trustdex 0.6.0 → 0.8.0

package/examples/adversarial/permissions/codex-restrictive.toml

@@ -0,0 +1,13 @@
+approval_policy = "on-request"
+approvals_reviewer = "user"
+sandbox_mode = "read-only"
+web_search = "disabled"
+
+[sandbox_workspace_write]
+network_access = false
+writable_roots = []
+exclude_slash_tmp = true
+exclude_tmpdir_env_var = true
+
+[agents]
+enabled = false

package/examples/adversarial/permissions/expected.json

@@ -0,0 +1,18 @@
+{
+  "claude": {
+    "restrictiveAction": "ask",
+    "expandedAction": "block",
+    "diffStatus": "needs-review"
+  },
+  "codex": {
+    "restrictiveAction": "ask",
+    "expandedAction": "block",
+    "diffStatus": "needs-review"
+  },
+  "forbiddenOutputMarkers": [
+    "INERT_CLAUDE_PERMISSION_SECRET",
+    "INERT_CLAUDE_PERMISSION_PATH",
+    "INERT_CLAUDE_HOOK_SECRET",
+    "INERT_CODEX_PERMISSION_PATH"
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustdex",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "A local-first trust, provenance, and review gate for AI agent tools, MCP servers, skills, and plugins.",
   "type": "module",
   "bin": {
@@ -8,8 +8,8 @@
   },
   "scripts": {
     "test": "node --test",
-    "test:research": "node --test test/research-fixtures.test.mjs test/claude-settings.test.mjs test/codex-settings.test.mjs",
-    "check": "node --check bin/trustdex.mjs && node --check src/canonical.mjs && node --check src/claude-config.mjs && node --check src/claude-settings.mjs && node --check src/codex-config.mjs && node --check src/codex-settings.mjs && node --check src/extensions.mjs && node --check src/gate.mjs && node --check src/inspect.mjs && node --check src/policy.mjs && node --check src/policy-packs.mjs && node --check src/provenance.mjs && node --check src/provenance-online.mjs && node --check src/review.mjs && node --check src/snapshot.mjs && node --check src/trust-record.mjs",
+    "test:research": "node --test test/research-fixtures.test.mjs test/claude-settings.test.mjs test/codex-settings.test.mjs test/posture.test.mjs test/settings-stack.test.mjs",
+    "check": "node --check bin/trustdex.mjs && node --check src/canonical.mjs && node --check src/claude-config.mjs && node --check src/claude-settings.mjs && node --check src/codex-config.mjs && node --check src/codex-settings.mjs && node --check src/extensions.mjs && node --check src/gate.mjs && node --check src/inspect.mjs && node --check src/policy.mjs && node --check src/policy-packs.mjs && node --check src/posture.mjs && node --check src/provenance.mjs && node --check src/provenance-online.mjs && node --check src/review.mjs && node --check src/snapshot.mjs && node --check src/trust-record.mjs",
     "prepublishOnly": "npm test && npm run check"
   },
   "engines": {
@@ -39,6 +39,7 @@
     "src",
     "docs",
     "examples",
+    "schemas",
     "README.md",
     "SECURITY.md",
     "LICENSE"

package/schemas/permission-posture-diff-v1.schema.json

@@ -0,0 +1,78 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/permission-posture-diff-v1.schema.json",
+  "title": "TrustDex permission posture diff v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runtime",
+    "status",
+    "baselineDigest",
+    "currentDigest",
+    "summary",
+    "changes"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "runtime": { "enum": ["claude", "codex"] },
+    "status": { "enum": ["unchanged", "restricted", "needs-review"] },
+    "baselineDigest": { "$ref": "#/$defs/digest" },
+    "currentDigest": { "$ref": "#/$defs/digest" },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["expansions", "restrictions", "reviews"],
+      "properties": {
+        "expansions": { "$ref": "#/$defs/count" },
+        "restrictions": { "$ref": "#/$defs/count" },
+        "reviews": { "$ref": "#/$defs/count" }
+      }
+    },
+    "changes": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/change" }
+    }
+  },
+  "$defs": {
+    "digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "scalar": {
+      "type": ["string", "number", "boolean", "null"]
+    },
+    "change": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["impact", "type", "field"],
+      "properties": {
+        "impact": { "enum": ["expansion", "restriction", "review"] },
+        "type": {
+          "enum": [
+            "policy-changed",
+            "items-added",
+            "items-removed",
+            "decision-changed",
+            "count-changed",
+            "boolean-changed",
+            "value-changed"
+          ]
+        },
+        "field": { "type": "string" },
+        "before": { "$ref": "#/$defs/scalar" },
+        "after": { "$ref": "#/$defs/scalar" },
+        "items": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/schemas/permission-posture-diff-v2.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/permission-posture-diff-v2.schema.json",
+  "title": "TrustDex merged permission posture diff v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runtime",
+    "status",
+    "baselineDigest",
+    "currentDigest",
+    "summary",
+    "changes"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 2 },
+    "runtime": { "enum": ["claude", "codex"] },
+    "status": { "enum": ["unchanged", "restricted", "needs-review"] },
+    "baselineDigest": { "$ref": "permission-posture-diff-v1.schema.json#/$defs/digest" },
+    "currentDigest": { "$ref": "permission-posture-diff-v1.schema.json#/$defs/digest" },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["expansions", "restrictions", "reviews"],
+      "properties": {
+        "expansions": { "$ref": "permission-posture-diff-v1.schema.json#/$defs/count" },
+        "restrictions": { "$ref": "permission-posture-diff-v1.schema.json#/$defs/count" },
+        "reviews": { "$ref": "permission-posture-diff-v1.schema.json#/$defs/count" }
+      }
+    },
+    "changes": {
+      "type": "array",
+      "items": { "$ref": "permission-posture-diff-v1.schema.json#/$defs/change" }
+    }
+  }
+}

package/schemas/permission-posture-v1.schema.json

@@ -0,0 +1,162 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/permission-posture-v1.schema.json",
+  "title": "TrustDex permission posture snapshot v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "createdAt",
+    "runtime",
+    "policyDigest",
+    "posture",
+    "digest"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "agent-permission-posture" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "runtime": { "enum": ["claude", "codex"] },
+    "policyDigest": { "$ref": "#/$defs/digest" },
+    "digest": { "$ref": "#/$defs/digest" },
+    "posture": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["action", "signals", "metadata"],
+      "properties": {
+        "action": { "enum": ["allow", "ask", "block"] },
+        "signals": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string" }
+        },
+        "metadata": { "type": "object" }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "runtime": { "const": "claude" } } },
+      "then": {
+        "properties": {
+          "posture": {
+            "properties": {
+              "metadata": { "$ref": "#/$defs/claudeMetadata" }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "runtime": { "const": "codex" } } },
+      "then": {
+        "properties": {
+          "posture": {
+            "properties": {
+              "metadata": { "$ref": "#/$defs/codexMetadata" }
+            }
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "digest": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "claudeMetadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "defaultMode",
+        "allowRuleCount",
+        "askRuleCount",
+        "denyRuleCount",
+        "allowCategories",
+        "additionalDirectoryCount",
+        "bypassDisabled",
+        "autoModeDisabled",
+        "outsideReadsBlocked",
+        "uninspectedRootKeyCount"
+      ],
+      "properties": {
+        "defaultMode": {
+          "type": ["string", "null"],
+          "enum": [null, "default", "manual", "acceptEdits", "plan", "dontAsk", "bypassPermissions", "auto"]
+        },
+        "allowRuleCount": { "$ref": "#/$defs/count" },
+        "askRuleCount": { "$ref": "#/$defs/count" },
+        "denyRuleCount": { "$ref": "#/$defs/count" },
+        "allowCategories": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "enum": ["filesystem", "mcp", "network", "other", "shell", "subagent"] }
+        },
+        "additionalDirectoryCount": { "$ref": "#/$defs/count" },
+        "bypassDisabled": { "type": "boolean" },
+        "autoModeDisabled": { "type": "boolean" },
+        "outsideReadsBlocked": { "type": "boolean" },
+        "uninspectedRootKeyCount": { "$ref": "#/$defs/count" }
+      }
+    },
+    "codexMetadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "approvalPolicy",
+        "granularPromptCategories",
+        "approvalsReviewer",
+        "sandboxMode",
+        "defaultPermissionsKind",
+        "webSearch",
+        "networkAccess",
+        "additionalWritableRootCount",
+        "tempRootsExcluded",
+        "subagentsEnabled",
+        "uninspectedAgentKeyCount",
+        "uninspectedRootKeyCount",
+        "uninspectedSectionKindCount"
+      ],
+      "properties": {
+        "approvalPolicy": {
+          "type": ["string", "null"],
+          "enum": [null, "on-request", "never", "granular"]
+        },
+        "granularPromptCategories": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "enum": ["mcp_elicitations", "request_permissions", "rules", "sandbox_approval", "skill_approval"] }
+        },
+        "approvalsReviewer": {
+          "type": ["string", "null"],
+          "enum": [null, "user", "auto_review"]
+        },
+        "sandboxMode": {
+          "type": ["string", "null"],
+          "enum": [null, "read-only", "workspace-write", "danger-full-access"]
+        },
+        "defaultPermissionsKind": {
+          "type": ["string", "null"],
+          "enum": [null, ":read-only", ":workspace", ":danger-full-access", "custom"]
+        },
+        "webSearch": {
+          "type": ["string", "null"],
+          "enum": [null, "disabled", "cached", "indexed", "live"]
+        },
+        "networkAccess": { "type": "boolean" },
+        "additionalWritableRootCount": { "$ref": "#/$defs/count" },
+        "tempRootsExcluded": { "type": "boolean" },
+        "subagentsEnabled": { "type": "boolean" },
+        "uninspectedAgentKeyCount": { "$ref": "#/$defs/count" },
+        "uninspectedRootKeyCount": { "$ref": "#/$defs/count" },
+        "uninspectedSectionKindCount": { "$ref": "#/$defs/count" }
+      }
+    }
+  }
+}

package/schemas/permission-posture-v2.schema.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/grigent/trustdex/blob/main/schemas/permission-posture-v2.schema.json",
+  "title": "TrustDex merged permission posture snapshot v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "createdAt",
+    "runtime",
+    "policyDigest",
+    "posture",
+    "sources",
+    "digest"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 2 },
+    "kind": { "const": "agent-permission-posture" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "runtime": { "enum": ["claude", "codex"] },
+    "policyDigest": { "$ref": "permission-posture-v1.schema.json#/$defs/digest" },
+    "digest": { "$ref": "permission-posture-v1.schema.json#/$defs/digest" },
+    "posture": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["action", "signals", "metadata"],
+      "properties": {
+        "action": { "enum": ["allow", "ask", "block"] },
+        "signals": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string" }
+        },
+        "metadata": { "type": "object" }
+      }
+    },
+    "sources": { "type": "object" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "runtime": { "const": "claude" } } },
+      "then": {
+        "properties": {
+          "posture": {
+            "properties": {
+              "metadata": { "$ref": "permission-posture-v1.schema.json#/$defs/claudeMetadata" }
+            }
+          },
+          "sources": { "$ref": "#/$defs/claudeSources" }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "runtime": { "const": "codex" } } },
+      "then": {
+        "properties": {
+          "posture": {
+            "properties": {
+              "metadata": { "$ref": "permission-posture-v1.schema.json#/$defs/codexMetadata" }
+            }
+          },
+          "sources": { "$ref": "#/$defs/codexSources" }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "claudeSources": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sourceCount", "activeSourceCount", "sourceCounts"],
+      "properties": {
+        "sourceCount": { "$ref": "#/$defs/count" },
+        "activeSourceCount": { "$ref": "#/$defs/count" },
+        "sourceCounts": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["user", "project", "local", "session", "managed"],
+          "properties": {
+            "user": { "$ref": "#/$defs/count" },
+            "project": { "$ref": "#/$defs/count" },
+            "local": { "$ref": "#/$defs/count" },
+            "session": { "$ref": "#/$defs/count" },
+            "managed": { "$ref": "#/$defs/count" }
+          }
+        }
+      }
+    },
+    "codexSources": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sourceCount", "activeSourceCount", "sourceCounts"],
+      "properties": {
+        "sourceCount": { "$ref": "#/$defs/count" },
+        "activeSourceCount": { "$ref": "#/$defs/count" },
+        "sourceCounts": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["system", "managed", "user", "profile", "project", "cli"],
+          "properties": {
+            "system": { "$ref": "#/$defs/count" },
+            "managed": { "$ref": "#/$defs/count" },
+            "user": { "$ref": "#/$defs/count" },
+            "profile": { "$ref": "#/$defs/count" },
+            "project": { "$ref": "#/$defs/count" },
+            "cli": { "$ref": "#/$defs/count" }
+          }
+        }
+      }
+    }
+  }
+}

package/src/claude-settings.mjs

@@ -19,6 +19,14 @@ const MODES = new Set([
   'auto'
 ]);
 const NON_PERMISSION_ROOT_KEYS = new Set(['$schema', 'permissions']);
+const CLAUDE_SCOPE_RANK = Object.freeze({
+  user: 0,
+  project: 1,
+  local: 2,
+  session: 3,
+  managed: 4
+});
+const MERGED_PERMISSION_LISTS = new Set(['allow', 'ask', 'deny', 'additionalDirectories']);
 
 function isObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
@@ -171,3 +179,76 @@ export function inspectClaudeSettings(settings, sourceName = 'settings.json') {
     envKeys
   };
 }
+
+function normalizeClaudeLayers(layers) {
+  if (!Array.isArray(layers) || !layers.length) {
+    throw new Error('Claude settings stack requires at least one settings source.');
+  }
+  const seen = new Set();
+  return layers.map((layer, index) => {
+    if (!isObject(layer) || !Object.hasOwn(CLAUDE_SCOPE_RANK, layer.scope)) {
+      throw new Error('Unsupported Claude settings source scope.');
+    }
+    if (seen.has(layer.scope)) {
+      throw new Error(`Claude settings stack accepts only one ${layer.scope} source.`);
+    }
+    seen.add(layer.scope);
+    if (!isObject(layer.settings)) throw new Error('Claude settings source must contain a JSON object.');
+    inspectClaudeSettings(layer.settings, 'Claude settings source');
+    return { ...layer, index };
+  }).sort((left, right) =>
+    CLAUDE_SCOPE_RANK[left.scope] - CLAUDE_SCOPE_RANK[right.scope] || left.index - right.index
+  );
+}
+
+function mergeClaudeSettings(layers) {
+  const merged = {};
+  const permissions = {};
+
+  for (const { scope, settings } of layers) {
+    for (const [key, value] of Object.entries(settings)) {
+      if (key === 'permissions') continue;
+      if (Array.isArray(value) && Array.isArray(merged[key])) merged[key] = [...merged[key], ...value];
+      else merged[key] = value;
+    }
+
+    const current = settings.permissions || {};
+    for (const [key, value] of Object.entries(current)) {
+      if (MERGED_PERMISSION_LISTS.has(key)) {
+        permissions[key] = [...(permissions[key] || []), ...value];
+        continue;
+      }
+      if (key === 'defaultMode' && ['project', 'local'].includes(scope) &&
+          ['auto', 'bypassPermissions'].includes(value)) {
+        continue;
+      }
+      permissions[key] = value;
+    }
+  }
+
+  if (Object.keys(permissions).length) merged.permissions = permissions;
+  return merged;
+}
+
+export function inspectClaudeSettingsStack(layers) {
+  const normalized = normalizeClaudeLayers(layers);
+  const merged = mergeClaudeSettings(normalized);
+  const result = inspectClaudeSettings(merged, 'merged Claude settings');
+  const sourceCounts = Object.fromEntries(Object.keys(CLAUDE_SCOPE_RANK).map((scope) => [scope, 0]));
+  let activeSourceCount = 0;
+  for (const layer of normalized) {
+    sourceCounts[layer.scope] += 1;
+    if (Object.keys(layer.settings).length) activeSourceCount += 1;
+  }
+  return {
+    ...result,
+    name: 'merged Claude settings',
+    kind: 'claude-settings-stack',
+    source: { type: 'local', format: 'claude-settings-stack', scopes: sourceCounts },
+    settingsContext: {
+      sourceCount: normalized.length,
+      activeSourceCount,
+      sourceCounts
+    }
+  };
+}

package/src/codex-settings.mjs

@@ -25,6 +25,14 @@ const INSPECTED_ROOT_KEYS = new Set([
   'default_permissions',
   'web_search'
 ]);
+const CODEX_SCOPE_RANK = Object.freeze({
+  system: 0,
+  managed: 1,
+  user: 2,
+  profile: 3,
+  project: 4,
+  cli: 5
+});
 
 function isObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
@@ -154,8 +162,7 @@ function validateSandbox(sandbox) {
   }
 }
 
-export function inspectCodexSettingsText(text, sourceName = 'config.toml') {
-  const { root, sandbox, agents, sections } = parseTomlAssignments(text);
+function inspectParsedCodexSettings({ root, sandbox, agents, sections }, sourceName, kind) {
   validateSandbox(sandbox);
 
   const signals = new Set();
@@ -222,7 +229,7 @@ export function inspectCodexSettingsText(text, sourceName = 'config.toml') {
 
   return {
     name: sourceName,
-    kind: 'codex-settings',
+    kind,
     source: { type: 'local', format: 'codex-settings', path: sourceName },
     metadata: {
       approvalPolicy: approval.mode,
@@ -245,3 +252,74 @@ export function inspectCodexSettingsText(text, sourceName = 'config.toml') {
     envKeys: []
   };
 }
+
+export function inspectCodexSettingsText(text, sourceName = 'config.toml') {
+  return inspectParsedCodexSettings(
+    parseTomlAssignments(text),
+    sourceName,
+    'codex-settings'
+  );
+}
+
+function normalizeCodexLayers(layers) {
+  if (!Array.isArray(layers) || !layers.length) {
+    throw new Error('Codex settings stack requires at least one config source.');
+  }
+  const seen = new Set();
+  return layers.map((layer, index) => {
+    if (!isObject(layer) || !Object.hasOwn(CODEX_SCOPE_RANK, layer.scope)) {
+      throw new Error('Unsupported Codex config source scope.');
+    }
+    if (layer.scope !== 'project' && seen.has(layer.scope)) {
+      throw new Error(`Codex settings stack accepts only one ${layer.scope} source.`);
+    }
+    seen.add(layer.scope);
+    if (typeof layer.text !== 'string') throw new Error('Codex config source must contain TOML text.');
+    const parsed = parseTomlAssignments(layer.text);
+    inspectParsedCodexSettings(parsed, 'Codex settings source', 'codex-settings');
+    return { ...layer, parsed, index };
+  }).sort((left, right) =>
+    CODEX_SCOPE_RANK[left.scope] - CODEX_SCOPE_RANK[right.scope] || left.index - right.index
+  );
+}
+
+export function inspectCodexSettingsStack(layers) {
+  const normalized = normalizeCodexLayers(layers);
+  const merged = {
+    root: Object.create(null),
+    sandbox: Object.create(null),
+    agents: Object.create(null),
+    sections: []
+  };
+  const sections = new Set();
+  const sourceCounts = Object.fromEntries(Object.keys(CODEX_SCOPE_RANK).map((scope) => [scope, 0]));
+  let activeSourceCount = 0;
+
+  for (const layer of normalized) {
+    sourceCounts[layer.scope] += 1;
+    Object.assign(merged.root, layer.parsed.root);
+    Object.assign(merged.sandbox, layer.parsed.sandbox);
+    Object.assign(merged.agents, layer.parsed.agents);
+    for (const section of layer.parsed.sections) sections.add(section);
+    if (Object.keys(layer.parsed.root).length || Object.keys(layer.parsed.sandbox).length ||
+        Object.keys(layer.parsed.agents).length || layer.parsed.sections.length) {
+      activeSourceCount += 1;
+    }
+  }
+  merged.sections = [...sections].sort();
+
+  const result = inspectParsedCodexSettings(
+    merged,
+    'merged Codex settings',
+    'codex-settings-stack'
+  );
+  return {
+    ...result,
+    source: { type: 'local', format: 'codex-settings-stack', scopes: sourceCounts },
+    settingsContext: {
+      sourceCount: normalized.length,
+      activeSourceCount,
+      sourceCounts
+    }
+  };
+}