@getmarrow/mcp 3.9.102 → 3.9.106

package/dist/keyless-server.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Keyless start of the MCP server. With no Marrow key anywhere the server reads
+ * one, the server used to print "MARROW_API_KEY environment variable is
+ * required" and exit 1, which hosts show as a broken server. It now answers the
+ * MCP protocol with zero tools and an `instructions` string that says how the
+ * owner connects a key.
+ *
+ * Fail closed: keylessStart is true only for a clear "no key". A key, anything
+ * key-shaped, a refused owner key file, a base URL the server would refuse, or
+ * any doubt runs the real server path exactly as before.
+ *
+ * The keyless server judges, checks and records nothing. It starts no child
+ * process, opens no network and no file, reads no environment, and writes only
+ * to stdout and stderr. Hooks are separate entrypoints and are not touched.
+ * Protocol handling matches the plugin launcher's keyless stub
+ * (marrow-plugins plugins/<plugin>/scripts/marrow-launch.cjs, serveKeyless).
+ *
+ * Never looser than the exit 1 it replaces: until a valid `initialize` request has
+ * been answered, a frame that is not JSON-RPC 2.0 (a Cursor or Claude hook payload
+ * piped to the entry, a parse error, an oversize line) or an end of stdin ends the
+ * process with the no-key refusal on stderr, nothing on stdout, and exit 1. After
+ * an initialize, the end of stdin is exit 0.
+ *
+ * The key text (URL, activate command, plugin steps, the refusal) is owned by cli.ts
+ * and passed in; this file holds no second copy of it.
+ */
+export interface KeylessInstructionParts {
+    getKeyUrl: string;
+    activateCommand: string;
+    /** Set when the server runs under the Claude Code plugin: its key steps replace the activate command. */
+    pluginSteps?: string;
+}
+/** The `instructions` string of the initialize answer. */
+export declare function keylessInstructions(parts: KeylessInstructionParts): string;
+export interface KeylessTexts {
+    instructions: string;
+    /** Written to stderr once, when the first initialize is answered. */
+    notice: string;
+    /** The server's own no-key refusal, written to stderr before the exit 1 that a non-MCP first frame or an early end of stdin gets. */
+    refusal: string;
+}
+export declare const KEYLESS_NOTICE = "Marrow: no Marrow key on this machine, so the Marrow MCP server started with no tools. Marrow hooks, where they are set up, keep their free keyless seatbelt.";
+/**
+ * Whether the MCP server starts keyless. `resolved` must be the server's own resolveMarrowEnv() result.
+ * True only when it found no key (an empty MARROW_API_KEY or MARROW_KEY counts as none, a whitespace one does
+ * not), no owner key file was refused, no `--key` argument is given in any form, no fleet key
+ * (MARROW_KEY_<SUFFIX>) is set, and the base URL passes the server's own check.
+ */
+export declare function keylessStart(resolved: unknown, argv: readonly unknown[], env: Record<string, string | undefined>): boolean;
+export declare function keylessProtocolVersion(params: unknown): string;
+/** Newline-delimited JSON-RPC 2.0 on stdio with zero tools. Exits 0 when stdin ends after an initialize, 1 for a non-MCP start. */
+export declare function serveKeylessMcp(serverVersion: string, texts: KeylessTexts): void;
+//# sourceMappingURL=keyless-server.d.ts.map

package/dist/keyless-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-server.d.ts","sourceRoot":"","sources":["../src/keyless-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAS1E;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,qIAAqI;IACrI,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,cAAc,kKAAkK,CAAC;AAQ9L;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAe1H;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO9D;AAED,mIAAmI;AACnI,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAyHhF"}

package/dist/keyless-server.js

@@ -0,0 +1,230 @@
+"use strict";
+/**
+ * Keyless start of the MCP server. With no Marrow key anywhere the server reads
+ * one, the server used to print "MARROW_API_KEY environment variable is
+ * required" and exit 1, which hosts show as a broken server. It now answers the
+ * MCP protocol with zero tools and an `instructions` string that says how the
+ * owner connects a key.
+ *
+ * Fail closed: keylessStart is true only for a clear "no key". A key, anything
+ * key-shaped, a refused owner key file, a base URL the server would refuse, or
+ * any doubt runs the real server path exactly as before.
+ *
+ * The keyless server judges, checks and records nothing. It starts no child
+ * process, opens no network and no file, reads no environment, and writes only
+ * to stdout and stderr. Hooks are separate entrypoints and are not touched.
+ * Protocol handling matches the plugin launcher's keyless stub
+ * (marrow-plugins plugins/<plugin>/scripts/marrow-launch.cjs, serveKeyless).
+ *
+ * Never looser than the exit 1 it replaces: until a valid `initialize` request has
+ * been answered, a frame that is not JSON-RPC 2.0 (a Cursor or Claude hook payload
+ * piped to the entry, a parse error, an oversize line) or an end of stdin ends the
+ * process with the no-key refusal on stderr, nothing on stdout, and exit 1. After
+ * an initialize, the end of stdin is exit 0.
+ *
+ * The key text (URL, activate command, plugin steps, the refusal) is owned by cli.ts
+ * and passed in; this file holds no second copy of it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYLESS_NOTICE = void 0;
+exports.keylessInstructions = keylessInstructions;
+exports.keylessStart = keylessStart;
+exports.keylessProtocolVersion = keylessProtocolVersion;
+exports.serveKeylessMcp = serveKeylessMcp;
+const index_1 = require("./index");
+/** The `instructions` string of the initialize answer. */
+function keylessInstructions(parts) {
+    const connect = parts.pluginSteps
+        ? `To connect a Marrow account, the owner follows these steps. ${parts.pluginSteps} `
+        : `To connect a Marrow account, the owner creates a key at ${parts.getKeyUrl} and runs ${parts.activateCommand} in their own terminal, then restarts this agent host. `;
+    return 'This Marrow server started without a Marrow key on this machine, so it has no tools. '
+        + 'It does not judge, check or record any action. '
+        + (parts.pluginSteps ? '' : 'Marrow hooks, where they are set up on this machine, are separate from this server and keep their free keyless seatbelt; this server does not show whether any are set up. ')
+        + connect
+        + 'A key can not be added from this chat.';
+}
+exports.KEYLESS_NOTICE = 'Marrow: no Marrow key on this machine, so the Marrow MCP server started with no tools. Marrow hooks, where they are set up, keep their free keyless seatbelt.';
+// The real server's protocolVersion rule (cli.ts noteClientCapabilities): the requested version only when it is one
+// of these AND the client's capabilities.elicitation is an object; every other input gets 2024-11-05.
+const ELICITATION_PROTOCOL_VERSIONS = ['2025-06-18', '2025-11-25'];
+const DEFAULT_PROTOCOL_VERSION = '2024-11-05';
+const MAX_LINE_BYTES = 1024 * 1024;
+/**
+ * Whether the MCP server starts keyless. `resolved` must be the server's own resolveMarrowEnv() result.
+ * True only when it found no key (an empty MARROW_API_KEY or MARROW_KEY counts as none, a whitespace one does
+ * not), no owner key file was refused, no `--key` argument is given in any form, no fleet key
+ * (MARROW_KEY_<SUFFIX>) is set, and the base URL passes the server's own check.
+ */
+function keylessStart(resolved, argv, env) {
+    try {
+        if (argv.some((arg) => typeof arg !== 'string' || arg.startsWith('--key')))
+            return false;
+        if (resolved === null || typeof resolved !== 'object')
+            return false;
+        const result = resolved;
+        if (result.apiKey !== '' || result.missing !== true || result.source !== null || result.ownerFileRefused !== undefined)
+            return false;
+        // The resolver uses a fleet key only with a direct key and a matching agent identity; one set without them is still a key.
+        if (Object.keys(env).some((name) => name.startsWith('MARROW_KEY_') && Boolean(env[name])))
+            return false;
+        const baseUrl = result.baseUrl || 'https://api.getmarrow.ai';
+        if (typeof baseUrl !== 'string')
+            return false;
+        (0, index_1.validateBaseUrl)(baseUrl);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function keylessProtocolVersion(params) {
+    const record = params && typeof params === 'object' ? params : {};
+    const capabilities = record.capabilities && typeof record.capabilities === 'object' ? record.capabilities : {};
+    const requested = typeof record.protocolVersion === 'string' ? record.protocolVersion : '';
+    const elicits = Boolean(capabilities.elicitation && typeof capabilities.elicitation === 'object')
+        && ELICITATION_PROTOCOL_VERSIONS.includes(requested);
+    return elicits ? requested : DEFAULT_PROTOCOL_VERSION;
+}
+/** Newline-delimited JSON-RPC 2.0 on stdio with zero tools. Exits 0 when stdin ends after an initialize, 1 for a non-MCP start. */
+function serveKeylessMcp(serverVersion, texts) {
+    const has = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+    const send = (id, body) => process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, ...body })}\n`);
+    const refuse = (id, code, message) => send(id, { error: { code, message } });
+    let initialized = false;
+    // Today's no-key exit: the refusal on stderr, nothing on stdout, exit 1.
+    function exitAsNoKey() {
+        try {
+            process.stderr.write(texts.refusal);
+        }
+        catch {
+            // a closed stderr changes nothing
+        }
+        process.exit(1);
+    }
+    // A frame that is not a usable JSON-RPC 2.0 message. Before an initialize it proves the process was not started by an MCP host.
+    function badFrame(id, code, message) {
+        if (!initialized)
+            exitAsNoKey();
+        refuse(id, code, message);
+    }
+    function handle(text) {
+        let msg;
+        try {
+            msg = JSON.parse(text);
+        }
+        catch {
+            badFrame(null, -32700, 'Parse error.');
+            return;
+        }
+        if (msg === null || typeof msg !== 'object' || Array.isArray(msg)) {
+            badFrame(null, -32600, 'Invalid request.');
+            return;
+        }
+        const request = msg;
+        if (request.jsonrpc !== '2.0' || typeof request.method !== 'string') {
+            badFrame(null, -32600, 'Invalid request.');
+            return;
+        }
+        if (!has(request, 'id'))
+            return; // a notification gets no reply
+        const id = request.id;
+        if (!(typeof id === 'string' || id === null || (typeof id === 'number' && Number.isFinite(id)))) {
+            badFrame(null, -32600, 'Invalid request.');
+            return;
+        }
+        if (request.method === 'initialize') {
+            initialized = true;
+            try {
+                process.stderr.write(texts.notice);
+            }
+            catch {
+                // a closed stderr changes nothing
+            }
+            send(id, {
+                result: {
+                    protocolVersion: keylessProtocolVersion(request.params),
+                    capabilities: { tools: { listChanged: false } },
+                    serverInfo: { name: 'marrow', version: serverVersion },
+                    instructions: texts.instructions,
+                },
+            });
+            return;
+        }
+        if (!initialized) {
+            refuse(id, -32002, 'Server not initialized. Send initialize first.');
+            return;
+        }
+        switch (request.method) {
+            case 'ping':
+                send(id, { result: {} });
+                return;
+            case 'tools/list':
+                send(id, { result: { tools: [] } });
+                return;
+            case 'prompts/list':
+                send(id, { result: { prompts: [] } });
+                return;
+            case 'resources/list':
+                send(id, { result: { resources: [] } });
+                return;
+            case 'resources/templates/list':
+                send(id, { result: { resourceTemplates: [] } });
+                return;
+            case 'tools/call':
+                refuse(id, -32602, 'This server has no tools.');
+                return;
+            default: refuse(id, -32601, 'Method not found.');
+        }
+    }
+    function dispatch(chunks) {
+        const text = Buffer.concat(chunks).toString('utf8');
+        if (!text.trim())
+            return;
+        try {
+            handle(text);
+        }
+        catch {
+            badFrame(null, -32603, 'Internal error.');
+        }
+    }
+    let chunks = [];
+    let size = 0;
+    let skipping = false; // inside a line over the limit: dropped up to the next newline, never buffered
+    process.stdout.on('error', () => process.exit(initialized ? 0 : 1));
+    process.stdin.on('error', () => { process.exitCode = 1; });
+    process.stdin.on('data', (data) => {
+        const chunk = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+        let from = 0;
+        while (from < chunk.length) {
+            const newline = chunk.indexOf(10, from);
+            const to = newline === -1 ? chunk.length : newline;
+            if (!skipping) {
+                size += to - from;
+                if (size > MAX_LINE_BYTES) {
+                    skipping = true;
+                    chunks = [];
+                    size = 0;
+                    badFrame(null, -32600, 'Request too large.');
+                }
+                else if (to > from) {
+                    chunks.push(chunk.subarray(from, to));
+                }
+            }
+            if (newline === -1)
+                return;
+            if (!skipping)
+                dispatch(chunks);
+            chunks = [];
+            size = 0;
+            skipping = false;
+            from = newline + 1;
+        }
+    });
+    process.stdin.on('end', () => {
+        if (!skipping)
+            dispatch(chunks);
+        if (!initialized)
+            exitAsNoKey(); // empty stdin, or an end before any initialize: no MCP host ever spoke
+    });
+}
+//# sourceMappingURL=keyless-server.js.map

package/dist/keyless-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-server.js","sourceRoot":"","sources":["../src/keyless-server.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAYH,kDASC;AAwBD,oCAeC;AAED,wDAOC;AAGD,0CAyHC;AA/LD,mCAA0C;AAS1C,0DAA0D;AAC1D,SAAgB,mBAAmB,CAAC,KAA8B;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC,+DAA+D,KAAK,CAAC,WAAW,GAAG;QACrF,CAAC,CAAC,2DAA2D,KAAK,CAAC,SAAS,aAAa,KAAK,CAAC,eAAe,yDAAyD,CAAC;IAC1K,OAAO,uFAAuF;UAC1F,iDAAiD;UACjD,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6KAA6K,CAAC;UACxM,OAAO;UACP,wCAAwC,CAAC;AAC/C,CAAC;AAUY,QAAA,cAAc,GAAG,+JAA+J,CAAC;AAE9L,oHAAoH;AACpH,sGAAsG;AACtG,MAAM,6BAA6B,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AACnE,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAiB,EAAE,IAAwB,EAAE,GAAuC;IAC/G,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpE,MAAM,MAAM,GAAG,QAAmC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrI,2HAA2H;QAC3H,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;QAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAe;IACpD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1I,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,IAAI,OAAO,YAAY,CAAC,WAAW,KAAK,QAAQ,CAAC;WAC5F,6BAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACxD,CAAC;AAED,mIAAmI;AACnI,SAAgB,eAAe,CAAC,aAAqB,EAAE,KAAmB;IACxE,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,IAA6B,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAG,CAAC,EAAW,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACtG,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,yEAAyE;IACzE,SAAS,WAAW;QAClB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gIAAgI;IAChI,SAAS,QAAQ,CAAC,EAAW,EAAE,IAAY,EAAE,OAAe;QAC1D,IAAI,CAAC,WAAW;YAAE,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,SAAS,MAAM,CAAC,IAAY;QAC1B,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAA8B,CAAC;QAC/C,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,+BAA+B;QAChE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;YACD,IAAI,CAAC,EAAE,EAAE;gBACP,MAAM,EAAE;oBACN,eAAe,EAAE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC;oBACvD,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;oBACtD,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,gDAAgD,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YAC9C,KAAK,YAAY;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YAC/D,KAAK,cAAc;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACnE,KAAK,gBAAgB;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACvE,KAAK,0BAA0B;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACzF,KAAK,YAAY;gBAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;gBAAC,OAAO;YAC3E,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,MAAgB;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,+EAA+E;IACrG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAqB,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC;gBAClB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAC1B,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM,GAAG,EAAE,CAAC;oBACZ,IAAI,GAAG,CAAC,CAAC;oBACT,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;gBAC/C,CAAC;qBAAM,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,CAAC;gBAAE,OAAO;YAC3B,IAAI,CAAC,QAAQ;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,GAAG,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,IAAI,CAAC,QAAQ;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW;YAAE,WAAW,EAAE,CAAC,CAAC,uEAAuE;IAC1G,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/normalized-action.d.ts

@@ -8,8 +8,14 @@
  * names of a shell command, the file paths of an edit (the home directory as
  * `~`, another user's home as `/home/[user]`), a SHA-256 of the
  * command or tool input, and `truncated: true` when that hash could not cover
- * everything that decides what the action does. The command text and the
- * tool input themselves are never sent.
+ * everything that decides what the action does. The tool input is never sent.
+ * The command text is never sent, with one exception: a shell command that is
+ * word for word one of the deploy grammars (deployCommandText: one clause of
+ * plain ASCII words, an optional launcher, the deploy tool and subcommand, at
+ * most one environment flag with a DEPLOY_ENV_VALUE value, nothing else, and
+ * no secret replaced) is also sent as `tool_input.command`, exactly as typed
+ * (for example `sst deploy --stage production`), so the service can judge the
+ * deploy target. Every other command sends only its hash.
  *
  * Before hashing, a normalized form is built (whitespace and quoting
  * normalized) in which:
@@ -39,9 +45,12 @@
  * - Data a command reads (text echoed or printed into a pipe or a file,
  *   heredoc bodies, here-strings) and the values of other environment
  *   assignments and env-store settings (`env:set`, `config:set`, `variables
- *   set`) are replaced by a SHA-256 of the data when the data carries
- *   nothing secret-shaped and does not feed a secrets command or a secrets
- *   file: different data gives a different hash, the same data the same hash.
+ *   set`) are replaced by a SHA-256 of the data when the data does not feed
+ *   a secrets command or a secrets file: different data gives a different
+ *   hash, the same data the same hash. Data that carries something
+ *   secret-shaped is hashed with each secret replaced by `[secret]`
+ *   (`[secret-data:…]`, truncated), so data that differs outside a secret
+ *   still gives a different hash.
  * - Anything else that may be a secret is replaced by `[secret]` and the
  *   action is marked `truncated: true`, so Marrow never binds an approval to
  *   it and always asks: data that feeds a secrets command (`… secret put`,
@@ -74,8 +83,12 @@ export type NormalizedHookAction = {
     paths?: string[];
     tool_input: {
         command_sha256: string;
+        exact_hmac?: string;
     } | {
         input_sha256: string;
+        exact_hmac?: string;
+    } | {
+        exact_hmac: string;
     } | Record<string, never>;
     /** The hash could not cover everything that decides the action: Marrow never binds an approval to it. */
     truncated?: true;
@@ -100,7 +113,7 @@ export declare function classifySecretName(name: string): NameClass;
  * never sent. `truncated` is true when something that may change what the
  * command does had to be withheld. Exported for tests.
  */
-export declare function normalizeShellCommand(command: string, deadline?: number): {
+export declare function normalizeShellCommand(command: string, deadline?: number, exact?: boolean): {
     text: string;
     programs: string[];
     truncated: boolean;
@@ -116,6 +129,8 @@ export declare function normalizeShellCommand(command: string, deadline?: number
  * word ever leaves the machine.
  */
 export declare function deployCommandText(command: string): string | null;
+/** runOptionsKey as a standalone identity (no deadline), for the exact target of a call (hook-contract exactHookTarget). */
+export declare function shellToolRunOptionsKey(event: ToolEvent): string | null;
 /**
  * The normalized action of a hook event. `deadlineAt` bounds the time it may
  * take (default one second from now): past it, or past the size limits, the
@@ -123,9 +138,19 @@ export declare function deployCommandText(command: string): string | null;
  * service never binds, so the hook still answers within its host's budget.
  * An event whose input a host adapter cut or dropped (`input_truncated`) is
  * marked truncated as well.
+ *
+ * A truncated action also carries `tool_input.exact_hmac`: a keyed hash (the
+ * device salt never leaves the machine) of the action with only certain
+ * credentials replaced, so two actions that differ anywhere else never share a
+ * correlation, hold or key, and a retry that differs only in a certain
+ * credential (an OTP) still does. A placeholder keys the raw input (up to
+ * 1 MB). Input a host adapter cut or dropped, input over 1 MB and a missing or
+ * unsafe salt give a random nonce: the action matches nothing (it is asked
+ * again). `salt` is a test seam (undefined: the device salt).
  */
 export declare function normalizedHookAction(event: ToolEvent, options?: {
     deadlineAt?: number;
+    salt?: Buffer | null;
 }): NormalizedHookAction;
 export {};
 //# sourceMappingURL=normalized-action.d.ts.map

package/dist/normalized-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1F,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA+B/D,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AA+CD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAowBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CASlI;AAgGD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AAkBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,oBAAoB,CAmBlH"}
+{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7J,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA8C/D,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AAgDD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAm5BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWjJ;AA4HD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AA2BD,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAEtE;AAkLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,oBAAoB,CAgCxI"}