feat: add lsp and auto-permissions stack

config/lsp.json

@@ -0,0 +1,54 @@
+{
+  "version": 1,
+  "servers": [
+    {
+      "id": "kotlin-lsp",
+      "enabled": true,
+      "include": ["**/*.kt", "**/*.kts"],
+      "exclude": ["**/.gradle/**", "**/build/**"],
+      "rootMarkers": [
+        "settings.gradle.kts",
+        "settings.gradle",
+        "pom.xml",
+        "build.gradle.kts",
+        "build.gradle",
+        ".git"
+      ],
+      "bin": "kotlin-lsp",
+      "args": ["--stdio"],
+      "cwd": "{root}",
+      "languageIdByExtension": {
+        ".kt": "kotlin",
+        ".kts": "kotlin"
+      },
+      "startupTimeoutMs": 120000,
+      "diagnosticsWaitMs": 3000,
+      "initializationOptions": {},
+      "settings": {}
+    },
+    {
+      "id": "jdtls",
+      "enabled": true,
+      "include": ["**/*.java"],
+      "exclude": ["**/.gradle/**", "**/build/**", "**/target/**"],
+      "rootMarkers": [
+        "settings.gradle.kts",
+        "settings.gradle",
+        "pom.xml",
+        "build.gradle.kts",
+        "build.gradle",
+        ".git"
+      ],
+      "bin": "jdtls",
+      "args": [],
+      "cwd": "{root}",
+      "languageIdByExtension": {
+        ".java": "java"
+      },
+      "startupTimeoutMs": 120000,
+      "diagnosticsWaitMs": 3000,
+      "initializationOptions": {},
+      "settings": {}
+    }
+  ]
+}

config/pi-auto-permissions.json

@@ -0,0 +1,27 @@
+{
+  "enabled": true,
+  "reviewEvidence": {
+    "projectInstructions": true
+  },
+  "ui": {
+    "enabled": true,
+    "resultDisplayMs": 2500,
+    "placement": "widget"
+  },
+  "rules": [
+    {
+      "pattern": "\\bgit\\s+(?!(?:status|diff|log|show|rev-parse|ls-files|grep)\\b)(?!branch(?:\\s+--show-current[^\\r\\n;&|]*)?\\s*(?:$|[;&|]))(?!remote\\s+(?:-v|get-url)\\b)",
+      "flags": "i",
+      "level": "guarded",
+      "group": "git",
+      "label": "Git mutation or network operation"
+    },
+    {
+      "pattern": "(?:^|[\\n;&|])\\s*(?:(?:npm|pnpm|bun)\\s+(?:install|add|uninstall|update)\\b|pip3?\\s+install\\b|brew\\s+(?:install|uninstall)\\b)",
+      "flags": "i",
+      "level": "guarded",
+      "group": "packages",
+      "label": "Package installation or removal"
+    }
+  ]
+}

config/pi-permission-system.json

@@ -43,7 +43,6 @@
       "grep*": "deny",
       "find*": "deny",
       "fd*": "deny",
-      "git *": "ask",
       "git status*": "allow",
       "git diff*": "allow",
       "git log*": "allow",
@@ -82,17 +81,6 @@
       "rsync *": "ask",
       "curl *": "ask",
       "wget *": "ask",
-      "npm install*": "ask",
-      "npm uninstall*": "ask",
-      "npm update*": "ask",
-      "pnpm add*": "ask",
-      "pnpm install*": "ask",
-      "bun add*": "ask",
-      "bun install*": "ask",
-      "pip install*": "ask",
-      "pip3 install*": "ask",
-      "brew install*": "ask",
-      "brew uninstall*": "ask",
       "printenv*": "ask"
     },
     "mcp": {