@node9/proxy 2.23.2 → 2.23.3

package/dist/cli.js

@@ -60496,11 +60496,15 @@ function injectableJobs(wf, raw, untrustedTrigger) {
   }
   return out;
 }
+var DEAD_SECRET_TAIL_RE = /(?<=(?:\$\{\{|\(|,)\s*)(secrets\.GITHUB_TOKEN|github\.token)(?:\s*\|\|\s*(?:'[^']*'|[A-Za-z_][A-Za-z0-9_.]*))+(?=\s*(?:\}\}|\)|,))/gi;
+function dropDeadSecretRefs(text) {
+  return text.replace(DEAD_SECRET_TAIL_RE, "$1");
+}
 function usesPatIn(jobs) {
   for (const j of jobs)
     for (const step of j.steps ?? []) {
-      const gt = str(step.with?.["github_token"]);
-      if (/secrets\./i.test(gt) && !/secrets\.GITHUB_TOKEN/i.test(gt)) return true;
+      const gt = dropDeadSecretRefs(str(step.with?.["github_token"]));
+      if (/secrets\.(?!GITHUB_TOKEN\b)[A-Za-z_]/i.test(gt)) return true;
     }
   return false;
 }
@@ -60690,7 +60694,8 @@ var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_u
 function fuelSecretNames(agentSteps) {
   const out = /* @__PURE__ */ new Set();
   const add = (v) => {
-    for (const m of str(v).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) out.add(m[1]);
+    for (const m of dropDeadSecretRefs(str(v)).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi))
+      out.add(m[1]);
   };
   for (const st of agentSteps) {
     for (const [k, v] of Object.entries(st.with ?? {})) if (FUEL_INPUT_KEYS.test(k)) add(v);
@@ -60712,7 +60717,7 @@ function agentReachableSecrets(wf, agentSteps, agentJobs) {
   blobs.push(str(wf.env));
   const fuel = fuelSecretNames(agentSteps);
   const found = /* @__PURE__ */ new Map();
-  for (const b of blobs) {
+  for (const b of blobs.map(dropDeadSecretRefs)) {
     for (const m of b.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) {
       const name = m[1];
       if (AGENT_FUEL_RE.test(name) || fuel.has(name)) continue;
@@ -60840,19 +60845,35 @@ function analyzeAgentConfig(path80, content) {
   );
   if (broad.length > 0) {
     const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
+    const bashBackstop = deny.some((d) => /^Bash\b/.test(d));
+    const bareShell = broad.some((a) => /^Bash$|^Bash\(\s*\*/.test(a));
+    const high = bareShell && !bashBackstop;
+    const signals = [`broad allow(s): ${broad.slice(0, 5).join(", ")}`];
+    if (high)
+      signals.push(
+        "unrestricted `Bash` with no `deny` backstop \u2014 any command an injected instruction names runs without a prompt, for everyone who opens this repo with the agent"
+      );
+    else if (bareShell)
+      signals.push(
+        "a `Bash` deny list narrows the unrestricted `Bash` allow; it blocks only the commands it names"
+      );
+    if (broad.some((a) => /^Bash\(git:/.test(a)))
+      signals.push(
+        "`Bash(git:*)` pre-approves every git command; git can run other programs (`-c core.pager=\u2026`, `!` aliases), so this is broader than it looks"
+      );
+    if (broad.some((a) => /^Write|^Edit$/.test(a)))
+      signals.push("`Write`/`Edit` pre-approve file changes without a prompt");
+    if (!high && !bareShell && !hasBackstop) signals.push("no `deny` entry narrows these grants");
     findings.push({
       check: "CI-1",
       rule: "CI-1.broad-allow",
       // File-level: one finding per config file. Adding a SECOND broad allow makes the
       // same statement about the same file, so it must not read as a new finding.
       dimension: "toolRules",
-      severity: hasBackstop ? "medium" : "high",
-      title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
+      severity: high ? "high" : "medium",
+      title: high ? "Committed agent config pre-authorizes broad tools with no deny backstop" : "Committed agent config pre-authorizes broad tools",
       file: path80,
-      signals: [
-        `broad allow(s): ${broad.slice(0, 5).join(", ")}`,
-        hasBackstop ? "a `deny` list backstops the broad allow" : "no `deny` entry covers Bash/Write/Edit \u2014 every contributor is pre-authorized for catastrophic tools"
-      ],
+      signals,
       fix: "Scope the allow-list to specific read-only subcommands (e.g. `Bash(gh pr view:*)`); avoid bare `Bash`/`git:`/`Write`, or add a `deny` backstop."
     });
   }

package/dist/cli.mjs

@@ -60485,11 +60485,15 @@ function injectableJobs(wf, raw, untrustedTrigger) {
   }
   return out;
 }
+var DEAD_SECRET_TAIL_RE = /(?<=(?:\$\{\{|\(|,)\s*)(secrets\.GITHUB_TOKEN|github\.token)(?:\s*\|\|\s*(?:'[^']*'|[A-Za-z_][A-Za-z0-9_.]*))+(?=\s*(?:\}\}|\)|,))/gi;
+function dropDeadSecretRefs(text) {
+  return text.replace(DEAD_SECRET_TAIL_RE, "$1");
+}
 function usesPatIn(jobs) {
   for (const j of jobs)
     for (const step of j.steps ?? []) {
-      const gt = str(step.with?.["github_token"]);
-      if (/secrets\./i.test(gt) && !/secrets\.GITHUB_TOKEN/i.test(gt)) return true;
+      const gt = dropDeadSecretRefs(str(step.with?.["github_token"]));
+      if (/secrets\.(?!GITHUB_TOKEN\b)[A-Za-z_]/i.test(gt)) return true;
     }
   return false;
 }
@@ -60679,7 +60683,8 @@ var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_u
 function fuelSecretNames(agentSteps) {
   const out = /* @__PURE__ */ new Set();
   const add = (v) => {
-    for (const m of str(v).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) out.add(m[1]);
+    for (const m of dropDeadSecretRefs(str(v)).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi))
+      out.add(m[1]);
   };
   for (const st of agentSteps) {
     for (const [k, v] of Object.entries(st.with ?? {})) if (FUEL_INPUT_KEYS.test(k)) add(v);
@@ -60701,7 +60706,7 @@ function agentReachableSecrets(wf, agentSteps, agentJobs) {
   blobs.push(str(wf.env));
   const fuel = fuelSecretNames(agentSteps);
   const found = /* @__PURE__ */ new Map();
-  for (const b of blobs) {
+  for (const b of blobs.map(dropDeadSecretRefs)) {
     for (const m of b.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) {
       const name = m[1];
       if (AGENT_FUEL_RE.test(name) || fuel.has(name)) continue;
@@ -60829,19 +60834,35 @@ function analyzeAgentConfig(path80, content) {
   );
   if (broad.length > 0) {
     const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
+    const bashBackstop = deny.some((d) => /^Bash\b/.test(d));
+    const bareShell = broad.some((a) => /^Bash$|^Bash\(\s*\*/.test(a));
+    const high = bareShell && !bashBackstop;
+    const signals = [`broad allow(s): ${broad.slice(0, 5).join(", ")}`];
+    if (high)
+      signals.push(
+        "unrestricted `Bash` with no `deny` backstop \u2014 any command an injected instruction names runs without a prompt, for everyone who opens this repo with the agent"
+      );
+    else if (bareShell)
+      signals.push(
+        "a `Bash` deny list narrows the unrestricted `Bash` allow; it blocks only the commands it names"
+      );
+    if (broad.some((a) => /^Bash\(git:/.test(a)))
+      signals.push(
+        "`Bash(git:*)` pre-approves every git command; git can run other programs (`-c core.pager=\u2026`, `!` aliases), so this is broader than it looks"
+      );
+    if (broad.some((a) => /^Write|^Edit$/.test(a)))
+      signals.push("`Write`/`Edit` pre-approve file changes without a prompt");
+    if (!high && !bareShell && !hasBackstop) signals.push("no `deny` entry narrows these grants");
     findings.push({
       check: "CI-1",
       rule: "CI-1.broad-allow",
       // File-level: one finding per config file. Adding a SECOND broad allow makes the
       // same statement about the same file, so it must not read as a new finding.
       dimension: "toolRules",
-      severity: hasBackstop ? "medium" : "high",
-      title: hasBackstop ? "Committed agent config pre-authorizes broad tools" : "Committed agent config pre-authorizes broad tools with no deny backstop",
+      severity: high ? "high" : "medium",
+      title: high ? "Committed agent config pre-authorizes broad tools with no deny backstop" : "Committed agent config pre-authorizes broad tools",
       file: path80,
-      signals: [
-        `broad allow(s): ${broad.slice(0, 5).join(", ")}`,
-        hasBackstop ? "a `deny` list backstops the broad allow" : "no `deny` entry covers Bash/Write/Edit \u2014 every contributor is pre-authorized for catastrophic tools"
-      ],
+      signals,
       fix: "Scope the allow-list to specific read-only subcommands (e.g. `Bash(gh pr view:*)`); avoid bare `Bash`/`git:`/`Write`, or add a `deny` backstop."
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.23.2",
+  "version": "2.23.3",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",