fix(debugger): run debug adapters on the tool search path

Debug adapters were found on the tool search path but ran with the app's own PATH. When the login shell's PATH didn't reach the app, what an adapter starts in turn was missing although Run found it: js-debug's wrapper failed with "exec: node: not found", and Delve's go build with "exec: go: executable file not found in $PATH". Adapters now get the search path language servers get, unless the launch sets its own PATH (a selected SDK's bin first), and adapter binaries are resolved on it. Fixes #1690 Fixes #1707
fix(terminal): keep Windows shell paths intact (#1723 )
2026-11-08 03:08:18 -10:00 · 2026-11-06 14:40:08 +08:00 · 2026-11-06 14:24:59 +08:00 · 2026-11-06 14:14:44 +08:00 · 2026-11-06 13:30:19 +08:00 · 2026-11-06 13:24:59 +08:00
376 changed files with 15926 additions and 1107 deletions
@@ -0,0 +1,52 @@
+name: CNB mirror
+
+# Copies a published release to cnb.cool/l0ng-ai/openidea, the updater's CNB source
+# (scripts/cnb-mirror.ts). Release runs it after publishing; run it by hand to mirror
+# an existing tag again. Skipped without the CNB_TOKEN secret.
+on:
+  workflow_call:
+    inputs:
+      tag: { type: string, required: true }
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Published release to mirror (e.g. v0.1.38)"
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cnb-mirror-${{ inputs.tag }}
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      TAG: ${{ inputs.tag }}
+      CNB_TOKEN: ${{ secrets.CNB_TOKEN }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Check token
+        id: token
+        run: |
+          if [ -z "$CNB_TOKEN" ]; then
+            echo "::notice::CNB_TOKEN unset: not mirroring $TAG"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/checkout@v5
+        if: steps.token.outputs.skip != 'true'
+        with: { sparse-checkout: scripts }
+      - uses: actions/setup-node@v5
+        if: steps.token.outputs.skip != 'true'
+        with: { node-version: 22 }
+      - name: Download release
+        if: steps.token.outputs.skip != 'true'
+        run: |
+          gh release download "$TAG" -R "$GITHUB_REPOSITORY" -D assets
+          gh release view "$TAG" -R "$GITHUB_REPOSITORY" --json body,isPrerelease > assets/release.json
+          du -sh assets
+      - name: Upload to CNB
+        if: steps.token.outputs.skip != 'true'
+        run: node scripts/cnb-mirror.ts "$TAG" assets
@@ -355,3 +355,10 @@ jobs:
            await github.rest.repos.updateRelease({
              ...context.repo, release_id: Number(process.env.RELEASE_ID), draft: false,
            });
+
+  # The China mirror the updater's CNB source reads; a failure here leaves the GitHub release as is.
+  cnb-mirror:
+    needs: publish
+    uses: ./.github/workflows/cnb-mirror.yml
+    with: { tag: "${{ github.event.inputs.tag || github.ref_name }}" }
+    secrets: inherit
@@ -11,6 +11,7 @@
    "src/bindings.ts",
    "src/editor/core/cm/angular/parser*.ts",
    "src/editor/core/cm/jsp/parser*.ts",
+    "src/editor/core/cm/astro/parser*.ts",
    "docs/plugins/themes.md",
    "pnpm-lock.yaml",
    "**/*.toml",
@@ -14,6 +14,7 @@
    "crates",
    "src/bindings.ts",
    "src/editor/core/cm/angular/parser*.ts",
+    "src/editor/core/cm/astro/parser*.ts",
    "fixtures",
    "plugins",
    "test-results",
@@ -79,6 +79,8 @@ Shared agent skills live in `.agents/skills/` (`.claude/skills/` links to them):
  `pnpm gen:bindings`.
 - `pnpm perf` (UI interaction latency / frames / leaks), `pnpm perf:rust` (criterion
  benches vs budgets). Budgets: `perf/budgets.json`.
+- `pnpm release:prepare <version>` — the release commit's changes: app version everywhere,
+  `Cargo.lock`, and the plugin API snapshot when `wit/` moved to a new version.

 ## Before opening a PR

@@ -1496,7 +1496,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
 dependencies = [
 "quote",
- "syn 2.0.119",
+ "syn 3.0.9",
 ]

 [[package]]
@@ -1552,6 +1552,16 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "darling"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a01d95850c592940db9b8194bc39f4bc0e89dee5c4265e4b1807c34a9aba453c"
+dependencies = [
+ "darling_core 0.13.4",
+ "darling_macro 0.13.4",
+]
+
 [[package]]
 name = "darling"
 version = "0.23.0"
@@ -1572,6 +1582,20 @@ dependencies = [
 "darling_macro 0.24.1",
 ]

+[[package]]
+name = "darling_core"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "859d65a907b6852c9361e3185c862aae7fafd2887876799fa55f5f99dc40d610"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.10.0",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.23.0"
@@ -1581,7 +1605,7 @@ dependencies = [
 "ident_case",
 "proc-macro2",
 "quote",
- "strsim",
+ "strsim 0.11.1",
 "syn 2.0.119",
 ]

@@ -1594,10 +1618,21 @@ dependencies = [
 "ident_case",
 "proc-macro2",
 "quote",
- "strsim",
+ "strsim 0.11.1",
 "syn 3.0.9",
 ]

+[[package]]
+name = "darling_macro"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c972679f83bdf9c42bd905396b6c3588a843a17f0f16dfcfa3e2c5d57441835"
+dependencies = [
+ "darling_core 0.13.4",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
@@ -3001,7 +3036,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c48eccd894bd15555b0346470e63491ded94aefe76b3fcb1052084b5a393238"
 dependencies = [
 "bstr",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]

 [[package]]
@@ -4177,11 +4212,13 @@ dependencies = [
 name = "ide-dap"
 version = "0.1.37"
 dependencies = [
+ "futures",
 "ide-core",
 "ide-jsonrpc",
 "ide-language",
 "memchr",
 "parking_lot",
+ "portable-pty",
 "serde",
 "serde_json",
 "specta",
@@ -4201,6 +4238,7 @@ dependencies = [
 "ide-core",
 "ide-http",
 "ide-ssh",
+ "oracle",
 "parking_lot",
 "reqwest",
 "rustls",
@@ -4543,6 +4581,7 @@ dependencies = [
 "ignore",
 "parking_lot",
 "serde",
+ "serde_json",
 "specta",
 "tempfile",
 "tokio",
@@ -5974,7 +6013,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
 "bitflags 2.13.2",
- "block2 0.6.2",
 "dispatch2",
 "objc2 0.6.5",
 ]
@@ -6285,6 +6323,15 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "odpic-sys"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "920b5474a5128a9f0232df5a0ffc50aaa5b077b29b8b06ab0131985ac82793ed"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -6356,7 +6403,6 @@ dependencies = [
 "ide-workspace",
 "objc2 0.6.5",
 "objc2-app-kit 0.3.2",
- "objc2-core-foundation",
 "objc2-foundation 0.3.2",
 "objc2-web-kit 0.3.2",
 "parking_lot",
@@ -6396,6 +6442,32 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"

+[[package]]
+name = "oracle"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3db40fe6e4df881b683691ade5ef1f7b1afd52aefa115581f7b92855524d7ec0"
+dependencies = [
+ "cc",
+ "odpic-sys",
+ "once_cell",
+ "oracle_procmacro",
+ "paste",
+ "rustversion",
+]
+
+[[package]]
+name = "oracle_procmacro"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad247f3421d57de56a0d0408d3249d4b1048a522be2013656d92f022c3d8af27"
+dependencies = [
+ "darling 0.13.4",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "ordered-stream"
 version = "0.2.0"
@@ -8378,7 +8450,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d204abcbdf8e88729306a8d0ca01a79d8a49969fe1f84696909d6dbc4321c1a"
 dependencies = [
 "foldhash",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]

 [[package]]
@@ -8696,6 +8768,12 @@ dependencies = [
 "unicode-properties",
 ]

+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -8732,6 +8810,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
 dependencies = [
 "proc-macro2",
+ "quote",
 "unicode-ident",
 ]

@@ -8954,7 +9033,7 @@ dependencies = [
 "serde",
 "serde_json",
 "static_vcruntime",
- "strsim",
+ "strsim 0.11.1",
 "tauri-utils",
 "tauri-winres",
 "walkdir",
@@ -9980,9 +10059,9 @@ dependencies = [

 [[package]]
 name = "tree-sitter-haskell"
-version = "0.23.1"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "977c51e504548cba13fc27cb5a2edab2124cf6716a1934915d07ab99523b05a4"
+checksum = "781de30e0d1ec8e6db4ed799d36ce1cedaf4684374dada45ebe2a8ea44c3f814"
 dependencies = [
 "cc",
 "tree-sitter-language",
@@ -103,6 +103,7 @@ rustls = { version = "0.23", default-features = false, features = ["ring", "std"
 rustls-platform-verifier = "0.7"
 sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "tls-rustls-ring-webpki", "sqlite", "postgres", "mysql"] }
 tiberius = { version = "0.13", default-features = false, features = ["tds73", "rustls", "sql-browser-tokio"] }
+oracle = { version = "0.6", default-features = false }
 bb8 = "0.9"
 uuid = { version = "1", features = ["v4"] }
 # OS credential stores
@@ -68,4 +68,7 @@ the [official plugins](plugins/official). The plugin API is still a preview.

 [Apache 2.0](LICENSE). Bundled third-party assets are listed in [`THIRD_PARTY_LICENSES.md`](THIRD_PARTY_LICENSES.md).

+Database tool window notes, including Oracle Instant Client setup, are in
+[`docs/databases.md`](docs/databases.md).
+
 <sub>Not affiliated with JetBrains. IntelliJ IDEA is a trademark of JetBrains s.r.o.</sub>
@@ -2,8 +2,9 @@

 ## Project Lombok

-`java/lombok/lombok-1.18.48-openidea.2.jar` contains Project Lombok v1.18.48 with the Equinox
-classloader fix from [projectlombok/lombok#4059](https://github.com/projectlombok/lombok/pull/4059)
+`java/lombok/lombok-1.18.48-openidea.3.jar` contains Project Lombok v1.18.48 with the Equinox
+classloader fix from [projectlombok/lombok#4059](https://github.com/projectlombok/lombok/pull/4059),
+the [compact record constructor builder fix](java/lombok/patches/builder-compact-constructor.patch)
 and the ECJ constructor-call fix from [projectlombok/lombok#4089](https://github.com/projectlombok/lombok/pull/4089).
 Copyright (C) 2009-2021 The Project Lombok Authors. MIT license and bundled component
 notices are retained in [java/lombok/LICENSE](java/lombok/LICENSE) and inside the jar.
@@ -33,7 +34,8 @@ icon set, copied unmodified (some renamed) from JetBrains' open-source repositor
 - [intellij-plugins](https://github.com/JetBrains/intellij-plugins) (each plugin
  carries its own licence): `protobuf/protoeditor-core` (`newui/protoFile` →
  `fileTypes/protoFile`, Apache-2.0); `terraform` (`newui/hashiCorp` →
-  `fileTypes/hashiCorp`, Apache-2.0); `makefile` (`expui/makefile` →
+  `fileTypes/hashiCorp`, Apache-2.0); `Astro` (`icons/astro` → `fileTypes/astro`,
+  Apache-2.0); `makefile` (`expui/makefile` →
  `fileTypes/makefile`, MIT, Copyright (c) 2016 Victor Kropp — full text below).

 The read/write usage filter assets (`actions/showReadAccess{,_dark}.svg` and
@@ -882,7 +882,8 @@ mod tests {
        model.gradle[0].env.insert("JAVA_HOME".into(), "/external-jdk".into());
        let all = super::plan(&root, &model, super::BuildKind::Build, None, None).unwrap();
        assert_eq!(all.steps[0].cwd, external);
-        assert_eq!(all.steps[0].program, external.join(wrapper).to_string_lossy());
+        // Linked roots are saved with forward slashes, so on Windows the program mixes separators.
+        assert_eq!(std::path::Path::new(&all.steps[0].program), external.join(wrapper));
        let module = super::plan(&root, &model, super::BuildKind::Rebuild, Some(&source), None).unwrap();
        assert_eq!(module.steps[0].cwd, external);
        assert_eq!(module.steps[0].env["JAVA_HOME"], "/external-jdk");
@@ -229,6 +229,9 @@ pub enum DebugEvent {
        thread_id: i64,
        started: bool,
    },
+    /// The program runs in a terminal the IDE gave it (`runInTerminal`): what is typed for it
+    /// in the debug console reaches its input.
+    ProgramInput,
    BreakpointsChanged {
        path: crate::IpcPath,
    },
@@ -1,5 +1,5 @@
-//! Settings of remote work: SSH configurations, SFTP deployment and SSH run
-//! targets. The fields hang off `Settings` in `settings.rs`.
+//! Settings of remote work: SSH configurations, SFTP deployment and run
+//! targets (SSH, Docker, Compose). The fields hang off `Settings` in `settings.rs`.

 use serde::{Deserialize, Serialize};
 use specta::Type;
@@ -140,22 +140,55 @@ pub struct DeploymentMapping {
    pub web: String,
 }

-/// Build, Execution, Deployment › Run Targets: run configurations on another machine.
+/// Where a run target runs configurations.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub enum RunTargetKind {
+    /// Another machine over SSH, the project synchronised to its folder.
+    #[default]
+    Ssh,
+    /// A new container of an image (`docker run --rm`), the project bind-mounted.
+    Docker,
+    /// A new container of a Compose service (`docker compose run --rm`).
+    Compose,
+}
+
+/// Build, Execution, Deployment › Run Targets: run configurations on another machine
+/// or in a container.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
 pub struct RunTarget {
+    pub kind: RunTargetKind,
    pub id: String,
    pub name: String,
-    /// [`SshConfiguration::id`].
+    /// [`SshConfiguration::id`] (SSH).
    pub ssh_config: String,
-    /// Remote folder the project is synchronised to and run from.
+    /// Remote folder the project is synchronised to and run from (SSH).
    pub project_root: String,
-    /// Upload changed project files before each run.
+    /// Upload changed project files before each run (SSH).
    pub sync_before_run: bool,
    /// Interpreters on the target; empty = the one on the remote `PATH`.
    pub python: String,
    pub node: String,
    pub java: String,
+    /// Id of a Docker connection of the Services tool window (Docker, Compose);
+    /// empty = the CLI's own daemon.
+    pub docker_connection: String,
+    /// Image to run (Docker).
+    pub image: String,
+    /// Compose files, relative to the project; empty = the project's default one (Compose).
+    pub compose_files: Vec<String>,
+    /// Service to run (Compose).
+    pub service: String,
+    /// Where the project is in the container; empty = `/workspaces/<folder>` (Docker),
+    /// the service's bind mount of the project (Compose).
+    pub container_root: String,
+    /// Published ports, as `docker run --publish` takes them (`8000:8000`).
+    pub ports: Vec<String>,
+    /// More options for `docker run` / `docker compose run`, shell-like quoted.
+    pub run_options: String,
+    /// Run as the image's user instead of the project folder's owner (Linux).
+    pub image_user: bool,
 }

 #[cfg(test)]
@@ -176,4 +209,24 @@ mod deployment_tests {
            );
        }
    }
+
+    #[test]
+    fn run_target_kind_defaults_to_ssh_and_round_trips() {
+        let legacy: RunTarget =
+            serde_json::from_str(r#"{"id":"t","name":"Build box","sshConfig":"ssh","projectRoot":"/srv"}"#).unwrap();
+        assert_eq!((legacy.kind, legacy.ssh_config.as_str()), (RunTargetKind::Ssh, "ssh"));
+        let docker = RunTarget {
+            kind: RunTargetKind::Compose,
+            docker_connection: "local".into(),
+            compose_files: vec!["compose.dev.yaml".into()],
+            service: "web".into(),
+            ports: vec!["8000:8000".into()],
+            image_user: true,
+            ..legacy
+        };
+        let json = serde_json::to_value(&docker).unwrap();
+        assert_eq!(json["kind"], "compose");
+        assert_eq!(json["composeFiles"], serde_json::json!(["compose.dev.yaml"]));
+        assert_eq!(serde_json::from_value::<RunTarget>(json).unwrap(), docker);
+    }
 }
@@ -268,6 +268,8 @@ pub struct GeneralSettings {
    pub power_save_mode: bool,
    /// File › Rename Project… (project layer): the name shown for the project; empty = its folder name.
    pub project_name: String,
+    /// Where updates come from: `auto` (the CNB mirror for the Chinese UI, else GitHub) | `github` | `cnb`.
+    pub update_source: String,
 }

 impl Default for GeneralSettings {
@@ -282,6 +284,7 @@ impl Default for GeneralSettings {
            date_format: DateFormatSettings::default(),
            power_save_mode: false,
            project_name: String::new(),
+            update_source: "auto".into(),
        }
    }
 }
@@ -6,6 +6,7 @@ edition.workspace = true
 license.workspace = true

 [dependencies]
+futures.workspace = true
 tempfile.workspace = true
 ide-core.workspace = true
 ide-language.workspace = true
@@ -16,6 +17,7 @@ specta.workspace = true
 tokio = { workspace = true, features = ["net"] }
 parking_lot.workspace = true
 memchr = "2"
+portable-pty.workspace = true
 tracing.workspace = true

 [dev-dependencies]
@@ -64,13 +64,13 @@ fn builtin(adapter: &str) -> Option<DebuggerConfig> {
            "codelldb",
            &["--port", PORT_PLACEHOLDER],
            "tcp",
-            "Install the CodeLLDB adapter (https://github.com/vadimcn/codelldb/releases) and put `codelldb` on PATH",
+            "Install CodeLLDB in Settings › Languages & Frameworks › Language Servers",
        ),
        "kotlin-debug-adapter" => cfg(
            "kotlin-debug-adapter",
            &[],
            "stdio",
-            "Install the Kotlin Debug Adapter from Settings > Language Servers",
+            "Install Kotlin Debug Adapter in Settings › Languages & Frameworks › Language Servers",
        ),
        // Windows installs `python.exe`; `python3.exe` there is at most a Store alias.
        "debugpy" => cfg(
@@ -84,7 +84,7 @@ fn builtin(adapter: &str) -> Option<DebuggerConfig> {
            // Without a host it listens on `localhost`, which may resolve to ::1 only.
            &[PORT_PLACEHOLDER, "127.0.0.1"],
            "tcp",
-            "Install vscode-js-debug's DAP server (js-debug-dap-*.tar.gz from https://github.com/microsoft/vscode-js-debug/releases) as `js-debug-adapter`",
+            "Install JavaScript Debugger (vscode-js-debug) in Settings › Languages & Frameworks › Language Servers",
        ),
        "delve" => cfg(
            "dlv",
@@ -96,7 +96,7 @@ fn builtin(adapter: &str) -> Option<DebuggerConfig> {
            "netcoredbg",
            &["--interpreter=vscode"],
            "stdio",
-            "Install Samsung netcoredbg (https://github.com/Samsung/netcoredbg/releases)",
+            "Install netcoredbg (.NET debugger) in Settings › Languages & Frameworks › Language Servers",
        ),
        "lldb-dap" => {
            cfg("lldb-dap", &[], "stdio", "Install LLVM's lldb-dap (brew install llvm; on macOS `xcrun -f lldb-dap`)")
@@ -196,10 +196,18 @@ fn managed_dirs(root: &Path) -> Vec<PathBuf> {
    dirs
 }

+/// The `PATH` an adapter runs with, unless its launch sets one: the search path language servers
+/// get, so what it starts in turn (js-debug's wrapper runs `node`, Delve runs `go build`) is
+/// found like Run finds it, even when the login shell's `PATH` didn't reach the app.
+fn adapter_path(env: &[(String, String)]) -> Option<std::ffi::OsString> {
+    let own = env.iter().any(|(k, _)| if cfg!(windows) { k.eq_ignore_ascii_case("PATH") } else { k == "PATH" });
+    (!own).then(ide_core::tool_path::search_path)
+}
+
 /// Directories searched for adapter binaries: managed tools first, then `PATH` and the usual install spots.
 fn search_dirs() -> Vec<PathBuf> {
    let mut dirs: Vec<PathBuf> = tools_root().map(|r| managed_dirs(&r)).unwrap_or_default();
-    dirs.extend(std::env::var_os("PATH").map(|p| std::env::split_paths(&p).collect::<Vec<_>>()).unwrap_or_default());
+    dirs.extend(std::env::split_paths(&ide_core::tool_path::search_path()));
    if let Some(home) = std::env::var_os("HOME").map(PathBuf::from) {
        for rel in [".cargo/bin", ".local/bin", "go/bin", ".dotnet/tools", ".bun/bin", ".npm-global/bin", ".volta/bin"]
        {
@@ -464,6 +472,9 @@ impl AdapterLauncher for ProcessLauncher {
                None => args,
            };
            let mut cmd = Command::new(&binary);
+            if let Some(path) = adapter_path(&spec.env) {
+                cmd.env("PATH", path);
+            }
            ide_core::process::prepare(cmd.as_std_mut());
            cmd.args(&args)
                .envs(spec.env.iter().map(|(k, v)| (k, v)))
@@ -592,6 +603,21 @@ async fn connect_with_retries(
 mod tests {
    use super::*;

+    #[test]
+    fn adapters_run_on_the_tool_search_path() {
+        let search = ide_core::tool_path::search_path();
+        assert_eq!(adapter_path(&[]), Some(search.clone()));
+        assert_eq!(adapter_path(&[("GOFLAGS".into(), "-mod=mod".into())]), Some(search));
+        // A launch that sets its own (a selected Go SDK's bin first) keeps it.
+        assert_eq!(adapter_path(&[("PATH".into(), "/sdk/go/bin:/usr/bin".into())]), None);
+        // The search path reaches the usual install spots even when this process's `PATH` doesn't.
+        #[cfg(unix)]
+        {
+            let dirs: Vec<PathBuf> = std::env::split_paths(&ide_core::tool_path::search_path()).collect();
+            assert!(dirs.contains(&PathBuf::from("/usr/local/bin")), "{dirs:?}");
+        }
+    }
+
    #[tokio::test]
    async fn program_output_is_forwarded_without_the_adapter_banner() {
        let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel();
@@ -668,7 +694,7 @@ mod tests {
        assert!(find_binary("definitely-not-a-real-binary-openidea", &spec.cwd).is_none());
        let err = missing(&spec);
        assert_eq!(err.kind, ide_core::error::ErrorKind::Unavailable);
-        assert!(err.message.contains("netcoredbg/releases"));
+        assert!(err.message.contains("Settings › Languages & Frameworks › Language Servers"));
    }

    #[tokio::test]
@@ -19,6 +19,7 @@ mod session;

 use adapter::{AdapterLauncher, AdapterSpec, ProcessLauncher};
 use connection::{Connection, DapError};
+use futures::future::join_all;
 use ide_core::{DebugSessionId, IdeError, IdeResult, SharedSink};
 use ide_language::LanguageRegistry;
 use parking_lot::Mutex;
@@ -510,6 +511,18 @@ pub(crate) fn capabilities_from(caps: &Value) -> DebugCapabilities {
    }
 }

+/// States of a file's line breakpoints that no session has been sent.
+fn unsent(breakpoints: &[Breakpoint]) -> Vec<BreakpointState> {
+    breakpoints
+        .iter()
+        .map(|b| BreakpointState {
+            line: b.line,
+            verified: false,
+            message: (!b.enabled).then(|| "Disabled".to_owned()),
+        })
+        .collect()
+}
+
 /// States for breakpoints no session has verified yet.
 fn unverified(enabled: impl Iterator<Item = bool>) -> Vec<BreakpointState> {
    enabled
@@ -877,12 +890,20 @@ impl DebugManager {
            let _ = tokio::time::timeout(INIT_TIMEOUT, initialized.wait_for(|v| *v)).await;
        }

-        let files: Vec<(PathBuf, Vec<Breakpoint>)> =
-            self.breakpoints.lock().iter().map(|(p, b)| (p.clone(), b.clone())).collect();
+        // A fresh adapter has no breakpoints, so a file with none enabled needs no request; the
+        // others go out together, as VS Code sends them, instead of one round trip per file.
+        let (files, idle): (Vec<_>, Vec<_>) = self
+            .breakpoints
+            .lock()
+            .iter()
+            .map(|(p, b)| (p.clone(), b.clone()))
+            .partition(|(_, b)| b.iter().any(|b| b.enabled));
+        let sent = join_all(files.iter().map(|(path, bps)| s.send_breakpoints(path, bps, None))).await;
        // Breakpoint states follow the owner's first session.
        let first = self.live_sessions().into_iter().find(|f| f.owner.key == s.owner.key).map(|f| f.id) == Some(s.id);
-        for (path, bps) in files {
-            match s.send_breakpoints(&path, &bps, None).await {
+        let idle = idle.into_iter().map(|(path, bps)| (path, Ok(unsent(&bps))));
+        for (path, result) in files.into_iter().map(|(path, _)| path).zip(sent).chain(idle) {
+            match result {
                Ok(states) => {
                    if first {
                        self.states.lock().insert(path.clone(), states);
@@ -990,16 +1011,7 @@ impl DebugManager {
                Err(e) => tracing::debug!("setBreakpoints on session {} failed: {e}", s.id.0),
            }
        }
-        let states = result.unwrap_or_else(|| {
-            breakpoints
-                .iter()
-                .map(|b| BreakpointState {
-                    line: b.line,
-                    verified: false,
-                    message: (!b.enabled).then(|| "Disabled".to_owned()),
-                })
-                .collect()
-        });
+        let states = result.unwrap_or_else(|| unsent(&breakpoints));
        self.states.lock().insert(path, states.clone());
        Ok(states)
    }
@@ -1266,6 +1278,16 @@ impl DebugManager {
        Ok(())
    }

+    /// Types `text` into the terminal the session's program runs in (see [`ide_core::event::DebugEvent::ProgramInput`]).
+    pub fn send_input(&self, s: DebugSessionId, text: &str) -> IdeResult<()> {
+        let session = self.session(s)?;
+        let mut program = session.program.lock();
+        let program = program
+            .as_mut()
+            .ok_or_else(|| IdeError::invalid("The program doesn't read input from the debug console"))?;
+        program.write(text).map_err(|e| IdeError::internal(format!("cannot write to the program: {e}")))
+    }
+
    /// Flutter's DAP adapter: injects the changed sources into the running app.
    /// Not part of the DAP standard; adapters that do not know the request reject it.
    pub async fn hot_reload(&self, s: DebugSessionId) -> IdeResult<()> {
@@ -1317,13 +1339,26 @@ impl DebugManager {
    /// Sends empty breakpoint lists (line, function, data) to `session` until its next
    /// stop, when the stored ones are restored. `except` is left to the caller.
    async fn suspend_breakpoints(&self, session: &Arc<Session>, except: Option<&Path>) -> IdeResult<()> {
-        let files: Vec<PathBuf> = self.breakpoints.lock().keys().cloned().collect();
-        for path in files {
-            if Some(path.as_path()) == except {
-                continue;
+        // While paused the adapter holds the stored lists: only files with something enabled change.
+        let files: Vec<PathBuf> = self
+            .breakpoints
+            .lock()
+            .iter()
+            .filter(|(path, bps)| Some(path.as_path()) != except && bps.iter().any(|b| b.enabled))
+            .map(|(path, _)| path.clone())
+            .collect();
+        let sent = join_all(files.iter().map(|path| session.send_breakpoints(path, &[], None))).await;
+        let mut failed = None;
+        for (path, result) in files.into_iter().zip(sent) {
+            match result {
+                Ok(_) => {
+                    session.pending_restore.lock().files.insert(path);
+                }
+                Err(e) => failed = failed.or(Some(e)),
            }
-            session.send_breakpoints(&path, &[], None).await?;
-            session.pending_restore.lock().files.insert(path);
+        }
+        if let Some(e) = failed {
+            return Err(e.into());
        }
        if !self.function_breakpoints.lock().is_empty() && session.supports("supportsFunctionBreakpoints") {
            session.send_function_breakpoints(&[]).await?;
@@ -1339,9 +1374,11 @@ impl DebugManager {
    /// Re-sends what [`suspend_breakpoints`](Self::suspend_breakpoints) / run to cursor replaced.
    pub(crate) async fn restore_breakpoints(&self, session: &Arc<Session>) {
        let pending = std::mem::take(&mut *session.pending_restore.lock());
-        for path in pending.files {
-            let bps = self.stored_breakpoints(&path);
-            if let Err(e) = session.send_breakpoints(&path, &bps, None).await {
+        let files: Vec<(PathBuf, Vec<Breakpoint>)> =
+            pending.files.into_iter().map(|path| (path.clone(), self.stored_breakpoints(&path))).collect();
+        let sent = join_all(files.iter().map(|(path, bps)| session.send_breakpoints(path, bps, None))).await;
+        for ((path, _), result) in files.iter().zip(sent) {
+            if let Err(e) = result {
                tracing::debug!("restoring breakpoints of {} failed: {e}", path.display());
            }
        }
@@ -43,6 +43,8 @@ pub(crate) struct Session {
    pub adapter_process: Mutex<Option<Child>>,
    /// Processes started for `runInTerminal`.
    pub debuggees: Mutex<Vec<Child>>,
+    /// The terminal a `runInTerminal` program runs in: typed input goes to it.
+    pub program: Mutex<Option<ProgramTerminal>>,
    /// Set once `configurationDone` was sent; breakpoint updates go out live after that.
    pub configured: AtomicBool,
    pub initialized: watch::Sender<bool>,
@@ -90,6 +92,7 @@ impl Session {
            caps: Mutex::new(Value::Null),
            adapter_process: Mutex::new(child),
            debuggees: Mutex::new(Vec::new()),
+            program: Mutex::new(None),
            configured: AtomicBool::new(false),
            initialized: watch::channel(false).0,
            terminated: AtomicBool::new(false),
@@ -266,6 +269,9 @@ impl Session {
        for mut c in std::mem::take(&mut *self.debuggees.lock()) {
            let _ = c.start_kill();
        }
+        if let Some(mut program) = self.program.lock().take() {
+            let _ = program.child.kill();
+        }
    }
 }

@@ -451,8 +457,25 @@ fn on_reverse_request(mgr: &Arc<DebugManager>, s: &Arc<Session>, seq: i64, comma
    }
 }

-/// `runInTerminal`: spawns the debuggee directly and forwards its output to the console.
+/// A `runInTerminal` program and the pseudo-terminal it runs in.
+pub(crate) struct ProgramTerminal {
+    writer: Box<dyn std::io::Write + Send>,
+    child: Box<dyn portable_pty::Child + Send + Sync>,
+    _master: Box<dyn portable_pty::MasterPty + Send>,
+}
+
+impl ProgramTerminal {
+    pub(crate) fn write(&mut self, text: &str) -> std::io::Result<()> {
+        self.writer.write_all(text.as_bytes())?;
+        self.writer.flush()
+    }
+}
+
+/// `runInTerminal`: starts the debuggee on a pseudo-terminal, as an IDE terminal would (CodeLLDB
+/// starts a launcher that gives the program its terminal, and the program reads input only from
+/// a terminal), forwards its output to the console, and keeps the terminal for typed input.
 pub(crate) fn run_in_terminal(s: &Arc<Session>, args: &Value) -> Result<Value, String> {
+    use portable_pty::{CommandBuilder, PtySize, native_pty_system};
    let argv: Vec<String> = args
        .get("args")
        .and_then(Value::as_array)
@@ -461,16 +484,25 @@ pub(crate) fn run_in_terminal(s: &Arc<Session>, args: &Value) -> Result<Value, S
    let Some((program, rest)) = argv.split_first() else {
        return Err("runInTerminal without args".into());
    };
-    let mut cmd = tokio::process::Command::new(program);
-    ide_core::process::prepare(cmd.as_std_mut());
-    cmd.args(rest)
-        .envs(ide_core::process::shell_env())
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .kill_on_drop(true);
-    if let Some(cwd) = args.get("cwd").and_then(Value::as_str).filter(|c| !c.is_empty()) {
-        cmd.current_dir(cwd);
+    let pair = native_pty_system()
+        .openpty(PtySize { rows: 24, cols: 200, pixel_width: 0, pixel_height: 0 })
+        .map_err(|e| format!("cannot open a terminal for {program}: {e}"))?;
+    let mut cmd = CommandBuilder::new(program);
+    // CodeLLDB's launcher clears the terminal first; the console keeps the session's earlier output.
+    cmd.args(rest.iter().filter(|a| *a != "--clear-screen"));
+    for (k, v) in ide_core::process::host_env_fixes() {
+        match v {
+            Some(v) => cmd.env(k, v),
+            None => cmd.env_remove(k),
+        }
+    }
+    for (k, v) in ide_core::process::shell_env() {
+        cmd.env(k, v);
+    }
+    cmd.env("TERM", "xterm-256color");
+    match args.get("cwd").and_then(Value::as_str).filter(|c| !c.is_empty()) {
+        Some(cwd) => cmd.cwd(cwd),
+        None => cmd.cwd(&s.spec.cwd),
    }
    if let Some(env) = args.get("env").and_then(Value::as_object) {
        for (k, v) in env {
@@ -480,18 +512,53 @@ pub(crate) fn run_in_terminal(s: &Arc<Session>, args: &Value) -> Result<Value, S
            };
        }
    }
-    let mut child = cmd.spawn().map_err(|e| format!("failed to start {program}: {e}"))?;
-    let pid = child.id();
-    if let Some(out) = child.stdout.take() {
-        forward_output(s, out, "stdout");
+    let child = pair.slave.spawn_command(cmd).map_err(|e| format!("failed to start {program}: {e}"))?;
+    drop(pair.slave);
+    let reader = pair.master.try_clone_reader().map_err(|e| format!("terminal of {program}: {e}"))?;
+    let writer = pair.master.take_writer().map_err(|e| format!("terminal of {program}: {e}"))?;
+    let pid = child.process_id();
+    forward_terminal_output(s, reader);
+    if let Some(mut previous) = s.program.lock().replace(ProgramTerminal { writer, child, _master: pair.master }) {
+        let _ = previous.child.kill();
    }
-    if let Some(err) = child.stderr.take() {
-        forward_output(s, err, "stderr");
-    }
-    s.debuggees.lock().push(child);
+    s.owner.sink.emit(IdeEvent::Debug { session: s.id, event: DebugEvent::ProgramInput });
    Ok(json!({ "processId": pid }))
 }

+/// The program's terminal output, as stdout lines (`\r\n` as `\n`; colours are kept).
+fn forward_terminal_output(s: &Session, mut reader: Box<dyn std::io::Read + Send>) {
+    let session = s.id;
+    let sink = s.owner.sink.clone();
+    let _ = std::thread::Builder::new().name(format!("openidea-debuggee-{}", session.0)).spawn(move || {
+        let mut buf = vec![0u8; 8192];
+        let mut pending: Vec<u8> = Vec::new();
+        loop {
+            match reader.read(&mut buf) {
+                Ok(0) | Err(_) => break,
+                Ok(n) => pending.extend_from_slice(&buf[..n]),
+            }
+            // Keep incomplete UTF-8 sequences, and a `\r` that may start a `\r\n`, for the next chunk.
+            let mut valid = match std::str::from_utf8(&pending) {
+                Ok(_) => pending.len(),
+                Err(e) if e.error_len().is_none() => e.valid_up_to(),
+                Err(_) => pending.len(),
+            };
+            if valid > 0 && pending[valid - 1] == b'\r' {
+                valid -= 1;
+            }
+            let output = String::from_utf8_lossy(&pending[..valid]).replace("\r\n", "\n");
+            pending.drain(..valid);
+            if !output.is_empty() {
+                sink.emit(IdeEvent::Debug { session, event: DebugEvent::Output { category: "stdout".into(), output } });
+            }
+        }
+        if !pending.is_empty() {
+            let output = String::from_utf8_lossy(&pending).replace("\r\n", "\n");
+            sink.emit(IdeEvent::Debug { session, event: DebugEvent::Output { category: "stdout".into(), output } });
+        }
+    });
+}
+
 fn forward_output<R: AsyncRead + Unpin + Send + 'static>(s: &Session, mut stream: R, category: &'static str) {
    let session = s.id;
    let sink = s.owner.sink.clone();
@@ -17,6 +17,8 @@ struct Script {
    start_debugging: bool,
    ignore_configuration_done: bool,
    source_path: Option<String>,
+    /// Answer `setBreakpoints` only once this many are waiting (a client that waits for each never gets one).
+    hold_set_breakpoints: usize,
 }

 struct FakeLauncher {
@@ -49,6 +51,7 @@ async fn fake_adapter<S: AsyncRead + AsyncWrite + Unpin + Send + 'static>(stream
    let mut r = BufReader::new(r);
    let mut seq = 1000;
    let mut pending_launch: Option<i64> = None;
+    let mut held: Vec<Value> = Vec::new();
    macro_rules! send {
        ($v:expr) => {{
            let mut v: Value = $v;
@@ -101,14 +104,20 @@ async fn fake_adapter<S: AsyncRead + AsyncWrite + Unpin + Send + 'static>(stream
                send!(json!({"type": "event", "event": "initialized"}));
            }
            "setBreakpoints" => {
-                let bps: Vec<Value> = msg["arguments"]["breakpoints"]
-                    .as_array()
-                    .unwrap()
-                    .iter()
-                    .enumerate()
-                    .map(|(i, b)| json!({"id": i + 1, "verified": true, "line": b["line"]}))
-                    .collect();
-                ok!(msg, json!({"breakpoints": bps}));
+                held.push(msg);
+                if held.len() < script.hold_set_breakpoints {
+                    continue;
+                }
+                for msg in std::mem::take(&mut held) {
+                    let bps: Vec<Value> = msg["arguments"]["breakpoints"]
+                        .as_array()
+                        .unwrap()
+                        .iter()
+                        .enumerate()
+                        .map(|(i, b)| json!({"id": i + 1, "verified": true, "line": b["line"]}))
+                        .collect();
+                    ok!(msg, json!({"breakpoints": bps}));
+                }
            }
            "setExceptionBreakpoints" => ok!(msg, json!({})),
            "setFunctionBreakpoints" | "setDataBreakpoints" => {
@@ -468,6 +477,40 @@ async fn run_in_terminal_spawns_debuggee() {
    assert!(response["body"]["processId"].as_u64().unwrap() > 0);
 }

+#[cfg(unix)]
+#[tokio::test]
+async fn run_in_terminal_program_reads_typed_input() {
+    let h = harness(Script {
+        // CodeLLDB's launcher asks to clear the terminal; the console keeps its output.
+        run_in_terminal: Some(vec![
+            "sh".into(),
+            "-c".into(),
+            "[ -t 0 ] && echo 'name?' && read name && echo \"hello $name\"".into(),
+            "--clear-screen".into(),
+        ]),
+        ..Script::default()
+    });
+    let session = h.start(config()).await.unwrap();
+    h.wait_event(|e| matches!(e, DebugEvent::ProgramInput)).await;
+    h.wait_event(|e| matches!(e, DebugEvent::Output { output, .. } if output.contains("name?"))).await;
+    h.manager.send_input(session, "Bob\n").unwrap();
+    h.wait_event(|e| matches!(e, DebugEvent::Output { output, .. } if output.contains("hello Bob"))).await;
+    let output: String = h
+        .events
+        .lock()
+        .iter()
+        .filter_map(|e| match e {
+            IdeEvent::Debug { event: DebugEvent::Output { category, output }, .. } if category == "stdout" => {
+                Some(output.clone())
+            }
+            _ => None,
+        })
+        .collect();
+    assert!(!output.contains('\r'), "{output:?}");
+    h.manager.stop(session).await.unwrap();
+    assert!(h.manager.send_input(session, "x\n").is_err());
+}
+
 #[test]
 fn launch_arguments_merge_and_defaults() {
    let mut c = config();
@@ -887,6 +930,7 @@ async fn force_stepping_suspends_breakpoints_until_the_next_stop() {
    let b = PathBuf::from("/p/b.py");
    h.manager.set_breakpoints(a.clone(), vec![bp(1)]).await.unwrap();
    h.manager.set_breakpoints(b.clone(), vec![bp(3)]).await.unwrap();
+    h.manager.set_breakpoints(PathBuf::from("/p/off.py"), vec![Breakpoint { enabled: false, ..bp(5) }]).await.unwrap();
    h.manager.set_function_breakpoints(vec![function_bp("run", true)]).await.unwrap();
    let id = h.start(config()).await.unwrap();
    h.wait_event(|e| matches!(e, DebugEvent::Stopped { .. })).await;
@@ -915,6 +959,24 @@ async fn force_stepping_suspends_breakpoints_until_the_next_stop() {
    h.manager.run_to(id, 1, a.clone(), 9, true).await.unwrap();
    assert_eq!(sent_for("/p/a.py").last().unwrap(), &json!([{"line": 10}]));
    assert_eq!(sent_for("/p/b.py").last().unwrap(), &json!([]));
+    assert!(sent_for("/p/off.py").is_empty(), "nothing enabled there, nothing to suspend or restore");
+}
+
+#[tokio::test]
+async fn startup_sends_every_file_at_once_and_skips_files_with_nothing_enabled() {
+    let h = harness(Script { hold_set_breakpoints: 2, ..Script::default() });
+    h.manager.set_breakpoints(PathBuf::from("/p/a.py"), vec![bp(1)]).await.unwrap();
+    h.manager.set_breakpoints(PathBuf::from("/p/b.py"), vec![bp(3)]).await.unwrap();
+    let off = PathBuf::from("/p/off.py");
+    h.manager.set_breakpoints(off.clone(), vec![Breakpoint { enabled: false, ..bp(5) }]).await.unwrap();
+    // Waiting for each answer before the next request would stall until the request timeout.
+    tokio::time::timeout(Duration::from_secs(5), h.start(config())).await.expect("requests pipelined").unwrap();
+    let paths: Vec<Value> = requests(&h, "setBreakpoints").into_iter().map(|r| r["source"]["path"].clone()).collect();
+    assert_eq!(paths, [json!("/p/a.py"), json!("/p/b.py")]);
+    assert_eq!(
+        h.manager.breakpoint_states(&off),
+        [BreakpointState { line: 5, verified: false, message: Some("Disabled".into()) }]
+    );
 }

 #[tokio::test]
@@ -0,0 +1,140 @@
+//! Drives php-debug (vscode-php-debug) the way a PHP Remote Debug (Xdebug)
+//! configuration does: a launch without a program makes it listen, and every PHP
+//! run that Xdebug connects stops at the breakpoint set in the local copy of the
+//! file, through `pathMappings`, until the session is stopped. A second listener on
+//! the same port fails to start and names the port.
+//!
+//! Ignored by default (needs PHP with Xdebug 3, Node.js and php-debug). Run with
+//! `PHP_DEBUG_ADAPTER=<php-debug-adapter> cargo test -p ide-dap --test php_debug -- --ignored --nocapture`
+//! (`PHP_BIN` picks the PHP executable, default `php`).
+
+use ide_core::event::DebugEvent;
+use ide_core::ipc_path::to_ipc;
+use ide_core::{IdeEvent, SharedSink};
+use ide_dap::*;
+use ide_language::LanguageRegistry;
+use parking_lot::Mutex;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+const SCRIPT: &str = "<?php\n$greeting = \"hello\";\n$n = 40 + 2;\necho \"$greeting $n\\n\";\n";
+/// 0-based line of `$n = 40 + 2;`.
+const BREAK_LINE: u32 = 2;
+
+async fn wait_for(events: &Mutex<Vec<IdeEvent>>, timeout: Duration, pred: impl Fn(&DebugEvent) -> bool) -> DebugEvent {
+    let start = Instant::now();
+    loop {
+        if let Some(e) = events.lock().iter().find_map(|e| match e {
+            IdeEvent::Debug { event, .. } if pred(event) => Some(event.clone()),
+            _ => None,
+        }) {
+            return e;
+        }
+        assert!(start.elapsed() < timeout, "timed out; events: {:#?}", events.lock());
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+}
+
+fn listen_config(port: u16, served: &Path, local: &Path) -> LaunchConfig {
+    // As remote.ts builds it for Remote root = `served`, Local root = `local`.
+    let mapping = serde_json::Map::from_iter([(to_ipc(served), to_ipc(local).into())]);
+    LaunchConfig {
+        name: "PHP Remote".into(),
+        adapter: "php-debug".into(),
+        request: "launch".into(),
+        program: None,
+        args: vec![],
+        cwd: Some(local.to_path_buf().into()),
+        env: BTreeMap::new(),
+        extra_json: Some(serde_json::json!({ "port": port, "pathMappings": mapping }).to_string()),
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+#[ignore]
+async fn listens_for_xdebug_until_stopped_with_path_mappings() {
+    let Ok(adapter) = std::env::var("PHP_DEBUG_ADAPTER") else {
+        eprintln!("PHP_DEBUG_ADAPTER not set; skipping");
+        return;
+    };
+    let php = std::env::var("PHP_BIN").unwrap_or_else(|_| "php".into());
+    let dir = tempfile::tempdir().unwrap();
+    // The project here, and the copy PHP runs from (a container's /var/www/html).
+    let (local, served) = (dir.path().join("local"), dir.path().join("served"));
+    for d in [&local, &served] {
+        std::fs::create_dir_all(d).unwrap();
+        std::fs::write(d.join("index.php"), SCRIPT).unwrap();
+    }
+    // Resolved like the project root the UI sends (`/private/var` on macOS, no `\\?\` on Windows).
+    let resolved = |p: &Path| PathBuf::from(to_ipc(&std::fs::canonicalize(p).unwrap()));
+    let (local, served) = (resolved(&local), resolved(&served));
+    let port = std::net::TcpListener::bind(("127.0.0.1", 0)).unwrap().local_addr().unwrap().port();
+
+    let manager = DebugManager::new(Arc::new(LanguageRegistry::load(None).unwrap()));
+    let events: Arc<Mutex<Vec<IdeEvent>>> = Arc::default();
+    let sink: SharedSink = {
+        let events = events.clone();
+        Arc::new(move |e: IdeEvent| events.lock().push(e))
+    };
+    let local_script = local.join("index.php");
+    manager
+        .set_breakpoints(
+            local_script.clone(),
+            vec![Breakpoint {
+                line: BREAK_LINE,
+                condition: None,
+                hit_condition: None,
+                log_message: None,
+                enabled: true,
+            }],
+        )
+        .await
+        .unwrap();
+    let id = manager
+        .start_with(listen_config(port, &served, &local), SessionOwner::new("main", sink.clone()), |_| {
+            Some(adapter.clone())
+        })
+        .await
+        .unwrap_or_else(|e| panic!("start: {e:?}"));
+
+    // Requests in a row each stop; the session keeps listening between them.
+    for request in 1..=2 {
+        events.lock().clear();
+        let run = std::process::Command::new(&php)
+            .args([
+                "-dxdebug.mode=debug",
+                "-dxdebug.start_with_request=yes",
+                "-dxdebug.client_host=127.0.0.1",
+                &format!("-dxdebug.client_port={port}"),
+                "index.php",
+            ])
+            .current_dir(&served)
+            .stdout(std::process::Stdio::piped())
+            .spawn()
+            .unwrap();
+        let stopped = wait_for(&events, Duration::from_secs(30), |e| matches!(e, DebugEvent::Stopped { .. })).await;
+        let DebugEvent::Stopped { thread_id, .. } = stopped else { unreachable!() };
+        let frames = manager.stack_trace(id, thread_id).await.unwrap();
+        assert_eq!(frames[0].line, BREAK_LINE, "request {request}");
+        let top = frames[0].path.as_deref().and_then(|p| p.canonicalize().ok());
+        assert_eq!(top, local_script.canonicalize().ok(), "request {request}");
+        manager.resume(id, thread_id).await.unwrap();
+        wait_for(&events, Duration::from_secs(30), |e| matches!(e, DebugEvent::Thread { started: false, .. })).await;
+        let out = run.wait_with_output().unwrap();
+        assert_eq!(String::from_utf8_lossy(&out.stdout), "hello 42\n", "request {request}");
+        assert!(manager.sessions(None).iter().any(|s| s.id == id), "still listening after request {request}");
+    }
+
+    // Another listener on the port (another IDE): the start fails and says why.
+    let err = manager
+        .start_with(listen_config(port, &served, &local), SessionOwner::new("main", sink), |_| Some(adapter.clone()))
+        .await
+        .expect_err("a second listener on the same port");
+    assert!(err.message.contains("EADDRINUSE") && err.message.ends_with(&format!(":{port}")), "{err:?}");
+    assert_eq!(manager.sessions(None).len(), 1);
+
+    manager.stop(id).await.unwrap();
+    assert!(manager.sessions(None).is_empty());
+}
@@ -17,6 +17,7 @@ parking_lot.workspace = true
 futures.workspace = true
 sqlx.workspace = true
 tiberius.workspace = true
+oracle.workspace = true
 bb8.workspace = true
 tokio-util = { workspace = true, features = ["compat"] }
 dirs.workspace = true
@@ -107,6 +107,7 @@ pub enum Pool {
    Mysql(MySqlPool),
    SqlServer(Bb8Pool<MssqlConnectionManager>),
    Clickhouse(crate::clickhouse::ClickhousePool),
+    Oracle(crate::oracle::OraclePool),
 }

 /// Runs `$body` with `$p` bound to the concrete pool of each driver.
@@ -116,7 +117,7 @@ macro_rules! with_pool {
            Pool::Sqlite($p) => $body,
            Pool::Postgres($p) => $body,
            Pool::Mysql($p) => $body,
-            Pool::SqlServer(_) | Pool::Clickhouse(_) => unreachable!(),
+            Pool::SqlServer(_) | Pool::Clickhouse(_) | Pool::Oracle(_) => unreachable!(),
        }
    };
 }
@@ -262,7 +263,7 @@ fn tiberius_cell(cell: &tiberius::ColumnData<'_>, ty: tiberius::ColumnType) -> O
    }
 }

-fn hex(bytes: &[u8]) -> String {
+pub(crate) fn hex(bytes: &[u8]) -> String {
    let mut s = String::with_capacity(2 + bytes.len() * 2);
    s.push_str("0x");
    for b in bytes {
@@ -386,7 +387,7 @@ macro_rules! fetch {
 }

 /// Columns, rows, rows affected, more rows beyond the limit, time of the first answer.
-type Fetched = (Vec<ResultColumn>, Vec<Vec<Option<String>>>, Option<u64>, bool, Option<Instant>);
+pub(crate) type Fetched = (Vec<ResultColumn>, Vec<Vec<Option<String>>>, Option<u64>, bool, Option<Instant>);

 async fn mssql_command(conn: &mut MssqlClient, sql: &str) -> IdeResult<()> {
    // Transaction control must be a batch: sp_executesql rejects a changed transaction count.
@@ -503,6 +504,18 @@ impl Setup {
                }
            }
            DbDriver::Mysql if source.read_only => s.statements.push("SET SESSION TRANSACTION READ ONLY".into()),
+            DbDriver::Oracle => {
+                let schema = o.default_schema.trim();
+                if !schema.is_empty() {
+                    if !is_identifier(schema) {
+                        return Err(IdeError::invalid(format!("invalid schema name: {schema}")));
+                    }
+                    s.statements.push(format!("ALTER SESSION SET CURRENT_SCHEMA = {schema}"));
+                }
+                if !o.time_zone.trim().is_empty() {
+                    s.statements.push(format!("ALTER SESSION SET TIME_ZONE = {}", mysql_value(o.time_zone.trim())));
+                }
+            }
            _ => {}
        }
        for p in &source.properties {
@@ -527,6 +540,9 @@ impl Setup {
                (DbDriver::Mysql, "charset") => s.charset = Some(value.to_owned()),
                (DbDriver::Mysql, "collation") => s.collation = Some(value.to_owned()),
                (DbDriver::Mysql, _) => s.statements.push(format!("SET SESSION {name} = {}", mysql_value(value))),
+                (DbDriver::Oracle, _) => {
+                    s.statements.push(format!("ALTER SESSION SET {name} = {}", mysql_value(value)))
+                }
                _ => s.params.push((name, value.to_owned())),
            }
        }
@@ -549,6 +565,15 @@ impl Pool {
            Pool::Mysql(_) => DbDriver::Mysql,
            Pool::SqlServer(_) => DbDriver::SqlServer,
            Pool::Clickhouse(_) => DbDriver::Clickhouse,
+            Pool::Oracle(_) => DbDriver::Oracle,
+        }
+    }
+
+    /// The keep-alive ping (Oracle needs a FROM clause).
+    pub fn ping_sql(&self) -> &'static str {
+        match self {
+            Pool::Oracle(_) => "SELECT 1 FROM DUAL",
+            _ => "SELECT 1",
        }
    }

@@ -559,6 +584,9 @@ impl Pool {
        if source.driver == DbDriver::Clickhouse {
            return crate::clickhouse::ClickhousePool::connect(source, password, setup).await.map(Pool::Clickhouse);
        }
+        if source.driver == DbDriver::Oracle {
+            return crate::oracle::OraclePool::connect(source, password, &setup).await.map(Pool::Oracle);
+        }
        let timeout = setup.connect_timeout.unwrap_or(Duration::from_secs(30));
        let init = Arc::new(setup.statements);
        // Runs the session statements (startup script…) on every new connection.
@@ -721,12 +749,13 @@ impl Pool {
                Ok(Pool::SqlServer(pool))
            }
            DbDriver::Clickhouse => unreachable!(),
+            DbDriver::Oracle => unreachable!(),
        }
    }

    pub async fn close(&self) {
        match self {
-            Pool::SqlServer(_) => {}
+            Pool::SqlServer(_) | Pool::Oracle(_) => {}
            Pool::Clickhouse(p) => p.close(),
            _ => with_pool!(self, p => p.close().await),
        }
@@ -735,6 +764,7 @@ impl Pool {
    pub fn is_closed(&self) -> bool {
        match self {
            Pool::SqlServer(_) => false,
+            Pool::Oracle(p) => p.is_closed(),
            Pool::Clickhouse(p) => p.is_closed(),
            _ => with_pool!(self, p => p.is_closed()),
        }
@@ -745,6 +775,11 @@ impl Pool {
        if let Pool::Clickhouse(p) = self {
            return Ok(p.execute(sql, max, &CancellationToken::new()).await?.rows);
        }
+        if let Pool::Oracle(p) = self {
+            let mut conn = p.get().await?;
+            let fetched = crate::oracle::run(&mut conn, sql, 0, max, Cells::Text, &CancellationToken::new()).await?;
+            return Ok(fetched.1);
+        }
        let fetched: IdeResult<Fetched> = match self {
            Pool::SqlServer(p) => {
                let mut conn = p.get_owned().await.map_err(mssql_pool_err)?;
@@ -811,6 +846,15 @@ impl Pool {
                }
                result
            }
+            Pool::Oracle(p) => {
+                let mut conn = p.get().await?;
+                let result = crate::oracle::transaction(&mut conn, statements).await;
+                if result.is_err() {
+                    // An open transaction must never return to the pool with the connection.
+                    conn.discard_inner();
+                }
+                result
+            }
            _ => with_pool!(self, p => {
                let mut tx = p.begin().await.map_err(db_err)?;
                let mut total = 0;
@@ -838,6 +882,7 @@ pub enum Held {
    Mysql(PoolConnection<MySql>),
    SqlServer(Box<bb8::PooledConnection<'static, MssqlConnectionManager>>),
    Clickhouse(crate::clickhouse::ClickhousePool),
+    Oracle(crate::oracle::OracleConnection),
 }

 impl Held {
@@ -853,6 +898,7 @@ impl Held {
                }
                Held::Clickhouse(p.clone())
            }
+            Pool::Oracle(p) => Held::Oracle(p.get().await?),
        })
    }

@@ -861,13 +907,20 @@ impl Held {
        match self {
            Held::SqlServer(c) => mssql_command(c, sql).await,
            Held::Clickhouse(_) => Err(crate::clickhouse::transaction_error()),
+            Held::Oracle(c) => {
+                let sql = sql.trim();
+                if sql.is_empty() {
+                    return Ok(()); // Oracle transactions open implicitly.
+                }
+                crate::oracle::run(c, sql, 0, 0, Cells::Text, &CancellationToken::new()).await.map(drop)
+            }
            other => {
                let sql = sqlx::AssertSqlSafe(sql.to_owned());
                match other {
                    Held::Sqlite(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
                    Held::Postgres(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
                    Held::Mysql(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
-                    Held::SqlServer(_) | Held::Clickhouse(_) => unreachable!(),
+                    Held::SqlServer(_) | Held::Clickhouse(_) | Held::Oracle(_) => unreachable!(),
                }
                .map_err(db_err)
            }
@@ -889,6 +942,7 @@ impl Held {
                c.0.take();
            }
            Held::Clickhouse(_) => {}
+            Held::Oracle(mut c) => c.discard_inner(),
        }
    }

@@ -959,6 +1013,7 @@ impl Held {
                    () = cancel.cancelled() => return Err(IdeError::cancelled()),
                }
            }
+            Held::Oracle(c) => crate::oracle::run(c, sql, skip, max_rows, Cells::Display, cancel).await?,
            Held::Clickhouse(_) => unreachable!(),
        };
        let (columns, rows, affected, has_more, first) = fetched;
@@ -980,6 +1035,7 @@ pub fn begin_statement(driver: DbDriver) -> &'static str {
    match driver {
        DbDriver::Mysql => "START TRANSACTION",
        DbDriver::SqlServer => "BEGIN TRAN",
+        DbDriver::Oracle => "", // opens implicitly with autocommit off
        DbDriver::Sqlite | DbDriver::Postgres | DbDriver::Clickhouse => "BEGIN",
    }
 }
@@ -5,6 +5,7 @@
 mod clickhouse;
 pub mod conn;
 pub mod history;
+mod oracle;
 pub mod plan;
 pub mod secrets;
 pub mod source;
@@ -303,7 +304,7 @@ fn keep_alive(pool: &Arc<Pool>, every: Duration) {
        loop {
            tick.tick().await;
            let Some(p) = pool.upgrade().filter(|p| !p.is_closed()) else { break };
-            if let Err(e) = p.rows("SELECT 1", 1).await {
+            if let Err(e) = p.rows(p.ping_sql(), 1).await {
                tracing::debug!("keep-alive: {}", e.message);
            }
        }
@@ -614,6 +615,7 @@ impl DbManager {
            DbDriver::Postgres | DbDriver::Clickhouse => "SELECT version()",
            DbDriver::Mysql => "SELECT CONCAT(@@version_comment, ' ', VERSION())",
            DbDriver::SqlServer => "SELECT @@VERSION",
+            DbDriver::Oracle => "SELECT banner FROM v$version WHERE banner LIKE 'Oracle%' AND ROWNUM = 1",
        };
        let result = pool.rows(version, 1).await;
        pool.close().await;
@@ -905,6 +907,33 @@ impl DbManager {
                    .next();
                ddl.map(|d| format!("{d};\n")).ok_or_else(missing)
            }
+            DbDriver::Oracle => {
+                let (s, n) = (sql::quote_literal(driver, schema), sql::quote_literal(driver, name));
+                let kind = pool
+                    .rows(
+                        &format!(
+                            "SELECT object_type FROM all_objects WHERE owner = {s} AND object_name = {n} \
+                             AND object_type IN ('TABLE', 'VIEW') AND ROWNUM = 1"
+                        ),
+                        1,
+                    )
+                    .await?
+                    .into_iter()
+                    .next()
+                    .and_then(|r| r.into_iter().next().flatten())
+                    .ok_or_else(missing)?;
+                let ddl = cells(
+                    pool.rows(
+                        &format!("SELECT DBMS_METADATA.GET_DDL('{}', {n}, {s}) FROM DUAL", kind.replace('\'', "''")),
+                        1,
+                    )
+                    .await?,
+                    0,
+                )
+                .into_iter()
+                .next();
+                ddl.map(|d| format!("{};\n", d.trim_end().trim_end_matches(';'))).ok_or_else(missing)
+            }
            DbDriver::Postgres => {
                let rel = pool.rows(&sql::postgres_relation(schema, name), 1).await?.into_iter().next();
                let (oid, kind) = match rel.as_deref() {
@@ -1057,6 +1086,29 @@ impl DbManager {
    /// The execution plan of `statement` (explained, not run).
    pub async fn explain(&self, id: &str, statement: &str, cancel: &CancellationToken) -> IdeResult<Vec<PlanNode>> {
        let driver = self.pool(id).await?.driver();
+        if driver == DbDriver::Oracle {
+            // EXPLAIN PLAN writes PLAN_TABLE; the plan is read (and cleaned up) separately.
+            let plan_id = format!(
+                "OPENIDEA{}",
+                std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.subsec_nanos())
+            );
+            self.run(
+                id,
+                &format!(
+                    "EXPLAIN PLAN SET STATEMENT_ID = '{}' FOR {}",
+                    plan_id,
+                    statement.trim().trim_end_matches(';')
+                ),
+                0,
+                MAX_META_ROWS,
+                cancel,
+            )
+            .await?;
+            let result = self.run(id, &plan::oracle_plan_query(&plan_id), 0, MAX_META_ROWS, cancel).await?;
+            let nodes = plan::parse(driver, &result);
+            let _ = self.run(id, &plan::oracle_plan_cleanup(&plan_id), 0, 0, cancel).await;
+            return nodes;
+        }
        let result = self.run(id, &plan::explain_statement(driver, statement), 0, MAX_META_ROWS, cancel).await?;
        plan::parse(driver, &result)
    }
@@ -0,0 +1,639 @@
+//! Oracle connections through the synchronous `rust-oracle` driver (ODPI-C).
+//! The Oracle client library (Instant Client) is loaded once per process from
+//! the Options tab or `ORACLE_HOME`; every blocking call runs on the blocking
+//! pool, and cancelling a statement closes its connection.
+
+use crate::conn::{Cells, Fetched, ResultColumn, Setup, hex};
+use crate::source::{DataSource, DbDriver, DbTxMode};
+use bb8::ManageConnection;
+use ide_core::{CancellationToken, IdeError, IdeResult, error::ErrorKind};
+use oracle::sql_type::{Blob, Clob, OracleType};
+use std::io::Read;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use tokio::sync::mpsc;
+
+/// Characters of a LOB column shown in the grid; catalog text reads more.
+const MAX_GRID_LOB: u64 = 4096;
+const MAX_TEXT_LOB: u64 = 1 << 16;
+
+/// Everything a new connection needs, built once per pool.
+#[derive(Debug)]
+struct State {
+    user: String,
+    password: String,
+    /// EZConnect `//host:port/service`, a TNS descriptor or an alias.
+    connect: String,
+    init: Vec<String>,
+    auto_commit: bool,
+    read_only: bool,
+    statement_cache: Option<u32>,
+    timeout: Duration,
+}
+
+impl State {
+    fn of(source: &DataSource, password: Option<&str>, setup: &Setup) -> IdeResult<Self> {
+        let user = source.user.trim();
+        if user.is_empty() {
+            return Err(IdeError::invalid("Oracle data sources need a user name"));
+        }
+        Ok(Self {
+            user: user.to_owned(),
+            password: password.unwrap_or_default().to_owned(),
+            connect: connect_string(source),
+            init: setup.statements.clone(),
+            auto_commit: source.options.transaction != DbTxMode::Manual,
+            read_only: source.read_only,
+            statement_cache: setup.statement_cache.map(|n| n as u32),
+            timeout: setup.connect_timeout.unwrap_or(Duration::from_secs(30)),
+        })
+    }
+}
+
+/// `//host:port/service`; the database field may also hold a TNS descriptor or alias.
+fn connect_string(source: &DataSource) -> String {
+    let db = source.database.trim();
+    if db.starts_with('(') || db.contains('=') {
+        return db.to_owned();
+    }
+    let host = if source.host.trim().is_empty() { "localhost" } else { source.host.trim() };
+    let port = source.port.unwrap_or(1521);
+    if db.is_empty() { format!("//{host}:{port}") } else { format!("//{host}:{port}/{db}") }
+}
+
+/// The expanded Instant Client directory, `None` when the search path is used.
+fn client_dir(dir: &str) -> IdeResult<Option<String>> {
+    let dir = dir.trim();
+    if dir.is_empty() {
+        return Ok(None);
+    }
+    let expanded: PathBuf = ide_ssh::expand(dir);
+    if !expanded.is_dir() {
+        return Err(IdeError::invalid(format!("Oracle Instant Client directory not found: {}", expanded.display())));
+    }
+    Ok(Some(expanded.to_string_lossy().into_owned()))
+}
+
+/// Loads the Oracle client once per process; the first data source's directory wins.
+/// Failures are not cached: a corrected directory works without restarting.
+fn init_client(dir: &str) -> IdeResult<()> {
+    static LOADED: std::sync::Mutex<Option<String>> = std::sync::Mutex::new(None);
+    let dir = dir.trim();
+    let mut loaded = LOADED.lock().unwrap_or_else(|e| e.into_inner());
+    if let Some(used) = loaded.as_deref() {
+        if !dir.is_empty() && !used.is_empty() && used != dir {
+            tracing::warn!("Oracle client already loaded from {used}; ignoring {dir}");
+        }
+        return Ok(());
+    }
+    let mut params = oracle::InitParams::new();
+    if let Some(lib_dir) = client_dir(dir)? {
+        params
+            .oracle_client_lib_dir(lib_dir)
+            .map_err(|e| IdeError::invalid(format!("Oracle Instant Client directory: {e}")))?;
+    }
+    params.init().map_err(|e| {
+        let hint = if e.to_string().contains("DPI-1047") {
+            format!("{e} — set the Instant Client directory (Options tab) or ORACLE_HOME")
+        } else {
+            e.to_string()
+        };
+        IdeError::new(ErrorKind::Io, format!("Oracle client: {hint}"))
+    })?;
+    *loaded = Some(dir.to_owned());
+    Ok(())
+}
+
+/// `rust-oracle` errors are not `Sync`; the pool wants a shareable error.
+#[derive(Debug, Clone)]
+pub struct OracleError(Arc<oracle::Error>);
+
+impl OracleError {
+    fn new(e: oracle::Error) -> Self {
+        Self(Arc::new(e))
+    }
+
+    fn message(msg: impl Into<String>) -> Self {
+        Self::new(oracle::Error::new(oracle::ErrorKind::InvalidArgument, msg.into()))
+    }
+
+    fn into_ide(self) -> IdeError {
+        oracle_err(clone_db(&self.0))
+    }
+}
+
+/// Database errors (the interesting ones) rebuild cheaply for cloning.
+fn clone_db(e: &oracle::Error) -> oracle::Error {
+    match e.db_error() {
+        Some(db) => oracle::Error::new(oracle::ErrorKind::OciError, db.message().to_owned()),
+        None => message_error(&e.to_string()),
+    }
+}
+
+fn message_error(msg: &str) -> oracle::Error {
+    oracle::Error::new(oracle::ErrorKind::InvalidArgument, msg.to_owned())
+}
+
+/// Wrong or missing password: ORA-01017 / ORA-01005; unreachable server: ORA-12xxx / ORA-31xx.
+pub(crate) fn oracle_err(e: oracle::Error) -> IdeError {
+    let Some(db) = e.db_error() else {
+        return IdeError::new(ErrorKind::InvalidInput, e.to_string());
+    };
+    let msg = db.message().to_owned();
+    if msg.contains("DPI-1047") {
+        return IdeError::new(
+            ErrorKind::Io,
+            format!("{msg} — set the Instant Client directory (Options tab) or ORACLE_HOME"),
+        );
+    }
+    let code = db.code();
+    let full = format!("[ORA-{code:05}] {msg}");
+    match code {
+        1005 | 1017 | 28000 | 28001 => IdeError::new(ErrorKind::PermissionDenied, full),
+        12150..=12199 | 12537 | 12540 | 12541 | 12543 | 12545 | 3113 | 3114 => IdeError::new(ErrorKind::Io, full),
+        _ => IdeError::new(ErrorKind::InvalidInput, full),
+    }
+}
+
+#[derive(Debug)]
+pub struct OraclePool {
+    state: Arc<State>,
+    pool: Arc<bb8::Pool<OracleConnectionManager>>,
+}
+
+impl OraclePool {
+    pub(crate) async fn connect(source: &DataSource, password: Option<&str>, setup: &Setup) -> IdeResult<Self> {
+        init_client(&source.options.instant_client)?;
+        let state = Arc::new(State::of(source, password, setup)?);
+        let pool = bb8::Pool::builder()
+            .max_size(4)
+            .connection_timeout(state.timeout)
+            .build(OracleConnectionManager(state.clone()))
+            .await
+            .map_err(|e| e.into_ide())?;
+        // bb8 connects lazily and reports failed attempts as a bare timeout, which
+        // would turn a wrong password into "timed out connecting to the database".
+        let opened = tokio::task::spawn_blocking({
+            let state = state.clone();
+            move || open(&state)
+        })
+        .await
+        .map_err(|e| IdeError::internal(format!("Oracle connect task: {e}")))?
+        .map_err(oracle_err)?;
+        let _ = pool.add(OracleHandle { conn: Some(opened) });
+        Ok(Self { state, pool: Arc::new(pool) })
+    }
+
+    /// A connection taken out of the pool for one statement or a held session.
+    pub async fn get(&self) -> IdeResult<OracleConnection> {
+        let pooled = self.pool.get_owned().await.map_err(|e| pool_err(e).into_ide())?;
+        Ok(OracleConnection { state: self.state.clone(), pooled })
+    }
+
+    pub fn is_closed(&self) -> bool {
+        let state = self.pool.state();
+        state.connections == 0 && state.idle_connections == 0
+    }
+}
+
+fn pool_err(e: bb8::RunError<OracleError>) -> OracleError {
+    match e {
+        bb8::RunError::User(e) => e,
+        bb8::RunError::TimedOut => OracleError::message("timed out connecting to the database"),
+    }
+}
+
+/// A pooled connection's payload; `conn` is `None` once the connection is
+/// discarded (a cancelled statement leaves it in the blocking task).
+pub struct OracleHandle {
+    conn: Option<oracle::Connection>,
+}
+
+pub struct OracleConnectionManager(Arc<State>);
+
+impl ManageConnection for OracleConnectionManager {
+    type Connection = OracleHandle;
+    type Error = OracleError;
+
+    async fn connect(&self) -> Result<Self::Connection, Self::Error> {
+        let state = self.0.clone();
+        let opened = tokio::task::spawn_blocking(move || open(&state))
+            .await
+            .map_err(|e| OracleError::message(format!("Oracle connect task: {e}")))?;
+        let conn = opened.map_err(OracleError::new)?;
+        Ok(OracleHandle { conn: Some(conn) })
+    }
+
+    async fn is_valid(&self, conn: &mut Self::Connection) -> Result<(), Self::Error> {
+        let state = self.0.clone();
+        let Some(raw) = conn.conn.take() else {
+            return Err(OracleError::message("Oracle connection is closed"));
+        };
+        let ping = tokio::time::timeout(
+            state.timeout,
+            tokio::task::spawn_blocking(move || {
+                let result = (|| -> oracle::Result<()> {
+                    // `execute` rejects selects, so read one row.
+                    let mut stmt = raw.statement("SELECT 1 FROM DUAL").build()?;
+                    let mut rows = stmt.query(&[])?;
+                    if let Some(row) = rows.next() {
+                        row?;
+                    }
+                    Ok(())
+                })();
+                (raw, result)
+            }),
+        )
+        .await;
+        match ping {
+            Ok(Ok((raw, Ok(())))) => {
+                conn.conn = Some(raw);
+                Ok(())
+            }
+            Ok(Ok((_, Err(e)))) => Err(OracleError::new(e)),
+            Ok(Err(e)) => Err(OracleError::message(format!("Oracle ping task: {e}"))),
+            // Timed out (the task keeps the connection and closes it): discard this one.
+            Err(_) => Err(OracleError::message("timed out waiting for the Oracle server")),
+        }
+    }
+
+    fn has_broken(&self, conn: &mut Self::Connection) -> bool {
+        conn.conn.is_none()
+    }
+}
+
+/// A connection borrowed from the pool. It returns to the pool when dropped,
+/// unless its statement was cancelled (then it is discarded).
+pub struct OracleConnection {
+    state: Arc<State>,
+    pooled: bb8::PooledConnection<'static, OracleConnectionManager>,
+}
+
+impl OracleConnection {
+    pub fn is_closed(&self) -> bool {
+        self.pooled.conn.is_none()
+    }
+
+    /// Drops the connection instead of returning it; the server rolls an open
+    /// transaction back.
+    pub(crate) fn discard_inner(&mut self) {
+        self.pooled.conn.take();
+    }
+}
+
+fn open(state: &State) -> oracle::Result<oracle::Connection> {
+    let mut connector = oracle::Connector::new(state.user.clone(), state.password.clone(), state.connect.clone());
+    connector.driver_name("OpenIDEA");
+    if let Some(n) = state.statement_cache {
+        connector.stmt_cache_size(n);
+    }
+    let mut conn = connector.connect()?;
+    conn.set_autocommit(state.auto_commit);
+    for sql in &state.init {
+        statement(&mut conn, sql, 0, 0, Cells::Text).map_err(|e| message_error(&e.message))?;
+    }
+    Ok(conn)
+}
+
+/// Runs `f` with the connection on the blocking pool. Cancelling drops the
+/// connection instead of returning it (its statement keeps running server-side).
+async fn with_conn<T>(
+    c: &mut OracleConnection,
+    cancel: &CancellationToken,
+    f: impl FnOnce(&mut oracle::Connection) -> IdeResult<T> + Send + 'static,
+) -> IdeResult<T>
+where
+    T: Send + 'static,
+{
+    let Some(conn) = c.pooled.conn.take() else {
+        return Err(IdeError::new(ErrorKind::Io, "Oracle connection is closed"));
+    };
+    let (tx, mut rx) = mpsc::channel::<(oracle::Connection, IdeResult<T>)>(1);
+    tokio::task::spawn_blocking(move || {
+        let mut slot = Some(conn);
+        let result = match slot.as_mut() {
+            Some(conn) => f(conn),
+            None => unreachable!("connection taken above"),
+        };
+        // A closed receiver (cancelled) drops the connection, closing it.
+        let _ = tx.blocking_send((slot.take().expect("some"), result));
+    });
+    tokio::select! {
+        item = rx.recv() => match item {
+            Some((conn, result)) => {
+                c.pooled.conn = Some(conn);
+                result
+            }
+            None => Err(IdeError::internal("the Oracle connection task failed")),
+        },
+        () = cancel.cancelled() => {
+            rx.close();
+            Err(IdeError::cancelled())
+        }
+    }
+}
+
+/// Runs a script on `c` (see [`crate::conn::Pool::rows`] and `Held::execute`).
+pub(crate) async fn run(
+    c: &mut OracleConnection,
+    sql: &str,
+    skip: usize,
+    max: usize,
+    mode: Cells,
+    cancel: &CancellationToken,
+) -> IdeResult<Fetched> {
+    let state = c.state.clone();
+    let sql = sql.to_owned();
+    with_conn(c, cancel, move |conn| statements(conn, &state, &sql, skip, max, mode)).await
+}
+
+/// The table editor's edits in one transaction.
+pub(crate) async fn transaction(c: &mut OracleConnection, statements: &[(String, bool)]) -> IdeResult<u64> {
+    if c.state.read_only {
+        return Err(IdeError::new(ErrorKind::PermissionDenied, "read-only connection: edits are not allowed"));
+    }
+    let script = statements.iter().map(|(sql, _)| sql.clone()).collect::<Vec<_>>();
+    let expect: Vec<bool> = statements.iter().map(|(_, e)| *e).collect();
+    let apply = move |conn: &mut oracle::Connection| -> IdeResult<u64> {
+        conn.set_autocommit(false);
+        let mut total = 0;
+        for (sql, expect_one) in script.iter().zip(&expect) {
+            let mut stmt = conn.statement(sql).build().map_err(oracle_err)?;
+            stmt.execute(&[]).map_err(oracle_err)?;
+            let n = stmt.row_count().map_err(oracle_err)?;
+            if *expect_one && n != 1 {
+                conn.rollback().ok();
+                return Err(IdeError::invalid(format!(
+                    "{sql}: expected to change 1 row, changed {n}; nothing was saved"
+                )));
+            }
+            total += n;
+        }
+        conn.commit().map_err(oracle_err)?;
+        Ok(total)
+    };
+    let cancel = CancellationToken::new();
+    with_conn(c, &cancel, apply).await
+}
+
+/// Runs every statement of `sql` (one script, PL/SQL blocks kept whole): the
+/// first query's rows are the result, otherwise the total rows changed.
+fn statements(
+    conn: &mut oracle::Connection,
+    state: &State,
+    sql: &str,
+    skip: usize,
+    max: usize,
+    mode: Cells,
+) -> IdeResult<Fetched> {
+    conn.set_autocommit(state.auto_commit);
+    let mut query: Option<Fetched> = None;
+    let mut affected: u64 = 0;
+    let mut first: Option<Instant> = None;
+    for s in crate::split::split(sql, DbDriver::Oracle) {
+        if state.read_only && is_write(&s.text) {
+            return Err(IdeError::new(
+                ErrorKind::PermissionDenied,
+                format!("read-only connection: {} statements are not allowed", first_word(&s.text)),
+            ));
+        }
+        let r = statement(conn, &s.text, skip, max, mode)?;
+        first.get_or_insert_with(|| r.4.unwrap_or_else(Instant::now));
+        if r.0.is_empty() {
+            affected += r.2.unwrap_or(0);
+        } else if query.is_none() {
+            query = Some(r);
+        }
+    }
+    Ok(query.unwrap_or((Vec::new(), Vec::new(), Some(affected), false, first)))
+}
+
+/// Reads one statement; `skip` rows are fetched and dropped (result pagination).
+fn statement(conn: &mut oracle::Connection, sql: &str, skip: usize, max: usize, mode: Cells) -> IdeResult<Fetched> {
+    let started = Instant::now();
+    // LOB locators let `cell` read only the shown prefix (the default fetches whole LOBs).
+    let mut stmt = conn
+        .statement(sql)
+        .fetch_array_size((max as u32).clamp(1, 1000) + 1)
+        .lob_locator()
+        .build()
+        .map_err(oracle_err)?;
+    match stmt.statement_type() {
+        oracle::StatementType::Select => {
+            let rows = stmt.query(&[]).map_err(oracle_err)?;
+            let columns: Vec<ResultColumn> = rows
+                .column_info()
+                .iter()
+                .map(|c| ResultColumn { name: c.name().to_owned(), type_name: c.oracle_type().to_string() })
+                .collect();
+            let mut out: Vec<Vec<Option<String>>> = Vec::new();
+            let mut has_more = false;
+            let mut to_skip = skip;
+            for row in rows {
+                if to_skip > 0 {
+                    to_skip -= 1;
+                    continue;
+                }
+                if out.len() >= max {
+                    has_more = true;
+                    break;
+                }
+                let row = row.map_err(oracle_err)?;
+                out.push(row.sql_values().iter().map(|v| cell(v, mode)).collect());
+            }
+            Ok((columns, out, None, has_more, Some(started)))
+        }
+        _ => {
+            stmt.execute(&[]).map_err(oracle_err)?;
+            let affected = stmt.row_count().map_err(oracle_err)?;
+            Ok((Vec::new(), Vec::new(), Some(affected), false, Some(started)))
+        }
+    }
+}
+
+fn first_word(sql: &str) -> String {
+    sql.lines()
+        .map(str::trim)
+        .find(|l| !l.is_empty() && !l.starts_with("--"))
+        .and_then(|l| l.split_whitespace().next())
+        .unwrap_or("")
+        .to_ascii_uppercase()
+}
+
+/// Whether `sql` changes data or schema (read-only connections refuse it).
+fn is_write(sql: &str) -> bool {
+    !matches!(first_word(sql).as_str(), "SELECT" | "WITH" | "SHOW" | "EXPLAIN" | "DESCRIBE" | "DESC" | "SET")
+}
+
+fn cell(v: &oracle::SqlValue, mode: Cells) -> Option<String> {
+    if v.is_null().unwrap_or(false) {
+        return None;
+    }
+    match v.oracle_type().ok() {
+        Some(OracleType::CLOB | OracleType::NCLOB) => {
+            let lob: Clob = v.get().ok()?;
+            let cap = if mode == Cells::Text { MAX_TEXT_LOB } else { MAX_GRID_LOB };
+            let mut s = String::new();
+            lob.take(cap).read_to_string(&mut s).ok()?;
+            Some(s)
+        }
+        Some(OracleType::BLOB) => {
+            let lob: Blob = v.get().ok()?;
+            let cap = if mode == Cells::Text { MAX_TEXT_LOB } else { MAX_GRID_LOB };
+            let mut buf = Vec::new();
+            lob.take(cap).read_to_end(&mut buf).ok()?;
+            Some(hex(&buf))
+        }
+        _ => v.get::<String>().ok(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn connect_strings() {
+        let s = |db: &str| DataSource {
+            driver: DbDriver::Oracle,
+            host: "db.local".into(),
+            port: Some(1521),
+            database: db.into(),
+            ..Default::default()
+        };
+        assert_eq!(connect_string(&s("ORCLPDB1")), "//db.local:1521/ORCLPDB1");
+        assert_eq!(connect_string(&s("")), "//db.local:1521");
+        assert_eq!(
+            connect_string(&DataSource { host: String::new(), port: None, database: "ORCL".into(), ..s("") }),
+            "//localhost:1521/ORCL"
+        );
+        assert_eq!(connect_string(&s("(DESCRIPTION=(ADDRESS=...))")), "(DESCRIPTION=(ADDRESS=...))");
+        assert_eq!(connect_string(&s("PROD=MYDB")), "PROD=MYDB");
+    }
+
+    #[test]
+    fn write_detection() {
+        assert!(!is_write("SELECT 1 FROM DUAL"));
+        assert!(!is_write("-- x\nWITH q AS (SELECT 1) SELECT * FROM q"));
+        assert!(!is_write("DESC users"));
+        assert!(is_write("INSERT INTO t VALUES (1)"));
+        assert!(is_write("begin\n  null;\nend;"));
+        assert!(is_write("DROP TABLE t"));
+    }
+
+    #[test]
+    fn missing_user_is_rejected_before_connecting() {
+        let setup = Setup::default();
+        let err = State::of(&DataSource { driver: DbDriver::Oracle, ..Default::default() }, None, &setup).unwrap_err();
+        assert!(err.message.contains("user name"));
+        let state = State::of(
+            &DataSource { driver: DbDriver::Oracle, user: "scott".into(), ..Default::default() },
+            Some("tiger"),
+            &setup,
+        )
+        .unwrap();
+        assert_eq!(
+            (state.user.as_str(), state.password.as_str(), state.connect.as_str()),
+            ("scott", "tiger", "//localhost:1521")
+        );
+        assert!(state.auto_commit);
+    }
+
+    #[test]
+    fn oracle_errors_map_to_kinds() {
+        let auth = oracle_err(message_error("x")).kind; // no database error: invalid input
+        assert_eq!(auth, ErrorKind::InvalidInput);
+    }
+
+    #[tokio::test]
+    async fn a_discarded_connection_is_broken_but_a_live_one_is_not() {
+        // No server is reachable here, so the pooled connection is a husk: `has_broken`
+        // decides whether bb8 keeps it, which is what cancellation relies on.
+        let manager = OracleConnectionManager(Arc::new(
+            State::of(
+                &DataSource { driver: DbDriver::Oracle, user: "scott".into(), ..Default::default() },
+                None,
+                &Setup::default(),
+            )
+            .unwrap(),
+        ));
+        let mut broken = OracleHandle { conn: None };
+        assert!(manager.has_broken(&mut broken));
+        // A connection that cannot be opened reports the failure without panicking
+        // (a client-load error, or ORA-12541 when a client is available).
+        match manager.connect().await {
+            Ok(_) => unreachable!("no server is listening"),
+            Err(err) => assert!(!err.into_ide().message.is_empty()),
+        }
+    }
+
+    #[test]
+    fn connect_reports_a_missing_client_directory() {
+        let err = client_dir("/nonexistent/instantclient").expect_err("no such directory");
+        assert!(err.message.contains("Instant Client directory not found"), "{}", err.message);
+        assert!(client_dir("").expect("the search path").is_none());
+    }
+
+    /// A live server, skipped unless `OPENIDEA_ORACLE_TEST` is
+    /// `user/password@host:port/service` (and `OPENIDEA_ORACLE_CLIENT` names the
+    /// Instant Client when it is not on the search path).
+    ///
+    /// Checking out a connection runs `is_valid`, so this fails if the ping is
+    /// not a query (bb8 silently retries a rejected check-out until it times out).
+    #[tokio::test]
+    async fn a_pooled_connection_runs_queries() {
+        let Some(spec) = std::env::var("OPENIDEA_ORACLE_TEST").ok().filter(|s| !s.is_empty()) else { return };
+        let (auth, addr) = spec.split_once('@').expect("user/password@host:port/service");
+        let (user, password) = auth.split_once('/').expect("user/password");
+        let (host, rest) = addr.split_once(':').expect("host:port/service");
+        let (port, service) = rest.split_once('/').expect("port/service");
+        let source = DataSource {
+            driver: DbDriver::Oracle,
+            host: host.into(),
+            port: Some(port.parse().expect("port")),
+            database: service.into(),
+            user: user.into(),
+            options: crate::source::DbOptions {
+                instant_client: std::env::var("OPENIDEA_ORACLE_CLIENT").unwrap_or_default(),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        // A missing or wrong password asks for one (the UI prompts on PermissionDenied).
+        for wrong in [None, Some("wrong")] {
+            let Err(err) = crate::conn::Pool::connect(&source, wrong, None).await else { panic!("bad password") };
+            assert_eq!(err.kind, ErrorKind::PermissionDenied, "{}", err.message);
+        }
+        let pool = crate::conn::Pool::connect(&source, Some(password), None).await.expect("connect");
+        let rows = pool.rows("SELECT 1 FROM DUAL", 1).await.expect("query through the pool");
+        assert_eq!(rows.first().and_then(|r| r.first().cloned().flatten()).as_deref(), Some("1"));
+
+        // The result grid reads later pages by skipping rows client-side.
+        let page = pool
+            .execute_from("SELECT LEVEL FROM DUAL CONNECT BY LEVEL <= 10", 4, 3, &CancellationToken::new())
+            .await
+            .expect("second page");
+        let values: Vec<String> = page.rows.iter().filter_map(|r| r.first().cloned().flatten()).collect();
+        assert_eq!(values, ["5", "6", "7"]);
+        assert!(page.has_more);
+
+        // PL/SQL units reach the server with their closing `END;`.
+        pool.rows("begin null; end;", 0).await.expect("anonymous block");
+        pool.rows("declare n number := 1; begin n := n + 1; end;", 0).await.expect("declare block");
+        let proc = "create or replace procedure openidea_p(a number) is\n  x number := a;\nbegin\n  x := x + 1;\nend;";
+        let rows = pool.rows(&format!("{proc}\nselect 7 from dual;"), 1).await.expect("procedure, then a query");
+        assert_eq!(rows.first().and_then(|r| r.first().cloned().flatten()).as_deref(), Some("7"));
+        pool.rows("begin openidea_p(1); end;", 0).await.expect("call the procedure");
+        let package = "create or replace package openidea_k as\n  function f return number;\nend openidea_k;\n/\n\
+                       create or replace package body openidea_k as\n  function f return number is begin return 8; end;\nend openidea_k;\n/";
+        pool.rows(package, 0).await.expect("package spec and body");
+        let rows = pool.rows("select openidea_k.f from dual", 1).await.expect("call the package");
+        assert_eq!(rows.first().and_then(|r| r.first().cloned().flatten()).as_deref(), Some("8"));
+        pool.rows("drop package openidea_k; drop procedure openidea_p", 0).await.expect("clean up");
+
+        // LOB cells are read through locators.
+        let rows = pool.rows("select to_clob('abc'), to_blob(hextoraw('0A0B')) from dual", 1).await.expect("LOBs");
+        assert_eq!(rows.first().cloned(), Some(vec![Some("abc".into()), Some("0x0A0B".into())]));
+    }
+}
@@ -38,13 +38,28 @@ pub fn explain_statement(driver: DbDriver, statement: &str) -> String {
        DbDriver::Clickhouse => format!("EXPLAIN json = 1 {s}"),
        DbDriver::Mysql => format!("EXPLAIN {s}"),
        DbDriver::SqlServer => format!("SET SHOWPLAN_TEXT ON; {s}"),
+        DbDriver::Oracle => format!("EXPLAIN PLAN FOR {s}"),
    }
 }

+/// Reads the plan `EXPLAIN PLAN SET STATEMENT_ID = '{plan_id}'` wrote (see [`parse`] with `DbDriver::Oracle`).
+pub fn oracle_plan_query(plan_id: &str) -> String {
+    format!(
+        "SELECT id, parent_id, operation, options, object_name, cost, cardinality, bytes \
+         FROM plan_table WHERE statement_id = '{plan_id}' ORDER BY id"
+    )
+}
+
+/// Removes a read plan (PLAN_TABLE keeps rows until the session ends).
+pub fn oracle_plan_cleanup(plan_id: &str) -> String {
+    format!("DELETE FROM plan_table WHERE statement_id = '{plan_id}'")
+}
+
 /// Reads the result of [`explain_statement`].
 pub fn parse(driver: DbDriver, result: &QueryResult) -> IdeResult<Vec<PlanNode>> {
    match driver {
        DbDriver::Sqlite => Ok(sqlite(&result.rows)),
+        DbDriver::Oracle => Ok(oracle(&result.rows)),
        DbDriver::Postgres | DbDriver::Clickhouse => {
            let text: String =
                result.rows.iter().filter_map(|r| r.first().cloned().flatten()).collect::<Vec<_>>().join("\n");
@@ -148,6 +163,40 @@ fn postgres(node: &Value, parent: Option<u32>, out: &mut Vec<PlanNode>) {
    }
 }

+/// Oracle PLAN_TABLE rows: `id, parent_id, operation, options, object_name, cost, cardinality, bytes`.
+fn oracle(rows: &[Vec<Option<String>>]) -> Vec<PlanNode> {
+    let mut ids: Vec<String> = Vec::new();
+    let mut out = Vec::new();
+    for r in rows {
+        let cell = |i: usize| r.get(i).cloned().flatten().unwrap_or_default();
+        let (id, parent, operation, options, object) = (cell(0), cell(1), cell(2), cell(3), cell(4));
+        let parent = ids.iter().position(|x| *x == parent).map(|i| i as u32);
+        let op = format!("{operation} {options}").trim().to_owned();
+        let (operation, params) = match (operation.as_str(), options.as_str()) {
+            ("TABLE ACCESS", "FULL") => ("Full Scan".into(), object),
+            ("TABLE ACCESS", "BY INDEX ROWID" | "BY ROWID RANGE" | "BY USER ROWID") => ("Table Access".into(), object),
+            ("INDEX", "RANGE SCAN" | "RANGE SCAN DESCENDING") => ("Index Range Scan".into(), object),
+            ("INDEX", "UNIQUE SCAN") => ("Index Lookup".into(), object),
+            ("INDEX", "FULL SCAN" | "FAST FULL SCAN" | "SKIP SCAN") => ("Full Index Scan".into(), object),
+            ("INDEX", "SAMPLE FAST FULL SCAN") => ("Full Index Scan".into(), object),
+            ("SORT", "ORDER BY") => ("Order By".into(), String::new()),
+            ("SORT", "GROUP BY") => ("Group By".into(), String::new()),
+            ("SORT", "UNIQUE") => ("Distinct".into(), String::new()),
+            ("HASH", "GROUP BY") => ("Group By".into(), String::new()),
+            _ => (op, object),
+        };
+        let mut properties = Vec::new();
+        for (name, value) in [("Cost", 5), ("Rows", 6), ("Bytes", 7)] {
+            if let Some(v) = r.get(value).cloned().flatten() {
+                properties.push(prop(name, v));
+            }
+        }
+        out.push(PlanNode { parent, operation, params, properties });
+        ids.push(id);
+    }
+    out
+}
+
 /// MySQL's tabular `EXPLAIN`: one row per table access, flat.
 fn mysql(names: &[&str], rows: &[Vec<Option<String>>]) -> Vec<PlanNode> {
    let col = |r: &[Option<String>], n: &str| {
@@ -202,6 +251,49 @@ mod tests {
        assert_eq!(explain_statement(DbDriver::Mysql, "select 1"), "EXPLAIN select 1");
        assert_eq!(explain_statement(DbDriver::Clickhouse, " select 1;"), "EXPLAIN json = 1 select 1");
        assert_eq!(explain_statement(DbDriver::SqlServer, "select 1"), "SET SHOWPLAN_TEXT ON; select 1");
+        assert_eq!(explain_statement(DbDriver::Oracle, "select 1"), "EXPLAIN PLAN FOR select 1");
+        let q = oracle_plan_query("OI1");
+        assert!(q.contains("FROM plan_table WHERE statement_id = 'OI1' ORDER BY id"));
+        assert!(oracle_plan_cleanup("OI1").contains("DELETE FROM plan_table WHERE statement_id = 'OI1'"));
+    }
+
+    #[test]
+    fn reads_oracle_plan_table_rows() {
+        let r = result(
+            &["id", "parent_id", "operation", "options", "object_name", "cost", "cardinality", "bytes"],
+            vec![
+                vec![Some("1"), Some("0"), Some("SELECT STATEMENT"), None, None, Some("3"), Some("41"), Some("1230")],
+                vec![Some("2"), Some("1"), Some("HASH"), Some("GROUP BY"), None, Some("3"), Some("41"), Some("1230")],
+                vec![
+                    Some("4"),
+                    Some("2"),
+                    Some("TABLE ACCESS"),
+                    Some("FULL"),
+                    Some("orders"),
+                    Some("2"),
+                    Some("41"),
+                    Some("1230"),
+                ],
+                vec![
+                    Some("5"),
+                    Some("2"),
+                    Some("INDEX"),
+                    Some("UNIQUE SCAN"),
+                    Some("c_pk"),
+                    Some("0"),
+                    Some("1"),
+                    Some("6"),
+                ],
+            ],
+        );
+        let plan = parse(DbDriver::Oracle, &r).unwrap();
+        let ops: Vec<(&str, &str)> = plan.iter().map(|n| (n.operation.as_str(), n.params.as_str())).collect();
+        assert_eq!(
+            ops,
+            [("SELECT STATEMENT", ""), ("Group By", ""), ("Full Scan", "orders"), ("Index Lookup", "c_pk")]
+        );
+        assert_eq!((plan[2].parent, plan[3].parent), (Some(1), Some(1)));
+        assert!(plan[0].properties.iter().any(|p| p.name == "Cost" && p.value == "3"));
    }

    #[test]
@@ -20,6 +20,8 @@ pub enum DbDriver {
    /// Microsoft SQL Server.
    SqlServer,
    Clickhouse,
+    /// Oracle Database (via Oracle Instant Client).
+    Oracle,
 }

 impl DbDriver {
@@ -30,6 +32,7 @@ impl DbDriver {
            DbDriver::Mysql => Some(3306),
            DbDriver::SqlServer => Some(1433),
            DbDriver::Clickhouse => Some(8123),
+            DbDriver::Oracle => Some(1521),
        }
    }
 }
@@ -85,6 +88,8 @@ pub struct DbOptions {
    pub auto_disconnect_secs: Option<u32>,
    /// PostgreSQL: show only the configured database, its schemas right under the data source.
    pub single_database: bool,
+    /// Oracle: directory of the Oracle Instant Client (empty: `ORACLE_HOME` / system search path).
+    pub instant_client: String,
 }

 /// Schemas tab: the databases / schemas the tree shows. Names may use `*` and `?`.
@@ -261,6 +266,7 @@ pub fn scheme_driver(scheme: &str) -> Option<DbDriver> {
        "sqlserver" | "mssql" | "mssqlserver" => Some(DbDriver::SqlServer),
        "sqlite" | "sqlite3" => Some(DbDriver::Sqlite),
        "clickhouse" | "http" | "https" => Some(DbDriver::Clickhouse),
+        "oracle" | "oracledb" => Some(DbDriver::Oracle),
        _ => None,
    }
 }
@@ -273,6 +279,12 @@ pub fn parse_url(raw: &str) -> IdeResult<ParsedUrl> {
    let url = url.strip_prefix("jdbc:").or_else(|| url.strip_prefix("JDBC:")).unwrap_or(url);
    let (scheme, rest) = url.split_once(':').ok_or_else(bad)?;
    let driver = scheme_driver(scheme).ok_or_else(bad)?;
+    // JDBC thin URLs: `jdbc:oracle:thin:@//host:port/service` (after the `jdbc:` prefix).
+    let rest = if driver == DbDriver::Oracle {
+        rest.strip_prefix("thin:@").or_else(|| rest.strip_prefix("thin:/@")).unwrap_or(rest)
+    } else {
+        rest
+    };
    if driver == DbDriver::Sqlite {
        let file = rest.strip_prefix("//").unwrap_or(rest);
        let file = file.split('?').next().unwrap_or_default();
@@ -540,7 +552,11 @@ mod tests {
        assert_eq!(parse_url("jdbc:redshift://r:5439/dev").unwrap().driver, Some(DbDriver::Postgres));
        assert_eq!(parse_url("tidb://h:4000").unwrap().driver, Some(DbDriver::Mysql));
        assert_eq!(parse_url("sqlite:/tmp/a.db").unwrap().file.as_deref(), Some("/tmp/a.db"));
-        assert!(parse_url("oracle://x").is_err());
+        let u = parse_url("oracle://scott:[email protected]:1521/ORCLPDB1").unwrap();
+        assert_eq!(u.driver, Some(DbDriver::Oracle));
+        assert_eq!((u.host.as_str(), u.port, u.database.as_str()), ("db.local", Some(1521), "ORCLPDB1"));
+        assert_eq!((u.user.as_str(), u.password.as_deref()), ("scott", Some("tiger")));
+        assert_eq!(parse_url("oracledb://[email protected]/hrdb").unwrap().driver, Some(DbDriver::Oracle));
        assert!(parse_url("postgres://h:99999/db").is_err());
    }

@@ -9,7 +9,8 @@ use specta::Type;
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub struct SqlStatement {
-    /// UTF-16 offsets of the statement text (whitespace trimmed, `;` excluded).
+    /// UTF-16 offsets of the statement text (whitespace trimmed, `;` excluded except
+    /// after an Oracle PL/SQL block, whose `END;` needs it).
    pub from: u32,
    pub to: u32,
    pub text: String,
@@ -29,6 +30,8 @@ enum State {
 pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
    let mysql = driver == DbDriver::Mysql;
    let clickhouse = driver == DbDriver::Clickhouse;
+    // PL/SQL: `;` inside BEGIN…END / DECLARE…END blocks does not terminate a statement.
+    let plsql = driver == DbDriver::Oracle;
    let chars: Vec<(usize, char)> = text.char_indices().collect();
    // UTF-16 offset of each char index (plus the end).
    let mut u16_at = Vec::with_capacity(chars.len() + 1);
@@ -46,6 +49,14 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
    // Whether the current segment has anything but whitespace / comments.
    let mut has_code = false;
    let mut i = 0usize;
+    // PL/SQL block depth (BEGIN / CASE / LOOP open, END closes).
+    let mut depth = 0usize;
+    // Inside a top-level block's declaration section (`DECLARE … BEGIN`).
+    let mut declarations = false;
+    // The segment is a PL/SQL block: its closing `;` is part of the statement.
+    let mut block = false;
+    // `CREATE PACKAGE` / `TYPE BODY`: only `/` on its own line (or the end) ends it.
+    let mut package = false;
    let push = |out: &mut Vec<SqlStatement>, s: usize, e: usize, has_code: bool| {
        if !has_code {
            return;
@@ -69,11 +80,24 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
        let next = chars.get(i + 1).map(|c| c.1);
        match state {
            State::Code => match c {
-                ';' => {
-                    push(&mut out, start, i, has_code);
+                _ if plsql && !has_code && c.is_alphabetic() => {
+                    match plsql_unit(&chars, i) {
+                        Unit::Sql => {}
+                        Unit::Block => block = true,
+                        Unit::Subprogram => (block, declarations) = (true, true),
+                        Unit::Package => (block, package) = (true, true),
+                    }
+                    has_code = true;
+                    // Re-read this character as code (it may start BEGIN / DECLARE).
+                    continue;
+                }
+                ';' if depth == 0 && !declarations && !package => {
+                    push(&mut out, start, if block { i + 1 } else { i }, has_code);
                    start = i + 1;
                    has_code = false;
+                    block = false;
                }
+                ';' => has_code = true,
                '\'' => {
                    state = State::Single;
                    has_code = true;
@@ -86,15 +110,28 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
                    state = State::Backtick;
                    has_code = true;
                }
+                '/' if next == Some('*') => {
+                    state = State::BlockComment;
+                    i += 1;
+                }
+                '/' if plsql && ends_line(&chars, i) && starts_line(&chars, i) => {
+                    // SQL*Plus block terminator: `/` alone on its line ends the statement.
+                    push(&mut out, start, i, has_code);
+                    while chars.get(i).is_some_and(|&(_, c)| c != '\n') {
+                        i += 1;
+                    }
+                    start = i + 1;
+                    has_code = false;
+                    depth = 0;
+                    declarations = false;
+                    block = false;
+                    package = false;
+                }
                '-' if next == Some('-') => {
                    state = State::LineComment;
                    i += 1;
                }
                '#' if mysql => state = State::LineComment,
-                '/' if next == Some('*') => {
-                    state = State::BlockComment;
-                    i += 1;
-                }
                '$' if driver == DbDriver::Postgres => {
                    // `$tag$ … $tag$` (tag may be empty); `$1` parameters are not quotes.
                    let rest = &text[byte_at(i)..];
@@ -114,6 +151,34 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
                        continue;
                    }
                }
+                _ if plsql && word_at(&chars, i, "BEGIN") => {
+                    depth += 1;
+                    declarations = false;
+                    has_code = true;
+                }
+                _ if plsql && word_at(&chars, i, "CASE") || plsql && word_at(&chars, i, "LOOP") => {
+                    depth += 1;
+                    has_code = true;
+                }
+                // `DECLARE … BEGIN … END;` is one block: the declarations of a top-level block
+                // end at BEGIN, so their `;` must not split it.
+                _ if plsql && word_at(&chars, i, "DECLARE") => {
+                    if depth == 0 {
+                        declarations = true;
+                    }
+                    has_code = true;
+                }
+                _ if plsql && word_at(&chars, i, "END") => {
+                    // `END IF` closes an IF (which never opened a block); END LOOP / END CASE
+                    // close the block their keyword opened. Other ENDs close a block.
+                    let after = skip_ws(&chars, i + 3);
+                    let closing = ["LOOP", "CASE", "IF"].into_iter().find(|w| word_at(&chars, after, w));
+                    if closing != Some("IF") && depth > 0 {
+                        depth -= 1;
+                    }
+                    i = closing.map_or(i + 3, |w| after + w.len()) - 1;
+                    has_code = true;
+                }
                c if !c.is_whitespace() => has_code = true,
                _ => {}
            },
@@ -164,6 +229,73 @@ pub fn split(text: &str, driver: DbDriver) -> Vec<SqlStatement> {
    out
 }

+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum Unit {
+    Sql,
+    /// `DECLARE` / `BEGIN`: an anonymous block.
+    Block,
+    /// `CREATE PROCEDURE` / `FUNCTION` / `TRIGGER`: declarations up to the body's BEGIN.
+    Subprogram,
+    /// `CREATE PACKAGE [BODY]` / `TYPE BODY`.
+    Package,
+}
+
+/// What kind of PL/SQL unit, if any, a statement starting at `i` is.
+fn plsql_unit(chars: &[(usize, char)], mut i: usize) -> Unit {
+    let mut words: Vec<String> = Vec::new();
+    while words.len() < 6 {
+        let word: String = chars[i.min(chars.len())..]
+            .iter()
+            .map(|&(_, c)| c)
+            .take_while(|c| c.is_alphanumeric() || *c == '_' || *c == '$')
+            .collect();
+        if word.is_empty() {
+            break;
+        }
+        i = skip_ws(chars, i + word.chars().count());
+        words.push(word.to_ascii_uppercase());
+    }
+    let w = |n: usize| words.get(n).map_or("", String::as_str);
+    match w(0) {
+        "DECLARE" | "BEGIN" => return Unit::Block,
+        "CREATE" => {}
+        _ => return Unit::Sql,
+    }
+    let mut n = if (w(1), w(2)) == ("OR", "REPLACE") { 3 } else { 1 };
+    if matches!(w(n), "EDITIONABLE" | "NONEDITIONABLE") {
+        n += 1;
+    }
+    match (w(n), w(n + 1)) {
+        ("PROCEDURE" | "FUNCTION" | "TRIGGER", _) => Unit::Subprogram,
+        ("PACKAGE", _) | ("TYPE", "BODY") => Unit::Package,
+        _ => Unit::Sql,
+    }
+}
+
+/// Whether the characters at `i` are the keyword `word` (identifier bounds respected).
+fn word_at(chars: &[(usize, char)], i: usize, word: &str) -> bool {
+    let (before, after) = (chars[..i].last().map(|&(_, c)| c), chars.get(i).map(|&(_, c)| c));
+    before.is_none_or(|c| !c.is_alphanumeric() && c != '_' && c != '$')
+        && after.is_some_and(|c| c.is_ascii_alphabetic())
+        && chars[i..].iter().take(word.len()).map(|&(_, c)| c.to_ascii_uppercase()).eq(word.chars())
+        && chars.get(i + word.len()).is_none_or(|&(_, c)| !c.is_alphanumeric() && c != '_' && c != '$')
+}
+
+/// Whether only whitespace follows `i` until the end of its line.
+fn ends_line(chars: &[(usize, char)], i: usize) -> bool {
+    chars[i + 1..].iter().take_while(|&&(_, c)| c != '\n').all(|&(_, c)| c.is_whitespace())
+}
+
+/// Whether only whitespace precedes `i` since the start of its line.
+fn starts_line(chars: &[(usize, char)], i: usize) -> bool {
+    chars[..i].iter().rev().take_while(|&&(_, c)| c != '\n').all(|&(_, c)| c.is_whitespace())
+}
+
+/// The index of the first non-whitespace character at or after `i`.
+fn skip_ws(chars: &[(usize, char)], i: usize) -> usize {
+    chars[i..].iter().position(|&(_, c)| !c.is_whitespace()).map_or(chars.len(), |n| i + n)
+}
+
 /// The statement to run for a caret at `offset` (UTF-16): the one containing
 /// it, else the nearest one before it (caret after `;` or on a blank line
 /// below), else the next one.
@@ -277,4 +409,62 @@ mod tests {
        assert_eq!(s.iter().map(|s| s.text.as_str()).collect::<Vec<_>>(), vec!["select 1", "select 2"]);
        assert_eq!((s[1].from, s[1].to), (13, 21));
    }
+
+    #[test]
+    fn oracle_keeps_plsql_blocks_as_one_statement() {
+        let block = "begin\n  for r in (select 1 from dual) loop\n    null; -- ;\n  end loop;\nend";
+        assert_eq!(
+            texts(&format!("{block};\nselect 2;"), DbDriver::Oracle),
+            vec![format!("{block};"), "select 2".into()]
+        );
+        let nested = "declare\n  x number;\nbegin\n  if x = 1 then\n    case when x = 2 then\n      null;\n    end case;\n    begin\n      null;\n    end;\n  end if;\nend";
+        assert_eq!(
+            texts(&format!("{nested};\nselect 3;"), DbDriver::Oracle),
+            vec![format!("{nested};"), "select 3".into()]
+        );
+        // Plain SQL with CASE is unaffected; END IF does not close a block twice.
+        assert_eq!(
+            texts("select case when a = 1 then 2 end from t; select 2", DbDriver::Oracle),
+            vec!["select case when a = 1 then 2 end from t", "select 2"]
+        );
+    }
+
+    #[test]
+    fn oracle_slash_terminator_and_other_drivers_unaffected() {
+        // `END;` ends the block; a following `/` (SQL*Plus's own terminator) adds nothing.
+        assert_eq!(
+            texts("begin\n  null;\nend;\n/\nselect 2", DbDriver::Oracle),
+            vec!["begin\n  null;\nend;", "select 2"]
+        );
+        // A division is not a terminator.
+        assert_eq!(texts("select 1 /\n 2 from dual", DbDriver::Oracle), vec!["select 1 /\n 2 from dual"]);
+        assert_eq!(texts("select 'a;b' from t; select 2", DbDriver::Oracle), vec!["select 'a;b' from t", "select 2"]);
+    }
+
+    #[test]
+    fn oracle_create_units_keep_their_declarations_and_end() {
+        let proc = "create or replace procedure p(a number) is\n  x number := 1;\nbegin\n  null;\nend p;";
+        assert_eq!(texts(&format!("{proc}\nselect 1 from dual;"), DbDriver::Oracle), vec![proc, "select 1 from dual"]);
+        let trigger =
+            "CREATE TRIGGER t BEFORE INSERT ON x FOR EACH ROW\nDECLARE n NUMBER;\nBEGIN\n  :new.id := 1;\nEND;";
+        assert_eq!(
+            texts(&format!("{trigger}\nselect 2 from dual"), DbDriver::Oracle),
+            vec![trigger, "select 2 from dual"]
+        );
+        // Packages end at `/` (or the end of the script), like in SQL*Plus.
+        let spec = "create package k as\n  procedure a;\n  function f return number;\nend k;";
+        let body = "create package body k as\n  procedure a is begin null; end;\n  function f return number is begin return 1; end;\nbegin\n  null;\nend k;";
+        assert_eq!(
+            texts(&format!("{spec}\n/\n{body}\n/\nselect 3 from dual;"), DbDriver::Oracle),
+            vec![spec, body, "select 3 from dual"]
+        );
+        // Other CREATE statements and object types stay plain SQL.
+        assert_eq!(
+            texts(
+                "create view v as select 1 x from dual; create type t as object (a number); select 4",
+                DbDriver::Oracle
+            ),
+            vec!["create view v as select 1 x from dual", "create type t as object (a number)", "select 4"]
+        );
+    }
 }
@@ -46,6 +46,23 @@ pub fn databases(templates: bool) -> &'static str {
 /// Databases of managed services that their users cannot use (hidden unless connected to).
 pub const INTERNAL_DATABASES: &[&str] = &["rdsadmin", "azure_maintenance", "azure_sys", "cloudsqladmin"];

+/// Oracle system accounts hidden unless `show_system` (see the Schemas tab).
+pub const ORACLE_SYSTEM_SCHEMAS: &[&str] = &[
+    "CTXSYS",
+    "DBSFWUSER",
+    "DVSYS",
+    "GSMADMIN_INTERNAL",
+    "LBACSYS",
+    "MDDATA",
+    "MDSYS",
+    "OLAPSYS",
+    "OUTLN",
+    "SYS",
+    "SYSTEM",
+    "XDB",
+    "XS$NULL",
+];
+
 pub fn schemas(driver: DbDriver, system: bool) -> &'static str {
    match driver {
        DbDriver::Sqlite => "SELECT name FROM pragma_database_list WHERE name <> 'temp' ORDER BY seq",
@@ -59,6 +76,12 @@ pub fn schemas(driver: DbDriver, system: bool) -> &'static str {
        }
        DbDriver::Mysql if system => "SELECT schema_name FROM information_schema.schemata ORDER BY 1",
        DbDriver::SqlServer if system => "SELECT schema_name FROM information_schema.schemata ORDER BY 1",
+        DbDriver::Oracle if system => "SELECT username FROM all_users ORDER BY username",
+        DbDriver::Oracle => {
+            "SELECT username FROM all_users WHERE username NOT IN \
+             ('CTXSYS', 'DBSFWUSER', 'DVSYS', 'GSMADMIN_INTERNAL', 'LBACSYS', 'MDDATA', 'MDSYS', 'OLAPSYS', \
+             'OUTLN', 'SYS', 'SYSTEM', 'XDB', 'XS$NULL') ORDER BY username"
+        }
        DbDriver::Postgres => {
            "SELECT schema_name FROM information_schema.schemata \
             WHERE schema_name NOT IN ('pg_catalog', 'information_schema') \
@@ -89,6 +112,12 @@ pub fn tables(driver: DbDriver, schema: &str) -> String {
             AND name NOT LIKE 'sqlite\\_%' ESCAPE '\\' ORDER BY name",
            quote_ident(driver, schema)
        ),
+        DbDriver::Oracle => format!(
+            "SELECT table_name, 'table' FROM all_tables WHERE owner = {} \
+             UNION ALL SELECT view_name, 'view' FROM all_views WHERE owner = {} ORDER BY 1",
+            quote_literal(driver, schema),
+            quote_literal(driver, schema)
+        ),
        DbDriver::Postgres => format!(
            "SELECT c.relname, CASE c.relkind WHEN 'v' THEN 'view' WHEN 'm' THEN 'materialized view' ELSE 'table' END \
             FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace \
@@ -148,6 +177,17 @@ pub fn columns(driver: DbDriver, schema: &str, table: &str) -> String {
             FROM information_schema.columns c WHERE c.table_schema = {s} AND c.table_name = {t} \
             ORDER BY c.ordinal_position"
        ),
+        DbDriver::Oracle => format!(
+            "SELECT c.column_name, c.data_type, DECODE(c.nullable, 'Y', 'YES', 'NO'), c.data_default, \
+             CASE WHEN k.column_name IS NOT NULL THEN 1 ELSE 0 END \
+             FROM all_tab_columns c \
+             LEFT JOIN (SELECT kc.column_name FROM all_constraints con \
+               JOIN all_cons_columns kc ON kc.owner = con.owner AND kc.table_name = con.table_name \
+               AND kc.constraint_name = con.constraint_name \
+               WHERE con.constraint_type = 'P' AND con.owner = {s} AND con.table_name = {t}) k \
+             ON k.column_name = c.column_name \
+             WHERE c.owner = {s} AND c.table_name = {t} ORDER BY c.column_id"
+        ),
    }
 }

@@ -185,6 +225,12 @@ pub fn indexes(driver: DbDriver, schema: &str, table: &str) -> String {
             WHERE OBJECT_SCHEMA_NAME(i.object_id) = {s} AND OBJECT_NAME(i.object_id) = {t} AND i.name IS NOT NULL \
             ORDER BY i.name, ic.key_ordinal"
        ),
+        DbDriver::Oracle => format!(
+            "SELECT i.index_name, CASE WHEN i.uniqueness = 'UNIQUE' THEN 1 ELSE 0 END, ic.column_name \
+             FROM all_indexes i JOIN all_ind_columns ic \
+             ON ic.index_owner = i.owner AND ic.index_name = i.index_name \
+             WHERE i.owner = {s} AND i.table_name = {t} ORDER BY i.index_name, ic.column_position"
+        ),
    }
 }

@@ -245,6 +291,21 @@ pub fn completion_columns(driver: DbDriver) -> &'static str {
             WHERE c.table_schema NOT IN ('sys', 'information_schema') \
             ORDER BY c.table_schema, c.table_name, c.ordinal_position"
        }
+        DbDriver::Oracle => {
+            "SELECT c.owner, c.table_name, CASE WHEN v.view_name IS NOT NULL THEN 'view' ELSE 'table' END, \
+             c.column_name, c.data_type, DECODE(c.nullable, 'Y', 'YES', 'NO'), \
+             CASE WHEN k.column_name IS NOT NULL THEN 1 ELSE 0 END, \
+             CASE WHEN c.data_default IS NOT NULL THEN 1 ELSE 0 END \
+             FROM all_tab_columns c \
+             LEFT JOIN all_views v ON v.owner = c.owner AND v.view_name = c.table_name \
+             LEFT JOIN (SELECT con.owner, con.table_name, kc.column_name FROM all_constraints con \
+               JOIN all_cons_columns kc ON kc.owner = con.owner AND kc.table_name = con.table_name \
+               AND kc.constraint_name = con.constraint_name WHERE con.constraint_type = 'P') k \
+             ON k.owner = c.owner AND k.table_name = c.table_name AND k.column_name = c.column_name \
+             WHERE c.owner NOT IN ('CTXSYS', 'DBSFWUSER', 'DVSYS', 'GSMADMIN_INTERNAL', 'LBACSYS', 'MDDATA', \
+             'MDSYS', 'OLAPSYS', 'OUTLN', 'SYS', 'SYSTEM', 'XDB', 'XS$NULL') \
+             ORDER BY c.owner, c.table_name, c.column_id FETCH FIRST 50000 ROWS ONLY"
+        }
    }
 }

@@ -284,6 +345,19 @@ pub fn foreign_keys(driver: DbDriver) -> &'static str {
             AND table_schema NOT IN ('sys', 'information_schema') \
             ORDER BY table_schema, table_name, constraint_name, ordinal_position"
        }
+        DbDriver::Oracle => {
+            "SELECT con.owner, con.table_name, con.constraint_name, col.column_name, \
+             rcon.owner, rcon.table_name, rcol.column_name \
+             FROM all_constraints con \
+             JOIN all_cons_columns col ON col.owner = con.owner AND col.table_name = con.table_name \
+             AND col.constraint_name = con.constraint_name \
+             JOIN all_constraints rcon ON rcon.owner = con.r_owner AND rcon.constraint_name = con.r_constraint_name \
+             JOIN all_cons_columns rcol ON rcol.owner = rcon.owner AND rcol.table_name = rcon.table_name \
+             AND rcol.constraint_name = rcon.constraint_name \
+             WHERE con.constraint_type = 'R' AND con.owner NOT IN ('CTXSYS', 'DBSFWUSER', 'DVSYS', \
+             'GSMADMIN_INTERNAL', 'LBACSYS', 'MDDATA', 'MDSYS', 'OLAPSYS', 'OUTLN', 'SYS', 'SYSTEM', 'XDB', 'XS$NULL') \
+             ORDER BY 1, 2, 3, col.position FETCH FIRST 20000 ROWS ONLY"
+        }
    }
 }

@@ -304,6 +378,9 @@ pub fn table_foreign_keys(driver: DbDriver, schema: &str, table: &str) -> String
        DbDriver::SqlServer => format!(
            "SELECT table_schema, table_name, constraint_name, column_name,              referenced_table_schema, referenced_table_name, referenced_column_name              FROM information_schema.key_column_usage WHERE referenced_table_name IS NOT NULL              AND table_schema = {s} AND table_name = {t} ORDER BY constraint_name, ordinal_position"
        ),
+        DbDriver::Oracle => format!(
+            "SELECT con.owner, con.table_name, con.constraint_name, col.column_name,              rcon.owner, rcon.table_name, rcol.column_name              FROM all_constraints con              JOIN all_cons_columns col ON col.owner = con.owner AND col.table_name = con.table_name              AND col.constraint_name = con.constraint_name              JOIN all_constraints rcon ON rcon.owner = con.r_owner AND rcon.constraint_name = con.r_constraint_name              JOIN all_cons_columns rcol ON rcol.owner = rcon.owner AND rcol.table_name = rcon.table_name              AND rcol.constraint_name = rcon.constraint_name              WHERE con.constraint_type = 'R' AND con.owner = {s} AND con.table_name = {t}              ORDER BY con.constraint_name, col.position"
+        ),
    }
 }

@@ -315,6 +392,7 @@ pub fn current_schema(driver: DbDriver) -> Option<&'static str> {
        DbDriver::Postgres => Some("SELECT current_schema()"),
        DbDriver::Mysql => Some("SELECT DATABASE()"),
        DbDriver::SqlServer => Some("SELECT DB_NAME()"),
+        DbDriver::Oracle => Some("SELECT SYS_CONTEXT('USERENV', 'CURRENT_SCHEMA') FROM DUAL"),
    }
 }

@@ -359,6 +437,8 @@ pub fn table_page(
            sql.push_str(" ORDER BY (SELECT 1)");
        }
        sql.push_str(&format!(" OFFSET {offset} ROWS FETCH NEXT {} ROWS ONLY", limit + 1));
+    } else if driver == DbDriver::Oracle {
+        sql.push_str(&format!(" OFFSET {offset} ROWS FETCH FIRST {} ROWS ONLY", limit + 1));
    } else {
        sql.push_str(&format!(" LIMIT {} OFFSET {offset}", limit + 1));
    }
@@ -421,6 +501,8 @@ pub fn edit_statement(driver: DbDriver, schema: &str, table: &str, edit: &DbRowE
            if values.is_empty() {
                return Ok(match driver {
                    DbDriver::Mysql => format!("INSERT INTO {target} () VALUES ()"),
+                    // Oracle has no DEFAULT VALUES; without columns there is nothing to insert.
+                    DbDriver::Oracle => return Err("Oracle needs at least one column value to insert".into()),
                    _ => format!("INSERT INTO {target} DEFAULT VALUES"),
                });
            }
@@ -509,6 +591,12 @@ pub fn triggers(driver: DbDriver, schema: &str, table: &str) -> String {
            "SELECT t.name, lower(te.type_desc), '' FROM sys.triggers t \
             WHERE OBJECT_SCHEMA_NAME(t.parent_id) = {s} AND OBJECT_NAME(t.parent_id) = {t} ORDER BY 1"
        ),
+        DbDriver::Oracle => format!(
+            "SELECT trigger_name, CASE WHEN trigger_type LIKE 'BEFORE%' THEN 'before' \
+             WHEN trigger_type LIKE 'INSTEAD%' THEN 'instead of' ELSE 'after' END, \
+             lower(replace(triggering_event, ' OR ', ',')) \
+             FROM all_triggers WHERE owner = {s} AND table_name = {t} ORDER BY 1"
+        ),
    }
 }

@@ -551,17 +639,28 @@ pub fn routines(driver: DbDriver, schema: &str) -> Option<String> {
            "SELECT r.routine_name, lower(r.routine_type), '', r.data_type \
             FROM information_schema.routines r WHERE r.routine_schema = {s} ORDER BY 1"
        )),
+        DbDriver::Oracle => Some(format!(
+            "SELECT object_name, CASE object_type WHEN 'PROCEDURE' THEN 'procedure' ELSE 'function' END, '', NULL \
+             FROM all_objects WHERE owner = {s} AND object_type IN ('PROCEDURE', 'FUNCTION') \
+             AND object_name NOT LIKE 'BIN$%' ORDER BY 1"
+        )),
    }
 }

-/// Rows: `name, data type` of a schema's sequences (PostgreSQL).
+/// Rows: `name, data type` of a schema's sequences (PostgreSQL, Oracle).
 pub fn sequences(driver: DbDriver, schema: &str) -> Option<String> {
-    (driver == DbDriver::Postgres).then(|| {
-        format!(
+    match driver {
+        DbDriver::Postgres => Some(format!(
            "SELECT sequence_name, data_type FROM information_schema.sequences WHERE sequence_schema = {} ORDER BY 1",
            quote_literal(driver, schema)
-        )
-    })
+        )),
+        // Every sequence is numeric; ALL_SEQUENCES has no data_type column before 18c.
+        DbDriver::Oracle => Some(format!(
+            "SELECT sequence_name, 'NUMBER' FROM all_sequences WHERE sequence_owner = {} ORDER BY 1",
+            quote_literal(driver, schema)
+        )),
+        _ => None,
+    }
 }

 /// The statement reading the definition of a routine (a row per overload), trigger
@@ -606,6 +705,26 @@ pub fn object_ddl(driver: DbDriver, schema: &str, kind: crate::DbObjectKind, nam
        (DbDriver::Mysql, K::Function) => (format!("SHOW CREATE FUNCTION {target}"), 2),
        (DbDriver::Mysql, K::Procedure) => (format!("SHOW CREATE PROCEDURE {target}"), 2),
        (DbDriver::Mysql, K::Trigger) => (format!("SHOW CREATE TRIGGER {target}"), 2),
+        (DbDriver::Oracle, K::Function | K::Procedure | K::Trigger) => (
+            format!(
+                "SELECT DBMS_METADATA.GET_DDL('{}', {n}, {s}) FROM DUAL",
+                match kind {
+                    K::Function => "FUNCTION",
+                    K::Procedure => "PROCEDURE",
+                    _ => "TRIGGER",
+                }
+            ),
+            0,
+        ),
+        (DbDriver::Oracle, K::Sequence) => (
+            format!(
+                "SELECT 'create sequence ' || {n} || E'\\n    increment by ' || increment_by || \
+                 E'\\n    minvalue ' || min_value || E'\\n    maxvalue ' || max_value || \
+                 E'\\n    start with ' || last_number || CASE WHEN cycle_flag = 'Y' THEN E'\\n    cycle' ELSE '' END \
+                 FROM all_sequences WHERE sequence_owner = {s} AND sequence_name = {n}"
+            ),
+            0,
+        ),
        _ => return None,
    })
 }
@@ -792,6 +911,64 @@ mod tests {
        assert!(completion_columns(DbDriver::SqlServer).contains("information_schema.columns"));
    }

+    #[test]
+    fn oracle_quoting_pages_and_current_schema() {
+        assert_eq!(quote_ident(DbDriver::Oracle, "a\"b"), "\"a\"\"b\"");
+        assert_eq!(quote_literal(DbDriver::Oracle, "it's"), "'it''s'");
+        assert_eq!(qualified(DbDriver::Oracle, "hr", "employees"), "\"hr\".\"employees\"");
+        assert_eq!(current_schema(DbDriver::Oracle), Some("SELECT SYS_CONTEXT('USERENV', 'CURRENT_SCHEMA') FROM DUAL"));
+        assert_eq!(crate::conn::begin_statement(DbDriver::Oracle), "");
+        let sort = [SortKey { column: "id".into(), descending: true }];
+        assert_eq!(
+            table_page(DbDriver::Oracle, "hr", "employees", Some("WHERE id > 3"), &sort, 50, 25),
+            "SELECT * FROM \"hr\".\"employees\" WHERE id > 3 ORDER BY \"id\" DESC OFFSET 50 ROWS FETCH FIRST 26 ROWS ONLY"
+        );
+        assert_eq!(
+            table_page(DbDriver::Oracle, "", "t", None, &[], 0, 10),
+            "SELECT * FROM \"t\" OFFSET 0 ROWS FETCH FIRST 11 ROWS ONLY"
+        );
+    }
+
+    #[test]
+    fn oracle_introspection_queries() {
+        assert_eq!(DbDriver::Oracle.default_port(), Some(1521));
+        assert!(schemas(DbDriver::Oracle, true).contains("all_users"));
+        assert!(schemas(DbDriver::Oracle, false).contains("'MDSYS'"));
+        assert!(tables(DbDriver::Oracle, "hr").contains("all_tables"));
+        assert!(tables(DbDriver::Oracle, "hr").contains("all_views"));
+        let cols = columns(DbDriver::Oracle, "hr", "employees");
+        assert!(cols.contains("all_tab_columns"));
+        assert!(cols.contains("DECODE(c.nullable, 'Y', 'YES', 'NO')"));
+        assert!(cols.contains("constraint_type = 'P'"));
+        assert!(indexes(DbDriver::Oracle, "hr", "t").contains("all_indexes"));
+        assert!(foreign_keys(DbDriver::Oracle).contains("constraint_type = 'R'"));
+        assert!(table_foreign_keys(DbDriver::Oracle, "hr", "t").contains("all_cons_columns"));
+        assert!(completion_columns(DbDriver::Oracle).contains("all_tab_columns"));
+        assert!(triggers(DbDriver::Oracle, "hr", "t").contains("all_triggers"));
+        assert!(routines(DbDriver::Oracle, "hr").unwrap().contains("all_objects"));
+        assert!(sequences(DbDriver::Oracle, "hr").unwrap().contains("all_sequences"));
+    }
+
+    #[test]
+    fn oracle_edits_and_object_ddl() {
+        let key = vec![cv("id", Some("1"))];
+        assert_eq!(
+            edit_statement(
+                DbDriver::Oracle,
+                "hr",
+                "t",
+                &DbRowEdit::Update { key: key.clone(), values: vec![cv("n", Some("x"))] }
+            )
+            .unwrap(),
+            "UPDATE \"hr\".\"t\" SET \"n\" = 'x' WHERE \"id\" = '1'"
+        );
+        assert!(edit_statement(DbDriver::Oracle, "hr", "t", &DbRowEdit::Insert { values: vec![] }).is_err());
+        use crate::DbObjectKind as K;
+        let (q, col) = object_ddl(DbDriver::Oracle, "hr", K::Procedure, "p").unwrap();
+        assert!(q.contains("DBMS_METADATA.GET_DDL('PROCEDURE'") && col == 0);
+        assert!(object_ddl(DbDriver::Oracle, "hr", K::Sequence, "q").unwrap().0.contains("all_sequences"));
+    }
+
    #[test]
    fn sqlite_trigger_events() {
        let ev = sqlite_trigger_event;
@@ -440,3 +440,89 @@ pub fn compose_op(
    });
    run_streaming(ep, None, &args, cancel, on_output)
 }
+
+/// Whether `ep` is a daemon on this machine, where a bind mount of the project
+/// is this machine's folder. The CLI's default daemon and a context are looked
+/// up (`DOCKER_HOST`, else the context's endpoint).
+pub fn endpoint_is_local(ep: &DockerEndpoint) -> IdeResult<bool> {
+    let url = match ep {
+        DockerEndpoint::Socket { path } => path.trim().to_owned(),
+        DockerEndpoint::Tcp { host, .. } => {
+            let host = host.trim();
+            if host.contains("://") { host.to_owned() } else { format!("tcp://{host}") }
+        }
+        DockerEndpoint::Default => {
+            match ide_core::process::host_var_os("DOCKER_HOST").map(|v| v.to_string_lossy().trim().to_owned()) {
+                Some(url) if !url.is_empty() => url,
+                _ => context_host(ep, None)?,
+            }
+        }
+        DockerEndpoint::Context { name } => context_host(&DockerEndpoint::Default, Some(name.trim()))?,
+    };
+    Ok(daemon_url_is_local(&url))
+}
+
+/// The daemon URL of context `name` (the current one with `None`).
+fn context_host(ep: &DockerEndpoint, name: Option<&str>) -> IdeResult<String> {
+    let mut args = vec!["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"];
+    args.extend(name);
+    Ok(run(ep, &args, QUICK)?.trim().to_owned())
+}
+
+/// `unix://`, `npipe://`, a bare socket path and TCP on the loopback address are
+/// this machine; `ssh://` and other hosts are not.
+pub fn daemon_url_is_local(url: &str) -> bool {
+    let url = url.trim();
+    let Some((scheme, rest)) = url.split_once("://") else { return true };
+    match scheme {
+        "unix" | "npipe" => true,
+        "tcp" | "http" | "https" => {
+            let host = rest.split('/').next().unwrap_or_default();
+            let host = match host.strip_prefix('[') {
+                Some(v6) => v6.split(']').next().unwrap_or_default(),
+                None => host.rsplit_once(':').map_or(host, |(h, _)| h),
+            };
+            matches!(host, "localhost" | "127.0.0.1" | "::1")
+        }
+        _ => false,
+    }
+}
+
+/// `docker compose config --format json` of the project at `dir` (`files`
+/// relative to it; none = the project's default file).
+pub fn compose_config(ep: &DockerEndpoint, dir: &Path, files: &[String]) -> IdeResult<String> {
+    let mut args: Vec<&str> = vec!["compose"];
+    for f in files.iter().map(|f| f.trim()).filter(|f| !f.is_empty()) {
+        args.extend(["--file", f]);
+    }
+    args.extend(["config", "--format", "json"]);
+    let mut cmd = command(ep, &args)?;
+    cmd.current_dir(dir);
+    let out = process::run(cmd, QUICK, None)?;
+    if out.success { Ok(out.stdout) } else { Err(failure(&args, &out.stderr, &out.stdout)) }
+}
+
+#[cfg(test)]
+mod local_tests {
+    use super::*;
+
+    #[test]
+    fn local_daemon_urls() {
+        for url in [
+            "unix:///var/run/docker.sock",
+            "/var/run/docker.sock",
+            "npipe:////./pipe/docker_engine",
+            "tcp://localhost:2375",
+            "tcp://127.0.0.1:2376",
+            "tcp://[::1]:2375",
+            "",
+        ] {
+            assert!(daemon_url_is_local(url), "{url}");
+        }
+        for url in ["ssh://me@build", "tcp://build:2376", "tcp://10.0.0.5:2375", "https://docker.example.com"] {
+            assert!(!daemon_url_is_local(url), "{url}");
+        }
+        assert!(endpoint_is_local(&DockerEndpoint::Socket { path: "/run/user/1000/docker.sock".into() }).unwrap());
+        assert!(!endpoint_is_local(&DockerEndpoint::Tcp { host: "build:2376".into(), tls_cert_dir: None }).unwrap());
+    }
+}
@@ -32,7 +32,7 @@ use std::path::{Component, Path, PathBuf};

 pub const MANIFEST_FILE: &str = "plugin.toml";
 /// The plugin API (engine) version this host implements.
-pub const ENGINE_VERSION: &str = "1.1.0";
+pub const ENGINE_VERSION: &str = "1.2.0";
 /// The 0.1 API, still accepted for contribution-only packages and 0.1 components.
 pub const LEGACY_API: &str = "0.1";
 /// Marketplace categories, in the order they are shown.
@@ -98,7 +98,15 @@ fn parse_unary(t: &[Tok], p: &mut usize, src: &str) -> Result<(), String> {
            *p += 1;
            Ok(())
        }
-        Some(Tok::Id(_)) => {
+        Some(Tok::Id(id)) => {
+            if let Some(path) = id.strip_prefix("workspaceContains:")
+                && (path.is_empty()
+                    || path.starts_with('/')
+                    || path.contains('\\')
+                    || path.split('/').any(|s| s == ".."))
+            {
+                return Err(format!("workspaceContains: needs a relative path inside the project: {src}"));
+            }
            *p += 1;
            if matches!(t.get(*p), Some(Tok::Op("==" | "!="))) {
                *p += 1;
@@ -133,4 +141,23 @@ mod tests {
            assert!(validate_when(bad).is_err(), "{bad}");
        }
    }
+
+    #[test]
+    fn workspace_contains_paths_stay_in_the_project() {
+        for ok in [
+            "workspaceContains:pom.xml",
+            "workspaceContains:.devcontainer/devcontainer.json",
+            "!workspaceContains:a/b && editorFocus",
+        ] {
+            assert!(validate_when(ok).is_ok(), "{ok}");
+        }
+        for bad in [
+            "workspaceContains:",
+            "workspaceContains:/etc/passwd",
+            "workspaceContains:../x",
+            "workspaceContains:a/../../x",
+        ] {
+            assert!(validate_when(bad).unwrap_err().contains("workspaceContains"), "{bad}");
+        }
+    }
 }
@@ -92,6 +92,33 @@ fn format_range(text: &ide_text::Document, range: Range) -> formatter::FormatRan
    }
 }

+/// The edits PHP-CS-Fixer makes to the unsaved text: it fixes a temporary copy with the file's
+/// name (from stdin it doesn't fix anything), so the file on disk stays as it is.
+fn php_cs_fixer_edits(
+    tools: &Tools,
+    php: Option<&Path>,
+    fixer: &formatter::PhpCsFixer,
+    path: &Path,
+    unsaved: &str,
+) -> IdeResult<Vec<TextEdit>> {
+    let name = path.file_name().ok_or_else(|| IdeError::invalid("PHP-CS-Fixer: file has no name"))?;
+    let dir = tempfile::tempdir()?;
+    let copy = dir.path().join(name);
+    std::fs::write(&copy, unsaved)?;
+    formatter::run_php_cs_fixer(tools.php_cs_fixer_command(php, fixer, &copy)?, &Default::default())?;
+    let formatted = std::fs::read_to_string(&copy)?;
+    let text = ide_text::Document::new(unsaved);
+    Ok(text
+        .diff(&formatted)
+        .changes
+        .into_iter()
+        .map(|c| TextEdit {
+            range: Range::new(text.offset_to_pos(c.from), text.offset_to_pos(c.to)),
+            new_text: c.insert,
+        })
+        .collect())
+}
+
 pub async fn format(
    host: &Host,
    window: &str,
@@ -103,6 +130,34 @@ pub async fn format(
    let snap = project.documents.snapshot(doc)?;
    let settings = project.settings.effective();
    let language = project.languages.get(&snap.language);
+    // A committed PHP-CS-Fixer configuration takes over Reformat Code for `.php` files.
+    if options.tool.is_none()
+        && snap.path.extension().is_some_and(|e| e == "php")
+        && let Some(fixer) = formatter::php_cs_fixer(&snap.path)
+    {
+        if options.on_save && !settings.editor.format_on_save {
+            return Ok(Vec::new());
+        }
+        host.require_trust(window)?;
+        if snap.read_only {
+            return Err(IdeError::invalid("The file is read-only"));
+        }
+        let php = ide_sdk::apply::setting_path(&project.root, &settings.languages.php.interpreter);
+        let tools = Tools::new(&host.local_data_dir);
+        let edits = tokio::task::spawn_blocking(move || {
+            php_cs_fixer_edits(&tools, php.as_deref(), &fixer, &snap.path, &snap.text)
+        })
+        .await
+        .map_err(|e| IdeError::internal(e.to_string()))??;
+        if range.is_some() {
+            project.sink.emit(IdeEvent::Notify {
+                level: NotifyLevel::Info,
+                title: "PHP-CS-Fixer".into(),
+                body: Some("PHP-CS-Fixer does not support selection formatting; formatted the whole file".into()),
+            });
+        }
+        return Ok(edits);
+    }
    let mut selected = external_tool(options.tool, language.as_ref(), &snap.path, &settings.languages)?;
    if let Some(tool) = selected
        && options.tool.is_none()
@@ -273,6 +328,59 @@ mod tests {
        assert_eq!(rust.message, "oxfmt cannot format Rust files");
    }

+    #[test]
+    fn php_cs_fixer_needs_a_config_and_the_project_binary() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::create_dir_all(root.join("src/Http")).unwrap();
+        let file = root.join("src/Http/Kernel.php");
+        assert_eq!(formatter::php_cs_fixer(&file), None);
+        std::fs::write(root.join(".php-cs-fixer.dist.php"), "<?php").unwrap();
+        assert_eq!(formatter::php_cs_fixer(&file), None, "no vendor/bin/php-cs-fixer");
+        std::fs::create_dir_all(root.join("vendor/bin")).unwrap();
+        std::fs::write(root.join("vendor/bin/php-cs-fixer"), "").unwrap();
+        let found = formatter::php_cs_fixer(&file).unwrap();
+        assert_eq!(found.config, root.join(".php-cs-fixer.dist.php"));
+        assert_eq!(found.bin, root.join("vendor/bin/php-cs-fixer"));
+        std::fs::write(root.join(".php-cs-fixer.php"), "<?php").unwrap();
+        assert_eq!(formatter::php_cs_fixer(&file).unwrap().config, root.join(".php-cs-fixer.php"));
+        std::fs::write(root.join("src/.php-cs-fixer.dist.php"), "<?php").unwrap();
+        assert_eq!(formatter::php_cs_fixer(&file).unwrap().config, root.join("src/.php-cs-fixer.dist.php"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn php_cs_fixer_fixes_a_copy_of_the_unsaved_text() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let fixer = formatter::PhpCsFixer { config: root.join(".php-cs-fixer.dist.php"), bin: root.join("fixer") };
+        std::fs::write(&fixer.config, "<?php").unwrap();
+        let php = root.join("php");
+        // Stands in for `php vendor/bin/php-cs-fixer fix … <file>`: rewrites the last argument.
+        std::fs::write(
+            &php,
+            "#!/bin/sh\nfor last; do :; done\ncase \"$last\" in */Kernel.php) ;; *) exit 3 ;; esac\n\
+             [ \"$2\" = fix ] || exit 4\nsed 's/  echo/    echo/' \"$last\" > \"$last.new\" && mv \"$last.new\" \"$last\"\n",
+        )
+        .unwrap();
+        std::fs::set_permissions(&php, std::fs::Permissions::from_mode(0o755)).unwrap();
+        let file = root.join("src/Kernel.php");
+        let tools = Tools::new(&root.join("tools"));
+        let edits = php_cs_fixer_edits(&tools, Some(&php), &fixer, &file, "<?php\n  echo 1;\n").unwrap();
+        assert_eq!(edits.len(), 1);
+        assert_eq!(edits[0].new_text, "  ");
+        assert!(!file.exists(), "the file on disk is left alone");
+
+        std::fs::write(&php, "#!/bin/sh\necho 'Configuration file is invalid' >&2\nexit 16\n").unwrap();
+        let err = php_cs_fixer_edits(&tools, Some(&php), &fixer, &file, "<?php\n").unwrap_err();
+        assert!(
+            err.message.starts_with("PHP-CS-Fixer: ") && err.message.contains("Configuration file is invalid"),
+            "{}",
+            err.message
+        );
+    }
+
    #[test]
    fn ruff_ranges_are_one_based_unicode_columns() {
        let text = ide_text::Document::new("😀x = 1\ny  =  2\n");
@@ -223,6 +223,10 @@ impl Host {
            self.cancel_request(request);
        }
        let project = self.projects.write().remove(window)?;
+        if let Some(plugins) = plugins::editor_plugin_host() {
+            plugins.invalidate_client_navigation(&project.root, Some(window), None);
+            plugins.set_active_file(window, None);
+        }
        if !project.light {
            self.environment.project_closed();
        }
@@ -245,6 +249,7 @@ impl Host {
            project.kotlin_bridge.iter().cloned().collect(),
            Some(project.lsp.clone()),
            Some((self.debugger.clone(), window.to_owned())),
+            Some(project),
        ))
    }

@@ -257,6 +262,7 @@ impl Host {
        bridges: Vec<Arc<kotlin_bridge::KotlinBridge>>,
        lsp: Option<Arc<ide_lsp::LspManager>>,
        debug: Option<(Arc<ide_dap::DebugManager>, String)>,
+        retired: Option<Arc<Project>>,
    ) -> std::thread::JoinHandle<()> {
        for bridge in &bridges {
            bridge.stop();
@@ -266,6 +272,10 @@ impl Host {
        }
        let runtime = self.runtime.clone();
        std::thread::spawn(move || {
+            // Dropping the project stops its file watcher and index worker, which first finish the
+            // batch they are applying (many file events while a build writes its output), so it
+            // isn't done on the closing caller's thread (the UI thread for a window close).
+            let retired = retired.map(|project| std::thread::spawn(move || drop(project)));
            runtime.block_on(async move {
                for bridge in bridges {
                    bridge.shutdown().await;
@@ -280,6 +290,9 @@ impl Host {
                    debug.stop_key(&key).await;
                }
            });
+            if let Some(retired) = retired {
+                let _ = retired.join();
+            }
        })
    }

@@ -319,6 +332,7 @@ impl Host {
            projects.iter().filter_map(|project| project.kotlin_bridge.clone()).collect(),
            None,
            None,
+            None,
        ));
        let deadline = std::time::Instant::now() + EXIT_SHUTDOWN_WAIT;
        while pending.iter().any(|handle| !handle.is_finished()) {
@@ -422,3 +436,37 @@ impl Host {
        self.projects.write().insert(window.to_owned(), project);
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn detached_close_releases_the_project_before_a_reopen() {
+        let temp = tempfile::tempdir().unwrap();
+        let base = dunce::canonicalize(temp.path()).unwrap();
+        let root = base.join("project");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::write(root.join("main.rs"), "fn main() {}\n").unwrap();
+        let host = Host::new(HostConfig {
+            config_dir: base.join("config"),
+            data_dir: base.join("data"),
+            local_data_dir: base.join("local"),
+            languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+            syntax: Arc::default(),
+            sink_for: Box::new(|_| Arc::new(|_| {})),
+            owner: |w| w,
+            runtime: tokio::runtime::Handle::current(),
+            project_environment: false,
+        });
+        let project = Arc::downgrade(&host.open_project("main", &root).unwrap());
+        host.close_project_detached("main");
+        assert!(host.project("main").is_err());
+        // The project (its file watcher and index database) is dropped off the closing thread, but
+        // before opening a project waits out the close.
+        host.wait_detached_closes();
+        assert!(project.upgrade().is_none(), "the closed project is dropped");
+        host.open_project("main", &root).unwrap();
+        host.close_project("main");
+    }
+}
@@ -162,6 +162,11 @@ pub async fn debug_pause(host: &Host, _window: &str, session: DebugSessionId, th
    host.debugger.pause(session, thread_id).await
 }

+/// Types `text` into the session's program (a `runInTerminal` program).
+pub async fn debug_send_input(host: &Host, _window: &str, session: DebugSessionId, text: String) -> IdeResult<()> {
+    host.debugger.send_input(session, &text)
+}
+
 pub async fn debug_hot_reload(host: &Host, _window: &str, session: DebugSessionId) -> IdeResult<()> {
    host.debugger.hot_reload(session).await
 }
@@ -381,6 +386,9 @@ pub(crate) fn register(d: &mut Dispatcher) {
        "debug_pause",
        |c| async move { debug_pause(&c.host, &c.window, c.arg("session")?, c.arg("threadId")?).await },
    );
+    d.add("debug_send_input", |c| async move {
+        debug_send_input(&c.host, &c.window, c.arg("session")?, c.arg("text")?).await
+    });
    d.add("debug_step", |c| async move {
        debug_step(&c.host, &c.window, c.arg("session")?, c.arg("threadId")?, c.arg("kind")?).await
    });
@@ -204,6 +204,17 @@ pub async fn lsp_signature_help(host: &Host, window: &str, doc: DocId, pos: Pos)
 }

 pub async fn lsp_goto(host: &Host, window: &str, doc: DocId, pos: Pos, kind: GotoKind) -> IdeResult<Vec<Location>> {
+    if kind == GotoKind::Definition
+        && let Some(plugins) = crate::plugins::editor_plugin_host()
+    {
+        let project = host.project(window)?;
+        let (path, version) = project.documents.identity(doc)?;
+        if let Some(found) = plugins.navigation_at(&project.root, &path, version, pos, Some(window), |p| {
+            project.documents.by_path(p).and_then(|id| project.documents.version(id).ok())
+        }) {
+            return Ok(found.targets);
+        }
+    }
    let result = host.project(window)?.lsp.goto(doc, pos, kind).await;
    if kind != GotoKind::Definition {
        return result;
@@ -257,6 +268,28 @@ pub async fn lsp_implementations(
    result
 }

+/// Go to Implementation of the symbol at `pos`. Implementations found before a slower
+/// search for the rest (Java: the project's, before the dependencies') arrive on
+/// `on_partial`; the result has them all. Cancel with `cancel_request(request)`.
+pub async fn lsp_goto_implementation(
+    host: &Host,
+    window: &str,
+    request: RequestId,
+    doc: DocId,
+    pos: Pos,
+    on_partial: super::Channel<Vec<Location>>,
+) -> IdeResult<Vec<Location>> {
+    let lsp = host.project(window)?.lsp.clone();
+    let cancel = host.begin_request(request);
+    let result = lsp
+        .goto_implementation(doc, pos, cancel, &|locs| {
+            let _ = on_partial.send(locs);
+        })
+        .await;
+    host.end_request(request);
+    result
+}
+
 /// Contents of a read-only language-server document, including JDT library
 /// classes and disk class files. Cached per project.
 pub async fn lsp_virtual_document(host: &Host, window: &str, uri: String) -> IdeResult<VirtualDocument> {
@@ -746,6 +779,10 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("lsp_implementations", |c| async move {
        lsp_implementations(&c.host, &c.window, c.arg("request")?, c.arg("doc")?, c.arg("positions")?).await
    });
+    d.add("lsp_goto_implementation", |c| async move {
+        let on_partial = c.sender("onPartial")?;
+        lsp_goto_implementation(&c.host, &c.window, c.arg("request")?, c.arg("doc")?, c.arg("pos")?, on_partial).await
+    });
    d.add(
        "lsp_resolve_class_file",
        |c| async move { lsp_resolve_class_file(&c.host, &c.window, c.arg("path")?).await },
@@ -1,5 +1,6 @@
 use super::Emit;
 use crate::Host;
+use ide_core::remote_settings::RunTargetKind;
 use ide_core::{IdeError, IdeResult, RunId};
 use ide_run::{OutputChunk, RunConfig, RunInfo, StartOptions};
 use std::time::Duration;
@@ -140,12 +141,33 @@ pub async fn start(host: &Host, window: &str, config: RunConfig, on_output: Emit
    if config.command.is_empty() {
        return Err(IdeError::invalid("run configuration has no command"));
    }
-    // Settings › Run Targets: over SSH.
+    // Settings › Run Targets: over SSH, or in a container.
    if config.kind == "tomcat" && config.extras.target.as_deref().is_some_and(|t| !t.is_empty()) {
        return Err(IdeError::invalid("Tomcat Local requires the local machine"));
    }
-    if config.extras.target.as_deref().is_some_and(|t| !t.is_empty()) {
+    if let Some(id) = config.extras.target.as_deref().filter(|t| !t.is_empty()) {
        let settings = project.settings.effective();
+        let target = ide_remote::service::run_target(&settings, id)?;
+        if target.kind != RunTargetKind::Ssh {
+            // A local run of the docker CLI: the command is resolved in the container, and
+            // this machine's toolchains and `PYTHONPATH` don't apply.
+            let config = container::prepare(host, &project.root, target, config).await?;
+            let encoding = settings.console.encoding;
+            let options = StartOptions {
+                encoding: Some(encoding).filter(|e| !e.trim().is_empty()),
+                python_paths: Vec::new(),
+                // A folder on this machine: not in the container.
+                ruby_reporter: None,
+            };
+            project.require_trust()?;
+            return host.processes.start(
+                &project.root,
+                &config,
+                &options,
+                project.sink.clone(),
+                Box::new(move |c| on_output(c)),
+            );
+        }
        let out = on_output.clone();
        return host
            .remote
@@ -271,4 +293,5 @@ pub fn list(host: &Host) -> Vec<RunInfo> {
 }

 mod commands;
+mod container;
 pub use commands::*;
@@ -0,0 +1,108 @@
+//! Docker and Compose run targets: the configuration becomes a local run of the
+//! docker CLI (see `ide_remote::docker`).
+
+use crate::Host;
+use ide_core::remote_settings::{RunTarget, RunTargetKind};
+use ide_core::{IdeError, IdeResult};
+use ide_docker::DockerEndpoint;
+use ide_remote::docker::{
+    ContainerRun, compose_container_root, container_config, container_name, default_container_root,
+};
+use ide_run::RunConfig;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+/// `config` rewritten to run in a new container of `target`'s image or service.
+pub(super) async fn prepare(host: &Host, root: &Path, target: RunTarget, config: RunConfig) -> IdeResult<RunConfig> {
+    if config.kind == "dotnet" || config.kind == "dotnet-test" {
+        return Err(IdeError::invalid(".NET Project requires the local machine"));
+    }
+    let endpoint = endpoint(&host.data_dir, &target)?;
+    let root = root.to_path_buf();
+    host.blocking(move || {
+        if !ide_docker::endpoint_is_local(&endpoint)? {
+            return Err(IdeError::invalid(format!(
+                "Run target '{}' uses a Docker daemon on another machine: the project can only be mounted from a local one",
+                target.name
+            )));
+        }
+        let docker = ide_docker::docker_executable().ok_or_else(|| {
+            IdeError::unavailable("docker executable not found; install Docker and make sure it is on PATH")
+        })?;
+        let container_root = match target.container_root.trim() {
+            "" if target.kind == RunTargetKind::Compose => {
+                let json = ide_docker::compose_config(&endpoint, &root, &target.compose_files)?;
+                compose_container_root(&json, target.service.trim(), &root)?
+            }
+            "" => default_container_root(&root),
+            folder => folder.to_owned(),
+        };
+        let file_env = env_files(&root, &config)?;
+        let name = container_name(&config.id, &unique());
+        container_config(
+            &config,
+            &ContainerRun {
+                target: &target,
+                root: &root,
+                container_root: &container_root,
+                docker: &docker.to_string_lossy(),
+                endpoint_env: &ide_docker::run_env(&endpoint),
+                file_env: &file_env,
+                name: &name,
+                user: user(&root, &target),
+            },
+        )
+    })
+    .await
+}
+
+/// The target's Docker connection (Services tool window), by id; none = the CLI's daemon.
+fn endpoint(data_dir: &Path, target: &RunTarget) -> IdeResult<DockerEndpoint> {
+    let id = target.docker_connection.trim();
+    if id.is_empty() {
+        return Ok(DockerEndpoint::Default);
+    }
+    ide_docker::load_settings(data_dir).connections.into_iter().find(|c| c.id == id).map(|c| c.endpoint).ok_or_else(
+        || {
+            IdeError::not_found(format!(
+                "Run target '{}' uses a Docker connection that no longer exists; choose one in Settings › Run Targets",
+                target.name
+            ))
+        },
+    )
+}
+
+/// The configuration's `.env` files, read here: the container gets their variables.
+fn env_files(root: &Path, config: &RunConfig) -> IdeResult<BTreeMap<String, String>> {
+    let extras = &config.extras;
+    if extras.env_files.is_empty() {
+        return Ok(BTreeMap::new());
+    }
+    let paths: Vec<PathBuf> = extras
+        .env_files
+        .iter()
+        .map(|f| if Path::new(f).is_absolute() { PathBuf::from(f) } else { root.join(f) })
+        .collect();
+    let base = if extras.include_system_env { ide_run::system_env() } else { BTreeMap::new() };
+    ide_run::envfile::load(&paths, &base).map_err(|e| IdeError::not_found(format!("cannot read .env file: {e}")))
+}
+
+/// On Linux the container writes files as the project folder's owner, unless the
+/// target keeps the image's user. Docker Desktop and OrbStack map ownership themselves.
+fn user(root: &Path, target: &RunTarget) -> Option<(u32, u32)> {
+    #[cfg(target_os = "linux")]
+    if !target.image_user {
+        use std::os::unix::fs::MetadataExt;
+        return std::fs::metadata(root).ok().map(|m| (m.uid(), m.gid()));
+    }
+    let _ = (root, target);
+    None
+}
+
+/// Distinguishes runs of the same configuration.
+fn unique() -> String {
+    use std::sync::atomic::{AtomicU32, Ordering};
+    static COUNT: AtomicU32 = AtomicU32::new(0);
+    let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs());
+    format!("{:x}-{}", secs & 0xff_ffff, COUNT.fetch_add(1, Ordering::Relaxed))
+}
@@ -96,6 +96,33 @@ pub async fn sdk_php_language_level(host: &Host, window: &str, path: PathBuf) ->
    .map_err(join_err)
 }

+/// The Composer project `path` belongs to, when its dependencies need `composer install`.
+#[derive(Clone, Debug, serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct ComposerInstallState {
+    pub root: ide_core::IpcPath,
+    pub reason: ide_sdk::php::ComposerInstall,
+}
+
+/// `None` in an untrusted project too: `composer install` runs the project's scripts.
+pub async fn sdk_php_composer_install(
+    host: &Host,
+    window: &str,
+    path: PathBuf,
+) -> IdeResult<Option<ComposerInstallState>> {
+    let project = host.project(window)?;
+    if !project.is_trusted() {
+        return Ok(None);
+    }
+    let root = project.root.clone();
+    tokio::task::spawn_blocking(move || {
+        ide_sdk::php::composer_install(&path, &root)
+            .map(|(root, reason)| ComposerInstallState { root: ide_core::IpcPath::from(root), reason })
+    })
+    .await
+    .map_err(join_err)
+}
+
 /// SDK / library source folders shown under "External Libraries" in the Project view,
 /// with the Maven / Gradle dependency jars of the build model.
 pub async fn sdk_project_libraries(host: &Host, window: &str) -> IdeResult<Vec<ide_sdk::libraries::LibraryGroup>> {
@@ -211,6 +238,10 @@ pub(crate) fn register(d: &mut Dispatcher) {
        "sdk_php_language_level",
        |c| async move { sdk_php_language_level(&c.host, &c.window, c.arg("path")?).await },
    );
+    d.add(
+        "sdk_php_composer_install",
+        |c| async move { sdk_php_composer_install(&c.host, &c.window, c.arg("path")?).await },
+    );
    d.add("sdk_project_libraries", |c| async move { sdk_project_libraries(&c.host, &c.window).await });
    d.add("sdk_locate_tools", |c| async move {
        sdk_locate_tools(&c.host, &c.window, c.arg("names")?, c.arg("near")?).await
@@ -103,12 +103,20 @@ pub enum RemoteOp {
    Pull {
        rebase: bool,
    },
+    /// Update Project › Reset to the Remote Branch.
+    ResetToUpstream,
    Push {
        force_with_lease: bool,
        set_upstream: bool,
        /// Push dialog › Push tags.
        #[serde(default)]
        tags: Option<PushTags>,
+        /// Plain `--force` (Force push anyway).
+        #[serde(default)]
+        force: bool,
+        /// Push dialog › Run Git hooks unchecked (`--no-verify`).
+        #[serde(default)]
+        no_verify: bool,
    },
    /// Deletes a remote branch; `branch` is the remote-tracking name (`origin/feature`).
    DeleteBranch {
@@ -125,6 +133,23 @@ pub enum RemoteOp {
        target: Option<String>,
        #[serde(default)]
        remote: Option<String>,
+        #[serde(default)]
+        force: bool,
+        /// Record the target as upstream (Push dialog › Set upstream).
+        #[serde(default)]
+        set_upstream: bool,
+        #[serde(default)]
+        no_verify: bool,
+    },
+    /// Push Tag › Push to `remote`.
+    PushTag {
+        tag: String,
+        remote: String,
+    },
+    /// Deletes tag `tag` on `remote` (Delete on Remote).
+    DeleteRemoteTag {
+        tag: String,
+        remote: String,
    },
    /// Fast-forwards local `branch` (not checked out) to its upstream.
    UpdateBranch {
@@ -155,11 +180,15 @@ pub struct GitExecutableInfo {
 pub enum GitOperation {
    /// Continue the merge / rebase / cherry-pick / revert in progress.
    Continue,
+    /// Stage and Retry: stage the changes of tracked files, then continue.
+    StageAndContinue,
    Abort,
    Skip,
-    /// Commits oldest first.
+    /// Commits oldest first; `record_origin` adds "(cherry picked from commit …)".
    CherryPick {
        commits: Vec<String>,
+        #[serde(default, rename = "recordOrigin")]
+        record_origin: bool,
    },
    /// Commits newest first.
    Revert {
@@ -572,6 +601,33 @@ pub async fn vcs_undo_commit(host: &Host, window: &str, repo: Option<PathBuf>, c
    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.undo_commit(&commit))).await
 }

+/// Edit Commit Message: rewrites the commit and its descendants without touching the
+/// working tree.
+pub async fn vcs_reword(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+    commit: String,
+    message: String,
+) -> IdeResult<ide_vcs::HeadChange> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.reword(&commit, &message))).await
+}
+
+/// Undo of a history rewrite (Edit Commit Message, Drop, Squash).
+pub async fn vcs_restore_head(
+    host: &Host,
+    window: &str,
+    repo: Option<PathBuf>,
+    before: String,
+    after: String,
+) -> IdeResult<()> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.restore_head(&before, &after))).await
+}
+
 pub async fn vcs_delete_branch(
    host: &Host,
    window: &str,
@@ -584,6 +640,19 @@ pub async fn vcs_delete_branch(
 }

 /// "Restore" of the branch-deleted notification.
+/// Deletes a local tag; the result restores it.
+pub async fn vcs_delete_tag(host: &Host, window: &str, repo: Option<PathBuf>, name: String) -> IdeResult<DeletedTag> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.delete_tag(&name))).await
+}
+
+pub async fn vcs_restore_tag(host: &Host, window: &str, repo: Option<PathBuf>, deleted: DeletedTag) -> IdeResult<()> {
+    host.require_trust(window)?;
+    let project = host.project(window)?;
+    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.restore_tag(&deleted))).await
+}
+
 pub async fn vcs_restore_branch(
    host: &Host,
    window: &str,
@@ -679,26 +748,42 @@ pub async fn vcs_remote(
        let out = |line: String| {
            let _ = on_output.send(line);
        };
-        let recorded = matches!(op, RemoteOp::Pull { .. } | RemoteOp::PullFrom { .. }).then_some("Git pull");
+        let recorded = matches!(op, RemoteOp::Pull { .. } | RemoteOp::PullFrom { .. } | RemoteOp::ResetToUpstream)
+            .then_some("Git pull");
        project.with_repo_recorded(repo.as_deref(), recorded, |r| match op {
            RemoteOp::Fetch => r.fetch(&cancel, &out),
            RemoteOp::Pull { rebase } => r.pull(rebase, &cancel, &out),
-            RemoteOp::Push { force_with_lease, set_upstream, tags } => {
-                r.push_with_tags(force_with_lease, set_upstream, tags, &cancel, &out)
+            RemoteOp::ResetToUpstream => r.reset_to_upstream(&cancel, &out),
+            RemoteOp::Push { force_with_lease, set_upstream, tags, force, no_verify } => {
+                r.push_with(PushOptions { force_with_lease, force, set_upstream, tags, no_verify }, &cancel, &out)
            }
            RemoteOp::DeleteBranch { branch } => r.delete_remote_branch(&branch, &cancel, &out),
-            RemoteOp::PushBranch { branch, revision, force_with_lease, target, remote } => r.push_branch_to(
+            RemoteOp::PushBranch {
+                branch,
+                revision,
+                force_with_lease,
+                target,
+                remote,
+                force,
+                set_upstream,
+                no_verify,
+            } => r.push_branch_to(
                &branch,
                PushBranchOptions {
                    revision: revision.as_deref(),
                    target: target.as_deref(),
                    remote: remote.as_deref(),
                    force_with_lease,
+                    force,
+                    set_upstream,
+                    no_verify,
                },
                &cancel,
                &out,
            ),
            RemoteOp::UpdateBranch { branch } => r.update_branch(&branch, &cancel, &out),
+            RemoteOp::PushTag { tag, remote } => r.push_tag(&tag, &remote, &cancel, &out),
+            RemoteOp::DeleteRemoteTag { tag, remote } => r.delete_remote_tag(&tag, &remote, &cancel, &out),
            RemoteOp::PullFrom { remote, branches, rebase, options } => {
                r.pull_from(&remote, &branches, rebase, &options, &cancel, &out)
            }
@@ -834,9 +919,12 @@ pub async fn vcs_operation(
        };
        project.with_repo_recorded(repo.as_deref(), recorded, |r| match op {
            GitOperation::Continue => r.continue_operation(&cancel, &out),
+            GitOperation::StageAndContinue => r.stage_and_continue(&cancel, &out),
            GitOperation::Abort => r.abort_operation(&cancel, &out),
            GitOperation::Skip => r.skip_operation(&cancel, &out),
-            GitOperation::CherryPick { commits } => r.cherry_pick(&commits, &cancel, &out),
+            GitOperation::CherryPick { commits, record_origin } => {
+                r.cherry_pick_with(&commits, record_origin, &cancel, &out)
+            }
            GitOperation::Revert { commits } => r.revert(&commits, &cancel, &out),
            GitOperation::Reset { commit, mode } => r.reset(&commit, mode, &cancel, &out),
            GitOperation::InteractiveRebase { base, entries } => {
@@ -1020,6 +1108,12 @@ pub async fn vcs_diff_numstat(
    blocking(move || project.with_log_repo_at(repo.as_deref(), |r| r.diff_numstat(&from, &to, &paths))).await
 }

+/// Whether the repository has the executable Git hook `name` (Push dialog › Run Git hooks).
+pub async fn vcs_has_hook(host: &Host, window: &str, repo: Option<PathBuf>, name: String) -> IdeResult<bool> {
+    let project = host.project(window)?;
+    blocking(move || project.with_repo_at(repo.as_deref(), |r| r.has_hook(&name))).await
+}
+
 /// The best common ancestor of `a` and `b` (`git merge-base`), if any: the New Pull
 /// Request tab's three-dot diff.
 pub async fn vcs_merge_base(
@@ -1247,9 +1341,22 @@ pub(crate) fn register(d: &mut Dispatcher) {
        "vcs_undo_commit",
        |c| async move { vcs_undo_commit(&c.host, &c.window, c.arg("repo")?, c.arg("commit")?).await },
    );
+    d.add("vcs_reword", |c| async move {
+        vcs_reword(&c.host, &c.window, c.arg("repo")?, c.arg("commit")?, c.arg("message")?).await
+    });
+    d.add("vcs_restore_head", |c| async move {
+        vcs_restore_head(&c.host, &c.window, c.arg("repo")?, c.arg("before")?, c.arg("after")?).await
+    });
    d.add("vcs_delete_branch", |c| async move {
        vcs_delete_branch(&c.host, &c.window, c.arg("repo")?, c.arg("branch")?).await
    });
+    d.add(
+        "vcs_delete_tag",
+        |c| async move { vcs_delete_tag(&c.host, &c.window, c.arg("repo")?, c.arg("name")?).await },
+    );
+    d.add("vcs_restore_tag", |c| async move {
+        vcs_restore_tag(&c.host, &c.window, c.arg("repo")?, c.arg("deleted")?).await
+    });
    d.add("vcs_restore_branch", |c| async move {
        vcs_restore_branch(&c.host, &c.window, c.arg("repo")?, c.arg("deleted")?).await
    });
@@ -1373,6 +1480,7 @@ pub(crate) fn register(d: &mut Dispatcher) {
    d.add("vcs_diff_numstat", |c| async move {
        vcs_diff_numstat(&c.host, &c.window, c.arg("repo")?, c.arg("from")?, c.arg("to")?, c.arg("paths")?).await
    });
+    d.add("vcs_has_hook", |c| async move { vcs_has_hook(&c.host, &c.window, c.arg("repo")?, c.arg("name")?).await });
    d.add("vcs_merge_base", |c| async move {
        vcs_merge_base(&c.host, &c.window, c.arg("repo")?, c.arg("a")?, c.arg("b")?).await
    });
@@ -611,7 +611,7 @@ mod tests {
    }

    /// A project with PHPStan whose PHP logs each run, waits `pause` seconds, prints `stderr` and
-    /// reports `report`.
+    /// reports `report`. `pause` is read before the run is logged, so a test that sees the run can change it.
    #[cfg(unix)]
    struct Fixture {
        _dir: tempfile::TempDir,
@@ -634,8 +634,8 @@ mod tests {
            // Named php8.5: the selected PHP runs vendor/bin/phpstan, whatever its name.
            let php = base.join("php/php8.5");
            std::fs::create_dir_all(php.parent().unwrap()).unwrap();
-            let script = "#!/bin/sh\nshift\necho \"$XDEBUG_MODE $*\" >> runs.log\n\
-                sleep \"$(cat pause 2>/dev/null || echo 0)\"\ncat stderr >&2 2>/dev/null\ncat report\n";
+            let script = "#!/bin/sh\nshift\npause=\"$(cat pause 2>/dev/null || echo 0)\"\n\
+                echo \"$XDEBUG_MODE $*\" >> runs.log\nsleep \"$pause\"\ncat stderr >&2 2>/dev/null\ncat report\n";
            std::fs::write(&php, script).unwrap();
            std::fs::set_permissions(&php, std::fs::Permissions::from_mode(0o755)).unwrap();
            std::fs::create_dir_all(root.join(".openidea")).unwrap();
@@ -0,0 +1,177 @@
+use super::PluginHost;
+use ide_core::{IdeError, IdeResult};
+use ide_plugin::Invocation;
+use std::{path::PathBuf, sync::Arc};
+#[derive(serde::Serialize, specta::Type)]
+pub struct NavigationFiles {
+    pub paths: Vec<ide_core::IpcPath>,
+    pub indexing: bool,
+    pub extensions: Vec<String>,
+}
+
+/// File discovery is separate from clicking: the UI schedules small background
+/// batches after initial index completion and updates only changed files later.
+pub async fn plugin_navigation_files(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+) -> IdeResult<NavigationFiles> {
+    let project = host.project(window)?;
+    blocking(move || {
+        let extensions = plugins.navigation_extensions(&project.root);
+        if extensions.is_empty() {
+            return Ok(NavigationFiles { paths: vec![], indexing: false, extensions: vec![] });
+        }
+        let indexing = project.index.status().indexing;
+        let files = project.index.files_with_extensions(&extensions, 20_001);
+        if files.len() > 20_000 {
+            return Err(IdeError::unavailable("plugin navigation supports up to 20,000 matching files"));
+        }
+        Ok(NavigationFiles {
+            paths: files.into_iter().filter(|p| p.starts_with(&project.root)).map(Into::into).collect(),
+            indexing,
+            extensions,
+        })
+    })
+    .await
+}
+
+pub fn plugin_navigation_invalidate(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+    paths: Option<Vec<PathBuf>>,
+) -> IdeResult<()> {
+    let project = host.project(window)?;
+    plugins.invalidate_client_navigation(&project.root, Some(window), paths.as_deref());
+    Ok(())
+}
+
+pub async fn plugin_navigation_index(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+    paths: Vec<PathBuf>,
+    request: ide_core::RequestId,
+) -> IdeResult<()> {
+    if paths.len() > 16 {
+        return Err(IdeError::invalid("navigation batches are limited to 16 files"));
+    }
+    let project = host.project(window)?;
+    let cancel = host.begin_project_request(window, request);
+    let client = window.to_owned();
+    let result = blocking(move || {
+        if !project.is_trusted() {
+            return Err(IdeError::unavailable("project is not trusted"));
+        }
+        for path in paths {
+            if cancel.is_cancelled() {
+                return Err(IdeError::cancelled());
+            }
+            let Ok(path) = ide_plugin::resolve_in_root(&project.root, &path.to_string_lossy()) else {
+                continue;
+            };
+            let extensions = plugins.navigation_extensions(&project.root);
+            if !path.extension().and_then(|e| e.to_str()).is_some_and(|e| extensions.iter().any(|x| x == e)) {
+                continue;
+            }
+            let document = project.documents.by_path(&path);
+            let (text, version, language) = if let Some(id) = document {
+                let snapshot = project.documents.text_snapshot(id)?;
+                if snapshot.large {
+                    continue;
+                }
+                (snapshot.text, Some(snapshot.version), snapshot.language)
+            } else {
+                use std::io::Read;
+                if !std::fs::metadata(&path)
+                    .is_ok_and(|m| m.is_file() && m.len() <= crate::plugins::navigation::MAX_DOCUMENT_BYTES as u64)
+                {
+                    continue;
+                }
+                let Ok(file) = std::fs::File::open(&path) else {
+                    continue;
+                };
+                let mut text = String::new();
+                if file
+                    .take((crate::plugins::navigation::MAX_DOCUMENT_BYTES + 1) as u64)
+                    .read_to_string(&mut text)
+                    .is_err()
+                {
+                    continue;
+                }
+                let language = project.languages.detect(&path, text.lines().next());
+                (text, None, language)
+            };
+            if text.len() > crate::plugins::navigation::MAX_DOCUMENT_BYTES {
+                continue;
+            }
+            let symbols = project
+                .index
+                .symbols_for_text(&path, &text)
+                .unwrap_or_else(|| project.syntax.syntax().tags(&language, &text));
+            let roots = project.roots();
+            let scope = roots
+                .roots
+                .iter()
+                .filter(|r| path.starts_with(project.root.join(&r.path)))
+                .max_by_key(|r| r.path.len())
+                .and_then(|r| r.detected_from.as_deref())
+                .unwrap_or("");
+            plugins.index_navigation(
+                &project.root,
+                crate::plugins::navigation::Snapshot { path: &path, version, text: &text, symbols: &symbols, scope },
+                Invocation { client: Some(client.clone()), workspace_root: Some(project.root.clone()), editor: None },
+            )?;
+            // A document edit while WASM was executing must not publish stale ranges.
+            if cancel.is_cancelled() || document.is_some_and(|id| project.documents.version(id).ok() != version) {
+                plugins.invalidate_client_navigation(&project.root, Some(&client), Some(&[path]));
+            }
+        }
+        Ok(())
+    })
+    .await;
+    host.end_request(request);
+    result
+}
+
+pub async fn plugin_navigation_goto(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+    doc: ide_core::DocId,
+    pos: ide_core::Pos,
+) -> IdeResult<Option<crate::plugins::navigation::NavigationResult>> {
+    let project = host.project(window)?;
+    let client = window.to_owned();
+    blocking(move || {
+        let (path, version) = project.documents.identity(doc)?;
+        Ok(plugins.navigation_at(&project.root, &path, version, pos, Some(&client), |p| {
+            project.documents.by_path(p).and_then(|id| project.documents.version(id).ok())
+        }))
+    })
+    .await
+}
+
+pub async fn plugin_navigation_markers(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+    paths: Vec<PathBuf>,
+) -> IdeResult<Vec<crate::plugins::navigation::FileMarkers>> {
+    if paths.len() > 64 {
+        return Err(IdeError::invalid("marker batches are limited to 64 files"));
+    }
+    let project = host.project(window)?;
+    let client = window.to_owned();
+    blocking(move || {
+        Ok(plugins.navigation_markers(&project.root, &paths, Some(&client), |p| {
+            project.documents.by_path(p).and_then(|id| project.documents.version(id).ok())
+        }))
+    })
+    .await
+}
+
+async fn blocking<T: Send + 'static>(f: impl FnOnce() -> IdeResult<T> + Send + 'static) -> IdeResult<T> {
+    tokio::task::spawn_blocking(f).await.map_err(|e| IdeError::internal(e.to_string()))?
+}
@@ -20,9 +20,11 @@ mod icon_extensions;
 mod icon_patterns;
 mod icon_settings;
 mod icons;
+pub mod index_ops;
 mod install;
 pub mod intellij;
 mod market;
+pub mod navigation;
 mod points;
 mod providers;
 pub mod remote;
@@ -41,8 +43,8 @@ pub use market::{
    read_url as read_market_url, resolve as resolve_market_href,
 };
 pub use points::{COMMANDS, CommandDecl, register_builtin_points};
-pub(crate) use providers::editor_providers as editor_providers_for;
 pub use providers::{ProviderKind, set_editor_providers};
+pub(crate) use providers::{editor_plugin_host, editor_providers as editor_providers_for};
 pub use theme::{ThemeDef, ThemeKind};
 pub use types::*;

@@ -308,6 +310,7 @@ pub struct PluginHost {
    run_detectors: Arc<run_detectors::RunDetectors>,
    /// `[[contributes.providers]]` of enabled plugins.
    providers: Arc<providers::Providers>,
+    navigation: Mutex<navigation::NavigationIndex>,
    /// Validated UI declarations of installed packages (start-up reuses them).
    index: Arc<ContributionIndex>,
    ledger: Mutex<Ledger>,
@@ -396,6 +399,7 @@ impl PluginHost {
            languages,
            run_detectors,
            providers,
+            navigation: Mutex::default(),
            index,
            plugins: RwLock::default(),
            state: Mutex::new(state),
@@ -1881,6 +1885,7 @@ impl PluginHost {
            }
        }
        let Some(error) = actor.take_crash() else { return };
+        self.clear_plugin_navigation(plugin.id());
        if error.starts_with(CANCELLED) {
            // Cancelled on request: restart on next use, no backoff.
            let mut meta = plugin.meta.lock();
@@ -1952,6 +1957,7 @@ impl PluginHost {
    }

    fn stop(&self, plugin: &LoadedPlugin) {
+        self.clear_plugin_navigation(plugin.id());
        if let Some(actor) = plugin.runtime.lock().take() {
            actor.stop(true);
        }
@@ -1961,6 +1967,7 @@ impl PluginHost {
    }

    fn set_failed(&self, plugin: &LoadedPlugin, error: String) {
+        self.clear_plugin_navigation(plugin.id());
        tracing::warn!(plugin = %plugin.id(), "{error}");
        self.registry.dispose_plugin(plugin.id());
        let mut meta = plugin.meta.lock();
@@ -1969,6 +1976,7 @@ impl PluginHost {
    }

    fn fail(&self, plugin: &LoadedPlugin, error: &str, client: Option<&str>) {
+        self.clear_plugin_navigation(plugin.id());
        tracing::warn!(plugin = %plugin.id(), "disabled after failure: {error}");
        if let Some(actor) = plugin.runtime.lock().take() {
            actor.stop(false);
@@ -0,0 +1,462 @@
+//! API 1.x document indexers: background snapshots become project-scoped
+//! associations. Navigation and gutter markers only read validated memory indexes.
+use super::PluginHost;
+use ide_core::{IdeError, IdeResult, Location, Pos, Range};
+use ide_extension::{Capability, Disposable, ExtensionPoint, Package, Placement, Prepared, decode};
+use ide_language::SymbolTag;
+use ide_plugin::Invocation;
+use serde::Deserialize;
+
+use std::collections::{BTreeMap, HashMap};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Weak};
+
+pub const MAX_DOCUMENT_BYTES: usize = 2 << 20;
+const MAX_FILES: usize = 20_000;
+const MAX_EDGES: usize = 4096;
+
+pub struct Snapshot<'a> {
+    pub path: &'a Path,
+    pub version: Option<u32>,
+    pub text: &'a str,
+    pub symbols: &'a [SymbolTag],
+    pub scope: &'a str,
+}
+
+pub use ide_plugin::indexing::*;
+
+struct File {
+    version: Option<u32>,
+    scope: String,
+    edges: Edges,
+}
+#[derive(Default)]
+struct Graph {
+    instance: Weak<super::LoadedPlugin>,
+    files: BTreeMap<PathBuf, File>,
+    definitions: HashMap<String, Vec<Location>>,
+    aliases: HashMap<String, Vec<(PathBuf, String)>>,
+    edges: usize,
+}
+impl Graph {
+    fn targets(&self, key: &str) -> Vec<&Location> {
+        let mut keys = vec![key.to_owned()];
+        let mut seen = std::collections::HashSet::new();
+        let mut targets = vec![];
+        while let Some(key) = keys.pop() {
+            if seen.len() >= 64 || !seen.insert(key.clone()) {
+                continue;
+            }
+            if let Some(locations) = self.definitions.get(&key) {
+                targets.extend(locations.iter().take(256usize.saturating_sub(targets.len())));
+                continue;
+            }
+            if let Some((prefix, suffix)) = key.split_once('#')
+                && let Some(aliases) = self.aliases.get(&format!("{prefix}#"))
+            {
+                for (_, target) in aliases.iter().take(64) {
+                    keys.push(format!("{target}{suffix}"));
+                }
+            }
+        }
+        targets
+    }
+    fn remove(&mut self, path: &Path) {
+        if let Some(file) = self.files.remove(path) {
+            self.edges -= file.edges.definitions.len()
+                + file.edges.references.len()
+                + file.edges.aliases.len()
+                + file.edges.markers.len();
+            for alias in file.edges.aliases {
+                if let Some(entries) = self.aliases.get_mut(&alias.prefix) {
+                    entries.retain(|(p, _)| p != path);
+                    if entries.is_empty() {
+                        self.aliases.remove(&alias.prefix);
+                    }
+                }
+            }
+            for anchor in file.edges.definitions {
+                if let Some(locations) = self.definitions.get_mut(&anchor.key) {
+                    locations.retain(|l| l.path.0.as_path() != path);
+                    if locations.is_empty() {
+                        self.definitions.remove(&anchor.key);
+                    }
+                }
+            }
+        }
+    }
+    fn insert(&mut self, path: PathBuf, file: File) {
+        self.remove(&path);
+        self.edges += file.edges.definitions.len()
+            + file.edges.references.len()
+            + file.edges.aliases.len()
+            + file.edges.markers.len();
+        for alias in &file.edges.aliases {
+            self.aliases.entry(alias.prefix.clone()).or_default().push((path.clone(), alias.target.clone()));
+        }
+        for anchor in &file.edges.definitions {
+            self.definitions.entry(anchor.key.clone()).or_default().push(Location {
+                path: path.clone().into(),
+                range: anchor.range,
+                uri: None,
+            });
+        }
+        self.files.insert(path, file);
+    }
+}
+
+#[derive(Default)]
+pub(crate) struct NavigationIndex {
+    projects: HashMap<(PathBuf, Option<String>), HashMap<String, Graph>>,
+    generation: u64,
+    epochs: HashMap<PathBuf, u64>,
+}
+
+fn contains(range: Range, pos: Pos) -> bool {
+    (range.start.line, range.start.col) <= (pos.line, pos.col) && (pos.line, pos.col) < (range.end.line, range.end.col)
+}
+fn valid_range(lines: &[usize], range: Range) -> bool {
+    let pos = |p: Pos| lines.get(p.line as usize).is_some_and(|&length| p.col as usize <= length);
+    pos(range.start) && pos(range.end) && (range.start.line, range.start.col) < (range.end.line, range.end.col)
+}
+
+impl PluginHost {
+    pub(crate) fn clear_plugin_navigation(&self, id: &str) {
+        let mut index = self.navigation.lock();
+        index.generation = index.generation.wrapping_add(1);
+        let epoch = index.generation;
+        let roots: Vec<_> = index.projects.keys().cloned().collect();
+        for root in roots {
+            index.epochs.insert(root.0, epoch);
+        }
+        for graphs in index.projects.values_mut() {
+            graphs.remove(id);
+        }
+        drop(index);
+        self.emit(None, super::PluginEvent::DocumentIndexesChanged);
+    }
+
+    /// Extensions with an active, permissioned navigation provider for this root.
+    pub fn navigation_extensions(&self, root: &Path) -> Vec<String> {
+        if !(self.project_policy.read())(root) {
+            return vec![];
+        }
+        self.plugins
+            .read()
+            .values()
+            .filter(|p| p.status().is_live() && p.dev_root.as_deref().is_none_or(|r| r == root))
+            .filter_map(|p| declaration(p))
+            .flat_map(|d| d.extensions)
+            .collect()
+    }
+
+    /// Remove stale contributions before scheduling replacement work. `None`
+    /// disposes the project, including reverse-index entries, on project close.
+    pub fn invalidate_navigation(&self, root: &Path, paths: Option<&[PathBuf]>) {
+        self.invalidate_navigation_scope(root, None, paths);
+    }
+
+    pub fn invalidate_client_navigation(&self, root: &Path, client: Option<&str>, paths: Option<&[PathBuf]>) {
+        self.invalidate_navigation_scope(root, Some(client), paths);
+    }
+
+    fn invalidate_navigation_scope(&self, root: &Path, client: Option<Option<&str>>, paths: Option<&[PathBuf]>) {
+        let matches = |key: &(PathBuf, Option<String>)| key.0 == root && client.is_none_or(|c| key.1.as_deref() == c);
+        let mut index = self.navigation.lock();
+        index.generation = index.generation.wrapping_add(1);
+        let epoch = index.generation;
+        index.epochs.insert(root.to_owned(), epoch);
+        if index.epochs.len() > 64
+            && let Some(oldest) = index.epochs.iter().min_by_key(|(_, v)| **v).map(|(p, _)| p.clone())
+        {
+            index.epochs.remove(&oldest);
+        }
+        match paths {
+            None => {
+                index.projects.retain(|key, _| !matches(key));
+            }
+            Some(paths) => {
+                for graphs in index.projects.iter_mut().filter(|(key, _)| matches(key)).map(|(_, graphs)| graphs) {
+                    for graph in graphs.values_mut() {
+                        for path in paths {
+                            graph.remove(path);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// Index one bounded snapshot. No directory traversal or parsing happens in
+    /// navigation_at. Call off the UI thread, in small cancellable batches.
+    pub fn index_navigation(&self, root: &Path, snapshot: Snapshot<'_>, invocation: Invocation) -> IdeResult<()> {
+        let Snapshot { path, version, text, symbols, scope } = snapshot;
+        if !(self.project_policy.read())(root) {
+            return Err(IdeError::unavailable("project is not trusted"));
+        }
+        if text.len() > MAX_DOCUMENT_BYTES {
+            return Err(IdeError::invalid("navigation document is too large"));
+        }
+        let real = ide_plugin::resolve_in_root(root, &path.to_string_lossy()).map_err(IdeError::invalid)?;
+        if real != path {
+            return Err(IdeError::invalid("navigation requires a canonical project path"));
+        }
+        let project_key = (root.to_owned(), invocation.client.clone());
+        let generation = self.navigation.lock().epochs.get(root).copied();
+        let extension = path.extension().and_then(|e| e.to_str()).unwrap_or_default();
+        let plugins: Vec<_> = self
+            .plugins
+            .read()
+            .values()
+            .filter(|p| {
+                p.status().is_live()
+                    && p.dev_root.as_deref().is_none_or(|r| r == root)
+                    && p.meta.lock().granted.contains(&Capability::ProjectRead)
+                    && declaration(p).is_some_and(|n| n.extensions.iter().any(|e| e == extension))
+            })
+            .cloned()
+            .collect();
+        if plugins.is_empty() {
+            return Ok(());
+        }
+        let lines: Vec<_> = text.split('\n').map(|l| l.encode_utf16().count()).collect();
+        for plugin in plugins {
+            let (actor, activated) = self.ensure_active(&plugin, invocation.client.as_deref())?;
+            if activated {
+                self.changed();
+            }
+            let (owned_path, owned_text) = (path.to_string_lossy().into_owned(), text.to_owned());
+            let symbols = symbols
+                .iter()
+                .map(|s| ide_plugin::indexing::IndexSymbol {
+                    name: s.name.clone(),
+                    kind: serde_json::to_value(s.kind)
+                        .ok()
+                        .and_then(|v| v.as_str().map(str::to_owned))
+                        .unwrap_or_default(),
+                    container: s.container.clone(),
+                    range: s.range,
+                })
+                .collect::<Vec<_>>();
+            let ctx = invocation.clone();
+            let started = std::time::Instant::now();
+            let result = actor.call(None, move |rt| rt.index_document(&owned_path, &owned_text, &symbols, ctx));
+            let edges = self
+                .finish_provider_call(&plugin, &actor, started, result)
+                .ok_or_else(|| IdeError::unavailable("document indexer did not return a result"))?;
+            let output_bytes = edges
+                .definitions
+                .iter()
+                .chain(&edges.references)
+                .chain(&edges.markers)
+                .map(|a| a.key.len().saturating_add(32))
+                .sum::<usize>()
+                .saturating_add(edges.aliases.iter().map(|a| a.prefix.len() + a.target.len()).sum::<usize>());
+            if output_bytes > MAX_DOCUMENT_BYTES {
+                return Err(IdeError::invalid("document index output is too large"));
+            }
+            if edges.aliases.len() > 256
+                || edges.aliases.iter().any(|a| {
+                    !a.prefix.ends_with('#')
+                        || !a.target.ends_with('#')
+                        || a.prefix.len() > 1024
+                        || a.target.len() > 1024
+                })
+                || edges.definitions.len() + edges.references.len() > MAX_EDGES
+                || edges
+                    .definitions
+                    .iter()
+                    .chain(&edges.references)
+                    .any(|a| a.key.is_empty() || a.key.len() > 1024 || !valid_range(&lines, a.range))
+            {
+                return Err(IdeError::invalid("invalid navigation anchors"));
+            }
+            if edges.markers.len() > MAX_EDGES
+                || edges.markers.iter().any(|a| a.key.is_empty() || a.key.len() > 1024 || !valid_range(&lines, a.range))
+            {
+                return Err(IdeError::invalid("invalid navigation markers"));
+            }
+            let mut index = self.navigation.lock();
+            if index.epochs.get(root).copied() != generation {
+                return Err(IdeError::cancelled());
+            }
+            // Keep a bounded number of project graphs, including closed windows
+            // whose frontend did not get an opportunity to dispose its state.
+            if index.projects.len() >= 16 && !index.projects.contains_key(&project_key) {
+                return Err(IdeError::unavailable("navigation project limit reached"));
+            }
+            let graph =
+                index.projects.entry(project_key.clone()).or_default().entry(plugin.id().to_owned()).or_default();
+            if !graph.instance.ptr_eq(&Arc::downgrade(&plugin)) {
+                *graph = Graph { instance: Arc::downgrade(&plugin), ..Default::default() };
+            }
+            if graph.files.len() >= MAX_FILES && !graph.files.contains_key(path) {
+                return Err(IdeError::unavailable("navigation file limit reached"));
+            }
+            graph.remove(path);
+            if graph.edges
+                + edges.definitions.len()
+                + edges.references.len()
+                + edges.aliases.len()
+                + edges.markers.len()
+                > 200_000
+            {
+                return Err(IdeError::unavailable("navigation association limit reached"));
+            }
+            graph.insert(path.to_owned(), File { version, scope: scope.to_owned(), edges });
+        }
+        Ok(())
+    }
+
+    /// Resolves only current live providers. Disable/reload/trap cannot retain
+    /// navigable stale data, even if a background snapshot finished concurrently.
+    pub fn navigation_at(
+        &self,
+        root: &Path,
+        path: &Path,
+        version: u32,
+        pos: Pos,
+        client: Option<&str>,
+        version_of: impl Fn(&Path) -> Option<u32>,
+    ) -> Option<NavigationResult> {
+        if !(self.project_policy.read())(root) {
+            return None;
+        }
+        let plugins = self.plugins.read();
+        let index = self.navigation.lock();
+        let graphs = index.projects.get(&(root.to_owned(), client.map(str::to_owned)))?;
+        let mut result: Option<NavigationResult> = None;
+        for (id, graph) in graphs {
+            let Some(plugin) = plugins.get(id) else { continue };
+            if !plugin.status().is_live() || !graph.instance.ptr_eq(&Arc::downgrade(plugin)) {
+                continue;
+            }
+            let Some(file) = graph.files.get(path) else { continue };
+            if file.version != Some(version) {
+                continue;
+            }
+            for reference in &file.edges.references {
+                if !contains(reference.range, pos) {
+                    continue;
+                }
+                let targets = graph.targets(&reference.key);
+                if targets.is_empty() {
+                    continue;
+                }
+                let answer = result.get_or_insert_with(|| NavigationResult { range: reference.range, targets: vec![] });
+                let local = targets.iter().any(|t| graph.files.get(&t.path.0).is_some_and(|f| f.scope == file.scope));
+                for target in targets.iter().take(256) {
+                    let Some(target_file) = graph.files.get(&target.path.0) else {
+                        continue;
+                    };
+                    if local && target_file.scope != file.scope {
+                        continue;
+                    }
+                    if version_of(&target.path).is_some_and(|v| target_file.version != Some(v)) {
+                        continue;
+                    }
+                    if (target.path.0.as_path() != path || !contains(target.range, pos))
+                        && !answer.targets.iter().any(|t| t.path == target.path && t.range == target.range)
+                    {
+                        answer.targets.push((*target).clone());
+                    }
+                }
+            }
+        }
+        result.filter(|r| !r.targets.is_empty())
+    }
+    /// Gutter markers of visible files. Uses only existing graph entries; never executes WASM.
+    pub fn navigation_markers(
+        &self,
+        root: &Path,
+        paths: &[PathBuf],
+        client: Option<&str>,
+        version_of: impl Fn(&Path) -> Option<u32>,
+    ) -> Vec<FileMarkers> {
+        if !(self.project_policy.read())(root) {
+            return vec![];
+        }
+        let plugins = self.plugins.read();
+        let index = self.navigation.lock();
+        let Some(graphs) = index.projects.get(&(root.to_owned(), client.map(str::to_owned))) else {
+            return vec![];
+        };
+        let mut result = vec![];
+        for path in paths {
+            for (id, graph) in graphs {
+                let Some(plugin) = plugins.get(id) else { continue };
+                if !plugin.status().is_live() || !graph.instance.ptr_eq(&Arc::downgrade(plugin)) {
+                    continue;
+                }
+                let Some(file) = graph.files.get(path) else { continue };
+                if version_of(path).is_some_and(|v| file.version != Some(v)) {
+                    continue;
+                }
+                let mut markers = vec![];
+                for anchor in &file.edges.markers {
+                    let candidates = graph.targets(&anchor.key);
+                    let local =
+                        candidates.iter().any(|t| graph.files.get(&t.path.0).is_some_and(|f| f.scope == file.scope));
+                    let mut targets = vec![];
+                    for target in candidates {
+                        let Some(other) = graph.files.get(&target.path.0) else { continue };
+                        if (local && other.scope != file.scope)
+                            || version_of(&target.path).is_some_and(|v| other.version != Some(v))
+                            || (target.path.0 == *path && target.range == anchor.range)
+                        {
+                            continue;
+                        }
+                        if !targets.iter().any(|t: &Location| t.path == target.path && t.range == target.range) {
+                            targets.push(target.clone());
+                        }
+                    }
+                    if !targets.is_empty() {
+                        markers.push(NavigationResult { range: anchor.range, targets });
+                    }
+                }
+                if !markers.is_empty() {
+                    result.push(FileMarkers { path: path.clone(), version: file.version, markers });
+                }
+            }
+        }
+        result
+    }
+}
+
+#[derive(Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Decl {
+    extensions: Vec<String>,
+}
+fn declaration(p: &super::LoadedPlugin) -> Option<Decl> {
+    p.manifest()
+        .declarations("documentIndexers")
+        .into_iter()
+        .next()
+        .and_then(|d| decode("documentIndexers", d.clone()).ok())
+}
+pub struct IndexersPoint;
+impl ExtensionPoint for IndexersPoint {
+    fn id(&self) -> &'static str {
+        "documentIndexers"
+    }
+    fn placement(&self) -> Placement {
+        Placement::Workspace
+    }
+    fn prepare(&self, pkg: &Package, value: toml::Value) -> Result<Prepared, String> {
+        let d: Decl = decode(self.id(), value)?;
+        if pkg.manifest.wasm.is_none()
+            || d.extensions.is_empty()
+            || d.extensions.len() > 32
+            || d.extensions
+                .iter()
+                .any(|e| e.is_empty() || e.len() > 32 || !e.bytes().all(|c| c.is_ascii_alphanumeric()))
+        {
+            return Err("documentIndexers requires wasm and 1-32 file extensions".into());
+        }
+        if pkg.manifest.declarations(self.id()).len() > 1 {
+            return Err("declare one document indexer per plugin".into());
+        }
+        Ok(Prepared::new(d.extensions.join(", "), || Ok(Disposable::new(|| {}))).capability(Capability::ProjectRead))
+    }
+}
@@ -56,6 +56,7 @@ pub fn register_builtin_points(
    registry.register(Arc::new(LanguagesPoint::new(languages.clone())))?;
    registry.register(Arc::new(UiPoint::new(super::icons::POINT_ID, ui.clone(), super::icons::icon_theme)))?;
    registry.register(Arc::new(super::run_detectors::RunDetectorsPoint::new(run_detectors.clone())))?;
+    registry.register(Arc::new(super::navigation::IndexersPoint))?;
    registry.register(Arc::new(super::providers::ProvidersPoint::new(providers.clone())))?;
    registry.register(Arc::new(UiPoint::new(super::providers::SECRETS_POINT, ui.clone(), super::providers::secret)))?;
    use super::ui_points as p;
@@ -180,10 +180,14 @@ pub fn set_editor_providers(host: Option<&Arc<PluginHost>>) {

 /// The plugin host whose providers take part, when any declares `kind`.
 pub(crate) fn editor_providers(kind: ProviderKind) -> Option<Arc<PluginHost>> {
-    let host = EDITOR_PROVIDERS.read().as_ref()?.upgrade()?;
+    let host = editor_plugin_host()?;
    host.providers.any(kind).then_some(host)
 }

+pub(crate) fn editor_plugin_host() -> Option<Arc<PluginHost>> {
+    EDITOR_PROVIDERS.read().as_ref()?.upgrade()
+}
+
 impl PluginHost {
    /// Usable plugins declaring `kind` for `language`.
    fn provider_plugins(&self, kind: ProviderKind, language: &str) -> Vec<Arc<LoadedPlugin>> {
@@ -448,6 +448,44 @@ impl RemotePlugins {
                .await
            }
        });
+        let h = host.clone();
+        d.add("plugin_navigation_files", move |c| {
+            let h = h.clone();
+            async move { super::index_ops::plugin_navigation_files(&c.host, alive(&h)?, &c.window).await }
+        });
+        let h = host.clone();
+        d.add("plugin_navigation_invalidate", move |c| { let h = h.clone(); async move {
+            super::index_ops::plugin_navigation_invalidate(&c.host, alive(&h)?, &c.window, c.arg("paths")?)
+        } });
+        let h = host.clone();
+        d.add("plugin_navigation_index", move |c| {
+            let h = h.clone();
+            async move {
+                super::index_ops::plugin_navigation_index(
+                    &c.host,
+                    alive(&h)?,
+                    &c.window,
+                    c.arg("paths")?,
+                    c.arg("request")?,
+                )
+                .await
+            }
+        });
+        let h = host.clone();
+        d.add("plugin_navigation_goto", move |c| {
+            let h = h.clone();
+            async move {
+                super::index_ops::plugin_navigation_goto(&c.host, alive(&h)?, &c.window, c.arg("doc")?, c.arg("pos")?)
+                    .await
+            }
+        });
+        let h = host.clone();
+        d.add("plugin_navigation_markers", move |c| {
+            let h = h.clone();
+            async move {
+                super::index_ops::plugin_navigation_markers(&c.host, alive(&h)?, &c.window, c.arg("paths")?).await
+            }
+        });
        d.add("plugin_line_markers", |c| async move {
            crate::ops::lsp::plugin_line_markers(&c.host, &c.window, c.arg("doc")?).await
        });
@@ -153,6 +153,8 @@ pub struct PluginUpdate {
 pub enum PluginEvent {
    /// Plugins, their status or their contributions changed: re-fetch `plugin_list`.
    CommandsChanged,
+    /// Cached document associations were disposed (reload, disable or failure).
+    DocumentIndexesChanged,
    /// The marketplace offers newer versions of installed plugins (announced
    /// once per set of versions).
    UpdatesAvailable { updates: Vec<PluginUpdate> },
@@ -526,6 +526,7 @@ impl Host {
            }));
        }
        self.insert_project(window, project.clone());
+        project.lsp.prewarm_java_configuration();
        if let Some(bridge) = &project.kotlin_bridge {
            bridge.start(&self.runtime);
        }
@@ -121,6 +121,7 @@ impl crate::Host {
                    self.environment.spawn_post_start(cmd, project.root.clone(), project.sink.clone());
                }
                project.lsp.set_execution_allowed(true);
+                project.lsp.prewarm_java_configuration();
            } else {
                self.environment.project_closed();
                project.agents.shutdown();
@@ -340,6 +341,7 @@ pub fn restricted_command_allowed(cmd: &str) -> bool {
            | "vcs_diff_revisions"
            | "vcs_diff_numstat"
            | "vcs_merge_base"
+            | "vcs_has_hook"
            | "vcs_shelves"
            | "vcs_shelf_patch"
            | "vcs_changelists_load"
@@ -0,0 +1,122 @@
+//! Docker run targets through `ops::run::start`, with a stand-in `docker`
+//! (`OPENIDEA_DOCKER`) that prints what it was given.
+#![cfg(unix)]
+
+use ide_core::NullSink;
+use ide_host::{Host, HostConfig, ops};
+use ide_run::{OutputChunk, RunConfig};
+use parking_lot::Mutex;
+use std::collections::BTreeMap;
+use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
+use std::sync::Arc;
+use std::time::Duration;
+
+fn host(base: &Path) -> Arc<Host> {
+    Arc::new(Host::new(HostConfig {
+        config_dir: base.join("config"),
+        data_dir: base.join("data"),
+        local_data_dir: base.join("data"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(|_| Arc::new(NullSink)),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }))
+}
+
+fn config(target: &str, root: &Path) -> RunConfig {
+    RunConfig {
+        id: "app".into(),
+        name: "app".into(),
+        kind: "python".into(),
+        command: root.join(".venv/bin/python").to_string_lossy().into_owned(),
+        args: vec![root.join("main.py").to_string_lossy().into_owned()],
+        cwd: None,
+        env: BTreeMap::from([("DATA".to_owned(), root.join("data").to_string_lossy().into_owned())]),
+        detected: false,
+        is_test: false,
+        debug_adapter: None,
+        allow_parallel: false,
+        extras: ide_run::RunExtras { target: Some(target.into()), ..Default::default() },
+    }
+}
+
+async fn output_of(host: &Host, config: RunConfig) -> String {
+    let out = Arc::new(Mutex::new(String::new()));
+    let sink = out.clone();
+    ops::run::start(
+        host,
+        "main",
+        config,
+        Arc::new(move |chunk| match chunk {
+            OutputChunk::Stdout { text } | OutputChunk::Stderr { text } | OutputChunk::System { text } => {
+                sink.lock().push_str(&text)
+            }
+        }),
+    )
+    .await
+    .unwrap();
+    for _ in 0..200 {
+        if out.lock().contains("Process finished") {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(25)).await;
+    }
+    out.lock().clone()
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn docker_targets_run_through_the_docker_cli() {
+    let tmp = tempfile::tempdir().unwrap();
+    let base = dunce::canonicalize(tmp.path()).unwrap();
+    let docker = base.join("docker");
+    std::fs::write(
+        &docker,
+        "#!/bin/sh\nif [ \"$1\" = context ]; then echo unix:///var/run/docker.sock; exit 0; fi\n\
+         for a in \"$@\"; do echo \"arg:$a\"; done\necho \"DATA=$DATA\"\n",
+    )
+    .unwrap();
+    std::fs::set_permissions(&docker, std::fs::Permissions::from_mode(0o755)).unwrap();
+    // SAFETY: the only test of this binary, before any thread looks docker up.
+    unsafe {
+        std::env::set_var("OPENIDEA_DOCKER", &docker);
+        std::env::remove_var("DOCKER_HOST");
+    }
+
+    let root = base.join("proj");
+    std::fs::create_dir_all(&root).unwrap();
+    let host = host(&base.join("app"));
+    std::fs::create_dir_all(&host.data_dir).unwrap();
+    std::fs::write(
+        host.data_dir.join("docker.json"),
+        r#"{"connections": [{"id": "far", "name": "Build box", "endpoint": {"kind": "tcp", "host": "build:2376"}}]}"#,
+    )
+    .unwrap();
+    host.trust.decide(&root, true, false).unwrap();
+    host.open_project("main", &root).unwrap();
+    let targets = serde_json::json!([
+        { "kind": "docker", "id": "py", "name": "Python", "image": "python:3.12" },
+        { "kind": "docker", "id": "far", "name": "Far", "image": "python:3.12", "dockerConnection": "far" },
+    ]);
+    ops::project::set_settings(
+        &host,
+        "main",
+        ide_workspace::settings::SettingsScope::Project,
+        "runTargets",
+        &targets.to_string(),
+    )
+    .unwrap();
+
+    let out = output_of(&host, config("py", &root)).await;
+    let args: Vec<&str> = out.lines().filter_map(|l| l.strip_prefix("arg:")).collect();
+    assert_eq!(&args[..4], ["run", "--rm", "--interactive", "--init"], "{out}");
+    assert!(args.contains(&format!("{}:/workspaces/proj", root.display()).as_str()), "{out}");
+    assert!(args.ends_with(&["python:3.12", "python3", "/workspaces/proj/main.py"]), "{out}");
+    assert!(out.contains("DATA=/workspaces/proj/data"), "{out}");
+    assert!(!args.iter().any(|a| a.contains("/workspaces/proj/data")), "values stay out of the command line");
+
+    let err = ops::run::start(&host, "main", config("far", &root), Arc::new(|_| {})).await.unwrap_err();
+    assert!(err.message.contains("another machine"), "{}", err.message);
+}
@@ -0,0 +1,159 @@
+//! Docker and Compose run targets against a real daemon. Ignored by default:
+//! `OPENIDEA_DOCKER_TEST_DIR` names an empty folder the daemon can bind-mount
+//! (on this machine, or at the same path in a VM such as OrbStack's), and
+//! `docker` with the Compose plugin must be on `PATH`.
+#![cfg(unix)]
+
+use ide_core::NullSink;
+use ide_host::{Host, HostConfig, ops};
+use ide_run::{OutputChunk, RunConfig};
+use parking_lot::Mutex;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::Arc;
+use std::time::Duration;
+
+fn host(base: &Path) -> Arc<Host> {
+    Arc::new(Host::new(HostConfig {
+        config_dir: base.join("config"),
+        data_dir: base.join("data"),
+        local_data_dir: base.join("data"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(|_| Arc::new(NullSink)),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }))
+}
+
+fn config(id: &str, target: &str, root: &Path, args: &[&str]) -> RunConfig {
+    RunConfig {
+        id: id.into(),
+        name: id.into(),
+        kind: "python".into(),
+        command: root.join(".venv/bin/python").to_string_lossy().into_owned(),
+        args: args.iter().map(|a| a.to_string()).collect(),
+        cwd: None,
+        env: BTreeMap::from([("GREETING".to_owned(), "hello".to_owned())]),
+        detected: false,
+        is_test: false,
+        debug_adapter: None,
+        allow_parallel: false,
+        extras: ide_run::RunExtras { target: Some(target.into()), ..Default::default() },
+    }
+}
+
+type Output = Arc<Mutex<String>>;
+
+async fn start(host: &Host, config: RunConfig) -> (ide_core::RunId, Output) {
+    let out: Output = Arc::default();
+    let sink = out.clone();
+    let info = ops::run::start(
+        host,
+        "main",
+        config,
+        Arc::new(move |chunk| match chunk {
+            OutputChunk::Stdout { text } | OutputChunk::Stderr { text } | OutputChunk::System { text } => {
+                sink.lock().push_str(&text)
+            }
+        }),
+    )
+    .await
+    .unwrap();
+    (info.id, out)
+}
+
+async fn finished(out: &Output, secs: u64) -> String {
+    for _ in 0..secs * 10 {
+        if out.lock().contains("Process finished") {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    out.lock().clone()
+}
+
+fn containers(label: &str) -> String {
+    let out = Command::new("docker").args(["ps", "--all", "--quiet", "--filter", label]).output().unwrap();
+    String::from_utf8_lossy(&out.stdout).trim().to_owned()
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires a Docker daemon and OPENIDEA_DOCKER_TEST_DIR"]
+async fn runs_in_docker_and_compose_containers() {
+    let root = PathBuf::from(std::env::var("OPENIDEA_DOCKER_TEST_DIR").expect("OPENIDEA_DOCKER_TEST_DIR"));
+    let root = dunce::canonicalize(root).unwrap();
+    let name = root.file_name().unwrap().to_string_lossy().into_owned();
+    std::fs::write(
+        root.join("main.py"),
+        "import os\nprint('cwd=' + os.getcwd())\nprint('GREETING=' + os.environ['GREETING'])\n\
+         open('out.txt', 'w').write('ok')\n",
+    )
+    .unwrap();
+    std::fs::write(
+        root.join("compose.yaml"),
+        "services:\n  app:\n    image: python:3.12-alpine\n    volumes:\n      - .:/app\n",
+    )
+    .unwrap();
+    let state = tempfile::tempdir().unwrap();
+    let host = host(state.path());
+    host.trust.decide(&root, true, false).unwrap();
+    host.open_project("main", &root).unwrap();
+    let targets = serde_json::json!([
+        { "kind": "docker", "id": "py", "name": "Python", "image": "python:3.12-alpine" },
+        { "kind": "compose", "id": "app", "name": "Compose", "service": "app" },
+    ]);
+    ops::project::set_settings(
+        &host,
+        "main",
+        ide_workspace::settings::SettingsScope::Project,
+        "runTargets",
+        &targets.to_string(),
+    )
+    .unwrap();
+
+    let (_, out) = start(&host, config("docker-main", "py", &root, &[&root.join("main.py").to_string_lossy()])).await;
+    let out = finished(&out, 120).await;
+    assert!(out.contains(&format!("cwd=/workspaces/{name}")), "{out}");
+    assert!(out.contains("GREETING=hello") && out.contains("exit code 0"), "{out}");
+    let written = root.join("out.txt");
+    assert_eq!(std::fs::read_to_string(&written).unwrap(), "ok");
+    #[cfg(target_os = "linux")]
+    {
+        use std::os::unix::fs::MetadataExt;
+        let (file, folder) = (std::fs::metadata(&written).unwrap(), std::fs::metadata(&root).unwrap());
+        assert_eq!((file.uid(), file.gid()), (folder.uid(), folder.gid()), "written as the folder's owner");
+    }
+    std::fs::remove_file(&written).unwrap();
+    assert_eq!(containers("label=openidea.run=docker-main"), "", "removed when the run ends");
+
+    let (_, out) = start(&host, config("compose-main", "app", &root, &["main.py"])).await;
+    let out = finished(&out, 120).await;
+    assert!(out.contains("cwd=/app") && out.contains("GREETING=hello") && out.contains("exit code 0"), "{out}");
+    std::fs::remove_file(&written).unwrap();
+
+    // Stop: `docker stop` ends the container; `--rm` removes it.
+    let (id, out) =
+        start(&host, config("sleep", "py", &root, &["-c", "print('up', flush=True); import time; time.sleep(600)"]))
+            .await;
+    for _ in 0..600 {
+        if out.lock().contains("up\n") {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    assert_ne!(containers("label=openidea.run=sleep"), "", "{}", out.lock());
+    ops::run::stop(&host, "main", id).unwrap();
+    let out = finished(&out, 30).await;
+    assert!(out.contains(" stop openidea-sleep-"), "{out}");
+    for _ in 0..100 {
+        if containers("label=openidea.run=sleep").is_empty() {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    assert_eq!(containers("label=openidea.run=sleep"), "", "{out}");
+    Command::new("docker").args(["compose", "down"]).current_dir(&root).status().unwrap();
+}
@@ -0,0 +1,236 @@
+//! Generic document-indexer contract through a minimal real WASM fixture.
+use ide_core::{Pos, Range, SymbolKind};
+use ide_host::plugins::navigation::Snapshot;
+use ide_host::plugins::{Consent, PluginHost};
+use ide_language::SymbolTag;
+use ide_plugin::{Invocation, Limits};
+use std::{
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+
+struct Fixture {
+    _tmp: tempfile::TempDir,
+    root: PathBuf,
+    host: PluginHost,
+}
+impl Fixture {
+    fn new() -> Self {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().canonicalize().unwrap();
+        let host = PluginHost::new(root.join("plugins"), Arc::new(|_: Option<&str>, _| {}), Limits::default()).unwrap();
+        host.set_project_policy(Arc::new(|_| true));
+        host.install_from_dir(
+            &Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/indexer"),
+            &Consent::all(),
+        )
+        .unwrap();
+        Self { _tmp: tmp, root, host }
+    }
+    fn index(&self, path: &str, text: &str, symbols: &[SymbolTag], version: Option<u32>, scope: &str) -> PathBuf {
+        let path = self.root.join(path);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(&path, text).unwrap();
+        self.host
+            .index_navigation(
+                &self.root,
+                Snapshot { path: &path, version, text, symbols, scope },
+                Invocation { workspace_root: Some(self.root.clone()), ..Default::default() },
+            )
+            .unwrap();
+        path
+    }
+}
+fn method() -> SymbolTag {
+    SymbolTag {
+        name: "item".into(),
+        kind: SymbolKind::Method,
+        container: None,
+        range: Range::new(Pos::new(0, 4), Pos::new(0, 8)),
+    }
+}
+const SOURCE: &str = "def source:item\nref mapping:item\n";
+const MAPPING: &str = "def mapping:item\nref source:item\n";
+fn reference_pos() -> Pos {
+    Pos::new(1, 5)
+}
+
+#[test]
+fn bidirectional_navigation_versions_and_incremental_deletion() {
+    let f = Fixture::new();
+    let source = f.index("src/source.idx", SOURCE, &[method()], Some(1), "app");
+    let mapping = f.index("resources/mapping.idx", MAPPING, &[], Some(1), "app");
+    let result = f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).unwrap();
+    assert_eq!(result.targets[0].path.0, source);
+    assert_eq!(result.range.end.col - result.range.start.col, 11);
+    let reverse = f.host.navigation_at(&f.root, &source, 1, reference_pos(), None, |_| None).unwrap();
+    assert_eq!(reverse.targets[0].path.0, mapping);
+    assert!(f.host.navigation_at(&f.root, &mapping, 2, reference_pos(), None, |_| None).is_none());
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| Some(2)).is_none());
+    f.host.invalidate_navigation(&f.root, Some(&[source]));
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).is_none());
+}
+
+#[test]
+fn module_candidates_reload_disable_and_project_isolation() {
+    let f = Fixture::new();
+    let first = f.index("a/source.idx", SOURCE, &[method()], Some(1), "a");
+    f.index("b/source.idx", SOURCE, &[method()], Some(1), "b");
+    let mapping = f.index("a/mapping.idx", MAPPING, &[], Some(1), "a");
+    let result = f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).unwrap();
+    assert_eq!(result.targets.len(), 1);
+    assert_eq!(result.targets[0].path.0, first);
+    let other = f.index("c/mapping.idx", MAPPING, &[], Some(1), "c");
+    assert_eq!(f.host.navigation_at(&f.root, &other, 1, reference_pos(), None, |_| None).unwrap().targets.len(), 2);
+    assert!(
+        f.host.navigation_at(&f.root.join("other-project"), &mapping, 1, reference_pos(), None, |_| None).is_none()
+    );
+    f.host.set_enabled("test.indexer", false).unwrap();
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).is_none());
+    f.host.set_enabled("test.indexer", true).unwrap();
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).is_none());
+    f.host.reload("test.indexer").unwrap();
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).is_none());
+}
+
+#[test]
+fn warmed_clicks_never_read_or_parse_files() {
+    let f = Fixture::new();
+    let source = f.index("source.idx", SOURCE, &[method()], Some(1), "");
+    let mapping = f.index("mapping.idx", MAPPING, &[], Some(1), "");
+    // Files become unreadable; the watcher invalidates separately. Resolution
+    // must remain purely in-memory, with no disk reads or component execution.
+    std::fs::remove_file(&source).unwrap();
+    std::fs::remove_file(&mapping).unwrap();
+    let calls = f.host.info_of("test.indexer").unwrap().stats.calls;
+    for _ in 0..10_000 {
+        assert_eq!(
+            f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).unwrap().targets.len(),
+            1
+        );
+    }
+    assert_eq!(f.host.info_of("test.indexer").unwrap().stats.calls, calls, "warm navigation must not execute Wasm");
+    f.host.invalidate_navigation(&f.root, None);
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), None, |_| None).is_none());
+}
+
+#[test]
+fn permissions_and_paths_are_checked_before_indexing() {
+    let f = Fixture::new();
+    let external = tempfile::NamedTempFile::new().unwrap();
+    assert!(
+        f.host
+            .index_navigation(
+                &f.root,
+                Snapshot { path: external.path(), version: None, text: "", symbols: &[], scope: "" },
+                Invocation::default()
+            )
+            .is_err()
+    );
+    f.host.set_project_policy(Arc::new(|_| false));
+    assert!(f.host.navigation_extensions(&f.root).is_empty());
+    assert!(
+        f.host
+            .index_navigation(
+                &f.root,
+                Snapshot { path: &f.root.join("x.idx"), version: None, text: MAPPING, symbols: &[], scope: "" },
+                Invocation::default()
+            )
+            .is_err()
+    );
+}
+
+#[test]
+fn syntax_symbols_aliases_and_utf16_ranges_cross_the_wasm_boundary() {
+    let f = Fixture::new();
+    let symbol = method();
+    let definition = f.index("source.idx", "def item\nsymbols parent#\n", &[symbol], Some(1), "app");
+    f.index("child.idx", "alias child# parent#\n", &[], Some(1), "app");
+    let mapping = f.index("mapping.idx", "ref child#item\n", &[], Some(1), "app");
+    let result = f.host.navigation_at(&f.root, &mapping, 1, Pos::new(0, 6), None, |_| None).unwrap();
+    assert_eq!(result.targets[0].path.0, definition);
+    assert_eq!(result.targets[0].range, method().range);
+    f.index("unicode.idx", "def 😀\n", &[], Some(1), "app");
+    let unicode = f.index("unicode-ref.idx", "ref 😀\n", &[], Some(1), "app");
+    let result = f.host.navigation_at(&f.root, &unicode, 1, Pos::new(0, 5), None, |_| None).unwrap();
+    assert_eq!(result.range, Range::new(Pos::new(0, 4), Pos::new(0, 6)));
+}
+
+#[test]
+fn two_windows_of_same_root_keep_unsaved_snapshots_isolated() {
+    let f = Fixture::new();
+    let source = f.index("source.idx", SOURCE, &[method()], Some(1), "");
+    let mapping = f.index("mapping.idx", MAPPING, &[], Some(1), "");
+    for client in ["one", "two"] {
+        let mut symbol = method();
+        if client == "two" {
+            symbol.range = Range::new(Pos::new(0, 5), Pos::new(0, 9));
+        }
+        for (path, text, symbols) in [(&source, "symbols source:\n", vec![symbol]), (&mapping, MAPPING, vec![])] {
+            f.host
+                .index_navigation(
+                    &f.root,
+                    Snapshot { path, version: Some(1), text, symbols: &symbols, scope: "" },
+                    Invocation { client: Some(client.into()), workspace_root: Some(f.root.clone()), editor: None },
+                )
+                .unwrap();
+        }
+    }
+    assert_eq!(
+        f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), Some("one"), |_| None).unwrap().targets[0]
+            .range
+            .start
+            .col,
+        4
+    );
+    assert_eq!(
+        f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), Some("two"), |_| None).unwrap().targets[0]
+            .range
+            .start
+            .col,
+        5
+    );
+    f.host.invalidate_client_navigation(&f.root, Some("one"), None);
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), Some("one"), |_| None).is_none());
+    assert!(f.host.navigation_at(&f.root, &mapping, 1, reference_pos(), Some("two"), |_| None).is_some());
+}
+
+#[test]
+fn markers_and_disable_follow_graph_state() {
+    let f = Fixture::new();
+    let tags = vec![];
+    let source = f.index("source.idx", SOURCE, &tags, Some(1), "app");
+    assert!(f.host.navigation_markers(&f.root, std::slice::from_ref(&source), None, |_| None).is_empty());
+    let mapping = f.index("mapping.idx", MAPPING, &[], Some(1), "app");
+    let entries = f.host.navigation_markers(&f.root, &[source.clone(), mapping.clone()], None, |_| None);
+    let source_markers = entries.iter().find(|e| e.path == source).unwrap();
+    assert_eq!(source_markers.markers.len(), 1);
+    assert_eq!(source_markers.markers[0].targets[0].path.0, mapping);
+    let mapping_markers = entries.iter().find(|e| e.path == mapping).unwrap();
+    assert_eq!(mapping_markers.markers.len(), 1);
+    assert_eq!(mapping_markers.markers[0].targets[0].path.0, source);
+    assert!(f.host.navigation_markers(&f.root, std::slice::from_ref(&source), None, |_| Some(2)).is_empty());
+    f.host.invalidate_navigation(&f.root, Some(&[mapping]));
+    assert!(f.host.navigation_markers(&f.root, std::slice::from_ref(&source), None, |_| None).is_empty());
+    f.host.set_enabled("test.indexer", false).unwrap();
+    assert!(f.host.navigation_markers(&f.root, &[source], None, |_| None).is_empty());
+}
+
+#[test]
+fn invalid_ranges_and_oversized_documents_never_publish() {
+    let f = Fixture::new();
+    let path = f.root.join("invalid.idx");
+    std::fs::write(&path, "invalid key\n").unwrap();
+    for text in ["invalid key\n".to_owned(), "x".repeat(ide_host::plugins::navigation::MAX_DOCUMENT_BYTES + 1)] {
+        assert!(
+            f.host
+                .index_navigation(
+                    &f.root,
+                    Snapshot { path: &path, version: Some(1), text: &text, symbols: &[], scope: "" },
+                    Invocation { workspace_root: Some(f.root.clone()), ..Default::default() },
+                )
+                .is_err()
+        );
+    }
+    assert!(f.host.navigation_markers(&f.root, &[path], None, |_| None).is_empty());
+}
@@ -189,6 +189,43 @@ impl ProjectIndex {
        out
    }

+    /// Reuse indexed syntax tags only for the exact text snapshot. Unsaved or
+    /// not-yet-indexed contents fall back to the caller's parser.
+    pub fn symbols_for_text(&self, path: &Path, text: &str) -> Option<Vec<ide_language::SymbolTag>> {
+        let hash = blake3::hash(text.as_bytes());
+        let data = self.shared.data.read();
+        let file = data.get(path)?;
+        if &file.hash != hash.as_bytes() {
+            return None;
+        }
+        Some(
+            file.symbols
+                .iter()
+                .map(|s| ide_language::SymbolTag {
+                    name: s.name.to_string(),
+                    kind: s.kind,
+                    container: s.container.as_ref().map(ToString::to_string),
+                    range: s.range,
+                })
+                .collect(),
+        )
+    }
+
+    /// Bounded file inventory for background plugin indexers; honors the same
+    /// project/exclude scope as search and never walks the filesystem.
+    pub fn files_with_extensions(&self, extensions: &[String], limit: usize) -> Vec<PathBuf> {
+        self.shared
+            .data
+            .read()
+            .files
+            .iter()
+            .flatten()
+            .filter(|f| f.path.extension().and_then(|e| e.to_str()).is_some_and(|e| extensions.iter().any(|x| x == e)))
+            .take(limit)
+            .map(|f| f.path.clone())
+            .collect()
+    }
+
    /// Fuzzy file search. IDEA-like ranking: file-name matches beat directory
    /// matches; `/` in the query matches path segments; recently opened files boost.
    pub fn find_files(&self, query: &str, limit: usize) -> Vec<FileMatch> {
@@ -632,3 +632,23 @@ fn workspace_scope_excludes_state_from_scans_updates_and_cached_results() {
    assert!(idx.wait_idle(WAIT));
    assert!(idx.find_files("", 100).is_empty());
 }
+
+#[test]
+fn plugin_inventory_respects_excludes_and_symbols_require_matching_text() {
+    let java = "package demo; interface UserMapper { void find(); }";
+    let f = Fixture::new(&[
+        ("src/UserMapper.java", java),
+        ("src/mapper.xml", "<mapper/>"),
+        ("target/Generated.java", "class Generated {}"),
+        ("other.txt", "ignored"),
+    ]);
+    let index = f.open();
+    let paths = index.files_with_extensions(&["java".into(), "xml".into()], 100);
+    assert_eq!(paths.len(), 2);
+    assert!(paths.iter().all(|p| p.starts_with(f.root.join("src"))));
+    assert_eq!(index.files_with_extensions(&["java".into(), "xml".into()], 1).len(), 1);
+    let path = f.root.join("src/UserMapper.java");
+    let symbols = index.symbols_for_text(&path, java).unwrap();
+    assert!(symbols.iter().any(|s| s.name == "find"));
+    assert!(index.symbols_for_text(&path, &java.replace("find", "renamed")).is_none());
+}
@@ -52,7 +52,7 @@ tree-sitter-proto = "0.6.0"
 tree-sitter-make = "1.1.1"
 tree-sitter-cmake = "0.7.4"
 tree-sitter-xml = "0.7.0"
-tree-sitter-haskell = "0.23.1"
+tree-sitter-haskell = "0.24.1"
 tree-sitter-dart = "0.2.0"
 tree-sitter-graphql = "0.3.0"
 tree-sitter-gdscript = "6.1.0"
@@ -1,7 +1,7 @@
 (header module: (module) @name) @outline.module
 (data_type name: (name) @name) @def.enum
 (newtype name: (name) @name) @def.struct
-(type_synomym name: (name) @name) @def.type
+(type_synonym name: (name) @name) @def.type
 (type_family name: (name) @name) @def.type
 (class name: (name) @name) @def.interface
 (instance name: (name) @name patterns: (_) @detail) @outline.namespace
@@ -10,6 +10,7 @@ use std::sync::{Arc, OnceLock};
 /// Built-in definitions, embedded at compile time. Add new languages here.
 const BUILTIN: &[(&str, &str)] = &[
    ("asciidoc", include_str!("../../../languages/asciidoc.toml")),
+    ("astro", include_str!("../../../languages/astro.toml")),
    ("bat", include_str!("../../../languages/bat.toml")),
    ("c", include_str!("../../../languages/c.toml")),
    ("clojure", include_str!("../../../languages/clojure.toml")),
@@ -602,6 +603,7 @@ mod tests {
        "Angular Template",
        "ERB",
        "JSP",
+        "Astro",
    ];

    fn reg() -> LanguageRegistry {
@@ -675,7 +677,7 @@ mod tests {
        let root = tmp.path();
        std::fs::create_dir_all(root.join("apps/web/src")).unwrap();
        std::fs::write(root.join("apps/web/.oxlintrc.json"), "{}").unwrap();
-        for lang in ["javascript", "javascriptreact", "typescript", "typescriptreact", "vue", "svelte"] {
+        for lang in ["javascript", "javascriptreact", "typescript", "typescriptreact", "vue", "svelte", "astro"] {
            let cfg = reg.get(&LanguageId::new(lang)).unwrap();
            let oxlint = cfg.language_servers.iter().find(|s| s.name == "oxlint").unwrap();
            assert_eq!((oxlint.command.as_str(), oxlint.args.as_slice()), ("oxlint", ["--lsp".to_string()].as_slice()));
@@ -889,6 +891,7 @@ mod tests {
            ("App.svelte", "svelte"),
            ("index.jsp", "jsp"),
            ("WEB-INF/tags/card.tag", "jsp"),
+            ("index.astro", "astro"),
            ("package.json", "json"),
            ("tsconfig.json", "jsonc"),
            ("tsconfig.app.json", "jsonc"),
@@ -950,6 +953,14 @@ mod tests {
        assert_eq!(res.line_comment.as_deref(), Some(";"));
    }

+    #[test]
+    fn astro_server_reads_the_project_typescript() {
+        let reg = reg();
+        let ls = &reg.get(&LanguageId::new("astro")).unwrap().language_servers[0];
+        let tsdk = ls.initialization_options.as_ref().and_then(|o| o.get("typescript")?.get("tsdk")?.as_str());
+        assert_eq!(tsdk, Some("node_modules/typescript/lib"));
+    }
+
    #[test]
    fn detects_shebangs() {
        let reg = reg();
@@ -327,6 +327,36 @@ impl LspManager {
        Ok(changed)
    }

+    /// Start Java in trusted build-root projects during idle startup, so configuration
+    /// navigation can warm after import even when no Java editor has been opened.
+    pub fn prewarm_java_configuration(self: &Arc<Self>) {
+        let weak = Arc::downgrade(self);
+        self.runtime.spawn(async move {
+            tokio::time::sleep(Duration::from_secs(2)).await;
+            let Some(mgr) = weak.upgrade() else { return };
+            if mgr.shutting_down.load(std::sync::atomic::Ordering::Acquire)
+                || !mgr.execution_allowed.load(std::sync::atomic::Ordering::Acquire)
+            {
+                return;
+            }
+            let root = mgr.project_root.clone();
+            let java_project = tokio::task::spawn_blocking(move || {
+                ["pom.xml", "build.gradle", "build.gradle.kts", ".classpath"]
+                    .iter()
+                    .any(|name| root.join(name).is_file())
+            })
+            .await
+            .unwrap_or(false);
+            if java_project {
+                for server in mgr.servers_for(&LanguageId::new("java"), &mgr.project_root) {
+                    if server.name == SERVER {
+                        mgr.ensure_started(&server);
+                    }
+                }
+            }
+        });
+    }
+
    pub(crate) fn java_import_ready(self: &Arc<Self>, server: Arc<Server>, generation: u64) {
        let mgr = self.clone();
        self.runtime.spawn(async move {
@@ -334,6 +364,32 @@ impl LspManager {
            if let Err(e) = mgr.java_configure_compiler(&server, &run).await {
                tracing::warn!("jdtls: cannot apply compiler defaults: {e}");
            }
+            // The extension only queues bounded, low-priority work; this request
+            // never waits for the configuration index itself to be built.
+            const WARMUP: &str = "openidea.java.configuration.warmup";
+            if server.running_gen(generation).is_some()
+                && run.caps.read().commands().iter().any(|command| command == WARMUP)
+            {
+                let preferred: Vec<_> = mgr
+                    .docs
+                    .lock()
+                    .values()
+                    .filter(|doc| matches!(doc.language.as_str(), "yaml" | "properties"))
+                    .map(|doc| doc.uri.to_string())
+                    .collect();
+                let result = tokio::time::timeout(
+                    Duration::from_secs(5),
+                    run.peer.request::<_, Value>(
+                        "workspace/executeCommand",
+                        json!({"command": WARMUP, "arguments": ["start", preferred]}),
+                        None,
+                    ),
+                )
+                .await;
+                if !matches!(result, Ok(Ok(_))) {
+                    tracing::debug!("jdtls: configuration warmup unavailable; retaining on-demand navigation");
+                }
+            }
        });
    }

@@ -758,7 +814,7 @@ mod tests {
        for wrapped in [false, true] {
            let mut cfg = java_config();
            let settings = json!({"java": {"project": {"referencedLibraries": ["vendor/*.jar"]}}});
-            cfg.settings = Some(if wrapped { json!({"settings": settings}) } else { settings });
+            cfg.settings = Some(if wrapped { json!({ "settings": settings }) } else { settings });
            configure_source_paths(&mut cfg, Some(vec!["custom".into()]));
            let settings = crate::handler::all_settings(&cfg);
            assert_eq!(settings["java"]["project"]["referencedLibraries"], json!(["vendor/*.jar"]));
@@ -315,6 +315,27 @@ async fn library_sources(snap: &DocSnap, pos: Pos, locs: Vec<Location>) -> Vec<L
    .unwrap_or_default()
 }

+const JAVA_IMPLEMENTATIONS: &str = "openidea.java.implementations";
+
+/// The answer of [`JAVA_IMPLEMENTATIONS`]: `complete` when the type is declared in the
+/// sources, so no dependency can implement it.
+#[derive(serde::Deserialize)]
+struct SourceImplementations {
+    locations: Vec<lsp::Location>,
+    complete: bool,
+}
+
+/// Receives the implementations found so far, before a slower search for the rest.
+type Partial<'a> = Option<&'a (dyn Fn(Vec<Location>) + Send + Sync)>;
+
+/// `first`, then those of `more` not in it (same file and start).
+fn merge_locations(first: Vec<Location>, more: Vec<Location>) -> Vec<Location> {
+    let mut seen: HashSet<(PathBuf, Pos)> = first.iter().map(|l| (l.path.to_path_buf(), l.range.start)).collect();
+    let mut out = first;
+    out.extend(more.into_iter().filter(|l| seen.insert((l.path.to_path_buf(), l.range.start))));
+    out
+}
+
 fn goto_method(kind: GotoKind) -> (&'static str, &'static str, &'static str) {
    match kind {
        GotoKind::Definition => ("textDocument/definition", "definitionProvider", "go to definition"),
@@ -1229,7 +1250,22 @@ impl LspManager {
        }
        let (method, cap, feature) = goto_method(kind);
        let (snap, targets) = self.doc_targets(doc, feature, |c| c.has(cap)).await?;
-        self.goto_in(&snap, &targets, method, pos, None).await
+        self.goto_in(&snap, &targets, method, pos, None, None).await
+    }
+
+    /// Go to Implementation, with the implementations found first passed to `partial` while
+    /// the search goes on: jdtls answers from the project's sources quickly, then searches every
+    /// dependency jar for a type declared in one. Returns them all, the first ones first.
+    pub async fn goto_implementation(
+        &self,
+        doc: DocId,
+        pos: Pos,
+        cancel: CancellationToken,
+        partial: &(dyn Fn(Vec<Location>) + Send + Sync),
+    ) -> IdeResult<Vec<Location>> {
+        let (method, cap, feature) = goto_method(GotoKind::Implementation);
+        let (snap, targets) = self.doc_targets(doc, feature, |c| c.has(cap)).await?;
+        self.goto_in(&snap, &targets, method, pos, Some(&cancel), Some(partial)).await
    }

    /// Implementations of the symbols at each of `positions` (gutter line
@@ -1246,7 +1282,7 @@ impl LspManager {
        let (snap, targets) = self.doc_targets(doc, feature, |c| c.has(cap)).await?;
        let requests = positions.iter().copied().map(|pos| {
            let (snap, targets, cancel) = (&snap, &targets, &cancel);
-            async move { self.goto_in(snap, targets, method, pos, Some(cancel)).await }
+            async move { self.goto_in(snap, targets, method, pos, Some(cancel), None).await }
        });
        let results: Vec<IdeResult<Vec<Location>>> =
            futures::stream::iter(requests).buffered(IMPLEMENTATION_CONCURRENCY).collect().await;
@@ -1259,6 +1295,46 @@ impl LspManager {
        Ok(results.into_iter().map(Result::unwrap_or_default).collect())
    }

+    /// jdtls: the implementations in the project's sources (`openidea.java.implementations`),
+    /// and whether they are all there are. Its standard request builds the type hierarchy over
+    /// every dependency jar too, which takes long in a project with many dependencies.
+    async fn java_source_implementations(
+        &self,
+        snap: &DocSnap,
+        t: &Target,
+        pos: Pos,
+        cancel: Option<&CancellationToken>,
+    ) -> (Vec<Location>, bool) {
+        if t.server.name != "jdtls" || !t.caps().commands().iter().any(|c| c == JAVA_IMPLEMENTATIONS) {
+            return (Vec::new(), false);
+        }
+        let params = snap.pos_params(t, pos);
+        let arguments =
+            json!([params["textDocument"]["uri"], params["position"]["line"], params["position"]["character"]]);
+        let result: IdeResult<SourceImplementations> = self
+            .call(
+                t,
+                "workspace/executeCommand",
+                json!({ "command": JAVA_IMPLEMENTATIONS, "arguments": arguments }),
+                cancel,
+                DEFAULT_TIMEOUT,
+            )
+            .await;
+        match result {
+            Ok(found) => {
+                let locs =
+                    convert::goto_response(&self.conv(t.enc()), lsp::GotoDefinitionResponse::Array(found.locations));
+                let locs = library_sources(snap, pos, locs).await;
+                self.note_virtual(&t.server, locs.iter().map(|l| l.uri.as_deref()));
+                (locs, found.complete)
+            }
+            Err(e) => {
+                tracing::debug!("{JAVA_IMPLEMENTATIONS}: {}", e.message);
+                (Vec::new(), false)
+            }
+        }
+    }
+
    async fn goto_in(
        &self,
        snap: &DocSnap,
@@ -1266,9 +1342,24 @@ impl LspManager {
        method: &str,
        pos: Pos,
        cancel: Option<&CancellationToken>,
+        partial: Partial<'_>,
    ) -> IdeResult<Vec<Location>> {
        let mut out = Outcome::new();
        for t in targets.iter().filter(|t| snap.asks(t, pos)) {
+            // Found in the sources before the standard request searches the dependencies too.
+            let mut first = Vec::new();
+            if method == "textDocument/implementation" {
+                let (locs, complete) = self.java_source_implementations(snap, t, pos, cancel).await;
+                if complete && !locs.is_empty() {
+                    return Ok(locs);
+                }
+                if let Some(partial) = partial
+                    && !locs.is_empty()
+                {
+                    partial(locs.clone());
+                    first = locs;
+                }
+            }
            let r = loading::while_loading(&t.server, cancel, loading::LOADING_WAIT, goto_is_empty, || {
                self.call::<_, Option<lsp::GotoDefinitionResponse>>(
                    t,
@@ -1284,12 +1375,19 @@ impl LspManager {
                    let locs = convert::goto_response(&self.conv(t.enc()), r);
                    let locs = library_sources(snap, pos, locs).await;
                    self.note_virtual(&t.server, locs.iter().map(|l| l.uri.as_deref()));
+                    let locs = merge_locations(first, locs);
                    if !locs.is_empty() {
                        return Ok(locs);
                    }
                    out.value = Some(Vec::new());
                }
+                Ok(None) if !first.is_empty() => return Ok(first),
                Ok(None) => out.value = Some(Vec::new()),
+                // Those shown stay valid when the rest can't be found.
+                Err(e) if !first.is_empty() && e.kind != ErrorKind::Cancelled => {
+                    tracing::debug!("go to implementation in the dependencies: {}", e.message);
+                    return Ok(first);
+                }
                Err(e) => out.fail(e),
            }
        }
@@ -1473,7 +1571,9 @@ impl LspManager {
                return Vec::new();
            }
            let defining = self.ready_targets(&snap.servers, |c| c.has("definitionProvider")).await;
-            self.goto_in(&snap, &defining, "textDocument/definition", pos, Some(&cancel)).await.unwrap_or_default()
+            self.goto_in(&snap, &defining, "textDocument/definition", pos, Some(&cancel), None)
+                .await
+                .unwrap_or_default()
        };
        let (results, declarations) = futures::join!(join_all(requests), declarations);
        let mut out = Outcome::new();
@@ -1804,6 +1804,71 @@ async fn implementations_per_position() {
    assert_eq!(err.kind, ide_core::error::ErrorKind::Cancelled);
 }

+#[tokio::test(flavor = "multi_thread")]
+async fn java_implementations_come_from_sources_first() {
+    let caps = json!({
+        "textDocumentSync": 1,
+        "implementationProvider": true,
+        "executeCommandProvider": { "commands": ["openidea.java.implementations"] },
+    });
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    let (doc, path) = h.open("Repo.java", "interface Repo {}\nclass A implements Repo {}\nclass B {}\nclass C {}\n");
+    h.wait_status("jdtls", ServerStatus::Ready).await;
+    let s = h.launcher.state("jdtls");
+    let uri = uri_of(&path);
+    let at = move |lines: &[u32]| {
+        lines
+            .iter()
+            .map(|&l| json!({ "uri": uri, "range": {"start":{"line":l,"character":6},"end":{"line":l,"character":7}} }))
+            .collect::<Value>()
+    };
+    *s.responder.lock() = Some(Arc::new(move |_, method, params| match method {
+        // Line 0 is declared in the sources; line 2 in a dependency, which implements it on line 3.
+        "workspace/executeCommand" => Some(match params["arguments"][1].as_u64() {
+            Some(0) => json!({ "locations": at(&[1]), "complete": true }),
+            Some(2) => json!({ "locations": at(&[1]), "complete": false }),
+            _ => json!({ "locations": [], "complete": true }),
+        }),
+        "textDocument/implementation" => Some(at(&[3, 1])),
+        _ => None,
+    }));
+    let lines = |locs: &[ide_core::Location]| locs.iter().map(|l| l.range.start.line).collect::<Vec<_>>();
+    let found = h.mgr.goto(doc, Pos::new(0, 10), GotoKind::Implementation).await.unwrap();
+    assert_eq!(lines(&found), vec![1]);
+    let markers = h.mgr.implementations(doc, &[Pos::new(0, 10)], Default::default()).await.unwrap();
+    assert_eq!(lines(&markers[0]), vec![1]);
+    assert!(s.requested("textDocument/implementation").is_empty(), "no search through the dependencies");
+    let asked = s.requested("workspace/executeCommand");
+    assert_eq!(asked[0]["command"], "openidea.java.implementations");
+    assert_eq!((asked[0]["arguments"][1].clone(), asked[0]["arguments"][2].clone()), (json!(0), json!(10)));
+
+    // A dependency's type: those in the sources first, then the dependencies' too.
+    let partial = Mutex::new(Vec::new());
+    let found = h
+        .mgr
+        .goto_implementation(doc, Pos::new(2, 6), Default::default(), &|locs| partial.lock().push(lines(&locs)))
+        .await
+        .unwrap();
+    assert_eq!(*partial.lock(), vec![vec![1]]);
+    assert_eq!(lines(&found), vec![1, 3]);
+    assert_eq!(s.requested("textDocument/implementation").len(), 1);
+    // Without a receiver for the first ones (gutter markers), just all of them.
+    let found = h.mgr.goto(doc, Pos::new(2, 6), GotoKind::Implementation).await.unwrap();
+    assert_eq!(lines(&found), vec![3, 1]);
+    assert_eq!(s.requested("textDocument/implementation").len(), 2);
+
+    // None in the sources: the standard request, with the dependencies.
+    let partial = Mutex::new(Vec::new());
+    let found = h
+        .mgr
+        .goto_implementation(doc, Pos::new(3, 6), Default::default(), &|locs| partial.lock().push(lines(&locs)))
+        .await
+        .unwrap();
+    assert!(partial.lock().is_empty());
+    assert_eq!(lines(&found), vec![3, 1]);
+    assert_eq!(s.requested("textDocument/implementation").len(), 3);
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn navigation_rename_format_and_decorations() {
    let h = harness(&[("mock", incremental_caps())]);
@@ -2312,7 +2377,7 @@ async fn class_file_opening_routes_sources_and_binary_documents() {
    let source = sources.join("p/Outer.java");
    std::fs::write(&source, "package p; class Outer {} ").unwrap();
    s.respond("java/classFileContents", json!("// Source code is decompiled from a .class file using FernFlower decompiler (from Intellij IDEA).\npackage p;\npublic class Outer {}"));
-    s.respond("workspace/executeCommand", json!({"org.eclipse.jdt.ls.core.sourcePaths":[sources]}));
+    s.respond("workspace/executeCommand", json!({ "org.eclipse.jdt.ls.core.sourcePaths": [sources] }));
    for class in ["Outer", "Outer$Nested", "Outer$1"] {
        let path = h.root.join(format!("target/classes/p/{class}.class"));
        let resolved = h.mgr.java_class_file(&path, None).await.unwrap();
@@ -3329,7 +3394,7 @@ async fn gopls_interactive_command_validates_before_execution_and_applies_edits(
            let reply: Value = tokio::task::block_in_place(|| {
                tokio::runtime::Handle::current().block_on(s.peer().request(
                    "workspace/applyEdit",
-                    json!({"edit": edit}),
+                    json!({ "edit": edit }),
                    None,
                ))
            })
@@ -3614,6 +3679,54 @@ async fn configuration_extension_failure_preserves_native_java_navigation() {
    assert_eq!(s.requested("textDocument/definition").len(), 1);
 }

+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_prewarm_starts_java_without_an_open_editor_and_waits_for_import() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.configuration.warmup"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    let s = h.launcher.state("jdtls");
+    h.mgr.prewarm_java_configuration();
+    h.mgr.prewarm_java_configuration();
+    h.wait_status("jdtls", ServerStatus::Ready).await;
+    assert_eq!(s.launches.load(Ordering::SeqCst), 1);
+    assert!(s.requested("workspace/executeCommand").is_empty());
+    let config = h.root.join("application.yml");
+    h.mgr.did_open(DocId::next(), &config, &LanguageId::new("yaml"), 1, "app: {}\n");
+    s.peer().notify("language/status", json!({"type": "ServiceReady"})).unwrap();
+    eventually(|| {
+        s.requested("workspace/executeCommand").iter().any(|p| p["command"] == "openidea.java.configuration.warmup")
+    })
+    .await;
+    let requests = s.requested("workspace/executeCommand");
+    let warmup = requests.iter().find(|p| p["command"] == "openidea.java.configuration.warmup").unwrap();
+    assert_eq!(warmup["arguments"], json!(["start", [uri_of(&config)]]));
+    assert!(s.notified("textDocument/didOpen").is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_prewarm_respects_trust_shutdown_and_non_java_roots() {
+    let mut fixtures = Vec::new();
+    for mode in ["untrusted", "closed", "non-java"] {
+        let h = harness_for("java", "java", &[("jdtls", incremental_caps())], &[]);
+        if mode != "non-java" {
+            std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+        }
+        if mode == "untrusted" {
+            h.mgr.set_execution_allowed(false);
+        }
+        h.mgr.prewarm_java_configuration();
+        if mode == "closed" {
+            h.mgr.shutdown_all().await;
+        }
+        fixtures.push(h);
+    }
+    tokio::time::sleep(Duration::from_millis(2200)).await;
+    for h in fixtures {
+        assert_eq!(h.launcher.state("jdtls").launches.load(Ordering::SeqCst), 0);
+    }
+}
+
 /// The configuration command indexes the whole project, so Go to Definition (and
 /// every Ctrl+hover probe) consults it only inside a key argument; ordinary Java
 /// symbols in a Spring file go straight to JDT.
@@ -0,0 +1,53 @@
+//! Edges a `document-indexer` export returns, and what the host answers from them.
+use ide_core::{Location, Range};
+use serde::{Deserialize, Serialize};
+use specta::Type;
+use std::path::PathBuf;
+
+#[derive(Clone, Debug, Deserialize, Serialize, Type)]
+#[serde(deny_unknown_fields)]
+pub struct Anchor {
+    pub key: String,
+    pub range: Range,
+}
+
+#[derive(Default, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct Alias {
+    pub prefix: String,
+    pub target: String,
+}
+
+#[derive(Default, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct Edges {
+    pub definitions: Vec<Anchor>,
+    pub references: Vec<Anchor>,
+    #[serde(default)]
+    pub aliases: Vec<Alias>,
+    #[serde(default)]
+    pub markers: Vec<Anchor>,
+}
+
+/// The resolved gutter markers of one file.
+#[derive(Clone, Debug, Serialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct FileMarkers {
+    pub path: PathBuf,
+    pub version: Option<u32>,
+    pub markers: Vec<NavigationResult>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct NavigationResult {
+    pub range: Range,
+    pub targets: Vec<Location>,
+}
+
+pub struct IndexSymbol {
+    pub name: String,
+    pub kind: String,
+    pub container: Option<String>,
+    pub range: Range,
+}
@@ -9,6 +9,7 @@
 //! host drops it. Each active plugin's runtime lives on its own [`Actor`] thread.

 mod actor;
+pub mod indexing;
 mod runtime;
 mod sandbox;
 mod types;
@@ -11,7 +11,7 @@ use crate::types::{
 use crate::types::{
    FieldValue, View, ViewBody, ViewButton, ViewEvent, ViewField, ViewListItem, ViewTable, ViewTreeItem, Viewport,
 };
-use crate::wit_host::{bindings, providers_bindings, syntax_bindings, views_bindings};
+use crate::wit_host::{bindings, indexing_bindings, providers_bindings, syntax_bindings, views_bindings};
 use ide_core::CancellationToken;
 use ide_core::ipc_path::to_ipc;
 use ide_extension::Capability;
@@ -27,13 +27,14 @@ use wasmtime_wasi::{WasiCtx, WasiCtxView, WasiView};

 use bindings::openidea::plugin::events as wit_events;
 use bindings::openidea::plugin::types as wit_types;
+use indexing_bindings::exports::openidea::plugin::document_indexer as wit_index;
 use providers_bindings::exports::openidea::plugin::providers as wit_prov;
 use syntax_bindings::exports::openidea::plugin::syntax_provider as wit_syntax;
 use views_bindings::exports::openidea::plugin::view_provider as wit_view;
 use views_bindings::openidea::plugin::view_types as wit_vt;

 /// The API version of the world above, `major.minor` of [`host_api`].
-pub const API_VERSION: &str = "1.1";
+pub const API_VERSION: &str = "1.2";
 const EPOCH_TICK: Duration = Duration::from_millis(10);
 pub(crate) const MAX_TEXT: usize = 1 << 20;
 pub(crate) const MAX_TITLE: usize = 256;
@@ -484,6 +485,7 @@ struct Exports {
    plugin: bindings::Plugin,
    syntax: Option<wit_syntax::Guest>,
    providers: Option<wit_prov::Guest>,
+    indexer: Option<wit_index::Guest>,
    views: Option<wit_view::Guest>,
 }

@@ -560,6 +562,7 @@ impl Runtime {
        let pre = engine.linker.instantiate_pre(component).map_err(api_hint)?;
        let plugin_indices = bindings::PluginIndices::new(&pre).map_err(api_hint)?;
        let syntax_indices = wit_syntax::GuestIndices::new(&pre).ok();
+        let index_indices = wit_index::GuestIndices::new(&pre).ok();
        let provider_indices = wit_prov::GuestIndices::new(&pre).ok();
        let view_indices = wit_view::GuestIndices::new(&pre).ok();
        let instance = pre.instantiate(&mut store).map_err(api_hint)?;
@@ -572,13 +575,17 @@ impl Runtime {
            Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
            None => None,
        };
+        let indexer = match index_indices {
+            Some(i) => Some(i.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
        let views = match view_indices {
            Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
            None => None,
        };
        Ok(Self {
            store,
-            exports: Exports { plugin, syntax, providers, views },
+            exports: Exports { plugin, syntax, providers, views, indexer },
            limits: setup.limits,
            version: setup.version,
        })
@@ -651,6 +658,47 @@ impl Runtime {
        self.call(Invocation::default(), timeout, |exports, store| f(exports.syntax.as_ref().expect("checked"), store))
    }

+    pub fn index_document(
+        &mut self,
+        path: &str,
+        text: &str,
+        symbols: &[crate::indexing::IndexSymbol],
+        invocation: Invocation,
+    ) -> Result<crate::indexing::Edges, CallError> {
+        if self.exports.indexer.is_none() {
+            return Err(CallError::missing_export("document-indexer"));
+        }
+        let doc = wit_index::Document {
+            path: path.into(),
+            text: text.into(),
+            symbols: symbols
+                .iter()
+                .map(|s| wit_index::Symbol {
+                    name: s.name.clone(),
+                    kind: s.kind.clone(),
+                    container: s.container.clone(),
+                    range: range_to_wit(s.range),
+                })
+                .collect(),
+        };
+        let edges = self.call(invocation, self.limits.timeout, |e, store| {
+            e.indexer.as_ref().expect("checked").call_index(store, &doc)
+        })?;
+        fn anchor(a: wit_index::Anchor) -> crate::indexing::Anchor {
+            crate::indexing::Anchor { key: a.key, range: range_from_wit(a.range) }
+        }
+        Ok(crate::indexing::Edges {
+            definitions: edges.definitions.into_iter().map(anchor).collect(),
+            references: edges.references.into_iter().map(anchor).collect(),
+            aliases: edges
+                .aliases
+                .into_iter()
+                .map(|a| crate::indexing::Alias { prefix: a.prefix, target: a.target })
+                .collect(),
+            markers: edges.markers.into_iter().map(anchor).collect(),
+        })
+    }
+
    /// The component exports `providers`.
    pub fn has_providers(&self) -> bool {
        self.exports.providers.is_some()
@@ -696,3 +696,10 @@ impl views_bindings::openidea::plugin::view_types::Host for StoreData {}

 /// Largest message between a plugin and its view's frame.
 const MAX_VIEW_MESSAGE: usize = 1 << 20;
+
+pub(crate) mod indexing_bindings {
+    wasmtime::component::bindgen!({
+        world: "indexing", path: "../../wit",
+        with: { "openidea:plugin/types": super::bindings::openidea::plugin::types },
+    });
+}
@@ -23,9 +23,12 @@ fn repo() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR")).join("../..")
 }

-/// Every component the repository builds for users: the official plugins with code, plus the `hello` fixture.
+/// Official components plus fixtures for the base and optional indexing exports.
 fn components() -> Vec<PathBuf> {
-    let mut out = vec![repo().join("crates/ide-plugin/tests/fixtures/hello/dist/plugin.wasm")];
+    let mut out = vec![
+        repo().join("crates/ide-plugin/tests/fixtures/hello/dist/plugin.wasm"),
+        repo().join("crates/ide-plugin/tests/fixtures/indexer/dist/plugin.wasm"),
+    ];
    let official = repo().join("plugins/official");
    let mut dirs: Vec<_> = std::fs::read_dir(&official).unwrap().map(|e| e.unwrap().path()).collect();
    dirs.sort();
@@ -1 +1 @@
-455d848dd27f242bb3e9bf420558cbc8c200853f51ada3d481635ac9771803f3
+42044c4b2e3d768b922d6e5026ff4e725d37b265896ea7f383f1d737e2feffb7
@@ -0,0 +1,333 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "equivalent"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "log"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
+
+[[package]]
+name = "macro-string"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e7b3a5bbb2f63aaa223a671ea1bd0e7bc16bd30ce387324cf63995deaddbbd2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "openidea-plugin"
+version = "0.1.0"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "openidea-test-indexer"
+version = "0.1.0"
+dependencies = [
+ "openidea-plugin",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "wasm-encoder"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c86ff6668190d9fb70372b306b4f9fe8930f0e2f57ce72e4922bf2f117900949"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
+dependencies = [
+ "bitflags",
+ "hashbrown",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b85a987ab61d365382d25c7d47e26edd48941b3bf6e3fbf76eff918bc71dab06"
+dependencies = [
+ "bitflags",
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "775e122e390603abfacd548027016cd0113a6e2bf2f8ce6bdd3658b013456ea8"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84e26e13b9d972026778d2ffb7985736de116026fdc8d9464f966e12df2eb240"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a008a0d6b4840677326beb4edbeb210a2f1b7d0183fb7cc33f466b90fd7fb6"
+dependencies = [
+ "anyhow",
+ "macro-string",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "078def49fdb49cab405c3006e05793b3fdaf7069126ba6b9c97d01ec8c98fe4c"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00f0dc051466ffe46787721fca3d088536f158ae400be044f1b1c386ba9397ad"
+dependencies = [
+ "anyhow",
+ "hashbrown",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-ident",
+ "wasmparser",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
@@ -0,0 +1,20 @@
+[package]
+name = "openidea-test-indexer"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[workspace]
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+openidea-plugin = { path = "../../../../../sdk/rust/openidea-plugin" }
+
+[profile.release]
+opt-level = "s"
+lto = true
+strip = true
+codegen-units = 1
+panic = "abort"
@@ -0,0 +1,10 @@
+# Document indexer test fixture
+
+A small line-oriented test language (`.idx`), unrelated to any framework:
+`def key`, `ref key`, `alias prefix# target#` and `symbols prefix`.
+References also produce gutter markers. `symbols` uses host-supplied UTF-16
+syntax ranges. `invalid key` deliberately returns an out-of-bounds range.
+
+Used by `cargo test -p ide-host --test plugin_indexing` to exercise the optional
+WIT export, lifecycle invalidation, permissions, per-window isolation, candidate
+selection and warm memory-only lookups. It is not a marketplace plugin.
@@ -0,0 +1 @@
+87eb2a28875abbc649b98d2a7f87263da217f9ad28f1395d96a61db5f781d9f0
@@ -0,0 +1,11 @@
+id = "test.indexer"
+name = "Document indexer fixture"
+version = "0.1.0"
+engines.openidea = "^1.2"
+wasm = "dist/plugin.wasm"
+
+[capabilities]
+required = ["project.read"]
+
+[[contributes.documentIndexers]]
+extensions = ["idx"]
@@ -0,0 +1,51 @@
+//! Deliberately tiny line-oriented fixture, not a language/framework plugin.
+use openidea_plugin::indexing::{Alias, Anchor, Document, DocumentIndexer, Edges};
+use openidea_plugin::{Error, Invocation, Plugin, Position, Range, register_plugin};
+
+#[derive(Default)]
+struct Indexer;
+impl Plugin for Indexer {
+    fn run_command(&mut self, id: &str, _: &Invocation, _: Option<&str>) -> Result<Option<String>, Error> {
+        Err(Error::NotFound(id.into()))
+    }
+}
+impl DocumentIndexer for Indexer {
+    fn index(&mut self, doc: &Document) -> Edges {
+        let mut out = Edges::default();
+        for (line, text) in doc.text.lines().enumerate() {
+            let Some((kind, value)) = text.split_once(' ') else { continue };
+            let range = Range {
+                start: Position { line: line as u32, character: kind.len() as u32 + 1 },
+                end: Position { line: line as u32, character: text.encode_utf16().count() as u32 },
+            };
+            let anchor = Anchor { key: value.into(), range };
+            match kind {
+                "def" => out.definitions.push(anchor),
+                "ref" => {
+                    out.references.push(anchor.clone());
+                    out.markers.push(anchor);
+                }
+                "alias" => {
+                    if let Some((prefix, target)) = value.split_once(' ') {
+                        out.aliases.push(Alias { prefix: prefix.into(), target: target.into() });
+                    }
+                }
+                "symbols" => out.definitions.extend(
+                    doc.symbols
+                        .iter()
+                        .map(|symbol| Anchor { key: format!("{value}{}", symbol.name), range: symbol.range }),
+                ),
+                "invalid" => out.references.push(Anchor {
+                    key: value.into(),
+                    range: Range {
+                        start: Position { line: 999, character: 0 },
+                        end: Position { line: 999, character: 1 },
+                    },
+                }),
+                _ => {}
+            }
+        }
+        out
+    }
+}
+register_plugin!(Indexer, indexing);
@@ -1 +1 @@
-f7e1ae06a90460ed1d2319bfc51f848654df145fa451f3d959b32776b2b25ce3
+3d3e43d4e49efa7a97984335f7f2df2cb286321bd0368251f37818aa6c1b70ad
@@ -1 +1 @@
-12973c7ca7330fc50eb16718fd769d412401b5a92bd014f4804659e4a272122f
+1d8561e04cb777efbafc6f64963473b9b69654a72ebb2be34f49c6c53c6f76e2
@@ -5,8 +5,8 @@ wit_bindgen::generate!({
    inline: "
        package fixture:misbehave;
        world misbehave {
-            include openidea:plugin/plugin-syntax@1.1.0;
-            export openidea:plugin/providers@1.1.0;
+            include openidea:plugin/plugin-syntax@1.2.0;
+            export openidea:plugin/providers@1.2.0;
        }
    ",
    path: "../../../../../wit",
@@ -1,6 +1,6 @@
 [package]
 name = "ide-remote"
-description = "Remote work over SSH: SFTP deployment (mappings, upload, download, sync) and run targets"
+description = "Remote work over SSH: SFTP deployment (mappings, upload, download, sync) and run targets (SSH, Docker, Compose)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,6 +10,7 @@ ide-core.workspace = true
 ide-ssh.workspace = true
 ide-run.workspace = true
 serde.workspace = true
+serde_json.workspace = true
 specta.workspace = true
 tokio.workspace = true
 tracing.workspace = true
@@ -0,0 +1,350 @@
+//! Run configurations on Docker and Compose run targets: rewritten into a local
+//! `docker run --rm` / `docker compose run --rm` of the configuration's program,
+//! with the project bind-mounted and its paths and interpreters swapped for the
+//! container's. The console, stdin, Stop and test parsers then work as for any
+//! local run.
+
+use crate::target::remote_command;
+use ide_core::remote_settings::{RunTarget, RunTargetKind};
+use ide_core::{IdeError, IdeResult};
+use ide_run::RunConfig;
+use std::collections::BTreeMap;
+use std::path::Path;
+
+/// What the rewrite needs besides the configuration and its target.
+pub struct ContainerRun<'a> {
+    pub target: &'a RunTarget,
+    /// The project on this machine.
+    pub root: &'a Path,
+    /// Where the project is in the container.
+    pub container_root: &'a str,
+    /// The docker executable.
+    pub docker: &'a str,
+    /// The connection's variables for the docker CLI (`ide_docker::run_env`).
+    pub endpoint_env: &'a BTreeMap<String, String>,
+    /// Variables of the configuration's `.env` files, already read.
+    pub file_env: &'a BTreeMap<String, String>,
+    /// Container name, unique per run.
+    pub name: &'a str,
+    /// `--user uid:gid`; `None` keeps the image's user.
+    pub user: Option<(u32, u32)>,
+}
+
+/// The container folder of the project when a Docker target sets none.
+pub fn default_container_root(root: &Path) -> String {
+    let name = root.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+    let name: String =
+        name.chars().map(|c| if c.is_alphanumeric() || matches!(c, '_' | '-' | '.') { c } else { '-' }).collect();
+    format!("/workspaces/{}", if name.is_empty() { "project" } else { &name })
+}
+
+/// A container name for a run of `config_id`: Docker allows `[a-zA-Z0-9][a-zA-Z0-9_.-]*`.
+pub fn container_name(config_id: &str, unique: &str) -> String {
+    let id: String = config_id
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-') { c } else { '-' })
+        .take(40)
+        .collect();
+    format!("openidea-{}-{unique}", id.trim_matches('-'))
+}
+
+/// `config` as a local run of the docker CLI that runs it in a new container.
+pub fn container_config(config: &RunConfig, run: &ContainerRun) -> IdeResult<RunConfig> {
+    let target = run.target;
+    let command = remote_command(config, target, run.root, run.container_root);
+    // Variables go by name (`-e NAME`) so their values stay out of the command line
+    // echoed in the console; the docker CLI reads them from its own environment.
+    let mut env: BTreeMap<String, String> = run.file_env.clone();
+    if matches!(config.kind.as_str(), "python" | "pytest" | "django-test")
+        && !command.env.contains_key("PYTHONUNBUFFERED")
+    {
+        env.insert("PYTHONUNBUFFERED".into(), "1".into());
+    }
+    env.extend(command.env.clone());
+    let pty = config.extras.emulate_terminal;
+    let mut args: Vec<String> = Vec::new();
+    match target.kind {
+        RunTargetKind::Docker => {
+            if target.image.trim().is_empty() {
+                return Err(IdeError::invalid(format!("Run target '{}' has no image", target.name)));
+            }
+            args.extend(["run", "--rm", "--interactive", "--init"].map(String::from));
+            if pty {
+                args.push("--tty".into());
+            }
+            let root = run.root.to_string_lossy();
+            args.extend(["--volume".into(), format!("{root}:{}", run.container_root)]);
+        }
+        RunTargetKind::Compose => {
+            if target.service.trim().is_empty() {
+                return Err(IdeError::invalid(format!("Run target '{}' has no service", target.name)));
+            }
+            args.push("compose".into());
+            for file in target.compose_files.iter().map(|f| f.trim()).filter(|f| !f.is_empty()) {
+                args.extend(["--file".into(), run.root.join(file).to_string_lossy().into_owned()]);
+            }
+            args.extend(["run", "--rm"].map(String::from));
+            if !pty {
+                args.push("--no-TTY".into());
+            }
+        }
+        RunTargetKind::Ssh => return Err(IdeError::internal("an SSH target does not run in a container")),
+    }
+    args.extend(["--name".into(), run.name.to_owned(), "--label".into(), format!("openidea.run={}", config.id)]);
+    args.extend(["--workdir".into(), command.cwd.clone()]);
+    let mut docker_env = run.endpoint_env.clone();
+    for (key, value) in &env {
+        if run.endpoint_env.contains_key(key) {
+            // `PATH`, `DOCKER_HOST`…: the CLI's own value differs from the container's.
+            args.extend(["--env".into(), format!("{key}={value}")]);
+        } else {
+            args.extend(["--env".into(), key.clone()]);
+            docker_env.insert(key.clone(), value.clone());
+        }
+    }
+    for port in target.ports.iter().map(|p| p.trim()).filter(|p| !p.is_empty()) {
+        args.extend(["--publish".into(), port.to_owned()]);
+    }
+    if let Some((uid, gid)) = run.user {
+        args.extend(["--user".into(), format!("{uid}:{gid}")]);
+    }
+    let options = target.run_options.trim();
+    if !options.is_empty() {
+        args.extend(ide_run::import::split_args(options));
+    }
+    args.push(match target.kind {
+        RunTargetKind::Compose => target.service.trim().to_owned(),
+        _ => target.image.trim().to_owned(),
+    });
+    match command.shell_line {
+        Some(line) => args.extend(["sh".into(), "-c".into(), line]),
+        None => {
+            args.push(command.program);
+            args.extend(command.args);
+        }
+    }
+    let mut out = config.clone();
+    out.command = run.docker.to_owned();
+    out.args = args;
+    out.cwd = Some(run.root.to_path_buf().into());
+    out.env = docker_env;
+    let extras = &mut out.extras;
+    extras.target = None;
+    extras.env_files.clear();
+    // The docker CLI needs `HOME` (contexts, credentials); the container gets only `env`.
+    extras.include_system_env = true;
+    // `docker stop` signals the container's process (the CLI may not forward a signal).
+    extras.stop_command = Some(format!("{} stop {}", shell_word(run.docker), run.name));
+    Ok(out)
+}
+
+/// `word` for this machine's shell (the stop command runs there): the docker CLI found
+/// outside `PATH` (Docker.app's bundle) may contain spaces.
+fn shell_word(word: &str) -> String {
+    if !word.contains(|c: char| c.is_whitespace() || "'\"$`\\&;|<>()*?#~".contains(c)) || word.is_empty() {
+        word.to_owned()
+    } else if cfg!(windows) {
+        format!("\"{word}\"")
+    } else {
+        format!("'{}'", word.replace('\'', "'\\''"))
+    }
+}
+
+/// The project's folder in the container of a Compose `service`, from the JSON of
+/// `docker compose config --format json`: the target of a bind mount of the project
+/// or a folder above it.
+pub fn compose_container_root(config_json: &str, service: &str, root: &Path) -> IdeResult<String> {
+    let model: serde_json::Value = serde_json::from_str(config_json)
+        .map_err(|e| IdeError::internal(format!("cannot read `docker compose config`: {e}")))?;
+    let Some(svc) = model.pointer(&format!("/services/{}", service.replace('~', "~0").replace('/', "~1"))) else {
+        return Err(IdeError::not_found(format!("the Compose files have no service '{service}'")));
+    };
+    let mounts = svc.get("volumes").and_then(|v| v.as_array()).into_iter().flatten();
+    let mut best: Option<(usize, String)> = None;
+    for m in mounts {
+        if m.get("type").and_then(|t| t.as_str()) != Some("bind") {
+            continue;
+        }
+        let (Some(source), Some(target)) =
+            (m.get("source").and_then(|s| s.as_str()), m.get("target").and_then(|t| t.as_str()))
+        else {
+            continue;
+        };
+        let Ok(rel) = root.strip_prefix(source) else { continue };
+        let depth = Path::new(source).components().count();
+        if best.as_ref().is_none_or(|(d, _)| depth > *d) {
+            let rel = crate::mapping::posix(rel);
+            let target = target.trim_end_matches('/');
+            let folder = match (target.is_empty(), rel.is_empty()) {
+                (true, true) => "/".to_owned(),
+                (_, true) => target.to_owned(),
+                _ => format!("{target}/{rel}"),
+            };
+            best = Some((depth, folder));
+        }
+    }
+    best.map(|(_, folder)| folder).ok_or_else(|| {
+        IdeError::invalid(format!(
+            "service '{service}' does not mount the project folder: add a bind mount of it, or set the container folder of the run target"
+        ))
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[cfg(unix)]
+    use std::path::PathBuf;
+
+    #[cfg(unix)]
+    fn config(command: &str, args: &[&str]) -> RunConfig {
+        RunConfig {
+            id: "app".into(),
+            name: "app".into(),
+            kind: "python".into(),
+            command: command.into(),
+            args: args.iter().map(|s| s.to_string()).collect(),
+            cwd: None,
+            env: BTreeMap::from([("DATA".to_owned(), "/work/proj/data".to_owned())]),
+            detected: false,
+            is_test: false,
+            debug_adapter: None,
+            allow_parallel: false,
+            extras: Default::default(),
+        }
+    }
+
+    #[cfg(unix)]
+    fn run<'a>(
+        target: &'a RunTarget,
+        endpoint: &'a BTreeMap<String, String>,
+        files: &'a BTreeMap<String, String>,
+    ) -> ContainerRun<'a> {
+        ContainerRun {
+            target,
+            root: Path::new("/work/proj"),
+            container_root: "/workspaces/proj",
+            docker: "/usr/local/bin/docker",
+            endpoint_env: endpoint,
+            file_env: files,
+            name: "openidea-app-1",
+            user: Some((501, 20)),
+        }
+    }
+
+    // Unix paths are not absolute on Windows.
+    #[cfg(unix)]
+    #[test]
+    fn docker_target_runs_the_program_in_a_new_container() {
+        let target = RunTarget {
+            kind: RunTargetKind::Docker,
+            name: "py".into(),
+            image: "python:3.12".into(),
+            ports: vec!["8000:8000".into(), " ".into()],
+            run_options: r#"--network host --label "a b""#.into(),
+            ..Default::default()
+        };
+        let endpoint = BTreeMap::from([
+            ("DOCKER_CONTEXT".to_owned(), "orbstack".to_owned()),
+            ("PATH".to_owned(), "/usr/local/bin".to_owned()),
+        ]);
+        let files = BTreeMap::from([("SECRET".to_owned(), "s3".to_owned())]);
+        let mut c = config("/work/proj/.venv/bin/python", &["-u", "/work/proj/main.py"]);
+        c.env.insert("PATH".into(), "/opt/bin".into());
+        c.extras.target = Some("t".into());
+        c.extras.env_files = vec![".env".into()];
+        let out = container_config(&c, &run(&target, &endpoint, &files)).unwrap();
+        assert_eq!(out.command, "/usr/local/bin/docker");
+        assert_eq!(
+            out.args.join(" "),
+            "run --rm --interactive --init --volume /work/proj:/workspaces/proj \
+             --name openidea-app-1 --label openidea.run=app --workdir /workspaces/proj \
+             --env DATA --env PATH=/opt/bin --env PYTHONUNBUFFERED --env SECRET \
+             --publish 8000:8000 --user 501:20 --network host --label a b \
+             python:3.12 python3 -u /workspaces/proj/main.py"
+        );
+        assert_eq!(out.env["DATA"], "/workspaces/proj/data", "values reach the CLI's environment, mapped");
+        assert_eq!(out.env["SECRET"], "s3");
+        assert_eq!(out.env["PATH"], "/usr/local/bin", "the CLI keeps its own PATH");
+        assert_eq!(out.env["DOCKER_CONTEXT"], "orbstack");
+        assert_eq!(out.cwd.as_deref(), Some(Path::new("/work/proj")));
+        assert_eq!(out.extras.target, None);
+        assert!(out.extras.env_files.is_empty() && out.extras.include_system_env);
+        assert_eq!(out.extras.stop_command.as_deref(), Some("/usr/local/bin/docker stop openidea-app-1"));
+        assert_eq!(out.kind, "python", "test and output parsers still apply");
+
+        let mut c = config("npm run dev", &[]);
+        c.kind = "npm".into();
+        c.extras.emulate_terminal = true;
+        let target = RunTarget { kind: RunTargetKind::Docker, image: "node:22".into(), ..Default::default() };
+        let mut r = run(&target, &endpoint, &files);
+        r.user = None;
+        let out = container_config(&c, &r).unwrap();
+        assert!(out.args.starts_with(&["run", "--rm", "--interactive", "--init", "--tty"].map(String::from)));
+        assert!(!out.args.contains(&"--user".to_string()) && !out.args.contains(&"PYTHONUNBUFFERED".to_string()));
+        assert!(out.args.ends_with(&["node:22", "sh", "-c", "npm run dev"].map(String::from)));
+
+        let target = RunTarget { kind: RunTargetKind::Docker, name: "none".into(), ..Default::default() };
+        assert!(container_config(&c, &run(&target, &endpoint, &files)).unwrap_err().message.contains("no image"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn compose_target_runs_in_a_new_container_of_the_service() {
+        let target = RunTarget {
+            kind: RunTargetKind::Compose,
+            compose_files: vec!["compose.yaml".into(), "compose.dev.yaml".into()],
+            service: "web".into(),
+            ..Default::default()
+        };
+        let none = BTreeMap::new();
+        let mut c = config("/work/proj/.venv/bin/python", &["manage.py", "test"]);
+        c.kind = "django-test".into();
+        c.cwd = Some(PathBuf::from("/work/proj/backend").into());
+        let mut r = run(&target, &none, &none);
+        r.container_root = "/app";
+        let out = container_config(&c, &r).unwrap();
+        assert_eq!(
+            out.args.join(" "),
+            "compose --file /work/proj/compose.yaml --file /work/proj/compose.dev.yaml run --rm --no-TTY \
+             --name openidea-app-1 --label openidea.run=app --workdir /app/backend \
+             --env DATA --env PYTHONUNBUFFERED --user 501:20 web python3 manage.py test"
+        );
+        assert_eq!(out.env["DATA"], "/app/data");
+
+        let target = RunTarget { kind: RunTargetKind::Compose, name: "c".into(), ..Default::default() };
+        assert!(container_config(&c, &run(&target, &none, &none)).unwrap_err().message.contains("no service"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn compose_container_root_follows_the_project_bind_mount() {
+        let json = r#"{"services": {
+            "web": {"volumes": [
+                {"type": "volume", "source": "data", "target": "/data"},
+                {"type": "bind", "source": "/work", "target": "/src"},
+                {"type": "bind", "source": "/work/proj", "target": "/app/"}
+            ]},
+            "worker": {"volumes": [{"type": "bind", "source": "/work", "target": "/src"}]},
+            "db": {}
+        }}"#;
+        let root = Path::new("/work/proj");
+        assert_eq!(compose_container_root(json, "web", root).unwrap(), "/app", "the closest mount wins");
+        assert_eq!(compose_container_root(json, "worker", root).unwrap(), "/src/proj");
+        assert!(compose_container_root(json, "db", root).unwrap_err().message.contains("does not mount"));
+        assert_eq!(compose_container_root(json, "api", root).unwrap_err().kind, ide_core::error::ErrorKind::NotFound);
+    }
+
+    #[test]
+    fn names_and_default_folder() {
+        assert_eq!(container_name("workspace:a/b:Run app", "k3x"), "openidea-workspace-a-b-Run-app-k3x");
+        assert_eq!(default_container_root(Path::new("/work/my proj")), "/workspaces/my-proj");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn stop_quotes_the_docker_cli_for_the_shell() {
+        assert_eq!(shell_word("/usr/local/bin/docker"), "/usr/local/bin/docker");
+        assert_eq!(shell_word("/Volumes/My Apps/docker"), "'/Volumes/My Apps/docker'");
+    }
+}
@@ -1,7 +1,8 @@
 //! Remote work over SSH: SFTP deployment ([`deploy`], [`mapping`]) and run
-//! configurations on run targets ([`target`]).
+//! configurations on run targets ([`target`]; Docker and Compose ones in [`docker`]).

 pub mod deploy;
+pub mod docker;
 pub mod import;
 pub mod mapping;
 pub mod service;
@@ -338,6 +338,9 @@ impl RemoteService {
    ) -> IdeResult<RunInfo> {
        let target_id = config.extras.target.as_deref().unwrap_or_default();
        let target = run_target(settings, target_id)?;
+        if target.kind != ide_core::remote_settings::RunTargetKind::Ssh {
+            return Err(IdeError::internal("container run targets start as local runs of the docker CLI"));
+        }
        let session = self.ssh.session(&target.ssh_config).await?;
        let fs = RemoteFs::new(session.sftp().await?);
        let folder = if target.project_root.trim().is_empty() {
@@ -241,7 +241,7 @@ pub(crate) fn config(name: &str, kind: &str, command: String, args: Vec<String>,

 /// Splits a command line into words: whitespace, `'…'` and `"…"` quoting, backslash escapes
 /// (like `parseArgs` in `src/platform/commandLine.ts`).
-pub(crate) fn split_args(line: &str) -> Vec<String> {
+pub fn split_args(line: &str) -> Vec<String> {
    let mut out = Vec::new();
    let mut cur = String::new();
    let mut has = false;
@@ -880,7 +880,7 @@ mod tests {
        configure_jdtls(&mut plain, Path::new("/p"), Path::new("/data"), &[], None, None, JDTLS_MIN_JAVA, &[], None);
        let data = |c: &LanguageServerConfig| c.args[c.args.iter().position(|a| a == "-data").unwrap() + 1].clone();
        assert_ne!(data(&cfg), data(&plain), "a separate workspace, so everything is rebuilt with the agent");
-        let patched = Path::new("/managed/lombok-1.18.48-openidea.2.jar");
+        let patched = Path::new("/managed/lombok-1.18.48-openidea.3.jar");
        let mut fixed = jdtls();
        configure_jdtls(
            &mut fixed,
@@ -894,6 +894,23 @@ mod tests {
            Some(patched),
        );
        assert_ne!(data(&cfg), data(&fixed), "the patch must rebuild classes compiled with the official agent");
+        let mut previous = jdtls();
+        configure_jdtls(
+            &mut previous,
+            Path::new("/p"),
+            Path::new("/data"),
+            &[],
+            None,
+            None,
+            JDTLS_MIN_JAVA,
+            &[],
+            Some(Path::new("/managed/lombok-1.18.48-openidea.2.jar")),
+        );
+        assert_ne!(
+            data(&previous),
+            data(&fixed),
+            "the new patch must rebuild classes compiled with the previous bundle"
+        );
        let before = cfg.clone();
        configure_jdtls(&mut cfg, Path::new("/p"), Path::new("/data"), &[], None, None, JDTLS_MIN_JAVA, &[], Some(jar));
        assert_eq!(cfg, before, "idempotent");
@@ -1169,7 +1186,7 @@ mod kotlin_bridge_bundle_tests {

 /// Installs the app-owned JDT LS command bundle, falling back to ordinary LSP on IO failure.
 pub fn usages_bundle(data_dir: &Path) -> Option<PathBuf> {
-    let extension = data_dir.join("java-usages-1.3.0.jar");
+    let extension = data_dir.join("java-usages-1.6.0.jar");
    let bytes = include_bytes!("../../../java/java-usages/openidea-java-usages.jar");
    if std::fs::read(&extension).is_ok_and(|old| old == bytes) {
        clean_usages_bundles(data_dir, &extension);
@@ -507,7 +507,7 @@ mod tests {
        let cache = repo.join("org/projectlombok/lombok/1.18.48");
        fs::create_dir_all(&cache).unwrap();
        fs::write(cache.join("lombok-1.18.48.jar"), b"official agent").unwrap();
-        let patched = PathBuf::from("/managed/lombok-1.18.48-openidea.2.jar");
+        let patched = PathBuf::from("/managed/lombok-1.18.48-openidea.3.jar");
        let selected = lombok_agent(tmp.path(), None, Some(patched.clone()), Some(repo.clone()));
        assert_eq!(selected.jar(), Some(patched.as_path()));
        assert_eq!(selected.problem(), None);
@@ -52,6 +52,43 @@ pub fn composer_level(root: &Path) -> Option<PhpLanguageLevel> {
        .map(|v| PhpLanguageLevel::new(v, PhpLevelSource::Require))
 }

+/// Why `composer install` is due in a Composer project.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub enum ComposerInstall {
+    /// No `vendor/autoload.php`.
+    Missing,
+    /// A package of `composer.lock` is not installed, or at another version.
+    Outdated,
+}
+
+/// The Composer project `file` belongs to (the nearest `composer.json` at or below `root`), and
+/// whether its dependencies need `composer install`.
+pub fn composer_install(file: &Path, root: &Path) -> Option<(PathBuf, ComposerInstall)> {
+    let dir = file.ancestors().filter(|d| d.starts_with(root)).find(|d| d.join("composer.json").is_file())?;
+    let composer: Value = serde_json::from_str(&std::fs::read_to_string(dir.join("composer.json")).ok()?).ok()?;
+    let vendor = dir.join(composer.pointer("/config/vendor-dir").and_then(Value::as_str).unwrap_or("vendor"));
+    if !vendor.join("autoload.php").is_file() {
+        return Some((dir.to_path_buf(), ComposerInstall::Missing));
+    }
+    let read = |path: PathBuf| std::fs::read_to_string(path).ok().and_then(|t| serde_json::from_str::<Value>(&t).ok());
+    let lock = read(dir.join("composer.lock"))?;
+    let installed = read(vendor.join("composer/installed.json")).unwrap_or(Value::Null);
+    // Composer 2 writes `{"packages": [...], "dev": bool}`, Composer 1 the list itself.
+    let packages = installed.get("packages").unwrap_or(&installed).as_array().cloned().unwrap_or_default();
+    let versions: std::collections::HashMap<&str, &str> =
+        packages.iter().filter_map(|p| Some((p.get("name")?.as_str()?, p.get("version")?.as_str()?))).collect();
+    let dev = installed.get("dev").and_then(Value::as_bool).unwrap_or(true);
+    let sections: &[&str] = if dev { &["packages", "packages-dev"] } else { &["packages"] };
+    let outdated = sections
+        .iter()
+        .filter_map(|section| lock.get(*section).and_then(Value::as_array))
+        .flatten()
+        .filter_map(|p| Some((p.get("name")?.as_str()?, p.get("version")?.as_str()?)))
+        .any(|(name, version)| versions.get(name) != Some(&version));
+    outdated.then(|| (dir.to_path_buf(), ComposerInstall::Outdated))
+}
+
 /// Gives each PHP version its own Intelephense workspace storage (below `data_dir`).
 /// Intelephense keeps the built-in functions of the version a workspace was first indexed
 /// with in that storage, and reuses them after the version changes. Without a version, or
@@ -226,6 +263,39 @@ fn lower_bound(alternative: &str) -> Option<Version> {
 mod tests {
    use super::*;

+    #[test]
+    fn composer_install_is_due_without_vendor_or_when_the_lock_differs() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let app = root.join("app");
+        std::fs::create_dir_all(app.join("src")).unwrap();
+        let file = app.join("src/Kernel.php");
+        assert_eq!(composer_install(&file, root), None, "not a Composer project");
+        std::fs::write(app.join("composer.json"), r#"{"config": {"vendor-dir": "lib"}}"#).unwrap();
+        assert_eq!(composer_install(&file, root), Some((app.clone(), ComposerInstall::Missing)));
+        std::fs::create_dir_all(app.join("lib/composer")).unwrap();
+        std::fs::write(app.join("lib/autoload.php"), "<?php").unwrap();
+        assert_eq!(composer_install(&file, root), None, "installed, no lock to compare with");
+        let lock = r#"{"packages": [{"name": "a/a", "version": "v1.2.0"}], "packages-dev": [{"name": "t/t", "version": "10.0.0"}]}"#;
+        std::fs::write(app.join("composer.lock"), lock).unwrap();
+        let installed = |packages: &str, dev: bool| {
+            let json = format!(r#"{{"packages": [{packages}], "dev": {dev}}}"#);
+            std::fs::write(app.join("lib/composer/installed.json"), json).unwrap();
+            composer_install(&file, root)
+        };
+        let a = r#"{"name": "a/a", "version": "v1.2.0"}"#;
+        let t = r#"{"name": "t/t", "version": "10.0.0"}"#;
+        assert_eq!(installed(&format!("{a},{t}"), true), None);
+        assert_eq!(installed(a, false), None, "`--no-dev` leaves out the dev packages");
+        assert_eq!(installed(a, true), Some((app.clone(), ComposerInstall::Outdated)), "a dev package is missing");
+        let old = r#"{"name": "a/a", "version": "v1.1.0"}"#;
+        assert_eq!(installed(&format!("{old},{t}"), true), Some((app.clone(), ComposerInstall::Outdated)));
+        // Composer 1 lists the packages at the top level.
+        std::fs::write(app.join("lib/composer/installed.json"), format!("[{a},{t}]")).unwrap();
+        assert_eq!(composer_install(&file, root), None);
+        assert_eq!(composer_install(&root.join("other.php"), root), None, "outside the Composer project");
+    }
+
    fn level(composer: Option<&str>, explicit: &str) -> Option<String> {
        levels(composer, explicit).0.map(|l| l.version)
    }
@@ -29,6 +29,24 @@ pub fn display_name(tool: &str) -> &str {
    crate::registry::find(tool).map_or(tool, |t| t.display)
 }

+/// A project's PHP-CS-Fixer: its committed configuration and `vendor/bin/php-cs-fixer`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PhpCsFixer {
+    pub config: PathBuf,
+    pub bin: PathBuf,
+}
+
+/// PHP-CS-Fixer for `file`: the nearest folder above it with `.php-cs-fixer.php` (which wins, as
+/// PHP-CS-Fixer documents) or `.php-cs-fixer.dist.php`, and the nearest `vendor/bin/php-cs-fixer`.
+/// `None` without both: Reformat Code keeps the language server.
+pub fn php_cs_fixer(file: &Path) -> Option<PhpCsFixer> {
+    let config = file.parent()?.ancestors().find_map(|dir| {
+        [".php-cs-fixer.php", ".php-cs-fixer.dist.php"].iter().map(|name| dir.join(name)).find(|p| p.is_file())
+    })?;
+    let bin = find_up(file, &Path::new("vendor").join("bin").join("php-cs-fixer"))?;
+    Some(PhpCsFixer { config, bin })
+}
+
 fn package_bin(package: &Path, tool: &str) -> IdeResult<PathBuf> {
    let name = display_name(tool);
    let json: serde_json::Value = serde_json::from_slice(&std::fs::read(package.join("package.json"))?)
@@ -159,6 +177,33 @@ pub fn arguments(
    args
 }

+impl Tools {
+    /// `php vendor/bin/php-cs-fixer fix` of `target` with the project's configuration, from the
+    /// configuration's folder; `php` is the interpreter chosen in the settings, else the one on `PATH`.
+    pub fn php_cs_fixer_command(&self, php: Option<&Path>, fixer: &PhpCsFixer, target: &Path) -> IdeResult<Command> {
+        let php = match php {
+            Some(php) => php.to_path_buf(),
+            None => self.which("php").ok_or_else(|| IdeError::unavailable("PHP-CS-Fixer: PHP is not installed"))?,
+        };
+        let mut cmd = self.command(php);
+        cmd.arg(&fixer.bin)
+            .args(["fix", "--config"])
+            .arg(&fixer.config)
+            .args(["--using-cache=no", "--no-interaction", "--show-progress=none"])
+            .arg(target);
+        if let Some(dir) = fixer.config.parent() {
+            cmd.current_dir(dir);
+        }
+        Ok(cmd)
+    }
+}
+
+/// Runs a [`Tools::php_cs_fixer_command`], which rewrites its target file in place.
+pub fn run_php_cs_fixer(mut command: Command, cancel: &CancellationToken) -> IdeResult<String> {
+    crate::process::run_input(&mut command, "", Duration::from_secs(30), cancel)
+        .map_err(|e| IdeError::invalid(format!("PHP-CS-Fixer: {}", e.message.trim())))
+}
+
 pub fn run(tool: &str, mut command: Command, text: &str, cancel: &CancellationToken) -> IdeResult<String> {
    crate::process::run_input(&mut command, text, Duration::from_secs(15), cancel).map_err(|e| e.with_tool(tool))
 }
@@ -1221,10 +1221,26 @@ impl Tools {
        cancel: &CancellationToken,
    ) -> IdeResult<sources::Download> {
        match source {
-            ReleaseSource::GitHub { repo } => {
-                let json = http.get_text(&sources::github_latest_url(repo), cancel)?;
-                sources::github_pick(&json, assets, self.platform)
-            }
+            ReleaseSource::GitHub { repo } => match http.get_text(&sources::github_latest_url(repo), cancel) {
+                Ok(json) => sources::github_pick(&json, assets, self.platform),
+                Err(e) if e.kind == ErrorKind::Cancelled => Err(e),
+                // Without a token the API allows 60 requests an hour per IP address, often used
+                // up behind a shared one (403/429); the release's web pages have no such limit.
+                Err(api) => self.resolve_github_web(http, repo, assets, cancel).map_err(|web| {
+                    if web.kind == ErrorKind::Cancelled {
+                        return web;
+                    }
+                    tracing::warn!("GitHub release lookup for {repo} failed: {api}; web pages: {web}");
+                    IdeError::new(
+                        api.kind,
+                        format!(
+                            "{}\nDownload it from {} and set its Path in Settings › Languages & Frameworks › Language Servers.",
+                            api.message,
+                            sources::github_latest_page(repo)
+                        ),
+                    )
+                }),
+            },
            ReleaseSource::HashiCorp { product } => {
                let json = http.get_text(&sources::hashicorp_latest_url(product), cancel)?;
                sources::hashicorp_pick(&json, assets, self.platform)
@@ -1251,6 +1267,27 @@ impl Tools {
        }
    }

+    /// [`resolve_release`](Self::resolve_release) for a GitHub release, from its web pages.
+    fn resolve_github_web(
+        &self,
+        http: &Http,
+        repo: &str,
+        assets: &[platform::AssetRule],
+        cancel: &CancellationToken,
+    ) -> IdeResult<sources::Download> {
+        let page = http.effective_url(&sources::github_latest_page(repo), cancel)?;
+        let tag = sources::github_tag_from_url(&page)
+            .ok_or_else(|| IdeError::unavailable(format!("{repo} has no published release")))?;
+        let list = http.get_text(&sources::github_assets_page(repo, &tag), cancel)?;
+        match sources::github_pick_web(repo, &tag, &list, None, assets, self.platform) {
+            Err(e) if e.kind == ErrorKind::Unavailable => {
+                let notes = http.get_text(&sources::github_tag_page(repo, &tag), cancel)?;
+                sources::github_pick_web(repo, &tag, &list, Some(&notes), assets, self.platform)
+            }
+            result => result,
+        }
+    }
+
    fn install_release(
        &self,
        spec: &ToolSpec,
@@ -263,6 +263,15 @@ fn curl_takes_revoke_best_effort(version: &str) -> bool {
    (major, minor) >= (7, 70) && first.split_whitespace().any(|w| w.eq_ignore_ascii_case("schannel"))
 }

+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Request {
+    Get,
+    /// Adoptium uses 404 as well as an empty array for absent platform builds.
+    GetOrEmptyOn404,
+    /// Headers, then the URL redirects ended at.
+    Head,
+}
+
 /// HTTP via the system `curl` (shipped with macOS, Windows 10+ and every
 /// mainstream Linux), so the IDE carries no TLS stack of its own.
 pub struct Http {
@@ -336,26 +345,39 @@ impl Http {
        self.get_text_limited(url, None, cancel)
    }

+    /// Where `url` ends up after redirects (a HEAD request).
+    pub fn effective_url(&self, url: &str, cancel: &CancellationToken) -> IdeResult<String> {
+        let out = self.get_text_response(url, None, Request::Head, cancel)?;
+        Ok(out.trim_end().rsplit('\n').next().unwrap_or_default().trim().to_owned())
+    }
+
    /// GETs `url` as text, failing when the response is larger than `max_bytes`.
    pub fn get_text_limited(&self, url: &str, max_bytes: Option<u64>, cancel: &CancellationToken) -> IdeResult<String> {
-        self.get_text_response(url, max_bytes, false, cancel)
+        self.get_text_response(url, max_bytes, Request::Get, cancel)
    }

    /// Adoptium uses 404 as well as an empty array for absent platform builds.
    pub fn get_text_or_empty_on_404(&self, url: &str, cancel: &CancellationToken) -> IdeResult<String> {
-        self.get_text_response(url, None, true, cancel)
+        self.get_text_response(url, None, Request::GetOrEmptyOn404, cancel)
    }

    fn get_text_response(
        &self,
        url: &str,
        max_bytes: Option<u64>,
-        empty_on_404: bool,
+        request: Request,
        cancel: &CancellationToken,
    ) -> IdeResult<String> {
        let (mut cmd, token) = self.base(url, cancel)?;
-        if empty_on_404 {
-            cmd.args(["--write-out", "\n%{http_code}"]);
+        let empty_on_404 = request == Request::GetOrEmptyOn404;
+        match request {
+            Request::Get => {}
+            Request::GetOrEmptyOn404 => {
+                cmd.args(["--write-out", "\n%{http_code}"]);
+            }
+            Request::Head => {
+                cmd.args(["--head", "--write-out", "\n%{url_effective}"]);
+            }
        }
        if let Some(max) = max_bytes {
            cmd.arg("--max-filesize").arg(max.to_string());
@@ -646,12 +646,13 @@ pub static TOOLS: &[ToolSpec] = &[
        // Equinox removed getModuleClassLoader(boolean), breaking lombok.config lookup (lombok#4059);
        // ECJ 3.46.200 keeps the constructor call in a constructor's statements, which
        // @SneakyThrows / @NonNull must not wrap or precede (lombok#4089).
-        // Return to Maven Central once an official release includes both.
+        // Builders on compact record constructors need the patch in java/lombok/patches.
+        // Return to Maven Central once an official release includes all of these fixes.
        // Source commit, build instructions and checksum: java/lombok/README.md.
        method: Method::Bundled {
-            filename: "lombok-1.18.48-openidea.2.jar",
-            version: "1.18.48-openidea.2",
-            bytes: include_bytes!("../../../java/lombok/lombok-1.18.48-openidea.2.jar"),
+            filename: "lombok-1.18.48-openidea.3.jar",
+            version: "1.18.48-openidea.3",
+            bytes: include_bytes!("../../../java/lombok/lombok-1.18.48-openidea.3.jar"),
        },
        fallback: None,
        version: V,
@@ -47,38 +47,146 @@ pub fn github_latest_url(repo: &str) -> String {
    format!("https://api.github.com/repos/{repo}/releases/latest")
 }

+/// The latest release's web page; it redirects to `…/releases/tag/<tag>`. Web pages don't
+/// count against the API's rate limit for unauthenticated clients (60 requests an hour).
+pub fn github_latest_page(repo: &str) -> String {
+    format!("https://github.com/{repo}/releases/latest")
+}
+
+/// The tag `github_latest_page` redirected to.
+pub fn github_tag_from_url(url: &str) -> Option<String> {
+    let (_, tag) = url.split_once("/releases/tag/")?;
+    let tag = tag.split(['?', '#']).next().unwrap_or(tag).trim_end_matches('/');
+    (!tag.is_empty()).then(|| percent_decode(tag))
+}
+
+pub fn github_tag_page(repo: &str, tag: &str) -> String {
+    format!("https://github.com/{repo}/releases/tag/{tag}")
+}
+
+/// The asset list the release page loads (HTML).
+pub fn github_assets_page(repo: &str, tag: &str) -> String {
+    format!("https://github.com/{repo}/releases/expanded_assets/{tag}")
+}
+
+/// One file of a release, from the API or its web page.
+struct ReleaseAsset {
+    name: String,
+    url: String,
+    size: Option<u64>,
+    sha256: Option<String>,
+}
+
 /// Picks the platform asset from a GitHub `releases/latest` response. Links
 /// in the release notes count as assets too (some projects host binaries on
 /// a CDN and only link them).
 pub fn github_pick(json: &str, rules: &[AssetRule], platform: Platform) -> IdeResult<Download> {
    let rel: GhRelease = serde_json::from_str(json).map_err(|e| proto(format!("unexpected GitHub response: {e}")))?;
-    let version = rel.tag_name.trim_start_matches('v').to_string();
-    let names: Vec<&str> = rel.assets.iter().map(|a| a.name.as_str()).collect();
+    let assets: Vec<ReleaseAsset> = rel
+        .assets
+        .into_iter()
+        .map(|a| ReleaseAsset {
+            sha256: a.digest.as_deref().and_then(|d| d.strip_prefix("sha256:")).map(str::to_ascii_lowercase),
+            name: a.name,
+            url: a.browser_download_url,
+            size: a.size,
+        })
+        .collect();
+    pick_release(&rel.tag_name, &assets, rel.body.as_deref().unwrap_or(""), rules, platform)
+}
+
+/// [`github_pick`] from the release's web pages: `assets_html` from [`github_assets_page`] and,
+/// for projects that only link their builds, `notes_html` from [`github_tag_page`].
+pub fn github_pick_web(
+    repo: &str,
+    tag: &str,
+    assets_html: &str,
+    notes_html: Option<&str>,
+    rules: &[AssetRule],
+    platform: Platform,
+) -> IdeResult<Download> {
+    let prefix = format!("href=\"/{repo}/releases/download/");
+    let mut assets: Vec<ReleaseAsset> = Vec::new();
+    let mut rest = assets_html;
+    while let Some(i) = rest.find(&prefix) {
+        let tail = &rest[i + "href=\"".len()..];
+        let Some(end) = tail.find('"') else { break };
+        let path = html_unescape(&tail[..end]);
+        rest = &tail[end..];
+        let name = percent_decode(file_name(&path));
+        if name.is_empty() || assets.iter().any(|a| a.name == name) {
+            continue;
+        }
+        // `<clipboard-copy aria-label="Copy to clipboard digest for <name>" … value="sha256:<hex>">`
+        let sha256 = assets_html.find(&format!("digest for {}\"", html_escape(&name))).and_then(|at| {
+            let tag_end = assets_html[at..].find('>').map_or(assets_html.len(), |e| at + e);
+            let value = assets_html[at..tag_end].split_once("value=\"sha256:")?.1;
+            let hex: String = value.chars().take_while(char::is_ascii_hexdigit).collect();
+            (hex.len() == 64).then(|| hex.to_ascii_lowercase())
+        });
+        assets.push(ReleaseAsset { url: format!("https://github.com{path}"), name, size: None, sha256 });
+    }
+    pick_release(tag, &assets, &html_unescape(notes_html.unwrap_or("")), rules, platform)
+}
+
+fn pick_release(
+    tag: &str,
+    assets: &[ReleaseAsset],
+    notes: &str,
+    rules: &[AssetRule],
+    platform: Platform,
+) -> IdeResult<Download> {
+    let version = tag.trim_start_matches('v').to_string();
+    let names: Vec<&str> = assets.iter().map(|a| a.name.as_str()).collect();
    if let Some(name) = select_asset(&names, rules, platform) {
-        let a = rel.assets.iter().find(|a| a.name == name).expect("selected from list");
-        let sha256 = a.digest.as_deref().and_then(|d| d.strip_prefix("sha256:")).map(str::to_ascii_lowercase);
-        let checksum_url = rel
-            .assets
+        let a = assets.iter().find(|a| a.name == name).expect("selected from list");
+        let checksum_url = assets
            .iter()
            .find(|c| c.name == format!("{name}.sha256") || c.name == format!("{name}.sha256sum"))
-            .map(|c| c.browser_download_url.clone());
+            .map(|c| c.url.clone());
        return Ok(Download {
            version,
            name: a.name.clone(),
-            url: a.browser_download_url.clone(),
+            url: a.url.clone(),
            size: a.size,
-            sha256,
+            sha256: a.sha256.clone(),
            checksum_url,
        });
    }
-    let links = extract_links(rel.body.as_deref().unwrap_or(""));
+    let links = extract_links(notes);
    let link_names: Vec<&str> = links.iter().map(|u| file_name(u)).collect();
    if let Some(name) = select_asset(&link_names, rules, platform) {
        let url = links.iter().find(|u| file_name(u) == name).expect("selected from list").clone();
        let checksum_url = links.iter().find(|u| *u == &format!("{url}.sha256")).cloned();
        return Ok(Download { version, name: name.to_string(), url, size: None, sha256: None, checksum_url });
    }
-    Err(IdeError::unavailable(format!("release {} has no build for this platform", rel.tag_name)))
+    Err(IdeError::unavailable(format!("release {tag} has no build for this platform")))
+}
+
+fn html_unescape(s: &str) -> String {
+    s.replace("&quot;", "\"").replace("&#39;", "'").replace("&lt;", "<").replace("&gt;", ">").replace("&amp;", "&")
+}
+
+fn html_escape(s: &str) -> String {
+    s.replace('&', "&amp;").replace('"', "&quot;").replace('<', "&lt;").replace('>', "&gt;")
+}
+
+fn percent_decode(s: &str) -> String {
+    let bytes = s.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%'
+            && let Some(b) = s.get(i + 1..i + 3).and_then(|h| u8::from_str_radix(h, 16).ok())
+        {
+            out.push(b);
+            i += 3;
+        } else {
+            out.push(bytes[i]);
+            i += 1;
+        }
+    }
+    String::from_utf8(out).unwrap_or_else(|_| s.to_owned())
 }

 fn file_name(url: &str) -> &str {
@@ -336,6 +444,71 @@ mod tests {
        assert_eq!(d.name, "kotlin-lsp-0.253.10629-linux-x64.zip");
    }

+    #[test]
+    fn github_tag_from_redirect() {
+        let url = "https://github.com/Kotlin/kotlin-lsp/releases/tag/kotlin-lsp/v263.7084.0";
+        assert_eq!(github_tag_from_url(url).as_deref(), Some("kotlin-lsp/v263.7084.0"));
+        let url = "https://github.com/o/r/releases/tag/v1.0%2Bbuild";
+        assert_eq!(github_tag_from_url(url).as_deref(), Some("v1.0+build"));
+        // A repository without releases stays on the list.
+        assert_eq!(github_tag_from_url("https://github.com/o/r/releases"), None);
+    }
+
+    /// Trimmed from `github.com/<repo>/releases/expanded_assets/<tag>`.
+    const ASSETS_HTML: &str = r#"<li><div><a href="/LuaLS/lua-language-server/releases/download/3.13.5/lua-language-server-3.13.5-darwin-arm64.tar.gz" rel="nofollow" data-turbo="false" class="wb-break-all">
+          <span class="text-bold">lua-language-server-3.13.5-darwin-arm64.tar.gz</span></a></div>
+        <span class="Truncate-text">sha256:ABCDEF0123456789abcdef0123456789abcdef0123456789abcdef0123456789</span>
+        <clipboard-copy id="clipboard-button-sha256:abc" aria-label="Copy to clipboard digest for lua-language-server-3.13.5-darwin-arm64.tar.gz" type="button" value="sha256:ABCDEF0123456789abcdef0123456789abcdef0123456789abcdef0123456789" class="Button"></clipboard-copy></li>
+      <li><a href="/LuaLS/lua-language-server/releases/download/3.13.5/lua-language-server-3.13.5-linux-x64.tar.gz" rel="nofollow">lua-language-server-3.13.5-linux-x64.tar.gz</a></li>
+      <li><a href="/LuaLS/lua-language-server/archive/refs/tags/3.13.5.zip" rel="nofollow">Source code (zip)</a></li>"#;
+
+    #[test]
+    fn github_web_assets_with_digest() {
+        let rules = find("lua-language-server").unwrap().asset_rules();
+        let d = github_pick_web("LuaLS/lua-language-server", "3.13.5", ASSETS_HTML, None, rules, MAC_ARM).unwrap();
+        assert_eq!(d.version, "3.13.5");
+        assert_eq!(d.name, "lua-language-server-3.13.5-darwin-arm64.tar.gz");
+        assert_eq!(
+            d.url,
+            "https://github.com/LuaLS/lua-language-server/releases/download/3.13.5/lua-language-server-3.13.5-darwin-arm64.tar.gz"
+        );
+        assert_eq!(d.sha256.as_deref(), Some("abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"));
+        let d = github_pick_web("LuaLS/lua-language-server", "3.13.5", ASSETS_HTML, None, rules, LINUX).unwrap();
+        assert_eq!(d.sha256, None);
+        let win = Platform { os: Os::Windows, arch: Arch::X64 };
+        let err = github_pick_web("LuaLS/lua-language-server", "3.13.5", ASSETS_HTML, None, rules, win).unwrap_err();
+        assert_eq!(err.kind, ErrorKind::Unavailable);
+    }
+
+    #[test]
+    fn github_web_sibling_checksum_and_notes_links() {
+        let html = r#"<a href="/artempyanykh/marksman/releases/download/2024-12-18/marksman-macos" rel="nofollow">
+            <a href="/artempyanykh/marksman/releases/download/2024-12-18/marksman-macos.sha256" rel="nofollow">"#;
+        let d = github_pick_web(
+            "artempyanykh/marksman",
+            "2024-12-18",
+            html,
+            None,
+            find("marksman").unwrap().asset_rules(),
+            MAC_ARM,
+        )
+        .unwrap();
+        assert_eq!(
+            d.checksum_url.as_deref(),
+            Some("https://github.com/artempyanykh/marksman/releases/download/2024-12-18/marksman-macos.sha256")
+        );
+
+        let notes = r#"<li><a href="https://download-cdn.jetbrains.com/kotlin-lsp/0.253.10629/kotlin-lsp-0.253.10629-mac-aarch64.zip?a=1&amp;b=2" rel="nofollow">macOS arm</a></li>"#;
+        let rules = find("kotlin-lsp").unwrap().asset_rules();
+        let d =
+            github_pick_web("Kotlin/kotlin-lsp", "kotlin-lsp/v0.253.10629", "", Some(notes), rules, MAC_ARM).unwrap();
+        assert_eq!(d.name, "kotlin-lsp-0.253.10629-mac-aarch64.zip");
+        assert_eq!(
+            d.url,
+            "https://download-cdn.jetbrains.com/kotlin-lsp/0.253.10629/kotlin-lsp-0.253.10629-mac-aarch64.zip?a=1&b=2"
+        );
+    }
+
    #[test]
    fn hashicorp() {
        let json = r#"{"version":"0.36.4","url_shasums":"https://r/terraform-ls_0.36.4_SHA256SUMS","builds":[
@@ -58,16 +58,20 @@ fn bundled_lombok_replaces_legacy_installs_on_every_platform_without_downloads()
            fs::create_dir_all(legacy.parent().unwrap()).unwrap();
            fs::write(&legacy, b"old official agent").unwrap();
            fs::write(env.root.join("lombok").join(MANIFEST), r#"{"version":"1.18.48"}"#).unwrap();
+            let previous = env.root.join("lombok/bin/lombok-1.18.48-openidea.2.jar");
+            fs::write(&previous, b"previous bundled agent").unwrap();
            let tools = Tools::with_paths(env.root.clone(), OsString::new(), Platform { os, arch });
            let info = tools.info("lombok", &[]).unwrap();
            let path = managed_bundle(env.root.parent().unwrap(), "lombok").unwrap();
            assert_eq!(info.status, ToolStatus::Installed);
-            assert_eq!(info.version.as_deref(), Some("1.18.48-openidea.2"));
+            assert_eq!(info.version.as_deref(), Some("1.18.48-openidea.3"));
            assert_eq!(info.path, Some(path.clone().into()));
-            assert_eq!(path.file_name().unwrap(), "lombok-1.18.48-openidea.2.jar");
+            assert_eq!(path.file_name().unwrap(), "lombok-1.18.48-openidea.3.jar");
            assert!(!info.can_install && !info.can_uninstall);
            assert_eq!(tools.unavailable_reason(registry::find("lombok").unwrap()), None);
            assert_eq!(fs::read(&legacy).unwrap(), b"old official agent", "other windows may still use it");
+            assert_ne!(path, previous, "new agent path must invalidate the JDT LS workspace");
+            assert_eq!(fs::read(&previous).unwrap(), b"previous bundled agent", "other windows may still use it");
        }
    }
 }
@@ -93,6 +93,131 @@ fn git_select(
    Ok(ids)
 }

+/// The commits of a file's history and the path it had in each. The commits that changed
+/// the path, merges included (`--full-history --simplify-merges`); where it appears, a
+/// rename from any parent continues the history under the old path from that parent.
+/// Unlike `--follow`, this sees renames done in merges and history merged in from other
+/// branches.
+fn file_history(
+    r: &Repo,
+    scopes: &[String],
+    rel: &str,
+    first_parent: bool,
+    cancel: &CancellationToken,
+) -> IdeResult<(HashSet<ObjectId>, HashMap<ObjectId, String>)> {
+    let mut ids = HashSet::new();
+    let mut paths = HashMap::new();
+    let mut starts: std::collections::VecDeque<(Vec<String>, String)> =
+        scopes.iter().map(|s| (s.split_whitespace().map(str::to_string).collect(), rel.to_string())).collect();
+    let mut started = HashSet::new();
+    while let Some((revs, path)) = starts.pop_front() {
+        if !started.insert((revs.clone(), path.clone())) {
+            continue;
+        }
+        let mut args: Vec<String> =
+            ["log", "--format=%x00%H", "--name-status", "-z", "--full-history", "--simplify-merges", "--no-follow"]
+                .map(String::from)
+                .into();
+        if first_parent {
+            args.push("--first-parent".into());
+        }
+        args.push("--end-of-options".into());
+        args.extend(revs);
+        let pathspec = ["--".to_string(), format!(":(literal){path}")];
+        let run = |args: &[String]| -> IdeResult<Vec<(ObjectId, Option<char>)>> {
+            let argv: Vec<&str> = args.iter().chain(&pathspec).map(String::as_str).collect();
+            Ok(parse_name_status_log(&crate::cli::run_cancellable(r.root(), &argv, cancel)?.stdout_str()))
+        };
+        let records = run(&args)?;
+        // Where the file appears its history ends: what is behind that is another file of
+        // the same name (a rename continues the history below). The commits of the history
+        // are those not behind a creation; the statuses come from the full listing (with
+        // its parents excluded a merge shows no changes).
+        let created: Vec<ObjectId> = records.iter().filter(|(_, s)| *s == Some('A')).map(|(id, _)| *id).collect();
+        let kept: Option<HashSet<ObjectId>> = if created.is_empty() {
+            None
+        } else {
+            args.extend(created.iter().map(|id| format!("^{id}^@")));
+            Some(run(&args)?.into_iter().map(|(id, _)| id).collect())
+        };
+        let mut created = Vec::new();
+        for (id, first_status) in records {
+            if kept.as_ref().is_some_and(|k| !k.contains(&id)) || !ids.insert(id) {
+                continue;
+            }
+            paths.insert(id, path.clone());
+            if first_status == Some('A') {
+                created.push(id);
+            }
+        }
+        for commit in created {
+            let line = crate::cli::run_cancellable(
+                r.root(),
+                &["rev-list", "--parents", "-n", "1", "--end-of-options", &commit.to_string()],
+                cancel,
+            )?
+            .stdout_str();
+            let parents: Vec<&str> =
+                line.split_whitespace().skip(1).take(if first_parent { 1 } else { usize::MAX }).collect();
+            for parent in parents {
+                if let Some(old) = renamed_from(r, parent, &commit.to_string(), &path, cancel)? {
+                    starts.push_back((vec![parent.to_string()], old));
+                }
+            }
+        }
+    }
+    Ok((ids, paths))
+}
+
+/// `git log --format=%x00%H --name-status -z`: each commit with the status letter of its
+/// first change (none for a merge listed without changes).
+fn parse_name_status_log(text: &str) -> Vec<(ObjectId, Option<char>)> {
+    let mut out: Vec<(ObjectId, Option<char>)> = Vec::new();
+    let mut tokens = text.split('\0');
+    while let Some(token) = tokens.next() {
+        let token = token.trim_start_matches('\n');
+        if let Ok(id) = ObjectId::from_hex(token.as_bytes()) {
+            out.push((id, None));
+            continue;
+        }
+        let Some(status) = token.chars().next().filter(|c| c.is_ascii_uppercase()) else { continue };
+        if !token[1..].bytes().all(|b| b.is_ascii_digit()) {
+            continue;
+        }
+        let paths = if matches!(status, 'R' | 'C') { 2 } else { 1 };
+        for _ in 0..paths {
+            tokens.next();
+        }
+        if let Some(last) = out.last_mut() {
+            last.1.get_or_insert(status);
+        }
+    }
+    out
+}
+
+/// The path `path` had in `parent` when `commit` renamed it.
+fn renamed_from(
+    r: &Repo,
+    parent: &str,
+    commit: &str,
+    path: &str,
+    cancel: &CancellationToken,
+) -> IdeResult<Option<String>> {
+    let args = ["diff", "-M", "--name-status", "-z", "--diff-filter=R", "--no-ext-diff", parent, commit, "--"];
+    let text = crate::cli::run_cancellable(r.root(), &args, cancel)?.stdout_str();
+    let mut tokens = text.split('\0');
+    while let Some(status) = tokens.next() {
+        if !status.starts_with('R') {
+            continue;
+        }
+        let (Some(old), Some(new)) = (tokens.next(), tokens.next()) else { break };
+        if new == path {
+            return Ok(Some(old.to_string()));
+        }
+    }
+    Ok(None)
+}
+
 pub(crate) fn log(r: &Repo, q: &LogQuery, cancel: &CancellationToken) -> IdeResult<Vec<Commit>> {
    if cancel.is_cancelled() {
        return Err(IdeError::cancelled());
@@ -230,45 +355,8 @@ fn log_indexed(
    let path_ids = if paths.is_empty() {
        None
    } else if q.follow && paths.len() == 1 {
-        let mut ids = HashSet::new();
-        let rel = &paths[0];
-        let mut args = vec![
-            "log".to_string(),
-            "--format=%x00%H".into(),
-            "--name-status".into(),
-            "-z".into(),
-            "--follow".into(),
-            "--topo-order".into(),
-        ];
-        if q.first_parent {
-            args.push("--first-parent".into());
-        }
-        args.push("--end-of-options".into());
-        for scope in &scopes {
-            let mut args = args.clone();
-            args.extend(scope.split_whitespace().map(str::to_string));
-            args.extend(["--".into(), rel.clone()]);
-            let output =
-                crate::cli::run_cancellable(r.root(), &args.iter().map(String::as_str).collect::<Vec<_>>(), cancel)?;
-            let text = output.stdout_str();
-            let mut tokens = text.split('\0').peekable();
-            let mut current_path = rel.clone();
-            while let Some(token) = tokens.next() {
-                let token = token.trim_start_matches('\n');
-                if let Ok(id) = ObjectId::from_hex(token.as_bytes()) {
-                    ids.insert(id);
-                    history_paths.insert(id, current_path.clone());
-                } else if token.starts_with('R') && token[1..].bytes().all(|b| b.is_ascii_digit()) {
-                    if let (Some(old), Some(new)) = (tokens.next(), tokens.next())
-                        && new == current_path
-                    {
-                        current_path = old.to_string();
-                    }
-                } else if ["A", "D", "M", "T", "U"].contains(&token) {
-                    tokens.next();
-                }
-            }
-        }
+        let (ids, at) = file_history(r, &scopes, &paths[0], q.first_parent, cancel)?;
+        history_paths = at;
        Some(ids)
    } else {
        Some(git_select(r, &scopes, &[], &paths, q.first_parent, cancel)?)
@@ -273,6 +273,12 @@ pub struct CommitOptions {
    /// entries of the index change; afterwards their index entries match the new commit.
    #[serde(default)]
    pub partial: Vec<PartialCommitFile>,
+    /// Files committed with their working-tree content, staged or not.
+    #[serde(default)]
+    pub stage: Vec<ide_core::IpcPath>,
+    /// Staged files left out of the commit; they stay staged afterwards.
+    #[serde(default)]
+    pub exclude: Vec<ide_core::IpcPath>,
 }

 /// A file of a partial commit: which of its changes against HEAD to commit.
@@ -356,6 +362,27 @@ pub struct PushBranchOptions<'a> {
    pub remote: Option<&'a str>,
    /// `git push --force-with-lease`.
    pub force_with_lease: bool,
+    /// `git push --force` (Force push anyway after a rejected force-with-lease push).
+    pub force: bool,
+    /// Record the target as the branch's upstream even when it already has one.
+    pub set_upstream: bool,
+    /// Skip the pre-push hook (`--no-verify`).
+    pub no_verify: bool,
+}
+
+/// Options of [`Repo::push_with`]: the Push dialog's choices for the current branch.
+#[derive(Clone, Copy, Debug, Default)]
+pub struct PushOptions {
+    /// `git push --force-with-lease`.
+    pub force_with_lease: bool,
+    /// `git push --force` (Force push anyway after a rejected force-with-lease push).
+    pub force: bool,
+    /// Push to the branch's remote under the same name and record it as upstream.
+    pub set_upstream: bool,
+    /// Push tags too.
+    pub tags: Option<PushTags>,
+    /// Skip the pre-push hook (`--no-verify`).
+    pub no_verify: bool,
 }

 /// What an interactive rebase does with one commit.
@@ -480,6 +507,10 @@ pub enum CheckoutOutcome {
    LocalChanges {
        files: Vec<String>,
    },
+    /// These untracked files (repository-relative paths) would be overwritten.
+    UntrackedFiles {
+        files: Vec<String>,
+    },
    /// Local branch `local` has commits that remote branch `remote` does not.
    LocalBranchAhead {
        local: String,
@@ -492,6 +523,14 @@ pub enum CheckoutOutcome {
    },
 }

+/// HEAD before and after a history rewrite, for its Undo.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct HeadChange {
+    pub before: String,
+    pub after: String,
+}
+
 /// A deleted local branch, enough to restore it (IDEA's "Restore" notification action).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
@@ -505,6 +544,15 @@ pub struct DeletedBranch {
    pub unmerged: bool,
 }

+/// A deleted tag, enough to restore it (Restore in the tag-deleted notification).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct DeletedTag {
+    pub name: String,
+    /// What the tag pointed at: its tag object (annotated tags) or commit.
+    pub target: String,
+}
+
 /// Who stands on each side of the conflicts of the operation in progress (merge editor
 /// titles, as IDEA labels them).
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize, Type)]
@@ -575,6 +623,8 @@ mod log_index;
 mod manage;
 mod ops;
 mod patch;
+mod preserve;
+pub use ops::UNSTAGED_CHANGES_PREVENT_REBASE;
 mod refs;
 mod remotes;
 mod repo;
@@ -1006,7 +1056,7 @@ impl Repo {
    /// `amend` keeps the previous message.
    pub fn commit(&self, message: &str, amend: bool, sign_off: bool) -> IdeResult<String> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
-        let options = CommitOptions { amend, sign_off, author: None, run_hooks: true, partial: Vec::new() };
+        let options = CommitOptions { amend, sign_off, author: None, run_hooks: true, ..Default::default() };
        write::commit(self, message, &options, &|_| Ok(encoding_rs::UTF_8.into()))
    }
    /// Commits with the Commit Options popup's choices.
@@ -1048,6 +1098,17 @@ impl Repo {
        write::undo_commit(self, commit)
    }
    /// Deletes a local branch (`git branch -d`, `-D` when `force`).
+    /// Edit Commit Message without touching the index or the working tree; returns HEAD
+    /// before and after.
+    pub fn reword(&self, commit: &str, message: &str) -> IdeResult<HeadChange> {
+        write::reword(self, commit, message).map(|(before, after)| HeadChange { before, after })
+    }
+
+    /// Undoes a history rewrite: HEAD goes from `after` back to `before`, local changes kept.
+    pub fn restore_head(&self, before: &str, after: &str) -> IdeResult<()> {
+        write::restore_head(self, before, after)
+    }
+
    pub fn delete_branch(&self, branch: &str, force: bool) -> IdeResult<()> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        write::delete_branch(self, branch, force)
@@ -1124,9 +1185,11 @@ impl Repo {
    pub fn pull(&self, rebase: bool, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        let mode: &[&str] = if rebase { &["--rebase"] } else { &["--no-rebase", "--ff"] };
-        let mut args = vec!["pull", "--progress", "--autostash"];
+        let mut args = vec!["pull", "--progress"];
        args.extend_from_slice(mode);
-        cli::run_streaming(&self.root, &args, cancel, on_output)
+        preserve::around(self, "Local changes saved before update", || {
+            cli::run_streaming(&self.root, &args, cancel, on_output)
+        })
    }
    /// Pushes the current branch. `set_upstream` pushes to the branch's remote (or
    /// `origin`) under the same name and records it as upstream.
@@ -1137,8 +1200,7 @@ impl Repo {
        cancel: &CancellationToken,
        on_output: &dyn Fn(String),
    ) -> IdeResult<()> {
-        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
-        write::push(self, force_with_lease, set_upstream, None, cancel, on_output)
+        self.push_with(PushOptions { force_with_lease, set_upstream, ..Default::default() }, cancel, on_output)
    }
    /// [`Repo::push`] that also pushes tags (Push dialog › Push tags).
    pub fn push_with_tags(
@@ -1148,9 +1210,23 @@ impl Repo {
        tags: Option<PushTags>,
        cancel: &CancellationToken,
        on_output: &dyn Fn(String),
+    ) -> IdeResult<()> {
+        self.push_with(PushOptions { force_with_lease, set_upstream, tags, ..Default::default() }, cancel, on_output)
+    }
+    /// Pushes the current branch with the Push dialog's options.
+    pub fn push_with(
+        &self,
+        options: PushOptions,
+        cancel: &CancellationToken,
+        on_output: &dyn Fn(String),
    ) -> IdeResult<()> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
-        write::push(self, force_with_lease, set_upstream, tags, cancel, on_output)
+        write::push(self, options, cancel, on_output)
+    }
+    /// Whether the repository has an executable hook `name` (e.g. `pre-push`), wherever
+    /// `core.hooksPath` puts it: the Push dialog then offers to skip it.
+    pub fn has_hook(&self, name: &str) -> IdeResult<bool> {
+        write::has_hook(self, name)
    }
    /// Pushes a local branch, or its history up to `revision`, to its upstream (Git Log
    /// › Push…, Push All up to Here).
@@ -1184,6 +1260,12 @@ impl Repo {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        write::push_branch(self, branch, options, cancel, on_output)
    }
+    /// Update Project › Reset to the Remote Branch: the current branch is moved to its
+    /// freshly fetched tracked branch; local commits are dropped, local changes kept.
+    pub fn reset_to_upstream(&self, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        write::reset_to_upstream(self, cancel, on_output)
+    }
    /// Fast-forwards a local branch that is not checked out to its upstream (Branches ›
    /// Update). Fails when the branch has diverged.
    pub fn update_branch(&self, branch: &str, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
@@ -1196,7 +1278,12 @@ impl Repo {
    /// conflicts are unresolved.
    pub fn continue_operation(&self, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
-        ops::continue_op(self, cancel, on_output)
+        ops::continue_op(self, false, cancel, on_output)
+    }
+    /// Stage and Retry: stages the changes of tracked files, then continues.
+    pub fn stage_and_continue(&self, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        ops::continue_op(self, true, cancel, on_output)
    }
    pub fn abort_operation(&self, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
@@ -1213,9 +1300,19 @@ impl Repo {
        commits: &[String],
        cancel: &CancellationToken,
        on_output: &dyn Fn(String),
+    ) -> IdeResult<()> {
+        self.cherry_pick_with(commits, false, cancel, on_output)
+    }
+    /// [`Repo::cherry_pick`]; `record_origin` adds "(cherry picked from commit …)" (`-x`).
+    pub fn cherry_pick_with(
+        &self,
+        commits: &[String],
+        record_origin: bool,
+        cancel: &CancellationToken,
+        on_output: &dyn Fn(String),
    ) -> IdeResult<()> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
-        ops::cherry_pick(self, commits, cancel, on_output)
+        ops::cherry_pick(self, commits, record_origin, cancel, on_output)
    }
    /// Reverts `commits` in order (newest first) with git's default messages.
    pub fn revert(&self, commits: &[String], cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
@@ -1251,6 +1348,38 @@ impl Repo {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        ops::create_tag(self, name, commit, message, force)
    }
+    /// Deletes a local tag, returning what [`Repo::restore_tag`] needs to undo it.
+    pub fn delete_tag(&self, name: &str) -> IdeResult<DeletedTag> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        ops::delete_tag(self, name)
+    }
+    /// Recreates a deleted tag (annotated ones with their message).
+    pub fn restore_tag(&self, deleted: &DeletedTag) -> IdeResult<()> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        ops::restore_tag(self, deleted)
+    }
+    /// Pushes one tag to `remote` (Push Tag › Push to …).
+    pub fn push_tag(
+        &self,
+        tag: &str,
+        remote: &str,
+        cancel: &CancellationToken,
+        on_output: &dyn Fn(String),
+    ) -> IdeResult<()> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        ops::push_tag(self, tag, remote, false, cancel, on_output)
+    }
+    /// Deletes a tag on `remote` (Delete on Remote, after deleting it locally).
+    pub fn delete_remote_tag(
+        &self,
+        tag: &str,
+        remote: &str,
+        cancel: &CancellationToken,
+        on_output: &dyn Fn(String),
+    ) -> IdeResult<()> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        ops::push_tag(self, tag, remote, true, cancel, on_output)
+    }
    pub fn tags(&self) -> IdeResult<Vec<String>> {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        ops::tags(self)
@@ -106,7 +106,7 @@ pub(crate) fn merge_args(branches: &[String], o: &MergeOptions) -> IdeResult<Vec
    if branches.is_empty() {
        return Err(IdeError::invalid("no branch to merge"));
    }
-    let mut args: Vec<String> = vec!["merge".into(), "--autostash".into()];
+    let mut args: Vec<String> = vec!["merge".into()];
    args.extend(merge_flags(o)?.into_iter().map(String::from));
    match o.message.as_deref().map(str::trim).filter(|m| !m.is_empty()) {
        Some(m) => args.extend(["-m".into(), m.to_string()]),
@@ -120,7 +120,7 @@ pub(crate) fn merge_args(branches: &[String], o: &MergeOptions) -> IdeResult<Vec

 /// `git rebase` arguments for the Rebase dialog.
 pub(crate) fn rebase_args(upstream: &str, o: &RebaseOptions) -> IdeResult<Vec<String>> {
-    let mut args: Vec<String> = vec!["rebase".into(), "--autostash".into()];
+    let mut args: Vec<String> = vec!["rebase".into()];
    if o.rebase_merges {
        args.push("--rebase-merges".into());
    }
@@ -137,7 +137,7 @@ pub(crate) fn rebase_args(upstream: &str, o: &RebaseOptions) -> IdeResult<Vec<St
 /// `git pull` arguments for the Pull dialog: `remote` and its `branches` (none = the
 /// upstream's configured merge branch).
 pub(crate) fn pull_args(remote: &str, branches: &[String], rebase: bool, o: &MergeOptions) -> IdeResult<Vec<String>> {
-    let mut args: Vec<String> = vec!["pull".into(), "--progress".into(), "--autostash".into()];
+    let mut args: Vec<String> = vec!["pull".into(), "--progress".into()];
    if rebase {
        if o.no_ff || o.ff_only || o.squash || o.no_commit {
            return Err(IdeError::invalid("--rebase cannot be combined with merge options"));
@@ -213,7 +213,7 @@ impl Repo {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        let args = merge_args(branches, options)?;
        let args: Vec<&str> = args.iter().map(String::as_str).collect();
-        run(self.root(), &args, None).map(|_| ())
+        crate::preserve::around(self, "Local changes saved before merge", || run(self.root(), &args, None).map(|_| ()))
    }

    /// Rebases the current branch onto `upstream` (or `upstream..HEAD` onto `options.onto`).
@@ -221,7 +221,7 @@ impl Repo {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        let args = rebase_args(upstream, options)?;
        let args: Vec<&str> = args.iter().map(String::as_str).collect();
-        run(self.root(), &args, None).map(|_| ())
+        crate::preserve::around(self, "Local changes saved before rebase", || run(self.root(), &args, None).map(|_| ()))
    }

    /// Git › Pull…: pulls `branches` of `remote` into the current branch.
@@ -237,7 +237,9 @@ impl Repo {
        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
        let args = pull_args(remote, branches, rebase, options)?;
        let args: Vec<&str> = args.iter().map(String::as_str).collect();
-        cli::run_streaming(self.root(), &args, cancel, on_output)
+        crate::preserve::around(self, "Local changes saved before update", || {
+            cli::run_streaming(self.root(), &args, cancel, on_output)
+        })
    }

    /// Manage Remotes: adds, removes or edits a remote.
@@ -305,13 +307,10 @@ mod tests {
    #[test]
    fn merge_args_follow_the_options() {
        let o = MergeOptions { no_ff: true, message: Some("Merge it".into()), ..Default::default() };
-        assert_eq!(
-            merge_args(&["dev".into()], &o).unwrap(),
-            ["merge", "--autostash", "--no-ff", "-m", "Merge it", "dev"]
-        );
+        assert_eq!(merge_args(&["dev".into()], &o).unwrap(), ["merge", "--no-ff", "-m", "Merge it", "dev"]);
        assert_eq!(
            merge_args(&["a".into(), "b".into()], &MergeOptions::default()).unwrap(),
-            ["merge", "--autostash", "--no-edit", "a", "b"]
+            ["merge", "--no-edit", "a", "b"]
        );
        let bad = MergeOptions { ff_only: true, squash: true, ..Default::default() };
        assert!(merge_args(&["dev".into()], &bad).is_err());
@@ -322,18 +321,15 @@ mod tests {
    #[test]
    fn rebase_and_pull_args() {
        let o = RebaseOptions { onto: Some("main".into()), rebase_merges: true, keep_empty: false };
-        assert_eq!(
-            rebase_args("feature~3", &o).unwrap(),
-            ["rebase", "--autostash", "--rebase-merges", "--onto", "main", "feature~3"]
-        );
+        assert_eq!(rebase_args("feature~3", &o).unwrap(), ["rebase", "--rebase-merges", "--onto", "main", "feature~3"]);
        assert_eq!(
            pull_args("origin", &["main".into()], false, &MergeOptions { ff_only: true, ..Default::default() })
                .unwrap(),
-            ["pull", "--progress", "--autostash", "--no-rebase", "--ff-only", "origin", "main"]
+            ["pull", "--progress", "--no-rebase", "--ff-only", "origin", "main"]
        );
        assert_eq!(
            pull_args("origin", &[], true, &MergeOptions::default()).unwrap(),
-            ["pull", "--progress", "--autostash", "--rebase", "origin"]
+            ["pull", "--progress", "--rebase", "origin"]
        );
        assert!(pull_args("origin", &[], true, &MergeOptions { squash: true, ..Default::default() }).is_err());
    }
@@ -5,6 +5,7 @@ use crate::cli::{self, run};
 use crate::repo::{gx, resolve};
 use crate::{ChangeKind, ChangedFile, FileLineStats, MergeSides, RebaseAction, RebaseEntry, Repo, ResetMode};
 use ide_core::{CancellationToken, IdeError, IdeResult};
+use std::collections::HashSet;

 /// The in-progress operation git can continue / abort / skip.
 fn sequencer(r: &Repo) -> IdeResult<&'static str> {
@@ -57,7 +58,8 @@ pub(crate) fn merge_sides(r: &Repo) -> IdeResult<MergeSides> {
        Some("cherry-pick") => sides.commit = read("CHERRY_PICK_HEAD").map(short),
        Some("revert") => sides.commit = read("REVERT_HEAD").map(short),
        // Conflicts outside an operation come from restoring stashed changes (Smart
-        // Checkout, update with autostash): stage 2 is the new HEAD, stage 3 the user's.
+        // Checkout, local changes put aside for a merge or update): stage 2 is the new HEAD,
+        // stage 3 the user's.
        None if !crate::write::unmerged_paths(r)?.is_empty() => {
            sides.operation = Some("unstash".into());
            sides.reversed = true;
@@ -113,13 +115,38 @@ fn check_commits(commits: &[String]) -> IdeResult<()> {
    Ok(())
 }

+/// Why a rebase can't continue: tracked files changed while it was stopped, not staged.
+pub const UNSTAGED_CHANGES_PREVENT_REBASE: &str =
+    "There are unstaged changes in tracked files preventing rebase from continuing";
+
+fn changed_paths(r: &Repo, args: &[&str]) -> IdeResult<Vec<String>> {
+    let text = run(r.root(), args, None)?.stdout_str();
+    Ok(text.split('\0').filter(|p| !p.is_empty()).map(str::to_string).collect())
+}
+
 /// Concludes the operation in progress once every conflict is resolved (staged).
-pub(crate) fn continue_op(r: &Repo, cancel: &CancellationToken, out: &dyn Fn(String)) -> IdeResult<()> {
+/// `stage` first stages the changes of tracked files (Stage and Retry). Without it a
+/// rebase stages only edits of files already staged (made while resolving them) and
+/// otherwise fails with [`UNSTAGED_CHANGES_PREVENT_REBASE`].
+pub(crate) fn continue_op(r: &Repo, stage: bool, cancel: &CancellationToken, out: &dyn Fn(String)) -> IdeResult<()> {
    let op = sequencer(r)?;
    let unresolved = unmerged_paths(r)?;
    if !unresolved.is_empty() {
        return Err(IdeError::invalid(format!("resolve all conflicts before continuing: {}", unresolved.join(", "))));
    }
+    if stage {
+        run(r.root(), &["add", "-u"], None)?;
+    } else if op == "rebase" {
+        let unstaged = changed_paths(r, &["diff", "--name-only", "-z", "--no-ext-diff"])?;
+        if !unstaged.is_empty() {
+            let staged: HashSet<String> =
+                changed_paths(r, &["diff", "--cached", "--name-only", "-z", "--no-ext-diff"])?.into_iter().collect();
+            if !unstaged.iter().all(|p| staged.contains(p)) {
+                return Err(IdeError::invalid(UNSTAGED_CHANGES_PREVENT_REBASE));
+            }
+            cli::run_paths(r.root(), &["add", "-u"], &unstaged)?;
+        }
+    }
    let args: &[&str] = match op {
        // `git merge --continue` commits with the prepared MERGE_MSG.
        "merge" => &["merge", "--continue"],
@@ -128,12 +155,16 @@ pub(crate) fn continue_op(r: &Repo, cancel: &CancellationToken, out: &dyn Fn(Str
        "revert" => &["revert", "--continue"],
        _ => &["am", "--continue"],
    };
-    cli::run_streaming(r.root(), args, cancel, out)
+    let result = cli::run_streaming(r.root(), args, cancel, out);
+    let finished = finish_operation(r);
+    result.and(finished)
 }

 pub(crate) fn abort_op(r: &Repo, cancel: &CancellationToken, out: &dyn Fn(String)) -> IdeResult<()> {
    let op = sequencer(r)?;
-    cli::run_streaming(r.root(), &[op, "--abort"], cancel, out)
+    let result = cli::run_streaming(r.root(), &[op, "--abort"], cancel, out);
+    let finished = finish_operation(r);
+    result.and(finished)
 }

 pub(crate) fn skip_op(r: &Repo, cancel: &CancellationToken, out: &dyn Fn(String)) -> IdeResult<()> {
@@ -141,7 +172,9 @@ pub(crate) fn skip_op(r: &Repo, cancel: &CancellationToken, out: &dyn Fn(String)
    if op == "merge" {
        return Err(IdeError::invalid("a merge cannot be skipped; abort it instead"));
    }
-    cli::run_streaming(r.root(), &[op, "--skip"], cancel, out)
+    let result = cli::run_streaming(r.root(), &[op, "--skip"], cancel, out);
+    let finished = finish_operation(r);
+    result.and(finished)
 }

 /// Merge commits need a mainline (`-m`), which IDEA doesn't offer for cherry-pick / revert.
@@ -157,18 +190,23 @@ fn reject_merges(r: &Repo, commits: &[String], verb: &str) -> IdeResult<()> {
    Ok(())
 }

-/// Applies `commits` on top of HEAD, in the given order (pass oldest first).
+/// Applies `commits` on top of HEAD, in the given order (pass oldest first);
+/// `record_origin` adds "(cherry picked from commit …)" to their messages.
 pub(crate) fn cherry_pick(
    r: &Repo,
    commits: &[String],
+    record_origin: bool,
    cancel: &CancellationToken,
    out: &dyn Fn(String),
 ) -> IdeResult<()> {
    check_commits(commits)?;
    reject_merges(r, commits, "cherry-pick")?;
    let mut args = vec!["cherry-pick"];
+    if record_origin {
+        args.push("-x");
+    }
    args.extend(commits.iter().map(String::as_str));
-    cli::run_streaming(r.root(), &args, cancel, out)
+    apply_skipping_empty(r, "cherry-pick", &args, cancel, out)
 }

 /// Creates commits undoing `commits`, in the given order (pass newest first).
@@ -177,7 +215,42 @@ pub(crate) fn revert(r: &Repo, commits: &[String], cancel: &CancellationToken, o
    reject_merges(r, commits, "revert")?;
    let mut args = vec!["revert", "--no-edit"];
    args.extend(commits.iter().map(String::as_str));
-    cli::run_streaming(r.root(), &args, cancel, out)
+    apply_skipping_empty(r, "revert", &args, cancel, out)
+}
+
+/// Runs a cherry-pick / revert sequence. A commit whose changes are already there leaves
+/// nothing to commit: it is skipped and the rest of the sequence goes on.
+fn apply_skipping_empty(
+    r: &Repo,
+    verb: &str,
+    args: &[&str],
+    cancel: &CancellationToken,
+    out: &dyn Fn(String),
+) -> IdeResult<()> {
+    let head_file = if verb == "revert" { "REVERT_HEAD" } else { "CHERRY_PICK_HEAD" };
+    let said_nothing = std::cell::Cell::new(false);
+    let watch = |line: String| {
+        // git runs with LC_ALL=C; a single commit with nothing left to apply stops here.
+        said_nothing.set(said_nothing.get() || line.contains("nothing to commit"));
+        out(line)
+    };
+    let mut result = cli::run_streaming(r.root(), args, cancel, &watch);
+    if result.is_err() && said_nothing.get() && r.branch_info()?.operation.is_none() {
+        out("Skipped: its changes are already applied".into());
+        return Ok(());
+    }
+    while result.is_err() && !cancel.is_cancelled() {
+        let Ok(stopped) = std::fs::read_to_string(r.git_dir.join(head_file)) else { break };
+        let empty = unmerged_paths(r)?.is_empty()
+            && cli::run_raw(r.root(), &["diff", "--cached", "--quiet", "HEAD", "--"], None)?.code == Some(0);
+        if !empty {
+            break;
+        }
+        let id = stopped.trim();
+        out(format!("{} skipped: its changes are already applied", &id[..id.len().min(8)]));
+        result = cli::run_streaming(r.root(), &[verb, "--skip"], cancel, out);
+    }
+    result
 }

 pub(crate) fn reset(
@@ -281,7 +354,7 @@ pub(crate) fn interactive_rebase(
            let file = work.join(format!("msg-{i}"));
            std::fs::write(&file, m)?;
            todo.push_str(&format!(
-                "exec git commit --amend --allow-empty --no-verify --quiet --cleanup=strip -F {}\n",
+                "exec git commit --amend --allow-empty --no-verify --quiet --cleanup=whitespace -F {}\n",
                quote(&file)
            ));
        }
@@ -289,15 +362,26 @@ pub(crate) fn interactive_rebase(
    let todo_file = work.join("todo");
    std::fs::write(&todo_file, todo)?;
    let editor = format!("cp {}", quote(&todo_file));
-    let mut args = vec!["rebase", "--interactive", "--autostash", "--no-autosquash"];
+    // Local changes are put aside and restored when the rebase is over, staged ones as
+    // staged (git's --autostash would bring them all back unstaged).
+    crate::preserve::save(r, "Local changes saved before rebase")?;
+    let mut args = vec!["rebase", "--interactive", "--no-autosquash"];
    args.push(base.unwrap_or("--root"));
    let env = [("GIT_SEQUENCE_EDITOR", std::ffi::OsStr::new(&editor))];
-    cli::run_streaming_env(r.root(), &args, &env, cancel, out)?;
+    let result = cli::run_streaming_env(r.root(), &args, &env, cancel, out);
    // A stopped rebase still needs the message files for its remaining `exec` lines.
-    if r.branch_info()?.operation.is_none() {
-        let _ = std::fs::remove_dir_all(&work);
+    let finished = finish_operation(r);
+    result.and(finished)
+}
+
+/// Once a rebase / merge / cherry-pick / revert is over, brings back the local changes
+/// put aside for it; the plan files of [`interactive_rebase`] go once it is done.
+pub(crate) fn finish_operation(r: &Repo) -> IdeResult<()> {
+    if r.branch_info()?.operation.is_some() {
+        return Ok(());
    }
-    Ok(())
+    let _ = std::fs::remove_dir_all(r.git_dir.join("openidea-rebase"));
+    crate::preserve::restore(r)
 }

 /// Creates a tag on `commit`: annotated when `message` is non-empty, else lightweight.
@@ -325,6 +409,51 @@ pub(crate) fn create_tag(r: &Repo, name: &str, commit: &str, message: Option<&st
    run(r.root(), &args, message.map(str::as_bytes)).map(|_| ())
 }

+fn tag_ref(name: &str) -> IdeResult<String> {
+    let name = name.trim();
+    if name.is_empty() || name.starts_with('-') || name.contains("..") || name.contains(':') {
+        return Err(IdeError::invalid(format!("'{name}' is not a valid tag name")));
+    }
+    Ok(format!("refs/tags/{name}"))
+}
+
+pub(crate) fn delete_tag(r: &Repo, name: &str) -> IdeResult<crate::DeletedTag> {
+    let tag = tag_ref(name)?;
+    let target = run(r.root(), &["rev-parse", "-q", "--verify", &tag], None)
+        .map_err(|_| IdeError::invalid(format!("Could not find tag {name}")))?
+        .stdout_str();
+    let target = target.trim().to_string();
+    run(r.root(), &["update-ref", "-d", &tag, &target], None)?;
+    Ok(crate::DeletedTag { name: name.trim().to_string(), target })
+}
+
+pub(crate) fn restore_tag(r: &Repo, deleted: &crate::DeletedTag) -> IdeResult<()> {
+    let tag = tag_ref(&deleted.name)?;
+    let target = deleted.target.trim();
+    if target.is_empty() || target.starts_with('-') {
+        return Err(IdeError::invalid("invalid tag target"));
+    }
+    // Only recreates it: a tag made with that name meanwhile stays.
+    run(r.root(), &["update-ref", &tag, target, ""], None).map(|_| ())
+}
+
+pub(crate) fn push_tag(
+    r: &Repo,
+    name: &str,
+    remote: &str,
+    delete: bool,
+    cancel: &CancellationToken,
+    on_output: &dyn Fn(String),
+) -> IdeResult<()> {
+    let tag = tag_ref(name)?;
+    let remote = remote.trim();
+    if remote.is_empty() || remote.starts_with('-') {
+        return Err(IdeError::invalid(format!("invalid remote '{remote}'")));
+    }
+    let spec = if delete { format!(":{tag}") } else { format!("{tag}:{tag}") };
+    cli::run_streaming(r.root(), &["push", "--progress", remote, &spec], cancel, on_output)
+}
+
 /// Tag names, sorted.
 pub(crate) fn tags(r: &Repo) -> IdeResult<Vec<String>> {
    let repo = r.gix()?;
@@ -0,0 +1,68 @@
+//! Local changes put aside around merge, rebase and pull, and brought back once the
+//! operation is over: staged changes as staged (git's `--autostash` brings everything
+//! back unstaged). An operation that stops on conflicts keeps them aside until it is
+//! continued, skipped, aborted or concluded by a commit.
+
+use crate::Repo;
+use crate::cli::{self, run};
+use crate::write::unmerged_paths;
+use ide_core::{IdeError, IdeResult};
+
+/// `.git/<MARKER>` holds the id of the stash the changes went to.
+const MARKER: &str = "openidea-saved-changes";
+
+/// Stashes the local changes of tracked files, if any.
+pub(crate) fn save(r: &Repo, message: &str) -> IdeResult<()> {
+    let marker = r.git_dir.join(MARKER);
+    if marker.exists() {
+        // Changes saved by an operation still in progress stay where they are; those of
+        // one concluded outside the IDE come back first.
+        if r.branch_info()?.operation.is_some() {
+            return Ok(());
+        }
+        restore(r)?;
+    }
+    if run(r.root(), &["status", "--porcelain", "--untracked-files=no"], None)?.stdout_str().trim().is_empty() {
+        return Ok(());
+    }
+    let before = run(r.root(), &["rev-parse", "-q", "--verify", "refs/stash"], None).map(|o| o.stdout_str()).ok();
+    run(r.root(), &["stash", "push", "-q", "-m", message], None)?;
+    let id = run(r.root(), &["rev-parse", "refs/stash"], None)?.stdout_str();
+    if before.as_deref().map(str::trim) == Some(id.trim()) {
+        return Err(IdeError::invalid("could not save the local changes"));
+    }
+    std::fs::write(marker, id.trim())?;
+    Ok(())
+}
+
+/// Brings the saved changes back once no operation is in progress. Fails when they come
+/// back with conflicts (they then also stay in the stash).
+pub(crate) fn restore(r: &Repo) -> IdeResult<()> {
+    let marker = r.git_dir.join(MARKER);
+    let Ok(saved) = std::fs::read_to_string(&marker) else { return Ok(()) };
+    if r.branch_info()?.operation.is_some() {
+        return Ok(());
+    }
+    let _ = std::fs::remove_file(&marker);
+    let saved = saved.trim();
+    let stashes = run(r.root(), &["stash", "list", "--format=%H"], None)?.stdout_str();
+    let Some(index) = stashes.lines().position(|id| id.trim() == saved) else { return Ok(()) };
+    let entry = format!("stash@{{{index}}}");
+    if cli::run_raw(r.root(), &["stash", "pop", "-q", "--index", &entry], None)?.code == Some(0) {
+        return Ok(());
+    }
+    // The staged part no longer applies as it was: bring everything back unstaged.
+    if unmerged_paths(r)?.is_empty() && cli::run_raw(r.root(), &["stash", "pop", "-q", &entry], None)?.code == Some(0) {
+        return Ok(());
+    }
+    Err(IdeError::invalid("local changes were restored with conflicts; resolve them (a copy stays in the stash)"))
+}
+
+/// Runs `op` with the local changes put aside, and brings them back if it finished.
+pub(crate) fn around<T>(r: &Repo, message: &str, op: impl FnOnce() -> IdeResult<T>) -> IdeResult<T> {
+    save(r, message)?;
+    let result = op();
+    let restored = restore(r);
+    let value = result?;
+    restored.map(|_| value)
+}
@@ -372,11 +372,13 @@ pub(crate) fn commit(
        args.extend(["-F", "-"]);
        Some(message.as_bytes())
    };
-    if options.partial.is_empty() {
+    if options.partial.is_empty() && options.stage.is_empty() && options.exclude.is_empty() {
        run(r.root(), &args, stdin)?;
    } else {
-        commit_partial(r, &args, stdin, &options.partial, encoding)?;
+        commit_selected(r, &args, stdin, options, encoding)?;
    }
+    // A commit concluding a merge brings back the local changes put aside for it.
+    let _ = crate::preserve::restore(r);
    let repo = r.gix()?;
    Ok(repo.head_id().map_err(gx)?.detach().to_string())
 }
@@ -391,15 +393,16 @@ impl Drop for TempIndex {
    }
 }

-/// Commits the index with only the chosen hunks of `partial` files, through a copy of the
-/// index (`GIT_INDEX_FILE`), as IDEA's partial commit does: the working tree and the
-/// user's index are left alone except that the partial files' entries end up matching
-/// the new commit.
-fn commit_partial(
+/// Commits a selection of the changes through a copy of the index (`GIT_INDEX_FILE`):
+/// `exclude` goes back to HEAD in the copy, `stage` takes its working-tree content and
+/// `partial` only the chosen hunks. The working tree and the user's index are left alone
+/// except that the committed files' entries end up matching the new commit, so changes
+/// left out keep their staged state.
+fn commit_selected(
    r: &Repo,
    commit_args: &[&str],
    stdin: Option<&[u8]>,
-    partial: &[crate::PartialCommitFile],
+    options: &CommitOptions,
    encoding: &dyn Fn(&Path) -> IdeResult<TextEncoding>,
 ) -> IdeResult<()> {
    let tmp = TempIndex(r.git_dir.join("openidea-partial-index"));
@@ -408,8 +411,22 @@ fn commit_partial(
        std::fs::copy(&index, &tmp.0)?;
    }
    let env = [("GIT_INDEX_FILE", tmp.0.as_os_str())];
-    let mut rels = Vec::new();
-    for file in partial {
+    let rel_paths = |paths: &[ide_core::IpcPath]| -> IdeResult<Vec<String>> {
+        let paths: Vec<PathBuf> = paths.iter().map(|p| p.0.clone()).collect();
+        r.rel_paths(&paths)
+    };
+    let exclude = rel_paths(&options.exclude)?;
+    if !exclude.is_empty() {
+        let args: &[&str] = if r.has_head()? {
+            &["--literal-pathspecs", "reset", "-q", "HEAD", "--"]
+        } else {
+            &["--literal-pathspecs", "rm", "--cached", "-r", "-q", "--ignore-unmatch", "--"]
+        };
+        cli::run_paths_env(r.root(), args, &exclude, None, &env)?;
+    }
+    let mut rels = rel_paths(&options.stage)?;
+    cli::run_paths_env(r.root(), &["--literal-pathspecs", "add", "-A", "--"], &rels, None, &env)?;
+    for file in &options.partial {
        let rel = r.rel_path(&file.path.0)?;
        let head = {
            let repo = r.gix()?;
@@ -525,8 +542,16 @@ fn switch_plan(r: &Repo, branch: &str, create: bool, diverged: Option<DivergedLo

 /// Files git refuses to overwrite with local changes, from its error message.
 fn overwritten_files(stderr: &str) -> Option<Vec<String>> {
-    let mut lines =
-        stderr.lines().skip_while(|l| !l.contains("local changes to the following files would be overwritten"));
+    listed_files(stderr, "local changes to the following files would be overwritten")
+}
+
+/// Untracked files git refuses to overwrite, from its error message.
+fn overwritten_untracked(stderr: &str) -> Option<Vec<String>> {
+    listed_files(stderr, "untracked working tree files would be")
+}
+
+fn listed_files(stderr: &str, header: &str) -> Option<Vec<String>> {
+    let mut lines = stderr.lines().skip_while(|l| !l.contains(header));
    lines.next()?;
    Some(lines.take_while(|l| l.starts_with('\t')).map(|l| l.trim().to_string()).collect())
 }
@@ -547,10 +572,13 @@ pub(crate) fn checkout_with(
    let mut args = match switch_plan(r, branch, create, options.diverged)? {
        SwitchPlan::Ahead { local, remote } => return Ok(CheckoutOutcome::LocalBranchAhead { local, remote }),
        SwitchPlan::Rebase { local, remote } => {
-            let out = cli::run_raw(r.root(), &["rebase", "--autostash", &remote, &local], None)?;
+            crate::preserve::save(r, "Local changes saved before checkout")?;
+            let out = cli::run_raw(r.root(), &["rebase", &remote, &local], None)?;
            if out.code == Some(0) {
+                crate::preserve::restore(r)?;
                return Ok(CheckoutOutcome::Done);
            }
+            crate::preserve::restore(r)?;
            let files = unmerged_paths(r)?;
            if files.is_empty() {
                return Err(cli::failure(&["rebase"], &out.stderr, &out.stdout, out.code));
@@ -567,7 +595,11 @@ pub(crate) fn checkout_with(
    if out.code == Some(0) {
        return Ok(CheckoutOutcome::Done);
    }
-    let Some(files) = overwritten_files(&String::from_utf8_lossy(&out.stderr)) else {
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    if let Some(files) = overwritten_untracked(&stderr) {
+        return Ok(CheckoutOutcome::UntrackedFiles { files });
+    }
+    let Some(files) = overwritten_files(&stderr) else {
        return Err(cli::failure(&argv, &out.stderr, &out.stdout, out.code));
    };
    if options.mode != CheckoutMode::Smart {
@@ -583,7 +615,17 @@ pub(crate) fn checkout_with(
        run(r.root(), &["stash", "pop", "-q", "--index"], None)?;
        return Err(e);
    }
-    let pop = cli::run_raw(r.root(), &["stash", "pop", "-q"], None)?;
+    // Staged changes come back staged; when the index can't be restored as it was (it
+    // conflicts with the new branch), the changes come back unstaged.
+    let pop = cli::run_raw(r.root(), &["stash", "pop", "-q", "--index"], None)?;
+    if pop.code == Some(0) {
+        return Ok(CheckoutOutcome::Done);
+    }
+    let pop = if unmerged_paths(r)?.is_empty() && stash_count(r)? > before {
+        cli::run_raw(r.root(), &["stash", "pop", "-q"], None)?
+    } else {
+        pop
+    };
    if pop.code == Some(0) {
        return Ok(CheckoutOutcome::Done);
    }
@@ -623,6 +665,104 @@ pub(crate) fn create_branch(r: &Repo, name: &str, start: Option<&str>, checkout:

 /// Undo Commit: moves the current branch back to the parent of `commit` (which must be
 /// HEAD), keeping its changes staged. Returns the undone commit's message.
+/// Edit Commit Message: writes `commit` again with `message`, and its descendants on top
+/// of it with their own trees, then moves HEAD to the new tip. Trees don't change, so the
+/// index and the working tree stay as they are (local changes included). Returns HEAD
+/// before and after, for [`restore_head`].
+pub(crate) fn reword(r: &Repo, commit: &str, message: &str) -> IdeResult<(String, String)> {
+    if r.branch_info()?.operation.is_some() {
+        return Err(IdeError::invalid(
+            "cannot edit a commit message while a merge, rebase or cherry-pick is in progress",
+        ));
+    }
+    let message = message.trim();
+    if message.is_empty() {
+        return Err(IdeError::invalid("commit message is empty"));
+    }
+    let (target, head) = {
+        let repo = r.gix()?;
+        let head = repo.head_id().map_err(|_| IdeError::invalid("there is no commit to edit"))?.detach();
+        let target = repo.find_object(resolve(&repo, commit)?).map_err(gx)?.peel_to_commit().map_err(gx)?.id;
+        (target.to_string(), head.to_string())
+    };
+    if cli::run_raw(r.root(), &["merge-base", "--is-ancestor", &target, &head], None)?.code != Some(0) {
+        return Err(IdeError::invalid("the commit is not in the current branch"));
+    }
+    // target..HEAD must be a straight line on top of the target.
+    let range = format!("{target}..{head}");
+    let listed = run(r.root(), &["rev-list", "--reverse", "--topo-order", "--parents", &range], None)?.stdout_str();
+    let mut chain = vec![target.clone()];
+    for line in listed.lines() {
+        let ids: Vec<&str> = line.split_whitespace().collect();
+        if ids.len() != 2 || ids[1] != chain.last().unwrap() {
+            return Err(IdeError::invalid("the commits after this one are not a linear history"));
+        }
+        chain.push(ids[0].to_string());
+    }
+    let mut parent: Option<String> = None;
+    for (i, id) in chain.iter().enumerate() {
+        let raw = run(r.root(), &["cat-file", "commit", id], None)?.stdout;
+        let text = String::from_utf8_lossy(&raw);
+        let (headers, body) = text.split_once("\n\n").unwrap_or((&text, ""));
+        let mut tree = "";
+        let mut parents = Vec::new();
+        let mut author = "";
+        for line in headers.lines() {
+            if let Some(v) = line.strip_prefix("tree ") {
+                tree = v;
+            } else if let Some(v) = line.strip_prefix("parent ") {
+                parents.push(v.to_string());
+            } else if let Some(v) = line.strip_prefix("author ") {
+                author = v;
+            }
+        }
+        if parents.len() > 1 {
+            return Err(IdeError::invalid("merge commits cannot be reworded"));
+        }
+        if let Some(p) = &parent {
+            parents = vec![p.clone()];
+        }
+        let (name, rest) = author.split_once(" <").unwrap_or((author, ""));
+        let (email, date) = rest.split_once("> ").unwrap_or((rest, ""));
+        let env = [
+            ("GIT_AUTHOR_NAME", std::ffi::OsStr::new(name)),
+            ("GIT_AUTHOR_EMAIL", std::ffi::OsStr::new(email)),
+            ("GIT_AUTHOR_DATE", std::ffi::OsStr::new(date)),
+        ];
+        let mut args = vec!["commit-tree", tree];
+        for p in &parents {
+            args.extend(["-p", p.as_str()]);
+        }
+        let new_message = if i == 0 { format!("{message}\n") } else { body.to_string() };
+        let created = cli::run_env(r.root(), &args, Some(new_message.as_bytes()), &env)?.stdout_str();
+        parent = Some(created.trim().to_string());
+    }
+    let new_head = parent.expect("the chain holds the target");
+    let reason = format!("reword: {}", message.lines().next().unwrap_or_default());
+    run(r.root(), &["update-ref", "-m", &reason, "HEAD", &new_head, &head], None)?;
+    Ok((head, new_head))
+}
+
+/// Undo of a history rewrite: moves HEAD from `after` back to `before`, keeping local
+/// changes (`git reset --keep`). Refused when HEAD has moved since.
+pub(crate) fn restore_head(r: &Repo, before: &str, after: &str) -> IdeResult<()> {
+    if r.branch_info()?.operation.is_some() {
+        return Err(IdeError::invalid("cannot undo while a merge, rebase or cherry-pick is in progress"));
+    }
+    let head = run(r.root(), &["rev-parse", "--verify", "HEAD"], None)?.stdout_str();
+    if head.trim() != after {
+        return Err(IdeError::invalid("the branch has changed since; undo is no longer possible"));
+    }
+    let before = check_rev(before)?;
+    let tree = |rev: &str| run(r.root(), &["rev-parse", &format!("{rev}^{{tree}}")], None).map(|o| o.stdout_str());
+    if tree(before)? == tree(after)? {
+        run(r.root(), &["update-ref", "-m", "undo", "HEAD", before, after], None)?;
+    } else {
+        run(r.root(), &["reset", "-q", "--keep", before, "--"], None)?;
+    }
+    Ok(())
+}
+
 pub(crate) fn undo_commit(r: &Repo, commit: &str) -> IdeResult<String> {
    if r.branch_info()?.operation.is_some() {
        return Err(IdeError::invalid("cannot undo a commit while a merge, rebase or cherry-pick is in progress"));
@@ -711,11 +851,17 @@ fn check_rev(rev: &str) -> IdeResult<&str> {

 /// Local changes are stashed and restored around the merge (IDEA's "save local changes").
 pub(crate) fn merge(r: &Repo, branch: &str) -> IdeResult<()> {
-    run(r.root(), &["merge", "--no-edit", "--autostash", check_rev(branch)?], None).map(|_| ())
+    let branch = check_rev(branch)?;
+    crate::preserve::around(r, "Local changes saved before merge", || {
+        run(r.root(), &["merge", "--no-edit", branch], None).map(|_| ())
+    })
 }

 pub(crate) fn rebase(r: &Repo, onto: &str) -> IdeResult<()> {
-    run(r.root(), &["rebase", "--autostash", check_rev(onto)?], None).map(|_| ())
+    let onto = check_rev(onto)?;
+    crate::preserve::around(r, "Local changes saved before rebase", || {
+        run(r.root(), &["rebase", onto], None).map(|_| ())
+    })
 }

 pub(crate) fn stash_push(r: &Repo, message: Option<&str>, include_untracked: bool, keep_index: bool) -> IdeResult<()> {
@@ -781,20 +927,16 @@ pub(crate) fn delete_remote_branch(

 pub(crate) fn push(
    r: &Repo,
-    force_with_lease: bool,
-    set_upstream: bool,
-    tags: Option<crate::PushTags>,
+    o: crate::PushOptions,
    cancel: &CancellationToken,
    on_output: &dyn Fn(String),
 ) -> IdeResult<()> {
    let mut args: Vec<String> = vec!["push".into(), "--progress".into()];
-    if force_with_lease {
-        args.push("--force-with-lease".into());
-    }
-    if tags == Some(crate::PushTags::CurrentBranch) {
+    args.extend(force_args(o.force, o.force_with_lease, o.no_verify));
+    if o.tags == Some(crate::PushTags::CurrentBranch) {
        args.push("--follow-tags".into());
    }
-    if set_upstream {
+    if o.set_upstream {
        let repo = r.gix()?;
        let head =
            repo.head_name().map_err(gx)?.ok_or_else(|| IdeError::invalid("cannot set upstream: HEAD is detached"))?;
@@ -817,14 +959,49 @@ pub(crate) fn push(
    }
    let argv: Vec<&str> = args.iter().map(String::as_str).collect();
    cli::run_streaming(r.root(), &argv, cancel, on_output)?;
-    if tags == Some(crate::PushTags::All) {
+    if o.tags == Some(crate::PushTags::All) {
        // `git push --tags` alone pushes only tags, so it runs after the branch push.
        let remote = push_remote(r)?;
-        cli::run_streaming(r.root(), &["push", "--progress", &remote, "--tags"], cancel, on_output)?;
+        let mut args = vec!["push", "--progress"];
+        if o.no_verify {
+            args.push("--no-verify");
+        }
+        args.extend([remote.as_str(), "--tags"]);
+        cli::run_streaming(r.root(), &args, cancel, on_output)?;
    }
    Ok(())
 }

+/// `--force` / `--force-with-lease` and `--no-verify` of a push.
+fn force_args(force: bool, force_with_lease: bool, no_verify: bool) -> Vec<String> {
+    let mut args = Vec::new();
+    if force {
+        args.push("--force".into());
+    } else if force_with_lease {
+        args.push("--force-with-lease".into());
+    }
+    if no_verify {
+        args.push("--no-verify".into());
+    }
+    args
+}
+
+pub(crate) fn has_hook(r: &Repo, name: &str) -> IdeResult<bool> {
+    if name.is_empty() || name.contains(['/', '\\']) {
+        return Err(IdeError::invalid(format!("invalid hook name '{name}'")));
+    }
+    let path = run(r.root(), &["rev-parse", "--git-path", &format!("hooks/{name}")], None)?.stdout_str();
+    let path = r.root().join(path.trim());
+    let Ok(meta) = std::fs::metadata(&path) else { return Ok(false) };
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        Ok(meta.is_file() && meta.permissions().mode() & 0o111 != 0)
+    }
+    #[cfg(not(unix))]
+    Ok(meta.is_file())
+}
+
 /// Remote and branch name a local branch pulls from (`branch.<b>.remote` / `.merge`).
 fn branch_upstream(r: &Repo, branch: &str) -> Option<(String, String)> {
    let get = |key: &str| {
@@ -855,10 +1032,18 @@ pub(crate) fn push_branch(
    cancel: &CancellationToken,
    on_output: &dyn Fn(String),
 ) -> IdeResult<()> {
-    let PushBranchOptions { revision, target, remote: remote_override, force_with_lease } = opts;
+    let PushBranchOptions {
+        revision,
+        target,
+        remote: remote_override,
+        force_with_lease,
+        force,
+        set_upstream,
+        no_verify,
+    } = opts;
    check_local_branch(r, branch)?;
    let remote_override = remote_override.map(str::trim).filter(|s| !s.is_empty());
-    let (remote, mut name, set_upstream) = match (remote_override, branch_upstream(r, branch)) {
+    let (remote, mut name, untracked) = match (remote_override, branch_upstream(r, branch)) {
        // An explicit remote keeps the upstream's branch name but pushes elsewhere.
        (Some(remote), Some((_, name))) => (check_rev(remote)?.to_string(), name, false),
        (Some(remote), None) => (check_rev(remote)?.to_string(), branch.to_string(), revision.is_none()),
@@ -879,10 +1064,8 @@ pub(crate) fn push_branch(
        None => format!("refs/heads/{branch}"),
    };
    let mut args: Vec<String> = vec!["push".into(), "--progress".into()];
-    if force_with_lease {
-        args.push("--force-with-lease".into());
-    }
-    if set_upstream {
+    args.extend(force_args(force, force_with_lease, no_verify));
+    if untracked || (set_upstream && revision.is_none()) {
        args.push("--set-upstream".into());
    }
    args.extend([remote, format!("{source}:refs/heads/{target}")]);
@@ -904,6 +1087,27 @@ pub(crate) fn update_branch(
    cli::run_streaming(r.root(), &["fetch", "--progress", &remote, &refspec], cancel, on_output)
 }

+/// Update Project › Reset to the Remote Branch: fetches the current branch's tracked
+/// branch and moves the branch to it, dropping local commits. Local changes are put
+/// aside and brought back (an error with the conflicts left in place when they clash).
+pub(crate) fn reset_to_upstream(r: &Repo, cancel: &CancellationToken, on_output: &dyn Fn(String)) -> IdeResult<()> {
+    let head = run(r.root(), &["symbolic-ref", "-q", "--short", "HEAD"], None)
+        .map_err(|_| IdeError::invalid("cannot reset: HEAD is detached"))?
+        .stdout_str();
+    let head = head.trim();
+    let no_tracked =
+        || IdeError::invalid(format!("no tracked branch configured for branch {head} or the branch doesn't exist"));
+    let (remote, name) = branch_upstream(r, head).ok_or_else(no_tracked)?;
+    cli::run_streaming(r.root(), &["fetch", "--progress", &remote], cancel, on_output)?;
+    let tracked = format!("refs/remotes/{remote}/{name}");
+    if run(r.root(), &["rev-parse", "-q", "--verify", &format!("{tracked}^{{commit}}")], None).is_err() {
+        return Err(no_tracked());
+    }
+    crate::preserve::around(r, "Local changes saved before reset", || {
+        run(r.root(), &["reset", "-q", "--keep", &tracked], None).map(|_| ())
+    })
+}
+
 /// The remote the current branch pushes to (`origin`, or the only remote, by default).
 /// The remote and ref HEAD's branch tracks when the ref has another name: a plain
 /// `git push` refuses that under the default `push.default=simple`.
@@ -306,6 +306,17 @@ fn interactive_rebase_reorder_squash_fixup_reword_drop() {
    assert_eq!(fx.git(&["show", "--format=", "--name-only", "HEAD"]), "f1.txt\nf2.txt\nf3.txt");
 }

+#[test]
+fn interactive_rebase_reword_keeps_lines_starting_with_a_hash() {
+    let (fx, ids) = linear();
+    let (cancel, out) = quiet();
+    let message = "Subject\n\n#body starting with a hash";
+    fx.repo()
+        .interactive_rebase(Some(&ids[2]), &[entry(&ids[3], RebaseAction::Reword, Some(message))], &cancel, &out)
+        .unwrap();
+    assert_eq!(fx.git(&["log", "-1", "--format=%B"]), message);
+}
+
 #[test]
 fn interactive_rebase_squash_without_message_combines_messages() {
    let (fx, ids) = linear();
@@ -407,6 +418,89 @@ fn interactive_rebase_conflict_stops_then_continues_with_reword() {
    assert_eq!(fx.subjects(), vec!["one", "two first", "base"]);
 }

+/// `main` and `feature` both change `c.txt`: rebasing feature onto main stops on it.
+fn rebase_stopped_on_a_conflict() -> (Fixture, Repo) {
+    let fx = Fixture::new();
+    fx.write("c.txt", "base\n");
+    fx.write("other.txt", "other\n");
+    fx.commit_all("base");
+    fx.git(&["switch", "-q", "-c", "feature"]);
+    fx.write("c.txt", "feature\n");
+    fx.commit_all("feature change");
+    fx.git(&["switch", "-q", "main"]);
+    fx.write("c.txt", "main\n");
+    fx.commit_all("main change");
+    fx.git(&["switch", "-q", "feature"]);
+    let repo = fx.repo();
+    assert!(repo.rebase("main").is_err());
+    assert_eq!(repo.branch_info().unwrap().operation.as_deref(), Some("rebase"));
+    (fx, repo)
+}
+
+#[test]
+fn edits_of_a_resolved_file_go_with_it_when_the_rebase_continues() {
+    let (fx, repo) = rebase_stopped_on_a_conflict();
+    fx.write("c.txt", "resolved\n");
+    repo.stage(&[fx.path("c.txt")]).unwrap();
+    fx.write("c.txt", "resolved\nmore\n");
+    let (cancel, out) = quiet();
+    repo.continue_operation(&cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None);
+    assert_eq!(fx.git(&["show", "HEAD:c.txt"]), "resolved\nmore");
+}
+
+#[test]
+fn unstaged_changes_of_other_files_stop_the_rebase_until_staged() {
+    let (fx, repo) = rebase_stopped_on_a_conflict();
+    fx.write("c.txt", "resolved\n");
+    repo.stage(&[fx.path("c.txt")]).unwrap();
+    fx.write("other.txt", "changed while stopped\n");
+    let (cancel, out) = quiet();
+    let err = repo.continue_operation(&cancel, &out).unwrap_err();
+    assert_eq!(err.message, UNSTAGED_CHANGES_PREVENT_REBASE);
+    assert_eq!(repo.branch_info().unwrap().operation.as_deref(), Some("rebase"));
+    repo.stage_and_continue(&cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None);
+    assert_eq!(fx.git(&["show", "HEAD:other.txt"]), "changed while stopped");
+}
+
+#[test]
+fn stage_and_retry_after_editing_a_commit() {
+    let (fx, ids) = linear();
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    let plan = [entry(&ids[2], RebaseAction::Edit, None), entry(&ids[3], RebaseAction::Pick, None)];
+    repo.interactive_rebase(Some(&ids[1]), &plan, &cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation.as_deref(), Some("rebase"));
+    fx.write("f1.txt", "edited\n");
+    std::fs::remove_file(fx.path("f2.txt")).unwrap();
+    assert!(repo.continue_operation(&cancel, &out).is_err());
+    repo.stage_and_continue(&cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None);
+    assert_eq!(fx.git(&["status", "--porcelain"]), "");
+    assert!(!fx.exists("f2.txt"));
+}
+
+#[test]
+fn rebase_and_merge_onto_a_branch_named_like_a_tag_use_the_branch() {
+    let fx = Fixture::new();
+    fx.write("a.txt", "a\n");
+    fx.commit_all("base");
+    fx.git(&["tag", "main"]);
+    fx.write("m.txt", "m\n");
+    let tip = fx.commit_all("main moved on");
+    fx.git(&["switch", "-q", "-c", "feature", "HEAD~1"]);
+    fx.write("f.txt", "f\n");
+    fx.commit_all("feature");
+    let repo = fx.repo();
+    repo.rebase("refs/heads/main").unwrap();
+    assert_eq!(fx.git(&["rev-parse", "HEAD~1"]), tip);
+    fx.git(&["reset", "-q", "--hard", "HEAD~1"]);
+    fx.git(&["switch", "-q", "-c", "other", "refs/heads/main~1"]);
+    repo.merge("refs/heads/main").unwrap();
+    assert_eq!(fx.head(), tip, "fast-forwarded to the branch, not the tag");
+}
+
 #[test]
 fn interactive_rebase_edit_stops_for_amend() {
    let (fx, ids) = linear();
@@ -524,6 +618,157 @@ fn update_merge_with_local_changes_to_the_same_file() {
    assert_eq!(fx.git(&["rev-list", "--count", "--merges", "HEAD"]), "1");
 }

+#[test]
+fn update_with_rebase_keeps_a_file_added_then_deleted_added_to_the_index() {
+    let (fx, bare) = Fixture::with_origin();
+    fx.push_from_other(&bare, "remote.txt", "r\n");
+    fx.write("local.txt", "l\n");
+    fx.commit_all("local");
+    fx.write("ad.txt", "x\n");
+    fx.git(&["add", "ad.txt"]);
+    std::fs::remove_file(fx.path("ad.txt")).unwrap();
+    let (cancel, out) = quiet();
+    fx.repo().pull(true, &cancel, &out).unwrap();
+    assert!(fx.exists("remote.txt"));
+    assert!(fx.git(&["status", "--porcelain", "--", "ad.txt"]).starts_with('A'), "still added");
+}
+
+#[test]
+fn reset_to_the_remote_branch_drops_local_commits_and_keeps_local_changes() {
+    let (fx, bare) = Fixture::with_origin();
+    for i in 0..3 {
+        fx.push_from_other(&bare, "bro.txt", &format!("bro {i}\n"));
+    }
+    fx.write("local1.txt", "1\n");
+    fx.commit_all("local commit");
+    fx.write("untracked.txt", "u\n");
+    fx.write("a.txt", "edited\n");
+    fx.git(&["add", "a.txt"]);
+    let (cancel, out) = quiet();
+    fx.repo().reset_to_upstream(&cancel, &out).unwrap();
+    assert_eq!(fx.head(), fx.git(&["rev-parse", "origin/main"]));
+    assert!(!fx.exists("local1.txt"), "files of local commits are gone");
+    assert!(fx.exists("untracked.txt"));
+    assert_eq!(fx.git(&["status", "--porcelain", "--", "a.txt"]), "M  a.txt", "staged changes stay staged");
+    assert_eq!(fx.git(&["stash", "list"]), "");
+}
+
+#[test]
+fn reset_to_the_remote_branch_without_new_remote_commits_drops_local_ones() {
+    let (fx, _bare) = Fixture::with_origin();
+    let before = fx.head();
+    fx.write("local1.txt", "1\n");
+    fx.commit_all("local commit");
+    let (cancel, out) = quiet();
+    fx.repo().reset_to_upstream(&cancel, &out).unwrap();
+    assert_eq!(fx.head(), before);
+}
+
+#[test]
+fn reset_to_the_remote_branch_leaves_conflicting_local_changes_to_resolve() {
+    let (fx, bare) = Fixture::with_origin();
+    fx.push_from_other(&bare, "bro.txt", "bro\n");
+    fx.write("bro.txt", "local content\n");
+    fx.git(&["add", "bro.txt"]);
+    let (cancel, out) = quiet();
+    assert!(fx.repo().reset_to_upstream(&cancel, &out).is_err());
+    assert_eq!(fx.head(), fx.git(&["rev-parse", "origin/main"]));
+    assert!(fx.read("bro.txt").contains("<<<<<<<"), "the clash is left to resolve");
+    assert_eq!(fx.git(&["stash", "list"]).lines().count(), 1, "a copy stays in the stash");
+}
+
+#[test]
+fn reset_to_the_remote_branch_needs_a_tracked_branch_that_exists() {
+    let (fx, bare) = Fixture::with_origin();
+    let (cancel, out) = quiet();
+    fx.git(&["branch", "--unset-upstream"]);
+    let err = fx.repo().reset_to_upstream(&cancel, &out).unwrap_err();
+    assert!(err.message.contains("no tracked branch"), "{}", err.message);
+
+    fx.git(&["push", "-q", "-u", "origin", "main:feature"]);
+    fx.git(&["switch", "-q", "-c", "feature", "--track", "origin/feature"]);
+    git_in(&bare, &["branch", "-D", "feature"]);
+    fx.git(&["fetch", "-q", "--prune"]);
+    let err = fx.repo().reset_to_upstream(&cancel, &out).unwrap_err();
+    assert!(err.message.contains("no tracked branch"), "{}", err.message);
+}
+
+#[cfg(unix)]
+#[test]
+fn push_can_skip_a_failing_pre_push_hook() {
+    use std::os::unix::fs::PermissionsExt;
+    let (fx, _bare) = Fixture::with_origin();
+    let repo = fx.repo();
+    assert!(!repo.has_hook("pre-push").unwrap());
+    let hook = fx.path(".git/hooks/pre-push");
+    std::fs::create_dir_all(hook.parent().unwrap()).unwrap();
+    std::fs::write(&hook, "#!/bin/sh\necho refused >&2\nexit 1\n").unwrap();
+    std::fs::set_permissions(&hook, std::fs::Permissions::from_mode(0o755)).unwrap();
+    assert!(repo.has_hook("pre-push").unwrap());
+
+    fx.write("local.txt", "l\n");
+    fx.commit_all("local");
+    let (cancel, out) = quiet();
+    assert!(repo.push(false, false, &cancel, &out).is_err(), "the hook refuses the push");
+    let options = PushOptions { no_verify: true, ..Default::default() };
+    repo.push_with(options, &cancel, &out).unwrap();
+    assert_eq!(fx.head(), fx.git(&["rev-parse", "origin/main"]));
+}
+
+#[test]
+fn force_push_without_lease_overwrites_a_remote_that_moved() {
+    let (fx, bare) = Fixture::with_origin();
+    fx.write("local.txt", "l\n");
+    fx.commit_all("local");
+    fx.push_from_other(&bare, "remote.txt", "r\n");
+    fx.git(&["fetch", "-q"]);
+    fx.push_from_other(&bare, "remote2.txt", "r\n");
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    let lease = PushOptions { force_with_lease: true, ..Default::default() };
+    let err = repo.push_with(lease, &cancel, &out).unwrap_err();
+    assert!(err.message.contains("stale info"), "{}", err.message);
+    repo.push_with(PushOptions { force: true, ..Default::default() }, &cancel, &out).unwrap();
+    assert_eq!(git_in(&bare, &["rev-parse", "main"]), fx.head());
+}
+
+#[test]
+fn push_to_another_branch_can_make_it_the_upstream() {
+    let (fx, _bare) = Fixture::with_origin();
+    fx.write("local.txt", "l\n");
+    fx.commit_all("local");
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    let to = |target, set_upstream| PushBranchOptions { target: Some(target), set_upstream, ..Default::default() };
+    repo.push_branch_to("main", to("feature", false), &cancel, &out).unwrap();
+    assert_eq!(fx.git(&["rev-parse", "--abbrev-ref", "main@{u}"]), "origin/main", "upstream kept");
+    repo.push_branch_to("main", to("feature-1", true), &cancel, &out).unwrap();
+    assert_eq!(fx.git(&["rev-parse", "--abbrev-ref", "main@{u}"]), "origin/feature-1");
+}
+
+#[test]
+fn tags_are_pushed_one_at_a_time_deleted_restored_and_deleted_on_the_remote() {
+    let (fx, bare) = Fixture::with_origin();
+    fx.git(&["tag", "-a", "v1", "-m", "release one"]);
+    fx.git(&["tag", "v2"]);
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    repo.push_tag("v1", "origin", &cancel, &out).unwrap();
+    assert_eq!(git_in(&bare, &["tag"]), "v1", "only the chosen tag goes");
+    repo.push_tag("v1", "origin", &cancel, &out).unwrap();
+
+    let deleted = repo.delete_tag("v1").unwrap();
+    assert_eq!(fx.git(&["tag"]), "v2");
+    repo.restore_tag(&deleted).unwrap();
+    assert_eq!(fx.git(&["cat-file", "-t", "v1"]), "tag", "annotated, as it was");
+    assert!(fx.git(&["tag", "-n1", "v1"]).contains("release one"));
+
+    repo.delete_tag("v1").unwrap();
+    repo.delete_remote_tag("v1", "origin", &cancel, &out).unwrap();
+    assert_eq!(git_in(&bare, &["tag"]), "");
+    assert!(repo.delete_tag("missing").is_err());
+}
+
 #[test]
 fn fetch_prunes_deleted_remote_branches() {
    let (fx, bare) = Fixture::with_origin();
@@ -863,3 +1108,100 @@ fn remote_progress_is_streamed() {
    fx.repo().push(false, false, &CancellationToken::new(), &move |l| sink.lock().unwrap().push(l)).unwrap();
    assert!(!lines.lock().unwrap().is_empty());
 }
+
+#[test]
+fn interactive_rebase_restores_local_changes_staged_as_they_were() {
+    let (fx, ids) = linear();
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    fx.write("f1.txt", "staged\n");
+    fx.git(&["add", "f1.txt"]);
+    fx.write("f2.txt", "unstaged\n");
+    repo.interactive_rebase(
+        Some(&ids[1]),
+        &[entry(&ids[2], RebaseAction::Drop, None), entry(&ids[3], RebaseAction::Pick, None)],
+        &cancel,
+        &out,
+    )
+    .unwrap();
+    assert_eq!(fx.subjects(), vec!["c4", "c2", "c1"]);
+    assert_eq!(fx.git(&["diff", "--cached", "--name-only"]), "f1.txt");
+    assert_eq!(fx.git(&["diff", "--name-only"]), "f2.txt");
+    assert!(fx.git(&["stash", "list"]).is_empty());
+    assert!(!fx.path(".git/openidea-rebase").exists());
+}
+
+#[test]
+fn local_changes_come_back_once_a_stopped_rebase_is_continued() {
+    let (fx, ids) = linear();
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    // c4 rewrites f3.txt so that dropping c3 conflicts.
+    fx.write("f3.txt", "3\nmore\n");
+    fx.commit_all("c5");
+    let c5 = fx.git(&["rev-parse", "HEAD"]);
+    fx.write("f1.txt", "staged\n");
+    fx.git(&["add", "f1.txt"]);
+    let result = repo.interactive_rebase(
+        Some(&ids[1]),
+        &[
+            entry(&ids[2], RebaseAction::Drop, None),
+            entry(&ids[3], RebaseAction::Pick, None),
+            entry(&c5, RebaseAction::Pick, None),
+        ],
+        &cancel,
+        &out,
+    );
+    assert!(result.is_err());
+    assert_eq!(repo.branch_info().unwrap().operation.as_deref(), Some("rebase"));
+    assert_eq!(fx.read("f1.txt"), "1\n", "put aside while the rebase is stopped");
+    fx.write("f3.txt", "3\nmore\n");
+    repo.stage(&[fx.path("f3.txt")]).unwrap();
+    repo.continue_operation(&cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None);
+    assert_eq!(fx.read("f1.txt"), "staged\n");
+    assert_eq!(fx.git(&["diff", "--cached", "--name-only"]), "f1.txt");
+    assert!(fx.git(&["stash", "list"]).is_empty());
+}
+
+#[test]
+fn merge_brings_staged_changes_back_staged() {
+    let (fx, _ids) = linear();
+    let repo = fx.repo();
+    fx.git(&["checkout", "-q", "-b", "side", "HEAD~1"]);
+    fx.write("side.txt", "side\n");
+    fx.git(&["add", "side.txt"]);
+    fx.git(&["commit", "-q", "-m", "side"]);
+    fx.git(&["checkout", "-q", "main"]);
+    fx.write("f1.txt", "staged\n");
+    fx.git(&["add", "f1.txt"]);
+    fx.write("f2.txt", "unstaged\n");
+    repo.merge_with(&["side".to_string()], &MergeOptions::default()).unwrap();
+    assert!(fx.exists("side.txt"));
+    assert_eq!(fx.git(&["diff", "--cached", "--name-only"]), "f1.txt");
+    assert_eq!(fx.git(&["diff", "--name-only"]), "f2.txt");
+    assert!(fx.git(&["stash", "list"]).is_empty());
+}
+
+#[test]
+fn local_changes_come_back_after_a_conflicting_merge_is_committed() {
+    let (fx, _ids) = linear();
+    let repo = fx.repo();
+    fx.git(&["checkout", "-q", "-b", "side", "HEAD~1"]);
+    fx.write("f4.txt", "side\n");
+    fx.git(&["add", "f4.txt"]);
+    fx.git(&["commit", "-q", "-m", "side f4"]);
+    fx.git(&["checkout", "-q", "main"]);
+    fx.write("f1.txt", "staged\n");
+    fx.git(&["add", "f1.txt"]);
+    assert!(repo.merge_with(&["side".to_string()], &MergeOptions::default()).is_err());
+    assert_eq!(repo.branch_info().unwrap().operation.as_deref(), Some("merge"));
+    assert_eq!(fx.read("f1.txt"), "1\n", "put aside while the merge is in progress");
+    fx.write("f4.txt", "both\n");
+    repo.stage(&[fx.path("f4.txt")]).unwrap();
+    repo.commit("Merge side", false, false).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None);
+    assert_eq!(fx.read("f1.txt"), "staged\n");
+    assert_eq!(fx.git(&["diff", "--cached", "--name-only"]), "f1.txt");
+    assert!(fx.git(&["stash", "list"]).is_empty());
+}
@@ -662,3 +662,45 @@ fn shelf_new_renames_keep_self_contained_sides_and_plain_imports_keep_scope() {
    shelf::delete_path(&shelf, "plain", Some("one.txt")).unwrap();
    assert_eq!(shelf::list(&shelf).unwrap().iter().find(|s| s.id == "plain").unwrap().files[0].path, "two.txt");
 }
+
+#[test]
+fn cherry_pick_skips_commits_already_applied() {
+    let fx = Fixture::new();
+    fx.write("a.txt", "1\n");
+    fx.commit_all("base");
+    fx.git(&["checkout", "-q", "-b", "side"]);
+    fx.write("a.txt", "2\n");
+    let same = fx.commit_all("same change");
+    fx.write("b.txt", "b\n");
+    let other = fx.commit_all("other change");
+    fx.git(&["checkout", "-q", "main"]);
+    // main already has the first change.
+    fx.write("a.txt", "2\n");
+    fx.commit_all("same change, made on main");
+    let repo = fx.repo();
+    let cancel = CancellationToken::new();
+    let lines = std::sync::Mutex::new(Vec::new());
+    let out = |l: String| lines.lock().unwrap().push(l);
+
+    repo.cherry_pick_with(&[same.clone(), other], true, &cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None, "nothing left in progress");
+    assert_eq!(fx.git(&["log", "--format=%s", "-2"]), "other change\nsame change, made on main");
+    assert!(fx.git(&["log", "-1", "--format=%B"]).contains("(cherry picked from commit"));
+    assert!(lines.lock().unwrap().iter().any(|l| l.starts_with(&same[..8]) && l.contains("skipped")));
+}
+
+#[test]
+fn revert_of_a_commit_already_reverted_is_skipped() {
+    let fx = Fixture::new();
+    fx.write("a.txt", "1\n");
+    fx.commit_all("one");
+    fx.write("a.txt", "2\n");
+    let two = fx.commit_all("two");
+    fx.write("a.txt", "1\n");
+    fx.commit_all("undo two by hand");
+    let repo = fx.repo();
+    let (cancel, out) = quiet();
+    repo.revert(&[two], &cancel, &out).unwrap();
+    assert_eq!(repo.branch_info().unwrap().operation, None);
+    assert_eq!(fx.git(&["rev-list", "--count", "HEAD"]), "3", "no empty revert commit");
+}
				`@@ -0,0 +1 @@`
				`87eb2a28875abbc649b98d2a7f87263da217f9ad28f1395d96a61db5f781d9f0`