@node9/proxy 2.24.0 → 2.24.1

package/dist/cli.js

@@ -60454,10 +60454,6 @@ function ifsAreGated(ifs, labelConfigured) {
   const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function hasActorGate(wf, raw) {
-  const ifs = [jobList(wf).map((j) => j.if), allSteps(wf).map((s) => s.step.if)].flat().map(str).join(" ");
-  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
-}
 function hasStepMembershipGate(job) {
   const steps = job.steps ?? [];
   const gateIds = steps.filter((s) => s.id && MEMBERSHIP_CHECK_RE.test(str(s.run))).map((s) => s.id);
@@ -60475,6 +60471,54 @@ function jobActorGate(job, wf, raw) {
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
   hasStepMembershipGate(job);
 }
+var STATUS_FN_RE = /\b(success|failure|always|cancelled)\s*\(/i;
+var FAILING_STEP_RE = /\bexit\s+[1-9]|core\.setFailed|process\.exit\(\s*[1-9]/;
+function needsOf(job) {
+  return (Array.isArray(job.needs) ? job.needs : job.needs ? [job.needs] : []).map(String);
+}
+function escapeRe(x) {
+  return x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function upstreamJobGates(name, dep, wf, raw, readerIf) {
+  const depIf = str(dep.if);
+  const label2 = labelTypeConfigured(wf, raw);
+  if (!/\|\|/.test(depIf) && (ifsAreGated(depIf, label2) || /assignee\.login\s*==|event\.assignee\b/i.test(depIf)))
+    return true;
+  const steps = dep.steps ?? [];
+  const stepGated = ifsAreGated(steps.map((st) => str(st.if)).join(" "), label2) || hasStepMembershipGate(dep);
+  if (!stepGated) return false;
+  if (steps.some(
+    (st) => FAILING_STEP_RE.test(str(st.run)) || FAILING_STEP_RE.test(str(st.with?.["script"]))
+  ))
+    return true;
+  return readerIf !== null && new RegExp(`needs\\.${escapeRe(name)}\\.outputs\\.`).test(readerIf);
+}
+function gatingAncestors(job, wf, raw) {
+  const out = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (j, readerIf) => {
+    for (const name of needsOf(j)) {
+      const dep = wf.jobs?.[name];
+      if (!dep) continue;
+      if (upstreamJobGates(name, dep, wf, raw, readerIf)) out.add(name);
+      if (seen.has(name)) continue;
+      seen.add(name);
+      visit(dep, str(dep.if));
+    }
+  };
+  visit(job, str(job.if));
+  return out;
+}
+function jobGated(job, wf, raw) {
+  if (jobActorGate(job, wf, raw)) return true;
+  const gating = gatingAncestors(job, wf, raw);
+  if (gating.size === 0) return false;
+  const ownIf = str(job.if);
+  if (!STATUS_FN_RE.test(ownIf)) return true;
+  return needsOf(job).some(
+    (n) => gating.has(n) && new RegExp(`needs\\.${escapeRe(n)}\\.result\\s*==\\s*['"]success['"]`).test(ownIf)
+  );
+}
 function bypassArmed(steps) {
   return steps.some(
     (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
@@ -60490,8 +60534,7 @@ function injectableJobs(wf, raw, untrustedTrigger) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
     const jobStar = bypassArmed(a);
-    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
-      continue;
+    if (jobGated(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger)) continue;
     out.push(job);
   }
   return out;
@@ -60625,10 +60668,10 @@ function analyzeWorkflow(path80, content) {
   const elevated = hasCodeWritePerm(wf, powerJobs) || hasIdTokenWrite(wf, powerJobs) && egressTool;
   const pat = usesPatIn(powerJobs);
   const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const explicitGate = hasActorGate(wf, raw);
   const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
   const membershipGated = injJobs.length === 0 && jobList(wf).some((j) => (j.steps ?? []).some(isAgentStep) && hasStepMembershipGate(j));
-  const gate = explicitGate || implicitGate;
+  const gate = injJobs.length === 0;
+  const gatedSiblings = agentJobs.filter((j) => !injJobs.includes(j)).length;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -60700,15 +60743,28 @@ function analyzeWorkflow(path80, content) {
       "`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` is switched off, so the action no longer scrubs the Anthropic key, cloud credentials and Actions runtime tokens from the agent's shell"
     );
   if (!gate && reach > 0) signals.push("no effective actor gate");
+  if (!gate && reach > 0 && gatedSiblings > 0) {
+    const siblings = agentJobs.filter((j) => !injJobs.includes(j));
+    const explicit = siblings.filter((j) => jobGated(j, wf, raw)).length;
+    const byDefault = siblings.length - explicit;
+    const n = (k) => `${k} other agent job${k === 1 ? "" : "s"}`;
+    const parts = [
+      explicit ? `${n(explicit)} ${explicit === 1 ? "is" : "are"} actor-gated` : "",
+      byDefault ? `${n(byDefault)} ${byDefault === 1 ? "is" : "are"} held by claude-code-action's default write-access gate` : ""
+    ].filter(Boolean);
+    signals.push(
+      `${parts.join("; ")} in this workflow; this finding is about the ungated one${injJobs.length === 1 ? "" : "s"}`
+    );
+  }
   const noExplicitPerms = wf.permissions == null && jobList(wf).every((j) => j.permissions == null);
   if (noExplicitPerms && reach > 0 && (broadTools || githubWriteTool))
     signals.push(
       "no explicit `permissions:` \u2014 the token defaults to the repo/org setting, which may grant write; set it explicitly to read-only"
     );
   const mitigations = [];
-  if (explicitGate || membershipGated)
+  if (gate && (membershipGated || agentJobs.some((j) => jobGated(j, wf, raw))))
     mitigations.push("actor-gated (maintainer/label/write-user required)");
-  else if (implicitGate)
+  else if (gate && implicitGate)
     mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
@@ -60791,7 +60847,7 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
     promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
     bypassActive ? 2 : 0
   );
-  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const gate = jobGated(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
   const injectable = untrustedTrigger && !gate && reach > 0;
   const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
   const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");

package/dist/cli.mjs

@@ -60443,10 +60443,6 @@ function ifsAreGated(ifs, labelConfigured) {
   const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
   return gated || labelGated;
 }
-function hasActorGate(wf, raw) {
-  const ifs = [jobList(wf).map((j) => j.if), allSteps(wf).map((s) => s.step.if)].flat().map(str).join(" ");
-  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
-}
 function hasStepMembershipGate(job) {
   const steps = job.steps ?? [];
   const gateIds = steps.filter((s) => s.id && MEMBERSHIP_CHECK_RE.test(str(s.run))).map((s) => s.id);
@@ -60464,6 +60460,54 @@ function jobActorGate(job, wf, raw) {
   return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs) || // [2] job-scoped permission-check-output gate
   hasStepMembershipGate(job);
 }
+var STATUS_FN_RE = /\b(success|failure|always|cancelled)\s*\(/i;
+var FAILING_STEP_RE = /\bexit\s+[1-9]|core\.setFailed|process\.exit\(\s*[1-9]/;
+function needsOf(job) {
+  return (Array.isArray(job.needs) ? job.needs : job.needs ? [job.needs] : []).map(String);
+}
+function escapeRe(x) {
+  return x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function upstreamJobGates(name, dep, wf, raw, readerIf) {
+  const depIf = str(dep.if);
+  const label2 = labelTypeConfigured(wf, raw);
+  if (!/\|\|/.test(depIf) && (ifsAreGated(depIf, label2) || /assignee\.login\s*==|event\.assignee\b/i.test(depIf)))
+    return true;
+  const steps = dep.steps ?? [];
+  const stepGated = ifsAreGated(steps.map((st) => str(st.if)).join(" "), label2) || hasStepMembershipGate(dep);
+  if (!stepGated) return false;
+  if (steps.some(
+    (st) => FAILING_STEP_RE.test(str(st.run)) || FAILING_STEP_RE.test(str(st.with?.["script"]))
+  ))
+    return true;
+  return readerIf !== null && new RegExp(`needs\\.${escapeRe(name)}\\.outputs\\.`).test(readerIf);
+}
+function gatingAncestors(job, wf, raw) {
+  const out = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (j, readerIf) => {
+    for (const name of needsOf(j)) {
+      const dep = wf.jobs?.[name];
+      if (!dep) continue;
+      if (upstreamJobGates(name, dep, wf, raw, readerIf)) out.add(name);
+      if (seen.has(name)) continue;
+      seen.add(name);
+      visit(dep, str(dep.if));
+    }
+  };
+  visit(job, str(job.if));
+  return out;
+}
+function jobGated(job, wf, raw) {
+  if (jobActorGate(job, wf, raw)) return true;
+  const gating = gatingAncestors(job, wf, raw);
+  if (gating.size === 0) return false;
+  const ownIf = str(job.if);
+  if (!STATUS_FN_RE.test(ownIf)) return true;
+  return needsOf(job).some(
+    (n) => gating.has(n) && new RegExp(`needs\\.${escapeRe(n)}\\.result\\s*==\\s*['"]success['"]`).test(ownIf)
+  );
+}
 function bypassArmed(steps) {
   return steps.some(
     (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
@@ -60479,8 +60523,7 @@ function injectableJobs(wf, raw, untrustedTrigger) {
     const a = (job.steps ?? []).filter(isAgentStep);
     if (!a.length) continue;
     const jobStar = bypassArmed(a);
-    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger))
-      continue;
+    if (jobGated(job, wf, raw) || hasImplicitActorGate(a, jobStar && untrustedTrigger)) continue;
     out.push(job);
   }
   return out;
@@ -60614,10 +60657,10 @@ function analyzeWorkflow(path80, content) {
   const elevated = hasCodeWritePerm(wf, powerJobs) || hasIdTokenWrite(wf, powerJobs) && egressTool;
   const pat = usesPatIn(powerJobs);
   const power = (broadTools ? 2 : 0) + (bypassActive ? 1 : 0) + (elevated ? 1 : 0) + (pat ? 1 : 0);
-  const explicitGate = hasActorGate(wf, raw);
   const implicitGate = hasImplicitActorGate(agentSteps, bypassActive);
   const membershipGated = injJobs.length === 0 && jobList(wf).some((j) => (j.steps ?? []).some(isAgentStep) && hasStepMembershipGate(j));
-  const gate = explicitGate || implicitGate;
+  const gate = injJobs.length === 0;
+  const gatedSiblings = agentJobs.filter((j) => !injJobs.includes(j)).length;
   const envDeny = hasEnvDeny(agentSteps);
   const pinned = agentActionsPinned(agentSteps);
   let score = reach + power;
@@ -60689,15 +60732,28 @@ function analyzeWorkflow(path80, content) {
       "`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` is switched off, so the action no longer scrubs the Anthropic key, cloud credentials and Actions runtime tokens from the agent's shell"
     );
   if (!gate && reach > 0) signals.push("no effective actor gate");
+  if (!gate && reach > 0 && gatedSiblings > 0) {
+    const siblings = agentJobs.filter((j) => !injJobs.includes(j));
+    const explicit = siblings.filter((j) => jobGated(j, wf, raw)).length;
+    const byDefault = siblings.length - explicit;
+    const n = (k) => `${k} other agent job${k === 1 ? "" : "s"}`;
+    const parts = [
+      explicit ? `${n(explicit)} ${explicit === 1 ? "is" : "are"} actor-gated` : "",
+      byDefault ? `${n(byDefault)} ${byDefault === 1 ? "is" : "are"} held by claude-code-action's default write-access gate` : ""
+    ].filter(Boolean);
+    signals.push(
+      `${parts.join("; ")} in this workflow; this finding is about the ungated one${injJobs.length === 1 ? "" : "s"}`
+    );
+  }
   const noExplicitPerms = wf.permissions == null && jobList(wf).every((j) => j.permissions == null);
   if (noExplicitPerms && reach > 0 && (broadTools || githubWriteTool))
     signals.push(
       "no explicit `permissions:` \u2014 the token defaults to the repo/org setting, which may grant write; set it explicitly to read-only"
     );
   const mitigations = [];
-  if (explicitGate || membershipGated)
+  if (gate && (membershipGated || agentJobs.some((j) => jobGated(j, wf, raw))))
     mitigations.push("actor-gated (maintainer/label/write-user required)");
-  else if (implicitGate)
+  else if (gate && implicitGate)
     mitigations.push("claude-code-action gates the agent to write-access users by default");
   if (head === "subdir") mitigations.push("untrusted head isolated in a subdir, not root");
   if (envDeny) mitigations.push("secrets env-denied from the agent subprocess");
@@ -60780,7 +60836,7 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
     promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
     bypassActive ? 2 : 0
   );
-  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const gate = jobGated(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
   const injectable = untrustedTrigger && !gate && reach > 0;
   const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
   const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.24.0",
+  "version": "2.24.1",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",