@sammorrowdrums/mcpi 0.70.9 → 0.85.0

package/dist/core/package-manager.js

@@ -1,24 +1,51 @@
-import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+function getEnv() {
+    if (process.platform !== "linux" || Object.keys(process.env).length > 0) {
+        return process.env;
+    }
+    try {
+        const data = readFileSync("/proc/self/environ", "utf-8");
+        const env = {};
+        for (const entry of data.split("\0")) {
+            const idx = entry.indexOf("=");
+            if (idx > 0) {
+                env[entry.slice(0, idx)] = entry.slice(idx + 1);
+            }
+        }
+        return env;
+    }
+    catch {
+        return process.env;
+    }
+}
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { globSync } from "glob";
 import ignore from "ignore";
 import { minimatch } from "minimatch";
-import { CONFIG_DIR_NAME } from "../config.js";
+import { maxSatisfying, rcompare, satisfies, valid, validRange } from "semver";
+import { CONFIG_DIR_NAME, getAgentDir, getCacheDir } from "../config.js";
+import { spawnProcess, spawnProcessSync } from "../utils/child-process.js";
 import { parseGitUrl } from "../utils/git.js";
-import { isLocalPath } from "../utils/paths.js";
+import { canonicalizePath, isLocalPath, markPathIgnoredByCloudSync, resolvePath } from "../utils/paths.js";
 import { isStdoutTakenOver } from "./output-guard.js";
+import { readPiManifest } from "./pi-manifest.js";
 const NETWORK_TIMEOUT_MS = 10000;
 const UPDATE_CHECK_CONCURRENCY = 4;
 const GIT_UPDATE_CONCURRENCY = 4;
 function isOfflineModeEnabled() {
-    const value = process.env.PI_OFFLINE;
+    const value = process.env.MCPI_OFFLINE;
     if (!value)
         return false;
     return value === "1" || value.toLowerCase() === "true" || value.toLowerCase() === "yes";
 }
+function isExactNpmVersion(version) {
+    return valid(version ?? "") !== null;
+}
+function getNpmVersionRange(version) {
+    return version ? (validRange(version) ?? undefined) : undefined;
+}
 /**
  * Compute a numeric precedence rank for a resource based on its metadata.
  * Lower rank = higher precedence. Used to sort resolved resources so that
@@ -51,6 +78,12 @@ function toPosixPath(p) {
 function getHomeDir() {
     return process.env.HOME || homedir();
 }
+export function getExtensionTempFolder(agentDir) {
+    const tempFolder = join(agentDir, "tmp", "extensions");
+    mkdirSync(tempFolder, { recursive: true, mode: 0o700 });
+    chmodSync(tempFolder, 0o700);
+    return tempFolder;
+}
 function prefixIgnorePattern(line, prefix) {
     const trimmed = line.trim();
     if (!trimmed)
@@ -206,7 +239,7 @@ function collectSkillEntries(dir, mode, ignoreMatcher, rootDir) {
                 }
             }
             const relPath = toPosixPath(relative(root, fullPath));
-            if (mode === "pi" && dir === root && isFile && entry.name.endsWith(".md") && !ig.ignores(relPath)) {
+            if (mode === "mcpi" && dir === root && isFile && entry.name.endsWith(".md") && !ig.ignores(relPath)) {
                 entries.push(fullPath);
                 continue;
             }
@@ -328,20 +361,10 @@ function collectAutoThemeEntries(dir) {
     }
     return entries;
 }
-function readPiManifestFile(packageJsonPath) {
-    try {
-        const content = readFileSync(packageJsonPath, "utf-8");
-        const pkg = JSON.parse(content);
-        return pkg.pi ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 function resolveExtensionEntries(dir) {
     const packageJsonPath = join(dir, "package.json");
     if (existsSync(packageJsonPath)) {
-        const manifest = readPiManifestFile(packageJsonPath);
+        const manifest = readPiManifest(packageJsonPath);
         if (manifest?.extensions?.length) {
             const entries = [];
             for (const extPath of manifest.extensions) {
@@ -423,7 +446,7 @@ function collectAutoExtensionEntries(dir) {
  */
 function collectResourceFiles(dir, resourceType) {
     if (resourceType === "skills") {
-        return collectSkillEntries(dir, "pi");
+        return collectSkillEntries(dir, "mcpi");
     }
     if (resourceType === "extensions") {
         return collectAutoExtensionEntries(dir);
@@ -550,16 +573,37 @@ function applyPatterns(allPaths, patterns, baseDir) {
     }
     return new Set(result);
 }
+function applyAutoloadDisabledPatterns(allPaths, patterns, baseDir) {
+    const result = new Map();
+    for (const pattern of patterns) {
+        const target = pattern.slice(pattern.startsWith("+") || pattern.startsWith("-") || pattern.startsWith("!") ? 1 : 0);
+        const enabled = !pattern.startsWith("-") && !pattern.startsWith("!");
+        const exact = pattern.startsWith("+") || pattern.startsWith("-");
+        for (const filePath of allPaths) {
+            if (exact ? matchesAnyExactPattern(filePath, [target], baseDir) : matchesAnyPattern(filePath, [target], baseDir)) {
+                result.set(filePath, enabled);
+            }
+        }
+    }
+    return result;
+}
 export class DefaultPackageManager {
     cwd;
     agentDir;
+    cacheDir;
     settingsManager;
     globalNpmRoot;
     globalNpmRootCommandKey;
     progressCallback;
     constructor(options) {
-        this.cwd = options.cwd;
-        this.agentDir = options.agentDir;
+        this.cwd = resolvePath(options.cwd);
+        this.agentDir = resolvePath(options.agentDir);
+        this.cacheDir =
+            options.cacheDir !== undefined
+                ? resolvePath(options.cacheDir)
+                : this.agentDir === resolvePath(getAgentDir())
+                    ? getCacheDir()
+                    : this.agentDir;
         this.settingsManager = options.settingsManager;
     }
     setProgressCallback(callback) {
@@ -570,9 +614,22 @@ export class DefaultPackageManager {
         const currentSettings = scope === "project" ? this.settingsManager.getProjectSettings() : this.settingsManager.getGlobalSettings();
         const currentPackages = currentSettings.packages ?? [];
         const normalizedSource = this.normalizePackageSourceForSettings(source, scope);
-        const exists = currentPackages.some((existing) => this.packageSourcesMatch(existing, source, scope));
-        if (exists) {
-            return false;
+        const matchIndex = currentPackages.findIndex((existing) => this.packageSourcesMatch(existing, source, scope));
+        if (matchIndex !== -1) {
+            const existing = currentPackages[matchIndex];
+            if (this.getPackageSourceString(existing) === normalizedSource) {
+                return false;
+            }
+            const nextPackages = [...currentPackages];
+            nextPackages[matchIndex] =
+                typeof existing === "string" ? normalizedSource : { ...existing, source: normalizedSource };
+            if (scope === "project") {
+                this.settingsManager.setProjectPackages(nextPackages);
+            }
+            else {
+                this.settingsManager.setPackages(nextPackages);
+            }
+            return true;
         }
         const nextPackages = [...currentPackages, normalizedSource];
         if (scope === "project") {
@@ -701,6 +758,7 @@ export class DefaultPackageManager {
     async install(source, options) {
         const parsed = this.parseSource(source);
         const scope = options?.local ? "project" : "user";
+        this.assertProjectTrustedForScope(scope);
         await this.withProgress("install", source, `Installing ${source}...`, async () => {
             if (parsed.type === "npm") {
                 await this.installNpm(parsed, scope, false);
@@ -727,6 +785,7 @@ export class DefaultPackageManager {
     async remove(source, options) {
         const parsed = this.parseSource(source);
         const scope = options?.local ? "project" : "user";
+        this.assertProjectTrustedForScope(scope);
         await this.withProgress("remove", source, `Removing ${source}...`, async () => {
             if (parsed.type === "npm") {
                 await this.uninstallNpm(parsed, scope);
@@ -782,14 +841,16 @@ export class DefaultPackageManager {
         const gitCandidates = [];
         for (const entry of sources) {
             const parsed = this.parseSource(entry.source);
-            if (parsed.type === "local" || parsed.pinned) {
-                continue;
-            }
+            // Pinned npm versions are fixed. Pinned git refs are configured checkout targets,
+            // so include them to reconcile an existing clone when the configured ref changes.
             if (parsed.type === "npm") {
-                npmCandidates.push({ ...entry, parsed });
-                continue;
+                if (!parsed.pinned) {
+                    npmCandidates.push({ ...entry, parsed });
+                }
+            }
+            else if (parsed.type === "git") {
+                gitCandidates.push({ ...entry, parsed });
             }
-            gitCandidates.push({ ...entry, parsed });
         }
         const npmCheckTasks = npmCandidates.map((entry) => async () => ({
             entry,
@@ -825,14 +886,14 @@ export class DefaultPackageManager {
         await Promise.all(tasks);
     }
     async shouldUpdateNpmSource(source, scope) {
-        const installedPath = this.getNpmInstallPath(source, scope);
+        const installedPath = this.getManagedNpmInstallPath(source, scope);
         const installedVersion = existsSync(installedPath) ? this.getInstalledNpmVersion(installedPath) : undefined;
         if (!installedVersion) {
             return true;
         }
         try {
-            const latestVersion = await this.getLatestNpmVersion(source.name);
-            return latestVersion !== installedVersion;
+            const targetVersion = await this.getLatestNpmVersion(source.version ? source.spec : source.name, source.range);
+            return targetVersion !== installedVersion;
         }
         catch {
             // Preserve existing update behavior when version lookup fails.
@@ -845,19 +906,15 @@ export class DefaultPackageManager {
         }
         const sourceLabel = sources.length === 1 ? sources[0].source : `${scope} npm packages`;
         const message = sources.length === 1 ? `Updating ${sources[0].source}...` : `Updating ${scope} npm packages...`;
-        const specs = sources.map((entry) => `${entry.parsed.name}@latest`);
+        const specs = sources.map((entry) => (entry.parsed.version ? entry.parsed.spec : `${entry.parsed.name}@latest`));
         await this.withProgress("update", sourceLabel, message, async () => {
             await this.installNpmBatch(specs, scope);
         });
     }
     async installNpmBatch(specs, scope) {
-        if (scope === "user") {
-            await this.runNpmCommand(["install", "-g", ...specs]);
-            return;
-        }
         const installRoot = this.getNpmInstallRoot(scope, false);
         this.ensureNpmProject(installRoot);
-        await this.runNpmCommand(["install", ...specs, "--prefix", installRoot]);
+        await this.runNpmCommand(this.getNpmInstallArgs(specs, installRoot));
     }
     async checkForAvailableUpdates() {
         if (isOfflineModeEnabled()) {
@@ -919,57 +976,67 @@ export class DefaultPackageManager {
         for (const { pkg, scope } of sources) {
             const sourceStr = typeof pkg === "string" ? pkg : pkg.source;
             const filter = typeof pkg === "object" ? pkg : undefined;
-            const parsed = this.parseSource(sourceStr);
+            const deltaBase = this.findAutoloadDeltaBase(pkg, scope, sources);
+            const resolvedSource = deltaBase?.source ?? sourceStr;
+            const resolvedScope = deltaBase?.scope ?? scope;
+            const parsed = this.parseSource(resolvedSource);
             const metadata = { source: sourceStr, scope, origin: "package" };
             if (parsed.type === "local") {
-                const baseDir = this.getBaseDirForScope(scope);
+                const baseDir = this.getBaseDirForScope(resolvedScope);
                 this.resolveLocalExtensionSource(parsed, accumulator, filter, metadata, baseDir);
                 continue;
             }
             const installMissing = async () => {
-                if (isOfflineModeEnabled()) {
+                if (isOfflineModeEnabled())
                     return false;
-                }
                 if (!onMissing) {
-                    await this.installParsedSource(parsed, scope);
+                    await this.installParsedSource(parsed, resolvedScope);
                     return true;
                 }
-                const action = await onMissing(sourceStr);
+                const action = await onMissing(resolvedSource);
                 if (action === "skip")
                     return false;
                 if (action === "error")
-                    throw new Error(`Missing source: ${sourceStr}`);
-                await this.installParsedSource(parsed, scope);
+                    throw new Error(`Missing source: ${resolvedSource}`);
+                await this.installParsedSource(parsed, resolvedScope);
                 return true;
             };
             if (parsed.type === "npm") {
-                const installedPath = this.getNpmInstallPath(parsed, scope);
-                const needsInstall = !existsSync(installedPath) ||
-                    (parsed.pinned && !(await this.installedNpmMatchesPinnedVersion(parsed, installedPath)));
+                let installedPath = this.getNpmInstallPath(parsed, resolvedScope);
+                const needsInstall = !existsSync(installedPath) || !(await this.installedNpmMatchesConfiguredVersion(parsed, installedPath));
                 if (needsInstall) {
                     const installed = await installMissing();
                     if (!installed)
                         continue;
+                    installedPath = this.getNpmInstallPath(parsed, resolvedScope);
                 }
                 metadata.baseDir = installedPath;
                 this.collectPackageResources(installedPath, accumulator, filter, metadata);
                 continue;
             }
             if (parsed.type === "git") {
-                const installedPath = this.getGitInstallPath(parsed, scope);
+                const installedPath = this.getGitInstallPath(parsed, resolvedScope);
                 if (!existsSync(installedPath)) {
                     const installed = await installMissing();
                     if (!installed)
                         continue;
                 }
-                else if (scope === "temporary" && !parsed.pinned && !isOfflineModeEnabled()) {
-                    await this.refreshTemporaryGitSource(parsed, sourceStr);
+                else if (resolvedScope === "temporary" && !parsed.pinned && !isOfflineModeEnabled()) {
+                    await this.refreshTemporaryGitSource(parsed, resolvedSource);
                 }
                 metadata.baseDir = installedPath;
                 this.collectPackageResources(installedPath, accumulator, filter, metadata);
             }
         }
     }
+    findAutoloadDeltaBase(pkg, scope, sources) {
+        if (scope !== "project" || typeof pkg !== "object" || pkg.autoload !== false)
+            return undefined;
+        const identity = this.getPackageIdentity(pkg.source, scope);
+        const userEntry = sources.find((entry) => entry.scope === "user" &&
+            this.getPackageIdentity(this.getPackageSourceString(entry.pkg), "user") === identity);
+        return userEntry ? { source: this.getPackageSourceString(userEntry.pkg), scope: "user" } : undefined;
+    }
     resolveLocalExtensionSource(source, accumulator, filter, metadata, baseDir) {
         const resolved = this.resolvePathFromBase(source.path, baseDir);
         if (!existsSync(resolved)) {
@@ -1080,7 +1147,9 @@ export class DefaultPackageManager {
                 type: "npm",
                 spec,
                 name,
-                pinned: Boolean(version),
+                version,
+                range: getNpmVersionRange(version),
+                pinned: isExactNpmVersion(version),
             };
         }
         if (isLocalPath(source)) {
@@ -1093,16 +1162,12 @@ export class DefaultPackageManager {
         }
         return { type: "local", path: source };
     }
-    async installedNpmMatchesPinnedVersion(source, installedPath) {
+    async installedNpmMatchesConfiguredVersion(source, installedPath) {
         const installedVersion = this.getInstalledNpmVersion(installedPath);
         if (!installedVersion) {
             return false;
         }
-        const { version: pinnedVersion } = this.parseNpmSpec(source.spec);
-        if (!pinnedVersion) {
-            return true;
-        }
-        return installedVersion === pinnedVersion;
+        return source.range ? satisfies(installedVersion, source.range) : true;
     }
     async npmHasAvailableUpdate(source, installedPath) {
         if (isOfflineModeEnabled()) {
@@ -1113,8 +1178,8 @@ export class DefaultPackageManager {
             return false;
         }
         try {
-            const latestVersion = await this.getLatestNpmVersion(source.name);
-            return latestVersion !== installedVersion;
+            const targetVersion = await this.getLatestNpmVersion(source.version ? source.spec : source.name, source.range);
+            return targetVersion !== installedVersion;
         }
         catch {
             return false;
@@ -1133,13 +1198,23 @@ export class DefaultPackageManager {
             return undefined;
         }
     }
-    async getLatestNpmVersion(packageName) {
+    async getLatestNpmVersion(packageSpec, range) {
         const npmCommand = this.getNpmCommand();
-        const stdout = await this.runCommandCapture(npmCommand.command, [...npmCommand.args, "view", packageName, "version", "--json"], { cwd: this.cwd, timeoutMs: NETWORK_TIMEOUT_MS });
+        const stdout = await this.runCommandCapture(npmCommand.command, [...npmCommand.args, "view", packageSpec, "version", "--json"], { cwd: this.cwd, timeoutMs: NETWORK_TIMEOUT_MS });
         const raw = stdout.trim();
         if (!raw)
             throw new Error("Empty response from npm view");
-        return JSON.parse(raw);
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "string") {
+            return parsed;
+        }
+        if (Array.isArray(parsed)) {
+            const versions = parsed.filter((value) => typeof value === "string" && value.length > 0);
+            const latest = range ? maxSatisfying(versions, range) : [...versions].sort(rcompare)[0];
+            if (latest)
+                return latest;
+        }
+        throw new Error("Unexpected response from npm view");
     }
     async gitHasAvailableUpdate(installedPath) {
         if (isOfflineModeEnabled()) {
@@ -1303,25 +1378,30 @@ export class DefaultPackageManager {
     }
     /**
      * Dedupe packages: if same package identity appears in both global and project,
-     * keep only the project one (project wins).
+     * keep only the project one (project wins). A project entry with autoload=false
+     * is a delta over the global entry, so both are kept (delta first).
      */
     dedupePackages(packages) {
+        const result = [];
         const seen = new Map();
         for (const entry of packages) {
-            const sourceStr = typeof entry.pkg === "string" ? entry.pkg : entry.pkg.source;
-            const identity = this.getPackageIdentity(sourceStr, entry.scope);
-            const existing = seen.get(identity);
-            if (!existing) {
-                seen.set(identity, entry);
+            const identity = this.getPackageIdentity(this.getPackageSourceString(entry.pkg), entry.scope);
+            const index = seen.get(identity);
+            if (index === undefined) {
+                seen.set(identity, result.length);
+                result.push(entry);
+                continue;
+            }
+            const existing = result[index];
+            if (existing?.scope === "project" && entry.scope === "user") {
+                if (typeof existing.pkg === "object" && existing.pkg.autoload === false)
+                    result.push(entry);
             }
-            else if (entry.scope === "project" && existing.scope === "user") {
-                // Project wins over user
-                seen.set(identity, entry);
+            else if (entry.scope === "project") {
+                result[index] = entry;
             }
-            // If existing is project and new is global, keep existing (project)
-            // If both are same scope, keep first one
         }
-        return Array.from(seen.values());
+        return result;
     }
     parseNpmSpec(spec) {
         const match = spec.match(/^(@?[^@]+(?:\/[^@]+)?)(?:@(.+))?$/);
@@ -1332,6 +1412,11 @@ export class DefaultPackageManager {
         const version = match[2];
         return { name, version };
     }
+    assertProjectTrustedForScope(scope) {
+        if (scope === "project" && !this.settingsManager.isProjectTrusted()) {
+            throw new Error("Project is not trusted; refusing to access project package storage");
+        }
+    }
     getNpmCommand() {
         const configuredCommand = this.settingsManager.getNpmCommand();
         if (!configuredCommand || configuredCommand.length === 0) {
@@ -1343,6 +1428,13 @@ export class DefaultPackageManager {
         }
         return { command, args };
     }
+    getPackageManagerName() {
+        const npmCommand = this.getNpmCommand();
+        const commandParts = [npmCommand.command, ...npmCommand.args];
+        const separatorIndex = commandParts.lastIndexOf("--");
+        const packageManagerCommand = separatorIndex >= 0 ? commandParts[separatorIndex + 1] : npmCommand.command;
+        return packageManagerCommand ? basename(packageManagerCommand).replace(/\.(cmd|exe)$/i, "") : "";
+    }
     async runNpmCommand(args, options) {
         const npmCommand = this.getNpmCommand();
         await this.runCommand(npmCommand.command, [...npmCommand.args, ...args], options);
@@ -1358,29 +1450,58 @@ export class DefaultPackageManager {
         const npmCommand = this.getNpmCommand();
         return this.runCommandSync(npmCommand.command, [...npmCommand.args, ...args]);
     }
+    getNpmInstallArgs(specs, installRoot) {
+        const packageManagerName = this.getPackageManagerName();
+        // Extension packages run inside mcpi and resolve mcpi APIs through loader aliases/virtual modules.
+        // Disable peer dependency resolution for managed installs (npm's --legacy-peer-deps, and
+        // equivalent bun/pnpm settings) so package managers do not install or solve host-provided
+        // @sammorrowdrums/mcpi-* peers. Stale auto-installed upstream peers can otherwise block updates.
+        if (packageManagerName === "bun") {
+            return ["install", ...specs, "--cwd", installRoot, "--omit=peer"];
+        }
+        if (packageManagerName === "pnpm") {
+            return [
+                "install",
+                ...specs,
+                "--prefix",
+                installRoot,
+                "--config.auto-install-peers=false",
+                "--config.strict-peer-dependencies=false",
+                "--config.strict-dep-builds=false",
+            ];
+        }
+        return ["install", ...specs, "--prefix", installRoot, "--legacy-peer-deps"];
+    }
     async installNpm(source, scope, temporary) {
-        if (scope === "user" && !temporary) {
-            await this.runNpmCommand(["install", "-g", source.spec]);
-            return;
-        }
         const installRoot = this.getNpmInstallRoot(scope, temporary);
         this.ensureNpmProject(installRoot);
-        await this.runNpmCommand(["install", source.spec, "--prefix", installRoot]);
+        await this.runNpmCommand(this.getNpmInstallArgs([source.spec], installRoot));
     }
     async uninstallNpm(source, scope) {
-        if (scope === "user") {
-            await this.runNpmCommand(["uninstall", "-g", source.name]);
-            return;
-        }
         const installRoot = this.getNpmInstallRoot(scope, false);
         if (!existsSync(installRoot)) {
             return;
         }
-        await this.runNpmCommand(["uninstall", source.name, "--prefix", installRoot]);
+        const packageManagerName = this.getPackageManagerName();
+        if (packageManagerName === "bun") {
+            await this.runNpmCommand(["uninstall", source.name, "--cwd", installRoot]);
+            return;
+        }
+        const args = ["uninstall", source.name, "--prefix", installRoot];
+        if (packageManagerName !== "pnpm") {
+            args.push("--legacy-peer-deps");
+        }
+        await this.runNpmCommand(args);
     }
     async installGit(source, scope) {
         const targetDir = this.getGitInstallPath(source, scope);
         if (existsSync(targetDir)) {
+            if (source.ref) {
+                await this.ensureGitRef(targetDir, ["fetch", "origin", source.ref], "FETCH_HEAD");
+                return;
+            }
+            const target = await this.getLocalGitUpdateTarget(targetDir);
+            await this.ensureGitRef(targetDir, target.fetchArgs, target.ref);
             return;
         }
         const gitRoot = this.getGitInstallRoot(scope);
@@ -1388,13 +1509,21 @@ export class DefaultPackageManager {
             this.ensureGitIgnore(gitRoot);
         }
         mkdirSync(dirname(targetDir), { recursive: true });
-        await this.runCommand("git", ["clone", source.repo, targetDir]);
-        if (source.ref) {
-            await this.runCommand("git", ["checkout", source.ref], { cwd: targetDir });
+        rmSync(this.getGitUpdateMarkerPath(targetDir), { force: true });
+        try {
+            await this.runCommand("git", ["clone", source.repo, targetDir]);
+            if (source.ref) {
+                await this.runCommand("git", ["checkout", source.ref], { cwd: targetDir });
+            }
+            const packageJsonPath = join(targetDir, "package.json");
+            if (existsSync(packageJsonPath)) {
+                await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
+            }
         }
-        const packageJsonPath = join(targetDir, "package.json");
-        if (existsSync(packageJsonPath)) {
-            await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
+        catch (error) {
+            rmSync(targetDir, { recursive: true, force: true });
+            this.pruneEmptyGitParents(targetDir, gitRoot);
+            throw error;
         }
     }
     async updateGit(source, scope) {
@@ -1403,27 +1532,85 @@ export class DefaultPackageManager {
             await this.installGit(source, scope);
             return;
         }
+        if (source.ref) {
+            await this.ensureGitRef(targetDir, ["fetch", "origin", source.ref], "FETCH_HEAD");
+            return;
+        }
         const target = await this.getLocalGitUpdateTarget(targetDir);
+        await this.ensureGitRef(targetDir, target.fetchArgs, target.ref);
+    }
+    hasMissingGitDependencies(targetDir) {
+        const packageJsonPath = join(targetDir, "package.json");
+        if (!existsSync(packageJsonPath))
+            return false;
+        try {
+            const manifest = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+            if (!manifest.dependencies ||
+                typeof manifest.dependencies !== "object" ||
+                Array.isArray(manifest.dependencies)) {
+                return false;
+            }
+            const nodeModulesDir = resolve(targetDir, "node_modules");
+            return Object.keys(manifest.dependencies).some((name) => {
+                const dependencyPath = resolve(nodeModulesDir, name);
+                if (!dependencyPath.startsWith(`${nodeModulesDir}${sep}`))
+                    return false;
+                return !existsSync(dependencyPath);
+            });
+        }
+        catch {
+            return false;
+        }
+    }
+    async repairMissingGitDependencies(targetDir) {
+        if (!this.hasMissingGitDependencies(targetDir))
+            return;
+        await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
+    }
+    getGitUpdateMarkerPath(targetDir) {
+        return join(dirname(targetDir), `.${basename(targetDir)}.mcpi-update-incomplete`);
+    }
+    async cleanAndInstallGitDependencies(targetDir, markerPath) {
+        // Clean untracked files (extensions should be pristine). If this fails after
+        // deleting dependencies, repair them so the existing extension still loads.
+        try {
+            await this.runCommand("git", ["clean", "-fdx"], { cwd: targetDir });
+        }
+        catch (error) {
+            await this.repairMissingGitDependencies(targetDir).catch(() => { });
+            throw error;
+        }
+        const packageJsonPath = join(targetDir, "package.json");
+        if (existsSync(packageJsonPath)) {
+            await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
+        }
+        rmSync(markerPath, { force: true });
+    }
+    async ensureGitRef(targetDir, fetchArgs, ref) {
         // Fetch only the ref we will reset to, avoiding unrelated branch/tag noise.
-        await this.runCommand("git", target.fetchArgs, { cwd: targetDir });
+        await this.runCommand("git", fetchArgs, { cwd: targetDir });
         const localHead = await this.runCommandCapture("git", ["rev-parse", "HEAD"], {
             cwd: targetDir,
             timeoutMs: NETWORK_TIMEOUT_MS,
         });
-        const refreshedTargetHead = await this.runCommandCapture("git", ["rev-parse", target.ref], {
+        const commitRef = `${ref}^{commit}`;
+        const targetHead = await this.runCommandCapture("git", ["rev-parse", commitRef], {
             cwd: targetDir,
             timeoutMs: NETWORK_TIMEOUT_MS,
         });
-        if (localHead.trim() === refreshedTargetHead.trim()) {
+        const markerPath = this.getGitUpdateMarkerPath(targetDir);
+        if (localHead.trim() === targetHead.trim()) {
+            if (existsSync(markerPath)) {
+                await this.cleanAndInstallGitDependencies(targetDir, markerPath);
+            }
+            else {
+                await this.repairMissingGitDependencies(targetDir);
+            }
             return;
         }
-        await this.runCommand("git", ["reset", "--hard", target.ref], { cwd: targetDir });
-        // Clean untracked files (extensions should be pristine)
-        await this.runCommand("git", ["clean", "-fdx"], { cwd: targetDir });
-        const packageJsonPath = join(targetDir, "package.json");
-        if (existsSync(packageJsonPath)) {
-            await this.runNpmCommand(this.getGitDependencyInstallArgs(), { cwd: targetDir });
-        }
+        writeFileSync(markerPath, "", "utf-8");
+        await this.runCommand("git", ["reset", "--hard", commitRef], { cwd: targetDir });
+        await this.cleanAndInstallGitDependencies(targetDir, markerPath);
     }
     async refreshTemporaryGitSource(source, sourceStr) {
         if (isOfflineModeEnabled()) {
@@ -1440,9 +1627,8 @@ export class DefaultPackageManager {
     }
     async removeGit(source, scope) {
         const targetDir = this.getGitInstallPath(source, scope);
-        if (!existsSync(targetDir))
-            return;
         rmSync(targetDir, { recursive: true, force: true });
+        rmSync(this.getGitUpdateMarkerPath(targetDir), { force: true });
         this.pruneEmptyGitParents(targetDir, this.getGitInstallRoot(scope));
     }
     pruneEmptyGitParents(targetDir, installRoot) {
@@ -1472,10 +1658,11 @@ export class DefaultPackageManager {
         if (!existsSync(installRoot)) {
             mkdirSync(installRoot, { recursive: true });
         }
+        markPathIgnoredByCloudSync(installRoot);
         this.ensureGitIgnore(installRoot);
         const packageJsonPath = join(installRoot, "package.json");
         if (!existsSync(packageJsonPath)) {
-            const pkgJson = { name: "pi-extensions", private: true };
+            const pkgJson = { name: "mcpi-extensions", private: true };
             writeFileSync(packageJsonPath, JSON.stringify(pkgJson, null, 2), "utf-8");
         }
     }
@@ -1493,9 +1680,10 @@ export class DefaultPackageManager {
             return this.getTemporaryDir("npm");
         }
         if (scope === "project") {
+            this.assertProjectTrustedForScope(scope);
             return join(this.cwd, CONFIG_DIR_NAME, "npm");
         }
-        return join(this.getGlobalNpmRoot(), "..");
+        return join(this.cacheDir, "npm");
     }
     getGlobalNpmRoot() {
         const npmCommand = this.getNpmCommand();
@@ -1503,47 +1691,94 @@ export class DefaultPackageManager {
         if (this.globalNpmRoot && this.globalNpmRootCommandKey === commandKey) {
             return this.globalNpmRoot;
         }
-        const result = this.runNpmCommandSync(["root", "-g"]);
-        this.globalNpmRoot = result.trim();
+        if (this.getPackageManagerName() === "bun") {
+            const binDir = this.runNpmCommandSync(["pm", "bin", "-g"]).trim();
+            this.globalNpmRoot = join(dirname(binDir), "install", "global", "node_modules");
+        }
+        else {
+            this.globalNpmRoot = this.runNpmCommandSync(["root", "-g"]).trim();
+        }
         this.globalNpmRootCommandKey = commandKey;
         return this.globalNpmRoot;
     }
-    getNpmInstallPath(source, scope) {
+    getPnpmGlobalPackagePath(packageName) {
+        if (this.getPackageManagerName() !== "pnpm") {
+            return undefined;
+        }
+        const output = this.runNpmCommandSync(["list", "-g", "--depth", "0", "--json"]);
+        const entries = JSON.parse(output);
+        for (const entry of entries) {
+            const path = entry.dependencies?.[packageName]?.path;
+            if (path)
+                return path;
+        }
+        return undefined;
+    }
+    getManagedNpmInstallPath(source, scope) {
         if (scope === "temporary") {
             return join(this.getTemporaryDir("npm"), "node_modules", source.name);
         }
         if (scope === "project") {
+            this.assertProjectTrustedForScope(scope);
             return join(this.cwd, CONFIG_DIR_NAME, "npm", "node_modules", source.name);
         }
-        return join(this.getGlobalNpmRoot(), source.name);
+        return join(this.cacheDir, "npm", "node_modules", source.name);
+    }
+    getLegacyGlobalNpmInstallPath(source) {
+        try {
+            return this.getPnpmGlobalPackagePath(source.name) ?? join(this.getGlobalNpmRoot(), source.name);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    getNpmInstallPath(source, scope) {
+        const managedPath = this.getManagedNpmInstallPath(source, scope);
+        if (scope !== "user" || existsSync(managedPath)) {
+            return managedPath;
+        }
+        const legacyPath = this.getLegacyGlobalNpmInstallPath(source);
+        return legacyPath && existsSync(legacyPath) ? legacyPath : managedPath;
     }
     getGitInstallPath(source, scope) {
         if (scope === "temporary") {
             return this.getTemporaryDir(`git-${source.host}`, source.path);
         }
-        if (scope === "project") {
-            return join(this.cwd, CONFIG_DIR_NAME, "git", source.host, source.path);
+        const installRoot = this.getGitInstallRoot(scope);
+        if (!installRoot) {
+            throw new Error("Missing git install root");
         }
-        return join(this.agentDir, "git", source.host, source.path);
+        return this.resolveManagedPath(installRoot, source.host, source.path);
     }
     getGitInstallRoot(scope) {
         if (scope === "temporary") {
             return undefined;
         }
         if (scope === "project") {
+            this.assertProjectTrustedForScope(scope);
             return join(this.cwd, CONFIG_DIR_NAME, "git");
         }
-        return join(this.agentDir, "git");
+        return join(this.cacheDir, "git");
     }
     getTemporaryDir(prefix, suffix) {
+        const root = this.resolveManagedPath(getExtensionTempFolder(this.cacheDir), prefix);
         const hash = createHash("sha256")
             .update(`${prefix}-${suffix ?? ""}`)
             .digest("hex")
             .slice(0, 8);
-        return join(tmpdir(), "pi-extensions", prefix, hash, suffix ?? "");
+        return this.resolveManagedPath(root, hash, suffix ?? "");
+    }
+    resolveManagedPath(root, ...parts) {
+        const resolvedRoot = resolve(root);
+        const resolvedPath = resolve(resolvedRoot, ...parts);
+        if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(`${resolvedRoot}${sep}`)) {
+            throw new Error(`Refusing to use path outside package install root: ${resolvedPath}`);
+        }
+        return resolvedPath;
     }
     getBaseDirForScope(scope) {
         if (scope === "project") {
+            this.assertProjectTrustedForScope(scope);
             return join(this.cwd, CONFIG_DIR_NAME);
         }
         if (scope === "user") {
@@ -1552,31 +1787,20 @@ export class DefaultPackageManager {
         return this.cwd;
     }
     resolvePath(input) {
-        const trimmed = input.trim();
-        if (trimmed === "~")
-            return getHomeDir();
-        if (trimmed.startsWith("~/"))
-            return join(getHomeDir(), trimmed.slice(2));
-        if (trimmed.startsWith("~"))
-            return join(getHomeDir(), trimmed.slice(1));
-        return resolve(this.cwd, trimmed);
+        return resolvePath(input, this.cwd, { homeDir: getHomeDir(), trim: true });
     }
     resolvePathFromBase(input, baseDir) {
-        const trimmed = input.trim();
-        if (trimmed === "~")
-            return getHomeDir();
-        if (trimmed.startsWith("~/"))
-            return join(getHomeDir(), trimmed.slice(2));
-        if (trimmed.startsWith("~"))
-            return join(getHomeDir(), trimmed.slice(1));
-        return resolve(baseDir, trimmed);
+        return resolvePath(input, baseDir, { homeDir: getHomeDir(), trim: true });
     }
     collectPackageResources(packageRoot, accumulator, filter, metadata) {
         if (filter) {
             for (const resourceType of RESOURCE_TYPES) {
                 const patterns = filter[resourceType];
                 const target = this.getTargetMap(accumulator, resourceType);
-                if (patterns !== undefined) {
+                if (filter.autoload === false) {
+                    this.applyPackageDeltaFilter(packageRoot, patterns ?? [], resourceType, target, metadata);
+                }
+                else if (patterns !== undefined) {
                     this.applyPackageFilter(packageRoot, patterns, resourceType, target, metadata);
                 }
                 else {
@@ -1585,7 +1809,7 @@ export class DefaultPackageManager {
             }
             return true;
         }
-        const manifest = this.readPiManifest(packageRoot);
+        const manifest = readPiManifest(join(packageRoot, "package.json"));
         if (manifest) {
             for (const resourceType of RESOURCE_TYPES) {
                 const entries = manifest[resourceType];
@@ -1608,7 +1832,7 @@ export class DefaultPackageManager {
         return hasAnyDir;
     }
     collectDefaultResources(packageRoot, resourceType, target, metadata) {
-        const manifest = this.readPiManifest(packageRoot);
+        const manifest = readPiManifest(join(packageRoot, "package.json"));
         const entries = manifest?.[resourceType];
         if (entries) {
             this.addManifestEntries(entries, packageRoot, resourceType, target, metadata);
@@ -1639,13 +1863,23 @@ export class DefaultPackageManager {
             this.addResource(target, f, metadata, enabled);
         }
     }
+    applyPackageDeltaFilter(packageRoot, userPatterns, resourceType, target, metadata) {
+        if (userPatterns.length === 0) {
+            return;
+        }
+        const { allFiles } = this.collectManifestFiles(packageRoot, resourceType);
+        const enabledByUser = applyAutoloadDisabledPatterns(allFiles, userPatterns, packageRoot);
+        for (const [filePath, enabled] of enabledByUser) {
+            this.addResource(target, filePath, metadata, enabled);
+        }
+    }
     /**
      * Collect all files from a package for a resource type, applying manifest patterns.
      * Returns { allFiles, enabledByManifest } where enabledByManifest is the set of files
      * that pass the manifest's own patterns.
      */
     collectManifestFiles(packageRoot, resourceType) {
-        const manifest = this.readPiManifest(packageRoot);
+        const manifest = readPiManifest(join(packageRoot, "package.json"));
         const entries = manifest?.[resourceType];
         if (entries && entries.length > 0) {
             const allFiles = this.collectFilesFromManifestEntries(entries, packageRoot, resourceType);
@@ -1660,20 +1894,6 @@ export class DefaultPackageManager {
         const allFiles = collectResourceFiles(conventionDir, resourceType);
         return { allFiles, enabledByManifest: new Set(allFiles) };
     }
-    readPiManifest(packageRoot) {
-        const packageJsonPath = join(packageRoot, "package.json");
-        if (!existsSync(packageJsonPath)) {
-            return null;
-        }
-        try {
-            const content = readFileSync(packageJsonPath, "utf-8");
-            const pkg = JSON.parse(content);
-            return pkg.pi ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
     addManifestEntries(entries, root, resourceType, target, metadata) {
         if (!entries)
             return;
@@ -1753,7 +1973,10 @@ export class DefaultPackageManager {
             themes: join(projectBaseDir, "themes"),
         };
         const userAgentsSkillsDir = join(getHomeDir(), ".agents", "skills");
-        const projectAgentsSkillDirs = collectAncestorAgentsSkillDirs(this.cwd).filter((dir) => resolve(dir) !== resolve(userAgentsSkillsDir));
+        const projectTrusted = this.settingsManager.isProjectTrusted();
+        const projectAgentsSkillDirs = projectTrusted
+            ? collectAncestorAgentsSkillDirs(this.cwd).filter((dir) => resolve(dir) !== resolve(userAgentsSkillsDir))
+            : [];
         const addResources = (resourceType, paths, metadata, overrides, baseDir) => {
             const target = this.getTargetMap(accumulator, resourceType);
             for (const path of paths) {
@@ -1761,15 +1984,36 @@ export class DefaultPackageManager {
                 this.addResource(target, path, metadata, enabled);
             }
         };
-        addResources("extensions", collectAutoExtensionEntries(projectDirs.extensions), projectMetadata, projectOverrides.extensions, projectBaseDir);
-        addResources("skills", [
-            ...collectAutoSkillEntries(projectDirs.skills, "pi"),
-            ...projectAgentsSkillDirs.flatMap((dir) => collectAutoSkillEntries(dir, "agents")),
-        ], projectMetadata, projectOverrides.skills, projectBaseDir);
-        addResources("prompts", collectAutoPromptEntries(projectDirs.prompts), projectMetadata, projectOverrides.prompts, projectBaseDir);
-        addResources("themes", collectAutoThemeEntries(projectDirs.themes), projectMetadata, projectOverrides.themes, projectBaseDir);
+        if (projectTrusted) {
+            // Project extensions from .mcpi/
+            addResources("extensions", collectAutoExtensionEntries(projectDirs.extensions), projectMetadata, projectOverrides.extensions, projectBaseDir);
+            // Project skills from .mcpi/
+            addResources("skills", collectAutoSkillEntries(projectDirs.skills, "mcpi"), projectMetadata, projectOverrides.skills, projectBaseDir);
+        }
+        // Project skills from .agents/ (each with its own baseDir)
+        for (const agentsSkillsDir of projectAgentsSkillDirs) {
+            const agentsBaseDir = dirname(agentsSkillsDir); // the .agents directory
+            const agentsMetadata = {
+                ...projectMetadata,
+                baseDir: agentsBaseDir,
+            };
+            addResources("skills", collectAutoSkillEntries(agentsSkillsDir, "agents"), agentsMetadata, projectOverrides.skills, agentsBaseDir);
+        }
+        if (projectTrusted) {
+            addResources("prompts", collectAutoPromptEntries(projectDirs.prompts), projectMetadata, projectOverrides.prompts, projectBaseDir);
+            addResources("themes", collectAutoThemeEntries(projectDirs.themes), projectMetadata, projectOverrides.themes, projectBaseDir);
+        }
+        // User extensions from the mcpi config directory
         addResources("extensions", collectAutoExtensionEntries(userDirs.extensions), userMetadata, userOverrides.extensions, globalBaseDir);
-        addResources("skills", [...collectAutoSkillEntries(userDirs.skills, "pi"), ...collectAutoSkillEntries(userAgentsSkillsDir, "agents")], userMetadata, userOverrides.skills, globalBaseDir);
+        // User skills from the mcpi config directory
+        addResources("skills", collectAutoSkillEntries(userDirs.skills, "mcpi"), userMetadata, userOverrides.skills, globalBaseDir);
+        // User skills from ~/.agents/ (with its own baseDir)
+        const userAgentsBaseDir = dirname(userAgentsSkillsDir);
+        const userAgentsMetadata = {
+            ...userMetadata,
+            baseDir: userAgentsBaseDir,
+        };
+        addResources("skills", collectAutoSkillEntries(userAgentsSkillsDir, "agents"), userAgentsMetadata, userOverrides.skills, userAgentsBaseDir);
         addResources("prompts", collectAutoPromptEntries(userDirs.prompts), userMetadata, userOverrides.prompts, globalBaseDir);
         addResources("themes", collectAutoThemeEntries(userDirs.themes), userMetadata, userOverrides.themes, globalBaseDir);
     }
@@ -1823,52 +2067,44 @@ export class DefaultPackageManager {
         };
     }
     toResolvedPaths(accumulator) {
-        const toResolved = (entries) => {
+        const mapToResolved = (entries) => {
             const resolved = Array.from(entries.entries()).map(([path, { metadata, enabled }]) => ({
                 path,
                 enabled,
                 metadata,
             }));
             resolved.sort((a, b) => resourcePrecedenceRank(a.metadata) - resourcePrecedenceRank(b.metadata));
-            return resolved;
+            const seen = new Set();
+            return resolved.filter((entry) => {
+                const canonicalPath = canonicalizePath(entry.path);
+                if (seen.has(canonicalPath))
+                    return false;
+                seen.add(canonicalPath);
+                return true;
+            });
         };
-        const seenCanonicalSkillPaths = new Set();
-        const resolvedSkills = toResolved(accumulator.skills).filter((entry) => {
-            let canonicalPath;
-            try {
-                // Resolve symlink aliases to detect duplicate files.
-                canonicalPath = realpathSync(entry.path);
-            }
-            catch {
-                // Fallback to raw path to match loadSkills() behavior.
-                canonicalPath = entry.path;
-            }
-            if (seenCanonicalSkillPaths.has(canonicalPath)) {
-                return false;
-            }
-            seenCanonicalSkillPaths.add(canonicalPath);
-            return true;
-        });
         return {
-            extensions: toResolved(accumulator.extensions),
-            skills: resolvedSkills,
-            prompts: toResolved(accumulator.prompts),
-            themes: toResolved(accumulator.themes),
+            extensions: mapToResolved(accumulator.extensions),
+            skills: mapToResolved(accumulator.skills),
+            prompts: mapToResolved(accumulator.prompts),
+            themes: mapToResolved(accumulator.themes),
         };
     }
     spawnCommand(command, args, options) {
-        return spawn(command, args, {
+        const env = getEnv();
+        return spawnProcess(command, args, {
             cwd: options?.cwd,
             stdio: isStdoutTakenOver() ? ["ignore", 2, 2] : "inherit",
-            shell: process.platform === "win32",
+            env,
         });
     }
     spawnCaptureCommand(command, args, options) {
-        return spawn(command, args, {
+        const baseEnv = getEnv();
+        const env = options?.env ? { ...baseEnv, ...options.env } : baseEnv;
+        return spawnProcess(command, args, {
             cwd: options?.cwd,
             stdio: ["ignore", "pipe", "pipe"],
-            shell: process.platform === "win32",
-            env: options?.env ? { ...process.env, ...options.env } : process.env,
+            env,
         });
     }
     runCommandCapture(command, args, options) {
@@ -1925,13 +2161,14 @@ export class DefaultPackageManager {
         });
     }
     runCommandSync(command, args) {
-        const result = spawnSync(command, args, {
+        const env = getEnv();
+        const result = spawnProcessSync(command, args, {
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
-            shell: process.platform === "win32",
+            env,
         });
-        if (result.status !== 0) {
-            throw new Error(`Failed to run ${command} ${args.join(" ")}: ${result.stderr || result.stdout}`);
+        if (result.error || result.status !== 0) {
+            throw new Error(`Failed to run ${command} ${args.join(" ")}: ${result.error?.message || result.stderr || result.stdout}`);
         }
         return (result.stdout || result.stderr || "").trim();
     }