@code-yeongyu/senpi 2026.6.6-3 → 2026.6.10-2

package/dist/core/resource-loader.js

@@ -101,25 +101,23 @@ export function loadProjectContextFiles(options) {
         contextFiles.push(globalContext);
         seenPaths.add(globalContext.path);
     }
-    if (options.projectTrusted !== false) {
-        const ancestorContextFiles = [];
-        let currentDir = resolvedCwd;
-        const root = resolve("/");
-        while (true) {
-            const contextFile = loadContextFileFromDir(currentDir);
-            if (contextFile && !seenPaths.has(contextFile.path)) {
-                ancestorContextFiles.unshift(contextFile);
-                seenPaths.add(contextFile.path);
-            }
-            if (currentDir === root)
-                break;
-            const parentDir = resolve(currentDir, "..");
-            if (parentDir === currentDir)
-                break;
-            currentDir = parentDir;
-        }
-        contextFiles.push(...ancestorContextFiles);
-    }
+    const ancestorContextFiles = [];
+    let currentDir = resolvedCwd;
+    const root = resolve("/");
+    while (true) {
+        const contextFile = loadContextFileFromDir(currentDir);
+        if (contextFile && !seenPaths.has(contextFile.path)) {
+            ancestorContextFiles.unshift(contextFile);
+            seenPaths.add(contextFile.path);
+        }
+        if (currentDir === root)
+            break;
+        const parentDir = resolve(currentDir, "..");
+        if (parentDir === currentDir)
+            break;
+        currentDir = parentDir;
+    }
+    contextFiles.push(...ancestorContextFiles);
     return contextFiles;
 }
 export class DefaultResourceLoader {
@@ -211,8 +209,22 @@ export class DefaultResourceLoader {
             this.updateThemesFromPaths(this.lastThemePaths);
         }
     }
-    async reload() {
+    async loadProjectTrustExtensions() {
+        // Force untrusted project settings for the bootstrap pass. This keeps project-local
+        // extensions/packages out while still loading user/global and temporary CLI extensions.
+        this.settingsManager.setProjectTrusted(false);
+        await this.settingsManager.reload();
+        return this.loadCurrentExtensionSet({ includeInlineFactories: true });
+    }
+    async reload(options) {
         this.ensureGlobalDefaultExtensions();
+        let preTrustExtensions;
+        if (options?.resolveProjectTrust) {
+            preTrustExtensions = await this.loadProjectTrustExtensions();
+            const projectTrusted = await options.resolveProjectTrust({ extensionsResult: preTrustExtensions });
+            this.settingsManager.setProjectTrusted(projectTrusted);
+        }
+        // reload() preserves SettingsManager.projectTrusted and reloads settings for that trust state.
         await this.settingsManager.reload();
         const resolvedPaths = await this.packageManager.resolve();
         const cliExtensionPaths = await this.packageManager.resolveExtensionSources(this.additionalExtensionPaths, {
@@ -236,29 +248,7 @@ export class DefaultResourceLoader {
         const enabledSkillResources = getEnabledResources(resolvedPaths.skills);
         const enabledPrompts = getEnabledPaths(resolvedPaths.prompts);
         const enabledThemes = getEnabledPaths(resolvedPaths.themes);
-        const mapSkillPath = (resource) => {
-            if (resource.metadata.source !== "auto" && resource.metadata.origin !== "package") {
-                return resource.path;
-            }
-            try {
-                const stats = statSync(resource.path);
-                if (!stats.isDirectory()) {
-                    return resource.path;
-                }
-            }
-            catch {
-                return resource.path;
-            }
-            const skillFile = join(resource.path, "SKILL.md");
-            if (existsSync(skillFile)) {
-                if (!metadataByPath.has(skillFile)) {
-                    metadataByPath.set(skillFile, resource.metadata);
-                }
-                return skillFile;
-            }
-            return resource.path;
-        };
-        const enabledSkills = enabledSkillResources.map(mapSkillPath);
+        const enabledSkills = enabledSkillResources.map((resource) => this.mapSkillPath(resource, metadataByPath));
         // Add CLI paths metadata. Explicit -e/-s resources must keep CLI precedence
         // even when they resolve through a package manifest.
         for (const r of cliExtensionPaths.extensions) {
@@ -281,20 +271,7 @@ export class DefaultResourceLoader {
             ? cliEnabledExtensions
             : this.mergePaths(cliEnabledExtensions, enabledExtensions);
         const dedupedExtensionPaths = this.dedupeExtensionPathsByPackageName(this.shadowVendoredBuiltinExtensionPaths(extensionPaths, metadataByPath));
-        const factoryResolver = (_extensionPath, resolvedPath) => resolveGeneratedGlobalDefaultExtensionFactory(resolvedPath, this.agentDir);
-        const extensionsResult = await loadExtensions(dedupedExtensionPaths, this.cwd, this.eventBus, {
-            factoryResolver,
-        });
-        const inlineExtensions = await this.loadExtensionFactories(extensionsResult.runtime);
-        extensionsResult.extensions.unshift(...inlineExtensions.extensions);
-        this.rebuildExtensionFlagDefaults(extensionsResult);
-        extensionsResult.errors.push(...inlineExtensions.errors);
-        // Detect extension conflicts (tools, commands, flags with same names from different extensions)
-        // Keep all extensions loaded. Conflicts are reported as diagnostics, and precedence is handled by load order.
-        const conflicts = this.detectExtensionConflicts(extensionsResult.extensions);
-        for (const conflict of conflicts) {
-            extensionsResult.errors.push({ path: conflict.path, error: conflict.message });
-        }
+        const extensionsResult = await this.loadFinalExtensionSet(dedupedExtensionPaths, preTrustExtensions);
         for (const p of this.additionalExtensionPaths) {
             if (isLocalPath(p)) {
                 const resolved = this.resolveResourcePath(p);
@@ -352,7 +329,6 @@ export class DefaultResourceLoader {
                 : loadProjectContextFiles({
                     cwd: this.cwd,
                     agentDir: this.agentDir,
-                    projectTrusted: this.settingsManager.isProjectTrusted(),
                 }),
         };
         const resolvedAgentsFiles = this.agentsFilesOverride ? this.agentsFilesOverride(agentsFiles) : agentsFiles;
@@ -382,6 +358,100 @@ export class DefaultResourceLoader {
             writeFileSync(targetPath, shim, "utf-8");
         }
     }
+    buildGlobalDefaultExtensionLoadOptions() {
+        return {
+            factoryResolver: (_extensionPath, resolvedPath) => resolveGeneratedGlobalDefaultExtensionFactory(resolvedPath, this.agentDir),
+        };
+    }
+    async loadCurrentExtensionSet(options) {
+        const resolvedPaths = await this.packageManager.resolve();
+        const cliExtensionPaths = await this.packageManager.resolveExtensionSources(this.additionalExtensionPaths, {
+            temporary: true,
+        });
+        const enabledExtensions = resolvedPaths.extensions.filter((r) => r.enabled).map((r) => r.path);
+        const cliEnabledExtensions = cliExtensionPaths.extensions.filter((r) => r.enabled).map((r) => r.path);
+        const extensionPaths = this.noExtensions
+            ? cliEnabledExtensions
+            : this.mergePaths(cliEnabledExtensions, enabledExtensions);
+        const extensionsResult = await loadExtensions(extensionPaths, this.cwd, this.eventBus, undefined, this.buildGlobalDefaultExtensionLoadOptions());
+        if (!options.includeInlineFactories) {
+            return extensionsResult;
+        }
+        const inlineExtensions = await this.loadExtensionFactories(extensionsResult.runtime);
+        extensionsResult.extensions.push(...inlineExtensions.extensions);
+        extensionsResult.errors.push(...inlineExtensions.errors);
+        return extensionsResult;
+    }
+    resolveExtensionLoadPath(path) {
+        return resolvePath(path, this.cwd, { normalizeUnicodeSpaces: true });
+    }
+    async loadFinalExtensionSet(extensionPaths, preTrustExtensions) {
+        if (!preTrustExtensions) {
+            const extensionsResult = await loadExtensions(extensionPaths, this.cwd, this.eventBus, undefined, this.buildGlobalDefaultExtensionLoadOptions());
+            const inlineExtensions = await this.loadExtensionFactories(extensionsResult.runtime);
+            extensionsResult.extensions.unshift(...inlineExtensions.extensions);
+            this.rebuildExtensionFlagDefaults(extensionsResult);
+            extensionsResult.errors.push(...inlineExtensions.errors);
+            this.addExtensionConflictDiagnostics(extensionsResult);
+            return extensionsResult;
+        }
+        const preloadedByPath = new Map(preTrustExtensions.extensions
+            .filter((extension) => !extension.path.startsWith("<inline:"))
+            .map((extension) => [extension.resolvedPath, extension]));
+        const failedPreloadPaths = new Set(preTrustExtensions.errors.map((error) => this.resolveExtensionLoadPath(error.path)));
+        const remainingPaths = extensionPaths.filter((path) => {
+            const resolvedPath = this.resolveExtensionLoadPath(path);
+            return !preloadedByPath.has(resolvedPath) && !failedPreloadPaths.has(resolvedPath);
+        });
+        const remainingExtensions = await loadExtensions(remainingPaths, this.cwd, this.eventBus, preTrustExtensions.runtime, this.buildGlobalDefaultExtensionLoadOptions());
+        const loadedByPath = new Map(preloadedByPath);
+        for (const extension of remainingExtensions.extensions) {
+            loadedByPath.set(extension.resolvedPath, extension);
+        }
+        const inlineExtensions = preTrustExtensions.extensions.filter((extension) => extension.path.startsWith("<inline:"));
+        const orderedExtensions = extensionPaths
+            .map((path) => loadedByPath.get(this.resolveExtensionLoadPath(path)))
+            .filter((extension) => extension !== undefined);
+        orderedExtensions.unshift(...inlineExtensions);
+        const extensionsResult = {
+            extensions: orderedExtensions,
+            errors: [...preTrustExtensions.errors, ...remainingExtensions.errors],
+            runtime: preTrustExtensions.runtime,
+        };
+        this.rebuildExtensionFlagDefaults(extensionsResult);
+        this.addExtensionConflictDiagnostics(extensionsResult);
+        return extensionsResult;
+    }
+    addExtensionConflictDiagnostics(extensionsResult) {
+        // Detect extension conflicts (tools, commands, flags with same names from different extensions)
+        // Keep all extensions loaded. Conflicts are reported as diagnostics, and precedence is handled by load order.
+        const conflicts = this.detectExtensionConflicts(extensionsResult.extensions);
+        for (const conflict of conflicts) {
+            extensionsResult.errors.push({ path: conflict.path, error: conflict.message });
+        }
+    }
+    mapSkillPath(resource, metadataByPath) {
+        if (resource.metadata.source !== "auto" && resource.metadata.origin !== "package") {
+            return resource.path;
+        }
+        try {
+            const stats = statSync(resource.path);
+            if (!stats.isDirectory()) {
+                return resource.path;
+            }
+        }
+        catch {
+            return resource.path;
+        }
+        const skillFile = join(resource.path, "SKILL.md");
+        if (existsSync(skillFile)) {
+            if (!metadataByPath.has(skillFile)) {
+                metadataByPath.set(skillFile, resource.metadata);
+            }
+            return skillFile;
+        }
+        return resource.path;
+    }
     normalizeExtensionPaths(entries) {
         return entries.map((entry) => {
             const metadata = entry.metadata.baseDir