Qiyuanqiii · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -47,6 +47,60 @@ jobs:
           "$GOVULNCHECK" -version
           "$GOVULNCHECK" ./...
 
+  code-intel-lsp:
+    name: Real LSP (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Set up current Go 1.25 patch
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.25.x'
+          check-latest: true
+          cache: true
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Install reviewed real language servers
+        shell: pwsh
+        run: |
+          $goBin = Join-Path $env:RUNNER_TEMP "prayu-gopls"
+          $tsRoot = Join-Path $env:RUNNER_TEMP "prayu-typescript-lsp"
+          New-Item -ItemType Directory -Path $goBin -Force | Out-Null
+          $env:GOBIN = $goBin
+          go install golang.org/x/tools/gopls@v0.21.1
+          npm install --prefix $tsRoot --ignore-scripts --no-audit --no-fund `
+            --package-lock=false typescript-language-server@6.0.0 typescript@5.9.3
+
+          $suffix = if ($IsWindows) { ".exe" } else { "" }
+          $gopls = Join-Path $goBin "gopls$suffix"
+          $node = (Get-Command node).Source
+          $typescriptServer = Join-Path $tsRoot `
+            "node_modules/typescript-language-server/lib/cli.mjs"
+          foreach ($path in @($gopls, $node, $typescriptServer)) {
+            if (-not [System.IO.Path]::IsPathFullyQualified($path) -or
+                -not (Test-Path -LiteralPath $path -PathType Leaf)) {
+              throw "reviewed real LSP dependency is unavailable: $path"
+            }
+          }
+          "CYBERAGENT_GOPLS_SMOKE_BINARY=$gopls" | Out-File `
+            -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          "CYBERAGENT_TYPESCRIPT_LSP_SMOKE_NODE=$node" | Out-File `
+            -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          "CYBERAGENT_TYPESCRIPT_LSP_SMOKE_CLI=$typescriptServer" | Out-File `
+            -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+      - name: Exercise reviewed gopls and TypeScript LSP tool sets
+        run: >-
+          go test -v -count=1 -timeout 5m ./internal/codeintel
+          -run '^TestReal(Gopls|TypeScriptLanguageServer)ReadOnlySemanticToolSmoke$'
+      - name: Run code-intel race and fault suite
+        if: runner.os == 'Linux'
+        run: go test -race -count=1 -timeout 5m ./internal/codeintel
+
   web:
     name: TypeScript console
     runs-on: ubuntu-latest

diff --git a/README.en.md b/README.en.md
@@ -61,7 +61,7 @@ The allowed direction is always `TypeScript -> Go -> LLM/Rust/Docker`. TypeScrip
 | Models and context | Mock, Anthropic-compatible, OpenAI-compatible, and loopback-only Ollama providers, routing, qualification, capability probing, streaming, compaction, hierarchical project instructions, explicit user/project memory, and Session continuity trees |
 | Planning and collaboration | Plan/Delivery, work items, notes, up to two core children, `batch-delivery.v1` isolated worktrees/branches/mailboxes/review/ordered merge, and 1/2/4/6 read-only fan-out tiers |
 | Tools and permissions | Tool Gateway, JSON Schema validation, Policy, Scope, human approval, four host-permission tiers, fixed commands, an ordinary-mode Run-owned command runtime, per-command PowerShell/Git Bash approval, and time-bound Debug terminal input |
-| Code workflows | Native folder selection and Workspace import, workspace browsing, repository state/history, diff review, file-edit proposals, transactional Workspace Checkpoints, Undo/Redo/Rewind, independent Forks, verification plans, Code Journey, and Handoff |
+| Code workflows | Native folder selection and Workspace import, workspace browsing, repository state/history, diff review, file-edit proposals, read-only `code-intel-lsp.v1` semantic tools, transactional Workspace Checkpoints, Undo/Redo/Rewind, independent Forks, verification plans, Code Journey, and Handoff |
 | Observability | Append-only Run events, Live Activity, public model commentary, Harness facts, Artifacts, Findings/Evidence/Reports, and SARIF |
 | Extension seams | Mode-aware inert Skill packages, human-reviewed generated candidates, a two-stage MCP Client, signed `plugin.v1`, restricted lifecycle hooks, Provider and Tool interfaces, an embedded WASI Analyzer, and network-none Docker product execution disabled by default |
 | Clients | `cyberagent` CLI, Bubble Tea TUI, authenticated HTTP/OpenAPI, React/Vite, and Windows/macOS Desktop portable preview |
@@ -79,6 +79,12 @@ Schema v115 introduces `agent-code-tools.v1`, allowing the root Supervisor to co
 
 Read results are deterministically ordered, paginated, and bounded. Root escape, casing aliases, hidden entries outside the Go allowlist (`.github` is the sole code-evidence exception), ignored entries, links or reparse points, binary/non-UTF-8 data, and oversized files fail closed. `workspace_change` creates replace/create/move proposals only; `workspace_delete` is a separate exactly confirmed deletion proposal; `workspace_apply` can apply only an approved exact revision and rechecks source and destination hashes to detect review-time drift. Calls, results or refusals, authority snapshots, budget charges, and bounded Artifacts enter the resumable Supervisor ledger. `cyberagent run show <run-id>`, the Run Detail API, and the Desktop Run page expose the current generation and per-tool availability. This protocol grants no Shell, Git, network, or Sandbox authority. See the [Usage Guide](docs/usage.md) and [ADR 0116](docs/adr/0116-model-callable-workspace-tools.md).
 
+### Read-only LSP code intelligence
+
+`code-intel-lsp.v1` starts only local language servers selected through an explicit operator-reviewed configuration and pinned executable SHA-256. Go owns initialization, document synchronization, cancellation/timeouts, crash restart, and process-tree cleanup. During Code-surface root Plan/Deliver turns, the model sees only capabilities actually negotiated by the server: workspace/document symbols, definition, references, implementation, hover, signature help, diagnostics, and call/type hierarchy. Cyber, Specialist, rename, code actions, and formatting remain unavailable.
+
+Every semantic result binds the Workspace/root, commit/branch/dirty digest, document URI/hash/version, server generation/capability fingerprint, and query/page. Edits, branch changes, root changes, and server restarts make old evidence explicitly stale; escaping URIs, remote links, secret/control text, and oversized results are rejected, sanitized, or marked partial. `code-intel status|qualify`, authenticated OpenAPI, and Desktop settings expose only source, language, health, capabilities, generation, bounded errors, and model-visible tools—never executable, argv, environment, or credentials. A minimal environment and “no network grant” are not an OS sandbox; the configured server must be trusted. See [LSP Code Intelligence](docs/code-intelligence.md) for configuration, the real gopls/TypeScript matrix, and residual risks.
+
 ### Transactional Workspace Checkpoints
 
 Schema v117 `workspace-checkpoint.v1` records immutable checkpoints before and after file tools, Run-owned command batches/background Jobs, typed Git writes, and the agent-merge boundary. Each checkpoint binds the base commit, branch, raw Git index, a deterministic tracked/untracked manifest, content hashes, trigger receipt, attempt/capability generation, and recovery grade. Ordinary file and index bytes are deduplicated by SHA-256; ignored, generated, large, sensitive-looking, linked, and external state is represented explicitly instead of being silently advertised as recoverable. Because no portable filesystem watcher is installed, Shell boundaries are explicitly `partial` and cover only observed Workspace/Git state, not effects outside the root.
@@ -266,6 +272,7 @@ See the [Usage Guide](docs/usage.md) for more commands and boundaries.
 - [Documentation Index](docs/README.md)
 - [Product Scope and Optional Extensions](docs/PRODUCT_SCOPE.md)
 - [MCP Client, Plugins, and Restricted Hooks](docs/extensions.md)
+- [LSP Code Intelligence](docs/code-intelligence.md)
 - [Architecture](docs/architecture.md)
 - [Usage Guide](docs/usage.md)
 - [Current Project Status](docs/PROJECT_STATUS.md)

diff --git a/README.md b/README.md
@@ -61,7 +61,7 @@ CLI / TUI / React / Windows Desktop / CI
 | 模型与上下文 | Mock、Anthropic-compatible、OpenAI-compatible 与 loopback-only Ollama Provider、模型路由、资格校验、能力探测、流式响应、上下文压缩、层级项目指令、显式 user/project 长期记忆与 Session 恢复树 |
 | 计划与协作 | Plan/Delivery、工作项、备注、最多两个核心 child、`batch-delivery.v1` 独立 Worktree/分支/邮箱/交付复核/顺序合并，以及 1/2/4/6 档只读 Fan-out |
 | 工具与权限 | Tool Gateway、JSON Schema 校验、Policy、Scope、人工审批、四档宿主权限、受控固定命令、普通模式 Run-owned 命令运行时、逐条审批 PowerShell/Git Bash，以及限时 Debug 终端输入 |
-| 代码工作流 | 系统目录选择与 Workspace 导入、工作区浏览、仓库状态、提交历史、Diff 审阅、文件编辑提案、事务化 Workspace Checkpoint、Undo/Redo/Rewind、独立 Fork、验证计划、Code Journey 与 Handoff |
+| 代码工作流 | 系统目录选择与 Workspace 导入、工作区浏览、仓库状态、提交历史、Diff 审阅、文件编辑提案、只读 `code-intel-lsp.v1` 语义工具、事务化 Workspace Checkpoint、Undo/Redo/Rewind、独立 Fork、验证计划、Code Journey 与 Handoff |
 | 可观测性 | 追加式 Run 事件、Live Activity、公开模型进度、Harness 事实、Artifact、Finding/Evidence/Report、SARIF、持久化有界计划任务与脱敏结构化诊断包 |
 | 扩展 | 模式感知的惰性 Skill 包、生成候选人工审查、两阶段 MCP Client、签名 `plugin.v1`、受限生命周期 Hooks、Provider/Tool 接口、Go/Rust JSON 协议、内嵌 WASI Analyzer、Sandbox 合同与默认关闭的 network-none Docker 产品执行 |
 | 客户端 | `cyberagent` CLI、Bubble Tea TUI、认证 HTTP/OpenAPI、React/Vite、Windows/macOS Desktop 便携预览 |
@@ -79,6 +79,12 @@ Schema v115 引入 `agent-code-tools.v1`，让 root Supervisor 能在真实 Work
 
 只读结果稳定排序、分页且有界，并拒绝根目录逃逸、大小写别名、未列入 Go allowlist 的隐藏项（仅 `.github` 作为代码证据开放）、忽略项、链接或重解析点、二进制、非 UTF-8 与超限文件。`workspace_change` 只创建 replace/create/move 提案；`workspace_delete` 是独立、需精确确认的删除提案；`workspace_apply` 只能应用已经批准的精确版本，并重新检查原文件与目标文件哈希，避免审阅后内容漂移。每次调用、结果/拒绝、authority 快照、预算消耗与有界 Artifact 都进入可恢复 Supervisor 账本。`cyberagent run show <run-id>`、Run Detail API 和 Desktop Run 页面可查看当前 generation、逐工具可用性与拒绝原因。该协议不授予 Shell、Git、网络或 Sandbox 权限；完整设计见[使用手册](docs/usage.md)和 [ADR 0116](docs/adr/0116-model-callable-workspace-tools.md)。
 
+### 只读 LSP 语义代码智能
+
+`code-intel-lsp.v1` 只启动操作者显式配置、审查并以 executable SHA-256 固定的本地 Language Server。Go 拥有 initialize、文档同步、请求取消/超时、崩溃重启和进程树清理；模型只在 Code Surface 的 root Plan/Deliver 回合看到 Server 实际协商成功的 workspace/document symbol、definition、references、implementation、hover、signature、diagnostics、call/type hierarchy 工具。Cyber、Specialist、rename、code action 和 format 均不开放。
+
+每份语义结果绑定 Workspace/root、commit/branch/dirty digest、document URI/hash/version、Server generation/capability fingerprint 和 query/page。编辑、切换分支、换根目录或 Server 重启会让旧证据显式变为 stale；越界 URI、远程 link、secret/control 文本和超限结果会被拒绝、清洗或标记 partial。CLI 提供 `code-intel status|qualify`，认证 OpenAPI 和 Desktop 设置页只显示来源、语言、健康、capability、generation、有界错误与模型工具，永不返回 executable、argv、环境或凭证。最小环境和“不授予网络”不是 OS Sandbox；Server 本身必须受信任。配置、真实 gopls/TypeScript 兼容矩阵和残余风险见 [LSP 语义代码智能](docs/code-intelligence.md)。
+
 ### 事务化 Workspace Checkpoint
 
 Schema v117 的 `workspace-checkpoint.v1` 在文件工具、Run-owned 命令批次/后台 Job、typed Git 写入与 agent merge 边界前后记录不可变检查点。检查点固定 base commit、branch、原始 Git index、稳定排序的 tracked/untracked manifest、内容哈希、触发收据、attempt/capability generation 与恢复等级；普通文件和 index 以 SHA-256 内容寻址去重，ignored/generated/large/sensitive/link/external 状态会显式标记而不是静默承诺可恢复。Shell 没有可移植 watcher，因此其边界明确降级为 `partial`，只承诺观测到的 Workspace/Git 状态，不宣称回滚根目录外副作用。
@@ -326,6 +332,7 @@ Get-AuthenticodeSignature .\PrayuDesktop.msix | Format-List Status, StatusMessag
 - [文档导航](docs/README.md)
 - [产品范围与可选扩展](docs/PRODUCT_SCOPE.md)
 - [MCP Client、Plugin 与受限 Hooks](docs/extensions.md)
+- [LSP 语义代码智能](docs/code-intelligence.md)
 - [架构说明](docs/architecture.md)
 - [使用手册](docs/usage.md)
 - [当前项目状态](docs/PROJECT_STATUS.md)

diff --git a/cmd/cyberagent-desktop/main.go b/cmd/cyberagent-desktop/main.go
@@ -70,6 +70,7 @@ type desktopOptions struct {
 	uiEvidence             bool
 	userTerminal           bool
 	dockerExecution        bool
+	codeIntelConfig        string
 	version                bool
 }
 
@@ -288,6 +289,8 @@ func parseDesktopOptions(args []string) (desktopOptions, error) {
 		"enable the user-owned Debug ConPTY terminal")
 	dockerExecution := fs.Bool("enable-docker-execution", false,
 		"enable product Docker Sandbox admission and execution on the fixed local daemon")
+	codeIntelConfig := fs.String("code-intel-config", "",
+		"absolute operator-reviewed code-intel config")
 	version := fs.Bool("version", false, "print version and exit")
 	if err := fs.Parse(args); err != nil {
 		return desktopOptions{}, err
@@ -392,6 +395,7 @@ func parseDesktopOptions(args []string) (desktopOptions, error) {
 		uiEvidence:             *uiEvidence,
 		userTerminal:           *userTerminal,
 		dockerExecution:        *dockerExecution,
+		codeIntelConfig:        strings.TrimSpace(*codeIntelConfig),
 		version:                *version}, nil
 }
 
@@ -477,6 +481,7 @@ func runDesktop(config desktopOptions) error {
 		},
 		UserTerminalEnabled:    config.userTerminal,
 		DockerExecutionEnabled: config.dockerExecution,
+		CodeIntelConfigPath:    config.codeIntelConfig,
 		AppVersion:             app.Version, UIHandler: bundle,
 		OnWakeWorkerError: func(runErr error) {
 			fmt.Fprintln(os.Stderr, "wake-worker:", runErr)
@@ -543,6 +548,7 @@ func runDesktop(config desktopOptions) error {
 		UIEvidenceControlEnabled:                config.uiEvidence,
 		UserTerminalEnabled:                     config.userTerminal,
 		DockerExecutionEnabled:                  dockerExecutionEnabled,
+		CodeIntelEnabled:                        controlPlane.CodeIntelEnabled(),
 		AppVersion:                              app.Version, UIDigest: bundle.Digest(), Selector: selector,
 		PreviewBridge: preview, SkillInstaller: controlPlane.SkillInstaller(),
 		WorkspaceResolver: controlPlane, WorkspaceLauncher: newNativeWorkspaceLauncher(),

diff --git a/docs/README.md b/docs/README.md
@@ -25,6 +25,7 @@ This directory separates user-facing documentation, current engineering state, a
 | 文档 | 用途 |
 |---|---|
 | [架构说明 / Architecture](architecture.md) | Go 单一控制平面、Run-centric 领域和跨语言边界 |
+| [LSP 语义代码智能 / Code Intelligence](code-intelligence.md) | 审查配置、十项只读工具、进程生命周期、证据失效与真实 Server 验证 |
 | [HTTP API](http-api.md) | 认证 API 行为与 DTO 边界 |
 | [OpenAPI](openapi.json) | 由 Go 生成并受测试保护的机器可读合同 |
 | [错误模型 / Errors](errors.md) | 稳定错误类别、CLI 退出码和 HTTP 映射 |

diff --git a/docs/SKILL_PACKAGE_PLAN.md b/docs/SKILL_PACKAGE_PLAN.md
@@ -6,7 +6,7 @@
 
 现有 Go `skill.v1` 已严格定义名称、语义版本、描述、兼容 Profile、工具前置声明、Markdown 内容路径、UTF-8 字节数、保守 token 上界和 SHA-256。当前内置 Manifest 还显式声明 `surfaces`（Code/Cyber）、`phases`（Plan/Deliver）、`roles`（root/Specialist）以及 `user_invocable`、`model_invocable`、`explicit_only` 调用策略；四维兼容必须同时命中，调用许可与正文交付分别判断，任何字段都不授予能力。`internal/skills.LoadFS` 可以从受控 `fs.FS` 构造不可变 Registry，当前编译进二进制的十二项为 `code`、`review`、`learn`、`script`、`plan-delivery`、`doctor`、`debug`、`run-verify`、`focused-checks`、`simplify`、`security-review` 和 `run-skill-generator`，另支持测试夹具。
 
-Profile Skill 中 `code/learn` 仅支持 Code，增强后的 `review@1.3.0` 支持 Code 与 Review Profile，`script` 支持 Code 与 Cyber；它们支持 Plan/Deliver、root/Specialist 和 user/model 来源。`plan-delivery` 跨全部 Profile 与 Surface，但仅支持 root 且必须由操作者显式选择。六项新增通用能力均为 root 可组合指导：`doctor` 仅 Plan，`run-verify`、`focused-checks` 和 `simplify` 仅 Deliver，`debug` 与 `security-review` 跨两阶段。schema v110 按当前 mode 固定每轮兼容子集并允许审计空交付。schema v111 让外部安装账本保存同一模式字段且保持 legacy 指纹；schema v112 的 `run-skill-generator` 只在 Code/Deliver/root 显式选择后开放候选提案，生成、人工审批、惰性安装与 Run 选择互不替代。当前产品仍无模型自主选择入口，`model_invocable` 只为未来受控选择器声明准入。
+Profile Skill 中 `code/learn` 仅支持 Code，增强后的 `review@1.4.0` 支持 Code 与 Review Profile，`script` 支持 Code 与 Cyber；它们支持 Plan/Deliver、root/Specialist 和 user/model 来源。`plan-delivery` 跨全部 Profile 与 Surface，但仅支持 root 且必须由操作者显式选择。六项新增通用能力均为 root 可组合指导：`doctor` 仅 Plan，`run-verify`、`focused-checks` 和 `simplify` 仅 Deliver，`debug` 与 `security-review` 跨两阶段。`review@1.4.0` 和 `focused-checks@1.1.0` 可消费当前 `code-intel-lsp.v1` 证据但不会把语义结果当成能力授权；旧版已进入有界内嵌归档以保持既有 Run 可恢复。schema v110 按当前 mode 固定每轮兼容子集并允许审计空交付。schema v111 让外部安装账本保存同一模式字段且保持 legacy 指纹；schema v112 的 `run-skill-generator` 只在 Code/Deliver/root 显式选择后开放候选提案，生成、人工审批、惰性安装与 Run 选择互不替代。当前产品仍无模型自主选择入口，`model_invocable` 只为未来受控选择器声明准入。
 
 当前产品入口包括：