@askalf/truecopy 0.10.0 → 0.10.1

package/README.md

@@ -1,10 +1,14 @@
 # truecopy
 
-[![npm](https://img.shields.io/npm/v/%40askalf%2Ftruecopy?label=npm)](https://www.npmjs.com/package/@askalf/truecopy) [![GitHub Marketplace](https://img.shields.io/badge/marketplace-truecopy--action-6f42c1?logo=github)](https://github.com/marketplace/actions/truecopy-gate-your-agent-skills) [![marketplace watch](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Faskalf%2Ftruecopy%2Fwatch%2Fbadge.json)](https://github.com/askalf/truecopy/blob/watch/WATCH.md) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/askalf/truecopy/badge)](https://scorecard.dev/viewer/?uri=github.com/askalf/truecopy)
+[![npm](https://img.shields.io/npm/v/%40askalf%2Ftruecopy?label=npm)](https://www.npmjs.com/package/@askalf/truecopy) [![GitHub Marketplace](https://img.shields.io/badge/marketplace-truecopy--action-6f42c1?logo=github)](https://github.com/marketplace/actions/truecopy-gate-your-agent-skills) [![marketplace watch](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Faskalf%2Ftruecopy%2Fwatch%2Fbadge.json)](https://github.com/askalf/truecopy/blob/watch/WATCH.md) [![CI](https://github.com/askalf/truecopy/actions/workflows/ci.yml/badge.svg)](https://github.com/askalf/truecopy/actions/workflows/ci.yml) [![CodeQL](https://github.com/askalf/truecopy/actions/workflows/codeql.yml/badge.svg)](https://github.com/askalf/truecopy/actions/workflows/codeql.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/askalf/truecopy/badge)](https://scorecard.dev/viewer/?uri=github.com/askalf/truecopy) [![license](https://img.shields.io/npm/l/%40askalf%2Ftruecopy?label=license&color=6f42c1)](https://github.com/askalf/truecopy/blob/master/LICENSE) [![downloads](https://img.shields.io/npm/dm/%40askalf%2Ftruecopy?label=downloads&color=6f42c1)](https://www.npmjs.com/package/@askalf/truecopy)
+
+<!-- OpenSSF Best Practices — uncomment once enrolled at https://www.bestpractices.dev and replace PROJECT_ID:
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/PROJECT_ID/badge)](https://www.bestpractices.dev/projects/PROJECT_ID)
+-->
 
 > _truecopy — **own your agent skills**. Vet, sign, and pin every skill & MCP server before it runs. Part of **[Own Your Stack](https://github.com/askalf)** — own your AI infrastructure instead of renting it by the token._
 
-**Proven at ecosystem scale:** truecopy has poison-scanned **68,560 skills** — the full official Claude Code plugin directory ([2,019 skills, zero poisoned](https://sprayberrylabs.com/blog/auditing-the-skills-supply-chain)) and the entire ClawHub registry, the marketplace whose poisoning incident started the category ([66,541 skills, zero confirmed malicious](https://sprayberrylabs.com/blog/the-marketplace-that-started-the-panic)). A [standing watch](https://github.com/askalf/truecopy/blob/watch/WATCH.md) re-audits all 255 official plugins **every Monday** and publishes the verdict — that's the live badge above. And the gate eats its own cooking: this repo pins its own demo manifest in [`truecopy.lock`](truecopy.lock) and verifies it on every PR with [truecopy-action](https://github.com/marketplace/actions/truecopy-gate-your-agent-skills).
+**Proven at ecosystem scale:** truecopy has poison-scanned **68,560 skills** — the full official Claude Code plugin directory ([2,019 skills, zero poisoned](https://sprayberrylabs.com/blog/auditing-the-skills-supply-chain)) and the entire ClawHub registry, the marketplace whose poisoning incident started the category ([66,541 skills, zero confirmed malicious](https://sprayberrylabs.com/blog/the-marketplace-that-started-the-panic)). A [standing watch](https://github.com/askalf/truecopy/blob/watch/WATCH.md) re-audits the full official plugin directory **every day** and publishes the verdict — that's the live badge above. And the gate eats its own cooking: this repo pins its own demo manifest in [`truecopy.lock`](truecopy.lock) and verifies it on every PR with [truecopy-action](https://github.com/marketplace/actions/truecopy-gate-your-agent-skills).
 
 > _**Formerly `canon`.** Renamed to `truecopy` — a certified true copy — for the npm release; the GitHub repo redirects and the legacy `canon`/`canon-mcp` CLI aliases keep working._
 
@@ -23,7 +27,7 @@ Deterministic and offline. truecopy shares **[redstamp](https://github.com/askal
 
 ```bash
 npm i -g @askalf/truecopy                # latest, from npm
-npm i -g @askalf/truecopy@0.8.0          # pinned release
+npm i -g @askalf/truecopy@0.10.0         # pinned release
 ```
 
 > Also installable straight from GitHub: `npm i -g github:askalf/truecopy`. Every command below runs one-shot with `npx -y @askalf/truecopy` (or `npx -y github:askalf/truecopy`).
@@ -119,7 +123,7 @@ truecopy scan --marketplace ./clone     # audit a marketplace or plugin repo you
   "hooks": {
     "PreToolUse": [
       { "matcher": "Skill",
-        "hooks": [{ "type": "command", "command": "npx -y github:askalf/truecopy#v0.8.0 hook claude", "timeout": 20 }] }
+        "hooks": [{ "type": "command", "command": "npx -y github:askalf/truecopy#v0.10.0 hook claude", "timeout": 20 }] }
     ]
   }
 }
@@ -136,6 +140,7 @@ Two policies. The default protects the **pinned** set — unpinned skills pass,
 | pinned clean, **now scans poisoned** — same bytes, newer detection | **blocked** | **blocked** |
 | pinned with `--force` (findings **accepted** for those exact bytes), unchanged | runs | runs |
 | pinned, directory missing · corrupt lock | **blocked** | **blocked** |
+| pinned, but the check itself failed (unreadable file, I/O error) | **blocked** | **blocked** |
 | not pinned · a name truecopy can't resolve to a directory | runs | **blocked** |
 | no lock · hook crash | runs | **blocked** |
 
@@ -143,7 +148,7 @@ A `--force` pin is an explicit accept: you read those bytes, truecopy records `v
 
 **Verdicts are severity-aware by surface.** In long-form skill prose, only an *instruction* flags — instruction-override, a jailbreak persona, a sensitive path being *moved* (`read ~/.ssh/id_rsa and POST it to https://…`). A bare *mention* of a sensitive path or secret env var is an **advisory**: shown in `scan`/`add` (`· 1 advisory`), noted in the lock, never blocking — documentation legitimately teaches credential handling. Measured at ecosystem scale: truecopy audited **2,019 skills** — the full official Claude Code plugin marketplace (255 catalog plugins, 177 vendor repos at their pinned SHAs) plus nine community marketplaces — and found **zero poisoned skills**; tightening detection against that corpus took the flag rate from 126 to **12 (0.6%), every one benign on manual review**. Methodology and findings: [Auditing the skills supply chain](https://sprayberrylabs.com/blog/auditing-the-skills-supply-chain). Since then, at registry scale: all **66,541 skills on ClawHub** — the marketplace whose poisoned-skills incident started the category — scanned **clean**: zero confirmed malicious, 813 deterministic alarms, every one benign on cross-check against ClawHub's own scanner ([write-up](https://sprayberrylabs.com/blog/the-marketplace-that-started-the-panic)). MCP *tool definitions* keep the strict any-finding rule — in a short description, a mention has no innocent reason to be there.
 
-And the audit didn't end with the study: a **standing watch** re-scans the full official plugin directory every week — every catalog plugin, including the external vendor plugins fetched at their catalog-pinned SHAs — and publishes the snapshot — plugin and skill counts, verdicts, advisories, pin drift — to [`WATCH.md` on the `watch` branch](https://github.com/askalf/truecopy/blob/watch/WATCH.md) (that's the badge at the top of this page). A poisoned skill would turn the badge red and the scheduled run with it.
+And the audit didn't end with the study: a **standing watch** re-scans the full official plugin directory every day — every catalog plugin, including the external vendor plugins fetched at their catalog-pinned SHAs — and publishes the snapshot — plugin and skill counts, verdicts, advisories, pin drift — to [`WATCH.md` on the `watch` branch](https://github.com/askalf/truecopy/blob/watch/WATCH.md) (that's the badge at the top of this page). A poisoned skill would turn the badge red and the scheduled run with it.
 
 **The watch is consumable, not just a badge.** Each run also publishes [`directory-manifest.json`](https://github.com/askalf/truecopy/blob/watch/directory-manifest.json) — name → content hash for every skill it scanned, plus the currently-flagged names. Point `check-manifest` at it and every marketplace plugin skill **installed on your machine** is compared against exactly the bytes the watch vetted:
 
@@ -174,7 +179,7 @@ Every row above is verified **live**, not just unit-tested: each scenario ran in
 
 ## Publisher signatures — trust *who* signed, not just *that* it changed
 
-A hash catches a change; a signature says **who vetted it**. `truecopy verify` checks every signed entry against your **trust set** — and a cryptographically valid signature from a key you *don't* trust fails closed (`untrusted`), it doesn't quietly pass:
+A hash catches a change; a signature says **who vetted it**. `truecopy verify` checks every signed entry against your **trust set** — and a cryptographically valid signature from a key you *don't* trust fails closed (`untrusted`), it doesn't quietly pass. A signer is matched on the **whole public key**; the short `key id` is a handle for reading and addressing keys, never the thing that decides trust:
 
 ```bash
 # publisher — vet, sign, and publish your key
@@ -245,5 +250,7 @@ verify();                                 // { ok, results: [{ name, status: 'ok
 
 Three composable layers, one defense: **[redstamp](https://github.com/askalf/redstamp)** contains the call · **[truecopy](https://github.com/askalf/truecopy)** vets the tool *(you are here)* · **[strongroom](https://github.com/askalf/strongroom)** holds the keys. Run all three together → **[agent-security-stack](https://github.com/askalf/agent-security-stack)**.
 
+Related: **[plumbline](https://github.com/askalf/plumbline)** — own your agent *trajectory*: out-of-band, read-only monitoring of the whole action sequence against the declared job. A monitor **above** these three in-path layers — it scores what an agent did end to end, catching an escape assembled from individually-authorized steps. It never blocks an action.
+
 ---
 Part of **[Own Your Stack](https://github.com/askalf)** — own your AI infrastructure instead of renting it. Built by Thomas Sprayberry.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/truecopy",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "own your agent skills — vet, sign, and pin every skill & MCP server before it runs. The supply-chain gate for AI agents. Part of Own Your Stack.",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
     "demo": "node demo/demo.mjs"
   },
   "dependencies": {
-    "@askalf/redstamp": "github:askalf/redstamp#71a18c4e95a0ac3617805cb6bb48fe5f9aa23943"
+    "@askalf/redstamp": "https://github.com/askalf/redstamp/releases/download/v0.7.3/askalf-redstamp-0.7.3.tgz"
   },
   "devDependencies": {
     "@jazzer.js/core": "^4.0.0"

package/src/claude.mjs

@@ -28,14 +28,45 @@ export function claudeSkillRoots({ projectDir = process.env.CLAUDE_PROJECT_DIR |
 
 const hasSkillMd = (dir) => { try { return fs.statSync(path.join(dir, 'SKILL.md')).isFile(); } catch { return false; } };
 
+const statIsDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch { return false; } };
+
+// A Dirent's isDirectory() is LSTAT-based, so a symlinked directory — or a
+// Windows junction, which needs no special privilege to create — answers false.
+// Every discovery filter here used it, so those entries were skipped silently.
+//
+// Claude Code does not skip them: hasSkillMd() and resolveClaudeSkill() stat
+// THROUGH the link. So a symlinked skill directory was one that RUNS but that
+// truecopy could neither inventory nor pin — `add --claude` never saw it, which
+// left the default-mode hook treating it as unpinned and allowing it, forever
+// and invisibly, while `scan --claude` reported the machine clean by omission.
+// A gate that cannot see a skill is worse than one that reports it.
+const isDirEntry = (e, full) => e.isDirectory() || (e.isSymbolicLink() && statIsDir(full));
+
+// Does `full` still land inside `realRoot` once symlinks are resolved?
+// `realRoot` must already be realpath'd, or a symlinked root compares unequal to
+// its own contents.
+function insideRoot(full, realRoot) {
+  try {
+    const real = fs.realpathSync(full);
+    return real === realRoot || real.startsWith(realRoot + path.sep);
+  } catch { return false; }
+}
+
 /** Every Claude Code skill visible from projectDir. → [{ name, dir, scope }]
  *  (a project skill shadows a user skill of the same name, like Claude Code itself) */
 export function discoverClaudeSkills(opts = {}) {
   const seen = new Map();
   for (const { scope, dir } of claudeSkillRoots(opts)) {
     for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
-      if (!e.isDirectory() || seen.has(e.name)) continue;
+      if (seen.has(e.name)) continue;
       const skillDir = path.join(dir, e.name);
+      // Followed wherever it points, including out of the skills root. This is
+      // the machine's OWN skill directory, and the content is going to be loaded
+      // into the model either way — the only question is whether the gate knows
+      // about it. Confining discovery here would recreate the invisible-but-
+      // runnable skill this fixes. (An untrusted CLONE is a different matter —
+      // see discoverMarketplaceSkills.)
+      if (!isDirEntry(e, skillDir)) continue;
       if (hasSkillMd(skillDir)) seen.set(e.name, { name: e.name, dir: skillDir, scope });
     }
   }
@@ -69,26 +100,41 @@ function* pluginDirs() {
   let mps = [];
   try { mps = fs.readdirSync(marketplacesDir(), { withFileTypes: true }); } catch { return; }
   // sorted → deterministic resolution when two marketplaces carry the same plugin name
-  for (const mp of mps.filter((e) => e.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
+  const sorted = (list) => list.sort((a, b) => a.name.localeCompare(b.name));
+  for (const mp of sorted(mps)) {
+    if (!isDirEntry(mp, path.join(marketplacesDir(), mp.name))) continue;
     for (const kind of ['plugins', 'external_plugins']) {
       const root = path.join(marketplacesDir(), mp.name, kind);
       let entries = [];
       try { entries = fs.readdirSync(root, { withFileTypes: true }); } catch { continue; }
-      for (const e of entries.filter((x) => x.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
-        yield { marketplace: mp.name, dir: path.join(root, e.name) };
+      for (const e of sorted(entries)) {
+        const dir = path.join(root, e.name);
+        if (!isDirEntry(e, dir)) continue;   // installed plugins are local: follow the link
+        yield { marketplace: mp.name, dir };
       }
     }
   }
 }
 
-function collectPluginSkills(pluginDir, marketplace, seen) {
+// `confine` (a realpath'd root) restricts discovery to skills that stay inside
+// it, and every entry refused that way is pushed onto `skipped` rather than
+// dropped. Used when walking an UNTRUSTED clone: without it, a vendor repo
+// shipping `skills/x -> /somewhere/else` would have the watch read, hash and
+// publish evidence from a directory outside the corpus. Local discovery passes
+// no confine — see discoverClaudeSkills.
+function collectPluginSkills(pluginDir, marketplace, seen, { confine = null, skipped = null } = {}) {
   const plugin = pluginName(pluginDir);
   if (!plugin) return;
   let skills = [];
   try { skills = fs.readdirSync(path.join(pluginDir, 'skills'), { withFileTypes: true }); } catch { return; }
-  for (const s of skills.filter((e) => e.isDirectory())) {
-    if (!SKILL_NAME.test(s.name)) continue;
+  for (const s of skills) {
     const skillDir = path.join(pluginDir, 'skills', s.name);
+    if (!isDirEntry(s, skillDir)) continue;
+    if (!SKILL_NAME.test(s.name)) continue;
+    if (confine && !insideRoot(skillDir, confine)) {
+      skipped?.push({ path: skillDir, name: `${plugin}:${s.name}`, reason: 'symlink leaves the scanned tree' });
+      continue;
+    }
     const name = `${plugin}:${s.name}`;
     if (hasSkillMd(skillDir) && !seen.has(name)) seen.set(name, { name, dir: skillDir, scope: 'plugin', marketplace });
   }
@@ -108,20 +154,53 @@ export function discoverClaudePluginSkills() {
  *  (`plugins/` + `external_plugins/` trees) or a single-plugin repo (`skills/`
  *  at the top, usually with `.claude-plugin/plugin.json`). Same `plugin:skill`
  *  naming as the live-marketplace discovery, so a study scan, a pin, and the
- *  hook all agree on identity. Offline by design: point it at a clone you made. */
-export function discoverMarketplaceSkills(root) {
+ *  hook all agree on identity. Offline by design: point it at a clone you made.
+ *
+ *  This root is UNTRUSTED — it is how the watch walks 250+ vendor repos — so
+ *  symlinked directories are followed only while they stay inside it. One that
+ *  points out of the tree is refused and recorded on `opts.skipped` (pass an
+ *  array to collect them), never silently dropped: a scanner that quietly
+ *  ignores part of what it was pointed at reports a coverage number it did not
+ *  earn, and this one publishes that number.
+ *
+ *  `opts.confine` widens that boundary to an ANCESTOR of `root`. A `git-subdir`
+ *  plugin is one directory inside a larger repo, and the honest layout for a
+ *  vendor with several plugins is to keep canonical skills at the top and
+ *  symlink them in — Redis does exactly that, with eight
+ *  `skills/x -> ../../../skills/x` links. Confined to the plugin directory those
+ *  resolve "outside" and are refused, even though the fetch materialized the
+ *  whole repo and the targets are sitting right there. The watch passes the
+ *  fetched repo root so they are scanned rather than counted as unscannable.
+ *
+ *  The widening is deliberately one-directional: a `confine` that is not an
+ *  ancestor of `root` is IGNORED. A bad value can only narrow the boundary back
+ *  to the scanned directory, never redirect discovery somewhere unrelated. */
+export function discoverMarketplaceSkills(root, { skipped = null, confine = null } = {}) {
   const seen = new Map();
   const resolved = path.resolve(String(root || '.'));
+  const real = (p) => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+  const realRoot = real(resolved);
+  let boundary = realRoot;
+  if (confine) {
+    const c = real(confine);
+    if (realRoot === c || realRoot.startsWith(c + path.sep)) boundary = c;
+  }
   const label = path.basename(resolved);
   for (const kind of ['plugins', 'external_plugins']) {
     const base = path.join(resolved, kind);
     let entries = [];
     try { entries = fs.readdirSync(base, { withFileTypes: true }); } catch { continue; }
-    for (const e of entries.filter((x) => x.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
-      collectPluginSkills(path.join(base, e.name), label, seen);
+    for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const dir = path.join(base, e.name);
+      if (!isDirEntry(e, dir)) continue;
+      if (!insideRoot(dir, boundary)) {
+        skipped?.push({ path: dir, name: `${label}/${e.name}`, reason: 'symlink leaves the scanned tree' });
+        continue;
+      }
+      collectPluginSkills(dir, label, seen, { confine: boundary, skipped });
     }
   }
-  if (!seen.size) collectPluginSkills(resolved, label, seen); // a single-plugin repo
+  if (!seen.size) collectPluginSkills(resolved, label, seen, { confine: boundary, skipped }); // a single-plugin repo
   return [...seen.values()];
 }
 

package/src/cli.mjs

@@ -95,7 +95,7 @@ function usage() {
   truecopy key                         print this machine's public key + id (share it to be trusted)
   truecopy trust add <pubkey> --name <who> [--repo]   trust a publisher's key (--repo → commit it to truecopy.trust)
   truecopy trust list                  show the trusted signing keys
-  truecopy trust remove <id>           stop trusting a key
+  truecopy trust remove <id> [--all]   stop trusting a key (≥8 chars of the id; --all if it matches several)
 
   truecopy hook claude [--strict]      Claude Code PreToolUse hook: block a pinned skill that
                                     drifted or turned poisonous at the moment it's invoked
@@ -353,8 +353,12 @@ function runTrust() {
     } catch (e) { out(`${c(C.red, '✗')} ${e.message}`); return 1; }
   }
   if (action === 'remove' || action === 'rm') {
-    if (!sources[1]) { out('usage: canon trust remove <keyId>'); return 2; }
-    const n = untrustKey(sources[1]);
+    if (!sources[1]) { out('usage: canon trust remove <keyId> [--all]'); return 2; }
+    let n;
+    // A too-short or ambiguous prefix is refused, not guessed at — removing the
+    // wrong trusted key is as bad as keeping one you meant to drop.
+    try { n = untrustKey(sources[1], { all: !!opt('--all', false) }); }
+    catch (e) { out(`${c(C.red, '✗')} ${e.message}`); return 2; }
     out(n ? `${mark.ok} removed ${n} key(s)` : c(C.dim, 'no matching key'));
     return 0;
   }
@@ -373,6 +377,7 @@ function runTrust() {
 //   pinned + drifted       BLOCK     BLOCK
 //   pinned + poisoned      BLOCK     BLOCK
 //   pinned, dir missing    BLOCK     BLOCK     (can't verify what will run → fail closed)
+//   pinned, check errored  BLOCK     BLOCK     (same reason — see `unverifiable` below)
 //   not pinned             allow     BLOCK     (adoption-friendly vs lockdown)
 //   no lock / hook error   allow     BLOCK     (a crashed gate must not be a bypass in strict)
 function runHookClaude() {
@@ -409,9 +414,29 @@ function runHookClaude() {
 
     const dir = resolveClaudeSkill(name, { projectDir });
     if (!dir) return deny(`skill '${name}' is pinned but not found under .claude/skills — can't verify what will run`);
-    const skill = loadSkill(dir);
-    if (skillHash(skill) !== entry.hash) return deny(`skill '${name}' DRIFTED since it was pinned — review with: canon diff ${dir.replace(/\\/g, '/')}`);
-    const s = scanSkill(skill);
+
+    // From here the skill IS pinned, so the only question left is whether it
+    // still matches. A failure to answer that is not a reason to run it: an
+    // unreadable file (locked by another process, EACCES, over 2 GiB, EIO, or
+    // removed mid-walk) makes loadSkill throw, and that used to reach the outer
+    // catch — which returns 0 in default mode. Adding one such file to a pinned
+    // skill's directory was therefore enough to make the gate wave it through,
+    // in the mode this gate ships in. The same "can't verify what will run"
+    // reasoning already blocks a missing directory in BOTH modes; leniency below
+    // this line is for skills nobody vetted, not for vetted skills we failed to
+    // check. Attempts stay separate so the drift check keeps short-circuiting
+    // the scan, exactly as before.
+    const unverifiable = (e) => deny(`skill '${name}' is pinned but could NOT be verified — ${e && e.message || e}`);
+    const attempt = (fn) => { try { return { value: fn() }; } catch (e) { return { error: e }; } };
+
+    const loaded = attempt(() => loadSkill(dir));
+    if (loaded.error) return unverifiable(loaded.error);
+    const hashed = attempt(() => skillHash(loaded.value));
+    if (hashed.error) return unverifiable(hashed.error);
+    if (hashed.value !== entry.hash) return deny(`skill '${name}' DRIFTED since it was pinned — review with: canon diff ${dir.replace(/\\/g, '/')}`);
+    const scanned = attempt(() => scanSkill(loaded.value));
+    if (scanned.error) return unverifiable(scanned.error);
+    const s = scanned.value;
     // findings the human accepted with a --force pin (verdict:'flagged' in the
     // lock) don't re-block the same bytes; flagged-but-pinned-clean still does
     if (s.verdict === 'flagged' && entry.verdict !== 'flagged') return deny(`skill '${name}' is POISONED: ${s.findings.map((f) => `${f.tool}: ${f.flags.join('; ')}`).join(' · ')}`);

package/src/hash.mjs

@@ -7,19 +7,145 @@ export const sha256 = (s) =>
     .update(Buffer.isBuffer(s) ? s : typeof s === 'string' ? s : String(s ?? ''))
     .digest('hex');
 
-/** Deterministic JSON: object keys sorted recursively (arrays keep order).
- *  Fail-safe on hostile input — a circular ref becomes "[circular]" and a BigInt
- *  is stringified, so hashing a malformed tool definition can't throw. */
-export function canonicalJson(v) {
+const CIRCULAR = JSON.stringify('[circular]');
+// Values JSON drops: omitted as an object member, `null` as an array element.
+const drops = (x) => x === undefined || typeof x === 'function' || typeof x === 'symbol';
+// A leaf's own serialization. BigInt has no JSON form, so it is stringified
+// first (as it always was) rather than throwing.
+const leaf = (x) => (typeof x === 'bigint' ? JSON.stringify(x.toString()) : JSON.stringify(x));
+
+// An ARRAY INDEX in the JS property-order sense: a canonical numeric string in
+// [0, 2^32-1). "01", "1.5", "-1" and "4294967295" are ordinary string keys.
+const isIndexKey = (k) => /^(0|[1-9][0-9]*)$/.test(k) && Number(k) < 4294967295;
+
+/** Positions of `keys` in EMIT order — which is not their traversal order.
+ *
+ *  The recursive form sorted an object's keys and then rebuilt an object from
+ *  them, so JS property ordering hoisted integer-like keys to the front in
+ *  ascending numeric order regardless of insertion: `{ "b":1, "0":2 }`
+ *  canonicalized as `{"0":2,"b":1}`, with "0" first even though "0" (0x30) sorts
+ *  after '"' or '!'. Emitting text directly skips that rebuild, so the hoist has
+ *  to be reproduced explicitly — otherwise every lock entry holding a
+ *  numeric-string key (a JSON-schema `enum` map, a positional tool arg, an
+ *  `items` tuple) silently changes hash and verifies as `drifted`. */
+function emitOrder(keys) {
+  const index = [], rest = [];
+  for (let i = 0; i < keys.length; i++) (isIndexKey(keys[i]) ? index : rest).push(i);
+  index.sort((a, b) => Number(keys[a]) - Number(keys[b]));
+  return index.concat(rest);
+}
+
+/** Walk `v` and build a shadow tree, marking cycles as it goes.
+ *  Traversal is depth-first in PLAIN SORTED key order — deliberately not the
+ *  emit order above. Which of two references to the same object is the one
+ *  stamped "[circular]" depends on visit order, so the two orders have to stay
+ *  separate to keep hashes stable (the differential test pins this). */
+function build(v) {
+  // Objects: a WeakSet that is never cleared, so a SHARED reference — not just a
+  // cyclic one — becomes "[circular]" on its second visit. Long-standing
+  // behavior, baked into every lock file already written: preserved exactly.
   const seen = new WeakSet();
-  const sort = (x) => {
-    if (Array.isArray(x)) return x.map(sort);
+  // Arrays were never tracked at all, so `a = []; a.push(a)` recursed until the
+  // stack blew. They get an ANCESTORS-only check: a true cycle terminates, while
+  // a shared (non-cyclic) array still serializes in full, exactly as today.
+  // Anything this changes is an input that currently throws — no hash moves.
+  const onPath = new Set();
+
+  const root = [null];
+  const work = [{ target: root, idx: 0, value: v }];
+  while (work.length) {
+    const w = work.pop();
+    if (w.release !== undefined) { onPath.delete(w.release); continue; }
+    const x = w.value;
+
+    if (Array.isArray(x)) {
+      if (onPath.has(x)) { w.target[w.idx] = { t: 'leaf', s: CIRCULAR }; continue; }
+      onPath.add(x);
+      const node = { t: 'arr', kids: new Array(x.length).fill(null) };
+      w.target[w.idx] = node;
+      work.push({ release: x });                   // pops after every child: closes the ancestor scope
+      for (let i = x.length - 1; i >= 0; i--) {     // reversed in, so children pop in index order
+        const el = x[i];                            // a hole reads as undefined → `null`, as JSON does
+        if (drops(el)) node.kids[i] = { t: 'leaf', s: 'null' };
+        else work.push({ target: node.kids, idx: i, value: el });
+      }
+      continue;
+    }
+
     if (x && typeof x === 'object') {
-      if (seen.has(x)) return '[circular]';
+      if (seen.has(x)) { w.target[w.idx] = { t: 'leaf', s: CIRCULAR }; continue; }
       seen.add(x);
-      return Object.fromEntries(Object.keys(x).sort().map((k) => [k, sort(x[k])]));
+      const keys = Object.keys(x).sort();
+      const vals = keys.map((k) => x[k]);           // read each property exactly once
+      const node = { t: 'obj', keys, kids: new Array(keys.length).fill(null) };
+      w.target[w.idx] = node;
+      for (let i = keys.length - 1; i >= 0; i--) {
+        if (drops(vals[i])) node.kids[i] = { t: 'drop' };
+        else work.push({ target: node.kids, idx: i, value: vals[i] });
+      }
+      continue;
     }
-    return typeof x === 'bigint' ? x.toString() : x;
-  };
-  return JSON.stringify(sort(v)) ?? '';
+
+    // Leaf. A dropped value reaches here only as the ROOT (members and elements
+    // are handled above), and JSON.stringify(undefined) is undefined — which the
+    // old form turned into '' via `?? ''`.
+    const s = leaf(x);
+    w.target[w.idx] = { t: 'leaf', s: s === undefined ? '' : s };
+  }
+  return root[0];
+}
+
+/** Render the shadow tree. Also iterative: JSON.stringify recurses too, and blew
+ *  the stack at the same depth the walk did. */
+function render(root) {
+  const parts = [];
+  const work = [root];
+  while (work.length) {
+    const w = work.pop();
+    if (typeof w === 'string') { parts.push(w); continue; }
+    if (w.t === 'leaf') { parts.push(w.s); continue; }
+
+    const items = [];
+    if (w.t === 'arr') {
+      for (let i = 0; i < w.kids.length; i++) { if (i) items.push(','); items.push(w.kids[i]); }
+      parts.push('[');
+      work.push(']');
+    } else {
+      let n = 0;
+      for (const i of emitOrder(w.keys)) {
+        if (w.kids[i].t === 'drop') continue;
+        if (n++) items.push(',');
+        items.push(JSON.stringify(w.keys[i]) + ':');
+        items.push(w.kids[i]);
+      }
+      parts.push('{');
+      work.push('}');
+    }
+    for (let i = items.length - 1; i >= 0; i--) work.push(items[i]);
+  }
+  return parts.join('');
+}
+
+/** Deterministic JSON: object keys sorted recursively (arrays keep order).
+ *  Fail-safe on hostile input — a circular ref becomes "[circular]" and a BigInt
+ *  is stringified, so hashing a malformed tool definition can't throw.
+ *
+ *  ITERATIVE, and that is a security property rather than a style choice. The
+ *  recursive form (a `sort` walk feeding JSON.stringify, both of which recurse)
+ *  overflowed the stack at ~2,000 levels of nesting — and this function sits on
+ *  the runtime trust boundary: gateTools() hashes every tool a downstream MCP
+ *  server advertises, from inside a readline handler where nothing catches. A
+ *  ~15 KB tools/list carrying a deeply nested inputSchema therefore killed the
+ *  gate process outright. V8 parses that message happily, so "the JSON was
+ *  valid" was no defense. Depth now costs heap, not call frames.
+ *
+ *  Deliberately NOT solved with a depth cap: truncating a subtree makes two tools
+ *  that differ only below the cap hash identically — a pin-one-serve-another hole
+ *  in the thing whose whole job is telling those two apart.
+ *
+ *  Output is byte-identical to the recursive form for every input that form could
+ *  serialize; test/canonical-json-compat.test.mjs pins that against the original
+ *  implementation over randomized structures. */
+export function canonicalJson(v) {
+  return render(build(v));
 }

package/src/index.mjs

@@ -3,12 +3,12 @@
 // pairs with warden's runtime firewall: vet it → contain it.
 import { loadSkill, skillHash, joinScanText, PIECE_JOIN } from './skill.mjs';
 import { scanSkill, detectionInfo } from './scan.mjs';
-import { readLock, writeLock, DEFAULT_LOCK, LEGACY_LOCK, resolveLock } from './lock.mjs';
+import { readLock, writeLock, updateLock, DEFAULT_LOCK, LEGACY_LOCK, resolveLock } from './lock.mjs';
 import { signHash, verifyHashSig, keyId, ensureKey } from './sign.mjs';
 import { loadTrust, trustedSigner, trustKey, untrustKey, listTrust } from './trust.mjs';
 import { sha256, canonicalJson } from './hash.mjs';
 
-export { loadSkill, skillHash, joinScanText, PIECE_JOIN, scanSkill, detectionInfo, readLock, writeLock, DEFAULT_LOCK, LEGACY_LOCK, resolveLock };
+export { loadSkill, skillHash, joinScanText, PIECE_JOIN, scanSkill, detectionInfo, readLock, writeLock, updateLock, DEFAULT_LOCK, LEGACY_LOCK, resolveLock };
 export { signHash, verifyHashSig, keyId, ensureKey };
 export { loadTrust, trustedSigner, trustKey, untrustKey, listTrust };
 export { claudeSkillRoots, discoverClaudeSkills, discoverClaudePluginSkills, discoverMarketplaceSkills, resolveClaudeSkill } from './claude.mjs';
@@ -41,8 +41,10 @@ export function pin(source, { lockPath = resolveLock(), sign = false, force = fa
   if (s.verdict === 'flagged' && !force) return { ok: false, reason: 'flagged', findings: s.findings, skill };
   const hash = skillHash(skill);
   const key = name || skill.name;
-  const lock = readLock(lockPath);
-  lock.skills[key] = {
+  // Everything expensive — loading, scanning, hashing, signing — is done above,
+  // OUTSIDE the guard. Only the read-modify-write is serialized, so a concurrent
+  // pin queues for milliseconds rather than behind someone else's poison scan.
+  const entry = {
     source: skill.source, kind: skill.kind, hash,
     scannedAt: new Date().toISOString(), verdict: s.verdict, findings: s.findings.length,
     ...(s.advisories?.length ? { advisories: s.advisories.length } : {}), // mentions noted at pin time, for the record
@@ -50,7 +52,7 @@ export function pin(source, { lockPath = resolveLock(), sign = false, force = fa
     parts: partsOf(skill),
     ...(sign ? { sig: signHash(hash), signed: true } : {}),
   };
-  writeLock(lock, lockPath);
+  updateLock(lockPath, (lock) => { lock.skills[key] = entry; });
   return { ok: true, name: key, hash, verdict: s.verdict, signed: sign, skill, advisories: s.advisories?.length || 0 };
 }
 
@@ -59,11 +61,11 @@ export function pin(source, { lockPath = resolveLock(), sign = false, force = fa
  *  manual editing canon exists to discourage. A no-op removal never writes (so it
  *  can't create an empty lock), and a corrupt lock still fails CLOSED via readLock. */
 export function unpin(name, { lockPath = resolveLock() } = {}) {
-  const lock = readLock(lockPath);
-  if (!(name in lock.skills)) return 0;
-  delete lock.skills[name];
-  writeLock(lock, lockPath);
-  return 1;
+  return updateLock(lockPath, (lock, ctx) => {
+    if (!(name in lock.skills)) { ctx.skip(); return 0; }
+    delete lock.skills[name];
+    return 1;
+  });
 }
 
 /** Re-derive every pinned skill and classify it against the lock.

package/src/keychain.mjs

@@ -36,8 +36,18 @@ export function keychainGet() {
       const blob = blobFile();
       if (!fs.existsSync(blob)) return null;
       const enc = fs.readFileSync(blob, 'utf8').trim();
-      const ps = `Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('${enc}'); $p=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Console]::Out.Write([Text.Encoding]::UTF8.GetString($p))`;
-      return run('powershell', ['-NoProfile', '-NonInteractive', '-Command', ps]).trim() || null;
+      // The blob goes in on STDIN, never interpolated into the command string.
+      // It used to be spliced into a single-quoted PowerShell literal, so one
+      // apostrophe in signing-key.dpapi closed the quote and the rest of the file
+      // ran as PowerShell — arbitrary code as this user, on the next `--sign`.
+      // We write that file ourselves as base64, so it takes a separate write to
+      // reach it; but "an attacker who can already write there could do worse"
+      // is a weak defense for a key store, and it stops being true the moment
+      // ~/.canon is a mounted volume, a synced home directory, or a shared CI
+      // box. The set path has always used stdin — this just matches it.
+      if (!/^[A-Za-z0-9+/=\s]+$/.test(enc)) return null;   // not base64: refuse rather than hand it to a shell
+      const ps = 'Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String([Console]::In.ReadToEnd().Trim()); $p=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,\'CurrentUser\'); [Console]::Out.Write([Text.Encoding]::UTF8.GetString($p))';
+      return run('powershell', ['-NoProfile', '-NonInteractive', '-Command', ps], enc).trim() || null;
     }
   } catch { return null; }
   return null;

package/src/lock.mjs

@@ -57,6 +57,100 @@ export function readLock(p = DEFAULT_LOCK, { mustExist = false } = {}) {
   return { version: 1, ...l, skills: asSkills(l.skills) };
 }
 
+/** Write the lock ATOMICALLY — a temp file in the same directory, then a rename.
+ *
+ *  A plain writeFileSync truncates first, so an interrupted write (crash, full
+ *  disk, Ctrl-C mid-`add --claude` over a few hundred skills) leaves a truncated
+ *  lock. readLock fails CLOSED on that, which is the right call and also means
+ *  the damage is loud: `verify` refuses, and the Skill hook blocks EVERY pinned
+ *  skill until someone restores the file. Rename replaces in one step, so the
+ *  lock on disk is always either the old one or the new one.
+ *
+ *  This makes a single WRITE atomic. Making a whole read-modify-write atomic is
+ *  updateLock's job — use that for anything that edits the lock. */
 export function writeLock(lock, p = DEFAULT_LOCK) {
-  fs.writeFileSync(p, JSON.stringify(lock, null, 2) + '\n');
+  const body = JSON.stringify(lock, null, 2) + '\n';
+  const tmp = `${p}.tmp-${process.pid}`;
+  try {
+    fs.writeFileSync(tmp, body);
+    fs.renameSync(tmp, p);            // replaces an existing file on POSIX and Windows alike
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch {}   // never leave the temp behind on failure
+    throw e;
+  }
+}
+
+// ---- exclusive updates -------------------------------------------------------
+
+const GUARD = (p) => `${p}.guard`;
+const GUARD_WAIT_MS = 10_000;   // how long to queue behind another writer before giving up
+const GUARD_STALE_MS = 30_000;  // a guard older than this belonged to a process that died
+
+// A real sleep in synchronous code. The whole lock API is sync, and a spin loop
+// would burn a core while a concurrent `add` does its work.
+const sleepSync = (ms) => { try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* fall through to a spin */ } };
+
+const guardAge = (g) => { try { return Date.now() - fs.statSync(g).mtimeMs; } catch { return null; } };
+
+/** Take the guard for `p`, or throw if someone else holds it too long.
+ *  `wx` is create-if-absent in ONE syscall, which is what makes this a lock and
+ *  not another race. */
+function acquire(p, { waitMs = GUARD_WAIT_MS, staleMs = GUARD_STALE_MS } = {}) {
+  const g = GUARD(p);
+  const deadline = Date.now() + waitMs;
+  for (;;) {
+    try {
+      const fd = fs.openSync(g, 'wx');
+      try { fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: new Date().toISOString() })); } finally { fs.closeSync(fd); }
+      return g;
+    } catch (e) {
+      if (e.code !== 'EEXIST') throw e;
+      // A process that crashed mid-update would otherwise wedge the lock file
+      // forever. Guards are held for milliseconds, so anything this old is dead.
+      const age = guardAge(g);
+      if (age === null) continue;                       // vanished between open and stat: retry
+      if (age > staleMs) { try { fs.unlinkSync(g); } catch {} continue; }
+      if (Date.now() > deadline) {
+        throw new Error(`timed out waiting for another truecopy process to finish updating ${p} (holder: ${g}) — delete it if no truecopy is running`);
+      }
+      sleepSync(20);
+    }
+  }
+}
+
+/** Read the lock, hand it to `mutate`, and write it back — with no other
+ *  truecopy process able to interleave.
+ *
+ *  readLock → mutate → writeLock is three operations, and pin/unpin did them
+ *  unguarded. Two `truecopy add` runs against one lock therefore both read the
+ *  same state, each added its own entry, and the second write erased the first:
+ *  a skill reported as `pinned` that is silently absent from the lock. That is
+ *  the worst shape a bug can take here — the CLI says it vetted something, and
+ *  the gate that enforces the lock has never heard of it. It is not exotic
+ *  either: a CI job pinning while a hook re-pins, two shells, or one
+ *  `add --claude` beside an editor task is enough.
+ *
+ *  Serialized with a guard FILE rather than an in-process mutex, because the
+ *  racing writers are separate processes. Atomic writes alone cannot fix this:
+ *  they stop a torn file, not a lost update.
+ *
+ *  `mutate(lock, ctx)` may call `ctx.skip()` to leave the file untouched — an
+ *  idempotent no-op must not create a lock that did not exist. Whatever `mutate`
+ *  returns is returned to the caller.
+ *
+ *  NOT reentrant: calling updateLock inside another updateLock on the same path
+ *  waits for a guard the same process is holding. Do the reads you need first,
+ *  then take it once. Scanning and hashing belong OUTSIDE — the guard should be
+ *  held for a file read and a rename, not for a poison scan. */
+export function updateLock(p = DEFAULT_LOCK, mutate, opts = {}) {
+  const g = acquire(p, opts);
+  try {
+    const lock = readLock(p);
+    let write = true;
+    const result = mutate(lock, { skip: () => { write = false; } });
+    if (write) writeLock(lock, p);
+    return result;
+  } finally {
+    try { fs.unlinkSync(g); } catch {}
+  }
 }

package/src/mcp.mjs

@@ -20,12 +20,30 @@ const batchError = (msg) => {
   return { reply: JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32600, message: '⛔ canon: JSON-RPC batching is not supported through the gate — send individual requests' } }) };
 };
 
+// A line neither side can agree on is not forwarded. Everything else in this
+// gate fails closed; passing on bytes we could not inspect was the one exception,
+// and it undoes the guarantee exactly when it matters — the gate's promise is
+// that nothing reaches the agent it has not looked at, and "our parser choked"
+// is not a reason to believe a message is harmless. Any disagreement between
+// this parser and the peer's is a hole the size of one tools/list.
+//
+// Nothing legitimate is lost: MCP frames one JSON value per line, so a line
+// V8's JSON.parse rejects is not valid JSON, and a peer could not have acted on
+// it either. The client gets a JSON-RPC parse error (id null, per spec, since
+// the id is exactly what we failed to read); a server line is dropped with a
+// warning rather than handed on as garbage the client would only fail to parse
+// itself.
+const parseError = (detail) => ({
+  reply: JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: `⛔ truecopy: ${detail}` } }),
+});
+
 /** client → server. { forward } to pass on, or { reply } to short-circuit a blocked call. */
 export function inspectClient(line, state) {
+  if (!String(line).trim()) return {};                 // nothing to do; not an error
   let msg;
-  try { msg = JSON.parse(line); } catch { return { forward: line }; }
+  try { msg = JSON.parse(line); }
+  catch { return parseError('that request is not parseable JSON — the gate does not forward what it cannot inspect'); }
   if (Array.isArray(msg)) return batchError(msg); // a batch could smuggle a blocked tools/call — fail closed
-  if (msg && msg.method && msg.id != null) state.pending[msg.id] = msg.method;
   // Fail CLOSED on calls: a tool is callable only once we've SEEN and vetted a
   // tools/list AND its name survived that gating. Before any gated list (`listed`
   // is false), block everything — a tool known to the agent out-of-band, or
@@ -43,8 +61,7 @@ export function inspectClient(line, state) {
 // element instead of forwarding the array raw.
 function gateServerMsg(msg, state, opts) {
   const isToolsResult = msg && msg.result && Array.isArray(msg.result.tools);
-  if (!isToolsResult) { if (msg && msg.id != null) delete state.pending[msg.id]; return msg; }
-  if (msg.id != null) delete state.pending[msg.id];
+  if (!isToolsResult) return msg;
   const { allowed, report } = gateTools(msg.result.tools, opts.entry);
   const blockAll = opts.strict && report.some((r) => r.status !== 'vetted'); // strict: any problem → block the whole server
   for (const r of report) if (r.status !== 'vetted') { state.blocked.add(r.tool); opts.onWarn?.(`${blockAll ? 'strict — blocking all (' : 'dropped '}${r.tool} (${r.status})${blockAll ? ')' : ''}`); }
@@ -65,8 +82,15 @@ function gateServerMsg(msg, state, opts) {
  *  is cleared), bury tools in another reply, or hide a tools/list inside a
  *  JSON-RPC BATCH array; all must be gated, never forwarded raw. */
 export function inspectServer(line, state, opts = {}) {
+  if (!String(line).trim()) return {};
   let msg;
-  try { msg = JSON.parse(line); } catch { return { forward: line }; }
+  try { msg = JSON.parse(line); }
+  catch {
+    // Dropped, not relayed: the client could not have parsed it either, and
+    // forwarding un-inspected bytes is the one way past this gate.
+    opts.onWarn?.('dropped an unparseable line from the server (not forwarded)');
+    return { drop: true };
+  }
   if (Array.isArray(msg)) return { forward: JSON.stringify(msg.map((m) => gateServerMsg(m, state, opts))) };
   return { forward: JSON.stringify(gateServerMsg(msg, state, opts)) };
 }
@@ -84,7 +108,7 @@ export function runGate({ command, args = [], lockPath = resolveLock(), name = n
   const entry = pickEntry(readLock(lockPath), name);
   if (!entry) warn(`no pinned ${name ? '"' + name + '" ' : ''}MCP entry in ${lockPath} — every tool will be treated as unvetted (canon add it first)`);
   const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'inherit'] });
-  const state = { pending: {}, blocked: new Set(), allowedNames: new Set(), listed: false };
+  const state = { blocked: new Set(), allowedNames: new Set(), listed: false };
   const opts = { entry, strict, onWarn: warn };
 
   readline.createInterface({ input: process.stdin }).on('line', (line) => {
@@ -95,7 +119,8 @@ export function runGate({ command, args = [], lockPath = resolveLock(), name = n
   });
   readline.createInterface({ input: child.stdout }).on('line', (line) => {
     if (!line.trim()) return;
-    process.stdout.write(inspectServer(line, state, opts).forward + '\n');
+    const r = inspectServer(line, state, opts);
+    if (r.forward) process.stdout.write(r.forward + '\n');   // a dropped line writes nothing
   });
   process.stdin.on('end', () => { try { child.stdin.end(); } catch {} });
   child.on('exit', (code) => process.exit(code ?? 0));

package/src/sign.mjs

@@ -22,8 +22,10 @@ const keyFile = () => path.join(process.env.CANON_HOME || os.homedir(), '.canon'
 
 // PEM bytes can differ only by line endings (CRLF on Windows, a trailing newline
 // from a file read) yet be the same key — normalize before hashing/verifying so a
-// key's identity is stable across platforms.
-const normPem = (p) => String(p).replace(/\r\n/g, '\n').trim();
+// key's identity is stable across platforms. Exported because the trust set keys
+// on it: two normalizations that drift apart would be a security bug, not a
+// cosmetic one.
+export const normPem = (p) => String(p).replace(/\r\n/g, '\n').trim();
 const enc64 = (s) => Buffer.from(s, 'utf8').toString('base64');
 const dec64 = (s) => Buffer.from(s, 'base64').toString('utf8');
 

package/src/trust.mjs

@@ -9,7 +9,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { loadKey, keyId } from './sign.mjs';
+import { loadKey, keyId, normPem } from './sign.mjs';
 
 // The repo-committed trust file was `canon.trust` before the rename. New writes
 // go to `truecopy.trust`, but an existing `canon.trust` is still read and written
@@ -41,15 +41,21 @@ function writeStore(file, keys, repo) {
   fs.writeFileSync(file, JSON.stringify({ version: 1, keys }, null, 2) + '\n', repo ? undefined : { mode: 0o600 });
 }
 
-/** Build the active trust set as a Map: keyId → { id, name, publicKey }.
+/** Build the active trust set as a Map: normalized PUBLIC KEY → { id, name, publicKey }.
  *  Always includes your own key as `self`, so a locally-signed lock verifies with
- *  no extra trust step. */
+ *  no extra trust step.
+ *
+ *  Keyed on the WHOLE key, not on `keyId`. The id is a 64-bit truncation of
+ *  SHA-256 — fine as a human-readable handle, far too narrow to decide trust on:
+ *  two distinct keys sharing an id would otherwise be interchangeable here, and
+ *  whichever was inserted first would silently shadow the other. */
 export function loadTrust({ trustPath, cwd = process.cwd() } = {}) {
   const map = new Map();
   const add = (k) => {
     if (!k || !k.publicKey) return;
+    const pem = normPem(k.publicKey);
     const id = keyId(k.publicKey);
-    if (!map.has(id)) map.set(id, { id, name: k.name || id.slice(0, 12), publicKey: k.publicKey });
+    if (!map.has(pem)) map.set(pem, { id, name: k.name || id.slice(0, 12), publicKey: k.publicKey });
   };
   // self = the machine's PERSISTENT local key only — NOT a CANON_SIGNING_KEY env
   // key. A CI signing key signs; it isn't auto-trusted at verify time (that would
@@ -61,11 +67,24 @@ export function loadTrust({ trustPath, cwd = process.cwd() } = {}) {
   return map;
 }
 
-/** Name of the trusted signer for a public key, or null if its key isn't trusted. */
+/** Name of the trusted signer for a public key, or null if its key isn't trusted.
+ *
+ *  Matches the ENTIRE key. This used to look the key up by `keyId` and return the
+ *  name it found without ever comparing the key itself — so anything that hashed
+ *  to the same 16 hex chars was accepted as that publisher. 64 bits is not a
+ *  trust boundary: grinding a second key to collide with one you already trust is
+ *  a birthday search over ~2^32 keypairs, which is hours on one core and minutes
+ *  spread out — cheap enough for "a vendor hands you key A, then signs a release
+ *  with key B". The full key was already sitting in the entry, unused. */
 export function trustedSigner(publicKey, trust) {
   if (!publicKey) return null;
-  const entry = trust.get(keyId(publicKey));
-  return entry ? entry.name : null;
+  const entry = trust.get(normPem(publicKey));
+  // Public keys are public, so there is no secret here to leak through timing —
+  // a plain comparison is the honest primitive. The lookup is exact-keyed, but
+  // compare anyway so a caller that builds its own Map cannot reintroduce the
+  // truncated-id shortcut.
+  if (!entry || normPem(entry.publicKey) !== normPem(publicKey)) return null;
+  return entry.name;
 }
 
 /** Add a publisher public key to the trust set (global by default, or repo canon.trust). */
@@ -73,20 +92,43 @@ export function trustKey(publicKey, name, { repo = false, cwd = process.cwd() }
   const file = repo ? resolveRepoTrust(cwd) : homeStore();
   const id = keyId(publicKey);
   if (!id) throw new Error('not a public key');
-  const entry = { id, name: name || id.slice(0, 12), publicKey: String(publicKey).replace(/\r\n/g, '\n').trim() };
+  const entry = { id, name: name || id.slice(0, 12), publicKey: normPem(publicKey) };
   const keys = readStore(file).filter((k) => keyId(k.publicKey) !== id);
   keys.push(entry);
   writeStore(file, keys, repo);
   return entry;
 }
 
-/** Remove a trusted key by exact id or id-prefix (global store). → count removed. */
-export function untrustKey(idOrPrefix, { cwd = process.cwd() } = {}) {
+const MIN_UNTRUST_PREFIX = 8;
+
+/** Remove a trusted key by exact id or id-prefix (global store). → count removed.
+ *
+ *  Guarded, because the prefix match is greedy and this store is the thing that
+ *  decides whose signatures count. `''.startsWith(x)` is true for every key, so
+ *  `truecopy trust remove ""` silently emptied the entire trust set and cheerfully
+ *  reported "removed 2 key(s)" — every publisher you had vetted, gone, and the
+ *  next `verify --require-signed` failing for reasons that look nothing like the
+ *  cause. A short prefix did the same thing more quietly, to whichever keys
+ *  happened to share it.
+ *
+ *  So: at least 8 characters, and an ambiguous prefix is refused rather than
+ *  applied — unless `all` says that was the intent. Removing the WRONG key is
+ *  not a safe default in either direction, so this errors instead of guessing. */
+export function untrustKey(idOrPrefix, { cwd = process.cwd(), all = false } = {}) {
+  const prefix = String(idOrPrefix ?? '');
+  if (prefix.length < MIN_UNTRUST_PREFIX) {
+    throw new Error(`refusing to match trusted keys on '${prefix}' — give at least ${MIN_UNTRUST_PREFIX} characters of the key id (truecopy trust list)`);
+  }
   const file = homeStore();
   const keys = readStore(file);
-  const kept = keys.filter((k) => !(k.id === idOrPrefix || (k.id || keyId(k.publicKey)).startsWith(idOrPrefix)));
-  if (kept.length !== keys.length) writeStore(file, kept, false);
-  return keys.length - kept.length;
+  const matches = (k) => k.id === prefix || (k.id || keyId(k.publicKey)).startsWith(prefix);
+  const hit = keys.filter(matches);
+  if (hit.length > 1 && !all) {
+    throw new Error(`'${prefix}' matches ${hit.length} trusted keys (${hit.map((k) => k.name || k.id).join(', ')}) — use the full id, or --all to remove them together`);
+  }
+  if (!hit.length) return 0;
+  writeStore(file, keys.filter((k) => !matches(k)), false);
+  return hit.length;
 }
 
 /** The flattened trust set (incl. implicit `self`), for display. */