@getmarrow/mcp 3.9.103 → 3.9.107

package/dist/normalized-action.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_SCAN_CHARS = void 0;
+exports.KNOWN_KEY_PREFIX = exports.MAX_SCAN_CHARS = void 0;
 exports.looksLikeKey = looksLikeKey;
 exports.classifySecretName = classifySecretName;
 exports.normalizeShellCommand = normalizeShellCommand;
 exports.deployCommandText = deployCommandText;
+exports.shellToolRunOptionsKey = shellToolRunOptionsKey;
+exports.keyedTargetHash = keyedTargetHash;
 exports.normalizedHookAction = normalizedHookAction;
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = require("node:os");
@@ -28,7 +30,7 @@ const DEFAULT_NORMALIZE_MS = 1_000;
 class NormalizationLimit extends Error {
 }
 function newExactness(deadline = Date.now() + DEFAULT_NORMALIZE_MS, exact = false) {
-    return { truncated: false, budget: { scanned: 0, deadline }, exact, sigs: [] };
+    return { truncated: false, budget: { scanned: 0, deadline }, exact, sigs: [], freeText: false };
 }
 /**
  * A value withheld only because it MAY be a secret (it may also be an id, a commit or a name that decides the
@@ -50,7 +52,16 @@ function sha256(text) {
 // ---------------------------------------------------------------------------
 // Key-shaped values
 // ---------------------------------------------------------------------------
-const KNOWN_KEY_PREFIX = /^(?:AKIA|ASIA|AGPA|AIDA|AROA)[0-9A-Z]{12,}$|^(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}$|^github_pat_[A-Za-z0-9_]{20,}$|^(?:sk|pk|rk)[-_](?:live|test|proj|ant)?[-_]?[A-Za-z0-9_-]{12,}$|^xox[abprs]-[A-Za-z0-9-]{10,}$|^AIza[0-9A-Za-z_-]{30,}$|^glpat-[A-Za-z0-9_-]{16,}$|^npm_[A-Za-z0-9]{20,}$|^mrw_[A-Za-z0-9_-]{8,}$|^cfut_[A-Za-z0-9_-]{12,}$|^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/;
+exports.KNOWN_KEY_PREFIX = /^(?:AKIA|ASIA|AGPA|AIDA|AROA)[0-9A-Z]{12,}$|^(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}$|^github_pat_[A-Za-z0-9_]{20,}$|^(?:sk|pk|rk)[-_](?:live|test|proj|ant)?[-_]?[A-Za-z0-9_-]{12,}$|^xox[abprs]-[A-Za-z0-9-]{10,}$|^AIza[0-9A-Za-z_-]{30,}$|^glpat-[A-Za-z0-9_-]{16,}$|^npm_[A-Za-z0-9]{20,}$|^mrw_[A-Za-z0-9_-]{8,}$|^cfut_[A-Za-z0-9_-]{12,}$|^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/;
+/**
+ * KNOWN_KEY_PREFIX as spans inside a longer text (an edit path): the same alternatives with their anchors cut off, so
+ * the two cannot drift apart, plus a hex run of 32 or more characters. A span starts at the start of the text or after
+ * any character that is not a letter or digit (`/`, `\`, `.`, `-`, `=`), and its greedy token class ends it at the first
+ * character the class does not hold (the `.` before an extension, `/`, `\`, `?`, `#`, the end).
+ */
+const PATH_KEY_SPAN = new RegExp(`(?<![A-Za-z0-9])(?:${exports.KNOWN_KEY_PREFIX.source.split('|^').map((alt) => alt.replace(/^\^/, '').replace(/\$$/, '')).join('|')}|[0-9A-Fa-f]{32,})`, 'g');
+/** An edit path is scanned for spans on its first characters only, twice the 512 that are sent: the work stays bounded. */
+const PATH_SCAN_CHARS = 1024;
 const PEM = /-----BEGIN [A-Z ]*(?:PRIVATE KEY|CERTIFICATE)-----/;
 /** Known formats that only name a key or are public (AWS key, user, group and role ids; publishable keys): the exact pass keeps them. */
 const PUBLIC_KNOWN_KEY = /^(?:AKIA|ASIA|AGPA|AIDA|AROA)[0-9A-Z]{12,}$|^pk[-_]/;
@@ -59,7 +70,7 @@ function looksLikeKey(value) {
     const text = value.trim();
     if (!text)
         return false;
-    if (KNOWN_KEY_PREFIX.test(text))
+    if (exports.KNOWN_KEY_PREFIX.test(text))
         return true;
     if (PEM.test(text))
         return true;
@@ -81,7 +92,7 @@ const KEY_SPLIT = /([\s=:,;@/?&'"`()[\]{}<>|!*$])/;
 function redactKeyShapes(text, state) {
     const whole = text.trim();
     if (whole && !/\s/.test(whole) && looksLikeKey(whole)) {
-        if (!KNOWN_KEY_PREFIX.test(whole) && !PEM.test(whole))
+        if (!exports.KNOWN_KEY_PREFIX.test(whole) && !PEM.test(whole))
             return withheld(state, text);
         return state.exact && PUBLIC_KNOWN_KEY.test(whole) ? text : SECRET;
     }
@@ -92,7 +103,7 @@ function redactKeyShapes(text, state) {
     return text.split(KEY_SPLIT).map((part) => {
         if (!looksLikeKey(part))
             return part;
-        if (!KNOWN_KEY_PREFIX.test(part))
+        if (!exports.KNOWN_KEY_PREFIX.test(part))
             return withheld(state, part);
         return state.exact && PUBLIC_KNOWN_KEY.test(part) ? part : SECRET;
     }).join('');
@@ -333,7 +344,7 @@ function dataMarker(text, feedsSecrets, state, words = null) {
         // The exact pass: only the certain credentials inside the data are replaced and the rest is hashed, also for
         // data a secrets command or file reads (a vault policy, an authorized_keys line, a kubeconfig differ outside
         // any secret), so data that differs outside a certain credential never shares exact material.
-        const probe = { truncated: false, budget: state.budget, exact: true, sigs: [] };
+        const probe = { truncated: false, budget: state.budget, exact: true, sigs: [], freeText: false };
         return `[data:${sha256(`${HASH_VERSION}\nexact-data\n${redactText(text, probe)}`)}]`;
     }
     if (feedsSecrets) {
@@ -344,7 +355,7 @@ function dataMarker(text, feedsSecrets, state, words = null) {
     // replaced and the rest is hashed, so data that differs outside a secret gives
     // a different key, data that differs only in a secret the same one. Withheld:
     // the action is truncated and never binds an approval.
-    const probe = { truncated: false, budget: state.budget, exact: false, sigs: [] };
+    const probe = { truncated: false, budget: state.budget, exact: false, sigs: [], freeText: false };
     const redacted = redactText(text, probe);
     if (redacted !== text) {
         state.truncated = true; // exact: kept (hashed above, certain credentials replaced)
@@ -361,7 +372,7 @@ function dataMarker(text, feedsSecrets, state, words = null) {
  */
 function printedData(words, feedsSecrets, state) {
     if (state.exact) {
-        const probe = { truncated: false, budget: state.budget, exact: true, sigs: [] };
+        const probe = { truncated: false, budget: state.budget, exact: true, sigs: [], freeText: false };
         return `[data:${sha256(`${HASH_VERSION}\nexact-words\n${JSON.stringify(words.map((word) => redactText(word, probe)))}`)}]`;
     }
     return dataMarker(words.join(' '), feedsSecrets, state, words);
@@ -1039,6 +1050,93 @@ function quoteSignature(command) {
     }
     return parts.join('');
 }
+/**
+ * The program names a stage that feeds a password program may keep in `programs[]`: the seatbelt's compiled-in
+ * KNOWN_COMMANDS and INERT_PROGRAMS (a copy: this module may not import the seatbelt, see test/seatbelt-vendor.test.js;
+ * test/n5-redact-keyed.test.js fails when the tables gain a name this set lacks) and a few secret-store and
+ * PowerShell feeders. Any other first word of such a stage may be the secret itself (`"pw" | smbpasswd -s`).
+ */
+const KNOWN_FEEDER_PROGRAMS = new Set([
+    '.', '[', '[[', 'ack', 'ag', 'alias', 'anaconda', 'apply_patch', 'applypatch', 'ash', 'awk', 'aws', 'az', 'b2sum',
+    'base64', 'basename', 'bash', 'bat', 'bc', 'break', 'bsdtar', 'builtin', 'bun', 'bunx', 'busybox', 'bw', 'bzcat',
+    'bzip2', 'cabal', 'caffeinate', 'cal', 'cargo', 'cat', 'cd', 'cdk', 'changeset', 'changesets', 'chgrp', 'chmod',
+    'chown', 'chrt', 'cksum', 'claude', 'clear', 'cmd', 'cmp', 'colordiff', 'column', 'comm', 'command',
+    'concurrently', 'conda', 'continue', 'convertto-securestring', 'corepack', 'cp', 'cpio', 'csh', 'curl', 'cut',
+    'dart', 'dash', 'date', 'dc', 'dd', 'declare', 'deno', 'df', 'diff', 'diff3', 'dig', 'dirname', 'doas', 'docker',
+    'dotnet', 'du', 'eb', 'echo', 'egrep', 'env', 'eslint', 'eval', 'exa', 'exec', 'exit', 'export', 'expr', 'eza',
+    'false', 'fd', 'fgrep', 'file', 'find', 'firebase', 'fish', 'flit', 'flock', 'flutter', 'fly', 'flyctl', 'fmt',
+    'fold', 'free', 'gawk', 'gcloud', 'gem', 'get-content', 'get-secret', 'getconf', 'getopts', 'gh', 'git', 'git-lfs',
+    'gmake', 'gopass', 'goreleaser', 'gpg', 'gpg2', 'gradle', 'gradlew', 'grep', 'gsed', 'gtar', 'gunzip', 'gzip',
+    'hash', 'hatch', 'head', 'helm', 'help', 'heroku', 'hexdump', 'history', 'host', 'hostname', 'htop', 'http',
+    'https', 'id', 'ifconfig', 'install', 'invoke', 'ionice', 'ip', 'ipython', 'irb', 'jest', 'jobs', 'join', 'jq',
+    'jsr', 'just', 'kill', 'ksh', 'kubectl', 'lein', 'lerna', 'less', 'let', 'ln', 'local', 'locale', 'logger',
+    'lpass', 'ls', 'lsof', 'lua', 'mage', 'make', 'mamba', 'man', 'mapfile', 'marrow', 'marrow-install', 'maturin',
+    'mawk', 'md5sum', 'mix', 'mkdir', 'mksh', 'mktemp', 'mocha', 'more', 'mv', 'mvn', 'mvnw', 'nawk', 'netlify',
+    'netstat', 'nice', 'nl', 'node', 'nodejs', 'nohup', 'notify-send', 'np', 'npm', 'npm-run-all', 'npm-run-all2',
+    'nproc', 'npx', 'nslookup', 'ntl', 'nuget', 'nx', 'od', 'op', 'opam', 'openssl', 'osascript', 'ovsx', 'parallel',
+    'pass', 'paste', 'patch', 'pax', 'pbcopy', 'pbpaste', 'pdm', 'perl', 'pgrep', 'php', 'ping', 'pkexec', 'pnpm',
+    'pod', 'podman', 'poetry', 'popd', 'powershell', 'prettier', 'print', 'printenv', 'printf', 'ps', 'pulumi',
+    'pushd', 'pwd', 'pwgen', 'pwsh', 'python', 'python2', 'python3', 'railway', 'rake', 'rbash', 'read', 'read-host',
+    'readarray', 'readlink', 'readonly', 'realpath', 'rebar3', 'release-it', 'retry', 'return', 'rev', 'rg', 'rimraf',
+    'rm', 'rmdir', 'rsync', 'ruby', 'run-p', 'run-s', 'runas', 'say', 'sbt', 'script', 'secret-tool', 'security',
+    'sed', 'semantic-release', 'seq', 'serverless', 'set', 'setsid', 'sh', 'sha1sum', 'sha256sum', 'sha512sum',
+    'shasum', 'shift', 'shred', 'sleep', 'sls', 'sort', 'source', 'ss', 'ssh', 'ssh-add', 'ssh-keygen', 'ssh-keyscan',
+    'sst', 'stack', 'stat', 'stdbuf', 'strings', 'stty', 'su', 'sudo', 'sync', 'tac', 'tail', 'tar', 'task', 'taskset',
+    'tclsh', 'tcsh', 'tee', 'terraform', 'terragrunt', 'test', 'time', 'timeout', 'tofu', 'top', 'touch', 'toybox',
+    'tput', 'tr', 'trap', 'tree', 'true', 'truncate', 'tsc', 'turbo', 'twine', 'type', 'typeset', 'ulimit', 'umask',
+    'uname', 'unbuffer', 'uniq', 'unlink', 'unset', 'unzip', 'uptime', 'uv', 'vault', 'vercel', 'vitest', 'vsce',
+    'wait', 'watch', 'wc', 'wget', 'whereis', 'which', 'whoami', 'wl-copy', 'wrangler', 'write-host', 'write-output',
+    'xargs', 'xclip', 'xxd', 'xz', 'xzcat', 'yarn', 'yash', 'yes', 'yq', 'zcat', 'zip', 'zsh', 'zstd',
+]);
+/**
+ * Program names the vendored classifier's policy table knows and the set above lacks (psql, mysql, crontab, iptables,
+ * systemctl, ...): a name the classifier judges stays a name in `programs[]`, so withholding unknown words never drops one
+ * (test/n5-full-scope.test.js fails when the table gains a name neither set has).
+ */
+const CLASSIFIER_PROGRAMS = new Set([
+    '7z', 'actionlint', 'ansible', 'ansible-playbook', 'astro', 'base32', 'biome', 'black', 'chpasswd', 'clang-format',
+    'clang_format', 'clickhouse-client', 'cloc', 'code', 'cqlsh', 'createdb', 'crontab', 'dir', 'doctl', 'dropdb',
+    'eksctl', 'emacs', 'enable', 'esbuild', 'fdisk', 'flake8', 'gatsby', 'go', 'gofmt', 'golangci-lint',
+    'golangci_lint', 'hadolint', 'halt', 'husky', 'init', 'iptables', 'isort', 'killall', 'launchctl', 'll',
+    'marrow-agentd', 'marrow-mcp', 'mkfs', 'mkfs.ext4', 'mkfs.xfs', 'mongo', 'mongosh', 'mosh', 'mount', 'mypy',
+    'mysql', 'nano', 'nc', 'ncat', 'next', 'nft', 'nox', 'nuxi', 'nuxt', 'nvim', 'open', 'parcel', 'parted', 'passwd',
+    'pg_dump', 'pg_restore', 'pip', 'pip3', 'pkill', 'pnpx', 'poweroff', 'psql', 'pylint', 'pytest', 'reboot',
+    'redis-cli', 'remix', 'rollup', 'ruff', 'rustfmt', 'scp', 'service', 'sftp', 'shellcheck', 'shopt', 'shutdown',
+    'socat', 'sqlite3', 'storybook', 'stripe', 'supabase', 'swapoff', 'systemctl', 'telnet', 'tokei', 'tox', 'tsup',
+    'ufw', 'umount', 'unxz', 'useradd', 'userdel', 'usermod', 'vim', 'visudo', 'vite', 'webpack', 'webpack-cli',
+    'wipefs', 'xdg-open', 'xh', 'yamllint',
+]);
+/** A lone word (no argument, no redirection) is a program only when it is one of the stdin producers; a lone password is a lone word. */
+const LONE_FEEDER_PROGRAMS = new Set(['cat', 'yes', 'pbpaste']);
+/** Stands in `programs[]` for a withheld first word: constant, derived from nothing about the word. */
+const WITHHELD_FEEDER = 'unlisted-feeder';
+/** Stands in `programs[]` for a program word of a tool that does not run shell text, when it is not a known program. */
+const UNLISTED_PROGRAM = 'unlisted-program';
+/** Whether a program word names a known program (`git.exe`, `npm.cmd` and `wrangler.ps1` are the program they name). */
+function isKnownProgram(program) {
+    const stem = programStem(program).replace(/\.(?:cmd|bat|com)$/, '');
+    return KNOWN_FEEDER_PROGRAMS.has(stem) || CLASSIFIER_PROGRAMS.has(stem);
+}
+/**
+ * Whether a word of a tool that does not run shell text may stay in `programs[]`: a known program, or one of the programs
+ * that take credentials (the table `takesSecrets` reads, and the password program of the SEC1 cases). A name the seatbelt or
+ * the classifier reasons about is never replaced by the marker; the feeder rule below stays on the narrower known set.
+ */
+function isListableProgram(program) {
+    if (isKnownProgram(program))
+        return true;
+    const stem = programStem(program).replace(/\.(?:cmd|bat|com)$/, '');
+    return SECRET_PROGRAMS.has(stem) || stem === 'smbpasswd';
+}
+/** Whether the program of a stage that feeds a password program is a program name rather than possibly a value. */
+function feederNameKept(program, stage) {
+    if (!isKnownProgram(program))
+        return false;
+    if (stage.length !== 1)
+        return true;
+    // Alone, only the exact lower-case name of a stdin producer: no path, no other case (`"Cat" | smbpasswd` is a value).
+    return LONE_FEEDER_PROGRAMS.has(program) && stage[0] === program;
+}
 function normalizeInner(command, state, depth) {
     if (command.length > MAX_COMMAND_CHARS)
         throw new NormalizationLimit();
@@ -1104,9 +1202,24 @@ function normalizeInner(command, state, depth) {
                 depth,
             });
             words.push(...result.words.map(quoteWord));
-            if (result.program && /^[a-z0-9][a-z0-9._+-]{0,63}$/.test(result.program) && !looksLikeKey(result.program) && !programs.includes(result.program)) {
-                programs.push(result.program);
+            let program = result.program;
+            // The first word of a stage that feeds a password program may itself be the secret (PowerShell's
+            // `"pw" | smbpasswd -s` idiom, which the redactor reads as a program name). It is named only when it is a
+            // known program (and, when it stands alone, one of the stdin producers); any other word is withheld as a
+            // fixed marker and the action is never bound. The word stays in the hashed text (keyed for a truncated
+            // action), so two different feeders never share a key.
+            if (program && sinkAfter[k] && !feederNameKept(program, segment.words)) {
+                program = WITHHELD_FEEDER;
+                state.truncated = true; // exact: n/a (programs are not exact material; the hashed text keeps the word)
             }
+            const listed = !!program && /^[a-z0-9][a-z0-9._+-]{0,63}$/.test(program) && !looksLikeKey(program);
+            // A tool that does not run shell text (ToolSearch's query, a prompt, a path, an unknown tool's `command`) is read
+            // as shell words only for classification: its first word is a value, not a program, unless it names a known one.
+            // Not marked truncated: the text hash is keyed, so binding stays safe (see keyTextHash).
+            if (listed && state.freeText && program !== WITHHELD_FEEDER && !isListableProgram(program))
+                program = UNLISTED_PROGRAM;
+            if (listed && !programs.includes(program))
+                programs.push(program);
         }
         const op = segment.op;
         if (op && (op !== ';' || (words.length && words[words.length - 1] !== ';')))
@@ -1194,8 +1307,9 @@ function redactedInput(value, state, depth = 0) {
 function untrimmedShellText(event, trimmed) {
     const input = event.tool_input && typeof event.tool_input === 'object' && !Array.isArray(event.tool_input)
         ? event.tool_input : null;
-    const host = typeof event.tool_input === 'string' ? event.tool_input
-        : typeof input?.command === 'string' ? input.command : typeof input?.cmd === 'string' ? input.cmd : null;
+    const host = (0, hook_tool_policy_1.shellCommandToolText)(event)
+        ?? (typeof event.tool_input === 'string' ? event.tool_input
+            : typeof input?.command === 'string' ? input.command : typeof input?.cmd === 'string' ? input.cmd : null);
     if (host === null || host === trimmed)
         return null;
     const at = host.indexOf(trimmed);
@@ -1210,6 +1324,10 @@ function untrimmedShellText(event, trimmed) {
  * would carry, so both give the same normalized action.
  */
 function shellCommand(event) {
+    // A plain Monitor or PowerShell call: its one command or script text, read as Bash's command.
+    const toolText = (0, hook_tool_policy_1.shellCommandToolText)(event);
+    if (toolText !== null)
+        return toolText.trim();
     const input = event.tool_input && typeof event.tool_input === 'object' && !Array.isArray(event.tool_input)
         ? event.tool_input : null;
     const argv = Array.isArray(input?.command) ? input.command : Array.isArray(input?.cmd) ? input.cmd : null;
@@ -1237,6 +1355,18 @@ function withoutUserName(path, state) {
     state.truncated = true; // exact: n/a (paths are not exact material; the whole input is)
     return `${other[1]}/[user]${path.slice(other[0].length)}`;
 }
+/**
+ * An edit path with each known-format secret span (PATH_KEY_SPAN) replaced by `[secret]`: only the span, so the
+ * extension, `.env.`, `backup-`, the directories and the Windows, `file://` and `~/` forms stay readable for the
+ * service's path classifier. The caller marks the action truncated when a span was replaced or the path is longer than
+ * the scan window (it never binds). Only the first 512 characters of a path are sent: a path longer than the window is
+ * scanned on the window without its last run of token characters (a token that began there and was cut).
+ */
+function redactPathSpans(path) {
+    if (path.length <= PATH_SCAN_CHARS)
+        return path.replace(PATH_KEY_SPAN, SECRET);
+    return path.slice(0, PATH_SCAN_CHARS).replace(/[A-Za-z0-9_.-]+$/, '').replace(PATH_KEY_SPAN, SECRET);
+}
 // ---------------------------------------------------------------------------
 // Deploy command text (the only command text ever sent)
 // ---------------------------------------------------------------------------
@@ -1321,13 +1451,45 @@ function deployCommandText(command) {
 function normalizedWords(_toolWords, trimmed) {
     return trimmed.split(/[ \t]+/).join(' ');
 }
-function inputHash(input, state) {
+/** What `input_sha256` hashes (null: no input). Sets `truncated` when a credential was replaced. */
+function inputPreimage(input, state) {
     if (input === undefined || input === null)
-        return {};
+        return null;
     const text = JSON.stringify(sortedValue(redactedInput(input, state)));
     if (text.includes(SECRET))
         state.truncated = true; // exact: n/a (pass 1 only; exactMaterial is the exact form)
-    return { input_sha256: sha256(`${HASH_VERSION}\ninput\n${text}`) };
+    return `${HASH_VERSION}\ninput\n${text}`;
+}
+function inputHash(input, state) {
+    const preimage = inputPreimage(input, state);
+    return preimage === null ? {} : { input_sha256: sha256(preimage) };
+}
+/** Whether every run option of a Monitor or PowerShell call is a number or a boolean (none: yes). */
+function runOptionsScalar(event) {
+    const options = (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    return options === null || Object.values(options).every((value) => typeof value === 'boolean' || (typeof value === 'number' && Number.isFinite(value)));
+}
+/**
+ * The run options of a Monitor or PowerShell call (timeout, timeout_ms, run_in_background) as key material:
+ * the hash of their canonical JSON with credentials replaced, as any tool input is hashed (so a replaced
+ * credential marks the action truncated here too), or null when the call sets none (and for any other tool).
+ * They decide how long and where the command runs, so an approval of one set is not an approval of another;
+ * `description` is not key material.
+ */
+function runOptionsKey(event, state) {
+    const options = (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    if (options === null)
+        return null;
+    return inputHash(options, state).input_sha256;
+}
+/** runOptionsKey as a standalone identity (no deadline), for the exact target of a call (hook-contract exactHookTarget). */
+function shellToolRunOptionsKey(event) {
+    return runOptionsKey(event, newExactness(Number.POSITIVE_INFINITY));
+}
+/** The exact form of the run options (only certain credentials replaced), for the exact material of a truncated action. */
+function exactRunOptions(event, state) {
+    const options = (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    return options === null ? null : JSON.stringify(sortedValue(redactedInput(options, state)));
 }
 function withExactness(action, state) {
     return state.truncated ? { ...action, truncated: true } : action;
@@ -1335,10 +1497,14 @@ function withExactness(action, state) {
 // ---------------------------------------------------------------------------
 // Exact material for a truncated action (exact_hmac; M2)
 // ---------------------------------------------------------------------------
-const EXACT_DOMAIN = 'marrow-exact-action-v1';
+/** The version tag is part of every MAC input: a value made under another version can never equal one made under this. */
+const EXACT_DOMAIN = 'marrow-exact-action-v2';
+const TEXT_KEY_LABEL = 'marrow-text-hmac-key-v2';
+const TEXT_MAC_DOMAIN = 'marrow-text-hmac-v2';
+const TARGET_MAC_DOMAIN = 'marrow-hook-target-v2';
 /** Raw canonical input past this is never keyed: a nonce instead (it matches nothing). */
 const MAX_RAW_EXACT_CHARS = 1_048_576;
-const EXACT_SALT_NOTE = 'Marrow: the private device key for exact action matching is unavailable or unsafe on this machine, so a held action that hides a value is asked again instead of resumed on retry. Owner: run the Marrow installer doctor command in a terminal.';
+const EXACT_SALT_NOTE = 'Marrow: neither the private device key nor the local approval state for exact action matching is usable on this machine, so a held action is asked again instead of resumed on retry. Owner: run the Marrow installer doctor command in a terminal.';
 /** Canonical JSON (keys sorted at every depth), or null past 1 MB, past 64 levels, or when it cannot be serialized. */
 function canonicalJson(value) {
     const parts = [];
@@ -1433,13 +1599,22 @@ function shellReferences(command) {
 function exactShellForm(text, command, state) {
     return `${text}\n${JSON.stringify(shellReferences(command))}\n${JSON.stringify(state.sigs)}`;
 }
+/** The raw shell text as material; a plain Monitor or PowerShell call also carries its run options (raw). */
+function rawShellMaterial(event, command) {
+    const options = (0, hook_tool_policy_1.shellCommandToolText)(event) === null
+        ? null : (0, hook_tool_policy_1.shellCommandToolRunOptions)(event);
+    if (options === null)
+        return `raw-shell\n${command}`;
+    const json = canonicalJson(options);
+    return json === null ? null : `raw-shell+run\n${json}\n${command}`;
+}
 /** The raw input as material (a placeholder, or an exact pass that hit a limit): the command, or the canonical input. */
 function rawExactMaterial(event, kind) {
     if (kind === 'shell') {
         try {
             const trimmed = shellCommand(event);
             const command = untrimmedShellText(event, trimmed) ?? trimmed;
-            return typeof command === 'string' && command.length <= MAX_RAW_EXACT_CHARS ? `raw-shell\n${command}` : null;
+            return typeof command === 'string' && command.length <= MAX_RAW_EXACT_CHARS ? rawShellMaterial(event, command) : null;
         }
         catch {
             return null;
@@ -1460,10 +1635,14 @@ function exactMaterial(event, kind, deadline) {
         if (kind === 'shell') {
             const trimmed = shellCommand(event);
             const host = untrimmedShellText(event, trimmed);
-            if (host !== null)
-                return bounded(`raw-shell\n${host}`);
+            if (host !== null) {
+                const raw = rawShellMaterial(event, host);
+                return raw === null ? null : bounded(raw);
+            }
             const { text } = normalizeInner(trimmed, state, 0);
-            return bounded(`exact-shell\n${exactShellForm(text, trimmed, state)}`);
+            const runOptions = (0, hook_tool_policy_1.shellCommandToolText)(event) !== null
+                ? exactRunOptions(event, newExactness(deadline, true)) : null;
+            return bounded(`exact-shell${runOptions === null ? '' : `+run\n${runOptions}`}\n${exactShellForm(text, trimmed, state)}`);
         }
         const input = event.tool_input;
         const text = input === undefined || input === null ? 'null' : JSON.stringify(sortedValue(redactedInput(input, state)));
@@ -1474,7 +1653,11 @@ function exactMaterial(event, kind, deadline) {
     }
 }
 let saltNoted = false;
-/** The device salt (seatbelt store, same checks), or null with one stderr line per process (no path, no value). */
+/**
+ * The device salt (the same checks as the receipts store). Without one, the fallback key of the host-approval state
+ * (nokeyFallbackKey: where a hold can be made, the same hashes stay stable, so an approved action is still reported and
+ * committed). null, with one stderr line per process (no path, no value), only when neither key is usable.
+ */
 function exactSalt() {
     let salt = null;
     try {
@@ -1483,6 +1666,14 @@ function exactSalt() {
     catch {
         salt = null;
     }
+    if (!salt) {
+        try {
+            salt = require('./host-approval-state').nokeyFallbackKey();
+        }
+        catch {
+            salt = null;
+        }
+    }
     if (!salt && !saltNoted) {
         saltNoted = true;
         try {
@@ -1501,6 +1692,31 @@ function exactHmac(salt, kind, toolName, material) {
         return (0, node_crypto_1.randomBytes)(16).toString('hex');
     return (0, node_crypto_1.createHmac)('sha256', salt).update(`${EXACT_DOMAIN}\n${kind}\n${JSON.stringify(toolName)}\n`).update(material).digest('hex').slice(0, 32);
 }
+/**
+ * The hash of the text of an action (`command_sha256`, `input_sha256`; every action but a deploy sent in clear):
+ * HMAC-SHA256 under a sub-key of the device salt, 64 hex (the plain hash had the same shape). The text may hold a
+ * value the redactor did not recognise, so a plain hash of it could be brute-forced offline; the key never leaves
+ * this machine. The kind and the host's tool
+ * name are in the input, as for exact_hmac. Without a usable salt it is a random value that matches nothing (the
+ * action is asked again): never the plain hash, never a fixed value.
+ */
+function keyTextHash(salt, kind, toolName, preimage) {
+    if (!salt || salt.length < 16)
+        return (0, node_crypto_1.randomBytes)(32).toString('hex');
+    const key = (0, node_crypto_1.createHmac)('sha256', salt).update(TEXT_KEY_LABEL).digest();
+    return (0, node_crypto_1.createHmac)('sha256', key).update(`${TEXT_MAC_DOMAIN}\n${kind}\n${JSON.stringify(toolName)}\n`).update(preimage).digest('hex');
+}
+/**
+ * The keyed hash of a hold's exact target (hook-contract exactHookTarget): the same sub-key as keyTextHash, its own
+ * domain. null without a usable device key (the caller then makes a target nothing can match).
+ */
+function keyedTargetHash(parts) {
+    const salt = exactSalt();
+    if (!salt || salt.length < 16)
+        return null;
+    const key = (0, node_crypto_1.createHmac)('sha256', salt).update(TEXT_KEY_LABEL).digest();
+    return (0, node_crypto_1.createHmac)('sha256', key).update(`${TARGET_MAC_DOMAIN}\n`).update(JSON.stringify(parts)).digest('hex');
+}
 /**
  * The normalized action of a hook event. `deadlineAt` bounds the time it may
  * take (default one second from now): past it, or past the size limits, the
@@ -1514,9 +1730,9 @@ function exactHmac(salt, kind, toolName, material) {
  * credentials replaced, so two actions that differ anywhere else never share a
  * correlation, hold or key, and a retry that differs only in a certain
  * credential (an OTP) still does. A placeholder keys the raw input (up to
- * 1 MB). Input a host adapter cut or dropped, input over 1 MB and a missing or
- * unsafe salt give a random nonce: the action matches nothing (it is asked
- * again). `salt` is a test seam (undefined: the device salt).
+ * 1 MB). Input a host adapter cut or dropped, input over 1 MB and a machine with neither a
+ * device salt nor a usable host-approval state (exactSalt) give a random nonce: the action matches
+ * nothing (it is asked again). `salt` is a test seam (undefined: the device salt).
  */
 function normalizedHookAction(event, options = {}) {
     const deadline = options.deadlineAt ?? Date.now() + DEFAULT_NORMALIZE_MS;
@@ -1528,17 +1744,24 @@ function normalizedHookAction(event, options = {}) {
     const hostToolName = rawToolName.slice(0, 128);
     if (rawToolName.length > 128)
         state.truncated = true; // exact: kept (the full name is in exact_hmac)
+    // Claude Code built-ins first hooked in 3.9.105 that are not plain shell calls (a native git
+    // equivalent, Skill, a call whose words are not actions, an irregular Monitor or PowerShell call)
+    // are keyed by their whole input, never by one field of it.
     const kind = (0, hook_tool_policy_1.isMcpHookTool)(event.tool_name) || /^MCP:/i.test(hostToolName) ? 'mcp'
-        : (0, hook_tool_policy_1.isShellGovernedTool)(event) ? 'shell'
-            : EDIT_TOOLS.test(toolName) ? 'edit'
-                : 'other';
+        : (0, hook_tool_policy_1.isWholeInputNativeTool)(event) ? 'other'
+            : (0, hook_tool_policy_1.isShellGovernedTool)(event) ? 'shell'
+                : EDIT_TOOLS.test(toolName) ? 'edit'
+                    : 'other';
     const inputCut = event.input_truncated === true;
     if (inputCut)
         state.truncated = true; // exact: nonce (the cut or dropped input is all that is left)
     let action;
+    let preimage = null;
+    let hashField = 'input_sha256';
+    let plain = false;
     let placeholder = false;
     try {
-        action = normalizedOfKind(event, kind, hostToolName, state);
+        ({ action, preimage, hashField, plain } = normalizedOfKind(event, kind, hostToolName, state));
     }
     catch (error) {
         if (!(error instanceof NormalizationLimit))
@@ -1546,20 +1769,35 @@ function normalizedHookAction(event, options = {}) {
         action = { tool_kind: kind, tool_name: hostToolName, tool_input: {}, truncated: true };
         placeholder = true;
     }
-    if (action.truncated !== true)
+    const cut = action.truncated === true;
+    // Nothing to key: the deploy text sent in clear (plain hash, see BuiltAction), or an action with no text hash.
+    if (!cut && (plain || preimage === null))
         return action;
-    const material = inputCut ? null : placeholder ? rawExactMaterial(event, kind) : exactMaterial(event, kind, deadline);
-    const salt = options.salt !== undefined ? options.salt : material === null ? null : exactSalt();
-    return { ...action, tool_input: { ...action.tool_input, exact_hmac: exactHmac(salt, kind, rawToolName, material) } };
+    const material = !cut || inputCut ? null : placeholder ? rawExactMaterial(event, kind) : exactMaterial(event, kind, deadline);
+    const salt = options.salt !== undefined ? options.salt : cut && material === null && preimage === null ? null : exactSalt();
+    // EVERY text hash is keyed, bound or not: the text of any tool field may hold a value the redactor did not see
+    // (a prompt, a message, a plan, a query, a filter, an id, an unknown tool's `command`), and a plain hash of it could be
+    // guessed offline. The key is per install and stable, so the same call on the same install still binds and resumes.
+    const keyed = preimage === null ? {} : { [hashField]: keyTextHash(salt, kind, rawToolName, preimage) };
+    if (!cut)
+        return { ...action, tool_input: { ...action.tool_input, ...keyed } };
+    return { ...action, tool_input: { ...action.tool_input, ...keyed, exact_hmac: exactHmac(salt, kind, rawToolName, material) } };
+}
+/** An action whose tool input is hashed whole (mcp, edit, other). */
+function inputAction(base, input, state) {
+    const preimage = inputPreimage(input, state);
+    const action = { ...base, tool_input: preimage === null ? {} : { input_sha256: sha256(preimage) } };
+    return { action: withExactness(action, state), hashField: 'input_sha256', preimage, plain: false };
 }
 function normalizedOfKind(event, kind, hostToolName, state) {
     if (kind === 'mcp') {
-        return withExactness({ tool_kind: 'mcp', tool_name: hostToolName, tool_input: inputHash(event.tool_input, state) }, state);
+        return inputAction({ tool_kind: 'mcp', tool_name: hostToolName }, event.tool_input, state);
     }
     if (kind === 'shell') {
         const raw = shellCommand(event);
         if (untrimmedShellText(event, raw) !== null)
             state.truncated = true; // exact: raw (the host's untrimmed text)
+        state.freeText = !(0, hook_tool_policy_1.isShellTextTool)(event);
         const { text, programs } = normalizeInner(raw, state, 0);
         // A secret was replaced: the action is never bound or reused (it asks each time).
         if (text.includes(SECRET))
@@ -1569,29 +1807,47 @@ function normalizedOfKind(event, kind, hostToolName, state) {
         const input = event.tool_input && typeof event.tool_input === 'object' && !Array.isArray(event.tool_input) ? event.tool_input : null;
         const exact = typeof input?.command === 'string' ? input.command : typeof input?.cmd === 'string' ? input.cmd : raw;
         const deployText = state.truncated ? null : deployCommandText(exact);
-        return withExactness({
-            tool_kind: 'shell',
-            tool_name: hostToolName,
-            programs,
-            tool_input: {
-                // An exact action also hashes its quoting (never for a truncated one: a secret's characters stay out of it).
-                command_sha256: sha256(`${HASH_VERSION}\nshell\n${state.truncated || !state.sigs.length ? text : `${text}\n${JSON.stringify(state.sigs)}`}`),
-                ...(deployText !== null && deployText === text ? { command: deployText } : {}),
-            },
-        }, state);
+        // A Monitor or PowerShell command carries its host tool name, so it never shares a hash with the
+        // same Bash command (or another tool's): the line after the version is `shell` only for every
+        // other shell call, whose hash is unchanged.
+        // Its run options (timeout, timeout_ms, run_in_background), when it sets any, are in the hash too: a
+        // different line after `shell-tool+run`, so no command text can stand for them.
+        const plainShellTool = (0, hook_tool_policy_1.shellCommandToolText)(event) !== null;
+        const runOptions = plainShellTool ? runOptionsKey(event, state) : null;
+        const domain = !plainShellTool ? 'shell'
+            : runOptions === null ? `shell-tool\n${JSON.stringify(hostToolName)}`
+                : `shell-tool+run\n${JSON.stringify(hostToolName)}\n${runOptions}`;
+        // An exact action also hashes its quoting (never for a truncated one: a secret's characters stay out of it).
+        const preimage = `${HASH_VERSION}\n${domain}\n${state.truncated || !state.sigs.length ? text : `${text}\n${JSON.stringify(state.sigs)}`}`;
+        return {
+            action: withExactness({
+                tool_kind: 'shell',
+                tool_name: hostToolName,
+                programs,
+                tool_input: {
+                    command_sha256: sha256(preimage),
+                    ...(deployText !== null && deployText === text ? { command: deployText } : {}),
+                },
+            }, state),
+            hashField: 'command_sha256',
+            preimage,
+            // Only the grammar-bound deploy text is sent in clear, so only its hash may stay plain (the service binds a deploy
+            // word for word). The run options in the preimage must be numbers or booleans: any other value takes the keyed form.
+            plain: deployText !== null && deployText === text && !state.truncated && runOptionsScalar(event),
+        };
     }
     if (kind === 'edit') {
         const targets = (0, hook_tool_policy_1.toolTargetPaths)(event);
         if (targets.length > 64)
             state.truncated = true; // exact: n/a (paths are not exact material; the whole input is)
         const paths = targets.slice(0, 64).map((path) => {
-            const redacted = redactText(withoutUserName(path, state), state);
-            if (redacted.length > 512 || redacted.includes(SECRET))
+            const redacted = redactPathSpans(redactText(withoutUserName(path, state), state));
+            if (redacted.length > 512 || redacted.includes(SECRET) || path.length > PATH_SCAN_CHARS)
                 state.truncated = true; // exact: n/a (as above)
             return redacted.slice(0, 512);
         });
-        return withExactness({ tool_kind: 'edit', tool_name: hostToolName, paths, tool_input: inputHash(event.tool_input, state) }, state);
+        return inputAction({ tool_kind: 'edit', tool_name: hostToolName, paths }, event.tool_input, state);
     }
-    return withExactness({ tool_kind: 'other', tool_name: hostToolName, tool_input: inputHash(event.tool_input, state) }, state);
+    return inputAction({ tool_kind: 'other', tool_name: hostToolName }, event.tool_input, state);
 }
 //# sourceMappingURL=normalized-action.js.map