@node9/proxy 1.58.1 → 1.58.2

package/dist/cli.js

@@ -53109,8 +53109,20 @@ async function fetchTree(input, onProgress) {
 
 // src/ci-check/workflows.ts
 var import_yaml = require("yaml");
+
+// src/ci-check/types.ts
+var SEVERITY_RANK2 = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  advisory: 1
+};
+
+// src/ci-check/workflows.ts
 var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claude-code|openai\/codex|codex-action|run-?aider|aider-?action|google-github-actions\/run-gemini)/i;
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
+var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
+var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
 function str(v) {
   return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
 }
@@ -53135,11 +53147,12 @@ function isAgentStep(step) {
   return false;
 }
 function collectTools(steps) {
+  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + str(w["claude_args"]) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + str(w["settings"]);
+    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + stripDeny(str(w["settings"]));
   }
   return s;
 }
@@ -53177,12 +53190,22 @@ function hasActorGate(wf, raw) {
   const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function permsElevated(wf) {
+function hasImplicitActorGate(agentSteps, bypassActive) {
+  if (bypassActive) return false;
+  return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
+}
+function permsElevated(wf, agentJobs) {
   const check = (p) => {
     const s = str(p);
     return /["']?(contents|id-token|packages)["']?\s*:\s*["']?write/i.test(s);
   };
-  return check(wf.permissions) || Object.values(wf.jobs ?? {}).some((j) => check(j.permissions));
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
+}
+function hasGithubWritePerm(wf, agentJobs) {
+  const check = (p) => /["']?(contents|pull-requests|issues|packages|actions|deployments)["']?\s*:\s*["']?write/i.test(
+    str(p)
+  );
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
 }
 function usesPat(wf) {
   for (const { step } of allSteps(wf)) {
@@ -53216,6 +53239,11 @@ function analyzeWorkflow(path70, content) {
   const wf = raw;
   const steps = allSteps(wf).map((s) => s.step);
   const agentSteps = steps.filter(isAgentStep);
+  const agentJobs = [
+    ...new Set(
+      allSteps(wf).filter((s) => isAgentStep(s.step)).map((s) => s.job)
+    )
+  ];
   if (agentSteps.length === 0) return null;
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
@@ -53223,19 +53251,23 @@ function analyzeWorkflow(path70, content) {
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
+  const untrustedTrigger = secretExposed || forkInput;
+  const bypassActive = nonWriteStar && untrustedTrigger;
   const head = untrustedHeadCheckout(wf);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
   const reach = Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
-    nonWriteStar ? 2 : 0
+    bypassActive ? 2 : 0
   );
   const toolsBlob = collectTools(agentSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
-  const elevated = permsElevated(wf);
+  const elevated = permsElevated(wf, agentJobs);
   const pat = usesPat(wf);
-  const power = (broadTools ? 2 : 0) + (nonWriteStar ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const gate = hasActorGate(wf, raw);
+  const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
+  const explicitGate = hasActorGate(wf, raw);
+  const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
+  const gate = explicitGate || implicitGate;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -53245,7 +53277,14 @@ function analyzeWorkflow(path70, content) {
   score = Math.max(0, score);
   if (score === 0 && !secretExposed) return null;
   let severity = severityFromScore(score);
-  if (gate && reach > 0 && severity && severity !== "advisory") severity = "advisory";
+  if (gate && severity && severity !== "advisory") severity = "advisory";
+  if (reach === 0 && severity && severity !== "advisory") severity = "advisory";
+  if (!broadTools && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
+  const exfilOrRce = EXFIL_RCE_RE.test(toolsBlob);
+  const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
+  const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
+  if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53257,12 +53296,14 @@ function analyzeWorkflow(path70, content) {
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
   if (broadTools) signals.push("agent has broad/write-capable tools (Bash/Write/curl/git push)");
-  if (nonWriteStar) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
+  if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
   const mitigations = [];
-  if (gate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  if (explicitGate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  else if (implicitGate)
+    mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
   if (pinned) mitigations.push("agent action pinned to a commit SHA");
@@ -53389,14 +53430,6 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
-// src/ci-check/types.ts
-var SEVERITY_RANK2 = {
-  critical: 4,
-  high: 3,
-  medium: 2,
-  advisory: 1
-};
-
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;

package/dist/cli.mjs

@@ -53102,8 +53102,20 @@ async function fetchTree(input, onProgress) {
 
 // src/ci-check/workflows.ts
 import { parse as parseYaml } from "yaml";
+
+// src/ci-check/types.ts
+var SEVERITY_RANK2 = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  advisory: 1
+};
+
+// src/ci-check/workflows.ts
 var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claude-code|openai\/codex|codex-action|run-?aider|aider-?action|google-github-actions\/run-gemini)/i;
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
+var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
+var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
 function str(v) {
   return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
 }
@@ -53128,11 +53140,12 @@ function isAgentStep(step) {
   return false;
 }
 function collectTools(steps) {
+  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + str(w["claude_args"]) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + str(w["settings"]);
+    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + stripDeny(str(w["settings"]));
   }
   return s;
 }
@@ -53170,12 +53183,22 @@ function hasActorGate(wf, raw) {
   const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function permsElevated(wf) {
+function hasImplicitActorGate(agentSteps, bypassActive) {
+  if (bypassActive) return false;
+  return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
+}
+function permsElevated(wf, agentJobs) {
   const check = (p) => {
     const s = str(p);
     return /["']?(contents|id-token|packages)["']?\s*:\s*["']?write/i.test(s);
   };
-  return check(wf.permissions) || Object.values(wf.jobs ?? {}).some((j) => check(j.permissions));
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
+}
+function hasGithubWritePerm(wf, agentJobs) {
+  const check = (p) => /["']?(contents|pull-requests|issues|packages|actions|deployments)["']?\s*:\s*["']?write/i.test(
+    str(p)
+  );
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
 }
 function usesPat(wf) {
   for (const { step } of allSteps(wf)) {
@@ -53209,6 +53232,11 @@ function analyzeWorkflow(path70, content) {
   const wf = raw;
   const steps = allSteps(wf).map((s) => s.step);
   const agentSteps = steps.filter(isAgentStep);
+  const agentJobs = [
+    ...new Set(
+      allSteps(wf).filter((s) => isAgentStep(s.step)).map((s) => s.job)
+    )
+  ];
   if (agentSteps.length === 0) return null;
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
@@ -53216,19 +53244,23 @@ function analyzeWorkflow(path70, content) {
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
+  const untrustedTrigger = secretExposed || forkInput;
+  const bypassActive = nonWriteStar && untrustedTrigger;
   const head = untrustedHeadCheckout(wf);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
   const reach = Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
-    nonWriteStar ? 2 : 0
+    bypassActive ? 2 : 0
   );
   const toolsBlob = collectTools(agentSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
-  const elevated = permsElevated(wf);
+  const elevated = permsElevated(wf, agentJobs);
   const pat = usesPat(wf);
-  const power = (broadTools ? 2 : 0) + (nonWriteStar ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const gate = hasActorGate(wf, raw);
+  const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
+  const explicitGate = hasActorGate(wf, raw);
+  const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
+  const gate = explicitGate || implicitGate;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -53238,7 +53270,14 @@ function analyzeWorkflow(path70, content) {
   score = Math.max(0, score);
   if (score === 0 && !secretExposed) return null;
   let severity = severityFromScore(score);
-  if (gate && reach > 0 && severity && severity !== "advisory") severity = "advisory";
+  if (gate && severity && severity !== "advisory") severity = "advisory";
+  if (reach === 0 && severity && severity !== "advisory") severity = "advisory";
+  if (!broadTools && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
+  const exfilOrRce = EXFIL_RCE_RE.test(toolsBlob);
+  const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
+  const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
+  if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53250,12 +53289,14 @@ function analyzeWorkflow(path70, content) {
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
   if (broadTools) signals.push("agent has broad/write-capable tools (Bash/Write/curl/git push)");
-  if (nonWriteStar) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
+  if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
   const mitigations = [];
-  if (gate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  if (explicitGate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  else if (implicitGate)
+    mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
   if (pinned) mitigations.push("agent action pinned to a commit SHA");
@@ -53382,14 +53423,6 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
-// src/ci-check/types.ts
-var SEVERITY_RANK2 = {
-  critical: 4,
-  high: 3,
-  medium: 2,
-  advisory: 1
-};
-
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.1",
+  "version": "1.58.2",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",