fix(remote): decide routing, trust and accepted events on the desktop (#2999)

In a remote window the desktop took several decisions about itself from the server: it routed commands by the server's `commands` reply (a command the server left out ran locally), authorized its own commands from the server's `project_current().trusted`, and showed or ran whatever events the server forwarded, including any workbench action named by a plugin `executeCommand` event.

- Routing: commands go by `rpc::client_commands()`, the list a server of this build serves, compiled into the desktop; a test builds the server's dispatcher and compares the two.
- Trust: commands that run on the desktop follow the desktop's own decision, stored in `remote-project-trust.json` by target and root (a dev container also follows its local folder). The trust prompt appears unless the desktop's and the server's decisions agree; the answer and Revoke Trust update both. New commands `remote_trust_status` / `remote_trust_set`.
- Events: server `event`s pass an exhaustive allow-list (MCP approvals, update notices and window-group events are dropped); plugin `executeCommand` may only name `plugin.<id>.<command>`; `openProject` is dropped.
- Paths: a project root that the desktop would read as a share or device path is refused at connect.
- A remote plugin's `openUrl` and `copyToClipboard` ask first, showing the full address or the text.

Co-authored-by: rohitdanda <[email protected]>

.github/workflows/nightly.yml

@@ -47,7 +47,7 @@ jobs:
             exit 0
           fi
           # No `nightly` tag yet (the first run): compare fails and the build goes on.
-          status="$(gh api "repos/$GH_REPO/compare/nightly...$sha" --jq .status 2>/dev/null || echo ahead)"
+          status="$(gh api "repos/$GH_REPO/compare/nightly...$sha" --jq .status 2>/dev/null)" || status=ahead
           if [ "$status" != ahead ] && [ "$FORCE" != true ]; then
             echo "::notice::$sha is not newer than the last nightly"
             exit 0

Cargo.lock

@@ -8727,7 +8727,7 @@ checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
 [[package]]
 name = "sqlx"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "sqlx-core",
  "sqlx-macros",
@@ -8739,7 +8739,7 @@ dependencies = [
 [[package]]
 name = "sqlx-core"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -8774,7 +8774,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8786,7 +8786,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros-core"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "cfg-if",
  "dotenvy",
@@ -8810,7 +8810,7 @@ dependencies = [
 [[package]]
 name = "sqlx-mysql"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "bitflags 2.13.2",
  "byteorder",
@@ -8835,7 +8835,7 @@ dependencies = [
 [[package]]
 name = "sqlx-postgres"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "atoi",
  "base64 0.22.1",
@@ -8869,7 +8869,7 @@ dependencies = [
 [[package]]
 name = "sqlx-sqlite"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
+source = "git+https://github.com/l0ng-ai/sqlx?rev=9894985a1babc7e6bc0437da4fd43e3143184073#9894985a1babc7e6bc0437da4fd43e3143184073"
 dependencies = [
  "atoi",
  "flume",

Cargo.toml

@@ -111,7 +111,7 @@ reqwest = { version = "0.13", default-features = false, features = ["rustls-no-p
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
 rustls-platform-verifier = "0.7"
 # Until SQLx releases its libsqlite3-sys 0.39 update (RUSTSEC-2026-0459).
-sqlx = { version = "0.9", git = "https://github.com/transact-rs/sqlx", rev = "10462fa4414c6c7f1ed1d39bb31678e3b726878c", default-features = false, features = ["runtime-tokio", "tls-rustls-ring-webpki", "sqlite", "postgres", "mysql"] }
+sqlx = { version = "0.9", git = "https://github.com/l0ng-ai/sqlx", rev = "9894985a1babc7e6bc0437da4fd43e3143184073", default-features = false, features = ["runtime-tokio", "tls-rustls-ring-webpki", "sqlite", "postgres", "mysql"] }
 tiberius = { version = "0.13", default-features = false, features = ["tds73", "rustls", "sql-browser-tokio"] }
 # Pure-Rust thin Oracle driver; pinned to the beta until it stabilizes.
 oracledb = "=26.0.0-beta.5"

crates/ide-agent/src/acp/e2e.rs

@@ -107,6 +107,7 @@ fn manager(dir: &Path, agent: Arc<FakeV2Agent>) -> AgentManager {
             models_file: dir.join("models.json"),
             custom_agents_dir: None,
             home_dir: None,
+            env_secrets: None,
         },
         tokio::runtime::Handle::current(),
         connector,

crates/ide-agent/src/acp/tests.rs

@@ -154,6 +154,7 @@ async fn discovery_reads_effort_and_fast_from_session_new_then_stops_the_agent()
             models_file: tmp.path().join("models.json"),
             custom_agents_dir: None,
             home_dir: None,
+            env_secrets: None,
         },
         tokio::runtime::Handle::current(),
         connector,

crates/ide-agent/src/config.rs

@@ -42,9 +42,38 @@ pub(crate) fn bypass_approvals(config: &[AgentConfigOption]) -> bool {
     let selected = |category: &str| {
         config.iter().find(|o| o.category.as_deref() == Some(category)).and_then(|o| o.current.as_deref())
     };
-    selected("mode").is_some_and(is_bypass_mode)
-        || selected("permissions").is_some_and(|v| matches!(v.to_ascii_lowercase().as_str(), "on" | "true"))
-        || selected("approval").is_some_and(|v| v.eq_ignore_ascii_case("bypass"))
+    ["mode", "permissions", "approval"]
+        .into_iter()
+        .any(|category| selected(category).zip(bypass_value(category)).is_some_and(|(value, bypass)| bypass(value)))
+}
+
+/// For an option of `category` that can approve everything, what tells its approving values.
+fn bypass_value(category: &str) -> Option<fn(&str) -> bool> {
+    match category {
+        "mode" => Some(is_bypass_mode),
+        "permissions" => Some(|v| matches!(v.to_ascii_lowercase().as_str(), "on" | "true")),
+        "approval" => Some(|v| v.eq_ignore_ascii_case("bypass")),
+        _ => None,
+    }
+}
+
+/// Moves options that approve everything without asking to a value that asks: the agent's
+/// default or ask mode, else its first one that asks.
+pub(crate) fn ask_for_approvals(config: &mut [AgentConfigOption]) {
+    for option in config {
+        let Some(bypass) = option.category.as_deref().and_then(bypass_value) else { continue };
+        if option.current.as_deref().is_some_and(|c| !bypass(c)) {
+            continue;
+        }
+        let asks = |v: &&AgentConfigValue| !bypass(&v.value);
+        let value = ["default", "ask"]
+            .iter()
+            .find_map(|preferred| option.values.iter().filter(asks).find(|v| v.value == *preferred))
+            .or_else(|| option.values.iter().find(asks));
+        if let Some(value) = value {
+            option.current = Some(value.value.clone());
+        }
+    }
 }
 
 /// The mode that approves everything without asking (`bypassPermissions`, `yolo`, `full-access`…), if the agent has one.
@@ -341,6 +370,36 @@ mod tests {
         assert!(bypass_approvals(&url_mode));
     }
 
+    #[test]
+    fn asking_for_approvals_keeps_a_mode_that_asks_and_leaves_one_that_does_not() {
+        let mode = |current: &str, values: &[&str]| {
+            options_of(&json!({"modes": {"currentModeId": current,
+                "availableModes": values.iter().map(|v| json!({"id": v})).collect::<Vec<_>>()}}))
+        };
+        let codex = ["read-only", "ask", "auto", "full-access"];
+        for (current, expected) in [("auto", "auto"), ("read-only", "read-only"), ("full-access", "ask")] {
+            let mut c = mode(current, &codex);
+            ask_for_approvals(&mut c);
+            assert_eq!(c[0].current.as_deref(), Some(expected), "{current}");
+            assert!(!bypass_approvals(&c));
+        }
+        let mut claude = mode("bypassPermissions", &["acceptEdits", "default", "plan", "bypassPermissions"]);
+        ask_for_approvals(&mut claude);
+        assert_eq!(claude[0].current.as_deref(), Some("default"));
+        let mut other = mode("yolo", &["yolo", "code", "architect"]);
+        ask_for_approvals(&mut other);
+        assert_eq!(other[0].current.as_deref(), Some("code"));
+
+        let mut c = options_of(&json!({"configOptions": [
+            {"id": "allow_all", "category": "permissions", "type": "select", "currentValue": "on",
+             "options": [{"value": "on"}, {"value": "off"}]},
+            {"id": "approval", "category": "approval", "type": "select", "currentValue": "bypass",
+             "options": [{"value": "bypass"}, {"value": "ask"}]}
+        ]}));
+        ask_for_approvals(&mut c);
+        assert_eq!(ids(&c), [("allow_all", Some("off")), ("approval", Some("ask"))]);
+    }
+
     #[test]
     fn effort_and_fast_categories_are_inferred_from_ids() {
         let c = options_of(&json!({

crates/ide-agent/src/lib.rs

@@ -43,6 +43,9 @@ pub type AgentSink = Arc<dyn Fn(AgentEvent) + Send + Sync>;
 /// Returns the active command execution security policy for the project.
 pub type SecurityHook = Arc<dyn Fn() -> ide_core::settings::AgentSecuritySettings + Send + Sync>;
 
+/// Returns the user's choice of the approvals new tasks start with.
+pub type NewTaskApprovalsHook = Arc<dyn Fn() -> ide_core::settings::NewTaskApprovals + Send + Sync>;
+
 /// Entry changes are batched for this long before they are sent.
 const FLUSH_DELAY: Duration = Duration::from_millis(40);
 /// Updates that arrive this late after `session/load` returns are still replayed history.
@@ -89,6 +92,18 @@ pub struct AgentPaths {
     pub custom_agents_dir: Option<PathBuf>,
     /// The user's home: its `.claude` holds their own skills and commands.
     pub home_dir: Option<PathBuf>,
+    /// Where the values of the agent files' environment variables are kept; without it they stay in the files.
+    pub env_secrets: Option<Arc<dyn EnvSecrets>>,
+}
+
+/// Keeps the values of agent files' environment variables (`agent/<id>/env/<name>`) out of
+/// the files, which keep only the names; the app keeps them in the OS credential store.
+pub trait EnvSecrets: Send + Sync {
+    fn get(&self, key: &str) -> Option<String>;
+    fn set(&self, key: &str, value: &str) -> IdeResult<()>;
+    fn delete(&self, key: &str);
+    /// The keys that start with `prefix`.
+    fn keys(&self, prefix: &str) -> Vec<String>;
 }
 
 /// Starts the ACP server of a provider in a directory, speaking to `client`.
@@ -107,6 +122,7 @@ struct Shared {
     connector: Connector,
     sink: RwLock<Option<AgentSink>>,
     security: RwLock<Option<SecurityHook>>,
+    new_task_approvals: RwLock<Option<NewTaskApprovalsHook>>,
     known: Mutex<HashMap<String, Known>>,
     providers: RwLock<Vec<provider::ProviderSpec>>,
     /// Last probe of each provider.
@@ -136,6 +152,10 @@ impl Shared {
         self.providers.read().iter().find(|p| p.id == id).cloned()
     }
 
+    fn env_secrets(&self) -> Option<&dyn EnvSecrets> {
+        self.paths.env_secrets.as_deref()
+    }
+
     fn emit(&self, event: AgentEvent) {
         let sink = self.sink.read().clone();
         if let Some(sink) = sink {
@@ -155,6 +175,11 @@ impl Shared {
         // Model-specific options are offered separately, never as provider-wide defaults.
         config.retain(|o| o.category.as_deref() != Some("thought_level"));
         config::add_client_options(provider, &mut config);
+        let hook = self.new_task_approvals.read().clone();
+        if hook.is_some_and(|ask| ask() == ide_core::settings::NewTaskApprovals::Ask) {
+            config::ask_for_approvals(&mut config);
+            return config;
+        }
         if let Some((o, v)) = config::bypass_mode(&config).map(|(o, v)| (o.id.clone(), v.value.clone()))
             && let Some(o) = config.iter_mut().find(|c| c.id == o)
         {
@@ -446,13 +471,14 @@ impl AgentManager {
     fn with_connector(paths: AgentPaths, runtime: tokio::runtime::Handle, connector: Connector) -> Self {
         let known =
             std::fs::read(&paths.models_file).ok().and_then(|b| serde_json::from_slice(&b).ok()).unwrap_or_default();
-        let providers = RwLock::new(provider::load(paths.custom_agents_dir.as_deref()));
+        let providers = RwLock::new(provider::load(paths.custom_agents_dir.as_deref(), paths.env_secrets.as_deref()));
         let shared = Arc::new(Shared {
             paths,
             runtime,
             connector,
             sink: RwLock::new(None),
             security: RwLock::new(None),
+            new_task_approvals: RwLock::new(None),
             known: Mutex::new(known),
             providers,
             probes: Mutex::new(HashMap::new()),
@@ -501,9 +527,14 @@ impl AgentManager {
         *self.shared.security.write() = Some(hook);
     }
 
+    /// Sets the callback that reads which approvals new tasks start with.
+    pub fn set_new_task_approvals_hook(&self, hook: NewTaskApprovalsHook) {
+        *self.shared.new_task_approvals.write() = Some(hook);
+    }
+
     /// The agents (custom ones re-read), whether each is installed, and what they offered last time.
     pub fn providers(&self) -> Vec<AgentProvider> {
-        let specs = provider::load(self.shared.paths.custom_agents_dir.as_deref());
+        let specs = provider::load(self.shared.paths.custom_agents_dir.as_deref(), self.shared.env_secrets());
         let in_use: std::collections::HashSet<String> =
             self.tasks.read().values().map(|t| t.state.lock().task.provider.clone()).collect();
         let list = specs
@@ -537,7 +568,7 @@ impl AgentManager {
         let Some(dir) = self.shared.paths.custom_agents_dir.clone() else {
             return Err(IdeError::unavailable("there is no custom agents directory"));
         };
-        provider::set_builtin_command(&dir, id, command.as_deref())
+        provider::set_builtin_command(&dir, self.shared.env_secrets(), id, command.as_deref())
     }
 
     /// Sets the environment variables built-in `id` starts with; empty clears them.
@@ -545,7 +576,7 @@ impl AgentManager {
         let Some(dir) = self.shared.paths.custom_agents_dir.clone() else {
             return Err(IdeError::unavailable("there is no custom agents directory"));
         };
-        provider::set_builtin_env(&dir, id, env)
+        provider::set_builtin_env(&dir, self.shared.env_secrets(), id, env)
     }
 
     /// Saves a new custom ACP agent through its agent file.
@@ -553,7 +584,7 @@ impl AgentManager {
         let Some(dir) = self.shared.paths.custom_agents_dir.clone() else {
             return Err(IdeError::unavailable("there is no custom agents directory"));
         };
-        provider::save_custom(&dir, &input)
+        provider::save_custom(&dir, self.shared.env_secrets(), &input)
     }
 
     /// Removes a custom agent's file (registry installs go through `registry_remove`).
@@ -561,7 +592,7 @@ impl AgentManager {
         let Some(dir) = self.shared.paths.custom_agents_dir.clone() else {
             return Err(IdeError::unavailable("there is no custom agents directory"));
         };
-        provider::remove_custom(&dir, id)
+        provider::remove_custom(&dir, self.shared.env_secrets(), id)
     }
 
     /// Imports a JetBrains `acp.json` file's `agent_servers` entries as custom agents.
@@ -569,12 +600,12 @@ impl AgentManager {
         let Some(dir) = self.shared.paths.custom_agents_dir.clone() else {
             return Err(IdeError::unavailable("there is no custom agents directory"));
         };
-        provider::import_acp(&dir, text)
+        provider::import_acp(&dir, self.shared.env_secrets(), text)
     }
 
     /// Re-reads configured/installed agents, drops cached probes, and notifies subscribers.
     pub fn reload_providers(&self) {
-        let specs = provider::load(self.shared.paths.custom_agents_dir.as_deref());
+        let specs = provider::load(self.shared.paths.custom_agents_dir.as_deref(), self.shared.env_secrets());
         *self.shared.providers.write() = specs;
         self.shared.probes.lock().clear();
         self.shared.emit(AgentEvent::Providers);
@@ -2266,15 +2297,19 @@ impl Task {
             .iter()
             .map(|question| question.answer_key.clone().unwrap_or_else(|| question.question.clone()))
             .collect();
+        let command = security::extract_command(params);
+        // What the card names as the command: not for a request that grants more than running it.
+        let shown = command.as_deref().filter(|_| !security::widens_access(params)).map(shown_command);
         if let Some(hook) = self.shared.security.read().clone()
-            && let Some(command) = security::extract_command(params)
+            && let Some(command) = command.as_deref()
         {
-            match security::evaluate_command(&command, &hook()) {
+            match security::evaluate_command(command, &hook()) {
                 security::PolicyDecision::Blocked(pattern) => {
                     let reject = options.iter().find(|o| o.kind.starts_with("reject")).cloned();
                     let _ = self.push_entry(AgentEntry::Permission {
                         id,
                         title,
+                        command: shown.clone(),
                         options,
                         questions: Vec::new(),
                         chosen: Some(format!("Blocked by policy ({pattern})")),
@@ -2284,7 +2319,7 @@ impl Task {
                         None => json!({ "outcome": { "outcome": "cancelled" } }),
                     };
                 }
-                security::PolicyDecision::Allowed => {
+                security::PolicyDecision::Allowed if !security::widens_access(params) => {
                     if let Some(allow) = options
                         .iter()
                         .find(|o| o.kind == "allow_once")
@@ -2294,6 +2329,7 @@ impl Task {
                         let _ = self.push_entry(AgentEntry::Permission {
                             id,
                             title,
+                            command: shown.clone(),
                             options,
                             questions: Vec::new(),
                             chosen: Some(format!("{} (whitelisted)", allow.name)),
@@ -2301,12 +2337,18 @@ impl Task {
                         return json!({ "outcome": { "outcome": "selected", "optionId": allow.id } });
                     }
                 }
-                security::PolicyDecision::AskUser => {}
+                security::PolicyDecision::Allowed | security::PolicyDecision::AskUser => {}
             }
         }
         let (tx, rx) = std::sync::mpsc::channel();
-        let entry =
-            self.push_entry(AgentEntry::Permission { id, title, options: options.clone(), questions, chosen: None });
+        let entry = self.push_entry(AgentEntry::Permission {
+            id,
+            title,
+            command: shown,
+            options: options.clone(),
+            questions,
+            chosen: None,
+        });
         self.permissions.lock().insert(id, tx);
         self.set_status(AgentStatus::NeedsInput, None);
         self.approve_pending();
@@ -2468,6 +2510,11 @@ fn permission_title(params: &Value) -> String {
     title.unwrap_or("The agent asks for permission").to_owned()
 }
 
+/// A command as a permission card shows it: the script of a `<shell> -c <script>` line.
+fn shown_command(command: &str) -> String {
+    shell_script(command).unwrap_or_else(|| command.to_owned())
+}
+
 /// The script of a `<shell> -c <quoted script>` command line, when the whole line is exactly that.
 pub(crate) fn shell_script(command: &str) -> Option<String> {
     let (shell, rest) = command.split_once(' ')?;

crates/ide-agent/src/model.rs

@@ -384,6 +384,10 @@ pub enum AgentEntry {
     Permission {
         id: u32,
         title: String,
+        /// The shell command the request asks to run, from its structured input; `None` for
+        /// any other request, whatever its title says.
+        #[serde(default)]
+        command: Option<String>,
         options: Vec<AgentPermissionOption>,
         /// Set when the request asks `AskUserQuestion`'s questions; answered with a JSON object
         /// of question to answer instead of an option.

crates/ide-agent/src/native/codex/mod.rs

@@ -869,13 +869,14 @@ impl CodexShim {
             "item/commandExecution/requestApproval" => {
                 let choices = translate::decisions(params, true);
                 let title = translate::command_approval_title(params, item.as_ref());
-                let call = tool_call_of(
-                    &item_id,
-                    &title,
-                    "execute",
-                    reason,
-                    Some(json!({ "command": params.get("command"), "cwd": params.get("cwd") })),
-                );
+                let mut input = json!({
+                    "command": translate::approval_command(params, item.as_ref()),
+                    "cwd": params.get("cwd"),
+                });
+                if let Some(network) = params.get("networkApprovalContext").filter(|c| !c.is_null()) {
+                    input["networkApprovalContext"] = network.clone();
+                }
+                let call = tool_call_of(&item_id, &title, "execute", reason, Some(input));
                 Ok(self.ask(&thread, call, &choices, decline))
             }
             "item/fileChange/requestApproval" => {

crates/ide-agent/src/native/codex/translate.rs

@@ -757,19 +757,23 @@ pub(super) fn answer_of(choices: &[Choice], outcome: &Value, decline: Value) ->
     choices.iter().find(|c| selected && c.option["optionId"].as_str() == chosen).map_or(decline, |c| c.answer.clone())
 }
 
+/// The command a command approval is about: the request's own, else its item's.
+pub(super) fn approval_command<'a>(params: &'a Value, item: Option<&'a Value>) -> Option<&'a str> {
+    // Approval payloads can describe a different command from the item's earlier summary.
+    let item = item.filter(|i| i.get("id") == params.get("itemId"));
+    params
+        .get("command")
+        .and_then(Value::as_str)
+        .filter(|c| !c.is_empty())
+        .or_else(|| item.and_then(|i| i.get("command")).and_then(Value::as_str).filter(|c| !c.is_empty()))
+}
+
 /// The ACP title of a command approval.
 pub(super) fn command_approval_title(params: &Value, item: Option<&Value>) -> String {
     if let Some(host) = params.pointer("/networkApprovalContext/host").and_then(Value::as_str) {
         return format!("Allow network access to {host}");
     }
-    // Approval payloads can describe a different command from the item's earlier summary.
-    let item = item.filter(|i| i.get("id") == params.get("itemId"));
-    let command = params
-        .get("command")
-        .and_then(Value::as_str)
-        .filter(|c| !c.is_empty())
-        .or_else(|| item.and_then(|i| i.get("command")).and_then(Value::as_str).filter(|c| !c.is_empty()));
-    match command {
+    match approval_command(params, item) {
         Some(command) => format!("Run {}", crate::shell_script(command).unwrap_or_else(|| command.to_owned())),
         None => "Run a command".to_owned(),
     }

crates/ide-agent/src/provider.rs

@@ -2,7 +2,7 @@
 //! `<config>/agents/<id>.toml` (written by hand, or by installing one from the ACP
 //! Registry, see `registry`).
 
-use crate::{AcpImportOutcome, AgentCommandReadOnlyReason, AgentProvider, AgentSource, CustomAgentInput};
+use crate::{AcpImportOutcome, AgentCommandReadOnlyReason, AgentProvider, AgentSource, CustomAgentInput, EnvSecrets};
 use ide_core::{IdeError, IdeResult};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -231,23 +231,40 @@ pub(crate) fn describe(spec: &ProviderSpec) -> AgentProvider {
 
 /// Overrides built-in `id`'s command through its agent file, preserving other
 /// customizations. `None` restores the built-in command and removes a redundant file.
-pub(crate) fn set_builtin_command(custom_dir: &Path, id: &str, command: Option<&str>) -> IdeResult<()> {
-    update_builtin(custom_dir, id, |agent, builtin| agent.command = command.unwrap_or(&builtin.command).to_owned())
+pub(crate) fn set_builtin_command(
+    custom_dir: &Path,
+    secrets: Option<&dyn EnvSecrets>,
+    id: &str,
+    command: Option<&str>,
+) -> IdeResult<()> {
+    update_builtin(custom_dir, secrets, id, |agent, builtin| {
+        agent.command = command.unwrap_or(&builtin.command).to_owned()
+    })
 }
 
 /// The environment built-in `id` starts with, through its agent file (empty clears it).
-pub(crate) fn set_builtin_env(custom_dir: &Path, id: &str, env: BTreeMap<String, String>) -> IdeResult<()> {
-    update_builtin(custom_dir, id, |agent, _| agent.env = env)
+pub(crate) fn set_builtin_env(
+    custom_dir: &Path,
+    secrets: Option<&dyn EnvSecrets>,
+    id: &str,
+    env: BTreeMap<String, String>,
+) -> IdeResult<()> {
+    update_builtin(custom_dir, secrets, id, |agent, _| agent.env = env)
 }
 
 /// Changes built-in `id`'s agent file; a file left with only the built-in's values is removed.
-fn update_builtin(custom_dir: &Path, id: &str, change: impl FnOnce(&mut CustomAgent, &ProviderSpec)) -> IdeResult<()> {
+fn update_builtin(
+    custom_dir: &Path,
+    secrets: Option<&dyn EnvSecrets>,
+    id: &str,
+    change: impl FnOnce(&mut CustomAgent, &ProviderSpec),
+) -> IdeResult<()> {
     let Some(builtin) = builtin_spec(id) else {
         return Err(IdeError::invalid(format!("{id} is not a built-in agent")));
     };
     let file = custom_dir.join(format!("{id}.toml"));
     let mut agent = if file.try_exists()? {
-        CustomAgent::read(&file).map_err(IdeError::invalid)?
+        CustomAgent::read_with(&file, id, secrets).map_err(IdeError::invalid)?
     } else {
         CustomAgent {
             name: Some(builtin.name.clone()),
@@ -272,16 +289,20 @@ fn update_builtin(custom_dir: &Path, id: &str, change: impl FnOnce(&mut CustomAg
             Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(e.into()),
             _ => {}
         }
+        forget_env(secrets, id, &[]);
         return Ok(());
     }
-    agent.write(&file)?;
-    Ok(())
+    agent.write_with(&file, id, secrets)
 }
 
 /// Saves a new custom agent; refuses built-in and ACP Registry ids, taken ids
 /// and an empty command. The id is also the agent file's name, so it must be
 /// a safe file stem.
-pub(crate) fn save_custom(custom_dir: &Path, input: &CustomAgentInput) -> IdeResult<()> {
+pub(crate) fn save_custom(
+    custom_dir: &Path,
+    secrets: Option<&dyn EnvSecrets>,
+    input: &CustomAgentInput,
+) -> IdeResult<()> {
     let id = validated_custom_id(&input.id)?;
     if builtin_spec(&id).is_some() {
         return Err(IdeError::invalid(format!("{id} is a built-in agent; change its command instead")));
@@ -306,12 +327,11 @@ pub(crate) fn save_custom(custom_dir: &Path, input: &CustomAgentInput) -> IdeRes
         env: input.env.clone(),
         registry: None,
     }
-    .write(&file)?;
-    Ok(())
+    .write_with(&file, &id, secrets)
 }
 
 /// Removes a custom agent's file; refuses built-in, ACP Registry and missing ids.
-pub(crate) fn remove_custom(custom_dir: &Path, id: &str) -> IdeResult<()> {
+pub(crate) fn remove_custom(custom_dir: &Path, secrets: Option<&dyn EnvSecrets>, id: &str) -> IdeResult<()> {
     let id = validated_custom_id(id)?;
     let id = id.as_str();
     if builtin_spec(id).is_some() {
@@ -325,14 +345,21 @@ pub(crate) fn remove_custom(custom_dir: &Path, id: &str) -> IdeResult<()> {
     }
     match std::fs::remove_file(&file) {
         Err(e) if e.kind() != std::io::ErrorKind::NotFound => Err(e.into()),
-        _ => Ok(()),
+        _ => {
+            forget_env(secrets, id, &[]);
+            Ok(())
+        }
     }
 }
 
 /// Imports a JetBrains `acp.json` file's `agent_servers` entries as custom
 /// agents, one outcome per entry; entries that collide, lack a command or
 /// have no usable name are skipped with a reason.
-pub(crate) fn import_acp(custom_dir: &Path, text: &str) -> IdeResult<Vec<AcpImportOutcome>> {
+pub(crate) fn import_acp(
+    custom_dir: &Path,
+    secrets: Option<&dyn EnvSecrets>,
+    text: &str,
+) -> IdeResult<Vec<AcpImportOutcome>> {
     #[derive(Deserialize)]
     struct AcpJson {
         #[serde(default)]
@@ -370,7 +397,7 @@ pub(crate) fn import_acp(custom_dir: &Path, text: &str) -> IdeResult<Vec<AcpImpo
                 env: server.env,
                 registry: None,
             }
-            .write(&custom_dir.join(format!("{id}.toml")))?;
+            .write_with(&custom_dir.join(format!("{id}.toml")), &id, secrets)?;
             outcome.saved = true;
         }
         outcomes.push(outcome);
@@ -400,7 +427,7 @@ fn slugify_id(name: &str) -> String {
 }
 
 /// An agent file, `<config>/agents/<id>.toml`.
-#[derive(Debug, PartialEq, Serialize, Deserialize)]
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub(crate) struct CustomAgent {
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -447,11 +474,67 @@ impl CustomAgent {
         std::fs::write(&tmp, text)?;
         std::fs::rename(&tmp, path)
     }
+
+    /// Reads agent `id`'s file with its environment values filled in from `secrets`; values
+    /// still written in the file (by hand, by an older version) move there first. A registry
+    /// install keeps the environment its registry entry gives it in the file.
+    pub(crate) fn read_with(path: &Path, id: &str, secrets: Option<&dyn EnvSecrets>) -> Result<Self, String> {
+        let mut agent = Self::read(path)?;
+        let Some(secrets) = secrets.filter(|_| agent.registry.is_none()) else {
+            return Ok(agent);
+        };
+        let written = agent.env.values().any(|v| !v.is_empty());
+        for (name, value) in agent.env.iter_mut() {
+            if value.is_empty()
+                && let Some(saved) = secrets.get(&env_key(id, name))
+            {
+                *value = saved;
+            }
+        }
+        if written && let Err(e) = agent.write_with(path, id, Some(secrets)) {
+            tracing::warn!("agent {id}: could not move environment values out of {}: {}", path.display(), e.message);
+        }
+        Ok(agent)
+    }
+
+    /// Writes agent `id`'s file with the environment's names only, its values saved in `secrets`.
+    pub(crate) fn write_with(&self, path: &Path, id: &str, secrets: Option<&dyn EnvSecrets>) -> IdeResult<()> {
+        let Some(secrets) = secrets.filter(|_| self.registry.is_none()) else {
+            return Ok(self.write(path)?);
+        };
+        let mut keys = Vec::with_capacity(self.env.len());
+        for (name, value) in &self.env {
+            let key = env_key(id, name);
+            if value.is_empty() {
+                secrets.delete(&key);
+            } else if secrets.get(&key).as_deref() != Some(value.as_str()) {
+                secrets.set(&key, value)?;
+            }
+            keys.push(key);
+        }
+        forget_env(Some(secrets), id, &keys);
+        let names = self.env.keys().map(|name| (name.clone(), String::new())).collect();
+        Ok(Self { env: names, ..self.clone() }.write(path)?)
+    }
+}
+
+fn env_key(id: &str, name: &str) -> String {
+    format!("agent/{id}/env/{}", name.replace('%', "%25").replace('/', "%2F"))
+}
+
+/// Forgets agent `id`'s saved environment values, except `keep`.
+fn forget_env(secrets: Option<&dyn EnvSecrets>, id: &str, keep: &[String]) {
+    let Some(secrets) = secrets else { return };
+    for key in secrets.keys(&format!("agent/{id}/env/")) {
+        if !keep.contains(&key) {
+            secrets.delete(&key);
+        }
+    }
 }
 
 /// Built-in agents, then the `*.toml` agents of `custom_dir`; a custom agent with a
 /// built-in id replaces it.
-pub(crate) fn load(custom_dir: Option<&Path>) -> Vec<ProviderSpec> {
+pub(crate) fn load(custom_dir: Option<&Path>, secrets: Option<&dyn EnvSecrets>) -> Vec<ProviderSpec> {
     let mut specs = builtins();
     let mut files: Vec<PathBuf> = custom_dir
         .and_then(|d| std::fs::read_dir(d).ok())
@@ -464,7 +547,7 @@ pub(crate) fn load(custom_dir: Option<&Path>) -> Vec<ProviderSpec> {
     files.sort();
     for path in files {
         let Some(id) = path.file_stem().and_then(|s| s.to_str()).map(str::to_owned) else { continue };
-        let agent = match CustomAgent::read(&path) {
+        let agent = match CustomAgent::read_with(&path, &id, secrets) {
             Ok(a) => a,
             Err(e) => {
                 tracing::warn!("skipping agent {}: {e}", path.display());
@@ -534,7 +617,7 @@ mod tests {
 
     #[test]
     fn qoder_global_and_cn_editions_are_both_built_in() {
-        let info = |id: &str| describe(&load(None).into_iter().find(|s| s.id == id).unwrap());
+        let info = |id: &str| describe(&load(None, None).into_iter().find(|s| s.id == id).unwrap());
         let (global, cn) = (info("qoder"), info("qodercn"));
         assert_eq!((global.name.as_str(), global.command.as_str()), ("Qoder", "qodercli --acp"));
         assert_eq!((cn.name.as_str(), cn.command.as_str()), ("Qoder CN", "qoderclicn --acp"));
@@ -544,7 +627,7 @@ mod tests {
     #[test]
     fn qodercn_is_available_without_a_file_and_preserves_existing_customizations() {
         let dir = tempfile::tempdir().unwrap();
-        let qodercn = load(None).into_iter().find(|s| s.id == "qodercn").unwrap();
+        let qodercn = load(None, None).into_iter().find(|s| s.id == "qodercn").unwrap();
         assert_eq!(qodercn.driver, Driver::Acp);
         assert!(!is_unlisted(&qodercn));
         let info = describe(&qodercn);
@@ -559,13 +642,13 @@ mod tests {
             "command = \"/custom/qoderclicn\"\nargs = [\"--acp\"]\n[env]\nK = \"v\"\n",
         )
         .unwrap();
-        let specs = load(Some(dir.path()));
+        let specs = load(Some(dir.path()), None);
         assert_eq!(specs.iter().filter(|s| s.id == "qodercn").count(), 1);
         let custom = specs.iter().find(|s| s.id == "qodercn").unwrap();
         assert_eq!(custom.command, "/custom/qoderclicn");
         assert_eq!(custom.env, [("K".into(), "v".into())]);
-        set_builtin_command(dir.path(), "qodercn", None).unwrap();
-        let reset = load(Some(dir.path())).into_iter().find(|s| s.id == "qodercn").unwrap();
+        set_builtin_command(dir.path(), None, "qodercn", None).unwrap();
+        let reset = load(Some(dir.path()), None).into_iter().find(|s| s.id == "qodercn").unwrap();
         assert_eq!(reset.command, "qoderclicn");
         assert_eq!(reset.args, ["--acp"]);
         assert_eq!(reset.env, custom.env);
@@ -680,7 +763,7 @@ mod tests {
     #[test]
     fn launch_metadata_distinguishes_defaults_overrides_and_read_only_agents() {
         let dir = tempfile::tempdir().unwrap();
-        let list = || load(Some(dir.path())).iter().map(describe).collect::<Vec<_>>();
+        let list = || load(Some(dir.path()), None).iter().map(describe).collect::<Vec<_>>();
         let defaults = list();
         let codex = defaults.iter().find(|p| p.id == "codex").unwrap();
         assert_eq!(codex.program, "codex");
@@ -700,14 +783,14 @@ mod tests {
                 p.id.ends_with("-acp").then_some(AgentCommandReadOnlyReason::PackageRunner)
             );
         }
-        set_builtin_command(dir.path(), "codex", Some("/path with spaces/codex")).unwrap();
+        set_builtin_command(dir.path(), None, "codex", Some("/path with spaces/codex")).unwrap();
         let overridden = list().into_iter().find(|p| p.id == "codex").unwrap();
         assert_eq!(overridden.program, "/path with spaces/codex");
         assert_eq!(overridden.args, codex.args);
         assert_eq!(overridden.default_program, codex.default_program);
         assert!(overridden.command_overridden && overridden.command_editable);
         assert_eq!(overridden.source, AgentSource::Builtin);
-        set_builtin_command(dir.path(), "codex", Some("codex")).unwrap();
+        set_builtin_command(dir.path(), None, "codex", Some("codex")).unwrap();
         assert!(!list().iter().find(|p| p.id == "codex").unwrap().command_overridden);
         std::fs::write(
             dir.path().join("gemini.toml"),
@@ -732,7 +815,7 @@ mod tests {
         write("mine.toml", "name = \"Mine\"\ncommand = \"/opt/mine\"\nargs = [\"acp\"]\n[env]\nK = \"v\"\n");
         write("gemini.toml", "command = \"gemini\"\nargs = [\"--acp\"]\n");
         write("broken.toml", "nope = 1\n");
-        let specs = load(Some(dir.path()));
+        let specs = load(Some(dir.path()), None);
         let mine = specs.iter().find(|s| s.id == "mine").unwrap();
         assert_eq!((mine.name.as_str(), mine.command.as_str()), ("Mine", "/opt/mine"));
         assert_eq!(mine.env, vec![("K".to_owned(), "v".to_owned())]);
@@ -748,34 +831,35 @@ mod tests {
     fn set_builtin_env_writes_and_clears_the_environment() {
         let dir = tempfile::tempdir().unwrap();
         let env = BTreeMap::from([("CLAUDE_CODE_ENTRYPOINT".to_owned(), "openidea".to_owned())]);
-        set_builtin_env(dir.path(), "claude", env.clone()).unwrap();
-        let claude = load(Some(dir.path())).into_iter().find(|s| s.id == "claude").unwrap();
+        set_builtin_env(dir.path(), None, "claude", env.clone()).unwrap();
+        let claude = load(Some(dir.path()), None).into_iter().find(|s| s.id == "claude").unwrap();
         assert_eq!(claude.env, vec![("CLAUDE_CODE_ENTRYPOINT".to_owned(), "openidea".to_owned())]);
         assert_eq!(describe(&claude).env, env);
         // The command override and the environment are kept independently.
-        set_builtin_command(dir.path(), "claude", Some("/opt/claude")).unwrap();
-        set_builtin_command(dir.path(), "claude", None).unwrap();
+        set_builtin_command(dir.path(), None, "claude", Some("/opt/claude")).unwrap();
+        set_builtin_command(dir.path(), None, "claude", None).unwrap();
         assert!(dir.path().join("claude.toml").is_file());
-        set_builtin_env(dir.path(), "claude", BTreeMap::new()).unwrap();
+        set_builtin_env(dir.path(), None, "claude", BTreeMap::new()).unwrap();
         assert!(!dir.path().join("claude.toml").exists());
-        set_builtin_env(dir.path(), "not-a-builtin", env).unwrap_err();
+        set_builtin_env(dir.path(), None, "not-a-builtin", env).unwrap_err();
     }
 
     #[test]
     fn acp_adapters_of_native_agents_are_unlisted_until_customized() {
         let dir = tempfile::tempdir().unwrap();
-        let unlisted = |dir: &Path| load(Some(dir)).into_iter().filter(is_unlisted).map(|s| s.id).collect::<Vec<_>>();
+        let unlisted =
+            |dir: &Path| load(Some(dir), None).into_iter().filter(is_unlisted).map(|s| s.id).collect::<Vec<_>>();
         assert_eq!(unlisted(dir.path()), ["claude-acp", "codex-acp"]);
-        set_builtin_env(dir.path(), "codex-acp", BTreeMap::from([("A".to_owned(), "1".to_owned())])).unwrap();
+        set_builtin_env(dir.path(), None, "codex-acp", BTreeMap::from([("A".to_owned(), "1".to_owned())])).unwrap();
         assert_eq!(unlisted(dir.path()), ["claude-acp"]);
     }
 
     #[test]
     fn set_builtin_command_overrides_and_clears_a_builtin() {
         let dir = tempfile::tempdir().unwrap();
-        set_builtin_command(dir.path(), "not-a-builtin", Some("/x")).unwrap_err();
-        set_builtin_command(dir.path(), "claude", Some("/opt/claude")).unwrap();
-        let claude = load(Some(dir.path())).into_iter().find(|s| s.id == "claude").unwrap();
+        set_builtin_command(dir.path(), None, "not-a-builtin", Some("/x")).unwrap_err();
+        set_builtin_command(dir.path(), None, "claude", Some("/opt/claude")).unwrap();
+        let claude = load(Some(dir.path()), None).into_iter().find(|s| s.id == "claude").unwrap();
         assert_eq!((claude.command.as_str(), claude.driver), ("/opt/claude", Driver::Claude));
         assert!(claude.args.is_empty());
         // A registry install is neither overwritten nor removed by a command override.
@@ -790,14 +874,14 @@ mod tests {
         }
         .write(&path)
         .unwrap();
-        set_builtin_command(dir.path(), "codex", Some("/x")).unwrap_err();
-        set_builtin_command(dir.path(), "codex", None).unwrap_err();
+        set_builtin_command(dir.path(), None, "codex", Some("/x")).unwrap_err();
+        set_builtin_command(dir.path(), None, "codex", None).unwrap_err();
         assert!(path.exists());
         // Clearing (twice) returns the built-in to auto-detection.
-        set_builtin_command(dir.path(), "claude", None).unwrap();
-        set_builtin_command(dir.path(), "claude", None).unwrap();
+        set_builtin_command(dir.path(), None, "claude", None).unwrap();
+        set_builtin_command(dir.path(), None, "claude", None).unwrap();
         assert!(!dir.path().join("claude.toml").exists());
-        assert_eq!(load(Some(dir.path())).iter().find(|s| s.id == "claude").unwrap().command, "claude");
+        assert_eq!(load(Some(dir.path()), None).iter().find(|s| s.id == "claude").unwrap().command, "claude");
     }
 
     #[test]
@@ -825,11 +909,11 @@ mod tests {
             }
             agent.write(&path).unwrap();
 
-            set_builtin_command(dir.path(), "claude", Some("/new/claude")).unwrap();
+            set_builtin_command(dir.path(), None, "claude", Some("/new/claude")).unwrap();
             agent.command = "/new/claude".into();
             assert_eq!(CustomAgent::read(&path).unwrap(), agent, "{field}");
 
-            set_builtin_command(dir.path(), "claude", None).unwrap();
+            set_builtin_command(dir.path(), None, "claude", None).unwrap();
             agent.command = "claude".into();
             assert_eq!(CustomAgent::read(&path).unwrap(), agent, "{field}");
         }
@@ -845,11 +929,11 @@ mod tests {
         )
         .unwrap();
 
-        set_builtin_command(dir.path(), "codex", None).unwrap();
+        set_builtin_command(dir.path(), None, "codex", None).unwrap();
 
         assert!(!path.exists());
         assert_eq!(
-            load(Some(dir.path())).into_iter().find(|s| s.id == "codex").unwrap(),
+            load(Some(dir.path()), None).into_iter().find(|s| s.id == "codex").unwrap(),
             builtin_spec("codex").unwrap()
         );
     }
@@ -870,7 +954,7 @@ mod tests {
         let text = std::fs::read_to_string(&path).unwrap();
         assert!(text.contains("[registry]") && !text.contains("driver"), "{text}");
         assert_eq!(CustomAgent::read(&path).unwrap(), agent);
-        let spec = load(Some(path.parent().unwrap())).into_iter().find(|s| s.id == "amp-acp").unwrap();
+        let spec = load(Some(path.parent().unwrap()), None).into_iter().find(|s| s.id == "amp-acp").unwrap();
         assert_eq!(spec.source, AgentSource::Registry { version: "0.10.0".into(), update: None });
         assert!(toml::from_str::<CustomAgent>("command = \"x\"\n[registry]\nid = \"x\"\n").is_err());
     }
@@ -888,50 +972,117 @@ mod tests {
     #[test]
     fn custom_agents_save_list_and_remove() {
         let dir = tempfile::tempdir().unwrap();
-        save_custom(dir.path(), &custom_input("mine")).unwrap();
-        let mine = load(Some(dir.path())).into_iter().find(|s| s.id == "mine").unwrap();
+        save_custom(dir.path(), None, &custom_input("mine")).unwrap();
+        let mine = load(Some(dir.path()), None).into_iter().find(|s| s.id == "mine").unwrap();
         assert_eq!((mine.name.as_str(), mine.command.as_str()), ("Mine", "/opt/mine"));
         assert_eq!(mine.env, vec![("K".to_owned(), "v".to_owned())]);
         assert_eq!(mine.source, AgentSource::Custom);
-        remove_custom(dir.path(), "mine").unwrap();
-        assert!(!load(Some(dir.path())).iter().any(|s| s.id == "mine"));
-        remove_custom(dir.path(), "mine").unwrap_err();
+        remove_custom(dir.path(), None, "mine").unwrap();
+        assert!(!load(Some(dir.path()), None).iter().any(|s| s.id == "mine"));
+        remove_custom(dir.path(), None, "mine").unwrap_err();
     }
 
     #[test]
     fn custom_agents_refuse_builtin_registry_and_bad_ids() {
         let dir = tempfile::tempdir().unwrap();
-        save_custom(dir.path(), &custom_input("claude")).unwrap_err();
-        save_custom(dir.path(), &custom_input("../evil")).unwrap_err();
-        save_custom(dir.path(), &custom_input("")).unwrap_err();
+        save_custom(dir.path(), None, &custom_input("claude")).unwrap_err();
+        save_custom(dir.path(), None, &custom_input("../evil")).unwrap_err();
+        save_custom(dir.path(), None, &custom_input("")).unwrap_err();
         let mut empty_command = custom_input("mine");
         empty_command.command = "  ".into();
-        save_custom(dir.path(), &empty_command).unwrap_err();
-        save_custom(dir.path(), &custom_input("mine")).unwrap();
-        save_custom(dir.path(), &custom_input("mine")).unwrap_err();
-        remove_custom(dir.path(), "claude").unwrap_err();
+        save_custom(dir.path(), None, &empty_command).unwrap_err();
+        save_custom(dir.path(), None, &custom_input("mine")).unwrap();
+        save_custom(dir.path(), None, &custom_input("mine")).unwrap_err();
+        remove_custom(dir.path(), None, "claude").unwrap_err();
         // An id that isn't a plain file stem never reaches outside the agents directory.
         let outside = dir.path().join("outside.toml");
         std::fs::write(&outside, "command = \"/bin/sh\"\n").unwrap();
         let agents = dir.path().join("agents");
         std::fs::create_dir(&agents).unwrap();
-        remove_custom(&agents, "../outside").unwrap_err();
+        remove_custom(&agents, None, "../outside").unwrap_err();
         assert!(outside.exists());
         std::fs::write(
             dir.path().join("amp-acp.toml"),
             "command = \"/registry/amp\"\n[registry]\nid = \"amp-acp\"\nversion = \"1.0\"\n",
         )
         .unwrap();
-        save_custom(dir.path(), &custom_input("amp-acp")).unwrap_err();
-        remove_custom(dir.path(), "amp-acp").unwrap_err();
+        save_custom(dir.path(), None, &custom_input("amp-acp")).unwrap_err();
+        remove_custom(dir.path(), None, "amp-acp").unwrap_err();
+    }
+
+    #[derive(Default)]
+    struct MemorySecrets(parking_lot::Mutex<BTreeMap<String, String>>);
+
+    impl EnvSecrets for MemorySecrets {
+        fn get(&self, key: &str) -> Option<String> {
+            self.0.lock().get(key).cloned()
+        }
+        fn set(&self, key: &str, value: &str) -> IdeResult<()> {
+            self.0.lock().insert(key.to_owned(), value.to_owned());
+            Ok(())
+        }
+        fn delete(&self, key: &str) {
+            self.0.lock().remove(key);
+        }
+        fn keys(&self, prefix: &str) -> Vec<String> {
+            self.0.lock().keys().filter(|k| k.starts_with(prefix)).cloned().collect()
+        }
+    }
+
+    #[test]
+    fn environment_values_go_to_the_secrets_and_the_files_keep_the_names() {
+        let dir = tempfile::tempdir().unwrap();
+        let secrets = MemorySecrets::default();
+        let s = Some(&secrets as &dyn EnvSecrets);
+        let env = BTreeMap::from([("API_KEY".to_owned(), "v-91f".to_owned()), ("A/B".to_owned(), String::new())]);
+        set_builtin_env(dir.path(), s, "claude", env.clone()).unwrap();
+        save_custom(dir.path(), s, &CustomAgentInput { env: env.clone(), ..custom_input("mine") }).unwrap();
+        for id in ["claude", "mine"] {
+            let text = std::fs::read_to_string(dir.path().join(format!("{id}.toml"))).unwrap();
+            assert!(text.contains("API_KEY") && !text.contains("v-91f"), "{text}");
+            let spec = load(Some(dir.path()), s).into_iter().find(|p| p.id == id).unwrap();
+            assert_eq!(describe(&spec).env, env);
+        }
+        assert_eq!(secrets.keys("agent/"), ["agent/claude/env/API_KEY", "agent/mine/env/API_KEY"]);
+
+        set_builtin_command(dir.path(), s, "claude", Some("/opt/claude")).unwrap();
+        assert_eq!(secrets.get("agent/claude/env/API_KEY").as_deref(), Some("v-91f"));
+        set_builtin_env(dir.path(), s, "claude", BTreeMap::from([("OTHER".to_owned(), "x".to_owned())])).unwrap();
+        assert_eq!(secrets.keys("agent/claude/"), ["agent/claude/env/OTHER"]);
+        set_builtin_command(dir.path(), s, "claude", None).unwrap();
+        set_builtin_env(dir.path(), s, "claude", BTreeMap::new()).unwrap();
+        remove_custom(dir.path(), s, "mine").unwrap();
+        assert_eq!(secrets.keys("agent/"), Vec::<String>::new());
+    }
+
+    #[test]
+    fn values_written_in_agent_files_move_to_the_secrets_unless_installed_from_the_registry() {
+        let dir = tempfile::tempdir().unwrap();
+        let secrets = MemorySecrets::default();
+        let s = Some(&secrets as &dyn EnvSecrets);
+        std::fs::write(dir.path().join("mine.toml"), "command = \"/opt/mine\"\n[env]\nK = \"v-91f\"\nS = \"\"\n")
+            .unwrap();
+        secrets.set("agent/mine/env/S", "saved").unwrap();
+        let registry =
+            "command = \"/registry/amp\"\n[env]\nR = \"1\"\n[registry]\nid = \"amp-acp\"\nversion = \"1.0\"\n";
+        std::fs::write(dir.path().join("amp-acp.toml"), registry).unwrap();
+        let specs = load(Some(dir.path()), s);
+        assert_eq!(
+            specs.iter().find(|p| p.id == "mine").unwrap().env,
+            [("K".to_owned(), "v-91f".to_owned()), ("S".to_owned(), "saved".to_owned())]
+        );
+        assert!(!std::fs::read_to_string(dir.path().join("mine.toml")).unwrap().contains("v-91f"));
+        assert_eq!(secrets.keys("agent/"), ["agent/mine/env/K", "agent/mine/env/S"]);
+        assert_eq!(std::fs::read_to_string(dir.path().join("amp-acp.toml")).unwrap(), registry);
     }
 
     #[test]
     fn acp_json_imports_servers_and_skips_collisions() {
         let dir = tempfile::tempdir().unwrap();
-        save_custom(dir.path(), &custom_input("taken")).unwrap();
+        save_custom(dir.path(), None, &custom_input("taken")).unwrap();
         let outcomes = import_acp(
             dir.path(),
+            None,
             r#"{"agent_servers": {
                 "My Agent!": {"command": "/opt/agent", "args": ["--acp"], "env": {"K": "v"}},
                 "taken": {"command": "/opt/taken"},
@@ -944,10 +1095,10 @@ mod tests {
         let saved: Vec<&str> = outcomes.iter().filter(|o| o.saved).map(|o| o.id.as_str()).collect();
         assert_eq!(saved, ["my-agent"]);
         assert!(outcomes.iter().filter(|o| !o.saved).all(|o| !o.reason.is_empty()));
-        let mine = load(Some(dir.path())).into_iter().find(|s| s.id == "my-agent").unwrap();
+        let mine = load(Some(dir.path()), None).into_iter().find(|s| s.id == "my-agent").unwrap();
         assert_eq!((mine.name.as_str(), mine.command.as_str()), ("My Agent!", "/opt/agent"));
         assert_eq!(mine.source, AgentSource::Custom);
-        import_acp(dir.path(), "not json").unwrap_err();
-        assert!(import_acp(dir.path(), "{}").unwrap().is_empty());
+        import_acp(dir.path(), None, "not json").unwrap_err();
+        assert!(import_acp(dir.path(), None, "{}").unwrap().is_empty());
     }
 }

crates/ide-agent/src/registry.rs

@@ -826,7 +826,7 @@ mod tests {
         assert!(!shown.iter().any(|a| a.id == "cline"));
 
         write_atomic(&p.cache_file, INDEX.as_bytes()).unwrap();
-        let mut providers: Vec<AgentProvider> = provider::load(Some(&p.agents_dir))
+        let mut providers: Vec<AgentProvider> = provider::load(Some(&p.agents_dir), None)
             .into_iter()
             .filter(|s| s.id == "amp-acp")
             .map(|s| provider::describe(&s))
@@ -918,7 +918,7 @@ mod tests {
         assert_eq!(agent.command, v1.to_string_lossy());
         assert_eq!((agent.args.as_slice(), agent.env["A"].as_str()), (&["acp".to_owned()][..], "1"));
         assert_eq!(agent.registry, Some(RegistryRef { id: "demo".into(), version: "1.0.0".into() }));
-        let spec = provider::load(Some(&p.agents_dir)).into_iter().find(|s| s.id == "demo").unwrap();
+        let spec = provider::load(Some(&p.agents_dir), None).into_iter().find(|s| s.id == "demo").unwrap();
         assert_eq!(spec.source, AgentSource::Registry { version: "1.0.0".into(), update: None });
         assert!(provider::installed(&spec.command));
 
@@ -991,7 +991,7 @@ mod tests {
         assert_eq!((shown[0].installed.as_deref(), shown[0].update), (Some("1.0.104"), true));
 
         write_atomic(&p.cache_file, index.as_bytes()).unwrap();
-        let spec = provider::load(Some(&p.agents_dir)).into_iter().find(|s| s.id == "copilot").unwrap();
+        let spec = provider::load(Some(&p.agents_dir), None).into_iter().find(|s| s.id == "copilot").unwrap();
         assert_eq!(spec.name, "GitHub Copilot");
         assert_eq!(spec.login_hint, "Run `copilot` in a terminal and sign in.");
         assert_eq!(spec.source, AgentSource::Registry { version: "1.0.104".into(), update: None });
@@ -1004,7 +1004,7 @@ mod tests {
         );
 
         remove(&p, "github-copilot-cli").unwrap();
-        let fallback = provider::load(Some(&p.agents_dir)).into_iter().find(|s| s.id == "copilot").unwrap();
+        let fallback = provider::load(Some(&p.agents_dir), None).into_iter().find(|s| s.id == "copilot").unwrap();
         assert_eq!(fallback.source, AgentSource::Builtin);
     }
 }

crates/ide-agent/src/replay_tests.rs

@@ -24,6 +24,7 @@ fn paths(dir: &Path) -> AgentPaths {
         models_file: dir.join("models.json"),
         custom_agents_dir: None,
         home_dir: None,
+        env_secrets: None,
     }
 }
 

crates/ide-agent/src/security.rs

@@ -13,29 +13,23 @@ pub enum PolicyDecision {
     AskUser,
 }
 
-/// Extracts the shell command string from an ACP `session/request_permission` payload
-/// when the request is for executing a command.
+/// The shell command an ACP `session/request_permission` asks to run: only a tool call of kind
+/// `execute`, and only its structured `rawInput` command. A title is free text the agent
+/// writes, so it never names the command.
 pub fn extract_command(params: &Value) -> Option<String> {
     let tool = params.get("toolCall").or_else(|| params.pointer("/subject/toolCall"))?;
+    if tool.get("kind").and_then(Value::as_str) != Some("execute") {
+        return None;
+    }
     let raw_cmd = tool.pointer("/rawInput/command").or_else(|| tool.pointer("/rawInput/cmd"));
-    if let Some(cmd) = raw_cmd.and_then(command_from_value) {
-        return Some(cmd);
-    }
-    let kind = tool.get("kind").and_then(Value::as_str).unwrap_or_default();
-    let name = tool.get("name").and_then(Value::as_str).unwrap_or_default();
-    let title =
-        tool.get("title").and_then(Value::as_str).or_else(|| params.get("title").and_then(Value::as_str))?.trim();
-    if let Some(cmd) = title.strip_prefix("Run ").map(str::trim).filter(|s| !s.is_empty()) {
-        return Some(cmd.to_owned());
-    }
-    if (kind == "execute" || matches!(name, "Bash" | "PowerShell" | "Execute" | "Run" | "terminal"))
-        && !title.is_empty()
-        && title != "Terminal"
-        && title != "Run a command"
-    {
-        return Some(title.to_owned());
-    }
-    None
+    raw_cmd.and_then(command_from_value)
+}
+
+/// Whether allowing the request grants more than running its command, such as network access
+/// for it: the command policy may block such a request but never approves it.
+pub fn widens_access(params: &Value) -> bool {
+    let tool = params.get("toolCall").or_else(|| params.pointer("/subject/toolCall"));
+    tool.and_then(|t| t.pointer("/rawInput/networkApprovalContext")).is_some_and(|c| !c.is_null())
 }
 
 fn command_from_value(val: &Value) -> Option<String> {
@@ -298,6 +292,41 @@ fn split_subcommands(command: &str) -> Vec<&str> {
     out
 }
 
+/// Whether every shell an agent may run `command` in (a POSIX shell, PowerShell, cmd.exe) reads
+/// it as the one command the policy sees. Outside double quotes no separator or redirection may
+/// remain after splitting (cmd.exe takes single quotes literally); `\` may only stand in a
+/// path (it escapes only in POSIX shells); no `^` may escape a quote (cmd.exe); no `%` (cmd.exe
+/// expands it before parsing); no carriage return; no typographic quotes (PowerShell ends
+/// strings at them).
+fn reads_alike_in_every_shell(command: &str) -> bool {
+    let chars: Vec<char> = command.chars().collect();
+    let mut in_double = false;
+    for (i, &c) in chars.iter().enumerate() {
+        let next = chars.get(i + 1).copied();
+        match c {
+            '"' => in_double = !in_double,
+            '\\' if !next.is_none_or(|n| n.is_ascii_alphanumeric() || matches!(n, '\\' | '.' | '_' | '-')) => {
+                return false;
+            }
+            '^' if matches!(next, Some('"' | '\'' | '\n' | '\r')) => return false,
+            '%' | '\r' | '\u{2018}'..='\u{201f}' => return false,
+            ';' | '&' | '|' | '<' | '>' | '\n' if !in_double => return false,
+            _ => {}
+        }
+    }
+    true
+}
+
+/// A command as blocked patterns are compared with it: lower case, single spaces, and the
+/// program without its folder or `.exe` (`/bin/rm` and `RM.EXE` are `rm`).
+fn normalized_for_blocking(command: &str) -> String {
+    let mut words = command.split_whitespace().map(str::to_lowercase);
+    let Some(program) = words.next() else { return String::new() };
+    let program = program.rsplit(['/', '\\']).next().unwrap_or(&program);
+    let program = program.strip_suffix(".exe").unwrap_or(program);
+    std::iter::once(program.to_owned()).chain(words).collect::<Vec<_>>().join(" ")
+}
+
 /// Evaluates `command` against `settings`:
 /// 1. Blacklist takes precedence: if the full command or any sub-command matches a
 ///    `blocked_commands` entry, returns [`PolicyDecision::Blocked`].
@@ -312,12 +341,18 @@ pub fn evaluate_command(command: &str, settings: &AgentSecuritySettings) -> Poli
     }
     let subcommands = split_subcommands(cmd);
 
+    let normalized: Vec<String> =
+        std::iter::once(cmd).chain(subcommands.iter().copied()).map(normalized_for_blocking).collect();
     for pat in &settings.blocked_commands {
         let pat = pat.trim();
         if pat.is_empty() {
             continue;
         }
-        if matches_command(pat, cmd) || subcommands.iter().any(|sub| matches_command(pat, sub)) {
+        let normalized_pat = normalized_for_blocking(pat);
+        if matches_command(pat, cmd)
+            || subcommands.iter().any(|sub| matches_command(pat, sub))
+            || normalized.iter().any(|c| matches_command(&normalized_pat, c))
+        {
             return PolicyDecision::Blocked(pat.to_owned());
         }
     }
@@ -328,7 +363,7 @@ pub fn evaluate_command(command: &str, settings: &AgentSecuritySettings) -> Poli
 
     let all_allowed = subcommands.iter().all(|sub| {
         let s = sub.trim();
-        if s.is_empty() || has_unsafe_shell_syntax(s) {
+        if s.is_empty() || has_unsafe_shell_syntax(s) || !reads_alike_in_every_shell(s) {
             return false;
         }
         settings.allowed_commands.iter().any(|entry| matches_allow_entry(entry, s))
@@ -455,6 +490,58 @@ mod tests {
         assert_eq!(evaluate_command("git status && rm -rf /", &settings), PolicyDecision::Blocked("rm -rf *".into()));
     }
 
+    /// The command may run in PowerShell or cmd.exe as well as a POSIX shell: what any of them
+    /// would split or expand differently from the policy's reading is never auto-approved.
+    #[test]
+    fn what_another_shell_reads_as_two_commands_is_not_auto_approved() {
+        let settings = AgentSecuritySettings {
+            allowed_commands: vec!["git status".into(), "git commit".into()],
+            blocked_commands: vec![],
+        };
+        for cmd in [
+            // `\` escapes only in POSIX shells.
+            "git status \\; calc.exe",
+            "git status \\& calc.exe",
+            "git status \\| calc.exe",
+            "git status \\\\\\; calc.exe",
+            "git status \"\\\" ; calc.exe ; \\\"\"",
+            // cmd.exe: single quotes don't quote, `^` escapes a quote, `%` expands first.
+            "git status '&' calc.exe",
+            "git status ';' calc.exe",
+            "git status '>' out.txt",
+            "git status ^\" & calc.exe ^\"",
+            "git status %COMSPEC%",
+            // PowerShell also closes a string at a typographic quote.
+            "git status \"a \u{201d} ; calc.exe ; \u{201c} b\"",
+            "git status \u{2018}x\u{2019}",
+            // A carriage return ends the command line too.
+            "git status\r calc.exe",
+        ] {
+            assert_eq!(evaluate_command(cmd, &settings), PolicyDecision::AskUser, "{cmd:?}");
+        }
+        // Text every shell reads alike stays approvable.
+        for cmd in [
+            "git status -s",
+            "git status && git status",
+            "git commit -m \"fix <bug> & (issue); done\"",
+            "git status src\\main.rs C:\\work\\repo",
+            "git status HEAD^",
+        ] {
+            assert_eq!(evaluate_command(cmd, &settings), PolicyDecision::Allowed, "{cmd:?}");
+        }
+    }
+
+    #[test]
+    fn blocked_patterns_ignore_case_spacing_and_the_programs_folder() {
+        let settings = AgentSecuritySettings::default();
+        for cmd in
+            ["rm  -rf /", "RM -RF /", "/bin/rm -rf /", "Rm -Rf  /tmp/x", "C:\\Windows\\System32\\shutdown.exe /s"]
+        {
+            assert!(matches!(evaluate_command(cmd, &settings), PolicyDecision::Blocked(_)), "{cmd:?}");
+        }
+        assert_eq!(evaluate_command("git status", &settings), PolicyDecision::AskUser);
+    }
+
     #[test]
     fn extracts_command_from_v1_v2_and_codex_payloads() {
         let claude = json!({
@@ -484,4 +571,30 @@ mod tests {
         });
         assert_eq!(extract_command(&write), None);
     }
+
+    /// Only a tool call of kind `execute` runs a command, and its command is in `rawInput`:
+    /// a title says what the agent wants it to say.
+    #[test]
+    fn a_request_is_a_command_only_by_its_kind_and_input() {
+        let escalation = json!({ "sessionId": "t", "toolCall": {
+            "toolCallId": "i1", "title": "Run git status", "kind": "other", "status": "pending",
+            "rawInput": { "fileSystem": { "write": ["C:\\"] }, "network": { "enabled": true } } },
+            "options": [ { "optionId": "turn", "name": "Allow for this turn", "kind": "allow_once" },
+                         { "optionId": "decline", "name": "Decline", "kind": "reject_once" } ] });
+        assert_eq!(extract_command(&escalation), None);
+        let titled_only = json!({ "toolCall": { "title": "Run git status", "kind": "execute" } });
+        assert_eq!(extract_command(&titled_only), None);
+        let named_only = json!({ "toolCall": { "title": "git status", "name": "Bash" } });
+        assert_eq!(extract_command(&named_only), None);
+        let mislabelled = json!({ "toolCall": { "title": "Run git status", "kind": "edit",
+            "rawInput": { "command": "git status" } } });
+        assert_eq!(extract_command(&mislabelled), None);
+        let network = json!({ "toolCall": { "title": "Allow network access to example.com", "kind": "execute",
+            "rawInput": { "command": "curl https://example.com", "networkApprovalContext": { "host": "example.com" } } } });
+        assert_eq!(extract_command(&network).as_deref(), Some("curl https://example.com"));
+        assert!(widens_access(&network));
+        let plain = json!({ "toolCall": { "title": "Run git status", "kind": "execute",
+            "rawInput": { "command": "git status" } } });
+        assert!(!widens_access(&plain));
+    }
 }

crates/ide-agent/src/tests.rs

@@ -264,6 +264,23 @@ impl Handler for FakeAgent {
                     self.say(&session, &format!("late chose {chosen}"));
                     return Ok(json!({"stopReason": "end_turn"}));
                 }
+                if text == "escalate" {
+                    // A request for wider access, titled with text the model wrote.
+                    let peer = self.latest();
+                    let answer: Value = tokio::runtime::Handle::current()
+                        .block_on(peer.request(
+                            "session/request_permission",
+                            json!({"sessionId": session, "toolCall": {"toolCallId": "e1", "title": "Run cargo test",
+                                "kind": "other", "rawInput": {"network": {"enabled": true}}},
+                                "options": [{"optionId": "yes", "name": "Allow for this turn", "kind": "allow_once"},
+                                            {"optionId": "no", "name": "Decline", "kind": "reject_once"}]}),
+                            None,
+                        ))
+                        .unwrap();
+                    let chosen = answer.pointer("/outcome/optionId").and_then(Value::as_str).unwrap_or("none");
+                    self.say(&session, &format!("escalation chose {chosen}"));
+                    return Ok(json!({"stopReason": "end_turn"}));
+                }
                 if text == "ask" {
                     let peer = self.latest();
                     let answer: Value = tokio::runtime::Handle::current()
@@ -344,7 +361,8 @@ impl Handler for FakeAgent {
                 let answer: Value = tokio::runtime::Handle::current()
                     .block_on(peer.request(
                         "session/request_permission",
-                        json!({"sessionId": session, "toolCall": {"toolCallId": "t1", "title": "Run cargo test"},
+                        json!({"sessionId": session, "toolCall": {"toolCallId": "t1", "title": "Run cargo test",
+                            "kind": "execute", "rawInput": {"command": "cargo test"}},
                             "options": [{"optionId": "yes", "name": "Allow", "kind": "allow_once"},
                                         {"optionId": "no", "name": "Reject", "kind": "reject_once"}]}),
                         None,
@@ -366,7 +384,8 @@ fn manager(dir: &Path, agent: Arc<FakeAgent>) -> AgentManager {
 fn manager_at(dir: &Path, models_file: &Path, agent: Arc<FakeAgent>) -> AgentManager {
     // These tests speak to FakeAgent, never an installed CLI, including after a provider reload.
     let agents = dir.join("agents");
-    provider::set_builtin_command(&agents, "claude", Some(&dir.join("missing-claude").to_string_lossy())).unwrap();
+    provider::set_builtin_command(&agents, None, "claude", Some(&dir.join("missing-claude").to_string_lossy()))
+        .unwrap();
     let connector: Connector = Arc::new(move |_spec, _cwd, client, _stderr| {
         let (a, b) = duplex(1 << 20);
         let (ar, aw) = tokio::io::split(a);
@@ -385,6 +404,7 @@ fn manager_at(dir: &Path, models_file: &Path, agent: Arc<FakeAgent>) -> AgentMan
             // The project is the boundary of the skill walk: nothing above it (such as the
             // user's profile, when temp lives under it) leaks into the test.
             home_dir: Some(dir.to_path_buf()),
+            env_secrets: None,
         },
         tokio::runtime::Handle::current(),
         connector,
@@ -1410,6 +1430,7 @@ async fn real_claude_task_in_a_worktree() {
             models_file: tmp.path().join("models.json"),
             custom_agents_dir: None,
             home_dir: None,
+            env_secrets: None,
         },
         tokio::runtime::Handle::current(),
     );
@@ -2243,6 +2264,7 @@ async fn reload_providers_updates_registry_install_clears_stale_probes_and_notif
             models_file: tmp.path().join("models.json"),
             custom_agents_dir: Some(agents_dir.clone()),
             home_dir: None,
+            env_secrets: None,
         },
         tokio::runtime::Handle::current(),
         connector,
@@ -2553,6 +2575,7 @@ async fn delete_running_agent(no_load: bool) {
             models_file: root.join("models.json"),
             custom_agents_dir: None,
             home_dir: None,
+            env_secrets: None,
         },
         tokio::runtime::Handle::current(),
         connector,
@@ -3187,3 +3210,43 @@ async fn security_policy_auto_approves_whitelist_and_rejects_blacklist() {
         "{blocked_entries:?}"
     );
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn security_policy_never_auto_approves_a_request_that_only_reads_like_a_command() {
+    use ide_core::settings::AgentSecuritySettings;
+
+    let tmp = tempfile::tempdir().unwrap();
+    let agent = Arc::new(FakeAgent::default());
+    let mgr = manager(tmp.path(), agent);
+    mgr.set_security_hook(Arc::new(|| AgentSecuritySettings {
+        allowed_commands: vec!["cargo test".into()],
+        blocked_commands: vec![],
+    }));
+    let task = mgr
+        .create(NewAgentTask {
+            project_root: None,
+            prompt: text("escalate"),
+            provider: "claude".into(),
+            config: vec![],
+            isolation: Isolation::Local,
+            base: None,
+        })
+        .await
+        .unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::NeedsInput).await;
+    let entries = mgr.entries(&task.id, None).unwrap();
+    let pending = entries
+        .iter()
+        .find_map(|e| match e {
+            AgentEntry::Permission { id, chosen: None, .. } => Some(*id),
+            _ => None,
+        })
+        .unwrap_or_else(|| panic!("the request was answered without the user: {entries:?}"));
+    mgr.respond(&task.id, pending, Some("no".into())).unwrap();
+    wait_for(&mgr, &task.id, AgentStatus::Ready).await;
+    let entries = mgr.entries(&task.id, None).unwrap();
+    assert!(
+        entries.iter().any(|e| matches!(e, AgentEntry::Agent { text } if text == "escalation chose no")),
+        "{entries:?}"
+    );
+}

crates/ide-agent/src/timeline.rs

@@ -438,6 +438,7 @@ mod tests {
         t.push(AgentEntry::Permission {
             id: 1,
             title: "Run?".into(),
+            command: None,
             options: vec![],
             questions: vec![],
             chosen: None,

crates/ide-agent/src/worktree.rs

@@ -358,6 +358,38 @@ impl TaskBase {
     }
 }
 
+/// One side of an Accept (the task's worktree or the checkout): where its files really are, and
+/// git's own folders for it.
+struct Confined {
+    root: PathBuf,
+    metadata: Vec<PathBuf>,
+}
+
+impl Confined {
+    fn new(root: &Path, repo: Option<&Repo>) -> IdeResult<Self> {
+        let metadata = match repo {
+            Some(repo) => repo.metadata_dirs()?.iter().map(|d| ide_core::real_path::resolve_real(d)).collect(),
+            None => Vec::new(),
+        };
+        Ok(Self { root: dunce::canonicalize(root)?, metadata })
+    }
+
+    /// Whether `rel` may be read or written here: it doesn't name git's metadata under any
+    /// spelling (case, trailing dots or spaces, stream suffixes, short names), stays in the tree
+    /// once links are followed, and isn't a link itself.
+    fn allows(&self, rel: &str) -> bool {
+        use ide_core::real_path::{names_git_dir, reaches_git_dir, resolve_real};
+        let path = self.root.join(rel);
+        if names_git_dir(Path::new(rel)) || path.symlink_metadata().is_ok_and(|m| m.file_type().is_symlink()) {
+            return false;
+        }
+        let real = resolve_real(&path);
+        real.starts_with(&self.root)
+            && !reaches_git_dir(&self.root, &real)
+            && !self.metadata.iter().any(|dir| real.starts_with(dir))
+    }
+}
+
 /// Copies the task's `changes` (against `base`) from the worktree `cwd` into the
 /// local checkout `root`, uncommitted: the user reviews and commits them with the
 /// VCS tools. Files the checkout changed itself are left alone and reported, so
@@ -370,7 +402,13 @@ pub(crate) fn accept(
 ) -> IdeResult<crate::AgentAcceptOutcome> {
     let repo = repo_at(cwd)?;
     // Change paths are repository-relative, and the task's project may be a folder inside it.
-    let local_root = discover(root)?.map_or_else(|| root.to_path_buf(), |r| r.root().to_path_buf());
+    let local = discover(root)?;
+    let local_root = local.as_ref().map_or_else(|| root.to_path_buf(), |r| r.root().to_path_buf());
+    // Paths come from what the agent left in its worktree: neither side may lead into git's own
+    // files or out through a link.
+    let task_side = Confined::new(repo.root(), Some(&repo))?;
+    let checkout_side = Confined::new(&local_root, local.as_ref())?;
+    let copyable = |rel: &str| task_side.allows(rel) && checkout_side.allows(rel);
     let renamed_from: BTreeMap<String, String> =
         repo.diff_with_worktree(base)?.into_iter().filter_map(|f| Some((f.path, f.old_path?))).collect();
     // Brings one path of the checkout to the task's version, unless the checkout changed it itself.
@@ -411,13 +449,25 @@ pub(crate) fn accept(
         path: path.to_owned(),
         reason: "the checkout has changes of its own to it; accept it by hand".to_owned(),
     };
+    let refuse = |path: &str| crate::AgentAcceptSkipped {
+        path: path.to_owned(),
+        reason: "it leads into git's own files or through a link, so it is not copied".to_owned(),
+    };
     for change in changes {
+        let old = renamed_from.get(&change.rel_path);
+        if !copyable(&change.rel_path) {
+            skipped.push(refuse(&change.rel_path));
+            continue;
+        }
+        if let Some(old) = old.filter(|old| !copyable(old)) {
+            skipped.push(refuse(old));
+            continue;
+        }
         // A case-only rename (`a.txt` → `A.txt`). Where the disk resolves both
         // spellings to one file it is renamed in place and `apply` then refreshes
         // the content. On a case-sensitive disk the two names are different files:
         // the old one's unchanged-ness (it is the file the checkout had) decides —
         // then the task's version lands at the new name and the old one goes.
-        let old = renamed_from.get(&change.rel_path);
         let case_only =
             old.is_some_and(|o| o != &change.rel_path && o.to_lowercase() == change.rel_path.to_lowercase());
         if case_only {
@@ -910,6 +960,103 @@ mod tests {
         assert_eq!(names, ["A.txt"]);
     }
 
+    #[cfg(windows)]
+    #[test]
+    fn accept_does_not_write_into_the_checkouts_git_folder_through_its_short_name() {
+        let (_tmp, repo, created) = accept_repo();
+        if !repo.join("GIT~1").join("HEAD").is_file() {
+            eprintln!("8.3 short names are disabled on this volume; nothing to check");
+            return;
+        }
+        // Written in the worktree under the name the checkout's `.git` folder also has.
+        let wt = &created.path;
+        std::fs::rename(wt.join(".git"), wt.join("gitfile")).unwrap();
+        std::fs::create_dir_all(wt.join("GIT~1").join("hooks")).unwrap();
+        std::fs::write(wt.join("GIT~1").join("hooks").join("pre-commit"), "#!/bin/sh\nexit 0\n").unwrap();
+        std::fs::rename(wt.join("gitfile"), wt.join(".git")).unwrap();
+        std::fs::write(wt.join("a.txt"), "one\nTWO\n").unwrap();
+
+        let changes = listed(wt, &created.base_commit);
+        assert!(changes.iter().any(|c| c.rel_path == "GIT~1/hooks/pre-commit"), "control: git lists it");
+        let outcome = accept(&repo, wt, &created.base_commit, &changes).unwrap();
+        assert!(!repo.join(".git").join("hooks").join("pre-commit").exists(), "{outcome:?}");
+        assert_eq!(outcome.accepted, ["a.txt"]);
+        assert_eq!(outcome.skipped.iter().map(|s| s.path.as_str()).collect::<Vec<_>>(), ["GIT~1/hooks/pre-commit"]);
+    }
+
+    #[test]
+    fn accept_refuses_paths_that_lead_into_git_metadata_under_any_spelling() {
+        let (tmp, repo, _created) = accept_repo();
+        let checkout = Confined::new(&repo, Repo::discover(&repo).unwrap().as_ref()).unwrap();
+        for rel in [
+            ".git/hooks/pre-commit",
+            ".GIT/hooks/pre-commit",
+            ".git./hooks/pre-commit",
+            ".git /hooks/pre-commit",
+            ".git::$INDEX_ALLOCATION/hooks/pre-commit",
+            "sub/.git/config",
+            "../outside.txt",
+        ] {
+            assert!(!checkout.allows(rel), "{rel}");
+        }
+        assert!(checkout.allows("src/new.txt"));
+        assert!(checkout.allows(".github/workflows/ci.yml"));
+
+        // git's folder under another name inside the tree (`--separate-git-dir`).
+        let separate = tmp.path().join("separate");
+        std::fs::create_dir(&separate).unwrap();
+        git(&separate, &["init", "-q", "--separate-git-dir", "meta", "-b", "main"]);
+        let side = Confined::new(&separate, Repo::discover(&separate).unwrap().as_ref()).unwrap();
+        assert!(!side.allows("meta/hooks/pre-commit"));
+        assert!(side.allows("metadata.txt"));
+    }
+
+    /// A link the task left in its worktree, or a linked folder in the checkout: neither is followed.
+    #[test]
+    fn accept_does_not_follow_links_on_either_side() {
+        let (tmp, repo, created) = accept_repo();
+        let outside = tmp.path().join("outside");
+        std::fs::create_dir(&outside).unwrap();
+        std::fs::write(outside.join("secret.txt"), "secret\n").unwrap();
+        // A folder link in the checkout (a junction on Windows, which needs no privilege).
+        #[cfg(unix)]
+        std::os::unix::fs::symlink(&outside, repo.join("linked")).unwrap();
+        #[cfg(windows)]
+        assert!(
+            std::process::Command::new("cmd")
+                .args(["/c", "mklink", "/J"])
+                .arg(repo.join("linked"))
+                .arg(&outside)
+                .output()
+                .unwrap()
+                .status
+                .success()
+        );
+        std::fs::create_dir(created.path.join("linked")).unwrap();
+        std::fs::write(created.path.join("linked/new.txt"), "x\n").unwrap();
+        std::fs::write(created.path.join("a.txt"), "one\nTWO\n").unwrap();
+        // A file link in the worktree, where the platform lets this user create one.
+        #[cfg(unix)]
+        let file_link = std::os::unix::fs::symlink(outside.join("secret.txt"), created.path.join("copied.txt"));
+        #[cfg(windows)]
+        let file_link = std::os::windows::fs::symlink_file(outside.join("secret.txt"), created.path.join("copied.txt"));
+        if let Err(e) = &file_link {
+            eprintln!("no file link ({e}); checking the folder link only");
+        }
+
+        let changes: Vec<_> = listed(&created.path, &created.base_commit);
+        let outcome = accept(&repo, &created.path, &created.base_commit, &changes).unwrap();
+        assert!(!outside.join("new.txt").exists(), "{outcome:?}");
+        assert!(!repo.join("copied.txt").exists(), "{outcome:?}");
+        assert!(outcome.accepted.contains(&"a.txt".to_owned()));
+        let refused: Vec<_> = outcome.skipped.iter().map(|s| s.path.as_str()).collect();
+        if file_link.is_ok() {
+            assert_eq!(refused, ["copied.txt", "linked/new.txt"]);
+        } else {
+            assert_eq!(refused, ["linked/new.txt"]);
+        }
+    }
+
     #[test]
     fn accept_copies_new_modified_and_deleted_files_into_the_checkout() {
         let (_tmp, repo, created) = accept_repo();

crates/ide-build/src/maven.rs

@@ -16,6 +16,7 @@ use std::io::Read;
 use std::path::{Path, PathBuf};
 use std::sync::{Mutex, OnceLock};
 
+pub mod completion;
 pub mod sources;
 
 /// Lets the IDE's own Maven runs (Reload, Build) use what the local repository already
@@ -299,7 +300,7 @@ fn read_plugin(e: &Element) -> Option<RawPlugin> {
     })
 }
 
-fn read_properties(e: Option<&Element>) -> Vec<(String, String)> {
+pub(crate) fn read_properties(e: Option<&Element>) -> Vec<(String, String)> {
     e.map(|p| p.children.iter().map(|c| (c.name.clone(), c.text.trim().to_owned())).collect()).unwrap_or_default()
 }
 
@@ -1729,7 +1730,7 @@ fn property_ref_at(text: &str, at: usize) -> Option<(&str, usize, usize)> {
 }
 
 /// The elements containing `at`, from the root down to the innermost one.
-fn element_path(root: &Element, at: usize) -> Vec<&Element> {
+pub(crate) fn element_path(root: &Element, at: usize) -> Vec<&Element> {
     let mut path = vec![root];
     loop {
         let Some(next) = path.last().unwrap().children.iter().find(|c| c.start <= at && at < c.end) else {

crates/ide-build/src/maven/completion.rs

@@ -0,0 +1,677 @@
+//! Completion of Maven coordinates in a POM: inside a `<dependency>`, the
+//! `<groupId>`, `<artifactId>` and `<version>` values are completed from the
+//! local repository layout (`<repo>/<group path>/<artifactId>/<version>/…`).
+//! The Maven Central search endpoint tops the lists up remotely; the host op
+//! fetches those (cached) and merges them behind the local ones, so this side
+//! stays pure text and directory logic and tests build their own repositories.
+
+use super::xml::{self, Element};
+use super::{element_path, interpolate, read_properties};
+use serde::{Deserialize, Serialize};
+use specta::Type;
+use std::cmp::Ordering;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+/// The coordinate element a POM completion fills.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub enum PomCompletionKind {
+    /// The dependency's `<groupId>`.
+    GroupId,
+    /// The dependency's `<artifactId>`.
+    ArtifactId,
+    /// The dependency's `<version>`.
+    Version,
+}
+
+/// One suggestion: the coordinate as inserted, and an optional note shown in
+/// the lookup (the owning group of an artifactId, its newest installed version).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PomCompletionOption {
+    /// The text the completion inserts (`org.example.lib`, `example-lib`, `1.2.0`).
+    pub label: String,
+    pub detail: Option<String>,
+}
+
+/// The completion offered at a caret of a POM: the replaced value span (UTF-16
+/// offsets) and the suggestions, local ones first.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PomCompletion {
+    /// UTF-16 offset where the completed text starts: the value's first character.
+    pub from: u32,
+    /// UTF-16 offset where the replaced value ends: past the caret when the caret
+    /// sits inside an existing value, which is then replaced whole.
+    pub to: u32,
+    /// Which coordinate element the caret is in.
+    pub kind: PomCompletionKind,
+    /// The suggestions, local repository first.
+    pub options: Vec<PomCompletionOption>,
+}
+
+/// Where the caret sits in a `<dependency>` coordinate element: what is being
+/// completed, the typed prefix, and the sibling coordinates the rest need.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PomCompletionTarget {
+    /// UTF-16 offset of the value's first character (the caret in an empty value).
+    pub from: u32,
+    /// UTF-16 offset past the value's last character (the caret in an empty value).
+    pub to: u32,
+    /// The value typed so far: the text between `from` and the caret, trimmed.
+    pub typed: String,
+    pub kind: PomCompletionKind,
+    /// The interpolated `<groupId>` sibling, when completing the artifactId and
+    /// the group is written out plain (no unresolved `${property}`).
+    pub group: Option<String>,
+    /// The interpolated `<artifactId>` sibling, when completing the version.
+    pub artifact: Option<String>,
+}
+
+/// A coordinate element's text, with the POM's own `${properties}` replaced;
+/// `None` when the element is missing or a property stays unresolved (the
+/// coordinates behind it are not known without the parent chain, which the
+/// completion does not follow).
+fn coordinate(e: Option<&Element>, props: &HashMap<String, String>) -> Option<String> {
+    let text = interpolate(e?.text.trim(), props);
+    (!text.is_empty() && !text.contains("${")).then_some(text)
+}
+
+fn own_properties(root: &Element) -> HashMap<String, String> {
+    read_properties(root.child("properties")).into_iter().collect()
+}
+
+/// UTF-16 offset -> byte offset, clamped to `text`.
+fn utf16_to_byte(text: &str, offset: u32) -> usize {
+    let mut seen = 0u32;
+    for (byte, c) in text.char_indices() {
+        if seen >= offset {
+            return byte;
+        }
+        seen += c.len_utf16() as u32;
+    }
+    text.len()
+}
+
+/// Byte offset -> UTF-16 offset.
+fn utf16_at(text: &str, byte: usize) -> u32 {
+    text[..byte].encode_utf16().count() as u32
+}
+
+/// Byte offset just past the start tag's `>` of the element at `start`.
+fn start_tag_end(text: &str, start: usize) -> Option<usize> {
+    let bytes = text.as_bytes();
+    let mut i = start.checked_add(1)?;
+    let mut quote = None;
+    while i < bytes.len() {
+        match (quote, bytes[i]) {
+            (Some(q), b) if b == q => quote = None,
+            (Some(_), _) => {}
+            (None, b'"' | b'\'') => quote = Some(bytes[i]),
+            (None, b'>') => return Some(i + 1),
+            _ => {}
+        }
+        i += 1;
+    }
+    None
+}
+
+/// What to complete at the caret (`offset`, UTF-16) of the POM `text`: the
+/// `<groupId>` / `<artifactId>` / `<version>` element of a `<dependency>` the
+/// caret sits in the value of. `None` everywhere else — other elements, carets
+/// in an end tag or a `${property}` reference, dependencies without the
+/// `<groupId>` (and, for versions, the `<artifactId>`) their completions need.
+pub fn completion_target(text: &str, offset: u32) -> Option<PomCompletionTarget> {
+    let root = xml::parse(text).filter(|e| e.name == "project")?;
+    let at = utf16_to_byte(text, offset);
+    // A caret at the very end of the input sits in the element still being
+    // typed, whose range reaches to the input's end; step back one character
+    // so `element_path` sees it (the caret's own offset stays `at`).
+    let probe = if at == text.len() && at > 0 {
+        let mut p = at - 1;
+        while p > 0 && !text.is_char_boundary(p) {
+            p -= 1;
+        }
+        p
+    } else {
+        at
+    };
+    let elements = element_path(&root, probe);
+    let e = *elements.last()?;
+    let parent = elements.get(elements.len().checked_sub(2)?)?;
+    let kind = match e.name.as_str() {
+        "groupId" => PomCompletionKind::GroupId,
+        "artifactId" => PomCompletionKind::ArtifactId,
+        "version" => PomCompletionKind::Version,
+        _ => return None,
+    };
+    if parent.name != "dependency" || at > e.inner_end {
+        return None;
+    }
+    let inner_start = start_tag_end(text, e.start)?;
+    let value = &text[inner_start..e.inner_end.max(inner_start)];
+    if value.contains("${") {
+        return None; // Property references are goto-declaration territory, not completion.
+    }
+    let lead = value.len() - value.trim_start().len();
+    let trail = value.len() - value.trim_end().len();
+    let (mut from, mut to) = (inner_start + lead, e.inner_end.max(inner_start) - trail);
+    if from > to {
+        // A value of whitespace only: complete at the caret.
+        from = at.min(to);
+        to = to.max(from);
+    }
+    from = from.min(at);
+    to = to.max(from);
+    let props = own_properties(&root);
+    let group = (kind != PomCompletionKind::GroupId).then(|| coordinate(parent.child("groupId"), &props)).flatten();
+    let artifact =
+        (kind == PomCompletionKind::Version).then(|| coordinate(parent.child("artifactId"), &props)).flatten();
+    let typed = text[from..at].trim().to_owned();
+    Some(PomCompletionTarget { from: utf16_at(text, from), to: utf16_at(text, to), typed, kind, group, artifact })
+}
+
+/// The suggestions the local repository at `repo` offers for `target`: group
+/// ids installed under it, the artifacts of the target's group, or the versions
+/// of the target's artifact. Every scan is bounded (see `SCAN_BUDGET`) and
+/// reads only directory listings of `repo` — nothing outside it, no jar
+/// contents.
+pub fn local_options(repo: &Path, target: &PomCompletionTarget) -> Vec<PomCompletionOption> {
+    let mut budget = SCAN_BUDGET;
+    match target.kind {
+        // `org.spr` completes the `spr` part under `org/`, `org.` the next
+        // segment under `org/`; every typed segment is validated so POM text
+        // cannot walk out of the repository.
+        PomCompletionKind::GroupId => {
+            let segments: Vec<&str> = target.typed.split('.').collect();
+            let (partial, base) = segments.split_last().unwrap_or((&"", &[]));
+            if base.iter().all(|s| segment(s)) {
+                let dir = base.iter().fold(repo.to_path_buf(), |p, s| p.join(s));
+                scan_groups(&dir, &base.join("."), partial, &mut budget)
+            } else {
+                Vec::new()
+            }
+        }
+        PomCompletionKind::ArtifactId => target
+            .group
+            .as_deref()
+            .and_then(|g| repo_dir(repo, &[g]))
+            .map_or_else(Vec::new, |dir| scan_artifacts(&dir, &target.typed, &mut budget)),
+        PomCompletionKind::Version => target
+            .group
+            .as_deref()
+            .zip(target.artifact.as_deref())
+            .and_then(|(g, a)| repo_dir(repo, &[g, a]))
+            .map_or_else(Vec::new, |dir| scan_versions(&dir, &target.typed, &mut budget)),
+    }
+}
+
+/// Directory listings one completion may read: the scans are interactive, so
+/// they stop before they could be felt, and a huge repository simply yields
+/// fewer suggestions (its shallowest first — the walk is breadth-preferring).
+const SCAN_BUDGET: u32 = 2048;
+/// Suggestion caps per kind: group ids and artifact ids fill a lookup page,
+/// versions list an artifact's releases.
+const MAX_GROUP_OPTIONS: usize = 60;
+const MAX_ARTIFACT_OPTIONS: usize = 60;
+const MAX_VERSION_OPTIONS: usize = 100;
+/// The cap the merged list (local plus Maven Central's) is truncated to.
+pub const MAX_OPTIONS: usize = 100;
+
+/// A directory entry whose name passes the repository layout's alphabet
+/// (mirrors `sources::artifact`'s): letters, digits, `._-`. Path separators
+/// and `..` never pass, so a POM's `${…}`-free text cannot traverse out of
+/// the repository.
+fn segment(name: &str) -> bool {
+    !name.is_empty()
+        && name != "."
+        && name != ".."
+        && name.chars().all(|c| c.is_ascii_alphanumeric() || "._-".contains(c))
+}
+
+/// The subdirectories of `dir` with repository-layout names, spending `budget`
+/// on the listing; `None` when the budget ran out before `dir` was listed.
+fn subdirs(dir: &Path, budget: &mut u32) -> Option<Vec<String>> {
+    if *budget == 0 {
+        return None;
+    }
+    *budget -= 1;
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return Some(Vec::new());
+    };
+    let mut names = Vec::new();
+    for entry in entries.flatten() {
+        // The budget bounds file-type checks too: a plain listing answers.
+        if entry.file_type().map(|t| t.is_dir()).unwrap_or(false)
+            && let Ok(name) = entry.file_name().into_string()
+            && segment(&name)
+        {
+            names.push(name);
+        }
+    }
+    Some(names)
+}
+
+/// Whether `dir` holds files — a version directory does (jar, pom, the
+/// tracking files), a group path segment never does.
+fn holds_files(dir: &Path, budget: &mut u32) -> bool {
+    if *budget == 0 {
+        return false;
+    }
+    *budget -= 1;
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return false;
+    };
+    entries.flatten().any(|e| e.file_type().map(|t| t.is_file()).unwrap_or(false))
+}
+
+/// Whether the version directory `dir` holds the version: its `.pom` or a `.jar`. A failed
+/// download leaves only `*.lastUpdated` tracking files behind, for a version that may not
+/// even exist (one typed while the POM was being edited).
+fn installed(dir: &Path, budget: &mut u32) -> bool {
+    if *budget == 0 {
+        return false;
+    }
+    *budget -= 1;
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return false;
+    };
+    entries.flatten().any(|e| {
+        e.file_type().map(|t| t.is_file()).unwrap_or(false)
+            && e.file_name().to_str().is_some_and(|n| n.ends_with(".pom") || n.ends_with(".jar"))
+    })
+}
+
+/// Whether `dir` is an artifact directory: it holds versions of one artifact,
+/// recognizable by a `maven-metadata*.xml` beside them or a child directory
+/// holding files. A group segment's children are directories without files.
+fn artifact_dir(dir: &Path, budget: &mut u32) -> bool {
+    if *budget == 0 {
+        return false;
+    }
+    *budget -= 1;
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return false;
+    };
+    for entry in entries.flatten() {
+        let Ok(name) = entry.file_name().into_string() else { continue };
+        if name.starts_with("maven-metadata") {
+            return true;
+        }
+    }
+    let Some(children) = subdirs(dir, budget) else { return false };
+    children.iter().any(|c| holds_files(&dir.join(c), budget))
+}
+
+/// Whether `dir` is a group directory (holds artifact directories) and whether
+/// it also holds deeper group segments worth descending into.
+fn group_dir(dir: &Path, budget: &mut u32) -> Option<(bool, bool)> {
+    let children = subdirs(dir, budget)?;
+    let (mut group, mut descend) = (false, false);
+    for child in &children {
+        if artifact_dir(&dir.join(child), budget) {
+            group = true;
+        } else {
+            descend = true;
+        }
+    }
+    Some((group, descend))
+}
+
+/// The group ids installed under `dir` (which the typed prefix `prefix` —
+/// "" for the repository root — already names), completing the partial last
+/// segment `partial`, shallower groups first.
+fn scan_groups(dir: &Path, prefix: &str, partial: &str, budget: &mut u32) -> Vec<PomCompletionOption> {
+    let mut out = Vec::new();
+    scan_groups_into(dir, prefix, partial, &mut out, budget);
+    out.sort_by(|a, b| a.label.cmp(&b.label));
+    out
+}
+
+fn scan_groups_into(dir: &Path, prefix: &str, partial: &str, out: &mut Vec<PomCompletionOption>, budget: &mut u32) {
+    if out.len() >= MAX_GROUP_OPTIONS {
+        return;
+    }
+    let Some(children) = subdirs(dir, budget) else { return };
+    for name in children {
+        if !name.starts_with(partial) {
+            continue;
+        }
+        let path = dir.join(&name);
+        let label = if prefix.is_empty() { name.clone() } else { format!("{prefix}.{name}") };
+        let Some((group, descend)) = group_dir(&path, budget) else { return };
+        if group {
+            out.push(PomCompletionOption { label: label.clone(), detail: None });
+            if out.len() >= MAX_GROUP_OPTIONS {
+                return;
+            }
+        }
+        // Deeper groups (org.example under org.example's own parent) follow the
+        // shallower ones, so a truncated scan of a huge repository still offers
+        // every first-level segment.
+        if descend {
+            scan_groups_into(&path, &label, "", out, budget);
+        }
+    }
+}
+
+/// The artifact ids installed under the group directory `dir`, completing the
+/// typed prefix, each with its newest installed version as the detail.
+fn scan_artifacts(dir: &Path, typed: &str, budget: &mut u32) -> Vec<PomCompletionOption> {
+    let Some(children) = subdirs(dir, budget) else { return Vec::new() };
+    let mut out = Vec::new();
+    for name in children {
+        if !name.starts_with(typed) || !artifact_dir(&dir.join(&name), budget) {
+            continue;
+        }
+        let detail = newest_version(&dir.join(&name), budget);
+        out.push(PomCompletionOption { label: name, detail });
+    }
+    out.sort_by(|a, b| a.label.cmp(&b.label));
+    out.truncate(MAX_ARTIFACT_OPTIONS);
+    out
+}
+
+/// The newest version directory of the artifact at `dir`, by Maven's ordering.
+fn newest_version(dir: &Path, budget: &mut u32) -> Option<String> {
+    let children = subdirs(dir, budget)?;
+    children.into_iter().filter(|name| installed(&dir.join(name), budget)).max_by(|a, b| compare_versions(a, b))
+}
+
+/// The versions installed of the artifact at `dir`, completing the typed
+/// prefix, newest first.
+fn scan_versions(dir: &Path, typed: &str, budget: &mut u32) -> Vec<PomCompletionOption> {
+    let Some(children) = subdirs(dir, budget) else { return Vec::new() };
+    let mut out: Vec<_> = children
+        .into_iter()
+        .filter(|name| name.starts_with(typed) && installed(&dir.join(name), budget))
+        .map(|name| PomCompletionOption { label: name, detail: None })
+        .collect();
+    out.sort_by(|a, b| compare_versions(&b.label, &a.label));
+    out.truncate(MAX_VERSION_OPTIONS);
+    out
+}
+
+/// The repository directory of the `/`-separated `coordinates` (a group id, or
+/// a group and an artifact id), each segment validated against the layout's
+/// alphabet so POM text cannot walk outside `repo`.
+fn repo_dir(repo: &Path, coordinates: &[&str]) -> Option<PathBuf> {
+    let segments: Vec<&str> = coordinates.iter().flat_map(|c| c.split('.')).collect();
+    segments.iter().all(|s| segment(s)).then(|| segments.iter().fold(repo.to_path_buf(), |p, s| p.join(s)))
+}
+
+/// Maven-ish version order, best-effort (a full `ComparableVersion` is out of
+/// proportion for ordering a lookup): numeric runs compare numerically, letter
+/// runs by their qualifier rank (`alpha < beta < m < rc < snapshot < release <
+/// sp`, unknown ones with releases lexically); missing parts rank as zero.
+fn compare_versions(a: &str, b: &str) -> Ordering {
+    fn tokens(v: &str) -> Vec<String> {
+        v.split(|c: char| !c.is_ascii_alphanumeric()).filter(|t| !t.is_empty()).map(str::to_ascii_lowercase).collect()
+    }
+    fn rank(t: &str) -> Option<u8> {
+        match t {
+            "a" | "alpha" => Some(0),
+            "b" | "beta" => Some(1),
+            "m" | "milestone" => Some(2),
+            "rc" | "cr" => Some(3),
+            "snapshot" => Some(4),
+            "" | "ga" | "final" => Some(5),
+            "sp" => Some(6),
+            _ => None,
+        }
+    }
+    let (a, b) = (tokens(a), tokens(b));
+    for i in 0..a.len().max(b.len()) {
+        let (x, y) = (a.get(i).map(String::as_str), b.get(i).map(String::as_str));
+        let (xn, yn) = (x.and_then(|s| s.parse::<u64>().ok()), y.and_then(|s| s.parse::<u64>().ok()));
+        let order = match (xn, yn) {
+            // Numbers compare numerically; a number outranks a qualifier.
+            (Some(xn), Some(yn)) => xn.cmp(&yn),
+            (Some(_), None) if y.is_some() => return Ordering::Greater,
+            (None, Some(_)) if x.is_some() => return Ordering::Less,
+            _ => {
+                let xr = x.and_then(rank).unwrap_or(5);
+                let yr = y.and_then(rank).unwrap_or(5);
+                if xr != yr { xr.cmp(&yr) } else { x.unwrap_or("").cmp(y.unwrap_or("")) }
+            }
+        };
+        if order != Ordering::Equal {
+            return order;
+        }
+    }
+    Ordering::Equal
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A small local repository: every file is laid out as Maven installs it,
+    /// so the scans recognize group, artifact and version directories.
+    fn repo(dir: &Path) -> PathBuf {
+        let repo = dir.join("repository");
+        for file in [
+            "org/apache/maven/maven-core/4.0.0-rc-5/maven-core-4.0.0-rc-5.jar",
+            "org/apache/maven/plugins/maven-compiler-plugin/3.8.1/maven-compiler-plugin-3.8.1.jar",
+            "org/example/lib/1.0/lib-1.0.jar",
+            "org/example/lib/1.9.1/lib-1.9.1.jar",
+            "org/example/lib/1.10/lib-1.10.jar",
+            "org/example/lib/2.0-beta-1/lib-2.0-beta-1.jar",
+            "org/example/lib/2.0/lib-2.0.pom",
+            "net/nu/netty/4.1.100/netty-4.1.100.jar",
+            // Failed downloads (a version typed while editing): tracking files only, not installed.
+            "org/example/lib/2/lib-2.jar.lastUpdated",
+            "org/example/lib/3.0/lib-3.0.pom.lastUpdated",
+        ] {
+            let path = repo.join(file);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(&path, b"").unwrap();
+        }
+        repo
+    }
+
+    fn target(text: &str, needle: &str) -> Option<PomCompletionTarget> {
+        completion_target(text, (text.find(needle).unwrap() + needle.len()) as u32)
+    }
+
+    #[test]
+    fn completes_each_coordinate_element_of_a_dependency() {
+        let text = "<project><dependencies><dependency>\
+<groupId>org.example</groupId><artifactId>lib</artifactId><version>1.0</version>\
+</dependency></dependencies></project>";
+        let t = target(text, "<groupId>org.example").unwrap();
+        assert_eq!(t.kind, PomCompletionKind::GroupId);
+        assert_eq!(t.typed, "org.example");
+        assert_eq!((t.from, t.to), (44, 55));
+        assert!(t.group.is_none() && t.artifact.is_none());
+
+        let t = target(text, "<artifactId>lib").unwrap();
+        assert_eq!(t.kind, PomCompletionKind::ArtifactId);
+        assert_eq!(t.typed, "lib");
+        assert_eq!(t.group.as_deref(), Some("org.example"));
+        assert!(t.artifact.is_none());
+
+        let t = target(text, "<version>1.0").unwrap();
+        assert_eq!(t.kind, PomCompletionKind::Version);
+        assert_eq!(t.typed, "1.0");
+        assert_eq!(t.group.as_deref(), Some("org.example"));
+        assert_eq!(t.artifact.as_deref(), Some("lib"));
+    }
+
+    #[test]
+    fn completes_while_the_element_is_being_typed_and_the_value_is_empty() {
+        let empty = "<project><dependencies><dependency><groupId></groupId></dependency></dependencies></project>";
+        let t = target(empty, "<groupId>").unwrap();
+        assert_eq!(t.kind, PomCompletionKind::GroupId);
+        assert_eq!(t.typed, "");
+        assert_eq!(t.from, t.to);
+
+        let open = "<project><dependencies><dependency><artifactId>li";
+        let t = target(open, "li").unwrap();
+        assert_eq!(t.kind, PomCompletionKind::ArtifactId);
+        assert_eq!(t.typed, "li");
+        // The value under construction ends with the input and is replaced whole.
+        assert_eq!(t.to, open.len() as u32);
+    }
+
+    #[test]
+    fn completes_only_dependency_coordinates() {
+        // The same elements outside a <dependency> get nothing: a <plugin> is
+        // completed by the repository, not coordinates.
+        let plugin =
+            "<project><build><plugins><plugin><groupId>org.apache.maven</groupId></plugin></plugins></build></project>";
+        assert_eq!(target(plugin, "<groupId>org.apache.maven"), None);
+        // A caret in the end tag, or on a `${property}` value, is not a completion.
+        let text =
+            "<project><dependencies><dependency><groupId>org.example</groupId></dependency></dependencies></project>";
+        assert_eq!(target(text, "</groupId>"), None);
+        let property = "<project><dependencies><dependency><groupId>${example.group}</groupId></dependency></dependencies></project>";
+        assert_eq!(target(property, "${example.group}"), None);
+        // A dependency's groupId is required before its artifacts can be listed.
+        let no_group =
+            "<project><dependencies><dependency><artifactId>lib</artifactId></dependency></dependencies></project>";
+        let t = target(no_group, "<artifactId>lib").unwrap();
+        assert!(t.group.is_none());
+    }
+
+    #[test]
+    fn interpolates_the_poms_own_properties_for_siblings() {
+        let text = "<project>\
+<properties><example.group>org.example</example.group><example.version>2.0</example.version></properties>\
+<dependencies><dependency><groupId>${example.group}</groupId><artifactId>lib</artifactId><version>${example.version}</version></dependency></dependencies>\
+</project>";
+        // The groupId the caret is typing stays a completion; the siblings resolve.
+        let t = target(text, "<artifactId>lib").unwrap();
+        assert_eq!(t.group.as_deref(), Some("org.example"));
+        // A `${property}` under the caret itself gets nothing to complete.
+        assert_eq!(target(text, "<version>${example.version}"), None);
+    }
+
+    #[test]
+    fn local_scan_lists_installed_groups_shallowest_first() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = repo(tmp.path());
+        let options = |typed: &str| {
+            local_options(
+                &repo,
+                &PomCompletionTarget {
+                    from: 0,
+                    to: 0,
+                    typed: typed.into(),
+                    kind: PomCompletionKind::GroupId,
+                    group: None,
+                    artifact: None,
+                },
+            )
+            .into_iter()
+            .map(|o| o.label)
+            .collect::<Vec<_>>()
+        };
+        // Only directories holding artifacts are group ids: `net` and `org`
+        // alone never receive an install, their deeper levels do.
+        assert_eq!(options(""), ["net.nu", "org.apache.maven", "org.apache.maven.plugins", "org.example"]);
+        assert_eq!(options("org"), ["org.apache.maven", "org.apache.maven.plugins", "org.example"]);
+        assert_eq!(options("org."), ["org.apache.maven", "org.apache.maven.plugins", "org.example"]);
+        assert_eq!(options("org.spr"), Vec::<String>::new());
+        assert_eq!(options("net."), ["net.nu"]);
+    }
+
+    #[test]
+    fn local_scan_lists_artifacts_of_the_group_with_their_newest_version() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = repo(tmp.path());
+        let options = |typed: &str| {
+            local_options(
+                &repo,
+                &PomCompletionTarget {
+                    from: 0,
+                    to: 0,
+                    typed: typed.into(),
+                    kind: PomCompletionKind::ArtifactId,
+                    group: Some("org.example".into()),
+                    artifact: None,
+                },
+            )
+            .into_iter()
+            .map(|o| (o.label, o.detail))
+            .collect::<Vec<_>>()
+        };
+        assert_eq!(options(""), [("lib".to_owned(), Some("2.0".to_owned()))]);
+        assert_eq!(options("net"), Vec::<(String, Option<String>)>::new());
+    }
+
+    #[test]
+    fn local_scan_lists_versions_of_the_artifact_newest_first() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = repo(tmp.path());
+        let options = |typed: &str| {
+            local_options(
+                &repo,
+                &PomCompletionTarget {
+                    from: 0,
+                    to: 0,
+                    typed: typed.into(),
+                    kind: PomCompletionKind::Version,
+                    group: Some("org.example".into()),
+                    artifact: Some("lib".into()),
+                },
+            )
+            .into_iter()
+            .map(|o| o.label)
+            .collect::<Vec<_>>()
+        };
+        assert_eq!(options(""), ["2.0", "2.0-beta-1", "1.10", "1.9.1", "1.0"]);
+        assert_eq!(options("1."), ["1.10", "1.9.1", "1.0"]);
+    }
+
+    #[test]
+    fn a_poms_text_cannot_walk_out_of_the_repository() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = repo(tmp.path());
+        for group in ["../../etc", "..", "org/../.."] {
+            let options = local_options(
+                &repo,
+                &PomCompletionTarget {
+                    from: 0,
+                    to: 0,
+                    typed: "".into(),
+                    kind: PomCompletionKind::ArtifactId,
+                    group: Some(group.into()),
+                    artifact: None,
+                },
+            );
+            assert!(options.is_empty(), "{group}");
+        }
+    }
+
+    #[test]
+    fn the_scan_stops_at_the_option_cap() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = tmp.path().join("repository");
+        for i in 0..MAX_GROUP_OPTIONS + 10 {
+            let group = repo.join(format!("com/example/g{i}"));
+            std::fs::create_dir_all(group.join("art/1.0")).unwrap();
+            std::fs::write(group.join("art/1.0/art-1.0.jar"), b"").unwrap();
+        }
+        let options = local_options(
+            &repo,
+            &PomCompletionTarget {
+                from: 0,
+                to: 0,
+                typed: "".into(),
+                kind: PomCompletionKind::GroupId,
+                group: None,
+                artifact: None,
+            },
+        );
+        assert_eq!(options.len(), MAX_GROUP_OPTIONS);
+    }
+
+    #[test]
+    fn maven_version_order() {
+        let mut versions = ["2.0", "1.0", "2.0-beta-1", "2.0-alpha-2", "1.10", "1.9.1", "4.0.0-rc-5", "4.0.0-rc-13"];
+        versions.sort_by(|a, b| compare_versions(a, b));
+        assert_eq!(versions, ["1.0", "1.9.1", "1.10", "2.0-alpha-2", "2.0-beta-1", "2.0", "4.0.0-rc-5", "4.0.0-rc-13"]);
+    }
+}

crates/ide-core/src/editor_settings.rs

@@ -67,6 +67,8 @@ pub struct EditorAppearanceSettings {
     /// Smooth caret movement curve: `snappy` | `gliding`.
     pub caret_movement_style: String,
     pub line_numbers: bool,
+    /// Gutter numbering: `absolute` | `relative` | `hybrid` (absolute on the caret line, distances elsewhere).
+    pub line_number_mode: String,
     pub method_separators: bool,
     /// Sub-options of `editor.showWhitespace`.
     pub whitespace_leading: bool,
@@ -96,6 +98,7 @@ impl Default for EditorAppearanceSettings {
             smooth_caret_movement: false,
             caret_movement_style: "snappy".into(),
             line_numbers: true,
+            line_number_mode: "absolute".into(),
             method_separators: false,
             whitespace_leading: true,
             whitespace_inner: true,

crates/ide-core/src/lib.rs

@@ -21,6 +21,7 @@ pub mod process;
 pub mod project_dir;
 pub mod project_roots;
 pub mod proxy_settings;
+pub mod real_path;
 pub mod remote_settings;
 pub mod settings;
 pub mod task;

crates/ide-core/src/real_path.rs

@@ -0,0 +1,53 @@
+//! Where a path really lands, and whether it reaches git's own metadata, for writes that must
+//! stay inside a project and out of its `.git`.
+
+use std::path::{Path, PathBuf};
+
+/// `joined` after `..`/symlink resolution as far as the file system allows:
+/// the canonical path when it exists, else the canonicalized deepest existing
+/// ancestor with the still-missing tail resolved textually — so the location
+/// of a missing path is still judged where it would really land.
+pub fn resolve_real(joined: &Path) -> PathBuf {
+    let mut tail = Vec::new();
+    let mut candidate = joined.to_path_buf();
+    let mut real = loop {
+        match dunce::canonicalize(&candidate) {
+            Ok(real) => break real,
+            Err(_) => {
+                let Some(last) = candidate.components().next_back() else {
+                    return joined.to_path_buf();
+                };
+                tail.push(last.as_os_str().to_owned());
+                if !candidate.pop() {
+                    return joined.to_path_buf();
+                }
+            }
+        }
+    };
+    for part in tail.iter().rev() {
+        if part == ".." {
+            real.pop();
+        } else if part != "." {
+            real.push(part);
+        }
+    }
+    real
+}
+
+/// Whether a path (relative to the project root) goes through git's own `.git` folder or file.
+/// git runs what it finds in `.git` (hooks, `gpg.program`, filters), so a content write must
+/// never reach it. Names are normalized for trailing dots and spaces and NTFS stream suffixes;
+/// the caller also checks the short-name-resolved path via [`resolve_real`].
+pub fn names_git_dir(rel: &Path) -> bool {
+    rel.components().any(|part| {
+        let name = part.as_os_str().to_string_lossy();
+        let name = name.split(':').next().unwrap_or_default().trim_end_matches(['.', ' ']);
+        name.eq_ignore_ascii_case(".git")
+    })
+}
+
+/// A resolved write destination under `root` that reaches git's own `.git` metadata, judged by
+/// the name given and by the name the file system resolves it to.
+pub fn reaches_git_dir(root: &Path, real: &Path) -> bool {
+    real.strip_prefix(root).is_ok_and(names_git_dir) || resolve_real(real).strip_prefix(root).is_ok_and(names_git_dir)
+}

crates/ide-core/src/settings.rs

@@ -102,6 +102,11 @@ pub struct AgentSettings {
     #[serde(deserialize_with = "or_default")]
     #[specta(type = WhileRunning)]
     pub while_running: WhileRunning,
+    /// Whether new tasks start in the agent's mode that approves everything (Claude Code's
+    /// bypass permissions, Codex's full access) or in one that asks. User settings only.
+    #[serde(deserialize_with = "or_default")]
+    #[specta(type = NewTaskApprovals)]
+    pub new_task_approvals: NewTaskApprovals,
     /// Settings new tasks of an agent start with: agent id → option id → value.
     #[serde(deserialize_with = "agent_defaults")]
     #[specta(type = BTreeMap<String, BTreeMap<String, String>>)]
@@ -127,6 +132,7 @@ impl Default for AgentSettings {
             expand_tool_output: false,
             send_with: SendKey::Enter,
             while_running: WhileRunning::Queue,
+            new_task_approvals: NewTaskApprovals::Bypass,
             defaults: BTreeMap::new(),
             mcp_servers: BTreeMap::new(),
         }
@@ -270,6 +276,17 @@ pub enum WhileRunning {
     Steer,
 }
 
+/// The approvals new agent tasks start with.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub enum NewTaskApprovals {
+    /// The agent's mode that approves everything without asking, when it has one.
+    #[default]
+    Bypass,
+    /// A mode in which the agent asks before edits and commands.
+    Ask,
+}
+
 /// Agents › MCP Server: agents use the IDE's built-in tools.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, Type)]
 #[serde(default, rename_all = "camelCase")]
@@ -1021,11 +1038,28 @@ pub struct PythonSettings {
     pub interpreter: String,
     /// Activate the interpreter's virtualenv in new terminal sessions.
     pub activate_virtualenv: bool,
+    /// Interpreters the user added to Settings › Python › All Interpreters (executable paths).
+    /// Detection contributes the rest; `hidden_interpreters` removes some of them.
+    pub interpreters: Vec<String>,
+    /// Interpreters the user removed from that list, as executable paths: detection does
+    /// not list them again.
+    pub hidden_interpreters: Vec<String>,
+    /// Hide interpreters that belong to another project (a virtualenv inside its folder).
+    pub hide_other_project_interpreters: bool,
+    /// Show each interpreter's path under its name on the interpreters page.
+    pub show_interpreter_paths: bool,
 }
 
 impl Default for PythonSettings {
     fn default() -> Self {
-        Self { interpreter: String::new(), activate_virtualenv: true }
+        Self {
+            interpreter: String::new(),
+            activate_virtualenv: true,
+            interpreters: Vec::new(),
+            hidden_interpreters: Vec::new(),
+            hide_other_project_interpreters: false,
+            show_interpreter_paths: true,
+        }
     }
 }
 

crates/ide-core/src/tool_path.rs

@@ -61,19 +61,13 @@ pub fn find_command(command: &str, search: &OsStr, root: &Path) -> Option<PathBu
 
 fn is_executable(path: &Path) -> bool {
     let Ok(metadata) = path.metadata() else { return false };
-    if !metadata.is_file() {
-        return false;
-    }
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        metadata.permissions().mode() & 0o111 != 0
+        metadata.is_file() && metadata.permissions().mode() & 0o111 != 0
     }
     #[cfg(not(unix))]
-    {
-        let _ = &metadata;
-        true
-    }
+    metadata.is_file()
 }
 
 /// [`search_path`]'s directories, in order and once each. Only absolute ones: a

crates/ide-db/Cargo.toml

@@ -37,6 +37,6 @@ zeroize = "1"
 open = "5"
 
 [dev-dependencies]
-tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net"] }
 tempfile.workspace = true
 ide-ssh = { workspace = true, features = ["testing"] }

crates/ide-db/src/conn.rs

@@ -241,6 +241,12 @@ pub enum Pool {
     Snowflake(crate::snowflake::SnowflakePool),
 }
 
+/// Some servers and proxies (e.g. Aliyun RDS for MySQL 5.6) advertise `CLIENT_DEPRECATE_EOF` but
+/// still end result sets with legacy EOF packets, which sqlx then fails to read as OK packets.
+fn legacy_eof(e: &sqlx::Error) -> bool {
+    matches!(e, sqlx::Error::Protocol(msg) if msg.starts_with("OK_Packet too short"))
+}
+
 pub(crate) fn db_err(e: sqlx::Error) -> IdeError {
     match &e {
         sqlx::Error::Database(d) => {
@@ -873,9 +879,16 @@ impl Pool {
                 if !tz.is_empty() {
                     opts = opts.timezone(Some(tz.to_owned()));
                 }
-                let manager = MysqlManager { options: opts, init: init.clone(), timeout };
+                let mut manager = MysqlManager { options: opts, init: init.clone(), timeout };
                 // Open once directly so authentication failures retain their database error.
-                let first = manager.connect().await.map_err(db_err)?;
+                let first = match manager.connect().await {
+                    Err(e) if legacy_eof(&e) => {
+                        manager.options = manager.options.clone().deprecate_eof(false);
+                        manager.connect().await
+                    }
+                    first => first,
+                }
+                .map_err(db_err)?;
                 let pool = Bb8Pool::builder().max_size(MAX).connection_timeout(timeout).build_unchecked(manager);
                 let _ = pool.add(first);
                 Ok(Pool::Mysql(ServerPool { inner: pool, closed: AtomicBool::new(false) }))

crates/ide-db/tests/mysql.rs

@@ -183,3 +183,51 @@ async fn a_reused_physical_connection_restores_the_configured_database() -> IdeR
     assert_eq!(pool.execute("SELECT CONNECTION_ID()", 1, &c).await?.rows, backend);
     Ok(())
 }
+
+/// Forwards to the test server, adding `CLIENT_DEPRECATE_EOF` to the capabilities its greeting
+/// advertises, like proxies that set the flag but leave a 5.x server sending legacy EOF packets.
+async fn deprecate_eof_proxy(host: String, port: u16) -> u16 {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let local = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        while let Ok((mut client, _)) = listener.accept().await {
+            let mut server = tokio::net::TcpStream::connect((host.as_str(), port)).await.unwrap();
+            tokio::spawn(async move {
+                let mut header = [0u8; 4];
+                server.read_exact(&mut header).await.unwrap();
+                let len = u32::from_le_bytes([header[0], header[1], header[2], 0]) as usize;
+                let mut greeting = vec![0u8; len];
+                server.read_exact(&mut greeting).await.unwrap();
+                // protocol version, NUL-terminated server version, connection id, 8 bytes of
+                // auth data, filler, lower capabilities, charset, status, upper capabilities.
+                let version_end = 1 + greeting[1..].iter().position(|&b| b == 0).unwrap();
+                let upper = version_end + 1 + 4 + 8 + 1 + 2 + 1 + 2;
+                greeting[upper + 1] |= 0x01; // bit 24 of the capability flags
+                client.write_all(&header).await.unwrap();
+                client.write_all(&greeting).await.unwrap();
+                let _ = tokio::io::copy_bidirectional(&mut client, &mut server).await;
+            });
+        }
+    });
+    local
+}
+
+#[tokio::test]
+async fn servers_that_advertise_deprecate_eof_but_send_legacy_eof_packets() -> IdeResult<()> {
+    use ide_db::Pool;
+    let Some((host, port, user, password)) = server() else { return Ok(()) };
+    let source = DataSource {
+        driver: DbDriver::Mysql,
+        host: "127.0.0.1".into(),
+        port: Some(deprecate_eof_proxy(host, port).await),
+        user,
+        ..Default::default()
+    };
+    let pool = Pool::connect(&source, Some(&password), None).await?;
+    assert_eq!(pool.rows("SELECT 1 + 1", 1).await?, vec![vec![Some("2".into())]]);
+    let c = CancellationToken::new();
+    let r = pool.execute("SELECT 'a' UNION ALL SELECT 'b'", 10, &c).await?;
+    assert_eq!(r.rows, vec![vec![Some("a".into())], vec![Some("b".into())]]);
+    Ok(())
+}

crates/ide-extension/src/ledger.rs

@@ -458,19 +458,13 @@ fn canonical_dir(p: &Path) -> PathBuf {
 
 fn is_executable(p: &Path) -> bool {
     let Ok(meta) = std::fs::metadata(p) else { return false };
-    if !meta.is_file() {
-        return false;
-    }
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        meta.permissions().mode() & 0o111 != 0
+        meta.is_file() && meta.permissions().mode() & 0o111 != 0
     }
     #[cfg(not(unix))]
-    {
-        let _ = &meta;
-        true
-    }
+    meta.is_file()
 }
 
 /// blake3 of a file, hex.

crates/ide-host/src/agent_secrets.rs

@@ -0,0 +1,175 @@
+//! Values coding agents are configured with that may be secrets (MCP servers' environment
+//! variables and HTTP headers, agents' environment), kept with the saved passwords in the OS
+//! credential store; the files that configure them keep only the names. Without a credential
+//! store (a headless Linux host) a value is kept in an owner-only file of the user's data
+//! instead, never in a project's files, and the user is told.
+
+use ide_core::event::NotifyLevel;
+use ide_core::{IdeEvent, IdeResult, SharedSink};
+use ide_ssh::secrets::SecretFile;
+use parking_lot::Mutex;
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+
+pub struct AgentSecrets {
+    store: SecretFile,
+    /// Values the credential store refused, by key.
+    local: PathBuf,
+    lock: Mutex<()>,
+}
+
+/// Where [`AgentSecrets::set`] kept a value.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Kept {
+    Store,
+    LocalFile,
+}
+
+impl AgentSecrets {
+    pub fn new(data_dir: &Path) -> Self {
+        Self::with_store(
+            SecretFile::new(data_dir.join("agent-secrets.json")),
+            data_dir.join("agent-secrets.local.json"),
+        )
+    }
+
+    pub fn with_store(store: SecretFile, local: PathBuf) -> Self {
+        Self { store, local, lock: Mutex::new(()) }
+    }
+
+    pub fn get(&self, key: &str) -> Option<String> {
+        self.store.get(key).or_else(|| self.read_local().remove(key))
+    }
+
+    pub fn set(&self, key: &str, value: &str) -> IdeResult<Kept> {
+        match self.store.set(key, value) {
+            Ok(()) => {
+                self.edit_local(|local| local.remove(key).is_some())?;
+                Ok(Kept::Store)
+            }
+            Err(e) => {
+                tracing::warn!("agent settings: {key} is kept in {}: {}", self.local.display(), e.message);
+                self.edit_local(|local| local.insert(key.to_owned(), value.to_owned()).as_deref() != Some(value))?;
+                Ok(Kept::LocalFile)
+            }
+        }
+    }
+
+    pub fn delete(&self, key: &str) {
+        self.store.delete(key);
+        if let Err(e) = self.edit_local(|local| local.remove(key).is_some()) {
+            tracing::warn!("agent settings: could not forget {key}: {}", e.message);
+        }
+    }
+
+    /// The keys that start with `prefix`, sorted.
+    pub fn keys(&self, prefix: &str) -> Vec<String> {
+        let keys: BTreeSet<String> = self.store.keys().into_iter().chain(self.read_local().into_keys()).collect();
+        keys.into_iter().filter(|k| k.starts_with(prefix)).collect()
+    }
+
+    /// Tells the window that values went to the owner-only file rather than the credential store.
+    pub fn notify_kept_locally(&self, sink: &SharedSink) {
+        sink.emit(IdeEvent::Notify {
+            level: NotifyLevel::Warning,
+            title: "No credential store".into(),
+            body: Some(format!(
+                "Values of agent and MCP server settings are kept in {}, readable only by you.",
+                self.local.display()
+            )),
+        });
+    }
+
+    fn read_local(&self) -> BTreeMap<String, String> {
+        match std::fs::read(&self.local) {
+            Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_else(|e| {
+                tracing::warn!("agent settings: {}: {e}", self.local.display());
+                BTreeMap::new()
+            }),
+            Err(_) => BTreeMap::new(),
+        }
+    }
+
+    fn edit_local(&self, edit: impl FnOnce(&mut BTreeMap<String, String>) -> bool) -> IdeResult<()> {
+        let _g = self.lock.lock();
+        let mut local = self.read_local();
+        if !edit(&mut local) {
+            return Ok(());
+        }
+        if local.is_empty() {
+            return match std::fs::remove_file(&self.local) {
+                Err(e) if e.kind() != std::io::ErrorKind::NotFound => Err(e.into()),
+                _ => Ok(()),
+            };
+        }
+        if let Some(dir) = self.local.parent() {
+            std::fs::create_dir_all(dir)?;
+        }
+        let bytes = serde_json::to_vec_pretty(&local).map_err(|e| ide_core::IdeError::internal(e.to_string()))?;
+        ide_vfs::write_atomic_private(&self.local, &bytes)?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ide_ssh::secrets::testing::{files_containing, use_memory_store};
+    use ide_ssh::secrets::{StoreError, StoreResult, Vault};
+    use std::sync::Arc;
+
+    /// A machine without a credential store (a headless Linux host).
+    struct NoStore;
+
+    impl Vault for NoStore {
+        fn available(&self) -> bool {
+            false
+        }
+        fn get(&self, _: &str, _: &str) -> StoreResult<String> {
+            Err(StoreError::NoDefaultStore)
+        }
+        fn set(&self, _: &str, _: &str, _: &str) -> StoreResult<()> {
+            Err(StoreError::NoDefaultStore)
+        }
+        fn delete(&self, _: &str, _: &str) -> StoreResult<()> {
+            Err(StoreError::NoDefaultStore)
+        }
+    }
+
+    #[test]
+    fn values_go_to_the_credential_store() {
+        use_memory_store();
+        let tmp = tempfile::tempdir().unwrap();
+        let secrets = AgentSecrets::new(tmp.path());
+        assert_eq!(secrets.set("mcp/user/a/env/TOKEN", "value-7c1e").unwrap(), Kept::Store);
+        assert_eq!(files_containing(tmp.path(), "value-7c1e"), Vec::<PathBuf>::new());
+        assert_eq!(AgentSecrets::new(tmp.path()).get("mcp/user/a/env/TOKEN").as_deref(), Some("value-7c1e"));
+        assert_eq!(secrets.keys("mcp/user/"), ["mcp/user/a/env/TOKEN"]);
+        secrets.delete("mcp/user/a/env/TOKEN");
+        assert_eq!(secrets.get("mcp/user/a/env/TOKEN"), None);
+    }
+
+    #[test]
+    fn without_a_credential_store_values_stay_in_an_owner_only_file() {
+        let tmp = tempfile::tempdir().unwrap();
+        let local = tmp.path().join("agent-secrets.local.json");
+        let store = SecretFile::with_vault(
+            tmp.path().join("agent-secrets.json"),
+            |v| serde_json::from_value(v).ok(),
+            Arc::new(NoStore),
+        );
+        let secrets = AgentSecrets::with_store(store, local.clone());
+        assert_eq!(secrets.set("mcp/user/a/env/TOKEN", "value-7c1e").unwrap(), Kept::LocalFile);
+        assert_eq!(files_containing(tmp.path(), "value-7c1e"), std::slice::from_ref(&local));
+        assert_eq!(secrets.get("mcp/user/a/env/TOKEN").as_deref(), Some("value-7c1e"));
+        assert_eq!(secrets.keys("mcp/"), ["mcp/user/a/env/TOKEN"]);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(std::fs::metadata(&local).unwrap().permissions().mode() & 0o777, 0o600);
+        }
+        secrets.delete("mcp/user/a/env/TOKEN");
+        assert_eq!(secrets.get("mcp/user/a/env/TOKEN"), None);
+        assert!(!local.exists());
+    }
+}

crates/ide-host/src/bin/openidea-plugin/main.rs

@@ -426,9 +426,9 @@ fn plugins_dir() -> Result<PathBuf, String> {
     if let Some(dir) = std::env::var_os("OPENIDEA_PLUGINS_DIR") {
         return Ok(PathBuf::from(dir));
     }
-    dirs::data_dir()
-        .map(|d| d.join("ai.l0ng.openidea").join("plugins"))
-        .ok_or_else(|| "cannot find the app data directory; set OPENIDEA_PLUGINS_DIR".into())
+    ide_host::data_dirs::data_dir("ai.l0ng.openidea")
+        .map(|d| d.join("plugins"))
+        .map_err(|error| format!("{error}; set OPENIDEA_PLUGINS_DIR"))
 }
 
 #[derive(Default, serde::Serialize, serde::Deserialize)]

crates/ide-host/src/data_dirs.rs

@@ -5,9 +5,52 @@ use std::fs;
 use std::io;
 use std::path::{Path, PathBuf};
 
-/// Moves the rebuildable local data (tools, language servers, indexes, caches);
-/// configuration and roaming data keep following the OS.
+/// Moves the rebuildable local data (tools, language servers, indexes, caches).
 pub const LOCAL_DATA_ENV: &str = "OPENIDEA_LOCAL_DATA_DIR";
+/// Moves the configuration (settings, recent projects, language definitions, window state).
+pub const CONFIG_ENV: &str = "OPENIDEA_CONFIG_DIR";
+/// Moves the user data (plugins, scratches, Local History, trusted projects).
+pub const DATA_ENV: &str = "OPENIDEA_DATA_DIR";
+/// Moves the logs.
+pub const LOG_ENV: &str = "OPENIDEA_LOG_DIR";
+
+/// `$OPENIDEA_CONFIG_DIR/<identifier>` when set, else the OS configuration directory
+/// (Tauri's `app_config_dir`). Like the local data, the identifier keeps release and
+/// per-worktree debug builds apart under one root; a relative path is an error.
+pub fn config_dir(identifier: &str) -> Result<PathBuf, String> {
+    resolve_env(CONFIG_ENV, std::env::var_os(CONFIG_ENV), dirs::config_dir(), identifier)
+}
+
+/// `$OPENIDEA_DATA_DIR/<identifier>` when set, else the OS data directory (Tauri's `app_data_dir`).
+pub fn data_dir(identifier: &str) -> Result<PathBuf, String> {
+    resolve_env(DATA_ENV, std::env::var_os(DATA_ENV), dirs::data_dir(), identifier)
+}
+
+/// `$OPENIDEA_LOG_DIR/<identifier>` when set, else `~/Library/Logs/<identifier>` on macOS and
+/// `<local data>/<identifier>/logs` elsewhere (Tauri's `app_log_dir`).
+pub fn log_dir(identifier: &str) -> Result<PathBuf, String> {
+    let os = if cfg!(target_os = "macos") {
+        dirs::home_dir().map(|home| home.join("Library/Logs").join(identifier))
+    } else {
+        dirs::data_local_dir().map(|dir| dir.join(identifier).join("logs"))
+    };
+    match std::env::var_os(LOG_ENV).filter(|v| !v.is_empty()) {
+        Some(var) => resolve_env(LOG_ENV, Some(var), None, identifier),
+        None => os.ok_or_else(|| "cannot find the log directory".into()),
+    }
+}
+
+/// The directory under `$<env>` when set (absolute, not created here), else under the OS directory.
+fn resolve_env(env: &str, var: Option<OsString>, os: Option<PathBuf>, identifier: &str) -> Result<PathBuf, String> {
+    let Some(root) = var.filter(|v| !v.is_empty()).map(PathBuf::from) else {
+        return os.map(|dir| dir.join(identifier)).ok_or_else(|| format!("cannot find the directory {env} replaces"));
+    };
+    // The working directory depends on how the IDE was launched.
+    if !root.is_absolute() {
+        return Err(format!("{env} must be an absolute path: {}", root.display()));
+    }
+    Ok(root.join(identifier))
+}
 
 /// A custom local-data root chosen in Settings › System Settings › Caches,
 /// stored in the configuration directory. The environment variable still wins.
@@ -51,11 +94,11 @@ fn startup_resolve(
 /// The file holding the custom local-data root, if the platform exposes its
 /// configuration directory. Both startup and Settings use this one path.
 pub fn override_path(identifier: &str) -> Option<PathBuf> {
-    dirs::config_dir().map(|dir| dir.join(identifier).join(OVERRIDE_FILE))
+    config_dir(identifier).ok().map(|dir| dir.join(OVERRIDE_FILE))
 }
 
 fn migration_path(identifier: &str) -> Option<PathBuf> {
-    dirs::config_dir().map(|dir| dir.join(identifier).join(MIGRATION_FILE))
+    config_dir(identifier).ok().map(|dir| dir.join(MIGRATION_FILE))
 }
 
 /// The custom root stored by Settings, if any (validated when it is used).
@@ -493,6 +536,25 @@ fn relative_wrapper(text: &str, source: &Path) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn config_data_and_log_dirs_follow_the_os_unless_their_variable_is_set() {
+        let os = Some(PathBuf::from("/os"));
+        for env in [CONFIG_ENV, DATA_ENV, LOG_ENV] {
+            for var in [None, Some(OsString::new())] {
+                assert_eq!(resolve_env(env, var, os.clone(), "id").unwrap(), PathBuf::from("/os/id"));
+            }
+            let root = std::env::temp_dir().join("openidea-moved");
+            assert_eq!(resolve_env(env, Some(root.clone().into()), os.clone(), "id").unwrap(), root.join("id"));
+            // Release and per-worktree debug builds stay apart under one root.
+            assert_ne!(
+                resolve_env(env, Some(root.clone().into()), None, "dev-a").unwrap(),
+                resolve_env(env, Some(root.clone().into()), None, "dev-b").unwrap()
+            );
+            let error = resolve_env(env, Some("relative/dir".into()), os.clone(), "id").unwrap_err();
+            assert!(error.contains(env) && error.contains("absolute"), "{error}");
+        }
+    }
+
     #[test]
     fn local_dir_follows_the_os_unless_the_variable_is_set() {
         let os = Some(PathBuf::from("/os-local"));

crates/ide-host/src/lib.rs

@@ -3,6 +3,7 @@
 //! wraps one [`Host`] and adds windows and menus; `openidea-server`
 //! runs one on a remote machine and serves it over JSON-RPC ([`rpc`]).
 
+pub mod agent_secrets;
 pub mod data_dirs;
 pub mod environment;
 mod formatter;
@@ -60,6 +61,7 @@ pub struct Host {
     pub mcp_reports: mcp::Reports,
     pub mcp_requests: mcp::Requests,
     pub trust: trust::TrustStore,
+    pub(crate) mcp_approvals: Arc<trust::McpServerApprovals>,
     pub config_dir: PathBuf,
     /// Persistent user state, including credentials and recovery history.
     pub data_dir: PathBuf,
@@ -91,6 +93,8 @@ pub struct Host {
     proxy_password: ide_ssh::secrets::SecretFile,
     /// The proxy password when it could not be saved (no credential store).
     proxy_session_password: Mutex<Option<String>>,
+    /// Values of agents' and MCP servers' environment variables and headers (see `agent_secrets.rs`).
+    pub agent_secrets: Arc<agent_secrets::AgentSecrets>,
     pub(crate) sink_for: SinkFactory,
     owner: fn(&str) -> &str,
     pub runtime: tokio::runtime::Handle,
@@ -138,8 +142,10 @@ impl Host {
             mcp_reports: Default::default(),
             mcp_requests: Default::default(),
             trust: trust::TrustStore::load(&config_dir, &data_dir),
+            mcp_approvals: Arc::new(trust::McpServerApprovals::load(&data_dir)),
             proxy_password: ide_ssh::secrets::SecretFile::new(data_dir.join("proxy-password.json")),
             proxy_session_password: Mutex::default(),
+            agent_secrets: Arc::new(agent_secrets::AgentSecrets::new(&data_dir)),
             remote: Arc::new(ide_remote::RemoteService::new(ssh.clone(), data_dir.join("remote"))),
             ssh,
             environment: environment::Environment::new(project_environment, local_data_dir.clone()),

crates/ide-host/src/mcp/edit.rs

@@ -112,16 +112,17 @@ fn whole_range(text: &str) -> Range {
 /// Whether two paths name the same file (language servers report canonical paths; on a
 /// case-insensitive file system `a.txt` and `A.txt` are one file).
 fn same_file(a: &Path, b: &Path) -> bool {
-    if a == b || matches!((dunce::canonicalize(a), dunce::canonicalize(b)), (Ok(x), Ok(y)) if x == y) {
-        return true;
-    }
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::MetadataExt;
-        if let (Ok(x), Ok(y)) = (std::fs::metadata(a), std::fs::metadata(b)) {
-            return x.dev() == y.dev() && x.ino() == y.ino();
-        }
-    }
+    a == b || matches!((dunce::canonicalize(a), dunce::canonicalize(b)), (Ok(x), Ok(y)) if x == y) || same_inode(a, b)
+}
+
+#[cfg(unix)]
+fn same_inode(a: &Path, b: &Path) -> bool {
+    use std::os::unix::fs::MetadataExt;
+    matches!((std::fs::metadata(a), std::fs::metadata(b)), (Ok(x), Ok(y)) if x.dev() == y.dev() && x.ino() == y.ino())
+}
+
+#[cfg(not(unix))]
+fn same_inode(_: &Path, _: &Path) -> bool {
     false
 }
 

crates/ide-host/src/ops/agent.rs

@@ -381,7 +381,7 @@ fn persist_mcp_map(
     Ok(())
 }
 
-fn update_mcp_maps<F>(host: &Host, window: &str, f: F) -> IdeResult<Vec<McpServer>>
+fn update_mcp_maps<F>(host: &Host, window: &str, approve: Option<&str>, f: F) -> IdeResult<Vec<McpServer>>
 where
     F: FnOnce(&mut McpServerMap, &mut McpServerMap, Option<&std::path::Path>) -> Result<(), String>,
 {
@@ -390,43 +390,83 @@ where
     let prev_workspace = workspace.clone();
     let project_root = project.as_ref().map(|p| p.root.as_path());
     f(&mut user, &mut workspace, project_root).map_err(IdeError::invalid)?;
+    if let (Some(name), Some(p)) = (approve, &project)
+        && let Some(server) = workspace.get(name)
+    {
+        host.mcp_approvals.approve(&p.root, name, server)?;
+    }
     if workspace != prev_workspace {
         persist_mcp_map(host, project.as_ref(), McpScope::Workspace, &workspace)?;
     }
     if user != prev_user {
         persist_mcp_map(host, project.as_ref(), McpScope::User, &user)?;
     }
-    Ok(ide_agent::mcp::servers_from_settings(&user, &workspace))
+    Ok(listed(host, project.as_ref(), &user, workspace))
+}
+
+/// Workspace servers the user hasn't turned on in Settings are listed as off: agents don't start them.
+fn listed(
+    host: &Host,
+    project: Option<&std::sync::Arc<crate::Project>>,
+    user: &McpServerMap,
+    workspace: McpServerMap,
+) -> Vec<McpServer> {
+    let workspace = match project {
+        Some(p) => host.mcp_approvals.apply(&p.root, workspace),
+        None => workspace,
+    };
+    ide_agent::mcp::servers_from_settings(user, &workspace)
+}
+
+/// The MCP servers agent sessions of the project at `root` get: the user's, and the project's the
+/// user turned on.
+pub(crate) fn session_mcp_servers(
+    settings: &ide_workspace::SettingsStore,
+    approvals: &crate::trust::McpServerApprovals,
+    root: &std::path::Path,
+) -> Vec<McpServer> {
+    use ide_workspace::settings::SettingsScope;
+    let user = settings.layer(SettingsScope::Global).agents.mcp_servers;
+    let workspace = approvals.apply(root, settings.layer(SettingsScope::Project).agents.mcp_servers);
+    ide_agent::mcp::servers_from_settings(&user, &workspace)
 }
 
 /// Lists configured MCP servers across User (`settings.toml`) and Workspace (`.openidea/settings.toml`) scopes.
 pub fn mcp_list(host: &Host, window: &str) -> IdeResult<Vec<McpServer>> {
-    let (user, workspace, _) = mcp_maps(host, window);
-    Ok(ide_agent::mcp::servers_from_settings(&user, &workspace))
+    let (user, workspace, project) = mcp_maps(host, window);
+    Ok(listed(host, project.as_ref(), &user, workspace))
 }
 
-/// Creates or updates a User or Workspace MCP server and returns the updated list.
+/// Creates or updates a User or Workspace MCP server and returns the updated list. A Workspace
+/// server saved here is one the user turned on.
 pub fn mcp_save(host: &Host, window: &str, input: McpServerInput) -> IdeResult<Vec<McpServer>> {
-    update_mcp_maps(host, window, |user, workspace, project_root| {
+    let approve = (input.scope == McpScope::Workspace).then(|| input.name.trim().to_owned());
+    update_mcp_maps(host, window, approve.as_deref(), |user, workspace, project_root| {
         ide_agent::mcp::apply_save(user, workspace, project_root.is_some(), input)
     })
 }
 
 /// Enables or disables an MCP server and returns the updated list.
 pub fn mcp_set_enabled(host: &Host, window: &str, id: String, enabled: bool) -> IdeResult<Vec<McpServer>> {
-    update_mcp_maps(host, window, |user, workspace, _| {
+    let approve = ide_agent::mcp::parse_server_id(&id)
+        .filter(|(scope, _)| enabled && *scope == McpScope::Workspace)
+        .map(|(_, name)| name.to_owned());
+    update_mcp_maps(host, window, approve.as_deref(), |user, workspace, _| {
         ide_agent::mcp::apply_set_enabled(user, workspace, &id, enabled).map(|_| ())
     })
 }
 
 /// Removes a User or Workspace MCP server and returns the updated list.
 pub fn mcp_remove(host: &Host, window: &str, id: String) -> IdeResult<Vec<McpServer>> {
-    update_mcp_maps(host, window, |user, workspace, _| ide_agent::mcp::apply_remove(user, workspace, &id).map(|_| ()))
+    update_mcp_maps(host, window, None, |user, workspace, _| {
+        ide_agent::mcp::apply_remove(user, workspace, &id).map(|_| ())
+    })
 }
 
-/// Copies MCP servers from `.mcp.json` and `.vscode/mcp.json` into the workspace settings once.
+/// Copies MCP servers from `.mcp.json` and `.vscode/mcp.json` into the workspace settings once;
+/// they stay off until the user turns them on.
 pub fn mcp_import(host: &Host, window: &str) -> IdeResult<Vec<McpServer>> {
-    update_mcp_maps(host, window, |_, workspace, project_root| {
+    update_mcp_maps(host, window, None, |_, workspace, project_root| {
         let root = project_root.ok_or_else(|| "Open a project to import workspace MCP servers".to_string())?;
         ide_agent::mcp::apply_import(workspace, root);
         Ok(())
@@ -550,4 +590,43 @@ mod tests {
             assert!(validate_project_root(&root, Some(&rejected)).is_err(), "{rejected:?}");
         }
     }
+
+    #[test]
+    fn sessions_get_the_users_servers_and_the_projects_turned_on_ones() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (config, root) = (tmp.path().join("config"), tmp.path().join("project"));
+        std::fs::create_dir_all(&config).unwrap();
+        std::fs::create_dir_all(root.join(".openidea")).unwrap();
+        std::fs::write(config.join("settings.toml"), "[agents.mcpServers.shared]\ncommand = \"user-cmd\"\n").unwrap();
+        std::fs::write(
+            root.join(".openidea/settings.toml"),
+            "[agents.mcpServers.shared]\ncommand = \"project-cmd\"\n\n[agents.mcpServers.extra]\ncommand = \"extra\"\n",
+        )
+        .unwrap();
+        let settings = ide_workspace::SettingsStore::load(&config, Some(&root));
+        let approvals = crate::trust::McpServerApprovals::load(&tmp.path().join("data"));
+        let on = |servers: Vec<McpServer>| -> Vec<(McpScope, String, String)> {
+            servers
+                .into_iter()
+                .filter(|s| s.enabled)
+                .map(|s| (s.scope, s.name, s.command.unwrap_or_default()))
+                .collect()
+        };
+        assert_eq!(
+            on(session_mcp_servers(&settings, &approvals, &root)),
+            [(McpScope::User, "shared".to_owned(), "user-cmd".to_owned())]
+        );
+
+        let extra = settings.layer(ide_workspace::settings::SettingsScope::Project).agents.mcp_servers["extra"].clone();
+        approvals.approve(&root, "extra", &extra).unwrap();
+        assert!(on(session_mcp_servers(&settings, &approvals, &root)).contains(&(
+            McpScope::Workspace,
+            "extra".to_owned(),
+            "extra".to_owned()
+        )));
+        // Remembered across restarts, and only for this project.
+        let reloaded = crate::trust::McpServerApprovals::load(&tmp.path().join("data"));
+        assert!(reloaded.approved(&root, "extra", &extra));
+        assert!(!reloaded.approved(&tmp.path().join("other"), "extra", &extra));
+    }
 }

crates/ide-host/src/ops/build.rs

@@ -2,16 +2,18 @@
 //! Build › Build Project (compiling with the project's build system).
 mod workspace;
 
+use super::dependencies::{MavenCentralArtifacts, MavenCentralGroups, MavenCentralVersions};
 use crate::ops::Channel;
 use crate::rpc::Dispatcher;
 use crate::{Host, Project, apply_workspace_edit};
 
 use ide_build::compile::{self, BuildEvent, BuildKind, BuildResult};
 use ide_build::maven::PomGoto;
+use ide_build::maven::completion::{PomCompletion, PomCompletionOption};
 use ide_build::pom_edit::{ArtifactKey, Exclusion};
 use ide_build::{BuildModel, BuildTool, SyncOptions, SyncProgress};
 use ide_core::settings::Settings;
-use ide_core::{FileEdit, IdeError, IdeEvent, IdeResult, Location, Pos, Range, RequestId, WorkspaceEdit};
+use ide_core::{DocId, FileEdit, IdeError, IdeEvent, IdeResult, Location, Pos, Range, RequestId, WorkspaceEdit};
 use std::path::Path;
 
 fn join_err(e: tokio::task::JoinError) -> IdeError {
@@ -470,6 +472,89 @@ pub async fn maven_goto_declaration(host: &Host, window: &str, pom: String, pos:
     .map_err(join_err)?
 }
 
+/// How long completion waits for Maven Central before answering from the local repository.
+const CENTRAL_WAIT: std::time::Duration = std::time::Duration::from_secs(1);
+
+/// Completion of the `<dependency>` coordinate the caret (`offset`, UTF-16) sits
+/// in the value of in the POM `doc`: the coordinates installed in the local
+/// repository (Settings › Maven's, else `~/.m2/repository`) — group ids,
+/// the chosen group's artifacts, the chosen artifact's versions — topped up
+/// with Maven Central's (the search endpoint's popular coordinates, the
+/// published version metadata), which the shared version cache keeps for the
+/// session. `None` when the caret is not in a `<dependency>` coordinate element.
+pub async fn maven_dependency_completion(
+    host: &Host,
+    window: &str,
+    doc: DocId,
+    offset: u32,
+    request: RequestId,
+) -> IdeResult<Option<PomCompletion>> {
+    use ide_build::maven::completion::{PomCompletionKind, local_options};
+    let project = host.project(window)?;
+    let cache = host.dependency_versions.clone();
+    let cancel = host.begin_project_read_request(window, request);
+    let result = host
+        .blocking(move || {
+            let snap = project.documents.snapshot(doc)?;
+            if snap.large || snap.read_only || !snap.path.file_name().is_some_and(|name| name == "pom.xml") {
+                return Ok(None);
+            }
+            let Some(target) = ide_build::maven::completion::completion_target(&snap.text, offset) else {
+                return Ok(None);
+            };
+            let settings = project.settings.effective();
+            let repo = ide_sdk::apply::maven_local_repository(&project.root, &settings)
+                .or_else(ide_build::maven::default_local_repo);
+            let mut options = repo.map_or_else(Vec::new, |repo| local_options(&repo, &target));
+            // Central's answers are cached for the session (the shared version cache).
+            // The local repository answers at once: Central gets `CENTRAL_WAIT`, then the
+            // lookup finishes in the background and fills the cache for the next request.
+            // Offline, behind a proxy or rate-limited, a failed fetch never fails completion.
+            let remote = {
+                let (cache, target) = (cache.clone(), target.clone());
+                let (tx, rx) = std::sync::mpsc::channel();
+                std::thread::spawn(move || {
+                    let detached = ide_core::CancellationToken::new();
+                    let found = match target.kind {
+                        PomCompletionKind::GroupId if !target.typed.is_empty() => {
+                            cache.versions(&MavenCentralGroups, &target.typed, &detached).unwrap_or_default()
+                        }
+                        PomCompletionKind::ArtifactId => match &target.group {
+                            Some(group) => cache
+                                .versions(&MavenCentralArtifacts { group: group.clone() }, &target.typed, &detached)
+                                .unwrap_or_default(),
+                            None => Vec::new(),
+                        },
+                        PomCompletionKind::Version => match (&target.group, &target.artifact) {
+                            (Some(group), Some(artifact)) => cache
+                                .versions(&MavenCentralVersions, &format!("{group}:{artifact}"), &detached)
+                                .unwrap_or_default(),
+                            _ => Vec::new(),
+                        },
+                        _ => Vec::new(), // A group id from nothing: the search endpoint has no such query.
+                    };
+                    let _ = tx.send(found);
+                });
+                rx.recv_timeout(CENTRAL_WAIT).unwrap_or_default()
+            };
+            if cancel.is_cancelled() {
+                return Err(IdeError::cancelled());
+            }
+            let known: std::collections::HashSet<String> = options.iter().map(|o| o.label.clone()).collect();
+            options.extend(
+                remote
+                    .into_iter()
+                    .filter(|label| !known.contains(label))
+                    .map(|label| PomCompletionOption { label, detail: None }),
+            );
+            options.truncate(ide_build::maven::completion::MAX_OPTIONS);
+            Ok(Some(PomCompletion { from: target.from, to: target.to, kind: target.kind, options }))
+        })
+        .await;
+    host.end_request(request);
+    result
+}
+
 /// Adds an `<exclusion>` of `exclusion` to the declaration of the direct dependency
 /// `dependency` of the Maven module `pom`, through the open document when there is one
 /// (saved). Returns the declaration; nothing changes when it already excludes it.
@@ -711,6 +796,9 @@ pub(crate) fn register(d: &mut Dispatcher) {
     d.add("maven_goto_declaration", |c| async move {
         maven_goto_declaration(&c.host, &c.window, c.arg("pom")?, c.arg("pos")?).await
     });
+    d.add("maven_dependency_completion", |c| async move {
+        maven_dependency_completion(&c.host, &c.window, c.arg("doc")?, c.arg("offset")?, c.arg("request")?).await
+    });
     d.add("maven_exclude_dependency", |c| async move {
         maven_exclude_dependency(&c.host, &c.window, c.arg("pom")?, c.arg("dependency")?, c.arg("exclusion")?).await
     });
@@ -909,3 +997,120 @@ mod build_tool_settings_tests {
         assert_eq!(model.env["GRADLE_USER_HOME"], root.join("user-home").to_string_lossy());
     }
 }
+
+#[cfg(test)]
+mod maven_completion_tests {
+    use super::*;
+    use crate::ops::dependencies::hashed_key;
+    use ide_build::maven::completion::PomCompletionKind;
+    use ide_core::CancellationToken;
+    use ide_workspace::dependencies::DependencyVersionSource;
+    use std::sync::Arc;
+
+    /// Cache answers the test plants before completing, so the op's Central
+    /// lookups hit the session cache and the network is never reached.
+    struct FakeSource(&'static str, Vec<&'static str>);
+    impl DependencyVersionSource for FakeSource {
+        fn id(&self) -> &'static str {
+            self.0
+        }
+        fn cache_key(&self, package: &str) -> Option<String> {
+            Some(hashed_key(self.0, package))
+        }
+        fn fetch(&self, _: &str, _: &CancellationToken) -> IdeResult<Vec<String>> {
+            Ok(self.1.iter().map(|s| (*s).to_owned()).collect())
+        }
+    }
+
+    const GROUPS: &str = "maven-central-groups";
+    const ARTIFACTS: &str = "maven-central-artifacts";
+    const VERSIONS: &str = "maven-central-versions";
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn completes_dependency_coordinates_from_the_local_repository_then_central() {
+        let temp = tempfile::tempdir().unwrap();
+        let base = dunce::canonicalize(temp.path()).unwrap();
+        let (root, repo) = (base.join("project"), base.join("repository"));
+        std::fs::create_dir_all(&root).unwrap();
+        // Settings › Maven's local repository points at the fixture, so the
+        // test machine's own ~/.m2 is never read.
+        std::fs::create_dir_all(base.join("config")).unwrap();
+        std::fs::write(
+            base.join("config/settings.toml"),
+            format!("[languages.java.maven]\nlocalRepository = \"{}\"\n", repo.to_string_lossy().replace('\\', "/")),
+        )
+        .unwrap();
+        for file in [
+            "org/apache/maven/maven-core/4.0.0-rc-5/maven-core-4.0.0-rc-5.jar",
+            "org/example/lib/2.0/lib-2.0.jar",
+            "org/lib/1.0/lib-1.0.jar",
+        ] {
+            let path = repo.join(file);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(&path, b"").unwrap();
+        }
+        let text = "<project>\n  <dependencies>\n    <dependency>\n      <groupId>org</groupId>\n      <artifactId>lib</artifactId>\n      <version>1.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.example</groupId>\n      <artifactId></artifactId>\n    </dependency>\n    <dependency>\n      <groupId>org.example</groupId>\n      <artifactId>lib</artifactId>\n      <version></version>\n    </dependency>\n  </dependencies>\n</project>\n";
+        let path = root.join("pom.xml");
+        std::fs::write(&path, text).unwrap();
+
+        let host = Host::new(crate::HostConfig {
+            config_dir: base.join("config"),
+            data_dir: base.join("data"),
+            local_data_dir: base.join("local"),
+            languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+            syntax: Arc::default(),
+            sink_for: Box::new(|_| Arc::new(|_| {})),
+            owner: |w| w,
+            runtime: tokio::runtime::Handle::current(),
+            project_environment: false,
+        });
+        let project = host.open_project("main", &root).unwrap();
+        let info = project.documents.open(&path).unwrap();
+
+        let token = CancellationToken::new();
+        host.dependency_versions.versions(&FakeSource(GROUPS, vec!["org.zzz"]), "org", &token).unwrap();
+        host.dependency_versions.versions(&FakeSource(ARTIFACTS, vec!["api"]), "org.example\u{1}", &token).unwrap();
+        host.dependency_versions.versions(&FakeSource(VERSIONS, vec!["9.9"]), "org.example:lib", &token).unwrap();
+
+        let at = |needle: &str| (text.find(needle).unwrap() + needle.len()) as u32;
+        let next = std::sync::atomic::AtomicU32::new(500);
+        let complete = |offset: u32| {
+            maven_dependency_completion(
+                &host,
+                "main",
+                info.id,
+                offset,
+                RequestId(next.fetch_add(1, std::sync::atomic::Ordering::Relaxed)),
+            )
+        };
+        fn labels(c: &PomCompletion) -> Vec<&str> {
+            c.options.iter().map(|o| o.label.as_str()).collect()
+        }
+
+        let group =
+            complete(text.find("<groupId>org").unwrap() as u32 + "<groupId>org".len() as u32).await.unwrap().unwrap();
+        assert_eq!(group.kind, PomCompletionKind::GroupId);
+        // The installed groups first, Central's cached suggestions behind them.
+        assert_eq!(labels(&group), ["org", "org.apache.maven", "org.example", "org.zzz"]);
+        // Nothing outside a dependency's coordinates.
+        let outside = complete(at("<dependencies>")).await;
+        assert!(matches!(outside, Ok(None)), "{outside:?}");
+
+        let empty_artifact = text.find("<artifactId></artifactId>").unwrap() as u32 + "<artifactId>".len() as u32;
+        let artifact = complete(empty_artifact).await;
+        let artifact = match artifact {
+            Ok(Some(a)) => a,
+            other => panic!("artifact completion: {other:?}"),
+        };
+        assert_eq!(artifact.kind, PomCompletionKind::ArtifactId);
+        let installed = artifact.options.first().unwrap();
+        assert_eq!((installed.label.as_str(), installed.detail.as_deref()), ("lib", Some("2.0")));
+        assert_eq!(labels(&artifact), ["lib", "api"]);
+
+        let empty_version = text.find("<version></version>").unwrap() as u32 + "<version>".len() as u32;
+        let version = complete(empty_version).await.unwrap().unwrap();
+        assert_eq!(version.kind, PomCompletionKind::Version);
+        assert_eq!(labels(&version), ["2.0", "9.9"]);
+        host.close_project("main");
+    }
+}

crates/ide-host/src/ops/dependencies.rs

@@ -1,7 +1,7 @@
 //! Repository version lookups for manifest inspections and completion.
 use crate::{Host, rpc::Dispatcher};
 use ide_core::{CancellationToken, DocId, IdeError, IdeResult, RequestId};
-use ide_workspace::dependencies::{DependencyVersionSource, DependencyVersions, cargo, go, npm};
+use ide_workspace::dependencies::{DependencyVersionSource, DependencyVersions, cargo, go, maven, npm};
 use std::collections::BTreeMap;
 use std::hash::{DefaultHasher, Hash, Hasher};
 use std::path::{Path, PathBuf};
@@ -25,6 +25,79 @@ impl DependencyVersionSource for CratesIo {
     }
 }
 
+/// A cache key for a `package` that is not a filesystem-safe name (a Maven
+/// coordinate with dots, a query): hashed under the source's id.
+pub(crate) fn hashed_key(id: &str, package: &str) -> String {
+    let mut hash = DefaultHasher::new();
+    package.hash(&mut hash);
+    format!("{id}-{:016x}", hash.finish())
+}
+
+/// Maven Central's group-id suggestions: the search endpoint's groups matching
+/// a typed prefix, most recently updated first.
+pub(crate) struct MavenCentralGroups;
+impl DependencyVersionSource for MavenCentralGroups {
+    fn id(&self) -> &'static str {
+        "maven-central-groups"
+    }
+
+    fn cache_key(&self, prefix: &str) -> Option<String> {
+        Some(hashed_key(self.id(), prefix))
+    }
+
+    fn fetch(&self, prefix: &str, cancel: &CancellationToken) -> IdeResult<Vec<String>> {
+        let url = maven::groups_url(prefix).ok_or_else(|| IdeError::internal("invalid group prefix"))?;
+        let search_path = std::env::var_os("PATH").unwrap_or_default();
+        let text =
+            ide_tools::Http::new(&search_path)?.https_only().get_text_limited(&url, Some(1024 * 1024), cancel)?;
+        maven::parse_search_groups(&text).ok_or_else(|| IdeError::internal("invalid search response"))
+    }
+}
+
+/// The artifacts of one group matching a typed prefix, from the same endpoint.
+pub(crate) struct MavenCentralArtifacts {
+    pub group: String,
+}
+impl DependencyVersionSource for MavenCentralArtifacts {
+    fn id(&self) -> &'static str {
+        "maven-central-artifacts"
+    }
+
+    fn cache_key(&self, prefix: &str) -> Option<String> {
+        Some(hashed_key(self.id(), &format!("{}\u{1}{prefix}", self.group)))
+    }
+
+    fn fetch(&self, prefix: &str, cancel: &CancellationToken) -> IdeResult<Vec<String>> {
+        let url =
+            maven::artifacts_url(&self.group, prefix).ok_or_else(|| IdeError::internal("invalid artifact prefix"))?;
+        let search_path = std::env::var_os("PATH").unwrap_or_default();
+        let text =
+            ide_tools::Http::new(&search_path)?.https_only().get_text_limited(&url, Some(1024 * 1024), cancel)?;
+        maven::parse_search_artifacts(&text).ok_or_else(|| IdeError::internal("invalid search response"))
+    }
+}
+
+/// Every version published of one `group:artifact` on Central, newest first.
+pub(crate) struct MavenCentralVersions;
+impl DependencyVersionSource for MavenCentralVersions {
+    fn id(&self) -> &'static str {
+        "maven-central-versions"
+    }
+
+    fn cache_key(&self, coordinates: &str) -> Option<String> {
+        Some(hashed_key(self.id(), coordinates))
+    }
+
+    fn fetch(&self, coordinates: &str, cancel: &CancellationToken) -> IdeResult<Vec<String>> {
+        let (group, artifact) = coordinates.split_once(':').ok_or_else(|| IdeError::internal("invalid coordinates"))?;
+        let url = maven::metadata_url(group, artifact).ok_or_else(|| IdeError::internal("invalid coordinates"))?;
+        let search_path = std::env::var_os("PATH").unwrap_or_default();
+        let text =
+            ide_tools::Http::new(&search_path)?.https_only().get_text_limited(&url, Some(2 * 1024 * 1024), cancel)?;
+        Ok(maven::parse_metadata_versions(&text))
+    }
+}
+
 struct NpmRegistry;
 impl DependencyVersionSource for NpmRegistry {
     fn id(&self) -> &'static str {

crates/ide-host/src/ops/java.rs

@@ -48,7 +48,7 @@ async fn resolve_launch(
     let build = policy != BuildPolicy::NoBuild;
     let full = policy == BuildPolicy::Rebuild;
     let build_kind = if full { compile::BuildKind::Rebuild } else { compile::BuildKind::Build };
-    let (model, external, delegated, prefer_maven) = {
+    let (model, external, mut delegated, prefer_maven, is_maven) = {
         let project = project.clone();
         let settings = settings.clone();
         let module = module.clone();
@@ -68,13 +68,29 @@ async fn resolve_launch(
                     prefer_maven,
                 );
             let external = non_java || delegated;
-            (model, external, delegated, prefer_maven)
+            (model, external, delegated, prefer_maven, is_maven)
         })
         .await
         .map_err(|e| IdeError::internal(e.to_string()))?
     };
-    let external_build = if delegated { Some(project.lsp.java_external_build(&module, cancel).await?) } else { None };
+    let mut external_build =
+        if delegated { Some(project.lsp.java_external_build(&module, cancel).await?) } else { None };
     let mut info = project.lsp.java_launch(&module, test, build && !delegated, full, delegated, cancel).await?;
+    if info.errors.iter().any(|e| processor_recreated_a_file(&e.message)) {
+        if build && !delegated && is_maven {
+            // JDT runs an annotation processor again over sources it generated in the same build
+            // (MapStruct over MapStruct-Plus's mappers) and fails on the file it already wrote;
+            // javac doesn't, so Maven builds the module.
+            tracing::info!("Annotation processing failed in JDT; building with Maven");
+            delegated = true;
+            external_build = Some(project.lsp.java_external_build(&module, cancel).await?);
+            info = project.lsp.java_launch(&module, test, false, false, true, cancel).await?;
+        }
+        if delegated {
+            // Maven runs the annotation processors itself; JDT's failure to rerun one is no compile error.
+            drop_processor_recreate_errors(&mut info);
+        }
+    }
     let lsp_ms = started.elapsed().as_millis();
     let data_dir = host.local_data_dir.clone();
     let cancel = cancel.clone();
@@ -338,10 +354,60 @@ pub(crate) fn register(d: &mut Dispatcher) {
     });
 }
 
+/// An annotation processor's error for writing a file this build already wrote (JDT's
+/// `IdeFilerImpl`: "Source file already created", javac's Filer: "Attempt to recreate a file").
+fn processor_recreated_a_file(message: &str) -> bool {
+    message.contains("FilerException")
+        && (message.contains("Source file already created") || message.contains("Attempt to recreate a file"))
+}
+
+fn drop_processor_recreate_errors(info: &mut JavaLaunchInfo) {
+    let before = info.errors.len();
+    info.errors.retain(|e| !processor_recreated_a_file(&e.message));
+    info.error_count = info.error_count.saturating_sub((before - info.errors.len()) as u32);
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn recognises_a_processor_recreating_its_output() {
+        assert!(processor_recreated_a_file(
+            "Internal error in the mapping processor: java.lang.RuntimeException: \
+             javax.annotation.processing.FilerException: Source file already created: /m/target/generated-sources/annotations/a/AMapper__4Impl.java"
+        ));
+        assert!(processor_recreated_a_file(
+            "javax.annotation.processing.FilerException: Attempt to recreate a file for type a.B"
+        ));
+        assert!(!processor_recreated_a_file("Source file already created"));
+        assert!(!processor_recreated_a_file("cannot find symbol"));
+    }
+
+    #[test]
+    fn a_delegated_launch_ignores_jdt_processor_recreate_errors() {
+        let error = |message: &str| ide_lsp::jdtls::JavaCompileError {
+            path: "src/main/java/a/A.java".into(),
+            line: 1,
+            column: 1,
+            message: message.into(),
+        };
+        let mut info = JavaLaunchInfo {
+            error_count: 2,
+            errors: vec![
+                error(
+                    "javax.annotation.processing.FilerException: Source file already created: /m/AMapper__1Impl.java",
+                ),
+                error("cannot find symbol"),
+            ],
+            ..Default::default()
+        };
+        drop_processor_recreate_errors(&mut info);
+        assert_eq!(info.error_count, 1);
+        assert_eq!(info.errors.len(), 1);
+        assert_eq!(info.errors[0].message, "cannot find symbol");
+    }
+
     #[test]
     fn delegated_launches_with_jdt_errors_recompile_with_maven() {
         assert_eq!(delegated_policy(BuildPolicy::Make, true, 1), BuildPolicy::Rebuild);

crates/ide-host/src/ops/sdk.rs

@@ -7,6 +7,8 @@ use ide_core::{IdeError, IdeResult, RequestId};
 use ide_sdk::python::PythonPackage;
 use ide_sdk::{Sdk, SdkKind};
 use std::path::PathBuf;
+use std::sync::Mutex;
+use std::sync::atomic::{AtomicUsize, Ordering};
 
 fn join_err(e: impl std::fmt::Display) -> IdeError {
     IdeError::internal(e.to_string())
@@ -20,6 +22,14 @@ pub struct LocatedTools {
     pub compile_dir: ide_core::IpcPath,
 }
 
+/// An interpreter another project uses: the project root and the SDK itself.
+#[derive(Clone, Debug, serde::Serialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct ProjectInterpreter {
+    pub project: ide_core::IpcPath,
+    pub sdk: Sdk,
+}
+
 /// Installed interpreters / toolchains of `kind`; project-local ones first.
 pub async fn sdk_detect(host: &Host, window: &str, kind: SdkKind) -> IdeResult<Vec<Sdk>> {
     host.require_trust(window)?;
@@ -45,6 +55,50 @@ pub async fn sdk_detect(host: &Host, window: &str, kind: SdkKind) -> IdeResult<V
     .map_err(join_err)
 }
 
+/// The Python interpreters of the projects opened recently (newest first), each with the
+/// project it belongs to. The open project is skipped: [`sdk_detect`] lists its own.
+pub async fn sdk_python_project_interpreters(host: &Host, window: &str) -> IdeResult<Vec<ProjectInterpreter>> {
+    host.require_trust(window)?;
+    let current = host.project(window).ok().map(|p| p.root.clone());
+    let config = host.config_dir.clone();
+    tokio::task::spawn_blocking(move || {
+        let roots: Vec<PathBuf> = ide_workspace::RecentProjects::load(&config)
+            .list()
+            .into_iter()
+            .map(|p| p.path.into_path_buf())
+            .filter(|root| current.as_deref() != Some(root.as_path()))
+            .collect();
+        // Each project resolves its configured interpreter, else its own virtualenv. The
+        // probes run `python`, so keep them off the async runtime and bound how many run at
+        // once: the recent list can hold ~30 projects, and each probe starts a process.
+        const PROBES: usize = 4;
+        let results = Mutex::new(Vec::with_capacity(roots.len()));
+        let next = AtomicUsize::new(0);
+        std::thread::scope(|scope| {
+            for _ in 0..roots.len().min(PROBES) {
+                scope.spawn(|| {
+                    loop {
+                        let index = next.fetch_add(1, Ordering::Relaxed);
+                        let Some(root) = roots.get(index) else { break };
+                        let settings = ide_workspace::SettingsStore::load(&config, Some(root)).effective();
+                        let Some(python) = ide_sdk::apply::python_interpreter(root, &settings) else { continue };
+                        let Some(sdk) = ide_sdk::python_interpreter_sdk(&python, Some(root)) else { continue };
+                        results
+                            .lock()
+                            .unwrap()
+                            .push((index, ProjectInterpreter { project: root.as_path().into(), sdk }));
+                    }
+                });
+            }
+        });
+        let mut found = results.into_inner().unwrap();
+        found.sort_by_key(|(index, _)| *index);
+        found.into_iter().map(|(_, interpreter)| interpreter).collect()
+    })
+    .await
+    .map_err(join_err)
+}
+
 /// An existing Python executable or virtualenv folder as an SDK; `None` if Python cannot run.
 pub async fn sdk_python_interpreter(host: &Host, window: &str, path: PathBuf) -> IdeResult<Option<Sdk>> {
     host.require_trust(window)?;
@@ -310,6 +364,10 @@ pub async fn sdk_python_pip(
 /// Commands of this module the remote server answers.
 pub(crate) fn register(d: &mut Dispatcher) {
     d.add("sdk_detect", |c| async move { sdk_detect(&c.host, &c.window, c.arg("kind")?).await });
+    d.add(
+        "sdk_python_project_interpreters",
+        |c| async move { sdk_python_project_interpreters(&c.host, &c.window).await },
+    );
     d.add(
         "sdk_python_interpreter",
         |c| async move { sdk_python_interpreter(&c.host, &c.window, c.arg("path")?).await },
@@ -425,4 +483,49 @@ mod tests {
         assert!(sdk_python_interpreter(&host, "main", root.join("README.md")).await.unwrap().is_none());
         host.close_project("main");
     }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn another_projects_interpreter_is_listed_with_its_project() {
+        let temp = tempfile::tempdir().unwrap();
+        let base = dunce::canonicalize(temp.path()).unwrap();
+        let root = base.join("project");
+        let other = base.join("shop");
+        std::fs::create_dir_all(other.join(".openidea")).unwrap();
+        std::fs::create_dir_all(&root).unwrap();
+        let python = fake_venv(&other, ".venv");
+        std::fs::write(
+            other.join(".openidea/settings.toml"),
+            "[languages.python]\ninterpreter = \".venv/bin/python\"\n",
+        )
+        .unwrap();
+        // The projects the user opened before this one.
+        let config = base.join("config");
+        std::fs::create_dir_all(&config).unwrap();
+        let recent = serde_json::json!([
+            { "path": other.to_str().unwrap(), "name": "shop", "openedAtMs": 2.0, "branch": null },
+            { "path": root.to_str().unwrap(), "name": "project", "openedAtMs": 1.0, "branch": null },
+        ]);
+        std::fs::write(config.join("recent.json"), serde_json::to_vec(&recent).unwrap()).unwrap();
+
+        let host = Host::new(HostConfig {
+            config_dir: config,
+            data_dir: base.join("data"),
+            local_data_dir: base.join("local"),
+            languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+            syntax: Arc::default(),
+            sink_for: Box::new(|_| Arc::new(|_| {})),
+            owner: |w| w,
+            runtime: tokio::runtime::Handle::current(),
+            project_environment: false,
+        });
+        host.trust.decide(&root, true, false).unwrap();
+        host.open_project("main", &root).unwrap();
+
+        let list = sdk_python_project_interpreters(&host, "main").await.unwrap();
+        assert_eq!(list.len(), 1, "{list:?}");
+        assert_eq!(&*list[0].project, other.as_path());
+        assert_eq!(&*list[0].sdk.path, python.as_path());
+        assert_eq!(list[0].sdk.name, "Python 3.12 (shop)");
+        host.close_project("main");
+    }
 }

crates/ide-host/src/plugins/api.rs

@@ -179,7 +179,7 @@ impl SecretStore for FileSecretStore {
 }
 
 /// Largest response body a plugin receives.
-const MAX_RESPONSE: usize = 8 << 20;
+const MAX_RESPONSE: usize = 16 << 20;
 /// Largest stdout / stderr kept from a process.
 const MAX_OUTPUT: usize = 16 << 20;
 /// Most processes one plugin keeps running at once.
@@ -2267,7 +2267,7 @@ impl HostApi for PluginApi {
                 let mut response = response;
                 while let Some(chunk) = response.chunk().await.map_err(|e| HostError::Failed(e.to_string()))? {
                     if body.len() + chunk.len() > MAX_RESPONSE {
-                        return Err(HostError::Failed("response larger than 8 MiB".into()));
+                        return Err(HostError::Failed(format!("response larger than {} MiB", MAX_RESPONSE >> 20)));
                     }
                     body.extend_from_slice(&chunk);
                 }
@@ -3949,6 +3949,72 @@ mod tests {
         worker.join().unwrap();
     }
 
+    #[test]
+    fn fetch_accepts_responses_up_to_16_mib_and_rejects_larger_bodies() {
+        fn serve_bytes(total: usize) -> (u16, std::thread::JoinHandle<()>) {
+            let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+            let port = listener.local_addr().unwrap().port();
+            let handle = std::thread::spawn(move || {
+                use std::io::{Read, Write};
+                let (mut stream, _) = listener.accept().unwrap();
+                let mut buf = [0; 4096];
+                let _ = stream.read(&mut buf);
+                let header = format!("HTTP/1.1 200 OK\r\nContent-Length: {total}\r\nConnection: close\r\n\r\n");
+                if stream.write_all(header.as_bytes()).is_err() {
+                    return;
+                }
+                let chunk = [b'x'; 64 << 10];
+                let mut sent = 0;
+                while sent < total {
+                    let n = (total - sent).min(chunk.len());
+                    if stream.write_all(&chunk[..n]).is_err() {
+                        break;
+                    }
+                    sent += n;
+                }
+            });
+            (port, handle)
+        }
+
+        let dir = tempfile::tempdir().unwrap();
+        let api = api(dir.path(), Arc::default());
+
+        let (ok_port, ok_worker) = serve_bytes(10 << 20);
+        let resp = api
+            .fetch(
+                HttpRequest {
+                    method: "GET".into(),
+                    url: format!("http://127.0.0.1:{ok_port}/"),
+                    headers: Vec::new(),
+                    body: None,
+                    timeout: Duration::from_secs(10),
+                    grants: vec![Capability::Net("127.0.0.1".into())],
+                },
+                &CancellationToken::new(),
+            )
+            .expect("10 MiB response within 16 MiB limit succeeds");
+        assert_eq!(resp.status, 200);
+        assert_eq!(resp.body.len(), 10 << 20);
+        ok_worker.join().unwrap();
+
+        let (big_port, big_worker) = serve_bytes(MAX_RESPONSE + (1 << 20));
+        let err = api
+            .fetch(
+                HttpRequest {
+                    method: "GET".into(),
+                    url: format!("http://127.0.0.1:{big_port}/"),
+                    headers: Vec::new(),
+                    body: None,
+                    timeout: Duration::from_secs(10),
+                    grants: vec![Capability::Net("127.0.0.1".into())],
+                },
+                &CancellationToken::new(),
+            )
+            .expect_err("response exceeding 16 MiB fails explicitly");
+        assert!(matches!(&err, HostError::Failed(msg) if msg.contains("response larger than 16 MiB")), "{err:?}");
+        big_worker.join().unwrap();
+    }
+
     #[test]
     fn output_ring_keeps_utf8_and_is_withdrawn_on_stop() {
         let dir = tempfile::tempdir().unwrap();

crates/ide-host/src/plugins/remote_host.rs

@@ -47,6 +47,48 @@ pub const SECRET_REQUEST: &str = "plugin_secret";
 pub const SECRET_WRITE: &str = "plugin_secret_write";
 /// OAuth listeners bound on the desktop, never the project server.
 pub const AUTH_REQUEST: &str = "plugin_auth";
+/// What [`RemotePlugins::register`] adds to a server's commands.
+pub const COMMANDS: &[&str] = &[
+    SYNC_PACKAGES,
+    "plugin_run_command",
+    "plugin_set_ui_locale",
+    "plugin_select_tests",
+    "plugin_parse_test_results",
+    "plugin_terminal_session_close",
+    "plugin_terminal_session_spawn",
+    "plugin_prepare_debug_run",
+    "plugin_finish_operation",
+    "plugin_content_tab_action",
+    "plugin_post_events",
+    "plugin_event_kinds",
+    "plugin_status_items",
+    "plugin_context_keys",
+    "plugin_cancel_task",
+    "plugin_answer_prompt",
+    "plugin_choose_program",
+    "plugin_program",
+    "plugin_answer_command",
+    "plugin_answer_commit",
+    "plugin_commit_checks",
+    "mcp_set_open_editors",
+    "mcp_set_focused_editor",
+    "mcp_report_problems",
+    "plugin_decoration_sets",
+    "plugin_set_active_file",
+    "plugin_view_render",
+    "plugin_view_event",
+    "plugin_service_detail",
+    "plugin_service_log",
+    "plugin_navigation_files",
+    "plugin_navigation_invalidate",
+    "plugin_navigation_index",
+    "plugin_navigation_goto",
+    "plugin_navigation_markers",
+    "plugin_endpoints",
+    "plugin_run_targets",
+    "plugin_answer_run_target",
+    "plugin_line_markers",
+];
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct SecretWrite {
@@ -134,8 +176,13 @@ pub fn package_digest(dir: &Path, files: &[PathBuf]) -> IdeResult<String> {
 }
 
 /// Whether a plugin event means something to a remote window (the desktop
-/// owns the plugin list, themes and consent).
+/// owns the plugin list, themes and consent). The desktop checks it again on
+/// arrival: a server may send anything, and only what acts on the remote project
+/// passes. A command may only be another plugin command, which runs on the server.
 pub fn forwarded(event: &PluginEvent) -> bool {
+    if let PluginEvent::ExecuteCommand { id, .. } = event {
+        return plugin_command(id);
+    }
     matches!(
         event,
         PluginEvent::RunTargetsChanged
@@ -147,7 +194,6 @@ pub fn forwarded(event: &PluginEvent) -> bool {
             | PluginEvent::Notification { .. }
             | PluginEvent::StatusItemChanged { .. }
             | PluginEvent::WindowStatusItemChanged { .. }
-            | PluginEvent::ExecuteCommand { .. }
             | PluginEvent::OutputChanged { .. }
             | PluginEvent::RevealOutput { .. }
             | PluginEvent::ContextChanged { .. }
@@ -163,7 +209,6 @@ pub fn forwarded(event: &PluginEvent) -> bool {
             | PluginEvent::OpenLogTab { .. }
             | PluginEvent::CopyToClipboard { .. }
             | PluginEvent::OpenUrl { .. }
-            | PluginEvent::OpenProject { .. }
             | PluginEvent::PromptRequested { .. }
             | PluginEvent::PromptClosed { .. }
             | PluginEvent::PromptWaiting { .. }
@@ -173,6 +218,13 @@ pub fn forwarded(event: &PluginEvent) -> bool {
     )
 }
 
+/// `plugin.<plugin id>.<command id>`, as the workbench names plugin commands.
+fn plugin_command(id: &str) -> bool {
+    id.strip_prefix("plugin.")
+        .and_then(|rest| rest.split_once('.'))
+        .is_some_and(|(plugin, command)| !plugin.is_empty() && !command.is_empty() && !command.ends_with('.'))
+}
+
 // ---- desktop side -----------------------------------------------------------
 
 impl PluginHost {
@@ -951,4 +1003,43 @@ mod tests {
         assert!(valid_id("ai-completion"));
         assert!(!valid_id("../x") && !valid_id(".data") && !valid_id(""));
     }
+
+    fn execute(id: &str) -> PluginEvent {
+        PluginEvent::ExecuteCommand {
+            request_id: "1".into(),
+            id: id.into(),
+            arg: Some(r"\\host.example\share\pkg".into()),
+            chain: vec!["tools".into()],
+        }
+    }
+
+    #[test]
+    fn a_server_runs_only_plugin_commands_in_the_desktop_window() {
+        assert!(forwarded(&execute("plugin.tools.build")));
+        assert!(forwarded(&execute("plugin.acme.tools.build.all")));
+        for id in [
+            "plugins.installFromDisk",
+            "project.revokeTrust",
+            "project.removeTrustedLocation",
+            "ssh.startSession",
+            "file.openProjectPath",
+            "terminal.runCommand",
+            "plugin.",
+            "plugin.tools",
+            "plugin..build",
+            "plugin.tools.",
+        ] {
+            assert!(!forwarded(&execute(id)), "{id}");
+        }
+    }
+
+    #[test]
+    fn a_server_does_not_open_desktop_folders() {
+        let open = PluginEvent::OpenProject {
+            plugin_id: "tools".into(),
+            path: r"\\host.example\share\project".into(),
+            new_window: true,
+        };
+        assert!(!forwarded(&open));
+    }
 }

crates/ide-host/src/project.rs

@@ -541,7 +541,7 @@ impl Host {
         mark("git");
         tracing::info!("opened {} in window {window} in {} ms {laps:?}", root.display(), started.elapsed().as_millis());
 
-        let (db, http_history, agents) = self.project_services(&root, &project_key, &settings);
+        let (db, http_history, agents) = self.project_services(&root, &project_key, &settings, &sink);
         let db_sources_watch = db_sources_watch(&db, &sink, &self.runtime);
         let notebooks = crate::notebook::NotebookService::new(
             self.local_data_dir.join("notebook-runtime").join(uuid::Uuid::new_v4().to_string()),
@@ -634,6 +634,7 @@ impl Host {
         root: &Path,
         project_key: &str,
         settings: &Arc<SettingsStore>,
+        sink: &SharedSink,
     ) -> (Arc<ide_db::DbManager>, Arc<ide_http::History>, Arc<ide_agent::AgentManager>) {
         let db = Arc::new(
             ide_db::DbManager::new(
@@ -660,12 +661,23 @@ impl Host {
                 models_file: self.data_dir.join("agents").join("models.json"),
                 custom_agents_dir: Some(self.config_dir.join("agents")),
                 home_dir: dirs::home_dir(),
+                env_secrets: Some(Arc::new(AgentEnvSecrets {
+                    secrets: self.agent_secrets.clone(),
+                    sink: sink.clone(),
+                    told: AtomicBool::new(false),
+                })),
             },
             self.runtime.clone(),
         ));
         let settings = settings.clone();
+        {
+            let settings = settings.clone();
+            agents.set_new_task_approvals_hook(Arc::new(move || settings.effective().agents.new_task_approvals));
+        }
+        let approvals = self.mcp_approvals.clone();
+        let root = root.to_path_buf();
         agents.set_mcp_servers_hook(Box::new(move || {
-            ide_agent::mcp::servers_from_settings(&Default::default(), &settings.effective().agents.mcp_servers)
+            crate::ops::agent::session_mcp_servers(&settings, &approvals, &root)
         }));
         (db, http_history, agents)
     }
@@ -708,7 +720,7 @@ impl Host {
         documents.add_observer(Arc::new(HistoryObserver(history.clone())));
         let watcher = light_watcher(&dir, &sink, &documents, &history)?;
         let project_key = project_key(&dir);
-        let (db, http_history, agents) = self.project_services(&dir, &project_key, &settings);
+        let (db, http_history, agents) = self.project_services(&dir, &project_key, &settings, &sink);
         let notebooks = crate::notebook::NotebookService::new(
             self.local_data_dir.join("notebook-runtime").join(uuid::Uuid::new_v4().to_string()),
             sink.clone(),
@@ -1586,6 +1598,37 @@ pub(crate) fn project_key(root: &Path) -> String {
     format!("{h:016x}")
 }
 
+/// The environment values of agent files in [`crate::agent_secrets::AgentSecrets`]; the
+/// window is told (once) when they had to go to the owner-only file instead.
+struct AgentEnvSecrets {
+    secrets: Arc<crate::agent_secrets::AgentSecrets>,
+    sink: SharedSink,
+    told: AtomicBool,
+}
+
+impl ide_agent::EnvSecrets for AgentEnvSecrets {
+    fn get(&self, key: &str) -> Option<String> {
+        self.secrets.get(key)
+    }
+
+    fn set(&self, key: &str, value: &str) -> IdeResult<()> {
+        if self.secrets.set(key, value)? == crate::agent_secrets::Kept::LocalFile
+            && !self.told.swap(true, Ordering::Relaxed)
+        {
+            self.secrets.notify_kept_locally(&self.sink);
+        }
+        Ok(())
+    }
+
+    fn delete(&self, key: &str) {
+        self.secrets.delete(key);
+    }
+
+    fn keys(&self, prefix: &str) -> Vec<String> {
+        self.secrets.keys(prefix)
+    }
+}
+
 struct LspObserver(Arc<LspManager>);
 
 impl DocumentObserver for LspObserver {

crates/ide-host/src/rpc.rs

@@ -298,6 +298,56 @@ pub fn event_sink(peer: Arc<OnceLock<Peer>>, window: Option<String>) -> ide_core
     Arc::new(PeerSink { peer, window })
 }
 
+/// Whether a desktop shows an `event` notification of its server in the window. A server reports
+/// on its project; what this machine answers or owns itself (MCP approvals, app updates, window
+/// groups) never comes from it.
+pub fn client_accepts(event: &IdeEvent) -> bool {
+    match event {
+        IdeEvent::McpRequest { .. }
+        | IdeEvent::McpRequestClosed { .. }
+        | IdeEvent::WindowGroupsChanged
+        | IdeEvent::WindowFullscreenChanged
+        | IdeEvent::UpdateStatusChanged { .. }
+        | IdeEvent::UpdateAvailable { .. } => false,
+        IdeEvent::DbSourcesChanged
+        | IdeEvent::ProjectTrustChanged { .. }
+        | IdeEvent::FsChanged { .. }
+        | IdeEvent::ExcludedDirsChanged { .. }
+        | IdeEvent::DocPatched { .. }
+        | IdeEvent::DocDirty { .. }
+        | IdeEvent::WorkspaceEditApplied { .. }
+        | IdeEvent::DocLanguage { .. }
+        | IdeEvent::Diagnostics { .. }
+        | IdeEvent::Task { .. }
+        | IdeEvent::IndexState { .. }
+        | IdeEvent::VcsChanged { .. }
+        | IdeEvent::LanguageServer { .. }
+        | IdeEvent::LanguageServerWarning { .. }
+        | IdeEvent::LanguageServerRemoved { .. }
+        | IdeEvent::LspRefresh { .. }
+        | IdeEvent::TerminalExited { .. }
+        | IdeEvent::RunExited { .. }
+        | IdeEvent::Debug { .. }
+        | IdeEvent::Notify { .. }
+        | IdeEvent::SettingsChanged { .. }
+        | IdeEvent::ProjectRootsChanged { .. }
+        | IdeEvent::Askpass { .. }
+        | IdeEvent::AskpassDone { .. }
+        | IdeEvent::NotebookKernel { .. } => true,
+    }
+}
+
+/// The commands a desktop routes to its server: what `openidea-server` of this build answers,
+/// fixed here rather than taken from the server, so a server cannot move a command to this machine.
+pub fn client_commands() -> Vec<&'static str> {
+    let mut out = Dispatcher::standard().commands();
+    out.extend(crate::plugins::remote_host::COMMANDS);
+    out.push(crate::plugins::remote::SYNC_COMMAND);
+    out.sort_unstable();
+    out.dedup();
+    out
+}
+
 struct PeerSink {
     peer: Arc<OnceLock<Peer>>,
     window: Option<String>,
@@ -364,3 +414,56 @@ pub fn error_from_reply(e: ide_jsonrpc::RpcError) -> IdeError {
         other => other.into(),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ide_core::event::{AskpassKind, McpUiRequest, NotifyLevel};
+
+    #[test]
+    fn a_server_cannot_raise_desktop_prompts() {
+        let confirm = McpUiRequest::Confirm {
+            client: "agent".into(),
+            tool: "run".into(),
+            subject: "rm -rf".into(),
+            project: "/srv/app".into(),
+            detail: None,
+        };
+        let update = ide_core::updates::UpdateInfo {
+            version: "9.9.9".into(),
+            current_version: "0.1.0".into(),
+            notes: None,
+            date: None,
+        };
+        for event in [
+            IdeEvent::McpRequest { id: 1, request: confirm },
+            IdeEvent::McpRequestClosed { id: 1 },
+            IdeEvent::UpdateAvailable { update },
+            IdeEvent::UpdateStatusChanged {
+                status: ide_core::updates::UpdateStatus { last_checked: None, checking: true },
+            },
+            IdeEvent::WindowGroupsChanged,
+            IdeEvent::WindowFullscreenChanged,
+        ] {
+            assert!(!client_accepts(&event), "{event:?}");
+        }
+    }
+
+    #[test]
+    fn a_server_reports_its_project_to_the_desktop() {
+        for event in [
+            IdeEvent::FsChanged {
+                created: vec!["/srv/app/a".into()],
+                modified: vec![],
+                removed: vec![],
+                ignore_rules: vec![],
+            },
+            IdeEvent::VcsChanged { root: "/srv/app".into() },
+            IdeEvent::Notify { level: NotifyLevel::Info, title: "Build".into(), body: None },
+            IdeEvent::Askpass { id: 1, prompt: "Password".into(), kind: AskpassKind::Secret, remember: false },
+            IdeEvent::ProjectTrustChanged { root: "/srv/app".into(), trusted: true },
+        ] {
+            assert!(client_accepts(&event), "{event:?}");
+        }
+    }
+}

crates/ide-host/src/trust.rs

@@ -18,6 +18,15 @@ pub struct TrustStore {
     state: Mutex<IdeResult<TrustDecisions>>,
     /// Folders trusted for this process only, by the client that started it ([`TRUSTED_ROOT_ENV`]).
     inherited: Mutex<Vec<PathBuf>>,
+    remote_file: PathBuf,
+    remote: Mutex<IdeResult<RemoteDecisions>>,
+}
+
+/// This machine's decisions about remote projects, by location (see [`TrustStore::remote_decision`]).
+#[derive(Clone, Default, Serialize, Deserialize)]
+struct RemoteDecisions {
+    trusted: Vec<String>,
+    restricted: Vec<String>,
 }
 
 /// Set by the desktop when it starts the server in a dev container of a folder the user trusts
@@ -40,7 +49,37 @@ impl TrustStore {
             }
             Err(e) => Err(e.into()),
         };
-        Self { file, state: Mutex::new(state), inherited: Mutex::default() }
+        let remote_file = data.join("remote-project-trust.json");
+        let remote = match std::fs::read(&remote_file) {
+            Ok(bytes) => serde_json::from_slice(&bytes).map_err(|e| IdeError::invalid(e.to_string())),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(RemoteDecisions::default()),
+            Err(e) => Err(e.into()),
+        };
+        Self { file, state: Mutex::new(state), inherited: Mutex::default(), remote_file, remote: Mutex::new(remote) }
+    }
+
+    /// The decision made on this machine for the remote project at `location` (`None`: none yet).
+    /// Commands a remote window runs here follow it, not the server's own trust.
+    pub fn remote_decision(&self, location: &str) -> IdeResult<Option<bool>> {
+        let remote = self.remote.lock().clone()?;
+        Ok(if remote.restricted.iter().any(|l| l == location) {
+            Some(false)
+        } else if remote.trusted.iter().any(|l| l == location) {
+            Some(true)
+        } else {
+            None
+        })
+    }
+
+    pub fn decide_remote(&self, location: &str, trusted: bool) -> IdeResult<()> {
+        let mut state = self.remote.lock();
+        let mut next = state.clone()?;
+        next.trusted.retain(|l| l != location);
+        next.restricted.retain(|l| l != location);
+        if trusted { &mut next.trusted } else { &mut next.restricted }.push(location.to_owned());
+        persist(&self.remote_file, &next)?;
+        *state = Ok(next);
+        Ok(())
     }
 
     pub fn decisions(&self) -> IdeResult<TrustDecisions> {
@@ -133,7 +172,7 @@ impl TrustStore {
     }
 }
 
-fn persist(file: &Path, state: &TrustDecisions) -> IdeResult<()> {
+fn persist<T: Serialize>(file: &Path, state: &T) -> IdeResult<()> {
     if let Some(parent) = file.parent() {
         std::fs::create_dir_all(parent)?;
     }
@@ -142,6 +181,61 @@ fn persist(file: &Path, state: &TrustDecisions) -> IdeResult<()> {
     Ok(())
 }
 
+type McpServers = std::collections::BTreeMap<String, ide_core::settings::AgentMcpServer>;
+
+/// Workspace MCP servers (a project's `agents.mcpServers`) the user turned on in Settings, by a
+/// fingerprint of the project and the server's definition. Agents start a workspace server only
+/// while its definition is one the user turned on, so a server added or changed in the project's
+/// file stays off until then.
+pub struct McpServerApprovals {
+    file: PathBuf,
+    approved: Mutex<std::collections::BTreeSet<String>>,
+}
+
+impl McpServerApprovals {
+    pub fn load(data: &Path) -> Self {
+        let file = data.join("mcp-server-approvals.json");
+        let approved = std::fs::read(&file).ok().and_then(|b| serde_json::from_slice(&b).ok()).unwrap_or_default();
+        Self { file, approved: Mutex::new(approved) }
+    }
+
+    fn fingerprint(root: &Path, name: &str, server: &ide_core::settings::AgentMcpServer) -> String {
+        // Turning a server off and on again doesn't change what it runs.
+        let server = ide_core::settings::AgentMcpServer { enabled: true, ..server.clone() };
+        let bytes = serde_json::to_vec(&(root, name, server)).expect("MCP server serializes");
+        blake3::hash(&bytes).to_hex().to_string()
+    }
+
+    pub fn approved(&self, root: &Path, name: &str, server: &ide_core::settings::AgentMcpServer) -> bool {
+        self.approved.lock().contains(&Self::fingerprint(root, name, server))
+    }
+
+    pub fn approve(&self, root: &Path, name: &str, server: &ide_core::settings::AgentMcpServer) -> IdeResult<()> {
+        let fingerprint = Self::fingerprint(root, name, server);
+        let mut approved = self.approved.lock();
+        if approved.contains(&fingerprint) {
+            return Ok(());
+        }
+        let mut next = approved.clone();
+        next.insert(fingerprint);
+        if let Some(parent) = self.file.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+        let bytes = serde_json::to_vec_pretty(&next).map_err(|e| IdeError::internal(e.to_string()))?;
+        ide_vfs::write_atomic(&self.file, &bytes)?;
+        *approved = next;
+        Ok(())
+    }
+
+    /// `workspace` with the servers the user hasn't turned on switched off.
+    pub fn apply(&self, root: &Path, mut workspace: McpServers) -> McpServers {
+        for (name, server) in &mut workspace {
+            server.enabled &= self.approved(root, name, server);
+        }
+        workspace
+    }
+}
+
 impl crate::Host {
     pub async fn set_project_trust(&self, path: &Path, trusted: bool, folder: bool) -> IdeResult<()> {
         self.trust.decide(path, trusted, folder)?;
@@ -317,6 +411,8 @@ pub fn restricted_command_allowed(cmd: &str) -> bool {
             | "remote_current"
             | "remote_disconnect"
             | "remote_connect"
+            | "remote_trust_status"
+            | "remote_trust_set"
             | "remote_bootstrap_list"
             | "wsl_distros"
             | "wsl_resolve"
@@ -471,4 +567,18 @@ mod tests {
     fn restricted_mode_allows_clipboard_write_text() {
         assert!(super::restricted_command_allowed("clipboard_write_text"));
     }
+
+    #[test]
+    fn remote_project_decisions_are_kept_on_this_machine() {
+        let tmp = tempfile::tempdir().unwrap();
+        let load = || super::TrustStore::load(&tmp.path().join("config"), &tmp.path().join("data"));
+        let store = load();
+        let here = r#"[{"kind":"ssh","config":"box"},"/srv/app"]"#;
+        assert_eq!(store.remote_decision(here).unwrap(), None);
+        store.decide_remote(here, true).unwrap();
+        assert_eq!(store.remote_decision(here).unwrap(), Some(true));
+        assert_eq!(store.remote_decision(r#"[{"kind":"ssh","config":"box"},"/srv/other"]"#).unwrap(), None);
+        store.decide_remote(here, false).unwrap();
+        assert_eq!(load().remote_decision(here).unwrap(), Some(false));
+    }
 }

crates/ide-host/tests/agent_approvals.rs

@@ -0,0 +1,57 @@
+//! The mode new agent tasks start in.
+
+use ide_core::NullSink;
+use ide_host::{Host, HostConfig};
+use serde_json::json;
+use std::path::Path;
+use std::sync::Arc;
+
+/// Codex's modes as it reported them last time, in "ask".
+fn remember_codex_modes(data: &Path) {
+    std::fs::create_dir_all(data.join("agents")).unwrap();
+    let modes = json!({ "codex": { "config": [ {
+        "id": "mode", "name": "Mode", "description": null, "category": "mode", "current": "ask",
+        "values": [ { "value": "read-only", "name": "Read Only", "description": null },
+                    { "value": "ask", "name": "Ask", "description": null },
+                    { "value": "full-access", "name": "Full Access", "description": null } ],
+        "via": "option" } ] } });
+    std::fs::write(data.join("agents/models.json"), modes.to_string()).unwrap();
+}
+
+fn codex_mode(host: &Host) -> Option<String> {
+    let providers = ide_host::ops::agent::providers(host, "main").unwrap();
+    let codex = providers.into_iter().find(|p| p.id == "codex").expect("codex is listed");
+    codex.config.into_iter().find(|o| o.id == "mode").and_then(|o| o.current)
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn new_tasks_start_asking_for_approval_when_the_user_chose_so() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = dunce::canonicalize(tmp.path()).unwrap().join("project");
+    std::fs::create_dir_all(root.join(".openidea")).unwrap();
+    let (config, data) = (tmp.path().join("config"), tmp.path().join("data"));
+    remember_codex_modes(&data);
+    std::fs::create_dir_all(&config).unwrap();
+    std::fs::write(config.join("settings.toml"), "[agents]\nnewTaskApprovals = \"ask\"\n").unwrap();
+    // A project's own settings don't choose this.
+    std::fs::write(root.join(".openidea/settings.toml"), "[agents]\nnewTaskApprovals = \"bypass\"\n").unwrap();
+    let host = Arc::new(Host::new(HostConfig {
+        config_dir: config.clone(),
+        data_dir: data,
+        local_data_dir: tmp.path().join("local"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(|_| Arc::new(NullSink)),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }));
+    host.trust.decide(&root, true, false).unwrap();
+    host.open_project("main", &root).unwrap();
+    assert_eq!(codex_mode(&host).as_deref(), Some("ask"));
+
+    // The default keeps starting new tasks without approvals.
+    std::fs::remove_file(config.join("settings.toml")).unwrap();
+    host.project("main").unwrap().settings.reload();
+    assert_eq!(codex_mode(&host).as_deref(), Some("full-access"));
+}

crates/ide-host/tests/agent_env_secrets.rs

@@ -0,0 +1,86 @@
+//! Values of agents' environment variables live in the credential store; agent files keep only their names.
+
+use ide_core::NullSink;
+use ide_host::{Host, HostConfig};
+use ide_ssh::secrets::testing::{files_containing, use_memory_store};
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+const VALUE: &str = "agent-env-value-5b2d81";
+
+fn host(dir: &Path) -> Arc<Host> {
+    Arc::new(Host::new(HostConfig {
+        config_dir: dir.join("config"),
+        data_dir: dir.join("data"),
+        local_data_dir: dir.join("data"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(|_| Arc::new(NullSink)),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }))
+}
+
+fn open(host: &Host, tmp: &tempfile::TempDir) {
+    let root = dunce::canonicalize(tmp.path()).unwrap().join("project");
+    std::fs::create_dir_all(&root).unwrap();
+    host.trust.decide(&root, true, false).unwrap();
+    host.open_project("main", &root).unwrap();
+}
+
+fn env_of(host: &Host, id: &str) -> BTreeMap<String, String> {
+    let providers = ide_host::ops::agent::providers(host, "main").unwrap();
+    providers.into_iter().find(|p| p.id == id).unwrap_or_else(|| panic!("{id}")).env
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn agent_environment_values_stay_out_of_agent_files() {
+    use_memory_store();
+    let tmp = tempfile::tempdir().unwrap();
+    let host = host(tmp.path());
+    open(&host, &tmp);
+    let env = BTreeMap::from([("ANTHROPIC_API_KEY".to_owned(), VALUE.to_owned())]);
+    ide_host::ops::agent::set_env(&host, "main", "claude".into(), env.clone()).unwrap();
+    ide_host::ops::agent::save_custom_agent(
+        &host,
+        "main",
+        ide_agent::CustomAgentInput {
+            id: "mine".into(),
+            name: "Mine".into(),
+            command: "/opt/mine".into(),
+            args: vec![],
+            env: env.clone(),
+        },
+    )
+    .unwrap();
+    host.close_project("main");
+    assert_eq!(files_containing(tmp.path(), VALUE), Vec::<PathBuf>::new());
+
+    let host = self::host(tmp.path());
+    open(&host, &tmp);
+    assert_eq!(env_of(&host, "claude"), env);
+    assert_eq!(env_of(&host, "mine"), env);
+    ide_host::ops::agent::remove_custom_agent(&host, "main", "mine".into()).unwrap();
+    ide_host::ops::agent::set_env(&host, "main", "claude".into(), BTreeMap::new()).unwrap();
+    assert_eq!(host.agent_secrets.keys("agent/"), Vec::<String>::new());
+    host.close_project("main");
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn values_in_agent_files_move_to_the_credential_store() {
+    use_memory_store();
+    let tmp = tempfile::tempdir().unwrap();
+    std::fs::create_dir_all(tmp.path().join("config/agents")).unwrap();
+    std::fs::write(
+        tmp.path().join("config/agents/mine.toml"),
+        format!("command = \"/opt/mine\"\n[env]\nTOKEN = \"{VALUE}\"\n"),
+    )
+    .unwrap();
+    let host = host(tmp.path());
+    open(&host, &tmp);
+    assert_eq!(files_containing(tmp.path(), VALUE), Vec::<PathBuf>::new());
+    assert_eq!(env_of(&host, "mine"), BTreeMap::from([("TOKEN".to_owned(), VALUE.to_owned())]));
+    host.close_project("main");
+}

crates/ide-host/tests/agent_mcp.rs

@@ -0,0 +1,77 @@
+//! External MCP servers in Settings › Agents, as the host stores and lists them.
+
+use ide_agent::{McpScope, McpServer, McpServerInput};
+use ide_core::NullSink;
+use ide_core::settings::McpTransport;
+use ide_host::ops::agent::{mcp_import, mcp_list, mcp_save, mcp_set_enabled};
+use ide_host::{Host, HostConfig};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+fn open(base: &Path) -> (Arc<Host>, PathBuf) {
+    let root = dunce::canonicalize(base).unwrap().join("project");
+    std::fs::create_dir_all(root.join(".openidea")).unwrap();
+    let host = Arc::new(Host::new(HostConfig {
+        config_dir: base.join("config"),
+        data_dir: base.join("data"),
+        local_data_dir: base.join("data"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(|_| Arc::new(NullSink)),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }));
+    host.trust.decide(&root, true, false).unwrap();
+    host.open_project("main", &root).unwrap();
+    (host, root)
+}
+
+fn enabled(list: &[McpServer], id: &str) -> bool {
+    list.iter().find(|s| s.id == id).unwrap_or_else(|| panic!("{id} not listed: {list:?}")).enabled
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn workspace_servers_from_the_project_file_stay_off_until_the_user_turns_them_on() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (host, root) = open(tmp.path());
+    let settings_file = root.join(".openidea/settings.toml");
+    std::fs::write(&settings_file, "[agents.mcpServers.helper]\ncommand = \"node\"\nargs = [\"helper.js\"]\n").unwrap();
+    host.project("main").unwrap().settings.reload();
+
+    assert!(!enabled(&mcp_list(&host, "main").unwrap(), "workspace::helper"));
+    assert!(enabled(&mcp_set_enabled(&host, "main", "workspace::helper".into(), true).unwrap(), "workspace::helper"));
+    assert!(enabled(&mcp_list(&host, "main").unwrap(), "workspace::helper"));
+
+    // A changed definition is off again until turned back on.
+    std::fs::write(&settings_file, "[agents.mcpServers.helper]\ncommand = \"node\"\nargs = [\"other.js\"]\n").unwrap();
+    host.project("main").unwrap().settings.reload();
+    assert!(!enabled(&mcp_list(&host, "main").unwrap(), "workspace::helper"));
+
+    // What the user adds in Settings is on.
+    let saved = mcp_save(
+        &host,
+        "main",
+        McpServerInput {
+            id: None,
+            name: "mine".into(),
+            scope: McpScope::Workspace,
+            transport: McpTransport::Stdio,
+            enabled: true,
+            command: Some("uvx".into()),
+            args: vec!["mcp-server-git".into()],
+            env: vec![],
+            url: None,
+            headers: vec![],
+            agents: vec![],
+        },
+    )
+    .unwrap();
+    assert!(enabled(&saved, "workspace::mine"));
+
+    // Imported servers come from the project's own files: off until turned on.
+    std::fs::write(root.join(".mcp.json"), r#"{"mcpServers":{"imported":{"command":"uvx","args":["x"]}}}"#).unwrap();
+    let imported = mcp_import(&host, "main").unwrap();
+    assert!(!enabled(&imported, "workspace::imported"));
+    assert!(enabled(&imported, "workspace::mine"));
+}

crates/ide-host/tests/plugins.rs

@@ -6682,7 +6682,11 @@ fn project_write_cannot_replace_the_git_file_of_a_linked_worktree() {
     }
     for rel in spellings {
         let err = f.run("misbehave", "projwrite", Some(rel)).unwrap_err();
-        assert!(err.contains("git's own files"), "{rel}: {err}");
+        // On Windows a stream name is refused before the path is looked at at all; elsewhere a colon
+        // is an ordinary character and the `.git` rule applies.
+        let refused =
+            if cfg!(windows) && rel.contains(':') { "file streams are not allowed" } else { "git's own files" };
+        assert!(err.contains(refused), "{rel}: {err}");
         assert_eq!(std::fs::read_to_string(&pointer).unwrap(), gitdir, "{rel}");
     }
 }

crates/ide-host/tests/rpc.rs

@@ -455,3 +455,29 @@ async fn properties_conversion_through_remote_dispatch_without_a_remote_host() {
     invoke(&peer, "close_project", json!({})).await.unwrap();
     peer.kill();
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn the_desktop_routes_exactly_what_a_server_of_this_build_answers() {
+    let tmp = tempfile::tempdir().unwrap();
+    let base = tmp.path().join("server");
+    let peer_slot = Arc::new(OnceLock::new());
+    let host = Arc::new(Host::new(HostConfig {
+        config_dir: base.join("config"),
+        data_dir: base.join("data"),
+        local_data_dir: base.join("data"),
+        languages: Arc::new(ide_language::LanguageRegistry::load(None).unwrap()),
+        syntax: Arc::default(),
+        sink_for: Box::new(|_| Arc::new(ide_core::NullSink)),
+        owner: |w| w,
+        runtime: tokio::runtime::Handle::current(),
+        project_environment: false,
+    }));
+    // As `openidea-server` assembles its commands.
+    let plugins = ide_host::plugins::remote_host::RemotePlugins::start(&base.join("data"), &host, peer_slot).unwrap();
+    let mut dispatcher = Dispatcher::standard();
+    plugins.register(&mut dispatcher);
+    dispatcher.add(ide_host::plugins::remote::SYNC_COMMAND, |_| async { Ok(()) });
+    assert_eq!(rpc::client_commands(), dispatcher.commands());
+    assert!(rpc::client_commands().contains(&"term_spawn"));
+    plugins.host().shutdown();
+}

crates/ide-index/Cargo.toml

@@ -21,6 +21,9 @@ ignore.workspace = true
 globset.workspace = true
 postcard = { version = "1.1", default-features = false, features = ["use-std"] }
 
+[build-dependencies]
+blake3.workspace = true
+
 [dev-dependencies]
 tempfile.workspace = true
 criterion = { version = "0.5", default-features = false }

crates/ide-index/build.rs

@@ -0,0 +1,33 @@
+//! Hashes this crate's sources into `INDEX_SOURCE_HASH`: what is extracted and stored for a
+//! file (ignored state, size limit, record layout) is decided here as well as in
+//! `ide-language`, so the persistent index is rebuilt when either changes.
+
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let src = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap()).join("src");
+    println!("cargo:rerun-if-changed={}", src.display());
+    let mut files = Vec::new();
+    collect(&src, &mut files);
+    files.sort();
+    let mut h = blake3::Hasher::new();
+    for file in files {
+        h.update(file.strip_prefix(&src).unwrap_or(&file).to_string_lossy().replace('\\', "/").as_bytes());
+        h.update(b"\0");
+        h.update(&std::fs::read(&file).unwrap());
+        h.update(b"\0");
+    }
+    println!("cargo:rustc-env=INDEX_SOURCE_HASH={}", &h.finalize().to_hex()[..16]);
+}
+
+fn collect(dir: &Path, out: &mut Vec<PathBuf>) {
+    let Ok(entries) = std::fs::read_dir(dir) else { return };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.is_dir() {
+            collect(&path, out);
+        } else {
+            out.push(path);
+        }
+    }
+}

crates/ide-index/src/store.rs

@@ -45,7 +45,7 @@ impl Store {
             }
         };
         let store = Self { db: RwLock::new(db) };
-        let stamp = format!("{SCHEMA}\n{fingerprint}\n{}", root.display());
+        let stamp = format!("{SCHEMA}\n{}\n{fingerprint}\n{}", env!("INDEX_SOURCE_HASH"), root.display());
         match store.meta("stamp") {
             Ok(Some(v)) if v == stamp.as_bytes() => {}
             _ => {

crates/ide-language/Cargo.toml

@@ -58,6 +58,9 @@ tree-sitter-graphql = "0.3.0"
 tree-sitter-prisma-io = "1.6.0"
 tree-sitter-gdscript = "6.1.0"
 
+[build-dependencies]
+blake3.workspace = true
+
 [dev-dependencies]
 criterion = { version = "0.5", default-features = false }
 tempfile.workspace = true

crates/ide-language/build.rs

@@ -0,0 +1,61 @@
+//! Hashes everything that decides what `Syntax::tags` extracts (this crate's
+//! sources, queries, language definitions and the locked tree-sitter crates)
+//! into `SYNTAX_SOURCE_HASH`, so persistent caches survive releases that leave
+//! extraction untouched.
+
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let manifest = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    let workspace = manifest.join("../..");
+    let lock = workspace.join("Cargo.lock");
+    let inputs = [manifest.join("src"), manifest.join("queries"), workspace.join("languages")];
+
+    let mut h = blake3::Hasher::new();
+    for dir in &inputs {
+        println!("cargo:rerun-if-changed={}", dir.display());
+        let mut files = Vec::new();
+        collect(dir, &mut files);
+        files.sort();
+        for file in files {
+            let rel = file.strip_prefix(&workspace).unwrap_or(&file);
+            h.update(rel.to_string_lossy().replace('\\', "/").as_bytes());
+            h.update(b"\0");
+            h.update(&std::fs::read(&file).unwrap());
+            h.update(b"\0");
+        }
+    }
+    println!("cargo:rerun-if-changed={}", lock.display());
+    match std::fs::read_to_string(&lock) {
+        Ok(text) => h.update(tree_sitter_packages(&text).as_bytes()),
+        // Built outside the workspace: fall back to the crate version.
+        Err(_) => h.update(std::env::var("CARGO_PKG_VERSION").unwrap().as_bytes()),
+    };
+    println!("cargo:rustc-env=SYNTAX_SOURCE_HASH={}", &h.finalize().to_hex()[..16]);
+}
+
+fn collect(dir: &Path, out: &mut Vec<PathBuf>) {
+    let Ok(entries) = std::fs::read_dir(dir) else { return };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.is_dir() {
+            collect(&path, out);
+        } else {
+            out.push(path);
+        }
+    }
+}
+
+/// `name version checksum` of every locked `tree-sitter*` package.
+fn tree_sitter_packages(lock: &str) -> String {
+    let mut out = String::new();
+    for package in lock.split("[[package]]") {
+        let field = |key: &str| {
+            package.lines().find_map(|l| l.strip_prefix(key)?.strip_prefix(" = ")).unwrap_or("").trim_matches('"')
+        };
+        if field("name").starts_with("tree-sitter") {
+            out.push_str(&format!("{} {} {}\n", field("name"), field("version"), field("checksum")));
+        }
+    }
+    out
+}

crates/ide-language/src/syntax/mod.rs

@@ -132,29 +132,11 @@ impl Syntax {
         SPECS.iter().map(|s| s.name)
     }
 
-    /// Changes whenever extraction output may change (grammar set, queries,
-    /// crate version); persistent caches of [`Syntax::tags`] key on it.
+    /// Changes whenever extraction output may change (this crate's sources,
+    /// queries, language definitions, tree-sitter crate versions; see
+    /// `build.rs`); persistent caches of [`Syntax::tags`] key on it.
     pub fn fingerprint(&self) -> String {
-        static FP: OnceLock<String> = OnceLock::new();
-        FP.get_or_init(|| {
-            let mut h = blake3::Hasher::new();
-            h.update(env!("CARGO_PKG_VERSION").as_bytes());
-            // Bump when web definitions (`.class`, `#id`, `--var` tags) change.
-            h.update(b"web-definitions-1");
-            for s in SPECS {
-                h.update(s.name.as_bytes());
-                h.update(&Language::new(s.language).abi_version().to_le_bytes());
-                h.update(s.outline.as_bytes());
-                for list in [s.fold_nodes, s.fold_bodies, s.imports, s.constructors] {
-                    for k in list {
-                        h.update(k.as_bytes());
-                        h.update(b"\0");
-                    }
-                }
-            }
-            h.finalize().to_hex()[..16].to_owned()
-        })
-        .clone()
+        env!("SYNTAX_SOURCE_HASH").to_owned()
     }
 
     /// Whether a tree-sitter grammar is bundled for this language.

crates/ide-lsp/src/lib.rs

@@ -378,15 +378,32 @@ fn read_jar_source(uri: &str, encoding: Option<&str>) -> Option<(String, ide_vfs
 /// Library classes in `jar:` targets (the official Kotlin LSP) go to their source
 /// in the artifact's sources jar when it is cached, at the declaration of the
 /// name navigated from; [`LspManager::virtual_document`] serves it.
-async fn library_sources(snap: &DocSnap, pos: Pos, locs: Vec<Location>) -> Vec<Location> {
-    if !locs.iter().any(|l| l.uri.as_deref().is_some_and(|u| u.starts_with("jar:") && u.ends_with(".class"))) {
+async fn library_sources(snap: &DocSnap, root: &Path, pos: Pos, locs: Vec<Location>) -> Vec<Location> {
+    let jar_class = |u: &str| u.starts_with("jar:") && u.ends_with(".class");
+    // The path names the class's source file (`Db.kt`); the handle in the query, the class.
+    let jdt_class = |u: &str| u.starts_with("jdt://contents/") && u.contains(".class");
+    if !locs.iter().any(|l| l.uri.as_deref().is_some_and(|u| jar_class(u) || jdt_class(u))) {
         return locs;
     }
     let name = library_source::identifier_at(snap.text.line(pos.line as usize), pos.col).map(str::to_owned);
+    let root = root.to_owned();
     tokio::task::spawn_blocking(move || {
         locs.into_iter()
             .map(|loc| {
-                let Some(uri) = loc.uri.as_deref().filter(|u| u.starts_with("jar:") && u.ends_with(".class")) else {
+                // A class JDT finds in a project's class folder (Kotlin compiled for Java code):
+                // the project's source file, not the decompiled class.
+                if let Some(uri) = loc.uri.as_deref().filter(|u| jdt_class(u)) {
+                    let source = library_source::folder_class(uri)
+                        .and_then(|(package, class)| library_source::project_class_source(&root, &package, &class));
+                    let Some(source) = source else { return loc };
+                    let range = name
+                        .as_deref()
+                        .zip(std::fs::read_to_string(&source).ok())
+                        .map(|(n, text)| library_source::declaration_range(&text, n))
+                        .unwrap_or_default();
+                    return Location { path: source.into(), range, uri: None };
+                }
+                let Some(uri) = loc.uri.as_deref().filter(|u| jar_class(u)) else {
                     return loc;
                 };
                 let Some((source, loaded)) = library_source::class_source(uri, None) else { return loc };
@@ -1683,7 +1700,7 @@ impl LspManager {
             Ok(found) => {
                 let locs =
                     convert::goto_response(&self.conv(t.enc()), lsp::GotoDefinitionResponse::Array(found.locations));
-                let locs = library_sources(snap, pos, locs).await;
+                let locs = library_sources(snap, &self.project_root, pos, locs).await;
                 self.note_virtual(&t.server, locs.iter().map(|l| l.uri.as_deref()));
                 (locs, found.complete)
             }
@@ -1732,7 +1749,7 @@ impl LspManager {
             match r {
                 Ok(Some(r)) => {
                     let locs = convert::goto_response(&self.conv(t.enc()), r);
-                    let locs = library_sources(snap, pos, locs).await;
+                    let locs = library_sources(snap, &self.project_root, pos, locs).await;
                     self.note_virtual(&t.server, locs.iter().map(|l| l.uri.as_deref()));
                     self.note_arduino_sources(&t.server, &locs);
                     let locs = merge_locations(first, locs);

crates/ide-lsp/src/library_source.rs

@@ -226,6 +226,66 @@ pub(crate) fn identifier_at(line: &str, col: u32) -> Option<&str> {
     (!word.is_empty() && !word.starts_with(|c: char| c.is_ascii_digit())).then_some(word)
 }
 
+/// A class of a class folder on JDT's classpath, as `(package path, class name)`, read
+/// from the element handle in the query:
+/// `jdt://contents/<folder>/<pkg>/<File>?=<project>/<escaped folder>[=/<attribute>=/<value>]…<pkg(Name.class`
+/// (`<File>` is the class's SourceFile, `Db.kt` for a Kotlin class). A folder is a project's
+/// own build output (the Kotlin classes the IDE compiles for JDT among them), never a
+/// dependency, which is a jar or a JDK module.
+pub(crate) fn folder_class(uri: &str) -> Option<(String, String)> {
+    uri.strip_prefix("jdt://contents/")?;
+    let query = percent_decode_str(uri.split_once('?')?.1).decode_utf8().ok()?;
+    let (root, element) = query.split_once('/')?.1.split_once('<')?;
+    let folder = PathBuf::from(root.split("=/").next()?.replace('\\', ""));
+    let (package, file) = element.split_once('(')?;
+    let name = file.strip_suffix(".class")?;
+    if name.is_empty() || !folder.is_dir() {
+        return None;
+    }
+    Some((package.replace('.', "/"), name.to_owned()))
+}
+
+/// The project's source of `class` (`Name`, `Outer$Inner`, `FileKt`) in `package`
+/// (`/`-separated): a `.kt` / `.java` file of that name declaring the package. Build
+/// output and ignored files are skipped.
+pub(crate) fn project_class_source(root: &Path, package: &str, class: &str) -> Option<PathBuf> {
+    let outer = class.split('$').next().unwrap_or(class);
+    let mut names = vec![format!("{outer}.kt"), format!("{outer}.java")];
+    if let Some(file) = outer.strip_suffix("Kt").filter(|f| !f.is_empty()) {
+        names.push(format!("{file}.kt"));
+    }
+    let package = package.replace('/', ".");
+    let mut found: Vec<PathBuf> = ignore::WalkBuilder::new(root)
+        .filter_entry(|e| {
+            let output = matches!(e.file_name().to_str(), Some("target" | "build" | "out" | "node_modules"));
+            // A package may be named `build`: only outside source trees is it output.
+            !output || e.path().components().any(|c| c.as_os_str() == "src")
+        })
+        .build()
+        .flatten()
+        .filter(|e| e.file_type().is_some_and(|t| t.is_file()))
+        .filter(|e| e.file_name().to_str().is_some_and(|n| names.iter().any(|name| name == n)))
+        .map(|e| e.into_path())
+        .filter(|p| std::fs::read_to_string(p).is_ok_and(|text| declared_package(&text) == package))
+        .collect();
+    // The directory matching the package first, then by name order.
+    found.sort_by_key(|p| {
+        let dir = p.parent().map(|d| d.to_string_lossy().replace('\\', "/")).unwrap_or_default();
+        let name = p.file_name().and_then(|n| n.to_str()).unwrap_or_default();
+        (!dir.ends_with(&format!("/{}", package.replace('.', "/"))), names.iter().position(|n| n == name))
+    });
+    found.into_iter().next()
+}
+
+/// The `package` a Kotlin or Java file declares; empty for the default package.
+fn declared_package(text: &str) -> String {
+    text.lines()
+        .map(str::trim)
+        .find(|line| line.starts_with("package "))
+        .map(|line| line["package ".len()..].trim_end_matches(';').trim().replace('`', ""))
+        .unwrap_or_default()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -414,6 +474,58 @@ mod tests {
         assert_eq!((reloaded.text.as_str(), reloaded.encoding.as_str()), (GBK_SAMPLE, "gbk"));
     }
 
+    #[test]
+    fn maps_class_folder_classes_to_project_sources() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let output = root.join(".cache/kotlin/main-0");
+        std::fs::create_dir_all(output.join("test001")).unwrap();
+        // As jdtls writes it: the class's source file name in the path, the library's
+        // classpath attributes after the folder.
+        let escaped = output.to_string_lossy().replace('/', "\\/");
+        let handle = format!("=demo/{escaped}=/ai.openidea.kotlin=/true=/<test001(Db.class");
+        let uri = format!("jdt://contents/main-0/test001/Db.kt?{}", utf8_percent_encode(&handle, PATH));
+        assert_eq!(folder_class(&uri), Some(("test001".into(), "Db".into())));
+        let plain = format!(
+            "jdt://contents/main-0/test001/Db.class?{}",
+            utf8_percent_encode(&format!("=demo/{escaped}<test001(Db.class"), PATH)
+        );
+        assert_eq!(folder_class(&plain), Some(("test001".into(), "Db".into())));
+        let nested = format!(
+            "jdt://contents/main-0/a.b/Db.kt?{}",
+            utf8_percent_encode(&format!("=demo/{escaped}<a.b(Db$Companion.class"), PATH)
+        );
+        assert_eq!(folder_class(&nested), Some(("a/b".into(), "Db$Companion".into())));
+        let jar = "jdt://contents/a.jar/p/C.class?=p/%5C/m2%5C/a.jar%3Cp%28C.class";
+        assert_eq!(folder_class(jar), None, "a dependency jar");
+        assert_eq!(folder_class(&uri.replace("main-0", "gone")), None);
+
+        let write = |path: &str, text: &str| {
+            let path = root.join(path);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(path, text).unwrap();
+        };
+        write("src/main/kotlin/test001/Db.kt", "package test001\n\nclass Db\n");
+        write("src/main/kotlin/other/Db.kt", "package other\n\nclass Db\n");
+        write("target/generated/test001/Db.kt", "package test001\n\nclass Db\n");
+        write("src/main/kotlin/util/Strings.kt", "@file:JvmName(\"Strings\")\npackage util\n\nfun shout() = 1\n");
+        write("src/main/kotlin/com/x/build/Tool.kt", "package com.x.build\n\nclass Tool\n");
+        write("src/main/kotlin/flat/Elsewhere.kt", "");
+        write("src/main/kotlin/Loose.kt", "package flat\n\nobject Loose\n");
+        let source = |package: &str, class: &str| {
+            project_class_source(root, package, class).map(|p| p.strip_prefix(root).unwrap().to_owned())
+        };
+        assert_eq!(source("test001", "Db"), Some(PathBuf::from("src/main/kotlin/test001/Db.kt")));
+        assert_eq!(source("test001", "Db$Companion"), Some(PathBuf::from("src/main/kotlin/test001/Db.kt")));
+        assert_eq!(source("other", "Db"), Some(PathBuf::from("src/main/kotlin/other/Db.kt")));
+        assert_eq!(source("util", "StringsKt"), Some(PathBuf::from("src/main/kotlin/util/Strings.kt")));
+        assert_eq!(source("com/x/build", "Tool"), Some(PathBuf::from("src/main/kotlin/com/x/build/Tool.kt")));
+        assert_eq!(source("flat", "Loose"), Some(PathBuf::from("src/main/kotlin/Loose.kt")), "any directory");
+        assert_eq!(source("test001", "Missing"), None);
+        assert_eq!(declared_package("package a.b.c;\n"), "a.b.c");
+        assert_eq!(declared_package("class A"), "");
+    }
+
     #[test]
     fn locates_declarations_in_kotlin_and_java_sources() {
         let at = |text: &str, name: &str| {

crates/ide-plugin/Cargo.toml

@@ -23,5 +23,5 @@ wasmtime-wasi = { version = "49.0.4", default-features = false, features = ["p2"
 
 [dev-dependencies]
 tempfile.workspace = true
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "time"] }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "time", "net"] }
 wat = "1.258"

crates/ide-plugin/src/runtime.rs

@@ -365,14 +365,7 @@ pub trait HostApi: Send + Sync {
     }
     /// The most specific open project containing a document (including a new file).
     fn project_of(&self, path: &Path) -> Option<std::path::PathBuf> {
-        if !path.is_absolute() {
-            return None;
-        }
-        let real = crate::resolve_real(path);
-        self.projects()
-            .into_iter()
-            .filter(|root| real.starts_with(crate::resolve_real(root)))
-            .max_by_key(|root| root.components().count())
+        crate::sandbox::innermost_root(self.projects(), path)
     }
 
     /// Searches the current in-memory index of an open project.

crates/ide-plugin/src/sandbox.rs

@@ -1,7 +1,9 @@
 //! Capability checks for host functions that touch the file system.
 
+use ide_core::real_path::reaches_git_dir;
+pub use ide_core::real_path::resolve_real;
 use ide_extension::Capability;
-use std::path::{Path, PathBuf};
+use std::path::{Component, Path, PathBuf, Prefix};
 
 /// Largest file `read-file` returns.
 /// The most entries `fs.read-dir` hands over: the same cap as `find-files`.
@@ -11,53 +13,114 @@ pub const MAX_READ_BYTES: u64 = 16 << 20;
 /// The largest file s.write may write, in bytes.
 pub const MAX_WRITE_BYTES: usize = 16 << 20;
 
-/// The canonical `root` and the absolute form of `path` (absolute, or
-/// relative to `root`) — before any symlink or existence check.
-fn joined_path(root: &Path, path: &str) -> Result<(PathBuf, PathBuf), String> {
+/// What a requested path is, judged from its text alone — before anything opens it. On
+/// Windows even resolving a path opens it, and opening a network or pipe path connects to
+/// that host or pipe, so every resolver asks this first and checks the real path after.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Lexical {
+    /// A local path, or a network path under one of the allowed bases.
+    Resolvable,
+    /// A network path outside every allowed base.
+    Outside,
+    /// A device, pipe or file stream, which is never a file a plugin may use.
+    Refused,
+}
+
+/// Judges `path` against `bases` (absolute paths a resolver allows) from the text alone.
+fn judge(path: &Path, bases: &[&Path]) -> Lexical {
+    let Some((parts, remote)) = lexical_parts(path) else {
+        return Lexical::Refused;
+    };
+    let under =
+        |base: &&Path| base.is_absolute() && lexical_parts(base).is_some_and(|(base, _)| parts.starts_with(&base));
+    if remote && !bases.iter().any(under) { Lexical::Outside } else { Lexical::Resolvable }
+}
+
+/// `path` split into comparable parts, `.` and `..` applied, a verbatim drive or share
+/// spelled like the plain one and, on Windows, case-folded; with whether it names a network
+/// location. `None` for a device or pipe (`\\.\…`, `\\?\GLOBALROOT\…`, `NUL`, `COM1`) or an
+/// NTFS stream (`a.txt:s`).
+fn lexical_parts(path: &Path) -> Option<(Vec<String>, bool)> {
+    let mut parts = Vec::new();
+    let mut remote = false;
+    let mut anchored = 0;
+    for part in path.components() {
+        match part {
+            Component::Prefix(prefix) => {
+                parts.push(match prefix.kind() {
+                    Prefix::Disk(drive) | Prefix::VerbatimDisk(drive) => format!("{}:", char::from(drive)),
+                    Prefix::UNC(server, share) | Prefix::VerbatimUNC(server, share) => {
+                        remote = true;
+                        format!(r"\\{}\{}", server.to_string_lossy(), share.to_string_lossy())
+                    }
+                    Prefix::Verbatim(_) | Prefix::DeviceNS(_) => return None,
+                });
+                anchored = parts.len();
+            }
+            Component::RootDir => {
+                parts.push(std::path::MAIN_SEPARATOR_STR.to_owned());
+                anchored = parts.len();
+            }
+            Component::CurDir => {}
+            Component::ParentDir => {
+                if parts.len() > anchored {
+                    parts.pop();
+                }
+            }
+            Component::Normal(name) => {
+                let name = name.to_string_lossy();
+                if cfg!(windows) && (name.contains(':') || names_device(&name)) {
+                    return None;
+                }
+                parts.push(name.into_owned());
+            }
+        }
+    }
+    if cfg!(windows) {
+        parts.iter_mut().for_each(|part| *part = part.to_lowercase());
+    }
+    Some((parts, remote))
+}
+
+/// A name Windows opens as a device in every folder (`NUL`, `COM1`, `con.txt`): what comes
+/// before the first `.`, trailing spaces ignored.
+fn names_device(name: &str) -> bool {
+    let stem = name.split('.').next().unwrap_or_default().trim_end_matches(' ').to_ascii_uppercase();
+    match stem.as_str() {
+        "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$" => true,
+        _ => stem.strip_prefix("COM").or_else(|| stem.strip_prefix("LPT")).is_some_and(|number| {
+            matches!(number, "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" | "¹" | "²" | "³")
+        }),
+    }
+}
+
+fn refused(path: &str) -> String {
+    format!("{path}: devices, pipes and file streams are not allowed")
+}
+
+/// The canonical `root` and the absolute form of `path` (absolute, or relative to `root`) —
+/// before any symlink or existence check — when [`judge`] lets it be resolved inside `root`.
+/// `Ok(None)` for a network path outside `root`.
+fn joined_path(root: &Path, path: &str) -> Result<Option<(PathBuf, PathBuf)>, String> {
     if path.is_empty() {
         return Err("empty path".into());
     }
-    let root = dunce::canonicalize(root).map_err(|e| format!("project root unavailable: {e}"))?;
+    let real_root = dunce::canonicalize(root).map_err(|e| format!("project root unavailable: {e}"))?;
     let requested = Path::new(path);
-    let joined = if requested.is_absolute() { requested.to_path_buf() } else { root.join(requested) };
-    Ok((root, joined))
-}
-
-/// `joined` after `..`/symlink resolution as far as the file system allows:
-/// the canonical path when it exists, else the canonicalized deepest existing
-/// ancestor with the still-missing tail resolved textually — so the location
-/// of a missing path is still judged where it would really land.
-pub fn resolve_real(joined: &Path) -> PathBuf {
-    let mut tail = Vec::new();
-    let mut candidate = joined.to_path_buf();
-    let mut real = loop {
-        match dunce::canonicalize(&candidate) {
-            Ok(real) => break real,
-            Err(_) => {
-                let Some(last) = candidate.components().next_back() else {
-                    return joined.to_path_buf();
-                };
-                tail.push(last.as_os_str().to_owned());
-                if !candidate.pop() {
-                    return joined.to_path_buf();
-                }
-            }
-        }
-    };
-    for part in tail.iter().rev() {
-        if part == ".." {
-            real.pop();
-        } else if part != "." {
-            real.push(part);
-        }
+    let joined = if requested.is_absolute() { requested.to_path_buf() } else { real_root.join(requested) };
+    match judge(&joined, &[root, &real_root]) {
+        Lexical::Resolvable => Ok(Some((real_root, joined))),
+        Lexical::Outside => Ok(None),
+        Lexical::Refused => Err(refused(path)),
     }
-    real
 }
 
 /// Resolves `path` (absolute, or relative to `root`) and checks that the real
 /// path — after following `..` and symlinks — stays inside `root`.
 pub fn resolve_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
-    let (root, joined) = joined_path(root, path)?;
+    let Some((root, joined)) = joined_path(root, path)? else {
+        return Err(format!("{path}: access outside the project root is not allowed"));
+    };
     let real = dunce::canonicalize(&joined).map_err(|_| format!("{path}: no such file"))?;
     if !real.starts_with(&root) {
         return Err(format!("{path}: access outside the project root is not allowed"));
@@ -93,7 +156,9 @@ pub fn resolve_in_roots(roots: &[PathBuf], path: &str) -> Result<PathBuf, String
 /// callers distinguish "outside" from "absent". Existing symlinks are
 /// followed; a missing tail is judged at its would-be location.
 pub fn inside_root(root: &Path, path: &str) -> Result<bool, String> {
-    let (root, joined) = joined_path(root, path)?;
+    let Some((root, joined)) = joined_path(root, path)? else {
+        return Ok(false);
+    };
     Ok(resolve_real(&joined).starts_with(&root))
 }
 
@@ -114,36 +179,40 @@ pub fn inside_roots(roots: &[PathBuf], path: &str) -> Result<bool, String> {
     Ok(false)
 }
 
+/// The most specific of `roots` containing `path` (absolute, and possibly not existing yet),
+/// judged where it really lands. A network path outside every root is not resolved at all.
+pub(crate) fn innermost_root(roots: Vec<PathBuf>, path: &Path) -> Option<PathBuf> {
+    if !path.is_absolute() {
+        return None;
+    }
+    let roots: Vec<(PathBuf, PathBuf)> = roots
+        .into_iter()
+        .map(|root| {
+            let real = resolve_real(&root);
+            (root, real)
+        })
+        .collect();
+    let bases: Vec<&Path> = roots.iter().flat_map(|(root, real)| [root.as_path(), real.as_path()]).collect();
+    if judge(path, &bases) != Lexical::Resolvable {
+        return None;
+    }
+    let real = resolve_real(path);
+    roots
+        .into_iter()
+        .filter(|(_, root)| real.starts_with(root))
+        .map(|(root, _)| root)
+        .max_by_key(|root| root.components().count())
+}
+
 /// Like [`resolve_in_root`] for a path that may not exist yet (a file about to
 /// be created) or that names a symlink itself (to delete or rename it): the
 /// directory part is resolved through symlinks, the final name is kept as is,
 /// and the result must stay inside `root`.
-/// Whether a path (relative to the project root) goes through git's own `.git` folder or file.
-/// git runs what it finds in `.git` (hooks, `gpg.program`, filters), so a content write must
-/// never reach it. Names are normalized for trailing dots and spaces and NTFS stream suffixes;
-/// the caller also checks the short-name-resolved path via [`resolve_real`].
-pub fn names_git_dir(rel: &Path) -> bool {
-    rel.components().any(|part| {
-        let name = part.as_os_str().to_string_lossy();
-        let name = name.split(':').next().unwrap_or_default().trim_end_matches(['.', ' ']);
-        name.eq_ignore_ascii_case(".git")
-    })
-}
-
-/// A resolved write destination that reaches git's own `.git` metadata, judged by the name
-/// given and by the name the file system resolves it to.
-fn reaches_git_dir(root: &Path, real: &Path) -> bool {
-    real.strip_prefix(root).is_ok_and(names_git_dir) || resolve_real(real).strip_prefix(root).is_ok_and(names_git_dir)
-}
-
 pub fn resolve_new_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
     let outside = || format!("{path}: access outside the project root is not allowed");
-    if path.is_empty() {
-        return Err("empty path".into());
-    }
-    let root = dunce::canonicalize(root).map_err(|e| format!("project root unavailable: {e}"))?;
-    let requested = Path::new(path);
-    let joined = if requested.is_absolute() { requested.to_path_buf() } else { root.join(requested) };
+    let Some((root, joined)) = joined_path(root, path)? else {
+        return Err(outside());
+    };
     let mut lexical = PathBuf::new();
     for part in joined.components() {
         match part {
@@ -181,7 +250,9 @@ pub fn resolve_new_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
 /// Resolves a content write's destination, including existing and dangling
 /// symlinks in the final component. Entry operations use [`resolve_new_in_root`].
 pub fn resolve_writable_in_root(root: &Path, path: &str) -> Result<PathBuf, String> {
-    let (root, joined) = joined_path(root, path)?;
+    let Some((root, joined)) = joined_path(root, path)? else {
+        return Err(format!("{path}: access outside the project root is not allowed"));
+    };
     let real = resolve_write_target(&joined, 40).map_err(|e| format!("{path}: {e}"))?;
     if !real.starts_with(&root) {
         return Err(format!("{path}: access outside the project root is not allowed"));
@@ -346,6 +417,22 @@ fn resolve(granted: &[Capability], path: &str, wanted: Wanted) -> Result<PathBuf
     if !asked.is_absolute() {
         return Err(Refusal::Invalid(format!("{path}: use an absolute path (or ~/…)")));
     }
+    let bases: Vec<PathBuf> = granted
+        .iter()
+        .filter_map(|grant| match (wanted, grant) {
+            (Wanted::Read, Capability::FsRead(base)) | (Wanted::Write, Capability::FsWrite(base)) => {
+                Some(expand_tilde(base))
+            }
+            _ => None,
+        })
+        .flat_map(|base| [dunce::canonicalize(&base).ok(), Some(base)])
+        .flatten()
+        .collect();
+    match judge(&asked, &bases.iter().map(PathBuf::as_path).collect::<Vec<_>>()) {
+        Lexical::Resolvable => {}
+        Lexical::Outside => return Err(Refusal::Denied(wanted.capability(strip_verbatim(&asked)).to_string())),
+        Lexical::Refused => return Err(Refusal::Invalid(refused(path))),
+    }
     let real = match wanted {
         Wanted::Read => dunce::canonicalize(&asked).map_err(|_| Refusal::Invalid(format!("{path}: no such file")))?,
         Wanted::Write => dunce::canonicalize(&asked)
@@ -399,6 +486,7 @@ fn strip_verbatim(path: &Path) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use ide_core::real_path::names_git_dir;
 
     #[cfg(windows)]
     #[test]
@@ -894,4 +982,127 @@ mod tests {
         );
         assert_eq!(expand_tilde("relative/x"), PathBuf::from("relative/x"));
     }
+
+    /// Resolving a path must not open what it names before the path is known to be allowed:
+    /// on Windows, opening a pipe or network path (even only to canonicalize it) connects to
+    /// that pipe or host. Streams and reserved device names are never project files.
+    #[cfg(windows)]
+    mod windows_paths {
+        use super::*;
+        use std::sync::Arc;
+        use std::sync::atomic::{AtomicBool, Ordering};
+        use tokio::net::windows::named_pipe::ServerOptions;
+
+        /// Every spelling of the local pipe `name` that Windows opens: device, verbatim, object
+        /// manager and network (through the SMB redirector, as a remote host would be reached).
+        fn spellings(name: &str) -> [String; 6] {
+            [
+                format!(r"\\.\pipe\{name}"),
+                format!(r"//./pipe/{name}"),
+                format!(r"\\?\pipe\{name}"),
+                format!(r"\\?\GLOBALROOT\Device\NamedPipe\{name}"),
+                format!(r"\\127.0.0.1\pipe\{name}"),
+                format!(r"\\?\UNC\127.0.0.1\pipe\{name}"),
+            ]
+        }
+
+        /// Each resolver, as `(name, accepts root path)`.
+        type Resolver = (&'static str, fn(&Path, &str) -> bool);
+
+        const RESOLVERS: [Resolver; 11] = [
+            ("resolve_in_root", |root, path| resolve_in_root(root, path).is_ok()),
+            ("resolve_in_roots", |root, path| resolve_in_roots(&[root.to_path_buf()], path).is_ok()),
+            ("inside_root", |root, path| inside_root(root, path).unwrap_or(false)),
+            ("inside_roots", |root, path| inside_roots(&[root.to_path_buf()], path).unwrap_or(false)),
+            ("resolve_new_in_root", |root, path| resolve_new_in_root(root, path).is_ok()),
+            ("resolve_new_in_roots", |root, path| resolve_new_in_roots(&[root.to_path_buf()], path).is_ok()),
+            ("resolve_writable_in_root", |root, path| resolve_writable_in_root(root, path).is_ok()),
+            ("resolve_writable_in_roots", |root, path| resolve_writable_in_roots(&[root.to_path_buf()], path).is_ok()),
+            ("resolve_granted", |root, path| resolve_granted(&[grant_for(root)], path).is_ok()),
+            ("resolve_writable", |root, path| {
+                resolve_writable(&[Capability::FsWrite(strip_verbatim(&dunce::canonicalize(root).unwrap()))], path)
+                    .is_ok()
+            }),
+            ("project_of", |root, path| innermost_root(vec![root.to_path_buf()], Path::new(path)).is_some()),
+        ];
+
+        #[test]
+        fn pipe_and_network_paths_are_refused_without_being_opened() {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path().join("project");
+            std::fs::create_dir(&root).unwrap();
+            let runtime = tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap();
+            let _context = runtime.enter();
+            let mut probes = Vec::new();
+            for (resolver, accepts) in RESOLVERS {
+                for spelling in 0..spellings("").len() {
+                    let name = format!("openidea-sandbox-{}-{resolver}-{spelling}", std::process::id());
+                    let server = ServerOptions::new().first_pipe_instance(true).create(format!(r"\\.\pipe\{name}"));
+                    let server = server.unwrap();
+                    let opened = Arc::new(AtomicBool::new(false));
+                    let flag = opened.clone();
+                    runtime.spawn(async move {
+                        let _ = server.connect().await;
+                        flag.store(true, Ordering::SeqCst);
+                    });
+                    let path = spellings(&name)[spelling].clone();
+                    let accepted = accepts(&root, &path);
+                    probes.push((resolver, path, accepted, opened));
+                }
+            }
+            runtime.block_on(tokio::time::sleep(std::time::Duration::from_millis(500)));
+            let failures: Vec<String> = probes
+                .iter()
+                .filter(|(_, _, accepted, opened)| *accepted || opened.load(Ordering::SeqCst))
+                .map(|(resolver, path, accepted, opened)| {
+                    format!("{resolver}({path}): accepted={accepted} opened={}", opened.load(Ordering::SeqCst))
+                })
+                .collect();
+            assert!(failures.is_empty(), "{failures:#?}");
+        }
+
+        #[test]
+        fn streams_and_device_names_are_refused() {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path().join("project");
+            std::fs::create_dir(&root).unwrap();
+            std::fs::write(root.join("a.txt"), "text").unwrap();
+            let root = dunce::canonicalize(root).unwrap();
+            let mut accepted = Vec::new();
+            for rel in ["a.txt:hidden", "a.txt::$DATA", "NUL", "con.txt", "sub/COM1", "LPT1.log", "CONIN$"] {
+                for path in [rel.to_owned(), root.join(rel).to_string_lossy().into_owned()] {
+                    for (resolver, accepts) in RESOLVERS {
+                        if accepts(&root, &path) {
+                            accepted.push(format!("{resolver}({path})"));
+                        }
+                    }
+                }
+            }
+            assert!(accepted.is_empty(), "{accepted:#?}");
+        }
+
+        #[test]
+        fn a_share_path_is_resolved_only_under_a_root_on_that_share() {
+            let root = Path::new(r"\\?\UNC\server\share\proj");
+            for path in
+                [r"\\server\share\proj\a.txt", r"\\SERVER\Share\Proj\src\..\a.txt", r"\\?\UNC\server\share\proj"]
+            {
+                assert_eq!(judge(Path::new(path), &[root]), Lexical::Resolvable, "{path}");
+            }
+            for path in [
+                r"\\server\other\a.txt",
+                r"\\elsewhere\share\proj\a.txt",
+                r"\\server\share\proj\..\..\other\a.txt",
+                r"\\server\share\project\a.txt",
+            ] {
+                assert_eq!(judge(Path::new(path), &[root]), Lexical::Outside, "{path}");
+                assert_eq!(judge(Path::new(path), &[Path::new(r"C:\proj")]), Lexical::Outside, "{path}");
+            }
+            for path in [r"C:\proj\a.txt", r"\\?\C:\elsewhere\a.txt", r"D:\x"] {
+                assert_eq!(judge(Path::new(path), &[root]), Lexical::Resolvable, "{path}");
+            }
+            assert_eq!(judge(Path::new(r"\\server\share\proj\a.txt:s"), &[root]), Lexical::Refused);
+            assert!(!names_device("console.log") && !names_device("com10") && !names_device("aux_utils.rs"));
+        }
+    }
 }

crates/ide-sdk/src/apply.rs

@@ -1620,6 +1620,17 @@ pub fn apply_to_run_configs_in(configs: &mut [RunConfig], root: &Path, fallback:
                     path_dirs.push(bin);
                 }
             }
+            // JAR Application's default JRE is the project JDK; a chosen JRE is an absolute `java`.
+            "jar-application" => {
+                if let Some(jdk) = &jdk
+                    && c.command == "java"
+                {
+                    let java = crate::java::java_executable(&jdk.home);
+                    if java.is_file() {
+                        c.command = java.to_string_lossy().into_owned();
+                    }
+                }
+            }
             "tomcat" => {
                 if let Some(jdk) = &jdk {
                     c.env.entry("JAVA_HOME".into()).or_insert_with(|| jdk.home.to_string_lossy().into_owned());

crates/ide-sdk/src/tests.rs

@@ -383,6 +383,30 @@ fn fake_jdk(dir: &Path) {
     std::fs::write(dir.join("bin").join(crate::exe("javac")), "").unwrap();
 }
 
+#[test]
+fn jar_application_runs_on_the_project_jdk_unless_a_jre_is_chosen() {
+    let tmp = tempfile::tempdir().unwrap();
+    let jdk = tmp.path().join("jbr");
+    fake_jdk(&jdk);
+    let mut s = Settings::default();
+    let mut configs = vec![run("jar-application", "java", &["-jar", "app.jar"])];
+    apply_to_run_configs(&mut configs, tmp.path(), &s);
+    assert_eq!(configs[0].command, "java", "java on PATH without a project JDK");
+
+    s.languages.java.jdk = jdk.to_string_lossy().into_owned();
+    let chosen = tmp.path().join("other/bin/java").to_string_lossy().into_owned();
+    let mut configs = vec![
+        run("jar-application", "java", &["-jar", "app.jar"]),
+        run("jar-application", &chosen, &["-jar", "app.jar"]),
+    ];
+    apply_to_run_configs(&mut configs, tmp.path(), &s);
+    let java = crate::java::java_executable(&project_jdk(tmp.path(), &s).unwrap().home).to_string_lossy().into_owned();
+    assert_eq!(configs[0].command, java);
+    assert_eq!(configs[1].command, chosen, "an explicit JRE stays");
+    // Saved as the default, so it follows a later Project JDK change.
+    assert_eq!(without_derived(&configs[0], tmp.path(), &s).command, "java");
+}
+
 #[test]
 fn project_jdk_and_maven_settings() {
     if cfg!(windows) {

crates/ide-vcs/src/lib.rs

@@ -745,6 +745,12 @@ impl Repo {
         let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
         &self.root
     }
+    /// git's own folders for this worktree: its git dir and the common one (they differ for a
+    /// linked worktree, whose `.git` file points into the main repository).
+    pub fn metadata_dirs(&self) -> IdeResult<[PathBuf; 2]> {
+        let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));
+        Ok([self.git_dir.clone(), repo::absolute(self.gix()?.common_dir())?])
+    }
     /// Untracked files with one of these names (or under such a folder) are not reported.
     pub fn set_ignored_names(&self, names: IgnoredNames) {
         let _scope = crate::ExecutionScope::enter(self.execution_allowed.load(std::sync::atomic::Ordering::Acquire));

crates/ide-workspace/src/dependencies/maven.rs

@@ -0,0 +1,182 @@
+//! Maven Central lookups for POM coordinate completion: the search endpoint's
+//! group and artifact suggestions, and the published version metadata of one
+//! artifact. The URLs and parsers are pure; the host op fetches and caches.
+use serde::Deserialize;
+
+/// The search endpoint's `docs` of one artifact coordinate each.
+#[derive(Deserialize)]
+struct SearchResponse {
+    #[serde(rename = "response")]
+    docs: SearchDocs,
+}
+
+#[derive(Deserialize)]
+struct SearchDocs {
+    docs: Vec<SearchDoc>,
+}
+
+#[derive(Deserialize)]
+struct SearchDoc {
+    g: String,
+    a: String,
+}
+
+/// Percent-encodes a query value; repository coordinates are ASCII words with
+/// `.` and `-`, so only a few characters ever get encoded.
+fn encoded(value: &str) -> String {
+    let mut out = String::with_capacity(value.len());
+    for byte in value.bytes() {
+        match byte {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'.' | b'_' | b'~' => out.push(byte as char),
+            _ => out.push_str(&format!("%{byte:02X}")),
+        }
+    }
+    out
+}
+
+/// A coordinate part a Central query may carry: repository ids are ASCII words
+/// with `.` and `-`, never whitespace, quotes or control characters.
+fn part(value: &str, max: usize) -> bool {
+    !value.is_empty()
+        && value.len() <= max
+        && value.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_' | '~'))
+}
+
+/// The search endpoint querying the group ids matching a typed prefix
+/// (`g:org.apache.ma*`), most recently updated first.
+pub fn groups_url(prefix: &str) -> Option<String> {
+    part(prefix, 100)
+        .then(|| format!("https://search.maven.org/solrsearch/select?q=g:{}*&rows=40&wt=json", encoded(prefix)))
+}
+
+/// The search endpoint querying the artifacts of one group matching a typed
+/// prefix (`g:"org.apache.maven" AND a:maven-c*`); an empty prefix asks the
+/// group's artifacts without a wildcard.
+pub fn artifacts_url(group: &str, prefix: &str) -> Option<String> {
+    (part(group, 200) && (prefix.is_empty() || part(prefix, 100))).then(|| {
+        let tail = if prefix.is_empty() { String::new() } else { format!("%20AND%20a:{}*", encoded(prefix)) };
+        format!("https://search.maven.org/solrsearch/select?q=g:%22{}%22{tail}&rows=30&wt=json", encoded(group))
+    })
+}
+
+/// The published version metadata of one artifact on Central.
+pub fn metadata_url(group: &str, artifact: &str) -> Option<String> {
+    (part(group, 200) && part(artifact, 100)).then(|| {
+        let path = group.split('.').chain(artifact.split('.')).collect::<Vec<_>>().join("/");
+        format!("https://repo1.maven.org/maven2/{path}/maven-metadata.xml")
+    })
+}
+
+/// The distinct `g` values of a search response, in the response's order (score
+/// descending); `None` when the document is not the shape the endpoint answers.
+pub fn parse_search_groups(text: &str) -> Option<Vec<String>> {
+    let docs: SearchResponse = serde_json::from_str(text).ok()?;
+    let mut out = Vec::new();
+    for doc in docs.docs.docs {
+        if doc.g.len() <= 200 && !out.contains(&doc.g) {
+            out.push(doc.g);
+        }
+    }
+    Some(out)
+}
+
+/// The distinct `a` values of a search response, in the response's order.
+pub fn parse_search_artifacts(text: &str) -> Option<Vec<String>> {
+    let docs: SearchResponse = serde_json::from_str(text).ok()?;
+    let mut out = Vec::new();
+    for doc in docs.docs.docs {
+        if doc.a.len() <= 100 && !out.contains(&doc.a) {
+            out.push(doc.a);
+        }
+    }
+    Some(out)
+}
+
+/// The `<versions>` of an artifact's `maven-metadata.xml`, newest first (the
+/// document lists them oldest first). A malformed document yields none.
+pub fn parse_metadata_versions(text: &str) -> Vec<String> {
+    let Some((_, after)) = text.split_once("<versions>") else { return Vec::new() };
+    let Some((inner, _)) = after.split_once("</versions>") else { return Vec::new() };
+    let mut out = Vec::new();
+    let mut rest = inner;
+    while let Some((_, after)) = rest.split_once("<version>") {
+        let Some((value, tail)) = after.split_once("</version>") else { break };
+        let value = value.trim();
+        if !value.is_empty() && value.len() <= 100 && out.last().is_none_or(|last| last != value) {
+            out.push(value.to_owned());
+        }
+        rest = tail;
+    }
+    out.reverse();
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn search_urls_encode_the_query() {
+        assert_eq!(
+            groups_url("org.apache.ma").as_deref(),
+            Some("https://search.maven.org/solrsearch/select?q=g:org.apache.ma*&rows=40&wt=json")
+        );
+        assert_eq!(
+            artifacts_url("org.apache.maven", "maven-c").as_deref(),
+            Some(
+                "https://search.maven.org/solrsearch/select?q=g:%22org.apache.maven%22%20AND%20a:maven-c*&rows=30&wt=json"
+            )
+        );
+        // An empty prefix asks the group's artifacts without a wildcard.
+        assert_eq!(
+            artifacts_url("org.example", "").as_deref(),
+            Some("https://search.maven.org/solrsearch/select?q=g:%22org.example%22&rows=30&wt=json")
+        );
+        // A quote, a space or a traversal in the coordinates drops the query.
+        assert_eq!(groups_url("org.apache\"ma"), None);
+        assert_eq!(groups_url(""), None);
+        assert_eq!(artifacts_url("org/../etc", "a"), None);
+        assert_eq!(artifacts_url("org.example", "a b"), None);
+        assert_eq!(metadata_url("org.example", "lib/../.."), None);
+    }
+
+    #[test]
+    fn metadata_url_paths_the_group() {
+        assert_eq!(
+            metadata_url("org.apache.maven", "maven-core").as_deref(),
+            Some("https://repo1.maven.org/maven2/org/apache/maven/maven-core/maven-metadata.xml")
+        );
+    }
+
+    #[test]
+    fn search_response_parses_distinct_coordinates() {
+        let doc = r#"{"response":{"numFound":2,"docs":[
+            {"g":"org.example","a":"lib","latestVersion":"2.0"},
+            {"g":"org.example","a":"lib"},
+            {"g":"org.example","a":"lib-other"}]}}"#;
+        assert_eq!(parse_search_groups(doc).unwrap(), ["org.example"]);
+        assert_eq!(parse_search_artifacts(doc).unwrap(), ["lib", "lib-other"]);
+        assert_eq!(parse_search_groups("not json"), None);
+    }
+
+    #[test]
+    fn metadata_versions_read_newest_first() {
+        let metadata = r#"<?xml version="1.0"?>
+<metadata>
+  <groupId>org.example</groupId>
+  <artifactId>lib</artifactId>
+  <versioning>
+    <latest>2.0</latest>
+    <versions>
+      <version>1.0</version>
+      <version>1.9.1</version>
+      <version>2.0-beta-1</version>
+      <version>2.0</version>
+    </versions>
+  </versioning>
+</metadata>"#;
+        assert_eq!(parse_metadata_versions(metadata), ["2.0", "2.0-beta-1", "1.9.1", "1.0"]);
+        assert!(parse_metadata_versions("<metadata><groupId>x</groupId></metadata>").is_empty());
+        assert!(parse_metadata_versions("").is_empty());
+    }
+}

crates/ide-workspace/src/dependencies/mod.rs

@@ -2,6 +2,7 @@
 mod cache;
 pub mod cargo;
 pub mod go;
+pub mod maven;
 pub mod npm;
 
 pub use cache::VersionCache;

crates/ide-workspace/src/settings.rs

@@ -27,12 +27,57 @@ pub enum SettingsScope {
     Project,
 }
 
-fn remove_global_settings(layer: &mut Json) {
-    if let Some(layer) = layer.as_object_mut() {
-        layer.remove("mcpServer");
+/// Settings a project's own file can't hold: the IDE's MCP server, imported color schemes, and
+/// what agents may do without asking (commands run without asking, the modes new tasks start in,
+/// whether new tasks ask for approvals).
+const USER_ONLY: [&[&str]; 5] = [
+    &["mcpServer"],
+    &["editor", "customSchemes"],
+    &["agentSecurity", "allowedCommands"],
+    &["agents", "defaults"],
+    &["agents", "newTaskApprovals"],
+];
+
+/// The [`USER_ONLY`] setting that writing `value` at `key` would set, as a dotted key.
+fn user_only_setting(key: &str, value: &Json) -> Option<String> {
+    let segments: Vec<&str> = key.split('.').collect();
+    USER_ONLY
+        .iter()
+        .find(|path| match path.split_at_checked(segments.len()) {
+            Some((head, rest)) => head == segments && rest.iter().try_fold(value, |v, seg| v.get(seg)).is_some(),
+            None => segments.starts_with(path),
+        })
+        .map(|path| path.join("."))
+}
+
+/// Applies a project layer's limits before it merges onto `below`: [`USER_ONLY`] settings are
+/// dropped, and its blocked agent commands add to the ones below instead of replacing them.
+fn restrict_project_layer(below: &Json, layer: &mut Json) {
+    for path in USER_ONLY {
+        let (last, parents) = path.split_last().expect("non-empty path");
+        if let Some(table) = parents.iter().try_fold(&mut *layer, |v, seg| v.get_mut(seg)).and_then(Json::as_object_mut)
+        {
+            table.remove(*last);
+        }
     }
-    if let Some(editor) = layer.get_mut("editor").and_then(Json::as_object_mut) {
-        editor.remove("customSchemes");
+    if let (Some(inherited), Some(blocked)) = (
+        below.pointer("/agentSecurity/blockedCommands").and_then(Json::as_array),
+        layer.pointer_mut("/agentSecurity/blockedCommands").and_then(Json::as_array_mut),
+    ) {
+        let mut all = inherited.clone();
+        for pattern in blocked.drain(..) {
+            if !all.contains(&pattern) {
+                all.push(pattern);
+            }
+        }
+        *blocked = all;
+    }
+    // The IDE-wide interpreter list, its view options and the project interpreters of
+    // other projects belong to the user's settings, not to one project.
+    if let Some(python) = layer.get_mut("languages").and_then(|l| l.get_mut("python")).and_then(Json::as_object_mut) {
+        for key in ["interpreters", "hiddenInterpreters", "hideOtherProjectInterpreters", "showInterpreterPaths"] {
+            python.remove(key);
+        }
     }
 }
 
@@ -224,7 +269,7 @@ impl SettingsStore {
         for (scope, file) in self.layers() {
             let Some(mut layer) = read_layer(&file) else { continue };
             if scope == SettingsScope::Project {
-                remove_global_settings(&mut layer);
+                restrict_project_layer(&merged, &mut layer);
             }
             if let Err(e) = try_merge(&mut merged, layer) {
                 tracing::warn!("{} has invalid settings, ignoring it: {e}", file.display());
@@ -254,7 +299,7 @@ impl SettingsStore {
             && let Some(mut layer) = read_layer(file)
         {
             if scope == SettingsScope::Project {
-                remove_global_settings(&mut layer);
+                restrict_project_layer(&merged, &mut layer);
             }
             if let Err(e) = try_merge(&mut merged, layer) {
                 tracing::warn!("{} has invalid settings, ignoring it: {e}", file.display());
@@ -268,14 +313,9 @@ impl SettingsStore {
     /// wrong type are rejected with `InvalidInput`; the file is left untouched.
     pub fn set(&self, scope: SettingsScope, key: &str, value: serde_json::Value) -> IdeResult<Settings> {
         if scope == SettingsScope::Project
-            && (key == "editor.customSchemes"
-                || key.starts_with("editor.customSchemes.")
-                || (key == "editor" && value.get("customSchemes").is_some()))
+            && let Some(setting) = user_only_setting(key, &value)
         {
-            return Err(IdeError::invalid("custom color schemes belong to user settings"));
-        }
-        if scope == SettingsScope::Project && (key == "mcpServer" || key.starts_with("mcpServer.")) {
-            return Err(IdeError::invalid("MCP server belongs to user settings"));
+            return Err(IdeError::invalid(format!("{setting} belongs to user settings")));
         }
         let file = self.file(scope).ok_or_else(|| IdeError::invalid("no project is open"))?.to_path_buf();
         let segments: Vec<&str> = key.split('.').collect();
@@ -316,7 +356,7 @@ impl SettingsStore {
             let layer = if is_target { parse_layer(&new_text).ok() } else { read_layer(&layer_file) };
             let Some(mut layer) = layer else { continue };
             if layer_scope == SettingsScope::Project {
-                remove_global_settings(&mut layer);
+                restrict_project_layer(&merged, &mut layer);
             }
             if let Err(e) = try_merge(&mut merged, layer)
                 && is_target
@@ -533,6 +573,34 @@ mod tests {
         assert!(SettingsStore::load(&cfg, Some(&proj)).effective().editor.custom_schemes.is_empty());
     }
 
+    #[test]
+    fn the_interpreter_list_and_its_view_options_are_user_settings() {
+        let tmp = tempfile::tempdir().unwrap();
+        let cfg = tmp.path().join("cfg");
+        let proj = tmp.path().join("proj");
+        std::fs::create_dir_all(proj.join(".openidea")).unwrap();
+        let store = SettingsStore::load(&cfg, Some(&proj));
+        store.set(SettingsScope::Global, "languages.python.interpreters", json!(["/envs/a/bin/python"])).unwrap();
+        store.set(SettingsScope::Global, "languages.python.showInterpreterPaths", json!(false)).unwrap();
+        let loaded = SettingsStore::load(&cfg, Some(&proj)).effective();
+        assert_eq!(loaded.languages.python.interpreters, ["/envs/a/bin/python"]);
+        assert!(!loaded.languages.python.show_interpreter_paths);
+
+        // A project's own settings.toml cannot change the IDE-wide list or its view options.
+        std::fs::write(
+            proj.join(".openidea/settings.toml"),
+            "[languages.python]\ninterpreters = [\"/proj/bin/python\"]\n\
+             hiddenInterpreters = [\"/envs/a/bin/python\"]\nhideOtherProjectInterpreters = true\n\
+             showInterpreterPaths = true\n",
+        )
+        .unwrap();
+        let loaded = SettingsStore::load(&cfg, Some(&proj)).effective();
+        assert_eq!(loaded.languages.python.interpreters, ["/envs/a/bin/python"]);
+        assert!(loaded.languages.python.hidden_interpreters.is_empty());
+        assert!(!loaded.languages.python.hide_other_project_interpreters);
+        assert!(!loaded.languages.python.show_interpreter_paths);
+    }
+
     #[test]
     fn layering_and_fallback() {
         let tmp = tempfile::tempdir().unwrap();
@@ -1030,4 +1098,81 @@ mod tests {
                 .enabled
         );
     }
+
+    #[test]
+    fn a_project_file_can_only_add_to_the_agent_policy() {
+        let tmp = tempfile::tempdir().unwrap();
+        let config = tmp.path().join("config");
+        let project = tmp.path().join("project");
+        std::fs::create_dir_all(project.join(".openidea")).unwrap();
+        std::fs::create_dir_all(&config).unwrap();
+        std::fs::write(
+            config.join("settings.toml"),
+            "[agentSecurity]\nallowedCommands = [\"git status\"]\nblockedCommands = [\"git push*\"]\n\n\
+             [agents.defaults.claude]\nmodel = \"opus\"\n",
+        )
+        .unwrap();
+        let project_file = project.join(".openidea/settings.toml");
+        std::fs::write(
+            &project_file,
+            "[agentSecurity]\nallowedCommands = [\"node\"]\nblockedCommands = [\"npm publish*\"]\n\n\
+             [agents.defaults.claude]\nmode = \"bypassPermissions\"\n\n\
+             [agents.defaults.codex]\nmode = \"full-access\"\n",
+        )
+        .unwrap();
+        let store = SettingsStore::load(&config, Some(&project));
+        let s = store.effective();
+        assert_eq!(s.agent_security.allowed_commands, ["git status"]);
+        assert_eq!(s.agent_security.blocked_commands, ["git push*", "npm publish*"]);
+        assert_eq!(
+            s.agents.defaults,
+            BTreeMap::from([("claude".to_owned(), BTreeMap::from([("model".to_owned(), "opus".to_owned())]))])
+        );
+        let layer = store.layer(SettingsScope::Project);
+        assert!(layer.agent_security.allowed_commands.is_empty());
+        assert!(layer.agents.defaults.is_empty());
+
+        // An empty project list doesn't clear the user's, nor the built-in one.
+        std::fs::write(&project_file, "[agentSecurity]\nblockedCommands = []\n").unwrap();
+        assert_eq!(store.reload().agent_security.blocked_commands, ["git push*"]);
+        std::fs::remove_file(config.join("settings.toml")).unwrap();
+        assert_eq!(
+            store.reload().agent_security.blocked_commands,
+            ide_core::settings::AgentSecuritySettings::default().blocked_commands
+        );
+
+        for (key, value) in [
+            ("agentSecurity.allowedCommands", json!(["node"])),
+            ("agentSecurity", json!({"allowedCommands": ["node"], "blockedCommands": []})),
+            ("agents.defaults", json!({"claude": {"mode": "bypassPermissions"}})),
+            ("agents.defaults.claude", json!({"mode": "bypassPermissions"})),
+            ("agents.defaults.claude.mode", json!("bypassPermissions")),
+            ("agents", json!({"defaults": {"codex": {"mode": "full-access"}}})),
+        ] {
+            assert!(store.set(SettingsScope::Project, key, value).is_err(), "{key}");
+        }
+        let s = store.set(SettingsScope::Project, "agentSecurity.blockedCommands", json!(["curl*"])).unwrap();
+        assert!(s.agent_security.blocked_commands.ends_with(&["curl*".to_owned()]));
+        assert!(s.agent_security.blocked_commands.contains(&"rm -rf /".to_owned()));
+        let s = store.set(SettingsScope::Project, "agents.showCost", json!(true)).unwrap();
+        assert!(s.agents.show_cost);
+    }
+
+    #[test]
+    fn new_task_approvals_are_a_user_setting() {
+        let tmp = tempfile::tempdir().unwrap();
+        let config = tmp.path().join("config");
+        let project = tmp.path().join("project");
+        std::fs::create_dir_all(project.join(".openidea")).unwrap();
+        std::fs::write(project.join(".openidea/settings.toml"), "[agents]\nnewTaskApprovals = \"ask\"\n").unwrap();
+        let settings = SettingsStore::load(&config, Some(&project));
+        use ide_core::settings::NewTaskApprovals;
+        assert_eq!(settings.effective().agents.new_task_approvals, NewTaskApprovals::Bypass);
+        assert!(settings.set(SettingsScope::Project, "agents.newTaskApprovals", json!("bypass")).is_err());
+        assert!(settings.set(SettingsScope::Project, "agents", json!({"newTaskApprovals": "bypass"})).is_err());
+        let s = settings.set(SettingsScope::Global, "agents.newTaskApprovals", json!("ask")).unwrap();
+        assert_eq!(s.agents.new_task_approvals, NewTaskApprovals::Ask);
+        std::fs::write(project.join(".openidea/settings.toml"), "[agents]\nnewTaskApprovals = \"bypass\"\n").unwrap();
+        assert_eq!(settings.reload().agents.new_task_approvals, NewTaskApprovals::Ask);
+    }
 }

deny.toml

@@ -24,6 +24,7 @@ multiple-versions = "warn"
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-# SQLx's unreleased SQLite dependency ceiling fix, pinned in Cargo.toml.
-allow-git = ["https://github.com/transact-rs/sqlx"]
+# SQLx at a pinned rev: upstream's unreleased SQLite dependency ceiling fix plus the MySQL
+# `deprecate_eof` option (transact-rs/sqlx#4507), until a release carries both.
+allow-git = ["https://github.com/l0ng-ai/sqlx"]
 required-git-spec = "rev"

docs/en/contribute/architecture/frontend.mdx

@@ -84,6 +84,10 @@ Main fields:
 
 Run actions with `executeAction(id, arg?)`. `registerAction` returns a disposer.
 
+### Context-menu owners
+
+`showContextMenu(at, items, { owner })` can associate a menu with its target element without selecting it. `ContextMenuHost` marks that element with `data-context-menu-open` while the menu is open and removes the marker on dismissal, replacement or unmount. Shared Tabs styles use the marker to retain the target's hover appearance without overriding selected or tinted tabs. Ownership is opt-in; database result tabs supply it for pointer and keyboard menu gestures.
+
 ## Keymaps and the dispatcher
 
 Default shortcuts live in `src/platform/keymaps/`, never on the action. A keymap maps action ids to bindings:
@@ -104,6 +108,10 @@ Binding syntax: modifiers `Meta Ctrl Alt Shift` joined with `+` to a key (`Meta+
 
 `installKeyboardDispatcher` listens to `keydown` in the capture phase so IDE shortcuts win over CodeMirror's defaults, resolves the stroke against the active keymap plus the user's overrides, and runs the first enabled action (`when` and `keyWhen`). A component that needs a keystroke for itself registers a key claim (`registerKeyClaim`), e.g. Vim mode for its shortcut conflicts.
 
+Blocking prompts (`promptInput`, `chooseItem`, `pickItems` and message dialogs) opt into `<Dialog blockWorkbenchShortcuts>`. Its effect acquires the reference-counted `suspendKeyboardDispatch()` guard and releases it on cleanup, so closing a nested prompt does not resume background shortcuts while another prompt is open. Native field editing and dialog-local keys still work. This is opt-in: non-modal workbench popups such as Search Everywhere keep their existing routing.
+
+Suspended keyboard and mouse dispatch clears pending chords and modifier taps, preventing a stale shortcut from firing after dismissal. Plain text fields also retain native, unshifted `Backspace`/`Delete` combinations; Shift-modified bindings and terminal inputs keep their existing routing.
+
 ## Context keys and `when` clauses
 
 Components publish facts as context keys (`src/platform/context.ts`); actions and keybindings are enabled by a `when` expression over them.

docs/en/guide/agents.mdx

@@ -71,6 +71,8 @@ On your own messages you can **Edit** (the messages after it are replaced; files
 
 When an agent wants to run a command or call a tool that needs approval, the task shows the request and is listed as **Needs Input**. Choose one of the options the agent offers, such as **Allow Once**, **Allow for This Session**, **Always Allow**, **Decline**, **Always Decline** or **Decline and Stop**. Many agents also have a mode picker that approves edits or everything automatically; use it with care.
 
+Once an agent has run a task, new tasks start in its mode that approves everything (Claude Code's bypass permissions, Codex's Full Access), and the Command Execution Policy doesn't apply there. To start them in a mode that asks, set **Settings › Agents › Chat › New tasks start** to **Asking for approval**. Only your own settings choose this, never a project's.
+
 ### Review the changes
 
 Click **Show changes** in the task header to list the files the task changed. Click a file to open a diff between the task's starting point and now. For a worktree task, the changes live on its `agent/…` branch: open a terminal there with **Open in Terminal**, and merge or cherry-pick the branch with the Git tools (see [Version control](/en/guide/vcs)) when you are happy with it.
@@ -85,7 +87,9 @@ Click **Show changes** in the task header to list the files the task changed. Cl
 
 The **Agents** tool window lists the project's tasks by what they need from you: **Needs Input**, **Failed**, usage limit reached, **Running**, **Ready to Review** and **Archived**. Its badge counts tasks that need input or have unread replies.
 
-Tasks open in editor tabs by default. **Chat in Tool Window** and **Chat in Editor** switch where conversations open; you can also drag a task into the editor area. A task's context menu has **Open**, **Rename…**, **Open in Terminal**, **Copy to a New Task**, **Archive** / **Unarchive** and **Delete…**. Deleting a worktree task also removes its worktree.
+Tasks open in editor tabs by default. **Chat in Tool Window** and **Chat in Editor** switch where conversations open; you can also drag a task into the editor area. A task's context menu has **Open**, **Rename…**, **Open in Terminal**, **Copy to a New Task**, **Pin** / **Unpin**, **Move to Group**, **Archive** / **Unarchive** and **Delete…**. Deleting a worktree task also removes its worktree.
+
+Pinned tasks sit above every group. **Move to Group** puts a task in a group of your own, and so does dropping it on a group header; **New Group…** in the tool window's options menu (⋯) creates an empty one, and a group's own menu renames or removes it. Groups and pins are kept per project.
 
 Tasks are saved per project and survive restarts. When the agent supports resuming sessions, the conversation continues where it left off on the next message; such an agent is also stopped after five idle minutes and started again when you send the next message.
 
@@ -93,7 +97,7 @@ Tasks are saved per project and survive restarts. When the agent supports resumi
 
 **Settings › Tools › Agents** (also **More Agents…** in the agent picker) has two tabs:
 
-- **Built-in**: for each built-in agent, whether its executable was found on `PATH`, a field to point at a **Custom executable**, **Environment variables** for the agent process (written as `NAME=value; OTHER=value`) and how to sign in. Changes apply to new sessions.
+- **Built-in**: for each built-in agent, whether its executable was found on `PATH`, a field to point at a **Custom executable**, **Environment variables** for the agent process (written as `NAME=value; OTHER=value`; the values are kept in the OS credential store) and how to sign in. Changes apply to new sessions.
 - **ACP Registry**: agents published in the [ACP Registry](https://agentclientprotocol.com). Search, **Install**, **Update** and **Remove**. Installed agents are kept in OpenIDEA's data directory; downloads are checked against the registry's SHA-256 when it provides one.
 
 **Settings › Tools › Agents › Chat** chooses what the task header shows: **Context window usage**, **Time spent on the task**, **Usage limits** (when the agent reports them, such as Claude Code) and **Session cost**.
@@ -128,7 +132,9 @@ MY_AGENT_LOG = "info"
   Arguments that start the agent in ACP mode.
 </ParamField>
 <ParamField path="env" type="table">
-  Extra environment variables for the agent process.
+  Extra environment variables for the agent process. OpenIDEA moves their values to the OS credential store the next
+  time it reads the file, and keeps only the names in it (with empty values). An agent installed from the ACP Registry
+  keeps the environment its registry entry sets in the file.
 </ParamField>
 <ParamField path="driver" type="string" default="acp">
   `acp` for an ACP agent. `claude` and `codex` use the Claude Code and Codex protocols instead.

docs/en/guide/code-intelligence.mdx

@@ -73,7 +73,7 @@ Going to files, classes and symbols by name is covered in [Search and navigation
 
 **Find Usages** lists the results in the **Find Usages** tool window, grouped by file, with a preview. **Show Usages** shows them in a popup at the caret. The occurrences of the symbol under the caret are highlighted in the editor as you move.
 
-Above declarations, a **N usages** hint and the last author of the code (from Git blame) are shown. Turn them off under **Code Vision** in **Settings › Editor › Inlay Hints**.
+Above declarations, a **N usages** hint and the last author of the code (from Git blame) are shown, with the date of that last change. Turn them off under **Code Vision** in **Settings › Editor › Inlay Hints**.
 
 ## Documentation and information
 

docs/en/guide/database.mdx

@@ -120,6 +120,10 @@ SQL completion knows the connected schema: tables after `FROM`/`JOIN` (with join
 
 Results appear in the **Services** tool window under the **Database** tab: an **Output** tab logs every statement, and each result set gets a **Result N** tab (up to 12).
 
+Right-click a result tab (or focus it and press `Shift+F10`) for **Close**, **Close Others**, **Close All**, **Rename Tab**, **Select Next Tab** and **Select Previous Tab**. They act on the result tabs only; **Output** stays. Renamed titles last while the result is open.
+
+Closing a selected result activates its left neighbor, or its right neighbor if there is no result on the left. When no results remain, **Output** is selected. Closing an inactive result keeps the current selection.
+
 - **Table** or **Chart** view (bar or line, with X/Y columns and an aggregation).
 - Paging with page sizes 10 to 1,000; click the row count to count all rows.
 - **Search in results** and a per-column local filter on the loaded rows.

docs/en/plugins/capabilities.mdx

@@ -75,7 +75,7 @@ The **API** column is the oldest plugin API the manifest may admit when it decla
 
 - `net:<host>` allows HTTPS (and HTTP to loopback) to that host on any port. `*.example.com` matches any subdomain, not the apex.
 - `net.http:<host>` allows unencrypted HTTP; it does not imply HTTPS. An HTTPS → HTTP redirect also needs `net.http:`.
-- Each redirect is checked before connecting. Responses are limited to 8 MiB. Requests run on the machine where the project is.
+- Each redirect is checked before connecting. Responses are limited to 16 MiB. Requests run on the machine where the project is.
 - `net:ask` (API 1.5) lets a plugin reach HTTPS hosts it didn't list. The first request to a new host asks the user, naming the plugin and the host, with **Allow once**, **Always allow** and **Deny** (remote sessions offer **Allow for this session** and **Deny**). "Always" is remembered per exact host and listed in the plugin's permissions, where it can be removed. Calls without a window (scheduled work, event handlers, providers) never ask and get `denied`. Plain HTTP never goes through this flow.
 
 ## Secrets

docs/en/reference/data-directories.mdx

@@ -65,9 +65,23 @@ setx OPENIDEA_LOCAL_DATA_DIR "E:\OpenIDEA"
 On macOS and Linux, set it in the environment OpenIDEA starts from.
 
 - If the path is relative or can't be written to, OpenIDEA shows an error and exits instead of falling back to the default location.
-- Configuration, user data and logs stay where they are. Logs are still written when the variable is wrong, so you can find out why.
+- Configuration, user data and logs stay where they are unless you move them too (see below). Logs are still written when the variable is wrong, so you can find out why.
 - Existing data is not moved. Either let OpenIDEA download and rebuild it, or quit OpenIDEA and move only `tools/`, `language-server-runtimes/`, `index/`, `cache/`, `lsp/`, `notebook-runtime/`, `server/`, `logs/`, `agents/tools/`, `agents/registry.json` and the top-level `java-usages-*.jar` / `java-usages-*.tmp` files, keeping their relative paths. Leave everything else in place.
 
+## Move configuration, user data or logs
+
+Each of the other directories has its own variable, set the same way as `OPENIDEA_LOCAL_DATA_DIR`: an absolute path, read when OpenIDEA starts. OpenIDEA then uses `<path>/ai.l0ng.openidea` and creates it if missing.
+
+| Variable              | Moves         |
+| --------------------- | ------------- |
+| `OPENIDEA_CONFIG_DIR` | Configuration |
+| `OPENIDEA_DATA_DIR`   | User data     |
+| `OPENIDEA_LOG_DIR`    | Logs          |
+
+- Set only the ones you want to move; the rest keep their default locations. Pointing several variables at the same path is fine.
+- If the configuration or user data path is relative or can't be used, OpenIDEA shows an error and exits instead of falling back to the default location. A wrong log path only turns off the log file.
+- Existing files are not moved. To keep your settings, plugins and history, quit OpenIDEA and copy the old folder's contents to the new location first.
+
 ## Logs
 
 OpenIDEA writes one log file per day, `openidea.<date>.log`, and keeps the last 7. Panics are written to the current log too.

docs/en/reference/settings.mdx

@@ -18,7 +18,9 @@ Settings are combined from three layers, each overriding the one before:
 
 A file holds only the values that differ from the layer below. Tables merge key by key; a value or array in a higher layer replaces the lower one entirely (for example, setting `files.exclude` in a project replaces the global list).
 
-Some settings are ignored in the project file: `mcpServer` and imported color schemes (`editor.customSchemes`) are global only. Project trust is never read from settings.
+Some settings are ignored in the project file: `mcpServer`, imported color schemes (`editor.customSchemes`) and `agents.newTaskApprovals` are global only. Project trust is never read from settings.
+
+A project file can't loosen what coding agents may do: `agentSecurity.allowedCommands` and `agents.defaults` are global only, and `agentSecurity.blockedCommands` in a project adds to the global list rather than replacing it. An MCP server in the project's `agents.mcpServers` stays off until you turn it on in **Settings › Agents › External MCP Servers**, and again after its definition changes.
 
 ## File format
 

docs/zh/contribute/architecture/frontend.mdx

@@ -84,6 +84,10 @@ registerAction({
 
 用 `executeAction(id, arg?)` 执行 action。`registerAction` 返回 disposer。
 
+### 右键菜单的所属元素
+
+`showContextMenu(at, items, { owner })` 可以将菜单关联到目标元素，而不选中该元素。菜单打开期间，`ContextMenuHost` 为目标添加 `data-context-menu-open` 标记，并在关闭、替换或卸载菜单时移除。共享 Tabs 样式通过该标记保留目标的悬停外观，不覆盖已选中或带颜色标签页的样式。该行为需要显式启用；数据库结果标签页会为鼠标和键盘菜单操作提供所属元素。
+
 ## Keymap 与键盘分发
 
 默认快捷键写在 `src/platform/keymaps/` 里，而不是写在 action 上。keymap 是 action id 到绑定的映射：
@@ -104,6 +108,10 @@ export const intellijMacos: Record<string, string[]> = {
 
 `installKeyboardDispatcher` 在捕获阶段监听 `keydown`，因此 IDE 快捷键优先于 CodeMirror 的默认按键；它把击键与当前 keymap 及用户覆盖项匹配，然后运行第一个启用的 action（满足 `when` 和 `keyWhen`）。需要自己处理某个按键的组件注册一个 key claim（`registerKeyClaim`），比如 Vim 模式处理快捷键冲突时。
 
+阻塞式提示框（`promptInput`、`chooseItem`、`pickItems` 和消息对话框）通过 `<Dialog blockWorkbenchShortcuts>` 显式启用快捷键隔离。其 effect 获取带引用计数的 `suspendKeyboardDispatch()` 保护，并在清理时释放，因此关闭嵌套提示框不会在其他提示框仍打开时恢复后台快捷键。输入框的系统文本编辑和对话框内部按键仍然有效。该行为需要显式启用：Search Everywhere 等非模态工作台弹出框保留原有的按键路由。
+
+暂停期间，键盘和鼠标分发会清除待完成的组合键及修饰键连按状态，避免关闭提示框后触发残留快捷键。普通文本输入框也会保留未按 Shift 的原生 `Backspace`/`Delete` 组合键；带 Shift 的绑定和终端输入保持原有路由。
+
 ## 上下文键与 `when` 子句
 
 组件把事实发布为上下文键（`src/platform/context.ts`）；action 和快捷键通过基于这些键的 `when` 表达式决定是否启用。

docs/zh/guide/agents.mdx

@@ -71,6 +71,8 @@ OpenIDEA 本身不带模型或账号：它启动你已安装并登录的 agent
 
 agent 要运行命令或调用需要授权的工具时，任务中会显示请求，并归入 **等待输入**。从 agent 提供的选项中选择，例如 **允许一次**、**在此会话中允许**、**始终允许**、**拒绝**、**始终拒绝** 或 **拒绝并停止**。很多 agent 还有模式选择器，可以自动批准编辑甚至所有操作，请谨慎使用。
 
+agent 运行过一个任务后，新任务会以它自动批准所有操作的模式开始（Claude Code 的绕过权限、Codex 的完全访问），此时命令执行策略不生效。要让新任务以请求批准的模式开始，把 **设置 › 智能体 › 聊天 › 新任务开始时** 设为 **请求批准**。这一项只由你自己的设置决定，项目设置无法更改。
+
 ### 查看改动
 
 在任务标题栏中单击 **显示更改**，列出任务改动过的文件；单击文件可以打开它从任务开始到现在的 diff。worktree 任务的改动在它的 `agent/…` 分支上：用 **在终端中打开** 在那里打开终端，满意后用 Git 工具合并或 cherry-pick 这个分支（见 [版本控制](/zh/guide/vcs)）。
@@ -85,7 +87,9 @@ agent 要运行命令或调用需要授权的工具时，任务中会显示请
 
 **智能体** 工具窗口按需要你处理的程度列出项目中的任务：**等待输入**、**失败**、用量到达上限、**正在运行**、**待审阅** 和 **已归档**。它的角标显示等待输入或有未读回复的任务数。
 
-任务默认在编辑器标签页中打开。**在工具窗口中聊天** 和 **在编辑器中聊天** 切换对话的打开位置，也可以把任务拖到编辑区。任务的右键菜单中有 **打开**、**重命名…**、**在终端中打开**、**复制为新任务**、**归档** / **取消归档** 和 **删除…**。删除 worktree 任务时会一并删除它的 worktree。
+任务默认在编辑器标签页中打开。**在工具窗口中聊天** 和 **在编辑器中聊天** 切换对话的打开位置，也可以把任务拖到编辑区。任务的右键菜单中有 **打开**、**重命名…**、**在终端中打开**、**复制为新任务**、**固定** / **取消固定**、**移动到组**、**归档** / **取消归档** 和 **删除…**。删除 worktree 任务时会一并删除它的 worktree。
+
+置顶的任务显示在所有分组之上。**移动到组** 可以把任务放进自建的分组，把它拖到分组标题上也可以；工具窗口选项菜单（⋯）中的 **新建组…** 新建空分组，分组自身的菜单可以重命名或移除它。分组和置顶状态按项目保存。
 
 任务按项目保存，重启后仍在。agent 支持恢复会话时，下次发消息会从上次中断处继续；这类 agent 空闲五分钟后会被停止，下次发消息时再重新启动。
 
@@ -93,7 +97,7 @@ agent 要运行命令或调用需要授权的工具时，任务中会显示请
 
 **设置 › 工具 › 智能体**（也可以在 agent 选择器中点 **更多 Agent…**）有两个标签页：
 
-- **内置**：每个内置 agent 的可执行文件是否在 `PATH` 中找到、指定 **自定义可执行文件** 的输入框、传给 agent 进程的 **环境变量**（格式为 `NAME=value; OTHER=value`）以及登录方式。改动对新会话生效。
+- **内置**：每个内置 agent 的可执行文件是否在 `PATH` 中找到、指定 **自定义可执行文件** 的输入框、传给 agent 进程的 **环境变量**（格式为 `NAME=value; OTHER=value`；这些值保存在系统凭据存储中）以及登录方式。改动对新会话生效。
 - **ACP 注册表**：[ACP Registry](https://agentclientprotocol.com) 中发布的 agent，可以搜索、**安装**、**更新** 和 **移除**。安装的 agent 保存在 OpenIDEA 的数据目录中；注册表提供 SHA-256 时会校验下载内容。
 
 **设置 › 工具 › 智能体 › 聊天** 决定任务标题栏显示哪些信息：**上下文窗口用量**、**任务耗时**、**用量限额**（agent 报告时，例如 Claude Code）和 **会话花费**。
@@ -128,7 +132,8 @@ MY_AGENT_LOG = "info"
   以 ACP 模式启动 agent 所需的参数。
 </ParamField>
 <ParamField path="env" type="table">
-  传给 agent 进程的额外环境变量。
+  传给 agent 进程的额外环境变量。OpenIDEA 下次读取该文件时会把这些值移到系统凭据存储中，文件里只保留变量名（值为空）。从
+  ACP Registry 安装的 agent 会把其注册表条目设置的环境变量保留在文件中。
 </ParamField>
 <ParamField path="driver" type="string" default="acp">
   ACP agent 用 `acp`；`claude` 和 `codex` 分别使用 Claude Code 和 Codex 的协议。

docs/zh/guide/code-intelligence.mdx

@@ -73,7 +73,7 @@ description: "代码补全、导航、查找用法、文档、层次结构与文
 
 **查找用法** 把结果按文件分组列在 **查找用法** 工具窗口中，并带预览。**显示用法** 在光标处用弹窗显示。移动光标时，编辑器会自动高亮光标下符号的所有出现位置。
 
-声明上方会显示用法数量（如 `3 usages`）和这段代码最后的作者（来自 Git blame）。可以在 **设置 › 编辑器 › 嵌入提示** 的 **Code Vision** 一节中关闭。
+声明上方会显示用法数量（如 `3 usages`）和这段代码最后的作者（来自 Git blame），并标注最近一次修改的日期。可以在 **设置 › 编辑器 › 嵌入提示** 的 **Code Vision** 一节中关闭。
 
 ## 文档与信息
 

docs/zh/guide/database.mdx

@@ -120,6 +120,10 @@ SQL 补全基于已连接的架构：`FROM`/`JOIN` 后补全表（并根据外
 
 结果显示在 **服务** 工具窗口的 **数据库** 标签页中：**输出** 标签页记录每条语句，每个结果集一个 **Result N** 标签页（最多 12 个）。
 
+右键点击结果标签页（或聚焦后按 `Shift+F10`），可使用 **关闭**、**关闭其他**、**全部关闭**、**重命名标签页**、**选择下一个标签页** 和 **选择上一个标签页**。这些操作只作用于结果标签页，**输出** 始终保留。重命名的标题在结果关闭前一直有效。
+
+关闭当前选中的结果标签页时，优先选中左侧相邻的结果；没有左侧结果时，选中右侧相邻结果。没有剩余结果时，选中 **输出**。关闭未选中的结果不会改变当前选择。
+
 - **表** 或 **图表** 视图（柱状图或折线图，可选 X/Y 列和聚合方式）。
 - 分页，每页 10 到 1,000 行；点击行数可以统计总行数。
 - **在结果中搜索**，以及按列对已加载行进行本地筛选。

docs/zh/plugins/capabilities.mdx

@@ -75,7 +75,7 @@ optional = ["net:api.example.com", "secrets"]
 
 - `net:<host>` 允许通过 HTTPS（以及 HTTP 访问回环地址）连接该主机的任意端口。`*.example.com` 匹配所有子域名，不包括主域名本身。
 - `net.http:<host>` 允许未加密的 HTTP，但不包含 HTTPS。从 HTTPS 重定向到 HTTP 也需要 `net.http:`。
-- 每次重定向都会在连接前检查。响应上限 8 MiB。请求在项目所在的机器上发出。
+- 每次重定向都会在连接前检查。响应上限 16 MiB。请求在项目所在的机器上发出。
 - `net:ask`（API 1.5）允许插件访问清单中没有列出的 HTTPS 主机。第一次请求新主机时会询问用户，显示插件名和主机名，选项为 **这次允许**、**一直允许** 和 **拒绝**（远程会话中为 **本次会话内允许** 和 **拒绝**）。“一直允许”按精确主机记住，并显示在插件的权限中，可以随时移除。没有窗口的调用（定时任务、事件处理、provider）从不询问，直接得到 `denied`。普通 HTTP 永远不走这个流程。
 
 ## 密钥

docs/zh/reference/data-directories.mdx

@@ -65,9 +65,23 @@ setx OPENIDEA_LOCAL_DATA_DIR "E:\OpenIDEA"
 在 macOS 和 Linux 上，需要在启动 OpenIDEA 的环境中设置这个变量。
 
 - 如果路径是相对路径或不可写，OpenIDEA 会显示错误并退出，而不会退回默认位置。
-- 配置、用户数据和日志的位置不变。即使变量设置有误，日志仍会写入，方便排查原因。
+- 配置、用户数据和日志的位置不变，除非也移动它们（见下文）。即使变量设置有误，日志仍会写入，方便排查原因。
 - 已有数据不会自动迁移。可以让 OpenIDEA 重新下载和重建；也可以先退出 OpenIDEA，只移动 `tools/`、`language-server-runtimes/`、`index/`、`cache/`、`lsp/`、`notebook-runtime/`、`server/`、`logs/`、`agents/tools/`、`agents/registry.json` 以及顶层的 `java-usages-*.jar` / `java-usages-*.tmp` 文件，并保持相对路径不变。其他内容请留在原处。
 
+## 移动配置、用户数据或日志
+
+其他几个目录各有一个变量，设置方法和 `OPENIDEA_LOCAL_DATA_DIR` 相同：设为绝对路径，OpenIDEA 启动时读取。IDE 随后会使用 `<路径>/ai.l0ng.openidea`，不存在时自动创建。
+
+| 变量                  | 移动的目录 |
+| --------------------- | ---------- |
+| `OPENIDEA_CONFIG_DIR` | 配置       |
+| `OPENIDEA_DATA_DIR`   | 用户数据   |
+| `OPENIDEA_LOG_DIR`    | 日志       |
+
+- 只设置想移动的那几个，其余仍在默认位置。几个变量指向同一路径也可以。
+- 如果配置或用户数据的路径是相对路径或不可用，OpenIDEA 会显示错误并退出，而不会退回默认位置；日志路径有误只会不写日志文件。
+- 已有文件不会自动迁移。想保留设置、插件和历史记录，先退出 OpenIDEA，把原文件夹里的内容复制到新位置。
+
 ## 日志
 
 OpenIDEA 每天写一个日志文件 `openidea.<日期>.log`，保留最近 7 个。程序崩溃（panic）的信息也会写入当前日志。

docs/zh/reference/settings.mdx

@@ -18,7 +18,9 @@ description: "OpenIDEA 的设置保存在哪里、全局文件与项目文件如
 
 每个文件只保存与下层不同的值。表（table）按键逐个合并；而单个值或数组会整个替换下层的值（例如在项目中设置 `files.exclude`，会替换全局的整个列表）。
 
-有些设置在项目文件中会被忽略：`mcpServer` 和导入的配色方案（`editor.customSchemes`）只能全局配置。项目信任状态永远不会从设置文件中读取。
+有些设置在项目文件中会被忽略：`mcpServer`、导入的配色方案（`editor.customSchemes`）和 `agents.newTaskApprovals` 只能全局配置。项目信任状态永远不会从设置文件中读取。
+
+项目文件不能放宽编码智能体的权限：`agentSecurity.allowedCommands` 和 `agents.defaults` 只能全局配置；项目中的 `agentSecurity.blockedCommands` 会追加到全局列表中，而不是替换它。项目 `agents.mcpServers` 中的 MCP 服务器会保持关闭，直到你在 **设置 › 智能体 › 外部 MCP 服务器** 中将其开启；服务器定义改变后也需要重新开启。
 
 ## 文件格式
 

e2e/agentApproval.spec.ts

@@ -49,6 +49,7 @@ const entries: AgentEntry[] = [
     type: "permission",
     id: 1,
     title: `Run ${command}`,
+    command,
     options: [
       { id: "once", kind: "allow_once", name: "Allow once" },
       { id: "always", kind: "allow_always", name: `Always allow \`${command}\`` },

e2e/branchesPopupResize.spec.ts

@@ -0,0 +1,93 @@
+/**
+ * Git Branches resizes by its edges and corner, as in IDEA, and reopens at that size.
+ * Git is stubbed at the IPC layer.
+ */
+import type { Page } from "@playwright/test";
+import { expect, stubDesktop, test } from "./fixtures";
+
+const ROOT = "/dev/acme-api";
+
+async function openBranches(page: Page) {
+  await page.evaluate(async () => {
+    const { executeAction } = await import(/* @vite-ignore */ "/src/platform/actions.ts");
+    await executeAction("vcs.branches");
+  });
+  const popup = page.getByRole("dialog", { name: "Git Branches" });
+  await expect(popup.getByRole("listbox", { name: "Branches" })).toBeVisible();
+  // Measure after the open animation: it slides the popup by a couple of pixels.
+  await popup.evaluate((el) => Promise.all(el.getAnimations().map((a) => a.finished)));
+  return popup;
+}
+
+test.beforeEach(async ({ workbench: page }) => {
+  await stubDesktop(page);
+  await page.evaluate(async (root) => {
+    const h = window.__ipc.handlers;
+    const branch = (name: string, current = false) => ({
+      name,
+      current,
+      remote: false,
+      upstream: null,
+      ahead: 0,
+      behind: 0,
+      lastCommitMs: null,
+      commit: "1111111",
+    });
+    h.vcs_roots = () => [{ root, operation: null, head: "main", headCommit: "1111111" }];
+    h.vcs_branch_info = () => ({
+      head: "main",
+      headCommit: "1111111",
+      upstream: null,
+      ahead: 0,
+      behind: 0,
+      operation: null,
+    });
+    h.vcs_status = () => [];
+    h.vcs_tags = () => [];
+    h.vcs_branches = () => [
+      branch("main", true),
+      ...Array.from({ length: 40 }, (_, i) => branch(`task-${i}-a-long-branch-name-that-gets-cut-off`)),
+    ];
+    const { useVcs, refreshNow, loadBranches } = await import(/* @vite-ignore */ "/src/features/vcs/store.ts");
+    useVcs.setState({ available: true, root, repo: root, branchesLoaded: false, stashesLoaded: false });
+    await refreshNow();
+    await loadBranches();
+  }, ROOT);
+});
+
+test("Git Branches resizes by its corner and right edge and reopens at that size", async ({ workbench: page }) => {
+  let popup = await openBranches(page);
+  const list = popup.getByRole("listbox", { name: "Branches" });
+  const before = (await popup.boundingBox())!;
+  const listBefore = (await list.boundingBox())!;
+
+  // The corner: both dimensions; the list takes the extra height.
+  const corner = (await popup.getByRole("separator", { name: "Resize" }).boundingBox())!;
+  await page.mouse.move(corner.x + corner.width / 2, corner.y + corner.height / 2);
+  await page.mouse.down();
+  await page.mouse.move(corner.x + corner.width / 2 + 120, corner.y + corner.height / 2 + 150, { steps: 5 });
+  await page.mouse.up();
+  const grown = (await popup.boundingBox())!;
+  expect(grown.width).toBeCloseTo(before.width + 120, 0);
+  expect(grown.height).toBeCloseTo(before.height + 150, 0);
+  expect(grown.x).toBeCloseTo(before.x, 0);
+  expect(grown.y).toBeCloseTo(before.y, 0);
+  expect((await list.boundingBox())!.height).toBeCloseTo(listBefore.height + 150, 0);
+
+  // The right edge: the width only.
+  await page.mouse.move(grown.x + grown.width - 2, grown.y + grown.height / 2);
+  await page.mouse.down();
+  await page.mouse.move(grown.x + grown.width - 62, grown.y + grown.height / 2 + 40, { steps: 5 });
+  await page.mouse.up();
+  const narrowed = (await popup.boundingBox())!;
+  expect(narrowed.width).toBeCloseTo(grown.width - 60, 0);
+  expect(narrowed.height).toBeCloseTo(grown.height, 0);
+  await expect(popup).toBeVisible();
+
+  await page.keyboard.press("Escape");
+  await expect(popup).toBeHidden();
+  popup = await openBranches(page);
+  const reopened = (await popup.boundingBox())!;
+  expect(reopened.width).toBeCloseTo(narrowed.width, 0);
+  expect(reopened.height).toBeCloseTo(narrowed.height, 0);
+});

e2e/commit.spec.ts

@@ -74,3 +74,26 @@ test("⌘K commits the checked changes with the typed message", async ({ workben
   expect(await ipcCalls(page, "vcs_stage")).toHaveLength(0);
   await expect(changes.getByRole("checkbox", { name: "Include build.gradle.kts in commit" })).toBeHidden();
 });
+
+test("commit message history opens above the message without an empty icon column", async ({ workbench: page }) => {
+  await stubRepository(page);
+  await page.keyboard.press("Meta+k");
+  const message = page.getByRole("textbox", { name: "Commit message" });
+  await expect(message).toBeVisible();
+  await page.evaluate((root) => {
+    localStorage.setItem(`openidea.vcs.commitMessages:${root}`, JSON.stringify(["Previous commit message"]));
+  }, ROOT);
+  await message.fill("Draft");
+  await page.getByRole("button", { name: "Commit Message History" }).click();
+
+  const menu = page.getByRole("menu", { name: "Recent commit messages" });
+  const row = menu.getByRole("menuitem", { name: "Previous commit message" });
+  await expect(row).toBeVisible();
+  const messageBox = await message.boundingBox();
+  const menuBox = await menu.locator("..").boundingBox();
+  expect(messageBox).not.toBeNull();
+  expect(menuBox).not.toBeNull();
+  expect(menuBox!.y + menuBox!.height).toBeLessThan(messageBox!.y);
+  expect(Math.abs(menuBox!.x - messageBox!.x)).toBeLessThan(2);
+  await expect(row.locator("span")).toHaveCount(1);
+});

e2e/databaseResultSpacing.spec.ts

@@ -0,0 +1,27 @@
+import { expect, test } from "./fixtures";
+
+test("selected result tabs are inset from the Services pane edge", async ({ workbench: page }) => {
+  await page.evaluate(async () => {
+    const storePath = "/src/features/database/store.ts";
+    const contributionsPath = "/src/workbench/contributions.ts";
+    const { useDatabase, RESULTS_VIEW } = await import(storePath);
+    const { showServiceView } = await import(contributionsPath);
+    useDatabase.setState({
+      loaded: true,
+      results: [],
+      activeResult: 0,
+      output: [{ id: 1, time: 0, kind: "info", text: "Query completed" }],
+    });
+    showServiceView(RESULTS_VIEW);
+  });
+  const output = page
+    .getByRole("tablist", { name: "Results", exact: true })
+    .getByRole("tab", { name: "Output", exact: true });
+  await expect(output).toHaveAttribute("aria-selected", "true");
+  const inset = await output.evaluate((element) => {
+    const strip = element.closest('[role="tablist"]')?.parentElement;
+    if (!strip) throw new Error("Result tab strip is missing");
+    return element.getBoundingClientRect().left - strip.getBoundingClientRect().left;
+  });
+  expect(inset).toBeGreaterThan(0);
+});

e2e/databaseResultTabs.spec.ts

@@ -0,0 +1,358 @@
+import type { Page } from "@playwright/test";
+import { expect, test } from "./fixtures";
+
+const edgeTitle = "Result 3 — a long query result at the edge of the Services pane";
+const bindings = { "alpha-console.sql": "alpha", "beta-console.sql": "beta" };
+
+/** Seed query outcomes, but use the production Services host, tabs, menus and dialogs. */
+async function seedResults(page: Page, edge = false) {
+  await page.evaluate(
+    async ({ edge, edgeTitle, bindings }) => {
+      const storePath = "/src/features/database/store.ts";
+      const contributionsPath = "/src/workbench/contributions.ts";
+      const { useDatabase, RESULTS_VIEW } = await import(storePath);
+      const { showServiceView } = await import(contributionsPath);
+      useDatabase.setState({
+        loaded: true,
+        sources: [
+          { id: "alpha", name: "Alpha database", driver: "sqlite", readOnly: true },
+          { id: "beta", name: "Beta database", driver: "sqlite", readOnly: true },
+        ],
+        consoles: bindings,
+        results: ["alpha rows", "beta rows", "third rows"].map((value, index) => {
+          const text = `SELECT '${value}' AS payload`;
+          return {
+            id: index + 1,
+            title: edge && index === 2 ? edgeTitle : `Result ${index + 1}`,
+            path: index === 1 ? "beta-console.sql" : "alpha-console.sql",
+            sourceId: index === 1 ? "beta" : "alpha",
+            outcome: {
+              statement: { text, from: 0, to: text.length },
+              error: null,
+              result: {
+                statement: text,
+                columns: [{ name: "payload", typeName: "text" }],
+                rows: [[value]],
+                affected: null,
+                hasMore: false,
+                elapsedMs: 1,
+                executionMs: 1,
+              },
+            },
+            page: 0,
+            pageSize: 500,
+          };
+        }),
+        activeResult: 2,
+        output: [{ id: 1, time: 0, kind: "info", text: "Seeded query output" }],
+      });
+      showServiceView(RESULTS_VIEW);
+    },
+    { edge, edgeTitle, bindings },
+  );
+  await expect(page.getByRole("tablist", { name: "Results", exact: true })).toBeVisible();
+  await expect(page.getByRole("gridcell", { name: "beta rows", exact: true })).toBeVisible();
+}
+
+function tab(page: Page, name: string) {
+  return page.getByRole("tablist", { name: "Results", exact: true }).getByRole("tab", { name, exact: true });
+}
+
+function menu(page: Page) {
+  return page.getByRole("menu").filter({ has: page.getByRole("menuitem", { name: "Close All", exact: true }) });
+}
+
+async function choose(page: Page, title: string, command: string) {
+  await tab(page, title).click({ button: "right" });
+  await menu(page).getByRole("menuitem", { name: command, exact: true }).click();
+  await expect(menu(page)).toHaveCount(0);
+}
+
+async function selected(page: Page, title: string, value?: string) {
+  await expect(tab(page, title)).toHaveAttribute("aria-selected", "true");
+  if (value) await expect(page.getByRole("gridcell", { name: value, exact: true })).toBeVisible();
+}
+
+test("result context menu fits the viewport, responds to hover and keyboard, and dismisses without selecting", async ({
+  workbench: page,
+}) => {
+  await page.setViewportSize({ width: 800, height: 600 });
+  await seedResults(page, true);
+  const target = tab(page, edgeTitle);
+  await target.scrollIntoViewIfNeeded();
+  const bounds = await target.boundingBox();
+  if (!bounds) throw new Error("Result tab is not visible");
+  const point = { x: bounds.x + bounds.width - 8, y: bounds.y + bounds.height / 2 };
+  expect(point.x).toBeGreaterThan(800 - 260);
+  await page.mouse.click(point.x, point.y, { button: "right" });
+  const popup = menu(page);
+  await expect(popup.getByRole("menuitem")).toHaveText([
+    "Close",
+    "Close Others",
+    "Close All",
+    "Rename Tab",
+    "Select Next Tab",
+    "Select Previous Tab",
+  ]);
+  await expect(popup.getByRole("separator")).toHaveCount(2);
+  await selected(page, "Result 2", "beta rows");
+  await expect
+    .poll(async () => {
+      const box = await popup.boundingBox();
+      return !!box && box.x >= 0 && box.y >= 0 && box.x + box.width <= 800 && box.y + box.height <= 600;
+    })
+    .toBe(true);
+  const popupBounds = await popup.boundingBox();
+  if (!popupBounds) throw new Error("Result menu is not visible");
+  expect(popupBounds.x).toBeLessThan(point.x);
+  // A bounded menu can still be clipped by a tool-window ancestor. Hit-test every row.
+  for (const item of await popup.getByRole("menuitem").all()) {
+    await expect(item).toBeVisible();
+    expect(
+      await item.evaluate((element) => {
+        const rect = element.getBoundingClientRect();
+        return element.contains(document.elementFromPoint(rect.x + rect.width / 2, rect.y + rect.height / 2));
+      }),
+    ).toBe(true);
+  }
+  const rename = popup.getByRole("menuitem", { name: "Rename Tab", exact: true });
+  await rename.hover();
+  await expect(rename).toHaveAttribute("tabindex", "0");
+  expect(await rename.evaluate((element) => getComputedStyle(element).backgroundColor)).not.toBe(
+    await popup
+      .getByRole("menuitem", { name: "Close", exact: true })
+      .evaluate((element) => getComputedStyle(element).backgroundColor),
+  );
+  await page.keyboard.press("Escape");
+  await expect(popup).toHaveCount(0);
+  await selected(page, "Result 2", "beta rows");
+
+  await target.click({ button: "right" });
+  await page.getByRole("tree", { name: "Project", exact: true }).click({ position: { x: 10, y: 10 } });
+  await expect(popup).toHaveCount(0);
+  await selected(page, "Result 2", "beta rows");
+
+  await target.focus();
+  await target.press("Shift+F10");
+  await expect(popup.getByRole("menuitem", { name: "Close", exact: true })).toBeFocused();
+  await page.keyboard.press("ArrowDown");
+  await expect(popup.getByRole("menuitem", { name: "Close Others", exact: true })).toBeFocused();
+  await page.keyboard.press("ArrowUp");
+  await expect(popup.getByRole("menuitem", { name: "Close", exact: true })).toBeFocused();
+  await page.keyboard.press("ArrowUp");
+  await expect(popup.getByRole("menuitem", { name: "Select Previous Tab", exact: true })).toBeFocused();
+  await page.keyboard.press("Enter");
+  await expect(popup).toHaveCount(0);
+  await selected(page, "Result 1", "alpha rows");
+});
+
+for (const [theme, label] of [
+  ["solarized-light", "Solarized Light"],
+  ["solarized-dark", "Solarized Dark"],
+]) {
+  test(`${label}: retains the inactive context-menu target's hover until dismissal without selecting it`, async ({
+    workbench: page,
+  }, info) => {
+    await page.emulateMedia({ reducedMotion: "reduce" });
+    await page.keyboard.press("Meta+,");
+    const settings = page.getByRole("dialog", { name: "Settings", exact: true });
+    await settings
+      .locator('[role="treeitem"][aria-level="2"]')
+      .filter({ hasText: /^Appearance$/ })
+      .click();
+    await settings.getByRole("button", { name: "Theme", exact: true }).click();
+    await page.getByRole("option", { name: label, exact: true }).click();
+    await settings.getByRole("button", { name: "Apply", exact: true }).click();
+    await expect(page.locator("html")).toHaveAttribute("data-color-theme", theme);
+    await page.keyboard.press("Escape");
+    await seedResults(page);
+    const target = tab(page, "Result 1");
+    const surface = target.locator("..");
+    const other = tab(page, "Result 3");
+    const otherSurface = other.locator("..");
+    await page.mouse.move(0, 0);
+    const idle = await surface.evaluate((element) => getComputedStyle(element).backgroundColor);
+    const selectedColor = await tab(page, "Result 2")
+      .locator("..")
+      .evaluate((element) => getComputedStyle(element).backgroundColor);
+    await target.hover();
+    const hovered = await surface.evaluate((element) => getComputedStyle(element).backgroundColor);
+    expect(hovered).not.toBe(idle);
+
+    await target.click({ button: "right" });
+    await menu(page).getByRole("menuitem", { name: "Close", exact: true }).hover();
+    expect(await surface.evaluate((element) => element.matches(":hover"))).toBe(false);
+    await expect(surface).toHaveCSS("background-color", hovered);
+    await expect(surface.getByRole("button", { name: "Close Tab", exact: true })).toHaveCSS("opacity", "1");
+    await selected(page, "Result 2", "beta rows");
+    await page.screenshot({ path: info.outputPath("context-menu-owner.png"), animations: "disabled" });
+    await page.keyboard.press("Escape");
+    await expect(menu(page)).toHaveCount(0);
+    await page.mouse.move(0, 0);
+    await expect(surface).toHaveCSS("background-color", idle);
+    await expect(surface.getByRole("button", { name: "Close Tab", exact: true })).toHaveCSS("opacity", "0");
+
+    await target.focus();
+    await target.press("Shift+F10");
+    await menu(page).getByRole("menuitem", { name: "Close", exact: true }).hover();
+    await expect(surface).toHaveCSS("background-color", hovered);
+    await selected(page, "Result 2", "beta rows");
+    await page.getByRole("tree", { name: "Project", exact: true }).click({ position: { x: 10, y: 10 } });
+    await expect(menu(page)).toHaveCount(0);
+    await expect(surface).toHaveCSS("background-color", idle);
+
+    await target.click({ button: "right" });
+    await other.click({ button: "right" });
+    await menu(page).getByRole("menuitem", { name: "Close", exact: true }).hover();
+    await expect(surface).toHaveCSS("background-color", idle);
+    await expect(otherSurface).toHaveCSS("background-color", hovered);
+    await selected(page, "Result 2", "beta rows");
+    await menu(page).getByRole("menuitem", { name: "Select Previous Tab", exact: true }).click();
+    await expect(menu(page)).toHaveCount(0);
+    await page.mouse.move(0, 0);
+    await expect(otherSurface).toHaveCSS("background-color", idle);
+    await selected(page, "Result 1", "alpha rows");
+
+    await target.click({ button: "right" });
+    await menu(page).getByRole("menuitem", { name: "Close", exact: true }).hover();
+    await expect(surface).toHaveCSS("background-color", selectedColor);
+    await page.keyboard.press("Escape");
+    await expect(menu(page)).toHaveCount(0);
+  });
+}
+
+test("renames the clicked inactive result without changing its rows and navigates through Output with wraparound", async ({
+  workbench: page,
+}) => {
+  await seedResults(page);
+  await tab(page, "Result 1").focus();
+  await tab(page, "Result 1").press("Shift+F10");
+  await selected(page, "Result 2", "beta rows");
+  await menu(page).getByRole("menuitem", { name: "Rename Tab", exact: true }).click();
+  const dialog = page.getByRole("dialog", { name: "Rename Tab", exact: true });
+  const input = dialog.getByRole("textbox", { name: "Tab name:", exact: true });
+  await expect(input).toBeFocused();
+  await expect(input).toHaveValue("Result 1");
+  await input.fill("Discarded name");
+  await dialog.getByRole("button", { name: "Cancel", exact: true }).click();
+  await expect(dialog).toHaveCount(0);
+  await expect(tab(page, "Result 1")).toBeVisible();
+  await selected(page, "Result 2", "beta rows");
+
+  await choose(page, "Result 1", "Rename Tab");
+  await input.fill("   ");
+  await expect(dialog.getByRole("button", { name: "OK", exact: true })).toBeDisabled();
+  await input.fill("  Customer summary  ");
+  await input.press("Enter");
+  await expect(dialog).toHaveCount(0);
+  await expect(tab(page, "Result 1")).toHaveCount(0);
+  await expect(tab(page, "Customer summary")).toBeVisible();
+  await selected(page, "Result 2", "beta rows");
+  await tab(page, "Customer summary").click();
+  await selected(page, "Customer summary", "alpha rows");
+
+  await choose(page, "Result 3", "Select Next Tab");
+  await selected(page, "Result 2", "beta rows");
+  await choose(page, "Result 3", "Select Next Tab");
+  await selected(page, "Result 3", "third rows");
+  await choose(page, "Customer summary", "Select Next Tab");
+  await selected(page, "Output");
+  await expect(page.getByText("Seeded query output", { exact: true })).toBeVisible();
+  await choose(page, "Customer summary", "Select Next Tab");
+  await selected(page, "Customer summary", "alpha rows");
+  await choose(page, "Result 3", "Select Previous Tab");
+  await selected(page, "Output");
+  await choose(page, "Result 2", "Select Previous Tab");
+  await selected(page, "Result 3", "third rows");
+});
+
+test("rename owns deletion and Cmd+Enter without editing the previously focused query", async ({ workbench: page }) => {
+  await seedResults(page);
+  await page.evaluate(async () => {
+    // This callback runs in the browser; a static import would load into the Node test runner.
+    const path = "/src/workbench/contributions.ts";
+    const { editorService } = await import(path);
+    await editorService().openFile("alpha-console.sql", { focus: true });
+  });
+  const content = page.locator(".cm-content[contenteditable=true]").first();
+  await content.click();
+  await page.keyboard.press("Meta+a");
+  const query = "SELECT 'keep this query';\nSELECT 2;";
+  await page.keyboard.insertText(query);
+  await page.keyboard.press("Meta+ArrowUp");
+  await expect(content).toHaveText(query.replace("\n", ""));
+
+  await choose(page, "Result 1", "Rename Tab");
+  const dialog = page.getByRole("dialog", { name: "Rename Tab", exact: true });
+  const input = dialog.getByRole("textbox", { name: "Tab name:", exact: true });
+  await input.fill("");
+  await input.press("Meta+Enter");
+  await expect(dialog).toBeVisible();
+  await expect(content).toHaveText(query.replace("\n", ""));
+  await input.fill("Customer summary");
+  await input.press("Meta+Backspace");
+  await expect(input).toBeFocused();
+  await expect(content).toHaveText(query.replace("\n", ""));
+  if (process.platform === "darwin") await expect(input).toHaveValue("");
+
+  await input.fill("Customer summary");
+  await input.press("Alt+Backspace");
+  await expect(input).toBeFocused();
+  await expect(content).toHaveText(query.replace("\n", ""));
+  if (process.platform === "darwin") await expect(input).toHaveValue("Customer ");
+  await input.fill("Customer summary");
+  await input.press("Meta+Enter");
+  await expect(dialog).toHaveCount(0);
+  await expect(tab(page, "Customer summary")).toBeVisible();
+  await expect(content).toHaveText(query.replace("\n", ""));
+
+  // The editor's own Delete Line shortcut still works after the dialog closes.
+  await content.click();
+  await page.keyboard.press("Meta+ArrowUp");
+  await page.keyboard.press("Meta+Backspace");
+  await expect(content.locator(".cm-line").filter({ hasText: /SELECT/ })).toHaveCount(1);
+});
+
+test("closes clicked results, other results and all results without removing Output, sources or console bindings", async ({
+  workbench: page,
+}) => {
+  await seedResults(page);
+  await tab(page, "Output").click({ button: "right" });
+  await expect(menu(page).getByRole("menuitem", { name: "Close", exact: true })).toBeDisabled();
+  await expect(menu(page).getByRole("menuitem", { name: "Rename Tab", exact: true })).toBeDisabled();
+  await page.keyboard.press("Escape");
+  await choose(page, "Result 1", "Close");
+  await expect(tab(page, "Result 1")).toHaveCount(0);
+  await selected(page, "Result 2", "beta rows");
+  await choose(page, "Result 3", "Close Others");
+  await expect(page.getByRole("tablist", { name: "Results", exact: true }).getByRole("tab")).toHaveText([
+    "Output",
+    "Result 3",
+  ]);
+  await selected(page, "Result 3", "third rows");
+  await choose(page, "Result 3", "Close All");
+  await expect(page.getByRole("tablist", { name: "Results", exact: true }).getByRole("tab")).toHaveText(["Output"]);
+  await selected(page, "Output");
+  await expect(page.getByText("Seeded query output", { exact: true })).toBeVisible();
+
+  await seedResults(page);
+  await choose(page, "Output", "Close Others");
+  await expect(page.getByRole("tablist", { name: "Results", exact: true }).getByRole("tab")).toHaveText(["Output"]);
+  await selected(page, "Output");
+  // These are lifetime invariants, not substitutes for the visible menu/grid assertions above.
+  expect(
+    await page.evaluate(async () => {
+      const storePath = "/src/features/database/store.ts";
+      const { useDatabase } = await import(storePath);
+      const { sources, consoles } = useDatabase.getState();
+      return { sources: sources.map((source: { id: string }) => source.id), consoles };
+    }),
+  ).toEqual({ sources: ["alpha", "beta"], consoles: bindings });
+  await page.evaluate(async () => {
+    const contributionsPath = "/src/workbench/contributions.ts";
+    const { toolWindowService } = await import(contributionsPath);
+    toolWindowService().show("database");
+  });
+  await expect(page.getByRole("treeitem", { name: "Alpha database", exact: true })).toBeVisible();
+  await expect(page.getByRole("treeitem", { name: "Beta database", exact: true })).toBeVisible();
+});

e2e/icls-php.spec.ts

@@ -54,7 +54,7 @@ test("imported PHP colours stay separate from Java and preserve regular text on
   await expect(token("'Palette'")).toHaveCSS("color", "rgb(255, 231, 146)");
   await expect(token("'Palette'")).toHaveCSS("font-weight", "400");
   await expect(token("class").first()).toHaveCSS("color", "rgb(249, 38, 114)");
-  await expect(token("Plain PHP documentation")).toHaveCSS("font-style", "normal");
+  await expect(token("Plain PHP documentation").first()).toHaveCSS("font-style", "normal");
   await expect(token("BasePalette")).toHaveCSS("color", "rgb(174, 129, 255)");
   await expect(token(";").first()).toHaveCSS("color", "rgb(255, 255, 255)");
   await expect(token("example")).toHaveCSS("color", "rgb(141, 225, 45)");

e2e/pythonInterpreters.spec.ts

@@ -0,0 +1,94 @@
+import { expect, test, stubDesktop } from "./fixtures";
+import type { Page } from "@playwright/test";
+
+/** Settings › Languages & Frameworks › Python › All Interpreters over a stubbed backend. */
+async function interpretersPage(page: Page) {
+  await page.evaluate(async () => {
+    const projectModule = "/src/platform/project.ts";
+    const { useProject } = await import(/* @vite-ignore */ projectModule);
+    const project = useProject.getState().project!;
+    const current = useProject.getState().settings ?? {};
+    const settings = {
+      ...current,
+      languages: {
+        ...(current.languages ?? {}),
+        python: {
+          interpreter: "/project/.venv/bin/python",
+          activateVirtualenv: true,
+          interpreters: ["/envs/tools/bin/python"],
+          hiddenInterpreters: ["/usr/bin/python3.9"],
+          hideOtherProjectInterpreters: false,
+          showInterpreterPaths: true,
+        },
+      },
+    };
+    useProject.setState({ settings });
+    const sdk = (path: string, name: string, home: string | null, source: string) => ({
+      path,
+      name,
+      version: "3.12.0",
+      source,
+      home,
+      extra: null,
+    });
+    window.__ipc.handlers.settings_get = () => settings;
+    window.__ipc.handlers.settings_get_global = () => settings;
+    window.__ipc.handlers.project_current = () => ({ ...project, settings });
+    window.__ipc.handlers.sdk_detect = () => [
+      sdk("/usr/bin/python3", "Python 3.12", "/usr", "system"),
+      sdk("/usr/bin/python3.9", "Python 3.9", "/usr", "system"),
+      sdk("/project/.venv/bin/python", "Python 3.12 (.venv)", "/project/.venv", "venv"),
+    ];
+    window.__ipc.handlers.sdk_python_project_interpreters = () => [
+      {
+        project: "/apps/shop",
+        sdk: sdk("/apps/shop/.venv/bin/python", "Python 3.11 (shop)", "/apps/shop/.venv", "venv"),
+      },
+    ];
+    window.__ipc.handlers.sdk_python_interpreter = () =>
+      sdk("/envs/tools/bin/python", "Python 3.13 (tools)", "/envs/tools", "venv");
+    const actions = "/src/platform/actions.ts";
+    void (await import(/* @vite-ignore */ actions)).executeAction("file.settings", "python.interpreters");
+  });
+  const dialog = page.getByRole("dialog", { name: "Settings" });
+  await expect(dialog).toBeVisible();
+  return dialog;
+}
+
+test("lists interpreters with their project, filters and toggles paths", async ({ workbench: page }) => {
+  await stubDesktop(page);
+  const dialog = await interpretersPage(page);
+  const row = (name: RegExp) => dialog.getByRole("option", { name });
+
+  await expect(row(/Python 3\.11 \(shop\)/)).toBeVisible();
+  await expect(row(/Python 3\.13 \(tools\)/)).toBeVisible();
+  // Removed earlier: not listed even though detection finds it.
+  await expect(row(/Python 3\.9/)).toHaveCount(0);
+  await expect(dialog.getByText("Project interpreter")).toBeVisible();
+  await expect(dialog.getByText("/project/.venv/bin/python")).toBeVisible();
+
+  await dialog.getByRole("button", { name: "Hide Interpreters from Other Projects" }).click();
+  await expect(row(/Python 3\.11 \(shop\)/)).toHaveCount(0);
+  await expect(row(/Python 3\.12 \(\.venv\)/)).toBeVisible();
+
+  await dialog.getByRole("button", { name: "Show Interpreter Paths" }).click();
+  await expect(dialog.getByText("/project/.venv/bin/python")).toHaveCount(0);
+});
+
+test("removes an interpreter in use and drops it from the interpreter combo", async ({ workbench: page }) => {
+  await stubDesktop(page);
+  const dialog = await interpretersPage(page);
+
+  await dialog.getByRole("option", { name: /Python 3\.12 \(\.venv\)/ }).click();
+  await dialog.getByRole("button", { name: "Remove Interpreter" }).click();
+  const confirm = page.getByRole("dialog", { name: "Remove Interpreter" });
+  await expect(confirm).toBeVisible();
+  await confirm.getByRole("button", { name: "Remove" }).click();
+  await expect(dialog.getByRole("option", { name: /Python 3\.12 \(\.venv\)/ })).toHaveCount(0);
+
+  // The project interpreter page offers what the list keeps: no removed path, added environments included.
+  await dialog.getByRole("treeitem", { name: "Dependencies", exact: true }).click();
+  await dialog.getByRole("button", { name: "Python interpreter" }).click();
+  await expect(page.getByRole("option", { name: /Python 3\.13 \(tools\)/ })).toBeVisible();
+  await expect(page.getByRole("option", { name: /Python 3\.9/ })).toHaveCount(0);
+});

e2e/settings.spec.ts

@@ -6,7 +6,7 @@ test("Add Python Interpreter keeps environment labels and fields inside their ro
   await settings.getByRole("textbox", { name: "Search settings" }).fill("Python Interpreter");
   await settings
     .getByRole("tree", { name: "Settings pages" })
-    .getByRole("treeitem", { name: "Python Interpreter", exact: true })
+    .getByRole("treeitem", { name: "Dependencies", exact: true })
     .click();
   await settings.getByRole("button", { name: "Add Interpreter…", exact: true }).click();
   const dialog = page.getByRole("dialog", { name: "Add Python Interpreter", exact: true });

languages/astro.toml

@@ -42,4 +42,5 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }

languages/javascript.toml

@@ -76,7 +76,8 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }
 
 [debugger]
 adapter = "js-debug"

languages/javascriptreact.toml

@@ -75,7 +75,8 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }
 
 [debugger]
 adapter = "js-debug"

languages/svelte.toml

@@ -44,4 +44,5 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }

languages/typescript.toml

@@ -90,7 +90,8 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }
 
 [debugger]
 adapter = "js-debug"

languages/typescriptreact.toml

@@ -75,7 +75,8 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }
 
 [debugger]
 adapter = "js-debug"

languages/vue.toml

@@ -69,4 +69,5 @@ problems = { shortenToSingleLine = false }
 workingDirectory = { mode = "auto" }
 codeAction = { disableRuleComment = { enable = true, location = "separateLine" }, showDocumentation = { enable = true } }
 # vscode-eslint reads it for every source.fixAll request (Actions on Save, Code Cleanup).
-codeActionOnSave = { mode = "all", rules = [] }
+# No `rules`: an empty list there means no rule gets fixed.
+codeActionOnSave = { mode = "all" }

plugins/README.md

@@ -1331,7 +1331,7 @@ main-toolbar actions use the focused editor context.
 `net.http:<host>` for unencrypted HTTP to other hosts; it does not imply an
 HTTPS grant. Both use the same wildcard rules. Each redirect is checked before
 connecting to the destination; HTTPS → HTTP also requires `net.http:<host>`,
-even on loopback. Responses are limited to 8 MiB. Requests run on the project
+even on loopback. Responses are limited to 16 MiB. Requests run on the project
 machine. A manifest using `net.http:` or `ipc:` declares `engines.openidea = "^1.4"`.
 
 A plugin with `net:ask` (API 1.5) may reach an HTTPS (or loopback) host that is

src-tauri/Cargo.toml

@@ -108,6 +108,7 @@ windows = { version = "0.62", features = [
 windows-sys = { version = "0.61", features = [
     "Win32_Foundation",
     "Win32_Graphics_Gdi",
+    "Win32_System_Diagnostics_Debug",
     "Win32_UI_Input_KeyboardAndMouse",
     "Win32_UI_Shell",
     "Win32_UI_WindowsAndMessaging",

src-tauri/src/commands/app.rs

@@ -16,6 +16,8 @@ pub struct AppInfo {
     pub platform: String,
     pub windows_build_number: Option<u32>,
     pub config_dir: ide_core::IpcPath,
+    /// User data (plugins, scratches, Local History); follows `OPENIDEA_DATA_DIR`.
+    pub data_dir: ide_core::IpcPath,
     /// Linux on a Wayland display: GTK draws the frameless windows' shadow and resize edges.
     pub wayland: bool,
 }
@@ -31,6 +33,7 @@ pub fn app_info(state: State<'_, AppState>) -> AppInfo {
         platform: std::env::consts::OS.into(),
         windows_build_number: ide_core::platform::windows_build_number(),
         config_dir: state.config_dir.clone().into(),
+        data_dir: state.data_dir.clone().into(),
         #[cfg(target_os = "linux")]
         wayland: crate::linux_window_state::is_wayland(),
         #[cfg(not(target_os = "linux"))]

src-tauri/src/commands/build.rs

@@ -5,7 +5,7 @@ use ide_build::compile::{BuildEvent, BuildKind, BuildResult};
 use ide_build::maven::PomGoto;
 use ide_build::pom_edit::ArtifactKey;
 use ide_build::{BuildModel, BuildTool, SyncProgress};
-use ide_core::{IdeResult, Location, Pos, RequestId};
+use ide_core::{DocId, IdeResult, Location, Pos, RequestId};
 #[allow(unused_imports)]
 pub use ide_host::ops::build::*;
 use tauri::ipc::Channel;
@@ -129,6 +129,20 @@ pub async fn maven_goto_declaration(
     ide_host::ops::build::maven_goto_declaration(&state.host, window.label(), pom, pos).await
 }
 
+/// Completion of the `<dependency>` coordinate the caret (`offset`, UTF-16) sits
+/// in the value of in the POM `doc`, from the local repository and Maven Central.
+#[tauri::command]
+#[specta::specta]
+pub async fn maven_dependency_completion(
+    window: Window,
+    state: State<'_, AppState>,
+    doc: DocId,
+    offset: u32,
+    request: RequestId,
+) -> IdeResult<Option<ide_build::maven::completion::PomCompletion>> {
+    ide_host::ops::build::maven_dependency_completion(&state.host, window.label(), doc, offset, request).await
+}
+
 /// Adds an `<exclusion>` of `exclusion` to the declaration of the direct dependency
 /// `dependency` of the Maven module `pom`, through the open document when there is one
 /// (saved). Returns the declaration; nothing changes when it already excludes it.

src-tauri/src/commands/caches.rs

@@ -7,13 +7,13 @@ use ide_host::data_dirs;
 use ide_workspace::caches::{self, InvalidateCachesOptions};
 use serde::Serialize;
 use std::path::PathBuf;
-use tauri::{AppHandle, Manager, State};
+use tauri::{AppHandle, State};
 
 /// Schedules the invalidation for the next start (`None` cancels a pending one).
 #[tauri::command]
 #[specta::specta]
 pub fn caches_schedule_invalidation(app: AppHandle, options: Option<InvalidateCachesOptions>) -> IdeResult<()> {
-    let data_dir = app.path().app_data_dir().map_err(|e| ide_core::IdeError::internal(e.to_string()))?;
+    let data_dir = ide_host::data_dirs::data_dir(&app.config().identifier).map_err(ide_core::IdeError::internal)?;
     match options {
         Some(o) => caches::schedule(&data_dir, &o),
         None => {