@getmarrow/install 0.1.16 → 0.1.18

package/README.md

@@ -11,16 +11,27 @@ npx @getmarrow/install --repair
 npx @getmarrow/install doctor
 ```
 
-## What's New in v0.1.16
+## What's New in v0.1.18
 
-v0.1.16 expands the Govern TUI harness addon coverage while preserving adaptive mode recommendations.
+v0.1.18 makes Marrow key loading more reliable for agents after install.
 
-- `npx @getmarrow/install govern` now shows first-class rows for Codex, Claude Code, Cursor, Gemini CLI, Grok CLI, DeepSeek CLI, Hermes, GLM CLI, Qwen CLI, OpenCode, OpenClaw, MCP-compatible clients, CI scripts, and custom commands.
+- Installer, SDK passive runtime, and MCP hooks now all recognize the same key locations: process env, MCP/agent secret env, `.marrow/env`, `.marrow/env.local`, `.env`, `.env.local`, `~/.marrow/env`, and `~/.marrow/env.local`.
+- `MARROW_API_KEY` remains the canonical variable. `MARROW_KEY` is accepted as an alias for fleet runners and secret managers.
+- `npx @getmarrow/install doctor` now reports whether a key is loaded, where a likely key file exists, and the exact repair command without printing the key.
+- Generated `.marrow/passive-runtime.mjs` loads `.marrow/env` before deciding Marrow is missing, so agents keep logging even when the shell did not export the key.
+- Full keys are never printed in diagnostics. Keep `.marrow/env` out of git and set file permissions to owner-only when possible.
+
+## What's New in v0.1.17
+
+v0.1.17 expands the Govern TUI harness addon coverage while preserving adaptive mode recommendations.
+
+- `npx @getmarrow/install govern` now shows first-class rows for Codex, Claude Code, Cursor, Cline, Gemini CLI, Grok CLI, DeepSeek CLI, Minimax CLI, Kimi CLI, Hermes, GLM CLI, Qwen CLI, OpenCode, OpenClaw, MCP-compatible clients, CI scripts, and custom commands.
 - Marrow remains a thin governance layer. It does not replace your model or harness; it wraps the command your agent already runs with pre-action risk gates, proof requirements, and automatic outcome closure.
 - Detection stays recommendation-first. Marrow uses local config, instruction, CI, and MCP markers to suggest the safest path, then the user or owner accepts, overrides, or saves a policy profile.
+- Cursor is treated as a development workflow surface. Marrow can govern Cursor-backed code review, edits, tests, deploys, and release steps through MCP setup, project rules, or the governed command wrapper.
 - If a harness is not detected yet, use **Custom command** or `npx @getmarrow/install run -- <your-agent-command>` to govern it immediately.
 
-Business value: teams can add Marrow to the agent stack they already use instead of migrating to a new agent host. Codex, Claude Code, Cursor, Gemini, Grok, DeepSeek, Hermes, GLM, Qwen, OpenClaw, OpenCode, MCP clients, and CI scripts can all be brought under the same governance loop.
+Business value: teams can add Marrow to the agent stack they already use instead of migrating to a new agent host. Codex, Claude Code, Cursor, Cline, Gemini, Grok, DeepSeek, Minimax, Kimi/Moonshot, Hermes, GLM, Qwen, OpenClaw, OpenCode, MCP clients, and CI scripts can all be brought under the same governance loop.
 
 ## What's New in v0.1.14
 
@@ -170,7 +181,7 @@ Marrow should answer with `proceed`, `warn`, `block`, or `owner_approval_require
 - Codex/agent instruction files such as `AGENTS.md`
 - Claude Code settings and hooks
 - Cursor project folders
-- Gemini, Grok, DeepSeek, Hermes, GLM, and Qwen project marker files when present
+- Gemini, Grok, DeepSeek, Minimax, Kimi/Moonshot, Hermes, GLM, and Qwen project marker files when present
 - MCP config files
 - CI workflow/script markers
 - Node projects

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Universal installer for Marrow passive agent setup.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/governed-runner.js

@@ -581,9 +581,12 @@ function detectHarnesses(cwd = process.cwd()) {
     { name: 'Gemini CLI', command: 'gemini', detected: existsAny([path.join(cwd, 'GEMINI.md'), path.join(cwd, '.gemini'), path.join(home, '.gemini')]) },
     { name: 'Grok CLI', command: 'grok', detected: existsAny([path.join(cwd, 'GROK.md'), path.join(cwd, '.grok'), path.join(home, '.grok')]) },
     { name: 'DeepSeek CLI', command: 'deepseek', detected: existsAny([path.join(cwd, 'DEEPSEEK.md'), path.join(cwd, '.deepseek'), path.join(home, '.deepseek')]) },
+    { name: 'Minimax CLI', command: 'minimax', detected: existsAny([path.join(cwd, 'MINIMAX.md'), path.join(cwd, '.minimax'), path.join(home, '.minimax')]) },
+    { name: 'Kimi CLI', command: 'kimi', detected: existsAny([path.join(cwd, 'KIMI.md'), path.join(cwd, 'MOONSHOT.md'), path.join(cwd, '.kimi'), path.join(cwd, '.moonshot'), path.join(home, '.kimi'), path.join(home, '.moonshot')]) },
     { name: 'Hermes', command: 'hermes', detected: existsAny([path.join(cwd, 'HERMES.md'), path.join(cwd, 'hermes.json'), path.join(cwd, '.hermes'), path.join(home, '.hermes')]) },
     { name: 'GLM CLI', command: 'glm', detected: existsAny([path.join(cwd, 'GLM.md'), path.join(cwd, '.glm'), path.join(home, '.glm')]) },
     { name: 'Qwen CLI', command: 'qwen', detected: existsAny([path.join(cwd, 'QWEN.md'), path.join(cwd, '.qwen'), path.join(home, '.qwen')]) },
+    { name: 'Cline', command: 'cline', detected: existsAny([path.join(cwd, '.cline'), path.join(cwd, 'CLINE.md'), path.join(home, '.cline')]) },
     { name: 'OpenCode', command: 'opencode', detected: existsAny([path.join(cwd, 'opencode.json'), path.join(cwd, '.opencode'), path.join(home, '.opencode')]) },
     { name: 'OpenClaw', command: 'openclaw agent', detected: existsAny([path.join(cwd, 'openclaw.json'), path.join(home, '.openclaw')]) },
     { name: 'MCP-compatible client', command: '<mcp-client>', detected: existsAny([path.join(cwd, '.mcp.json'), path.join(cwd, '.cursor', 'mcp.json'), path.join(cwd, '.claude', 'settings.json')]) },

package/src/installer.js

@@ -15,7 +15,7 @@ function parseArgs(argv) {
     doctor: false,
     repair: false,
     mode: 'auto',
-    apiKey: process.env.MARROW_API_KEY || '',
+    apiKey: process.env.MARROW_API_KEY || process.env.MARROW_KEY || '',
     baseUrl: process.env.MARROW_BASE_URL || DEFAULT_BASE_URL,
     agentId: process.env.MARROW_FLEET_AGENT_ID || process.env.MARROW_AGENT_ID || '',
     selfTest: true,
@@ -57,6 +57,12 @@ function parseArgs(argv) {
     throw new Error('--mode must be one of auto, mcp, sdk, both, md');
   }
 
+  const resolved = resolveMarrowKeyMaterial(options.cwd);
+  if (!options.apiKey && resolved.apiKey) options.apiKey = resolved.apiKey;
+  if (!options.agentId && resolved.agentId) options.agentId = resolved.agentId;
+  if (options.baseUrl === DEFAULT_BASE_URL && resolved.baseUrl) options.baseUrl = resolved.baseUrl;
+  if (!options.keySource && resolved.source) options.keySource = resolved.source;
+
   return options;
 }
 
@@ -157,8 +163,7 @@ function findLikelyEnvFiles(detection, env = process.env) {
     path.join(detection.root, '.marrow', 'env'),
     path.join(detection.root, '.marrow', 'env.local'),
     path.join(home, '.marrow', 'env'),
-    path.join(home, '.openclaw', 'credentials', 'marrow-mcp.env'),
-    path.join(home, '.openclaw', 'gateway.systemd.env'),
+    path.join(home, '.marrow', 'env.local'),
   ];
   return candidates.filter((filePath) => {
     if (!exists(filePath)) return false;
@@ -183,6 +188,36 @@ function readEnvVar(filePath, name) {
   return match ? stripQuotes(match[1]) : '';
 }
 
+function resolveMarrowKeyMaterial(cwd = process.cwd(), env = process.env) {
+  if (env.MARROW_API_KEY || env.MARROW_KEY) {
+    return {
+      apiKey: env.MARROW_API_KEY || env.MARROW_KEY,
+      baseUrl: env.MARROW_BASE_URL || DEFAULT_BASE_URL,
+      agentId: env.MARROW_FLEET_AGENT_ID || env.MARROW_AGENT_ID || '',
+      source: env.MARROW_API_KEY ? 'MARROW_API_KEY' : 'MARROW_KEY',
+    };
+  }
+
+  const detection = detectEnvironment(cwd, env);
+  for (const filePath of findLikelyEnvFiles(detection, env)) {
+    const apiKey = readEnvVar(filePath, 'MARROW_API_KEY') || readEnvVar(filePath, 'MARROW_KEY');
+    if (!apiKey) continue;
+    return {
+      apiKey,
+      baseUrl: readEnvVar(filePath, 'MARROW_BASE_URL') || env.MARROW_BASE_URL || DEFAULT_BASE_URL,
+      agentId: readEnvVar(filePath, 'MARROW_FLEET_AGENT_ID') || readEnvVar(filePath, 'MARROW_AGENT_ID') || env.MARROW_FLEET_AGENT_ID || env.MARROW_AGENT_ID || '',
+      source: filePath,
+    };
+  }
+
+  return {
+    apiKey: '',
+    baseUrl: env.MARROW_BASE_URL || DEFAULT_BASE_URL,
+    agentId: env.MARROW_FLEET_AGENT_ID || env.MARROW_AGENT_ID || '',
+    source: null,
+  };
+}
+
 function readFirstLineSecret(filePath) {
   if (!exists(filePath)) return '';
   return safeRead(filePath).split(/\r?\n/).map((line) => line.trim()).find(Boolean) || '';
@@ -297,27 +332,79 @@ Required environment:
 
 - \`MARROW_API_KEY\`
 - Optional: \`MARROW_BASE_URL\`, \`MARROW_FLEET_AGENT_ID\`
+
+Key loading:
+
+- Prefer your shell, MCP secret store, or agent secret manager.
+- Marrow also auto-detects \`.marrow/env\`, \`.marrow/env.local\`, \`.env\`, \`.env.local\`, and \`~/.marrow/env\`.
+- Run \`npx @getmarrow/install doctor\` any time an agent says Marrow is missing or degraded.
 ${MARROW_BLOCK_END}`;
 }
 
 function passiveRuntimeSource() {
-  return `const apiKey = process.env.MARROW_API_KEY;
+  return `import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+function stripQuotes(value) {
+  const trimmed = String(value || '').trim();
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) return trimmed.slice(1, -1);
+  return trimmed;
+}
+
+function readEnvFile(filePath) {
+  if (!fs.existsSync(filePath)) return {};
+  const values = {};
+  const allowed = new Set(['MARROW_API_KEY', 'MARROW_KEY', 'MARROW_BASE_URL', 'MARROW_FLEET_AGENT_ID', 'MARROW_AGENT_ID', 'MARROW_SESSION_ID', 'MARROW_ENFORCEMENT_MODE', 'MARROW_PASSIVE_VALUE_REPORT', 'MARROW_VALUE_REPORT_PERIOD', 'MARROW_AGENT_RUNTIME', 'MARROW_WORKFLOW_GATE', 'MARROW_REQUIRE_OUTCOME_CLOSURE']);
+  for (const line of fs.readFileSync(filePath, 'utf8').split(/\\r?\\n/)) {
+    const match = line.match(/^\\s*(?:export\\s+)?([A-Z_][A-Z0-9_]*)\\s*=\\s*(.*?)\\s*$/);
+    if (!match) continue;
+    if (!allowed.has(match[1])) continue;
+    let value = match[2] || '';
+    const hashIndex = value.search(/\\s+#/);
+    if (hashIndex >= 0) value = value.slice(0, hashIndex);
+    values[match[1]] = stripQuotes(value);
+  }
+  return values;
+}
+
+function resolveMarrowEnv() {
+  if (process.env.MARROW_API_KEY || process.env.MARROW_KEY) return process.env;
+  const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+  const files = [];
+  let dir = process.cwd();
+  for (let depth = 0; depth < 8; depth += 1) {
+    files.push(path.join(dir, '.marrow', 'env'), path.join(dir, '.marrow', 'env.local'), path.join(dir, '.env'), path.join(dir, '.env.local'));
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  files.push(path.join(home, '.marrow', 'env'), path.join(home, '.marrow', 'env.local'));
+  for (const filePath of [...new Set(files)]) {
+    const values = readEnvFile(filePath);
+    if (values.MARROW_API_KEY || values.MARROW_KEY) return { ...process.env, ...values };
+  }
+  return process.env;
+}
+
+const marrowEnv = resolveMarrowEnv();
+const apiKey = marrowEnv.MARROW_API_KEY || marrowEnv.MARROW_KEY;
 if (apiKey && !globalThis.__MARROW_PASSIVE_RUNTIME__) {
   try {
     const { MarrowClient } = await import('@getmarrow/sdk');
     const marrow = new MarrowClient(apiKey, {
-      baseUrl: process.env.MARROW_BASE_URL,
-      agentId: process.env.MARROW_FLEET_AGENT_ID || process.env.MARROW_AGENT_ID,
-      sessionId: process.env.MARROW_SESSION_ID,
-      mode: process.env.MARROW_ENFORCEMENT_MODE || 'auto',
+      baseUrl: marrowEnv.MARROW_BASE_URL,
+      agentId: marrowEnv.MARROW_FLEET_AGENT_ID || marrowEnv.MARROW_AGENT_ID,
+      sessionId: marrowEnv.MARROW_SESSION_ID,
+      mode: marrowEnv.MARROW_ENFORCEMENT_MODE || 'auto',
     });
 
     const runtime = marrow.createPassiveRuntime({
-      includeValueReport: process.env.MARROW_PASSIVE_VALUE_REPORT !== 'false',
-      valueReportPeriod: process.env.MARROW_VALUE_REPORT_PERIOD || '7d',
-      useAgentRuntime: process.env.MARROW_AGENT_RUNTIME !== 'false',
-      useWorkflowGate: process.env.MARROW_WORKFLOW_GATE !== 'false',
-      requireOutcomeClosure: process.env.MARROW_REQUIRE_OUTCOME_CLOSURE !== 'false',
+      includeValueReport: marrowEnv.MARROW_PASSIVE_VALUE_REPORT !== 'false',
+      valueReportPeriod: marrowEnv.MARROW_VALUE_REPORT_PERIOD || '7d',
+      useAgentRuntime: marrowEnv.MARROW_AGENT_RUNTIME !== 'false',
+      useWorkflowGate: marrowEnv.MARROW_WORKFLOW_GATE !== 'false',
+      requireOutcomeClosure: marrowEnv.MARROW_REQUIRE_OUTCOME_CLOSURE !== 'false',
     });
 
     runtime.install();
@@ -325,6 +412,8 @@ if (apiKey && !globalThis.__MARROW_PASSIVE_RUNTIME__) {
   } catch {
     console.warn('[Marrow] passive runtime skipped: install @getmarrow/sdk or verify SDK initialization. Run npm install @getmarrow/sdk, then rerun npx @getmarrow/install --repair.');
   }
+} else if (!apiKey) {
+  console.warn('[Marrow] passive runtime skipped: MARROW_API_KEY missing. Put it in .marrow/env or run npx @getmarrow/install doctor for the exact fix.');
 }
 `;
 }
@@ -908,8 +997,8 @@ async function install(options) {
       missingHooks: changes.filter((change) => change.changed).map((change) => change.label),
       recommendedFix: configDiagnostics.npm_token.recommended_fix || selfTest.recommended_fix || (!options.apiKey
         ? envHints.length
-          ? `MARROW_API_KEY was found in a likely env file at ${envHints[0]}. Load that key from trusted secret storage, export only MARROW_API_KEY, then run npx @getmarrow/install --repair.`
-          : 'Set MARROW_API_KEY, then run npx @getmarrow/install --repair.'
+          ? `MARROW_API_KEY was found in ${envHints[0]} and can now be auto-loaded by Marrow SDK/MCP runtimes. Run npx @getmarrow/install --repair to refresh hooks and self-test.`
+          : 'Set MARROW_API_KEY or MARROW_KEY in your shell, MCP secret store, .marrow/env, or ~/.marrow/env, then run npx @getmarrow/install --repair.'
         : null),
     },
     remediation,
@@ -946,6 +1035,7 @@ module.exports = {
   runSelfTest,
   runCli,
   passiveRuntimeSource,
+  resolveMarrowKeyMaterial,
   inspectNpmTokenConfig,
   inspectSdkDependency,
   buildInstallValueMoment,