Development

Prerequisites

• Go 1.26+
• pass CLI + gpg (for testing with a real backend)

Building

git clone https://github.com/ikkun1222/trustless
cd trustless
go build -o trustless .

Testing

go test ./...

Project Structure

├── main.go                          # CLI entry point & subcommand dispatch
├── plugin.json                      # Agent Plugins 1.0.0 manifest
├── skills/
│   └── trustless-usage/             # Agent Skills spec-compliant SKILL.md
├── schemas/
│   └── plugin.schema.json           # Vendored official Agent Plugins schema
├── internal/
│   ├── backend/
│   │   ├── backend.go               # Backend interface + types
│   │   ├── env.go                   # Environment variable backend
│   │   └── pass.go                  # Pass CLI backend implementation
│   ├── config/
│   │   └── config.go                # TOML config loading/saving (+ policy types)
│   ├── proxy/
│   │   ├── ca.go                    # MITM CA certificate generation
│   │   ├── command.go               # HTTP forward proxy with credential substitution
│   │   └── mitm.go                  # MITM CONNECT handler (HTTPS interception)
│   ├── run/
│   │   └── command.go               # Subprocess credential injection (+ policy check)
│   ├── scanner/
│   │   ├── scanner.go               # Pattern-based credential redaction
│   │   └── scanner_test.go          # Scanner tests
│   └── secret/
│       └── command.go               # Credential store operations
├── scripts/
│   └── validate-plugin.py           # Agent Plugins packaging validation
└── docs/
    └── design.md                    # Architecture & design document

Dependencies

trustless builds as a single static binary with no runtime dependencies. The Go standard library covers nearly everything; the one exception is TOML parsing, which the standard library doesn’t provide. Rather than hand-rolling a parser (unvetted code is a bigger supply-chain risk than a vetted module), trustless uses github.com/pelletier/go-toml/v2 — the project’s only external module. It’s pure Go (no cgo, links statically with the rest of the binary), actively maintained, and fuzz-tested. The version is pinned via go.sum, with Dependabot and govulncheck monitoring it.

• github.com/pelletier/go-toml/v2 — TOML config file parsing (the only external module)

Exit Codes