feat: gate project-scoped hooks, plugins, and MCP servers behind workspace trust - #529

Merged

kevincodex1 merged 17 commits into

Gitlawb:mainfrom

beardthelion:fix/workspace-trust-gate

Jul 9, 2026

Commits on Jul 9, 2026

feat(workspacetrust): add exact-match trust store for project config gating

beardthelion
authored and
kevincodex1
committed
870a25c
feat(hooks): add ExcludeProject option to LoadConfig

beardthelion
authored and
kevincodex1
committed
742811f
feat(plugins): add ExcludeProject option to Load

beardthelion
authored and
kevincodex1
committed
0d87fa3
feat(cli): gate project hooks and plugins behind workspace trust

beardthelion
authored and
kevincodex1
committed
c7e685e
feat(cli): add zero trust command (trust/list/remove)

beardthelion
authored and
kevincodex1
committed
fc76514
fix(review): key spec-draft trust on the original launch dir; cover trust CLI edge branches

beardthelion
authored and
kevincodex1
committed
efef8cc
test(cli): end-to-end trust-gate coverage through agent.Run and exec --worktree

beardthelion
authored and
kevincodex1
committed
05e93da
style(cli): gofmt struct alignment in exec_spec.go

beardthelion
authored and
kevincodex1
committed
dce2712
fix(workspacetrust): compare stored trust entries literally, no symlink re-resolution

beardthelion
authored and
kevincodex1
committed
f4ab12b
feat(mcp): gate project-scoped MCP servers behind workspace trust

beardthelion
authored and
kevincodex1
committed
47a9ecd
test(cli): cover default-mode beforeTool firing through the trust gate

beardthelion
authored and
kevincodex1
committed
1ed68d7
docs(cli): note MCP servers in zero trust help text and doc comment

beardthelion
authored and
kevincodex1
committed
d0fad90
test(cli): make workspace-trust tests portable on macOS and Windows

beardthelion
authored and
kevincodex1
committed
879d292
feat(cli): surface the project MCP skip in the workspace-trust notice

beardthelion
authored and
kevincodex1
committed
5b36bf9
fix(cli): print zero trust --help to stdout with a success exit

beardthelion
authored and
kevincodex1
committed
558d88c
fix(cli): gate oauth MCP login and surface mcp-check trust notice

beardthelion
authored and
kevincodex1
committed
db94609
test(cli): adapt MCP startup-skip tests to two-arg resolveMCPConfig
kevincodex1
committed
66b7d9a

Navigation Menu

Uh oh!

feat: gate project-scoped hooks, plugins, and MCP servers behind workspace trust - #529

feat: gate project-scoped hooks, plugins, and MCP servers behind workspace trust#529
kevincodex1 merged 17 commits into
Gitlawb:mainfrom
beardthelion:fix/workspace-trust-gate

Commits on Jul 9, 2026

feat(workspacetrust): add exact-match trust store for project config gating

feat(hooks): add ExcludeProject option to LoadConfig

feat(plugins): add ExcludeProject option to Load

feat(cli): gate project hooks and plugins behind workspace trust

feat(cli): add zero trust command (trust/list/remove)

fix(review): key spec-draft trust on the original launch dir; cover trust CLI edge branches

test(cli): end-to-end trust-gate coverage through agent.Run and exec --worktree

style(cli): gofmt struct alignment in exec_spec.go

fix(workspacetrust): compare stored trust entries literally, no symlink re-resolution

feat(mcp): gate project-scoped MCP servers behind workspace trust

test(cli): cover default-mode beforeTool firing through the trust gate

docs(cli): note MCP servers in zero trust help text and doc comment

test(cli): make workspace-trust tests portable on macOS and Windows

feat(cli): surface the project MCP skip in the workspace-trust notice

fix(cli): print zero trust --help to stdout with a success exit

fix(cli): gate oauth MCP login and surface mcp-check trust notice

test(cli): adapt MCP startup-skip tests to two-arg resolveMCPConfig