@askalf/truecopy 0.7.0 → 0.8.0

package/README.md

@@ -1,6 +1,6 @@
 # truecopy
 
-[![marketplace watch](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Faskalf%2Ftruecopy%2Fwatch%2Fbadge.json)](https://github.com/askalf/truecopy/blob/watch/WATCH.md)
+[![marketplace watch](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Faskalf%2Ftruecopy%2Fwatch%2Fbadge.json)](https://github.com/askalf/truecopy/blob/watch/WATCH.md) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/askalf/truecopy/badge)](https://scorecard.dev/viewer/?uri=github.com/askalf/truecopy)
 
 > _truecopy — **own your agent skills**. Vet, sign, and pin every skill & MCP server before it runs. Part of **[Own Your Stack](https://github.com/askalf)** — own your AI infrastructure instead of renting it by the token._
 
@@ -15,7 +15,7 @@ Agents install tools from places you don't control — MCP servers, skill market
 - **verifies** on every run / in CI that nothing **drifted** — a pinned skill whose bytes changed is a silent update or a supply-chain attack, and `truecopy verify` exits non-zero before it loads
 - **diffs** exactly what changed since you trusted it
 
-Deterministic and offline. truecopy shares **[warden](https://github.com/askalf/warden)**'s detection — so the two are a pair, not a duplicate: **truecopy vets the tool (provenance); warden contains the call (runtime).** *Vet it → contain it.*
+Deterministic and offline. truecopy shares **[redstamp](https://github.com/askalf/redstamp)**'s detection — so the two are a pair, not a duplicate: **truecopy vets the tool (provenance); redstamp contains the call (runtime).** *Vet it → contain it.*
 
 ## Install
 
@@ -74,7 +74,7 @@ A silently-added, drifted, or poisoned tool is stripped from `tools/list` (the a
 truecopy guard -- npm start        # refuses to launch (exit 1) if any pinned skill drifted or turned poisonous
 ```
 
-So truecopy spans the whole lifecycle: **scan → pin → verify (CI) → enforce (runtime).** Where [warden](https://github.com/askalf/warden) firewalls what a tool *does*, truecopy-mcp gates which tools *exist*.
+So truecopy spans the whole lifecycle: **scan → pin → verify (CI) → enforce (runtime).** Where [redstamp](https://github.com/askalf/redstamp) firewalls what a tool *does*, truecopy-mcp gates which tools *exist*.
 
 ## Gate Claude Code skills
 
@@ -199,7 +199,7 @@ verify();                                 // { ok, results: [{ name, status: 'ok
 
 ## The agent-security stack
 
-Three composable layers, one defense: **[warden](https://github.com/askalf/warden)** contains the call · **[truecopy](https://github.com/askalf/truecopy)** vets the tool *(you are here)* · **[keeper](https://github.com/askalf/keeper)** holds the keys. Run all three together → **[agent-security-stack](https://github.com/askalf/agent-security-stack)**.
+Three composable layers, one defense: **[redstamp](https://github.com/askalf/redstamp)** contains the call · **[truecopy](https://github.com/askalf/truecopy)** vets the tool *(you are here)* · **[strongroom](https://github.com/askalf/strongroom)** holds the keys. Run all three together → **[agent-security-stack](https://github.com/askalf/agent-security-stack)**.
 
 ---
 Part of **[Own Your Stack](https://github.com/askalf)** — own your AI infrastructure instead of renting it. Built by Thomas Sprayberry.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/truecopy",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "own your agent skills — vet, sign, and pin every skill & MCP server before it runs. The supply-chain gate for AI agents. Part of Own Your Stack.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -5,7 +5,7 @@ import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { scan, pin, unpin, verify, diff, readLock, ensureKey, keyId, trustKey, untrustKey, listTrust, loadSkill, skillHash, scanSkill } from './index.mjs';
+import { scan, pin, unpin, verify, diff, readLock, resolveLock, ensureKey, keyId, trustKey, untrustKey, listTrust, loadSkill, skillHash, scanSkill } from './index.mjs';
 import { discoverClaudeSkills, discoverClaudePluginSkills, discoverMarketplaceSkills, resolveClaudeSkill } from './claude.mjs';
 
 // This build's version — so `hook install` can PIN the gate command to a git tag
@@ -34,7 +34,9 @@ const sources = (() => {
   }
   return out;
 })();
-const lockPath = opt('--lock', 'canon.lock');
+// Default lock: prefer truecopy.lock, transparently fall back to an existing
+// canon.lock (pre-rename repos), else write truecopy.lock. `--lock` overrides.
+const lockPath = resolveLock(opt('--lock', null) || null);
 const optTrust = () => { const t = opt('--trust', undefined); return typeof t === 'string' ? t : undefined; };
 // `--json` — machine-readable output for scan/verify/list/diff: one JSON document
 // on stdout, no ANSI, and the SAME exit codes (the CI gate contract is the exit
@@ -69,40 +71,43 @@ const mark = { ok: c(C.grn, '✓'), clean: c(C.grn, '✓'), flagged: c(C.red, '
 const findingLine = (f) => `      ${c(C.red, '☠')} ${f.tool}: ${f.flags.join('; ')}`;
 
 function usage() {
-  out(`${c(C.bold, 'canon')} — own your agent skills · vet · sign · pin · verify
-
-  canon scan <source...>            poison-scan a skill / MCP manifest / directory
-  canon add  <source...> [--sign]   vet + pin into ${lockPath} (refuses poisoned unless --force)
-  canon scan --claude               poison-scan every Claude Code skill (.claude/skills, project + user)
-  canon add  --claude [--sign]      vet + pin them all
-  canon scan --claude-plugins       …and every skill shipped by installed marketplace plugins
-  canon add  --claude-plugins       vet + pin those under their \`plugin:skill\` invocation name
-  canon scan --marketplace <dir>    poison-scan a CLONED marketplace or plugin repo (you fetch, canon scans)
-  canon verify [--lock <file>] [--trust <file>] [--require-signed]   re-check every pinned skill
+  out(`${c(C.bold, 'truecopy')} — own your agent skills · vet · sign · pin · verify
+
+  truecopy scan <source...>            poison-scan a skill / MCP manifest / directory
+  truecopy add  <source...> [--sign]   vet + pin into ${lockPath} (refuses poisoned unless --force)
+  truecopy scan --claude               poison-scan every Claude Code skill (.claude/skills, project + user)
+  truecopy add  --claude [--sign]      vet + pin them all
+  truecopy scan --claude-plugins       …and every skill shipped by installed marketplace plugins
+  truecopy add  --claude-plugins       vet + pin those under their \`plugin:skill\` invocation name
+  truecopy scan --marketplace <dir>    poison-scan a CLONED marketplace or plugin repo (you fetch, truecopy scans)
+  truecopy verify [--lock <file>] [--trust <file>] [--require-signed]   re-check every pinned skill
                                     for drift / poisoning (--require-signed: also fail any entry
                                     without a valid signature from a trusted key)
-  canon diff <source> [--name <n>]  show what changed since it was pinned
-  canon list                        show the pinned set
-  canon remove <name...>            un-pin a skill — drop its ${lockPath} entry (alias: unpin)
-  canon guard [--lock <file>] [--require-signed] -- <cmd...>   verify the lock, then run <cmd> only if it's clean
+  truecopy diff <source> [--name <n>]  show what changed since it was pinned
+  truecopy list                        show the pinned set
+  truecopy remove <name...>            un-pin a skill — drop its ${lockPath} entry (alias: unpin)
+  truecopy guard [--lock <file>] [--require-signed] -- <cmd...>   verify the lock, then run <cmd> only if it's clean
   …scan / verify / list / diff take --json: machine-readable stdout, same exit codes
 
-  canon key                         print this machine's public key + id (share it to be trusted)
-  canon trust add <pubkey> --name <who> [--repo]   trust a publisher's key (--repo → commit it to canon.trust)
-  canon trust list                  show the trusted signing keys
-  canon trust remove <id>           stop trusting a key
+  truecopy key                         print this machine's public key + id (share it to be trusted)
+  truecopy trust add <pubkey> --name <who> [--repo]   trust a publisher's key (--repo → commit it to truecopy.trust)
+  truecopy trust list                  show the trusted signing keys
+  truecopy trust remove <id>           stop trusting a key
 
-  canon hook claude [--strict]      Claude Code PreToolUse hook: block a pinned skill that
+  truecopy hook claude [--strict]      Claude Code PreToolUse hook: block a pinned skill that
                                     drifted or turned poisonous at the moment it's invoked
                                     (--strict: only pinned skills may run at all)
-  canon hook install [--strict] [--user] [--settings <file>]
+  truecopy hook install [--strict] [--user] [--settings <file>]
                                     wire that hook into .claude/settings.json (idempotent;
                                     project file by default, --user for ~/.claude)
 
-  canon-mcp [--lock] [--name] [--strict] -- <mcp-server cmd...>
+  truecopy-mcp [--lock] [--name] [--strict] -- <mcp-server cmd...>
                                     enforce the lock on a LIVE MCP server: only vetted,
                                     unmodified, unpoisoned tools reach the client
 
+  \`canon\` / \`canon-mcp\` remain as back-compat aliases, and an existing canon.lock /
+  canon.trust is read automatically (new pins write truecopy.lock / truecopy.trust).
+
   Exit 1 on any flagged / drifted / poisoned result — drop it in CI.`);
 }
 
@@ -285,7 +290,7 @@ function runTrust() {
     try {
       const repo = !!opt('--repo', false);
       const r = trustKey(pub, opt('--name', undefined), { repo });
-      out(`${mark.ok} trusted ${c(C.bold, r.name)} ${c(C.dim, r.id)}${repo ? c(C.dim, ' · canon.trust') : ''}`);
+      out(`${mark.ok} trusted ${c(C.bold, r.name)} ${c(C.dim, r.id)}${repo ? c(C.dim, ' · truecopy.trust') : ''}`);
       return 0;
     } catch (e) { out(`${c(C.red, '✗')} ${e.message}`); return 1; }
   }
@@ -329,12 +334,14 @@ function runHookClaude() {
     const name = payload.tool_input && payload.tool_input.skill;
     if (!name) return 0;
 
-    // lock: explicit --lock > <project>/canon.lock > ./canon.lock (hooks run in the project dir)
+    // lock: explicit --lock > truecopy.lock (project/cwd) > canon.lock (back-compat, project/cwd).
+    // Hooks run in the project dir; prefer the branded name, still honor a pre-rename canon.lock.
     const projectDir = process.env.CLAUDE_PROJECT_DIR || payload.cwd || process.cwd();
     const explicit = opt('--lock', undefined);
-    const candidates = typeof explicit === 'string' ? [explicit] : [path.join(projectDir, 'canon.lock'), 'canon.lock'];
+    const candidates = typeof explicit === 'string' ? [explicit]
+      : [path.join(projectDir, 'truecopy.lock'), 'truecopy.lock', path.join(projectDir, 'canon.lock'), 'canon.lock'];
     const lp = candidates.find((p) => fs.existsSync(p));
-    if (!lp) return strict ? deny(`no canon.lock — pin your skills first: canon add --claude`) : 0;
+    if (!lp) return strict ? deny(`no truecopy.lock — pin your skills first: truecopy add --claude`) : 0;
 
     let lock;
     try { lock = readLock(lp, { mustExist: true }); }

package/src/index.mjs

@@ -3,12 +3,12 @@
 // pairs with warden's runtime firewall: vet it → contain it.
 import { loadSkill, skillHash } from './skill.mjs';
 import { scanSkill, detectionInfo } from './scan.mjs';
-import { readLock, writeLock, DEFAULT_LOCK } from './lock.mjs';
+import { readLock, writeLock, DEFAULT_LOCK, LEGACY_LOCK, resolveLock } from './lock.mjs';
 import { signHash, verifyHashSig, keyId, ensureKey } from './sign.mjs';
 import { loadTrust, trustedSigner, trustKey, untrustKey, listTrust } from './trust.mjs';
 import { sha256, canonicalJson } from './hash.mjs';
 
-export { loadSkill, skillHash, scanSkill, detectionInfo, readLock, writeLock, DEFAULT_LOCK };
+export { loadSkill, skillHash, scanSkill, detectionInfo, readLock, writeLock, DEFAULT_LOCK, LEGACY_LOCK, resolveLock };
 export { signHash, verifyHashSig, keyId, ensureKey };
 export { loadTrust, trustedSigner, trustKey, untrustKey, listTrust };
 export { claudeSkillRoots, discoverClaudeSkills, discoverClaudePluginSkills, discoverMarketplaceSkills, resolveClaudeSkill } from './claude.mjs';
@@ -35,7 +35,7 @@ export function scan(source) {
 }
 
 /** Pin a vetted skill into the lock. Refuses to pin a flagged skill unless force. */
-export function pin(source, { lockPath = DEFAULT_LOCK, sign = false, force = false, name } = {}) {
+export function pin(source, { lockPath = resolveLock(), sign = false, force = false, name } = {}) {
   const skill = loadSkill(source);
   const s = scanSkill(skill);
   if (s.verdict === 'flagged' && !force) return { ok: false, reason: 'flagged', findings: s.findings, skill };
@@ -58,7 +58,7 @@ export function pin(source, { lockPath = DEFAULT_LOCK, sign = false, force = fal
  *  The guided mirror of `pin`: hand-deleting from a signed lock is exactly the
  *  manual editing canon exists to discourage. A no-op removal never writes (so it
  *  can't create an empty lock), and a corrupt lock still fails CLOSED via readLock. */
-export function unpin(name, { lockPath = DEFAULT_LOCK } = {}) {
+export function unpin(name, { lockPath = resolveLock() } = {}) {
   const lock = readLock(lockPath);
   if (!(name in lock.skills)) return 0;
   delete lock.skills[name];
@@ -69,7 +69,7 @@ export function unpin(name, { lockPath = DEFAULT_LOCK } = {}) {
 /** Re-derive every pinned skill and classify it against the lock.
  *  Fails CLOSED on a missing or corrupt lock — a present-but-empty lock stays
  *  ok:true (legitimately nothing pinned). */
-export function verify({ lockPath = DEFAULT_LOCK, trustPath, requireSigned = false } = {}) {
+export function verify({ lockPath = resolveLock(), trustPath, requireSigned = false } = {}) {
   let lock;
   try { lock = readLock(lockPath, { mustExist: true }); }
   catch (e) { return { ok: false, error: e.message, results: [] }; }
@@ -129,7 +129,7 @@ function verifyOne(name, entry, trust) {
 }
 
 /** What changed in a source since it was pinned. */
-export function diff(source, { lockPath = DEFAULT_LOCK, name } = {}) {
+export function diff(source, { lockPath = resolveLock(), name } = {}) {
   const skill = loadSkill(source);
   const key = name || skill.name;
   const entry = readLock(lockPath).skills[key];

package/src/lock.mjs

@@ -1,9 +1,27 @@
-// canon.lock — the pinned, vetted set. One entry per trusted skill: where it came
-// from, the content hash you trusted, the scan verdict at pin time, and (optional)
-// a signature. `verify` re-derives the hash and flags any drift from this file.
+// truecopy.lock — the pinned, vetted set. One entry per trusted skill: where it
+// came from, the content hash you trusted, the scan verdict at pin time, and
+// (optional) a signature. `verify` re-derives the hash and flags any drift from
+// this file.
 import fs from 'node:fs';
+import path from 'node:path';
 
-export const DEFAULT_LOCK = 'canon.lock';
+// The lock filename was `canon.lock` before the rename. New locks are written as
+// `truecopy.lock`, but an existing `canon.lock` is still read (see resolveLock)
+// so a repo pinned before the rename keeps verifying with zero changes.
+export const DEFAULT_LOCK = 'truecopy.lock';
+export const LEGACY_LOCK = 'canon.lock';
+
+/** Pick the lock file when the caller didn't pass one explicitly: prefer the
+ *  branded `truecopy.lock`, transparently fall back to an existing `canon.lock`,
+ *  and default to `truecopy.lock` when neither exists (so fresh pins are branded). */
+export function resolveLock(explicit, dir = '.') {
+  if (typeof explicit === 'string' && explicit) return explicit;
+  for (const name of [DEFAULT_LOCK, LEGACY_LOCK]) {
+    const p = path.join(dir, name);
+    try { if (fs.existsSync(p)) return p; } catch {}
+  }
+  return path.join(dir, DEFAULT_LOCK);
+}
 
 // `skills` is ALWAYS a NULL-PROTOTYPE map, on every readLock path — so a skill
 // keyed by a prototype member ("__proto__", "toString", "constructor", …) can't
@@ -27,15 +45,15 @@ export function readLock(p = DEFAULT_LOCK, { mustExist = false } = {}) {
   try { raw = fs.readFileSync(p, 'utf8'); }
   catch (e) {
     if (e && e.code === 'ENOENT') {
-      if (mustExist) { const err = new Error(`no canon.lock at ${p}`); err.code = 'ELOCKMISSING'; throw err; }
+      if (mustExist) { const err = new Error(`no lock file at ${p}`); err.code = 'ELOCKMISSING'; throw err; }
       return emptyLock();
     }
     throw e;
   }
   let l;
   try { l = JSON.parse(raw); }
-  catch (e) { const err = new Error(`canon.lock at ${p} is present but unparseable: ${e.message}`); err.code = 'ELOCKCORRUPT'; throw err; }
-  if (!l || typeof l !== 'object' || Array.isArray(l)) { const err = new Error(`canon.lock at ${p} is not a lock object`); err.code = 'ELOCKCORRUPT'; throw err; }
+  catch (e) { const err = new Error(`lock file at ${p} is present but unparseable: ${e.message}`); err.code = 'ELOCKCORRUPT'; throw err; }
+  if (!l || typeof l !== 'object' || Array.isArray(l)) { const err = new Error(`lock file at ${p} is not a lock object`); err.code = 'ELOCKCORRUPT'; throw err; }
   return { version: 1, ...l, skills: asSkills(l.skills) };
 }
 

package/src/mcp-cli.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-// canon-mcp — enforce canon.lock on a live MCP server. Point your MCP client at
-//   canon-mcp [--lock canon.lock] [--name <pinned>] [--strict] -- <server cmd...>
-// Only vetted, unmodified, unpoisoned tools reach the client.
+// truecopy-mcp — enforce the lock on a live MCP server. Point your MCP client at
+//   truecopy-mcp [--lock truecopy.lock] [--name <pinned>] [--strict] -- <server cmd...>
+// Only vetted, unmodified, unpoisoned tools reach the client. (`canon-mcp` still
+// works as an alias; an existing canon.lock is read automatically.)
 import { runGate } from './mcp.mjs';
+import { resolveLock } from './lock.mjs';
 
 const argv = process.argv.slice(2);
 const sep = argv.indexOf('--');
@@ -16,7 +18,7 @@ const opt = (n, d) => {
 };
 
 if (!cmd.length || pre.includes('-h') || pre.includes('--help')) {
-  process.stderr.write('usage: canon-mcp [--lock canon.lock] [--name <pinned>] [--strict] -- <mcp-server cmd...>\n');
+  process.stderr.write('usage: truecopy-mcp [--lock truecopy.lock] [--name <pinned>] [--strict] -- <mcp-server cmd...>\n');
   process.exit(cmd.length ? 0 : 2);
 }
-runGate({ command: cmd[0], args: cmd.slice(1), lockPath: opt('--lock', 'canon.lock'), name: opt('--name', null) || null, strict: !!opt('--strict', false) });
+runGate({ command: cmd[0], args: cmd.slice(1), lockPath: resolveLock(opt('--lock', null) || null), name: opt('--name', null) || null, strict: !!opt('--strict', false) });

package/src/mcp.mjs

@@ -7,7 +7,7 @@
 import { spawn } from 'node:child_process';
 import readline from 'node:readline';
 import { gateTools, toolHash } from './gate.mjs';
-import { readLock } from './lock.mjs';
+import { readLock, resolveLock } from './lock.mjs';
 
 const blockReply = (id, name) =>
   JSON.stringify({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: `⛔ canon blocked an un-vetted / drifted tool: ${name}` }], isError: true } });
@@ -79,8 +79,8 @@ export function pickEntry(lock, name) {
 }
 
 /** Spawn the downstream server and wire the two gated streams together. */
-export function runGate({ command, args = [], lockPath = 'canon.lock', name = null, strict = false, onWarn } = {}) {
-  const warn = onWarn || ((m) => process.stderr.write('[canon] ' + m + '\n'));
+export function runGate({ command, args = [], lockPath = resolveLock(), name = null, strict = false, onWarn } = {}) {
+  const warn = onWarn || ((m) => process.stderr.write('[truecopy] ' + m + '\n'));
   const entry = pickEntry(readLock(lockPath), name);
   if (!entry) warn(`no pinned ${name ? '"' + name + '" ' : ''}MCP entry in ${lockPath} — every tool will be treated as unvetted (canon add it first)`);
   const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'inherit'] });

package/src/trust.mjs

@@ -11,9 +11,25 @@ import os from 'node:os';
 import path from 'node:path';
 import { loadKey, keyId } from './sign.mjs';
 
-export const DEFAULT_REPO_TRUST = 'canon.trust';
+// The repo-committed trust file was `canon.trust` before the rename. New writes
+// go to `truecopy.trust`, but an existing `canon.trust` is still read and written
+// (see resolveRepoTrust) for back-compat. The private global store stays at
+// `~/.canon/trust.json` / `$CANON_HOME` — an internal path kept stable so a
+// user's existing trust decisions aren't lost by the rename.
+export const DEFAULT_REPO_TRUST = 'truecopy.trust';
+export const LEGACY_REPO_TRUST = 'canon.trust';
 const homeStore = () => path.join(process.env.CANON_HOME || os.homedir(), '.canon', 'trust.json');
 
+/** The repo trust file to read/write: prefer branded `truecopy.trust`, fall back
+ *  to an existing `canon.trust`, default to `truecopy.trust`. */
+export function resolveRepoTrust(cwd = process.cwd()) {
+  for (const name of [DEFAULT_REPO_TRUST, LEGACY_REPO_TRUST]) {
+    const p = path.join(cwd, name);
+    try { if (fs.existsSync(p)) return p; } catch {}
+  }
+  return path.join(cwd, DEFAULT_REPO_TRUST);
+}
+
 function readStore(file) {
   try { const j = JSON.parse(fs.readFileSync(file, 'utf8')); return Array.isArray(j?.keys) ? j.keys : []; }
   catch { return []; }
@@ -41,7 +57,7 @@ export function loadTrust({ trustPath, cwd = process.cwd() } = {}) {
   // key belongs in canon.trust if you want to verify what it signed.
   const self = loadKey({ envAllowed: false }); if (self) add({ name: 'self', publicKey: self.publicKey });
   for (const k of readStore(homeStore())) add(k);
-  for (const k of readStore(trustPath || path.join(cwd, DEFAULT_REPO_TRUST))) add(k);
+  for (const k of readStore(trustPath || resolveRepoTrust(cwd))) add(k);
   return map;
 }
 
@@ -54,7 +70,7 @@ export function trustedSigner(publicKey, trust) {
 
 /** Add a publisher public key to the trust set (global by default, or repo canon.trust). */
 export function trustKey(publicKey, name, { repo = false, cwd = process.cwd() } = {}) {
-  const file = repo ? path.join(cwd, DEFAULT_REPO_TRUST) : homeStore();
+  const file = repo ? resolveRepoTrust(cwd) : homeStore();
   const id = keyId(publicKey);
   if (!id) throw new Error('not a public key');
   const entry = { id, name: name || id.slice(0, 12), publicKey: String(publicKey).replace(/\r\n/g, '\n').trim() };