@code-yeongyu/senpi 2026.10.16-2 → 2026.10.16-4

package/dist/core/settings-manager.d.ts

@@ -4,6 +4,7 @@ import type { RetryPolicyProfile } from "@earendil-works/pi-ai/utils/retry-profi
 import type { TuiMode as RendererTuiMode, ScrollViewScrollbar, TerminalCapabilities, WheelScrollLines } from "@earendil-works/pi-tui";
 import type { CompactionModelSelector, CompactionSettings } from "./compaction-settings-access.ts";
 import { type ResolvedCompactionSettings } from "./compaction-settings-resolver.ts";
+import type { ContextFileLimits } from "./context-files.ts";
 import { type FallbackCircuitSettings, type ResolvedFallbackCircuitSettings } from "./retry-fallback/circuit.ts";
 import { type ResolvedHintPolicySettings, type ResolvedRetryFallbackSettings, type RetrySettings as RetrySettingsConfig } from "./retry-fallback/settings.ts";
 import { parseSettingsJson } from "./settings-json.ts";
@@ -68,6 +69,7 @@ export interface Settings {
     compaction?: CompactionSettings & {
         model?: string;
     };
+    contextFiles?: ContextFileLimits;
     branchSummary?: BranchSummarySettings;
     retry?: RetrySettingsConfig;
     fallback?: FallbackCircuitSettings;
@@ -108,6 +110,8 @@ export interface Settings {
         maxPerUserInput?: number;
         maxToolFreePerMinute?: number;
     };
+    turn_inactivity_ms?: number;
+    turn_max_runtime_ms?: number;
     todo?: TodoSettings;
     recommendedModels?: string[];
     favoriteModels?: string[];
@@ -165,6 +169,8 @@ export declare function getSettingsPath(cwd: string, agentDir: string, scope: Se
 export declare function getInMemorySettingsPath(scope: SettingsScope): string;
 export interface SettingsManagerCreateOptions {
     projectTrusted?: boolean;
+    /** The project trust exists only because the session runs Full access (senpi#3414): leaving it withdraws the trust. */
+    trustFromFullAccess?: boolean;
 }
 export interface SettingsStorage {
     withLock(scope: SettingsScope, fn: (current: string | undefined) => string | undefined): void;
@@ -274,9 +280,22 @@ export declare class SettingsManager {
         maxPerUserInput: number;
         maxToolFreePerMinute: number;
     };
+    getTurnInactivityMs(): number | undefined;
+    getTurnMaxRuntimeMs(): number | undefined;
     getTodoFirstTurnPlan(): TodoFirstTurnPlan;
     getTodoTurnEndBackstop(): boolean;
     isProjectTrusted(): boolean;
+    /**
+     * True when this session's project trust came only from its Full access preset (never asked, never
+     * saved): leaving Full access withdraws it, and going back restores it (senpi#3414, #3420).
+     */
+    private trustFromFullAccess;
+    isTrustFromFullAccess(): boolean;
+    /** True when a Full-access-only trust was withdrawn in this session and Full access may restore it. */
+    canRestoreFullAccessTrust(): boolean;
+    /** Counts project-trust changes; a reload compares it before installing what it loaded (#3420). */
+    private trustEpoch;
+    getTrustEpoch(): number;
     setProjectTrusted(trusted: boolean): void;
     reload(): Promise<void>;
     getSelectedSettingsSources(): SettingsSourceSelection[];

package/dist/core/settings-manager.js

@@ -465,6 +465,13 @@ export class SettingsManager {
         this.selectedSources = new Map();
         this.sourceListeners = [];
         this.providerSettingsListeners = new Set();
+        /**
+         * True when this session's project trust came only from its Full access preset (never asked, never
+         * saved): leaving Full access withdraws it, and going back restores it (senpi#3414, #3420).
+         */
+        this.trustFromFullAccess = false;
+        /** Counts project-trust changes; a reload compares it before installing what it loaded (#3420). */
+        this.trustEpoch = 0;
         this.storage = storage;
         this.globalSettings = initialGlobal;
         this.projectSettings = initialProject;
@@ -506,7 +513,9 @@ export class SettingsManager {
         if (projectLoad.error) {
             initialErrors.push(toSettingsError("project", projectLoad.error, settingsPaths.project));
         }
-        return new SettingsManager(storage, globalLoad.settings, projectLoad.settings, globalLoad.error, projectLoad.error, initialErrors, projectTrusted, initialSources, settingsPaths);
+        const manager = new SettingsManager(storage, globalLoad.settings, projectLoad.settings, globalLoad.error, projectLoad.error, initialErrors, projectTrusted, initialSources, settingsPaths);
+        manager.trustFromFullAccess = options.trustFromFullAccess === true;
+        return manager;
     }
     /** Create an in-memory SettingsManager (no file I/O) */
     static inMemory(settings = {}, options = {}) {
@@ -717,6 +726,12 @@ export class SettingsManager {
             maxToolFreePerMinute: limit(configured?.maxToolFreePerMinute, MAX_TOOL_FREE_ENGINE_TURNS_PER_WINDOW),
         };
     }
+    getTurnInactivityMs() {
+        return this.settings.turn_inactivity_ms;
+    }
+    getTurnMaxRuntimeMs() {
+        return this.settings.turn_max_runtime_ms;
+    }
     getTodoFirstTurnPlan() {
         const configured = this.settings.todo?.firstTurnPlan;
         return configured === "remind" || configured === "off" ? configured : "force";
@@ -728,11 +743,22 @@ export class SettingsManager {
     isProjectTrusted() {
         return this.projectTrusted;
     }
+    isTrustFromFullAccess() {
+        return this.trustFromFullAccess && this.projectTrusted;
+    }
+    /** True when a Full-access-only trust was withdrawn in this session and Full access may restore it. */
+    canRestoreFullAccessTrust() {
+        return this.trustFromFullAccess && !this.projectTrusted;
+    }
+    getTrustEpoch() {
+        return this.trustEpoch;
+    }
     setProjectTrusted(trusted) {
         if (this.projectTrusted === trusted) {
             return;
         }
         this.projectTrusted = trusted;
+        this.trustEpoch += 1;
         this.modifiedProjectFields.clear();
         this.modifiedProjectNestedFields.clear();
         if (!trusted) {

package/dist/core/settings-shapes.d.ts

@@ -49,4 +49,8 @@ export interface OpenAISettings {
 export interface ProviderConcurrencySettings {
     maxConcurrency?: number;
 }
+export interface TurnDeadlineSettings {
+    turn_inactivity_ms?: number;
+    turn_max_runtime_ms?: number;
+}
 //# sourceMappingURL=settings-shapes.d.ts.map

package/dist/core/skills-prompt.d.ts

@@ -0,0 +1,18 @@
+import type { ResourceDiagnostic } from "./diagnostics.ts";
+import type { Skill } from "./skills.ts";
+export declare const COMPACT_SKILL_CATALOG_COUNT = 100;
+export declare const COMPACT_SKILL_CATALOG_DESCRIPTION_BYTES: number;
+export declare const MAX_SKILL_CATALOG_BYTES: number;
+/** A catalog this large is listed by name plus a one-line description, since it rides on every request. */
+export declare function isLargeSkillCatalog(skills: readonly Skill[]): boolean;
+export declare function warnIfLargeSkillCatalog(skills: readonly Skill[]): ResourceDiagnostic[];
+/**
+ * Format skills for inclusion in a system prompt.
+ * Uses XML format per Agent Skills standard.
+ * See: https://agentskills.io/integrate-skills
+ *
+ * Skills with disableModelInvocation=true are excluded from the prompt
+ * (they can only be invoked explicitly via /skill:name commands).
+ */
+export declare function formatSkillsForPrompt(skills: Skill[], fileReadTool?: "read" | "bash"): string;
+//# sourceMappingURL=skills-prompt.d.ts.map

package/dist/core/skills-prompt.js

@@ -0,0 +1,131 @@
+export const COMPACT_SKILL_CATALOG_COUNT = 100;
+export const COMPACT_SKILL_CATALOG_DESCRIPTION_BYTES = 64 * 1024;
+export const MAX_SKILL_CATALOG_BYTES = 48 * 1024;
+const ONE_LINE_DESCRIPTION_MAX_CHARS = 160;
+/** A catalog this large is listed by name plus a one-line description, since it rides on every request. */
+export function isLargeSkillCatalog(skills) {
+    if (skills.length > COMPACT_SKILL_CATALOG_COUNT)
+        return true;
+    const bytes = skills.reduce((sum, skill) => sum + Buffer.byteLength(skill.description, "utf8"), 0);
+    return bytes > COMPACT_SKILL_CATALOG_DESCRIPTION_BYTES;
+}
+export function warnIfLargeSkillCatalog(skills) {
+    const catalog = buildSkillCatalog(skills, "read");
+    if (!catalog.compact && !catalog.namesOnly)
+        return [];
+    return [
+        {
+            type: "warning",
+            category: "size-limit",
+            message: catalog.namesOnly
+                ? `The skills section is limited to ${MAX_SKILL_CATALOG_BYTES / 1024} KiB: descriptions were dropped and ${catalog.omitted} skills were omitted. Remove unused skills to shrink every request.`
+                : `The skills catalog uses one-line descriptions to limit request size (above ${COMPACT_SKILL_CATALOG_COUNT} skills, ${COMPACT_SKILL_CATALOG_DESCRIPTION_BYTES / 1024} KiB of descriptions, or ${MAX_SKILL_CATALOG_BYTES / 1024} KiB rendered). Remove unused skills to shrink every request.`,
+        },
+    ];
+}
+function buildSkillCatalog(skills, fileReadTool) {
+    const visible = skills.filter((skill) => !skill.disableModelInvocation);
+    const compact = isLargeSkillCatalog(visible);
+    const options = { fileReadTool, compact, namesOnly: false, omitted: 0 };
+    const prompt = renderSkills(visible, options);
+    if (Buffer.byteLength(prompt) <= MAX_SKILL_CATALOG_BYTES)
+        return { prompt, compact, namesOnly: false, omitted: 0 };
+    const compactPrompt = compact ? prompt : renderSkills(visible, { ...options, compact: true });
+    if (Buffer.byteLength(compactPrompt) <= MAX_SKILL_CATALOG_BYTES) {
+        return { prompt: compactPrompt, compact: true, namesOnly: false, omitted: 0 };
+    }
+    const minimal = { ...options, namesOnly: true };
+    const namesPrompt = renderSkills(visible, minimal);
+    if (Buffer.byteLength(namesPrompt) <= MAX_SKILL_CATALOG_BYTES) {
+        return { prompt: namesPrompt, compact, namesOnly: true, omitted: 0 };
+    }
+    let low = 0;
+    let high = visible.length;
+    while (low < high) {
+        const count = Math.ceil((low + high) / 2);
+        const candidate = renderSkills(visible.slice(0, count), { ...minimal, omitted: visible.length - count });
+        if (Buffer.byteLength(candidate) <= MAX_SKILL_CATALOG_BYTES)
+            low = count;
+        else
+            high = count - 1;
+    }
+    const omitted = visible.length - low;
+    return {
+        prompt: renderSkills(visible.slice(0, low), { ...minimal, omitted }),
+        compact,
+        namesOnly: true,
+        omitted,
+    };
+}
+function oneLineDescription(description) {
+    const firstLine = description.trim().split("\n", 1)[0]?.trim() ?? "";
+    return firstLine.length <= ONE_LINE_DESCRIPTION_MAX_CHARS
+        ? firstLine
+        : `${firstLine.slice(0, ONE_LINE_DESCRIPTION_MAX_CHARS - 1).trimEnd()}…`;
+}
+/**
+ * Format skills for inclusion in a system prompt.
+ * Uses XML format per Agent Skills standard.
+ * See: https://agentskills.io/integrate-skills
+ *
+ * Skills with disableModelInvocation=true are excluded from the prompt
+ * (they can only be invoked explicitly via /skill:name commands).
+ */
+// Skill roots share long absolute prefixes across every skill under them; rendering
+// that prefix per skill bills it once per skill. The roots table pays it once per
+// distinct root and each location becomes a short alias/relative path. A one-line
+// rule tells the model to expand aliases by joining them back to the root.
+// `fileReadTool` lets a bash-only tool set still load skills: the loading rule names
+// the tool the session actually has.
+export function formatSkillsForPrompt(skills, fileReadTool = "read") {
+    return buildSkillCatalog(skills, fileReadTool).prompt;
+}
+function renderSkills(visibleSkills, options) {
+    if (visibleSkills.length === 0 && options.omitted === 0) {
+        return "";
+    }
+    const rootByPath = new Map();
+    for (const skill of visibleSkills) {
+        const dir = skill.filePath.split("/").slice(0, -2).join("/"); // parent of <name>/SKILL.md
+        if (!rootByPath.has(dir))
+            rootByPath.set(dir, `r${rootByPath.size}`);
+    }
+    const lines = [
+        "\n\nThe following skills provide specialized instructions for specific tasks.",
+        options.fileReadTool === "read"
+            ? "Use the read tool to load a skill's file when its description matches the task and its instructions would change the work; keyword overlap or mere availability is not a reason."
+            : "Use bash to load a skill's file when its description matches the task and its instructions would change the work; keyword overlap or mere availability is not a reason.",
+        "When a skill file references a relative path, resolve it against the skill directory (parent of SKILL.md / dirname of the path) and use that absolute path in tool commands.",
+        "",
+        "<skill_roots>",
+    ];
+    for (const [dir, alias] of rootByPath) {
+        lines.push(`  <${alias}>${escapeXml(dir)}</${alias}>`);
+    }
+    lines.push("</skill_roots>", "A location's `rN/` prefix expands to the matching root above.", "", "<available_skills>");
+    for (const skill of visibleSkills) {
+        const dir = skill.filePath.split("/").slice(0, -2).join("/");
+        const alias = rootByPath.get(dir);
+        const relative = skill.filePath.startsWith(`${dir}/`) ? skill.filePath.slice(dir.length + 1) : skill.filePath;
+        lines.push("  <skill>");
+        lines.push(`    <name>${escapeXml(skill.name)}</name>`);
+        if (!options.namesOnly) {
+            lines.push(`    <description>${escapeXml(options.compact ? oneLineDescription(skill.description) : skill.description)}</description>`);
+        }
+        lines.push(`    <location>${escapeXml(`${alias}/${relative}`)}</location>`);
+        lines.push("  </skill>");
+    }
+    if (options.omitted > 0)
+        lines.push(`  <omitted_skills>${options.omitted}</omitted_skills>`);
+    lines.push("</available_skills>");
+    return lines.join("\n");
+}
+function escapeXml(str) {
+    return str
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+//# sourceMappingURL=skills-prompt.js.map

package/dist/core/skills.d.ts

@@ -1,5 +1,6 @@
 import type { ResourceDiagnostic } from "./diagnostics.ts";
 import { type SourceInfo } from "./source-info.ts";
+export { formatSkillsForPrompt } from "./skills-prompt.ts";
 export interface SkillFrontmatter {
     name?: string;
     description?: string;
@@ -39,15 +40,6 @@ export interface LoadSkillsFromDirOptions {
  * - recurse into subdirectories to find SKILL.md
  */
 export declare function loadSkillsFromDir(options: LoadSkillsFromDirOptions): LoadSkillsResult;
-/**
- * Format skills for inclusion in a system prompt.
- * Uses XML format per Agent Skills standard.
- * See: https://agentskills.io/integrate-skills
- *
- * Skills with disableModelInvocation=true are excluded from the prompt
- * (they can only be invoked explicitly via /skill:name commands).
- */
-export declare function formatSkillsForPrompt(skills: Skill[], fileReadTool?: "read" | "bash"): string;
 export interface LoadSkillsOptions {
     /** Working directory for project-local skills. */
     cwd: string;

package/dist/core/skills.js

@@ -6,6 +6,7 @@ import { parseFrontmatter } from "../utils/frontmatter.js";
 import { canonicalizePath, resolvePath } from "../utils/paths.js";
 import { readSkillMarkdownSource, shouldSkipSkillWalkDirectoryName } from "./skill-discovery.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
+export { formatSkillsForPrompt } from "./skills-prompt.js";
 /** Max name length per spec */
 const MAX_NAME_LENGTH = 64;
 /** Max description length per spec */
@@ -266,65 +267,6 @@ function loadSkillFromFile(filePath, source) {
         diagnostics,
     };
 }
-/**
- * Format skills for inclusion in a system prompt.
- * Uses XML format per Agent Skills standard.
- * See: https://agentskills.io/integrate-skills
- *
- * Skills with disableModelInvocation=true are excluded from the prompt
- * (they can only be invoked explicitly via /skill:name commands).
- */
-// Skill roots share long absolute prefixes across every skill under them; rendering
-// that prefix per skill bills it once per skill. The roots table pays it once per
-// distinct root and each location becomes a short alias/relative path. A one-line
-// rule tells the model to expand aliases by joining them back to the root.
-// `fileReadTool` lets a bash-only tool set still load skills: the loading rule names
-// the tool the session actually has.
-export function formatSkillsForPrompt(skills, fileReadTool = "read") {
-    const visibleSkills = skills.filter((s) => !s.disableModelInvocation);
-    if (visibleSkills.length === 0) {
-        return "";
-    }
-    const rootByPath = new Map();
-    for (const skill of visibleSkills) {
-        const dir = skill.filePath.split("/").slice(0, -2).join("/"); // parent of <name>/SKILL.md
-        if (!rootByPath.has(dir))
-            rootByPath.set(dir, `r${rootByPath.size}`);
-    }
-    const lines = [
-        "\n\nThe following skills provide specialized instructions for specific tasks.",
-        fileReadTool === "read"
-            ? "Use the read tool to load a skill's file when its description matches the task and its instructions would change the work; keyword overlap or mere availability is not a reason."
-            : "Use bash to load a skill's file when its description matches the task and its instructions would change the work; keyword overlap or mere availability is not a reason.",
-        "When a skill file references a relative path, resolve it against the skill directory (parent of SKILL.md / dirname of the path) and use that absolute path in tool commands.",
-        "",
-        "<skill_roots>",
-    ];
-    for (const [dir, alias] of rootByPath) {
-        lines.push(`  <${alias}>${escapeXml(dir)}</${alias}>`);
-    }
-    lines.push("</skill_roots>", "A location's `rN/` prefix expands to the matching root above.", "", "<available_skills>");
-    for (const skill of visibleSkills) {
-        const dir = skill.filePath.split("/").slice(0, -2).join("/");
-        const alias = rootByPath.get(dir);
-        const relative = skill.filePath.startsWith(`${dir}/`) ? skill.filePath.slice(dir.length + 1) : skill.filePath;
-        lines.push("  <skill>");
-        lines.push(`    <name>${escapeXml(skill.name)}</name>`);
-        lines.push(`    <description>${escapeXml(skill.description)}</description>`);
-        lines.push(`    <location>${escapeXml(`${alias}/${relative}`)}</location>`);
-        lines.push("  </skill>");
-    }
-    lines.push("</available_skills>");
-    return lines.join("\n");
-}
-function escapeXml(str) {
-    return str
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;")
-        .replace(/'/g, "&apos;");
-}
 /**
  * Load skills from all configured locations.
  * Returns skills and any validation diagnostics.

package/dist/core/trust-manager.d.ts

@@ -17,13 +17,22 @@ export declare function getProjectTrustParentPath(cwd: string): string | undefin
 export declare function getProjectTrustOptions(cwd: string, options?: {
     includeSessionOnly?: boolean;
 }): ProjectTrustOption[];
+/**
+ * The project `.agents/skills` directories for `cwd`, nearest first: one per folder from cwd up to
+ * the git root (or the filesystem root), stopping below the user's home. Home and every folder
+ * above it are never a project; `~/.agents/skills` is the user's own global skills. The ONE walk
+ * both the trust check and the loader use, over the same spelling and the same git root (#3420
+ * review): paths stay as spelled (resources are compared as strings), and each folder's real path
+ * decides whether it is home or above, so a symlink can't carry the walk past home either way.
+ */
+export declare function projectAgentsSkillDirs(cwd: string): string[];
 /**
  * Returns true when cwd has project-local resources that must be gated by
  * project trust: trust-requiring entries under the project config dir or the
- * legacy cwd/.pi dir (whose resources are also discovered), or .agents/skills in
- * cwd or one of its ancestors. Returns false when no such project resources
- * exist. The user/global ~/.agents/skills directory is always treated as a
- * trusted user resource and is ignored here, even when cwd is $HOME.
+ * legacy cwd/.pi dir (whose resources are also discovered), or a project
+ * `.agents/skills` (`projectAgentsSkillDirs`, the same walk the loader uses).
+ * The user's home and every folder above it are never a project: their config
+ * dirs and .agents/skills are the user's own global resources (#2465).
  */
 export declare function hasTrustRequiringProjectResources(cwd: string): boolean;
 export declare class ProjectTrustStore {

package/dist/core/trust-manager.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import lockfile from "proper-lockfile";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { canonicalizePath, canonicalizePathStrict, resolvePath } from "../utils/paths.js";
@@ -201,35 +201,66 @@ function withTrustFileLock(path, fn) {
         release();
     }
 }
+/** True when `dir` is the user's home or a folder above it: never a project (#2465). */
+function isHomeOrAboveDir(dir, homeDir) {
+    return dir === homeDir || homeDir.startsWith(dir.endsWith(sep) ? dir : `${dir}${sep}`);
+}
+/** The nearest folder at or above `dir` that holds `.git`, as spelled; undefined outside a repository. */
+function findGitRepoRoot(dir) {
+    let currentDir = dir;
+    while (!existsSync(join(currentDir, ".git"))) {
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir)
+            return undefined;
+        currentDir = parentDir;
+    }
+    return currentDir;
+}
+/**
+ * The project `.agents/skills` directories for `cwd`, nearest first: one per folder from cwd up to
+ * the git root (or the filesystem root), stopping below the user's home. Home and every folder
+ * above it are never a project; `~/.agents/skills` is the user's own global skills. The ONE walk
+ * both the trust check and the loader use, over the same spelling and the same git root (#3420
+ * review): paths stay as spelled (resources are compared as strings), and each folder's real path
+ * decides whether it is home or above, so a symlink can't carry the walk past home either way.
+ */
+export function projectAgentsSkillDirs(cwd) {
+    const homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));
+    const startDir = resolvePath(cwd);
+    const gitRepoRoot = findGitRepoRoot(startDir);
+    const dirs = [];
+    let currentDir = startDir;
+    while (!isHomeOrAboveDir(canonicalizePath(currentDir), homeDir)) {
+        dirs.push(join(currentDir, ".agents", "skills"));
+        if (currentDir === gitRepoRoot)
+            break;
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir)
+            break;
+        currentDir = parentDir;
+    }
+    return dirs;
+}
 /**
  * Returns true when cwd has project-local resources that must be gated by
  * project trust: trust-requiring entries under the project config dir or the
- * legacy cwd/.pi dir (whose resources are also discovered), or .agents/skills in
- * cwd or one of its ancestors. Returns false when no such project resources
- * exist. The user/global ~/.agents/skills directory is always treated as a
- * trusted user resource and is ignored here, even when cwd is $HOME.
+ * legacy cwd/.pi dir (whose resources are also discovered), or a project
+ * `.agents/skills` (`projectAgentsSkillDirs`, the same walk the loader uses).
+ * The user's home and every folder above it are never a project: their config
+ * dirs and .agents/skills are the user's own global resources (#2465).
  */
 export function hasTrustRequiringProjectResources(cwd) {
     const homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));
-    const userAgentsSkillsDir = join(homeDir, ".agents", "skills");
-    let currentDir = canonicalizePath(resolvePath(cwd));
-    const configDirs = [join(currentDir, CONFIG_DIR_NAME), join(currentDir, LEGACY_PROJECT_CONFIG_DIR_NAME)];
-    if (configDirs.some((configDir) => TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry))))) {
-        return true;
-    }
-    if (projectCodemodeNamesExecutable(join(currentDir, CONFIG_DIR_NAME)))
-        return true;
-    while (true) {
-        const agentsSkillsDir = join(currentDir, ".agents", "skills");
-        if (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {
+    const currentDir = canonicalizePath(resolvePath(cwd));
+    if (!isHomeOrAboveDir(currentDir, homeDir)) {
+        const configDirs = [join(currentDir, CONFIG_DIR_NAME), join(currentDir, LEGACY_PROJECT_CONFIG_DIR_NAME)];
+        if (configDirs.some((configDir) => TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry))))) {
             return true;
         }
-        const parentDir = dirname(currentDir);
-        if (parentDir === currentDir) {
-            return false;
-        }
-        currentDir = parentDir;
+        if (projectCodemodeNamesExecutable(join(currentDir, CONFIG_DIR_NAME)))
+            return true;
     }
+    return projectAgentsSkillDirs(cwd).some((dir) => existsSync(dir));
 }
 export class ProjectTrustStore {
     constructor(agentDir) {

package/dist/core/turn-deadline.d.ts

@@ -0,0 +1,92 @@
+export declare const TURN_DEADLINE_ENTRY_TYPE = "deadline-stop";
+export interface TurnDeadlineSettings {
+    readonly inactivityMs: number;
+    readonly maxRuntimeMs: number;
+}
+/** Milliseconds the abort is given to terminalize before the lease forces settlement. */
+export declare const TURN_DEADLINE_GRACE_MS = 10000;
+export declare const DEFAULT_TURN_INACTIVITY_MS = 3600000;
+export declare const MIN_TURN_INACTIVITY_MS = 60000;
+export declare const DEFAULT_TURN_MAX_RUNTIME_MS = 21600000;
+export type TurnDeadlineKind = "inactivity" | "max_runtime";
+export interface TurnDeadline {
+    readonly kind: TurnDeadlineKind;
+    readonly limitMs: number;
+    readonly elapsedMs: number;
+}
+/**
+ * The recorded form of a deadline stop, durable on the session branch so a config reload
+ * or session reopen keeps suppressing goal continuations until admitted user input.
+ */
+export interface DeadlineStopData {
+    readonly kind: TurnDeadlineKind;
+    readonly limitMs: number;
+    readonly elapsedMs: number;
+    readonly at: number;
+}
+interface DeadlineStopEntry {
+    readonly type: string;
+    readonly customType?: string;
+    readonly data?: unknown;
+    readonly message?: {
+        readonly role?: string;
+    };
+}
+/**
+ * The latest deadline stop on the branch, or undefined when none is pending. A
+ * deadline-stopped session suppresses every automatic continuation until admitted user
+ * input starts a new turn; the entry is read fresh so the hold survives reload and reopen.
+ * Only a user message releases the hold: the aborted assistant message of the stopped
+ * turn is persisted after the stop entry and must not clear it.
+ */
+export declare function deadlineStopPendingSinceLastTurn(entries: readonly DeadlineStopEntry[]): DeadlineStopData | undefined;
+export declare function resolveTurnDeadlineSettings(configured: {
+    readonly turn_inactivity_ms?: unknown;
+    readonly turn_max_runtime_ms?: unknown;
+}): TurnDeadlineSettings;
+/**
+ * The narrow AgentSession surface the tracker needs, declared here so the tracker lives
+ * with the rest of the deadline contract instead of inside agent-session.ts.
+ */
+export type TurnDeadlineWarning = "turn_deadline_record_failed" | "turn_deadline_abort_failed" | "turn_deadline_unsettled" | "turn_deadline_failed";
+export interface DeadlineSessionOwner {
+    _recordDeadlineStop(deadline: TurnDeadline): void;
+    /** End the turn through the normal system abort (tools see the abort signal); resolves once the session is idle. */
+    abortTurnForDeadline(): Promise<void>;
+    /** True while a provider retry is in flight; the engine is actively recovering the turn. */
+    readonly isRetryInFlight: boolean;
+    readonly isIdle: boolean;
+    /** A deadline stop that could not complete (the entry write failed, or the turn outlived the grace). */
+    _warnDeadline(event: TurnDeadlineWarning, detail: string): void;
+}
+/**
+ * Owns the inactivity lease and the hard max-runtime cap for one turn. Armed at prompt
+ * accept, renewed only by tool execution progress and admitted user input, never by text
+ * deltas. On expiry it records the durable stop entry and ends the run through the normal
+ * system-abort path. This is the single implementation of senpi#3227 for every surface.
+ */
+export declare class AgentDeadlineTracker {
+    private inactivityTimer;
+    private maxRuntimeTimer;
+    private deadlineValue;
+    private startedAtMs;
+    private readonly session;
+    private readonly settings;
+    private readonly now;
+    get current(): TurnDeadline | undefined;
+    constructor(session: DeadlineSessionOwner, settings: () => TurnDeadlineSettings, now?: () => number);
+    arm(): void;
+    renew(): void;
+    disarm(): void;
+    /**
+     * Admitted user input releases the deadline-stopped hold. Input steered into a live run counts as
+     * activity (the inactivity lease restarts) but never resets the max-runtime clock of that run.
+     */
+    clearHold(): void;
+    private clearTimers;
+    private fire;
+    private expire;
+}
+export declare function buildDeadlineStopNotice(deadline: TurnDeadline): string;
+export {};
+//# sourceMappingURL=turn-deadline.d.ts.map