@node9/proxy 1.58.2 → 1.58.3

package/dist/cli.js

@@ -52950,7 +52950,25 @@ var import_chalk30 = __toESM(require("chalk"));
 // src/ci-check/fetch.ts
 var import_fs59 = __toESM(require("fs"));
 var import_path56 = __toESM(require("path"));
+var import_node_child_process = require("child_process");
 var import_undici = __toESM(require_undici());
+var cachedGhToken;
+function resolveGitHubToken() {
+  const env = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (env) return env;
+  if (cachedGhToken === void 0) {
+    try {
+      cachedGhToken = (0, import_node_child_process.execFileSync)("gh", ["auth", "token"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3e3
+      }).trim() || null;
+    } catch {
+      cachedGhToken = null;
+    }
+  }
+  return cachedGhToken ?? void 0;
+}
 var SURFACE_FILES = [
   ".claude/settings.json",
   ".claude/settings.local.json",
@@ -52996,7 +53014,7 @@ function ghHeaders() {
     "User-Agent": "node9-scan-repo",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const tok = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const tok = resolveGitHubToken();
   if (tok) h.Authorization = `Bearer ${tok}`;
   return h;
 }
@@ -53019,7 +53037,7 @@ async function ghGet(url) {
   }
   return { status: res.statusCode, json };
 }
-var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN.";
+var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN or run `gh auth login`.";
 var NETWORK_NOTE = "A network error/timeout occurred \u2014 results may be INCOMPLETE (some files were not fetched).";
 async function fetchOne(owner, repo, filePath, notes) {
   const url = `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`;
@@ -53460,7 +53478,8 @@ function scanTree(tree) {
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings) };
+  const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
+  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -53487,9 +53506,15 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : import_chalk29.default.green("\u2705 agent-security: clean");
+  const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : res.incomplete ? import_chalk29.default.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : import_chalk29.default.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${import_chalk29.default.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(import_chalk29.default.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (res.incomplete)
+    L.push(
+      import_chalk29.default.yellow.bold(
+        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+      )
+    );
   L.push("");
   for (const f of res.findings) {
     L.push(
@@ -53501,7 +53526,7 @@ function renderScan(res) {
     L.push(import_chalk29.default.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
-  if (n === 0) {
+  if (n === 0 && !res.incomplete) {
     L.push(
       import_chalk29.default.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
@@ -53521,7 +53546,7 @@ function renderScan(res) {
 }
 function renderScanMarkdown(res) {
   const L = [];
-  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : "\u2705";
+  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
   L.push("");
   L.push(
@@ -53544,6 +53569,7 @@ function renderScanMarkdown(res) {
 function exitCodeFor(res) {
   if (res.worst === "critical" || res.worst === "high") return 2;
   if (res.worst === "medium") return 1;
+  if (res.incomplete) return 3;
   return 0;
 }
 

package/dist/cli.mjs

@@ -52944,6 +52944,24 @@ import chalk30 from "chalk";
 var import_undici = __toESM(require_undici());
 import fs60 from "fs";
 import path57 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+var cachedGhToken;
+function resolveGitHubToken() {
+  const env = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (env) return env;
+  if (cachedGhToken === void 0) {
+    try {
+      cachedGhToken = execFileSync2("gh", ["auth", "token"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3e3
+      }).trim() || null;
+    } catch {
+      cachedGhToken = null;
+    }
+  }
+  return cachedGhToken ?? void 0;
+}
 var SURFACE_FILES = [
   ".claude/settings.json",
   ".claude/settings.local.json",
@@ -52989,7 +53007,7 @@ function ghHeaders() {
     "User-Agent": "node9-scan-repo",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const tok = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const tok = resolveGitHubToken();
   if (tok) h.Authorization = `Bearer ${tok}`;
   return h;
 }
@@ -53012,7 +53030,7 @@ async function ghGet(url) {
   }
   return { status: res.statusCode, json };
 }
-var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN.";
+var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN or run `gh auth login`.";
 var NETWORK_NOTE = "A network error/timeout occurred \u2014 results may be INCOMPLETE (some files were not fetched).";
 async function fetchOne(owner, repo, filePath, notes) {
   const url = `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`;
@@ -53453,7 +53471,8 @@ function scanTree(tree) {
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings) };
+  const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
+  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -53480,9 +53499,15 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : chalk29.green("\u2705 agent-security: clean");
+  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : res.incomplete ? chalk29.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk29.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk29.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk29.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (res.incomplete)
+    L.push(
+      chalk29.yellow.bold(
+        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+      )
+    );
   L.push("");
   for (const f of res.findings) {
     L.push(
@@ -53494,7 +53519,7 @@ function renderScan(res) {
     L.push(chalk29.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
-  if (n === 0) {
+  if (n === 0 && !res.incomplete) {
     L.push(
       chalk29.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
@@ -53514,7 +53539,7 @@ function renderScan(res) {
 }
 function renderScanMarkdown(res) {
   const L = [];
-  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : "\u2705";
+  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
   L.push("");
   L.push(
@@ -53537,6 +53562,7 @@ function renderScanMarkdown(res) {
 function exitCodeFor(res) {
   if (res.worst === "critical" || res.worst === "high") return 2;
   if (res.worst === "medium") return 1;
+  if (res.incomplete) return 3;
   return 0;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.2",
+  "version": "1.58.3",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",