@node9/proxy 1.59.0 → 1.60.0

package/dist/cli.mjs

@@ -52978,6 +52978,28 @@ var SURFACE_FILES = [
   ".clinerules"
 ];
 var WORKFLOW_DIR = ".github/workflows";
+var SURFACE_BASENAME = /(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|(^|\/)\.(windsurf|cline)rules$|(^|\/)copilot-instructions\.md$|(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.mcp\.json$|(^|\/)\.cursor\/mcp\.json$|(^|\/)\.codex\/config\.toml$/;
+var IGNORE_HARD = /(^|\/)(node_modules|vendor|\.git|\.next|\.venv|site-packages)\//;
+var IGNORE_SOFT = /(^|\/)(dist|build|out|target)\//;
+var isIgnoredDir = (relSlash) => IGNORE_HARD.test(relSlash) || IGNORE_SOFT.test(relSlash);
+var MAX_SURFACE_FILES = 200;
+function pickSurfacePaths(paths, truncated, notes) {
+  const surface = paths.filter((p) => SURFACE_BASENAME.test(p) && !IGNORE_HARD.test(p));
+  const matched = surface.filter((p) => !IGNORE_SOFT.test(p));
+  const softSkipped = surface.filter((p) => IGNORE_SOFT.test(p));
+  const capped = matched.slice(0, MAX_SURFACE_FILES);
+  if (truncated || matched.length > MAX_SURFACE_FILES) {
+    notes.push(
+      `repo tree is large/truncated \u2014 some agent-surface files may be INCOMPLETE (scanned ${capped.length} of ${matched.length}${truncated ? "+" : ""}).`
+    );
+  }
+  if (softSkipped.length) {
+    notes.push(
+      `skipped ${softSkipped.length} agent-surface file(s) under a build-output dir (dist/build/out/target), e.g. ${softSkipped.slice(0, 3).join(", ")} \u2014 if any is a real committed config, move it out of the build dir to have it scanned.`
+    );
+  }
+  return capped;
+}
 async function pooled(items, limit, fn) {
   const out = new Array(items.length);
   let next = 0;
@@ -53069,13 +53091,37 @@ async function listWorkflowPaths(owner, repo, notes) {
   if (status !== 200 || !Array.isArray(json)) return [];
   return json.filter((e) => e.type === "file" && /\.ya?ml$/.test(e.name)).map((e) => e.path);
 }
+var ROOT_WORKFLOW_RE = /^\.github\/workflows\/[^/]+\.ya?ml$/;
+async function listSurfaceTree(owner, repo, notes) {
+  const url = `https://api.github.com/repos/${owner}/${repo}/git/trees/HEAD?recursive=1`;
+  const { status, json } = await ghGet(url);
+  if (status === 403 || status === 429) {
+    if (!notes.includes(RATE_LIMIT_NOTE)) notes.push(RATE_LIMIT_NOTE);
+    return null;
+  }
+  if (status === 0) {
+    if (!notes.includes(NETWORK_NOTE)) notes.push(NETWORK_NOTE);
+    return null;
+  }
+  if (status !== 200 || !json || typeof json !== "object") return null;
+  const tree = json;
+  if (!Array.isArray(tree.tree)) return null;
+  const blobs = tree.tree.filter((e) => e.type === "blob" && typeof e.path === "string").map((e) => e.path);
+  return {
+    surface: pickSurfacePaths(blobs, !!tree.truncated, notes),
+    workflows: blobs.filter((p) => ROOT_WORKFLOW_RE.test(p))
+  };
+}
 var FETCH_CONCURRENCY = 8;
 async function fetchGitHubTree(owner, repo, onProgress) {
   const notes = [];
   try {
-    onProgress?.({ phase: "listing workflows", done: 0, total: 1 });
-    const workflowPaths = await listWorkflowPaths(owner, repo, notes);
-    const allPaths = [...SURFACE_FILES, ...workflowPaths];
+    onProgress?.({ phase: "discovering agent surface", done: 0, total: 1 });
+    const discovered = await listSurfaceTree(owner, repo, notes);
+    const workflowPaths = discovered ? discovered.workflows : await listWorkflowPaths(owner, repo, notes);
+    const allPaths = [
+      .../* @__PURE__ */ new Set([...SURFACE_FILES, ...discovered?.surface ?? [], ...workflowPaths])
+    ];
     let done = 0;
     const fetched = await pooled(allPaths, FETCH_CONCURRENCY, async (p) => {
       const f = await fetchOne(owner, repo, p, notes);
@@ -53084,7 +53130,9 @@ async function fetchGitHubTree(owner, repo, onProgress) {
     });
     return { source: `${owner}/${repo}`, files: fetched.filter((f) => !!f), notes };
   } catch (err2) {
-    notes.push(`fetch degraded: ${err2?.message ?? "network error"}`);
+    notes.push(
+      `fetch degraded: ${err2?.message ?? "network error"} \u2014 results may be INCOMPLETE (the repo could not be fetched).`
+    );
     return { source: `${owner}/${repo}`, files: [], notes };
   }
 }
@@ -53101,7 +53149,42 @@ function readLocalTree(dir) {
     } catch {
     }
   };
-  for (const p of SURFACE_FILES) add(p);
+  const seen = /* @__PURE__ */ new Set();
+  const collect = (rel) => {
+    if (seen.has(rel)) return;
+    seen.add(rel);
+    add(rel);
+  };
+  for (const p of SURFACE_FILES) collect(p);
+  const matches = [];
+  const MAX_DIRS = 5e3;
+  let dirsVisited = 0;
+  const walk = (relDir) => {
+    if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS) return;
+    dirsVisited++;
+    let entries;
+    try {
+      entries = fs60.readdirSync(path57.join(root, relDir), { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS) return;
+      const rel = relDir ? `${relDir}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        if (isIgnoredDir(`${rel}/`)) continue;
+        walk(rel);
+      } else if (e.isFile() && SURFACE_BASENAME.test(rel)) {
+        matches.push(rel);
+      }
+    }
+  };
+  walk("");
+  if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS)
+    notes.push(
+      `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files / ${MAX_DIRS} dirs).`
+    );
+  for (const rel of matches) collect(rel);
   const wfDir = path57.join(root, WORKFLOW_DIR);
   try {
     if (fs60.existsSync(wfDir)) {
@@ -53142,6 +53225,18 @@ var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claud
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
 var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
 var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
+var EGRESS_TOOL_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\(\s*(curl|wget|python|python3|node|deno|bun|ruby|perl|php|pip|pipx|npx|nc|ncat|ssh|scp|http|gh api)|WebFetch|WebSearch/i;
+var MEMBERSHIP_CHECK_RE = /orgs\/[^/'"\s]+\/memberships\/|teams\/[^/'"\s]+\/memberships\/|getCollaboratorPermissionLevel|collaborators\/[^/'"\s]+\/permission|checkMembershipForUser|getMembershipForUser/i;
+var STRANGER_ISSUE_TYPES = /* @__PURE__ */ new Set(["opened", "edited", "reopened", "closed"]);
+var STRANGER_PR_TYPES = /* @__PURE__ */ new Set([
+  "opened",
+  "edited",
+  "reopened",
+  "closed",
+  "synchronize",
+  "ready_for_review",
+  "converted_to_draft"
+]);
 function str(v) {
   return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
 }
@@ -53152,9 +53247,57 @@ function triggerKeys(wf, raw) {
   if (on && typeof on === "object") return Object.keys(on);
   return [];
 }
+function onObject(wf, raw) {
+  return wf.on ?? raw["on"] ?? raw[true];
+}
+function activityTypes(node) {
+  return node && Array.isArray(node.types) ? node.types.map(String) : [];
+}
+function keyStrangerFirable(on, key) {
+  switch (key) {
+    case "issue_comment":
+    case "pull_request_review":
+    case "pull_request_review_comment":
+    case "workflow_run":
+    case "discussion":
+    case "discussion_comment":
+    case "fork":
+    case "watch":
+    case "public":
+      return true;
+    case "pull_request":
+    case "pull_request_target": {
+      const ts = activityTypes(on[key]);
+      return ts.length ? ts.some((t) => STRANGER_PR_TYPES.has(t)) : true;
+    }
+    case "issues": {
+      const ts = activityTypes(on["issues"]);
+      return ts.length ? ts.some((t) => STRANGER_ISSUE_TYPES.has(t)) : true;
+    }
+    // workflow_call / workflow_dispatch / schedule / push / create / delete / …
+    // are NOT stranger-firable (require write access, or run in a trusted context).
+    default:
+      return false;
+  }
+}
+function triggerReach(wf, raw) {
+  const on = onObject(wf, raw) ?? {};
+  const keys = triggerKeys(wf, raw);
+  const firable = keys.filter((k) => keyStrangerFirable(on, k));
+  const untrusted = firable.length > 0;
+  const reusable = !untrusted && keys.some((k) => /^workflow_call$/i.test(k));
+  const secretExposed = firable.some((t) => /pull_request_target|workflow_run/i.test(t));
+  const privileged = untrusted && firable.some(
+    (t) => /pull_request_target|pull_request_review|workflow_run|issue|discussion/i.test(t)
+  );
+  return { keys, untrusted, reusable, secretExposed, privileged };
+}
+function jobList(wf) {
+  return Object.values(wf.jobs ?? {}).filter((j) => j != null);
+}
 function allSteps(wf) {
   const out = [];
-  for (const job of Object.values(wf.jobs ?? {})) {
+  for (const job of jobList(wf)) {
     for (const step of job.steps ?? []) out.push({ job, step });
   }
   return out;
@@ -53209,63 +53352,100 @@ function promptTakesUntrusted(steps) {
   }
   return false;
 }
-var ACTOR_GATE_RE = /author_association|FIRST_TIME_CONTRIBUTOR|collaborator|\b(MEMBER|OWNER)\b|permission|github\.actor\s*==|user\.login\s*==|==\s*['"](write|admin|maintain)|contains\([^)]*(login|actor|association)|head\.repo\.full_name\s*==\s*github\.repository/i;
+var NONCONTAINS_GATE_RE = new RegExp(
+  [
+    String.raw`==\s*['"]?(OWNER|MEMBER|COLLABORATOR)\b`,
+    String.raw`==\s*['"](write|admin|maintain)`,
+    String.raw`github\.actor\s*==`,
+    String.raw`user\.login\s*==`,
+    String.raw`head\.repo\.full_name\s*==\s*github\.repository`
+  ].join("|"),
+  "i"
+);
+var PERMISSION_OUTPUT_GATE_RE = /steps\.[\w-]+\.outputs\.[\w-]*(permission|allowed|authoriz|is[_-]?(admin|member|maintainer|collaborator))[\w-]*\s*==\s*['"]?(true|admin|write|maintain)/i;
+var CONTAINS_GATE_RE = /contains\((?:[^()]|\([^()]*\))*(login|actor|association|OWNER|MEMBER|COLLABORATOR)/i;
+var NEGATED_CONTAINS_RE = /!\s*\(?\s*contains\((?:[^()]|\([^()]*\))*(login|actor|association|OWNER|MEMBER|COLLABORATOR)/i;
 function labelTypeConfigured(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
   const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
   return prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
 }
 function ifsAreGated(ifs, labelConfigured) {
-  const gated = ACTOR_GATE_RE.test(ifs);
+  const containsGate = CONTAINS_GATE_RE.test(ifs) && !NEGATED_CONTAINS_RE.test(ifs);
+  const gated = NONCONTAINS_GATE_RE.test(ifs) || containsGate;
   const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
 function hasActorGate(wf, raw) {
-  const ifs = [
-    wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
-    allSteps(wf).map((s) => s.step.if)
-  ].flat().map(str).join(" ");
+  const ifs = [jobList(wf).map((j) => j.if), allSteps(wf).map((s) => s.step.if)].flat().map(str).join(" ");
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
 }
+function hasStepMembershipGate(job) {
+  const steps = job.steps ?? [];
+  const gateIds = steps.filter((s) => s.id && MEMBERSHIP_CHECK_RE.test(str(s.run))).map((s) => s.id);
+  if (!gateIds.length) return false;
+  return steps.some(
+    (s) => isAgentStep(s) && gateIds.some(
+      (id) => new RegExp(`steps\\.${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.outputs\\.`).test(
+        str(s.if)
+      )
+    )
+  );
+}
 function jobActorGate(job, wf, raw) {
   const ifs = [job.if, ...(job.steps ?? []).map((s) => s.if)].map(str).join(" ");
-  return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs);
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
+  hasStepMembershipGate(job);
 }
 function hasImplicitActorGate(agentSteps, bypassActive) {
   if (bypassActive) return false;
   return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
 }
-function injectableAgentSteps(wf, raw, untrustedTrigger) {
+function injectableJobs(wf, raw, untrustedTrigger) {
   const out = [];
-  for (const job of Object.values(wf.jobs ?? {})) {
+  for (const job of jobList(wf)) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
     const jobStar = str(a.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
-    const jobBypass = jobStar && untrustedTrigger;
-    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobBypass)) continue;
-    out.push(...a);
+    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
+      continue;
+    out.push(job);
   }
   return out;
 }
-function permsElevated(wf, agentJobs) {
-  const check = (p) => {
-    const s = str(p);
-    return /["']?(contents|id-token|packages)["']?\s*:\s*["']?write/i.test(s);
-  };
-  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
+function usesPatIn(jobs) {
+  for (const j of jobs)
+    for (const step of j.steps ?? []) {
+      const gt = str(step.with?.["github_token"]);
+      if (/secrets\./i.test(gt) && !/secrets\.GITHUB_TOKEN/i.test(gt)) return true;
+    }
+  return false;
 }
-function hasGithubWritePerm(wf, agentJobs) {
-  const check = (p) => /["']?(contents|pull-requests|issues|packages|actions|deployments)["']?\s*:\s*["']?write/i.test(
-    str(p)
+function jobPerms(wf, job) {
+  return job.permissions != null ? str(job.permissions) : str(wf.permissions);
+}
+function jobsHaveWrite(wf, jobs, rx) {
+  return jobs.some((j) => {
+    const p = jobPerms(wf, j);
+    return /\bwrite-all\b/i.test(p) || rx.test(p);
+  });
+}
+function hasIdTokenWrite(wf, jobs) {
+  const rx = /["']?id-token["']?\s*:\s*["']?write/i;
+  return jobs.some((j) => rx.test(jobPerms(wf, j)));
+}
+function hasPrWritePerm(wf, jobs) {
+  return jobsHaveWrite(wf, jobs, /["']?pull-requests["']?\s*:\s*["']?write/i);
+}
+function hasCodeWritePerm(wf, agentJobs) {
+  return jobsHaveWrite(
+    wf,
+    agentJobs,
+    /["']?(contents|packages|actions|deployments)["']?\s*:\s*["']?write/i
   );
-  return check(wf.permissions) || agentJobs.some((j) => check(j.permissions));
 }
-function usesPat(wf) {
-  for (const { step } of allSteps(wf)) {
-    const gt = str(step.with?.["github_token"]);
-    if (/secrets\./i.test(gt) && !/secrets\.GITHUB_TOKEN/i.test(gt)) return true;
-  }
-  return false;
+function hasMetaWritePerm(wf, agentJobs) {
+  return jobsHaveWrite(wf, agentJobs, /["']?(pull-requests|issues)["']?\s*:\s*["']?write/i);
 }
 function hasEnvDeny(steps) {
   return steps.some((s) => /"?mode"?\s*:\s*"?deny/i.test(str(s.with?.["settings"])));
@@ -53298,33 +53478,38 @@ function analyzeWorkflow(path70, content) {
     )
   ];
   if (agentSteps.length === 0) return null;
-  const triggers = triggerKeys(wf, raw);
-  const secretExposed = triggers.some((t) => /pull_request_target|workflow_run/i.test(t));
-  const forkInput = triggers.some((t) => /issue|pull_request|workflow_call/i.test(t));
-  const privileged = triggers.some(
-    (t) => /pull_request_target|pull_request_review|workflow_run|workflow_call|issue|discussion/i.test(t)
-  );
+  const {
+    keys: triggers,
+    untrusted: forkInput,
+    secretExposed,
+    reusable,
+    privileged
+  } = triggerReach(wf, raw);
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = nonWrite === "*";
   const nonWriteList = !!nonWrite && nonWrite !== "*";
-  const untrustedTrigger = secretExposed || forkInput;
+  const untrustedTrigger = forkInput || reusable;
   const bypassActive = nonWriteStar && untrustedTrigger;
   const head = untrustedHeadCheckout(steps);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
-  const reach = untrustedTrigger ? Math.max(
+  const injJobs = injectableJobs(wf, raw, untrustedTrigger);
+  const powerJobs = injJobs.length ? injJobs : agentJobs;
+  const powerSteps = injJobs.flatMap((j) => (j.steps ?? []).filter(isAgentStep));
+  const scopedSteps = powerSteps.length ? powerSteps : agentSteps;
+  const toolsBlob = collectTools(scopedSteps);
+  const reach = untrustedTrigger && injJobs.length ? Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
     bypassActive ? 2 : 0
   ) : 0;
-  const powerSteps = injectableAgentSteps(wf, raw, untrustedTrigger);
-  const scopedSteps = powerSteps.length ? powerSteps : agentSteps;
-  const toolsBlob = collectTools(scopedSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
-  const elevated = permsElevated(wf, agentJobs);
-  const pat = usesPat(wf);
+  const egressTool = EGRESS_TOOL_RE.test(toolsBlob);
+  const elevated = hasCodeWritePerm(wf, powerJobs) || hasIdTokenWrite(wf, powerJobs) && egressTool;
+  const pat = usesPatIn(powerJobs);
   const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
   const explicitGate = hasActorGate(wf, raw);
   const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
+  const membershipGated = injJobs.length === 0 && jobList(wf).some((j) => (j.steps ?? []).some(isAgentStep) && hasStepMembershipGate(j));
   const gate = explicitGate || implicitGate;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
@@ -53333,7 +53518,7 @@ function analyzeWorkflow(path70, content) {
   if (envDeny) score -= 1;
   if (pinned) score -= 1;
   score = Math.max(0, score);
-  if (score === 0 && !secretExposed) return null;
+  if (score === 0 && !secretExposed && !reusable) return null;
   let severity = severityFromScore(score);
   if (gate && severity && severity !== "advisory") severity = "advisory";
   if (reach === 0 && severity && severity !== "advisory") severity = "advisory";
@@ -53341,9 +53526,20 @@ function analyzeWorkflow(path70, content) {
     severity = "medium";
   const exfilOrRce = EXFIL_RCE_RE.test(toolsBlob);
   const githubWriteTool = GH_WRITE_TOOL_RE.test(toolsBlob);
-  const canDamage = exfilOrRce || (hasGithubWritePerm(wf, agentJobs) || pat) && githubWriteTool;
+  const rce = exfilOrRce;
+  const codeWrite = pat || hasCodeWritePerm(wf, powerJobs) && githubWriteTool;
+  const metaWrite = hasMetaWritePerm(wf, powerJobs) && githubWriteTool;
+  const canDamage = rce || codeWrite || metaWrite;
   if (!canDamage && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
-  if (untrustedTrigger && !privileged && severity && severity !== "advisory") severity = "advisory";
+  if (canDamage && !rce && !codeWrite && severity === "critical") severity = "high";
+  const issueOnlyWrite = metaWrite && !hasPrWritePerm(wf, powerJobs) && !hasCodeWritePerm(wf, powerJobs);
+  if (issueOnlyWrite && !rce && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
+  if (untrustedTrigger && !privileged && !reusable && severity && severity !== "advisory")
+    severity = "advisory";
+  const reusableLoadedGun = reusable && (head === "root" || promptUntrusted);
+  if (reusable && !reusableLoadedGun && severity && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium)
+    severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
   if (secretExposed)
@@ -53351,7 +53547,11 @@ function analyzeWorkflow(path70, content) {
       `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
     );
   else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
-  if (untrustedTrigger && !privileged)
+  else if (reusable)
+    signals.push(
+      reusableLoadedGun ? `reusable workflow (${triggers.join(", ")}) that checks out an untrusted head / ingests untrusted input \u2014 exploitable the moment a caller wires a fork trigger (reachability depends on the caller, but this workflow is built to process attacker input)` : `reusable workflow (${triggers.join(", ")}) \u2014 no untrusted trigger of its own; reachability depends on the caller's trigger + actor gate`
+    );
+  if (forkInput && !privileged && !reusable)
     signals.push(
       "triggered by `pull_request` \u2014 fork PRs run with a read-only token (lower risk than pull_request_target)"
     );
@@ -53363,8 +53563,14 @@ function analyzeWorkflow(path70, content) {
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
+  const noExplicitPerms = wf.permissions == null && jobList(wf).every((j) => j.permissions == null);
+  if (noExplicitPerms && reach > 0 && (broadTools || githubWriteTool))
+    signals.push(
+      "no explicit `permissions:` \u2014 the token defaults to the repo/org setting, which may grant write; set it explicitly to read-only"
+    );
   const mitigations = [];
-  if (explicitGate) mitigations.push("actor-gated (maintainer/label/write-user required)");
+  if (explicitGate || membershipGated)
+    mitigations.push("actor-gated (maintainer/label/write-user required)");
   else if (implicitGate)
     mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
@@ -53417,12 +53623,12 @@ function agentReachableSecrets(wf, agentSteps, agentJobs) {
       found.set(name, classifySecret(name));
     }
   }
-  const idToken = /["']?id-token["']?\s*:\s*["']?write/i.test(str(wf.permissions)) || agentJobs.some((j) => /["']?id-token["']?\s*:\s*["']?write/i.test(str(j.permissions)));
+  const idToken = hasIdTokenWrite(wf, agentJobs);
   const out = [...found].map(([name, kind]) => ({ name, kind }));
   if (idToken) out.push({ name: "id-token (cloud OIDC)", kind: "cloud-oidc" });
   return out;
 }
-function evalAgentJob(job, wf, raw, untrustedTrigger) {
+function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
   const jobSteps = job.steps ?? [];
   const jobAgentSteps = jobSteps.filter(isAgentStep);
   if (jobAgentSteps.length === 0) return null;
@@ -53449,6 +53655,8 @@ function evalAgentJob(job, wf, raw, untrustedTrigger) {
   } else {
     return null;
   }
+  const loadedGun = head === "root" || promptTakesUntrusted(jobAgentSteps);
+  if (reusable && !loadedGun && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
   return { severity, secrets, injectable, canReadEnv };
 }
 function analyzeWorkflowSecrets(path70, content) {
@@ -53461,12 +53669,10 @@ function analyzeWorkflowSecrets(path70, content) {
   const wf = raw;
   const all = allSteps(wf);
   if (!all.some((s) => isAgentStep(s.step))) return null;
-  const triggers = triggerKeys(wf, raw);
-  const untrustedTrigger = triggers.some(
-    (t) => /pull_request_target|workflow_run|issue|pull_request|workflow_call/i.test(t)
-  );
+  const { untrusted: forkInput, reusable } = triggerReach(wf, raw);
+  const untrustedTrigger = forkInput || reusable;
   const agentJobs = [...new Set(all.filter((s) => isAgentStep(s.step)).map((s) => s.job))];
-  const worst = agentJobs.map((job) => evalAgentJob(job, wf, raw, untrustedTrigger)).filter((e) => e !== null).sort((a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity])[0];
+  const worst = agentJobs.map((job) => evalAgentJob(job, wf, raw, untrustedTrigger, reusable)).filter((e) => e !== null).sort((a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity])[0];
   if (!worst) return null;
   return {
     check: "CI-4",
@@ -53509,18 +53715,20 @@ function analyzeAgentConfig(path70, content) {
   }
   const findings = [];
   for (const cmd of hookCommands(cfg.hooks)) {
-    const remote = /\b(npx|curl|wget|iwr|irm)\b/.test(cmd) || /\|\s*(sh|bash)\b/.test(cmd);
-    if (!remote) continue;
-    const unpinned = /@latest\b/.test(cmd) || /\bnpx\b/.test(cmd) && !/@\d/.test(cmd);
+    const remoteExec = /\|\s*(sh|bash|zsh)\b/.test(cmd) || /\b(curl|wget|iwr|irm)\b/.test(cmd);
+    const isNpx = /\bnpx\b/.test(cmd);
+    if (!remoteExec && !isNpx) continue;
+    const unpinned = /@latest\b/.test(cmd) || isNpx && !/@\d/.test(cmd);
+    const high = remoteExec || unpinned;
     findings.push({
       check: "CI-1",
       dimension: "toolRules",
-      severity: unpinned ? "high" : "medium",
-      title: unpinned ? "Agent hook runs UNPINNED third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
+      severity: high ? "high" : "medium",
+      title: high ? "Agent hook runs UNPINNED/remote third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
       file: path70,
       signals: [
         `hook command: \`${cmd.slice(0, 120)}\``,
-        unpinned ? "unpinned \u2014 a compromised/yanked package = code execution on every contributor" : "pinned, but still a standing supply-chain dependency in the agent hot path"
+        remoteExec ? "fetch-and-run (curl|wget / pipe-to-shell) \u2014 unpinnable remote code execution on every contributor" : unpinned ? "unpinned \u2014 a compromised/yanked package = code execution on every contributor" : "pinned, but still a standing supply-chain dependency in the agent hot path"
       ],
       fix: "Vendor the command as a committed local script, or pin an exact version and treat updates as security-reviewed."
     });
@@ -53531,17 +53739,18 @@ function analyzeAgentConfig(path70, content) {
     (a) => /^Bash$|^Bash\(\s*\*|^Bash\(git:|^Write\(\s*\*|^Write$|^Edit$/.test(a)
   );
   if (broad.length > 0) {
+    const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
     findings.push({
       check: "CI-1",
       dimension: "toolRules",
-      severity: "medium",
-      title: "Committed agent config pre-authorizes broad tools",
+      severity: hasBackstop ? "medium" : "high",
+      title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
       file: path70,
       signals: [
         `broad allow(s): ${broad.slice(0, 5).join(", ")}`,
-        ...deny.length === 0 ? ["no `deny` entries to backstop it"] : []
+        hasBackstop ? "a `deny` list backstops the broad allow" : "no `deny` entry covers Bash/Write/Edit \u2014 every contributor is pre-authorized for catastrophic tools"
       ],
-      fix: "Scope the allow-list to specific read-only subcommands (e.g. `Bash(gh pr view:*)`); avoid bare `Bash`/`git:`/`Write`."
+      fix: "Scope the allow-list to specific read-only subcommands (e.g. `Bash(gh pr view:*)`); avoid bare `Bash`/`git:`/`Write`, or add a `deny` backstop."
     });
   }
   return findings;
@@ -53556,8 +53765,11 @@ function analyzeMcp(path70, content) {
   } catch {
     return [];
   }
+  return analyzeMcpServers(cfg.mcpServers ?? {}, path70);
+}
+function analyzeMcpServers(servers, path70) {
   const findings = [];
-  for (const [name, srv] of Object.entries(cfg.mcpServers ?? {})) {
+  for (const [name, srv] of Object.entries(servers ?? {})) {
     if (!srv || srv.disabled) continue;
     const argv = [srv.command, ...Array.isArray(srv.args) ? srv.args.map(String) : []].join(" ");
     if (/\bnpx\b/.test(argv) && (/@latest\b/.test(argv) || !/@\d/.test(argv))) {
@@ -53592,8 +53804,63 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
+// src/ci-check/codex.ts
+import { parse as parseToml5 } from "smol-toml";
+function analyzeCodexConfig(path70, content) {
+  let cfg;
+  try {
+    cfg = parseToml5(content);
+  } catch {
+    return [];
+  }
+  const findings = [];
+  findings.push(...analyzeMcpServers(cfg.mcp_servers ?? {}, path70));
+  const sandbox = typeof cfg.sandbox_mode === "string" ? cfg.sandbox_mode : "";
+  const approval = typeof cfg.approval_policy === "string" ? cfg.approval_policy : "";
+  const fullAccess = /danger-full-access/i.test(sandbox);
+  const noApproval = /^never$/i.test(approval);
+  if (fullAccess || noApproval) {
+    const signals = [
+      fullAccess ? 'sandbox_mode = "danger-full-access" \u2014 the agent runs arbitrary commands with full disk + network access' : null,
+      noApproval ? 'approval_policy = "never" \u2014 no human approval for agent actions' : null
+    ].filter((s) => s !== null);
+    findings.push({
+      check: "CI-1",
+      dimension: "toolRules",
+      severity: fullAccess ? "high" : "medium",
+      title: fullAccess ? "Codex config grants a full-access sandbox" : "Codex config never requires approval",
+      file: path70,
+      signals,
+      fix: 'Commit a least-privilege Codex config: prefer `sandbox_mode = "read-only"` (or `"workspace-write"`) and `approval_policy = "on-request"`/`"on-failure"`. A repo-committed config applies to every contributor who runs Codex here.'
+    });
+  }
+  return findings;
+}
+
 // src/ci-check/instructions.ts
-var HIDDEN_CHARS = /[\u200B\u2060\u202A-\u202E\u2066-\u2069]|[\u{E0000}-\u{E007F}]/u;
+var TAG_CHARS = /[\u{E0000}-\u{E007F}]/u;
+var BIDI_OVERRIDE = /[‭‮]/;
+var BIDI_EMBED_ISOLATE = /[‪-‬⁦-⁩]/;
+function isZwLegitScript(cp) {
+  if (cp === void 0) return false;
+  return cp >= 3584 && cp <= 3711 || cp >= 3712 && cp <= 3839 || cp >= 4096 && cp <= 4255 || cp >= 6016 && cp <= 6143 || cp >= 12352 && cp <= 12543 || cp >= 13312 && cp <= 40959 || cp >= 44032 && cp <= 55215;
+}
+var isAsciiWordChar = (ch) => !!ch && /[A-Za-z0-9]/.test(ch);
+function suspiciousZeroWidth(text) {
+  let n = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c !== 8203 && c !== 8288) continue;
+    if (isZwLegitScript(text.codePointAt(i - 1)) || isZwLegitScript(text.codePointAt(i + 1)))
+      continue;
+    const prev = text[i - 1];
+    const next = text[i + 1];
+    if (!prev || !next || /\s/.test(prev) || /\s/.test(next)) continue;
+    if (isAsciiWordChar(prev) && isAsciiWordChar(next)) n++;
+  }
+  return n;
+}
+var stripZeroWidth = (t) => t.replace(/[​⁠]/g, "");
 var OVERRIDE_RE = /ignore\s+(all\s+)?(previous|prior|the\s+above)\s+(instructions|prompts?|rules)|disregard\s+(the\s+|your\s+)?(system\s+)?(prompt|instructions|rules)|forget\s+(everything|all\s+(previous|prior))|you\s+are\s+now\s+(a|an|the)\b|<\/?system>/i;
 var FETCH_OBEY_RE = /\b(curl|wget|iwr|invoke-webrequest)\b[^\n|]*\|\s*(bash|sh|zsh|python3?|node|iex)\b|\b(curl|wget)\b[^\n]*&&[^\n]*\b(bash|sh)\b/i;
 var SECRET_PATH_RE = /~\/\.aws\/credentials|~\/\.ssh\/id_[a-z]+|~\/\.config\/gh\/hosts|read\s+the\s+(token|secret|api[_ ]?key|password)\s+(in|from)\s+[.`'"]?\.?env/i;
@@ -53624,15 +53891,53 @@ function mk(severity, title, signals, fix, path70) {
 function analyzeInstructionFile(path70, content) {
   const findings = [];
   const decoded = decodeSuspiciousBase64(content);
-  if (HIDDEN_CHARS.test(content)) {
+  if (TAG_CHARS.test(content))
+    findings.push(
+      mk(
+        "critical",
+        "Unicode tag characters in an agent instruction file",
+        [
+          "contains Unicode tag characters (U+E0000\u2013E007F) \u2014 an invisible instruction-smuggling channel with no legitimate use in text"
+        ],
+        "Remove the tag characters. Instruction files must be plain, reviewable text.",
+        path70
+      )
+    );
+  if (BIDI_OVERRIDE.test(content))
     findings.push(
       mk(
         "critical",
-        "Hidden characters in an agent instruction file",
+        "Bidirectional override characters in an agent instruction file",
+        [
+          "contains a bidi override (U+202D/U+202E) \u2014 a Trojan-Source technique that visually reorders text so a human reads something different from what the agent parses"
+        ],
+        "Remove the bidi override characters.",
+        path70
+      )
+    );
+  else if (BIDI_EMBED_ISOLATE.test(content))
+    findings.push(
+      mk(
+        "advisory",
+        "Bidirectional formatting characters in an agent instruction file",
+        [
+          "contains bidi embed/isolate characters (U+202A\u2013202C / U+2066\u20132069) \u2014 legitimate in right-to-left text, but confirm they are not being used to hide or reorder instructions"
+        ],
+        "Confirm the bidi marks are legitimate RTL formatting; remove otherwise.",
+        path70
+      )
+    );
+  const zw = suspiciousZeroWidth(content);
+  if (zw > 0) {
+    const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
+    findings.push(
+      mk(
+        revealed ? "critical" : "medium",
+        "Zero-width characters splitting text in an agent instruction file",
         [
-          "contains zero-width / bidi / Unicode-tag characters \u2014 a technique to hide instructions from human review while the agent still reads them"
+          revealed ? "a zero-width character conceals a prompt-override directive that only appears once the hidden characters are stripped" : "a zero-width character splits a visible Latin word \u2014 a concealment technique (hides text from human review while the agent reads it as contiguous)"
         ],
-        "Remove the hidden characters. Instruction files must be plain, reviewable text.",
+        "Remove the zero-width characters. Instruction files must be plain, reviewable text.",
         path70
       )
     );
@@ -53716,6 +54021,8 @@ function scanTree(tree) {
         findings.push(...analyzeAgentConfig(file.path, file.content));
       } else if (/\.mcp\.json$|\.cursor\/mcp\.json$/.test(file.path)) {
         findings.push(...analyzeMcp(file.path, file.content));
+      } else if (/(^|\/)\.codex\/config\.toml$/.test(file.path)) {
+        findings.push(...analyzeCodexConfig(file.path, file.content));
       } else if (/(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|copilot-instructions\.md$|(^|\/)\.(windsurf|cline)rules$/.test(
         file.path
       )) {