trustdex 0.5.0 → 0.6.0

package/examples/adversarial/drift-after.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "reviewed-package": {
+      "command": "npx",
+      "args": ["-y", "@trustdex-fixtures/reviewed-server@1.2.3"],
+      "env": {
+        "API_TOKEN": "NOT_A_REAL_SECRET"
+      }
+    }
+  }
+}

package/examples/adversarial/drift-before.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "reviewed-package": {
+      "command": "npx",
+      "args": ["-y", "@trustdex-fixtures/reviewed-server@1.2.3"]
+    }
+  }
+}

package/examples/adversarial/expected.json

@@ -0,0 +1,30 @@
+{
+  "trusted-pinned-package": {
+    "action": "allow",
+    "signals": ["install-on-run"]
+  },
+  "floating-version": {
+    "action": "block",
+    "signals": ["install-on-run", "unbounded-version"]
+  },
+  "shell-launcher": {
+    "action": "block",
+    "signals": ["filesystem-path", "shell-execution"]
+  },
+  "credential-bearing-url": {
+    "action": "block",
+    "signals": ["embedded-credentials", "network-endpoint", "url-query-parameters"]
+  },
+  "insecure-remote": {
+    "action": "block",
+    "signals": ["insecure-transport", "network-endpoint"]
+  },
+  "sensitive-local-env": {
+    "action": "ask",
+    "signals": ["filesystem-path", "secret-env"]
+  },
+  "unknown-remote": {
+    "action": "block",
+    "signals": ["network-endpoint"]
+  }
+}

package/examples/adversarial/mcp-config.json

@@ -0,0 +1,32 @@
+{
+  "mcpServers": {
+    "trusted-pinned-package": {
+      "command": "npx",
+      "args": ["-y", "@trustdex-fixtures/reviewed-server@1.2.3"]
+    },
+    "floating-version": {
+      "command": "npx",
+      "args": ["-y", "@trustdex-fixtures/floating-server@latest"]
+    },
+    "shell-launcher": {
+      "command": "bash",
+      "args": ["-lc", "./fixture-server.mjs"]
+    },
+    "credential-bearing-url": {
+      "url": "https://fixture-user:fixture-password@credentials.fixture.invalid/mcp?token=fixture-token"
+    },
+    "insecure-remote": {
+      "url": "http://insecure.fixture.invalid/mcp"
+    },
+    "sensitive-local-env": {
+      "command": "node",
+      "args": ["./fixture-server.mjs"],
+      "env": {
+        "SERVICE_API_TOKEN": "NOT_A_REAL_SECRET"
+      }
+    },
+    "unknown-remote": {
+      "url": "https://unknown.fixture.invalid/mcp"
+    }
+  }
+}

package/examples/adversarial/policy.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "trustedPackages": [
+    "@trustdex-fixtures/reviewed-server"
+  ],
+  "allowedRemoteHosts": [
+    "credentials.fixture.invalid",
+    "insecure.fixture.invalid"
+  ]
+}

package/examples/claude.mcp.json

@@ -0,0 +1,24 @@
+{
+  "mcpServers": {
+    "reviewed": {
+      "type": "http",
+      "url": "https://reviewed.invalid/mcp"
+    },
+    "unknown": {
+      "type": "http",
+      "url": "https://unknown.invalid/mcp"
+    },
+    "helper": {
+      "type": "http",
+      "url": "https://reviewed.invalid/mcp",
+      "headersHelper": "INERT_HELPER_NOT_EXECUTED"
+    },
+    "needsReview": {
+      "type": "http",
+      "url": "https://reviewed.invalid/mcp",
+      "headers": {
+        "Authorization": "Bearer ${EXAMPLE_API_TOKEN}"
+      }
+    }
+  }
+}

package/examples/claude.policy.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "allowedRemoteHosts": [
+    "reviewed.invalid"
+  ]
+}

package/examples/claude.settings.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": [
+      "Bash(npm test)",
+      "WebFetch(domain:docs.example.invalid)",
+      "mcp__reviewed__read_*",
+      "Agent(Explore)"
+    ],
+    "ask": [
+      "Edit",
+      "Bash(git push *)"
+    ],
+    "deny": [
+      "Read(./.env)",
+      "WebFetch(domain:*)"
+    ],
+    "defaultMode": "default",
+    "additionalDirectories": [
+      "../shared-read-only"
+    ],
+    "disableBypassPermissionsMode": "disable",
+    "disableAutoMode": "disable",
+    "blockReadsOutsideWorkingDirectories": true
+  }
+}

package/examples/codex.config.toml

@@ -0,0 +1,16 @@
+model = "gpt-5.6-sol"
+
+[mcp_servers.filesystem]
+command = "npx"
+args = ["-y", "@modelcontextprotocol/server-filesystem@1.2.3", "./workspace"]
+env_vars = ["LOCAL_TOKEN"]
+
+[mcp_servers.remote-example]
+url = "https://mcp.example.com/mcp"
+bearer_token_env_var = "MCP_BEARER_TOKEN"
+
+[mcp_servers.remote-example.http_headers]
+X-Region = "us-east-1"
+
+[features]
+example = true

package/examples/codex.permissions.toml

@@ -0,0 +1,13 @@
+approval_policy = "on-request"
+approvals_reviewer = "user"
+sandbox_mode = "workspace-write"
+web_search = "cached"
+
+[sandbox_workspace_write]
+network_access = false
+writable_roots = ["../reviewed-shared"]
+exclude_slash_tmp = true
+exclude_tmpdir_env_var = true
+
+[agents]
+enabled = false

package/examples/mcp.json

@@ -0,0 +1,22 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem@1.2.3",
+        "./workspace"
+      ]
+    },
+    "unknown-calendar": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "calendar-helper@latest"
+      ],
+      "env": {
+        "CALENDAR_API_TOKEN": "${CALENDAR_API_TOKEN}"
+      }
+    }
+  }
+}

package/examples/trust-store.example.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "claims": [
+    {
+      "type": "package",
+      "subject": "example-mcp-server",
+      "publisher": "Example Publisher",
+      "status": "verified",
+      "evidence": {
+        "kind": "manual-review",
+        "reference": "https://example.invalid/security-review",
+        "checkedAt": "2026-09-19T00:00:00Z"
+      }
+    }
+  ]
+}

package/examples/trustdex.policy.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "unknownAction": "block",
+  "localAction": "ask",
+  "sensitiveAction": "ask",
+  "unpinnedAction": "ask",
+  "shellAction": "block",
+  "trustedPackages": [
+    "@modelcontextprotocol/server-filesystem"
+  ],
+  "allowedRemoteHosts": [
+    "mcp.example.com"
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustdex",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "A local-first trust, provenance, and review gate for AI agent tools, MCP servers, skills, and plugins.",
   "type": "module",
   "bin": {
@@ -8,8 +8,8 @@
   },
   "scripts": {
     "test": "node --test",
-    "test:research": "node --test test/research-fixtures.test.mjs",
-    "check": "node --check bin/trustdex.mjs && node --check src/canonical.mjs && node --check src/claude-config.mjs && node --check src/codex-config.mjs && node --check src/extensions.mjs && node --check src/gate.mjs && node --check src/inspect.mjs && node --check src/policy.mjs && node --check src/policy-packs.mjs && node --check src/provenance.mjs && node --check src/provenance-online.mjs && node --check src/review.mjs && node --check src/snapshot.mjs && node --check src/trust-record.mjs",
+    "test:research": "node --test test/research-fixtures.test.mjs test/claude-settings.test.mjs test/codex-settings.test.mjs",
+    "check": "node --check bin/trustdex.mjs && node --check src/canonical.mjs && node --check src/claude-config.mjs && node --check src/claude-settings.mjs && node --check src/codex-config.mjs && node --check src/codex-settings.mjs && node --check src/extensions.mjs && node --check src/gate.mjs && node --check src/inspect.mjs && node --check src/policy.mjs && node --check src/policy-packs.mjs && node --check src/provenance.mjs && node --check src/provenance-online.mjs && node --check src/review.mjs && node --check src/snapshot.mjs && node --check src/trust-record.mjs",
     "prepublishOnly": "npm test && npm run check"
   },
   "engines": {
@@ -38,6 +38,7 @@
     "bin",
     "src",
     "docs",
+    "examples",
     "README.md",
     "SECURITY.md",
     "LICENSE"

package/src/claude-settings.mjs

@@ -0,0 +1,173 @@
+const SECRET_KEY_RE = /(token|secret|password|passwd|api[_-]?key|credential|auth)/i;
+const PERMISSION_KEYS = new Set([
+  'allow',
+  'ask',
+  'deny',
+  'defaultMode',
+  'additionalDirectories',
+  'disableBypassPermissionsMode',
+  'disableAutoMode',
+  'blockReadsOutsideWorkingDirectories'
+]);
+const MODES = new Set([
+  'default',
+  'manual',
+  'acceptEdits',
+  'plan',
+  'dontAsk',
+  'bypassPermissions',
+  'auto'
+]);
+const NON_PERMISSION_ROOT_KEYS = new Set(['$schema', 'permissions']);
+
+function isObject(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function requireStringArray(value, field) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || !item.trim())) {
+    throw new Error(`Claude permissions.${field} must be an array of non-empty strings.`);
+  }
+  return value;
+}
+
+function parseRule(rule, list) {
+  const value = rule.trim();
+  const match = value.match(/^([A-Za-z0-9_*.-]+)(?:\(([\s\S]*)\))?$/);
+  if (!match) throw new Error(`Invalid Claude permissions.${list} rule syntax.`);
+
+  const tool = match[1];
+  const specifier = match[2] === undefined ? null : match[2];
+  if (specifier !== null && !specifier.trim()) {
+    throw new Error(`Invalid empty specifier in Claude permissions.${list}.`);
+  }
+  if (list === 'allow' && (tool === '*' || tool === 'mcp__*' || (!tool.startsWith('mcp__') && tool.includes('*')))) {
+    throw new Error('Claude ignores unanchored wildcard allow rules; use an explicit tool or MCP server rule.');
+  }
+  if (tool.startsWith('mcp__') && specifier !== null) {
+    throw new Error('Claude skips MCP permission rules with parenthesized specifiers.');
+  }
+
+  return {
+    tool,
+    hasSpecifier: specifier !== null,
+    matchesAll: specifier === null || specifier.trim() === '*' || specifier.trim() === 'domain:*',
+    mcpWildcard: tool.startsWith('mcp__') && (tool.endsWith('__*') || !tool.includes('__', 5))
+  };
+}
+
+function toolCategory(tool) {
+  if (tool === 'Bash' || tool === 'PowerShell') return 'shell';
+  if (['Read', 'Edit', 'Write', 'Glob', 'Grep', 'NotebookEdit'].includes(tool)) return 'filesystem';
+  if (tool === 'WebFetch' || tool === 'WebSearch') return 'network';
+  if (tool === 'Agent') return 'subagent';
+  if (tool.startsWith('mcp__')) return 'mcp';
+  return 'other';
+}
+
+function validateDisable(value, field) {
+  if (value !== undefined && value !== 'disable') {
+    throw new Error(`Claude permissions.${field} must be "disable" when present.`);
+  }
+}
+
+function validatePermissions(value) {
+  if (value === undefined) return { permissions: {}, rules: { allow: [], ask: [], deny: [] } };
+  if (!isObject(value)) throw new Error('Claude settings permissions must be a JSON object.');
+
+  for (const key of Object.keys(value)) {
+    if (!PERMISSION_KEYS.has(key)) throw new Error(`Unsupported Claude permission setting: ${key}`);
+  }
+
+  const defaultMode = value.defaultMode;
+  if (defaultMode !== undefined && (!MODES.has(defaultMode) || typeof defaultMode !== 'string')) {
+    throw new Error('Unsupported Claude permissions.defaultMode value.');
+  }
+  const additionalDirectories = requireStringArray(value.additionalDirectories, 'additionalDirectories');
+  if (value.blockReadsOutsideWorkingDirectories !== undefined &&
+      typeof value.blockReadsOutsideWorkingDirectories !== 'boolean') {
+    throw new Error('Claude permissions.blockReadsOutsideWorkingDirectories must be a boolean.');
+  }
+  validateDisable(value.disableBypassPermissionsMode, 'disableBypassPermissionsMode');
+  validateDisable(value.disableAutoMode, 'disableAutoMode');
+
+  const rules = {};
+  for (const list of ['allow', 'ask', 'deny']) {
+    rules[list] = requireStringArray(value[list], list).map((rule) => parseRule(rule, list));
+  }
+  return { permissions: { ...value, additionalDirectories }, rules };
+}
+
+function inspectAllowRules(rules, signals) {
+  for (const rule of rules) {
+    signals.add('claude-auto-approve');
+    const category = toolCategory(rule.tool);
+    if (category === 'shell') signals.add('claude-shell-auto-approve');
+    if (category === 'filesystem') signals.add('claude-filesystem-auto-approve');
+    if (category === 'network') signals.add('claude-network-auto-approve');
+    if (category === 'subagent') signals.add('claude-subagent-auto-approve');
+    if (category === 'mcp') signals.add('claude-mcp-auto-approve');
+    if (rule.matchesAll && ['shell', 'filesystem', 'network', 'subagent'].includes(category)) {
+      signals.add('claude-broad-auto-approve');
+    }
+    if (rule.mcpWildcard) signals.add('claude-mcp-wildcard');
+  }
+}
+
+export function inspectClaudeSettings(settings, sourceName = 'settings.json') {
+  if (!isObject(settings)) throw new Error('Expected a Claude settings JSON object.');
+
+  const { permissions, rules } = validatePermissions(settings.permissions);
+  const signals = new Set();
+  inspectAllowRules(rules.allow, signals);
+
+  if (permissions.defaultMode === 'bypassPermissions') signals.add('claude-bypass-permissions');
+  if (permissions.defaultMode === 'auto') signals.add('claude-auto-mode');
+  if (permissions.defaultMode === 'acceptEdits') signals.add('claude-filesystem-auto-approve');
+  if (permissions.additionalDirectories?.length) signals.add('claude-additional-directories');
+  if (permissions.blockReadsOutsideWorkingDirectories === false) signals.add('claude-outside-read-access');
+
+  let envKeys = [];
+  if (settings.env !== undefined) {
+    if (!isObject(settings.env)) throw new Error('Claude settings env must be a JSON object.');
+    envKeys = Object.keys(settings.env).sort();
+    signals.add('claude-environment');
+    if (envKeys.some((key) => SECRET_KEY_RE.test(key))) signals.add('secret-env');
+  }
+  if (settings.hooks !== undefined) signals.add('claude-hooks');
+  if (settings.apiKeyHelper !== undefined) signals.add('claude-credential-helper');
+  if (settings.sandbox !== undefined) signals.add('claude-sandbox-settings');
+  if (settings.enabledPlugins !== undefined || settings.extraKnownMarketplaces !== undefined) {
+    signals.add('claude-extension-loading');
+  }
+
+  const inspectedAdjacentKeys = new Set([
+    'env', 'hooks', 'apiKeyHelper', 'sandbox', 'enabledPlugins', 'extraKnownMarketplaces'
+  ]);
+  const uninspectedRootKeys = Object.keys(settings)
+    .filter((key) => !NON_PERMISSION_ROOT_KEYS.has(key) && !inspectedAdjacentKeys.has(key))
+    .sort();
+  if (uninspectedRootKeys.length) signals.add('uninspected-claude-settings');
+
+  const allowCategories = [...new Set(rules.allow.map((rule) => toolCategory(rule.tool)))].sort();
+  return {
+    name: sourceName,
+    kind: 'claude-settings',
+    source: { type: 'local', format: 'claude-settings', path: sourceName },
+    metadata: {
+      defaultMode: permissions.defaultMode || null,
+      allowRuleCount: rules.allow.length,
+      askRuleCount: rules.ask.length,
+      denyRuleCount: rules.deny.length,
+      allowCategories,
+      additionalDirectoryCount: permissions.additionalDirectories?.length || 0,
+      bypassDisabled: permissions.disableBypassPermissionsMode === 'disable',
+      autoModeDisabled: permissions.disableAutoMode === 'disable',
+      outsideReadsBlocked: permissions.blockReadsOutsideWorkingDirectories === true,
+      uninspectedRootKeys
+    },
+    signals: [...signals].sort(),
+    envKeys
+  };
+}

package/src/codex-config.mjs

@@ -1,6 +1,6 @@
 const CODEX_MCP_NESTED_SECTIONS = new Set(['env', 'http_headers', 'env_http_headers']);
 
-function stripComment(line) {
+export function stripComment(line) {
   let quote = null;
   let escaped = false;
   for (let i = 0; i < line.length; i += 1) {
@@ -61,7 +61,7 @@ function splitTopLevel(value) {
   return out;
 }
 
-function unquote(value) {
+export function unquote(value) {
   const raw = value.trim();
   if ((raw.startsWith('"') && raw.endsWith('"')) || (raw.startsWith("'") && raw.endsWith("'"))) {
     return raw.slice(1, -1);
@@ -69,7 +69,7 @@ function unquote(value) {
   return raw;
 }
 
-function parseValue(raw) {
+export function parseValue(raw) {
   const value = raw.trim();
   if (!value) return '';
   if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
@@ -79,7 +79,7 @@ function parseValue(raw) {
     return splitTopLevel(value.slice(1, -1)).map(parseValue);
   }
   if (value.startsWith('{') && value.endsWith('}')) {
-    const object = {};
+    const object = Object.create(null);
     for (const part of splitTopLevel(value.slice(1, -1))) {
       const index = part.indexOf('=');
       if (index < 1) throw new Error(`Unsupported TOML inline table entry: ${part}`);
@@ -93,7 +93,7 @@ function parseValue(raw) {
   return value;
 }
 
-function valueComplete(value) {
+export function valueComplete(value) {
   let square = 0;
   let curly = 0;
   let quote = null;
@@ -128,8 +128,10 @@ export function codexServerNameFromHeader(header) {
     /^mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))(?:\.(.*))?$/
   );
   if (!match) return null;
+  const name = match[1] || match[2] || match[3];
+  if (['__proto__', 'prototype', 'constructor'].includes(name)) return null;
   return {
-    name: match[1] || match[2] || match[3],
+    name,
     nested: match[4] || ''
   };
 }
@@ -209,7 +211,7 @@ function applyAssignment(server, nested, key, value) {
 
 export function parseCodexMcpToml(text) {
   const lines = String(text || '').split(/\r?\n/);
-  const servers = {};
+  const servers = Object.create(null);
   let section = null;
 
   for (let i = 0; i < lines.length; i += 1) {