@getmarrow/mcp 3.9.101 → 3.9.103

package/dist/hook-pre-action.d.ts

@@ -3,6 +3,10 @@ import { type HoldPlan } from './host-approval';
 import { MARROW_OUTAGE_WARNING } from './hook-contract';
 /** A protected action with no Marrow key anywhere this machine keeps one (MARROW_API_KEY, ~/.marrow/env.local or ~/.marrow/env, owner-only). */
 export declare const NO_KEY_TEXT = "Marrow has no API key on this machine. Owner: create one at getmarrow.ai/signup, then run the installer activate command in a terminal. Do not retry this action.";
+/** Seatbelt mode `claimed_no_key` (spec §1.1): account evidence on the machine but no usable key. Same text as src/seatbelt/hook.ts. */
+export declare const CLAIMED_NO_KEY_TEXT = "Marrow is linked to an account but has no working key; owner: run `npx -y @getmarrow/install@latest doctor`.";
+/** `claimed_no_key` without account evidence (a mode fallback): the same holds, never an account claim. Same text as src/seatbelt/hook.ts. */
+export declare const SETUP_UNCONFIRMED_TEXT = "Marrow has no working key on this machine and its keyless mode is off here (strict mode, or a home folder it cannot trust); owner: run `npx -y @getmarrow/install@latest doctor`.";
 export { MARROW_OUTAGE_WARNING };
 export declare const MAX_PRE_ACTION_INPUT_BYTES: number;
 export declare const PRE_ACTION_CONTROL_TIMEOUT_MS = 8000;
@@ -33,6 +37,8 @@ type HookHarness = 'claude-code' | 'cline' | 'codex' | 'cursor' | 'gemini' | 'gr
 export declare const HOLD_OWNER_DENIAL = "Marrow is holding this action for approval. Retry it after approval.";
 /** Marrow did not answer within the hook's time limit: an action that can be held stays held. */
 export declare const HELD_SLOW_TEXT = "Marrow did not answer in time, so this action is held. Retry it in a moment.";
+/** Marrow cannot be reached (a real outage): a high-risk action fails closed; routine actions keep the outage allow. */
+export declare const HELD_OFFLINE_TEXT = "Marrow cannot be reached right now, so this high-risk action is held; routine actions keep running. Retry it when Marrow is back.";
 /** The only denial @getmarrow/install's Grok guard passes through (any other output blocks with a launch failure). */
 export declare const GROK_FIXED_DENIAL = "Marrow blocked this protected action.";
 /**
@@ -63,7 +69,7 @@ type PreActionControlResult = {
 };
 export declare function isMarrowOutage(result: PreActionControlResult): boolean;
 export declare function controlFailureKind(error: unknown): PreActionControlResult['failure'];
-export declare function controlRejectionMessage(error: unknown, agentId?: string): string;
+export declare function controlRejectionMessage(error: unknown, agentId?: string, kind?: PreActionControlResult['failure']): string;
 export type OwnerApprovalPrompt = {
     available: boolean;
     unavailableReason: string;
@@ -97,8 +103,37 @@ export declare function advisoryGateNotice(runtime: PreActionControlResult['runt
 export declare function runtimeGateVerdict(runtime: PreActionControlResult['runtime']): GateVerdict | null;
 export declare function gateDecisionMessage(verdict: GateVerdict, ask: boolean, prompt?: OwnerApprovalPrompt): string;
 export declare function localControlAllowOutput(harness: 'claude-code' | 'cline' | 'codex' | 'cursor' | 'gemini' | 'grok' | 'windsurf' | 'mcp-client'): Record<string, unknown> | null;
+/** Keyless seatbelt: a host that cannot hand this action to its own approval prompt holds it (no account to approve it). */
+export declare const SEATBELT_HELD_TEXT = "MARROW SEATBELT held this action: this host cannot hand it to its own approval prompt here, and no Marrow account is linked to approve it. This needs the machine owner. Do not retry it another way or edit Marrow settings. Tell the owner: run it yourself in your own terminal, or link a Marrow account with \"npx -y @getmarrow/install@latest activate\" (it needs MARROW_API_KEY set first) so these become approval prompts.";
+export declare const SEATBELT_CURSOR_ASK_USER_TEXT = "Marrow seatbelt (no account linked): approve this action here only if you expected it.";
+export declare const SEATBELT_CURSOR_ASK_AGENT_TEXT = "Cursor is asking the user to approve this action (Marrow seatbelt, no account linked). Wait for the answer; do not retry it another way.";
+/**
+ * The keyless seatbelt's answer for an action it does not stop (spec §1.3 "pass": Marrow adds no
+ * decision and the host's own permission flow runs). `heldBefore`: the 3.9.103 keyless hook held this
+ * action (protected, or not read-only on Windsurf, Gemini or Grok). `null` means exit 0, no output.
+ * - Not held before: exactly the answer 3.9.103 gave (its read-only and unprotected passes).
+ * - Held before: never an explicit allow that could skip the host's own approval step.
+ *   Claude Code and Codex `{}` (no permissionDecision), Cline `{cancel:false}`, Windsurf no output:
+ *   the hosts' neutral answers (see PASS_THROUGH_HOSTS), so their own approval step runs.
+ *   Gemini CLI `{"decision":"allow"}`: the installed guard passes only that or a fixed denial (no
+ *   output is a launch failure that blocks), and Gemini applies its own policy and confirmation
+ *   after the BeforeTool hook whatever an "allow" says, so it is Gemini's neutral answer.
+ *   Cursor beforeShellExecution / beforeMCPExecution: "ask", so Cursor's own approval prompt decides.
+ *   Cursor preToolUse (no neutral answer, "ask" not enforced) and Grok (its guard passes only an
+ *   explicit allow or the fixed denial, and nothing shows an allow keeps Grok's own approval): held,
+ *   as 3.9.103 did. Any other or missing Cursor event name is treated as preToolUse.
+ */
+export declare function seatbeltPassOutput(harness: 'claude-code' | 'cline' | 'codex' | 'cursor' | 'gemini' | 'grok' | 'windsurf' | 'mcp-client', hookEventName: unknown, heldBefore: boolean): Record<string, unknown> | null;
 export declare function localLoopGuardDenyOutput(harness: 'claude-code' | 'cline' | 'codex' | 'cursor' | 'gemini' | 'grok' | 'windsurf' | 'mcp-client', reason: string): Record<string, unknown> | null;
-export declare function classifyTool(event: PreToolUseEvent): {
+/**
+ * `ownUnproven`: the label is one of Marrow's own, but the host's server
+ * identity check did not prove the official server (Codex, Cursor). Such a
+ * call is classified as a protected MCP tool of another server, never
+ * read-only (it imitates Marrow's names, so a read verb proves nothing).
+ */
+export declare function classifyTool(event: PreToolUseEvent, options?: {
+    ownUnproven?: boolean;
+}): {
     action: string;
     target: string;
     type: string;
@@ -145,5 +180,16 @@ export declare function installPreActionHook(startDir?: string): {
     settingsPath: string;
     installed: boolean;
 };
+/**
+ * I3: whether a real outage (the gate never answered) holds this action. Never looser than master,
+ * which allowed every action in an outage. A shell command is read by the seatbelt mapper: held for an
+ * S0-S5/S-x hit or a program on the outage list (git push, publish, deploy, remote delete), allowed
+ * when the mapper read all of it and found neither (words in a message, a path or a comment never hold
+ * it). Anything else, or a mapper that could not finish, keeps `classifiedHighRisk` (F2).
+ */
+export declare function outageHolds(classifiedHighRisk: boolean, read: () => {
+    shell: boolean;
+    risk: 'high' | 'not_high' | 'unknown';
+}): boolean;
 export declare function runPreActionHookCommand(input?: unknown): Promise<void>;
 //# sourceMappingURL=hook-pre-action.d.ts.map

package/dist/hook-pre-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook-pre-action.d.ts","sourceRoot":"","sources":["../src/hook-pre-action.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAgB,iBAAiB,EAAgC,MAAM,SAAS,CAAC;AAK5G,OAAO,EAsBL,KAAK,QAAQ,EAEd,MAAM,iBAAiB,CAAC;AAiBzB,OAAO,EASL,qBAAqB,EAGtB,MAAM,iBAAiB,CAAC;AACzB,gJAAgJ;AAChJ,eAAO,MAAM,WAAW,sKAAsK,CAAC;AAE/L,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAIjC,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAI1D,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAmBnD,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,qBAAqB;;CAMnC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ7D;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,KAAK,WAAW,GAAG,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;AAEhH,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,yEAAyE,CAAC;AACxG,iGAAiG;AACjG,eAAO,MAAM,cAAc,iFAAiF,CAAC;AAC7G,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,0CAA0C,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,QAAQ,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA4BhC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKxG;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhH;AAWD,KAAK,sBAAsB,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,GAAG,IAAI,CAAC;IAC/D,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7D,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAAC;IAC7C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAEtE;AASD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAIpF;AA+BD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBhF;AASD,MAAM,MAAM,mBAAmB,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,8EAA8E;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAUrM;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,EACrG,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,gBAAgB,CAAC,EAClE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,mBAAmB,CAsBrB;AAED,KAAK,WAAW,GAAG;IAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAyBlG;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,OAAO,CAwBvF;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,OAAO,CAEvF;AAQD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,CAO5F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,IAAI,CAYjG;AAGD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,mBAAqC,GAAG,MAAM,CAW7H;AAID,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAM7K;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,EACrG,MAAM,EAAE,MAAM,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAOhC;AAyCD,wBAAgB,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAqDA;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBjG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBhG;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAU7G;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAUzH;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAOvH;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAA4B,EACrH,MAAM,GAAE,mBAAqC;AAC7C,qGAAqG;AACrG,gBAAgB,UAAQ,GACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoEzB;AA2BD,KAAK,YAAY,GAAG;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAGhF,eAAO,MAAM,gCAAgC,OAAQ,CAAC;AAEtD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CA4BlB;AAkCD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAM9G;AA0CD,wBAAgB,oBAAoB,CAAC,QAAQ,SAAgB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAgB3G;AAED,wBAAsB,uBAAuB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0c5E"}
+{"version":3,"file":"hook-pre-action.d.ts","sourceRoot":"","sources":["../src/hook-pre-action.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAgB,iBAAiB,EAAgC,MAAM,SAAS,CAAC;AAK5G,OAAO,EAsBL,KAAK,QAAQ,EAEd,MAAM,iBAAiB,CAAC;AAkBzB,OAAO,EASL,qBAAqB,EAItB,MAAM,iBAAiB,CAAC;AACzB,gJAAgJ;AAChJ,eAAO,MAAM,WAAW,sKAAsK,CAAC;AAC/L,wIAAwI;AACxI,eAAO,MAAM,mBAAmB,iHAAiH,CAAC;AAClJ,8IAA8I;AAC9I,eAAO,MAAM,sBAAsB,sLAAsL,CAAC;AAI1N,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAIjC,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAI1D,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAmBnD,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,qBAAqB;;CAMnC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ7D;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,KAAK,WAAW,GAAG,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;AAEhH,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,yEAAyE,CAAC;AACxG,iGAAiG;AACjG,eAAO,MAAM,cAAc,iFAAiF,CAAC;AAC7G,wHAAwH;AACxH,eAAO,MAAM,iBAAiB,sIAAsI,CAAC;AACrK,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,0CAA0C,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,QAAQ,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA4BhC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKxG;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhH;AAWD,KAAK,sBAAsB,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,GAAG,IAAI,CAAC;IAC/D,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7D,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAAC;IAC7C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAEtE;AASD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAIpF;AA+BD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,sBAAsB,CAAC,SAAS,CAA6B,GAAG,MAAM,CAkBrJ;AASD,MAAM,MAAM,mBAAmB,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,8EAA8E;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAUrM;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,EACrG,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,gBAAgB,CAAC,EAClE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,mBAAmB,CAsBrB;AAED,KAAK,WAAW,GAAG;IAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAyBlG;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,OAAO,CAwBvF;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,OAAO,CAEvF;AAQD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,CAO5F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,IAAI,CAYjG;AAGD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,mBAAqC,GAAG,MAAM,CAW7H;AAID,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAM7K;AAID,4HAA4H;AAC5H,eAAO,MAAM,kBAAkB,0aAAwa,CAAC;AACxc,eAAO,MAAM,6BAA6B,2FAA2F,CAAC;AACtI,eAAO,MAAM,8BAA8B,6IAA6I,CAAC;AAEzL;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,EACrG,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,EACrG,MAAM,EAAE,MAAM,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAShC;AAyCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAsDA;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBjG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BhG;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAU7G;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAUzH;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAOvH;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,YAA4B,EACrH,MAAM,GAAE,mBAAqC;AAC7C,qGAAqG;AACrG,gBAAgB,UAAQ,GACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoEzB;AA2BD,KAAK,YAAY,GAAG;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAGhF,eAAO,MAAM,gCAAgC,OAAQ,CAAC;AAEtD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CA4BlB;AAkCD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAM9G;AA0CD,wBAAgB,oBAAoB,CAAC,QAAQ,SAAgB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAgB3G;AAKD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,kBAAkB,EAAE,OAAO,EAC3B,IAAI,EAAE,MAAM;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,GACpE,OAAO,CAMT;AAWD,wBAAsB,uBAAuB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5E"}

package/dist/hook-pre-action.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DENIED_DECISION_CLOSE_TIMEOUT_MS = exports.GROK_FIXED_DENIAL = exports.HELD_SLOW_TEXT = exports.HOLD_OWNER_DENIAL = exports.PreActionControlTimeoutError = exports.PRE_ACTION_CONTROL_TIMEOUT_MS = exports.MAX_PRE_ACTION_INPUT_BYTES = exports.MARROW_OUTAGE_WARNING = exports.NO_KEY_TEXT = void 0;
+exports.DENIED_DECISION_CLOSE_TIMEOUT_MS = exports.SEATBELT_CURSOR_ASK_AGENT_TEXT = exports.SEATBELT_CURSOR_ASK_USER_TEXT = exports.SEATBELT_HELD_TEXT = exports.GROK_FIXED_DENIAL = exports.HELD_OFFLINE_TEXT = exports.HELD_SLOW_TEXT = exports.HOLD_OWNER_DENIAL = exports.PreActionControlTimeoutError = exports.PRE_ACTION_CONTROL_TIMEOUT_MS = exports.MAX_PRE_ACTION_INPUT_BYTES = exports.MARROW_OUTAGE_WARNING = exports.SETUP_UNCONFIRMED_TEXT = exports.CLAIMED_NO_KEY_TEXT = exports.NO_KEY_TEXT = void 0;
 exports.isMarrowControlTimeout = isMarrowControlTimeout;
 exports.isMarrowControlOutage = isMarrowControlOutage;
 exports.heldActionHookOutput = heldActionHookOutput;
@@ -16,6 +16,7 @@ exports.advisoryGateNotice = advisoryGateNotice;
 exports.runtimeGateVerdict = runtimeGateVerdict;
 exports.gateDecisionMessage = gateDecisionMessage;
 exports.localControlAllowOutput = localControlAllowOutput;
+exports.seatbeltPassOutput = seatbeltPassOutput;
 exports.localLoopGuardDenyOutput = localLoopGuardDenyOutput;
 exports.classifyTool = classifyTool;
 exports.cursorPreActionHookOutput = cursorPreActionHookOutput;
@@ -27,6 +28,7 @@ exports.preActionHookOutput = preActionHookOutput;
 exports.closeDeniedDecision = closeDeniedDecision;
 exports.localApprovalCategories = localApprovalCategories;
 exports.installPreActionHook = installPreActionHook;
+exports.outageHolds = outageHolds;
 exports.runPreActionHookCommand = runPreActionHookCommand;
 const node_crypto_1 = require("node:crypto");
 const index_1 = require("./index");
@@ -36,6 +38,7 @@ const control_state_1 = require("./control-state");
 const runtime_contract_1 = require("./runtime-contract");
 const host_approval_1 = require("./host-approval");
 const host_session_1 = require("./host-session");
+const own_server_identity_1 = require("./own-server-identity");
 const normalized_action_1 = require("./normalized-action");
 const session_loop_guard_1 = require("./session-loop-guard");
 const hook_tool_policy_1 = require("./hook-tool-policy");
@@ -43,6 +46,12 @@ const hook_contract_1 = require("./hook-contract");
 Object.defineProperty(exports, "MARROW_OUTAGE_WARNING", { enumerable: true, get: function () { return hook_contract_1.MARROW_OUTAGE_WARNING; } });
 /** A protected action with no Marrow key anywhere this machine keeps one (MARROW_API_KEY, ~/.marrow/env.local or ~/.marrow/env, owner-only). */
 exports.NO_KEY_TEXT = 'Marrow has no API key on this machine. Owner: create one at getmarrow.ai/signup, then run the installer activate command in a terminal. Do not retry this action.';
+/** Seatbelt mode `claimed_no_key` (spec §1.1): account evidence on the machine but no usable key. Same text as src/seatbelt/hook.ts. */
+exports.CLAIMED_NO_KEY_TEXT = 'Marrow is linked to an account but has no working key; owner: run `npx -y @getmarrow/install@latest doctor`.';
+/** `claimed_no_key` without account evidence (a mode fallback): the same holds, never an account claim. Same text as src/seatbelt/hook.ts. */
+exports.SETUP_UNCONFIRMED_TEXT = 'Marrow has no working key on this machine and its keyless mode is off here (strict mode, or a home folder it cannot trust); owner: run `npx -y @getmarrow/install@latest doctor`.';
+/** The seatbelt path itself could not run (its modules did not load): a stop (spec §2.1.4). */
+const SEATBELT_FAILED_TEXT = 'MARROW SEATBELT stopped this action: a safety check that could not finish (U5.fail_closed, hook_error). This needs the machine owner. Do not retry it another way or edit Marrow settings.';
 // Claude Code sends the whole tool input, and a Write of a long document grows
 // further once JSON-escaped, so tens of kilobytes of markdown must still parse.
 exports.MAX_PRE_ACTION_INPUT_BYTES = 4 * 1024 * 1024;
@@ -107,6 +116,8 @@ function isMarrowControlOutage(error) {
 exports.HOLD_OWNER_DENIAL = 'Marrow is holding this action for approval. Retry it after approval.';
 /** Marrow did not answer within the hook's time limit: an action that can be held stays held. */
 exports.HELD_SLOW_TEXT = 'Marrow did not answer in time, so this action is held. Retry it in a moment.';
+/** Marrow cannot be reached (a real outage): a high-risk action fails closed; routine actions keep the outage allow. */
+exports.HELD_OFFLINE_TEXT = 'Marrow cannot be reached right now, so this high-risk action is held; routine actions keep running. Retry it when Marrow is back.';
 /** The only denial @getmarrow/install's Grok guard passes through (any other output blocks with a launch failure). */
 exports.GROK_FIXED_DENIAL = 'Marrow blocked this protected action.';
 /**
@@ -231,7 +242,7 @@ function plainControlFix(error) {
 }
 // Names a reached control failure by HTTP status and stable failure code, with a plain
 // fix (see plainControlFix); private service text is never echoed into the agent transcript.
-function controlRejectionMessage(error, agentId) {
+function controlRejectionMessage(error, agentId, kind = controlFailureKind(error)) {
     const detail = [];
     if (error instanceof request_reliability_1.MarrowRequestError) {
         if (typeof error.status === 'number' && Number.isInteger(error.status))
@@ -241,7 +252,6 @@ function controlRejectionMessage(error, agentId) {
             detail.push(code);
     }
     const suffix = detail.length ? ` (${detail.join(' ')})` : '';
-    const kind = controlFailureKind(error);
     if (kind === 'credential_scope') {
         const agent = agentId && SAFE_AGENT_ID.test(agentId)
             ? `agent "${agentId}"`
@@ -410,6 +420,46 @@ function localControlAllowOutput(harness) {
         return { decision: 'allow' };
     return {};
 }
+/** The Cursor events where Cursor enforces "ask" with its own approval prompt (the installer's execution hooks). */
+const CURSOR_ASK_EVENTS = new Set(['beforeShellExecution', 'beforeMCPExecution']);
+/** Keyless seatbelt: a host that cannot hand this action to its own approval prompt holds it (no account to approve it). */
+exports.SEATBELT_HELD_TEXT = 'MARROW SEATBELT held this action: this host cannot hand it to its own approval prompt here, and no Marrow account is linked to approve it. This needs the machine owner. Do not retry it another way or edit Marrow settings. Tell the owner: run it yourself in your own terminal, or link a Marrow account with "npx -y @getmarrow/install@latest activate" (it needs MARROW_API_KEY set first) so these become approval prompts.';
+exports.SEATBELT_CURSOR_ASK_USER_TEXT = 'Marrow seatbelt (no account linked): approve this action here only if you expected it.';
+exports.SEATBELT_CURSOR_ASK_AGENT_TEXT = 'Cursor is asking the user to approve this action (Marrow seatbelt, no account linked). Wait for the answer; do not retry it another way.';
+/**
+ * The keyless seatbelt's answer for an action it does not stop (spec §1.3 "pass": Marrow adds no
+ * decision and the host's own permission flow runs). `heldBefore`: the 3.9.103 keyless hook held this
+ * action (protected, or not read-only on Windsurf, Gemini or Grok). `null` means exit 0, no output.
+ * - Not held before: exactly the answer 3.9.103 gave (its read-only and unprotected passes).
+ * - Held before: never an explicit allow that could skip the host's own approval step.
+ *   Claude Code and Codex `{}` (no permissionDecision), Cline `{cancel:false}`, Windsurf no output:
+ *   the hosts' neutral answers (see PASS_THROUGH_HOSTS), so their own approval step runs.
+ *   Gemini CLI `{"decision":"allow"}`: the installed guard passes only that or a fixed denial (no
+ *   output is a launch failure that blocks), and Gemini applies its own policy and confirmation
+ *   after the BeforeTool hook whatever an "allow" says, so it is Gemini's neutral answer.
+ *   Cursor beforeShellExecution / beforeMCPExecution: "ask", so Cursor's own approval prompt decides.
+ *   Cursor preToolUse (no neutral answer, "ask" not enforced) and Grok (its guard passes only an
+ *   explicit allow or the fixed denial, and nothing shows an allow keeps Grok's own approval): held,
+ *   as 3.9.103 did. Any other or missing Cursor event name is treated as preToolUse.
+ */
+function seatbeltPassOutput(harness, hookEventName, heldBefore) {
+    if (!heldBefore)
+        return localControlAllowOutput(harness);
+    if (harness === 'windsurf')
+        return null;
+    if (harness === 'cline')
+        return { cancel: false };
+    if (harness === 'gemini')
+        return { decision: 'allow' };
+    if (harness === 'grok')
+        return { decision: 'deny', reason: exports.GROK_FIXED_DENIAL };
+    if (harness === 'cursor') {
+        return typeof hookEventName === 'string' && CURSOR_ASK_EVENTS.has(hookEventName)
+            ? { permission: 'ask', user_message: exports.SEATBELT_CURSOR_ASK_USER_TEXT, agent_message: exports.SEATBELT_CURSOR_ASK_AGENT_TEXT }
+            : { permission: 'deny', user_message: exports.SEATBELT_HELD_TEXT, agent_message: exports.SEATBELT_HELD_TEXT };
+    }
+    return {};
+}
 function localLoopGuardDenyOutput(harness, reason) {
     const bounded = reason.replace(/[\u0000-\u001f\u007f]/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 500);
     if (harness === 'windsurf')
@@ -418,7 +468,10 @@ function localLoopGuardDenyOutput(harness, reason) {
         return { permission: 'deny', user_message: bounded, agent_message: bounded };
     if (harness === 'cline')
         return { cancel: true, errorMessage: bounded };
-    if (harness === 'gemini' || harness === 'grok')
+    // The installed Grok guard passes only an allow or this fixed denial; any other text is its launch failure (audit M1).
+    if (harness === 'grok')
+        return { decision: 'deny', reason: exports.GROK_FIXED_DENIAL };
+    if (harness === 'gemini')
         return { decision: 'deny', reason: bounded };
     return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: bounded } };
 }
@@ -456,7 +509,13 @@ function localControlDisabled() {
         return false;
     }
 }
-function classifyTool(event) {
+/**
+ * `ownUnproven`: the label is one of Marrow's own, but the host's server
+ * identity check did not prove the official server (Codex, Cursor). Such a
+ * call is classified as a protected MCP tool of another server, never
+ * read-only (it imitates Marrow's names, so a read verb proves nothing).
+ */
+function classifyTool(event, options = {}) {
     const tool = String(event.tool_name || 'tool').slice(0, 64);
     const normalizedTool = (0, hook_tool_policy_1.normalizeHookToolName)(tool);
     // Editing and task tools are judged by their target; shell-like words in the
@@ -464,7 +523,8 @@ function classifyTool(event) {
     const shellGoverned = (0, hook_tool_policy_1.isShellGovernedTool)(event);
     const command = shellGoverned ? (0, hook_tool_policy_1.hookToolCommand)(event) : '';
     const input = (0, hook_tool_policy_1.toolClassificationText)(event).toLowerCase();
-    const readOnly = (0, hook_tool_policy_1.isReadOnlyToolEvent)(event);
+    // A look-alike of Marrow's own tool is never read-only, whatever its verb.
+    const readOnly = options.ownUnproven !== true && (0, hook_tool_policy_1.isReadOnlyToolEvent)(event);
     const secretAccess = (0, hook_tool_policy_1.isSecretMaterialAccess)(event);
     const protectedShellCommand = shellGoverned && (0, hook_tool_policy_1.isProtectedShellMutation)(command);
     const infrastructureDeployment = /\b(?:kubectl|terraform|pulumi|helm)\b/.test(command.toLowerCase())
@@ -493,7 +553,7 @@ function classifyTool(event) {
     const protectedAction = !readOnly && (secretAccess
         || (shellGoverned && /\b(?:deploy|release|publish|git\s+push|git\s+merge|gh\s+pr\s+merge|migration|migrate|secret|credential|rotate|revoke|payment|refund|charge|invoice|production|prod)\b/.test(input))
         || protectedShellCommand
-        || ((0, hook_tool_policy_1.isMcpHookTool)(event.tool_name) && !(0, hook_tool_policy_1.isOfficialMarrowMcpTool)(event.tool_name))
+        || ((0, hook_tool_policy_1.isMcpHookTool)(event.tool_name) && (options.ownUnproven === true || !(0, hook_tool_policy_1.isOfficialMarrowMcpTool)(event.tool_name)))
         || (['use_mcp_tool', 'use_tool'].includes(normalizedTool) && !(0, hook_tool_policy_1.isOfficialMarrowMcpEvent)(event)));
     const risk = readOnly ? 'low' : protectedAction ? 'high' : 'medium';
     const target = surfaces.includes('npm') ? `npm:${type}`
@@ -548,11 +608,12 @@ function clinePreActionHookOutput(result) {
         };
     }
     if (result.protectedRisk && (!result.runtime || !result.permit?.verified)) {
-        const credentialsUnavailable = result.enforcementError === exports.NO_KEY_TEXT;
+        const credentialsUnavailable = result.enforcementError === exports.NO_KEY_TEXT || result.enforcementError === exports.CLAIMED_NO_KEY_TEXT
+            || result.enforcementError === exports.SETUP_UNCONFIRMED_TEXT;
         return {
             cancel: true,
             errorMessage: credentialsUnavailable
-                ? exports.NO_KEY_TEXT
+                ? result.enforcementError
                 : result.failure === 'credential_scope'
                     ? 'This Marrow API key is not authorized to obtain action permits for this agent. Use the API key issued to this agent and retry.'
                     : result.failure === 'unavailable'
@@ -828,11 +889,54 @@ function installPreActionHook(startDir = process.cwd()) {
     fs.writeFileSync(path, JSON.stringify(settings, null, 2) + '\n');
     return { settingsPath: path, installed: reconciled.changed };
 }
+/**
+ * I3: whether a real outage (the gate never answered) holds this action. Never looser than master,
+ * which allowed every action in an outage. A shell command is read by the seatbelt mapper: held for an
+ * S0-S5/S-x hit or a program on the outage list (git push, publish, deploy, remote delete), allowed
+ * when the mapper read all of it and found neither (words in a message, a path or a comment never hold
+ * it). Anything else, or a mapper that could not finish, keeps `classifiedHighRisk` (F2).
+ */
+function outageHolds(classifiedHighRisk, read) {
+    let reading = { shell: false, risk: 'unknown' };
+    try {
+        reading = read();
+    }
+    catch { /* unknown: the classifier's answer */ }
+    if (reading.risk === 'high')
+        return true;
+    if (reading.shell && reading.risk === 'not_high')
+        return false;
+    return classifiedHighRisk;
+}
+function seatbeltEvent(source, rawEvent) {
+    const raw = asRecord(rawEvent) || {};
+    const event = source;
+    return {
+        tool_name: source.tool_name, tool_input: source.tool_input, cwd: event.cwd ?? raw.cwd, truncated: event.input_truncated === true,
+        session: source.session_id || source.conversation_id || source.task_id || undefined,
+    };
+}
 async function runPreActionHookCommand(input) {
+    // Account mode: the S0-S5 floor in watch runs after the answer is written, for the record only.
+    const watch = {};
+    try {
+        await runPreActionHook(input, watch);
+    }
+    finally {
+        if (watch.harness && watch.event) {
+            try {
+                require('./seatbelt/hook').accountFloor(watch.harness, watch.event, (0, host_approval_1.preToolDeadline)((0, host_approval_1.approvalHostFor)(watch.harness)));
+            }
+            catch { /* watch never changes the answer */ }
+        }
+    }
+}
+async function runPreActionHook(input, watch) {
     if (process.env.MARROW_AUTO_HOOK === 'false')
         return;
     const identity = (0, hook_contract_1.resolveNativeHookIdentity)(process.argv[2]);
     let event = input;
+    let rawEvent = input;
     let inputFailure = null;
     if (event === undefined) {
         try {
@@ -842,7 +946,8 @@ async function runPreActionHookCommand(input) {
             }
             else {
                 const raw = stdin.raw.trim();
-                event = raw ? (0, hook_contract_1.normalizeHookEventPayload)(JSON.parse(raw)) : {};
+                rawEvent = raw ? JSON.parse(raw) : {};
+                event = (0, hook_contract_1.normalizeHookEventPayload)(rawEvent);
             }
         }
         catch {
@@ -865,7 +970,7 @@ async function runPreActionHookCommand(input) {
         emitDecision({ runtime: null, permit: null, protectedRisk: true, enforcementError: inputFailure || 'Marrow could not classify this mutation-capable tool request.' }, identity.harness);
         return;
     }
-    if ((0, hook_tool_policy_1.isOfficialMarrowMcpEvent)(source)) {
+    if ((0, own_server_identity_1.isOfficialMarrowMcpEventOnHost)(identity.harness, source, rawEvent)) {
         if (identity.harness === 'windsurf') {
             process.exitCode = 0;
             return;
@@ -876,7 +981,7 @@ async function runPreActionHookCommand(input) {
                     : {}));
         return;
     }
-    const classified = classifyTool(source);
+    const classified = classifyTool(source, { ownUnproven: (0, hook_tool_policy_1.isOfficialMarrowMcpEvent)(source) });
     let localControl;
     try {
         localControl = (0, control_state_1.readLocalControlState)();
@@ -962,6 +1067,55 @@ async function runPreActionHookCommand(input) {
         emitLoopGuardDenial(identity.harness, loopDecision.reason || `Marrow local loop guard blocked this unchanged repeat. Receipt: ${loopDecision.receipt}.`);
         return;
     }
+    // No usable key: the seatbelt decides first (spec §1.1), before the read-only pass so S4 reads stop.
+    // `seatbelt` answers here with no network call; `claimed_no_key` stops S0-S5 here and keeps the holds below.
+    // Whether a keyless hold may say "linked to an account" (only with account evidence, never for a mode fallback).
+    let keylessAccountLinked = false;
+    // The keyless hold text when the seatbelt does not answer: master's no-key text in seatbelt mode (a
+    // tool the mapper does not recognise, audit H1), the claimed_no_key texts otherwise.
+    let keylessSeatbeltMode = false;
+    if (!resolved.apiKey) {
+        let keyless;
+        try {
+            keyless = require('./seatbelt/hook').keylessSeatbelt(identity.harness, seatbeltEvent(source, rawEvent));
+        }
+        catch {
+            keyless = { mode: 'claimed_no_key', stopText: SEATBELT_FAILED_TEXT };
+        }
+        keylessAccountLinked = keyless.accountLinked === true;
+        keylessSeatbeltMode = keyless.mode === 'seatbelt';
+        if (keyless.stopText) {
+            emitLoopGuardDenial(identity.harness, keyless.stopText);
+            return;
+        }
+        // A tool the mapper does not recognise never gets the seatbelt pass: master's answer below.
+        if (keyless.mode === 'seatbelt' && keyless.recognized === true) {
+            // Never an explicit allow for an action 3.9.103 held: the host's own approval step decides.
+            const answer = seatbeltPassOutput(identity.harness, source.hook_event_name, !classified.readOnly && enforcementRequired);
+            if (answer === null)
+                process.exitCode = 0;
+            else
+                process.stdout.write(JSON.stringify(answer));
+            return;
+        }
+    }
+    else {
+        watch.harness = identity.harness;
+        watch.event = seatbeltEvent(source, rawEvent);
+        let floor = null;
+        try {
+            floor = require('./seatbelt/hook');
+        }
+        catch { /* watch only: a missing module never changes the account flow */ }
+        if (floor && floor.SEATBELT_ROLLOUT.account_floor === 'on') {
+            watch.harness = undefined;
+            const stopText = floor.accountFloor(identity.harness, watch.event, (0, host_approval_1.preToolDeadline)((0, host_approval_1.approvalHostFor)(identity.harness)));
+            if (stopText) {
+                emitLoopGuardDenial(identity.harness, stopText);
+                return;
+            }
+        }
+    }
     if (classified.readOnly) {
         const allow = localControlAllowOutput(identity.harness);
         if (allow === null)
@@ -988,7 +1142,7 @@ async function runPreActionHookCommand(input) {
             runtime: null,
             permit: null,
             protectedRisk: enforcementRequired,
-            enforcementError: exports.NO_KEY_TEXT,
+            enforcementError: keylessSeatbeltMode ? exports.NO_KEY_TEXT : keylessAccountLinked ? exports.CLAIMED_NO_KEY_TEXT : exports.SETUP_UNCONFIRMED_TEXT,
         }, identity.harness);
         return;
     }
@@ -1017,7 +1171,9 @@ async function runPreActionHookCommand(input) {
     }
     // The same action retried after a hold that waited for approval: its status decides.
     const dialogAvailable = holdContext.host === 'claude-code' && ownerApprovalPrompt(identity.harness, source).available;
-    const waited = await (0, host_approval_1.resumeWaitingHold)(holdContext, { correlation, toolUseId, generationId, dialogAvailable }).catch(() => null);
+    // The exact target (not only the correlation) binds a hold's approval to this call.
+    const target = (0, hook_contract_1.exactHookTarget)(source);
+    const waited = await (0, host_approval_1.resumeWaitingHold)(holdContext, { correlation, target, toolUseId, generationId, dialogAvailable }).catch(() => null);
     if (waited?.kind === 'allow') {
         emitHookOutput(identity.harness, approvedHoldHookOutput(identity.harness, waited.contextText));
         await afterAnswer(holdContext, {});
@@ -1056,6 +1212,11 @@ async function runPreActionHookCommand(input) {
     });
     // The decision and gate receipt this control path holds, so a denial can close them.
     const held = { decisionId: null, gateReceiptId: null };
+    // Set once the runtime gate has answered. A later network or 5xx failure (decision, permit issue
+    // or verify) on a high-risk action is a reached answer that no permit can be had: a denial, never
+    // "offline, allowed". Routine actions keep the outage policy (failure_mode low_risk_behavior).
+    const reach = { gateAnswered: false };
+    const highRisk = classified.protected || classified.risk === 'high';
     const control = async (signal) => {
         const runtime = await (0, index_1.marrowAgentRuntime)(resolved.apiKey, baseUrl, {
             action: classified.action,
@@ -1070,6 +1231,7 @@ async function runPreActionHookCommand(input) {
             // non-durable fast_gate receipt can never back an action permit.
             ...(enforcementRequired ? { risk_level: classified.risk } : {}),
         }, sessionId, agentId, signal);
+        reach.gateAnswered = true;
         const heldIds = [...new Set([runtime.decision_id, runtime.completion_contract?.decision_id, runtime.runtime_authorization?.decision_id]
                 .filter((value) => typeof value === 'string' && SAFE_DECISION_ID.test(value)))];
         held.decisionId = heldIds.length === 1 ? heldIds[0] : null;
@@ -1171,7 +1333,7 @@ async function runPreActionHookCommand(input) {
                 timedOut: true,
                 enforcementError: hook_contract_1.MARROW_OUTAGE_WARNING,
             }
-            : isMarrowControlOutage(error)
+            : isMarrowControlOutage(error) && !(reach.gateAnswered && highRisk)
                 ? {
                     runtime: null,
                     permit: null,
@@ -1179,13 +1341,21 @@ async function runPreActionHookCommand(input) {
                     outage: true,
                     enforcementError: hook_contract_1.MARROW_OUTAGE_WARNING,
                 }
-                : {
-                    runtime: null,
-                    permit: null,
-                    protectedRisk: enforcementRequired,
-                    enforcementError: controlRejectionMessage(error, agentId),
-                    ...(controlFailureKind(error) ? { failure: controlFailureKind(error) } : {}),
-                })),
+                : isMarrowControlOutage(error)
+                    ? {
+                        runtime: null,
+                        permit: null,
+                        protectedRisk: enforcementRequired,
+                        enforcementError: controlRejectionMessage(error, agentId, 'unavailable'),
+                        failure: 'unavailable',
+                    }
+                    : {
+                        runtime: null,
+                        permit: null,
+                        protectedRisk: enforcementRequired,
+                        enforcementError: controlRejectionMessage(error, agentId),
+                        ...(controlFailureKind(error) ? { failure: controlFailureKind(error) } : {}),
+                    })),
         lifecycle,
     ]);
     const claudePrompt = ownerApprovalPrompt(identity.harness, source);
@@ -1203,12 +1373,17 @@ async function runPreActionHookCommand(input) {
     }
     if (result.outage) {
         // Marrow cannot be reached. An action in a category the account owner
-        // protects stays held on every host; everything else keeps the outage policy.
+        // protects stays held on every host; a high-risk action fails closed (high-risk
+        // work needs a fresh gate); routine actions keep the outage policy.
         const protectedNow = (0, host_approval_1.protectedAmong)(holdContext, localApprovalCategories(classified));
         if (protectedNow.length) {
             emitHeldPlan(identity.harness, { kind: 'deny', agentText: host_approval_1.HELD_UNREACHABLE_TEXT, userText: host_approval_1.HELD_UNREACHABLE_TEXT, code: false });
             return;
         }
+        if (outageHolds(highRisk, () => require('./seatbelt/hook').outageRisk(seatbeltEvent(source, rawEvent), holdContext.deadlineAt ?? Number.POSITIVE_INFINITY))) {
+            emitHeldPlan(identity.harness, { kind: 'deny', agentText: exports.HELD_OFFLINE_TEXT, userText: exports.HELD_OFFLINE_TEXT, code: false });
+            return;
+        }
     }
     const verdict = result.outage ? null : runtimeGateVerdict(result.runtime);
     const guidance = verdict?.kind === 'review' ? (0, runtime_contract_1.ordinaryApprovalGuidance)(result.runtime) : null;
@@ -1258,6 +1433,7 @@ async function runPreActionHookCommand(input) {
             const hold = plan.kind === 'deny' && plan.retryFresh ? null : (0, host_approval_1.rememberHold)(holdContext, {
                 guidance: guidance || (0, host_approval_1.arbitrationHoldGuidance)(arbitration),
                 correlation,
+                target,
                 toolUseId,
                 generationId,
                 toolName: String(source.tool_name || 'tool'),