@node9/proxy 2.10.0 → 2.12.0

package/README.md

@@ -97,13 +97,13 @@ node9 scan-repo <owner/repo> --json    # machine-readable
 
 What it checks:
 
-| Check    | Flags                                                                        |
-| -------- | ---------------------------------------------------------------------------- |
-| **CI-1** | committed agent config that pre-authorizes broad tools or runs remote hooks  |
-| **CI-2** | injectable agent workflows — an outsider can trigger the agent and hijack it |
-| **CI-3** | unpinned / `@latest` MCP servers or inline credentials (supply chain)        |
-| **CI-4** | secrets an injected agent could exfiltrate                                   |
-| **CI-6** | poisoned or dangerous instructions in `CLAUDE.md` / `AGENTS.md` / skills     |
+| Check    | Flags                                                                            |
+| -------- | -------------------------------------------------------------------------------- |
+| **CI-1** | committed agent config that pre-authorizes broad tools or runs remote hooks      |
+| **CI-2** | injectable agent workflows — an outsider can trigger the agent and hijack it     |
+| **CI-3** | unpinned / `@latest` MCP servers or inline credentials (supply chain)            |
+| **CI-4** | secrets an injected agent could exfiltrate                                       |
+| **CI-6** | poisoned or dangerous instructions in `CLAUDE.md` / `AGENTS.md` / `.cursorrules` |
 
 **Gate every PR** — the same engine as a GitHub Action, so a hijackable config can't get merged:
 
@@ -112,8 +112,14 @@ What it checks:
 - uses: node9-ai/node9-proxy@v2
   with:
     fail-on: high # or 'never' to just comment
+    fail-on-scope: introduced # only what THIS PR added; 'all' (default) judges the whole repo
 ```
 
+`fail-on-scope: introduced` is what makes the gate adoptable on a repository that already
+has findings: the PR comment leads with what the change introduced, pre-existing findings
+stay listed but do not block, and a base commit that cannot be read falls back to judging
+everything rather than passing.
+
 Marketplace: **[node9 Agent Security](https://github.com/marketplace/actions/node9-agent-security)**
 
 Running it? Add the **[`scanned by node9` badge](docs/badges.md)** to your README.

package/dist/cli.js

@@ -57936,6 +57936,50 @@ function readLocalTree(dir) {
   }
   return { source: root, files, notes };
 }
+function readGitRefTree(dir, ref) {
+  const root = dir.replace(/^~/, process.env.HOME ?? "~");
+  if (!ref || ref.startsWith("-")) return null;
+  const git = (args) => {
+    try {
+      return (0, import_node_child_process.execFileSync)("git", ["-C", root, ...args], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 32 * 1024 * 1024,
+        timeout: 2e4
+      });
+    } catch {
+      return null;
+    }
+  };
+  const sha = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`])?.trim();
+  if (!sha) return null;
+  const listing = git(["ls-tree", "-r", "--name-only", "-z", sha]);
+  if (listing === null) return null;
+  const all = listing.split("\0").filter(Boolean);
+  const notes = [];
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  const present = new Set(all);
+  const add = (rel) => {
+    if (seen.has(rel) || !present.has(rel)) return;
+    seen.add(rel);
+    const content = git(["show", `${sha}:${rel}`]);
+    if (content !== null) files.push({ path: rel, content });
+  };
+  for (const rel of SURFACE_FILES) add(rel);
+  const nested = all.filter((rel) => SURFACE_BASENAME.test(rel) && !isIgnoredDir(rel));
+  if (nested.length > MAX_SURFACE_FILES) {
+    notes.push(
+      `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files).`
+    );
+  }
+  for (const rel of nested.slice(0, MAX_SURFACE_FILES)) add(rel);
+  for (const rel of all) {
+    if (rel.startsWith(`${WORKFLOW_DIR}/`) && /\.ya?ml$/.test(rel) && !rel.slice(WORKFLOW_DIR.length + 1).includes("/"))
+      add(rel);
+  }
+  return { source: `${root}@${ref}`, files, notes };
+}
 async function fetchTree(input, onProgress) {
   if (isLocalPath(input)) return readLocalTree(input);
   const parsed = parseRepoUrl(input);
@@ -58357,6 +58401,8 @@ function analyzeWorkflow(path77, content) {
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
   return {
     check: "CI-2",
+    // One verdict per workflow file — the finding IS the file's reachability score.
+    rule: "CI-2.injectable-workflow",
     dimension: "workflows",
     severity,
     title,
@@ -58453,6 +58499,7 @@ function analyzeWorkflowSecrets(path77, content) {
   if (!worst) return null;
   return {
     check: "CI-4",
+    rule: "CI-4.agent-reachable-secret",
     dimension: "data",
     severity: worst.severity,
     title: worst.severity === "advisory" ? "Secrets reachable by the agent \u2014 hardening" : "Exfiltratable secrets reachable by an injectable agent",
@@ -58499,6 +58546,10 @@ function analyzeAgentConfig(path77, content) {
     const high = remoteExec || unpinned;
     findings.push({
       check: "CI-1",
+      rule: "CI-1.hook-remote-code",
+      // Identity is the command itself: the same hook keeps its identity when its
+      // severity changes (pinned → unpinned), and two different hooks stay distinct.
+      locator: cmd,
       dimension: "toolRules",
       severity: high ? "high" : "medium",
       title: high ? "Agent hook runs UNPINNED/remote third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
@@ -58519,6 +58570,9 @@ function analyzeAgentConfig(path77, content) {
     const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
     findings.push({
       check: "CI-1",
+      rule: "CI-1.broad-allow",
+      // File-level: one finding per config file. Adding a SECOND broad allow makes the
+      // same statement about the same file, so it must not read as a new finding.
       dimension: "toolRules",
       severity: hasBackstop ? "medium" : "high",
       title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
@@ -58552,6 +58606,8 @@ function analyzeMcpServers(servers, path77) {
     if (/\bnpx\b/.test(argv) && (/@latest\b/.test(argv) || !/@\d/.test(argv))) {
       findings.push({
         check: "CI-3",
+        rule: "CI-3.mcp-unpinned",
+        locator: name,
         dimension: "mcp",
         severity: "medium",
         title: `MCP server "${name}" runs an unpinned executable`,
@@ -58566,6 +58622,8 @@ function analyzeMcpServers(servers, path77) {
       if (hit) {
         findings.push({
           check: "CI-3",
+          rule: "CI-3.mcp-inline-credential",
+          locator: `${name}.env.${k}`,
           dimension: "mcp",
           severity: "high",
           title: `MCP server "${name}" has an inline credential`,
@@ -58603,6 +58661,10 @@ function analyzeCodexConfig(path77, content) {
     ].filter((s) => s !== null);
     findings.push({
       check: "CI-1",
+      // One finding per Codex config; `danger-full-access` vs `approval_policy = never`
+      // are two severities of the same statement, so tightening one is a de-escalation
+      // of THIS finding rather than the removal of one and the arrival of another.
+      rule: "CI-1.codex-unsafe-defaults",
       dimension: "toolRules",
       severity: fullAccess ? "high" : "medium",
       title: fullAccess ? "Codex config grants a full-access sandbox" : "Codex config never requires approval",
@@ -58662,8 +58724,17 @@ function decodeSuspiciousBase64(text) {
   }
   return out;
 }
-function mk(severity, title, signals, fix, path77) {
-  return { check: "CI-6", dimension: "instructions", severity, title, file: path77, signals, fix };
+function mk(rule, severity, title, signals, fix, path77) {
+  return {
+    check: "CI-6",
+    rule,
+    dimension: "instructions",
+    severity,
+    title,
+    file: path77,
+    signals,
+    fix
+  };
 }
 function analyzeInstructionFile(path77, content) {
   const findings = [];
@@ -58671,6 +58742,7 @@ function analyzeInstructionFile(path77, content) {
   if (TAG_CHARS.test(content))
     findings.push(
       mk(
+        "CI-6.unicode-tag-chars",
         "critical",
         "Unicode tag characters in an agent instruction file",
         [
@@ -58683,6 +58755,7 @@ function analyzeInstructionFile(path77, content) {
   if (BIDI_OVERRIDE.test(content))
     findings.push(
       mk(
+        "CI-6.bidi-override",
         "critical",
         "Bidirectional override characters in an agent instruction file",
         [
@@ -58695,6 +58768,7 @@ function analyzeInstructionFile(path77, content) {
   else if (BIDI_EMBED_ISOLATE.test(content))
     findings.push(
       mk(
+        "CI-6.bidi-formatting",
         "advisory",
         "Bidirectional formatting characters in an agent instruction file",
         [
@@ -58709,6 +58783,7 @@ function analyzeInstructionFile(path77, content) {
     const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
     findings.push(
       mk(
+        "CI-6.zero-width",
         revealed ? "critical" : "medium",
         "Zero-width characters splitting text in an agent instruction file",
         [
@@ -58725,6 +58800,7 @@ function analyzeInstructionFile(path77, content) {
     const m = ov || ovEnc;
     findings.push(
       mk(
+        "CI-6.prompt-override",
         ovEnc ? "critical" : "high",
         "Prompt-override directive in an agent instruction file",
         [
@@ -58739,6 +58815,7 @@ function analyzeInstructionFile(path77, content) {
   if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
     findings.push(
       mk(
+        "CI-6.fetch-and-obey",
         "medium",
         "Instruction directs the agent to fetch and run remote code",
         [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
@@ -58751,6 +58828,7 @@ function analyzeInstructionFile(path77, content) {
   if (sp && !isNegated(content, sp.index)) {
     findings.push(
       mk(
+        "CI-6.secret-path",
         "medium",
         "Instruction points the agent at credential material",
         [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
@@ -58763,6 +58841,7 @@ function analyzeInstructionFile(path77, content) {
   if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
     findings.push(
       mk(
+        "CI-6.exfil-directive",
         "medium",
         "Instruction directs the agent to send data to an external endpoint",
         [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
@@ -58774,8 +58853,82 @@ function analyzeInstructionFile(path77, content) {
   return findings;
 }
 
+// src/ci-check/diff.ts
+var import_node_crypto = require("crypto");
+function fingerprintOf(f) {
+  const key = JSON.stringify([f.rule, f.file, f.locator ?? "", f.ordinal ?? 0]);
+  return (0, import_node_crypto.createHash)("sha256").update(key).digest("hex").slice(0, 16);
+}
+function assignOrdinals(findings) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const key = JSON.stringify([f.rule, f.file, f.locator ?? ""]);
+    const n = seen.get(key) ?? 0;
+    if (n > 0) f.ordinal = n;
+    seen.set(key, n + 1);
+  }
+  return findings;
+}
+function worstOf(severities) {
+  let worst = null;
+  for (const s of severities) {
+    if (!worst || SEVERITY_RANK2[s] > SEVERITY_RANK2[worst]) worst = s;
+  }
+  return worst;
+}
+function baseStateOf(base) {
+  if (!base) return "did-not-run";
+  return base.incomplete ? "incomplete" : "ok";
+}
+function diffScans(base, head) {
+  const state = baseStateOf(base);
+  if (state !== "ok" || !base) {
+    return {
+      base: state,
+      added: [],
+      removed: [],
+      unchanged: [...head.findings],
+      escalated: [],
+      worstIntroduced: head.worst,
+      incomplete: true
+    };
+  }
+  const baseByFp = /* @__PURE__ */ new Map();
+  for (const f of base.findings) baseByFp.set(fingerprintOf(f), f);
+  const added = [];
+  const unchanged = [];
+  const escalated = [];
+  const matched = /* @__PURE__ */ new Set();
+  for (const f of head.findings) {
+    const fp = fingerprintOf(f);
+    const prior = baseByFp.get(fp);
+    if (!prior) {
+      added.push(f);
+      continue;
+    }
+    matched.add(fp);
+    if (SEVERITY_RANK2[f.severity] > SEVERITY_RANK2[prior.severity]) {
+      escalated.push({ finding: f, from: prior.severity, to: f.severity });
+    } else {
+      unchanged.push(f);
+    }
+  }
+  const removed = base.findings.filter((f) => !matched.has(fingerprintOf(f)));
+  return {
+    base: state,
+    added,
+    removed,
+    unchanged,
+    escalated,
+    worstIntroduced: worstOf([...added.map((f) => f.severity), ...escalated.map((e) => e.to)]),
+    // The head side of the same guard: a scan that could not read every file has not
+    // earned the word "clean", however trustworthy the base was.
+    incomplete: head.incomplete
+  };
+}
+
 // src/ci-check/index.ts
-function worstOf(findings) {
+function worstOf2(findings) {
   let worst = null;
   for (const f of findings) {
     if (!worst || SEVERITY_RANK2[f.severity] > SEVERITY_RANK2[worst]) worst = f.severity;
@@ -58809,11 +58962,12 @@ function scanTree(tree) {
       notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
     }
   }
+  assignOrdinals(findings);
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
   const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
+  return { source: tree.source, findings, inspected, notes, worst: worstOf2(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -58867,12 +59021,37 @@ function renderCta(res) {
 function ownedHint(source) {
   return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
 }
-function renderScan(res) {
+function findingMd(f, L) {
+  L.push(`**${ICON2[f.severity]} ${f.severity.toUpperCase()} \u2014 ${f.title}**`);
+  L.push(`\`${f.file}${f.line ? ":" + f.line : ""}\`  \xB7  ${f.rule}`);
+  L.push("");
+  for (const s of f.signals) L.push(`- ${s}`);
+  if (f.mitigations?.length) L.push(`- _mitigated:_ ${f.mitigations.join("; ")}`);
+  L.push("");
+  L.push(`\u2192 **Fix:** ${f.fix}`);
+  L.push("");
+}
+function baseWarning(base) {
+  return base === "did-not-run" ? '\u26A0\uFE0F **Could not read the base commit**, so nothing below can be called "new" \u2014 every finding in this repo is listed. (A shallow clone is the usual cause: fetch the base ref.)' : "\u26A0\uFE0F **The base scan could not read every file**, so a finding missing from it would look new. Every finding in this repo is listed instead.";
+}
+function renderScan(res, diff) {
   const L = [];
   const n = res.findings.length;
   const head = res.worst === "critical" || res.worst === "high" ? import_chalk32.default.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? import_chalk32.default.yellow("agent-security notes") : res.incomplete ? import_chalk32.default.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : import_chalk32.default.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${import_chalk32.default.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(import_chalk32.default.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (diff) {
+    const introduced = diff.added.length + diff.escalated.length;
+    L.push(
+      diff.base !== "ok" ? import_chalk32.default.yellow.bold(
+        `   \u26A0\uFE0F  base ${diff.base === "did-not-run" ? "could not be read" : "scan was incomplete"} \u2014 cannot say what is new; showing everything`
+      ) : introduced > 0 ? import_chalk32.default.red.bold(
+        `   \u26A0\uFE0F  this change introduced ${introduced} finding(s)` + (diff.escalated.length ? ` (${diff.escalated.length} by widening an existing one)` : "")
+      ) : import_chalk32.default.green(
+        `   \u2705 this change introduced nothing` + (diff.unchanged.length ? ` (${diff.unchanged.length} pre-existing)` : "") + (diff.removed.length ? `, and fixed ${diff.removed.length}` : "")
+      )
+    );
+  }
   if (res.incomplete) {
     const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
@@ -58912,7 +59091,7 @@ function renderScan(res) {
   L.push(...renderCta(res));
   return L.join("\n");
 }
-function renderScanMarkdown(res) {
+function renderScanMarkdown(res, diff) {
   const L = [];
   const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
@@ -58921,25 +59100,57 @@ function renderScanMarkdown(res) {
     `Inspected ${res.inspected.length} config file(s) \xB7 **${res.findings.length} finding(s)**`
   );
   L.push("");
-  for (const f of res.findings) {
-    L.push(`**${ICON2[f.severity]} ${f.severity.toUpperCase()} \u2014 ${f.title}**`);
-    L.push(`\`${f.file}${f.line ? ":" + f.line : ""}\` \xB7 ${f.check}`);
-    L.push("");
-    for (const s of f.signals) L.push(`- ${s}`);
-    if (f.mitigations?.length) L.push(`- _mitigated:_ ${f.mitigations.join("; ")}`);
-    L.push("");
-    L.push(`\u2192 **Fix:** ${f.fix}`);
+  if (diff && diff.base === "ok") {
+    const introduced = [...diff.added, ...diff.escalated.map((e) => e.finding)];
+    if (introduced.length === 0) {
+      L.push(
+        `\u2705 **This change introduces no agent-security findings.**` + (diff.removed.length ? ` It also fixes ${diff.removed.length}.` : "")
+      );
+      L.push("");
+    } else {
+      L.push(`#### \u26A0\uFE0F Introduced by this change \u2014 ${introduced.length} finding(s)`);
+      L.push("");
+      for (const f of diff.added) findingMd(f, L);
+      for (const e of diff.escalated) {
+        L.push(
+          `> _Guardrail erosion: this finding already existed at **${e.from}** and this change widens it to **${e.to}**._`
+        );
+        L.push("");
+        findingMd(e.finding, L);
+      }
+    }
+    if (diff.removed.length) {
+      L.push(`\u2705 Fixed by this change: ${diff.removed.length} finding(s).`);
+      L.push("");
+    }
+    if (diff.unchanged.length) {
+      L.push(
+        `<details><summary>${diff.unchanged.length} pre-existing finding(s) \u2014 not introduced by this change</summary>`
+      );
+      L.push("");
+      for (const f of diff.unchanged) findingMd(f, L);
+      L.push("</details>");
+      L.push("");
+    }
+    return L.join("\n");
+  }
+  if (diff) {
+    L.push(baseWarning(diff.base));
     L.push("");
   }
+  for (const f of res.findings) findingMd(f, L);
   if (res.findings.length === 0) L.push("No committed agent-security issues found.");
   return L.join("\n");
 }
-function exitCodeFor(res) {
-  if (res.worst === "critical" || res.worst === "high") return 2;
-  if (res.worst === "medium") return 1;
-  if (res.incomplete) return 3;
+function exitCodeForSeverity(worst, incomplete) {
+  if (worst === "critical" || worst === "high") return 2;
+  if (worst === "medium") return 1;
+  if (incomplete) return 3;
   return 0;
 }
+function exitCodeFor(res) {
+  return exitCodeForSeverity(res.worst, res.incomplete);
+}
 
 // src/cli/commands/scan-repo.ts
 var SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -58965,23 +59176,36 @@ function makeProgress(target, quiet) {
   };
 }
 function registerScanRepoCommand(program2) {
-  program2.command("scan-repo <target>").description("Scan a repo's agent-security surface (GitHub URL or local path)").option("--json", "emit the raw result as JSON").option("--markdown", "emit a Markdown report (for a PR comment)").action(async (target, opts) => {
-    const { onProgress, done } = makeProgress(target, !!(opts.json || opts.markdown));
-    let res;
-    try {
-      res = await scanRepo(target, onProgress);
-    } finally {
-      done();
-    }
-    if (opts.json) {
-      console.log(JSON.stringify(res, null, 2));
-    } else if (opts.markdown) {
-      console.log(renderScanMarkdown(res));
-    } else {
-      console.log(renderScan(res));
+  program2.command("scan-repo <target>").description("Scan a repo's agent-security surface (GitHub URL or local path)").option("--json", "emit the raw result as JSON").option("--markdown", "emit a Markdown report (for a PR comment)").option(
+    "--base <ref>",
+    "also scan this git ref and report what the working tree INTRODUCED (local path targets only)"
+  ).option(
+    "--fail-on-introduced",
+    "exit non-zero only for findings this change introduced (requires --base)"
+  ).action(
+    async (target, opts) => {
+      const { onProgress, done } = makeProgress(target, !!(opts.json || opts.markdown));
+      let res;
+      try {
+        res = await scanRepo(target, onProgress);
+      } finally {
+        done();
+      }
+      let diff;
+      if (opts.base) {
+        const baseTree = readGitRefTree(target, opts.base);
+        diff = diffScans(baseTree ? scanTree(baseTree) : null, res);
+      }
+      if (opts.json) {
+        console.log(JSON.stringify(diff ? { ...res, diff } : res, null, 2));
+      } else if (opts.markdown) {
+        console.log(renderScanMarkdown(res, diff));
+      } else {
+        console.log(renderScan(res, diff));
+      }
+      process.exitCode = opts.failOnIntroduced && diff ? exitCodeForSeverity(diff.worstIntroduced, diff.incomplete) : exitCodeFor(res);
     }
-    process.exitCode = exitCodeFor(res);
-  });
+  );
 }
 
 // src/cli/commands/egress.ts

package/dist/cli.mjs

@@ -57928,6 +57928,50 @@ function readLocalTree(dir) {
   }
   return { source: root, files, notes };
 }
+function readGitRefTree(dir, ref) {
+  const root = dir.replace(/^~/, process.env.HOME ?? "~");
+  if (!ref || ref.startsWith("-")) return null;
+  const git = (args) => {
+    try {
+      return execFileSync2("git", ["-C", root, ...args], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 32 * 1024 * 1024,
+        timeout: 2e4
+      });
+    } catch {
+      return null;
+    }
+  };
+  const sha = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`])?.trim();
+  if (!sha) return null;
+  const listing = git(["ls-tree", "-r", "--name-only", "-z", sha]);
+  if (listing === null) return null;
+  const all = listing.split("\0").filter(Boolean);
+  const notes = [];
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  const present = new Set(all);
+  const add = (rel) => {
+    if (seen.has(rel) || !present.has(rel)) return;
+    seen.add(rel);
+    const content = git(["show", `${sha}:${rel}`]);
+    if (content !== null) files.push({ path: rel, content });
+  };
+  for (const rel of SURFACE_FILES) add(rel);
+  const nested = all.filter((rel) => SURFACE_BASENAME.test(rel) && !isIgnoredDir(rel));
+  if (nested.length > MAX_SURFACE_FILES) {
+    notes.push(
+      `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files).`
+    );
+  }
+  for (const rel of nested.slice(0, MAX_SURFACE_FILES)) add(rel);
+  for (const rel of all) {
+    if (rel.startsWith(`${WORKFLOW_DIR}/`) && /\.ya?ml$/.test(rel) && !rel.slice(WORKFLOW_DIR.length + 1).includes("/"))
+      add(rel);
+  }
+  return { source: `${root}@${ref}`, files, notes };
+}
 async function fetchTree(input, onProgress) {
   if (isLocalPath(input)) return readLocalTree(input);
   const parsed = parseRepoUrl(input);
@@ -58349,6 +58393,8 @@ function analyzeWorkflow(path77, content) {
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
   return {
     check: "CI-2",
+    // One verdict per workflow file — the finding IS the file's reachability score.
+    rule: "CI-2.injectable-workflow",
     dimension: "workflows",
     severity,
     title,
@@ -58445,6 +58491,7 @@ function analyzeWorkflowSecrets(path77, content) {
   if (!worst) return null;
   return {
     check: "CI-4",
+    rule: "CI-4.agent-reachable-secret",
     dimension: "data",
     severity: worst.severity,
     title: worst.severity === "advisory" ? "Secrets reachable by the agent \u2014 hardening" : "Exfiltratable secrets reachable by an injectable agent",
@@ -58491,6 +58538,10 @@ function analyzeAgentConfig(path77, content) {
     const high = remoteExec || unpinned;
     findings.push({
       check: "CI-1",
+      rule: "CI-1.hook-remote-code",
+      // Identity is the command itself: the same hook keeps its identity when its
+      // severity changes (pinned → unpinned), and two different hooks stay distinct.
+      locator: cmd,
       dimension: "toolRules",
       severity: high ? "high" : "medium",
       title: high ? "Agent hook runs UNPINNED/remote third-party code on every action" : "Agent hook runs third-party code in the agent hot path",
@@ -58511,6 +58562,9 @@ function analyzeAgentConfig(path77, content) {
     const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
     findings.push({
       check: "CI-1",
+      rule: "CI-1.broad-allow",
+      // File-level: one finding per config file. Adding a SECOND broad allow makes the
+      // same statement about the same file, so it must not read as a new finding.
       dimension: "toolRules",
       severity: hasBackstop ? "medium" : "high",
       title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
@@ -58544,6 +58598,8 @@ function analyzeMcpServers(servers, path77) {
     if (/\bnpx\b/.test(argv) && (/@latest\b/.test(argv) || !/@\d/.test(argv))) {
       findings.push({
         check: "CI-3",
+        rule: "CI-3.mcp-unpinned",
+        locator: name,
         dimension: "mcp",
         severity: "medium",
         title: `MCP server "${name}" runs an unpinned executable`,
@@ -58558,6 +58614,8 @@ function analyzeMcpServers(servers, path77) {
       if (hit) {
         findings.push({
           check: "CI-3",
+          rule: "CI-3.mcp-inline-credential",
+          locator: `${name}.env.${k}`,
           dimension: "mcp",
           severity: "high",
           title: `MCP server "${name}" has an inline credential`,
@@ -58595,6 +58653,10 @@ function analyzeCodexConfig(path77, content) {
     ].filter((s) => s !== null);
     findings.push({
       check: "CI-1",
+      // One finding per Codex config; `danger-full-access` vs `approval_policy = never`
+      // are two severities of the same statement, so tightening one is a de-escalation
+      // of THIS finding rather than the removal of one and the arrival of another.
+      rule: "CI-1.codex-unsafe-defaults",
       dimension: "toolRules",
       severity: fullAccess ? "high" : "medium",
       title: fullAccess ? "Codex config grants a full-access sandbox" : "Codex config never requires approval",
@@ -58654,8 +58716,17 @@ function decodeSuspiciousBase64(text) {
   }
   return out;
 }
-function mk(severity, title, signals, fix, path77) {
-  return { check: "CI-6", dimension: "instructions", severity, title, file: path77, signals, fix };
+function mk(rule, severity, title, signals, fix, path77) {
+  return {
+    check: "CI-6",
+    rule,
+    dimension: "instructions",
+    severity,
+    title,
+    file: path77,
+    signals,
+    fix
+  };
 }
 function analyzeInstructionFile(path77, content) {
   const findings = [];
@@ -58663,6 +58734,7 @@ function analyzeInstructionFile(path77, content) {
   if (TAG_CHARS.test(content))
     findings.push(
       mk(
+        "CI-6.unicode-tag-chars",
         "critical",
         "Unicode tag characters in an agent instruction file",
         [
@@ -58675,6 +58747,7 @@ function analyzeInstructionFile(path77, content) {
   if (BIDI_OVERRIDE.test(content))
     findings.push(
       mk(
+        "CI-6.bidi-override",
         "critical",
         "Bidirectional override characters in an agent instruction file",
         [
@@ -58687,6 +58760,7 @@ function analyzeInstructionFile(path77, content) {
   else if (BIDI_EMBED_ISOLATE.test(content))
     findings.push(
       mk(
+        "CI-6.bidi-formatting",
         "advisory",
         "Bidirectional formatting characters in an agent instruction file",
         [
@@ -58701,6 +58775,7 @@ function analyzeInstructionFile(path77, content) {
     const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
     findings.push(
       mk(
+        "CI-6.zero-width",
         revealed ? "critical" : "medium",
         "Zero-width characters splitting text in an agent instruction file",
         [
@@ -58717,6 +58792,7 @@ function analyzeInstructionFile(path77, content) {
     const m = ov || ovEnc;
     findings.push(
       mk(
+        "CI-6.prompt-override",
         ovEnc ? "critical" : "high",
         "Prompt-override directive in an agent instruction file",
         [
@@ -58731,6 +58807,7 @@ function analyzeInstructionFile(path77, content) {
   if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
     findings.push(
       mk(
+        "CI-6.fetch-and-obey",
         "medium",
         "Instruction directs the agent to fetch and run remote code",
         [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
@@ -58743,6 +58820,7 @@ function analyzeInstructionFile(path77, content) {
   if (sp && !isNegated(content, sp.index)) {
     findings.push(
       mk(
+        "CI-6.secret-path",
         "medium",
         "Instruction points the agent at credential material",
         [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
@@ -58755,6 +58833,7 @@ function analyzeInstructionFile(path77, content) {
   if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
     findings.push(
       mk(
+        "CI-6.exfil-directive",
         "medium",
         "Instruction directs the agent to send data to an external endpoint",
         [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
@@ -58766,8 +58845,82 @@ function analyzeInstructionFile(path77, content) {
   return findings;
 }
 
+// src/ci-check/diff.ts
+import { createHash as createHash4 } from "crypto";
+function fingerprintOf(f) {
+  const key = JSON.stringify([f.rule, f.file, f.locator ?? "", f.ordinal ?? 0]);
+  return createHash4("sha256").update(key).digest("hex").slice(0, 16);
+}
+function assignOrdinals(findings) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const key = JSON.stringify([f.rule, f.file, f.locator ?? ""]);
+    const n = seen.get(key) ?? 0;
+    if (n > 0) f.ordinal = n;
+    seen.set(key, n + 1);
+  }
+  return findings;
+}
+function worstOf(severities) {
+  let worst = null;
+  for (const s of severities) {
+    if (!worst || SEVERITY_RANK2[s] > SEVERITY_RANK2[worst]) worst = s;
+  }
+  return worst;
+}
+function baseStateOf(base) {
+  if (!base) return "did-not-run";
+  return base.incomplete ? "incomplete" : "ok";
+}
+function diffScans(base, head) {
+  const state = baseStateOf(base);
+  if (state !== "ok" || !base) {
+    return {
+      base: state,
+      added: [],
+      removed: [],
+      unchanged: [...head.findings],
+      escalated: [],
+      worstIntroduced: head.worst,
+      incomplete: true
+    };
+  }
+  const baseByFp = /* @__PURE__ */ new Map();
+  for (const f of base.findings) baseByFp.set(fingerprintOf(f), f);
+  const added = [];
+  const unchanged = [];
+  const escalated = [];
+  const matched = /* @__PURE__ */ new Set();
+  for (const f of head.findings) {
+    const fp = fingerprintOf(f);
+    const prior = baseByFp.get(fp);
+    if (!prior) {
+      added.push(f);
+      continue;
+    }
+    matched.add(fp);
+    if (SEVERITY_RANK2[f.severity] > SEVERITY_RANK2[prior.severity]) {
+      escalated.push({ finding: f, from: prior.severity, to: f.severity });
+    } else {
+      unchanged.push(f);
+    }
+  }
+  const removed = base.findings.filter((f) => !matched.has(fingerprintOf(f)));
+  return {
+    base: state,
+    added,
+    removed,
+    unchanged,
+    escalated,
+    worstIntroduced: worstOf([...added.map((f) => f.severity), ...escalated.map((e) => e.to)]),
+    // The head side of the same guard: a scan that could not read every file has not
+    // earned the word "clean", however trustworthy the base was.
+    incomplete: head.incomplete
+  };
+}
+
 // src/ci-check/index.ts
-function worstOf(findings) {
+function worstOf2(findings) {
   let worst = null;
   for (const f of findings) {
     if (!worst || SEVERITY_RANK2[f.severity] > SEVERITY_RANK2[worst]) worst = f.severity;
@@ -58801,11 +58954,12 @@ function scanTree(tree) {
       notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
     }
   }
+  assignOrdinals(findings);
   findings.sort(
     (a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity] || a.file.localeCompare(b.file)
   );
   const incomplete = notes.some((nt) => /may be INCOMPLETE/i.test(nt));
-  return { source: tree.source, findings, inspected, notes, worst: worstOf(findings), incomplete };
+  return { source: tree.source, findings, inspected, notes, worst: worstOf2(findings), incomplete };
 }
 async function scanRepo(input, onProgress) {
   const tree = await fetchTree(input, onProgress);
@@ -58859,12 +59013,37 @@ function renderCta(res) {
 function ownedHint(source) {
   return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
 }
-function renderScan(res) {
+function findingMd(f, L) {
+  L.push(`**${ICON2[f.severity]} ${f.severity.toUpperCase()} \u2014 ${f.title}**`);
+  L.push(`\`${f.file}${f.line ? ":" + f.line : ""}\`  \xB7  ${f.rule}`);
+  L.push("");
+  for (const s of f.signals) L.push(`- ${s}`);
+  if (f.mitigations?.length) L.push(`- _mitigated:_ ${f.mitigations.join("; ")}`);
+  L.push("");
+  L.push(`\u2192 **Fix:** ${f.fix}`);
+  L.push("");
+}
+function baseWarning(base) {
+  return base === "did-not-run" ? '\u26A0\uFE0F **Could not read the base commit**, so nothing below can be called "new" \u2014 every finding in this repo is listed. (A shallow clone is the usual cause: fetch the base ref.)' : "\u26A0\uFE0F **The base scan could not read every file**, so a finding missing from it would look new. Every finding in this repo is listed instead.";
+}
+function renderScan(res, diff) {
   const L = [];
   const n = res.findings.length;
   const head = res.worst === "critical" || res.worst === "high" ? chalk32.red.bold("\u26A0\uFE0F  agent-security risk found") : res.worst ? chalk32.yellow("agent-security notes") : res.incomplete ? chalk32.yellow.bold("\u26A0\uFE0F  INCOMPLETE \u2014 could not read all files") : chalk32.green("\u2705 agent-security: clean");
   L.push(`\u{1F6E1}\uFE0F  ${chalk32.bold("node9 scan-repo")}  \xB7  ${res.source}  \xB7  ${head}`);
   L.push(chalk32.gray(`   inspected ${res.inspected.length} config file(s), ${n} finding(s)`));
+  if (diff) {
+    const introduced = diff.added.length + diff.escalated.length;
+    L.push(
+      diff.base !== "ok" ? chalk32.yellow.bold(
+        `   \u26A0\uFE0F  base ${diff.base === "did-not-run" ? "could not be read" : "scan was incomplete"} \u2014 cannot say what is new; showing everything`
+      ) : introduced > 0 ? chalk32.red.bold(
+        `   \u26A0\uFE0F  this change introduced ${introduced} finding(s)` + (diff.escalated.length ? ` (${diff.escalated.length} by widening an existing one)` : "")
+      ) : chalk32.green(
+        `   \u2705 this change introduced nothing` + (diff.unchanged.length ? ` (${diff.unchanged.length} pre-existing)` : "") + (diff.removed.length ? `, and fixed ${diff.removed.length}` : "")
+      )
+    );
+  }
   if (res.incomplete) {
     const rateLimited = res.notes.some((nt) => /rate limit/i.test(nt));
     L.push(
@@ -58904,7 +59083,7 @@ function renderScan(res) {
   L.push(...renderCta(res));
   return L.join("\n");
 }
-function renderScanMarkdown(res) {
+function renderScanMarkdown(res, diff) {
   const L = [];
   const status = res.worst === "critical" || res.worst === "high" ? "\u26A0\uFE0F" : res.worst ? "\u{1F7E1}" : res.incomplete ? "\u26A0\uFE0F" : "\u2705";
   L.push(`### \u{1F6E1}\uFE0F node9 agent-security \xB7 \`${res.source}\` \xB7 ${status}`);
@@ -58913,25 +59092,57 @@ function renderScanMarkdown(res) {
     `Inspected ${res.inspected.length} config file(s) \xB7 **${res.findings.length} finding(s)**`
   );
   L.push("");
-  for (const f of res.findings) {
-    L.push(`**${ICON2[f.severity]} ${f.severity.toUpperCase()} \u2014 ${f.title}**`);
-    L.push(`\`${f.file}${f.line ? ":" + f.line : ""}\` \xB7 ${f.check}`);
-    L.push("");
-    for (const s of f.signals) L.push(`- ${s}`);
-    if (f.mitigations?.length) L.push(`- _mitigated:_ ${f.mitigations.join("; ")}`);
-    L.push("");
-    L.push(`\u2192 **Fix:** ${f.fix}`);
+  if (diff && diff.base === "ok") {
+    const introduced = [...diff.added, ...diff.escalated.map((e) => e.finding)];
+    if (introduced.length === 0) {
+      L.push(
+        `\u2705 **This change introduces no agent-security findings.**` + (diff.removed.length ? ` It also fixes ${diff.removed.length}.` : "")
+      );
+      L.push("");
+    } else {
+      L.push(`#### \u26A0\uFE0F Introduced by this change \u2014 ${introduced.length} finding(s)`);
+      L.push("");
+      for (const f of diff.added) findingMd(f, L);
+      for (const e of diff.escalated) {
+        L.push(
+          `> _Guardrail erosion: this finding already existed at **${e.from}** and this change widens it to **${e.to}**._`
+        );
+        L.push("");
+        findingMd(e.finding, L);
+      }
+    }
+    if (diff.removed.length) {
+      L.push(`\u2705 Fixed by this change: ${diff.removed.length} finding(s).`);
+      L.push("");
+    }
+    if (diff.unchanged.length) {
+      L.push(
+        `<details><summary>${diff.unchanged.length} pre-existing finding(s) \u2014 not introduced by this change</summary>`
+      );
+      L.push("");
+      for (const f of diff.unchanged) findingMd(f, L);
+      L.push("</details>");
+      L.push("");
+    }
+    return L.join("\n");
+  }
+  if (diff) {
+    L.push(baseWarning(diff.base));
     L.push("");
   }
+  for (const f of res.findings) findingMd(f, L);
   if (res.findings.length === 0) L.push("No committed agent-security issues found.");
   return L.join("\n");
 }
-function exitCodeFor(res) {
-  if (res.worst === "critical" || res.worst === "high") return 2;
-  if (res.worst === "medium") return 1;
-  if (res.incomplete) return 3;
+function exitCodeForSeverity(worst, incomplete) {
+  if (worst === "critical" || worst === "high") return 2;
+  if (worst === "medium") return 1;
+  if (incomplete) return 3;
   return 0;
 }
+function exitCodeFor(res) {
+  return exitCodeForSeverity(res.worst, res.incomplete);
+}
 
 // src/cli/commands/scan-repo.ts
 var SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -58957,23 +59168,36 @@ function makeProgress(target, quiet) {
   };
 }
 function registerScanRepoCommand(program2) {
-  program2.command("scan-repo <target>").description("Scan a repo's agent-security surface (GitHub URL or local path)").option("--json", "emit the raw result as JSON").option("--markdown", "emit a Markdown report (for a PR comment)").action(async (target, opts) => {
-    const { onProgress, done } = makeProgress(target, !!(opts.json || opts.markdown));
-    let res;
-    try {
-      res = await scanRepo(target, onProgress);
-    } finally {
-      done();
-    }
-    if (opts.json) {
-      console.log(JSON.stringify(res, null, 2));
-    } else if (opts.markdown) {
-      console.log(renderScanMarkdown(res));
-    } else {
-      console.log(renderScan(res));
+  program2.command("scan-repo <target>").description("Scan a repo's agent-security surface (GitHub URL or local path)").option("--json", "emit the raw result as JSON").option("--markdown", "emit a Markdown report (for a PR comment)").option(
+    "--base <ref>",
+    "also scan this git ref and report what the working tree INTRODUCED (local path targets only)"
+  ).option(
+    "--fail-on-introduced",
+    "exit non-zero only for findings this change introduced (requires --base)"
+  ).action(
+    async (target, opts) => {
+      const { onProgress, done } = makeProgress(target, !!(opts.json || opts.markdown));
+      let res;
+      try {
+        res = await scanRepo(target, onProgress);
+      } finally {
+        done();
+      }
+      let diff;
+      if (opts.base) {
+        const baseTree = readGitRefTree(target, opts.base);
+        diff = diffScans(baseTree ? scanTree(baseTree) : null, res);
+      }
+      if (opts.json) {
+        console.log(JSON.stringify(diff ? { ...res, diff } : res, null, 2));
+      } else if (opts.markdown) {
+        console.log(renderScanMarkdown(res, diff));
+      } else {
+        console.log(renderScan(res, diff));
+      }
+      process.exitCode = opts.failOnIntroduced && diff ? exitCodeForSeverity(diff.worstIntroduced, diff.incomplete) : exitCodeFor(res);
     }
-    process.exitCode = exitCodeFor(res);
-  });
+  );
 }
 
 // src/cli/commands/egress.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.10.0",
+  "version": "2.12.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -16,7 +16,7 @@
     "node9": "./dist/cli.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "workspaces": [
     "packages/*"