maqcli 0.5.0 → 0.6.1

package/dist/core/command-catalog.js

@@ -41,6 +41,8 @@ export const maqCommands = [
     { name: "memory", category: "memory", summary: "Recall memory store (injected into planning).", usage: "maq memory [store|recall|list]", needsInput: "query", args: [] },
     { name: "flow", category: "control", summary: "Scheduled agent sessions (run under the daemon).", usage: "maq flow [list|add|remove]", needsInput: "none", args: [] },
     { name: "audit", category: "control", summary: "Verify a run's hash-chained audit log.", usage: "maq audit verify <run-dir>", needsInput: "none", args: [] },
+    { name: "security", category: "system", summary: "Enforced security rules (protected paths, egress allowlist, injection scanning) + recent findings.", usage: "maq security [report|rules|scan <path>]", needsInput: "none", args: [] },
+    { name: "update", category: "system", summary: "Check npm for a newer maqcli and self-update.", usage: "maq update [--check]", needsInput: "none", args: [{ name: "check", type: "boolean", description: "only check, don't install" }] },
 ];
 /** Catalog of AI worker CLIs' own commands/flags (verified 2026-07-01). */
 export const aiCliCatalog = [

package/dist/core/config-store.d.ts

@@ -31,6 +31,10 @@ export interface MaqConfig {
     headroomModel: string;
     /** True once the guided launcher has completed first-run setup. */
     onboarded: boolean;
+    /** Project-specific additions to the protected-path denylist (base list is never removable). */
+    extraProtectedPaths: string[];
+    /** Additional hosts allowed for network egress (default allowlist is always applied on top). */
+    extraNetAllowlist: string[];
 }
 export declare const DEFAULT_CONFIG: MaqConfig;
 export declare function configDir(): string;
@@ -39,3 +43,7 @@ export declare function loadConfig(): MaqConfig;
 export declare function saveConfig(cfg: MaqConfig): void;
 /** Set a single top-level scalar key by string, coercing to the existing type. */
 export declare function setConfigKey(key: string, value: string): MaqConfig;
+/** Append a value to an array-valued config key (e.g. security allowlists). */
+export declare function addConfigListItem(key: string, value: string): MaqConfig;
+/** Remove a value from an array-valued config key. */
+export declare function removeConfigListItem(key: string, value: string): MaqConfig;

package/dist/core/config-store.js

@@ -19,6 +19,8 @@ export const DEFAULT_CONFIG = {
     executionMode: "loop",
     headroomModel: "",
     onboarded: false,
+    extraProtectedPaths: [],
+    extraNetAllowlist: [],
 };
 export function configDir() {
     return process.env.MAQ_CONFIG_DIR ?? join(homedir(), ".maqcli");
@@ -57,9 +59,34 @@ export function setConfigKey(key, value) {
     if (typeof current === "boolean")
         coerced = value === "true";
     if (typeof current === "object") {
-        throw new Error(`Cannot set object key '${key}' from the CLI`);
+        throw new Error(`Cannot set object key '${key}' from the CLI; use addConfigListItem/removeConfigListItem`);
     }
     cfg[key] = coerced;
     saveConfig(cfg);
     return cfg;
 }
+/** Array-valued config keys that may be extended/trimmed from the CLI. */
+const LIST_KEYS = new Set(["extraProtectedPaths", "extraNetAllowlist"]);
+/** Append a value to an array-valued config key (e.g. security allowlists). */
+export function addConfigListItem(key, value) {
+    if (!LIST_KEYS.has(key))
+        throw new Error(`'${key}' is not a list config key`);
+    const cfg = loadConfig();
+    const list = cfg[key];
+    if (!list.includes(value))
+        list.push(value);
+    saveConfig(cfg);
+    return cfg;
+}
+/** Remove a value from an array-valued config key. */
+export function removeConfigListItem(key, value) {
+    if (!LIST_KEYS.has(key))
+        throw new Error(`'${key}' is not a list config key`);
+    const cfg = loadConfig();
+    const list = cfg[key];
+    const idx = list.indexOf(value);
+    if (idx >= 0)
+        list.splice(idx, 1);
+    saveConfig(cfg);
+    return cfg;
+}

package/dist/core/exec.d.ts

@@ -14,6 +14,15 @@ export interface ExecOptions {
     maxBuffer?: number;
     /** Abort signal; kills the child when aborted. */
     signal?: AbortSignal;
+    /**
+     * Secret hygiene for the spawned process (NVIDIA: "secret injection, not
+     * inheritance"). Defaults to scrubbing secret-shaped env vars from the
+     * inherited environment. Set to false to opt out (e.g. a trusted local
+     * tool that legitimately needs a key); pass `secretAllowlist` to re-admit
+     * specific names the task actually needs.
+     */
+    scrubSecrets?: boolean;
+    secretAllowlist?: string[];
 }
 export interface ExecOutcome {
     code: number | null;

package/dist/core/exec.js

@@ -6,6 +6,7 @@
  * chokepoint for running worker CLIs and raw commands.
  */
 import { spawn } from "node:child_process";
+import { scrubEnv } from "./security.js";
 /**
  * Run a command safely. `cmd` is the binary, `args` are passed verbatim.
  * Never pass a full command string here — that is what enables injection.
@@ -13,9 +14,11 @@ import { spawn } from "node:child_process";
 export function execSafe(cmd, args = [], opts = {}) {
     const maxBuffer = opts.maxBuffer ?? 10 * 1024 * 1024;
     return new Promise((resolve) => {
+        const baseEnv = opts.env ?? process.env;
+        const env = opts.scrubSecrets === false ? baseEnv : scrubEnv(baseEnv, opts.secretAllowlist);
         const child = spawn(cmd, args, {
             cwd: opts.cwd ?? process.cwd(),
-            env: opts.env ?? process.env,
+            env,
             shell: false,
             windowsHide: true,
         });
@@ -78,9 +81,11 @@ export function execSafe(cmd, args = [], opts = {}) {
 export function execStream(cmd, args = [], opts = {}) {
     const maxBuffer = opts.maxBuffer ?? 20 * 1024 * 1024;
     return new Promise((resolve) => {
+        const baseEnv = opts.env ?? process.env;
+        const env = opts.scrubSecrets === false ? baseEnv : scrubEnv(baseEnv, opts.secretAllowlist);
         const child = spawn(cmd, args, {
             cwd: opts.cwd ?? process.cwd(),
-            env: opts.env ?? process.env,
+            env,
             shell: false,
             windowsHide: true,
         });

package/dist/core/launcher.js

@@ -353,7 +353,7 @@ async function connectMobile(rl) {
 async function launchUi(authKey) {
     // Reuse the daemon; open its landing page. Import lazily to avoid a cycle.
     const { createDaemon } = await import("../server/daemon.js");
-    const daemon = createDaemon({ token: authKey, version: "0.5.0" });
+    const daemon = createDaemon({ token: authKey, version: "0.6.1" });
     try {
         const { host, port } = await daemon.listen();
         const url = `http://${host}:${port}/`;

package/dist/core/sandbox.d.ts

@@ -15,6 +15,8 @@ export interface SandboxPolicy {
     allowedPaths: string[];
     denyCommands: string[];
     readOnlyCommands: string[];
+    /** Project-specific additions to the protected-path denylist (config-driven; the base list is always applied and cannot be removed). */
+    extraProtectedPaths?: string[];
 }
 export interface SandboxCheck {
     allowed: boolean;
@@ -29,7 +31,7 @@ export declare const EXIT_SANDBOX = 4;
  * @param cwd  - Working directory that becomes the default allowed-path root.
  * @param tier - Permission tier (defaults to **2** — scoped-write).
  */
-export declare function createPolicy(cwd: string, tier?: PermissionTier): SandboxPolicy;
+export declare function createPolicy(cwd: string, tier?: PermissionTier, extraProtectedPaths?: string[]): SandboxPolicy;
 /**
  * Determine whether a **read** of `filePath` is permitted under `policy`.
  *
@@ -63,6 +65,17 @@ export declare function checkCommand(command: string | string[], policy: Sandbox
  * `shutdown`, and `reboot`.
  */
 export declare function isDestructive(command: string | string[]): boolean;
+/**
+ * Scan ingested content (README, commit messages, AGENTS.md, tool/HTTP
+ * output, recalled memory) for prompt-injection indicators before it reaches
+ * a model. Never blocks silently — it records a security event and returns
+ * the finding so the caller decides whether to warn, exclude, or gate on
+ * approval. Maps to OWASP ASI04 (Agentic Supply Chain) / ASI06 (Memory and
+ * Context Poisoning).
+ */
+export declare function checkContent(text: string, source: string): SandboxCheck & {
+    severity: "none" | "low" | "high";
+};
 /**
  * Map a pipeline phase name to its appropriate {@link PermissionTier}.
  *

package/dist/core/sandbox.js

@@ -11,6 +11,7 @@
  */
 import { resolve, normalize } from "node:path";
 import { platform } from "node:os";
+import { checkProtectedPath, scanForInjection, securityLog, makeSecurityEvent } from "./security.js";
 // ─── Constants ───────────────────────────────────────────────────────────────
 /** Sentinel exit code returned when a sandbox violation terminates a phase. */
 export const EXIT_SANDBOX = 4;
@@ -99,12 +100,13 @@ function isSystemPath(filePath) {
  * @param cwd  - Working directory that becomes the default allowed-path root.
  * @param tier - Permission tier (defaults to **2** — scoped-write).
  */
-export function createPolicy(cwd, tier = 2) {
+export function createPolicy(cwd, tier = 2, extraProtectedPaths = []) {
     return {
         tier,
         allowedPaths: [resolve(cwd)],
         denyCommands: [...DENY_COMMANDS],
         readOnlyCommands: [...READ_ONLY_COMMANDS],
+        extraProtectedPaths,
     };
 }
 /**
@@ -130,6 +132,19 @@ export function checkRead(filePath, policy) {
  */
 export function checkWrite(filePath, policy) {
     const resolved = normalize(resolve(filePath));
+    // Unconditional, tier-independent denylist: dotfiles, credentials, shell
+    // profiles, and the agent's own config/rules files are NEVER writable, no
+    // matter the tier or permission mode. Re-evaluated fresh every call — never
+    // cached, so a prior approval can't be replayed against a new target.
+    const protectedCheck = checkProtectedPath(resolved, policy.extraProtectedPaths ?? []);
+    if (!protectedCheck.allowed) {
+        securityLog.record(makeSecurityEvent("path-blocked", `${resolved}: ${protectedCheck.reason}`, "high"));
+        return {
+            allowed: false,
+            tier: policy.tier,
+            reason: `Write denied: ${protectedCheck.reason}`,
+        };
+    }
     // Tier 1: read-only — no writes ever.
     if (policy.tier === 1) {
         return {
@@ -178,6 +193,19 @@ export function checkWrite(filePath, policy) {
  */
 export function checkCommand(command, policy) {
     const cmd = normalizeCommand(command);
+    // 0. Unconditional: a command that names a protected path as its target
+    // (redirection, well-known config-editing commands) is blocked regardless
+    // of tier. This closes the gap NVIDIA calls out — OS-level path protection
+    // is the primary control, but catching it at the command layer too is
+    // useful defense-in-depth against sandbox misconfiguration.
+    const redirectTarget = /(>>?|\btee\b)\s*([^\s|&;]+)/.exec(cmd);
+    if (redirectTarget) {
+        const protectedCheck = checkProtectedPath(redirectTarget[2], policy.extraProtectedPaths ?? []);
+        if (!protectedCheck.allowed) {
+            securityLog.record(makeSecurityEvent("path-blocked", `command target ${redirectTarget[2]}: ${protectedCheck.reason}`, "high"));
+            return { allowed: false, tier: policy.tier, reason: `Command denied: ${protectedCheck.reason}` };
+        }
+    }
     // 1. Deny-list — always blocked.
     for (const denied of policy.denyCommands) {
         if (cmd.includes(denied)) {
@@ -240,6 +268,26 @@ export function isDestructive(command) {
     const cmd = normalizeCommand(command).toLowerCase();
     return DESTRUCTIVE_PATTERNS.some((p) => cmd.includes(p.toLowerCase()));
 }
+/**
+ * Scan ingested content (README, commit messages, AGENTS.md, tool/HTTP
+ * output, recalled memory) for prompt-injection indicators before it reaches
+ * a model. Never blocks silently — it records a security event and returns
+ * the finding so the caller decides whether to warn, exclude, or gate on
+ * approval. Maps to OWASP ASI04 (Agentic Supply Chain) / ASI06 (Memory and
+ * Context Poisoning).
+ */
+export function checkContent(text, source) {
+    const finding = scanForInjection(text, source);
+    if (finding.severity !== "none") {
+        securityLog.record(makeSecurityEvent("injection-detected", `${source}: ${finding.reason}`, finding.severity === "high" ? "high" : "low"));
+    }
+    return {
+        allowed: finding.severity !== "high",
+        tier: 1,
+        reason: finding.reason,
+        severity: finding.severity,
+    };
+}
 /**
  * Map a pipeline phase name to its appropriate {@link PermissionTier}.
  *

package/dist/core/security.d.ts

@@ -0,0 +1,113 @@
+/**
+ * security — defense-in-depth for a Headroom master that can drive real AI
+ * agents with real shell/file/network access. Prompt-level instructions
+ * ("don't touch secrets") are advisory only; a compromised or over-eager
+ * agent can be talked past them. These controls enforce at the code
+ * chokepoint instead, mapped to:
+ *
+ *  - NVIDIA AI Red Team's mandatory sandbox controls (network egress,
+ *    no writes outside the workspace, no writes to config/dotfiles ever,
+ *    no cached approvals, secret injection not inheritance).
+ *  - OWASP Top 10 for Agentic Applications:
+ *      ASI01 Agent Goal Hijack / ASI05 Unexpected Code Execution
+ *        -> protected-path denylist + destructive-command detection (sandbox.ts)
+ *      ASI02 Tool Misuse            -> network egress allowlist
+ *      ASI03 Identity/Privilege Abuse -> secret scrubbing for spawned processes
+ *      ASI04 Agentic Supply Chain    -> prompt-injection scanning of ingested
+ *                                       content (README, commits, AGENTS.md,
+ *                                       skills, tool output) before it reaches
+ *                                       a model
+ *      ASI06 Memory/Context Poisoning -> same scanner applied to recall memory
+ *
+ * Every check here is a pure function re-evaluated on every call — nothing is
+ * memoized or cached, so a single approval can never be replayed (NVIDIA:
+ * "approvals should never be cached or persisted").
+ */
+/**
+ * Paths that must NEVER be written to by the agent, regardless of tier,
+ * permission mode, or user override. This list is the "enterprise-level
+ * denylist" NVIDIA describes: it cannot be relaxed by config.
+ */
+export declare function baseProtectedPaths(): string[];
+/** File name / extension patterns that are protected wherever they appear
+ * (including inside the project workspace) — agent-config and secret files. */
+export declare const PROTECTED_NAME_PATTERNS: RegExp[];
+export interface PathCheck {
+    allowed: boolean;
+    reason: string;
+    protectedBy?: string;
+}
+/**
+ * Check a write target against the protected-path denylist. `extra` allows
+ * project-specific additions (config), but the base list is always applied on
+ * top and can never be removed — this is the "enterprise policy" backstop.
+ */
+export declare function checkProtectedPath(targetPath: string, extra?: string[]): PathCheck;
+export interface EgressCheck {
+    allowed: boolean;
+    reason: string;
+}
+/** Default-deny egress: only these hosts are reachable unless configured otherwise. */
+export declare const DEFAULT_NET_ALLOWLIST: string[];
+/**
+ * Check an outbound URL against the egress allowlist. Wildcards ("*.example.com")
+ * match subdomains. Default-deny: anything not listed is blocked (NVIDIA:
+ * "network connections ... should not be permitted without manual approval").
+ */
+export declare function checkEgress(url: string, allowlist?: string[]): EgressCheck;
+/**
+ * Scrub secret-shaped env vars from an environment before it's handed to a
+ * spawned process. `allow` explicitly re-admits specific names the current
+ * task actually needs (secret injection, not blanket inheritance — NVIDIA).
+ */
+export declare function scrubEnv(env: NodeJS.ProcessEnv, allow?: string[]): NodeJS.ProcessEnv;
+/** Redact secret-shaped substrings from text before it is logged or shown. */
+export declare function redactSecrets(text: string): string;
+export type InjectionSeverity = "none" | "low" | "high";
+export interface InjectionFinding {
+    severity: InjectionSeverity;
+    matches: string[];
+    reason: string;
+}
+/** Scan a single blob of ingested text for injection indicators. */
+export declare function scanForInjection(text: string, source?: string): InjectionFinding;
+/** Scan several named blobs at once (e.g. scout findings) and keep only hits. */
+export declare function scanAll(blobs: Record<string, string | null | undefined>): Record<string, InjectionFinding>;
+export interface SecurityEvent {
+    ts: string;
+    kind: "path-blocked" | "egress-blocked" | "injection-detected" | "secret-scrubbed";
+    detail: string;
+    severity: "low" | "high";
+}
+export declare function makeSecurityEvent(kind: SecurityEvent["kind"], detail: string, severity?: SecurityEvent["severity"]): SecurityEvent;
+/** In-memory ring buffer of recent security events, for `maq security report` / the UI. */
+export declare class SecurityLog {
+    private cap;
+    private events;
+    constructor(cap?: number);
+    record(e: SecurityEvent): void;
+    list(): SecurityEvent[];
+    clear(): void;
+}
+/** Process-wide default log so independently-imported modules share one feed. */
+export declare const securityLog: SecurityLog;
+export interface SecurityConfigLike {
+    extraProtectedPaths: string[];
+    extraNetAllowlist: string[];
+    permissionMode: string;
+}
+/**
+ * The single source of truth for "what does MAQ enforce right now" — used by
+ * both `maq security rules` (terminal) and `GET /v1/security` (web UI), so the
+ * two surfaces can never drift out of sync with each other or with what
+ * sandbox.ts/exec.ts/tools.ts actually enforce.
+ */
+export declare function securityRules(cfg: SecurityConfigLike): {
+    protectedPaths: string[];
+    protectedNamePatterns: string[];
+    extraProtectedPaths: string[];
+    netAllowlist: string[];
+    permissionMode: string;
+    secretEnvScrubbing: boolean;
+    promptInjectionScanning: string[];
+};

package/dist/core/security.js

@@ -0,0 +1,303 @@
+/**
+ * security — defense-in-depth for a Headroom master that can drive real AI
+ * agents with real shell/file/network access. Prompt-level instructions
+ * ("don't touch secrets") are advisory only; a compromised or over-eager
+ * agent can be talked past them. These controls enforce at the code
+ * chokepoint instead, mapped to:
+ *
+ *  - NVIDIA AI Red Team's mandatory sandbox controls (network egress,
+ *    no writes outside the workspace, no writes to config/dotfiles ever,
+ *    no cached approvals, secret injection not inheritance).
+ *  - OWASP Top 10 for Agentic Applications:
+ *      ASI01 Agent Goal Hijack / ASI05 Unexpected Code Execution
+ *        -> protected-path denylist + destructive-command detection (sandbox.ts)
+ *      ASI02 Tool Misuse            -> network egress allowlist
+ *      ASI03 Identity/Privilege Abuse -> secret scrubbing for spawned processes
+ *      ASI04 Agentic Supply Chain    -> prompt-injection scanning of ingested
+ *                                       content (README, commits, AGENTS.md,
+ *                                       skills, tool output) before it reaches
+ *                                       a model
+ *      ASI06 Memory/Context Poisoning -> same scanner applied to recall memory
+ *
+ * Every check here is a pure function re-evaluated on every call — nothing is
+ * memoized or cached, so a single approval can never be replayed (NVIDIA:
+ * "approvals should never be cached or persisted").
+ */
+import { homedir, platform } from "node:os";
+import { join, normalize, resolve, sep } from "node:path";
+/* ------------------------- protected paths ------------------------------ */
+/**
+ * Paths that must NEVER be written to by the agent, regardless of tier,
+ * permission mode, or user override. This list is the "enterprise-level
+ * denylist" NVIDIA describes: it cannot be relaxed by config.
+ */
+export function baseProtectedPaths() {
+    const home = homedir();
+    const win = platform() === "win32";
+    const common = [
+        // secrets / credentials
+        join(home, ".ssh"),
+        join(home, ".aws"),
+        join(home, ".gnupg"),
+        join(home, ".netrc"),
+        join(home, ".npmrc"),
+        join(home, ".pypirc"),
+        join(home, ".docker", "config.json"),
+        join(home, ".kube", "config"),
+        // shell / dotfile persistence vectors
+        join(home, ".bashrc"),
+        join(home, ".bash_profile"),
+        join(home, ".zshrc"),
+        join(home, ".zprofile"),
+        join(home, ".profile"),
+        join(home, ".gitconfig"),
+        join(home, ".curlrc"),
+        join(home, ".local", "bin"),
+        // MAQ's own configuration — an agent must never edit its own permission model
+        join(home, ".maqcli"),
+    ];
+    if (win) {
+        common.push(join(home, "AppData", "Roaming", "npm"), "C:\\Windows", "C:\\Program Files", "C:\\Program Files (x86)");
+    }
+    else {
+        common.push("/etc", "/usr", "/bin", "/sbin", "/boot");
+    }
+    return common;
+}
+/** File name / extension patterns that are protected wherever they appear
+ * (including inside the project workspace) — agent-config and secret files. */
+export const PROTECTED_NAME_PATTERNS = [
+    /^\.env(\..*)?$/i,
+    /^\.git\/config$/i,
+    /credentials(\.json)?$/i,
+    /^id_rsa(\.pub)?$/i,
+    /^id_ed25519(\.pub)?$/i,
+    /\.pem$/i,
+    /\.pfx$/i,
+    /^\.npmrc$/i,
+    /^\.pypirc$/i,
+    /^\.netrc$/i,
+    // an agent must never rewrite the rules that govern its own behavior
+    /^AGENTS\.md$/i,
+    /^CLAUDE\.md$/i,
+    /^\.cursorrules$/i,
+    /^copilot-instructions\.md$/i,
+    /^\.maq[\\/]security\.json$/i,
+];
+/**
+ * Check a write target against the protected-path denylist. `extra` allows
+ * project-specific additions (config), but the base list is always applied on
+ * top and can never be removed — this is the "enterprise policy" backstop.
+ */
+export function checkProtectedPath(targetPath, extra = []) {
+    const resolved = normalize(resolve(targetPath));
+    const win = platform() === "win32";
+    const eq = (a, b) => (win ? a.toLowerCase() === b.toLowerCase() : a === b);
+    const within = (root) => {
+        const r = normalize(resolve(root));
+        if (eq(resolved, r))
+            return true;
+        const withSep = r.endsWith(sep) ? r : r + sep;
+        return win ? resolved.toLowerCase().startsWith(withSep.toLowerCase()) : resolved.startsWith(withSep);
+    };
+    for (const root of [...baseProtectedPaths(), ...extra]) {
+        if (within(root)) {
+            return { allowed: false, reason: `protected path (never writable): ${root}`, protectedBy: root };
+        }
+    }
+    const base = resolved.split(/[\\/]/).pop() ?? resolved;
+    for (const pat of PROTECTED_NAME_PATTERNS) {
+        if (pat.test(base) || pat.test(resolved.replace(/\\/g, "/"))) {
+            return { allowed: false, reason: `protected file pattern (never writable): ${pat}`, protectedBy: pat.toString() };
+        }
+    }
+    return { allowed: true, reason: "not a protected path" };
+}
+/** Default-deny egress: only these hosts are reachable unless configured otherwise. */
+export const DEFAULT_NET_ALLOWLIST = [
+    // package registries an agent legitimately needs during normal dev work
+    "registry.npmjs.org",
+    "pypi.org",
+    "files.pythonhosted.org",
+    "crates.io",
+    "proxy.golang.org",
+    "github.com",
+    "raw.githubusercontent.com",
+    "api.github.com",
+];
+function hostOf(url) {
+    try {
+        return new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check an outbound URL against the egress allowlist. Wildcards ("*.example.com")
+ * match subdomains. Default-deny: anything not listed is blocked (NVIDIA:
+ * "network connections ... should not be permitted without manual approval").
+ */
+export function checkEgress(url, allowlist = DEFAULT_NET_ALLOWLIST) {
+    const host = hostOf(url);
+    if (!host)
+        return { allowed: false, reason: `not a valid http(s) URL: ${url}` };
+    if (!/^https?:$/i.test(new URL(url).protocol)) {
+        return { allowed: false, reason: "only http/https egress is permitted" };
+    }
+    const match = allowlist.some((entry) => {
+        const e = entry.toLowerCase();
+        if (e.startsWith("*."))
+            return host === e.slice(2) || host.endsWith("." + e.slice(2));
+        return host === e;
+    });
+    return match
+        ? { allowed: true, reason: `host allowlisted: ${host}` }
+        : { allowed: false, reason: `host not in the network allowlist: ${host} (default-deny)` };
+}
+/* ------------------------- secret scrubbing ------------------------------ */
+/** Env var name patterns treated as secrets and stripped before spawning a worker. */
+const SECRET_ENV_PATTERNS = [
+    /_KEY$/i,
+    /_SECRET$/i,
+    /_TOKEN$/i,
+    /_PASSWORD$/i,
+    /^AWS_/i,
+    /^AZURE_/i,
+    /^GCP_/i,
+    /^OPENAI_API_KEY$/i,
+    /^ANTHROPIC_API_KEY$/i,
+    /^GROQ_API_KEY$/i,
+    /^GEMINI_API_KEY$/i,
+    /^GOOGLE_API_KEY$/i,
+    /^NPM_TOKEN$/i,
+    /^GITHUB_TOKEN$/i,
+    /^MAQ_TOKEN$/i,
+    /^RELAY_TOKEN$/i,
+];
+/**
+ * Scrub secret-shaped env vars from an environment before it's handed to a
+ * spawned process. `allow` explicitly re-admits specific names the current
+ * task actually needs (secret injection, not blanket inheritance — NVIDIA).
+ */
+export function scrubEnv(env, allow = []) {
+    const allowSet = new Set(allow.map((a) => a.toUpperCase()));
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (v === undefined)
+            continue;
+        const isSecret = SECRET_ENV_PATTERNS.some((p) => p.test(k));
+        if (isSecret && !allowSet.has(k.toUpperCase()))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/** Redact secret-shaped substrings from text before it is logged or shown. */
+export function redactSecrets(text) {
+    let out = text;
+    // key=value / key: value pairs whose key looks like a secret
+    out = out.replace(/\b([A-Za-z_][A-Za-z0-9_]*(?:_KEY|_SECRET|_TOKEN|_PASSWORD))\s*[=:]\s*\S+/gi, "$1=***REDACTED***");
+    // common token shapes
+    out = out.replace(/\bsk-[A-Za-z0-9_-]{10,}\b/g, "sk-***REDACTED***");
+    out = out.replace(/\bnpm_[A-Za-z0-9]{20,}\b/g, "npm_***REDACTED***");
+    out = out.replace(/\bghp_[A-Za-z0-9]{20,}\b/g, "ghp_***REDACTED***");
+    out = out.replace(/\bAKIA[0-9A-Z]{12,}\b/g, "AKIA***REDACTED***");
+    return out;
+}
+/**
+ * Heuristic scanner for indirect prompt injection in ingested content (README,
+ * commit messages, AGENTS.md, skills, tool/HTTP output, recalled memory).
+ * This is advisory-but-loud: it never silently drops content, it flags it so
+ * the caller can warn, exclude it from context, or require approval before
+ * acting on anything it suggested. Pattern-based and dependency-free.
+ */
+const INJECTION_PATTERNS = [
+    { re: /ignore\s+(all\s+)?(previous|prior|above)\s+instructions/i, severity: "high", label: "instruction override" },
+    { re: /disregard\s+(all\s+)?(previous|prior|your)\s+(instructions|rules|guidelines)/i, severity: "high", label: "instruction override" },
+    { re: /you\s+are\s+now\s+(a|an)\s+\w+/i, severity: "high", label: "role reassignment" },
+    { re: /system\s*prompt\s*:/i, severity: "high", label: "fake system prompt" },
+    { re: /\bnew\s+instructions?\b.{0,40}\bfollow\b/i, severity: "high", label: "instruction override" },
+    { re: /reveal\s+(your\s+)?(system\s+prompt|instructions|api\s*key|secret)/i, severity: "high", label: "exfiltration request" },
+    { re: /send\s+(this|the|your)\s+.{0,30}\bto\s+https?:\/\//i, severity: "high", label: "exfiltration instruction" },
+    { re: /curl\s+.{0,60}\|\s*(sh|bash)/i, severity: "high", label: "pipe-to-shell" },
+    { re: /base64\s+-d.{0,20}\|\s*(sh|bash)/i, severity: "high", label: "obfuscated execution" },
+    { re: /rm\s+-rf\s+[~/]/i, severity: "high", label: "destructive command in content" },
+    { re: /(disable|bypass|turn off)\s+(the\s+)?(sandbox|permission|security|safety)/i, severity: "high", label: "guardrail bypass request" },
+    { re: /as\s+an?\s+ai\s+(with\s+)?no\s+(restrictions|limits|filters)/i, severity: "low", label: "jailbreak framing" },
+    { re: /\[\s*(system|assistant)\s*\]/i, severity: "low", label: "fake role marker" },
+];
+/** Scan a single blob of ingested text for injection indicators. */
+export function scanForInjection(text, source = "content") {
+    if (!text)
+        return { severity: "none", matches: [], reason: "empty" };
+    const matches = [];
+    let severity = "none";
+    for (const p of INJECTION_PATTERNS) {
+        if (p.re.test(text)) {
+            matches.push(p.label);
+            if (p.severity === "high")
+                severity = "high";
+            else if (severity === "none")
+                severity = "low";
+        }
+    }
+    return {
+        severity,
+        matches: [...new Set(matches)],
+        reason: matches.length ? `${matches.length} indicator(s) in ${source}: ${[...new Set(matches)].join(", ")}` : `no indicators found in ${source}`,
+    };
+}
+/** Scan several named blobs at once (e.g. scout findings) and keep only hits. */
+export function scanAll(blobs) {
+    const out = {};
+    for (const [name, text] of Object.entries(blobs)) {
+        if (!text)
+            continue;
+        const f = scanForInjection(text, name);
+        if (f.severity !== "none")
+            out[name] = f;
+    }
+    return out;
+}
+export function makeSecurityEvent(kind, detail, severity = "high") {
+    return { ts: new Date().toISOString(), kind, detail, severity };
+}
+/** In-memory ring buffer of recent security events, for `maq security report` / the UI. */
+export class SecurityLog {
+    cap;
+    events = [];
+    constructor(cap = 500) {
+        this.cap = cap;
+    }
+    record(e) {
+        this.events.push(e);
+        if (this.events.length > this.cap)
+            this.events.splice(0, this.events.length - this.cap);
+    }
+    list() {
+        return [...this.events];
+    }
+    clear() {
+        this.events = [];
+    }
+}
+/** Process-wide default log so independently-imported modules share one feed. */
+export const securityLog = new SecurityLog();
+/**
+ * The single source of truth for "what does MAQ enforce right now" — used by
+ * both `maq security rules` (terminal) and `GET /v1/security` (web UI), so the
+ * two surfaces can never drift out of sync with each other or with what
+ * sandbox.ts/exec.ts/tools.ts actually enforce.
+ */
+export function securityRules(cfg) {
+    return {
+        protectedPaths: baseProtectedPaths(),
+        protectedNamePatterns: PROTECTED_NAME_PATTERNS.map((p) => p.toString()),
+        extraProtectedPaths: cfg.extraProtectedPaths,
+        netAllowlist: [...DEFAULT_NET_ALLOWLIST, ...cfg.extraNetAllowlist],
+        permissionMode: cfg.permissionMode,
+        secretEnvScrubbing: true,
+        promptInjectionScanning: ["scout.readme", "scout.manifest", "scout.commits", "skills.files", "agents.md"],
+    };
+}

package/dist/core/skills.d.ts

@@ -28,6 +28,15 @@ export interface Skill {
     tier: SkillTier;
     kind: SkillKind;
     content: string;
+    /**
+     * Set when the file's content matched a prompt-injection heuristic. Skills
+     * (AGENTS.md, project .maq/skills/*.md) are standing instructions read into
+     * EVERY prompt — exactly the OWASP ASI04 supply-chain vector (a poisoned
+     * file committed into a cloned repo). Flagged skills are still loaded (so
+     * legitimate unusual-but-safe rules aren't silently dropped) but are marked
+     * for the caller to warn on / exclude / gate.
+     */
+    suspicious?: boolean;
 }
 export interface SkillsOptions {
     skillsDir?: string;

package/dist/core/skills.js

@@ -22,6 +22,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, writeFileSync } from "node:fs";
+import { scanForInjection, securityLog, makeSecurityEvent } from "./security.js";
 /**
  * Curated default skills. Grounded in 2026 agent-instruction best practice:
  * frontier models reliably follow ~150–200 instructions before adherence
@@ -164,7 +165,8 @@ export class SkillsManager {
         const parts = ["Standing instructions (skills):"];
         let budget = this.maxChars;
         for (const s of skills) {
-            const line = `- [${s.kind}] ${s.name}: ${s.content.trim()}`;
+            const flag = s.suspicious ? "[UNVERIFIED-SOURCE, possible injection] " : "";
+            const line = `- [${s.kind}] ${s.name}: ${flag}${s.content.trim()}`;
             if (line.length > budget) {
                 parts.push(line.slice(0, Math.max(0, budget)) + "…");
                 break;
@@ -202,7 +204,13 @@ export class SkillsManager {
                 return null;
             const raw = readFileSync(path, "utf8").slice(0, MAX_FILE_CHARS);
             const { tier, kind, body } = parseFrontMatter(raw);
-            return { name, path, tier, kind, content: body };
+            // Skill/AGENTS.md files are standing instructions read into every
+            // prompt — scan them the same way ingested repo content is scanned.
+            const finding = scanForInjection(body, `skill:${name}`);
+            if (finding.severity !== "none") {
+                securityLog.record(makeSecurityEvent("injection-detected", `${path}: ${finding.reason}`, finding.severity === "high" ? "high" : "low"));
+            }
+            return { name, path, tier, kind, content: body, suspicious: finding.severity !== "none" };
         }
         catch {
             return null;

package/dist/core/tools.d.ts

@@ -26,6 +26,8 @@ export interface ToolContext {
     cwd: string;
     headroom?: Headroom;
     allowNet?: boolean;
+    /** Egress allowlist for http_get; falls back to security.ts's DEFAULT_NET_ALLOWLIST. */
+    netAllowlist?: string[];
 }
 export declare function createToolRegistry(ctx: ToolContext): ToolRegistry;
 export declare class ToolRegistry {

package/dist/core/tools.js

@@ -11,6 +11,7 @@
  */
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { resolve, join, relative, isAbsolute } from "node:path";
+import { checkEgress } from "./security.js";
 const MAX_OUT = 64 * 1024;
 /** Resolve a user path safely inside cwd; throws on traversal escape. */
 function safePath(cwd, p) {
@@ -122,12 +123,17 @@ export function createToolRegistry(ctx) {
     if (allowNet) {
         tools.push({
             name: "http_get",
-            description: "HTTP GET a URL and return up to 64KB of text (network access is enabled).",
+            description: "HTTP GET a URL and return up to 64KB of text (network access is enabled, egress allowlisted).",
             parameters: { url: { type: "string", description: "http(s) URL", required: true } },
             run: async (args) => {
                 const url = String(args.url ?? "");
                 if (!/^https?:\/\//i.test(url))
                     throw new Error("only http(s) URLs allowed");
+                // Enabling net access is not a blanket exfiltration path — every
+                // request still passes the network egress allowlist (default-deny).
+                const egress = checkEgress(url, ctx.netAllowlist);
+                if (!egress.allowed)
+                    throw new Error(`blocked by network egress policy: ${egress.reason}`);
                 const res = await fetch(url, { signal: AbortSignal.timeout(15000) });
                 const text = await res.text();
                 return { status: res.status, body: text.slice(0, MAX_OUT) };

package/dist/core/update.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Self-update — lets a user run `maq update` from inside the CLI instead of
+ * remembering the npm incantation. Checks the npm registry for the latest
+ * published version, compares it to the running version, and (unless
+ * --check-only) re-installs globally via npm.
+ *
+ * Network access here is a deliberate, user-initiated exception to the
+ * default-deny egress posture (core/security.ts) — it only ever talks to the
+ * npm registry, and only when the user explicitly runs this command.
+ */
+export interface VersionInfo {
+    current: string;
+    latest: string | null;
+    upToDate: boolean;
+    error?: string;
+}
+/** Returns true if `latest` is strictly newer than `current`. */
+export declare function isNewer(current: string, latest: string): boolean;
+/** Query the npm registry for the latest published version of `maqcli`. */
+export declare function fetchLatestVersion(registryUrl?: string, timeoutMs?: number): Promise<string>;
+/** Compare the running version against the registry; never throws. */
+export declare function checkForUpdate(currentVersion: string): Promise<VersionInfo>;
+export interface UpdateOutcome {
+    ok: boolean;
+    message: string;
+    version?: VersionInfo;
+}
+/**
+ * Perform the update: check the registry, and if a newer version exists,
+ * run `npm install -g maqcli@<latest>`. `runner` is injectable for tests —
+ * it defaults to execSafe (shell:false, argument array; never string-built).
+ */
+export declare function performUpdate(currentVersion: string, opts?: {
+    checkOnly?: boolean;
+    runner?: (cmd: string, args: string[]) => Promise<{
+        code: number | null;
+        stdout: string;
+        stderr: string;
+    }>;
+}): Promise<UpdateOutcome>;

package/dist/core/update.js

@@ -0,0 +1,75 @@
+/**
+ * Self-update — lets a user run `maq update` from inside the CLI instead of
+ * remembering the npm incantation. Checks the npm registry for the latest
+ * published version, compares it to the running version, and (unless
+ * --check-only) re-installs globally via npm.
+ *
+ * Network access here is a deliberate, user-initiated exception to the
+ * default-deny egress posture (core/security.ts) — it only ever talks to the
+ * npm registry, and only when the user explicitly runs this command.
+ */
+import { execSafe } from "./exec.js";
+/** Parse "x.y.z" into a comparable tuple; non-numeric parts sort as 0. */
+function parseSemver(v) {
+    const parts = v.replace(/^v/, "").split(".").map((p) => parseInt(p, 10));
+    return [parts[0] || 0, parts[1] || 0, parts[2] || 0];
+}
+/** Returns true if `latest` is strictly newer than `current`. */
+export function isNewer(current, latest) {
+    const a = parseSemver(current);
+    const b = parseSemver(latest);
+    for (let i = 0; i < 3; i++) {
+        if (b[i] > a[i])
+            return true;
+        if (b[i] < a[i])
+            return false;
+    }
+    return false;
+}
+/** Query the npm registry for the latest published version of `maqcli`. */
+export async function fetchLatestVersion(registryUrl = "https://registry.npmjs.org/maqcli/latest", timeoutMs = 8000) {
+    const res = await fetch(registryUrl, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok)
+        throw new Error(`registry returned ${res.status}`);
+    const body = (await res.json());
+    if (!body.version)
+        throw new Error("registry response missing a version field");
+    return body.version;
+}
+/** Compare the running version against the registry; never throws. */
+export async function checkForUpdate(currentVersion) {
+    try {
+        const latest = await fetchLatestVersion();
+        return { current: currentVersion, latest, upToDate: !isNewer(currentVersion, latest) };
+    }
+    catch (e) {
+        return { current: currentVersion, latest: null, upToDate: true, error: e.message };
+    }
+}
+/**
+ * Perform the update: check the registry, and if a newer version exists,
+ * run `npm install -g maqcli@<latest>`. `runner` is injectable for tests —
+ * it defaults to execSafe (shell:false, argument array; never string-built).
+ */
+export async function performUpdate(currentVersion, opts = {}) {
+    const version = await checkForUpdate(currentVersion);
+    if (version.error) {
+        return { ok: false, message: `could not check for updates: ${version.error}`, version };
+    }
+    if (version.upToDate) {
+        return { ok: true, message: `already up to date (v${version.current})`, version };
+    }
+    if (opts.checkOnly) {
+        return { ok: true, message: `update available: v${version.current} -> v${version.latest}`, version };
+    }
+    const runner = opts.runner ?? (async (cmd, args) => execSafe(cmd, args, { timeoutMs: 120000 }));
+    const outcome = await runner("npm", ["install", "-g", `maqcli@${version.latest}`]);
+    if (outcome.code !== 0) {
+        return {
+            ok: false,
+            message: `update to v${version.latest} failed (exit ${outcome.code}): ${outcome.stderr.slice(0, 400) || outcome.stdout.slice(0, 400)}`,
+            version,
+        };
+    }
+    return { ok: true, message: `updated v${version.current} -> v${version.latest}`, version };
+}

package/dist/index.js

@@ -11,7 +11,7 @@
 import { parseArgs } from "node:util";
 import { logger } from "./core/logger.js";
 import { detectAgents, resolveTarget } from "./core/registry.js";
-import { loadConfig, saveConfig, setConfigKey, configPath } from "./core/config-store.js";
+import { loadConfig, saveConfig, setConfigKey, configPath, addConfigListItem, removeConfigListItem } from "./core/config-store.js";
 import { runScout } from "./phases/scout.js";
 import { getProvider } from "./core/model.js";
 import { runPlan } from "./phases/plan.js";
@@ -43,7 +43,10 @@ import { runInit } from "./core/init-wizard.js";
 import { CostTracker } from "./core/cost-tracker.js";
 import { runLauncher } from "./core/launcher.js";
 import { runOrchestration } from "./core/orchestrator.js";
-const VERSION = "0.5.0";
+import { performUpdate } from "./core/update.js";
+import { checkProtectedPath, scanForInjection, securityLog, securityRules, } from "./core/security.js";
+import { readFileSync, statSync } from "node:fs";
+const VERSION = "0.6.1";
 async function main(argv) {
     const [command, ...rest] = argv;
     switch (command) {
@@ -75,6 +78,10 @@ async function main(argv) {
             return cmdRun(rest);
         case "orchestrate":
             return cmdOrchestrate(rest);
+        case "security":
+            return cmdSecurity(rest);
+        case "update":
+            return cmdUpdate(rest);
         case "verify":
             return cmdVerify(rest);
         case "serve":
@@ -319,6 +326,131 @@ async function cmdVerify(args) {
     logger.out(JSON.stringify({ detectedTestCommand: testCmd, verify: result }, null, values.json ? 0 : 2));
     return result.verified ? 0 : 3;
 }
+/**
+ * `maq security` — the single place both the terminal and the web UI read
+ * the SAME enforced rules from (core/security.ts), so there is no drift
+ * between what's documented and what's actually enforced at the code
+ * chokepoints (sandbox.ts / exec.ts / tools.ts / scout.ts / skills.ts).
+ */
+function cmdSecurity(args) {
+    const { values, positionals } = parseArgs({
+        args,
+        options: { ...commonFlags(), limit: { type: "string" } },
+        allowPositionals: true,
+    });
+    const sub = positionals[0] ?? "report";
+    const cfg = loadConfig();
+    if (sub === "rules") {
+        const rules = securityRules(cfg);
+        if (values.json) {
+            logger.out(JSON.stringify(rules, null, 0));
+            return 0;
+        }
+        logger.out("MAQ security rules — enforced at the code level, not just prompted for.\n");
+        logger.out("Protected paths (never writable, cannot be overridden by config):");
+        for (const p of rules.protectedPaths)
+            logger.out(`  - ${p}`);
+        logger.out("\nProtected file patterns (matched by name, anywhere):");
+        for (const p of rules.protectedNamePatterns)
+            logger.out(`  - ${p}`);
+        if (rules.extraProtectedPaths.length) {
+            logger.out("\nProject-added protected paths (config: extraProtectedPaths):");
+            for (const p of rules.extraProtectedPaths)
+                logger.out(`  - ${p}`);
+        }
+        logger.out("\nNetwork egress allowlist (default-deny everything else):");
+        for (const h of rules.netAllowlist)
+            logger.out(`  - ${h}`);
+        logger.out("\nSecret-shaped env vars scrubbed from spawned workers by default.");
+        logger.out("Prompt-injection heuristics scanned on: README, manifest, git commits, AGENTS.md/skill files.");
+        logger.out(`\nPermission posture: ${cfg.permissionMode}  (moderate = major/destructive actions queue for approval)`);
+        logger.out("\nmanage: maq security add|remove extraProtectedPaths|extraNetAllowlist <value>");
+        return 0;
+    }
+    if (sub === "scan") {
+        const target = positionals[1];
+        if (!target) {
+            logger.error("usage: maq security scan <path>");
+            return 1;
+        }
+        try {
+            const stat = statSync(target);
+            if (!stat.isFile()) {
+                logger.error(`not a file: ${target}`);
+                return 1;
+            }
+            const text = readFileSync(target, "utf8");
+            const pathCheck = checkProtectedPath(target, cfg.extraProtectedPaths);
+            const injection = scanForInjection(text, target);
+            const result = { path: target, protectedPath: !pathCheck.allowed, pathReason: pathCheck.reason, injection };
+            if (values.json) {
+                logger.out(JSON.stringify(result, null, 0));
+            }
+            else {
+                logger.out(`scan: ${target}`);
+                logger.out(`  protected path: ${pathCheck.allowed ? "no" : "YES — " + pathCheck.reason}`);
+                logger.out(`  prompt injection: ${injection.severity} (${injection.reason})`);
+            }
+            return pathCheck.allowed && injection.severity !== "high" ? 0 : 2;
+        }
+        catch (e) {
+            logger.error(e.message);
+            return 1;
+        }
+    }
+    if (sub === "add" || sub === "remove") {
+        const key = positionals[1];
+        const value = positionals[2];
+        if (!key || !value || !["extraProtectedPaths", "extraNetAllowlist"].includes(key)) {
+            logger.error("usage: maq security [add|remove] <extraProtectedPaths|extraNetAllowlist> <value>");
+            return 1;
+        }
+        const updated = sub === "add" ? addConfigListItem(key, value) : removeConfigListItem(key, value);
+        logger.out(`${key} = ${JSON.stringify(updated[key])}`);
+        return 0;
+    }
+    // Default: report — recent security events (path blocks, egress blocks,
+    // injection detections) recorded during this process's lifetime, plus
+    // a rollup of the enforced posture.
+    const limit = values.limit ? Number(values.limit) : 20;
+    const events = securityLog.list().slice(-limit);
+    if (values.json) {
+        logger.out(JSON.stringify({ permissionMode: cfg.permissionMode, events }, null, 0));
+        return 0;
+    }
+    logger.out("MAQ security report");
+    logger.out(`  permission posture: ${cfg.permissionMode}`);
+    logger.out(`  recent security events: ${events.length}`);
+    for (const e of events) {
+        logger.out(`  [${e.severity.padEnd(4)}] ${e.ts}  ${e.kind}: ${e.detail}`);
+    }
+    if (events.length === 0)
+        logger.out("  (none recorded this session — run a task, then check again, or 'maq security rules')");
+    return 0;
+}
+/** Machine-readable rule set — shared shape with the daemon's GET /v1/security. */
+async function cmdUpdate(args) {
+    const { values } = parseArgs({
+        args,
+        options: { ...commonFlags(), check: { type: "boolean", default: false } },
+        allowPositionals: true,
+    });
+    logger.out(`current version: ${VERSION}`);
+    logger.out(values.check ? "checking npm for a newer version…" : "checking npm and updating if a newer version is available…");
+    const outcome = await performUpdate(VERSION, { checkOnly: values.check });
+    if (values.json) {
+        logger.out(JSON.stringify(outcome, null, 0));
+        return outcome.ok ? 0 : 1;
+    }
+    logger.out(outcome.message);
+    if (outcome.ok && outcome.version && !outcome.version.upToDate && !values.check) {
+        logger.out("restart your terminal (or open a new one) to pick up the updated binary.");
+    }
+    if (outcome.ok && outcome.version && !outcome.version.upToDate && values.check) {
+        logger.out("run 'maq update' (without --check) to install it.");
+    }
+    return outcome.ok ? 0 : 1;
+}
 async function cmdServe(args) {
     const { values } = parseArgs({
         args,
@@ -1069,6 +1201,8 @@ function printHelp() {
         "  cost [report|reset]          Aggregated cost tracking",
         '  completion <shell>           Shell completions (bash/zsh/fish/powershell)',
         "  audit verify <run-dir>       Verify a run's hash-chained audit log",
+        "  security [report|rules|scan <path>|add|remove]  Enforced security rules + recent findings",
+        "  update [--check]             Check npm for a newer maqcli and self-update",
         "  config [get|set|path|reset]  Read or update ~/.maqcli/config.json",
         "  version | help [<topic>]",
         "",

package/dist/phases/scout.js

@@ -10,6 +10,7 @@ import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 import { classifyComplexity } from "../core/complexity.js";
 import { execSafe } from "../core/exec.js";
+import { scanAll, securityLog, makeSecurityEvent } from "../core/security.js";
 const IGNORE = new Set([
     "node_modules",
     ".git",
@@ -94,6 +95,21 @@ export async function runScout(task, cwd, fileCap = 400) {
     if (recentCommits.length === 0)
         notes.push("no git history (or git unavailable)");
     notes.push(`complexity=${complexity}: ${reasons.join("; ") || "no strong signals"}`);
+    // Scan everything Scout just ingested from the repo (README, manifest,
+    // commit messages) for indirect prompt-injection before it reaches a model.
+    // A malicious README/commit is exactly the OWASP ASI04 (Agentic Supply
+    // Chain) vector: content an attacker controls (a PR, a cloned repo) that
+    // gets read into context automatically. Findings never block Scout — they
+    // are surfaced loudly so Plan/Execute treat the content with suspicion.
+    const findings = scanAll({
+        readme,
+        manifest: manifestSnippet,
+        commits: recentCommits.join("\n"),
+    });
+    for (const [source, finding] of Object.entries(findings)) {
+        notes.push(`security: possible prompt injection in ${source} (${finding.matches.join(", ")}) — treat as untrusted content`);
+        securityLog.record(makeSecurityEvent("injection-detected", `scout/${source}: ${finding.reason}`, finding.severity === "high" ? "high" : "low"));
+    }
     return {
         task,
         cwd,

package/dist/server/daemon.js

@@ -36,6 +36,7 @@ import { InteractiveRegistry } from "../core/interactive-registry.js";
 import { webuiHtml } from "./webui.js";
 import { PermissionBroker } from "../core/permissions.js";
 import { loadConfig } from "../core/config-store.js";
+import { securityRules, securityLog } from "../core/security.js";
 /** Generate a URL-safe token. */
 export function generateToken() {
     return randomBytes(24).toString("base64url");
@@ -51,7 +52,7 @@ export function createDaemon(opts = {}) {
     const host = opts.host ?? process.env.MAQ_HOST ?? "127.0.0.1";
     const port = opts.port ?? Number(process.env.MAQ_PORT ?? 7717);
     const token = opts.token ?? process.env.MAQ_TOKEN ?? generateToken();
-    const version = opts.version ?? "0.5.0";
+    const version = opts.version ?? "0.6.1";
     const corsOrigin = opts.corsOrigin ?? process.env.MAQ_CORS_ORIGIN;
     const registry = opts.registry ?? new SessionRegistry();
     const interactive = new InteractiveRegistry();
@@ -136,6 +137,13 @@ export function createDaemon(opts = {}) {
             sendJson(res, 200, { mode: broker.getMode(), pending: broker.pending(), requests: broker.list() });
             return;
         }
+        // Enforced security rules + recent findings — the SAME data `maq security
+        // rules`/`report` prints in the terminal, so the UI and CLI never drift.
+        if (path === "/v1/security" && method === "GET") {
+            const cfg = loadConfig();
+            sendJson(res, 200, { rules: securityRules(cfg), events: securityLog.list().slice(-100) });
+            return;
+        }
         const reqMatch = /^\/v1\/requests\/([^/]+)$/.exec(path);
         if (reqMatch && method === "POST") {
             const id = decodeURIComponent(reqMatch[1]);

package/dist/server/webui.js

@@ -104,6 +104,14 @@ export function webuiHtml(version) {
   .req .btns{display:flex;gap:6px}
   .req button{border:none;border-radius:6px;padding:4px 10px;cursor:pointer;font-size:11px}
   .ok-btn{background:var(--ok);color:#00231a} .no-btn{background:var(--red);color:#2a0007}
+  .sechead{display:flex;align-items:center;gap:8px;margin:18px 0 8px}
+  .sechead:first-child{margin-top:0}
+  .sechead .n{background:var(--panel2);border:1px solid var(--edge);border-radius:999px;padding:2px 9px;font-size:11px;color:var(--mut)}
+  .seclist{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:6px}
+  .secitem{background:var(--panel);border:1px solid var(--edge);border-radius:8px;padding:8px 10px;font-family:ui-monospace,monospace;font-size:12px;color:var(--ink);word-break:break-all}
+  .secnote{color:var(--mut);font-size:12px;margin:4px 0 14px}
+  .pill2{display:inline-flex;align-items:center;gap:6px;background:var(--panel2);border:1px solid var(--edge);border-radius:999px;padding:5px 12px;font-size:12px;color:var(--ink);margin-right:8px}
+  .pill2.on{color:var(--ok);border-color:var(--ok)}
 </style></head>
 <body>
 <header>
@@ -117,6 +125,7 @@ export function webuiHtml(version) {
     <button onclick="feat('connectivity')">Connectivity</button>
     <button onclick="feat('doctor')">Doctor</button>
     <button onclick="feat('models')">Models</button>
+    <button onclick="openSecurity()">&#128274; Security</button>
     <button class="ghost" onclick="togglePreview()">Preview</button>
   </div>
 </header>
@@ -165,6 +174,15 @@ export function webuiHtml(version) {
   </div>
   <div class="grid" id="featureGrid"><div class="empty">loading…</div></div>
 </div>
+<div class="overlay" id="security">
+  <div class="rhead" style="padding:14px 16px">
+    <button class="ghost" onclick="closeSecurity()">&#8592; Back to home</button>
+    <b style="margin-left:12px">Security rules</b>
+    <span class="grow"></span>
+    <span class="e-mut" style="font-size:12px">enforced at the code level — same rules the terminal ('maq security') shows and enforces</span>
+  </div>
+  <div id="securityBody" style="overflow:auto;padding:16px"><div class="empty">loading…</div></div>
+</div>
 <script>
 "use strict";
 var base = location.origin;
@@ -353,6 +371,55 @@ async function openFeatures(){
   }catch(e){ grid.innerHTML='<div class="empty">'+e+'</div>'; }
 }
 function closeFeatures(){ document.getElementById('features').classList.remove('show'); }
+
+async function openSecurity(){
+  document.getElementById('security').classList.add('show');
+  var box=document.getElementById('securityBody'); box.innerHTML='loading…';
+  try{
+    var d=await (await api('/v1/security')).json();
+    var r=d.rules, evs=(d.events||[]);
+    var html='';
+    html+='<div style="margin-bottom:14px">';
+    html+='<span class="pill2 on">permission posture: '+r.permissionMode+'</span>';
+    html+='<span class="pill2 on">secret env scrubbing: on</span>';
+    html+='<span class="pill2 on">prompt-injection scanning: on</span>';
+    html+='</div>';
+
+    html+=sec('Protected paths (never writable — cannot be overridden by config)', r.protectedPaths.length);
+    html+='<div class="seclist">'+r.protectedPaths.map(function(p){return '<div class="secitem">'+esc(p)+'</div>';}).join('')+'</div>';
+    html+='<div class="secnote">Enforced in sandbox.ts checkWrite(), unconditionally, before any tier logic — a compromised agent cannot argue past this with a clever prompt.</div>';
+
+    html+=sec('Protected file patterns (matched by name, anywhere in the project)', r.protectedNamePatterns.length);
+    html+='<div class="seclist">'+r.protectedNamePatterns.map(function(p){return '<div class="secitem">'+esc(p)+'</div>';}).join('')+'</div>';
+
+    if(r.extraProtectedPaths && r.extraProtectedPaths.length){
+      html+=sec('Project-added protected paths', r.extraProtectedPaths.length);
+      html+='<div class="seclist">'+r.extraProtectedPaths.map(function(p){return '<div class="secitem">'+esc(p)+'</div>';}).join('')+'</div>';
+    }
+
+    html+=sec('Network egress allowlist (default-deny everything else)', r.netAllowlist.length);
+    html+='<div class="seclist">'+r.netAllowlist.map(function(p){return '<div class="secitem">'+esc(p)+'</div>';}).join('')+'</div>';
+    html+='<div class="secnote">Enforced in tools.ts http_get and available to any outbound call site via security.ts checkEgress(). Not just a suggestion in a prompt.</div>';
+
+    html+=sec('Prompt-injection scanning', r.promptInjectionScanning.length);
+    html+='<div class="seclist">'+r.promptInjectionScanning.map(function(p){return '<div class="secitem">'+esc(p)+'</div>';}).join('')+'</div>';
+    html+='<div class="secnote">README, manifest, git commits, AGENTS.md and skill files are scanned for override/exfiltration/jailbreak patterns before they reach a model. Findings are surfaced loudly, never silently dropped.</div>';
+
+    html+=sec('Recent findings (this session)', evs.length);
+    if(!evs.length){ html+='<div class="secnote">None recorded yet — findings appear here as tasks run.</div>'; }
+    else {
+      html+='<div>'+evs.slice().reverse().map(function(e){
+        var cls=e.severity==='high'?'e-red':'e-warn';
+        return '<div class="ev"><span class="ic '+cls+'">&#9888;</span><span class="tx '+cls+'">'+esc(e.kind)+': '+esc(e.detail)+'</span></div>';
+      }).join('')+'</div>';
+    }
+  }catch(e){ box.innerHTML='<div class="empty">'+e+'</div>'; return; }
+  box.innerHTML = html;
+}
+function sec(title,count){ return '<div class="sechead"><b>'+title+'</b><span class="n">'+count+'</span></div>'; }
+function esc(s){ var d=document.createElement('div'); d.textContent=String(s); return d.innerHTML; }
+function closeSecurity(){ document.getElementById('security').classList.remove('show'); }
+
 function runFeature(c){
   closeFeatures();
   if(c.needsInput==='task'||c.needsInput==='query'){

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maqcli",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "MAQ master orchestrator — a token-efficient, agent-agnostic supervisor CLI that sits on top of any worker CLI (AI or not) via a Scout -> Plan -> Execute -> Verify pipeline.",
   "type": "module",
   "bin": {