8e8f90e235
Lifecycle and safety fixes from the external review: - Observe abort while awaiting the initialize handshake, so a server that never replies can't defeat the tool-timeout signal. - On an aborted request the server won't cancel, tear the instance down after a bounded grace instead of releasing the serialized queue with work still live (prevents overlapping document lifecycles). - Re-check provider disposal after the canonicalize/read awaits so a query can't spawn an unowned server after disposeAll(). - Read the source through one open handle (stat + read on the same fd) to close the realpath-vs-read TOCTOU; decode with a fatal UTF-8 decoder so a legitimate U+FFFD is not misclassified as invalid. - Validate and read the source BEFORE spawning a server (pre-start rejection). - Require an explicit openClose for option-form textDocumentSync. - Reject nonpositive teardown budgets and non-executable absolute commands at load; surface unsupported operations as structured LSP_UNSUPPORTED_OPERATION. - Retain the stderr tail (fatal diagnostics land at exit), not the prefix. - Catalog the seam vocabulary in docs/core-data-structures/lsp.md.
lsp/ - LSP capability family
The language-server capability seam: an abstract LSP interface, a generic stdio provider, and the model-facing lsp tool. All product packages.
| Package | Role | ctx key |
|---|---|---|
lsp/ |
Abstract LSP seam (provider registry by branded id + extension mapping, per-query selection, vocabulary, LspError) |
ctx.lsp |
lsp-local/ |
Generic stdio language-server provider (spawn, JSON-RPC, transient-open queries) | (registers on ctx.lsp) |
tool-lsp/ |
Model-facing lsp tool (four operations, one-based UTF-16 cursor coordinates) |
(registers on ctx.tools) |
The interface lives at lsp/lsp/. The seam exposes exactly four semantic operations — definition, references, implementation, hover — and no generic JSON-RPC escape hatch, so a provider swap does not change how the model asks for navigation and no protocol payload or unreviewed mutation reaches the model contract. Providers register capabilities, not tools; tool-lsp is the only owner of the model-facing name, schema, prompt guidance, and presentation.
See the LSP capability seam RFC for the design rationale, including why documents open transiently per query, why the local host reads through Node APIs rather than ctx.fs, and why extension ownership is exclusive within one runtime.