trust

Return whether project hooks are trusted for a canonical workspace root.

Persist project-hook trust for a workspace root.

Resolve the workspace root that governs hook trust for a directory.

Explicit user/project path context for project-sensitive behavior.

Persisted trust record for one canonical workspace root.

Versioned on-disk trust store for project-scoped hooks.

Decides whether project-scoped hooks may run in a given directory.

Trust is a property of the workspace, not of the session, so it must be re-resolved every time the working directory moves. A session that starts in a trusted project and later moves into an untrusted one must not carry the original grant forward.

Callers hand this policy to HooksManager, which resolves it on load and on every reload; nothing upstream needs to hold or reinterpret the decision.