@getmarrow/install 0.1.35 → 0.1.36

package/README.md

@@ -76,17 +76,28 @@ npx -y @getmarrow/install@latest --repair
 
 `activate` reconciles Marrow-managed entries while retaining unrelated user hooks and configuration. Detection and notification are automatic; local changes remain explicit and subject to the operator's normal change policy.
 
-## What's New in v0.1.35
+## What's New in v0.1.36
 
-v0.1.35 turns server-side client update detection into a guided, low-friction operator workflow. Installer status, activation reports, and the Fleet Operator expose a request-specific advisory with the exact update and verification commands while keeping local mutation explicit:
+v0.1.36 combines guided, operator-controlled client updates with a signed permit boundary for protected actions. Installer status, activation reports, and the Fleet Operator expose request-specific update advisories with exact update and verification commands while keeping local mutation explicit:
 
 - official installer requests identify the installed `@getmarrow/install` version;
 - status, self-test, and Fleet Operator output show recommended, unrecognized, and security-required update states without conflating them;
 - generated agent instructions tell the agent to notify the operator and obey local change policy;
-- certified activation now pins MCP 3.9.51 and SDK 3.7.50, including the exact SDK registry integrity;
+- certified activation pins the matching MCP and SDK releases, including exact SDK registry integrity;
 - `activate`, `doctor`, and `--repair` remain explicit commands and preserve unrelated hooks and configuration.
 
-It preserves the passive-governance verification introduced in v0.1.34. Activation registers a bounded capability profile, a one-way configuration fingerprint, expected and observed hook surfaces, and a server-accepted lifecycle receipt. The Fleet Operator shows activation state, capture coverage, outcome closure, intervention follow-through, drift, and the exact repair:
+The governed runner makes protected actions executable only through a short-lived, signed Marrow permit bound to the exact account, agent, session, action, target, canonical action surfaces, runtime gate, and decision before starting the child process. It then closes that permit with exact evidence and the real outcome:
+
+- deploy, publish, merge, migration, credential, and other protected work fails closed when its permit cannot be verified;
+- the child process receives only the scoped permit, never the Marrow API key through a new broker interface;
+- permits are single-use, expire within minutes, and cannot be replayed for another agent, action, target, or session;
+- `permit` and `verify-permit` provide deterministic CI choke points;
+- the loopback `sidecar` keeps private state owner-only and reports hook/configuration drift;
+- `coverage` reports permit closure, bypasses, stale sidecars, and hook health with exact repair steps;
+- correlated result hooks can close evidence automatically, while incomplete protected work remains visible;
+- controlled break-glass access requires an authenticated account owner, a current runtime gate, a reason, a short expiry, and evidence closure.
+
+It preserves the measurable passive-governance coverage introduced in v0.1.34:
 
 - Claude Code installation includes exact `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PostToolUseFailure`, and `Stop` hooks;
 - matching pre-action/result receipts use one tool correlation, and activation fingerprints the exact hook contract without uploading configuration contents;
@@ -175,15 +186,20 @@ npx @getmarrow/install run \
 The runner:
 
 1. requests the Marrow runtime gate;
-2. prints the decision, relevant lesson, owner-approval state, and required proof;
-3. blocks when policy requires it;
-4. runs the original command when allowed;
-5. records success or failure and attaches a redacted proof pack.
+2. records the governed decision against that exact gate;
+3. requests and verifies a single-use permit bound to the exact action, target, and canonical action surfaces;
+4. blocks protected work if policy or permit verification fails;
+5. runs the original command with the scoped permit, not the Marrow API key;
+6. records success or failure, supplies every exact server-required proof field through a redacted proof pack, and closes the permit.
 
 Useful commands:
 
 ```bash
 npx @getmarrow/install gate --agent deploy-agent --type deploy --action "deploy production"
+npx @getmarrow/install permit --agent deploy-agent --type deploy --action "deploy production"
+MARROW_ACTION_PERMIT=... npx @getmarrow/install verify-permit --agent deploy-agent --type deploy --action "deploy production"
+npx @getmarrow/install coverage --agent deploy-agent
+npx @getmarrow/install sidecar --agent deploy-agent
 npx @getmarrow/install status
 npx @getmarrow/install doctor
 npx @getmarrow/install --repair

package/bin/marrow-install.js

@@ -4,7 +4,7 @@ const installer = require('../src/installer');
 const governedRunner = require('../src/governed-runner');
 
 const argv = process.argv.slice(2);
-const governedCommands = new Set(['run', 'gate', 'proof', 'status', 'govern', 'fleet', 'hermes', 'openclaw', 'integrations']);
+const governedCommands = new Set(['run', 'gate', 'proof', 'status', 'govern', 'fleet', 'hermes', 'openclaw', 'integrations', 'permit', 'verify-permit', 'coverage', 'sidecar']);
 const runCli = governedCommands.has(argv[0]) ? governedRunner.runCli : installer.runCli;
 
 runCli(argv).catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/enforcement-client.js

@@ -0,0 +1,94 @@
+const crypto = require('node:crypto');
+
+function sha256(value) {
+  return crypto.createHash('sha256').update(String(value || '')).digest('hex');
+}
+
+function actionBinding(input) {
+  const action = String(input.action || '').trim();
+  const actionType = String(input.type || 'general').trim().toLowerCase();
+  const target = String(input.target || '').trim();
+  return {
+    action,
+    action_type: actionType,
+    target: target || action,
+    action_hash: sha256(action),
+    target_hash: sha256(target || action),
+  };
+}
+
+async function enforcementRequest(requestJson, options, operation, input = {}) {
+  return requestJson(options, 'POST', '/v1/agent/enforcement', {
+    operation,
+    ...input,
+  });
+}
+
+async function issueActionPermit(requestJson, options, input) {
+  const binding = actionBinding(input);
+  return enforcementRequest(requestJson, options, 'issue', {
+    ...binding,
+    session_id: options.sessionId,
+    agent_id: options.agentId,
+    harness: options.client,
+    policy_mode: options.policy,
+    decision_id: input.decisionId || null,
+    gate_receipt_id: input.gateReceiptId || null,
+    owner_approval_receipt_id: input.ownerApproval || null,
+    surfaces: Array.isArray(input.surfaces) ? input.surfaces : [],
+    proof_requirements: Array.isArray(input.proofRequirements) ? input.proofRequirements : [],
+  });
+}
+
+async function verifyActionPermit(requestJson, options, input) {
+  const binding = actionBinding(input);
+  return enforcementRequest(requestJson, options, 'verify', {
+    ...binding,
+    surfaces: Array.isArray(input.surfaces) ? input.surfaces : [],
+    permit: input.permit,
+    session_id: options.sessionId,
+    agent_id: options.agentId,
+    harness: options.client,
+  });
+}
+
+async function closeActionPermit(requestJson, options, input) {
+  return enforcementRequest(requestJson, options, 'close', {
+    permit: input.permit,
+    permit_id: input.permitId || null,
+    decision_id: input.decisionId || null,
+    session_id: options.sessionId,
+    agent_id: options.agentId,
+    success: Boolean(input.success),
+    evidence: input.evidence || {},
+  });
+}
+
+async function recordEnforcementHeartbeat(requestJson, options, input = {}) {
+  return enforcementRequest(requestJson, options, 'heartbeat', {
+    session_id: options.sessionId,
+    agent_id: options.agentId,
+    harness: options.client,
+    sidecar_instance_id: input.sidecarInstanceId || null,
+    config_fingerprint: input.configFingerprint || null,
+    expected_hooks: input.expectedHooks || ['pre_action', 'action_result', 'outcome_closure'],
+    observed_hooks: input.observedHooks || ['pre_action'],
+  });
+}
+
+async function readEnforcementCoverage(requestJson, options) {
+  const query = new URLSearchParams();
+  if (options.agentId) query.set('agent_id', options.agentId);
+  return requestJson(options, 'GET', `/v1/agent/enforcement${query.size ? `?${query}` : ''}`);
+}
+
+module.exports = {
+  actionBinding,
+  sha256,
+  enforcementRequest,
+  issueActionPermit,
+  verifyActionPermit,
+  closeActionPermit,
+  recordEnforcementHeartbeat,
+  readEnforcementCoverage,
+};

package/src/governance-sidecar.js

@@ -0,0 +1,213 @@
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const http = require('node:http');
+const os = require('node:os');
+const path = require('node:path');
+
+const MAX_BODY_BYTES = 64 * 1024;
+
+function sidecarStateDir() {
+  return process.env.MARROW_SIDECAR_STATE_DIR || path.join(os.homedir(), '.marrow', 'sidecar');
+}
+
+function currentUid() {
+  return typeof process.getuid === 'function' ? process.getuid() : null;
+}
+
+function createPrivateDirectoryWithoutSymlinks(directory) {
+  const resolved = path.resolve(directory);
+  const parsed = path.parse(resolved);
+  let current = parsed.root;
+  for (const segment of resolved.slice(parsed.root.length).split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    try {
+      fs.mkdirSync(current, { mode: 0o700 });
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+    }
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink() || !stat.isDirectory() || fs.realpathSync(current) !== current) {
+      throw new Error('Sidecar state directory cannot contain symlinked path components.');
+    }
+  }
+  return resolved;
+}
+
+function assertPrivateStateDirectory(directory) {
+  const resolved = createPrivateDirectoryWithoutSymlinks(directory);
+  const stat = fs.lstatSync(resolved);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error('Sidecar state directory must be a private real directory.');
+  }
+  if (fs.realpathSync(resolved) !== resolved) {
+    throw new Error('Sidecar state directory cannot contain symlinked path components.');
+  }
+  const uid = currentUid();
+  if (uid !== null && stat.uid !== uid) {
+    throw new Error('Sidecar state directory must be owned by the current user.');
+  }
+  if ((stat.mode & 0o077) !== 0) {
+    throw new Error('Sidecar state directory permissions must be 0700 or stricter.');
+  }
+  return resolved;
+}
+
+function assertSafeStateFile(filePath) {
+  if (!fs.existsSync(filePath)) return;
+  const stat = fs.lstatSync(filePath);
+  const uid = currentUid();
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error('Sidecar state file must be a private regular file.');
+  }
+  if (uid !== null && stat.uid !== uid) {
+    throw new Error('Sidecar state file must be owned by the current user.');
+  }
+  if ((stat.mode & 0o077) !== 0) {
+    throw new Error('Sidecar state file permissions must be 0600 or stricter.');
+  }
+}
+
+function writePrivateJsonAtomic(filePath, value) {
+  const directory = assertPrivateStateDirectory(path.dirname(filePath));
+  const target = path.join(directory, path.basename(filePath));
+  assertSafeStateFile(target);
+  const temporary = path.join(directory, '.active-' + process.pid + '-' + crypto.randomBytes(8).toString('hex') + '.tmp');
+  let descriptor;
+  try {
+    descriptor = fs.openSync(temporary, 'wx', 0o600);
+    fs.writeFileSync(descriptor, JSON.stringify(value, null, 2) + '\n', 'utf8');
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = undefined;
+    assertSafeStateFile(target);
+    fs.renameSync(temporary, target);
+    fs.chmodSync(target, 0o600);
+  } finally {
+    if (descriptor !== undefined) {
+      try { fs.closeSync(descriptor); } catch {}
+    }
+    try { fs.unlinkSync(temporary); } catch {}
+  }
+}
+
+function unlinkPrivateStateFile(filePath) {
+  try {
+    const stat = fs.lstatSync(filePath);
+    const uid = currentUid();
+    if (!stat.isSymbolicLink() && stat.isFile() && (uid === null || stat.uid === uid)) {
+      fs.unlinkSync(filePath);
+    }
+  } catch {}
+}
+
+async function readJson(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    bytes += chunk.length;
+    if (bytes > MAX_BODY_BYTES) throw new Error('request_too_large');
+    chunks.push(chunk);
+  }
+  if (chunks.length === 0) return {};
+  const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('invalid_json');
+  return value;
+}
+
+function json(res, status, value) {
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+  });
+  res.end(JSON.stringify(value));
+}
+
+async function startGovernanceSidecar(options, handlers) {
+  if (!options.apiKey) throw new Error('MARROW_API_KEY is required to start the governance sidecar.');
+  const port = Number(options.sidecarPort || process.env.MARROW_SIDECAR_PORT || 0);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error('Invalid sidecar port.');
+  const authToken = crypto.randomBytes(32).toString('hex');
+  const instanceId = `sidecar-${crypto.randomUUID()}`;
+  const startedAt = new Date().toISOString();
+  let latestCoverage = null;
+
+  const server = http.createServer(async (req, res) => {
+    try {
+      if (req.socket.remoteAddress !== '127.0.0.1' && req.socket.remoteAddress !== '::1') {
+        return json(res, 403, { ok: false, error: 'loopback_only' });
+      }
+      if (req.headers.authorization !== `Bearer ${authToken}`) {
+        return json(res, 401, { ok: false, error: 'invalid_sidecar_token' });
+      }
+      const url = new URL(req.url || '/', 'http://127.0.0.1');
+      if (req.method === 'GET' && url.pathname === '/health') {
+        return json(res, 200, { ok: true, instance_id: instanceId, started_at: startedAt });
+      }
+      if (req.method === 'GET' && url.pathname === '/coverage') {
+        latestCoverage = await handlers.coverage();
+        return json(res, 200, latestCoverage);
+      }
+      if (req.method === 'POST' && ['/permit', '/verify', '/close'].includes(url.pathname)) {
+        const body = await readJson(req);
+        const operation = url.pathname.slice(1);
+        return json(res, 200, await handlers[operation](body));
+      }
+      return json(res, 404, { ok: false, error: 'not_found' });
+    } catch (error) {
+      return json(res, error?.message === 'request_too_large' ? 413 : 400, {
+        ok: false,
+        error: error instanceof Error ? error.message : 'sidecar_request_failed',
+      });
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, '127.0.0.1', resolve);
+  });
+  const address = server.address();
+  const boundPort = typeof address === 'object' && address ? address.port : port;
+  const stateFile = path.join(sidecarStateDir(), 'active.json');
+  try {
+    writePrivateJsonAtomic(stateFile, {
+      instance_id: instanceId,
+      pid: process.pid,
+      host: '127.0.0.1',
+      port: boundPort,
+      token: authToken,
+      started_at: startedAt,
+    });
+  } catch (error) {
+    await new Promise((resolve) => server.close(resolve));
+    throw error;
+  }
+
+  const heartbeat = async () => {
+    try {
+      latestCoverage = await handlers.heartbeat({ sidecarInstanceId: instanceId });
+    } catch {
+      // Coverage will mark stale heartbeat; never weaken execution policy here.
+    }
+  };
+  await heartbeat();
+  const timer = setInterval(heartbeat, 30_000);
+  timer.unref();
+
+  let closed = false;
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    clearInterval(timer);
+    unlinkPrivateStateFile(stateFile);
+    process.off('SIGINT', close);
+    process.off('SIGTERM', close);
+    server.close();
+  };
+  process.once('SIGINT', close);
+  process.once('SIGTERM', close);
+
+  return { server, instanceId, port: boundPort, stateFile, close };
+}
+
+module.exports = { startGovernanceSidecar, sidecarStateDir };

package/src/governed-runner.js

@@ -5,9 +5,72 @@ const os = require('node:os');
 const path = require('node:path');
 const readline = require('node:readline');
 const { version: INSTALLER_PACKAGE_VERSION } = require('../package.json');
+const {
+  actionBinding,
+  closeActionPermit,
+  issueActionPermit,
+  readEnforcementCoverage,
+  recordEnforcementHeartbeat,
+  verifyActionPermit,
+} = require('./enforcement-client');
+const { startGovernanceSidecar } = require('./governance-sidecar');
 
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const HIGH_RISK_TERMS = /\b(deploy|prod|production|publish|release|merge|migration|migrate|secret|token|key|cloudflare|wrangler|npm publish|gh pr merge|git push|terraform apply|kubectl apply|delete|destroy|drop)\b/i;
+const PROTECTED_COMMAND_PATTERNS = [
+  /\b(?:npm|pnpm|yarn)(?:\s+npm)?\b[\s\S]{0,8192}\b(?:publish|unpublish|deprecate|access|owner|team|token|login|logout|profile\s+(?:set|enable-2fa|disable-2fa)|dist-tag|tag\s+(?:add|remove))\b/i,
+  /\b(?:cargo\s+(?:publish|yank|owner)|twine\s+upload|gem\s+(?:push|yank|owner)|(?:dotnet\s+nuget|nuget)\s+(?:push|delete))\b/i,
+  /\bgit\b[\s\S]{0,8192}\b(?:push|commit|merge|rebase|reset|tag|clean|rm|cherry-pick|revert|worktree\s+(?:add|move|remove|prune|repair|lock|unlock)|branch\s+(?:-[dDmM]|--delete|--move)|remote\s+(?:add|remove|rename|set-url|set-head|prune|update)|checkout\s+-[bB]|switch\s+-[cC])\b/i,
+  /\bgh\b[\s\S]{0,8192}\b(?:auth\s+logout|pr\s+(?:merge|close|reopen|edit|review|comment)|issue\s+(?:create|close|reopen|edit|comment)|run\s+(?:cancel|delete|rerun)|release\s+(?:create|delete|edit|upload)|repo\s+(?:archive|delete|edit|fork|rename)|workflow\s+run|secret\s+(?:set|delete)|variable\s+(?:set|delete))\b/i,
+  /\bgh\s+api\b[\s\S]{0,8192}(?:(?:--method|-X)(?:=|\s+)(?:POST|PUT|PATCH|DELETE)\b|(?:-f|-F|--field|--raw-field|--input)(?:=|\s+))/i,
+  /\b(?:kubectl|oc)\b[\s\S]{0,8192}\b(?:apply|create|delete|edit|patch|replace|rollout|scale|set|drain|cordon|uncordon|taint|exec|cp|run|expose|autoscale|label|annotate|reconcile|certificate\s+(?:approve|deny))\b/i,
+  /\b(?:terraform|terragrunt|tofu)\b[\s\S]{0,8192}\b(?:apply|destroy|import|taint|untaint|force-unlock|state\s+(?:mv|rm|push|replace-provider)|workspace\s+(?:new|delete))\b/i,
+  /\bpulumi\b[\s\S]{0,8192}\b(?:up|destroy|import|refresh|stack\s+rm|config\s+(?:set|rm))\b/i,
+  /\bhelm\b[\s\S]{0,8192}\b(?:install|upgrade|uninstall|rollback|push)\b/i,
+  /\bflux\b[\s\S]{0,8192}\b(?:bootstrap|create|delete|install|reconcile|resume|suspend|tag|uninstall)\b/i,
+  /\bnomad\b[\s\S]{0,8192}\b(?:job\s+(?:dispatch|plan|promote|run|scale|stop)|alloc\s+stop|deployment\s+(?:fail|promote)|acl\s+(?:bootstrap|policy|role|token))\b/i,
+  /\bcdk\b[\s\S]{0,8192}\b(?:bootstrap|deploy|destroy|import|rollback)\b/i,
+  /\bansible-playbook\b/i,
+  /\b(?:docker|podman)\b[\s\S]{0,8192}\b(?:push|buildx\s+build\b[\s\S]*--push)\b/i,
+  /\bwrangler\b[\s\S]{0,8192}\b(?:deploy|delete|rollback|execute|apply|put|bulk|secret|publish)\b/i,
+  /\bcurl\b[\s\S]{0,8192}(?:(?:-X\s*|--request(?:=|\s+))(?:POST|PUT|PATCH|DELETE)\b|--(?:json|data(?:-ascii|-raw|-binary|-urlencode)?)(?:=|\s+)|-[dF](?:\s+|[^A-Za-z])|--form(?:-string)?(?:=|\s+)|(?:-T|--upload-file)(?:=|\s+))/i,
+  /\b(?:http|xh)\b[\s\S]{0,8192}(?:\b(?:POST|PUT|PATCH|DELETE)\b|(?:--form|--raw|-f)\b|\s[^\s=:@]+(?::=|=|@))/i,
+  /\bwget\b[\s\S]{0,8192}(?:--post-data|--post-file|--body-data|--body-file|--method(?:=|\s+)(?:POST|PUT|PATCH|DELETE))\b/i,
+  /\b(?:psql|mysql|sqlite3|duckdb)\b[\s\S]{0,8192}(?:\b(?:drop|delete|update|insert|alter|truncate|create|grant|revoke|call|do)\b|(?:-f|--file|\.read|source)(?:=|\s+)|\s<\s*[^\s])/i,
+  /\bredis-cli\b[\s\S]{0,8192}\b(?:set|setex|psetex|mset|del|unlink|getdel|incr|decr|append|expire|persist|rename|move|flushall|flushdb|shutdown|eval|evalsha|fcall|fcall_ro|function|script\s+(?:load|flush|kill)|config\s+set|acl\s+setuser|hset|hdel|lpush|rpush|lpop|rpop|sadd|srem|zadd|zrem|xadd|xdel|publish|restore|migrate)\b/i,
+  /\baws\b[\s\S]{0,8192}\b(?:create|update|delete|put|attach|detach|associate|disassociate|terminate|stop|start|reboot|modify|restore|rotate|tag|untag|deploy|sync|s3\s+(?:cp|mv|rm)|s3api\s+put-object|ssm\s+(?:put-parameter|delete-parameter|delete-parameters))\b/i,
+  /\bgcloud\b[\s\S]{0,8192}\b(?:create|update|delete|deploy|add|remove|set|destroy|disable|restore|storage\s+(?:cp|mv|rm|rsync)|pubsub\s+(?:topics|subscriptions)\s+(?:create|delete|update))\b/i,
+  /\baz\b[\s\S]{0,8192}\b(?:create|update|delete|set|deploy|start|stop|restart|restore|storage\s+blob\s+(?:upload|delete|copy)|group\s+(?:create|delete|update))\b/i,
+  /\brclone\b[\s\S]{0,8192}\b(?:copy|copyto|sync|move|moveto|delete|deletefile|purge|mkdir|rmdir|bisync)\b/i,
+  /\bgsutil\b[\s\S]{0,8192}\b(?:cp|mv|rm|rsync|setacl|setmeta|web)\b/i,
+  /(?:^|[;&|]\s*|\bsudo\s+|\benv\s+)mc\b[\s\S]{0,8192}\b(?:cp|mv|rm|mirror|mb|rb|anonymous|admin)\b/i,
+  /\boci\b[\s\S]{0,8192}\bos\b[\s\S]{0,8192}\b(?:put|upload|bulk-upload|delete|rename|restore|reencrypt)\b/i,
+  /\b(?:vault|op)\b[\s\S]{0,8192}\b(?:write|put|patch|delete|edit|create|move|rotate|revoke|destroy|share)\b/i,
+  /\bpass\b[\s\S]{0,8192}\b(?:insert|edit|generate|rm|remove|mv|cp|init|git)\b/i,
+  /(?:^|[\s;&|]|\bsudo\s+|\benv\s+)(?:(?:\/[^\s/]+)*\/)?(?:rm\b|unlink\b|shred\b|truncate\b|dd\b[\s\S]{0,8192}\bof=|find\b[\s\S]{0,8192}\s-delete\b|xargs\b[\s\S]{0,8192}(?:(?:\/[^\s/]+)*\/)?rm\b)/i,
+];
+const PROTECTED_ACTION_TYPES = new Set([
+  'credential',
+  'credentials',
+  'deploy',
+  'financial',
+  'merge',
+  'migration',
+  'production',
+  'publish',
+  'release',
+  'secret',
+  'security',
+]);
+const SAFE_MARROW_CHILD_METADATA = new Set([
+  'MARROW_AGENT_ID',
+  'MARROW_AGENT_CLIENT',
+  'MARROW_CLIENT',
+  'MARROW_FLEET_AGENT_ID',
+  'MARROW_GOVERN_PROFILE',
+  'MARROW_HARNESS',
+  'MARROW_SESSION_ID',
+]);
 const GOVERN_TUI_ROW_COUNT = 7;
 const FLEET_TUI_ROW_COUNT = 12;
 function usage() {
@@ -17,6 +80,10 @@ function usage() {
   npx @getmarrow/install gate "deploy production worker"
   npx @getmarrow/install proof --decision-id <id> --success --summary "smoke passed"
   npx @getmarrow/install status
+  npx @getmarrow/install permit --action "deploy production" --type deploy
+  MARROW_ACTION_PERMIT=... npx @getmarrow/install verify-permit --action "deploy production" --type deploy
+  npx @getmarrow/install coverage
+  npx @getmarrow/install sidecar
   npx @getmarrow/install govern
   npx @getmarrow/install govern --no-interactive
   npx @getmarrow/install fleet
@@ -29,6 +96,10 @@ Commands:
   gate      Check Marrow runtime/gate for an action without running a command
   proof     Commit an outcome/proof for an existing decision
   status    Read /v1/agent/status
+  permit    Issue a short-lived action-bound permit after Marrow policy evaluation
+  verify-permit Verify a permit before CI, deploy, publish, merge, migration, or credential access
+  coverage  Show enforcement, hook-health, closure, and bypass coverage
+  sidecar   Run the loopback-only Marrow governance sidecar
   govern    Interactive setup TUI when run in a terminal; text panel in CI/non-TTY
   fleet     Fleet operator TUI for live agents, workflows, gates, proof debt, and exact fixes
   integrations List Marrow-supported harness add-ons
@@ -42,9 +113,12 @@ Options:
   --action <text>         Human-readable action. Defaults to the redacted command
   --profile <name>        Policy profile label, such as dev, staging, or production
   --policy <mode>         enforce, warn, or audit. Default: enforce
-  --fail-open             If Marrow is unreachable, run anyway and mark telemetry degraded
+  --fail-open             For non-protected, low-risk actions only, run if Marrow is unreachable
   --fail-closed           If Marrow is unreachable, block the command
   --owner-approved <ref>  Owner approval reference for review-required gates
+  --permit <token>        Short-lived action permit. Prefer MARROW_ACTION_PERMIT
+  --target <text>         Protected target binding, such as repository/environment
+  --sidecar-port <port>   Loopback sidecar port. Default: ephemeral
   --proof-file <path>     JSON proof to include on outcome commit
   --client <label>        Harness/client label. Defaults to MARROW_CLIENT, MARROW_HARNESS, or MARROW_AGENT_CLIENT
   --base-url <url>        Marrow API base URL
@@ -79,6 +153,14 @@ function redactedCommand(command) {
   return command.map((part) => shellQuote(redact(part))).join(' ');
 }
 
+function isProtectedCommand(text) {
+  const raw = String(text || '');
+  if (raw.length > 8192) return true;
+  const value = raw.slice(0, 8192);
+  return HIGH_RISK_TERMS.test(value)
+    || PROTECTED_COMMAND_PATTERNS.some((pattern) => pattern.test(value));
+}
+
 function normalizeClientLabel(value) {
   const raw = String(value || '').trim().toLowerCase();
   if (!raw) return '';
@@ -129,9 +211,11 @@ function shellQuoteDisplay(value) {
 
 function inferType(text) {
   const value = String(text || '').toLowerCase();
-  if (/\b(deploy|wrangler|cloudflare|production|prod|release)\b/.test(value)) return 'deploy';
-  if (/\b(publish|npm publish)\b/.test(value)) return 'publish';
-  if (/\b(merge|gh pr merge)\b/.test(value)) return 'merge';
+  if (/\b(deploy|wrangler|cloudflare|production|prod|release)\b/.test(value)
+    || /\b(?:kubectl|terraform|pulumi|helm)\b/.test(value) && isProtectedCommand(value)) return 'deploy';
+  if (/\b(publish|unpublish|deprecate|npm publish)\b/.test(value)) return 'publish';
+  if (/\b(merge|gh pr merge)\b/.test(value)
+    || /\bgit\b[^\n;&|]{0,240}\bpush\b/.test(value)) return 'merge';
   if (/\b(migration|migrate|schema|d1 execute|drop table)\b/.test(value)) return 'migration';
   if (/\b(secret|token|key|password)\b/.test(value)) return 'security';
   if (/\b(test|check|lint|typecheck|smoke)\b/.test(value)) return 'verification';
@@ -143,6 +227,7 @@ function inferSurfaces(text) {
   const surfaces = new Set();
   if (/\b(git|gh|github)\b/.test(value)) surfaces.add('github');
   if (/\b(wrangler|cloudflare|worker|d1|r2)\b/.test(value)) surfaces.add('cloudflare');
+  if (/\b(kubectl|terraform|pulumi|helm|production|prod)\b/.test(value)) surfaces.add('production');
   if (/\b(npm|pnpm|yarn|publish)\b/.test(value)) surfaces.add('npm');
   if (/\b(sql|d1|migration|database|db)\b/.test(value)) surfaces.add('database');
   if (/\b(curl|api|http)\b/.test(value)) surfaces.add('api');
@@ -232,7 +317,8 @@ function detectProjectSignals(cwd = process.cwd()) {
 }
 
 function isRisky(text, type) {
-  return HIGH_RISK_TERMS.test(`${type || ''} ${text || ''}`);
+  return PROTECTED_ACTION_TYPES.has(String(type || '').trim().toLowerCase())
+    || isProtectedCommand(`${type || ''} ${text || ''}`);
 }
 
 function parseBaseOptions(argv, startIndex = 0) {
@@ -252,6 +338,9 @@ function parseBaseOptions(argv, startIndex = 0) {
     action: '',
     client: sourceClient(),
     interactive: null,
+    permit: process.env.MARROW_ACTION_PERMIT || '',
+    target: process.env.MARROW_ACTION_TARGET || '',
+    sidecarPort: process.env.MARROW_SIDECAR_PORT || '0',
   };
   let i = startIndex;
   for (; i < argv.length; i += 1) {
@@ -270,6 +359,9 @@ function parseBaseOptions(argv, startIndex = 0) {
       options.failClosed = true;
       options.failOpen = false;
     } else if (arg === '--owner-approved') options.ownerApproval = argv[++i] || options.ownerApproval;
+    else if (arg === '--permit') options.permit = argv[++i] || options.permit;
+    else if (arg === '--target') options.target = argv[++i] || options.target;
+    else if (arg === '--sidecar-port') options.sidecarPort = argv[++i] || options.sidecarPort;
     else if (arg === '--proof-file') options.proofFile = argv[++i] || options.proofFile;
     else if (arg === '--client' || arg === '--harness') options.client = sourceClient(argv[++i] || options.client);
     else if (arg === '--base-url') options.baseUrl = argv[++i] || options.baseUrl;
@@ -311,6 +403,17 @@ function parseArgs(argv) {
     return { command, options: { ...parsed.options, action } };
   }
 
+  if (command === 'permit' || command === 'verify-permit') {
+    const parsed = parseBaseOptions(argv, 1);
+    const action = parsed.options.action || argv.slice(parsed.index).join(' ');
+    if (parsed.options.help) return { command: 'help' };
+    if (!action) throw new Error(`${command} requires --action or an action string`);
+    if (command === 'verify-permit' && !parsed.options.permit) {
+      throw new Error('verify-permit requires MARROW_ACTION_PERMIT or --permit');
+    }
+    return { command, options: { ...parsed.options, action } };
+  }
+
   if (command === 'proof') {
     const parsed = parseBaseOptions(argv, 1);
     const options = { ...parsed.options, decisionId: '', success: true, summary: '', outcome: '' };
@@ -328,7 +431,7 @@ function parseArgs(argv) {
     return { command, options };
   }
 
-  if (command === 'status' || command === 'govern' || command === 'fleet' || command === 'hermes' || command === 'openclaw' || command === 'integrations') {
+  if (command === 'status' || command === 'govern' || command === 'fleet' || command === 'hermes' || command === 'openclaw' || command === 'integrations' || command === 'coverage' || command === 'sidecar') {
     const parsed = parseBaseOptions(argv, 1);
     if (parsed.options.help) return { command: 'help' };
     return { command, options: parsed.options };
@@ -414,11 +517,14 @@ function defaultProof(input) {
 }
 
 async function preflightRuntime(options, action, type, commandText) {
+  const target = options.target || commandText || action;
+  const surfaces = inferSurfaces(commandText || action);
   const meta = sourceMeta(options, 'runtime', { action, command: commandText, action_type: type });
   return requestJson(options, 'POST', '/v1/agent/runtime', {
     action,
     type,
-    surfaces: inferSurfaces(commandText || action),
+    target,
+    surfaces,
     source_meta: meta,
     context: {
       runner: '@getmarrow/install run',
@@ -484,6 +590,7 @@ function gateDecision(runtime) {
   return {
     decision: gate.enforcement_decision || receipt.decision || gate.decision || 'unknown',
     allow: gate.allow !== false,
+    riskLevel: String(gate.risk_level || receipt.risk_level || runtime?.risk_level || '').trim().toLowerCase(),
     required: Boolean(receipt.required || gate.gate_required),
     ownerApprovalRequired: Boolean(receipt.owner_approval_required || gate.owner_approval_required),
     receiptId: receipt.id || gate.gate_receipt_id || '',
@@ -525,11 +632,28 @@ function runChild(command, env = process.env) {
   });
 }
 
-async function createDecision(options, action, type) {
+function scopedExecutionEnv(permit) {
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (name.startsWith('MARROW_') && !SAFE_MARROW_CHILD_METADATA.has(name)) continue;
+    if (name.startsWith('ACTION_PERMIT_')) continue;
+    env[name] = value;
+  }
+  if (permit?.permit) {
+    env.MARROW_ACTION_PERMIT = permit.permit;
+    env.MARROW_ACTION_PERMIT_ID = String(permit.permit_id || '');
+    env.MARROW_GOVERNANCE_VERIFIED = 'true';
+  }
+  return env;
+}
+
+async function createDecision(options, action, type, target, surfaces) {
   const meta = sourceMeta(options, 'think', { action, action_type: type });
   return requestJson(options, 'POST', '/v1/agent/think', {
     action,
     type,
+    target,
+    surfaces,
     source_meta: meta,
     context: {
       runner: '@getmarrow/install run',
@@ -556,11 +680,16 @@ async function runGoverned(parsed) {
   const { options, childCommand } = parsed;
   const commandText = redactedCommand(childCommand);
   const action = options.action ? redact(options.action) : commandText;
-  const type = options.type || inferType(`${action} ${commandText}`);
-  const risky = isRisky(`${action} ${commandText}`, type);
+  const riskText = `${action} ${commandText} ${options.target || ''}`;
+  const type = options.type || inferType(riskText);
+  const risky = isRisky(riskText, type);
   let runtime = null;
   let decision = null;
   let decisionId = '';
+  let actionPermit = null;
+  let permitEnforcementStarted = false;
+  let permitVerified = false;
+  const surfaces = inferSurfaces(commandText || action);
 
   try {
     runtime = await preflightRuntime(options, action, type, commandText);
@@ -578,10 +707,41 @@ async function runGoverned(parsed) {
         message: decision.exactNextAction || 'Marrow blocked this action before execution.',
       };
     }
-    const think = await createDecision(options, action, type);
+    const target = options.target || commandText;
+    const think = await createDecision(options, action, type, target, surfaces);
     decisionId = think.decision_id || think.id || think.decision?.id || '';
+    permitEnforcementStarted = true;
+    actionPermit = await issueActionPermit(requestJson, options, {
+      action,
+      type,
+      target,
+      surfaces,
+      decisionId,
+      gateReceiptId: decision?.receiptId || '',
+      ownerApproval: options.ownerApproval,
+      proofRequirements: decision?.proofPack?.required_fields || decision?.proofPack?.missing || [],
+    });
+    if (!actionPermit?.permit || !actionPermit?.permit_id) {
+      throw new Error('Marrow did not issue a valid action permit.');
+    }
+    const verified = await verifyActionPermit(requestJson, options, {
+      action,
+      type,
+      target,
+      surfaces,
+      permit: actionPermit.permit,
+    });
+    if (verified?.verified !== true) throw new Error('Marrow action permit verification failed.');
+    permitVerified = true;
   } catch (error) {
-    if (options.failOpen || (!risky && !options.failClosed)) {
+    const protectedAction = risky
+      || decision?.required === true
+      || decision?.riskLevel === 'high'
+      || decision?.riskLevel === 'critical';
+    const canDegrade = !permitEnforcementStarted
+      && !protectedAction
+      && (options.failOpen || !options.failClosed);
+    if (canDegrade) {
       process.stderr.write(`Marrow degraded: ${error.message}. Continuing because fail-open/non-risky policy allows it.\n`);
     } else {
       return {
@@ -597,7 +757,8 @@ async function runGoverned(parsed) {
     }
   }
 
-  const child = await runChild(childCommand);
+  const childEnv = scopedExecutionEnv(actionPermit);
+  const child = await runChild(childCommand, childEnv);
   const success = child.exitCode === 0;
   const proof = defaultProof({ options, action, childCommand, exitCode: child.exitCode, success });
   const outcome = success
@@ -613,6 +774,21 @@ async function runGoverned(parsed) {
     }
   }
 
+  let permitClosed = null;
+  if (actionPermit?.permit) {
+    try {
+      permitClosed = await closeActionPermit(requestJson, options, {
+        permit: actionPermit.permit,
+        permitId: actionPermit.permit_id,
+        decisionId,
+        success,
+        evidence: proof,
+      });
+    } catch (error) {
+      process.stderr.write(`Marrow permit close failed: ${error.message}\n`);
+    }
+  }
+
   return {
     ok: success,
     blocked: false,
@@ -623,9 +799,72 @@ async function runGoverned(parsed) {
     decision,
     decision_id: decisionId,
     outcome_committed: Boolean(commit),
+    permit_id: actionPermit?.permit_id || null,
+    permit_verified: permitVerified,
+    permit_closed: Boolean(permitClosed),
   };
 }
 
+async function permitOnly(parsed) {
+  const { options } = parsed;
+  const action = redact(options.action);
+  const type = options.type || inferType(action);
+  const target = options.target || action;
+  const surfaces = inferSurfaces(target);
+  const runtime = await preflightRuntime(options, action, type, target);
+  const decision = gateDecision(runtime);
+  if (shouldBlock(decision, options)) {
+    return { ok: false, blocked: true, exitCode: 12, decision, message: decision.exactNextAction };
+  }
+  const think = await createDecision(options, action, type, target, surfaces);
+  const decisionId = think.decision_id || think.id || think.decision?.id || '';
+  const result = await issueActionPermit(requestJson, options, {
+    action,
+    type,
+    target,
+    surfaces,
+    decisionId,
+    gateReceiptId: decision.receiptId,
+    ownerApproval: options.ownerApproval,
+    proofRequirements: decision?.proofPack?.required_fields || decision?.proofPack?.missing || [],
+  });
+  return { ok: true, decision_id: decisionId, ...result };
+}
+
+async function verifyPermitOnly(parsed) {
+  const { options } = parsed;
+  const action = redact(options.action);
+  const type = options.type || inferType(action);
+  const surfaces = inferSurfaces(options.target || action);
+  const result = await verifyActionPermit(requestJson, options, {
+    action,
+    type,
+    target: options.target || action,
+    surfaces,
+    permit: options.permit,
+  });
+  const verified = result?.verified === true;
+  return { ...result, ok: verified, exitCode: verified ? 0 : 14 };
+}
+
+async function coverageOnly(parsed) {
+  return readEnforcementCoverage(requestJson, parsed.options);
+}
+
+async function sidecarOnly(parsed) {
+  const options = parsed.options;
+  const sidecar = await startGovernanceSidecar(options, {
+    permit: (input) => issueActionPermit(requestJson, options, input),
+    verify: (input) => verifyActionPermit(requestJson, options, input),
+    close: (input) => closeActionPermit(requestJson, options, input),
+    coverage: () => readEnforcementCoverage(requestJson, options),
+    heartbeat: (input) => recordEnforcementHeartbeat(requestJson, options, input),
+  });
+  process.stdout.write(`Marrow governance sidecar active on 127.0.0.1:${sidecar.port}. Press Ctrl+C to stop.\n`);
+  await new Promise((resolve) => sidecar.server.once('close', resolve));
+  return { ok: true };
+}
+
 async function gateOnly(parsed) {
   const { options } = parsed;
   const action = redact(options.action);
@@ -1859,6 +2098,10 @@ async function runCli(argv) {
   else if (parsed.command === 'gate') result = await gateOnly(parsed);
   else if (parsed.command === 'proof') result = await proofOnly(parsed);
   else if (parsed.command === 'status') result = await statusOnly(parsed);
+  else if (parsed.command === 'permit') result = await permitOnly(parsed);
+  else if (parsed.command === 'verify-permit') result = await verifyPermitOnly(parsed);
+  else if (parsed.command === 'coverage') result = await coverageOnly(parsed);
+  else if (parsed.command === 'sidecar') result = await sidecarOnly(parsed);
   else if (parsed.command === 'govern') {
     await runGovernInteractive(parsed.options);
     return;
@@ -1877,7 +2120,9 @@ async function runCli(argv) {
   else if (parsed.command === 'status') process.stdout.write(`${statusPanel(result)}\n`);
   else if (!['run', 'fleet', 'hermes', 'openclaw', 'integrations'].includes(parsed.command)) process.stdout.write('Marrow command completed.\n');
 
-  if (parsed.command === 'run' || result?.blocked) process.exitCode = result?.exitCode ?? (result?.ok === false ? 1 : 0);
+  if (parsed.command === 'run' || parsed.command === 'verify-permit' || result?.blocked) {
+    process.exitCode = result?.exitCode ?? (result?.ok === false ? 1 : 0);
+  }
 }
 
 module.exports = {
@@ -1890,6 +2135,7 @@ module.exports = {
   headers,
   inferType,
   inferSurfaces,
+  isRisky,
   commandForSelection,
   buildGovernState,
   detectProjectSignals,
@@ -1901,6 +2147,12 @@ module.exports = {
   renderGovernTui,
   canUseInteractive,
   runGoverned,
+  scopedExecutionEnv,
+  permitOnly,
+  verifyPermitOnly,
+  coverageOnly,
+  sidecarOnly,
+  actionBinding,
   gateOnly,
   proofOnly,
   statusOnly,

package/src/installer.js

@@ -7,9 +7,9 @@ const { version: INSTALLER_ADAPTER_VERSION } = require('../package.json');
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const MCP_ADAPTER_VERSION = '3.9.51';
-const SDK_ADAPTER_VERSION = '3.7.50';
-const SDK_ADAPTER_INTEGRITY = 'sha512-TyCXUKZAaKRPdfVqXEuIvWnOt4GLcIUbwhpX+EopzdALNzq+t5wUGHrqJlkNSvopppPTTdFVLJ7O1vtwofqFqw==';
+const MCP_ADAPTER_VERSION = '3.9.52';
+const SDK_ADAPTER_VERSION = '3.7.51';
+const SDK_ADAPTER_INTEGRITY = 'sha512-0l4UOeJLZ8izIoci4TRy22svKm3xvoyyAbU16aB3vnqxvsrdv3TDaz2EqXpo0vz62IEMlx/F+IoiQ9t9xKzdFA==';
 const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
 const MCP_PACKAGE_SPEC = `@getmarrow/mcp@${MCP_ADAPTER_VERSION}`;
 const MCP_CONTEXT_HOOK_COMMAND = `npx -y ${MCP_PACKAGE_SPEC} context-hook`;
@@ -291,6 +291,7 @@ function fingerprint(value) {
 function npmTokenPaths(env = process.env) {
   const home = env.HOME || env.USERPROFILE || os.homedir();
   return {
+    home,
     openclawEnv: path.join(home, '.openclaw', '.env'),
     credentialFile: path.join(home, '.openclaw', 'credentials', 'npm-getmarrow-token.txt'),
     npmrc: path.join(home, '.npmrc'),
@@ -301,7 +302,14 @@ function inspectNpmTokenConfig(env = process.env) {
   const paths = npmTokenPaths(env);
   const openclawToken = readEnvVar(paths.openclawEnv, 'NPM_TOKEN');
   const credentialToken = readFirstLineSecret(paths.credentialFile);
-  const npmrcToken = readNpmrcToken(paths.npmrc);
+  let npmrcToken = '';
+  let unsafeNpmrcPath = false;
+  try {
+    assertDirectOwnerFile(paths.home, paths.npmrc, { allowMissing: true });
+    npmrcToken = readNpmrcToken(paths.npmrc);
+  } catch {
+    unsafeNpmrcPath = true;
+  }
   const sourceToken = openclawToken || credentialToken;
   const mismatch = Boolean(sourceToken && npmrcToken && fingerprint(sourceToken) !== fingerprint(npmrcToken));
   const missingNpmrcToken = Boolean(sourceToken && !npmrcToken);
@@ -310,15 +318,18 @@ function inspectNpmTokenConfig(env = process.env) {
     safe: {
       npm_token: {
         checked: true,
-        repairable: Boolean(sourceToken && (mismatch || missingNpmrcToken)),
+        repairable: Boolean(sourceToken && (mismatch || missingNpmrcToken) && !unsafeNpmrcPath),
         mismatch,
         missing_npmrc_token: missingNpmrcToken,
+        unsafe_path: unsafeNpmrcPath,
         sources: {
           openclaw_env: { path: paths.openclawEnv, present: Boolean(openclawToken), fingerprint: fingerprint(openclawToken) },
           credential_file: { path: paths.credentialFile, present: Boolean(credentialToken), fingerprint: fingerprint(credentialToken) },
           npmrc: { path: paths.npmrc, present: Boolean(npmrcToken), fingerprint: fingerprint(npmrcToken) },
         },
-        recommended_fix: mismatch || missingNpmrcToken
+        recommended_fix: unsafeNpmrcPath
+          ? 'Refusing automatic npm token repair because ~/.npmrc or its home directory is not a direct, regular owner path.'
+          : mismatch || missingNpmrcToken
           ? 'Run npx @getmarrow/install --repair to sync ~/.npmrc from the active OpenClaw/getmarrow npm token source.'
           : null,
       },
@@ -327,7 +338,49 @@ function inspectNpmTokenConfig(env = process.env) {
   };
 }
 
-function upsertNpmrcToken(filePath, token) {
+function assertDirectOwnerFile(homePath, filePath, { allowMissing = false } = {}) {
+  const home = path.resolve(homePath);
+  const target = path.resolve(filePath);
+  if (target !== path.join(home, '.npmrc')) throw new Error('npm token repair target must be the direct owner ~/.npmrc');
+  if (!fs.existsSync(home)) throw new Error('npm token repair owner home does not exist');
+  const homeStat = fs.lstatSync(home);
+  if (!homeStat.isDirectory() || homeStat.isSymbolicLink() || fs.realpathSync(home) !== home) {
+    throw new Error('npm token repair owner home must be a direct, non-symbolic directory');
+  }
+  if (!fs.existsSync(target)) {
+    if (allowMissing) return;
+    throw new Error('npm token repair target does not exist');
+  }
+  const targetStat = fs.lstatSync(target);
+  if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+    throw new Error('npm token repair target must be a regular file, not a symbolic link');
+  }
+}
+
+function atomicWriteOwnerFile(homePath, filePath, contents) {
+  const home = path.resolve(homePath);
+  const target = path.resolve(filePath);
+  const allowMissing = !fs.existsSync(target);
+  assertDirectOwnerFile(home, target, { allowMissing });
+  const tempPath = path.join(home, `.npmrc.marrow-${process.pid}-${crypto.randomBytes(6).toString('hex')}.tmp`);
+  let descriptor;
+  try {
+    descriptor = fs.openSync(tempPath, 'wx', 0o600);
+    fs.writeFileSync(descriptor, contents, { encoding: 'utf8' });
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = undefined;
+    assertDirectOwnerFile(home, target, { allowMissing });
+    fs.renameSync(tempPath, target);
+    fs.chmodSync(target, 0o600);
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor);
+    if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
+  }
+}
+
+function upsertNpmrcToken(homePath, filePath, token) {
+  assertDirectOwnerFile(homePath, filePath, { allowMissing: true });
   const before = safeRead(filePath);
   const tokenLine = `//registry.npmjs.org/:_authToken=${token}`;
   let after;
@@ -338,14 +391,17 @@ function upsertNpmrcToken(filePath, token) {
     after = `${before}${separator}${tokenLine}\n`;
   }
   if (before !== after) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
     if (before) {
       const backupPath = `${filePath}.marrow-backup`;
-      fs.writeFileSync(backupPath, before, { mode: 0o600 });
+      if (fs.existsSync(backupPath) && fs.lstatSync(backupPath).isSymbolicLink()) {
+        throw new Error('npm token repair backup must not be a symbolic link');
+      }
+      const backupTemp = path.join(path.resolve(homePath), `.npmrc.marrow-backup-${process.pid}-${crypto.randomBytes(6).toString('hex')}.tmp`);
+      fs.writeFileSync(backupTemp, before, { mode: 0o600, flag: 'wx' });
+      fs.renameSync(backupTemp, backupPath);
       fs.chmodSync(backupPath, 0o600);
     }
-    fs.writeFileSync(filePath, after, { mode: 0o600 });
-    fs.chmodSync(filePath, 0o600);
+    atomicWriteOwnerFile(homePath, filePath, after);
   }
   return before !== after;
 }
@@ -355,7 +411,7 @@ function repairConfigDiagnostics(diagnostics, env = process.env) {
   const npm = diagnostics.npm_token;
   const repairs = [];
   if (npm?.repairable && inspection.raw.sourceToken) {
-    const changed = upsertNpmrcToken(inspection.raw.paths.npmrc, inspection.raw.sourceToken);
+    const changed = upsertNpmrcToken(inspection.raw.paths.home, inspection.raw.paths.npmrc, inspection.raw.sourceToken);
     repairs.push({
       type: 'npm_token_npmrc_sync',
       changed,
@@ -866,10 +922,69 @@ function buildPlan(detection, options) {
     });
   }
 
-  return { mode, writes };
+  return { mode, root: detection.root, writes };
+}
+
+function assertContainedManagedTarget(root, targetPath) {
+  const resolvedRoot = path.resolve(root);
+  const resolvedTarget = path.resolve(targetPath);
+  if (resolvedTarget === resolvedRoot || !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new Error(`Refusing installer write outside project root: ${resolvedTarget}`);
+  }
+  if (!fs.existsSync(resolvedRoot)) throw new Error(`Project root does not exist: ${resolvedRoot}`);
+  const rootStat = fs.lstatSync(resolvedRoot);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error(`Refusing installer write through unsafe project root: ${resolvedRoot}`);
+  }
+  const realRoot = fs.realpathSync(resolvedRoot);
+  const relativeParent = path.relative(resolvedRoot, path.dirname(resolvedTarget));
+  let current = resolvedRoot;
+  for (const segment of relativeParent.split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    if (!fs.existsSync(current)) break;
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`Refusing installer write through unsafe path component: ${current}`);
+    }
+    const realCurrent = fs.realpathSync(current);
+    if (realCurrent !== realRoot && !realCurrent.startsWith(`${realRoot}${path.sep}`)) {
+      throw new Error(`Refusing installer write outside resolved project root: ${current}`);
+    }
+  }
+  if (fs.existsSync(resolvedTarget)) {
+    const targetStat = fs.lstatSync(resolvedTarget);
+    if (targetStat.isSymbolicLink() || !targetStat.isFile()) {
+      throw new Error(`Refusing installer write to unsafe managed target: ${resolvedTarget}`);
+    }
+  }
+  return { resolvedRoot, resolvedTarget };
+}
+
+function atomicWriteManagedFile(root, targetPath, contents) {
+  const { resolvedTarget } = assertContainedManagedTarget(root, targetPath);
+  const parent = path.dirname(resolvedTarget);
+  fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+  assertContainedManagedTarget(root, resolvedTarget);
+  const existingMode = fs.existsSync(resolvedTarget)
+    ? fs.lstatSync(resolvedTarget).mode & 0o777
+    : 0o600;
+  const tempPath = path.join(
+    parent,
+    `.${path.basename(resolvedTarget)}.marrow-${process.pid}-${crypto.randomBytes(6).toString('hex')}`,
+  );
+  try {
+    fs.writeFileSync(tempPath, contents, { flag: 'wx', mode: existingMode });
+    assertContainedManagedTarget(root, resolvedTarget);
+    fs.renameSync(tempPath, resolvedTarget);
+  } finally {
+    if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
+  }
 }
 
 function applyPlan(plan, options) {
+  if (!Array.isArray(plan?.writes) || plan.writes.length === 0) return [];
+  const root = path.resolve(plan.root || path.dirname(plan.writes[0].path));
+  for (const write of plan.writes) assertContainedManagedTarget(root, write.path);
   const prepared = plan.writes.map((write) => {
     const before = safeRead(write.path);
     let after;
@@ -902,8 +1017,7 @@ function applyPlan(plan, options) {
       already_present: !changed,
     });
     if (changed && writeApplied) {
-      fs.mkdirSync(path.dirname(write.path), { recursive: true });
-      fs.writeFileSync(write.path, after);
+      atomicWriteManagedFile(root, write.path, after);
     }
   }
   return changes;