@node9/proxy 1.58.1 → 1.58.3

package/dist/cli.js

@@ -52950,7 +52950,25 @@ var import_chalk30 = __toESM(require("chalk"));
 // src/ci-check/fetch.ts
 var import_fs59 = __toESM(require("fs"));
 var import_path56 = __toESM(require("path"));
+var import_node_child_process = require("child_process");
 var import_undici = __toESM(require_undici());
+var cachedGhToken;
+function resolveGitHubToken() {
+  const env = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (env) return env;
+  if (cachedGhToken === void 0) {
+    try {
+      cachedGhToken = (0, import_node_child_process.execFileSync)("gh", ["auth", "token"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3e3
+      }).trim() || null;
+    } catch {
+      cachedGhToken = null;
+    }
+  }
+  return cachedGhToken ?? void 0;
+}
 var SURFACE_FILES = [
   ".claude/settings.json",
   ".claude/settings.local.json",
@@ -52996,7 +53014,7 @@ function ghHeaders() {
     "User-Agent": "node9-scan-repo",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const tok = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const tok = resolveGitHubToken();
   if (tok) h.Authorization = `Bearer ${tok}`;
   return h;
 }
@@ -53019,7 +53037,7 @@ async function ghGet(url) {
   }
   return { status: res.statusCode, json };
 }
-var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN.";
+var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN or run `gh auth login`.";
 var NETWORK_NOTE = "A network error/timeout occurred \u2014 results may be INCOMPLETE (some files were not fetched).";
 async function fetchOne(owner, repo, filePath, notes) {
   const url = `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`;
@@ -53109,8 +53127,20 @@ async function fetchTree(input, onProgress) {
 
 // src/ci-check/workflows.ts
 var import_yaml = require("yaml");
+
+// src/ci-check/types.ts
+var SEVERITY_RANK2 = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  advisory: 1
+};
+
+// src/ci-check/workflows.ts
 var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claude-code|openai\/codex|codex-action|run-?aider|aider-?action|google-github-actions\/run-gemini)/i;
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
+var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
+var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
 function str(v) {
   return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
 }
@@ -53135,11 +53165,12 @@ function isAgentStep(step) {
   return false;
 }
 function collectTools(steps) {
+  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + str(w["claude_args"]) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + str(w["settings"]);
+    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + stripDeny(str(w["settings"]));
   }
   return s;
 }
@@ -53177,12 +53208,22 @@ function hasActorGate(wf, raw) {
   const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function permsElevated(wf) {
+function hasImplicitActorGate(agentSteps, bypassActive) {
+  if (bypassActive) return false;
+  return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
+}
+function permsElevated(wf, agentJobs) {
   const check = (p) => {
     const s = str(p);
     return /["']?(contents|id-token|packages)["']?\s*:\s*["']?write/i.test(s);
   };
-  return check(wf.permissions) || Object.values(wf.jobs ?? {}).some((j) => check(j.permissions));
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
+}
+function hasGithubWritePerm(wf, agentJobs) {
+  const check = (p) => /["']?(contents|pull-requests|issues|packages|actions|deployments)["']?\s*:\s*["']?write/i.test(
+    str(p)
+  );
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
 }
 function usesPat(wf) {
   for (const { step } of allSteps(wf)) {
@@ -53216,6 +53257,11 @@ function analyzeWorkflow(path70, content) {
   const wf = raw;
   const steps = allSteps(wf).map((s) => s.step);
   const agentSteps = steps.filter(isAgentStep);
+  const agentJobs = [
+    ...new Set(
+      allSteps(wf).filter((s) => isAgentStep(s.step)).map((s) => s.job)
+    )
+  ];
   if (agentSteps.length === 0) return null;
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
@@ -53223,19 +53269,23 @@ function analyzeWorkflow(path70, content) {
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
+  const untrustedTrigger = secretExposed || forkInput;
+  const bypassActive = nonWriteStar && untrustedTrigger;
   const head = untrustedHeadCheckout(wf);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
   const reach = Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
-    nonWriteStar ? 2 : 0
+    bypassActive ? 2 : 0
   );
   const toolsBlob = collectTools(agentSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
-  const elevated = permsElevated(wf);
+  const elevated = permsElevated(wf, agentJobs);
   const pat = usesPat(wf);
-  const power = (broadTools ? 2 : 0) + (nonWriteStar ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const gate = hasActorGate(wf, raw);
+  const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
+  const explicitGate = hasActorGate(wf, raw);
+  const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
+  const gate = explicitGate || implicitGate;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -53245,7 +53295,14 @@ function analyzeWorkflow(path70, content) {
   score = Math.max(0, score);
   if (score === 0 && !secretExposed) return null;
   let severity = severityFromScore(score);
-  if (gate && reach > 0 && severity && severity !== "advisory") severity = "advisory";
+  if (gate && severity && severity !== "advisory") severity = "advisory";
+  if (reach === 0 && severity && severity !== "advisory") severity = "advisory";
+  if (!broadTools && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
+  const exfilOrRce = EXFIL_RCE_RE.test(toolsBlob);
+  const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
+  const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
+  if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53257,12 +53314,14 @@ function analyzeWorkflow(path70, content) {
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
   if (broadTools) signals.push("agent has broad/write-capable tools (Bash/Write/curl/git push)");
-  if (nonWriteStar) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
+  if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
   const mitigations = [];
-  if (gate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  if (explicitGate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  else if (implicitGate)
+    mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
   if (pinned) mitigations.push("agent action pinned to a commit SHA");
@@ -53389,14 +53448,6 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
-// src/ci-check/types.ts
-var SEVERITY_RANK2 = {
-  critical: 4,
-  high: 3,
-  medium: 2,
-  advisory: 1
-};
-
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;
@@ -53427,7 +53478,8 @@ function scanTree(tree) {
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings) };
+  const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
+  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -53454,9 +53506,15 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : import_chalk29.default.green("\u2705 agent-security: clean");
+  const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : res.incomplete ? import_chalk29.default.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : import_chalk29.default.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${import_chalk29.default.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(import_chalk29.default.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (res.incomplete)
+    L.push(
+      import_chalk29.default.yellow.bold(
+        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+      )
+    );
   L.push("");
   for (const f of res.findings) {
     L.push(
@@ -53468,7 +53526,7 @@ function renderScan(res) {
     L.push(import_chalk29.default.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
-  if (n === 0) {
+  if (n === 0 && !res.incomplete) {
     L.push(
       import_chalk29.default.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
@@ -53488,7 +53546,7 @@ function renderScan(res) {
 }
 function renderScanMarkdown(res) {
   const L = [];
-  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : "\u2705";
+  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
   L.push("");
   L.push(
@@ -53511,6 +53569,7 @@ function renderScanMarkdown(res) {
 function exitCodeFor(res) {
   if (res.worst === "critical" || res.worst === "high") return 2;
   if (res.worst === "medium") return 1;
+  if (res.incomplete) return 3;
   return 0;
 }
 

package/dist/cli.mjs

@@ -52944,6 +52944,24 @@ import chalk30 from "chalk";
 var import_undici = __toESM(require_undici());
 import fs60 from "fs";
 import path57 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+var cachedGhToken;
+function resolveGitHubToken() {
+  const env = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (env) return env;
+  if (cachedGhToken === void 0) {
+    try {
+      cachedGhToken = execFileSync2("gh", ["auth", "token"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3e3
+      }).trim() || null;
+    } catch {
+      cachedGhToken = null;
+    }
+  }
+  return cachedGhToken ?? void 0;
+}
 var SURFACE_FILES = [
   ".claude/settings.json",
   ".claude/settings.local.json",
@@ -52989,7 +53007,7 @@ function ghHeaders() {
     "User-Agent": "node9-scan-repo",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const tok = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const tok = resolveGitHubToken();
   if (tok) h.Authorization = `Bearer ${tok}`;
   return h;
 }
@@ -53012,7 +53030,7 @@ async function ghGet(url) {
   }
   return { status: res.statusCode, json };
 }
-var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN.";
+var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN or run `gh auth login`.";
 var NETWORK_NOTE = "A network error/timeout occurred \u2014 results may be INCOMPLETE (some files were not fetched).";
 async function fetchOne(owner, repo, filePath, notes) {
   const url = `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`;
@@ -53102,8 +53120,20 @@ async function fetchTree(input, onProgress) {
 
 // src/ci-check/workflows.ts
 import { parse as parseYaml } from "yaml";
+
+// src/ci-check/types.ts
+var SEVERITY_RANK2 = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  advisory: 1
+};
+
+// src/ci-check/workflows.ts
 var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claude-code|openai\/codex|codex-action|run-?aider|aider-?action|google-github-actions\/run-gemini)/i;
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
+var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
+var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
 function str(v) {
   return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
 }
@@ -53128,11 +53158,12 @@ function isAgentStep(step) {
   return false;
 }
 function collectTools(steps) {
+  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + str(w["claude_args"]) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + str(w["settings"]);
+    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + stripDeny(str(w["settings"]));
   }
   return s;
 }
@@ -53170,12 +53201,22 @@ function hasActorGate(wf, raw) {
   const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function permsElevated(wf) {
+function hasImplicitActorGate(agentSteps, bypassActive) {
+  if (bypassActive) return false;
+  return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
+}
+function permsElevated(wf, agentJobs) {
   const check = (p) => {
     const s = str(p);
     return /["']?(contents|id-token|packages)["']?\s*:\s*["']?write/i.test(s);
   };
-  return check(wf.permissions) || Object.values(wf.jobs ?? {}).some((j) => check(j.permissions));
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
+}
+function hasGithubWritePerm(wf, agentJobs) {
+  const check = (p) => /["']?(contents|pull-requests|issues|packages|actions|deployments)["']?\s*:\s*["']?write/i.test(
+    str(p)
+  );
+  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
 }
 function usesPat(wf) {
   for (const { step } of allSteps(wf)) {
@@ -53209,6 +53250,11 @@ function analyzeWorkflow(path70, content) {
   const wf = raw;
   const steps = allSteps(wf).map((s) => s.step);
   const agentSteps = steps.filter(isAgentStep);
+  const agentJobs = [
+    ...new Set(
+      allSteps(wf).filter((s) => isAgentStep(s.step)).map((s) => s.job)
+    )
+  ];
   if (agentSteps.length === 0) return null;
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
@@ -53216,19 +53262,23 @@ function analyzeWorkflow(path70, content) {
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
+  const untrustedTrigger = secretExposed || forkInput;
+  const bypassActive = nonWriteStar && untrustedTrigger;
   const head = untrustedHeadCheckout(wf);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
   const reach = Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
-    nonWriteStar ? 2 : 0
+    bypassActive ? 2 : 0
   );
   const toolsBlob = collectTools(agentSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
-  const elevated = permsElevated(wf);
+  const elevated = permsElevated(wf, agentJobs);
   const pat = usesPat(wf);
-  const power = (broadTools ? 2 : 0) + (nonWriteStar ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const gate = hasActorGate(wf, raw);
+  const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
+  const explicitGate = hasActorGate(wf, raw);
+  const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
+  const gate = explicitGate || implicitGate;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -53238,7 +53288,14 @@ function analyzeWorkflow(path70, content) {
   score = Math.max(0, score);
   if (score === 0 && !secretExposed) return null;
   let severity = severityFromScore(score);
-  if (gate && reach > 0 && severity && severity !== "advisory") severity = "advisory";
+  if (gate && severity && severity !== "advisory") severity = "advisory";
+  if (reach === 0 && severity && severity !== "advisory") severity = "advisory";
+  if (!broadTools && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
+  const exfilOrRce = EXFIL_RCE_RE.test(toolsBlob);
+  const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
+  const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
+  if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53250,12 +53307,14 @@ function analyzeWorkflow(path70, content) {
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
   if (broadTools) signals.push("agent has broad/write-capable tools (Bash/Write/curl/git push)");
-  if (nonWriteStar) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
+  if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
   const mitigations = [];
-  if (gate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  if (explicitGate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  else if (implicitGate)
+    mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
   if (pinned) mitigations.push("agent action pinned to a commit SHA");
@@ -53382,14 +53441,6 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
-// src/ci-check/types.ts
-var SEVERITY_RANK2 = {
-  critical: 4,
-  high: 3,
-  medium: 2,
-  advisory: 1
-};
-
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;
@@ -53420,7 +53471,8 @@ function scanTree(tree) {
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings) };
+  const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
+  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -53447,9 +53499,15 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : chalk29.green("\u2705 agent-security: clean");
+  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : res.incomplete ? chalk29.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk29.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk29.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk29.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (res.incomplete)
+    L.push(
+      chalk29.yellow.bold(
+        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+      )
+    );
   L.push("");
   for (const f of res.findings) {
     L.push(
@@ -53461,7 +53519,7 @@ function renderScan(res) {
     L.push(chalk29.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
-  if (n === 0) {
+  if (n === 0 && !res.incomplete) {
     L.push(
       chalk29.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
@@ -53481,7 +53539,7 @@ function renderScan(res) {
 }
 function renderScanMarkdown(res) {
   const L = [];
-  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : "\u2705";
+  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
   L.push("");
   L.push(
@@ -53504,6 +53562,7 @@ function renderScanMarkdown(res) {
 function exitCodeFor(res) {
   if (res.worst === "critical" || res.worst === "high") return 2;
   if (res.worst === "medium") return 1;
+  if (res.incomplete) return 3;
   return 0;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.1",
+  "version": "1.58.3",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",