@theia/ai-core 1.71.0-next.8 → 1.71.0

package/src/browser/frontend-prompt-customization-service.ts

@@ -18,6 +18,7 @@ import { DisposableCollection, URI, Event, Emitter, nls } from '@theia/core';
 import { OpenerService } from '@theia/core/lib/browser';
 import { inject, injectable, postConstruct } from '@theia/core/shared/inversify';
 import { PromptFragmentCustomizationService, CustomAgentDescription, CustomizedPromptFragment, CommandPromptFragmentMetadata } from '../common';
+import { ConfigurableInMemoryResources } from '../common/configurable-in-memory-resources';
 import { BinaryBuffer } from '@theia/core/lib/common/buffer';
 import { FileService } from '@theia/filesystem/lib/browser/file-service';
 import { FileChangesEvent } from '@theia/filesystem/lib/common/files';
@@ -132,6 +133,9 @@ export class DefaultPromptFragmentCustomizationService implements PromptFragment
     @inject(OpenerService)
     protected readonly openerService: OpenerService;
 
+    @inject(ConfigurableInMemoryResources)
+    protected readonly inMemoryResources: ConfigurableInMemoryResources;
+
     /** Stores URI strings of template files from directories currently being monitored for changes. */
     protected trackedTemplateURIs = new Set<string>();
 
@@ -852,11 +856,38 @@ export class DefaultPromptFragmentCustomizationService implements PromptFragment
      */
     protected async editTemplate(id: string, defaultContent?: string): Promise<void> {
         const editorUri = await this.getTemplateURI(id);
-        if (!(await this.fileService.exists(editorUri))) {
-            await this.fileService.createFile(editorUri, BinaryBuffer.fromString(defaultContent ?? ''));
+        if (await this.fileService.exists(editorUri)) {
+            const openHandler = await this.openerService.getOpener(editorUri);
+            openHandler.open(editorUri);
+        } else {
+            await this.openInMemoryTemplate(editorUri, defaultContent ?? '');
+        }
+    }
+
+    /**
+     * Opens an in-memory resource with the given content, without creating a file on disk.
+     * The file is only created when the user saves in the editor.
+     */
+    protected async openInMemoryTemplate(templateUri: URI, defaultContent: string): Promise<void> {
+        try {
+            this.inMemoryResources.resolve(templateUri);
+        } catch {
+            const resource = this.inMemoryResources.add(templateUri, {
+                contents: defaultContent,
+                initiallyDirty: false,
+                onSave: async (contents: string) => {
+                    const dirUri = templateUri.parent;
+                    if (!(await this.fileService.exists(dirUri))) {
+                        await this.fileService.createFolder(dirUri);
+                    }
+                    await this.fileService.createFile(templateUri, BinaryBuffer.fromString(contents), { overwrite: true });
+                    resource.dispose();
+                }
+            });
         }
-        const openHandler = await this.openerService.getOpener(editorUri);
-        openHandler.open(editorUri);
+
+        const openHandler = await this.openerService.getOpener(templateUri);
+        openHandler.open(templateUri);
     }
 
     async removePromptFragmentCustomization(id: string, customizationId: string): Promise<void> {
@@ -978,18 +1009,10 @@ export class DefaultPromptFragmentCustomizationService implements PromptFragment
             const openHandler = await this.openerService.getOpener(uri);
             openHandler.open(uri);
         } else {
-            // Create a new built-in customization
-            // Get the template URI in the main templates directory (priority 1)
+            // Open the built-in content without creating a file on disk.
+            // The file will only be created when the user saves.
             const templateUri = await this.getTemplateURI(id);
-
-            // If template doesn't exist, create it with default content
-            if (!(await this.fileService.exists(templateUri))) {
-                await this.fileService.createFile(templateUri, BinaryBuffer.fromString(defaultContent));
-            }
-
-            // Open the template in the editor
-            const openHandler = await this.openerService.getOpener(templateUri);
-            openHandler.open(templateUri);
+            await this.openInMemoryTemplate(templateUri, defaultContent);
         }
     }
 

package/src/browser/product-name-variable-contribution.spec.ts

@@ -0,0 +1,68 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '@theia/core/lib/browser/test/jsdom';
+
+let disableJSDOM = enableJSDOM();
+
+import { FrontendApplicationConfigProvider } from '@theia/core/lib/browser/frontend-application-config-provider';
+FrontendApplicationConfigProvider.set({ applicationName: 'Test IDE' });
+
+import 'reflect-metadata';
+
+import { expect } from 'chai';
+import { ProductNameVariableContribution, PRODUCT_NAME_VARIABLE } from './product-name-variable-contribution';
+
+disableJSDOM();
+
+describe('ProductNameVariableContribution', () => {
+    before(() => {
+        disableJSDOM = enableJSDOM();
+        FrontendApplicationConfigProvider.set({ applicationName: 'Test IDE' });
+    });
+    after(() => disableJSDOM());
+
+    let contribution: ProductNameVariableContribution;
+
+    beforeEach(() => {
+        contribution = new ProductNameVariableContribution();
+    });
+
+    it('should resolve to the configured application name', async () => {
+        const result = await contribution.resolve(
+            { variable: PRODUCT_NAME_VARIABLE },
+            {}
+        );
+        expect(result).to.not.be.undefined;
+        expect(result!.value).to.equal('Test IDE');
+    });
+
+    it('should return undefined for unknown variables', async () => {
+        const result = await contribution.resolve(
+            { variable: { id: 'other', name: 'other', description: 'other' } },
+            {}
+        );
+        expect(result).to.be.undefined;
+    });
+
+    it('should return a positive priority from canResolve', async () => {
+        const priority = await contribution.canResolve(
+            { variable: PRODUCT_NAME_VARIABLE },
+            {}
+        );
+        expect(priority).to.equal(1);
+    });
+});

package/src/browser/product-name-variable-contribution.ts

@@ -0,0 +1,47 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { MaybePromise, nls } from '@theia/core';
+import { FrontendApplicationConfigProvider } from '@theia/core/lib/browser/frontend-application-config-provider';
+import { injectable } from '@theia/core/shared/inversify';
+import { AIVariable, AIVariableContribution, AIVariableContext, AIVariableResolutionRequest, AIVariableResolver, AIVariableService, ResolvedAIVariable } from '../common';
+
+export const PRODUCT_NAME_VARIABLE: AIVariable = {
+    id: 'product-name-provider',
+    name: 'productName',
+    description: nls.localize('theia/ai/core/productNameVariable/description', 'The name of the product/application the user is working with'),
+};
+
+@injectable()
+export class ProductNameVariableContribution implements AIVariableContribution, AIVariableResolver {
+    registerVariables(service: AIVariableService): void {
+        service.registerResolver(PRODUCT_NAME_VARIABLE, this);
+    }
+
+    canResolve(request: AIVariableResolutionRequest, context: AIVariableContext): MaybePromise<number> {
+        if (request.variable.name === PRODUCT_NAME_VARIABLE.name) {
+            return 1;
+        }
+        return -1;
+    }
+
+    async resolve(request: AIVariableResolutionRequest, context: AIVariableContext): Promise<ResolvedAIVariable | undefined> {
+        if (request.variable.name === PRODUCT_NAME_VARIABLE.name) {
+            return { variable: request.variable, value: FrontendApplicationConfigProvider.get().applicationName };
+        }
+        return undefined;
+    }
+}

package/src/browser/skill-prompt-coordinator.ts

@@ -30,7 +30,10 @@ export class SkillPromptCoordinator implements FrontendApplicationContribution {
 
     protected registeredSkillCommands = new Set<string>();
 
-    onStart(): void {
+    async onStart(): Promise<void> {
+        // Wait for skills to be loaded before registering commands
+        await this.skillService.ready;
+
         // Register initial skills
         this.updateSkillCommands();
 

package/src/browser/skill-service.ts

@@ -15,6 +15,7 @@
 // *****************************************************************************
 
 import { inject, injectable, named, postConstruct } from '@theia/core/shared/inversify';
+import { Deferred } from '@theia/core/lib/common/promise-util';
 import { DisposableCollection, Emitter, Event, ILogger, URI } from '@theia/core';
 import { Path } from '@theia/core/lib/common/path';
 import { EnvVariablesServer } from '@theia/core/lib/common/env-variables';
@@ -37,6 +38,9 @@ export interface SkillService {
 
     /** Event fired when skills change */
     readonly onSkillsChanged: Event<void>;
+
+    /** Promise that resolves when initial skill loading is complete */
+    readonly ready: Promise<void>;
 }
 
 @injectable()
@@ -68,6 +72,11 @@ export class DefaultSkillService implements SkillService {
 
     protected updateDebounceTimeout: ReturnType<typeof setTimeout> | undefined;
 
+    protected _ready = new Deferred<void>();
+    get ready(): Promise<void> {
+        return this._ready.promise;
+    }
+
     @postConstruct()
     protected init(): void {
         this.fileService.onDidFilesChange(async (event: FileChangesEvent) => {
@@ -113,6 +122,7 @@ export class DefaultSkillService implements SkillService {
         // Wait for workspace to be ready before initial update
         this.workspaceService.ready.then(() => {
             this.update().then(() => {
+                this._ready.resolve();
                 // Only after initial update, start listening for changes
                 this.lastSkillDirectoriesValue = JSON.stringify(this.preferences[PREFERENCE_NAME_SKILL_DIRECTORIES]);
 

package/src/browser/skills-variable-contribution.spec.ts

@@ -52,7 +52,8 @@ describe('SkillsVariableContribution', () => {
         skillService = {
             getSkills: sinon.stub(),
             getSkill: sinon.stub(),
-            onSkillsChanged: sinon.stub() as unknown as typeof skillService.onSkillsChanged
+            onSkillsChanged: sinon.stub() as unknown as typeof skillService.onSkillsChanged,
+            ready: sinon.stub() as unknown as typeof skillService.ready
         };
 
         container.bind(SkillService).toConstantValue(skillService as unknown as SkillService);

package/src/browser/trust-aware-preference-reader.spec.ts

@@ -0,0 +1,304 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '@theia/core/lib/browser/test/jsdom';
+const disableJSDOM = enableJSDOM();
+import { FrontendApplicationConfigProvider } from '@theia/core/lib/browser/frontend-application-config-provider';
+FrontendApplicationConfigProvider.set({});
+
+import { expect } from 'chai';
+import { Container } from '@theia/core/shared/inversify';
+import { Emitter, Event } from '@theia/core';
+import { Deferred } from '@theia/core/lib/common/promise-util';
+import { PreferenceService } from '@theia/core/lib/common/preferences';
+import { WorkspaceTrustService } from '@theia/workspace/lib/browser/workspace-trust-service';
+import { TrustAwarePreferenceReader } from './trust-aware-preference-reader';
+
+disableJSDOM();
+
+interface InspectResult<T> {
+    defaultValue?: T;
+    globalValue?: T;
+    workspaceValue?: T;
+    workspaceFolderValue?: T;
+}
+
+class StubPreferenceService {
+    inspectResult: InspectResult<unknown> | undefined;
+    effectiveValue: unknown;
+
+    get<T>(_preferenceName: string, fallback?: T, _resourceUri?: string): T | undefined {
+        return ((this.effectiveValue as T | undefined) ?? fallback);
+    }
+
+    inspect<T>(_preferenceName: string, _resourceUri?: string): InspectResult<T> | undefined {
+        return this.inspectResult as InspectResult<T> | undefined;
+    }
+}
+
+class StubWorkspaceTrustService {
+    readonly trustDeferred = new Deferred<boolean>();
+    protected readonly emitter = new Emitter<boolean>();
+    readonly onDidChangeWorkspaceTrust: Event<boolean> = this.emitter.event;
+
+    getWorkspaceTrust(): Promise<boolean> {
+        return this.trustDeferred.promise;
+    }
+
+    fireTrustChange(trusted: boolean): void {
+        this.emitter.fire(trusted);
+    }
+}
+
+const PREFERENCE_NAME = 'some.preference';
+
+describe('TrustAwarePreferenceReader', () => {
+    let preferences: StubPreferenceService;
+    let trust: StubWorkspaceTrustService;
+    let reader: TrustAwarePreferenceReader;
+
+    beforeEach(() => {
+        preferences = new StubPreferenceService();
+        trust = new StubWorkspaceTrustService();
+
+        const container = new Container();
+        container.bind(PreferenceService).toConstantValue(preferences as unknown as PreferenceService);
+        container.bind(WorkspaceTrustService).toConstantValue(trust as unknown as WorkspaceTrustService);
+        container.bind(TrustAwarePreferenceReader).toSelf().inSingletonScope();
+
+        reader = container.get(TrustAwarePreferenceReader);
+    });
+
+    describe('fail-closed default', () => {
+        it('returns only user/default/fallback before ready resolves', () => {
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('user');
+        });
+
+        it('returns defaultValue when only workspace value exists before ready', () => {
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                workspaceValue: 'workspace'
+            };
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('default');
+        });
+
+        it('returns fallback when nothing is set before ready', () => {
+            preferences.effectiveValue = undefined;
+            preferences.inspectResult = {};
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('fallback');
+        });
+    });
+
+    describe('after ready resolves with trusted = true', () => {
+        beforeEach(async () => {
+            trust.trustDeferred.resolve(true);
+            await reader.ready;
+        });
+
+        it('delegates to preferences.get and returns the workspace value', () => {
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('workspace');
+        });
+    });
+
+    describe('after ready resolves with trusted = false', () => {
+        beforeEach(async () => {
+            trust.trustDeferred.resolve(false);
+            await reader.ready;
+        });
+
+        it('returns globalValue when both global and workspace values exist', () => {
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('user');
+        });
+
+        it('falls back to defaultValue when only workspace value exists', () => {
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                workspaceValue: 'workspace'
+            };
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('default');
+        });
+
+        it('returns the supplied fallback when nothing is set', () => {
+            preferences.effectiveValue = undefined;
+            preferences.inspectResult = {};
+            const value = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            expect(value).to.equal('fallback');
+        });
+    });
+
+    describe('onDidChangeTrust', () => {
+        beforeEach(async () => {
+            trust.trustDeferred.resolve(false);
+            await reader.ready;
+        });
+
+        it('fires with the new value when the underlying service emits a change', () => {
+            const received: boolean[] = [];
+            reader.onDidChangeTrust(value => received.push(value));
+
+            trust.fireTrustChange(true);
+            expect(received).to.deep.equal([true]);
+        });
+
+        it('does not fire when the value is unchanged', () => {
+            const received: boolean[] = [];
+            reader.onDidChangeTrust(value => received.push(value));
+
+            trust.fireTrustChange(false);
+            expect(received).to.deep.equal([]);
+        });
+
+        it('has updated the cached trusted flag by the time listeners run', () => {
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+
+            let observedDuringListener: string | undefined;
+            reader.onDidChangeTrust(() => {
+                observedDuringListener = reader.get<string>(PREFERENCE_NAME, 'fallback');
+            });
+
+            trust.fireTrustChange(true);
+            expect(observedDuringListener).to.equal('workspace');
+        });
+    });
+
+    describe('ready', () => {
+        it('does not resolve until the initial getWorkspaceTrust promise resolves', async () => {
+            let resolved = false;
+            reader.ready.then(() => { resolved = true; });
+
+            // Allow microtasks to settle without resolving the deferred.
+            await Promise.resolve();
+            expect(resolved).to.equal(false);
+
+            trust.trustDeferred.resolve(true);
+            await reader.ready;
+            expect(resolved).to.equal(true);
+        });
+
+        it('resolves via an early change event when it arrives before the initial promise', async () => {
+            const received: boolean[] = [];
+            reader.onDidChangeTrust(value => received.push(value));
+
+            trust.fireTrustChange(true);
+            await reader.ready;
+
+            // The first signal acts as the initial resolution and must not
+            // be reported as a change event.
+            expect(received).to.deep.equal([]);
+
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+            expect(reader.get<string>(PREFERENCE_NAME, 'fallback')).to.equal('workspace');
+        });
+    });
+
+    describe('race between initial promise and change event', () => {
+        it('ignores a stale getWorkspaceTrust resolution after a change event has initialised the reader', async () => {
+            const received: boolean[] = [];
+            reader.onDidChangeTrust(value => received.push(value));
+
+            // Change event arrives first and initialises the reader.
+            trust.fireTrustChange(false);
+            // The (now stale) initial promise resolves to a different value.
+            trust.trustDeferred.resolve(true);
+
+            await reader.ready;
+            // Allow the stale .then callback to run.
+            await Promise.resolve();
+            await Promise.resolve();
+
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+
+            // Cached trust must still reflect the change event (false), not
+            // the stale promise resolution (true).
+            expect(reader.get<string>(PREFERENCE_NAME, 'fallback')).to.equal('user');
+            // No change event should have been fired for the initial value
+            // and none for the stale resolution either.
+            expect(received).to.deep.equal([]);
+        });
+
+        it('ignores a stale getWorkspaceTrust rejection after a change event has initialised the reader', async () => {
+            const received: boolean[] = [];
+            reader.onDidChangeTrust(value => received.push(value));
+
+            // Avoid an unhandled rejection warning for the (now stale) initial promise.
+            trust.getWorkspaceTrust().catch(() => { /* expected */ });
+
+            // Change event arrives first and initialises the reader.
+            trust.fireTrustChange(true);
+            // The (now stale) initial promise rejects.
+            trust.trustDeferred.reject(new Error('stale failure'));
+
+            // ready must resolve (not reject) because the event already initialised it.
+            await reader.ready;
+            // Allow the stale rejection callback to run.
+            await Promise.resolve();
+            await Promise.resolve();
+
+            preferences.effectiveValue = 'workspace';
+            preferences.inspectResult = {
+                defaultValue: 'default',
+                globalValue: 'user',
+                workspaceValue: 'workspace'
+            };
+
+            // Cached trust must reflect the change event (true).
+            expect(reader.get<string>(PREFERENCE_NAME, 'fallback')).to.equal('workspace');
+            // No change event should have been fired for the initial value.
+            expect(received).to.deep.equal([]);
+        });
+    });
+});

package/src/browser/trust-aware-preference-reader.ts

@@ -0,0 +1,108 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { inject, injectable, postConstruct } from '@theia/core/shared/inversify';
+import { JSONValue } from '@theia/core/shared/@lumino/coreutils';
+import { Emitter, Event } from '@theia/core';
+import { Deferred } from '@theia/core/lib/common/promise-util';
+import { PreferenceService } from '@theia/core/lib/common/preferences';
+import { WorkspaceTrustService } from '@theia/workspace/lib/browser/workspace-trust-service';
+
+/**
+ * Helper for reading AI preferences that must ignore workspace/folder scopes
+ * when the current workspace is not trusted.
+ *
+ * Writes should continue to go through `PreferenceService` directly; trust only
+ * affects reads.
+ */
+@injectable()
+export class TrustAwarePreferenceReader {
+
+    @inject(PreferenceService)
+    protected readonly preferences: PreferenceService;
+
+    @inject(WorkspaceTrustService)
+    protected readonly trust: WorkspaceTrustService;
+
+    /**
+     * Cached trust flag updated via `onDidChangeWorkspaceTrust`. Defaults to
+     * `false` (fail closed): until the initial trust state has resolved, reads
+     * return only user/default scope values. Asynchronous callers should
+     * `await ready` before their first read.
+     */
+    protected trusted = false;
+
+    protected readonly _ready = new Deferred<void>();
+
+    /**
+     * Resolves once the initial workspace trust state has been resolved.
+     * Callers that need a deterministic trust state before their first read can
+     * await this promise.
+     */
+    get ready(): Promise<void> {
+        return this._ready.promise;
+    }
+
+    protected readonly onDidChangeTrustEmitter = new Emitter<boolean>();
+    readonly onDidChangeTrust: Event<boolean> = this.onDidChangeTrustEmitter.event;
+
+    @postConstruct()
+    protected init(): void {
+        let initialized = false;
+
+        this.trust.onDidChangeWorkspaceTrust(t => {
+            if (!initialized) {
+                initialized = true;
+                this.trusted = t;
+                this._ready.resolve();
+                return;
+            }
+            if (this.trusted === t) {
+                return;
+            }
+            this.trusted = t;
+            this.onDidChangeTrustEmitter.fire(t);
+        });
+
+        this.trust.getWorkspaceTrust().then(t => {
+            if (initialized) {
+                return;
+            }
+            initialized = true;
+            this.trusted = t;
+            this._ready.resolve();
+        }, err => {
+            if (initialized) {
+                return;
+            }
+            initialized = true;
+            this._ready.reject(err);
+        });
+    }
+
+    /**
+     * Reads the preference, ignoring workspace/folder scopes when the workspace
+     * is untrusted. Returns `globalValue ?? defaultValue ?? fallback`.
+     */
+    get<T>(preferenceName: string, fallback?: T, resourceUri?: string): T | undefined {
+        if (this.trusted) {
+            return this.preferences.get<T>(preferenceName, fallback, resourceUri);
+        }
+        const inspection = this.preferences.inspect<JSONValue>(preferenceName, resourceUri);
+        const value = inspection?.globalValue ?? inspection?.defaultValue;
+        return (value as T | undefined) ?? fallback;
+    }
+}