Commit Graph
3274 Commits
Author SHA1 Message Date
Dominik Jain b030baf544 Add 'Security' section to changelog 2026-08-09 13:54:03 +02:00
Dominik Jain 600dda1fdf Use <code> tag for commands in news 2026-08-09 13:53:54 +02:00
Dominik Jain d3441d3e23 Merge remote-tracking branch 'origin/main' into release-1.7
Conflicts:
  CHANGELOG.md
2026-08-09 13:53:19 +02:00
Dominik Jain 430fc62e72 Improve tray manager handling, particularly on macOS #1825
* On shutdown, message tray manager before lengthy project shutdown
* When dead ports are found, explicitly update the menu
2026-08-08 22:17:29 +02:00
Dr. Dominik Jain 9f9700a503 Merge pull request #1827 from oraios/memory-cleanup 2026-08-08 21:51:41 +02:00
Dominik Jain b2de2c8f97 Improve instructions on prompt templates, adding link to new docs section
Improve other docstrings in templates and add missing key `fixed_tools`
2026-08-08 21:50:13 +02:00
dependabot[bot] bfd4738e2b chore(deps): bump the uv group across 1 directory with 5 updates
Bumps the uv group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `48.0.1` | `50.0.0` |
| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.3` | `0.6.4` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.46` | `3.1.58` |
| [h2](https://github.com/python-hyper/h2) | `4.3.0` | `4.4.1` |
| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |



Updates `cryptography` from 48.0.1 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/48.0.1...50.0.0)

Updates `pyasn1` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](https://github.com/pyasn1/pyasn1/compare/v0.6.3...v0.6.4)

Updates `gitpython` from 3.1.46 to 3.1.58
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.58)

Updates `h2` from 4.3.0 to 4.4.1
- [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-hyper/h2/compare/v4.3.0...v4.4.1)

Updates `setuptools` from 82.0.1 to 83.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/setuptools/compare/v82.0.1...v83.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: gitpython
  dependency-version: 3.1.58
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h2
  dependency-version: 4.4.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-08-08 19:53:53 +02:00
weiconghe 1d44e9cfab feat: add Gleam language support via the Gleam compiler's bundled gleam lsp (#1765) 2026-08-08 19:44:27 +02:00
Merlin Hughes 8c1f3bcc98 Scala: give Metals the build roots rather than the repository root (#1767)
Metals serves one build per workspace folder, and Serena sends only the
repository root. Where the builds live below the root, Metals falls back to
its own search (BuildTools.searchForBuildTool), which looks one level down
and takes the *first* match — so in a monorepo every build but that one is
served with no build target, and cross-file references silently come back
empty.

Detect the build roots instead and send them all, one Metals service each.
`ls_specific_settings.scala.project_roots` names them explicitly where the
detection guesses wrong, `project_root_scan_depth` bounds the search.

The configured `ls_workspace_folders` are not usable for this: they are about
what SolidLSP indexes and are shared by every language server of a project, so
in a polyglot monorepo no single value suits both Metals and, say, tsserver.

Where the repository root is itself a build root, nothing changes.
2026-08-08 19:33:42 +02:00
xor 88d71530ab Test speed optimization, svelte: remove unused dependencies (#1707) 2026-08-08 19:05:31 +02:00
Evangelos Karatzas 76b94f3274 Add Nextflow language server support (#1815)
The Nextflow language server schedules a debounced (1s) AST update on every
didOpen/didChange, and LanguageService.references is the only request that does
not await it -- documentSymbol, codeLens, documentLink and semanticTokensFull
all do. A references request issued inside that window races the recompile of
the file it asks about and can return an empty list, which is what the macOS CI
runner hit. Send a documentSymbol request for the same file first, which blocks
server-side until the pending update has been applied.

Also compare reference paths using the platform separator in the tests, since
relativePath is OS-native and the hardcoded forward slashes failed on Windows.
2026-08-08 18:58:46 +02:00
Michael Panchenko 27d7d0e0ec Merge pull request #1778 from shiersa/feat/deno-language-server
feat: add Deno language server support
2026-08-08 18:50:38 +02:00
dependabot[bot] de2f1a658a Bump pillow from 12.2.0 to 12.3.0 in the uv group across 1 directory
Bumps the uv group with 1 update in the / directory: [pillow](https://github.com/python-pillow/Pillow).


Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0)

---
updated-dependencies:
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-08-08 18:44:45 +02:00
Kobi Hikri 436fbe4ac3 ci: attach provenance and SBOM attestations to the published image (#1775) 2026-08-08 18:44:10 +02:00
Dominik Jain c9fa15741e Add documentation on prompt templating in Serena 2026-08-08 17:57:21 +02:00
Dominik Jain 69d14891ca Minor refactoring: Rename _format_prompt to _render_prompt, adding docstring 2026-08-08 17:48:37 +02:00
Dominik Jain bb06ed05dd Support embed_memory function in prompt templates
Apply it in Serena's own project prompt
2026-08-08 17:43:13 +02:00
Dominik Jain 91ebba1c8c Merge remote-tracking branch 'origin/Main' into memory-cleanup 2026-08-08 17:18:05 +02:00
Dominik Jain ed401769b5 ProjectServer: Use general headless mode config overrides 2026-08-08 16:57:40 +02:00
Dr. Dominik Jain f90d488309 Merge pull request #1828 from oraios/prompt-tags 2026-08-08 16:53:39 +02:00
Dominik Jain d3a8e9b565 Improve project activation message 2026-08-08 16:49:42 +02:00
Dominik Jain 548aea28a6 Allow project initial prompt & newly activated dynamic mode prompts to use templating/variables
Add helper method _format_prompt_tag
2026-08-08 16:47:03 +02:00
Dominik Jain 0968bae6eb Enclose sub-prompts in tags 2026-08-08 16:43:46 +02:00
Tyce Herrman 7acd78bde0 ci: exclude JDTLS workspaces from cache 2026-08-08 16:32:17 +02:00
Merlin Hughes 600d3b2fad Scala: answer Metals' build-import prompt (#1769)
* scala: answer Metals' build-import prompt

Metals asks, via window/showMessageRequest, whether to import a workspace it
has not seen before. Serena registered no handler, so the request came back
`method 'window/showMessageRequest' not handled on client` and Metals logged
"Unexpected error initializing server" and gave up. No build server, no build
target, and every cross-file query answered by the fallback presentation
compiler — which cannot see past the file it is given.

A client cannot decline the question instead: Metals' `disableShowMessageRequest`
is server-side configuration, and its no-op fallback answers "Not now", which
imports nothing either. Answering is the only route to a build.

So answer the three prompts that lead to a build server, and dismiss anything
else with `null` — a prompt we do not recognise is one whose consequences we
cannot judge, and two of Metals' others offer to kill a process and to open a
window. "Don't show again" is never chosen; Metals persists that in the
project's own state.

Since answering yes lets Metals run the project's build tool,
`ls_specific_settings.scala.auto_import_build: false` declines instead.

* scala: name the build-tool choice as a gap, and test the setting

`Messages.ChooseBuildTool` ("Multiple build definitions found. Which would
you like to use?") offers the build tools' own executable names, and precedes
the import prompt wherever a workspace holds more than one kind of build. It
is dismissed like anything else unrecognised, so such a workspace is still
not imported — a deliberate choice, since picking one is a guess of a
different order, but one the comment and the setup guide should admit to
rather than claim every prompt on the path is answered.

Also: cover the route from `ls_specific_settings` to `auto_import_build`,
which nothing exercised, and correct the `ImportBuildChanges` message in the
fixtures, which had the notification variant's trailing full stop rather than
the request's own text.
2026-08-08 16:28:04 +02:00
Tyce HerrmanandDominik Jain 217517ecdf feat(kotlin): update language server to 262.9593.0 (#1811)
* feat(kotlin): update language server to 262.9593.0

Note: download URL structure differs depending on version

---------

Co-authored-by: Dominik Jain <dominik.jain@oraios-ai.de>
2026-08-08 16:25:13 +02:00
Tyce Herrman 8364fc5548 fix(java): remove unused IntelliCode integration 2026-08-08 16:19:31 +02:00
yhheolab-oss 5a06cec7d0 Merge pull request #1820 from yhheolab-oss/fix/project-server-active-project-race
fix(project_server): serialize access to the process-wide active project
2026-08-08 16:15:30 +02:00
Dominik Jain 07d49be110 Clean up memories and move system prompt info to critical_info memory 2026-08-08 13:35:19 +02:00
Dominik Jain 52c3165d1d Add more concrete instructions on test strategy in system prompt 2026-08-08 13:05:09 +02:00
shiersa 7a870878b8 feat: add Deno language server support
Add a Deno language server backed by the Deno CLI's built-in `deno lsp`,
serving TypeScript/JavaScript in Deno projects. Unlike the plain
typescript-language-server it understands Deno module resolution
(npm:/jsr:/https: imports) and the `Deno.*` global namespace.

It is experimental and must be selected explicitly via
`language_servers: [deno]`; it overlaps the TypeScript server on file
extensions, so it is not auto-detected. Requires the `deno` CLI on PATH.

Tests run in CI: the `deno` marker joins the other-langs batch, which now
installs Deno via denoland/setup-deno. Off-CI and wherever the CLI is
absent they skip through the central conftest guard, following the existing
pattern for toolchain-gated language servers. Hover is covered explicitly,
including hover on a `Deno.*` global, which is the capability this server
adds over the TypeScript one.
2026-08-06 23:21:42 +08:00
Dominik Jain c7af2c09ef SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) 2026-08-05 21:36:03 +02:00
Dominik Jain df24c3151f Clarify responsibilities when exposing network services 2026-08-05 21:31:59 +02:00
Dominik Jain 7aa24b8dad ProjectServer: Configure trusted hosts for localhost case 2026-08-05 21:28:17 +02:00
Dominik Jain de8eaac089 Merge branch 'jinja' into release-1.7 2026-08-05 14:15:05 +02:00
Dominik Jain 81fb5203f9 Use sandboxed environment for jinja2 template rendering
This prevents attackers from exploiting jinja's code execution mechanisms
via custom prompts (e.g. mode inclusion from local file)
2026-08-05 14:14:56 +02:00
Dominik Jain b8fd8a936a Allow project prompt to use templating 2026-08-05 14:12:10 +02:00
Dr. Dominik Jain 9558366327 Merge pull request #1808 from rr-develop/fix/kotlin-ls-refresh-request-handlers 2026-08-05 13:50:53 +02:00
arimu1andDominik Jain c657e26d36 Change default SolidLSP request timeout to 300s
SolidLanguageServer.create previously defaulted timeout=None, so Request
waits were unbounded. Test construction never set a timeout; a wedged
language server (intermittent ccls hang during indexing) could stall CI
until the job cap.

Default create to DEFAULT_LS_REQUEST_TIMEOUT (300s). Explicit timeout=None
still opts out. Project continues to pass ls_timeout from tool_timeout.

Resolves #1717

Co-authored-by: Dominik Jain <dominik.jain@oraios-ai.de>
2026-08-05 13:48:34 +02:00
Dr. Dominik Jain df5ab4f607 Merge pull request #1781 from oraios/test-uv-python-compat
Test Python version compatibility in CI
2026-08-05 12:00:32 +02:00
Dr. Dominik Jain e2a344a8da Merge pull request #1791 from caost/fix/macos-tray-dock-icon 2026-08-05 11:51:48 +02:00
Dominik Jain 16692df979 Use TRAY_MANAGER as new default dashboard interface on macOS 2026-08-05 11:51:13 +02:00
caostandClaude Opus 5 89c83efc4f Fix: macOS tray manager showed a Dock icon
The tray manager creates the shared NSApplication so that pystray can
attach its status item to it, but it never sets an activation policy.
The default is NSApplicationActivationPolicyRegular, which makes the
process a regular app: a Python icon appears in the Dock and in the
app switcher even though the tray manager has no windows.

Set NSApplicationActivationPolicyAccessory instead, which is the
policy intended for menu-bar-only agents. Only the status item remains
visible.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-05 11:49:56 +02:00
Tyce Herrman 0498de4a52 fix: scope Syrupy diff patch to PyCharm 2026-08-05 11:46:54 +02:00
Tyce Herrman e03094f5bc fix(nix): use published diagnostics for nixd 2026-08-05 11:40:52 +02:00
Dominik Jain e6b3852117 More liberal handling of ignored paths in file access tools
- Tools that explicitly target a single file (`create_text_file`, `read_file`, `replace_content`) no longer
   consider ignored paths in general, i.e. all files can be accessed.
   When a path is explicitly accessed, we should not try to prevent it; the agent is assumed to have a good reason
    for doing so.
 - Tools that traverse a subtree of the project (`list_dir`, `find_file`, `search_for_pattern`) now all have an
   option `skip_ignored_files` (whether to skip ignored sub-paths).
   Note that if the base path is itself ignored, ignored paths cannot be considered.

Resolves #1805
2026-08-04 10:33:34 +02:00
Dr. Dominik Jain cd04838be9 Merge pull request #1804 from oraios/ls-notify-on-reopen-changed
Fix stale file state in language servers (with files kept open)
2026-08-03 22:22:23 +02:00
Dominik Jain 0720dd92e0 Merge remote-tracking branch 'origin/main' into ls-notify-on-reopen-changed
Conflicts:
	CHANGELOG.md
2026-08-03 22:21:48 +02:00
rr-develop d3293b2c63 fix(svelte): correct inlayHint refresh method name
`workspace/inlayHints/refresh` (plural) is not a method in the LSP
specification — the refresh request is `workspace/inlayHint/refresh`.
The handler could therefore never be invoked, so the request it was
meant to absorb would still be answered with `MethodNotFound`.
2026-08-03 11:07:15 +02:00
rr-develop bfa45a6a11 fix(kotlin): handle workspace refresh requests to prevent LS shutdown
The Kotlin language server client advertises `refreshSupport` for
codeLens, semanticTokens, inlineValue, inlayHint and diagnostics, but
registered no handler for the corresponding `workspace/*/refresh`
requests.

When the server sends one, `LanguageServerProcess._request_handler`
finds no handler and replies with `MethodNotFound`. The Kotlin LSP
treats that error as fatal and terminates, which surfaces as
`LanguageServerTerminatedException` and kills any in-flight tool call.

Register no-op handlers for all five advertised capabilities, mirroring
what `svelte_language_server` already does.
2026-08-03 11:02:06 +02:00