@node9/proxy 1.58.2 → 1.58.4

package/dist/cli.js

@@ -52950,7 +52950,25 @@ var import_chalk30 = __toESM(require("chalk"));
 // src/ci-check/fetch.ts
 var import_fs59 = __toESM(require("fs"));
 var import_path56 = __toESM(require("path"));
+var import_node_child_process = require("child_process");
 var import_undici = __toESM(require_undici());
+var cachedGhToken;
+function resolveGitHubToken() {
+  const env = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (env) return env;
+  if (cachedGhToken === void 0) {
+    try {
+      cachedGhToken = (0, import_node_child_process.execFileSync)("gh", ["auth", "token"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3e3
+      }).trim() || null;
+    } catch {
+      cachedGhToken = null;
+    }
+  }
+  return cachedGhToken ?? void 0;
+}
 var SURFACE_FILES = [
   ".claude/settings.json",
   ".claude/settings.local.json",
@@ -52996,7 +53014,7 @@ function ghHeaders() {
     "User-Agent": "node9-scan-repo",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const tok = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const tok = resolveGitHubToken();
   if (tok) h.Authorization = `Bearer ${tok}`;
   return h;
 }
@@ -53019,7 +53037,7 @@ async function ghGet(url) {
   }
   return { status: res.statusCode, json };
 }
-var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN.";
+var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN or run `gh auth login`.";
 var NETWORK_NOTE = "A network error/timeout occurred \u2014 results may be INCOMPLETE (some files were not fetched).";
 async function fetchOne(owner, repo, filePath, notes) {
   const url = `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`;
@@ -53178,8 +53196,8 @@ function promptTakesUntrusted(steps) {
 }
 function hasActorGate(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
-  const prt = on?.["pull_request_target"];
-  const labeled = prt && Array.isArray(prt.types) && prt.types.map(String).includes("labeled");
+  const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
+  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
@@ -53248,6 +53266,9 @@ function analyzeWorkflow(path70, content) {
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
   const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
+  const privileged = triggers.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
+  );
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
@@ -53285,6 +53306,7 @@ function analyzeWorkflow(path70, content) {
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
   const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53292,6 +53314,10 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
+  if (untrustedTrigger && !privileged)
+    signals.push(
+      "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
+    );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
@@ -53460,7 +53486,8 @@ function scanTree(tree) {
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings) };
+  const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
+  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -53487,9 +53514,15 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : import_chalk29.default.green("\u2705 agent-security: clean");
+  const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : res.incomplete ? import_chalk29.default.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : import_chalk29.default.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${import_chalk29.default.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(import_chalk29.default.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (res.incomplete)
+    L.push(
+      import_chalk29.default.yellow.bold(
+        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+      )
+    );
   L.push("");
   for (const f of res.findings) {
     L.push(
@@ -53501,7 +53534,7 @@ function renderScan(res) {
     L.push(import_chalk29.default.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
-  if (n === 0) {
+  if (n === 0 && !res.incomplete) {
     L.push(
       import_chalk29.default.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
@@ -53521,7 +53554,7 @@ function renderScan(res) {
 }
 function renderScanMarkdown(res) {
   const L = [];
-  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : "\u2705";
+  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
   L.push("");
   L.push(
@@ -53544,6 +53577,7 @@ function renderScanMarkdown(res) {
 function exitCodeFor(res) {
   if (res.worst === "critical" || res.worst === "high") return 2;
   if (res.worst === "medium") return 1;
+  if (res.incomplete) return 3;
   return 0;
 }
 

package/dist/cli.mjs

@@ -52944,6 +52944,24 @@ import chalk30 from "chalk";
 var import_undici = __toESM(require_undici());
 import fs60 from "fs";
 import path57 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+var cachedGhToken;
+function resolveGitHubToken() {
+  const env = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (env) return env;
+  if (cachedGhToken === void 0) {
+    try {
+      cachedGhToken = execFileSync2("gh", ["auth", "token"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3e3
+      }).trim() || null;
+    } catch {
+      cachedGhToken = null;
+    }
+  }
+  return cachedGhToken ?? void 0;
+}
 var SURFACE_FILES = [
   ".claude/settings.json",
   ".claude/settings.local.json",
@@ -52989,7 +53007,7 @@ function ghHeaders() {
     "User-Agent": "node9-scan-repo",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const tok = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const tok = resolveGitHubToken();
   if (tok) h.Authorization = `Bearer ${tok}`;
   return h;
 }
@@ -53012,7 +53030,7 @@ async function ghGet(url) {
   }
   return { status: res.statusCode, json };
 }
-var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN.";
+var RATE_LIMIT_NOTE = "GitHub rate limit hit \u2014 results may be INCOMPLETE (a missing file could be unread, not absent). Set GITHUB_TOKEN or run `gh auth login`.";
 var NETWORK_NOTE = "A network error/timeout occurred \u2014 results may be INCOMPLETE (some files were not fetched).";
 async function fetchOne(owner, repo, filePath, notes) {
   const url = `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`;
@@ -53171,8 +53189,8 @@ function promptTakesUntrusted(steps) {
 }
 function hasActorGate(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
-  const prt = on?.["pull_request_target"];
-  const labeled = prt && Array.isArray(prt.types) && prt.types.map(String).includes("labeled");
+  const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
+  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
@@ -53241,6 +53259,9 @@ function analyzeWorkflow(path70, content) {
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
   const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
+  const privileged = triggers.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
+  );
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
@@ -53278,6 +53299,7 @@ function analyzeWorkflow(path70, content) {
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
   const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53285,6 +53307,10 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
+  if (untrustedTrigger && !privileged)
+    signals.push(
+      "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
+    );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
@@ -53453,7 +53479,8 @@ function scanTree(tree) {
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings) };
+  const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
+  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -53480,9 +53507,15 @@ function ownedHint(source) {
 function renderScan(res) {
   const L = [];
   const n = res.findings.length;
-  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : chalk29.green("\u2705 agent-security: clean");
+  const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : res.incomplete ? chalk29.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk29.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk29.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk29.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (res.incomplete)
+    L.push(
+      chalk29.yellow.bold(
+        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+      )
+    );
   L.push("");
   for (const f of res.findings) {
     L.push(
@@ -53494,7 +53527,7 @@ function renderScan(res) {
     L.push(chalk29.cyan(`     \u2192 ${f.fix}`));
     L.push("");
   }
-  if (n === 0) {
+  if (n === 0 && !res.incomplete) {
     L.push(
       chalk29.gray("   No committed agent hooks, injectable workflows, or unpinned MCP servers.")
     );
@@ -53514,7 +53547,7 @@ function renderScan(res) {
 }
 function renderScanMarkdown(res) {
   const L = [];
-  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : "\u2705";
+  const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
   L.push("");
   L.push(
@@ -53537,6 +53570,7 @@ function renderScanMarkdown(res) {
 function exitCodeFor(res) {
   if (res.worst === "critical" || res.worst === "high") return 2;
   if (res.worst === "medium") return 1;
+  if (res.incomplete) return 3;
   return 0;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.2",
+  "version": "1.58.4",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",