@node9/proxy 1.58.4 → 1.58.5

package/dist/cli.js

@@ -53343,7 +53343,7 @@ function analyzeWorkflow(path70, content) {
     file: path70,
     signals,
     mitigations: mitigations.length ? mitigations : void 0,
-    fix: head === "root" ? "Do not check out the PR head into the workspace root under pull_request_target \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
+    fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
 
@@ -53517,12 +53517,14 @@ function renderScan(res) {
   const head = res.worst === "critical" || res.worst === "high" ? import_chalk29.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk29.default.yellow("agent-security notes") : res.incomplete ? import_chalk29.default.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : import_chalk29.default.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${import_chalk29.default.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(import_chalk29.default.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
-  if (res.incomplete)
+  if (res.incomplete) {
+    const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
       import_chalk29.default.yellow.bold(
-        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+        rateLimited ? "   \u26A0\uFE0F  Rate-limited \u2014 some files were unread. NOT a clean bill of health; set GITHUB_TOKEN (or run `gh auth login`) and re-run." : "   \u26A0\uFE0F  A network error left some files unread. NOT a clean bill of health; re-run."
       )
     );
+  }
   L.push("");
   for (const f of res.findings) {
     L.push(

package/dist/cli.mjs

@@ -53336,7 +53336,7 @@ function analyzeWorkflow(path70, content) {
     file: path70,
     signals,
     mitigations: mitigations.length ? mitigations : void 0,
-    fix: head === "root" ? "Do not check out the PR head into the workspace root under pull_request_target \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
+    fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
 
@@ -53510,12 +53510,14 @@ function renderScan(res) {
   const head = res.worst === "critical" || res.worst === "high" ? chalk29.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk29.yellow("agent-security notes") : res.incomplete ? chalk29.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk29.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk29.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk29.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
-  if (res.incomplete)
+  if (res.incomplete) {
+    const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
       chalk29.yellow.bold(
-        "   \u26A0\uFE0F  This scan was rate-limited and is NOT a clean bill of health \u2014 set GITHUB_TOKEN and re-run."
+        rateLimited ? "   \u26A0\uFE0F  Rate-limited \u2014 some files were unread. NOT a clean bill of health; set GITHUB_TOKEN (or run `gh auth login`) and re-run." : "   \u26A0\uFE0F  A network error left some files unread. NOT a clean bill of health; re-run."
       )
     );
+  }
   L.push("");
   for (const f of res.findings) {
     L.push(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.4",
+  "version": "1.58.5",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",