talos-code 0.0.1 → 0.1.0

package/dist/security/project-resource-inventory.js

@@ -0,0 +1,186 @@
+import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { fingerprintExecutableResource, fingerprintExecutableResourceContent } from "./project-trust.js";
+import { isPathInsideWorkspace } from "./workspace-identity.js";
+// A plugin package contributes EVERY file it carries, not just its manifest: a manifest only
+// inventory lets the code an approval covered be replaced underneath that approval. Deciding which
+// extensions are "really" executable would be a judgement about safety, which this inventory does
+// not make - it only decides what trust must be able to NOTICE.
+// The walk is bounded so a package carrying node_modules cannot turn a trust check into a stall,
+// and the bound fails CLOSED: truncating the walk would reopen the same hole somewhere deeper.
+// Measured on Windows 11 / Node 24.18, warm cache: 10 000 files = ~98 ms walk + ~370 ms fingerprint
+// at concurrency 32. Fingerprinting the same set with an unbounded Promise.all dies with EMFILE.
+export const PLUGIN_PACKAGE_MAX_FILES = 10_000;
+const FINGERPRINT_CONCURRENCY = 32;
+async function entryKind(pathname) { try {
+    const value = await lstat(pathname);
+    if (value.isSymbolicLink())
+        return 'symlink';
+    if (value.isFile())
+        return 'file';
+    if (value.isDirectory())
+        return 'directory';
+    return null;
+}
+catch (error) {
+    if (error.code === 'ENOENT')
+        return null;
+    throw error;
+} }
+function fail(code) { throw Object.assign(new Error(code), { code }); }
+function relativeId(root, pathname) { return path.relative(root, pathname).split(path.sep).join('/'); }
+async function walkFiles(root, accept) {
+    const rootKind = await entryKind(root);
+    if (rootKind === null)
+        return [];
+    if (rootKind === 'symlink')
+        fail('RESOURCE_DIRECTORY_SYMLINK_UNSUPPORTED');
+    if (rootKind !== 'directory')
+        return [];
+    const files = [];
+    async function walk(directory) { for (const entry of await readdir(directory, { withFileTypes: true })) {
+        const pathname = path.join(directory, entry.name);
+        if (entry.isSymbolicLink()) {
+            if (accept(pathname))
+                files.push(pathname);
+            else
+                fail('RESOURCE_DIRECTORY_SYMLINK_UNSUPPORTED');
+        }
+        else if (entry.isDirectory())
+            await walk(pathname);
+        else if (entry.isFile() && accept(pathname))
+            files.push(pathname);
+    } }
+    await walk(root);
+    return files.sort();
+}
+// Every link is refused rather than followed or skipped: following one lets the walk leave the
+// package, skipping one lets a file the package can load stay outside the fingerprint. Both
+// directions are the same hole, so neither is tolerated.
+async function walkPackageFiles(packageRoot, limit) {
+    const files = [];
+    async function walk(directory) { for (const entry of await readdir(directory, { withFileTypes: true })) {
+        const pathname = path.join(directory, entry.name);
+        if (entry.isSymbolicLink())
+            fail('RESOURCE_DIRECTORY_SYMLINK_UNSUPPORTED');
+        else if (entry.isDirectory())
+            await walk(pathname);
+        else if (entry.isFile()) {
+            if (files.length >= limit)
+                fail('RESOURCE_PACKAGE_TOO_LARGE');
+            files.push(pathname);
+        }
+    } }
+    await walk(packageRoot);
+    return files.sort();
+}
+async function mapBounded(items, limit, handler) {
+    const results = new Array(items.length);
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => { for (;;) {
+        const index = cursor++;
+        if (index >= items.length)
+            return;
+        results[index] = await handler(items[index]);
+    } }));
+    return results;
+}
+async function fixedFile(root, relative, kind, candidates) { const pathname = path.join(root, relative); const value = await entryKind(pathname); if (value === 'file' || value === 'symlink')
+    candidates.push({ kind, id: relative, path: pathname }); }
+async function safeConfigText(workspace, pathname) {
+    const canonical = await realpath(pathname);
+    if (!isPathInsideWorkspace(workspace, canonical))
+        fail('RESOURCE_OUTSIDE_WORKSPACE');
+    return readFile(canonical, 'utf8');
+}
+function uniqueId(value, seen) { if (typeof value !== 'string' || value.length === 0)
+    fail('RESOURCE_CONFIG_MALFORMED'); if (seen.has(value))
+    fail('RESOURCE_ID_DUPLICATE'); seen.add(value); return value; }
+async function hookCandidates(workspace, candidates) {
+    const pathname = path.join(workspace.canonicalRoot, '.harness-ui-hooks.json');
+    const kind = await entryKind(pathname);
+    if (kind === null)
+        return;
+    if (kind !== 'file' && kind !== 'symlink')
+        fail('RESOURCE_CONFIG_MALFORMED');
+    let data;
+    try {
+        data = JSON.parse(await safeConfigText(workspace, pathname));
+    }
+    catch (error) {
+        if (error?.code === 'RESOURCE_OUTSIDE_WORKSPACE')
+            throw error;
+        fail('RESOURCE_CONFIG_MALFORMED');
+    }
+    if (!data || !Array.isArray(data.hooks))
+        fail('RESOURCE_CONFIG_MALFORMED');
+    const seen = new Set();
+    const legacyFingerprint = (await fingerprintExecutableResource({ workspace, kind: 'hook', id: '.harness-ui-hooks.json', path: pathname })).fingerprint;
+    for (const row of data.hooks) {
+        const id = uniqueId(row?.id, seen);
+        if (typeof row?.comando !== 'string' || !row.comando || !Array.isArray(row?.eventi) || !row.eventi.length || !row.eventi.every((event) => typeof event === 'string'))
+            fail('RESOURCE_CONFIG_MALFORMED');
+        candidates.push({ kind: 'hook', id, path: pathname, semanticContent: JSON.stringify({ eventi: row.eventi, comando: row.comando }), legacyFingerprint });
+    }
+}
+async function mcpCandidates(workspace, candidates) {
+    const pathname = path.join(workspace.canonicalRoot, '.harness-ui-mcp.json');
+    const kind = await entryKind(pathname);
+    if (kind === null)
+        return;
+    if (kind !== 'file' && kind !== 'symlink')
+        fail('RESOURCE_CONFIG_MALFORMED');
+    let data;
+    try {
+        data = JSON.parse(await safeConfigText(workspace, pathname));
+    }
+    catch (error) {
+        if (error?.code === 'RESOURCE_OUTSIDE_WORKSPACE')
+            throw error;
+        fail('RESOURCE_CONFIG_MALFORMED');
+    }
+    if (!data || !Array.isArray(data.server))
+        fail('RESOURCE_CONFIG_MALFORMED');
+    const seen = new Set();
+    const legacyFingerprint = (await fingerprintExecutableResource({ workspace, kind: 'mcp', id: '.harness-ui-mcp.json', path: pathname })).fingerprint;
+    for (const row of data.server) {
+        const id = uniqueId(row?.id, seen);
+        const args = row?.argomenti ?? [];
+        if (typeof row?.comando !== 'string' || !row.comando || !Array.isArray(args) || !args.every((arg) => typeof arg === 'string') || !Array.isArray(row?.allowlist) || !row.allowlist.length || !row.allowlist.every((tool) => typeof tool === 'string' && tool.length > 0))
+            fail('RESOURCE_CONFIG_MALFORMED');
+        candidates.push({ kind: 'mcp', id, path: pathname, semanticContent: JSON.stringify({ comando: row.comando, argomenti: args, allowlist: row.allowlist }), legacyFingerprint });
+    }
+}
+export async function inventoryProjectResources(workspace, options) {
+    const packageLimit = Math.max(1, Math.min(options?.maxPackageFiles ?? PLUGIN_PACKAGE_MAX_FILES, PLUGIN_PACKAGE_MAX_FILES));
+    const root = workspace.canonicalRoot;
+    const candidates = [];
+    for (const relative of ['.talos-cli/config.json', 'AGENTS.md', 'CLAUDE.md', 'TALOS.md'])
+        await fixedFile(root, relative, 'context', candidates);
+    await hookCandidates(workspace, candidates);
+    await mcpCandidates(workspace, candidates);
+    const talosPath = path.join(root, '.talos');
+    const talosKind = await entryKind(talosPath);
+    if (talosKind === 'file' || talosKind === 'symlink')
+        candidates.push({ kind: 'context', id: '.talos', path: talosPath });
+    else if (talosKind === 'directory')
+        for (const pathname of await walkFiles(talosPath, () => true))
+            candidates.push({ kind: 'context', id: relativeId(root, pathname), path: pathname });
+    for (const pathname of await walkFiles(path.join(root, '.talos-cli', 'commands'), value => value.toLowerCase().endsWith('.md')))
+        candidates.push({ kind: 'command', id: relativeId(root, pathname), path: pathname });
+    const pluginRoot = path.join(root, '.harness-ui-plugins');
+    const pluginKind = await entryKind(pluginRoot);
+    if (pluginKind === 'symlink')
+        fail('RESOURCE_DIRECTORY_SYMLINK_UNSUPPORTED');
+    if (pluginKind === 'directory')
+        for (const entry of await readdir(pluginRoot, { withFileTypes: true })) {
+            if (entry.isSymbolicLink())
+                fail('RESOURCE_DIRECTORY_SYMLINK_UNSUPPORTED');
+            if (!entry.isDirectory())
+                continue;
+            for (const pathname of await walkPackageFiles(path.join(pluginRoot, entry.name), packageLimit))
+                candidates.push({ kind: 'plugin', id: relativeId(root, pathname), path: pathname });
+        }
+    const resources = await mapBounded(candidates, FINGERPRINT_CONCURRENCY, candidate => candidate.semanticContent !== undefined ? fingerprintExecutableResourceContent({ workspace, kind: candidate.kind, id: candidate.id, path: candidate.path, content: candidate.semanticContent, ...(candidate.legacyFingerprint ? { legacyFingerprint: candidate.legacyFingerprint } : {}) }) : fingerprintExecutableResource({ workspace, kind: candidate.kind, id: candidate.id, path: candidate.path }));
+    return resources.sort((left, right) => left.relativePath.localeCompare(right.relativePath) || left.kind.localeCompare(right.kind) || left.id.localeCompare(right.id));
+}

package/dist/security/project-trust-gate.js

@@ -0,0 +1,38 @@
+import { createTrustAuthority } from "./trust-authority.js";
+import { findNestedRepositories } from "./workspace-identity.js";
+const reviewInstruction = 'Review with `talos project status`; if the change is expected, run `talos project trust` (or `talos project trust --include-nested` when status lists nested repositories).';
+function assessmentOf(snapshot, folder) {
+    return { trusted: snapshot.trusted, reason: snapshot.reason, workspace: snapshot.workspace, resources: snapshot.resources.flatMap(row => row.current ? [row.current] : []), storeSchema: snapshot.storeSchema, migrationRequired: snapshot.migrationRequired, folder };
+}
+export async function assessProjectTrust({ projectRoot, trustRoot, homeDir }) {
+    const authority = createTrustAuthority({ projectRoot, trustRoot, ...(homeDir ? { homeDir } : {}) });
+    const snapshot = await authority.inspect();
+    return assessmentOf(snapshot, await authority.folderDecision(snapshot));
+}
+export async function nestedRepositoriesForProjectTrust(assessment) { return findNestedRepositories(assessment.workspace, [...new Set(assessment.resources.map(resource => resource.relativePath))]); }
+/** R4 Q-R4-1: an interactive start asks when a project file is not trusted OR the folder has no saved decision. */
+export function needsTrustQuestion(assessment) { return !assessment.trusted || (assessment.folder !== undefined && !assessment.folder.decided); }
+export function projectTrustFailure(assessment) {
+    /* A folder that was never decided (no project files, or the home folder) is "not trusted", never "changed". */
+    const neverDecided = assessment.reason === 'PROJECT_UNTRUSTED' || assessment.reason === 'NO_PROJECT_RESOURCES' || assessment.trusted;
+    const code = neverDecided ? 'PROJECT_TRUST_REQUIRED' : 'PROJECT_TRUST_INVALIDATED';
+    const message = code === 'PROJECT_TRUST_REQUIRED'
+        ? (assessment.resources.length
+            ? `${code}: TALOS did not load project instructions or executable resources because this folder is not trusted. ${reviewInstruction}`
+            : `${code}: TALOS did not start because this folder is not trusted.`)
+        : `${code}: the trusted project snapshot changed (${assessment.reason}). TALOS did not load the changed snapshot. ${reviewInstruction}`;
+    return Object.assign(new Error(message), { code, reason: assessment.reason, projectIdentity: assessment.workspace.identityHash });
+}
+export async function assertProjectTrusted(input) {
+    const assessment = await assessProjectTrust(input);
+    if (assessment.trusted)
+        return assessment;
+    throw projectTrustFailure(assessment);
+}
+/** `folder` (R4 Q-R4-2): which folder decision the grant saves; omitted, this folder (nothing for the home folder or a drive root).
+ *  `sessionOnly` (R4 Q-R4-17): "Trust this folder for this session" — the grant lives in memory for this process, nothing is written. */
+export async function trustProjectAssessment({ assessment, trustRoot, nestedRepositories = [], folder, homeDir, sessionOnly = false }) {
+    const authority = createTrustAuthority({ projectRoot: assessment.workspace.canonicalRoot, trustRoot, ...(homeDir ? { homeDir } : {}) });
+    const trusted = await authority.trustProject({ expected: { workspaceIdentityHash: assessment.workspace.identityHash, resources: assessment.resources, nestedRepositories }, includeNested: nestedRepositories.length > 0, ...(folder ? { folder } : {}), ...(sessionOnly ? { session: true } : {}) });
+    return assessmentOf(trusted, await authority.folderDecision(trusted));
+}

package/dist/security/project-trust.js

@@ -0,0 +1,367 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { isPathInsideWorkspace } from "./workspace-identity.js";
+function fail(code) { throw Object.assign(new Error(code), { code }); }
+export function projectResourceKey(resource) { return `${resource.kind}:${resource.id}`; }
+function recordPath(trustRoot, workspace) { return path.join(trustRoot, `${workspace.identityHash}.json`); }
+function backupPath(trustRoot, workspace) { return `${recordPath(trustRoot, workspace)}.v1.bak`; }
+function parseResourceKey(key) {
+    const colon = key.indexOf(':');
+    const kind = key.slice(0, colon);
+    const id = key.slice(colon + 1);
+    if (colon <= 0 || !['command', 'hook', 'plugin', 'mcp', 'context'].includes(kind) || !id)
+        fail('PROJECT_TRUST_STORE_INVALID');
+    return { kind, id };
+}
+function trustedEntry(record, key) { return record.resources[key]; }
+function normalizeNestedRepositories(values = []) {
+    const out = [...new Set(values)].sort();
+    for (const value of out) {
+        if (typeof value !== 'string' || !value || value.includes('\\') || path.posix.isAbsolute(value) || value.split('/').some(part => part === '' || part === '.' || part === '..'))
+            fail('PROJECT_TRUST_STORE_INVALID');
+    }
+    return out;
+}
+function sameNestedRepositories(left, right) { const a = normalizeNestedRepositories(left), b = normalizeNestedRepositories(right); return a.length === b.length && a.every((value, index) => value === b[index]); }
+function validBase(value, workspace) {
+    return value && value.identityHash === workspace.identityHash && value.canonicalRoot === workspace.canonicalRoot && value.resources && typeof value.resources === 'object';
+}
+function validateRecord(value, workspace) {
+    if (!validBase(value, workspace))
+        fail('PROJECT_TRUST_STORE_INVALID');
+    if (value.schema === 'talos.cli.project-trust.v1') {
+        for (const [key, row] of Object.entries(value.resources)) {
+            parseResourceKey(key);
+            if (typeof row?.fingerprint !== 'string' || typeof row?.relativePath !== 'string')
+                fail('PROJECT_TRUST_STORE_INVALID');
+        }
+        if (typeof value.trustedAt !== 'string')
+            fail('PROJECT_TRUST_STORE_INVALID');
+        return value;
+    }
+    if (value.schema === 'talos.cli.project-trust.v2') {
+        for (const [key, row] of Object.entries(value.resources)) {
+            const parsed = parseResourceKey(key);
+            if (row?.kind !== parsed.kind || row?.id !== parsed.id || typeof row?.fingerprint !== 'string' || typeof row?.relativePath !== 'string' || typeof row?.trustedAt !== 'string')
+                fail('PROJECT_TRUST_STORE_INVALID');
+        }
+        if (typeof value.trustedAt !== 'string' || typeof value.updatedAt !== 'string' || (value.rollbackValid !== undefined && typeof value.rollbackValid !== 'boolean'))
+            fail('PROJECT_TRUST_STORE_INVALID');
+        if (value.nestedRepositories !== undefined) {
+            if (!Array.isArray(value.nestedRepositories) || value.nestedRepositories.some((item) => typeof item !== 'string'))
+                fail('PROJECT_TRUST_STORE_INVALID');
+            normalizeNestedRepositories(value.nestedRepositories);
+        }
+        return value;
+    }
+    fail('PROJECT_TRUST_STORE_INVALID');
+}
+/*
+ * R4 (owner decision Q-R4-17, 2026-09-24): the home folder and a drive root are trusted for THIS SESSION ONLY. Their grant is a
+ * v2 record kept in this map, keyed by trust root and workspace identity, and never written: every service this process builds
+ * (the runtime composition builds its own) reads it BEFORE the file, so hooks, MCP and plugins work for the session, the
+ * snapshot rule applies to it as to a saved record, changes made during the session stay here, and a new process has none.
+ */
+const SESSION_RECORDS = new Map();
+function sessionKey(trustRoot, workspace) { return `${path.resolve(trustRoot)}\0${workspace.identityHash}`; }
+async function readRecordWithText(trustRoot, workspace) {
+    const session = SESSION_RECORDS.get(sessionKey(trustRoot, workspace));
+    if (session)
+        return { record: structuredClone(session), text: '', session: true };
+    try {
+        const text = await readFile(recordPath(trustRoot, workspace), 'utf8');
+        return { record: validateRecord(JSON.parse(text), workspace), text, session: false };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+async function readRecord(trustRoot, workspace) { return (await readRecordWithText(trustRoot, workspace))?.record ?? null; }
+async function atomicWriteText(file, text) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.tmp-${process.pid}-${Date.now()}`;
+    try {
+        await writeFile(temporary, text, { encoding: 'utf8', mode: 0o600 });
+        const handle = await open(temporary, 'r+');
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, file);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}
+async function atomicWrite(file, value) { return atomicWriteText(file, `${JSON.stringify(value, null, 2)}\n`); }
+function v2Resources(resources, trustedAt) {
+    const entries = resources.map(resource => [projectResourceKey(resource), { kind: resource.kind, id: resource.id, fingerprint: resource.fingerprint, relativePath: resource.relativePath, trustedAt }]).sort(([a], [b]) => a.localeCompare(b));
+    return Object.fromEntries(entries);
+}
+function convertV1(record, updatedAt, nestedRepositories = []) {
+    const resources = {};
+    for (const key of Object.keys(record.resources).sort()) {
+        const parsed = parseResourceKey(key);
+        const row = record.resources[key];
+        resources[key] = { ...parsed, fingerprint: row.fingerprint, relativePath: row.relativePath, trustedAt: record.trustedAt };
+    }
+    return { schema: 'talos.cli.project-trust.v2', identityHash: record.identityHash, canonicalRoot: record.canonicalRoot, trustedAt: record.trustedAt, updatedAt, rollbackValid: true, nestedRepositories: normalizeNestedRepositories(nestedRepositories), resources };
+}
+async function preserveLegacyBackup(trustRoot, workspace, text) {
+    const backup = backupPath(trustRoot, workspace);
+    try {
+        await writeFile(backup, text, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const existing = await readFile(backup, 'utf8');
+        if (existing !== text)
+            fail('TRUST_MIGRATION_BACKUP_CONFLICT');
+    }
+}
+function trustedForResource(record, resource, consumedLegacy) {
+    const direct = trustedEntry(record, projectResourceKey(resource));
+    if (direct)
+        return direct;
+    if (record.schema === 'talos.cli.project-trust.v1' && resource.legacyFingerprint) {
+        const legacyKey = `${resource.kind}:${resource.relativePath}`;
+        const legacy = record.resources[legacyKey];
+        if (legacy && legacy.fingerprint === resource.legacyFingerprint && legacy.relativePath === resource.relativePath) {
+            consumedLegacy?.add(legacyKey);
+            return legacy;
+        }
+    }
+    return undefined;
+}
+function inspectRecord(record, resources, nestedRepositories = []) {
+    const current = new Map(resources.map(resource => [projectResourceKey(resource), resource]));
+    const consumedLegacy = new Set();
+    const rows = [];
+    for (const resource of resources) {
+        const key = projectResourceKey(resource);
+        const trusted = record ? trustedForResource(record, resource, consumedLegacy) : undefined;
+        const direct = record ? trustedEntry(record, key) : undefined;
+        const state = !trusted ? 'added' : direct ? (direct.fingerprint === resource.fingerprint && direct.relativePath === resource.relativePath ? 'trusted' : 'changed') : 'trusted';
+        rows.push({ key, kind: resource.kind, id: resource.id, relativePath: resource.relativePath, state, current: resource, currentFingerprint: resource.fingerprint, ...(trusted ? { trustedFingerprint: trusted.fingerprint } : {}) });
+    }
+    if (record)
+        for (const key of Object.keys(record.resources).sort())
+            if (!current.has(key) && !consumedLegacy.has(key)) {
+                const parsed = parseResourceKey(key);
+                const trusted = record.resources[key];
+                rows.push({ key, ...parsed, relativePath: trusted.relativePath, state: 'removed', trustedFingerprint: trusted.fingerprint });
+            }
+    rows.sort((a, b) => a.relativePath.localeCompare(b.relativePath) || a.key.localeCompare(b.key));
+    let state;
+    if (!record)
+        state = { trusted: false, reason: 'PROJECT_UNTRUSTED' };
+    else if (record.schema === 'talos.cli.project-trust.v1' && normalizeNestedRepositories(nestedRepositories).length > 0)
+        state = { trusted: false, reason: 'NESTED_REPOSITORY_BOUNDARY_CHANGED' };
+    else if (record.schema === 'talos.cli.project-trust.v2' && !sameNestedRepositories(record.nestedRepositories ?? [], nestedRepositories))
+        state = { trusted: false, reason: 'NESTED_REPOSITORY_BOUNDARY_CHANGED' };
+    else if (rows.some(row => row.state === 'added' || row.state === 'removed'))
+        state = { trusted: false, reason: 'RESOURCE_SET_CHANGED' };
+    else if (rows.some(row => row.state === 'changed'))
+        state = { trusted: false, reason: 'RESOURCE_FINGERPRINT_CHANGED' };
+    else
+        state = { trusted: true, reason: 'PROJECT_TRUSTED' };
+    return { state, storeSchema: record?.schema === 'talos.cli.project-trust.v1' ? 'v1' : record ? 'v2' : null, migrationRequired: record?.schema === 'talos.cli.project-trust.v1', resources: rows };
+}
+async function resourceLocation(workspace, resourcePath) {
+    const canonicalPath = await realpath(path.resolve(resourcePath));
+    if (!isPathInsideWorkspace(workspace, canonicalPath))
+        fail('RESOURCE_OUTSIDE_WORKSPACE');
+    return { canonicalPath, relativePath: path.relative(workspace.canonicalRoot, canonicalPath).split(path.sep).join('/') };
+}
+function fingerprintResource(workspace, kind, id, relativePath, content, domain) {
+    const fingerprint = createHash('sha256').update(domain).update('\0').update(kind).update('\0').update(id).update('\0').update(relativePath).update('\0').update(content).digest('hex');
+    return { workspaceIdentityHash: workspace.identityHash, kind, id, relativePath, fingerprint };
+}
+export async function fingerprintExecutableResource({ workspace, kind, id, path: resourcePath }) {
+    const { canonicalPath, relativePath } = await resourceLocation(workspace, resourcePath);
+    return fingerprintResource(workspace, kind, id, relativePath, await readFile(canonicalPath), 'talos-executable-resource-v1');
+}
+export async function fingerprintExecutableResourceContent({ workspace, kind, id, path: resourcePath, content, legacyFingerprint }) {
+    const { relativePath } = await resourceLocation(workspace, resourcePath);
+    return { ...fingerprintResource(workspace, kind, id, relativePath, content, 'talos-executable-resource-semantic-v2'), ...(legacyFingerprint ? { legacyFingerprint } : {}) };
+}
+export function createProjectTrustService({ trustRoot, clock = () => new Date().toISOString() }) {
+    /* A change to a session grant stays in memory; any other record is written as before. */
+    async function save(workspace, record, session) {
+        if (session) {
+            SESSION_RECORDS.set(sessionKey(trustRoot, workspace), structuredClone(record));
+            return;
+        }
+        await atomicWrite(recordPath(trustRoot, workspace), record);
+    }
+    async function isSession(workspace) { return SESSION_RECORDS.has(sessionKey(trustRoot, workspace)); }
+    async function ensureV2(workspace, resources, nestedRepositories = []) {
+        const current = await readRecordWithText(trustRoot, workspace);
+        if (!current)
+            fail('PROJECT_TRUST_REQUIRED');
+        if (current.record.schema === 'talos.cli.project-trust.v2')
+            return current.record;
+        await preserveLegacyBackup(trustRoot, workspace, current.text);
+        const now = clock();
+        const inspection = inspectRecord(current.record, resources);
+        const trustedCurrent = inspection.resources.filter(row => row.state === 'trusted' && row.current).map(row => row.current);
+        return { schema: 'talos.cli.project-trust.v2', identityHash: workspace.identityHash, canonicalRoot: workspace.canonicalRoot, trustedAt: current.record.trustedAt, updatedAt: now, rollbackValid: true, nestedRepositories: normalizeNestedRepositories(nestedRepositories), resources: v2Resources(trustedCurrent, current.record.trustedAt) };
+    }
+    return {
+        async status(workspace) { return await readRecord(trustRoot, workspace) ? { trusted: true, reason: 'PROJECT_TRUSTED' } : { trusted: false, reason: 'PROJECT_UNTRUSTED' }; },
+        async trust(workspace, resources, nestedRepositories = [], options = {}) {
+            for (const resource of resources)
+                if (resource.workspaceIdentityHash !== workspace.identityHash)
+                    fail('RESOURCE_IDENTITY_MISMATCH');
+            if (options.session) {
+                const now = clock();
+                SESSION_RECORDS.set(sessionKey(trustRoot, workspace), { schema: 'talos.cli.project-trust.v2', identityHash: workspace.identityHash, canonicalRoot: workspace.canonicalRoot, trustedAt: now, updatedAt: now, rollbackValid: false, nestedRepositories: normalizeNestedRepositories(nestedRepositories), resources: v2Resources(resources, now) });
+                return;
+            }
+            SESSION_RECORDS.delete(sessionKey(trustRoot, workspace));
+            const existing = await readRecordWithText(trustRoot, workspace);
+            const fromV1 = existing?.record.schema === 'talos.cli.project-trust.v1';
+            if (fromV1)
+                await preserveLegacyBackup(trustRoot, workspace, existing.text);
+            const now = clock();
+            const record = { schema: 'talos.cli.project-trust.v2', identityHash: workspace.identityHash, canonicalRoot: workspace.canonicalRoot, trustedAt: existing?.record.trustedAt ?? now, updatedAt: now, rollbackValid: fromV1, nestedRepositories: normalizeNestedRepositories(nestedRepositories), resources: v2Resources(resources, now) };
+            await atomicWrite(recordPath(trustRoot, workspace), record);
+        },
+        async revoke(workspace) { SESSION_RECORDS.delete(sessionKey(trustRoot, workspace)); await Promise.all([rm(recordPath(trustRoot, workspace), { force: true }), rm(backupPath(trustRoot, workspace), { force: true })]); },
+        forgetSession(workspace) { SESSION_RECORDS.delete(sessionKey(trustRoot, workspace)); },
+        hasSession(workspace) { return SESSION_RECORDS.has(sessionKey(trustRoot, workspace)); },
+        async verifyResource(workspace, resource) {
+            const record = await readRecord(trustRoot, workspace);
+            if (!record)
+                return { trusted: false, reason: 'PROJECT_UNTRUSTED' };
+            if (resource.workspaceIdentityHash !== workspace.identityHash)
+                return { trusted: false, reason: 'RESOURCE_IDENTITY_MISMATCH' };
+            const direct = trustedEntry(record, projectResourceKey(resource));
+            const trusted = trustedForResource(record, resource);
+            if (!trusted)
+                return { trusted: false, reason: 'RESOURCE_NOT_TRUSTED' };
+            if (direct && (direct.fingerprint !== resource.fingerprint || direct.relativePath !== resource.relativePath))
+                return { trusted: false, reason: 'RESOURCE_FINGERPRINT_CHANGED' };
+            return { trusted: true, reason: 'RESOURCE_TRUSTED' };
+        },
+        async verifySnapshot(workspace, resources, nestedRepositories = []) { return (await this.inspectSnapshot(workspace, resources, nestedRepositories)).state; },
+        async inspectSnapshot(workspace, resources, nestedRepositories = []) { for (const resource of resources)
+            if (resource.workspaceIdentityHash !== workspace.identityHash)
+                return { state: { trusted: false, reason: 'RESOURCE_IDENTITY_MISMATCH' }, storeSchema: null, migrationRequired: false, resources: [] }; return inspectRecord(await readRecord(trustRoot, workspace), resources, nestedRepositories); },
+        async reconcile(workspace, resources, keys, nestedRepositories = []) {
+            const requested = [...new Set(keys)].sort();
+            if (!requested.length)
+                return false;
+            for (const resource of resources)
+                if (resource.workspaceIdentityHash !== workspace.identityHash)
+                    fail('RESOURCE_IDENTITY_MISMATCH');
+            const record = await ensureV2(workspace, resources, nestedRepositories);
+            const current = new Map(resources.map(resource => [projectResourceKey(resource), resource]));
+            const now = clock();
+            let changed = false;
+            for (const key of requested) {
+                const resource = current.get(key);
+                if (resource) {
+                    const previous = record.resources[key];
+                    const next = { kind: resource.kind, id: resource.id, fingerprint: resource.fingerprint, relativePath: resource.relativePath, trustedAt: now };
+                    if (!previous || previous.fingerprint !== next.fingerprint || previous.relativePath !== next.relativePath) {
+                        record.resources[key] = next;
+                        changed = true;
+                    }
+                }
+                else if (record.resources[key]) {
+                    delete record.resources[key];
+                    changed = true;
+                }
+            }
+            if (changed) {
+                record.updatedAt = now;
+                record.rollbackValid = false;
+                await save(workspace, record, await isSession(workspace));
+            }
+            return changed;
+        },
+        async untrustResources(workspace, resources, keys, nestedRepositories = []) {
+            const requested = [...new Set(keys)].sort();
+            if (!requested.length)
+                return false;
+            const existing = await readRecord(trustRoot, workspace);
+            if (!existing)
+                return false;
+            const record = await ensureV2(workspace, resources, nestedRepositories);
+            let changed = false;
+            for (const key of requested)
+                if (record.resources[key]) {
+                    delete record.resources[key];
+                    changed = true;
+                }
+            if (changed) {
+                record.updatedAt = clock();
+                record.rollbackValid = false;
+                await save(workspace, record, await isSession(workspace));
+            }
+            return changed;
+        },
+        async migrate(workspace, resources, nestedRepositories = []) {
+            const existing = await readRecordWithText(trustRoot, workspace);
+            if (!existing)
+                return false;
+            if (existing.record.schema === 'talos.cli.project-trust.v2')
+                return false;
+            const inspection = inspectRecord(existing.record, resources, []);
+            if (!inspection.state.trusted)
+                fail('TRUST_MIGRATION_SNAPSHOT_CHANGED');
+            await preserveLegacyBackup(trustRoot, workspace, existing.text);
+            const now = clock();
+            const record = { schema: 'talos.cli.project-trust.v2', identityHash: workspace.identityHash, canonicalRoot: workspace.canonicalRoot, trustedAt: existing.record.trustedAt, updatedAt: now, rollbackValid: true, nestedRepositories: normalizeNestedRepositories(nestedRepositories), resources: v2Resources(resources, existing.record.trustedAt) };
+            await atomicWrite(recordPath(trustRoot, workspace), record);
+            return true;
+        },
+        async rollbackMigration(workspace) {
+            const backup = backupPath(trustRoot, workspace);
+            let text;
+            try {
+                text = await readFile(backup, 'utf8');
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    fail('TRUST_MIGRATION_ROLLBACK_UNAVAILABLE');
+                throw error;
+            }
+            const current = await readRecord(trustRoot, workspace);
+            if (!current || current.schema !== 'talos.cli.project-trust.v2')
+                fail('TRUST_MIGRATION_ROLLBACK_INVALID');
+            if (current.rollbackValid !== true)
+                fail('TRUST_MIGRATION_ROLLBACK_STALE');
+            const parsed = validateRecord(JSON.parse(text), workspace);
+            if (parsed.schema !== 'talos.cli.project-trust.v1')
+                fail('TRUST_MIGRATION_BACKUP_INVALID');
+            await atomicWriteText(recordPath(trustRoot, workspace), text);
+            await rm(backup, { force: true });
+            return true;
+        },
+        async rollbackAvailable(workspace) {
+            const current = await readRecord(trustRoot, workspace);
+            if (!current || current.schema !== 'talos.cli.project-trust.v2' || current.rollbackValid !== true)
+                return false;
+            try {
+                const text = await readFile(backupPath(trustRoot, workspace), 'utf8');
+                const parsed = validateRecord(JSON.parse(text), workspace);
+                return parsed.schema === 'talos.cli.project-trust.v1';
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return false;
+                throw error;
+            }
+        },
+        migrationBackupPath(workspace) { return backupPath(trustRoot, workspace); }
+    };
+}