Use * activation to augment PATH before git extension's async operations

Author: j-256

CLAUDE.md

@@ -28,7 +28,8 @@ test/
 
 ## Key Design Decisions
 
-- **Eager registration:** Decoration provider is registered before repo scanning completes. The git extension may not have discovered repositories when we activate (`onStartupFinished`), so gating on repo state causes missed decorations.
+- **`*` activation:** The extension uses `*` activation (not `onStartupFinished`) so PATH is augmented before the git extension's async repo discovery runs git operations that trigger clean/smudge filters. Combined with `extensionDependencies` on `vscode.git`, the sequence is: git extension activates and schedules async work, our extension activates immediately after and sets PATH synchronously, then the git extension's async operations find git-crypt. The `package` and `publish` scripts pass `--allow-star-activation` to suppress the vsce warning -- this is intentional since our activation is lightweight (just PATH augmentation).
+- **Eager registration:** Decoration provider is registered before repo scanning completes. The git extension may not have discovered repositories when we activate, so gating on repo state causes missed decorations.
 - **PATH augmentation:** The VSCode extension host has a minimal PATH. `src/extension.ts` appends `/opt/homebrew/bin`, `/usr/local/bin`, `/usr/bin`, and the bundled `bin/` directory to `process.env.PATH` on the shared extension host so `git-crypt` is discoverable by all extensions (including the built-in git extension's clean/smudge filter invocations). User-installed git-crypt takes precedence; the bundled binary is appended last. This is the extension's primary function.
 - **Bundled binary:** Platform-specific VSIX files ship a statically linked git-crypt binary (macOS arm64, Linux x64/arm64). A universal VSIX (no binary) is also published for unsupported platforms. The binary version is pinned in `git-crypt-version.txt` with a sha256 checksum.
 - **Unlock detection via key directory:** `isRepoUnlocked()` checks for `.git/git-crypt/keys/` existence rather than parsing `git-crypt status` output (which is slow on large repos and ambiguous -- it labels managed files as "encrypted:" even when unlocked).

CONTRIBUTING.md

@@ -37,7 +37,7 @@ src/
   git.ts        # Low-level git/git-crypt command helpers (execFile, no shell)
 ```
 
-The extension activates lazily (`onStartupFinished`), augments the extension host's `process.env.PATH` so `git-crypt` is discoverable, checks for `git-crypt` availability, scans workspace repositories for git-crypt files via `git check-attr`, and registers a file decoration provider. All git interaction uses `execFile` with array arguments (no shell) to prevent command injection.
+The extension uses `*` activation so it can augment `process.env.PATH` before the git extension's async repo discovery triggers clean/smudge filters. `extensionDependencies` on `vscode.git` ensures our activation runs right after the git extension's, and our PATH augmentation is synchronous so it completes before any async git operations execute. The `package` and `publish` npm scripts pass `--allow-star-activation` to vsce to acknowledge this is intentional (our activation is lightweight). After PATH setup, the extension checks for `git-crypt` availability, scans workspace repositories for git-crypt files via `git check-attr`, and registers a file decoration provider. All git interaction uses `execFile` with array arguments (no shell) to prevent command injection.
 
 ## Release Workflow
 

package.json

@@ -21,7 +21,7 @@
     "Other"
   ],
   "activationEvents": [
-    "onStartupFinished"
+    "*"
   ],
   "extensionDependencies": [
     "vscode.git"
@@ -43,8 +43,8 @@
     "build": "node esbuild.js",
     "watch": "node esbuild.js --watch",
     "test": "node --import tsx --test test/*.test.ts",
-    "package": "vsce package",
-    "publish": "vsce publish",
+    "package": "vsce package --allow-star-activation",
+    "publish": "vsce publish --allow-star-activation",
     "reinstall": "rm -f *.vsix && npm run package && code --install-extension git-crypt-vscode-*.vsix"
   },
   "devDependencies": {