@shomra/agent 0.3.29 → 0.3.30

package/src/guard/tool-guard.mjs

@@ -6,6 +6,8 @@ import { isMemoryPath, reportMemoryWrite } from '../commands/memory-scan.mjs';
 import { breakerOpen, breakerReset, breakerTrip, guardTimeoutMs } from '../core/circuit-breaker.mjs';
 import { CONFIG_DIR } from '../core/config.mjs';
 import { makeLedgerStore } from './ledger.mjs';
+import { memoryWritesFor, outOfBandChange, recordLedger, sha256 } from './memory-write.mjs';
+import { gateMachine } from '../core/api-client.mjs';
 import { VERSION } from '../core/version.mjs';
 import { loadConfig, resolveSettings } from '../core/config.mjs';
 import { classifyConsequence, downrankCodeContext, grade, localScan } from '../detect/guard-signals.mjs';
@@ -19,23 +21,7 @@ import { buildGuardBody, reportGuardDecision } from './report.mjs';
 
 const ALLOW_VERDICT = { verdict: 'ALLOW', top: null, findings: [] };
 
-/**
- * ⚠ FAILING OPEN ON EVERYTHING IS AN ENFORCEMENT BYPASS AN ATTACKER BUYS WITH A
- * SLOW INPUT. The hook has to fail open - an agent that hard-stops on an
- * unreachable SaaS backend is one nobody keeps installed - but "open on every
- * call" means padding a command until the screen times out runs it unscreened,
- * which is cheaper than any evasion in the corpus.
- *
- * So the rung decides. A routine or material call still flows: that is the
- * promise that keeps the hook installed. A SEVERE one - a recursive delete, a
- * force push over a shared branch, a write into ~/.ssh - stops and ASKS.
- *
- * ⚠ IT ASKS, IT DOES NOT DENY. A deny during an outage is unappealable at 3am
- * and gets the hook uninstalled, taking every other control with it. An ask
- * puts the human who is already sitting there in the loop and says plainly
- * that the call was NOT screened, which is the honest sentence: we do not know
- * that this is dangerous, we know that we could not check.
- */
+
 function failOpenOnSevere() {
   return envFlag('SHOMRA_GUARD_FAILOPEN_SEVERE');
 }
@@ -49,34 +35,18 @@ function unscreenedSevere(normalized, tool, input) {
   }) === 'severe';
 }
 
-/**
- * ⚠⚠ THE LEDGER HAD NO PRODUCER. `guard/ledger.mjs` builds the fail-open window
- * the backend's EnforcementGap reads - and nothing in this repo ever called
- * `countCall`, so every client reported ZERO gaps forever. The backend then
- * asks whether a capable reporter exists, gets silence, and the estate reads
- * either "no outages" or NOT_ATTEMPTABLE. Both are wrong and one is flattering:
- * a smoke detector reporting no fire with a dead battery, which is the exact
- * shape enforcement-availability.ts was written to prevent.
- *
- * ⚠ COUNTS ARE LOWER BOUNDS BY DESIGN - concurrent hook processes race this
- * file, and the backend already treats them as a floor. Do not "fix" that with
- * a lock on the firewall's hot path.
- */
+
 function ledger() {
   return makeLedgerStore(CONFIG_DIR, { version: VERSION });
 }
 
-/** A call that ran with no server verdict: Tier-0 screened it, or nothing did. */
 function countUnscreened(reason) {
   try {
     ledger().count(localTierDisabled() ? 'unscreened' : 'local', reason);
   } catch {
-    /* The ledger is a record, never a gate: a failure to write one must not
-     * take the firewall down. The count is a floor and this makes it lower. */
   }
 }
 
-/** Close the open window and hand the backend everything not yet acknowledged. */
 function sendLedger() {
   try {
     const store = ledger();
@@ -85,7 +55,6 @@ function sendLedger() {
     pendingLedger = env.gaps ?? [];
     return env;
   } catch {
-    /* No ledger is a lower bound, not a wrong number. */
     return undefined;
   }
 }
@@ -97,8 +66,6 @@ function ackLedger() {
   try {
     ledger().ack(pendingLedger);
   } catch {
-    /* Unacknowledged gaps are re-sent next time; a duplicate is a floor read
-     * twice, which is safe. Losing one is not. */
   }
   pendingLedger = [];
 }
@@ -138,28 +105,56 @@ function screenLocally(normalized, tool, input) {
   return { ...grade(findings), top, findings };
 }
 
-function memoryWriteContent(input) {
-  if (typeof input.content === 'string') return input.content;
-  if (typeof input.new_string === 'string') return input.new_string;
-  return null;
+const READ_TOOLS_RE = /^(read|read_file|view|open_file|cat)$/i;
+const OUT_OF_BAND = 'changed outside any agent write the Shomra hook observed';
+
+function memoryReportBase(filePath, normalized) {
+  const machine = gateMachine();
+  return {
+    path: path.resolve(filePath).split(path.sep).join('/'),
+    name: path.basename(String(filePath)),
+    machineId: machine.machineId,
+    hostname: machine.hostname,
+    actor: machine.username,
+    sessionId: normalized.session_id,
+  };
 }
 
-async function recordMemoryWrite({ url, apiKey, input, normalized }) {
-  const memoryPath = input.file_path || input.path;
-  if (!memoryPath || !isMemoryPath(memoryPath) || breakerOpen()) return;
+async function reportOutOfBand(url, apiKey, filePath, current, normalized) {
+  if (current == null || !outOfBandChange(filePath, current)) return;
+  await reportMemoryWrite(url, apiKey, { ...memoryReportBase(filePath, normalized), content: current, writer: 'UNKNOWN', source: OUT_OF_BAND });
+  recordLedger(filePath, [sha256(current)]);
+}
 
-  const content = memoryWriteContent(input);
-  if (content == null) return;
+async function recordMemoryWrite({ url, apiKey, tool, input, normalized }) {
+  if (breakerOpen()) return;
+
+  if (READ_TOOLS_RE.test(tool || '')) {
+    const target = input.file_path || input.path || input.target_file;
+    if (!target || !isMemoryPath(target)) return;
+    const abs = path.resolve(normalized.cwd || process.cwd(), String(target));
+    let current = null;
+    try {
+      current = fs.readFileSync(abs, 'utf8');
+    } catch {
+      return;
+    }
+    await reportOutOfBand(url, apiKey, abs, current, normalized);
+    return;
+  }
 
-  await reportMemoryWrite(url, apiKey, {
-    path: String(memoryPath).split(path.sep).join('/'),
-    name: path.basename(String(memoryPath)),
-    content,
-    writer: 'AGENT',
-    source: os.hostname(),
-    actor: os.userInfo().username,
-    sessionId: normalized.session_id,
-  });
+  const writes = memoryWritesFor(tool, input, { cwd: normalized.cwd }).filter((w) => w.path && isMemoryPath(w.path));
+  for (const w of writes) {
+    await reportOutOfBand(url, apiKey, w.path, w.before, normalized);
+    await reportMemoryWrite(url, apiKey, {
+      ...memoryReportBase(w.path, normalized),
+      content: w.content,
+      writer: 'AGENT',
+      source: os.hostname(),
+      contentBasis: w.basis,
+    });
+    recordLedger(w.path, [w.before != null ? sha256(w.before) : null, w.basis === 'whole' ? sha256(w.content) : null]);
+  }
 }
 
 function reportUnauthenticated(agent, status, strict) {
@@ -193,12 +188,6 @@ async function requestServerDecision({ url, apiKey, agentId, body, agent, strict
 
     if (!response.ok) {
       if (response.status === 401 || response.status === 403) reportUnauthenticated(agent, response.status, strict);
-      /* ⚠ A 429 IS NOT AN OUTAGE, and treating it as one was a silent
-       * enforcement bypass: tripping the breaker skips the server for the whole
-       * cooldown, so one burst past the rate limit switched org policy, agent
-       * identity and flow control off for thirty seconds - on the machine, with
-       * nothing said. It means "we are here, come back", so it is retried once
-       * against Retry-After and never counted against the breaker. */
       if (response.status === 429) {
         const wait = retryAfterMs(response);
         if (wait !== null && !retried) {
@@ -223,7 +212,6 @@ async function requestServerDecision({ url, apiKey, agentId, body, agent, strict
   }
 }
 
-/** Honours a seconds or an HTTP-date Retry-After; null when the server named none. */
 function retryAfterMs(response) {
   const raw = response.headers?.get?.('retry-after');
   if (!raw) return null;
@@ -271,26 +259,16 @@ export async function cmdToolGuard(flags) {
     process.exit(0);
   }
 
-  await recordMemoryWrite({ url, apiKey, input, normalized });
+  await recordMemoryWrite({ url, apiKey, tool, input, normalized });
+
 
-  /* ⚠ A SEVERE CALL IS ALWAYS WORTH THE ROUND TRIP. `guardNeedsServer` asks
-   * which calls are worth escalating and answered NO for `git push --force
-   * origin main` and `rm -rf` alike - so the most destructive calls in the
-   * estate were graded by the offline tier and NOTHING ELSE: no org policy, no
-   * capability check, no flow control, and no gate event to read afterwards. */
   const severe = unscreenedSevere(normalized, tool, input);
   const escalate = alwaysEscalate || severe || local.verdict === 'FLAG' || guardNeedsServer(tool, input, !!agentId);
-  /* ⚠ A call the client CHOSE not to escalate is still a call no server graded,
-   * and the denominator has to carry it or the fail-open rate is measured over
-   * the escalated traffic alone - which flatters it by exactly the calls the
-   * client decided were dull. */
   if (!escalate) {
     countUnscreened('not escalated - screened by the local tier only');
     process.exit(0);
   }
 
-  /* Every path out of here that did NOT get a server verdict goes through this
-   * one door, so a new way of failing cannot quietly skip the rung check. */
   const onUnreachable = (why) => {
     countUnscreened(why);
     if (severe) askUnscreened(agent, why);
@@ -309,9 +287,6 @@ export async function cmdToolGuard(flags) {
     onUnreachable,
     body: {
       ...buildGuardBody(normalized, agent, flagged ? 'FLAG' : undefined, flagged ? local.top?.label : undefined),
-      /* The window closes the moment a verdict arrives, and rides out on the
-       * SAME request - a separate report would be a second round trip on the
-       * firewall's hot path, and one that fails exactly when the first did. */
       guard_ledger: sendLedger(),
     },
   });

package/src/inventory/agent-posture.mjs

@@ -2,6 +2,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { emptyGrant, extractGrant, grantIsEmpty, parseLooseToml, parseLooseYaml, stripJsonc } from './grant-extract.mjs';
+import { readMcpServers } from '../detect/signals/mcp-config.mjs';
+import { CURSOR_APP_USER_KEY, INTERPRETERS, readStateKeys } from './vscode-state.mjs';
+import { projectRoots } from './project-roots.mjs';
 
 const HOME = os.homedir();
 const PLAT = process.platform;
@@ -15,14 +19,17 @@ export const TIER_MEANING = {
   none: 'No machine-readable permission surface. This agent appears in inventory only.',
 };
 
-function readJsonc(file) {
+function readJsonc(file, maxBytes = MAX_SETTINGS_BYTES) {
   try {
     const st = fs.statSync(file);
-    if (!st.isFile() || st.size > MAX_SETTINGS_BYTES) return { state: 'unreadable', reason: st.isFile() ? 'oversized' : 'not-a-file' };
+    if (!st.isFile() || st.size > maxBytes) return { state: 'unreadable', reason: st.isFile() ? 'oversized' : 'not-a-file' };
     const raw = fs.readFileSync(file, 'utf8');
+    if (/\.(?:toml|ya?ml)$/i.test(file)) {
+      const doc = /\.toml$/i.test(file) ? parseLooseToml(raw) : parseLooseYaml(raw);
+      return doc ? { state: 'read', json: doc } : { state: 'unreadable', reason: 'parse-failed' };
+    }
 
-    const stripped = raw.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:"])\/\/.*$/gm, '$1');
-    return { state: 'read', json: JSON.parse(stripped) };
+    return { state: 'read', json: JSON.parse(stripJsonc(raw)) };
   } catch (err) {
     if (err && err.code === 'ENOENT') return { state: 'absent' };
 
@@ -30,6 +37,10 @@ function readJsonc(file) {
   }
 }
 
+const COPILOT_KEYS = ['chat.', 'github.copilot'];
+
+const EDITOR_APPS = ['Code', 'Code - Insiders', 'Cursor', 'Windsurf'];
+
 export const VENDOR_POSTURE = {
   'claude-code': {
     tier: 'declared',
@@ -40,6 +51,8 @@ export const VENDOR_POSTURE = {
       { rel: ['.claude', 'settings.local.json'], base: 'home', scope: 'user' },
       { rel: ['.claude', 'settings.json'], base: 'cwd', scope: 'project' },
       { rel: ['.claude', 'settings.local.json'], base: 'cwd', scope: 'project' },
+      { rel: ['managed-settings.json'], base: 'claude-managed', scope: 'managed' },
+      { rel: ['managed-settings.d'], base: 'claude-managed', scope: 'managed', dir: '.json' },
     ],
   },
   gemini: {
@@ -48,22 +61,43 @@ export const VENDOR_POSTURE = {
     sources: [
       { rel: ['.gemini', 'settings.json'], base: 'home', scope: 'user' },
       { rel: ['.gemini', 'settings.json'], base: 'cwd', scope: 'project' },
+      { rel: ['.gemini', 'policies'], base: 'home', scope: 'user', dir: '.toml' },
+      { rel: ['settings.json'], base: 'gemini-system', scope: 'managed' },
+      { rel: ['system-defaults.json'], base: 'gemini-system', scope: 'managed' },
+    ],
+  },
+  'qwen-code': {
+    tier: 'declared',
+    label: 'Qwen Code',
+    sources: [
+      { rel: ['.qwen', 'settings.json'], base: 'home', scope: 'user' },
+      { rel: ['.qwen', 'settings.json'], base: 'cwd', scope: 'project' },
+      { rel: ['settings.json'], base: 'qwen-system', scope: 'managed' },
     ],
   },
   codex: {
     tier: 'declared',
     label: 'OpenAI Codex CLI',
     sources: [
+      { rel: ['.codex', 'config.toml'], base: 'home', scope: 'user' },
+      { rel: ['.codex', 'config.toml'], base: 'cwd', scope: 'project' },
       { rel: ['.codex', 'config.json'], base: 'home', scope: 'user' },
       { rel: ['.codex', 'settings.json'], base: 'home', scope: 'user' },
     ],
   },
   cursor: {
-    tier: 'flag',
+    tier: 'declared',
     label: 'Cursor',
     sources: [
+      { stateDb: 'Cursor', dbKeys: [CURSOR_APP_USER_KEY], interpret: 'cursor', scope: 'user' },
+      { rel: ['.cursor', 'cli-config.json'], base: 'home', scope: 'user' },
+      { rel: ['.cursor', 'permissions.json'], base: 'home', scope: 'user' },
+      { rel: ['.cursor', 'sandbox.json'], base: 'home', scope: 'user' },
       { rel: ['.cursor', 'settings.json'], base: 'home', scope: 'user' },
       { rel: ['.cursor', 'mcp.json'], base: 'home', scope: 'user' },
+      { rel: ['.cursor', 'cli.json'], base: 'cwd', scope: 'project' },
+      { rel: ['.cursor', 'permissions.json'], base: 'cwd', scope: 'project' },
+      { rel: ['.cursor', 'sandbox.json'], base: 'cwd', scope: 'project' },
       { rel: ['.cursor', 'mcp.json'], base: 'cwd', scope: 'project' },
       { rel: ['.cursor', 'settings.json'], base: 'cwd', scope: 'project' },
       { rel: ['User', 'settings.json'], base: 'cursor-user', scope: 'user' },
@@ -76,31 +110,113 @@ export const VENDOR_POSTURE = {
       { rel: ['.codeium', 'windsurf', 'settings.json'], base: 'home', scope: 'user' },
       { rel: ['.codeium', 'windsurf', 'mcp_config.json'], base: 'home', scope: 'user' },
       { rel: ['.windsurf', 'mcp.json'], base: 'cwd', scope: 'project' },
+      { rel: ['settings.json'], base: 'windsurf-user', scope: 'user', keys: ['windsurf.', 'cascade'] },
+      { stateDb: 'Windsurf', dbKeys: ['windsurf%', 'codeium%'], interpret: 'windsurf', scope: 'user' },
     ],
   },
   cline: {
-    tier: 'flag',
+    tier: 'declared',
     label: 'Cline',
     sources: [
       { rel: ['settings', 'cline_mcp_settings.json'], base: 'cline-storage', scope: 'user' },
       { rel: ['.cline', 'settings.json'], base: 'home', scope: 'user' },
+      { rel: ['.cline', 'data', 'globalState.json'], base: 'home', scope: 'user', interpret: 'cline', maxBytes: 8 * 1024 * 1024 },
+      { rel: ['settings.json'], base: 'vscode-user', scope: 'user', keys: ['cline.'] },
+      ...EDITOR_APPS.map((app) => ({ stateDb: app, dbKeys: ['saoudrizwan.claude-dev'], interpret: 'cline', scope: 'user' })),
     ],
   },
   roo: {
-    tier: 'flag',
+    tier: 'declared',
     label: 'Roo Code',
     sources: [
       { rel: ['settings', 'mcp_settings.json'], base: 'roo-storage', scope: 'user' },
       { rel: ['.roo', 'settings.json'], base: 'cwd', scope: 'project' },
+      { rel: ['settings.json'], base: 'vscode-user', scope: 'user', keys: ['roo-cline.'] },
+      ...EDITOR_APPS.map((app) => ({ stateDb: app, dbKeys: ['rooveterinaryinc.roo-cline'], interpret: 'roo', scope: 'user' })),
     ],
   },
   copilot: {
     tier: 'flag',
-    label: 'GitHub Copilot CLI',
-    sources: [{ rel: ['.copilot', 'config.json'], base: 'home', scope: 'user' }],
+    label: 'GitHub Copilot',
+    sources: [
+      { rel: ['.copilot', 'config.json'], base: 'home', scope: 'user' },
+      { rel: ['.copilot', 'settings.json'], base: 'home', scope: 'user' },
+      { rel: ['settings.json'], base: 'vscode-user', scope: 'user', keys: COPILOT_KEYS },
+      { rel: ['settings.json'], base: 'vscode-insiders-user', scope: 'user', keys: COPILOT_KEYS },
+      { rel: ['.vscode', 'settings.json'], base: 'cwd', scope: 'project', keys: COPILOT_KEYS },
+      { rel: ['.github', 'copilot', 'settings.json'], base: 'cwd', scope: 'project' },
+      { rel: ['.github', 'copilot', 'settings.local.json'], base: 'cwd', scope: 'project' },
+    ],
+  },
+  kiro: {
+    tier: 'declared',
+    label: 'Kiro',
+    sources: [
+      { rel: ['.kiro', 'settings', 'permissions.yaml'], base: 'home', scope: 'user' },
+      { rel: ['.kiro', 'agents'], base: 'home', scope: 'user', dir: '.json' },
+      { rel: ['.kiro', 'agents'], base: 'cwd', scope: 'project', dir: '.json' },
+      { rel: ['.kiro', 'settings'], base: 'home', scope: 'user', dir: '.json' },
+      { rel: ['.kiro', 'settings'], base: 'cwd', scope: 'project', dir: '.json' },
+      { rel: ['settings.json'], base: 'vscode-user', scope: 'user', keys: ['kiroAgent.'] },
+      { rel: ['.aws', 'amazonq', 'cli-agents'], base: 'home', scope: 'user', dir: '.json' },
+    ],
+  },
+  opencode: {
+    tier: 'declared',
+    label: 'OpenCode',
+    sources: [
+      { rel: ['.config', 'opencode', 'opencode.json'], base: 'home', scope: 'user' },
+      { rel: ['.config', 'opencode', 'opencode.jsonc'], base: 'home', scope: 'user' },
+      { rel: ['opencode.json'], base: 'cwd', scope: 'project' },
+      { rel: ['opencode.jsonc'], base: 'cwd', scope: 'project' },
+    ],
+  },
+  zed: {
+    tier: 'declared',
+    label: 'Zed',
+    sources: [
+      { rel: ['settings.json'], base: 'zed-config', scope: 'user' },
+      { rel: ['.zed', 'settings.json'], base: 'cwd', scope: 'project' },
+    ],
+  },
+  augment: {
+    tier: 'declared',
+    label: 'Augment',
+    sources: [
+      { rel: ['.augment', 'settings.json'], base: 'home', scope: 'user' },
+      { rel: ['.augment', 'settings.json'], base: 'cwd', scope: 'project' },
+    ],
+  },
+  continue: {
+    tier: 'declared',
+    label: 'Continue',
+    sources: [{ rel: ['.continue', 'permissions.yaml'], base: 'home', scope: 'user' }],
+  },
+  goose: {
+    tier: 'flag',
+    label: 'Goose',
+    sources: [
+      { rel: ['config.yaml'], base: 'goose-config', scope: 'user' },
+      { rel: ['permission.yaml'], base: 'goose-config', scope: 'user' },
+    ],
+  },
+  amp: {
+    tier: 'flag',
+    label: 'Amp',
+    sources: [
+      { rel: ['settings.json'], base: 'vscode-user', scope: 'user', keys: ['amp.'] },
+      { rel: ['.config', 'amp', 'settings.json'], base: 'home', scope: 'user' },
+      { rel: ['.vscode', 'settings.json'], base: 'cwd', scope: 'project', keys: ['amp.'] },
+    ],
+  },
+  aider: {
+    tier: 'flag',
+    label: 'Aider',
+    sources: [
+      { rel: ['.aider.conf.yml'], base: 'home', scope: 'user' },
+      { rel: ['.aider.conf.yml'], base: 'cwd', scope: 'project' },
+    ],
   },
-
-  aider: { tier: 'none', label: 'Aider', sources: [] },
 };
 
 function vscodeUserDir(variant) {
@@ -109,6 +225,12 @@ function vscodeUserDir(variant) {
   return path.join(HOME, '.config', variant, 'User');
 }
 
+const APPDATA = process.env.APPDATA || path.join(HOME, 'AppData', 'Roaming');
+
+function systemDir(win, mac, linux) {
+  return PLAT === 'win32' ? win : PLAT === 'darwin' ? mac : linux;
+}
+
 function resolveBase(base, cwd) {
   switch (base) {
     case 'home': return HOME;
@@ -116,10 +238,39 @@ function resolveBase(base, cwd) {
     case 'cursor-user': return path.dirname(vscodeUserDir('Cursor'));
     case 'cline-storage': return path.join(vscodeUserDir('Code'), 'globalStorage', 'saoudrizwan.claude-dev');
     case 'roo-storage': return path.join(vscodeUserDir('Code'), 'globalStorage', 'rooveterinaryinc.roo-cline');
+    case 'vscode-user': return vscodeUserDir('Code');
+    case 'vscode-insiders-user': return vscodeUserDir('Code - Insiders');
+    case 'windsurf-user': return vscodeUserDir('Windsurf');
+    case 'claude-managed': return systemDir('C:\\Program Files\\ClaudeCode', '/Library/Application Support/ClaudeCode', '/etc/claude-code');
+    case 'gemini-system': return systemDir('C:\\ProgramData\\gemini-cli', '/Library/Application Support/GeminiCli', '/etc/gemini-cli');
+    case 'qwen-system': return systemDir('C:\\ProgramData\\qwen-code', '/Library/Application Support/QwenCode', '/etc/qwen-code');
+    case 'zed-config': return PLAT === 'win32' ? path.join(APPDATA, 'Zed') : path.join(HOME, '.config', 'zed');
+    case 'goose-config': return PLAT === 'win32' ? path.join(APPDATA, 'Block', 'goose', 'config') : path.join(HOME, '.config', 'goose');
     default: return cwd;
   }
 }
 
+const MAX_DIR_FILES = 20;
+
+function expandSource(src, cwd) {
+  const target = path.join(resolveBase(src.base, cwd), ...src.rel);
+  if (!src.dir) return [target];
+  try {
+    return fs.readdirSync(target)
+      .filter((n) => n.toLowerCase().endsWith(src.dir))
+      .sort()
+      .slice(0, MAX_DIR_FILES)
+      .map((n) => path.join(target, n));
+  } catch {
+    return [];
+  }
+}
+
+function pickKeys(json, prefixes) {
+  if (!prefixes || !json || typeof json !== 'object' || Array.isArray(json)) return json;
+  return Object.fromEntries(Object.entries(json).filter(([k]) => prefixes.some((p) => k.toLowerCase().startsWith(p.toLowerCase()))));
+}
+
 const AUTO_APPROVE_KEYS = [
   { re: /^(yolo|yolomode|enableyolo)$/i, label: 'YOLO mode', severity: 'CRITICAL' },
   { re: /^(autoapprove|alwaysallow|autoallow|autoaccept|autoconfirm)$/i, label: 'auto-approve', severity: 'HIGH' },
@@ -147,53 +298,59 @@ function collectSwitches(node, out, depth = 0, trail = '') {
   }
 }
 
+
 function collectMcpServers(json) {
-  const servers = json?.mcpServers ?? json?.servers ?? json?.mcp?.servers ?? null;
-  if (!servers || typeof servers !== 'object' || Array.isArray(servers)) return [];
-  return Object.entries(servers)
-    .slice(0, 60)
-    .map(([name, def]) => ({
-      name,
-      transport: def?.url ? 'http' : 'stdio',
-
-      autoApprove: Array.isArray(def?.autoApprove) ? def.autoApprove.slice(0, 20) : Array.isArray(def?.alwaysAllow) ? def.alwaysAllow.slice(0, 20) : [],
-      disabled: def?.disabled === true,
-    }));
+  const servers = readMcpServers(json) ?? [];
+  return servers.slice(0, 60).map((s) => ({
+    name: s.name,
+    transport: s.url ? 'http' : 'stdio',
+    autoApprove: (s.trusted ? ['*', ...(s.autoApprove ?? [])] : s.autoApprove ?? []).slice(0, 20),
+    disabled: s.disabled === true,
+  }));
 }
 
-export function readVendorPosture(vendor, cwd = process.cwd()) {
+function readSource(src, cwd) {
+  if (src.stateDb) {
+    const file = path.join(vscodeUserDir(src.stateDb), 'globalStorage', 'state.vscdb');
+    const res = readStateKeys(file, src.dbKeys);
+    const docs = res.state === 'read' ? res.values.map((v) => INTERPRETERS[src.interpret](v.json)) : [];
+    return [{ path: `${file}#${src.dbKeys.join('|')}`, res, docs }];
+  }
+  return expandSource(src, cwd).map((file) => {
+    const res = readJsonc(file, src.maxBytes);
+    const raw = res.state === 'read' ? pickKeys(res.json ?? {}, src.keys) : null;
+    const doc = raw && src.interpret ? INTERPRETERS[src.interpret](raw) : raw;
+    return { path: file, res, docs: doc ? [doc] : [] };
+  });
+}
+
+export function readVendorPosture(vendor, cwd = process.cwd(), roots = null) {
   const def = VENDOR_POSTURE[vendor];
   if (!def) return null;
 
   const sources = [];
   const switches = [];
   const mcpServers = [];
-  let mode = null;
-  const allow = [];
-  const deny = [];
-  const ask = [];
-  let enableAllProjectMcpServers = null;
+  const grant = emptyGrant();
+  const extraRoots = (roots ?? []).filter((r) => r && path.resolve(r) !== path.resolve(cwd));
+  const projectsRead = new Set();
 
   for (const src of def.sources) {
-    const file = path.join(resolveBase(src.base, cwd), ...src.rel);
-    const res = readJsonc(file);
-    sources.push({ path: file, scope: src.scope, state: res.state, reason: res.reason ?? null });
-    if (res.state !== 'read') continue;
-
-    const json = res.json ?? {};
-    const perms = json.permissions ?? {};
-
-    const m = perms.defaultMode ?? json.defaultMode ?? null;
-    if (m && (!mode || String(m).toLowerCase() === 'bypasspermissions')) mode = String(m);
-    for (const [key, sink] of [['allow', allow], ['deny', deny], ['ask', ask]]) {
-      const list = Array.isArray(perms[key]) ? perms[key] : key === 'allow' && Array.isArray(json.allowedTools) ? json.allowedTools : [];
-      for (const g of list) if (typeof g === 'string' && !sink.includes(g)) sink.push(g);
+    const bases = src.base === 'cwd' ? [cwd, ...extraRoots] : [cwd];
+    for (const base of bases) {
+      for (const { path: file, res, docs } of readSource(src, base)) {
+        const primary = base === cwd;
+        if (primary || res.state !== 'absent') sources.push({ path: file, scope: src.scope, state: res.state, reason: res.reason ?? null });
+        if (res.state !== 'read') continue;
+        if (src.base === 'cwd') projectsRead.add(base);
+        for (const json of docs) {
+          if ((src.keys || src.interpret) && !Object.keys(json).length) continue;
+          extractGrant(json, grant);
+          if (def.tier === 'flag') collectSwitches(json, switches);
+          for (const s of collectMcpServers(json)) if (!mcpServers.some((x) => x.name === s.name)) mcpServers.push(s);
+        }
+      }
     }
-    if (json.enableAllProjectMcpServers === true) enableAllProjectMcpServers = true;
-    else if (enableAllProjectMcpServers === null && json.enableAllProjectMcpServers === false) enableAllProjectMcpServers = false;
-
-    if (def.tier === 'flag') collectSwitches(json, switches);
-    for (const s of collectMcpServers(json)) if (!mcpServers.some((x) => x.name === s.name)) mcpServers.push(s);
   }
 
   const read = sources.filter((s) => s.state === 'read');
@@ -207,38 +364,60 @@ export function readVendorPosture(vendor, cwd = process.cwd()) {
     readable: read.length > 0,
     sources,
     unreadableCount: holes.length,
-    mode,
-    allow: allow.slice(0, 60),
-    deny: deny.slice(0, 60),
-    ask: ask.slice(0, 60),
-    enableAllProjectMcpServers,
+    mode: grant.mode,
+    allow: grant.allow.slice(0, 60),
+    deny: grant.deny.slice(0, 60),
+    ask: grant.ask.slice(0, 60),
+    enableAllProjectMcpServers: grant.enableAllProjectMcpServers,
+    grant,
     switches: switches.slice(0, 20),
     mcpServers,
 
     autoApprovedMcp: mcpServers.filter((s) => s.autoApprove.length > 0 && !s.disabled).map((s) => s.name),
 
-    claim: def.tier === 'declared' && read.length > 0 && holes.length === 0 ? 'complete' : 'floor',
+    truncated: grant.truncated === true,
+    projectsScanned: 1 + extraRoots.length,
+    projectsWithSettings: projectsRead.size,
+    claim: def.tier === 'declared' && read.length > 0 && holes.length === 0 && !grant.truncated ? 'complete' : 'floor',
   };
 }
 
 export function canonicalGrant(posture) {
   if (!posture) return null;
+  const g = posture.grant && !grantIsEmpty(posture.grant) ? posture.grant : null;
   const doc = {};
   const perms = {};
   if (posture.mode) perms.defaultMode = posture.mode;
-  if (posture.allow.length) perms.allow = posture.allow;
-  if (posture.deny.length) perms.deny = posture.deny;
-  if (posture.ask.length) perms.ask = posture.ask;
+  if (posture.allow?.length) perms.allow = posture.allow;
+  if (posture.deny?.length) perms.deny = posture.deny;
+  if (posture.ask?.length) perms.ask = posture.ask;
+  if (g) {
+    if (g.directories.length) perms.additionalDirectories = g.directories;
+    if (g.trustedFolders.length) perms.trustedFolders = g.trustedFolders;
+    const fsGrant = Object.fromEntries(Object.entries(g.fileSystem).filter(([, v]) => v.length));
+    if (Object.keys(fsGrant).length) perms.fileSystem = fsGrant;
+    const net = Object.fromEntries(Object.entries(g.network).filter(([, v]) => v.length));
+    if (Object.keys(net).length) perms.network = net;
+    if (g.envNames.length) perms.environmentVariables = { allowList: g.envNames };
+    if (g.commands.length) perms.tools = { allowExecution: g.commands };
+    if (g.rules.length) perms.rules = g.rules;
+    if (g.permission) perms.permission = g.permission;
+    if (g.toolPermissions && Object.keys(g.toolPermissions).length) perms.tool_permissions = g.toolPermissions;
+    if (g.unixSockets.length) perms.sandbox = { network: { allowUnixSockets: g.unixSockets } };
+    if (g.mcpAllowlist.length) perms.mcpAllowlist = g.mcpAllowlist;
+    if (g.folderTrustDisabled) perms.folderTrust = { enabled: false };
+    for (const [k, v] of Object.entries(g.flags)) if (!(k in perms)) perms[k] = v;
+  }
   if (Object.keys(perms).length) doc.permissions = perms;
   if (posture.enableAllProjectMcpServers === true) doc.enableAllProjectMcpServers = true;
   return Object.keys(doc).length ? JSON.stringify(doc, null, 2) : null;
 }
 
-export function readPostures(vendors, cwd = process.cwd()) {
+export function readPostures(vendors, cwd = process.cwd(), roots = projectRoots(cwd)) {
   const out = {};
   for (const v of vendors) {
     try {
-      const p = readVendorPosture(v, cwd);
+      const p = readVendorPosture(v, cwd, roots);
       if (p) out[v] = p;
     } catch {