@getmarrow/mcp 3.9.101 → 3.9.103

package/dist/normalized-action.d.ts

@@ -8,8 +8,14 @@
  * names of a shell command, the file paths of an edit (the home directory as
  * `~`, another user's home as `/home/[user]`), a SHA-256 of the
  * command or tool input, and `truncated: true` when that hash could not cover
- * everything that decides what the action does. The command text and the
- * tool input themselves are never sent.
+ * everything that decides what the action does. The tool input is never sent.
+ * The command text is never sent, with one exception: a shell command that is
+ * word for word one of the deploy grammars (deployCommandText: one clause of
+ * plain ASCII words, an optional launcher, the deploy tool and subcommand, at
+ * most one environment flag with a DEPLOY_ENV_VALUE value, nothing else, and
+ * no secret replaced) is also sent as `tool_input.command`, exactly as typed
+ * (for example `sst deploy --stage production`), so the service can judge the
+ * deploy target. Every other command sends only its hash.
  *
  * Before hashing, a normalized form is built (whitespace and quoting
  * normalized) in which:
@@ -39,9 +45,12 @@
  * - Data a command reads (text echoed or printed into a pipe or a file,
  *   heredoc bodies, here-strings) and the values of other environment
  *   assignments and env-store settings (`env:set`, `config:set`, `variables
- *   set`) are replaced by a SHA-256 of the data when the data carries
- *   nothing secret-shaped and does not feed a secrets command or a secrets
- *   file: different data gives a different hash, the same data the same hash.
+ *   set`) are replaced by a SHA-256 of the data when the data does not feed
+ *   a secrets command or a secrets file: different data gives a different
+ *   hash, the same data the same hash. Data that carries something
+ *   secret-shaped is hashed with each secret replaced by `[secret]`
+ *   (`[secret-data:…]`, truncated), so data that differs outside a secret
+ *   still gives a different hash.
  * - Anything else that may be a secret is replaced by `[secret]` and the
  *   action is marked `truncated: true`, so Marrow never binds an approval to
  *   it and always asks: data that feeds a secrets command (`… secret put`,
@@ -74,8 +83,12 @@ export type NormalizedHookAction = {
     paths?: string[];
     tool_input: {
         command_sha256: string;
+        exact_hmac?: string;
     } | {
         input_sha256: string;
+        exact_hmac?: string;
+    } | {
+        exact_hmac: string;
     } | Record<string, never>;
     /** The hash could not cover everything that decides the action: Marrow never binds an approval to it. */
     truncated?: true;
@@ -100,7 +113,7 @@ export declare function classifySecretName(name: string): NameClass;
  * never sent. `truncated` is true when something that may change what the
  * command does had to be withheld. Exported for tests.
  */
-export declare function normalizeShellCommand(command: string, deadline?: number): {
+export declare function normalizeShellCommand(command: string, deadline?: number, exact?: boolean): {
     text: string;
     programs: string[];
     truncated: boolean;
@@ -123,9 +136,19 @@ export declare function deployCommandText(command: string): string | null;
  * service never binds, so the hook still answers within its host's budget.
  * An event whose input a host adapter cut or dropped (`input_truncated`) is
  * marked truncated as well.
+ *
+ * A truncated action also carries `tool_input.exact_hmac`: a keyed hash (the
+ * device salt never leaves the machine) of the action with only certain
+ * credentials replaced, so two actions that differ anywhere else never share a
+ * correlation, hold or key, and a retry that differs only in a certain
+ * credential (an OTP) still does. A placeholder keys the raw input (up to
+ * 1 MB). Input a host adapter cut or dropped, input over 1 MB and a missing or
+ * unsafe salt give a random nonce: the action matches nothing (it is asked
+ * again). `salt` is a test seam (undefined: the device salt).
  */
 export declare function normalizedHookAction(event: ToolEvent, options?: {
     deadlineAt?: number;
+    salt?: Buffer | null;
 }): NormalizedHookAction;
 export {};
 //# sourceMappingURL=normalized-action.d.ts.map

package/dist/normalized-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1F,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA+B/D,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AA+CD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAowBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CASlI;AAgGD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AAkBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,oBAAoB,CAgBlH"}
+{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7J,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA8C/D,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AAgDD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAm5BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWjJ;AAwHD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AA0KD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,oBAAoB,CA4BxI"}