@mrciphersmith/keryx 0.3.51 → 0.3.52

package/dist/cli.js

@@ -20094,7 +20094,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.51",
+    version: "0.3.52",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -109149,7 +109149,7 @@ var init_serve_credential = __esm(() => {
 });
 
 // src/remote/shell-token.ts
-import { createHash as createHash62, randomBytes as randomBytes10 } from "crypto";
+import { createHash as createHash62, createHmac as createHmac5, randomBytes as randomBytes10 } from "crypto";
 import { statSync as statSync16 } from "fs";
 import path246 from "path";
 function shellTokenPath(dir) {
@@ -109191,16 +109191,59 @@ function mintShellToken(dir) {
 function readShellToken(dir) {
   return readValidated(shellTokenPath(dir));
 }
+function mac(token, parts) {
+  const hmac = createHmac5("sha256", token);
+  for (const part of parts) {
+    const bytes = Buffer.from(part, "utf8");
+    hmac.update(`${bytes.byteLength}:`);
+    hmac.update(bytes);
+  }
+  return hmac.digest("base64url");
+}
+function macEqual(a, b) {
+  return constantTimeEqual(createHash62("sha256").update(a, "utf8").digest(), createHash62("sha256").update(b, "utf8").digest());
+}
+function shellRequestCredential(token) {
+  const nonce = randomBytes10(18).toString("base64url");
+  return { nonce, bearer: `${DERIVED_BEARER_PREFIX}${nonce}.${mac(token, [AUTH_DOMAIN, nonce])}` };
+}
+function derivedBearerNonce(presented) {
+  if (!presented.startsWith(DERIVED_BEARER_PREFIX)) {
+    return;
+  }
+  const [nonce, presentedMac, ...rest] = presented.slice(DERIVED_BEARER_PREFIX.length).split(".");
+  if (rest.length > 0 || nonce === undefined || presentedMac === undefined || !NONCE_SHAPE.test(nonce) || !MAC_SHAPE.test(presentedMac)) {
+    return;
+  }
+  return nonce;
+}
+function serveResponseProof(token, nonce, route, status, body) {
+  return mac(token, [PROOF_DOMAIN, nonce, route, String(status), body]);
+}
+function verifyServeResponseProof(token, nonce, route, status, body, presented) {
+  if (presented === null || !MAC_SHAPE.test(presented)) {
+    return false;
+  }
+  return macEqual(serveResponseProof(token, nonce, route, status, body), presented);
+}
 function createShellTokenVerifier(token) {
   const expected = createHash62("sha256").update(token, "utf8").digest();
-  return (presented) => constantTimeEqual(createHash62("sha256").update(presented, "utf8").digest(), expected);
+  return (presented) => {
+    const nonce = derivedBearerNonce(presented);
+    if (nonce !== undefined) {
+      return macEqual(presented, `${DERIVED_BEARER_PREFIX}${nonce}.${mac(token, [AUTH_DOMAIN, nonce])}`);
+    }
+    return constantTimeEqual(createHash62("sha256").update(presented, "utf8").digest(), expected);
+  };
 }
-var SHELL_TOKEN_FILE = "shell-token", TOKEN_SHAPE;
+var SHELL_TOKEN_FILE = "shell-token", TOKEN_SHAPE, SERVE_PROOF_HEADER = "x-keryx-serve-proof", DERIVED_BEARER_PREFIX = "ksp1.", AUTH_DOMAIN = "keryx-shell-auth-v1", PROOF_DOMAIN = "keryx-serve-proof-v1", NONCE_SHAPE, MAC_SHAPE;
 var init_shell_token = __esm(() => {
   init_config_dir();
   init_serve_credential();
   init_paths4();
   TOKEN_SHAPE = /^[A-Za-z0-9_-]{32,128}$/;
+  NONCE_SHAPE = /^[A-Za-z0-9_-]{22,64}$/;
+  MAC_SHAPE = /^[A-Za-z0-9_-]{43}$/;
 });
 
 // src/remote/client.ts
@@ -109376,6 +109419,7 @@ class RemoteClient {
     });
   }
   target(route, query = "") {
+    const token = readShellToken(this.options.dir);
     const endpoint = readEndpoint(this.options.dir);
     if (!endpoint.ok) {
       throw new TransientClientError(endpoint.reason);
@@ -109386,7 +109430,6 @@ class RemoteClient {
     if (!this.isAlive(endpoint.value.pid)) {
       throw new TransientClientError(`the serve named in the endpoint file (pid ${endpoint.value.pid}) is not running as this user; refusing to send the shell token to whatever listens on that port`);
     }
-    const token = readShellToken(this.options.dir);
     if (!token.ok) {
       throw new TransientClientError(token.reason);
     }
@@ -109394,12 +109437,19 @@ class RemoteClient {
   }
   async post(route, body) {
     const { url, token } = this.target(route);
-    return this.fetchImpl(url, {
+    const { nonce, bearer } = shellRequestCredential(token);
+    const response = await this.fetchImpl(url, {
       method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      redirect: "manual",
+      headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
       body: JSON.stringify(body),
       signal: AbortSignal.any([AbortSignal.timeout(this.requestTimeoutMs), this.lifetime.signal])
     });
+    const text = await response.text();
+    if (!verifyServeResponseProof(token, nonce, route, response.status, text, response.headers.get(SERVE_PROOF_HEADER))) {
+      throw new TransientClientError(UNVERIFIED_SERVE_MESSAGE);
+    }
+    return new Response(text, { status: response.status, headers: response.headers });
   }
   async heartbeat() {
     if (this.stopped || this.name === undefined) {
@@ -109461,11 +109511,18 @@ class RemoteClient {
     const abort = new AbortController;
     this.streamAbort = abort;
     const { url, token } = this.target("stream", `?sessionId=${encodeURIComponent(this.options.sessionId)}`);
-    const headers = { authorization: `Bearer ${token}`, accept: "text/event-stream" };
+    const { nonce, bearer } = shellRequestCredential(token);
+    const headers = { authorization: `Bearer ${bearer}`, accept: "text/event-stream" };
     if (this.lastCompleted > 0) {
       headers["last-event-id"] = String(this.lastCompleted);
     }
-    const response = await this.fetchImpl(url, { method: "GET", headers, signal: AbortSignal.any([abort.signal, this.lifetime.signal]) });
+    const response = await this.fetchImpl(url, { method: "GET", redirect: "manual", headers, signal: AbortSignal.any([abort.signal, this.lifetime.signal]) });
+    if (!verifyServeResponseProof(token, nonce, "stream", response.status, "", response.headers.get(SERVE_PROOF_HEADER))) {
+      await response.body?.cancel().catch(() => {
+        return;
+      });
+      throw new TransientClientError(UNVERIFIED_SERVE_MESSAGE);
+    }
     if (!response.ok || response.body === null) {
       await response.text().catch(() => "");
       if (response.status === 404) {
@@ -109619,7 +109676,7 @@ class RemoteClient {
     this.earlyDecisions.clear();
   }
 }
-var FatalClientError, TransientClientError, DEFAULT_BACKOFF_INITIAL_MS = 250, DEFAULT_BACKOFF_MAX_MS = 15000, DEFAULT_REQUEST_TIMEOUT_MS = 1e4, MAX_EARLY_DECISIONS = 32, MAX_COMPLETED_IDS = 256;
+var UNVERIFIED_SERVE_MESSAGE = "the program answering on keryx serve's port did not prove it is the keryx serve this shell trusts; its answer was ignored. Restart `keryx serve` (an older serve cannot prove itself; update keryx on both sides)", FatalClientError, TransientClientError, DEFAULT_BACKOFF_INITIAL_MS = 250, DEFAULT_BACKOFF_MAX_MS = 15000, DEFAULT_REQUEST_TIMEOUT_MS = 1e4, MAX_EARLY_DECISIONS = 32, MAX_COMPLETED_IDS = 256;
 var init_client3 = __esm(() => {
   init_serve_config();
   init_lease();
@@ -110205,6 +110262,7 @@ class ChannelsClient {
     return { ok: true, value: { deleted, remaining, topicsDeleted: hubWasRunning && remaining === 0, erased, message: `${topics} ${gone}` } };
   }
   target(route) {
+    const token = readShellToken(this.options.dir);
     const endpoint = readEndpoint(this.options.dir);
     if (!endpoint.ok) {
       throw new ServeDown("serve-down", `keryx serve is not running (${endpoint.reason})`);
@@ -110215,28 +110273,23 @@ class ChannelsClient {
     if (!this.isAlive(endpoint.value.pid)) {
       throw new ServeDown("serve-down", `keryx serve is not running (pid ${endpoint.value.pid} is gone); start it with \`keryx serve\``);
     }
-    const token = readShellToken(this.options.dir);
     if (!token.ok) {
       throw new ServeDown("serve-down", `keryx serve is not accepting the shell yet (${token.reason})`);
     }
     return { url: `http://${authority(endpoint.value.address, endpoint.value.port)}${channelsRoutePath(route)}`, token: token.value };
   }
-  async post(route) {
+  async send(route) {
     const { url, token } = this.target(route);
-    return this.fetchImpl(url, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: "{}",
+    const { nonce, bearer } = shellRequestCredential(token);
+    const post = CHANNELS_ROUTE_METHODS[route] === "POST";
+    const response = await this.fetchImpl(url, {
+      method: post ? "POST" : "GET",
+      redirect: "manual",
+      headers: post ? { authorization: `Bearer ${bearer}`, "content-type": "application/json" } : { authorization: `Bearer ${bearer}` },
+      ...post ? { body: "{}" } : {},
       signal: AbortSignal.timeout(route === "channels-disconnect" ? this.requestTimeoutMs * DISCONNECT_TIMEOUT_FACTOR : this.requestTimeoutMs)
     });
-  }
-  async get(route) {
-    const { url, token } = this.target(route);
-    return this.fetchImpl(url, {
-      method: "GET",
-      headers: { authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(this.requestTimeoutMs)
-    });
+    return { response, token, nonce };
   }
   reachable() {
     try {
@@ -110250,9 +110303,11 @@ class ChannelsClient {
     }
   }
   async call(route, guard) {
-    let response;
+    let sent;
+    let text;
     try {
-      response = CHANNELS_ROUTE_METHODS[route] === "GET" ? await this.get(route) : await this.post(route);
+      sent = await this.send(route);
+      text = await sent.response.text();
     } catch (error) {
       if (error instanceof ServeDown) {
         return { ok: false, code: error.code, reason: error.message };
@@ -110266,9 +110321,13 @@ class ChannelsClient {
         reason: "keryx serve did not answer in time or dropped the connection, so the outcome is unknown. Check /channels, then retry if needed."
       };
     }
+    const { response, token, nonce } = sent;
+    if (!verifyServeResponseProof(token, nonce, route, response.status, text, response.headers.get(SERVE_PROOF_HEADER))) {
+      return { ok: false, code: "unverified-serve", reason: UNVERIFIED_SERVE_REASON };
+    }
     let parsed;
     try {
-      parsed = JSON.parse(await response.text());
+      parsed = JSON.parse(text);
     } catch {
       parsed = undefined;
     }
@@ -110314,7 +110373,7 @@ function refusedConnection(error) {
 function isPairing(body) {
   return typeof body.state === "string" && typeof body.expiresAt === "number" && Array.isArray(body.problems);
 }
-var DEFAULT_REQUEST_TIMEOUT_MS2 = 15000, DISCONNECT_TIMEOUT_FACTOR = 8, ServeDown;
+var DEFAULT_REQUEST_TIMEOUT_MS2 = 15000, UNVERIFIED_SERVE_REASON = "The program answering on keryx serve's port did not prove it is the keryx serve this shell trusts, so its answer was ignored and nothing was written. Restart `keryx serve` (an older serve cannot prove itself; update keryx on both sides).", DISCONNECT_TIMEOUT_FACTOR = 8, ServeDown;
 var init_channels_client = __esm(() => {
   init_serve_config();
   init_config_dir();
@@ -110688,7 +110747,7 @@ function channelsStatusLines(snapshot) {
       return [
         "Telegram: pairing in progress",
         ...machine,
-        "Resume shows the one-time code again; Cancel pairing abandons it and erases the token."
+        "Resume shows the one-time code again, or connects a pairing that already finished; Cancel pairing abandons it and erases the token."
       ];
     case "connected":
       return [
@@ -162700,7 +162759,8 @@ async function importProjectSkills(options) {
   }
   const existingFlags = await projectReviewerFlags(options.projectRoot);
   const plans = await Promise.all(sources.map((source) => planOne(options, source)));
-  const ruleDecisions = await decideReferencedRules(options, sources.filter((source) => !skippedAsDeprecated(source)).filter((source) => options.force === true || !BUNDLED_NAMES.has(source.name)));
+  const refusedPackages = new Set(plans.flatMap((plan) => ("row" in plan) && isRefusedStatus(plan.row.status) ? [plan.row.name] : []));
+  const ruleDecisions = await decideReferencedRules(options, sources.filter((source) => !skippedAsDeprecated(source)).filter((source) => options.force === true || !BUNDLED_NAMES.has(source.name)), refusedPackages);
   await refuseUncontainedWrites(label, options.projectRoot, [
     ...plans.flatMap((plan) => ("write" in plan) ? projectSkillWritePaths(plan.write.module, plan.write.name, "single") : []),
     ...ruleDecisions.flatMap((decision) => ("placement" in decision) ? [decision.placement.target] : [])
@@ -162712,7 +162772,7 @@ async function importProjectSkills(options) {
   addFlagWarnings(imported, sources, existingFlags);
   const rules = [];
   for (const decision of ruleDecisions) {
-    rules.push("row" in decision ? decision.row : options.dryRun ? unwrittenRow(decision.placement, decision.dryRunReason) : await writePlacedRule(options, decision.placement));
+    rules.push("row" in decision ? decision.row : options.dryRun ? unwrittenRow(decision.placement, [decision.dryRunReason, ...gateNotes(decision.gate, true)].filter(isString2).join(" \u2014 ") || undefined, decision.gate.security) : await writePlacedRule(options, decision.placement, decision.gate));
   }
   return {
     from: options.from,
@@ -162770,7 +162830,7 @@ function renderImportProjectSkillsMarkdown(result) {
     `from: ${result.from}`,
     `dry-run: ${result.dryRun ? "yes" : "no"}`,
     `force: ${result.force ? "yes" : "no"}`,
-    `imported: ${counts.imported} overwritten: ${counts.overwritten} updated: ${counts.updated} skipped: ${counts.skipped} would-import: ${counts["would-import"]} would-overwrite: ${counts["would-overwrite"]}`,
+    `imported: ${counts.imported} overwritten: ${counts.overwritten} updated: ${counts.updated} skipped: ${counts.skipped} would-import: ${counts["would-import"]} would-overwrite: ${counts["would-overwrite"]}${counts.refused > 0 ? ` refused: ${counts.refused}` : ""}${counts["would-refuse"] > 0 ? ` would-refuse: ${counts["would-refuse"]}` : ""}`,
     ""
   ];
   if (result.dryRun) {
@@ -162795,6 +162855,9 @@ function renderImportProjectSkillsMarkdown(result) {
   if (result.imported.some((row) => row.status === "skipped" && row.reason === DEPRECATED_REASON)) {
     lines.push("A package whose frontmatter says `deprecated: true` is skipped in a tree import. To import one anyway, pass its own directory as --from.", "");
   }
+  if (result.imported.some((row) => isRefusedStatus(row.status)) || result.rules.some((rule) => isRefusedStatus(rule.status))) {
+    lines.push(refusedNote(result), "");
+  }
   if (result.rules.length > 0) {
     lines.push("## rules the skills cite", "");
     for (const rule of result.rules) {
@@ -162806,10 +162869,10 @@ function renderImportProjectSkillsMarkdown(result) {
       lines.push("A reviewer that cites `<dir>/<name>.mdc` reads `.metaproject/rules/project/<dir>/<name>.mdc` when that file exists,", "and `.metaproject/rules/<dir>/<name>.mdc` otherwise. `keryx init`, `keryx update` and `keryx skills install` overwrite", "rules/core with keryx's own rules and leave rules/project alone. `keryx review reviewers` lists each such reference", "under `shadowedRules`.", "");
     }
   }
-  if (result.imported.some((row) => row.module === PROJECT_REVIEWER_MODULE && row.status !== "skipped")) {
+  if (result.imported.some((row) => row.module === PROJECT_REVIEWER_MODULE && isWrittenRow(row))) {
     lines.push(`Reviewers: \`keryx review reviewers\` must list every imported ${PROJECT_REVIEWER_MODULE}/* name. That is the same call review-orchestrator makes.`);
   }
-  if (result.imported.some((row) => row.module !== PROJECT_REVIEWER_MODULE && row.status !== "skipped")) {
+  if (result.imported.some((row) => row.module !== PROJECT_REVIEWER_MODULE && isWrittenRow(row))) {
     lines.push("Non-review modules are registered for `keryx skills route`. They are NOT injected into flow-orchestrator's fixed pipeline \u2014 name the skill in a dispatch if you want it there.");
   }
   return `${lines.join(`
@@ -162894,7 +162957,7 @@ function soleCarrierWarning(flag, overwritten, remaining) {
   return `flag ${flag} is dropped by this version of ${overwritten}, which leaves ${remaining} its only carrier: ${flag} now dispatches ${remaining} outright instead of selecting it path-gated.`;
 }
 function addFlagWarnings(rows, sources, existingFlags) {
-  const isWritten = (row) => row.module === PROJECT_REVIEWER_MODULE && row.status !== "skipped";
+  const isWritten = (row) => row.module === PROJECT_REVIEWER_MODULE && isWrittenRow(row);
   const replaced = new Set(rows.filter(isWritten).map((row) => row.name));
   const flagsAfter = new Map(existingFlags);
   for (const [index, row] of rows.entries()) {
@@ -163106,6 +163169,110 @@ async function skillPackageDirs(root) {
   }
   return { dirs, tree: true };
 }
+function isRefusedStatus(status) {
+  return status === "refused" || status === "would-refuse";
+}
+function refusedNote(result) {
+  const refused = [...result.imported, ...result.rules].filter((row) => isRefusedStatus(row.status));
+  const overridable = refused.some((row) => row.security?.findings.some((finding) => finding.policyId.startsWith("prompt-injection.")));
+  return overridable ? `${REFUSED_NOTE} ${ALLOW_FLAGGED_HINT}` : REFUSED_NOTE;
+}
+function exitNonZeroOnRefusal(result) {
+  if ([...result.imported, ...result.rules].some((row) => row.status === "refused")) {
+    process.exitCode = 1;
+  }
+}
+function isWrittenRow(row) {
+  return row.status !== "skipped" && !isRefusedStatus(row.status);
+}
+async function gateText(projectRoot, text, target, allowFlagged) {
+  const guard = await guardOutput({
+    cwd: projectRoot,
+    content: text,
+    target: "skill",
+    source: "untrusted-external",
+    path: target
+  });
+  let findings = guard.decision.findings.map(({ policyId, category, action }) => ({ policyId, category, action }));
+  let action = guard.decision.action;
+  let warning = formatGuardWarning(guard.decision);
+  if (guard.allowed && !await isSecurityEnabled(projectRoot)) {
+    const own = detectInjection(text);
+    if (own.length > 0) {
+      findings = own.map(({ policyId, category }) => ({ policyId, category, action: "warn" }));
+      action = "warn";
+      warning = `[security] the security module is disabled, so the import ran its own injection check: ${own.length} finding(s) (prompt-injection:${own.length})`;
+    }
+  }
+  const summary = findings;
+  const security = (redacted, refused) => ({
+    action,
+    findings: summary,
+    redacted,
+    refused
+  });
+  const injection = findings.some((finding) => finding.policyId.startsWith("prompt-injection."));
+  const blockedByMode = !guard.allowed && findings.length > 0;
+  if (blockedByMode || injection && !allowFlagged) {
+    return { kind: "refuse", reason: warning ?? guard.reason ?? "security gate blocked", security: security(false, true) };
+  }
+  const output = prepareOutputForPersistence(guard, text);
+  if (!output.allowed)
+    return { kind: "blocked", reason: output.reason };
+  const redacted = !output.bytesPreserved;
+  return {
+    kind: "write",
+    content: output.content,
+    warning,
+    overridden: injection,
+    redacted,
+    ...findings.length > 0 || redacted ? { security: security(redacted, false) } : {}
+  };
+}
+function gateRowParts(gate, dryRun) {
+  const detail = gate.warning !== null ? ` (${gate.warning})` : "";
+  const security = gate.security !== undefined ? { security: gate.security } : {};
+  if (gate.overridden) {
+    const redacted = gate.redacted ? ", redacted" : "";
+    return {
+      reason: `flagged by the security gate${detail}${redacted}, ${dryRun ? "would be written" : "written"} because --allow-flagged`,
+      ...security
+    };
+  }
+  if (gate.redacted) {
+    return { reason: `${dryRun ? "would be redacted" : "redacted"} by the security gate${detail}`, ...security };
+  }
+  if (gate.warning !== null) {
+    return { reason: `flagged by the security gate${detail}`, ...security };
+  }
+  return security;
+}
+function gateNotes(gate, dryRun) {
+  return [gateRowParts(gate, dryRun).reason].filter(isString2);
+}
+function plannedSkillText(content, header) {
+  const version = parseSkillFrontmatter(content).metadataVersion ?? "0.1.0";
+  return stampImportHeader(content, [
+    `Version: ${version}`,
+    `Target: ${header.name}`,
+    `Module: ${header.module}`,
+    `Origin: ${header.origin.trim()}`,
+    `Origin Hash: ${hashOriginContent(content)}`,
+    `Imported At: ${new Date().toISOString()}`,
+    "Status: active",
+    "Last Verified: never",
+    ""
+  ].join(`
+`));
+}
+function refusedSkillRow(base, verdict, dryRun) {
+  return {
+    ...base,
+    status: dryRun ? "would-refuse" : "refused",
+    reason: verdict.kind === "blocked" ? `blocked by the security gate: ${verdict.reason}` : verdict.reason,
+    ...verdict.kind === "refuse" ? { security: verdict.security } : {}
+  };
+}
 async function planOne(options, source) {
   const dest = projectSkillPackagePath(source.module, source.name);
   const destAbs = path320.join(options.projectRoot, dest, "SKILL.md");
@@ -163148,10 +163315,18 @@ async function planOne(options, source) {
       }
     };
   }
-  return { write: source, exists };
+  const verdict = await gateText(options.projectRoot, plannedSkillText(source.content, { name: source.name, module: source.module, origin: source.origin }), toPosix(path320.join(dest, "SKILL.md")), options.allowFlagged === true);
+  if (verdict.kind !== "write") {
+    return {
+      row: refusedSkillRow({ name: source.name, module: source.module, path: dest, origin: source.origin }, verdict, options.dryRun === true)
+    };
+  }
+  return { write: source, exists, gate: verdict };
 }
-async function writeOne(options, { write: source, exists }) {
+async function writeOne(options, { write: source, exists, gate }) {
+  const notes = importNotes(source);
   if (options.dryRun) {
+    const parts = gateRowParts(gate, true);
     return {
       name: source.name,
       module: source.module,
@@ -163159,7 +163334,7 @@ async function writeOne(options, { write: source, exists }) {
       path: projectSkillPackagePath(source.module, source.name),
       origin: source.origin,
       wired: wiringNote(source.module),
-      ...importNotes(source)
+      ...mergeNotes(notes, parts)
     };
   }
   const created = await createProjectSkill(options.projectRoot, {
@@ -163172,7 +163347,7 @@ async function writeOne(options, { write: source, exists }) {
     ...versionOption(source.content),
     format: "single"
   });
-  await overwriteImportedSkill(options.projectRoot, created, source.content);
+  await writeGatedSkill(options.projectRoot, created, gate);
   return {
     name: source.name,
     module: source.module,
@@ -163180,7 +163355,15 @@ async function writeOne(options, { write: source, exists }) {
     path: created.skillPath,
     origin: source.origin,
     wired: wiringNote(source.module),
-    ...importNotes(source)
+    ...mergeNotes(notes, gateRowParts(gate, false))
+  };
+}
+function mergeNotes(notes, parts) {
+  return {
+    ...notes.pathsSource !== undefined ? { pathsSource: notes.pathsSource } : {},
+    ...notes.warnings !== undefined ? { warnings: notes.warnings } : {},
+    ...parts.reason !== undefined ? { reason: parts.reason } : {},
+    ...parts.security !== undefined ? { security: parts.security } : {}
   };
 }
 async function planUpdate(options, entry) {
@@ -163209,9 +163392,15 @@ async function planUpdate(options, entry) {
     content = await readFile163(resolved, "utf8");
     origin = portableOriginRef(resolved, options.projectRoot);
   }
-  return { entry, origin, content };
+  const verdict = await gateText(options.projectRoot, plannedSkillText(content, { name: entry.name, module: entry.module, origin }), toPosix(path320.join(entry.path, "SKILL.md")), options.allowFlagged === true);
+  if (verdict.kind !== "write") {
+    return {
+      row: refusedSkillRow({ name: entry.name, module: entry.module, path: entry.path, origin }, verdict, options.dryRun === true)
+    };
+  }
+  return { entry, origin, content, gate: verdict };
 }
-async function writeUpdate(options, { entry, origin, content }) {
+async function writeUpdate(options, { entry, origin, content, gate }) {
   if (options.dryRun) {
     return {
       name: entry.name,
@@ -163219,7 +163408,8 @@ async function writeUpdate(options, { entry, origin, content }) {
       status: "would-overwrite",
       path: entry.path,
       origin,
-      wired: wiringNote(entry.module)
+      wired: wiringNote(entry.module),
+      ...mergeNotes({}, gateRowParts(gate, true))
     };
   }
   const created = await createProjectSkill(options.projectRoot, {
@@ -163232,40 +163422,19 @@ async function writeUpdate(options, { entry, origin, content }) {
     ...versionOption(content),
     format: "single"
   });
-  await overwriteImportedSkill(options.projectRoot, created, content);
+  await writeGatedSkill(options.projectRoot, created, gate);
   return {
     name: entry.name,
     module: entry.module,
     status: "updated",
     path: created.skillPath,
     origin,
-    wired: wiringNote(entry.module)
+    wired: wiringNote(entry.module),
+    ...mergeNotes({}, gateRowParts(gate, false))
   };
 }
-async function overwriteImportedSkill(projectRoot, created, source) {
-  const relative = toPosix(path320.join(created.skillPath, "SKILL.md"));
-  const scaffold = await readFile163(path320.join(projectRoot, relative), "utf8");
-  const header = extractImportHeader(scaffold, parseSkillFrontmatter(source).metadataVersion);
-  const stamped = stampImportHeader(source, header);
-  const guard = await guardOutput({
-    cwd: projectRoot,
-    content: stamped,
-    target: "skill",
-    source: "untrusted-external",
-    path: relative
-  });
-  const output = prepareOutputForPersistence(guard, stamped);
-  if (!output.allowed) {
-    throw new Error(`Project skill blocked by the security gate: ${output.reason}`);
-  }
-  await writeContained(projectRoot, relative, output.content);
-}
-function extractImportHeader(scaffold, version) {
-  const lines = scaffold.split(`
-`).filter((line) => IMPORT_HEADER_LINE.test(line)).map((line) => version && line.startsWith("Version:") ? `Version: ${version}` : line);
-  return lines.length > 0 ? `${lines.join(`
-`)}
-` : "";
+async function writeGatedSkill(projectRoot, created, gate) {
+  await writeContained(projectRoot, toPosix(path320.join(created.skillPath, "SKILL.md")), gate.content);
 }
 function stampImportHeader(source, header) {
   if (!header)
@@ -163340,8 +163509,9 @@ function collectRuleCitations(sources) {
   }
   return [...byRef.values()].map((citation) => ({ ...citation, citedBy: citation.citedBy.sort() })).sort((a, b) => a.ref.localeCompare(b.ref));
 }
-function unwrittenRow(placement, reason) {
+function unwrittenRow(placement, reason, security) {
   const { ref, citedBy, origin, target } = placement;
+  const gate = security !== undefined ? { security } : {};
   if (placement.existing !== undefined) {
     return {
       ref,
@@ -163351,17 +163521,43 @@ function unwrittenRow(placement, reason) {
       existing: placement.existing.path,
       target,
       written: false,
-      ...reason !== undefined ? { reason } : {}
+      ...reason !== undefined ? { reason } : {},
+      ...gate
     };
   }
-  return { ref, citedBy, status: placement.toProjectSlot ? "would-import-project" : "would-import", origin, target };
+  return {
+    ref,
+    citedBy,
+    status: placement.toProjectSlot ? "would-import-project" : "would-import",
+    origin,
+    target,
+    ...reason !== undefined ? { reason } : {},
+    ...gate
+  };
 }
-function writtenRow(placement) {
+function writtenRow(placement, gate) {
   const { ref, citedBy, origin, target } = placement;
+  const notes = gateNotes(gate, false).join(" \u2014 ");
+  const extra = {
+    ...notes !== "" ? { reason: notes } : {},
+    ...gate.security !== undefined ? { security: gate.security } : {}
+  };
   if (placement.existing !== undefined) {
-    return { ref, citedBy, status: "differs", origin, existing: placement.existing.path, target, written: true };
+    return { ref, citedBy, status: "differs", origin, existing: placement.existing.path, target, written: true, ...extra };
   }
-  return { ref, citedBy, status: placement.toProjectSlot ? "imported-project" : "imported", origin, target };
+  return { ref, citedBy, status: placement.toProjectSlot ? "imported-project" : "imported", origin, target, ...extra };
+}
+function refusedRuleRow(placement, verdict, dryRun) {
+  const { ref, citedBy, origin } = placement;
+  return {
+    ref,
+    citedBy,
+    status: dryRun ? "would-refuse" : "refused",
+    origin,
+    ...placement.existing !== undefined ? { existing: placement.existing.path } : {},
+    reason: verdict.reason,
+    security: verdict.security
+  };
 }
 async function decideRule(options, citation, bundledRules) {
   const base = { ref: citation.ref, citedBy: citation.citedBy };
@@ -163410,32 +163606,35 @@ async function decideRule(options, citation, bundledRules) {
   if (replacesProjectCopy && options.force !== true) {
     return { row: unwrittenRow(placement, "left as it is; pass --force to replace it with the overlay's") };
   }
-  return replacesProjectCopy ? { placement, dryRunReason: "would be replaced with the overlay's (--force)" } : { placement };
-}
-async function writePlacedRule(options, placement) {
-  const { ref, citedBy, origin, target } = placement;
-  const guard = await guardOutput({
-    cwd: options.projectRoot,
-    content: placement.content,
-    target: "skill",
-    source: "untrusted-external",
-    path: target
-  });
-  const output = prepareOutputForPersistence(guard, placement.content);
-  if (!output.allowed) {
-    const reason = `blocked by the security gate: ${output.reason}`;
-    return placement.existing !== undefined ? unwrittenRow(placement, reason) : { ref, citedBy, status: "unresolved", origin, reason };
+  const verdict = await gateText(options.projectRoot, content, target, options.allowFlagged === true);
+  if (verdict.kind === "refuse") {
+    return { row: refusedRuleRow(placement, verdict, options.dryRun === true) };
   }
-  if (placement.existing?.content === output.content) {
-    return { ref, citedBy, status: "present", origin, existing: placement.existing.path };
+  if (verdict.kind === "blocked") {
+    const reason = `blocked by the security gate: ${verdict.reason}`;
+    return {
+      row: placement.existing !== undefined ? unwrittenRow(placement, reason) : { ...base, status: "unresolved", origin, reason }
+    };
+  }
+  if (placement.existing?.content === verdict.content) {
+    return { row: { ...base, status: "present", origin, existing: placement.existing.path } };
   }
-  await writeContained(options.projectRoot, target, output.content);
-  return writtenRow(placement);
+  return replacesProjectCopy ? { placement, gate: verdict, dryRunReason: "would be replaced with the overlay's (--force)" } : { placement, gate: verdict };
 }
-async function decideReferencedRules(options, sources) {
+async function writePlacedRule(options, placement, gate) {
+  await writeContained(options.projectRoot, placement.target, gate.content);
+  return writtenRow(placement, gate);
+}
+async function decideReferencedRules(options, sources, refusedPackages) {
   const bundledRules = bundledRulesSourcePath();
   const decisions = [];
   for (const citation of collectRuleCitations(sources)) {
+    if (citation.citedBy.every((name) => refusedPackages.has(name))) {
+      decisions.push({
+        row: { ref: citation.ref, citedBy: citation.citedBy, status: "skipped", reason: "cited only by a refused package" }
+      });
+      continue;
+    }
     decisions.push(await decideRule(options, citation, bundledRules));
   }
   return decisions;
@@ -163495,7 +163694,9 @@ function countByStatus(rows) {
     skipped: 0,
     "would-import": 0,
     "would-overwrite": 0,
-    updated: 0
+    updated: 0,
+    refused: 0,
+    "would-refuse": 0
   };
   for (const row of rows) {
     counts[row.status] += 1;
@@ -163521,13 +163722,15 @@ async function runSkillsImportCommand(args) {
     ...skillName !== undefined ? { name: skillName } : {},
     only: onlyOption(args, "keryx skills import"),
     dryRun: args.includes("--dry-run"),
-    force: args.includes("--force")
+    force: args.includes("--force"),
+    allowFlagged: args.includes(ALLOW_FLAGGED_FLAG)
   });
   if (args.includes("--json")) {
     console.log(JSON.stringify(result, null, 2));
-    return;
+  } else {
+    console.log(renderImportProjectSkillsMarkdown(result));
   }
-  console.log(renderImportProjectSkillsMarkdown(result));
+  exitNonZeroOnRefusal(result);
 }
 async function runSkillsUpdateCommand(args) {
   if (args.includes("--help") || args.includes("-h")) {
@@ -163541,13 +163744,15 @@ async function runSkillsUpdateCommand(args) {
     ...positional[0] !== undefined ? { skill: positional[0] } : {},
     all: args.includes("--all"),
     ...from !== undefined ? { from } : {},
-    dryRun: args.includes("--dry-run")
+    dryRun: args.includes("--dry-run"),
+    allowFlagged: args.includes(ALLOW_FLAGGED_FLAG)
   });
   if (args.includes("--json")) {
     console.log(JSON.stringify(result, null, 2));
-    return;
+  } else {
+    console.log(renderImportProjectSkillsMarkdown(result));
   }
-  console.log(renderImportProjectSkillsMarkdown(result));
+  exitNonZeroOnRefusal(result);
 }
 function printSkillsImportHelp() {
   console.log(`keryx skills import
@@ -163558,7 +163763,7 @@ detectable.
 
 Usage:
   keryx skills import --from <dir|SKILL.md|https-url> [--module <module>] [--name <name>]
-                      [--only <glob>]... [--dry-run] [--force] [--json]
+                      [--only <glob>]... [--dry-run] [--force] [--allow-flagged] [--json]
 
 --from:
   a skill package directory, a SKILL.md file, a parent tree that contains
@@ -163592,6 +163797,8 @@ skipped. Pass its own directory as --from to import it anyway.
 
 A name that collides with a bundled keryx skill is skipped unless --force.
 
+${SECURITY_GATE_HELP}
+
 A package landing in module \`review\` is imported with a warning for each of:
   - neither \`metadata.paths\` nor a glob in its description (a file path named
     without a glob is not a trigger): it is dispatched on every round.
@@ -163639,8 +163846,10 @@ function printSkillsUpdateHelp() {
 Re-read a project-skill's Origin and overwrite SKILL.md when the source moved on.
 
 Usage:
-  keryx skills update <module>/<name> [--from <new-origin>] [--dry-run] [--json]
-  keryx skills update --all [--dry-run] [--json]
+  keryx skills update <module>/<name> [--from <new-origin>] [--dry-run] [--allow-flagged] [--json]
+  keryx skills update --all [--dry-run] [--allow-flagged] [--json]
+
+${SECURITY_GATE_HELP}
 
 Before anything is written, every destination is checked for a symlink on the
 way that resolves outside the project, as \`keryx skills import\` does. One is
@@ -163654,7 +163863,19 @@ Examples:
 var BUNDLED_NAMES, PATHS_NONE_WARNING = 'paths: none \u2014 dispatched on every round. Declare `metadata.paths: "<glob>, <glob>"` in its frontmatter to gate it on the diff.', DEFAULT_FETCHER = async (url) => {
   const response = await fetch(url);
   return { ok: response.ok, status: response.status, text: await response.text() };
-}, DEPRECATED_REASON = "deprecated", KNOWN_CATEGORIES, IMPORT_HEADER_LABELS, IMPORT_HEADER_LINE, BYTE_ORDER_MARK = 65279;
+}, DEPRECATED_REASON = "deprecated", KNOWN_CATEGORIES, isString2 = (value) => value !== undefined, REFUSED_NOTE = "A refused file was not written.", ALLOW_FLAGGED_HINT = "A prompt-injection refusal can be overridden after you read the file: run the command again with --allow-flagged.", IMPORT_HEADER_LABELS, IMPORT_HEADER_LINE, BYTE_ORDER_MARK = 65279, ALLOW_FLAGGED_FLAG = "--allow-flagged", SECURITY_GATE_HELP = `Security gate: a SKILL.md or rule is written as the gate returns it, so a secret is
+masked and the row says it was redacted, and any other finding is reported on the
+row. Text with a prompt-injection finding is refused in every security mode: the
+row is \`refused\` (\`would-refuse\` on a dry run) with the gate's own summary,
+nothing is written, and the other packages and rules go on. After reading the
+file, --allow-flagged writes it anyway and the row says it was flagged and written
+because of the flag. It does not override a block by the project's security mode:
+under mode enforced a secret is refused either way. With the security module
+disabled the import runs the injection check itself, so injection text is refused
+there too (the row says the module is disabled); a secret is still masked. A rule
+cited only by refused packages is not written (\`skipped \u2014 cited only by a refused
+package\`). A real run that refused anything exits 1 after printing every row; a
+dry run (\`would-refuse\`) exits 0. --json rows carry a \`security\` object.`;
 var init_import_skills = __esm(() => {
   init_args();
   init_contained_write();
@@ -163666,6 +163887,7 @@ var init_import_skills = __esm(() => {
   init_project_skills();
   init_project_reviewers();
   init_reviewer_triggers();
+  init_injection();
   init_guard2();
   BUNDLED_NAMES = new Set(BUNDLED_GDSKILLS.map((entry) => entry.name));
   KNOWN_CATEGORIES = new Set(["review", "quality", "orchestration", "planning", "platform", "core"]);
@@ -167565,7 +167787,8 @@ async function importOverlayReviewers(options) {
     commandLabel: REVIEW_IMPORT_LABEL,
     ...options.only !== undefined ? { only: options.only } : {},
     ...options.dryRun !== undefined ? { dryRun: options.dryRun } : {},
-    ...options.force !== undefined ? { force: options.force } : {}
+    ...options.force !== undefined ? { force: options.force } : {},
+    ...options.allowFlagged !== undefined ? { allowFlagged: options.allowFlagged } : {}
   });
 }
 async function runImportReviewers(args) {
@@ -167583,13 +167806,15 @@ async function runImportReviewers(args) {
     from,
     only: onlyOption(args, REVIEW_IMPORT_LABEL),
     dryRun: args.includes("--dry-run"),
-    force: args.includes("--force")
+    force: args.includes("--force"),
+    allowFlagged: args.includes(ALLOW_FLAGGED_FLAG)
   });
   if (args.includes("--json")) {
     console.log(JSON.stringify({ ...result, inventory: await collectReviewers(process.cwd()) }, null, 2));
-    return;
+  } else {
+    console.log(renderImportProjectSkillsMarkdown(result));
   }
-  console.log(renderImportProjectSkillsMarkdown(result));
+  exitNonZeroOnRefusal(result);
 }
 function printImportHelp() {
   console.log(`keryx review import
@@ -167601,7 +167826,7 @@ The review-shaped spelling of:
 Same importer, same rules; the module is implied.
 
 Usage:
-  keryx review import --from <package-dir|tree> [--only <glob>]... [--dry-run] [--force] [--json]
+  keryx review import --from <package-dir|tree> [--only <glob>]... [--dry-run] [--force] [--allow-flagged] [--json]
 
 --from:
   one reviewer package directory, or a tree that holds several (a directory of
@@ -167623,6 +167848,8 @@ In a tree import a package whose frontmatter says \`deprecated: true\` is
 skipped; pass its own directory as --from to import it anyway. A name that
 collides with a bundled keryx skill is skipped unless --force.
 
+${SECURITY_GATE_HELP}
+
 A reviewer is imported with a warning for each of:
   - neither \`metadata.paths\` nor a glob in its description (a file path named
     without a glob is not a trigger): it is dispatched on every round.
@@ -172033,7 +172260,7 @@ var init_review = __esm(() => {
   COMPLETE_FLAGS = ["--finding", "--disposition", "--evidence"];
   STACK_FLAGS = ["--json"];
   REVIEWERS_FLAGS = ["--json"];
-  IMPORT_FLAGS = ["--from", "--only", "--dry-run", "--force", "--json", "--help"];
+  IMPORT_FLAGS = ["--from", "--only", "--dry-run", "--force", "--allow-flagged", "--json", "--help"];
   SESSION_SOURCE_LABELS = {
     flags: "flags (--session-provider/--session-model)",
     env: "environment (KERYX_SESSION_PROVIDER/KERYX_SESSION_MODEL)",
@@ -187025,6 +187252,28 @@ class RemoteHttpSurface {
     return this.options.verifyShellToken(presented);
   }
   async handle(route, request, io) {
+    const response = await this.dispatch(route, request, io);
+    const authorization = request.headers.get("authorization") ?? "";
+    const nonce = /^Bearer /i.test(authorization) ? derivedBearerNonce(authorization.slice(7).trim()) : undefined;
+    if (nonce === undefined || this.options.proveResponse === undefined) {
+      return response;
+    }
+    if (route === "stream") {
+      const proof = this.options.proveResponse(nonce, route, response.status, "");
+      if (proof !== undefined) {
+        response.headers.set(SERVE_PROOF_HEADER, proof);
+      }
+      return response;
+    }
+    const body = await response.text();
+    const proof = this.options.proveResponse(nonce, route, response.status, body);
+    const headers = new Headers(response.headers);
+    if (proof !== undefined) {
+      headers.set(SERVE_PROOF_HEADER, proof);
+    }
+    return new Response(body, { status: response.status, headers });
+  }
+  async dispatch(route, request, io) {
     if (isChannelsRoute(route)) {
       if (this.closed || this.channels === undefined) {
         return fail4(503, "remote-unavailable", "channels are not available in this serve");
@@ -187471,6 +187720,7 @@ var init_http_surface = __esm(() => {
   init_service2();
   init_hub();
   init_protocol2();
+  init_shell_token();
   CONTROL_CHARS2 = /[\u0000-\u001f\u007f]/;
   JSON_HEADERS2 = { "content-type": "application/json; charset=utf-8" };
 });
@@ -187499,6 +187749,7 @@ class Pairing {
   expiresAt;
   ttlMs;
   earlyGroups = new Map;
+  earlyMigrations = [];
   userId;
   chatId;
   chatTitle;
@@ -187510,6 +187761,7 @@ class Pairing {
   timers;
   expiryTimer;
   finished = false;
+  begun = false;
   queue = Promise.resolve();
   constructor(options, bot) {
     this.options = options;
@@ -187529,6 +187781,13 @@ class Pairing {
     });
   }
   static async open(options) {
+    const prepared = await Pairing.prepare(options);
+    if (prepared.ok) {
+      prepared.pairing.begin();
+    }
+    return prepared;
+  }
+  static async prepare(options) {
     let bot;
     try {
       bot = await options.api.getMe();
@@ -187538,11 +187797,14 @@ class Pairing {
       }
       return { ok: false, kind: "unreachable", reason: `could not reach Telegram: ${describe3(error)}` };
     }
-    const pairing = new Pairing(options, bot);
-    pairing.begin();
-    return { ok: true, pairing };
+    return { ok: true, pairing: new Pairing(options, bot) };
   }
   begin() {
+    if (this.begun || FINAL.has(this.state)) {
+      return;
+    }
+    this.begun = true;
+    this.expiresAt = this.now() + this.ttlMs;
     this.armExpiryTimer();
     this.poller.start();
   }
@@ -187572,10 +187834,17 @@ class Pairing {
     this.expireIfDue();
     return FINAL.has(this.state);
   }
+  isReady() {
+    this.expireIfDue();
+    return this.state === "ready";
+  }
   async recheck() {
     if (this.state === "waiting-for-group" && this.candidate !== undefined) {
-      const chatId = this.candidate;
-      await this.enqueue(() => this.inspectGroup(chatId));
+      await this.enqueue(async () => {
+        if (this.state === "waiting-for-group" && this.candidate !== undefined) {
+          await this.inspectGroup(this.candidate);
+        }
+      });
     }
   }
   async cancel() {
@@ -187639,6 +187908,7 @@ class Pairing {
           await this.takeCode(update);
         } else if (this.state === "waiting-for-group") {
           await this.takeGroup(update);
+          await this.takeMigration(update);
         }
       }
     });
@@ -187664,15 +187934,31 @@ class Pairing {
       return;
     });
     const early = [...this.earlyGroups.values()];
+    const earlyMoves = this.earlyMigrations;
     this.earlyGroups.clear();
+    this.earlyMigrations = [];
     for (const event of early) {
       if (this.state !== "waiting-for-group") {
         break;
       }
       await this.takeGroup(event);
     }
+    for (const event of earlyMoves) {
+      if (this.state !== "waiting-for-group") {
+        break;
+      }
+      await this.takeMigration(event);
+    }
   }
   rememberGroupEvent(update) {
+    const message = update.message;
+    if (message !== undefined && (typeof message.migrate_to_chat_id === "number" || typeof message.migrate_from_chat_id === "number")) {
+      this.earlyMigrations.push(update);
+      if (this.earlyMigrations.length > EARLY_GROUP_EVENTS) {
+        this.earlyMigrations.shift();
+      }
+      return;
+    }
     const change = update.my_chat_member;
     if (change === undefined) {
       return;
@@ -187705,6 +187991,23 @@ class Pairing {
     }
     await this.inspectGroup(change.chat.id);
   }
+  async takeMigration(update) {
+    const message = update.message;
+    if (message === undefined || this.candidate === undefined || FINAL.has(this.state)) {
+      return;
+    }
+    let next;
+    if (typeof message.migrate_to_chat_id === "number" && message.chat.id === this.candidate) {
+      next = message.migrate_to_chat_id;
+    } else if (typeof message.migrate_from_chat_id === "number" && message.migrate_from_chat_id === this.candidate) {
+      next = message.chat.id;
+    }
+    if (next === undefined || next === this.candidate) {
+      return;
+    }
+    this.candidate = next;
+    await this.inspectGroup(next);
+  }
   async inspectGroup(chatId) {
     if (FINAL.has(this.state)) {
       return;
@@ -187800,7 +188103,7 @@ class ChannelsController {
     if (this.host.hub() !== undefined) {
       return { state: "connected" };
     }
-    if (this.pairing !== undefined && !this.pairing.isFinal()) {
+    if (this.pairing !== undefined && (!this.pairing.isFinal() || this.pairing.isReady())) {
       return { state: "pairing" };
     }
     if (this.configured()) {
@@ -187831,12 +188134,11 @@ class ChannelsController {
       if (this.host.hub() !== undefined) {
         return fail4(409, "already-connected", "Telegram is already connected on this machine; disconnect it first.");
       }
-      await this.dropPairing();
       const api = this.host.openApi();
       if (!api.ok) {
         return fail4(422, "no-token", api.reason);
       }
-      const opened = await Pairing.open({
+      const opened = await Pairing.prepare({
         api: api.api,
         ...this.options.now === undefined ? {} : { now: this.options.now },
         ...this.options.pairing
@@ -187845,9 +188147,13 @@ class ChannelsController {
         return fail4(opened.kind === "rejected" ? 422 : 502, opened.kind === "rejected" ? "token-rejected" : "telegram-unreachable", opened.reason);
       }
       if (mine !== this.generation) {
-        await opened.pairing.cancel();
         return superseded();
       }
+      await this.dropPairing();
+      if (mine !== this.generation) {
+        return superseded();
+      }
+      opened.pairing.begin();
       this.pairing = opened.pairing;
       return ok2({ ...opened.pairing.snapshot() });
     });
@@ -187872,13 +188178,13 @@ class ChannelsController {
   reload() {
     this.generation += 1;
     return this.exclusive(async () => {
-      await this.dropPairing();
       const config = loadRemoteConfig(this.host.dir);
       const token = loadBotToken(this.host.dir);
       if (!config.ok || !token.ok) {
         const reason = !config.ok ? config.reason : !token.ok ? token.reason : "";
         return fail4(422, "cannot-connect", this.host.hub() === undefined ? reason : `${reason} The running channel was left as it was.`);
       }
+      await this.dropPairing();
       if (this.host.hub() !== undefined) {
         await this.host.stopHub("reloading remote control");
       }
@@ -188052,8 +188358,10 @@ function openRemoteService(options = {}) {
   });
   const machine = options.machine ?? localMachineName();
   let verifyShellToken;
+  let shellToken;
   const surface = new RemoteHttpSurface({
     verifyShellToken: (presented) => verifyShellToken?.(presented) ?? false,
+    proveResponse: (nonce, route, status, body) => shellToken === undefined ? undefined : serveResponseProof(shellToken, nonce, route, status, body),
     ...options.now === undefined ? {} : { now: options.now },
     ...options.timers === undefined ? {} : { timers: options.timers },
     ...options.surface
@@ -188219,11 +188527,15 @@ function openRemoteService(options = {}) {
           return refuse(lock.reason);
         }
       }
+      try {
+        unlinkSync11(endpointPath(options.dir));
+      } catch {}
       const token = mintShellToken(options.dir);
       if (!token.ok) {
         return refuse(token.reason);
       }
       verifyShellToken = createShellTokenVerifier(token.value);
+      shellToken = token.value;
       try {
         ensureRemoteDir(options.dir);
         const body = { address: endpoint.address, port: endpoint.port, pid: process.pid };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.51",
+  "version": "0.3.52",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {

package/src/gdskills/bundled/skills/core/reviewer-skill-creator/SKILL.detail.md

@@ -171,9 +171,10 @@ Read three things off it before running for real:
   the reviewer will cite a rule the project will not have. `differs` means a
   file already answers that reference with other content.
 
-A dry-run does not run the security gate that a real run applies to every file
-it writes, so a `would-…` status can be optimistic: the real run may still block
-a package, or report a rule as `unresolved` with `blocked by the security gate`.
+A dry-run runs the same security gate a real run does, on the text that would
+be written, so a `would-…` status already says what the gate would do. A file
+the gate would refuse is `would-refuse`, and a file it would change or flag
+carries the reason on its row (section 3, "The security gate on import").
 
 ### 3. The real run, and what it writes
 
@@ -305,6 +306,107 @@ to overwrite`, and the rule rows are re-resolved — `present` for both files
 written above, the second with `the reviewer reads
 .metaproject/rules/project/core/error-handling.mdc`.
 
+**The security gate on import.** `keryx skills import`, `keryx review import`
+and `keryx skills update` pass every `SKILL.md` and rule through the security
+gate on the final text, while planning, so a dry run reports it too. The gate
+does not write silently:
+
+- A secret is masked in what is written, and the row says so: `redacted by the
+  security gate (…)`. On a dry run, `would be redacted by the security gate (…)`.
+- Any other finding follows the project's security mode and is reported on the
+  row as `flagged by the security gate (…)`.
+- A **prompt-injection** finding refuses the file in every security mode. The row
+  status is `refused` (`would-refuse` on a dry run), the reason is the gate's own
+  leak-safe summary (policy ids and counts, never the matched text), nothing is
+  written and no scaffold is left. The other packages and rules go on.
+- **With the security module disabled** the guard reports nothing, so the import
+  runs the deterministic prompt-injection detector itself and refuses on a match
+  exactly as above; the row reason says `the security module is disabled, so the
+  import ran its own injection check`. A secret is still masked by the floor
+  redaction; clean text imports as usual.
+- A rule cited **only** by refused (`would-refuse`) packages is not written. Its
+  row reads `skipped — cited only by a refused package`, on a dry run and a real
+  run alike; a rule an imported package also cites is handled as before.
+- **Exit code.** A real run that produced any `refused` row prints every row (text
+  or `--json`) and then exits 1. A dry run, whose rows say `would-refuse`, exits 0.
+- The file is gated once, before anything is written, and the text written is the
+  text gated: a refusal leaves no scaffold, registry entry or catalog row, and
+  never overwrites an installed `SKILL.md` on `--force` or update.
+- `--allow-flagged` writes a prompt-injection-flagged file anyway, after you have
+  read it. The row then reads `flagged by the security gate (…), written because
+  --allow-flagged` (`would be written because --allow-flagged` on a dry run). It
+  never overrides a block by the project's security mode: under mode `enforced`
+  a secret is refused with or without the flag.
+
+The flag belongs to all three commands: `keryx skills import … [--allow-flagged]`,
+`keryx review import … [--allow-flagged]`, `keryx skills update … [--allow-flagged]`.
+The summary line gains `refused: N` (`would-refuse: N` on a dry run) only when
+N is above zero, and the note under it names `--allow-flagged` only when a refused
+row carries a prompt-injection finding (the flag cannot change any other
+refusal). This is the output for an overlay with two reviewers, one whose
+body tries to override the agent's instructions and asks it to disclose its
+own context, and one that holds the AWS documentation placeholder access key:
+
+```
+$ keryx review import --from ./ov --only 'review-acme-*' --dry-run
+# skills import
+
+from: ./ov
+dry-run: yes
+force: no
+imported: 0 overwritten: 0 updated: 0 skipped: 0 would-import: 1 would-overwrite: 0 would-refuse: 1
+…
+## packages
+
+- review/review-acme-inj: would-refuse — [security] pass: 2 finding(s) (prompt-injection:2)
+- review/review-acme-key: would-import — would be redacted by the security gate ([security] fail: 1 finding(s) (secret:1)) — review-orchestrator will dispatch this after `keryx review reviewers` lists it
+
+A refused file was not written. A prompt-injection refusal can be overridden after you read the file: run the command again with --allow-flagged.
+…
+
+$ keryx review import --from ./ov --only 'review-acme-*'
+…
+imported: 1 overwritten: 0 updated: 0 skipped: 0 would-import: 0 would-overwrite: 0 refused: 1
+
+- review/review-acme-inj: refused — [security] pass: 2 finding(s) (prompt-injection:2)
+- review/review-acme-key: imported — redacted by the security gate ([security] fail: 1 finding(s) (secret:1)) — review-orchestrator will dispatch this after `keryx review reviewers` lists it
+…
+
+$ keryx review import --from ./ov --only 'review-acme-inj' --dry-run --allow-flagged
+…
+- review/review-acme-inj: would-import — flagged by the security gate ([security] pass: 2 finding(s) (prompt-injection:2)), would be written because --allow-flagged — review-orchestrator will dispatch this after `keryx review reviewers` lists it
+…
+```
+
+Row statuses, with the gate in them: `imported`, `overwritten`, `updated`,
+`skipped`, `would-import`, `would-overwrite`, `refused`, `would-refuse`.
+
+In `--json` a row carries a `security` object when the gate had something to say
+about it, and none otherwise. The refused row above, trimmed:
+
+```json
+{
+  "name": "review-acme-inj",
+  "module": "review",
+  "status": "would-refuse",
+  "reason": "[security] pass: 2 finding(s) (prompt-injection:2)",
+  "security": {
+    "action": "warn",
+    "findings": [
+      { "policyId": "prompt-injection.ignore-instructions", "category": "prompt-injection", "action": "warn" },
+      …
+    ],
+    "redacted": false,
+    "refused": true
+  }
+}
+```
+
+`security.redacted` is true when the gate changed the bytes that are, or would
+be, written; `security.refused` is true when the file was not (or would not be)
+written. A caller that used to read `status` alone must now treat `refused` and
+`would-refuse` as failures to import that exit 0.
+
 ### 4. Reading `keryx review reviewers`
 
 ```