@getmarrow/mcp 3.9.103 → 3.9.107

package/dist/hook-tool-policy.js

@@ -1,26 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isOfficialMarrowMcpTool = exports.isOfficialMarrowMcpEvent = void 0;
+exports.SHELL_DIALECT = exports.isOfficialMarrowMcpTool = exports.isOfficialMarrowMcpEvent = void 0;
 exports.normalizeHookToolName = normalizeHookToolName;
 exports.isMcpHookTool = isMcpHookTool;
 exports.isProtectedShellMutation = isProtectedShellMutation;
 exports.hookToolCommand = hookToolCommand;
 exports.parseShellSegments = parseShellSegments;
 exports.normalizedToolPath = normalizedToolPath;
+exports.secretPatternRegex = secretPatternRegex;
 exports.isSecretPath = isSecretPath;
 exports.isProtectedWriteTarget = isProtectedWriteTarget;
 exports.isSecretVariableName = isSecretVariableName;
 exports.shellSegmentVerdict = shellSegmentVerdict;
+exports.policyReadsAllWords = policyReadsAllWords;
 exports.toolTargetPaths = toolTargetPaths;
 exports.isSecretMaterialAccess = isSecretMaterialAccess;
+exports.isSecretMaterialAccessAsNamed = isSecretMaterialAccessAsNamed;
 exports.toolClassificationText = toolClassificationText;
+exports.isShellTextTool = isShellTextTool;
 exports.isShellGovernedTool = isShellGovernedTool;
 exports.isReadOnlyToolEvent = isReadOnlyToolEvent;
+exports.isReadOnlyToolEventAsNamed = isReadOnlyToolEventAsNamed;
+exports.toolPolicyReading = toolPolicyReading;
+exports.readEquivalent = readEquivalent;
+exports.shellCommandToolText = shellCommandToolText;
+exports.shellCommandToolRunOptions = shellCommandToolRunOptions;
+exports.isWholeInputNativeTool = isWholeInputNativeTool;
+const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const own_tool_1 = require("./own-tool");
 Object.defineProperty(exports, "isOfficialMarrowMcpEvent", { enumerable: true, get: function () { return own_tool_1.isOfficialMarrowMcpEvent; } });
 Object.defineProperty(exports, "isOfficialMarrowMcpTool", { enumerable: true, get: function () { return own_tool_1.isOfficialMarrowMcpTool; } });
+const secret_paths_1 = require("./secret-paths");
+/**
+ * Marks the Bash twin of a PowerShell call (toolPolicyReading): its text is PowerShell, not Bash. A symbol,
+ * so no field of a host event or of a tool input (JSON has no symbols) can set or clear it.
+ */
+exports.SHELL_DIALECT = Symbol('marrow.shellDialect');
 const READ_ONLY_TOOLS = new Set([
     'read',
     'read_file',
@@ -83,7 +100,9 @@ const SECRET_STORE_DIRECTORY = /^(?:\.ssh|\.gnupg|\.aws|\.azure|\.kube|\.docker|
 // A plainly named secrets/credentials directory holds secret material, but source code may live in one too.
 const NAMED_SECRET_DIRECTORY = /^(?:secrets?|credentials?)$/i;
 const SECRET_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.dev\.vars|\.git-credentials|\.netrc|_netrc|\.npmrc|\.yarnrc\.ya?ml|\.pypirc|\.pgpass|\.my\.cnf|\.htpasswd|\.?credentials\.(?:json|ya?ml|toml|ini|csv|txt|xml)|secrets?\.(?:json|ya?ml|toml|env|txt)|id_(?:rsa|dsa|ecdsa|ed25519)(?:_[A-Za-z0-9]+)?|.+\.(?:pem|key|p12|pfx|jks|keystore|kdbx|ppk))$/i;
-const ENV_TEMPLATE_FILE = /(?:^|\.)env\.(?:example|sample|template|dist|defaults?)$/i;
+// One list with the keyless seatbelt (ENV_TEMPLATE_WORDS, src/secret-paths.ts): a `.env` template is `.example`, `.sample` or `.template` and nothing else, so
+// `.env.dist`, `.env.defaults` and `.env.default` are secret files in both modes. A test keeps this list equal to the keyless table's.
+const ENV_TEMPLATE_FILE = new RegExp(`(?:^|\\.)env\\.(?:${secret_paths_1.ENV_TEMPLATE_WORDS.join('|')})$`, 'i');
 const SECRET_KEYWORD_FILE = /(?:^|[._-])(?:secrets?|credentials?|tokens?|api[_-]?keys?|passwords?|private[_-]?keys?)(?:[._-]|$)/i;
 const SOURCE_OR_DOC_FILE = /\.(?:[cm]?[jt]sx?|md|mdx|rst|py|rb|go|rs|java|kt|swift|c|cc|cpp|h|hpp|cs|php|sh|bash|zsh|ps1|sql|html|css|scss|vue|svelte|map|snap|lock)$/i;
 const SECRET_VARIABLE_PART = new Set(['KEY', 'APIKEY', 'TOKEN', 'SECRET', 'PASSWORD', 'PASSWD', 'PAT', 'CREDENTIAL', 'CREDENTIALS', 'AUTH']);
@@ -94,6 +113,9 @@ const MAX_SHELL_ANALYSIS_BYTES = 8192;
 // or line separators as word characters, so splitting on them could hide one
 // command inside another; such input takes the conservative whole-command path.
 const UNMODELED_SHELL_CHARACTER = /[\u0000-\u0008\u000b-\u001f\u007f-\u00a0\u00ad\u061c\u1680\u180e\u2000-\u200f\u2028-\u202f\u205f-\u206f\u3000\ufeff\ufff9-\ufffb]/;
+// PowerShell reads the typographic single and double quotation marks as quotes; Bash does not, so
+// a PowerShell text holding one has quoting the splitter cannot follow.
+const POWERSHELL_QUOTE_CHARACTER = /[\u2018-\u201f]/;
 // Programs whose options can execute, write, or change what runs; an expanded
 // variable could supply such an option, so they are not read-only with one.
 const OPTION_SENSITIVE_PROGRAMS = new Set(['find', 'rg', 'sort', 'git', 'gh', 'date', 'env', 'file', 'npm', 'pnpm', 'yarn', 'node', 'npx',
@@ -186,9 +208,12 @@ function hookToolCommand(event) {
  * the words alone (command or process substitution, subshells, heredocs,
  * complex parameter expansion); callers then fall back to whole-command rules.
  */
-function parseShellSegments(command) {
+function parseShellSegments(command, dialect) {
     if (command.length > MAX_SHELL_ANALYSIS_BYTES || UNMODELED_SHELL_CHARACTER.test(command))
         return null;
+    const powershell = dialect === 'powershell';
+    if (powershell && POWERSHELL_QUOTE_CHARACTER.test(command))
+        return null;
     const segments = [];
     let segment = { words: [], outputs: [], inputs: [], expansions: [] };
     let word = '';
@@ -271,7 +296,7 @@ function parseShellSegments(command) {
                 }
                 if (inner === '`')
                     return null;
-                if (inner === '\\' && index + 1 < command.length && '$`"\\\n'.includes(command[index + 1])) {
+                if (!powershell && inner === '\\' && index + 1 < command.length && '$`"\\\n'.includes(command[index + 1])) {
                     if (command[index + 1] !== '\n')
                         word += command[index + 1];
                     index += 2;
@@ -291,7 +316,8 @@ function parseShellSegments(command) {
                 return null;
             continue;
         }
-        if (char === '\\') {
+        // PowerShell's escape is the backtick (unmodeled); a backslash there is a path separator.
+        if (char === '\\' && !powershell) {
             if (next === undefined)
                 return null;
             if (next !== '\n') {
@@ -304,6 +330,9 @@ function parseShellSegments(command) {
         // Braces expand or group commands, so the words would not be what runs.
         if (char === '`' || char === '(' || char === ')' || char === '{')
             return null;
+        // A PowerShell here-string (@' or @") holds lines of text up to a closing quote at a line start: not words.
+        if (powershell && char === '@' && (next === "'" || next === '"'))
+            return null;
         if (char === '$') {
             const consumed = expansion(index);
             if (consumed < 0)
@@ -423,7 +452,7 @@ function secretPath(value, base) {
         return true;
     if (!SOURCE_OR_DOC_FILE.test(name) && directories.some((part) => NAMED_SECRET_DIRECTORY.test(part)))
         return true;
-    if (/^\/proc\/[^/]+\/environ$/.test(path) || /^\/etc\/g?shadow$/.test(path))
+    if (secret_paths_1.PROC_ENVIRON.test(path) || /^\/etc\/g?shadow$/.test(path))
         return true;
     // Claude Code local settings can carry agent keys in their env block.
     if (name === 'settings.local.json' && parts[parts.length - 2] === '.claude')
@@ -434,8 +463,53 @@ function secretPath(value, base) {
         return false;
     if (SECRET_FILE.test(name))
         return true;
+    // One table: every path the keyless seatbelt stops as a secret (S4) is a secret here too.
+    // Only the last 4096 characters (PATH_MAX) are read: the patterns end at `$`, and a two-`**`
+    // pattern backtracks quadratically, so an unbounded path could stall the hook past its timeout.
+    const tail = path.length > SECRET_PATH_TABLE_CHARS ? path.slice(-SECRET_PATH_TABLE_CHARS) : path;
+    if (SEATBELT_SECRET_PATHS.some((pattern) => pattern.test(tail)) || secret_paths_1.APPROVAL_STATE_TREE.test(tail))
+        return true;
     return SECRET_KEYWORD_FILE.test(name) && !SOURCE_OR_DOC_FILE.test(name);
 }
+/**
+ * A SECRET_PATTERNS glob (src/secret-paths.ts) as a regex, the way the vendored classifier's globToRegex reads
+ * it (the table holds only `**`/`*` globs, home-agnostic `**`/ prefixes and absolute paths).
+ */
+function secretPatternRegex(pattern) {
+    let p = pattern;
+    let anchored = true;
+    if (p.startsWith('**/')) {
+        anchored = false;
+        p = p.slice(3);
+    }
+    let out = '';
+    for (let i = 0; i < p.length; i += 1) {
+        const ch = p[i];
+        if (ch === '*' && p[i + 1] === '*') {
+            if (p[i + 2] === '/') {
+                out += '(?:.*/)?';
+                i += 2;
+            }
+            else if (out.endsWith('/') && i + 2 === p.length) {
+                out = `${out.slice(0, -1)}(?:/.*)?`;
+                i += 1;
+            }
+            else {
+                out += '.*';
+                i += 1;
+            }
+        }
+        else if (ch === '*')
+            out += '[^/]*';
+        else if (ch === '?')
+            out += '[^/]';
+        else
+            out += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`${anchored ? '^' : '(?:^|/)'}${out}$`);
+}
+const SEATBELT_SECRET_PATHS = secret_paths_1.SECRET_PATTERNS.map(secretPatternRegex);
+const SECRET_PATH_TABLE_CHARS = 4096;
 // A glob such as .env* or *.pem names secret files without spelling one out.
 function globVariants(value) {
     if (!/[*?[]/.test(value))
@@ -447,6 +521,37 @@ function globVariants(value) {
 function isSecretPath(value, base = process.cwd()) {
     return pathCandidates(String(value || '')).flatMap(globVariants).some((candidate) => secretPath(candidate, base));
 }
+/** The host-approvals folder, or ~/.marrow that holds it: a search tool that walks either reads the state file. */
+function isApprovalStateFolder(value, base = process.cwd()) {
+    const folder = node_path_1.posix.join(homeDirectory(), '.marrow', 'host-approvals').toLowerCase();
+    return pathCandidates(String(value || '')).some((candidate) => {
+        const walked = normalizedToolPath(candidate, base).replace(/\/+$/, '').toLowerCase();
+        return walked === folder || walked === node_path_1.posix.dirname(folder);
+    });
+}
+/** A process folder (`/proc`, `/proc/self/task`): a search tool that walks it reads the `environ` of every process under it. */
+function isProcessFolder(value, base = process.cwd()) {
+    return pathCandidates(String(value || '')).some((candidate) => secret_paths_1.PROC_PROCESS_TREE.test(normalizedToolPath(candidate, base)));
+}
+/**
+ * True when a path the tool names is a symbolic link, or goes through one, to a secret file (or, for a write, to a protected one): a read or an edit
+ * through it is of the file it points at, whatever the link is called. Only a path that exists and resolves elsewhere is read; nothing else changes.
+ */
+function secretThroughLink(value, write, base = process.cwd()) {
+    return pathCandidates(String(value || '')).some((candidate) => {
+        let real;
+        try {
+            const lexical = normalizedToolPath(candidate, base);
+            real = (0, node_fs_1.realpathSync)(lexical);
+            if (real === lexical)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        return write ? isProtectedWriteTarget(real) : isSecretPath(real);
+    });
+}
 /** True for a secret file or Marrow's own local control state. */
 function isProtectedWriteTarget(value, base = process.cwd()) {
     return pathCandidates(String(value || '')).flatMap(globVariants).some((candidate) => secretPath(candidate, base)
@@ -577,8 +682,15 @@ function readOnlyProgramInvocation(program, args) {
         return !args.some((arg) => /^-[A-Za-z]*C/.test(arg) || longOptionPrefix(arg, ['compile']));
     return true;
 }
-/** Classifies one simple command: a read-only inspection, a secret access, or anything else. */
-function shellSegmentVerdict(segment, cwd = process.cwd()) {
+/**
+ * Classifies one simple command: a read-only inspection, a secret access, or anything else.
+ * In the PowerShell dialect no command is a read-only inspection and no program is exempt from
+ * the content-read check (Bash's allowlists name Bash programs; `type` and `cat` read files in
+ * PowerShell, and `ls env:` and `echo $env:X` print the environment): every word is judged as a
+ * file a command may read.
+ */
+function shellSegmentVerdict(segment, cwd = process.cwd(), dialect) {
+    const powershell = dialect === 'powershell';
     // After a cd Marrow cannot follow, relative paths are unknown, so nothing that follows is read-only.
     const base = cwd ?? process.cwd();
     const secret = (value) => isSecretPath(value, base);
@@ -587,7 +699,7 @@ function shellSegmentVerdict(segment, cwd = process.cwd()) {
     if (segment.inputs.some(secret) || writes.some(protectedTarget))
         return 'secret';
     if (!segment.words.length)
-        return writes.length || cwd === null ? 'other' : 'read';
+        return writes.length || cwd === null || powershell ? 'other' : 'read';
     // A leading assignment can redirect a pager or helper into arbitrary code.
     const program = /^[A-Za-z_][A-Za-z0-9_]*=/.test(segment.words[0]) ? null : programName(segment.words[0]);
     const args = segment.words.slice(1);
@@ -607,12 +719,15 @@ function shellSegmentVerdict(segment, cwd = process.cwd()) {
             return 'secret';
         if (program === 'cd' && args.some(secret))
             return 'secret';
-        if (!NON_CONTENT_BASH_COMMANDS.has(program)) {
+        if (powershell || !NON_CONTENT_BASH_COMMANDS.has(program)) {
             const targets = ['grep', 'egrep', 'fgrep', 'rg', 'jq'].includes(program) ? contentReadTargets(program, args) : args.filter((arg) => !arg.startsWith('-') || arg.includes('='));
             if (targets.some(secret))
                 return 'secret';
         }
-        return writes.length || cwd === null ? 'other' : 'read';
+        // A PowerShell parameter binds its value in the same word (-Path:.env).
+        if (powershell && segment.words.some(protectedTarget))
+            return 'secret';
+        return writes.length || cwd === null || powershell ? 'other' : 'read';
     }
     return segment.words.some(protectedTarget) ? 'secret' : 'other';
 }
@@ -627,18 +742,36 @@ function nextWorkingDirectory(segment, cwd) {
         return null;
     return normalizedToolPath(targets[0], cwd);
 }
-function shellAnalysis(command) {
-    const segments = parseShellSegments(command);
+/** `parse`: the dialect the words are split in; `dialect`: the dialect the simple commands are judged in (default: the same). */
+function shellAnalysis(command, dialect, parse = dialect) {
+    const segments = parseShellSegments(command, parse === 'bash' ? undefined : parse);
     if (!segments)
         return null;
     let cwd = process.cwd();
     const verdicts = segments.map((segment) => {
-        const verdict = shellSegmentVerdict(segment, cwd);
+        const verdict = shellSegmentVerdict(segment, cwd, dialect);
         cwd = nextWorkingDirectory(segment, cwd);
         return verdict;
     });
     return { segments, verdicts };
 }
+/**
+ * True when the policy's own reading is the whole answer for a shell command: it parses, every simple command in it is a recognised read-only
+ * program (a `cat`, `grep`, `ls`, `jq`, `ps`, never a wrapper such as `bash -c`, `eval`, `sudo`, `ssh`, `xargs` or a program that writes), and no word
+ * holds a glob, a brace or a variable (those can spell a name the text does not hold). Such a command names its files in the words the policy already
+ * judges, so a second reading of it by the mapper could only add the mapper's own over-stops (the pattern or filter operand of `grep .env README.md`).
+ */
+function policyReadsAllWords(command) {
+    try {
+        const analysis = shellAnalysis(command);
+        if (!analysis?.segments.length || !analysis.verdicts.every((verdict) => verdict === 'read'))
+            return false;
+        return analysis.segments.every((segment) => segment.expansions.length === 0 && ![...segment.words, ...segment.inputs, ...segment.outputs].some((word) => /[*?[{]/.test(word)));
+    }
+    catch {
+        return false;
+    }
+}
 function stringLeaves(value, depth = 0, output = []) {
     if (output.length >= 64 || depth > 4)
         return output;
@@ -684,18 +817,44 @@ function shellCommandText(event) {
 /**
  * True when a tool reads secret or credential material, or writes a secret file
  * or Marrow's local control state. Unparseable shell falls back to a token scan.
+ * A Monitor command, and any shell text another tool carries, is read as Bash
+ * reads its command; a PowerShell command in the PowerShell dialect, which
+ * reads every word as a file the command may read (toolPolicyReading).
  */
-function isSecretMaterialAccess(event) {
+function isSecretMaterialAccess(event, printsEnvironment) {
+    const reading = toolPolicyReading(event);
+    if (reading.shell.some((twin) => isSecretMaterialAccessAsNamed(twin, printsEnvironment)))
+        return true;
+    if (reading.exact)
+        return false;
+    if (reading.base === 'read')
+        return isSecretMaterialAccessAsNamed(readEquivalent(event), printsEnvironment);
+    return reading.base === 'named' && isSecretMaterialAccessAsNamed(event, printsEnvironment);
+}
+/** isSecretMaterialAccess for the call's own tool name only (every tool before the built-ins were hooked). */
+function isSecretMaterialAccessAsNamed(event, printsEnvironment) {
     const tool = normalizeHookToolName(event.tool_name);
     if (CONTENT_READ_TOOLS.has(tool))
-        return toolTargetPaths(event).some((path) => isSecretPath(path));
+        return toolTargetPaths(event).some((path) => isSecretPath(path) || secretThroughLink(path, false) || (tool === 'grep' && (isProcessFolder(path) || isApprovalStateFolder(path))));
     if (FILE_EDIT_TOOLS.has(tool))
-        return toolTargetPaths(event).some((path) => isProtectedWriteTarget(path));
+        return toolTargetPaths(event).some((path) => isProtectedWriteTarget(path) || secretThroughLink(path, true));
     if (!SHELL_TOOLS.has(tool))
         return false;
     const command = shellCommandText(event);
-    const analysis = shellAnalysis(command);
-    if (analysis)
+    if (printsEnvironment && event[exports.SHELL_DIALECT] !== 'powershell' && printsEnvironment(command))
+        return true;
+    const analysis = shellAnalysis(command, event[exports.SHELL_DIALECT]);
+    if (event[exports.SHELL_DIALECT] === 'powershell') {
+        // The words are split as PowerShell splits them; text whose quoting Bash splits differently (an escaped quote,
+        // a typographic quote) is also split as Bash splits it, judged with no allowlist: a secret either finds is one.
+        // Where either split cannot be modelled, every token of the text is judged as a path.
+        const asBash = shellAnalysis(command, 'powershell', 'bash');
+        if (analysis?.verdicts.includes('secret') || asBash?.verdicts.includes('secret'))
+            return true;
+        if (analysis && asBash)
+            return false;
+    }
+    else if (analysis)
         return analysis.verdicts.includes('secret');
     return command.split(/[\s'"`;&|<>(){}]+/).some((token) => isProtectedWriteTarget(token));
 }
@@ -712,7 +871,7 @@ function toolClassificationText(event) {
         return [tool, ...toolTargetPaths(event)].join(' ');
     const command = hookToolCommand(event);
     if (SHELL_TOOLS.has(tool)) {
-        const analysis = shellAnalysis(shellCommandText(event));
+        const analysis = shellAnalysis(shellCommandText(event), event[exports.SHELL_DIALECT]);
         if (analysis) {
             return [tool, ...analysis.segments
                     .filter((_, index) => analysis.verdicts[index] !== 'read')
@@ -728,6 +887,17 @@ function toolClassificationText(event) {
     }
     return `${tool} ${command} ${serialized}`;
 }
+/**
+ * Whether a tool runs its text as a shell command: Bash and the other terminal tools (Codex exec, Cursor Shell, ...),
+ * Monitor and PowerShell. Every other tool whose text is read as shell words (ToolSearch, a prompt, a path, an unknown
+ * tool's `command`) only borrows the parser, so no word of it is known to be a program.
+ */
+function isShellTextTool(event) {
+    if (isMcpHookTool(event.tool_name))
+        return false;
+    const tool = normalizeHookToolName(event.tool_name);
+    return SHELL_TOOLS.has(tool) || SHELL_COMMAND_TOOLS.has(tool);
+}
 /** Editing and task tools are judged by their target, not by shell-like text in their input. */
 function isShellGovernedTool(event) {
     const tool = normalizeHookToolName(event.tool_name);
@@ -742,14 +912,37 @@ function pathOnlyInput(value) {
         && keys.every((key) => ['path', 'file_path', 'filename', 'target_file'].includes(key))
         && Object.values(input).every((item) => typeof item === 'string' && item.trim().length > 0);
 }
+/**
+ * Whether a call only reads. A shell reading (Monitor, a native git
+ * equivalent) is read-only exactly when Bash running its text is; a PowerShell
+ * call never is (Bash's read-only commands are Bash's); any other
+ * call carrying shell text is read-only only when both its own reading and
+ * Bash running the text are (never more than before).
+ */
 function isReadOnlyToolEvent(event) {
+    const reading = toolPolicyReading(event);
+    if (reading.dialect === 'powershell')
+        return false;
+    const shellReadOnly = reading.shell.every((twin) => isReadOnlyToolEventAsNamed(twin));
+    if (reading.exact)
+        return reading.shell.length > 0 && shellReadOnly;
+    const own = reading.base === 'read' ? isReadOnlyToolEventAsNamed(readEquivalent(event))
+        : reading.base === 'non_acting' ? false
+            : isReadOnlyToolEventAsNamed(event);
+    return own && shellReadOnly;
+}
+/** isReadOnlyToolEvent for the call's own tool name only (every tool before the built-ins were hooked). */
+function isReadOnlyToolEventAsNamed(event, printsEnvironment) {
     const tool = normalizeHookToolName(event.tool_name);
     if (!tool)
         return false;
+    // Nothing PowerShell runs is a read-only inspection: the Bash twin of a PowerShell call never is.
+    if (event[exports.SHELL_DIALECT] === 'powershell')
+        return false;
     if (LOCAL_TASK_TOOLS.has(tool))
         return true;
     if (READ_ONLY_TOOLS.has(tool))
-        return !isSecretMaterialAccess(event);
+        return !isSecretMaterialAccess(event, printsEnvironment);
     if (['edit', 'write', 'multiedit', 'search_replace', 'run_terminal_command', 'spawn_subagent'].includes(tool))
         return false;
     if (MUTATION_TOOL_VERB.test(tool))
@@ -758,6 +951,9 @@ function isReadOnlyToolEvent(event) {
         return true;
     const command = hookToolCommand(event);
     if (tool === 'bash' && command) {
+        // Printing the environment is never a read-only inspection.
+        if (printsEnvironment && printsEnvironment(shellCommandText(event)))
+            return false;
         // A compound command is read-only only when every simple command in it is.
         const analysis = shellAnalysis(shellCommandText(event));
         return Boolean(analysis?.segments.length && analysis.verdicts.every((verdict) => verdict === 'read'));
@@ -766,4 +962,141 @@ function isReadOnlyToolEvent(event) {
         && pathOnlyInput(event.tool_input)
         && !toolTargetPaths(event).some((path) => isSecretPath(path));
 }
+// ---------------------------------------------------------------------------
+// How a call is read for classification. Keys always keep the call's
+// own tool name and input (normalized-action, hook-contract).
+// ---------------------------------------------------------------------------
+// Claude Code tools that run their `command` (or `script`) as a shell command: Monitor in the same
+// shell environment as Bash, PowerShell in PowerShell. Any case or padding of the name. Monitor's
+// text goes through Bash's rules exactly. PowerShell's does not: Bash's allowlists name Bash
+// programs (`type`, `cat`, `find`, `ls`, `echo` read or print different things in PowerShell), so a
+// PowerShell call is never read-only and is classified as the stricter of its own (named) reading
+// and Bash's reading of its text with no allowlist applied (the PowerShell dialect of the splitter).
+const SHELL_COMMAND_TOOLS = new Set(['monitor', 'powershell']);
+// How long a Monitor or PowerShell call may run and whether it runs in the background: they are
+// part of what is approved (a short-timeout approval is not a long-timeout one).
+const SHELL_COMMAND_TOOL_RUN_FIELDS = ['timeout', 'timeout_ms', 'run_in_background'];
+// The fields a Monitor or PowerShell call may carry besides its shell text without changing what runs.
+const SHELL_COMMAND_TOOL_FIELDS = new Set(['description', ...SHELL_COMMAND_TOOL_RUN_FIELDS]);
+// Tools whose `command` names something other than shell text (a slash command, a skill, an editor
+// operation), and Workflow, whose `script` is JavaScript that only starts sub-agents.
+const NON_SHELL_COMMAND_TOOLS = new Set(['slashcommand', 'skill', 'str_replace_editor', 'str_replace_based_edit_tool', 'workflow']);
+// Claude Code built-ins that run a fixed local git command (exact host label): read as Bash running it.
+const NATIVE_SHELL_EQUIVALENTS = new Map([
+    ['EnterWorktree', 'git worktree add'],
+    ['ExitWorktree', 'git worktree remove'],
+]);
+// Claude Code built-ins no released Marrow matcher hooked that never act themselves (exact host
+// label): what they lead to (a sub-agent's tools, a scheduled prompt, the agent's next step after a
+// fetch, a message or a question) reaches the hook on its own. As for task bookkeeping, words in
+// their prompt, message, plan or URL are not performed by the call, so they never make it
+// protected; the call is still reported to Marrow (never read-only). Monitor is here only without
+// shell text (its WebSocket source). The tools that only report, notify, structure output, render or
+// hand text back, and what each one does:
+//   Artifact, ArtifactCheck, ArtifactComments, ArtifactData: the host's artifact pane (render a page
+//     for the user, check it, comment on it, give it data); no command, no local file.
+//   ListAgents: lists the agents SendMessage can reach.
+//   PushNotification: a desktop or phone notification with a one-line `message`.
+//   ReportFindings: hands a code review's findings to the host UI to render.
+//   StructuredOutput: hands the final structured result back to the caller.
+//   SubagentHandback: hands a sub-agent's text back to the agent that started it.
+//   Workflow: its `script` (JavaScript) only starts sub-agents, whose own tools reach the hook.
+// Tools a released matcher already hooked keep their reading (BashOutput, NotebookRead,
+// ReadMcpResourceTool, Task*, TodoWrite, ToolSearch); RemoteTrigger and DesignSync act on remote
+// services and stay as named.
+const NON_ACTING_NATIVE_TOOLS = new Set(['Agent', 'SendMessage', 'WebFetch', 'AskUserQuestion', 'EnterPlanMode', 'ExitPlanMode',
+    'SlashCommand', 'CronCreate', 'CronDelete', 'CronList', 'ScheduleWakeup', 'KillShell', 'Monitor',
+    'Artifact', 'ArtifactCheck', 'ArtifactComments', 'ArtifactData', 'ListAgents', 'PushNotification', 'ReportFindings',
+    'StructuredOutput', 'SubagentHandback', 'Workflow']);
+// Claude Code's Skill loads a skill's instructions (exact host label): read as Read.
+const READ_EQUIVALENT_NATIVE_TOOLS = new Set(['Skill']);
+function bashTwin(command) {
+    return { tool_name: 'Bash', tool_input: { command } };
+}
+function powerShellTwin(command) {
+    return { tool_name: 'Bash', tool_input: { command }, [exports.SHELL_DIALECT]: 'powershell' };
+}
+/** The string `command` and `script` texts of a call that are not blank (both when both are set). */
+function shellTexts(event) {
+    const input = asRecord(event.tool_input);
+    if (!input)
+        return [];
+    const texts = [];
+    for (const key of ['command', 'script']) {
+        const value = input[key];
+        if (typeof value === 'string' && value.trim() && !texts.includes(value))
+            texts.push(value);
+    }
+    return texts;
+}
+function toolPolicyReading(event) {
+    const named = { base: 'named', shell: [], exact: false, bashLabel: false };
+    const tool = normalizeHookToolName(event.tool_name);
+    // Bash and the other shell tools are read as they always were; Marrow's own and MCP calls keep their reading plus any shell text.
+    if (!tool || SHELL_TOOLS.has(tool))
+        return named;
+    const label = typeof event.tool_name === 'string' ? event.tool_name : '';
+    const texts = NON_SHELL_COMMAND_TOOLS.has(tool) ? [] : shellTexts(event);
+    const equivalent = isMcpHookTool(event.tool_name) ? undefined : NATIVE_SHELL_EQUIVALENTS.get(label);
+    if (equivalent !== undefined)
+        return { base: 'named', shell: [equivalent, ...texts].map(bashTwin), exact: true, bashLabel: false };
+    if (tool === 'monitor' && texts.length && !isMcpHookTool(event.tool_name)) {
+        return { base: 'named', shell: texts.map(bashTwin), exact: true, bashLabel: true };
+    }
+    // PowerShell: the stricter of its named reading and Bash's reading of the text in the PowerShell dialect.
+    if (tool === 'powershell' && texts.length && !isMcpHookTool(event.tool_name)) {
+        return { base: 'named', shell: texts.map(powerShellTwin), exact: false, bashLabel: false, dialect: 'powershell' };
+    }
+    const base = isMcpHookTool(event.tool_name) ? 'named'
+        : READ_EQUIVALENT_NATIVE_TOOLS.has(label) ? 'read'
+            : NON_ACTING_NATIVE_TOOLS.has(label) ? 'non_acting'
+                : 'named';
+    return { base, shell: texts.map(bashTwin), exact: false, bashLabel: false };
+}
+/** The Read call a Read-equivalent tool is read as (same input). */
+function readEquivalent(event) {
+    return { tool_name: 'Read', tool_input: event.tool_input };
+}
+/**
+ * The shell text of a plain Monitor or PowerShell call (one command or script string, no field
+ * that changes what runs besides it), else null. Only such a call is keyed as shell text.
+ */
+function shellCommandToolText(event) {
+    if (isMcpHookTool(event.tool_name) || !SHELL_COMMAND_TOOLS.has(normalizeHookToolName(event.tool_name)))
+        return null;
+    const input = asRecord(event.tool_input);
+    if (!input)
+        return null;
+    const texts = Object.keys(input).filter((key) => !SHELL_COMMAND_TOOL_FIELDS.has(key));
+    if (texts.length !== 1 || !['command', 'script'].includes(texts[0]))
+        return null;
+    const value = input[texts[0]];
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+/**
+ * The run options (`timeout`, `timeout_ms`, `run_in_background`) a Monitor or PowerShell call carries, in a
+ * fixed order and as sent, or null for any other call or when it carries none. They are part of the key
+ * of the call (normalized-action, hook-contract exactHookTarget); `description` is not.
+ */
+function shellCommandToolRunOptions(event) {
+    if (isMcpHookTool(event.tool_name) || !SHELL_COMMAND_TOOLS.has(normalizeHookToolName(event.tool_name)))
+        return null;
+    const input = asRecord(event.tool_input);
+    if (!input)
+        return null;
+    const options = {};
+    for (const key of SHELL_COMMAND_TOOL_RUN_FIELDS) {
+        if (Object.prototype.hasOwnProperty.call(input, key))
+            options[key] = input[key];
+    }
+    return Object.keys(options).length ? options : null;
+}
+/** A Claude Code built-in keyed by its whole input (a native git equivalent, Skill, or a call whose words are not actions). */
+function isWholeInputNativeTool(event) {
+    const reading = toolPolicyReading(event);
+    if ((reading.exact && !reading.bashLabel) || reading.base !== 'named')
+        return true;
+    // A Monitor or PowerShell call is keyed as shell text only when it is a plain one.
+    return ((reading.exact && reading.bashLabel) || reading.dialect === 'powershell') && shellCommandToolText(event) === null;
+}
 //# sourceMappingURL=hook-tool-policy.js.map