Still Systems TreeResolve

Still Systems, LLC — TreeResolve product site (stillsystems.github.io/treeresolve-community)

Enterprise Guide

This document provides technical, architectural, and security details for enterprise engineering organizations, InfoSec assessment teams, and IT administrators evaluating or deploying TreeResolve.

1. Executive Summary

TreeResolve is an offline-first, deterministic 3-way merge conflict resolution engine for VS Code and Git workflows. Unlike generative AI coding assistants, TreeResolve uses mathematical syntax-tree reconciliation to eliminate merge conflicts without code hallucination or data egress.

Core Value Proposition for Enterprises

2. Security & Compliance Architecture

2.1. What is transmitted

2.2. Deterministic AST Analysis vs. Generative AI

Traditional line-based merge tools frequently fail on trivial disjoint changes, while generative AI merge tools carry substantial risks:

TreeResolve's Approach: TreeResolve parses source files into concrete syntax trees using pre-compiled, sandboxed WebAssembly grammars (@vscode/tree-sitter-wasm). Changes are merged using formal set-difference logic against the common ancestor (Base). If an operation cannot be proven syntactically disjoint, TreeResolve preserves the conflict for human review.

2.3. WebAssembly Sandboxing & CSP Enforcement

``text default-src 'none'; connect-src 'none'; object-src 'none'; frame-ancestors 'none'; ``

The editor webview cannot initiate outbound network requests, run arbitrary remote scripts, or leak buffer contents.

3. Enterprise Licensing Architecture

TreeResolve uses an offline-first cryptographic licensing model that eliminates the requirement for continuous internet connectivity.

3.1. Ed25519 Asymmetric Verification

3.2. License Tiers & Binding Model

3.3. Internal Gateway / Proxy Deployment & Air-Gapped Environments

For enterprises operating within strict egress-restricted VPCs, corporate TLS-intercepting forward proxies, or air-gapped enclaves:

  1. Air-Gapped Workstations & Offline Keys:

``bash npx treeresolve license <JWT_TOKEN> ``

  1. Corporate Forward Proxies (HTTPS_PROXY / TLS Interception):
  1. Internal Licensing Mirror:

``json { "treeresolve.licensingEndpoint": "https://treeresolve-licensing.internal.company.com" } ``

3.4. Workstation Migration, Salt Invalidation & Floating Seat Reconciliation

To eliminate repository name leakage under network inspection, TreeResolve derives domain identifiers using a local 32-byte installation salt stored in VS Code secretsStorage (or ~/.treeresolve/installation_salt).

```bash # CLI npx treeresolve reclaim <licenseKey>

# VS Code Command Palette TreeResolve: Reclaim Floating Lease (Machine Migration) ```

This calls POST /api/v1/lease/reclaim on the licensing worker and stores the new lease for offline verification.

``bash npx treeresolve portal [licenseKey] ``

Or in VS Code: TreeResolve: Open Billing Portal (routes through GET /api/v1/portal?licenseKey=).

4. Fleet Management & Automated Deployment

4.1. Silent Installation via MDM

TreeResolve is on the VS Code Marketplace as still-systems.ss-treeresolve. For air-gapped fleets, distribute a verified offline VSIX (SHA-256 + Sigstore) from a GitHub Release, or provision the CLI via npm (treeresolve@1.0.2) for headless / mergetool workflows. Full steps and AllowedExtensions allow-list examples: docs/trust/offline-vsix.md.

Microsoft Intune / Windows MDM

Deploy via PowerShell script or Intune Win32 App:


# Install extension silently for all users
code --install-extension still-systems.ss-treeresolve --force

Jamf Pro / macOS Fleet

Deploy via Jamf shell policy:


#!/bin/bash
# Install extension silently under current logged-in user
sudo -u $(stat -f "%Su" /dev/console) code --install-extension still-systems.ss-treeresolve --force

4.2. Centralized VS Code Settings Configuration

IT administrators can push global default settings to /etc/vscode/settings.json (Linux), C:\ProgramData\Code\settings.json (Windows), or via MDM profiles:


{
  "treeresolve.autoMergeImports": true,
  "treeresolve.stageOnSave": true,
  "treeresolve.enableTelemetry": false,
  "treeresolve.licensingEndpoint": "https://treeresolve-licensing.internal.company.com"
}

4.3. Repository-Level Policy Governance (.treeresolverc)

Security and platform teams can check a .treeresolverc or treeresolve.json file into the root of any repository to enforce uniform conflict handling:


{
  "$schema": "https://stillsystems.github.io/treeresolve-community/schema/treeresolverc.json",
  "autoMergeImports": true,
  "stageOnSave": false,
  "rules": [
    {
      "pattern": "**/package-lock.json",
      "autoMerge": true,
      "stageOnSave": true
    },
    {
      "pattern": "security/auth/**",
      "autoMerge": false,
      "stageOnSave": false
    }
  ]
}

The $schema URL is hosted on Still Systems–controlled GitHub Pages (stillsystems.github.io). Do not point editors at third-party domains for this schema.

4.4. Headless CI/CD & CLI Deployment

For headless build systems, containerized CI runners, and terminal merge workflows:

```yaml

``bash npx treeresolve setup-driver ``

This configures Git's native 5-parameter merge driver (merge.treeresolve.driver) globally.

``bash npx treeresolve license <token> ``

Credentials are saved to ~/.treeresolve/license.json with restricted file permissions (0o600).

4.5. Headless CI/CD Runner Prerequisites & Node.js Runtime Isolation

The standalone TreeResolve CLI executable (bin/treeresolve.js) runs natively in headless environments without requiring VS Code:

5. Trust Pack (vendor risk, zero-cost)

TreeResolve does not ship a paid SOC 2 report. For InfoSec review, use the Trust Pack:

Quick claims buyers usually need:

6. Procurement & Commercial Terms

Still Systems (solo-operated LLC) offers honest, deliverable procurement paths for enterprise buyers:

For enterprise evaluations, custom quotes, or security reviews, submit an inquiry via the Enterprise Portal or open a thread on the TreeResolve Community Tracker.