@klhapp/skillmux 1.9.2 → 1.9.3

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.3](https://github.com/klhq/skillmux/compare/v1.9.2...v1.9.3) (2026-08-31)
+
+
+### Added
+
+* **security:** add egress allowlist for install/update ([#160](https://github.com/klhq/skillmux/issues/160)) ([08779fd](https://github.com/klhq/skillmux/commit/08779fd67aacb941aa56025aecc05cf52e93e0c9))
+* **security:** centralized secret redaction + tamper-evident admin audit trail ([#162](https://github.com/klhq/skillmux/issues/162)) ([f5335ec](https://github.com/klhq/skillmux/commit/f5335ecacf877d4e75821fe9d4be615718055814))
+* **server:** remote report reporting via a stats-only port + authenticated --context ([#158](https://github.com/klhq/skillmux/issues/158)) ([aa19986](https://github.com/klhq/skillmux/commit/aa19986d43d5557d1ef5c6dd4ff53fca7fc9002a))
+* **server:** runtime resource hardening — body/concurrency bounds and inference egress allowlist ([#161](https://github.com/klhq/skillmux/issues/161)) ([5e98765](https://github.com/klhq/skillmux/commit/5e9876581190aead64434c62f70e8d5e4010a9ad))
+
+
+### Chores
+
+* force release version to 1.9.3 ([97887fe](https://github.com/klhq/skillmux/commit/97887fe4931b183951dec6859333fb1497f6df91))
+
 ## [1.9.2](https://github.com/klhq/skillmux/compare/v1.9.1...v1.9.2) (2026-08-30)
 
 

package/docs/configuration.md

@@ -192,6 +192,8 @@ hostname = "127.0.0.1"
 auth_enabled = false
 auth_token_env = "SKILLMUX_AUTH_TOKEN"
 allowed_origins = []
+max_body_bytes = 1048576
+max_concurrent_requests = 100
 
 [server.rate_limit]
 enabled = false
@@ -205,6 +207,8 @@ token_env = "SKILLMUX_ADMIN_TOKEN"
 
 Defaults are loopback-only (`hostname = "127.0.0.1"`) with CORS deny-by-default (`allowed_origins = []`), so a zero-config `skillmux serve --transport http` is not reachable from the network or from a browser tab on another origin. Docker sets `hostname` to `0.0.0.0` automatically (`RUNNING_IN_DOCKER=true`) since port-mapping needs the container to accept connections on all interfaces.
 
+`max_body_bytes` (default 1 MiB) and `max_concurrent_requests` (default 100) are positive resource bounds on the `--transport http` listener: unlike `rate_limit`, which is opt-in and off by default, these apply out of the box so the transport is never unbounded by omission. A request whose body exceeds `max_body_bytes` is rejected with `413 Payload Too Large` before it's fully read; once `max_concurrent_requests` requests are in flight, an additional request is rejected with `503 Service Unavailable`. Both are unrelated to `rate_limit`, which bounds request *count* per client over time rather than body size or concurrency.
+
 Before exposing HTTP beyond localhost, set `hostname` to a reachable interface, `auth_enabled = true` with a token, and populate `allowed_origins` with the specific origins that need browser access. `rate_limit.trust_proxy` should stay `false` unless a trusted reverse proxy sets `X-Forwarded-For`: it's otherwise a client-controlled, spoofable header, and trusting it defeats per-client rate limiting.
 
 `server.auth_token_env` names the MCP token for AI clients calling `/mcp`.
@@ -219,6 +223,53 @@ Inside the server image, only read-only `config show`, `get`, `validate`,
 host CLI; the image returns `CONTAINER_COMMAND_UNSUPPORTED` with the exact host
 command to run. See [Deployment](deployment.md#container-command-contract).
 
+## Secret redaction and the admin audit trail
+
+Skillmux redacts resolved credential values before they can reach CLI
+output or server logs. Every `*_env`-suffixed config key (`api_key_env`,
+`token_env`, `auth_token_env`) names an environment variable rather than
+storing the secret itself; when an error message would otherwise embed that
+variable's current value — or a credential typed directly into a URL, e.g.
+`https://user:TOKEN@host/repo.git` for private-repo git auth — it is
+replaced with `[REDACTED]` before the CLI's error handler or the server's
+exception logging writes it out. This applies in both human and `--json`
+output and requires no configuration; with no `*_env` keys set, it is a
+no-op.
+
+Every successful `PATCH /admin/v1/config` mutation appends one row to an
+`admin_audit` table in the same `audit.sqlite3` used for fetch/resolve
+telemetry, recording the timestamp, changed keys with their old and new
+values, and the resulting config revision hash. A rejected request (stale
+`If-Match`, read-only config) writes no row. Each row's hash is chained to
+the previous row's hash, so any row deleted or edited outside the running
+server breaks the chain — detectable by walking the table and recomputing
+the chain, without a dedicated query endpoint. `admin_audit` rows are
+pruned by the same `[audit] retention_days` setting as the rest of
+`audit.sqlite3`; there is no separate retention config for admin history.
+
+## Egress allowlist
+
+```toml
+[egress]
+allowed_hosts = ["github.com"]
+```
+
+Unset by default, matching Skillmux's opt-in security posture elsewhere.
+When set, `skillmux install` and `skillmux update` refuse to fetch from any
+git host not on the list, checked before the network call — see
+[Managing skills](skill-management.md#restrict-which-hosts-install-and-update-can-reach).
+`file://` sources are exempt (no network egress occurs; they're already
+gated by `--allow-local-source`), and host matching is exact and
+case-insensitive, with no glob support.
+
+The same `allowed_hosts` list also gates remote-inference calls: when set,
+a `[inference.embedding]` or `[inference.reranker]` `endpoint` host not on
+the list is rejected before the HTTP request, surfaced the same way as any
+other embedding/reranker configuration error (`resolve_skill` degrades to
+the strongest available retrieval lane rather than failing outright). This
+does not apply to `inference.mode = "local"`, which never makes a network
+call.
+
 ## Tiers and the manifest
 
 `skillmux init` and `skillmux sync` manage native delivery by pinning selected

package/docs/skill-management.md

@@ -53,6 +53,22 @@ from a local repo is a deliberate, interactive choice:
 skillmux install file:///path/to/local/repo --allow-local-source
 ```
 
+### Restrict which hosts install and update can reach
+
+By default `install` and `update` will fetch from any git host. Set
+`[egress] allowed_hosts` in your config to restrict both to an explicit list:
+
+```toml
+[egress]
+allowed_hosts = ["github.com", "git.example.com"]
+```
+
+A host not on the list is rejected before any network fetch, for both a new
+`skillmux install <source>` and a `skillmux update` re-fetching a skill's
+recorded origin. This doesn't apply to `file://` sources, which never leave
+the local filesystem and are already gated by `--allow-local-source` above.
+Leaving `allowed_hosts` unset (the default) leaves both commands unrestricted.
+
 ## Scan a vault or candidate
 
 ```sh
@@ -211,6 +227,7 @@ skillmux doctor
 ```sh
 skillmux report --since 7d
 skillmux report --server http://host:3000 --since 7d
+skillmux report --context prod --since 7d
 ```
 
 `skillmux report` aggregates total requests, empty shortlist count and rate,
@@ -224,6 +241,32 @@ Top empty shortlist queries point to missing skills or weak skill descriptions.
 `--since` accepts windows such as `1h`, `7d`, and `1m`, plus absolute dates and
 timestamps.
 
+Register a remote deployment once with `skillmux context add`, then reuse it by
+name instead of retyping `--server` (and, if the deployment requires
+authentication, its token) on every call:
+
+```sh
+skillmux context add prod --server http://host:3000 --token-env SKILLMUX_AUTH_TOKEN
+skillmux report --context prod --since 7d
+```
+
+`--context` and bare `--server` both hit `GET /stats` on the target and require
+an HTTP transport listening there. A stdio-only deployment (the common case
+for an MCP server spawned by a host over stdin/stdout) has no such listener by
+default. Give it a narrow, read-only one — just `/health` and `/stats`, none
+of the MCP tool surface — without switching its primary transport:
+
+```sh
+skillmux serve --transport stdio --stats-port 4317
+```
+
+The stats port inherits the same `[server]` bind-posture rule as the `http`
+transport (see [Configuration](configuration.md#http-server)): binding it
+to anything other than a loopback address requires `server.auth_enabled =
+true` with a token, or it refuses to start. `--stats-port` is rejected
+alongside `--transport http`, since that transport already serves `/stats` on
+`--port`.
+
 ## Target ownership and recovery
 
 `skillmux target remove <name> --yes` removes the manifest record and preserves

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klhapp/skillmux",
-  "version": "1.9.2",
+  "version": "1.9.3",
   "description": "Skill management and retrieval for AI agents: sync native skills across clients and route the long tail over MCP",
   "type": "module",
   "private": false,

package/src/cli.ts

@@ -15,6 +15,7 @@ import {
 import { openAudit } from "./db";
 import { diagnose } from "./doctor";
 import { getEffectiveConfig } from "./config-service";
+import { buildRedactor } from "./redact";
 import { evalVault } from "./eval";
 import {
   assessClientReadiness,
@@ -39,6 +40,7 @@ import {
   surfaceCandidates,
 } from "./init";
 import {
+  assertHostAllowed,
   cloneToTemp,
   deriveRepoName,
   installIntoVault,
@@ -101,7 +103,7 @@ import {
   useContext,
   type ResolvedTarget,
 } from "./context";
-import { createTargetAdapter, type TargetAdapter } from "./adapters";
+import { createTargetAdapter, isLoopbackHost, type TargetAdapter } from "./adapters";
 import {
   emitSuccess,
   CliError,
@@ -241,7 +243,7 @@ async function main() {
     process.env.RUNNING_IN_DOCKER === "true" &&
     isDockerHostManagementCommand(command, subCommand)
   ) {
-    handleError(containerCommandUnsupported(command, subCommand), {
+    await handleError(containerCommandUnsupported(command, subCommand), {
       target: resolvedTarget,
       isJson,
       isVerbose,
@@ -263,7 +265,7 @@ async function main() {
         server: flagServer,
       });
     } catch (err: any) {
-      handleError(err, { target: resolvedTarget, isJson, isVerbose });
+      await handleError(err, { target: resolvedTarget, isJson, isVerbose });
       return;
     }
   }
@@ -294,8 +296,8 @@ async function main() {
         break;
       case "serve": {
         const { startServer } = await import("./server");
-        const { transport, port } = parseServeArgs(rawArgv.slice(1));
-        const handle = await startServer({ transport, port });
+        const { transport, port, statsPort } = parseServeArgs(rawArgv.slice(1));
+        const handle = await startServer({ transport, port, statsPort });
         let stopping = false;
         const shutdown = async () => {
           if (stopping) return;
@@ -337,7 +339,11 @@ async function main() {
         await runCore(subCommand, commandArgs, { isJson, dryRun: isDryRun });
         break;
       case "report":
-        await runReport(rawArgv.slice(1), { isJson });
+        await runReport(rawArgv.slice(1), {
+          isJson,
+          target: resolvedTarget,
+          allowInsecure,
+        });
         break;
       case "audit":
         await runAudit(subCommand, commandArgs, { isJson, dryRun: isDryRun });
@@ -396,7 +402,7 @@ async function main() {
       }
     }
   } catch (err: any) {
-    handleError(err, { target: resolvedTarget, isJson, isVerbose });
+    await handleError(err, { target: resolvedTarget, isJson, isVerbose });
   }
 }
 
@@ -497,14 +503,25 @@ async function handleCompletionsCommand(shell: string) {
   console.log(generateCompletions(shell as ShellType));
 }
 
-function handleError(
+async function handleError(
   err: any,
   opts: { target: ResolvedTarget; isJson: boolean; isVerbose: boolean },
 ) {
   const code = mapExitCode(err);
   process.exitCode = code;
 
-  const msg = err instanceof Error ? err.message : String(err);
+  const rawMsg = err instanceof Error ? err.message : String(err);
+  // Best-effort: a broken config must not suppress the original error report,
+  // so fall back to the URL-credential-only layer of buildRedactor(undefined)
+  // rather than let a config-load failure mask the real failure.
+  let redact: (text: string) => string;
+  try {
+    const { effective } = await getEffectiveConfig();
+    redact = buildRedactor(effective);
+  } catch {
+    redact = buildRedactor(undefined);
+  }
+  const msg = redact(rawMsg);
 
   if (opts.isJson) {
     const env = formatJsonEnvelope({
@@ -526,7 +543,7 @@ function handleError(
         : `error: ${msg}`,
     );
     if (opts.isVerbose && err instanceof Error && err.stack) {
-      console.error(err.stack);
+      console.error(redact(err.stack));
     }
   }
 }
@@ -573,7 +590,7 @@ Init targets:
   agent-skills, claude-code, codex, custom
 
 Operations:
-  skillmux report [--server <url> | --db <path>] --since <window> [--json]
+  skillmux report [--context <name> | --server <url> | --db <path>] --since <window> [--json]
   skillmux audit prune [--older-than <window>] [--dry-run] [--yes] [--json]
   skillmux eval promote --since <window> [--target <path>] [--dry-run] [--yes] [--json]
   skillmux outdated [--allow-local-source] [--json]
@@ -593,9 +610,11 @@ type Transport = "stdio" | "http";
 function parseServeArgs(args: string[]): {
   transport: Transport;
   port?: number;
+  statsPort?: number;
 } {
   let transport: Transport = "stdio";
   let port: number | undefined;
+  let statsPort: number | undefined;
   for (let i = 0; i < args.length; i++) {
     const option = args[i];
     const value = args[i + 1];
@@ -612,11 +631,18 @@ function parseServeArgs(args: string[]): {
       }
       port = parsed;
       i++;
+    } else if (option === "--stats-port") {
+      const parsed = Number(value);
+      if (!Number.isInteger(parsed) || parsed < 0 || parsed > 65_535) {
+        throw new Error("--stats-port must be an integer between 0 and 65535");
+      }
+      statsPort = parsed;
+      i++;
     } else {
       throw new Error(`unknown serve option: ${option}`);
     }
   }
-  return { transport, port };
+  return { transport, port, statsPort };
 }
 
 async function runIndex(): Promise<void> {
@@ -1498,21 +1524,15 @@ async function runInit(
 }
 
 function parseReportArgs(args: string[]): {
-  server?: string;
   db?: string;
   since?: string;
 } {
-  let server: string | undefined;
   let db: string | undefined;
   let since: string | undefined;
   for (let i = 0; i < args.length; i++) {
     const option = args[i];
     const value = args[i + 1];
-    if (option === "--server") {
-      if (!value) throw new Error("--server requires a URL");
-      server = value;
-      i++;
-    } else if (option === "--db") {
+    if (option === "--db") {
       if (!value) throw new Error("--db requires a path");
       db = value;
       i++;
@@ -1522,27 +1542,49 @@ function parseReportArgs(args: string[]): {
       i++;
     } else if (option === "--json") {
       // handled globally by main()'s isJson flag; recognized here so it isn't rejected
+    } else if (option === "--server" || option === "--context") {
+      // handled globally by main()'s resolveTarget(); recognized here so it isn't rejected
+      i++;
+    } else if (option === "--allow-insecure") {
+      // handled globally by main()'s allowInsecure flag; recognized here so it isn't rejected
     } else {
       throw new Error(`unknown report option: ${option}`);
     }
   }
-  if (server && db) throw new Error("--server and --db are mutually exclusive");
-  return { server, db, since };
+  return { db, since };
 }
 
 async function runReport(
   args: string[],
-  options: { isJson: boolean },
+  options: { isJson: boolean; target: ResolvedTarget; allowInsecure: boolean },
 ): Promise<void> {
-  const { server, db: dbPath, since } = parseReportArgs(args);
+  const { db: dbPath, since } = parseReportArgs(args);
   if (!since)
     throw new Error(
-      "usage: skillmux report [--server <url> | --db <path>] --since <window> [--json]",
+      "usage: skillmux report [--context <name> | --server <url> | --db <path>] --since <window> [--json]",
     );
-
-  if (server) {
-    const url = `${server.replace(/\/$/, "")}/stats?since=${encodeURIComponent(since)}`;
-    const res = await fetch(url);
+  if (dbPath && options.target.type === "remote")
+    throw new Error("--db and --context/--server are mutually exclusive");
+
+  if (options.target.type === "remote") {
+    const { server, token_env } = options.target;
+    const url = new URL(`${server.replace(/\/$/, "")}/stats`);
+    url.searchParams.set("since", since);
+    if (
+      url.protocol === "http:" &&
+      !isLoopbackHost(url.hostname) &&
+      !options.allowInsecure
+    ) {
+      throw new Error(
+        `Plaintext HTTP report target not allowed for non-loopback server "${server}". Pass --allow-insecure to bypass.`,
+      );
+    }
+    const headers: Record<string, string> = {};
+    if (token_env) {
+      const token = process.env[token_env];
+      if (token) headers.Authorization = `Bearer ${token}`;
+    }
+    const res = await fetch(url, { headers });
     if (!res.ok)
       throw new Error(
         `skillmux report --server failed: ${res.status} ${await res.text()}`,
@@ -1638,8 +1680,8 @@ function parseInstallArgs(args: string[]): {
         throw new Error("--fail-on must be low, medium, or high");
       }
       failOn = value;
-    } else if (option === "--json") {
-      // handled globally by main()'s isJson flag; recognized here so it isn't rejected
+    } else if (option === "--json" || option === "--verbose") {
+      // handled globally by main()'s isJson/isVerbose flags; recognized here so they aren't rejected
     } else if (option?.startsWith("--")) {
       throw new Error(`unknown install option: ${option}`);
     } else if (repo !== undefined) {
@@ -1668,6 +1710,8 @@ async function runInstall(
       `"${repo}" is a local (file://) source — pass --allow-local-source to install from it`,
     );
   }
+  const config = await loadConfig();
+  assertHostAllowed(source.url, config.egress?.allowed_hosts);
   const cloneDir = await cloneToTemp(source.url);
   try {
     const resolved = resolveSkillDir(
@@ -1689,7 +1733,7 @@ async function runInstall(
       return;
     }
 
-    const vaultPath = expandHome((await loadConfig()).vault_path);
+    const vaultPath = expandHome(config.vault_path);
     if (dryRun) {
       const plannedPath = join(vaultPath, resolved.skillId);
       emitSuccess(

package/src/clients.ts

@@ -1,5 +1,6 @@
 import type { Clients, Config, RemoteRerankerConfig } from "./types";
 import { expandHome } from "./config";
+import { assertHostAllowed } from "./install";
 import type { pipeline as createPipeline } from "@huggingface/transformers";
 
 export type RemoteErrorKind = "configuration" | "availability" | "protocol";
@@ -34,6 +35,17 @@ function authorizationHeaders(
   return { authorization: `Bearer ${apiKey}` };
 }
 
+function assertInferenceHostAllowed(url: string, allowedHosts: string[] | undefined): void {
+  try {
+    assertHostAllowed(url, allowedHosts);
+  } catch (error) {
+    throw new RemoteInferenceError(
+      "configuration",
+      error instanceof Error ? error.message : String(error),
+    );
+  }
+}
+
 function httpFailure(surface: string, status: number): RemoteInferenceError {
   const kind: RemoteErrorKind =
     status === 401 || status === 403
@@ -196,9 +208,12 @@ async function fetchRerankerScores(
   timeoutMs: number,
   query: string,
   docs: { skill_id: string; text: string }[],
+  allowedHosts: string[] | undefined,
 ): Promise<number[]> {
   if (docs.length === 0) return [];
 
+  assertInferenceHostAllowed(reranker.endpoint, allowedHosts);
+
   let response: Response;
   try {
     response = await fetch(reranker.endpoint, {
@@ -300,6 +315,7 @@ export function createClients(config: Config): Clients {
       }
 
       const embedding = config.inference.embedding;
+      assertInferenceHostAllowed(embedding.endpoint, config.egress?.allowed_hosts);
       let response: Response;
       try {
         response = await fetch(embedding.endpoint, {
@@ -344,6 +360,7 @@ export function createClients(config: Config): Clients {
         inference.timeout_ms,
         query,
         docs,
+        config.egress?.allowed_hosts,
       );
     };
   }

package/src/commands/audit.ts

@@ -39,7 +39,7 @@ export async function runAudit(
     if (retentionDays <= 0) {
       emitSuccess(
         { isJson: options.isJson },
-        { audit_deleted: 0, fetch_deleted: 0, dry_run: dryRun, cutoff: null },
+        { audit_deleted: 0, fetch_deleted: 0, admin_audit_deleted: 0, dry_run: dryRun, cutoff: null },
         () => console.log("prune: audit.retention_days is 0 (pruning disabled); nothing to do"),
       );
       return;
@@ -55,7 +55,10 @@ export async function runAudit(
       emitSuccess(
         { isJson: options.isJson },
         { ...counts, dry_run: true, cutoff: cutoffIso },
-        () => console.log(`prune: audit=${counts.audit_deleted} fetch=${counts.fetch_deleted} (dry-run)`),
+        () =>
+          console.log(
+            `prune: audit=${counts.audit_deleted} fetch=${counts.fetch_deleted} admin_audit=${counts.admin_audit_deleted} (dry-run)`,
+          ),
       );
       return;
     }
@@ -74,7 +77,10 @@ export async function runAudit(
     emitSuccess(
       { isJson: options.isJson },
       { ...counts, dry_run: false, cutoff: cutoffIso },
-      () => console.log(`prune: audit=${counts.audit_deleted} fetch=${counts.fetch_deleted}`),
+      () =>
+        console.log(
+          `prune: audit=${counts.audit_deleted} fetch=${counts.fetch_deleted} admin_audit=${counts.admin_audit_deleted}`,
+        ),
     );
   } finally {
     db.close();

package/src/commands/outdated.ts

@@ -1,7 +1,7 @@
 import { readdirSync } from "node:fs";
 import { join } from "node:path";
 import { expandHome, loadConfig } from "../config";
-import { isLocalFileUrl, remoteHeadCommit } from "../install";
+import { assertHostAllowed, isLocalFileUrl, remoteHeadCommit } from "../install";
 import { emitSuccess } from "../output";
 import { readSkillOrigin } from "../provenance";
 import { SKILL_ID_PATTERN } from "../vault";
@@ -24,7 +24,7 @@ function vaultSkillIds(vaultPath: string): string[] {
 
 export async function checkOutdated(
   vaultPath: string,
-  options: { allowLocalSource?: boolean } = {},
+  options: { allowLocalSource?: boolean; allowedHosts?: string[] } = {},
 ): Promise<OutdatedCheckResult[]> {
   const results: OutdatedCheckResult[] = [];
   for (const skillId of vaultSkillIds(vaultPath)) {
@@ -64,6 +64,7 @@ export async function checkOutdated(
     let status: OutdatedCheckResult["status"];
     let reason: string | null = null;
     try {
+      assertHostAllowed(origin.source_url, options.allowedHosts);
       remoteCommit = await remoteHeadCommit(origin.source_url);
       status = remoteCommit === origin.commit ? "up_to_date" : "outdated";
     } catch (error) {
@@ -94,8 +95,9 @@ export async function runOutdated(args: string[], options: { isJson: boolean }):
     throw new Error(`unknown outdated option: ${arg}`);
   }
 
-  const vaultPath = expandHome((await loadConfig()).vault_path);
-  const skills = await checkOutdated(vaultPath, { allowLocalSource });
+  const config = await loadConfig();
+  const vaultPath = expandHome(config.vault_path);
+  const skills = await checkOutdated(vaultPath, { allowLocalSource, allowedHosts: config.egress?.allowed_hosts });
   const checksFailed = skills.filter((s) => s.status === "check_failed").length;
   process.exitCode = checksFailed > 0 ? 1 : 0;
 

package/src/commands/update.ts

@@ -2,6 +2,7 @@ import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { expandHome, loadConfig } from "../config";
 import {
+  assertHostAllowed,
   cloneToTemp,
   installIntoVault,
   isLocalFileUrl,
@@ -37,6 +38,7 @@ async function resolveCandidateOrigins(
   vaultPath: string,
   skillId: string | undefined,
   allowLocalSource: boolean,
+  allowedHosts: string[] | undefined,
 ): Promise<{ skillId: string; origin: SkillOrigin }[]> {
   if (skillId) {
     // skillId (the CLI's positional <skill-id>) is joined straight into vaultPath
@@ -65,7 +67,7 @@ async function resolveCandidateOrigins(
     }
     return [{ skillId, origin }];
   }
-  const outdated = await checkOutdated(vaultPath, { allowLocalSource });
+  const outdated = await checkOutdated(vaultPath, { allowLocalSource, allowedHosts });
   return outdated
     .filter((result) => result.status === "outdated")
     .map((result) => ({ skillId: result.skill_id, origin: readSkillOrigin(join(vaultPath, result.skill_id))! }));
@@ -76,6 +78,7 @@ async function buildPlan(
   candidates: { skillId: string; origin: SkillOrigin }[],
   failOn: ScanSeverity | undefined,
   force: boolean,
+  allowedHosts: string[] | undefined,
 ): Promise<UpdatePlanItem[]> {
   const plan: UpdatePlanItem[] = [];
   for (const { skillId, origin } of candidates) {
@@ -118,6 +121,7 @@ async function buildPlan(
       continue;
     }
 
+    assertHostAllowed(origin.source_url, allowedHosts);
     const cloneDir = await cloneToTemp(origin.source_url);
     const resolved = resolveSkillDir(cloneDir, skillId, origin.skill_path);
     const base = {
@@ -206,10 +210,11 @@ function parseUpdateArgs(args: string[]): {
 
 export async function runUpdate(args: string[], options: { isJson: boolean }): Promise<void> {
   const { skillId, yes, dryRun, force, failOn, allowLocalSource } = parseUpdateArgs(args);
-  const vaultPath = expandHome((await loadConfig()).vault_path);
+  const config = await loadConfig();
+  const vaultPath = expandHome(config.vault_path);
 
-  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource);
-  const plan = await buildPlan(vaultPath, candidates, failOn, force);
+  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource, config.egress?.allowed_hosts);
+  const plan = await buildPlan(vaultPath, candidates, failOn, force, config.egress?.allowed_hosts);
   try {
     const toWrite = plan.filter((item) => item.kind === "update");
 

package/src/concurrency-limiter.ts

@@ -0,0 +1,61 @@
+export class ConcurrencyLimiter {
+  private inFlight = 0;
+
+  constructor(private readonly max: number) {}
+
+  tryAcquire(): boolean {
+    if (this.inFlight >= this.max) return false;
+    this.inFlight++;
+    return true;
+  }
+
+  release(): void {
+    this.inFlight = Math.max(0, this.inFlight - 1);
+  }
+}
+
+/**
+ * Wraps a response body so `release` fires when the stream actually finishes
+ * (fully drained or cancelled by a client disconnect) instead of as soon as
+ * the Response object is constructed. For a buffered body this happens almost
+ * immediately; for an open SSE stream it defers release until the connection
+ * really closes, so a concurrency limiter reflects true connection lifetime.
+ */
+export function releaseOnStreamClose(
+  body: ReadableStream<Uint8Array> | null,
+  release: () => void,
+): ReadableStream<Uint8Array> | null {
+  if (!body) {
+    release();
+    return null;
+  }
+
+  const reader = body.getReader();
+  let released = false;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    release();
+  };
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          releaseOnce();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (error) {
+        controller.error(error);
+        releaseOnce();
+      }
+    },
+    cancel(reason) {
+      releaseOnce();
+      return reader.cancel(reason);
+    },
+  });
+}