[li-xiu-qi]

Fixes #216

Problem

The --no-skills, --no-prompt-templates, and --no-themes options disable their respective resource types during normal discovery, but extension-contributed paths enter through a second channel. AgentSession passes those paths to DefaultResourceLoader.extendResources(), which merges and loads them without checking any of the three flags.

As a result, a plugin can still inject a SKILL.md into the system prompt after the user explicitly requested --no-skills. The same bypass applies to extension-provided prompt templates and themes. On clean main at 81e79bc, the production plugin-discovery reproduction produced [] after reload() and ["evil-skill"] after extendResources() despite noSkills: true.

Changes

• Filter extension-contributed skill, prompt, and theme paths at the extendResources() admission point when the matching flag is set.
• Leave the existing reload() guards and the separate explicit-resource path unchanged. Explicitly supplied additionalSkillPaths, additionalPromptTemplatePaths, and additionalThemePaths still load under their corresponding --no-* flag.
• Add regression coverage for all three flags, a flags-off positive control, and preservation of all three explicit resource types while extension resources are blocked.

Behavior and compatibility

• --no-skills, --no-prompt-templates, and --no-themes now also cover resources contributed by plugins and other extensions during startup and reload.
• Behavior is unchanged when these flags are not set. No API shapes, command-line arguments, resource formats, or public result types change.
• Explicitly supplied resources retain their existing behavior; this change only filters extension-discovered resources.

Validation

• Reproduced the defect on unmodified main (81e79bc) using the production plugin discovery function and DefaultResourceLoader: before: [], after: ["evil-skill"] with noSkills: true.
• Defect probe: temporarily restoring the old three-line behavior caused exactly 4 failures and 1 pass in the new five-test file. The three flag tests and the explicit-resource preservation test failed; the flags-off positive control passed. The implementation was then restored byte-for-byte from backup.
• cd packages/coding-agent && pnpm exec vitest --run test/resource-loader-extension-flags.test.ts: 5/5 passed.
• cd packages/coding-agent && pnpm exec vitest --run test/resource-loader-extension-flags.test.ts test/resource-loader-no-skills.test.ts test/resource-loader.test.ts: 49/49 passed.
• A broader run of all 16 test files importing DefaultResourceLoader covered 122 tests: 121 passed, 1 failed. The failure is the Windows Git path-quoting assertion in skill-loading-regressions.test.ts (nested gitignore basename patterns must apply to all descendants in that scope); the same assertion fails on unmodified main.
• npm run check from the repository root: passed on Windows with Node v24.21.0.
• git diff --check upstream/main: passed. Public-content review found no private paths, credentials, AI attribution, debug residue, third-party reference attribution, or unrelated files.
• Fork CI on commit 0fcc02c: run 40123588861 completed with conclusion: success; Build, Check, and Test all passed on Ubuntu.
• Upstream PR CI on the same commit: run 40124299091 completed with conclusion: success; Build, Check, and Test all passed on Ubuntu.

Limitations

• The pre-existing Windows assertion failure in skill-loading-regressions.test.ts (nested gitignore basename patterns must apply to all descendants in that scope) remains outside this PR's scope. It fails identically on unmodified main and is neither introduced nor fixed by this change.