@node9/proxy 1.62.0 → 1.62.1

package/dist/cli.js

@@ -53772,6 +53772,38 @@ function collectTools(steps) {
   }
   return s;
 }
+function toolTokens(blob) {
+  const out = [];
+  let buf = "";
+  let inParen = false;
+  const flush = () => {
+    const t = buf.replace(/[[\]"'`\r\n]/g, "").trim();
+    if (t) out.push(t);
+    buf = "";
+  };
+  for (const ch of blob) {
+    if (ch === "(") inParen = true;
+    else if (ch === ")") inParen = false;
+    if (!inParen && (ch === "," || /\s/.test(ch))) {
+      flush();
+      continue;
+    }
+    buf += ch;
+  }
+  flush();
+  return out;
+}
+function matchedBroadTools(blob) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const tok of toolTokens(blob)) {
+    if (!BROAD_TOOL_RE.test(`,${tok},`)) continue;
+    if (seen.has(tok)) continue;
+    seen.add(tok);
+    out.push(tok.length > 40 ? tok.slice(0, 40) + "\u2026" : tok);
+  }
+  return out;
+}
 function untrustedHeadCheckout(steps) {
   for (const step of steps) {
     if (!step.uses || !/actions\/checkout/.test(step.uses)) continue;
@@ -53998,7 +54030,12 @@ function analyzeWorkflow(path71, content) {
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
-  if (broadTools) signals.push("agent has broad/write-capable tools (Bash/Write/curl/git push)");
+  if (broadTools) {
+    const names = matchedBroadTools(toolsBlob);
+    signals.push(
+      names.length ? `agent has broad/write-capable tools: ${names.map((n) => `\`${n}\``).join(", ")}` : "agent has broad/write-capable tool grants"
+    );
+  }
   if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");

package/dist/cli.mjs

@@ -53765,6 +53765,38 @@ function collectTools(steps) {
   }
   return s;
 }
+function toolTokens(blob) {
+  const out = [];
+  let buf = "";
+  let inParen = false;
+  const flush = () => {
+    const t = buf.replace(/[[\]"'`\r\n]/g, "").trim();
+    if (t) out.push(t);
+    buf = "";
+  };
+  for (const ch of blob) {
+    if (ch === "(") inParen = true;
+    else if (ch === ")") inParen = false;
+    if (!inParen && (ch === "," || /\s/.test(ch))) {
+      flush();
+      continue;
+    }
+    buf += ch;
+  }
+  flush();
+  return out;
+}
+function matchedBroadTools(blob) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const tok of toolTokens(blob)) {
+    if (!BROAD_TOOL_RE.test(`,${tok},`)) continue;
+    if (seen.has(tok)) continue;
+    seen.add(tok);
+    out.push(tok.length > 40 ? tok.slice(0, 40) + "\u2026" : tok);
+  }
+  return out;
+}
 function untrustedHeadCheckout(steps) {
   for (const step of steps) {
     if (!step.uses || !/actions\/checkout/.test(step.uses)) continue;
@@ -53991,7 +54023,12 @@ function analyzeWorkflow(path71, content) {
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
-  if (broadTools) signals.push("agent has broad/write-capable tools (Bash/Write/curl/git push)");
+  if (broadTools) {
+    const names = matchedBroadTools(toolsBlob);
+    signals.push(
+      names.length ? `agent has broad/write-capable tools: ${names.map((n) => `\`${n}\``).join(", ")}` : "agent has broad/write-capable tool grants"
+    );
+  }
   if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.62.0",
+  "version": "1.62.1",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",