feat(plugins): refresh diagnostics while typing (#2048)

Closes #1952

API 1.3 adds a diagnostics provider for unsaved documents: the host sends versioned text for the declared languages after a 300 ms debounce, cancels superseded calls, drops late or stale answers under the editor-provider budget, and clears results with the document, project or plugin. Ranges are UTF-16. Actor panics are contained, queued work is rejected after a host panic, and diagnostics arriving after plugin cleanup are discarded. Verified on macOS with the diagnostics fixture.

Co-authored-by: arnaud-ritti <[email protected]>

Cargo.lock

@@ -4319,6 +4319,7 @@ name = "ide-host"
 version = "0.1.38"
 dependencies = [
  "base64 0.22.1",
+ "blake3",
  "criterion",
  "dirs 6.0.0",
  "dunce",
@@ -4597,6 +4598,7 @@ dependencies = [
  "encoding_rs",
  "ide-build",
  "ide-core",
+ "ide-language",
  "libc",
  "parking_lot",
  "portable-pty",
@@ -4675,7 +4677,6 @@ dependencies = [
  "keyring-core",
  "parking_lot",
  "russh",
- "russh-config",
  "russh-sftp",
  "serde",
  "serde_json",
@@ -5425,10 +5426,7 @@ version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
 dependencies = [
- "bitflags 2.13.2",
  "libc",
- "plain",
- "redox_syscall 0.9.5",
 ]
 
 [[package]]
@@ -6603,7 +6601,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.18",
+ "redox_syscall",
  "smallvec",
  "windows-link",
 ]
@@ -6773,12 +6771,6 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
-[[package]]
-name = "plain"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
-
 [[package]]
 name = "plist"
 version = "1.10.2"
@@ -7236,15 +7228,6 @@ dependencies = [
  "bitflags 2.13.2",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "580c875845b41ecb1564ad1ae4703044cef774145e3d7a94dc2b3fa7c97868fd"
-dependencies = [
- "bitflags 2.13.2",
-]
-
 [[package]]
 name = "redox_users"
 version = "0.5.3"
@@ -7529,20 +7512,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "russh-config"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "993346101d4741a59c82bafc6b645c52ce3e7b0820f13e4b5d48cdb591e3d955"
-dependencies = [
- "futures",
- "globset",
- "log",
- "thiserror 2.0.21",
- "tokio",
- "whoami 1.6.1",
-]
-
 [[package]]
 name = "russh-cryptovec"
 version = "0.62.0"
@@ -8360,7 +8329,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "objc2-quartz-core 0.3.2",
  "raw-window-handle",
- "redox_syscall 0.5.18",
+ "redox_syscall",
  "tracing",
  "wasm-bindgen",
  "web-sys",
@@ -8624,7 +8593,7 @@ dependencies = [
  "stringprep",
  "thiserror 2.0.21",
  "tracing",
- "whoami 2.1.3",
+ "whoami",
 ]
 
 [[package]]
@@ -10566,12 +10535,6 @@ dependencies = [
  "wit-bindgen",
 ]
 
-[[package]]
-name = "wasite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
-
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.129"
@@ -11146,17 +11109,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "whoami"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
-dependencies = [
- "libredox",
- "wasite",
- "web-sys",
-]
-
 [[package]]
 name = "whoami"
 version = "2.1.3"

README.md

@@ -76,8 +76,4 @@ the [official plugins](plugins/official). The plugin API is still a preview.
 
 [Apache 2.0](LICENSE). Bundled third-party assets are listed in [`THIRD_PARTY_LICENSES.md`](THIRD_PARTY_LICENSES.md).
 
-Database tool window notes, including Oracle Instant Client setup, are in
-[`docs/databases.md`](docs/databases.md).
-Java language server choices and their capabilities are in [`docs/java.md`](docs/java.md).
-
 <sub>Not affiliated with JetBrains. IntelliJ IDEA is a trademark of JetBrains s.r.o.</sub>

crates/ide-agent/src/lib.rs

@@ -109,6 +109,9 @@ struct Shared {
 struct Known {
     #[serde(default)]
     config: Vec<AgentConfigOption>,
+    /// Thinking levels reported for each model value, including its last choice.
+    #[serde(default, rename = "thoughtLevels")]
+    thought_levels: BTreeMap<String, Vec<AgentConfigOption>>,
     /// By project root: skills and custom commands differ per project.
     #[serde(default, rename = "projectCommands")]
     commands: HashMap<String, Vec<AgentCommand>>,
@@ -128,10 +131,7 @@ impl Shared {
 
     fn known_config(&self, provider: &str) -> Vec<AgentConfigOption> {
         let mut config = self.known.lock().get(provider).map(|k| k.config.clone()).unwrap_or_default();
-        // A thinking level's values depend on the model (low/medium/high on one, none or a
-        // different set on another), but what ran last is remembered wholesale — after a
-        // model switch the New Task page would offer the previous model's levels. Until the
-        // session reports the new model's own, don't show the option at all.
+        // Model-specific options are offered separately, never as provider-wide defaults.
         config.retain(|o| o.category.as_deref() != Some("thought_level"));
         config::add_client_options(provider, &mut config);
         if let Some((o, v)) = config::bypass_mode(&config).map(|(o, v)| (o.id.clone(), v.value.clone()))
@@ -155,14 +155,31 @@ impl Shared {
         self.paths.project_root.to_string_lossy().into_owned()
     }
 
-    fn remember(&self, provider: &str, config: Option<&[AgentConfigOption]>, commands: Option<&[AgentCommand]>) {
+    /// Cache levels only when `model` confirms which model the session reported them for.
+    fn remember(
+        &self,
+        provider: &str,
+        config: Option<&[AgentConfigOption]>,
+        commands: Option<&[AgentCommand]>,
+        model: Option<&str>,
+    ) {
         let snapshot = {
             let mut cache = self.known.lock();
             let known = cache.entry(provider.to_owned()).or_default();
             let mut changed = false;
-            if let Some(c) = config.filter(|c| !c.is_empty() && known.config != *c) {
-                known.config = c.to_vec();
-                changed = true;
+            if let Some(c) = config {
+                if let Some(model) = model {
+                    let levels: Vec<_> =
+                        c.iter().filter(|o| o.category.as_deref() == Some("thought_level")).cloned().collect();
+                    if known.thought_levels.get(model) != Some(&levels) {
+                        known.thought_levels.insert(model.to_owned(), levels);
+                        changed = true;
+                    }
+                }
+                if !c.is_empty() && known.config != c {
+                    known.config = c.to_vec();
+                    changed = true;
+                }
             }
             let root = self.root_key();
             if let Some(c) =
@@ -221,6 +238,7 @@ struct TaskState {
 /// A running agent and its session.
 #[derive(Clone)]
 struct Live {
+    sign_in_message: String,
     peer: acp::Conn,
     session: String,
     capabilities: AgentCapabilities,
@@ -339,6 +357,8 @@ impl AgentManager {
             .map(|p| {
                 let mut info = provider::describe(p);
                 info.config = self.shared.known_config(&p.id);
+                info.thought_levels =
+                    self.shared.known.lock().get(&p.id).map(|k| k.thought_levels.clone()).unwrap_or_default();
                 info.commands = self.shared.known_commands(&p.id);
                 info
             })
@@ -458,6 +478,18 @@ impl AgentManager {
                 o.current = Some(choice.value.clone());
             }
         }
+        if let Some(model) = model_of(&config)
+            && let Some(levels) = self.shared.known.lock().get(&spec.id).and_then(|k| k.thought_levels.get(&model))
+        {
+            config.extend(levels.iter().cloned().map(|mut o| {
+                if let Some(choice) =
+                    req.config.iter().find(|c| c.id == o.id && o.values.iter().any(|v| v.value == c.value))
+                {
+                    o.current = Some(choice.value.clone());
+                }
+                o
+            }));
+        }
         let now = now_ms();
         let task = AgentTask {
             project_root,
@@ -605,6 +637,8 @@ impl AgentManager {
             o.clone()
         };
         let live = task.live.lock().clone().filter(|l| !l.peer.is_closed());
+        let mut model_options =
+            target.category.as_deref() != Some("model") || target.current.as_deref() == Some(value.as_str());
         if let Some(live) = live.filter(|_| option != config::CURSOR_APPROVAL) {
             let (method, mut params) = config::set_request(&target, &value);
             params["sessionId"] = json!(live.session);
@@ -612,10 +646,14 @@ impl AgentManager {
                 live.peer.request(method, params, None).await.map_err(|e| IdeError::internal(task.describe(e)))?;
             if let Some(options) = reply.get("configOptions") {
                 config::merge_update(&mut task.state.lock().task.config, options);
+                model_options = true;
             }
         }
         {
             let mut s = task.state.lock();
+            if !model_options {
+                s.task.config.retain(|o| o.category.as_deref() != Some("thought_level"));
+            }
             s.wanted.retain(|c| c.id != option);
             s.wanted.push(AgentConfigChoice { id: option.to_owned(), value: value.clone() });
             if let Some(o) = s.task.config.iter_mut().find(|o| o.id == option) {
@@ -624,8 +662,9 @@ impl AgentManager {
             s.task.model = model_of(&s.task.config).or(s.task.model.take());
             let provider = s.task.provider.clone();
             let config = s.task.config.clone();
+            let model = s.task.model.clone().filter(|_| model_options);
             drop(s);
-            task.shared.remember(&provider, Some(&config), None);
+            task.shared.remember(&provider, Some(&config), None, model.as_deref());
         }
         task.approve_pending();
         task.persist();
@@ -1301,11 +1340,7 @@ impl Task {
         match e {
             // Signed out, or the account was refused (Claude Code: "API Error: 403").
             RpcError::Server { message, .. } if message.to_lowercase().contains("auth") => {
-                let provider = self.state.lock().task.provider.clone();
-                Failure::from(match self.shared.spec(&provider) {
-                    Some(spec) => format!("{} needs you to sign in. {}", spec.name, spec.login_hint),
-                    None => message,
-                })
+                Failure::from(self.live.lock().as_ref().map(|live| live.sign_in_message.clone()).unwrap_or(message))
             }
             e => Failure::from(self.describe(e)),
         }
@@ -1323,6 +1358,11 @@ impl Task {
             (s.task.provider.clone(), s.task.cwd.0.clone(), s.session_id.clone())
         };
         let spec = self.shared.spec(&provider_id).ok_or_else(|| format!("unknown agent {provider_id}"))?;
+        let launch_cwd = cwd.clone();
+        let spec = tokio::task::spawn_blocking(move || spec.resolve_for_launch(&launch_cwd))
+            .await
+            .map_err(|e| e.to_string())?;
+        let sign_in_message = spec.sign_in_message();
         self.stderr.lock().clear();
         self.config_sent.lock().clear();
         let weak = Arc::downgrade(self);
@@ -1368,7 +1408,7 @@ impl Task {
                     .await
                     .map_err(|e| match e {
                         RpcError::Server { ref message, .. } if message.to_lowercase().contains("auth") => {
-                            format!("{} needs you to sign in. {}", spec.name, spec.login_hint)
+                            sign_in_message.clone()
                         }
                         e => self.describe(e),
                     })?;
@@ -1394,11 +1434,21 @@ impl Task {
         // A session that reports none keeps the last known ones, but what is set is unknown.
         let reported = config::options_of(&result);
         let known = !reported.is_empty();
-        let (mut options, wanted) = {
+        if known {
+            self.shared.remember(&provider_id, Some(&reported), None, model_of(&reported).as_deref());
+        }
+        let (mut options, mut wanted) = {
             let s = self.state.lock();
             (if known { reported } else { s.task.config.clone() }, s.wanted.clone())
         };
         config::add_client_options(&provider_id, &mut options);
+        // Changing model can replace the effort choices; validate those only afterwards.
+        wanted.sort_by_key(|c| match options.iter().find(|o| o.id == c.id).and_then(|o| o.category.as_deref()) {
+            Some("model") => 0,
+            Some("thought_level") => 2,
+            _ => 1,
+        });
+        let mut model_options = known;
         for choice in &wanted {
             // An option the session doesn't offer yet is set once it does (`apply_late_choices`).
             let Some(o) = options.iter().find(|o| o.id == choice.id).cloned() else { continue };
@@ -1408,6 +1458,9 @@ impl Task {
                 }
                 continue;
             }
+            if o.category.as_deref() == Some("thought_level") && !model_options {
+                continue;
+            }
             let already = known && o.current.as_deref() == Some(choice.value.as_str());
             if already || !o.values.iter().any(|v| v.value == choice.value) {
                 continue;
@@ -1419,6 +1472,12 @@ impl Task {
                 Ok(reply) => {
                     if let Some(fresh) = reply.get("configOptions") {
                         config::merge_update(&mut options, fresh);
+                        model_options = true;
+                    } else if o.category.as_deref() == Some("model") {
+                        if o.current.as_deref() != Some(choice.value.as_str()) {
+                            options.retain(|o| o.category.as_deref() != Some("thought_level"));
+                        }
+                        model_options = false;
                     }
                     if let Some(o) = options.iter_mut().find(|o| o.id == choice.id) {
                         o.current = Some(choice.value.clone());
@@ -1427,7 +1486,8 @@ impl Task {
                 Err(e) => tracing::warn!("agent task {}: setting {} to {} failed: {e}", self.id, o.id, choice.value),
             }
         }
-        self.shared.remember(&provider_id, Some(&options), None);
+        let model = model_of(&options).filter(|_| model_options);
+        self.shared.remember(&provider_id, Some(&options), None, model.as_deref());
         {
             let mut s = self.state.lock();
             s.task.model = model_of(&options).or(s.task.model.take());
@@ -1440,7 +1500,7 @@ impl Task {
         }
         self.persist();
         self.emit_task();
-        let live = Live { peer, session: session_id, capabilities, embedded, resumable: can_load };
+        let live = Live { sign_in_message, peer, session: session_id, capabilities, embedded, resumable: can_load };
         *self.live.lock() = Some(live.clone());
         Ok(live)
     }
@@ -1476,11 +1536,19 @@ impl Task {
                         let mut s = task.state.lock();
                         if let Some(fresh) = reply.get("configOptions") {
                             config::merge_update(&mut s.task.config, fresh);
+                        } else if option.category.as_deref() == Some("model") {
+                            s.task.config.retain(|o| o.category.as_deref() != Some("thought_level"));
                         }
                         if let Some(o) = s.task.config.iter_mut().find(|o| o.id == option.id) {
                             o.current = Some(value);
                         }
                         s.task.model = model_of(&s.task.config).or(s.task.model.take());
+                        let model = s.task.model.clone().filter(|_| {
+                            reply.get("configOptions").is_some() || option.category.as_deref() != Some("model")
+                        });
+                        let (provider, options) = (s.task.provider.clone(), s.task.config.clone());
+                        drop(s);
+                        task.shared.remember(&provider, Some(&options), None, model.as_deref());
                     }
                     Err(e) => tracing::warn!("agent task {}: setting {} to {value} failed: {e}", task.id, option.id),
                 }
@@ -1579,11 +1647,15 @@ impl Task {
             }
         };
         if task_changed {
-            let (config, commands) = {
+            let (config, commands, model) = {
                 let s = self.state.lock();
-                (s.task.config.clone(), s.task.commands.clone())
+                (
+                    s.task.config.clone(),
+                    s.task.commands.clone(),
+                    s.task.model.clone().filter(|_| kind == "config_option_update"),
+                )
             };
-            self.shared.remember(&provider, Some(&config), Some(&commands));
+            self.shared.remember(&provider, Some(&config), Some(&commands), model.as_deref());
             if kind != "usage_update" {
                 self.persist();
             }
@@ -1620,12 +1692,17 @@ impl Task {
     /// Blocks the calling (blocking-pool) thread until the user answers.
     fn ask_permission(self: &Arc<Self>, params: &Value) -> Value {
         let id = self.next_permission.fetch_add(1, Ordering::Relaxed);
+        let (questions, by_index) = asked_questions(params);
         let title = params
             .pointer("/toolCall/title")
             .and_then(Value::as_str)
             .filter(|t| !t.is_empty())
             .unwrap_or("The agent asks for permission")
             .to_owned();
+        // An agent that answers by index titles its request "Ask user N question(s)"; its
+        // first question says what it wants, as the Claude Code adapter titles its own.
+        let title =
+            if by_index { questions.first().map(|question| question.question.clone()).unwrap_or(title) } else { title };
         // A subagent's request is answered in the task's conversation, named after the subagent.
         let session = params.get("sessionId").and_then(Value::as_str);
         let title = match session.and_then(|s| self.state.lock().conversation.label(s)) {
@@ -1647,10 +1724,6 @@ impl Task {
                     .collect()
             })
             .unwrap_or_default();
-        let questions: Vec<AgentQuestion> = params
-            .pointer("/toolCall/_meta/questions")
-            .and_then(|questions| serde_json::from_value(questions.clone()).ok())
-            .unwrap_or_default();
         let asked: Vec<String> = questions.iter().map(|question| question.question.clone()).collect();
         let (tx, rx) = std::sync::mpsc::channel();
         let entry =
@@ -1664,7 +1737,7 @@ impl Task {
             .as_deref()
             .filter(|_| !asked.is_empty())
             .and_then(|reply| serde_json::from_str::<serde_json::Map<String, Value>>(reply).ok());
-        let name = match answers {
+        let name = match &answers {
             Some(answers) => asked
                 .iter()
                 .filter_map(|question| answers.get(question))
@@ -1690,6 +1763,31 @@ impl Task {
         if !still_asking && self.state.lock().task.status == AgentStatus::NeedsInput {
             self.set_status(AgentStatus::Running, None);
         }
+        // An agent that answers by index reads the answers beside the outcome, keyed by
+        // question index, with its Submit option chosen; anything less cancels the request.
+        if by_index {
+            let submit = options.iter().find(|option| option.kind == "allow_once").or_else(|| options.first());
+            return match (answers.as_ref(), submit) {
+                (Some(answers), Some(submit)) => {
+                    let picked: serde_json::Map<String, Value> = asked
+                        .iter()
+                        .enumerate()
+                        .filter_map(|(index, question)| {
+                            let items = answers.get(question)?;
+                            let answer = match items {
+                                Value::Array(items) => {
+                                    items.iter().filter_map(Value::as_str).collect::<Vec<_>>().join(", ")
+                                }
+                                item => item.as_str().unwrap_or_default().to_owned(),
+                            };
+                            Some((index.to_string(), json!(answer)))
+                        })
+                        .collect();
+                    json!({ "outcome": { "outcome": "selected", "optionId": submit.id }, "answers": picked })
+                }
+                _ => json!({ "outcome": { "outcome": "cancelled" } }),
+            };
+        }
         match answer {
             Some(option) => json!({ "outcome": { "outcome": "selected", "optionId": option } }),
             None => json!({ "outcome": { "outcome": "cancelled" } }),
@@ -1703,7 +1801,10 @@ impl Task {
         }
         let mut pending = self.permissions.lock();
         for entry in s.conversation.main.entries.iter().rev() {
-            if let AgentEntry::Permission { id, options, chosen: None, .. } = entry
+            // A request with questions is never satisfied by a bypass: its Submit option
+            // would answer with no answers.
+            if let AgentEntry::Permission { id, options, questions, chosen: None, .. } = entry
+                && questions.is_empty()
                 && let Some(option) = options.iter().find(|o| o.kind == "allow_once")
                 && let Some(reply) = pending.remove(id)
             {
@@ -1768,6 +1869,23 @@ fn clean(mut prompt: AgentPrompt) -> Option<AgentPrompt> {
     (!prompt.text.is_empty() || !prompt.images.is_empty() || !prompt.files.is_empty()).then_some(prompt)
 }
 
+/// The questions a permission request asks, and whether they answer by question index.
+/// The Claude Code adapter carries them as `_meta.questions`, answered as the option id;
+/// Qwen Code (ACP) as `_meta.qwenQuestions`, answered with `answers` keyed by index beside
+/// the id of its Submit option.
+fn asked_questions(params: &Value) -> (Vec<AgentQuestion>, bool) {
+    for (pointer, by_index) in [("/toolCall/_meta/questions", false), ("/toolCall/_meta/qwenQuestions", true)] {
+        if let Some(questions) = params
+            .pointer(pointer)
+            .and_then(|questions| serde_json::from_value::<Vec<AgentQuestion>>(questions.clone()).ok())
+            .filter(|questions| !questions.is_empty())
+        {
+            return (questions, by_index);
+        }
+    }
+    (Vec::new(), false)
+}
+
 /// ACP content blocks: the text, each file (embedded when its text is in `contents`, else
 /// a `resource_link`), then the images.
 fn blocks(prompt: &AgentPrompt, contents: &[Option<String>]) -> Vec<Value> {

crates/ide-agent/src/model.rs

@@ -406,6 +406,9 @@ pub struct AgentProvider {
     pub env: BTreeMap<String, String>,
     /// Settings (models, modes…) the agent offered last time it ran; empty before its first session.
     pub config: Vec<AgentConfigOption>,
+    /// Thinking-level options by model value; absent models have not reported their levels.
+    #[serde(default)]
+    pub thought_levels: BTreeMap<String, Vec<AgentConfigOption>>,
     /// Slash commands it offered last time.
     pub commands: Vec<AgentCommand>,
     pub source: AgentSource,

crates/ide-agent/src/provider.rs

@@ -81,6 +81,64 @@ fn builtins() -> Vec<ProviderSpec> {
         .collect()
 }
 
+impl ProviderSpec {
+    pub(crate) fn login_hint(&self, program: &Path) -> String {
+        if !program.is_absolute() {
+            return self.login_hint.clone();
+        }
+        let search = ide_core::process::host_var_os("PATH").unwrap_or_default();
+        let builtin = builtin_spec(&self.id);
+        let on_path = builtin.as_ref().and_then(|b| ide_core::process::find_executable(&b.command, &search));
+        render_login_hint(self, program, on_path.as_deref(), cfg!(windows))
+    }
+
+    pub(crate) fn sign_in_message(&self) -> String {
+        let name = &self.name;
+        let hint = self.login_hint(Path::new(&self.command));
+        format!("{name} needs you to sign in. {hint}")
+    }
+
+    /// Resolve once before connecting, so authentication guidance names that same install.
+    pub(crate) fn resolve_for_launch(mut self, cwd: &Path) -> Self {
+        if self.driver != Driver::Acp {
+            self.command = crate::native::newest_install(&self.command);
+        }
+        let program = ide_jsonrpc::resolve_spawn_program(&self.command, &self.env);
+        self.command =
+            if program.components().count() > 1 && !program.is_absolute() { cwd.join(program) } else { program }
+                .to_string_lossy()
+                .into_owned();
+        self
+    }
+}
+
+fn render_login_hint(spec: &ProviderSpec, program: &Path, on_path: Option<&Path>, windows: bool) -> String {
+    let Some(builtin) = builtin_spec(&spec.id) else { return spec.login_hint.clone() };
+    let prefix = format!("Run `{}", builtin.command);
+    let Some(rest) = spec.login_hint.strip_prefix(&prefix).filter(|rest| rest.starts_with([' ', '`'])) else {
+        return spec.login_hint.clone();
+    };
+    let same_path = |a: &Path, b: &Path| {
+        a == b || dunce::canonicalize(a).ok().zip(dunce::canonicalize(b).ok()).is_some_and(|(a, b)| a == b)
+    };
+    if on_path.is_some_and(|path| same_path(path, program)) {
+        return spec.login_hint.clone();
+    }
+    let path = program.to_string_lossy();
+    let quoted = if windows {
+        format!("& '{}'", path.replace('\'', "''"))
+    } else {
+        format!("'{}'", path.replace('\'', "'\\''"))
+    };
+    let (args, suffix) = rest.split_once('`').expect("built-in login hints delimit their command");
+    let command = format!("{quoted}{args}");
+    match suffix {
+        " in a terminal." => format!("Run `{command}` in a terminal."),
+        " in a terminal and sign in." => format!("Run `{command}` in a terminal and sign in."),
+        _ => spec.login_hint.clone(),
+    }
+}
+
 /// Whether `id` names a built-in agent that needs no registry install (native drivers
 /// and `npx -y` adapters). CLI built-ins (`copilot`, `gemini`, …) can be installed and
 /// updated from the ACP Registry into `<config>/agents/<id>.toml`.
@@ -119,13 +177,14 @@ pub(crate) fn describe(spec: &ProviderSpec) -> AgentProvider {
         args: spec.args.clone(),
         default_program: builtin.as_ref().map(|b| b.command.clone()),
         default_args: builtin.as_ref().map(|b| b.args.clone()).unwrap_or_default(),
-        login_hint: Some(spec.login_hint.clone()),
+        login_hint: Some(spec.login_hint(&ide_jsonrpc::resolve_spawn_program(&spec.command, &spec.env))),
         command_overridden: builtin.as_ref().is_some_and(|b| b.command != spec.command),
         command_editable: reason.is_none(),
         command_read_only_reason: reason,
         installed: installed(&spec.command),
         env: spec.env.iter().cloned().collect(),
         config: vec![],
+        thought_levels: BTreeMap::new(),
         commands: vec![],
         source: spec.source.clone(),
     }
@@ -312,6 +371,81 @@ fn is_executable(p: &Path) -> bool {
 mod tests {
     use super::*;
 
+    #[test]
+    fn login_hints_cover_all_builtin_commands_and_preserve_separate_login_tools() {
+        for spec in builtins() {
+            let separate = matches!(spec.id.as_str(), "claude-acp" | "codex-acp" | "vibe");
+            for windows in [false, true] {
+                let program =
+                    if windows { Path::new(r"C:\Agent Tools\renamed.cmd") } else { Path::new("/agent tools/renamed") };
+                let hint = render_login_hint(&spec, program, None, windows);
+                if separate {
+                    assert_eq!(hint, spec.login_hint, "{}", spec.id);
+                } else {
+                    let prefix =
+                        if windows { "Run `& 'C:\\Agent Tools\\renamed.cmd'" } else { "Run `'/agent tools/renamed'" };
+                    assert!(hint.starts_with(prefix), "{}: {hint}", spec.id);
+                    assert_eq!(
+                        render_login_hint(&spec, program, Some(program), windows),
+                        spec.login_hint,
+                        "a PATH-resolved command stays bare: {}",
+                        spec.id
+                    );
+                    assert_eq!(render_login_hint(&spec, program, Some(Path::new("/other/install")), windows), hint);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn login_commands_quote_shell_metacharacters_and_keep_arguments() {
+        let cursor = builtin_spec("cursor").unwrap();
+        assert_eq!(
+            render_login_hint(&cursor, Path::new("/agent's tools/$cli"), None, false),
+            "Run `'/agent'\\''s tools/$cli' login` in a terminal."
+        );
+        assert_eq!(
+            render_login_hint(&cursor, Path::new(r"C:\agent's tools\$cli.cmd"), None, true),
+            r"Run `& 'C:\agent''s tools\$cli.cmd' login` in a terminal."
+        );
+        let opencode = builtin_spec("opencode").unwrap();
+        assert_eq!(
+            render_login_hint(&opencode, Path::new("/registry/opencode"), None, false),
+            "Run `'/registry/opencode' auth login` in a terminal."
+        );
+        let mut custom = cursor;
+        custom.id = "custom".into();
+        custom.login_hint = "Sign in with the agent's own command line first.".into();
+        assert_eq!(render_login_hint(&custom, Path::new("/custom"), None, false), custom.login_hint);
+    }
+
+    #[test]
+    fn launch_resolution_uses_the_child_path_and_absolutizes_relative_overrides() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut cursor = builtin_spec("cursor").unwrap();
+        let command = if cfg!(windows) { "cursor-agent.cmd" } else { "cursor-agent" };
+        let program = dir.path().join(command);
+        std::fs::write(&program, "").unwrap();
+        cursor.env.push(("PATH".into(), dir.path().to_string_lossy().into_owned()));
+        let resolved = cursor.clone().resolve_for_launch(dir.path());
+        assert_eq!(Path::new(&resolved.command), program);
+        assert!(resolved.sign_in_message().contains(&*program.to_string_lossy()));
+        cursor.command = format!("tools/{command}");
+        let resolved = cursor.resolve_for_launch(dir.path());
+        assert_eq!(Path::new(&resolved.command), dir.path().join("tools").join(command));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn registry_login_hint_names_the_installed_executable() {
+        let mut spec = builtin_spec("cursor").unwrap();
+        spec.command = "/registry path/dist-package/cursor-agent".into();
+        assert_eq!(
+            describe(&spec).login_hint.as_deref(),
+            Some("Run `'/registry path/dist-package/cursor-agent' login` in a terminal.")
+        );
+    }
+
     #[test]
     fn launch_metadata_distinguishes_defaults_overrides_and_read_only_agents() {
         let dir = tempfile::tempdir().unwrap();

crates/ide-agent/src/tests.rs

@@ -9,13 +9,27 @@ struct FakeAgent {
     /// Every connection's agent side, kept open.
     servers: Mutex<Vec<Peer>>,
     calls: Mutex<Vec<String>>,
+    permission_replies: Mutex<Vec<Value>>,
     /// Without `loadSession` (a session lives only as long as its process).
     no_load: bool,
+    auth_on_new: bool,
+    empty_config: AtomicBool,
     /// Config options `session/new` reports after the model one (per-model efforts, say).
     extra_options: Mutex<Vec<Value>>,
+    model_options: Mutex<HashMap<String, Vec<Value>>>,
 }
 
 impl FakeAgent {
+    fn options_for(&self, model: &str) -> Vec<Value> {
+        let mut options = vec![json!({"id": "model", "category": "model", "type": "select",
+            "currentValue": model,
+            "options": [{"value": "big", "name": "Big"}, {"value": "small", "name": "Small"},
+                {"value": "plain", "name": "Plain"}, {"value": "unknown", "name": "Unknown"}]})];
+        options
+            .extend(self.model_options.lock().get(model).cloned().unwrap_or_else(|| self.extra_options.lock().clone()));
+        options
+    }
+
     /// The connection opened last: the agent restarted, or a fork's.
     fn latest(&self) -> Peer {
         self.servers.lock().last().cloned().expect("a connection")
@@ -87,6 +101,11 @@ impl Handler for FakeAgent {
 
     fn on_request(&self, method: &str, params: Value) -> Result<Value, (i64, String)> {
         self.calls.lock().push(method.to_owned());
+        if (method == "session/new" && self.auth_on_new)
+            || (method == "session/prompt" && params.pointer("/prompt/0/text") == Some(&json!("auth")))
+        {
+            return Err((codes::INTERNAL_ERROR, "Authentication required".into()));
+        }
         let session = params.get("sessionId").and_then(Value::as_str).unwrap_or("s1").to_owned();
         match method {
             "initialize" => {
@@ -97,10 +116,10 @@ impl Handler for FakeAgent {
                     "sessionCapabilities": {"fork": {}}, "_meta": {"openidea": {"rollback": true, "steer": true, "backgroundTasks": true}}}}))
             }
             "session/new" => {
-                let mut options = vec![json!({"id": "model", "category": "model", "type": "select",
-                    "currentValue": "big",
-                    "options": [{"value": "big", "name": "Big"}, {"value": "small", "name": "Small"}]})];
-                options.extend(self.extra_options.lock().iter().cloned());
+                if self.empty_config.load(Ordering::Acquire) {
+                    return Ok(json!({"sessionId": "s1"}));
+                }
+                let options = self.options_for("big");
                 Ok(json!({"sessionId": "s1",
                 "modes": {"currentModeId": "ask", "availableModes": [{"id": "ask", "name": "Ask"}, {"id": "code", "name": "Code"}]},
                 "configOptions": options}))
@@ -121,6 +140,9 @@ impl Handler for FakeAgent {
             }
             "session/set_config_option" | "session/set_mode" => {
                 self.calls.lock().push(format!("{method} {}", params.get("value").or(params.get("modeId")).unwrap()));
+                if params["configId"] == "model" && !self.model_options.lock().is_empty() {
+                    return Ok(json!({"configOptions": self.options_for(params["value"].as_str().unwrap())}));
+                }
                 Ok(json!({}))
             }
             "session/prompt" => {
@@ -170,9 +192,37 @@ impl Handler for FakeAgent {
                             None,
                         ))
                         .unwrap();
+                    self.permission_replies.lock().push(answer.clone());
                     let chosen = answer.pointer("/outcome/optionId").and_then(Value::as_str).unwrap_or("none");
                     self.say(&session, &format!("answered {chosen}"));
-                    return Ok(json!({"stopReason": "end_turn"}));
+                    return Ok(json!({ "stopReason": "end_turn" }));
+                }
+                if text == "qwen ask" {
+                    // Qwen Code's ACP dialect: the questions as `qwenQuestions`, Submit and
+                    // Cancel as the options, the answers keyed by question index.
+                    let peer = self.latest();
+                    let answer: Value = tokio::runtime::Handle::current()
+                        .block_on(peer.request(
+                            "session/request_permission",
+                            json!({"sessionId": session,
+                                "toolCall": {"toolCallId": "q2", "title": "Ask user 2 questions", "kind": "think",
+                                    "_meta": {"toolName": "ask_user_question", "qwenInteractionKind": "user_question",
+                                        "qwenQuestions": [
+                                            {"question": "Which database?", "header": "Database", "options": [
+                                                {"label": "Postgres", "description": "Relational"},
+                                                {"label": "Redis", "description": "Key-value"}]},
+                                            {"question": "Which caches?", "header": "Caches", "multiSelect": true,
+                                             "options": [{"label": "Disk"}, {"label": "Memory"}]}]}},
+                                "options": [{"optionId": "proceed_once", "name": "Submit", "kind": "allow_once"},
+                                            {"optionId": "cancel", "name": "Cancel", "kind": "reject_once"}]}),
+                            None,
+                        ))
+                        .unwrap();
+                    let outcome = answer.pointer("/outcome/outcome").and_then(Value::as_str).unwrap_or("none");
+                    let option = answer.pointer("/outcome/optionId").and_then(Value::as_str).unwrap_or("none");
+                    let answers = answer.get("answers").cloned().unwrap_or(Value::Null);
+                    self.say(&session, &format!("answered {outcome} {option} {answers}"));
+                    return Ok(json!({ "stopReason": "end_turn" }));
                 }
                 if text == "wait" {
                     // Works until cancelled.
@@ -250,6 +300,49 @@ fn manager_at(dir: &Path, models_file: &Path, agent: Arc<FakeAgent>) -> AgentMan
     )
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn authentication_failures_name_the_session_executable_at_start_and_during_prompts() {
+    for auth_on_new in [true, false] {
+        let tmp = tempfile::tempdir().unwrap();
+        let agent = Arc::new(FakeAgent { auth_on_new, ..Default::default() });
+        let mgr = manager(tmp.path(), agent);
+        let program = tmp.path().join("Agent Tools").join("renamed-cursor.cmd");
+        mgr.shared.providers.write().iter_mut().find(|s| s.id == "cursor").unwrap().command =
+            program.to_string_lossy().into_owned();
+        let task = mgr
+            .create(NewAgentTask {
+                project_root: None,
+                prompt: text("again"),
+                provider: "cursor".into(),
+                config: vec![],
+                isolation: Isolation::Local,
+                base: None,
+            })
+            .await
+            .unwrap();
+        if !auth_on_new {
+            wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+            // A settings change must not redirect guidance for the already running process.
+            mgr.shared.providers.write().iter_mut().find(|s| s.id == "cursor").unwrap().command =
+                "different-cursor".into();
+            mgr.prompt(&task.id, text("auth"), false).await.unwrap();
+        }
+        wait_for(&mgr, &task.id, AgentStatus::Failed).await;
+        let entries = mgr.entries(&task.id, None).unwrap();
+        let error = entries
+            .iter()
+            .find_map(|e| match e {
+                AgentEntry::Error { message, .. } => Some(message),
+                _ => None,
+            })
+            .expect("authentication error");
+        assert!(error.starts_with("Cursor needs you to sign in. Run `"), "{error}");
+        assert!(error.contains(&*program.to_string_lossy()), "{error}");
+        assert!(error.ends_with(" login` in a terminal."), "{error}");
+        mgr.shutdown();
+    }
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn commands_are_remembered_per_project_and_merged_with_skills_on_disk() {
     let tmp = tempfile::tempdir().unwrap();
@@ -628,9 +721,10 @@ fn prompts_become_acp_content_blocks() {
 }
 
 #[tokio::test(flavor = "multi_thread")]
-async fn answered_questions_close_the_question_with_every_picked_label() {
+async fn claude_questions_keep_the_answer_object_as_the_option_id() {
     let tmp = tempfile::tempdir().unwrap();
-    let mgr = manager(tmp.path(), Arc::new(FakeAgent::default()));
+    let agent = Arc::new(FakeAgent::default());
+    let mgr = manager(tmp.path(), agent.clone());
     let task = mgr
         .create(NewAgentTask {
             project_root: None,
@@ -648,13 +742,22 @@ async fn answered_questions_close_the_question_with_every_picked_label() {
         .unwrap()
         .iter()
         .find_map(|e| match e {
-            AgentEntry::Permission { id, .. } => Some(*id),
+            AgentEntry::Permission { id, title, questions, .. } => {
+                assert_eq!(title, "AskUserQuestion");
+                assert_eq!(questions.len(), 2);
+                assert_eq!(questions[0].question, "Which layout?");
+                assert!(!questions[0].multi_select);
+                assert_eq!(questions[1].question, "Which checks?");
+                assert!(questions[1].multi_select);
+                Some(*id)
+            }
             _ => None,
         })
         .unwrap();
     let reply = json!({"Which layout?": ["List"], "Which checks?": ["Disk", "GPU temps"]}).to_string();
-    mgr.respond(&task.id, question, Some(reply)).unwrap();
+    mgr.respond(&task.id, question, Some(reply.clone())).unwrap();
     wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+    assert_eq!(*agent.permission_replies.lock(), [json!({"outcome": {"outcome": "selected", "optionId": reply}})]);
 
     let entries = mgr.entries(&task.id, None).unwrap();
     assert!(
@@ -665,6 +768,113 @@ async fn answered_questions_close_the_question_with_every_picked_label() {
     );
 }
 
+/// Qwen Code asks its questions as `_meta.qwenQuestions` with Submit/Cancel options; the
+/// card answers with `answers` keyed by question index beside the Submit option's id.
+#[tokio::test(flavor = "multi_thread")]
+async fn qwen_questions_answer_by_index_beside_the_submit_option() {
+    let tmp = tempfile::tempdir().unwrap();
+    let mgr = manager(tmp.path(), Arc::new(FakeAgent::default()));
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text("qwen ask"),
+            provider: "codex".into(),
+            config: vec![],
+            isolation: Isolation::Local,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::NeedsInput).await;
+    let (id, title, questions) = mgr
+        .entries(&task.id, None)
+        .unwrap()
+        .iter()
+        .find_map(|e| match e {
+            AgentEntry::Permission { id, title, questions, .. } => Some((*id, title.clone(), questions.clone())),
+            _ => None,
+        })
+        .unwrap();
+    assert_eq!(title, "Which database?", "the first question, not the request's own title");
+    assert_eq!(
+        questions,
+        vec![
+            AgentQuestion {
+                header: "Database".into(),
+                question: "Which database?".into(),
+                multi_select: false,
+                options: vec![
+                    AgentQuestionOption { label: "Postgres".into(), description: "Relational".into(), preview: None },
+                    AgentQuestionOption { label: "Redis".into(), description: "Key-value".into(), preview: None },
+                ],
+            },
+            AgentQuestion {
+                header: "Caches".into(),
+                question: "Which caches?".into(),
+                multi_select: true,
+                options: vec![
+                    AgentQuestionOption { label: "Disk".into(), description: String::new(), preview: None },
+                    AgentQuestionOption { label: "Memory".into(), description: String::new(), preview: None },
+                ],
+            },
+        ]
+    );
+    let reply = json!({"Which database?": ["Postgres"], "Which caches?": ["Disk", "Memory"]}).to_string();
+    mgr.respond(&task.id, id, Some(reply)).unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+
+    let entries = mgr.entries(&task.id, None).unwrap();
+    let expected = format!("answered selected proceed_once {}", json!({"0": "Postgres", "1": "Disk, Memory"}));
+    assert!(entries.iter().any(|e| matches!(e, AgentEntry::Agent { text } if text == &expected)), "{entries:?}");
+    assert!(
+        entries
+            .iter()
+            .any(|e| matches!(e, AgentEntry::Permission { chosen: Some(c), .. } if c == "Postgres; Disk, Memory")),
+        "{entries:?}"
+    );
+}
+
+/// A skipped Qwen question cancels the request: qwen-code reads the answers it expects
+/// only beside a chosen option, and `reject` is none of the options it offered.
+#[tokio::test(flavor = "multi_thread")]
+async fn skipped_qwen_questions_cancel_the_request() {
+    let tmp = tempfile::tempdir().unwrap();
+    let mgr = manager(tmp.path(), Arc::new(FakeAgent::default()));
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text("qwen ask"),
+            provider: "codex".into(),
+            config: vec![],
+            isolation: Isolation::Local,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::NeedsInput).await;
+    let id = mgr
+        .entries(&task.id, None)
+        .unwrap()
+        .iter()
+        .find_map(|e| match e {
+            AgentEntry::Permission { id, questions, .. } if !questions.is_empty() => Some(*id),
+            _ => None,
+        })
+        .unwrap();
+    mgr.respond(&task.id, id, Some("reject".into())).unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+
+    let entries = mgr.entries(&task.id, None).unwrap();
+    assert!(
+        entries.iter().any(|e| matches!(e, AgentEntry::Agent { text } if text == "answered cancelled none null")),
+        "{entries:?}"
+    );
+    assert!(
+        entries.iter().any(|e| matches!(e, AgentEntry::Permission { chosen: Some(c), .. } if c == "Cancelled")),
+        "{entries:?}"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn cancelling_resolves_the_open_permission_and_delete_forgets_the_task() {
     let tmp = tempfile::tempdir().unwrap();
@@ -863,6 +1073,22 @@ async fn usage_limits_and_late_settings() {
     assert!(agent.calls.lock().iter().any(|c| c == "session/set_config_option \"high\""));
     let config = mgr.task(&task.id).unwrap().state.lock().task.config.clone();
     assert_eq!(config.iter().find(|o| o.id == "effort").unwrap().current.as_deref(), Some("high"));
+    for _ in 0..100 {
+        if mgr
+            .shared
+            .known
+            .lock()
+            .get("claude")
+            .and_then(|k| k.thought_levels.get("big"))
+            .and_then(|levels| levels.first())
+            .and_then(|o| o.current.as_deref())
+            == Some("high")
+        {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    }
+    assert_eq!(mgr.shared.known.lock()["claude"].thought_levels["big"][0].current.as_deref(), Some("high"));
 }
 
 #[tokio::test(flavor = "multi_thread")]
@@ -870,7 +1096,7 @@ async fn remembered_settings_drop_per_model_choices_for_the_next_task() {
     let tmp = tempfile::tempdir().unwrap();
     let agent = Arc::new(FakeAgent::default());
     // The effort list depends on the model: what the last session ran means nothing once
-    // the user picks another model, so the New Task page shows the option without a choice.
+    // the user picks another model, so provider-wide defaults never include it.
     *agent.extra_options.lock() = vec![json!({"id": "effort", "category": "thought_level",
         "type": "select", "currentValue": "high",
         "options": [{"value": "low", "name": "Low"}, {"value": "high", "name": "High"}]})];
@@ -894,6 +1120,185 @@ async fn remembered_settings_drop_per_model_choices_for_the_next_task() {
     assert_eq!(model.current.as_deref(), Some("big"), "the model choice survives");
 }
 
+fn effort_options(levels: &[&str], current: &str) -> Vec<Value> {
+    vec![json!({"id": "effort", "category": "thought_level", "type": "select", "currentValue": current,
+        "options": levels.iter().map(|v| json!({"value": v, "name": v})).collect::<Vec<_>>()})]
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn thinking_levels_are_remembered_per_provider_and_model() {
+    let tmp = tempfile::tempdir().unwrap();
+    let agent = Arc::new(FakeAgent::default());
+    *agent.model_options.lock() = HashMap::from([
+        ("big".into(), effort_options(&["low", "high"], "high")),
+        ("small".into(), effort_options(&["minimal", "medium"], "minimal")),
+        ("plain".into(), vec![]),
+    ]);
+    let mgr = manager(tmp.path(), agent.clone());
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text("again"),
+            provider: "claude".into(),
+            config: vec![],
+            isolation: Isolation::Local,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+    mgr.set_config(&task.id, "model", "small".into()).await.unwrap();
+    mgr.set_config(&task.id, "effort", "medium".into()).await.unwrap();
+    mgr.set_config(&task.id, "model", "plain".into()).await.unwrap();
+    let p = mgr.providers().into_iter().find(|p| p.id == "claude").unwrap();
+    let big = &p.thought_levels["big"][0];
+    assert_eq!(big.current.as_deref(), Some("high"));
+    assert_eq!(big.values.iter().map(|v| v.value.as_str()).collect::<Vec<_>>(), ["low", "high"]);
+    let small = &p.thought_levels["small"][0];
+    assert_eq!(small.current.as_deref(), Some("medium"));
+    assert_eq!(small.values.iter().map(|v| v.value.as_str()).collect::<Vec<_>>(), ["minimal", "medium"]);
+    assert!(p.thought_levels["plain"].is_empty());
+    assert!(!p.thought_levels.contains_key("unknown"));
+    assert!(mgr.providers().iter().find(|p| p.id == "codex").unwrap().thought_levels.is_empty());
+    let saved: HashMap<String, Known> =
+        serde_json::from_slice(&std::fs::read(&mgr.shared.paths.models_file).unwrap()).unwrap();
+    assert_eq!(saved["claude"].thought_levels, p.thought_levels);
+    mgr.shutdown();
+    let restored = manager(tmp.path(), agent);
+    assert_eq!(restored.providers().into_iter().find(|p| p.id == "claude").unwrap().thought_levels, p.thought_levels);
+    restored.shutdown();
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn upfront_effort_is_validated_after_changing_model_before_the_prompt() {
+    for (effort, applied) in [("medium", true), ("high", false)] {
+        let tmp = tempfile::tempdir().unwrap();
+        let agent = Arc::new(FakeAgent::default());
+        *agent.model_options.lock() = HashMap::from([
+            ("big".into(), effort_options(&["low", "high"], "low")),
+            ("small".into(), effort_options(&["minimal", "medium"], "minimal")),
+        ]);
+        let mgr = manager(tmp.path(), agent.clone());
+        let task = mgr
+            .create(NewAgentTask {
+                project_root: None,
+                prompt: text("again"),
+                provider: "claude".into(),
+                // Reversed on purpose: model must be set before validating effort.
+                config: vec![
+                    AgentConfigChoice { id: "effort".into(), value: effort.into() },
+                    AgentConfigChoice { id: "model".into(), value: "small".into() },
+                ],
+                isolation: Isolation::Local,
+                base: None,
+            })
+            .await
+            .unwrap();
+        wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+        let calls = agent.calls.lock();
+        let model = calls.iter().position(|c| c == "session/set_config_option \"small\"").unwrap();
+        let effort_call = calls.iter().position(|c| c == &format!("session/set_config_option \"{effort}\""));
+        assert_eq!(effort_call.is_some(), applied);
+        if let Some(effort_call) = effort_call {
+            let prompt = calls.iter().position(|c| c == "session/prompt").unwrap();
+            assert!(model < effort_call && effort_call < prompt);
+        }
+        drop(calls);
+        mgr.shutdown();
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn unreported_model_switch_does_not_cache_the_previous_models_levels() {
+    let tmp = tempfile::tempdir().unwrap();
+    let agent = Arc::new(FakeAgent::default());
+    *agent.extra_options.lock() = effort_options(&["low", "high"], "high");
+    let mgr = manager(tmp.path(), agent);
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text("again"),
+            provider: "claude".into(),
+            config: vec![],
+            isolation: Isolation::Local,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+    mgr.set_config(&task.id, "model", "small".into()).await.unwrap();
+    let p = mgr.providers().into_iter().find(|p| p.id == "claude").unwrap();
+    assert!(!p.thought_levels.contains_key("small"));
+    assert_eq!(p.thought_levels["big"][0].current.as_deref(), Some("high"));
+    mgr.shutdown();
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn cached_effort_is_not_sent_without_real_session_options() {
+    let tmp = tempfile::tempdir().unwrap();
+    let agent = Arc::new(FakeAgent::default());
+    *agent.extra_options.lock() = effort_options(&["low", "high"], "low");
+    let mgr = manager(tmp.path(), agent.clone());
+    let new = |config| NewAgentTask {
+        project_root: None,
+        prompt: text("again"),
+        provider: "claude".into(),
+        config,
+        isolation: Isolation::Local,
+        base: None,
+    };
+    let warm = mgr.create(new(vec![])).await.unwrap();
+    wait_for(&mgr, &warm.id, AgentStatus::Ready).await;
+    agent.calls.lock().clear();
+    agent.empty_config.store(true, Ordering::Release);
+    let task = mgr
+        .create(new(vec![
+            AgentConfigChoice { id: "model".into(), value: "big".into() },
+            AgentConfigChoice { id: "effort".into(), value: "high".into() },
+        ]))
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+    assert!(!agent.calls.lock().iter().any(|c| c == "session/set_config_option \"high\""));
+    assert!(
+        mgr.task(&task.id).unwrap().state.lock().task.config.iter().any(|o| o.id == "effort"),
+        "remembered session settings remain visible until the agent refreshes them"
+    );
+    mgr.shutdown();
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn reported_levels_refresh_even_without_a_model_option() {
+    let tmp = tempfile::tempdir().unwrap();
+    let agent = Arc::new(FakeAgent::default());
+    *agent.extra_options.lock() = effort_options(&["low", "high"], "high");
+    let mgr = manager(tmp.path(), agent.clone());
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text("again"),
+            provider: "claude".into(),
+            config: vec![],
+            isolation: Isolation::Local,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+    for levels in [effort_options(&["minimal", "medium"], "medium"), vec![]] {
+        agent.update("s1", json!({"sessionUpdate": "config_option_update", "configOptions": levels}));
+        let expected = config::parse_options(&json!(levels));
+        for _ in 0..100 {
+            if mgr.shared.known.lock()["claude"].thought_levels["big"] == expected {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        assert_eq!(mgr.shared.known.lock()["claude"].thought_levels["big"], expected);
+    }
+    mgr.shutdown();
+}
+
 #[test]
 fn retry_updates_become_a_countdown() {
     let update =
@@ -963,6 +1368,64 @@ async fn cursor_approval_switch_resolves_pending_and_survives_restart() {
     mgr.shutdown();
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn bypass_approvals_keeps_both_question_dialects_pending_but_allows_permissions() {
+    for prompt in ["ask", "qwen ask"] {
+        for bypass_at_start in [false, true] {
+            let tmp = tempfile::tempdir().unwrap();
+            let mgr = manager(tmp.path(), Arc::new(FakeAgent::default()));
+            // Cursor's client-side approval policy applies independently of the question dialect.
+            let task = mgr
+                .create(NewAgentTask {
+                    project_root: None,
+                    prompt: text(prompt),
+                    provider: "cursor".into(),
+                    config: if bypass_at_start {
+                        vec![AgentConfigChoice { id: config::CURSOR_APPROVAL.into(), value: "bypass".into() }]
+                    } else {
+                        vec![]
+                    },
+                    isolation: Isolation::Local,
+                    base: None,
+                })
+                .await
+                .unwrap();
+            wait_for(&mgr, &task.id, AgentStatus::NeedsInput).await;
+            let id = mgr
+                .entries(&task.id, None)
+                .unwrap()
+                .iter()
+                .find_map(|entry| match entry {
+                    AgentEntry::Permission { id, questions, chosen: None, .. } if questions.len() == 2 => Some(*id),
+                    _ => None,
+                })
+                .unwrap();
+            mgr.set_config(&task.id, config::CURSOR_APPROVAL, "bypass".into()).await.unwrap();
+            assert!(mgr.task(&task.id).unwrap().permissions.lock().contains_key(&id), "{prompt}, {bypass_at_start}");
+            assert_eq!(mgr.task(&task.id).unwrap().state.lock().task.status, AgentStatus::NeedsInput);
+            let reply = if prompt == "ask" {
+                json!({"Which layout?": ["Grid"], "Which checks?": ["Disk"]})
+            } else {
+                json!({"Which database?": ["Postgres"], "Which caches?": ["Memory"]})
+            };
+            mgr.respond(&task.id, id, Some(reply.to_string())).unwrap();
+            wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+
+            mgr.prompt(&task.id, text("Fix"), false).await.unwrap();
+            wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+            let entries = mgr.entries(&task.id, None).unwrap();
+            assert!(
+                entries.iter().any(|entry| matches!(entry,
+                    AgentEntry::Permission { questions, chosen: Some(name), .. }
+                    if questions.is_empty() && name == "Allow")),
+                "{entries:?}"
+            );
+            assert!(entries.iter().any(|entry| matches!(entry, AgentEntry::Agent { text } if text == "chose yes")));
+            mgr.shutdown();
+        }
+    }
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn cursor_approval_choice_applies_before_first_prompt() {
     let tmp = tempfile::tempdir().unwrap();

crates/ide-build/src/compile/mod.rs

@@ -153,7 +153,7 @@ fn detect_dir(dir: &Path, model: &BuildModel, root: &Path) -> Option<BuildSystem
         Some(BuildSystem::Gradle)
     } else if has(dir, &["Cargo.toml"]) {
         Some(BuildSystem::Cargo)
-    } else if has(dir, &["go.mod"]) {
+    } else if has(dir, &["go.mod", "go.work"]) {
         Some(BuildSystem::Go)
     } else if has(dir, &["tsconfig.json", "package.json"]) {
         Some(BuildSystem::TypeScript)
@@ -227,7 +227,7 @@ pub fn plan(
         BuildSystem::Gradle => gradle_steps(root, model, kind, module_dir.as_deref())?,
         BuildSystem::Cargo => cargo_steps(&dir, kind),
         // Go builds the file's package (a module holds many).
-        BuildSystem::Go => go_steps(file.and_then(Path::parent).unwrap_or(&dir), kind),
+        BuildSystem::Go => go_steps(file.and_then(Path::parent).unwrap_or(&dir), kind)?,
         BuildSystem::TypeScript => ts_steps(&dir, kind),
         BuildSystem::CMake => cmake_steps(&dir, kind, cmake.and_then(<[_]>::first)),
     };
@@ -374,7 +374,31 @@ fn cmake_steps(dir: &Path, kind: BuildKind, profile: Option<&CMakeProfile>) -> V
     steps
 }
 
-fn go_steps(dir: &Path, kind: BuildKind) -> Vec<BuildStep> {
+fn go_steps(dir: &Path, kind: BuildKind) -> IdeResult<Vec<BuildStep>> {
+    if dir.join("go.work").is_file() {
+        let work_file = dunce::canonicalize(dir.join("go.work"))?;
+        let modules = ide_core::go::work_modules(&std::fs::read_to_string(dir.join("go.work"))?);
+        if modules.is_empty() {
+            return Err(IdeError::invalid("The Go workspace contains no modules"));
+        }
+        let mut steps = Vec::new();
+        for module in modules {
+            let module = dir.join(module);
+            if !module.join("go.mod").is_file() {
+                return Err(IdeError::not_found(format!("Go workspace module has no go.mod: {}", module.display())));
+            }
+            let mut module_steps = go_module_steps(&module, kind);
+            for step in &mut module_steps {
+                step.env.insert("GOWORK".into(), work_file.to_string_lossy().into_owned());
+            }
+            steps.extend(module_steps);
+        }
+        return Ok(steps);
+    }
+    Ok(go_module_steps(dir, kind))
+}
+
+fn go_module_steps(dir: &Path, kind: BuildKind) -> Vec<BuildStep> {
     let module_root = dir.ancestors().find(|d| d.join("go.mod").is_file()).unwrap_or(dir);
     let target = if module_root == dir { "./...".to_owned() } else { format!("./{}/...", rel_str(module_root, dir)) };
     let mut args = vec!["build"];
@@ -813,6 +837,68 @@ fn launch_class_dirs(system: BuildSystem, module: &Path, test: bool) -> Vec<Path
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn go_workspace_build_commands_compile_members_with_local_dependencies() {
+        let Some(go) = ide_core::process::find_executable("go", &ide_core::tool_path::search_path()) else {
+            return;
+        };
+        let tmp = tempfile::tempdir().unwrap();
+        let root = &tmp.path().join("workspace");
+        write(root, "go.work", "go 1.22\nuse (\n ./app\n ./lib\n ../external\n)\n");
+        write(root, "lib/go.mod", "module example.com/lib\ngo 1.22\n");
+        write(root, "lib/lib.go", "package lib\nfunc Value() int { return 1 }\n");
+        write(root, "app/go.mod", "module example.com/app\ngo 1.22\nrequire example.com/lib v0.0.0\n");
+        write(root, "app/main.go", "package main\nimport \"example.com/lib\"\nfunc main(){_ = lib.Value()}\n");
+        write(root, "../external/go.mod", "module example.com/external\ngo 1.22\nrequire example.com/lib v0.0.0\n");
+        write(root, "../external/main.go", "package main\nimport \"example.com/lib\"\nfunc main(){_ = lib.Value()}\n");
+        let plan = plan(root, &BuildModel::default(), BuildKind::Build, None, None).unwrap();
+        for step in plan.steps {
+            let result = std::process::Command::new(&go)
+                .args(&step.args)
+                .envs(&step.env)
+                .env("GOPROXY", "off")
+                .current_dir(&step.cwd)
+                .output()
+                .unwrap();
+            assert!(result.status.success(), "{}", String::from_utf8_lossy(&result.stderr));
+        }
+    }
+
+    #[test]
+    fn go_workspace_builds_every_use_module() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("workspace");
+        write(&root, "go.work", "go 1.22\nuse (\n  ./api\n  \"./lib with spaces\"\n  ../shared\n)\n");
+        for module in ["api", "lib with spaces", "../shared"] {
+            write(&root.join(module), "go.mod", "module example.com/p\ngo 1.22\n");
+        }
+        for kind in [BuildKind::Build, BuildKind::Rebuild, BuildKind::Artifacts] {
+            let p = plan(&root, &BuildModel::default(), kind, None, None).unwrap();
+            assert_eq!(p.system, BuildSystem::Go);
+            assert_eq!(p.steps.len(), 3);
+            for (step, module) in p.steps.iter().zip(["api", "lib with spaces", "../shared"]) {
+                assert_eq!(step.cwd, root.join(module));
+                let expected =
+                    if kind == BuildKind::Rebuild { vec!["build", "-a", "./..."] } else { vec!["build", "./..."] };
+                assert_eq!(step.args, expected);
+            }
+        }
+        let member =
+            plan(&root, &BuildModel::default(), BuildKind::Build, Some(&root.join("api/pkg/a.go")), None).unwrap();
+        assert_eq!(member.steps.len(), 1);
+        assert_eq!(member.steps[0].cwd, root.join("api"));
+        assert_eq!(member.steps[0].args, ["build", "./pkg/..."]);
+        write(&root, "go.work", "use ./missing\n");
+        assert!(
+            plan(&root, &BuildModel::default(), BuildKind::Build, None, None)
+                .unwrap_err()
+                .to_string()
+                .contains("go.mod")
+        );
+        write(&root, "go.work", "go 1.22\n");
+        assert!(plan(&root, &BuildModel::default(), BuildKind::Build, None, None).is_err());
+    }
+
     #[test]
     fn independent_gradle_builds_keep_their_launchers_and_task_paths() {
         let wrapper = if cfg!(windows) { "gradlew.bat" } else { "gradlew" };

crates/ide-core/src/event.rs

@@ -15,6 +15,8 @@ use std::sync::Arc;
 pub enum IdeEvent {
     /// Project window membership or selection changed.
     WindowGroupsChanged,
+    /// A window entered or left full screen, itself or as a member of a full-screen window group.
+    WindowFullscreenChanged,
     ProjectTrustChanged {
         root: crate::IpcPath,
         trusted: bool,

crates/ide-core/src/go.rs

@@ -0,0 +1,124 @@
+//! Go workspace module paths shared by project builds and run detection.
+use std::path::PathBuf;
+
+/// Module directories from a go.work file. Quoted paths and comments follow Go's file syntax.
+pub fn work_modules(text: &str) -> Vec<PathBuf> {
+    let mut tokens = Vec::new();
+    let mut chars = text.chars().peekable();
+    while let Some(ch) = chars.next() {
+        match ch {
+            '\n' | '(' | ')' => tokens.push(ch.to_string()),
+            ch if ch.is_whitespace() => {}
+            '/' if chars.peek() == Some(&'/') => {
+                for c in chars.by_ref() {
+                    if c == '\n' {
+                        tokens.push("\n".into());
+                        break;
+                    }
+                }
+            }
+            '"' | '`' => {
+                let Some(token) = quoted_work_path(&mut chars, ch) else { return Vec::new() };
+                tokens.push(token);
+            }
+            _ => {
+                let mut token = ch.to_string();
+                while chars.peek().is_some_and(|c| !c.is_whitespace() && *c != '(' && *c != ')') {
+                    token.push(chars.next().unwrap());
+                }
+                tokens.push(token);
+            }
+        }
+    }
+    let mut out = Vec::new();
+    let mut start = true;
+    let mut tokens = tokens.into_iter();
+    while let Some(token) = tokens.next() {
+        if token == "\n" {
+            start = true;
+            continue;
+        }
+        if start
+            && token == "use"
+            && let Some(path) = tokens.next()
+        {
+            if path == "(" {
+                let mut paths = Vec::new();
+                let mut closed = false;
+                for path in tokens.by_ref() {
+                    if path == ")" {
+                        closed = true;
+                        break;
+                    }
+                    if path != "\n" && !path.is_empty() {
+                        paths.push(PathBuf::from(path));
+                    }
+                }
+                if closed {
+                    out.extend(paths);
+                }
+            } else if path != "\n" && !path.is_empty() {
+                out.push(PathBuf::from(path));
+            }
+        }
+        start = false;
+    }
+    let mut seen = std::collections::HashSet::new();
+    out.retain(|path| seen.insert(path.clone()));
+    out
+}
+
+fn quoted_work_path(chars: &mut std::iter::Peekable<std::str::Chars<'_>>, quote: char) -> Option<String> {
+    let mut bytes = Vec::new();
+    while let Some(ch) = chars.next() {
+        if ch == quote {
+            return String::from_utf8(bytes).ok();
+        }
+        if ch == '\\' && quote == '"' {
+            let escaped = chars.next()?;
+            let byte = match escaped {
+                'a' => 7,
+                'b' => 8,
+                'f' => 12,
+                'n' => 10,
+                'r' => 13,
+                't' => 9,
+                'v' => 11,
+                '\\' => b'\\',
+                '"' => b'"',
+                'x' => {
+                    let digits: String = chars.by_ref().take(2).collect();
+                    if digits.len() != 2 {
+                        return None;
+                    }
+                    u8::from_str_radix(&digits, 16).ok()?
+                }
+                'u' | 'U' => {
+                    let width = if escaped == 'u' { 4 } else { 8 };
+                    let digits: String = chars.by_ref().take(width).collect();
+                    if digits.len() != width {
+                        return None;
+                    }
+                    let ch = char::from_u32(u32::from_str_radix(&digits, 16).ok()?)?;
+                    bytes.extend_from_slice(ch.to_string().as_bytes());
+                    continue;
+                }
+                '0'..='7' => {
+                    let digits = format!("{escaped}{}", chars.by_ref().take(2).collect::<String>());
+                    if digits.len() != 3 {
+                        return None;
+                    }
+                    u8::from_str_radix(&digits, 8).ok()?
+                }
+                _ => return None,
+            };
+            bytes.push(byte);
+        } else {
+            if ch == '\n' && quote == '"' {
+                return None;
+            }
+            bytes.extend_from_slice(ch.to_string().as_bytes());
+        }
+    }
+    None
+}

crates/ide-core/src/lib.rs

@@ -7,6 +7,7 @@
 pub mod editor_settings;
 pub mod error;
 pub mod event;
+pub mod go;
 pub mod ids;
 pub mod ignored;
 pub mod inspection_settings;

crates/ide-core/src/process.rs

@@ -299,9 +299,11 @@ fn appimage_fixes() -> Vec<(OsString, Option<OsString>)> {
 const APPIMAGE_LAUNCH_VARS: [&str; 4] = ["APPDIR", "APPIMAGE", "ARGV0", "OWD"];
 
 /// What to change in `vars` (an environment) so a child sees the host's environment rather
-/// than the AppImage's: every `:`-separated entry inside `$APPDIR` is dropped (a saved
-/// `<NAME>_ORIG` wins when present), variables left empty are removed, and so are the
-/// runtime's own launch variables. Nothing changes when `APPDIR` is not set.
+/// than the AppImage's: every `:`-separated entry inside `$APPDIR` — or inside *any*
+/// AppImage mount, since an in-app update restart inherits the previous mount's entries
+/// alongside the new one — is dropped (a saved `<NAME>_ORIG` wins when present),
+/// variables left empty are removed, and so are the runtime's own launch variables.
+/// Nothing changes when `APPDIR` is not set.
 fn appimage_env_fixes(vars: &[(OsString, OsString)]) -> Vec<(OsString, Option<OsString>)> {
     let get = |name: &str| vars.iter().find(|(k, _)| k == name).map(|(_, v)| v);
     let Some(appdir) =
@@ -309,7 +311,12 @@ fn appimage_env_fixes(vars: &[(OsString, OsString)]) -> Vec<(OsString, Option<Os
     else {
         return Vec::new();
     };
-    let inside = |entry: &str| entry.strip_prefix(appdir).is_some_and(|rest| rest.is_empty() || rest.starts_with('/'));
+    let inside = |entry: &str| {
+        let own = entry.strip_prefix(appdir).is_some_and(|rest| rest.is_empty() || rest.starts_with('/'));
+        // AppImages extract to `/tmp/.mount_<name>`; an entry under another mount is
+        // another image's (e.g. the pre-update one a restart inherited), never the host's.
+        own || entry.starts_with("/tmp/.mount_")
+    };
     let mut fixes = Vec::new();
     for (key, value) in vars {
         let (Some(name), Some(value)) = (key.to_str(), value.to_str()) else { continue };
@@ -715,7 +722,7 @@ mod tests {
             ("PATH", "/tmp/.mount_OpenIDabc/usr/bin/:/tmp/.mount_OpenIDabc/usr/sbin/:/usr/local/bin:/usr/bin"),
             ("XDG_DATA_DIRS", "/tmp/.mount_OpenIDabc/usr/share:/usr/share:/usr/local/share:/usr/share"),
             ("HOME", "/home/me"),
-            ("JAVA_HOME", "/tmp/.mount_OpenIDabcdef/jdk"),
+            ("JAVA_HOME", "/opt/jdk"),
         ]);
         assert_eq!(
             got,
@@ -728,6 +735,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn entries_of_a_previous_updates_mount_are_dropped() {
+        // An in-app update restart inherits the old mount's entries: a child's curl
+        // must not load the old image's libraries (they can still be mounted).
+        let got = fixes(&[
+            ("APPDIR", "/tmp/.mount_OpenIDjIlFFA"),
+            ("LD_LIBRARY_PATH", "/tmp/.mount_OpenIDjIlFFA/usr/lib/:/tmp/.mount_OpenIDdaNGfM/usr/lib/:/usr/local/lib"),
+            ("PATH", "/tmp/.mount_OpenIDjIlFFA/usr/bin/:/tmp/.mount_OpenIDdaNGfM/usr/bin/:/usr/bin"),
+            ("GIO_MODULE_DIR", "/tmp/.mount_OpenIDdaNGfM/usr/lib/gio/modules"),
+        ]);
+        assert_eq!(
+            got,
+            [
+                fix("APPDIR", None),
+                fix("LD_LIBRARY_PATH", Some("/usr/local/lib")),
+                fix("PATH", Some("/usr/bin")),
+                fix("GIO_MODULE_DIR", None),
+            ]
+        );
+    }
+
     #[test]
     fn variables_left_empty_are_removed() {
         // AppRun prepends to an unset variable, leaving a trailing `:`; hooks set single paths.

crates/ide-core/src/project_roots.rs

@@ -1,5 +1,6 @@
 //! Shared filesystem rules for discovering builds and resolving their owners.
 
+use std::collections::HashSet;
 use std::path::{Component, Path, PathBuf};
 
 pub const SEARCH_DEPTH: usize = 3;
@@ -35,10 +36,23 @@ pub fn discover_matching(
     max_depth: usize,
     stop_at_match: bool,
     marked: impl Fn(&Path) -> bool,
+) -> Vec<PathBuf> {
+    discover_matching_cancellable(root, max_depth, stop_at_match, &crate::CancellationToken::new(), marked)
+}
+
+pub fn discover_matching_cancellable(
+    root: &Path,
+    max_depth: usize,
+    stop_at_match: bool,
+    cancel: &crate::CancellationToken,
+    marked: impl Fn(&Path) -> bool,
 ) -> Vec<PathBuf> {
     let mut found = Vec::new();
     let mut pending = vec![(root.to_path_buf(), 0)];
     while let Some((dir, depth)) = pending.pop() {
+        if cancel.is_cancelled() {
+            break;
+        }
         if marked(&dir) {
             found.push(dir.clone());
             if stop_at_match {
@@ -66,6 +80,70 @@ pub fn discover_matching(
     found
 }
 
+/// Expands workspace member patterns one level deep: `dir`, `dir/*`, `dir/**`.
+pub fn expand_members(root: &Path, patterns: &[String], marker: &str) -> Vec<PathBuf> {
+    let mut dirs = Vec::new();
+    for pattern in patterns {
+        let pattern = pattern.trim().trim_start_matches("./").trim_end_matches('/');
+        if pattern.is_empty() || pattern.starts_with('!') {
+            continue;
+        }
+        let base = pattern.strip_suffix("/**").or_else(|| pattern.strip_suffix("/*"));
+        match base {
+            Some(base) if !base.contains('*') => {
+                dirs.extend(children(&root.join(base)).into_iter().filter(|d| d.join(marker).is_file()))
+            }
+            None if !pattern.contains('*') => {
+                let dir = root.join(pattern);
+                if dir.join(marker).is_file() {
+                    dirs.push(dir);
+                }
+            }
+            _ => {}
+        }
+    }
+    let mut seen = HashSet::new();
+    dirs.retain(|d| seen.insert(d.clone()));
+    dirs
+}
+
+pub fn node_workspace_members(root: &Path) -> Vec<PathBuf> {
+    let package = std::fs::read(root.join("package.json"))
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<serde_json::Value>(&bytes).ok())
+        .unwrap_or_default();
+    expand_members(root, &node_workspace_patterns(root, &package), "package.json")
+}
+
+fn node_workspace_patterns(root: &Path, pkg: &serde_json::Value) -> Vec<String> {
+    let mut patterns: Vec<String> = Vec::new();
+    let ws = pkg.get("workspaces");
+    let list = ws
+        .and_then(serde_json::Value::as_array)
+        .or_else(|| ws.and_then(|w| w.get("packages")).and_then(serde_json::Value::as_array));
+    if let Some(list) = list {
+        patterns.extend(list.iter().filter_map(serde_json::Value::as_str).map(str::to_owned));
+    }
+    if let Ok(yaml) = std::fs::read_to_string(root.join("pnpm-workspace.yaml")) {
+        let mut in_packages = false;
+        for line in yaml.lines() {
+            let trimmed = line.trim();
+            if trimmed.is_empty() || trimmed.starts_with('#') {
+                continue;
+            }
+            if !line.starts_with([' ', '\t', '-']) {
+                in_packages = trimmed.starts_with("packages:");
+                continue;
+            }
+            if in_packages && let Some(item) = trimmed.strip_prefix('-') {
+                let item = item.split(" #").next().unwrap_or_default().trim().trim_matches(['"', '\'']);
+                patterns.push(item.to_owned());
+            }
+        }
+    }
+    patterns
+}
+
 /// The closest package manager declaration or lockfile, shared by build and run.
 pub fn package_manager(root: &Path) -> &'static str {
     for dir in root.ancestors() {

crates/ide-core/src/settings.rs

@@ -850,6 +850,8 @@ pub struct JavaSettings {
     /// Project JDK home; empty = per module, the installed JDK matching the
     /// Java version it targets.
     pub jdk: String,
+    /// Project Java language level (`8`, `11`, `17`, `21`, `25`); empty = SDK default.
+    pub language_level: String,
     /// JDK home the Java language server (jdtls) runs on, apart from the project
     /// JDK (IDEA's "JDK for importer"); empty = the project JDK when new enough,
     /// else the first installed one that is.
@@ -903,6 +905,8 @@ pub enum GradleDistribution {
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
 pub struct MavenSettings {
+    /// JDK home used to run Maven; empty = Project JDK, else the POM's Java version.
+    pub runner_jre: String,
     /// Project-relative root POMs removed from the Maven project model.
     pub unlinked_projects: Vec<String>,
     /// Project-relative POMs outside the root reactor added as independent top-level projects.
@@ -953,6 +957,98 @@ impl Default for TypeScriptSettings {
     }
 }
 
+/// Dependency scope for a module dependency or project library (IDEA's Modules › Dependencies).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub enum DependencyScope {
+    #[default]
+    Compile,
+    Test,
+    Runtime,
+    Provided,
+}
+
+/// A project-level library (Project Structure › Libraries).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ProjectLibrary {
+    pub name: String,
+    /// Class archives (`.jar`) or class directories.
+    pub classes: Vec<String>,
+    /// Source archives (`-sources.jar`, `.zip`) or source directories.
+    pub sources: Vec<String>,
+    /// Documentation archives (`-javadoc.jar`) or directories.
+    pub javadocs: Vec<String>,
+    pub scope: DependencyScope,
+}
+
+/// Dependency entry of a module (Project Structure › Modules › Dependencies).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ModuleDependency {
+    /// `"library"` (references a `ProjectLibrary` by name or path) or `"module"` (references another module).
+    pub kind: String,
+    pub target: String,
+    pub scope: DependencyScope,
+    pub exported: bool,
+}
+
+/// Per-module Project Structure overrides (SDK, language level, output paths, dependencies).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ModuleStructureSettings {
+    /// Module SDK home override; empty = inherit Project SDK.
+    pub jdk: String,
+    /// Module language level override; empty = inherit Project language level.
+    pub language_level: String,
+    /// Module compiler output directory override; empty = inherit Project compiler output.
+    pub compiler_output: String,
+    /// Module test compiler output directory override; empty = default.
+    pub test_compiler_output: String,
+    /// Additional module dependencies.
+    pub dependencies: Vec<ModuleDependency>,
+}
+
+/// Framework facet attached to a module (Project Structure › Facets).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct FacetConfig {
+    /// `"web"` | `"spring"` | `"jpa"`.
+    pub kind: String,
+    /// Module relative path (`"."` for root module).
+    pub module: String,
+    /// Deployment descriptor path (e.g. `src/main/webapp/WEB-INF/web.xml`, `src/main/resources/META-INF/persistence.xml`).
+    pub descriptor: String,
+    /// Web resource root directory for Web facets (e.g. `src/main/webapp`).
+    pub web_root: String,
+}
+
+/// Packaging type of a Project Structure artifact.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub enum ArtifactKind {
+    #[default]
+    Jar,
+    War,
+    WarExploded,
+}
+
+/// Packaging artifact definition (Project Structure › Artifacts).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ArtifactConfig {
+    pub name: String,
+    pub kind: ArtifactKind,
+    /// Module relative path (`"."` for root module).
+    pub module: String,
+    /// Output directory (relative to project root or absolute).
+    pub output_directory: String,
+    /// Main class for executable JAR artifacts.
+    pub main_class: String,
+    /// Project library names included in the packaged artifact (`WEB-INF/lib` or JAR manifest).
+    pub include_libraries: Vec<String>,
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
 pub struct ProjectStructureSettings {
@@ -969,9 +1065,28 @@ pub struct ProjectStructureSettings {
     pub content_roots: Vec<String>,
     /// "Exclude files": `;`-separated name patterns (`*.log;tmp*`) excluded at any depth.
     pub exclude_files: String,
+    /// Project compiler output directory (relative to project root or absolute; empty = default).
+    pub compiler_output: String,
+    /// Per-module SDK, language level, output paths and dependency overrides, keyed by module relative path (`"."` for root).
+    pub modules: BTreeMap<String, ModuleStructureSettings>,
+    /// Project-level libraries (`JAR`s / class folders / source archives).
+    pub libraries: Vec<ProjectLibrary>,
+    /// Module framework facets (`web`, `spring`, `jpa`).
+    pub facets: Vec<FacetConfig>,
+    /// Packaging artifacts (`jar`, `war`, `warExploded`).
+    pub artifacts: Vec<ArtifactConfig>,
 }
 
 impl ProjectStructureSettings {
+    /// Overrides belong to the module's full path, never just its directory name.
+    pub fn module_settings(
+        &self,
+        root: &std::path::Path,
+        module: &std::path::Path,
+    ) -> Option<&ModuleStructureSettings> {
+        self.modules.iter().find_map(|(key, settings)| (root.join(key) == module).then_some(settings))
+    }
+
     /// The "Exclude files" name patterns.
     pub fn exclude_file_patterns(&self) -> Vec<String> {
         self.exclude_files.split(';').map(str::trim).filter(|p| !p.is_empty()).map(str::to_owned).collect()
@@ -1152,12 +1267,81 @@ mod tests {
         assert_eq!(s.file_excludes(), vec!["*.log", "tmp*"]);
         assert!(Settings::default().files.file_types.is_empty());
     }
+
+    #[test]
+    fn project_structure_modules_libraries_facets_and_artifacts_round_trip() {
+        let old: Settings = serde_json::from_str(r#"{"projectStructure":{"sourceRoots":["src"]}}"#).unwrap();
+        assert!(old.project_structure.compiler_output.is_empty());
+        assert!(old.project_structure.modules.is_empty());
+        assert!(old.project_structure.libraries.is_empty());
+        assert!(old.project_structure.facets.is_empty());
+        assert!(old.project_structure.artifacts.is_empty());
+        assert!(old.languages.java.language_level.is_empty());
+
+        let mut settings = Settings::default();
+        settings.languages.java.language_level = "21".into();
+        settings.project_structure.compiler_output = "out/production".into();
+        settings.project_structure.modules.insert(
+            "backend".into(),
+            ModuleStructureSettings {
+                jdk: "/opt/jdk-21".into(),
+                language_level: "21".into(),
+                compiler_output: "backend/target/classes".into(),
+                test_compiler_output: "backend/target/test-classes".into(),
+                dependencies: vec![ModuleDependency {
+                    kind: "library".into(),
+                    target: "custom-lib".into(),
+                    scope: DependencyScope::Compile,
+                    exported: true,
+                }],
+            },
+        );
+        settings.project_structure.libraries.push(ProjectLibrary {
+            name: "custom-lib".into(),
+            classes: vec!["lib/custom.jar".into()],
+            sources: vec!["lib/custom-sources.jar".into()],
+            javadocs: Vec::new(),
+            scope: DependencyScope::Compile,
+        });
+        settings.project_structure.facets.push(FacetConfig {
+            kind: "web".into(),
+            module: "backend".into(),
+            descriptor: "src/main/webapp/WEB-INF/web.xml".into(),
+            web_root: "src/main/webapp".into(),
+        });
+        settings.project_structure.artifacts.push(ArtifactConfig {
+            name: "backend:war exploded".into(),
+            kind: ArtifactKind::WarExploded,
+            module: "backend".into(),
+            output_directory: "out/artifacts/backend_war_exploded".into(),
+            main_class: String::new(),
+            include_libraries: vec!["custom-lib".into()],
+        });
+
+        let value = serde_json::to_value(&settings).unwrap();
+        assert_eq!(value["languages"]["java"]["languageLevel"], "21");
+        assert_eq!(value["projectStructure"]["compilerOutput"], "out/production");
+        assert_eq!(value["projectStructure"]["artifacts"][0]["kind"], "warExploded");
+        let restored: Settings = serde_json::from_value(value).unwrap();
+        assert_eq!(restored, settings);
+    }
 }
 
 #[cfg(test)]
 mod maven_linkage_tests {
     use super::*;
 
+    #[test]
+    fn maven_runner_jre_defaults_and_round_trips() {
+        let old: MavenSettings = serde_json::from_str(r#"{"home":"/opt/maven"}"#).unwrap();
+        assert!(old.runner_jre.is_empty());
+        assert!(MavenSettings::default().runner_jre.is_empty());
+        let settings = MavenSettings { runner_jre: "/opt/jdk-21".into(), ..old };
+        let encoded = serde_json::to_string(&settings).unwrap();
+        assert!(encoded.contains(r#""runnerJre":"/opt/jdk-21""#));
+        assert_eq!(serde_json::from_str::<MavenSettings>(&encoded).unwrap(), settings);
+    }
+
     #[test]
     fn maven_linkage_defaults_and_round_trips() {
         let old: MavenSettings = serde_json::from_str(r#"{"home":"/opt/maven"}"#).unwrap();

crates/ide-core/src/workflow_settings.rs

@@ -113,6 +113,8 @@ pub struct CommitSettings {
     pub body_limit: u32,
     pub show_right_margin: bool,
     pub wrap_at_margin: bool,
+    /// Plugin before-commit checks turned off (`<plugin id>/<check id>`); the rest run.
+    pub disabled_plugin_checks: Vec<String>,
 }
 
 impl Default for CommitSettings {
@@ -132,6 +134,7 @@ impl Default for CommitSettings {
             body_limit: 72,
             show_right_margin: true,
             wrap_at_margin: false,
+            disabled_plugin_checks: Vec::new(),
         }
     }
 }

crates/ide-db/src/conn.rs

@@ -12,14 +12,17 @@ use ide_core::{CancellationToken, IdeError, IdeResult, error::ErrorKind};
 use serde::{Deserialize, Serialize};
 use specta::Type;
 use sqlx::{
-    Column, ColumnIndex, Connection, Decode, Executor, MySql, Postgres, Row, SqlSafeStr, Sqlite, TypeInfo, ValueRef,
-    mysql::{MySqlConnectOptions, MySqlPool, MySqlPoolOptions, MySqlSslMode},
+    Column, ColumnIndex, Connection, Decode, Executor, Row, SqlSafeStr, Sqlite, TypeInfo, ValueRef,
+    mysql::{MySqlConnectOptions, MySqlConnection, MySqlSslMode},
     pool::PoolConnection,
-    postgres::{PgConnectOptions, PgPool, PgPoolOptions, PgSslMode},
+    postgres::{PgConnectOptions, PgConnection, PgSslMode},
     sqlite::{SqliteConnectOptions, SqlitePool, SqlitePoolOptions},
 };
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, Ordering},
+};
 use std::time::{Duration, Instant};
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Type)]
@@ -47,12 +50,135 @@ pub struct QueryResult {
     pub execution_ms: f64,
 }
 
+/// Session context belongs to the physical connection, including across pool checkouts.
+#[derive(Debug, Clone)]
+pub struct Context {
+    default: Option<String>,
+    current: Option<String>,
+    known: bool,
+}
+
+impl Context {
+    pub(crate) fn new(default: Option<String>) -> Self {
+        Self { current: default.clone(), default, known: true }
+    }
+
+    pub(crate) fn set_current(&mut self, current: Option<String>) {
+        self.current = current;
+    }
+
+    fn wanted(&self, driver: DbDriver, schema: Option<&str>) -> Option<String> {
+        schema
+            .filter(|s| !s.is_empty())
+            .and_then(|s| crate::sql::use_schema(driver, s))
+            .or_else(|| self.default.clone())
+    }
+}
+
+macro_rules! sqlx_pool {
+    ($manager:ident, $handle:ident, $options:ty, $connection:ty, $driver:expr, $query:expr) => {
+        pub struct $manager {
+            options: $options,
+            init: Arc<Vec<String>>,
+            timeout: Duration,
+        }
+
+        pub struct $handle {
+            conn: Option<$connection>,
+            context: Context,
+            options: $options,
+            init: Arc<Vec<String>>,
+            timeout: Duration,
+            in_transaction: bool,
+        }
+
+        impl std::ops::Deref for $handle {
+            type Target = $connection;
+            fn deref(&self) -> &Self::Target {
+                self.conn.as_ref().expect("live connection")
+            }
+        }
+
+        impl std::ops::DerefMut for $handle {
+            fn deref_mut(&mut self) -> &mut Self::Target {
+                self.conn.as_mut().expect("live connection")
+            }
+        }
+
+        impl ManageConnection for $manager {
+            type Connection = $handle;
+            type Error = sqlx::Error;
+
+            async fn connect(&self) -> Result<Self::Connection, Self::Error> {
+                tokio::time::timeout(self.timeout, async {
+                    let mut conn = <$connection>::connect_with(&self.options).await?;
+                    let context_sql = |value: Option<String>| {
+                        value.map(|v| {
+                            if $driver == DbDriver::Postgres {
+                                format!("SET search_path TO {v}")
+                            } else {
+                                crate::sql::use_schema($driver, &v).expect("switchable driver")
+                            }
+                        })
+                    };
+                    for sql in self.init.iter() {
+                        sqlx::raw_sql(sqlx::AssertSqlSafe(sql.clone())).execute(&mut conn).await?;
+                    }
+                    let row = sqlx::raw_sql(sqlx::AssertSqlSafe($query.to_owned())).fetch_one(&mut conn).await?;
+                    let context = Context::new(context_sql(row.try_get(0)?));
+                    Ok($handle {
+                        conn: Some(conn),
+                        context,
+                        options: self.options.clone(),
+                        init: self.init.clone(),
+                        timeout: self.timeout,
+                        in_transaction: false,
+                    })
+                })
+                .await
+                .map_err(|_| sqlx::Error::PoolTimedOut)?
+            }
+
+            async fn is_valid(&self, conn: &mut Self::Connection) -> Result<(), Self::Error> {
+                conn.ping().await
+            }
+
+            fn has_broken(&self, conn: &mut Self::Connection) -> bool {
+                conn.conn.is_none()
+            }
+        }
+    };
+}
+
+sqlx_pool!(PgManager, PgHandle, PgConnectOptions, PgConnection, DbDriver::Postgres, "SHOW search_path");
+sqlx_pool!(MysqlManager, MysqlHandle, MySqlConnectOptions, MySqlConnection, DbDriver::Mysql, "SELECT DATABASE()");
+
+pub struct ServerPool<M: ManageConnection> {
+    inner: Bb8Pool<M>,
+    closed: AtomicBool,
+}
+
+impl<M: ManageConnection> ServerPool<M> {
+    async fn get(&self) -> IdeResult<bb8::PooledConnection<'static, M>>
+    where
+        M::Error: std::fmt::Display,
+    {
+        if self.closed.load(Ordering::Relaxed) {
+            return Err(IdeError::new(ErrorKind::Io, "database connection is closed"));
+        }
+        self.inner.get_owned().await.map_err(|e| match e {
+            bb8::RunError::User(e) => IdeError::new(ErrorKind::Io, e.to_string()),
+            bb8::RunError::TimedOut => IdeError::new(ErrorKind::Io, "timed out connecting to the database"),
+        })
+    }
+}
+
 // Keep an empty slot when a connection is discarded after cancellation or rollback failure.
 pub struct MssqlConnectionManager(tiberius::Config);
 
 type MssqlClient = tiberius::Client<tokio_util::compat::Compat<tokio::net::TcpStream>>;
 
-pub struct MssqlConnection(Option<MssqlClient>);
+pub struct MssqlConnection(Option<MssqlClient>, Context);
 
 impl std::ops::Deref for MssqlConnection {
     type Target = MssqlClient;
@@ -76,7 +202,7 @@ impl ManageConnection for MssqlConnectionManager {
 
         let tcp = tokio::net::TcpStream::connect(self.0.get_addr()).await?;
         tcp.set_nodelay(true)?;
-        let client = match MssqlClient::connect(self.0.clone(), tcp.compat_write()).await {
+        let mut client = match MssqlClient::connect(self.0.clone(), tcp.compat_write()).await {
             // Preserve the single redirect supported by the previous pool adapter.
             Err(tiberius::error::Error::Routing { host, port }) => {
                 let mut config = self.0.clone();
@@ -88,7 +214,11 @@ impl ManageConnection for MssqlConnectionManager {
             }
             result => result?,
         };
-        Ok(MssqlConnection(Some(client)))
+        let row = client.simple_query("SELECT DB_NAME()").await?.into_row().await?;
+        let default = row
+            .and_then(|r| r.get::<&str, _>(0).map(str::to_owned))
+            .and_then(|db| crate::sql::use_schema(DbDriver::SqlServer, &db));
+        Ok(MssqlConnection(Some(client), Context::new(default)))
     }
 
     async fn is_valid(&self, conn: &mut Self::Connection) -> Result<(), Self::Error> {
@@ -103,25 +233,13 @@ impl ManageConnection for MssqlConnectionManager {
 
 pub enum Pool {
     Sqlite(SqlitePool),
-    Postgres(PgPool),
-    Mysql(MySqlPool),
+    Postgres(ServerPool<PgManager>),
+    Mysql(ServerPool<MysqlManager>),
     SqlServer(Bb8Pool<MssqlConnectionManager>),
     Clickhouse(crate::clickhouse::ClickhousePool),
     Oracle(crate::oracle::OraclePool),
 }
 
-/// Runs `$body` with `$p` bound to the concrete pool of each driver.
-macro_rules! with_pool {
-    ($pool:expr, $p:ident => $body:expr) => {
-        match $pool {
-            Pool::Sqlite($p) => $body,
-            Pool::Postgres($p) => $body,
-            Pool::Mysql($p) => $body,
-            Pool::SqlServer(_) | Pool::Clickhouse(_) | Pool::Oracle(_) => unreachable!(),
-        }
-    };
-}
-
 pub(crate) fn db_err(e: sqlx::Error) -> IdeError {
     match &e {
         sqlx::Error::Database(d) => {
@@ -438,6 +556,19 @@ macro_rules! backend_id {
     }};
 }
 
+// Session control, scripts and PostgreSQL set_config can invalidate the tracked context.
+fn context_may_change(sql: &str) -> bool {
+    let text = sql.trim().trim_end_matches(';');
+    text.contains(';')
+        || text.to_ascii_lowercase().contains("set_config")
+        || !text.split_whitespace().next().is_some_and(|s| {
+            matches!(
+                s.to_ascii_uppercase().as_str(),
+                "SELECT" | "INSERT" | "UPDATE" | "DELETE" | "CREATE" | "DROP" | "TRUNCATE" | "SHOW" | "EXPLAIN"
+            )
+        })
+}
+
 fn looks_like_query(sql: &str) -> bool {
     let first = sql
         .lines()
@@ -535,7 +666,13 @@ impl Setup {
                     return Err(IdeError::invalid("ClickHouse HTTP does not support statement caching"));
                 }
                 (_, "statement_cache_capacity") => s.statement_cache = Some(number(&name)? as usize),
-                (_, "connect_timeout") => s.connect_timeout = Some(Duration::from_secs(number(&name)?)),
+                (_, "connect_timeout") => {
+                    let seconds = number(&name)?;
+                    if seconds == 0 {
+                        return Err(IdeError::invalid("connect_timeout must be greater than zero"));
+                    }
+                    s.connect_timeout = Some(Duration::from_secs(seconds));
+                }
                 (DbDriver::Postgres, "application_name") => s.application_name = Some(value.to_owned()),
                 (DbDriver::Mysql, "charset") => s.charset = Some(value.to_owned()),
                 (DbDriver::Mysql, "collation") => s.collation = Some(value.to_owned()),
@@ -662,14 +799,12 @@ impl Pool {
                 if let Some(n) = setup.statement_cache {
                     opts = opts.statement_cache_capacity(n);
                 }
-                let pool = PgPoolOptions::new()
-                    .max_connections(MAX)
-                    .acquire_timeout(timeout)
-                    .after_connect(after_connect!())
-                    .connect_with(opts)
-                    .await
-                    .map_err(db_err)?;
-                Ok(Pool::Postgres(pool))
+                let manager = PgManager { options: opts, init: init.clone(), timeout };
+                // Open once directly so authentication failures retain their database error.
+                let first = manager.connect().await.map_err(db_err)?;
+                let pool = Bb8Pool::builder().max_size(MAX).connection_timeout(timeout).build_unchecked(manager);
+                let _ = pool.add(first);
+                Ok(Pool::Postgres(ServerPool { inner: pool, closed: AtomicBool::new(false) }))
             }
             DbDriver::Mysql => {
                 let mut opts = MySqlConnectOptions::new()
@@ -711,14 +846,12 @@ impl Pool {
                 if !tz.is_empty() {
                     opts = opts.timezone(Some(tz.to_owned()));
                 }
-                let pool = MySqlPoolOptions::new()
-                    .max_connections(MAX)
-                    .acquire_timeout(timeout)
-                    .after_connect(after_connect!())
-                    .connect_with(opts)
-                    .await
-                    .map_err(db_err)?;
-                Ok(Pool::Mysql(pool))
+                let manager = MysqlManager { options: opts, init: init.clone(), timeout };
+                // Open once directly so authentication failures retain their database error.
+                let first = manager.connect().await.map_err(db_err)?;
+                let pool = Bb8Pool::builder().max_size(MAX).connection_timeout(timeout).build_unchecked(manager);
+                let _ = pool.add(first);
+                Ok(Pool::Mysql(ServerPool { inner: pool, closed: AtomicBool::new(false) }))
             }
             DbDriver::SqlServer => {
                 use tiberius::Config;
@@ -757,7 +890,9 @@ impl Pool {
         match self {
             Pool::SqlServer(_) | Pool::Oracle(_) => {}
             Pool::Clickhouse(p) => p.close(),
-            _ => with_pool!(self, p => p.close().await),
+            Pool::Sqlite(p) => p.close().await,
+            Pool::Postgres(p) => p.closed.store(true, Ordering::Relaxed),
+            Pool::Mysql(p) => p.closed.store(true, Ordering::Relaxed),
         }
     }
 
@@ -766,7 +901,9 @@ impl Pool {
             Pool::SqlServer(_) => false,
             Pool::Oracle(p) => p.is_closed(),
             Pool::Clickhouse(p) => p.is_closed(),
-            _ => with_pool!(self, p => p.is_closed()),
+            Pool::Sqlite(p) => p.is_closed(),
+            Pool::Postgres(p) => p.closed.load(Ordering::Relaxed),
+            Pool::Mysql(p) => p.closed.load(Ordering::Relaxed),
         }
     }
 
@@ -775,18 +912,9 @@ impl Pool {
         if let Pool::Clickhouse(p) = self {
             return Ok(p.execute(sql, max, &CancellationToken::new()).await?.rows);
         }
-        if let Pool::Oracle(p) = self {
-            let mut conn = p.get().await?;
-            let fetched = crate::oracle::run(&mut conn, sql, 0, max, Cells::Text, &CancellationToken::new()).await?;
-            return Ok(fetched.1);
-        }
-        let fetched: IdeResult<Fetched> = match self {
-            Pool::SqlServer(p) => {
-                let mut conn = p.get_owned().await.map_err(mssql_pool_err)?;
-                mssql_fetch(&mut conn, sql, 0, max).await
-            }
-            _ => with_pool!(self, p => fetch!(p, sql, max, Cells::Text)),
-        };
+        let mut conn = Held::acquire(self).await?;
+        conn.apply_context(None).await?;
+        let fetched = conn.fetch_rows(sql, max).await;
         Ok(fetched?.1)
     }
 
@@ -809,7 +937,10 @@ impl Pool {
             return p.execute_from(sql, skip, max_rows, cancel).await;
         }
         let mut conn = Held::acquire(self).await?;
-        let r = conn.execute_from(self, sql, skip, max_rows, cancel).await;
+        let r = match conn.apply_context(None).await {
+            Ok(()) => conn.execute_from(self, sql, skip, max_rows, cancel).await,
+            Err(e) => Err(e),
+        };
         if cancel.is_cancelled() {
             conn.discard().await;
             return Err(IdeError::cancelled());
@@ -822,8 +953,10 @@ impl Pool {
     pub async fn transaction(&self, statements: &[(String, bool)]) -> IdeResult<u64> {
         match self {
             Pool::Clickhouse(_) => Err(crate::clickhouse::transaction_error()),
-            Pool::SqlServer(p) => {
-                let mut conn = p.get_owned().await.map_err(mssql_pool_err)?;
+            Pool::SqlServer(_) => {
+                let mut held = Held::acquire(self).await?;
+                held.apply_context(None).await?;
+                let Held::SqlServer(mut conn) = held else { unreachable!() };
                 let result = async {
                     mssql_command(&mut conn, "BEGIN TRAN").await?;
                     let mut total = 0;
@@ -846,8 +979,10 @@ impl Pool {
                 }
                 result
             }
-            Pool::Oracle(p) => {
-                let mut conn = p.get().await?;
+            Pool::Oracle(_) => {
+                let mut held = Held::acquire(self).await?;
+                held.apply_context(None).await?;
+                let Held::Oracle(mut conn) = held else { unreachable!() };
                 let result = crate::oracle::transaction(&mut conn, statements).await;
                 if result.is_err() {
                     // An open transaction must never return to the pool with the connection.
@@ -855,21 +990,37 @@ impl Pool {
                 }
                 result
             }
-            _ => with_pool!(self, p => {
-                let mut tx = p.begin().await.map_err(db_err)?;
-                let mut total = 0;
-                for (sql, expect_one) in statements {
-                    let done = sqlx::raw_sql(sqlx::AssertSqlSafe(sql.clone())).execute(&mut *tx).await.map_err(db_err)?;
-                    let n = done.rows_affected();
-                    // MySQL reports 0 for an UPDATE that leaves the row unchanged.
-                    if *expect_one && (n > 1 || (n == 0 && !matches!(self, Pool::Mysql(_)))) {
-                        return Err(IdeError::invalid(format!("{sql}: expected to change 1 row, changed {n}; nothing was saved")));
-                    }
-                    total += n;
+            _ => {
+                let mut conn = Held::acquire(self).await?;
+                conn.apply_context(None).await?;
+                macro_rules! transaction {
+                    ($c:expr) => {{
+                        let mut tx = (&mut **$c).begin().await.map_err(db_err)?;
+                        let mut total = 0;
+                        for (sql, expect_one) in statements {
+                            let done = sqlx::raw_sql(sqlx::AssertSqlSafe(sql.clone()))
+                                .execute(&mut *tx)
+                                .await
+                                .map_err(db_err)?;
+                            let n = done.rows_affected();
+                            if *expect_one && (n > 1 || (n == 0 && !matches!(self, Pool::Mysql(_)))) {
+                                return Err(IdeError::invalid(format!(
+                                    "{sql}: expected to change 1 row, changed {n}; nothing was saved"
+                                )));
+                            }
+                            total += n;
+                        }
+                        tx.commit().await.map_err(db_err)?;
+                        Ok(total)
+                    }};
                 }
-                tx.commit().await.map_err(db_err)?;
-                Ok(total)
-            }),
+                match &mut conn {
+                    Held::Sqlite(c) => transaction!(c),
+                    Held::Postgres(c) => transaction!(&mut ***c),
+                    Held::Mysql(c) => transaction!(&mut ***c),
+                    _ => unreachable!(),
+                }
+            }
         }
     }
 }
@@ -878,8 +1029,8 @@ impl Pool {
 /// manual-commit console across statements with its transaction open.
 pub enum Held {
     Sqlite(PoolConnection<Sqlite>),
-    Postgres(PoolConnection<Postgres>),
-    Mysql(PoolConnection<MySql>),
+    Postgres(Box<bb8::PooledConnection<'static, PgManager>>),
+    Mysql(Box<bb8::PooledConnection<'static, MysqlManager>>),
     SqlServer(Box<bb8::PooledConnection<'static, MssqlConnectionManager>>),
     Clickhouse(crate::clickhouse::ClickhousePool),
     Oracle(crate::oracle::OracleConnection),
@@ -889,8 +1040,8 @@ impl Held {
     pub async fn acquire(pool: &Pool) -> IdeResult<Self> {
         Ok(match pool {
             Pool::Sqlite(p) => Held::Sqlite(p.acquire().await.map_err(db_err)?),
-            Pool::Postgres(p) => Held::Postgres(p.acquire().await.map_err(db_err)?),
-            Pool::Mysql(p) => Held::Mysql(p.acquire().await.map_err(db_err)?),
+            Pool::Postgres(p) => Held::Postgres(Box::new(p.get().await?)),
+            Pool::Mysql(p) => Held::Mysql(Box::new(p.get().await?)),
             Pool::SqlServer(p) => Held::SqlServer(Box::new(p.get_owned().await.map_err(mssql_pool_err)?)),
             Pool::Clickhouse(p) => {
                 if p.is_closed() {
@@ -902,8 +1053,121 @@ impl Held {
         })
     }
 
+    fn context(&mut self) -> Option<&mut Context> {
+        match self {
+            Held::Postgres(c) => Some(&mut c.context),
+            Held::Mysql(c) => Some(&mut c.context),
+            Held::SqlServer(c) => Some(&mut c.1),
+            Held::Oracle(c) => Some(c.context()),
+            _ => None,
+        }
+    }
+
+    fn invalidate_context(&mut self) {
+        if let Some(context) = self.context() {
+            context.known = false;
+        }
+    }
+
+    fn before_statement(&mut self, sql: &str) {
+        let control = sql.trim().trim_end_matches(';').trim().to_ascii_uppercase();
+        if let Held::Mysql(c) = self {
+            if matches!(control.as_str(), "BEGIN" | "START TRANSACTION") {
+                c.in_transaction = true;
+                return;
+            }
+            if matches!(control.as_str(), "COMMIT" | "ROLLBACK") {
+                return;
+            }
+        }
+        if context_may_change(sql) {
+            self.invalidate_context();
+        }
+    }
+
+    fn after_statement(&mut self, sql: &str) {
+        if let Held::Mysql(c) = self
+            && matches!(sql.trim().trim_end_matches(';').trim().to_ascii_uppercase().as_str(), "COMMIT" | "ROLLBACK")
+        {
+            c.in_transaction = false;
+        }
+    }
+
+    pub async fn apply_context(&mut self, schema: Option<&str>) -> IdeResult<()> {
+        let driver = match self {
+            Held::Postgres(_) => DbDriver::Postgres,
+            Held::Mysql(_) => DbDriver::Mysql,
+            Held::SqlServer(_) => DbDriver::SqlServer,
+            Held::Oracle(_) => DbDriver::Oracle,
+            _ => return Ok(()),
+        };
+        let context = self.context().expect("switchable connection");
+        let wanted = context.wanted(driver, schema);
+        if context.known && context.current == wanted {
+            return Ok(());
+        }
+        context.known = false;
+        if let Some(sql) = &wanted {
+            self.raw_command(sql).await?;
+        } else {
+            // MySQL cannot USE an absent database. Re-open with the original options.
+            macro_rules! reopen {
+                ($c:expr, $manager:ident) => {{
+                    let manager = $manager { options: $c.options.clone(), init: $c.init.clone(), timeout: $c.timeout };
+                    if $c.in_transaction {
+                        return Err(IdeError::invalid("commit or roll back before clearing the selected database"));
+                    }
+                    let fresh = manager.connect().await.map_err(db_err)?;
+                    if let Some(raw) = $c.conn.take() {
+                        let _ = raw.close().await;
+                    }
+                    ***$c = fresh;
+                }};
+            }
+            match self {
+                Held::Mysql(c) => reopen!(c, MysqlManager),
+                Held::Postgres(c) => reopen!(c, PgManager),
+                _ => unreachable!("server context has a default"),
+            }
+        }
+        let context = self.context().expect("switchable connection");
+        context.current = wanted;
+        context.known = true;
+        Ok(())
+    }
+
+    /// Restore before a manual session returns its physical connection to the pool.
+    pub async fn restore_default(&mut self) -> IdeResult<()> {
+        self.apply_context(None).await
+    }
+
+    async fn fetch_rows(&mut self, sql: &str, max: usize) -> IdeResult<Fetched> {
+        self.before_statement(sql);
+        let result = match self {
+            Held::Sqlite(c) => fetch!(&mut **c, sql, max, Cells::Text),
+            Held::Postgres(c) => fetch!(&mut ****c, sql, max, Cells::Text),
+            Held::Mysql(c) => fetch!(&mut ****c, sql, max, Cells::Text),
+            Held::SqlServer(c) => mssql_fetch(c, sql, 0, max).await,
+            Held::Oracle(c) => crate::oracle::run(c, sql, 0, max, Cells::Text, &CancellationToken::new()).await,
+            Held::Clickhouse(_) => unreachable!(),
+        };
+        if result.is_ok() {
+            self.after_statement(sql);
+        }
+        result
+    }
+
     /// Runs a statement without results (`BEGIN`, `COMMIT`, `ROLLBACK`).
     pub async fn command(&mut self, sql: &str) -> IdeResult<()> {
+        self.before_statement(sql);
+        let result = self.raw_command(sql).await;
+        if result.is_ok() {
+            self.after_statement(sql);
+        }
+        result
+    }
+
+    async fn raw_command(&mut self, sql: &str) -> IdeResult<()> {
         match self {
             Held::SqlServer(c) => mssql_command(c, sql).await,
             Held::Clickhouse(_) => Err(crate::clickhouse::transaction_error()),
@@ -918,8 +1182,8 @@ impl Held {
                 let sql = sqlx::AssertSqlSafe(sql.to_owned());
                 match other {
                     Held::Sqlite(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
-                    Held::Postgres(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
-                    Held::Mysql(c) => sqlx::raw_sql(sql).execute(&mut **c).await.map(drop),
+                    Held::Postgres(c) => sqlx::raw_sql(sql).execute(&mut ****c).await.map(drop),
+                    Held::Mysql(c) => sqlx::raw_sql(sql).execute(&mut ****c).await.map(drop),
                     Held::SqlServer(_) | Held::Clickhouse(_) | Held::Oracle(_) => unreachable!(),
                 }
                 .map_err(db_err)
@@ -932,11 +1196,15 @@ impl Held {
     pub async fn discard(self) {
         match self {
             Held::Sqlite(c) => drop(c.detach()),
-            Held::Postgres(c) => {
-                let _ = c.detach().close().await;
+            Held::Postgres(mut c) => {
+                if let Some(raw) = c.conn.take() {
+                    let _ = raw.close().await;
+                }
             }
-            Held::Mysql(c) => {
-                let _ = c.detach().close().await;
+            Held::Mysql(mut c) => {
+                if let Some(raw) = c.conn.take() {
+                    let _ = raw.close().await;
+                }
             }
             Held::SqlServer(mut c) => {
                 c.0.take();
@@ -971,6 +1239,7 @@ impl Held {
         if let Held::Clickhouse(c) = self {
             return c.execute_from(sql, skip, max_rows, cancel).await;
         }
+        self.before_statement(sql);
         let started = Instant::now();
         // `$id`: the query naming the server process, `$kill`: how another connection stops it.
         macro_rules! run {
@@ -1003,9 +1272,9 @@ impl Held {
         let fetched: Fetched = match self {
             Held::Sqlite(c) => run!(c, None::<&str>, |_: String| String::new()),
             Held::Postgres(c) => {
-                run!(c, Some("SELECT pg_backend_pid()"), |b: String| format!("SELECT pg_cancel_backend({b})"))
+                run!(&mut ***c, Some("SELECT pg_backend_pid()"), |b: String| format!("SELECT pg_cancel_backend({b})"))
             }
-            Held::Mysql(c) => run!(c, Some("SELECT CONNECTION_ID()"), |b: String| format!("KILL QUERY {b}")),
+            Held::Mysql(c) => run!(&mut ***c, Some("SELECT CONNECTION_ID()"), |b: String| format!("KILL QUERY {b}")),
             Held::SqlServer(c) => {
                 // Tiberius has no attention/cancel API; stop reading and discard the connection.
                 tokio::select! {
@@ -1016,6 +1285,7 @@ impl Held {
             Held::Oracle(c) => crate::oracle::run(c, sql, skip, max_rows, Cells::Display, cancel).await?,
             Held::Clickhouse(_) => unreachable!(),
         };
+        self.after_statement(sql);
         let (columns, rows, affected, has_more, first) = fetched;
         let elapsed_ms = started.elapsed().as_secs_f64() * 1000.0;
         Ok(QueryResult {
@@ -1055,7 +1325,7 @@ mod tests {
     #[test]
     fn discarded_sqlserver_connections_are_broken() {
         let manager = MssqlConnectionManager(tiberius::Config::new());
-        assert!(manager.has_broken(&mut MssqlConnection(None)));
+        assert!(manager.has_broken(&mut MssqlConnection(None, Context::new(None))));
     }
 
     #[tokio::test]
@@ -1191,6 +1461,7 @@ mod tests {
         assert_eq!(setup.charset.as_deref(), Some("utf8mb4"));
         assert_eq!(setup.connect_timeout, Some(Duration::from_secs(5)));
         assert!(Setup::of(&DataSource { properties: vec![prop("a; drop", "1")], ..s.clone() }).is_err());
+        assert!(Setup::of(&DataSource { properties: vec![prop("connect_timeout", "0")], ..s.clone() }).is_err());
         assert!(Setup::of(&DataSource { properties: vec![prop("connect_timeout", "soon")], ..s }).is_err());
     }
 

crates/ide-db/src/lib.rs

@@ -315,7 +315,7 @@ fn keep_alive(pool: &Arc<Pool>, every: Duration) {
 async fn end_session(session: &Session) {
     let held = session.lock().await.take();
     if let Some(mut conn) = held
-        && conn.command("ROLLBACK").await.is_err()
+        && (conn.command("ROLLBACK").await.is_err() || conn.restore_default().await.is_err())
     {
         conn.discard().await;
     }
@@ -704,8 +704,15 @@ impl DbManager {
         let introspection = self.source(id)?.introspection;
         let system = introspection.show_system;
         let pool = self.pool(id).await?;
+        if pool.driver() == DbDriver::SqlServer {
+            let first =
+                |rows: Vec<Vec<Option<String>>>| rows.into_iter().filter_map(|r| r.into_iter().next().flatten());
+            let current = first(pool.rows("SELECT DB_NAME()", 1).await?).next().unwrap_or_default();
+            let names = first(pool.rows(sql::sqlserver_databases(), MAX_META_ROWS).await?).collect();
+            return Ok(Databases { current, names });
+        }
         if pool.driver() != DbDriver::Postgres {
-            return Err(IdeError::invalid("only PostgreSQL data sources list databases"));
+            return Err(IdeError::invalid("this data source does not list databases"));
         }
         let first = |rows: Vec<Vec<Option<String>>>| rows.into_iter().filter_map(|r| r.into_iter().next().flatten());
         let current = first(pool.rows("SELECT current_database()", 1).await?).next().unwrap_or_default();
@@ -1038,11 +1045,13 @@ impl DbManager {
         max_rows: usize,
         cancel: &CancellationToken,
     ) -> IdeResult<QueryResult> {
-        self.execute_from(id, statement, 0, max_rows, cancel).await
+        self.execute_from(id, statement, 0, max_rows, cancel, None).await
     }
 
     /// [`execute`](Self::execute), reading past the first `skip` rows without keeping
     /// them: a later page of a result, where only that page is decoded and returned.
+    /// `schema` is a query console's active context: the connection that runs the
+    /// statement is put in it first, so unqualified names resolve there.
     pub async fn execute_from(
         &self,
         id: &str,
@@ -1050,8 +1059,9 @@ impl DbManager {
         skip: usize,
         max_rows: usize,
         cancel: &CancellationToken,
+        schema: Option<&str>,
     ) -> IdeResult<QueryResult> {
-        let r = self.run(id, statement, skip, max_rows, cancel).await;
+        let r = self.run(id, statement, skip, max_rows, cancel, schema).await;
         let ran = match &r {
             Ok(_) => true,
             Err(e) => !matches!(e.kind, ErrorKind::Cancelled | ErrorKind::PermissionDenied),
@@ -1083,8 +1093,15 @@ impl DbManager {
             .map_err(|e| IdeError::internal(e.to_string()))?
     }
 
-    /// The execution plan of `statement` (explained, not run).
-    pub async fn explain(&self, id: &str, statement: &str, cancel: &CancellationToken) -> IdeResult<Vec<PlanNode>> {
+    /// The execution plan of `statement` (explained, not run), in the console's
+    /// active `schema` when it has one.
+    pub async fn explain(
+        &self,
+        id: &str,
+        statement: &str,
+        cancel: &CancellationToken,
+        schema: Option<&str>,
+    ) -> IdeResult<Vec<PlanNode>> {
         let driver = self.pool(id).await?.driver();
         if driver == DbDriver::Oracle {
             // EXPLAIN PLAN writes PLAN_TABLE; the plan is read (and cleaned up) separately.
@@ -1102,14 +1119,16 @@ impl DbManager {
                 0,
                 MAX_META_ROWS,
                 cancel,
+                schema,
             )
             .await?;
-            let result = self.run(id, &plan::oracle_plan_query(&plan_id), 0, MAX_META_ROWS, cancel).await?;
+            let result = self.run(id, &plan::oracle_plan_query(&plan_id), 0, MAX_META_ROWS, cancel, None).await?;
             let nodes = plan::parse(driver, &result);
-            let _ = self.run(id, &plan::oracle_plan_cleanup(&plan_id), 0, 0, cancel).await;
+            let _ = self.run(id, &plan::oracle_plan_cleanup(&plan_id), 0, 0, cancel, None).await;
             return nodes;
         }
-        let result = self.run(id, &plan::explain_statement(driver, statement), 0, MAX_META_ROWS, cancel).await?;
+        let result =
+            self.run(id, &plan::explain_statement(driver, statement), 0, MAX_META_ROWS, cancel, schema).await?;
         plan::parse(driver, &result)
     }
 
@@ -1120,11 +1139,25 @@ impl DbManager {
         skip: usize,
         max_rows: usize,
         cancel: &CancellationToken,
+        schema: Option<&str>,
     ) -> IdeResult<QueryResult> {
         let pool = self.pool(id).await?;
         let session = self.sessions.lock().get(id).cloned();
         let Some(session) = session else {
-            return pool.execute_from(statement, skip, max_rows, cancel).await;
+            if schema.is_none() {
+                return pool.execute_from(statement, skip, max_rows, cancel).await;
+            }
+            // Like `Pool::execute_from`, with the schema applied to the connection first.
+            let mut conn = Held::acquire(&pool).await?;
+            let r = match conn.apply_context(schema).await {
+                Ok(()) => conn.execute_from(&pool, statement, skip, max_rows, cancel).await,
+                Err(e) => Err(e),
+            };
+            if cancel.is_cancelled() {
+                conn.discard().await;
+                return Err(IdeError::cancelled());
+            }
+            return r;
         };
         if pool.driver() == DbDriver::Clickhouse {
             return Err(IdeError::invalid("ClickHouse manual transactions are unsupported"));
@@ -1132,10 +1165,12 @@ impl DbManager {
         let mut held = session.lock().await;
         if held.is_none() {
             let mut conn = Held::acquire(&pool).await?;
+            conn.apply_context(schema).await?;
             conn.command(conn::begin_statement(pool.driver())).await?;
             *held = Some(conn);
         }
         let conn = held.as_mut().expect("opened above");
+        conn.apply_context(schema).await?;
         let r = conn.execute_from(&pool, statement, skip, max_rows, cancel).await;
         if cancel.is_cancelled() {
             // The server rolls the transaction back with the connection.
@@ -1171,7 +1206,12 @@ impl DbManager {
         let Some(session) = session else { return Ok(()) };
         let mut held = session.lock().await;
         let Some(mut conn) = held.take() else { return Ok(()) };
-        match conn.command(if commit { "COMMIT" } else { "ROLLBACK" }).await {
+        let result = async {
+            conn.command(if commit { "COMMIT" } else { "ROLLBACK" }).await?;
+            conn.restore_default().await
+        }
+        .await;
+        match result {
             Ok(()) => Ok(()),
             Err(e) => {
                 conn.discard().await;

crates/ide-db/src/oracle.rs

@@ -181,7 +181,7 @@ impl OraclePool {
         .await
         .map_err(|e| IdeError::internal(format!("Oracle connect task: {e}")))?
         .map_err(oracle_err)?;
-        let _ = pool.add(OracleHandle { conn: Some(opened) });
+        let _ = pool.add(opened);
         Ok(Self { state, pool: Arc::new(pool) })
     }
 
@@ -208,6 +208,7 @@ fn pool_err(e: bb8::RunError<OracleError>) -> OracleError {
 /// discarded (a cancelled statement leaves it in the blocking task).
 pub struct OracleHandle {
     conn: Option<oracle::Connection>,
+    context: crate::conn::Context,
 }
 
 pub struct OracleConnectionManager(Arc<State>);
@@ -222,7 +223,7 @@ impl ManageConnection for OracleConnectionManager {
             .await
             .map_err(|e| OracleError::message(format!("Oracle connect task: {e}")))?;
         let conn = opened.map_err(OracleError::new)?;
-        Ok(OracleHandle { conn: Some(conn) })
+        Ok(conn)
     }
 
     async fn is_valid(&self, conn: &mut Self::Connection) -> Result<(), Self::Error> {
@@ -271,6 +272,10 @@ pub struct OracleConnection {
 }
 
 impl OracleConnection {
+    pub(crate) fn context(&mut self) -> &mut crate::conn::Context {
+        &mut self.pooled.context
+    }
+
     pub fn is_closed(&self) -> bool {
         self.pooled.conn.is_none()
     }
@@ -282,7 +287,7 @@ impl OracleConnection {
     }
 }
 
-fn open(state: &State) -> oracle::Result<oracle::Connection> {
+fn open(state: &State) -> oracle::Result<OracleHandle> {
     let mut connector = oracle::Connector::new(state.user.clone(), state.password.clone(), state.connect.clone());
     connector.driver_name("OpenIDEA");
     if let Some(n) = state.statement_cache {
@@ -293,7 +298,12 @@ fn open(state: &State) -> oracle::Result<oracle::Connection> {
     for sql in &state.init {
         statement(&mut conn, sql, 0, 0, Cells::Text).map_err(|e| message_error(&e.message))?;
     }
-    Ok(conn)
+    let user: String = conn.query_row_as("SELECT SYS_CONTEXT('USERENV', 'SESSION_USER') FROM DUAL", &[])?;
+    let default = crate::sql::use_schema(DbDriver::Oracle, &user);
+    let current: String = conn.query_row_as("SELECT SYS_CONTEXT('USERENV', 'CURRENT_SCHEMA') FROM DUAL", &[])?;
+    let mut context = crate::conn::Context::new(default);
+    context.set_current(crate::sql::use_schema(DbDriver::Oracle, &current));
+    Ok(OracleHandle { conn: Some(conn), context })
 }
 
 /// Runs `f` with the connection on the blocking pool. Cancelling drops the
@@ -558,7 +568,7 @@ mod tests {
             )
             .unwrap(),
         ));
-        let mut broken = OracleHandle { conn: None };
+        let mut broken = OracleHandle { conn: None, context: crate::conn::Context::new(None) };
         assert!(manager.has_broken(&mut broken));
         // A connection that cannot be opened reports the failure without panicking
         // (a client-load error, or ORA-12541 when a client is available).

crates/ide-db/src/sql.rs

@@ -63,6 +63,11 @@ pub const ORACLE_SYSTEM_SCHEMAS: &[&str] = &[
     "XS$NULL",
 ];
 
+/// Databases available to this login; offline/restoring databases cannot be selected.
+pub fn sqlserver_databases() -> &'static str {
+    "SELECT name FROM sys.databases WHERE state = 0 AND HAS_DBACCESS(name) = 1 ORDER BY name"
+}
+
 pub fn schemas(driver: DbDriver, system: bool) -> &'static str {
     match driver {
         DbDriver::Sqlite => "SELECT name FROM pragma_database_list WHERE name <> 'temp' ORDER BY seq",
@@ -396,6 +401,18 @@ pub fn current_schema(driver: DbDriver) -> Option<&'static str> {
     }
 }
 
+/// The statement that makes unqualified names resolve in `schema` on the
+/// connection that runs it (a query console's active schema; `None`: the driver
+/// has no schema to switch — SQLite's `main`, ClickHouse's `USE` differs).
+pub fn use_schema(driver: DbDriver, schema: &str) -> Option<String> {
+    match driver {
+        DbDriver::Sqlite | DbDriver::Clickhouse => None,
+        DbDriver::Postgres => Some(format!("SET search_path TO {}", quote_ident(driver, schema))),
+        DbDriver::Mysql | DbDriver::SqlServer => Some(format!("USE {}", quote_ident(driver, schema))),
+        DbDriver::Oracle => Some(format!("ALTER SESSION SET CURRENT_SCHEMA = {}", quote_ident(driver, schema))),
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 #[serde(rename = "DbSortKey")]
@@ -994,6 +1011,20 @@ mod tests {
         assert!(object_ddl(DbDriver::Postgres, "s", K::Sequence, "q").unwrap().0.contains("sequencename = 'q'"));
     }
 
+    #[test]
+    fn schema_switch_statement_per_dialect() {
+        assert_eq!(use_schema(DbDriver::Postgres, "app data"), Some("SET search_path TO \"app data\"".into()));
+        assert_eq!(use_schema(DbDriver::Mysql, "a`b"), Some("USE `a``b`".into()));
+        assert_eq!(use_schema(DbDriver::SqlServer, "app] data"), Some("USE [app]] data]".into()));
+        assert_eq!(use_schema(DbDriver::Postgres, "a\"b"), Some("SET search_path TO \"a\"\"b\"".into()));
+        assert_eq!(use_schema(DbDriver::Oracle, "a\"b"), Some("ALTER SESSION SET CURRENT_SCHEMA = \"a\"\"b\"".into()));
+        assert!(sqlserver_databases().contains("state = 0 AND HAS_DBACCESS(name) = 1"));
+        assert_eq!(use_schema(DbDriver::Oracle, "hr"), Some("ALTER SESSION SET CURRENT_SCHEMA = \"hr\"".into()));
+        // Single-schema (SQLite) and not-yet-supported drivers: no dropdown, no switch.
+        assert_eq!(use_schema(DbDriver::Sqlite, "main"), None);
+        assert_eq!(use_schema(DbDriver::Clickhouse, "default"), None);
+    }
+
     #[test]
     fn postgres_ddl() {
         let cols = [

crates/ide-db/tests/clickhouse.rs

@@ -103,7 +103,7 @@ async fn clickhouse_cloud_manager_catalogs_and_session_table() -> IdeResult<()>
                 "completion columns differ from catalog",
             )?;
         }
-        let plan = db.explain("clickhouse", &format!("SELECT id FROM {table}"), &cancel).await?;
+        let plan = db.explain("clickhouse", &format!("SELECT id FROM {table}"), &cancel, None).await?;
         check(!plan.is_empty(), "query plan missing")?;
         let value = r"path\O'Brien";
         let result = db

crates/ide-db/tests/mysql.rs

@@ -85,3 +85,101 @@ async fn metadata_names_are_text_whatever_the_column_collation() -> IdeResult<()
     let raw = manager(&tmp, "SET character_set_results = binary").await.unwrap();
     assert_metadata_is_text(&raw).await
 }
+
+// A console's active schema: the connection that runs each autocommit statement
+// is put in it first, so unqualified names resolve there (and not elsewhere).
+// Its own schema names: tests of this file share one server but run in parallel.
+#[tokio::test]
+async fn active_schema_context_drives_the_executing_connection() -> IdeResult<()> {
+    const A: &str = "oi_ctx_meta";
+    const B: &str = "oi_ctx_data";
+    let tmp = tempfile::tempdir().unwrap();
+    let Some(db) = manager(&tmp, "").await else { return Ok(()) };
+    let c = CancellationToken::new();
+    for s in [A, B] {
+        for stmt in [
+            format!("DROP DATABASE IF EXISTS `{s}`"),
+            format!("CREATE DATABASE `{s}` CHARACTER SET utf8mb4 COLLATE utf8mb4_bin"),
+            format!("CREATE TABLE `{s}`.`用户` (id INT PRIMARY KEY, name VARCHAR(20))"),
+            format!("INSERT INTO `{s}`.`用户` VALUES (1, '{s}')"),
+        ] {
+            db.execute("m", &stmt, 10, &c).await.unwrap();
+        }
+    }
+
+    // The source connects with no default database; the console's pick decides.
+    let r = db.execute_from("m", "SELECT DATABASE()", 0, 1, &c, Some(A)).await?;
+    assert_eq!(r.rows, vec![vec![Some(A.into())]]);
+    // Both schemas hold `用户`; the context resolves the unqualified name in its own,
+    // on every pooled connection the autocommit statements may land on.
+    for _ in 0..6 {
+        for (schema, name) in [(A, A), (B, B)] {
+            let r = db.execute_from("m", "SELECT name FROM 用户", 0, 1, &c, Some(schema)).await?;
+            assert_eq!(r.rows, vec![vec![Some(name.into())]], "of {schema}");
+            let r = db.execute_from("m", "SELECT DATABASE()", 0, 1, &c, Some("")).await?;
+            assert_eq!(r.rows, vec![vec![None]]);
+            assert_eq!(db.completion("m").await?.default_schema, "");
+        }
+    }
+    // A statement without a selection returns to the source's absent default.
+    let r = db.execute_from("m", "SELECT DATABASE()", 0, 1, &c, None).await?;
+    assert_eq!(r.rows, vec![vec![None]]);
+
+    // A manual-commit console switches schemas on its session connection.
+    db.set_manual_commit("m", true).await?;
+    // Starting a no-database manual session must keep its transaction open.
+    db.execute("m", &format!("INSERT INTO `{A}`.`用户` VALUES (2, 'rollback')"), 1, &c).await?;
+    db.finish_transaction("m", false).await?;
+    assert!(db.execute("m", &format!("SELECT name FROM `{A}`.`用户` WHERE id = 2"), 1, &c).await?.rows.is_empty());
+    let r = db.execute_from("m", "SELECT name FROM 用户", 0, 1, &c, Some(A)).await?;
+    assert_eq!(r.rows, vec![vec![Some(A.into())]]);
+    let r = db.execute_from("m", "SELECT DATABASE()", 0, 1, &c, Some(B)).await?;
+    assert_eq!(r.rows, vec![vec![Some(B.into())]]);
+    assert!(db.execute("m", "SELECT DATABASE()", 1, &c).await.is_err());
+    // The rejected clear keeps the transaction and selection intact.
+    assert_eq!(db.execute_from("m", "SELECT DATABASE()", 0, 1, &c, Some(B)).await?.rows, vec![vec![Some(B.into())]]);
+    db.finish_transaction("m", true).await?;
+    for commit in [false, true] {
+        db.execute_from("m", "SELECT 1", 0, 1, &c, Some(A)).await?;
+        db.finish_transaction("m", commit).await?;
+        let r = db.execute("m", "SELECT DATABASE()", 1, &c).await?;
+        assert_eq!(r.rows, vec![vec![None]]);
+    }
+    db.execute_from("m", "SELECT 1", 0, 1, &c, Some(A)).await?;
+    db.set_manual_commit("m", false).await?;
+    db.execute("m", &format!("USE `{B}`"), 1, &c).await?;
+    let r = db.execute("m", "SELECT DATABASE()", 1, &c).await?;
+    assert_eq!(r.rows, vec![vec![None]]);
+
+    // An unknown schema fails the statement instead of running it somewhere else.
+    let error = db.execute_from("m", "SELECT 1", 0, 1, &c, Some("oi_missing")).await.unwrap_err();
+    assert!(error.message.contains("oi_missing"), "{}", error.message);
+    Ok(())
+}
+
+#[tokio::test]
+async fn a_reused_physical_connection_restores_the_configured_database() -> IdeResult<()> {
+    use ide_db::{Held, Pool};
+    let Some((host, port, user, password)) = server() else { return Ok(()) };
+    let source = DataSource {
+        driver: DbDriver::Mysql,
+        host,
+        port: Some(port),
+        user,
+        database: "mysql".into(),
+        ..Default::default()
+    };
+    let pool = Pool::connect(&source, Some(&password), None).await?;
+    let c = CancellationToken::new();
+    let _other = [Held::acquire(&pool).await?, Held::acquire(&pool).await?, Held::acquire(&pool).await?];
+    let mut conn = Held::acquire(&pool).await?;
+    let backend = conn.execute(&pool, "SELECT CONNECTION_ID()", 1, &c).await?.rows;
+    for schema in ["information_schema", "mysql", "information_schema"] {
+        conn.apply_context(Some(schema)).await?;
+        assert_eq!(conn.execute(&pool, "SELECT DATABASE()", 1, &c).await?.rows, vec![vec![Some(schema.into())]]);
+    }
+    drop(conn);
+    assert_eq!(pool.rows("SELECT DATABASE()", 1).await?, vec![vec![Some("mysql".into())]]);
+    assert_eq!(pool.execute("SELECT CONNECTION_ID()", 1, &c).await?.rows, backend);
+    Ok(())
+}

crates/ide-db/tests/postgres.rs

@@ -0,0 +1,135 @@
+//! The active schema context against a real PostgreSQL server, skipped unless
+//! `OPENIDEA_TEST_POSTGRES=host:port:user:password` names a throwaway server.
+
+use ide_core::{CancellationToken, IdeResult};
+use ide_db::{DataSource, DbDriver, DbManager};
+
+fn server() -> Option<(String, u16, String, String)> {
+    let v = std::env::var("OPENIDEA_TEST_POSTGRES").ok()?;
+    let mut it = v.splitn(4, ':');
+    Some((it.next()?.into(), it.next()?.parse().ok()?, it.next()?.into(), it.next().unwrap_or("").into()))
+}
+
+async fn manager(tmp: &tempfile::TempDir) -> Option<DbManager> {
+    let (host, port, user, password) = server()?;
+    let root = tmp.path().to_path_buf();
+    let ssh = std::sync::Arc::new(ide_ssh::SshManager::new(root.join("ssh-passwords.json")));
+    let db = DbManager::new(root.clone(), root.join("passwords.json"), root.join("history.json"), ssh);
+    db.save_sources(vec![DataSource {
+        id: "p".into(),
+        name: "postgres".into(),
+        driver: DbDriver::Postgres,
+        host,
+        port: Some(port),
+        user,
+        ..Default::default()
+    }])
+    .await
+    .unwrap();
+    db.set_password("p", Some(password), false).await.unwrap();
+    Some(db)
+}
+
+async fn create_schemas(db: &DbManager) {
+    let c = CancellationToken::new();
+    for (schema, tag) in [("oi_a", "from a"), ("oi_b", "from b")] {
+        for stmt in [
+            format!("DROP SCHEMA IF EXISTS \"{schema}\" CASCADE"),
+            format!("CREATE SCHEMA \"{schema}\""),
+            format!("CREATE TABLE \"{schema}\".items (id INT PRIMARY KEY, tag TEXT)"),
+            format!("INSERT INTO \"{schema}\".items VALUES (1, '{tag}')"),
+        ] {
+            db.execute("p", &stmt, 10, &c).await.unwrap();
+        }
+    }
+}
+
+#[tokio::test]
+async fn active_schema_context_drives_the_executing_connection() -> IdeResult<()> {
+    let tmp = tempfile::tempdir().unwrap();
+    let Some(db) = manager(&tmp).await else { return Ok(()) };
+    create_schemas(&db).await;
+    let c = CancellationToken::new();
+
+    // The connection default stays untouched before any console picks a schema.
+    let r = db.execute("p", "SHOW search_path", 1, &c).await?;
+    assert!(r.rows[0][0].as_deref().unwrap_or("").contains("public"), "{:?}", r.rows);
+
+    // Both schemas hold `items`; the context resolves the unqualified name in its own,
+    // on every pooled connection the autocommit statements may land on.
+    for _ in 0..6 {
+        for (schema, tag) in [("oi_a", "from a"), ("oi_b", "from b")] {
+            let r = db.execute_from("p", "SELECT tag FROM items", 0, 1, &c, Some(schema)).await?;
+            assert_eq!(r.rows, vec![vec![Some(tag.into())]], "of {schema}");
+            let r = db.execute_from("p", "SHOW search_path", 0, 1, &c, Some("")).await?;
+            assert_eq!(r.rows, vec![vec![Some("\"$user\", public".into())]]);
+            assert_eq!(db.completion("p").await?.default_schema, "public");
+        }
+    }
+
+    // A manual-commit console switches schemas on its session connection.
+    db.set_manual_commit("p", true).await?;
+    let r = db.execute_from("p", "SELECT tag FROM items", 0, 1, &c, Some("oi_a")).await?;
+    assert_eq!(r.rows, vec![vec![Some("from a".into())]]);
+    let r = db.execute_from("p", "SELECT tag FROM items", 0, 1, &c, Some("oi_b")).await?;
+    assert_eq!(r.rows, vec![vec![Some("from b".into())]]);
+    db.finish_transaction("p", true).await?;
+    for commit in [false, true] {
+        db.execute_from("p", "SELECT 1", 0, 1, &c, Some("oi_a")).await?;
+        db.finish_transaction("p", commit).await?;
+        let r = db.execute("p", "SHOW search_path", 1, &c).await?;
+        assert_eq!(r.rows, vec![vec![Some("\"$user\", public".into())]]);
+    }
+    db.set_manual_commit("p", false).await?;
+    db.execute("p", "SET search_path TO oi_b", 1, &c).await?;
+    let r = db.execute("p", "SHOW search_path", 1, &c).await?;
+    assert_eq!(r.rows, vec![vec![Some("\"$user\", public".into())]]);
+
+    // An unknown schema never resolves the statement's tables (`SET search_path`
+    // itself does not validate names; resolution against it does).
+    let error = db.execute_from("p", "SELECT tag FROM items", 0, 1, &c, Some("oi_missing")).await.unwrap_err();
+    assert!(error.message.to_lowercase().contains("does not exist"), "{}", error.message);
+    Ok(())
+}
+
+#[tokio::test]
+async fn a_reused_physical_connection_restores_the_full_default_path() -> IdeResult<()> {
+    use ide_db::{DbOptions, Held, Pool};
+    let Some((host, port, user, password)) = server() else { return Ok(()) };
+    let source = DataSource {
+        driver: DbDriver::Postgres,
+        host,
+        port: Some(port),
+        user,
+        options: DbOptions { default_schema: "public, pg_catalog".into(), ..Default::default() },
+        ..Default::default()
+    };
+    let pool = Pool::connect(&source, Some(&password), None).await?;
+    let c = CancellationToken::new();
+    // Occupy the other three slots: every operation below must reuse the fourth.
+    let _other = [Held::acquire(&pool).await?, Held::acquire(&pool).await?, Held::acquire(&pool).await?];
+    let mut conn = Held::acquire(&pool).await?;
+    let backend = conn.execute(&pool, "SELECT pg_backend_pid()", 1, &c).await?.rows;
+    for schema in ["pg_catalog", "public", "pg_catalog"] {
+        conn.apply_context(Some(schema)).await?;
+        let r = conn.execute(&pool, "SELECT current_schema()", 1, &c).await?;
+        assert_eq!(r.rows, vec![vec![Some(schema.into())]]);
+    }
+    conn.apply_context(Some("public")).await?;
+    conn.execute(&pool, "SELECT set_config('search_path', 'pg_catalog', false)", 1, &c).await?;
+    conn.apply_context(Some("public")).await?;
+    assert_eq!(conn.execute(&pool, "SELECT current_schema()", 1, &c).await?.rows, vec![vec![Some("public".into())]]);
+    drop(conn);
+    assert_eq!(pool.rows("SHOW search_path", 1).await?, vec![vec![Some("public, pg_catalog".into())]]);
+    assert_eq!(pool.execute("SELECT pg_backend_pid()", 1, &c).await?.rows, backend);
+    let mut conn = Held::acquire(&pool).await?;
+    conn.command("BEGIN").await?;
+    conn.apply_context(Some("pg_catalog")).await?;
+    conn.command("ROLLBACK").await?;
+    conn.restore_default().await?;
+    assert_eq!(
+        conn.execute(&pool, "SHOW search_path", 1, &c).await?.rows,
+        vec![vec![Some("public, pg_catalog".into())]]
+    );
+    Ok(())
+}

crates/ide-db/tests/sqlite.rs

@@ -132,16 +132,16 @@ async fn a_later_page_returns_only_its_rows() -> IdeResult<()> {
     let sql = "SELECT id FROM users ORDER BY id";
     let ids = |r: &QueryResult| r.rows.iter().map(|row| row[0].clone().unwrap()).collect::<Vec<_>>();
 
-    let second = db.execute_from("s1", sql, 1, 1, &c).await?;
+    let second = db.execute_from("s1", sql, 1, 1, &c, None).await?;
     assert_eq!(ids(&second), vec!["2"]);
     assert!(second.has_more);
     assert_eq!(second.columns.len(), 1);
 
-    let last = db.execute_from("s1", sql, 2, 5, &c).await?;
+    let last = db.execute_from("s1", sql, 2, 5, &c, None).await?;
     assert_eq!(ids(&last), vec!["3"]);
     assert!(!last.has_more);
 
-    let past = db.execute_from("s1", sql, 9, 5, &c).await?;
+    let past = db.execute_from("s1", sql, 9, 5, &c, None).await?;
     assert!(past.rows.is_empty() && !past.has_more);
     assert_eq!(past.columns.len(), 1, "columns of a page past the end come from the prepared statement");
     Ok(())
@@ -276,11 +276,11 @@ async fn ddl_of_tables_and_views() -> IdeResult<()> {
 async fn explains_queries_without_running_them() -> IdeResult<()> {
     let (_tmp, db) = setup().await;
     let c = CancellationToken::new();
-    let plan = db.explain("s1", "SELECT * FROM users WHERE id > 1 ORDER BY note;", &c).await?;
+    let plan = db.explain("s1", "SELECT * FROM users WHERE id > 1 ORDER BY note;", &c, None).await?;
     let ops: Vec<_> = plan.iter().map(|n| n.operation.as_str()).collect();
     assert_eq!(ops, vec!["Index Scan", "Order By"]);
     assert!(plan[0].params.starts_with("table: users;"), "{}", plan[0].params);
-    db.explain("s1", "DELETE FROM users", &c).await?;
+    db.explain("s1", "DELETE FROM users", &c, None).await?;
     assert_eq!(count(&db).await, "3");
     Ok(())
 }

crates/ide-docker/src/lib.rs

@@ -443,7 +443,7 @@ pub fn compose_op(
 
 /// Whether `ep` is a daemon on this machine, where a bind mount of the project
 /// is this machine's folder. The CLI's default daemon and a context are looked
-/// up (`DOCKER_HOST`, else the context's endpoint).
+/// up (`DOCKER_CONTEXT`, then `DOCKER_HOST`, else the current context).
 pub fn endpoint_is_local(ep: &DockerEndpoint) -> IdeResult<bool> {
     let url = match ep {
         DockerEndpoint::Socket { path } => path.trim().to_owned(),
@@ -451,17 +451,31 @@ pub fn endpoint_is_local(ep: &DockerEndpoint) -> IdeResult<bool> {
             let host = host.trim();
             if host.contains("://") { host.to_owned() } else { format!("tcp://{host}") }
         }
-        DockerEndpoint::Default => {
-            match ide_core::process::host_var_os("DOCKER_HOST").map(|v| v.to_string_lossy().trim().to_owned()) {
-                Some(url) if !url.is_empty() => url,
-                _ => context_host(ep, None)?,
-            }
-        }
+        DockerEndpoint::Default => default_daemon_url(
+            ide_core::process::host_var_os("DOCKER_CONTEXT").as_deref().and_then(|v| v.to_str()),
+            ide_core::process::host_var_os("DOCKER_HOST").as_deref().and_then(|v| v.to_str()),
+            |name| context_host(&DockerEndpoint::Default, name),
+        )?,
         DockerEndpoint::Context { name } => context_host(&DockerEndpoint::Default, Some(name.trim()))?,
     };
     Ok(daemon_url_is_local(&url))
 }
 
+fn default_daemon_url(
+    context: Option<&str>,
+    host: Option<&str>,
+    lookup: impl FnOnce(Option<&str>) -> IdeResult<String>,
+) -> IdeResult<String> {
+    let context = context.filter(|v| !v.is_empty());
+    if context.is_some() {
+        return lookup(context);
+    }
+    match host.filter(|v| !v.is_empty()) {
+        Some(host) => Ok(host.to_owned()),
+        None => lookup(None),
+    }
+}
+
 /// The daemon URL of context `name` (the current one with `None`).
 fn context_host(ep: &DockerEndpoint, name: Option<&str>) -> IdeResult<String> {
     let mut args = vec!["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"];
@@ -506,6 +520,34 @@ pub fn compose_config(ep: &DockerEndpoint, dir: &Path, files: &[String]) -> IdeR
 mod local_tests {
     use super::*;
 
+    #[test]
+    fn the_selected_context_overrides_docker_host() {
+        let local = "unix:///var/run/docker.sock";
+        let remote = "ssh://me@build";
+        for host in [None, Some(""), Some(local)] {
+            let url = default_daemon_url(Some("build"), host, |name| {
+                assert_eq!(name, Some("build"));
+                Ok(remote.into())
+            })
+            .unwrap();
+            assert!(!daemon_url_is_local(&url));
+        }
+        for context in [None, Some("")] {
+            assert_eq!(
+                default_daemon_url(context, Some(local), |_| panic!("host overrides current context")).unwrap(),
+                local
+            );
+            assert_eq!(
+                default_daemon_url(context, None, |name| {
+                    assert_eq!(name, None);
+                    Ok(remote.into())
+                })
+                .unwrap(),
+                remote
+            );
+        }
+    }
+
     #[test]
     fn local_daemon_urls() {
         for url in [

crates/ide-extension/src/capability.rs

@@ -18,6 +18,8 @@ pub enum Capability {
     EditorRead,
     /// Edit the focused editor (versioned edits).
     EditorWrite,
+    /// Create and replace files inside the project root.
+    ProjectWrite,
     VcsRead,
     VcsWrite,
     /// The plugin's own key-value store and data directory.
@@ -36,6 +38,8 @@ pub enum Capability {
     Process(String),
     /// Read files outside the project under one path.
     FsRead(String),
+    /// Write files outside the project under one path.
+    FsWrite(String),
 }
 
 /// How a grant is presented (plan 4.2).
@@ -54,10 +58,14 @@ impl Capability {
     pub fn risk(&self) -> Risk {
         match self {
             Self::ProjectRead | Self::EditorRead | Self::Storage | Self::Events | Self::VcsRead => Risk::Low,
-            Self::EditorWrite | Self::VcsWrite | Self::Net(_) | Self::Secrets | Self::InputEvents | Self::Clipboard => {
-                Risk::Medium
-            }
-            Self::Process(_) | Self::FsRead(_) => Risk::High,
+            Self::EditorWrite
+            | Self::ProjectWrite
+            | Self::VcsWrite
+            | Self::Net(_)
+            | Self::Secrets
+            | Self::InputEvents
+            | Self::Clipboard => Risk::Medium,
+            Self::Process(_) | Self::FsRead(_) | Self::FsWrite(_) => Risk::High,
         }
     }
 
@@ -73,6 +81,7 @@ impl Capability {
             Self::ProjectRead => "Read files in the open project".into(),
             Self::EditorRead => "Read the focused editor's file and selection".into(),
             Self::EditorWrite => "Change text in the editor".into(),
+            Self::ProjectWrite => "Create and change files in the open project".into(),
             Self::VcsRead => "Read version control state".into(),
             Self::VcsWrite => "Change version control state (commit, fetch, checkout)".into(),
             Self::Storage => "Store its own data".into(),
@@ -85,6 +94,7 @@ impl Capability {
             Self::Net(host) => format!("Connect to {host} (from the machine the project is on)"),
             Self::Process(bin) => format!("Run {bin} — equivalent to running arbitrary code on this machine"),
             Self::FsRead(path) => format!("Read files under {path}, outside the project"),
+            Self::FsWrite(path) => format!("Change files under {path}, outside the project"),
         }
     }
 
@@ -92,7 +102,7 @@ impl Capability {
     pub fn covers(&self, wanted: &Capability) -> bool {
         match (self, wanted) {
             (Self::Net(pattern), Self::Net(host)) => host_matches(pattern, host),
-            (Self::FsRead(base), Self::FsRead(path)) => {
+            (Self::FsRead(base), Self::FsRead(path)) | (Self::FsWrite(base), Self::FsWrite(path)) => {
                 std::path::Path::new(path).starts_with(std::path::Path::new(base))
             }
             _ => self == wanted,
@@ -116,6 +126,7 @@ impl fmt::Display for Capability {
             Self::ProjectRead => f.write_str("project.read"),
             Self::EditorRead => f.write_str("editor.read"),
             Self::EditorWrite => f.write_str("editor.write"),
+            Self::ProjectWrite => f.write_str("project.write"),
             Self::VcsRead => f.write_str("vcs.read"),
             Self::VcsWrite => f.write_str("vcs.write"),
             Self::Storage => f.write_str("storage"),
@@ -126,6 +137,7 @@ impl fmt::Display for Capability {
             Self::Net(h) => write!(f, "net:{h}"),
             Self::Process(b) => write!(f, "process:{b}"),
             Self::FsRead(p) => write!(f, "fs.read:{p}"),
+            Self::FsWrite(p) => write!(f, "fs.write:{p}"),
         }
     }
 }
@@ -158,11 +170,11 @@ impl FromStr for Capability {
                     }
                     Ok(Self::Process(arg.to_owned()))
                 }
-                "fs.read" => {
+                "fs.read" | "fs.write" => {
                     if !std::path::Path::new(arg).is_absolute() && !arg.starts_with('~') {
                         return Err(format!("{s:?}: use an absolute path (or ~/…)"));
                     }
-                    Ok(Self::FsRead(arg.to_owned()))
+                    Ok(if kind == "fs.read" { Self::FsRead(arg.to_owned()) } else { Self::FsWrite(arg.to_owned()) })
                 }
                 _ => Err(format!("unknown capability {s:?}")),
             };
@@ -171,6 +183,7 @@ impl FromStr for Capability {
             "project.read" | "project-read" => Self::ProjectRead,
             "editor.read" | "editor-read" => Self::EditorRead,
             "editor.write" | "editor-write" => Self::EditorWrite,
+            "project.write" => Self::ProjectWrite,
             "vcs.read" => Self::VcsRead,
             "vcs.write" => Self::VcsWrite,
             "storage" => Self::Storage,
@@ -224,6 +237,7 @@ mod tests {
         for s in [
             "project.read",
             "editor.write",
+            "project.write",
             "vcs.write",
             "storage",
             "secrets",
@@ -236,12 +250,12 @@ mod tests {
             assert_eq!(s.parse::<Capability>().unwrap().to_string(), s);
         }
         // Absolute paths are the platform's.
-        let (git, etc) = if cfg!(windows) {
-            (r"process:C:\Program Files\Git\bin\git.exe", r"fs.read:C:\Windows")
+        let (git, etc, out) = if cfg!(windows) {
+            (r"process:C:\Program Files\Git\bin\git.exe", r"fs.read:C:\Windows", r"fs.write:C:\out")
         } else {
-            ("process:/usr/bin/git", "fs.read:/etc")
+            ("process:/usr/bin/git", "fs.read:/etc", "fs.write:/out")
         };
-        for s in [git, etc] {
+        for s in [git, etc, out] {
             assert_eq!(s.parse::<Capability>().unwrap().to_string(), s);
         }
         assert_eq!("project-read".parse::<Capability>().unwrap(), Capability::ProjectRead);
@@ -249,6 +263,7 @@ mod tests {
         assert!("net:a b".parse::<Capability>().is_err());
         assert!("process:./evil".parse::<Capability>().is_err());
         assert!("fs.read:rel".parse::<Capability>().is_err());
+        assert!("fs.write:rel".parse::<Capability>().is_err());
         assert!("network".parse::<Capability>().is_err());
     }
 

crates/ide-extension/src/ledger.rs

@@ -308,6 +308,13 @@ pub fn by_risk(caps: &[Capability]) -> Vec<(Risk, Vec<Capability>)> {
 
 /// Resolves a `process:` program to an absolute path once, at grant time:
 /// absolute names are taken as is, others are looked up in `path_var`.
+/// The directory is canonicalized but the file name kept as found: `cargo`,
+/// `rustc` and friends are often links to a multicall shim (rustup, asdf,
+/// mise) that picks the tool by the name it was invoked under — resolving the
+/// link itself would start the shim with the tool's arguments. The grant
+/// still pins the target's content: a hash read through a link reads the file
+/// it points to, so relinking or replacing either still fails the
+/// approved-file check.
 pub fn resolve_program(name: &str, path_var: Option<&OsStr>) -> Result<PathBuf, String> {
     let candidate = Path::new(name);
     if candidate.is_absolute() {
@@ -325,15 +332,21 @@ pub fn resolve_program(name: &str, path_var: Option<&OsStr>) -> Result<PathBuf,
         for ext in &exts {
             let p = dir.join(format!("{name}{ext}"));
             if is_executable(&p) {
-                return Ok(dunce_canonical(&p));
+                return Ok(canonical_dir(&p));
             }
         }
     }
     Err(format!("{name} was not found on PATH"))
 }
 
-fn dunce_canonical(p: &Path) -> PathBuf {
-    std::fs::canonicalize(p).unwrap_or_else(|_| p.to_path_buf())
+/// `p` with its parent canonicalized but the file name as found: PATH
+/// entries like `/var` → `/private/var` (macOS) or `~` links collapse to
+/// their real directory, while a linked program (`cargo` → rustup) keeps
+/// its link name so the shim still dispatches on argv[0].
+fn canonical_dir(p: &Path) -> PathBuf {
+    let Some(dir) = p.parent() else { return p.to_path_buf() };
+    let Some(name) = p.file_name() else { return p.to_path_buf() };
+    std::fs::canonicalize(dir).map(|d| d.join(name)).unwrap_or_else(|_| p.to_path_buf())
 }
 
 fn is_executable(p: &Path) -> bool {
@@ -474,6 +487,42 @@ mod tests {
         assert!(l.check_binary(&r.subject, &cap).unwrap_err().contains("changed"));
     }
 
+    /// A program found as a link stays the link: multicall shims (rustup,
+    /// asdf, mise) pick the tool by the name they were invoked under, so
+    /// `Command::new` must see the link. The hash still covers the target —
+    /// reading through the link reads it — so replacing either still trips
+    /// the approved-file check.
+    #[cfg(unix)]
+    #[test]
+    fn linked_programs_resolve_to_the_link() {
+        use std::os::unix::fs::PermissionsExt;
+        let tmp = tempfile::tempdir().unwrap();
+        let bin_dir = tmp.path().join("bin");
+        let real_dir = tmp.path().join("real");
+        std::fs::create_dir(&bin_dir).unwrap();
+        std::fs::create_dir(&real_dir).unwrap();
+        let target = real_dir.join("shim");
+        std::fs::write(&target, "#!/bin/sh\necho v1\n").unwrap();
+        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o755)).unwrap();
+        std::os::unix::fs::symlink(&target, bin_dir.join("cargo")).unwrap();
+
+        let path_var = std::env::join_paths([bin_dir.clone()]).unwrap();
+        let resolved = resolve_program("cargo", Some(&path_var)).unwrap();
+        // Directory canonicalized, file name kept — still the link.
+        let want = std::fs::canonicalize(&bin_dir).unwrap().join("cargo");
+        assert_eq!(resolved, want);
+        assert!(resolved.symlink_metadata().unwrap().file_type().is_symlink());
+
+        let mut l = Ledger::in_memory();
+        let r = req("1.0.0", "h", &["process:cargo"], &[]);
+        let cap: Capability = "process:cargo".parse().unwrap();
+        let bin = BinaryGrant { path: resolved.clone(), hash: file_hash(&resolved).unwrap() };
+        l.confirm(&r, &[], [(cap.to_string(), bin)].into());
+        assert_eq!(l.check_binary(&r.subject, &cap).unwrap(), resolved);
+        std::fs::write(&target, "#!/bin/sh\necho evil\n").unwrap();
+        assert!(l.check_binary(&r.subject, &cap).unwrap_err().contains("changed"));
+    }
+
     #[test]
     fn hashes_and_grouping() {
         let tmp = tempfile::tempdir().unwrap();

crates/ide-extension/src/lib.rs

@@ -31,6 +31,6 @@ pub use manifest::{
     Manifest, check_relative, engine_compatible, validate_item_id, validate_plugin_id, validate_point_id,
 };
 pub use point::{Commit, Disposable, ExtensionPoint, MAX_PACKAGE_FILE, Package, Placement, Prepared, decode};
-pub use registry::{ContributionInfo, ExtensionRegistry, PreparedSet};
+pub use registry::{ContributionInfo, ExtensionRegistry, LOCALES_DIR, LOCALES_POINT, PreparedSet};
 pub use ui::{UiContribution, UiDecl, UiPoint, UiStore, to_json};
 pub use when::validate_when;

crates/ide-extension/src/manifest.rs

@@ -315,6 +315,11 @@ impl Manifest {
             self.needs_api("`icon`", 2)?;
             check_relative(icon, "icon")?;
         }
+        for cap in self.capabilities.required.iter().chain(&self.capabilities.optional) {
+            if matches!(cap, Capability::ProjectWrite | Capability::FsWrite(_)) {
+                self.needs_api(&format!("capability `{cap}`"), 3)?;
+            }
+        }
         if let Some(dark) = &self.icon_dark {
             if self.icon.is_none() {
                 return Err("`icon-dark` needs `icon`".into());
@@ -583,6 +588,16 @@ mod tests {
 
     const BASE: &str = "id = \"ok\"\nname = \"N\"\nversion = \"1.0.0\"\nengines.openidea = \"^1.2\"\n";
 
+    #[test]
+    fn write_capabilities_need_api_1_3() {
+        for cap in ["project.write", "fs.write:/opt/tool"] {
+            let caps = format!("[capabilities]\noptional = [\"{cap}\"]\n");
+            assert!(err(&format!("{BASE}{caps}")).contains("new in plugin API 1.3"), "{cap}");
+            let m = Manifest::parse(&format!("{}{caps}", BASE.replace("^1.2", "^1.3"))).unwrap();
+            assert_eq!(m.capabilities.optional[0].to_string(), cap);
+        }
+    }
+
     #[test]
     fn parses_icons() {
         let m = Manifest::parse(&format!("{BASE}icon = \"icon.svg\"\nicon-dark = \"icon_dark.svg\"\n")).unwrap();

crates/ide-extension/src/registry.rs

@@ -9,6 +9,11 @@ use std::collections::BTreeMap;
 use std::path::PathBuf;
 use std::sync::Arc;
 
+/// The point behind a package's `locales/<tag>.json` catalogs: it has no
+/// `[[contributes.locales]]` table, the directory declares it.
+pub const LOCALES_POINT: &str = "locales";
+pub const LOCALES_DIR: &str = "locales";
+
 /// A contribution as the plugin details page lists it.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
@@ -127,6 +132,20 @@ impl ExtensionRegistry {
                 set.items.push((point.id(), prepared));
             }
         }
+        if let Some(point) = self.point(LOCALES_POINT)
+            && !pkg.manifest.contributes.contains_key(LOCALES_POINT)
+            && pkg.dir.join(LOCALES_DIR).is_dir()
+        {
+            let prepared = point
+                .prepare(pkg, toml::Value::Table(Default::default()))
+                .map_err(|e| format!("{LOCALES_DIR}: {}", strip_prefix(&e, LOCALES_POINT)))?;
+            for f in &prepared.files {
+                if !set.files.contains(f) {
+                    set.files.push(f.clone());
+                }
+            }
+            set.items.push((point.id(), prepared));
+        }
         Ok(set)
     }
 

crates/ide-host/Cargo.toml

@@ -17,6 +17,7 @@ ide-vfs.workspace = true
 regex-syntax.workspace = true
 ide-workspace.workspace = true
 ide-language.workspace = true
+blake3.workspace = true
 ide-index.workspace = true
 ide-syntax.workspace = true
 ide-search.workspace = true

crates/ide-host/src/bin/server.rs

@@ -78,6 +78,11 @@ async fn run(base: PathBuf) -> i32 {
             None
         }
     };
+    if let Some(root) = std::env::var_os(ide_host::trust::TRUSTED_ROOT_ENV)
+        && let Err(e) = host.trust.inherit(std::path::Path::new(&root))
+    {
+        tracing::warn!("cannot trust {}: {e}", root.to_string_lossy());
+    }
     tracing::info!("openidea-server {} ready", env!("CARGO_PKG_VERSION"));
     let mut dispatcher = Dispatcher::standard();
     if let Some(plugins) = &plugins {

crates/ide-host/src/environment.rs

@@ -22,6 +22,10 @@ use std::time::Duration;
 
 type Changes = Vec<(OsString, Option<OsString>)>;
 
+/// Set by the desktop when the Dev Containers CLI already ran the lifecycle commands
+/// (`devcontainer up`): the server then doesn't run `postStartCommand` again.
+pub const LIFECYCLE_DONE_ENV: &str = "OPENIDEA_LIFECYCLE_DONE";
+
 /// What Reload Environment changed.
 #[derive(Debug, Clone, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
@@ -72,7 +76,7 @@ impl Environment {
             return None;
         }
         let config = self.load_project(root, sink);
-        let post_start = config.and_then(|c| c.post_start);
+        let post_start = config.and_then(|c| c.post_start).filter(|_| std::env::var_os(LIFECYCLE_DONE_ENV).is_none());
         let first = self.state.lock().post_started.insert(root.to_path_buf());
         post_start.filter(|_| first)
     }

crates/ide-host/src/lib.rs

@@ -223,6 +223,7 @@ impl Host {
             self.cancel_request(request);
         }
         let project = self.projects.write().remove(window)?;
+        project.plugin_diagnostics.close();
         if let Some(plugins) = plugins::editor_plugin_host() {
             plugins.invalidate_client_navigation(&project.root, Some(window), None);
             plugins.set_active_file(window, None);
@@ -373,6 +374,7 @@ impl Host {
         self.terminals.kill_all();
         let projects: Vec<_> = self.projects.write().drain().map(|(_, p)| p).collect();
         for project in &projects {
+            project.plugin_diagnostics.close();
             if let Some(bridge) = &project.kotlin_bridge {
                 bridge.stop();
             }

crates/ide-host/src/ops/build.rs

@@ -17,14 +17,6 @@ fn join_err(e: tokio::task::JoinError) -> IdeError {
     IdeError::internal(e.to_string())
 }
 
-/// `JAVA_HOME`: the project JDK, else the installed JDK matching `release` (none
-/// when the project names no version).
-fn java_env(project_jdk: Option<&ide_sdk::java::Jdk>, release: Option<u32>) -> BTreeMap<String, String> {
-    let jdks = ide_sdk::java::installed_jdks();
-    let jdk = project_jdk.or_else(|| release.and_then(|r| ide_sdk::java::pick_jdk(&jdks, Some(r))));
-    jdk.map(|j| BTreeMap::from([("JAVA_HOME".to_owned(), j.home.to_string_lossy().into_owned())])).unwrap_or_default()
-}
-
 /// The build model with the launch settings applied: the JDK (`JAVA_HOME`), and
 /// the Maven home and options from Settings › Maven.
 pub fn load(root: &Path, cache: &Path, settings: &Settings) -> BuildModel {
@@ -40,7 +32,7 @@ pub fn load(root: &Path, cache: &Path, settings: &Settings) -> BuildModel {
         let mvn = ide_sdk::apply::maven_command(root, settings);
         let options = ide_sdk::apply::maven_options(root, settings);
         for p in &mut m.projects {
-            p.env = java_env(jdk.as_ref(), p.java_version);
+            p.env = ide_sdk::apply::maven_build_env(root, settings, p.java_version);
             if let Some(mvn) = &mvn {
                 p.command = mvn.to_string_lossy().into_owned();
             }
@@ -64,7 +56,11 @@ pub fn load(root: &Path, cache: &Path, settings: &Settings) -> BuildModel {
     if let Some(m) = &mut model.maven
         && m.sync_error.is_some()
     {
-        let hint = m.projects.iter().find_map(|p| missing(p.java_version));
+        let hint = if settings.languages.java.maven.runner_jre.trim().is_empty() {
+            m.projects.iter().find_map(|p| missing(p.java_version))
+        } else {
+            None
+        };
         explain(&mut m.sync_error, hint);
     }
     for g in &mut model.gradle {
@@ -625,7 +621,7 @@ pub(crate) fn register(d: &mut Dispatcher) {
 }
 
 #[cfg(test)]
-mod gradle_settings_tests {
+mod build_tool_settings_tests {
     use super::*;
 
     #[test]
@@ -710,6 +706,34 @@ mod gradle_settings_tests {
         }
     }
 
+    #[test]
+    fn model_for_maven_sync_goals_and_compile_uses_runner_jre() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = dunce::canonicalize(tmp.path()).unwrap();
+        std::fs::write(root.join("pom.xml"),
+            r#"<project><modelVersion>4.0.0</modelVersion><groupId>test</groupId><artifactId>app</artifactId><version>1</version></project>"#
+        ).unwrap();
+        for name in ["project-jdk", "runner-jdk"] {
+            let home = root.join(name);
+            std::fs::create_dir_all(home.join("bin")).unwrap();
+            std::fs::write(home.join("bin").join(if cfg!(windows) { "java.exe" } else { "java" }), "").unwrap();
+            std::fs::write(home.join("release"), "JAVA_VERSION=\"21\"\n").unwrap();
+        }
+        let mut settings = Settings::default();
+        settings.languages.java.jdk = "project-jdk".into();
+        for runner in ["", "runner-jdk"] {
+            settings.languages.java.maven.runner_jre = runner.into();
+            let expected = root.join(if runner.is_empty() { "project-jdk" } else { runner });
+            let model = load(&root, &root.join("cache"), &settings);
+            assert_eq!(model.maven.as_ref().unwrap().projects[0].env["JAVA_HOME"], expected.to_string_lossy());
+            let plan = compile::plan(&root, &model, BuildKind::Build, None, None).unwrap();
+            assert!(!plan.steps.is_empty());
+            for step in plan.steps {
+                assert_eq!(step.env["JAVA_HOME"], expected.to_string_lossy());
+            }
+        }
+    }
+
     #[test]
     fn model_for_sync_tasks_and_compile_uses_gradle_settings() {
         let tmp = tempfile::tempdir().unwrap();

crates/ide-host/src/ops/db.rs

@@ -103,7 +103,8 @@ pub(crate) fn register(d: &mut Dispatcher) {
     d.add("db_explain", |c| async move {
         let (request, id, statement) =
             (c.arg::<RequestId>("request")?, c.arg::<String>("id")?, c.arg::<String>("statement")?);
-        explain(&c.host, &c.window, request, &id, &statement).await
+        let schema = c.arg::<Option<String>>("schema")?;
+        explain(&c.host, &c.window, request, &id, &statement, schema.as_deref()).await
     });
     d.add("db_history", |c| async move {
         let id = c.arg::<String>("id")?;
@@ -130,7 +131,8 @@ pub(crate) fn register(d: &mut Dispatcher) {
             c.arg::<Option<u32>>("skip")?.unwrap_or(0),
             c.arg::<u32>("maxRows")?,
         );
-        execute(&c.host, &c.window, request, &id, statements, skip, max_rows).await
+        let schema = c.arg::<Option<String>>("schema")?;
+        execute(&c.host, &c.window, request, &id, statements, skip, max_rows, schema.as_deref()).await
     });
     d.add("db_table_page", |c| async move {
         let (request, id, schema, table) = (
@@ -289,10 +291,11 @@ pub async fn explain(
     request: RequestId,
     id: &str,
     statement: &str,
+    schema: Option<&str>,
 ) -> IdeResult<Vec<PlanNode>> {
     let db = host.project(window)?.db.clone();
     let cancel = host.begin_request(request);
-    let result = db.explain(id, statement, &cancel).await;
+    let result = db.explain(id, statement, &cancel, schema).await;
     host.end_request(request);
     result
 }
@@ -327,7 +330,9 @@ pub fn statements(host: &Host, window: &str, id: &str, text: &str, from: u32, to
 
 /// Runs `statements` in order on data source `id`, stopping at the first
 /// error. Each result reads past its first `skip` rows (a later page) and keeps
-/// `max_rows`. Cancel with `cancel_request(request)`.
+/// `max_rows`. `schema` is the console's active context: the connection running
+/// each statement is put in it first. Cancel with `cancel_request(request)`.
+#[allow(clippy::too_many_arguments)]
 pub async fn execute(
     host: &Host,
     window: &str,
@@ -336,12 +341,13 @@ pub async fn execute(
     statements: Vec<SqlStatement>,
     skip: u32,
     max_rows: u32,
+    schema: Option<&str>,
 ) -> IdeResult<Vec<StatementOutcome>> {
     let db = host.project(window)?.db.clone();
     let cancel = host.begin_request(request);
     let mut out = Vec::new();
     for statement in statements {
-        match db.execute_from(id, &statement.text, skip as usize, max_rows.max(1) as usize, &cancel).await {
+        match db.execute_from(id, &statement.text, skip as usize, max_rows.max(1) as usize, &cancel, schema).await {
             Ok(result) => out.push(StatementOutcome { statement, result: Some(result), error: None }),
             Err(e) if e.kind == ide_core::error::ErrorKind::Cancelled => {
                 host.end_request(request);

crates/ide-host/src/ops/debug.rs

@@ -28,9 +28,11 @@ pub async fn debug_start(host: &Host, window: &str, config: LaunchConfig) -> Ide
         let settings = settings.clone();
         config = host
             .blocking(move || {
-                ide_sdk::go::debug_environment(&root, &settings, &mut config.env);
+                ide_sdk::go::configure_environment(&root, &settings, &mut config.env);
                 ide_sdk::go::apply_to_debug(
                     &mut config.env,
+                    &mut config.program,
+                    &mut config.args,
                     &mut config.extra_json,
                     &settings.languages.go.build_tags,
                 )?;

crates/ide-host/src/ops/dependencies.rs

@@ -1,7 +1,11 @@
 //! Repository version lookups for manifest inspections and completion.
 use crate::{Host, rpc::Dispatcher};
 use ide_core::{CancellationToken, DocId, IdeError, IdeResult, RequestId};
-use ide_workspace::dependencies::{DependencyVersionSource, DependencyVersions, cargo};
+use ide_workspace::dependencies::{DependencyVersionSource, DependencyVersions, cargo, go};
+use std::collections::BTreeMap;
+use std::hash::{DefaultHasher, Hash, Hasher};
+use std::path::{Path, PathBuf};
+use std::process::Command;
 
 struct CratesIo;
 impl DependencyVersionSource for CratesIo {
@@ -21,6 +25,76 @@ impl DependencyVersionSource for CratesIo {
     }
 }
 
+struct GoModules {
+    root: PathBuf,
+    env: BTreeMap<String, String>,
+}
+
+impl DependencyVersionSource for GoModules {
+    fn id(&self) -> &'static str {
+        "go-modules"
+    }
+
+    fn cache_key(&self, package: &str) -> Option<String> {
+        let mut hash = DefaultHasher::new();
+        (&self.root, &self.env, package).hash(&mut hash);
+        Some(format!("{}-{:016x}", self.id(), hash.finish()))
+    }
+
+    fn fetch(&self, package: &str, cancel: &CancellationToken) -> IdeResult<Vec<String>> {
+        let search =
+            self.env.get("PATH").map(std::ffi::OsString::from).unwrap_or_else(ide_core::tool_path::search_path);
+        let go = ide_core::tool_path::find_command("go", &search, &self.root)
+            .ok_or_else(|| IdeError::unavailable("Go SDK is unavailable"))?;
+        // A partially edited go.mod is often invalid. Query outside it while
+        // keeping the SDK and proxy/private module configuration.
+        let dir = tempfile::tempdir()?;
+        let mut cmd = Command::new(go);
+        cmd.current_dir(dir.path())
+            .env("PATH", search)
+            .envs(&self.env)
+            .env("GO111MODULE", "on")
+            .env("GOFLAGS", "")
+            .env("GOWORK", "off")
+            .env("GIT_TERMINAL_PROMPT", "0")
+            .args(["list", "-m", "-versions", "-f", "{{range .Versions}}{{println .}}{{end}}", "--", package]);
+        let query = cancel.child_token();
+        // Fetches run on Host::blocking's Tokio pool, which keeps a runtime current.
+        let deadline = tokio::spawn({
+            let query = query.clone();
+            async move {
+                tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+                query.cancel();
+            }
+        });
+        let output = ide_tools::run_streamed(cmd, &query, &|_| {});
+        deadline.abort();
+        Ok(go::listed_versions(&output?))
+    }
+}
+
+#[cfg(all(test, unix))]
+#[path = "dependencies/go_tests.rs"]
+mod go_tests;
+
+fn go_source(project: &crate::Project, config_dir: &Path, path: &Path) -> IdeResult<GoModules> {
+    let member = ide_workspace::workspace::Workspace::load(&project.root)?.and_then(|workspace| {
+        workspace
+            .projects
+            .into_iter()
+            .filter(|root| path.starts_with(root))
+            .max_by_key(|root| root.components().count())
+    });
+    let settings = match &member {
+        Some(root) => ide_workspace::SettingsStore::load(config_dir, Some(root)).effective(),
+        None => project.settings.effective(),
+    };
+    let root = member.unwrap_or_else(|| project.root.clone());
+    let mut env = BTreeMap::new();
+    ide_sdk::go::configure_environment(&root, &settings, &mut env);
+    Ok(GoModules { root, env })
+}
+
 /// `offset` limits a completion request to its version string; inspections omit it.
 pub async fn dependency_versions(
     host: &Host,
@@ -31,11 +105,24 @@ pub async fn dependency_versions(
 ) -> IdeResult<Vec<DependencyVersions>> {
     let project = host.project(window)?;
     let cache = host.dependency_versions.clone();
-    let cancel = host.begin_request(request);
+    let config_dir = host.config_dir.clone();
+    let cancel = host.begin_project_read_request(window, request);
     let result = host
         .blocking(move || {
             let snap = project.documents.snapshot(doc)?;
-            if snap.large || snap.read_only || snap.path.file_name().is_none_or(|n| n != "Cargo.toml") {
+            if snap.large || snap.read_only {
+                return Ok(Vec::new());
+            }
+            if snap.path.file_name().is_some_and(|name| name == "go.mod") {
+                let Some(dependency) = offset.and_then(|offset| go::dependency_at(&snap.text, offset)) else {
+                    return Ok(Vec::new());
+                };
+                project.require_trust()?;
+                let source = go_source(&project, &config_dir, snap.path.as_ref())?;
+                let versions = cache.versions(&source, &dependency.package, &cancel)?;
+                return Ok(vec![DependencyVersions { dependency, versions, update: None }]);
+            }
+            if snap.path.file_name().is_none_or(|name| name != "Cargo.toml") {
                 return Ok(Vec::new());
             }
             let mut out = Vec::new();

crates/ide-host/src/ops/dependencies/go_tests.rs

@@ -0,0 +1,107 @@
+use super::*;
+use ide_workspace::dependencies::VersionCache;
+use std::os::unix::fs::PermissionsExt;
+use std::time::{Duration, Instant};
+
+fn source(dir: &Path, script: &str) -> GoModules {
+    let bin = dir.join("bin");
+    std::fs::create_dir_all(&bin).unwrap();
+    let go = bin.join("go");
+    std::fs::write(&go, format!("#!/bin/sh\n{script}\n")).unwrap();
+    std::fs::set_permissions(&go, std::fs::Permissions::from_mode(0o755)).unwrap();
+    GoModules {
+        root: dir.to_owned(),
+        env: BTreeMap::from([
+            ("PATH".into(), bin.to_string_lossy().into_owned()),
+            ("PROJECT_ROOT".into(), dir.to_string_lossy().into_owned()),
+            ("GOPROXY".into(), "https://user:[email protected]".into()),
+            ("GOPRIVATE".into(), "private.example/token".into()),
+            ("GOWORK".into(), "broken.work".into()),
+            ("GOFLAGS".into(), "-mod=vendor".into()),
+        ]),
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn go_query_is_isolated_and_persists_only_hashed_configuration_and_versions() {
+    let dir = tempfile::tempdir().unwrap();
+    let source = source(
+        dir.path(),
+        r#"set -eu
+[ "$PWD" != "$PROJECT_ROOT" ]
+[ "$GOPROXY" = 'https://user:[email protected]' ]
+[ "$GOPRIVATE" = 'private.example/token' ]
+[ "$GOWORK" = off ]
+[ "$GOFLAGS" = '' ]
+[ "$GO111MODULE" = on ]
+[ "$GIT_TERMINAL_PROMPT" = 0 ]
+[ "$1 $2 $3 $4" = 'list -m -versions -f' ]
+[ "$5" = '{{range .Versions}}{{println .}}{{end}}' ]
+[ "$6 $7" = '-- example.com/Org/Lib/v2' ]
+printf 'v2.9.0\nv2.10.0\n'"#,
+    );
+    let key = source.cache_key("example.com/Org/Lib/v2").unwrap();
+    assert_ne!(key, source.cache_key("example.com/org/lib/v2").unwrap());
+    let mut other = GoModules { root: source.root.join("member"), env: source.env.clone() };
+    assert_ne!(key, other.cache_key("example.com/Org/Lib/v2").unwrap());
+    other.root = source.root.clone();
+    other.env.insert("GOPROXY".into(), "https://other.example".into());
+    assert_ne!(key, other.cache_key("example.com/Org/Lib/v2").unwrap());
+    let cache_dir = dir.path().join("cache");
+    let disk = cache_dir.clone();
+    let versions = tokio::task::spawn_blocking(move || {
+        VersionCache::new(cache_dir).versions(&source, "example.com/Org/Lib/v2", &CancellationToken::new())
+    })
+    .await
+    .unwrap()
+    .unwrap();
+    assert_eq!(versions, ["v2.10.0", "v2.9.0"]);
+    let entries: Vec<_> = std::fs::read_dir(disk).unwrap().map(Result::unwrap).collect();
+    assert_eq!(entries.len(), 1, "the hashed key passes the cache filename filter");
+    assert_eq!(entries[0].file_name().to_str().unwrap(), format!("{key}.json"));
+    let cached = std::fs::read_to_string(entries[0].path()).unwrap();
+    for sensitive in ["secret", "proxy.example", "private.example", "token", "PROJECT_ROOT"] {
+        assert!(!cached.contains(sensitive), "configuration must not be persisted: {sensitive}");
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn failed_go_queries_are_silent_and_not_persisted() {
+    let dir = tempfile::tempdir().unwrap();
+    let source = source(dir.path(), "echo 'private module or offline proxy' >&2\nexit 1");
+    let cache_dir = dir.path().join("cache");
+    let disk = cache_dir.clone();
+    let versions = tokio::task::spawn_blocking(move || {
+        VersionCache::new(cache_dir).versions(&source, "private.example/module", &CancellationToken::new())
+    })
+    .await
+    .unwrap()
+    .unwrap();
+    assert!(versions.is_empty());
+    assert!(!disk.exists());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn stalled_go_queries_obey_the_deadline_and_parent_cancellation() {
+    for cancel_parent in [false, true] {
+        let dir = tempfile::tempdir().unwrap();
+        let source = source(dir.path(), "exec /bin/sleep 60");
+        let cancel = CancellationToken::new();
+        let query = cancel.clone();
+        let started = Instant::now();
+        let work = tokio::task::spawn_blocking(move || {
+            VersionCache::new(source.root.join("cache")).versions(&source, "example.com/stalled", &query)
+        });
+        if cancel_parent {
+            tokio::time::sleep(Duration::from_millis(150)).await;
+            cancel.cancel();
+            assert!(work.await.unwrap().is_err());
+            assert!(started.elapsed() < Duration::from_secs(3));
+        } else {
+            assert!(work.await.unwrap().unwrap().is_empty());
+            assert!(started.elapsed() >= Duration::from_secs(10));
+            assert!(started.elapsed() < Duration::from_secs(15));
+            assert!(!cancel.is_cancelled(), "a query deadline must not cancel its caller");
+        }
+    }
+}

crates/ide-host/src/ops/java.rs

@@ -91,9 +91,10 @@ async fn resolve_launch(
             }
         }
         info.class_paths = class_paths;
+        apply_library_classpath(&mut info, &project.root, &settings.project_structure.libraries, test);
         let compile_ms = started.elapsed().as_millis() - lsp_ms;
-        // The project JDK, else the JDK jdtls compiles the module against, else one matching its Java version.
-        let project_jdk = ide_sdk::apply::project_jdk(&project.root, &settings);
+        // The module/project JDK, else the JDK jdtls compiles the module against, else one matching its Java version.
+        let project_jdk = ide_sdk::apply::module_jdk(&project.root, &module, &settings);
         let from_jdtls = info.java_home.as_deref().map(ide_sdk::java::java_executable).filter(|p| p.is_file());
         let java = project_jdk.map(|j| ide_sdk::java::java_executable(&j.home)).or(from_jdtls).or_else(|| {
             // The build model's level includes what the module inherits from its parent POMs.
@@ -153,6 +154,41 @@ fn entry_key(path: &str, windows: bool) -> String {
     if windows { key.to_lowercase() } else { key }
 }
 
+fn apply_library_classpath(
+    info: &mut JavaLaunchInfo,
+    root: &std::path::Path,
+    libraries: &[ide_core::settings::ProjectLibrary],
+    test: bool,
+) {
+    use ide_core::settings::DependencyScope;
+    let entries: Vec<_> = libraries
+        .iter()
+        .flat_map(|lib| {
+            let allowed = match lib.scope {
+                DependencyScope::Compile | DependencyScope::Runtime => true,
+                DependencyScope::Test | DependencyScope::Provided => test,
+            };
+            lib.classes.iter().filter_map(move |entry| {
+                ide_sdk::apply::setting_path(root, entry).map(|path| (path.to_string_lossy().into_owned(), allowed))
+            })
+        })
+        .collect();
+    // JDT may already have returned these archives on either classpath.
+    for paths in [&mut info.class_paths, &mut info.module_paths] {
+        paths.retain(|path| {
+            let matching: Vec<_> = entries.iter().filter(|(entry, _)| same_entry(path, entry, cfg!(windows))).collect();
+            matching.is_empty() || matching.iter().any(|(_, allowed)| *allowed)
+        });
+    }
+    for (entry, allowed) in entries {
+        if allowed
+            && !info.class_paths.iter().chain(&info.module_paths).any(|path| same_entry(path, &entry, cfg!(windows)))
+        {
+            info.class_paths.push(entry);
+        }
+    }
+}
+
 fn same_entry(a: &str, b: &str, windows: bool) -> bool {
     a == b || entry_key(a, windows) == entry_key(b, windows)
 }
@@ -220,6 +256,36 @@ pub(crate) fn register(d: &mut Dispatcher) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn library_scopes_filter_jdt_classpaths_and_module_paths() {
+        use ide_core::settings::{DependencyScope, ProjectLibrary};
+        let root = tempfile::tempdir().unwrap();
+        let scopes =
+            [DependencyScope::Compile, DependencyScope::Runtime, DependencyScope::Test, DependencyScope::Provided];
+        let libraries: Vec<_> = scopes
+            .iter()
+            .enumerate()
+            .map(|(i, scope)| ProjectLibrary {
+                classes: vec![format!("lib/{i}.jar")],
+                scope: *scope,
+                ..Default::default()
+            })
+            .collect();
+        let paths: Vec<_> =
+            (0..4).map(|i| root.path().join(format!("lib/{i}.jar")).to_string_lossy().into_owned()).collect();
+        for test in [false, true] {
+            let mut info =
+                JavaLaunchInfo { class_paths: paths.clone(), module_paths: paths.clone(), ..Default::default() };
+            apply_library_classpath(&mut info, root.path(), &libraries, test);
+            let expected = if test { &paths[..] } else { &paths[..2] };
+            assert_eq!(info.class_paths, expected);
+            assert_eq!(info.module_paths, expected);
+        }
+        let mut info = JavaLaunchInfo::default();
+        apply_library_classpath(&mut info, root.path(), &libraries, false);
+        assert_eq!(info.class_paths, &paths[..2]);
+    }
+
     /// JDT LS and our build model spell a module output differently on Windows; the
     /// snapshot must still replace it, or resources (MyBatis mapper XML) load twice.
     #[test]

crates/ide-host/src/ops/lsp.rs

@@ -7,6 +7,7 @@ use ide_core::error::ErrorKind;
 use ide_core::{DocId, IdeResult, Location, Pos, Range, RequestId, ServerId, TextEdit, WorkspaceEdit};
 use ide_lsp::types::*;
 use ide_plugin::ProviderDocument;
+use std::path::Path;
 
 async fn prepare_actions(
     project: std::sync::Arc<crate::Project>,
@@ -85,7 +86,12 @@ const PLUGIN_SERVER: ServerId = ServerId(0);
 #[derive(serde::Serialize, serde::Deserialize)]
 struct PluginActionRef {
     plugin: String,
-    data: String,
+    data: Option<String>,
+    /// Opened once the action is applied.
+    open: Option<ide_core::IpcPath>,
+    /// Listed by the plugin's `file-actions` export, which resolves it.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    file: bool,
 }
 
 /// A plugin's `completion-item.kind` (wit/providers.wit lists them).
@@ -195,9 +201,24 @@ pub async fn lsp_hover(
 ) -> IdeResult<Option<Hover>> {
     let lsp = host.project(window)?.lsp.clone();
     let cancel = host.begin_request(request);
-    let result = lsp.hover(doc, pos, cancel).await;
+    let Some((plugins, d)) = plugin_providers(host, window, doc, ProviderKind::Hover) else {
+        let result = lsp.hover(doc, pos, cancel).await;
+        host.end_request(request);
+        return result;
+    };
+    let (result, hovers) =
+        tokio::join!(lsp.hover(doc, pos, cancel), plugin_call(move || plugins.provide_hover(&d, pos)));
     host.end_request(request);
-    result
+    let hovers = hovers.unwrap_or_default();
+    if hovers.is_empty() {
+        return result;
+    }
+    let server = match result {
+        Ok(server) => server,
+        Err(e) if matches!(e.kind, ErrorKind::NotFound | ErrorKind::Unavailable) => None,
+        Err(e) => return Err(e),
+    };
+    Ok(crate::plugins::merge_hover(server, hovers))
 }
 
 pub async fn lsp_signature_help(host: &Host, window: &str, doc: DocId, pos: Pos) -> IdeResult<Option<SignatureHelp>> {
@@ -428,7 +449,7 @@ pub async fn lsp_code_actions(
     };
     let plugin_actions: Vec<CodeAction> = plugin_actions
         .into_iter()
-        .map(|(plugin, a)| plugin_code_action(&plugin, a))
+        .map(|(plugin, a)| plugin_code_action(&plugin, &project.root, a))
         .filter(|a| {
             only.is_empty()
                 || a.kind.as_ref().is_some_and(|k| only.iter().any(|o| k == o || k.starts_with(&format!("{o}."))))
@@ -444,23 +465,26 @@ pub async fn lsp_code_actions(
     prepare_actions(project, doc, version, actions).await
 }
 
-fn plugin_code_action(plugin: &str, a: ide_plugin::CodeAction) -> CodeAction {
-    // With `data` and no edits, the plugin computes them when the action is picked.
-    let lazy = a.edits.is_empty() && a.data.is_some();
-    let files: Vec<_> = a
-        .edits
-        .into_iter()
-        .map(|(path, edits)| ide_core::FileEdit::Edit { path: path.into(), edits, version: None })
-        .collect();
-    let data = a
-        .data
-        .filter(|_| lazy)
-        .and_then(|data| serde_json::to_value(PluginActionRef { plugin: plugin.to_owned(), data }).ok());
+fn plugin_code_action(plugin: &str, root: &Path, a: ide_plugin::CodeAction) -> CodeAction {
+    // With `data` and nothing to apply, the plugin computes the edits when the action is picked.
+    let lazy = a.edits.is_empty() && a.operations.is_empty() && a.data.is_some();
+    let (files, open, disabled_reason) = match plugin_file_edits(root, &a) {
+        Ok((files, open)) => (files, open, None),
+        Err(reason) => (Vec::new(), None, Some(reason)),
+    };
+    let data = (lazy || open.is_some())
+        .then(|| PluginActionRef {
+            plugin: plugin.to_owned(),
+            data: a.data.filter(|_| lazy),
+            open: open.map(Into::into),
+            file: a.file_action,
+        })
+        .and_then(|r| serde_json::to_value(r).ok());
     CodeAction {
         title: a.title,
         kind: a.kind,
         is_preferred: a.preferred,
-        disabled_reason: None,
+        disabled_reason,
         edit: (!lazy).then(|| WorkspaceEdit { files, preconditions: Vec::new() }),
         command: None,
         data,
@@ -468,6 +492,53 @@ fn plugin_code_action(plugin: &str, a: ide_plugin::CodeAction) -> CodeAction {
     }
 }
 
+/// The action's file operations, then its text edits, as one workspace edit's files, and the
+/// file to open. An action with file operations or an `open` target stays inside the project
+/// root as a whole: a path outside it disables the action.
+fn plugin_file_edits(
+    root: &Path,
+    a: &ide_plugin::CodeAction,
+) -> Result<(Vec<ide_core::FileEdit>, Option<std::path::PathBuf>), String> {
+    use ide_core::FileEdit;
+    use ide_plugin::FileOperation;
+    let confine = !a.operations.is_empty() || a.open.is_some();
+    let confined = |path: &Path| ide_plugin::resolve_new_in_root(root, &path.to_string_lossy());
+    let mut files = Vec::new();
+    let mut created_with_text = Vec::new();
+    for operation in &a.operations {
+        match operation {
+            FileOperation::Create { path, text, overwrite } => {
+                let path = confined(path)?;
+                files.push(FileEdit::Create { path: path.clone().into(), overwrite: *overwrite });
+                if !text.is_empty() {
+                    let start = Range::point(Pos::new(0, 0));
+                    files.push(FileEdit::Edit {
+                        path: path.clone().into(),
+                        edits: vec![TextEdit { range: start, new_text: text.clone() }],
+                        version: None,
+                    });
+                    created_with_text.push(path);
+                }
+            }
+            FileOperation::Rename { from, to } => {
+                files.push(FileEdit::Rename { from: confined(from)?.into(), to: confined(to)?.into() });
+            }
+            FileOperation::Delete { path } => {
+                files.push(FileEdit::Delete { path: confined(path)?.into(), recursive: false });
+            }
+        }
+    }
+    for (path, edits) in &a.edits {
+        let path = if confine { confined(path)? } else { path.clone() };
+        if created_with_text.contains(&path) {
+            return Err("put the text of a created file in its `create`, not in an edit".into());
+        }
+        files.push(FileEdit::Edit { path: path.into(), edits: edits.clone(), version: None });
+    }
+    let open = a.open.as_deref().map(confined).transpose()?;
+    Ok((files, open))
+}
+
 /// A code action resolved by whoever offered it: its language server, or
 /// the plugin its `data` names.
 async fn resolve_action(host: &Host, window: &str, doc: DocId, action: CodeAction) -> IdeResult<CodeAction> {
@@ -484,11 +555,16 @@ async fn resolve_action(host: &Host, window: &str, doc: DocId, action: CodeActio
         kind: action.kind.clone(),
         preferred: action.is_preferred,
         edits: Vec::new(),
-        data: Some(r.data),
+        operations: Vec::new(),
+        open: None,
+        data: r.data,
+        file_action: r.file,
     };
     let plugin = r.plugin.clone();
-    let resolved = blocking(move || plugins.resolve_code_action(&plugin, &d, pending)).await?;
-    Ok(plugin_code_action(&r.plugin, ide_plugin::CodeAction { data: None, ..resolved }))
+    let invocation = ide_plugin::Invocation { client: Some(window.to_owned()), ..Default::default() };
+    let resolved = blocking(move || plugins.resolve_code_action(&plugin, &d, pending, invocation)).await?;
+    let root = host.project(window)?.root.clone();
+    Ok(plugin_code_action(&r.plugin, &root, ide_plugin::CodeAction { data: None, ..resolved }))
 }
 
 /// Cancellable code actions with the kinds the servers advertise (Refactor This, refactoring availability).
@@ -511,7 +587,7 @@ pub async fn lsp_code_action_query(
     Ok(result)
 }
 
-/// Resolves a code action's edit without applying it (intention preview).
+/// Resolves a code action's edit without applying it.
 pub async fn lsp_resolve_code_action(
     host: &Host,
     window: &str,
@@ -539,11 +615,15 @@ pub async fn lsp_apply_code_action(host: &Host, window: &str, doc: DocId, action
     } else {
         action
     };
+    if let Some(reason) = &action.disabled_reason {
+        return Err(ide_core::IdeError::invalid(reason.clone()));
+    }
     if let Some(edit) = &action.edit {
         let documents = project.documents.clone();
         let edit = edit.clone();
         blocking(move || apply_edit(&documents, &edit)).await?;
     }
+    open_plugin_action_target(&action, window);
     if let Some(command) = action.command
         && !(action.edit.is_some() && is_client_follow_up(&project, doc, None, &command).await)
     {
@@ -552,6 +632,24 @@ pub async fn lsp_apply_code_action(host: &Host, window: &str, doc: DocId, action
     Ok(())
 }
 
+/// The plugin and the file its action asks to show once applied.
+fn plugin_action_open(action: &CodeAction) -> Option<(String, ide_core::IpcPath)> {
+    if action.server != PLUGIN_SERVER {
+        return None;
+    }
+    let r = action.data.clone().and_then(|d| serde_json::from_value::<PluginActionRef>(d).ok())?;
+    Some((r.plugin, r.open?))
+}
+
+/// Opens the file a plugin's action asked to show, now that the action is applied.
+fn open_plugin_action_target(action: &CodeAction, window: &str) {
+    let (Some((plugin, path)), Some(plugins)) = (plugin_action_open(action), crate::plugins::editor_plugin_host())
+    else {
+        return;
+    };
+    plugins.open_file(&plugin, window, path);
+}
+
 /// A command after a code action's edit that no server provides: what other editors'
 /// extensions do once the edit is applied (vtsls' `_typescript.didOrganizeImports`). The edit
 /// is the action; there is nothing to run.
@@ -662,7 +760,22 @@ pub async fn lsp_format(
 }
 
 pub async fn lsp_inlay_hints(host: &Host, window: &str, doc: DocId, range: Range) -> IdeResult<Vec<InlayHint>> {
-    host.project(window)?.lsp.inlay_hints(doc, range).await
+    let lsp = host.project(window)?.lsp.clone();
+    let Some((plugins, d)) = plugin_providers(host, window, doc, ProviderKind::InlayHints) else {
+        return lsp.inlay_hints(doc, range).await;
+    };
+    let (result, hints) =
+        tokio::join!(lsp.inlay_hints(doc, range), plugin_call(move || plugins.provide_inlay_hints(&d, range)));
+    let hints = hints.unwrap_or_default();
+    if hints.is_empty() {
+        return result;
+    }
+    let server = match result {
+        Ok(server) => server,
+        Err(e) if matches!(e.kind, ErrorKind::NotFound | ErrorKind::Unavailable) => Vec::new(),
+        Err(e) => return Err(e),
+    };
+    Ok(crate::plugins::merge_inlay_hints(server, hints, range))
 }
 
 pub async fn lsp_semantic_tokens(host: &Host, window: &str, doc: DocId) -> IdeResult<Option<SemanticTokens>> {
@@ -816,6 +929,8 @@ pub async fn lsp_execute_code_action(
             return Err(ide_core::IdeError::cancelled());
         }
         let edited = action.edit.is_some();
+        // A plugin's action may name a file to show once applied; the caller opens it.
+        let open = plugin_action_open(&action).map(|(_, path)| path);
         if let Some(edit) = action.edit {
             let documents = project.documents.clone();
             tokio::task::spawn_blocking(move || apply_edit(&documents, &edit))
@@ -831,7 +946,7 @@ pub async fn lsp_execute_code_action(
                 .execute_action_command(doc, action.server, command, answers, cancel)
                 .await
                 .map(|paths| paths.into_iter().map(ide_core::IpcPath::from).collect()),
-            None => Ok(Vec::new()),
+            None => Ok(open.into_iter().collect()),
         }
     }
     .await;
@@ -995,15 +1110,19 @@ mod tests {
             kind: None,
             preferred: false,
             edits,
+            operations: Vec::new(),
+            open: None,
             data: data.map(str::to_owned),
+            file_action: false,
         };
-        let lazy = plugin_code_action("acme.x", action(Vec::new(), Some("ref")));
+        let root = Path::new("/p");
+        let lazy = plugin_code_action("acme.x", root, action(Vec::new(), Some("ref")));
         assert!(lazy.edit.is_none());
         let r: PluginActionRef = serde_json::from_value(lazy.data.unwrap()).unwrap();
-        assert_eq!((r.plugin.as_str(), r.data.as_str()), ("acme.x", "ref"));
+        assert_eq!((r.plugin.as_str(), r.data.as_deref()), ("acme.x", Some("ref")));
         // With edits, `data` is the plugin's business: applied as is.
         let edit = TextEdit { range: Range::default(), new_text: "x".into() };
-        let eager = plugin_code_action("acme.x", action(vec![("/a".into(), vec![edit])], Some("ref")));
+        let eager = plugin_code_action("acme.x", root, action(vec![("/a".into(), vec![edit])], Some("ref")));
         assert!(eager.edit.is_some() && eager.data.is_none());
     }
 
@@ -1080,6 +1199,83 @@ mod tests {
         assert!(without_generated_helpers(Vec::new()).is_empty());
     }
 
+    #[test]
+    fn a_plugin_action_maps_its_file_operations_before_its_edits_and_stays_in_the_project() {
+        use ide_core::FileEdit;
+        use ide_plugin::FileOperation;
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("proj");
+        std::fs::create_dir_all(&root).unwrap();
+        let root = root.canonicalize().unwrap();
+        let action = |operations: Vec<FileOperation>| ide_plugin::CodeAction {
+            title: "Create view".into(),
+            kind: Some("quickfix".into()),
+            preferred: false,
+            edits: vec![(root.join("a.txt"), vec![TextEdit { range: Range::default(), new_text: "x".into() }])],
+            operations,
+            open: Some(root.join("views/home.html")),
+            data: None,
+            file_action: true,
+        };
+
+        let created = plugin_code_action(
+            "acme.x",
+            &root,
+            action(vec![
+                FileOperation::Create { path: "views/home.html".into(), text: "<h1/>".into(), overwrite: false },
+                FileOperation::Rename { from: root.join("old.txt"), to: root.join("new.txt") },
+                FileOperation::Delete { path: root.join("gone.txt") },
+            ]),
+        );
+        assert_eq!(created.disabled_reason, None);
+        let files = created.edit.unwrap().files;
+        let home = root.join("views/home.html");
+        assert!(matches!(&files[0], FileEdit::Create { path, overwrite: false } if **path == home));
+        assert!(
+            matches!(&files[1], FileEdit::Edit { path, edits, .. } if **path == home && edits[0].new_text == "<h1/>")
+        );
+        assert!(matches!(&files[2], FileEdit::Rename { to, .. } if **to == root.join("new.txt")));
+        assert!(matches!(&files[3], FileEdit::Delete { recursive: false, .. }));
+        assert!(matches!(&files[4], FileEdit::Edit { path, .. } if **path == root.join("a.txt")));
+        let r: PluginActionRef = serde_json::from_value(created.data.unwrap()).unwrap();
+        assert_eq!(r.data, None);
+        assert!(r.file, "resolved by the file-actions export");
+        let opened = r.open.unwrap().to_path_buf();
+        assert!(opened.components().eq(dunce::simplified(&home).components()), "{opened:?}");
+
+        let outside = tmp.path().join("evil.txt");
+        let mut open_outside = action(Vec::new());
+        open_outside.open = Some(outside.clone());
+        assert!(plugin_code_action("acme.x", &root, open_outside).disabled_reason.is_some());
+        let mut edit_outside = action(vec![FileOperation::Delete { path: root.join("gone.txt") }]);
+        edit_outside.edits.push((outside, Vec::new()));
+        assert!(plugin_code_action("acme.x", &root, edit_outside).disabled_reason.is_some());
+        let mut edit_created =
+            action(vec![FileOperation::Create { path: root.join("n.txt"), text: "x".into(), overwrite: false }]);
+        edit_created.edits = vec![(root.join("n.txt"), Vec::new())];
+        assert!(plugin_code_action("acme.x", &root, edit_created).disabled_reason.is_some());
+
+        for outside in [tmp.path().join("evil.txt"), "../evil.txt".into()] {
+            for operation in [
+                FileOperation::Create { path: outside.clone(), text: String::new(), overwrite: false },
+                FileOperation::Rename { from: root.join("old.txt"), to: outside.clone() },
+                FileOperation::Delete { path: outside.clone() },
+            ] {
+                let rejected = plugin_code_action("acme.x", &root, action(vec![operation]));
+                assert!(rejected.disabled_reason.is_some_and(|r| r.contains("outside the project root")));
+                assert!(rejected.edit.unwrap().files.is_empty());
+            }
+        }
+
+        // `data` and nothing to apply: the file-actions export computes it when picked.
+        let mut lazy = action(Vec::new());
+        (lazy.edits, lazy.open, lazy.data) = (Vec::new(), None, Some("ref".into()));
+        let lazy = plugin_code_action("acme.x", &root, lazy);
+        assert!(lazy.edit.is_none());
+        let r: PluginActionRef = serde_json::from_value(lazy.data.unwrap()).unwrap();
+        assert_eq!((r.data.as_deref(), r.file), (Some("ref"), true));
+    }
+
     #[test]
     fn every_completion_kind_the_plugin_api_documents_is_understood() {
         let wit = include_str!("../../../../wit/providers.wit");

crates/ide-host/src/ops/run/commands.rs

@@ -181,6 +181,16 @@ pub async fn run_tomcat_home(host: &Host, window: &str, home: String) -> IdeResu
         .map_err(|e| IdeError::internal(e.to_string()))?
 }
 
+pub async fn run_tomcat_installations(
+    host: &Host,
+    window: &str,
+) -> IdeResult<Vec<ide_run::tomcat::TomcatInstallation>> {
+    host.require_trust(window)?;
+    tokio::task::spawn_blocking(ide_run::tomcat::detect_installations)
+        .await
+        .map_err(|e| IdeError::internal(e.to_string()))
+}
+
 pub async fn run_tomcat_artifacts(host: &Host, window: &str) -> IdeResult<Vec<ide_build::web::WebArtifact>> {
     host.require_trust(window)?;
     let project = host.project(window)?;
@@ -212,7 +222,7 @@ pub async fn run_tomcat_build(host: &Host, window: &str, config: RunConfig) -> I
             &project.root,
             &model,
             id,
-            &ide_run::tomcat::base_dir(&project.cache_dir, &config.id),
+            &ide_run::tomcat::effective_base_dir(&project.root, &project.cache_dir, &config)?,
         )?;
         plan.env.extend(config.env.clone());
         let mut build = RunConfig {
@@ -278,7 +288,7 @@ pub async fn run_tomcat_sync(
         let module = dunce::canonicalize(project.root.join(module))?;
         let class_paths: Vec<_> =
             class_paths.iter().filter_map(|p| dunce::canonicalize(project.root.join(p)).ok()).collect();
-        let base = ide_run::tomcat::base_dir(&project.cache_dir, &config.id);
+        let base = ide_run::tomcat::effective_base_dir(&project.root, &project.cache_dir, &config)?;
         ide_run::tomcat::sync_outputs(&base, &module, &class_paths, resources_only)
     })
     .await
@@ -297,6 +307,7 @@ pub(crate) fn register(d: &mut Dispatcher) {
         run_application_publish(&c.host, &c.window, c.arg("config")?, c.arg("classPaths")?, c.arg("mainClass")?).await
     });
     d.add("run_tomcat_home", |c| async move { run_tomcat_home(&c.host, &c.window, c.arg("home")?).await });
+    d.add("run_tomcat_installations", |c| async move { run_tomcat_installations(&c.host, &c.window).await });
     d.add("run_tomcat_artifacts", |c| async move { run_tomcat_artifacts(&c.host, &c.window).await });
     d.add("run_tomcat_build", |c| async move { run_tomcat_build(&c.host, &c.window, c.arg("config")?).await });
     d.add("run_tomcat_sync", |c| async move {

crates/ide-host/src/ops/run/container.rs

@@ -6,19 +6,32 @@ use ide_core::remote_settings::{RunTarget, RunTargetKind};
 use ide_core::{IdeError, IdeResult};
 use ide_docker::DockerEndpoint;
 use ide_remote::docker::{
-    ContainerRun, compose_container_root, container_config, container_name, default_container_root,
+    ContainerDebug, ContainerRun, DEBUG_BOOTSTRAP, DEBUG_BOOTSTRAP_NAME, compose_container_root, container_config,
+    container_name, default_container_root,
 };
 use ide_run::RunConfig;
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 
+/// Set by the Debug action on a configuration that runs on a container target: the
+/// program starts under debugpy and waits for the debugger.
+const DEBUG_PARAM: &str = "containerDebug";
+
 /// `config` rewritten to run in a new container of `target`'s image or service.
 pub(super) async fn prepare(host: &Host, root: &Path, target: RunTarget, config: RunConfig) -> IdeResult<RunConfig> {
     if config.kind == "dotnet" || config.kind == "dotnet-test" {
         return Err(IdeError::invalid(".NET Project requires the local machine"));
     }
+    let debug = config.extras.params.get(DEBUG_PARAM).is_some_and(|v| v == "true");
+    if debug && config.debug_adapter.as_deref() != Some("debugpy") {
+        return Err(IdeError::invalid(format!(
+            "'{}' can't be debugged in a container: only Python run configurations can",
+            config.name
+        )));
+    }
     let endpoint = endpoint(&host.data_dir, &target)?;
     let root = root.to_path_buf();
+    let data_dir = host.data_dir.clone();
     host.blocking(move || {
         if !ide_docker::endpoint_is_local(&endpoint)? {
             return Err(IdeError::invalid(format!(
@@ -39,6 +52,7 @@ pub(super) async fn prepare(host: &Host, root: &Path, target: RunTarget, config:
         };
         let file_env = env_files(&root, &config)?;
         let name = container_name(&config.id, &unique());
+        let debugging = if debug { Some(Debugging::prepare(&data_dir)?) } else { None };
         container_config(
             &config,
             &ContainerRun {
@@ -50,12 +64,45 @@ pub(super) async fn prepare(host: &Host, root: &Path, target: RunTarget, config:
                 file_env: &file_env,
                 name: &name,
                 user: user(&root, &target),
+                debug: debugging.as_ref().map(|d| ContainerDebug {
+                    port: d.port,
+                    bootstrap_dir: &d.bootstrap_dir,
+                    debugpy: d.debugpy.as_deref(),
+                }),
             },
         )
     })
     .await
 }
 
+/// What a debug run mounts and publishes.
+struct Debugging {
+    port: u16,
+    bootstrap_dir: PathBuf,
+    debugpy: Option<PathBuf>,
+}
+
+impl Debugging {
+    fn prepare(data_dir: &Path) -> IdeResult<Self> {
+        // The bootstrap is (re)written on each run, so it matches this version of the IDE.
+        let bootstrap_dir = data_dir.join("container-debug");
+        std::fs::create_dir_all(&bootstrap_dir)?;
+        std::fs::write(bootstrap_dir.join(DEBUG_BOOTSTRAP_NAME), DEBUG_BOOTSTRAP)?;
+        // The managed install the local debugger falls back to (`ide_dap::adapter::prepare_debugpy`).
+        let tools = ide_dap::adapter::tools_root().unwrap_or_else(|| ide_tools::tools_dir(data_dir));
+        let lib = ide_tools::python_lib_dir(&tools, ide_dap::adapter::DEBUGPY_TOOL);
+        let debugpy = lib.join("debugpy").join("__init__.py").is_file().then_some(lib);
+        Ok(Self { port: free_port()?, bootstrap_dir, debugpy })
+    }
+}
+
+/// A port nobody listens on here: debugpy listens on the same port in the container,
+/// published on the loopback interface.
+fn free_port() -> IdeResult<u16> {
+    let listener = std::net::TcpListener::bind(("127.0.0.1", 0))?;
+    Ok(listener.local_addr()?.port())
+}
+
 /// The target's Docker connection (Services tool window), by id; none = the CLI's daemon.
 fn endpoint(data_dir: &Path, target: &RunTarget) -> IdeResult<DockerEndpoint> {
     let id = target.docker_connection.trim();

crates/ide-host/src/ops/sdk.rs

@@ -149,25 +149,56 @@ pub async fn sdk_php_composer_install(
 
 /// SDK / library source folders shown under "External Libraries" in the Project view,
 /// with the Maven / Gradle dependency jars of the build model.
-pub async fn sdk_project_libraries(host: &Host, window: &str) -> IdeResult<Vec<ide_sdk::libraries::LibraryGroup>> {
+pub async fn sdk_project_libraries(
+    host: &Host,
+    window: &str,
+    request: RequestId,
+    on_groups: Channel<Vec<ide_sdk::libraries::LibraryGroup>>,
+) -> IdeResult<Vec<ide_sdk::libraries::LibraryGroup>> {
     host.require_trust(window)?;
     let project = host.project(window)?;
     let (root, cache, settings) = (project.root.clone(), project.build_cache_dir(), project.settings.effective());
-    tokio::task::spawn_blocking(move || {
-        let model = crate::ops::build::load(&root, &cache, &settings);
-        let deps: Vec<ide_sdk::libraries::BuildDependency> = ide_build::dependency_coordinates(&root, &model)
-            .into_iter()
-            .map(|c| ide_sdk::libraries::BuildDependency {
-                gradle: c.gradle,
-                group: c.group_id,
-                artifact: c.artifact_id,
-                version: c.version,
+    let cancel = host.begin_project_request(window, request);
+    let libraries = {
+        let (root, settings, cancel, on_groups) = (root.clone(), settings.clone(), cancel.clone(), on_groups.clone());
+        tokio::task::spawn_blocking(move || {
+            ide_sdk::libraries::project_libraries_stream(&root, &settings, &[], &cancel, &|groups| {
+                let _ = on_groups.send(groups);
             })
-            .collect();
-        ide_sdk::libraries::project_libraries(&root, &settings, &deps)
-    })
-    .await
-    .map_err(join_err)
+        })
+    };
+    let dependencies = {
+        let cancel = cancel.clone();
+        tokio::task::spawn_blocking(move || {
+            if cancel.is_cancelled() {
+                return Vec::new();
+            }
+            let model = crate::ops::build::load(&root, &cache, &settings);
+            let deps: Vec<ide_sdk::libraries::BuildDependency> = ide_build::dependency_coordinates(&root, &model)
+                .into_iter()
+                .map(|c| ide_sdk::libraries::BuildDependency {
+                    gradle: c.gradle,
+                    group: c.group_id,
+                    artifact: c.artifact_id,
+                    version: c.version,
+                })
+                .collect();
+            if cancel.is_cancelled() {
+                return Vec::new();
+            }
+            let groups = ide_sdk::libraries::dependency_groups(&root, &settings, &deps);
+            if !cancel.is_cancelled() {
+                let _ = on_groups.send(groups.clone());
+            }
+            groups
+        })
+    };
+    let (libraries, dependencies) = tokio::join!(libraries, dependencies);
+    host.end_request(request);
+    if cancel.is_cancelled() {
+        return Err(IdeError::cancelled());
+    }
+    Ok(ide_sdk::libraries::merge_groups([libraries.map_err(join_err)?, dependencies.map_err(join_err)?].concat()))
 }
 
 /// Looks up `names` (bare command names): `node_modules/.bin` above `near`, then the search path.
@@ -268,7 +299,9 @@ pub(crate) fn register(d: &mut Dispatcher) {
         "sdk_php_composer_install",
         |c| async move { sdk_php_composer_install(&c.host, &c.window, c.arg("path")?).await },
     );
-    d.add("sdk_project_libraries", |c| async move { sdk_project_libraries(&c.host, &c.window).await });
+    d.add("sdk_project_libraries", |c| async move {
+        sdk_project_libraries(&c.host, &c.window, c.arg("request")?, c.sender("onGroups")?).await
+    });
     d.add("sdk_locate_tools", |c| async move {
         sdk_locate_tools(&c.host, &c.window, c.arg("names")?, c.arg("near")?).await
     });

crates/ide-host/src/plugins/commit.rs

@@ -0,0 +1,28 @@
+//! The Commit view's side of the `commit` API, as the window commands
+//! `plugin_answer_commit` / `plugin_commit_checks` serve it — the desktop for
+//! local projects, `openidea-server` for remote ones.
+
+use super::{CommitSelection, PluginCommitCheckRef, PluginCommitCheckResult, PluginHost};
+use ide_core::{IdeError, IdeResult, RequestId};
+use std::sync::Arc;
+
+/// Runs the plugins' before-commit checks `checks` on what `selection` commits,
+/// until request `request` is cancelled.
+pub async fn commit_checks(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+    selection: CommitSelection,
+    checks: Vec<PluginCommitCheckRef>,
+    request: RequestId,
+) -> IdeResult<Vec<PluginCommitCheckResult>> {
+    host.require_trust(window)?;
+    let invocation = super::views::view_invocation(host, window, None, None)?;
+    let cancel = host.begin_project_read_request(window, request);
+    let result = tokio::task::spawn_blocking(move || plugins.commit_checks(invocation, selection, checks, &cancel))
+        .await
+        .map_err(|e| IdeError::internal(e.to_string()))
+        .and_then(|r| r);
+    host.end_request(request);
+    result
+}

crates/ide-host/src/plugins/diagnostics.rs

@@ -0,0 +1,245 @@
+//! Versioned, project-scoped diagnostics for unsaved editor buffers.
+use super::{PluginHost, ProviderKind, editor_plugin_host};
+use ide_core::{CancellationToken, Diagnostic, DocId, IdeEvent, SharedSink};
+use ide_plugin::ProviderDocument;
+use ide_text::AppliedChange;
+use ide_workspace::documents::DocumentObserver;
+use ide_workspace::{DocumentInfo, Documents};
+use parking_lot::Mutex;
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+use std::sync::{Arc, Weak};
+use std::time::Duration;
+
+const DEBOUNCE: Duration = Duration::from_millis(300);
+
+struct Document {
+    snapshot: ProviderDocument,
+    cancel: CancellationToken,
+    sources: HashSet<String>,
+}
+
+#[derive(Default)]
+pub(super) struct State {
+    closed: bool,
+    documents: HashMap<DocId, Document>,
+    generations: HashMap<String, u64>,
+}
+
+/// One incarnation of one project's documents, shared by all its editors.
+pub(crate) struct Diagnostics {
+    state: Arc<Mutex<State>>,
+    sink: SharedSink,
+    runtime: tokio::runtime::Handle,
+    documents: Weak<Documents>,
+    root: std::path::PathBuf,
+}
+
+impl Diagnostics {
+    pub fn new(
+        sink: SharedSink,
+        runtime: tokio::runtime::Handle,
+        documents: &Arc<Documents>,
+        root: &Path,
+    ) -> Arc<Self> {
+        Arc::new(Self {
+            state: Arc::default(),
+            sink,
+            runtime,
+            documents: Arc::downgrade(documents),
+            root: root.to_path_buf(),
+        })
+    }
+
+    fn emit(&self, path: &Path, plugin: &str, items: Vec<Diagnostic>) {
+        self.sink.emit(IdeEvent::Diagnostics {
+            path: path.to_path_buf().into(),
+            source: format!("plugin-provider:{plugin}"),
+            items,
+        });
+    }
+
+    fn clear_document(&self, doc: &Document) {
+        doc.cancel.cancel();
+        for plugin in &doc.sources {
+            self.emit(&doc.snapshot.path, plugin, Vec::new());
+        }
+    }
+
+    pub fn close(&self) {
+        let mut state = self.state.lock();
+        state.closed = true;
+        for (_, doc) in state.documents.drain() {
+            self.clear_document(&doc);
+        }
+    }
+
+    fn schedule(&self, id: DocId, state: &mut State) {
+        let Some(doc) = state.documents.get_mut(&id) else { return };
+        doc.cancel.cancel();
+        doc.cancel = CancellationToken::new();
+        let Some(host) = editor_plugin_host() else { return };
+        if host.providers.plugins_for(ProviderKind::Diagnostics, &doc.snapshot.language).is_empty() {
+            return;
+        }
+        // Register only once per project incarnation; no project is retained by the host.
+        let weak = Arc::downgrade(&self.state);
+        {
+            let mut projects = host.diagnostic_projects.lock();
+            projects.retain(|(state, _)| state.strong_count() > 0);
+            if !projects.iter().any(|(state, _)| state.ptr_eq(&weak)) {
+                projects.push((weak.clone(), self.sink.clone()));
+            }
+        }
+        let root = self.root.clone();
+        let (mut snapshot, cancel, sink, documents) =
+            (doc.snapshot.clone(), doc.cancel.clone(), self.sink.clone(), self.documents.clone());
+        let lifecycle_generations = state.generations.clone();
+        self.runtime.spawn(async move {
+            tokio::time::sleep(DEBOUNCE).await;
+            if cancel.is_cancelled() || weak.strong_count() == 0 {
+                return;
+            }
+            let _ = tokio::task::spawn_blocking(move || {
+                let Some(documents) = documents.upgrade() else { return };
+                let Ok(current) = documents.snapshot(id) else { return };
+                if u64::from(current.version) != snapshot.version
+                    || current.path.0 != snapshot.path
+                    || current.language.as_str() != snapshot.language
+                    || cancel.is_cancelled()
+                {
+                    return;
+                }
+                snapshot.text = current.text;
+                drop(documents);
+
+                let generations = host.providers.diagnostic_generations(&snapshot.language);
+                let results = if snapshot.text.len() <= super::navigation::MAX_DOCUMENT_BYTES {
+                    host.provide_project_diagnostics(Some(&root), &snapshot, &cancel)
+                } else {
+                    Vec::new()
+                };
+                let Some(state) = weak.upgrade() else { return };
+                let mut state = state.lock();
+                if state.closed || cancel.is_cancelled() {
+                    return;
+                }
+                let matching: HashSet<_> = host
+                    .diagnostic_plugins(Some(&root), &snapshot.language)
+                    .into_iter()
+                    .map(|p| p.id().to_owned())
+                    .filter(|p| lifecycle_generations.get(p) == state.generations.get(p))
+                    .collect();
+                let latest = host.providers.diagnostic_generations(&snapshot.language);
+                let Some(doc) = state.documents.get_mut(&id) else { return };
+                if doc.snapshot.version != snapshot.version || doc.snapshot.path != snapshot.path {
+                    return;
+                }
+                let mut current = HashSet::new();
+                for (plugin, items) in results {
+                    if !matching.contains(&plugin)
+                        || !generations.get(&plugin).is_some_and(|seq| latest.get(&plugin) == Some(seq))
+                    {
+                        continue;
+                    }
+                    current.insert(plugin.clone());
+                    sink.emit(IdeEvent::Diagnostics {
+                        path: snapshot.path.clone().into(),
+                        source: format!("plugin-provider:{plugin}"),
+                        items,
+                    });
+                }
+                for plugin in doc.sources.difference(&current) {
+                    sink.emit(IdeEvent::Diagnostics {
+                        path: snapshot.path.clone().into(),
+                        source: format!("plugin-provider:{plugin}"),
+                        items: Vec::new(),
+                    });
+                }
+                doc.sources = current;
+            })
+            .await;
+        });
+    }
+}
+
+impl DocumentObserver for Diagnostics {
+    fn opened(&self, info: &DocumentInfo) {
+        let mut state = self.state.lock();
+        if state.closed {
+            return;
+        }
+        if let Some(old) = state.documents.remove(&info.id) {
+            self.clear_document(&old);
+        }
+        if info.large || info.uri.is_some() {
+            return;
+        }
+        state.documents.insert(
+            info.id,
+            Document {
+                snapshot: ProviderDocument {
+                    path: info.path.0.clone(),
+                    language: info.language.to_string(),
+                    version: u64::from(info.version),
+                    text: String::new(),
+                },
+                cancel: CancellationToken::new(),
+                sources: HashSet::new(),
+            },
+        );
+        self.schedule(info.id, &mut state);
+    }
+
+    fn changed(&self, id: DocId, path: &Path, version: u32, _: &[AppliedChange], _text: &dyn Fn() -> String) {
+        let mut state = self.state.lock();
+        if state.closed {
+            return;
+        }
+        let Some(doc) = state.documents.get_mut(&id) else { return };
+        if doc.snapshot.path != path {
+            self.clear_document(doc);
+            doc.sources.clear();
+        }
+        doc.snapshot.path = path.to_path_buf();
+        doc.snapshot.version = u64::from(version);
+        self.schedule(id, &mut state);
+    }
+
+    fn closed(&self, id: DocId, _: &Path) {
+        if let Some(doc) = self.state.lock().documents.remove(&id) {
+            self.clear_document(&doc);
+        }
+    }
+}
+
+impl Drop for Diagnostics {
+    fn drop(&mut self) {
+        self.close();
+    }
+}
+
+pub(super) type ProjectState = (Weak<Mutex<State>>, SharedSink);
+
+impl PluginHost {
+    pub(super) fn clear_provider_diagnostics(&self, plugin: &str) {
+        // Clone before taking a project's state lock (edits register in the other order).
+        let projects = self.diagnostic_projects.lock().clone();
+        for (state, sink) in projects {
+            if let Some(state) = state.upgrade() {
+                let mut state = state.lock();
+                // A completed answer can still be waiting for another provider.
+                *state.generations.entry(plugin.to_owned()).or_default() += 1;
+                for doc in state.documents.values_mut() {
+                    if doc.sources.remove(plugin) {
+                        sink.emit(IdeEvent::Diagnostics {
+                            path: doc.snapshot.path.clone().into(),
+                            source: format!("plugin-provider:{plugin}"),
+                            items: Vec::new(),
+                        });
+                    }
+                }
+            }
+        }
+    }
+}

crates/ide-host/src/plugins/endpoints.rs

@@ -0,0 +1,318 @@
+//! `[[contributes.endpoints]]`: HTTP routes a plugin finds in a project. The UI
+//! asks for them (`plugin_endpoints`); the host caches each plugin's list per
+//! project until a file matching its globs changes, then emits `EndpointsChanged`.
+use super::{PluginEvent, PluginHost};
+use ide_core::{IdeResult, ipc_path::to_ipc};
+use ide_extension::{Capability, Package, UiDecl, decode};
+use ide_plugin::{Endpoint, HostError, Invocation};
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::BTreeMap,
+    path::{Path, PathBuf},
+    sync::Arc,
+    time::Duration,
+};
+
+pub(super) const POINT: &str = "endpoints";
+
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct Decl {
+    files: Vec<String>,
+}
+
+pub(super) fn declaration(pkg: &Package, value: toml::Value) -> Result<UiDecl, String> {
+    let d: Decl = decode(POINT, value)?;
+    pkg.manifest.needs_api("contributes.endpoints", 3)?;
+    if pkg.manifest.wasm.is_none() || d.files.is_empty() || d.files.len() > 64 {
+        return Err("contributes.endpoints needs code and 1–64 file globs".into());
+    }
+    for file in &d.files {
+        if file.is_empty()
+            || file.len() > 1024
+            || file.starts_with('/')
+            || file.contains('\\')
+            || file.contains(':')
+            || file.split('/').any(|p| p == "..")
+        {
+            return Err("endpoint file globs must be project-relative".into());
+        }
+        matcher(file).map_err(|e| e.to_string())?;
+    }
+    let key = serde_json::to_string(&d.files).map_err(|e| e.to_string())?;
+    Ok(UiDecl::new(key, "HTTP endpoints", serde_json::to_value(d).map_err(|e| e.to_string())?))
+}
+
+fn matcher(glob: &str) -> Result<globset::GlobMatcher, globset::Error> {
+    Ok(globset::GlobBuilder::new(glob).literal_separator(true).build()?.compile_matcher())
+}
+
+/// A route as the UI gets it.
+#[derive(Clone, Debug, PartialEq, Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginEndpoint {
+    /// `None` accepts any method.
+    pub method: Option<String>,
+    /// Path parameters in braces: `/photos/{id}`.
+    pub path: String,
+    pub framework: String,
+    /// Display name, e.g. `PhotosController#show`.
+    pub handler: Option<String>,
+    /// Where the route is declared.
+    pub location: ide_core::Location,
+}
+
+#[derive(Default)]
+pub(super) struct Endpoints {
+    /// Bumped by every invalidation: a list computed across one is kept but not trusted.
+    epoch: u64,
+    cache: BTreeMap<(String, PathBuf), Cached>,
+}
+
+struct Cached {
+    list: Arc<Vec<PluginEndpoint>>,
+    fresh: bool,
+}
+
+impl PluginHost {
+    /// `plugin`'s routes in the project `root`: the cached list while no file
+    /// matching its globs changed, else computed again. Runs plugin code, so
+    /// call it on a blocking thread. A failed or invalid run keeps the last list.
+    pub fn endpoints(&self, plugin: &str, root: &Path) -> IdeResult<Arc<Vec<PluginEndpoint>>> {
+        let Some(workspace) = self.shared.workspace() else { return Ok(Arc::default()) };
+        let open = |root: &Path| workspace.projects().iter().any(|r| r == root) && workspace.trusted(root);
+        let loaded = self.get(plugin)?;
+        let key = (plugin.to_owned(), root.to_path_buf());
+        let epoch = {
+            let mut state = self.endpoints.lock();
+            state.cache.retain(|(_, r), _| open(r));
+            if !open(root) || !self.endpoint_eligible(&loaded, root) {
+                return Ok(Arc::default());
+            }
+            if let Some(cached) = state.cache.get(&key).filter(|c| c.fresh) {
+                return Ok(cached.list.clone());
+            }
+            state.epoch
+        };
+        let invocation = Invocation { workspace_root: Some(root.to_path_buf()), ..Default::default() };
+        let result = self
+            .code_call(plugin, invocation, "endpoints", |rt, ctx| rt.endpoints(ctx, Duration::from_secs(2)))
+            .and_then(|items| {
+                validate(root, items, &*workspace).map_err(|e| ide_core::IdeError::invalid(e.to_string()))
+            });
+        let mut state = self.endpoints.lock();
+        // Disabled, replaced or closed meanwhile: its routes are gone.
+        let current = self.plugins.read().get(plugin).is_some_and(|p| Arc::ptr_eq(p, &loaded));
+        if !current || !open(root) || !self.endpoint_eligible(&loaded, root) {
+            state.cache.remove(&key);
+            return Ok(Arc::default());
+        }
+        let fresh = state.epoch == epoch;
+        let list = match result {
+            Ok(list) => Arc::new(list),
+            Err(e) => {
+                tracing::warn!(plugin, "endpoints failed: {e}");
+                state.cache.get(&key).map(|c| c.list.clone()).unwrap_or_default()
+            }
+        };
+        state.cache.insert(key, Cached { list: list.clone(), fresh });
+        Ok(list)
+    }
+
+    pub(super) fn clear_plugin_endpoints(&self, plugin: &str) {
+        let mut state = self.endpoints.lock();
+        state.epoch += 1;
+        let roots: Vec<PathBuf> = state.cache.keys().filter(|(id, _)| id == plugin).map(|(_, r)| r.clone()).collect();
+        state.cache.retain(|(id, _), _| id != plugin);
+        drop(state);
+        for root in roots {
+            self.emit(None, PluginEvent::EndpointsChanged { plugin_id: plugin.to_owned(), root: to_ipc(&root).into() });
+        }
+    }
+
+    /// Called by the project's file watcher; doesn't run plugin code.
+    pub fn invalidate_endpoints(&self, root: &Path, paths: &[PathBuf]) {
+        let rel: Vec<&Path> = paths.iter().filter_map(|p| p.strip_prefix(root).ok()).collect();
+        if rel.is_empty() {
+            return;
+        }
+        let declarations = self.ui.items(POINT, None);
+        let mut state = self.endpoints.lock();
+        state.epoch += 1;
+        let mut changed = Vec::new();
+        for ((plugin, project), cached) in &mut state.cache {
+            let matches = project == root
+                && declarations.iter().filter(|d| &d.plugin_id == plugin).any(|d| {
+                    d.decl["files"].as_array().is_some_and(|globs| {
+                        globs
+                            .iter()
+                            .filter_map(|g| matcher(g.as_str()?).ok())
+                            .any(|m| rel.iter().any(|p| m.is_match(p)))
+                    })
+                });
+            if matches && cached.fresh {
+                cached.fresh = false;
+                changed.push(plugin.clone());
+            }
+        }
+        drop(state);
+        for plugin_id in changed {
+            self.emit(None, PluginEvent::EndpointsChanged { plugin_id, root: to_ipc(root).into() });
+        }
+    }
+
+    fn endpoint_eligible(&self, plugin: &super::LoadedPlugin, root: &Path) -> bool {
+        plugin.status().is_live()
+            && plugin.dev_root.as_deref().is_none_or(|r| r == root)
+            && !self.ui.items(POINT, Some(plugin.id())).is_empty()
+            && {
+                let meta = plugin.meta.lock();
+                meta.pending.is_empty() && meta.granted.contains(&Capability::ProjectRead)
+            }
+    }
+}
+
+fn validate(
+    root: &Path,
+    items: Vec<Endpoint>,
+    workspace: &dyn super::PluginWorkspace,
+) -> Result<Vec<PluginEndpoint>, HostError> {
+    if items.len() > 10_000 {
+        return Err(HostError::Invalid("at most 10,000 endpoints".into()));
+    }
+    let mut bytes = 0usize;
+    let mut document_bytes = 0usize;
+    let mut texts: BTreeMap<PathBuf, Vec<usize>> = BTreeMap::new();
+    let mut validated = Vec::with_capacity(items.len());
+    for e in items {
+        bytes += e.path.len()
+            + e.method.as_ref().map_or(0, String::len)
+            + e.framework.len()
+            + e.handler.as_ref().map_or(0, String::len)
+            + e.location.path.as_os_str().len();
+        if bytes > 4 << 20
+            || e.path.len() > 8192
+            || !e.path.starts_with('/')
+            || e.path.chars().any(char::is_whitespace)
+            || e.path.chars().any(char::is_control)
+            || e.method.as_ref().is_some_and(|m| {
+                m.is_empty() || m.len() > 32 || !m.bytes().all(|b| b.is_ascii_uppercase() || b == b'-')
+            })
+            || e.framework.is_empty()
+            || e.framework.len() > 256
+            || e.framework.chars().any(char::is_control)
+            || e.handler.as_ref().is_some_and(|h| h.len() > 1024 || h.chars().any(char::is_control))
+        {
+            return Err(HostError::Invalid("invalid endpoint or batch larger than 4 MiB".into()));
+        }
+        let path = ide_plugin::resolve_in_root(root, &e.location.path.to_string_lossy()).map_err(HostError::Invalid)?;
+        if !texts.contains_key(&path) {
+            let text = workspace
+                .buffer_text(&path)
+                .map(Ok)
+                .unwrap_or_else(|| ide_plugin::read_text(&path).map_err(HostError::Invalid));
+            let text = text?;
+            document_bytes += text.len();
+            if document_bytes > 16 << 20 {
+                return Err(HostError::Invalid("endpoint declaration documents exceed 16 MiB".into()));
+            }
+            texts.insert(
+                path.clone(),
+                text.split('\n').map(|line| line.trim_end_matches('\r').encode_utf16().count()).collect(),
+            );
+        }
+        let lines = &texts[&path];
+        let range = e.location.range;
+        if range.start > range.end
+            || [range.start, range.end]
+                .iter()
+                .any(|p| lines.get(p.line as usize).is_none_or(|len| p.col as usize > *len))
+        {
+            return Err(HostError::Invalid("endpoint location is outside its UTF-16 document range".into()));
+        }
+        validated.push(PluginEndpoint {
+            method: e.method,
+            path: e.path,
+            framework: e.framework,
+            handler: e.handler,
+            location: ide_core::Location { path: to_ipc(&path).into(), range, uri: None },
+        });
+    }
+    Ok(validated)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ide_core::{Pos, Range};
+    struct Workspace;
+    impl super::super::PluginWorkspace for Workspace {
+        fn projects(&self) -> Vec<PathBuf> {
+            vec![]
+        }
+        fn buffer_text(&self, _: &Path) -> Option<String> {
+            None
+        }
+        fn document(&self, _: &Path) -> Option<(u64, String)> {
+            None
+        }
+        fn trusted(&self, _: &Path) -> bool {
+            true
+        }
+        fn project_of(&self, _: &str) -> Option<PathBuf> {
+            None
+        }
+        fn apply_edits(&self, _: &Path, _: u64, _: &[ide_core::TextEdit]) -> Result<u64, HostError> {
+            unreachable!()
+        }
+        fn publish_diagnostics(&self, _: &str, _: &Path, _: Vec<ide_core::Diagnostic>) -> Result<(), HostError> {
+            unreachable!()
+        }
+    }
+    fn endpoint(path: PathBuf) -> Endpoint {
+        Endpoint {
+            method: Some("GET".into()),
+            path: "/users/{id}".into(),
+            framework: "Rails".into(),
+            handler: None,
+            location: ide_plugin::Location { path, range: Range::new(Pos::new(0, 2), Pos::new(0, 3)) },
+        }
+    }
+    #[test]
+    fn validates_entire_rooted_batch_with_utf16_positions() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().canonicalize().unwrap();
+        let file = root.join("routes.rb");
+        std::fs::write(&file, "😀x\n").unwrap();
+        let good = endpoint(file.clone());
+        let items = validate(&root, vec![good.clone()], &Workspace).unwrap();
+        assert_eq!(items[0].location.range.end.col, 3);
+        assert!(items[0].handler.is_none());
+        for bad in [
+            Endpoint { method: Some("GET\nPOST".into()), ..good.clone() },
+            Endpoint { path: "https://example.com".into(), ..good.clone() },
+            Endpoint { path: "/bad\r\nPOST /".into(), ..good.clone() },
+            Endpoint { handler: Some("bad\nhandler".into()), ..good.clone() },
+            Endpoint {
+                location: ide_plugin::Location {
+                    path: file.clone(),
+                    range: Range::new(Pos::new(0, 0), Pos::new(0, 4)),
+                },
+                ..good.clone()
+            },
+            Endpoint {
+                location: ide_plugin::Location { path: root.join("../outside"), range: Range::default() },
+                ..good.clone()
+            },
+        ] {
+            assert!(validate(&root, vec![good.clone(), bad], &Workspace).is_err());
+        }
+        assert!(validate(&root, vec![good.clone(); 10_001], &Workspace).is_err());
+        #[cfg(unix)]
+        {
+            let outside = tempfile::NamedTempFile::new().unwrap();
+            std::os::unix::fs::symlink(outside.path(), root.join("escape")).unwrap();
+            assert!(validate(&root, vec![endpoint(root.join("escape"))], &Workspace).is_err());
+        }
+    }
+}

crates/ide-host/src/plugins/event_paths.rs

@@ -0,0 +1,176 @@
+//! Project-relative event filters, kept with runtime subscriptions across idle reclaim.
+use super::{LoadedPlugin, PluginHost};
+use globset::{GlobBuilder, GlobMatcher};
+use ide_plugin::{EventKind, HostError, WorkbenchEvent};
+use std::{
+    collections::{BTreeSet, HashMap},
+    path::Path,
+};
+
+#[derive(Clone, Default)]
+pub(super) struct Subscriptions {
+    pub kinds: HashMap<String, BTreeSet<EventKind>>,
+    pub paths: HashMap<String, HashMap<String, PathFilter>>,
+}
+
+#[derive(Clone)]
+pub(super) struct PathFilter {
+    pub globs: Vec<String>,
+    matchers: Vec<GlobMatcher>,
+}
+
+impl PathFilter {
+    pub fn new(kind: &str, globs: Vec<String>) -> Result<Self, HostError> {
+        if !matches!(kind, "file-opened" | "file-saved") {
+            return Err(HostError::Invalid("subscribe-paths supports file-opened and file-saved".into()));
+        }
+        if globs.len() > 64 {
+            return Err(HostError::Invalid("at most 64 event path globs".into()));
+        }
+        let mut matchers = Vec::new();
+        for input in &globs {
+            let glob = input.trim_start_matches("./");
+            if glob.is_empty()
+                || input.len() > 1024
+                || glob.starts_with('/')
+                || glob.contains('\\')
+                || glob.contains(':')
+                || glob.chars().any(char::is_control)
+                || glob.split('/').any(|c| c == "..")
+            {
+                return Err(HostError::Invalid(
+                    "event globs must be project-relative paths, at most 1024 bytes each".into(),
+                ));
+            }
+            matchers.push(
+                GlobBuilder::new(glob)
+                    .literal_separator(true)
+                    .build()
+                    .map_err(|e| HostError::Invalid(format!("invalid event glob: {e}")))?
+                    .compile_matcher(),
+            );
+        }
+        Ok(Self { globs, matchers })
+    }
+
+    pub fn matches(&self, root: &Path, path: &Path) -> bool {
+        let path = ide_plugin::resolve_real(path);
+        let root = ide_plugin::resolve_real(root);
+        path.strip_prefix(&root).is_ok_and(|relative| self.matchers.iter().any(|m| m.is_match(relative)))
+    }
+}
+
+impl Subscriptions {
+    pub fn remove(&mut self, plugin: &str) -> bool {
+        self.kinds.remove(plugin).is_some() | self.paths.remove(plugin).is_some()
+    }
+    /// Subscribes to every event of `kind`, dropping its path filter.
+    pub fn set(&mut self, plugin: &str, kind: EventKind) -> bool {
+        let removed = self.paths.get_mut(plugin).is_some_and(|filters| filters.remove(kind.name()).is_some());
+        self.kinds.entry(plugin.to_owned()).or_default().insert(kind) | removed
+    }
+    pub fn set_paths(&mut self, plugin: &str, kind: &str, filter: PathFilter) -> bool {
+        let mut changed = false;
+        if let Some(kind) = EventKind::parse(kind) {
+            changed = self.kinds.entry(plugin.to_owned()).or_default().insert(kind);
+        }
+        let previous = self.paths.entry(plugin.to_owned()).or_default().insert(kind.to_owned(), filter.clone());
+        previous.is_none_or(|old| old.globs != filter.globs) | changed
+    }
+    pub fn unsubscribe(&mut self, plugin: &str, kind: &str) -> bool {
+        let removed = self.paths.get_mut(plugin).is_some_and(|filters| filters.remove(kind).is_some());
+        let off = EventKind::parse(kind)
+            .is_some_and(|kind| self.kinds.get_mut(plugin).is_some_and(|kinds| kinds.remove(&kind)));
+        removed | off
+    }
+}
+
+impl PluginHost {
+    pub(super) fn filter_path_events(
+        &self,
+        plugin: &LoadedPlugin,
+        client: Option<&str>,
+        events: &[WorkbenchEvent],
+        subs: &Subscriptions,
+    ) -> Vec<WorkbenchEvent> {
+        let Some(filters) = subs.paths.get(plugin.id()) else { return events.to_vec() };
+        let workspace = self.shared.workspace();
+        events
+            .iter()
+            .filter(|event| {
+                let path = match event {
+                    WorkbenchEvent::FileOpened(path) | WorkbenchEvent::FileSaved(path) => Path::new(path),
+                    _ => return true,
+                };
+                let Some(filter) = filters.get(event.kind().name()) else { return true };
+                if !path.is_absolute() {
+                    return false;
+                }
+                let Some(workspace) = &workspace else { return false };
+                let root = match client {
+                    Some(client) => workspace.project_of(client),
+                    None => {
+                        let real = ide_plugin::resolve_real(path);
+                        workspace
+                            .projects()
+                            .into_iter()
+                            .filter(|r| real.starts_with(ide_plugin::resolve_real(r)))
+                            .max_by_key(|r| r.components().count())
+                    }
+                };
+                let Some(root) = root else { return false };
+                if plugin.dev_root.as_deref().is_some_and(|r| r != root) {
+                    return false;
+                }
+                filter.matches(&root, path)
+            })
+            .cloned()
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn glob_validation_is_bounded_and_project_relative() {
+        for invalid in ["", "/etc/*", "../*", "a/../b", "C:/a", "a\\b", "a\nb", "["] {
+            assert!(PathFilter::new("file-opened", vec![invalid.into()]).is_err(), "{invalid:?}");
+        }
+        assert!(PathFilter::new("editor-focused", vec!["*".into()]).is_err());
+        assert!(PathFilter::new("file-saved", vec!["*".into(); 65]).is_err());
+        assert!(PathFilter::new("file-saved", vec!["./".repeat(513)]).is_err());
+        assert!(PathFilter::new("file-saved", vec![]).is_ok());
+    }
+
+    #[test]
+    fn matchers_use_or_semantics_and_component_boundaries() {
+        let root = tempfile::tempdir().unwrap();
+        let root = dunce::canonicalize(root.path()).unwrap();
+        let filter = PathFilter::new("file-opened", vec!["./config/*.yaml".into(), "src/**/*.rs".into()]).unwrap();
+        for path in ["config/a.yaml", "src/main.rs", "src/深い/a.rs"] {
+            assert!(filter.matches(&root, &root.join(path)), "{path}");
+        }
+        for path in ["config/nested/a.yaml", "other/a.yaml", "src/a.ts"] {
+            assert!(!filter.matches(&root, &root.join(path)), "{path}");
+        }
+        assert!(!filter.matches(&root, &root.with_extension("other").join("config/a.yaml")));
+        assert!(!PathFilter::new("file-opened", vec![]).unwrap().matches(&root, &root.join("a")));
+    }
+
+    #[test]
+    fn subscriptions_replace_atomically_and_legacy_subscribe_clears_filters() {
+        let mut subs = Subscriptions::default();
+        subs.set_paths("plugin", "file-opened", PathFilter::new("file-opened", vec!["*.rs".into()]).unwrap());
+        assert!(subs.kinds["plugin"].contains(&EventKind::FileOpened));
+        subs.set_paths("plugin", "file-opened", PathFilter::new("file-opened", vec![]).unwrap());
+        assert!(subs.paths["plugin"]["file-opened"].globs.is_empty());
+        subs.set("plugin", EventKind::FileOpened);
+        assert!(subs.paths["plugin"].is_empty());
+        subs.set_paths("plugin", "file-saved", PathFilter::new("file-saved", vec!["*".into()]).unwrap());
+        assert!(subs.unsubscribe("plugin", "file-saved"));
+        assert!(subs.remove("plugin"));
+        assert!(subs.paths.is_empty() && subs.kinds.is_empty());
+    }
+}

crates/ide-host/src/plugins/hover.rs

@@ -0,0 +1,94 @@
+use ide_lsp::types::{Hover, Markup};
+use ide_plugin::PluginHover;
+
+pub(crate) fn merge(server: Option<Hover>, plugin: Vec<PluginHover>) -> Option<Hover> {
+    if plugin.is_empty() {
+        return server;
+    }
+    let mut parts = Vec::with_capacity(plugin.len() + 1);
+    let mut range = None;
+    if let Some(h) = server {
+        range = h.range;
+        if !h.contents.value.trim().is_empty() {
+            parts.push(if h.contents.kind == "markdown" { h.contents.value } else { escape(&h.contents.value) });
+        }
+    }
+    for h in plugin {
+        range = range.or(h.range);
+        parts.push(h.markdown);
+    }
+    Some(Hover { contents: Markup { kind: "markdown".into(), value: parts.join("\n\n---\n\n") }, range })
+}
+
+fn escape(plain: &str) -> String {
+    let mut out = String::with_capacity(plain.len() + plain.len() / 4);
+    for c in plain.chars() {
+        match c {
+            '\n' => out.push_str("  \n"),
+            '\\' | '`' | '*' | '_' | '{' | '}' | '[' | ']' | '<' | '>' | '(' | ')' | '#' | '+' | '-' | '.' | '!'
+            | '|' => {
+                out.push('\\');
+                out.push(c);
+            }
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ide_core::{Pos, Range};
+
+    fn range(line: u32, from: u32, to: u32) -> Range {
+        Range::new(Pos::new(line, from), Pos::new(line, to))
+    }
+
+    fn plugin(markdown: &str, at: Option<Range>) -> PluginHover {
+        PluginHover { markdown: markdown.into(), range: at }
+    }
+
+    fn server(kind: &str, value: &str, at: Option<Range>) -> Hover {
+        Hover { contents: Markup { kind: kind.into(), value: value.into() }, range: at }
+    }
+
+    #[test]
+    fn plugin_content_follows_the_server_hover() {
+        let merged = merge(
+            Some(server("markdown", "```php\nfunction route()\n```", Some(range(3, 4, 9)))),
+            vec![plugin("**orders.index** · `GET /orders`", Some(range(3, 10, 22)))],
+        )
+        .unwrap();
+        assert_eq!(merged.contents.kind, "markdown");
+        assert_eq!(merged.contents.value, "```php\nfunction route()\n```\n\n---\n\n**orders.index** · `GET /orders`");
+        assert_eq!(merged.range, Some(range(3, 4, 9)));
+    }
+
+    #[test]
+    fn without_a_server_hover_the_plugins_answer_alone() {
+        let merged = merge(None, vec![plugin("one", None), plugin("two", Some(range(1, 0, 3)))]).unwrap();
+        assert_eq!(merged.contents.value, "one\n\n---\n\ntwo");
+        assert_eq!(merged.range, Some(range(1, 0, 3)));
+        assert!(merge(None, Vec::new()).is_none());
+    }
+
+    #[test]
+    fn plain_text_from_the_server_keeps_its_characters() {
+        let merged = merge(Some(server("plaintext", "a_b *c*\nd", None)), vec![plugin("x", None)]).unwrap();
+        assert_eq!(merged.contents.value, "a\\_b \\*c\\*  \nd\n\n---\n\nx");
+    }
+
+    #[test]
+    fn an_empty_server_hover_is_left_out() {
+        let merged = merge(Some(server("markdown", "  ", None)), vec![plugin("x", None)]).unwrap();
+        assert_eq!(merged.contents.value, "x");
+    }
+
+    #[test]
+    fn no_plugin_content_keeps_the_server_hover() {
+        let kept = merge(Some(server("plaintext", "a_b", Some(range(0, 0, 1)))), Vec::new()).unwrap();
+        assert_eq!((kept.contents.kind.as_str(), kept.contents.value.as_str()), ("plaintext", "a_b"));
+        assert_eq!(kept.range, Some(range(0, 0, 1)));
+    }
+}

crates/ide-host/src/plugins/icons.rs

@@ -510,6 +510,8 @@ fn check_value(key: &str, value: &str) -> Result<(), String> {
     if lower.contains("javascript:")
         || lower.contains("expression(")
         || lower.contains("@import")
+        // These CSS image/URL functions accept bare strings, bypassing url().
+        || ["image(", "image-set(", "src("].iter().any(|function| lower.contains(function))
         || value.contains('\\')
     {
         return Err("unsafe value".into());
@@ -607,6 +609,10 @@ mod tests {
             r##"<svg><use xlink:href="data:image/svg+xml,..."/></svg>"##,
             r##"<svg><rect style="fill:url(https://evil)"/></svg>"##,
             r##"<svg><rect fill="url( 'http://x' )"/></svg>"##,
+            r##"<svg><rect style="background-image:image-set('https://evil/x.png' 1x)"/></svg>"##,
+            r##"<svg><rect style="background-image:-webkit-image-set('https://evil/x.png' 1x)"/></svg>"##,
+            r##"<svg><rect style="background-image:image('https://evil/x.png')"/></svg>"##,
+            r##"<svg><rect style="fill:src('https://evil/x.svg')"/></svg>"##,
             r##"<!DOCTYPE svg [<!ENTITY x "y">]><svg/>"##,
             r##"<svg><![CDATA[x]]></svg>"##,
             r##"<svg><a href="#x"/></svg>"##,

crates/ide-host/src/plugins/index_ops.rs

@@ -140,6 +140,17 @@ pub async fn plugin_navigation_index(
     result
 }
 
+/// The HTTP routes `plugin_id` reports for this window's project.
+pub async fn plugin_endpoints(
+    host: &crate::Host,
+    plugins: Arc<PluginHost>,
+    window: &str,
+    plugin_id: String,
+) -> IdeResult<Vec<crate::plugins::endpoints::PluginEndpoint>> {
+    let project = host.project(window)?;
+    blocking(move || Ok(plugins.endpoints(&plugin_id, &project.root)?.as_ref().clone())).await
+}
+
 pub async fn plugin_navigation_goto(
     host: &crate::Host,
     plugins: Arc<PluginHost>,

crates/ide-host/src/plugins/inlay_hints.rs

@@ -0,0 +1,94 @@
+use ide_core::Range;
+use ide_lsp::types::{InlayHint, InlayKind};
+use ide_plugin::PluginInlayHint;
+
+pub(crate) fn merge(server: Vec<InlayHint>, plugin: Vec<PluginInlayHint>, range: Range) -> Vec<InlayHint> {
+    let inside = |h: &PluginInlayHint| {
+        let at = (h.position.line, h.position.col);
+        (range.start.line, range.start.col) <= at && at <= (range.end.line, range.end.col)
+    };
+    let mut out = server;
+    out.extend(plugin.into_iter().filter(inside).map(|h| InlayHint {
+        position: h.position,
+        label: h.label,
+        kind: match h.kind.as_str() {
+            "type" => InlayKind::Type,
+            "parameter" => InlayKind::Parameter,
+            _ => InlayKind::Other,
+        },
+        padding_left: h.padding_left,
+        padding_right: h.padding_right,
+        tooltip: h.tooltip,
+        parts: Vec::new(),
+    }));
+    out.sort_by_key(|h| (h.position.line, h.position.col));
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ide_core::Pos;
+
+    fn plugin(line: u32, col: u32, label: &str, kind: &str) -> PluginInlayHint {
+        PluginInlayHint {
+            position: Pos::new(line, col),
+            label: label.into(),
+            kind: kind.into(),
+            tooltip: Some("from the plugin".into()),
+            padding_left: true,
+            padding_right: false,
+        }
+    }
+
+    fn server(line: u32, col: u32, label: &str) -> InlayHint {
+        InlayHint {
+            position: Pos::new(line, col),
+            label: label.into(),
+            kind: InlayKind::Parameter,
+            padding_left: false,
+            padding_right: true,
+            tooltip: None,
+            parts: Vec::new(),
+        }
+    }
+
+    fn summary(hints: &[InlayHint]) -> Vec<(u32, u32, String)> {
+        hints.iter().map(|h| (h.position.line, h.position.col, h.label.clone())).collect()
+    }
+
+    #[test]
+    fn plugin_hints_join_the_servers_in_position_order() {
+        let range = Range::new(Pos::new(0, 0), Pos::new(10, 0));
+        let merged = merge(
+            vec![server(2, 4, "name:"), server(5, 1, "id:")],
+            vec![plugin(3, 9, ": string", "type"), plugin(2, 1, "GET /orders", "other")],
+            range,
+        );
+        assert_eq!(
+            summary(&merged),
+            [
+                (2, 1, "GET /orders".to_owned()),
+                (2, 4, "name:".to_owned()),
+                (3, 9, ": string".to_owned()),
+                (5, 1, "id:".to_owned())
+            ]
+        );
+        let typed = merged.iter().find(|h| h.label == ": string").unwrap();
+        assert!(matches!(typed.kind, InlayKind::Type));
+        assert!(typed.padding_left && !typed.padding_right);
+        assert_eq!(typed.tooltip.as_deref(), Some("from the plugin"));
+    }
+
+    #[test]
+    fn unknown_kinds_are_other_and_hints_outside_the_range_are_dropped() {
+        let range = Range::new(Pos::new(2, 5), Pos::new(4, 3));
+        let merged = merge(
+            Vec::new(),
+            vec![plugin(2, 4, "before", "type"), plugin(3, 0, "in", "route"), plugin(4, 4, "after", "type")],
+            range,
+        );
+        assert_eq!(summary(&merged), [(3, 0, "in".to_owned())]);
+        assert!(matches!(merged[0].kind, InlayKind::Other));
+    }
+}

crates/ide-host/src/plugins/market.rs

@@ -429,6 +429,7 @@ impl PluginHost {
                                 level: ide_plugin::NotificationLevel::Warning,
                                 title: format!("{} was disabled", plugin.manifest().name),
                                 body: format!("The marketplace revoked this plugin: {reason}"),
+                                actions: Vec::new(),
                             },
                         );
                     }

crates/ide-host/src/plugins/mod.rs

@@ -16,11 +16,17 @@
 //! projects) and folders linked with `openidea-plugin link` (`links.json`).
 
 mod api;
+pub mod commit;
+pub(crate) mod diagnostics;
+pub mod endpoints;
+mod event_paths;
+mod hover;
 mod icon_extensions;
 mod icon_patterns;
 mod icon_settings;
 mod icons;
 pub mod index_ops;
+mod inlay_hints;
 mod install;
 pub mod intellij;
 mod market;
@@ -38,9 +44,11 @@ pub mod views;
 pub mod web;
 
 pub use api::{FileSecretStore, HostWorkspace, PluginWorkspace, SecretStore};
+pub(crate) use hover::merge as merge_hover;
 pub use icons::{
     MAX_PLUGIN_ICON, map_asset as icon_theme_map_asset, plugin_icon, sanitize_svg, svg_prefix as icon_theme_svg_prefix,
 };
+pub(crate) use inlay_hints::merge as merge_inlay_hints;
 pub use market::{
     INDEX_FILE as MARKET_INDEX_FILE, MarketPlugin, OFFICIAL_INDEX as OFFICIAL_MARKET_INDEX, OFFICIAL_PUBLISHER,
     read_url as read_market_url, resolve as resolve_market_href,
@@ -318,6 +326,9 @@ pub struct PluginHost {
     /// `[[contributes.providers]]` of enabled plugins.
     providers: Arc<providers::Providers>,
     navigation: Mutex<navigation::NavigationIndex>,
+    endpoints: Mutex<endpoints::Endpoints>,
+    web_ptys: Mutex<BTreeMap<String, Vec<web::WebPtySession>>>,
+    diagnostic_projects: Mutex<Vec<diagnostics::ProjectState>>,
     /// Validated UI declarations of installed packages (start-up reuses them).
     index: Arc<ContributionIndex>,
     ledger: Mutex<Ledger>,
@@ -374,7 +385,8 @@ impl PluginHost {
         let ui = UiStore::new();
         let index = Arc::new(ContributionIndex::new(
             plugins_dir.join(".cache").join("contributions"),
-            env!("CARGO_PKG_VERSION"),
+            // Revalidate SVGs accepted before URL-valued CSS functions were rejected.
+            concat!(env!("CARGO_PKG_VERSION"), ":svg-2"),
         ));
         ui.set_index(Some(index.clone()));
         let languages = PluginLanguages::new();
@@ -407,6 +419,9 @@ impl PluginHost {
             run_detectors,
             providers,
             navigation: Mutex::default(),
+            endpoints: Mutex::default(),
+            web_ptys: Mutex::default(),
+            diagnostic_projects: Mutex::default(),
             index,
             plugins: RwLock::default(),
             state: Mutex::new(state),
@@ -695,6 +710,15 @@ impl PluginHost {
         Ok(self.ui.assets_with_prefix(id, prefix).into_iter().map(|(k, v)| (k, v.to_string())).collect())
     }
 
+    /// The UI language windows run in, as `locale()` reports it to plugin code.
+    pub fn set_ui_locale(&self, tag: &str) {
+        *self.shared.locale.write() = tag.to_owned();
+    }
+
+    pub fn ui_locale(&self) -> String {
+        self.shared.locale.read().clone()
+    }
+
     pub fn set_enabled(&self, id: &str, enabled: bool) -> IdeResult<()> {
         let _guard = self.lifecycle.lock();
         let plugin = self.get(id)?;
@@ -899,6 +923,7 @@ impl PluginHost {
                 level: ide_plugin::NotificationLevel::Warning,
                 title: format!("{name} update rolled back"),
                 body: message.clone(),
+                actions: Vec::new(),
             },
         );
         self.changed();
@@ -1077,8 +1102,7 @@ impl PluginHost {
         })
     }
 
-    /// The Services pane of node `key` of the plugin's `location = "services"`
-    /// view `view`.
+    /// The detail tabs of item `key` of a Services or `detail = true` view.
     pub fn service_detail(
         &self,
         id: &str,
@@ -1086,9 +1110,9 @@ impl PluginHost {
         key: &str,
         invocation: Invocation,
     ) -> IdeResult<Vec<ide_plugin::ServiceTab>> {
-        self.services_view(id, view)?;
+        self.detail_view(id, view)?;
         let (view, key) = (view.to_owned(), key.to_owned());
-        self.code_call(id, invocation, "rendering the service's pane", move |rt, inv| {
+        self.code_call(id, invocation, "rendering the item's detail pane", move |rt, inv| {
             rt.service_detail(&view, &key, inv)
         })
     }
@@ -1144,16 +1168,16 @@ impl PluginHost {
         if declared { Ok(()) } else { Err(IdeError::not_found(format!("plugin {id:?} declares no view {view:?}"))) }
     }
 
-    fn services_view(&self, id: &str, view: &str) -> IdeResult<()> {
-        let services = self
-            .ui
-            .items(ui_points::VIEWS, Some(id))
-            .iter()
-            .any(|i| i.key == view && i.decl["location"].as_str() == Some(ui_points::SERVICES_LOCATION));
-        if services {
+    fn detail_view(&self, id: &str, view: &str) -> IdeResult<()> {
+        let detail = self.ui.items(ui_points::VIEWS, Some(id)).iter().any(|i| {
+            i.key == view
+                && (i.decl["location"].as_str() == Some(ui_points::SERVICES_LOCATION)
+                    || i.decl["detail"].as_bool() == Some(true))
+        });
+        if detail {
             Ok(())
         } else {
-            Err(IdeError::not_found(format!("plugin {id:?} declares no services view {view:?}")))
+            Err(IdeError::not_found(format!("plugin {id:?} declares no detail view {view:?}")))
         }
     }
 
@@ -1346,11 +1370,12 @@ impl PluginHost {
         self.shared.reopen_client(label);
     }
 
-    /// Window `label` closed: drops its context keys and queued events, and ignores
-    /// context writes of commands still running for it.
+    /// Window `label` closed: cancels its prompts, drops its context keys and queued
+    /// events, and ignores context writes of commands still running for it.
     pub fn forget_client(&self, label: &str) {
         self.queues.lock().retain(|(_, client), _| client.as_deref() != Some(label));
         self.shared.forget_client(label);
+        self.forget_web_ptys(label);
     }
 
     /// The user cancelled a plugin task (`task_id` from `TaskStarted`).
@@ -1364,6 +1389,67 @@ impl PluginHost {
         prompt_id.parse().is_ok_and(|id| self.shared.answer_prompt(id, answer))
     }
 
+    /// A window answered a plugin's `CommitRequested`; false when the call no
+    /// longer waits.
+    pub fn answer_commit(&self, request_id: &str, answer: CommitAnswer) -> bool {
+        request_id.parse().is_ok_and(|id| self.shared.answer_commit(id, answer))
+    }
+
+    /// Runs the plugins' before-commit checks `checks` (`(plugin, check)`) on
+    /// what `selection` commits. A check that fails or isn't available is
+    /// reported with `error`, so the commit still stops for it.
+    pub fn commit_checks(
+        &self,
+        invocation: Invocation,
+        selection: CommitSelection,
+        checks: Vec<PluginCommitCheckRef>,
+        cancel: &ide_core::CancellationToken,
+    ) -> IdeResult<Vec<PluginCommitCheckResult>> {
+        let declared = self.ui.items(ui_points::COMMIT_CHECKS, None);
+        let wanted: Vec<_> = checks
+            .into_iter()
+            .filter_map(|c| {
+                let item = declared.iter().find(|i| i.plugin_id == c.plugin_id && i.key == c.check)?;
+                Some((c, item.decl["title"].as_str().unwrap_or_default().to_owned()))
+            })
+            .collect();
+        if wanted.is_empty() {
+            return Ok(Vec::new());
+        }
+        let workspace = self.shared.workspace().ok_or_else(|| IdeError::unavailable("no workspace"))?;
+        let draft = api::commit_draft(&*workspace, selection, cancel).map_err(|e| match e {
+            HostError::Cancelled => IdeError::cancelled(),
+            HostError::Invalid(m) => IdeError::invalid(m),
+            e => IdeError::unavailable(e.to_string()),
+        })?;
+        let mut out = Vec::new();
+        for (c, title) in wanted {
+            if cancel.is_cancelled() {
+                return Err(IdeError::cancelled());
+            }
+            let granted = self
+                .plugins
+                .read()
+                .get(&c.plugin_id)
+                .is_some_and(|p| p.meta.lock().granted.contains(&Capability::VcsRead));
+            let result = if granted {
+                let (check, draft) = (c.check.clone(), draft.clone());
+                self.code_call(&c.plugin_id, invocation.clone(), "checking the commit", move |rt, inv| {
+                    rt.commit_check(&check, draft.clone(), inv)
+                })
+                .map_err(|e| e.message)
+            } else {
+                Err(HostError::Denied(Capability::VcsRead.to_string()).to_string())
+            };
+            let (problems, error) = match result {
+                Ok(problems) => (problems, None),
+                Err(e) => (Vec::new(), Some(e)),
+            };
+            out.push(PluginCommitCheckResult { plugin_id: c.plugin_id, check: c.check, title, problems, error });
+        }
+        Ok(out)
+    }
+
     /// Kinds of workbench events some running or activatable plugin wants;
     /// the UI reports only these.
     pub fn event_kinds(&self) -> BTreeSet<EventKind> {
@@ -1371,7 +1457,7 @@ impl PluginHost {
         let mut out = BTreeSet::new();
         for p in self.plugins.read().values() {
             for kind in EventKind::ALL {
-                if self.wants(p, kind, subs.get(p.id())) {
+                if self.wants(p, kind, subs.kinds.get(p.id())) {
                     out.insert(kind);
                 }
             }
@@ -1404,7 +1490,8 @@ impl PluginHost {
         let mut queues = self.queues.lock();
         for p in plugins {
             let wanted: Vec<WorkbenchEvent> =
-                events.iter().filter(|e| self.wants(&p, e.kind(), subs.get(p.id()))).cloned().collect();
+                events.iter().filter(|e| self.wants(&p, e.kind(), subs.kinds.get(p.id()))).cloned().collect();
+            let wanted = self.filter_path_events(&p, client, &wanted, &subs);
             if wanted.is_empty() {
                 continue;
             }
@@ -1484,6 +1571,18 @@ impl PluginHost {
     /// Returns whether the plugin was activated.
     fn deliver(&self, id: &str, client: Option<String>, events: Vec<WorkbenchEvent>) -> bool {
         let Ok(plugin) = self.get(id) else { return false };
+        let subs = self.shared.subscriptions.lock().clone();
+        let events: Vec<_> = self
+            .filter_path_events(&plugin, client.as_deref(), &events, &subs)
+            .into_iter()
+            .filter(|event| {
+                !matches!(event, WorkbenchEvent::FileOpened(_) | WorkbenchEvent::FileSaved(_))
+                    || self.wants(&plugin, event.kind(), subs.kinds.get(id))
+            })
+            .collect();
+        if events.is_empty() {
+            return false;
+        }
         if !plugin.meta.lock().pending.is_empty() {
             return false;
         }
@@ -1669,6 +1768,7 @@ impl PluginHost {
         let actors: Vec<_> = self.plugins.read().values().filter_map(|p| p.runtime.lock().take()).collect();
         for id in self.plugins.read().keys() {
             self.shared.block_prompts(id);
+            self.stop_web_ptys(id);
         }
         for a in &actors {
             a.stop(false);
@@ -1676,6 +1776,7 @@ impl PluginHost {
         for a in actors {
             a.stop(true);
         }
+        self.shared.finish_process_shutdowns();
     }
 
     /// Periodic upkeep (every few seconds): reports crashes nobody waited
@@ -1844,6 +1945,7 @@ impl PluginHost {
     /// whose activation event already fired.
     fn start(&self, plugin: &Arc<LoadedPlugin>) {
         self.registry.dispose_plugin(plugin.id());
+        self.clear_provider_diagnostics(plugin.id());
         if plugin.source == PluginSource::Installed
             && let Some(reason) = self.revoked_reason(plugin.id(), &plugin.manifest().version, plugin.dir())
         {
@@ -2009,6 +2111,7 @@ impl PluginHost {
         }
         let Some(error) = actor.take_crash() else { return };
         self.clear_plugin_navigation(plugin.id());
+        self.clear_plugin_endpoints(plugin.id());
         if error.starts_with(CANCELLED) {
             // Cancelled on request: restart on next use, no backoff.
             let mut meta = plugin.meta.lock();
@@ -2025,6 +2128,7 @@ impl PluginHost {
     /// A trap dropped the plugin's instance: restart it on next use after a
     /// backoff, or stop it for the session after too many crashes in a row.
     fn crashed(&self, plugin: &LoadedPlugin, error: &str, client: Option<&str>) {
+        self.clear_provider_diagnostics(plugin.id());
         let failures = {
             let mut meta = plugin.meta.lock();
             meta.failures += 1;
@@ -2054,6 +2158,7 @@ impl PluginHost {
                     level: NotificationLevel::Warning,
                     title: format!("Plugin \u{201c}{}\u{201d} crashed", plugin.manifest().name),
                     body: format!("{error}\nIt restarts the next time it is needed."),
+                    actions: Vec::new(),
                 },
             );
         }
@@ -2070,6 +2175,8 @@ impl PluginHost {
             *runtime = None;
         }
         actor.stop(false);
+        // Its handles go with its instance; an idle reclaim is one.
+        self.shared.kill_processes(plugin.id());
         let mut meta = plugin.meta.lock();
         if meta.status == PluginStatus::Active {
             meta.status = PluginStatus::Inactive;
@@ -2080,28 +2187,36 @@ impl PluginHost {
     }
 
     fn stop(&self, plugin: &LoadedPlugin) {
+        self.stop_web_ptys(plugin.id());
         self.clear_plugin_navigation(plugin.id());
+        self.clear_plugin_endpoints(plugin.id());
         // A call waiting on the user would keep the join below waiting.
         self.shared.block_prompts(plugin.id());
         if let Some(actor) = plugin.runtime.lock().take() {
             actor.stop(true);
         }
         self.registry.dispose_plugin(plugin.id());
+        self.clear_provider_diagnostics(plugin.id());
         self.shared.clear_plugin(plugin.id(), true);
         self.queues.lock().retain(|(id, _), _| id != plugin.id());
     }
 
     fn set_failed(&self, plugin: &LoadedPlugin, error: String) {
         self.clear_plugin_navigation(plugin.id());
+        self.clear_plugin_endpoints(plugin.id());
         tracing::warn!(plugin = %plugin.id(), "{error}");
         self.registry.dispose_plugin(plugin.id());
+        self.clear_provider_diagnostics(plugin.id());
         let mut meta = plugin.meta.lock();
         meta.status = PluginStatus::Failed;
         meta.error = Some(error);
+        drop(meta);
+        self.stop_web_ptys(plugin.id());
     }
 
     fn fail(&self, plugin: &LoadedPlugin, error: &str, client: Option<&str>) {
         self.clear_plugin_navigation(plugin.id());
+        self.clear_plugin_endpoints(plugin.id());
         tracing::warn!(plugin = %plugin.id(), "disabled after failure: {error}");
         if let Some(actor) = plugin.runtime.lock().take() {
             actor.stop(false);
@@ -2115,6 +2230,7 @@ impl PluginHost {
                 level: NotificationLevel::Error,
                 title: format!("Plugin \u{201c}{}\u{201d} was disabled", plugin.manifest().name),
                 body: error.to_owned(),
+                actions: Vec::new(),
             },
         );
         self.changed();
@@ -2459,6 +2575,70 @@ impl ide_language::ExternalSyntax for PluginSyntax {
 mod tests {
     use super::*;
 
+    #[test]
+    fn host_panics_stop_actor_and_reply_on_every_call_path() {
+        let tmp = tempfile::tempdir().unwrap();
+        let host =
+            PluginHost::new(tmp.path().join("plugins"), Arc::new(|_: Option<&str>, _| {}), Limits::default()).unwrap();
+        let fixture = Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/diagnostics");
+        host.install_from_dir(&fixture, &Consent::all()).unwrap();
+        let plugin = host.get("test.diagnostics").unwrap();
+        for mode in 0..5 {
+            let (actor, _) = host.ensure_active(&plugin, None).unwrap();
+            let cancel = ide_core::CancellationToken::new();
+            let next_actor = actor.clone();
+            let (queued_tx, queued_rx) = std::sync::mpsc::channel();
+            let panic = move |_: &mut Runtime| -> Result<(), CallError> {
+                let pending = next_actor.submit(None, |_| Ok("must not run")).unwrap();
+                queued_tx.send(pending).unwrap();
+                panic!("host call panic")
+            };
+            let result = match mode {
+                0 => actor.call(None, panic),
+                1 => actor.call_cancellable(&cancel, Duration::ZERO, panic),
+                2 => actor.call_edit_cancellable(&cancel, Duration::ZERO, Duration::from_secs(5), panic),
+                _ => {
+                    let (tx, rx) = std::sync::mpsc::channel();
+                    if mode == 3 {
+                        actor.post(panic, move |result| {
+                            let _ = tx.send(result);
+                        });
+                    } else {
+                        actor.post(
+                            |_| Ok(()),
+                            move |result| {
+                                let _ = tx.send(result);
+                                panic!("completion callback panic");
+                            },
+                        );
+                    }
+                    rx.recv_timeout(Duration::from_secs(5)).expect("actor must reply")
+                }
+            };
+            if mode < 4 {
+                let queued = queued_rx.recv_timeout(Duration::from_secs(5)).unwrap();
+                assert!(matches!(queued.wait(), Err(ActorError::Stopped)), "poisoned runtime must not run queued work");
+            }
+            actor.stop(true);
+            if mode < 4 {
+                assert!(
+                    matches!(result, Err(ActorError::Call(CallError::Trap(ref message))) if message.contains("host call panic")),
+                    "{result:?}"
+                );
+            }
+            assert!(!actor.is_alive());
+            assert!(!actor.is_busy());
+            assert!(matches!(actor.call(None, |_| Ok(())), Err(ActorError::Stopped)));
+            let crash = actor.take_crash().expect("supervisor must see the panic");
+            assert!(crash.contains(if mode == 4 { "completion callback panic" } else { "host call panic" }));
+            assert!(actor.take_crash().is_none());
+            cancel.cancel();
+            // Re-enable to reset the supervisor before testing the next call path.
+            host.set_enabled("test.diagnostics", false).unwrap();
+            host.set_enabled("test.diagnostics", true).unwrap();
+        }
+    }
+
     #[test]
     fn globs() {
         assert!(glob_match("**/*Mapper.xml", "src/main/UserMapper.xml"));

crates/ide-host/src/plugins/points.rs

@@ -59,6 +59,7 @@ pub fn register_builtin_points(
     registry.register(Arc::new(super::navigation::IndexersPoint))?;
     registry.register(Arc::new(super::providers::ProvidersPoint::new(providers.clone())))?;
     registry.register(Arc::new(UiPoint::new(super::providers::SECRETS_POINT, ui.clone(), super::providers::secret)))?;
+    registry.register(Arc::new(UiPoint::new(super::endpoints::POINT, ui.clone(), super::endpoints::declaration)))?;
     use super::ui_points as p;
     registry.register(Arc::new(UiPoint::new(p::MENUS, ui.clone(), p::menu)))?;
     registry.register(Arc::new(UiPoint::new(p::KEYMAPS, ui.clone(), p::keymap)))?;
@@ -66,7 +67,10 @@ pub fn register_builtin_points(
     registry.register(Arc::new(UiPoint::new(p::SETTINGS, ui.clone(), p::settings)))?;
     registry.register(Arc::new(UiPoint::new(p::VIEWS, ui.clone(), p::view)))?;
     registry.register(Arc::new(UiPoint::new(p::CUSTOM_EDITORS, ui.clone(), p::custom_editor)))?;
+    registry.register(Arc::new(UiPoint::new(p::MARKER_ICONS, ui.clone(), p::marker_icon)))?;
     registry.register(Arc::new(UiPoint::new(p::FILE_ICONS, ui.clone(), p::file_icon)))?;
     registry.register(Arc::new(UiPoint::new(p::FILE_TEMPLATES, ui.clone(), p::file_template)))?;
+    registry.register(Arc::new(UiPoint::new(p::COMMIT_CHECKS, ui.clone(), p::commit_check)))?;
+    registry.register(Arc::new(UiPoint::new(ide_extension::LOCALES_POINT, ui.clone(), p::locales)))?;
     Ok(())
 }

crates/ide-host/src/plugins/providers.rs

@@ -22,6 +22,7 @@
 use ide_extension::{Disposable, ExtensionPoint, Package, Placement, Prepared, UiDecl, decode, validate_item_id};
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
 
@@ -38,6 +39,9 @@ pub enum ProviderKind {
     Definition,
     LineMarkers,
     SemanticTokens,
+    Hover,
+    InlayHints,
+    Diagnostics,
 }
 
 #[derive(Clone, Debug, Deserialize)]
@@ -71,13 +75,26 @@ impl Providers {
 
     /// Plugins providing `kind` for `language`, in declaration order.
     pub fn plugins_for(&self, kind: ProviderKind, language: &str) -> Vec<String> {
-        let mut out: Vec<String> = Vec::new();
-        for (_, plugin, kinds, languages) in self.items.read().iter() {
-            if kinds.contains(&kind) && languages.iter().any(|l| l == "*" || l == language) && !out.contains(plugin) {
-                out.push(plugin.clone());
-            }
-        }
-        out
+        self.matching::<Vec<_>>(kind, language).into_iter().map(|(plugin, _)| plugin).collect()
+    }
+
+    /// One coherent declaration snapshot, preserving the first match per plugin.
+    fn matching<T: FromIterator<(String, u64)>>(&self, kind: ProviderKind, language: &str) -> T {
+        let items = self.items.read();
+        let mut seen = HashSet::new();
+        items
+            .iter()
+            .filter(|(_, plugin, kinds, languages)| {
+                kinds.contains(&kind)
+                    && languages.iter().any(|l| l == "*" || l == language)
+                    && seen.insert(plugin.as_str())
+            })
+            .map(|(seq, plugin, ..)| (plugin.clone(), *seq))
+            .collect()
+    }
+
+    pub(super) fn diagnostic_generations(&self, language: &str) -> HashMap<String, u64> {
+        self.matching(ProviderKind::Diagnostics, language)
     }
 
     /// Whether any plugin provides `kind` (for any language).
@@ -116,6 +133,15 @@ impl ExtensionPoint for ProvidersPoint {
         if d.kinds.contains(&ProviderKind::SemanticTokens) {
             pkg.manifest.needs_api("contributes.providers: semantic-tokens", 3)?;
         }
+        if d.kinds.contains(&ProviderKind::Diagnostics) {
+            pkg.manifest.needs_api("contributes.providers: diagnostics", 3)?;
+        }
+        if d.kinds.contains(&ProviderKind::Hover) {
+            pkg.manifest.needs_api("contributes.providers: hover", 3)?;
+        }
+        if d.kinds.contains(&ProviderKind::InlayHints) {
+            pkg.manifest.needs_api("contributes.providers: inlay-hints", 3)?;
+        }
         for l in &d.languages {
             if l != "*"
                 && (l.is_empty()
@@ -161,11 +187,11 @@ pub(super) fn secret(_pkg: &Package, decl: toml::Value) -> Result<UiDecl, String
 
 // ---- dispatch ---------------------------------------------------------------
 
-use super::{LoadedPlugin, PluginHost, PluginStatus};
+use super::{LoadedPlugin, PluginEvent, PluginHost, PluginStatus};
 use ide_core::CancellationToken;
 use ide_plugin::{
-    ActorError, CallError, CodeAction, CompletionItem, InlineSuggestion, LineMarker, Location, Pending,
-    ProviderDocument, Runtime, SemanticToken,
+    ActorError, CallError, CodeAction, CompletionItem, InlineSuggestion, LineMarker, Location, Pending, PluginHover,
+    PluginInlayHint, ProviderDocument, Runtime, SemanticToken,
 };
 use std::sync::Weak;
 use std::time::{Duration, Instant};
@@ -194,7 +220,7 @@ pub(crate) fn editor_plugin_host() -> Option<Arc<PluginHost>> {
 
 impl PluginHost {
     /// Usable plugins declaring `kind` for `language`.
-    fn provider_plugins(&self, kind: ProviderKind, language: &str) -> Vec<Arc<LoadedPlugin>> {
+    pub(super) fn provider_plugins(&self, kind: ProviderKind, language: &str) -> Vec<Arc<LoadedPlugin>> {
         self.providers
             .plugins_for(kind, language)
             .into_iter()
@@ -307,14 +333,21 @@ impl PluginHost {
         plugin_id: &str,
         doc: &ProviderDocument,
         action: CodeAction,
+        invocation: ide_plugin::Invocation,
     ) -> ide_core::IdeResult<CodeAction> {
         let d = Arc::new(doc.clone());
         let timeout = self.limits.timeout;
-        self.code_call(plugin_id, ide_plugin::Invocation::default(), "resolving the code action", move |rt, _| {
-            rt.resolve_code_action(&d, &action, timeout)
+        self.code_call(plugin_id, invocation, "resolving the code action", move |rt, inv| {
+            rt.resolve_code_action(&d, &action, inv, timeout)
         })
     }
 
+    /// Shows `path` in window `client` after a code action of `plugin_id` was applied.
+    pub fn open_file(&self, plugin_id: &str, client: &str, path: ide_core::IpcPath) {
+        let event = PluginEvent::OpenLocation { plugin_id: plugin_id.to_owned(), path, line: 0, column: 0 };
+        self.emit(Some(client), event);
+    }
+
     pub fn provide_definition(&self, doc: &ProviderDocument, at: ide_core::Pos) -> Vec<Location> {
         let d = Arc::new(doc.clone());
         self.edit_calls(ProviderKind::Definition, &doc.language, move |rt, timeout| {
@@ -345,6 +378,77 @@ impl PluginHost {
         .collect()
     }
 
+    pub fn provide_diagnostics(
+        &self,
+        doc: &ProviderDocument,
+        cancel: &CancellationToken,
+    ) -> Vec<(String, Vec<ide_core::Diagnostic>)> {
+        self.provide_project_diagnostics(None, doc, cancel)
+    }
+
+    pub(super) fn diagnostic_plugins(
+        &self,
+        project: Option<&std::path::Path>,
+        language: &str,
+    ) -> Vec<Arc<LoadedPlugin>> {
+        self.provider_plugins(ProviderKind::Diagnostics, language)
+            .into_iter()
+            .filter(|p| p.dev_root.is_none() || p.dev_root.as_deref() == project)
+            .collect()
+    }
+
+    pub(super) fn provide_project_diagnostics(
+        &self,
+        project: Option<&std::path::Path>,
+        doc: &ProviderDocument,
+        cancel: &CancellationToken,
+    ) -> Vec<(String, Vec<ide_core::Diagnostic>)> {
+        std::thread::scope(|scope| {
+            let calls: Vec<_> = self
+                .diagnostic_plugins(project, &doc.language)
+                .into_iter()
+                .map(|p| {
+                    scope.spawn(move || {
+                        if cancel.is_cancelled() {
+                            return None;
+                        }
+                        let (actor, activated) = self.ensure_active(&p, None).ok()?;
+                        if activated {
+                            self.changed();
+                        }
+                        let (d, timeout) = (doc.clone(), self.limits.edit_hard);
+                        let started = Instant::now();
+                        let result =
+                            actor.call_edit_cancellable(cancel, CANCEL_GRACE, self.limits.edit_soft, move |rt| {
+                                rt.provide_diagnostics(&d, timeout)
+                            });
+                        let items = self.finish_provider_call(&p, &actor, started, result)?;
+                        (!cancel.is_cancelled()).then(|| (p.id().to_owned(), items))
+                    })
+                })
+                .collect();
+            calls.into_iter().filter_map(|call| call.join().ok().flatten()).collect()
+        })
+    }
+
+    pub fn provide_hover(&self, doc: &ProviderDocument, at: ide_core::Pos) -> Vec<PluginHover> {
+        let d = Arc::new(doc.clone());
+        self.edit_calls(ProviderKind::Hover, &doc.language, move |rt, timeout| rt.provide_hover(&d, at, timeout))
+            .into_iter()
+            .filter_map(|(_, hover)| hover)
+            .collect()
+    }
+
+    pub fn provide_inlay_hints(&self, doc: &ProviderDocument, range: ide_core::Range) -> Vec<PluginInlayHint> {
+        let d = Arc::new(doc.clone());
+        self.edit_calls(ProviderKind::InlayHints, &doc.language, move |rt, timeout| {
+            rt.provide_inlay_hints(&d, range, timeout)
+        })
+        .into_iter()
+        .flat_map(|(_, hints)| hints)
+        .collect()
+    }
+
     /// Ghost text from the first plugin that has some. Not bound by the
     /// edit-path soft deadline (it may need the network) but by `cancel`:
     /// the editor cancels a request as soon as the user types on.
@@ -373,3 +477,41 @@ impl PluginHost {
         None
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn provider_snapshots_preserve_order_first_generation_and_language_matching() {
+        let providers = Arc::new(Providers::default());
+        let declare = |plugin: &str, kind, language: &str| {
+            providers.add(plugin.into(), Decl { kinds: vec![kind], languages: vec![language.into()] })
+        };
+        let mut declarations = Vec::new();
+        declarations.push(declare("unrelated", ProviderKind::Hover, "*"));
+        declarations.push(declare("other-language", ProviderKind::Diagnostics, "rust"));
+        for i in 0..256 {
+            let plugin = format!("plugin-{i}");
+            declarations.push(declare(&plugin, ProviderKind::Diagnostics, "text"));
+            declarations.push(declare(&plugin, ProviderKind::Diagnostics, "*"));
+        }
+        let expected: Vec<_> = (0..256).map(|i| format!("plugin-{i}")).collect();
+        assert_eq!(providers.plugins_for(ProviderKind::Diagnostics, "text"), expected);
+        let before = providers.diagnostic_generations("text");
+        assert_eq!(before.len(), 256);
+        assert_eq!(before["plugin-0"], 2);
+        assert_eq!(providers.diagnostic_generations("rust").len(), 257);
+        assert_eq!(providers.plugins_for(ProviderKind::Hover, "text"), ["unrelated"]);
+        // Removing the first matching declaration must invalidate its generation,
+        // even while a second declaration still provides the same language.
+        drop(declarations.remove(2));
+        let after = providers.diagnostic_generations("text");
+        assert_eq!(after["plugin-0"], 3);
+        assert_ne!(before["plugin-0"], after["plugin-0"]);
+        drop(declarations);
+        assert!(providers.diagnostic_generations("text").is_empty());
+        let _reloaded = declare("plugin-0", ProviderKind::Diagnostics, "text");
+        assert_ne!(providers.diagnostic_generations("text")["plugin-0"], after["plugin-0"]);
+    }
+}

crates/ide-host/src/plugins/remote_host.rs

@@ -14,8 +14,8 @@
 //! The commands a window needs at run time (`plugin_run_command`,
 //! `plugin_post_events`, `plugin_event_kinds`, `plugin_status_items`,
 //! `plugin_context_keys`, `plugin_cancel_task`, `plugin_answer_prompt`, `plugin_set_active_file`,
-//! `plugin_line_markers`, `plugin_view_render`, `plugin_view_event`, `plugin_service_detail`,
-//! `plugin_service_log`)
+//! `plugin_line_markers`, `plugin_set_ui_locale`, `plugin_view_render`, `plugin_view_event`,
+//! `plugin_service_detail`, `plugin_service_log`, `plugin_answer_commit`, `plugin_commit_checks`)
 //! carry the desktop commands' names and arguments, so a remote window's UI
 //! routes them here unchanged. Plugin results come back as `plugin`
 //! notifications ([`PluginEventMessage`]); secrets stay in the desktop's
@@ -119,9 +119,12 @@ pub fn forwarded(event: &PluginEvent) -> bool {
             | PluginEvent::OpenLocation { .. }
             | PluginEvent::CopyToClipboard { .. }
             | PluginEvent::OpenUrl { .. }
+            | PluginEvent::OpenProject { .. }
             | PluginEvent::PromptRequested { .. }
             | PluginEvent::PromptClosed { .. }
             | PluginEvent::RevealView { .. }
+            | PluginEvent::CommitRequested { .. }
+            | PluginEvent::EndpointsChanged { .. }
     )
 }
 
@@ -383,6 +386,14 @@ impl RemotePlugins {
             }
         });
         let h = host.clone();
+        d.add("plugin_set_ui_locale", move |c| {
+            let h = h.clone();
+            async move {
+                alive(&h)?.set_ui_locale(&c.arg::<String>("tag")?);
+                Ok(())
+            }
+        });
+        let h = host.clone();
         d.add("plugin_post_events", move |c| {
             let h = h.clone();
             async move {
@@ -422,6 +433,26 @@ impl RemotePlugins {
             async move { Ok(alive(&h)?.answer_prompt(&c.arg::<String>("promptId")?, c.arg("answer")?)) }
         });
         let h = host.clone();
+        d.add("plugin_answer_commit", move |c| {
+            let h = h.clone();
+            async move { Ok(alive(&h)?.answer_commit(&c.arg::<String>("requestId")?, c.arg("answer")?)) }
+        });
+        let h = host.clone();
+        d.add("plugin_commit_checks", move |c| {
+            let h = h.clone();
+            async move {
+                super::commit::commit_checks(
+                    &c.host,
+                    alive(&h)?,
+                    &c.window,
+                    c.arg("selection")?,
+                    c.arg("checks")?,
+                    c.arg("request")?,
+                )
+                .await
+            }
+        });
+        let h = host.clone();
         d.add("plugin_set_active_file", move |c| {
             let h = h.clone();
             async move {
@@ -537,6 +568,11 @@ impl RemotePlugins {
                 super::index_ops::plugin_navigation_markers(&c.host, alive(&h)?, &c.window, c.arg("paths")?).await
             }
         });
+        let h = host.clone();
+        d.add("plugin_endpoints", move |c| {
+            let h = h.clone();
+            async move { super::index_ops::plugin_endpoints(&c.host, alive(&h)?, &c.window, c.arg("pluginId")?).await }
+        });
         d.add("plugin_line_markers", |c| async move {
             crate::ops::lsp::plugin_line_markers(&c.host, &c.window, c.arg("doc")?).await
         });

crates/ide-host/src/plugins/types.rs

@@ -168,11 +168,22 @@ pub enum PluginEvent {
     CommandsChanged,
     /// Cached document associations were disposed (reload, disable or failure).
     DocumentIndexesChanged,
+    /// The routes `plugin_id` reports for the project `root` may have changed:
+    /// ask `plugin_endpoints` again.
+    #[serde(rename_all = "camelCase")]
+    EndpointsChanged { plugin_id: String, root: ide_core::IpcPath },
     /// The marketplace offers newer versions of installed plugins (announced
     /// once per set of versions).
     UpdatesAvailable { updates: Vec<PluginUpdate> },
     #[serde(rename_all = "camelCase")]
-    Notification { plugin_id: String, level: NotificationLevel, title: String, body: String },
+    Notification {
+        plugin_id: String,
+        level: NotificationLevel,
+        title: String,
+        body: String,
+        /// Buttons running the plugin's own commands (`ui.notify`).
+        actions: Vec<ide_plugin::NotificationAction>,
+    },
     /// A plugin's status bar item was set (`item`) or removed.
     #[serde(rename_all = "camelCase")]
     StatusItemChanged { plugin_id: String, id: String, item: Option<StatusItem> },
@@ -222,6 +233,9 @@ pub enum PluginEvent {
     /// Open `url` (`http(s)://`) in the system browser.
     #[serde(rename_all = "camelCase")]
     OpenUrl { plugin_id: String, url: String },
+    /// A window command/event requests the normal File > Open flow.
+    #[serde(rename_all = "camelCase")]
+    OpenProject { plugin_id: String, path: String, new_window: bool },
     /// A command waits for the user's answer: show `prompt`, then report it with
     /// `plugin_answer_prompt(prompt_id, …)`.
     #[serde(rename_all = "camelCase")]
@@ -232,6 +246,55 @@ pub enum PluginEvent {
     /// Bring the tool window of the plugin's view `view` to the front.
     #[serde(rename_all = "camelCase")]
     RevealView { plugin_id: String, view: String },
+    /// A command needs the window's Commit view: answer with
+    /// `plugin_answer_commit(request_id, …)`. Closed like a prompt (`PromptClosed`).
+    #[serde(rename_all = "camelCase")]
+    CommitRequested { plugin_id: String, request_id: String, request: CommitRequest },
+}
+
+/// What a plugin asks of a window's Commit view.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum CommitRequest {
+    /// What Commit would commit now ([`CommitAnswer::Selection`]); unsaved
+    /// editors of the included files are saved first.
+    Selection,
+    /// Replace the message if the draft is still at `revision`.
+    SetMessage { revision: u64, message: String },
+}
+
+/// A window's answer to a [`CommitRequest`].
+#[derive(Clone, Debug, Serialize, Deserialize, Type)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum CommitAnswer {
+    /// The window's project has no repository.
+    NoRepository,
+    Selection {
+        selection: CommitSelection,
+    },
+    /// The message was replaced.
+    Done,
+    /// The draft is no longer at the revision.
+    Stale,
+}
+
+/// What a window's Commit view would commit: per repository, the options
+/// `vcs_commit` would get.
+#[derive(Clone, Debug, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct CommitSelection {
+    /// Changes whenever the message, the included changes or Amend do.
+    pub revision: u64,
+    pub message: String,
+    pub amend: bool,
+    pub repositories: Vec<CommitSelectionRepo>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct CommitSelectionRepo {
+    pub root: ide_core::IpcPath,
+    pub options: ide_vcs::CommitOptions,
 }
 
 /// Delivers events to the UI. `client` is the window that invoked the plugin
@@ -300,3 +363,24 @@ pub struct LineMarkerInfo {
     /// Opened on click.
     pub target: Option<ide_core::Location>,
 }
+
+/// A plugin's before-commit check to run (`[[contributes.commitChecks]]`).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginCommitCheckRef {
+    pub plugin_id: String,
+    pub check: String,
+}
+
+/// What a plugin's before-commit check found.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginCommitCheckResult {
+    pub plugin_id: String,
+    pub check: String,
+    /// The check's declared title.
+    pub title: String,
+    pub problems: Vec<ide_plugin::CommitProblem>,
+    /// The check could not run (the plugin failed, timed out or lacks `vcs.read`).
+    pub error: Option<String>,
+}

crates/ide-host/src/plugins/ui_points.rs

@@ -5,7 +5,7 @@
 //!
 //! ```toml
 //! [[contributes.menus]]
-//! menu = "editor.context"          # projectView.context, editorTab.context, tools, viewItem.context
+//! menu = "editor.context"          # projectView.context, editorTab.context, tools, viewItem.context, commit.message
 //! command = "check"
 //! when = "editorLang == java"
 //! # view = "<view id>"             # required for (only allowed on) viewItem.context
@@ -42,6 +42,10 @@
 //! icon = "icons/drawing.svg"
 //! iconDark = "icons/drawing_dark.svg"
 //!
+//! [[contributes.commitChecks]]
+//! id = "conventional"
+//! title = "Conventional Commits"   # Commit Options › Before Commit; `commit-checker.check` runs it
+//!
 //! [[contributes.fileTemplates]]
 //! id = "drawing"
 //! name = "Excalidraw Drawing"
@@ -49,14 +53,14 @@
 //! path = "templates/drawing.excalidraw"
 //! ```
 
-use ide_extension::{Package, UiDecl, decode, validate_item_id, validate_when};
+use ide_extension::{LOCALES_DIR, Package, UiDecl, decode, validate_item_id, validate_when};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
-use std::collections::BTreeSet;
-use std::path::PathBuf;
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
 
 /// A view whose tree shows in the Services tool window; the plugin's
-/// `service-provider` renders the selected node's pane.
+/// `detail-provider` renders the selected node's pane.
 pub const SERVICES_LOCATION: &str = "services";
 pub const MENUS: &str = "menus";
 pub const KEYMAPS: &str = "keymaps";
@@ -65,10 +69,15 @@ pub const SETTINGS: &str = "settings";
 pub const VIEWS: &str = "views";
 pub const CUSTOM_EDITORS: &str = "customEditors";
 pub const FILE_ICONS: &str = "fileIcons";
+pub const MARKER_ICONS: &str = "markerIcons";
 pub const FILE_TEMPLATES: &str = "fileTemplates";
+pub const COMMIT_CHECKS: &str = "commitChecks";
 
 const VIEW_ITEM_MENU: &str = "viewItem.context";
-const MENU_IDS: [&str; 5] = ["editor.context", "projectView.context", "editorTab.context", "tools", VIEW_ITEM_MENU];
+/// The toolbar above the commit message (Commit tool window and dialog).
+const COMMIT_MESSAGE_MENU: &str = "commit.message";
+const MENU_IDS: [&str; 6] =
+    ["editor.context", "projectView.context", "editorTab.context", "tools", VIEW_ITEM_MENU, COMMIT_MESSAGE_MENU];
 const MAX_TITLE: usize = 256;
 const MAX_SETTINGS: usize = 200;
 const MAX_PATTERNS: usize = 16;
@@ -114,6 +123,10 @@ struct MenuDecl {
     when: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     view: Option<String>,
+    /// Groups the plugin's entries of one context menu that name the same
+    /// submenu under it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    submenu: Option<String>,
 }
 
 pub(super) fn menu(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
@@ -122,9 +135,19 @@ pub(super) fn menu(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
         return Err(format!("contributes.menus: unknown menu {:?} (one of {})", d.menu, MENU_IDS.join(", ")));
     }
     declared_command(pkg, MENUS, &d.command)?;
+    if d.menu == COMMIT_MESSAGE_MENU {
+        pkg.manifest.needs_api(&format!("contributes.menus: {COMMIT_MESSAGE_MENU}"), 3)?;
+    }
     if let Some(w) = &d.when {
         validate_when(w).map_err(|e| format!("contributes.menus: {e}"))?;
     }
+    if let Some(submenu) = &d.submenu {
+        if !d.menu.ends_with(".context") {
+            return Err(format!("contributes.menus: `submenu` is only for context menus, not {:?}", d.menu));
+        }
+        title(MENUS, submenu)?;
+        pkg.manifest.needs_api("contributes.menus: submenu", 3)?;
+    }
     let key = match (d.menu == VIEW_ITEM_MENU, &d.view) {
         (true, None) => return Err(format!("contributes.menus: {VIEW_ITEM_MENU} needs `view`")),
         (true, Some(v)) => {
@@ -377,6 +400,13 @@ struct ViewDecl {
     icon: Option<String>,
     #[serde(default = "right")]
     location: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    group: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    when: Option<String>,
+    /// Show the selected tree/list item's detail-provider tabs beside it.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    detail: bool,
     /// A web page of the package (`web/index.html`) instead of content the code renders.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     web: Option<String>,
@@ -397,6 +427,15 @@ pub(super) fn view(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
     let d: ViewDecl = decode(VIEWS, decl)?;
     validate_item_id(&d.id, "view id")?;
     title(VIEWS, &d.title)?;
+    if let Some(group) = &d.group {
+        pkg.manifest.needs_api("contributes.views.group", 3)?;
+        validate_item_id(group, "view group")?;
+    }
+    if let Some(when) = &d.when {
+        pkg.manifest.needs_api("contributes.views.when", 3)?;
+        validate_when(when).map_err(|e| format!("contributes.views: {e}"))?;
+    }
+
     let files = web_or_code(pkg, d.web.as_deref(), &format!("view {:?}", d.id))?;
     if !["left", "right", "bottom", SERVICES_LOCATION].contains(&d.location.as_str()) {
         return Err(format!("view {:?}: `location` is left, right, bottom or services", d.id));
@@ -407,6 +446,12 @@ pub(super) fn view(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
             return Err(format!("view {:?}: a services view is rendered by the plugin's code (no `web`)", d.id));
         }
     }
+    if d.detail {
+        pkg.manifest.needs_api(&format!("view {:?}: `detail`", d.id), 3)?;
+        if d.web.is_some() {
+            return Err(format!("view {:?}: `detail` needs a tree or list rendered by the plugin (no `web`)", d.id));
+        }
+    }
     if d.icon.as_ref().is_some_and(|i| i.len() > 64) {
         return Err(format!("view {:?}: icon names are up to 64 bytes", d.id));
     }
@@ -518,17 +563,56 @@ pub(super) fn file_icon(pkg: &Package, decl: toml::Value) -> Result<UiDecl, Stri
     Ok(out)
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct MarkerIconDecl {
+    id: String,
+    icon: PathBuf,
+    #[serde(default)]
+    icon_dark: Option<PathBuf>,
+}
+
+pub(super) fn marker_icon(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
+    pkg.manifest.needs_api("contributes.markerIcons", 3)?;
+    let d: MarkerIconDecl = decode(MARKER_ICONS, decl)?;
+    validate_item_id(&d.id, "marker icon id")?;
+    if d.icon.to_string_lossy().len() > 256 {
+        return Err("marker icon paths are up to 256 bytes".into());
+    }
+    let mut out = UiDecl::new(d.id.clone(), d.id.clone(), serde_json::json!({ "id": d.id, "icon": d.icon }));
+    for (path, variant) in [(Some(&d.icon), "light"), (d.icon_dark.as_ref(), "dark")] {
+        let Some(path) = path else { continue };
+        let svg = super::icons::read_icon(pkg, path, super::icons::MAX_SVG)?;
+        out.assets.push((format!("markerIcon/{}/{variant}", d.id), svg));
+        out.files.push(path.clone());
+    }
+    // A changed SVG must reproject even when its declared path stays the same.
+    let bytes = serde_json::to_vec(&out.assets).map_err(|e| e.to_string())?;
+    out.json["revision"] = Value::String(blake3::hash(&bytes).to_hex().to_string());
+    Ok(out)
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct FileTemplateDecl {
     id: String,
     name: String,
     /// Without the dot.
+    #[serde(default)]
     extension: String,
+    file_name: Option<String>,
+    variables: Option<Vec<FileTemplateVariable>>,
     /// The new file's content (`$NAME$`, `$END$` and the other template variables work).
     path: PathBuf,
 }
 
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct FileTemplateVariable {
+    name: String,
+    prompt: String,
+}
+
 const MAX_TEMPLATE: usize = 256 << 10;
 
 /// `[[contributes.fileTemplates]]`: an entry of the New menu.
@@ -537,8 +621,59 @@ pub(super) fn file_template(pkg: &Package, decl: toml::Value) -> Result<UiDecl,
     validate_item_id(&d.id, "file template id")?;
     title(FILE_TEMPLATES, &d.name)?;
     let what = format!("file template {:?}", d.id);
+    if d.file_name.is_some() || d.variables.is_some() {
+        pkg.manifest.needs_api("contributes.fileTemplates: fileName / variables", 3)?;
+    }
+    if let Some(name) = &d.file_name {
+        let stem = name.split('.').next().unwrap_or("").trim_end().to_ascii_uppercase();
+        if name.is_empty()
+            || name.len() > 255
+            || name.trim() != name
+            || name.ends_with('.')
+            || matches!(name.as_str(), "." | "..")
+            || name.chars().any(|c| c.is_control() || "/\\<>:\"|?*".contains(c))
+            || matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL")
+            || ((stem.starts_with("COM") || stem.starts_with("LPT"))
+                && matches!(stem.as_bytes().get(3), Some(b'1'..=b'9'))
+                && stem.len() == 4)
+        {
+            return Err(format!("{what}: `fileName` must be a safe single file name"));
+        }
+    }
+    let mut names = std::collections::HashSet::new();
+    let variables = d.variables.unwrap_or_default();
+    if variables.len() > 32 {
+        return Err(format!("{what}: at most 32 variables are allowed"));
+    }
+    for variable in &variables {
+        let name = &variable.name;
+        if name.is_empty()
+            || name.len() > 64
+            || !name
+                .bytes()
+                .enumerate()
+                .all(|(i, c)| c.is_ascii_alphabetic() || c == b'_' || i > 0 && c.is_ascii_digit())
+            || matches!(
+                name.as_str(),
+                "NAME"
+                    | "FILE_NAME"
+                    | "PACKAGE"
+                    | "PACKAGE_NAME"
+                    | "PROJECT_NAME"
+                    | "USER"
+                    | "DATE"
+                    | "TIME"
+                    | "YEAR"
+                    | "END"
+            )
+            || !names.insert(name)
+        {
+            return Err(format!("{what}: invalid, reserved or duplicate variable name {name:?}"));
+        }
+        title("file template variable prompt", &variable.prompt)?;
+    }
     let ext = d.extension.trim_start_matches('.');
-    if ext.is_empty()
+    if (ext.is_empty() && d.file_name.is_none())
         || ext.len() > 32
         || !ext.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_'))
     {
@@ -548,12 +683,86 @@ pub(super) fn file_template(pkg: &Package, decl: toml::Value) -> Result<UiDecl,
     if body.len() > MAX_TEMPLATE {
         return Err(format!("{what}: {} is larger than {} KiB", d.path.display(), MAX_TEMPLATE >> 10));
     }
-    let json = serde_json::json!({ "id": d.id, "name": d.name, "extension": ext, "body": body });
+    let json = serde_json::json!({ "id": d.id, "name": d.name, "extension": ext, "body": body, "fileName": d.file_name, "variables": variables });
     let mut out = UiDecl::new(d.id.clone(), d.name.clone(), json);
     out.files = vec![d.path.clone()];
     Ok(out)
 }
 
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct CommitCheckDecl {
+    id: String,
+    title: String,
+}
+
+/// `[[contributes.commitChecks]]`: a before-commit check run by the plugin's
+/// `commit-checker` export, listed in Commit Options.
+pub(super) fn commit_check(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
+    let d: CommitCheckDecl = decode(COMMIT_CHECKS, decl)?;
+    pkg.manifest.needs_api(&format!("contributes.{COMMIT_CHECKS}"), 3)?;
+    validate_item_id(&d.id, "commit check id")?;
+    title(COMMIT_CHECKS, &d.title)?;
+    if pkg.manifest.wasm.is_none() {
+        return Err(format!("contributes.{COMMIT_CHECKS}: needs `wasm` (the checks run in the plugin's code)"));
+    }
+    if !pkg.manifest.capabilities.all().any(|c| *c == ide_extension::Capability::VcsRead) {
+        return Err(format!("contributes.{COMMIT_CHECKS}: needs the `vcs.read` capability (checks read the commit)"));
+    }
+    Ok(UiDecl::new(d.id.clone(), d.title.clone(), json(&d)?))
+}
+
+const MAX_CATALOG_ENTRIES: usize = 20_000;
+
+pub fn locale_asset(tag: &str) -> String {
+    format!("locale/{tag}")
+}
+
+fn locale_tag_ok(tag: &str) -> bool {
+    let mut parts = tag.split('-');
+    let language = parts.next().unwrap_or_default();
+    (2..=3).contains(&language.len())
+        && language.chars().all(|c| c.is_ascii_alphabetic())
+        && parts.all(|p| (1..=8).contains(&p.len()) && p.chars().all(|c| c.is_ascii_alphanumeric()))
+}
+
+/// `locales/<tag>.json`: English source text → translation, for the plugin's own strings.
+pub(super) fn locales(pkg: &Package, _decl: toml::Value) -> Result<UiDecl, String> {
+    let dir = Path::new(LOCALES_DIR);
+    let mut names: Vec<String> = std::fs::read_dir(pkg.dir.join(dir))
+        .map_err(|e| format!("{LOCALES_DIR}: {e}"))?
+        .filter_map(|entry| entry.ok()?.file_name().into_string().ok())
+        .filter(|name| name.ends_with(".json"))
+        .collect();
+    names.sort();
+    let mut tags = Vec::new();
+    let mut files = Vec::new();
+    let mut assets = Vec::new();
+    for name in names {
+        let tag = name.trim_end_matches(".json");
+        if !locale_tag_ok(tag) {
+            return Err(format!("{LOCALES_DIR}/{name}: the file name must be a language tag such as fr or zh-CN"));
+        }
+        let file = dir.join(&name);
+        let text = pkg.read_text(&file)?;
+        let catalog: BTreeMap<String, Value> = serde_json::from_str(&text)
+            .map_err(|e| format!("{}: not a JSON object of strings ({e})", file.display()))?;
+        if catalog.len() > MAX_CATALOG_ENTRIES {
+            return Err(format!("{}: more than {MAX_CATALOG_ENTRIES} entries", file.display()));
+        }
+        if let Some((key, _)) = catalog.iter().find(|(_, v)| !v.is_string()) {
+            return Err(format!("{}: the value of {key:?} is not a string", file.display()));
+        }
+        assets.push((locale_asset(tag), text));
+        tags.push(tag.to_owned());
+        files.push(file);
+    }
+    let mut out = UiDecl::new("locales", tags.join(", "), serde_json::json!({ "tags": tags }));
+    out.files = files;
+    out.assets = assets;
+    Ok(out)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -585,4 +794,41 @@ mod tests {
         assert!(parse_settings_schema(r#"{"properties": {"x": {"type": "string", "default": 3}}}"#).is_err());
         assert!(parse_settings_schema(r#"{"properties": {"x": {"type": "object"}}}"#).is_err());
     }
+
+    fn package_with_catalogs(files: &[(&str, &str)]) -> (tempfile::TempDir, Package) {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir(dir.path().join(LOCALES_DIR)).unwrap();
+        for (name, text) in files {
+            std::fs::write(dir.path().join(LOCALES_DIR).join(name), text).unwrap();
+        }
+        let src = "id = \"p\"\nname = \"P\"\nversion = \"1.0.0\"\nengines.openidea = \"^1.0\"";
+        let pkg = Package::new(ide_extension::Manifest::parse(src).unwrap(), dir.path().to_path_buf());
+        (dir, pkg)
+    }
+
+    #[test]
+    fn catalogs_become_assets_by_language_tag() {
+        let (_dir, pkg) = package_with_catalogs(&[
+            ("fr.json", r#"{"Refresh": "Actualiser"}"#),
+            ("zh-CN.json", r#"{"Refresh": "刷新"}"#),
+            ("notes.txt", "ignored"),
+        ]);
+        let decl = locales(&pkg, toml::Value::Table(Default::default())).unwrap();
+        assert_eq!(decl.json["tags"], serde_json::json!(["fr", "zh-CN"]));
+        assert_eq!(decl.assets.iter().map(|(id, _)| id.as_str()).collect::<Vec<_>>(), ["locale/fr", "locale/zh-CN"]);
+    }
+
+    #[test]
+    fn invalid_catalogs_are_refused() {
+        for (name, text) in [
+            ("fr.json", "{"),
+            ("fr.json", r#"["Refresh"]"#),
+            ("fr.json", r#"{"Refresh": 3}"#),
+            ("fr.json", r#"{"Refresh": {"a": "b"}}"#),
+            ("french!.json", "{}"),
+        ] {
+            let (_dir, pkg) = package_with_catalogs(&[(name, text)]);
+            assert!(locales(&pkg, toml::Value::Table(Default::default())).is_err(), "{name}: {text}");
+        }
+    }
 }

crates/ide-host/src/plugins/web.rs

@@ -100,6 +100,23 @@ pub struct WebPage {
     pub path: String,
 }
 
+/// A web frame's API 1.3 PTY request. The frame never supplies an executable path or cwd.
+#[derive(Clone, Debug, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct WebPtyCommand {
+    pub program: String,
+    pub args: Vec<String>,
+    pub env: std::collections::BTreeMap<String, String>,
+    pub cols: u16,
+    pub rows: u16,
+}
+
+pub(super) struct WebPtySession {
+    id: ide_core::TerminalId,
+    host: std::sync::Weak<crate::Host>,
+    window: String,
+}
+
 /// A file of a web view.
 pub struct WebFile {
     pub bytes: Vec<u8>,
@@ -107,6 +124,138 @@ pub struct WebFile {
 }
 
 impl PluginHost {
+    /// Uses the normal PTY backend, without user shell fallback or startup commands.
+    #[allow(clippy::too_many_arguments)]
+    pub fn spawn_web_pty(
+        &self,
+        host: &std::sync::Arc<crate::Host>,
+        plugin_id: &str,
+        view: &str,
+        window: &str,
+        command: WebPtyCommand,
+        output: crate::ops::Emit<String>,
+    ) -> IdeResult<ide_terminal::TerminalInfo> {
+        let _guard = self.lifecycle.lock();
+        let mut sessions = self.web_ptys.lock();
+        if self.shared.client_closed(window) {
+            return Err(IdeError::cancelled());
+        }
+        let options = self.web_pty_options(plugin_id, view, window, command)?;
+        let entries = sessions.entry(plugin_id.to_owned()).or_default();
+        entries.retain(|s| s.host.upgrade().is_some_and(|h| h.terminals.contains(s.id)));
+        if entries.len() >= 8 {
+            return Err(IdeError::invalid("a plugin may own at most 8 PTYs"));
+        }
+        let cwd = options.cwd.0.clone();
+        let info = host.terminals.spawn_program(
+            options,
+            host.owner_window(window).to_owned(),
+            host.window_sink(window),
+            Box::new(move |data| output(data)),
+        )?;
+        if !self
+            .shared
+            .workspace()
+            .is_some_and(|workspace| workspace.project_of(window).as_ref() == Some(&cwd) && workspace.trusted(&cwd))
+        {
+            let _ = host.terminals.kill(info.id);
+            return Err(IdeError::cancelled());
+        }
+        entries.push(WebPtySession { id: info.id, host: std::sync::Arc::downgrade(host), window: window.to_owned() });
+        Ok(info)
+    }
+
+    pub(super) fn forget_web_ptys(&self, window: &str) {
+        for sessions in self.web_ptys.lock().values_mut() {
+            sessions.retain(|session| {
+                if session.window != window {
+                    return true;
+                }
+                if let Some(host) = session.host.upgrade() {
+                    let _ = host.terminals.kill(session.id);
+                }
+                false
+            });
+        }
+    }
+
+    pub(super) fn stop_web_ptys(&self, plugin: &str) {
+        if let Some(sessions) = self.web_ptys.lock().remove(plugin) {
+            for session in sessions {
+                if let Some(host) = session.host.upgrade() {
+                    let _ = host.terminals.kill(session.id);
+                }
+            }
+        }
+    }
+
+    /// Authorizes a PTY immediately before spawning through the existing terminal backend.
+    pub fn web_pty_options(
+        &self,
+        plugin_id: &str,
+        view: &str,
+        window: &str,
+        command: WebPtyCommand,
+    ) -> IdeResult<ide_terminal::TerminalOptions> {
+        self.web_page(plugin_id, view)?;
+        let plugin = self.get(plugin_id)?;
+        plugin.pkg.manifest.needs_api("web view PTYs", 3).map_err(IdeError::invalid)?;
+        let cap = ide_extension::Capability::Process(command.program.clone());
+        if !plugin.meta.lock().granted.contains(&cap) {
+            return Err(IdeError::new(
+                ide_core::error::ErrorKind::PermissionDenied,
+                format!("{cap} capability not granted"),
+            ));
+        }
+        if command.program.is_empty()
+            || command.program.len() > 256
+            || command.program.trim() != command.program
+            || command.program.contains(['\0', '\r', '\n'])
+            || command.args.len() > 256
+            || command.args.iter().any(|a| a.len() > 4096 || a.contains('\0'))
+            || !(2..=500).contains(&command.cols)
+            || !(1..=500).contains(&command.rows)
+        {
+            return Err(IdeError::invalid("invalid PTY program, arguments or dimensions"));
+        }
+        if command.env.len() > 64
+            || command.env.iter().any(|(k, v)| {
+                k.is_empty()
+                    || k.len() > 256
+                    || k.contains(['=', '\0'])
+                    || v.len() > 4096
+                    || v.contains('\0')
+                    || std::env::vars_os().any(|(inherited, _)| {
+                        if cfg!(windows) {
+                            inherited.to_string_lossy().eq_ignore_ascii_case(k)
+                        } else {
+                            inherited == k.as_str()
+                        }
+                    })
+            })
+        {
+            return Err(IdeError::invalid("PTY environment may only add variables, within the size limits"));
+        }
+        let workspace = self.shared.workspace().ok_or_else(|| IdeError::unavailable("no workspace"))?;
+        let cwd = workspace.project_of(window).ok_or_else(|| IdeError::invalid("no project in this window"))?;
+        if !cwd.is_absolute() || !cwd.is_dir() {
+            return Err(IdeError::invalid("the project directory no longer exists"));
+        }
+        if !workspace.trusted(&cwd) {
+            return Err(IdeError::new(ide_core::error::ErrorKind::PermissionDenied, "project is not trusted"));
+        }
+        let program = self.program_for(plugin_id, &command.program)?;
+        Ok(ide_terminal::TerminalOptions {
+            cwd: cwd.into(),
+            shell: Some(program.to_string_lossy().into_owned()),
+            args: command.args,
+            env: command.env,
+            cols: command.cols,
+            rows: command.rows,
+            shell_integration: false,
+        })
+    }
+
     /// The web roots `plugin` declares (entry directories, package-relative, `/`-terminated).
     fn web_dirs(&self, plugin: &str) -> Vec<String> {
         [super::ui_points::VIEWS, super::ui_points::CUSTOM_EDITORS]

crates/ide-host/src/project.rs

@@ -27,6 +27,7 @@ pub struct Project {
     pub languages: Arc<LanguageRegistry>,
     pub settings: Arc<SettingsStore>,
     pub documents: Arc<Documents>,
+    pub(crate) plugin_diagnostics: Arc<crate::plugins::diagnostics::Diagnostics>,
     pub history: Arc<LocalHistory>,
     /// Undo stack of file move / rename refactorings.
     pub moves: FileMoves,
@@ -56,7 +57,7 @@ pub struct Project {
     pub notebooks: Arc<crate::notebook::NotebookService>,
     pub(crate) kotlin_bridge: Option<Arc<crate::kotlin_bridge::KotlinBridge>>,
     pub(crate) phpstan: Option<Arc<crate::phpstan::Phpstan>>,
-    pub(crate) watcher: Watcher,
+    pub(crate) watcher: Arc<Watcher>,
     /// Watchers of the Project Structure content roots outside the project folder.
     pub(crate) content_watchers: Mutex<Vec<(PathBuf, Watcher)>>,
     /// Watchers of folders outside the project that language servers registered file
@@ -193,6 +194,7 @@ impl Host {
                             &effective.project_structure,
                         ),
                     );
+                    ide_lsp::jdtls::configure_project_structure(cfg, root, server_root, &effective.project_structure);
                     let bundles: Vec<PathBuf> = ide_tools::managed_bundle(&data_dir, "java-debug")
                         .into_iter()
                         .chain(ide_sdk::java::usages_bundle(&data_dir))
@@ -213,13 +215,19 @@ impl Host {
                         cfg.launch_error = Some(e);
                         None
                     });
-                    ide_sdk::apply::configure_java_compiler(cfg, &data_dir, &effective.inspections);
+                    let lang_level = ide_sdk::apply::effective_java_language_level(root, server_root, &effective);
+                    ide_sdk::apply::configure_java_compiler_with_level(
+                        cfg,
+                        &data_dir,
+                        &effective.inspections,
+                        lang_level,
+                    );
                     ide_sdk::java::configure_jdtls(
                         cfg,
                         server_root,
                         &data_dir,
                         &jdks,
-                        ide_sdk::apply::project_jdk(root, &effective).as_ref(),
+                        ide_sdk::apply::module_jdk(root, server_root, &effective).as_ref(),
                         server_jdk.as_ref(),
                         min_java,
                         &bundles,
@@ -305,6 +313,12 @@ impl Host {
         for repo in repos.read().all() {
             repo.set_execution_allowed(trusted.load(Ordering::Acquire));
         }
+        // Shared handle: `unwatched_reason` is a live query on the watcher,
+        // filled after `start` returns so the on-change callback can reach it.
+        let watcher_weak = Arc::new(std::sync::OnceLock::<std::sync::Weak<Watcher>>::new());
+        // One-shot latch for the post-start watch-limit warning (#1915): the
+        // synchronous startup walk and a later batch can both observe it.
+        let notify_watch_exhausted = Arc::new(AtomicBool::new(false));
         let watcher = {
             let kotlin_bridge = kotlin_bridge.clone();
             let phpstan = phpstan.clone();
@@ -322,6 +336,8 @@ impl Host {
             let lsp = lsp.clone();
             let trusted = trusted.clone();
             let build_cache = build_cache.clone();
+            let notify_watch_exhausted = notify_watch_exhausted.clone();
+            let watcher_weak = watcher_weak.clone();
             Watcher::start(
                 &root.clone(),
                 excludes.clone(),
@@ -339,6 +355,9 @@ impl Host {
                     }
                     // Atomic saves by external tools surface as `created`.
                     documents.on_disk_changed(&[&changed[..], &ignored].concat());
+                    if let Some(plugins) = crate::plugins::editor_plugin_host() {
+                        plugins.invalidate_endpoints(&root, &[changed.clone(), batch.removed.clone()].concat());
+                    }
                     // A framework's root marker (`angular.json`) created or deleted: its
                     // templates gain or lose their mode. Markers in `node_modules` only
                     // count here when the folder isn't excluded (it is by default).
@@ -408,9 +427,26 @@ impl Host {
                     if git_dirs || vcs_moved {
                         sink.emit(IdeEvent::VcsChanged { root: root.clone().into() });
                     }
+                    // A watch limit hit after startup (per-directory mode, Linux):
+                    // folders past the limit never sync — surface it once, like
+                    // the polling fallback below (#1915). The check itself is
+                    // deferred to here, on a batch that already had events.
+                    if !notify_watch_exhausted.load(Ordering::Relaxed)
+                        && let Some(msg) =
+                            watcher_weak.get().and_then(std::sync::Weak::upgrade).and_then(|w| w.unwatched_reason())
+                    {
+                        sink.emit(IdeEvent::Notify {
+                            level: ide_core::event::NotifyLevel::Warning,
+                            title: "External file changes sync may be slow".into(),
+                            body: Some(msg),
+                        });
+                        notify_watch_exhausted.store(true, Ordering::Relaxed);
+                    }
                 }),
             )?
         };
+        let watcher = Arc::new(watcher);
+        let _ = watcher_weak.set(Arc::downgrade(&watcher));
         if let Some(reason) = watcher.polling() {
             sink.emit(IdeEvent::Notify {
                 level: ide_core::event::NotifyLevel::Warning,
@@ -418,6 +454,17 @@ impl Host {
                 body: Some(reason.into()),
             });
         }
+        // A watch can also be refused part-way through the synchronous startup
+        // walk (large tree, SYNC_WATCH_BUDGET) — after start() returns, before
+        // any batch. Emit the same warning so the limit isn't silent there either.
+        if let Some(reason) = watcher.unwatched_reason() {
+            sink.emit(IdeEvent::Notify {
+                level: ide_core::event::NotifyLevel::Warning,
+                title: "External file changes sync may be slow".into(),
+                body: Some(reason),
+            });
+            notify_watch_exhausted.store(true, Ordering::Relaxed);
+        }
 
         // Scratch files live outside the project; watch them too so the
         // Project view and open editors follow changes made there.
@@ -473,7 +520,11 @@ impl Host {
             sink.clone(),
         );
         ide_agent::registry::maintain(crate::ops::agent::registry_paths(self));
+        let plugin_diagnostics =
+            crate::plugins::diagnostics::Diagnostics::new(sink.clone(), self.runtime.clone(), &documents, &root);
+        documents.add_observer(plugin_diagnostics.clone());
         let project = Arc::new(Project {
+            plugin_diagnostics,
             trusted,
             root,
             sink,
@@ -619,7 +670,11 @@ impl Host {
             self.local_data_dir.join("notebook-runtime").join(uuid::Uuid::new_v4().to_string()),
             sink.clone(),
         );
+        let plugin_diagnostics =
+            crate::plugins::diagnostics::Diagnostics::new(sink.clone(), self.runtime.clone(), &documents, &dir);
+        documents.add_observer(plugin_diagnostics.clone());
         let project = Arc::new(Project {
+            plugin_diagnostics,
             trusted: Arc::new(AtomicBool::new(false)),
             sink,
             languages,
@@ -644,7 +699,7 @@ impl Host {
             notebooks,
             kotlin_bridge: None,
             phpstan: None,
-            watcher,
+            watcher: Arc::new(watcher),
             content_watchers: Mutex::new(Vec::new()),
             lsp_watchers: Mutex::new(Vec::new()),
             _scratch_watcher: None,

crates/ide-host/src/trust.rs

@@ -16,8 +16,14 @@ pub struct TrustDecisions {
 pub struct TrustStore {
     file: PathBuf,
     state: Mutex<IdeResult<TrustDecisions>>,
+    /// Folders trusted for this process only, by the client that started it ([`TRUSTED_ROOT_ENV`]).
+    inherited: Mutex<Vec<PathBuf>>,
 }
 
+/// Set by the desktop when it starts the server in a dev container of a folder the user trusts
+/// there: the project folder in the container, trusted without asking again. Never persisted.
+pub const TRUSTED_ROOT_ENV: &str = "OPENIDEA_TRUSTED_ROOT";
+
 impl TrustStore {
     pub fn load(config: &Path, data: &Path) -> Self {
         let file = data.join("project-trust.json");
@@ -34,7 +40,7 @@ impl TrustStore {
             }
             Err(e) => Err(e.into()),
         };
-        Self { file, state: Mutex::new(state) }
+        Self { file, state: Mutex::new(state), inherited: Mutex::default() }
     }
 
     pub fn decisions(&self) -> IdeResult<TrustDecisions> {
@@ -45,7 +51,19 @@ impl TrustStore {
         let root = dunce::canonicalize(path)?;
         let decisions = self.decisions()?;
         Ok(!decisions.restricted.contains(&root)
-            && (decisions.projects.contains(&root) || decisions.locations.iter().any(|p| root.starts_with(p))))
+            && (decisions.projects.contains(&root)
+                || decisions.locations.iter().any(|p| root.starts_with(p))
+                || self.inherited.lock().contains(&root)))
+    }
+
+    /// Trusts `path` for this process without recording a decision (see [`TRUSTED_ROOT_ENV`]).
+    pub fn inherit(&self, path: &Path) -> IdeResult<()> {
+        let root = dunce::canonicalize(path)?;
+        let mut inherited = self.inherited.lock();
+        if !inherited.contains(&root) {
+            inherited.push(root);
+        }
+        Ok(())
     }
 
     pub fn decide(&self, path: &Path, trusted: bool, folder: bool) -> IdeResult<()> {
@@ -300,6 +318,7 @@ pub fn restricted_command_allowed(cmd: &str) -> bool {
             | "plugin_set_theme_frame"
             | "plugin_catalog"
             | "plugin_assets"
+            | "plugin_set_ui_locale"
             | "plugin_market"
             | "plugin_market_url"
             | "plugin_set_market_url"

crates/ide-host/tests/docker_run_targets.rs

@@ -117,6 +117,41 @@ async fn docker_targets_run_through_the_docker_cli() {
     assert!(out.contains("DATA=/workspaces/proj/data"), "{out}");
     assert!(!args.iter().any(|a| a.contains("/workspaces/proj/data")), "values stay out of the command line");
 
+    // Debug: the program starts under the bootstrap, which waits for the debugger on a
+    // port published on the loopback interface, with the IDE's debugpy mounted.
+    let lib = host.data_dir.join("tools/debugpy/lib");
+    std::fs::create_dir_all(lib.join("debugpy")).unwrap();
+    std::fs::write(lib.join("debugpy/__init__.py"), "").unwrap();
+    let mut debug = config("py", &root);
+    debug.debug_adapter = Some("debugpy".into());
+    debug.extras.params.insert("containerDebug".into(), "true".into());
+    let out = output_of(&host, debug.clone()).await;
+    let args: Vec<&str> = out.lines().filter_map(|l| l.strip_prefix("arg:")).collect();
+    let publish = args[args.iter().position(|a| *a == "--publish").unwrap() + 1];
+    let port = publish.strip_prefix("127.0.0.1:").and_then(|p| p.split_once(':')).unwrap();
+    assert_eq!(port.0, port.1, "{out}");
+    let bootstrap = host.data_dir.join("container-debug");
+    assert!(args.contains(&format!("{}:/opt/openidea/debug:ro", bootstrap.display()).as_str()), "{out}");
+    assert!(args.contains(&format!("{}:/opt/openidea/debugpy-lib:ro", lib.display()).as_str()), "{out}");
+    assert_eq!(
+        std::fs::read_to_string(bootstrap.join("openidea_debug.py")).unwrap(),
+        ide_remote::docker::DEBUG_BOOTSTRAP
+    );
+    assert!(
+        args.ends_with(&[
+            "python:3.12",
+            "python3",
+            "/opt/openidea/debug/openidea_debug.py",
+            port.0,
+            "/workspaces/proj",
+            "/workspaces/proj/main.py"
+        ]),
+        "{out}"
+    );
+    debug.debug_adapter = Some("delve".into());
+    let err = ops::run::start(&host, "main", debug, Arc::new(|_| {})).await.unwrap_err();
+    assert!(err.message.contains("only Python"), "{}", err.message);
+
     let err = ops::run::start(&host, "main", config("far", &root), Arc::new(|_| {})).await.unwrap_err();
     assert!(err.message.contains("another machine"), "{}", err.message);
 }

crates/ide-host/tests/docker_run_targets_real.rs

@@ -157,3 +157,150 @@ async fn runs_in_docker_and_compose_containers() {
     assert_eq!(containers("label=openidea.run=sleep"), "", "{out}");
     Command::new("docker").args(["compose", "down"]).current_dir(&root).status().unwrap();
 }
+
+/// A debug adapter connection: just enough DAP to drive debugpy.
+struct Dap {
+    reader: std::io::BufReader<std::net::TcpStream>,
+    writer: std::net::TcpStream,
+    seq: i64,
+}
+
+impl Dap {
+    fn connect(address: &str) -> Self {
+        let stream = std::net::TcpStream::connect(address).unwrap();
+        stream.set_read_timeout(Some(Duration::from_secs(60))).unwrap();
+        Self { reader: std::io::BufReader::new(stream.try_clone().unwrap()), writer: stream, seq: 0 }
+    }
+
+    fn send(&mut self, command: &str, arguments: serde_json::Value) {
+        use std::io::Write;
+        self.seq += 1;
+        let body = serde_json::json!({"seq": self.seq, "type": "request", "command": command, "arguments": arguments})
+            .to_string();
+        write!(self.writer, "Content-Length: {}\r\n\r\n{body}", body.len()).unwrap();
+    }
+
+    fn read(&mut self) -> serde_json::Value {
+        use std::io::{BufRead, Read};
+        let mut length = 0;
+        loop {
+            let mut line = String::new();
+            assert!(self.reader.read_line(&mut line).unwrap() > 0, "the adapter closed the connection");
+            let line = line.trim();
+            if line.is_empty() {
+                break;
+            }
+            if let Some(n) = line.strip_prefix("Content-Length:") {
+                length = n.trim().parse().unwrap();
+            }
+        }
+        let mut body = vec![0; length];
+        self.reader.read_exact(&mut body).unwrap();
+        serde_json::from_slice(&body).unwrap()
+    }
+
+    /// Reads until a message of `kind` (`"response"` / `"event"`) named `name`.
+    fn wait(&mut self, kind: &str, name: &str) -> serde_json::Value {
+        loop {
+            let m = self.read();
+            let key = if kind == "event" { "event" } else { "command" };
+            if m["type"] == kind && m[key] == name {
+                return m;
+            }
+        }
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires a Docker daemon, OPENIDEA_DOCKER_TEST_DIR, and pip to fetch debugpy"]
+async fn debugs_python_in_a_container() {
+    let root = PathBuf::from(std::env::var("OPENIDEA_DOCKER_TEST_DIR").expect("OPENIDEA_DOCKER_TEST_DIR"));
+    // A project of its own: the other test may run at the same time.
+    let root = dunce::canonicalize(root).unwrap().join("debug");
+    std::fs::create_dir_all(&root).unwrap();
+    let name = "debug";
+    let main = root.join("main.py");
+    std::fs::write(&main, "import os\nvalue = os.environ['GREETING']\nprint('value=' + value)\n").unwrap();
+    // The IDE's state must be where the daemon can mount it (the bootstrap, the debugpy copy).
+    let state = root.join(".state");
+    let host = host(&state);
+    // The IDE's copy, installed like the Tools page does (`ide_tools` `PipTarget`): the image has no debugpy.
+    let lib = host.data_dir.join("tools/debugpy/lib");
+    let pip = Command::new("python3")
+        .args(["-m", "pip", "install", "--quiet", "--no-deps", "--target"])
+        .arg(&lib)
+        .args(["--only-binary=:all:", "--platform", "any", "--implementation", "py", "debugpy"])
+        .status()
+        .unwrap();
+    assert!(pip.success());
+    host.trust.decide(&root, true, false).unwrap();
+    host.open_project("main", &root).unwrap();
+    let targets =
+        serde_json::json!([{ "kind": "docker", "id": "py", "name": "Python", "image": "python:3.12-alpine" }]);
+    ops::project::set_settings(
+        &host,
+        "main",
+        ide_workspace::settings::SettingsScope::Project,
+        "runTargets",
+        &targets.to_string(),
+    )
+    .unwrap();
+
+    let mut debug = config("debug-main", "py", &root, &[&main.to_string_lossy()]);
+    debug.debug_adapter = Some("debugpy".into());
+    debug.extras.params.insert("containerDebug".into(), "true".into());
+    let (_, out) = start(&host, debug).await;
+    let mut ready = None;
+    for _ in 0..1200 {
+        ready = out
+            .lock()
+            .lines()
+            .find_map(|l| l.trim().strip_prefix(ide_remote::docker::DEBUG_READY).map(|rest| rest.to_owned()));
+        if ready.is_some() || out.lock().contains("Process finished") {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    let ready = ready.unwrap_or_else(|| panic!("{}", out.lock()));
+    let (port, folder) = ready.split_once(", project folder ").unwrap();
+    assert_eq!(folder, format!("/workspaces/{name}"));
+    let address = format!("{}:{port}", std::env::var("OPENIDEA_DOCKER_TEST_HOST").unwrap_or("127.0.0.1".into()));
+
+    // Attach with the project mapped, stop at a breakpoint set on the local file, continue.
+    let local = main.to_string_lossy().into_owned();
+    let root_str = root.to_string_lossy().into_owned();
+    let folder = folder.to_owned();
+    let stopped_at = tokio::task::spawn_blocking(move || {
+        let mut dap = Dap::connect(&address);
+        dap.send(
+            "initialize",
+            serde_json::json!({"adapterID": "debugpy", "pathFormat": "path", "linesStartAt1": true}),
+        );
+        dap.wait("response", "initialize");
+        dap.send(
+            "attach",
+            serde_json::json!({"justMyCode": true, "pathMappings": [{"localRoot": root_str, "remoteRoot": folder}]}),
+        );
+        dap.wait("event", "initialized");
+        dap.send("setBreakpoints", serde_json::json!({"source": {"path": local}, "breakpoints": [{"line": 3}]}));
+        let set = dap.wait("response", "setBreakpoints");
+        assert_eq!(set["body"]["breakpoints"][0]["verified"], true, "{set}");
+        dap.send("configurationDone", serde_json::json!({}));
+        let stopped = dap.wait("event", "stopped");
+        let thread = stopped["body"]["threadId"].clone();
+        dap.send("stackTrace", serde_json::json!({"threadId": thread}));
+        let frame = dap.wait("response", "stackTrace")["body"]["stackFrames"][0].clone();
+        dap.send("continue", serde_json::json!({"threadId": thread}));
+        dap.wait("response", "continue");
+        (stopped["body"]["reason"].clone(), frame["source"]["path"].clone(), frame["line"].clone())
+    })
+    .await
+    .unwrap();
+    assert_eq!(stopped_at.0, "breakpoint");
+    assert_eq!(stopped_at.1, main.to_string_lossy().as_ref(), "the container's path maps back to the project");
+    assert_eq!(stopped_at.2, 3);
+    let out = finished(&out, 60).await;
+    assert!(out.contains("value=hello") && out.contains("exit code 0"), "{out}");
+    assert_eq!(containers("label=openidea.run=debug-main"), "", "removed when the run ends");
+    std::fs::remove_dir_all(&root).unwrap();
+}

crates/ide-host/tests/plugin_commit.rs

@@ -0,0 +1,254 @@
+//! The `commit` interface and the `commit-checker` export, through the
+//! `test.commit` fixture and a scripted window answering `CommitRequested`.
+
+use ide_core::ipc_path::to_ipc;
+use ide_host::plugins::*;
+use ide_plugin::{HostError, Invocation, Limits};
+use parking_lot::Mutex;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+fn fixture_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/commit")
+}
+
+fn git(dir: &Path, args: &[&str]) {
+    let out = Command::new("git")
+        .current_dir(dir)
+        .args(["-c", "init.defaultBranch=main", "-c", "user.name=T", "-c", "[email protected]"])
+        .args(args)
+        .output()
+        .unwrap();
+    assert!(out.status.success(), "git {args:?}: {}", String::from_utf8_lossy(&out.stderr));
+}
+
+struct Workspace {
+    root: PathBuf,
+    trusted: AtomicBool,
+}
+
+impl PluginWorkspace for Workspace {
+    fn projects(&self) -> Vec<PathBuf> {
+        vec![self.root.clone()]
+    }
+    fn buffer_text(&self, _: &Path) -> Option<String> {
+        None
+    }
+    fn document(&self, _: &Path) -> Option<(u64, String)> {
+        None
+    }
+    fn apply_edits(&self, _: &Path, _: u64, _: &[ide_core::TextEdit]) -> Result<u64, HostError> {
+        Err(HostError::NotFound("not open".into()))
+    }
+    fn trusted(&self, _: &Path) -> bool {
+        self.trusted.load(Ordering::Relaxed)
+    }
+    fn project_of(&self, _: &str) -> Option<PathBuf> {
+        Some(self.root.clone())
+    }
+    fn publish_diagnostics(&self, _: &str, _: &Path, _: Vec<ide_core::Diagnostic>) -> Result<(), HostError> {
+        Ok(())
+    }
+}
+
+/// The window's Commit view: its draft, and whether the user types between
+/// the plugin reading it and writing the message.
+#[derive(Default)]
+struct Window {
+    revision: u64,
+    message: String,
+    selection: Option<CommitSelection>,
+    type_after_reading: bool,
+    requests: Vec<CommitRequest>,
+}
+
+struct Fixture {
+    host: Arc<PluginHost>,
+    window: Arc<Mutex<Window>>,
+    workspace: Arc<Workspace>,
+    project: PathBuf,
+    _tmp: tempfile::TempDir,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let tmp = tempfile::tempdir().unwrap();
+        let project = tmp.path().join("project");
+        std::fs::create_dir_all(&project).unwrap();
+        git(&project, &["init", "-q"]);
+        std::fs::write(project.join("a.txt"), "one\ntwo\nthree\n").unwrap();
+        git(&project, &["add", "."]);
+        git(&project, &["commit", "-qm", "base"]);
+        std::fs::write(project.join("a.txt"), "one\nDO NOT COMMIT\nthree\n").unwrap();
+
+        let window = Arc::new(Mutex::new(Window { revision: 7, ..Window::default() }));
+        let host_slot: Arc<Mutex<Option<std::sync::Weak<PluginHost>>>> = Arc::default();
+        let (w, slot) = (window.clone(), host_slot.clone());
+        // Answers on another thread, as the UI does through `plugin_answer_commit`.
+        let sink = Arc::new(move |_: Option<&str>, e: PluginEvent| {
+            let PluginEvent::CommitRequested { request_id, request, .. } = e else { return };
+            let (w, slot) = (w.clone(), slot.clone());
+            std::thread::spawn(move || {
+                let answer = {
+                    let mut w = w.lock();
+                    w.requests.push(request.clone());
+                    match request {
+                        CommitRequest::Selection => {
+                            let selection = w.selection.clone();
+                            if w.type_after_reading {
+                                w.revision += 1;
+                            }
+                            match selection {
+                                Some(s) => CommitAnswer::Selection { selection: s },
+                                None => CommitAnswer::NoRepository,
+                            }
+                        }
+                        CommitRequest::SetMessage { revision, message } if revision == w.revision => {
+                            w.message = message;
+                            w.revision += 1;
+                            CommitAnswer::Done
+                        }
+                        CommitRequest::SetMessage { .. } => CommitAnswer::Stale,
+                    }
+                };
+                let host = slot.lock().as_ref().and_then(std::sync::Weak::upgrade);
+                assert!(host.unwrap().answer_commit(&request_id, answer));
+            });
+        });
+        let host = Arc::new(PluginHost::new(tmp.path().join("plugins"), sink, Limits::default()).unwrap());
+        *host_slot.lock() = Some(Arc::downgrade(&host));
+        let workspace = Arc::new(Workspace { root: project.clone(), trusted: AtomicBool::new(true) });
+        host.set_workspace(Some(workspace.clone()));
+        host.install_from_dir(&fixture_dir(), &Consent::all()).unwrap();
+        Self { host, window, workspace, project, _tmp: tmp }
+    }
+
+    fn inv(&self) -> Invocation {
+        Invocation { client: Some("main".into()), workspace_root: Some(self.project.clone()), ..Invocation::default() }
+    }
+
+    /// `a.txt` included whole, with `message`.
+    fn selection(&self, message: &str) -> CommitSelection {
+        let revision = self.window.lock().revision;
+        CommitSelection {
+            revision,
+            message: message.into(),
+            amend: false,
+            repositories: vec![CommitSelectionRepo {
+                root: self.project.clone().into(),
+                options: ide_vcs::CommitOptions {
+                    stage: vec![self.project.join("a.txt").into()],
+                    run_hooks: true,
+                    ..Default::default()
+                },
+            }],
+        }
+    }
+
+    fn markers(&self, message: &str) -> Vec<PluginCommitCheckResult> {
+        let check = PluginCommitCheckRef { plugin_id: "test.commit".into(), check: "markers".into() };
+        let cancel = ide_core::CancellationToken::new();
+        self.host.commit_checks(self.inv(), self.selection(message), vec![check], &cancel).unwrap()
+    }
+}
+
+#[test]
+fn a_command_reads_the_pending_commit_and_writes_its_message() {
+    let f = Fixture::new();
+    let selection = f.selection("");
+    f.window.lock().selection = Some(selection);
+    let out = f.host.run_command("test.commit", "describe", None, f.inv()).unwrap();
+    assert_eq!(out.as_deref(), Some("chore: modified a.txt"));
+    let w = f.window.lock();
+    assert_eq!(w.message, "chore: modified a.txt");
+    assert_eq!(w.revision, 8);
+    // Reading the draft left the index alone: nothing is staged.
+    let staged = Command::new("git").current_dir(&f.project).args(["diff", "--cached", "--name-only"]).output();
+    assert!(staged.unwrap().stdout.is_empty());
+}
+
+#[test]
+fn typing_meanwhile_makes_the_write_stale() {
+    let f = Fixture::new();
+    let selection = f.selection("");
+    {
+        let mut w = f.window.lock();
+        w.selection = Some(selection);
+        w.type_after_reading = true;
+    }
+    let err = f.host.run_command("test.commit", "describe", None, f.inv()).unwrap_err();
+    assert!(err.message.contains("stale") || err.message.contains("changed"), "{}", err.message);
+    assert_eq!(f.window.lock().message, "");
+}
+
+#[test]
+fn no_repository_and_restricted_mode() {
+    let f = Fixture::new();
+    let err = f.host.run_command("test.commit", "describe", None, f.inv()).unwrap_err();
+    assert!(err.message.contains("no repository"), "{}", err.message);
+
+    f.workspace.trusted.store(false, Ordering::Relaxed);
+    f.window.lock().requests.clear();
+    let err = f.host.run_command("test.commit", "describe", None, f.inv()).unwrap_err();
+    assert!(err.message.contains("Restricted Mode"), "{}", err.message);
+    assert!(f.window.lock().requests.is_empty(), "the window is not asked");
+
+    // Outside a window's command there is no Commit view to ask.
+    let headless = Invocation { client: None, ..f.inv() };
+    let err = f.host.run_command("test.commit", "describe", None, headless).unwrap_err();
+    assert!(err.message.contains("from a command"), "{}", err.message);
+}
+
+#[test]
+fn checks_report_the_message_and_markers_in_the_included_changes() {
+    let f = Fixture::new();
+    let results = f.markers("wip");
+    assert_eq!(results.len(), 1);
+    let r = &results[0];
+    assert_eq!((r.title.as_str(), r.error.as_deref()), ("Commit Markers", None));
+    let found: Vec<_> =
+        r.problems.iter().map(|p| (p.message.as_str(), p.path.clone(), p.range.map(|r| r.start.line))).collect();
+    assert_eq!(
+        found,
+        [
+            ("The message does not start with `type: `.", None, None),
+            ("Remove the DO NOT COMMIT marker.", Some(to_ipc(&f.project.join("a.txt"))), Some(1)),
+        ]
+    );
+    assert_eq!(f.markers("fix: drop marker")[0].problems.len(), 1);
+
+    // Unknown checks are not run, nor those of a plugin that lost `vcs.read`.
+    let other = PluginCommitCheckRef { plugin_id: "test.commit".into(), check: "other".into() };
+    let cancel = ide_core::CancellationToken::new();
+    assert!(f.host.commit_checks(f.inv(), f.selection("x"), vec![other], &cancel).unwrap().is_empty());
+    f.host.set_capability("test.commit", "vcs.read", false).unwrap();
+    assert!(f.markers("wip").iter().all(|r| r.problems.is_empty()));
+}
+
+#[test]
+fn the_commit_points_need_plugin_api_1_3() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host =
+        PluginHost::new(tmp.path().join("plugins"), Arc::new(|_: Option<&str>, _| {}), Limits::default()).unwrap();
+    // The manifest surgery below matches on `\n`; normalize so a CRLF checkout (Windows) behaves the same.
+    let manifest = std::fs::read_to_string(fixture_dir().join("plugin.toml")).unwrap().replace("\r\n", "\n");
+    for (what, manifest) in [
+        (
+            "commit.message",
+            manifest.replace("[[contributes.commitChecks]]\nid = \"markers\"\ntitle = \"Commit Markers\"\n", ""),
+        ),
+        (
+            "commitChecks",
+            manifest.replace("[[contributes.menus]]\nmenu = \"commit.message\"\ncommand = \"describe\"\n", ""),
+        ),
+    ] {
+        let pkg = tmp.path().join(what);
+        std::fs::create_dir_all(pkg.join("dist")).unwrap();
+        std::fs::copy(fixture_dir().join("dist/plugin.wasm"), pkg.join("dist/plugin.wasm")).unwrap();
+        std::fs::write(pkg.join("plugin.toml"), manifest.replace("\"^1.3\"", "\"^1.2\"")).unwrap();
+        let err = host.install_from_dir(&pkg, &Consent::all()).unwrap_err();
+        assert!(err.message.contains("new in plugin API 1.3") && err.message.contains(what), "{what}: {}", err.message);
+    }
+}

crates/ide-host/tests/plugin_diagnostics.rs

@@ -0,0 +1,354 @@
+//! Real Wasm provider dispatch and the document-edit path used locally and over RPC.
+use ide_core::{CancellationToken, ChangeSet, Diagnostic, IdeEvent, Pos, Range, TextChange};
+use ide_host::plugins::{Consent, HostWorkspace, PluginHost, set_editor_providers};
+use ide_host::{Host, HostConfig, ops};
+use ide_plugin::{Invocation, Limits, ProviderDocument};
+use parking_lot::Mutex;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+const ID: &str = "test.diagnostics";
+const SOURCE: &str = "plugin-provider:test.diagnostics";
+
+fn fixture() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/diagnostics")
+}
+
+fn plugins(dir: &Path, limits: Limits) -> Arc<PluginHost> {
+    let host = Arc::new(PluginHost::new(dir.join("plugins"), Arc::new(|_: Option<&str>, _| {}), limits).unwrap());
+    host.install_from_dir(&fixture(), &Consent::all()).unwrap();
+    host
+}
+
+fn generous() -> Limits {
+    Limits { edit_soft: Duration::from_secs(5), edit_hard: Duration::from_secs(10), ..Limits::default() }
+}
+
+fn doc(root: &Path, language: &str, text: &str) -> ProviderDocument {
+    ProviderDocument { path: root.join("a.txt"), language: language.into(), version: 42, text: text.into() }
+}
+
+#[test]
+fn declared_languages_receive_versioned_text_and_utf16_ranges() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = plugins(tmp.path(), generous());
+    let result = host.provide_diagnostics(&doc(tmp.path(), "text", "😀BAD\nBAD"), &CancellationToken::new());
+    assert_eq!(result.len(), 1);
+    assert_eq!(result[0].0, ID);
+    let items = &result[0].1;
+    assert_eq!(items.len(), 2);
+    assert_eq!(items[0].range, Range::new(Pos::new(0, 2), Pos::new(0, 5)));
+    assert_eq!(items[1].range, Range::new(Pos::new(1, 0), Pos::new(1, 3)));
+    assert_eq!(items[0].message, "BAD in text at version 42");
+    assert_eq!(items[0].code.as_deref(), Some("bad-word"));
+    assert_eq!(items[0].server.as_deref(), Some(ID));
+    assert!(host.provide_diagnostics(&doc(tmp.path(), "rust", "BAD"), &CancellationToken::new()).is_empty());
+}
+
+#[test]
+fn provider_diagnostics_have_the_same_bounds_and_tags_as_manual_publish() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = plugins(tmp.path(), generous());
+    let result = host.provide_diagnostics(&doc(tmp.path(), "text", "limits"), &CancellationToken::new());
+    let items = &result[0].1;
+    assert_eq!(items.len(), 5000);
+    assert_eq!(items[0].message.len(), 4096);
+    assert_eq!(items[0].source.as_ref().unwrap().len(), 128);
+    assert_eq!(items[0].code.as_ref().unwrap().len(), 128);
+    assert!(items[0].unnecessary && items[0].deprecated);
+}
+
+#[test]
+fn the_export_does_not_need_project_read_permission() {
+    let tmp = tempfile::tempdir().unwrap();
+    let package = tmp.path().join("no-capability");
+    std::fs::create_dir_all(package.join("dist")).unwrap();
+    std::fs::copy(fixture().join("dist/plugin.wasm"), package.join("dist/plugin.wasm")).unwrap();
+    let manifest = std::fs::read_to_string(fixture().join("plugin.toml")).unwrap();
+    std::fs::write(package.join("plugin.toml"), manifest.replace("[capabilities]\nrequired = [\"project.read\"]", ""))
+        .unwrap();
+    let host = PluginHost::new(tmp.path().join("plugins"), Arc::new(|_: Option<&str>, _| {}), generous()).unwrap();
+    host.install_from_dir(&package, &Consent::default()).unwrap();
+    assert_eq!(host.provide_diagnostics(&doc(tmp.path(), "text", "BAD"), &CancellationToken::new()).len(), 1);
+    assert!(host.run_command(ID, "publish", Some("/project/a.txt"), Invocation::default()).is_err());
+}
+
+#[test]
+fn diagnostics_is_an_api_1_3_addition() {
+    let tmp = tempfile::tempdir().unwrap();
+    let package = tmp.path().join("old");
+    std::fs::create_dir_all(package.join("dist")).unwrap();
+    std::fs::copy(fixture().join("dist/plugin.wasm"), package.join("dist/plugin.wasm")).unwrap();
+    let manifest = std::fs::read_to_string(fixture().join("plugin.toml")).unwrap();
+    std::fs::write(package.join("plugin.toml"), manifest.replace("^1.3", "^1.0")).unwrap();
+    let host = PluginHost::new(tmp.path().join("plugins"), Arc::new(|_: Option<&str>, _| {}), generous()).unwrap();
+    assert!(host.install_from_dir(&package, &Consent::all()).unwrap_err().message.contains("new in plugin API 1.3"));
+}
+
+#[test]
+fn late_and_cancelled_answers_are_dropped_without_disabling_the_plugin() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = plugins(tmp.path(), Limits { edit_soft: Duration::from_millis(10), ..generous() });
+    assert!(host.provide_diagnostics(&doc(tmp.path(), "text", "slow BAD"), &CancellationToken::new()).is_empty());
+    let cancel = CancellationToken::new();
+    cancel.cancel();
+    assert!(host.provide_diagnostics(&doc(tmp.path(), "text", "BAD"), &cancel).is_empty());
+    assert_eq!(host.run_command(ID, "calls", None, Invocation::default()).unwrap().as_deref(), Some("1"));
+}
+
+#[test]
+fn cancelling_a_queued_provider_does_not_interrupt_another_windows_command() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = plugins(tmp.path(), generous());
+    host.run_command(ID, "calls", None, Invocation::default()).unwrap();
+    let waiter = {
+        let host = host.clone();
+        std::thread::spawn(move || host.run_command(ID, "wait", None, Invocation::default()))
+    };
+    std::thread::sleep(Duration::from_millis(50));
+    let cancel = CancellationToken::new();
+    let canceller = {
+        let cancel = cancel.clone();
+        std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(30));
+            cancel.cancel();
+        })
+    };
+    assert!(host.provide_diagnostics(&doc(tmp.path(), "text", "BAD"), &cancel).is_empty());
+    canceller.join().unwrap();
+    assert_eq!(waiter.join().unwrap().unwrap().as_deref(), Some("finished"));
+    assert_eq!(host.run_command(ID, "calls", None, Invocation::default()).unwrap().as_deref(), Some("0"));
+}
+
+#[test]
+fn editor_requests_expire_in_the_queue_without_running_after_a_command() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = plugins(tmp.path(), Limits { edit_soft: Duration::from_millis(10), ..generous() });
+    host.run_command(ID, "calls", None, Invocation::default()).unwrap();
+    let waiter = {
+        let host = host.clone();
+        std::thread::spawn(move || host.run_command(ID, "wait", None, Invocation::default()))
+    };
+    std::thread::sleep(Duration::from_millis(50));
+    assert!(host.provide_diagnostics(&doc(tmp.path(), "text", "BAD"), &CancellationToken::new()).is_empty());
+    assert_eq!(waiter.join().unwrap().unwrap().as_deref(), Some("finished"));
+    assert_eq!(host.run_command(ID, "calls", None, Invocation::default()).unwrap().as_deref(), Some("0"));
+    assert_eq!(host.info_of(ID).unwrap().stats.slow_calls, 1);
+}
+
+#[test]
+fn typing_on_cancels_a_running_provider_before_its_hard_deadline() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = plugins(tmp.path(), Limits { fuel: u64::MAX, ..generous() });
+    host.run_command(ID, "calls", None, Invocation::default()).unwrap();
+    let cancel = CancellationToken::new();
+    let canceller = {
+        let cancel = cancel.clone();
+        std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(30));
+            cancel.cancel();
+        })
+    };
+    let started = Instant::now();
+    assert!(host.provide_diagnostics(&doc(tmp.path(), "text", "spin BAD"), &cancel).is_empty());
+    assert!(started.elapsed() < Duration::from_secs(2));
+    canceller.join().unwrap();
+}
+
+// This executable has one edit-path test because editor providers are installed once per process.
+type Events = Arc<Mutex<Vec<(String, IdeEvent)>>>;
+
+fn runtime_host(base: &Path, events: Events) -> Arc<Host> {
+    Arc::new(Host::new(HostConfig {
+        config_dir: base.join("config"),
+        data_dir: base.join("data"),
+        local_data_dir: base.join("data"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(move |window| {
+            let (events, window) = (events.clone(), window.to_owned());
+            Arc::new(move |event: IdeEvent| events.lock().push((window.clone(), event)))
+        }),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }))
+}
+
+fn latest(events: &Events, window: &str, source: &str) -> Option<Vec<Diagnostic>> {
+    events.lock().iter().rev().find_map(|(w, e)| match e {
+        IdeEvent::Diagnostics { source: s, items, .. } if w == window && s == source => Some(items.clone()),
+        _ => None,
+    })
+}
+
+async fn wait_for(events: &Events, window: &str, predicate: impl Fn(&[Diagnostic]) -> bool) {
+    wait_for_source(events, window, SOURCE, predicate).await;
+}
+
+async fn wait_for_source(events: &Events, window: &str, source: &str, predicate: impl Fn(&[Diagnostic]) -> bool) {
+    let start = Instant::now();
+    loop {
+        if latest(events, window, source).is_some_and(|items| predicate(&items)) {
+            return;
+        }
+        assert!(start.elapsed() < Duration::from_secs(5), "missing diagnostics for {window}");
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    }
+}
+
+fn replace(host: &Host, window: &str, info: &ide_workspace::DocumentInfo, text: &str) -> u32 {
+    let project = host.project(window).unwrap();
+    let snapshot = project.documents.snapshot(info.id).unwrap();
+    let len = snapshot.text.encode_utf16().count() as u32;
+    ops::doc::edit(
+        host,
+        window,
+        info.id,
+        snapshot.version,
+        ChangeSet { changes: vec![TextChange { from: 0, to: len, insert: text.into() }] },
+    )
+    .unwrap()
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn typing_is_debounced_versioned_and_scoped_to_document_project_and_window_lifetimes() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = dunce::canonicalize(tmp.path()).unwrap();
+    let path = root.join("a.txt");
+    std::fs::write(&path, "clean").unwrap();
+    let events: Events = Arc::default();
+    let host = runtime_host(&root.join("app"), events.clone());
+    let plugins = plugins(&root, generous());
+    plugins.set_workspace(Some(Arc::new(HostWorkspace(Arc::downgrade(&host)))));
+    set_editor_providers(Some(&plugins));
+    let left = host.open_light("left", &path).unwrap();
+    host.open_light("right", &path).unwrap();
+    let a = ops::doc::open(&host, "left", path.clone()).await.unwrap();
+    let b = ops::doc::open(&host, "right", path.clone()).await.unwrap();
+    let second_tab = ops::doc::open(&host, "right", path.clone()).await.unwrap();
+    assert_eq!(b.id, second_tab.id);
+    wait_for(&events, "left", |items| items.is_empty()).await;
+    wait_for(&events, "right", |items| items.is_empty()).await;
+
+    let calls: u64 = plugins.run_command(ID, "calls", None, Invocation::default()).unwrap().unwrap().parse().unwrap();
+    events.lock().clear();
+    replace(&host, "left", &a, "BAD");
+    tokio::time::sleep(Duration::from_millis(100)).await;
+    let version = replace(&host, "left", &a, "😀BAD");
+    tokio::time::sleep(Duration::from_millis(150)).await;
+    assert!(latest(&events, "left", SOURCE).is_none(), "300ms after the latest edit");
+    wait_for(&events, "left", |items| !items.is_empty()).await;
+    assert_eq!(
+        latest(&events, "left", SOURCE).unwrap()[0].message,
+        format!("BAD in {} at version {version}", a.language)
+    );
+    assert!(latest(&events, "right", SOURCE).is_none(), "other window has its own buffer");
+    assert_eq!(std::fs::read_to_string(&path).unwrap(), "clean", "no save required");
+    let after: u64 = plugins.run_command(ID, "calls", None, Invocation::default()).unwrap().unwrap().parse().unwrap();
+    assert_eq!(after, calls + 1, "the edit burst was coalesced");
+
+    plugins.run_command(ID, "publish", path.to_str(), Invocation::default()).unwrap();
+    let manual_window = events.lock().iter().find_map(|(window, event)| matches!(event, IdeEvent::Diagnostics { source, items, .. } if source == "plugin:test.diagnostics" && !items.is_empty()).then(|| window.clone())).unwrap();
+    assert_eq!(latest(&events, &manual_window, "plugin:test.diagnostics").unwrap()[0].message, "Manual problem");
+    replace(&host, "left", &a, "clean again");
+    wait_for(&events, "left", |items| items.is_empty()).await;
+    assert_eq!(latest(&events, &manual_window, "plugin:test.diagnostics").unwrap()[0].message, "Manual problem");
+
+    events.lock().clear();
+    replace(&host, "left", &a, "slow BAD");
+    tokio::time::sleep(Duration::from_millis(350)).await;
+    replace(&host, "left", &a, "latest clean");
+    wait_for(&events, "left", |items| items.is_empty()).await;
+    assert!(
+        !events.lock().iter().any(|(_, e)| matches!(e, IdeEvent::Diagnostics { items, .. } if !items.is_empty())),
+        "superseded in-flight answers never publish"
+    );
+
+    replace(&host, "right", &b, "BAD right");
+    wait_for(&events, "right", |items| !items.is_empty()).await;
+    ops::doc::close(&host, "right", b.id).unwrap();
+    assert!(!latest(&events, "right", SOURCE).unwrap().is_empty(), "another pane still owns this document");
+    ops::doc::close(&host, "right", second_tab.id).unwrap();
+    wait_for(&events, "right", |items| items.is_empty()).await;
+    replace(&host, "left", &a, "BAD left");
+    wait_for(&events, "left", |items| !items.is_empty()).await;
+    plugins.set_enabled(ID, false).unwrap();
+    wait_for(&events, "left", |items| items.is_empty()).await;
+    plugins.set_enabled(ID, true).unwrap();
+
+    events.lock().clear();
+    replace(&host, "left", &a, "slow BAD closing");
+    tokio::time::sleep(Duration::from_millis(350)).await;
+    host.close_project("left");
+    // Keep the old Project alive deliberately: window reuse must still cancel it.
+    assert_eq!(left.documents.snapshot(a.id).unwrap().text, "slow BAD closing");
+    host.open_light("left", &path).unwrap();
+    let reopened = ops::doc::open(&host, "left", path.clone()).await.unwrap();
+    wait_for(&events, "left", |items| items.is_empty()).await;
+    assert!(!events.lock().iter().any(|(_, e)| matches!(e, IdeEvent::Diagnostics { items, .. } if !items.is_empty())));
+    // Project plugins receive only snapshots from the project that owns their declaration.
+    let project_package = root.join(ide_host::plugins::DEV_PLUGINS_DIR).join("diagnostics");
+    std::fs::create_dir_all(project_package.join("dist")).unwrap();
+    std::fs::copy(fixture().join("dist/plugin.wasm"), project_package.join("dist/plugin.wasm")).unwrap();
+    let manifest = std::fs::read_to_string(fixture().join("plugin.toml")).unwrap();
+    std::fs::write(project_package.join("plugin.toml"), manifest.replace(ID, "project.diagnostics")).unwrap();
+    plugins.set_project_policy(Arc::new(|_| true));
+    plugins.sync_project(&root);
+    plugins.grant("project.diagnostics", &Consent::all()).unwrap();
+    replace(&host, "left", &reopened, "BAD in project");
+    wait_for(&events, "left", |items| !items.is_empty()).await;
+    let project_source = "plugin-provider:project.diagnostics";
+    wait_for_source(&events, "left", project_source, |items| !items.is_empty()).await;
+    let elsewhere = root.join("other");
+    std::fs::create_dir_all(&elsewhere).unwrap();
+    let other_path = elsewhere.join("other.txt");
+    std::fs::write(&other_path, "BAD outside").unwrap();
+    host.open_light("elsewhere", &other_path).unwrap();
+    ops::doc::open(&host, "elsewhere", other_path).await.unwrap();
+    wait_for(&events, "elsewhere", |items| !items.is_empty()).await;
+    assert!(latest(&events, "elsewhere", project_source).is_none());
+    plugins.restrict_project(&root);
+    assert!(latest(&events, "left", project_source).unwrap().is_empty());
+    // A completed answer may still be waiting for a sibling when its plugin crashes.
+    let sibling = root.join("slow-sibling");
+    std::fs::create_dir_all(sibling.join("dist")).unwrap();
+    std::fs::copy(fixture().join("dist/plugin.wasm"), sibling.join("dist/plugin.wasm")).unwrap();
+    let manifest = std::fs::read_to_string(fixture().join("plugin.toml")).unwrap();
+    std::fs::write(
+        sibling.join("plugin.toml"),
+        manifest.replace(ID, "test.slow").replace("[\"text\", \"plaintext\"]", "[\"plaintext\"]"),
+    )
+    .unwrap();
+    plugins.install_from_dir(&sibling, &Consent::all()).unwrap();
+    plugins.run_command("test.slow", "calls", None, Invocation::default()).unwrap();
+    let calls = plugins.run_command(ID, "calls", None, Invocation::default()).unwrap();
+    events.lock().clear();
+    replace(&host, "left", &reopened, "BAD completed before crash");
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    let waiter = {
+        let plugins = plugins.clone();
+        std::thread::spawn(move || plugins.run_command("test.slow", "wait", None, Invocation::default()))
+    };
+    let started = Instant::now();
+    while plugins.run_command(ID, "calls", None, Invocation::default()).unwrap() == calls {
+        assert!(started.elapsed() < Duration::from_secs(5));
+        tokio::time::sleep(Duration::from_millis(5)).await;
+    }
+    assert!(
+        latest(&events, "left", SOURCE).is_none_or(|items| items.is_empty()),
+        "the sibling still holds the result: {:?}",
+        latest(&events, "left", SOURCE)
+    );
+    assert!(plugins.provide_diagnostics(&doc(&root, "text", "panic"), &CancellationToken::new()).is_empty());
+    waiter.join().unwrap().unwrap();
+    wait_for_source(&events, "left", "plugin-provider:test.slow", |items| !items.is_empty()).await;
+    assert!(
+        latest(&events, "left", SOURCE).is_none_or(|items| items.is_empty()),
+        "a crash invalidates completed answers"
+    );
+    ops::doc::close(&host, "left", reopened.id).unwrap();
+    host.shutdown().await;
+    set_editor_providers(None);
+}

crates/ide-host/tests/plugin_hover.rs

@@ -0,0 +1,55 @@
+use ide_core::Pos;
+use ide_host::plugins::{Consent, PluginHost};
+use ide_plugin::{Limits, ProviderDocument};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+fn fixture_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/hover")
+}
+
+fn host(dir: &Path) -> PluginHost {
+    let limits = Limits { edit_soft: Duration::from_secs(5), edit_hard: Duration::from_secs(10), ..Limits::default() };
+    PluginHost::new(dir.join("plugins"), Arc::new(|_: Option<&str>, _| {}), limits).unwrap()
+}
+
+fn doc(dir: &Path, language: &str, text: &str) -> ProviderDocument {
+    ProviderDocument { path: dir.join("Order.php"), language: language.into(), version: 1, text: text.into() }
+}
+
+const ORDER: &str = "<?php\nclass Order\n{\n    public function user() {}\n}\n$order->user;\n$order->total;\n";
+
+#[test]
+fn a_declared_name_gets_the_plugins_hover() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    host.install_from_dir(&fixture_dir(), &Consent::all()).unwrap();
+    let hovers = host.provide_hover(&doc(tmp.path(), "php", ORDER), Pos::new(5, 10));
+    assert_eq!(hovers.len(), 1);
+    assert_eq!(hovers[0].markdown, "**user** · declared on line 4");
+    let range = hovers[0].range.unwrap();
+    assert_eq!((range.start.line, range.start.col, range.end.line, range.end.col), (5, 8, 5, 12));
+    assert!(host.provide_hover(&doc(tmp.path(), "php", ORDER), Pos::new(6, 10)).is_empty());
+}
+
+#[test]
+fn only_declared_languages_are_asked() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    host.install_from_dir(&fixture_dir(), &Consent::all()).unwrap();
+    assert!(host.provide_hover(&doc(tmp.path(), "javascript", ORDER), Pos::new(5, 10)).is_empty());
+}
+
+#[test]
+fn the_kind_needs_plugin_api_1_3() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    let pkg = tmp.path().join("old");
+    std::fs::create_dir_all(pkg.join("dist")).unwrap();
+    std::fs::copy(fixture_dir().join("dist/plugin.wasm"), pkg.join("dist/plugin.wasm")).unwrap();
+    let manifest = std::fs::read_to_string(fixture_dir().join("plugin.toml")).unwrap();
+    std::fs::write(pkg.join("plugin.toml"), manifest.replace("\"^1.3\"", "\"^1.0\"")).unwrap();
+    let err = host.install_from_dir(&pkg, &Consent::all()).unwrap_err();
+    assert!(err.message.contains("new in plugin API 1.3"), "{}", err.message);
+}

crates/ide-host/tests/plugin_inlay_hints.rs

@@ -0,0 +1,59 @@
+use ide_core::{Pos, Range};
+use ide_host::plugins::{Consent, PluginHost};
+use ide_plugin::{Limits, ProviderDocument};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+fn fixture_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/inlay-hints")
+}
+
+fn host(dir: &Path) -> PluginHost {
+    let limits = Limits { edit_soft: Duration::from_secs(5), edit_hard: Duration::from_secs(10), ..Limits::default() };
+    PluginHost::new(dir.join("plugins"), Arc::new(|_: Option<&str>, _| {}), limits).unwrap()
+}
+
+fn doc(dir: &Path, language: &str, text: &str) -> ProviderDocument {
+    ProviderDocument { path: dir.join("Order.php"), language: language.into(), version: 1, text: text.into() }
+}
+
+const ORDER: &str = "<?php\nclass Order\n{\n    public function user(): ?User {}\n}\n$order->user();\n$order->total();\n$order->user;\n";
+
+fn all() -> Range {
+    Range::new(Pos::new(0, 0), Pos::new(100, 0))
+}
+
+#[test]
+fn calls_of_declared_methods_get_a_type_hint() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    host.install_from_dir(&fixture_dir(), &Consent::all()).unwrap();
+    let hints = host.provide_inlay_hints(&doc(tmp.path(), "php", ORDER), all());
+    let found: Vec<_> =
+        hints.iter().map(|h| (h.position.line, h.position.col, h.label.as_str(), h.kind.as_str())).collect();
+    assert_eq!(found, [(5, 14, ": ?User", "type")]);
+    assert_eq!(hints[0].tooltip.as_deref(), Some("user() returns ?User"));
+    assert!(!hints[0].padding_left && !hints[0].padding_right);
+}
+
+#[test]
+fn only_declared_languages_are_asked() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    host.install_from_dir(&fixture_dir(), &Consent::all()).unwrap();
+    assert!(host.provide_inlay_hints(&doc(tmp.path(), "javascript", ORDER), all()).is_empty());
+}
+
+#[test]
+fn the_kind_needs_plugin_api_1_3() {
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    let pkg = tmp.path().join("old");
+    std::fs::create_dir_all(pkg.join("dist")).unwrap();
+    std::fs::copy(fixture_dir().join("dist/plugin.wasm"), pkg.join("dist/plugin.wasm")).unwrap();
+    let manifest = std::fs::read_to_string(fixture_dir().join("plugin.toml")).unwrap();
+    std::fs::write(pkg.join("plugin.toml"), manifest.replace("\"^1.3\"", "\"^1.0\"")).unwrap();
+    let err = host.install_from_dir(&pkg, &Consent::all()).unwrap_err();
+    assert!(err.message.contains("new in plugin API 1.3"), "{}", err.message);
+}

crates/ide-host/tests/plugin_symbols.rs

@@ -0,0 +1,232 @@
+//! The synchronous workspace import uses the real project index, also from a provider.
+use ide_core::CancellationToken;
+use ide_core::{NullSink, Pos, Range};
+use ide_host::plugins::{Consent, HostWorkspace, PluginHost, PluginWorkspace};
+use ide_host::{Host, HostConfig};
+use ide_plugin::{Invocation, Limits, ProviderDocument};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, OnceLock};
+use std::time::{Duration, Instant};
+
+const WAIT: Duration = Duration::from_secs(30);
+
+struct Fixture {
+    _tmp: tempfile::TempDir,
+    _runtime: tokio::runtime::Runtime,
+    host: Arc<Host>,
+    plugins: PluginHost,
+    root: PathBuf,
+    other: PathBuf,
+}
+
+impl Fixture {
+    fn new(capability: bool) -> Self {
+        let tmp = tempfile::tempdir().unwrap();
+        let base = dunce::canonicalize(tmp.path()).unwrap();
+        let (root, other) = (base.join("project"), base.join("other"));
+        for dir in [&root, &other] {
+            std::fs::create_dir_all(dir).unwrap();
+        }
+        std::fs::write(root.join("Order.php"), "<?php class OrderController { public function item() {} }\n").unwrap();
+        std::fs::write(root.join("Main.java"), "class OrderService { void serve() {} }\n").unwrap();
+        std::fs::write(other.join("Order.php"), "<?php class OrderElsewhere {}\n").unwrap();
+        let runtime = tokio::runtime::Builder::new_multi_thread().worker_threads(2).enable_all().build().unwrap();
+        let syntax = OnceLock::new();
+        syntax.set(Arc::new(ide_language::Syntax::new())).ok().unwrap();
+        let host = Arc::new(Host::new(HostConfig {
+            config_dir: base.join("config"),
+            data_dir: base.join("data"),
+            local_data_dir: base.join("data"),
+            languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+            syntax: Arc::new(syntax),
+            sink_for: Box::new(|_| Arc::new(NullSink)),
+            owner: |w| w,
+            runtime: runtime.handle().clone(),
+            project_environment: false,
+        }));
+        // Restricted projects need no LSP/process startup for index queries.
+        {
+            let _guard = runtime.enter();
+            for (window, dir) in [("main", &root), ("other", &other)] {
+                let project = host.open_project(window, dir).unwrap();
+                assert!(project.index.wait_idle(WAIT));
+            }
+        }
+        let plugins = PluginHost::new(
+            base.join("plugins"),
+            Arc::new(|_: Option<&str>, _| {}),
+            Limits { edit_soft: Duration::from_secs(5), edit_hard: Duration::from_secs(10), ..Limits::default() },
+        )
+        .unwrap();
+        plugins.set_workspace(Some(Arc::new(HostWorkspace(Arc::downgrade(&host)))));
+        plugins.set_project_policy(Arc::new(|_| true));
+        let source = Path::new(env!("CARGO_MANIFEST_DIR")).join("../ide-plugin/tests/fixtures/symbols");
+        let package = base.join("fixture");
+        std::fs::create_dir_all(package.join("dist")).unwrap();
+        std::fs::copy(source.join("dist/plugin.wasm"), package.join("dist/plugin.wasm")).unwrap();
+        let manifest = std::fs::read_to_string(source.join("plugin.toml")).unwrap();
+        let manifest =
+            if capability { manifest } else { manifest.replace("required = [\"project.read\"]", "required = []") };
+        std::fs::write(package.join("plugin.toml"), manifest).unwrap();
+        plugins.install_from_dir(&package, &Consent::all()).unwrap();
+        Self { _tmp: tmp, _runtime: runtime, host, plugins, root, other }
+    }
+
+    fn invoke(&self, command: &str, root: &Path, query: &str) -> ide_core::IdeResult<Option<String>> {
+        self.plugins.run_command(
+            "test.symbols",
+            command,
+            Some(query),
+            Invocation { workspace_root: Some(root.to_path_buf()), ..Default::default() },
+        )
+    }
+
+    fn search(&self, query: &str) -> String {
+        self.invoke("symbols", &self.root, query).unwrap().unwrap()
+    }
+}
+
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        self.host.close_project("main");
+        self.host.close_project("other");
+    }
+}
+
+#[test]
+fn symbols_reach_commands_and_providers_without_a_language_server() {
+    let f = Fixture::new(true);
+    let all = f.search("Order|10");
+    assert!(all.contains("OrderController\tclass\t"), "{all}");
+    assert!(all.contains("OrderService\tclass\t"), "{all}");
+    assert!(!all.contains("OrderElsewhere"));
+    assert_eq!(f.search("OCo|1").lines().count(), 1);
+    assert!(f.search("OrderController.item|1").starts_with("item\tmethod\tOrderController\t"));
+    assert!(f.search("|10").is_empty());
+    assert!(f.search("Order|0").is_empty());
+    assert!(f.search("missing|10").is_empty());
+    assert!(f.search("Order|4294967295").contains("OrderController"));
+    assert!(
+        f.invoke("symbols", &f.root, &format!("{}|1", "é".repeat(129)))
+            .unwrap_err()
+            .message
+            .contains("256 UTF-8 bytes")
+    );
+    let other = f.invoke("symbols", &f.other, "Order|10").unwrap().unwrap();
+    assert!(other.contains("OrderElsewhere") && !other.contains("OrderController"));
+    for language in ["php", "java"] {
+        let targets = f.plugins.provide_definition(
+            &ProviderDocument {
+                path: f.root.join(if language == "php" { "Usage.php" } else { "Usage.java" }),
+                language: language.into(),
+                version: 1,
+                text: "OCo".into(),
+            },
+            Pos::new(0, 3),
+        );
+        assert_eq!(targets.len(), 1);
+        assert_eq!(targets[0].path, f.root.join("Order.php"));
+        let indexed = HostWorkspace(Arc::downgrade(&f.host))
+            .symbols(&f.root, "OCo", 1, &CancellationToken::new(), Instant::now() + WAIT)
+            .unwrap();
+        assert_eq!(targets[0].range, indexed[0].location.range);
+    }
+}
+
+#[test]
+fn reindex_and_closed_project_replace_results_and_invalidate_retained_handles() {
+    let f = Fixture::new(true);
+    f.invoke("remember", &f.root, "").unwrap();
+    let p = f.host.project("main").unwrap();
+    let path = f.root.join("Order.php");
+    std::fs::write(&path, "<?php /*😀*/ class UpdatedController {}\n").unwrap();
+    p.index.update(std::slice::from_ref(&path), &[]);
+    assert!(p.index.wait_idle(WAIT));
+    assert!(!f.search("Order|10").contains("OrderController"));
+    let symbols = HostWorkspace(Arc::downgrade(&f.host))
+        .symbols(&f.root, "UpdatedController", 1, &CancellationToken::new(), Instant::now() + WAIT)
+        .unwrap();
+    assert_eq!(symbols.len(), 1);
+    assert_eq!(symbols[0].location.range, Range::new(Pos::new(0, 19), Pos::new(0, 36)));
+    assert!(f.search("Updated|10").contains("0:19-0:36"));
+    std::fs::remove_file(&path).unwrap();
+    p.index.update(&[], &[path]);
+    assert!(p.index.wait_idle(WAIT));
+    assert!(f.search("Updated|10").is_empty());
+    f.host.close_project("main");
+    let error = f.invoke("remembered", &f.root, "Order|10").unwrap_err();
+    assert!(error.message.contains("no longer open"), "{error}");
+}
+
+#[test]
+fn large_limits_are_capped_before_searching_the_index() {
+    let f = Fixture::new(true);
+    let project = f.host.project("main").unwrap();
+    let path = f.root.join("Bulk.java");
+    let text = (0..1005).map(|i| format!("class BulkSymbol{i} {{}}\n")).collect::<String>();
+    std::fs::write(&path, text).unwrap();
+    project.index.update(&[path], &[]);
+    assert!(project.index.wait_idle(WAIT));
+    assert_eq!(f.search("BulkSymbol|4294967295").lines().count(), 1000);
+}
+
+#[test]
+fn symbol_queries_require_project_read_even_with_an_invocation_project() {
+    let f = Fixture::new(false);
+    let error = f.invoke("symbols", &f.root, "Order|10").unwrap_err();
+    assert!(error.message.contains("project.read"), "{error}");
+    assert!(
+        f.plugins
+            .provide_definition(
+                &ProviderDocument {
+                    path: f.root.join("Usage.php"),
+                    language: "php".into(),
+                    version: 1,
+                    text: "OCo".into(),
+                },
+                Pos::new(0, 3)
+            )
+            .is_empty()
+    );
+}
+
+#[test]
+fn symbol_search_excludes_external_content_roots_before_ranking() {
+    let f = Fixture::new(true);
+    let project = f.host.project("main").unwrap();
+    std::fs::write(f.other.join("Exact.php"), "<?php class Order {}\n").unwrap();
+    project.index.set_scope(vec![f.other.clone()], Vec::new());
+    assert!(project.index.wait_idle(WAIT));
+    assert_eq!(project.index.find_symbols("OrderElsewhere", ide_index::SymbolFilter::All, 1).len(), 1);
+    assert!(f.search("OrderElsewhere|10").is_empty());
+    // A better external match must not displace a readable fuzzy match.
+    let result = f.search("Order|1");
+    assert!(result.contains("OrderController") || result.contains("OrderService"), "{result}");
+}
+
+#[test]
+fn native_symbol_search_honours_cancellation_and_deadlines() {
+    let f = Fixture::new(true);
+    let workspace = HostWorkspace(Arc::downgrade(&f.host));
+    let cancel = CancellationToken::new();
+    cancel.cancel();
+    assert_eq!(
+        workspace.symbols(&f.root, "Order", 10, &cancel, Instant::now() + WAIT),
+        Err(ide_plugin::HostError::Cancelled)
+    );
+    let error = workspace.symbols(&f.root, "Order", 10, &CancellationToken::new(), Instant::now()).unwrap_err();
+    assert!(error.to_string().contains("timed out"), "{error}");
+}
+
+#[cfg(unix)]
+#[test]
+fn symbol_search_excludes_updates_through_escaping_symlink_ancestors() {
+    let f = Fixture::new(true);
+    let project = f.host.project("main").unwrap();
+    std::fs::write(f.other.join("Secret.php"), "<?php class SecretSymbol {}\n").unwrap();
+    let dir = f.root.join("linked");
+    std::os::unix::fs::symlink(&f.other, &dir).unwrap();
+    project.index.update(&[dir.join("Secret.php")], &[]);
+    assert!(project.index.wait_idle(WAIT));
+    assert!(f.search("Secret|1").is_empty());
+}

crates/ide-host/tests/remote_plugins.rs

@@ -164,6 +164,9 @@ async fn remote_projects_run_the_desktops_code_plugins_on_the_server() {
     let kinds = invoke(&peer, "plugin_event_kinds", json!({})).await.unwrap();
     assert!(kinds.as_array().unwrap().contains(&json!("file-saved")), "{kinds}");
 
+    invoke(&peer, "plugin_set_ui_locale", json!({ "tag": "fr" })).await.unwrap();
+    assert_eq!(plugins.host().ui_locale(), "fr");
+
     // Saving a file that exists only on the server: Checkstyle reads that file.
     let java = project.join("src/A.java");
     std::fs::write(&java, "class A {\n\tint x;\n}\n").unwrap();

crates/ide-host/tests/trust.rs

@@ -211,6 +211,24 @@ fn persists_user_decisions_locations_revocation_and_one_time_migration() {
     assert!(TrustStore::load(&config, &data).trusted(&a).is_err(), "corruption fails closed");
 }
 
+#[test]
+fn an_inherited_folder_is_trusted_for_this_process_only() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (config, data) = (tmp.path().join("config"), tmp.path().join("data"));
+    let root = tmp.path().join("workspaces/app");
+    std::fs::create_dir_all(&root).unwrap();
+    let trust = TrustStore::load(&config, &data);
+    assert!(!trust.trusted(&root).unwrap());
+    trust.inherit(&root).unwrap();
+    assert!(trust.trusted(&root).unwrap());
+    assert!(!trust.trusted(root.parent().unwrap()).unwrap(), "only that folder");
+    assert!(trust.status(&root).unwrap().decided, "the trust prompt doesn't ask again");
+    assert!(trust.decisions().unwrap().projects.is_empty(), "no decision is recorded");
+    assert!(!TrustStore::load(&config, &data).trusted(&root).unwrap(), "not persisted");
+    trust.decide(&root, false, false).unwrap();
+    assert!(!trust.trusted(&root).unwrap(), "a decision to restrict it still wins");
+}
+
 #[cfg(unix)]
 fn script(root: &Path, name: &str, marker: &str) {
     use std::os::unix::fs::PermissionsExt;

crates/ide-index/src/lib.rs

@@ -268,6 +268,43 @@ impl ProjectIndex {
         matching::find_symbols(&d, &matching::Recents { paths: &recent }, query, filter, limit)
     }
 
+    /// Scoped symbol search with cooperative interruption, including lock waits.
+    /// `None` means interrupted; no partial results are returned.
+    pub fn find_symbols_until(
+        &self,
+        query: &str,
+        filter: SymbolFilter,
+        limit: usize,
+        include: &(impl Fn(&Path) -> bool + Sync),
+        stopped: &(impl Fn() -> bool + Sync),
+    ) -> Option<Vec<SymbolMatch>> {
+        let recent = loop {
+            if stopped() {
+                return None;
+            }
+            if let Some(recent) = self.shared.recent.try_lock_for(Duration::from_millis(1)) {
+                break recent.clone();
+            }
+        };
+        let data = loop {
+            if stopped() {
+                return None;
+            }
+            if let Some(data) = self.shared.data.try_read_for(Duration::from_millis(1)) {
+                break data;
+            }
+        };
+        matching::find_symbols_until(
+            &data,
+            &matching::Recents { paths: &recent },
+            query,
+            filter,
+            limit,
+            include,
+            stopped,
+        )
+    }
+
     /// Symbols named exactly `name` (of `kind`, if given): `.card` selectors for `class="card"`.
     pub fn symbols_named(&self, name: &str, kind: Option<SymbolKind>, limit: usize) -> Vec<SymbolMatch> {
         matching::symbols_named(&self.shared.data.read(), name, kind, limit)

crates/ide-index/src/matching.rs

@@ -121,22 +121,35 @@ fn scan(
     tiebreak: &(impl Fn(&Cand, &Cand) -> Ordering + Sync),
     per_file: impl Fn(u32, &FileEntry, &mut Vec<Cand>) + Sync,
 ) -> Vec<Cand> {
+    scan_until(data, pool, tiebreak, &|| false, per_file).unwrap_or_default()
+}
+
+fn scan_until(
+    data: &IndexData,
+    pool: usize,
+    tiebreak: &(impl Fn(&Cand, &Cand) -> Ordering + Sync),
+    stopped: &(impl Fn() -> bool + Sync),
+    per_file: impl Fn(u32, &FileEntry, &mut Vec<Cand>) + Sync,
+) -> Option<Vec<Cand>> {
     data.files
         .par_iter()
         .enumerate()
         .with_min_len(256)
-        .fold(Vec::new, |mut acc, (slot, e)| {
+        .try_fold(Vec::new, |mut acc, (slot, e)| {
+            if stopped() {
+                return None;
+            }
             if let Some(e) = e {
                 per_file(slot as u32, e, &mut acc);
                 if acc.len() >= pool * 2 {
                     acc = keep_best(acc, pool, tiebreak);
                 }
             }
-            acc
+            Some(acc)
         })
-        .reduce(Vec::new, |mut a, b| {
+        .try_reduce(Vec::new, |mut a, b| {
             a.extend(b);
-            if a.len() >= pool * 2 { keep_best(a, pool, tiebreak) } else { a }
+            Some(if a.len() >= pool * 2 { keep_best(a, pool, tiebreak) } else { a })
         })
 }
 
@@ -423,9 +436,21 @@ pub(crate) fn find_symbols(
     filter: SymbolFilter,
     limit: usize,
 ) -> Vec<SymbolMatch> {
+    find_symbols_until(data, recents, query, filter, limit, &|_| true, &|| false).unwrap_or_default()
+}
+
+pub(crate) fn find_symbols_until(
+    data: &IndexData,
+    recents: &Recents,
+    query: &str,
+    filter: SymbolFilter,
+    limit: usize,
+    include: &(impl Fn(&Path) -> bool + Sync),
+    stopped: &(impl Fn() -> bool + Sync),
+) -> Option<Vec<SymbolMatch>> {
     let q: String = query.trim().chars().filter(|c| !c.is_whitespace()).collect();
     if q.is_empty() || limit == 0 {
-        return Vec::new();
+        return Some(Vec::new());
     }
     let (container_q, name_q) = split_symbol_query(&q);
     let name = Needle::new(name_q);
@@ -436,13 +461,16 @@ pub(crate) fn find_symbols(
         sa.name.len().cmp(&sb.name.len()).then_with(|| file(data, a.slot).rel.cmp(&file(data, b.slot).rel))
     };
     let pool = limit * 4 + 64;
-    let cands = scan(data, pool, &tiebreak, |slot, e, acc| {
-        if e.symbols.is_empty() {
+    let cands = scan_until(data, pool, &tiebreak, stopped, |slot, e, acc| {
+        if e.symbols.is_empty() || !include(&e.path) {
             return;
         }
         with_matcher(|m| {
             let mut buf = Vec::new();
             for (i, s) in e.symbols.iter().enumerate() {
+                if stopped() {
+                    break;
+                }
                 if filter == SymbolFilter::Types && !s.kind.is_type_like() {
                     continue;
                 }
@@ -451,11 +479,15 @@ pub(crate) fn find_symbols(
                 }
             }
         });
-    });
+    })?;
+    if stopped() {
+        return None;
+    }
     let mut out: Vec<(u32, Cand, Vec<u32>)> = with_matcher(|m| {
         let mut buf = Vec::new();
         cands
             .into_iter()
+            .take_while(|_| !stopped())
             .filter_map(|c| {
                 let s = sym(&c);
                 let e = file(data, c.slot);
@@ -472,7 +504,8 @@ pub(crate) fn find_symbols(
         b.0.cmp(&a.0).then_with(|| tiebreak(&a.1, &b.1)).then_with(|| sym(&a.1).range.cmp(&sym(&b.1).range))
     });
     out.truncate(limit);
-    out.into_iter()
+    let results = out
+        .into_iter()
         .map(|(score, c, indices)| {
             let e = file(data, c.slot);
             let s = &e.symbols[c.sym as usize];
@@ -487,7 +520,8 @@ pub(crate) fn find_symbols(
                 indices,
             }
         })
-        .collect()
+        .collect();
+    (!stopped()).then_some(results)
 }
 
 /// Symbols named exactly `name` (and of `kind`, when given), by path then position.

crates/ide-index/src/tests.rs

@@ -652,3 +652,80 @@ fn plugin_inventory_respects_excludes_and_symbols_require_matching_text() {
     assert!(symbols.iter().any(|s| s.name == "find"));
     assert!(index.symbols_for_text(&path, &java.replace("find", "renamed")).is_none());
 }
+
+#[test]
+fn symbol_search_can_stop_during_scanning_and_lock_waits() {
+    use std::sync::atomic::AtomicUsize;
+    let fx = sample();
+    let idx = fx.open();
+    let calls = AtomicUsize::new(0);
+    let stopped = || calls.fetch_add(1, Ordering::Relaxed) >= 5;
+    assert!(idx.find_symbols_until("a", SymbolFilter::All, 20, &|_| true, &stopped).is_none());
+    assert!(calls.load(Ordering::Relaxed) > 5);
+    for recent in [false, true] {
+        let _data = (!recent).then(|| idx.shared.data.write());
+        let _recent = recent.then(|| idx.shared.recent.lock());
+        let deadline = std::time::Instant::now() + Duration::from_millis(10);
+        assert!(
+            idx.find_symbols_until("a", SymbolFilter::All, 20, &|_| true, &|| std::time::Instant::now() >= deadline)
+                .is_none()
+        );
+    }
+}
+
+#[test]
+fn scoped_symbol_search_preserves_fuzzy_ranking_within_allowed_paths() {
+    let fx = sample();
+    let idx = fx.open();
+    let allowed = fx.root.join("src/order");
+    let symbols =
+        idx.find_symbols_until("OCo", SymbolFilter::All, 1, &|path| path.starts_with(&allowed), &|| false).unwrap();
+    assert_eq!(symbols.len(), 1);
+    assert_eq!(symbols[0].name, "OrderController");
+    assert!(
+        idx.find_symbols_until("OtherCollection", SymbolFilter::All, 1, &|path| path.starts_with(&allowed), &|| false)
+            .unwrap()
+            .is_empty()
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn incremental_symbols_resolve_symlink_ancestors_before_scope_checks() {
+    let fx = Fixture::new(&[("src/inside.rs", "fn inside_symbol() {}\n")]);
+    let outside = fx._dir.path().join("outside");
+    std::fs::create_dir(&outside).unwrap();
+    std::fs::write(outside.join("secret.rs"), "fn secret_symbol() {}\n").unwrap();
+    std::os::unix::fs::symlink(&outside, fx.root.join("escape")).unwrap();
+    std::os::unix::fs::symlink(fx.root.join("src"), fx.root.join("alias")).unwrap();
+    let idx = fx.open();
+    idx.update(&[fx.root.join("escape/secret.rs"), fx.root.join("alias/inside.rs")], &[]);
+    assert!(idx.wait_idle(WAIT));
+    assert!(symbols(&idx, "secret_symbol", SymbolFilter::All).is_empty());
+    let inside = idx.find_symbols("inside_symbol", SymbolFilter::All, 10);
+    assert_eq!(inside.len(), 1);
+    assert_eq!(inside[0].path.0, fx.root.join("src/inside.rs"));
+}
+
+#[cfg(unix)]
+#[test]
+fn persisted_symbols_do_not_load_through_escaping_symlink_ancestors() {
+    let fx = Fixture::new(&[("src/old.rs", "fn old_symbol() {}\n")]);
+    drop(fx.open());
+    let outside = fx._dir.path().join("outside");
+    std::fs::rename(fx.root.join("src"), &outside).unwrap();
+    std::os::unix::fs::symlink(outside, fx.root.join("src")).unwrap();
+    let initial = Arc::new(Mutex::new(Vec::new()));
+    let events = initial.clone();
+    let sink: SharedSink = Arc::new(move |event: IdeEvent| {
+        if let IdeEvent::IndexState { symbols, .. } = event {
+            events.lock().push(symbols);
+        }
+    });
+    let languages = Arc::new(LanguageRegistry::load(None).unwrap());
+    let idx = ProjectIndex::open(&fx.root, &fx.cache, Vec::new(), Vec::new(), languages, Arc::new(Syntax::new()), sink)
+        .unwrap();
+    assert!(idx.wait_idle(WAIT));
+    assert!(symbols(&idx, "old_symbol", SymbolFilter::All).is_empty());
+    assert_eq!(initial.lock()[0], 0, "unsafe cached symbols must never be published");
+}

crates/ide-index/src/worker.rs

@@ -174,7 +174,10 @@ impl Shared {
             Ok(records) => {
                 let entries: Vec<FileEntry> = records
                     .into_par_iter()
-                    .filter(|(rel, _)| !filter.is_excluded(&root.join(rel), false))
+                    .filter(|(rel, _)| {
+                        let path = root.join(rel);
+                        !filter.is_excluded(&path, false) && dunce::canonicalize(&path).is_ok_and(|real| real == path)
+                    })
                     .map(|(rel, rec)| FileEntry::new(root.join(&rel), rel, rec))
                     .collect();
                 let mut d = self.data.write();
@@ -420,7 +423,10 @@ impl Shared {
         let mut seen = HashSet::new();
         let mut by_dir: HashMap<PathBuf, HashSet<PathBuf>> = HashMap::new();
         for path in changed {
-            if !seen.insert(path.clone()) {
+            // A watcher path may have a symlink ancestor even when its spelling
+            // is inside the root. Resolve it on the worker before reading it.
+            let Ok(path) = dunce::canonicalize(&path) else { continue };
+            if !filter.contains(&path) || !seen.insert(path.clone()) {
                 continue;
             }
             let Ok(meta) = std::fs::symlink_metadata(&path) else { continue };

crates/ide-jsonrpc/src/lib.rs

@@ -346,7 +346,7 @@ impl Drop for KillOnDrop {
 /// child's `PATH` (a caller's `env` PATH, else the login shell's, else ours), so
 /// that on Windows `PATHEXT` names (`codex` → `codex.cmd`) start; anything else
 /// is kept as given.
-fn resolve_spawn_program(command: &str, env: &[(String, String)]) -> std::path::PathBuf {
+pub fn resolve_spawn_program(command: &str, env: &[(String, String)]) -> std::path::PathBuf {
     let path = std::path::Path::new(command);
     if path.components().count() > 1 || path.is_absolute() {
         return path.to_path_buf();

crates/ide-language/src/registry.rs

@@ -9,6 +9,7 @@ use std::sync::{Arc, OnceLock};
 
 /// Built-in definitions, embedded at compile time. Add new languages here.
 const BUILTIN: &[(&str, &str)] = &[
+    ("arduino", include_str!("../../../languages/arduino.toml")),
     ("asciidoc", include_str!("../../../languages/asciidoc.toml")),
     ("astro", include_str!("../../../languages/astro.toml")),
     ("bat", include_str!("../../../languages/bat.toml")),
@@ -601,9 +602,11 @@ mod tests {
         "MsGenny",
         "Vue",
         "Angular Template",
+        "Angular TypeScript",
         "ERB",
         "JSP",
         "Astro",
+        "GoMod",
     ];
 
     fn reg() -> LanguageRegistry {
@@ -716,7 +719,7 @@ mod tests {
     }
 
     #[test]
-    fn html_of_angular_projects_is_an_angular_template() {
+    fn angular_projects_use_framework_modes() {
         let reg = reg();
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
@@ -727,7 +730,12 @@ mod tests {
         assert_eq!(mode("html", "apps/web/src/app/app.html").as_deref(), Some("Angular Template"));
         assert_eq!(mode("html", "apps/admin/src/index.html").as_deref(), Some("Angular Template"));
         assert_eq!(mode("html", "docs/index.html"), None);
-        assert_eq!(mode("typescript", "apps/web/src/app/app.ts"), None);
+        for file in ["apps/web/src/app/app.ts", "apps/admin/src/app.mts", "apps/admin/src/app.cts"] {
+            assert_eq!(mode("typescript", file).as_deref(), Some("Angular TypeScript"), "{file}");
+        }
+        assert_eq!(mode("typescript", "docs/example.ts"), None);
+        assert_eq!(mode("javascript", "apps/web/src/app/app.js"), None);
+        assert_eq!(mode("typescriptreact", "apps/web/src/app/app.tsx"), None);
         assert!(reg.is_framework_marker(&root.join("apps/admin/angular.json")));
         assert!(!reg.is_framework_marker(&root.join("apps/admin/package.json")));
     }
@@ -860,6 +868,7 @@ mod tests {
             ("x.h", "c"),
             ("x.hpp", "cpp"),
             ("x.cc", "cpp"),
+            ("blink.ino", "arduino"),
             ("P.cs", "csharp"),
             ("V.swift", "swift"),
             ("AppDelegate.m", "objective-c"),

crates/ide-language/src/syntax/configuration.rs

@@ -22,8 +22,49 @@ impl Syntax {
         if language.as_str() == "properties" {
             return Ok(properties(text));
         }
+        if language.as_str() == "xml" {
+            // Only Spring wiring that mentions property placeholders can declare
+            // a configuration key; skip parsing unrelated XML (POMs, mappers,
+            // manifests) during project scans.
+            if !text.contains("<prop") && !text.contains("placeholder") && !text.contains("Placeholder") {
+                return Ok(Vec::new());
+            }
+            return self.with_parsed(language, text, cancelled, |tree| tree.spring_xml_keys(cancelled));
+        }
         self.with_parsed(language, text, cancelled, |tree| tree.configuration_keys(cancelled))
     }
+
+    /// Name of the Spring `${name[:default]}` placeholder covering `pos` in
+    /// `text`, if the position lies anywhere inside its braces. The name stops
+    /// at the first `:` or `}`; inside a nested default (`${a:${b}}`) the inner
+    /// braces name `b`. Empty names (`${}`) name nothing.
+    pub fn configuration_placeholder(&self, text: &str, pos: Pos) -> Option<String> {
+        let at = byte_at(text, pos)?;
+        let mut braces = Vec::new();
+        let mut best: Option<(usize, usize)> = None;
+        for (i, byte) in text.bytes().enumerate() {
+            match byte {
+                b'{' => braces.push((i, None, i > 0 && text.as_bytes()[i - 1] == b'$')),
+                b':' => {
+                    if let Some((_, end, true)) = braces.last_mut() {
+                        end.get_or_insert(i);
+                    }
+                }
+                b'}' => {
+                    if let Some((open, end, true)) = braces.pop() {
+                        let open = open - 1;
+                        if open <= at && at <= i && best.is_none_or(|(previous, _)| open > previous) {
+                            best = Some((open, end.unwrap_or(i)));
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+        let (open, end) = best?;
+        let name = text[open + 2..end].trim();
+        (!name.is_empty()).then(|| name.to_owned())
+    }
 }
 
 /// Spring's property lookups whose first argument names a configuration key.
@@ -68,6 +109,134 @@ impl ParsedTree<'_> {
         }
         out
     }
+
+    /// Spring property declarations in XML wiring: `<prop key="name">` values
+    /// (util:properties, configurer `<props>`) and `<property name="name"
+    /// value="...">` entries under a placeholder configurer bean. Elements that
+    /// only reference a property file (`<context:property-placeholder>`,
+    /// `<util:properties location="...">`) declare no key of their own; the
+    /// configuration scan finds the keys inside the referenced files.
+    pub fn spring_xml_keys(&self, cancelled: &dyn Fn() -> bool) -> Vec<ConfigurationKey> {
+        let mut out = Vec::new();
+        spring_xml(self.tree.root_node(), self.text, &LineIndex::new(self.text), &mut out, cancelled, 0, false);
+        out
+    }
+}
+
+/// Bean classes whose `<property name="key" value="...">` entries feed
+/// placeholder resolution (the placeholder configurers).
+fn placeholder_bean(class: &str) -> bool {
+    class.to_ascii_lowercase().contains("placeholder")
+}
+
+fn local_name(tag: &str) -> &str {
+    tag.rsplit(':').next().unwrap_or(tag)
+}
+
+fn spring_xml(
+    node: Node<'_>,
+    text: &str,
+    lines: &LineIndex<'_>,
+    out: &mut Vec<ConfigurationKey>,
+    cancelled: &dyn Fn() -> bool,
+    depth: usize,
+    configurer: bool,
+) {
+    if depth > 64 || cancelled() || out.len() >= 20_000 {
+        return;
+    }
+    if node.kind() != "element" {
+        let mut cursor = node.walk();
+        for child in node.named_children(&mut cursor) {
+            spring_xml(child, text, lines, out, cancelled, depth + 1, configurer);
+        }
+        return;
+    }
+    let mut cursor = node.walk();
+    let children: Vec<_> = node.named_children(&mut cursor).collect();
+    let mut tag = "";
+    let mut inside = configurer;
+    let mut content: Vec<Node<'_>> = Vec::new();
+    for child in children {
+        match child.kind() {
+            "STag" | "EmptyElemTag" => {
+                let mut attrs_cursor = child.walk();
+                let attrs: Vec<_> = child.named_children(&mut attrs_cursor).collect();
+                let mut attributes: Vec<(&str, String, Range)> = Vec::new();
+                for (i, attr) in attrs.iter().enumerate() {
+                    if i == 0 && attr.kind() == "Name" {
+                        tag = local_name(&text[attr.byte_range()]);
+                        continue;
+                    }
+                    if attr.kind() != "Attribute" {
+                        continue;
+                    }
+                    let mut parts_cursor = attr.walk();
+                    let mut name = "";
+                    let mut value = None;
+                    for part in attr.named_children(&mut parts_cursor) {
+                        match part.kind() {
+                            "Name" => name = &text[part.byte_range()],
+                            "AttValue" => value = Some(quoted_value(part, text, lines)),
+                            _ => {}
+                        }
+                    }
+                    if let Some((value, range)) = value {
+                        attributes.push((name, value, range));
+                    }
+                }
+                let attribute = |wanted: &str| attributes.iter().find(|(name, _, _)| *name == wanted);
+                if tag == "prop"
+                    && let Some((_, key, range)) = attribute("key")
+                    && !key.is_empty()
+                    && key.len() <= 1024
+                {
+                    out.push(ConfigurationKey { name: key.clone(), range: *range });
+                }
+                if tag == "property"
+                    && configurer
+                    && let (Some((_, name, range)), Some(_)) = (attribute("name"), attribute("value"))
+                    && !name.is_empty()
+                    && name.len() <= 1024
+                {
+                    out.push(ConfigurationKey { name: name.clone(), range: *range });
+                }
+                if tag == "bean"
+                    && let Some((_, class, _)) = attribute("class")
+                {
+                    inside = placeholder_bean(class);
+                }
+            }
+            "content" => content.extend(child.named_children(&mut cursor).filter(|n| n.kind() == "element")),
+            // Error recovery can nest elements without a `content` node.
+            "element" => content.push(child),
+            _ => {}
+        }
+    }
+    for element in content {
+        spring_xml(element, text, lines, out, cancelled, depth + 1, inside);
+    }
+}
+
+/// The decoded text of an `AttValue` and the range of its quoted contents.
+fn quoted_value(node: Node<'_>, text: &str, lines: &LineIndex<'_>) -> (String, Range) {
+    let raw = &text[node.byte_range()];
+    let quoted = raw.len() >= 2
+        && ((raw.starts_with('"') && raw.ends_with('"')) || (raw.starts_with('\'') && raw.ends_with('\'')));
+    let (value, range) = if quoted {
+        (&raw[1..raw.len() - 1], lines.range(node.start_byte() + 1, node.end_byte() - 1))
+    } else {
+        (raw, lines.range(node.start_byte(), node.end_byte()))
+    };
+    (unescape_xml(value), range)
+}
+
+/// XML's five predefined entities; unknown references keep their text.
+fn unescape_xml(value: &str) -> String {
+    if !value.contains('&') {
+        return value.to_owned();
+    }
+    value.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&apos;", "'").replace("&amp;", "&")
 }
 
 fn yaml(
@@ -317,4 +486,107 @@ class A {
         );
         assert_eq!(keys[0].range.end.line, 2);
     }
+    #[test]
+    fn placeholder_names_cover_the_whole_reference() {
+        let text = "name: ${db.url:8080}\nplain: value\nempty: ${}\nnested: ${a:${b.c}}\nspaced: ${ db.h }\n";
+        let syntax = Syntax::new();
+        let at = |needle: &str, offset: u32| {
+            let line = text.lines().position(|l| l.contains(needle)).unwrap();
+            let line_text = text.lines().nth(line).unwrap();
+            let byte = line_text.find(needle).unwrap();
+            let col = line_text[..byte].encode_utf16().count() as u32 + offset;
+            syntax.configuration_placeholder(text, Pos::new(line as u32, col))
+        };
+        // On the `$`, inside the name and on the default all name `db.url`.
+        assert_eq!(at("${db.url", 0), Some("db.url".into()));
+        assert_eq!(at("db.url", 1), Some("db.url".into()));
+        assert_eq!(at("8080", 1), Some("db.url".into()));
+        assert_eq!(at("plain", 1), None);
+        assert_eq!(at("empty", 3), None);
+        // A nested default names its own property; the outer braces name `a`.
+        assert_eq!(at("${b.c", 2), Some("b.c".into()));
+        assert_eq!(at("${a:", 2), Some("a".into()));
+        assert_eq!(at("db.h", 1), Some("db.h".into()));
+        assert_eq!(syntax.configuration_placeholder("no placeholder", Pos::new(0, 3)), None);
+        assert_eq!(syntax.configuration_placeholder("trailing ${open", Pos::new(0, 12)), None);
+    }
+    #[test]
+    fn nested_placeholder_defaults_are_brace_balanced() {
+        let syntax = Syntax::new();
+        let text = "${outer:${inner}suffix}";
+        for col in 0..text.len() {
+            let expected = if (8..=15).contains(&col) { "inner" } else { "outer" };
+            assert_eq!(
+                syntax.configuration_placeholder(text, Pos::new(0, col as u32)).as_deref(),
+                Some(expected),
+                "column {col}"
+            );
+        }
+        let text = "${outer:${middle:${inner}}suffix}";
+        for (needle, expected) in [("outer", "outer"), ("middle", "middle"), ("inner", "inner"), ("suffix", "outer")] {
+            assert_eq!(
+                syntax.configuration_placeholder(text, Pos::new(0, text.find(needle).unwrap() as u32)).as_deref(),
+                Some(expected)
+            );
+        }
+        assert_eq!(
+            syntax.configuration_placeholder("${outer:{default}suffix}", Pos::new(0, 19)).as_deref(),
+            Some("outer")
+        );
+        assert_eq!(syntax.configuration_placeholder("${outer:${inner}suffix", Pos::new(0, 18)), None);
+    }
+
+    #[test]
+    fn configuration_placeholders_use_utf16_columns() {
+        let syntax = Syntax::new();
+        for text in ["message=你好😀 ${db.user}", "message: 你好😀 ${db.user}", "<bean value=\"你好😀 ${db.user}\"/>"]
+        {
+            let col = text[..text.find("db.user").unwrap()].encode_utf16().count() as u32;
+            assert_eq!(syntax.configuration_placeholder(text, Pos::new(0, col + 2)).as_deref(), Some("db.user"));
+        }
+    }
+
+    #[test]
+    fn spring_xml_declares_prop_and_configurer_property_keys() {
+        let text = r#"<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans">
+  <context:property-placeholder location="classpath:db.properties"/>
+  <util:properties id="db">
+    <prop key="db.url">jdbc:h2:mem:test</prop>
+  </util:properties>
+  <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
+    <property name="properties">
+      <props>
+        <prop key="db.user">sa</prop>
+      </props>
+    </property>
+  </bean>
+  <bean class="org.springframework.jdbc.datasource.DriverManagerDataSource">
+    <property name="url" value="jdbc:h2:mem"/>
+  </bean>
+  <bean class="org.springframework.beans.factory.config.PropertySourcesPlaceholderConfigurer">
+    <property name="system.mode" value="test"/>
+  </bean>
+</beans>
+"#;
+        let keys = Syntax::new().configuration_keys(&LanguageId::new("xml"), text, &|| false).unwrap();
+        let names: Vec<_> = keys.iter().map(|k| k.name.as_str()).collect();
+        // The configurer's own `properties` injection names no property, and a
+        // plain bean's `<property name="url">` is not an environment property.
+        assert_eq!(names, ["db.url", "db.user", "system.mode"]);
+        // The range covers the quoted key attribute's value.
+        let line = text.lines().position(|l| l.contains("db.url")).unwrap() as u32;
+        let start = keys[0].range.start;
+        assert_eq!((start.line, keys[0].range.end.line), (line, line));
+        assert_eq!(
+            &text.lines().nth(line as usize).unwrap()[start.col as usize..keys[0].range.end.col as usize],
+            "db.url"
+        );
+    }
+    #[test]
+    fn xml_without_property_markers_is_not_parsed() {
+        let text = "<mappers><mapper resource='a.xml'/><select id='x'>select 1</select></mappers>";
+        let keys = Syntax::new().configuration_keys(&LanguageId::new("xml"), text, &|| false).unwrap();
+        assert!(keys.is_empty());
+    }
 }

crates/ide-lsp/src/go_scope.rs

@@ -0,0 +1,354 @@
+//! Go files a gopls search does not reach.
+//!
+//! gopls answers a search from the view of the file it is asked about: the
+//! modules of a `go.work`, or that file's own module, built for the host's
+//! GOOS/GOARCH without extra tags. Opening more files does not widen it (each
+//! gets a view of its own), so the generic scope widening is skipped for Go.
+//! Usages it leaves out are found as GoLand finds them, by resolving each
+//! mention of the name in its own file's view: files of other modules that use
+//! the declaration's module through a local `replace` (a multi-module
+//! repository without `go.work`), and files whose build constraints exclude
+//! them from the default build (`_windows.go`, `//go:build`).
+
+use ide_core::{Pos, Range};
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+
+/// The files of `candidates` the search at `origin` does not cover and that can refer to
+/// `declaration`: those of the covered modules excluded from their default build, and those
+/// of the declaration's own module or one replacing it with its directory when not covered.
+pub(crate) fn files_beyond_search(origin: &Path, declaration: &Path, candidates: Vec<PathBuf>) -> Vec<PathBuf> {
+    let mut modules = ModuleRoots::default();
+    let (Some(origin_module), Some(declaring)) = (modules.of(origin), modules.of(declaration)) else {
+        return Vec::new();
+    };
+    let Some(declaring_path) = read_module_path(&declaring) else { return Vec::new() };
+    let mut covered: HashSet<PathBuf> = workspace_modules(&origin_module).into_iter().collect();
+    covered.insert(origin_module);
+    let mut uses: HashMap<PathBuf, bool> = HashMap::new();
+    candidates
+        .into_iter()
+        .filter(|file| {
+            let Some(module) = modules.of(file) else { return false };
+            // The covered modules share the search's view: only their excluded files are missed.
+            if covered.contains(&module) {
+                return !in_default_build(file);
+            }
+            *uses.entry(module.clone()).or_insert_with(|| {
+                module == declaring
+                    || std::fs::read_to_string(module.join("go.mod")).is_ok_and(|text| {
+                        local_replacements(&text, &module)
+                            .iter()
+                            .any(|(path, dir)| *path == declaring_path && *dir == declaring)
+                    })
+            })
+        })
+        .collect()
+}
+
+/// Whether gopls' default view builds `file`: no build constraint other than the host's
+/// own GOOS/GOARCH file name suffix.
+fn in_default_build(file: &Path) -> bool {
+    let name = file.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+    let stem = name.strip_suffix(".go").unwrap_or(&name);
+    let stem = stem.strip_suffix("_test").unwrap_or(stem);
+    let parts: Vec<&str> = stem.split('_').collect();
+    // `name_GOOS`, `name_GOARCH`, `name_GOOS_GOARCH`; a file named just `linux.go` has no constraint.
+    let host = |part: &&str| *part == host_goos() || *part == host_goarch();
+    if parts.len() > 1 {
+        let last = parts[parts.len() - 1];
+        if (GOOS.contains(&last) || GOARCH.contains(&last)) && !host(&last) {
+            return false;
+        }
+        if parts.len() > 2 && GOARCH.contains(&last) {
+            let os = parts[parts.len() - 2];
+            if GOOS.contains(&os) && !host(&os) {
+                return false;
+            }
+        }
+    }
+    std::fs::read_to_string(file).is_ok_and(|text| !constrained_header(&text))
+}
+
+/// A `//go:build` or `// +build` line before the package clause.
+fn constrained_header(text: &str) -> bool {
+    for line in text.lines() {
+        let line = line.trim();
+        if line.starts_with("package ") {
+            return false;
+        }
+        if line.starts_with("//go:build") || line.starts_with("// +build") {
+            return true;
+        }
+    }
+    false
+}
+
+fn host_goos() -> &'static str {
+    match std::env::consts::OS {
+        "macos" => "darwin",
+        os => os,
+    }
+}
+
+fn host_goarch() -> &'static str {
+    match std::env::consts::ARCH {
+        "x86_64" => "amd64",
+        "aarch64" => "arm64",
+        "x86" => "386",
+        "powerpc64" => "ppc64",
+        arch => arch,
+    }
+}
+
+const GOOS: &[&str] = &[
+    "aix",
+    "android",
+    "darwin",
+    "dragonfly",
+    "freebsd",
+    "hurd",
+    "illumos",
+    "ios",
+    "js",
+    "linux",
+    "nacl",
+    "netbsd",
+    "openbsd",
+    "plan9",
+    "solaris",
+    "wasip1",
+    "windows",
+    "zos",
+];
+const GOARCH: &[&str] = &[
+    "386",
+    "amd64",
+    "amd64p32",
+    "arm",
+    "armbe",
+    "arm64",
+    "arm64be",
+    "loong64",
+    "mips",
+    "mipsle",
+    "mips64",
+    "mips64le",
+    "mips64p32",
+    "mips64p32le",
+    "ppc",
+    "ppc64",
+    "ppc64le",
+    "riscv",
+    "riscv64",
+    "s390",
+    "s390x",
+    "sparc",
+    "sparc64",
+    "wasm",
+];
+
+/// Whole-word occurrences of `word` in `text`, as ranges in UTF-16 columns.
+pub(crate) fn word_ranges(text: &str, word: &str) -> Vec<Range> {
+    let ident = |c: char| c.is_alphanumeric() || c == '_';
+    let mut out = Vec::new();
+    for (line_no, line) in text.lines().enumerate() {
+        let code = line.split("//").next().unwrap_or(line);
+        for (at, _) in code.match_indices(word) {
+            let before = code[..at].chars().next_back();
+            let after = code[at + word.len()..].chars().next();
+            if before.is_some_and(ident) || after.is_some_and(ident) {
+                continue;
+            }
+            let col = code[..at].encode_utf16().count() as u32;
+            let len = word.encode_utf16().count() as u32;
+            out.push(Range::new(Pos::new(line_no as u32, col), Pos::new(line_no as u32, col + len)));
+        }
+    }
+    out
+}
+
+/// Nearest enclosing `go.mod` directory, cached per directory.
+#[derive(Default)]
+struct ModuleRoots(HashMap<PathBuf, Option<PathBuf>>);
+
+impl ModuleRoots {
+    fn of(&mut self, file: &Path) -> Option<PathBuf> {
+        let dir = file.parent()?.to_path_buf();
+        self.dir(&dir)
+    }
+
+    fn dir(&mut self, dir: &Path) -> Option<PathBuf> {
+        if let Some(found) = self.0.get(dir) {
+            return found.clone();
+        }
+        let found =
+            if dir.join("go.mod").is_file() { Some(dir.to_path_buf()) } else { dir.parent().and_then(|p| self.dir(p)) };
+        self.0.insert(dir.to_path_buf(), found.clone());
+        found
+    }
+}
+
+fn read_module_path(module: &Path) -> Option<String> {
+    let text = std::fs::read_to_string(module.join("go.mod")).ok()?;
+    text.lines().find_map(|line| Some(unquote(line.trim().strip_prefix("module ")?.trim())))
+}
+
+/// The modules a `go.work` above `module` uses, as gopls loads them together.
+fn workspace_modules(module: &Path) -> Vec<PathBuf> {
+    let Some(work) = module.ancestors().map(|d| d.join("go.work")).find(|p| p.is_file()) else { return Vec::new() };
+    let Ok(text) = std::fs::read_to_string(&work) else { return Vec::new() };
+    let base = work.parent().unwrap_or(Path::new(""));
+    directives(&text, "use").into_iter().map(|dir| normalize(&base.join(dir))).collect()
+}
+
+/// `replace <module> [version] => <local directory>` entries, directories resolved against `base`.
+fn local_replacements(go_mod: &str, base: &Path) -> Vec<(String, PathBuf)> {
+    directives(go_mod, "replace")
+        .into_iter()
+        .filter_map(|entry| {
+            let (from, to) = entry.split_once("=>")?;
+            let from = unquote(from.split_whitespace().next()?);
+            let to = unquote(to.split_whitespace().next()?);
+            let local = to.starts_with("./")
+                || to.starts_with("../")
+                || Path::new(&to).is_absolute()
+                || to == "."
+                || to == "..";
+            local.then(|| (from, normalize(&base.join(to))))
+        })
+        .collect()
+}
+
+/// The arguments of `keyword` directives, single-line and block form.
+fn directives(text: &str, keyword: &str) -> Vec<String> {
+    let mut out = Vec::new();
+    let mut in_block = false;
+    for line in text.lines() {
+        let line = line.split("//").next().unwrap_or("").trim();
+        if in_block {
+            if line == ")" {
+                in_block = false;
+            } else if !line.is_empty() {
+                out.push(line.to_owned());
+            }
+        } else if let Some(rest) = line.strip_prefix(keyword)
+            && rest.starts_with([' ', '\t', '('])
+        {
+            let rest = rest.trim();
+            if rest == "(" {
+                in_block = true;
+            } else if !rest.is_empty() {
+                out.push(rest.to_owned());
+            }
+        }
+    }
+    out
+}
+
+fn unquote(s: &str) -> String {
+    s.trim_matches(|c| c == '"' || c == '`').to_owned()
+}
+
+fn normalize(path: &Path) -> PathBuf {
+    let mut out = PathBuf::new();
+    for c in path.components() {
+        match c {
+            std::path::Component::CurDir => {}
+            std::path::Component::ParentDir => {
+                out.pop();
+            }
+            c => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn write(root: &Path, rel: &str, text: &str) -> PathBuf {
+        let path = root.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(&path, text).unwrap();
+        path
+    }
+
+    fn names(root: &Path, files: Vec<PathBuf>) -> Vec<String> {
+        files.iter().map(|f| f.strip_prefix(root).unwrap().to_string_lossy().replace('\\', "/")).collect()
+    }
+
+    #[test]
+    fn modules_replacing_the_declarations_module_are_searched() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(root, "go.mod", "module example.com/app\n");
+        let origin = write(root, "app.go", "package app\nfunc New() {}\n");
+        write(root, "example/a/go.mod", "module a\n\nreplace example.com/app => ../..\n");
+        write(root, "example/b/go.mod", "module b\n\nreplace (\n\texample.com/app v1.0.0 => \"../../\"\n)\n");
+        write(root, "example/c/go.mod", "module c\n\nrequire example.com/app v1.0.0\n");
+        write(root, "example/d/go.mod", "module d\n\nreplace example.com/app => github.com/fork/app v1.0.0\n");
+        let candidates = vec![
+            write(root, "same.go", "package app\n"),
+            write(root, "same_plan9.go", "package app\n"),
+            write(root, &format!("same_{}.go", host_goos()), "package app\n"),
+            write(root, "same_plan9_test.go", "package app\n"),
+            write(root, "tagged.go", "// Copyright\n\n//go:build integration\n\npackage app\n"),
+            write(root, "plan9.go", "package app\n"),
+            write(root, "example/a/main.go", "package main\n"),
+            write(root, "example/b/main.go", "package main\n"),
+            write(root, "example/c/main.go", "package main\n"),
+            write(root, "example/d/main.go", "package main\n"),
+        ];
+        assert_eq!(
+            names(root, files_beyond_search(&origin, &origin, candidates)),
+            ["same_plan9.go", "same_plan9_test.go", "tagged.go", "example/a/main.go", "example/b/main.go"]
+        );
+    }
+
+    #[test]
+    fn go_work_modules_are_covered_by_the_first_search() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(root, "go.work", "go 1.22\n\nuse (\n\t./lib // shared\n\t./app\n)\n");
+        write(root, "lib/go.mod", "module example.com/lib\n");
+        write(root, "app/go.mod", "module example.com/app\n\nreplace example.com/lib => ../lib\n");
+        write(root, "tool/go.mod", "module example.com/tool\n\nreplace example.com/lib => ../lib\n");
+        let declaration = write(root, "lib/lib.go", "package lib\n");
+        let candidates = vec![
+            write(root, "app/main.go", "package main\n"),
+            write(root, "app/main_plan9.go", "package main\n"),
+            write(root, "tool/main.go", "package main\n"),
+        ];
+        assert_eq!(
+            names(root, files_beyond_search(&declaration, &declaration, candidates)),
+            ["app/main_plan9.go", "tool/main.go"]
+        );
+    }
+
+    #[test]
+    fn a_usage_site_in_another_module_searches_the_declaring_module() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write(root, "go.mod", "module example.com/app\n");
+        let declaration = write(root, "app.go", "package app\n");
+        write(root, "cmd/go.mod", "module cmd\n\nreplace example.com/app => ../\n");
+        let origin = write(root, "cmd/main.go", "package main\n");
+        let candidates = vec![write(root, "other.go", "package app\n"), write(root, "cmd/util.go", "package main\n")];
+        assert_eq!(names(root, files_beyond_search(&origin, &declaration, candidates)), ["other.go"]);
+    }
+
+    #[test]
+    fn word_ranges_are_whole_words_outside_line_comments() {
+        let text = "x := app.New() // New here\nNewer := New\n\tvar é = New()\n";
+        assert_eq!(
+            word_ranges(text, "New"),
+            [
+                Range::new(Pos::new(0, 9), Pos::new(0, 12)),
+                Range::new(Pos::new(1, 9), Pos::new(1, 12)),
+                Range::new(Pos::new(2, 9), Pos::new(2, 12)),
+            ]
+        );
+    }
+}

crates/ide-lsp/src/jdtls.rs

@@ -41,6 +41,12 @@ const ACCESS_OPTIONS: [&str; 2] = [
     "org.eclipse.jdt.core.compiler.problem.discouragedReference",
 ];
 
+const LEVEL_OPTIONS: [&str; 3] = [
+    "org.eclipse.jdt.core.compiler.source",
+    "org.eclipse.jdt.core.compiler.compliance",
+    "org.eclipse.jdt.core.compiler.codegen.targetPlatform",
+];
+
 /// Keep the source model in protocol settings so jdtls's invisible-project
 /// initialization and configuration use the same roots as workspace builds.
 pub fn configure_source_paths(cfg: &mut ide_language::LanguageServerConfig, paths: Option<Vec<String>>) {
@@ -54,6 +60,115 @@ pub fn configure_source_paths(cfg: &mut ide_language::LanguageServerConfig, path
     }
 }
 
+/// Applies Project Structure compiler output path, project libraries (and source attachments),
+/// and Web facet `WEB-INF/lib` directories to jdtls `java.project.*` settings.
+pub fn configure_project_structure(
+    cfg: &mut ide_language::LanguageServerConfig,
+    root: &Path,
+    server_root: &Path,
+    structure: &ide_core::settings::ProjectStructureSettings,
+) {
+    if cfg.name != SERVER {
+        return;
+    }
+    let module_cfg = structure.module_settings(root, server_root);
+    let module_output = module_cfg.map(|m| m.compiler_output.trim()).filter(|s| !s.is_empty());
+    let output_path = if let Some(output) = module_output {
+        // The dialog stores paths relative to the project, JDT expects the server root.
+        let path = root.join(output);
+        match path.strip_prefix(server_root) {
+            Ok(relative) => Some(relative.to_string_lossy().replace('\\', "/")),
+            Err(_) => {
+                cfg.launch_error = Some(format!("Java compiler output must be inside its module: {}", path.display()));
+                None
+            }
+        }
+    } else {
+        let output = structure.compiler_output.trim();
+        if output.is_empty() {
+            None
+        } else if Path::new(output).is_absolute() {
+            match Path::new(output).strip_prefix(server_root) {
+                Ok(relative) => Some(relative.to_string_lossy().replace('\\', "/")),
+                Err(_) => {
+                    cfg.launch_error = Some(format!("Java compiler output must be inside its module: {output}"));
+                    None
+                }
+            }
+        } else {
+            Some(output.replace('\\', "/"))
+        }
+    };
+
+    let normalize = |entry: &str| -> Option<String> {
+        let trimmed = entry.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+        // JDT resolves relative library globs against its own root, which may be a submodule.
+        Some(root.join(trimmed).to_string_lossy().replace('\\', "/"))
+    };
+    let mut include: Vec<String> = Vec::new();
+    let mut sources = serde_json::Map::new();
+    for lib in &structure.libraries {
+        let class_entries: Vec<String> = lib.classes.iter().filter_map(|c| normalize(c)).collect();
+        let source_entries: Vec<String> = lib.sources.iter().filter_map(|s| normalize(s)).collect();
+        for c in &class_entries {
+            if !include.contains(c) {
+                include.push(c.clone());
+            }
+        }
+        for (class, source) in class_entries.iter().zip(&source_entries) {
+            sources.insert(class.clone(), json!(source));
+        }
+    }
+    for facet in &structure.facets {
+        if facet.kind == "web" && root.join(&facet.module) == server_root {
+            let web_root = facet.web_root.trim();
+            let web_root = if web_root.is_empty() { "src/main/webapp" } else { web_root };
+            if let Some(path) = normalize(web_root) {
+                let glob = format!("{}/WEB-INF/lib/**/*.jar", path.trim_end_matches('/'));
+                if !include.contains(&glob) {
+                    include.push(glob);
+                }
+            }
+        }
+    }
+
+    if output_path.is_none() && include.is_empty() {
+        return;
+    }
+    let mut settings = cfg.settings.take().unwrap_or_else(|| json!({}));
+    if let Some(output) = output_path {
+        settings["java"]["project"]["outputPath"] = json!(output);
+    }
+    if !include.is_empty() {
+        let existing = &settings["java"]["project"]["referencedLibraries"];
+        let mut libraries = if existing.is_object() {
+            existing.clone()
+        } else if existing.is_array() {
+            json!({ "include": existing })
+        } else {
+            json!({ "include": ["lib/**/*.jar"] })
+        };
+        let mut entries = libraries["include"].as_array().cloned().unwrap_or_default();
+        for path in include {
+            let path = json!(path);
+            if !entries.contains(&path) {
+                entries.push(path);
+            }
+        }
+        libraries["include"] = json!(entries);
+        if !sources.is_empty() {
+            let mut attachments = libraries["sources"].as_object().cloned().unwrap_or_default();
+            attachments.extend(sources);
+            libraries["sources"] = json!(attachments);
+        }
+        settings["java"]["project"]["referencedLibraries"] = libraries;
+    }
+    cfg.settings = Some(settings);
+}
+
 pub(crate) fn source_paths_removed(
     current: &ide_language::LanguageServerConfig,
     next: &ide_language::LanguageServerConfig,
@@ -104,11 +219,13 @@ fn compiler_defaults(cfg: &ide_language::LanguageServerConfig) -> Value {
     let Ok(prefs) = std::fs::read_to_string(path) else { return json!({}) };
     let mut options = serde_json::Map::new();
     for line in prefs.lines() {
-        if let Some((key, value)) = line.split_once('=')
-            && ACCESS_OPTIONS.contains(&key.trim())
-            && ["error", "warning", "info", "ignore"].contains(&value.trim())
-        {
-            options.insert(key.trim().into(), json!(value.trim()));
+        if let Some((key, value)) = line.split_once('=') {
+            let (k, v) = (key.trim(), value.trim());
+            if (ACCESS_OPTIONS.contains(&k) && ["error", "warning", "info", "ignore"].contains(&v))
+                || (LEVEL_OPTIONS.contains(&k) && ["1.8", "11", "17", "21", "25"].contains(&v))
+            {
+                options.insert(k.into(), json!(v));
+            }
         }
     }
     Value::Object(options)
@@ -978,4 +1095,110 @@ mod tests {
         assert!(missing_bundle(&IdeError::invalid("No delegateCommandHandler for vscode.java.startDebugSession")));
         assert!(!missing_bundle(&e));
     }
+
+    #[test]
+    fn configure_project_structure_sets_output_referenced_libraries_and_web_facets() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let lib_dir = root.join("lib");
+        std::fs::create_dir_all(&lib_dir).unwrap();
+        let jar_path = lib_dir.join("helper.jar");
+        let src_path = lib_dir.join("helper-sources.jar");
+        std::fs::write(&jar_path, b"").unwrap();
+        std::fs::write(&src_path, b"").unwrap();
+
+        let mut structure = ide_core::settings::ProjectStructureSettings {
+            compiler_output: "out/production".into(),
+            libraries: vec![ide_core::settings::ProjectLibrary {
+                name: "helper".into(),
+                classes: vec!["lib/helper.jar".into()],
+                sources: vec!["lib/helper-sources.jar".into()],
+                javadocs: vec![],
+                scope: ide_core::settings::DependencyScope::Compile,
+            }],
+            facets: vec![ide_core::settings::FacetConfig {
+                kind: "web".into(),
+                module: ".".into(),
+                descriptor: "src/main/webapp/WEB-INF/web.xml".into(),
+                web_root: "src/main/webapp".into(),
+            }],
+            ..Default::default()
+        };
+        structure.modules.insert(
+            "submod".into(),
+            ide_core::settings::ModuleStructureSettings {
+                compiler_output: "submod/classes".into(),
+                ..Default::default()
+            },
+        );
+
+        let mut cfg: ide_language::LanguageServerConfig = toml::from_str("name = 'jdtls'\ncommand = 'jdtls'").unwrap();
+        configure_project_structure(&mut cfg, root, root, &structure);
+
+        let settings = cfg.settings.as_ref().unwrap();
+        assert_eq!(settings.pointer("/java/project/outputPath").and_then(Value::as_str), Some("out/production"));
+        let include = settings
+            .pointer("/java/project/referencedLibraries/include")
+            .and_then(Value::as_array)
+            .unwrap()
+            .iter()
+            .filter_map(Value::as_str)
+            .collect::<Vec<_>>();
+        assert!(include.iter().any(|p| p.ends_with("lib/helper.jar")));
+        assert!(include.iter().any(|p| p.ends_with("src/main/webapp/WEB-INF/lib/**/*.jar")));
+        let sources = settings.pointer("/java/project/referencedLibraries/sources").and_then(Value::as_object).unwrap();
+        assert!(sources.values().any(|v| v.as_str().is_some_and(|s| s.ends_with("lib/helper-sources.jar"))));
+
+        // Module-specific compiler output overrides project-wide compiler output.
+        let mut sub_cfg: ide_language::LanguageServerConfig =
+            toml::from_str("name = 'jdtls'\ncommand = 'jdtls'").unwrap();
+        configure_project_structure(&mut sub_cfg, root, &root.join("submod"), &structure);
+        assert_eq!(
+            sub_cfg.settings.as_ref().unwrap().pointer("/java/project/outputPath").and_then(Value::as_str),
+            Some("classes")
+        );
+        let sub_settings = sub_cfg.settings.as_ref().unwrap();
+        let libs = sub_settings.pointer("/java/project/referencedLibraries/include").unwrap().as_array().unwrap();
+        assert!(libs.contains(&json!(root.join("lib/helper.jar").to_string_lossy().replace('\\', "/"))));
+        assert!(!libs.iter().any(|v| v.as_str().is_some_and(|p| p.contains("WEB-INF"))));
+    }
+
+    #[test]
+    fn project_libraries_preserve_existing_globs_exclusions_and_source_attachments() {
+        let tmp = tempfile::tempdir().unwrap();
+        let mut cfg: ide_language::LanguageServerConfig = toml::from_str("name = 'jdtls'\ncommand = 'jdtls'").unwrap();
+        cfg.settings = Some(json!({"java": {"project": {"referencedLibraries": {
+            "include": ["vendor/**/*.jar"], "exclude": ["vendor/old.jar"],
+            "sources": {"vendor/base.jar": "vendor/base-sources.jar"}
+        }}}}));
+        let structure = ide_core::settings::ProjectStructureSettings {
+            libraries: vec![ide_core::settings::ProjectLibrary {
+                classes: vec!["lib/new.jar".into()],
+                sources: vec!["lib/new-sources.jar".into()],
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        configure_project_structure(&mut cfg, tmp.path(), tmp.path(), &structure);
+        let libraries = cfg.settings.as_ref().unwrap().pointer("/java/project/referencedLibraries").unwrap();
+        assert_eq!(libraries["include"][0], "vendor/**/*.jar");
+        assert_eq!(libraries["exclude"], json!(["vendor/old.jar"]));
+        assert_eq!(libraries["sources"]["vendor/base.jar"], "vendor/base-sources.jar");
+        assert_eq!(libraries["sources"].as_object().unwrap().len(), 2);
+    }
+
+    #[test]
+    fn absolute_output_inside_the_module_becomes_relative() {
+        let tmp = tempfile::tempdir().unwrap();
+        let mut cfg: ide_language::LanguageServerConfig = toml::from_str("name = 'jdtls'\ncommand = 'jdtls'").unwrap();
+        let mut structure = ide_core::settings::ProjectStructureSettings {
+            compiler_output: tmp.path().join("out").to_string_lossy().into_owned(),
+            ..Default::default()
+        };
+        configure_project_structure(&mut cfg, tmp.path(), tmp.path(), &structure);
+        assert_eq!(cfg.settings.as_ref().unwrap().pointer("/java/project/outputPath"), Some(&json!("out")));
+        structure.compiler_output = tmp.path().parent().unwrap().join("elsewhere").to_string_lossy().into_owned();
+        configure_project_structure(&mut cfg, tmp.path(), tmp.path(), &structure);
+        assert!(cfg.launch_error.as_deref().unwrap().contains("inside its module"));
+    }
 }

crates/ide-lsp/src/jdtls/configuration.rs

@@ -20,6 +20,16 @@ const MAX_CACHED_KEYS: usize = 100_000;
 #[derive(Default)]
 pub(crate) struct ConfigurationCache {
     files: HashMap<PathBuf, CachedFile>,
+    roots: HashMap<PathBuf, CachedPaths>,
+}
+struct CachedPaths {
+    paths: Vec<PathBuf>,
+    incomplete: Option<ReferencesIncomplete>,
+}
+impl ConfigurationCache {
+    pub(crate) fn invalidate_paths(&mut self) {
+        self.roots.clear();
+    }
 }
 struct CachedFile {
     stamp: (SystemTime, u64),
@@ -49,6 +59,9 @@ fn language(path: &Path) -> Option<LanguageId> {
     match path.extension()?.to_str()? {
         "yaml" | "yml" => Some(LanguageId::new("yaml")),
         "properties" => Some(LanguageId::new("properties")),
+        // Spring XML wiring declares properties in `<prop key="...">` values
+        // and placeholder-configurer `<property name="...">` entries.
+        "xml" => Some(LanguageId::new("xml")),
         _ => None,
     }
 }
@@ -158,6 +171,16 @@ impl LspManager {
         } else {
             None
         };
+        // A click inside a Spring `${name}` placeholder sits on a value, not a
+        // key: the name names the property whose declaration lives in
+        // configuration files or Spring XML, with Java binding members still
+        // answering through the Java index.
+        let placeholder = if config && key.is_none() && !usages && snap.text.as_str().len() as u64 <= MAX_BYTES {
+            syntax().configuration_placeholder(snap.text.as_str(), pos)
+        } else {
+            None
+        };
+        let key = placeholder.clone().or(key);
         if config && key.is_none() {
             return Ok(None);
         }
@@ -178,7 +201,8 @@ impl LspManager {
                 return Ok(None);
             }
         }
-        let result = self.configuration_query(snap, pos, key, usages, include_declaration, cancel).await;
+        let result =
+            self.configuration_query(snap, pos, key, placeholder.is_some(), usages, include_declaration, cancel).await;
         match result {
             Err(e) if cancel.is_cancelled() || e.kind == ErrorKind::Cancelled => Err(IdeError::cancelled()),
             Err(e) => {
@@ -189,22 +213,63 @@ impl LspManager {
         }
     }
 
+    #[allow(clippy::too_many_arguments)]
     async fn configuration_query(
         &self,
         snap: &DocSnap,
         pos: Pos,
         key: Option<String>,
+        placeholder: bool,
         usages: bool,
         include_declaration: bool,
         cancel: &CancellationToken,
     ) -> IdeResult<Option<References>> {
-        let (server, run) = self.jdtls(&snap.path, cancel).await?;
+        // A `${name}` reference resolves from configuration files and Spring
+        // XML without Java; those declarations are collected first so
+        // navigation survives an unavailable or outdated Java extension.
+        let local = if placeholder {
+            let name = key.clone().unwrap_or_default();
+            let path = snap.path.clone();
+            let project_root = self.project_root.clone();
+            let root = tokio::task::spawn_blocking(move || {
+                path.parent()
+                    .into_iter()
+                    .flat_map(Path::ancestors)
+                    .take_while(|p| p.starts_with(&project_root))
+                    .find(|p| {
+                        ["pom.xml", "build.gradle", "build.gradle.kts", ".classpath"]
+                            .iter()
+                            .any(|name| p.join(name).is_file())
+                    })
+                    .map(Path::to_path_buf)
+                    .unwrap_or(project_root)
+            })
+            .await
+            .map_err(|_| IdeError::unavailable("configuration search worker stopped"))?;
+            Some(
+                self.configuration_declarations(
+                    vec![Pattern { name, relaxed: true }],
+                    std::slice::from_ref(&root),
+                    cancel,
+                )
+                .await?,
+            )
+        } else {
+            None
+        };
+        let answered = local.as_ref().is_some_and(|local| !local.locations.is_empty());
+        let (server, run) = match self.jdtls(&snap.path, cancel).await {
+            Ok(found) => found,
+            Err(e) if cancel.is_cancelled() || e.kind == ErrorKind::Cancelled => return Err(IdeError::cancelled()),
+            Err(_) if answered => return Ok(local),
+            Err(e) => return Err(e),
+        };
         if !run.caps.read().commands().iter().any(|command| command == COMMAND) {
-            return Ok(None);
+            return Ok(if placeholder { local } else { None });
         }
         let target = Target { server: server.clone(), run };
         let position = snap.text.ide_to_lsp(Encoding::Utf16, pos);
-        let response: Response = self
+        let response: Response = match self
             .call(
                 &target,
                 "workspace/executeCommand",
@@ -214,11 +279,17 @@ impl LspManager {
                 Some(cancel),
                 crate::LONG_TIMEOUT,
             )
-            .await?;
+            .await
+        {
+            Ok(response) => response,
+            Err(e) if cancel.is_cancelled() || e.kind == ErrorKind::Cancelled => return Err(IdeError::cancelled()),
+            Err(_) if answered => return Ok(local),
+            Err(e) => return Err(e),
+        };
         if cancel.is_cancelled() {
             return Err(IdeError::cancelled());
         }
-        if response.keys.is_empty() {
+        if response.keys.is_empty() && !placeholder {
             return Ok(response
                 .incomplete
                 .then(|| References { incomplete: Some(ReferencesIncomplete::FilesSkipped), ..Default::default() }));
@@ -229,22 +300,18 @@ impl LspManager {
             ..Default::default()
         };
         self.note_virtual(&server, result.locations.iter().map(|l| l.uri.as_deref()));
-        if key.is_none() || usages {
+        if let Some(local) = local {
+            result.locations.extend(local.locations);
+            result.incomplete = result.incomplete.or(local.incomplete);
+        }
+        if key.is_none() || usages || placeholder {
             let roots: Vec<PathBuf> = response.roots.iter().filter_map(|uri| super::project_path(uri)).collect();
-            let overlays: HashMap<PathBuf, String> = self
-                .docs
-                .lock()
-                .values()
-                .filter(|d| language(&d.path).is_some() && d.text.as_str().len() as u64 <= MAX_BYTES)
-                .map(|d| (d.canonical.clone(), d.text.as_str().to_owned()))
-                .collect();
-            let cache = self.configuration_cache.clone();
-            let cancelled = cancel.clone();
-            let keys = response.keys;
-            let files =
-                tokio::task::spawn_blocking(move || configuration_files(&roots, &keys, &overlays, &cache, &cancelled))
-                    .await
-                    .map_err(|_| IdeError::unavailable("configuration search worker stopped"))?;
+            let patterns = if placeholder {
+                vec![Pattern { name: key.clone().unwrap_or_default(), relaxed: true }]
+            } else {
+                response.keys
+            };
+            let files = self.configuration_declarations(patterns, &roots, cancel).await?;
             result.locations.extend(files.locations);
             result.incomplete = result.incomplete.or(files.incomplete);
         }
@@ -266,6 +333,29 @@ impl LspManager {
         crate::convert::dedup_locations(&mut result.locations);
         Ok(Some(result))
     }
+
+    /// Configuration-file and Spring-XML declarations matching `patterns` under
+    /// `roots`, with open editor contents taking precedence over disk.
+    async fn configuration_declarations(
+        &self,
+        patterns: Vec<Pattern>,
+        roots: &[PathBuf],
+        cancel: &CancellationToken,
+    ) -> IdeResult<References> {
+        let overlays: HashMap<PathBuf, String> = self
+            .docs
+            .lock()
+            .values()
+            .filter(|d| language(&d.path).is_some() && d.text.as_str().len() as u64 <= MAX_BYTES)
+            .map(|d| (d.canonical.clone(), d.text.as_str().to_owned()))
+            .collect();
+        let cache = self.configuration_cache.clone();
+        let cancelled = cancel.clone();
+        let roots = roots.to_vec();
+        tokio::task::spawn_blocking(move || configuration_files(&roots, &patterns, &overlays, &cache, &cancelled))
+            .await
+            .map_err(|_| IdeError::unavailable("configuration search worker stopped"))
+    }
 }
 
 fn in_module(root: &Path, path: &Path) -> bool {
@@ -296,11 +386,15 @@ fn configuration_files(
 ) -> References {
     let mut result = References::default();
     let mut paths = std::collections::BTreeSet::new();
-    // Do not scan a source root twice when its enclosing module is also present.
-    let roots: Vec<_> =
-        roots.iter().filter(|root| !roots.iter().any(|other| other != *root && root.starts_with(other))).collect();
-    for root in &roots {
-        let module = (*root).clone();
+    let mut cache = cache.lock();
+    for root in roots {
+        if let Some(cached) = cache.roots.get(root) {
+            paths.extend(cached.paths.iter().cloned());
+            result.incomplete = result.incomplete.or(cached.incomplete);
+            continue;
+        }
+        let mut found = CachedPaths { paths: Vec::new(), incomplete: None };
+        let module = root.clone();
         let walker = ignore::WalkBuilder::new(root)
             .follow_links(false)
             .filter_entry(move |entry| {
@@ -324,21 +418,26 @@ fn configuration_files(
             if cancel.is_cancelled() {
                 return result;
             }
-            if visited >= 50_000 || paths.len() >= MAX_FILES {
-                result.incomplete = Some(ReferencesIncomplete::TooManyFiles);
+            if visited >= 50_000 || found.paths.len() >= MAX_FILES {
+                found.incomplete = Some(ReferencesIncomplete::TooManyFiles);
                 break;
             }
             match entry {
                 Ok(entry) if entry.file_type().is_some_and(|t| t.is_file()) && language(entry.path()).is_some() => {
-                    paths.insert(entry.into_path());
+                    found.paths.push(entry.into_path());
                 }
-                Err(_) => result.incomplete = Some(ReferencesIncomplete::FilesSkipped),
+                Err(_) => found.incomplete = Some(ReferencesIncomplete::FilesSkipped),
                 _ => {}
             }
         }
+        paths.extend(found.paths.iter().cloned());
+        result.incomplete = result.incomplete.or(found.incomplete);
+        if cache.roots.len() >= MAX_FILES {
+            cache.roots.clear();
+        }
+        cache.roots.insert(root.clone(), found);
     }
     paths.extend(overlays.keys().filter(|p| roots.iter().any(|r| in_module(r, p))).cloned());
-    let mut cache = cache.lock();
     if cache.files.len() > MAX_FILES {
         cache.files.clear();
     }

crates/ide-lsp/src/lib.rs

@@ -13,6 +13,7 @@ mod convert;
 mod external_project;
 mod file_ops;
 mod file_watch;
+mod go_scope;
 mod handler;
 mod inspect;
 pub mod jdtls;
@@ -53,7 +54,7 @@ use serde::Serialize;
 use serde::de::DeserializeOwned;
 use serde_json::{Value, json};
 use server::{Conn, Running, Server};
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Weak};
@@ -506,8 +507,20 @@ impl LspManager {
         if self.shutting_down.load(Ordering::Acquire) || !self.execution_allowed.load(Ordering::Acquire) {
             return;
         }
+        // `begin_start` only claims Idle servers, so a claimed server is never a
+        // live one. Its root is the process's working directory: starting with
+        // one deleted from disk fails (`os error 267` on Windows). Such a
+        // server can never serve again, so drop it instead of leaving a
+        // permanently "Crashed" entry behind (e.g. the root vanishing during
+        // the crash-restart backoff, or an open-file request arriving later).
         let Some(generation) = server.begin_start() else { return };
         let Some(me) = self.me.upgrade() else { return };
+        if !server.root.is_dir() {
+            tracing::info!("{}: workspace root {} is gone, dropping", server.name, server.root.display());
+            server.announce_down();
+            self.forget(std::slice::from_ref(server));
+            return;
+        }
         let server = server.clone();
         self.runtime.spawn(async move { me.run_instance(server, generation).await });
     }
@@ -704,6 +717,14 @@ impl LspManager {
             server.announce_down();
             return;
         }
+        // The workspace root gone means this server can never serve again:
+        // restarting would respawn with a dead working directory, so the entry
+        // is dropped instead of staying "Crashed" forever.
+        if !server.root.is_dir() {
+            server.announce_down();
+            self.forget(std::slice::from_ref(&server));
+            return;
+        }
         let tail = server.stderr_tail(5);
         let cfg = server.effective_config();
         let mut message = match (code, &cfg.connect) {
@@ -1364,14 +1385,8 @@ impl LspManager {
             let mut first = Vec::new();
             if method == "textDocument/implementation" {
                 let (locs, complete) = self.java_source_implementations(snap, t, pos, cancel).await;
-                // A type declared in the sources has no implementations in the dependencies:
-                // none found there is the whole answer, without a type hierarchy over every jar.
-                if complete {
-                    if !locs.is_empty() {
-                        return Ok(locs);
-                    }
-                    out.value = Some(Vec::new());
-                    continue;
+                if complete && !locs.is_empty() {
+                    return Ok(locs);
                 }
                 if let Some(partial) = partial
                     && !locs.is_empty()
@@ -1429,9 +1444,9 @@ impl LspManager {
         self.references_streaming(doc, pos, include_declaration, project_wide, true, cancel, None).await
     }
 
-    /// [`Self::references`]. Java: without `libraries`, only the workspace's sources are
-    /// searched (`libraries_skipped` when `project_wide`); with it and `project_wide`, those
-    /// found there arrive on `partial` before the dependencies and the JDK are searched.
+    /// [`Self::references`]. Java, `project_wide`: without `libraries`, only the
+    /// workspace's sources are searched (`libraries_skipped`); with it, those found
+    /// there arrive on `partial` before the dependencies and the JDK are searched.
     #[allow(clippy::too_many_arguments)]
     pub async fn references_streaming(
         &self,
@@ -1460,7 +1475,20 @@ impl LspManager {
         };
         let native =
             self.native_references(doc, pos, include_declaration, project_wide, libraries, cancel.clone(), partial);
-        let (configuration, result) = futures::join!(configuration, native);
+        futures::pin_mut!(configuration, native);
+        let (configuration, result) = match futures::future::select(configuration, native).await {
+            futures::future::Either::Left((configuration, native)) => (configuration, native.await),
+            futures::future::Either::Right((result, configuration)) => {
+                // The configuration index is rebuilt after Java changes, which takes seconds in a
+                // project with many dependencies: the usages found meanwhile are shown first.
+                if let (Some(partial), Ok(found)) = (partial, &result)
+                    && !found.locations.is_empty()
+                {
+                    partial(found.clone());
+                }
+                (configuration.await, result)
+            }
+        };
         let configuration = configuration?;
         let mut result = result?;
         if let Some(configuration) = configuration {
@@ -1584,10 +1612,7 @@ impl LspManager {
                     };
                     scope::Widened { first: all, second: Some(found), incomplete: sources.incomplete }
                 } else {
-                    // Bulk probes (usage counts, Safe Delete) ask about the sources' own symbols,
-                    // which no dependency uses: searching every jar and the JDK only adds seconds
-                    // per symbol and delays the searches the user asks for.
-                    let first = query(!libraries).await?;
+                    let first = query(false).await?;
                     let empty = first.is_empty();
                     scope::Widened::only(first, empty, &t.server)
                 };
@@ -1688,6 +1713,19 @@ impl LspManager {
         }
         let mut v = out.finish(References::default())?;
         convert::dedup_locations(&mut v.locations);
+        if project_wide && let Some(t) = targets.first().filter(|_| snap.language.as_str() == "go") {
+            // Usages in other modules take a view per module: those in reach come first.
+            if let Some(partial) = partial
+                && !v.locations.is_empty()
+            {
+                partial(v.clone());
+            }
+            v.locations.extend(self.go_mentions_beyond_search(&snap, t, pos, &cancel, false).await.locations);
+            if cancel.is_cancelled() {
+                return Err(IdeError::cancelled());
+            }
+            convert::dedup_locations(&mut v.locations);
+        }
         Ok(v)
     }
 
@@ -2120,7 +2158,20 @@ impl LspManager {
         };
         let w = self.widened(snap, t, pos, cancel, query, files).await?;
         // The second edit covers the first: its files stay analysed.
-        Ok(Renamed { edit: w.second.unwrap_or(w.first), incomplete: w.incomplete })
+        let mut edit = w.second.unwrap_or(w.first);
+        let mut more: BTreeMap<PathBuf, Vec<TextEdit>> = BTreeMap::new();
+        for l in self.go_mentions_beyond_search(snap, t, pos, cancel, false).await.locations {
+            more.entry(l.path.to_path_buf())
+                .or_default()
+                .push(TextEdit { range: l.range, new_text: new_name.to_owned() });
+        }
+        if cancel.is_cancelled() {
+            return Err(IdeError::cancelled());
+        }
+        let files =
+            more.into_iter().map(|(path, edits)| ide_core::FileEdit::Edit { path: path.into(), edits, version: None });
+        convert::merge_workspace_edit(&mut edit, WorkspaceEdit { files: files.collect(), ..Default::default() });
+        Ok(Renamed { edit, incomplete: w.incomplete })
     }
 
     // ---- file operations (`workspace/willRenameFiles`, `workspace/didRenameFiles`) ----
@@ -2189,6 +2240,10 @@ impl LspManager {
                 },
             );
         for file in candidate {
+            // A move may have already removed the sampled entry on disk.
+            if !file.is_file() {
+                continue;
+            }
             let language = self.languages.detect(&file, None);
             if !languages.contains(&language) {
                 continue;
@@ -2259,6 +2314,9 @@ impl LspManager {
 
     /// Tells running servers that files or folders moved (`moves`: from → to, after the move).
     pub fn did_rename_files(&self, moves: &[(PathBuf, PathBuf)]) {
+        if !moves.is_empty() {
+            self.configuration_cache.lock().invalidate_paths();
+        }
         let moves: Vec<(PathBuf, PathBuf, bool)> =
             moves.iter().map(|(f, t)| (f.clone(), t.clone(), t.is_dir())).collect();
         let servers: Vec<Arc<Server>> = self.servers.lock().clone();
@@ -2279,6 +2337,13 @@ impl LspManager {
     /// into `.venv` or a `go.mod` rewritten by `go get` is picked up without a restart. Other
     /// servers hear of their languages' files under their root; without it jdtls's incremental
     /// build never sees them, so a launch runs stale classes.
+    ///
+    /// Creates and changes for documents synced on a server's current instance are left out.
+    /// Their text reaches the server through `didOpen`/`didChange`, including clean-buffer
+    /// reloads. A server that re-reads the file on the watched change (csharp-ls) would apply
+    /// the reload and then the `didChange` computed against the pre-reload copy, so it would
+    /// keep analysing content that diverges from both the disk and the editor (#1780).
+    /// Deletions still reach it: document sync does not describe workspace membership.
     pub fn watched_files_changed(
         &self,
         created: &[PathBuf],
@@ -2287,20 +2352,47 @@ impl LspManager {
         excluded_dirs: &[PathBuf],
     ) {
         use file_watch::Change;
+        if !created.is_empty() || !removed.is_empty() || !excluded_dirs.is_empty() {
+            self.configuration_cache.lock().invalidate_paths();
+        }
         let servers: Vec<Arc<Server>> = self.servers.lock().clone();
+        let open: HashMap<(ide_core::ServerId, u64), HashSet<PathBuf>> = {
+            let docs = self.docs.lock();
+            let mut open: HashMap<_, HashSet<_>> = HashMap::new();
+            for d in docs.values() {
+                for a in &d.servers {
+                    if let Some(generation) = a.opened_gen {
+                        open.entry((a.server.id, generation))
+                            .or_default()
+                            .extend([d.path.clone(), d.canonical.clone()]);
+                    }
+                }
+            }
+            open
+        };
+        let canonical: HashMap<_, _> =
+            created.iter().chain(modified).filter_map(|p| dunce::canonicalize(p).ok().map(|c| (p, c))).collect();
         for s in servers {
             let Some(run) = s.running() else { continue };
+            let open = open.get(&(s.id, run.generation)).filter(|_| run.caps.read().sync != SyncKind::None);
+            let send = |p: &PathBuf, change: Change| {
+                change == Change::Deleted
+                    || !open
+                        .is_some_and(|paths| paths.contains(p) || canonical.get(p).is_some_and(|c| paths.contains(c)))
+            };
             let all = [(created, Change::Created), (modified, Change::Changed), (removed, Change::Deleted)]
                 .into_iter()
                 .flat_map(|(paths, change)| paths.iter().map(move |p| (p, change)));
             let watchers = run.watchers.read();
             let changes: Vec<(&PathBuf, Change)> = if watchers.is_empty() {
                 let languages = s.languages();
-                all.filter(|(p, _)| p.starts_with(&s.root) && languages.contains(&self.languages.detect(p, None)))
-                    .collect()
+                all.filter(|(p, change)| {
+                    p.starts_with(&s.root) && languages.contains(&self.languages.detect(p, None)) && send(p, *change)
+                })
+                .collect()
             } else {
                 all.chain(excluded_dirs.iter().map(|p| (p, Change::Created)))
-                    .filter(|(p, change)| watchers.wants(&s.root, p, *change))
+                    .filter(|(p, change)| watchers.wants(&s.root, p, *change) && send(p, *change))
                     .collect()
             };
             drop(watchers);
@@ -2565,6 +2657,15 @@ impl LspManager {
             }
             HierarchyDirection::Outgoing => (query().await?, None),
         };
+        let mut out = out;
+        if direction == HierarchyDirection::Incoming {
+            for caller in self.go_mentions_beyond_search(&snap, t, pos, cancel, true).await.callers {
+                match out.iter_mut().find(|i| i.path == caller.path && i.range == caller.range) {
+                    Some(item) => item.from_ranges.extend(caller.from_ranges),
+                    None => out.push(caller),
+                }
+            }
+        }
         if cancel.is_cancelled() {
             return Err(IdeError::cancelled());
         }
@@ -3036,6 +3137,13 @@ impl LspManager {
             .find(|s| s.id == server)
             .cloned()
             .ok_or_else(|| IdeError::not_found(format!("unknown language server {server}")))?;
+        if !s.root.is_dir() {
+            return Err(IdeError::unavailable(format!(
+                "the workspace root of {} is gone: {}",
+                s.name,
+                s.root.display()
+            )));
+        }
         self.stop_instance(&s, false).await;
         s.reset_for_restart();
         self.ensure_started(&s);

crates/ide-lsp/src/scope.rs

@@ -6,13 +6,15 @@
 //! other project files are silently missing. So, as a word index would, the
 //! project files of the server's languages that contain the symbol's name as a
 //! whole word (found through the host's [`CandidateFn`]) and that the first
-//! answer did not cover are opened on the server for a second request, then
-//! closed again. Diagnostics the server publishes for them are dropped.
+//! answer and the server's analysis scope did not cover are opened for a second
+//! request, then closed again. Diagnostics the server publishes for them are dropped.
 
 use crate::server::{Running, Server};
-use crate::types::ReferencesIncomplete;
+use crate::text::DocText;
+use crate::types::{HierarchyItem, ReferencesIncomplete};
 use crate::{DocSnap, LspManager, Target};
-use ide_core::{CancellationToken, IdeError, IdeResult, LanguageId, Pos};
+use futures::StreamExt;
+use ide_core::{CancellationToken, IdeError, IdeResult, LanguageId, Location, Pos};
 use lsp_types as lsp;
 use serde_json::json;
 use std::collections::HashSet;
@@ -27,6 +29,8 @@ pub const MAX_CANDIDATES: usize = 300;
 const MAX_CANDIDATE_BYTES: u64 = 1 << 20;
 /// How long a search that found nothing waits for a server to finish indexing.
 const INDEX_WAIT: Duration = Duration::from_secs(10);
+/// Optional server command: candidate URIs in, already analysed candidate URIs out.
+const COVERED_FILES: &str = "openidea.workspace.coveredFiles";
 
 /// Project files that may mention a symbol.
 #[derive(Clone, Debug)]
@@ -51,6 +55,14 @@ pub struct CandidateFiles {
 /// blocking thread and should stop early when cancelled.
 pub type CandidateFn = dyn Fn(&CandidateQuery, &CancellationToken) -> CandidateFiles + Send + Sync;
 
+/// What a Go search adds beyond gopls' own answer.
+#[derive(Default)]
+pub(crate) struct GoMentions {
+    pub locations: Vec<Location>,
+    /// The declarations containing them, as incoming calls (when asked for).
+    pub callers: Vec<HierarchyItem>,
+}
+
 /// A reference-based answer and, when files were opened for it, the second one.
 pub(crate) struct Widened<R> {
     pub first: R,
@@ -93,7 +105,7 @@ impl LspManager {
     }
 
     /// Runs `query` on `t`; then again with the project files that mention the
-    /// symbol at `pos` and are not in `covered(first)` opened on the server.
+    /// symbol at `pos` outside `covered(first)` and the server's analysis scope opened.
     /// A first answer that is empty while the server indexes is retried once
     /// indexing ends.
     pub(crate) async fn widened<R, F, Fut>(
@@ -110,7 +122,9 @@ impl LspManager {
         Fut: Future<Output = IdeResult<R>>,
     {
         let busy = t.server.is_busy();
-        let word = search_word(snap, pos).filter(|_| t.caps().open_close);
+        // gopls searches the view of the file asked about; files opened for it only get views of
+        // their own (see `go_scope`).
+        let word = search_word(snap, pos).filter(|_| t.caps().open_close && snap.language.as_str() != "go");
         let candidates = async {
             match word {
                 Some(w) => self.candidates(t, w, cancel).await,
@@ -134,6 +148,10 @@ impl LspManager {
         }
         let known: HashSet<PathBuf> = covered(&first).into_iter().chain([snap.path.clone()]).collect();
         let files: Vec<PathBuf> = candidates.files.into_iter().filter(|f| !known.contains(f)).collect();
+        let files = self.files_beyond_scope(t, files, cancel).await;
+        if cancel.is_cancelled() {
+            return Err(IdeError::cancelled());
+        }
         if files.is_empty() {
             return Ok(Widened { first, second: None, incomplete });
         }
@@ -162,6 +180,196 @@ impl LspManager {
         }
     }
 
+    async fn files_beyond_scope(&self, t: &Target, files: Vec<PathBuf>, cancel: &CancellationToken) -> Vec<PathBuf> {
+        if files.is_empty() || !t.caps().commands().iter().any(|c| c == COVERED_FILES) {
+            return files;
+        }
+        let uris: Vec<String> = files.iter().map(|p| crate::uri::path_to_uri_string(p)).collect();
+        let params = json!({ "command": COVERED_FILES, "arguments": [uris] });
+        // An unsupported, failed or malformed scope answer must not remove candidates.
+        let covered: IdeResult<Vec<String>> =
+            self.call(t, "workspace/executeCommand", params, Some(cancel), crate::DEFAULT_TIMEOUT).await;
+        match covered {
+            Ok(covered) => {
+                let covered: HashSet<_> = covered.into_iter().collect();
+                files.into_iter().zip(uris).filter_map(|(f, uri)| (!covered.contains(&uri)).then_some(f)).collect()
+            }
+            Err(e) => {
+                tracing::debug!("{}: analysis scope unavailable: {}", t.server.name, e.message);
+                files
+            }
+        }
+    }
+
+    /// Go: usages of the symbol at `pos` that the search at `pos` does not reach (see
+    /// `go_scope`), each mention of the name resolved in its own file's view; with `callers`,
+    /// also the declarations containing them, as incoming calls.
+    pub(crate) async fn go_mentions_beyond_search(
+        &self,
+        snap: &DocSnap,
+        t: &Target,
+        pos: Pos,
+        cancel: &CancellationToken,
+        callers: bool,
+    ) -> GoMentions {
+        if snap.language.as_str() != "go" || !t.caps().open_close {
+            return GoMentions::default();
+        }
+        let Some(word) = search_word(snap, pos) else { return GoMentions::default() };
+        let declarations: Vec<Location> = self
+            .goto_in(snap, std::slice::from_ref(t), "textDocument/definition", pos, Some(cancel), None)
+            .await
+            .unwrap_or_default()
+            .into_iter()
+            .filter(|l| l.uri.is_none())
+            .collect();
+        let Some(declaration) = declarations.first() else { return GoMentions::default() };
+        let Some(candidates) = self.candidates(t, word.clone(), cancel).await else { return GoMentions::default() };
+        let (origin, declared) = (snap.path.clone(), declaration.path.to_path_buf());
+        let files = tokio::task::spawn_blocking(move || {
+            crate::go_scope::files_beyond_search(&origin, &declared, candidates.files)
+                .into_iter()
+                .filter_map(|f| {
+                    let text = std::fs::read_to_string(&f).ok()?;
+                    let ranges = crate::go_scope::word_ranges(&text, &word);
+                    (!ranges.is_empty()).then(|| (f, DocText::new(&text), ranges))
+                })
+                .collect::<Vec<_>>()
+        })
+        .await
+        .unwrap_or_default();
+        if files.is_empty() || cancel.is_cancelled() {
+            return GoMentions::default();
+        }
+        // Open, each file gives gopls a view to resolve its mentions in (its module, its build).
+        let _opened = self.open_transient(t, files.iter().map(|(f, _, _)| f.clone()).collect(), cancel).await;
+        let texts: Vec<(PathBuf, Arc<DocText>)> =
+            files.iter().map(|(path, text, _)| (path.clone(), Arc::new(text.clone()))).collect();
+        let probes: Vec<(PathBuf, Arc<DocText>, ide_core::Range)> = files
+            .into_iter()
+            .zip(&texts)
+            .flat_map(|((path, _, ranges), (_, text))| {
+                let text = text.clone();
+                ranges.into_iter().map(move |r| (path.clone(), text.clone(), r))
+            })
+            .collect();
+        let declarations = &declarations;
+        let found: Vec<Option<Location>> = futures::stream::iter(probes)
+            .map(|(path, text, range)| async move {
+                let params = json!({
+                    "textDocument": { "uri": crate::uri::path_to_uri_string(&path) },
+                    "position": text.ide_to_lsp(t.enc(), range.start),
+                });
+                let r = crate::loading::while_loading(
+                    &t.server,
+                    Some(cancel),
+                    crate::loading::LOADING_WAIT,
+                    crate::goto_is_empty,
+                    || {
+                        self.call::<_, Option<lsp::GotoDefinitionResponse>>(
+                            t,
+                            "textDocument/definition",
+                            params.clone(),
+                            Some(cancel),
+                            crate::DEFAULT_TIMEOUT,
+                        )
+                    },
+                )
+                .await;
+                let targets = match r {
+                    Ok(Some(r)) => crate::convert::goto_response(&self.conv(t.enc()), r),
+                    _ => return None,
+                };
+                let same = targets
+                    .iter()
+                    .any(|l| declarations.iter().any(|d| d.path == l.path && d.range.start == l.range.start));
+                same.then(|| Location { path: path.into(), range, uri: None })
+            })
+            .buffer_unordered(8)
+            .collect()
+            .await;
+        let locations: Vec<Location> = found.into_iter().flatten().collect();
+        let mut out = GoMentions { callers: Vec::new(), locations };
+        if callers && !cancel.is_cancelled() {
+            for (path, text) in &texts {
+                let here: Vec<ide_core::Range> =
+                    out.locations.iter().filter(|l| l.path == *path).map(|l| l.range).collect();
+                if !here.is_empty() {
+                    out.callers.extend(self.go_callers_in(t, path, text, &here, cancel).await);
+                }
+            }
+        }
+        if cancel.is_cancelled() {
+            return GoMentions::default();
+        }
+        out
+    }
+
+    /// The declarations of `path` containing `calls`, innermost first, each with its call sites.
+    async fn go_callers_in(
+        &self,
+        t: &Target,
+        path: &Path,
+        text: &DocText,
+        calls: &[ide_core::Range],
+        cancel: &CancellationToken,
+    ) -> Vec<HierarchyItem> {
+        let params = json!({ "textDocument": { "uri": crate::uri::path_to_uri_string(path) } });
+        let r: IdeResult<Option<lsp::DocumentSymbolResponse>> =
+            self.call(t, "textDocument/documentSymbol", params, Some(cancel), crate::DEFAULT_TIMEOUT).await;
+        let range =
+            |r: lsp::Range| ide_core::Range::new(text.lsp_to_ide(t.enc(), r.start), text.lsp_to_ide(t.enc(), r.end));
+        // (name, kind, detail, range, selection range) of every declaration.
+        let mut symbols = Vec::new();
+        match r {
+            Ok(Some(lsp::DocumentSymbolResponse::Nested(nested))) => {
+                let mut stack = nested;
+                while let Some(s) = stack.pop() {
+                    symbols.push((s.name, s.kind, s.detail, range(s.range), range(s.selection_range)));
+                    stack.extend(s.children.unwrap_or_default());
+                }
+            }
+            #[allow(deprecated)]
+            Ok(Some(lsp::DocumentSymbolResponse::Flat(flat))) => {
+                for s in flat {
+                    let r = range(s.location.range);
+                    symbols.push((s.name, s.kind, None, r, r));
+                }
+            }
+            _ => return Vec::new(),
+        }
+        let contains =
+            |outer: &ide_core::Range, inner: &ide_core::Range| outer.start <= inner.start && inner.end <= outer.end;
+        let mut items: Vec<HierarchyItem> = Vec::new();
+        for call in calls {
+            // The innermost function or method; a package-level declaration otherwise.
+            let callable = |k: lsp::SymbolKind| matches!(k, lsp::SymbolKind::FUNCTION | lsp::SymbolKind::METHOD);
+            let innermost = |pick: &dyn Fn(lsp::SymbolKind) -> bool| {
+                symbols
+                    .iter()
+                    .filter(|(_, kind, _, r, _)| pick(*kind) && contains(r, call))
+                    .min_by_key(|(_, _, _, r, _)| (r.end.line - r.start.line, r.end.col.saturating_sub(r.start.col)))
+            };
+            let Some((name, kind, detail, r, selection)) = innermost(&callable).or_else(|| innermost(&|_| true)) else {
+                continue;
+            };
+            match items.iter_mut().find(|i| i.range == *r && i.name == *name) {
+                Some(item) => item.from_ranges.push(*call),
+                None => items.push(HierarchyItem {
+                    name: name.clone(),
+                    kind: crate::convert::symbol_kind(*kind),
+                    detail: detail.clone(),
+                    path: path.to_path_buf().into(),
+                    uri: None,
+                    range: *r,
+                    selection_range: *selection,
+                    from_ranges: vec![*call],
+                }),
+            }
+        }
+        items
+    }
+
     /// Opens `files` on `t` (read from disk) unless the user has them open;
     /// they are closed when the returned guard drops. Files too large or not
     /// readable as text are left out and flagged on the guard.

crates/ide-lsp/tests/fixtures/LombokSymbols.java

@@ -0,0 +1,28 @@
+package demo;
+
+@lombok.Data
+@lombok.Builder
+class User {
+    private String name;
+    private int age;
+}
+
+@lombok.Getter
+@lombok.Setter
+@lombok.RequiredArgsConstructor
+class Profile {
+    private final String id;
+    private String name;
+}
+
+@lombok.extern.java.Log
+class Logged {
+    void write() { log.info("hello"); }
+}
+
+class PlainUser {
+    private String name;
+    PlainUser(String name) { this.name = name; }
+    String getName() { return name; }
+    void setName(String name) { this.name = name; }
+}

crates/ide-lsp/tests/mock_server.rs

@@ -422,7 +422,8 @@ async fn files_changed_on_disk_reach_the_servers_of_their_language() {
     h.open("a.mk", "x");
     h.wait_status("mock", ServerStatus::Ready).await;
     let s = h.launcher.state("mock");
-    let (created, modified, removed) = (h.root.join("new.mk"), h.root.join("a.mk"), h.root.join("old.mk"));
+    // `a.mk` is open on the server: its changes reach it through document sync, not here.
+    let (created, modified, removed) = (h.root.join("new.mk"), h.root.join("changed.mk"), h.root.join("old.mk"));
     // Other languages and files outside the server's root are left out.
     let other = h.root.join("notes.txt");
     let outside = tempfile::tempdir().unwrap().path().join("far.mk");
@@ -448,6 +449,197 @@ async fn files_changed_on_disk_reach_the_servers_of_their_language() {
     h.mgr.shutdown_all().await;
 }
 
+/// An external change to a document open on the server's current instance reaches it only
+/// through the reload's `didChange`: a watched-file change for it too would make a server
+/// that re-reads the file on one (csharp-ls) apply the reload and then the diff computed
+/// against the pre-reload copy, so it would keep analysing stale content (#1780). A closed
+/// file's change is watched as before, and the file is watched again once its document closes.
+#[tokio::test(flavor = "multi_thread")]
+async fn documents_open_on_a_server_are_left_out_of_watched_file_changes() {
+    let h = harness(&[("mock", incremental_caps())]);
+    let (doc, path) = h.open("a.mk", "old");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    let s = h.launcher.state("mock");
+    eventually(|| !s.notified("textDocument/didOpen").is_empty()).await;
+
+    // The open document and a closed file changed outside the editor.
+    let closed = h.root.join("b.mk");
+    h.mgr.watched_files_changed(&[], &[path.clone(), closed.clone()], &[], &[]);
+    eventually(|| !s.notified("workspace/didChangeWatchedFiles").is_empty()).await;
+    assert_eq!(
+        s.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+        json!([{ "uri": uri_of(&closed), "type": 2 }])
+    );
+
+    // The editor reloads the open buffer from disk; the server hears the new text.
+    h.mgr.did_change(doc, 2, &[change(rng(0, 0, 0, 3), "new")], &|| "new".to_owned());
+    eventually(|| s.docs.lock().get(uri_of(&path).as_str()).map(String::as_str) == Some("new")).await;
+
+    // Once the document closes, the file is watched again.
+    h.mgr.did_close(doc);
+    h.mgr.watched_files_changed(&[], std::slice::from_ref(&path), &[], &[]);
+    eventually(|| s.notified("workspace/didChangeWatchedFiles").len() == 2).await;
+    assert_eq!(
+        s.notified("workspace/didChangeWatchedFiles")[1]["changes"],
+        json!([{ "uri": uri_of(&path), "type": 2 }])
+    );
+    h.mgr.shutdown_all().await;
+}
+
+async fn watch_all(s: &MockState) {
+    s.peer()
+        .request::<_, Value>(
+            "client/registerCapability",
+            json!({ "registrations": [{ "id": "all", "method": "workspace/didChangeWatchedFiles",
+                "registerOptions": { "watchers": [{ "globPattern": "**/*" }] } }] }),
+            None,
+        )
+        .await
+        .unwrap();
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn open_document_watches_keep_deletions_and_renames() {
+    for registered in [false, true] {
+        let h = harness(&[("mock", incremental_caps())]);
+        let (_, path) = h.open("a.mk", "old");
+        h.wait_status("mock", ServerStatus::Ready).await;
+        let s = h.launcher.state("mock");
+        if registered {
+            watch_all(&s).await;
+        }
+        let closed = h.root.join("closed.mk");
+        // An atomic replacement is reported as created and still uses document sync.
+        h.mgr.watched_files_changed(std::slice::from_ref(&path), &[path.clone(), closed.clone()], &[], &[]);
+        eventually(|| !s.notified("workspace/didChangeWatchedFiles").is_empty()).await;
+        assert_eq!(
+            s.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+            json!([{ "uri": uri_of(&closed), "type": 2 }])
+        );
+
+        let renamed = h.root.join("renamed.mk");
+        std::fs::rename(&path, &renamed).unwrap();
+        h.mgr.watched_files_changed(std::slice::from_ref(&renamed), &[], std::slice::from_ref(&path), &[]);
+        eventually(|| s.notified("workspace/didChangeWatchedFiles").len() == 2).await;
+        assert_eq!(
+            s.notified("workspace/didChangeWatchedFiles")[1]["changes"],
+            json!([
+                { "uri": uri_of(&renamed), "type": 1 },
+                { "uri": uri_of(&path), "type": 3 }
+            ])
+        );
+        h.mgr.shutdown_all().await;
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn open_document_watches_resolve_path_aliases() {
+    for registered in [false, true] {
+        let h = harness(&[("mock", incremental_caps())]);
+        let (_, path) = h.open("Mixed.mk", "old");
+        h.wait_status("mock", ServerStatus::Ready).await;
+        let s = h.launcher.state("mock");
+        if registered {
+            watch_all(&s).await;
+        }
+        let mut aliases = vec![path.clone()];
+        let case_alias = h.root.join("mixed.mk");
+        if dunce::canonicalize(&case_alias).ok() == Some(path.clone()) {
+            aliases.push(case_alias);
+        }
+        #[cfg(unix)]
+        {
+            let link = h.root.join("alias.mk");
+            std::os::unix::fs::symlink(&path, &link).unwrap();
+            aliases.push(link);
+        }
+        let closed = h.root.join("closed.mk");
+        aliases.push(closed.clone());
+        h.mgr.watched_files_changed(&[], &aliases, &[], &[]);
+        eventually(|| !s.notified("workspace/didChangeWatchedFiles").is_empty()).await;
+        assert_eq!(
+            s.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+            json!([{ "uri": uri_of(&closed), "type": 2 }])
+        );
+        h.mgr.shutdown_all().await;
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn open_document_watches_are_scoped_to_the_attached_server() {
+    let h = harness(&[("mock", incremental_caps()), ("other", incremental_caps())]);
+    h.mgr.set_servers_hook(Box::new(|_, configs| configs.iter().filter(|c| c.name == "mock").cloned().collect()));
+    let (_, path) = h.open("a.mk", "old");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    h.mgr.set_servers_hook(Box::new(|_, configs| configs.iter().filter(|c| c.name == "other").cloned().collect()));
+    h.open("b.mk", "other");
+    h.wait_status("other", ServerStatus::Ready).await;
+    let first = h.launcher.state("mock");
+    let second = h.launcher.state("other");
+    watch_all(&first).await;
+    watch_all(&second).await;
+    let closed = h.root.join("closed.mk");
+    h.mgr.watched_files_changed(&[], &[path.clone(), closed.clone()], &[], &[]);
+    eventually(|| {
+        !first.notified("workspace/didChangeWatchedFiles").is_empty()
+            && !second.notified("workspace/didChangeWatchedFiles").is_empty()
+    })
+    .await;
+    assert_eq!(
+        first.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+        json!([{ "uri": uri_of(&closed), "type": 2 }])
+    );
+    assert_eq!(
+        second.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+        json!([
+            { "uri": uri_of(&path), "type": 2 }, { "uri": uri_of(&closed), "type": 2 }
+        ])
+    );
+    h.mgr.shutdown_all().await;
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn open_document_watches_resume_on_a_restart_without_open_documents() {
+    let h = harness(&[("mock", incremental_caps())]);
+    let (doc, path) = h.open("a.mk", "old");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    let s = h.launcher.state("mock");
+    let id = h.mgr.servers()[0].id;
+    h.mgr.restart(id).await.unwrap();
+    let closed = h.root.join("closed.mk");
+    h.mgr.watched_files_changed(&[], &[path.clone(), closed.clone()], &[], &[]);
+    eventually(|| !s.notified("workspace/didChangeWatchedFiles").is_empty()).await;
+    assert_eq!(
+        s.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+        json!([{ "uri": uri_of(&closed), "type": 2 }])
+    );
+    h.mgr.did_close(doc);
+    h.mgr.restart(id).await.unwrap();
+    h.mgr.watched_files_changed(&[], std::slice::from_ref(&path), &[], &[]);
+    eventually(|| s.notified("workspace/didChangeWatchedFiles").len() == 2).await;
+    assert_eq!(
+        s.notified("workspace/didChangeWatchedFiles")[1]["changes"],
+        json!([{ "uri": uri_of(&path), "type": 2 }])
+    );
+    h.mgr.shutdown_all().await;
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn servers_without_document_sync_keep_open_document_watches() {
+    let h = harness(&[("mock", json!({ "textDocumentSync": 0 }))]);
+    let (_, path) = h.open("a.mk", "old");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    let s = h.launcher.state("mock");
+    let closed = h.root.join("closed.mk");
+    h.mgr.watched_files_changed(&[], &[path.clone(), closed.clone()], &[], &[]);
+    eventually(|| !s.notified("workspace/didChangeWatchedFiles").is_empty()).await;
+    assert_eq!(
+        s.notified("workspace/didChangeWatchedFiles")[0]["changes"],
+        json!([{ "uri": uri_of(&path), "type": 2 }, { "uri": uri_of(&closed), "type": 2 }])
+    );
+    h.mgr.shutdown_all().await;
+}
+
 /// A server that registers file watchers hears of what they match, inside excluded folders
 /// too (`uv add` into `.venv`, `go get` rewriting `go.mod`); folders outside the project
 /// that relative patterns name are reported for watching; unregistered, it falls back to
@@ -1235,6 +1427,61 @@ async fn gives_up_after_repeated_crashes_and_manual_restart_works() {
     assert_eq!(h.mgr.servers()[0].status, ServerStatus::Ready);
 }
 
+/// The whole workspace root deleted: the server can never start again
+/// (its cwd is gone), so the crash drops the entry instead of restarting.
+#[tokio::test(flavor = "multi_thread")]
+async fn a_crash_below_a_deleted_workspace_root_drops_the_server() {
+    let h = harness(&[("mock", incremental_caps())]);
+    h.open("a.mk", "x");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    let s = h.launcher.state("mock");
+
+    // A crash on a root that still exists restarts; removing it changes that.
+    s.peer().kill();
+    eventually(|| h.statuses("mock").contains(&ServerStatus::Crashed)).await;
+    eventually(|| s.launches.load(Ordering::SeqCst) == 2).await;
+    h.wait_status("mock", ServerStatus::Ready).await;
+
+    std::fs::remove_dir_all(&h.root).unwrap();
+    s.peer().kill();
+    eventually(|| h.removed("mock")).await;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(s.launches.load(Ordering::SeqCst), 2, "no restart with a dead working directory");
+}
+
+/// The root deleted while a crash backoff is still sleeping: the pending
+/// restart must drop the server rather than leave a permanently "Crashed" row.
+#[tokio::test(flavor = "multi_thread")]
+async fn root_deleted_during_crash_backoff_drops_the_server() {
+    let h = harness(&[("mock", incremental_caps())]);
+    h.open("a.mk", "x");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    let s = h.launcher.state("mock");
+
+    // Crash with the root alive: "Crashed" is published before the backoff
+    // sleep, so removing the root here lands inside that window.
+    s.peer().kill();
+    eventually(|| h.statuses("mock").contains(&ServerStatus::Crashed)).await;
+    std::fs::remove_dir_all(&h.root).unwrap();
+    eventually(|| h.removed("mock")).await;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(s.launches.load(Ordering::SeqCst), 1, "no restart with a dead working directory");
+}
+
+/// A manual restart with the root gone fails instead of spawning into a dead cwd.
+#[tokio::test(flavor = "multi_thread")]
+async fn restarting_below_a_deleted_workspace_root_fails() {
+    let h = harness(&[("mock", incremental_caps())]);
+    h.open("a.mk", "x");
+    h.wait_status("mock", ServerStatus::Ready).await;
+    let id = h.mgr.servers()[0].id;
+
+    std::fs::remove_dir_all(&h.root).unwrap();
+    let err = h.mgr.restart(id).await.unwrap_err();
+    assert_eq!(err.kind, ide_core::error::ErrorKind::Unavailable);
+    assert!(err.message.contains("workspace root"), "{err:?}");
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn missing_server_reports_once() {
     let h = harness(&[("ghost", json!({}))]);
@@ -1836,11 +2083,10 @@ async fn java_implementations_come_from_sources_first() {
             .collect::<Value>()
     };
     *s.responder.lock() = Some(Arc::new(move |_, method, params| match method {
-        // Lines 0 and 1 are declared in the sources; 2 and 3 in a dependency, which implements 2 on line 3.
+        // Line 0 is declared in the sources; line 2 in a dependency, which implements it on line 3.
         "workspace/executeCommand" => Some(match params["arguments"][1].as_u64() {
             Some(0) => json!({ "locations": at(&[1]), "complete": true }),
             Some(2) => json!({ "locations": at(&[1]), "complete": false }),
-            Some(3) => json!({ "locations": [], "complete": false }),
             _ => json!({ "locations": [], "complete": true }),
         }),
         "textDocument/implementation" => Some(at(&[3, 1])),
@@ -1871,14 +2117,7 @@ async fn java_implementations_come_from_sources_first() {
     assert_eq!(lines(&found), vec![3, 1]);
     assert_eq!(s.requested("textDocument/implementation").len(), 2);
 
-    // Declared in the sources and implemented nowhere there: no search through the dependencies.
-    let found = h.mgr.goto(doc, Pos::new(1, 6), GotoKind::Implementation).await.unwrap();
-    assert!(found.is_empty());
-    let markers = h.mgr.implementations(doc, &[Pos::new(1, 6)], Default::default()).await.unwrap();
-    assert!(markers[0].is_empty());
-    assert_eq!(s.requested("textDocument/implementation").len(), 2);
-
-    // None in the sources of a dependency's type: the standard request, with the dependencies.
+    // None in the sources: the standard request, with the dependencies.
     let partial = Mutex::new(Vec::new());
     let found = h
         .mgr
@@ -2883,6 +3122,112 @@ fn scope_harness() -> (Harness, Arc<MockState>) {
     (h, s)
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn indexed_sources_are_not_widened_but_outside_callers_are() {
+    for classified in [false, true] {
+        for outside in [false, true] {
+            let mut caps = incremental_caps();
+            caps["executeCommandProvider"]["commands"] = if classified {
+                json!(["openidea.workspace.coveredFiles", "openidea.java.usages"])
+            } else {
+                json!(["openidea.workspace.coveredFiles"])
+            };
+            let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+            let s = h.launcher.state("jdtls");
+            let caller = h.root.join("Caller.java");
+            let decoy = h.root.join("Unrelated.java");
+            let extra = h.root.join("Outside.java");
+            std::fs::write(&caller, "target();").unwrap();
+            std::fs::write(&decoy, "target").unwrap();
+            if outside {
+                std::fs::write(&extra, "target();").unwrap();
+            }
+            let covered = vec![uri_of(&caller), uri_of(&decoy)];
+            let indexed = uri_of(&caller);
+            *s.responder.lock() = Some(Arc::new(move |s, method, params| {
+                if method == "workspace/executeCommand" && params["command"] == "openidea.workspace.coveredFiles" {
+                    return Some(json!(covered));
+                }
+                let model = MockState::default();
+                *model.docs.lock() = s.docs.lock().clone();
+                model.docs.lock().insert(indexed.clone(), "target();".into());
+                let responder = open_files_only(vec![]);
+                if method == "workspace/executeCommand" && params["command"] == "openidea.java.usages" {
+                    let refs = responder(&model, "textDocument/references", params).unwrap();
+                    return Some(Value::Array(
+                        refs.as_array()
+                            .unwrap()
+                            .iter()
+                            .map(|location| json!({ "location": location, "kind": "unknown", "access": "read" }))
+                            .collect(),
+                    ));
+                }
+                responder(&model, method, params)
+            }));
+            grep_candidates(&h);
+            let (doc, _) = h.open("Target.java", "def target\n");
+            h.wait_status("jdtls", ServerStatus::Ready).await;
+            let refs = h
+                .mgr
+                .references_streaming(doc, Pos::new(0, 5), true, true, false, Default::default(), None)
+                .await
+                .unwrap();
+            assert!(refs.locations.iter().any(|l| l.path == caller));
+            assert_eq!(refs.locations.iter().any(|l| l.path == extra), outside);
+            assert_eq!(refs.incomplete, None);
+            let calls = h
+                .mgr
+                .call_hierarchy(doc, Pos::new(0, 5), HierarchyDirection::Incoming, Default::default())
+                .await
+                .unwrap();
+            assert!(calls.items.iter().any(|i| i.path == caller));
+            assert_eq!(calls.items.iter().any(|i| i.path == extra), outside);
+            assert_eq!(calls.incomplete, None);
+            let rounds = if outside { 2 } else { 1 };
+            assert_eq!(s.requested("callHierarchy/incomingCalls").len(), rounds);
+            if classified {
+                assert_eq!(
+                    s.requested("workspace/executeCommand")
+                        .iter()
+                        .filter(|p| p["command"] == "openidea.java.usages")
+                        .count(),
+                    rounds
+                );
+                assert_eq!(refs.classified.len(), refs.locations.len());
+            } else {
+                assert_eq!(s.requested("textDocument/references").len(), rounds);
+            }
+            eventually(|| s.docs.lock().len() == 1).await;
+            let opened = uris(&s.notified("textDocument/didOpen"));
+            assert!(!opened.contains(&uri_of(&caller)));
+            assert!(!opened.contains(&uri_of(&decoy)));
+            assert_eq!(opened.contains(&uri_of(&extra)), outside);
+        }
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn unavailable_scope_capability_keeps_widening_and_incomplete_signals() {
+    for response in [json!(null), json!([false]), json!([])] {
+        let mut caps = incremental_caps();
+        caps["executeCommandProvider"]["commands"] = json!(["openidea.workspace.coveredFiles"]);
+        let h = harness(&[("mock", caps)]);
+        let s = h.launcher.state("mock");
+        *s.responder.lock() = Some(open_files_only(vec![]));
+        s.respond("workspace/executeCommand", response);
+        h.mgr.set_candidates_hook(Box::new(|q, _| ide_lsp::CandidateFiles {
+            files: vec![q.root.join("b.mk")],
+            limit_hit: true,
+        }));
+        std::fs::write(h.root.join("b.mk"), "target\n").unwrap();
+        let (doc, _) = h.open("a.mk", "def target\n");
+        h.wait_status("mock", ServerStatus::Ready).await;
+        expect_all(incomplete_reports(&h, doc).await, Some(ReferencesIncomplete::TooManyFiles));
+        assert_eq!(s.requested("textDocument/references").len(), 2);
+        assert_eq!(s.requested("callHierarchy/incomingCalls").len(), 2);
+    }
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn references_open_unopened_files_that_mention_the_name() {
     let (h, s) = scope_harness();
@@ -2930,6 +3275,165 @@ async fn references_open_unopened_files_that_mention_the_name() {
     assert_eq!(seen.lock().len(), 2);
 }
 
+/// A Go project: the module at the root, `tools` replacing it with `../` and `other` requiring a
+/// published copy. The mock answers a definition in `tools` like gopls in that module's view.
+fn go_modules_harness() -> (Harness, Arc<MockState>, PathBuf, PathBuf, PathBuf, PathBuf) {
+    let h = harness_for("go", "go", &[("gopls", incremental_caps())], &[]);
+    let s = h.launcher.state("gopls");
+    let write = |rel: &str, text: &str| {
+        let path = h.root.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(&path, text).unwrap();
+        path
+    };
+    write("go.mod", "module example.com/app\n");
+    write("tools/go.mod", "module example.com/tools\n\nreplace example.com/app => ../\n");
+    write("other/go.mod", "module example.com/other\n\nrequire example.com/app v1.0.0\n");
+    let same = write("same.go", "package app\nvar x = New()\n");
+    // Line 1 uses the declaration; line 2 is a local `New` of the tools module.
+    let tools = write("tools/gen.go", "package tools\nvar a = app.New()\nfunc New() {}\n");
+    write("other/o.go", "package other\nvar b = app.New()\n");
+    // Built for plan9 only: outside gopls' default view of the root module.
+    let plan9 = write("boot_plan9.go", "package app\nfunc boot() { New() }\n");
+    let decl = h.root.join("a.go");
+    let candidates = vec![same.clone(), tools.clone(), h.root.join("other/o.go"), plan9.clone()];
+    h.mgr.set_candidates_hook(Box::new(move |_, _| ide_lsp::CandidateFiles {
+        files: candidates.clone(),
+        limit_hit: false,
+    }));
+    let at = |line: u32, col: u32| json!({ "start": { "line": line, "character": col }, "end": { "line": line, "character": col + 3 } });
+    let (decl_uri, same_uri, tools_uri, plan9_uri) = (uri_of(&decl), uri_of(&same), uri_of(&tools), uri_of(&plan9));
+    let span = |line: u32, from: u32, to: u32| json!({ "start": { "line": line, "character": from }, "end": { "line": line, "character": to } });
+    *s.responder.lock() = Some(Arc::new(move |_, method, params| {
+        let uri = params["textDocument"]["uri"].as_str().unwrap_or_default().to_owned();
+        let line = params["position"]["line"].as_u64().unwrap_or(0);
+        match method {
+            // The view of the root module: the declaration and its usage in same.go.
+            "textDocument/references" => Some(json!([
+                { "uri": decl_uri, "range": at(0, 5) },
+                { "uri": same_uri, "range": at(1, 8) },
+            ])),
+            "textDocument/rename" => Some(json!({ "changes": {
+                decl_uri.clone(): [{ "range": at(0, 5), "newText": "Make" }],
+                same_uri.clone(): [{ "range": at(1, 8), "newText": "Make" }],
+            } })),
+            "textDocument/definition" if uri == decl_uri => Some(json!({ "uri": decl_uri, "range": at(0, 5) })),
+            "textDocument/definition" if uri == tools_uri && line == 1 => {
+                Some(json!({ "uri": decl_uri, "range": at(0, 5) }))
+            }
+            "textDocument/definition" if uri == tools_uri => Some(json!({ "uri": tools_uri, "range": at(2, 5) })),
+            "textDocument/definition" if uri == plan9_uri => Some(json!({ "uri": decl_uri, "range": at(0, 5) })),
+            "textDocument/documentSymbol" if uri == tools_uri => Some(json!([
+                { "name": "a", "kind": 13, "range": span(1, 0, 17), "selectionRange": span(1, 4, 5) },
+                { "name": "New", "kind": 12, "range": span(2, 0, 13), "selectionRange": span(2, 5, 8) },
+            ])),
+            "textDocument/documentSymbol" if uri == plan9_uri => Some(json!([
+                { "name": "boot", "kind": 12, "range": span(1, 0, 20), "selectionRange": span(1, 5, 9) },
+            ])),
+            "textDocument/prepareCallHierarchy" => Some(
+                json!([{ "name": "New", "kind": 12, "uri": decl_uri, "range": span(0, 0, 13), "selectionRange": at(0, 5) }]),
+            ),
+            "callHierarchy/incomingCalls" => Some(json!([{
+                "from": { "name": "x", "kind": 13, "uri": same_uri, "range": span(1, 0, 13), "selectionRange": span(1, 4, 5) },
+                "fromRanges": [at(1, 8)],
+            }])),
+            _ => None,
+        }
+    }));
+    (h, s, decl, same, tools, plan9)
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn go_searches_resolve_other_modules_that_replace_the_declarations_module() {
+    let (h, s, decl, same, tools, plan9) = go_modules_harness();
+    let (doc, _) = h.open("a.go", "func New() {}\n");
+    h.wait_status("gopls", ServerStatus::Ready).await;
+    eventually(|| s.docs.lock().len() == 1).await;
+
+    let partials = Arc::new(Mutex::new(Vec::new()));
+    let seen = partials.clone();
+    let partial = move |r: ide_lsp::types::References| seen.lock().push(r.locations.len());
+    let refs = h
+        .mgr
+        .references_streaming(doc, Pos::new(0, 5), true, true, true, Default::default(), Some(&partial))
+        .await
+        .unwrap();
+    let mut found: Vec<(PathBuf, u32)> =
+        refs.locations.iter().map(|l| (l.path.to_path_buf(), l.range.start.line)).collect();
+    found.sort();
+    let mut want = vec![(decl.clone(), 0), (same.clone(), 1), (tools.clone(), 1), (plan9.clone(), 1)];
+    want.sort();
+    assert_eq!(found, want);
+    // Those in gopls' reach arrive first.
+    assert_eq!(*partials.lock(), [2]);
+    // Only the module replacing the declaration's module was opened, never the root module's file.
+    let opened = uris(&s.notified("textDocument/didOpen"));
+    assert!(opened.contains(&uri_of(&tools)));
+    assert!(opened.contains(&uri_of(&plan9)));
+    assert!(!opened.contains(&uri_of(&same)));
+    assert!(!opened.iter().any(|u| u.ends_with("other/o.go")));
+    assert_eq!(s.requested("textDocument/references").len(), 1);
+
+    let renamed = h.mgr.rename(doc, Pos::new(0, 5), "Make".into(), Default::default()).await.unwrap();
+    let mut edited: Vec<(PathBuf, Vec<u32>)> = renamed
+        .edit
+        .files
+        .iter()
+        .filter_map(|f| match f {
+            ide_core::FileEdit::Edit { path, edits, .. } => {
+                Some((path.to_path_buf(), edits.iter().map(|e| e.range.start.line).collect()))
+            }
+            _ => None,
+        })
+        .collect();
+    edited.sort();
+    let mut want = vec![(decl, vec![0]), (same, vec![1]), (tools, vec![1]), (plan9, vec![1])];
+    want.sort();
+    assert_eq!(edited, want);
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn go_incoming_calls_include_callers_beyond_the_search() {
+    let (h, s, _, same, tools, plan9) = go_modules_harness();
+    let (doc, _) = h.open("a.go", "func New() {}\n");
+    h.wait_status("gopls", ServerStatus::Ready).await;
+    eventually(|| s.docs.lock().len() == 1).await;
+
+    let calls =
+        h.mgr.call_hierarchy(doc, Pos::new(0, 5), HierarchyDirection::Incoming, Default::default()).await.unwrap();
+    let mut callers: Vec<(PathBuf, String, Vec<u32>)> = calls
+        .items
+        .iter()
+        .map(|i| (i.path.to_path_buf(), i.name.clone(), i.from_ranges.iter().map(|r| r.start.line).collect()))
+        .collect();
+    callers.sort();
+    let mut want = vec![
+        (same, "x".to_owned(), vec![1]),
+        (tools, "a".to_owned(), vec![1]),
+        (plan9.clone(), "boot".to_owned(), vec![1]),
+    ];
+    want.sort();
+    assert_eq!(callers, want);
+    let boot = calls.items.iter().find(|i| i.name == "boot").unwrap();
+    assert_eq!((boot.selection_range.start, boot.from_ranges[0].start), (Pos::new(1, 5), Pos::new(1, 14)));
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn go_searches_open_nothing_when_no_other_module_uses_the_declaration() {
+    let (h, s, _, same, _, plan9) = go_modules_harness();
+    std::fs::write(h.root.join("tools/go.mod"), "module example.com/tools\n").unwrap();
+    std::fs::remove_file(&plan9).unwrap();
+    let (doc, _) = h.open("a.go", "func New() {}\n");
+    h.wait_status("gopls", ServerStatus::Ready).await;
+    eventually(|| s.docs.lock().len() == 1).await;
+
+    let refs = h.mgr.references(doc, Pos::new(0, 5), true, true, Default::default()).await.unwrap();
+    assert_eq!(refs.locations.len(), 2);
+    assert_eq!(uris(&s.notified("textDocument/didOpen")).len(), 1, "only a.go");
+    assert!(s.requested("textDocument/definition").len() <= 1);
+    assert!(!uris(&s.notified("textDocument/didOpen")).contains(&uri_of(&same)));
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn references_never_reopen_or_close_the_users_files() {
     let h = harness(&[("mock", incremental_caps())]);
@@ -3108,17 +3612,9 @@ async fn java_usages_in_the_sources_arrive_before_the_dependencies() {
     let scopes: Vec<_> =
         s.requested("workspace/executeCommand")[3..].iter().map(|p| p["arguments"].get(4).cloned()).collect();
     assert_eq!(scopes, [Some(json!("sources")), Some(json!("sources"))]);
-    // Scoped probes with the libraries search everything at once.
+    // Scoped probes (code lenses) search everything at once.
     let scoped = h.mgr.references(doc, Pos::new(0, 5), true, false, Default::default()).await.unwrap();
     assert_eq!(scoped.locations.len(), 2);
-    // Usage counts and Safe Delete (no libraries): the sources alone, not widened.
-    let scoped =
-        h.mgr.references_streaming(doc, Pos::new(0, 5), true, false, false, Default::default(), None).await.unwrap();
-    assert_eq!(scoped.locations.len(), 1);
-    assert!(scoped.locations.iter().all(|l| l.uri.is_none()));
-    let scopes: Vec<_> =
-        s.requested("workspace/executeCommand")[5..].iter().map(|p| p["arguments"].get(4).cloned()).collect();
-    assert_eq!(scopes, [None, Some(json!("sources"))]);
 }
 
 #[tokio::test(flavor = "multi_thread")]
@@ -3930,6 +4426,52 @@ async fn configuration_usages_merge_native_and_unsaved_profiles_without_sibling_
     assert_eq!(refs.incomplete, None);
 }
 
+/// The configuration index is rebuilt after Java changes, which can take seconds: Show Usages
+/// shows the Java usages meanwhile, then adds the configuration ones.
+#[tokio::test(flavor = "multi_thread")]
+async fn java_usages_arrive_before_configuration_usages() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.usages", "openidea.java.configuration"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    let s = h.launcher.state("jdtls");
+    let yaml = h.root.join("application.yml");
+    std::fs::write(&yaml, "app:\n  target: 1\n").unwrap();
+    let property = json!({"uri": uri_of(&yaml), "range": {
+        "start": {"line": 1, "character": 2}, "end": {"line": 1, "character": 8}}});
+    let gate = Arc::new(Gate::default());
+    let held = gate.clone();
+    *s.responder.lock() = Some(Arc::new(move |s, method, params| {
+        (method == "workspace/executeCommand").then(|| {
+            if params["command"] == "openidea.java.configuration" {
+                held.hold();
+                return json!({"locations": [property.clone()], "keys": [{"name": "app.target", "relaxed": true}], "roots": []});
+            }
+            let docs = s.docs.lock();
+            let rows = docs.iter().flat_map(|(uri, text)| occurrences(uri, text));
+            Value::Array(rows.map(|location| json!({"location": location, "kind": "unknown"})).collect())
+        })
+    }));
+    let (doc, a) = h.open("a.java", "int target;");
+    h.wait_status("jdtls", ServerStatus::Ready).await;
+    eventually(|| s.docs.lock().len() == 1).await;
+    let partials = Mutex::new(Vec::<References>::new());
+    let push = |r| partials.lock().push(r);
+    let search = h.mgr.references_streaming(doc, Pos::new(0, 5), true, true, false, Default::default(), Some(&push));
+    let release = async {
+        eventually(|| !partials.lock().is_empty()).await;
+        assert!(gate.entered(), "shown before the configuration lookup started");
+        gate.open();
+    };
+    let (refs, ()) = tokio::join!(search, release);
+    let refs = refs.unwrap();
+    let partials = partials.into_inner();
+    assert_eq!(partials.len(), 1);
+    let paths = |r: &References| r.locations.iter().map(|l| l.path.to_path_buf()).collect::<Vec<_>>();
+    assert_eq!(paths(&partials[0]), std::slice::from_ref(&a));
+    assert_eq!(partials[0].classified.len(), 1);
+    assert_eq!(paths(&refs), [a, yaml]);
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn configuration_extension_failure_preserves_native_java_navigation() {
     let mut caps = incremental_caps();
@@ -3951,6 +4493,198 @@ async fn configuration_extension_failure_preserves_native_java_navigation() {
     assert_eq!(s.requested("textDocument/definition").len(), 1);
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_placeholder_definition_lands_in_spring_xml_and_properties() {
+    let h = harness_for("java", "java", &[("jdtls", incremental_caps())], &[]);
+    let s = h.launcher.state("jdtls");
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    let resources = h.root.join("src/main/resources");
+    std::fs::create_dir_all(&resources).unwrap();
+    std::fs::write(
+        resources.join("context.xml"),
+        r#"<beans><util:properties id="db"><prop key="db.user">sa</prop></util:properties></beans>"#,
+    )
+    .unwrap();
+    std::fs::write(h.root.join("db.properties"), "db.user=root\n").unwrap();
+    let config = h.root.join("application.yml");
+    let doc = DocId::next();
+    h.mgr.did_open(doc, &config, &LanguageId::new("yaml"), 1, "spring:\n  datasource:\n    username: ${db.user}\n");
+    let locations = h.mgr.goto(doc, Pos::new(2, 16), GotoKind::Definition).await.unwrap();
+    // The Java extension is not needed: the declarations come from the XML
+    // wiring and the properties file, and the open YAML never matches itself.
+    assert_eq!(locations.len(), 2, "{locations:?}");
+    assert!(locations.iter().any(|l| l.path.to_path_buf() == resources.join("context.xml")));
+    assert!(locations.iter().any(|l| l.path.to_path_buf() == h.root.join("db.properties")));
+    assert!(s.requested("workspace/executeCommand").is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_placeholders_use_java_module_roots_and_utf16_columns() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.configuration"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    std::fs::write(
+        h.root.join("pom.xml"),
+        "<project><packaging>pom</packaging><modules><module>child</module></modules></project>",
+    )
+    .unwrap();
+    let child = h.root.join("child");
+    let resources = child.join("src/main/resources");
+    std::fs::create_dir_all(&resources).unwrap();
+    std::fs::write(child.join("pom.xml"), "<project/>").unwrap();
+    let definition = resources.join("application.properties");
+    std::fs::write(&definition, "db.user=sa\n").unwrap();
+    let sibling = h.root.join("sibling");
+    std::fs::create_dir(&sibling).unwrap();
+    std::fs::write(sibling.join("pom.xml"), "<project/>").unwrap();
+    std::fs::write(sibling.join("application.properties"), "db.user=wrong\n").unwrap();
+    h.launcher.state("jdtls").respond("workspace/executeCommand", json!({
+        "locations": [], "keys": [], "roots": [uri_of(&h.root), uri_of(&child), uri_of(&child.join("src/main/java"))]
+    }));
+    for (file, language, text) in [
+        ("references.properties", "properties", "message=你好😀 ${db.user}"),
+        ("references.yml", "yaml", "message: 你好😀 ${db.user}"),
+        ("context.xml", "xml", "<bean value=\"你好😀 ${db.user}\"/>"),
+    ] {
+        let doc = DocId::next();
+        h.mgr.did_open(doc, &h.root.join(file), &LanguageId::new(language), 1, text);
+        let col = text[..text.find("db.user").unwrap()].encode_utf16().count() as u32;
+        let locations = h.mgr.goto(doc, Pos::new(0, col + 2), GotoKind::Definition).await.unwrap();
+        assert_eq!(locations.len(), 1, "{file}: {locations:?}");
+        assert_eq!(locations[0].path.to_path_buf(), definition);
+        assert_eq!(locations[0].range.start, Pos::new(0, 0));
+        assert_eq!(locations[0].range.end, Pos::new(0, 7));
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_file_list_refreshes_on_watched_changes_and_renames() {
+    let h = harness_for("java", "java", &[("jdtls", incremental_caps())], &[]);
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    let child = h.root.join("child");
+    std::fs::create_dir(&child).unwrap();
+    std::fs::write(child.join("pom.xml"), "<project/>").unwrap();
+    let file = child.join("application.properties");
+    std::fs::write(&file, "db.user=sa\n").unwrap();
+    let doc = DocId::next();
+    h.mgr.did_open(doc, &child.join("reference.yml"), &LanguageId::new("yaml"), 1, "message: ${db.user}");
+    assert_eq!(h.mgr.goto(doc, Pos::new(0, 13), GotoKind::Definition).await.unwrap().len(), 1);
+    let profile = child.join("application-dev.properties");
+    std::fs::write(&profile, "db.user=dev\n").unwrap();
+    // No notification yet: the existing file list is reused.
+    assert_eq!(h.mgr.goto(doc, Pos::new(0, 13), GotoKind::Definition).await.unwrap().len(), 1);
+    h.mgr.watched_files_changed(std::slice::from_ref(&profile), &[], &[], &[]);
+    assert_eq!(h.mgr.goto(doc, Pos::new(0, 13), GotoKind::Definition).await.unwrap().len(), 2);
+    std::fs::write(&profile, "db.user=development\n").unwrap();
+    h.mgr.watched_files_changed(&[], std::slice::from_ref(&profile), &[], &[]);
+    assert_eq!(h.mgr.goto(doc, Pos::new(0, 13), GotoKind::Definition).await.unwrap().len(), 2);
+    let renamed = child.join("application-test.properties");
+    std::fs::rename(&profile, &renamed).unwrap();
+    h.mgr.did_rename_files(&[(profile, renamed.clone())]);
+    let locations = h.mgr.goto(doc, Pos::new(0, 13), GotoKind::Definition).await.unwrap();
+    assert_eq!(locations.len(), 2);
+    assert!(locations.iter().any(|l| l.path.to_path_buf() == renamed));
+    std::fs::remove_file(&renamed).unwrap();
+    h.mgr.watched_files_changed(&[], &[], &[renamed], &[]);
+    assert_eq!(h.mgr.goto(doc, Pos::new(0, 13), GotoKind::Definition).await.unwrap().len(), 1);
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_placeholder_definition_merges_java_members_with_xml_declarations() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.configuration"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    std::fs::write(h.root.join("context.xml"), r#"<beans><prop key="db.user">sa</prop></beans>"#).unwrap();
+    let s = h.launcher.state("jdtls");
+    let target = uri_of(&h.root.join("Db.java"));
+    s.respond(
+        "workspace/executeCommand",
+        json!({
+            "locations": [{"uri": target, "range": {"start": {"line": 1, "character": 4}, "end": {"line": 1, "character": 8}}}],
+            "keys": [{"name": "db.user", "relaxed": true}], "roots": []
+        }),
+    );
+    let config = h.root.join("application.yml");
+    let doc = DocId::next();
+    h.mgr.did_open(doc, &config, &LanguageId::new("yaml"), 1, "spring:\n  datasource:\n    username: ${db.user}\n");
+    let locations = h.mgr.goto(doc, Pos::new(2, 16), GotoKind::Definition).await.unwrap();
+    // A bound Java member and the XML declaration are both candidates.
+    assert_eq!(locations.len(), 2, "{locations:?}");
+    assert!(locations.iter().any(|l| l.range.start == Pos::new(1, 4)));
+    assert!(locations.iter().any(|l| l.path.to_path_buf() == h.root.join("context.xml")));
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_placeholder_definition_survives_a_failing_java_extension() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.configuration"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    std::fs::write(h.root.join("context.xml"), r#"<beans><prop key="db.user">sa</prop></beans>"#).unwrap();
+    let s = h.launcher.state("jdtls");
+    s.errors.lock().insert("workspace/executeCommand".into(), (-32603, "old server".into()));
+    let config = h.root.join("application.yml");
+    let doc = DocId::next();
+    h.mgr.did_open(doc, &config, &LanguageId::new("yaml"), 1, "spring:\n  datasource:\n    username: ${db.user}\n");
+    let locations = h.mgr.goto(doc, Pos::new(2, 16), GotoKind::Definition).await.unwrap();
+    // The XML declaration still answers when the Java extension fails.
+    assert_eq!(locations.len(), 1, "{locations:?}");
+    assert!(locations.iter().any(|l| l.path.to_path_buf() == h.root.join("context.xml")));
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_key_definition_stays_java_only() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.configuration"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    std::fs::write(h.root.join("context.xml"), r#"<beans><prop key="spring.datasource.username">sa</prop></beans>"#)
+        .unwrap();
+    let s = h.launcher.state("jdtls");
+    let target = uri_of(&h.root.join("Settings.java"));
+    s.respond(
+        "workspace/executeCommand",
+        json!({
+            "locations": [{"uri": target, "range": {"start": {"line": 2, "character": 4}, "end": {"line": 2, "character": 11}}}],
+            "keys": [{"name": "spring.datasource.username", "relaxed": true}], "roots": []
+        }),
+    );
+    let config = h.root.join("application.yml");
+    let doc = DocId::next();
+    h.mgr.did_open(doc, &config, &LanguageId::new("yaml"), 1, "spring:\n  datasource:\n    username: sa\n");
+    let locations = h.mgr.goto(doc, Pos::new(2, 6), GotoKind::Definition).await.unwrap();
+    // A key keeps the Java-only definition path; the XML declaration is not a candidate.
+    assert_eq!(locations.len(), 1, "{locations:?}");
+    assert_eq!(locations[0].range.start, Pos::new(2, 4));
+    assert_eq!(s.requested("workspace/executeCommand")[0]["arguments"][1], "spring.datasource.username");
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn configuration_definition_on_an_xml_property_asks_java() {
+    let mut caps = incremental_caps();
+    caps["executeCommandProvider"] = json!({"commands": ["openidea.java.configuration"]});
+    let h = harness_for("java", "java", &[("jdtls", caps)], &[]);
+    std::fs::write(h.root.join("pom.xml"), "<project/>").unwrap();
+    let s = h.launcher.state("jdtls");
+    let target = uri_of(&h.root.join("Db.java"));
+    s.respond(
+        "workspace/executeCommand",
+        json!({
+            "locations": [{"uri": target, "range": {"start": {"line": 1, "character": 4}, "end": {"line": 1, "character": 8}}}],
+            "keys": [{"name": "db.user", "relaxed": true}], "roots": []
+        }),
+    );
+    let xml = h.root.join("context.xml");
+    let doc = DocId::next();
+    h.mgr.did_open(doc, &xml, &LanguageId::new("xml"), 1, "<beans><prop key=\"db.user\">sa</prop></beans>\n");
+    let locations = h.mgr.goto(doc, Pos::new(0, 19), GotoKind::Definition).await.unwrap();
+    // A Spring XML declaration is a configuration site: it navigates to the
+    // binding member through the Java index.
+    assert_eq!(locations.len(), 1, "{locations:?}");
+    assert_eq!(s.requested("workspace/executeCommand")[0]["arguments"][1], "db.user");
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn configuration_prewarm_starts_java_without_an_open_editor_and_waits_for_import() {
     let mut caps = incremental_caps();

crates/ide-lsp/tests/real_servers.rs

@@ -112,6 +112,146 @@ async fn kmp_lsp_java_end_to_end() {
     tokio::time::timeout(Duration::from_secs(10), mgr.shutdown_all()).await.unwrap();
 }
 
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "requires jdtls on PATH and a compatible JDK"]
+async fn java_searches_skip_indexed_sources_but_keep_exclusions_outside_scope() {
+    use ide_lsp::types::HierarchyDirection;
+    use serde_json::json;
+
+    let dir = tempfile::tempdir().unwrap();
+    let root = dir.path().join("project");
+    std::fs::create_dir(&root).unwrap();
+    let root = dunce::canonicalize(root).unwrap();
+    std::fs::create_dir_all(root.join("src/demo/excluded")).unwrap();
+    std::fs::write(root.join(".project"), "<projectDescription><name>search-scope</name><buildSpec><buildCommand><name>org.eclipse.jdt.core.javabuilder</name></buildCommand></buildSpec><natures><nature>org.eclipse.jdt.core.javanature</nature></natures></projectDescription>").unwrap();
+    std::fs::write(root.join(".classpath"), "<classpath><classpathentry kind=\"src\" path=\"src\" excluding=\"demo/excluded/**\"/><classpathentry kind=\"con\" path=\"org.eclipse.jdt.launching.JRE_CONTAINER\"/><classpathentry kind=\"output\" path=\"bin\"/></classpath>").unwrap();
+    let source = "package demo; public class Target { public static void target() {} }";
+    let path = root.join("src/demo/Target.java");
+    let caller = root.join("src/demo/Caller.java");
+    let decoy = root.join("src/demo/Decoy.java");
+    let excluded = root.join("src/demo/excluded/Excluded.java");
+    let outside = root.join("Outside.java");
+    std::fs::write(&path, source).unwrap();
+    std::fs::write(&caller, "package demo; class Caller { void call() { Target.target(); } }").unwrap();
+    // A source file mentioning the name without a usage, too large for transient opening.
+    std::fs::write(&decoy, format!("package demo; class Decoy {{ void target() {{}} }}\n/*{}*/", " ".repeat(1 << 20)))
+        .unwrap();
+    std::fs::write(&excluded, "package demo.excluded; class Excluded {}").unwrap();
+    std::fs::write(&outside, "class Outside {}").unwrap();
+    let mut java = LanguageRegistry::load(None).unwrap().get(&LanguageId::new("java")).unwrap();
+    java.language_servers.retain(|s| s.name == "jdtls");
+    let server = &mut java.language_servers[0];
+    if let Ok(bin) = std::env::var("OPENIDEA_TEST_JDTLS") {
+        server.command = bin;
+    }
+    server.args.extend(["-data".into(), dir.path().join("metadata").to_string_lossy().into_owned()]);
+    let bundle = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../java/java-usages/openidea-java-usages.jar");
+    server
+        .initialization_options
+        .as_mut()
+        .unwrap()
+        .as_table_mut()
+        .unwrap()
+        .insert("bundles".into(), toml::Value::Array(vec![toml::Value::String(bundle.to_string_lossy().into_owned())]));
+    let (mgr, _) = manager(&root, LanguageRegistry::from_configs(vec![java]));
+    let doc = DocId::next();
+    mgr.did_open(doc, &path, &LanguageId::new("java"), 1, source);
+    mgr.java_build(&path, &Default::default()).await.unwrap();
+    let uri = ide_lsp::path_to_uri_string;
+    let covered = retry("imported source scope", Duration::from_secs(120), || async {
+        mgr.jdtls_command(
+            &path,
+            "openidea.workspace.coveredFiles",
+            vec![json!([uri(&caller), uri(&decoy), uri(&excluded), uri(&outside),])],
+        )
+        .await
+        .ok()
+        .filter(|v| v.as_array().is_some_and(|a| !a.is_empty()))
+    })
+    .await;
+    assert_eq!(covered, json!([uri(&caller), uri(&decoy)]));
+    mgr.set_candidates_hook(Box::new(move |_, _| ide_lsp::CandidateFiles {
+        files: vec![caller.clone(), decoy.clone()],
+        limit_hit: false,
+    }));
+    let at = Pos::new(0, source.find("target()").unwrap() as u32);
+    let refs = mgr.references_streaming(doc, at, false, true, false, Default::default(), None).await.unwrap();
+    assert_eq!(refs.locations.len(), 1);
+    assert!(refs.locations[0].path.ends_with("Caller.java"));
+    assert_eq!(refs.incomplete, None, "the indexed decoy must not be transiently opened");
+    let calls = mgr.call_hierarchy(doc, at, HierarchyDirection::Incoming, Default::default()).await.unwrap();
+    assert_eq!(calls.items.len(), 1);
+    assert!(calls.items[0].path.ends_with("Caller.java"));
+    assert_eq!(calls.incomplete, None);
+    mgr.shutdown_all().await;
+}
+
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "requires jdtls on PATH and a compatible JDK"]
+async fn lombok_generated_members_appear_in_document_symbols() {
+    let dir = tempfile::tempdir().unwrap();
+    let root = dunce::canonicalize(dir.path()).unwrap();
+    let source = include_str!("fixtures/LombokSymbols.java");
+    let path = root.join("src/demo/LombokSymbols.java");
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    std::fs::write(&path, source).unwrap();
+    let agent = dunce::canonicalize(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("../../java/lombok/lombok-1.18.48-openidea.3.jar"),
+    )
+    .unwrap();
+    std::fs::write(
+        root.join(".project"),
+        "<projectDescription><name>lombok-symbols</name><buildSpec><buildCommand>\
+         <name>org.eclipse.jdt.core.javabuilder</name></buildCommand></buildSpec><natures>\
+         <nature>org.eclipse.jdt.core.javanature</nature></natures></projectDescription>",
+    )
+    .unwrap();
+    let library = agent.to_string_lossy().replace('&', "&amp;").replace('"', "&quot;").replace('<', "&lt;");
+    std::fs::write(
+        root.join(".classpath"),
+        format!(
+            "<classpath><classpathentry kind=\"src\" path=\"src\"/>\
+             <classpathentry kind=\"con\" path=\"org.eclipse.jdt.launching.JRE_CONTAINER\"/>\
+             <classpathentry kind=\"lib\" path=\"{library}\"/>\
+             <classpathentry kind=\"output\" path=\"bin\"/></classpath>"
+        ),
+    )
+    .unwrap();
+    let mut java = LanguageRegistry::load(None).unwrap().get(&LanguageId::new("java")).unwrap();
+    java.language_servers.retain(|s| s.name == "jdtls");
+    let server = &mut java.language_servers[0];
+    if let Ok(bin) = std::env::var("OPENIDEA_TEST_JDTLS") {
+        server.command = bin;
+    }
+    server.args.extend([
+        "-data".into(),
+        root.join("workspace").to_string_lossy().into_owned(),
+        format!("--jvm-arg=-javaagent:{}", agent.display()),
+    ]);
+    let (mgr, _) = manager(&root, LanguageRegistry::from_configs(vec![java]));
+    let doc = DocId::next();
+    mgr.did_open(doc, &path, &LanguageId::new("java"), 1, source);
+    let expected: &[(&str, &[&str])] = &[
+        ("User", &["getName()", "setName(String)", "getAge()", "setAge(int)", "User(String, int)", "builder()"]),
+        ("UserBuilder", &["name(String)", "age(int)", "build()"]),
+        ("Profile", &["Profile(String)", "getId()", "getName()", "setName(String)"]),
+        ("Logged", &["log", "write()"]),
+        ("PlainUser", &["PlainUser(String)", "getName()", "setName(String)"]),
+    ];
+    fn has_members(items: &[ide_core::OutlineItem], owner: &str, names: &[&str]) -> bool {
+        items.iter().any(|item| {
+            (item.name == owner && names.iter().all(|n| item.children.iter().any(|c| c.name == *n)))
+                || has_members(&item.children, owner, names)
+        })
+    }
+    retry("Lombok document symbols", Duration::from_secs(120), || async {
+        let items = mgr.document_symbols(doc).await.ok().flatten()?;
+        expected.iter().all(|(owner, names)| has_members(&items, owner, names)).then_some(())
+    })
+    .await;
+    tokio::time::timeout(Duration::from_secs(10), mgr.shutdown_all()).await.unwrap();
+}
+
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "requires jdtls on PATH and a compatible JDK"]
 async fn intellij_java_formatter_preserves_manual_breaks_and_wraps_long_lines() {

crates/ide-plugin/src/actor.rs

@@ -13,6 +13,7 @@
 //! idle reclaim ends it.
 
 use crate::runtime::{CallCancel, CallError, Runtime};
+use std::panic::{AssertUnwindSafe, catch_unwind};
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::{Arc, Mutex, mpsc};
 use std::thread::JoinHandle;
@@ -20,6 +21,17 @@ use std::time::{Duration, Instant};
 
 type Job = Box<dyn FnOnce(&mut Option<Runtime>) + Send>;
 
+fn catch_call<R>(f: impl FnOnce() -> Result<R, CallError>) -> Result<R, CallError> {
+    catch_unwind(AssertUnwindSafe(f)).unwrap_or_else(|panic| {
+        let message = panic
+            .downcast_ref::<String>()
+            .map(String::as_str)
+            .or_else(|| panic.downcast_ref::<&str>().copied())
+            .unwrap_or("unknown panic");
+        Err(CallError::Trap(format!("plugin actor panicked: {message}")))
+    })
+}
+
 /// Why an [`Actor::call`] produced no result.
 #[derive(Debug)]
 pub enum ActorError {
@@ -85,15 +97,24 @@ impl Actor {
         let cancel = runtime.cancel_handle();
         let alive = Arc::new(AtomicBool::new(true));
         let busy = Arc::new(AtomicBool::new(false));
+        let crash = Arc::new(Mutex::new(None));
         let last_used = Arc::new(AtomicU64::new(0));
         let epoch = Instant::now();
         let thread = {
-            let (alive, busy, last_used) = (alive.clone(), busy.clone(), last_used.clone());
+            let (alive, busy, last_used, crash) = (alive.clone(), busy.clone(), last_used.clone(), crash.clone());
             std::thread::Builder::new().name(format!("plugin:{name}")).spawn(move || {
                 let mut slot = Some(runtime);
                 while let Ok(job) = rx.recv() {
                     busy.store(true, Ordering::Release);
-                    job(&mut slot);
+                    // A completion callback may panic too; never leave a dead thread marked alive.
+                    if let Err(CallError::Trap(error)) = catch_call(|| {
+                        job(&mut slot);
+                        Ok(())
+                    }) {
+                        *crash.lock().unwrap_or_else(|e| e.into_inner()) = Some(error);
+                        alive.store(false, Ordering::Release);
+                        slot = None;
+                    }
                     last_used.store(epoch.elapsed().as_millis() as u64, Ordering::Release);
                     busy.store(false, Ordering::Release);
                     if slot.is_none() {
@@ -113,7 +134,7 @@ impl Actor {
             thread: Mutex::new(Some(thread)),
             cancel,
             alive,
-            crash: Arc::default(),
+            crash,
             busy,
             last_used,
             epoch,
@@ -148,7 +169,7 @@ impl Actor {
                 return;
             }
             let Some(rt) = slot.as_mut() else { return };
-            let outcome = f(rt);
+            let outcome = catch_call(|| f(rt));
             if let Err(CallError::Trap(e)) = &outcome {
                 *crash.lock().unwrap_or_else(|e| e.into_inner()) = Some(e.clone());
                 // Before the reply: the caller sees the actor dead.
@@ -174,21 +195,59 @@ impl Actor {
         cancel: &ide_core::CancellationToken,
         grace: Duration,
         f: impl FnOnce(&mut Runtime) -> Result<R, CallError> + Send + 'static,
+    ) -> Result<R, ActorError> {
+        self.call_cancellable_before(cancel, grace, None, f)
+    }
+
+    /// A cancellable editor call: queued work expires after `soft`, and a
+    /// successful answer produced later is dropped. Running work still has
+    /// its runtime hard deadline and can be cancelled by further typing.
+    pub fn call_edit_cancellable<R: Send + 'static>(
+        &self,
+        cancel: &ide_core::CancellationToken,
+        grace: Duration,
+        soft: Duration,
+        f: impl FnOnce(&mut Runtime) -> Result<R, CallError> + Send + 'static,
+    ) -> Result<R, ActorError> {
+        self.call_cancellable_before(cancel, grace, Some(Instant::now() + soft), f)
+    }
+
+    fn call_cancellable_before<R: Send + 'static>(
+        &self,
+        cancel: &ide_core::CancellationToken,
+        grace: Duration,
+        deadline: Option<Instant>,
+        f: impl FnOnce(&mut Runtime) -> Result<R, CallError> + Send + 'static,
     ) -> Result<R, ActorError> {
         let (reply, result) = mpsc::sync_channel(1);
         let (crash, alive) = (self.crash.clone(), self.alive.clone());
         let skip = cancel.clone();
+        let running = Arc::new(Mutex::new(false));
+        let in_job = running.clone();
         let job: Job = Box::new(move |slot| {
-            if skip.is_cancelled() {
-                return;
-            }
             let Some(rt) = slot.as_mut() else { return };
-            let outcome = f(rt);
+            {
+                let mut running = in_job.lock().unwrap_or_else(|e| e.into_inner());
+                if skip.is_cancelled() {
+                    return;
+                }
+                if deadline.is_some_and(|t| Instant::now() >= t) {
+                    let _ = reply.send(Err(ActorError::SoftTimeout));
+                    return;
+                }
+                *running = true;
+            }
+            let outcome = catch_call(|| f(rt));
+            *in_job.lock().unwrap_or_else(|e| e.into_inner()) = false;
             if let Err(CallError::Trap(e)) = &outcome {
                 *crash.lock().unwrap_or_else(|e| e.into_inner()) = Some(e.clone());
                 alive.store(false, Ordering::Release);
                 *slot = None;
             }
+            let outcome = match outcome {
+                Ok(_) if deadline.is_some_and(|t| Instant::now() > t) => Err(ActorError::SoftTimeout),
+                other => other.map_err(ActorError::Call),
+            };
             let _ = reply.send(outcome);
         });
         {
@@ -203,25 +262,34 @@ impl Actor {
                     drop(outcome);
                     return Err(ActorError::Cancelled);
                 }
-                Ok(outcome) => return outcome.map_err(ActorError::Call),
+                Ok(outcome) => return outcome,
                 Err(mpsc::RecvTimeoutError::Disconnected) => {
                     return Err(if cancel.is_cancelled() { ActorError::Cancelled } else { ActorError::Stopped });
                 }
                 Err(mpsc::RecvTimeoutError::Timeout) => {}
             }
             if !cancel.is_cancelled() {
+                if deadline.is_some_and(|t| Instant::now() >= t) && !*running.lock().unwrap_or_else(|e| e.into_inner())
+                {
+                    return Err(ActorError::SoftTimeout);
+                }
                 continue;
             }
             match cancelled_at {
                 None => {
                     cancelled_at = Some(Instant::now());
-                    if self.is_busy() {
-                        self.cancel.cancel_soft();
+                    let running = running.lock().unwrap_or_else(|e| e.into_inner());
+                    if !*running {
+                        return Err(ActorError::Cancelled);
                     }
+                    self.cancel.cancel_soft();
                 }
                 Some(at) if at.elapsed() >= grace => {
                     // Did not return in time: interrupt it (the instance is rebuilt).
-                    self.cancel();
+                    let running = running.lock().unwrap_or_else(|e| e.into_inner());
+                    if *running {
+                        self.cancel();
+                    }
                     return Err(ActorError::Cancelled);
                 }
                 Some(_) => {}
@@ -239,7 +307,7 @@ impl Actor {
         let (crash, alive) = (self.crash.clone(), self.alive.clone());
         let job: Job = Box::new(move |slot| {
             let Some(rt) = slot.as_mut() else { return done(Err(ActorError::Stopped)) };
-            let outcome = f(rt);
+            let outcome = catch_call(|| f(rt));
             if let Err(CallError::Trap(e)) = &outcome {
                 *crash.lock().unwrap_or_else(|e| e.into_inner()) = Some(e.clone());
                 alive.store(false, Ordering::Release);

crates/ide-plugin/src/lib.rs

@@ -20,6 +20,6 @@ pub use runtime::{
     API_VERSION, CANCELLED, CallCancel, CallError, GuestError, HostApi, PluginEngine, Runtime, RuntimeSetup, check_api,
     component_api, host_api,
 };
-pub use sandbox::{MAX_READ_BYTES, read_text, resolve_in_root};
+pub use sandbox::{MAX_READ_BYTES, inside_root, read_text, resolve_in_root, resolve_new_in_root, resolve_real};
 pub use types::*;
 pub use wasmtime::component::Component;

crates/ide-plugin/src/runtime.rs

@@ -4,19 +4,21 @@
 //! themselves are in `wit_host`.
 
 use crate::types::{
-    CodeAction, CompletionItem, InlineSuggestion, LineMarker, Location, ProviderDocument, SemanticToken,
+    CodeAction, CommitDraft, CommitProblem, CompletionItem, FileOperation, InlineSuggestion, LineMarker, Location,
+    PluginHover, PluginInlayHint, ProviderDocument, SemanticToken,
 };
 use crate::types::{
-    EventKind, HostError, HttpRequest, HttpResponse, Invocation, Limits, NotificationLevel, ProcessOutput, Prompt,
-    RepositoryStatus, StatusItem, SyntaxFold, SyntaxSymbol, SyntaxToken, WorkbenchEvent,
+    EventKind, HostError, HttpRequest, HttpResponse, Invocation, Limits, NotificationLevel, ProcessChunk,
+    ProcessCommand, ProcessOutput, Prompt, RepositoryStatus, StatusItem, SyntaxFold, SyntaxSymbol, SyntaxToken,
+    WorkbenchEvent,
 };
 use crate::types::{
-    FieldValue, ServiceLog, ServiceLogToggle, ServicePane, ServiceTab, View, ViewBody, ViewButton, ViewEvent,
-    ViewField, ViewListItem, ViewTable, ViewTreeItem, Viewport,
+    FieldValue, ServiceLog, ServiceLogToggle, ServicePane, ServiceTab, TableSort, View, ViewBody, ViewButton,
+    ViewEvent, ViewField, ViewListItem, ViewTable, ViewTreeItem, Viewport,
 };
 use crate::wit_host::{
-    bindings, indexing_bindings, providers_bindings, semantic_bindings, services_bindings, syntax_bindings,
-    views_bindings,
+    bindings, commit_checks_bindings, details_bindings, endpoints_bindings, file_actions_bindings, hover_bindings,
+    indexing_bindings, inlay_bindings, providers_bindings, semantic_bindings, syntax_bindings, views_bindings,
 };
 use ide_core::CancellationToken;
 use ide_core::ipc_path::to_ipc;
@@ -33,11 +35,16 @@ use wasmtime_wasi::{WasiCtx, WasiCtxView, WasiView};
 
 use bindings::openidea::plugin::events as wit_events;
 use bindings::openidea::plugin::types as wit_types;
+use commit_checks_bindings::exports::openidea::plugin::commit_checker as wit_cc;
+use details_bindings::exports::openidea::plugin::detail_provider as wit_detail;
+use details_bindings::openidea::plugin::detail_types as wit_dt;
+use endpoints_bindings::exports::openidea::plugin::endpoints_provider as wit_endpoints;
+use file_actions_bindings::exports::openidea::plugin::file_actions as wit_fa;
+use hover_bindings::exports::openidea::plugin::hover_provider as wit_hover;
 use indexing_bindings::exports::openidea::plugin::document_indexer as wit_index;
+use inlay_bindings::exports::openidea::plugin::inlay_hints_provider as wit_inlay;
 use providers_bindings::exports::openidea::plugin::providers as wit_prov;
 use semantic_bindings::exports::openidea::plugin::semantic_tokens_provider as wit_sem;
-use services_bindings::exports::openidea::plugin::service_provider as wit_svc;
-use services_bindings::openidea::plugin::service_types as wit_st;
 use syntax_bindings::exports::openidea::plugin::syntax_provider as wit_syntax;
 use views_bindings::exports::openidea::plugin::view_provider as wit_view;
 use views_bindings::openidea::plugin::view_types as wit_vt;
@@ -55,7 +62,15 @@ pub const CANCELLED: &str = "was cancelled";
 /// which routes notifications and status items to windows and edits to open
 /// documents. Capabilities are already checked when these are called.
 pub trait HostApi: Send + Sync {
-    fn notify(&self, client: Option<&str>, level: NotificationLevel, title: String, body: String);
+    /// Shows a notification; `actions` name commands the plugin declares.
+    fn notify(
+        &self,
+        client: Option<&str>,
+        level: NotificationLevel,
+        title: String,
+        body: String,
+        actions: Vec<crate::NotificationAction>,
+    ) -> Result<(), HostError>;
     fn copy_to_clipboard(&self, client: Option<&str>, text: String) -> Result<(), HostError> {
         let _ = (client, text);
         Ok(())
@@ -64,6 +79,10 @@ pub trait HostApi: Send + Sync {
         let _ = (client, url);
         Ok(())
     }
+    fn open_project(&self, client: Option<&str>, path: String, new_window: bool) -> Result<(), HostError> {
+        let _ = (client, path, new_window);
+        Err(HostError::Invalid("opening projects is unavailable".into()))
+    }
     /// Shows `prompt` in `client`'s window and waits for the answer until the
     /// user gives one or `cancel` fires: the chosen keys (`QuickPick`), the
     /// text (`Input`, one element) or any value (`Confirm`: OK); `None` when
@@ -92,6 +111,30 @@ pub trait HostApi: Send + Sync {
     }
     /// Roots of the open projects.
     fn projects(&self) -> Vec<std::path::PathBuf>;
+    /// The most specific open project containing a document (including a new file).
+    fn project_of(&self, path: &Path) -> Option<std::path::PathBuf> {
+        if !path.is_absolute() {
+            return None;
+        }
+        let real = crate::resolve_real(path);
+        self.projects()
+            .into_iter()
+            .filter(|root| real.starts_with(crate::resolve_real(root)))
+            .max_by_key(|root| root.components().count())
+    }
+
+    /// Searches the current in-memory index of an open project.
+    fn symbols(
+        &self,
+        root: &Path,
+        query: &str,
+        limit: usize,
+        cancel: &CancellationToken,
+        deadline: Instant,
+    ) -> Result<Vec<crate::SymbolInfo>, HostError> {
+        let _ = (root, query, limit, cancel, deadline);
+        Err(HostError::NotFound("no project index is available".into()))
+    }
     /// Unsaved text of an open editor's file.
     fn buffer_text(&self, path: &Path) -> Option<String>;
     /// Version and text of the open document at `path`.
@@ -114,6 +157,22 @@ pub trait HostApi: Send + Sync {
         Ok(Vec::new())
     }
     fn vcs_fetch(&self, root: &Path, cancel: &CancellationToken) -> Result<(), HostError>;
+    /// The commit being prepared in `client`'s window (`None`: no repository),
+    /// waiting for the window until `cancel` fires.
+    fn pending_commit(
+        &self,
+        client: Option<&str>,
+        cancel: &CancellationToken,
+    ) -> Result<Option<CommitDraft>, HostError> {
+        let _ = (client, cancel);
+        Ok(None)
+    }
+    /// Replaces the commit message of `client`'s window if its draft is still at
+    /// `revision` (else [`HostError::Stale`]).
+    fn set_commit_message(&self, client: Option<&str>, revision: u64, message: String) -> Result<(), HostError> {
+        let _ = (client, revision, message);
+        Err(HostError::Invalid("no commit is being prepared".into()))
+    }
     /// Subscribes to (or unsubscribes from) a kind of workbench event.
     /// Project files matching `glob` (root-relative), at most `limit`.
     fn find_files(&self, root: &Path, glob: &str, limit: usize) -> Result<Vec<String>, HostError>;
@@ -122,17 +181,50 @@ pub trait HostApi: Send + Sync {
     /// Performs `request` (its host is granted), filling in secret placeholders.
     fn fetch(&self, request: HttpRequest, cancel: &CancellationToken) -> Result<HttpResponse, HostError>;
     fn secret_is_set(&self, name: &str) -> bool;
-    /// Runs the approved file of `process:<program>`.
+    /// Runs the approved file of `process:<program>` with `cmd.env` added to
+    /// the inherited environment, and waits.
     fn run_process(
         &self,
-        program: &str,
-        args: Vec<String>,
+        cmd: ProcessCommand,
         cwd: Option<&Path>,
         stdin: Option<String>,
         cancel: &CancellationToken,
         timeout: Duration,
     ) -> Result<ProcessOutput, HostError>;
-    fn subscribe(&self, kind: EventKind, on: bool);
+    /// Delivers every event of `kind`, dropping its path filter.
+    fn subscribe(&self, kind: EventKind);
+    /// Delivers `kind` (`file-opened`, `file-saved`) only for paths matching `globs`.
+    fn subscribe_paths(&self, kind: &str, globs: Vec<String>) -> Result<(), HostError>;
+    fn unsubscribe(&self, kind: &str);
+    /// Starts `cmd` and returns the handle to it without waiting.
+    fn start_process(&self, cmd: ProcessCommand, cwd: Option<&Path>, client: Option<&str>) -> Result<u64, HostError>;
+    /// What process `id` printed since the last call, each stream at most
+    /// `max` bytes (the rest waits for the next call), and its status once it
+    /// ended.
+    fn poll_process(&self, id: u64, max: usize) -> Result<ProcessChunk, HostError>;
+    /// Writes `text` to the stdin of process `id`.
+    fn write_process(
+        &self,
+        id: u64,
+        text: &str,
+        cancel: &CancellationToken,
+        timeout: Duration,
+    ) -> Result<(), HostError>;
+    /// Closes the stdin of process `id`.
+    fn close_process_stdin(&self, id: u64) -> Result<(), HostError>;
+    /// Ends process `id`; not an error if it already ended.
+    fn kill_process(&self, id: u64) -> Result<(), HostError>;
+    /// Forgets the handle and ends its process if it still runs.
+    fn release_process(&self, id: u64);
+    /// Waits up to `timeout` for process `id` to end (`ZERO` only checks) and
+    /// returns what it printed meanwhile with its status once it ended.
+    fn wait_process(
+        &self,
+        id: u64,
+        max: usize,
+        timeout: Duration,
+        cancel: &CancellationToken,
+    ) -> Result<ProcessChunk, HostError>;
     /// Starts a progress indicator; cancelling it from the UI cancels `cancel`.
     fn task_begin(&self, client: Option<&str>, title: String, cancellable: bool, cancel: CancellationToken) -> u64;
     fn task_report(&self, id: u64, done: u32, total: Option<u32>, message: Option<String>);
@@ -153,8 +245,21 @@ pub trait HostApi: Send + Sync {
         cwd: Option<&Path>,
     ) -> Result<(), HostError>;
     fn open_location(&self, client: Option<&str>, path: &Path, line: u32, column: u32) -> Result<(), HostError>;
+    /// The IDE's UI language as a BCP 47 tag.
+    fn locale(&self) -> String;
     /// A setting of the plugin as JSON (project over global over the schema default).
     fn setting(&self, root: Option<&Path>, key: &str) -> Option<String>;
+    /// Reads and decodes a text file outside the project, whose real path an
+    /// `fs.read` grant already covers: the unsaved buffer wins, then the disk.
+    /// `max` bounds the bytes read.
+    fn read_text_file(&self, real: &Path, max: usize) -> Result<String, HostError>;
+    /// Replaces the text of a file whose real path the caller already checked:
+    /// in one step, keeping its encoding and BOM (a new file is UTF-8). Refused
+    /// while an editor holds unsaved changes for it.
+    fn write_text_file(&self, real: &Path, text: &str) -> Result<(), HostError>;
+    /// Replaces the bytes of a file whose real path the caller already checked,
+    /// in one step. Refused while an editor holds unsaved changes for it.
+    fn write_bytes_file(&self, real: &Path, bytes: &[u8]) -> Result<(), HostError>;
 }
 
 /// Shared compilation engine plus an epoch ticker thread for wall-clock limits.
@@ -391,8 +496,10 @@ pub struct StoreData {
     pub(crate) granted: Vec<Capability>,
     pub(crate) host: Arc<dyn HostApi>,
     pub(crate) invocation: Invocation,
-    /// The running call is a command or an event, so it may ask the user.
+    /// The running call is a command or an event.
     pub(crate) interactive: bool,
+    /// Editor window for pick, pick-many, input and confirm during action resolution.
+    pub(crate) action_prompt_client: Option<String>,
     /// Tasks begun by the running call and not ended yet.
     pub(crate) open_tasks: Vec<u64>,
     pub(crate) last_report: Option<Instant>,
@@ -521,9 +628,15 @@ struct Exports {
     syntax: Option<wit_syntax::Guest>,
     providers: Option<wit_prov::Guest>,
     indexer: Option<wit_index::Guest>,
+    file_actions: Option<wit_fa::Guest>,
     views: Option<wit_view::Guest>,
     semantic: Option<wit_sem::Guest>,
-    services: Option<wit_svc::Guest>,
+    details: Option<wit_detail::Guest>,
+    diagnostics: Option<crate::wit_host::diagnostics_bindings::exports::openidea::plugin::diagnostics_provider::Guest>,
+    hover: Option<wit_hover::Guest>,
+    commit_checks: Option<wit_cc::Guest>,
+    inlay: Option<wit_inlay::Guest>,
+    endpoints: Option<wit_endpoints::Guest>,
 }
 
 /// Most results one syntax call may return (more are dropped).
@@ -576,6 +689,7 @@ impl Runtime {
             host: setup.host,
             invocation: Invocation::default(),
             interactive: false,
+            action_prompt_client: None,
             open_tasks: Vec::new(),
             last_report: None,
         };
@@ -601,10 +715,17 @@ impl Runtime {
         let plugin_indices = bindings::PluginIndices::new(&pre).map_err(api_hint)?;
         let syntax_indices = wit_syntax::GuestIndices::new(&pre).ok();
         let index_indices = wit_index::GuestIndices::new(&pre).ok();
+        let file_action_indices = wit_fa::GuestIndices::new(&pre).ok();
         let provider_indices = wit_prov::GuestIndices::new(&pre).ok();
         let view_indices = wit_view::GuestIndices::new(&pre).ok();
         let semantic_indices = wit_sem::GuestIndices::new(&pre).ok();
-        let service_indices = wit_svc::GuestIndices::new(&pre).ok();
+        let detail_indices = wit_detail::GuestIndices::new(&pre).ok();
+        use crate::wit_host::diagnostics_bindings::exports::openidea::plugin::diagnostics_provider as wit_diag;
+        let diagnostics_indices = wit_diag::GuestIndices::new(&pre).ok();
+        let hover_indices = wit_hover::GuestIndices::new(&pre).ok();
+        let commit_check_indices = wit_cc::GuestIndices::new(&pre).ok();
+        let inlay_indices = wit_inlay::GuestIndices::new(&pre).ok();
+        let endpoint_indices = wit_endpoints::GuestIndices::new(&pre).ok();
         let instance = pre.instantiate(&mut store).map_err(api_hint)?;
         let plugin = plugin_indices.load(&mut store, &instance).map_err(api_hint)?;
         let syntax = match syntax_indices {
@@ -619,6 +740,10 @@ impl Runtime {
             Some(i) => Some(i.load(&mut store, &instance).map_err(api_hint)?),
             None => None,
         };
+        let file_actions = match file_action_indices {
+            Some(i) => Some(i.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
         let views = match view_indices {
             Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
             None => None,
@@ -627,13 +752,47 @@ impl Runtime {
             Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
             None => None,
         };
-        let services = match service_indices {
+        let details = match detail_indices {
+            Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
+        let diagnostics = match diagnostics_indices {
+            Some(i) => Some(i.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
+        let hover = match hover_indices {
+            Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
+        let commit_checks = match commit_check_indices {
+            Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
+        let inlay = match inlay_indices {
+            Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
+            None => None,
+        };
+        let endpoints = match endpoint_indices {
             Some(indices) => Some(indices.load(&mut store, &instance).map_err(api_hint)?),
             None => None,
         };
         Ok(Self {
             store,
-            exports: Exports { plugin, syntax, providers, views, indexer, semantic, services },
+            exports: Exports {
+                plugin,
+                syntax,
+                providers,
+                views,
+                indexer,
+                semantic,
+                details,
+                diagnostics,
+                hover,
+                commit_checks,
+                inlay,
+                endpoints,
+                file_actions,
+            },
             limits: setup.limits,
             version: setup.version,
         })
@@ -815,9 +974,23 @@ impl Runtime {
         selection: ide_core::Range,
         timeout: Duration,
     ) -> Result<Vec<CodeAction>, CallError> {
-        let d = doc_to_wit(doc);
-        let actions = self.provider_call(timeout, |p, s| p.call_code_actions(s, &d, range_to_wit(selection)))?;
-        Ok(actions.into_iter().take(MAX_PROVIDER_ITEMS).map(code_action_from_wit).collect())
+        let mut out = Vec::new();
+        if self.exports.providers.is_some() {
+            let d = doc_to_wit(doc);
+            let actions = self.provider_call(timeout, |p, s| p.call_code_actions(s, &d, range_to_wit(selection)))?;
+            out.extend(actions.into_iter().take(MAX_PROVIDER_ITEMS).map(code_action_from_wit));
+        }
+        if self.exports.file_actions.is_some() {
+            let d = file_action_doc(doc);
+            let actions = self.call(Invocation::default(), timeout, |e, store| {
+                e.file_actions.as_ref().expect("checked").call_code_actions(store, &d, range_to_wit(selection))
+            })?;
+            out.extend(actions.into_iter().take(MAX_PROVIDER_ITEMS).map(file_action_from_wit));
+        }
+        if out.is_empty() && self.exports.providers.is_none() {
+            return Err(CallError::missing_export("providers"));
+        }
+        Ok(out)
     }
 
     /// The edits of an action `provide_code_actions` returned with `data`.
@@ -825,11 +998,30 @@ impl Runtime {
         &mut self,
         doc: &ProviderDocument,
         action: &CodeAction,
+        invocation: Invocation,
         timeout: Duration,
     ) -> Result<CodeAction, CallError> {
+        if action.file_action {
+            if self.exports.file_actions.is_none() {
+                return Err(CallError::missing_export("file-actions"));
+            }
+            let d = file_action_doc(doc);
+            let a = file_action_to_wit(action);
+            let resolved = self.call(Invocation::default(), timeout, |e, store| {
+                store.data_mut().action_prompt_client = invocation.client;
+                e.file_actions.as_ref().expect("checked").call_resolve(store, &d, &a)
+            })?;
+            return resolved.map(file_action_from_wit).map_err(|e| CallError::Guest(e.into()));
+        }
         let d = doc_to_wit(doc);
         let a = code_action_to_wit(action);
-        let resolved = self.provider_call(timeout, |p, s| p.call_resolve_code_action(s, &d, &a))?;
+        if self.exports.providers.is_none() {
+            return Err(CallError::missing_export("providers"));
+        }
+        let resolved = self.call(Invocation::default(), timeout, |e, store| {
+            store.data_mut().action_prompt_client = invocation.client;
+            e.providers.as_ref().expect("checked").call_resolve_code_action(store, &d, &a)
+        })?;
         resolved.map(code_action_from_wit).map_err(|e| CallError::Guest(e.into()))
     }
 
@@ -856,7 +1048,7 @@ impl Runtime {
             .take(MAX_PROVIDER_ITEMS)
             .map(|m| LineMarker {
                 line: m.line,
-                icon: m.icon.map(|i| clip(i, 32)),
+                icon: m.icon.map(|i| clip(i, 256)),
                 tooltip: clip(m.tooltip, 1024),
                 target: m.target.map(location_from_wit),
             })
@@ -891,6 +1083,84 @@ impl Runtime {
             .collect())
     }
 
+    pub fn provide_diagnostics(
+        &mut self,
+        doc: &ProviderDocument,
+        timeout: Duration,
+    ) -> Result<Vec<ide_core::Diagnostic>, CallError> {
+        use crate::wit_host::diagnostics_bindings::exports::openidea::plugin::diagnostics_provider as w;
+        if self.exports.diagnostics.is_none() {
+            return Err(CallError::missing_export("diagnostics-provider"));
+        }
+        let d = w::Document {
+            path: to_ipc(&doc.path),
+            language: doc.language.clone(),
+            version: doc.version,
+            text: doc.text.clone(),
+        };
+        let items = self.call(Invocation::default(), timeout, |e, store| {
+            e.diagnostics.as_ref().expect("checked").call_diagnostics(store, &d)
+        })?;
+        Ok(crate::wit_host::diagnostics_from_wit(items, &self.store.data().plugin_id))
+    }
+
+    pub fn provide_hover(
+        &mut self,
+        doc: &ProviderDocument,
+        at: ide_core::Pos,
+        timeout: Duration,
+    ) -> Result<Option<PluginHover>, CallError> {
+        if self.exports.hover.is_none() {
+            return Err(CallError::missing_export("hover-provider"));
+        }
+        let d = wit_hover::Document {
+            path: to_ipc(&doc.path),
+            language: doc.language.clone(),
+            version: doc.version,
+            text: doc.text.clone(),
+        };
+        let hover = self.call(Invocation::default(), timeout, |e, store| {
+            e.hover.as_ref().expect("checked").call_hover(store, &d, pos_to_wit(at))
+        })?;
+        Ok(hover
+            .filter(|h| !h.markdown.trim().is_empty())
+            .map(|h| PluginHover { markdown: clip(h.markdown, MAX_HOVER_BYTES), range: h.range.map(range_from_wit) }))
+    }
+
+    pub fn provide_inlay_hints(
+        &mut self,
+        doc: &ProviderDocument,
+        range: ide_core::Range,
+        timeout: Duration,
+    ) -> Result<Vec<PluginInlayHint>, CallError> {
+        if self.exports.inlay.is_none() {
+            return Err(CallError::missing_export("inlay-hints-provider"));
+        }
+        let d = wit_inlay::Document {
+            path: to_ipc(&doc.path),
+            language: doc.language.clone(),
+            version: doc.version,
+            text: doc.text.clone(),
+        };
+        let r = wit_types::Range { start: pos_to_wit(range.start), end: pos_to_wit(range.end) };
+        let hints = self.call(Invocation::default(), timeout, |e, store| {
+            e.inlay.as_ref().expect("checked").call_inlay_hints(store, &d, r)
+        })?;
+        Ok(hints
+            .into_iter()
+            .filter(|h| !h.label.trim().is_empty())
+            .take(MAX_PROVIDER_ITEMS)
+            .map(|h| PluginInlayHint {
+                position: ide_core::Pos::new(h.position.line, h.position.character),
+                label: clip(h.label, 256),
+                kind: clip(h.kind, 32),
+                tooltip: h.tooltip.map(|t| clip(t, 1024)),
+                padding_left: h.padding_left,
+                padding_right: h.padding_right,
+            })
+            .collect())
+    }
+
     pub fn activate(&mut self) -> Result<(), CallError> {
         let data = self.store.data();
         let ctx = wit_types::Context {
@@ -956,6 +1226,37 @@ impl Runtime {
         }
     }
 
+    /// Project routes, with an explicit project invocation and background budget.
+    pub fn endpoints(&mut self, invocation: Invocation, timeout: Duration) -> Result<Vec<crate::Endpoint>, CallError> {
+        if self.exports.endpoints.is_none() {
+            return Err(CallError::missing_export("endpoints-provider"));
+        }
+        let result = self.call(invocation, timeout, |e, store| {
+            let ctx = store.data_mut().new_invocation()?;
+            let r = e
+                .endpoints
+                .as_ref()
+                .expect("checked")
+                .call_endpoints(&mut *store, wasmtime::component::Resource::new_borrow(ctx.rep()));
+            store.data_mut().drop_invocation(ctx);
+            r
+        })?;
+        let entries = result.map_err(|e| CallError::Guest(e.into()))?;
+        if entries.len() > MAX_PROVIDER_ITEMS {
+            return Err(CallError::Guest(GuestError::Invalid("too many endpoints".into())));
+        }
+        Ok(entries
+            .into_iter()
+            .map(|e| crate::Endpoint {
+                method: e.method,
+                path: e.path,
+                framework: e.framework,
+                handler: e.handler,
+                location: location_from_wit(e.location),
+            })
+            .collect())
+    }
+
     /// The Services pane of node `key` of the plugin's services view `view`.
     pub fn service_detail(
         &mut self,
@@ -963,13 +1264,13 @@ impl Runtime {
         key: &str,
         invocation: Invocation,
     ) -> Result<Vec<ServiceTab>, CallError> {
-        if self.exports.services.is_none() {
-            return Err(CallError::missing_export("service-provider"));
+        if self.exports.details.is_none() {
+            return Err(CallError::missing_export("detail-provider"));
         }
         let result = self.call(invocation, self.limits.timeout, |e, store| {
             let ctx = store.data_mut().new_invocation()?;
-            let services = e.services.as_ref().expect("checked");
-            let r = services.call_detail(&mut *store, view, key, wasmtime::component::Resource::new_borrow(ctx.rep()));
+            let details = e.details.as_ref().expect("checked");
+            let r = details.call_detail(&mut *store, view, key, wasmtime::component::Resource::new_borrow(ctx.rep()));
             store.data_mut().drop_invocation(ctx);
             r
         })?;
@@ -979,6 +1280,30 @@ impl Runtime {
         }
     }
 
+    /// Runs the plugin's before-commit check `check` on `draft`.
+    pub fn commit_check(
+        &mut self,
+        check: &str,
+        draft: CommitDraft,
+        invocation: Invocation,
+    ) -> Result<Vec<CommitProblem>, CallError> {
+        if self.exports.commit_checks.is_none() {
+            return Err(CallError::missing_export("commit-checker"));
+        }
+        let draft = crate::wit_host::commit_draft_to_wit(draft);
+        let result = self.call(invocation, self.limits.timeout, |e, store| {
+            let ctx = store.data_mut().new_invocation()?;
+            let checks = e.commit_checks.as_ref().expect("checked");
+            let r = checks.call_check(&mut *store, check, &draft, wasmtime::component::Resource::new_borrow(ctx.rep()));
+            store.data_mut().drop_invocation(ctx);
+            r
+        })?;
+        match result {
+            Ok(problems) => Ok(problems.into_iter().take(MAX_COMMIT_PROBLEMS).map(commit_problem_from_wit).collect()),
+            Err(e) => Err(CallError::Guest(e.into())),
+        }
+    }
+
     /// A user action in a view or custom editor.
     pub fn view_event(&mut self, view: &str, event: ViewEvent, invocation: Invocation) -> Result<(), CallError> {
         if self.exports.views.is_none() {
@@ -1039,6 +1364,7 @@ impl Runtime {
         let data = self.store.data_mut();
         data.invocation = Invocation::default();
         data.interactive = false;
+        data.action_prompt_client = None;
         // Tasks don't outlive the call that began them.
         for id in std::mem::take(&mut data.open_tasks) {
             data.host.task_end(id);
@@ -1068,6 +1394,7 @@ impl Runtime {
 const MAX_PROVIDER_ITEMS: usize = 10_000;
 const MAX_SEMANTIC_TOKENS: usize = 1 << 16;
 const MAX_TOKEN_MODIFIERS: usize = 8;
+const MAX_HOVER_BYTES: usize = 64 * 1024;
 
 fn pos_to_wit(p: ide_core::Pos) -> wit_types::Position {
     wit_types::Position { line: p.line, character: p.col }
@@ -1148,7 +1475,10 @@ fn code_action_from_wit(a: wit_prov::CodeAction) -> CodeAction {
             .into_iter()
             .map(|f| (std::path::PathBuf::from(f.path), f.edits.into_iter().map(edit_from_wit).collect()))
             .collect(),
+        operations: Vec::new(),
+        open: None,
         data: a.data.map(|d| clip(d, 64 << 10)),
+        file_action: false,
     }
 }
 
@@ -1172,20 +1502,106 @@ fn code_action_to_wit(a: &CodeAction) -> wit_prov::CodeAction {
     }
 }
 
+const MAX_FILE_OPERATIONS: usize = 1000;
+
+fn file_action_doc(doc: &ProviderDocument) -> wit_fa::Document {
+    wit_fa::Document {
+        path: to_ipc(&doc.path),
+        language: doc.language.clone(),
+        version: doc.version,
+        text: doc.text.clone(),
+    }
+}
+
+fn file_action_from_wit(a: wit_fa::FileAction) -> CodeAction {
+    CodeAction {
+        title: clip(a.title, MAX_TITLE),
+        kind: a.kind.map(|k| clip(k, 64)),
+        preferred: a.preferred,
+        edits: a
+            .edits
+            .into_iter()
+            .map(|f| (std::path::PathBuf::from(f.path), f.edits.into_iter().map(edit_from_wit).collect()))
+            .collect(),
+        operations: a.operations.into_iter().take(MAX_FILE_OPERATIONS).map(operation_from_wit).collect(),
+        open: a.open.map(std::path::PathBuf::from),
+        data: a.data.map(|d| clip(d, 64 << 10)),
+        file_action: true,
+    }
+}
+
+fn file_action_to_wit(a: &CodeAction) -> wit_fa::FileAction {
+    wit_fa::FileAction {
+        title: a.title.clone(),
+        kind: a.kind.clone(),
+        preferred: a.preferred,
+        operations: a
+            .operations
+            .iter()
+            .map(|op| match op {
+                FileOperation::Create { path, text, overwrite } => wit_fa::FileOperation::Create(wit_fa::CreateFile {
+                    path: to_ipc(path),
+                    text: text.clone(),
+                    overwrite: *overwrite,
+                }),
+                FileOperation::Rename { from, to } => {
+                    wit_fa::FileOperation::Rename(wit_fa::RenameFile { path: to_ipc(from), new_path: to_ipc(to) })
+                }
+                FileOperation::Delete { path } => {
+                    wit_fa::FileOperation::Delete(wit_fa::DeleteFile { path: to_ipc(path) })
+                }
+            })
+            .collect(),
+        edits: a
+            .edits
+            .iter()
+            .map(|(path, edits)| wit_fa::FileEdit {
+                path: to_ipc(path),
+                edits: edits
+                    .iter()
+                    .map(|e| wit_types::TextEdit { range: range_to_wit(e.range), text: e.new_text.clone() })
+                    .collect(),
+            })
+            .collect(),
+        open: a.open.as_deref().map(to_ipc),
+        data: a.data.clone(),
+    }
+}
+
+fn operation_from_wit(op: wit_fa::FileOperation) -> FileOperation {
+    match op {
+        wit_fa::FileOperation::Create(c) => {
+            FileOperation::Create { path: c.path.into(), text: c.text, overwrite: c.overwrite }
+        }
+        wit_fa::FileOperation::Rename(r) => FileOperation::Rename { from: r.path.into(), to: r.new_path.into() },
+        wit_fa::FileOperation::Delete(d) => FileOperation::Delete { path: d.path.into() },
+    }
+}
+
 fn opt_clip(s: Option<String>, max: usize) -> Option<String> {
     s.map(|s| clip(s, max))
 }
 
+const MAX_COMMIT_PROBLEMS: usize = 50;
+
+fn commit_problem_from_wit(p: wit_cc::CommitProblem) -> CommitProblem {
+    let (path, range) = match p.location {
+        Some(l) => (Some(clip(l.path, 4096)), Some(range_from_wit(l.range))),
+        None => (None, None),
+    };
+    CommitProblem { message: clip(p.message, 4096), path, range }
+}
+
 const MAX_SERVICE_TABS: usize = 8;
 const MAX_LOG_TOGGLES: usize = 8;
 const MAX_LOG_ARGS: usize = 256;
 const MAX_LOG_ARG: usize = 4096;
 
-fn service_tab_from_wit(t: wit_st::Tab) -> ServiceTab {
+fn service_tab_from_wit(t: wit_dt::Tab) -> ServiceTab {
     let body = match t.body {
-        wit_st::Pane::Message(m) => ServicePane::Message(clip(m, 16 << 10)),
-        wit_st::Pane::Text(text) => ServicePane::Text(clip(text, MAX_TEXT)),
-        wit_st::Pane::Log(log) => {
+        wit_dt::Pane::Message(m) => ServicePane::Message(clip(m, 16 << 10)),
+        wit_dt::Pane::Text(text) => ServicePane::Text(clip(text, MAX_TEXT)),
+        wit_dt::Pane::Log(log) => {
             let args_fit = |args: &[String]| args.len() <= MAX_LOG_ARGS && args.iter().all(|a| a.len() <= MAX_LOG_ARG);
             if args_fit(&log.args)
                 && log.toggles.len() <= MAX_LOG_TOGGLES
@@ -1210,12 +1626,54 @@ fn service_tab_from_wit(t: wit_st::Tab) -> ServiceTab {
     ServiceTab { id: clip(t.id, 64), label: clip(t.label, MAX_TITLE), body }
 }
 
+/// A `table` body carried by the `other` case (the sortable variant, plugins/
+/// README.md §10): the usual table fields as JSON plus `sort`, the column the
+/// plugin orders by and the direction, or null. Anything unparsable degrades
+/// like a body this host doesn't know.
+fn sortable_table_from_json(data: &str) -> Option<ViewTable> {
+    #[derive(serde::Deserialize)]
+    #[serde(rename_all = "camelCase")]
+    struct Json {
+        #[serde(default)]
+        columns: Vec<String>,
+        #[serde(default)]
+        total_rows: u32,
+        #[serde(default)]
+        first_row: u32,
+        #[serde(default)]
+        rows: Vec<Vec<String>>,
+        #[serde(default)]
+        editable: bool,
+        #[serde(default)]
+        sort: Option<TableSort>,
+    }
+    let json: Json = serde_json::from_str(data).ok()?;
+    Some(ViewTable {
+        columns: json.columns.into_iter().take(1000).map(|c| clip(c, MAX_TITLE)).collect(),
+        total_rows: json.total_rows,
+        first_row: json.first_row,
+        rows: json
+            .rows
+            .into_iter()
+            .take(MAX_TABLE_ROWS as usize)
+            .map(|r| r.into_iter().take(1000).map(|c| clip(c, MAX_CELL)).collect())
+            .collect(),
+        editable: json.editable,
+        sortable: true,
+        sort: json.sort,
+    })
+}
+
 fn view_from_wit(v: wit_vt::View) -> View {
     let body = match v.body {
         wit_vt::Body::Message(m) => ViewBody::Message(clip(m, 16 << 10)),
-        wit_vt::Body::Other(e) => {
-            ViewBody::Message(format!("This view needs a newer version of OpenIDEA ({}).", clip(e.kind, 64)))
-        }
+        wit_vt::Body::Other(e) => match e.kind.as_str() {
+            "table" => match sortable_table_from_json(&e.data) {
+                Some(t) => ViewBody::Table(t),
+                None => ViewBody::Message("This view needs a newer version of OpenIDEA (table).".into()),
+            },
+            _ => ViewBody::Message(format!("This view needs a newer version of OpenIDEA ({}).", clip(e.kind, 64))),
+        },
         wit_vt::Body::Tree(items) => ViewBody::Tree(
             items
                 .into_iter()
@@ -1256,8 +1714,23 @@ fn view_from_wit(v: wit_vt::View) -> View {
                             options: options.into_iter().take(1000).map(|o| clip(o, MAX_TITLE)).collect(),
                             selected: clip(selected, MAX_TITLE),
                         },
-                        // A field type of a newer API: left out.
-                        wit_vt::FieldValue::Other(_) => return None,
+                        wit_vt::FieldValue::Other(e) => match e.kind.as_str() {
+                            "label" => FieldValue::Label(clip(serde_json::from_str(&e.data).ok()?, MAX_CELL)),
+                            "readonly-text" => {
+                                #[derive(serde::Deserialize)]
+                                struct ReadonlyText {
+                                    text: String,
+                                    #[serde(default)]
+                                    multiline: bool,
+                                }
+                                let value: ReadonlyText = serde_json::from_str(&e.data).ok()?;
+                                FieldValue::ReadonlyText {
+                                    text: clip(value.text, if value.multiline { 1 << 20 } else { MAX_CELL }),
+                                    multiline: value.multiline,
+                                }
+                            }
+                            _ => return None,
+                        },
                     };
                     Some(ViewField { key: clip(f.key, 128), label: clip(f.label, MAX_TITLE), value })
                 })
@@ -1274,6 +1747,9 @@ fn view_from_wit(v: wit_vt::View) -> View {
                 .map(|r| r.into_iter().take(1000).map(|c| clip(c, MAX_CELL)).collect())
                 .collect(),
             editable: t.editable,
+            // The plain body predates sortable headers; `other` kind `table` opts in.
+            sortable: false,
+            sort: None,
         }),
         wit_vt::Body::Html(h) => ViewBody::Html(clip(h, MAX_HTML)),
     };
@@ -1307,6 +1783,18 @@ fn event_to_wit_view(e: ViewEvent) -> wit_vt::ViewEvent {
         ViewEvent::InsertRow { before } => W::InsertRow(before),
         ViewEvent::DeleteRows { rows } => W::DeleteRows(rows),
         ViewEvent::Message { text } => W::Message(text),
+        ViewEvent::TableSelect { row } => {
+            W::Other(wit_types::Extension { kind: "table-select".into(), data: format!(r#"{{"row":{row}}}"#) })
+        }
+        ViewEvent::TableActivate { row } => {
+            W::Other(wit_types::Extension { kind: "table-activate".into(), data: format!(r#"{{"row":{row}}}"#) })
+        }
+        // A sortable table's header click, as an `other` view-event (plugins/
+        // README.md §10): the SDKs decode the kinds they know.
+        ViewEvent::Sort { column, descending } => W::Other(wit_types::Extension {
+            kind: "sort".into(),
+            data: format!(r#"{{"column":{column},"descending":{descending}}}"#),
+        }),
     }
 }
 
@@ -1314,6 +1802,44 @@ fn event_to_wit_view(e: ViewEvent) -> wit_vt::ViewEvent {
 mod tests {
     use super::*;
 
+    #[test]
+    fn readonly_field_extensions_are_parsed_and_unknown_or_malformed_fields_are_skipped() {
+        let fields = [
+            ("label", r#""Title \"quoted\"""#),
+            ("readonly-text", r#"{"text":"one\ntwo","multiline":true}"#),
+            ("readonly-text", r#"{"text":"author"}"#),
+            ("label", "{}"),
+            ("readonly-text", r#"{"text":false}"#),
+            ("future", "null"),
+        ]
+        .into_iter()
+        .enumerate()
+        .map(|(i, (kind, data))| wit_vt::Field {
+            key: i.to_string(),
+            label: "Field".into(),
+            value: wit_vt::FieldValue::Other(wit_types::Extension { kind: kind.into(), data: data.into() }),
+        })
+        .collect();
+        let view = view_from_wit(wit_vt::View { toolbar: vec![], body: wit_vt::Body::Form(fields), status: None });
+        let ViewBody::Form(fields) = view.body else { panic!("form") };
+        assert_eq!(fields.len(), 3);
+        assert_eq!(fields[0].value, FieldValue::Label("Title \"quoted\"".into()));
+        assert_eq!(fields[1].value, FieldValue::ReadonlyText { text: "one\ntwo".into(), multiline: true });
+        assert_eq!(fields[2].value, FieldValue::ReadonlyText { text: "author".into(), multiline: false });
+    }
+
+    #[test]
+    fn table_row_events_leave_through_released_extension_case() {
+        for (event, kind) in [
+            (ViewEvent::TableSelect { row: 51 }, "table-select"),
+            (ViewEvent::TableActivate { row: 51 }, "table-activate"),
+        ] {
+            let wit_vt::ViewEvent::Other(extension) = event_to_wit_view(event) else { panic!("other") };
+            assert_eq!(extension.kind, kind);
+            assert_eq!(extension.data, r#"{"row":51}"#);
+        }
+    }
+
     #[cfg(windows)]
     #[test]
     fn provider_and_resolved_action_paths_match_ipc_events() {
@@ -1329,7 +1855,10 @@ mod tests {
                 kind: None,
                 preferred: false,
                 edits: vec![(path.into(), Vec::new())],
+                operations: Vec::new(),
+                open: None,
                 data: None,
+                file_action: false,
             };
             assert_eq!(code_action_to_wit(&action).edits[0].path, expected);
         }
@@ -1352,4 +1881,41 @@ mod tests {
         let ViewBody::Form(fields) = form.body else { panic!("a form") };
         assert_eq!(fields.iter().map(|f| f.key.as_str()).collect::<Vec<_>>(), ["name"], "unknown fields are left out");
     }
+
+    #[test]
+    fn a_sortable_table_arrives_through_other() {
+        let view = |data: &str| wit_vt::View {
+            toolbar: Vec::new(),
+            body: wit_vt::Body::Other(wit_types::Extension { kind: "table".into(), data: data.into() }),
+            status: None,
+        };
+        let shown = view_from_wit(view(
+            r#"{"columns":["ext","files"],"totalRows":3,"firstRow":1,"rows":[["rs","2"],["md","1"]],
+                "editable":false,"sort":{"column":1,"descending":true}}"#,
+        ));
+        let ViewBody::Table(t) = shown.body else { panic!("{shown:?}") };
+        assert_eq!(t.columns, ["ext".to_owned(), "files".into()]);
+        assert_eq!((t.total_rows, t.first_row, t.editable), (3, 1, false));
+        assert!(t.sortable, "a `table` through `other` opts the headers in");
+        assert_eq!(t.sort, Some(TableSort { column: 1, descending: true }));
+
+        // No sort yet: still clickable headers, just no arrow.
+        let fresh = view_from_wit(view(
+            r#"{"columns":["a"],"totalRows":0,"firstRow":0,"rows":[],"editable":false,"sort":null}"#,
+        ));
+        let ViewBody::Table(t) = fresh.body else { panic!("{fresh:?}") };
+        assert!(t.sortable);
+        assert_eq!(t.sort, None);
+
+        // Broken JSON degrades like any body the host doesn't know.
+        let broken = view_from_wit(view("{not json"));
+        assert!(matches!(broken.body, ViewBody::Message(_)), "{broken:?}");
+    }
+
+    #[test]
+    fn a_sort_click_leaves_as_an_other_extension() {
+        let wit = event_to_wit_view(ViewEvent::Sort { column: 2, descending: true });
+        let wit_vt::ViewEvent::Other(e) = wit else { panic!("{wit:?}") };
+        assert_eq!((e.kind.as_str(), e.data.as_str()), ("sort", r#"{"column":2,"descending":true}"#));
+    }
 }

crates/ide-plugin/src/sandbox.rs

@@ -1,19 +1,63 @@
 //! Capability checks for host functions that touch the file system.
 
+use ide_extension::Capability;
 use std::path::{Path, PathBuf};
 
 /// Largest file `read-file` returns.
-pub const MAX_READ_BYTES: u64 = 16 << 20;
+/// The most entries `fs.read-dir` hands over: the same cap as `find-files`.
+pub const MAX_LIST_ENTRIES: usize = 4096;
 
-/// Resolves `path` (absolute, or relative to `root`) and checks that the real
-/// path — after following `..` and symlinks — stays inside `root`.
-pub fn resolve_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
+pub const MAX_READ_BYTES: u64 = 16 << 20;
+/// The largest file s.write may write, in bytes.
+pub const MAX_WRITE_BYTES: usize = 16 << 20;
+
+/// The canonical `root` and the absolute form of `path` (absolute, or
+/// relative to `root`) — before any symlink or existence check.
+fn joined_path(root: &Path, path: &str) -> Result<(PathBuf, PathBuf), String> {
     if path.is_empty() {
         return Err("empty path".into());
     }
     let root = root.canonicalize().map_err(|e| format!("project root unavailable: {e}"))?;
     let requested = Path::new(path);
     let joined = if requested.is_absolute() { requested.to_path_buf() } else { root.join(requested) };
+    Ok((root, joined))
+}
+
+/// `joined` after `..`/symlink resolution as far as the file system allows:
+/// the canonical path when it exists, else the canonicalized deepest existing
+/// ancestor with the still-missing tail resolved textually — so the location
+/// of a missing path is still judged where it would really land.
+pub fn resolve_real(joined: &Path) -> PathBuf {
+    let mut tail = Vec::new();
+    let mut candidate = joined.to_path_buf();
+    let mut real = loop {
+        match candidate.canonicalize() {
+            Ok(real) => break real,
+            Err(_) => {
+                let Some(last) = candidate.components().next_back() else {
+                    return joined.to_path_buf();
+                };
+                tail.push(last.as_os_str().to_owned());
+                if !candidate.pop() {
+                    return joined.to_path_buf();
+                }
+            }
+        }
+    };
+    for part in tail.iter().rev() {
+        if part == ".." {
+            real.pop();
+        } else if part != "." {
+            real.push(part);
+        }
+    }
+    real
+}
+
+/// Resolves `path` (absolute, or relative to `root`) and checks that the real
+/// path — after following `..` and symlinks — stays inside `root`.
+pub fn resolve_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
+    let (root, joined) = joined_path(root, path)?;
     let real = joined.canonicalize().map_err(|_| format!("{path}: no such file"))?;
     if !real.starts_with(&root) {
         return Err(format!("{path}: access outside the project root is not allowed"));
@@ -21,6 +65,58 @@ pub fn resolve_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
     Ok(real)
 }
 
+/// Whether `path` (absolute, or relative to `root`) lands inside `root`,
+/// without requiring it to exist: `Ok(true)` also for a missing path, so
+/// callers distinguish "outside" from "absent". Existing symlinks are
+/// followed; a missing tail is judged at its would-be location.
+pub fn inside_root(root: &Path, path: &str) -> Result<bool, String> {
+    let (root, joined) = joined_path(root, path)?;
+    Ok(resolve_real(&joined).starts_with(&root))
+}
+
+/// Like [`resolve_in_root`] for a path that may not exist yet (a file about to
+/// be created) or that names a symlink itself (to delete or rename it): the
+/// directory part is resolved through symlinks, the final name is kept as is,
+/// and the result must stay inside `root`.
+pub fn resolve_new_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
+    let outside = || format!("{path}: access outside the project root is not allowed");
+    if path.is_empty() {
+        return Err("empty path".into());
+    }
+    let root = root.canonicalize().map_err(|e| format!("project root unavailable: {e}"))?;
+    let requested = Path::new(path);
+    let joined = if requested.is_absolute() { requested.to_path_buf() } else { root.join(requested) };
+    let mut lexical = PathBuf::new();
+    for part in joined.components() {
+        match part {
+            std::path::Component::ParentDir => {
+                lexical.pop();
+            }
+            std::path::Component::CurDir => {}
+            part => lexical.push(part),
+        }
+    }
+    let (Some(name), Some(parent)) = (lexical.file_name(), lexical.parent()) else {
+        return Err(outside());
+    };
+    let mut missing = Vec::new();
+    let mut existing = parent;
+    while !existing.exists() {
+        let (Some(dir), Some(above)) = (existing.file_name(), existing.parent()) else {
+            return Err(outside());
+        };
+        missing.push(dir);
+        existing = above;
+    }
+    let mut real = existing.canonicalize().map_err(|e| format!("{path}: {e}"))?;
+    real.extend(missing.into_iter().rev());
+    real.push(name);
+    if !real.starts_with(&root) {
+        return Err(outside());
+    }
+    Ok(real)
+}
+
 /// Reads a UTF-8 file that `resolve_in_root` already approved.
 pub fn read_text(real: &Path) -> Result<String, String> {
     let meta = std::fs::metadata(real).map_err(|e| e.to_string())?;
@@ -34,6 +130,132 @@ pub fn read_text(real: &Path) -> Result<String, String> {
     String::from_utf8(bytes).map_err(|_| format!("{}: not valid UTF-8 text", real.display()))
 }
 
+/// Why a read outside the project was refused.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Refusal {
+    /// No `fs.read:<path>` grant covers the file; names the capability to declare.
+    Denied(String),
+    /// The path cannot be read as asked.
+    Invalid(String),
+}
+
+/// Expands a leading `~` or `~/` to the user's home; everything else as written.
+fn expand_tilde(path: &str) -> PathBuf {
+    let rest = if path == "~" {
+        Some("")
+    } else if let Some(rest) = path.strip_prefix("~/") {
+        Some(rest)
+    } else {
+        path.strip_prefix("~\\")
+    };
+    match rest {
+        Some(rest) => std::env::var_os("HOME")
+            .or_else(|| std::env::var_os("USERPROFILE"))
+            .map(|home| PathBuf::from(home).join(rest))
+            .unwrap_or_else(|| PathBuf::from(path)),
+        None => PathBuf::from(path),
+    }
+}
+
+/// Which grant a path is resolved against.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Wanted {
+    Read,
+    Write,
+}
+
+impl Wanted {
+    fn capability(self, plain: String) -> Capability {
+        match self {
+            Self::Read => Capability::FsRead(plain),
+            Self::Write => Capability::FsWrite(plain),
+        }
+    }
+
+    /// `fs.read` / `fs.write`, for messages.
+    fn prefix(self) -> &'static str {
+        match self {
+            Self::Read => "fs.read",
+            Self::Write => "fs.write",
+        }
+    }
+}
+
+/// The real path of `path` when an `fs.read:<path>` grant covers it.
+///
+/// The grant is compared with the **real** path, so a symlink pointing out of
+/// a granted tree is refused, and `fs.read:/srv/app` covers `/srv/app/x` but
+/// not `/srv/application`. Windows' `\\?\` prefix (what `canonicalize` adds)
+/// is stripped from the file side so a manifest may spell `C:\Program Files\X`.
+pub fn resolve_granted(granted: &[Capability], path: &str) -> Result<PathBuf, Refusal> {
+    resolve(granted, path, Wanted::Read)
+}
+
+/// The real path `path` would be written to, when an `fs.write:<path>` grant
+/// covers it.
+///
+/// A file that does not exist yet cannot be canonicalized, so its directory is
+/// canonicalized instead and the name appended; an existing file (or link) is
+/// followed first, so a link cannot be used to write outside the grant.
+pub fn resolve_writable(granted: &[Capability], path: &str) -> Result<PathBuf, Refusal> {
+    resolve(granted, path, Wanted::Write)
+}
+
+fn resolve(granted: &[Capability], path: &str, wanted: Wanted) -> Result<PathBuf, Refusal> {
+    let asked = expand_tilde(path);
+    if !asked.is_absolute() {
+        return Err(Refusal::Invalid(format!("{path}: use an absolute path (or ~/…)")));
+    }
+    let real = match wanted {
+        Wanted::Read => asked.canonicalize().map_err(|_| Refusal::Invalid(format!("{path}: no such file")))?,
+        Wanted::Write => asked
+            .canonicalize()
+            .or_else(|_| resolve_unsaved(&asked))
+            .map_err(|e| Refusal::Invalid(format!("{path}: {e}")))?,
+    };
+    let plain = strip_verbatim(&real);
+    let cap = wanted.capability(plain.clone());
+    let mut covered = false;
+    for grant in granted {
+        let base = match (wanted, grant) {
+            (Wanted::Read, Capability::FsRead(base)) | (Wanted::Write, Capability::FsWrite(base)) => base,
+            _ => continue,
+        };
+        // The grant is compared where it really is too: `/tmp/x` is `/private/tmp/x`
+        // on macOS, and `~` is the home directory.
+        let base = match expand_tilde(base).canonicalize() {
+            Ok(real) => strip_verbatim(&real),
+            Err(_) => strip_verbatim(&expand_tilde(base)),
+        };
+        if !wanted.capability(base.clone()).covers(&cap) {
+            continue;
+        }
+        // A directory that is its own parent is a root: `/`, `C:\`.
+        if Path::new(&base).parent().is_none() {
+            return Err(Refusal::Invalid(format!(
+                "{plain}: {}:{base} covers a whole file system; declare a directory",
+                wanted.prefix()
+            )));
+        }
+        covered = true;
+    }
+    if covered { Ok(real) } else { Err(Refusal::Denied(cap.to_string())) }
+}
+
+/// Where `asked` would be created: its directory, resolved, plus its name.
+fn resolve_unsaved(asked: &Path) -> Result<PathBuf, String> {
+    let name = asked.file_name().ok_or_else(|| "not a file name".to_string())?;
+    let parent = asked.parent().ok_or_else(|| "no directory to put it in".to_string())?;
+    let dir = parent.canonicalize().map_err(|_| "its directory does not exist".to_string())?;
+    Ok(dir.join(name))
+}
+
+/// `\\?\C:\…` (what `canonicalize` returns on Windows) as `C:\…`.
+fn strip_verbatim(path: &Path) -> String {
+    let text = path.to_string_lossy();
+    text.strip_prefix(r"\\?\").unwrap_or(&text).to_owned()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -62,6 +284,57 @@ mod tests {
         assert!(read_text(&resolve_in_root(&root, "src").unwrap()).unwrap_err().contains("not a file"));
     }
 
+    #[test]
+    fn inside_root_covers_missing_paths() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("proj");
+        std::fs::create_dir_all(root.join("src")).unwrap();
+        std::fs::write(root.join("src/a.txt"), "hi").unwrap();
+        std::fs::write(tmp.path().join("secret.txt"), "s").unwrap();
+
+        assert!(inside_root(&root, "src/a.txt").unwrap());
+        assert!(inside_root(&root, "src").unwrap());
+        assert!(inside_root(&root, "missing.txt").unwrap());
+        assert!(inside_root(&root, "missing/deep/nested.txt").unwrap());
+        assert!(inside_root(&root, "missing/../src/a.txt").unwrap());
+        assert!(!inside_root(&root, "../secret.txt").unwrap());
+        assert!(!inside_root(&root, "missing/../../secret.txt").unwrap());
+        assert!(!inside_root(&root, "missing/sub/../../../secret.txt").unwrap());
+        let abs_out = tmp.path().join("secret.txt");
+        assert!(!inside_root(&root, abs_out.to_str().unwrap()).unwrap());
+        assert!(inside_root(&root, "").is_err());
+    }
+
+    #[test]
+    fn new_paths_are_confined_to_root() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("proj");
+        std::fs::create_dir_all(root.join("src")).unwrap();
+        let root_real = root.canonicalize().unwrap();
+
+        assert_eq!(resolve_new_in_root(&root, "src/new/a.txt").unwrap(), root_real.join("src/new/a.txt"));
+        assert_eq!(resolve_new_in_root(&root, "src/../b.txt").unwrap(), root_real.join("b.txt"));
+        assert!(resolve_new_in_root(&root, "../x.txt").unwrap_err().contains("outside"));
+        assert!(resolve_new_in_root(&root, "src/../../x.txt").unwrap_err().contains("outside"));
+        assert!(resolve_new_in_root(&root, "/etc/new.txt").is_err());
+        assert!(resolve_new_in_root(&root, "").is_err());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_symlink_is_named_not_followed() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("proj");
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::write(root.join("target.txt"), "t").unwrap();
+        std::os::unix::fs::symlink(root.join("target.txt"), root.join("link.txt")).unwrap();
+        std::os::unix::fs::symlink(tmp.path(), root.join("out")).unwrap();
+        let root_real = root.canonicalize().unwrap();
+
+        assert_eq!(resolve_new_in_root(&root, "link.txt").unwrap(), root_real.join("link.txt"));
+        assert!(resolve_new_in_root(&root, "out/x.txt").unwrap_err().contains("outside"));
+    }
+
     #[cfg(unix)]
     #[test]
     fn symlinks_cannot_escape() {
@@ -71,6 +344,11 @@ mod tests {
         std::fs::write(tmp.path().join("secret.txt"), "s").unwrap();
         std::os::unix::fs::symlink(tmp.path().join("secret.txt"), root.join("link")).unwrap();
         assert!(resolve_in_root(&root, "link").unwrap_err().contains("outside"));
+        assert!(!inside_root(&root, "link").unwrap());
+        assert!(!inside_root(&root, "link/../x").unwrap());
+        std::os::unix::fs::symlink(tmp.path(), root.join("dirlink")).unwrap();
+        assert!(!inside_root(&root, "dirlink/secret.txt").unwrap());
+        assert!(!inside_root(&root, "dirlink/missing.txt").unwrap());
     }
 
     #[test]
@@ -80,4 +358,128 @@ mod tests {
         let p = resolve_in_root(tmp.path(), "b.bin").unwrap();
         assert!(read_text(&p).unwrap_err().contains("UTF-8"));
     }
+
+    /// The grant a manifest author would write for `dir`: the plain path, no
+    /// `\\?\` prefix.
+    fn grant_for(dir: &Path) -> Capability {
+        Capability::FsRead(strip_verbatim(&dir.canonicalize().unwrap()))
+    }
+
+    fn text_at(dir: &Path, name: &str, body: &str) -> PathBuf {
+        let file = dir.join(name);
+        std::fs::write(&file, body).unwrap();
+        file.canonicalize().unwrap()
+    }
+
+    #[test]
+    fn a_file_outside_every_grant_is_denied_naming_the_capability() {
+        let tmp = tempfile::tempdir().unwrap();
+        let file = text_at(tmp.path(), "app.properties", "name=YonBIP\n");
+        let err = resolve_granted(&[], file.to_str().unwrap()).unwrap_err();
+        match err {
+            Refusal::Denied(cap) => assert!(cap.starts_with("fs.read:"), "{cap}"),
+            other => panic!("expected denied, got {other:?}"),
+        }
+        // A grant on another tree does not cover it either.
+        let elsewhere = tempfile::tempdir().unwrap();
+        let err = resolve_granted(&[grant_for(elsewhere.path())], file.to_str().unwrap()).unwrap_err();
+        assert!(matches!(err, Refusal::Denied(_)), "{err:?}");
+    }
+
+    #[test]
+    fn a_grant_covers_what_is_under_it_but_not_a_sibling_with_its_prefix() {
+        let tmp = tempfile::tempdir().unwrap();
+        let granted = tmp.path().join("seeyon");
+        std::fs::create_dir_all(granted.join("conf")).unwrap();
+        let file = text_at(&granted.join("conf"), "server.xml", "<server/>");
+        let cap = grant_for(&granted);
+
+        assert_eq!(resolve_granted(std::slice::from_ref(&cap), file.to_str().unwrap()).unwrap(), file);
+        // The directory itself, asked for explicitly, is covered too.
+        assert!(resolve_granted(std::slice::from_ref(&cap), granted.to_str().unwrap()).is_ok());
+
+        // `/x/seeyon` must not cover `/x/seeyon-old/app.properties`.
+        let sibling = tmp.path().join("seeyon-old");
+        std::fs::create_dir_all(&sibling).unwrap();
+        let other = text_at(&sibling, "app.properties", "x=1");
+        assert!(matches!(resolve_granted(&[cap], other.to_str().unwrap()), Err(Refusal::Denied(_))));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_grant_declared_through_a_symlinked_directory_covers_its_files() {
+        // `/tmp/tool` on macOS is `/private/tmp/tool`: the grant is resolved too.
+        let tmp = tempfile::tempdir().unwrap();
+        let real = tmp.path().join("real");
+        std::fs::create_dir_all(&real).unwrap();
+        let file = text_at(&real, "a.txt", "a");
+        let link = tmp.path().join("link");
+        std::os::unix::fs::symlink(&real, &link).unwrap();
+        let cap = Capability::FsRead(link.to_string_lossy().into_owned());
+        assert!(resolve_granted(std::slice::from_ref(&cap), link.join("a.txt").to_str().unwrap()).is_ok());
+        assert!(resolve_granted(&[cap], file.to_str().unwrap()).is_ok());
+    }
+
+    #[test]
+    fn a_granted_symlink_target_must_still_be_covered() {
+        // The grant is compared with the real path, so a link inside a granted
+        // tree cannot be used to read outside it.
+        let tmp = tempfile::tempdir().unwrap();
+        let granted = tmp.path().join("granted");
+        std::fs::create_dir_all(&granted).unwrap();
+        let secret = text_at(tmp.path(), "secret.txt", "s");
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink(&secret, granted.join("link")).unwrap();
+            let cap = grant_for(&granted);
+            let err = resolve_granted(&[cap], granted.join("link").to_str().unwrap()).unwrap_err();
+            assert!(matches!(err, Refusal::Denied(_)), "{err:?}");
+        }
+        #[cfg(windows)]
+        {
+            // Creating symlinks needs a privilege tests do not have; hard links
+            // to the same file are covered by the parent directory anyway, so
+            // only the textual check is exercised here.
+            let _ = secret;
+            assert!(resolve_granted(&[grant_for(&granted)], granted.to_str().unwrap()).is_ok());
+        }
+    }
+
+    #[test]
+    fn a_path_must_be_absolute_and_exist() {
+        let tmp = tempfile::tempdir().unwrap();
+        let cap = grant_for(tmp.path());
+        let err = resolve_granted(std::slice::from_ref(&cap), "app.properties").unwrap_err();
+        assert!(matches!(err, Refusal::Invalid(ref m) if m.contains("absolute")), "{err:?}");
+        let err = resolve_granted(&[cap], tmp.path().join("missing").to_str().unwrap()).unwrap_err();
+        assert!(matches!(err, Refusal::Invalid(ref m) if m.contains("no such file")), "{err:?}");
+    }
+
+    #[test]
+    fn a_root_grant_is_refused() {
+        let tmp = tempfile::tempdir().unwrap();
+        let file = text_at(tmp.path(), "a.txt", "hi");
+        #[cfg(windows)]
+        let cap = Capability::FsRead(format!("{}\\", std::env::var("SystemDrive").unwrap_or_else(|_| "C:".into())));
+        #[cfg(unix)]
+        let cap = Capability::FsRead("/".into());
+        let err = resolve_granted(&[cap], file.to_str().unwrap()).unwrap_err();
+        assert!(matches!(err, Refusal::Invalid(ref m) if m.contains("whole file system")), "{err:?}");
+    }
+
+    #[test]
+    fn a_tilde_starts_at_the_users_home() {
+        let home = std::env::var_os("HOME").or_else(|| std::env::var_os("USERPROFILE"));
+        if home.is_none() {
+            return;
+        }
+        let expanded = expand_tilde("~/app.properties");
+        assert!(expanded.is_absolute(), "{}", expanded.display());
+        assert!(expanded.starts_with(home.unwrap()));
+        assert_eq!(
+            expand_tilde("~"),
+            PathBuf::from(std::env::var_os("HOME").or_else(|| std::env::var_os("USERPROFILE")).unwrap())
+        );
+        assert_eq!(expand_tilde("relative/x"), PathBuf::from("relative/x"));
+    }
 }

crates/ide-plugin/src/types.rs

@@ -77,16 +77,19 @@ pub struct PickItem {
     pub description: Option<String>,
 }
 
-/// What a plugin asks the user (`ui.pick`, `ui.pick-many`, `ui.input`, `ui.confirm`).
+/// What a plugin asks the user (`ui.pick`, `ui.pick-many`, `ui.input`,
+/// `ui.input-multiline`, `ui.confirm`).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(tag = "kind", rename_all = "camelCase")]
 pub enum Prompt {
     #[serde(rename_all = "camelCase")]
     QuickPick { title: String, items: Vec<PickItem>, multiple: bool },
     #[serde(rename_all = "camelCase")]
-    Input { prompt: String, value: Option<String> },
+    Input { prompt: String, value: Option<String>, multiline: bool },
     #[serde(rename_all = "camelCase")]
     Confirm { title: String, message: String },
+    #[serde(rename_all = "camelCase")]
+    PickDirectory { title: String, initial: Option<String> },
 }
 
 /// Kinds of workbench events a plugin can subscribe to (`on-event:<kind>`).
@@ -210,6 +213,40 @@ pub struct RepositoryStatus {
     pub changed_files: u32,
 }
 
+/// A file a pending commit changes (WIT `commit.commit-change`).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct CommitChange {
+    pub repository: String,
+    pub path: String,
+    pub old_path: Option<String>,
+    /// `added`, `modified`, `deleted`, `renamed`, `copied` or `type-changed`.
+    pub status: String,
+    /// `git diff` of the included changes; `None` for binary content.
+    pub diff: Option<String>,
+    pub truncated: bool,
+}
+
+/// What Commit would commit (WIT `commit.commit-draft`).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct CommitDraft {
+    pub revision: u64,
+    pub message: String,
+    pub amend: bool,
+    pub changes: Vec<CommitChange>,
+}
+
+/// A problem a plugin's before-commit check reported (WIT `commit-checker.commit-problem`).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct CommitProblem {
+    pub message: String,
+    /// Absolute path of the file it is in, if any (IPC form).
+    pub path: Option<String>,
+    pub range: Option<ide_core::Range>,
+}
+
 /// Resource limits and supervision policy for plugin code.
 #[derive(Clone, Copy, Debug)]
 pub struct Limits {
@@ -315,6 +352,24 @@ pub struct ProcessOutput {
     pub stderr: String,
 }
 
+/// What to run: the approved file of `process:<program>`, its arguments and
+/// the environment to add to the inherited one (WIT `process.command`).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct ProcessCommand {
+    pub program: String,
+    pub args: Vec<String>,
+    pub env: Vec<(String, String)>,
+}
+
+/// What a kept-running program printed since the last read, and its exit
+/// status once it ended (WIT `process.chunk`).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct ProcessChunk {
+    pub stdout: String,
+    pub stderr: String,
+    pub status: Option<i32>,
+}
+
 /// Where `net:` requests may go: the URL's host when it is `https`, or
 /// `http` to the loopback interface.
 pub fn net_host(url: &str) -> Result<String, String> {
@@ -378,6 +433,15 @@ pub struct Location {
     pub range: ide_core::Range,
 }
 
+/// A symbol in the current project index. Ranges use UTF-16 columns.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SymbolInfo {
+    pub name: String,
+    pub kind: String,
+    pub container: Option<String>,
+    pub location: Location,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct CompletionItem {
     pub label: String,
@@ -407,8 +471,21 @@ pub struct CodeAction {
     pub kind: Option<String>,
     pub preferred: bool,
     pub edits: Vec<(PathBuf, Vec<ide_core::TextEdit>)>,
+    /// Applied before `edits`, in one workspace edit with them.
+    pub operations: Vec<FileOperation>,
+    /// Opened once the action is applied.
+    pub open: Option<PathBuf>,
     /// The plugin's reference: the edits come from `resolve_code_action`.
     pub data: Option<String>,
+    /// Listed by the `file-actions` export, which also resolves it.
+    pub file_action: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum FileOperation {
+    Create { path: PathBuf, text: String, overwrite: bool },
+    Rename { from: PathBuf, to: PathBuf },
+    Delete { path: PathBuf },
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -426,6 +503,22 @@ pub struct SemanticToken {
     pub modifiers: Vec<String>,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PluginHover {
+    pub markdown: String,
+    pub range: Option<ide_core::Range>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PluginInlayHint {
+    pub position: ide_core::Pos,
+    pub label: String,
+    pub kind: String,
+    pub tooltip: Option<String>,
+    pub padding_left: bool,
+    pub padding_right: bool,
+}
+
 // ---- declarative views (wit/views.wit) ---------------------------------------
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
@@ -461,6 +554,8 @@ pub struct ViewListItem {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase", tag = "kind", content = "value")]
 pub enum FieldValue {
+    Label(String),
+    ReadonlyText { text: String, multiline: bool },
     Text(String),
     Multiline(String),
     Checkbox(bool),
@@ -475,6 +570,14 @@ pub struct ViewField {
     pub value: FieldValue,
 }
 
+/// A sortable table's order: the column and the direction.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct TableSort {
+    pub column: u32,
+    pub descending: bool,
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub struct ViewTable {
@@ -483,6 +586,10 @@ pub struct ViewTable {
     pub first_row: u32,
     pub rows: Vec<Vec<String>>,
     pub editable: bool,
+    /// The plugin opted its headers in to click-to-sort (a `table` body through `other`).
+    pub sortable: bool,
+    /// The sort the plugin orders by (none: no arrow yet).
+    pub sort: Option<TableSort>,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
@@ -505,7 +612,7 @@ pub struct View {
     pub status: Option<String>,
 }
 
-/// A tab of the Services pane of a plugin's node (`service-provider.detail`).
+/// A tab of the Services pane of a plugin's node (`detail-provider.detail`).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub struct ServiceTab {
@@ -563,4 +670,28 @@ pub enum ViewEvent {
     InsertRow { before: u32 },
     DeleteRows { rows: Vec<u32> },
     Message { text: String },
+    // A sortable table's header click: the column and the direction (leaves
+    // as an `other` view-event, kind `sort`). See `TableSort`.
+    Sort { column: u32, descending: bool },
+    TableSelect { row: u32 },
+    TableActivate { row: u32 },
+}
+
+/// A plugin's HTTP route declaration in a project.
+#[derive(Clone, Debug)]
+pub struct Endpoint {
+    pub method: Option<String>,
+    pub path: String,
+    pub framework: String,
+    pub handler: Option<String>,
+    pub location: Location,
+}
+
+/// A notification button that runs one of the publishing plugin's commands.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct NotificationAction {
+    pub label: String,
+    pub command: String,
+    pub argument: Option<String>,
 }

crates/ide-plugin/src/wit_host.rs

@@ -5,7 +5,8 @@
 use crate::runtime::{MAX_TITLE, StoreData, clip};
 use crate::sandbox;
 use crate::types::{
-    EditorContext, EventKind, HostError, HttpRequest, NotificationLevel, PickItem, Prompt, StatusItem, net_host,
+    EditorContext, EventKind, HostError, HttpRequest, NotificationLevel, PickItem, ProcessChunk, ProcessCommand,
+    Prompt, StatusItem, net_host,
 };
 use ide_core::ipc_path::to_ipc;
 use ide_extension::Capability;
@@ -23,6 +24,7 @@ pub(crate) mod bindings {
             "openidea:plugin/editor.text-editor": super::EditorRes,
             "openidea:plugin/invocation.invocation": super::InvocationRes,
             "openidea:plugin/tasks.task": super::TaskRes,
+            "openidea:plugin/process.child": super::ChildRes,
         },
     });
 }
@@ -42,12 +44,14 @@ pub(crate) mod syntax_bindings {
             "openidea:plugin/editor": super::bindings::openidea::plugin::editor,
             "openidea:plugin/invocation": super::bindings::openidea::plugin::invocation,
             "openidea:plugin/vcs": super::bindings::openidea::plugin::vcs,
+            "openidea:plugin/commit": super::bindings::openidea::plugin::commit,
             "openidea:plugin/events": super::bindings::openidea::plugin::events,
             "openidea:plugin/tasks": super::bindings::openidea::plugin::tasks,
             "openidea:plugin/diagnostics": super::bindings::openidea::plugin::diagnostics,
             "openidea:plugin/net": super::bindings::openidea::plugin::net,
             "openidea:plugin/secrets": super::bindings::openidea::plugin::secrets,
             "openidea:plugin/process": super::bindings::openidea::plugin::process,
+            "openidea:plugin/fs": super::bindings::openidea::plugin::fs,
             "openidea:plugin/views": super::bindings::openidea::plugin::views,
             "openidea:plugin/settings": super::bindings::openidea::plugin::settings,
         },
@@ -69,12 +73,14 @@ pub(crate) mod providers_bindings {
             "openidea:plugin/editor": super::bindings::openidea::plugin::editor,
             "openidea:plugin/invocation": super::bindings::openidea::plugin::invocation,
             "openidea:plugin/vcs": super::bindings::openidea::plugin::vcs,
+            "openidea:plugin/commit": super::bindings::openidea::plugin::commit,
             "openidea:plugin/events": super::bindings::openidea::plugin::events,
             "openidea:plugin/tasks": super::bindings::openidea::plugin::tasks,
             "openidea:plugin/diagnostics": super::bindings::openidea::plugin::diagnostics,
             "openidea:plugin/net": super::bindings::openidea::plugin::net,
             "openidea:plugin/secrets": super::bindings::openidea::plugin::secrets,
             "openidea:plugin/process": super::bindings::openidea::plugin::process,
+            "openidea:plugin/fs": super::bindings::openidea::plugin::fs,
             "openidea:plugin/views": super::bindings::openidea::plugin::views,
             "openidea:plugin/settings": super::bindings::openidea::plugin::settings,
         },
@@ -96,12 +102,14 @@ pub(crate) mod views_bindings {
             "openidea:plugin/editor": super::bindings::openidea::plugin::editor,
             "openidea:plugin/invocation": super::bindings::openidea::plugin::invocation,
             "openidea:plugin/vcs": super::bindings::openidea::plugin::vcs,
+            "openidea:plugin/commit": super::bindings::openidea::plugin::commit,
             "openidea:plugin/events": super::bindings::openidea::plugin::events,
             "openidea:plugin/tasks": super::bindings::openidea::plugin::tasks,
             "openidea:plugin/diagnostics": super::bindings::openidea::plugin::diagnostics,
             "openidea:plugin/net": super::bindings::openidea::plugin::net,
             "openidea:plugin/secrets": super::bindings::openidea::plugin::secrets,
             "openidea:plugin/process": super::bindings::openidea::plugin::process,
+            "openidea:plugin/fs": super::bindings::openidea::plugin::fs,
             "openidea:plugin/views": super::bindings::openidea::plugin::views,
             "openidea:plugin/settings": super::bindings::openidea::plugin::settings,
         },
@@ -109,8 +117,8 @@ pub(crate) mod views_bindings {
 }
 
 use bindings::openidea::plugin::{
-    diagnostics, editor, events, invocation, log, net, process, secrets, settings, storage, tasks, types as wit, ui,
-    vcs, views, workspace,
+    commit, diagnostics, editor, events, fs, invocation, log, net, process, secrets, settings, storage, tasks,
+    types as wit, ui, vcs, views, workspace,
 };
 
 /// A project handle: its root.
@@ -118,6 +126,19 @@ pub struct ProjectRes {
     root: PathBuf,
 }
 
+/// A program a plugin started behind a handle (`process.start`); dropping the
+/// handle ends it if it still runs.
+pub struct ChildRes {
+    id: u64,
+    host: std::sync::Arc<dyn crate::HostApi>,
+}
+
+impl Drop for ChildRes {
+    fn drop(&mut self) {
+        self.host.release_process(self.id);
+    }
+}
+
 /// The invoking window's focused editor.
 pub struct EditorRes {
     ctx: EditorContext,
@@ -137,6 +158,15 @@ const MAX_FIND: u32 = 10_000;
 const MAX_STATUS_TEXT: usize = 128;
 const MAX_PICK_ITEMS: usize = 5000;
 const MAX_PICK_KEY: usize = 256;
+const MAX_ARGS: usize = 256;
+const MAX_ARG_BYTES: usize = 4096;
+const MAX_ENV: usize = 64;
+const MAX_ENV_NAME: usize = 256;
+const MAX_ENV_VALUE: usize = 4096;
+/// Most output one `poll` / `wait` hands out, per stream.
+const MAX_CHUNK: usize = 1 << 20;
+/// Most text one `write` puts into a process's stdin.
+const MAX_STDIN_BYTES: usize = 1 << 20;
 
 type Fallible<T> = wasmtime::Result<Result<T, wit::Error>>;
 
@@ -151,6 +181,14 @@ pub(crate) fn to_wit(e: HostError) -> wit::Error {
     }
 }
 
+fn notification_level(level: wit::NotificationLevel) -> NotificationLevel {
+    match level {
+        wit::NotificationLevel::Info => NotificationLevel::Info,
+        wit::NotificationLevel::Warning => NotificationLevel::Warning,
+        wit::NotificationLevel::Error => NotificationLevel::Error,
+    }
+}
+
 /// A guest's `error` as text (`denied: net:example.com`, `stale`, …).
 impl From<wit::Error> for crate::runtime::GuestError {
     fn from(e: wit::Error) -> Self {
@@ -182,6 +220,18 @@ impl StoreData {
         if self.granted.iter().any(|g| g.covers(&cap)) { Ok(()) } else { Err(wit::Error::Denied(cap.to_string())) }
     }
 
+    /// `path` as the real path an `fs.read:…` grant covers, or what the plugin
+    /// should be told instead (`denied` naming the capability to declare).
+    fn granted_file(&self, path: &str) -> Result<PathBuf, wit::Error> {
+        sandbox::resolve_granted(&self.granted, path).map_err(Into::into)
+    }
+
+    /// The same for `fs.write:…`: a file that does not exist yet is resolved
+    /// through the directory it would be created in.
+    fn writable_file(&self, path: &str) -> Result<PathBuf, wit::Error> {
+        sandbox::resolve_writable(&self.granted, path).map_err(Into::into)
+    }
+
     fn client(&self) -> Option<&str> {
         self.invocation.client.as_deref()
     }
@@ -220,8 +270,16 @@ impl StoreData {
     /// Asks the user and waits; the wait doesn't count against the call's
     /// wall-clock budget.
     fn ask(&mut self, prompt: Prompt) -> Result<Option<Vec<String>>, wit::Error> {
-        self.require_interactive()?;
-        let client = self.invocation.client.clone();
+        let client = match (&prompt, &self.action_prompt_client) {
+            (
+                Prompt::QuickPick { .. } | Prompt::Input { multiline: false, .. } | Prompt::Confirm { .. },
+                Some(client),
+            ) => Some(client.clone()),
+            _ => {
+                self.require_interactive()?;
+                self.invocation.client.clone()
+            }
+        };
         let started = Instant::now();
         let answer = self.host.ask(client.as_deref(), prompt, &self.cancel.token());
         let waited = started.elapsed();
@@ -253,7 +311,7 @@ impl StoreData {
         self.ask(Prompt::QuickPick { title: clip(title, MAX_TITLE), items, multiple })
     }
 
-    /// Dialogs belong to commands and events; rendering and providers have no one to ask.
+    /// APIs reserved for commands and events exclude code-action resolution.
     fn require_interactive(&self) -> Result<(), wit::Error> {
         if self.interactive {
             return Ok(());
@@ -263,19 +321,40 @@ impl StoreData {
 }
 
 impl ui::Host for StoreData {
+    fn notify(
+        &mut self,
+        level: wit::NotificationLevel,
+        title: String,
+        body: String,
+        actions: Vec<ui::NotificationAction>,
+    ) -> Fallible<()> {
+        const MAX_ACTIONS: usize = 3;
+        if actions.len() > MAX_ACTIONS {
+            return Ok(Err(wit::Error::Invalid(format!("a notification has at most {MAX_ACTIONS} actions"))));
+        }
+        let mut checked = Vec::with_capacity(actions.len());
+        for a in actions {
+            if a.label.trim().is_empty() || a.label.len() > 256 || a.label.chars().any(char::is_control) {
+                return Ok(Err(wit::Error::Invalid(format!("invalid action label {:?}", a.label))));
+            }
+            if a.argument.as_ref().is_some_and(|arg| arg.len() > 64 << 10) {
+                return Ok(Err(wit::Error::Invalid("an action argument is limited to 64 KiB".into())));
+            }
+            checked.push(crate::NotificationAction { label: a.label, command: a.command, argument: a.argument });
+        }
+        let (title, body) = (clip(title, MAX_TITLE), clip(body, 16 << 10));
+        Ok(self.host.notify(self.client(), notification_level(level), title, body, checked).map_err(to_wit))
+    }
+
     fn show_notification(
         &mut self,
         level: wit::NotificationLevel,
         title: String,
         body: String,
     ) -> wasmtime::Result<()> {
-        let level = match level {
-            wit::NotificationLevel::Info => NotificationLevel::Info,
-            wit::NotificationLevel::Warning => NotificationLevel::Warning,
-            wit::NotificationLevel::Error => NotificationLevel::Error,
-        };
-        let max = crate::runtime::MAX_TITLE;
-        self.host.notify(self.client(), level, clip(title, max), clip(body, 16 << 10));
+        let (title, body) = (clip(title, MAX_TITLE), clip(body, 16 << 10));
+        // A plain notification has nothing the host could refuse.
+        let _ = self.host.notify(self.client(), notification_level(level), title, body, Vec::new());
         Ok(())
     }
 
@@ -347,12 +426,35 @@ impl ui::Host for StoreData {
         Ok(answer.map(|keys| keys.and_then(|keys| keys.into_iter().next())))
     }
 
+    fn pick_directory(&mut self, title: String, initial: Option<String>) -> Fallible<Option<String>> {
+        if let Some(path) = &initial
+            && let Err(error) = validate_ui_path(path)
+        {
+            return Ok(Err(error));
+        }
+        let answer = self.ask(Prompt::PickDirectory { title: clip(title, MAX_TITLE), initial });
+        Ok(answer.and_then(|answer| {
+            let path = answer.and_then(|items| items.into_iter().next());
+            if let Some(path) = &path {
+                validate_ui_path(path)?;
+            }
+            Ok(path)
+        }))
+    }
+
     fn pick_many(&mut self, title: String, items: Vec<ui::PickItem>) -> Fallible<Option<Vec<String>>> {
         Ok(self.pick_prompt(title, items, true))
     }
 
     fn input(&mut self, prompt: String, value: Option<String>) -> Fallible<Option<String>> {
-        let prompt = Prompt::Input { prompt: clip(prompt, MAX_TITLE), value: value.map(|v| clip(v, 4096)) };
+        let prompt =
+            Prompt::Input { prompt: clip(prompt, MAX_TITLE), value: value.map(|v| clip(v, 4096)), multiline: false };
+        Ok(self.ask(prompt).map(|answer| answer.and_then(|text| text.into_iter().next())))
+    }
+
+    fn input_multiline(&mut self, prompt: String, value: Option<String>) -> Fallible<Option<String>> {
+        let prompt =
+            Prompt::Input { prompt: clip(prompt, MAX_TITLE), value: value.map(|v| clip(v, 4096)), multiline: true };
         Ok(self.ask(prompt).map(|answer| answer.and_then(|text| text.into_iter().next())))
     }
 
@@ -360,6 +462,10 @@ impl ui::Host for StoreData {
         let prompt = Prompt::Confirm { title: clip(title, MAX_TITLE), message: clip(body, 16 << 10) };
         Ok(self.ask(prompt).map(|answer| answer.is_some()))
     }
+
+    fn locale(&mut self) -> wasmtime::Result<String> {
+        Ok(self.host.locale())
+    }
 }
 
 impl storage::Host for StoreData {
@@ -393,6 +499,51 @@ impl storage::Host for StoreData {
 }
 
 impl workspace::Host for StoreData {
+    fn open_project(&mut self, path: String, new_window: bool) -> Fallible<()> {
+        if let Err(error) = self.require_interactive().and_then(|_| validate_ui_path(&path)) {
+            return Ok(Err(error));
+        }
+        let client = self.invocation.client.clone();
+        Ok(self.host.open_project(client.as_deref(), path, new_window).map_err(to_wit))
+    }
+
+    fn project_of(&mut self, path: String) -> wasmtime::Result<Option<Resource<ProjectRes>>> {
+        self.host.project_of(Path::new(&path)).map(|root| self.push(ProjectRes { root })).transpose()
+    }
+
+    fn symbols(
+        &mut self,
+        project: Resource<ProjectRes>,
+        query: String,
+        limit: u32,
+    ) -> Fallible<Vec<workspace::SymbolInfo>> {
+        if let Err(e) = self.require(Capability::ProjectRead) {
+            return Ok(Err(e));
+        }
+        if query.len() > 256 {
+            return Ok(Err(wit::Error::Invalid("symbol query exceeds 256 UTF-8 bytes".into())));
+        }
+        let root = &self.table.get(&project)?.root;
+        Ok(self
+            .host
+            .symbols(root, &query, limit.min(1000) as usize, &self.cancel.token(), self.deadline)
+            .map(|symbols| {
+                symbols
+                    .into_iter()
+                    .map(|s| workspace::SymbolInfo {
+                        name: s.name,
+                        kind: s.kind,
+                        container: s.container,
+                        location: wit::Location {
+                            path: to_ipc(&s.location.path),
+                            range: range_to_wit(&s.location.range),
+                        },
+                    })
+                    .collect()
+            })
+            .map_err(to_wit))
+    }
+
     fn projects(&mut self) -> Fallible<Vec<Resource<ProjectRes>>> {
         if let Err(e) = self.require(Capability::ProjectRead) {
             return Ok(Err(e));
@@ -421,7 +572,10 @@ impl workspace::HostProject for StoreData {
         let root = self.table.get(&this)?.root.clone();
         let real = match sandbox::resolve_in_root(&root, &path) {
             Ok(real) => real,
-            Err(e) => return Ok(Err(wit::Error::Invalid(e))),
+            Err(e) => {
+                let e = if e.ends_with("no such file") { wit::Error::NotFound(e) } else { wit::Error::Invalid(e) };
+                return Ok(Err(e));
+            }
         };
         if let Some(text) = self.host.buffer_text(&real) {
             return Ok(Ok(text));
@@ -429,6 +583,39 @@ impl workspace::HostProject for StoreData {
         Ok(sandbox::read_text(&real).map_err(wit::Error::Failed))
     }
 
+    fn exists(&mut self, this: Resource<ProjectRes>, path: String) -> Fallible<bool> {
+        if let Err(e) = self.require(Capability::ProjectRead) {
+            return Ok(Err(e));
+        }
+        let root = self.table.get(&this)?.root.clone();
+        match sandbox::inside_root(&root, &path) {
+            Err(e) => Ok(Err(wit::Error::Invalid(e))),
+            Ok(false) => {
+                Ok(Err(wit::Error::Invalid(format!("{path}: access outside the project root is not allowed"))))
+            }
+            Ok(true) => {
+                let requested = Path::new(&path);
+                let joined = if requested.is_absolute() { requested.to_path_buf() } else { root.join(requested) };
+                Ok(Ok(joined.exists()))
+            }
+        }
+    }
+
+    fn stat(&mut self, this: Resource<ProjectRes>, path: String) -> Fallible<workspace::FileStat> {
+        if let Err(e) = self.require(Capability::ProjectRead) {
+            return Ok(Err(e));
+        }
+        let root = self.table.get(&this)?.root.clone();
+        let real = match sandbox::resolve_in_root(&root, &path) {
+            Ok(real) => real,
+            Err(e) => {
+                let e = if e.ends_with("no such file") { wit::Error::NotFound(e) } else { wit::Error::Invalid(e) };
+                return Ok(Err(e));
+            }
+        };
+        Ok(file_stat(&real, &path))
+    }
+
     fn find_files(&mut self, this: Resource<ProjectRes>, glob: String, limit: u32) -> Fallible<Vec<String>> {
         if let Err(e) = self.require(Capability::ProjectRead) {
             return Ok(Err(e));
@@ -437,6 +624,27 @@ impl workspace::HostProject for StoreData {
         Ok(self.host.find_files(&root, &glob, limit.min(MAX_FIND) as usize).map_err(to_wit))
     }
 
+    fn write_file(&mut self, this: Resource<ProjectRes>, path: String, text: String) -> Fallible<()> {
+        if let Err(e) = self.require(Capability::ProjectWrite) {
+            return Ok(Err(e));
+        }
+        if text.len() > sandbox::MAX_WRITE_BYTES {
+            return Ok(Err(too_much_to_write(&path)));
+        }
+        let root = self.table.get(&this)?.root.clone();
+        let real = match sandbox::resolve_new_in_root(&root, &path) {
+            Ok(real) => real,
+            Err(e) => return Ok(Err(wit::Error::Invalid(e))),
+        };
+        // The directories it goes in are created, like a new file in the project view.
+        if let Some(parent) = real.parent()
+            && let Err(e) = std::fs::create_dir_all(parent)
+        {
+            return Ok(Err(wit::Error::Failed(format!("{path}: {e}"))));
+        }
+        Ok(self.host.write_text_file(&real, &text).map_err(to_wit))
+    }
+
     fn drop(&mut self, rep: Resource<ProjectRes>) -> wasmtime::Result<()> {
         self.table.delete(rep)?;
         Ok(())
@@ -571,6 +779,62 @@ impl vcs::Host for StoreData {
     }
 }
 
+impl commit::Host for StoreData {
+    fn pending_commit(&mut self) -> Fallible<Option<commit::CommitDraft>> {
+        if let Err(e) = self.require(Capability::VcsRead) {
+            return Ok(Err(e));
+        }
+        if let Err(e) = self.require_interactive() {
+            return Ok(Err(e));
+        }
+        // Waiting for the window (saving, diffing) doesn't count against the call's budget.
+        let client = self.invocation.client.clone();
+        let started = Instant::now();
+        let draft = self.host.pending_commit(client.as_deref(), &self.cancel.token());
+        let waited = started.elapsed();
+        self.deadline += waited;
+        self.call_started += waited;
+        Ok(draft.map(|d| d.map(commit_draft_to_wit)).map_err(to_wit))
+    }
+
+    fn set_commit_message(&mut self, revision: u64, message: String) -> Fallible<()> {
+        if let Err(e) = self.require(Capability::VcsWrite) {
+            return Ok(Err(e));
+        }
+        if let Err(e) = self.require_interactive() {
+            return Ok(Err(e));
+        }
+        if message.len() > MAX_COMMIT_MESSAGE {
+            return Ok(Err(wit::Error::Invalid(format!("a commit message is at most {MAX_COMMIT_MESSAGE} bytes"))));
+        }
+        let client = self.invocation.client.clone();
+        Ok(self.host.set_commit_message(client.as_deref(), revision, message).map_err(to_wit))
+    }
+}
+
+/// Longest commit message a plugin may set.
+const MAX_COMMIT_MESSAGE: usize = 64 << 10;
+
+pub(crate) fn commit_draft_to_wit(d: crate::types::CommitDraft) -> commit::CommitDraft {
+    commit::CommitDraft {
+        revision: d.revision,
+        message: d.message,
+        amend: d.amend,
+        changes: d
+            .changes
+            .into_iter()
+            .map(|c| commit::CommitChange {
+                repository: c.repository,
+                path: c.path,
+                old_path: c.old_path,
+                status: c.status,
+                diff: c.diff,
+                truncated: c.truncated,
+            })
+            .collect(),
+    }
+}
+
 impl events::Host for StoreData {
     fn subscribe(&mut self, kind: String) -> Fallible<()> {
         let Some(kind) = EventKind::parse(&kind) else {
@@ -581,14 +845,19 @@ impl events::Host for StoreData {
         {
             return Ok(Err(e));
         }
-        self.host.subscribe(kind, true);
+        self.host.subscribe(kind);
         Ok(Ok(()))
     }
 
-    fn unsubscribe(&mut self, kind: String) -> wasmtime::Result<()> {
-        if let Some(kind) = EventKind::parse(&kind) {
-            self.host.subscribe(kind, false);
+    fn subscribe_paths(&mut self, kind: String, globs: Vec<String>) -> Fallible<()> {
+        if let Err(e) = self.require(Capability::Events) {
+            return Ok(Err(e));
         }
+        Ok(self.host.subscribe_paths(&kind, globs).map_err(to_wit))
+    }
+
+    fn unsubscribe(&mut self, kind: String) -> wasmtime::Result<()> {
+        self.host.unsubscribe(&kind);
         Ok(())
     }
 }
@@ -653,26 +922,7 @@ impl diagnostics::Host for StoreData {
         if let Err(e) = self.require(Capability::ProjectRead) {
             return Ok(Err(e));
         }
-        let source = self.plugin_id.clone();
-        let items = items
-            .into_iter()
-            .take(MAX_DIAGNOSTICS)
-            .map(|d| ide_core::Diagnostic {
-                range: ide_core::Range::new(pos(d.range.start), pos(d.range.end)),
-                severity: match d.severity {
-                    diagnostics::Severity::Error => ide_core::Severity::Error,
-                    diagnostics::Severity::Warning => ide_core::Severity::Warning,
-                    diagnostics::Severity::Info => ide_core::Severity::Info,
-                    diagnostics::Severity::Hint => ide_core::Severity::Hint,
-                },
-                message: clip(d.message, 4096),
-                source: Some(d.source.map_or_else(|| source.clone(), |s| clip(s, 128))),
-                code: d.code.map(|c| clip(c, 128)),
-                unnecessary: d.tags.iter().any(|t| t == "unnecessary"),
-                deprecated: d.tags.iter().any(|t| t == "deprecated"),
-                server: Some(source.clone()),
-            })
-            .collect();
+        let items = diagnostics_from_wit(items, &self.plugin_id);
         Ok(self.host.publish_diagnostics(Path::new(&path), items).map_err(to_wit))
     }
 }
@@ -721,6 +971,45 @@ impl secrets::Host for StoreData {
     }
 }
 
+impl StoreData {
+    /// The `command` of `process.run-command` / `process.start`, checked: the
+    /// program is the one the user approved, the sizes stay in the limits.
+    fn command(&self, cmd: process::Command) -> Result<ProcessCommand, wit::Error> {
+        self.require(Capability::Process(cmd.program.clone()))?;
+        if cmd.args.len() > MAX_ARGS || cmd.args.iter().any(|a| a.len() > MAX_ARG_BYTES) {
+            return Err(wit::Error::Invalid(format!("at most {MAX_ARGS} arguments of at most {MAX_ARG_BYTES} bytes")));
+        }
+        if cmd.env.len() > MAX_ENV {
+            return Err(wit::Error::Invalid(format!("at most {MAX_ENV} environment variables")));
+        }
+        for (name, value) in &cmd.env {
+            if name.is_empty() || name.len() > MAX_ENV_NAME || name.contains(['=', '\0']) {
+                return Err(wit::Error::Invalid(format!("{name:?} is not an environment variable name")));
+            }
+            if value.len() > MAX_ENV_VALUE || value.contains('\0') {
+                return Err(wit::Error::Invalid(format!("the value of {name:?} is too long or holds a NUL")));
+            }
+        }
+        Ok(ProcessCommand { program: cmd.program, args: cmd.args, env: cmd.env })
+    }
+
+    /// The project a call runs in, when it named one.
+    fn cwd_of(&self, cwd: Option<Resource<ProjectRes>>) -> wasmtime::Result<Option<PathBuf>> {
+        Ok(match &cwd {
+            Some(p) => Some(self.table.get(p)?.root.clone()),
+            None => None,
+        })
+    }
+}
+
+fn to_chunk(chunk: ProcessChunk) -> process::Chunk {
+    process::Chunk { stdout: chunk.stdout, stderr: chunk.stderr, status: chunk.status }
+}
+
+fn to_output(output: crate::types::ProcessOutput) -> process::Output {
+    process::Output { status: output.status, stdout: output.stdout, stderr: output.stderr }
+}
+
 impl process::Host for StoreData {
     fn run(
         &mut self,
@@ -729,20 +1018,81 @@ impl process::Host for StoreData {
         cwd: Option<Resource<ProjectRes>>,
         stdin: Option<String>,
     ) -> Fallible<process::Output> {
-        if let Err(e) = self.require(Capability::Process(program.clone())) {
-            return Ok(Err(e));
-        }
-        let cwd = match &cwd {
-            Some(p) => Some(self.table.get(p)?.root.clone()),
-            None => None,
+        let cmd = match self.command(process::Command { program, args, env: Vec::new() }) {
+            Ok(cmd) => cmd,
+            Err(e) => return Ok(Err(e)),
         };
+        let cwd = self.cwd_of(cwd)?;
         let token = self.cancel.token();
         let timeout = self.remaining();
-        Ok(self
-            .host
-            .run_process(&program, args, cwd.as_deref(), stdin, &token, timeout)
-            .map(|o| process::Output { status: o.status, stdout: o.stdout, stderr: o.stderr })
-            .map_err(to_wit))
+        Ok(self.host.run_process(cmd, cwd.as_deref(), stdin, &token, timeout).map(to_output).map_err(to_wit))
+    }
+
+    fn run_command(
+        &mut self,
+        cmd: process::Command,
+        cwd: Option<Resource<ProjectRes>>,
+        stdin: Option<String>,
+    ) -> Fallible<process::Output> {
+        let cmd = match self.command(cmd) {
+            Ok(cmd) => cmd,
+            Err(e) => return Ok(Err(e)),
+        };
+        let cwd = self.cwd_of(cwd)?;
+        let token = self.cancel.token();
+        let timeout = self.remaining();
+        Ok(self.host.run_process(cmd, cwd.as_deref(), stdin, &token, timeout).map(to_output).map_err(to_wit))
+    }
+
+    fn start(&mut self, cmd: process::Command, cwd: Option<Resource<ProjectRes>>) -> Fallible<Resource<ChildRes>> {
+        let cmd = match self.command(cmd) {
+            Ok(cmd) => cmd,
+            Err(e) => return Ok(Err(e)),
+        };
+        let cwd = self.cwd_of(cwd)?;
+        let id = match self.host.start_process(cmd, cwd.as_deref(), self.invocation.client.as_deref()) {
+            Ok(id) => id,
+            Err(e) => return Ok(Err(to_wit(e))),
+        };
+        self.push(ChildRes { id, host: self.host.clone() }).map(Ok)
+    }
+}
+
+impl process::HostChild for StoreData {
+    fn poll(&mut self, this: Resource<ChildRes>, max_bytes: u32) -> Fallible<process::Chunk> {
+        let id = self.table.get(&this)?.id;
+        let max = (max_bytes as usize).min(MAX_CHUNK);
+        Ok(self.host.poll_process(id, max).map(to_chunk).map_err(to_wit))
+    }
+
+    fn wait(&mut self, this: Resource<ChildRes>, timeout_ms: u32) -> Fallible<process::Chunk> {
+        let id = self.table.get(&this)?.id;
+        let timeout = Duration::from_millis(u64::from(timeout_ms)).min(self.remaining());
+        let token = self.cancel.token();
+        Ok(self.host.wait_process(id, MAX_CHUNK, timeout, &token).map(to_chunk).map_err(to_wit))
+    }
+
+    fn write(&mut self, this: Resource<ChildRes>, text: String) -> Fallible<()> {
+        if text.len() > MAX_STDIN_BYTES {
+            return Ok(Err(wit::Error::Invalid(format!("at most {MAX_STDIN_BYTES} bytes at a time"))));
+        }
+        let id = self.table.get(&this)?.id;
+        Ok(self.host.write_process(id, &text, &self.cancel.token(), self.remaining()).map_err(to_wit))
+    }
+
+    fn close_stdin(&mut self, this: Resource<ChildRes>) -> Fallible<()> {
+        let id = self.table.get(&this)?.id;
+        Ok(self.host.close_process_stdin(id).map_err(to_wit))
+    }
+
+    fn kill(&mut self, this: Resource<ChildRes>) -> Fallible<()> {
+        let id = self.table.get(&this)?.id;
+        Ok(self.host.kill_process(id).map_err(to_wit))
+    }
+
+    fn drop(&mut self, rep: Resource<ChildRes>) -> wasmtime::Result<()> {
+        self.table.delete(rep)?;
+        Ok(())
     }
 }
 
@@ -805,8 +1155,125 @@ impl settings::Host for StoreData {
 
 impl views_bindings::openidea::plugin::view_types::Host for StoreData {}
 
+fn file_kind(t: std::fs::FileType) -> workspace::FileKind {
+    if t.is_file() {
+        workspace::FileKind::File
+    } else if t.is_dir() {
+        workspace::FileKind::Directory
+    } else if t.is_symlink() {
+        workspace::FileKind::Symlink
+    } else {
+        workspace::FileKind::Other
+    }
+}
+
+/// `project.stat` and `fs.stat`: the metadata of `real`, named `shown` in errors.
+fn file_stat(real: &Path, shown: &str) -> Result<workspace::FileStat, wit::Error> {
+    let meta = std::fs::symlink_metadata(real).map_err(|e| match e.kind() {
+        std::io::ErrorKind::NotFound => wit::Error::NotFound(format!("{shown}: no such file")),
+        _ => wit::Error::Failed(e.to_string()),
+    })?;
+    let modified = meta.modified().ok().and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok()).map(|d| d.as_secs());
+    Ok(workspace::FileStat { kind: file_kind(meta.file_type()), size: meta.len(), modified })
+}
+
+/// A refused `fs` call as the plugin sees it: `denied` carries the capability
+/// string, so the plugin can say exactly what its manifest lacks.
+impl From<sandbox::Refusal> for wit::Error {
+    fn from(refusal: sandbox::Refusal) -> Self {
+        match refusal {
+            sandbox::Refusal::Denied(cap) => Self::Denied(cap),
+            sandbox::Refusal::Invalid(message) => Self::Invalid(message),
+        }
+    }
+}
+
+/// Files outside the open projects, gated by `fs.read:<path>` and
+/// `fs.write:<path>` grants.
+impl fs::Host for StoreData {
+    fn read_file(&mut self, path: String) -> Fallible<String> {
+        let real = match self.granted_file(&path) {
+            Ok(real) => real,
+            Err(e) => return Ok(Err(e)),
+        };
+        Ok(self.host.read_text_file(&real, sandbox::MAX_READ_BYTES as usize).map_err(to_wit))
+    }
+
+    fn read_bytes(&mut self, path: String) -> Fallible<Vec<u8>> {
+        use std::io::Read;
+        let real = match self.granted_file(&path) {
+            Ok(real) => real,
+            Err(e) => return Ok(Err(e)),
+        };
+        let max = sandbox::MAX_READ_BYTES;
+        let read = std::fs::File::open(&real).and_then(|file| {
+            let mut bytes = Vec::new();
+            // One byte over: a file that grew past the limit is refused, not truncated.
+            file.take(max + 1).read_to_end(&mut bytes).map(|_| bytes)
+        });
+        Ok(match read {
+            Ok(bytes) if bytes.len() as u64 > max => {
+                Err(wit::Error::Invalid(format!("{path}: larger than {} MiB", max >> 20)))
+            }
+            Ok(bytes) => Ok(bytes),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                Err(wit::Error::NotFound(format!("{path}: no such file")))
+            }
+            Err(e) => Err(wit::Error::Failed(format!("{path}: {e}"))),
+        })
+    }
+
+    fn stat(&mut self, path: String) -> Fallible<workspace::FileStat> {
+        Ok(self.granted_file(&path).and_then(|real| file_stat(&real, &path)))
+    }
+
+    fn read_dir(&mut self, path: String) -> Fallible<Vec<fs::DirEntry>> {
+        let real = match self.granted_file(&path) {
+            Ok(real) => real,
+            Err(e) => return Ok(Err(e)),
+        };
+        let read = match std::fs::read_dir(&real) {
+            Ok(read) => read,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                return Ok(Err(wit::Error::NotFound(format!("{path}: no such directory"))));
+            }
+            Err(_) if real.is_file() => return Ok(Err(wit::Error::Invalid(format!("{path}: not a directory")))),
+            Err(e) => return Ok(Err(wit::Error::Failed(format!("{path}: {e}")))),
+        };
+        let mut entries: Vec<fs::DirEntry> = read
+            .flatten()
+            .take(sandbox::MAX_LIST_ENTRIES)
+            .map(|e| fs::DirEntry {
+                name: e.file_name().to_string_lossy().into_owned(),
+                kind: e.file_type().map_or(workspace::FileKind::Other, file_kind),
+            })
+            .collect();
+        // Sorted, so what a plugin picks doesn't depend on the disk's order.
+        entries.sort_by(|a, b| a.name.cmp(&b.name));
+        Ok(Ok(entries))
+    }
+
+    fn write_file(&mut self, path: String, text: String) -> Fallible<()> {
+        if text.len() > sandbox::MAX_WRITE_BYTES {
+            return Ok(Err(too_much_to_write(&path)));
+        }
+        Ok(self.writable_file(&path).and_then(|real| self.host.write_text_file(&real, &text).map_err(to_wit)))
+    }
+
+    fn write_bytes(&mut self, path: String, bytes: Vec<u8>) -> Fallible<()> {
+        if bytes.len() > sandbox::MAX_WRITE_BYTES {
+            return Ok(Err(too_much_to_write(&path)));
+        }
+        Ok(self.writable_file(&path).and_then(|real| self.host.write_bytes_file(&real, &bytes).map_err(to_wit)))
+    }
+}
+
+fn too_much_to_write(path: &str) -> wit::Error {
+    wit::Error::Invalid(format!("{path}: more than {} MiB to write", sandbox::MAX_WRITE_BYTES >> 20))
+}
+
 /// Largest message between a plugin and its view's frame.
-const MAX_VIEW_MESSAGE: usize = 1 << 20;
+const MAX_VIEW_MESSAGE: usize = 8 << 20;
 
 pub(crate) mod indexing_bindings {
     wasmtime::component::bindgen!({
@@ -815,10 +1282,10 @@ pub(crate) mod indexing_bindings {
     });
 }
 
-/// The optional `service-provider` export.
-pub(crate) mod services_bindings {
+/// The optional `detail-provider` export.
+pub(crate) mod details_bindings {
     wasmtime::component::bindgen!({
-        world: "services", path: "../../wit",
+        world: "details", path: "../../wit",
         with: {
             "openidea:plugin/types": super::bindings::openidea::plugin::types,
             "openidea:plugin/workspace": super::bindings::openidea::plugin::workspace,
@@ -828,9 +1295,118 @@ pub(crate) mod services_bindings {
     });
 }
 
+/// The optional `commit-checker` export.
+pub(crate) mod commit_checks_bindings {
+    wasmtime::component::bindgen!({
+        world: "commit-checks", path: "../../wit",
+        with: {
+            "openidea:plugin/types": super::bindings::openidea::plugin::types,
+            "openidea:plugin/workspace": super::bindings::openidea::plugin::workspace,
+            "openidea:plugin/editor": super::bindings::openidea::plugin::editor,
+            "openidea:plugin/invocation": super::bindings::openidea::plugin::invocation,
+            "openidea:plugin/commit": super::bindings::openidea::plugin::commit,
+        },
+    });
+}
+
 pub(crate) mod semantic_bindings {
     wasmtime::component::bindgen!({
         world: "semantic-tokens", path: "../../wit",
         with: { "openidea:plugin/types": super::bindings::openidea::plugin::types },
     });
 }
+
+pub(crate) mod hover_bindings {
+    wasmtime::component::bindgen!({
+        world: "hover", path: "../../wit",
+        with: { "openidea:plugin/types": super::bindings::openidea::plugin::types },
+    });
+}
+
+pub(crate) mod inlay_bindings {
+    wasmtime::component::bindgen!({
+        world: "inlay-hints", path: "../../wit",
+        with: { "openidea:plugin/types": super::bindings::openidea::plugin::types },
+    });
+}
+
+pub(crate) mod endpoints_bindings {
+    wasmtime::component::bindgen!({
+        world: "endpoints", path: "../../wit",
+        with: {
+            "openidea:plugin/types": super::bindings::openidea::plugin::types,
+            "openidea:plugin/workspace": super::bindings::openidea::plugin::workspace,
+            "openidea:plugin/editor": super::bindings::openidea::plugin::editor,
+            "openidea:plugin/invocation": super::bindings::openidea::plugin::invocation,
+        },
+    });
+}
+
+/// The optional `file-actions` export.
+pub(crate) mod file_actions_bindings {
+    wasmtime::component::bindgen!({
+        world: "file-actions-provider", path: "../../wit",
+        with: { "openidea:plugin/types": super::bindings::openidea::plugin::types },
+    });
+}
+
+/// Paths belong to the UI machine, which can have a different OS than the plugin host.
+fn validate_ui_path(path: &str) -> Result<(), wit::Error> {
+    let b = path.as_bytes();
+    let absolute = path.starts_with('/')
+        || path.starts_with("\\\\")
+        || (b.first().is_some_and(u8::is_ascii_alphabetic)
+            && b.get(1) == Some(&b':')
+            && matches!(b.get(2), Some(b'/' | b'\\')));
+    if !absolute || path.len() > 8192 || path.chars().any(char::is_control) {
+        return Err(wit::Error::Invalid("expected an absolute UI directory path of at most 8192 bytes".into()));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod project_ui_tests {
+    use super::validate_ui_path;
+    #[test]
+    fn validates_ui_paths_without_using_the_plugin_hosts_os() {
+        for path in ["/work/repo", "C:/work/repo", r"C:\work\repo", r"\\server\share\repo"] {
+            assert!(validate_ui_path(path).is_ok(), "{path:?}");
+        }
+        for path in ["repo", "C:repo", "/bad\npath", ""] {
+            assert!(validate_ui_path(path).is_err(), "{path:?}");
+        }
+        assert!(validate_ui_path(&format!("/{}", "x".repeat(8192))).is_err());
+    }
+}
+
+pub(crate) mod diagnostics_bindings {
+    wasmtime::component::bindgen!({
+        world: "editor-diagnostics", path: "../../wit",
+        with: {
+            "openidea:plugin/types": super::bindings::openidea::plugin::types,
+            "openidea:plugin/diagnostics": super::bindings::openidea::plugin::diagnostics,
+        },
+    });
+}
+
+pub(crate) fn diagnostics_from_wit(items: Vec<diagnostics::Diagnostic>, source: &str) -> Vec<ide_core::Diagnostic> {
+    items
+        .into_iter()
+        .take(MAX_DIAGNOSTICS)
+        .map(|d| ide_core::Diagnostic {
+            range: ide_core::Range::new(pos(d.range.start), pos(d.range.end)),
+            severity: match d.severity {
+                diagnostics::Severity::Error => ide_core::Severity::Error,
+                diagnostics::Severity::Warning => ide_core::Severity::Warning,
+                diagnostics::Severity::Info => ide_core::Severity::Info,
+                diagnostics::Severity::Hint => ide_core::Severity::Hint,
+            },
+            message: clip(d.message, 4096),
+            source: Some(d.source.map_or_else(|| source.to_owned(), |s| clip(s, 128))),
+            code: d.code.map(|c| clip(c, 128)),
+            unnecessary: d.tags.iter().any(|t| t == "unnecessary"),
+            deprecated: d.tags.iter().any(|t| t == "deprecated"),
+            server: Some(source.to_owned()),
+        })
+        .collect()
+}

crates/ide-plugin/tests/api_compat.rs

@@ -29,6 +29,10 @@ fn components() -> Vec<PathBuf> {
         repo().join("crates/ide-plugin/tests/fixtures/hello/dist/plugin.wasm"),
         repo().join("crates/ide-plugin/tests/fixtures/indexer/dist/plugin.wasm"),
         repo().join("crates/ide-plugin/tests/fixtures/semantic-tokens/dist/plugin.wasm"),
+        repo().join("crates/ide-plugin/tests/fixtures/hover/dist/plugin.wasm"),
+        repo().join("crates/ide-plugin/tests/fixtures/diagnostics/dist/plugin.wasm"),
+        repo().join("crates/ide-plugin/tests/fixtures/inlay-hints/dist/plugin.wasm"),
+        repo().join("crates/ide-plugin/tests/fixtures/symbols/dist/plugin.wasm"),
     ];
     let official = repo().join("plugins/official");
     let mut dirs: Vec<_> = std::fs::read_dir(&official).unwrap().map(|e| e.unwrap().path()).collect();

crates/ide-plugin/tests/fixtures/commit/Cargo.lock

@@ -0,0 +1,333 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "equivalent"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "log"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
+
+[[package]]
+name = "macro-string"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e7b3a5bbb2f63aaa223a671ea1bd0e7bc16bd30ce387324cf63995deaddbbd2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "openidea-plugin"
+version = "0.1.0"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "openidea-test-commit"
+version = "0.1.0"
+dependencies = [
+ "openidea-plugin",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "wasm-encoder"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c86ff6668190d9fb70372b306b4f9fe8930f0e2f57ce72e4922bf2f117900949"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
+dependencies = [
+ "bitflags",
+ "hashbrown",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b85a987ab61d365382d25c7d47e26edd48941b3bf6e3fbf76eff918bc71dab06"
+dependencies = [
+ "bitflags",
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "775e122e390603abfacd548027016cd0113a6e2bf2f8ce6bdd3658b013456ea8"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84e26e13b9d972026778d2ffb7985736de116026fdc8d9464f966e12df2eb240"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a008a0d6b4840677326beb4edbeb210a2f1b7d0183fb7cc33f466b90fd7fb6"
+dependencies = [
+ "anyhow",
+ "macro-string",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "078def49fdb49cab405c3006e05793b3fdaf7069126ba6b9c97d01ec8c98fe4c"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.262.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00f0dc051466ffe46787721fca3d088536f158ae400be044f1b1c386ba9397ad"
+dependencies = [
+ "anyhow",
+ "hashbrown",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-ident",
+ "wasmparser",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

crates/ide-plugin/tests/fixtures/commit/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "openidea-test-commit"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[workspace]
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+openidea-plugin = { path = "../../../../../sdk/rust/openidea-plugin" }
+
+[profile.release]
+opt-level = "s"
+lto = true
+strip = true
+codegen-units = 1
+panic = "abort"

crates/ide-plugin/tests/fixtures/commit/README.md

@@ -0,0 +1,9 @@
+# Commit test fixture
+
+`Describe Changes` (in the `commit.message` toolbar) reads the commit being
+prepared and writes a message listing its files; the `markers` before-commit
+check reports a message without a `type: ` prefix and every `DO NOT COMMIT`
+added by the commit.
+
+Used by `cargo test -p ide-host --test plugin_commit` to exercise the `commit`
+interface and the optional `commit-checker` export. It is not a marketplace plugin.

crates/ide-plugin/tests/fixtures/commit/dist/plugin.wasm.sources

@@ -0,0 +1 @@
+24726dac5ce264f5d451956def099e0002ec721e4828bc7852ad1dcabcb4bcba

crates/ide-plugin/tests/fixtures/commit/plugin.toml

@@ -0,0 +1,21 @@
+id = "test.commit"
+name = "Commit fixture"
+version = "0.1.0"
+engines.openidea = "^1.3"
+wasm = "dist/plugin.wasm"
+activation = ["on-command:*"]
+
+[capabilities]
+required = ["vcs.read", "vcs.write"]
+
+[[contributes.commands]]
+id = "describe"
+title = "Commit Fixture: Describe Changes"
+
+[[contributes.menus]]
+menu = "commit.message"
+command = "describe"
+
+[[contributes.commitChecks]]
+id = "markers"
+title = "Commit Markers"

crates/ide-plugin/tests/fixtures/commit/src/lib.rs

@@ -0,0 +1,57 @@
+use openidea_plugin::commit::{CommitChecks, CommitProblem};
+use openidea_plugin::{CommitDraft, Error, Invocation, Location, Plugin, Position, Range, host, register_plugin};
+
+#[derive(Default)]
+struct Fixture;
+
+impl Plugin for Fixture {
+    fn run_command(&mut self, id: &str, _: &Invocation, _: Option<&str>) -> Result<Option<String>, Error> {
+        if id != "describe" {
+            return Err(Error::NotFound(id.into()));
+        }
+        let draft = host::pending_commit()?.ok_or("no repository")?;
+        let names: Vec<String> = draft
+            .changes
+            .iter()
+            .map(|c| format!("{} {}", c.status, c.path.rsplit('/').next().unwrap_or(&c.path)))
+            .collect();
+        let message = format!("chore: {}", names.join(", "));
+        host::set_commit_message(draft.revision, &message)?;
+        Ok(Some(message))
+    }
+}
+
+impl CommitChecks for Fixture {
+    fn check(&mut self, check: &str, draft: &CommitDraft, _: &Invocation) -> Result<Vec<CommitProblem>, Error> {
+        if check != "markers" {
+            return Err(Error::NotFound(check.into()));
+        }
+        let mut problems = Vec::new();
+        if !draft.message.split_once(": ").is_some_and(|(t, _)| !t.is_empty() && !t.contains(' ')) {
+            problems.push(CommitProblem::new("The message does not start with `type: `."));
+        }
+        for change in &draft.changes {
+            let Some(diff) = &change.diff else { continue };
+            let mut line = 0u32;
+            for l in diff.lines() {
+                if let Some(hunk) = l.strip_prefix("@@ -") {
+                    // `@@ -a,b +c,d @@`: c is the 1-based first line of the new side.
+                    let new = hunk.split(" +").nth(1).and_then(|s| s.split([',', ' ']).next());
+                    line = new.and_then(|n| n.parse::<u32>().ok()).unwrap_or(1).saturating_sub(1);
+                } else if l.starts_with('+') && !l.starts_with("+++") {
+                    if l.contains("DO NOT COMMIT") {
+                        let at = Position::new(line, 0);
+                        let location = Location { path: change.path.clone(), range: Range::new(at, at) };
+                        problems.push(CommitProblem::new("Remove the DO NOT COMMIT marker.").at(location));
+                    }
+                    line += 1;
+                } else if !l.starts_with('-') {
+                    line += 1;
+                }
+            }
+        }
+        Ok(problems)
+    }
+}
+
+register_plugin!(Fixture, commit_checks);