@node9/proxy 2.23.1 → 2.23.2

package/dist/cli.js

@@ -60475,6 +60475,11 @@ function jobActorGate(job, wf, raw) {
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
   hasStepMembershipGate(job);
 }
+function bypassArmed(steps) {
+  return steps.some(
+    (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
+  );
+}
 function hasImplicitActorGate(agentSteps, bypassActive) {
   if (bypassActive) return false;
   return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
@@ -60484,7 +60489,7 @@ function injectableJobs(wf, raw, untrustedTrigger) {
   for (const job of jobList(wf)) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
-    const jobStar = str(a.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+    const jobStar = bypassArmed(a);
     if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
       continue;
     out.push(job);
@@ -60564,7 +60569,8 @@ function analyzeWorkflow(path80, content) {
     privileged
   } = triggerReach(wf, raw);
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
-  const nonWriteStar = nonWrite === "*";
+  const nonWriteStar = bypassArmed(agentSteps);
+  const starWithoutToken = nonWrite === "*" && !nonWriteStar;
   const nonWriteList = !!nonWrite && nonWrite !== "*";
   const untrustedTrigger = forkInput || reusable;
   const bypassActive = nonWriteStar && untrustedTrigger;
@@ -60642,7 +60648,8 @@ function analyzeWorkflow(path80, content) {
       names.length ? `agent has broad/write-capable tools: ${names.map((n) => `\`${n}\``).join(", ")}` : "agent has broad/write-capable tool grants"
     );
   }
-  if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
+  if (bypassActive)
+    signals.push('allowed_non_write_users: "*" with github_token \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
@@ -60660,6 +60667,10 @@ function analyzeWorkflow(path80, content) {
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
   if (pinned) mitigations.push("agent action pinned to a commit SHA");
   if (nonWriteList) mitigations.push('non-write users scoped to a list, not "*"');
+  if (starWithoutToken)
+    mitigations.push(
+      'allowed_non_write_users: "*" is set without github_token, so the action keeps its default write gate'
+    );
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
   return {
     check: "CI-2",
@@ -60719,8 +60730,7 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
   if (jobAgentSteps.length === 0) return null;
   const secrets = agentReachableSecrets(wf, jobAgentSteps, [job]);
   if (secrets.length === 0) return null;
-  const nonWriteStar = str(jobAgentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
-  const bypassActive = nonWriteStar && untrustedTrigger;
+  const bypassActive = bypassArmed(jobAgentSteps) && untrustedTrigger;
   const head = untrustedHeadCheckout(jobSteps);
   const reach = Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,

package/dist/cli.mjs

@@ -60464,6 +60464,11 @@ function jobActorGate(job, wf, raw) {
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
   hasStepMembershipGate(job);
 }
+function bypassArmed(steps) {
+  return steps.some(
+    (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
+  );
+}
 function hasImplicitActorGate(agentSteps, bypassActive) {
   if (bypassActive) return false;
   return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
@@ -60473,7 +60478,7 @@ function injectableJobs(wf, raw, untrustedTrigger) {
   for (const job of jobList(wf)) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
-    const jobStar = str(a.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+    const jobStar = bypassArmed(a);
     if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
       continue;
     out.push(job);
@@ -60553,7 +60558,8 @@ function analyzeWorkflow(path80, content) {
     privileged
   } = triggerReach(wf, raw);
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
-  const nonWriteStar = nonWrite === "*";
+  const nonWriteStar = bypassArmed(agentSteps);
+  const starWithoutToken = nonWrite === "*" && !nonWriteStar;
   const nonWriteList = !!nonWrite && nonWrite !== "*";
   const untrustedTrigger = forkInput || reusable;
   const bypassActive = nonWriteStar && untrustedTrigger;
@@ -60631,7 +60637,8 @@ function analyzeWorkflow(path80, content) {
       names.length ? `agent has broad/write-capable tools: ${names.map((n) => `\`${n}\``).join(", ")}` : "agent has broad/write-capable tool grants"
     );
   }
-  if (bypassActive) signals.push('allowed_non_write_users: "*" \u2014 any user can trigger the agent');
+  if (bypassActive)
+    signals.push('allowed_non_write_users: "*" with github_token \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
   if (!gate && reach > 0) signals.push("no effective actor gate");
@@ -60649,6 +60656,10 @@ function analyzeWorkflow(path80, content) {
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
   if (pinned) mitigations.push("agent action pinned to a commit SHA");
   if (nonWriteList) mitigations.push('non-write users scoped to a list, not "*"');
+  if (starWithoutToken)
+    mitigations.push(
+      'allowed_non_write_users: "*" is set without github_token, so the action keeps its default write gate'
+    );
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
   return {
     check: "CI-2",
@@ -60708,8 +60719,7 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
   if (jobAgentSteps.length === 0) return null;
   const secrets = agentReachableSecrets(wf, jobAgentSteps, [job]);
   if (secrets.length === 0) return null;
-  const nonWriteStar = str(jobAgentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
-  const bypassActive = nonWriteStar && untrustedTrigger;
+  const bypassActive = bypassArmed(jobAgentSteps) && untrustedTrigger;
   const head = untrustedHeadCheckout(jobSteps);
   const reach = Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.23.1",
+  "version": "2.23.2",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",