fix(project-tree): list a re-installed SNAPSHOT's entries after reloading the project

A SNAPSHOT installed again replaces its jar in place, which no file watcher
reports, so folders already expanded inside it under External Libraries kept
the old entries, even after collapsing and expanding them again. The project
view now re-reads its loaded folders inside archives when project roots change
(a build tool sync); the backend's archive listing already follows the jar's
modification time and size.

Cargo.lock

@@ -4144,7 +4144,7 @@ checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
 [[package]]
 name = "ide-agent"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dunce",
  "encoding_rs",
@@ -4168,7 +4168,7 @@ dependencies = [
 
 [[package]]
 name = "ide-analysis"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ast-grep-core",
  "ide-core",
@@ -4182,7 +4182,7 @@ dependencies = [
 
 [[package]]
 name = "ide-android"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "serde",
@@ -4193,7 +4193,7 @@ dependencies = [
 
 [[package]]
 name = "ide-build"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "blake3",
  "chardetng",
@@ -4211,7 +4211,7 @@ dependencies = [
 
 [[package]]
 name = "ide-cli"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dirs 6.0.0",
  "serde",
@@ -4225,7 +4225,7 @@ dependencies = [
 
 [[package]]
 name = "ide-clipboard"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "gtk",
  "objc2 0.6.5",
@@ -4235,7 +4235,7 @@ dependencies = [
 
 [[package]]
 name = "ide-core"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dunce",
  "encoding_rs",
@@ -4252,7 +4252,7 @@ dependencies = [
 
 [[package]]
 name = "ide-coverage"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "ide-run",
@@ -4266,7 +4266,7 @@ dependencies = [
 
 [[package]]
 name = "ide-dap"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "futures",
  "ide-core",
@@ -4292,7 +4292,7 @@ dependencies = [
 
 [[package]]
 name = "ide-db"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "base64 0.22.1",
  "bb8",
@@ -4328,7 +4328,7 @@ dependencies = [
 
 [[package]]
 name = "ide-docker"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "serde",
@@ -4341,7 +4341,7 @@ dependencies = [
 
 [[package]]
 name = "ide-extension"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -4362,7 +4362,7 @@ dependencies = [
 
 [[package]]
 name = "ide-fonts"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "objc2-core-foundation",
  "objc2-core-text",
@@ -4374,7 +4374,7 @@ dependencies = [
 
 [[package]]
 name = "ide-github"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "ide-vcs",
@@ -4387,7 +4387,7 @@ dependencies = [
 
 [[package]]
 name = "ide-heap"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "criterion",
  "ide-core",
@@ -4405,7 +4405,7 @@ dependencies = [
 
 [[package]]
 name = "ide-host"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -4476,7 +4476,7 @@ dependencies = [
 
 [[package]]
 name = "ide-http"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "ide-vfs",
@@ -4495,7 +4495,7 @@ dependencies = [
 
 [[package]]
 name = "ide-index"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "blake3",
  "criterion",
@@ -4517,7 +4517,7 @@ dependencies = [
 
 [[package]]
 name = "ide-jdwp"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-jvm-inspect",
  "proptest",
@@ -4529,7 +4529,7 @@ dependencies = [
 
 [[package]]
 name = "ide-jsonrpc"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "encoding_rs",
  "futures",
@@ -4546,7 +4546,7 @@ dependencies = [
 
 [[package]]
 name = "ide-jvm-attach"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "libc",
  "tempfile",
@@ -4555,7 +4555,7 @@ dependencies = [
 
 [[package]]
 name = "ide-jvm-inspect"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "futures",
  "serde",
@@ -4566,7 +4566,7 @@ dependencies = [
 
 [[package]]
 name = "ide-language"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "blake3",
  "criterion",
@@ -4623,7 +4623,7 @@ dependencies = [
 
 [[package]]
 name = "ide-lsp"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dunce",
  "encoding_rs",
@@ -4651,7 +4651,7 @@ dependencies = [
 
 [[package]]
 name = "ide-mcp"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "bytes",
  "dunce",
@@ -4670,7 +4670,7 @@ dependencies = [
 
 [[package]]
 name = "ide-notebook"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "futures",
  "ide-core",
@@ -4693,7 +4693,7 @@ dependencies = [
 
 [[package]]
 name = "ide-plugin"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "blake3",
  "dunce",
@@ -4716,7 +4716,7 @@ dependencies = [
 
 [[package]]
 name = "ide-profiler"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "ide-jvm-attach",
@@ -4730,7 +4730,7 @@ dependencies = [
 
 [[package]]
 name = "ide-remote"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dunce",
  "futures",
@@ -4750,7 +4750,7 @@ dependencies = [
 
 [[package]]
 name = "ide-run"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dunce",
  "encoding_rs",
@@ -4774,7 +4774,7 @@ dependencies = [
 
 [[package]]
 name = "ide-scaffold"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "ide-tools",
@@ -4790,7 +4790,7 @@ dependencies = [
 
 [[package]]
 name = "ide-sdk"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dunce",
  "ide-core",
@@ -4811,7 +4811,7 @@ dependencies = [
 
 [[package]]
 name = "ide-search"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "criterion",
  "encoding_rs",
@@ -4832,7 +4832,7 @@ dependencies = [
 
 [[package]]
 name = "ide-spell"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "parking_lot",
@@ -4845,7 +4845,7 @@ dependencies = [
 
 [[package]]
 name = "ide-ssh"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dirs 6.0.0",
  "flate2",
@@ -4870,7 +4870,7 @@ dependencies = [
 
 [[package]]
 name = "ide-syntax"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "ide-language",
@@ -4885,7 +4885,7 @@ dependencies = [
 
 [[package]]
 name = "ide-terminal"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "ide-core",
  "libc",
@@ -4898,7 +4898,7 @@ dependencies = [
 
 [[package]]
 name = "ide-text"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "criterion",
  "ide-core",
@@ -4911,7 +4911,7 @@ dependencies = [
 
 [[package]]
 name = "ide-tools"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "flate2",
  "hex",
@@ -4932,7 +4932,7 @@ dependencies = [
 
 [[package]]
 name = "ide-vcs"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "blake3",
  "dunce",
@@ -4953,7 +4953,7 @@ dependencies = [
 
 [[package]]
 name = "ide-vfs"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "chardetng",
  "dunce",
@@ -4977,7 +4977,7 @@ dependencies = [
 
 [[package]]
 name = "ide-web"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "dirs 6.0.0",
  "ide-core",
@@ -4993,7 +4993,7 @@ dependencies = [
 
 [[package]]
 name = "ide-workspace"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "blake3",
  "dunce",
@@ -6594,7 +6594,7 @@ dependencies = [
 
 [[package]]
 name = "openidea"
-version = "0.1.43"
+version = "0.1.44"
 dependencies = [
  "base64 0.22.1",
  "blake3",

Cargo.toml

@@ -5,7 +5,7 @@ members = ["crates/*", "src-tauri"]
 exclude = ["sdk", "plugins"]
 
 [workspace.package]
-version = "0.1.43"
+version = "0.1.44"
 edition = "2024"
 rust-version = "1.96"
 license = "Apache-2.0"

crates/ide-agent/src/worktree.rs

@@ -225,6 +225,15 @@ fn same_file(a: &Path, b: &Path) -> bool {
     }
 }
 
+/// The bytes of `path` (`Some(None)`: no file there), or `None` when it is there but can't be read.
+fn existing(path: &Path) -> Option<Option<Vec<u8>>> {
+    match std::fs::read(path) {
+        Ok(bytes) => Some(Some(bytes)),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Some(None),
+        Err(_) => None,
+    }
+}
+
 fn crlf_to_lf(bytes: &[u8]) -> Vec<u8> {
     let mut out = Vec::with_capacity(bytes.len());
     for (i, &b) in bytes.iter().enumerate() {
@@ -411,25 +420,31 @@ pub(crate) fn accept(
     let copyable = |rel: &str| task_side.allows(rel) && checkout_side.allows(rel);
     let renamed_from: BTreeMap<String, String> =
         repo.diff_with_worktree(base)?.into_iter().filter_map(|f| Some((f.path, f.old_path?))).collect();
-    // Brings one path of the checkout to the task's version, unless the checkout changed it itself.
-    let apply = |rel: &str| -> IdeResult<bool> {
-        let local = local_root.join(rel);
+    // The task's version of one path of the checkout (`Some(None)`: absent there), or `None` when
+    // the checkout changed it itself.
+    let target = |rel: &str| -> IdeResult<Option<Option<Vec<u8>>>> {
         let in_task = repo.root().join(rel);
-        let base_bytes = repo.file_bytes_at(&in_task, Some(base))?;
         let current = std::fs::read(&in_task).ok();
-        let local_bytes = std::fs::read(&local).ok();
+        // A file there that can't be read is the checkout's own: never written over.
+        let Some(local_bytes) = existing(&local_root.join(rel)) else { return Ok(None) };
         if local_bytes == current {
-            return Ok(true);
+            return Ok(Some(current));
         }
+        let base_bytes = repo.file_bytes_at(&in_task, Some(base))?;
         // The checkout may hold the committed LF text with CRLF line ends (`core.autocrlf`).
         let unchanged = match (&local_bytes, &base_bytes) {
             (Some(now), Some(at_base)) => now == at_base || crlf_to_lf(now) == *at_base,
             (now, at_base) => now == at_base,
         };
-        if !unchanged {
-            return Ok(false);
+        Ok(unchanged.then_some(current))
+    };
+    // Puts `bytes` (`None`: nothing) at `rel` of the checkout.
+    let write = |rel: &str, bytes: Option<Vec<u8>>| -> IdeResult<()> {
+        let local = local_root.join(rel);
+        if std::fs::read(&local).ok() == bytes {
+            return Ok(());
         }
-        match current {
+        match bytes {
             Some(bytes) => {
                 if let Some(parent) = local.parent() {
                     std::fs::create_dir_all(parent)?;
@@ -441,6 +456,12 @@ pub(crate) fn accept(
                 _ => {}
             },
         }
+        Ok(())
+    };
+    // Brings one path of the checkout to the task's version, unless the checkout changed it itself.
+    let apply = |rel: &str| -> IdeResult<bool> {
+        let Some(bytes) = target(rel)? else { return Ok(false) };
+        write(rel, bytes)?;
         Ok(true)
     };
     let mut accepted = Vec::with_capacity(changes.len());
@@ -466,8 +487,9 @@ pub(crate) fn accept(
         // A case-only rename (`a.txt` → `A.txt`). Where the disk resolves both
         // spellings to one file it is renamed in place and `apply` then refreshes
         // the content. On a case-sensitive disk the two names are different files:
-        // the old one's unchanged-ness (it is the file the checkout had) decides —
-        // then the task's version lands at the new name and the old one goes.
+        // both are checked before either changes — the old one must be the file the
+        // checkout had, the new one absent or already the task's — then the task's
+        // version lands at the new name before the old one goes.
         let case_only =
             old.is_some_and(|o| o != &change.rel_path && o.to_lowercase() == change.rel_path.to_lowercase());
         if case_only {
@@ -476,20 +498,18 @@ pub(crate) fn accept(
             if same_file(&old_path, &new_path) {
                 std::fs::rename(&old_path, &new_path)?;
             } else {
-                if !apply(old)? {
+                let Some(old_target) = target(old)? else {
                     skipped.push(skip(old));
                     continue;
+                };
+                let task_bytes = std::fs::read(repo.root().join(&change.rel_path)).ok();
+                let at_new = existing(&new_path);
+                if at_new.as_ref().is_none_or(|at_new| at_new.is_some() && *at_new != task_bytes) {
+                    skipped.push(skip(&change.rel_path));
+                    continue;
                 }
-                // `apply(old)` removed the old file (the task's tree has it only at
-                // the new name); now write that version under the new name. `apply`
-                // can't do it — it reads the new name's own base/absence — so the
-                // write is open-coded from the same task bytes `apply` would use.
-                if let Ok(bytes) = std::fs::read(repo.root().join(&change.rel_path)) {
-                    if let Some(parent) = new_path.parent() {
-                        std::fs::create_dir_all(parent)?;
-                    }
-                    std::fs::write(&new_path, bytes)?;
-                }
+                write(&change.rel_path, task_bytes)?;
+                write(old, old_target)?;
                 accepted.push(change.rel_path.clone());
                 continue;
             }
@@ -960,6 +980,41 @@ mod tests {
         assert_eq!(names, ["A.txt"]);
     }
 
+    #[test]
+    fn a_case_only_rename_keeps_a_file_the_checkout_has_at_the_new_name() {
+        let (_tmp, repo, created) = accept_repo();
+        std::fs::write(repo.join("A.txt"), "mine\n").unwrap();
+        if std::fs::read_to_string(repo.join("a.txt")).unwrap() == "mine\n" {
+            eprintln!("this disk doesn't tell a.txt from A.txt; nothing to check");
+            return;
+        }
+        git(&created.path, &["mv", "a.txt", "A.txt"]);
+        let changes = listed(&created.path, &created.base_commit);
+        let outcome = accept(&repo, &created.path, &created.base_commit, &changes).unwrap();
+        assert_eq!(outcome.skipped.iter().map(|s| s.path.as_str()).collect::<Vec<_>>(), ["A.txt"]);
+        assert_eq!(std::fs::read_to_string(repo.join("A.txt")).unwrap(), "mine\n");
+        assert_eq!(std::fs::read_to_string(repo.join("a.txt")).unwrap(), "one\ntwo\n");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn accept_leaves_a_checkout_file_it_cannot_read() {
+        use std::os::unix::fs::PermissionsExt;
+        let (_tmp, repo, created) = accept_repo();
+        std::fs::write(created.path.join("new.txt"), "task\n").unwrap();
+        std::fs::write(repo.join("new.txt"), "mine\n").unwrap();
+        std::fs::set_permissions(repo.join("new.txt"), std::fs::Permissions::from_mode(0o200)).unwrap();
+        if std::fs::read(repo.join("new.txt")).is_ok() {
+            eprintln!("running as a user that reads any file; nothing to check");
+            return;
+        }
+        let changes = listed(&created.path, &created.base_commit);
+        let outcome = accept(&repo, &created.path, &created.base_commit, &changes).unwrap();
+        std::fs::set_permissions(repo.join("new.txt"), std::fs::Permissions::from_mode(0o644)).unwrap();
+        assert_eq!(outcome.skipped.iter().map(|s| s.path.as_str()).collect::<Vec<_>>(), ["new.txt"]);
+        assert_eq!(std::fs::read_to_string(repo.join("new.txt")).unwrap(), "mine\n");
+    }
+
     #[cfg(windows)]
     #[test]
     fn accept_does_not_write_into_the_checkouts_git_folder_through_its_short_name() {

crates/ide-build/src/compile/mod.rs

@@ -12,7 +12,8 @@ mod up_to_date;
 pub use fingerprint::{LaunchFingerprint, launch_fingerprint, menu_fingerprint};
 pub use launch_resources::process_launch_resources;
 pub use single::{
-    SingleFileTarget, compile_file_plan, find_javac, javac_step, single_file_classpath, single_file_target,
+    SingleFileTarget, compile_file_plan, find_javac, javac_step, module_classpath, single_file_classpath,
+    single_file_target,
 };
 pub use up_to_date::{menu_up_to_date, record_menu_build};
 

crates/ide-build/src/compile/single.rs

@@ -4,12 +4,21 @@
 //! walks the whole reactor; compiling one file only needs that file's module
 //! outputs plus its dependency classpath, which is much faster to assemble.
 use super::*;
+use serde::{Deserialize, Serialize};
 use std::fs;
 use std::process::Command as ProcCommand;
 
 /// Output file of the `dependency:build-classpath` probe, relative to each module.
 const CP_FILE: &str = "target/ide-compile-cp.txt";
 
+/// The resolved dependency classpath for one module and scope, tied to the same
+/// inputs as its launch build so POM, JDK, settings and profile changes invalidate it.
+#[derive(Debug, Deserialize, Serialize)]
+struct CachedClasspath {
+    fingerprint: LaunchFingerprint,
+    classpath: String,
+}
+
 /// A `.java` source and the module build that compiles it.
 pub struct SingleFileTarget {
     /// Absolute module directory.
@@ -64,6 +73,28 @@ pub fn single_file_target(root: &Path, model: &BuildModel, file: &Path) -> IdeRe
     Ok(SingleFileTarget { module, test, out_dir, top: top.clone(), pl, java_version: project.java_version })
 }
 
+/// The Maven reactor target for a launch module whose source file is not known yet.
+fn module_target(root: &Path, model: &BuildModel, module: &Path, test: bool) -> IdeResult<SingleFileTarget> {
+    let Some(m) = &model.maven else {
+        return Err(IdeError::not_found("no linked Maven project found for module"));
+    };
+    let module = if module.is_absolute() { module.to_path_buf() } else { root.join(module) };
+    let project = m
+        .projects
+        .iter()
+        .find(|p| root.join(&p.dir) == module)
+        .ok_or_else(|| IdeError::not_found("no linked Maven project found for module"))?;
+    if project.packaging == "pom" {
+        return Err(IdeError::not_found("the launch module is a Maven aggregator without sources"));
+    }
+    let top = maven_reactor(m, &project.dir)
+        .ok_or_else(|| IdeError::not_found("no linked Maven reactor found for module"))?;
+    let top_dir = subdir(root, &top.dir);
+    let pl = module.strip_prefix(&top_dir).map(|r| r.to_string_lossy().replace('\\', "/")).unwrap_or_default();
+    let out_dir = module.join("target").join(if test { "test-classes" } else { "classes" });
+    Ok(SingleFileTarget { module, test, out_dir, top: top.clone(), pl, java_version: project.java_version })
+}
+
 /// `javac` for the module: its `JAVA_HOME`, else `PATH`.
 pub fn find_javac(env: &BTreeMap<String, String>) -> String {
     let home = env.get("JAVA_HOME").map(Path::new);
@@ -78,6 +109,88 @@ pub fn find_javac(env: &BTreeMap<String, String>) -> String {
 /// `mvn dependency:build-classpath` (which resolves without compiling anything,
 /// so `-am` stays cheap). Entries are platform-separated (`;` on Windows).
 pub fn single_file_classpath(root: &Path, model: &BuildModel, target: &SingleFileTarget) -> IdeResult<String> {
+    classpath(root, model, target, "test", false)
+}
+
+/// Runtime (or test) dependency classpath for a launch module.
+///
+/// The Java language server runs on its own JDK, so its Maven model can select a
+/// different JDK profile and dependency classifier than the project launch. Use the
+/// same Maven process that builds the module instead.
+pub fn module_classpath(
+    root: &Path,
+    model: &BuildModel,
+    module: &Path,
+    test: bool,
+    local_repo: Option<PathBuf>,
+    cache: &Path,
+    cancel: &ide_core::CancellationToken,
+) -> IdeResult<String> {
+    let target = module_target(root, model, module, test)?;
+    let fingerprint = launch_fingerprint(root, model, &target.module, test, local_repo, cancel)?;
+    let cache_path = classpath_cache_path(root, cache, &target.module, test);
+    if let (Some(fingerprint), Some(path)) = (&fingerprint, &cache_path)
+        && let Ok(bytes) = fs::read(path)
+        && let Ok(cached) = serde_json::from_slice::<CachedClasspath>(&bytes)
+        && cached.fingerprint == *fingerprint
+        && classpath_entries_exist(root, &cached.classpath)
+    {
+        return Ok(cached.classpath);
+    }
+    let classpath = classpath(root, model, &target, if test { "test" } else { "runtime" }, true)?;
+    if cancel.is_cancelled() {
+        return Err(IdeError::cancelled());
+    }
+    if let (Some(fingerprint), Some(path)) = (fingerprint, cache_path) {
+        let cached = CachedClasspath { fingerprint, classpath: classpath.clone() };
+        if let Err(error) = cache_classpath(&path, &cached) {
+            tracing::debug!(path = %path.display(), %error, "Cannot cache the Java launch classpath");
+        }
+    }
+    Ok(classpath)
+}
+
+/// One cache file per module and scope. Mirroring the module path keeps nested
+/// modules and their different dependency scopes from overwriting each other.
+fn classpath_cache_path(root: &Path, cache: &Path, module: &Path, test: bool) -> Option<PathBuf> {
+    let relative = module.strip_prefix(root).ok()?;
+    let mut path = cache.join("java-launch/classpaths");
+    path.push(if relative.as_os_str().is_empty() { Path::new("_root") } else { relative });
+    path.push(if test { "test.json" } else { "runtime.json" });
+    Some(path)
+}
+
+/// Best-effort cache persistence. A failed write only costs one later Maven
+/// probe, so the launch still succeeds even when the cache directory is unusable.
+fn cache_classpath(path: &Path, cached: &CachedClasspath) -> IdeResult<()> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+    fs::write(path, serde_json::to_vec(cached).map_err(|e| IdeError::internal(e.to_string()))?)?;
+    Ok(())
+}
+
+/// A cache entry stays valid while every file exists. Maven also emits reactor
+/// output directories for modules with no classes, which may legitimately never be
+/// created; the launch snapshot already supplies the module's classes in that case.
+fn classpath_entries_exist(root: &Path, classpath: &str) -> bool {
+    // Temp directories on macOS are commonly reached through `/var`, while Maven
+    // reports the canonical `/private/var` path. Compare against both spellings.
+    let canonical_root = dunce::canonicalize(root).unwrap_or_else(|_| root.to_path_buf());
+    std::env::split_paths(classpath).all(|entry| {
+        entry.exists()
+            || ((entry.starts_with(root) || entry.starts_with(&canonical_root))
+                && (entry.ends_with(Path::new("target/classes")) || entry.ends_with(Path::new("target/test-classes"))))
+    })
+}
+
+fn classpath(
+    root: &Path,
+    model: &BuildModel,
+    target: &SingleFileTarget,
+    scope: &str,
+    compile_first: bool,
+) -> IdeResult<String> {
     let mut entries: Vec<String> = Vec::new();
     // The module's own classes first: the file almost always uses classes next to it.
     let own: &[&str] = if target.test { &["target/test-classes", "target/classes"] } else { &["target/classes"] };
@@ -110,7 +223,14 @@ pub fn single_file_classpath(root: &Path, model: &BuildModel, target: &SingleFil
         args.extend(["-pl", target.pl.as_str(), "-am"]);
     }
     let output_arg = format!("-Dmdep.outputFile={probe}");
-    args.extend(["dependency:build-classpath", output_arg.as_str(), "-Dmdep.includeScope=test", "-q"]);
+    let scope_arg = format!("-Dmdep.includeScope={scope}");
+    // A launch build may only have reached `compile`. Running `compile` in this
+    // same Maven session lets the dependency plugin resolve Reactor siblings from
+    // their target/classes without paying for package-phase plugins.
+    if compile_first {
+        args.push("compile");
+    }
+    args.extend(["dependency:build-classpath", output_arg.as_str(), scope_arg.as_str(), "-q"]);
     let top_dir = subdir(root, &target.top.dir);
     let status = ProcCommand::new(&target.top.command)
         .args(&args)
@@ -119,8 +239,10 @@ pub fn single_file_classpath(root: &Path, model: &BuildModel, target: &SingleFil
         .output()
         .map_err(|e| IdeError::internal(format!("cannot resolve the compile classpath: {e}")))?;
     if !status.status.success() {
+        let stdout = String::from_utf8_lossy(&status.stdout);
         let stderr = String::from_utf8_lossy(&status.stderr);
-        let tail: Vec<&str> = stderr.lines().filter(|l| !l.trim().is_empty()).collect();
+        // Maven reports reactor/dependency failures on stdout, not only stderr.
+        let tail: Vec<&str> = stdout.lines().chain(stderr.lines()).filter(|l| !l.trim().is_empty()).collect();
         let tail = tail.iter().rev().take(5).rev().cloned().collect::<Vec<_>>().join("\n");
         return Err(IdeError::internal(format!("cannot resolve the compile classpath:\n{tail}")));
     }
@@ -305,7 +427,7 @@ mod tests {
         let script = root.join("mvnw");
         fs::write(
             &script,
-            "#!/bin/sh\npl='.'\nwhile [ $# -gt 0 ]; do\nif [ \"$1\" = \"-pl\" ]; then pl=\"$2\"; shift 2; else shift; fi\ndone\nmkdir -p \"$pl/target\"\nprintf '/repo/a.jar:/repo/b.jar' > \"$pl/target/ide-compile-cp.txt\"\n",
+            "#!/bin/sh\nprintf '%s\\n' \"$@\" > args.txt\npl='.'\nwhile [ $# -gt 0 ]; do\nif [ \"$1\" = \"-pl\" ]; then pl=\"$2\"; shift 2; else shift; fi\ndone\nmkdir -p \"$pl/target\"\nprintf '/repo/a.jar:/repo/b.jar' > \"$pl/target/ide-compile-cp.txt\"\n",
         )
         .unwrap();
         fs::set_permissions(&script, fs::Permissions::from_mode(0o755)).unwrap();
@@ -327,5 +449,90 @@ mod tests {
         assert!(cp.contains("/repo/a.jar"), "{cp}");
         assert!(cp.contains("/repo/b.jar"), "{cp}");
         assert!(cp.split(separator).count() >= 3, "{cp}");
+        let args = fs::read_to_string(root.join("args.txt")).unwrap();
+        assert!(!args.lines().any(|a| a == "compile" || a == "package"), "{args}");
+    }
+
+    /// A launch uses runtime dependencies, while tests additionally see test-scope ones.
+    #[cfg(unix)]
+    #[test]
+    fn launch_module_classpath_uses_the_matching_dependency_scope() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        fixture(root);
+        let script = root.join("mvnw");
+        fs::write(
+            &script,
+            "#!/bin/sh\nprintf '%s\\n' \"$@\" > args.txt\npl='.'\nwhile [ $# -gt 0 ]; do\nif [ \"$1\" = \"-pl\" ]; then pl=\"$2\"; shift 2; else shift; fi\ndone\nmkdir -p \"$pl/target\"\nprintf '/repo/runtime.jar:/repo/test.jar' > \"$pl/target/ide-compile-cp.txt\"\n",
+        )
+        .unwrap();
+        fs::set_permissions(&script, fs::Permissions::from_mode(0o755)).unwrap();
+        let model = crate::load(root, &root.join("cache"), None);
+
+        let cache = root.join("cache");
+        let runtime =
+            module_classpath(root, &model, &root.join("app"), false, None, &cache, &CancellationToken::new()).unwrap();
+        assert!(runtime.contains("/repo/runtime.jar"), "{runtime}");
+        let args = fs::read_to_string(root.join("args.txt")).unwrap();
+        assert!(args.lines().any(|a| a == "compile"), "{args}");
+        assert!(!args.lines().any(|a| a == "package"), "{args}");
+        assert!(args.lines().any(|a| a == "-Dmdep.includeScope=runtime"), "{args}");
+
+        let test =
+            module_classpath(root, &model, &root.join("app"), true, None, &cache, &CancellationToken::new()).unwrap();
+        assert!(test.contains("/repo/test.jar"), "{test}");
+        let args = fs::read_to_string(root.join("args.txt")).unwrap();
+        assert!(args.lines().any(|a| a == "-Dmdep.includeScope=test"), "{args}");
+    }
+
+    /// The launch classpath follows the Maven runner JDK and is reused until that
+    /// build input changes; the probe does not run packaging plugins.
+    #[cfg(unix)]
+    #[test]
+    fn launch_classpath_cache_follows_the_runner_jdk() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        fixture(root);
+        let script = root.join("mvnw");
+        // `dependency:build-classpath` reports reactor outputs as absolute paths. Keep
+        // the fake probe faithful so the cache's existence check sees the output.
+        fs::write(
+            &script,
+            "#!/bin/sh\nprintf x >> calls.txt\npl='.'\nwhile [ $# -gt 0 ]; do\nif [ \"$1\" = \"-pl\" ]; then pl=\"$2\"; shift 2; else shift; fi\ndone\nmkdir -p \"$pl/target/classes\" \"$JAVA_HOME/classpath\"\n: > \"$JAVA_HOME/classpath/jdk.jar\"\nprintf '%s/classpath/jdk.jar:%s/%s/target/classes:%s/empty/target/classes' \"$JAVA_HOME\" \"$(pwd)\" \"$pl\" \"$(pwd)\" > \"$pl/target/ide-compile-cp.txt\"\n",
+        )
+        .unwrap();
+        fs::set_permissions(&script, fs::Permissions::from_mode(0o755)).unwrap();
+        let mut model = crate::load(root, &root.join("cache"), None);
+        for (name, version) in [("jdk21", "21"), ("jdk8", "8")] {
+            let home = root.join(name);
+            fs::create_dir_all(home.join("bin")).unwrap();
+            fs::write(home.join("release"), format!("JAVA_VERSION=\"{version}\"\n")).unwrap();
+            fs::write(home.join("bin/java"), "").unwrap();
+        }
+        let cache = root.join("classpath-cache");
+        let cancel = CancellationToken::new();
+        let jdk21 = root.join("jdk21");
+        for project in &mut model.maven.as_mut().unwrap().projects {
+            project.env.insert("JAVA_HOME".into(), jdk21.to_string_lossy().into_owned());
+        }
+        let first = module_classpath(root, &model, &root.join("app"), false, None, &cache, &cancel).unwrap();
+        assert!(first.contains("jdk21/classpath/jdk.jar"), "{first}");
+        assert!(!first.contains("jdk8/classpath/jdk.jar"), "{first}");
+        let second = module_classpath(root, &model, &root.join("app"), false, None, &cache, &cancel).unwrap();
+        assert_eq!(second, first);
+        assert_eq!(fs::read_to_string(root.join("calls.txt")).unwrap(), "x");
+
+        let jdk8 = root.join("jdk8");
+        for project in &mut model.maven.as_mut().unwrap().projects {
+            project.env.insert("JAVA_HOME".into(), jdk8.to_string_lossy().into_owned());
+        }
+        let switched = module_classpath(root, &model, &root.join("app"), false, None, &cache, &cancel).unwrap();
+        assert!(switched.contains("jdk8/classpath/jdk.jar"), "{switched}");
+        assert!(!switched.contains("jdk21/classpath/jdk.jar"), "{switched}");
+        assert_eq!(fs::read_to_string(root.join("calls.txt")).unwrap(), "xx");
     }
 }

crates/ide-build/src/maven.rs

@@ -712,18 +712,27 @@ pub(crate) fn launch_inputs(
         // Profile activation may depend on the presence of an otherwise unrelated file.
         let activation = parent == "file" && matches!(el.name.as_str(), "exists" | "missing");
         if input || activation {
-            // Other properties can be overridden by -D, profiles or settings.
-            // Without Maven's effective roots, conservatively disable reuse for them.
-            let value = el
-                .text
-                .trim()
-                .replace("${project.basedir}", &dir.to_string_lossy())
-                .replace("${basedir}", &dir.to_string_lossy());
-            if value.contains("${") {
-                return None;
-            }
-            if !value.is_empty() {
-                out.push(dir.join(value));
+            // A source root under Maven's build directory is generated by the build itself.
+            // Skip it without resolving the property: `<build><directory>` may be custom, and
+            // hashing its rewritten files would make every launch look changed.
+            if !(input && el.text.contains("${project.build.directory}")) {
+                // Other properties can be overridden by -D, profiles or settings. Without
+                // Maven's effective model, leave them unresolved to conservatively disable reuse.
+                let value = el
+                    .text
+                    .trim()
+                    .replace("${project.basedir}", &dir.to_string_lossy())
+                    .replace("${basedir}", &dir.to_string_lossy());
+                if value.contains("${") {
+                    return None;
+                }
+                if !value.is_empty() {
+                    let path = dir.join(value);
+                    // Conventional generated sources under target are also build outputs.
+                    if !(input && path.starts_with(dir.join("target"))) {
+                        out.push(path);
+                    }
+                }
             }
         }
         for child in &el.children {
@@ -2140,6 +2149,52 @@ mod tests {
         assert_eq!(known.goals, ["compile", "help", "testCompile"], "the common plugins keep their table");
     }
 
+    #[test]
+    fn launch_inputs_skip_generated_sources_under_the_project_build_directory() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(
+            root,
+            "pom.xml",
+            "<project><groupId>demo</groupId><artifactId>parent</artifactId><version>1</version>\
+             <packaging>pom</packaging><modules><module>app</module></modules></project>",
+        );
+        write(
+            root,
+            "app/pom.xml",
+            r#"<project><parent><groupId>demo</groupId><artifactId>parent</artifactId><version>1</version></parent>
+               <artifactId>app</artifactId><build><plugins><plugin>
+                 <groupId>org.codehaus.mojo</groupId><artifactId>build-helper-maven-plugin</artifactId>
+                 <executions><execution><configuration><sources>
+                   <source>${project.build.directory}/generated-sources/java</source>
+                 </sources></configuration></execution></executions>
+               </plugin></plugins></build></project>"#,
+        );
+        let model = load_with_repo(root, None);
+        let projects: Vec<&MavenProject> = model.projects.iter().collect();
+        let inputs = launch_inputs(root, &projects, None).expect("portable launch inputs");
+        assert!(!inputs.contains(&root.join("app/target/generated-sources/java")), "{inputs:?}");
+        assert!(inputs.contains(&root.join("app/src")), "conventional sources stay fingerprinted");
+    }
+
+    #[test]
+    fn launch_inputs_disable_reuse_for_file_activation_on_the_build_directory() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(
+            root,
+            "pom.xml",
+            r#"<project><groupId>demo</groupId><artifactId>app</artifactId><version>1</version>
+               <build><directory>${project.basedir}/custom-build</directory></build>
+               <profiles><profile><id>generated</id><activation><file>
+                 <exists>${project.build.directory}/enable-profile</exists>
+               </file></activation></profile></profiles></project>"#,
+        );
+        let model = load_with_repo(root, None);
+        let projects: Vec<&MavenProject> = model.projects.iter().collect();
+        assert!(launch_inputs(root, &projects, None).is_none());
+    }
+
     fn write(dir: &Path, rel: &str, text: &str) {
         let p = dir.join(rel);
         std::fs::create_dir_all(p.parent().unwrap()).unwrap();

crates/ide-build/src/maven/completion.rs

@@ -393,11 +393,13 @@ fn scan_versions(dir: &Path, typed: &str, budget: &mut u32) -> Vec<PomCompletion
     out
 }
 
-/// The repository directory of the `/`-separated `coordinates` (a group id, or
-/// a group and an artifact id), each segment validated against the layout's
-/// alphabet so POM text cannot walk outside `repo`.
+/// The repository directory of `coordinates` (a group id, or a group and an artifact
+/// id): the group's dots are directories, an artifact id is one directory whatever dots
+/// it has (`org/eclipse/platform/org.eclipse.core.runtime`). Each segment is validated
+/// against the layout's alphabet so POM text cannot walk outside `repo`.
 fn repo_dir(repo: &Path, coordinates: &[&str]) -> Option<PathBuf> {
-    let segments: Vec<&str> = coordinates.iter().flat_map(|c| c.split('.')).collect();
+    let (group, artifact) = coordinates.split_first()?;
+    let segments: Vec<&str> = group.split('.').chain(artifact.iter().copied()).collect();
     segments.iter().all(|s| segment(s)).then(|| segments.iter().fold(repo.to_path_buf(), |p, s| p.join(s)))
 }
 
@@ -460,6 +462,7 @@ mod tests {
             "org/example/lib/2.0-beta-1/lib-2.0-beta-1.jar",
             "org/example/lib/2.0/lib-2.0.pom",
             "net/nu/netty/4.1.100/netty-4.1.100.jar",
+            "org/eclipse/platform/org.eclipse.core.runtime/3.31.0/org.eclipse.core.runtime-3.31.0.jar",
             // Failed downloads (a version typed while editing): tracking files only, not installed.
             "org/example/lib/2/lib-2.jar.lastUpdated",
             "org/example/lib/3.0/lib-3.0.pom.lastUpdated",
@@ -570,9 +573,10 @@ mod tests {
         };
         // Only directories holding artifacts are group ids: `net` and `org`
         // alone never receive an install, their deeper levels do.
-        assert_eq!(options(""), ["net.nu", "org.apache.maven", "org.apache.maven.plugins", "org.example"]);
-        assert_eq!(options("org"), ["org.apache.maven", "org.apache.maven.plugins", "org.example"]);
-        assert_eq!(options("org."), ["org.apache.maven", "org.apache.maven.plugins", "org.example"]);
+        let org = ["org.apache.maven", "org.apache.maven.plugins", "org.eclipse.platform", "org.example"];
+        assert_eq!(options(""), [&["net.nu"][..], &org].concat());
+        assert_eq!(options("org"), org);
+        assert_eq!(options("org."), org);
         assert_eq!(options("org.spr"), Vec::<String>::new());
         assert_eq!(options("net."), ["net.nu"]);
     }
@@ -623,6 +627,19 @@ mod tests {
         };
         assert_eq!(options(""), ["2.0", "2.0-beta-1", "1.10", "1.9.1", "1.0"]);
         assert_eq!(options("1."), ["1.10", "1.9.1", "1.0"]);
+        // An artifact id with dots is one directory.
+        let dotted = local_options(
+            &repo,
+            &PomCompletionTarget {
+                from: 0,
+                to: 0,
+                typed: "".into(),
+                kind: PomCompletionKind::Version,
+                group: Some("org.eclipse.platform".into()),
+                artifact: Some("org.eclipse.core.runtime".into()),
+            },
+        );
+        assert_eq!(dotted.into_iter().map(|o| o.label).collect::<Vec<_>>(), ["3.31.0"]);
     }
 
     #[test]

crates/ide-build/src/sync.rs

@@ -270,6 +270,13 @@ fn run(
 
 /// The first error lines of a failed build, for the tool window.
 pub(crate) fn error_summary(text: &str) -> String {
+    // The JVM's "could not find or load main class" (localized) when `gradlew` has no jar.
+    if text.contains("org.gradle.wrapper.GradleWrapperMain") {
+        return "gradle/wrapper/gradle-wrapper.jar is missing (often excluded by a `*.jar` rule in .gitignore). \
+                Restore it, run `gradle wrapper` with an installed Gradle, or choose Distribution: Local installation \
+                in Settings › Build, Execution, Deployment › Gradle."
+            .to_owned();
+    }
     let lines: Vec<&str> = text
         .lines()
         .filter(|l| {
@@ -909,6 +916,8 @@ mod tests {
         let text = "[INFO] x\n[ERROR] Failed to execute goal\n[ERROR] \n[ERROR] Re-run Maven using -X\n";
         assert_eq!(error_summary(text), "Failed to execute goal");
         assert_eq!(error_summary("one\nlast line\n\n"), "last line");
+        let missing_jar = "错误: 找不到或无法加载主类 org.gradle.wrapper.GradleWrapperMain\n";
+        assert!(error_summary(missing_jar).starts_with("gradle/wrapper/gradle-wrapper.jar is missing"));
     }
 
     #[test]

crates/ide-core/src/event.rs

@@ -77,6 +77,9 @@ pub enum IdeEvent {
     WorkspaceEditApplied {
         id: u32,
         paths: Vec<crate::IpcPath>,
+        /// Made by an agent through the MCP server's tools: undoable like a refactoring, but
+        /// not announced as one.
+        by_agent: bool,
     },
     /// An open document's language changed (Settings › File Types, Override File
     /// Type), or its UI mode (a framework's root marker appeared or went).

crates/ide-core/src/remote_settings.rs

@@ -77,6 +77,8 @@ pub enum AutoUpload {
 #[serde(default, rename_all = "camelCase")]
 pub struct DeploymentSettings {
     pub servers: Vec<DeploymentServer>,
+    /// Server groups: Upload to… on a group uploads to each of its servers.
+    pub groups: Vec<DeploymentGroup>,
     /// Server used by Upload / Download / Sync and automatic upload; empty = none.
     pub default_server: String,
     pub auto_upload: AutoUpload,
@@ -92,6 +94,7 @@ impl Default for DeploymentSettings {
     fn default() -> Self {
         Self {
             servers: Vec::new(),
+            groups: Vec::new(),
             default_server: String::new(),
             auto_upload: AutoUpload::Never,
             delete_remote: false,
@@ -103,6 +106,16 @@ impl Default for DeploymentSettings {
     }
 }
 
+/// Named set of deployment servers that files are uploaded to together.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct DeploymentGroup {
+    pub id: String,
+    pub name: String,
+    /// [`DeploymentServer::id`]s, in upload order.
+    pub servers: Vec<String>,
+}
+
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub enum DeploymentType {

crates/ide-core/src/settings.rs

@@ -300,11 +300,30 @@ pub struct McpServerSettings {
     pub agent_tab_limit: u32,
     /// Archived agent tabs kept; older ones are closed.
     pub agent_archive_limit: u32,
+    /// Listen on [`Self::port`] in every run, rather than a free port each time, so HTTP clients and
+    /// port forwards keep working after a restart.
+    pub fixed_port: bool,
+    /// The port of [`Self::fixed_port`].
+    pub port: u16,
+    /// Keep the bearer token across runs (in the app data, readable by this user only) rather than
+    /// make a new one each run.
+    pub fixed_token: bool,
 }
 
+/// The default of [`McpServerSettings::port`].
+pub const DEFAULT_MCP_PORT: u16 = 26371;
+
 impl Default for McpServerSettings {
     fn default() -> Self {
-        Self { enabled: false, run_without_confirmation: false, agent_tab_limit: 1, agent_archive_limit: 999 }
+        Self {
+            enabled: false,
+            run_without_confirmation: false,
+            agent_tab_limit: 1,
+            agent_archive_limit: 999,
+            fixed_port: true,
+            port: DEFAULT_MCP_PORT,
+            fixed_token: false,
+        }
     }
 }
 

crates/ide-db/src/conn.rs

@@ -753,7 +753,7 @@ impl Pool {
             return crate::oracle::OraclePool::connect(source, password, &setup).await.map(Pool::Oracle);
         }
         if source.driver == DbDriver::Snowflake {
-            return crate::snowflake::SnowflakePool::connect(source, password, setup).await.map(Pool::Snowflake);
+            return crate::snowflake::SnowflakePool::connect(source, password, setup, root).await.map(Pool::Snowflake);
         }
         let timeout = setup.connect_timeout.unwrap_or(Duration::from_secs(30));
         let init = Arc::new(setup.statements);

crates/ide-db/src/lib.rs

@@ -1491,18 +1491,21 @@ impl DbManager {
         let Some(session) = session else { return Ok(()) };
         let mut held = session.lock().await;
         let Some(mut conn) = held.take() else { return Ok(()) };
-        let result = async {
-            conn.command(if commit { "COMMIT" } else { "ROLLBACK" }).await?;
-            conn.restore_default().await
-        }
-        .await;
-        match result {
-            Ok(()) => Ok(()),
-            Err(e) => {
+        if let Err(e) = conn.command(if commit { "COMMIT" } else { "ROLLBACK" }).await {
+            // Discarding a Snowflake connection doesn't end its session, which the data source's
+            // other targets share: the transaction stays open, so it stays held to be ended again.
+            if matches!(conn, conn::Held::Snowflake(..)) {
+                *held = Some(conn);
+            } else {
                 conn.discard().await;
-                Err(e)
             }
+            return Err(e);
         }
+        if let Err(e) = conn.restore_default().await {
+            conn.discard().await;
+            return Err(e);
+        }
+        Ok(())
     }
 
     #[allow(clippy::too_many_arguments)]

crates/ide-db/src/snowflake/mod.rs

@@ -78,7 +78,8 @@ pub(crate) fn sso_seed(key: &str, token: &str) {
     }
 }
 
-/// Live sessions by their connection settings, so targets opened with the same settings share one.
+/// Live sessions by data source and connection settings, so the targets of one data source (its
+/// databases, the tree, consoles) opened with the same settings share one.
 static SESSIONS: LazyLock<parking_lot::Mutex<HashMap<String, Weak<State>>>> =
     LazyLock::new(|| parking_lot::Mutex::new(HashMap::new()));
 
@@ -106,6 +107,15 @@ struct Lane {
     context: parking_lot::Mutex<Option<String>>,
 }
 
+/// What [`SnowflakePool::statement`] does when the session is gone and it signs in again.
+#[derive(Clone, Copy)]
+enum Lost<'a> {
+    /// Runs the statement again on the new session, after this `USE` when there is one.
+    Enter(Option<&'a str>),
+    /// Fails: the statement was part of a transaction that ended with the session.
+    Fail,
+}
+
 const CONSOLE: usize = 0;
 const METADATA: usize = 1;
 
@@ -251,7 +261,12 @@ fn gunzip(bytes: Vec<u8>) -> IdeResult<Vec<u8>> {
 }
 
 impl SnowflakePool {
-    pub(crate) async fn connect(source: &DataSource, secret: Option<&str>, setup: Setup) -> IdeResult<Self> {
+    pub(crate) async fn connect(
+        source: &DataSource,
+        secret: Option<&str>,
+        setup: Setup,
+        root: Option<&std::path::Path>,
+    ) -> IdeResult<Self> {
         let settings = source.snowflake();
         let endpoint = account::endpoint(source)?;
         let user = source.user.trim();
@@ -302,9 +317,15 @@ impl SnowflakePool {
             lane: CONSOLE,
         };
         // Everything that makes a session what it is, the secret included (hashed: the key is only compared).
+        // The data source and its project too: its databases share a session, but another data source
+        // with the same settings, or the same one in another project (a plugin's source has the same id
+        // in every project), gets its own: its statements and transactions are not this one's. A browser
+        // sign-in is still shared through the cached ID token.
         let key = blake3::hash(
             format!(
-                "{}\0{user}\0{:?}\0{}\0{}\0{}\0{}\0{:?}\0{:?}",
+                "{:?}\0{}\0{}\0{user}\0{:?}\0{}\0{}\0{}\0{}\0{:?}\0{:?}",
+                root,
+                source.id,
                 api.address(),
                 settings.auth,
                 secret.unwrap_or_default(),
@@ -636,13 +657,18 @@ impl SnowflakePool {
             () = self.closed.cancelled() => return Err(closed()),
             turn = self.lane().turn.lock() => turn,
         };
-        // A `USE` needs no schema to run in, and may be what makes the schema reachable.
-        if first_word(sql) != "USE" {
-            self.enter(schema, cancel).await?;
-        }
+        // A `USE` needs no schema to run in, and may be what makes the schema reachable. Ending a
+        // transaction needs none either, and must not fail because the schema is gone meanwhile.
+        let context = match first_word(sql).as_str() {
+            "USE" | "COMMIT" | "ROLLBACK" => None,
+            _ => {
+                self.enter(schema, cancel).await?;
+                self.context(schema)
+            }
+        };
         // These can move the session to another database or schema.
         let moves = matches!(first_word(sql).as_str(), "USE" | "CALL" | "EXECUTE");
-        let result = self.statement(sql, skip, max_rows, cancel).await;
+        let result = self.statement(sql, skip, max_rows, Lost::Enter(context.as_deref()), cancel).await;
         if moves {
             *self.lane().context.lock() = None;
         }
@@ -655,16 +681,14 @@ impl SnowflakePool {
             && self.lane().context.lock().as_deref() != Some(wanted.as_str())
         {
             *self.lane().context.lock() = None;
-            match self.statement(&wanted, 0, 0, cancel).await {
-                Ok(_) => {}
-                // The session's role may not use this database or schema (after `USE ROLE`, or a
-                // schema that is gone). The statement still runs, in the session's own context:
-                // it may be the `USE` that leads back, or name its objects in full. Asked again
-                // once a statement moves the session.
-                Err(refused) if refused.kind == ErrorKind::InvalidInput => {
-                    tracing::warn!("Snowflake: the session did not enter its database and schema");
-                }
-                Err(error) => return Err(error),
+            // Refused (the session's role may not use this database or schema): the statement
+            // does not run, since the session is still wherever it was, which may be another
+            // target's database. Tried again with the next statement.
+            if let Err(error) = self.statement(&wanted, 0, 0, Lost::Enter(None), cancel).await {
+                return Err(IdeError {
+                    message: format!("{wanted} failed, so the statement was not run: {}", error.message),
+                    ..error
+                });
             }
             *self.lane().context.lock() = Some(wanted);
         }
@@ -680,11 +704,11 @@ impl SnowflakePool {
         let _turn = self.lane().turn.lock().await;
         let cancel = CancellationToken::new();
         self.enter(None, &cancel).await?;
-        self.statement("BEGIN", 0, 0, &cancel).await?;
+        self.statement("BEGIN", 0, 0, Lost::Enter(self.context(None).as_deref()), &cancel).await?;
         let changes = async {
             let mut total = 0;
             for (sql, expect_one) in statements {
-                let changed = self.statement(sql, 0, 0, &cancel).await?.affected.unwrap_or(0.0) as u64;
+                let changed = self.statement(sql, 0, 0, Lost::Fail, &cancel).await?.affected.unwrap_or(0.0) as u64;
                 if *expect_one && changed != 1 {
                     return Err(IdeError::invalid(format!(
                         "{sql}: expected to change 1 row, changed {changed}; nothing was saved"
@@ -697,22 +721,24 @@ impl SnowflakePool {
         .await;
         match changes {
             Ok(total) => {
-                self.statement("COMMIT", 0, 0, &cancel).await?;
+                self.statement("COMMIT", 0, 0, Lost::Fail, &cancel).await?;
                 Ok(total)
             }
             Err(error) => {
-                let _ = self.statement("ROLLBACK", 0, 0, &cancel).await;
+                let _ = self.statement("ROLLBACK", 0, 0, Lost::Fail, &cancel).await;
                 Err(error)
             }
         }
     }
 
-    /// One statement on the session; the caller holds the session's turn.
+    /// One statement on the session; the caller holds the session's turn. `lost`: what to do when
+    /// the session is gone and a new one is signed in to.
     async fn statement(
         &self,
         sql: &str,
         skip: usize,
         max_rows: usize,
+        lost: Lost<'_>,
         cancel: &CancellationToken,
     ) -> IdeResult<QueryResult> {
         let started = Instant::now();
@@ -743,7 +769,24 @@ impl SnowflakePool {
                 Ok(Outcome::Done(result)) => return Ok(*result),
                 Ok(Outcome::Expired { gone }) if !renewed => {
                     renewed = true;
-                    tokens = if gone { self.login().await? } else { self.renew(&tokens).await? };
+                    if !gone {
+                        tokens = self.renew(&tokens).await?;
+                        continue;
+                    }
+                    if let Lost::Fail = lost {
+                        // The transaction ended with the session: nothing of it was saved.
+                        let _ = self.login().await;
+                        return Err(IdeError::new(
+                            ErrorKind::Io,
+                            "Snowflake: the session was lost during the transaction; nothing was saved",
+                        ));
+                    }
+                    // The new session is under the login's database and schema, which may be another
+                    // target's: back to this one's before the statement runs again.
+                    tokens = self.login().await?;
+                    if let Lost::Enter(Some(wanted)) = lost {
+                        self.reenter(wanted, &tokens, cancel).await?;
+                    }
                 }
                 Ok(Outcome::Expired { .. }) => {
                     return Err(IdeError::new(ErrorKind::Io, "Snowflake: the session expired; reconnect"));
@@ -753,6 +796,33 @@ impl SnowflakePool {
         }
     }
 
+    /// [`enter`](Self::enter) on a session just signed in to (its `tokens`), within [`statement`](Self::statement).
+    async fn reenter(&self, wanted: &str, tokens: &Tokens, cancel: &CancellationToken) -> IdeResult<()> {
+        let request_id = uuid();
+        let outcome = tokio::select! {
+            biased;
+            () = cancel.cancelled() => return Err(IdeError::cancelled()),
+            () = self.closed.cancelled() => return Err(closed()),
+            outcome = self.run(wanted, 0, 0, tokens, &request_id, Instant::now()) => outcome,
+        };
+        match outcome {
+            Ok(Outcome::Done(_)) => {
+                *self.lane().context.lock() = Some(wanted.to_owned());
+                Ok(())
+            }
+            Ok(Outcome::Expired { .. }) => {
+                Err(IdeError::new(ErrorKind::Io, "Snowflake: the session expired; reconnect"))
+            }
+            Err(error) => {
+                let error = self.shared.api.scrub.clean(error);
+                Err(IdeError {
+                    message: format!("{wanted} failed, so the statement was not run: {}", error.message),
+                    ..error
+                })
+            }
+        }
+    }
+
     async fn run(
         &self,
         sql: &str,

crates/ide-db/src/snowflake/tests.rs

@@ -407,13 +407,64 @@ async fn a_lost_session_signs_in_again() {
     let (listener, port) = bind().await;
     let gone = r#"{"success":false,"code":"390114","message":"Authentication token has expired. The user must authenticate again."}"#;
     let again = r#"{"success":true,"data":{"token":"session-token-3","masterToken":"master-token-3"}}"#;
-    let server = serve(listener, vec![ok(LOGIN_OK), ok(gone), ok(again), ok(one()), ok(CLOSED_OK)]);
+    let status = json!({ "success": true, "data": { "rowtype": [{ "name": "status", "type": "text" }],
+        "rowset": [["Statement executed successfully."]], "queryResultFormat": "json", "statementTypeId": 0x5000 } })
+    .to_string();
+    let server = serve(listener, vec![ok(LOGIN_OK), ok(gone), ok(again), ok(status), ok(one()), ok(CLOSED_OK)]);
     let pool = Pool::connect(&source(port), None, None).await.unwrap();
     pool.execute("select 1", 5, &CancellationToken::new()).await.unwrap();
     pool.close().await;
     let seen = server.await.unwrap();
     assert!(seen[2].line().starts_with("POST /session/v1/login-request?"), "{}", seen[2].line());
-    assert_eq!(seen[3].header("authorization"), Some("Snowflake Token=\"session-token-3\""));
+    // The new session enters the target's schema before the statement runs again.
+    assert_eq!(seen[3].json()["sqlText"], "USE SCHEMA \"ANALYTICS\".\"PUBLIC\"");
+    assert_eq!(seen[4].json()["sqlText"], "select 1");
+    assert_eq!(seen[4].header("authorization"), Some("Snowflake Token=\"session-token-3\""));
+}
+
+#[tokio::test]
+async fn a_lost_session_runs_the_statement_in_its_own_database_again() {
+    let (listener, port) = bind().await;
+    let gone = r#"{"success":false,"code":"390114","message":"Authentication token has expired. The user must authenticate again."}"#;
+    let again = r#"{"success":true,"data":{"token":"session-token-3","masterToken":"master-token-3"}}"#;
+    let status = || {
+        json!({ "success": true, "data": { "rowtype": [{ "name": "status", "type": "text" }],
+            "rowset": [["Statement executed successfully."]], "queryResultFormat": "json", "statementTypeId": 0x5000 } })
+        .to_string()
+    };
+    // Raw Data entered, the statement finds the session gone, a new login (under ANALYTICS),
+    // Raw Data entered again, the statement.
+    let replies = vec![ok(LOGIN_OK), ok(status()), ok(gone), ok(again), ok(status()), ok(one()), ok(CLOSED_OK)];
+    let server = serve(listener, replies);
+    let first = Pool::connect(&source(port), None, None).await.unwrap();
+    let mut other = source(port);
+    other.database = "Raw Data".into();
+    other.options.default_schema = String::new();
+    let second = Pool::connect(&other, None, None).await.unwrap();
+    second.execute("delete from t", 1, &CancellationToken::new()).await.unwrap();
+    first.close().await;
+    second.close().await;
+    let sent: Vec<String> =
+        server.await.unwrap()[1..6].iter().map(|r| r.json()["sqlText"].as_str().unwrap_or("").to_owned()).collect();
+    let raw = "USE DATABASE \"Raw Data\"";
+    assert_eq!(sent, [raw, "delete from t", "", raw, "delete from t"]);
+}
+
+#[tokio::test]
+async fn a_transaction_ends_even_when_its_schema_is_gone() {
+    let (listener, port) = bind().await;
+    let status = json!({ "success": true, "data": { "rowtype": [{ "name": "status", "type": "text" }],
+        "rowset": [["Statement executed successfully."]], "queryResultFormat": "json", "statementTypeId": 0x5000 } })
+    .to_string();
+    let server = serve(listener, vec![ok(LOGIN_OK), ok(status), ok(CLOSED_OK)]);
+    let pool = Pool::connect(&source(port), None, None).await.unwrap();
+    // The console's schema was dropped since it was picked: ending the transaction doesn't switch to it.
+    let mut console = crate::conn::Held::acquire(&pool).await.unwrap();
+    console.apply_context(Some("Dropped")).await.unwrap();
+    console.execute(&pool, "ROLLBACK", 0, &CancellationToken::new()).await.unwrap();
+    pool.close().await;
+    let seen = server.await.unwrap();
+    assert_eq!(seen[1].json()["sqlText"], "ROLLBACK");
 }
 
 #[tokio::test]
@@ -714,7 +765,7 @@ async fn a_console_schema_is_switched_with_its_statement_and_only_when_needed()
 }
 
 #[tokio::test]
-async fn a_role_that_may_not_use_the_schema_still_runs_statements() {
+async fn a_role_that_may_not_use_the_schema_runs_nothing_elsewhere() {
     let status = || {
         json!({ "success": true, "data": { "rowtype": [{ "name": "status", "type": "text" }],
             "rowset": [["Statement executed successfully."]], "queryResultFormat": "json", "statementTypeId": 0x5000 } })
@@ -722,14 +773,12 @@ async fn a_role_that_may_not_use_the_schema_still_runs_statements() {
     };
     let refused = r#"{"success":false,"code":"002043","message":"SQL compilation error:\nObject does not exist, or operation cannot be performed."}"#;
     let (listener, port) = bind().await;
-    // use role | the schema is refused once, the statement runs | the next one does not ask again |
-    // a role that is not granted | use role back, the schema is entered again
+    // use role | the schema is refused, the statement is not sent | asked again, refused again |
+    // use role back, the schema is entered, the statement runs
     let replies = vec![
         ok(LOGIN_OK),
         ok(status()),
         ok(refused),
-        ok(one()),
-        ok(one()),
         ok(refused),
         ok(status()),
         ok(status()),
@@ -740,20 +789,22 @@ async fn a_role_that_may_not_use_the_schema_still_runs_statements() {
     let pool = Pool::connect(&source(port), None, None).await.unwrap();
     let cancel = CancellationToken::new();
     pool.execute("use role auditor", 0, &cancel).await.unwrap();
-    pool.execute("select 1", 1, &cancel).await.unwrap();
-    pool.execute("select 2", 1, &cancel).await.unwrap();
-    let missing = pool.execute("use role nobody", 0, &cancel).await.unwrap_err();
-    assert!(missing.message.contains("002043") && missing.message.contains("granted"), "{}", missing.message);
+    let error = pool.execute("delete from t", 1, &cancel).await.unwrap_err();
+    assert!(
+        error.message.contains("USE SCHEMA")
+            && error.message.contains("was not run")
+            && error.message.contains("002043"),
+        "{}",
+        error.message
+    );
+    assert!(pool.execute("select 2", 1, &cancel).await.is_err());
     pool.execute("use role analyst", 0, &cancel).await.unwrap();
     pool.execute("select 3", 1, &cancel).await.unwrap();
     pool.close().await;
     let sent: Vec<String> =
-        server.await.unwrap()[1..9].iter().map(|r| r.json()["sqlText"].as_str().unwrap().to_owned()).collect();
+        server.await.unwrap()[1..7].iter().map(|r| r.json()["sqlText"].as_str().unwrap().to_owned()).collect();
     let schema = "USE SCHEMA \"ANALYTICS\".\"PUBLIC\"";
-    assert_eq!(
-        sent,
-        ["use role auditor", schema, "select 1", "select 2", "use role nobody", "use role analyst", schema, "select 3"]
-    );
+    assert_eq!(sent, ["use role auditor", schema, schema, "use role analyst", schema, "select 3"]);
 }
 
 #[tokio::test]
@@ -785,6 +836,45 @@ async fn databases_of_one_data_source_share_a_login() {
     assert!(seen[4].line().starts_with("POST /session?delete=true"), "{}", seen[4].line());
 }
 
+#[tokio::test]
+async fn data_sources_with_the_same_settings_have_their_own_sessions() {
+    let (listener, port) = bind().await;
+    let second = r#"{"success":true,"data":{"token":"session-token-2","masterToken":"master-token-2"}}"#;
+    let server = serve(listener, vec![ok(LOGIN_OK), ok(second), ok(one()), ok(one()), ok(CLOSED_OK), ok(CLOSED_OK)]);
+    let first = Pool::connect(&source(port), None, None).await.unwrap();
+    let mut copy = source(port);
+    copy.id = format!("{}-copy", copy.id);
+    let other = Pool::connect(&copy, None, None).await.unwrap();
+    let cancel = CancellationToken::new();
+    first.execute("select 1", 1, &cancel).await.unwrap();
+    other.execute("select 2", 1, &cancel).await.unwrap();
+    first.close().await;
+    other.close().await;
+    let seen = server.await.unwrap();
+    assert!(seen[1].line().starts_with("POST /session/v1/login-request?"), "{}", seen[1].line());
+    assert_eq!(seen[2].header("authorization"), Some("Snowflake Token=\"session-token-1\""));
+    assert_eq!(seen[3].header("authorization"), Some("Snowflake Token=\"session-token-2\""));
+}
+
+#[tokio::test]
+async fn one_data_source_in_two_projects_has_a_session_in_each() {
+    let (listener, port) = bind().await;
+    let second = r#"{"success":true,"data":{"token":"session-token-2","masterToken":"master-token-2"}}"#;
+    let server = serve(listener, vec![ok(LOGIN_OK), ok(second), ok(one()), ok(one()), ok(CLOSED_OK), ok(CLOSED_OK)]);
+    // A plugin's data source has the same id in every project.
+    let first = Pool::connect(&source(port), None, Some(std::path::Path::new("/projects/a"))).await.unwrap();
+    let other = Pool::connect(&source(port), None, Some(std::path::Path::new("/projects/b"))).await.unwrap();
+    let cancel = CancellationToken::new();
+    first.execute("select 1", 1, &cancel).await.unwrap();
+    other.execute("select 2", 1, &cancel).await.unwrap();
+    first.close().await;
+    other.close().await;
+    let seen = server.await.unwrap();
+    assert!(seen[1].line().starts_with("POST /session/v1/login-request?"), "{}", seen[1].line());
+    assert_eq!(seen[2].header("authorization"), Some("Snowflake Token=\"session-token-1\""));
+    assert_eq!(seen[3].header("authorization"), Some("Snowflake Token=\"session-token-2\""));
+}
+
 #[tokio::test]
 async fn metadata_runs_on_its_own_session_beside_a_busy_console() {
     let (listener, port) = bind().await;

crates/ide-host/src/mcp/edit.rs

@@ -87,7 +87,7 @@ async fn create_or_replace(call: &Call, path: PathBuf, text: Option<String>, ove
         return Ok(());
     }
     let edit = crate::ops::lsp::prepare_workspace_edit(&call.host, call.window(), edit).await?;
-    crate::ops::lsp::apply_workspace_edit(&call.host, call.window(), edit).await
+    crate::ops::lsp::apply_agent_workspace_edit(&call.host, call.window(), edit).await
 }
 
 /// The open document of `path`, or a transient one (`true`: close it after use).
@@ -317,7 +317,7 @@ async fn apply_op(call: &Call, op: FileOp, notes: &mut Vec<String>) -> IdeResult
                 preconditions: Vec::new(),
             };
             let edit = crate::ops::lsp::prepare_workspace_edit(&host, call.window(), edit).await?;
-            crate::ops::lsp::apply_workspace_edit(&host, call.window(), edit).await
+            crate::ops::lsp::apply_agent_workspace_edit(&host, call.window(), edit).await
         }
         FileOp::Update { path: first, move_to, hunks, or } => {
             // A plain diff's other names count when its `+++` path does not exist.
@@ -400,7 +400,7 @@ async fn apply_op(call: &Call, op: FileOp, notes: &mut Vec<String>) -> IdeResult
                 edit.files.push(FileEdit::Rename { from: path.into(), to: to.into() });
             }
             let edit = crate::ops::lsp::prepare_workspace_edit(&host, call.window(), edit).await?;
-            crate::ops::lsp::apply_workspace_edit(&host, call.window(), edit).await?;
+            crate::ops::lsp::apply_agent_workspace_edit(&host, call.window(), edit).await?;
             if dirty {
                 notes.push(format!("{shown}: patched the unsaved editor buffer"));
             }

crates/ide-host/src/mcp/edit/rename.rs

@@ -385,7 +385,7 @@ targetIndex, or narrow the call with a contextSnippet that shows the one you mea
         _ => None,
     });
     let (h, w) = (host.clone(), window.to_owned());
-    let written = crate::ops::lsp::apply_workspace_edit(&h, &w, edit).await;
+    let written = crate::ops::lsp::apply_agent_workspace_edit(&h, &w, edit).await;
     if let Err(e) = written {
         let hint = format!("The rename stopped while it wrote. {} Read the files again before you retry.", e.message);
         return Ok(RenameResult::failed("write_failed", hint).with_symbol(symbol));

crates/ide-host/src/ops/build.rs

@@ -15,6 +15,7 @@ use ide_build::{BuildModel, BuildTool, SyncOptions, SyncProgress};
 use ide_core::settings::Settings;
 use ide_core::{DocId, FileEdit, IdeError, IdeEvent, IdeResult, Location, Pos, Range, RequestId, WorkspaceEdit};
 use std::path::Path;
+use std::sync::Arc;
 
 fn join_err(e: tokio::task::JoinError) -> IdeError {
     IdeError::internal(e.to_string())
@@ -330,21 +331,61 @@ pub async fn build_sync(
     // holds for Gradle: it reuses its cached classpath on restart, so a
     // dependency added to `build.gradle` stays unresolved until told to sync.
     let lsp = project.lsp.clone();
+    let documents = project.documents.clone();
     tokio::spawn(async move {
         if profiles_changed {
             // jdtls takes the profiles from its Maven settings (see `ide_sdk::maven_profiles`).
             lsp.reconfigure().await;
         }
+        let first = updates.first().cloned();
         for file in updates {
             let uri = ide_lsp::path_to_uri_string(&file);
             if let Err(e) = lsp.java_update_project_configs(&file, vec![uri]).await {
                 tracing::debug!("java/projectConfigurationsUpdate: {e}");
             }
         }
+        let changed = {
+            let lsp = lsp.clone();
+            tokio::task::spawn_blocking(move || lsp.changed_library_archives()).await.unwrap_or_default()
+        };
+        if let Some(file) = first
+            && let Err(e) = lsp.java_refresh_archives(&file, &changed).await
+        {
+            tracing::debug!("openidea.java.refreshArchives: {e}");
+        }
+        refresh_library_classes(&lsp, &documents).await;
     });
     Ok(model)
 }
 
+/// Open library classes whose jar was replaced in place (a SNAPSHOT installed
+/// again keeps its path) show the new contents, like a reopened one.
+async fn refresh_library_classes(lsp: &Arc<ide_lsp::LspManager>, documents: &Arc<ide_workspace::Documents>) {
+    let changed = {
+        let (lsp, documents) = (lsp.clone(), documents.clone());
+        tokio::task::spawn_blocking(move || {
+            documents
+                .open_documents()
+                .into_iter()
+                .filter_map(|doc| Some((doc, documents.virtual_uri(doc).ok().flatten()?)))
+                .filter(|(_, uri)| lsp.library_class_changed(uri))
+                .collect::<Vec<_>>()
+        })
+        .await
+        .unwrap_or_default()
+    };
+    for (doc, uri) in changed {
+        match lsp.virtual_document(&uri).await {
+            Ok(vd) => {
+                if let Err(e) = documents.replace_virtual(doc, &vd.text, &vd.encoding, vd.has_bom) {
+                    tracing::debug!("refreshing {uri}: {e}");
+                }
+            }
+            Err(e) => tracing::debug!("refreshing {uri}: {e}"),
+        }
+    }
+}
+
 /// The POM declaring `dependency` for the Maven module `pom` (project-relative): the
 /// module's own, else its nearest parent in the project; its path, text and declaration.
 fn declaring_pom(
@@ -985,6 +1026,38 @@ mod build_tool_settings_tests {
         }
     }
 
+    /// Changing Project JDK updates the next Maven build without reopening the project.
+    #[test]
+    fn changing_project_jdk_updates_the_next_maven_build() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = dunce::canonicalize(tmp.path()).unwrap();
+        std::fs::write(
+            root.join("pom.xml"),
+            r#"<project><modelVersion>4.0.0</modelVersion><groupId>test</groupId><artifactId>app</artifactId><version>1</version></project>"#,
+        )
+        .unwrap();
+        for (name, version) in [("jdk8", "1.8"), ("jdk21", "21")] {
+            let home = root.join(name);
+            std::fs::create_dir_all(home.join("bin")).unwrap();
+            std::fs::write(home.join("bin").join(if cfg!(windows) { "java.exe" } else { "java" }), "").unwrap();
+            std::fs::write(home.join("release"), format!("JAVA_VERSION=\"{version}\"\n")).unwrap();
+        }
+
+        let mut settings = Settings::default();
+        settings.languages.java.maven.runner_jre.clear();
+        for name in ["jdk8", "jdk21"] {
+            settings.languages.java.jdk = name.into();
+            let expected = root.join(name);
+            let model = load(&root, &root.join("cache"), &settings);
+            assert_eq!(model.maven.as_ref().unwrap().projects[0].env["JAVA_HOME"], expected.to_string_lossy());
+            let plan = compile::plan(&root, &model, BuildKind::Build, None, None).unwrap();
+            assert!(!plan.steps.is_empty());
+            for step in plan.steps {
+                assert_eq!(step.env["JAVA_HOME"], expected.to_string_lossy());
+            }
+        }
+    }
+
     #[test]
     fn model_for_sync_tasks_and_compile_uses_gradle_settings() {
         let tmp = tempfile::tempdir().unwrap();
@@ -1019,7 +1092,6 @@ mod maven_completion_tests {
     use ide_build::maven::completion::PomCompletionKind;
     use ide_core::CancellationToken;
     use ide_workspace::dependencies::DependencyVersionSource;
-    use std::sync::Arc;
 
     /// Cache answers the test plants before completing, so the op's Central
     /// lookups hit the session cache and the network is never reached.

crates/ide-host/src/ops/java.rs

@@ -96,18 +96,19 @@ async fn resolve_launch(
     let cancel = cancel.clone();
     tokio::task::spawn_blocking(move || {
         let _external_build = external_build;
+        let local_repo = ide_sdk::apply::maven_local_repository(&project.root, &settings);
         let built = if delegated {
-            let policy = delegated_policy(policy, prefer_maven, info.error_count);
+            let rebuild_on_jdt_errors = rebuild_on_jdt_errors(policy, prefer_maven, info.error_count);
             let outputs = project.java_launch_snapshots.lock().build(
                 &project.root,
                 &model,
                 &module,
-                cache::BuildOptions { test, policy },
-                ide_sdk::apply::maven_local_repository(&project.root, &settings),
+                cache::BuildOptions { test, policy, rebuild_on_jdt_errors },
+                local_repo.clone(),
                 &cancel,
             )?;
             let copies = use_snapshot(&mut info, &outputs.originals, &outputs.snapshot);
-            apply_external_build_result(&mut info, outputs.failure, policy == BuildPolicy::Rebuild);
+            apply_external_build_result(&mut info, outputs.failure, outputs.authoritative);
             copies
         } else if external {
             let built = compile::build_for_launch(&project.root, &model, &module, test, build_kind, &cancel)?;
@@ -123,10 +124,22 @@ async fn resolve_launch(
             Vec::new()
         };
         let mut class_paths: Vec<String> = built.iter().map(|p| p.to_string_lossy().into_owned()).collect();
-        for p in std::mem::take(&mut info.class_paths) {
-            if !class_paths.iter().any(|c| same_entry(c, &p, cfg!(windows))) {
-                class_paths.push(p);
-            }
+        if delegated {
+            // m2e runs inside jdtls on the server JDK and can resolve a different
+            // Maven profile/classifier than the module build. Ask the same Maven
+            // process that built the module for its runtime/test dependencies.
+            let maven_cp = compile::module_classpath(
+                &project.root,
+                &model,
+                &module,
+                test,
+                local_repo,
+                &project.build_cache_dir(),
+                &cancel,
+            );
+            merge_maven_launch_classpath(&mut class_paths, &mut info, maven_cp)?;
+        } else {
+            append_unique_class_paths(&mut class_paths, std::mem::take(&mut info.class_paths));
         }
         info.class_paths = class_paths;
         apply_library_classpath(&mut info, &project.root, &settings.project_structure.libraries, test);
@@ -191,21 +204,18 @@ async fn resolve_launch(
 /// With Settings › Maven › Delegate IDE build/run actions to Maven, javac's verdict replaces
 /// JDT's. Classes JDT wrote for sources with errors look up to date to Maven's incremental
 /// compiler, so a launch JDT reports errors for recompiles everything.
-fn delegated_policy(policy: BuildPolicy, prefer_maven: bool, jdt_errors: u32) -> BuildPolicy {
-    if prefer_maven && jdt_errors > 0 && matches!(policy, BuildPolicy::Automatic | BuildPolicy::Make) {
-        BuildPolicy::Rebuild
-    } else {
-        policy
-    }
+fn rebuild_on_jdt_errors(policy: BuildPolicy, prefer_maven: bool, jdt_errors: u32) -> bool {
+    prefer_maven && jdt_errors > 0 && matches!(policy, BuildPolicy::Automatic | BuildPolicy::Make)
 }
 
-fn apply_external_build_result(info: &mut JavaLaunchInfo, failure: Option<String>, clean: bool) {
+fn apply_external_build_result(info: &mut JavaLaunchInfo, failure: Option<String>, authoritative: bool) {
     info.build = Some(if let Some(failure) = failure {
         info.hints.push(failure);
         JavaBuildStatus::Failed
-    } else if clean {
-        // A clean external build recompiled every source; JDT's diagnostics still describe
-        // the previous output (and reject sources javac accepts, e.g. a package mismatch).
+    } else if authoritative {
+        // A clean rebuild or a fingerprint-verified snapshot is authoritative. JDT diagnostics
+        // may describe an older output or its own classpath, so they must not mark this launch
+        // as failed after Maven has produced usable classes.
         info.errors.clear();
         info.error_count = 0;
         JavaBuildStatus::Succeeded
@@ -286,6 +296,44 @@ fn same_entry(a: &str, b: &str, windows: bool) -> bool {
     a == b || entry_key(a, windows) == entry_key(b, windows)
 }
 
+/// Merge the Maven launch classpath without turning a recoverable probe failure into a
+/// failed launch. Cancellation still propagates; ordinary failures keep jdtls' classpath
+/// and leave the reason in the run console.
+fn merge_maven_launch_classpath(
+    class_paths: &mut Vec<String>,
+    info: &mut JavaLaunchInfo,
+    classpath: IdeResult<String>,
+) -> IdeResult<()> {
+    match classpath {
+        Ok(classpath) => {
+            append_unique_class_paths(
+                class_paths,
+                std::env::split_paths(&classpath).map(|path| path.to_string_lossy().into_owned()),
+            );
+            Ok(())
+        }
+        Err(error) if error.kind == ErrorKind::Cancelled => Err(error),
+        Err(error) => {
+            info.hints.push(format!(
+                "Maven launch classpath resolution failed; using the Java language server classpath instead:\n{}",
+                error.message
+            ));
+            append_unique_class_paths(class_paths, std::mem::take(&mut info.class_paths));
+            Ok(())
+        }
+    }
+}
+
+/// Append entries without changing their precedence; `same_entry` also catches
+/// Windows case-insensitive duplicates that would otherwise lengthen the command.
+fn append_unique_class_paths(class_paths: &mut Vec<String>, entries: impl IntoIterator<Item = String>) {
+    for entry in entries {
+        if !class_paths.iter().any(|existing| same_entry(existing, &entry, cfg!(windows))) {
+            class_paths.push(entry);
+        }
+    }
+}
+
 fn use_snapshot(info: &mut JavaLaunchInfo, built: &[PathBuf], snapshot: &std::path::Path) -> Vec<PathBuf> {
     use_snapshot_on(info, built, snapshot, cfg!(windows))
 }
@@ -410,14 +458,36 @@ mod tests {
 
     #[test]
     fn delegated_launches_with_jdt_errors_recompile_with_maven() {
-        assert_eq!(delegated_policy(BuildPolicy::Make, true, 1), BuildPolicy::Rebuild);
-        assert_eq!(delegated_policy(BuildPolicy::Automatic, true, 2), BuildPolicy::Rebuild);
-        assert_eq!(delegated_policy(BuildPolicy::Make, true, 0), BuildPolicy::Make);
-        assert_eq!(delegated_policy(BuildPolicy::Make, false, 1), BuildPolicy::Make);
-        assert_eq!(
-            delegated_policy(BuildPolicy::MakeAndContinueOnErrors, true, 1),
-            BuildPolicy::MakeAndContinueOnErrors
-        );
+        assert!(rebuild_on_jdt_errors(BuildPolicy::Make, true, 1));
+        assert!(rebuild_on_jdt_errors(BuildPolicy::Automatic, true, 2));
+        assert!(!rebuild_on_jdt_errors(BuildPolicy::Make, true, 0));
+        assert!(!rebuild_on_jdt_errors(BuildPolicy::Make, false, 1));
+        assert!(!rebuild_on_jdt_errors(BuildPolicy::MakeAndContinueOnErrors, true, 1));
+    }
+
+    #[test]
+    fn maven_classpath_probe_failure_falls_back_to_jdtls_classpaths() {
+        let maven = std::env::join_paths(["maven.jar", "snapshot.jar"]).unwrap().to_string_lossy().into_owned();
+        let mut class_paths = vec!["snapshot.jar".to_owned()];
+        let mut info =
+            JavaLaunchInfo { class_paths: vec!["snapshot.jar".into(), "jdtls.jar".into()], ..Default::default() };
+        merge_maven_launch_classpath(&mut class_paths, &mut info, Ok(maven)).unwrap();
+        assert_eq!(class_paths, ["snapshot.jar", "maven.jar"]);
+
+        merge_maven_launch_classpath(&mut class_paths, &mut info, Err(IdeError::internal("offline dependency")))
+            .unwrap();
+        assert_eq!(class_paths, ["snapshot.jar", "maven.jar", "jdtls.jar"]);
+        assert!(info.hints[0].contains("offline dependency"), "{:?}", info.hints);
+    }
+
+    #[test]
+    fn cancelled_maven_classpath_probe_propagates_without_fallback() {
+        let mut class_paths = vec!["snapshot.jar".to_owned()];
+        let mut info = JavaLaunchInfo { class_paths: vec!["jdtls.jar".into()], ..Default::default() };
+        let error = merge_maven_launch_classpath(&mut class_paths, &mut info, Err(IdeError::cancelled())).unwrap_err();
+        assert_eq!(error.kind, ErrorKind::Cancelled);
+        assert_eq!(class_paths, ["snapshot.jar"]);
+        assert!(info.hints.is_empty());
     }
 
     #[test]
@@ -461,7 +531,7 @@ mod tests {
     }
 
     #[test]
-    fn clean_external_build_clears_stale_jdt_errors() {
+    fn authoritative_external_result_clears_stale_jdt_errors() {
         let mut info = JavaLaunchInfo {
             error_count: 7,
             errors: vec![ide_lsp::jdtls::JavaCompileError {

crates/ide-host/src/ops/java/cache.rs

@@ -14,6 +14,10 @@ pub(super) struct Outputs {
     pub originals: Vec<PathBuf>,
     #[serde(skip)]
     pub failure: Option<String>,
+    /// Whether this result replaces jdtls diagnostics with a clean Maven build or a
+    /// verified snapshot. It is runtime-only because reuse is determined per launch.
+    #[serde(skip)]
+    pub authoritative: bool,
 }
 
 impl Outputs {
@@ -42,6 +46,9 @@ pub(super) fn has_record(root: &Path, cache: &Path, module: &Path) -> bool {
 pub(super) struct BuildOptions {
     pub test: bool,
     pub policy: BuildPolicy,
+    /// A JDT error makes a cache miss rebuild, but it must not prevent an unchanged
+    /// snapshot from being reused on the next launch.
+    pub rebuild_on_jdt_errors: bool,
 }
 
 /// Owned by Project: running JVMs may still load superseded outputs until it drops.
@@ -75,7 +82,7 @@ impl Session {
         cancel: &CancellationToken,
     ) -> IdeResult<Outputs> {
         self.initialize();
-        let BuildOptions { test, policy } = options;
+        let BuildOptions { test, policy, rebuild_on_jdt_errors } = options;
         let cache = &self.cache;
         let record =
             record_path(root, cache, module, test).ok_or_else(|| IdeError::internal("launch outside project"))?;
@@ -115,8 +122,14 @@ impl Session {
             && outputs.reusable(&before, &snapshots)
         {
             tracing::info!(module = %module.display(), test, "Reusing Maven launch snapshot");
-            return Ok(previous.unwrap());
+            let mut outputs = previous.unwrap();
+            outputs.authoritative = true;
+            return Ok(outputs);
         }
+        // JDT can report errors from its own classpath while the last Maven snapshot is
+        // still valid. Reuse that snapshot first; only a cache miss needs the expensive
+        // clean rebuild that replaces JDT's error-stub classes.
+        let policy = if rebuild_on_jdt_errors { BuildPolicy::Rebuild } else { policy };
         // Retain a non-reusable record even on failure, so removing the final mixed
         // source still delegates to Maven to clean its old classes on the next launch.
         fs::create_dir_all(record.parent().unwrap())?;
@@ -156,7 +169,13 @@ impl Session {
         if cancel.is_cancelled() {
             return Err(IdeError::cancelled());
         }
-        let mut outputs = Outputs { fingerprint: None, snapshot, originals, failure: built.failure };
+        let mut outputs = Outputs {
+            fingerprint: None,
+            snapshot,
+            originals,
+            failure: built.failure,
+            authoritative: policy == BuildPolicy::Rebuild,
+        };
         if outputs.failure.is_none() && before.is_some() && before == after {
             outputs.fingerprint = before;
             fs::create_dir_all(record.parent().unwrap())?;
@@ -334,6 +353,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn jdt_errors_reuse_an_unchanged_snapshot_and_rebuild_only_on_a_cache_miss() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let model = fixture(root);
+        let cancel = CancellationToken::new();
+        let mut session = Session::new(root.join("cache"));
+        let first = session.build(root, &model, root, BuildOptions::default(), None, &cancel).unwrap();
+        assert!(!first.authoritative);
+
+        let reused = session
+            .build(
+                root,
+                &model,
+                root,
+                BuildOptions { rebuild_on_jdt_errors: true, ..Default::default() },
+                None,
+                &cancel,
+            )
+            .unwrap();
+        assert_eq!(reused.snapshot, first.snapshot);
+        assert!(reused.authoritative);
+        assert_eq!(fs::read_to_string(root.join("calls")).unwrap().lines().count(), 1);
+
+        fs::write(root.join("src/main/kotlin/Main.kt"), "updated").unwrap();
+        let rebuilt = session
+            .build(
+                root,
+                &model,
+                root,
+                BuildOptions { rebuild_on_jdt_errors: true, ..Default::default() },
+                None,
+                &cancel,
+            )
+            .unwrap();
+        assert_ne!(rebuilt.snapshot, first.snapshot);
+        assert!(rebuilt.authoritative);
+        let calls = fs::read_to_string(root.join("calls")).unwrap();
+        assert_eq!(calls.lines().count(), 2);
+        assert!(calls.lines().last().unwrap().contains("clean"));
+    }
+
     #[test]
     fn successful_snapshots_reuse_across_close_and_rebuild_for_changes_missing_outputs_or_failure() {
         let dir = tempfile::tempdir().unwrap();
@@ -483,7 +544,13 @@ mod tests {
         fs::write(snapshots.join("launch-file"), "keep").unwrap();
         let record = cache.join("java-launch/records/deep/module/test.json");
         fs::create_dir_all(record.parent().unwrap()).unwrap();
-        let outputs = Outputs { fingerprint: None, snapshot: retained.clone(), originals: Vec::new(), failure: None };
+        let outputs = Outputs {
+            fingerprint: None,
+            snapshot: retained.clone(),
+            originals: Vec::new(),
+            failure: None,
+            authoritative: false,
+        };
         fs::write(record, serde_json::to_vec(&outputs).unwrap()).unwrap();
         let mut session = Session::new(cache);
         session.initialize();

crates/ide-host/src/ops/lsp.rs

@@ -1483,23 +1483,38 @@ pub async fn lsp_restart_named(host: &Host, name: &str) -> IdeResult<()> {
 pub async fn apply_workspace_edit(host: &Host, window: &str, edit: WorkspaceEdit) -> IdeResult<()> {
     let project = host.project(window)?;
     blocking(move || {
-        // Multi-file refactorings leave a Local History point to go back to.
-        let paths: Vec<&std::path::Path> = edit
-            .files
-            .iter()
-            .filter_map(|f| match f {
-                ide_core::FileEdit::Edit { path, .. } => Some(&**path),
-                _ => None,
-            })
-            .collect();
-        if edit.files.len() > 1 {
-            project.record_before_refactoring(&paths, "Apply changes");
-        }
+        record_before_multi_file_edit(&project, &edit);
         apply_edit(&project.documents, &edit)
     })
     .await
 }
 
+/// [`apply_workspace_edit`] for the MCP server's tools: undoable the same way, but the UI does
+/// not announce it as a refactoring.
+pub async fn apply_agent_workspace_edit(host: &Host, window: &str, edit: WorkspaceEdit) -> IdeResult<()> {
+    let project = host.project(window)?;
+    blocking(move || {
+        record_before_multi_file_edit(&project, &edit);
+        project.documents.apply_agent_workspace_edit(&edit)
+    })
+    .await
+}
+
+/// Multi-file edits leave a Local History point to go back to.
+fn record_before_multi_file_edit(project: &crate::Project, edit: &WorkspaceEdit) {
+    let paths: Vec<&std::path::Path> = edit
+        .files
+        .iter()
+        .filter_map(|f| match f {
+            ide_core::FileEdit::Edit { path, .. } => Some(&**path),
+            _ => None,
+        })
+        .collect();
+    if edit.files.len() > 1 {
+        project.record_before_refactoring(&paths, "Apply changes");
+    }
+}
+
 pub async fn prepare_workspace_edit(host: &Host, window: &str, mut edit: WorkspaceEdit) -> IdeResult<WorkspaceEdit> {
     let project = host.project(window)?;
     blocking(move || {

crates/ide-host/src/ops/sdk.rs

@@ -61,13 +61,16 @@ pub async fn sdk_python_project_interpreters(host: &Host, window: &str) -> IdeRe
     host.require_trust(window)?;
     let current = host.project(window).ok().map(|p| p.root.clone());
     let config = host.config_dir.clone();
+    // Probing runs the project's interpreter (and its settings may name any program): only
+    // projects trusted in their own right, not ones last opened in Restricted Mode.
+    let roots: Vec<PathBuf> = ide_workspace::RecentProjects::load(&config)
+        .list()
+        .into_iter()
+        .map(|p| p.path.into_path_buf())
+        .filter(|root| current.as_deref() != Some(root.as_path()))
+        .filter(|root| host.trust.window_trusted(root).unwrap_or(false))
+        .collect();
     tokio::task::spawn_blocking(move || {
-        let roots: Vec<PathBuf> = ide_workspace::RecentProjects::load(&config)
-            .list()
-            .into_iter()
-            .map(|p| p.path.into_path_buf())
-            .filter(|root| current.as_deref() != Some(root.as_path()))
-            .collect();
         // Each project resolves its configured interpreter, else its own virtualenv. The
         // probes run `python`, so keep them off the async runtime and bound how many run at
         // once: the recent list can hold ~30 projects, and each probe starts a process.
@@ -521,6 +524,10 @@ mod tests {
         host.trust.decide(&root, true, false).unwrap();
         host.open_project("main", &root).unwrap();
 
+        // A project last opened in Restricted Mode: its interpreter is never run.
+        host.trust.decide(&other, false, false).unwrap();
+        assert!(sdk_python_project_interpreters(&host, "main").await.unwrap().is_empty());
+        host.trust.decide(&other, true, false).unwrap();
         let list = sdk_python_project_interpreters(&host, "main").await.unwrap();
         assert_eq!(list.len(), 1, "{list:?}");
         assert_eq!(&*list[0].project, other.as_path());

crates/ide-host/src/plugins/api.rs

@@ -4125,6 +4125,11 @@ impl PluginApi {
         if items.len() > 10_000 || file.as_ref().and_then(|f| f.badge.as_ref()).is_some_and(|b| b.chars().count() > 2) {
             return Err(HostError::Invalid("decoration limit exceeded".into()));
         }
+        if let Some(note) = file.as_ref().and_then(|f| f.note.as_ref())
+            && (note.trim().is_empty() || note.chars().count() > 200 || note.contains(['\n', '\r']))
+        {
+            return Err(HostError::Invalid("a file note is one non-empty line of at most 200 characters".into()));
+        }
         items.retain(|d| decoration_style(&d.style));
         if items.iter().any(|d| d.range.start > d.range.end) {
             return Err(HostError::Invalid("reversed decoration range".into()));
@@ -4143,7 +4148,7 @@ impl PluginApi {
                 set_id: set.into(),
                 tree,
                 items,
-                file: file.filter(|f| decoration_style(&f.style)),
+                file: file.filter(|f| f.note.is_some() || decoration_style(&f.style)),
             })
         } else {
             None
@@ -4315,10 +4320,33 @@ mod workbench_tests {
             api.file_decorations(
                 Some(&path),
                 "tree",
-                Some(ide_plugin::FileDecoration { badge: Some("abc".into()), style: "info".into(), tooltip: None })
+                Some(ide_plugin::FileDecoration {
+                    badge: Some("abc".into()),
+                    style: "info".into(),
+                    tooltip: None,
+                    note: None
+                })
             )
             .is_err()
         );
+        let note = |text: &str| ide_plugin::FileDecoration {
+            badge: None,
+            style: String::new(),
+            tooltip: Some("why".into()),
+            note: Some(text.into()),
+        };
+        api.file_decorations(Some(&path), "notes", Some(note("entry point"))).unwrap();
+        let notes = |api: &PluginApi| {
+            api.shared.decoration_sets()["test"]
+                .iter()
+                .filter(|s| s.tree && s.set_id == "notes")
+                .map(|s| s.file.as_ref().and_then(|f| f.note.clone()))
+                .collect::<Vec<_>>()
+        };
+        assert_eq!(notes(&api), [Some("entry point".to_string())], "kept without a style");
+        for bad in ["", "two\nlines", &"x".repeat(201)] {
+            assert!(api.file_decorations(Some(&path), "notes", Some(note(bad))).is_err(), "{bad:?}");
+        }
         api.shared.clear_plugin("test", true);
         assert!(api.shared.decoration_sets().is_empty());
     }

crates/ide-host/tests/mcp.rs

@@ -231,7 +231,11 @@ async fn mutations_preserve_unsaved_text_and_reject_metadata_and_escapes() {
         .iter()
         .rev()
         .find_map(|event| match event {
-            IdeEvent::WorkspaceEditApplied { id, .. } => Some(*id),
+            // Undoable like a refactoring, but marked as the agent's, so it isn't announced as one.
+            IdeEvent::WorkspaceEditApplied { id, by_agent, .. } => {
+                assert!(*by_agent, "an MCP edit is the agent's");
+                Some(*id)
+            }
             _ => None,
         })
         .unwrap();

crates/ide-host/tests/project_smoke.rs

@@ -252,6 +252,77 @@ async fn maven_sync() {
     assert!(!junit.children.is_empty(), "{junit:?}");
 }
 
+/// The launch classpath must come from the runner JDK, not the JDK that happened
+/// to load the language-server model: JDK-activated profiles can select a
+/// different dependency classifier. Use real Maven so this covers the scenario
+/// rather than only the probe arguments.
+#[test]
+#[ignore = "project smoke: needs Maven and a JDK"]
+fn maven_launch_classpath_uses_the_runner_jdk_classifier() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let java_home = PathBuf::from(std::env::var("JAVA_HOME").expect("JAVA_HOME"));
+    let release = std::fs::read_to_string(java_home.join("release")).unwrap();
+    let version = release
+        .lines()
+        .find_map(|line| line.strip_prefix("JAVA_VERSION=\""))
+        .and_then(|line| line.strip_suffix('"'))
+        .expect("JAVA_VERSION in release");
+    let major = version.strip_prefix("1.").unwrap_or(version).split(['.', '_']).next().unwrap().parse::<u32>().unwrap();
+    let jar = java_home.join(if cfg!(windows) { "bin/jar.exe" } else { "bin/jar" });
+    let jars = root.join("libs");
+    let staging = root.join("empty");
+    std::fs::create_dir_all(&jars).unwrap();
+    std::fs::create_dir_all(&staging).unwrap();
+    for name in ["api-jdk8.jar", "api-jdk9.jar"] {
+        let status = std::process::Command::new(&jar)
+            .args(["cf"])
+            .arg(jars.join(name))
+            .arg(".")
+            .current_dir(&staging)
+            .status()
+            .unwrap();
+        assert!(status.success());
+    }
+    std::fs::write(
+        root.join("pom.xml"),
+        r#"<project xmlns="http://maven.apache.org/POM/4.0.0">
+          <modelVersion>4.0.0</modelVersion>
+          <groupId>demo</groupId><artifactId>jdk-classifier</artifactId><version>1</version>
+          <profiles>
+            <profile><id>jdk8</id><activation><jdk>1.8</jdk></activation><dependencies>
+              <dependency><groupId>demo</groupId><artifactId>api</artifactId><version>1</version><classifier>jdk8</classifier>
+                <scope>system</scope><systemPath>${project.basedir}/libs/api-jdk8.jar</systemPath></dependency>
+            </dependencies></profile>
+            <profile><id>jdk9</id><activation><jdk>[9,)</jdk></activation><dependencies>
+              <dependency><groupId>demo</groupId><artifactId>api</artifactId><version>1</version><classifier>jdk9</classifier>
+                <scope>system</scope><systemPath>${project.basedir}/libs/api-jdk9.jar</systemPath></dependency>
+            </dependencies></profile>
+          </profiles>
+        </project>"#,
+    )
+    .unwrap();
+    let cache = root.join("cache");
+    let mut model = ide_build::load(root, &cache, None);
+    for project in &mut model.maven.as_mut().unwrap().projects {
+        project.env.insert("JAVA_HOME".into(), java_home.to_string_lossy().into_owned());
+    }
+    let classpath = ide_build::compile::module_classpath(
+        root,
+        &model,
+        root,
+        false,
+        None,
+        &root.join("classpath-cache"),
+        &ide_core::CancellationToken::new(),
+    )
+    .unwrap();
+    let expected = if major <= 8 { "api-jdk8.jar" } else { "api-jdk9.jar" };
+    let other = if major <= 8 { "api-jdk9.jar" } else { "api-jdk8.jar" };
+    assert!(classpath.contains(expected), "{classpath}");
+    assert!(!classpath.contains(other), "{classpath}");
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 #[ignore = "project smoke: needs Gradle and a JDK"]
 async fn gradle_sync() {

crates/ide-lsp/src/handler.rs

@@ -223,6 +223,8 @@ impl ClientHandler {
         if self.server.running_gen(self.generation).is_some_and(|run| !run.caps.read().restriction.diagnostics()) {
             return;
         }
+        let mut params = params;
+        crate::virtual_doc::normalize_uris(&mut params);
         let params: lsp::PublishDiagnosticsParams = match serde_json::from_value(params) {
             Ok(p) => p,
             Err(e) => {
@@ -250,7 +252,14 @@ impl ClientHandler {
         {
             return;
         }
-        let shown = self.server.set_diagnostics(path.clone(), params.diagnostics);
+        // A late answer for an older version of the text is shown, but isn't fresh (`check_files`).
+        let obsolete =
+            params.version.is_some_and(|v| mgr.docs.lock().values().any(|d| d.path == path && d.version > v));
+        let shown = if obsolete {
+            self.server.set_obsolete_diagnostics(path.clone(), params.diagnostics)
+        } else {
+            self.server.set_diagnostics(path.clone(), params.diagnostics)
+        };
         mgr.emit_diagnostics(&self.server, path, shown, self.encoding());
     }
 
@@ -315,11 +324,13 @@ impl ClientHandler {
     }
 
     fn apply_edit(&self, mgr: &LspManager, params: Value) -> Result<Value, (i64, String)> {
-        let edit: lsp::WorkspaceEdit = params
-            .get("edit")
-            .cloned()
-            .ok_or_else(|| (codes::INVALID_PARAMS, "missing edit".to_owned()))
-            .and_then(|e| serde_json::from_value(e).map_err(|e| (codes::INVALID_PARAMS, e.to_string())))?;
+        let edit: lsp::WorkspaceEdit =
+            params.get("edit").cloned().ok_or_else(|| (codes::INVALID_PARAMS, "missing edit".to_owned())).and_then(
+                |mut e| {
+                    crate::virtual_doc::normalize_uris(&mut e);
+                    serde_json::from_value(e).map_err(|e| (codes::INVALID_PARAMS, e.to_string()))
+                },
+            )?;
         // Convert before calling the hook: it re-enters document sync.
         let edit = convert::workspace_edit(&mgr.conv(self.encoding()), edit);
         let applied = match mgr.apply_edit_hook() {

crates/ide-lsp/src/inspect.rs

@@ -239,6 +239,9 @@ impl LspManager {
         cancel: &CancellationToken,
     ) -> IdeResult<DocumentCheck> {
         let snap = self.snapshot(doc)?;
+        // The text may have changed before this call synced it (the file watcher reloaded it):
+        // only diagnostics published after the servers got the current text are fresh.
+        let changed = Some(changed.map_or(snap.changed, |c| c.max(snap.changed)));
         let deadline = tokio::time::Instant::now() + timeout;
         let left = || deadline.saturating_duration_since(tokio::time::Instant::now());
         let ready = tokio::select! {

crates/ide-lsp/src/jdtls.rs

@@ -809,6 +809,21 @@ impl LspManager {
             .map_err(|e| crate::rpc_err(&server.name, "java/projectConfigurationsUpdate", e))
     }
 
+    /// Asks jdtls to re-read library archives replaced in place (`openidea.java.refreshArchives`):
+    /// a SNAPSHOT installed again keeps its path, and JDT would keep showing the classes it read
+    /// from the old archive. Best-effort: skipped while jdtls is not already running.
+    pub async fn java_refresh_archives(&self, path: &Path, archives: &[PathBuf]) -> IdeResult<()> {
+        let java = LanguageId::new("java");
+        let Some(server) = self.servers_for(&java, path).into_iter().find(|s| s.name == SERVER) else {
+            return Ok(());
+        };
+        if server.running().is_none() {
+            return Ok(());
+        }
+        let archives = archives.iter().map(|a| Value::String(a.to_string_lossy().into_owned())).collect();
+        self.jdtls_command(path, "openidea.java.refreshArchives", archives).await.map(|_| ())
+    }
+
     /// Pause autobuild before resolving the launch classpath. That query takes the
     /// Java project's workspace scheduling rule, draining the interrupted autobuild.
     /// Keep this guard until Maven outputs have been copied out of JDT's reach.

crates/ide-lsp/src/lib.rs

@@ -120,6 +120,8 @@ struct DocState {
     compose_detected: bool,
     /// The notebook a code cell belongs to: synced through `notebookDocument/*`, not as a file.
     notebook: Option<PathBuf>,
+    /// When the servers last got new text (open or change): diagnostics published before are stale.
+    changed: std::time::Instant,
 }
 
 impl DocState {
@@ -158,6 +160,8 @@ struct DocSnap {
     language: LanguageId,
     text: Arc<DocText>,
     servers: Vec<Arc<Server>>,
+    /// [`DocState::changed`].
+    changed: std::time::Instant,
 }
 
 impl DocSnap {
@@ -237,6 +241,9 @@ pub struct LspManager {
     virtual_origins: Mutex<HashMap<String, ide_core::ServerId>>,
     /// Contents fetched for virtual URIs.
     virtual_docs: Mutex<HashMap<String, VirtualDocument>>,
+    /// Modification time of the archive behind a cached library class, so a jar
+    /// replaced in place (a SNAPSHOT installed again) is read again.
+    virtual_stamps: Mutex<HashMap<String, std::time::SystemTime>>,
     injections: injections::State,
     /// Open notebooks by path. Locked before `docs` when both are.
     notebooks: Mutex<HashMap<PathBuf, notebook::NotebookState>>,
@@ -504,6 +511,7 @@ impl LspManager {
             go_mod_checked: Mutex::new(HashSet::new()),
             virtual_origins: Mutex::new(HashMap::new()),
             virtual_docs: Mutex::new(HashMap::new()),
+            virtual_stamps: Mutex::new(HashMap::new()),
             injections: injections::State::default(),
             notebooks: Mutex::new(HashMap::new()),
         })
@@ -1170,6 +1178,7 @@ impl LspManager {
             servers: servers.iter().map(|s| Attached { server: s.clone(), opened_gen: None }).collect(),
             compose_detected,
             notebook: None,
+            changed: std::time::Instant::now(),
         };
         let compose_added = {
             let mut docs = self.docs.lock();
@@ -1217,6 +1226,7 @@ impl LspManager {
         let mut docs = self.docs.lock();
         let Some(d) = docs.get_mut(&doc) else { return };
         d.version = version as i32;
+        d.changed = std::time::Instant::now();
 
         // Servers that have this document open on their current instance.
         let targets: Vec<(Arc<Server>, Running, SyncKind, Encoding)> = d
@@ -1392,6 +1402,7 @@ impl LspManager {
             language: d.language.clone(),
             text: d.text.clone(),
             servers,
+            changed: d.changed,
         })
     }
 
@@ -1433,13 +1444,9 @@ impl LspManager {
         let params = serde_json::to_value(params).map_err(|e| IdeError::internal(e.to_string()))?;
         let stamp = self.injected_request_stamp(&params);
         let fut = async {
-            if t.server.name == "csharp-ls" {
-                let mut value = t.run.peer.request::<Value, Value>(method, params, cancel.cloned()).await?;
-                virtual_doc::normalize_csharp_uris(&mut value);
-                serde_json::from_value(value).map_err(|e| RpcError::Protocol(format!("{method}: {e}")))
-            } else {
-                t.run.peer.request::<Value, R>(method, params, cancel.cloned()).await
-            }
+            let mut value = t.run.peer.request::<Value, Value>(method, params, cancel.cloned()).await?;
+            virtual_doc::normalize_uris(&mut value);
+            serde_json::from_value(value).map_err(|e| RpcError::Protocol(format!("{method}: {e}")))
         };
         let result = match tokio::time::timeout(timeout, fut).await {
             Ok(r) => r.map_err(|e| rpc_err(&t.server.name, method, e)),
@@ -3199,14 +3206,44 @@ impl LspManager {
         Ok(found)
     }
 
+    /// Whether the archive behind a cached library class changed since it was read.
+    /// Stats the archive: call from a blocking worker.
+    pub fn library_class_changed(&self, uri: &str) -> bool {
+        let Some(stamp) = self.virtual_stamps.lock().get(uri).copied() else { return false };
+        virtual_doc::archive_modified(uri) != Some(stamp)
+    }
+
+    /// Archives behind cached library classes that changed since they were read.
+    /// Stats each archive: call from a blocking worker.
+    pub fn changed_library_archives(&self) -> Vec<PathBuf> {
+        let uris: Vec<String> = self.virtual_stamps.lock().keys().cloned().collect();
+        let mut archives: Vec<PathBuf> = uris
+            .iter()
+            .filter(|uri| self.library_class_changed(uri))
+            .filter_map(|uri| virtual_doc::archive(uri))
+            .collect();
+        archives.sort();
+        archives.dedup();
+        archives
+    }
+
     /// Contents of a virtual document, from the server that owns `uri`:
     /// `workspace/textDocumentContent` (LSP 3.18) when the server serves the
     /// scheme, jdtls' `java/classFileContents` for `jdt:` URIs. A `jar:` entry
     /// is read from its archive, a `jar:` class shown as its library source
     /// (see [`library_source`]) or else decompiled by the server. Cached.
     pub async fn virtual_document(&self, uri: &str) -> IdeResult<VirtualDocument> {
-        if let Some(d) = self.virtual_docs.lock().get(uri) {
-            return Ok(d.clone());
+        let cached = self.virtual_docs.lock().get(uri).cloned();
+        if let Some(d) = cached {
+            let stamp = self.virtual_stamps.lock().get(uri).copied();
+            let current = {
+                let uri = uri.to_owned();
+                tokio::task::spawn_blocking(move || virtual_doc::archive_modified(&uri)).await.ok().flatten()
+            };
+            if stamp.is_none() || stamp == current {
+                return Ok(d);
+            }
+            self.virtual_docs.lock().remove(uri);
         }
         let scheme = virtual_doc::scheme(uri).to_owned();
         let jar_class = scheme == "jar" && library_source::parse(uri).is_some_and(|e| e.entry.ends_with(".class"));
@@ -3350,11 +3387,18 @@ impl LspManager {
         if let Some(server) = server {
             self.virtual_origins.lock().entry(uri.to_owned()).or_insert(server);
         }
+        let stamp = virtual_doc::archive_modified(uri);
         let mut cache = self.virtual_docs.lock();
+        let mut stamps = self.virtual_stamps.lock();
         if cache.len() >= VIRTUAL_CACHE_LIMIT {
             cache.clear();
+            stamps.clear();
         }
         cache.insert(uri.to_owned(), doc.clone());
+        match stamp {
+            Some(stamp) => stamps.insert(uri.to_owned(), stamp),
+            None => stamps.remove(uri),
+        };
         doc
     }
 

crates/ide-lsp/src/notebook.rs

@@ -213,6 +213,7 @@ impl LspManager {
             {
                 if d.text.as_str() != cell.source {
                     Arc::make_mut(&mut d.text).set(&cell.source);
+                    d.changed = std::time::Instant::now();
                 }
                 d.version += 1;
                 state.cells.push((cell.id.clone(), doc));
@@ -234,6 +235,7 @@ impl LspManager {
                     servers: state.servers.iter().map(|s| Attached { server: s.clone(), opened_gen: None }).collect(),
                     compose_detected: false,
                     notebook: Some(path.to_owned()),
+                    changed: std::time::Instant::now(),
                 },
             );
             state.cells.push((cell.id.clone(), doc));
@@ -259,6 +261,7 @@ impl LspManager {
             }
             Arc::make_mut(&mut d.text).set(&cell.source);
             d.version += 1;
+            d.changed = std::time::Instant::now();
             content.push(json!({
                 "document": { "uri": d.uri, "version": d.version },
                 "changes": [{ "text": cell.source }],

crates/ide-lsp/src/server.rs

@@ -770,6 +770,20 @@ impl Server {
         self.combine(path)
     }
 
+    /// [`Server::set_diagnostics`] for a publication tagged with a document version older than
+    /// the text the server has now: shown, but not an answer for the current text, so
+    /// [`Server::last_published`] keeps its time.
+    pub fn set_obsolete_diagnostics(&self, path: PathBuf, items: Vec<lsp::Diagnostic>) -> Vec<lsp::Diagnostic> {
+        let before = self.last_published(&path);
+        let shown = self.set_diagnostics(path.clone(), items);
+        let mut published = self.published.lock();
+        match before {
+            Some(at) => published.insert(path, at),
+            None => published.remove(&path),
+        };
+        shown
+    }
+
     /// Records a pulled report for `path` (`None` items: unchanged since `result_id`'s
     /// predecessor); returns what the file now shows.
     pub fn set_pulled(

crates/ide-lsp/src/virtual_doc.rs

@@ -18,23 +18,36 @@ const URI_ESCAPES: &AsciiSet = &CONTROLS
     .add(b'|')
     .add(b'}');
 
-/// csharp-ls uses .NET Uri.ToString(), which can leave spaces and Unicode unescaped.
-/// Normalize only document URI fields, before lsp-types' strict URI deserialization.
-pub(crate) fn normalize_csharp_uris(value: &mut serde_json::Value) {
+/// Servers can leave spaces and Unicode unescaped in document URIs: csharp-ls uses .NET
+/// `Uri.ToString()`, and Java servers build some URIs with `java.net.URI.toString()` (which keeps
+/// non-ASCII characters), e.g. jdtls in a refactoring's edit for a project under a Chinese path.
+/// Escape them in document URI fields (and `WorkspaceEdit.changes` keys) before lsp-types' strict
+/// URI deserialization, which otherwise rejects the whole response.
+pub(crate) fn normalize_uris(value: &mut serde_json::Value) {
     match value {
-        serde_json::Value::Array(values) => values.iter_mut().for_each(normalize_csharp_uris),
+        serde_json::Value::Array(values) => values.iter_mut().for_each(normalize_uris),
         serde_json::Value::Object(fields) => {
-            for (key, value) in fields {
+            for (key, value) in fields.iter_mut() {
                 // Opaque payloads must survive resolve/execute round trips unchanged.
                 if matches!(key.as_str(), "data" | "arguments") {
                     continue;
                 }
-                if matches!(key.as_str(), "uri" | "targetUri")
-                    && let Some(uri) = value.as_str().filter(|s| s.starts_with("csharp:"))
+                if matches!(key.as_str(), "uri" | "targetUri" | "oldUri" | "newUri")
+                    && let Some(uri) = value.as_str().and_then(escaped_uri)
                 {
-                    *value = utf8_percent_encode(uri, URI_ESCAPES).to_string().into();
+                    *value = uri.into();
+                } else if key == "changes"
+                    && let serde_json::Value::Object(changes) = value
+                {
+                    *changes = std::mem::take(changes)
+                        .into_iter()
+                        .map(|(uri, mut edits)| {
+                            normalize_uris(&mut edits);
+                            (escaped_uri(&uri).unwrap_or(uri), edits)
+                        })
+                        .collect();
                 } else {
-                    normalize_csharp_uris(value);
+                    normalize_uris(value);
                 }
             }
         }
@@ -42,6 +55,16 @@ pub(crate) fn normalize_csharp_uris(value: &mut serde_json::Value) {
     }
 }
 
+/// `uri` with the characters a URI can't hold escaped; `None` when nothing changes or it is
+/// not a document URI this applies to (other schemes are passed back to servers as given).
+fn escaped_uri(uri: &str) -> Option<String> {
+    if !(uri.starts_with("file:") || uri.starts_with("csharp:")) {
+        return None;
+    }
+    let escaped = utf8_percent_encode(uri, URI_ESCAPES).to_string();
+    (escaped != uri).then_some(escaped)
+}
+
 #[derive(serde::Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub(crate) struct CSharpMetadata {
@@ -149,6 +172,20 @@ pub fn description(uri: &str) -> Option<String> {
     }
 }
 
+/// The archive a `jar:` or `jdt:` library class comes from.
+pub(crate) fn archive(uri: &str) -> Option<std::path::PathBuf> {
+    match scheme(uri) {
+        "jar" => Some(crate::library_source::parse(uri)?.jar),
+        "jdt" => description(uri).filter(|p| p.ends_with(".jar") || p.ends_with(".jmod")).map(Into::into),
+        _ => None,
+    }
+}
+
+/// Modification time of the archive a `jar:` or `jdt:` library class comes from.
+pub(crate) fn archive_modified(uri: &str) -> Option<std::time::SystemTime> {
+    std::fs::metadata(archive(uri)?).and_then(|m| m.modified()).ok()
+}
+
 /// Check both the package and actual archive, so duplicate type names never pick another jar.
 pub(crate) fn matches_class(uri: &str, jar: &std::path::Path, package: &str, name: &str) -> bool {
     let segs = segments(uri);
@@ -202,7 +239,7 @@ mod tests {
             { "data": { "uri": uri }, "command": { "arguments": [{ "targetUri": uri }] } }
         ]);
         let original = response.clone();
-        normalize_csharp_uris(&mut response);
+        normalize_uris(&mut response);
         assert_eq!(response[0]["uri"], encoded);
         assert_eq!(response[0]["source"], uri);
         assert_eq!(response[1]["location"]["targetUri"], encoded);
@@ -210,6 +247,31 @@ mod tests {
         assert!(encoded.parse::<lsp_types::Uri>().is_ok());
     }
 
+    /// #3089: jdtls's Introduce Variable edit for a project under a Chinese path names the file
+    /// with the characters unescaped, and the resolved code action failed to deserialize.
+    #[test]
+    fn file_uris_with_unicode_and_spaces_deserialize_in_workspace_edits() {
+        let uri = "file:///C:/项目/my app/src/A.java";
+        let encoded = "file:///C:/%E9%A1%B9%E7%9B%AE/my%20app/src/A.java";
+        let edit = serde_json::json!([{ "range": { "start": { "line": 0, "character": 0 }, "end": { "line": 0, "character": 0 } }, "newText": "x" }]);
+        let mut action = serde_json::json!({
+            "title": "Extract to local variable",
+            "edit": {
+                "documentChanges": [{ "textDocument": { "uri": uri, "version": 3 }, "edits": edit }],
+                "changes": { (uri): edit },
+            },
+            "data": { "uri": uri },
+        });
+        assert!(serde_json::from_value::<lsp_types::CodeAction>(action.clone()).is_err());
+        normalize_uris(&mut action);
+        let action: lsp_types::CodeAction = serde_json::from_value(action.clone()).unwrap();
+        let edit = action.edit.unwrap();
+        let Some(lsp_types::DocumentChanges::Edits(edits)) = edit.document_changes else { panic!() };
+        assert_eq!(edits[0].text_document.uri.as_str(), encoded);
+        assert_eq!(edit.changes.unwrap().keys().next().unwrap().as_str(), encoded);
+        assert_eq!(action.data.unwrap()["uri"], uri, "opaque data is passed back unchanged");
+    }
+
     #[test]
     fn jdt_titles() {
         assert_eq!(title(JDT, true), "SpringApplication.class");
@@ -256,6 +318,29 @@ mod tests {
         assert_eq!(description("foo://x/y"), None);
     }
 
+    #[test]
+    fn finds_the_archive_behind_a_library_class() {
+        assert_eq!(archive(JDT), Some("/Users/me/.m2/repository/spring-boot-4.1.1.jar".into()));
+        assert_eq!(
+            archive("jdt://contents/java.base/java.lang/String.class?=p/%5C/jdk%5C/lib%5C/jrt-fs.jar%60java.base=x"),
+            None
+        );
+        assert_eq!(archive("jdt://contents/a.jar/p/C.class"), None);
+        assert_eq!(archive("file:///a/C.java"), None);
+
+        let dir = tempfile::tempdir().unwrap();
+        let jar = dir.path().join("lib-1.0-SNAPSHOT.jar");
+        std::fs::write(&jar, b"PK").unwrap();
+        let uri = format!("jar:file://{}!/p/C.class", jar.display());
+        assert_eq!(archive(&uri), Some(jar.clone()));
+        let before = archive_modified(&uri).unwrap();
+        let file = std::fs::File::options().write(true).open(&jar).unwrap();
+        file.set_modified(before + std::time::Duration::from_secs(5)).unwrap();
+        assert_ne!(archive_modified(&uri), Some(before));
+        std::fs::remove_file(&jar).unwrap();
+        assert_eq!(archive_modified(&uri), None);
+    }
+
     #[test]
     fn detects_generated_code() {
         assert!(is_decompiled(

crates/ide-lsp/tests/mock_server.rs

@@ -2204,6 +2204,25 @@ async fn checking_a_document_saves_it_and_waits_for_fresh_diagnostics() {
     let stale = h.mgr.check_document(doc, changed, Duration::from_millis(800), &cancel).await.unwrap();
     assert!(stale.servers[0].checked && stale.servers[0].incomplete, "{:?}", stale.servers);
     assert_eq!(stale.diagnostics.len(), 1);
+
+    // The text changed before the call (the file watcher reloaded it), so the caller saw no
+    // change of its own: the old publication is still not fresh.
+    h.mgr.did_change(doc, 2, &[change(rng(0, 0, 0, 3), "good")], &|| "good\n".to_owned());
+    let reloaded = h.mgr.check_document(doc, None, Duration::from_millis(800), &cancel).await.unwrap();
+    assert!(reloaded.servers[0].incomplete, "{:?}", reloaded.servers);
+
+    // A late publication tagged with the old version is no answer for the current text.
+    s.peer()
+        .notify("textDocument/publishDiagnostics", json!({ "uri": uri_of(&path), "version": 1, "diagnostics": [] }))
+        .unwrap();
+    let late = h.mgr.check_document(doc, None, Duration::from_millis(800), &cancel).await.unwrap();
+    assert!(late.servers[0].incomplete, "{:?}", late.servers);
+    // One for the current version is.
+    s.peer()
+        .notify("textDocument/publishDiagnostics", json!({ "uri": uri_of(&path), "version": 2, "diagnostics": [] }))
+        .unwrap();
+    let fresh = h.mgr.check_document(doc, None, Duration::from_secs(5), &cancel).await.unwrap();
+    assert!(fresh.servers[0].checked && !fresh.servers[0].incomplete, "{:?}", fresh.servers);
 }
 
 #[tokio::test(flavor = "multi_thread")]

crates/ide-mcp/src/discovery.rs

@@ -1,6 +1,7 @@
 //! `<app-data>/mcp/server.json`: where the running IDE's server listens and
 //! its token, for the stdio bridge. Readable only by the user; removed when
-//! the server stops.
+//! the server stops. `<app-data>/mcp/token` keeps the token across runs when
+//! the user chose a fixed token.
 
 use serde::{Deserialize, Serialize};
 use std::io;
@@ -14,6 +15,28 @@ pub fn discovery_path(app_data: &Path) -> PathBuf {
     app_data.join(DISCOVERY_FILE)
 }
 
+/// The kept token, relative to the app data directory.
+pub const TOKEN_FILE: &str = "mcp/token";
+
+/// The kept token of the IDE whose app data directory is `app_data`.
+pub fn token_path(app_data: &Path) -> PathBuf {
+    app_data.join(TOKEN_FILE)
+}
+
+/// The token kept at `path`; a new one is made and kept there when there is none (or the
+/// file doesn't hold one). Readable only by the user.
+pub fn kept_token(path: &Path) -> io::Result<String> {
+    if let Ok(text) = std::fs::read_to_string(path) {
+        let token = text.trim();
+        if token.len() == 64 && token.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return Ok(token.to_owned());
+        }
+    }
+    let token = crate::server::new_token()?;
+    write_atomic(path, token.as_bytes())?;
+    Ok(token)
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Discovery {
     pub port: u16,
@@ -32,15 +55,8 @@ impl Discovery {
 
     /// Writes the file atomically, readable only by the user.
     pub fn write(&self, path: &Path) -> io::Result<()> {
-        let dir = path.parent().ok_or_else(|| io::Error::other("no parent directory"))?;
-        std::fs::create_dir_all(dir)?;
-        let tmp = path.with_extension(format!("tmp{}", std::process::id()));
         let bytes = serde_json::to_vec_pretty(self).map_err(io::Error::other)?;
-        let written = write_private(&tmp, &bytes).and_then(|()| std::fs::rename(&tmp, path));
-        if written.is_err() {
-            let _ = std::fs::remove_file(&tmp);
-        }
-        written
+        write_atomic(path, &bytes)
     }
 
     /// Removes the file at `path` if it still describes this process's server.
@@ -51,6 +67,18 @@ impl Discovery {
     }
 }
 
+/// Writes `bytes` to `path` atomically, readable only by the user.
+fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
+    let dir = path.parent().ok_or_else(|| io::Error::other("no parent directory"))?;
+    std::fs::create_dir_all(dir)?;
+    let tmp = path.with_extension(format!("tmp{}", std::process::id()));
+    let written = write_private(&tmp, bytes).and_then(|()| std::fs::rename(&tmp, path));
+    if written.is_err() {
+        let _ = std::fs::remove_file(&tmp);
+    }
+    written
+}
+
 #[cfg(unix)]
 fn write_private(path: &Path, bytes: &[u8]) -> io::Result<()> {
     use std::io::Write;
@@ -91,4 +119,23 @@ mod tests {
         Discovery::remove_if_ours(&path);
         assert!(!path.exists());
     }
+
+    #[test]
+    fn keeps_one_token_until_its_file_is_removed() {
+        let tmp = tempfile::tempdir().unwrap();
+        let path = token_path(tmp.path());
+        let first = kept_token(&path).unwrap();
+        assert_eq!(first.len(), 64);
+        assert_eq!(kept_token(&path).unwrap(), first, "the same token on the next run");
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(std::fs::metadata(&path).unwrap().permissions().mode() & 0o777, 0o600);
+        }
+        std::fs::write(&path, "not a token").unwrap();
+        let replaced = kept_token(&path).unwrap();
+        assert_ne!(replaced, first);
+        std::fs::remove_file(&path).unwrap();
+        assert_ne!(kept_token(&path).unwrap(), replaced, "a removed token is made anew");
+    }
 }

crates/ide-mcp/src/lib.rs

@@ -22,8 +22,8 @@ mod protocol;
 mod server;
 pub mod stdio;
 
-pub use discovery::{DISCOVERY_FILE, Discovery, discovery_path};
-pub use server::McpServer;
+pub use discovery::{DISCOVERY_FILE, Discovery, TOKEN_FILE, discovery_path, kept_token, token_path};
+pub use server::{McpServer, ServerOptions};
 pub use tokio_util::sync::CancellationToken;
 
 use std::path::{Path, PathBuf};

crates/ide-mcp/src/server.rs

@@ -49,12 +49,25 @@ struct Shared {
 /// removes its discovery file.
 pub struct McpServer {
     port: u16,
+    /// Why the port asked for in [`ServerOptions::port`] was not used.
+    port_unavailable: Option<String>,
     token: String,
     discovery: Option<PathBuf>,
     shutdown: watch::Sender<bool>,
     cancel: CancellationToken,
 }
 
+/// How [`McpServer::start_with`] listens.
+#[derive(Clone, Debug, Default)]
+pub struct ServerOptions {
+    /// Listen on `127.0.0.1:<port>`. When it can't be bound (in use, or reserved by the
+    /// system), a free port is taken instead and [`McpServer::port_unavailable`] says why.
+    /// `None`: a free port.
+    pub port: Option<u16>,
+    /// The bearer token; `None`: a new one.
+    pub token: Option<String>,
+}
+
 impl McpServer {
     /// Starts listening on `127.0.0.1:<random port>` with a new token, on
     /// `runtime`, and writes the discovery file at `discovery` if given.
@@ -63,10 +76,32 @@ impl McpServer {
         discovery: Option<PathBuf>,
         runtime: &tokio::runtime::Handle,
     ) -> std::io::Result<Self> {
-        let listener = std::net::TcpListener::bind(("127.0.0.1", 0))?;
+        Self::start_with(registry, discovery, runtime, ServerOptions::default())
+    }
+
+    /// [`Self::start`] on the port and with the token of `options`.
+    pub fn start_with(
+        registry: Arc<dyn ToolRegistry>,
+        discovery: Option<PathBuf>,
+        runtime: &tokio::runtime::Handle,
+        options: ServerOptions,
+    ) -> std::io::Result<Self> {
+        let (listener, port_unavailable) = match options.port {
+            Some(port) => match std::net::TcpListener::bind(("127.0.0.1", port)) {
+                Ok(listener) => (listener, None),
+                Err(e) => {
+                    tracing::warn!("MCP server: port {port} unavailable ({e}); taking a free one");
+                    (std::net::TcpListener::bind(("127.0.0.1", 0))?, Some(format!("port {port}: {e}")))
+                }
+            },
+            None => (std::net::TcpListener::bind(("127.0.0.1", 0))?, None),
+        };
         listener.set_nonblocking(true)?;
         let port = listener.local_addr()?.port();
-        let token = new_token()?;
+        let token = match options.token {
+            Some(token) => token,
+            None => new_token()?,
+        };
         let listener = {
             let _entered = runtime.enter();
             tokio::net::TcpListener::from_std(listener)?
@@ -91,13 +126,18 @@ impl McpServer {
         });
         runtime.spawn(accept(listener, shared, stopped));
         tracing::info!("MCP server on 127.0.0.1:{port}");
-        Ok(Self { port, token, discovery, shutdown, cancel })
+        Ok(Self { port, port_unavailable, token, discovery, shutdown, cancel })
     }
 
     pub fn port(&self) -> u16 {
         self.port
     }
 
+    /// Why the port of [`ServerOptions::port`] is not the one listened on.
+    pub fn port_unavailable(&self) -> Option<&str> {
+        self.port_unavailable.as_deref()
+    }
+
     /// The bearer token of this run.
     pub fn token(&self) -> &str {
         &self.token

crates/ide-mcp/tests/server.rs

@@ -1,7 +1,7 @@
 //! The server over real HTTP, and the stdio bridge in front of it, with a
 //! registry standing in for the IDE host.
 
-use ide_mcp::{Discovery, McpServer, Tool, ToolCallError, ToolRegistry, discovery_path, stdio};
+use ide_mcp::{Discovery, McpServer, ServerOptions, Tool, ToolCallError, ToolRegistry, discovery_path, stdio};
 use serde_json::{Value, json};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -366,3 +366,30 @@ async fn a_cancellation_that_arrives_before_the_call_is_remembered() {
     let (_, body) = post(&s, "/mcp", &headers, &call).await;
     assert_eq!(serde_json::from_str::<Value>(&body).unwrap()["result"]["isError"], true);
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn a_fixed_port_and_token_are_used_and_a_taken_port_falls_back_to_a_free_one() {
+    let mut s = setup();
+    s.server.take().unwrap().stop();
+    let free = std::net::TcpListener::bind(("127.0.0.1", 0)).unwrap().local_addr().unwrap().port();
+    let token = "ab".repeat(32);
+    let options = ServerOptions { port: Some(free), token: Some(token.clone()) };
+    let registry = Arc::new(Registry { project: s.project.clone() });
+    let runtime = tokio::runtime::Handle::current();
+    s.server =
+        Some(McpServer::start_with(registry.clone(), Some(s.discovery.clone()), &runtime, options.clone()).unwrap());
+    assert_eq!((s.server().port(), s.server().token()), (free, token.as_str()));
+    assert!(s.server().port_unavailable().is_none());
+    assert_eq!(Discovery::read(&s.discovery).unwrap().port, free);
+    let list = rpc(&s, "tools/list", json!({})).await;
+    assert_eq!(list["result"]["tools"][0]["name"], "echo");
+
+    // The port is taken (by the first server): a second one listens elsewhere and says why.
+    let second = McpServer::start_with(registry, None, &runtime, options).unwrap();
+    assert_ne!(second.port(), free);
+    assert!(
+        second.port_unavailable().is_some_and(|why| why.contains(&free.to_string())),
+        "{:?}",
+        second.port_unavailable()
+    );
+}

crates/ide-plugin/src/types.rs

@@ -922,6 +922,9 @@ pub struct FileDecoration {
     pub badge: Option<String>,
     pub style: String,
     pub tooltip: Option<String>,
+    /// Text shown after the name (API 1.7 `set-file-note`).
+    #[serde(default)]
+    pub note: Option<String>,
 }
 /// Commit metadata, date in Unix seconds.
 #[derive(Clone, Debug, Serialize, Deserialize, Type)]

crates/ide-plugin/src/wit_host.rs

@@ -2497,7 +2497,7 @@ impl bindings::openidea::plugin::decorations::Host for StoreData {
             .file_decorations(
                 Some(&real),
                 &set_id,
-                Some(crate::FileDecoration { badge: item.badge, style: item.style, tooltip: item.tooltip }),
+                Some(crate::FileDecoration { badge: item.badge, style: item.style, tooltip: item.tooltip, note: None }),
             )
             .map_err(to_wit))
     }
@@ -2507,6 +2507,17 @@ impl bindings::openidea::plugin::decorations::Host for StoreData {
         }
         Ok(self.host.file_decorations(None, &set_id, None).map_err(to_wit))
     }
+    fn set_file_note(&mut self, path: String, set_id: String, note: String, tooltip: Option<String>) -> Fallible<()> {
+        if let Err(e) = self.require(Capability::ProjectRead) {
+            return Ok(Err(e));
+        }
+        let real = match self.decoration_path(&path) {
+            Ok(real) => real,
+            Err(e) => return Ok(Err(e)),
+        };
+        let item = crate::FileDecoration { badge: None, style: String::new(), tooltip, note: Some(note) };
+        Ok(self.host.file_decorations(Some(&real), &set_id, Some(item)).map_err(to_wit))
+    }
 }
 
 pub(crate) mod language_features_bindings {

crates/ide-plugin/tests/fixtures/api14/dist/plugin.wasm.sources

@@ -1 +1 @@
-3c7f35facd15ee8380ccb6475b7c051d500e38346b711e1805077becd0c75f75
+d6c855f1f91aeb02eec5d6c8a07be4eb64bae0704619f44cb67f3b832daf01ee

crates/ide-plugin/tests/fixtures/commit/dist/plugin.wasm.sources

@@ -1 +1 @@
-3879822d975695c6258e95286b0e64c5ee1e3265876501efaf0e577b38f8222b
+51d00702c42c7167083caea70cf2df022e512bcaf89af8addf526421ff45a15f

crates/ide-plugin/tests/fixtures/data-tools/dist/plugin.wasm.sources

@@ -1 +1 @@
-228ae888bf556ce5cedc7843eb20e92f221d9e1f640f3c6c595bed3fd6be6051
+40d2fd76ba96b0c93ea0a034c6749709ddc00fc119046e653a50b180a9c4718d

crates/ide-plugin/tests/fixtures/detail-views/dist/plugin.wasm.sources

@@ -1 +1 @@
-41de239b6f723020b38eb2b67f642b7c88cc88c79117c3072ba122633afc418c
+08822287f3649412340f9dbbe2f0ea5a5cd2f543a3c242c5d0a29c422c4c5367

crates/ide-plugin/tests/fixtures/diagnostics/dist/plugin.wasm.sources

@@ -1 +1 @@
-78c5ed3c756498c7619b46c3622ae7a59461c61c747b45caecd79b341ee654de
+43eba23cc14cf3c74bfc934099cd58df20f07ee5df96cc10100b90016c544a7a

crates/ide-plugin/tests/fixtures/endpoints/dist/plugin.wasm.sources

@@ -1 +1 @@
-ee848321e53cb181536e6158570dbb4ab02a6fd2a1a064b068803ac7da7f3448
+520d9a95328dc772bbb913a2e5e22af8243c95ca45744cbb65b25747653d2a34

crates/ide-plugin/tests/fixtures/execution/dist/plugin.wasm.sources

@@ -1 +1 @@
-b587de945875a98f1d4ca20fab7cf94fb4dc6d848136aa19ab0e0e5319155a80
+acd3d0ee3f886c6a271ce3139200ce5bdb46e40f9c68e495c5ff9b4db98a88ac

crates/ide-plugin/tests/fixtures/ext-owner/dist/plugin.wasm.sources

@@ -1 +1 @@
-1c8776dcae35d2d49dd6c1e32b0cdd354de1eb0f72a473245a2c47368b89ec30
+0cf3bc2197f0bd5339fe3c2199bd973e68b3637b8c5ae07902e62659160275e3

crates/ide-plugin/tests/fixtures/file-templates/dist/plugin.wasm.sources

@@ -1 +1 @@
-2a517cbffd6d3cdda37117d8ca8815978a09995923fc3d5aa5af7020afdac56a
+17f837c8d6f58800728e00060afe68b2a093085d816d809c9e67065fdd165352

crates/ide-plugin/tests/fixtures/files-events/dist/plugin.wasm.sources

@@ -1 +1 @@
-dbd912b1f8488ecd446af07b5dcaef55d44bce57c1a55be5c0b0fb33e2697903
+2cca80220fab6764a8e1f51db8ed2f55b603000c8d0dbf5913a441876b7857ba

crates/ide-plugin/tests/fixtures/grouped-views/dist/plugin.wasm.sources

@@ -1 +1 @@
-efdc84cd2bedb3989b03d19b569d09958f26e502db65db4dd786eb3438a7c407
+54211437002ad83a9d3d642f2dca5f37cadd89d7d77ddc7de545db87b99fb8b7

crates/ide-plugin/tests/fixtures/hello/dist/plugin.wasm.sources

@@ -1 +1 @@
-be6bc15ee42a5e21781ba54f548007351a46b669882ee4491da20ff556927a06
+4326d9cdefe71f4bb9aab043ccef883abbd13145b1579352b97c66889f514c68

crates/ide-plugin/tests/fixtures/hover/dist/plugin.wasm.sources

@@ -1 +1 @@
-e5c3a3beda750dff27d7b823676d53f15b7c76b8ad539594cd913bd178d750da
+2469023f4f29b9abdaa27c9d96774229c4dd002366421dc508926c3fed1fba1b

crates/ide-plugin/tests/fixtures/indexer/dist/plugin.wasm.sources

@@ -1 +1 @@
-322de3299f0413101c02358836e7df7e06e58cbb22c11897664564abbb8af090
+233461ab52a12e27fa600e108e83cab1b930b3e61812e0c048c99c1e18c6d646

crates/ide-plugin/tests/fixtures/inlay-hints/dist/plugin.wasm.sources

@@ -1 +1 @@
-d768ff6a4a466cc6f1d72499df3ccb4ae76872436b8eddff27f62aa156331a37
+bfc654523da608bbc008ea6a15a0cfd0b129ffab70088bf6b610786b63b5352e

crates/ide-plugin/tests/fixtures/jobs/dist/plugin.wasm.sources

@@ -1 +1 @@
-57aea107b2c10e4d30fa3785ac4c6566f1b40908a18a3859aca8be047fac9518
+c8536be072d27aa89f5e92b5b96e38ed65b7f06c35c05ecbd4a151218203c5f7

crates/ide-plugin/tests/fixtures/language-features/dist/plugin.wasm.sources

@@ -1 +1 @@
-c98bcc89750e26e738d7115a7c0454fde25367a0a23bdc2ff95fb5a5dacc9f98
+7c0c1f5035e12c794d48cb75a8fc259d11dd99ba3188030fe1d9956720ee6ad5

crates/ide-plugin/tests/fixtures/misbehave/dist/plugin.wasm.sources

@@ -1 +1 @@
-a4c23b93a14eda705cb18c88bbc2373d1ef3f96031ff2df21b8b092b50633996
+3cf5fd6ab0ce909b806230e20a7fa46264f85937018cfa68865ec0eeb92d4b72

crates/ide-plugin/tests/fixtures/path-events/dist/plugin.wasm.sources

@@ -1 +1 @@
-aec002b3dd310068e69a6ae67a49d30655bf8baea9153a110a407e9d408e6880
+d349977fd3cbfba92d1d953ac09f65dae5b83b7070723b59553d791c638acf81

crates/ide-plugin/tests/fixtures/private-dir/dist/plugin.wasm.sources

@@ -1 +1 @@
-08ece563c3b55c2b86e68fbb0815ddcbb63beb6f1f6c32b8dbdbee558a4a66c1
+e796039ae2f8e534ffc8c2ed2e47e910aaf593c464525287699cf1daf3e195ef

crates/ide-plugin/tests/fixtures/semantic-tokens/dist/plugin.wasm.sources

@@ -1 +1 @@
-450845edf234a1cc78cd6cfc0b812a89f3a2e41484689cc1e1b05be66873d4eb
+5e084fa409bb0641409110d91f203a6f99b451b95cd8067bd1ee68140bf8a892

crates/ide-plugin/tests/fixtures/settings-pages/dist/plugin.wasm.sources

@@ -1 +1 @@
-61b735de5ef61dcd0ea8e640c2ad004e84a63fe4dfd7872ffb5e04d6d81dc9a9
+521557c1a062a9b82afa14547bc54b57255cdbed3b2ab4b1b86424dfb8accbdc

crates/ide-plugin/tests/fixtures/storage/dist/plugin.wasm.sources

@@ -1 +1 @@
-36776367782eaa4b8b8121f4a665dd8e68525a4836bff1c92bc16770cce14929
+5280990269e944aef81ec91b356fadf4aa2fc7e7bb10e4b6842e1dc1c669704a

crates/ide-plugin/tests/fixtures/symbols/dist/plugin.wasm.sources

@@ -1 +1 @@
-f6311d232a99356b02a398b2ce3db0865c425f435a8d201157719178ba2b97c7
+ff1391d3c9338b6270fef8af7d7c4a5bc595c391997c220a3a827b4b8a068de8

crates/ide-plugin/tests/fixtures/tables/dist/plugin.wasm.sources

@@ -1 +1 @@
-fe1d26665e3c816ed43fc720acabad03a37b7924bccd4dd8c357fd156947b3c7
+b78ac0b6fa14401a6379f3e6d07d1398a63d70e882930b3747ec843c0fdb5de7

crates/ide-plugin/tests/fixtures/web-content/dist/plugin.wasm.sources

@@ -1 +1 @@
-76bab8e48235f9f066f5b9bbfdd9398916b6c3ed73c072c543d80595130519f7
+55331477c1d5322b0dc35d13fc7f8223bf697f5f21328d340f75519dd1098727

crates/ide-plugin/tests/fixtures/web-log/dist/plugin.wasm.sources

@@ -1 +1 @@
-f9ed2eac306229f76b05d0c4a4fb2f0ed8d81a1dfc5eb50d044bbe10c9206a5f
+0ae6b7edd0d7cd5025ead4a4afacf0fbe3ebc9548d847f94be0e63585a19747e

crates/ide-plugin/tests/fixtures/web-pty/dist/plugin.wasm.sources

@@ -1 +1 @@
-f2d83d9f56da072d38a1552195af8a9d4edc11888c645627d5dd1e4a46afc4df
+5d909d6ab2e73fabba2d213a944546ef7e425552852cf7f74e00eb94c9d167ac

crates/ide-sdk/src/apply.rs

@@ -323,6 +323,18 @@ fn resolve_gradle_command(root: &Path, build_dir: &Path, s: &Settings, use_wrapp
     }
     let wrapper = build_dir.join(if cfg!(windows) { "gradlew.bat" } else { "gradlew" });
     if use_wrapper && wrapper.is_file() {
+        // `gradlew` can't start without its jar, which `.gitignore`s with `*.jar` often leave
+        // out: run the distribution the wrapper already unpacked instead.
+        if build_dir.join("gradle/wrapper/gradle-wrapper.jar").is_file() {
+            return wrapper;
+        }
+        let home = setting_path(root, &g.user_home)
+            .or_else(|| std::env::var_os("GRADLE_USER_HOME").map(PathBuf::from))
+            .or_else(|| Some(crate::home_dir()?.join(".gradle")));
+        if let Some(gradle) = home.and_then(|home| unpacked_wrapper_distribution(build_dir, &home)) {
+            return gradle;
+        }
+        // Nothing to run instead: the wrapper's failure explains what is missing.
         return wrapper;
     }
     pinned::pinned_install(build_dir, Tool::Gradle)
@@ -330,6 +342,21 @@ fn resolve_gradle_command(root: &Path, build_dir: &Path, s: &Settings, use_wrapp
         .unwrap_or_else(|| name.into())
 }
 
+/// `bin/gradle` of the distribution `gradle/wrapper/gradle-wrapper.properties` names, once the
+/// wrapper has unpacked it in `<gradle_user_home>/wrapper/dists` (and marked it complete).
+fn unpacked_wrapper_distribution(build_dir: &Path, gradle_user_home: &Path) -> Option<PathBuf> {
+    let properties = std::fs::read_to_string(build_dir.join("gradle/wrapper/gradle-wrapper.properties")).ok()?;
+    let url = properties.lines().find_map(|line| line.trim().strip_prefix("distributionUrl="))?;
+    let zip = url.trim().replace("\\:", ":").rsplit('/').next()?.to_owned();
+    let name = zip.strip_suffix(".zip")?;
+    let gradle = if cfg!(windows) { "gradle.bat" } else { "gradle" };
+    // One directory per distribution URL hash, each holding the unpacked `gradle-<version>`.
+    let hashes = std::fs::read_dir(gradle_user_home.join("wrapper/dists").join(name)).ok()?;
+    hashes.flatten().map(|e| e.path()).filter(|dir| dir.join(format!("{zip}.ok")).is_file()).find_map(|dir| {
+        std::fs::read_dir(&dir).ok()?.flatten().map(|e| e.path().join("bin").join(gradle)).find(|p| p.is_file())
+    })
+}
+
 fn gradle_run_jdk<'a>(
     release: Option<u32>,
     configured: Option<&'a crate::java::Jdk>,

crates/ide-sdk/src/java.rs

@@ -1547,7 +1547,7 @@ pub fn usages_bundle(data_dir: &Path) -> Option<PathBuf> {
     install_bundle(
         data_dir,
         "java-usages",
-        "1.13.0",
+        "1.14.0",
         include_bytes!("../../../java/java-usages/openidea-java-usages.jar"),
     )
 }

crates/ide-sdk/src/tests.rs

@@ -1866,6 +1866,37 @@ fn max_java_picks_an_older_jdk() {
     assert_eq!(free.env["JAVA_HOME"], j25.home.to_string_lossy());
 }
 
+/// #3086: `gradle-wrapper.jar` excluded by a `*.jar` rule in `.gitignore`: `gradlew` can't
+/// start, so the distribution the wrapper already unpacked runs instead.
+#[test]
+fn gradle_wrapper_without_its_jar_runs_the_unpacked_distribution() {
+    use crate::apply::gradle_command;
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let plain = if cfg!(windows) { "gradle.bat" } else { "gradle" };
+    let wrapper = root.join(if cfg!(windows) { "gradlew.bat" } else { "gradlew" });
+    std::fs::write(&wrapper, "").unwrap();
+    std::fs::create_dir_all(root.join("gradle/wrapper")).unwrap();
+    std::fs::write(
+        root.join("gradle/wrapper/gradle-wrapper.properties"),
+        "distributionUrl=https\\://services.gradle.org/distributions/gradle-4.10-bin.zip\n",
+    )
+    .unwrap();
+    let mut settings = Settings::default();
+    settings.languages.java.gradle.user_home = "user-home".into();
+    let hash = root.join("user-home/wrapper/dists/gradle-4.10-bin/7ddd1b3f");
+    let gradle = hash.join("gradle-4.10/bin").join(plain);
+    std::fs::create_dir_all(gradle.parent().unwrap()).unwrap();
+    std::fs::write(&gradle, "").unwrap();
+    // Not marked complete: possibly half unpacked.
+    assert_eq!(gradle_command(root, root, &settings), wrapper);
+    std::fs::write(hash.join("gradle-4.10-bin.zip.ok"), "").unwrap();
+    assert_eq!(gradle_command(root, root, &settings), gradle);
+    // With its jar the wrapper runs as usual.
+    std::fs::write(root.join("gradle/wrapper/gradle-wrapper.jar"), "").unwrap();
+    assert_eq!(gradle_command(root, root, &settings), wrapper);
+}
+
 #[test]
 fn gradle_settings_precedence() {
     use crate::apply::{gradle_command, gradle_env};

crates/ide-sdk/src/vue.rs

@@ -17,11 +17,18 @@ pub(crate) const EXTENSION: &str = "vue";
 const CLI_SERVICE: &str = "@vue/cli-service";
 const CLI_CONFIG_TIMEOUT: Duration = Duration::from_secs(30);
 const ALIASES_MARKER: &str = "openidea-webpack-aliases:";
-/// Prints the `resolve.alias` of the webpack configuration module `argv[1]`, after whatever
-/// the configuration itself prints.
-const PRINT_ALIASES: &str = "const c = require(process.argv[1]); const a = (c.resolve && c.resolve.alias) || {}; \
+/// Prints the `resolve.alias` of the webpack configuration module `argv[1]` (an object, an
+/// ES module's default, a function of the environment, or a list of configurations), after
+/// whatever the configuration itself prints.
+const PRINT_ALIASES: &str = "let c = require(process.argv[1]); if (c && c.__esModule) c = c.default; \
+    if (typeof c === 'function') c = c({}, { mode: 'development' }); if (Array.isArray(c)) c = c[0]; \
+    const a = (c && c.resolve && c.resolve.alias) || {}; \
     const e = Array.isArray(a) ? a.map((x) => [x.name, x.alias]) : Object.entries(a); \
     process.stdout.write('\\n' + process.argv[2] + JSON.stringify(e));";
+/// Webpack configurations of Vue projects without Vue CLI: the project's own, and the
+/// `vue init webpack` (Vue CLI 2) template's.
+const WEBPACK_CONFIGS: &[&str] =
+    &["webpack.config.js", "webpack.config.cjs", "build/webpack.base.conf.js", "build/webpack.dev.conf.js"];
 
 type Paths = BTreeMap<String, Vec<String>>;
 static CLI_PATHS: LazyLock<Mutex<HashMap<PathBuf, (Stamp, Paths)>>> = LazyLock::new(Default::default);
@@ -42,24 +49,33 @@ pub(crate) fn tsserver_plugin(package: &Path) -> serde_json::Value {
     })
 }
 
-/// `compilerOptions.paths` for the webpack aliases of a Vue CLI project at `root` (`@/*` →
+/// `compilerOptions.paths` for the webpack aliases of a Vue project at `root` (`@/*` →
 /// `<root>/src/*`), for its tsserver project when it has no `jsconfig.json`: tsserver can't
 /// read webpack configurations, so `@/` imports resolve to nothing, and a mixin imported
-/// that way makes the component's whole `this` `any`. Like IntelliJ, evaluates the
-/// configuration `@vue/cli-service` resolves with the project's `vue.config.js` (the project
-/// is trusted: language servers only run then); else the alias Vue CLI always adds.
-/// Empty for other projects.
+/// that way makes the component's whole `this` `any`. Like IntelliJ, evaluates the webpack
+/// configuration (the project is trusted: language servers only run then): the one
+/// `@vue/cli-service` resolves with the project's `vue.config.js`, else the project's own
+/// (`webpack.config.js`, Vue CLI 2's `build/webpack.base.conf.js`). Without one (Vite, or
+/// no Node), the `@` → `src` alias every Vue template sets up. Empty for other projects.
 pub(crate) fn cli_paths(root: &Path, node: Option<&Path>) -> Paths {
     let Ok(manifest) = std::fs::read_to_string(root.join("package.json")) else { return Paths::new() };
-    if !package_dependencies(&manifest).iter().any(|d| d == CLI_SERVICE) {
+    let dependencies = package_dependencies(&manifest);
+    let cli = dependencies.iter().any(|d| d == CLI_SERVICE);
+    if !cli && !dependencies.iter().any(|d| d == "vue") {
         return Paths::new();
     }
-    let config = root
-        .ancestors()
-        .map(|dir| dir.join("node_modules").join(CLI_SERVICE).join("webpack.config.js"))
-        .find(|f| f.is_file());
-    let mut inputs: Vec<PathBuf> =
-        ["package.json", "vue.config.js", "vue.config.cjs", "vue.config.mjs"].iter().map(|f| root.join(f)).collect();
+    let config = if cli {
+        root.ancestors()
+            .map(|dir| dir.join("node_modules").join(CLI_SERVICE).join("webpack.config.js"))
+            .find(|f| f.is_file())
+    } else {
+        WEBPACK_CONFIGS.iter().map(|f| root.join(f)).find(|f| f.is_file())
+    };
+    let mut inputs: Vec<PathBuf> = ["package.json", "vue.config.js", "vue.config.cjs", "vue.config.mjs"]
+        .iter()
+        .chain(WEBPACK_CONFIGS)
+        .map(|f| root.join(f))
+        .collect();
     inputs.extend(config.iter().cloned());
     inputs.extend(node.map(Path::to_path_buf));
     let now = stamp(&inputs);
@@ -71,6 +87,7 @@ pub(crate) fn cli_paths(root: &Path, node: Option<&Path>) -> Paths {
     let aliases = config
         .zip(node)
         .and_then(|(config, node)| webpack_aliases(root, &config, node))
+        .filter(|aliases| !aliases.is_empty())
         .unwrap_or_else(|| vec![("@".into(), root.join("src").to_string_lossy().into_owned())]);
     let paths = alias_paths(&aliases);
     CLI_PATHS.lock().unwrap_or_else(|e| e.into_inner()).insert(root.to_path_buf(), (now, paths.clone()));
@@ -181,6 +198,43 @@ mod tests {
         );
     }
 
+    #[test]
+    fn other_vue_projects_get_their_webpack_aliases_else_the_at_alias() {
+        let tmp = tempfile::tempdir().unwrap();
+        // As `__dirname` sees it (macOS: /private/var).
+        let t = &dunce::canonicalize(tmp.path()).unwrap();
+        std::fs::write(t.join("package.json"), r#"{"dependencies":{"react":"^18.0.0"}}"#).unwrap();
+        std::fs::create_dir_all(t.join("src/views")).unwrap();
+        assert!(cli_paths(t, None).is_empty(), "not a Vue project");
+        std::fs::write(t.join("package.json"), r#"{"dependencies":{"vue":"^2.6.14"}}"#).unwrap();
+        let slash = |p: PathBuf| p.to_string_lossy().replace('\\', "/");
+        let (src, views) = (slash(t.join("src")), slash(t.join("src/views")));
+        let at = Paths::from([("@".into(), vec![src.clone()]), ("@/*".into(), vec![format!("{src}/*")])]);
+        assert_eq!(cli_paths(t, None), at, "Vite or no Node: the template alias");
+        let Some(node) = crate::exec::which("node") else { return };
+        // `vue init webpack`: a function of the environment is called, its aliases taken.
+        std::fs::create_dir_all(t.join("build")).unwrap();
+        std::fs::write(
+            t.join("build/webpack.base.conf.js"),
+            r#"const path = require('path');
+const resolve = (dir) => path.join(__dirname, '..', dir);
+module.exports = (env) => ({ resolve: { alias: { vue$: 'vue/dist/vue.esm.js', '@': resolve('src'), views: resolve('src/views') } } });"#,
+        )
+        .unwrap();
+        assert_eq!(
+            cli_paths(t, Some(&node)),
+            Paths::from([
+                ("@".into(), vec![src.clone()]),
+                ("@/*".into(), vec![format!("{src}/*")]),
+                ("views".into(), vec![views.clone()]),
+                ("views/*".into(), vec![format!("{views}/*")]),
+            ])
+        );
+        // A configuration that can't be loaded (dependencies not installed): the template alias.
+        std::fs::write(t.join("build/webpack.base.conf.js"), "require('not-installed-plugin');").unwrap();
+        assert_eq!(cli_paths(t, Some(&node)), at);
+    }
+
     #[test]
     fn vue_cli_aliases_come_from_the_resolved_webpack_configuration() {
         let Some(node) = crate::exec::which("node") else { return };

crates/ide-vcs/src/manage.rs

@@ -281,6 +281,9 @@ impl Repo {
         let commitish = arg(commitish, "revision")?;
         let mut args: Vec<String> = vec!["worktree".into(), "add".into()];
         if let Some(b) = new_branch.map(str::trim).filter(|b| !b.is_empty()) {
+            if crate::write::renamed_remote_start(self, b, &commitish) {
+                args.push("--no-track".into());
+            }
             args.extend(["-b".into(), arg(b, "branch name")?]);
         }
         args.extend(["--".into(), path, commitish]);

crates/ide-vcs/src/write.rs

@@ -800,16 +800,41 @@ pub(crate) fn create_branch(
         let repo = r.gix()?;
         resolve(&repo, s)?;
     }
+    let no_track = start.is_some_and(|s| renamed_remote_start(r, name, s));
     let mut args = match (checkout, overwrite) {
         (true, false) => vec!["switch", "-c", name],
         (true, true) => vec!["switch", "-C", name],
-        (false, false) => vec!["branch", "--", name],
-        (false, true) => vec!["branch", "--force", "--", name],
+        (false, false) => vec!["branch"],
+        (false, true) => vec!["branch", "--force"],
     };
+    if no_track {
+        args.push("--no-track");
+    }
+    if !checkout {
+        args.extend(["--", name]);
+    }
     args.extend(start);
     run(r.root(), &args, None).map(|_| ())
 }
 
+/// Whether `start` is a remote-tracking branch with another name than the new branch
+/// `name`. Git would make it the upstream, so pushing the new branch would go to the
+/// start branch (`feature` from `origin/main` pushes to `main`); such a branch is left
+/// without upstream and gets its own one on the first push. A remote branch under the
+/// same name stays tracked.
+pub(crate) fn renamed_remote_start(r: &Repo, name: &str, start: &str) -> bool {
+    let Ok(out) = cli::run_raw(r.root(), &["rev-parse", "--verify", "--quiet", "--symbolic-full-name", start], None)
+    else {
+        return false;
+    };
+    let full = out.stdout_str().trim().to_string();
+    let Some(rest) = full.strip_prefix("refs/remotes/").filter(|_| out.code == Some(0)) else { return false };
+    let Ok(repo) = r.gix() else { return false };
+    let names = repo.remote_names();
+    let branch = names.iter().find_map(|remote| rest.strip_prefix(&format!("{remote}/")));
+    branch.is_some_and(|b| b != name)
+}
+
 /// Undo Commit: moves the current branch back to the parent of `commit` (which must be
 /// HEAD), keeping its changes staged. Returns the undone commit's message.
 /// Edit Commit Message: writes `commit` again with `message`, and its descendants on top

crates/ide-vcs/tests/git_workflows.rs

@@ -984,15 +984,41 @@ fn branch_overwrite_preserves_the_ref_if_checkout_fails() {
 }
 
 #[test]
-fn new_branch_from_remote_branch_tracks_it() {
-    let (fx, _bare) = Fixture::with_origin();
+fn new_branch_from_remote_branch_tracks_it_only_under_the_same_name() {
+    let (fx, bare) = Fixture::with_origin();
     fx.git(&["push", "-q", "origin", "main:release"]);
     fx.git(&["fetch", "-q"]);
     let repo = fx.repo();
+    let upstream = |name: &str| {
+        repo.branches().unwrap().into_iter().find(|b| b.name == name && !b.remote).and_then(|b| b.upstream)
+    };
+
+    repo.create_branch("release", Some("origin/release"), false).unwrap();
+    assert_eq!(upstream("release").as_deref(), Some("origin/release"));
+
+    // Another name: no upstream, whether switched to or not, created plainly or overwritten.
+    repo.create_branch("other", Some("origin/release"), false).unwrap();
+    assert_eq!(upstream("other"), None);
+    repo.create_branch_with_overwrite("other", Some("origin/main"), false, true).unwrap();
+    assert_eq!(upstream("other"), None);
     repo.create_branch("my-release", Some("origin/release"), true).unwrap();
     let info = repo.branch_info().unwrap();
     assert_eq!(info.head.as_deref(), Some("my-release"));
-    assert_eq!(info.upstream.as_deref(), Some("origin/release"));
+    assert_eq!(info.upstream, None);
+
+    // The first push then goes to a branch of its own name and tracks it.
+    fx.write("a.txt", "mine\n");
+    let tip = fx.commit_all("mine");
+    let (cancel, out) = quiet();
+    repo.push(false, true, &cancel, &out).unwrap();
+    assert_eq!(git_in(&bare, &["rev-parse", "my-release"]), tip);
+    assert_ne!(git_in(&bare, &["rev-parse", "release"]), tip);
+    assert_eq!(fx.git(&["config", "branch.my-release.merge"]), "refs/heads/my-release");
+
+    // New worktree on a new branch from a remote branch: the same rule.
+    let wt = fx.tmp.path().join("wt");
+    repo.add_worktree(&wt, "origin/release", Some("wt-branch")).unwrap();
+    assert_eq!(upstream("wt-branch"), None);
 }
 
 #[test]

crates/ide-workspace/src/dependencies/maven.rs

@@ -61,8 +61,9 @@ pub fn artifacts_url(group: &str, prefix: &str) -> Option<String> {
 
 /// The published version metadata of one artifact on Central.
 pub fn metadata_url(group: &str, artifact: &str) -> Option<String> {
-    (part(group, 200) && part(artifact, 100)).then(|| {
-        let path = group.split('.').chain(artifact.split('.')).collect::<Vec<_>>().join("/");
+    // The group's dots are directories; an artifact id is one directory, dots and all.
+    (part(group, 200) && part(artifact, 100) && artifact != "." && artifact != "..").then(|| {
+        let path = group.split('.').chain([artifact]).collect::<Vec<_>>().join("/");
         format!("https://repo1.maven.org/maven2/{path}/maven-metadata.xml")
     })
 }
@@ -146,6 +147,11 @@ mod tests {
             metadata_url("org.apache.maven", "maven-core").as_deref(),
             Some("https://repo1.maven.org/maven2/org/apache/maven/maven-core/maven-metadata.xml")
         );
+        assert_eq!(
+            metadata_url("org.eclipse.platform", "org.eclipse.core.runtime").as_deref(),
+            Some("https://repo1.maven.org/maven2/org/eclipse/platform/org.eclipse.core.runtime/maven-metadata.xml")
+        );
+        assert_eq!(metadata_url("org.example", ".."), None);
     }
 
     #[test]

crates/ide-workspace/src/documents/workspace_edit.rs

@@ -389,6 +389,12 @@ impl Documents {
         self.apply_workspace_edit_inner(edit, true, &mut |_| Ok(()))
     }
 
+    /// [`Self::apply_workspace_edit`] for an agent's edit (the MCP server's tools): undoable the
+    /// same way, announced as an agent's (`by_agent`) rather than as a refactoring.
+    pub fn apply_agent_workspace_edit(&self, edit: &WorkspaceEdit) -> IdeResult<()> {
+        self.apply_workspace_edit_as(edit, true, true, &mut |_| Ok(()))
+    }
+
     /// File moves already own a combined move/reference undo record.
     pub fn apply_file_move_edits(&self, edit: &WorkspaceEdit) -> IdeResult<()> {
         self.apply_workspace_edit_inner(edit, false, &mut |_| Ok(()))
@@ -399,6 +405,16 @@ impl Documents {
         edit: &WorkspaceEdit,
         remember: bool,
         before_operation: &mut dyn FnMut(usize) -> IdeResult<()>,
+    ) -> IdeResult<()> {
+        self.apply_workspace_edit_as(edit, remember, false, before_operation)
+    }
+
+    fn apply_workspace_edit_as(
+        &self,
+        edit: &WorkspaceEdit,
+        remember: bool,
+        by_agent: bool,
+        before_operation: &mut dyn FnMut(usize) -> IdeResult<()>,
     ) -> IdeResult<()> {
         let _operation = self.operations.lock();
         if edit.files.is_empty() {
@@ -485,7 +501,7 @@ impl Documents {
                 });
             }
             history.prune(SystemTime::now(), MAX_HISTORY_BYTES, MAX_HISTORY_AGE);
-            self.sink.emit(IdeEvent::WorkspaceEditApplied { id, paths: affected });
+            self.sink.emit(IdeEvent::WorkspaceEditApplied { id, paths: affected, by_agent });
         }
         Ok(())
     }

docs/en/guide/database.mdx

@@ -118,9 +118,20 @@ SQL completion knows the connected schema: tables after `FROM`/`JOIN` (with join
 
 ## Results and data editing
 
-Results appear in the **Services** tool window under the **Database** tab: an **Output** tab logs every statement, and each result set gets a **Result N** tab (up to 12).
+Results appear in the **Services** tool window under the **Database** tab: an **Output** tab logs every statement, and each result set gets a **Result N** tab (up to 12, pinned tabs excepted).
 
-Right-click a result tab (or focus it and press `Shift+F10`) for **Close**, **Close Others**, **Close All**, **Rename Tab**, **Select Next Tab** and **Select Previous Tab**. They act on the result tabs only; **Output** stays. Renamed titles last while the result is open.
+Running a console again replaces its previous results: its unpinned result tabs make way for the new run, which gets one tab per result set (**Result N**, or **Result N**, **Result N-2**, … when several selected statements return rows). A run with no result sets, such as an `UPDATE`, keeps the previous results. Results from other consoles stay.
+
+To keep a result, pin it with **Pin Tab** in the result tab's context menu or the pin button on the result toolbar; the tab's close button becomes a pin button that unpins it, so a stray click or middle-click can't close it, and later runs open new tabs instead. Rerunning or paging a pinned result updates it in place.
+
+<Warning>
+  Replacing a result discards changes you have not submitted in it. **Submit** or **Revert** them, or pin the tab,
+  before running the console again.
+</Warning>
+
+Right-click a result tab (or focus it and press `Shift+F10`) for **Close**, **Close Others**, **Close All**, **Close All but Pinned**, **Pin Tab** / **Unpin Tab**, **Rename Tab**, **Select Next Tab** and **Select Previous Tab**. They act on the result tabs only; **Output** stays. Renamed titles last until the result is closed or replaced.
+
+With focus on a result tab or inside a result, use `⇧⌘]` / `⇧⌘[` in the IntelliJ macOS keymap (`⌃→` / `⌃←` also work), or `Alt+→` / `Alt+←` in IntelliJ Windows/Linux. VS Code and Eclipse presets use their respective editor-tab navigation defaults. Switching focuses the destination result tab. Result navigation stays scoped to Results and is blocked while a menu or dialog is open. Customize database result shortcuts independently of editor shortcuts in **Settings › Keymap**.
 
 Closing a selected result activates its left neighbor, or its right neighbor if there is no result on the left. When no results remain, **Output** is selected. Closing an inactive result keeps the current selection.
 

docs/en/guide/mcp.mdx

@@ -18,14 +18,17 @@ Agent tasks started inside OpenIDEA (see [Agents](/en/guide/agents)) get the sam
   </Step>
 </Steps>
 
-The server listens on `127.0.0.1` only, on a random port, and every request must carry a token that changes each time OpenIDEA starts. Requests from another origin or host are refused.
+The server listens on `127.0.0.1` only, and every request must carry a bearer token. Requests from another origin or host are refused.
+
+- **Port.** By default it listens on the same port, 26371, in every run (**Use a fixed port** and **Port**), so HTTP clients and port forwards (an SSH tunnel to another machine, say) keep working after a restart. When the port is in use or reserved, that run takes a free port and **Status** says why. Turn **Use a fixed port** off for a free port in every run.
+- **Token.** By default the token changes each time OpenIDEA starts. Turn on **Keep the token** to keep one across runs, stored in OpenIDEA's application data for your account only; **Regenerate Token** replaces it, and clients configured with the old one stop working.
 
 ## Connect a client
 
 The settings page has two buttons under **Client configuration**. Both copy an `mcpServers` entry in the JSON format most clients accept.
 
 - **Copy Stdio Config** (recommended): the client starts OpenIDEA's executable with `--mcp-stdio`, which relays to the running IDE. It holds no token and keeps working after OpenIDEA restarts.
-- **Copy HTTP Config**: the client connects to `http://127.0.0.1:<port>/mcp` with `Authorization: Bearer <token>`. It stops working when OpenIDEA restarts, because the port and token change.
+- **Copy HTTP Config**: the client connects to `http://127.0.0.1:<port>/mcp` with `Authorization: Bearer <token>`. It keeps working after OpenIDEA restarts only with a fixed port and a kept token; otherwise copy it again after each restart.
 
 The stdio configuration looks like this (the path is the one on your machine):
 

docs/en/plugins/guides/themes.mdx

@@ -204,6 +204,8 @@ argument; themes that ship no `.icls` keep the built-in syntax colours.
 | `--bg-button`, `--border-button`                   | `Button.startBackground`, `Button.startBorderColor`                       |
 | `--bg-tab-selected`                                | `EditorTabs.underlinedTabBackground`                                      |
 | `--border-tab-selected`                            | `EditorTabs.underlinedBorderColor` (Islands), `EditorTabs.underlineColor` |
+| `--bg-tab-selected-inactive`                       | `EditorTabs.inactiveUnderlinedTabBackground`                              |
+| `--border-tab-selected-inactive`                   | `EditorTabs.inactiveUnderlinedTabBorderColor`, `.inactiveUnderlineColor`  |
 | `--fg-completion-match`                            | `CompletionPopup.matchForeground`                                         |
 | `--bg-toolbar-hover`, `--bg-toolbar-pressed`       | `ActionButton.hoverBackground`, `ActionButton.pressedBackground`          |
 | `--bg-stripe-hover`, `--bg-stripe-selected`        | `ToolWindow.Button.hoverBackground`, `.selectedBackground`                |
@@ -268,6 +270,7 @@ by hand:
 | `--link`                                                                                               | `textLink.foreground`                                                                                                                                                                                |
 | `--bg-input`, `--bg-field`                                                                             | `input.background`                                                                                                                                                                                   |
 | `--bg-tab-selected`, `--border-tab-selected`                                                           | `tab.activeBackground`, `tab.activeBorderTop`                                                                                                                                                        |
+| `--bg-tab-selected-inactive`, `--border-tab-selected-inactive`                                         | `tab.unfocusedActiveBackground`, `tab.unfocusedActiveBorderTop`                                                                                                                                      |
 | `--scrollbar-thumb`, `--scrollbar-thumb-hover`                                                         | `scrollbarSlider.background`, `scrollbarSlider.hoverBackground`                                                                                                                                      |
 | `--danger`, `--warning`, `--info`                                                                      | `errorForeground`, `editorWarning.foreground`, `editorInfo.foreground`                                                                                                                               |
 | `--vcs-modified`, `--vcs-added`, `--vcs-deleted`, `--vcs-untracked`, `--vcs-ignored`, `--vcs-conflict` | `gitDecoration.modifiedResourceForeground`, `.addedResourceForeground`, `.deletedResourceForeground`, `.untrackedResourceForeground`, `.ignoredResourceForeground`, `.conflictingResourceForeground` |

docs/zh/guide/database.mdx

@@ -118,9 +118,19 @@ SQL 补全基于已连接的架构：`FROM`/`JOIN` 后补全表（并根据外
 
 ## 结果与数据编辑
 
-结果显示在 **服务** 工具窗口的 **数据库** 标签页中：**输出** 标签页记录每条语句，每个结果集一个 **Result N** 标签页（最多 12 个）。
+结果显示在 **服务** 工具窗口的 **数据库** 标签页中：**输出** 标签页记录每条语句，每个结果集一个 **Result N** 标签页（最多 12 个，已固定的标签页除外）。
 
-右键点击结果标签页（或聚焦后按 `Shift+F10`），可使用 **关闭**、**关闭其他**、**全部关闭**、**重命名标签页**、**选择下一个标签页** 和 **选择上一个标签页**。这些操作只作用于结果标签页，**输出** 始终保留。重命名的标题在结果关闭前一直有效。
+再次运行控制台会替换它之前的结果：它未固定的结果标签页会让位给新的运行，新运行每个结果集一个标签页（**Result N**；选中的多条语句都返回行时为 **Result N**、**Result N-2**……）。没有结果集的运行（如 `UPDATE`）会保留之前的结果。其他控制台的结果不受影响。
+
+要保留某个结果，可在结果标签页的右键菜单中选择 **固定标签页**，或点击结果工具栏上的固定按钮；标签页的关闭按钮会变成固定按钮，点击即可取消固定，误点或中键点击都不会关闭它；之后的运行会改为打开新标签页。重新运行或翻页已固定的结果时，会在原标签页中更新。
+
+<Warning>
+  替换结果会丢弃其中尚未提交的更改。再次运行控制台前，请先 **提交** 或 **还原** 这些更改，或固定该标签页。
+</Warning>
+
+右键点击结果标签页（或聚焦后按 `Shift+F10`），可使用 **关闭**、**关闭其他**、**全部关闭**、**关闭除已固定外的所有标签页**、**固定标签页** / **取消固定标签页**、**重命名标签页**、**选择下一个标签页** 和 **选择上一个标签页**。这些操作只作用于结果标签页，**输出** 始终保留。重命名的标题在结果关闭或被替换前一直有效。
+
+焦点位于结果标签页或结果内容中时，IntelliJ macOS 快捷键方案使用 `⇧⌘]` / `⇧⌘[`（也支持 `⌃→` / `⌃←`），IntelliJ Windows/Linux 使用 `Alt+→` / `Alt+←`。VS Code 和 Eclipse 方案分别使用各自默认的编辑器标签页导航快捷键。切换后焦点移到目标结果标签页。结果导航快捷键仅在结果区域中生效，菜单或对话框打开时不会切换结果。可在 **设置 › 快捷键** 中单独修改数据库结果快捷键，不影响编辑器快捷键。
 
 关闭当前选中的结果标签页时，优先选中左侧相邻的结果；没有左侧结果时，选中右侧相邻结果。没有剩余结果时，选中 **输出**。关闭未选中的结果不会改变当前选择。
 

docs/zh/guide/mcp.mdx

@@ -17,14 +17,17 @@ OpenIDEA 内置了一个 [Model Context Protocol](https://modelcontextprotocol.i
   </Step>
 </Steps>
 
-服务器只监听 `127.0.0.1` 上的一个随机端口，每个请求都必须带上令牌，令牌在每次启动 OpenIDEA 时都会变化。来自其他 Origin 或 Host 的请求会被拒绝。
+服务器只监听 `127.0.0.1`，每个请求都必须带上访问令牌。来自其他 Origin 或 Host 的请求会被拒绝。
+
+- **端口。** 默认每次运行都监听同一个端口 26371（**使用固定端口** 和 **端口**），这样 OpenIDEA 重启后 HTTP 客户端和端口转发（例如到另一台机器的 SSH 隧道）仍然有效。端口被占用或被系统保留时，本次运行改用一个空闲端口，**状态** 中会说明原因。关闭 **使用固定端口** 则每次运行使用一个空闲端口。
+- **令牌。** 默认每次启动 OpenIDEA 都会换一个新令牌。打开 **保留令牌** 后会在多次运行间保留同一个令牌，保存在 OpenIDEA 的应用数据目录中，只有你的账户可读；**重新生成令牌** 会替换它，使用旧令牌配置的客户端随之失效。
 
 ## 连接客户端
 
 设置页面的 **客户端配置** 下有两个按钮，都会复制一段大多数客户端都能识别的 `mcpServers` JSON 配置。
 
 - **复制 Stdio 配置**（推荐）：客户端以 `--mcp-stdio` 参数启动 OpenIDEA 的可执行文件，由它转发给正在运行的 IDE。配置里没有令牌，OpenIDEA 重启后依然可用。
-- **复制 HTTP 配置**：客户端带着 `Authorization: Bearer <token>` 连接 `http://127.0.0.1:<port>/mcp`。由于端口和令牌会变，OpenIDEA 重启后这份配置就失效了。
+- **复制 HTTP 配置**：客户端带着 `Authorization: Bearer <token>` 连接 `http://127.0.0.1:<port>/mcp`。只有同时使用固定端口并保留令牌时，OpenIDEA 重启后这份配置才继续有效；否则每次重启后都要重新复制。
 
 stdio 配置大致如下（路径以你机器上的为准）：
 

docs/zh/plugins/guides/themes.mdx

@@ -177,6 +177,8 @@ pnpm theme:import-intellij path/to/MyTheme.theme.json path/to/MyTheme.icls --out
 | `--bg-button`, `--border-button`                   | `Button.startBackground`, `Button.startBorderColor`                        |
 | `--bg-tab-selected`                                | `EditorTabs.underlinedTabBackground`                                       |
 | `--border-tab-selected`                            | `EditorTabs.underlinedBorderColor`（Islands）, `EditorTabs.underlineColor` |
+| `--bg-tab-selected-inactive`                       | `EditorTabs.inactiveUnderlinedTabBackground`                               |
+| `--border-tab-selected-inactive`                   | `EditorTabs.inactiveUnderlinedTabBorderColor`, `.inactiveUnderlineColor`   |
 | `--fg-completion-match`                            | `CompletionPopup.matchForeground`                                          |
 | `--bg-toolbar-hover`, `--bg-toolbar-pressed`       | `ActionButton.hoverBackground`, `ActionButton.pressedBackground`           |
 | `--bg-stripe-hover`, `--bg-stripe-selected`        | `ToolWindow.Button.hoverBackground`, `.selectedBackground`                 |
@@ -239,6 +241,7 @@ VS Code 主题（扩展中的 `themes/*.json`）包含 `type`（`dark` / `light`
 | `--link`                                                                                               | `textLink.foreground`                                                                                                                                                                                |
 | `--bg-input`, `--bg-field`                                                                             | `input.background`                                                                                                                                                                                   |
 | `--bg-tab-selected`, `--border-tab-selected`                                                           | `tab.activeBackground`, `tab.activeBorderTop`                                                                                                                                                        |
+| `--bg-tab-selected-inactive`, `--border-tab-selected-inactive`                                         | `tab.unfocusedActiveBackground`, `tab.unfocusedActiveBorderTop`                                                                                                                                      |
 | `--scrollbar-thumb`, `--scrollbar-thumb-hover`                                                         | `scrollbarSlider.background`, `scrollbarSlider.hoverBackground`                                                                                                                                      |
 | `--danger`, `--warning`, `--info`                                                                      | `errorForeground`, `editorWarning.foreground`, `editorInfo.foreground`                                                                                                                               |
 | `--vcs-modified`, `--vcs-added`, `--vcs-deleted`, `--vcs-untracked`, `--vcs-ignored`, `--vcs-conflict` | `gitDecoration.modifiedResourceForeground`, `.addedResourceForeground`, `.deletedResourceForeground`, `.untrackedResourceForeground`, `.ignoredResourceForeground`, `.conflictingResourceForeground` |

e2e/databaseJsonExport.spec.ts

@@ -0,0 +1,91 @@
+import type { Page } from "@playwright/test";
+import { expect, ipcCalls, stubDesktop, test } from "./fixtures";
+
+const expected =
+  '[\n  {\n    "id": 9223372036854775807,\n    "amount": 1.0000000000000000002,\n    "note": "9007199254740993",\n    "empty": null\n  }\n]';
+
+async function seedResult(page: Page) {
+  await stubDesktop(page);
+  await page.evaluate(async () => {
+    window.__ipc.handlers.clipboard_write_text = () => null;
+    window.__ipc.handlers.db_export_file = () => null;
+    window.__ipc.handlers["plugin:path|resolve_directory"] = () => "/tmp";
+    const storePath = "/src/features/database/store.ts";
+    const contributionsPath = "/src/workbench/contributions.ts";
+    const { useDatabase, RESULTS_VIEW } = await import(storePath);
+    const { showServiceView } = await import(contributionsPath);
+    const text = "SELECT id, amount, note, empty FROM numbers";
+    useDatabase.setState({
+      loaded: true,
+      sources: [{ id: "exact", name: "Exact numbers", driver: "postgres", readOnly: true }],
+      consoles: { "exact-console.sql": "exact" },
+      results: [
+        {
+          id: 1,
+          title: "Result 1",
+          path: "exact-console.sql",
+          sourceId: "exact",
+          outcome: {
+            statement: { text, from: 0, to: text.length },
+            error: null,
+            result: {
+              statement: text,
+              columns: [
+                { name: "id", typeName: "BIGINT" },
+                { name: "amount", typeName: "NUMERIC(38,19)" },
+                { name: "note", typeName: "TEXT" },
+                { name: "empty", typeName: "TEXT" },
+              ],
+              rows: [["9223372036854775807", "1.0000000000000000002", "9007199254740993", null]],
+              affected: null,
+              hasMore: false,
+              elapsedMs: 1,
+              executionMs: 1,
+            },
+          },
+          page: 0,
+          pageSize: 500,
+        },
+      ],
+      activeResult: 1,
+    });
+    showServiceView(RESULTS_VIEW);
+  });
+  await expect(page.getByRole("grid", { name: "Result 1", exact: true }).getByRole("gridcell")).toHaveCount(4);
+}
+
+async function openExport(page: Page) {
+  await page.getByRole("button", { name: "Export Data", exact: true }).click();
+  await page.getByRole("menuitem", { name: "Export Data…", exact: true }).click();
+  const dialog = page.getByRole("dialog", { name: "Export Data", exact: true });
+  await dialog.getByRole("button", { name: "Extractor", exact: true }).click();
+  await page.getByRole("option", { name: "JSON", exact: true }).click();
+  return dialog;
+}
+
+test("Copy as JSON preserves exact numeric values", async ({ workbench: page }) => {
+  await seedResult(page);
+  await page.getByRole("button", { name: "Export Data", exact: true }).click();
+  await page.getByRole("menuitem", { name: "Copy as JSON", exact: true }).click();
+  await expect.poll(() => ipcCalls(page, "clipboard_write_text")).toHaveLength(1);
+  expect((await ipcCalls(page, "clipboard_write_text"))[0]!.text).toBe(expected);
+});
+
+test("Export Data preserves exact preview and clipboard values", async ({ workbench: page }) => {
+  await seedResult(page);
+  const dialog = await openExport(page);
+  await expect(dialog.getByLabel("Export preview", { exact: true })).toHaveText(expected);
+  await dialog.getByRole("button", { name: "Copy to Clipboard", exact: true }).click();
+  await expect.poll(() => ipcCalls(page, "clipboard_write_text")).toHaveLength(1);
+  expect((await ipcCalls(page, "clipboard_write_text"))[0]!.text).toBe(expected);
+});
+
+test("Export Data preserves exact preview and exported file values", async ({ workbench: page }) => {
+  await seedResult(page);
+  const dialog = await openExport(page);
+  await expect(dialog.getByLabel("Export preview", { exact: true })).toHaveText(expected);
+  await dialog.getByRole("textbox", { name: "Output file", exact: true }).fill("/tmp/exact-numbers.json");
+  await dialog.getByRole("button", { name: "Export to File", exact: true }).click();
+  await expect.poll(() => ipcCalls(page, "db_export_file")).toHaveLength(1);
+  expect((await ipcCalls(page, "db_export_file"))[0]).toEqual({ path: "/tmp/exact-numbers.json", text: expected });
+});

e2e/databaseNumericSort.spec.ts

@@ -0,0 +1,103 @@
+import type { Page } from "@playwright/test";
+import { expect, test } from "./fixtures";
+
+const integers = ["9007199254740993", "9007199254740992", "-9007199254740992", "-9007199254740993"];
+const decimals = ["1.0000000000000000002", "1.0000000000000000001", "-0.0000000000000000001", "0"];
+
+async function seedResult(page: Page, values: string[], type: string) {
+  await page.evaluate(
+    async ({ values, type }) => {
+      const storePath = "/src/features/database/store.ts";
+      const contributionsPath = "/src/workbench/contributions.ts";
+      const { useDatabase, RESULTS_VIEW } = await import(storePath);
+      const { showServiceView } = await import(contributionsPath);
+      const text = "SELECT value FROM exact_numbers";
+      useDatabase.setState({
+        loaded: true,
+        sources: [{ id: "exact", name: "Exact numbers", driver: "postgres", readOnly: true }],
+        consoles: { "exact-console.sql": "exact" },
+        results: [
+          {
+            id: 1,
+            title: "Result 1",
+            path: "exact-console.sql",
+            sourceId: "exact",
+            outcome: {
+              statement: { text, from: 0, to: text.length },
+              error: null,
+              result: {
+                statement: text,
+                columns: [{ name: "value", typeName: type }],
+                rows: values.map((value) => [value]),
+                affected: null,
+                hasMore: false,
+                elapsedMs: 1,
+                executionMs: 1,
+              },
+            },
+            page: 0,
+            pageSize: 500,
+          },
+        ],
+        activeResult: 1,
+      });
+      showServiceView(RESULTS_VIEW);
+    },
+    { values, type },
+  );
+  await expect(page.getByRole("grid", { name: "Result 1", exact: true }).getByRole("gridcell")).toHaveCount(
+    values.length,
+  );
+}
+
+for (const [name, values, type, ascending] of [
+  ["BIGINT", integers, "BIGINT", [integers[3]!, integers[2]!, integers[1]!, integers[0]!]],
+  ["DECIMAL", decimals, "NUMERIC(38,19)", [decimals[2]!, decimals[3]!, decimals[1]!, decimals[0]!]],
+] as const) {
+  test(`${name}: result headers sort exact values ascending, descending and back to query order`, async ({
+    workbench: page,
+  }) => {
+    await seedResult(page, [...values], type);
+    const grid = page.getByRole("grid", { name: "Result 1", exact: true });
+    const cells = grid.getByRole("gridcell");
+    const header = grid.getByRole("columnheader", { name: /^value\b/ }).getByText("value", { exact: true });
+    await expect(cells).toHaveText([...values]);
+    await header.click();
+    await expect(cells).toHaveText([...ascending]);
+    await header.click();
+    await expect(cells).toHaveText([...ascending].reverse());
+    await header.click();
+    await expect(cells).toHaveText([...values]);
+  });
+}
+
+test("precise filter values are ordered and filtering composes with result sorting", async ({ workbench: page }) => {
+  await seedResult(page, [...integers], "BIGINT");
+  const grid = page.getByRole("grid", { name: "Result 1", exact: true });
+  await grid.getByRole("button", { name: "Filter value", exact: true }).click();
+  const values = page.getByRole("group", { name: "Values", exact: true });
+  const ascending = [integers[3]!, integers[2]!, integers[1]!, integers[0]!];
+  await expect(values.locator("label")).toHaveText(ascending);
+  await values.getByRole("checkbox", { name: integers[3], exact: true }).uncheck();
+  await page.keyboard.press("Escape");
+  await grid
+    .getByRole("columnheader", { name: /^value\b/ })
+    .getByText("value", { exact: true })
+    .click();
+  await expect(grid.getByRole("gridcell")).toHaveText(ascending.slice(1));
+});
+
+test("selection aggregates preserve exact minimum and maximum values", async ({ workbench: page }) => {
+  await seedResult(page, [...decimals], "NUMERIC(38,19)");
+  const grid = page.getByRole("grid", { name: "Result 1", exact: true });
+  await grid.getByRole("gridcell").first().click();
+  await grid
+    .getByRole("gridcell")
+    .last()
+    .click({ modifiers: ["Shift"] });
+  await page.getByRole("button", { name: "Show Record / Value / Aggregates", exact: true }).click();
+  const panel = page.getByRole("complementary", { name: "Value panel", exact: true });
+  await panel.getByRole("tab", { name: "Aggregates", exact: true }).click();
+  await expect(panel.getByRole("row", { name: `Min ${decimals[2]}`, exact: true })).toBeVisible();
+  await expect(panel.getByRole("row", { name: `Max ${decimals[0]}`, exact: true })).toBeVisible();
+});

e2e/databaseResultTabs.spec.ts

@@ -1,5 +1,5 @@
 import type { Page } from "@playwright/test";
-import { expect, test } from "./fixtures";
+import { expect, openFromTree, test } from "./fixtures";
 
 const edgeTitle = "Result 3 — a long query result at the edge of the Services pane";
 const bindings = { "alpha-console.sql": "alpha", "beta-console.sql": "beta" };
@@ -64,7 +64,9 @@ function menu(page: Page) {
 
 async function choose(page: Page, title: string, command: string) {
   await tab(page, title).click({ button: "right" });
-  await menu(page).getByRole("menuitem", { name: command, exact: true }).click();
+  await menu(page)
+    .getByRole("menuitem", { name: command.startsWith("Select ") ? new RegExp(`^${command}`) : command, exact: true })
+    .click();
   await expect(menu(page)).toHaveCount(0);
 }
 
@@ -90,9 +92,11 @@ test("result context menu fits the viewport, responds to hover and keyboard, and
     "Close",
     "Close Others",
     "Close All",
+    "Close All but Pinned",
+    "Pin Tab",
     "Rename Tab",
-    "Select Next Tab",
-    "Select Previous Tab",
+    "Select Next Tab⇧⌘]",
+    "Select Previous Tab⇧⌘[",
   ]);
   await expect(popup.getByRole("separator")).toHaveCount(2);
   await selected(page, "Result 2", "beta rows");
@@ -140,7 +144,7 @@ test("result context menu fits the viewport, responds to hover and keyboard, and
   await page.keyboard.press("ArrowUp");
   await expect(popup.getByRole("menuitem", { name: "Close", exact: true })).toBeFocused();
   await page.keyboard.press("ArrowUp");
-  await expect(popup.getByRole("menuitem", { name: "Select Previous Tab", exact: true })).toBeFocused();
+  await expect(popup.getByRole("menuitem", { name: /^Select Previous Tab/ })).toBeFocused();
   await page.keyboard.press("Enter");
   await expect(popup).toHaveCount(0);
   await selected(page, "Result 1", "alpha rows");
@@ -170,6 +174,8 @@ for (const [theme, label] of [
     const surface = target.locator("..");
     const other = tab(page, "Result 3");
     const otherSurface = other.locator("..");
+    // The results hold focus, as they do at the end when the menu is opened from a result tab.
+    await tab(page, "Result 2").focus();
     await page.mouse.move(0, 0);
     const idle = await surface.evaluate((element) => getComputedStyle(element).backgroundColor);
     const selectedColor = await tab(page, "Result 2")
@@ -207,7 +213,9 @@ for (const [theme, label] of [
     await expect(surface).toHaveCSS("background-color", idle);
     await expect(otherSurface).toHaveCSS("background-color", hovered);
     await selected(page, "Result 2", "beta rows");
-    await menu(page).getByRole("menuitem", { name: "Select Previous Tab", exact: true }).click();
+    await menu(page)
+      .getByRole("menuitem", { name: /^Select Previous Tab/ })
+      .click();
     await expect(menu(page)).toHaveCount(0);
     await page.mouse.move(0, 0);
     await expect(otherSurface).toHaveCSS("background-color", idle);
@@ -221,6 +229,43 @@ for (const [theme, label] of [
   });
 }
 
+test("accents the selected tabs only in the part holding focus, as IDEA does", async ({ workbench: page }) => {
+  await openFromTree(page, "README.md");
+  await seedResults(page);
+  const token = (name: string) =>
+    page.evaluate((name) => {
+      const probe = document.body.appendChild(document.createElement("div"));
+      probe.style.background = `var(${name})`;
+      const color = getComputedStyle(probe).backgroundColor;
+      probe.remove();
+      return color;
+    }, name);
+  const accent = await token("--bg-tab-selected");
+  const inactive = await token("--bg-tab-selected-inactive");
+  expect(inactive).not.toBe(accent);
+  const surfaces = [
+    page.getByRole("tablist", { name: "Editor tabs" }).getByRole("tab", { name: "README.md" }),
+    page.getByRole("tab", { name: "Database", exact: true }),
+    tab(page, "Result 2"),
+  ].map((tab) => tab.locator(".."));
+  const colors = () =>
+    Promise.all(surfaces.map((surface) => surface.evaluate((element) => getComputedStyle(element).backgroundColor)));
+
+  await page.getByRole("gridcell", { name: "beta rows", exact: true }).click();
+  await expect.poll(colors).toEqual([inactive, accent, accent]);
+  // A menu opened from a result tab keeps the results active.
+  await tab(page, "Result 2").click({ button: "right" });
+  await expect(menu(page)).toBeVisible();
+  await expect.poll(colors).toEqual([inactive, accent, accent]);
+  await page.keyboard.press("Escape");
+  await expect(menu(page)).toHaveCount(0);
+
+  await page.locator(".cm-content").first().click();
+  await expect.poll(colors).toEqual([accent, inactive, inactive]);
+  await page.getByRole("tree", { name: "Project", exact: true }).click({ position: { x: 10, y: 10 } });
+  await expect.poll(colors).toEqual([inactive, inactive, inactive]);
+});
+
 test("renames the clicked inactive result without changing its rows and navigates through Output with wraparound", async ({
   workbench: page,
 }) => {
@@ -266,6 +311,59 @@ test("renames the clicked inactive result without changing its rows and navigate
   await selected(page, "Result 3", "third rows");
 });
 
+test("default tab shortcuts stay in results across repeated tab and grid switches, and remain editor shortcuts elsewhere", async ({
+  workbench: page,
+}) => {
+  await openFromTree(page, "build.gradle.kts");
+  await openFromTree(page, "settings.gradle.kts");
+  const editors = page.getByRole("tablist", { name: "Editor tabs", exact: true });
+  const build = editors.getByRole("tab", { name: "build.gradle.kts", exact: true });
+  const settings = editors.getByRole("tab", { name: "settings.gradle.kts", exact: true });
+  await seedResults(page);
+
+  await tab(page, "Result 1").focus();
+  for (const [shortcut, title, value] of [
+    ["Meta+Shift+BracketRight", "Result 3", "third rows"],
+    ["Meta+Shift+BracketRight", "Output"],
+    ["Meta+Shift+BracketRight", "Result 1", "alpha rows"],
+    ["Meta+Shift+BracketLeft", "Output"],
+    ["Meta+Shift+BracketLeft", "Result 3", "third rows"],
+  ]) {
+    await page.keyboard.press(shortcut!);
+    await selected(page, title!, value);
+    await expect(settings).toHaveAttribute("aria-selected", "true");
+  }
+
+  // The grid is replaced on a tab switch; the second press must still belong to results.
+  await page.getByRole("gridcell", { name: "third rows", exact: true }).click();
+  await page.keyboard.press("Meta+Shift+BracketRight");
+  await selected(page, "Output");
+  await page.keyboard.press("Meta+Shift+BracketRight");
+  await selected(page, "Result 1", "alpha rows");
+  await page.getByRole("gridcell", { name: "alpha rows", exact: true }).click();
+  await page.keyboard.press("Meta+Shift+BracketRight");
+  await selected(page, "Result 2", "beta rows");
+  await page.keyboard.press("Meta+Shift+BracketRight");
+  await selected(page, "Result 3", "third rows");
+  await expect(settings).toHaveAttribute("aria-selected", "true");
+
+  await settings.click();
+  await page.locator(".cm-content[contenteditable=true]").first().click();
+  await page.keyboard.press("Meta+Shift+BracketRight");
+  await expect(build).toHaveAttribute("aria-selected", "true");
+  await selected(page, "Result 3", "third rows");
+  await page.keyboard.press("Meta+Shift+BracketLeft");
+  await expect(settings).toHaveAttribute("aria-selected", "true");
+  await selected(page, "Result 3", "third rows");
+
+  await tab(page, "Result 1").click({ button: "right" });
+  await page.keyboard.press("Meta+Shift+BracketRight");
+  await page.keyboard.press("Meta+Shift+BracketLeft");
+  await selected(page, "Result 3", "third rows");
+  await expect(menu(page)).toBeVisible();
+  await page.keyboard.press("Escape");
+});
+
 test("rename owns deletion and Cmd+Enter without editing the previously focused query", async ({ workbench: page }) => {
   await seedResults(page);
   await page.evaluate(async () => {
@@ -356,3 +454,148 @@ test("closes clicked results, other results and all results without removing Out
   await expect(page.getByRole("treeitem", { name: "Alpha database", exact: true })).toBeVisible();
   await expect(page.getByRole("treeitem", { name: "Beta database", exact: true })).toBeVisible();
 });
+
+/** Runs `text` in console `path` through the production store, with the backend's answers stubbed. */
+async function runConsole(page: Page, path: string, text: string) {
+  await page.evaluate(
+    async ({ path, text }) => {
+      const bindingsPath = "/src/bindings.ts";
+      const storePath = "/src/features/database/store.ts";
+      const { commands } = await import(bindingsPath);
+      const { executeConsole } = await import(storePath);
+      commands.dbStatements = async (_id: string, sql: string) => {
+        let from = 0;
+        const data = sql.split(";").flatMap((part) => {
+          const start = from + part.length - part.trimStart().length;
+          from += part.length + 1;
+          const st = part.trim();
+          return st ? [{ from: start, to: start + st.length, text: st }] : [];
+        });
+        return { status: "ok", data };
+      };
+      commands.dbExecute = async (_r: unknown, _id: string, statements: { text: string }[]) => ({
+        status: "ok",
+        data: statements.map((statement) => ({
+          statement,
+          error: null,
+          result: {
+            statement: statement.text,
+            columns: [{ name: "payload", typeName: "text" }],
+            rows: [[/'(.*)'/.exec(statement.text)![1]]],
+            affected: null,
+            hasMore: false,
+            elapsedMs: 1,
+            executionMs: 1,
+          },
+        })),
+      });
+      await executeConsole(path, text, 0, text.length);
+    },
+    { path, text },
+  );
+}
+
+test("console runs replace their unpinned results; pinned results stay until Close All but Pinned", async ({
+  workbench: page,
+}) => {
+  await seedResults(page);
+  const strip = page.getByRole("tablist", { name: "Results", exact: true }).getByRole("tab");
+  await choose(page, "Result 1", "Close All");
+  // The seeded Output line's id would collide with the ids of the lines the runs log.
+  await page.evaluate(async () => {
+    const storePath = "/src/features/database/store.ts";
+    const { useDatabase } = await import(storePath);
+    useDatabase.setState({ output: [] });
+  });
+  await runConsole(page, "alpha-console.sql", "SELECT 'one'");
+  const n = Number(/\d+/.exec((await strip.nth(1).textContent())!)![0]);
+  const result = (run: number, index = 1) => `Result ${n + run}${index > 1 ? `-${index}` : ""}`;
+  await runConsole(page, "alpha-console.sql", "SELECT 'two'");
+  await expect(strip).toHaveText(["Output", result(1)]);
+  await selected(page, result(1), "two");
+
+  const pin = page.getByRole("button", { name: "Pin Tab", exact: true });
+  await pin.click();
+  await expect(pin).toHaveAttribute("aria-pressed", "true");
+  await runConsole(page, "alpha-console.sql", "SELECT 'three'; SELECT 'four'");
+  await runConsole(page, "beta-console.sql", "SELECT 'beta'");
+  await expect(strip).toHaveText(["Output", result(1), result(2), result(2, 2), result(3)]);
+  await selected(page, result(3), "beta");
+
+  await tab(page, result(2)).click({ button: "right" });
+  await expect(menu(page).getByRole("menuitem", { name: "Close All but Pinned", exact: true })).toBeEnabled();
+  await menu(page).getByRole("menuitem", { name: "Pin Tab", exact: true }).click();
+  await expect(menu(page)).toHaveCount(0);
+  await runConsole(page, "alpha-console.sql", "SELECT 'five'");
+  await expect(strip).toHaveText(["Output", result(1), result(2), result(4), result(3)]);
+  await selected(page, result(4), "five");
+  await expect(pin).toHaveAttribute("aria-pressed", "false");
+
+  await tab(page, result(2)).click();
+  await expect(pin).toHaveAttribute("aria-pressed", "true");
+  await choose(page, result(3), "Close All but Pinned");
+  await expect(strip).toHaveText(["Output", result(1), result(2)]);
+  await selected(page, result(2), "three");
+  await tab(page, result(1)).click({ button: "right" });
+  await expect(menu(page).getByRole("menuitem", { name: "Unpin Tab", exact: true })).toBeVisible();
+  await expect(menu(page).getByRole("menuitem", { name: "Close All but Pinned", exact: true })).toBeDisabled();
+  await page.keyboard.press("Escape");
+
+  // A pinned tab's close button is its Unpin button; middle-click leaves it open.
+  const slot = tab(page, result(1)).locator("..");
+  await expect(slot.getByRole("button", { name: "Close Tab", exact: true })).toHaveCount(0);
+  await tab(page, result(1)).click({ button: "middle" });
+  await expect(strip).toHaveText(["Output", result(1), result(2)]);
+  await slot.getByRole("button", { name: "Unpin Tab", exact: true }).click();
+  await selected(page, result(2), "three");
+  await slot.getByRole("button", { name: "Close Tab", exact: true }).click();
+  await expect(strip).toHaveText(["Output", result(2)]);
+});
+
+test("Tab goes from a result tab to its first cell, and the result toolbar is one stop back", async ({
+  workbench: page,
+}) => {
+  await openFromTree(page, "README.md");
+  await seedResults(page);
+  const grid = page.getByRole("grid");
+  const cell = page.getByRole("gridcell", { name: "beta rows", exact: true });
+  await expect(cell).toHaveAttribute("aria-selected", "false");
+
+  await tab(page, "Result 2").focus();
+  await page.keyboard.press("Tab");
+  await expect(grid).toBeFocused();
+  await expect(cell).toHaveAttribute("aria-selected", "true");
+
+  const toolbar = page.getByRole("toolbar", { name: "Result actions", exact: true });
+  await page.keyboard.press("Shift+Tab");
+  await expect(toolbar.getByRole("button", { name: "Table", exact: true })).toBeFocused();
+  await page.keyboard.press("ArrowRight");
+  await expect(toolbar.getByRole("button", { name: "Chart", exact: true })).toBeFocused();
+  await page.keyboard.press("Shift+Tab");
+  await expect(tab(page, "Result 2")).toBeFocused();
+  // The toolbar is entered at the control used last.
+  await page.keyboard.press("Tab");
+  await expect(grid).toBeFocused();
+  await page.keyboard.press("Shift+Tab");
+  await expect(toolbar.getByRole("button", { name: "Chart", exact: true })).toBeFocused();
+
+  // Past the last cell, Tab leaves the grid instead of landing on its header's filter button.
+  await page.keyboard.press("Tab");
+  await expect(grid).toBeFocused();
+  await page.keyboard.press("Tab");
+  await expect(grid).not.toBeFocused();
+  expect(await page.evaluate(() => !!document.activeElement?.closest("[role=grid]"))).toBe(false);
+
+  // The keyboard path to the header's local filter is the Local Filter action.
+  await grid.focus();
+  await page.evaluate(async () => {
+    const actionsModule = "/src/platform/actions.ts";
+    const { executeAction } = await import(/* @vite-ignore */ actionsModule);
+    await executeAction("db.localFilter");
+  });
+  const filter = page.getByRole("dialog", { name: "Local filter of payload", exact: true });
+  await expect(filter.getByRole("textbox", { name: "Search values", exact: true })).toBeFocused();
+  await page.keyboard.press("Escape");
+  await expect(filter).toBeHidden();
+  await expect(grid).toBeFocused();
+});

e2e/diffJumpToSource.spec.ts

@@ -0,0 +1,39 @@
+import { expect, stubDesktop, test } from "./fixtures";
+
+test.use({ video: "on" });
+
+test("opens the working file with Command+Down after a revision diff loads its source", async ({ workbench: page }) => {
+  await stubDesktop(page);
+  await page.evaluate(async () => {
+    const path = "/dev/acme-api/README.md";
+    const probe = new Promise((resolve) => {
+      window.__ipc.handlers.complete_probe = () => resolve({ size: 48, binary: false, tooLarge: false });
+    });
+    window.__ipc.handlers.fs_probe = ({ path: candidate }) => (candidate === path ? probe : null);
+    window.__ipc.handlers.fs_read_text = () => "# Acme API\n\nWorking copy\n";
+    const keymap = "/src/platform/keymap.ts";
+    (await import(/* @vite-ignore */ keymap)).applyKeymapSettings("intellij-macos", {});
+    const actions = "/src/platform/actions.ts";
+    await (
+      await import(/* @vite-ignore */ actions)
+    ).executeAction("diff.compareTexts", {
+      path,
+      left: { text: "# Acme API\n\nPrevious commit\n", label: "Parent" },
+      right: { text: "# Acme API\n\nNew commit\n", label: "Commit" },
+    });
+  });
+
+  const pane = page.locator(".cm-merge-b .cm-content");
+  await pane.click();
+  await expect(pane).toBeFocused();
+  const jump = page.getByRole("button", { name: "Jump to Source", exact: true });
+  await expect(jump).toHaveCount(0);
+  await page.evaluate(() => window.__ipc.handlers.complete_probe!({}));
+  await expect(jump).toBeVisible();
+  await expect(pane).toBeFocused();
+
+  await page.keyboard.press("Meta+ArrowDown");
+  await page.screenshot({ path: test.info().outputPath("jump-to-source.png"), animations: "disabled" });
+  await expect(page.getByRole("tab", { name: "README.md", exact: true, selected: true })).toBeVisible();
+  await expect(pane).toBeHidden();
+});

java/java-usages/MANIFEST.MF

@@ -2,7 +2,7 @@ Manifest-Version: 1.0
 Bundle-ManifestVersion: 2
 Bundle-Name: OpenIDEA Java usages
 Bundle-SymbolicName: ai.openidea.usages;singleton:=true
-Bundle-Version: 1.13.0
+Bundle-Version: 1.14.0
 Bundle-RequiredExecutionEnvironment: JavaSE-21
 Require-Bundle: org.eclipse.jdt.ls.core,org.eclipse.jdt.core,
  org.eclipse.jdt.core.manipulation,org.eclipse.core.runtime,

java/java-usages/plugin.xml

@@ -17,6 +17,9 @@
     <delegateCommandHandler class="ai.openidea.implementations.ImplementationsCommand">
       <command id="openidea.java.implementations"/>
     </delegateCommandHandler>
+    <delegateCommandHandler class="ai.openidea.archives.RefreshArchivesCommand">
+      <command id="openidea.java.refreshArchives"/>
+    </delegateCommandHandler>
     <delegateCommandHandler class="ai.openidea.hierarchy.HierarchyCommand">
       <command id="openidea.java.hierarchy.members"/>
       <command id="openidea.java.hierarchy.refactor"/>

java/java-usages/src/ai/openidea/archives/RefreshArchivesCommand.java

@@ -0,0 +1,68 @@
+package ai.openidea.archives;
+
+import java.lang.reflect.Field;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.eclipse.core.resources.ResourcesPlugin;
+import org.eclipse.core.runtime.IPath;
+import org.eclipse.core.runtime.IProgressMonitor;
+import org.eclipse.core.runtime.OperationCanceledException;
+import org.eclipse.core.runtime.Path;
+import org.eclipse.jdt.core.IJavaModel;
+import org.eclipse.jdt.core.IJavaProject;
+import org.eclipse.jdt.core.IPackageFragmentRoot;
+import org.eclipse.jdt.core.JavaCore;
+import org.eclipse.jdt.ls.core.internal.IDelegateCommandHandler;
+import org.eclipse.jdt.ls.core.internal.JavaLanguageServerPlugin;
+
+/**
+ * Re-reads library archives replaced in place (a SNAPSHOT installed again keeps its path). The
+ * arguments are the archives' file system paths. Their package fragment roots are closed, which
+ * drops the class files read from the old archive, and jdtls' decompiled sources (cached by class
+ * handle, which a replaced archive keeps) are dropped, so the classes are read again.
+ */
+public final class RefreshArchivesCommand implements IDelegateCommandHandler {
+    @Override
+    public Object executeCommand(String command, List<Object> arguments, IProgressMonitor monitor) throws Exception {
+        IJavaModel model = JavaCore.create(ResourcesPlugin.getWorkspace().getRoot());
+        model.refreshExternalArchives(null, monitor);
+        Set<IPath> archives = new HashSet<>();
+        for (Object argument : arguments) {
+            if (argument instanceof String path) archives.add(Path.fromOSString(path));
+        }
+        int closed = 0;
+        if (archives.isEmpty()) return closed;
+        clearDecompilerCache();
+        for (IJavaProject project : model.getJavaProjects()) {
+            for (IPackageFragmentRoot root : project.getPackageFragmentRoots()) {
+                if (monitor.isCanceled()) throw new OperationCanceledException();
+                if (root.isArchive() && root.isExternal() && archives.contains(root.getPath()) && root.isOpen()) {
+                    root.close();
+                    closed++;
+                }
+            }
+        }
+        return closed;
+    }
+
+    /** jdtls keeps decompiled sources in a static per-decompiler LRU with no API to drop them. */
+    private static void clearDecompilerCache() {
+        try {
+            Class<?> impl = IDelegateCommandHandler.class.getClassLoader()
+                    .loadClass("org.eclipse.jdt.ls.core.internal.decompiler.DecompilerImpl");
+            Field field = impl.getDeclaredField("decompilerCache");
+            field.setAccessible(true);
+            if (field.get(null) instanceof Map<?, ?> caches) {
+                synchronized (caches) {
+                    for (Object cache : caches.values()) {
+                        if (cache instanceof Map<?, ?> map) map.clear();
+                    }
+                }
+            }
+        } catch (ReflectiveOperationException | RuntimeException e) {
+            JavaLanguageServerPlugin.logException("Clearing decompiled sources", e);
+        }
+    }
+}

java/java-usages/src/ai/openidea/implementations/ImplementationsCommand.java

@@ -8,6 +8,11 @@ import org.eclipse.core.resources.ResourcesPlugin;
 import org.eclipse.core.runtime.IProgressMonitor;
 import org.eclipse.core.runtime.OperationCanceledException;
 import org.eclipse.jdt.core.*;
+import org.eclipse.jdt.core.search.IJavaSearchScope;
+import org.eclipse.jdt.core.search.SearchEngine;
+import org.eclipse.jdt.internal.core.CreateTypeHierarchyOperation;
+import org.eclipse.jdt.internal.core.DefaultWorkingCopyOwner;
+import org.eclipse.jdt.internal.core.JavaModelManager;
 import org.eclipse.jdt.internal.corext.util.MethodOverrideTester;
 import org.eclipse.jdt.ls.core.internal.IDelegateCommandHandler;
 import org.eclipse.jdt.ls.core.internal.JDTUtils;
@@ -56,7 +61,7 @@ public final class ImplementationsCommand implements IDelegateCommandHandler {
             return false;
         }
         if (type == null || type.getJavaProject() == null) return false;
-        IRegion sources = JavaCore.newRegion();
+        List<IJavaElement> sources = new ArrayList<>();
         for (IJavaProject project : JavaCore.create(ResourcesPlugin.getWorkspace().getRoot()).getJavaProjects()) {
             for (IPackageFragmentRoot fragmentRoot : project.getPackageFragmentRoots()) {
                 if (fragmentRoot.getKind() == IPackageFragmentRoot.K_SOURCE || isKotlinOutput(fragmentRoot)) {
@@ -64,7 +69,13 @@ public final class ImplementationsCommand implements IDelegateCommandHandler {
                 }
             }
         }
-        ITypeHierarchy hierarchy = type.getJavaProject().newTypeHierarchy(type, sources, monitor);
+        // IType.newTypeHierarchy's operation over the sources: the index narrows the subtypes to the
+        // files that name a supertype, where a region hierarchy resolves every type in the region.
+        ICompilationUnit[] workingCopies = JavaModelManager.getJavaModelManager().getWorkingCopies(DefaultWorkingCopyOwner.PRIMARY, true);
+        IJavaSearchScope scope = SearchEngine.createJavaSearchScope(sources.toArray(IJavaElement[]::new));
+        CreateTypeHierarchyOperation operation = new CreateTypeHierarchyOperation(type, workingCopies, scope, true);
+        operation.runOperation(monitor);
+        ITypeHierarchy hierarchy = operation.getResult();
         for (IType subtype : hierarchy.getAllSubtypes(type)) {
             if (monitor.isCanceled()) throw new OperationCanceledException();
             IMember found;

java/java-usages/tests/implementations.py

@@ -72,6 +72,21 @@ public class Task implements Runnable {
     public void run() {
     }
 }
+''',
+    'Anon.java': '''package zoo;
+
+public class Anon {
+    Repo<Double> make() {
+        class Local implements Repo<Double> {
+            public void save(Double item) {
+            }
+        }
+        return new Repo<Double>() {
+            public void save(Double item) {
+            }
+        };
+    }
+}
 ''',
     'Use.java': '''package zoo;
 
@@ -174,11 +189,11 @@ try:
     request('java/buildWorkspace', True)
     # (implementations in the sources, whether they are all there are)
     cases = {
-        # Classes, abstract ones too, and those of the bridged Kotlin output; not the sub-interface.
-        ('Repo.java', 'Repo<T>'): (['Base.java:2', 'Longs.java:0', 'Numbers.java:2', 'Words.java:2'], True),
+        # Classes, abstract, local and anonymous ones too, and those of the bridged Kotlin output; not the sub-interface.
+        ('Repo.java', 'Repo<T>'): (['Anon.java:4', 'Anon.java:8', 'Base.java:2', 'Longs.java:0', 'Numbers.java:2', 'Words.java:2'], True),
         # Through the type arguments; not the abstract re-declaration.
-        ('Repo.java', 'save(T'): (['Longs.java:0', 'Numbers.java:3', 'Words.java:3'], True),
-        ('Use.java', 'save("x")'): (['Longs.java:0', 'Numbers.java:3', 'Words.java:3'], True),
+        ('Repo.java', 'save(T'): (['Anon.java:5', 'Anon.java:9', 'Longs.java:0', 'Numbers.java:3', 'Words.java:3'], True),
+        ('Use.java', 'save("x")'): (['Anon.java:5', 'Anon.java:9', 'Longs.java:0', 'Numbers.java:3', 'Words.java:3'], True),
         ('Repo.java', 'name()'): (['Words.java:6'], True),
         # A library type's implementations in the sources; the library has more.
         ('Use.java', 'Runnable task'): (['Task.java:2'], False),

package.json

@@ -2,7 +2,7 @@
   "name": "openidea",
   "private": true,
   "description": "An open-source IDE inspired by IntelliJ IDEA",
-  "version": "0.1.43",
+  "version": "0.1.44",
   "license": "Apache-2.0",
   "type": "module",
   "scripts": {

plugins/README.md

@@ -598,6 +598,7 @@ then run `openidea-plugin check`.
 | `TextEditor::set_selections(ranges)`, `reveal(range)`                                                          | `editor.text-editor`                       | API 1.4: selections or scrolling in this window's already open editor; no capability. Commands/events only, UTF-16 coordinates.                                                                                                                                                                                                                           |
 | `host::set_decorations`, `clear_decorations`                                                                   | `decorations.{set,clear}`                  | API 1.4: project-scoped editor annotations cleared on plugin stop. Requires `project.read`.                                                                                                                                                                                                                                                               |
 | `host::set_file_decoration`, `clear_file_decorations`                                                          | `decorations.{set-file,clear-file}`        | API 1.4: project-tree badges/styles. Requires `project.read`.                                                                                                                                                                                                                                                                                             |
+| `host::set_file_note`                                                                                          | `decorations.set-file-note`                | API 1.7: a note after the name in the project tree (one line, at most 200 characters). Requires `project.read`.                                                                                                                                                                                                                                           |
 | `Project::search_text(query, limit)`                                                                           | `workspace.project.search-text`            | API 1.4: cancellable Find in Files with unsaved documents and project excludes, at most 10,000 matches. Requires `project.read`.                                                                                                                                                                                                                          |
 | `host::problems(path)`                                                                                         | `diagnostics.problems`                     | API 1.4: project Problems reports grouped by file/source, optional file filter. Requires `project.read` and an invoking window. Empty for remote projects.                                                                                                                                                                                                |
 | `Project::vcs_log(path, limit)`                                                                                | `vcs.log`                                  | API 1.4: newest first, at most 1000 commits, optional file history. Requires `vcs.read` and trust.                                                                                                                                                                                                                                                        |
@@ -851,8 +852,10 @@ Decorations are plain text, with fixed styles mapped to theme tokens:
 `highlight`, `search`, `added`, `modified`, `removed`, `warning`, `error`, `info`,
 `underline`, `strikethrough`, `muted`. Unknown styles are ignored. Editor items
 have `{ range, style, hover, after }`; tree items have `{ badge, style, tooltip }`,
-where a badge has at most two Unicode characters. Paths must resolve inside an
-open project; absolute paths select that project, relative paths use the invoking
+where a badge has at most two Unicode characters. A tree item can instead be a note
+(`set-file-note`, API 1.7): muted text after the file or folder name, one line of at
+most 200 characters, with an optional tooltip; it replaces that set's item for the file.
+Paths must resolve inside an open project; absolute paths select that project, relative paths use the invoking
 project. Sets are isolated by plugin and project and shared by all windows of
 that project. Setting replaces a set's items for one file; clearing removes that
 set in all projects. Each plugin has at most 50 editor sets and 50 tree sets,

plugins/official/ai-completion/dist/plugin.wasm.sources

@@ -1 +1 @@
-e8e6dbe6dba09de2fd71a9d84eed8c01b16253f9247bf882361c6f49b8a4d51d
+b064bd91f44d088c778a0b7e207f9682a56156724588ff500c0c864d22085205

plugins/official/blame-annotations/dist/plugin.wasm.sources

@@ -1 +1 @@
-784a4e01725063fc2949a88bd209e7fcc8ecb0f721acd5f03d92db39ece091a9
+4145b677141c592dbd9130000eae707615ec36069b78ea3e25fe598dc642bf14

plugins/official/checkstyle/dist/plugin.wasm.sources

@@ -1 +1 @@
-73670a049d8c108511af35b5030d08f1e04a9198cba0da54268e75a06747d953
+52f7ccad8966c991505e7a377c59dbf24d0660df66eca97e7a2a8c5d58e3ce68

plugins/official/container-runner/dist/plugin.wasm.sources

@@ -1 +1 @@
-a17332b7d5becc4ddccffdba1f9b009e07f75f171bc2519b6c1038fdda2bfd71
+a438e04a1e179469eec1ee16522b031fea9bbb669d34c77973ee6fd85885a088

plugins/official/csv-editor/dist/plugin.wasm.sources

@@ -1 +1 @@
-3db5b81c6562e2532c9408d749cf65164247c0ef6d51e4195a44ebdc9a697924
+7ff4e304120c9c7bd316b95ce7526fda74adf00867642fcc66311effa1567d76

plugins/official/git-toolbox/dist/plugin.wasm.sources

@@ -1 +1 @@
-2c31b614b8c942fdfc075aa58da2000c85598f0c5031d565ffafeb60c75eeac5
+63847067fc7b9931a3d697d8e6649cea04a0af7ad02d57e26a38f9acb2e6fcdd