@node9/proxy 1.58.5 → 1.60.0

package/dist/cli.js

@@ -52974,9 +52974,39 @@ var SURFACE_FILES = [
   ".claude/settings.local.json",
   ".mcp.json",
   ".cursor/mcp.json",
-  ".codex/config.toml"
+  ".codex/config.toml",
+  // CI-6: agent instruction files (auto-loaded into the agent's system prompt).
+  "CLAUDE.md",
+  "AGENTS.md",
+  "GEMINI.md",
+  ".cursorrules",
+  ".github/copilot-instructions.md",
+  ".windsurfrules",
+  ".clinerules"
 ];
 var WORKFLOW_DIR = ".github/workflows";
+var SURFACE_BASENAME = /(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|(^|\/)\.(windsurf|cline)rules$|(^|\/)copilot-instructions\.md$|(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.mcp\.json$|(^|\/)\.cursor\/mcp\.json$|(^|\/)\.codex\/config\.toml$/;
+var IGNORE_HARD = /(^|\/)(node_modules|vendor|\.git|\.next|\.venv|site-packages)\//;
+var IGNORE_SOFT = /(^|\/)(dist|build|out|target)\//;
+var isIgnoredDir = (relSlash) => IGNORE_HARD.test(relSlash) || IGNORE_SOFT.test(relSlash);
+var MAX_SURFACE_FILES = 200;
+function pickSurfacePaths(paths, truncated, notes) {
+  const surface = paths.filter((p) => SURFACE_BASENAME.test(p) && !IGNORE_HARD.test(p));
+  const matched = surface.filter((p) => !IGNORE_SOFT.test(p));
+  const softSkipped = surface.filter((p) => IGNORE_SOFT.test(p));
+  const capped = matched.slice(0, MAX_SURFACE_FILES);
+  if (truncated || matched.length > MAX_SURFACE_FILES) {
+    notes.push(
+      `repo tree is large/truncated \u2014 some agent-surface files may be INCOMPLETE (scanned ${capped.length} of ${matched.length}${truncated ? "+" : ""}).`
+    );
+  }
+  if (softSkipped.length) {
+    notes.push(
+      `skipped ${softSkipped.length} agent-surface file(s) under a build-output dir (dist/build/out/target), e.g. ${softSkipped.slice(0, 3).join(", ")} \u2014 if any is a real committed config, move it out of the build dir to have it scanned.`
+    );
+  }
+  return capped;
+}
 async function pooled(items, limit, fn) {
   const out = new Array(items.length);
   let next = 0;
@@ -53068,13 +53098,37 @@ async function listWorkflowPaths(owner, repo, notes) {
   if (status !== 200 || !Array.isArray(json)) return [];
   return json.filter((e) => e.type === "file" && /\.ya?ml$/.test(e.name)).map((e) => e.path);
 }
+var ROOT_WORKFLOW_RE = /^\.github\/workflows\/[^/]+\.ya?ml$/;
+async function listSurfaceTree(owner, repo, notes) {
+  const url = `https://api.github.com/repos/${owner}/${repo}/git/trees/HEAD?recursive=1`;
+  const { status, json } = await ghGet(url);
+  if (status === 403 || status === 429) {
+    if (!notes.includes(RATE_LIMIT_NOTE)) notes.push(RATE_LIMIT_NOTE);
+    return null;
+  }
+  if (status === 0) {
+    if (!notes.includes(NETWORK_NOTE)) notes.push(NETWORK_NOTE);
+    return null;
+  }
+  if (status !== 200 || !json || typeof json !== "object") return null;
+  const tree = json;
+  if (!Array.isArray(tree.tree)) return null;
+  const blobs = tree.tree.filter((e) => e.type === "blob" && typeof e.path === "string").map((e) => e.path);
+  return {
+    surface: pickSurfacePaths(blobs, !!tree.truncated, notes),
+    workflows: blobs.filter((p) => ROOT_WORKFLOW_RE.test(p))
+  };
+}
 var FETCH_CONCURRENCY = 8;
 async function fetchGitHubTree(owner, repo, onProgress) {
   const notes = [];
   try {
-    onProgress?.({ phase: "listing workflows", done: 0, total: 1 });
-    const workflowPaths = await listWorkflowPaths(owner, repo, notes);
-    const allPaths = [...SURFACE_FILES, ...workflowPaths];
+    onProgress?.({ phase: "discovering agent surface", done: 0, total: 1 });
+    const discovered = await listSurfaceTree(owner, repo, notes);
+    const workflowPaths = discovered ? discovered.workflows : await listWorkflowPaths(owner, repo, notes);
+    const allPaths = [
+      .../* @__PURE__ */ new Set([...SURFACE_FILES, ...discovered?.surface ?? [], ...workflowPaths])
+    ];
     let done = 0;
     const fetched = await pooled(allPaths, FETCH_CONCURRENCY, async (p) => {
       const f = await fetchOne(owner, repo, p, notes);
@@ -53083,7 +53137,9 @@ async function fetchGitHubTree(owner, repo, onProgress) {
     });
     return { source: `${owner}/${repo}`, files: fetched.filter((f) => !!f), notes };
   } catch (err2) {
-    notes.push(`fetch degraded: ${err2?.message ?? "network error"}`);
+    notes.push(
+      `fetch degraded: ${err2?.message ?? "network error"} \u2014 results may be INCOMPLETE (the repo could not be fetched).`
+    );
     return { source: `${owner}/${repo}`, files: [], notes };
   }
 }
@@ -53100,7 +53156,42 @@ function readLocalTree(dir) {
     } catch {
     }
   };
-  for (const p of SURFACE_FILES) add(p);
+  const seen = /* @__PURE__ */ new Set();
+  const collect = (rel) => {
+    if (seen.has(rel)) return;
+    seen.add(rel);
+    add(rel);
+  };
+  for (const p of SURFACE_FILES) collect(p);
+  const matches = [];
+  const MAX_DIRS = 5e3;
+  let dirsVisited = 0;
+  const walk = (relDir) => {
+    if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS) return;
+    dirsVisited++;
+    let entries;
+    try {
+      entries = import_fs59.default.readdirSync(import_path56.default.join(root, relDir), { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS) return;
+      const rel = relDir ? `${relDir}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        if (isIgnoredDir(`${rel}/`)) continue;
+        walk(rel);
+      } else if (e.isFile() && SURFACE_BASENAME.test(rel)) {
+        matches.push(rel);
+      }
+    }
+  };
+  walk("");
+  if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS)
+    notes.push(
+      `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files / ${MAX_DIRS} dirs).`
+    );
+  for (const rel of matches) collect(rel);
   const wfDir = import_path56.default.join(root, WORKFLOW_DIR);
   try {
     if (import_fs59.default.existsSync(wfDir)) {
@@ -53141,6 +53232,18 @@ var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claud
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
 var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
 var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
+var EGRESS_TOOL_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\(\s*(curl|wget|python|python3|node|deno|bun|ruby|perl|php|pip|pipx|npx|nc|ncat|ssh|scp|http|gh api)|WebFetch|WebSearch/i;
+var MEMBERSHIP_CHECK_RE = /orgs\/[^/'"\s]+\/memberships\/|teams\/[^/'"\s]+\/memberships\/|getCollaboratorPermissionLevel|collaborators\/[^/'"\s]+\/permission|checkMembershipForUser|getMembershipForUser/i;
+var STRANGER_ISSUE_TYPES = /* @__PURE__ */ new Set(["opened", "edited", "reopened", "closed"]);
+var STRANGER_PR_TYPES = /* @__PURE__ */ new Set([
+  "opened",
+  "edited",
+  "reopened",
+  "closed",
+  "synchronize",
+  "ready_for_review",
+  "converted_to_draft"
+]);
 function str(v) {
   return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
 }
@@ -53151,9 +53254,57 @@ function triggerKeys(wf, raw) {
   if (on && typeof on === "object") return Object.keys(on);
   return [];
 }
+function onObject(wf, raw) {
+  return wf.on ?? raw["on"] ?? raw[true];
+}
+function activityTypes(node) {
+  return node && Array.isArray(node.types) ? node.types.map(String) : [];
+}
+function keyStrangerFirable(on, key) {
+  switch (key) {
+    case "issue_comment":
+    case "pull_request_review":
+    case "pull_request_review_comment":
+    case "workflow_run":
+    case "discussion":
+    case "discussion_comment":
+    case "fork":
+    case "watch":
+    case "public":
+      return true;
+    case "pull_request":
+    case "pull_request_target": {
+      const ts = activityTypes(on[key]);
+      return ts.length ? ts.some((t) => STRANGER_PR_TYPES.has(t)) : true;
+    }
+    case "issues": {
+      const ts = activityTypes(on["issues"]);
+      return ts.length ? ts.some((t) => STRANGER_ISSUE_TYPES.has(t)) : true;
+    }
+    // workflow_call / workflow_dispatch / schedule / push / create / delete / …
+    // are NOT stranger-firable (require write access, or run in a trusted context).
+    default:
+      return false;
+  }
+}
+function triggerReach(wf, raw) {
+  const on = onObject(wf, raw) ?? {};
+  const keys = triggerKeys(wf, raw);
+  const firable = keys.filter((k) => keyStrangerFirable(on, k));
+  const untrusted = firable.length > 0;
+  const reusable = !untrusted && keys.some((k) => /^workflow_call$/i.test(k));
+  const secretExposed = firable.some((t) => /pull_request_target|workflow_run/i.test(t));
+  const privileged = untrusted && firable.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|issue|discussion/i.test(t)
+  );
+  return { keys, untrusted, reusable, secretExposed, privileged };
+}
+function jobList(wf) {
+  return Object.values(wf.jobs ?? {}).filter((j) => j != null);
+}
 function allSteps(wf) {
   const out = [];
-  for (const job of Object.values(wf.jobs ?? {})) {
+  for (const job of jobList(wf)) {
     for (const step of job.steps ?? []) out.push({ job, step });
   }
   return out;
@@ -53164,18 +53315,32 @@ function isAgentStep(step) {
     return true;
   return false;
 }
+function allowedToolsFromArgs(claudeArgs) {
+  let out = "";
+  for (const m of claudeArgs.matchAll(/--allowed[-_]?tools[=\s]+("[^"]*"|'[^']*'|\S+)/gi))
+    out += " " + m[1];
+  return out;
+}
+function allowedToolsFromSettings(settings) {
+  let out = "";
+  for (const key of ["allowedTools", "allow"]) {
+    for (const m of settings.matchAll(new RegExp(`"${key}"\\s*:\\s*(\\[[^\\]]*\\])`, "gi")))
+      out += " " + m[1];
+  }
+  return out;
+}
 function collectTools(steps) {
-  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + stripDeny(str(w["settings"]));
+    s += " " + allowedToolsFromArgs(str(w["claude_args"]));
+    s += " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + allowedToolsFromSettings(str(w["settings"]));
   }
   return s;
 }
-function untrustedHeadCheckout(wf) {
-  for (const { step } of allSteps(wf)) {
+function untrustedHeadCheckout(steps) {
+  for (const step of steps) {
     if (!step.uses || !/actions\/checkout/.test(step.uses)) continue;
     const ref = str(step.with?.["ref"]);
     if (/pull_request\.head|head[._]sha|head_ref|expected_head|workflow_run\.head|inputs\.[\w]*head/i.test(
@@ -53194,43 +53359,100 @@ function promptTakesUntrusted(steps) {
   }
   return false;
 }
-function hasActorGate(wf, raw) {
+var NONCONTAINS_GATE_RE = new RegExp(
+  [
+    String.raw`==\s*['"]?(OWNER|MEMBER|COLLABORATOR)\b`,
+    String.raw`==\s*['"](write|admin|maintain)`,
+    String.raw`github\.actor\s*==`,
+    String.raw`user\.login\s*==`,
+    String.raw`head\.repo\.full_name\s*==\s*github\.repository`
+  ].join("|"),
+  "i"
+);
+var PERMISSION_OUTPUT_GATE_RE = /steps\.[\w-]+\.outputs\.[\w-]*(permission|allowed|authoriz|is[_-]?(admin|member|maintainer|collaborator))[\w-]*\s*==\s*['"]?(true|admin|write|maintain)/i;
+var CONTAINS_GATE_RE = /contains\((?:[^()]|\([^()]*\))*(login|actor|association|OWNER|MEMBER|COLLABORATOR)/i;
+var NEGATED_CONTAINS_RE = /!\s*\(?\s*contains\((?:[^()]|\([^()]*\))*(login|actor|association|OWNER|MEMBER|COLLABORATOR)/i;
+function labelTypeConfigured(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
   const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
-  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
-  const ifs = [
-    wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
-    allSteps(wf).map((s) => s.step.if)
-  ].flat().map(str).join(" ");
-  const gated = /author_association|FIRST_TIME_CONTRIBUTOR|collaborator|\b(MEMBER|OWNER)\b|permission|github\.actor\s*==|user\.login\s*==|==\s*['"](write|admin|maintain)|contains\([^)]*(login|actor|association)|head\.repo\.full_name\s*==\s*github\.repository/i.test(
-    ifs
-  );
-  const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
+  return prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+}
+function ifsAreGated(ifs, labelConfigured) {
+  const containsGate = CONTAINS_GATE_RE.test(ifs) && !NEGATED_CONTAINS_RE.test(ifs);
+  const gated = NONCONTAINS_GATE_RE.test(ifs) || containsGate;
+  const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
+function hasActorGate(wf, raw) {
+  const ifs = [jobList(wf).map((j) => j.if), allSteps(wf).map((s) => s.step.if)].flat().map(str).join(" ");
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
+}
+function hasStepMembershipGate(job) {
+  const steps = job.steps ?? [];
+  const gateIds = steps.filter((s) => s.id && MEMBERSHIP_CHECK_RE.test(str(s.run))).map((s) => s.id);
+  if (!gateIds.length) return false;
+  return steps.some(
+    (s) => isAgentStep(s) && gateIds.some(
+      (id) => new RegExp(`steps\\.${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.outputs\\.`).test(
+        str(s.if)
+      )
+    )
+  );
+}
+function jobActorGate(job, wf, raw) {
+  const ifs = [job.if, ...(job.steps ?? []).map((s) => s.if)].map(str).join(" ");
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
+  hasStepMembershipGate(job);
+}
 function hasImplicitActorGate(agentSteps, bypassActive) {
   if (bypassActive) return false;
   return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
 }
-function permsElevated(wf, agentJobs) {
-  const check = (p) => {
-    const s = str(p);
-    return /["']?(contents|id-token|packages)["']?\s*:\s*["']?write/i.test(s);
-  };
-  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
+function injectableJobs(wf, raw, untrustedTrigger) {
+  const out = [];
+  for (const job of jobList(wf)) {
+    const a = (job.steps ?? []).filter(isAgentStep);
+    if (!a.length) continue;
+    const jobStar = str(a.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
+      continue;
+    out.push(job);
+  }
+  return out;
+}
+function usesPatIn(jobs) {
+  for (const j of jobs)
+    for (const step of j.steps ?? []) {
+      const gt = str(step.with?.["github_token"]);
+      if (/secrets\./i.test(gt) && !/secrets\.GITHUB_TOKEN/i.test(gt)) return true;
+    }
+  return false;
+}
+function jobPerms(wf, job) {
+  return job.permissions != null ? str(job.permissions) : str(wf.permissions);
+}
+function jobsHaveWrite(wf, jobs, rx) {
+  return jobs.some((j) => {
+    const p = jobPerms(wf, j);
+    return /\bwrite-all\b/i.test(p) || rx.test(p);
+  });
+}
+function hasIdTokenWrite(wf, jobs) {
+  const rx = /["']?id-token["']?\s*:\s*["']?write/i;
+  return jobs.some((j) => rx.test(jobPerms(wf, j)));
+}
+function hasPrWritePerm(wf, jobs) {
+  return jobsHaveWrite(wf, jobs, /["']?pull-requests["']?\s*:\s*["']?write/i);
 }
-function hasGithubWritePerm(wf, agentJobs) {
-  const check = (p) => /["']?(contents|pull-requests|issues|packages|actions|deployments)["']?\s*:\s*["']?write/i.test(
-    str(p)
+function hasCodeWritePerm(wf, agentJobs) {
+  return jobsHaveWrite(
+    wf,
+    agentJobs,
+    /["']?(contents|packages|actions|deployments)["']?\s*:\s*["']?write/i
   );
-  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
 }
-function usesPat(wf) {
-  for (const { step } of allSteps(wf)) {
-    const gt = str(step.with?.["github_token"]);
-    if (/secrets\./i.test(gt) && !/secrets\.GITHUB_TOKEN/i.test(gt)) return true;
-  }
-  return false;
+function hasMetaWritePerm(wf, agentJobs) {
+  return jobsHaveWrite(wf, agentJobs, /["']?(pull-requests|issues)["']?\s*:\s*["']?write/i);
 }
 function hasEnvDeny(steps) {
   return steps.some((s) => /"?mode"?\s*:\s*"?deny/i.test(str(s.with?.["settings"])));
@@ -53263,31 +53485,38 @@ function analyzeWorkflow(path70, content) {
     )
   ];
   if (agentSteps.length === 0) return null;
-  const triggers = triggerKeys(wf, raw);
-  const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
-  const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
-  const privileged = triggers.some(
-    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
-  );
+  const {
+    keys: triggers,
+    untrusted: forkInput,
+    secretExposed,
+    reusable,
+    privileged
+  } = triggerReach(wf, raw);
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
-  const untrustedTrigger = secretExposed || forkInput;
+  const untrustedTrigger = forkInput || reusable;
   const bypassActive = nonWriteStar && untrustedTrigger;
-  const head = untrustedHeadCheckout(wf);
+  const head = untrustedHeadCheckout(steps);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
-  const reach = Math.max(
+  const injJobs = injectableJobs(wf, raw, untrustedTrigger);
+  const powerJobs = injJobs.length ? injJobs : agentJobs;
+  const powerSteps = injJobs.flatMap((j) => (j.steps ?? []).filter(isAgentStep));
+  const scopedSteps = powerSteps.length ? powerSteps : agentSteps;
+  const toolsBlob = collectTools(scopedSteps);
+  const reach = untrustedTrigger && injJobs.length ? Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
     bypassActive ? 2 : 0
-  );
-  const toolsBlob = collectTools(agentSteps);
+  ) : 0;
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
-  const elevated = permsElevated(wf, agentJobs);
-  const pat = usesPat(wf);
+  const egressTool = EGRESS_TOOL_RE.test(toolsBlob);
+  const elevated = hasCodeWritePerm(wf, powerJobs) || hasIdTokenWrite(wf, powerJobs) && egressTool;
+  const pat = usesPatIn(powerJobs);
   const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
   const explicitGate = hasActorGate(wf, raw);
   const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
+  const membershipGated = injJobs.length === 0 && jobList(wf).some((j) => (j.steps ?? []).some(isAgentStep) && hasStepMembershipGate(j));
   const gate = explicitGate || implicitGate;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
@@ -53296,7 +53525,7 @@ function analyzeWorkflow(path70, content) {
   if (envDeny) score -= 1;
   if (pinned) score -= 1;
   score = Math.max(0, score);
-  if (score === 0 && !secretExposed) return null;
+  if (score === 0 && !secretExposed && !reusable) return null;
   let severity = severityFromScore(score);
   if (gate && severity && severity !== "advisory") severity = "advisory";
   if (reach === 0 && severity && severity !== "advisory") severity = "advisory";
@@ -53304,9 +53533,20 @@ function analyzeWorkflow(path70, content) {
     severity = "medium";
   const exfilOrRce = EXFIL_RCE_RE.test(toolsBlob);
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
-  const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
+  const rce = exfilOrRce;
+  const codeWrite = pat || hasCodeWritePerm(wf, powerJobs) && githubWriteTool;
+  const metaWrite = hasMetaWritePerm(wf, powerJobs) && githubWriteTool;
+  const canDamage = rce || codeWrite || metaWrite;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
-  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
+  if (canDamage && !rce && !codeWrite && severity === "critical") severity = "high";
+  const issueOnlyWrite = metaWrite && !hasPrWritePerm(wf, powerJobs) && !hasCodeWritePerm(wf, powerJobs);
+  if (issueOnlyWrite && !rce && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
+  if (untrustedTrigger && !privileged && !reusable && severity && severity !== "advisory")
+    severity = "advisory";
+  const reusableLoadedGun = reusable && (head === "root" || promptUntrusted);
+  if (reusable && !reusableLoadedGun && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53314,7 +53554,11 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
-  if (untrustedTrigger && !privileged)
+  else if (reusable)
+    signals.push(
+      reusableLoadedGun ? `reusable workflow (${triggers.join(", ")}) that checks out an untrusted head / ingests untrusted input \u2014 exploitable the moment a caller wires a fork trigger (reachability depends on the caller, but this workflow is built to process attacker input)` : `reusable workflow (${triggers.join(", ")}) \u2014 no untrusted trigger of its own; reachability depends on the caller's trigger + actor gate`
+    );
+  if (forkInput && !privileged && !reusable)
     signals.push(
       "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
     );
@@ -53326,8 +53570,14 @@ function analyzeWorkflow(path70, content) {
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
+  const noExplicitPerms = wf.permissions == null && jobList(wf).every((j) => j.permissions == null);
+  if (noExplicitPerms && reach > 0 && (broadTools || githubWriteTool))
+    signals.push(
+      "no explicit `permissions:` \u2014 the token defaults to the repo/org setting, which may grant write; set it explicitly to read-only"
+    );
   const mitigations = [];
-  if (explicitGate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  if (explicitGate || membershipGated)
+    mitigations.push("actor-gated (maintainer/label/write-user required)");
   else if (implicitGate)
     mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
@@ -53346,6 +53596,105 @@ function analyzeWorkflow(path70, content) {
     fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
+var AGENT_FUEL_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_BASE_URL|GEMINI_API_KEY|GOOGLE_API_KEY|GITHUB_TOKEN)$/i;
+var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_url|claude_code_oauth_token|openai_api_key|openai_base_url|gemini_api_key|google_api_key)$/i;
+function fuelSecretNames(agentSteps) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (v) => {
+    for (const m of str(v).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) out.add(m[1]);
+  };
+  for (const st of agentSteps) {
+    for (const [k, v] of Object.entries(st.with ?? {})) if (FUEL_INPUT_KEYS.test(k)) add(v);
+    for (const [k, v] of Object.entries(st.env ?? {})) if (AGENT_FUEL_RE.test(k)) add(v);
+  }
+  return out;
+}
+function classifySecret(name) {
+  if (/AWS_|AZURE_|GCP_|GOOGLE_APPLICATION|GCLOUD/i.test(name)) return "cloud";
+  if (/_PAT\b|PAT$|_TOKEN$|GH_TOKEN/i.test(name)) return "pat";
+  if (/DATABASE|_DB_|POSTGRES|MYSQL|REDIS|MONGO|CONNECTION_STRING/i.test(name)) return "db";
+  if (/API_KEY|_KEY$|SECRET|PASSWORD|PASSWD/i.test(name)) return "api-key";
+  return "generic";
+}
+function agentReachableSecrets(wf, agentSteps, agentJobs) {
+  const blobs = [];
+  for (const st of agentSteps) blobs.push(str(st.env), str(st.with));
+  for (const j of agentJobs) blobs.push(str(j.env));
+  blobs.push(str(wf.env));
+  const fuel = fuelSecretNames(agentSteps);
+  const found = /* @__PURE__ */ new Map();
+  for (const b of blobs) {
+    for (const m of b.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) {
+      const name = m[1];
+      if (AGENT_FUEL_RE.test(name) || fuel.has(name)) continue;
+      found.set(name, classifySecret(name));
+    }
+  }
+  const idToken = hasIdTokenWrite(wf, agentJobs);
+  const out = [...found].map(([name, kind]) => ({ name, kind }));
+  if (idToken) out.push({ name: "id-token (cloud OIDC)", kind: "cloud-oidc" });
+  return out;
+}
+function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
+  const jobSteps = job.steps ?? [];
+  const jobAgentSteps = jobSteps.filter(isAgentStep);
+  if (jobAgentSteps.length === 0) return null;
+  const secrets = agentReachableSecrets(wf, jobAgentSteps, [job]);
+  if (secrets.length === 0) return null;
+  const nonWriteStar = str(jobAgentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+  const bypassActive = nonWriteStar && untrustedTrigger;
+  const head = untrustedHeadCheckout(jobSteps);
+  const reach = Math.max(
+    head === "root" ? 3 : head === "subdir" ? 1 : 0,
+    promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
+    bypassActive ? 2 : 0
+  );
+  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const injectable = untrustedTrigger && !gate && reach > 0;
+  const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
+  const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");
+  const hasOidc = secrets.some((s) => s.kind === "cloud-oidc");
+  let severity;
+  if (injectable && canReadEnv) {
+    severity = hasOidc || realSecrets.some((s) => ["cloud", "pat", "db"].includes(s.kind)) ? "critical" : "high";
+  } else if (realSecrets.length > 0) {
+    severity = "advisory";
+  } else {
+    return null;
+  }
+  const loadedGun = head === "root" || promptTakesUntrusted(jobAgentSteps);
+  if (reusable && !loadedGun && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
+  return { severity, secrets, injectable, canReadEnv };
+}
+function analyzeWorkflowSecrets(path70, content) {
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(content) ?? {};
+  } catch {
+    return null;
+  }
+  const wf = raw;
+  const all = allSteps(wf);
+  if (!all.some((s) => isAgentStep(s.step))) return null;
+  const { untrusted: forkInput, reusable } = triggerReach(wf, raw);
+  const untrustedTrigger = forkInput || reusable;
+  const agentJobs = [...new Set(all.filter((s) => isAgentStep(s.step)).map((s) => s.job))];
+  const worst = agentJobs.map((job) => evalAgentJob(job, wf, raw, untrustedTrigger, reusable)).filter((e) => e !== null).sort((a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity])[0];
+  if (!worst) return null;
+  return {
+    check: "CI-4",
+    dimension: "data",
+    severity: worst.severity,
+    title: worst.severity === "advisory" ? "Secrets reachable by the agent \u2014 hardening" : "Exfiltratable secrets reachable by an injectable agent",
+    file: path70,
+    signals: [
+      `agent can reach: ${worst.secrets.map((s) => s.name).join(", ")}`,
+      worst.injectable ? "the agent is externally triggerable (untrusted trigger, no gate)" : "gated / not externally triggerable \u2014 latent risk only",
+      worst.canReadEnv ? "agent has arbitrary shell (bare Bash) \u2192 can read env and exfiltrate" : "no arbitrary-shell tool \u2014 not exfiltratable today, but one tool-add away"
+    ],
+    fix: "Move extra secrets to a separate trusted job the agent cannot reach; drop id-token:write if unused; scope the agent tools to read-only and gate the trigger."
+  };
+}
 
 // src/ci-check/agent-config.ts
 function asStrings(v) {
@@ -53373,18 +53722,20 @@ function analyzeAgentConfig(path70, content) {
   }
   const findings = [];
   for (const cmd of hookCommands(cfg.hooks)) {
-    const remote = /\b(npx|curl|wget|iwr|irm)\b/.test(cmd) || /\|\s*(sh|bash)\b/.test(cmd);
-    if (!remote) continue;
-    const unpinned = /@latest\b/.test(cmd) || /\bnpx\b/.test(cmd) && !/@\d/.test(cmd);
+    const remoteExec = /\|\s*(sh|bash|zsh)\b/.test(cmd) || /\b(curl|wget|iwr|irm)\b/.test(cmd);
+    const isNpx = /\bnpx\b/.test(cmd);
+    if (!remoteExec && !isNpx) continue;
+    const unpinned = /@latest\b/.test(cmd) || isNpx && !/@\d/.test(cmd);
+    const high = remoteExec || unpinned;
     findings.push({
       check: "CI-1",
       dimension: "toolRules",
-      severity: unpinned ? "high" : "medium",
-      title: unpinned ? "Agent hook runs UNPINNED third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
+      severity: high ? "high" : "medium",
+      title: high ? "Agent hook runs UNPINNED/remote third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
       file: path70,
       signals: [
         `hook command: \`${cmd.slice(0, 120)}\``,
-        unpinned ? "unpinned \u2014 a compromised/yanked package = code execution on every contributor" : "pinned, but still a standing supply-chain dependency in the agent hot path"
+        remoteExec ? "fetch-and-run (curl|wget / pipe-to-shell) \u2014 unpinnable remote code execution on every contributor" : unpinned ? "unpinned \u2014 a compromised/yanked package = code execution on every contributor" : "pinned, but still a standing supply-chain dependency in the agent hot path"
       ],
       fix: "Vendor the command as a committed local script, or pin an exact version and treat updates as security-reviewed."
     });
@@ -53395,17 +53746,18 @@ function analyzeAgentConfig(path70, content) {
     (a) => /^Bash$|^Bash\(\s*\*|^Bash\(git:|^Write\(\s*\*|^Write$|^Edit$/.test(a)
   );
   if (broad.length > 0) {
+    const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
     findings.push({
       check: "CI-1",
       dimension: "toolRules",
-      severity: "medium",
-      title: "Committed agent config pre-authorizes broad tools",
+      severity: hasBackstop ? "medium" : "high",
+      title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
       file: path70,
       signals: [
         `broad allow(s): ${broad.slice(0, 5).join(", ")}`,
-        ...deny.length === 0 ? ["no `deny` entries to backstop it"] : []
+        hasBackstop ? "a `deny` list backstops the broad allow" : "no `deny` entry covers Bash/Write/Edit \u2014 every contributor is pre-authorized for catastrophic tools"
       ],
-      fix: "Scope the allow-list to specific read-only subcommands (e.g. `Bash(gh pr view:*)`); avoid bare `Bash`/`git:`/`Write`."
+      fix: "Scope the allow-list to specific read-only subcommands (e.g. `Bash(gh pr view:*)`); avoid bare `Bash`/`git:`/`Write`, or add a `deny` backstop."
     });
   }
   return findings;
@@ -53420,8 +53772,11 @@ function analyzeMcp(path70, content) {
   } catch {
     return [];
   }
+  return analyzeMcpServers(cfg.mcpServers ?? {}, path70);
+}
+function analyzeMcpServers(servers, path70) {
   const findings = [];
-  for (const [name, srv] of Object.entries(cfg.mcpServers ?? {})) {
+  for (const [name, srv] of Object.entries(servers ?? {})) {
     if (!srv || srv.disabled) continue;
     const argv = [srv.command, ...Array.isArray(srv.args) ? srv.args.map(String) : []].join(" ");
     if (/\bnpx\b/.test(argv) && (/@latest\b/.test(argv) || !/@\d/.test(argv))) {
@@ -53456,6 +53811,199 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
+// src/ci-check/codex.ts
+var import_smol_toml5 = require("smol-toml");
+function analyzeCodexConfig(path70, content) {
+  let cfg;
+  try {
+    cfg = (0, import_smol_toml5.parse)(content);
+  } catch {
+    return [];
+  }
+  const findings = [];
+  findings.push(...analyzeMcpServers(cfg.mcp_servers ?? {}, path70));
+  const sandbox = typeof cfg.sandbox_mode === "string" ? cfg.sandbox_mode : "";
+  const approval = typeof cfg.approval_policy === "string" ? cfg.approval_policy : "";
+  const fullAccess = /danger-full-access/i.test(sandbox);
+  const noApproval = /^never$/i.test(approval);
+  if (fullAccess || noApproval) {
+    const signals = [
+      fullAccess ? 'sandbox_mode = "danger-full-access" \u2014 the agent runs arbitrary commands with full disk + network access' : null,
+      noApproval ? 'approval_policy = "never" \u2014 no human approval for agent actions' : null
+    ].filter((s) => s !== null);
+    findings.push({
+      check: "CI-1",
+      dimension: "toolRules",
+      severity: fullAccess ? "high" : "medium",
+      title: fullAccess ? "Codex config grants a full-access sandbox" : "Codex config never requires approval",
+      file: path70,
+      signals,
+      fix: 'Commit a least-privilege Codex config: prefer `sandbox_mode = "read-only"` (or `"workspace-write"`) and `approval_policy = "on-request"`/`"on-failure"`. A repo-committed config applies to every contributor who runs Codex here.'
+    });
+  }
+  return findings;
+}
+
+// src/ci-check/instructions.ts
+var TAG_CHARS = /[\u{E0000}-\u{E007F}]/u;
+var BIDI_OVERRIDE = /[‭‮]/;
+var BIDI_EMBED_ISOLATE = /[‪-‬⁦-⁩]/;
+function isZwLegitScript(cp) {
+  if (cp === void 0) return false;
+  return cp >= 3584 && cp <= 3711 || cp >= 3712 && cp <= 3839 || cp >= 4096 && cp <= 4255 || cp >= 6016 && cp <= 6143 || cp >= 12352 && cp <= 12543 || cp >= 13312 && cp <= 40959 || cp >= 44032 && cp <= 55215;
+}
+var isAsciiWordChar = (ch) => !!ch && /[A-Za-z0-9]/.test(ch);
+function suspiciousZeroWidth(text) {
+  let n = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c !== 8203 && c !== 8288) continue;
+    if (isZwLegitScript(text.codePointAt(i - 1)) || isZwLegitScript(text.codePointAt(i + 1)))
+      continue;
+    const prev = text[i - 1];
+    const next = text[i + 1];
+    if (!prev || !next || /\s/.test(prev) || /\s/.test(next)) continue;
+    if (isAsciiWordChar(prev) && isAsciiWordChar(next)) n++;
+  }
+  return n;
+}
+var stripZeroWidth = (t) => t.replace(/[​⁠]/g, "");
+var OVERRIDE_RE = /ignore\s+(all\s+)?(previous|prior|the\s+above)\s+(instructions|prompts?|rules)|disregard\s+(the\s+|your\s+)?(system\s+)?(prompt|instructions|rules)|forget\s+(everything|all\s+(previous|prior))|you\s+are\s+now\s+(a|an|the)\b|<\/?system>/i;
+var FETCH_OBEY_RE = /\b(curl|wget|iwr|invoke-webrequest)\b[^\n|]*\|\s*(bash|sh|zsh|python3?|node|iex)\b|\b(curl|wget)\b[^\n]*&&[^\n]*\b(bash|sh)\b/i;
+var SECRET_PATH_RE = /~\/\.aws\/credentials|~\/\.ssh\/id_[a-z]+|~\/\.config\/gh\/hosts|read\s+the\s+(token|secret|api[_ ]?key|password)\s+(in|from)\s+[.`'"]?\.?env/i;
+var EXFIL_RE = /\b(post|send|upload|exfiltrate|forward)\b[^\n]{0,40}\b(to|at)\b[^\n]{0,50}(https?:\/\/|webhook|hook\.[a-z])/i;
+var HUMAN_SECTION_RE = /^#+\s*(install|installation|setup|set ?up|getting started|quick ?start|contributing|contribution|development|dev setup|build|prerequisites|requirements|usage)\b/i;
+var NEGATION_RE = /\b(never|do not|don'?t|avoid|must not|should not|no need to|refuse to)\b/i;
+function isNegated(text, idx) {
+  return NEGATION_RE.test(text.slice(Math.max(0, idx - 40), idx));
+}
+function inHumanSection(text, idx) {
+  const heading = text.slice(0, idx).split("\n").reverse().find((l) => /^#+\s/.test(l));
+  return !!heading && HUMAN_SECTION_RE.test(heading);
+}
+function decodeSuspiciousBase64(text) {
+  let out = "";
+  for (const m of text.matchAll(/[A-Za-z0-9+/]{40,}={0,2}/g)) {
+    try {
+      const d = Buffer.from(m[0], "base64").toString("utf8");
+      if (/[\x20-\x7E]{16,}/.test(d) && /[a-z]{4,}/i.test(d)) out += " " + d;
+    } catch {
+    }
+  }
+  return out;
+}
+function mk(severity, title, signals, fix, path70) {
+  return { check: "CI-6", dimension: "instructions", severity, title, file: path70, signals, fix };
+}
+function analyzeInstructionFile(path70, content) {
+  const findings = [];
+  const decoded = decodeSuspiciousBase64(content);
+  if (TAG_CHARS.test(content))
+    findings.push(
+      mk(
+        "critical",
+        "Unicode tag characters in an agent instruction file",
+        [
+          "contains Unicode tag characters (U+E0000\u2013E007F) \u2014 an invisible instruction-smuggling channel with no legitimate use in text"
+        ],
+        "Remove the tag characters. Instruction files must be plain, reviewable text.",
+        path70
+      )
+    );
+  if (BIDI_OVERRIDE.test(content))
+    findings.push(
+      mk(
+        "critical",
+        "Bidirectional override characters in an agent instruction file",
+        [
+          "contains a bidi override (U+202D/U+202E) \u2014 a Trojan-Source technique that visually reorders text so a human reads something different from what the agent parses"
+        ],
+        "Remove the bidi override characters.",
+        path70
+      )
+    );
+  else if (BIDI_EMBED_ISOLATE.test(content))
+    findings.push(
+      mk(
+        "advisory",
+        "Bidirectional formatting characters in an agent instruction file",
+        [
+          "contains bidi embed/isolate characters (U+202A\u2013202C / U+2066\u20132069) \u2014 legitimate in right-to-left text, but confirm they are not being used to hide or reorder instructions"
+        ],
+        "Confirm the bidi marks are legitimate RTL formatting; remove otherwise.",
+        path70
+      )
+    );
+  const zw = suspiciousZeroWidth(content);
+  if (zw > 0) {
+    const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
+    findings.push(
+      mk(
+        revealed ? "critical" : "medium",
+        "Zero-width characters splitting text in an agent instruction file",
+        [
+          revealed ? "a zero-width character conceals a prompt-override directive that only appears once the hidden characters are stripped" : "a zero-width character splits a visible Latin word \u2014 a concealment technique (hides text from human review while the agent reads it as contiguous)"
+        ],
+        "Remove the zero-width characters. Instruction files must be plain, reviewable text.",
+        path70
+      )
+    );
+  }
+  const ov = OVERRIDE_RE.exec(content);
+  const ovEnc = !ov ? OVERRIDE_RE.exec(decoded) : null;
+  if (ov || ovEnc) {
+    const m = ov || ovEnc;
+    findings.push(
+      mk(
+        ovEnc ? "critical" : "high",
+        "Prompt-override directive in an agent instruction file",
+        [
+          `contains a prompt-override / role-impersonation directive (\`${m[0].slice(0, 60).trim()}\`)${ovEnc ? " \u2014 concealed in a base64 blob" : ""}`
+        ],
+        "Remove the override text. An instruction file should not tell the agent to ignore its own rules.",
+        path70
+      )
+    );
+  }
+  const fo = FETCH_OBEY_RE.exec(content);
+  if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction directs the agent to fetch and run remote code",
+        [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
+        "Do not instruct the agent to pipe remote content into a shell; pin and vendor scripts instead.",
+        path70
+      )
+    );
+  }
+  const sp = SECRET_PATH_RE.exec(content);
+  if (sp && !isNegated(content, sp.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction points the agent at credential material",
+        [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
+        "Do not reference credential files or paths in agent instructions.",
+        path70
+      )
+    );
+  }
+  const ex = EXFIL_RE.exec(content);
+  if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction directs the agent to send data to an external endpoint",
+        [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
+        "Remove external post/upload directives from agent instructions.",
+        path70
+      )
+    );
+  }
+  return findings;
+}
+
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;
@@ -53474,10 +54022,18 @@ function scanTree(tree) {
       if (/\.github\/workflows\/.+\.ya?ml$/.test(file.path)) {
         const f = analyzeWorkflow(file.path, file.content);
         if (f) findings.push(f);
+        const s = analyzeWorkflowSecrets(file.path, file.content);
+        if (s) findings.push(s);
       } else if (/\.claude\/settings(\.local)?\.json$/.test(file.path)) {
         findings.push(...analyzeAgentConfig(file.path, file.content));
       } else if (/\.mcp\.json$|\.cursor\/mcp\.json$/.test(file.path)) {
         findings.push(...analyzeMcp(file.path, file.content));
+      } else if (/(^|\/)\.codex\/config\.toml$/.test(file.path)) {
+        findings.push(...analyzeCodexConfig(file.path, file.content));
+      } else if (/(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|copilot-instructions\.md$|(^|\/)\.(windsurf|cline)rules$/.test(
+        file.path
+      )) {
+        findings.push(...analyzeInstructionFile(file.path, file.content));
       }
     } catch (err2) {
       notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
@@ -53508,6 +54064,36 @@ var COLOR = {
   medium: import_chalk29.default.yellow,
   advisory: import_chalk29.default.gray
 };
+var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security-check?ref=cli_scan_repo";
+function renderCta(res) {
+  const L = [];
+  L.push(import_chalk29.default.dim("   " + "\u2500".repeat(63)));
+  if (res.worst === "critical" || res.worst === "high") {
+    const n = res.findings.filter((f) => f.severity === "critical" || f.severity === "high").length;
+    L.push(
+      "   " + import_chalk29.default.red.bold(
+        `\u{1F534} ${n} ${n === 1 ? "issue" : "issues"} to fix \u2014 then stop the next at the PR.`
+      )
+    );
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Catch this class of issue on every PR, automatically:"));
+  } else if (res.worst) {
+    L.push("   " + import_chalk29.default.yellow("\u{1F7E1} Review the findings above, then keep it covered:"));
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Check every PR for agent-CI risk:"));
+  } else if (res.incomplete) {
+    L.push("   " + import_chalk29.default.yellow.bold("\u26A0\uFE0F  Incomplete \u2014 not a clean bill of health."));
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Get a complete check on every PR (CI reads the tree directly):"));
+  } else {
+    L.push("   " + import_chalk29.default.green("\u2705 Agent CI is well-configured \u2014 0 unmitigated issues."));
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Keep it green as you add agent workflows \u2014 check every PR:"));
+  }
+  L.push("   " + import_chalk29.default.dim("\u2192 ") + import_chalk29.default.cyan.underline(ACTION_URL));
+  L.push("   " + import_chalk29.default.gray("  zero setup \xB7 no token \xB7 runs in your CI"));
+  return L;
+}
 function ownedHint(source) {
   return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
 }
@@ -53552,6 +54138,8 @@ function renderScan(res) {
       )
     );
   }
+  L.push("");
+  L.push(...renderCta(res));
   return L.join("\n");
 }
 function renderScanMarkdown(res) {