@mrciphersmith/keryx 0.3.18 → 0.3.20

package/dist/cli.js

@@ -3913,6 +3913,19 @@ var init_provider_catalog_cache = __esm(() => {
 
 // src/lib/oauth/open-url.ts
 import { spawn } from "child_process";
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+}
+function isSafeVerificationUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  const schemeOk = parsed.protocol === "https:" || parsed.protocol === "http:" && isLoopbackHost(parsed.hostname);
+  return schemeOk && ALLOWED_URL_CHARS.test(url);
+}
 function browserOpenPlan(url, platform = process.platform, env = process.env) {
   if (url.length === 0) {
     return;
@@ -3921,7 +3934,10 @@ function browserOpenPlan(url, platform = process.platform, env = process.env) {
     return { cmd: "open", args: [url] };
   }
   if (platform === "win32") {
-    return { cmd: "cmd", args: ["/c", "start", "", url] };
+    if (!isSafeVerificationUrl(url)) {
+      return;
+    }
+    return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
   }
   if (typeof env.DISPLAY === "string" && env.DISPLAY.length > 0) {
     return { cmd: "xdg-open", args: [url] };
@@ -3943,7 +3959,10 @@ function openVerificationUrl(url, deps = {}) {
     child.unref();
   } catch {}
 }
-var init_open_url = () => {};
+var ALLOWED_URL_CHARS;
+var init_open_url = __esm(() => {
+  ALLOWED_URL_CHARS = /^[A-Za-z0-9\-._~:/?#[\]@!$'()*+,;=%]+$/;
+});
 
 // src/harness/policy/engine.ts
 import path8 from "path";
@@ -4282,7 +4301,7 @@ function isPrivateEgressToken(token) {
 function isPrivateEgressHost(host) {
   return isPrivateEgressToken(host);
 }
-function isLoopbackHost(host) {
+function isLoopbackHost2(host) {
   if (typeof host !== "string" || host.length === 0)
     return false;
   const normalized = host.trim();
@@ -4415,7 +4434,7 @@ async function probeOllamaModels(deps, baseUrl) {
   } catch {
     host = baseUrl;
   }
-  if (isPrivateEgressHost(host) && !isLoopbackHost(host)) {
+  if (isPrivateEgressHost(host) && !isLoopbackHost2(host)) {
     return;
   }
   let response;
@@ -9060,6 +9079,325 @@ var init_config = __esm(() => {
   ]);
 });
 
+// src/security/detect/entropy.ts
+function isHexBlob(value) {
+  return HEX_BLOB.test(value) && /[a-f]/i.test(value);
+}
+function isAllowShapedValue(value) {
+  return FULL_GIT_SHA_RE.test(value) || UUID_RE.test(value) || INTEGRITY_RE.test(value);
+}
+function lastLineOf(before) {
+  const newline = before.lastIndexOf(`
+`);
+  return newline < 0 ? before : before.slice(newline + 1);
+}
+function isPlainCasedWord(letters) {
+  return /^[a-z]+$/.test(letters) || /^[A-Z]+$/.test(letters) || /^[A-Z][a-z]*$/.test(letters);
+}
+function isSingleTransitionTag(segment) {
+  const letterThenDigit = /^([A-Za-z]+)([0-9]+)$/.exec(segment);
+  if (letterThenDigit !== null) {
+    const letters = letterThenDigit[1];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  const digitThenLetter = /^([0-9]+)([A-Za-z]+)$/.exec(segment);
+  if (digitThenLetter !== null) {
+    const letters = digitThenLetter[2];
+    return letters.length <= TAG_MAX_LETTER_RUN && isPlainCasedWord(letters);
+  }
+  return false;
+}
+function isSlugHexTail(segment) {
+  return SLUG_HEX_TAIL_RE.test(segment);
+}
+function isWordSlug(value) {
+  const segments = value.split(/[-_]/);
+  if (segments.length < 3) {
+    return false;
+  }
+  let words = 0;
+  for (let i = 0;i < segments.length; i += 1) {
+    const segment = segments[i];
+    const isDigits = /^[0-9]+$/.test(segment);
+    if (isDigits) {
+      continue;
+    }
+    if (isPlainCasedWord(segment)) {
+      if (segment.length >= 3) {
+        words += 1;
+      }
+      continue;
+    }
+    if (isSingleTransitionTag(segment)) {
+      continue;
+    }
+    if (i === segments.length - 1 && isSlugHexTail(segment)) {
+      continue;
+    }
+    return false;
+  }
+  return words >= 1;
+}
+function shannonEntropy(value) {
+  const counts = new Map;
+  for (const ch of value) {
+    counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / value.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function bareShapeQualifies(head) {
+  if (!/[0-9]/.test(head) && !/[+=]/.test(head)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  if (isWordSlug(head)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  const entropy = shannonEntropy(head);
+  const hexBlob = isHexBlob(head);
+  if (entropy < 3.6 && !hexBlob) {
+    return { qualifies: false, entropy };
+  }
+  return { qualifies: true, entropy };
+}
+function shapeQualifiesAsSecret(value) {
+  if (isAllowShapedValue(value)) {
+    return { qualifies: false, entropy: 0 };
+  }
+  return bareShapeQualifies(value);
+}
+function looksSecretShaped(value) {
+  return shapeQualifiesAsSecret(value).qualifies;
+}
+function buildMatch(start, end, value, entropy) {
+  const confidence = Math.max(0.4, Math.min(0.7, 0.4 + (entropy - 3.6) * 0.21));
+  return {
+    category: "secret",
+    policyId: "secrets.high-entropy",
+    severity: "medium",
+    confidence: Number(confidence.toFixed(2)),
+    start,
+    end,
+    value,
+    mask: "entropy",
+    remediation: "Verify this high-entropy value is not a live credential."
+  };
+}
+function findUrlSpans(content) {
+  const spans = [];
+  URL_SPAN_RE.lastIndex = 0;
+  let m;
+  while ((m = URL_SPAN_RE.exec(content)) !== null) {
+    let raw = m[0];
+    while (raw.length > 0 && URL_TRAILING_PUNCTUATION_RE.test(raw)) {
+      raw = raw.slice(0, -1);
+    }
+    if (raw.length > 0) {
+      spans.push({ start: m.index, end: m.index + raw.length, raw });
+    }
+    if (m.index === URL_SPAN_RE.lastIndex) {
+      URL_SPAN_RE.lastIndex += 1;
+    }
+  }
+  return spans;
+}
+function urlComponentSpans(raw) {
+  const spans = [];
+  const schemeMatch = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.exec(raw);
+  if (schemeMatch === null) {
+    return spans;
+  }
+  let i = schemeMatch[0].length;
+  while (i < raw.length && raw[i] !== "/" && raw[i] !== "?" && raw[i] !== "#") {
+    i += 1;
+  }
+  let pathEnd = i;
+  while (pathEnd < raw.length && raw[pathEnd] !== "?" && raw[pathEnd] !== "#") {
+    pathEnd += 1;
+  }
+  let segStart = i;
+  for (let j = i;j <= pathEnd; j += 1) {
+    if (j === pathEnd || raw[j] === "/") {
+      if (j > segStart) {
+        spans.push({ start: segStart, end: j });
+      }
+      segStart = j + 1;
+    }
+  }
+  let cursor = pathEnd;
+  if (cursor < raw.length && raw[cursor] === "?") {
+    let queryEnd = cursor + 1;
+    while (queryEnd < raw.length && raw[queryEnd] !== "#") {
+      queryEnd += 1;
+    }
+    let pairStart = cursor + 1;
+    for (let j = cursor + 1;j <= queryEnd; j += 1) {
+      if (j === queryEnd || raw[j] === "&") {
+        const pair = raw.slice(pairStart, j);
+        const eq = pair.indexOf("=");
+        if (eq !== -1 && eq + 1 < pair.length) {
+          spans.push({ start: pairStart + eq + 1, end: j });
+        } else if (eq === -1 && pair.length > 0) {
+          spans.push({ start: pairStart, end: j });
+        }
+        pairStart = j + 1;
+      }
+    }
+    cursor = queryEnd;
+  }
+  if (cursor < raw.length && raw[cursor] === "#" && cursor + 1 < raw.length) {
+    spans.push({ start: cursor + 1, end: raw.length });
+  }
+  return spans;
+}
+function secretShapedCandidatesIn(text) {
+  const normalized = text.replace(/\+/g, " ");
+  const out = [];
+  TOKEN.lastIndex = 0;
+  let m;
+  while ((m = TOKEN.exec(normalized)) !== null) {
+    const value = m[0];
+    if (value.length < URL_COMPONENT_MIN_LENGTH) {
+      continue;
+    }
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    const { qualifies, entropy } = shapeQualifiesAsSecret(head);
+    if (!qualifies) {
+      continue;
+    }
+    const start = m.index;
+    const end = start + value.length;
+    out.push({ start, end, value: text.slice(start, end), entropy });
+  }
+  return out;
+}
+function looksSecretShapedIn(text) {
+  return secretShapedCandidatesIn(text).length > 0;
+}
+function labelledPieceQualifies(piece) {
+  const base = bareShapeQualifies(piece);
+  if (base.qualifies) {
+    return { entropy: base.entropy };
+  }
+  if (isAllowShapedValue(piece)) {
+    return { entropy: base.entropy };
+  }
+  return null;
+}
+function firstQualifyingSlashPiece(head) {
+  let offset = 0;
+  for (const piece of head.split("/")) {
+    if (piece.length > 0) {
+      const found = labelledPieceQualifies(piece);
+      if (found !== null) {
+        return { offset, length: piece.length, entropy: found.entropy };
+      }
+    }
+    offset += piece.length + 1;
+  }
+  return null;
+}
+function detectEntropy(content) {
+  const matches = [];
+  const urlSpans = findUrlSpans(content);
+  for (const url of urlSpans) {
+    for (const comp of urlComponentSpans(url.raw)) {
+      const compText = url.raw.slice(comp.start, comp.end);
+      for (const cand of secretShapedCandidatesIn(compText)) {
+        const absStart = url.start + comp.start + cand.start;
+        const absEnd = url.start + comp.start + cand.end;
+        matches.push(buildMatch(absStart, absEnd, cand.value, cand.entropy));
+      }
+    }
+  }
+  LABEL_ASSIGNMENT_RE.lastIndex = 0;
+  let am;
+  while ((am = LABEL_ASSIGNMENT_RE.exec(content)) !== null) {
+    const value = am[1];
+    const end = am.index + am[0].length;
+    const start = end - value.length;
+    if (urlSpans.some((u) => start < u.end && end > u.start)) {
+      continue;
+    }
+    const { qualifies, entropy } = bareShapeQualifies(value);
+    if (qualifies) {
+      matches.push(buildMatch(start, end, value, entropy));
+    }
+  }
+  TOKEN.lastIndex = 0;
+  let m;
+  while ((m = TOKEN.exec(content)) !== null) {
+    const value = m[0];
+    const start = m.index;
+    const end = start + value.length;
+    if (urlSpans.some((u) => start < u.end && end > u.start)) {
+      continue;
+    }
+    if (matches.some((existing) => start < existing.end && end > existing.start)) {
+      continue;
+    }
+    const before = lastLineOf(content.slice(Math.max(0, start - LABEL_WINDOW), start));
+    if (!ADJACENT_LABEL.test(before)) {
+      continue;
+    }
+    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
+    if (head.includes("/")) {
+      const piece = firstQualifyingSlashPiece(head);
+      if (piece === null) {
+        continue;
+      }
+      const pieceStart = start + piece.offset;
+      const pieceEnd = pieceStart + piece.length;
+      matches.push(buildMatch(pieceStart, pieceEnd, content.slice(pieceStart, pieceEnd), piece.entropy));
+      continue;
+    }
+    const found = labelledPieceQualifies(head);
+    if (found === null) {
+      continue;
+    }
+    matches.push(buildMatch(start, end, value, found.entropy));
+  }
+  return matches.sort((a, b) => a.start - b.start);
+}
+var SENSITIVE_LABEL_WORDS = "key|secret|token|password|passwd|api|credential|auth|bearer", caseless = (words) => words.replace(/[a-z]/g, (ch) => `[${ch}${ch.toUpperCase()}]`), ADJACENT_LABEL, LABEL_ASSIGNMENT_RE, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB, FULL_GIT_SHA_RE, UUID_RE, INTEGRITY_RE, TAG_MAX_LETTER_RUN = 8, SLUG_HEX_TAIL_RE, URL_SPAN_RE, URL_TRAILING_PUNCTUATION_RE, URL_COMPONENT_MIN_LENGTH = 20;
+var init_entropy = __esm(() => {
+  ADJACENT_LABEL = new RegExp(`(?:^|[^A-Za-z0-9])(?:${caseless(SENSITIVE_LABEL_WORDS)})[A-Za-z0-9_-]*["']?\\s*[:=]?\\s*["']?$`);
+  LABEL_ASSIGNMENT_RE = new RegExp(`(?:^|[^A-Za-z0-9])(?:${SENSITIVE_LABEL_WORDS})[A-Za-z0-9_-]*"?\\s*=\\s*"?([A-Za-z0-9+/_=-]{6,})`, "gi");
+  TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
+  TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
+  HEX_BLOB = /^[0-9a-f]{24,}$/i;
+  FULL_GIT_SHA_RE = /^[0-9a-f]{40}$/i;
+  UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  INTEGRITY_RE = /^(?:sha256|sha512)-[A-Za-z0-9+/]+=*$/;
+  SLUG_HEX_TAIL_RE = /^[0-9a-f]{10,16}$/i;
+  URL_SPAN_RE = /\bhttps?:\/\/[^\s<>"'\\]+/g;
+  URL_TRAILING_PUNCTUATION_RE = /[.,;:!?)\]}]$/;
+});
+
+// src/security/entropy-gate.ts
+function ensureLoading() {
+  if (loadStarted) {
+    return;
+  }
+  loadStarted = true;
+  loadSecurityConfig(process.cwd()).then((config) => {
+    cachedEnabled = config.backends.entropy.enabled;
+  }).catch(() => {});
+}
+function isEntropyBackendEnabled() {
+  ensureLoading();
+  return cachedEnabled;
+}
+var cachedEnabled, loadStarted = false;
+var init_entropy_gate = __esm(() => {
+  init_config();
+  cachedEnabled = DEFAULT_SECURITY_CONFIG.backends.entropy.enabled;
+});
+
 // src/security/redact.ts
 import path14 from "path";
 import { createHmac, randomBytes } from "crypto";
@@ -9129,7 +9467,12 @@ function redactSensitiveText(text) {
   if (text.length === 0) {
     return text;
   }
-  const matches = [...detectSecrets(text), ...detectPii(text), ...detectExfil(text)];
+  const matches = [
+    ...detectSecrets(text),
+    ...detectPii(text),
+    ...detectExfil(text),
+    ...isEntropyBackendEnabled() ? detectEntropy(text) : []
+  ];
   if (matches.length === 0) {
     return text;
   }
@@ -9166,6 +9509,8 @@ var init_redact = __esm(() => {
   init_secrets();
   init_pii();
   init_exfil();
+  init_entropy();
+  init_entropy_gate();
 });
 
 // src/security/output-validation.ts
@@ -9909,102 +10254,33 @@ var init_seam = __esm(() => {
   init_warn_once();
 });
 
-// src/security/detect/entropy.ts
-function lastLineOf(before) {
-  const newline = before.lastIndexOf(`
-`);
-  return newline < 0 ? before : before.slice(newline + 1);
-}
-function isWordSlug(value) {
-  const segments = value.split(/[-_]/);
-  if (segments.length < 3) {
-    return false;
-  }
-  let words = 0;
-  for (const segment of segments) {
-    const isAlpha = /^[A-Za-z]+$/.test(segment);
-    const isDigits = /^[0-9]+$/.test(segment);
-    if (!isAlpha && !isDigits) {
-      return false;
-    }
-    if (isAlpha && segment.length >= 3) {
-      words += 1;
-    }
-  }
-  return words >= 2;
-}
-function shannonEntropy(value) {
-  const counts = new Map;
-  for (const ch of value) {
-    counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  }
-  let entropy = 0;
-  for (const count of counts.values()) {
-    const p = count / value.length;
-    entropy -= p * Math.log2(p);
-  }
-  return entropy;
-}
-function detectEntropy(content) {
-  const matches = [];
-  TOKEN.lastIndex = 0;
-  let m;
-  while ((m = TOKEN.exec(content)) !== null) {
-    const value = m[0];
-    const head = TOKEN_HEAD.exec(value)?.[0] ?? value;
-    if (!/[0-9]/.test(head) && !/[+=]/.test(head)) {
-      continue;
-    }
-    if (isWordSlug(head)) {
-      continue;
-    }
-    const entropy = shannonEntropy(head);
-    const hexBlob = HEX_BLOB.test(head);
-    if (entropy < 3.6 && !hexBlob) {
-      continue;
-    }
-    const before = lastLineOf(content.slice(Math.max(0, m.index - LABEL_WINDOW), m.index));
-    if (!SENSITIVE_LABEL.test(before)) {
-      continue;
-    }
-    const confidence = Math.max(0.4, Math.min(0.7, 0.4 + (entropy - 3.6) * 0.21));
-    matches.push({
-      category: "secret",
-      policyId: "secrets.high-entropy",
-      severity: "medium",
-      confidence: Number(confidence.toFixed(2)),
-      start: m.index,
-      end: m.index + value.length,
-      value,
-      mask: "secret",
-      remediation: "Verify this high-entropy value is not a live credential."
-    });
+// src/security/detect/injection.ts
+function foldForMatching(content) {
+  let folded = "";
+  for (let i = 0;i < content.length; i += 1) {
+    const ch = content[i];
+    folded += CONFUSABLES[ch] ?? ch;
   }
-  return matches;
+  const nfkc = folded.normalize("NFKC");
+  return nfkc.length === folded.length ? nfkc : folded;
 }
-var SENSITIVE_LABEL, TOKEN, TOKEN_HEAD, LABEL_WINDOW = 40, HEX_BLOB;
-var init_entropy = __esm(() => {
-  SENSITIVE_LABEL = /(key|secret|token|password|passwd|api|credential|auth)/i;
-  TOKEN = /[A-Za-z0-9+/=_-]{20,}(?:\.[A-Za-z0-9+/=_-]{6,})*/g;
-  TOKEN_HEAD = /^[A-Za-z0-9+/=_-]+/;
-  HEX_BLOB = /^[0-9a-f]{24,}$/i;
-});
-
-// src/security/detect/injection.ts
 function detectInjection(content) {
   const matches = [];
+  const folded = foldForMatching(content);
   for (const pattern of PATTERNS) {
     pattern.regex.lastIndex = 0;
     let m;
-    while ((m = pattern.regex.exec(content)) !== null) {
+    while ((m = pattern.regex.exec(folded)) !== null) {
+      const start = Math.min(m.index, content.length);
+      const end = Math.min(m.index + m[0].length, content.length);
       matches.push({
         category: "prompt-injection",
         policyId: pattern.policyId,
         severity: "low",
         confidence: pattern.confidence,
-        start: m.index,
-        end: m.index + m[0].length,
-        value: m[0],
+        start,
+        end,
+        value: content.slice(start, end),
         remediation: "Treat external content as data, not instruction; require human review."
       });
       if (m.index === pattern.regex.lastIndex) {
@@ -10014,27 +10290,69 @@ function detectInjection(content) {
   }
   return matches;
 }
-var PATTERNS;
+var CONFUSABLES, PATTERNS;
 var init_injection = __esm(() => {
+  CONFUSABLES = {
+    "\u0430": "a",
+    "\u0410": "A",
+    "\u0435": "e",
+    "\u0415": "E",
+    "\u043E": "o",
+    "\u041E": "O",
+    "\u0440": "p",
+    "\u0420": "P",
+    "\u0441": "c",
+    "\u0421": "C",
+    "\u0445": "x",
+    "\u0425": "X",
+    "\u0443": "y",
+    "\u0423": "Y",
+    "\u0455": "s",
+    "\u0405": "S",
+    "\u0456": "o",
+    "\u0406": "O",
+    "\u0458": "j",
+    "\u0408": "J",
+    "\u03B1": "a",
+    "\u0391": "A",
+    "\u03B2": "b",
+    "\u0392": "B",
+    "\u03B5": "e",
+    "\u0395": "E",
+    "\u03B9": "i",
+    "\u0399": "I",
+    "\u03BA": "k",
+    "\u039A": "K",
+    "\u03BF": "o",
+    "\u039F": "O",
+    "\u03C1": "p",
+    "\u03A1": "P",
+    "\u03C4": "t",
+    "\u03A4": "T",
+    "\u03C5": "u",
+    "\u03A5": "Y",
+    "\u03C7": "x",
+    "\u03A7": "X"
+  };
   PATTERNS = [
     {
       policyId: "prompt-injection.ignore-instructions",
-      regex: /\b(ignore|disregard|forget|override)\b[^.\n]{0,40}\b(all\s+)?(previous|prior|above|earlier|system|developer)\b[^.\n]{0,20}\b(instructions?|prompts?|rules?|context)\b/gi,
+      regex: /\b(ignore|disregard|forget|override)\b[^.]{0,40}\b(all\s+)?(previous|prior|above|earlier|system|developer)\b[^.]{0,20}\b(instructions?|prompts?|rules?|context)\b/gi,
       confidence: 0.4
     },
     {
       policyId: "prompt-injection.reveal-context",
-      regex: /\b(reveal|show|print|expose|leak|dump|repeat)\b[^.\n]{0,30}\b(your\s+)?(system\s+prompt|instructions?|memory|secrets?|hidden\s+context|api\s*keys?)\b/gi,
+      regex: /\b(reveal|show|print|expose|leak|dump|repeat)\b[^.]{0,30}\b(your\s+)?(system\s+prompt|instructions?|memory|secrets?|hidden\s+context|api\s*keys?)\b/gi,
       confidence: 0.45
     },
     {
       policyId: "prompt-injection.role-override",
-      regex: /\b(you\s+are\s+now|from\s+now\s+on|act\s+as|pretend\s+to\s+be)\b[^.\n]{0,40}\b(unrestricted|jailbroken|dan|admin|developer\s+mode|no\s+rules)\b/gi,
+      regex: /\b(you\s+are\s+now|from\s+now\s+on|act\s+as|pretend\s+to\s+be)\b[^.]{0,40}\b(unrestricted|jailbroken|dan|admin|developer\s+mode|no\s+rules)\b/gi,
       confidence: 0.4
     },
     {
       policyId: "prompt-injection.priority-override",
-      regex: /\b(treat|follow|obey)\b[^.\n]{0,30}\b(the\s+)?(following|external|below)\b[^.\n]{0,20}\b(as\s+)?(instructions?|higher\s+priority|commands?)\b/gi,
+      regex: /\b(treat|follow|obey)\b[^.]{0,30}\b(the\s+)?(following|external|below)\b[^.]{0,20}\b(as\s+)?(instructions?|higher\s+priority|commands?)\b/gi,
       confidence: 0.35
     }
   ];
@@ -11204,6 +11522,140 @@ var init_read_source = __esm(() => {
   init_contained_path();
 });
 
+// src/security/credential-shape.ts
+function isDeniedForMcpChild(name, value) {
+  if (value !== undefined && CREDENTIAL_IN_VALUE_RE.test(value))
+    return true;
+  const upper = name.toUpperCase();
+  if (MCP_ENV_ALLOW_EXACT.includes(upper))
+    return false;
+  const conditional = VALUE_DEPENDENT[upper];
+  if (conditional !== undefined) {
+    return value === undefined ? true : conditional(value);
+  }
+  if (EXTERNAL_ENV_DENY.some((denied) => denied.toUpperCase() === upper))
+    return true;
+  if (MCP_ENV_DENY.includes(upper))
+    return true;
+  if (EXTERNAL_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix.toUpperCase())))
+    return true;
+  if (MCP_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix)))
+    return true;
+  return SECRET_SEGMENT_RE.test(upper) || SECRET_SUBSTRING_RE.test(upper) || GLUED_SECRET_RE.test(upper) || CONNECTION_STRING_RE.test(upper);
+}
+var EXTERNAL_ENV_DENY, EXTERNAL_ENV_PREFIX_SWEEPS, MCP_ENV_ALLOW_EXACT, MCP_ENV_DENY, MCP_ENV_PREFIX_SWEEPS, SECRET_SEGMENTS, SECRET_SEGMENT_RE, SECRET_SUBSTRING_RE, GLUED_SECRET_RE, CONNECTION_STRING_RE, CREDENTIAL_IN_VALUE_RE, VALUE_DEPENDENT;
+var init_credential_shape = __esm(() => {
+  EXTERNAL_ENV_DENY = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_MODEL",
+    "CLAUDE_CONFIG_DIR",
+    "CODEX_HOME",
+    "CLAUDECODE"
+  ];
+  EXTERNAL_ENV_PREFIX_SWEEPS = ["CLAUDE_CODE_", "KERYX_"];
+  MCP_ENV_ALLOW_EXACT = ["PWD", "OLDPWD"];
+  MCP_ENV_DENY = [
+    "SSH_AUTH_SOCK",
+    "SSH_AGENT_PID",
+    "GPG_AGENT_INFO",
+    "GNUPGHOME",
+    "GNOME_KEYRING_CONTROL",
+    "GNOME_KEYRING_PID",
+    "KDE_FULL_SESSION",
+    "GIT_ASKPASS",
+    "SSH_ASKPASS",
+    "SUDO_ASKPASS",
+    "GIT_CREDENTIAL_HELPER",
+    "GIT_SSH_COMMAND",
+    "KUBECONFIG",
+    "NETRC",
+    "PGPASSFILE",
+    "PGSERVICEFILE",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "CLOUDSDK_CONFIG",
+    "DOCKER_CONFIG",
+    "AWS_SHARED_CREDENTIALS_FILE",
+    "AWS_CONFIG_FILE",
+    "BOTO_CONFIG",
+    "AZURE_CONFIG_DIR",
+    "CURLRC",
+    "WGETRC",
+    "NPMRC",
+    "NPM_CONFIG_USERCONFIG",
+    "PIP_CONFIG_FILE",
+    "RCLONE_CONFIG",
+    "MAVEN_SETTINGS",
+    "GIT_CONFIG",
+    "GIT_CONFIG_GLOBAL",
+    "HGRCPATH",
+    "ANSIBLE_VAULT_PASSWORD_FILE",
+    "AZURE_CLIENT_CERTIFICATE_PATH",
+    "ARM_CLIENT_CERTIFICATE_PATH",
+    "VAULT_CLIENT_CERT",
+    "VAULT_CLIENT_KEY",
+    "SSL_CLIENT_CERT_PATH",
+    "SSL_CLIENT_KEY_FILE",
+    "IDENTITY_FILE",
+    "SSH_IDENTITY_FILE",
+    "GCP_SERVICE_ACCOUNT",
+    "XAUTHORITY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "GROQ_API_KEY",
+    "MISTRAL_API_KEY",
+    "XAI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "OPENROUTER_API_KEY",
+    "TOGETHER_API_KEY",
+    "PERPLEXITY_API_KEY"
+  ];
+  MCP_ENV_PREFIX_SWEEPS = [
+    "OP_SESSION",
+    "BW_SESSION"
+  ];
+  SECRET_SEGMENTS = [
+    "KEY",
+    "KEYS",
+    "TOKEN",
+    "TOKENS",
+    "SECRET",
+    "SECRETS",
+    "PASSWORD",
+    "PASSWD",
+    "PWD",
+    "PASS",
+    "PASSPHRASE",
+    "PASSCODE",
+    "PASSKEY",
+    "CREDENTIAL",
+    "CREDENTIALS",
+    "CREDS",
+    "AUTH",
+    "AUTHORIZATION",
+    "BEARER",
+    "JWT",
+    "COOKIE",
+    "SIGNATURE",
+    "APIKEY",
+    "SECRETKEY",
+    "ACCESSKEY",
+    "AUTHTOKEN",
+    "PAT",
+    "WEBHOOK"
+  ];
+  SECRET_SEGMENT_RE = new RegExp(`(^|_)(${SECRET_SEGMENTS.join("|")})($|_)`);
+  SECRET_SUBSTRING_RE = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|SSHPASS|SECRET|CREDENTIAL|APIKEY|KEYFILE|PRIVKEY)/;
+  GLUED_SECRET_RE = /(PRIVATE|SECRET|ACCESS|REFRESH|SESSION|CLIENT|API|APP)(KEY|TOKEN|SECRET)($|_)|DB(PASS|PWD)($|_)/;
+  CONNECTION_STRING_RE = /(^|_)(DSN|CONNECTION_STRING|CONNECTIONSTRING)($|_)/;
+  CREDENTIAL_IN_VALUE_RE = /:\/\/[^/\s@]*(:[^/\s@]*)?@/;
+  VALUE_DEPENDENT = {
+    DOCKER_HOST: (value) => !value.startsWith("unix://") && !value.startsWith("fd://")
+  };
+});
+
 // src/security/audit-harness/codex-toml.ts
 function stripComment(line) {
   let quoted = false;
@@ -17641,7 +18093,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.18",
+    version: "0.3.20",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -28787,6 +29239,11 @@ var init_service4 = __esm(() => {
   init_path_scan();
   init_read_source();
   init_redact();
+  init_secrets();
+  init_entropy();
+  init_incidents();
+  init_entropy_gate();
+  init_credential_shape();
   init_audit_harness();
   init_config();
   init_impact_evidence();
@@ -29144,7 +29601,7 @@ class OpenAiCompatEngine {
     } catch {
       host = baseUrl;
     }
-    const permitted = !isPrivateEgressHost(host) || grant.allowLoopback === true && isLoopbackHost(host) || grant.allowPrivateLan === true && isPrivateLanHost(host);
+    const permitted = !isPrivateEgressHost(host) || grant.allowLoopback === true && isLoopbackHost2(host) || grant.allowPrivateLan === true && isPrivateLanHost(host);
     if (!permitted) {
       yield errorEvent({
         kind: "invalid_request",
@@ -58893,53 +59350,18 @@ ${shown.join(`
       }
       const risk = toolByName.get(call.name)?.definition.risk;
       const isPureReadTool = risk === "read" && !DURABLE_READ_TOOL_NAMES.has(call.name);
-      if (!isPureReadTool && untrustedContentSeen) {
-        const approver = io.requestApproval;
-        if (deps.unattended === true || approver === undefined) {
-          const result = {
-            output: "tool blocked: external web content cannot authorize further tool calls in this turn",
-            isError: true
-          };
-          if (deps.unattended === true) {
-            io.onUnattendedDenial?.(call.name, "untrusted external content in this turn cannot authorize the call");
-          }
-          io.onToolResult?.(call.name, result);
-          history.push({ role: "tool", content: withBudgetWarning(result.output), provenance: "tool", toolCallId: call.id, ts: now() });
-          io.onHistoryChange?.("tool");
-          gateBlockedAny = true;
-          continue;
-        }
-        const taintFingerprint = toolCallHash(call.name, call.input);
-        let taintApproved;
-        try {
-          const response = await approver(call.name, call.input, {
-            fingerprint: taintFingerprint,
-            destructive: risk === "destructive",
-            untrustedOrigin: true
-          });
-          taintApproved = isApprovalFor(response, taintFingerprint);
-        } catch (err) {
-          const result = {
-            output: `${call.name} not executed: the approval prompt failed (${err instanceof Error ? err.message : String(err)})`,
-            isError: true
-          };
-          io.onToolResult?.(call.name, result);
-          history.push({ role: "tool", content: withBudgetWarning(result.output), provenance: "tool", toolCallId: call.id, ts: now() });
-          io.onHistoryChange?.("tool");
-          gateBlockedAny = true;
-          continue;
-        }
-        if (!taintApproved) {
-          const result = {
-            output: "tool blocked: external web content cannot authorize this call, and the user did not authorize it either",
-            isError: true
-          };
-          io.onToolResult?.(call.name, result);
-          history.push({ role: "tool", content: withBudgetWarning(result.output), provenance: "tool", toolCallId: call.id, ts: now() });
-          io.onHistoryChange?.("tool");
-          gateBlockedAny = true;
-          continue;
-        }
+      const untrustedOrigin = !isPureReadTool && untrustedContentSeen;
+      if (untrustedOrigin && deps.unattended === true) {
+        const result = {
+          output: "tool blocked: external web content cannot authorize further tool calls in this turn",
+          isError: true
+        };
+        io.onUnattendedDenial?.(call.name, "untrusted external content in this turn cannot authorize the call");
+        io.onToolResult?.(call.name, result);
+        history.push({ role: "tool", content: withBudgetWarning(result.output), provenance: "tool", toolCallId: call.id, ts: now() });
+        io.onHistoryChange?.("tool");
+        gateBlockedAny = true;
+        continue;
       }
       io.onToolCall?.(call.name, call.input);
       const reservation = reservationByCallId.get(call.id) ?? reserveToolAttempt(budget, call.name, call.input);
@@ -58961,7 +59383,7 @@ ${shown.join(`
         result = precomputedResult;
       } else {
         try {
-          result = await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.readOnly, io.onAutoApproved, hasInvocationCapacity, reserveInvocation, invocationBudget.maxCalls, signal, deps.busLeases, deps.hardDeny === undefined ? undefined : { check: deps.hardDeny, onDenied: io.onUnattendedDenial }, deps.hooks);
+          result = await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.readOnly, io.onAutoApproved, hasInvocationCapacity, reserveInvocation, invocationBudget.maxCalls, signal, deps.busLeases, deps.hardDeny === undefined ? undefined : { check: deps.hardDeny, onDenied: io.onUnattendedDenial }, deps.hooks, untrustedOrigin);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           result = { output: `${call.name} failed: ${message}`, isError: true };
@@ -59531,7 +59953,7 @@ function composeWithHook(toolName, rawDecision, hookResult, interactive) {
   }
   return { decision, hookTightened: true, hookAsked, ...denyMessage !== undefined ? { denyMessage } : {} };
 }
-async function executeCall(call, toolByName, requestApproval, permissionMode, readOnly, onAutoApproved, hasInvocationCapacity, reserveInvocation, maxToolCalls, signal, busLeases, hardDeny, hooks) {
+async function executeCall(call, toolByName, requestApproval, permissionMode, readOnly, onAutoApproved, hasInvocationCapacity, reserveInvocation, maxToolCalls, signal, busLeases, hardDeny, hooks, untrustedOrigin = false) {
   const tool = toolByName.get(call.name);
   if (tool === undefined) {
     return { output: `unknown tool: ${call.name}`, isError: true };
@@ -59557,6 +59979,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
     }
   }
   const mode = permissionMode?.() ?? DEFAULT_PERMISSION_MODE;
+  const untrustedDenial = "tool blocked: external web content cannot authorize this call, and the user did not authorize it either";
   const isReadOnly = readOnly?.() ?? false;
   let hookResult;
   if (hooks !== undefined) {
@@ -59597,7 +60020,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
         isError: true
       };
     }
-    if (gated.decision === "auto") {
+    if (gated.decision === "auto" && !untrustedOrigin) {
       onAutoApproved?.(call.name, call.input, { destructive, credentials });
     } else {
       const fingerprint = toolCallHash(call.name, call.input);
@@ -59607,10 +60030,11 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
         ...credentials ? { credentials } : {},
         ...publishLease ? { publishLease } : {},
         ...publishLease && publishLeaseHolder !== undefined ? { publishLeaseDetail: `held by @${publishLeaseHolder.name} \u2014 "${publishLeaseHolder.reason}"` } : {},
-        ...gated.hookAsked ? { hookAsk: true } : {}
+        ...gated.hookAsked ? { hookAsk: true } : {},
+        ...untrustedOrigin ? { untrustedOrigin: true } : {}
       });
       if (!isApprovalFor(response, fingerprint)) {
-        return { output: `command not approved by the user; not executed`, isError: true };
+        return { output: untrustedOrigin ? untrustedDenial : "command not approved by the user; not executed", isError: true };
       }
     }
   } else if (risk === "delegate") {
@@ -59629,17 +60053,18 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
         isError: true
       };
     }
-    if (gated.decision === "auto") {
+    if (gated.decision === "auto" && !untrustedOrigin) {
       onAutoApproved?.(call.name, call.input, { destructive: false, credentials: false });
     } else {
       const fingerprint = toolCallHash(call.name, call.input);
       const response = requestApproval === undefined ? false : await requestApproval(call.name, call.input, {
         fingerprint,
         destructive: false,
-        ...gated.hookAsked ? { hookAsk: true } : {}
+        ...gated.hookAsked ? { hookAsk: true } : {},
+        ...untrustedOrigin ? { untrustedOrigin: true } : {}
       });
       if (!isApprovalFor(response, fingerprint)) {
-        return { output: `subagent spawn not approved by the user; not executed`, isError: true };
+        return { output: untrustedOrigin ? untrustedDenial : "subagent spawn not approved by the user; not executed", isError: true };
       }
     }
   } else if (risk === "write") {
@@ -59670,7 +60095,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
         isError: true
       };
     }
-    if (gated.decision === "auto") {
+    if (gated.decision === "auto" && !untrustedOrigin) {
       onAutoApproved?.(call.name, call.input, { destructive, credentials });
     } else {
       const fingerprint = toolCallHash(call.name, call.input);
@@ -59679,13 +60104,14 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
         destructive,
         ...credentials ? { credentials } : {},
         ...card !== undefined ? { alwaysAsk: true, card } : {},
-        ...gated.hookAsked ? { hookAsk: true } : {}
+        ...gated.hookAsked ? { hookAsk: true } : {},
+        ...untrustedOrigin ? { untrustedOrigin: true } : {}
       });
       if (!isApprovalFor(response, fingerprint)) {
         if (confirmationToken !== undefined)
           tool.confirmationDeclined?.(confirmationToken);
         return {
-          output: card !== undefined ? `${call.name} not confirmed by the operator; nothing was written or installed` : `patch not approved by the user; not executed`,
+          output: untrustedOrigin ? untrustedDenial : card !== undefined ? `${call.name} not confirmed by the operator; nothing was written or installed` : `patch not approved by the user; not executed`,
           isError: true
         };
       }
@@ -59698,11 +60124,11 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
     if (gated.decision === "deny") {
       return { output: gated.denyMessage ?? `tool "${call.name}" refused by a policy hook`, isError: true };
     }
-    if (gated.decision === "ask") {
+    if (gated.decision === "ask" || untrustedOrigin) {
       const fingerprint = toolCallHash(call.name, call.input);
-      const response = requestApproval === undefined ? false : await requestApproval(call.name, call.input, { fingerprint, destructive: false, hookAsk: true });
+      const response = requestApproval === undefined ? false : await requestApproval(call.name, call.input, { fingerprint, destructive: false, ...gated.hookAsked ? { hookAsk: true } : {}, ...untrustedOrigin ? { untrustedOrigin: true } : {} });
       if (!isApprovalFor(response, fingerprint)) {
-        return { output: `${call.name} not approved by the user; not executed`, isError: true };
+        return { output: untrustedOrigin ? untrustedDenial : `${call.name} not approved by the user; not executed`, isError: true };
       }
     }
   } else {
@@ -112158,6 +112584,7 @@ function resolveFqn(catalog, fqn) {
 }
 
 // src/mcp-servers/http-headers.ts
+init_service4();
 var VAR_PATTERN2 = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}/;
 var VAR_PATTERN_ALL = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
 function unresolvedVariables(raw, env) {
@@ -112275,6 +112702,14 @@ function elideCredentialText(raw) {
   const trimmed = query === -1 ? raw : `${raw.slice(0, query)}?\u2026`;
   return trimmed.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:)?\/\/[^/@]*@/, (_m, scheme) => `${scheme ?? ""}//\u2026@`);
 }
+var MASKED_SEGMENT_MIN_LENGTH = 16;
+function maskSecretShapedPathSegments(pathname) {
+  return pathname.split("/").map((segment) => {
+    if (segment.length < MASKED_SEGMENT_MIN_LENGTH)
+      return segment;
+    return detectSecrets(segment).length > 0 || looksSecretShaped(segment) ? "\u2026" : segment;
+  }).join("/");
+}
 function displayUrl(raw) {
   if (raw === undefined)
     return "";
@@ -112284,7 +112719,8 @@ function displayUrl(raw) {
     const parsed = new URL(raw);
     const query = parsed.search === "" ? "" : "?\u2026";
     const auth = parsed.username === "" ? "" : "\u2026@";
-    return `${parsed.protocol}//${auth}${parsed.host}${parsed.pathname}${query}`;
+    const pathname = maskSecretShapedPathSegments(parsed.pathname);
+    return `${parsed.protocol}//${auth}${parsed.host}${pathname}${query}`;
   } catch {
     return elideCredentialText(raw);
   }
@@ -113695,139 +114131,10 @@ function fileForScope(scope, targets) {
   return projectConfigFile(targets.projectRoot);
 }
 
-// src/harness/external/env-deny.ts
-var EXTERNAL_ENV_DENY = [
-  "ANTHROPIC_API_KEY",
-  "ANTHROPIC_AUTH_TOKEN",
-  "ANTHROPIC_BASE_URL",
-  "ANTHROPIC_MODEL",
-  "CLAUDE_CONFIG_DIR",
-  "CODEX_HOME",
-  "CLAUDECODE"
-];
-var EXTERNAL_ENV_PREFIX_SWEEPS = ["CLAUDE_CODE_", "KERYX_"];
-
 // src/mcp-servers/spawn-env.ts
+init_service4();
 init_shell_config();
-var MCP_ENV_ALLOW_EXACT = ["PWD", "OLDPWD"];
-var MCP_ENV_DENY = [
-  "SSH_AUTH_SOCK",
-  "SSH_AGENT_PID",
-  "GPG_AGENT_INFO",
-  "GNUPGHOME",
-  "GNOME_KEYRING_CONTROL",
-  "GNOME_KEYRING_PID",
-  "KDE_FULL_SESSION",
-  "GIT_ASKPASS",
-  "SSH_ASKPASS",
-  "SUDO_ASKPASS",
-  "GIT_CREDENTIAL_HELPER",
-  "GIT_SSH_COMMAND",
-  "KUBECONFIG",
-  "NETRC",
-  "PGPASSFILE",
-  "PGSERVICEFILE",
-  "GOOGLE_APPLICATION_CREDENTIALS",
-  "CLOUDSDK_CONFIG",
-  "DOCKER_CONFIG",
-  "AWS_SHARED_CREDENTIALS_FILE",
-  "AWS_CONFIG_FILE",
-  "BOTO_CONFIG",
-  "AZURE_CONFIG_DIR",
-  "CURLRC",
-  "WGETRC",
-  "NPMRC",
-  "NPM_CONFIG_USERCONFIG",
-  "PIP_CONFIG_FILE",
-  "RCLONE_CONFIG",
-  "MAVEN_SETTINGS",
-  "GIT_CONFIG",
-  "GIT_CONFIG_GLOBAL",
-  "HGRCPATH",
-  "ANSIBLE_VAULT_PASSWORD_FILE",
-  "AZURE_CLIENT_CERTIFICATE_PATH",
-  "ARM_CLIENT_CERTIFICATE_PATH",
-  "VAULT_CLIENT_CERT",
-  "VAULT_CLIENT_KEY",
-  "SSL_CLIENT_CERT_PATH",
-  "SSL_CLIENT_KEY_FILE",
-  "IDENTITY_FILE",
-  "SSH_IDENTITY_FILE",
-  "GCP_SERVICE_ACCOUNT",
-  "XAUTHORITY",
-  "OPENAI_API_KEY",
-  "GEMINI_API_KEY",
-  "GOOGLE_API_KEY",
-  "GROQ_API_KEY",
-  "MISTRAL_API_KEY",
-  "XAI_API_KEY",
-  "DEEPSEEK_API_KEY",
-  "OPENROUTER_API_KEY",
-  "TOGETHER_API_KEY",
-  "PERPLEXITY_API_KEY"
-];
-var MCP_ENV_PREFIX_SWEEPS = [
-  "OP_SESSION",
-  "BW_SESSION"
-];
-var SECRET_SEGMENTS = [
-  "KEY",
-  "KEYS",
-  "TOKEN",
-  "TOKENS",
-  "SECRET",
-  "SECRETS",
-  "PASSWORD",
-  "PASSWD",
-  "PWD",
-  "PASS",
-  "PASSPHRASE",
-  "PASSCODE",
-  "PASSKEY",
-  "CREDENTIAL",
-  "CREDENTIALS",
-  "CREDS",
-  "AUTH",
-  "AUTHORIZATION",
-  "BEARER",
-  "JWT",
-  "COOKIE",
-  "SIGNATURE",
-  "APIKEY",
-  "SECRETKEY",
-  "ACCESSKEY",
-  "AUTHTOKEN",
-  "PAT",
-  "WEBHOOK"
-];
-var SECRET_SEGMENT_RE = new RegExp(`(^|_)(${SECRET_SEGMENTS.join("|")})($|_)`);
-var SECRET_SUBSTRING_RE = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|SSHPASS|SECRET|CREDENTIAL|APIKEY|KEYFILE|PRIVKEY)/;
-var GLUED_SECRET_RE = /(PRIVATE|SECRET|ACCESS|REFRESH|SESSION|CLIENT|API|APP)(KEY|TOKEN|SECRET)|DB(PASS|PWD)/;
-var CONNECTION_STRING_RE = /(^|_)(DSN|CONNECTION_STRING|CONNECTIONSTRING)($|_)/;
-var CREDENTIAL_IN_VALUE_RE = /:\/\/[^/\s@]*(:[^/\s@]*)?@/;
-var VALUE_DEPENDENT = {
-  DOCKER_HOST: (value) => !value.startsWith("unix://") && !value.startsWith("fd://")
-};
-function isDeniedForMcpChild(name, value) {
-  if (value !== undefined && CREDENTIAL_IN_VALUE_RE.test(value))
-    return true;
-  const upper = name.toUpperCase();
-  if (MCP_ENV_ALLOW_EXACT.includes(upper))
-    return false;
-  const conditional = VALUE_DEPENDENT[upper];
-  if (conditional !== undefined) {
-    return value === undefined ? true : conditional(value);
-  }
-  if (EXTERNAL_ENV_DENY.some((denied) => denied.toUpperCase() === upper))
-    return true;
-  if (MCP_ENV_DENY.includes(upper))
-    return true;
-  if (EXTERNAL_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix.toUpperCase())))
-    return true;
-  if (MCP_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix)))
-    return true;
-  return SECRET_SEGMENT_RE.test(upper) || SECRET_SUBSTRING_RE.test(upper) || GLUED_SECRET_RE.test(upper) || CONNECTION_STRING_RE.test(upper);
-}
+init_service4();
 function buildMcpChildEnv(input) {
   const saved = input.savedCredentialKeys ?? new Set([...savedCredentialEnvKeys(), ...declaredCredentialEnvKeys(input.configDir)]);
   const env = {};
@@ -128843,6 +129150,70 @@ function createSystemWebWorkerRunner() {
   return new SystemWebWorkerRunner({ workspace: process.cwd(), home: homedir10() });
 }
 
+// src/harness/web/outbound-secret.ts
+init_service4();
+function safeDecodeComponent(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function outboundUrlComponents(text) {
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    return [];
+  }
+  const components = [];
+  for (const segment of url.pathname.split("/")) {
+    if (segment.length > 0) {
+      components.push(safeDecodeComponent(segment));
+    }
+  }
+  for (const [, value] of url.searchParams) {
+    if (value.length > 0) {
+      components.push(value);
+    }
+  }
+  if (url.hash.length > 1) {
+    components.push(safeDecodeComponent(url.hash.slice(1)));
+  }
+  return components;
+}
+function anyComponentLooksSecret(text) {
+  const entropyGateOpen = isEntropyBackendEnabled();
+  for (const component of outboundUrlComponents(text)) {
+    if (detectSecrets(component).length > 0) {
+      return true;
+    }
+    if (entropyGateOpen && looksSecretShapedIn(component)) {
+      return true;
+    }
+  }
+  return false;
+}
+function containsOutboundSecret(text) {
+  if (detectSecrets(text).length > 0) {
+    return true;
+  }
+  if (isEntropyBackendEnabled() && detectEntropy(text).length > 0) {
+    return true;
+  }
+  return anyComponentLooksSecret(text);
+}
+async function recordOutboundSecretFinding(cwd, tool, subject) {
+  try {
+    await appendIncident(cwd, {
+      at: new Date().toISOString(),
+      type: "egress-blocked",
+      message: "outbound secret-shaped content",
+      details: { policyId: "egress.outbound-secret", tool, subject }
+    });
+  } catch {}
+}
+
 // src/harness/tool/builtin/web-fetch-tool.ts
 function transportFor(deps) {
   if (deps.transport !== undefined)
@@ -128866,6 +129237,12 @@ function webFetchTool(deps = {}) {
       if (typeof input.url !== "string") {
         return { output: "web_fetch: url must be an absolute HTTPS URL without credentials", isError: true };
       }
+      if (containsOutboundSecret(input.url)) {
+        if (deps.cwd !== undefined) {
+          await recordOutboundSecretFinding(deps.cwd, "web_fetch", "url");
+        }
+        return { output: "web_fetch: outbound secret-shaped content", isError: true };
+      }
       const result = await transport.fetchPage({ url: input.url, providerId: "web_fetch" });
       return result.ok ? { output: result.value.text, isError: false, untrusted: true } : { output: `web_fetch: ${result.reason}`, isError: true };
     }
@@ -128896,7 +129273,7 @@ ${result.canonicalUrl}`;
   return lines.join(`
 `).trim();
 }
-function webSearchTool(service) {
+function webSearchTool(service, deps = {}) {
   return {
     definition: {
       name: "web_search",
@@ -128908,7 +129285,14 @@ function webSearchTool(service) {
       if (typeof input.query !== "string" || input.query.trim().length === 0) {
         return { output: "web_search: query must be a non-empty string", isError: true };
       }
-      const response = await service.search(input.query.trim());
+      const query = input.query.trim();
+      if (containsOutboundSecret(query)) {
+        if (deps.cwd !== undefined) {
+          await recordOutboundSecretFinding(deps.cwd, "web_search", "query");
+        }
+        return { output: "web_search: outbound secret-shaped content", isError: true };
+      }
+      const response = await service.search(query);
       if (!response.ok) {
         return {
           output: response.reason === "no-active-provider" ? "web_search: no active connected provider. Use /search-provider to configure one, test it, then use /search-connect to select it." : response.reason === "search-failed" ? `web_search: search failed${response.detail !== undefined && response.detail.length > 0 ? ` (${response.detail})` : ""}. Wait a few minutes before trying again, and do not switch providers yourself.` : "web_search: active provider is unavailable; reconnect it with /search-provider before retrying.",
@@ -129404,8 +129788,8 @@ function buildInteractiveAgentTools(input) {
   const built = [
     ...builtinReadOnlyTools(input.cwd),
     ...metaprojectTools,
-    webFetchTool(),
-    webSearchTool(input.searchController),
+    webFetchTool({ cwd: input.cwd }),
+    webSearchTool(input.searchController, { cwd: input.cwd }),
     shellExecTool(input.cwd, undefined, jobRegistry),
     ...jobRegistry !== undefined ? [
       shellTaskOutputTool(jobRegistry, { observer: "main" }),
@@ -129878,12 +130262,13 @@ function evaluateShellApproval(input) {
   const publishLease = input.meta?.publishLease === true;
   const publishLeaseDetail = input.meta?.publishLeaseDetail;
   const hookAsk = input.meta?.hookAsk === true;
+  const untrustedOrigin = input.meta?.untrustedOrigin === true;
   const audit = io.loadAudit();
   for (const pattern of audit.permissions.allow) {
     input.sessionAllow.add(pattern);
   }
   const tampered = io.fingerprint() !== input.fingerprintAtStart;
-  const autoApprove = !destructive && !credentials && !sacReviewConfirmation && !publishLease && !hookAsk && isShellCommandAllowed(command, [...input.sessionAllow]);
+  const autoApprove = !destructive && !credentials && !sacReviewConfirmation && !publishLease && !hookAsk && !untrustedOrigin && isShellCommandAllowed(command, [...input.sessionAllow]);
   return {
     command,
     destructive,
@@ -129892,6 +130277,7 @@ function evaluateShellApproval(input) {
     publishLease,
     ...publishLeaseDetail !== undefined ? { publishLeaseDetail } : {},
     hookAsk,
+    untrustedOrigin,
     autoApprove,
     rejected: audit.rejected,
     tampered
@@ -129925,6 +130311,9 @@ function formatShellApprovalHints(evaled) {
   if (evaled.hookAsk) {
     lines.push("a policy hook asked about this call \u2014 will not be remembered");
   }
+  if (evaled.untrustedOrigin) {
+    lines.push("follows untrusted external content \u2014 will not be remembered");
+  }
   if (evaled.publishLease) {
     lines.push(evaled.publishLeaseDetail !== undefined ? `a git-publish lease applies \u2014 ${evaled.publishLeaseDetail} \u2014 will not be remembered` : "a peer's git-publish lease applies \u2014 will not be remembered");
   }
@@ -131998,6 +132387,12 @@ function readRuntimeBlock(dispatch) {
   return raw;
 }
 
+// src/harness/external/env.ts
+init_service4();
+
+// src/harness/external/env-deny.ts
+init_service4();
+
 // src/harness/external/env.ts
 var EXTERNAL_RUNTIME_CREDENTIAL_ALLOW = {
   "codex-cli": ["OPENAI_API_KEY"],
@@ -132005,17 +132400,18 @@ var EXTERNAL_RUNTIME_CREDENTIAL_ALLOW = {
 };
 var ENV_EXTERNAL_DEPTH = "KERYX_EXTERNAL_DEPTH";
 function buildExternalChildEnv(input) {
-  const denied = new Set(EXTERNAL_ENV_DENY);
+  const denied = new Set(EXTERNAL_ENV_DENY.map((name) => name.toUpperCase()));
   const allowedForThisRuntime = new Set((EXTERNAL_RUNTIME_CREDENTIAL_ALLOW[input.runtimeId] ?? []).map((name) => name.toUpperCase()));
   const env = {};
   for (const [key, value] of Object.entries(input.parent)) {
     if (value === undefined)
       continue;
-    if (denied.has(key))
+    const upper = key.toUpperCase();
+    if (denied.has(upper))
       continue;
-    if (EXTERNAL_ENV_PREFIX_SWEEPS.some((prefix) => key.startsWith(prefix)))
+    if (EXTERNAL_ENV_PREFIX_SWEEPS.some((prefix) => upper.startsWith(prefix.toUpperCase())))
       continue;
-    if (!allowedForThisRuntime.has(key.toUpperCase()) && isDeniedForMcpChild(key, value))
+    if (!allowedForThisRuntime.has(upper) && isDeniedForMcpChild(key, value))
       continue;
     env[key] = value;
   }
@@ -148088,7 +148484,7 @@ function ollamaShowAllowed(baseUrl) {
   } catch {
     return false;
   }
-  if (isPrivateEgressHost(host) && !isLoopbackHost(host)) {
+  if (isPrivateEgressHost(host) && !isLoopbackHost2(host)) {
     return false;
   }
   return true;
@@ -155602,8 +155998,8 @@ async function recordTurnTaskCostBestEffort(input) {
     }, input.userConfigDir);
   } catch {}
 }
-function shouldAutoApproveReadOnlySpawn(mode, hookAsk) {
-  return mode === "read_only" && hookAsk !== true;
+function shouldAutoApproveReadOnlySpawn(mode, hookAsk, untrustedOrigin) {
+  return mode === "read_only" && hookAsk !== true && untrustedOrigin !== true;
 }
 function isUserPromptApprovalCard(tool) {
   return tool === "user_prompt";
@@ -157819,7 +158215,7 @@ async function launchTuiAgentShell(opts) {
             }
           }
         } catch {}
-        if (shouldAutoApproveReadOnlySpawn(mode, meta?.hookAsk)) {
+        if (shouldAutoApproveReadOnlySpawn(mode, meta?.hookAsk, meta?.untrustedOrigin)) {
           transcript.add(new otui.TextRenderable(r, {
             id: `ap${uid++}`,
             content: otui.t`${roleChunk(otui, "accent", "\u25C7 subagent auto-approved")} ${dimChunk(otui, `mode=read_only (no shell) \xB7 ${taskPreview}`)}`
@@ -157829,7 +158225,7 @@ async function launchTuiAgentShell(opts) {
         chrome.hideMenu();
         setMainAgent("blocked", "approval");
         const id = await chrome.withOverlay(() => showComposerChoice(otui, r, chrome.dock, {
-          title: mode === "read_only" ? "Spawn read-only subagent? (policy hook asked)" : "Spawn general subagent?",
+          title: mode === "read_only" ? meta?.hookAsk === true ? "Spawn read-only subagent? (policy hook asked)" : "Spawn read-only subagent? (follows untrusted content)" : "Spawn general subagent?",
           subtitle: taskPreview,
           cancelId: "deny",
           onOpen: () => chrome.blurComposer(),
@@ -158024,7 +158420,7 @@ async function launchTuiAgentShell(opts) {
       const choice = await chrome.withOverlay(() => pickShellApproval(otui, r, chrome.dock, cmd, approvalContext, destructive, meta?.credentials === true, {
         onOpen: () => chrome.blurComposer(),
         signal: foregroundOperation.signal
-      }, ev.publishLease, ev.publishLeaseDetail, ev.hookAsk));
+      }, ev.publishLease, ev.publishLeaseDetail, ev.hookAsk || ev.untrustedOrigin));
       input.focus();
       if (choice === "deny") {
         transcript.add(new otui.TextRenderable(r, {
@@ -162300,7 +162696,7 @@ ${indentBlock(style.dim(context), GUTTER)}`);
         out(`${GUTTER}${style.yellow(hint)}
 `);
       }
-      const rememberable = !evaled.destructive && !evaled.credentials && !evaled.sacReviewConfirmation && !evaled.publishLease && !evaled.hookAsk;
+      const rememberable = !evaled.destructive && !evaled.credentials && !evaled.sacReviewConfirmation && !evaled.publishLease && !evaled.hookAsk && !evaled.untrustedOrigin;
       const prompt = rememberable ? "[y/N/A=always] " : "[y/N] ";
       out(`
 ${GUTTER}${style.yellow(`Run: ${evaled.command}`)} ${style.dim(prompt)}`);