@getmarrow/install 0.1.69 → 0.1.70

package/src/mcp-runtime.js

@@ -1,37 +1,43 @@
 'use strict';
 
 // A private local copy of the pinned @getmarrow/mcp, so hooks start it directly instead of
-// through npx (npx costs 0.6 to 1.3 s per gated tool call before Marrow is contacted).
+// through npx (npx costs 0.6 to 1.3 s per gated tool call before Marrow is contacted, and it
+// resolves the package from the project directory first: a copy planted in the project's
+// node_modules, or a project npm config naming another registry, would decide every hook).
 //
 // Layout (all owner-only, directories 0700):
 //   ~/.marrow/runtime/mcp/<version>/node_modules/...   the package, installed with --ignore-scripts
 //   ~/.marrow/runtime/mcp/<version>/.verified          integrity record (0600)
-//   ~/.marrow/runtime/mcp/<version>/launch.cjs         checks the files, then runs the entrypoint
-//   ~/.marrow/runtime/mcp/<version>/run                /bin/sh script: absolute node + launch.cjs
 //   ~/.marrow/runtime/mcp/<version>/node               link to the node binary captured at install
+//   ~/.marrow/runtime/mcp/.heal-<version>.lock          a hook's self-heal in progress (one per user)
+//   ~/.marrow/runtime/mcp/.heal-<version>-<sha256 of the project's real path>.failed|.tried
+//                                                       that project's last failed heal / last heal start
+// (On Windows there is no node link.)
 //
-// The package's integrity is checked against the pin (or the registry-verified update target)
-// when it is installed. Every start re-checks the installed files against the record; if the
-// copy is missing, changed or its node is gone, the same entrypoint runs through npx exactly as
-// before, so a hook keeps its fail-closed behaviour. Hook commands reach the runtime through
-// $HOME, so project hook files stay the same for every user and name no local path.
+// Every hook command carries the runtime loader inline (runtime-core.js, compressed): it checks
+// the installed files against the record and runs the entry. When the copy is missing or changed,
+// it installs the pinned version itself, with the installer's own rules and the pinned integrity
+// it carries. When that fails for an outage (offline, registry down, the wait ran out) a
+// pre-action hook warns and lets the call run (exit 1, as npx failing did); any other failure,
+// such as an integrity mismatch, holds it (exit 2 with a fixed repair message; every other
+// entrypoint exits 1). Nothing ever reads the project or starts npx.
+// Hook commands reach the runtime through the home directory, so project hook files stay the same
+// for every user and name no local path.
 
-const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
-const { spawnSync } = require('node:child_process');
+const zlib = require('node:zlib');
+const PINS = require('./pins');
+const { runtimeCore } = require('./runtime-core');
 
-const RUNTIME_SCHEMA = 'marrow-mcp-runtime.v1';
+const core = runtimeCore();
+const RUNTIME_SCHEMA = core.SCHEMA;
+const HOLD_TEXT = core.HOLD;
+const UNAVAILABLE_TEXT = core.UNAVAILABLE;
+const WARN_TEXT = core.WARN;
+const NPM_INSTALL_TIMEOUT_MS = core.NPM_TIMEOUT_MS;
 const VERSION_RE = /^\d+\.\d+\.\d+$/;
-const INTEGRITY_RE = /^sha512-[A-Za-z0-9+/]{86}==$/;
-// Paths written into the run script, quoted with single quotes: no quote, backslash or newline.
-const SAFE_PATH_RE = /^[^'\\\n\r\0]+$/;
-// A black-holed registry must not hold an install for minutes: past this, hooks stay on npx.
-const NPM_INSTALL_TIMEOUT_MS = 30_000;
-
-function currentUid() {
-  return typeof process.getuid === 'function' ? process.getuid() : null;
-}
+const PRE_ACTION_SUB_RE = /-pre-action-hook$/;
 
 function runtimeRoot(home) {
   return path.join(home, '.marrow', 'runtime', 'mcp');
@@ -41,330 +47,256 @@ function runtimeDir(home, version) {
   return path.join(runtimeRoot(home), version);
 }
 
-// A directory Marrow owns: a real directory (not a link) owned by this user, not writable by
-// others; created 0700 when missing.
-function ensurePrivateDirectory(directory) {
-  if (!fs.existsSync(directory)) fs.mkdirSync(directory, { mode: 0o700 });
-  const stat = fs.lstatSync(directory);
-  const uid = currentUid();
-  if (!stat.isDirectory() || stat.isSymbolicLink() || (uid !== null && stat.uid !== uid)) {
-    throw new Error(`unsafe runtime directory ${directory}`);
-  }
-  if ((stat.mode & 0o077) !== 0) fs.chmodSync(directory, 0o700);
+function failureText(sub) {
+  return PRE_ACTION_SUB_RE.test(String(sub || '')) ? HOLD_TEXT : UNAVAILABLE_TEXT;
 }
 
-function privateDirectoryOk(directory) {
-  try {
-    const stat = fs.lstatSync(directory);
-    const uid = currentUid();
-    return stat.isDirectory() && !stat.isSymbolicLink() && (uid === null || stat.uid === uid) && (stat.mode & 0o077) === 0;
-  } catch {
-    return false;
-  }
+function failureStatus(sub) {
+  return PRE_ACTION_SUB_RE.test(String(sub || '')) ? 2 : 1;
 }
 
-function listFiles(base, relative = '') {
-  const directory = path.join(base, relative);
-  const out = [];
-  for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
-    const rel = relative ? `${relative}/${entry.name}` : entry.name;
-    if (rel === 'node_modules/.bin') continue;
-    if (entry.isSymbolicLink()) throw new Error(`unexpected link in runtime package: ${rel}`);
-    if (entry.isDirectory()) out.push(...listFiles(base, rel));
-    else if (entry.isFile()) out.push(rel);
-  }
-  return out;
+// The runtime for one version, when its record matches the expected integrity and its files
+// still hash to the record. Returns null otherwise (also when no integrity is given).
+function verifyMcpRuntime(home, version, integrity, { platform = process.platform } = {}) {
+  return core.verify(home, version, integrity, { platform });
 }
 
-// The installed package files, as the launcher hashes them on every start (npm's own lock copy
-// and any .bin links are not package files; the runtime is never started through .bin).
-function packageFiles(directory) {
-  return listFiles(directory, 'node_modules').filter((file) => file !== 'node_modules/.package-lock.json');
+// Installs (or keeps) the runtime for one MCP version whose tarball integrity is known.
+// `sdk` is the pinned SDK { version, integrity }; when the installed SDK has that version, its
+// integrity must match too. Never throws: a failure leaves hooks to heal it or hold.
+function ensureMcpRuntime(options = {}) {
+  return core.ensure({ ...options, prune: true });
 }
 
-function manifestDigest(directory, files) {
-  const hash = crypto.createHash('sha256');
-  for (const file of files) {
-    hash.update(file);
-    hash.update('\0');
-    hash.update(fs.readFileSync(path.join(directory, file)));
-    hash.update('\0');
-  }
-  return hash.digest('hex');
+function defaultNpmInstall(stage, specs, options = {}) {
+  return core.npmInstall(stage, specs, options);
 }
 
-const LAUNCHER_SOURCE = `'use strict';
-// Written by @getmarrow/install. Runs the verified local @getmarrow/mcp. When the copy is
-// missing or any of its files changed, the same entrypoint runs through npx instead.
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-const args = process.argv.slice(2);
-// Every package file now present, listed as at install: an added file is a change too.
-function listFiles(relative) {
-  const out = [];
-  const entries = fs.readdirSync(path.join(__dirname, relative), { withFileTypes: true })
-    .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-  for (const entry of entries) {
-    const rel = relative + '/' + entry.name;
-    if (rel === 'node_modules/.bin') continue;
-    if (entry.isSymbolicLink()) throw new Error('link');
-    if (entry.isDirectory()) out.push(...listFiles(rel));
-    else if (entry.isFile()) out.push(rel);
-  }
-  return out;
+function npmInvocation(options = {}) {
+  return core.npmInvocation(options);
 }
-function verifiedEntry() {
-  try {
-    const record = JSON.parse(fs.readFileSync(path.join(__dirname, '.verified'), 'utf8'));
-    if (record.schema !== ${JSON.stringify(RUNTIME_SCHEMA)}) return null;
-    if (args[0] !== '--package=@getmarrow/mcp@' + record.version || args[1] !== 'marrow-mcp') return null;
-    const present = listFiles('node_modules').filter((file) => file !== 'node_modules/.package-lock.json');
-    if (JSON.stringify(present) !== JSON.stringify(record.files)) return null;
-    const hash = crypto.createHash('sha256');
-    for (const file of record.files) {
-      hash.update(file);
-      hash.update('\\0');
-      hash.update(fs.readFileSync(path.join(__dirname, file)));
-      hash.update('\\0');
-    }
-    return hash.digest('hex') === record.manifest_sha256 ? path.join(__dirname, record.bin) : null;
-  } catch {
-    return null;
-  }
-}
-const entry = verifiedEntry();
-if (entry) {
-  process.argv = [process.argv[0], entry, ...args.slice(2)];
-  require(entry);
-} else {
-  const { spawn } = require('child_process');
-  const child = spawn(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['-y', ...args], { stdio: 'inherit' });
-  child.on('error', () => process.exit(1));
-  child.on('exit', (code, signal) => {
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code === null ? 1 : code);
-  });
-}
-`;
-
-function runScript(nodePath, launcherPath) {
-  return [
-    '#!/bin/sh',
-    '# Written by @getmarrow/install: the verified local @getmarrow/mcp, or npx when it is gone.',
-    `if [ -x '${nodePath}' ] && [ -f '${launcherPath}' ]; then exec '${nodePath}' '${launcherPath}' "$@"; fi`,
-    'exec npx -y "$@"',
-    '',
-  ].join('\n');
+
+function npmEnvironment(source = process.env, network = null) {
+  return core.npmEnvironment(source, network);
 }
 
-function readRecord(directory) {
-  try {
-    const stat = fs.lstatSync(path.join(directory, '.verified'));
-    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) return null;
-    const record = JSON.parse(fs.readFileSync(path.join(directory, '.verified'), 'utf8'));
-    return record && record.schema === RUNTIME_SCHEMA ? record : null;
-  } catch {
-    return null;
-  }
+// The shared runtime serves every project on this machine, so a project uninstall keeps it;
+// only an explicit full uninstall (`uninstall --all`) removes it.
+function removeMcpRuntime(home, { dryRun = false } = {}) {
+  const root = path.dirname(runtimeRoot(home));
+  if (!fs.existsSync(root)) return { removed: false, path: root };
+  if (!dryRun) fs.rmSync(root, { recursive: true, force: true });
+  return { removed: !dryRun, would_remove: dryRun, path: root };
 }
 
-// The runtime for one version, when its record matches the expected integrity and its files
-// still hash to the record. Returns null otherwise.
-function verifyMcpRuntime(home, version, integrity) {
-  if (!home || !VERSION_RE.test(String(version || ''))) return null;
-  const directory = runtimeDir(home, version);
-  if (![path.join(home, '.marrow'), path.dirname(runtimeRoot(home)), runtimeRoot(home), directory].every(privateDirectoryOk)) return null;
-  const record = readRecord(directory);
-  if (!record || record.version !== version) return null;
-  if (integrity && record.integrity !== integrity) return null;
-  try {
-    const files = packageFiles(directory);
-    if (JSON.stringify(files) !== JSON.stringify(record.files)) return null;
-    if (manifestDigest(directory, files) !== record.manifest_sha256) return null;
-    if (fs.readFileSync(path.join(directory, 'launch.cjs'), 'utf8') !== LAUNCHER_SOURCE) return null;
-    const runStat = fs.statSync(path.join(directory, 'run'));
-    if (!runStat.isFile() || (runStat.mode & 0o100) === 0) return null;
-    const nodeTarget = fs.readlinkSync(path.join(directory, 'node'));
-    if (fs.readFileSync(path.join(directory, 'run'), 'utf8') !== runScript(nodeTarget, path.join(directory, 'launch.cjs'))) return null;
-  } catch {
-    return null;
-  }
-  return { state: 'verified', version, directory, run: path.join(directory, 'run'), node: path.join(directory, 'node') };
+// ---------------------------------------------------------------------------
+// The inline loader: the core's text with the pinned version, integrity and SDK pin, compressed
+// and base64url-encoded inside regex literals, so it contains no quote, $, %, !, backslash or
+// backtick and every hook form (sh single or double quotes, cmd, PowerShell, a JS string) can
+// carry it literally.
+// ---------------------------------------------------------------------------
+
+const CORE_SOURCE = runtimeCore.toString().split('\n').map((line) => line.trim()).filter(Boolean).join('\n');
+const LOADER_RE = /eval\(global\.MARROW_L=require\(\/node:zlib\/\.source\)\.brotliDecompressSync\(Buffer\.from\(\/([A-Za-z0-9_-]{16,16000})\/\.source,\/base64url\/\.source\)\)\+\[\]\)/;
+const LOADER_PATTERN = LOADER_RE.source;
+// The same pattern with no capture group, for use inside the command patterns below.
+const LOADER_NC = LOADER_PATTERN.replace('([A-Za-z0-9_-]', '(?:[A-Za-z0-9_-]');
+
+function runtimeConfig(version, { integrity, sdk } = {}) {
+  const pinned = version === PINS.MCP_ADAPTER_VERSION;
+  return core.configOf(
+    version,
+    integrity === undefined ? (pinned ? PINS.MCP_ADAPTER_INTEGRITY : null) : integrity,
+    sdk === undefined ? { version: PINS.SDK_ADAPTER_VERSION, integrity: PINS.SDK_ADAPTER_INTEGRITY } : sdk,
+  );
 }
 
-function defaultNpmInstall(stage, specs) {
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  const result = spawnSync(npm, ['install', '--no-audit', '--no-fund', '--ignore-scripts', '--no-bin-links', '--loglevel=error', ...specs], {
-    cwd: stage,
-    env: process.env,
-    stdio: 'ignore',
-    timeout: NPM_INSTALL_TIMEOUT_MS,
-  });
-  return result.status === 0;
+function launcherSource(cfg) {
+  return `'use strict';\nconst CFG = ${JSON.stringify(cfg)};\n(${CORE_SOURCE})().main(CFG, global.MARROW_L);\n`;
 }
 
-function removeQuietly(target) {
-  try {
-    fs.rmSync(target, { recursive: true, force: true });
-  } catch {
-    // Best effort: a leftover directory is cleaned on the next install or update.
+const loaderCache = new Map();
+function loaderFor(cfg) {
+  const source = launcherSource(cfg);
+  if (!loaderCache.has(source)) {
+    const packed = zlib.brotliCompressSync(Buffer.from(source), {
+      params: { [zlib.constants.BROTLI_PARAM_MODE]: zlib.constants.BROTLI_MODE_TEXT, [zlib.constants.BROTLI_PARAM_QUALITY]: 11 },
+    }).toString('base64url');
+    loaderCache.set(source, `eval(global.MARROW_L=require(/node:zlib/.source).brotliDecompressSync(Buffer.from(/${packed}/.source,/base64url/.source))+[])`);
   }
+  return loaderCache.get(source);
 }
 
-// Removes every runtime version except `keep` (and leftover staging directories).
-function removeOtherRuntimes(home, keep) {
-  const root = runtimeRoot(home);
-  const removed = [];
-  let entries = [];
+// The configuration a loader carries, only when it decodes to exactly the launcher this module
+// writes for that configuration (compressed bytes may differ between zlib builds; the code that
+// runs may not). A write with another configuration (integrity) than the current target's
+// replaces the command.
+function loaderConfig(loader) {
+  const match = String(loader || '').match(new RegExp(`^${LOADER_PATTERN}$`));
+  if (!match) return null;
+  let source;
   try {
-    entries = fs.readdirSync(root);
+    source = zlib.brotliDecompressSync(Buffer.from(match[1], 'base64url'), { maxOutputLength: 1 << 17 }).toString('utf8');
   } catch {
-    return removed;
-  }
-  for (const entry of entries) {
-    if (entry === keep) continue;
-    removeQuietly(path.join(root, entry));
-    removed.push(entry);
-  }
-  return removed;
-}
-
-// Installs (or keeps) the runtime for one MCP version whose tarball integrity is known.
-// `sdk` is the pinned SDK { version, integrity }; when the installed SDK has that version, its
-// integrity must match too. Never throws: a failure leaves hooks on npx.
-function ensureMcpRuntime({ home, version, integrity, sdk = null, nodePath = process.execPath, npmInstall = defaultNpmInstall, platform = process.platform, onProgress = null } = {}) {
-  if (platform === 'win32') return { state: 'unsupported', reason: 'windows' };
-  if (!home || !VERSION_RE.test(String(version || '')) || !INTEGRITY_RE.test(String(integrity || ''))) {
-    return { state: 'skipped', reason: 'no_verified_integrity' };
-  }
-  const existing = verifyMcpRuntime(home, version, integrity);
-  if (existing) {
-    const removed = removeOtherRuntimes(home, version);
-    return { ...existing, state: 'present', removed_versions: removed };
-  }
-  const directory = runtimeDir(home, version);
-  if (!SAFE_PATH_RE.test(directory) || !SAFE_PATH_RE.test(String(nodePath || '')) || !path.isAbsolute(String(nodePath || ''))) {
-    return { state: 'skipped', reason: 'unsafe_path' };
+    return null;
   }
-  let stage = null;
+  const line = source.split('\n')[1] || '';
+  if (!line.startsWith('const CFG = ') || !line.endsWith(';')) return null;
+  let parsed;
   try {
-    ensurePrivateDirectory(path.join(home, '.marrow'));
-    ensurePrivateDirectory(path.dirname(runtimeRoot(home)));
-    ensurePrivateDirectory(runtimeRoot(home));
-    stage = path.join(runtimeRoot(home), `.stage-${version}-${process.pid}-${crypto.randomBytes(4).toString('hex')}`);
-    fs.mkdirSync(stage, { mode: 0o700 });
-    const dependencies = { '@getmarrow/mcp': version };
-    if (sdk && VERSION_RE.test(String(sdk.version || ''))) dependencies['@getmarrow/sdk'] = sdk.version;
-    fs.writeFileSync(path.join(stage, 'package.json'), `${JSON.stringify({ name: 'marrow-mcp-runtime', private: true, dependencies }, null, 2)}\n`, { mode: 0o600 });
-    const specs = Object.entries(dependencies).map(([name, spec]) => `${name}@${spec}`);
-    if (typeof onProgress === 'function') {
-      onProgress(`Installing a local copy of @getmarrow/mcp@${version} so hooks start faster (up to ${NPM_INSTALL_TIMEOUT_MS / 1000} s; hooks keep using npx if it does not finish)...\n`);
-    }
-    if (!npmInstall(stage, specs)) return { state: 'failed', reason: 'npm_install_failed' };
-    const lock = JSON.parse(fs.readFileSync(path.join(stage, 'package-lock.json'), 'utf8'));
-    const packages = lock && typeof lock.packages === 'object' && lock.packages ? lock.packages : {};
-    const mcp = packages['node_modules/@getmarrow/mcp'] || {};
-    if (mcp.version !== version || mcp.integrity !== integrity) return { state: 'failed', reason: 'integrity_mismatch' };
-    const sdkEntry = packages['node_modules/@getmarrow/sdk'];
-    if (sdk && sdkEntry && sdkEntry.version === sdk.version && sdkEntry.integrity !== sdk.integrity) {
-      return { state: 'failed', reason: 'sdk_integrity_mismatch' };
-    }
-    for (const [key, entry] of Object.entries(packages)) {
-      if (key === '') continue;
-      if (!entry || typeof entry.integrity !== 'string' || !/^sha512-/.test(entry.integrity)) return { state: 'failed', reason: 'unverified_dependency' };
-    }
-    const installed = JSON.parse(fs.readFileSync(path.join(stage, 'node_modules', '@getmarrow', 'mcp', 'package.json'), 'utf8'));
-    if (installed.name !== '@getmarrow/mcp' || installed.version !== version) return { state: 'failed', reason: 'package_mismatch' };
-    const binRelative = typeof installed.bin === 'object' && installed.bin ? installed.bin['marrow-mcp'] : null;
-    if (typeof binRelative !== 'string' || !/^[A-Za-z0-9._/-]+$/.test(binRelative) || binRelative.includes('..')) {
-      return { state: 'failed', reason: 'package_entry_missing' };
-    }
-    const bin = `node_modules/@getmarrow/mcp/${binRelative.replace(/^\.\//, '')}`;
-    const files = packageFiles(stage);
-    if (!files.includes(bin)) return { state: 'failed', reason: 'package_entry_missing' };
-    const launcher = path.join(directory, 'launch.cjs');
-    fs.writeFileSync(path.join(stage, 'launch.cjs'), LAUNCHER_SOURCE, { mode: 0o600 });
-    fs.writeFileSync(path.join(stage, 'run'), runScript(nodePath, launcher), { mode: 0o700 });
-    fs.symlinkSync(nodePath, path.join(stage, 'node'));
-    fs.writeFileSync(path.join(stage, '.verified'), `${JSON.stringify({
-      schema: RUNTIME_SCHEMA,
-      version,
-      integrity,
-      sdk_version: sdkEntry ? sdkEntry.version : null,
-      bin,
-      files,
-      manifest_sha256: manifestDigest(stage, files),
-      installed_at: new Date().toISOString(),
-    }, null, 2)}\n`, { mode: 0o600 });
-    removeQuietly(directory);
-    fs.renameSync(stage, directory);
-    stage = null;
-    const verified = verifyMcpRuntime(home, version, integrity);
-    if (!verified) return { state: 'failed', reason: 'verification_failed' };
-    const removed = removeOtherRuntimes(home, version);
-    return { ...verified, state: 'installed', removed_versions: removed };
-  } catch (error) {
-    return { state: 'failed', reason: error && /unsafe runtime directory/.test(error.message) ? 'unsafe_directory' : 'install_error' };
-  } finally {
-    if (stage) removeQuietly(stage);
+    parsed = JSON.parse(line.slice('const CFG = '.length, -1));
+  } catch {
+    return null;
   }
-}
-
-function removeMcpRuntime(home, { dryRun = false } = {}) {
-  const root = path.dirname(runtimeRoot(home));
-  if (!fs.existsSync(root)) return { removed: false, path: root };
-  if (!dryRun) removeQuietly(root);
-  return { removed: !dryRun, would_remove: dryRun, path: root };
+  if (!parsed || typeof parsed !== 'object' || !VERSION_RE.test(String(parsed.version || ''))) return null;
+  const cfg = core.configOf(parsed.version, parsed.integrity, parsed.sdk);
+  return launcherSource(cfg) === source ? cfg : null;
 }
 
 // ---------------------------------------------------------------------------
-// Hook commands: the canonical npx form <-> the local runtime form.
+// Hook commands: the canonical npx form (the one spelling every check and merge reads) <-> the
+// written local-runtime form. Written hooks never start npx: the canonical form exists only in
+// memory. Earlier local forms (0.1.66-0.1.68, which fell back to npx) still read as Marrow's own
+// so that repair rewrites them.
 // ---------------------------------------------------------------------------
 
-const ARGS = '--package=@getmarrow/mcp@(\\d+\\.\\d+\\.\\d+) marrow-mcp ([a-z][a-z-]{0,63})';
+const V = '(\\d+\\.\\d+\\.\\d+)';
+const SUB = '([a-z][a-z-]{0,63})';
+const ARGS = `--package=@getmarrow/mcp@${V} marrow-mcp ${SUB}`;
+const canonicalEntrypoint = (version, sub) => `npx -y --package=@getmarrow/mcp@${version} marrow-mcp ${sub}`;
 const RUN = (version) => `$HOME/.marrow/runtime/mcp/${version}/run`;
-const NODE = (version) => `$HOME/.marrow/runtime/mcp/${version}/node`;
 
-// 1. A plain entrypoint command.
-function localPlain(version, sub) {
-  const args = `--package=@getmarrow/mcp@${version} marrow-mcp ${sub}`;
-  return `/bin/sh -c 'M="${RUN(version)}"; if [ -x "$M" ]; then exec "$M" ${args}; fi; exec npx -y ${args}'`;
+// Each written form is built from its parts by one function, and the pattern that recognizes it
+// is generated from the same function (named groups for the version, entrypoint and loader; a
+// repeated part must repeat exactly), so the writer and the reader cannot drift apart.
+const SENTINEL = { version: '\u0001V\u0001', sub: '\u0001S\u0001', loader: '\u0001L\u0001', text: '\u0001T\u0001', status: '\u0001X\u0001' };
+function formPattern(build) {
+  const seen = new Set();
+  const parts = { V: ['v', '\\d+\\.\\d+\\.\\d+'], S: ['s', '[a-z][a-z-]{0,63}'], L: ['l', LOADER_NC] };
+  return build(SENTINEL).replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\u0001([VSLTX])\u0001/g, (match, key) => {
+    if (key === 'T') return '[^"\']*';
+    if (key === 'X') return '[12]';
+    const [name, pattern] = parts[key];
+    if (seen.has(name)) return `\\k<${name}>`;
+    seen.add(name);
+    return `(?<${name}>${pattern})`;
+  });
 }
-const LOCAL_PLAIN_RE = new RegExp(`^/bin/sh -c 'M="\\$HOME/\\.marrow/runtime/mcp/(\\d+\\.\\d+\\.\\d+)/run"; if \\[ -x "\\$M" \\]; then exec "\\$M" ${ARGS}; fi; exec npx -y --package=@getmarrow/mcp@\\2 marrow-mcp \\3'$`);
+const partsFor = (version, sub, cfg) => ({ version, sub, loader: loaderFor(cfg), text: failureText(sub), status: failureStatus(sub) });
+const argsOf = (p) => `--package=@getmarrow/mcp@${p.version} marrow-mcp ${p.sub}`;
+// Which node runs the loader (POSIX): the one captured in the private runtime when it exists, else
+// node on PATH or in the usual absolute places, but never a relative path or one inside the
+// current (project) directory, so a project cannot plant the node that checks it.
+const nodeSearch = (p, found) => `N="$HOME/.marrow/runtime/mcp/${p.version}/node"; if [ ! -x "$N" ]; then N=; P="$PATH:/usr/local/bin:/opt/homebrew/bin"; while [ -n "$P" ]; do D="\${P%%:*}"; case "$P" in (*:*) P="\${P#*:}" ;; (*) P= ;; esac; case "$D" in ("$PWD"|"$PWD"/*) ;; (/*) if [ -f "$D/node" ] && [ -x "$D/node" ]; then N="$D/node"; break; fi ;; esac; done; fi; ${found}`;
+
+// 1. A plain entrypoint command. POSIX: /bin/sh picks node as above and runs the loader, passed as
+// $0. Windows: node on the loader, quoted so cmd, PowerShell and sh all read it the same way. No
+// usable node: the fixed text with the hold (2) or failure (1) status.
+const plainPosix = (p) => `/bin/sh -c '${nodeSearch(p, `if [ -n "$N" ]; then exec "$N" -e "$0" -- ${argsOf(p)}; fi;`)} printf "%s\\n" "${p.text}" >&2; exit ${p.status}' "${p.loader}"`;
+const plainWindows = (p) => `node -e "${p.loader}" -- ${argsOf(p)}`;
+function localPlain(version, sub, platform, cfg = runtimeConfig(version)) {
+  return (platform === 'win32' ? plainWindows : plainPosix)(partsFor(version, sub, cfg));
+}
+const PLAIN_RE = new RegExp(`^${formPattern(plainPosix)}$`);
+const WINDOWS_PLAIN_RE = new RegExp(`^${formPattern(plainWindows)}$`);
+const LEGACY_PLAIN_RE = new RegExp(`^/bin/sh -c 'M="\\$HOME/\\.marrow/runtime/mcp/${V}/run"; if \\[ -x "\\$M" \\]; then exec "\\$M" ${ARGS}; fi; exec npx -y --package=@getmarrow/mcp@\\2 marrow-mcp \\3'$`);
 const CANONICAL_PLAIN_RE = new RegExp(`^npx -y ${ARGS}$`);
 
-// 2. An entrypoint inside an `sh -c '...'` wrapper (Windsurf, Gemini).
-function localInner(version, sub) {
-  const args = `--package=@getmarrow/mcp@${version} marrow-mcp ${sub}`;
-  return `{ M="${RUN(version)}"; if [ -x "$M" ]; then "$M" ${args}; else npx -y ${args}; fi; }`;
+// 2. An entrypoint inside an `sh -c '...'` wrapper (Windsurf, Gemini, every platform) or a Cline
+// hook script: the same node search and loader, or the fixed text with the hold or failure status.
+const innerForm = (p) => `{ ${nodeSearch(p, `if [ -n "$N" ]; then "$N" -e "${p.loader}" -- ${argsOf(p)}; else printf "%s\\n" "${p.text}" >&2; (exit ${p.status}); fi; }`)}`;
+function localInner(version, sub, cfg = runtimeConfig(version)) {
+  return innerForm(partsFor(version, sub, cfg));
 }
-const LOCAL_INNER_RE = new RegExp(`\\{ M="\\$HOME/\\.marrow/runtime/mcp/(\\d+\\.\\d+\\.\\d+)/run"; if \\[ -x "\\$M" \\]; then "\\$M" ${ARGS}; else npx -y --package=@getmarrow/mcp@\\2 marrow-mcp \\3; fi; \\}`, 'g');
+const INNER_RE = new RegExp(formPattern(innerForm), 'g');
+const LEGACY_INNER_RE = new RegExp(`\\{ M="\\$HOME/\\.marrow/runtime/mcp/${V}/run"; if \\[ -x "\\$M" \\]; then "\\$M" ${ARGS}; else npx -y --package=@getmarrow/mcp@\\2 marrow-mcp \\3; fi; \\}`, 'g');
 const CANONICAL_INNER_RE = new RegExp(`npx -y ${ARGS}`, 'g');
 
-// 3. A node guard (`node -e '...'`) that spawns the entrypoint through npx.
+// 3. A node guard (`node -e '...'`) that spawns the entrypoint: the guard's own node on the
+// loader. A failed child is what every guard already treats as its own launch failure (it
+// blocks, or stays neutral).
 const SPAWN_NPX = 'spawn(process.platform==="win32"?"npx.cmd":"npx",';
-function localSpawn(version, argsJson) {
-  return `spawn(...((f,m,a)=>f.existsSync(m)?[m,a.slice(1)]:[process.platform==="win32"?"npx.cmd":"npx",a])(require("node:fs"),(process.env.HOME||"")+${JSON.stringify(`/.marrow/runtime/mcp/${version}/run`)},${argsJson}),`;
+function localSpawn(version, sub, cfg = runtimeConfig(version)) {
+  return `spawn(process.execPath,["-e","${loaderFor(cfg)}","--","--package=@getmarrow/mcp@${version}","marrow-mcp","${sub}"],`;
 }
-const LOCAL_SPAWN_RE = /spawn\(\.\.\.\(\(f,m,a\)=>f\.existsSync\(m\)\?\[m,a\.slice\(1\)\]:\[process\.platform==="win32"\?"npx\.cmd":"npx",a\]\)\(require\("node:fs"\),\(process\.env\.HOME\|\|""\)\+"\/\.marrow\/runtime\/mcp\/\d+\.\d+\.\d+\/run",(\["-y","--package=@getmarrow\/mcp@\d+\.\d+\.\d+","marrow-mcp","[a-z-]+"\])\),/g;
-const CANONICAL_SPAWN_RE = /spawn\(process\.platform==="win32"\?"npx\.cmd":"npx",(\["-y","--package=@getmarrow\/mcp@(\d+\.\d+\.\d+)","marrow-mcp","[a-z-]+"\]),/g;
-const localGuardPrefix = (version) => `N="${NODE(version)}"; [ -x "$N" ] || N=node; exec "$N" -e '`;
-const LOCAL_GUARD_PREFIX_RE = /^N="\$HOME\/\.marrow\/runtime\/mcp\/\d+\.\d+\.\d+\/node"; \[ -x "\$N" \] \|\| N=node; exec "\$N" -e '/;
+const SPAWN_RE = new RegExp(`spawn\\(process\\.execPath,\\["-e","(${LOADER_NC})","--","--package=@getmarrow/mcp@(\\d+\\.\\d+\\.\\d+)","marrow-mcp","([a-z-]+)"\\],`, 'g');
+const LEGACY_SPAWN_RE = /spawn\(\.\.\.\(\(f,m,a\)=>f\.existsSync\(m\)\?\[m,a\.slice\(1\)\]:\[process\.platform==="win32"\?"npx\.cmd":"npx",a\]\)\(require\("node:fs"\),\(process\.env\.HOME\|\|""\)\+"\/\.marrow\/runtime\/mcp\/\d+\.\d+\.\d+\/run",(\["-y","--package=@getmarrow\/mcp@\d+\.\d+\.\d+","marrow-mcp","[a-z-]+"\])\),/g;
+const LEGACY_SPAWN_ONE_RE = new RegExp(LEGACY_SPAWN_RE.source);
+const CANONICAL_SPAWN_RE = /spawn\(process\.platform==="win32"\?"npx\.cmd":"npx",\["-y","--package=@getmarrow\/mcp@(\d+\.\d+\.\d+)","marrow-mcp","([a-z-]+)"\],/g;
+// The POSIX guard runs on node found as above (none: a path that fails, as a missing node did).
+const guardPrefixForm = (p) => nodeSearch(p, `[ -n "$N" ] || N=/nonexistent/marrow-node; exec "$N" -e '`);
+const localGuardPrefix = (version) => guardPrefixForm({ version });
+const LOCAL_GUARD_PREFIX_RE = new RegExp(`^${formPattern(guardPrefixForm)}`);
+const LEGACY_GUARD_SPAWN_HINT = 'spawn(...((f,m,a)=>f.existsSync(m)';
 
-// The canonical (npx) form of a hook command; any other command is returned unchanged.
+// The command with each valid loader in it spelled as this module compresses it, so a command
+// written by another zlib build compares equal to its exact rebuild.
+function withCanonicalLoaders(command, cfg) {
+  return command.replace(new RegExp(LOADER_PATTERN, 'g'), (loader) => (loaderConfig(loader) ? loaderFor(cfg) : loader));
+}
+
+// The configuration of every loader in a command, when all are valid and carry the same one.
+function commandConfig(loaders) {
+  let cfg = null;
+  for (const loader of loaders) {
+    const found = loaderConfig(loader);
+    if (!found || (cfg && JSON.stringify(found) !== JSON.stringify(cfg))) return null;
+    cfg = found;
+  }
+  return cfg;
+}
+
+// The canonical (npx) form of a hook command; any other command is returned unchanged. Only a
+// command that the current writer would produce again exactly (or an earlier writer's local
+// form) maps back, so an edited command never reads as Marrow's own.
 function delocalizeHookCommand(command) {
   if (typeof command !== 'string') return command;
-  const plain = command.match(LOCAL_PLAIN_RE);
-  if (plain && plain[1] === plain[2]) return `npx -y --package=@getmarrow/mcp@${plain[2]} marrow-mcp ${plain[3]}`;
-  if (LOCAL_GUARD_PREFIX_RE.test(command)) {
-    return command.replace(LOCAL_GUARD_PREFIX_RE, 'node -e \'').replace(LOCAL_SPAWN_RE, `${SPAWN_NPX}$1,`);
+  const legacyPlain = command.match(LEGACY_PLAIN_RE);
+  if (legacyPlain && legacyPlain[1] === legacyPlain[2]) return canonicalEntrypoint(legacyPlain[2], legacyPlain[3]);
+  for (const [pattern, platform] of [[PLAIN_RE, 'posix'], [WINDOWS_PLAIN_RE, 'win32']]) {
+    const found = command.match(pattern);
+    if (!found) continue;
+    const { v, s, l } = found.groups;
+    const cfg = commandConfig([l]);
+    return cfg && cfg.version === v && localPlain(v, s, platform, cfg) === withCanonicalLoaders(command, cfg) ? canonicalEntrypoint(v, s) : command;
+  }
+  const prefixed = LOCAL_GUARD_PREFIX_RE.test(command);
+  if (prefixed || (command.startsWith('node -e \'') && (command.includes('spawn(process.execPath,["-e","') || command.includes(LEGACY_GUARD_SPAWN_HINT)))) {
+    const body = prefixed ? command.replace(LOCAL_GUARD_PREFIX_RE, 'node -e \'') : command;
+    if (LEGACY_SPAWN_ONE_RE.test(body)) {
+      const canonical = body.replace(LEGACY_SPAWN_RE, `${SPAWN_NPX}$1,`);
+      return canonical === body ? command : canonical;
+    }
+    const loaders = [];
+    const canonical = body.replace(SPAWN_RE, (match, loader, version, sub) => {
+      loaders.push(loader);
+      return `${SPAWN_NPX}${JSON.stringify(['-y', `--package=@getmarrow/mcp@${version}`, 'marrow-mcp', sub])},`;
+    });
+    if (canonical === body) return command;
+    const cfg = commandConfig(loaders);
+    const version = (canonical.match(/--package=@getmarrow\/mcp@(\d+\.\d+\.\d+)/) || [])[1];
+    // The current guard forms must map back exactly.
+    if (!cfg || !version || localizeHookCommand(canonical, version, { platform: prefixed ? 'posix' : 'win32', ...cfg }) !== withCanonicalLoaders(command, cfg)) return command;
+    return canonical;
   }
-  if (command.startsWith('/bin/sh -c \'') && LOCAL_INNER_RE.test(command)) {
-    LOCAL_INNER_RE.lastIndex = 0;
-    const inner = command.replace(LOCAL_INNER_RE, (match, runVersion, version, sub) => (
-      runVersion === version ? `npx -y --package=@getmarrow/mcp@${version} marrow-mcp ${sub}` : match
-    ));
+  if (command.startsWith('/bin/sh -c \'') && (LEGACY_INNER_RE.test(command) || INNER_RE.test(command))) {
+    LEGACY_INNER_RE.lastIndex = 0;
+    INNER_RE.lastIndex = 0;
+    const loaders = [];
+    let mismatch = false;
+    const inner = command
+      .replace(LEGACY_INNER_RE, (match, runVersion, version, sub) => (runVersion === version ? canonicalEntrypoint(version, sub) : match))
+      .replace(INNER_RE, (match, ...rest) => {
+        const { v: version, s: sub, l: loader } = rest[rest.length - 1];
+        const cfg = commandConfig([loader]);
+        if (!cfg || cfg.version !== version || localInner(version, sub, cfg) !== withCanonicalLoaders(match, cfg)) {
+          mismatch = true;
+          return match;
+        }
+        loaders.push(loader);
+        return canonicalEntrypoint(version, sub);
+      });
+    if (mismatch || (loaders.length && !commandConfig(loaders))) return command;
     return inner === command ? command : `sh -c '${inner.slice('/bin/sh -c \''.length)}`;
   }
   return command;
@@ -372,35 +304,49 @@ function delocalizeHookCommand(command) {
 
 // The local runtime form of a canonical hook command for `version`, or the command unchanged
 // when it is not a Marrow entrypoint for that version. The result always maps back exactly.
-function localizeHookCommand(command, version) {
+// `integrity` and `sdk` are what the loader installs when it heals (defaults: the pins).
+function localizeHookCommand(command, version, { platform = process.platform, integrity, sdk } = {}) {
   if (typeof command !== 'string' || !VERSION_RE.test(String(version || ''))) return command;
+  const windows = platform === 'win32';
+  const cfg = runtimeConfig(version, { integrity, sdk });
   let local = command;
   const plain = command.match(CANONICAL_PLAIN_RE);
   if (plain) {
     if (plain[1] !== version) return command;
-    local = localPlain(version, plain[2]);
+    local = localPlain(version, plain[2], windows ? 'win32' : 'posix', cfg);
   } else if (command.startsWith('node -e \'') && command.includes(SPAWN_NPX)) {
     let matched = false;
-    const body = command.slice('node -e \''.length).replace(CANONICAL_SPAWN_RE, (match, argsJson, specVersion) => {
+    const body = command.slice('node -e \''.length).replace(CANONICAL_SPAWN_RE, (match, specVersion, sub) => {
       if (specVersion !== version) return match;
       matched = true;
-      return localSpawn(version, argsJson);
+      return localSpawn(version, sub, cfg);
     });
     if (!matched) return command;
-    local = `${localGuardPrefix(version)}${body}`;
+    local = windows ? `node -e '${body}` : `${localGuardPrefix(version)}${body}`;
   } else if (command.startsWith('sh -c \'')) {
     let matched = false;
     const body = command.slice('sh -c \''.length).replace(CANONICAL_INNER_RE, (match, specVersion, sub) => {
       if (specVersion !== version) return match;
       matched = true;
-      return localInner(version, sub);
+      return localInner(version, sub, cfg);
     });
     if (!matched) return command;
     local = `/bin/sh -c '${body}`;
   } else {
     return command;
   }
-  return delocalizeHookCommand(local) === command ? local : command;
+  return mapsBack(local, command) ? local : command;
+}
+
+function mapsBack(local, command) {
+  // delocalize re-checks guard forms through localize; compare without recursing forever.
+  if (local.match(PLAIN_RE) || local.match(WINDOWS_PLAIN_RE) || local.startsWith('/bin/sh -c \'')) return delocalizeHookCommand(local) === command;
+  const prefixed = LOCAL_GUARD_PREFIX_RE.test(local);
+  const body = prefixed ? local.replace(LOCAL_GUARD_PREFIX_RE, 'node -e \'') : local;
+  const canonical = body.replace(SPAWN_RE, (match, loader, version, sub) => (loaderConfig(loader)
+    ? `${SPAWN_NPX}${JSON.stringify(['-y', `--package=@getmarrow/mcp@${version}`, 'marrow-mcp', sub])},`
+    : match));
+  return canonical === command;
 }
 
 // Every `command` string in a parsed hook settings object.
@@ -413,8 +359,11 @@ function mapHookCommands(value, map) {
   ]));
 }
 
-// Hook settings text with Marrow's entrypoints for `version` switched to the local runtime.
-function localizeHookSettingsText(text, version) {
+// Hook settings text with Marrow's entrypoints for `version` switched to the local runtime. A
+// command already in `previousText` that maps to the same canonical form and carries the same
+// configuration is kept byte for byte, so a file written on another machine (another zlib
+// build) is not rewritten.
+function localizeHookSettingsText(text, version, { platform = process.platform, integrity, sdk, previousText = null } = {}) {
   if (typeof text !== 'string' || !text.trim()) return text;
   let parsed;
   try {
@@ -422,25 +371,128 @@ function localizeHookSettingsText(text, version) {
   } catch {
     return text;
   }
+  const expected = JSON.stringify(runtimeConfig(version, { integrity, sdk }));
+  const keep = new Map();
+  if (typeof previousText === 'string' && previousText.trim()) {
+    try {
+      mapHookCommands(JSON.parse(previousText), (command) => {
+        const canonical = delocalizeHookCommand(command);
+        const loaders = [...command.matchAll(new RegExp(LOADER_PATTERN, 'g'))].map((match) => match[0]);
+        const cfg = loaders.length ? commandConfig(loaders) : null;
+        if (canonical !== command && cfg && JSON.stringify(cfg) === expected
+          && (platform === 'win32') === command.startsWith('node -e "')) keep.set(canonical, command);
+        return command;
+      });
+    } catch {
+      keep.clear();
+    }
+  }
   let changed = false;
   const mapped = mapHookCommands(parsed, (command) => {
-    const local = localizeHookCommand(command, version);
+    const local = keep.get(command) || localizeHookCommand(command, version, { platform, integrity, sdk });
     if (local !== command) changed = true;
     return local;
   });
   return changed ? `${JSON.stringify(mapped, null, 2)}\n` : text;
 }
 
+// A hook script (Cline) with each canonical entrypoint switched to the inline loader for
+// `version`. Without node the line fails, and each script already treats that as no decision
+// (the pre-action script then cancels the call).
+// The Cline pre-action script checks the runtime's answer with node: written scripts run that
+// check on the node the same search picks (never a node on PATH inside the project); no node
+// gives no decision, so the script cancels.
+const CANONICAL_VALIDATOR_RE = /\| NODE_OPTIONS= node -e '([^'\n]*)' 2>\/dev\/null\)"/g;
+const localValidator = (version, body) => `| { ${nodeSearch({ version }, `[ -n "$N" ] || exit 1; NODE_OPTIONS= "$N" -e '${body}'; }`)} 2>/dev/null)"`;
+const VALIDATOR_RE = new RegExp(localValidator('0.0.0', '\u0000').replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  .replace('0\\.0\\.0', '(\\d+\\.\\d+\\.\\d+)').replace('\u0000', "([^'\\n]*)"), 'g');
+
+function localizeHookScriptText(text, version, { integrity, sdk } = {}) {
+  if (typeof text !== 'string' || !VERSION_RE.test(String(version || ''))) return text;
+  const cfg = runtimeConfig(version, { integrity, sdk });
+  return text.replace(CANONICAL_INNER_RE, (match, specVersion, sub) => (
+    specVersion === version ? localInner(version, sub, cfg) : match
+  )).replace(CANONICAL_VALIDATOR_RE, (match, body) => localValidator(version, body));
+}
+
+// Earlier Cline script lines ("$HOME/.marrow/runtime/mcp/<v>/run" ...) back to the canonical form.
+function delocalizeHookScriptText(text) {
+  if (typeof text !== 'string') return text;
+  return text.replace(VALIDATOR_RE, (match, version, body) => `| NODE_OPTIONS= node -e '${body}' 2>/dev/null)"`).replace(INNER_RE, (match, ...rest) => {
+    const { v: version, s: sub, l: loader } = rest[rest.length - 1];
+    const cfg = commandConfig([loader]);
+    return cfg && cfg.version === version && localInner(version, sub, cfg) === withCanonicalLoaders(match, cfg) ? canonicalEntrypoint(version, sub) : match;
+  }).replace(/"\$HOME\/\.marrow\/runtime\/mcp\/(\d+\.\d+\.\d+)\/run" --package=@getmarrow\/mcp@(\d+\.\d+\.\d+) marrow-mcp ([a-z][a-z-]{0,63})/g,
+    (match, runVersion, version, sub) => (runVersion === version ? canonicalEntrypoint(version, sub) : match));
+}
+
+// The MCP server entry (.mcp.json, .cursor/mcp.json), started by the host with no shell. POSIX:
+// /bin/sh with the same node search as the hooks, on the loader. Windows: node on the loader.
+// Base and 0.1.68 wrote `npx -y --package=... marrow-mcp`, started from the project directory.
+function mcpServerLaunch(version, { integrity, sdk, platform = process.platform } = {}) {
+  const loader = loaderFor(runtimeConfig(version, { integrity, sdk }));
+  const tail = [`--package=@getmarrow/mcp@${version}`, 'marrow-mcp'];
+  if (platform === 'win32') return { command: 'node', args: ['-e', loader, '--', ...tail] };
+  const script = nodeSearch({ version }, `if [ -n "$N" ]; then exec "$N" -e "$0" -- "$@"; fi; printf "%s\\n" "${UNAVAILABLE_TEXT}" >&2; exit 1`);
+  return { command: '/bin/sh', args: ['-c', script, loader, ...tail] };
+}
+
+// The version of a server entry this module wrote (exactly, with a valid loader), else null.
+function mcpServerLaunchVersion(entry) {
+  if (!entry || typeof entry !== 'object' || !Array.isArray(entry.args)) return null;
+  const args = entry.args.map(String);
+  const spec = args.find((arg) => /^--package=@getmarrow\/mcp@\d+\.\d+\.\d+$/.test(arg));
+  const loader = args.find((arg) => arg.startsWith('eval(global.MARROW_L='));
+  if (!spec || !loader) return null;
+  const cfg = loaderConfig(loader);
+  const version = spec.slice('--package=@getmarrow/mcp@'.length);
+  if (!cfg || cfg.version !== version) return null;
+  const written = JSON.stringify({ command: entry.command, args: args.map((arg) => (arg === loader ? loaderFor(cfg) : arg)) });
+  return ['linux', 'win32'].some((platform) => JSON.stringify(mcpServerLaunch(version, { ...cfg, platform })) === written) ? version : null;
+}
+
+// Whether a hook file's text still starts @getmarrow/mcp through npx (the canonical form, an
+// earlier local form with its npx fallback, or a guard that spawns npx): such a file needs repair.
+function hookTextUsesNpx(text) {
+  if (typeof text !== 'string' || !text) return false;
+  return /npx -y --package=@getmarrow\/mcp@/.test(text) || text.includes('"npx.cmd":"npx"') || text.includes('\\"npx.cmd\\":\\"npx\\"');
+}
+
+// Whether an MCP server config still starts the Marrow server through npx.
+function mcpServerUsesNpx(config) {
+  const entry = config && typeof config === 'object' && config.mcpServers && typeof config.mcpServers === 'object' ? config.mcpServers.marrow : null;
+  if (!entry || typeof entry !== 'object') return false;
+  const args = Array.isArray(entry.args) ? entry.args.map(String) : [];
+  return /(?:^|[\\/])npx(?:\.cmd)?$/.test(String(entry.command || '')) && args.some((arg) => /^--package=@getmarrow\/mcp(?:@|$)/.test(arg));
+}
+
 module.exports = {
+  HOLD_TEXT,
   NPM_INSTALL_TIMEOUT_MS,
   RUNTIME_SCHEMA,
-  LAUNCHER_SOURCE,
+  UNAVAILABLE_TEXT,
+  WARN_TEXT,
+  RUN,
+  defaultNpmInstall,
   delocalizeHookCommand,
+  delocalizeHookScriptText,
   ensureMcpRuntime,
+  hookTextUsesNpx,
+  launcherSource,
+  loaderConfig,
+  loaderFor,
   localizeHookCommand,
+  localizeHookScriptText,
   localizeHookSettingsText,
   mapHookCommands,
+  mcpServerLaunch,
+  mcpServerLaunchVersion,
+  mcpServerUsesNpx,
+  npmEnvironment,
+  npmInvocation,
   removeMcpRuntime,
+  runtimeConfig,
+  runtimeCore: core,
   runtimeDir,
   runtimeRoot,
   verifyMcpRuntime,