ci: run the Maven launch classpath smoke for the runner JDK (#3273)

maven_launch_classpath_uses_the_runner_jdk_classifier (#2929) is an ignored project smoke test that CI never ran: add it to the java job's project_smoke step.

.github/tool-versions.env

@@ -7,7 +7,7 @@ BASEDPYRIGHT=1.40.2
 RUFF=0.17.3
 GOPLS=v0.24.0
 JDTLS=1.63.0-202610191322
-KOTLIN_LSP=263.7084.0
+KOTLIN_LSP=271.2085.0
 GRADLE=8.14.3
 INTELEPHENSE=1.18.5
 # The JDK projects compile against (JAVA_HOME): library navigation opens its sources.

.github/workflows/language-smoke.yml

@@ -119,7 +119,7 @@ jobs:
       - run: cargo test --locked -p ide-host --test language_smoke --no-run
       - run: cargo test --locked -p ide-host --test language_smoke -- --ignored --exact ${{ matrix.language }}
       - if: matrix.language == 'java'
-        run: cargo test --locked -p ide-host --test project_smoke -- --ignored --exact maven_sync jdk
+        run: cargo test --locked -p ide-host --test project_smoke -- --ignored --exact maven_sync jdk maven_launch_classpath_uses_the_runner_jdk_classifier
       - if: matrix.language == 'kotlin'
         run: cargo test --locked -p ide-host --test project_smoke -- --ignored --exact gradle_sync
       - if: matrix.language == 'python'

crates/ide-core/src/settings.rs

@@ -291,7 +291,7 @@ pub enum NewTaskApprovals {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
 pub struct McpServerSettings {
-    /// Serve the tools on 127.0.0.1 while the IDE runs.
+    /// Serve the tools on [`Self::address`] while the IDE runs.
     pub enabled: bool,
     /// Run the tools that change the project or start processes without asking first
     /// (IDEA's brave mode). Read from the IDE's own settings only, never a project's.
@@ -300,6 +300,9 @@ pub struct McpServerSettings {
     pub agent_tab_limit: u32,
     /// Archived agent tabs kept; older ones are closed.
     pub agent_archive_limit: u32,
+    /// The IP address to listen on: `127.0.0.1` (this computer only, the default), another
+    /// address of this computer, or `0.0.0.0` / `::` for every address.
+    pub address: String,
     /// Listen on [`Self::port`] in every run, rather than a free port each time, so HTTP clients and
     /// port forwards keep working after a restart.
     pub fixed_port: bool,
@@ -312,6 +315,8 @@ pub struct McpServerSettings {
 
 /// The default of [`McpServerSettings::port`].
 pub const DEFAULT_MCP_PORT: u16 = 26371;
+/// The default of [`McpServerSettings::address`]: this computer only.
+pub const DEFAULT_MCP_ADDRESS: &str = "127.0.0.1";
 
 impl Default for McpServerSettings {
     fn default() -> Self {
@@ -320,6 +325,7 @@ impl Default for McpServerSettings {
             run_without_confirmation: false,
             agent_tab_limit: 1,
             agent_archive_limit: 999,
+            address: DEFAULT_MCP_ADDRESS.to_owned(),
             fixed_port: true,
             port: DEFAULT_MCP_PORT,
             fixed_token: false,

crates/ide-db/src/lib.rs

@@ -324,6 +324,17 @@ fn group_foreign_keys(rows: Vec<Vec<Option<String>>>, tables: &[CompletionTable]
 /// Connection target: a data source id (its configured database), or
 /// `<id>:<database>` for another database of the same server. Data source ids
 /// never contain `:`.
+/// Snowflake is HTTPS to a named host: a tunnel's local end cannot pass its certificate check.
+fn tunneled(driver: DbDriver) -> bool {
+    !matches!(driver, DbDriver::Sqlite | DbDriver::Snowflake)
+}
+
+/// The database host and port the SSH host forwards to.
+fn tunnel_target(source: &DataSource) -> (&str, u16) {
+    let port = source.port.or(source.driver.default_port()).unwrap_or_default();
+    (if source.host.trim().is_empty() { "localhost" } else { source.host.trim() }, port)
+}
+
 pub fn split_target(target: &str) -> (&str, Option<&str>) {
     match target.split_once(':') {
         Some((id, db)) if !db.is_empty() => (id, Some(db)),
@@ -655,9 +666,7 @@ impl DbManager {
         ssh_secret: Option<String>,
         shared: bool,
     ) -> IdeResult<(DataSource, Option<Arc<Tunnel>>)> {
-        // Snowflake is HTTPS to a named host: a tunnel's local end cannot pass its certificate check.
-        let tunneled = !matches!(source.driver, DbDriver::Sqlite | DbDriver::Snowflake);
-        let Some(ssh) = source.ssh.as_ref().filter(|s| s.enabled && tunneled) else {
+        let Some(ssh) = source.ssh.as_ref().filter(|s| s.enabled && tunneled(source.driver)) else {
             return Ok((source.clone(), None));
         };
         let local = |t: &Tunnel| DataSource { host: "127.0.0.1".into(), port: Some(t.port()), ..source.clone() };
@@ -668,8 +677,25 @@ impl DbManager {
                 return Ok((local(&t), Some(t)));
             }
         }
+        let session = self.ssh_session(source, ssh, ssh_secret).await?;
+        let (target_host, target_port) = tunnel_target(source);
+        let t = Arc::new(Tunnel::open(session, target_host, target_port).await?);
+        if shared {
+            self.tunnels.lock().insert(source.id.clone(), t.clone());
+        }
+        Ok((local(&t), Some(t)))
+    }
+
+    /// The SSH session the tunnel of `source` goes through: its shared SSH configuration's, or one
+    /// opened with the settings typed in the data source.
+    async fn ssh_session(
+        &self,
+        source: &DataSource,
+        ssh: &DbSsh,
+        ssh_secret: Option<String>,
+    ) -> IdeResult<Arc<ide_ssh::Session>> {
         let config = ssh.config.trim();
-        let session = if config.is_empty() {
+        Ok(if config.is_empty() {
             let secret = match ssh_secret {
                 Some(s) => Some(s),
                 None => self.secret(source, secrets::ssh_key(&source.id), ssh.save_secret).await,
@@ -688,14 +714,22 @@ impl DbManager {
                 self.ssh.set_secret(config, Some(s), save);
             }
             self.ssh.session(config).await?
-        };
-        let target_port = source.port.or(source.driver.default_port()).unwrap_or_default();
-        let target_host = if source.host.trim().is_empty() { "localhost" } else { source.host.trim() };
-        let t = Arc::new(Tunnel::open(session, target_host, target_port).await?);
-        if shared {
-            self.tunnels.lock().insert(source.id.clone(), t.clone());
-        }
-        Ok((local(&t), Some(t)))
+        })
+    }
+
+    /// Data Source › SSH/SSL › Test SSH Tunnel: logs in to the SSH host and checks that it reaches
+    /// the database host and port, without logging in to the database.
+    pub async fn test_tunnel(&self, source: &DataSource, ssh_secret: Option<String>) -> IdeResult<String> {
+        let source = &source.resolved()?;
+        let ssh = source
+            .ssh
+            .as_ref()
+            .filter(|s| s.enabled && tunneled(source.driver))
+            .ok_or_else(|| IdeError::invalid("This data source does not use an SSH tunnel"))?;
+        let session = self.ssh_session(source, ssh, ssh_secret).await?;
+        let (host, port) = tunnel_target(source);
+        drop(Tunnel::open(session.clone(), host, port).await?);
+        Ok(format!("{} reaches {host}:{port}", session.label()))
     }
 
     /// Connects with `source` as given (not necessarily saved): Test Connection.

crates/ide-db/tests/ssh_tunnel.rs

@@ -0,0 +1,96 @@
+//! Data Source › SSH/SSL › Test SSH Tunnel against an in-process SSH server: the SSH login and
+//! the SSH host reaching the database host and port, with no database login.
+
+use ide_core::error::ErrorKind;
+use ide_db::{DataSource, DbDriver, DbManager, DbSsh, DbSshAuth};
+use ide_ssh::{SshFiles, SshManager};
+use std::sync::Arc;
+use tokio::net::TcpListener;
+
+struct Env {
+    _tmp: tempfile::TempDir,
+    db: DbManager,
+    ssh_port: u16,
+}
+
+async fn env() -> Env {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().to_path_buf();
+    let ssh_port = ide_ssh::testing::sshd(root.join("server"), Arc::new(|cmd| panic!("unexpected exec: {cmd}"))).await;
+    let ssh = Arc::new(SshManager::with_files(
+        root.join("ssh-secrets.json"),
+        SshFiles { known_hosts: root.join("known_hosts"), config: None },
+    ));
+    let db = DbManager::new(root.clone(), root.join("passwords.json"), root.join("history.json"), ssh);
+    Env { _tmp: tmp, db, ssh_port }
+}
+
+impl Env {
+    /// A PostgreSQL source on `127.0.0.1:<db_port>` through the test server as `dev`.
+    fn source(&self, db_port: u16) -> DataSource {
+        DataSource {
+            id: "pg".into(),
+            name: "pg".into(),
+            driver: DbDriver::Postgres,
+            host: "127.0.0.1".into(),
+            port: Some(db_port),
+            user: "app".into(),
+            ssh: Some(DbSsh {
+                enabled: true,
+                host: "127.0.0.1".into(),
+                port: Some(self.ssh_port),
+                user: "dev".into(),
+                auth: DbSshAuth::Password,
+                ..Default::default()
+            }),
+            ..Default::default()
+        }
+    }
+}
+
+/// A port something listens on (and never speaks a database protocol).
+async fn listening() -> (TcpListener, u16) {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    (listener, port)
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn the_tunnel_is_tested_without_a_database_login() {
+    let env = env().await;
+    let (_db, db_port) = listening().await;
+    let source = env.source(db_port);
+
+    // First contact: the host key has to be trusted, as with Test Connection.
+    let unknown = env.db.test_tunnel(&source, Some("secret".into())).await.unwrap_err();
+    assert!(unknown.message.starts_with("Unknown SSH host key"), "{unknown:?}");
+    env.db.trust_ssh_host("pg").await.unwrap();
+
+    let ok = env.db.test_tunnel(&source, Some("secret".into())).await.unwrap();
+    assert_eq!(ok, format!("[email protected]:{} reaches 127.0.0.1:{db_port}", env.ssh_port));
+
+    let wrong = env.db.test_tunnel(&source, Some("nope".into())).await.unwrap_err();
+    assert!(wrong.message.contains("SSH authentication failed"), "{}", wrong.message);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_database_port_the_ssh_host_cannot_reach_is_named() {
+    let env = env().await;
+    let (listener, closed) = listening().await;
+    drop(listener);
+    let source = env.source(closed);
+    let _ = env.db.test_tunnel(&source, Some("secret".into())).await;
+    env.db.trust_ssh_host("pg").await.unwrap();
+
+    let err = env.db.test_tunnel(&source, Some("secret".into())).await.unwrap_err();
+    assert!(err.message.contains(&format!("cannot reach 127.0.0.1:{closed}")), "{}", err.message);
+}
+
+#[tokio::test]
+async fn a_source_without_a_tunnel_has_nothing_to_test() {
+    let env = env().await;
+    let mut source = env.source(5432);
+    source.ssh.as_mut().unwrap().enabled = false;
+    let err = env.db.test_tunnel(&source, None).await.unwrap_err();
+    assert_eq!(err.kind, ErrorKind::InvalidInput, "{err:?}");
+}

crates/ide-host/src/ops/db.rs

@@ -42,6 +42,10 @@ pub(crate) fn register(d: &mut Dispatcher) {
         );
         test(&c.host, &c.window, source, password, ssh_secret).await
     });
+    d.add("db_test_tunnel", |c| async move {
+        let (source, ssh_secret) = (c.arg::<DataSource>("source")?, c.arg::<Option<String>>("sshSecret")?);
+        test_tunnel(&c.host, &c.window, source, ssh_secret).await
+    });
     d.add("db_set_ssh_secret", |c| async move {
         let (id, secret, save) = (c.arg::<String>("id")?, c.arg::<Option<String>>("secret")?, c.arg::<bool>("save")?);
         set_ssh_secret(&c.host, &c.window, &id, secret, save).await
@@ -212,6 +216,17 @@ pub async fn test(
     db.test(&source, password, ssh_secret).await
 }
 
+/// Checks the SSH tunnel of `source` alone: SSH login and the SSH host reaching the database.
+pub async fn test_tunnel(
+    host: &Host,
+    window: &str,
+    source: DataSource,
+    ssh_secret: Option<String>,
+) -> IdeResult<String> {
+    let db = host.project(window)?.db.clone();
+    db.test_tunnel(&source, ssh_secret).await
+}
+
 /// Remembers the SSH password / key passphrase of a data source (see `set_password`).
 pub async fn set_ssh_secret(host: &Host, window: &str, id: &str, secret: Option<String>, save: bool) -> IdeResult<()> {
     let db = host.project(window)?.db.clone();

crates/ide-host/src/ops/lsp.rs

@@ -74,9 +74,15 @@ pub async fn lsp_completion(
     host.end_request(request);
     // Plugin providers (`[[contributes.providers]]`) add theirs.
     let Some((plugins, d)) = plugin_providers(host, window, doc, ProviderKind::Completion) else { return result };
-    let items = plugin_call(move || plugins.provide_completion(&d, pos, trigger.as_deref())).await.unwrap_or_default();
+    let (covered, items) = plugin_call(move || plugins.provide_completion_for_editor(&d, pos, trigger.as_deref()))
+        .await
+        .unwrap_or_default();
     if items.is_empty() {
-        return Ok(result.unwrap_or(CompletionList { is_incomplete: true, items: Vec::new() }));
+        return if covered {
+            Ok(result.unwrap_or(CompletionList { is_incomplete: true, items: Vec::new() }))
+        } else {
+            result
+        };
     }
     let mut list = result.unwrap_or(CompletionList { is_incomplete: false, items: Vec::new() });
     list.items.extend(items.into_iter().map(|(_, item)| plugin_completion(item)));

crates/ide-host/src/ops/vcs.rs

@@ -22,6 +22,27 @@ pub async fn status(host: &Host, window: &str) -> IdeResult<Vec<FileStatus>> {
     .await
 }
 
+/// Changes of `paths` only: the dirty-scope refresh after a watcher batch. `paths` that belong
+/// to no repository are ignored, and an empty list is the full status.
+pub async fn status_paths(host: &Host, window: &str, paths: Vec<std::path::PathBuf>) -> IdeResult<Vec<FileStatus>> {
+    let project = host.project(window)?;
+    host.blocking(move || {
+        let settings = project.settings.effective();
+        if project.is_trusted() {
+            apply_git_executable(&settings);
+        }
+        let repos = project.repos();
+        if repos.is_empty() {
+            return Err(ide_core::IdeError::unavailable("project is not a git repository"));
+        }
+        for r in repos.all() {
+            r.set_ignored_names(settings.ignored_names());
+        }
+        repos.status_paths(&paths)
+    })
+    .await
+}
+
 mod commands;
 pub use commands::*;
 

crates/ide-host/src/plugins/api.rs

@@ -1642,6 +1642,9 @@ impl HostApi for PluginApi {
     ) -> Result<(), HostError> {
         self.set_decorations(path, set, Vec::new(), item, true)
     }
+    fn file_icon_decorations(&self, set: &str, items: Vec<(PathBuf, String)>) -> Result<(), HostError> {
+        self.set_file_icon_decorations(set, items)
+    }
     fn vcs_log(
         &self,
         root: &Path,
@@ -4124,6 +4127,9 @@ impl PluginApi {
         {
             return Err(HostError::Invalid("a file note is one non-empty line of at most 200 characters".into()));
         }
+        if let Some(icon) = file.as_ref().and_then(|f| f.icon.as_ref()) {
+            ide_extension::validate_item_id(icon, "file icon id").map_err(HostError::Invalid)?;
+        }
         items.retain(|d| decoration_style(&d.style));
         if items.iter().any(|d| d.range.start > d.range.end) {
             return Err(HostError::Invalid("reversed decoration range".into()));
@@ -4132,24 +4138,14 @@ impl PluginApi {
             // The decoration follows the file, not the window's project: editors render
             // whatever they have open, including files outside every project root. The
             // set's root stays the path's own (deepest open) project for tree filtering.
-            let root = self
-                .shared
-                .workspace()
-                .map(|w| {
-                    w.projects()
-                        .into_iter()
-                        .filter(|root| path.starts_with(root))
-                        .max_by_key(|root| root.components().count())
-                })
-                .unwrap_or_default()
-                .unwrap_or_else(|| path.parent().map(Path::to_path_buf).unwrap_or_else(|| path.to_path_buf()));
+            let root = self.decoration_root(path);
             Some(super::DecorationSet {
                 root: root.into(),
                 path: ide_core::IpcPath(path.to_path_buf()),
                 set_id: set.into(),
                 tree,
                 items,
-                file: file.filter(|f| f.note.is_some() || decoration_style(&f.style)),
+                file: file.filter(|f| f.note.is_some() || f.icon.is_some() || decoration_style(&f.style)),
             })
         } else {
             None
@@ -4177,6 +4173,60 @@ impl PluginApi {
         self.shared.sink.emit(None, PluginEvent::DecorationsChanged { plugin_id: self.id().into(), sets });
         Ok(())
     }
+
+    fn decoration_root(&self, path: &Path) -> PathBuf {
+        self.shared
+            .workspace()
+            .map(|w| {
+                w.projects()
+                    .into_iter()
+                    .filter(|root| path.starts_with(root))
+                    .max_by_key(|root| root.components().count())
+            })
+            .unwrap_or_default()
+            .unwrap_or_else(|| path.parent().map(Path::to_path_buf).unwrap_or_else(|| path.to_path_buf()))
+    }
+
+    fn set_file_icon_decorations(&self, set: &str, items: Vec<(PathBuf, String)>) -> Result<(), HostError> {
+        if set.is_empty() || set.len() > 128 {
+            return Err(HostError::Invalid("set id must be 1-128 bytes".into()));
+        }
+        if items.len() > 10_000 {
+            return Err(HostError::Invalid("at most 10000 file icons per set".into()));
+        }
+        let mut by_path = BTreeMap::new();
+        for (path, icon) in items {
+            ide_extension::validate_item_id(&icon, "file icon id").map_err(HostError::Invalid)?;
+            by_path.insert(path, icon);
+        }
+        let mut all = self.shared.decorations.lock();
+        let mut sets = all.get(self.id()).cloned().unwrap_or_default();
+        sets.retain(|s| !(s.tree && s.set_id == set));
+        for (path, icon) in by_path {
+            let root = self.decoration_root(&path);
+            sets.push(super::DecorationSet {
+                root: root.into(),
+                path: ide_core::IpcPath(path),
+                set_id: set.into(),
+                tree: true,
+                items: Vec::new(),
+                file: Some(ide_plugin::FileDecoration {
+                    badge: None,
+                    style: String::new(),
+                    tooltip: None,
+                    note: None,
+                    icon: Some(icon),
+                }),
+            });
+        }
+        let names: BTreeSet<_> = sets.iter().filter(|s| s.tree).map(|s| &s.set_id).collect();
+        if names.len() > 50 || serde_json::to_vec(&sets).map_err(failed)?.len() > 4 << 20 {
+            return Err(HostError::Invalid("decoration sets exceed plugin limits".into()));
+        }
+        all.insert(self.id().into(), sets.clone());
+        self.shared.sink.emit(None, PluginEvent::DecorationsChanged { plugin_id: self.id().into(), sets });
+        Ok(())
+    }
 }
 fn decoration_style(style: &str) -> bool {
     matches!(
@@ -4330,7 +4380,8 @@ mod workbench_tests {
                     badge: Some("abc".into()),
                     style: "info".into(),
                     tooltip: None,
-                    note: None
+                    note: None,
+                    icon: None,
                 })
             )
             .is_err()
@@ -4340,6 +4391,7 @@ mod workbench_tests {
             style: String::new(),
             tooltip: Some("why".into()),
             note: Some(text.into()),
+            icon: None,
         };
         api.file_decorations(Some(&path), "notes", Some(note("entry point"))).unwrap();
         let notes = |api: &PluginApi| {
@@ -4353,6 +4405,18 @@ mod workbench_tests {
         for bad in ["", "two\nlines", &"x".repeat(201)] {
             assert!(api.file_decorations(Some(&path), "notes", Some(note(bad))).is_err(), "{bad:?}");
         }
+        api.file_icon_decorations(
+            "icons",
+            vec![(path.clone(), "helm-chart".into()), (root.join("chart"), "helm-dir".into())],
+        )
+        .unwrap();
+        let icons = api.shared.decoration_sets()["test"]
+            .iter()
+            .filter(|s| s.tree && s.set_id == "icons")
+            .filter_map(|s| s.file.as_ref().and_then(|f| f.icon.clone()))
+            .collect::<Vec<_>>();
+        assert_eq!(icons.len(), 2);
+        assert!(api.file_icon_decorations("icons", vec![(path.clone(), "BAD ID".into())]).is_err());
         api.shared.clear_plugin("test", true);
         assert!(api.shared.decoration_sets().is_empty());
     }

crates/ide-host/src/plugins/providers.rs

@@ -396,15 +396,37 @@ impl PluginHost {
         }
     }
 
+    pub(super) fn has_document_providers(&self, kind: ProviderKind, doc: &ProviderDocument) -> bool {
+        self.provider_plugins(kind, &doc.language)
+            .into_iter()
+            .any(|p| p.dev_root.as_ref().is_none_or(|r| doc.path.starts_with(r)))
+    }
+
     pub fn provide_completion(
         &self,
         doc: &ProviderDocument,
         at: ide_core::Pos,
         trigger: Option<&str>,
     ) -> Vec<(String, CompletionItem)> {
-        self.feature_documents(doc, Some(at))
+        self.provide_completion_for_editor(doc, at, trigger).1
+    }
+
+    pub(crate) fn provide_completion_for_editor(
+        &self,
+        doc: &ProviderDocument,
+        at: ide_core::Pos,
+        trigger: Option<&str>,
+    ) -> (bool, Vec<(String, CompletionItem)>) {
+        // An injection-capable outer document (e.g. SQL embedded in text) may complete at other
+        // positions even when `at` is outside an injection, so avoid marking document-wide backoff.
+        let mut covered = self.has_document_providers(ProviderKind::Injections, doc);
+        let items = self
+            .feature_documents(doc, Some(at))
             .into_iter()
             .flat_map(|(doc, bounds)| {
+                if self.has_document_providers(ProviderKind::Completion, &doc) {
+                    covered = true;
+                }
                 let (d, t) = (Arc::new(doc.clone()), trigger.map(str::to_owned));
                 self.document_calls(ProviderKind::Completion, &doc, move |rt, timeout| {
                     rt.provide_completion(&d, at, t.as_deref(), timeout)
@@ -419,7 +441,8 @@ impl PluginHost {
                     Some((p, i))
                 })
             })
-            .collect()
+            .collect();
+        (covered, items)
     }
 
     pub fn provide_code_actions(

crates/ide-host/src/plugins/ui_points.rs

@@ -743,6 +743,7 @@ pub(super) fn custom_editor(pkg: &Package, decl: toml::Value) -> Result<UiDecl,
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct FileIconDecl {
     id: String,
+    #[serde(default)]
     patterns: Vec<String>,
     icon: PathBuf,
     #[serde(default)]
@@ -754,13 +755,19 @@ pub fn file_icon_asset(id: &str, dark: bool) -> String {
     format!("fileIcon/{id}/{}", if dark { "dark" } else { "light" })
 }
 
-/// `[[contributes.fileIcons]]`: an icon for the files matching `patterns`,
-/// whatever icon theme is in use (the user's own file type icons still win).
+/// `[[contributes.fileIcons]]`: an icon for the files matching `patterns` (or
+/// assigned dynamically through `decorations.set-file-icon` when `patterns` is
+/// omitted in API 1.8), whatever icon theme is in use (the user's own file type
+/// icons still win).
 pub(super) fn file_icon(pkg: &Package, decl: toml::Value) -> Result<UiDecl, String> {
     let d: FileIconDecl = decode(FILE_ICONS, decl)?;
     validate_item_id(&d.id, "file icon id")?;
     let what = format!("file icon {:?}", d.id);
-    file_patterns(&d.patterns, &what)?;
+    if d.patterns.is_empty() {
+        pkg.manifest.needs_api("contributes.fileIcons without patterns", 8)?;
+    } else {
+        file_patterns(&d.patterns, &what)?;
+    }
     let mut files = Vec::new();
     let mut assets = Vec::new();
     for (path, dark) in [(Some(&d.icon), false), (d.icon_dark.as_ref(), true)] {
@@ -769,8 +776,16 @@ pub(super) fn file_icon(pkg: &Package, decl: toml::Value) -> Result<UiDecl, Stri
         assets.push((file_icon_asset(&d.id, dark), svg));
         files.push(path.clone());
     }
-    let json = serde_json::json!({ "id": d.id, "patterns": d.patterns, "dark": d.icon_dark.is_some() });
-    let mut out = UiDecl::new(d.id.clone(), d.patterns.join(", "), json);
+    let bytes = serde_json::to_vec(&assets).map_err(|e| e.to_string())?;
+    let revision = blake3::hash(&bytes).to_hex().to_string();
+    let json = serde_json::json!({
+        "id": d.id,
+        "patterns": d.patterns,
+        "dark": d.icon_dark.is_some(),
+        "revision": revision,
+    });
+    let label = if d.patterns.is_empty() { d.id.clone() } else { d.patterns.join(", ") };
+    let mut out = UiDecl::new(d.id.clone(), label, json);
     out.files = files;
     out.assets = assets;
     Ok(out)

crates/ide-host/src/rpc.rs

@@ -270,7 +270,8 @@ impl Dispatcher {
         .add("run_resize", |c| async move { ops::run::resize(&c.host, c.arg("id")?, c.arg("cols")?, c.arg("rows")?) })
         .add("run_close_stdin", |c| async move { ops::run::close_stdin(&c.host, c.arg("id")?) })
         .add("run_list", |c| async move { Ok(ops::run::list(&c.host)) })
-        .add("vcs_status", |c| async move { ops::vcs::status(&c.host, &c.window).await });
+        .add("vcs_status", |c| async move { ops::vcs::status(&c.host, &c.window).await })
+        .add("vcs_status_paths", |c| async move { ops::vcs::status_paths(&c.host, &c.window, c.arg("paths")?).await });
         ops::register_all(&mut d);
         d
     }

crates/ide-host/src/trust.rs

@@ -475,6 +475,7 @@ pub fn restricted_command_allowed(cmd: &str) -> bool {
             | "vcs_clone"
             | "vcs_init"
             | "vcs_status"
+            | "vcs_status_paths"
             | "vcs_roots"
             | "vcs_branch_info"
             | "vcs_line_hunks"

crates/ide-host/tests/plugin_language_features.rs

@@ -99,6 +99,21 @@ async fn editor_ops_merge_the_fixture_format_selection_and_execute_owned_command
     let path = root.join("a.txt");
     std::fs::write(&path, "value\nnext\nend").unwrap();
     let doc = ops::doc::open(&host, "main", path.clone()).await.unwrap();
+    // `a.toml` has neither a language server, a completion plugin, nor an injection plugin, so `Unavailable` is preserved.
+    let toml_path = root.join("a.toml");
+    std::fs::write(&toml_path, "k = 1\n").unwrap();
+    let toml_doc = ops::doc::open(&host, "main", toml_path).await.unwrap();
+    assert_eq!(
+        ops::lsp::lsp_completion(&host, "main", RequestId(89), toml_doc.id, Pos::default(), None)
+            .await
+            .unwrap_err()
+            .kind,
+        ide_core::error::ErrorKind::Unavailable
+    );
+    let sql_path = root.join("q.sql");
+    std::fs::write(&sql_path, "SELECT 1;").unwrap();
+    let sql_doc = ops::doc::open(&host, "main", sql_path).await.unwrap();
+    assert!(ops::lsp::lsp_completion(&host, "main", RequestId(90), sql_doc.id, Pos::default(), None).await.is_ok());
     assert_eq!(
         ops::lsp::lsp_signature_help(&host, "main", doc.id, Pos::default()).await.unwrap().unwrap().signatures[0]
             .parameters,

crates/ide-host/tests/plugins.rs

@@ -3760,6 +3760,43 @@ path = "templates/new.draw"
     assert!(f.host.web_page("web-demo", "draw").is_err());
 }
 
+#[test]
+fn file_icons_without_patterns_require_api_1_8_and_project_assets() {
+    let f = fixture(Limits::default());
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = tmp.path().join("dynamic-icons");
+    std::fs::create_dir_all(pkg.join("icons")).unwrap();
+    std::fs::write(pkg.join("icons/helm-dir.svg"), r#"<svg viewBox="0 0 16 16"><circle cx="8" cy="8" r="6"/></svg>"#)
+        .unwrap();
+    let write_manifest = |api: &str| {
+        std::fs::write(
+            pkg.join("plugin.toml"),
+            format!(
+                r#"id = "dynamic-icons"
+name = "Dynamic Icons"
+version = "0.1.0"
+engines.openidea = "{api}"
+
+[[contributes.fileIcons]]
+id = "helm-dir"
+icon = "icons/helm-dir.svg"
+"#
+            ),
+        )
+        .unwrap();
+    };
+    write_manifest("^1.7");
+    let err = f.host.install_from_dir(&pkg, &Consent::all()).unwrap_err();
+    assert!(err.message.contains("1.8"), "{err:?}");
+
+    write_manifest("^1.8");
+    let info = f.install(&pkg);
+    assert!(info.error.is_none(), "{:?}", info.error);
+    let assets = f.host.assets("dynamic-icons", "fileIcon/helm-dir/").unwrap();
+    assert_eq!(assets.len(), 1);
+    assert!(assets[0].1.contains("<circle"));
+}
+
 #[test]
 fn file_templates_fixture_installs_without_write_capabilities() {
     let f = fixture(Limits::default());

crates/ide-host/tests/remote_plugins.rs

@@ -367,6 +367,7 @@ async fn remote_projects_get_plugin_views_and_custom_editors() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn api14_remote_calls_keep_browser_listeners_and_secrets_on_the_desktop() {
+    use ide_core::{Diagnostic, Pos, Range, Severity};
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
     let tmp = tempfile::tempdir().unwrap();
     let desktop = Arc::new(
@@ -426,42 +427,70 @@ async fn api14_remote_calls_keep_browser_listeners_and_secrets_on_the_desktop()
             "severity": "warning", "message": message, "source": "remote-check", "code": null
         }]})
     };
+    let publish = |path: &Path, source: &str, message: Option<&str>| {
+        let items = message
+            .map(|message| Diagnostic {
+                range: Range::new(Pos::new(0, 1), Pos::new(0, 3)),
+                severity: Severity::Warning,
+                message: message.into(),
+                source: Some(source.into()),
+                code: None,
+                unnecessary: false,
+                deprecated: false,
+                server: None,
+            })
+            .into_iter()
+            .collect();
+        host.project("main").unwrap().sink.emit(IdeEvent::Diagnostics {
+            path: path.to_path_buf().into(),
+            source: source.into(),
+            items,
+        });
+    };
     let files = json!([
         problem(&remote_file, "remote warning"),
         problem(&other_file, "other warning"),
         problem(&outside_file, "outside warning")
     ]);
     invoke(&peer, "mcp_report_problems", json!({"reset": true, "files": files})).await.unwrap();
+    // UI reports are not the source of the plugin's host-owned snapshot.
+    assert_eq!(invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap(), json!("[]"));
+    publish(&remote_file, "remote-check", Some("remote warning"));
+    publish(&other_file, "remote-check", Some("other warning"));
+    publish(&outside_file, "remote-check", Some("outside warning"));
+
     let problems = invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap();
     let problems = problems.as_str().unwrap();
     assert!(problems.contains("remote warning"), "{problems}");
     assert!(problems.contains("other warning"), "{problems}");
-    assert!(!problems.contains("outside warning"), "{problems}");
+    assert!(problems.contains("outside warning"), "{problems}");
     for path in ["remote.txt", remote_file.to_str().unwrap()] {
         let problems = invoke(&peer, "plugin_run_command", run("problems", Some(path))).await.unwrap();
         let problems = problems.as_str().unwrap();
         assert!(problems.contains("remote warning"), "{problems}");
         assert!(!problems.contains("other warning"), "{problems}");
+        assert!(!problems.contains("outside warning"), "{problems}");
         assert!(problems.contains(remote_file.to_str().unwrap()), "{problems}");
     }
     assert_eq!(invoke(&peer, "plugin_run_command", run("problems", Some("missing.txt"))).await.unwrap(), json!("[]"));
-    invoke(&peer, "mcp_report_problems", json!({"reset": false, "files": [{"path": remote_file, "items": []}]}))
-        .await
-        .unwrap();
+    publish(&remote_file, "second-check", Some("second warning"));
+    invoke(&peer, "mcp_report_problems", json!({"reset": true, "files": []})).await.unwrap();
+    let problems = invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap();
+    assert!(problems.as_str().unwrap().contains("remote warning"));
+    assert!(problems.as_str().unwrap().contains("second warning"));
+    publish(&remote_file, "remote-check", None);
     let problems = invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap();
     assert!(!problems.as_str().unwrap().contains("remote warning"));
+    assert!(problems.as_str().unwrap().contains("second warning"));
     assert!(problems.as_str().unwrap().contains("other warning"));
-    invoke(
-        &peer,
-        "mcp_report_problems",
-        json!({"reset": true, "files": [problem(&remote_file, "replacement warning")]}),
-    )
-    .await
-    .unwrap();
+    publish(&remote_file, "second-check", Some("replacement warning"));
     let problems = invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap();
     assert!(problems.as_str().unwrap().contains("replacement warning"));
-    assert!(!problems.as_str().unwrap().contains("other warning"));
-    invoke(&peer, "mcp_report_problems", json!({"reset": true, "files": []})).await.unwrap();
+    assert!(!problems.as_str().unwrap().contains("second warning"));
+    assert!(problems.as_str().unwrap().contains("other warning"));
+    publish(&remote_file, "second-check", None);
+    publish(&other_file, "remote-check", None);
+    publish(&outside_file, "remote-check", None);
     assert_eq!(invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap(), json!("[]"));
     invoke(&peer, "plugin_run_command", run("open-editor", Some("remote.txt"))).await.unwrap();
     invoke(&peer, "plugin_run_command", run("decorations", remote_file.to_str())).await.unwrap();
@@ -513,11 +542,11 @@ async fn api14_remote_calls_keep_browser_listeners_and_secrets_on_the_desktop()
     stream.read_to_string(&mut response).await.unwrap();
     assert!(response.contains("You can close this tab"));
     assert_eq!(oauth.await.unwrap().unwrap(), json!("code=desktop%2Bcode"));
-    invoke(&peer, "mcp_report_problems", json!({"reset": true, "files": files})).await.unwrap();
+    publish(&remote_file, "remote-check", Some("remote warning"));
     invoke(&peer, "close_project", json!({})).await.unwrap();
     invoke(&peer, "open_project", json!({"path": project})).await.unwrap();
     assert_eq!(invoke(&peer, "plugin_run_command", run("problems", None)).await.unwrap(), json!("[]"));
-    invoke(&peer, "mcp_report_problems", json!({"reset": true, "files": files})).await.unwrap();
+    publish(&remote_file, "remote-check", Some("remote warning"));
     peer.kill();
     tokio::time::timeout(Duration::from_secs(5), server).await.unwrap().unwrap();
     let plugin_host = plugins.host().clone();
@@ -537,7 +566,11 @@ async fn api14_remote_calls_keep_browser_listeners_and_secrets_on_the_desktop()
     })
     .await
     .unwrap();
-    assert_eq!(result.as_deref(), Some("[]"));
+    // Disconnect clears desktop reports, not the still-live host project snapshot.
+    let problems = result.as_deref().unwrap();
+    assert!(problems.contains("remote warning"), "{problems}");
+    assert!(problems.contains("remote-check"), "{problems}");
+    assert!(problems.contains(remote_file.to_str().unwrap()), "{problems}");
     plugins.host().shutdown();
     desktop.shutdown();
 }

crates/ide-host/tests/rpc.rs

@@ -341,6 +341,7 @@ async fn local_deployment_runs_on_the_project_host() {
         "db_save_sources",
         "db_set_password",
         "db_test",
+        "db_test_tunnel",
         "db_set_ssh_secret",
         "db_trust_ssh_host",
         "db_connected",

crates/ide-host/tests/trust_vcs_sweep.rs

@@ -172,6 +172,7 @@ async fn restricted_vcs_commands_run_no_program_of_the_repository() {
     }
     let calls: Vec<Call> = vec![
         call!("vcs_status", "", ops::vcs::status(host, w)),
+        call!("vcs_status_paths", "", ops::vcs::status_paths(host, w, vec![file.clone()])),
         sync!("vcs_roots", "", vcs::vcs_roots(host, w)),
         call!("vcs_branch_info", "", vcs::vcs_branch_info(host, w, root())),
         call!("vcs_line_hunks", "", vcs::vcs_line_hunks(host, w, file.clone())),

crates/ide-language/src/registry.rs

@@ -40,6 +40,7 @@ const BUILTIN: &[(&str, &str)] = &[
     ("groovy", include_str!("../../../languages/groovy.toml")),
     ("haskell", include_str!("../../../languages/haskell.toml")),
     ("hcl", include_str!("../../../languages/hcl.toml")),
+    ("helm-template", include_str!("../../../languages/helm-template.toml")),
     ("html", include_str!("../../../languages/html.toml")),
     ("http", include_str!("../../../languages/http.toml")),
     ("ignore", include_str!("../../../languages/ignore.toml")),
@@ -548,6 +549,7 @@ mod tests {
         "Groovy",
         "Haskell",
         "Haxe",
+        "Helm Template",
         "HXML",
         "HTTP",
         "IDL",
@@ -841,6 +843,30 @@ mod tests {
         assert!(reg.is_framework_marker(&root.join("src/manage.py")));
     }
 
+    #[test]
+    fn helm_charts_make_yaml_and_notes_in_templates_folders_helm_templates() {
+        let reg = reg();
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let detect = |file: &str| reg.detect(&root.join(file), None).as_str().to_owned();
+        std::fs::create_dir_all(root.join("charts/podinfo/templates/tests")).unwrap();
+        std::fs::create_dir_all(root.join("k8s/templates")).unwrap();
+        std::fs::write(root.join("charts/podinfo/Chart.yaml"), "apiVersion: v2\nname: podinfo\n").unwrap();
+        assert_eq!(detect("charts/podinfo/Chart.yaml"), "yaml");
+        assert_eq!(detect("charts/podinfo/values.yaml"), "yaml");
+        assert_eq!(detect("charts/podinfo/templates/deployment.yaml"), "helm-template");
+        assert_eq!(detect("charts/podinfo/templates/tests/connection.yml"), "helm-template");
+        assert_eq!(detect("charts/podinfo/templates/_helpers.tpl"), "helm-template");
+        assert_eq!(detect("charts/podinfo/templates/NOTES.txt"), "helm-template");
+        // No `Chart.yaml` / `Chart.yml` above this `templates` folder.
+        assert_eq!(detect("k8s/templates/deployment.yaml"), "yaml");
+        assert_eq!(detect("common.gotmpl"), "helm-template");
+        // Outside a chart, `.tpl` belongs to other template engines (Smarty, Terraform).
+        assert_ne!(detect("site/index.tpl"), "helm-template");
+        assert!(reg.is_framework_marker(&root.join("charts/podinfo/Chart.yaml")));
+        assert!(reg.is_framework_marker(&root.join("charts/podinfo/Chart.yml")));
+    }
+
     #[test]
     fn the_django_fixture_has_templates_and_a_page() {
         let reg = reg();

crates/ide-mcp/src/discovery.rs

@@ -5,6 +5,7 @@
 
 use serde::{Deserialize, Serialize};
 use std::io;
+use std::net::{IpAddr, Ipv4Addr};
 use std::path::{Path, PathBuf};
 
 /// The discovery file, relative to the app data directory.
@@ -39,6 +40,9 @@ pub fn kept_token(path: &Path) -> io::Result<String> {
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Discovery {
+    /// Where a client on this computer connects (the file of an IDE without this field: `127.0.0.1`).
+    #[serde(default = "loopback")]
+    pub address: IpAddr,
     pub port: u16,
     pub token: String,
     /// The IDE's process.
@@ -47,6 +51,10 @@ pub struct Discovery {
     pub version: String,
 }
 
+fn loopback() -> IpAddr {
+    IpAddr::V4(Ipv4Addr::LOCALHOST)
+}
+
 impl Discovery {
     pub fn read(path: &Path) -> io::Result<Self> {
         let bytes = std::fs::read(path)?;
@@ -103,7 +111,13 @@ mod tests {
     fn round_trips_privately_and_only_its_owner_removes_it() {
         let tmp = tempfile::tempdir().unwrap();
         let path = discovery_path(tmp.path());
-        let ours = Discovery { port: 1234, token: "t".into(), pid: std::process::id(), version: "0.1.0".into() };
+        let ours = Discovery {
+            address: "100.92.72.95".parse().unwrap(),
+            port: 1234,
+            token: "t".into(),
+            pid: std::process::id(),
+            version: "0.1.0".into(),
+        };
         ours.write(&path).unwrap();
         assert_eq!(Discovery::read(&path).unwrap(), ours);
         #[cfg(unix)]
@@ -118,6 +132,10 @@ mod tests {
         ours.write(&path).unwrap();
         Discovery::remove_if_ours(&path);
         assert!(!path.exists());
+
+        // The file of an IDE that listened on 127.0.0.1 only has no address.
+        std::fs::write(&path, r#"{"port":1,"token":"t","pid":1,"version":"0.1.0"}"#).unwrap();
+        assert_eq!(Discovery::read(&path).unwrap().address, loopback());
     }
 
     #[test]

crates/ide-mcp/src/lib.rs

@@ -2,14 +2,15 @@
 //! the IDE's built-in tools.
 //!
 //! - **Transport:** MCP Streamable HTTP (2025-06-18; 2025-03-26 and 2024-11-05
-//!   clients too) on `127.0.0.1:<random port>`, endpoint `/mcp`. Responses are
+//!   clients too) on `127.0.0.1:<random port>` (or another address of
+//!   [`ServerOptions`]), endpoint `/mcp`. Responses are
 //!   plain JSON (no SSE streams: `GET` is 405). Every request carries
 //!   `Authorization: Bearer <token>` (random, per run); requests from another
 //!   `Origin` or `Host` are refused (DNS rebinding).
 //! - **Projects:** the `X-OpenIDEA-Project` header or the `?project=` query
 //!   names a folder; the server picks the open project containing it.
-//! - **Discovery:** `<app-data>/mcp/server.json` (`port`, `token`, `pid`,
-//!   `version`; readable only by the user) while the server runs.
+//! - **Discovery:** `<app-data>/mcp/server.json` (`address`, `port`, `token`,
+//!   `pid`, `version`; readable only by the user) while the server runs.
 //! - **Stdio:** `<app exe> --mcp-stdio [--project <path>]` reads the discovery
 //!   file and relays newline-delimited JSON-RPC to the server ([`stdio`]), so
 //!   persisted client configurations hold no token.
@@ -23,7 +24,7 @@ mod server;
 pub mod stdio;
 
 pub use discovery::{DISCOVERY_FILE, Discovery, TOKEN_FILE, discovery_path, kept_token, token_path};
-pub use server::{McpServer, ServerOptions};
+pub use server::{McpServer, ServerOptions, local_address};
 pub use tokio_util::sync::CancellationToken;
 
 use std::path::{Path, PathBuf};
@@ -85,9 +86,15 @@ pub trait ToolRegistry: Send + Sync + 'static {
     ) -> Result<String, ToolCallError>;
 }
 
-/// The URL of the server at `port` for `project`.
+/// The URL of the server at `127.0.0.1:<port>` for `project`.
 pub fn endpoint_url(port: u16, project: &Path) -> String {
-    format!("http://127.0.0.1:{port}/mcp?project={}", encode_query(&project.to_string_lossy()))
+    endpoint_url_at(std::net::Ipv4Addr::LOCALHOST.into(), port, project)
+}
+
+/// The URL of the server at `<address>:<port>` for `project`.
+pub fn endpoint_url_at(address: std::net::IpAddr, port: u16, project: &Path) -> String {
+    let at = std::net::SocketAddr::new(address, port);
+    format!("http://{at}/mcp?project={}", encode_query(&project.to_string_lossy()))
 }
 
 /// The stdio bridge's command line for `project`: `exe --mcp-stdio --project <project>`.
@@ -133,6 +140,9 @@ mod tests {
     fn urls_and_commands_name_the_project() {
         let url = endpoint_url(4321, Path::new("/home/me/my app/项目"));
         assert_eq!(url, "http://127.0.0.1:4321/mcp?project=/home/me/my%20app/%E9%A1%B9%E7%9B%AE");
+        let ip = |s: &str| s.parse::<std::net::IpAddr>().unwrap();
+        assert_eq!(endpoint_url_at(ip("100.92.72.95"), 80, Path::new("/p")), "http://100.92.72.95:80/mcp?project=/p");
+        assert_eq!(endpoint_url_at(ip("fd7a::1"), 80, Path::new("/p")), "http://[fd7a::1]:80/mcp?project=/p");
         assert_eq!(
             stdio_command(Path::new("/Applications/OpenIDEA.app/Contents/MacOS/openidea"), Path::new("/p")),
             ["/Applications/OpenIDEA.app/Contents/MacOS/openidea", "--mcp-stdio", "--project", "/p"]

crates/ide-mcp/src/server.rs

@@ -9,6 +9,7 @@ use hyper::header::{self, HeaderMap, HeaderValue};
 use hyper::{Method, Request, Response, StatusCode};
 use serde_json::{Value, json};
 use std::convert::Infallible;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
 use std::path::{Path, PathBuf};
 use std::pin::Pin;
 use std::sync::Arc;
@@ -40,6 +41,8 @@ type Body = Either<Full<Bytes>, EventStream>;
 struct Shared {
     registry: Arc<dyn ToolRegistry>,
     token: String,
+    /// The address listened on (`0.0.0.0` / `::`: every address).
+    address: IpAddr,
     port: u16,
     requests: protocol::Requests,
     cancel: CancellationToken,
@@ -48,6 +51,7 @@ struct Shared {
 /// The running server. Stopping it (or dropping it) closes the port and
 /// removes its discovery file.
 pub struct McpServer {
+    address: IpAddr,
     port: u16,
     /// Why the port asked for in [`ServerOptions::port`] was not used.
     port_unavailable: Option<String>,
@@ -60,7 +64,10 @@ pub struct McpServer {
 /// How [`McpServer::start_with`] listens.
 #[derive(Clone, Debug, Default)]
 pub struct ServerOptions {
-    /// Listen on `127.0.0.1:<port>`. When it can't be bound (in use, or reserved by the
+    /// The address to listen on; `None`: `127.0.0.1`, this computer only. Another address of
+    /// this computer, or `0.0.0.0` / `::` for every address, lets other computers connect.
+    pub address: Option<IpAddr>,
+    /// Listen on `<address>:<port>`. When it can't be bound (in use, or reserved by the
     /// system), a free port is taken instead and [`McpServer::port_unavailable`] says why.
     /// `None`: a free port.
     pub port: Option<u16>,
@@ -86,15 +93,20 @@ impl McpServer {
         runtime: &tokio::runtime::Handle,
         options: ServerOptions,
     ) -> std::io::Result<Self> {
+        let address = options.address.unwrap_or(IpAddr::V4(Ipv4Addr::LOCALHOST));
+        let bind = |port: u16| {
+            std::net::TcpListener::bind(SocketAddr::new(address, port))
+                .map_err(|e| std::io::Error::new(e.kind(), format!("{}: {e}", SocketAddr::new(address, port))))
+        };
         let (listener, port_unavailable) = match options.port {
-            Some(port) => match std::net::TcpListener::bind(("127.0.0.1", port)) {
+            Some(port) => match bind(port) {
                 Ok(listener) => (listener, None),
                 Err(e) => {
                     tracing::warn!("MCP server: port {port} unavailable ({e}); taking a free one");
-                    (std::net::TcpListener::bind(("127.0.0.1", 0))?, Some(format!("port {port}: {e}")))
+                    (bind(0)?, Some(format!("port {port}: {e}")))
                 }
             },
-            None => (std::net::TcpListener::bind(("127.0.0.1", 0))?, None),
+            None => (bind(0)?, None),
         };
         listener.set_nonblocking(true)?;
         let port = listener.local_addr()?.port();
@@ -108,6 +120,7 @@ impl McpServer {
         };
         if let Some(path) = &discovery {
             let info = Discovery {
+                address: local_address(address),
                 port,
                 token: token.clone(),
                 pid: std::process::id(),
@@ -120,13 +133,19 @@ impl McpServer {
         let shared = Arc::new(Shared {
             registry,
             token: token.clone(),
+            address,
             port,
             requests: Default::default(),
             cancel: cancel.clone(),
         });
         runtime.spawn(accept(listener, shared, stopped));
-        tracing::info!("MCP server on 127.0.0.1:{port}");
-        Ok(Self { port, port_unavailable, token, discovery, shutdown, cancel })
+        tracing::info!("MCP server on {}", SocketAddr::new(address, port));
+        Ok(Self { address, port, port_unavailable, token, discovery, shutdown, cancel })
+    }
+
+    /// The address listened on (`0.0.0.0` / `::`: every address).
+    pub fn address(&self) -> IpAddr {
+        self.address
     }
 
     pub fn port(&self) -> u16 {
@@ -143,14 +162,24 @@ impl McpServer {
         &self.token
     }
 
-    /// The endpoint URL for `project`.
+    /// The endpoint URL for `project`, at the address a client on this computer connects to.
     pub fn url(&self, project: &Path) -> String {
-        crate::endpoint_url(self.port, project)
+        crate::endpoint_url_at(local_address(self.address), self.port, project)
     }
 
     pub fn stop(self) {}
 }
 
+/// The address a client on this computer connects to for a server listening on `address`:
+/// loopback for every address (`0.0.0.0` / `::`), else `address` itself.
+pub fn local_address(address: IpAddr) -> IpAddr {
+    match address {
+        IpAddr::V4(a) if a.is_unspecified() => IpAddr::V4(Ipv4Addr::LOCALHOST),
+        IpAddr::V6(a) if a.is_unspecified() => IpAddr::V6(Ipv6Addr::LOCALHOST),
+        a => a,
+    }
+}
+
 impl Drop for McpServer {
     fn drop(&mut self) {
         self.cancel.cancel();
@@ -212,7 +241,7 @@ async fn respond(req: Request<Incoming>, shared: &Arc<Shared>, scope: String) ->
     if req.uri().path() != "/mcp" {
         return plain(StatusCode::NOT_FOUND, "not found: the endpoint is /mcp");
     }
-    if !local_request(req.headers(), shared.port) {
+    if !local_request(req.headers(), shared.address, shared.port) {
         return plain(StatusCode::FORBIDDEN, "requests from web pages are refused");
     }
     if !authorized(req.headers(), &shared.token) {
@@ -343,11 +372,16 @@ impl hyper::body::Body for EventStream {
     }
 }
 
-/// No `Origin` other than this server's own, and a loopback `Host`: a web
-/// page (DNS rebinding) can't reach the tools even before the token check.
-fn local_request(headers: &HeaderMap, port: u16) -> bool {
+/// No `Origin` other than this server's own, and a `Host` naming this server by IP address
+/// (loopback, the address listened on, or any when listening on every address) or as
+/// `localhost`: never another host name, so a web page (DNS rebinding) can't reach the tools
+/// even before the token check.
+fn local_request(headers: &HeaderMap, address: IpAddr, port: u16) -> bool {
     let ours = |authority: &str| {
-        ["127.0.0.1", "localhost", "[::1]"].iter().any(|host| authority.eq_ignore_ascii_case(&format!("{host}:{port}")))
+        authority.eq_ignore_ascii_case(&format!("localhost:{port}"))
+            || authority.parse::<SocketAddr>().is_ok_and(|a| {
+                a.port() == port && (a.ip().is_loopback() || a.ip() == address || address.is_unspecified())
+            })
     };
     let host_ok = headers.get(header::HOST).is_none_or(|h| h.to_str().is_ok_and(ours));
     let origin_ok = headers.get(header::ORIGIN).is_none_or(|o| {
@@ -534,7 +568,7 @@ mod tests {
     }
 
     #[test]
-    fn only_loopback_hosts_and_origins_of_this_server_pass() {
+    fn only_hosts_and_origins_of_this_server_pass() {
         let headers = |pairs: &[(header::HeaderName, &str)]| {
             let mut h = HeaderMap::new();
             for (k, v) in pairs {
@@ -542,16 +576,43 @@ mod tests {
             }
             h
         };
-        assert!(local_request(&headers(&[]), 80));
-        assert!(local_request(&headers(&[(header::HOST, "127.0.0.1:80")]), 80));
+        let loopback = IpAddr::V4(Ipv4Addr::LOCALHOST);
+        let host = |h: &str, address: IpAddr| local_request(&headers(&[(header::HOST, h)]), address, 80);
+        assert!(local_request(&headers(&[]), loopback, 80));
+        assert!(host("127.0.0.1:80", loopback));
+        assert!(host("[::1]:80", loopback));
         assert!(local_request(
             &headers(&[(header::HOST, "localhost:80"), (header::ORIGIN, "http://localhost:80")]),
+            loopback,
             80
         ));
-        assert!(!local_request(&headers(&[(header::HOST, "evil.example:80")]), 80));
-        assert!(!local_request(&headers(&[(header::HOST, "127.0.0.1:81")]), 80));
-        assert!(!local_request(&headers(&[(header::ORIGIN, "https://evil.example")]), 80));
-        assert!(!local_request(&headers(&[(header::ORIGIN, "null")]), 80));
+        assert!(!host("evil.example:80", loopback));
+        assert!(!host("127.0.0.1:81", loopback));
+        assert!(!host("100.92.72.95:80", loopback), "another address of a loopback server");
+        assert!(!local_request(&headers(&[(header::ORIGIN, "https://evil.example")]), loopback, 80));
+        assert!(!local_request(&headers(&[(header::ORIGIN, "null")]), loopback, 80));
+
+        // Listening on one address: that address too, still never a host name.
+        let lan: IpAddr = "100.92.72.95".parse().unwrap();
+        assert!(host("100.92.72.95:80", lan) && host("127.0.0.1:80", lan));
+        assert!(!host("100.92.72.96:80", lan) && !host("evil.example:80", lan));
+        // Listening on every address: any IP address, still never a host name.
+        let every: IpAddr = "0.0.0.0".parse().unwrap();
+        assert!(host("192.168.1.7:80", every) && host("[fe80::1]:80", every));
+        assert!(!host("evil.example:80", every) && !host("192.168.1.7:81", every));
+        assert!(local_request(
+            &headers(&[(header::HOST, "192.168.1.7:80"), (header::ORIGIN, "http://192.168.1.7:80")]),
+            every,
+            80
+        ));
+    }
+
+    #[test]
+    fn clients_on_this_computer_connect_to_loopback_for_every_address() {
+        let ip = |s: &str| s.parse::<IpAddr>().unwrap();
+        assert_eq!(local_address(ip("0.0.0.0")), ip("127.0.0.1"));
+        assert_eq!(local_address(ip("::")), ip("::1"));
+        assert_eq!(local_address(ip("100.92.72.95")), ip("100.92.72.95"));
     }
 
     #[test]

crates/ide-mcp/src/stdio.rs

@@ -148,13 +148,14 @@ async fn post(
         )
     };
     let info = Discovery::read(discovery).map_err(|_| not_running())?;
-    let stream = tokio::net::TcpStream::connect(("127.0.0.1", info.port)).await.map_err(|_| not_running())?;
+    let at = std::net::SocketAddr::new(info.address, info.port);
+    let stream = tokio::net::TcpStream::connect(at).await.map_err(|_| not_running())?;
     let (mut sender, conn) = hyper::client::conn::http1::handshake(hyper_util::rt::TokioIo::new(stream))
         .await
         .map_err(|e| format!("cannot reach OpenIDEA: {e}"))?;
     tokio::spawn(conn);
     let request = Request::post(format!("/mcp?project={}", crate::encode_query(&project.to_string_lossy())))
-        .header(header::HOST, format!("127.0.0.1:{}", info.port))
+        .header(header::HOST, at.to_string())
         .header(header::AUTHORIZATION, format!("Bearer {}", info.token))
         .header("mcp-session-id", scope)
         .header(header::CONTENT_TYPE, "application/json")

crates/ide-mcp/tests/server.rs

@@ -373,7 +373,7 @@ async fn a_fixed_port_and_token_are_used_and_a_taken_port_falls_back_to_a_free_o
     s.server.take().unwrap().stop();
     let free = std::net::TcpListener::bind(("127.0.0.1", 0)).unwrap().local_addr().unwrap().port();
     let token = "ab".repeat(32);
-    let options = ServerOptions { port: Some(free), token: Some(token.clone()) };
+    let options = ServerOptions { port: Some(free), token: Some(token.clone()), ..Default::default() };
     let registry = Arc::new(Registry { project: s.project.clone() });
     let runtime = tokio::runtime::Handle::current();
     s.server =
@@ -393,3 +393,34 @@ async fn a_fixed_port_and_token_are_used_and_a_taken_port_falls_back_to_a_free_o
         second.port_unavailable()
     );
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn another_listen_address_is_used_and_one_not_on_this_computer_fails() {
+    let mut s = setup();
+    s.server.take().unwrap().stop();
+    let registry = Arc::new(Registry { project: s.project.clone() });
+    let runtime = tokio::runtime::Handle::current();
+
+    // Every address: clients here use loopback; other computers name the server by an address of it.
+    let every = ServerOptions { address: Some("0.0.0.0".parse().unwrap()), ..Default::default() };
+    s.server = Some(McpServer::start_with(registry.clone(), Some(s.discovery.clone()), &runtime, every).unwrap());
+    let port = s.server().port();
+    assert_eq!(s.server().address().to_string(), "0.0.0.0");
+    assert!(s.server().url(&s.project).starts_with(&format!("http://127.0.0.1:{port}/mcp?")));
+    assert_eq!(Discovery::read(&s.discovery).unwrap().address.to_string(), "127.0.0.1");
+    let ping = json!({ "jsonrpc": "2.0", "id": 1, "method": "ping" }).to_string();
+    let request = |host: String| {
+        format!(
+            "POST /mcp HTTP/1.1\r\nHost: {host}\r\n{}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{ping}",
+            bearer(&s),
+            ping.len()
+        )
+    };
+    assert_eq!(http(port, &request(format!("192.0.2.7:{port}"))).await.0, 200);
+    assert_eq!(http(port, &request(format!("evil.example:{port}"))).await.0, 403, "never a host name");
+
+    // Not an address of this computer: the server does not start, and says which address.
+    let elsewhere = ServerOptions { address: Some("192.0.2.1".parse().unwrap()), ..Default::default() };
+    let error = McpServer::start_with(registry, None, &runtime, elsewhere).err().expect("no such address here");
+    assert!(error.to_string().contains("192.0.2.1"), "{error}");
+}

crates/ide-plugin/src/runtime.rs

@@ -234,6 +234,11 @@ pub trait HostApi: Send + Sync {
         let _ = (path, set, item);
         Err(HostError::Failed("decorations unavailable".into()))
     }
+    /// Replace all `(path, icon)` entries of a tree decoration set at once (API 1.8).
+    fn file_icon_decorations(&self, set: &str, items: Vec<(PathBuf, String)>) -> Result<(), HostError> {
+        let _ = (set, items);
+        Err(HostError::Failed("decorations unavailable".into()))
+    }
     /// Trusted repository history.
     fn vcs_log(
         &self,

crates/ide-plugin/src/types.rs

@@ -932,6 +932,9 @@ pub struct FileDecoration {
     /// Text shown after the name (API 1.7 `set-file-note`).
     #[serde(default)]
     pub note: Option<String>,
+    /// `[[contributes.fileIcons]]` id for this file or folder (API 1.8 `set-file-icon`).
+    #[serde(default)]
+    pub icon: Option<String>,
 }
 /// Commit metadata, date in Unix seconds.
 #[derive(Clone, Debug, Serialize, Deserialize, Type)]

crates/ide-plugin/src/wit_host.rs

@@ -2505,7 +2505,13 @@ impl bindings::openidea::plugin::decorations::Host for StoreData {
             .file_decorations(
                 Some(&real),
                 &set_id,
-                Some(crate::FileDecoration { badge: item.badge, style: item.style, tooltip: item.tooltip, note: None }),
+                Some(crate::FileDecoration {
+                    badge: item.badge,
+                    style: item.style,
+                    tooltip: item.tooltip,
+                    note: None,
+                    icon: None,
+                }),
             )
             .map_err(to_wit))
     }
@@ -2523,9 +2529,36 @@ impl bindings::openidea::plugin::decorations::Host for StoreData {
             Ok(real) => real,
             Err(e) => return Ok(Err(e)),
         };
-        let item = crate::FileDecoration { badge: None, style: String::new(), tooltip, note: Some(note) };
+        let item = crate::FileDecoration { badge: None, style: String::new(), tooltip, note: Some(note), icon: None };
         Ok(self.host.file_decorations(Some(&real), &set_id, Some(item)).map_err(to_wit))
     }
+    fn set_file_icon(&mut self, path: String, set_id: String, icon: String, tooltip: Option<String>) -> Fallible<()> {
+        if let Err(e) = self.require(Capability::ProjectRead) {
+            return Ok(Err(e));
+        }
+        let real = match self.decoration_path(&path) {
+            Ok(real) => real,
+            Err(e) => return Ok(Err(e)),
+        };
+        let item = crate::FileDecoration { badge: None, style: String::new(), tooltip, note: None, icon: Some(icon) };
+        Ok(self.host.file_decorations(Some(&real), &set_id, Some(item)).map_err(to_wit))
+    }
+    fn set_file_icons(&mut self, set_id: String, items: Vec<(String, String)>) -> Fallible<()> {
+        if let Err(e) = self.require(Capability::ProjectRead) {
+            return Ok(Err(e));
+        }
+        if items.len() > 10_000 {
+            return Ok(Err(wit::Error::Invalid("at most 10000 file icons per set".into())));
+        }
+        let mut resolved = Vec::with_capacity(items.len());
+        for (path, icon) in items {
+            match self.decoration_path(&path) {
+                Ok(real) => resolved.push((real, icon)),
+                Err(e) => return Ok(Err(e)),
+            }
+        }
+        Ok(self.host.file_icon_decorations(&set_id, resolved).map_err(to_wit))
+    }
 }
 
 pub(crate) mod language_features_bindings {

crates/ide-plugin/tests/fixtures/api14/dist/plugin.wasm.sources

@@ -1 +1 @@
-6c50332c868a890b91a7f92ef7f92e76a4818b7435291e99c77c0b9f0931b81c
+e616b87b24371581ad648f9c7072259de7732d122b5887b488f7bd480ebd69c2

crates/ide-plugin/tests/fixtures/commit/dist/plugin.wasm.sources

@@ -1 +1 @@
-fdcb208365db90bcd06d0d0df3d436b69d1229c40f7c63dd6f1ab768e0d236b8
+75eeecc467bff141bda14f1f080633348af348f7259e793be81e6548d2008669

crates/ide-plugin/tests/fixtures/data-tools/dist/plugin.wasm.sources

@@ -1 +1 @@
-3108abe8d381b224ec4b44ecf4c43c045671bd5e221ee21582e25497f8c14dff
+4aaf7754e895f022d34dad05bd2b8018e3a61ba18771b8c95d9f070cb212530c

crates/ide-plugin/tests/fixtures/detail-views/dist/plugin.wasm.sources

@@ -1 +1 @@
-876a84b7da5a4b27fce47cf71a4dc28eb1ea6c9d54283c1b73a2ae2411653bf5
+e573144879a7caa0975e17b233476eb317ff54bef23fd8fa64280d3649bad700

crates/ide-plugin/tests/fixtures/diagnostics/dist/plugin.wasm.sources

@@ -1 +1 @@
-234dc693e01e484b91fa7f2d0ac0e7757fb69c9fba81f06bf8ef1cd3624228d8
+36dd40ef751a617f1ad59491312889c12481b05666e580f21f7c2552df76edbc

crates/ide-plugin/tests/fixtures/diagnostics/src/lib.rs

@@ -39,12 +39,8 @@ impl Plugin for Fixture {
                     hover: None,
                     after: Some(after.into()),
                 };
-                host::set_decorations(
-                    path,
-                    "fixture",
-                    &[item("typo", "typo message"), item("weak", "weak message")],
-                )
-                .map(|()| None)
+                host::set_decorations(path, "fixture", &[item("typo", "typo message"), item("weak", "weak message")])
+                    .map(|()| None)
             }
             _ => Err(Error::NotFound(id.into())),
         }

crates/ide-plugin/tests/fixtures/endpoints/dist/plugin.wasm.sources

@@ -1 +1 @@
-927c329fd21d12fd5f423b937e1be756be45a4c6dceee08679e762d5d9f511f2
+724ed3bbd828e4fc1925c1b555bdaec9268633cb587806a661f8838e5a540545

crates/ide-plugin/tests/fixtures/execution/dist/plugin.wasm.sources

@@ -1 +1 @@
-e7c77fde915e0765f91929dba2aa8eff606f2302e078b7305d272a4de5b9d80b
+1a3685234f1b3b0957184c44c603c0eefe7e3084b88d0df32da268b29292ee92

crates/ide-plugin/tests/fixtures/ext-owner/dist/plugin.wasm.sources

@@ -1 +1 @@
-3feb9df8b408dedbc3586864db00b92c8cb244c8ad5b8f10c95edb8eb3d30df1
+4283de821d69a18438f58062e4bc28b63ba5025cc5f9fa51f21ff475b677a6a5

crates/ide-plugin/tests/fixtures/file-templates/dist/plugin.wasm.sources

@@ -1 +1 @@
-3bfce29f90b9d2f20082b9bdd0957c6c58c265a346305ec948f514537a4579c8
+0f25487b8e488e5ec01fabd2951bdb03d80bc26e4e9aa508394a7f9cd09d1759

crates/ide-plugin/tests/fixtures/files-events/dist/plugin.wasm.sources

@@ -1 +1 @@
-ca72c5cfa2f76a93bc07495d50e58181a9c6c2fc75854cf548bb0278814ddb87
+80f9dc28e4f168dd22ccee1c53e1f6b08c446622eb10f07de29be5fc45e9fb1c

crates/ide-plugin/tests/fixtures/grouped-views/dist/plugin.wasm.sources

@@ -1 +1 @@
-8a4a7df8fd6cf397750ac24cedf06174ed50e4214ef44029e29f7d0557d426ba
+5355cb4ef373eba3c54806eb00294fcd5fccb3cf05dae3e1c2a4ad45ab958f03

crates/ide-plugin/tests/fixtures/hello/dist/plugin.wasm.sources

@@ -1 +1 @@
-8d12313675e0869e087ac4c79bdfb1a9738867e28af2437eff27cb07254f572b
+fc75ede42e6db7619fa28fc8999f091d39e3c1ed401356db3a3f07de54287c99

crates/ide-plugin/tests/fixtures/hover/dist/plugin.wasm.sources

@@ -1 +1 @@
-1b2ad52d4cbb4abb662be5772f050844836f8e3f0c525edd0de19ff45e95a148
+8793601496f1727cf912e4cdf86ec48fc340a17585098e98dee52a125cb8a16d

crates/ide-plugin/tests/fixtures/indexer/dist/plugin.wasm.sources

@@ -1 +1 @@
-13babf73d8d3d029aba26641b01a4add3abb3dab84394d8bd676edb064dc0c19
+fb2db14a645cad42941d20a25a3ff87ca6fdee635fdb40953383ff30ce16af8a

crates/ide-plugin/tests/fixtures/inlay-hints/dist/plugin.wasm.sources

@@ -1 +1 @@
-a7790bf28783d57ed47f635a58981b80ddaecd7074cf88c539465b57132a9f8f
+fc66b3b56a1ab1c9d547e3efe6bb4693dca908bb18be8b8ebd26f2fb41e4436c

crates/ide-plugin/tests/fixtures/jobs/dist/plugin.wasm.sources

@@ -1 +1 @@
-af7070f6ca3a14cf480260aa21b7a6e95038996d224d40e53a487c96a8f3acf2
+c76830df9dee3caba932ffaddaabce88ac7ef23b3957b3e8e570b4939dd58d9d

crates/ide-plugin/tests/fixtures/language-features/dist/plugin.wasm.sources

@@ -1 +1 @@
-16930ecfe74d096e6dcaa5fbf35664128b4d3844f47993a947aabe9d2a9650de
+3a41a06d54939a9e85fcf6b0bf15b336f928a3caf66576bd2da62c5b8b177c1d

crates/ide-plugin/tests/fixtures/misbehave/dist/plugin.wasm.sources

@@ -1 +1 @@
-25eaf7ac2837ade4b3204698d3af41854324ece6ec196daba84bea6bb41f6cde
+f30a8c0a7893519872628c001314efd567f87f4dfaf718a737ea3631b55881b0

crates/ide-plugin/tests/fixtures/path-events/dist/plugin.wasm.sources

@@ -1 +1 @@
-f7cd477be706ee5da2656ffb5435cb2b52443aec1270b3b1d804b2bdc6ed8bc8
+cb65533984ffd8684c9e9f5ddeef92a8f387735c12310b25282ee7bbf2d73cd7

crates/ide-plugin/tests/fixtures/private-dir/dist/plugin.wasm.sources

@@ -1 +1 @@
-c97989134a8e8a0a12013909f4726288b6d9cdaa44d02a58ff505a6cbb1fb9a1
+d11f9cb1130f3f3aaa89514bf47ec8ece9b2ca0edf1d82c11f80b262325f16be

crates/ide-plugin/tests/fixtures/semantic-tokens/dist/plugin.wasm.sources

@@ -1 +1 @@
-67660f5ebbfdd3967fabcc0b5c41f215d4a38d9092b91eb0166f12bccfdffffa
+48ea4414469ebd70a89da8a5df7b7bddc4d32f5c50f1759ee3cea14558073c92

crates/ide-plugin/tests/fixtures/settings-pages/dist/plugin.wasm.sources

@@ -1 +1 @@
-09c810ce7ebd820ea21525dc9faea99b13e7665b308cb131510e02b86e763c9f
+0c02303182be04ed3776fb532fd8b72e6057aa0fdb92b7d235000146fef4120e

crates/ide-plugin/tests/fixtures/storage/dist/plugin.wasm.sources

@@ -1 +1 @@
-9b3a210440560e05326947c7d549ce691315839daea2931c6a78720f7b0d9e7c
+8162a70e848172663463119e6357984a73e54bc71a99b2845621d0733cf9333e

crates/ide-plugin/tests/fixtures/symbols/dist/plugin.wasm.sources

@@ -1 +1 @@
-57d8b00b5853ca789fe704f21e4394d1524dd73dfd27ea4a0b34f4b0e4f1a5f8
+4524cab0ceac631153a945f6b76f7d40efd3c854740ae22c64580381e9532397

crates/ide-plugin/tests/fixtures/tables/dist/plugin.wasm.sources

@@ -1 +1 @@
-53e355922819b8034c93070323c7eb2b1505d3bf561dd5de6abb930fe514748c
+a92f4def072ca4cc805414516ab4f046fc54bcf11394a5413a27ea151c156174

crates/ide-plugin/tests/fixtures/web-content/dist/plugin.wasm.sources

@@ -1 +1 @@
-7af929a1adf5d89929d66e78068253ccde9ad5cedee329c2d4db6b7a5e29790e
+994fca61bc5a10f0229301406af76c188a9cb2f593db85a403c1ece746e9f7b5

crates/ide-plugin/tests/fixtures/web-log/dist/plugin.wasm.sources

@@ -1 +1 @@
-511fab979382c5d64054ba4f5fdfc98d50e252dfd5896265ee589336bf8e7d70
+48eaf97f57cc08c3854a1effa37ebf29defca4782f76c7de1da6ef9a02c23441

crates/ide-plugin/tests/fixtures/web-pty/dist/plugin.wasm.sources

@@ -1 +1 @@
-444497128ec5e1e01229a93d2340b49ccc5bc27e67defb2c4fe19683042442a3
+b896043cf261ff4bb19977f4648a736907fa897b8d4f0804077678a5895d1845

crates/ide-run/src/detect.rs

@@ -5,6 +5,7 @@
 
 pub(crate) mod cmake;
 mod dotnet;
+mod zig;
 
 use crate::RunConfig;
 use ide_core::project_roots::expand_members;
@@ -72,6 +73,7 @@ pub(crate) fn detect_with_profiles(
             }
         }
     }
+    detect_projects(root, &["build.zig"], zig::detect, &mut out);
     dotnet::detect(root, &mut out);
     detect_projects(root, &["Makefile", "makefile", "GNUmakefile"], detect_make, &mut out);
     detect_projects(root, &["justfile", "Justfile", ".justfile"], detect_just, &mut out);

crates/ide-run/src/detect/zig.rs

@@ -0,0 +1,232 @@
+//! Zig projects (`build.zig`): the build's steps (`zig build <step>`) and, for each executable it
+//! declares, the installed binary (`zig-out/bin/<name>`), built first and debuggable with CodeLLDB.
+//! Read from the build script's source: detecting configurations never runs the project's build code.
+
+use super::{ConfigExt, config, read};
+use crate::{BeforeLaunchTask, RunConfig};
+use std::path::Path;
+
+pub(super) const BUILD_ID: &str = "zig:build";
+
+pub(super) fn detect(dir: &Path, out: &mut Vec<RunConfig>) {
+    let Some(src) = read(&dir.join("build.zig")) else { return };
+    let src = code_only(&src);
+    out.push(config(BUILD_ID, "zig build", "zig", "zig", &["build"]));
+    for step in steps(&src) {
+        // `install` is what plain `zig build` runs.
+        if step == "install" || step == "uninstall" {
+            continue;
+        }
+        let mut c = config(format!("zig:{step}"), format!("zig build {step}"), "zig", "zig", &["build", &step]);
+        if step == "test" || step.starts_with("test-") || step.starts_with("test_") {
+            c = c.test();
+        }
+        out.push(c);
+    }
+    for exe in executables(&src) {
+        let binary = if cfg!(windows) {
+            format!("zig-out\\bin\\{}.exe", exe.name)
+        } else {
+            format!("./zig-out/bin/{}", exe.name)
+        };
+        let mut c = config(format!("zig:exe:{}", exe.name), exe.name.clone(), "zig-application", &binary, &[])
+            .debug("codelldb");
+        c.extras.before_launch.push(BeforeLaunchTask { kind: "run".into(), target: BUILD_ID.into() });
+        if let Some(source) = exe.source {
+            c.extras.params.insert("source".into(), source);
+        }
+        out.push(c);
+    }
+}
+
+/// `src` with comments blanked out (Zig has only `//` comments) and string contents kept.
+fn code_only(src: &str) -> String {
+    let mut out = String::with_capacity(src.len());
+    for line in src.lines() {
+        let mut in_string = false;
+        let mut escaped = false;
+        let mut end = line.len();
+        let bytes = line.as_bytes();
+        for (i, &b) in bytes.iter().enumerate() {
+            if in_string {
+                match b {
+                    _ if escaped => escaped = false,
+                    b'\\' => escaped = true,
+                    b'"' => in_string = false,
+                    _ => {}
+                }
+            } else if b == b'"' {
+                in_string = true;
+            } else if b == b'/' && bytes.get(i + 1) == Some(&b'/') {
+                end = i;
+                break;
+            }
+        }
+        out.push_str(&line[..end]);
+        out.push('\n');
+    }
+    out
+}
+
+/// The string literal starting at `s` (after optional whitespace), unescaped only for `\"`.
+fn string_at(s: &str) -> Option<String> {
+    let rest = s.trim_start().strip_prefix('"')?;
+    let mut value = String::new();
+    let mut chars = rest.chars();
+    while let Some(c) = chars.next() {
+        match c {
+            '"' => return Some(value),
+            '\\' => value.push(chars.next()?),
+            c => value.push(c),
+        }
+    }
+    None
+}
+
+/// Step names from `<build>.step("name", "description")`, in order and without duplicates.
+fn steps(src: &str) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    for (i, _) in src.match_indices(".step(") {
+        let preceded = src[..i].chars().next_back().is_some_and(|c| c.is_alphanumeric() || c == '_');
+        if let Some(name) = string_at(&src[i + ".step(".len()..])
+            && preceded
+            && !name.is_empty()
+            && !out.contains(&name)
+        {
+            out.push(name);
+        }
+    }
+    out
+}
+
+struct Executable {
+    name: String,
+    /// Root source file, relative to the build script's folder.
+    source: Option<String>,
+}
+
+/// `addExecutable(.{ .name = "…", … .root_source_file = <b>.path("…") … })`: the name at the
+/// options' top level (an `imports` entry has its own `.name`) and the first root source file.
+fn executables(src: &str) -> Vec<Executable> {
+    let mut out: Vec<Executable> = Vec::new();
+    for (start, _) in src.match_indices("addExecutable(") {
+        let body = &src[start + "addExecutable(".len()..];
+        let (mut depth, mut in_string, mut escaped) = (1usize, false, false);
+        let mut name = None;
+        let mut source = None;
+        for (i, c) in body.char_indices() {
+            if in_string {
+                match c {
+                    _ if escaped => escaped = false,
+                    '\\' => escaped = true,
+                    '"' => in_string = false,
+                    _ => {}
+                }
+                continue;
+            }
+            match c {
+                '"' => in_string = true,
+                '(' | '{' | '[' => depth += 1,
+                ')' | '}' | ']' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        break;
+                    }
+                }
+                '.' => {
+                    let field = &body[i + 1..];
+                    let value =
+                        |key: &str| field.strip_prefix(key)?.trim_start().strip_prefix('=').map(str::trim_start);
+                    if depth == 2 && name.is_none() {
+                        name = value("name").and_then(string_at);
+                    }
+                    if source.is_none()
+                        && let Some(v) = value("root_source_file")
+                        && let Some(call) = v.find(".path(")
+                        && v[..call].chars().all(|c| c.is_alphanumeric() || c == '_')
+                    {
+                        source = string_at(&v[call + ".path(".len()..]);
+                    }
+                }
+                _ => {}
+            }
+        }
+        if let Some(name) = name
+            && !name.is_empty()
+            && !out.iter().any(|e| e.name == name)
+        {
+            out.push(Executable { name, source });
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const INIT: &str = r#"const std = @import("std");
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{});
+    const mod = b.addModule("app", .{
+        .root_source_file = b.path("src/root.zig"),
+        .target = target,
+    });
+    // const old = b.addExecutable(.{ .name = "commented-out" });
+    const exe = b.addExecutable(.{
+        .name = "app",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("src/main.zig"),
+            .target = target,
+            .imports = &.{
+                .{ .name = "app", .module = mod },
+            },
+        }),
+    });
+    b.installArtifact(exe);
+    const tool = b.addExecutable(.{ .name = "gen-docs", .root_module = b.createModule(.{
+        .root_source_file = b.path("tools/gen_docs.zig"),
+    }) });
+    _ = tool;
+    const run_step = b.step("run", "Run the app");
+    const test_step = b.step("test", "Run tests");
+    const docs = b.step("docs", "Generate docs // not a comment");
+    _ = .{ run_step, test_step, docs };
+}
+"#;
+
+    #[test]
+    fn steps_and_executables_come_from_the_build_script() {
+        let src = code_only(INIT);
+        assert_eq!(steps(&src), ["run", "test", "docs"]);
+        let exes = executables(&src);
+        assert_eq!(
+            exes.iter().map(|e| (e.name.as_str(), e.source.as_deref())).collect::<Vec<_>>(),
+            [("app", Some("src/main.zig")), ("gen-docs", Some("tools/gen_docs.zig"))]
+        );
+    }
+
+    #[test]
+    fn a_zig_project_gets_build_steps_and_debuggable_executables() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("build.zig"), INIT).unwrap();
+        let mut out = Vec::new();
+        detect(dir.path(), &mut out);
+        let ids: Vec<_> = out.iter().map(|c| c.id.as_str()).collect();
+        assert_eq!(ids, ["zig:build", "zig:run", "zig:test", "zig:docs", "zig:exe:app", "zig:exe:gen-docs"]);
+        let test = out.iter().find(|c| c.id == "zig:test").unwrap();
+        assert!(test.is_test);
+        assert_eq!(
+            (test.command.as_str(), test.args.as_slice()),
+            ("zig", ["build".to_owned(), "test".to_owned()].as_slice())
+        );
+        let app = out.iter().find(|c| c.id == "zig:exe:app").unwrap();
+        assert_eq!(app.kind, "zig-application");
+        assert!(app.command.ends_with(if cfg!(windows) { "app.exe" } else { "zig-out/bin/app" }));
+        assert_eq!(app.debug_adapter.as_deref(), Some("codelldb"));
+        assert_eq!(app.extras.before_launch[0].kind, "run");
+        assert_eq!(app.extras.before_launch[0].target, BUILD_ID);
+        assert_eq!(app.extras.params.get("source").map(String::as_str), Some("src/main.zig"));
+    }
+}

crates/ide-run/src/junit.rs

@@ -26,8 +26,10 @@ pub struct TestCaseReport {
     pub duration_ms: Option<f64>,
     /// Failure / error / skip message.
     pub message: Option<String>,
-    /// Failure stack trace and captured output.
+    /// Failure / error stack trace.
     pub output: Option<String>,
+    /// What the test printed (`<system-out>`, `<system-err>`).
+    pub stdout: Option<String>,
 }
 
 fn decode(s: &str) -> String {
@@ -124,11 +126,13 @@ pub fn parse_report(xml: &str) -> Vec<TestCaseReport> {
         if let Some(name) = tag.strip_prefix('/') {
             match name.trim() {
                 "testcase" => out.extend(current.take()),
-                "failure" | "error" | "rerunFailure" | "rerunError" | "skipped" | "system-out" | "system-err" => {
+                name @ ("failure" | "error" | "rerunFailure" | "rerunError" | "skipped" | "system-out"
+                | "system-err") => {
                     if let (Some(t), Some(c)) = (text.take(), current.as_mut()) {
                         let t = t.trim_matches('\n');
                         if !t.trim().is_empty() {
-                            let o = c.output.get_or_insert_with(String::new);
+                            let field = if name.starts_with("system-") { &mut c.stdout } else { &mut c.output };
+                            let o = field.get_or_insert_with(String::new);
                             if !o.is_empty() {
                                 o.push('\n');
                             }
@@ -160,6 +164,7 @@ pub fn parse_report(xml: &str) -> Vec<TestCaseReport> {
                     duration_ms,
                     message: None,
                     output: None,
+                    stdout: None,
                 };
                 if self_closing {
                     out.push(case);
@@ -238,6 +243,8 @@ mod tests {
     <failure message="expected: &lt;1&gt; but was: &lt;2&gt;" type="org.opentest4j.AssertionFailedError"><![CDATA[org.opentest4j.AssertionFailedError: expected: <1> but was: <2>
 	at com.example.demo.todo.TodoServiceTests.fails(TodoServiceTests.java:30)
 ]]></failure>
+    <system-out><![CDATA[printed before failing
+]]></system-out>
   </testcase>
   <testcase name="later" classname="com.example.demo.todo.TodoServiceTests" time="0">
     <skipped message="not yet"/>
@@ -254,10 +261,13 @@ mod tests {
         assert_eq!(cases[0].status, TestCaseStatus::Passed);
         assert_eq!(cases[0].duration_ms, Some(31.0));
         assert_eq!(cases[1].name, "deleteReturnsFalseForUnknownId");
-        assert_eq!(cases[1].output.as_deref(), Some("hello <world>"));
+        assert_eq!(cases[1].stdout.as_deref(), Some("hello <world>"));
+        assert_eq!(cases[1].output, None);
         assert_eq!(cases[2].status, TestCaseStatus::Failed);
         assert_eq!(cases[2].message.as_deref(), Some("expected: <1> but was: <2>"));
         assert!(cases[2].output.as_deref().unwrap().contains("TodoServiceTests.java:30"));
+        assert!(!cases[2].output.as_deref().unwrap().contains("printed"));
+        assert_eq!(cases[2].stdout.as_deref(), Some("printed before failing"));
         assert_eq!(cases[2].duration_ms, Some(1_234_500.0));
         assert_eq!(cases[3].status, TestCaseStatus::Skipped);
         assert_eq!(cases[3].message.as_deref(), Some("not yet"));

crates/ide-sdk/src/apply.rs

@@ -3,7 +3,7 @@
 
 use crate::discover::{project_venv_python, workspace_tsdk};
 use crate::exec::{path_with, search_path, which};
-use crate::npm::{has_ts_api, own_typescript};
+use crate::npm::{has_ts_api, native_typescript, own_typescript};
 use crate::{angular, astro, godot, pinned, vue};
 use crate::{bin_dir, exe, venv_of};
 use ide_core::settings::{InspectionLevel, InspectionSettings, LanguageServerSettings, Settings};
@@ -722,6 +722,16 @@ pub fn tsdk(root: &Path, s: &Settings) -> Option<PathBuf> {
     }
 }
 
+/// TypeScript 7's native executable when the selected TypeScript is one (see
+/// [`native_typescript`]); `None` for the bundled one and TypeScript 6 and older.
+pub fn native_tsdk(root: &Path, s: &Settings) -> Option<PathBuf> {
+    match s.languages.typescript.version.trim() {
+        "" | "bundled" => None,
+        "workspace" => native_typescript(&root.join("node_modules/typescript")),
+        custom => native_typescript(&setting_path(root, custom)?),
+    }
+}
+
 const PYTHON_SERVERS: [&str; 7] = ["basedpyright", "pyright", "ty", "pyrefly", "pylsp", "jedi-language-server", "ruff"];
 
 pub(crate) fn merge(base: &mut Value, layer: Value) {
@@ -1140,6 +1150,16 @@ pub fn configure_server(cfg: &mut LanguageServerConfig, root: &Path, server_root
             _ => {}
         }
     }
+    // TypeScript 7 serves LSP itself: it replaces the tsserver-based server.
+    if matches!(name, "vtsls" | "typescript-language-server")
+        && let Some(native) = native_tsdk(server_root, s).or_else(|| native_tsdk(root, s))
+    {
+        cfg.command = native.to_string_lossy().into_owned();
+        cfg.args = vec!["--lsp".into(), "--stdio".into()];
+        cfg.initialization_options = None;
+        cfg.tsserver_project = false;
+        return;
+    }
     let vue_command = s.tool_path(vue::SERVER).and_then(|p| setting_path(root, p));
     let vue_command = vue_command.as_deref().map_or(vue::SERVER.into(), Path::to_string_lossy);
     if name == "vtsls"

crates/ide-sdk/src/discover.rs

@@ -749,14 +749,26 @@ pub(crate) fn workspace_tsdk(root: &Path) -> Option<PathBuf> {
 
 fn typescript(root: Option<&Path>) -> Vec<Sdk> {
     let mut out = Vec::new();
-    if let Some(lib) = root.and_then(workspace_tsdk) {
+    // TypeScript 7 has no `tsserver.js`; its package directory stands for it (`native_tsdk`).
+    let native = || {
+        let package = root?.join("node_modules/typescript");
+        crate::npm::native_typescript(&package).map(|_| package.join("lib"))
+    };
+    if let Some(lib) = root.and_then(workspace_tsdk).or_else(native) {
         let version = std::fs::read_to_string(lib.parent().unwrap_or(&lib).join("package.json"))
             .ok()
             .and_then(|t| serde_json::from_str::<serde_json::Value>(&t).ok())
             .and_then(|v| v.get("version").and_then(|v| v.as_str()).map(str::to_owned));
         out.push(Sdk {
             path: lib.clone().into(),
-            name: format!("TypeScript {}", version.clone().unwrap_or_default()).trim().to_owned(),
+            name: format!(
+                "TypeScript {}{}",
+                version.clone().unwrap_or_default(),
+                if crate::npm::has_ts_api(&lib) { "" } else { " (native)" }
+            )
+            .replace("  ", " ")
+            .trim()
+            .to_owned(),
             version,
             source: "workspace".into(),
             home: lib.parent().map(Into::into),

crates/ide-sdk/src/npm.rs

@@ -10,6 +10,41 @@ pub(crate) fn has_ts_api(lib: &Path) -> bool {
     lib.join("typescript.js").is_file()
 }
 
+/// The native executable of TypeScript 7 (`typescript` 7+, whose `tsc` is native, or
+/// `@typescript/native-preview`'s `tsgo`), from its package directory or its `lib`.
+/// These packages have no JavaScript API (`lib/typescript.js`); their platform package
+/// (`@typescript/typescript-darwin-arm64`) holds the executable, which serves LSP itself
+/// (`--lsp --stdio`).
+pub(crate) fn native_typescript(dir: &Path) -> Option<PathBuf> {
+    let package = if dir.join("package.json").is_file() { dir } else { dir.parent()? };
+    if has_ts_api(&package.join("lib")) {
+        return None;
+    }
+    let manifest: serde_json::Value =
+        serde_json::from_slice(&std::fs::read(package.join("package.json")).ok()?).ok()?;
+    let (base, bin) = match manifest.get("name")?.as_str()? {
+        "typescript" => ("typescript", "tsc"),
+        "@typescript/native-preview" => ("native-preview", "tsgo"),
+        _ => return None,
+    };
+    let os = match std::env::consts::OS {
+        "macos" => "darwin",
+        "windows" => "win32",
+        os => os,
+    };
+    let arch = match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        "x86_64" => "x64",
+        arch => arch,
+    };
+    let platform = format!("{base}-{os}-{arch}");
+    // Next to the package (`node_modules/@typescript/…`) or nested in it.
+    package
+        .ancestors()
+        .map(|a| a.join("node_modules/@typescript").join(&platform).join("lib").join(crate::exe(bin)))
+        .find(|exe| exe.is_file())
+}
+
 /// The usable TypeScript library Node resolves from an installed server package.
 pub(crate) fn own_typescript(package: &Path) -> Option<PathBuf> {
     package.ancestors().map(|a| a.join("node_modules/typescript/lib")).find(|l| has_ts_api(l))

crates/ide-sdk/src/tests.rs

@@ -1359,6 +1359,51 @@ fn a_server_chosen_from_a_node_installation_runs_on_that_node() {
     assert_eq!(std::env::split_paths(&cfg.env["PATH"]).next(), Some(v20));
 }
 
+/// TypeScript 7 (`typescript` 7+, `@typescript/native-preview`) has no tsserver: choosing it
+/// runs its native executable's own language server instead of vtsls / typescript-language-server.
+#[test]
+fn typescript_7_runs_its_own_language_server() {
+    let tmp = tempfile::tempdir().unwrap();
+    let modules = tmp.path().join("node_modules");
+    let os = match std::env::consts::OS {
+        "macos" => "darwin",
+        "windows" => "win32",
+        os => os,
+    };
+    let arch = match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        "x86_64" => "x64",
+        arch => arch,
+    };
+    std::fs::create_dir_all(modules.join("typescript/lib")).unwrap();
+    std::fs::write(modules.join("typescript/package.json"), r#"{"name":"typescript","version":"7.0.2"}"#).unwrap();
+    let native = modules.join(format!("@typescript/typescript-{os}-{arch}/lib")).join(exe("tsc"));
+    std::fs::create_dir_all(native.parent().unwrap()).unwrap();
+    std::fs::write(&native, "").unwrap();
+    let mut s = Settings::default();
+    s.languages.typescript.version = "workspace".into();
+    for name in ["vtsls", "typescript-language-server"] {
+        let mut cfg = server(name);
+        configure_server(&mut cfg, tmp.path(), tmp.path(), &s);
+        assert_eq!(Path::new(&cfg.command), native, "{name}");
+        assert_eq!(cfg.args, ["--lsp", "--stdio"]);
+        assert!(cfg.initialization_options.is_none());
+    }
+    // Picked as a directory (its `lib`, as for older versions), too.
+    s.languages.typescript.version = modules.join("typescript/lib").to_string_lossy().into_owned();
+    let mut cfg = server("vtsls");
+    configure_server(&mut cfg, tmp.path(), tmp.path(), &s);
+    assert_eq!(Path::new(&cfg.command), native);
+
+    // TypeScript 6 keeps the tsserver-based server, pointed at it.
+    std::fs::write(modules.join("typescript/lib/typescript.js"), "").unwrap();
+    std::fs::write(modules.join("typescript/lib/tsserver.js"), "").unwrap();
+    s.languages.typescript.version = "workspace".into();
+    let mut cfg = server("vtsls");
+    configure_server(&mut cfg, tmp.path(), tmp.path(), &s);
+    assert_eq!(cfg.command, "vtsls");
+}
+
 #[test]
 fn the_godot_setting_applies_to_server_debugger_and_run_configurations() {
     let tmp = tempfile::tempdir().unwrap();

crates/ide-ssh/src/testing.rs

@@ -1,7 +1,8 @@
 //! An in-process SSH server for tests (feature `testing`): password `dev` /
 //! `secret`, commands answered by a closure, SFTP served from a local
 //! folder (remote `/x` is `<root>/x`), and a shell that echoes its input
-//! (`exit` ends it with status 0).
+//! (`exit` ends it with status 0). `direct-tcpip` channels are forwarded to local TCP
+//! ports, and refused when nothing listens there.
 
 use russh::server::{self, Auth, ChannelOpenHandle, Msg, Server as _, Session};
 use russh::{Channel, ChannelId};
@@ -71,6 +72,27 @@ impl server::Handler for Conn {
         Ok(())
     }
 
+    async fn channel_open_direct_tcpip(
+        &mut self,
+        channel: Channel<Msg>,
+        host: &str,
+        port: u32,
+        _originator_address: &str,
+        _originator_port: u32,
+        reply: ChannelOpenHandle,
+        _session: &mut Session,
+    ) -> Result<(), Self::Error> {
+        let Ok(mut upstream) = tokio::net::TcpStream::connect((host, port as u16)).await else {
+            return Ok(());
+        };
+        reply.accept().await;
+        tokio::spawn(async move {
+            let mut stream = channel.into_stream();
+            let _ = tokio::io::copy_bidirectional(&mut stream, &mut upstream).await;
+        });
+        Ok(())
+    }
+
     async fn exec_request(
         &mut self,
         channel: ChannelId,

crates/ide-vcs/src/backend.rs

@@ -41,6 +41,14 @@ pub trait Backend: Send + Sync {
     /// as `unstaged`.
     fn status(&self) -> IdeResult<Vec<FileStatus>>;
 
+    /// Working-area changes for `paths` only (absolute; those outside the root
+    /// are ignored), which is what a watcher batch needs. The default is the
+    /// full status: always correct, just not proportional to the batch.
+    fn status_paths(&self, paths: &[PathBuf]) -> IdeResult<Vec<FileStatus>> {
+        let _ = paths;
+        self.status()
+    }
+
     /// Text of `path` at `rev`; `None` when absent there.
     fn file_at(&self, path: &Path, rev: Option<&str>, encoding: TextEncoding) -> IdeResult<Option<String>>;
 
@@ -189,6 +197,10 @@ impl Backend for Repo {
         Repo::status(self)
     }
 
+    fn status_paths(&self, paths: &[PathBuf]) -> IdeResult<Vec<FileStatus>> {
+        Repo::status_paths(self, paths)
+    }
+
     fn file_at(&self, path: &Path, rev: Option<&str>, encoding: TextEncoding) -> IdeResult<Option<String>> {
         Repo::file_at(self, path, rev, encoding)
     }

crates/ide-vcs/src/lib.rs

@@ -764,6 +764,24 @@ impl Repo {
         let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
         status::status(self)
     }
+    /// Status of `paths` only (absolute; those outside the repository are ignored), for the
+    /// dirty-scope refresh after a watcher batch. An empty list is the full status.
+    pub fn status_paths(&self, paths: &[PathBuf]) -> IdeResult<Vec<FileStatus>> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        // Restricted Mode starts no program of the repository, and the scoped read is `git status`
+        // with a pathspec: answer with the full gitoxide status instead.
+        if !self.execution_allowed.load(std::sync::atomic::Ordering::Acquire) {
+            return status::status(self);
+        }
+        if paths.is_empty() {
+            return status::status_paths(self, &[]);
+        }
+        let rel: Vec<String> = paths.iter().filter_map(|p| self.given_rel_path(p).ok()).collect();
+        if rel.is_empty() {
+            return Ok(Vec::new());
+        }
+        status::status_paths(self, &rel)
+    }
     pub fn branch_info(&self) -> IdeResult<BranchInfo> {
         let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
         refs::branch_info(self)

crates/ide-vcs/src/repo.rs

@@ -148,7 +148,7 @@ impl Repo {
     }
 
     /// `path` relative to the worktree, spelled as given.
-    fn given_rel_path(&self, path: &Path) -> IdeResult<String> {
+    pub(crate) fn given_rel_path(&self, path: &Path) -> IdeResult<String> {
         let rel = if path.is_absolute() {
             self.strip_root(path)
                 .ok_or_else(|| IdeError::invalid(format!("{} is outside the repository", path.display())))?

crates/ide-vcs/src/roots.rs

@@ -146,17 +146,34 @@ impl Repos {
     /// The reads go through [`Backend`], the Changes-view surface — repositories of a
     /// future second backend slot in here once `Repos` learns to hold them.
     pub fn status(&self) -> IdeResult<Vec<FileStatus>> {
+        let groups: Vec<(Arc<Repo>, Vec<PathBuf>)> = self.repos.iter().map(|repo| (repo.clone(), Vec::new())).collect();
+        self.read_status(groups, false)
+    }
+
+    /// [`status`](Self::status) for `paths` only: each path goes to its innermost repository,
+    /// so a repository without one is not read at all and a nested repository keeps its own
+    /// files (the enclosing one's "untracked folder" entry for them is dropped).
+    pub fn status_paths(&self, paths: &[PathBuf]) -> IdeResult<Vec<FileStatus>> {
+        self.read_status(self.group(paths), true)
+    }
+
+    /// Reads one status per repository: the whole working tree, or `scoped` the paths it was
+    /// given. A nested repository reports its own files, so the enclosing one's "untracked
+    /// folder" entry for it is dropped. A repository that cannot be read is left out; fails
+    /// only when all fail.
+    fn read_status(&self, groups: Vec<(Arc<Repo>, Vec<PathBuf>)>, scoped: bool) -> IdeResult<Vec<FileStatus>> {
         let mut out = Vec::new();
         let mut first_error = None;
         let mut read = 0;
-        for repo in &self.repos {
+        for (repo, mine) in groups {
             let nested: Vec<&Path> = self
                 .repos
                 .iter()
                 .map(|r| r.root())
                 .filter(|r| *r != repo.root() && r.starts_with(repo.root()))
                 .collect();
-            let status = match (repo.as_ref() as &dyn Backend).status() {
+            let backend = repo.as_ref() as &dyn Backend;
+            let status = match if scoped { backend.status_paths(&mine) } else { backend.status() } {
                 Ok(status) => {
                     read += 1;
                     status

crates/ide-vcs/src/status.rs

@@ -24,9 +24,38 @@ pub(crate) fn status(r: &Repo) -> IdeResult<Vec<FileStatus>> {
         tracing::debug!("status via gitoxide failed, asking git: {}", e.message);
         cli_status(r, &ignored)
     })?;
+    Ok(collect(r, &ignored, map, conflicts))
+}
+
+/// Status of `paths` only (repository-relative, `/`-separated): the dirty-scope refresh.
+///
+/// A watcher batch touches a few files, and the full status walks the whole tree; git's own
+/// pathspec filtering keeps that batch proportional to what changed. An empty list is the
+/// full status, so a caller that lost the paths still gets a correct answer.
+pub(crate) fn status_paths(r: &Repo, paths: &[String]) -> IdeResult<Vec<FileStatus>> {
+    // Pathspecs always take `/`, and a path that *is* the repository root names everything: both
+    // matter, because `Repo::status_paths` hands over paths as the platform spells them.
+    let patterns: Vec<String> =
+        paths.iter().map(|path| path.replace('\\', "/")).filter(|path| !path.is_empty()).collect();
+    if patterns.is_empty() {
+        return status(r);
+    }
+    let ignored = r.ignored.read().unwrap_or_else(|p| p.into_inner()).clone();
+    // `git status` with the pathspec, for the same reason the full read falls back to it: gitoxide's
+    // in-process pathspec matched nothing for a plain relative path here, and a silent empty
+    // answer is worse than the ~40 ms a `git` process costs on Windows.
+    let (map, conflicts) = cli_status_paths(r, &ignored, &patterns)?;
+    Ok(collect(r, &ignored, map, conflicts))
+}
+
+fn collect(
+    r: &Repo,
+    ignored: &IgnoredNames,
+    map: BTreeMap<String, Entry>,
+    conflicts: HashSet<String>,
+) -> Vec<FileStatus> {
     let mut disk = r.gix().is_ok_and(|repo| crate::repo::ignores_case(&repo)).then(DiskSpelling::default);
-    Ok(map
-        .into_iter()
+    map.into_iter()
         .filter(|(_, e)| e.staged.is_some() || e.unstaged.is_some())
         // Ignored names mean "the IDE treats these as nonexistent": hide their tracked
         // changes too, not just untracked hits above. Conflicts stay visible so merges
@@ -51,7 +80,7 @@ pub(crate) fn status(r: &Repo) -> IdeResult<Vec<FileStatus>> {
                 renamed_from: e.renamed_from,
             }
         })
-        .collect())
+        .collect()
 }
 
 /// Spells repository paths the way a case-insensitive disk does, so that the tree, tabs and
@@ -216,6 +245,21 @@ fn cli_status(r: &Repo, ignored: &IgnoredNames) -> IdeResult<Entries> {
     Ok(parse_porcelain_v2(&String::from_utf8_lossy(&out.stdout), ignored))
 }
 
+/// `git status` for `paths` only, parsed and filtered like the full one. `--literal-pathspecs`
+/// keeps a `*` or `[` in a file name from being read as a pattern.
+fn cli_status_paths(r: &Repo, ignored: &IgnoredNames, paths: &[String]) -> IdeResult<Entries> {
+    let overrides = crate::cli::filter_overrides(r.root(), &ide_core::CancellationToken::new())?;
+    let mut args: Vec<&str> = overrides.iter().map(String::as_str).collect();
+    args.extend(["--literal-pathspecs", "status", "--porcelain=v2", "-z", "--untracked-files=all"]);
+    if !crate::execution_allowed() {
+        args.push("--ignore-submodules=dirty");
+    }
+    args.push("--");
+    args.extend(paths.iter().map(String::as_str));
+    let out = crate::cli::run(r.root(), &args, None)?;
+    Ok(parse_porcelain_v2(&String::from_utf8_lossy(&out.stdout), ignored))
+}
+
 fn parse_porcelain_v2(out: &str, ignored: &IgnoredNames) -> Entries {
     let kind = |c: u8| match c {
         b'M' | b'T' => Some(ChangeKind::Modified),

crates/ide-vcs/tests/repo.rs

@@ -2065,3 +2065,48 @@ fn a_case_only_directory_rename_keeps_status_and_head_content() {
     assert_eq!(status_of(&st, "src/financial/table/index.vue").staged, Some(ChangeKind::Modified));
     assert_eq!(fx.git(&["diff", "--cached", "--name-only"]), "src/financial/table/index.vue");
 }
+
+#[test]
+fn status_paths_reads_only_the_named_paths() {
+    // The dirty-scope refresh: a watcher batch names a few paths, and git's pathspec
+    // filtering keeps the answer proportional to the batch instead of the whole tree.
+    let fx = Fixture::new();
+    fx.write("a.txt", "a\n");
+    fx.write("b.txt", "a\n");
+    fx.write("dir/c.txt", "a\n");
+    fx.commit_all("base");
+    fx.write("a.txt", "b\n");
+    fx.write("b.txt", "b\n");
+    fx.write("dir/c.txt", "b\n");
+    fx.write("new.txt", "n\n");
+    let repo = fx.repo();
+    repo.set_ignored_names(ide_core::settings::Settings::default().ignored_names());
+
+    let one = repo.status_paths(&[fx.path("a.txt")]).unwrap();
+    assert_eq!(one.len(), 1, "{one:#?}");
+    assert_eq!(one[0].rel_path, "a.txt");
+    assert_eq!(one[0].unstaged, Some(ChangeKind::Modified));
+
+    // A directory stands for everything below it, as the watcher reports a removed one.
+    let dir = repo.status_paths(&[fx.path("dir")]).unwrap();
+    assert_eq!(dir.iter().map(|s| s.rel_path.as_str()).collect::<Vec<_>>(), ["dir/c.txt"]);
+
+    // A nested file: the path a watcher hands over is spelled by the platform, and the pathspec
+    // needs `/` whatever the platform's separator is.
+    let nested = repo.status_paths(&[fx.path("dir").join("c.txt")]).unwrap();
+    assert_eq!(nested.iter().map(|s| s.rel_path.as_str()).collect::<Vec<_>>(), ["dir/c.txt"]);
+
+    // The repository root itself names everything, not a path called "".
+    assert_eq!(repo.status_paths(&[fx.path("")]).unwrap().len(), 4);
+
+    // A new file the batch names is reported as untracked, not as a directory entry.
+    let new = repo.status_paths(&[fx.path("new.txt")]).unwrap();
+    assert_eq!((new[0].rel_path.as_str(), new[0].unstaged), ("new.txt", Some(ChangeKind::Untracked)));
+
+    // Paths outside the repository are ignored rather than an error; nothing named is nothing read.
+    let outside = if cfg!(windows) { PathBuf::from("C:/elsewhere/x.txt") } else { PathBuf::from("/elsewhere/x.txt") };
+    assert!(repo.status_paths(&[outside]).unwrap().is_empty());
+
+    // An empty list is the full status, so a caller that lost the paths stays correct.
+    assert_eq!(repo.status_paths(&[]).unwrap().len(), 4);
+}

docs/en/contribute/guidelines/ui.mdx

@@ -41,7 +41,7 @@ User-visible text is written in English at the call site and goes through the te
 
 ## WebKit compatibility
 
-On macOS and Linux the app runs in WebKit, and the supported floor is Safari 16 (macOS 11 can update to it). `pnpm build` runs `scripts/check-webkit.ts` on the bundle, and `src/platform/webkitCompatibility.test.ts` checks application regexes. Avoid:
+On macOS and Linux the app runs in WebKit, and the supported floor is Safari 16, the engine of macOS 13 (on macOS 11 and 12 a Safari update doesn't update the engine other apps use). `pnpm build` runs `scripts/check-webkit.ts` on the bundle, and `src/platform/webkitCompatibility.test.ts` checks application regexes. Avoid:
 
 - regex lookbehind (`(?<=…)`, `(?<!…)`), which needs Safari 16.4, and the regex `v` flag;
 - import attributes;

docs/en/guide/install.mdx

@@ -9,7 +9,7 @@ In the file names below, `<version>` is the release version, for example `0.1.40
 
 ## macOS
 
-macOS 11 or later.
+macOS 13 Ventura or later.
 
 | Mac           | File                             |
 | ------------- | -------------------------------- |