@getmarrow/mcp 3.9.108 → 3.9.110

package/dist/ipv4-first.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preferIpv4FirstWithHappyEyeballs = preferIpv4FirstWithHappyEyeballs;
+const dns = __importStar(require("node:dns"));
+const net = __importStar(require("node:net"));
+let applied = false;
+/**
+ * N1: the pre-action hook dials the Marrow API with IPv4 tried first and happy eyeballs on, so an IPv6 address that does not
+ * route (the resolver lists it first) cannot hold the hook past the host's budget. Transport only: the host, port, path and
+ * headers of every request are unchanged. Set once, before the first request; an older Node without either setting skips it.
+ */
+function preferIpv4FirstWithHappyEyeballs() {
+    if (applied)
+        return;
+    applied = true;
+    try {
+        if (typeof dns.setDefaultResultOrder === 'function')
+            dns.setDefaultResultOrder('ipv4first');
+    }
+    catch { /* older Node */ }
+    try {
+        if (typeof net.setDefaultAutoSelectFamily === 'function')
+            net.setDefaultAutoSelectFamily(true);
+    }
+    catch { /* older Node */ }
+}
+//# sourceMappingURL=ipv4-first.js.map

package/dist/ipv4-first.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipv4-first.js","sourceRoot":"","sources":["../src/ipv4-first.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,4EAKC;AAfD,8CAAgC;AAChC,8CAAgC;AAEhC,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB;;;;GAIG;AACH,SAAgB,gCAAgC;IAC9C,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QAAC,IAAI,OAAO,GAAG,CAAC,qBAAqB,KAAK,UAAU;YAAE,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC/H,IAAI,CAAC;QAAC,IAAI,OAAO,GAAG,CAAC,0BAA0B,KAAK,UAAU;YAAE,GAAG,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACpI,CAAC"}

package/dist/key-class.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The class (live or test) of a Stripe-style key (`sk_`, `rk_`, `pk_`) inside a span that a redactor is about to
+ * replace, so the marker that stands for the span keeps the class: an approval, a hold or a correlation made for an
+ * action with a test key can never cover the same action with a live key.
+ *
+ * Fail closed: the answer is `test` only when every key-shaped token of the span is the exact lowercase ASCII
+ * `sk_test_` / `rk_test_` / `pk_test_` shape. A live prefix in any spelling the text can be folded to (case, a
+ * `-` for the `_`, NFKC/NFKD-foldable forms, zero-width / format / combining characters, percent or Basic-auth base64
+ * encoding), an unknown or malformed prefix, or a test prefix that is not exactly canonical, is `live`. A span with
+ * no such token has no class (`null`): its marker stays what it was. The class is read, never copied: callers pick a
+ * marker from a closed set of constants.
+ */
+export type KeyClass = 'live' | 'test';
+/** The class of the Stripe-style key(s) in `span`, or null when it holds none. Linear in the span. */
+export declare function keyClassOf(span: string): KeyClass | null;
+//# sourceMappingURL=key-class.d.ts.map

package/dist/key-class.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-class.d.ts","sourceRoot":"","sources":["../src/key-class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAsBvC,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CASxD"}

package/dist/key-class.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyClassOf = keyClassOf;
+/** Format, combining and control characters (zero-width space and joiners, BOM, soft hyphen, bidi marks, accents, NUL). */
+const HIDDEN = /[\p{Cf}\p{Mn}\p{Me}\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu;
+const LIVE_TOKEN = /(?<![a-z0-9])(?:sk|rk|pk)[_-]live/;
+/** `sk_` and more that is neither `test` nor `live`: an unknown or malformed class (`sk_prod_…`, `sk_…`). */
+const UNKNOWN_TOKEN = /(?<![a-z0-9])(?:sk|rk|pk)_(?!test)[a-z0-9_-]{12,}/;
+const TEST_TOKEN = /(?<![a-z0-9])(?:sk|rk|pk)[_-]test/g;
+const CANONICAL_TEST = /(?<![A-Za-z0-9])(?:sk|rk|pk)_test_[A-Za-z0-9_-]{12,}/g;
+const PLAIN_ASCII = /^[\t\n\r\x20-\x7e]*$/;
+const BASE64_SPAN = /^\s*(?:Basic\s+)?([A-Za-z0-9+/]{16,4096}={0,2})\s*$/i;
+const PERCENT = /%([0-9A-Fa-f]{2})/g;
+/** The span with the readings a backend or a client may give it added after it (percent escapes, Basic-auth base64). */
+function withReadings(span) {
+    let probe = span;
+    if (span.includes('%'))
+        probe += `\n${span.replace(PERCENT, (_m, hex) => String.fromCharCode(parseInt(hex, 16)))}`;
+    const basic = BASE64_SPAN.exec(span);
+    if (basic)
+        probe += `\n${Buffer.from(basic[1], 'base64').toString('latin1')}`;
+    return probe;
+}
+/** The class of the Stripe-style key(s) in `span`, or null when it holds none. Linear in the span. */
+function keyClassOf(span) {
+    const probe = withReadings(span);
+    // NFKD, not NFKC: an accent composed onto a letter (`i` + U+0301) must come apart so the mark can be dropped.
+    const folded = probe.normalize('NFKD').toLowerCase().replace(HIDDEN, '');
+    if (LIVE_TOKEN.test(folded) || UNKNOWN_TOKEN.test(folded))
+        return 'live';
+    const tests = folded.match(TEST_TOKEN);
+    if (!tests)
+        return null;
+    const canonical = probe.match(CANONICAL_TEST);
+    return PLAIN_ASCII.test(probe) && canonical !== null && canonical.length === tests.length ? 'test' : 'live';
+}
+//# sourceMappingURL=key-class.js.map

package/dist/key-class.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-class.js","sourceRoot":"","sources":["../src/key-class.ts"],"names":[],"mappings":";;AAmCA,gCASC;AA9BD,2HAA2H;AAC3H,MAAM,MAAM,GAAG,oEAAoE,CAAC;AACpF,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,6GAA6G;AAC7G,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAC1E,MAAM,UAAU,GAAG,oCAAoC,CAAC;AACxD,MAAM,cAAc,GAAG,uDAAuD,CAAC;AAC/E,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC,wHAAwH;AACxH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,KAAK,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3H,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK;QAAE,KAAK,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sGAAsG;AACtG,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,8GAA8G;IAC9G,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9G,CAAC"}

package/dist/keyless-notice.d.ts

@@ -0,0 +1,10 @@
+/**
+ * MCP-5: a hook that runs with local control on and no API key records nothing, so nothing tells the person that holds and approvals are
+ * not being recorded. This puts one user-visible notice per host session through the host's `systemMessage` field: the first keyless hook
+ * call of a session (a local marker keyed by a hash of the session id, mode 600, says it was sent) adds it to the hook's own JSON output,
+ * or prints it alone when the hook prints nothing. Names only: no variable value is ever read into the text. Claude Code only, the one
+ * host whose hook output carries `systemMessage` for every event; other hosts keep their exact output.
+ */
+export declare const KEYLESS_NOTICE_TEXT = "Marrow hooks in this session have no API key, so holds and approvals are NOT recorded. Put MARROW_API_KEY in ~/.marrow/env (chmod 600) or start the host with it, then restart the session.";
+export declare function armKeylessNotice(harness: string, sessionId: unknown): boolean;
+//# sourceMappingURL=keyless-notice.d.ts.map

package/dist/keyless-notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-notice.d.ts","sourceRoot":"","sources":["../src/keyless-notice.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,gMAAgM,CAAC;AAIjO,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAyB7E"}

package/dist/keyless-notice.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYLESS_NOTICE_TEXT = void 0;
+exports.armKeylessNotice = armKeylessNotice;
+const session_marker_1 = require("./session-marker");
+/**
+ * MCP-5: a hook that runs with local control on and no API key records nothing, so nothing tells the person that holds and approvals are
+ * not being recorded. This puts one user-visible notice per host session through the host's `systemMessage` field: the first keyless hook
+ * call of a session (a local marker keyed by a hash of the session id, mode 600, says it was sent) adds it to the hook's own JSON output,
+ * or prints it alone when the hook prints nothing. Names only: no variable value is ever read into the text. Claude Code only, the one
+ * host whose hook output carries `systemMessage` for every event; other hosts keep their exact output.
+ */
+exports.KEYLESS_NOTICE_TEXT = 'Marrow hooks in this session have no API key, so holds and approvals are NOT recorded. Put MARROW_API_KEY in ~/.marrow/env (chmod 600) or start the host with it, then restart the session.';
+let armed = false;
+function armKeylessNotice(harness, sessionId) {
+    if (armed || harness !== 'claude-code' || typeof sessionId !== 'string' || !sessionId)
+        return false;
+    if (!(0, session_marker_1.claimSessionMarker)('keyless-notice', sessionId))
+        return false;
+    armed = true;
+    const write = process.stdout.write.bind(process.stdout);
+    let carried = false;
+    process.stdout.write = ((chunk, ...rest) => {
+        if (!carried && typeof chunk === 'string' && chunk.trim().startsWith('{')) {
+            try {
+                const parsed = JSON.parse(chunk);
+                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed) && !('systemMessage' in parsed)) {
+                    carried = true;
+                    return write(JSON.stringify({ ...parsed, systemMessage: exports.KEYLESS_NOTICE_TEXT }), ...rest);
+                }
+            }
+            catch { /* not JSON: written unchanged */ }
+        }
+        return write(chunk, ...rest);
+    });
+    process.on('exit', () => {
+        if (!carried) {
+            carried = true;
+            try {
+                write(JSON.stringify({ systemMessage: exports.KEYLESS_NOTICE_TEXT }));
+            }
+            catch { /* the notice is best effort */ }
+        }
+    });
+    return true;
+}
+//# sourceMappingURL=keyless-notice.js.map

package/dist/keyless-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-notice.js","sourceRoot":"","sources":["../src/keyless-notice.ts"],"names":[],"mappings":";;;AAaA,4CAyBC;AAtCD,qDAAsD;AAEtD;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,6LAA6L,CAAC;AAEjO,IAAI,KAAK,GAAG,KAAK,CAAC;AAElB,SAAgB,gBAAgB,CAAC,OAAe,EAAE,SAAkB;IAClE,IAAI,KAAK,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACpG,IAAI,CAAC,IAAA,mCAAkB,EAAC,gBAAgB,EAAE,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,KAAK,GAAG,IAAI,CAAC;IACb,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAoD,CAAC;IAC3G,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAW,EAAE;QACtE,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;gBAC5C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,IAAI,MAAM,CAAC,EAAE,CAAC;oBACnG,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAI,MAAkC,EAAE,aAAa,EAAE,2BAAmB,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;gBACxH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAgC,CAAC;IAClC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,2BAAmB,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;QAClH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/normalized-action.d.ts

@@ -24,6 +24,10 @@
  *   `truncated: true`: Marrow cannot see a replacement inside the hash, and
  *   an approval is never reused for an action that carried a secret (it asks
  *   each time). The verdict, the hold and the prompt do not depend on it.
+ *   A Stripe-style key (`sk_`, `rk_`, `pk_`) keeps its class in the marker it is replaced by: `[secret-live]` or
+ *   `[secret-test]` (key-class.ts decides; an unknown, malformed or look-alike prefix is live), so an approval or hold
+ *   made for an action with a test key never covers the same action with a live key. Any other credential stays
+ *   `[secret]`. The class markers are three constants; the paths sent for an edit stay `[secret]`.
  *   Credentials are:
  *   values of environment assignments, flags, `NAME=value` arguments and
  *   inline `name: value` / `"name": "value"` literals whose name is a

package/dist/normalized-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7J,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAMF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA2C/D,eAAO,MAAM,gBAAgB,QAAoZ,CAAC;AAelb,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AAgDD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAy/BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWjJ;AAwID;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AAuCD,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAEtE;AA+MD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,oBAAoB,CA0CxI"}
+{"version":3,"file":"normalized-action.d.ts","sourceRoot":"","sources":["../src/normalized-action.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7J,yGAAyG;IACzG,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAWF,yHAAyH;AACzH,eAAO,MAAM,cAAc,QAAS,CAAC;AAWrC,KAAK,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAqE/D,eAAO,MAAM,gBAAgB,QAAoZ,CAAC;AAelb,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnD;AAgDD,KAAK,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAW1D;AAy/BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAWjJ;AAwID;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyChE;AAuCD,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAEtE;AA+MD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,oBAAoB,CA0CxI"}

package/dist/normalized-action.js

@@ -11,7 +11,13 @@ exports.normalizedHookAction = normalizedHookAction;
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = require("node:os");
 const hook_tool_policy_1 = require("./hook-tool-policy");
+const key_class_1 = require("./key-class");
 const SECRET = '[secret]';
+/** The marker of a replaced Stripe-style key keeps its class (a closed set: never built from input). */
+const SECRET_LIVE = '[secret-live]';
+const SECRET_TEST = '[secret-test]';
+const SECRET_MARKER = /\[secret(?:-(?:live|test))?\]/;
+const SECRET_MARKER_ALL = /\[secret-(?:live|test)\]/g;
 const HASH_VERSION = 'marrow-normalized-action-v3';
 const EDIT_TOOLS = /^(?:edit|write|multiedit|apply_patch|notebookedit|replace|write_file|edit_file|delete_file|search_replace|delete|create_file)$/i;
 const MAX_DEPTH = 3;
@@ -36,9 +42,35 @@ function newExactness(deadline = Date.now() + DEFAULT_NORMALIZE_MS, exact = fals
  * A value withheld only because it MAY be a secret (it may also be an id, a commit or a name that decides the
  * action): replaced and the action marked truncated; the exact pass keeps it as it is.
  */
-function withheld(state, original, replacement = SECRET) {
+function withheld(state, original, replacement) {
     state.truncated = true; // exact: kept
-    return state.exact ? original : replacement;
+    return state.exact ? original : (replacement ?? secretFor(original));
+}
+/**
+ * The marker for a replaced span: `[secret-live]` / `[secret-test]` when the span holds a Stripe-style key of that class
+ * (key-class.ts: unknown, malformed and look-alike prefixes are live), else `[secret]`. A span past the scan limit is
+ * not read (it is withheld, truncated, and the exact pass keeps it as it is).
+ */
+function secretFor(span) {
+    if (span.length > exports.MAX_SCAN_CHARS)
+        return SECRET;
+    const keyClass = (0, key_class_1.keyClassOf)(span);
+    return keyClass === 'live' ? SECRET_LIVE : keyClass === 'test' ? SECRET_TEST : SECRET;
+}
+/** The marker for a replaced value of any type (a tool input field): an object or array is read as bounded JSON. */
+function secretOfValue(value) {
+    if (typeof value === 'string')
+        return secretFor(value);
+    try {
+        return secretFor((JSON.stringify(value) ?? '').slice(0, exports.MAX_SCAN_CHARS));
+    }
+    catch {
+        return SECRET;
+    }
+}
+/** Whether a text holds a replaced-secret marker (any class). */
+function hasSecretMarker(text) {
+    return SECRET_MARKER.test(text);
 }
 /** Counts text about to be scanned against the shared budget; past it, normalization stops. */
 function spend(state, chars) {
@@ -94,7 +126,7 @@ function redactKeyShapes(text, state) {
     if (whole && !/\s/.test(whole) && looksLikeKey(whole)) {
         if (!exports.KNOWN_KEY_PREFIX.test(whole) && !PEM.test(whole))
             return withheld(state, text);
-        return state.exact && PUBLIC_KNOWN_KEY.test(whole) ? text : SECRET;
+        return state.exact && PUBLIC_KNOWN_KEY.test(whole) ? text : secretFor(whole);
     }
     if (PEM.test(text)) {
         // The exact pass replaces only a private key block; a certificate or a public key block is kept.
@@ -105,7 +137,7 @@ function redactKeyShapes(text, state) {
             return part;
         if (!exports.KNOWN_KEY_PREFIX.test(part))
             return withheld(state, part);
-        return state.exact && PUBLIC_KNOWN_KEY.test(part) ? part : SECRET;
+        return state.exact && PUBLIC_KNOWN_KEY.test(part) ? part : secretFor(part);
     }).join('');
 }
 // ---------------------------------------------------------------------------
@@ -236,10 +268,10 @@ function cutCredential(value, state) {
     if (at >= value.length) {
         if (holdsMoreThanCredential(value))
             return withheld(state, value);
-        return SECRET;
+        return secretFor(value);
     }
     state.truncated = true; // exact: certain (the credential before the field; the rest is scanned in the same pass)
-    return SECRET + redactText(value.slice(at), state);
+    return secretFor(value.slice(0, at)) + redactText(value.slice(at), state);
 }
 /** One-value auth header (`Authorization: Bearer X`, `X-Api-Key: K`): the whole value is the credential. */
 const SINGLE_VALUE_HEADER = /^[^:\s]{1,128}:[ \t]*(?:(?:Bearer|Basic|Token|Bot)[ \t]+)?[^\s;,&]+[ \t]*$/i;
@@ -260,7 +292,7 @@ function redactText(text, state) {
     // goes to host `deploy`), while libpq, mysql and redis clients take the whole span as the password. It is
     // hidden either way, but it is not a certain credential: the action is marked truncated and the exact pass
     // keeps the span, so it never shares a key with `https://deploy:<pw>@host`.
-    let out = text.replace(URL_CREDENTIALS, (_match, scheme, user, password) => (`${scheme}${user}:${/[#?]/.test(password) ? withheld(state, password) : SECRET}@`));
+    let out = text.replace(URL_CREDENTIALS, (_match, scheme, user, password) => (`${scheme}${user}:${/[#?]/.test(password) ? withheld(state, password) : secretFor(password)}@`));
     // The exact pass keeps a `Token`/`Bot` value that is not key-shaped (`git commit -m "Token rotation"`).
     out = replaceValuesAfter(out, AUTH_SCHEME, state.exact ? (scheme, value) => /^(?:Token|Bot)$/.test(scheme) && !looksLikeKey(value) : null);
     // The exact pass keeps a URL `code` value: it may be an OAuth code, but it may as well be a country or product code.
@@ -286,7 +318,7 @@ function replaceValuesAfter(text, pattern, keep) {
             pattern.lastIndex = end;
             continue;
         }
-        out += text.slice(copied, start) + SECRET;
+        out += text.slice(copied, start) + secretFor(text.slice(start, end));
         copied = end;
         pattern.lastIndex = end;
     }
@@ -326,7 +358,7 @@ function redactAssignments(text, state) {
             continue;
         const value = text.slice(start, end);
         if (!value.startsWith('[secret') && !value.startsWith('[data:')) {
-            const replacement = kind === 'ambiguous' || holdsMoreThanCredential(value) ? withheld(state, value) : SECRET;
+            const replacement = kind === 'ambiguous' || holdsMoreThanCredential(value) ? withheld(state, value) : secretFor(value);
             out += text.slice(copied, start) + replacement;
             copied = end;
         }
@@ -349,7 +381,7 @@ function dataMarker(text, feedsSecrets, state, words = null) {
     }
     if (feedsSecrets) {
         state.truncated = true; // exact: kept (hashed above, certain credentials replaced)
-        return SECRET;
+        return secretFor(text);
     }
     // Secret-shaped data (`'{"api_key":"S","env":"production"}'`): the secrets are
     // replaced and the rest is hashed, so data that differs outside a secret gives
@@ -573,7 +605,7 @@ function assignedValue(name, value, state) {
     if (kind === 'credential' || kind === 'ambiguous') {
         if (kind === 'ambiguous' || holdsMoreThanCredential(value))
             return `${name}=${withheld(state, state.exact ? dataMarker(value, false, state) : value)}`;
-        return `${name}=${SECRET}`;
+        return `${name}=${secretFor(value)}`;
     }
     return value ? `${name}=${dataMarker(value, false, state)}` : `${name}=`;
 }
@@ -699,7 +731,7 @@ function redactSegment(words, ctx) {
     const envStore = storeContext(lowered.slice(0, 4));
     const stem = programStem(program);
     const redactAt = (i, ambiguous = false) => {
-        out[i] = ambiguous || holdsMoreThanCredential(out[i]) ? withheld(state, out[i]) : SECRET;
+        out[i] = ambiguous || holdsMoreThanCredential(out[i]) ? withheld(state, out[i]) : secretFor(out[i]);
         handled.add(i);
     };
     // An auth header: a one-value header is the credential; any other (`Cookie: a=1; env=prod`)
@@ -711,7 +743,7 @@ function redactSegment(words, ctx) {
             if (holdsMoreThanCredential(value))
                 return withheld(state, header);
             if (!state.exact)
-                return SECRET;
+                return secretFor(value);
             // The exact pass: the value of a credential header (or a Bearer/Basic value) is certain; any other
             // one-value header (`X-Idempotency-Key: k`) and the header name are kept.
             const name = header.slice(0, colon);
@@ -720,7 +752,7 @@ function redactSegment(words, ctx) {
             // Basic USER:PASSWORD names who acts, as `curl -u` does: only the password is certain.
             const basic = /^[ \t]*Basic[ \t]+([A-Za-z0-9+/]+={0,2})[ \t]*$/i.exec(value);
             const decoded = basic ? Buffer.from(basic[1], 'base64').toString('latin1') : '';
-            return /^[\x20-\x7e]*:/.test(decoded) ? `${name}:Basic ${JSON.stringify(decoded.slice(0, decoded.indexOf(':')))}:${SECRET}` : `${name}:${SECRET}`;
+            return /^[\x20-\x7e]*:/.test(decoded) ? `${name}:Basic ${JSON.stringify(decoded.slice(0, decoded.indexOf(':')))}:${secretFor(decoded.slice(decoded.indexOf(':') + 1))}` : `${name}:${secretFor(value)}`;
         }
         const redacted = redactText(header, state);
         return redacted === header ? withheld(state, header) : redacted;
@@ -739,9 +771,9 @@ function redactSegment(words, ctx) {
         return `${name}=${cutCredential(value, state)}`;
     };
     // The exact pass: `curl -u USER:PASSWORD` names who acts; only the password is certain.
-    const exactUser = (value) => (value.includes(':') ? `${value.slice(0, value.indexOf(':'))}:${SECRET}` : value);
+    const exactUser = (value) => (value.includes(':') ? `${value.slice(0, value.indexOf(':'))}:${secretFor(value.slice(value.indexOf(':') + 1))}` : value);
     // The exact pass: openssl `pass:X` and a bare value are the password; `env:`, `file:`, `fd:` name where it is.
-    const exactOpensslPass = (value) => (/^(?:env|file|fd):/.test(value) ? value : /^pass:/.test(value) ? `pass:${SECRET}` : SECRET);
+    const exactOpensslPass = (value) => (/^(?:env|file|fd):/.test(value) ? value : /^pass:/.test(value) ? `pass:${secretFor(value.slice(5))}` : secretFor(value));
     // A program named for a secret (set-password.sh): its arguments cannot be told apart (the exact pass keeps them).
     if (!SECRET_PROGRAMS.has(stem) && classifySecretName(stem) === 'credential') {
         for (const i of positionals)
@@ -771,7 +803,7 @@ function redactSegment(words, ctx) {
         };
         const attachedOrNext = (prefix) => {
             if (arg.length > prefix.length) {
-                out[i] = `${prefix}${SECRET}`;
+                out[i] = `${prefix}${secretFor(arg.slice(prefix.length))}`;
                 handled.add(i);
             }
             else {
@@ -790,12 +822,12 @@ function redactSegment(words, ctx) {
         if (long) {
             const name = long[1].replace(/^-+/, '');
             if (name === 'from-literal' || name === 'from-env-literal') {
-                const replaced = `${long[1]}=${long[2].replace(/^([^=]*)=.*$/s, `$1=${SECRET}`)}`;
+                const replaced = `${long[1]}=${long[2].replace(/^([^=]*)=(.*)$/s, (_m, literal, secret) => `${literal}=${secretFor(secret)}`)}`;
                 out[i] = holdsMoreThanCredential(long[2].replace(/^[^=]*=/, '')) ? withheld(state, arg, replaced) : replaced;
                 handled.add(i);
             }
             else if (CURL_FAMILY.has(program) && /^(?:u|user|proxy-user)$/.test(name)) {
-                out[i] = `${long[1]}=${state.exact ? exactUser(long[2]) : SECRET}`;
+                out[i] = `${long[1]}=${state.exact ? exactUser(long[2]) : secretFor(long[2])}`;
                 handled.add(i);
             }
             else if (CURL_FAMILY.has(program) && name === 'header' && AUTH_HEADER.test(long[2])) {
@@ -846,7 +878,7 @@ function redactSegment(words, ctx) {
         // Short flags by program; single-dash long names (-password, -token) by name.
         if (/^-[A-Za-z]/.test(arg)) {
             if (MYSQL_FAMILY.has(program) && /^-p.+/.test(arg)) {
-                out[i] = `-p${SECRET}`;
+                out[i] = `-p${secretFor(arg.slice(2))}`;
                 handled.add(i);
             }
             else if (ALWAYS_P.has(program) && /^-p/.test(arg))
@@ -889,7 +921,7 @@ function redactSegment(words, ctx) {
             const [, name, value] = assignment;
             if (secretContext) {
                 // In a secrets command every value is a secret: withheld whole, and truncated if it held more fields.
-                out[i] = /[&#]/.test(value) || holdsMoreThanCredential(value) ? withheld(state, arg, `${name}=${SECRET}`) : `${name}=${SECRET}`;
+                out[i] = /[&#]/.test(value) || holdsMoreThanCredential(value) ? withheld(state, arg, `${name}=${secretFor(value)}`) : `${name}=${secretFor(value)}`;
                 handled.add(i);
             }
             else if (holdsSecret(name)) {
@@ -909,7 +941,7 @@ function redactSegment(words, ctx) {
             continue;
         }
         if (program === 'openssl' && /^(?:pass|env|file|fd):/.test(arg)) {
-            out[i] = state.exact ? exactOpensslPass(arg) : arg.replace(/:.*/s, `:${SECRET}`);
+            out[i] = state.exact ? exactOpensslPass(arg) : arg.replace(/:(.*)$/s, (_m, rest) => `:${secretFor(rest)}`);
             handled.add(i);
             continue;
         }
@@ -1264,7 +1296,7 @@ function redactedInput(value, state, depth = 0) {
         if (state.exact)
             throw new NormalizationLimit();
         state.truncated = true; // exact: raw (canonical input)
-        return SECRET;
+        return secretOfValue(value);
     }
     if (typeof value === 'string')
         return redactText(value, state);
@@ -1289,7 +1321,7 @@ function redactedInput(value, state, depth = 0) {
                 // name (`credentials: {user, role, password}`): only a value itself is certain.
                 if (kind === 'ambiguous')
                     state.truncated = true; // exact: kept (below)
-                out[key] = state.exact && (kind === 'ambiguous' || (item !== null && typeof item === 'object')) ? redactedInput(item, state, depth + 1) : SECRET;
+                out[key] = state.exact && (kind === 'ambiguous' || (item !== null && typeof item === 'object')) ? redactedInput(item, state, depth + 1) : secretOfValue(item);
             }
             else {
                 out[key] = redactedInput(item, state, depth + 1);
@@ -1456,7 +1488,7 @@ function inputPreimage(input, state) {
     if (input === undefined || input === null)
         return null;
     const text = JSON.stringify(sortedValue(redactedInput(input, state)));
-    if (text.includes(SECRET))
+    if (hasSecretMarker(text))
         state.truncated = true; // exact: n/a (pass 1 only; exactMaterial is the exact form)
     return `${HASH_VERSION}\ninput\n${text}`;
 }
@@ -1800,7 +1832,7 @@ function normalizedOfKind(event, kind, hostToolName, state) {
         state.freeText = !(0, hook_tool_policy_1.isShellTextTool)(event);
         const { text, programs } = normalizeInner(raw, state, 0);
         // A secret was replaced: the action is never bound or reused (it asks each time).
-        if (text.includes(SECRET))
+        if (hasSecretMarker(text))
             state.truncated = true; // exact: n/a (pass 1 only; the exact pass decides each value)
         // The command text itself only for a deploy the service can judge word for word (see deployCommandText).
         // Judged on the host's exact text (a trimmed non-ASCII space must not slip through).
@@ -1841,7 +1873,8 @@ function normalizedOfKind(event, kind, hostToolName, state) {
         if (targets.length > 64)
             state.truncated = true; // exact: n/a (paths are not exact material; the whole input is)
         const paths = targets.slice(0, 64).map((path) => {
-            const redacted = redactPathSpans(redactText(withoutUserName(path, state), state));
+            // The paths go to the service's path classifier as they did before the key class: class-free (the class is in the hashes).
+            const redacted = redactPathSpans(redactText(withoutUserName(path, state), state)).replace(SECRET_MARKER_ALL, SECRET);
             if (redacted.length > 512 || redacted.includes(SECRET) || path.length > PATH_SCAN_CHARS)
                 state.truncated = true; // exact: n/a (as above)
             return redacted.slice(0, 512);