feat(json): JSON code intelligence - schema LSP, npm hints, vuln squigglies, dep hover

New integrated extension src/extensionsIntegrated/JSONSupport with
WebStorm-class intelligence for JSON files, on the existing multi-server
LSP framework:

1. JSON language server (desktop): vscode-json-language-server (from
vscode-langservers-extracted, resolved via src-node/node_modules/.bin)
with lazy start on the first JSON file and repoint-not-restart on project
switch. Curated schemastore.org associations (package.json, ts/jsconfig,
eslintrc, babelrc, prettierrc, composer, manifests, ...) are pushed via
workspace/didChangeConfiguration after every server up-transition; the
server downloads the schemas itself. Serves all json docs as jsonc
(comment-tolerant, matching real-world tsconfig/.eslintrc), yields
Phoenix pref files to PrefsCodeHints via the new documentFilter, and
opts into completionSnippetSupport (the server refuses to offer
completion without snippet support; insertHint already expands snippets
through TabstopManager).

2. npm package intelligence in package.json (all builds):
- Name completion in dependency keys: registry search in relevance
  order, typed-query emphasis via the standard .matched-hint style,
  descriptions in the reusable side docs popup (showHintDocPopup /
  hideHintDocPopup now exported from DefaultProviders) instead of
  widening the rows. Explicit Ctrl-Space searches the whole token under
  the cursor and skips the typing debounce.
- Version completion in values: the package's real version list newest
  first with ^latest/~latest range shortcuts; typed prefixes filter the
  FULL list (a 5.x prefix surfaces the 5.x train even when the newest 50
  are 7.x) and fall back to newest when nothing matches. Name insertion
  chains straight into version mode.
- Dependency hover (QuickView): registry summary - name, latest version,
  license, description - with Open homepage and a View docs link pinned
  bottom-right that opens the npm page anchored at the DECLARED version
  ("^5.4.11" -> /v/5.4.11, where npm renders that version's README).

3. Vulnerability squigglies: each declared range is resolved to the
version npm would install (semver.maxSatisfying over the real version
list) and checked against npm's bulk security-advisory endpoint (the
npm-audit data source). Severity-mapped (critical/high error, moderate
warning, low info), whole-entry underlines, capped and deduped per dep.
The endpoint has no CORS headers (verified), so desktop goes straight to
the new ph-npm-intel node helper - no doomed browser POST spamming the
console; browser builds try fetch and degrade quietly. scanFileAsync
never blocks on the network: cached results return immediately and a
single-flighted, dep-hash-gated background refresh requestRun()s on
change.

Framework hardening along the way:
- src-node/lsp-client.js answers server-initiated requests (spec-shaped
  null results for workspace/configuration & friends, -32601 otherwise)
  so no server can hang awaiting a reply the browser never sends.
- LanguageClient.sendCustomNotification; per-server documentFilter and
  completionSnippetSupport (per-config client capabilities); _notify now
  logs AND propagates failures so DocumentSync's lost-notification
  resync hardening actually engages.
- Hover typography: the shared .lsp-hover-quickview family (JSON schema
  hover, JS/TS hover, hint docs popup) moves to the 13px+ readability
  baseline; popup headings lose their asymmetric browser margins.

Tests: unit:JSONSupport npm intelligence 18/18 (dep-range scanner,
severity mapping/dedup, registry client with injected fetcher incl.
caching + bulk body, hint context detection, full-list version filter +
fallback, npm page URLs); integration:JSON LSP 3/3 (server syntax
diagnostics, inline-schema validation with no network, advisory
squigglies with fake fetcher); regressions integration:TypeScript LSP
20/20 and LegacyInteg:CodeHintManager 13/13.

Author: abose

docs/API-Reference/language/CodeInspection.md

@@ -163,7 +163,7 @@ Each error object in the results should have the following structure:
                htmlMessage:string,
                type:?Type ,
                fix: { // an optional fix, if present will show the fix button
-                    replace: "text to replace the offset given below",
+                    replaceText: "text to replace the offset given below",
                     rangeOffset: {
                         start: number,
                         end: number
@@ -194,7 +194,7 @@ Each error object in the results should have the following structure:
 | htmlMessage | <code>string</code> | The error message to be displayed as HTML. |
 | type | [<code>Type</code>](#Type) | The type of the error. Defaults to `Type.WARNING` if unspecified. |
 | fix | <code>Object</code> | An optional fix object. |
-| fix.replace | <code>string</code> | The text to replace the error with. |
+| fix.replaceText | <code>string</code> | The text to replace the error with. |
 | fix.rangeOffset | <code>Object</code> | The range within the text to replace. |
 | fix.rangeOffset.start | <code>number</code> | The start offset of the range. |
 | fix.rangeOffset.end | <code>number</code> | The end offset of the range. If no errors are found, return either `null`(treated as file is problem free) or an object with a zero-length `errors` array. Always use `message` to safely display the error as text. If you want to display HTML error message, then explicitly use `htmlMessage` to display it. Both `message` and `htmlMessage` can be used simultaneously. After scanning the file, if you need to omit the lint result, return or resolve with `{isIgnored: true}`. This prevents the file from being marked with a no errors tick mark in the status bar and excludes the linter from the problems panel. |

docs/API-Reference/widgets/NotificationUI.md

@@ -52,6 +52,8 @@ The `createFromTemplate` API can be configured with numerous options. See API op
     * [.createToastFromTemplate(title, template, [options])](#module_widgets/NotificationUI..createToastFromTemplate) ⇒ <code>Notification</code>
     * [.showToastOn(containerOrSelector, template, [options])](#module_widgets/NotificationUI..showToastOn) ⇒ <code>Notification</code>
     * [.showHUD(iconClass, label, [options])](#module_widgets/NotificationUI..showHUD) ⇒ <code>Notification</code>
+    * [.hideRichTooltip()](#module_widgets/NotificationUI..hideRichTooltip) : <code>function</code>
+    * [.attachRichTooltip(elements, html, [options])](#module_widgets/NotificationUI..attachRichTooltip) ⇒ <code>Object</code>
 
 <a name="module_widgets/NotificationUI..API"></a>
 
@@ -188,3 +190,31 @@ NotificationUI.showHUD("fa-solid fa-magnifying-glass-plus", "110%");
 | label | <code>string</code> | Text to display below the icon (e.g. "110%"). |
 | [options] | <code>Object</code> | optional, supported options:   * `autoCloseTimeS` - Time in seconds after which the HUD auto-closes. Default is 1. |
 
+<a name="module_widgets/NotificationUI..hideRichTooltip"></a>
+
+### widgets/NotificationUI.hideRichTooltip() : <code>function</code>
+Hide the currently showing rich tooltip (if any).
+
+**Kind**: inner method of [<code>widgets/NotificationUI</code>](#module_widgets/NotificationUI)  
+<a name="module_widgets/NotificationUI..attachRichTooltip"></a>
+
+### widgets/NotificationUI.attachRichTooltip(elements, html, [options]) ⇒ <code>Object</code>
+Attaches a rich (HTML-capable) hover tooltip to the given element(s). The tooltip is
+Phoenix-themed for both light and dark themes, positioned beside the element, clamped to the
+viewport, and attached to `<body>` so scrolling containers cannot clip it.
+
+```js
+NotificationUI.attachRichTooltip($(".my-info-icon"), "<b>Hello</b> world");
+// or compute content per element on show:
+NotificationUI.attachRichTooltip($(".my-info-icon"), el => $(el).attr("data-info"));
+```
+
+**Kind**: inner method of [<code>widgets/NotificationUI</code>](#module_widgets/NotificationUI)  
+**Returns**: <code>Object</code> - call `detach()` to unbind the handlers and hide the tooltip  
+
+| Param | Type | Description |
+| --- | --- | --- |
+| elements | <code>jQuery</code> \| <code>Element</code> \| <code>string</code> | element(s) or selector to attach to |
+| html | <code>string</code> \| <code>function</code> | TRUSTED html string (escape untrusted parts   yourself), or a function returning it for the hovered element |
+| [options] | <code>Object</code> | optional, supported options:   * `showDelayMs` - hover delay before the tooltip appears. Default 250. |
+

src-node/lsp-client.js

@@ -142,12 +142,54 @@ function handleMessage(serverId, msg) {
         } else {
             resolve(msg.result);
         }
+    } else if (msg.method && msg.id !== undefined) {
+        // Server-initiated REQUEST: answer it right here so the server never awaits a reply
+        // forever (the browser side has no response path; an unanswered request can stall the
+        // server's own processing - e.g. vscode-json-language-server pulling configuration).
+        _respondToServerRequest(serverId, server, msg);
     } else if (msg.method) {
-        // Notification or server-initiated request - forward to the browser.
+        // Notification - forward to the browser (e.g. textDocument/publishDiagnostics).
         nodeConnector.triggerPeer('lspNotification', { serverId, ...msg });
     }
 }
 
+/**
+ * Answer a server-initiated request with a benign, spec-shaped reply. We advertise minimal client
+ * capabilities (no dynamic registration, workspace.configuration=false), so servers should rarely
+ * send these - this is the safety net that guarantees no server hangs awaiting a reply.
+ * @param {string} serverId - The server identifier (for logging)
+ * @param {Object} server - The server state object
+ * @param {Object} msg - The incoming JSON-RPC request (method + id)
+ */
+function _respondToServerRequest(serverId, server, msg) {
+    let response;
+    switch (msg.method) {
+    case 'workspace/configuration':
+        // Result must be an array matching params.items length; null entries mean "no config".
+        response = {
+            jsonrpc: '2.0', id: msg.id,
+            result: ((msg.params && msg.params.items) || []).map(() => null)
+        };
+        break;
+    case 'client/registerCapability':
+    case 'client/unregisterCapability':
+    case 'window/workDoneProgress/create':
+    case 'window/showMessageRequest':
+        response = { jsonrpc: '2.0', id: msg.id, result: null };
+        break;
+    default:
+        response = {
+            jsonrpc: '2.0', id: msg.id,
+            error: { code: -32601, message: `Method not handled by Phoenix LSP client: ${msg.method}` }
+        };
+    }
+    try {
+        server.process.stdin.write(encode(response));
+    } catch (e) {
+        console.error(`[lsp-client][${serverId}] failed to answer ${msg.method}:`, e.message);
+    }
+}
+
 /**
  * Ping endpoint to verify the LSP connector is alive.
  * @returns {Promise<Object>} Status and list of active servers

src-node/npm-intel.js

@@ -0,0 +1,52 @@
+/*
+ * GNU AGPL-3.0 License
+ *
+ * Copyright (c) 2021 - present core.ai . All rights reserved.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see https://opensource.org/licenses/AGPL-3.0.
+ *
+ */
+
+/**
+ * npm-intel - node-side helper for npm security-advisory lookups. The registry's bulk advisory
+ * endpoint is POST-only without CORS headers, so the browser context cannot call it directly;
+ * the JSONSupport extension routes the request here on desktop builds.
+ *
+ * Lazy-loaded via NodeUtils._loadNodeExtensionModule("./npm-intel") on first use - keep this
+ * module free of heavyweight requires so it adds nothing to node boot.
+ */
+
+const ADVISORY_BULK_URL = "https://registry.npmjs.org/-/npm/v1/security/advisories/bulk";
+
+/**
+ * POST the bulk advisory query to the npm registry.
+ * @param {Object} params
+ * @param {Object<string, string[]>} params.body - map of package name -> array of exact versions
+ * @returns {Promise<Object>} the registry's response: package name -> advisory array
+ */
+async function fetchAdvisoriesBulk({ body }) {
+    const response = await fetch(ADVISORY_BULK_URL, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+        throw new Error(`advisory fetch failed: ${response.status}`);
+    }
+    return response.json();
+}
+
+exports.fetchAdvisoriesBulk = fetchAdvisoriesBulk;
+
+global.createNodeConnector("ph-npm-intel", exports);