trustdex 0.5.1 → 0.7.0

package/schemas/permission-posture-v1.schema.json

@@ -0,0 +1,162 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/permission-posture-v1.schema.json",
+  "title": "TrustDex permission posture snapshot v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "createdAt",
+    "runtime",
+    "policyDigest",
+    "posture",
+    "digest"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "agent-permission-posture" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "runtime": { "enum": ["claude", "codex"] },
+    "policyDigest": { "$ref": "#/$defs/digest" },
+    "digest": { "$ref": "#/$defs/digest" },
+    "posture": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["action", "signals", "metadata"],
+      "properties": {
+        "action": { "enum": ["allow", "ask", "block"] },
+        "signals": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string" }
+        },
+        "metadata": { "type": "object" }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "runtime": { "const": "claude" } } },
+      "then": {
+        "properties": {
+          "posture": {
+            "properties": {
+              "metadata": { "$ref": "#/$defs/claudeMetadata" }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "runtime": { "const": "codex" } } },
+      "then": {
+        "properties": {
+          "posture": {
+            "properties": {
+              "metadata": { "$ref": "#/$defs/codexMetadata" }
+            }
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "claudeMetadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "defaultMode",
+        "allowRuleCount",
+        "askRuleCount",
+        "denyRuleCount",
+        "allowCategories",
+        "additionalDirectoryCount",
+        "bypassDisabled",
+        "autoModeDisabled",
+        "outsideReadsBlocked",
+        "uninspectedRootKeyCount"
+      ],
+      "properties": {
+        "defaultMode": {
+          "type": ["string", "null"],
+          "enum": [null, "default", "manual", "acceptEdits", "plan", "dontAsk", "bypassPermissions", "auto"]
+        },
+        "allowRuleCount": { "$ref": "#/$defs/count" },
+        "askRuleCount": { "$ref": "#/$defs/count" },
+        "denyRuleCount": { "$ref": "#/$defs/count" },
+        "allowCategories": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "enum": ["filesystem", "mcp", "network", "other", "shell", "subagent"] }
+        },
+        "additionalDirectoryCount": { "$ref": "#/$defs/count" },
+        "bypassDisabled": { "type": "boolean" },
+        "autoModeDisabled": { "type": "boolean" },
+        "outsideReadsBlocked": { "type": "boolean" },
+        "uninspectedRootKeyCount": { "$ref": "#/$defs/count" }
+      }
+    },
+    "codexMetadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "approvalPolicy",
+        "granularPromptCategories",
+        "approvalsReviewer",
+        "sandboxMode",
+        "defaultPermissionsKind",
+        "webSearch",
+        "networkAccess",
+        "additionalWritableRootCount",
+        "tempRootsExcluded",
+        "subagentsEnabled",
+        "uninspectedAgentKeyCount",
+        "uninspectedRootKeyCount",
+        "uninspectedSectionKindCount"
+      ],
+      "properties": {
+        "approvalPolicy": {
+          "type": ["string", "null"],
+          "enum": [null, "on-request", "never", "granular"]
+        },
+        "granularPromptCategories": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "enum": ["mcp_elicitations", "request_permissions", "rules", "sandbox_approval", "skill_approval"] }
+        },
+        "approvalsReviewer": {
+          "type": ["string", "null"],
+          "enum": [null, "user", "auto_review"]
+        },
+        "sandboxMode": {
+          "type": ["string", "null"],
+          "enum": [null, "read-only", "workspace-write", "danger-full-access"]
+        },
+        "defaultPermissionsKind": {
+          "type": ["string", "null"],
+          "enum": [null, ":read-only", ":workspace", ":danger-full-access", "custom"]
+        },
+        "webSearch": {
+          "type": ["string", "null"],
+          "enum": [null, "disabled", "cached", "indexed", "live"]
+        },
+        "networkAccess": { "type": "boolean" },
+        "additionalWritableRootCount": { "$ref": "#/$defs/count" },
+        "tempRootsExcluded": { "type": "boolean" },
+        "subagentsEnabled": { "type": "boolean" },
+        "uninspectedAgentKeyCount": { "$ref": "#/$defs/count" },
+        "uninspectedRootKeyCount": { "$ref": "#/$defs/count" },
+        "uninspectedSectionKindCount": { "$ref": "#/$defs/count" }
+      }
+    }
+  }
+}

package/src/claude-settings.mjs

@@ -0,0 +1,173 @@
+const SECRET_KEY_RE = /(token|secret|password|passwd|api[_-]?key|credential|auth)/i;
+const PERMISSION_KEYS = new Set([
+  'allow',
+  'ask',
+  'deny',
+  'defaultMode',
+  'additionalDirectories',
+  'disableBypassPermissionsMode',
+  'disableAutoMode',
+  'blockReadsOutsideWorkingDirectories'
+]);
+const MODES = new Set([
+  'default',
+  'manual',
+  'acceptEdits',
+  'plan',
+  'dontAsk',
+  'bypassPermissions',
+  'auto'
+]);
+const NON_PERMISSION_ROOT_KEYS = new Set(['$schema', 'permissions']);
+
+function isObject(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function requireStringArray(value, field) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || !item.trim())) {
+    throw new Error(`Claude permissions.${field} must be an array of non-empty strings.`);
+  }
+  return value;
+}
+
+function parseRule(rule, list) {
+  const value = rule.trim();
+  const match = value.match(/^([A-Za-z0-9_*.-]+)(?:\(([\s\S]*)\))?$/);
+  if (!match) throw new Error(`Invalid Claude permissions.${list} rule syntax.`);
+
+  const tool = match[1];
+  const specifier = match[2] === undefined ? null : match[2];
+  if (specifier !== null && !specifier.trim()) {
+    throw new Error(`Invalid empty specifier in Claude permissions.${list}.`);
+  }
+  if (list === 'allow' && (tool === '*' || tool === 'mcp__*' || (!tool.startsWith('mcp__') && tool.includes('*')))) {
+    throw new Error('Claude ignores unanchored wildcard allow rules; use an explicit tool or MCP server rule.');
+  }
+  if (tool.startsWith('mcp__') && specifier !== null) {
+    throw new Error('Claude skips MCP permission rules with parenthesized specifiers.');
+  }
+
+  return {
+    tool,
+    hasSpecifier: specifier !== null,
+    matchesAll: specifier === null || specifier.trim() === '*' || specifier.trim() === 'domain:*',
+    mcpWildcard: tool.startsWith('mcp__') && (tool.endsWith('__*') || !tool.includes('__', 5))
+  };
+}
+
+function toolCategory(tool) {
+  if (tool === 'Bash' || tool === 'PowerShell') return 'shell';
+  if (['Read', 'Edit', 'Write', 'Glob', 'Grep', 'NotebookEdit'].includes(tool)) return 'filesystem';
+  if (tool === 'WebFetch' || tool === 'WebSearch') return 'network';
+  if (tool === 'Agent') return 'subagent';
+  if (tool.startsWith('mcp__')) return 'mcp';
+  return 'other';
+}
+
+function validateDisable(value, field) {
+  if (value !== undefined && value !== 'disable') {
+    throw new Error(`Claude permissions.${field} must be "disable" when present.`);
+  }
+}
+
+function validatePermissions(value) {
+  if (value === undefined) return { permissions: {}, rules: { allow: [], ask: [], deny: [] } };
+  if (!isObject(value)) throw new Error('Claude settings permissions must be a JSON object.');
+
+  for (const key of Object.keys(value)) {
+    if (!PERMISSION_KEYS.has(key)) throw new Error(`Unsupported Claude permission setting: ${key}`);
+  }
+
+  const defaultMode = value.defaultMode;
+  if (defaultMode !== undefined && (!MODES.has(defaultMode) || typeof defaultMode !== 'string')) {
+    throw new Error('Unsupported Claude permissions.defaultMode value.');
+  }
+  const additionalDirectories = requireStringArray(value.additionalDirectories, 'additionalDirectories');
+  if (value.blockReadsOutsideWorkingDirectories !== undefined &&
+      typeof value.blockReadsOutsideWorkingDirectories !== 'boolean') {
+    throw new Error('Claude permissions.blockReadsOutsideWorkingDirectories must be a boolean.');
+  }
+  validateDisable(value.disableBypassPermissionsMode, 'disableBypassPermissionsMode');
+  validateDisable(value.disableAutoMode, 'disableAutoMode');
+
+  const rules = {};
+  for (const list of ['allow', 'ask', 'deny']) {
+    rules[list] = requireStringArray(value[list], list).map((rule) => parseRule(rule, list));
+  }
+  return { permissions: { ...value, additionalDirectories }, rules };
+}
+
+function inspectAllowRules(rules, signals) {
+  for (const rule of rules) {
+    signals.add('claude-auto-approve');
+    const category = toolCategory(rule.tool);
+    if (category === 'shell') signals.add('claude-shell-auto-approve');
+    if (category === 'filesystem') signals.add('claude-filesystem-auto-approve');
+    if (category === 'network') signals.add('claude-network-auto-approve');
+    if (category === 'subagent') signals.add('claude-subagent-auto-approve');
+    if (category === 'mcp') signals.add('claude-mcp-auto-approve');
+    if (rule.matchesAll && ['shell', 'filesystem', 'network', 'subagent'].includes(category)) {
+      signals.add('claude-broad-auto-approve');
+    }
+    if (rule.mcpWildcard) signals.add('claude-mcp-wildcard');
+  }
+}
+
+export function inspectClaudeSettings(settings, sourceName = 'settings.json') {
+  if (!isObject(settings)) throw new Error('Expected a Claude settings JSON object.');
+
+  const { permissions, rules } = validatePermissions(settings.permissions);
+  const signals = new Set();
+  inspectAllowRules(rules.allow, signals);
+
+  if (permissions.defaultMode === 'bypassPermissions') signals.add('claude-bypass-permissions');
+  if (permissions.defaultMode === 'auto') signals.add('claude-auto-mode');
+  if (permissions.defaultMode === 'acceptEdits') signals.add('claude-filesystem-auto-approve');
+  if (permissions.additionalDirectories?.length) signals.add('claude-additional-directories');
+  if (permissions.blockReadsOutsideWorkingDirectories === false) signals.add('claude-outside-read-access');
+
+  let envKeys = [];
+  if (settings.env !== undefined) {
+    if (!isObject(settings.env)) throw new Error('Claude settings env must be a JSON object.');
+    envKeys = Object.keys(settings.env).sort();
+    signals.add('claude-environment');
+    if (envKeys.some((key) => SECRET_KEY_RE.test(key))) signals.add('secret-env');
+  }
+  if (settings.hooks !== undefined) signals.add('claude-hooks');
+  if (settings.apiKeyHelper !== undefined) signals.add('claude-credential-helper');
+  if (settings.sandbox !== undefined) signals.add('claude-sandbox-settings');
+  if (settings.enabledPlugins !== undefined || settings.extraKnownMarketplaces !== undefined) {
+    signals.add('claude-extension-loading');
+  }
+
+  const inspectedAdjacentKeys = new Set([
+    'env', 'hooks', 'apiKeyHelper', 'sandbox', 'enabledPlugins', 'extraKnownMarketplaces'
+  ]);
+  const uninspectedRootKeys = Object.keys(settings)
+    .filter((key) => !NON_PERMISSION_ROOT_KEYS.has(key) && !inspectedAdjacentKeys.has(key))
+    .sort();
+  if (uninspectedRootKeys.length) signals.add('uninspected-claude-settings');
+
+  const allowCategories = [...new Set(rules.allow.map((rule) => toolCategory(rule.tool)))].sort();
+  return {
+    name: sourceName,
+    kind: 'claude-settings',
+    source: { type: 'local', format: 'claude-settings', path: sourceName },
+    metadata: {
+      defaultMode: permissions.defaultMode || null,
+      allowRuleCount: rules.allow.length,
+      askRuleCount: rules.ask.length,
+      denyRuleCount: rules.deny.length,
+      allowCategories,
+      additionalDirectoryCount: permissions.additionalDirectories?.length || 0,
+      bypassDisabled: permissions.disableBypassPermissionsMode === 'disable',
+      autoModeDisabled: permissions.disableAutoMode === 'disable',
+      outsideReadsBlocked: permissions.blockReadsOutsideWorkingDirectories === true,
+      uninspectedRootKeys
+    },
+    signals: [...signals].sort(),
+    envKeys
+  };
+}

package/src/codex-config.mjs

@@ -1,6 +1,6 @@
 const CODEX_MCP_NESTED_SECTIONS = new Set(['env', 'http_headers', 'env_http_headers']);
 
-function stripComment(line) {
+export function stripComment(line) {
   let quote = null;
   let escaped = false;
   for (let i = 0; i < line.length; i += 1) {
@@ -61,7 +61,7 @@ function splitTopLevel(value) {
   return out;
 }
 
-function unquote(value) {
+export function unquote(value) {
   const raw = value.trim();
   if ((raw.startsWith('"') && raw.endsWith('"')) || (raw.startsWith("'") && raw.endsWith("'"))) {
     return raw.slice(1, -1);
@@ -69,7 +69,7 @@ function unquote(value) {
   return raw;
 }
 
-function parseValue(raw) {
+export function parseValue(raw) {
   const value = raw.trim();
   if (!value) return '';
   if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
@@ -79,7 +79,7 @@ function parseValue(raw) {
     return splitTopLevel(value.slice(1, -1)).map(parseValue);
   }
   if (value.startsWith('{') && value.endsWith('}')) {
-    const object = {};
+    const object = Object.create(null);
     for (const part of splitTopLevel(value.slice(1, -1))) {
       const index = part.indexOf('=');
       if (index < 1) throw new Error(`Unsupported TOML inline table entry: ${part}`);
@@ -93,7 +93,7 @@ function parseValue(raw) {
   return value;
 }
 
-function valueComplete(value) {
+export function valueComplete(value) {
   let square = 0;
   let curly = 0;
   let quote = null;
@@ -128,8 +128,10 @@ export function codexServerNameFromHeader(header) {
     /^mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))(?:\.(.*))?$/
   );
   if (!match) return null;
+  const name = match[1] || match[2] || match[3];
+  if (['__proto__', 'prototype', 'constructor'].includes(name)) return null;
   return {
-    name: match[1] || match[2] || match[3],
+    name,
     nested: match[4] || ''
   };
 }
@@ -209,7 +211,7 @@ function applyAssignment(server, nested, key, value) {
 
 export function parseCodexMcpToml(text) {
   const lines = String(text || '').split(/\r?\n/);
-  const servers = {};
+  const servers = Object.create(null);
   let section = null;
 
   for (let i = 0; i < lines.length; i += 1) {

package/src/codex-settings.mjs

@@ -0,0 +1,247 @@
+import { parseValue, stripComment, unquote, valueComplete } from './codex-config.mjs';
+
+const APPROVAL_POLICIES = new Set(['on-request', 'never']);
+const APPROVAL_REVIEWERS = new Set(['user', 'auto_review']);
+const SANDBOX_MODES = new Set(['read-only', 'workspace-write', 'danger-full-access']);
+const BUILTIN_PERMISSIONS = new Set([':read-only', ':workspace', ':danger-full-access']);
+const WEB_SEARCH_MODES = new Set(['disabled', 'cached', 'indexed', 'live']);
+const GRANULAR_KEYS = new Set([
+  'sandbox_approval',
+  'rules',
+  'mcp_elicitations',
+  'request_permissions',
+  'skill_approval'
+]);
+const SANDBOX_KEYS = new Set([
+  'network_access',
+  'writable_roots',
+  'exclude_slash_tmp',
+  'exclude_tmpdir_env_var'
+]);
+const INSPECTED_ROOT_KEYS = new Set([
+  'approval_policy',
+  'approvals_reviewer',
+  'sandbox_mode',
+  'default_permissions',
+  'web_search'
+]);
+
+function isObject(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function requireBoolean(value, key) {
+  if (typeof value !== 'boolean') throw new Error(`Codex ${key} must be a boolean.`);
+  return value;
+}
+
+function requireStringArray(value, key) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || !item.trim())) {
+    throw new Error(`Codex ${key} must be an array of non-empty strings.`);
+  }
+  return value;
+}
+
+function parseApprovalPolicy(value) {
+  if (typeof value === 'string') {
+    if (!APPROVAL_POLICIES.has(value)) throw new Error('Unsupported Codex approval_policy value.');
+    return { mode: value, promptCategories: [] };
+  }
+  if (!isObject(value) || !isObject(value.granular) || Object.keys(value).some((key) => key !== 'granular')) {
+    throw new Error('Codex approval_policy must be "on-request", "never", or a granular policy.');
+  }
+  for (const [key, enabled] of Object.entries(value.granular)) {
+    if (!GRANULAR_KEYS.has(key) || typeof enabled !== 'boolean') {
+      throw new Error(`Unsupported Codex granular approval setting: ${key}`);
+    }
+  }
+  return {
+    mode: 'granular',
+    promptCategories: Object.entries(value.granular)
+      .filter(([, enabled]) => enabled)
+      .map(([key]) => key)
+      .sort()
+  };
+}
+
+function parseTomlAssignments(text) {
+  const lines = String(text || '').split(/\r?\n/);
+  const root = Object.create(null);
+  const sandbox = Object.create(null);
+  const agents = Object.create(null);
+  const approvalGranular = Object.create(null);
+  const sections = new Set();
+  let section = '';
+
+  for (let i = 0; i < lines.length; i += 1) {
+    const cleaned = stripComment(lines[i]).trim();
+    if (!cleaned) continue;
+
+    const header = cleaned.match(/^\[([^\]]+)\]$/);
+    if (header) {
+      section = header[1].trim();
+      if (section.startsWith('sandbox_workspace_write.') ||
+          (section.startsWith('approval_policy.') && section !== 'approval_policy.granular')) {
+        throw new Error(`Unsupported Codex security section: ${section}`);
+      }
+      sections.add(section);
+      continue;
+    }
+
+    const eq = cleaned.indexOf('=');
+    if (eq < 1) {
+      if (section === 'sandbox_workspace_write' || !section) {
+        throw new Error(`Unsupported Codex TOML line ${i + 1}: expected key = value`);
+      }
+      continue;
+    }
+
+    const key = unquote(cleaned.slice(0, eq).trim());
+    let raw = cleaned.slice(eq + 1).trim();
+    while (!valueComplete(raw)) {
+      i += 1;
+      if (i >= lines.length) throw new Error(`Unterminated TOML value for ${key}`);
+      raw += `\n${stripComment(lines[i]).trim()}`;
+    }
+    const value = parseValue(raw);
+
+    if (!section) {
+      if (key.startsWith('sandbox_workspace_write.')) {
+        const nestedKey = key.slice('sandbox_workspace_write.'.length);
+        if (!nestedKey || nestedKey.includes('.')) throw new Error(`Unsupported Codex sandbox key: ${key}`);
+        if (Object.hasOwn(sandbox, nestedKey)) throw new Error(`Duplicate Codex sandbox setting: ${nestedKey}`);
+        sandbox[nestedKey] = value;
+      } else if (key.startsWith('approval_policy.granular.')) {
+        const nestedKey = key.slice('approval_policy.granular.'.length);
+        if (!nestedKey || nestedKey.includes('.')) throw new Error(`Unsupported Codex approval setting: ${key}`);
+        if (Object.hasOwn(approvalGranular, nestedKey)) throw new Error(`Duplicate Codex approval setting: ${nestedKey}`);
+        approvalGranular[nestedKey] = value;
+      } else {
+        if (Object.hasOwn(root, key)) throw new Error(`Duplicate Codex root setting: ${key}`);
+        root[key] = value;
+      }
+    } else if (section === 'sandbox_workspace_write') {
+      if (Object.hasOwn(sandbox, key)) throw new Error(`Duplicate Codex sandbox setting: ${key}`);
+      sandbox[key] = value;
+    } else if (section === 'agents') {
+      if (Object.hasOwn(agents, key)) throw new Error(`Duplicate Codex agents setting: ${key}`);
+      agents[key] = value;
+    } else if (section === 'approval_policy.granular') {
+      if (Object.hasOwn(approvalGranular, key)) throw new Error(`Duplicate Codex approval setting: ${key}`);
+      approvalGranular[key] = value;
+    }
+  }
+
+  if (Object.keys(approvalGranular).length) {
+    if (root.approval_policy !== undefined) {
+      throw new Error('Codex approval_policy cannot be declared in more than one form.');
+    }
+    root.approval_policy = { granular: approvalGranular };
+  }
+
+  return { root, sandbox, agents, sections: [...sections].sort() };
+}
+
+function validateSandbox(sandbox) {
+  for (const key of Object.keys(sandbox)) {
+    if (!SANDBOX_KEYS.has(key)) throw new Error(`Unsupported Codex sandbox_workspace_write setting: ${key}`);
+  }
+  if (sandbox.network_access !== undefined) requireBoolean(sandbox.network_access, 'sandbox network_access');
+  if (sandbox.writable_roots !== undefined) requireStringArray(sandbox.writable_roots, 'sandbox writable_roots');
+  if (sandbox.exclude_slash_tmp !== undefined) requireBoolean(sandbox.exclude_slash_tmp, 'sandbox exclude_slash_tmp');
+  if (sandbox.exclude_tmpdir_env_var !== undefined) {
+    requireBoolean(sandbox.exclude_tmpdir_env_var, 'sandbox exclude_tmpdir_env_var');
+  }
+}
+
+export function inspectCodexSettingsText(text, sourceName = 'config.toml') {
+  const { root, sandbox, agents, sections } = parseTomlAssignments(text);
+  validateSandbox(sandbox);
+
+  const signals = new Set();
+  let approval = { mode: null, promptCategories: [] };
+  if (root.approval_policy !== undefined) {
+    approval = parseApprovalPolicy(root.approval_policy);
+    if (approval.mode === 'never') signals.add('codex-no-approvals');
+  }
+
+  if (root.approvals_reviewer !== undefined) {
+    if (!APPROVAL_REVIEWERS.has(root.approvals_reviewer)) {
+      throw new Error('Unsupported Codex approvals_reviewer value.');
+    }
+    if (root.approvals_reviewer === 'auto_review') signals.add('codex-auto-review');
+  }
+
+  if (root.sandbox_mode !== undefined) {
+    if (!SANDBOX_MODES.has(root.sandbox_mode)) throw new Error('Unsupported Codex sandbox_mode value.');
+    if (root.sandbox_mode === 'workspace-write') signals.add('codex-workspace-write');
+    if (root.sandbox_mode === 'danger-full-access') signals.add('codex-full-access');
+  }
+
+  if (root.default_permissions !== undefined) {
+    if (typeof root.default_permissions !== 'string' || !root.default_permissions.trim()) {
+      throw new Error('Codex default_permissions must be a non-empty string.');
+    }
+    if (root.sandbox_mode !== undefined || sections.includes('sandbox_workspace_write') || Object.keys(sandbox).length) {
+      throw new Error('Codex default_permissions cannot be combined with sandbox_mode or sandbox_workspace_write.');
+    }
+    if (root.default_permissions === ':workspace') signals.add('codex-workspace-write');
+    else if (root.default_permissions === ':danger-full-access') signals.add('codex-full-access');
+    else if (!BUILTIN_PERMISSIONS.has(root.default_permissions)) signals.add('codex-custom-permissions');
+  }
+
+  if (root.web_search !== undefined) {
+    if (!WEB_SEARCH_MODES.has(root.web_search)) throw new Error('Unsupported Codex web_search value.');
+    if (root.web_search === 'live') signals.add('codex-live-web-search');
+  }
+
+  if (sandbox.network_access === true) signals.add('codex-network-access');
+  const writableRoots = sandbox.writable_roots || [];
+  if (writableRoots.length) signals.add('codex-additional-writable-roots');
+  if (sandbox.exclude_slash_tmp === false || sandbox.exclude_tmpdir_env_var === false) {
+    signals.add('codex-temp-write-access');
+  }
+  if (agents.enabled !== undefined) {
+    requireBoolean(agents.enabled, 'agents.enabled');
+    if (agents.enabled) signals.add('codex-subagents-enabled');
+  }
+  const uninspectedAgentKeys = Object.keys(agents).filter((key) => key !== 'enabled').sort();
+  if (uninspectedAgentKeys.length) signals.add('codex-subagent-settings');
+
+  const uninspectedRootKeys = Object.keys(root).filter((key) => !INSPECTED_ROOT_KEYS.has(key)).sort();
+  if (uninspectedRootKeys.length) signals.add('uninspected-codex-settings');
+
+  const sectionKinds = new Set(sections.map((section) => section.split('.')[0]));
+  sectionKinds.delete('sandbox_workspace_write');
+  sectionKinds.delete('approval_policy');
+  sectionKinds.delete('mcp_servers');
+  if (!uninspectedAgentKeys.length) sectionKinds.delete('agents');
+  if (sectionKinds.has('permissions')) signals.add('codex-custom-permissions');
+  if (sectionKinds.has('apps') || sectionKinds.has('plugins')) signals.add('codex-extension-settings');
+  if (sectionKinds.size) signals.add('uninspected-codex-sections');
+
+  return {
+    name: sourceName,
+    kind: 'codex-settings',
+    source: { type: 'local', format: 'codex-settings', path: sourceName },
+    metadata: {
+      approvalPolicy: approval.mode,
+      granularPromptCategories: approval.promptCategories,
+      approvalsReviewer: root.approvals_reviewer || null,
+      sandboxMode: root.sandbox_mode || null,
+      defaultPermissionsKind: BUILTIN_PERMISSIONS.has(root.default_permissions)
+        ? root.default_permissions
+        : root.default_permissions ? 'custom' : null,
+      webSearch: root.web_search || null,
+      networkAccess: sandbox.network_access === true,
+      additionalWritableRootCount: writableRoots.length,
+      tempRootsExcluded: sandbox.exclude_slash_tmp === true && sandbox.exclude_tmpdir_env_var === true,
+      subagentsEnabled: agents.enabled === true,
+      uninspectedAgentKeys,
+      uninspectedRootKeys,
+      uninspectedSectionKinds: [...sectionKinds].sort()
+    },
+    signals: [...signals].sort(),
+    envKeys: []
+  };
+}