feat(lsp): auto-install language servers with cancellable status-bar task

Removes the consent dialog + install bar + problems-panel row for the
PHP and Python language servers (user feedback: too many dialogs). The
servers now install automatically on the first relevant file open,
announced only through the status-bar task whose popup is opened for
every install/upgrade (download size in the message) with a stop icon.

- cancel: downloadFile/_npmInstallInFolder return promises carrying a
  cancel() handle (node-side keyed RPC under the hood; AbortController
  for downloads, retained child process for npm). Cancel cleans partial
  files and defers retry to the next app launch; the master prefs
  (python/php.codeIntelligence) stay the durable opt-out.
- npm installs on the same folder are now mutually exclusive, and the
  in-flight registries are cleaned on every failure path so retries
  always work.
- offline is a non-event: no task/toast, auto-retry when connectivity
  returns (window online) or next launch. Network errors mid-install
  take the same quiet path.
- real failures roll back the partial install, turn the task red with a
  retry icon, open the popup and raise a subtle toast; metrics
  (lsp/pyInst|phpInst x ok/upOk/fail/cancel/waitNet) and logger error
  reports added.
- corrupt-but-present installs self-repair (wipe + reinstall once per
  session) instead of staying silently broken.
- server versions now live in src/config.json (lsp_server_pins), flowing
  through generated appConfig.js; a missing pins block alerts (stale
  build tripwire). npm run updateBuiltInLSPS bumps all built-in servers
  (runtime pins + bundled vtsls/json in src-node) to latest stable, and
  a monthly workflow opens a reviewed PR gated by the LSP suites.
- auto-install never runs in test windows; suites acquire servers via
  installNow() explicitly (new guard specs).

Author: abose

.github/workflows/update-lsp-pins.yml

@@ -0,0 +1,49 @@
+name: Update pinned LSP server versions
+
+on:
+  schedule:
+    # monthly - 00:00 UTC on the 1st
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+jobs:
+  update-pins:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: main
+      - name: Update built-in LSP server versions
+        run: |
+          npm run updateBuiltInLSPS
+          git status
+        shell: bash
+
+      - name: Create update-lsp-pins Pull Request
+        id: cpr
+        uses: peter-evans/create-pull-request@v4
+        with:
+          commit-message: 'chore: update built-in LSP server versions'
+          committer: GitHub <noreply@github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          title: '[Release BOT] Update built-in LSP server versions'
+          branch: bot/update-lsp-pins
+          add-paths: |
+            src/config.json
+            src-node/package.json
+            src-node/package-lock.json
+          body: |
+            Updates every built-in language server to its latest stable release:
+            - runtime-installed pins in `src/config.json` (`lsp_server_pins`): intelephense (npm),
+              pyrefly and ruff (PyPI)
+            - bundled servers in `src-node/package.json` (+ lockfile): @vtsls/language-server (TS/JS),
+              vscode-langservers-extracted (JSON)
+
+            The TS/JSON/PHP/Python LSP integration suites exercise these exact versions for real,
+            so a green CI on this PR means the new versions actually work. Merge only when green.
+            - Auto-generated by `update-lsp-pins.yml` action
+      - name: Check outputs
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |
+          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
+          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

build/update-lsp-pins.js

@@ -0,0 +1,150 @@
+/*
+ * GNU AGPL-3.0 License
+ *
+ * Copyright (c) 2021 - present core.ai . All rights reserved.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see https://opensource.org/licenses/AGPL-3.0.
+ *
+ */
+
+/*
+ * Updates every built-in language server to its latest STABLE release:
+ *  - runtime-installed pins in src/config.json (config.lsp_server_pins): intelephense (npm),
+ *    pyrefly and ruff (PyPI), and
+ *  - bundled servers in src-node/package.json: @vtsls/language-server (TS/JS) and
+ *    vscode-langservers-extracted (JSON) - written as EXACT versions, with the src-node
+ *    lockfile regenerated so `npm ci` stays green.
+ *
+ * Prereleases are never picked up: npm's `latest` dist-tag is stable by convention and any
+ * version carrying a prerelease suffix is skipped with a warning.
+ *
+ * Run by the scheduled update-lsp-pins GitHub workflow (npm run updateBuiltInLSPS), which opens
+ * a PR with the diff - the TS/JSON/PHP/Python LSP integration suites exercise these exact
+ * versions for real, so CI green on that PR means the new versions actually work before they
+ * ship. Never run as part of normal builds: pins must not drift under a developer mid-work.
+ *
+ * Usage: node build/update-lsp-pins.js [--dry-run]
+ */
+
+/* eslint-env node */
+
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const CONFIG_PATH = path.join(__dirname, "..", "src", "config.json");
+const SRC_NODE_DIR = path.join(__dirname, "..", "src-node");
+const SRC_NODE_PKG_PATH = path.join(SRC_NODE_DIR, "package.json");
+const DRY_RUN = process.argv.includes("--dry-run");
+
+// bundled servers shipped inside src-node - bumped in src-node/package.json as exact versions
+const BUNDLED_LSP_PACKAGES = ["@vtsls/language-server", "vscode-langservers-extracted"];
+
+async function _fetchJson(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error("HTTP " + response.status + " for " + url);
+    }
+    return response.json();
+}
+
+// npm's `latest` dist-tag - the stable channel by convention (prereleases live on other tags)
+async function latestNpmVersion(pkg) {
+    const meta = await _fetchJson("https://registry.npmjs.org/" + encodeURIComponent(pkg) + "/latest");
+    return meta.version;
+}
+
+async function latestPyPIVersion(pkg) {
+    const meta = await _fetchJson("https://pypi.org/pypi/" + pkg + "/json");
+    return meta.info.version;
+}
+
+function _isPrerelease(version) {
+    return version.indexOf("-") !== -1;
+}
+
+async function updateRuntimePins() {
+    const config = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
+    const pins = config.config.lsp_server_pins;
+    if (!pins) {
+        throw new Error("config.lsp_server_pins missing in " + CONFIG_PATH);
+    }
+    const latest = {
+        intelephense: await latestNpmVersion("intelephense"),
+        pyrefly: await latestPyPIVersion("pyrefly"),
+        ruff: await latestPyPIVersion("ruff")
+    };
+    let changed = false;
+    for (const key of Object.keys(latest)) {
+        if (_isPrerelease(latest[key])) {
+            console.warn(key + ": skipping prerelease " + latest[key] + ", keeping " + pins[key]);
+        } else if (pins[key] !== latest[key]) {
+            console.log(key + ": " + pins[key] + " -> " + latest[key]);
+            pins[key] = latest[key];
+            changed = true;
+        } else {
+            console.log(key + ": " + pins[key] + " (up to date)");
+        }
+    }
+    if (!changed || DRY_RUN) {
+        if (changed) {
+            console.log("--dry-run: not writing " + CONFIG_PATH);
+        }
+        return;
+    }
+    // no trailing newline - matches the existing file and the gulp config writer exactly
+    fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 4), "utf8");
+    console.log("Updated " + CONFIG_PATH);
+}
+
+async function updateBundledServers() {
+    const pkgJson = JSON.parse(fs.readFileSync(SRC_NODE_PKG_PATH, "utf8"));
+    let changed = false;
+    for (const pkg of BUNDLED_LSP_PACKAGES) {
+        const current = pkgJson.dependencies[pkg];
+        if (!current) {
+            throw new Error(pkg + " missing from src-node/package.json dependencies");
+        }
+        const latest = await latestNpmVersion(pkg);
+        if (_isPrerelease(latest)) {
+            console.warn(pkg + ": skipping prerelease " + latest + ", keeping " + current);
+        } else if (current !== latest) {
+            console.log(pkg + ": " + current + " -> " + latest);
+            pkgJson.dependencies[pkg] = latest;
+            changed = true;
+        } else {
+            console.log(pkg + ": " + current + " (up to date)");
+        }
+    }
+    if (!changed || DRY_RUN) {
+        if (changed) {
+            console.log("--dry-run: not writing " + SRC_NODE_PKG_PATH);
+        }
+        return;
+    }
+    fs.writeFileSync(SRC_NODE_PKG_PATH, JSON.stringify(pkgJson, null, 4) + "\n", "utf8");
+    console.log("Updated " + SRC_NODE_PKG_PATH);
+    // keep the committed lockfile in sync or `npm ci` fails on manifest mismatch;
+    // --package-lock-only avoids touching node_modules
+    console.log("Regenerating src-node/package-lock.json ...");
+    execFileSync("npm", ["install", "--package-lock-only"], { cwd: SRC_NODE_DIR, stdio: "inherit" });
+}
+
+(async function main() {
+    await updateRuntimePins();
+    await updateBundledServers();
+}()).catch(function (err) {
+    console.error(err);
+    process.exit(1);
+});

docs/API-Reference/utils/NodeUtils.md

@@ -73,6 +73,35 @@ This is only available in the native app.
 | [options] | <code>Object</code> |  |
 | [options.sha256] | <code>string</code> | expected hex digest of the downloaded bytes |
 | [options.progress] | <code>function</code> | called with (transferredBytes,        totalBytes) as the download advances; totalBytes is 0 if the server sent no length |
+| [options.cancelId] | <code>string</code> | registers the download so        cancelDownload(cancelId) can abort it mid-stream; the partial file is        deleted and the rejection error message contains "cancelled" |
+
+<a name="cancelDownload"></a>
+
+## cancelDownload(cancelId) ⇒ <code>Promise.&lt;void&gt;</code>
+Cancels an in-flight downloadFile run by the cancelId it was started with. Idempotent -
+unknown ids are a no-op. The cancelled download's promise rejects (message contains
+"cancelled") and its partial file is deleted.
+This is only available in the native app.
+
+**Kind**: global function  
+
+| Param | Type | Description |
+| --- | --- | --- |
+| cancelId | <code>string</code> | cancelId passed to downloadFile |
+
+<a name="_cancelNpmInstall"></a>
+
+## \_cancelNpmInstall(moduleNativeDir) ⇒ <code>Promise.&lt;void&gt;</code>
+Kills an in-flight _npmInstallInFolder run by the moduleNativeDir it was started with.
+Idempotent - unknown dirs are a no-op. The killed install's promise rejects (message
+contains "cancelled").
+This is only available in the native app.
+
+**Kind**: global function  
+
+| Param | Type | Description |
+| --- | --- | --- |
+| moduleNativeDir | <code>string</code> | dir passed to _npmInstallInFolder |
 
 <a name="extractZipFile"></a>
 

package.json

@@ -48,6 +48,7 @@
         "prepare": "husky install",
         "_serveTest": "http-server . -p 5000 -c-1",
         "zipTestFiles": "gulp zipTestFiles",
+        "updateBuiltInLSPS": "node build/update-lsp-pins.js",
         "test": "echo please see `Running and debugging tests` section in readme.md",
         "testIntegHelp": "echo By default this command only runs unit tests.To Run integration tests, please see `Running and debugging tests` section in readme.md",
         "testChromium": "npm run testIntegHelp && npx playwright test --project=chromium",