@psnext/slingcli 2.5.20260607-2 → 2.5.20260615-2

package/node_modules/@earendil-works/pi-coding-agent/dist/core/resource-loader.js

@@ -54,25 +54,23 @@ export function loadProjectContextFiles(options) {
         contextFiles.push(globalContext);
         seenPaths.add(globalContext.path);
     }
-    if (options.projectTrusted !== false) {
-        const ancestorContextFiles = [];
-        let currentDir = resolvedCwd;
-        const root = resolve("/");
-        while (true) {
-            const contextFile = loadContextFileFromDir(currentDir);
-            if (contextFile && !seenPaths.has(contextFile.path)) {
-                ancestorContextFiles.unshift(contextFile);
-                seenPaths.add(contextFile.path);
-            }
-            if (currentDir === root)
-                break;
-            const parentDir = resolve(currentDir, "..");
-            if (parentDir === currentDir)
-                break;
-            currentDir = parentDir;
-        }
-        contextFiles.push(...ancestorContextFiles);
-    }
+    const ancestorContextFiles = [];
+    let currentDir = resolvedCwd;
+    const root = resolve("/");
+    while (true) {
+        const contextFile = loadContextFileFromDir(currentDir);
+        if (contextFile && !seenPaths.has(contextFile.path)) {
+            ancestorContextFiles.unshift(contextFile);
+            seenPaths.add(contextFile.path);
+        }
+        if (currentDir === root)
+            break;
+        const parentDir = resolve(currentDir, "..");
+        if (parentDir === currentDir)
+            break;
+        currentDir = parentDir;
+    }
+    contextFiles.push(...ancestorContextFiles);
     return contextFiles;
 }
 export class DefaultResourceLoader {
@@ -208,7 +206,21 @@ export class DefaultResourceLoader {
             this.updateThemesFromPaths(this.lastThemePaths);
         }
     }
-    async reload() {
+    async loadProjectTrustExtensions() {
+        // Force untrusted project settings for the bootstrap pass. This keeps project-local
+        // extensions/packages out while still loading user/global and temporary CLI extensions.
+        this.settingsManager.setProjectTrusted(false);
+        await this.settingsManager.reload();
+        return this.loadCurrentExtensionSet({ includeInlineFactories: true });
+    }
+    async reload(options) {
+        let preTrustExtensions;
+        if (options?.resolveProjectTrust) {
+            preTrustExtensions = await this.loadProjectTrustExtensions();
+            const projectTrusted = await options.resolveProjectTrust({ extensionsResult: preTrustExtensions });
+            this.settingsManager.setProjectTrusted(projectTrusted);
+        }
+        // reload() preserves SettingsManager.projectTrusted and reloads settings for that trust state.
         await this.settingsManager.reload();
         const resolvedPaths = await this.packageManager.resolve();
         const cliExtensionPaths = await this.packageManager.resolveExtensionSources(this.additionalExtensionPaths, {
@@ -232,29 +244,7 @@ export class DefaultResourceLoader {
         const enabledSkillResources = getEnabledResources(resolvedPaths.skills);
         const enabledPrompts = getEnabledPaths(resolvedPaths.prompts);
         const enabledThemes = getEnabledPaths(resolvedPaths.themes);
-        const mapSkillPath = (resource) => {
-            if (resource.metadata.source !== "auto" && resource.metadata.origin !== "package") {
-                return resource.path;
-            }
-            try {
-                const stats = statSync(resource.path);
-                if (!stats.isDirectory()) {
-                    return resource.path;
-                }
-            }
-            catch {
-                return resource.path;
-            }
-            const skillFile = join(resource.path, "SKILL.md");
-            if (existsSync(skillFile)) {
-                if (!metadataByPath.has(skillFile)) {
-                    metadataByPath.set(skillFile, resource.metadata);
-                }
-                return skillFile;
-            }
-            return resource.path;
-        };
-        const enabledSkills = enabledSkillResources.map(mapSkillPath);
+        const enabledSkills = enabledSkillResources.map((resource) => this.mapSkillPath(resource, metadataByPath));
         // Add CLI paths metadata
         for (const r of cliExtensionPaths.extensions) {
             if (!metadataByPath.has(r.path)) {
@@ -273,16 +263,7 @@ export class DefaultResourceLoader {
         const extensionPaths = this.noExtensions
             ? cliEnabledExtensions
             : this.mergePaths(cliEnabledExtensions, enabledExtensions);
-        const extensionsResult = await loadExtensions(extensionPaths, this.cwd, this.eventBus);
-        const inlineExtensions = await this.loadExtensionFactories(extensionsResult.runtime);
-        extensionsResult.extensions.push(...inlineExtensions.extensions);
-        extensionsResult.errors.push(...inlineExtensions.errors);
-        // Detect extension conflicts (tools, commands, flags with same names from different extensions)
-        // Keep all extensions loaded. Conflicts are reported as diagnostics, and precedence is handled by load order.
-        const conflicts = this.detectExtensionConflicts(extensionsResult.extensions);
-        for (const conflict of conflicts) {
-            extensionsResult.errors.push({ path: conflict.path, error: conflict.message });
-        }
+        const extensionsResult = await this.loadFinalExtensionSet(extensionPaths, preTrustExtensions);
         for (const p of this.additionalExtensionPaths) {
             if (isLocalPath(p)) {
                 const resolved = this.resolveResourcePath(p);
@@ -340,7 +321,6 @@ export class DefaultResourceLoader {
                 : loadProjectContextFiles({
                     cwd: this.cwd,
                     agentDir: this.agentDir,
-                    projectTrusted: this.settingsManager.isProjectTrusted(),
                 }),
         };
         const resolvedAgentsFiles = this.agentsFilesOverride ? this.agentsFilesOverride(agentsFiles) : agentsFiles;
@@ -356,6 +336,93 @@ export class DefaultResourceLoader {
             ? this.appendSystemPromptOverride(baseAppend)
             : baseAppend;
     }
+    async loadCurrentExtensionSet(options) {
+        const resolvedPaths = await this.packageManager.resolve();
+        const cliExtensionPaths = await this.packageManager.resolveExtensionSources(this.additionalExtensionPaths, {
+            temporary: true,
+        });
+        const enabledExtensions = resolvedPaths.extensions.filter((r) => r.enabled).map((r) => r.path);
+        const cliEnabledExtensions = cliExtensionPaths.extensions.filter((r) => r.enabled).map((r) => r.path);
+        const extensionPaths = this.noExtensions
+            ? cliEnabledExtensions
+            : this.mergePaths(cliEnabledExtensions, enabledExtensions);
+        const extensionsResult = await loadExtensions(extensionPaths, this.cwd, this.eventBus);
+        if (!options.includeInlineFactories) {
+            return extensionsResult;
+        }
+        const inlineExtensions = await this.loadExtensionFactories(extensionsResult.runtime);
+        extensionsResult.extensions.push(...inlineExtensions.extensions);
+        extensionsResult.errors.push(...inlineExtensions.errors);
+        return extensionsResult;
+    }
+    resolveExtensionLoadPath(path) {
+        return resolvePath(path, this.cwd, { normalizeUnicodeSpaces: true });
+    }
+    async loadFinalExtensionSet(extensionPaths, preTrustExtensions) {
+        if (!preTrustExtensions) {
+            const extensionsResult = await loadExtensions(extensionPaths, this.cwd, this.eventBus);
+            const inlineExtensions = await this.loadExtensionFactories(extensionsResult.runtime);
+            extensionsResult.extensions.push(...inlineExtensions.extensions);
+            extensionsResult.errors.push(...inlineExtensions.errors);
+            this.addExtensionConflictDiagnostics(extensionsResult);
+            return extensionsResult;
+        }
+        const preloadedByPath = new Map(preTrustExtensions.extensions
+            .filter((extension) => !extension.path.startsWith("<inline:"))
+            .map((extension) => [extension.resolvedPath, extension]));
+        const failedPreloadPaths = new Set(preTrustExtensions.errors.map((error) => this.resolveExtensionLoadPath(error.path)));
+        const remainingPaths = extensionPaths.filter((path) => {
+            const resolvedPath = this.resolveExtensionLoadPath(path);
+            return !preloadedByPath.has(resolvedPath) && !failedPreloadPaths.has(resolvedPath);
+        });
+        const remainingExtensions = await loadExtensions(remainingPaths, this.cwd, this.eventBus, preTrustExtensions.runtime);
+        const loadedByPath = new Map(preloadedByPath);
+        for (const extension of remainingExtensions.extensions) {
+            loadedByPath.set(extension.resolvedPath, extension);
+        }
+        const inlineExtensions = preTrustExtensions.extensions.filter((extension) => extension.path.startsWith("<inline:"));
+        const orderedExtensions = extensionPaths
+            .map((path) => loadedByPath.get(this.resolveExtensionLoadPath(path)))
+            .filter((extension) => extension !== undefined);
+        orderedExtensions.push(...inlineExtensions);
+        const extensionsResult = {
+            extensions: orderedExtensions,
+            errors: [...preTrustExtensions.errors, ...remainingExtensions.errors],
+            runtime: preTrustExtensions.runtime,
+        };
+        this.addExtensionConflictDiagnostics(extensionsResult);
+        return extensionsResult;
+    }
+    addExtensionConflictDiagnostics(extensionsResult) {
+        // Detect extension conflicts (tools, commands, flags with same names from different extensions)
+        // Keep all extensions loaded. Conflicts are reported as diagnostics, and precedence is handled by load order.
+        const conflicts = this.detectExtensionConflicts(extensionsResult.extensions);
+        for (const conflict of conflicts) {
+            extensionsResult.errors.push({ path: conflict.path, error: conflict.message });
+        }
+    }
+    mapSkillPath(resource, metadataByPath) {
+        if (resource.metadata.source !== "auto" && resource.metadata.origin !== "package") {
+            return resource.path;
+        }
+        try {
+            const stats = statSync(resource.path);
+            if (!stats.isDirectory()) {
+                return resource.path;
+            }
+        }
+        catch {
+            return resource.path;
+        }
+        const skillFile = join(resource.path, "SKILL.md");
+        if (existsSync(skillFile)) {
+            if (!metadataByPath.has(skillFile)) {
+                metadataByPath.set(skillFile, resource.metadata);
+            }
+            return skillFile;
+        }
+        return resource.path;
+    }
     normalizeExtensionPaths(entries) {
         return entries.map((entry) => {
             const metadata = entry.metadata.baseDir

package/node_modules/@earendil-works/pi-coding-agent/dist/core/session-manager.js

@@ -982,8 +982,17 @@ export class SessionManager {
         if (path.length === 0) {
             throw new Error(`Entry ${leafId} not found`);
         }
-        // Filter out LabelEntry from path - we'll recreate them from the resolved map
-        const pathWithoutLabels = path.filter((e) => e.type !== "label");
+        // Filter out LabelEntry from path - we'll recreate them from the resolved map.
+        // Because labels are real tree entries, later entries can be children of labels;
+        // removing labels requires re-chaining the retained path to avoid orphaned subtrees.
+        const pathWithoutLabels = [];
+        let pathParentId = null;
+        for (const entry of path) {
+            if (entry.type === "label")
+                continue;
+            pathWithoutLabels.push({ ...entry, parentId: pathParentId });
+            pathParentId = entry.id;
+        }
         const newSessionId = createSessionId();
         const timestamp = new Date().toISOString();
         const fileTimestamp = timestamp.replace(/[:.]/g, "-");

package/node_modules/@earendil-works/pi-coding-agent/dist/core/settings-manager.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import lockfile from "proper-lockfile";
@@ -594,6 +595,15 @@ export class SettingsManager {
         this.markModified("quietStartup");
         this.save();
     }
+    getDefaultProjectTrust() {
+        const value = this.globalSettings.defaultProjectTrust;
+        return value === "always" || value === "never" ? value : "ask";
+    }
+    setDefaultProjectTrust(defaultProjectTrust) {
+        this.globalSettings.defaultProjectTrust = defaultProjectTrust;
+        this.markModified("defaultProjectTrust");
+        this.save();
+    }
     getShellCommandPrefix() {
         return this.settings.shellCommandPrefix;
     }
@@ -626,6 +636,22 @@ export class SettingsManager {
         this.markModified("enableInstallTelemetry");
         this.save();
     }
+    getEnableAnalytics() {
+        return this.settings.enableAnalytics ?? false;
+    }
+    getTrackingId() {
+        return this.settings.trackingId;
+    }
+    /** Set the analytics opt-in preference; generates a tracking identifier on first opt-in */
+    setEnableAnalytics(enabled) {
+        this.globalSettings.enableAnalytics = enabled;
+        this.markModified("enableAnalytics");
+        if (enabled && !this.globalSettings.trackingId) {
+            this.globalSettings.trackingId = randomUUID();
+            this.markModified("trackingId");
+        }
+        this.save();
+    }
     getPackages() {
         return [...(this.settings.packages ?? [])];
     }

package/node_modules/@earendil-works/pi-coding-agent/dist/core/trust-manager.js

@@ -1,12 +1,71 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import lockfile from "proper-lockfile";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { canonicalizePath, resolvePath } from "../utils/paths.js";
-const CONTEXT_FILE_NAMES = ["AGENTS.md", "AGENTS.MD", "CLAUDE.md", "CLAUDE.MD"];
+const TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [
+    "settings.json",
+    "extensions",
+    "skills",
+    "prompts",
+    "themes",
+    "SYSTEM.md",
+    "APPEND_SYSTEM.md",
+];
 function normalizeCwd(cwd) {
     return canonicalizePath(resolvePath(cwd));
 }
+function findNearestTrustEntry(data, cwd) {
+    let currentDir = normalizeCwd(cwd);
+    while (true) {
+        const value = data[currentDir];
+        if (value === true || value === false) {
+            return { path: currentDir, decision: value };
+        }
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir) {
+            return null;
+        }
+        currentDir = parentDir;
+    }
+}
+export function getProjectTrustParentPath(cwd) {
+    const trustPath = normalizeCwd(cwd);
+    const parentDir = dirname(trustPath);
+    return parentDir === trustPath ? undefined : parentDir;
+}
+export function getProjectTrustOptions(cwd, options) {
+    const trustPath = normalizeCwd(cwd);
+    const trustOptions = [
+        { label: "Trust", trusted: true, updates: [{ path: trustPath, decision: true }], savedPath: trustPath },
+    ];
+    const parentPath = getProjectTrustParentPath(cwd);
+    if (parentPath !== undefined) {
+        trustOptions.push({
+            label: `Trust parent folder (${parentPath})`,
+            trusted: true,
+            updates: [
+                { path: parentPath, decision: true },
+                { path: trustPath, decision: null },
+            ],
+            savedPath: parentPath,
+        });
+    }
+    if (options?.includeSessionOnly) {
+        trustOptions.push({ label: "Trust (this session only)", trusted: true, updates: [] });
+    }
+    trustOptions.push({
+        label: "Do not trust",
+        trusted: false,
+        updates: [{ path: trustPath, decision: false }],
+        savedPath: trustPath,
+    });
+    if (options?.includeSessionOnly) {
+        trustOptions.push({ label: "Do not trust (this session only)", trusted: false, updates: [] });
+    }
+    return trustOptions;
+}
 function readTrustFile(path) {
     if (!existsSync(path)) {
         return {};
@@ -80,18 +139,24 @@ function withTrustFileLock(path, fn) {
         release();
     }
 }
-export function hasProjectTrustInputs(cwd) {
+/**
+ * Returns true when cwd has project-local resources that must be gated by
+ * project trust: trust-requiring entries under cwd/.pi, or .agents/skills in
+ * cwd or one of its ancestors. Returns false when no such project resources
+ * exist. The user/global ~/.agents/skills directory is always treated as a
+ * trusted user resource and is ignored here, even when cwd is $HOME.
+ */
+export function hasTrustRequiringProjectResources(cwd) {
+    const homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));
+    const userAgentsSkillsDir = join(homeDir, ".agents", "skills");
     let currentDir = canonicalizePath(resolvePath(cwd));
-    if (existsSync(join(currentDir, CONFIG_DIR_NAME))) {
+    const configDir = join(currentDir, CONFIG_DIR_NAME);
+    if (TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry)))) {
         return true;
     }
     while (true) {
-        for (const filename of CONTEXT_FILE_NAMES) {
-            if (existsSync(join(currentDir, filename))) {
-                return true;
-            }
-        }
-        if (existsSync(join(currentDir, ".agents", "skills"))) {
+        const agentsSkillsDir = join(currentDir, ".agents", "skills");
+        if (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {
             return true;
         }
         const parentDir = dirname(currentDir);
@@ -107,21 +172,28 @@ export class ProjectTrustStore {
         this.trustPath = join(resolvePath(agentDir), "trust.json");
     }
     get(cwd) {
+        return this.getEntry(cwd)?.decision ?? null;
+    }
+    getEntry(cwd) {
         return withTrustFileLock(this.trustPath, () => {
             const data = readTrustFile(this.trustPath);
-            const value = data[normalizeCwd(cwd)];
-            return value === true || value === false ? value : null;
+            return findNearestTrustEntry(data, cwd);
         });
     }
     set(cwd, decision) {
+        this.setMany([{ path: cwd, decision }]);
+    }
+    setMany(decisions) {
         withTrustFileLock(this.trustPath, () => {
             const data = readTrustFile(this.trustPath);
-            const key = normalizeCwd(cwd);
-            if (decision === null) {
-                delete data[key];
-            }
-            else {
-                data[key] = decision;
+            for (const { path, decision } of decisions) {
+                const key = normalizeCwd(path);
+                if (decision === null) {
+                    delete data[key];
+                }
+                else {
+                    data[key] = decision;
+                }
             }
             writeTrustFile(this.trustPath, data);
         });

package/node_modules/@earendil-works/pi-coding-agent/dist/index.js

@@ -1,7 +1,7 @@
 // Core session management
 export { parseArgs } from "./cli/args.js";
 // Config paths
-export { getAgentDir, VERSION } from "./config.js";
+export { getAgentDir, getDocsPath, getExamplesPath, getPackageDir, getReadmePath, VERSION } from "./config.js";
 export { AgentSession, parseSkillBlock, } from "./core/agent-session.js";
 // Auth and model registry
 export { AuthStorage, FileAuthStorageBackend, InMemoryAuthStorageBackend, } from "./core/auth-storage.js";
@@ -26,7 +26,7 @@ export { formatSkillsForPrompt, loadSkills, loadSkillsFromDir, } from "./core/sk
 export { createSyntheticSourceInfo } from "./core/source-info.js";
 // Tools
 export { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead, truncateLine, truncateTail, withFileMutationQueue, } from "./core/tools/index.js";
-export { hasProjectTrustInputs, ProjectTrustStore } from "./core/trust-manager.js";
+export { hasTrustRequiringProjectResources, ProjectTrustStore, } from "./core/trust-manager.js";
 // Main entry point
 export { main } from "./main.js";
 // Run modes for programmatic SDK usage