{"version":"2.1.238","anchor":"trust-dialog-now-discloses-header-minting-and-marketplace-co","canonical_anchor":"trust-dialog-now-discloses-header-minting-and-marketplace-co","heading":"Trust dialog now discloses header-minting and marketplace commands a folder declares","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/trust-dialog-now-discloses-header-minting-and-marketplace-co","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Trust dialog now discloses header-minting and marketplace commands a folder declares\n\nThe folder-trust prompt now lists commands a repo would run to mint HTTP headers.\n\n**What**\n\nThe folder-trust screen lists commands the repo's own settings would run to mint HTTP headers, alongside the existing marketplace, OpenTelemetry and proxy helper warnings, so a repo cannot introduce a command that runs on first fetch without appearing in the prompt.\n\n**Details**\n\n- The preview now walks `extraKnownMarketplaces` including alias keys, and lists URL-source and per-plugin `headersHelper` entries plus command-source plugin entries, rendered as `<key>: <command> \u2192 <url>` with truncation.\n- Project and local `.mcp.json` and settings MCP servers that declare a `headersHelper` are listed too.\n- Trust telemetry gained `hasRepoHeadersHelpers`.\n- Dependency resolution will not auto-install a plugin whose archive is fetched through an entry `headersHelper`; that requires an explicit `\/plugin install`.\n- Plugin autoupdate gained the failure classes `entry_helper_disabled_by_policy`, `entry_helper_remote_policy_unconsented` and `entry_helper_not_inlined`, plus deferred and policy-blocked counters.\n\n**Evidence**\n\n`This folder runs commands to mint HTTP headers (headersHelper), declared in `, `extraKnownMarketplaces[`\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}