@node9/proxy 1.58.3 → 1.58.5

package/dist/cli.js

@@ -53196,8 +53196,8 @@ function promptTakesUntrusted(steps) {
 }
 function hasActorGate(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
-  const prt = on?.["pull_request_target"];
-  const labeled = prt && Array.isArray(prt.types) && prt.types.map(String).includes("labeled");
+  const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
+  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
@@ -53266,6 +53266,9 @@ function analyzeWorkflow(path70, content) {
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
   const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
+  const privileged = triggers.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
+  );
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
@@ -53303,6 +53306,7 @@ function analyzeWorkflow(path70, content) {
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
   const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53310,6 +53314,10 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
+  if (untrustedTrigger && !privileged)
+    signals.push(
+      "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
+    );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
@@ -53335,7 +53343,7 @@ function analyzeWorkflow(path70, content) {
     file: path70,
     signals,
     mitigations: mitigations.length ? mitigations : void 0,
-    fix: head === "root" ? "Do not check out the PR head into the workspace root under pull_request_target \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
+    fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
 
@@ -53509,12 +53517,14 @@ function renderScan(res) {
   const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : res.incomplete ? import_chalk29.default.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : import_chalk29.default.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${import_chalk29.default.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(import_chalk29.default.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
-  if (res.incomplete)
+  if (res.incomplete) {
+    const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
       import_chalk29.default.yellow.bold(
-        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+        rateLimited ? "   \u26A0\uFE0F  Rate-limited \u2014 some files were unread. NOT a clean bill of health; set GITHUB_TOKEN (or run `gh auth login`) and re-run." : "   \u26A0\uFE0F  A network error left some files unread. NOT a clean bill of health; re-run."
       )
     );
+  }
   L.push("");
   for (const f of res.findings) {
     L.push(

package/dist/cli.mjs

@@ -53189,8 +53189,8 @@ function promptTakesUntrusted(steps) {
 }
 function hasActorGate(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
-  const prt = on?.["pull_request_target"];
-  const labeled = prt && Array.isArray(prt.types) && prt.types.map(String).includes("labeled");
+  const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
+  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
@@ -53259,6 +53259,9 @@ function analyzeWorkflow(path70, content) {
   const triggers = triggerKeys(wf, raw);
   const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
   const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
+  const privileged = triggers.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
+  );
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
@@ -53296,6 +53299,7 @@ function analyzeWorkflow(path70, content) {
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
   const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53303,6 +53307,10 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
+  if (untrustedTrigger && !privileged)
+    signals.push(
+      "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
+    );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
@@ -53328,7 +53336,7 @@ function analyzeWorkflow(path70, content) {
     file: path70,
     signals,
     mitigations: mitigations.length ? mitigations : void 0,
-    fix: head === "root" ? "Do not check out the PR head into the workspace root under pull_request_target \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
+    fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
 
@@ -53502,12 +53510,14 @@ function renderScan(res) {
   const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : res.incomplete ? chalk29.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk29.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk29.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk29.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
-  if (res.incomplete)
+  if (res.incomplete) {
+    const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
       chalk29.yellow.bold(
-        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+        rateLimited ? "   \u26A0\uFE0F  Rate-limited \u2014 some files were unread. NOT a clean bill of health; set GITHUB_TOKEN (or run `gh auth login`) and re-run." : "   \u26A0\uFE0F  A network error left some files unread. NOT a clean bill of health; re-run."
       )
     );
+  }
   L.push("");
   for (const f of res.findings) {
     L.push(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.3",
+  "version": "1.58.5",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",