@getmarrow/mcp 3.9.101 → 3.9.103

package/dist/codex-plugins.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The MCP servers enabled Codex plugins add, read from the plugin cache the
+ * way codex 0.161 lays it out (`codex plugin add` writes
+ * `$CODEX_HOME/plugins/cache/<marketplace>/<plugin>/<version>/` and enables
+ * `[plugins."<plugin>@<marketplace>"]` in `$CODEX_HOME/config.toml`), and
+ * whether a plugin is the official Marrow Codex plugin, proven only by the
+ * SHA-256 of every file that decides what its `marrow` server runs.
+ *
+ * Fail closed: a missing cache, more than one version, a symlink whose real
+ * path leaves the cache, a file that is not a regular file, over the size cap
+ * or unparsable, an unknown `mcpServers` shape, a plugin file changed after
+ * codex started (or no codex process to compare with) means "not proven".
+ * Nothing read here is ever logged.
+ */
+export type PluginServers = {
+    id: string;
+    official: boolean;
+    servers: string[];
+};
+export type PluginScan = {
+    bad: string;
+} | {
+    bad: null;
+    plugins: PluginServers[];
+};
+export type PluginScanOptions = {
+    codexHome: string;
+    ids: string[];
+    /** Wall-clock start of the codex process (ms), or null when it cannot be found. */
+    processStartMs: number | null;
+};
+/** Every enabled plugin's MCP server names; any doubt is `bad`. */
+export declare function scanCodexPlugins(options: PluginScanOptions): PluginScan;
+//# sourceMappingURL=codex-plugins.d.ts.map

package/dist/codex-plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-plugins.d.ts","sourceRoot":"","sources":["../src/codex-plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAeH,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC;AAkJnF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,mFAAmF;IACnF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA6BvE"}

package/dist/codex-plugins.js

@@ -0,0 +1,240 @@
+"use strict";
+/**
+ * The MCP servers enabled Codex plugins add, read from the plugin cache the
+ * way codex 0.161 lays it out (`codex plugin add` writes
+ * `$CODEX_HOME/plugins/cache/<marketplace>/<plugin>/<version>/` and enables
+ * `[plugins."<plugin>@<marketplace>"]` in `$CODEX_HOME/config.toml`), and
+ * whether a plugin is the official Marrow Codex plugin, proven only by the
+ * SHA-256 of every file that decides what its `marrow` server runs.
+ *
+ * Fail closed: a missing cache, more than one version, a symlink whose real
+ * path leaves the cache, a file that is not a regular file, over the size cap
+ * or unparsable, an unknown `mcpServers` shape, a plugin file changed after
+ * codex started (or no codex process to compare with) means "not proven".
+ * Nothing read here is ever logged.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanCodexPlugins = scanCodexPlugins;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const own_server_identity_1 = require("./own-server-identity");
+const codex_plugin_pins_1 = require("./codex-plugin-pins");
+const MAX_PLUGINS = 32;
+/** codex keeps whole-second precision in places and the process start is exact to about a second. */
+const START_MARGIN_MS = 2_000;
+const PLUGIN_ID = /^([A-Za-z0-9_][A-Za-z0-9_.-]{0,127})@([A-Za-z0-9_][A-Za-z0-9_.-]{0,127})$/;
+const MANIFESTS = ['.codex-plugin/plugin.json', '.claude-plugin/plugin.json', '.cursor-plugin/plugin.json'];
+const DEFAULT_MCP_FILE = '.mcp.json';
+function insideRoot(root, real) {
+    return real.startsWith(`${root}${node_path_1.sep}`);
+}
+/** A file inside the plugin version directory: relative, no `..`, real path inside the cache. */
+function readPluginFile(at, rel) {
+    if (typeof rel !== 'string' || rel.length === 0 || rel.length > 1024 || rel.includes('\0') || (0, node_path_1.isAbsolute)(rel))
+        return { state: 'bad' };
+    const clean = (0, node_path_1.normalize)(rel);
+    if (clean === '..' || clean.startsWith(`..${node_path_1.sep}`) || (0, node_path_1.isAbsolute)(clean))
+        return { state: 'bad' };
+    const path = (0, node_path_1.join)(at.dir, clean);
+    let real;
+    try {
+        real = (0, node_fs_1.realpathSync)(path);
+    }
+    catch (error) {
+        const code = error?.code;
+        return code === 'ENOENT' || code === 'ENOTDIR' ? { state: 'missing' } : { state: 'bad' };
+    }
+    if (!insideRoot(at.root, real))
+        return { state: 'bad' };
+    const read = (0, own_server_identity_1.readHostConfigBytes)(real);
+    if (read.state !== 'ok')
+        return read.state === 'missing' ? { state: 'missing' } : { state: 'bad' };
+    try {
+        at.newest = Math.max(at.newest, (0, node_fs_1.statSync)(real).mtimeMs, (0, node_fs_1.lstatSync)(path).mtimeMs);
+    }
+    catch {
+        return { state: 'bad' };
+    }
+    return read;
+}
+function withoutBom(text) {
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+function plainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+/** `{ "mcpServers": { name: {...} } }` or a bare `{ name: {...} }` map; anything else is unknown. */
+function serverNames(value) {
+    if (!plainObject(value))
+        return null;
+    const keys = Object.keys(value);
+    if (keys.includes('mcpServers')) {
+        if (keys.length !== 1 || !plainObject(value.mcpServers))
+            return null;
+        value = value.mcpServers;
+    }
+    const map = value;
+    if (!Object.values(map).every(plainObject))
+        return null;
+    return Object.keys(map);
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(withoutBom(text));
+    }
+    catch {
+        return undefined;
+    }
+}
+function sha256(bytes) {
+    return (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex');
+}
+/** One enabled plugin's servers, and whether its files are exactly a pinned official release. */
+function scanPlugin(cacheRoot, realRoot, id) {
+    const match = PLUGIN_ID.exec(id);
+    if (!match)
+        return 'a Codex plugin id has an unknown form';
+    const [, plugin, marketplace] = match;
+    const pluginDir = (0, node_path_1.join)(cacheRoot, marketplace, plugin);
+    let versions;
+    try {
+        versions = (0, node_fs_1.readdirSync)(pluginDir);
+    }
+    catch {
+        return 'an enabled Codex plugin is not in the local cache';
+    }
+    if (versions.length !== 1)
+        return versions.length ? 'more than one version of a Codex plugin is cached' : 'an enabled Codex plugin is not in the local cache';
+    const dir = (0, node_path_1.join)(pluginDir, versions[0]);
+    let realDir;
+    try {
+        realDir = (0, node_fs_1.realpathSync)(dir);
+        if (!(0, node_fs_1.statSync)(realDir).isDirectory())
+            return 'a Codex plugin cache entry is not a directory';
+    }
+    catch {
+        return 'a Codex plugin cache entry is unreadable';
+    }
+    if (!insideRoot(realRoot, realDir))
+        return 'a Codex plugin cache entry leaves the cache';
+    const at = { root: realRoot, dir, newest: 0 };
+    try {
+        at.newest = Math.max((0, node_fs_1.lstatSync)(dir).mtimeMs, (0, node_fs_1.statSync)(realDir).mtimeMs);
+    }
+    catch {
+        return 'a Codex plugin cache entry is unreadable';
+    }
+    const names = new Set();
+    const texts = new Map();
+    const take = (rel, required) => {
+        const read = readPluginFile(at, rel);
+        if (read.state === 'missing')
+            return required ? 'a Codex plugin file is missing' : null;
+        if (read.state === 'bad')
+            return 'a Codex plugin file is unreadable, not a regular file, too large or outside the cache';
+        texts.set((0, node_path_1.normalize)(rel), read.bytes);
+        const parsed = parseJson(read.bytes.toString('utf8'));
+        return parsed === undefined ? 'a Codex plugin file does not parse' : { parsed };
+    };
+    const manifests = [];
+    for (const rel of MANIFESTS) {
+        const got = take(rel, false);
+        if (typeof got === 'string')
+            return got;
+        if (got === null)
+            continue;
+        const manifest = got.parsed;
+        if (!plainObject(manifest))
+            return 'a Codex plugin manifest is not an object';
+        manifests.push(manifest);
+        const servers = manifest.mcpServers;
+        if (servers === undefined)
+            continue;
+        let found;
+        if (typeof servers === 'string') {
+            const file = take(servers, true);
+            if (typeof file === 'string')
+                return file;
+            found = serverNames(file.parsed);
+        }
+        else {
+            found = serverNames(servers);
+        }
+        if (!found)
+            return 'a Codex plugin declares MCP servers in an unknown shape';
+        for (const name of found)
+            names.add(name);
+    }
+    if (!manifests.length)
+        return 'a Codex plugin has no manifest';
+    const fallback = take(DEFAULT_MCP_FILE, false);
+    if (typeof fallback === 'string')
+        return fallback;
+    if (fallback !== null) {
+        const found = serverNames(fallback.parsed);
+        if (!found)
+            return 'a Codex plugin declares MCP servers in an unknown shape';
+        for (const name of found)
+            names.add(name);
+    }
+    // The official plugin: one codex manifest naming a pinned release, cached under its own version,
+    // and every file that decides what its server runs byte-identical to that release.
+    let official = false;
+    const primary = manifests.length === 1 && texts.has((0, node_path_1.normalize)(MANIFESTS[0])) ? manifests[0] : null;
+    const pins = primary && typeof primary.name === 'string' && typeof primary.version === 'string'
+        ? codex_plugin_pins_1.OFFICIAL_CODEX_PLUGIN_PINS[`${primary.name}@${primary.version}`]
+        : undefined;
+    if (pins && (0, node_path_1.basename)(dir) === primary.version) {
+        official = Object.entries(pins).every(([rel, digest]) => {
+            if (!texts.has((0, node_path_1.normalize)(rel))) {
+                const read = readPluginFile(at, rel);
+                if (read.state !== 'ok')
+                    return false;
+                texts.set((0, node_path_1.normalize)(rel), read.bytes);
+            }
+            return sha256(texts.get((0, node_path_1.normalize)(rel))) === digest;
+        });
+    }
+    return { id, official, servers: [...names], newest: at.newest };
+}
+/** Every enabled plugin's MCP server names; any doubt is `bad`. */
+function scanCodexPlugins(options) {
+    if (!options.ids.length)
+        return { bad: null, plugins: [] };
+    if (options.ids.length > MAX_PLUGINS)
+        return { bad: 'too many Codex plugins are enabled' };
+    if (options.processStartMs === null || !Number.isFinite(options.processStartMs)) {
+        return { bad: 'the codex process start is unknown, so plugin files cannot be dated' };
+    }
+    const plugins = (0, node_path_1.join)(options.codexHome, 'plugins');
+    try {
+        const staging = (0, node_fs_1.readdirSync)((0, node_path_1.join)(plugins, '.remote-plugin-install-staging'));
+        if (staging.length)
+            return { bad: 'a remote Codex plugin install is staged' };
+    }
+    catch (error) {
+        if (error?.code !== 'ENOENT')
+            return { bad: 'the Codex plugin staging folder is unreadable' };
+    }
+    const cacheRoot = (0, node_path_1.join)(plugins, 'cache');
+    let realRoot;
+    try {
+        realRoot = (0, node_fs_1.realpathSync)(cacheRoot);
+    }
+    catch {
+        return { bad: 'the Codex plugin cache is missing' };
+    }
+    const out = [];
+    for (const id of options.ids) {
+        const scanned = scanPlugin(cacheRoot, realRoot, id);
+        if (typeof scanned === 'string')
+            return { bad: scanned };
+        const { newest, ...plugin } = scanned;
+        if (!(newest < options.processStartMs - START_MARGIN_MS))
+            return { bad: 'a Codex plugin changed after codex started' };
+        out.push(plugin);
+    }
+    return { bad: null, plugins: out };
+}
+//# sourceMappingURL=codex-plugins.js.map

package/dist/codex-plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-plugins.js","sourceRoot":"","sources":["../src/codex-plugins.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AA0KH,4CA6BC;AArMD,6CAAyC;AACzC,qCAAyE;AACzE,yCAAuE;AACvE,+DAA4D;AAC5D,2DAAiE;AAEjE,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,qGAAqG;AACrG,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,SAAS,GAAG,2EAA2E,CAAC;AAC9F,MAAM,SAAS,GAAG,CAAC,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;AAC5G,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAOrC,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,eAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,EAAO,EAAE,GAAW;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAA,sBAAU,EAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvI,MAAM,KAAK,GAAG,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,eAAG,EAAE,CAAC,IAAI,IAAA,sBAAU,EAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACjG,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,EAAE,IAAI,CAAC;QACpD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnG,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC1E,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,iGAAiG;AACjG,SAAS,UAAU,CAAC,SAAiB,EAAE,QAAgB,EAAE,EAAU;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,uCAAuC,CAAC;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,qBAAW,EAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,mDAAmD,CAAC;IAC9J,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,+CAA+C,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACzF,MAAM,EAAE,GAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC;QAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAA,mBAAS,EAAC,GAAG,CAAC,CAAC,OAAO,EAAE,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,0CAA0C,CAAC;IAAC,CAAC;IAE7I,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,QAAiB,EAA2B,EAAE;QACvE,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,uFAAuF,CAAC;QACzH,KAAK,CAAC,GAAG,CAAC,IAAA,qBAAS,EAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAClF,CAAC,CAAC;IACF,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAI,GAA2B,CAAC,MAAM,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAAE,OAAO,0CAA0C,CAAC;QAC9E,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,KAAsB,CAAC;QAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,KAAK,GAAG,WAAW,CAAE,IAA4B,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,yDAAyD,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,gCAAgC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAE,QAAgC,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK;YAAE,OAAO,yDAAyD,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,iGAAiG;IACjG,mFAAmF;IACnF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAA,qBAAS,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAC7F,CAAC,CAAC,8CAA0B,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,IAAI,IAAI,IAAA,oBAAQ,EAAC,GAAG,CAAC,KAAK,OAAQ,CAAC,OAAO,EAAE,CAAC;QAC/C,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;YACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,CAAC,GAAG,CAAC,IAAA,qBAAS,EAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAE,CAAC,KAAK,MAAM,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAwC,CAAC;AACxG,CAAC;AASD,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,OAA0B;IACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,EAAE,GAAG,EAAE,oCAAoC,EAAE,CAAC;IAC3F,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,GAAG,EAAE,qEAAqE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,EAAE,yCAAyC,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAC;IAC3H,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,sBAAY,EAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,OAA6C,CAAC;QAC5E,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,eAAe,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,4CAA4C,EAAE,CAAC;QACvH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACrC,CAAC"}

package/dist/env.d.ts

@@ -7,6 +7,8 @@ export interface ResolvedMarrowEnv {
     missing: boolean;
     exactFix: string;
 }
+/** Host (with port) of a non-default base URL, for status output; null for the default. */
+export declare function nonDefaultBaseUrlHost(baseUrl: string): string | null;
 export declare function resolveMarrowEnv(options?: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6FD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,iBAAiB,CAsDzB"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQpE;AAiLD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,iBAAiB,CA6DzB"}

package/dist/env.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonDefaultBaseUrlHost = nonDefaultBaseUrlHost;
 exports.resolveMarrowEnv = resolveMarrowEnv;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -46,6 +47,47 @@ const ALLOWED_ENV_KEYS = new Set([
     'MARROW_AGENT_ID',
     'MARROW_SESSION_ID',
 ]);
+const MAX_ENV_FILE_BYTES = 1024 * 1024;
+const REPO_KEY_FIX = 'run npx @getmarrow/install doctor, or move the line to ~/.marrow/env, then chmod 600 ~/.marrow/env';
+/** Host (with port) of a non-default base URL, for status output; null for the default. */
+function nonDefaultBaseUrlHost(baseUrl) {
+    const normalized = normalizeBaseUrl(baseUrl);
+    if (normalized === normalizeBaseUrl(DEFAULT_BASE_URL))
+        return null;
+    try {
+        return new URL(baseUrl).host || 'invalid';
+    }
+    catch {
+        return 'invalid';
+    }
+}
+function normalizeBaseUrl(value) {
+    try {
+        return new URL(String(value || '').trim()).href.replace(/\/+$/, '');
+    }
+    catch {
+        return `invalid:${String(value || '')}`;
+    }
+}
+// File paths come from the working directory; keep notices on one printable line.
+const MAX_PRINTED_PATH = 200;
+// Paths in notices can be attacker-named: control, line-separator and format
+// (bidi, zero-width) characters become '?', and the length is capped.
+function printablePath(filePath) {
+    const clean = filePath.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+    const chars = Array.from(clean);
+    return chars.length > MAX_PRINTED_PATH ? `${chars.slice(0, MAX_PRINTED_PATH - 3).join('')}...` : clean;
+}
+// Shell operand for a chmod command built from the REAL path. Returns null when
+// the path cannot be printed faithfully (control/format/line-separator characters
+// or longer than the print cap), so advice never targets a shortened or '?' path.
+function shellOperand(realPath) {
+    if (/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(realPath) || Array.from(realPath).length > MAX_PRINTED_PATH)
+        return null;
+    if (/^[A-Za-z0-9_@%+=:,./][A-Za-z0-9_@%+=:,./-]*$/.test(realPath))
+        return realPath;
+    return `'${realPath.replace(/'/g, `'\\''`)}'`;
+}
 function stripQuotes(value) {
     const trimmed = String(value || '').trim();
     if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
@@ -53,35 +95,84 @@ function stripQuotes(value) {
     }
     return trimmed;
 }
-function isPrivateOwnerFile(filePath, home) {
+// The one trust decision for owner files, shared by the MCP and hook paths. It
+// is made about the bytes that were read: the file is opened without following
+// a symlink, its type, owner and mode come from fstat on that same descriptor,
+// and an lstat of the path taken after the read must name the same inode. The
+// file must be the owner's and private; home and ~/.marrow must be the owner's
+// real directories, not writable by anyone else. Anything else supplies nothing.
+function readOwnerEnvFile(filePath, home) {
+    const resolvedHome = path.resolve(home);
+    const resolvedFile = path.resolve(filePath);
+    const read = readEnvFile(resolvedFile, true, Infinity);
+    if (!read) {
+        try {
+            fs.lstatSync(resolvedFile);
+            return { status: 'rejected' };
+        }
+        catch {
+            return { status: 'absent' };
+        }
+    }
     try {
-        const resolvedHome = path.resolve(home);
-        const resolvedFile = path.resolve(filePath);
         const parent = path.dirname(resolvedFile);
         const homeStat = fs.lstatSync(resolvedHome);
         const parentStat = fs.lstatSync(parent);
-        const fileStat = fs.lstatSync(resolvedFile);
+        const pathStat = fs.lstatSync(resolvedFile);
         const uid = typeof process.getuid === 'function' ? process.getuid() : null;
-        return resolvedFile.startsWith(`${resolvedHome}${path.sep}`)
-            && homeStat.isDirectory() && !homeStat.isSymbolicLink() && fs.realpathSync(resolvedHome) === resolvedHome
-            && parentStat.isDirectory() && !parentStat.isSymbolicLink() && fs.realpathSync(parent) === parent
-            && fileStat.isFile() && !fileStat.isSymbolicLink()
-            && (uid === null || fileStat.uid === uid && parentStat.uid === uid && homeStat.uid === uid)
-            && (fileStat.mode & 0o077) === 0
-            && (parentStat.mode & 0o022) === 0
-            && (homeStat.mode & 0o022) === 0;
+        const owned = (stat) => uid === null || stat.uid === uid;
+        const safeDir = (stat, dir) => stat.isDirectory() && !stat.isSymbolicLink()
+            && fs.realpathSync(dir) === dir && owned(stat) && (stat.mode & 0o022) === 0;
+        const trusted = resolvedFile.startsWith(`${resolvedHome}${path.sep}`)
+            && safeDir(homeStat, resolvedHome) && safeDir(parentStat, parent)
+            && read.stat.isFile() && owned(read.stat) && (read.stat.mode & 0o077) === 0
+            && pathStat.isFile() && pathStat.dev === read.stat.dev && pathStat.ino === read.stat.ino;
+        return trusted ? { status: 'trusted', values: read.values } : { status: 'rejected' };
     }
     catch {
-        return false;
+        return { status: 'rejected' };
     }
 }
-function parseEnvFile(filePath, trustedHome) {
-    if (!fs.existsSync(filePath))
-        return {};
-    if (trustedHome && !isPrivateOwnerFile(filePath, trustedHome))
-        return {};
+// Opens without blocking (a planted FIFO cannot hang the server) and reads only
+// regular files. Only untrusted repo files are size-capped (maxBytes); owner files
+// keep base parity (no cap), so a file base accepted is never turned into no-key.
+// noFollow refuses a symlink at open time where supported.
+function readEnvFile(filePath, noFollow, maxBytes) {
+    const flags = fs.constants.O_RDONLY
+        | (fs.constants.O_NONBLOCK || 0)
+        | (noFollow ? fs.constants.O_NOFOLLOW || 0 : 0);
+    let fd;
+    try {
+        fd = fs.openSync(filePath, flags);
+    }
+    catch {
+        return null;
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > maxBytes)
+            return null;
+        const buffer = Buffer.alloc(stat.size + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const read = fs.readSync(fd, buffer, length, buffer.length - length, null);
+            if (read <= 0)
+                break;
+            length += read;
+        }
+        if (length > stat.size)
+            return null;
+        return { values: parseEnvText(buffer.subarray(0, length).toString('utf8')), stat };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function parseEnvText(raw) {
     const values = {};
-    const raw = fs.readFileSync(filePath, 'utf8');
     for (const line of raw.split(/\r?\n/)) {
         const match = line.match(/^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=\s*(.*?)\s*$/);
         if (!match)
@@ -96,14 +187,14 @@ function parseEnvFile(filePath, trustedHome) {
     }
     return values;
 }
-function candidateEnvFiles(cwd, home, trustedOnly) {
-    const ownerFiles = [
+function ownerEnvFiles(home) {
+    return [
         path.join(home, '.marrow', 'env.local'),
         path.join(home, '.marrow', 'env'),
     ];
-    if (trustedOnly)
-        return ownerFiles;
-    const files = [...ownerFiles];
+}
+function repoEnvFiles(cwd, ownerFiles) {
+    const files = [];
     let dir = path.resolve(cwd || process.cwd());
     for (let depth = 0; depth < 8; depth += 1) {
         files.push(path.join(dir, '.marrow', 'env.local'));
@@ -115,7 +206,7 @@ function candidateEnvFiles(cwd, home, trustedOnly) {
             break;
         dir = parent;
     }
-    return [...new Set(files)];
+    return [...new Set(files)].filter((file) => !ownerFiles.includes(file));
 }
 function pickKey(env) {
     if (env.MARROW_API_KEY)
@@ -169,21 +260,119 @@ function resolveMarrowEnv(options = {}) {
             exactFix: 'Marrow key is loaded from the process environment.',
         };
     }
-    for (const filePath of candidateEnvFiles(cwd, home, options.trustedOnly === true)) {
-        const parsed = parseEnvFile(filePath, options.trustedOnly === true ? home : undefined);
-        const found = pickKey(parsed);
-        if (!found.key)
+    // Owner files, in the same order and with the same check on the MCP and hook
+    // paths. A file that fails the check supplies nothing, key included.
+    const ownerFiles = ownerEnvFiles(home);
+    let ignored = null;
+    for (const filePath of ownerFiles) {
+        const read = readOwnerEnvFile(filePath, home);
+        if (read.status === 'rejected') {
+            if (!ignored)
+                ignored = ownerFileNotice(filePath, home);
             continue;
-        return {
-            apiKey: found.key,
-            baseUrl: parsed.MARROW_BASE_URL || env.MARROW_BASE_URL || DEFAULT_BASE_URL,
-            agentId: parsed.MARROW_FLEET_AGENT_ID || parsed.MARROW_AGENT_ID || env.MARROW_FLEET_AGENT_ID || env.MARROW_AGENT_ID,
-            sessionId: parsed.MARROW_SESSION_ID || env.MARROW_SESSION_ID,
-            source: `${filePath}:${found.source}`,
-            missing: false,
-            exactFix: `Marrow key was found in ${filePath}. Keep this file private and run npx @getmarrow/install doctor to verify.`,
-        };
+        }
+        if (read.status !== 'trusted')
+            continue;
+        const found = pickKey(read.values);
+        if (found.key)
+            return fromFile(filePath, found, read.values, env);
+    }
+    if (options.trustedOnly === true)
+        return missingKey(env, ignored);
+    // Repository-level files (found by walking up from cwd) never supply a key or
+    // any other Marrow setting, whatever their owner or mode: a umask-077 clone or a
+    // mode-preserving archive yields a private file the owner never wrote. They are
+    // read (bounded, non-blocking) only to tell the owner a key there was skipped.
+    for (const filePath of repoEnvFiles(cwd, ownerFiles)) {
+        try {
+            fs.lstatSync(filePath);
+        }
+        catch {
+            continue;
+        }
+        const peek = readEnvFile(filePath, false, MAX_ENV_FILE_BYTES);
+        if (pickKey(peek?.values || {}).key && !ignored)
+            ignored = repoKeyNotice(filePath);
+    }
+    return missingKey(env, ignored);
+}
+function repoKeyNotice(filePath) {
+    return `Marrow key in ${printablePath(filePath)} ignored: keys are read only from ~/.marrow/env or your environment. Fix: ${REPO_KEY_FIX}.`;
+}
+function symlinkInChain(filePath) {
+    try {
+        if (fs.lstatSync(filePath).isSymbolicLink())
+            return 'file';
+    }
+    catch {
+        // Missing or unreadable: not a link we can name.
+    }
+    let dir = path.dirname(path.resolve(filePath));
+    for (;;) {
+        try {
+            if (fs.lstatSync(dir).isSymbolicLink())
+                return 'folder';
+        }
+        catch {
+            // Keep walking up.
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
     }
+}
+function ownerFileNotice(filePath, home) {
+    const file = printablePath(filePath);
+    // Windows reports no owner-only mode bits, so owner files never pass there.
+    if (process.platform === 'win32') {
+        return `Ignored the Marrow key in ${file}: owner-only file permissions cannot be confirmed on Windows. Fix: set MARROW_API_KEY in your environment or in the MCP client's env settings.`;
+    }
+    // The helper also refuses a home directory others can write, so name it too.
+    let homeDir = null;
+    try {
+        const resolvedHome = path.resolve(home);
+        if (resolvedHome !== path.dirname(path.resolve(filePath)) && (fs.lstatSync(resolvedHome).mode & 0o022) !== 0) {
+            homeDir = resolvedHome;
+        }
+    }
+    catch {
+        // Unreadable home: the generic advice stands.
+    }
+    // chmod follows a symlink and would change its target while the link stays
+    // refused, so a symlinked file or folder gets no chmod operand on that path.
+    const lead = `Ignored the Marrow key in ${file}: the file is not owner-only (a symlink, readable or writable by others, owned by another user, or in a directory others can write).`;
+    const link = symlinkInChain(filePath);
+    if (link === 'file') {
+        return `${lead} Fix: replace the symlink with the real file (owner-only, mode 600); do not run chmod on the link.`;
+    }
+    if (link === 'folder') {
+        return `${lead} Fix: remove the symlink from the folder chain so the path uses real folders only, then make the file owner-only (mode 600); do not run chmod through the link.`;
+    }
+    const tail = ' (replace a symlink with the file itself)';
+    // Command operands use the real paths, quoted; if any cannot be printed safely, name no path.
+    const dirOp = shellOperand(path.dirname(filePath));
+    const fileOp = shellOperand(filePath);
+    const homeOp = homeDir === null ? '' : shellOperand(homeDir);
+    if (fileOp !== null && dirOp !== null && homeOp !== null) {
+        const homeFix = homeDir === null ? '' : ` && chmod go-w ${homeOp}`;
+        return `${lead} Fix: chmod 600 ${fileOp} && chmod 700 ${dirOp}${homeFix}${tail}.`;
+    }
+    const homeText = homeDir === null ? '' : ' and chmod go-w on your home folder';
+    return `${lead} Fix: run chmod 600 on the file named above and chmod 700 on its folder${homeText}${tail}.`;
+}
+function fromFile(filePath, found, parsed, env) {
+    return {
+        apiKey: found.key,
+        baseUrl: parsed.MARROW_BASE_URL || env.MARROW_BASE_URL || DEFAULT_BASE_URL,
+        agentId: parsed.MARROW_FLEET_AGENT_ID || parsed.MARROW_AGENT_ID || env.MARROW_FLEET_AGENT_ID || env.MARROW_AGENT_ID,
+        sessionId: parsed.MARROW_SESSION_ID || env.MARROW_SESSION_ID,
+        source: `${filePath}:${found.source}`,
+        missing: false,
+        exactFix: `Marrow key was found in ${printablePath(filePath)}. Keep this file private and run npx @getmarrow/install doctor to verify.`,
+    };
+}
+function missingKey(env, ignored) {
     return {
         apiKey: '',
         baseUrl: env.MARROW_BASE_URL || DEFAULT_BASE_URL,
@@ -191,7 +380,8 @@ function resolveMarrowEnv(options = {}) {
         sessionId: env.MARROW_SESSION_ID,
         source: null,
         missing: true,
-        exactFix: 'Create an API key at https://getmarrow.ai, then export MARROW_API_KEY from trusted secret storage or place it in ~/.marrow/env with owner-only permissions before running npx -y --package=@getmarrow/mcp@latest marrow-mcp setup.',
+        exactFix: 'Create an API key at https://getmarrow.ai, then export MARROW_API_KEY from trusted secret storage or place it in ~/.marrow/env with owner-only permissions before running npx -y --package=@getmarrow/mcp@latest marrow-mcp setup.'
+            + (ignored ? `\n${ignored}` : ''),
     };
 }
 //# sourceMappingURL=env.js.map