praxis-agent 0.40.0 → 0.41.0

package/README.md

@@ -170,7 +170,9 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   exclusions, violation reporting, and bare-repository control-file cleanup,
   safe-property Skill auto-allow, interactive
   workspace-directory add/remove controls, path confinement, credential
-  redaction, and sanitized child processes.
+  redaction, sanitized child processes, and exact-fingerprint workspace trust
+  that blocks automatically discovered project/local hooks and MCP servers
+  until the canonical workspace configuration is explicitly accepted.
 - **Durable local work** — resumable sessions, full-history forks, file
   checkpoints, tasks, foreground/background subagents, top-level agents, and
   Claude-compatible main-thread agent definitions with native prompt, model,

package/dist/cli/controls.js

@@ -7,6 +7,7 @@ export const DEFAULT_CLI_CONTROLS = {
     settingSources: undefined,
     safeMode: false,
     bare: false,
+    trustProject: false,
     systemPrompt: undefined,
     systemPromptFile: undefined,
     appendSystemPrompt: undefined,
@@ -180,6 +181,7 @@ export async function resolveCliControls(controls, cwd) {
         settingSources: controls.settingSources,
         safeMode: controls.safeMode,
         bare: controls.bare,
+        trustProject: controls.trustProject,
         systemPrompt,
         appendSystemPrompt,
         excludeDynamicSystemPromptSections: controls.excludeDynamicSystemPromptSections,

package/dist/cli/protocol.d.ts

@@ -14,6 +14,7 @@ export interface CliControls {
     settingSources: readonly ('user' | 'project' | 'local')[] | undefined;
     safeMode: boolean;
     bare: boolean;
+    trustProject: boolean;
     systemPrompt: string | undefined;
     systemPromptFile: string | undefined;
     appendSystemPrompt: string | undefined;

package/dist/cli/protocol.js

@@ -359,6 +359,7 @@ export function parseCliInvocation(argv) {
     let autocompact;
     let safeMode = false;
     let bare = false;
+    let trustProject = false;
     let systemPrompt;
     let systemPromptFile;
     let appendSystemPrompt;
@@ -1082,6 +1083,10 @@ export function parseCliInvocation(argv) {
             bare = true;
             continue;
         }
+        if (value === '--trust-project') {
+            trustProject = true;
+            continue;
+        }
         if (value === '--init') {
             init = true;
             continue;
@@ -1343,6 +1348,7 @@ export function parseCliInvocation(argv) {
         settingSources,
         safeMode,
         bare,
+        trustProject,
         systemPrompt,
         systemPromptFile,
         appendSystemPrompt,

package/dist/cli/workspace-trust-prompt.d.ts

@@ -0,0 +1,10 @@
+import { type WorkspaceTrustInventory } from '../security/workspace-trust.js';
+export interface WorkspaceTrustPromptIO {
+    input?: AsyncIterable<string>;
+    output?: (text: string) => void;
+    signal?: AbortSignal;
+}
+export declare function createWorkspaceTrustDecisionCache(decide: (inventory: WorkspaceTrustInventory) => boolean | Promise<boolean>): (inventory: WorkspaceTrustInventory) => Promise<boolean>;
+export declare function safeWorkspaceTrustDisplayField(value: string): string;
+export declare function promptWorkspaceTrust(inventory: WorkspaceTrustInventory, io?: WorkspaceTrustPromptIO): Promise<boolean>;
+//# sourceMappingURL=workspace-trust-prompt.d.ts.map

package/dist/cli/workspace-trust-prompt.js

@@ -0,0 +1,53 @@
+import { workspaceTrustDecisionKey, } from '../security/workspace-trust.js';
+export function createWorkspaceTrustDecisionCache(decide) {
+    const decisions = new Map();
+    return async (inventory) => {
+        const key = workspaceTrustDecisionKey(inventory);
+        const cached = decisions.get(key);
+        if (cached !== undefined)
+            return cached;
+        const decision = await decide(inventory);
+        decisions.set(key, decision);
+        return decision;
+    };
+}
+export function safeWorkspaceTrustDisplayField(value) {
+    return [...value]
+        .map((character) => {
+        return /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(character) ? '?' : character;
+    })
+        .join('')
+        .slice(0, 512);
+}
+export async function promptWorkspaceTrust(inventory, io = {}) {
+    const output = io.output ?? ((text) => process.stderr.write(text));
+    if (io.signal?.aborted)
+        return false;
+    output(`Workspace executable resources found for ${safeWorkspaceTrustDisplayField(inventory.canonicalPath)}\n`);
+    for (const origin of inventory.origins)
+        output(`  ${origin.kind} (${origin.scope}) ${safeWorkspaceTrustDisplayField(origin.path)}: ${safeWorkspaceTrustDisplayField(origin.label)}\n`);
+    output('Trust these workspace executables? [y/N] ');
+    const input = io.input ?? process.stdin;
+    const iterator = input[Symbol.asyncIterator]();
+    const abortedResult = Symbol('workspace-trust-prompt-aborted');
+    let abort;
+    try {
+        const aborted = new Promise((resolve) => {
+            abort = () => resolve(abortedResult);
+            io.signal?.addEventListener('abort', abort, { once: true });
+            if (io.signal?.aborted)
+                abort();
+        });
+        const result = await Promise.race([iterator.next(), aborted]);
+        if (result === abortedResult)
+            return false;
+        if (result.done)
+            return false;
+        return /^(?:y|yes)$/iu.test(String(result.value).trim());
+    }
+    finally {
+        if (abort)
+            io.signal?.removeEventListener('abort', abort);
+    }
+}
+//# sourceMappingURL=workspace-trust-prompt.js.map

package/dist/cli-runtime.d.ts

@@ -11,6 +11,7 @@ import type { TuiSlashCommand } from './cli/tui/slash-commands.js';
 import { type TuiHookConfiguration } from './cli/tui/hook-settings.js';
 import { type PraxisRuntimeSettings } from './cli/tui/runtime-settings.js';
 import { type ClaudePermissionMode } from './permissions/claude-permission-resolver.js';
+import { type WorkspaceTrustInventory } from './security/workspace-trust.js';
 import { type ClaudeMcpServerStatus, type ClaudeMcpToolInspection } from './mcp/claude-mcp-tools.js';
 import { authenticateMcpServer } from './mcp/claude-mcp-oauth.js';
 import { servePraxisMcpStdio } from './mcp/praxis-mcp-server.js';
@@ -138,6 +139,7 @@ export interface CliDependencies extends InteractiveServiceFactory {
         onElicitation?: (request: CliElicitationRequest) => Promise<CliElicitationResult>;
         askUser?: ClaudeInteractiveToolCallbacks['askUser'];
         approvePlan?: ClaudeInteractiveToolCallbacks['approvePlan'];
+        approveWorkspaceTrust?: (request: WorkspaceTrustInventory) => boolean | Promise<boolean>;
     }): Promise<SessionCommands>;
     createAutoModeCritic?(options: {
         model?: string;

package/dist/cli-runtime.js

@@ -33,6 +33,8 @@ import { createClaudeModelAutoClassifier, defaultClaudeAutoModeConfig, loadClaud
 import { ClaudeExtensionPermissionResolver, ClaudeExtensionToolRegistry, } from './extensions/claude-extension-tools.js';
 import { ClaudeExtensionCatalog } from './extensions/claude-extensions.js';
 import { ClaudeHookRunner } from './hooks/claude-hooks.js';
+import { allowedWorkspaceHookSettings, allowedWorkspaceMcpResources, assessWorkspaceTrust, persistWorkspaceTrust, workspaceTrustDecisionKey, workspaceTrustInventory, } from './security/workspace-trust.js';
+import { createWorkspaceTrustDecisionCache, promptWorkspaceTrust, safeWorkspaceTrustDisplayField, } from './cli/workspace-trust-prompt.js';
 import { ClaudeSessionEnvironment } from './hooks/claude-session-environment.js';
 import { ClaudeMcpToolRegistry, } from './mcp/claude-mcp-tools.js';
 import { ClaudeMcpManagement, filterDisabledMcpResources, mcpScope, } from './mcp/claude-mcp-management.js';
@@ -216,6 +218,7 @@ Options:
   --setting-sources <sources>         user, project, local, or an empty list
   --safe-mode                         Disable shared customizations
   --bare                              Use only explicitly supplied context
+  --trust-project                     Trust current workspace executables
   --system-prompt <prompt>            Set system prompt
   --append-system-prompt <prompt>     Append system prompt
   --exclude-dynamic-system-prompt-sections
@@ -755,6 +758,12 @@ const consoleIO = {
     isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     readStdinLines: () => process.stdin,
 };
+function warningEventSink(io) {
+    return (event) => {
+        if (event.type === 'warning')
+            io.stderr(`${event.message}\n`);
+    };
+}
 /**
  * Shared runtime model precedence used by every consumer (provider
  * construction, status/doctor output, and the interactive display):
@@ -789,7 +798,7 @@ export function resolveUnknownCostSidecarPath(dataPlane, configRoot) {
     assertNativeDataPlane(dataPlane);
     return join(configRoot, 'state', 'unknown-cost-sidecar.json');
 }
-const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
+const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, approveWorkspaceTrust, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
     const runtimeEnvironment = requestedProviderEnvironment ?? process.env;
     const sandboxEnvironment = { ...runtimeEnvironment, ...environment };
     const claudeVersion = VERIFIED_CLAUDE_SCHEMA_VERSION;
@@ -971,11 +980,58 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             }
             : {}),
     };
+    const warnedWorkspaceFingerprints = new Set();
+    let trustProjectRequestAvailable = cli.trustProject;
+    const authorizeWorkspaceExecutables = async (automaticSettings, automaticMcp, runtimeCwd) => {
+        if (cli.safeMode || simpleMode)
+            return true;
+        const trustRequested = trustProjectRequestAvailable;
+        trustProjectRequestAvailable = false;
+        const inventory = await workspaceTrustInventory({
+            cwd: runtimeCwd,
+            settings: automaticSettings,
+            mcp: automaticMcp,
+        });
+        const assessment = await assessWorkspaceTrust(inventory, claudeStatePath);
+        if (assessment.status !== 'untrusted')
+            return true;
+        let approved = trustRequested;
+        if (!approved && approveWorkspaceTrust) {
+            try {
+                approved = await approveWorkspaceTrust(assessment);
+            }
+            catch (error) {
+                if (!(error instanceof Error &&
+                    (error.name === 'AbortError' || error.name === 'CancellationError'))) {
+                    throw error;
+                }
+                approved = false;
+            }
+        }
+        if (approved) {
+            await persistWorkspaceTrust(assessment, claudeStatePath);
+            return true;
+        }
+        const warningKey = workspaceTrustDecisionKey(assessment);
+        if (!warnedWorkspaceFingerprints.has(warningKey)) {
+            warnedWorkspaceFingerprints.add(warningKey);
+            runtimeEventSink({
+                type: 'warning',
+                message: `Workspace executable resources blocked for ${safeWorkspaceTrustDisplayField(assessment.canonicalPath)}; restart to review them interactively, or rerun with --trust-project to approve the current fingerprint.`,
+            });
+        }
+        return false;
+    };
     const hookConfiguration = async () => {
-        const [settings, pluginResources] = await Promise.all([
+        const [sharedResources, pluginResources] = await Promise.all([
             cli.safeMode || simpleMode
-                ? []
-                : loadNativeSettings({ root: configRoot, cwd }),
+                ? Promise.resolve({ settings: [], mcp: [] })
+                : loadNativeSharedResources({
+                    root: configRoot,
+                    cwd,
+                    environment: runtimeEnvironment,
+                    includeProjectMemory: false,
+                }),
             loadClaudePlugins({
                 configRoot,
                 cwd,
@@ -983,13 +1039,20 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                 pluginUrls: cli.pluginUrls,
                 strictPluginDirectories: cli.pluginDirectories.length + cli.pluginUrls.length > 0,
                 loadInstalled: !cli.safeMode && !simpleMode,
-                readOnlyHooks: true,
+                readOnlyExecutables: true,
                 environment: runtimeEnvironment,
             }),
         ]);
-        return projectTuiHooks([
-            ...settings,
+        const automaticSettings = [
+            ...sharedResources.settings,
             ...pluginResources.settings,
+        ];
+        const automaticMcp = cli.strictMcpConfig
+            ? []
+            : [...sharedResources.mcp, ...pluginResources.mcp];
+        const trusted = await authorizeWorkspaceExecutables(automaticSettings, automaticMcp, cwd);
+        return projectTuiHooks([
+            ...allowedWorkspaceHookSettings(automaticSettings, trusted),
             ...(cli.additionalSettings ? [cli.additionalSettings] : []),
         ]);
     };
@@ -1001,7 +1064,10 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         const service = new ClaudeSessionService(options);
         if (!interactive)
             return service;
-        return Object.assign(service, { hookConfiguration });
+        const initialHookConfiguration = await hookConfiguration();
+        return Object.assign(service, {
+            hookConfiguration: () => Promise.resolve(initialHookConfiguration),
+        });
     }
     const toolProvider = provider ?? {
         model: 'praxis/provider',
@@ -1034,7 +1100,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
     const baseSettings = nativeSharedResourcesEnabled
         ? await loadNativeSettings({ root: configRoot, cwd })
         : [];
-    const pluginResources = await loadClaudePlugins({
+    const pluginLoadOptions = {
         configRoot,
         cwd,
         pluginDirectories: cli.pluginDirectories,
@@ -1042,6 +1108,10 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         strictPluginDirectories: cli.pluginDirectories.length + cli.pluginUrls.length > 0,
         loadInstalled: !cli.safeMode && !simpleMode,
         environment: runtimeEnvironment,
+    };
+    const executablePluginResources = await loadClaudePlugins({
+        ...pluginLoadOptions,
+        readOnlyExecutables: true,
     });
     const projectMemoryPolicy = cli.safeMode || simpleMode
         ? { enabled: false, extraction: false, recall: false }
@@ -1049,7 +1119,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             dataPlane,
             settings: [
                 ...baseSettings,
-                ...pluginResources.settings,
+                ...executablePluginResources.settings,
                 ...(cli.additionalSettings ? [cli.additionalSettings] : []),
             ],
             environment: runtimeEnvironment,
@@ -1071,7 +1141,42 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             settings: [],
             mcp: [],
         };
-    const settings = [
+    const trustSettings = [
+        ...loadedResources.settings,
+        ...executablePluginResources.settings,
+    ];
+    const trustMcp = cli.strictMcpConfig
+        ? []
+        : [...loadedResources.mcp, ...executablePluginResources.mcp];
+    const workspaceExecutablesTrusted = await authorizeWorkspaceExecutables(trustSettings, trustMcp, cwd);
+    const loadedPluginResources = await loadClaudePlugins({
+        ...pluginLoadOptions,
+        allowWorkspaceMcpb: workspaceExecutablesTrusted,
+    });
+    const materializedPluginMcp = new Map(loadedPluginResources.mcp.map((resource) => [resource.path, resource]));
+    const pluginResources = {
+        ...loadedPluginResources,
+        settings: executablePluginResources.settings,
+        mcp: executablePluginResources.mcp.flatMap((resource) => {
+            if (resource.pluginExecutableSource?.kind !== 'mcpb')
+                return [resource];
+            const materialized = materializedPluginMcp.get(resource.path);
+            if (!materialized)
+                return [];
+            if (materialized.pluginExecutableSource?.source !==
+                resource.pluginExecutableSource.source ||
+                materialized.pluginExecutableSource.fingerprint !==
+                    resource.pluginExecutableSource.fingerprint) {
+                runtimeEventSink({
+                    type: 'warning',
+                    message: `Workspace MCPB source changed during trust preflight and was blocked: ${safeWorkspaceTrustDisplayField(resource.path)}. Restart to review the new fingerprint.`,
+                });
+                return [];
+            }
+            return [materialized];
+        }),
+    };
+    const allSettings = [
         ...loadedResources.settings,
         ...pluginResources.settings,
         ...(cli.additionalSettings ? [cli.additionalSettings] : []),
@@ -1084,7 +1189,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             });
         }
     }
-    const configuredAgent = [...settings]
+    const configuredAgent = [...allSettings]
         .reverse()
         .map((resource) => resource.value &&
         typeof resource.value === 'object' &&
@@ -1093,6 +1198,21 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         : undefined)
         .find((value) => typeof value === 'string' && value.length > 0);
     const selectedMainAgent = agent ?? configuredAgent;
+    const automaticSettings = [
+        ...loadedResources.settings,
+        ...pluginResources.settings,
+    ];
+    const automaticMcp = cli.strictMcpConfig
+        ? []
+        : [...loadedResources.mcp, ...pluginResources.mcp];
+    const hookSettings = [
+        ...allowedWorkspaceHookSettings(automaticSettings, workspaceExecutablesTrusted),
+        ...(cli.additionalSettings ? [cli.additionalSettings] : []),
+    ];
+    const executableMcp = [
+        ...allowedWorkspaceMcpResources(automaticMcp, workspaceExecutablesTrusted),
+        ...cli.mcpResources,
+    ];
     const resources = {
         ...loadedResources,
         commands: [...loadedResources.commands, ...pluginResources.commands],
@@ -1102,10 +1222,8 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
             ...pluginResources.agents,
             ...cli.inlineAgents,
         ],
-        settings,
-        mcp: cli.strictMcpConfig
-            ? cli.mcpResources
-            : [...loadedResources.mcp, ...pluginResources.mcp, ...cli.mcpResources],
+        settings: allSettings,
+        mcp: executableMcp,
     };
     const extensions = new ClaudeExtensionCatalog(resources, {
         disableSlashCommands: cli.disableSlashCommands,
@@ -1174,7 +1292,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...(exposePlanDirectory ? [resolve(configRoot, 'plans')] : []),
     ];
     const sandboxSettings = loadClaudeSandboxSettings({
-        resources: settings.filter((resource) => resource.plugin !== true),
+        resources: allSettings.filter((resource) => resource.plugin !== true),
         cwd: workspace.cwd(),
         originalCwd: sandboxOriginalCwd ?? workspace.cwd(),
         configRoot,
@@ -1200,7 +1318,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         cwd,
         cwdProvider: () => workspace.cwd(),
         configRoot,
-        settings,
+        settings: allSettings,
         allowedTools: cli.allowedTools,
         disallowedTools: cli.disallowedTools,
         additionalDirectories: permissionAdditionalDirectories,
@@ -1275,9 +1393,14 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                     settings: [],
                     mcp: [],
                 };
+            const refreshedSettings = [
+                ...refreshed.settings,
+                ...pluginResources.settings,
+            ];
+            const refreshedMcp = [...refreshed.mcp, ...pluginResources.mcp];
+            const trusted = await authorizeWorkspaceExecutables(refreshedSettings, refreshedMcp, workspace.cwd());
             return runtimeMcpResources([
-                ...refreshed.mcp,
-                ...pluginResources.mcp,
+                ...allowedWorkspaceMcpResources(refreshedMcp, trusted),
                 ...cli.mcpResources,
             ]);
         },
@@ -1439,7 +1562,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         const hooks = cli.safeMode || simpleMode
             ? undefined
             : new ClaudeHookRunner({
-                settings,
+                settings: hookSettings,
                 cwd,
                 onEvent: (event) => runtimeEventSink({ type: 'hook', event }),
                 sessionEnvironment: hookSessionEnvironment,
@@ -1771,7 +1894,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
                     ? {}
                     : { progressMessage: definition.progressMessage }),
             })),
-            hookConfiguration: async () => projectTuiHooks(settings),
+            hookConfiguration: async () => projectTuiHooks(hookSettings),
             mcpInspect: () => service.mcpInspect(),
             mcpReconnect: (name) => service.mcpReconnect(name),
             mcpAuthenticate: (name) => service.mcpAuthenticate(name),
@@ -2051,6 +2174,14 @@ export function createDefaultDependencies(entrypoint = fileURLToPath(import.meta
         runInteractive: async ({ agent, controls, initialPrompt, resume, signal, }) => {
             const { runInteractive } = await import('./cli/interactive.js');
             const interactiveControls = controls ?? DEFAULT_CLI_CONTROLS;
+            let workspaceTrustPreflightOpen = true;
+            const cachedWorkspaceTrustDecision = createWorkspaceTrustDecisionCache((request) => promptWorkspaceTrust(request, {
+                output: (text) => process.stderr.write(text),
+                ...(signal ? { signal } : {}),
+            }));
+            const approveInteractiveWorkspaceTrust = (request) => workspaceTrustPreflightOpen
+                ? cachedWorkspaceTrustDecision(request)
+                : Promise.resolve(false);
             const initialAdditionalDirectories = interactiveControls.addDirectories.map((directory) => realpathSync(resolve(process.cwd(), directory)));
             const interactiveDataPlane = interactiveControls.dataPlane ?? resolveDataPlane();
             const { configRoot: interactiveConfigRoot, statePath: interactiveStatePath, } = resolveInteractiveRuntimeSettingsLocation(interactiveDataPlane);
@@ -2079,11 +2210,14 @@ export function createDefaultDependencies(entrypoint = fileURLToPath(import.meta
                     ...(agent === undefined ? {} : { agent }),
                     controls: {
                         ...interactiveControls,
+                        trustProject: workspaceTrustPreflightOpen && interactiveControls.trustProject,
                         addDirectories: options.additionalDirectories ??
                             interactiveControls.addDirectories,
                     },
                     interactive: true,
+                    approveWorkspaceTrust: approveInteractiveWorkspaceTrust,
                 });
+                workspaceTrustPreflightOpen = false;
                 if (resumePath !== undefined) {
                     await commands.registerResumePath?.(resumePath);
                 }
@@ -3491,7 +3625,7 @@ async function executeMcpCommand(args, invocation, io, dependencies, signal) {
             writeError: (message) => io.stderr(message),
             createToolRegistry: async () => {
                 const service = await dependencies.createService({
-                    eventSink: () => undefined,
+                    eventSink: warningEventSink(io),
                     requireProvider: false,
                     exposeToolRegistry: true,
                     approveTool: async () => true,
@@ -4273,7 +4407,7 @@ async function executeTeamCommand(args, io, dependencies, signal) {
         dataPlane: 'native',
     };
     const service = await dependencies.createService({
-        eventSink: () => undefined,
+        eventSink: warningEventSink(io),
         requireProvider: !['list', 'status', 'logs', 'attach'].includes(parsed.command),
         exposeToolRegistry: true,
         controls: nativeControls,
@@ -4594,7 +4728,7 @@ async function execute(argv, io, dependencies, signal) {
     }
     if (invocation.initOnly) {
         const lifecycleService = await dependencies.createService({
-            eventSink: () => undefined,
+            eventSink: warningEventSink(io),
             requireProvider: false,
             exposeToolRegistry: true,
             ...(signal ? { signal } : {}),

package/dist/core/resources.d.ts

@@ -13,6 +13,11 @@ export interface JsonResource {
     plugin?: true;
     pluginName?: string;
     pluginSource?: string;
+    pluginExecutableSource?: {
+        kind: 'mcpb';
+        source: string;
+        fingerprint: string;
+    };
     environment?: Readonly<Record<string, string>>;
     sensitiveValues?: readonly string[];
 }

package/dist/plugins/claude-plugin-mcpb.d.ts

@@ -1,4 +1,5 @@
 import { type DataPlane } from '../persistence/data-plane.js';
+export declare const CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES: number;
 export type ClaudePluginMcpbUserValue = string | number | boolean | readonly string[];
 export interface ClaudePluginMcpbManifest {
     manifest_version: string;
@@ -60,6 +61,7 @@ export interface LoadClaudePluginMcpbOptions {
     signal?: AbortSignal;
     timeoutMs?: number;
     refresh?: boolean;
+    requireHttps?: boolean;
     limits?: ClaudePluginMcpbLimits;
     fetch?: typeof fetch;
 }

package/dist/plugins/claude-plugin-mcpb.js

@@ -13,6 +13,7 @@ import manifestSchemaV04 from './mcpb-schemas/mcpb-manifest-v0.4.schema.json' wi
 import { ExclusiveFileLease, } from '../platform/exclusive-file-lease.js';
 import { resolveDataPlaneRoot, } from '../persistence/data-plane.js';
 const DEFAULT_ARCHIVE_BYTES = 512 * 1024 * 1024;
+export const CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES = DEFAULT_ARCHIVE_BYTES;
 const DEFAULT_EXTRACTED_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_FILE_BYTES = 512 * 1024 * 1024;
 const DEFAULT_FILES = 100_000;
@@ -540,9 +541,14 @@ async function fetchArchive(source, cached, options, signal, archiveLimit) {
                 throw new Error('MCPB download redirect is missing Location');
             }
             const redirected = new URL(location, requestUrl);
-            if (redirected.protocol !== 'http:' && redirected.protocol !== 'https:') {
+            if ((options.requireHttps && redirected.protocol !== 'https:') ||
+                (!options.requireHttps &&
+                    redirected.protocol !== 'http:' &&
+                    redirected.protocol !== 'https:')) {
                 await response.body?.cancel();
-                throw new Error('MCPB download redirect must use HTTP or HTTPS');
+                throw new Error(options.requireHttps
+                    ? 'MCPB download redirect must use HTTPS'
+                    : 'MCPB download redirect must use HTTP or HTTPS');
             }
             await response.body?.cancel();
             if (++redirects > 5) {
@@ -627,6 +633,9 @@ async function resolveMcpbSource(options, signal) {
     const pluginRoot = await realpath(resolve(options.pluginRoot));
     signal.throwIfAborted();
     const remote = /^https?:\/\//u.test(options.source);
+    if (options.requireHttps && remote && !/^https:\/\//u.test(options.source)) {
+        throw new Error('MCPB download source must use HTTPS');
+    }
     if (!remote && /^[a-z][a-z0-9+.-]*:\/\//iu.test(options.source))
         throw new Error('MCPB source URL must use HTTP or HTTPS');
     if (!['.mcpb', '.dxt'].some((extension) => options.source.endsWith(extension))) {

package/dist/plugins/claude-plugin-runtime.d.ts

@@ -108,6 +108,8 @@ export declare function loadClaudePlugins(options: {
     pluginUrls?: readonly string[];
     loadInstalled?: boolean;
     readOnlyHooks?: boolean;
+    readOnlyExecutables?: boolean;
+    allowWorkspaceMcpb?: boolean;
     environment?: Readonly<Record<string, string | undefined>>;
 }): Promise<ClaudePluginResources>;
 export declare function validateClaudePlugin(path: string, options?: {

package/dist/plugins/claude-plugin-runtime.js

@@ -1,3 +1,5 @@
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
 import { cp, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile, } from 'node:fs/promises';
 import { execFile } from 'node:child_process';
 import { basename, dirname, extname, join, relative, resolve } from 'node:path';
@@ -5,8 +7,34 @@ import { promisify } from 'node:util';
 import { parse as parseYaml } from 'yaml';
 import { countTokens } from '@anthropic-ai/tokenizer';
 import { claudePluginDataPath, materializeClaudePluginSource, readClaudePluginOptions, readClaudePluginMcpServerOptions, readClaudeSkillsDirectoryPlugins, replaceClaudePluginDirectory, readClaudeInstalledPlugins, validateClaudePluginUserConfig, } from './claude-plugin-marketplace.js';
-import { loadClaudePluginMcpb } from './claude-plugin-mcpb.js';
+import { CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES, loadClaudePluginMcpb, } from './claude-plugin-mcpb.js';
 const execFileAsync = promisify(execFile);
+async function boundedFileSha256(path) {
+    const metadata = await stat(path);
+    if (!metadata.isFile()) {
+        throw new Error(`MCPB archive must be a regular file: ${path}`);
+    }
+    if (metadata.size > CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES) {
+        throw new Error(`MCPB archive exceeds ${CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES} bytes`);
+    }
+    const source = createReadStream(path);
+    const hash = createHash('sha256');
+    let bytes = 0;
+    try {
+        for await (const chunk of source) {
+            const value = chunk;
+            bytes += value.byteLength;
+            if (bytes > CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES) {
+                throw new Error(`MCPB archive exceeds ${CLAUDE_PLUGIN_MCPB_ARCHIVE_BYTES} bytes`);
+            }
+            hash.update(value);
+        }
+        return hash.digest('hex');
+    }
+    finally {
+        source.destroy();
+    }
+}
 const PLUGIN_MANIFEST = join('.claude-plugin', 'plugin.json');
 const LEGACY_MANIFEST = 'plugin.json';
 const MAX_PLUGIN_FILES = 2_000;
@@ -139,6 +167,16 @@ function safePluginPath(pluginPath, candidate) {
     }
     return resolved;
 }
+async function canonicalPluginPath(pluginPath, candidate) {
+    const [root, resolved] = await Promise.all([
+        realpath(pluginPath),
+        realpath(candidate),
+    ]);
+    if (resolved !== root && !resolved.startsWith(`${root}/`)) {
+        throw new Error(`Plugin path escapes plugin root: ${candidate}`);
+    }
+    return resolved;
+}
 async function assertPluginPath(pluginPath, candidate) {
     let resolved;
     try {
@@ -462,7 +500,7 @@ async function loadLspServers(root, manifest, source, configRoot, environment, u
     }
     return [...definitions.values()];
 }
-async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = false, resourceScope, configRoot, environment = process.env, configId, readOnlyHooks = false, dataPlane) {
+async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = false, resourceScope, configRoot, environment = process.env, configId, readOnlyHooks = false, readOnlyExecutables = false, allowWorkspaceMcpb = true, dataPlane) {
     const canonical = await realpath(pluginPath);
     if (!(await isDirectory(canonical)))
         throw new Error(`Plugin path is not a directory: ${pluginPath}`);
@@ -480,7 +518,8 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
         : [])
         .filter((value) => value.length > 0);
     const pluginData = claudePluginDataPath(configRoot ?? canonical, source);
-    if (configRoot !== undefined && !readOnlyHooks) {
+    const readOnlyComponents = readOnlyHooks || readOnlyExecutables;
+    if (configRoot !== undefined && !readOnlyComponents) {
         await mkdir(pluginData, { recursive: true });
     }
     const pluginEnvironment = pluginOptionEnvironment(canonical, pluginData, userConfig);
@@ -491,7 +530,7 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
         environment: pluginEnvironment,
         ...(sensitiveValues.length === 0 ? {} : { sensitiveValues }),
     };
-    const scope = resourceScope ?? scopeForPath(canonical, cwd);
+    const scope = resourceScope ?? scopeForPath(canonical, await realpath(resolve(cwd)));
     const commandDefinitions = isRecord(manifest.commands)
         ? manifest.commands
         : undefined;
@@ -506,7 +545,7 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
         ? [join(canonical, 'skills'), canonical]
         : pathList(manifest.skills, 'skills').map((path) => safePluginPath(canonical, path));
     const agentsRoots = pathList(manifest.agents, 'agents').map((path) => safePluginPath(canonical, path));
-    const [commands, skills, agents, lsp] = readOnlyHooks
+    const [commands, skills, agents, lsp] = readOnlyComponents
         ? [[], [], [], []]
         : await (async () => {
             const [commandFiles, skillFiles, agentFiles, loadedLsp] = await Promise.all([
@@ -524,7 +563,7 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
             ]);
             return [...loadedText, loadedLsp];
         })();
-    if (commandDefinitions && !readOnlyHooks) {
+    if (commandDefinitions && !readOnlyComponents) {
         for (const [commandName, definition] of Object.entries(commandDefinitions)) {
             if (definition.content !== undefined) {
                 commands.push({
@@ -649,17 +688,61 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
             if (typeof spec === 'string') {
                 const urlReference = isUrlReference(spec);
                 if ((urlReference &&
-                    (!/^https?:\/\//u.test(spec) || !isMcpbReference(spec))) ||
+                    (!/^https?:\/\//u.test(spec) ||
+                        !isMcpbReference(spec) ||
+                        (scope !== 'user' && !/^https:\/\//u.test(spec)))) ||
                     (!urlReference && isMcpbReference(spec) && !spec.startsWith('./'))) {
                     mcpErrors.push(`Invalid plugin MCPB reference at index ${index}: expected ./file.mcpb, ./file.dxt, or an exact-suffix HTTP(S) URL`);
                     continue;
                 }
                 if (isMcpbReference(spec)) {
+                    let mcpbPath;
+                    let sourceFingerprint;
+                    try {
+                        mcpbPath = urlReference
+                            ? join(canonical, '.claude-plugin', `plugin-mcpb-${index}.json`)
+                            : await canonicalPluginPath(canonical, safePluginPath(canonical, spec));
+                        sourceFingerprint = createHash('sha256')
+                            .update(urlReference ? spec : await boundedFileSha256(mcpbPath))
+                            .digest('hex');
+                    }
+                    catch (error) {
+                        mcpErrors.push(`Invalid plugin MCPB reference at index ${index}: ${error instanceof Error ? error.message : String(error)}`);
+                        continue;
+                    }
+                    const pluginExecutableSource = {
+                        kind: 'mcpb',
+                        source: spec,
+                        fingerprint: sourceFingerprint,
+                    };
+                    if (readOnlyExecutables) {
+                        mcp.push({
+                            path: mcpbPath,
+                            scope,
+                            plugin: true,
+                            value: {
+                                mcpServers: {
+                                    [`plugin:${manifest.name}:mcpb-${index}`]: {
+                                        type: 'mcpb-reference',
+                                        source: spec,
+                                        fingerprint: sourceFingerprint,
+                                    },
+                                },
+                            },
+                            environment: pluginEnvironment,
+                            pluginExecutableSource,
+                            sensitiveValues,
+                        });
+                        continue;
+                    }
+                    if (scope !== 'user' && !allowWorkspaceMcpb)
+                        continue;
                     try {
                         const loaded = await loadClaudePluginMcpb({
                             pluginRoot: canonical,
                             pluginData,
                             source: spec,
+                            requireHttps: scope !== 'user',
                             ...(configRoot === undefined ? {} : { configRoot }),
                             ...(dataPlane === undefined ? {} : { dataPlane }),
                             environment,
@@ -667,8 +750,14 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
                                 ? readClaudePluginMcpServerOptions(configRoot, cwd, configId, bundleManifest.name, bundleManifest.user_config, dataPlane)
                                 : {},
                         });
+                        if (!urlReference &&
+                            createHash('sha256')
+                                .update(await boundedFileSha256(mcpbPath))
+                                .digest('hex') !== sourceFingerprint) {
+                            throw new Error(`Plugin MCPB source changed while loading: ${mcpbPath}`);
+                        }
                         mcp.push({
-                            path: join(canonical, '.claude-plugin', `plugin-mcpb-${index}.json`),
+                            path: mcpbPath,
                             scope,
                             plugin: true,
                             value: {
@@ -677,6 +766,7 @@ async function loadPlugin(pluginPath, source, enabled, cwd, requireManifest = fa
                                 },
                             },
                             environment: pluginEnvironment,
+                            pluginExecutableSource,
                             sensitiveValues: [...sensitiveValues, ...loaded.sensitiveValues],
                         });
                     }
@@ -840,7 +930,7 @@ export async function loadClaudePlugins(options) {
                 if (seen.has(canonical))
                     return null;
                 seen.add(canonical);
-                return await loadPlugin(canonical, candidate.source, candidate.enabled, options.cwd, false, candidate.resourceScope, options.configRoot, options.environment ?? process.env, candidate.configId, options.readOnlyHooks, options.dataPlane);
+                return await loadPlugin(canonical, candidate.source, candidate.enabled, options.cwd, false, candidate.resourceScope, options.configRoot, options.environment ?? process.env, candidate.configId, options.readOnlyHooks, options.readOnlyExecutables, options.allowWorkspaceMcpb, options.dataPlane);
             }
             catch (error) {
                 if (options.strictPluginDirectories &&

package/dist/security/workspace-trust.d.ts

@@ -0,0 +1,30 @@
+import type { JsonResource } from '../core/resources.js';
+export interface WorkspaceExecutableOrigin {
+    readonly kind: 'hook' | 'mcp';
+    readonly scope: 'project' | 'local';
+    readonly path: string;
+    readonly label: string;
+}
+export interface WorkspaceTrustInventory {
+    readonly canonicalPath: string;
+    readonly fingerprint: string;
+    readonly origins: readonly WorkspaceExecutableOrigin[];
+}
+export type WorkspaceTrustStatus = 'not-required' | 'trusted' | 'untrusted';
+export interface WorkspaceTrustAssessment extends WorkspaceTrustInventory {
+    readonly status: WorkspaceTrustStatus;
+}
+export declare function canonicalizeWorkspaceTrust(value: unknown, ancestors?: Set<object>): string;
+export declare function hasWorkspaceHooks(resource: JsonResource): boolean;
+export declare function hasWorkspaceMcpServers(resource: JsonResource): boolean;
+export declare function allowedWorkspaceHookSettings(resources: readonly JsonResource[], trusted: boolean): JsonResource[];
+export declare function allowedWorkspaceMcpResources(resources: readonly JsonResource[], trusted: boolean): JsonResource[];
+export declare function workspaceTrustInventory(options: {
+    cwd: string;
+    settings?: readonly JsonResource[];
+    mcp?: readonly JsonResource[];
+}): Promise<WorkspaceTrustInventory>;
+export declare function workspaceTrustDecisionKey(inventory: Pick<WorkspaceTrustInventory, 'canonicalPath' | 'fingerprint'>): string;
+export declare function assessWorkspaceTrust(inventory: WorkspaceTrustInventory, statePath: string): Promise<WorkspaceTrustAssessment>;
+export declare function persistWorkspaceTrust(assessment: WorkspaceTrustAssessment, statePath: string): Promise<void>;
+//# sourceMappingURL=workspace-trust.d.ts.map

package/dist/security/workspace-trust.js

@@ -0,0 +1,278 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { writeFileAtomically } from '../platform/atomic-write.js';
+import { ExclusiveFileLease } from '../platform/exclusive-file-lease.js';
+const MISSING_FINGERPRINT = 'missing';
+const TRUST_VERSION = 1;
+const FINGERPRINT_PATTERN = /^[a-f0-9]{64}$/u;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function canonicalizeWorkspaceTrust(value, ancestors = new Set()) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError('Workspace trust config contains a non-JSON number');
+        return JSON.stringify(value);
+    }
+    if (typeof value !== 'object')
+        throw new TypeError('Workspace trust config contains a non-JSON value');
+    if (ancestors.has(value))
+        throw new TypeError('Workspace trust config contains a cycle');
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return `[${value
+                .map((item) => canonicalizeWorkspaceTrust(item, ancestors))
+                .join(',')}]`;
+        }
+        return `{${Object.keys(value)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonicalizeWorkspaceTrust(value[key], ancestors)}`)
+            .join(',')}}`;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+function executableMap(resource, kind) {
+    if (!isRecord(resource.value))
+        return null;
+    const key = kind === 'hook' ? 'hooks' : 'mcpServers';
+    const value = resource.value[key];
+    return isRecord(value) && Object.keys(value).length > 0 ? value : null;
+}
+export function hasWorkspaceHooks(resource) {
+    return executableMap(resource, 'hook') !== null;
+}
+export function hasWorkspaceMcpServers(resource) {
+    return executableMap(resource, 'mcp') !== null;
+}
+export function allowedWorkspaceHookSettings(resources, trusted) {
+    if (trusted)
+        return [...resources];
+    return resources.filter((resource) => resource.scope === 'user' || !hasWorkspaceHooks(resource));
+}
+export function allowedWorkspaceMcpResources(resources, trusted) {
+    if (trusted)
+        return [...resources];
+    return resources.filter((resource) => resource.scope === 'user' || !hasWorkspaceMcpServers(resource));
+}
+async function resolvedResourcePath(canonicalPath, requestedWorkspace, path) {
+    if (path.startsWith('<'))
+        return path;
+    const absolute = isAbsolute(path)
+        ? resolve(path)
+        : resolve(requestedWorkspace, path);
+    const workspaceRelative = relative(requestedWorkspace, absolute);
+    if (workspaceRelative === '' ||
+        (!workspaceRelative.startsWith('..') && !isAbsolute(workspaceRelative))) {
+        const canonicalSource = resolve(canonicalPath, workspaceRelative);
+        try {
+            return await realpath(canonicalSource);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return canonicalSource;
+            }
+            throw error;
+        }
+    }
+    try {
+        return await realpath(absolute);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return absolute;
+        throw error;
+    }
+}
+export async function workspaceTrustInventory(options) {
+    const canonicalPath = await realpath(options.cwd);
+    const requestedWorkspace = resolve(options.cwd);
+    const origins = [];
+    const fingerprintEntries = [];
+    const collect = async (resources, kind) => {
+        for (const resource of resources) {
+            if (resource.scope === 'user')
+                continue;
+            const entries = executableMap(resource, kind);
+            if (!entries)
+                continue;
+            const path = await resolvedResourcePath(canonicalPath, requestedWorkspace, resource.path);
+            for (const [label, config] of Object.entries(entries)) {
+                const entry = {
+                    kind,
+                    scope: resource.scope,
+                    path,
+                    label,
+                    config,
+                    ...(kind === 'hook' && resource.environment !== undefined
+                        ? { environment: resource.environment }
+                        : {}),
+                };
+                fingerprintEntries.push(entry);
+                origins.push({ kind, scope: resource.scope, path, label });
+            }
+        }
+    };
+    await collect(options.settings ?? [], 'hook');
+    await collect(options.mcp ?? [], 'mcp');
+    const sortedEntries = fingerprintEntries
+        .map((entry) => canonicalizeWorkspaceTrust(entry))
+        .sort();
+    origins.sort((left, right) => canonicalizeWorkspaceTrust(left).localeCompare(canonicalizeWorkspaceTrust(right)));
+    return {
+        canonicalPath,
+        fingerprint: createHash('sha256')
+            .update(`[${sortedEntries.join(',')}]`)
+            .digest('hex'),
+        origins,
+    };
+}
+export function workspaceTrustDecisionKey(inventory) {
+    return `${inventory.canonicalPath}\0${inventory.fingerprint}`;
+}
+function validateInventory(inventory) {
+    if (!inventory.canonicalPath ||
+        !isAbsolute(inventory.canonicalPath) ||
+        resolve(inventory.canonicalPath) !== inventory.canonicalPath) {
+        throw new TypeError('Workspace trust requires a canonical absolute path');
+    }
+    if (!FINGERPRINT_PATTERN.test(inventory.fingerprint))
+        throw new TypeError('Workspace trust fingerprint must be lowercase SHA-256');
+    for (const origin of inventory.origins) {
+        if ((origin.kind !== 'hook' && origin.kind !== 'mcp') ||
+            (origin.scope !== 'project' && origin.scope !== 'local') ||
+            origin.path.length === 0 ||
+            origin.label.length === 0) {
+            throw new TypeError('Workspace trust inventory contains an invalid origin');
+        }
+    }
+}
+async function readState(path) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOENT')
+            return { content: null, fingerprint: MISSING_FINGERPRINT };
+        if (code === 'ELOOP')
+            throw new Error(`Workspace trust state must be a regular file: ${path}`, {
+                cause: error,
+            });
+        throw error;
+    }
+    try {
+        if (!(await handle.stat()).isFile())
+            throw new Error(`Workspace trust state must be a regular file: ${path}`);
+        const content = await handle.readFile('utf8');
+        return {
+            content,
+            fingerprint: createHash('sha256').update(content).digest('hex'),
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function parseStateRoot(content, path) {
+    if (content === null)
+        return {};
+    let value;
+    try {
+        value = JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Invalid workspace trust state: ${path}`, { cause: error });
+    }
+    if (!isRecord(value))
+        throw new Error(`Workspace trust state root must be an object: ${path}`);
+    return value;
+}
+function projectState(root, canonicalPath, statePath) {
+    if (root.projects !== undefined && !isRecord(root.projects))
+        throw new Error(`Workspace trust projects must be an object: ${statePath}`);
+    if (isRecord(root.projects)) {
+        for (const [path, project] of Object.entries(root.projects)) {
+            if (!isRecord(project)) {
+                throw new Error(`Workspace trust project entry must be an object: ${statePath} (${path})`);
+            }
+        }
+    }
+    const project = isRecord(root.projects)
+        ? root.projects[canonicalPath]
+        : undefined;
+    return isRecord(project) ? project : undefined;
+}
+function matchesRecord(value, fingerprint) {
+    return (isRecord(value) &&
+        value.version === TRUST_VERSION &&
+        value.fingerprint === fingerprint &&
+        typeof value.acceptedAt === 'string' &&
+        Number.isFinite(Date.parse(value.acceptedAt)));
+}
+export async function assessWorkspaceTrust(inventory, statePath) {
+    validateInventory(inventory);
+    if (inventory.origins.length === 0)
+        return { ...inventory, status: 'not-required' };
+    const root = parseStateRoot((await readState(statePath)).content, statePath);
+    const project = projectState(root, inventory.canonicalPath, statePath);
+    return {
+        ...inventory,
+        status: matchesRecord(project?.workspaceTrust, inventory.fingerprint)
+            ? 'trusted'
+            : 'untrusted',
+    };
+}
+async function acquireStateLease(statePath) {
+    const lease = new ExclusiveFileLease(join(dirname(statePath), '.praxis-state.lock'));
+    for (let attempt = 0; attempt < 400; attempt += 1) {
+        const handle = await lease.tryAcquire();
+        if (handle)
+            return handle;
+        await sleep(5);
+    }
+    throw new Error(`Timed out acquiring workspace trust lock: ${statePath}`);
+}
+export async function persistWorkspaceTrust(assessment, statePath) {
+    validateInventory(assessment);
+    if (assessment.status === 'not-required' || assessment.origins.length === 0) {
+        throw new TypeError('Cannot persist an empty workspace trust assessment');
+    }
+    const lease = await acquireStateLease(statePath);
+    try {
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            const current = await readState(statePath);
+            const root = parseStateRoot(current.content, statePath);
+            const existingProject = projectState(root, assessment.canonicalPath, statePath);
+            const projects = isRecord(root.projects) ? { ...root.projects } : {};
+            projects[assessment.canonicalPath] = {
+                ...(existingProject ?? {}),
+                workspaceTrust: {
+                    version: TRUST_VERSION,
+                    fingerprint: assessment.fingerprint,
+                    acceptedAt: new Date().toISOString(),
+                },
+            };
+            const next = { ...root, projects };
+            const committed = await writeFileAtomically(statePath, `${JSON.stringify(next, null, 2)}\n`, {
+                mode: 0o600,
+                beforeCommit: async () => (await readState(statePath)).fingerprint === current.fingerprint,
+            });
+            if (committed)
+                return;
+        }
+        throw new Error(`Workspace trust state changed concurrently: ${statePath}`);
+    }
+    finally {
+        await lease.release();
+    }
+}
+//# sourceMappingURL=workspace-trust.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",