Harden project trust across IDE setup mutations and executable scripts

[codeforester]

Goal

Make Base's trust model accurately cover project-originated setup mutations and executable command surfaces, or present explicit boundaries that prevent users from mistaking manifest approval for broader repository integrity.

Background

Project setup can install manifest-declared IDE extensions and merge arbitrary settings into user-global VS Code or Cursor configuration. Onboarding performs setup before its manifest command-trust review.

Command trust is bound to the base_manifest.yaml digest. Git HEAD is audit metadata only, and the documented contract intentionally does not prove that scripts reachable from the manifest are unchanged.

Relevant code and docs:

• https://github.com/basefoundry/base/blob/main/cli/python/base_setup/ide_extensions.py#L19-L45
• https://github.com/basefoundry/base/blob/main/cli/python/base_setup/ide_settings.py#L24-L106
• https://github.com/basefoundry/base/blob/main/docs/basectl-onboard.md#L125-L159
• https://github.com/basefoundry/base/blob/main/docs/manifest-command-trust.md#L55-L75
• https://github.com/basefoundry/base/blob/main/cli/python/base_trust/trust_store.py#L171-L206

Scope

• Define the trust boundary for project-originated IDE extension installs and user-global settings.
• Require explicit review or consent for global IDE mutations, including under --yes.
• Show the exact extensions and settings before applying them.
• Decide whether command trust should bind direct executable inputs, Git state, or emit a strong stale-script warning.
• Keep setup, onboarding, trust status, docs, and tests aligned with the selected contract.

Acceptance Criteria

• A newly cloned project cannot silently install extensions or add global IDE settings through generic setup consent.
• Dry-run provides a complete mutation plan.
• --yes does not implicitly grant project command trust or hide project-originated global mutations.
• The trust UI states whether script changes invalidate approval.
• Tests cover manifest-only changes, referenced-script changes, Git HEAD changes, and IDE setup consent.

Validation

• Focused base_setup IDE tests.
• Focused base_trust pytest and manifest-command-trust BATS tests.
• Onboarding dry-run and interactive consent tests.
• env -u BASE_HOME ./bin/base-test
• git diff --check

Non-Goals

• Do not turn Base into a general IDE policy manager.
• Do not overwrite existing user settings.
• Do not add remote trust or centralized policy infrastructure in this issue.

Project Fields

• Status: Backlog
• Priority: P1
• Area: Security
• Initiative: Contract Hardening
• Size: L

Agent Assignment

• Assignee: codeforester