@node9/proxy 1.58.3 → 1.58.4

package/dist/cli.js

@@ -53196,8 +53196,8 @@ function promptTakesUntrusted(steps) {
 }
 function hasActorGate(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
-  const prt = on?.["pull_request_target"];
-  const labeled = prt && Array.isArray(prt.types) && prt.types.map(String).includes("labeled");
+  const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
+  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
@@ -53266,6 +53266,9 @@ function analyzeWorkflow(path70, content) {
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
   const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
+  const privileged = triggers.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
+  );
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
@@ -53303,6 +53306,7 @@ function analyzeWorkflow(path70, content) {
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
   const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53310,6 +53314,10 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
+  if (untrustedTrigger && !privileged)
+    signals.push(
+      "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
+    );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");

package/dist/cli.mjs

@@ -53189,8 +53189,8 @@ function promptTakesUntrusted(steps) {
 }
 function hasActorGate(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
-  const prt = on?.["pull_request_target"];
-  const labeled = prt && Array.isArray(prt.types) && prt.types.map(String).includes("labeled");
+  const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
+  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
@@ -53259,6 +53259,9 @@ function analyzeWorkflow(path70, content) {
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
   const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
+  const privileged = triggers.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
+  );
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
@@ -53296,6 +53299,7 @@ function analyzeWorkflow(path70, content) {
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
   const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53303,6 +53307,10 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
+  if (untrustedTrigger && !privileged)
+    signals.push(
+      "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
+    );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.3",
+  "version": "1.58.4",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",