serena
serena copied to clipboard
feat: Add TOML language support via Taplo
Summary
- Add TOML language server using Taplo with automatic binary download for .toml file validation, formatting, and schema support
- Implement security hardening: SHA256 checksum verification, zip slip protection, download timeout
- Enable
serena project indexto work on projects with TOML in their language configuration
Fixes
Fixes #796
Details
TOML Language Support
- New
TaploServerclass insrc/solidlsp/language_servers/taplo_server.py - Automatic Taplo binary download for Windows, macOS, and Linux (x86_64, x86, aarch64, armv7)
- LSP integration for document symbols, hover, completion, and formatting
- TOML-specific directory ignore patterns (target, .cargo, node_modules)
Security Features
- SHA256 checksum verification: Validates downloaded binaries against hardcoded hashes from official Taplo 0.10.0 releases
- Zip slip protection: Validates archive paths to prevent directory traversal attacks
- Download timeout: 120-second timeout prevents indefinite hangs on network issues
Issue Resolution
When project.yml contains languages: ["toml"] but TOML isn't in the Language enum, ProjectConfig.load() raises ValueError: 'toml' is not a valid Language. This commonly occurs in Rust projects where users want to index Cargo.toml alongside .rs files. Adding TOML to the Language enum resolves this.
Test Plan
- [ ] Run
uv run poe test -m tomlto verify TOML language server tests pass - [ ] Test on a Rust project with
languages: ["toml"]in project.yml - [ ] Verify Taplo auto-downloads correctly on first use
- [ ] Confirm SHA256 verification works (modify hash to test rejection)