@askalf/truecopy 0.0.1 → 0.6.2

package/src/mcp-cli.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// canon-mcp — enforce canon.lock on a live MCP server. Point your MCP client at
+//   canon-mcp [--lock canon.lock] [--name <pinned>] [--strict] -- <server cmd...>
+// Only vetted, unmodified, unpoisoned tools reach the client.
+import { runGate } from './mcp.mjs';
+
+const argv = process.argv.slice(2);
+const sep = argv.indexOf('--');
+const pre = sep >= 0 ? argv.slice(0, sep) : argv;
+const cmd = sep >= 0 ? argv.slice(sep + 1) : [];
+const opt = (n, d) => {
+  const i = pre.indexOf(n);
+  if (i >= 0) { const nx = pre[i + 1]; return nx !== undefined && !nx.startsWith('--') ? nx : true; } // `--n value` or bare `--n`
+  const eq = pre.find((x) => x.startsWith(n + '='));
+  return eq ? eq.slice(n.length + 1) : d;
+};
+
+if (!cmd.length || pre.includes('-h') || pre.includes('--help')) {
+  process.stderr.write('usage: canon-mcp [--lock canon.lock] [--name <pinned>] [--strict] -- <mcp-server cmd...>\n');
+  process.exit(cmd.length ? 0 : 2);
+}
+runGate({ command: cmd[0], args: cmd.slice(1), lockPath: opt('--lock', 'canon.lock'), name: opt('--name', null) || null, strict: !!opt('--strict', false) });

package/src/mcp.mjs

@@ -0,0 +1,88 @@
+// canon-mcp — a stdio MCP proxy that ENFORCES canon.lock at runtime. It sits
+// between an MCP client and a downstream MCP server, filters `tools/list` down to
+// the vetted set, and blocks `tools/call` to anything it dropped. Un-vetted,
+// drifted, or poisoned tools never reach the agent. JSON-RPC over newline stdio.
+//
+// Where warden-mcp firewalls what a tool DOES, canon-mcp gates what tools EXIST.
+import { spawn } from 'node:child_process';
+import readline from 'node:readline';
+import { gateTools, toolHash } from './gate.mjs';
+import { readLock } from './lock.mjs';
+
+const blockReply = (id, name) =>
+  JSON.stringify({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: `⛔ canon blocked an un-vetted / drifted tool: ${name}` }], isError: true } });
+
+/** client → server. { forward } to pass on, or { reply } to short-circuit a blocked call. */
+export function inspectClient(line, state) {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return { forward: line }; }
+  if (msg && msg.method && msg.id != null) state.pending[msg.id] = msg.method;
+  // Fail CLOSED on calls: a tool is callable only if it was VETTED in a gated
+  // tools/list. `blocked` alone is insufficient — a tool that was never gated
+  // (smuggled past tools/list, or known to the agent out-of-band) would otherwise
+  // be forwarded and executed. Only allow once we've actually seen+vetted a list.
+  if (msg && msg.method === 'tools/call') {
+    const name = msg.params?.name;
+    if (state.listed && !state.allowedNames.has(name)) return { reply: blockReply(msg.id, name) };
+    if (state.blocked.has(name)) return { reply: blockReply(msg.id, name) };
+  }
+  return { forward: line };
+}
+
+/** server → client. Rewrites ANY result carrying a tools array down to the vetted
+ *  set — not only one correlated to a tracked tools/list id. A hostile server can
+ *  push an UNSOLICITED tools result, answer tools/list TWICE (the 2nd after the id
+ *  is cleared), or bury tools in another reply; all must be gated, never forwarded
+ *  raw. */
+export function inspectServer(line, state, opts = {}) {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return { forward: line }; }
+  const isToolsResult = msg && msg.result && Array.isArray(msg.result.tools);
+  if (isToolsResult) {
+    if (msg.id != null) delete state.pending[msg.id];
+    const { allowed, report } = gateTools(msg.result.tools, opts.entry);
+    const blockAll = opts.strict && report.some((r) => r.status !== 'vetted'); // strict: any problem → block the whole server
+    for (const r of report) if (r.status !== 'vetted') { state.blocked.add(r.tool); opts.onWarn?.(`${blockAll ? 'strict — blocking all (' : 'dropped '}${r.tool} (${r.status})${blockAll ? ')' : ''}`); }
+    const keep = blockAll ? new Set() : allowed;   // allowed is now a Set of hashes
+    const kept = msg.result.tools.filter((t) => t && typeof t === 'object' && keep.has(toolHash(t)));
+    msg.result.tools = kept;
+    // Remember the vetted names so a later tools/call can be allow-listed (fail
+    // closed). `listed` flips the call gate from blocklist to allowlist.
+    state.listed = true;
+    state.allowedNames = state.allowedNames || new Set();
+    for (const t of kept) state.allowedNames.add(t.name);
+    return { forward: JSON.stringify(msg) };
+  }
+  if (msg && msg.id != null) delete state.pending[msg.id];
+  return { forward: line };
+}
+
+/** Which lock entry governs this server: explicit --name, else the sole MCP entry. */
+export function pickEntry(lock, name) {
+  if (name) return (lock.skills && lock.skills[name]) || null;
+  const mcp = Object.entries(lock.skills || {}).filter(([, e]) => e.kind === 'mcp');
+  return mcp.length === 1 ? mcp[0][1] : null;
+}
+
+/** Spawn the downstream server and wire the two gated streams together. */
+export function runGate({ command, args = [], lockPath = 'canon.lock', name = null, strict = false, onWarn } = {}) {
+  const warn = onWarn || ((m) => process.stderr.write('[canon] ' + m + '\n'));
+  const entry = pickEntry(readLock(lockPath), name);
+  if (!entry) warn(`no pinned ${name ? '"' + name + '" ' : ''}MCP entry in ${lockPath} — every tool will be treated as unvetted (canon add it first)`);
+  const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'inherit'] });
+  const state = { pending: {}, blocked: new Set(), allowedNames: new Set(), listed: false };
+  const opts = { entry, strict, onWarn: warn };
+
+  readline.createInterface({ input: process.stdin }).on('line', (line) => {
+    if (!line.trim()) return;
+    const r = inspectClient(line, state);
+    if (r.reply) process.stdout.write(r.reply + '\n');
+    if (r.forward) child.stdin.write(r.forward + '\n');
+  });
+  readline.createInterface({ input: child.stdout }).on('line', (line) => {
+    if (!line.trim()) return;
+    process.stdout.write(inspectServer(line, state, opts).forward + '\n');
+  });
+  process.stdin.on('end', () => { try { child.stdin.end(); } catch {} });
+  child.on('exit', (code) => process.exit(code ?? 0));
+}

package/src/scan.mjs

@@ -0,0 +1,36 @@
+// Poison scan — reuse warden's supply-chain scanner (the OpenClaw poisoned-skill
+// class: injection / exfil instructions hidden in a tool's name, description, or
+// schema). canon adds the provenance layer on top; warden owns the detection.
+import { scanMcpTools } from '@askalf/redstamp/mcp';
+import { decide } from '@askalf/redstamp';
+import { canonicalJson } from './hash.mjs';
+
+/** Scan a loaded skill for poisoning. → { verdict: 'clean'|'flagged', findings, advisories }
+ *
+ *  Severity-aware by SURFACE. Long-form skill/file prose flags only on a
+ *  CRITICAL finding — an injection/exfil *instruction*; a bare sensitive-path or
+ *  secret-env *mention* comes back as an advisory instead (documentation
+ *  legitimately teaches credential handling — the official Claude Code
+ *  marketplace flagged 19/29 skills on mentions alone). MCP tool definitions
+ *  keep the strict any-finding rule: short descriptions are exactly the surface
+ *  the mention heuristics were tuned for. A finding without a `severity` field
+ *  (an older warden) is treated as critical — fail closed, never laxer. */
+export function scanSkill(skill) {
+  const all = scanMcpTools((skill && skill.scanTargets) || []);
+  const prose = !!skill && (skill.kind === 'skill' || skill.kind === 'file');
+  const findings = prose ? all.filter((f) => (f && f.severity) !== 'advisory') : all;
+  const advisories = prose ? all.filter((f) => f && f.severity === 'advisory') : [];
+  // An MCP manifest's launch fields (command/args/env) actually RUN when the
+  // server starts — an RCE or key-exfil hidden there must be caught too, not just
+  // poison in the tool descriptions.
+  const lz = skill && skill.launch;
+  if (lz && (lz.command || lz.args || lz.env)) {
+    const cmd = [lz.command, ...(Array.isArray(lz.args) ? lz.args : []), lz.env ? canonicalJson(lz.env) : '']
+      .filter(Boolean).join(' ');
+    const v = decide({ tool: 'shell', input: { command: cmd } });
+    if (v.tier === 'black' || v.tier === 'red') {
+      findings.push({ tool: (skill.name || 'server') + ' (launch)', flags: (v.why || []).filter((w) => /[☠⚠]/.test(w)), severity: 'critical' });
+    }
+  }
+  return { verdict: findings.length ? 'flagged' : 'clean', findings, advisories };
+}

package/src/sign.mjs

@@ -0,0 +1,122 @@
+// Ed25519 attestation. `--sign` stamps a pinned entry with a signature over its
+// content hash. WHO signed it is identified by the public key embedded in the
+// signature; WHETHER you accept that signer is a separate decision — the trust set
+// (see trust.mjs). Your machine's own key (in ~/.canon) is implicitly trusted, so a
+// local `--sign` round-trips with no extra step; a publisher you trust signs with
+// THEIR key and you add it once via `canon trust add`.
+//
+// The PRIVATE key is held in the OS keychain (keychain.mjs) — never written as
+// plaintext — when one is available; only the PUBLIC key lives in signing-key.json
+// (public is not secret). Hosts with no keychain fall back to a 0600 plaintext file,
+// and a pre-keychain plaintext key is migrated into the keychain on first sign. In CI,
+// set CANON_SIGNING_KEY (the private key) to sign without any local key at all —
+// signing moves off developer boxes into CI, and everyone else only `verify`s.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { keychainAvailable, keychainGet, keychainSet } from './keychain.mjs';
+
+// Resolved at call time (not import) so CANON_HOME can be set per-test/per-run.
+const keyFile = () => path.join(process.env.CANON_HOME || os.homedir(), '.canon', 'signing-key.json');
+
+// PEM bytes can differ only by line endings (CRLF on Windows, a trailing newline
+// from a file read) yet be the same key — normalize before hashing/verifying so a
+// key's identity is stable across platforms.
+const normPem = (p) => String(p).replace(/\r\n/g, '\n').trim();
+const enc64 = (s) => Buffer.from(s, 'utf8').toString('base64');
+const dec64 = (s) => Buffer.from(s, 'base64').toString('utf8');
+
+// A signing key injected via the environment — CI mode. CANON_SIGNING_KEY holds the
+// PRIVATE key (base64-encoded PEM, or a raw PEM); the PUBLIC key is DERIVED from it,
+// so the CI secret is just the private half and signing needs no file or keychain.
+// Read-only: never writes to disk/keychain (CI runners are ephemeral). Takes priority
+// over the local key, so `canon … --sign` in CI signs with this identity. Because the
+// public key is derived, a key minted locally and exported here keeps the same keyId.
+function envKey() {
+  const raw = process.env.CANON_SIGNING_KEY;
+  if (!raw) return null;
+  try {
+    const privateKey = raw.includes('-----BEGIN') ? raw : dec64(raw);
+    const publicKey = crypto.createPublicKey(privateKey).export({ type: 'spki', format: 'pem' });
+    return { publicKey, privateKey };
+  } catch {
+    return null;                                             // malformed → fall through to the local key
+  }
+}
+
+/** A stable short fingerprint for a public key — how the trust set addresses it. */
+export function keyId(publicKey) {
+  if (!publicKey) return '';
+  return crypto.createHash('sha256').update(normPem(publicKey)).digest('hex').slice(0, 16);
+}
+
+// The file half of the key record: { publicKey } (+ a legacy plaintext privateKey on
+// pre-keychain installs). Null when there's no key file at all.
+const readFile = () => { try { return JSON.parse(fs.readFileSync(keyFile(), 'utf8')); } catch { return null; } };
+
+/** The local key if it already exists, else null — never generates one (so a
+ *  read-only path like `verify` building its trust set can't create key material).
+ *  The private half comes from the OS keychain; a legacy plaintext private in the
+ *  file is honored as a fallback so existing installs keep working pre-migration. */
+export function loadKey() {
+  const env = envKey();
+  if (env) return env;                                       // CI: key from CANON_SIGNING_KEY
+  const file = readFile();
+  if (!file || !file.publicKey) return file;                 // no key (or unreadable)
+  if (keychainAvailable()) {
+    const stored = keychainGet();
+    if (stored) return { publicKey: file.publicKey, privateKey: dec64(stored) };
+  }
+  // keychain empty/unavailable → honor a legacy plaintext private if present.
+  return file.privateKey ? { publicKey: file.publicKey, privateKey: file.privateKey } : { publicKey: file.publicKey };
+}
+
+export function ensureKey() {
+  const env = envKey();
+  if (env) return env;                                       // CI: sign with the injected key; never generate/migrate
+  const file = keyFile();
+  const existing = readFile();
+  if (existing && existing.publicKey) {
+    // Migrate a legacy plaintext private key into the keychain, then strip it from
+    // the file. Same keypair → canon's identity is preserved. One-time, on first
+    // sign after the upgrade.
+    if (existing.privateKey && keychainAvailable()) {
+      keychainSet(enc64(existing.privateKey));
+      fs.writeFileSync(file, JSON.stringify({ publicKey: existing.publicKey }), { mode: 0o600 });
+    }
+    return loadKey();
+  }
+  // Generate a fresh keypair.
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (keychainAvailable()) {
+    keychainSet(enc64(privateKey));
+    fs.writeFileSync(file, JSON.stringify({ publicKey }), { mode: 0o600 });
+  } else {
+    fs.writeFileSync(file, JSON.stringify({ publicKey, privateKey }), { mode: 0o600 });
+  }
+  return { publicKey, privateKey };
+}
+
+/** Sign a content hash → { alg, pub, val }. Signs with the local key by default;
+ *  pass a { publicKey, privateKey } to sign as a specific publisher. */
+export function signHash(hash, key) {
+  const { publicKey, privateKey } = key || ensureKey();
+  const val = crypto.sign(null, Buffer.from(hash), privateKey).toString('base64');
+  return { alg: 'ed25519', pub: publicKey, val };
+}
+
+/** Cryptographically verify a signature object against a hash, using the public key
+ *  embedded in the signature. This proves the bytes were signed by whoever holds
+ *  that key — NOT that you trust that key. Trust (key ∈ your trust set) is a
+ *  separate gate, in trust.mjs, so a valid signature from an unknown key still
+ *  surfaces as `untrusted` rather than silently passing. */
+export function verifyHashSig(hash, sig) {
+  if (!sig || sig.alg !== 'ed25519' || !sig.val || !sig.pub) return false;
+  try { return crypto.verify(null, Buffer.from(hash), normPem(sig.pub), Buffer.from(sig.val, 'base64')); }
+  catch { return false; }
+}

package/src/skill.mjs

@@ -0,0 +1,108 @@
+// Resolve a skill SOURCE (a path) into a canonical, hashable representation.
+// Three shapes a vetted thing comes in:
+//   - an MCP manifest  (.json with a `tools` array)  → identity = the tool set
+//   - a skill directory (SKILL.md + files)           → identity = a manifest of per-file hashes
+//   - a single file     (e.g. a SKILL.md)            → identity = its bytes
+// `hashInput` is what we hash (the identity); `scanTargets` is what we poison-scan.
+import fs from 'node:fs';
+import path from 'node:path';
+import { sha256, canonicalJson } from './hash.mjs';
+
+// Scan everything that ISN'T known-binary, rather than an allowlist of "text"
+// extensions — a poisoned prompt hides just as well in a `.bin`/`.dat`/`.mdx`
+// file, a Dockerfile, a Makefile, or an extension-less script. Executable code
+// formats (wasm/so/dll/exe/…) are NOT on this skip-list: they're loaded+run, can
+// carry readable injection/exfil strings, and an attacker will pick exactly the
+// extension the scanner ignores — so we scan their text (best-effort) too.
+const BINARY_EXT = /\.(png|jpe?g|gif|webp|ico|bmp|tiff?|pdf|zip|gz|tgz|bz2|xz|7z|rar|woff2?|ttf|otf|eot|mp[34]|wav|ogg|webm|mov|avi|mkv|flac)$/i;
+
+// Decode a file to text for SCANNING (not hashing — hashing always uses raw
+// bytes). Handles UTF-16 LE/BE by BOM, so an injection encoded as UTF-16 in a
+// .md/.txt can't slip past a naive utf8 read (which would mangle it to U+FFFD).
+function decodeForScan(buf) {
+  // swap16() needs an even-length buffer AND mutates in place — so copy + trim to
+  // even first. And never let a decode edge case throw: a scanner that crashes on
+  // a crafted file is itself a bypass (the scan is skipped / errors out).
+  const swap16 = (b) => Buffer.from(b.length % 2 ? b.subarray(0, b.length - 1) : b).swap16();
+  try {
+    if (buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) return buf.toString('utf16le');
+    if (buf.length >= 2 && buf[0] === 0xfe && buf[1] === 0xff) return swap16(buf).toString('utf16le');
+    // Heuristic: lots of NUL bytes among ASCII ⇒ likely UTF-16 without a BOM.
+    let nul = 0; const cap = Math.min(buf.length, 4096);
+    for (let i = 0; i < cap; i++) if (buf[i] === 0) nul++;
+    if (cap > 0 && nul / cap > 0.2) {
+      const le = (buf.length >= 2 && buf[1] === 0) ? buf : swap16(buf);
+      return le.toString('utf16le');
+    }
+    return buf.toString('utf8');
+  } catch { return buf.toString('latin1'); } // byte-preserving best-effort; never throw
+}
+// node_modules is bundled runtime code that actually loads — it must be hashed
+// AND scanned; only VCS/canon metadata is outside the trust boundary.
+const SKIP_DIR = /(^|[\\/])(\.git|\.canon)([\\/]|$)/;
+
+function walk(dir, out = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, e.name);
+    if (SKIP_DIR.test(full)) continue;
+    if (e.isDirectory()) walk(full, out);
+    else if (e.isFile()) out.push(full);
+  }
+  return out;
+}
+
+function loadSkillDir(source) {
+  const files = walk(source).sort();
+  const entries = files.map((f) => ({
+    path: path.relative(source, f).replace(/\\/g, '/'),
+    hash: sha256(fs.readFileSync(f)),
+  }));
+  // scan every non-binary file — that's where poisoned prompts hide, and an
+  // attacker will pick whatever extension the scanner ignores
+  const scanText = files
+    .filter((f) => !BINARY_EXT.test(f))
+    .map((f) => decodeForScan(fs.readFileSync(f)))
+    .join('\n');
+  return {
+    source, kind: 'skill', name: path.basename(source.replace(/[\\/]$/, '')),
+    files: entries, hashInput: canonicalJson(entries),
+    scanTargets: [{ name: path.basename(source), description: scanText }],
+  };
+}
+
+export function loadSkill(source) {
+  // Read first and branch on the error, rather than stat()-then-read(): a separate
+  // existence/stat check re-resolves the path, leaving a TOCTOU window in which the
+  // source could be swapped (e.g. a symlink) between the check and the read. A
+  // directory surfaces as EISDIR; a missing source as ENOENT.
+  let raw;
+  try { raw = fs.readFileSync(source, 'utf8'); }
+  catch (e) {
+    if (e && e.code === 'EISDIR') return loadSkillDir(source);
+    if (e && e.code === 'ENOENT') throw new Error(`no such skill source: ${source}`);
+    throw e;
+  }
+
+  if (/\.json$/i.test(source)) {
+    let j = null;
+    try { j = JSON.parse(raw); } catch {}
+    const tools = j?.tools ?? (Array.isArray(j) ? j : null);
+    if (tools && Array.isArray(tools)) {
+      const manifestEnvelope = { ...j }; delete manifestEnvelope.tools;  // top-level fields: name/instructions/command/args/env/url/etc.
+      return {
+        source, kind: 'mcp', name: j?.name ?? path.basename(source),
+        tools, manifestEnvelope,
+        launch: { command: j?.command, args: j?.args, env: j?.env, url: j?.url },
+        hashInput: canonicalJson(j),                          // whole manifest → renamed server / swapped command/env drifts
+        scanTargets: [...tools, { name: (j?.name ?? 'manifest') + ' (manifest)', description: canonicalJson(manifestEnvelope) }],
+      };
+    }
+  }
+  return {
+    source, kind: 'file', name: path.basename(source),
+    hashInput: raw, scanTargets: [{ name: path.basename(source), description: raw }],
+  };
+}
+
+/** The content hash that pins a skill's identity. */
+export const skillHash = (skill) => sha256(skill.hashInput);

package/src/trust.mjs

@@ -0,0 +1,75 @@
+// The trust set — WHOSE signatures canon accepts. A signed lock entry only counts
+// as vetted-by-a-publisher if its signing key is in this set. Three sources, unioned:
+//   - your machine's own key (implicit, named `self`)  → local `--sign` just works
+//   - a repo-committed `canon.trust`                   → travels with the repo, so a
+//                                                         signed lock verifies in CI
+//   - a user-global `~/.canon/trust.json`              → keys you trust everywhere
+// `canon.trust` is the one that matters for sharing: commit it and a teammate's /
+// CI's `canon verify` knows which publisher key to expect.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { loadKey, keyId } from './sign.mjs';
+
+export const DEFAULT_REPO_TRUST = 'canon.trust';
+const homeStore = () => path.join(process.env.CANON_HOME || os.homedir(), '.canon', 'trust.json');
+
+function readStore(file) {
+  try { const j = JSON.parse(fs.readFileSync(file, 'utf8')); return Array.isArray(j?.keys) ? j.keys : []; }
+  catch { return []; }
+}
+function writeStore(file, keys, repo) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  // global store is private (it's your trust decisions); a repo canon.trust is meant
+  // to be committed, so don't lock it down to 0600.
+  fs.writeFileSync(file, JSON.stringify({ version: 1, keys }, null, 2) + '\n', repo ? undefined : { mode: 0o600 });
+}
+
+/** Build the active trust set as a Map: keyId → { id, name, publicKey }.
+ *  Always includes your own key as `self`, so a locally-signed lock verifies with
+ *  no extra trust step. */
+export function loadTrust({ trustPath, cwd = process.cwd() } = {}) {
+  const map = new Map();
+  const add = (k) => {
+    if (!k || !k.publicKey) return;
+    const id = keyId(k.publicKey);
+    if (!map.has(id)) map.set(id, { id, name: k.name || id.slice(0, 12), publicKey: k.publicKey });
+  };
+  const self = loadKey(); if (self) add({ name: 'self', publicKey: self.publicKey });
+  for (const k of readStore(homeStore())) add(k);
+  for (const k of readStore(trustPath || path.join(cwd, DEFAULT_REPO_TRUST))) add(k);
+  return map;
+}
+
+/** Name of the trusted signer for a public key, or null if its key isn't trusted. */
+export function trustedSigner(publicKey, trust) {
+  if (!publicKey) return null;
+  const entry = trust.get(keyId(publicKey));
+  return entry ? entry.name : null;
+}
+
+/** Add a publisher public key to the trust set (global by default, or repo canon.trust). */
+export function trustKey(publicKey, name, { repo = false, cwd = process.cwd() } = {}) {
+  const file = repo ? path.join(cwd, DEFAULT_REPO_TRUST) : homeStore();
+  const id = keyId(publicKey);
+  if (!id) throw new Error('not a public key');
+  const entry = { id, name: name || id.slice(0, 12), publicKey: String(publicKey).replace(/\r\n/g, '\n').trim() };
+  const keys = readStore(file).filter((k) => keyId(k.publicKey) !== id);
+  keys.push(entry);
+  writeStore(file, keys, repo);
+  return entry;
+}
+
+/** Remove a trusted key by exact id or id-prefix (global store). → count removed. */
+export function untrustKey(idOrPrefix, { cwd = process.cwd() } = {}) {
+  const file = homeStore();
+  const keys = readStore(file);
+  const kept = keys.filter((k) => !(k.id === idOrPrefix || (k.id || keyId(k.publicKey)).startsWith(idOrPrefix)));
+  if (kept.length !== keys.length) writeStore(file, kept, false);
+  return keys.length - kept.length;
+}
+
+/** The flattened trust set (incl. implicit `self`), for display. */
+export function listTrust(opts) {
+  return [...loadTrust(opts).values()];
+}

package/index.js

@@ -1 +0,0 @@
-module.exports = 'name reservation — real release imminent';