Module workspace_trust 

Workspace trust for project-local .lean-ctx.toml overrides (GH security audit, finding 4).

A cloned repository ships its own .lean-ctx.toml. Through Config::merge_local that file can raise security-sensitive settings — replace the shell allowlist, widen the path jail (allow_paths / extra_roots), repoint the proxy upstream, define command aliases. Opening an untrusted clone with an agent would let the repo silently weaken lean-ctx’s own boundaries before the user has read a line.

Mirroring VS Code’s Workspace Trust, project-local security-sensitive overrides are honoured only for a workspace the user has explicitly trusted via lean-ctx trust. Trust is pinned to BOTH the workspace path AND a content hash of its .lean-ctx.toml: editing the file after trust invalidates the pin, so a “trust once, modify later” change can never take effect silently.

Comfort-only overrides (compression level, theme, memory tuning) are never gated — only the sensitive set listed in crate::core::config is withheld when the workspace is untrusted.

Structs

TrustStore

The pinned trust set, persisted as workspace-trust.toml.

TrustedWorkspace

One trusted workspace: its canonical path plus the content hash of the .lean-ctx.toml reviewed at trust time (empty when no local file existed).

Functions

config_hash_for

Content hash of a workspace’s .lean-ctx.toml, or empty when absent. This is the value pinned at trust time and re-checked on every load.

is_trusted

Whether root is trusted at its current .lean-ctx.toml content. Reads the file to compute the hash; prefer is_trusted_for when the caller already holds it (e.g. config load).

is_trusted_for

Whether root’s project-local security-sensitive overrides may be applied, given the CURRENT content hash of its .lean-ctx.toml.

list

All trusted workspaces from the persisted store (env overrides excluded — those are provenance-free and shown separately by callers when relevant).

load

Load the pinned set. A missing file is the common case and yields an empty store, never an error.

save

Persist the pinned set (creating the config dir if needed), owner-only.

store_path

Location of the trust file (<config_dir>/workspace-trust.toml).

trust

Trust root at its current .lean-ctx.toml content. Re-trusting an already trusted path refreshes its pinned hash (and timestamp). Returns the entry.

untrust

Remove root from the trust store. Returns true when an entry was removed.

untrusted_override_notice

Actionable, single-paragraph explanation for the MCP tool surfaces (#540): when the active project’s .lean-ctx.toml carries SECURITY-sensitive overrides that are being withheld because the workspace is untrusted, name the ignored keys and the two ways to make them take effect. None when the workspace is trusted, has no project root, has no local config, or its local config carries no sensitive overrides.