@node9/proxy 2.23.3 → 2.24.1

package/dist/cli.js

@@ -60454,10 +60454,6 @@ function ifsAreGated(ifs, labelConfigured) {
   const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function hasActorGate(wf, raw) {
-  const ifs = [jobList(wf).map((j) => j.if), allSteps(wf).map((s) => s.step.if)].flat().map(str).join(" ");
-  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
-}
 function hasStepMembershipGate(job) {
   const steps = job.steps ?? [];
   const gateIds = steps.filter((s) => s.id && MEMBERSHIP_CHECK_RE.test(str(s.run))).map((s) => s.id);
@@ -60475,6 +60471,54 @@ function jobActorGate(job, wf, raw) {
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
   hasStepMembershipGate(job);
 }
+var STATUS_FN_RE = /\b(success|failure|always|cancelled)\s*\(/i;
+var FAILING_STEP_RE = /\bexit\s+[1-9]|core\.setFailed|process\.exit\(\s*[1-9]/;
+function needsOf(job) {
+  return (Array.isArray(job.needs) ? job.needs : job.needs ? [job.needs] : []).map(String);
+}
+function escapeRe(x) {
+  return x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function upstreamJobGates(name, dep, wf, raw, readerIf) {
+  const depIf = str(dep.if);
+  const label2 = labelTypeConfigured(wf, raw);
+  if (!/\|\|/.test(depIf) && (ifsAreGated(depIf, label2) || /assignee\.login\s*==|event\.assignee\b/i.test(depIf)))
+    return true;
+  const steps = dep.steps ?? [];
+  const stepGated = ifsAreGated(steps.map((st) => str(st.if)).join(" "), label2) || hasStepMembershipGate(dep);
+  if (!stepGated) return false;
+  if (steps.some(
+    (st) => FAILING_STEP_RE.test(str(st.run)) || FAILING_STEP_RE.test(str(st.with?.["script"]))
+  ))
+    return true;
+  return readerIf !== null && new RegExp(`needs\\.${escapeRe(name)}\\.outputs\\.`).test(readerIf);
+}
+function gatingAncestors(job, wf, raw) {
+  const out = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (j, readerIf) => {
+    for (const name of needsOf(j)) {
+      const dep = wf.jobs?.[name];
+      if (!dep) continue;
+      if (upstreamJobGates(name, dep, wf, raw, readerIf)) out.add(name);
+      if (seen.has(name)) continue;
+      seen.add(name);
+      visit(dep, str(dep.if));
+    }
+  };
+  visit(job, str(job.if));
+  return out;
+}
+function jobGated(job, wf, raw) {
+  if (jobActorGate(job, wf, raw)) return true;
+  const gating = gatingAncestors(job, wf, raw);
+  if (gating.size === 0) return false;
+  const ownIf = str(job.if);
+  if (!STATUS_FN_RE.test(ownIf)) return true;
+  return needsOf(job).some(
+    (n) => gating.has(n) && new RegExp(`needs\\.${escapeRe(n)}\\.result\\s*==\\s*['"]success['"]`).test(ownIf)
+  );
+}
 function bypassArmed(steps) {
   return steps.some(
     (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
@@ -60490,8 +60534,7 @@ function injectableJobs(wf, raw, untrustedTrigger) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
     const jobStar = bypassArmed(a);
-    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
-      continue;
+    if (jobGated(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger)) continue;
     out.push(job);
   }
   return out;
@@ -60537,6 +60580,36 @@ function hasMetaWritePerm(wf, agentJobs) {
 function hasEnvDeny(steps) {
   return steps.some((s) => /"?mode"?\s*:\s*"?deny/i.test(str(s.with?.["settings"])));
 }
+var CLAUDE_CODE_ACTION_RE = /anthropics\/claude-code-action@/i;
+var FULL_OUTPUT_ACTION_RE = /anthropics\/claude-code(-base)?-action@/i;
+function pinnedBelow(uses, min) {
+  const m = /@v?(\d+)\.(\d+)\.(\d+)$/.exec(uses.trim());
+  if (!m) return false;
+  const v = [Number(m[1]), Number(m[2]), Number(m[3])];
+  for (let i = 0; i < 3; i++) if (v[i] !== min[i]) return v[i] < min[i];
+  return false;
+}
+var FULL_OUTPUT_MIN = [1, 0, 16];
+var ENV_SCRUB_MIN = [1, 0, 77];
+function showsFullOutput(steps) {
+  return steps.some(
+    (s) => FULL_OUTPUT_ACTION_RE.test(s.uses ?? "") && !pinnedBelow(s.uses ?? "", FULL_OUTPUT_MIN) && str(s.with?.["show_full_output"]) === "true"
+  );
+}
+function envScrubOptedOut(pairs, wf) {
+  const wfEnv = wf.env;
+  const KEY = "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB";
+  return pairs.some(({ job, step }) => {
+    const uses = step.uses ?? "";
+    if (!CLAUDE_CODE_ACTION_RE.test(uses) || pinnedBelow(uses, ENV_SCRUB_MIN)) return false;
+    if (!str(step.with?.["allowed_non_write_users"]).trim()) return false;
+    const holder = [step.env, job.env, wfEnv].find((e) => e != null && KEY in e);
+    if (!holder) return false;
+    const v = str(holder[KEY]).trim();
+    if (!v || /\$\{\{/.test(v)) return false;
+    return !/^(1|true|yes|on)$/i.test(v);
+  });
+}
 function agentActionsPinned(steps) {
   const agent = steps.filter(isAgentStep).filter((s) => s.uses);
   if (agent.length === 0) return false;
@@ -60595,10 +60668,10 @@ function analyzeWorkflow(path80, content) {
   const elevated = hasCodeWritePerm(wf, powerJobs) || hasIdTokenWrite(wf, powerJobs) && egressTool;
   const pat = usesPatIn(powerJobs);
   const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const explicitGate = hasActorGate(wf, raw);
   const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
   const membershipGated = injJobs.length === 0 && jobList(wf).some((j) => (j.steps ?? []).some(isAgentStep) && hasStepMembershipGate(j));
-  const gate = explicitGate || implicitGate;
+  const gate = injJobs.length === 0;
+  const gatedSiblings = agentJobs.filter((j) => !injJobs.includes(j)).length;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -60656,16 +60729,42 @@ function analyzeWorkflow(path80, content) {
     signals.push('allowed_non_write_users: "*" with github_token \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
+  const scopedPairs = allSteps(wf).filter(
+    (p) => isAgentStep(p.step) && (injJobs.length === 0 || injJobs.includes(p.job))
+  );
+  const fullOutput = showsFullOutput(scopedPairs.map((p) => p.step));
+  const scrubOff = envScrubOptedOut(scopedPairs, wf);
+  if (fullOutput)
+    signals.push(
+      "`show_full_output: true` writes every agent command and its output to the Actions log, public on a public repo; GitHub masks known secret values there, but an agent told to encode one first can publish it without any network tool"
+    );
+  if (scrubOff)
+    signals.push(
+      "`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` is switched off, so the action no longer scrubs the Anthropic key, cloud credentials and Actions runtime tokens from the agent's shell"
+    );
   if (!gate && reach > 0) signals.push("no effective actor gate");
+  if (!gate && reach > 0 && gatedSiblings > 0) {
+    const siblings = agentJobs.filter((j) => !injJobs.includes(j));
+    const explicit = siblings.filter((j) => jobGated(j, wf, raw)).length;
+    const byDefault = siblings.length - explicit;
+    const n = (k) => `${k} other agent job${k === 1 ? "" : "s"}`;
+    const parts = [
+      explicit ? `${n(explicit)} ${explicit === 1 ? "is" : "are"} actor-gated` : "",
+      byDefault ? `${n(byDefault)} ${byDefault === 1 ? "is" : "are"} held by claude-code-action's default write-access gate` : ""
+    ].filter(Boolean);
+    signals.push(
+      `${parts.join("; ")} in this workflow; this finding is about the ungated one${injJobs.length === 1 ? "" : "s"}`
+    );
+  }
   const noExplicitPerms = wf.permissions == null && jobList(wf).every((j) => j.permissions == null);
   if (noExplicitPerms && reach > 0 && (broadTools || githubWriteTool))
     signals.push(
       "no explicit `permissions:` \u2014 the token defaults to the repo/org setting, which may grant write; set it explicitly to read-only"
     );
   const mitigations = [];
-  if (explicitGate || membershipGated)
+  if (gate && (membershipGated || agentJobs.some((j) => jobGated(j, wf, raw))))
     mitigations.push("actor-gated (maintainer/label/write-user required)");
-  else if (implicitGate)
+  else if (gate && implicitGate)
     mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
@@ -60676,7 +60775,7 @@ function analyzeWorkflow(path80, content) {
       'allowed_non_write_users: "*" is set without github_token, so the action keeps its default write gate'
     );
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
-  return {
+  const finding = {
     check: "CI-2",
     // One verdict per workflow file — the finding IS the file's reachability score.
     rule: "CI-2.injectable-workflow",
@@ -60688,6 +60787,12 @@ function analyzeWorkflow(path80, content) {
     mitigations: mitigations.length ? mitigations : void 0,
     fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
+  const extraFix = [
+    fullOutput ? "Remove `show_full_output: true` (the action documents it for debugging only)." : "",
+    scrubOff ? "Remove the `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` opt-out." : ""
+  ].filter(Boolean).join(" ");
+  if (extraFix) finding.fix = `${finding.fix} ${extraFix}`;
+  return finding;
 }
 var AGENT_FUEL_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_BASE_URL|GEMINI_API_KEY|GOOGLE_API_KEY|GITHUB_TOKEN)$/i;
 var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_url|claude_code_oauth_token|openai_api_key|openai_base_url|gemini_api_key|google_api_key)$/i;
@@ -60742,7 +60847,7 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
     promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
     bypassActive ? 2 : 0
   );
-  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const gate = jobGated(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
   const injectable = untrustedTrigger && !gate && reach > 0;
   const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
   const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");

package/dist/cli.mjs

@@ -60443,10 +60443,6 @@ function ifsAreGated(ifs, labelConfigured) {
   const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function hasActorGate(wf, raw) {
-  const ifs = [jobList(wf).map((j) => j.if), allSteps(wf).map((s) => s.step.if)].flat().map(str).join(" ");
-  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
-}
 function hasStepMembershipGate(job) {
   const steps = job.steps ?? [];
   const gateIds = steps.filter((s) => s.id && MEMBERSHIP_CHECK_RE.test(str(s.run))).map((s) => s.id);
@@ -60464,6 +60460,54 @@ function jobActorGate(job, wf, raw) {
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
   hasStepMembershipGate(job);
 }
+var STATUS_FN_RE = /\b(success|failure|always|cancelled)\s*\(/i;
+var FAILING_STEP_RE = /\bexit\s+[1-9]|core\.setFailed|process\.exit\(\s*[1-9]/;
+function needsOf(job) {
+  return (Array.isArray(job.needs) ? job.needs : job.needs ? [job.needs] : []).map(String);
+}
+function escapeRe(x) {
+  return x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function upstreamJobGates(name, dep, wf, raw, readerIf) {
+  const depIf = str(dep.if);
+  const label2 = labelTypeConfigured(wf, raw);
+  if (!/\|\|/.test(depIf) && (ifsAreGated(depIf, label2) || /assignee\.login\s*==|event\.assignee\b/i.test(depIf)))
+    return true;
+  const steps = dep.steps ?? [];
+  const stepGated = ifsAreGated(steps.map((st) => str(st.if)).join(" "), label2) || hasStepMembershipGate(dep);
+  if (!stepGated) return false;
+  if (steps.some(
+    (st) => FAILING_STEP_RE.test(str(st.run)) || FAILING_STEP_RE.test(str(st.with?.["script"]))
+  ))
+    return true;
+  return readerIf !== null && new RegExp(`needs\\.${escapeRe(name)}\\.outputs\\.`).test(readerIf);
+}
+function gatingAncestors(job, wf, raw) {
+  const out = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (j, readerIf) => {
+    for (const name of needsOf(j)) {
+      const dep = wf.jobs?.[name];
+      if (!dep) continue;
+      if (upstreamJobGates(name, dep, wf, raw, readerIf)) out.add(name);
+      if (seen.has(name)) continue;
+      seen.add(name);
+      visit(dep, str(dep.if));
+    }
+  };
+  visit(job, str(job.if));
+  return out;
+}
+function jobGated(job, wf, raw) {
+  if (jobActorGate(job, wf, raw)) return true;
+  const gating = gatingAncestors(job, wf, raw);
+  if (gating.size === 0) return false;
+  const ownIf = str(job.if);
+  if (!STATUS_FN_RE.test(ownIf)) return true;
+  return needsOf(job).some(
+    (n) => gating.has(n) && new RegExp(`needs\\.${escapeRe(n)}\\.result\\s*==\\s*['"]success['"]`).test(ownIf)
+  );
+}
 function bypassArmed(steps) {
   return steps.some(
     (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
@@ -60479,8 +60523,7 @@ function injectableJobs(wf, raw, untrustedTrigger) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
     const jobStar = bypassArmed(a);
-    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
-      continue;
+    if (jobGated(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger)) continue;
     out.push(job);
   }
   return out;
@@ -60526,6 +60569,36 @@ function hasMetaWritePerm(wf, agentJobs) {
 function hasEnvDeny(steps) {
   return steps.some((s) => /"?mode"?\s*:\s*"?deny/i.test(str(s.with?.["settings"])));
 }
+var CLAUDE_CODE_ACTION_RE = /anthropics\/claude-code-action@/i;
+var FULL_OUTPUT_ACTION_RE = /anthropics\/claude-code(-base)?-action@/i;
+function pinnedBelow(uses, min) {
+  const m = /@v?(\d+)\.(\d+)\.(\d+)$/.exec(uses.trim());
+  if (!m) return false;
+  const v = [Number(m[1]), Number(m[2]), Number(m[3])];
+  for (let i = 0; i < 3; i++) if (v[i] !== min[i]) return v[i] < min[i];
+  return false;
+}
+var FULL_OUTPUT_MIN = [1, 0, 16];
+var ENV_SCRUB_MIN = [1, 0, 77];
+function showsFullOutput(steps) {
+  return steps.some(
+    (s) => FULL_OUTPUT_ACTION_RE.test(s.uses ?? "") && !pinnedBelow(s.uses ?? "", FULL_OUTPUT_MIN) && str(s.with?.["show_full_output"]) === "true"
+  );
+}
+function envScrubOptedOut(pairs, wf) {
+  const wfEnv = wf.env;
+  const KEY = "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB";
+  return pairs.some(({ job, step }) => {
+    const uses = step.uses ?? "";
+    if (!CLAUDE_CODE_ACTION_RE.test(uses) || pinnedBelow(uses, ENV_SCRUB_MIN)) return false;
+    if (!str(step.with?.["allowed_non_write_users"]).trim()) return false;
+    const holder = [step.env, job.env, wfEnv].find((e) => e != null && KEY in e);
+    if (!holder) return false;
+    const v = str(holder[KEY]).trim();
+    if (!v || /\$\{\{/.test(v)) return false;
+    return !/^(1|true|yes|on)$/i.test(v);
+  });
+}
 function agentActionsPinned(steps) {
   const agent = steps.filter(isAgentStep).filter((s) => s.uses);
   if (agent.length === 0) return false;
@@ -60584,10 +60657,10 @@ function analyzeWorkflow(path80, content) {
   const elevated = hasCodeWritePerm(wf, powerJobs) || hasIdTokenWrite(wf, powerJobs) && egressTool;
   const pat = usesPatIn(powerJobs);
   const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const explicitGate = hasActorGate(wf, raw);
   const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
   const membershipGated = injJobs.length === 0 && jobList(wf).some((j) => (j.steps ?? []).some(isAgentStep) && hasStepMembershipGate(j));
-  const gate = explicitGate || implicitGate;
+  const gate = injJobs.length === 0;
+  const gatedSiblings = agentJobs.filter((j) => !injJobs.includes(j)).length;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -60645,16 +60718,42 @@ function analyzeWorkflow(path80, content) {
     signals.push('allowed_non_write_users: "*" with github_token \u2014 any user can trigger the agent');
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
+  const scopedPairs = allSteps(wf).filter(
+    (p) => isAgentStep(p.step) && (injJobs.length === 0 || injJobs.includes(p.job))
+  );
+  const fullOutput = showsFullOutput(scopedPairs.map((p) => p.step));
+  const scrubOff = envScrubOptedOut(scopedPairs, wf);
+  if (fullOutput)
+    signals.push(
+      "`show_full_output: true` writes every agent command and its output to the Actions log, public on a public repo; GitHub masks known secret values there, but an agent told to encode one first can publish it without any network tool"
+    );
+  if (scrubOff)
+    signals.push(
+      "`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` is switched off, so the action no longer scrubs the Anthropic key, cloud credentials and Actions runtime tokens from the agent's shell"
+    );
   if (!gate && reach > 0) signals.push("no effective actor gate");
+  if (!gate && reach > 0 && gatedSiblings > 0) {
+    const siblings = agentJobs.filter((j) => !injJobs.includes(j));
+    const explicit = siblings.filter((j) => jobGated(j, wf, raw)).length;
+    const byDefault = siblings.length - explicit;
+    const n = (k) => `${k} other agent job${k === 1 ? "" : "s"}`;
+    const parts = [
+      explicit ? `${n(explicit)} ${explicit === 1 ? "is" : "are"} actor-gated` : "",
+      byDefault ? `${n(byDefault)} ${byDefault === 1 ? "is" : "are"} held by claude-code-action's default write-access gate` : ""
+    ].filter(Boolean);
+    signals.push(
+      `${parts.join("; ")} in this workflow; this finding is about the ungated one${injJobs.length === 1 ? "" : "s"}`
+    );
+  }
   const noExplicitPerms = wf.permissions == null && jobList(wf).every((j) => j.permissions == null);
   if (noExplicitPerms && reach > 0 && (broadTools || githubWriteTool))
     signals.push(
       "no explicit `permissions:` \u2014 the token defaults to the repo/org setting, which may grant write; set it explicitly to read-only"
     );
   const mitigations = [];
-  if (explicitGate || membershipGated)
+  if (gate && (membershipGated || agentJobs.some((j) => jobGated(j, wf, raw))))
     mitigations.push("actor-gated (maintainer/label/write-user required)");
-  else if (implicitGate)
+  else if (gate && implicitGate)
     mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
@@ -60665,7 +60764,7 @@ function analyzeWorkflow(path80, content) {
       'allowed_non_write_users: "*" is set without github_token, so the action keeps its default write gate'
     );
   const title = severity === "critical" || severity === "high" ? "Injectable agent workflow \u2014 untrusted input reaches a tool-using agent with secrets" : severity === "medium" ? "Agent workflow with a risky pattern (partially mitigated)" : "Agent workflow on a privileged trigger \u2014 review the actor gate";
-  return {
+  const finding = {
     check: "CI-2",
     // One verdict per workflow file — the finding IS the file's reachability score.
     rule: "CI-2.injectable-workflow",
@@ -60677,6 +60776,12 @@ function analyzeWorkflow(path80, content) {
     mitigations: mitigations.length ? mitigations : void 0,
     fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
+  const extraFix = [
+    fullOutput ? "Remove `show_full_output: true` (the action documents it for debugging only)." : "",
+    scrubOff ? "Remove the `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` opt-out." : ""
+  ].filter(Boolean).join(" ");
+  if (extraFix) finding.fix = `${finding.fix} ${extraFix}`;
+  return finding;
 }
 var AGENT_FUEL_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_BASE_URL|GEMINI_API_KEY|GOOGLE_API_KEY|GITHUB_TOKEN)$/i;
 var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_url|claude_code_oauth_token|openai_api_key|openai_base_url|gemini_api_key|google_api_key)$/i;
@@ -60731,7 +60836,7 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
     promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
     bypassActive ? 2 : 0
   );
-  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const gate = jobGated(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
   const injectable = untrustedTrigger && !gate && reach > 0;
   const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
   const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.23.3",
+  "version": "2.24.1",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",