talos-code 0.0.1 → 0.2.0

package/dist/security/rule-parser.js

@@ -0,0 +1,201 @@
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { segmentShellCommand } from "./shell-segmentation.js";
+const TOOLS = new Set(['Read', 'Write', 'Edit', 'Bash', 'WebFetch', 'Mcp', 'Hook', 'Plugin', 'TalosService']);
+const RULE_SHAPE = /^([A-Za-z]+)\((.*)\)$/u;
+// B1 slice 21. Why a stored rule cannot be read, in words a person can act on, or null when it can.
+// It accepts exactly what parseRule accepts: the explanation is chosen only AFTER the shape has
+// failed, so a rule that parses today (a trailing line break is trimmed) keeps parsing.
+// `.` in the shape does not match a line break (LF, CR, U+2028, U+2029), which is how "allow always"
+// on a command with a line break used to write a rule that stopped the next start.
+const LINE_BREAK = /[\x0a\x0d\p{Zl}\p{Zp}]/u;
+export function ruleProblem(raw) {
+    if (typeof raw !== 'string')
+        return 'is not text';
+    const m = RULE_SHAPE.exec(raw.trim());
+    if (!m)
+        return LINE_BREAK.test(raw.trim()) ? 'contains a line break, and a rule is read on one line' : 'is not of the form Tool(pattern)';
+    if (!TOOLS.has(m[1]))
+        return `names "${m[1]}", which is not one of the tools ${[...TOOLS].join(', ')}`;
+    return null;
+}
+export function parseRule(raw, effect) { const m = ruleProblem(raw) === null ? RULE_SHAPE.exec(raw.trim()) : null; if (!m)
+    throw new Error(`PERMISSION_RULE_INVALID:${raw}`); return { raw, effect, tool: m[1], pattern: m[2] }; }
+export function tokenizeCommand(command) { if (typeof command !== 'string' || !command.trim() || command.includes('\0'))
+    return []; const out = []; let token = '', quote = null, escape = false; for (const c of command.trim()) {
+    if (escape) {
+        token += c;
+        escape = false;
+        continue;
+    }
+    if (c === '\\' && quote) {
+        escape = true;
+        continue;
+    }
+    if (c === '"' || c === "'") {
+        if (quote === c)
+            quote = null;
+        else if (!quote)
+            quote = c;
+        else
+            token += c;
+        continue;
+    }
+    if (!quote && /[&|;<>()]/u.test(c))
+        return [];
+    if (!quote && /\s/u.test(c)) {
+        if (token) {
+            out.push(token);
+            token = '';
+        }
+        continue;
+    }
+    token += c;
+} if (quote)
+    return []; if (token)
+    out.push(token); return out; }
+const READ_ONLY_COMMANDS = new Set(['ls', 'dir', 'cat', 'type', 'head', 'tail', 'grep', 'rg', 'wc', 'diff', 'stat', 'du', 'pwd']);
+const READ_ONLY_GIT = new Set(['status', 'diff', 'log', 'show', 'grep', 'rev-parse', 'ls-files', 'ls-tree']);
+export function isReadOnlyShellCommand(command) {
+    let commands;
+    try {
+        commands = segmentShellCommand(command).map(segment => segment.command);
+    }
+    catch {
+        return false;
+    }
+    return commands.every(singleCommandReadOnly);
+}
+// B1 slice 11. Windows resolves a command name without case, so `TYPE` and `type` are the same
+// program. Recognizing only the lowercase spelling let the shift key defeat the whole boundary:
+// measured on this host, `Bash(*)` plus `TYPE <private key>` was allowed and the shell really read
+// the key. The verb is folded only where the platform folds it, and only to RECOGNIZE a read-only
+// command. ⛔ Rule matching is deliberately NOT folded — a rule names the text a person wrote, and
+// making that comparison case-blind would change what every existing rule means.
+function readOnlyVerb(token) { return path.sep === '\\' ? token.toLowerCase() : token; }
+function singleCommandReadOnly(command) {
+    const tokens = tokenizeCommand(command);
+    if (!tokens.length)
+        return false;
+    const [head, sub] = tokens;
+    const verb = readOnlyVerb(head);
+    if (READ_ONLY_COMMANDS.has(verb))
+        return true;
+    if (verb === 'git' && sub && READ_ONLY_GIT.has(sub))
+        return true;
+    return false;
+}
+// B1 slice 10. A token whose value cannot be decided by reading it. An unexpanded shell variable
+// (`$HOME`, `${HOME}`), a command substitution, a Windows environment reference (`%USERPROFILE%`)
+// and a `~user` form all resolve to something this process cannot compute; a drive-relative path
+// (`C:foo`) means "the current directory of drive C:", which is not the project root even when
+// path.resolve() folds it into one. Measured 2026-09-16 on this host: path.resolve(root,'$HOME/x'),
+// path.resolve(root,'%USERPROFILE%\\x') and path.resolve(root,'C:foo') all land INSIDE the project,
+// so treating them as ordinary relative paths is what makes the boundary bypassable.
+// A trailing `$` cannot expand in any shell, so `grep 'end$'` stays verifiable and does not prompt.
+const WINDOWS_PATHS = path.sep === '\\';
+export function isUnverifiableArgument(token) {
+    if (/\$[\s\S]/u.test(token) || token.includes('`'))
+        return true;
+    if (WINDOWS_PATHS && /%[^%\s]*%/u.test(token))
+        return true;
+    if (WINDOWS_PATHS && /^[A-Za-z]:(?![\\/])/u.test(token))
+        return true;
+    return token.startsWith('~') && token !== '~' && !token.startsWith('~/') && !token.startsWith(`~${path.sep}`);
+}
+export function expandHomePrefix(token) {
+    if (token === '~')
+        return homedir();
+    if (token.startsWith('~/') || token.startsWith(`~${path.sep}`))
+        return path.join(homedir(), token.slice(2));
+    return token;
+}
+// On Windows a single-segment `/x` token is a switch, never a path: no Windows shell resolves
+// `/s` as a file name. More than one segment (`/c/Users/x`, git-bash style) or anything with a
+// separator in it is not switch-shaped and stays an operand, so POSIX is untouched.
+export function isWindowsStyleSwitch(token) { return WINDOWS_PATHS && /^\/[A-Za-z?][-\w:,]*$/u.test(token); }
+function tokenizeForBoundary(command) {
+    if (typeof command !== 'string' || !command.trim() || command.includes('\0'))
+        return null;
+    const chars = [...command.trim()];
+    const out = [];
+    let value = '', bare = '', started = false, quote = null;
+    const push = () => { if (started) {
+        out.push({ value, bare });
+        value = '';
+        bare = '';
+        started = false;
+    } };
+    for (let i = 0; i < chars.length; i += 1) {
+        const c = chars[i];
+        if (c === '\\' && !WINDOWS_PATHS && quote !== "'" && i + 1 < chars.length) {
+            const next = chars[i + 1];
+            value += next;
+            if (quote === null)
+                bare += next;
+            started = true;
+            i += 1;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            if (quote === c)
+                quote = null;
+            else if (quote === null)
+                quote = c;
+            else
+                value += c;
+            started = true;
+            continue;
+        }
+        if (quote === null && /[&|;<>()]/u.test(c))
+            return null;
+        if (quote === null && /\s/u.test(c)) {
+            push();
+            continue;
+        }
+        value += c;
+        if (quote === null)
+            bare += c;
+        started = true;
+    }
+    if (quote !== null)
+        return null;
+    push();
+    return out.length ? out : null;
+}
+// Brace expansion makes one token into several, and only its unquoted part expands. A bare
+// quantifier such as `a{2}` has no comma and no range, so a regular expression does not prompt.
+const BRACE_LIST = /\{[^{}]*,[^{}]*\}/u;
+const BRACE_RANGE = /\{[^{}]*\.\.[^{}]*\}/u;
+// The operands of one command segment: everything the verb is pointed at. Option flags are dropped,
+// but their value is not, in either form a path reaches them: `--file=PATH` and the attached short
+// form `-fPATH`. Nothing says where a short cluster ends, so every suffix is offered and the
+// comparison decides; a suffix that is not a path resolves inside the project and costs nothing.
+// Everything else is kept even when it is obviously not a path, for the same reason: a search
+// pattern lands inside the project, so keeping it costs nothing and guessing would cost a hole.
+export function commandOperands(command) {
+    const tokens = tokenizeForBoundary(command);
+    if (!tokens)
+        return null;
+    const operands = [];
+    for (const token of tokens.slice(1)) {
+        if (BRACE_LIST.test(token.bare) || BRACE_RANGE.test(token.bare))
+            return null;
+        const value = token.value;
+        if (value === '--')
+            continue;
+        if (value.startsWith('-')) {
+            const eq = value.indexOf('=');
+            if (eq >= 0) {
+                operands.push(value.slice(eq + 1));
+                continue;
+            }
+            if (!value.startsWith('--'))
+                for (let i = 2; i < value.length; i += 1)
+                    operands.push(value.slice(i));
+            continue;
+        }
+        operands.push(value);
+    }
+    return operands;
+}

package/dist/security/shell-segmentation.js

@@ -0,0 +1,68 @@
+function fail(code) {
+    throw Object.assign(new Error(code), { code });
+}
+export function segmentShellCommand(command) {
+    if (typeof command !== 'string' || !command.trim() || command.includes('\0'))
+        fail('SHELL_COMPOSITION_INVALID');
+    const segments = [];
+    let buffer = '';
+    let quote = null;
+    let operatorBefore = null;
+    const push = () => {
+        const value = buffer.trim();
+        if (!value)
+            fail('SHELL_COMPOSITION_INVALID');
+        segments.push({ command: value, operatorBefore });
+        buffer = '';
+    };
+    for (let index = 0; index < command.length; index += 1) {
+        const current = command[index];
+        const next = command[index + 1];
+        if (current === '\\' && next !== undefined && (quote !== null || /[&|;<>()`'"\\$]/u.test(next))) {
+            buffer += current + next;
+            index += 1;
+            continue;
+        }
+        if (current === '^' && quote === null && next !== undefined) {
+            buffer += current + next;
+            index += 1;
+            continue;
+        }
+        if (current === '"' || current === "'") {
+            if (quote === current)
+                quote = null;
+            else if (quote === null)
+                quote = current;
+            buffer += current;
+            continue;
+        }
+        if (quote !== "'" && (current === '`' || (current === '$' && next === '(')))
+            fail('SHELL_COMPOSITION_UNSUPPORTED');
+        if (quote === null) {
+            if (/[<>()]/u.test(current))
+                fail('SHELL_COMPOSITION_UNSUPPORTED');
+            let operator = null;
+            if ((current === '&' || current === '|') && next === current) {
+                operator = `${current}${next}`;
+                index += 1;
+            }
+            else if (current === '&' || current === '|' || current === ';')
+                operator = current;
+            else if (current === '\r' || current === '\n') {
+                operator = 'newline';
+                if (current === '\r' && next === '\n')
+                    index += 1;
+            }
+            if (operator) {
+                push();
+                operatorBefore = operator;
+                continue;
+            }
+        }
+        buffer += current;
+    }
+    if (quote !== null)
+        fail('SHELL_COMPOSITION_INVALID');
+    push();
+    return segments;
+}

package/dist/security/trust-authority.js

@@ -0,0 +1,324 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { normalizeProjectRoot } from "../paths.js";
+import { createProjectTrustService, projectResourceKey } from "./project-trust.js";
+import { inventoryProjectResources } from "./project-resource-inventory.js";
+import { findNestedRepositories, resolveWorkspaceIdentity } from "./workspace-identity.js";
+function fail(code, message = code, extra = {}) { throw Object.assign(new Error(message), { code, ...extra }); }
+function resourceSignature(resources) { return JSON.stringify([...resources].map(row => ({ key: projectResourceKey(row), path: row.relativePath, fingerprint: row.fingerprint })).sort((a, b) => a.key.localeCompare(b.key))); }
+function nestedSignature(entries) { return JSON.stringify([...entries].map(row => ({ relativePath: row.relativePath, resources: [...row.resources].sort() })).sort((a, b) => a.relativePath.localeCompare(b.relativePath))); }
+function expectationOf(value) {
+    if ('workspaceIdentityHash' in value)
+        return value;
+    return { workspaceIdentityHash: value.workspace.identityHash, resources: value.resources.flatMap(row => row.current ? [row.current] : []), nestedRepositories: value.nestedRepositories };
+}
+function nestedConsentFailure(snapshot) {
+    const crossing = snapshot.nestedRepositories.reduce((total, row) => total + row.resources.length, 0);
+    const detail = snapshot.nestedRepositories.map(row => `${row.relativePath} (${row.resources.slice(0, 3).join(', ')}${row.resources.length > 3 ? `, and ${row.resources.length - 3} more` : ''})`).join('; ');
+    fail('PROJECT_TRUST_NESTED_REPOSITORY_CONSENT_REQUIRED', `PROJECT_TRUST_NESTED_REPOSITORY_CONSENT_REQUIRED: ${crossing} project resources cross nested repository boundaries: ${detail}. Re-run with --include-nested to trust them deliberately.`);
+}
+function scopeRows(snapshot, scope) {
+    if (scope.kind === 'plugin') {
+        const prefix = `.harness-ui-plugins/${scope.id}/`;
+        return snapshot.resources.filter(row => row.kind === 'plugin' && row.relativePath.startsWith(prefix));
+    }
+    return snapshot.resources.filter(row => row.kind === scope.kind && row.id === scope.id);
+}
+export function compatibilityTrustRoots(trustRoot, workspace) {
+    const base = path.join(trustRoot, 'compat', workspace.identityHash);
+    return { hooks: path.join(base, 'hooks'), mcp: path.join(base, 'mcp'), plugins: path.join(base, 'plugins') };
+}
+function quarantinePath(trustRoot, workspace, scope) {
+    const digest = createHash('sha256').update(scope.kind + '\0' + scope.id).digest('hex');
+    return path.join(trustRoot, 'quarantine', workspace.identityHash, digest + '.json');
+}
+function scopeReviewedFingerprint(rows) {
+    const fingerprints = rows.flatMap(row => row.currentFingerprint ? [row.currentFingerprint] : []).sort();
+    if (!fingerprints.length)
+        return null;
+    return fingerprints.length === 1 ? fingerprints[0] : createHash('sha256').update(fingerprints.join('\n')).digest('hex');
+}
+function validateQuarantineRecord(value, workspace, scope) {
+    if (!value || value.schema !== 'talos.cli.trust-quarantine.v1' || value.active !== true
+        || value.workspaceIdentityHash !== workspace.identityHash || value.kind !== scope.kind || value.id !== scope.id
+        || typeof value.quarantinedAt !== 'string' || (value.reason !== null && typeof value.reason !== 'string')
+        || (value.reviewedFingerprint !== null && typeof value.reviewedFingerprint !== 'string')) {
+        fail('TRUST_QUARANTINE_STORE_INVALID');
+    }
+    return value;
+}
+async function readQuarantineRecord(trustRoot, workspace, scope) {
+    try {
+        const text = await readFile(quarantinePath(trustRoot, workspace, scope), 'utf8');
+        return validateQuarantineRecord(JSON.parse(text), workspace, scope);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        if (error instanceof SyntaxError)
+            fail('TRUST_QUARANTINE_STORE_INVALID');
+        throw error;
+    }
+}
+async function writeQuarantineRecord(trustRoot, workspace, scope, record) {
+    const target = quarantinePath(trustRoot, workspace, scope);
+    await mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    const temporary = target + '.tmp-' + process.pid + '-' + randomUUID();
+    try {
+        await writeFile(temporary, JSON.stringify(record, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+        await rename(temporary, target);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => { });
+    }
+}
+/* Folder decisions (R4). One small file per folder under `<trustRoot>/folders/`, named by a hash of the normalized
+   canonical path (the same normalization as the workspace identity), written through a temporary file and a rename. A
+   record that cannot be read or does not name its own folder decides nothing: the folder is asked again (fail closed). */
+const FOLDER_SCHEMA = 'talos.cli.folder-trust.v1';
+function folderKey(folder) { return normalizeProjectRoot(path.resolve(folder)); }
+function folderRecordPath(trustRoot, folder) {
+    const digest = createHash('sha256').update('talos-folder-trust-v1\0' + folderKey(folder)).digest('hex');
+    return path.join(trustRoot, 'folders', digest + '.json');
+}
+async function hasFolderRecord(trustRoot, folder) {
+    try {
+        const value = JSON.parse(await readFile(folderRecordPath(trustRoot, folder), 'utf8'));
+        return value?.schema === FOLDER_SCHEMA && typeof value.canonicalRoot === 'string' && folderKey(value.canonicalRoot) === folderKey(folder) && typeof value.decidedAt === 'string';
+    }
+    catch {
+        return false;
+    }
+}
+async function writeFolderRecord(trustRoot, folder, decidedAt) {
+    const target = folderRecordPath(trustRoot, folder);
+    await mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    const temporary = target + '.tmp-' + process.pid + '-' + randomUUID();
+    try {
+        await writeFile(temporary, JSON.stringify({ schema: FOLDER_SCHEMA, canonicalRoot: folder, decidedAt }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+        await rename(temporary, target);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => { });
+    }
+}
+async function canonicalHome(homeDir) { const raw = homeDir ?? homedir(); try {
+    return await realpath(raw);
+}
+catch {
+    return path.resolve(raw);
+} }
+/** The home folder and a drive root count for the session only (owner Q-R4-1; Claude Code treats the home directory so). */
+export function isSessionOnlyFolder(folder, { home = homedir() } = {}) {
+    const resolved = path.resolve(folder);
+    const key = folderKey(resolved);
+    return key === folderKey(path.parse(resolved).root) || key === folderKey(home);
+}
+export function createTrustAuthority({ projectRoot, trustRoot, clock, homeDir }) {
+    const service = createProjectTrustService({ trustRoot, ...(clock ? { clock } : {}) });
+    const now = clock ?? (() => new Date().toISOString());
+    async function folderDecision(snapshot) {
+        const fresh = snapshot ?? await current();
+        const folder = fresh.workspace.canonicalRoot;
+        const home = await canonicalHome(homeDir);
+        if (isSessionOnlyFolder(folder, { home }))
+            return { decided: false, source: null, path: null, sessionOnly: true, parent: null };
+        const above = path.dirname(folder);
+        const parent = above !== folder && !isSessionOnlyFolder(above, { home }) ? above : null;
+        if (await hasFolderRecord(trustRoot, folder))
+            return { decided: true, source: 'folder', path: folder, sessionOnly: false, parent };
+        if (fresh.storeSchema !== null)
+            return { decided: true, source: 'project', path: folder, sessionOnly: false, parent };
+        for (let cursor = above;;) {
+            if (!isSessionOnlyFolder(cursor, { home }) && await hasFolderRecord(trustRoot, cursor))
+                return { decided: true, source: 'parent', path: cursor, sessionOnly: false, parent };
+            const next = path.dirname(cursor);
+            if (next === cursor)
+                break;
+            cursor = next;
+        }
+        return { decided: false, source: null, path: null, sessionOnly: false, parent };
+    }
+    /* Which folder a grant saves, decided before anything is written. Omitted: this folder, or nothing for a session-only one. */
+    async function folderTarget(fresh, want) {
+        const folder = fresh.workspace.canonicalRoot;
+        const home = await canonicalHome(homeDir);
+        const sessionOnly = isSessionOnlyFolder(folder, { home });
+        const target = want ?? (sessionOnly ? 'none' : 'this');
+        if (target === 'none')
+            return null;
+        if (target === 'this') {
+            if (sessionOnly)
+                fail('PROJECT_TRUST_REQUIRED', 'The home folder and a drive root are trusted for one session only; TALOS never saves that decision.');
+            return folder;
+        }
+        const above = path.dirname(folder);
+        if (sessionOnly || above === folder || isSessionOnlyFolder(above, { home }))
+            fail('PROJECT_TRUST_REQUIRED', 'The parent folder is the home folder or a drive root, and TALOS never saves trust for those.');
+        return above;
+    }
+    async function current() {
+        const workspace = await resolveWorkspaceIdentity({ projectRoot });
+        const resources = await inventoryProjectResources(workspace);
+        const nestedRepositories = await findNestedRepositories(workspace, [...new Set(resources.map(resource => resource.relativePath))]);
+        const inspection = await service.inspectSnapshot(workspace, resources, nestedRepositories.map(row => row.relativePath));
+        const noResources = resources.length === 0 && inspection.storeSchema === null;
+        const rollbackAvailable = await service.rollbackAvailable(workspace);
+        return {
+            trusted: noResources ? true : inspection.state.trusted,
+            reason: noResources ? 'NO_PROJECT_RESOURCES' : inspection.state.reason,
+            storeSchema: inspection.storeSchema,
+            migrationRequired: inspection.migrationRequired,
+            rollbackAvailable,
+            workspace, resources: inspection.resources, nestedRepositories
+        };
+    }
+    async function exactExpected(expected, fresh) {
+        const want = expectationOf(expected);
+        const currentResources = fresh.resources.flatMap(row => row.current ? [row.current] : []);
+        if (want.workspaceIdentityHash !== fresh.workspace.identityHash || resourceSignature(want.resources) !== resourceSignature(currentResources)) {
+            fail('PROJECT_TRUST_INVALIDATED', 'PROJECT_TRUST_INVALIDATED: project resources changed while trust was being reviewed.', { reason: 'TRUST_REVIEW_CHANGED' });
+        }
+        if (nestedSignature(want.nestedRepositories) !== nestedSignature(fresh.nestedRepositories)) {
+            fail('PROJECT_TRUST_INVALIDATED', 'PROJECT_TRUST_INVALIDATED: nested repository boundaries changed while trust was being reviewed.', { reason: 'NESTED_REPOSITORY_BOUNDARY_CHANGED' });
+        }
+    }
+    return {
+        inspect: current,
+        folderDecision,
+        async trustProject(options = {}) {
+            const fresh = await current();
+            const expected = options.expected ? expectationOf(options.expected) : null;
+            const home = await canonicalHome(homeDir);
+            /* Q-R4-17: a session-only folder never gets anything on disk, whoever asks; the flag makes the question's answer explicit. */
+            const session = options.session === true || isSessionOnlyFolder(fresh.workspace.canonicalRoot, { home });
+            const target = session && options.folder === undefined ? null : await folderTarget(fresh, options.folder);
+            if (expected && expected.workspaceIdentityHash !== fresh.workspace.identityHash)
+                fail('PROJECT_TRUST_INVALIDATED', 'PROJECT_TRUST_INVALIDATED: workspace identity changed while trust was being reviewed.', { reason: 'RESOURCE_IDENTITY_MISMATCH' });
+            const reviewedNested = expected?.nestedRepositories ?? fresh.nestedRepositories;
+            if (reviewedNested.length && !options.includeNested)
+                nestedConsentFailure({ ...fresh, nestedRepositories: [...reviewedNested] });
+            const reviewedResources = expected?.resources ?? fresh.resources.flatMap(row => row.current ? [row.current] : []);
+            if (reviewedResources.length)
+                await service.trust(fresh.workspace, reviewedResources, reviewedNested.map(row => row.relativePath), { session });
+            const verified = await current();
+            if (expected && resourceSignature(expected.resources) !== resourceSignature(verified.resources.flatMap(row => row.current ? [row.current] : []))) {
+                fail('PROJECT_TRUST_INVALIDATED', `PROJECT_TRUST_INVALIDATED: the trusted project snapshot changed (${verified.reason}). TALOS did not load the changed snapshot.`, { reason: verified.reason, projectIdentity: verified.workspace.identityHash });
+            }
+            if (expected && nestedSignature(expected.nestedRepositories) !== nestedSignature(verified.nestedRepositories)) {
+                if (session)
+                    service.forgetSession(fresh.workspace);
+                else
+                    await service.revoke(fresh.workspace);
+                fail('PROJECT_TRUST_INVALIDATED', 'PROJECT_TRUST_INVALIDATED: nested repository boundaries changed while trust was being confirmed. TALOS revoked the new grant.', { reason: 'NESTED_REPOSITORY_BOUNDARY_CHANGED', projectIdentity: verified.workspace.identityHash });
+            }
+            if (target !== null && !session)
+                await writeFolderRecord(trustRoot, target, now());
+            return verified;
+        },
+        async sessionGrant() { return service.hasSession(await resolveWorkspaceIdentity({ projectRoot })); },
+        async revokeProject() { const before = await current(); await service.revoke(before.workspace); await rm(folderRecordPath(trustRoot, before.workspace.canonicalRoot), { force: true }); await rm(path.join(trustRoot, 'compat', before.workspace.identityHash), { recursive: true, force: true }); return current(); },
+        async trustScope(scope, options = {}) {
+            const before = await current();
+            if (options.expected)
+                await exactExpected(options.expected, before);
+            if (await readQuarantineRecord(trustRoot, before.workspace, scope))
+                fail('TRUST_SCOPE_QUARANTINED', 'TRUST_SCOPE_QUARANTINED: release quarantine before trusting this executable scope.');
+            if (before.storeSchema === null)
+                fail('PROJECT_TRUST_REQUIRED');
+            if (before.storeSchema === 'v1')
+                fail('TRUST_MIGRATION_REQUIRED', 'TRUST_MIGRATION_REQUIRED: migrate the legacy project trust store before changing individual resource trust.');
+            if (before.reason === 'NESTED_REPOSITORY_BOUNDARY_CHANGED')
+                nestedConsentFailure(before);
+            const rows = scopeRows(before, scope);
+            if (!rows.length)
+                fail('RESOURCE_NOT_FOUND');
+            const keys = rows.map(row => row.key);
+            const allTrusted = rows.every(row => row.state === 'trusted');
+            const resources = before.resources.flatMap(row => row.current ? [row.current] : []);
+            const changed = allTrusted ? false : await service.reconcile(before.workspace, resources, keys, before.nestedRepositories.map(row => row.relativePath));
+            return { changed, snapshot: await current() };
+        },
+        async untrustScope(scope) {
+            const before = await current();
+            if (before.storeSchema === null)
+                return { changed: false, snapshot: before };
+            if (before.storeSchema === 'v1')
+                fail('TRUST_MIGRATION_REQUIRED', 'TRUST_MIGRATION_REQUIRED: migrate the legacy project trust store before changing individual resource trust.');
+            const rows = scopeRows(before, scope);
+            if (!rows.length)
+                return { changed: false, snapshot: before };
+            const resources = before.resources.flatMap(row => row.current ? [row.current] : []);
+            const changed = await service.untrustResources(before.workspace, resources, rows.map(row => row.key), before.nestedRepositories.map(row => row.relativePath));
+            return { changed, snapshot: await current() };
+        },
+        async verifyScope(scope) {
+            const snapshot = await current();
+            if (await readQuarantineRecord(trustRoot, snapshot.workspace, scope))
+                return false;
+            const rows = scopeRows(snapshot, scope).filter(row => row.current);
+            return rows.length > 0 && rows.every(row => row.state === 'trusted');
+        },
+        async quarantineScope(scope, options = {}) {
+            const before = await current();
+            if (options.expected)
+                await exactExpected(options.expected, before);
+            const rows = scopeRows(before, scope).filter(row => row.current);
+            if (!rows.length)
+                fail('RESOURCE_NOT_FOUND');
+            const existing = await readQuarantineRecord(trustRoot, before.workspace, scope);
+            const record = {
+                schema: 'talos.cli.trust-quarantine.v1', active: true, workspaceIdentityHash: before.workspace.identityHash,
+                kind: scope.kind, id: scope.id, quarantinedAt: existing?.quarantinedAt ?? now(),
+                reason: options.reason ?? existing?.reason ?? null,
+                reviewedFingerprint: scopeReviewedFingerprint(rows)
+            };
+            const markerChanged = !existing || JSON.stringify(existing) !== JSON.stringify(record);
+            if (markerChanged)
+                await writeQuarantineRecord(trustRoot, before.workspace, scope, record);
+            let trustChanged = false;
+            if (before.storeSchema === 'v2') {
+                const resources = before.resources.flatMap(row => row.current ? [row.current] : []);
+                trustChanged = await service.untrustResources(before.workspace, resources, rows.map(row => row.key), before.nestedRepositories.map(row => row.relativePath));
+            }
+            return { changed: markerChanged || trustChanged, snapshot: await current(), record };
+        },
+        async releaseQuarantine(scope) {
+            const snapshot = await current();
+            const existing = await readQuarantineRecord(trustRoot, snapshot.workspace, scope);
+            if (!existing)
+                return { changed: false };
+            const rows = scopeRows(snapshot, scope).filter(row => row.current);
+            if (snapshot.storeSchema === 'v1')
+                fail('TRUST_MIGRATION_REQUIRED', 'TRUST_MIGRATION_REQUIRED: migrate the legacy project trust store before releasing quarantine.');
+            if (snapshot.storeSchema === 'v2' && rows.length) {
+                const resources = snapshot.resources.flatMap(row => row.current ? [row.current] : []);
+                await service.untrustResources(snapshot.workspace, resources, rows.map(row => row.key), snapshot.nestedRepositories.map(row => row.relativePath));
+            }
+            await rm(quarantinePath(trustRoot, snapshot.workspace, scope), { force: true });
+            return { changed: true };
+        },
+        async quarantineStatus(scope) {
+            const snapshot = await current();
+            return readQuarantineRecord(trustRoot, snapshot.workspace, scope);
+        },
+        async migrateLegacy(options = {}) {
+            const before = await current();
+            if (before.storeSchema !== 'v1')
+                return before;
+            const resourcesClean = before.resources.every(row => row.state === 'trusted');
+            if (!resourcesClean)
+                fail('TRUST_MIGRATION_SNAPSHOT_CHANGED');
+            if (before.nestedRepositories.length && !options.includeNested)
+                nestedConsentFailure(before);
+            const resources = before.resources.flatMap(row => row.current ? [row.current] : []);
+            await service.migrate(before.workspace, resources, before.nestedRepositories.map(row => row.relativePath));
+            return current();
+        },
+        async rollbackMigration() { const before = await current(); await service.rollbackMigration(before.workspace); return current(); },
+        async migrationBackupPath() { const snapshot = await current(); return service.migrationBackupPath(snapshot.workspace); },
+        async compatibilityRoots() { const snapshot = await current(); return compatibilityTrustRoots(trustRoot, snapshot.workspace); }
+    };
+}

package/dist/security/types.js

@@ -0,0 +1 @@
+export {};