fix(hosted): disable project LSP execution in reviews

[BunsDev]

Motivation

• Hosted review treated LSP as read-only even though invoking it can start an external language-server process.
• Repository settings are untrusted and must not supply executable LSP definitions, hosted capability policy, or persisted permission grants.

Description

• Exclude LSP from the default hosted-review read-only tool set.
• Remove repository-provided lsp_servers before hierarchical settings merge while retaining trusted global LSP configuration.
• Remove repository-provided hostedReview capability policy and permissionRules before merge so a project cannot re-enable LSP, Bash, write, plugin, or MCP access.
• Preserve the hosted-repair exhaustive repository file-tool allowlist.
• Add regressions for hosted tool filtering, project LSP sanitization, and trusted-global policy/rule preservation.

Verification

• cargo fmt --check
• cargo check --workspace --locked
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked
• Focused hosted-review, hosted-repair, project-LSP, and merged-settings regressions
• git diff --check origin/main --
• Independent security review of initial, reload, model/agent-switch, MCP/plugin, stream-mode, and LSP execution paths

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Jul 27, 2026 2:14pm

[Copilot]

Pull request overview

This PR hardens hosted-review execution by preventing untrusted repository settings from launching external processes via the LSP tool, and by ensuring the hosted-review tool allowlist cannot include LSP even though it is marked PermissionLevel::ReadOnly.

Changes:

• Sanitize project settings by clearing config.lsp_servers so repo-provided LSP server definitions are never merged at startup.
• Exclude LSP from the hosted-review read-only tool allowlist via filter_read_only_tools_except(...).
• Add/update unit tests to prevent regressions in both the settings merge behavior and hosted-review tool filtering.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src-rust/crates/core/src/lib.rs	Clears lsp_servers during project-settings sanitization and adds a regression test ensuring project configs cannot inject LSP servers.
src-rust/crates/cli/src/main.rs	Updates hosted-review tool filtering to explicitly exclude LSP from the read-only allowlist and extends the hosted-review toolset test accordingly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.