@getmarrow/mcp 3.9.103 → 3.9.106

package/dist/keyless-server.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Keyless start of the MCP server. With no Marrow key anywhere the server reads
+ * one, the server used to print "MARROW_API_KEY environment variable is
+ * required" and exit 1, which hosts show as a broken server. It now answers the
+ * MCP protocol with zero tools and an `instructions` string that says how the
+ * owner connects a key.
+ *
+ * Fail closed: keylessStart is true only for a clear "no key". A key, anything
+ * key-shaped, a refused owner key file, a base URL the server would refuse, or
+ * any doubt runs the real server path exactly as before.
+ *
+ * The keyless server judges, checks and records nothing. It starts no child
+ * process, opens no network and no file, reads no environment, and writes only
+ * to stdout and stderr. Hooks are separate entrypoints and are not touched.
+ * Protocol handling matches the plugin launcher's keyless stub
+ * (marrow-plugins plugins/<plugin>/scripts/marrow-launch.cjs, serveKeyless).
+ *
+ * Never looser than the exit 1 it replaces: until a valid `initialize` request has
+ * been answered, a frame that is not JSON-RPC 2.0 (a Cursor or Claude hook payload
+ * piped to the entry, a parse error, an oversize line) or an end of stdin ends the
+ * process with the no-key refusal on stderr, nothing on stdout, and exit 1. After
+ * an initialize, the end of stdin is exit 0.
+ *
+ * The key text (URL, activate command, plugin steps, the refusal) is owned by cli.ts
+ * and passed in; this file holds no second copy of it.
+ */
+export interface KeylessInstructionParts {
+    getKeyUrl: string;
+    activateCommand: string;
+    /** Set when the server runs under the Claude Code plugin: its key steps replace the activate command. */
+    pluginSteps?: string;
+}
+/** The `instructions` string of the initialize answer. */
+export declare function keylessInstructions(parts: KeylessInstructionParts): string;
+export interface KeylessTexts {
+    instructions: string;
+    /** Written to stderr once, when the first initialize is answered. */
+    notice: string;
+    /** The server's own no-key refusal, written to stderr before the exit 1 that a non-MCP first frame or an early end of stdin gets. */
+    refusal: string;
+}
+export declare const KEYLESS_NOTICE = "Marrow: no Marrow key on this machine, so the Marrow MCP server started with no tools. Marrow hooks, where they are set up, keep their free keyless seatbelt.";
+/**
+ * Whether the MCP server starts keyless. `resolved` must be the server's own resolveMarrowEnv() result.
+ * True only when it found no key (an empty MARROW_API_KEY or MARROW_KEY counts as none, a whitespace one does
+ * not), no owner key file was refused, no `--key` argument is given in any form, no fleet key
+ * (MARROW_KEY_<SUFFIX>) is set, and the base URL passes the server's own check.
+ */
+export declare function keylessStart(resolved: unknown, argv: readonly unknown[], env: Record<string, string | undefined>): boolean;
+export declare function keylessProtocolVersion(params: unknown): string;
+/** Newline-delimited JSON-RPC 2.0 on stdio with zero tools. Exits 0 when stdin ends after an initialize, 1 for a non-MCP start. */
+export declare function serveKeylessMcp(serverVersion: string, texts: KeylessTexts): void;
+//# sourceMappingURL=keyless-server.d.ts.map

package/dist/keyless-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-server.d.ts","sourceRoot":"","sources":["../src/keyless-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAS1E;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,qIAAqI;IACrI,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,cAAc,kKAAkK,CAAC;AAQ9L;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAe1H;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO9D;AAED,mIAAmI;AACnI,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAyHhF"}

package/dist/keyless-server.js

@@ -0,0 +1,230 @@
+"use strict";
+/**
+ * Keyless start of the MCP server. With no Marrow key anywhere the server reads
+ * one, the server used to print "MARROW_API_KEY environment variable is
+ * required" and exit 1, which hosts show as a broken server. It now answers the
+ * MCP protocol with zero tools and an `instructions` string that says how the
+ * owner connects a key.
+ *
+ * Fail closed: keylessStart is true only for a clear "no key". A key, anything
+ * key-shaped, a refused owner key file, a base URL the server would refuse, or
+ * any doubt runs the real server path exactly as before.
+ *
+ * The keyless server judges, checks and records nothing. It starts no child
+ * process, opens no network and no file, reads no environment, and writes only
+ * to stdout and stderr. Hooks are separate entrypoints and are not touched.
+ * Protocol handling matches the plugin launcher's keyless stub
+ * (marrow-plugins plugins/<plugin>/scripts/marrow-launch.cjs, serveKeyless).
+ *
+ * Never looser than the exit 1 it replaces: until a valid `initialize` request has
+ * been answered, a frame that is not JSON-RPC 2.0 (a Cursor or Claude hook payload
+ * piped to the entry, a parse error, an oversize line) or an end of stdin ends the
+ * process with the no-key refusal on stderr, nothing on stdout, and exit 1. After
+ * an initialize, the end of stdin is exit 0.
+ *
+ * The key text (URL, activate command, plugin steps, the refusal) is owned by cli.ts
+ * and passed in; this file holds no second copy of it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYLESS_NOTICE = void 0;
+exports.keylessInstructions = keylessInstructions;
+exports.keylessStart = keylessStart;
+exports.keylessProtocolVersion = keylessProtocolVersion;
+exports.serveKeylessMcp = serveKeylessMcp;
+const index_1 = require("./index");
+/** The `instructions` string of the initialize answer. */
+function keylessInstructions(parts) {
+    const connect = parts.pluginSteps
+        ? `To connect a Marrow account, the owner follows these steps. ${parts.pluginSteps} `
+        : `To connect a Marrow account, the owner creates a key at ${parts.getKeyUrl} and runs ${parts.activateCommand} in their own terminal, then restarts this agent host. `;
+    return 'This Marrow server started without a Marrow key on this machine, so it has no tools. '
+        + 'It does not judge, check or record any action. '
+        + (parts.pluginSteps ? '' : 'Marrow hooks, where they are set up on this machine, are separate from this server and keep their free keyless seatbelt; this server does not show whether any are set up. ')
+        + connect
+        + 'A key can not be added from this chat.';
+}
+exports.KEYLESS_NOTICE = 'Marrow: no Marrow key on this machine, so the Marrow MCP server started with no tools. Marrow hooks, where they are set up, keep their free keyless seatbelt.';
+// The real server's protocolVersion rule (cli.ts noteClientCapabilities): the requested version only when it is one
+// of these AND the client's capabilities.elicitation is an object; every other input gets 2024-11-05.
+const ELICITATION_PROTOCOL_VERSIONS = ['2025-06-18', '2025-11-25'];
+const DEFAULT_PROTOCOL_VERSION = '2024-11-05';
+const MAX_LINE_BYTES = 1024 * 1024;
+/**
+ * Whether the MCP server starts keyless. `resolved` must be the server's own resolveMarrowEnv() result.
+ * True only when it found no key (an empty MARROW_API_KEY or MARROW_KEY counts as none, a whitespace one does
+ * not), no owner key file was refused, no `--key` argument is given in any form, no fleet key
+ * (MARROW_KEY_<SUFFIX>) is set, and the base URL passes the server's own check.
+ */
+function keylessStart(resolved, argv, env) {
+    try {
+        if (argv.some((arg) => typeof arg !== 'string' || arg.startsWith('--key')))
+            return false;
+        if (resolved === null || typeof resolved !== 'object')
+            return false;
+        const result = resolved;
+        if (result.apiKey !== '' || result.missing !== true || result.source !== null || result.ownerFileRefused !== undefined)
+            return false;
+        // The resolver uses a fleet key only with a direct key and a matching agent identity; one set without them is still a key.
+        if (Object.keys(env).some((name) => name.startsWith('MARROW_KEY_') && Boolean(env[name])))
+            return false;
+        const baseUrl = result.baseUrl || 'https://api.getmarrow.ai';
+        if (typeof baseUrl !== 'string')
+            return false;
+        (0, index_1.validateBaseUrl)(baseUrl);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function keylessProtocolVersion(params) {
+    const record = params && typeof params === 'object' ? params : {};
+    const capabilities = record.capabilities && typeof record.capabilities === 'object' ? record.capabilities : {};
+    const requested = typeof record.protocolVersion === 'string' ? record.protocolVersion : '';
+    const elicits = Boolean(capabilities.elicitation && typeof capabilities.elicitation === 'object')
+        && ELICITATION_PROTOCOL_VERSIONS.includes(requested);
+    return elicits ? requested : DEFAULT_PROTOCOL_VERSION;
+}
+/** Newline-delimited JSON-RPC 2.0 on stdio with zero tools. Exits 0 when stdin ends after an initialize, 1 for a non-MCP start. */
+function serveKeylessMcp(serverVersion, texts) {
+    const has = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+    const send = (id, body) => process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, ...body })}\n`);
+    const refuse = (id, code, message) => send(id, { error: { code, message } });
+    let initialized = false;
+    // Today's no-key exit: the refusal on stderr, nothing on stdout, exit 1.
+    function exitAsNoKey() {
+        try {
+            process.stderr.write(texts.refusal);
+        }
+        catch {
+            // a closed stderr changes nothing
+        }
+        process.exit(1);
+    }
+    // A frame that is not a usable JSON-RPC 2.0 message. Before an initialize it proves the process was not started by an MCP host.
+    function badFrame(id, code, message) {
+        if (!initialized)
+            exitAsNoKey();
+        refuse(id, code, message);
+    }
+    function handle(text) {
+        let msg;
+        try {
+            msg = JSON.parse(text);
+        }
+        catch {
+            badFrame(null, -32700, 'Parse error.');
+            return;
+        }
+        if (msg === null || typeof msg !== 'object' || Array.isArray(msg)) {
+            badFrame(null, -32600, 'Invalid request.');
+            return;
+        }
+        const request = msg;
+        if (request.jsonrpc !== '2.0' || typeof request.method !== 'string') {
+            badFrame(null, -32600, 'Invalid request.');
+            return;
+        }
+        if (!has(request, 'id'))
+            return; // a notification gets no reply
+        const id = request.id;
+        if (!(typeof id === 'string' || id === null || (typeof id === 'number' && Number.isFinite(id)))) {
+            badFrame(null, -32600, 'Invalid request.');
+            return;
+        }
+        if (request.method === 'initialize') {
+            initialized = true;
+            try {
+                process.stderr.write(texts.notice);
+            }
+            catch {
+                // a closed stderr changes nothing
+            }
+            send(id, {
+                result: {
+                    protocolVersion: keylessProtocolVersion(request.params),
+                    capabilities: { tools: { listChanged: false } },
+                    serverInfo: { name: 'marrow', version: serverVersion },
+                    instructions: texts.instructions,
+                },
+            });
+            return;
+        }
+        if (!initialized) {
+            refuse(id, -32002, 'Server not initialized. Send initialize first.');
+            return;
+        }
+        switch (request.method) {
+            case 'ping':
+                send(id, { result: {} });
+                return;
+            case 'tools/list':
+                send(id, { result: { tools: [] } });
+                return;
+            case 'prompts/list':
+                send(id, { result: { prompts: [] } });
+                return;
+            case 'resources/list':
+                send(id, { result: { resources: [] } });
+                return;
+            case 'resources/templates/list':
+                send(id, { result: { resourceTemplates: [] } });
+                return;
+            case 'tools/call':
+                refuse(id, -32602, 'This server has no tools.');
+                return;
+            default: refuse(id, -32601, 'Method not found.');
+        }
+    }
+    function dispatch(chunks) {
+        const text = Buffer.concat(chunks).toString('utf8');
+        if (!text.trim())
+            return;
+        try {
+            handle(text);
+        }
+        catch {
+            badFrame(null, -32603, 'Internal error.');
+        }
+    }
+    let chunks = [];
+    let size = 0;
+    let skipping = false; // inside a line over the limit: dropped up to the next newline, never buffered
+    process.stdout.on('error', () => process.exit(initialized ? 0 : 1));
+    process.stdin.on('error', () => { process.exitCode = 1; });
+    process.stdin.on('data', (data) => {
+        const chunk = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+        let from = 0;
+        while (from < chunk.length) {
+            const newline = chunk.indexOf(10, from);
+            const to = newline === -1 ? chunk.length : newline;
+            if (!skipping) {
+                size += to - from;
+                if (size > MAX_LINE_BYTES) {
+                    skipping = true;
+                    chunks = [];
+                    size = 0;
+                    badFrame(null, -32600, 'Request too large.');
+                }
+                else if (to > from) {
+                    chunks.push(chunk.subarray(from, to));
+                }
+            }
+            if (newline === -1)
+                return;
+            if (!skipping)
+                dispatch(chunks);
+            chunks = [];
+            size = 0;
+            skipping = false;
+            from = newline + 1;
+        }
+    });
+    process.stdin.on('end', () => {
+        if (!skipping)
+            dispatch(chunks);
+        if (!initialized)
+            exitAsNoKey(); // empty stdin, or an end before any initialize: no MCP host ever spoke
+    });
+}
+//# sourceMappingURL=keyless-server.js.map

package/dist/keyless-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-server.js","sourceRoot":"","sources":["../src/keyless-server.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAYH,kDASC;AAwBD,oCAeC;AAED,wDAOC;AAGD,0CAyHC;AA/LD,mCAA0C;AAS1C,0DAA0D;AAC1D,SAAgB,mBAAmB,CAAC,KAA8B;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC,+DAA+D,KAAK,CAAC,WAAW,GAAG;QACrF,CAAC,CAAC,2DAA2D,KAAK,CAAC,SAAS,aAAa,KAAK,CAAC,eAAe,yDAAyD,CAAC;IAC1K,OAAO,uFAAuF;UAC1F,iDAAiD;UACjD,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6KAA6K,CAAC;UACxM,OAAO;UACP,wCAAwC,CAAC;AAC/C,CAAC;AAUY,QAAA,cAAc,GAAG,+JAA+J,CAAC;AAE9L,oHAAoH;AACpH,sGAAsG;AACtG,MAAM,6BAA6B,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AACnE,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAiB,EAAE,IAAwB,EAAE,GAAuC;IAC/G,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpE,MAAM,MAAM,GAAG,QAAmC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrI,2HAA2H;QAC3H,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;QAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAe;IACpD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1I,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,IAAI,OAAO,YAAY,CAAC,WAAW,KAAK,QAAQ,CAAC;WAC5F,6BAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACxD,CAAC;AAED,mIAAmI;AACnI,SAAgB,eAAe,CAAC,aAAqB,EAAE,KAAmB;IACxE,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,IAA6B,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAG,CAAC,EAAW,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACtG,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,yEAAyE;IACzE,SAAS,WAAW;QAClB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gIAAgI;IAChI,SAAS,QAAQ,CAAC,EAAW,EAAE,IAAY,EAAE,OAAe;QAC1D,IAAI,CAAC,WAAW;YAAE,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,SAAS,MAAM,CAAC,IAAY;QAC1B,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAA8B,CAAC;QAC/C,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,+BAA+B;QAChE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;YACD,IAAI,CAAC,EAAE,EAAE;gBACP,MAAM,EAAE;oBACN,eAAe,EAAE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC;oBACvD,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;oBACtD,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,gDAAgD,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YAC9C,KAAK,YAAY;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YAC/D,KAAK,cAAc;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACnE,KAAK,gBAAgB;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACvE,KAAK,0BAA0B;gBAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACzF,KAAK,YAAY;gBAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;gBAAC,OAAO;YAC3E,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,MAAgB;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,+EAA+E;IACrG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAqB,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC;gBAClB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAC1B,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM,GAAG,EAAE,CAAC;oBACZ,IAAI,GAAG,CAAC,CAAC;oBACT,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;gBAC/C,CAAC;qBAAM,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,CAAC;gBAAE,OAAO;YAC3B,IAAI,CAAC,QAAQ;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,GAAG,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,IAAI,CAAC,QAAQ;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW;YAAE,WAAW,EAAE,CAAC,CAAC,uEAAuE;IAC1G,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/normalized-action.d.ts

@@ -129,6 +129,8 @@ export declare function normalizeShellCommand(command: string, deadline?: number
  * word ever leaves the machine.
  */
 export declare function deployCommandText(command: string): string | null;
+/** runOptionsKey as a standalone identity (no deadline), for the exact target of a call (hook-contract exactHookTarget). */
+export declare function shellToolRunOptionsKey(event: ToolEvent): string | null;
 /**
  * The normalized action of a hook event. `deadlineAt` bounds the time it may
  * take (default one second from now): past it, or past the size limits, the

package/dist/normalized-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7J,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA8C/D,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AAgDD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAm5BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWjJ;AAwHD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AA0KD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,oBAAoB,CA4BxI"}
+{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7J,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA8C/D,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AAgDD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAm5BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWjJ;AA4HD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AA2BD,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAEtE;AAkLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,oBAAoB,CAgCxI"}

package/dist/normalized-action.js

@@ -5,6 +5,7 @@ exports.looksLikeKey = looksLikeKey;
 exports.classifySecretName = classifySecretName;
 exports.normalizeShellCommand = normalizeShellCommand;
 exports.deployCommandText = deployCommandText;
+exports.shellToolRunOptionsKey = shellToolRunOptionsKey;
 exports.normalizedHookAction = normalizedHookAction;
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = require("node:os");
@@ -1194,8 +1195,9 @@ function redactedInput(value, state, depth = 0) {
 function untrimmedShellText(event, trimmed) {
     const input = event.tool_input && typeof event.tool_input === 'object' && !Array.isArray(event.tool_input)
         ? event.tool_input : null;
-    const host = typeof event.tool_input === 'string' ? event.tool_input
-        : typeof input?.command === 'string' ? input.command : typeof input?.cmd === 'string' ? input.cmd : null;
+    const host = (0, hook_tool_policy_1.shellCommandToolText)(event)
+        ?? (typeof event.tool_input === 'string' ? event.tool_input
+            : typeof input?.command === 'string' ? input.command : typeof input?.cmd === 'string' ? input.cmd : null);
     if (host === null || host === trimmed)
         return null;
     const at = host.indexOf(trimmed);
@@ -1210,6 +1212,10 @@ function untrimmedShellText(event, trimmed) {
  * would carry, so both give the same normalized action.
  */
 function shellCommand(event) {
+    // A plain Monitor or PowerShell call: its one command or script text, read as Bash's command.
+    const toolText = (0, hook_tool_policy_1.shellCommandToolText)(event);
+    if (toolText !== null)
+        return toolText.trim();
     const input = event.tool_input && typeof event.tool_input === 'object' && !Array.isArray(event.tool_input)
         ? event.tool_input : null;
     const argv = Array.isArray(input?.command) ? input.command : Array.isArray(input?.cmd) ? input.cmd : null;
@@ -1329,6 +1335,28 @@ function inputHash(input, state) {
         state.truncated = true; // exact: n/a (pass 1 only; exactMaterial is the exact form)
     return { input_sha256: sha256(`${HASH_VERSION}\ninput\n${text}`) };
 }
+/**
+ * The run options of a Monitor or PowerShell call (timeout, timeout_ms, run_in_background) as key material:
+ * the hash of their canonical JSON with credentials replaced, as any tool input is hashed (so a replaced
+ * credential marks the action truncated here too), or null when the call sets none (and for any other tool).
+ * They decide how long and where the command runs, so an approval of one set is not an approval of another;
+ * `description` is not key material.
+ */
+function runOptionsKey(event, state) {
+    const options = (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    if (options === null)
+        return null;
+    return inputHash(options, state).input_sha256;
+}
+/** runOptionsKey as a standalone identity (no deadline), for the exact target of a call (hook-contract exactHookTarget). */
+function shellToolRunOptionsKey(event) {
+    return runOptionsKey(event, newExactness(Number.POSITIVE_INFINITY));
+}
+/** The exact form of the run options (only certain credentials replaced), for the exact material of a truncated action. */
+function exactRunOptions(event, state) {
+    const options = (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    return options === null ? null : JSON.stringify(sortedValue(redactedInput(options, state)));
+}
 function withExactness(action, state) {
     return state.truncated ? { ...action, truncated: true } : action;
 }
@@ -1433,13 +1461,22 @@ function shellReferences(command) {
 function exactShellForm(text, command, state) {
     return `${text}\n${JSON.stringify(shellReferences(command))}\n${JSON.stringify(state.sigs)}`;
 }
+/** The raw shell text as material; a plain Monitor or PowerShell call also carries its run options (raw). */
+function rawShellMaterial(event, command) {
+    const options = (0, hook_tool_policy_1.shellCommandToolText)(event) === null
+        ? null : (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    if (options === null)
+        return `raw-shell\n${command}`;
+    const json = canonicalJson(options);
+    return json === null ? null : `raw-shell+run\n${json}\n${command}`;
+}
 /** The raw input as material (a placeholder, or an exact pass that hit a limit): the command, or the canonical input. */
 function rawExactMaterial(event, kind) {
     if (kind === 'shell') {
         try {
             const trimmed = shellCommand(event);
             const command = untrimmedShellText(event, trimmed) ?? trimmed;
-            return typeof command === 'string' && command.length <= MAX_RAW_EXACT_CHARS ? `raw-shell\n${command}` : null;
+            return typeof command === 'string' && command.length <= MAX_RAW_EXACT_CHARS ? rawShellMaterial(event, command) : null;
         }
         catch {
             return null;
@@ -1460,10 +1497,14 @@ function exactMaterial(event, kind, deadline) {
         if (kind === 'shell') {
             const trimmed = shellCommand(event);
             const host = untrimmedShellText(event, trimmed);
-            if (host !== null)
-                return bounded(`raw-shell\n${host}`);
+            if (host !== null) {
+                const raw = rawShellMaterial(event, host);
+                return raw === null ? null : bounded(raw);
+            }
             const { text } = normalizeInner(trimmed, state, 0);
-            return bounded(`exact-shell\n${exactShellForm(text, trimmed, state)}`);
+            const runOptions = (0, hook_tool_policy_1.shellCommandToolText)(event) !== null
+                ? exactRunOptions(event, newExactness(deadline, true)) : null;
+            return bounded(`exact-shell${runOptions === null ? '' : `+run\n${runOptions}`}\n${exactShellForm(text, trimmed, state)}`);
         }
         const input = event.tool_input;
         const text = input === undefined || input === null ? 'null' : JSON.stringify(sortedValue(redactedInput(input, state)));
@@ -1528,10 +1569,14 @@ function normalizedHookAction(event, options = {}) {
     const hostToolName = rawToolName.slice(0, 128);
     if (rawToolName.length > 128)
         state.truncated = true; // exact: kept (the full name is in exact_hmac)
+    // Claude Code built-ins first hooked in 3.9.105 that are not plain shell calls (a native git
+    // equivalent, Skill, a call whose words are not actions, an irregular Monitor or PowerShell call)
+    // are keyed by their whole input, never by one field of it.
     const kind = (0, hook_tool_policy_1.isMcpHookTool)(event.tool_name) || /^MCP:/i.test(hostToolName) ? 'mcp'
-        : (0, hook_tool_policy_1.isShellGovernedTool)(event) ? 'shell'
-            : EDIT_TOOLS.test(toolName) ? 'edit'
-                : 'other';
+        : (0, hook_tool_policy_1.isWholeInputNativeTool)(event) ? 'other'
+            : (0, hook_tool_policy_1.isShellGovernedTool)(event) ? 'shell'
+                : EDIT_TOOLS.test(toolName) ? 'edit'
+                    : 'other';
     const inputCut = event.input_truncated === true;
     if (inputCut)
         state.truncated = true; // exact: nonce (the cut or dropped input is all that is left)
@@ -1569,13 +1614,23 @@ function normalizedOfKind(event, kind, hostToolName, state) {
         const input = event.tool_input && typeof event.tool_input === 'object' && !Array.isArray(event.tool_input) ? event.tool_input : null;
         const exact = typeof input?.command === 'string' ? input.command : typeof input?.cmd === 'string' ? input.cmd : raw;
         const deployText = state.truncated ? null : deployCommandText(exact);
+        // A Monitor or PowerShell command carries its host tool name, so it never shares a hash with the
+        // same Bash command (or another tool's): the line after the version is `shell` only for every
+        // other shell call, whose hash is unchanged.
+        // Its run options (timeout, timeout_ms, run_in_background), when it sets any, are in the hash too: a
+        // different line after `shell-tool+run`, so no command text can stand for them.
+        const plainShellTool = (0, hook_tool_policy_1.shellCommandToolText)(event) !== null;
+        const runOptions = plainShellTool ? runOptionsKey(event, state) : null;
+        const domain = !plainShellTool ? 'shell'
+            : runOptions === null ? `shell-tool\n${JSON.stringify(hostToolName)}`
+                : `shell-tool+run\n${JSON.stringify(hostToolName)}\n${runOptions}`;
         return withExactness({
             tool_kind: 'shell',
             tool_name: hostToolName,
             programs,
             tool_input: {
                 // An exact action also hashes its quoting (never for a truncated one: a secret's characters stay out of it).
-                command_sha256: sha256(`${HASH_VERSION}\nshell\n${state.truncated || !state.sigs.length ? text : `${text}\n${JSON.stringify(state.sigs)}`}`),
+                command_sha256: sha256(`${HASH_VERSION}\n${domain}\n${state.truncated || !state.sigs.length ? text : `${text}\n${JSON.stringify(state.sigs)}`}`),
                 ...(deployText !== null && deployText === text ? { command: deployText } : {}),
             },
         }, state);