@code-yeongyu/senpi 2026.10.16-3 → 2026.10.16-4

package/dist/core/extensions/builtin/anthropic-subscription/usage-limit-block.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Claude Code's own verdict that the account's subscription is spent: its anchored usage-limit prose
+ * or its structured terminal reason, under no status other than 429 (senpi#3462, senpi#3466).
+ */
+export declare function isConfirmedAccountUsageLimit(text: string): boolean;
+/**
+ * How long a spent account stays blocked: until the reset its limit names, or the reset its spent
+ * window reported, never past the window the limit belongs to. Undefined when the error is not
+ * Claude Code's account usage limit or names no reset, so the caller keeps its short default
+ * (senpi#3462).
+ */
+export declare function usageLimitBlockMs(text: string, accountName: string, now: number): number | undefined;
+//# sourceMappingURL=usage-limit-block.d.ts.map

package/dist/core/extensions/builtin/anthropic-subscription/usage-limit-block.js

@@ -0,0 +1,89 @@
+import { usageLimitResetMs } from "../../../credential-pool/reset-time.js";
+import { subscriptionLimits } from "../../../subscription-limits/limit-store.js";
+// The subscription-limit store keys accounts by this provider id (auth-attempt.ts).
+const PROVIDER = "anthropic-subscription";
+const HOUR_MS = 60 * 60 * 1_000;
+/**
+ * Claude Code's own account usage-limit errors, anchored at the start of the message: "You've hit
+ * your session limit · resets 3pm", "You've reached your 5-hour limit", "Claude AI usage limit
+ * reached". Only a window word Claude Code uses may stand before "limit", so a context or rate
+ * limit, a warning ("approaching your usage limit") or ordinary prose never takes a long block.
+ */
+const CLAUDE_USAGE_LIMIT = /^(?:You['\u2019]ve|You have) (?:hit|reached) your (?:(session|weekly|daily|monthly|\d+-hour|usage) )?limit(?=$|\s*[\u00b7\u2219.,{(]|\s+resets?\b)|^Claude AI usage limit reached\b/i;
+/**
+ * Claude Code's structured terminal reason for a spent subscription. `rapid_refill_breaker` is a short burst
+ * breaker, not a spent account, so it keeps the short, session-scoped block (senpi#3466).
+ */
+const TERMINAL_LIMIT_REASON = /\bblocking_limit\b/;
+/** A status the error names; a usage limit is a 429, so any other status is not one. */
+const NAMED_STATUS = /\b(?:HTTP|status(?: code)?)\s*(\d{3})\b/i;
+/** The longest a block may last for each window word: a reset read past it is a misread. */
+const WINDOW_MS = {
+    session: 5 * HOUR_MS,
+    daily: 24 * HOUR_MS,
+    weekly: 7 * 24 * HOUR_MS,
+    monthly: 31 * 24 * HOUR_MS,
+};
+/** A limit that names no window is capped at the shortest subscription window. */
+const UNNAMED_WINDOW_MS = 5 * HOUR_MS;
+function namedWindowMs(word) {
+    if (word === undefined)
+        return undefined;
+    const lower = word.toLowerCase();
+    const hours = /^(\d+)-hour$/.exec(lower);
+    if (hours)
+        return Number(hours[1]) * HOUR_MS;
+    return WINDOW_MS[lower];
+}
+/** The latest-resetting fully used window the SDK last reported for this account. */
+function spentWindow(accountName, now) {
+    const limits = subscriptionLimits
+        .snapshot()
+        .find((entry) => entry.provider === PROVIDER && entry.account === accountName);
+    let spent;
+    for (const window of limits?.windows ?? []) {
+        if (window.usedPercent < 100 || window.resetsAt === undefined)
+            continue;
+        const resetsAt = Date.parse(window.resetsAt);
+        if (!Number.isFinite(resetsAt) || resetsAt <= now)
+            continue;
+        if (spent === undefined || resetsAt - now > spent.resetMs) {
+            spent = {
+                resetMs: resetsAt - now,
+                windowMs: window.windowMinutes === undefined ? undefined : window.windowMinutes * 60_000,
+            };
+        }
+    }
+    return spent;
+}
+/**
+ * Claude Code's own verdict that the account's subscription is spent: its anchored usage-limit prose
+ * or its structured terminal reason, under no status other than 429 (senpi#3462, senpi#3466).
+ */
+export function isConfirmedAccountUsageLimit(text) {
+    const trimmed = text.trim();
+    if (!CLAUDE_USAGE_LIMIT.test(trimmed) && !TERMINAL_LIMIT_REASON.test(trimmed))
+        return false;
+    const status = NAMED_STATUS.exec(trimmed)?.[1];
+    return status === undefined || status === "429";
+}
+/**
+ * How long a spent account stays blocked: until the reset its limit names, or the reset its spent
+ * window reported, never past the window the limit belongs to. Undefined when the error is not
+ * Claude Code's account usage limit or names no reset, so the caller keeps its short default
+ * (senpi#3462).
+ */
+export function usageLimitBlockMs(text, accountName, now) {
+    const trimmed = text.trim();
+    if (!isConfirmedAccountUsageLimit(trimmed))
+        return undefined;
+    const shape = CLAUDE_USAGE_LIMIT.exec(trimmed);
+    const window = spentWindow(accountName, now);
+    const parsed = usageLimitResetMs(trimmed, now);
+    const resetMs = parsed !== undefined && parsed > 0 ? parsed : window?.resetMs;
+    if (resetMs === undefined)
+        return undefined;
+    const capMs = namedWindowMs(shape?.[1]) ?? window?.windowMs ?? UNNAMED_WINDOW_MS;
+    return Math.min(resetMs, capMs);
+}
+//# sourceMappingURL=usage-limit-block.js.map

package/dist/core/extensions/builtin/permission-system/always-scope.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The wider "Allow always" a prompt may offer for a tool WITHOUT its own permission parser, where
+ * plain "Allow always" remembers only the exact argument (one URL, one input) and so asks again for
+ * the next one (senpi#3403):
+ * - a URL argument: that URL's DOMAIN (scheme + canonical host + non-default port), stored as one
+ *   literal and matched by equality, never the whole tool: a tool-wide allow for a browser or
+ *   fetch tool would mean "go anywhere", close to Full access for the web;
+ * - a free `input`/`pattern` argument: the tool itself, for this project;
+ * - a command or a path: nothing wider (that would grant a shell or file access wholesale).
+ * Built-in tools (bash, eval, edit, write, read, ...) have parsers and never reach this.
+ */
+export interface WiderAlwaysScope {
+    /** The option label, stating the scope in plain words. */
+    readonly label: string;
+    /** The patterns an answer with this option approves for the permission. */
+    readonly patterns: string[];
+}
+/**
+ * The one normalizer both sides of a domain grant go through (senpi#3403). A parser-less tool (an
+ * MCP server, a custom tool) parses the URL itself, and the permission layer cannot make it reuse
+ * this parse. So a domain origin is given only for raw text every parser reads as the same host:
+ * the strict shape above, no ambiguous character anywhere, and the same host and port as the WHATWG
+ * parser finds (#3416 review: `https://example.invalid\\@evil.test/` is example.invalid to WHATWG and
+ * evil.test to curl and Python). Anything else gets no alias and no domain option, so it asks.
+ */
+export declare function canonicalUrlOrigin(raw: string): string | undefined;
+/**
+ * The match target a domain grant is written for: a literal that never contains a wildcard
+ * character, so the grant matches by equality. The `origin=` prefix keeps it from colliding with a
+ * user's own URL rules.
+ */
+export declare function urlOriginAlias(raw: string): string | undefined;
+export declare function widerAlwaysScope(toolName: string, argKey: string, arg: string): WiderAlwaysScope | undefined;
+//# sourceMappingURL=always-scope.d.ts.map

package/dist/core/extensions/builtin/permission-system/always-scope.js

@@ -0,0 +1,77 @@
+/** Never widened, even if a future change routes one of them through the fallback. */
+const NEVER_WIDENED = new Set([
+    "bash",
+    "eval",
+    "edit",
+    "write",
+    "read",
+    "apply_patch",
+    "multiedit",
+    "glob",
+    "grep",
+    "ls",
+]);
+/**
+ * The only raw URL shape that gets a domain alias: `http(s)://`, an ASCII DNS host (letters, digits,
+ * dots, dashes; no trailing dot), an optional port, then `/`, `?`, `#` or the end. No userinfo, no
+ * percent-escape, no IPv6 brackets.
+ */
+const UNAMBIGUOUS_URL = /^(https?):\/\/([A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)(?::([0-9]{1,5}))?(?:[/?#]|$)/;
+/** Characters that let one parser read another host than the next: backslash, `@`, `%`, whitespace, controls. */
+const AMBIGUOUS_CHARACTER = /[\\@%\s\u0000-\u001f\u007f]/;
+const DEFAULT_PORTS = { http: "80", https: "443" };
+/**
+ * The one normalizer both sides of a domain grant go through (senpi#3403). A parser-less tool (an
+ * MCP server, a custom tool) parses the URL itself, and the permission layer cannot make it reuse
+ * this parse. So a domain origin is given only for raw text every parser reads as the same host:
+ * the strict shape above, no ambiguous character anywhere, and the same host and port as the WHATWG
+ * parser finds (#3416 review: `https://example.invalid\\@evil.test/` is example.invalid to WHATWG and
+ * evil.test to curl and Python). Anything else gets no alias and no domain option, so it asks.
+ */
+export function canonicalUrlOrigin(raw) {
+    if (AMBIGUOUS_CHARACTER.test(raw))
+        return undefined;
+    const match = UNAMBIGUOUS_URL.exec(raw);
+    if (match === null)
+        return undefined;
+    const scheme = match[1].toLowerCase();
+    const host = match[2].toLowerCase();
+    const port = match[3] === undefined || match[3] === DEFAULT_PORTS[scheme] ? "" : String(Number(match[3]));
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== `${scheme}:` || url.hostname !== host || url.port !== port)
+        return undefined;
+    return `${scheme}://${host}${port === "" ? "" : `:${port}`}`;
+}
+/**
+ * The match target a domain grant is written for: a literal that never contains a wildcard
+ * character, so the grant matches by equality. The `origin=` prefix keeps it from colliding with a
+ * user's own URL rules.
+ */
+export function urlOriginAlias(raw) {
+    const origin = canonicalUrlOrigin(raw);
+    return origin === undefined ? undefined : `origin=${origin}`;
+}
+export function widerAlwaysScope(toolName, argKey, arg) {
+    if (NEVER_WIDENED.has(toolName))
+        return undefined;
+    if (argKey === "url") {
+        const origin = canonicalUrlOrigin(arg);
+        if (origin === undefined)
+            return undefined;
+        return {
+            label: `Allow ${toolName} on ${origin.slice(origin.indexOf("//") + 2)} always in this project`,
+            patterns: [`origin=${origin}`],
+        };
+    }
+    if (argKey === "input" || argKey === "pattern") {
+        return { label: `Allow ${toolName} always in this project`, patterns: ["*"] };
+    }
+    return undefined;
+}
+//# sourceMappingURL=always-scope.js.map

package/dist/core/extensions/builtin/permission-system/index.js

@@ -261,6 +261,7 @@ export default function permissionSystemExtension(pi) {
                 permission: permissionRequest.permission,
                 patterns: permissionRequest.patterns,
                 always: permissionRequest.always,
+                ...(permissionRequest.widerAlways ? { widerAlways: permissionRequest.widerAlways } : {}),
                 metadata: createRequestMetadata(event.toolName, event.input),
                 tool: {
                     callID: event.toolCallId,
@@ -295,7 +296,8 @@ export default function permissionSystemExtension(pi) {
                 const reply = await showPermissionPrompt(ctx, request, signal);
                 activeService.reply(reply);
                 if (reply.reply === "always") {
-                    persistAlways(ctx.agentDir, ctx.cwd, request, persistedAtAnswer);
+                    const answered = reply.always ? { ...request, always: reply.always } : request;
+                    persistAlways(ctx.agentDir, ctx.cwd, answered, persistedAtAnswer);
                 }
             }
             else {

package/dist/core/extensions/builtin/permission-system/parsers.d.ts

@@ -1,7 +1,7 @@
 import type { ToolInfo } from "../../types.ts";
 import type { Request } from "../permission-system/types.ts";
 /** Simplified permission request without ID/session metadata */
-export type PermissionRequest = Pick<Request, "permission" | "patterns" | "always"> & {
+export type PermissionRequest = Pick<Request, "permission" | "patterns" | "always" | "widerAlways"> & {
     readonly autoApproveAsk?: true;
     readonly ruleAliases?: readonly string[];
 };

package/dist/core/extensions/builtin/permission-system/parsers.js

@@ -4,6 +4,7 @@ import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
 import { BashArity } from "../permission-system/arity.js";
 import { extractExternalPaths, isExternalPath, toParentDirectoryPattern, } from "../permission-system/external-dir.js";
 import { setApprovedMonitorParent } from "../terminal/monitor-permission.js";
+import { urlOriginAlias, widerAlwaysScope } from "./always-scope.js";
 import { parseReadPermission } from "./read-permission.js";
 function fallbackPermissionRequest(permission) {
     return {
@@ -19,12 +20,32 @@ function fallbackPermissionRequest(permission) {
  * meaningful arg — path, command, url, or input — and keeps `*` only for a truly arg-less call.
  */
 function fallbackPermissionRequestFor(toolName, input) {
-    const arg = getString(input, "path", "file_path", "command", "url", "input", "pattern", "filePath");
-    if (arg === undefined)
+    const found = getStringEntry(input, "path", "file_path", "command", "url", "input", "pattern", "filePath");
+    if (found === undefined)
         return fallbackPermissionRequest(toolName);
+    const [argKey, arg] = found;
     // A bare `*` alongside the concrete arg would still match an ask/all rule and widen past a
     // pattern-specific deny, so the concrete arg is the only target; `*` is the arg-less fallback.
-    return { permission: toolName, patterns: [arg], always: [arg] };
+    // "Allow always" keeps the exact arg; a wider scope is a separate, labelled choice (senpi#3403).
+    const widerAlways = widerAlwaysScope(toolName, argKey, arg);
+    // A URL is also matched as its canonical origin, so a domain grant (a literal origin) applies to
+    // every spelling of that origin; rules on the raw URL, a deny included, still match the raw URL.
+    const originAlias = argKey === "url" ? urlOriginAlias(arg) : undefined;
+    return {
+        permission: toolName,
+        patterns: [arg],
+        always: [arg],
+        ...(originAlias === undefined ? {} : { ruleAliases: [arg, originAlias] }),
+        ...(widerAlways ? { widerAlways } : {}),
+    };
+}
+function getStringEntry(input, ...keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "string")
+            return [key, value];
+    }
+    return undefined;
 }
 function getString(input, ...keys) {
     for (const key of keys) {

package/dist/core/extensions/builtin/permission-system/prompt.js

@@ -2,7 +2,8 @@ export async function showPermissionPrompt(ctx, request, signal) {
     const title = `Permission required: ${request.permission}`;
     const message = formatRequestForDisplay(request);
     const displayTitle = `${title}\n\n${message}`;
-    const options = ["Allow once", "Allow always", "Deny", "Deny with feedback"];
+    const wider = request.widerAlways;
+    const options = ["Allow once", "Allow always", ...(wider ? [wider.label] : []), "Deny", "Deny with feedback"];
     // Clients bind the dialog to the call it approves by this id; with several calls of one tool in
     // flight (the engine prepares a message's calls before running them), nothing else says which.
     const call = request.tool
@@ -22,6 +23,9 @@ export async function showPermissionPrompt(ctx, request, signal) {
             message: feedback || undefined,
         };
     }
+    if (wider !== undefined && choice === wider.label) {
+        return { requestID: request.id, reply: "always", always: [...wider.patterns] };
+    }
     const replyMap = {
         "Allow once": "once",
         "Allow always": "always",

package/dist/core/extensions/builtin/permission-system/service.js

@@ -206,7 +206,7 @@ export class PermissionService {
         if (input.reply === "once") {
             return;
         }
-        for (const pattern of existing.info.always) {
+        for (const pattern of input.always ?? existing.info.always) {
             this.approved.push({
                 permission: existing.info.permission,
                 pattern,

package/dist/core/extensions/builtin/permission-system/types.d.ts

@@ -22,6 +22,11 @@ export type Request = {
     permission: string;
     patterns: string[];
     always: string[];
+    /** A wider "Allow always" scope the prompt may offer (tools without a parser, senpi#3403). */
+    widerAlways?: {
+        readonly label: string;
+        readonly patterns: string[];
+    };
     metadata: Record<string, unknown>;
     /** The tool call that raised this request (`parentCallID` when another tool issued it). */
     tool?: {
@@ -35,6 +40,8 @@ export type ReplyInput = {
     requestID: string;
     reply: Reply;
     message?: string;
+    /** With reply "always": the patterns to approve instead of the request's own (a wider scope). */
+    always?: string[];
 };
 /** Error thrown when user rejects a permission request */
 export declare class RejectedError extends Error {

package/dist/core/package-manager.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { chmodSync, existsSync, globSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { stripBom } from "../utils/text.js";
+import { projectAgentsSkillDirs } from "./trust-manager.js";
 function getEnv() {
     if (process.platform !== "linux" || Object.keys(process.env).length > 0) {
         return process.env;
@@ -207,36 +208,9 @@ function collectFiles(dir, filePattern, skipNodeModules = true, ignoreMatcher, r
     }
     return files;
 }
-function findGitRepoRoot(startDir) {
-    let dir = resolve(startDir);
-    while (true) {
-        if (existsSync(join(dir, ".git"))) {
-            return dir;
-        }
-        const parent = dirname(dir);
-        if (parent === dir) {
-            return null;
-        }
-        dir = parent;
-    }
-}
 function collectAncestorAgentsSkillDirs(startDir) {
-    const skillDirs = [];
-    const resolvedStartDir = resolve(startDir);
-    const gitRepoRoot = findGitRepoRoot(resolvedStartDir);
-    let dir = resolvedStartDir;
-    while (true) {
-        skillDirs.push(join(dir, ".agents", "skills"));
-        if (gitRepoRoot && dir === gitRepoRoot) {
-            break;
-        }
-        const parent = dirname(dir);
-        if (parent === dir) {
-            break;
-        }
-        dir = parent;
-    }
-    return skillDirs;
+    // The same walk the trust check uses: home and above are never project skills (#3420 review).
+    return projectAgentsSkillDirs(startDir);
 }
 function collectAutoPromptEntries(dir) {
     const entries = [];
@@ -1964,9 +1938,7 @@ export class DefaultPackageManager {
         };
         const userAgentsSkillsDir = join(getHomeDir(), ".agents", "skills");
         const projectTrusted = this.settingsManager.isProjectTrusted();
-        const projectAgentsSkillDirs = projectTrusted
-            ? collectAncestorAgentsSkillDirs(this.cwd).filter((dir) => resolve(dir) !== resolve(userAgentsSkillsDir))
-            : [];
+        const projectAgentsSkillDirs = projectTrusted ? collectAncestorAgentsSkillDirs(this.cwd) : [];
         const addResources = (resourceType, paths, metadata, overrides, baseDir) => {
             const target = this.getTargetMap(accumulator, resourceType);
             for (const path of paths) {

package/dist/core/project-trust.d.ts

@@ -2,6 +2,14 @@ import type { LoadExtensionsResult, ProjectTrustContext } from "./extensions/typ
 import type { DefaultProjectTrust } from "./settings-manager.ts";
 import { type ProjectTrustStore } from "./trust-manager.ts";
 export type AppMode = "interactive" | "print" | "json" | "rpc";
+/**
+ * Full access means no prompt anywhere (sisyphuslabs/omo-desktop-app#2465): a session whose
+ * permission preset is explicitly `full-access` trusts its project for that session. Explicit
+ * means the session's `permission-preset` flag (CLI, or `open_session.permissionPreset` through
+ * the launch profile), else the user's global setting. Project settings never count: they are what
+ * trust gates. The implicit default never counts either, so a plain launch keeps asking.
+ */
+export declare function presetTrustsProject(presetFlag: boolean | string | undefined, globalPreset: unknown): boolean;
 export interface ResolveProjectTrustedOptions {
     cwd: string;
     trustStore: ProjectTrustStore;

package/dist/core/project-trust.js

@@ -1,6 +1,18 @@
 import { APP_NAME, CONFIG_DIR_NAME } from "../config.js";
 import { emitProjectTrustEvent } from "./extensions/runner.js";
 import { getProjectTrustOptions, hasTrustRequiringProjectResources, } from "./trust-manager.js";
+/**
+ * Full access means no prompt anywhere (sisyphuslabs/omo-desktop-app#2465): a session whose
+ * permission preset is explicitly `full-access` trusts its project for that session. Explicit
+ * means the session's `permission-preset` flag (CLI, or `open_session.permissionPreset` through
+ * the launch profile), else the user's global setting. Project settings never count: they are what
+ * trust gates. The implicit default never counts either, so a plain launch keeps asking.
+ */
+export function presetTrustsProject(presetFlag, globalPreset) {
+    if (typeof presetFlag === "string")
+        return presetFlag === "full-access";
+    return globalPreset === "full-access";
+}
 function formatProjectTrustPrompt(cwd) {
     return `Trust project folder?\n${cwd}\n\nThis allows ${APP_NAME} to load ${CONFIG_DIR_NAME} settings and resources, install missing project packages, and execute project extensions.`;
 }

package/dist/core/resource-loader.d.ts

@@ -1,6 +1,8 @@
 import { type Theme } from "../modes/interactive/theme/theme.ts";
 import type { ResourceDiagnostic } from "./diagnostics.ts";
 export type { ResourceCollision, ResourceDiagnostic } from "./diagnostics.ts";
+export { loadProjectContextFiles };
+import { loadProjectContextFiles } from "./context-files.ts";
 import { type EventBus } from "./event-bus.ts";
 import type { HostMcpRegistry } from "./extensions/builtin/mcp/host-registry.ts";
 import type { ExtensionFactory, InlineExtension, LoadExtensionsResult, LoadedHookSources, SessionContext, SessionKind } from "./extensions/types.ts";
@@ -64,6 +66,7 @@ export interface ResourceLoader {
             path: string;
             content: string;
         }>;
+        diagnostics?: ResourceDiagnostic[];
     };
     getSystemPrompt(): string | undefined;
     getSystemPromptSource(): {
@@ -85,13 +88,6 @@ export interface ResourceLoader {
  * session. Canonicalizing collapses both spellings to one path.
  */
 export declare function canonicalizeGlobalDefaultExtensionModulePath(modulePath: string): string;
-export declare function loadProjectContextFiles(options: {
-    cwd: string;
-    agentDir: string;
-}): Array<{
-    path: string;
-    content: string;
-}>;
 export interface DefaultResourceLoaderOptions {
     cwd: string;
     agentDir: string;
@@ -185,6 +181,7 @@ export declare class DefaultResourceLoader implements ResourceLoader {
     private themes;
     private themeDiagnostics;
     private agentsFiles;
+    private contextDiagnostics;
     private systemPrompt?;
     private systemPromptSourcePath?;
     private appendSystemPrompt;
@@ -222,6 +219,7 @@ export declare class DefaultResourceLoader implements ResourceLoader {
             path: string;
             content: string;
         }>;
+        diagnostics: ResourceDiagnostic[];
     };
     getSystemPrompt(): string | undefined;
     getSystemPromptSource(): {

package/dist/core/resource-loader.js

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { detectCapabilities, getTerminalColorMode } from "@earendil-works/pi-tui";
 import chalk from "chalk";
@@ -7,22 +7,24 @@ import { APP_NAME, CONFIG_DIR_NAME, findNodePackageDir, getAgentDir, getPackageD
 import { loadThemeFromPath } from "../modes/interactive/theme/theme.js";
 import { resolveInstallPath } from "../runtime-snapshot/marker.js";
 import { ACCEPTED_SHIM_BANNERS, GENERATED_SHIM_BANNER } from "./generated-shim-banner.js";
+export { loadProjectContextFiles };
 import { canonicalizePath, isLocalPath, resolvePath } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
 import { bundledBuiltinExtensions } from "./bundled-resources.js";
+import { loadProjectContextFiles } from "./context-files.js";
 import { createEventBus } from "./event-bus.js";
 import { builtinExtensions, globalDefaultExtensionFactories, globalDefaultExtensionIds, } from "./extensions/builtin/index.js";
 import { createMcpExtension } from "./extensions/builtin/mcp/index.js";
 import { McpService } from "./extensions/builtin/mcp/service.js";
 import { createExtensionRuntime, loadExtensionFromFactory, loadExtensions, } from "./extensions/loader.js";
 import { EMPTY_SESSION_CONTEXT } from "./extensions/types.js";
-import { findGitPaths } from "./footer-data-provider.js";
 import { dedupePathsByPackageIdentity, findNearestPackageIdentity } from "./package-identity.js";
 import { DefaultPackageManager } from "./package-manager.js";
 import { loadPromptTemplates } from "./prompt-templates.js";
 import { memoizeResolvedPaths, resolvedPathsMemoKey } from "./resolved-paths-memo.js";
 import { SettingsManager } from "./settings-manager.js";
 import { loadSkills } from "./skills.js";
+import { warnIfLargeSkillCatalog } from "./skills-prompt.js";
 import { BUILTIN_PATH_PREFIX, createSourceInfo, getSyntheticPathSource, isSyntheticPath, } from "./source-info.js";
 import { resetTimings, time } from "./timings.js";
 const HOST_PROVIDED_EXTENSION_PACKAGES = new Set([
@@ -256,86 +258,9 @@ function resolveGeneratedGlobalDefaultExtensionFactory(extensionPath, agentDir)
         return undefined;
     }
 }
-function loadContextFileFromDir(dir) {
-    const candidates = ["AGENTS.override.md", "AGENTS.md", "AGENTS.MD", "CLAUDE.md", "CLAUDE.MD"];
-    for (const filename of candidates) {
-        const filePath = join(dir, filename);
-        if (existsSync(filePath)) {
-            try {
-                if (!statSync(filePath).isFile()) {
-                    continue;
-                }
-                return {
-                    path: filePath,
-                    content: stripBom(readFileSync(filePath, "utf-8")),
-                };
-            }
-            catch (error) {
-                console.error(chalk.yellow(`Warning: Could not read ${filePath}: ${error}`));
-            }
-        }
-    }
-    return null;
-}
-/**
- * The main repo's context file that a nested linked worktree's own copy shadows: both
- * occupy the same logical repository scope, so loading both applies that context twice. Returns
- * undefined when nothing is shadowed, leaving normal ancestor inheritance alone.
- *
- * Returned canonicalized (realpath), because `git worktree add` writes the `.git`
- * file's `gitdir:` target in realpath form while cwd may still be symlinked
- * (macOS `/tmp` -> `/private/tmp`).
- */
-function findShadowedContextFile(cwd) {
-    const gitPaths = findGitPaths(cwd);
-    if (!gitPaths)
-        return undefined;
-    const commonGitDir = canonicalizePath(gitPaths.commonGitDir);
-    const worktreeRoot = canonicalizePath(gitPaths.repoDir);
-    const mainRepoRoot = dirname(commonGitDir);
-    // False for an ordinary repo, where the two are the same dir, and for a sibling
-    // worktree (`git worktree add ../feat`), whose main repo is not an ancestor.
-    if (!worktreeRoot.startsWith(`${mainRepoRoot}${sep}`))
-        return undefined;
-    // dirname of the common git dir is the main worktree root only when that dir is
-    // itself checked out from the same repo. In a bare layout (`proj/.bare` +
-    // `proj/main`) it is just the directory holding `.bare`, which tracks nothing; a
-    // submodule's gitdir has no `commondir`, so it lands under `.git/modules`.
-    if (canonicalizePath(join(mainRepoRoot, ".git")) !== commonGitDir)
-        return undefined;
-    const worktreeContextFile = loadContextFileFromDir(worktreeRoot);
-    return worktreeContextFile ? join(mainRepoRoot, basename(worktreeContextFile.path)) : undefined;
-}
-export function loadProjectContextFiles(options) {
-    const resolvedCwd = resolvePath(options.cwd);
-    const resolvedAgentDir = resolvePath(options.agentDir);
-    const contextFiles = [];
-    const seenPaths = new Set();
-    const globalContext = loadContextFileFromDir(resolvedAgentDir);
-    if (globalContext) {
-        contextFiles.push(globalContext);
-        seenPaths.add(globalContext.path);
-    }
-    const ancestorContextFiles = [];
-    const shadowedContextFile = findShadowedContextFile(resolvedCwd);
-    let currentDir = resolvedCwd;
-    while (true) {
-        const contextFile = loadContextFileFromDir(currentDir);
-        const isShadowed = shadowedContextFile !== undefined && canonicalizePath(contextFile?.path ?? "") === shadowedContextFile;
-        if (contextFile && !isShadowed && !seenPaths.has(contextFile.path)) {
-            ancestorContextFiles.unshift(contextFile);
-            seenPaths.add(contextFile.path);
-        }
-        const parentDir = dirname(currentDir);
-        if (parentDir === currentDir)
-            break;
-        currentDir = parentDir;
-    }
-    contextFiles.push(...ancestorContextFiles);
-    return contextFiles;
-}
 export class DefaultResourceLoader {
     constructor(options) {
+        this.contextDiagnostics = [];
         this.cwd = resolvePath(options.cwd);
         this.agentDir = resolvePath(options.agentDir);
         this.settingsManager = options.settingsManager ?? SettingsManager.create(this.cwd, this.agentDir);
@@ -421,7 +346,7 @@ export class DefaultResourceLoader {
         return { themes: this.themes, diagnostics: this.themeDiagnostics };
     }
     getAgentsFiles() {
-        return { agentsFiles: this.agentsFiles };
+        return { agentsFiles: this.agentsFiles, diagnostics: this.contextDiagnostics };
     }
     getSystemPrompt() {
         return this.systemPrompt;
@@ -616,14 +541,16 @@ export class DefaultResourceLoader {
         }
         const agentsFiles = {
             agentsFiles: this.noContextFiles
-                ? []
+                ? Object.assign([], { diagnostics: [] })
                 : loadProjectContextFiles({
                     cwd: this.cwd,
                     agentDir: this.agentDir,
+                    ...this.settingsManager.getSettings().contextFiles,
                 }),
         };
         const resolvedAgentsFiles = this.agentsFilesOverride ? this.agentsFilesOverride(agentsFiles) : agentsFiles;
-        this.agentsFiles = resolvedAgentsFiles.agentsFiles;
+        this.agentsFiles = [...resolvedAgentsFiles.agentsFiles];
+        this.contextDiagnostics = agentsFiles.agentsFiles.diagnostics;
         time("contextFiles", "extensions");
         // SYSTEM.md / APPEND_SYSTEM.md file discovery was intentionally removed; the explicit
         // options are the only static prompt source (see packages/coding-agent/changes.md).
@@ -872,7 +799,7 @@ export class DefaultResourceLoader {
                 skill.sourceInfo ??
                 this.getDefaultSourceInfoForPath(skill.filePath),
         }));
-        this.skillDiagnostics = resolvedSkills.diagnostics;
+        this.skillDiagnostics = [...resolvedSkills.diagnostics, ...warnIfLargeSkillCatalog(this.skills)];
     }
     updatePromptsFromPaths(promptPaths, metadataByPath) {
         let promptsResult;

package/dist/core/retry-fallback/circuit-probes.d.ts

@@ -16,6 +16,7 @@ export declare class CircuitProbes {
     constructor(circuits: FallbackCircuitAccess | undefined);
     isOpen(selector: string): boolean;
     governs(selector: string): boolean;
+    isExhausted(selector: string): boolean;
     admit(selector: string): CircuitAdmission["kind"];
     holds(selector: string): boolean;
     get probing(): string | undefined;