fix(skills): stop walking the whole tree to answer "does any file match"

packages/core/src/util/glob.ts

@@ -1,4 +1,4 @@
-import { glob, globSync, type GlobOptions } from "glob"
+import { glob, globSync, globIterate, type GlobOptions } from "glob"
 import { minimatch } from "minimatch"
 
 export namespace Glob {
@@ -62,6 +62,16 @@ export namespace Glob {
     }
   }
 
+  // altimate_change start — upstream_fix: existence check that stops at the first match.
+  // `scan` resolves only once the whole walk is done, so a caller asking "does anything
+  // match?" pays for the entire tree even when the first directory answers it. `globIterate`
+  // yields lazily, so this abandons the walk as soon as one path matches.
+  export async function exists(pattern: string, options: Options = {}): Promise<boolean> {
+    for await (const _ of globIterate(pattern, toGlobOptions(options))) return true
+    return false
+  }
+  // altimate_change end
+
   export async function scan(pattern: string, options: Options = {}): Promise<string[]> {
     return glob(pattern, toGlobOptions(options)) as Promise<string[]>
   }

packages/core/test/util/glob.test.ts

@@ -121,3 +121,43 @@ describe("Glob.DEFAULT_IGNORE", () => {
   })
 })
 // altimate_change end
+
+// altimate_change start — upstream_fix: `exists` must answer without walking the whole tree.
+describe("Glob.exists", () => {
+  test("agrees with scan() on whether anything matched", async () => {
+    for (const pattern of ["**/*.ts", "**/mcp.json", "**/nothing-matches-this.xyz"]) {
+      const scanned = await Glob.scan(pattern, { cwd: root, absolute: true })
+      const existed = await Glob.exists(pattern, { cwd: root, absolute: true })
+      expect(existed, `pattern ${pattern}`).toBe(scanned.length > 0)
+    }
+  })
+
+  test("honours the same options as scan", async () => {
+    // `include: "file"` must not report a directory match, or a skill whose applyPaths names
+    // a directory would auto-load on every project that happens to have one.
+    const dirOnly = await Glob.exists("src", { cwd: root, include: "file" })
+    const withDirs = await Glob.exists("src", { cwd: root, include: "all" })
+    expect(dirOnly).toBe(false)
+    expect(withDirs).toBe(true)
+  })
+
+  test("prunes with ignore, like scan", async () => {
+    // Own fixture: the shared `root` has matching files outside the ignored trees too, which
+    // would make this pass for the wrong reason.
+    const own = await mkdtemp(path.join(tmpdir(), "glob-exists-"))
+    try {
+      await mkdir(path.join(own, "node_modules", "pkg"), { recursive: true })
+      await writeFile(path.join(own, "node_modules", "pkg", "only-here.json"), "{}")
+
+      expect(await Glob.exists("**/only-here.json", { cwd: own })).toBe(true)
+      expect(await Glob.exists("**/only-here.json", { cwd: own, ignore: ["**/node_modules/**"] })).toBe(false)
+    } finally {
+      await rm(own, { recursive: true, force: true })
+    }
+  })
+
+  test("returns false for a directory that does not exist", async () => {
+    expect(await Glob.exists("**/*", { cwd: path.join(root, "no-such-dir") })).toBe(false)
+  })
+})
+// altimate_change end

packages/opencode/src/session/system.ts

@@ -245,21 +245,52 @@ export namespace SystemPrompt {
     return v.filter((s) => typeof s === "string" && s.length > 0)
   }
 
+  /**
+   * Directory an `applyPaths` glob is matched against.
+   *
+   * `Project.fromDirectory` reports `/` as the worktree for a directory belonging to no git
+   * project — a sentinel meaning "no project", not a tree to search. Matching against it
+   * auto-loads a skill because an unrelated file exists elsewhere on the machine: an empty
+   * directory picked up the dbt skills from any `dbt_project.yml` anywhere on disk.
+   *
+   * `/` is only that sentinel when there is no VCS. A git repository genuinely rooted at `/`
+   * reports the same worktree but with `vcs: "git"`, and must keep scanning from its root —
+   * the same distinction `fromDirectory` itself draws when it chooses the value.
+   *
+   * The fallback deliberately narrows to at-or-below the session directory. Outside a repo
+   * there is no project boundary to walk up to, so anything wider is a guess about which of
+   * the machine's files are "this project"; the previous behaviour made that guess and got it
+   * wrong. A marker file above the cwd no longer auto-loads its skill in that case, which is
+   * the intended trade against loading skills from unrelated directories.
+   */
+  export function autoLoadScanRoot(worktree: string, directory: string, vcs: string | undefined): string {
+    return worktree === "/" && !vcs ? directory : worktree
+  }
+
   async function anyMatchInWorktree(globs: string[]): Promise<boolean> {
-    // Search from worktree root so a skill that wants `dbt_project.yml`
-    // catches the file no matter how deep the user's cwd is.
+    // Search from the worktree root, so a skill that wants `dbt_project.yml` catches the file
+    // no matter how deep the user's cwd is — within a project. Outside one there is no root to
+    // search and `autoLoadScanRoot` falls back to the session directory; see its docstring for
+    // why that narrowing is deliberate.
     // Errors propagate to the caller's try/catch (collectAutoLoadedSkills)
     // so the warning log there actually fires.
-    const root = Instance.worktree
+    // `Glob.exists` rather than `scan(...).length > 0`: this only needs to know whether any
+    // file matches, and `scan` walks the whole tree before the caller can look. That cost is
+    // paid once per `applyPaths` skill — two ship builtin — and the root is the worktree, which
+    // is `/` for a directory outside any git repo. Measured from such a directory, the two
+    // scans were ~45s of a ~51s startup, all of it before the first token.
+    const root = autoLoadScanRoot(Instance.worktree, Instance.directory, Instance.project.vcs)
     for (const g of globs) {
-      const matches = await Glob.scan(g, {
-        cwd: root,
-        absolute: true,
-        include: "file",
-        dot: false,
-        symlink: false,
-      })
-      if (matches.length > 0) return true
+      if (
+        await Glob.exists(g, {
+          cwd: root,
+          absolute: true,
+          include: "file",
+          dot: false,
+          symlink: false,
+        })
+      )
+        return true
     }
     return false
   }

packages/opencode/test/session/autoload-scan-root.test.ts

@@ -0,0 +1,31 @@
+// altimate_change start — a skill must not auto-load because of a file on some other project.
+import { describe, expect, test } from "bun:test"
+import { SystemPrompt } from "../../src/session/system"
+
+describe("autoLoadScanRoot", () => {
+  test("uses the worktree when there is a real project", () => {
+    expect(SystemPrompt.autoLoadScanRoot("/Users/me/code/proj", "/Users/me/code/proj/sub", "git")).toBe(
+      "/Users/me/code/proj",
+    )
+  })
+
+  test("falls back to the session directory when the worktree is the no-project sentinel", () => {
+    // `Project.fromDirectory` returns `/` with no vcs for a directory belonging to no git
+    // project. Searching it matched any `dbt_project.yml` anywhere on the machine, so an empty
+    // scratch directory silently loaded the dbt skills into its system prompt.
+    expect(SystemPrompt.autoLoadScanRoot("/", "/tmp/scratch", undefined)).toBe("/tmp/scratch")
+  })
+
+  test("keeps the root for a git repository genuinely rooted at /", () => {
+    // Same worktree value, different meaning: `fromDirectory` reports `/` with `vcs: "git"` for
+    // a real repo at the filesystem root, and narrowing that to the cwd would stop a marker at
+    // `/` matching a session started in `/workspace/sub`.
+    expect(SystemPrompt.autoLoadScanRoot("/", "/workspace/sub", "git")).toBe("/")
+  })
+
+  test("does not treat a path merely starting with / as the sentinel", () => {
+    // Guard against matching by prefix rather than equality — every absolute path starts with "/".
+    expect(SystemPrompt.autoLoadScanRoot("/srv", "/tmp/scratch", undefined)).toBe("/srv")
+  })
+})
+// altimate_change end