stacklok / toolhive / 31598145324

70%

Build Type

push

github

Committed by web-flow

Commit Message

Display recorded trust state to the user (#6137)

* Display recorded trust state to the user

RFC THV-0080 wants the identity pinned at trust-on-first-use displayed
prominently, not discovered weeks later inside a signer-mismatch
error. ProvenanceInfo becomes part of API responses: install results
carry the provenance or unsigned exception that was just recorded (the
CLI prints it — a deliberate exception to silent success, since a
recorded trust anchor is security-relevant information, not progress
chatter), and skill info surfaces the lock file's recorded trust state
for project-scoped skills, provisional markers included.

Part of #5899.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Carry install trust state across the HTTP boundary

The CLI is a pure HTTP client, so a field the service records but the
install response omits can never reach the user. Provenance and the
unsigned exception were set on InstallResult server-side and dropped at
the wire, leaving printInstallTrust to report every install as untracked
regardless of what was verified.

Add both to the install response and the client DTO, and map them back.
The round-trip test fails without the mapping — a direct test of the
printer passes either way, which is how the gap survived.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

37 of 63 new or added lines in 7 files covered. (58.73%)

5 existing lines in 2 files now uncovered.

84546 of 120223 relevant lines covered (70.32%)

99.04 hits per line