@node9/proxy 2.29.0 → 2.30.0

package/dist/cli.js

@@ -19442,19 +19442,24 @@ async function postCostBatches(apiUrl, apiKey, machineId, entries) {
         } catch {
         }
         if (typeof stored === "number" && stored < batch.length) {
-          import_fs33.default.appendFileSync(
-            HOOK_DEBUG_LOG,
-            `[cost-sync] dropped ${batch.length - stored} of ${batch.length} rows
-`
-          );
+          debugLog(`[cost-sync] dropped ${batch.length - stored} of ${batch.length} rows
+`);
         }
       }
     } catch (err2) {
-      import_fs33.default.appendFileSync(HOOK_DEBUG_LOG, `[cost-sync] ${safeMessage(err2)}
+      debugLog(`[cost-sync] ${safeMessage(err2)}
 `);
     }
   }
 }
+function debugLog(line) {
+  try {
+    import_fs33.default.mkdirSync(import_path34.default.dirname(HOOK_DEBUG_LOG), { recursive: true });
+    import_fs33.default.appendFileSync(HOOK_DEBUG_LOG, line);
+  } catch (err2) {
+    console.error(`[cost-sync] could not write ${HOOK_DEBUG_LOG}: ${safeMessage(err2)}`);
+  }
+}
 async function syncCost() {
   const creds = getCredentials();
   if (!creds?.apiKey || !creds?.apiUrl) return;
@@ -32349,7 +32354,7 @@ var require_diagnostics = __commonJS({
       proxyConnected: diagnosticsChannel.channel("undici:proxy:connected")
     };
     var isTrackingClientEvents = false;
-    function trackClientEvents(debugLog = undiciDebugLog) {
+    function trackClientEvents(debugLog2 = undiciDebugLog) {
       if (isTrackingClientEvents) {
         return;
       }
@@ -32364,7 +32369,7 @@ var require_diagnostics = __commonJS({
           const {
             connectParams: { version: version2, protocol, port, host }
           } = evt;
-          debugLog(
+          debugLog2(
             "connecting to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
@@ -32379,7 +32384,7 @@ var require_diagnostics = __commonJS({
           const {
             connectParams: { version: version2, protocol, port, host }
           } = evt;
-          debugLog(
+          debugLog2(
             "connected to %s%s using %s%s",
             host,
             port ? `:${port}` : "",
@@ -32395,7 +32400,7 @@ var require_diagnostics = __commonJS({
             connectParams: { version: version2, protocol, port, host },
             error
           } = evt;
-          debugLog(
+          debugLog2(
             "connection to %s%s using %s%s errored - %s",
             host,
             port ? `:${port}` : "",
@@ -32411,12 +32416,12 @@ var require_diagnostics = __commonJS({
           const {
             request: { method, path: path91, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path91);
+          debugLog2("sending request to %s %s%s", method, origin, path91);
         }
       );
     }
     var isTrackingRequestEvents = false;
-    function trackRequestEvents(debugLog = undiciDebugLog) {
+    function trackRequestEvents(debugLog2 = undiciDebugLog) {
       if (isTrackingRequestEvents) {
         return;
       }
@@ -32432,7 +32437,7 @@ var require_diagnostics = __commonJS({
             request: { method, path: path91, origin },
             response: { statusCode }
           } = evt;
-          debugLog(
+          debugLog2(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
@@ -32447,7 +32452,7 @@ var require_diagnostics = __commonJS({
           const {
             request: { method, path: path91, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path91);
+          debugLog2("trailers received from %s %s%s", method, origin, path91);
         }
       );
       diagnosticsChannel.subscribe(
@@ -32457,7 +32462,7 @@ var require_diagnostics = __commonJS({
             request: { method, path: path91, origin },
             error
           } = evt;
-          debugLog(
+          debugLog2(
             "request to %s %s%s errored - %s",
             method,
             origin,
@@ -32468,7 +32473,7 @@ var require_diagnostics = __commonJS({
       );
     }
     var isTrackingWebSocketEvents = false;
-    function trackWebSocketEvents(debugLog = websocketDebuglog) {
+    function trackWebSocketEvents(debugLog2 = websocketDebuglog) {
       if (isTrackingWebSocketEvents) {
         return;
       }
@@ -32482,9 +32487,9 @@ var require_diagnostics = __commonJS({
         (evt) => {
           if (evt.address != null) {
             const { address, port } = evt.address;
-            debugLog("connection opened %s%s", address, port ? `:${port}` : "");
+            debugLog2("connection opened %s%s", address, port ? `:${port}` : "");
           } else {
-            debugLog("connection opened");
+            debugLog2("connection opened");
           }
         }
       );
@@ -32492,7 +32497,7 @@ var require_diagnostics = __commonJS({
         "undici:websocket:close",
         (evt) => {
           const { websocket, code: code2, reason } = evt;
-          debugLog(
+          debugLog2(
             "closed connection to %s - %s %s",
             websocket.url,
             code2,
@@ -32503,19 +32508,19 @@ var require_diagnostics = __commonJS({
       diagnosticsChannel.subscribe(
         "undici:websocket:socket_error",
         (err2) => {
-          debugLog("connection errored - %s", err2.message);
+          debugLog2("connection errored - %s", err2.message);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:websocket:ping",
         (evt) => {
-          debugLog("ping received");
+          debugLog2("ping received");
         }
       );
       diagnosticsChannel.subscribe(
         "undici:websocket:pong",
         (evt) => {
-          debugLog("pong received");
+          debugLog2("pong received");
         }
       );
     }
@@ -64565,6 +64570,97 @@ function isZwLegitScript(cp) {
   return cp >= 3584 && cp <= 3711 || cp >= 3712 && cp <= 3839 || cp >= 4096 && cp <= 4255 || cp >= 6016 && cp <= 6143 || cp >= 12352 && cp <= 12543 || cp >= 13312 && cp <= 40959 || cp >= 44032 && cp <= 55215;
 }
 var isAsciiWordChar = (ch) => !!ch && /[A-Za-z0-9]/.test(ch);
+var LOOKALIKE = {
+  \u0430: "a",
+  \u0435: "e",
+  \u043E: "o",
+  \u0440: "p",
+  \u0441: "c",
+  \u0443: "y",
+  \u0445: "x",
+  \u0456: "i",
+  \u0458: "j",
+  \u0455: "s",
+  "\u0501": "d",
+  "\u051B": "q",
+  "\u051D": "w",
+  \u0410: "A",
+  \u0412: "B",
+  \u0415: "E",
+  \u041A: "K",
+  \u041C: "M",
+  \u041D: "H",
+  \u041E: "O",
+  \u0420: "P",
+  \u0421: "C",
+  \u0422: "T",
+  \u0425: "X",
+  \u0406: "I",
+  \u0408: "J",
+  \u0405: "S",
+  "\u050C": "G",
+  "\u051A": "Q",
+  "\u051C": "W",
+  \u03BF: "o",
+  \u03B1: "a",
+  \u03C1: "p",
+  \u03C4: "t",
+  \u03BD: "v",
+  \u03C5: "u",
+  \u03BA: "k",
+  \u03C7: "x",
+  \u03B9: "i",
+  \u0391: "A",
+  \u0392: "B",
+  \u0395: "E",
+  \u0397: "H",
+  \u0399: "I",
+  \u039A: "K",
+  \u039C: "M",
+  \u039D: "N",
+  \u039F: "O",
+  \u03A1: "P",
+  \u03A4: "T",
+  \u03A7: "X",
+  \u03A5: "Y",
+  \u0396: "Z",
+  // Armenian (review, round 2)
+  "\u0585": "o",
+  "\u057D": "u",
+  "\u0570": "h",
+  "\u0578": "n",
+  "\u0581": "g",
+  "\u0566": "q"
+};
+var MIXED_WORD_RE = /[A-Za-z\u0370-\u03ff\u0400-\u04ff\u0500-\u052f\u0530-\u058f]{4,60}/g;
+var FOREIGN_LETTER_RE = /[\u0370-\u03ff\u0400-\u04ff\u0500-\u052f\u0530-\u058f]/;
+var GREEK_RE = /[\u0370-\u03ff]/;
+var EXPLAINED_LINE_RE = /cyrillic|greek|armenian|homoglyph|confusable|look-?alike/i;
+var HOMOGLYPH_MAX_LINE = 2e3;
+function homoglyphWord(content) {
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (text.length > HOMOGLYPH_MAX_LINE) continue;
+    const visible = text.replace(/<!--[\s\S]*?(?:-->|$)/g, "");
+    if (EXPLAINED_LINE_RE.test(visible)) continue;
+    for (const m of text.matchAll(MIXED_WORD_RE)) {
+      const chars = [...m[0]];
+      const latin = chars.filter((c) => /[A-Za-z]/.test(c)).length;
+      const foreign = chars.filter((c) => FOREIGN_LETTER_RE.test(c));
+      if (latin < 2 || !foreign.some((c) => c in LOOKALIKE) || foreign.length > latin) continue;
+      const lead = chars.findIndex((c) => !FOREIGN_LETTER_RE.test(c));
+      if (lead > 0 && chars.slice(0, lead).every((c) => GREEK_RE.test(c)) && lead === foreign.length)
+        continue;
+      return {
+        folded: chars.map((c) => LOOKALIKE[c] ?? c).join(""),
+        count: foreign.length,
+        line: i + 1
+      };
+    }
+  }
+  return null;
+}
 function suspiciousZeroWidth(text) {
   let n = 0;
   let first = -1;
@@ -64808,6 +64904,21 @@ var lineAt = (text, i) => i >= 0 ? lineAtIndex(text, i) : void 0;
 function analyzeInstructionFile(path91, content) {
   const findings = [];
   const decoded = decodeSuspiciousBase64(content);
+  const glyph = homoglyphWord(content);
+  if (glyph)
+    findings.push(
+      mk2(
+        "CI-6.homoglyph",
+        "advisory",
+        "A word in an agent instruction file is spelled with look-alike letters",
+        [
+          `\`${glyph.folded}\` is written with ${glyph.count} non-Latin look-alike letter(s): it reads the same to a reviewer, but a search, a replace or a policy check on the real word misses it`
+        ],
+        "Spell the word with plain Latin letters, or explain on the same line why the look-alikes are there.",
+        path91,
+        glyph.line
+      )
+    );
   if (TAG_CHARS.test(content))
     findings.push(
       mk2(
@@ -64946,13 +65057,17 @@ function analyzeInstructionFile(path91, content) {
 }
 
 // src/ci-check/route.ts
+var MCP_CONFIG_RE = /\.mcp\.json$|\.cursor\/mcp\.json$|(^|\/)\.vscode\/mcp\.json$|(^|\/)\.kiro\/settings\/mcp\.json$|(^|\/)\.gemini\/settings\.json$|(^|\/)opencode\.json$|(^|\/)\.opencode\/config\.json$/;
+var ISSUE_FORM_RE = /^\.github\/ISSUE_TEMPLATE\/[^/]+\.(ya?ml|md)$/i;
 function routeOf(path91, skillDirs, appDirs = /* @__PURE__ */ new Set()) {
   if (path91 === SUPPRESSIONS_FILE) return "suppressions";
   if (/\.github\/workflows\/.+\.ya?ml$/.test(path91)) return "workflow";
+  if (ISSUE_FORM_RE.test(path91)) return "issue-form";
+  if (path91 === "package.json" || path91 === "pyproject.toml") return "manifest";
   if (/\.claude\/settings(\.local)?\.json$/.test(path91)) return "agent-config";
   if (isHookScript(path91)) return "hook-script";
   if (isSkillScript(path91, skillDirs)) return "skill-script";
-  if (/\.mcp\.json$|\.cursor\/mcp\.json$/.test(path91)) return "mcp";
+  if (MCP_CONFIG_RE.test(path91)) return "mcp";
   if (/(^|\/)\.codex\/config\.toml$/.test(path91)) return "codex";
   if (isInstructionFile(path91, skillDirs, appDirs)) return "instruction";
   if (isAppDoc(path91, skillDirs, appDirs)) return "app-doc";
@@ -64984,6 +65099,11 @@ var SURFACE_FILES = [
   ".claude/settings.local.json",
   ".mcp.json",
   ".cursor/mcp.json",
+  ".vscode/mcp.json",
+  ".kiro/settings/mcp.json",
+  ".gemini/settings.json",
+  "opencode.json",
+  ".opencode/config.json",
   ".codex/config.toml",
   // CI-6: agent instruction files (auto-loaded into the agent's system prompt).
   "CLAUDE.md",
@@ -64995,7 +65115,7 @@ var SURFACE_FILES = [
   ".clinerules"
 ];
 var WORKFLOW_DIR = ".github/workflows";
-var CONFIG_FILE_RE = /(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.mcp\.json$|(^|\/)\.cursor\/mcp\.json$|(^|\/)\.codex\/config\.toml$/;
+var CONFIG_FILE_RE = /(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.mcp\.json$|(^|\/)\.cursor\/mcp\.json$|(^|\/)\.codex\/config\.toml$|(^|\/)\.vscode\/mcp\.json$|(^|\/)\.kiro\/settings\/mcp\.json$|(^|\/)\.gemini\/settings\.json$|(^|\/)opencode\.json$|(^|\/)\.opencode\/config\.json$/;
 function selectSurface(paths) {
   const skillDirs = skillDirsOf(paths);
   const appDirs = appSkillDirsOf(paths, skillDirs);
@@ -65144,6 +65264,7 @@ async function listWorkflowPaths(owner, repo, notes) {
   return json.filter((e) => e.type === "file" && /\.ya?ml$/.test(e.name)).map((e) => e.path);
 }
 var ROOT_WORKFLOW_RE = /^\.github\/workflows\/[^/]+\.ya?ml$/;
+var MAX_ISSUE_FORMS = 40;
 function kindOfMode(mode) {
   if (mode === "120000") return "link";
   if (/^100[0-7]{3}$/.test(mode)) return "file";
@@ -65353,8 +65474,15 @@ function planSurface(paths, notes, truncated) {
   const present = new Set(paths);
   const root = SURFACE_FILES.filter((p) => present.has(p));
   const workflows = paths.filter((p) => ROOT_WORKFLOW_RE.test(p));
+  const allForms = paths.filter((p) => ISSUE_FORM_RE.test(p));
+  const forms = allForms.slice(0, MAX_ISSUE_FORMS);
+  if (allForms.length > MAX_ISSUE_FORMS)
+    notes.push(
+      `${allForms.length} issue forms; read the first ${MAX_ISSUE_FORMS} (a label an unread form applies is not known): results ${INCOMPLETE}.`
+    );
+  forms.push(...["package.json", "pyproject.toml"].filter((p) => present.has(p)));
   const nested = pickSurfacePaths(paths, truncated, notes, { files: Number.POSITIVE_INFINITY });
-  return [.../* @__PURE__ */ new Set([...root, ...workflows, ...nested])];
+  return [.../* @__PURE__ */ new Set([...root, ...workflows, ...forms, ...nested])];
 }
 function planReads(l, R, opts = {}) {
   const notes = [];
@@ -65420,7 +65548,7 @@ function planReads(l, R, opts = {}) {
 function capNested(reads, cap, notes) {
   if (cap === void 0) return reads;
   const rootSet = new Set(SURFACE_FILES);
-  const isRoot = (r) => rootSet.has(r.rel) || ROOT_WORKFLOW_RE.test(r.rel);
+  const isRoot = (r) => rootSet.has(r.rel) || ROOT_WORKFLOW_RE.test(r.rel) || ISSUE_FORM_RE.test(r.rel) || r.rel === "package.json" || r.rel === "pyproject.toml";
   const nested = reads.filter((r) => !isRoot(r));
   if (nested.length < cap) return reads;
   const keep = new Set(nested.slice(0, cap));
@@ -65516,6 +65644,45 @@ function readLocalFile(abs, rel) {
     if (fd !== void 0) import_fs74.default.closeSync(fd);
   }
 }
+function readSmallFile(p, max) {
+  let fd;
+  try {
+    fd = import_fs74.default.openSync(p, import_fs74.default.constants.O_RDONLY | (import_fs74.default.constants.O_NOFOLLOW ?? 0));
+    const st = import_fs74.default.fstatSync(fd);
+    if (!st.isFile() || st.size > max) return null;
+    const buf = Buffer.alloc(st.size);
+    const n = import_fs74.default.readSync(fd, buf, 0, st.size, 0);
+    return buf.subarray(0, n).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) import_fs74.default.closeSync(fd);
+  }
+}
+function localGitHubOwner(root) {
+  let cfg = readSmallFile(import_path71.default.join(root, ".git", "config"), 1e6);
+  if (cfg === null) {
+    const pointer = readSmallFile(import_path71.default.join(root, ".git"), 4096);
+    const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
+    if (!m) return void 0;
+    let gitDir = import_path71.default.resolve(root, m[1]);
+    const common = readSmallFile(import_path71.default.join(gitDir, "commondir"), 4096);
+    if (common !== null) gitDir = import_path71.default.resolve(gitDir, common.trim());
+    cfg = readSmallFile(import_path71.default.join(gitDir, "config"), 1e6);
+    if (cfg === null) return void 0;
+  }
+  let inOrigin = false;
+  for (const line of cfg.split(/\r?\n/)) {
+    const sec = /^\s*\[\s*([^\]\s]+)(?:\s+"([^"]*)")?\s*\]/.exec(line);
+    if (sec) {
+      inOrigin = sec[1].toLowerCase() === "remote" && sec[2] === "origin";
+      continue;
+    }
+    const url = inOrigin && /^\s*url\s*=\s*(.+?)\s*$/i.exec(line);
+    if (url) return /github\.com[:/]([\w.-]{1,100})\//i.exec(url[1])?.[1];
+  }
+  return void 0;
+}
 function readLocalTree(dir) {
   const root = dir.replace(/^~/, process.env.HOME ?? "~");
   const notes = [];
@@ -65545,8 +65712,10 @@ function readLocalTree(dir) {
       }
     });
   }
+  const owner = localGitHubOwner(root);
   return {
     source: root,
+    ...owner ? { owner } : {},
     files,
     notes,
     paths: plan.paths,
@@ -65659,8 +65828,10 @@ function readGitRefTree(dir, ref) {
       }
       files.push({ path: rel, content, route });
     }
+    const owner = localGitHubOwner(root);
     return {
       source: `${root}@${ref}`,
+      ...owner ? { owner } : {},
       files,
       notes,
       paths: plan.paths,
@@ -65760,7 +65931,13 @@ async function fetchGitHubTree(owner, repo, onProgress) {
     const listed2 = await listTree(owner, repo, notes);
     if (!listed2) {
       const workflowPaths = await listWorkflowPaths(owner, repo, notes);
-      const allPaths = [.../* @__PURE__ */ new Set([...SURFACE_FILES, ...workflowPaths])];
+      const allPaths = [
+        .../* @__PURE__ */ new Set([...SURFACE_FILES, ...workflowPaths, "package.json", "pyproject.toml"])
+      ];
+      if (!notes.includes(RATE_LIMIT_NOTE) && !notes.includes(NETWORK_NOTE))
+        notes.push(
+          `the repository tree could not be listed; only the root files and the workflows were read: nested agent files ${INCOMPLETE}.`
+        );
       const fetched2 = await pooled(
         allPaths,
         FETCH_CONCURRENCY,
@@ -65768,6 +65945,7 @@ async function fetchGitHubTree(owner, repo, onProgress) {
       );
       return {
         source: `${owner}/${repo}`,
+        owner,
         files: fetched2.filter((f) => !!f),
         notes
       };
@@ -65823,6 +66001,7 @@ async function fetchGitHubTree(owner, repo, onProgress) {
     notes.push(...session.closingNotes());
     return {
       source: `${owner}/${repo}`,
+      owner,
       files: fetched.filter((f) => !!f),
       notes,
       paths: plan.paths,
@@ -65833,7 +66012,7 @@ async function fetchGitHubTree(owner, repo, onProgress) {
     notes.push(
       `fetch degraded (${err2?.message ?? "network error"}): results ${INCOMPLETE} (the repo could not be fetched).`
     );
-    return { source: `${owner}/${repo}`, files: [], notes };
+    return { source: `${owner}/${repo}`, owner, files: [], notes };
   }
 }
 async function fetchTree(input, onProgress) {
@@ -65996,7 +66175,15 @@ function explainGrant(f) {
   const git = f.broad.some((a) => /^Bash\(git:/.test(a));
   const files = f.broad.some((a) => /^Write|^Edit$/.test(a));
   const template = TEMPLATE_PATH_RE.test(f.file);
-  const what = f.bareShell ? "run commands and change files" : sentence([git ? "run git commands" : "", files ? "change files" : ""].filter(Boolean), true);
+  const runner = f.broad.some((a) => !/^Bash\(git:|^Write|^Edit$/.test(a));
+  const what = f.bareShell ? "run commands and change files" : sentence(
+    [
+      runner ? "run programs" : "",
+      git ? "run git commands" : "",
+      files ? "change files" : ""
+    ].filter(Boolean),
+    true
+  );
   const saw = [];
   if (template) saw.push("This is a template: every project made from it gets these permissions.");
   saw.push(
@@ -66036,14 +66223,17 @@ function npxPackage(argv) {
   return null;
 }
 function explainMcp(f) {
-  const pkg = npxPackage(f.argv);
-  const what = pkg ? code(pkg) : "the package";
+  const pkg = f.pkg ?? npxPackage(f.argv);
+  const registry = f.registry ?? "npm";
+  const image = registry === "the image registry";
+  const what = pkg ? `the newest ${code(pkg)}` : image ? "the newest image" : "the newest version of the package";
+  const example = !pkg ? null : image ? `${pkg}@sha256:\u2026` : registry === "PyPI" ? `${pkg}==x.y.z` : registry === "the Go module proxy" ? `${pkg}@vX.Y.Z` : `${pkg}@x.y.z`;
   return {
     headline: `MCP server ${code(f.name, 60)} installs whatever version is newest, every time`,
-    happens: `Each run downloads the latest ${what} from npm. If that package is ever taken over, the next version runs on every developer's computer.`,
+    happens: `Each run downloads ${what} from ${registry}. If it is ever taken over, the next version runs on every developer's computer.`,
     saw: [`It starts with ${code(f.argv, 120)}.`],
     fix: [
-      pkg ? `Pin an exact version, for example ${code(`${pkg}@x.y.z`)}.` : "Pin an exact version."
+      example ? `Pin an exact version, for example ${code(example)}.` : "Pin an exact version."
     ]
   };
 }
@@ -66067,6 +66257,65 @@ function parseYamlStrict(text) {
   return doc.toJS();
 }
 
+// src/ci-check/frontmatter.ts
+function parseFrontmatter(content) {
+  const text = content.replace(/^/, "").replace(/^\s*\n/, "");
+  if (!/^---[ \t]*\r?\n/.test(text)) return null;
+  const close = /\r?\n---[ \t]*(\r?\n|$)/.exec(text.slice(3));
+  if (!close) return null;
+  const block = text.slice(3, 3 + close.index);
+  try {
+    const parsed = parseYamlStrict(block);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return salvageTopLevel(block);
+  }
+}
+function salvageTopLevel(block) {
+  const out = {};
+  const lines = block.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const m = /^([A-Za-z0-9_-]+):[ \t]*(.*)$/.exec(lines[i]);
+    if (!m) continue;
+    const [, key, rest] = m;
+    if (rest.trim()) {
+      out[key] = rest.trim();
+      continue;
+    }
+    const items = [];
+    while (i + 1 < lines.length && /^[ \t]+-[ \t]+/.test(lines[i + 1])) {
+      items.push(lines[++i].replace(/^[ \t]+-[ \t]+/, "").trim());
+    }
+    if (items.length) out[key] = items;
+  }
+  return Object.keys(out).length ? out : null;
+}
+function splitGrants(value) {
+  const out = [];
+  let depth = 0;
+  let cur = "";
+  for (const ch of value) {
+    if (ch === "(") depth++;
+    else if (ch === ")") depth = Math.max(0, depth - 1);
+    if (depth === 0 && (ch === "," || /\s/.test(ch))) {
+      if (cur) out.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+function allowedToolsOf(fm) {
+  const raw = fm?.["allowed-tools"];
+  if (typeof raw === "string") return splitGrants(raw);
+  if (Array.isArray(raw)) {
+    return raw.filter((x) => typeof x === "string").map((x) => x.trim()).filter(Boolean);
+  }
+  return [];
+}
+
 // src/ci-check/types.ts
 var SEVERITY_RANK2 = {
   critical: 4,
@@ -66075,11 +66324,28 @@ var SEVERITY_RANK2 = {
   advisory: 1
 };
 
+// src/ci-check/listing.ts
+var SAFE_LIST_FIELD_RE = /^(?:number|url|html_url|id|node_id|sha|state|createdat|updatedat|closedat|mergedat|headrefname|baserefname|isdraft|headrefoid|login|user|author_association)$/i;
+function sanitizedListing(t) {
+  if (t.length > 5e4) return false;
+  if (/\|\s*grep\s+-[a-zA-Z]*o/.test(t)) return true;
+  const fieldsSafe = (expr, fieldRe) => {
+    const fields = [...expr.matchAll(fieldRe)].map((m) => m[1]);
+    return fields.length > 0 && fields.every((f) => SAFE_LIST_FIELD_RE.test(f));
+  };
+  const jq = [
+    ...t.matchAll(/(?:--jq|\s-q)[\s=]+(?:'([^']{0,500})'|"([^"]{0,500})"|([^\s'"]{1,200}))/g)
+  ].map((m) => m[1] ?? m[2] ?? m[3]);
+  if (jq.length) return jq.every((e) => fieldsSafe(e, /\.([A-Za-z_]\w{0,60})/g));
+  const json = [...t.matchAll(/--json[\s=]+['"]?([\w,]{1,500})/g)].map((m) => m[1]);
+  return json.length > 0 && json.every((e) => fieldsSafe(e, /([A-Za-z_]\w{0,60})/g));
+}
+
 // src/ci-check/workflows.ts
 var AGENT_ACTION_RE = /(anthropics\/claude-code(-base)?-action|anthropics\/claude-code|^\s*[\w.-]{1,100}\/claude-code-action@|openai\/codex|codex-action|run-?aider|aider-?action|google-github-actions\/run-gemini)/i;
 var BROAD_TOOL_RE = /(^|["\s,])(Bash|Write|Edit)(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|git push|git commit|git config|git:|rm|sh|bash|eval|npx|pip)/i;
 var EXFIL_RCE_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\((curl|wget|sh[\s):]|eval|rm[\s):]|git push)/i;
-var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|git push|git:)/i;
+var GH_WRITE_TOOL_RE = /Bash\(\s*(gh api|gh:|gh (pr|issue) (comment|edit|merge|close|review|create|ready|lock|reopen)|gh (pr|issue)\s*[:*)]|git push|git:)/i;
 var EGRESS_TOOL_RE = /(^|["\s,])Bash(\s|,|"|$)|Bash\(\s*\*|Bash\(\s*(curl|wget|python|python3|node|deno|bun|ruby|perl|php|pip|pipx|npx|nc|ncat|ssh|scp|http|gh api)|WebFetch|WebSearch/i;
 var MEMBERSHIP_CHECK_RE = /orgs\/[^/'"\s]+\/memberships\/|teams\/[^/'"\s]+\/memberships\/|getCollaboratorPermissionLevel|collaborators\/[^/'"\s]+\/permission|checkMembershipForUser|getMembershipForUser/i;
 var STRANGER_ISSUE_TYPES = /* @__PURE__ */ new Set(["opened", "edited", "reopened", "closed"]);
@@ -66135,12 +66401,69 @@ function keyStrangerFirable(on, key) {
       return false;
   }
 }
+var AUTO_LABELS = /* @__PURE__ */ new Set();
+function issueFormLabels(content) {
+  const text = content.length > 2e5 ? content.slice(0, 2e5) : content;
+  let value;
+  let parsed = false;
+  if (/^\uFEFF?\s*---[ \t]*\r?\n/.test(text)) {
+    const fm = parseFrontmatter(text);
+    parsed = fm !== null;
+    value = fm?.["labels"];
+  } else {
+    try {
+      const doc = parseYamlStrict(text);
+      parsed = true;
+      if (doc && typeof doc === "object" && !Array.isArray(doc))
+        value = doc["labels"];
+    } catch {
+    }
+  }
+  const raw = parsed ? Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [] : labelLines(text);
+  return raw.filter((l) => typeof l === "string").map(
+    (l) => l.trim().replace(/^['"]|['"]$/g, "").trim().toLowerCase()
+  ).filter((l) => l && l.length <= 100);
+}
+function labelLines(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const m = /^labels:[ \t]*([^#]*)/.exec(lines[i]);
+    if (!m) continue;
+    const inline = m[1].trim();
+    if (inline) {
+      out.push(...inline.replace(/^\[|\]$/g, "").split(","));
+    } else {
+      for (let j = i + 1; j < lines.length && /^\s*-\s/.test(lines[j]); j++)
+        out.push(lines[j].replace(/^\s*-\s/, "").replace(/\s#.*$/, ""));
+    }
+  }
+  return out;
+}
+var CALLERS = /* @__PURE__ */ new WeakMap();
 function triggerReach(wf, raw) {
   const on = onObject(wf, raw) ?? {};
   const keys = triggerKeys(wf, raw);
-  const firable = keys.filter((k) => keyStrangerFirable(on, k));
+  const firable = keys.filter(
+    (k) => keyStrangerFirable(on, k) || /^issues$/i.test(k) && testsAutoLabel(allIfText(wf))
+  );
   const untrusted = firable.length > 0;
   const reusable = !untrusted && keys.some((k) => /^workflow_call$/i.test(k));
+  const callers = CALLERS.get(wf);
+  const open = (callers ?? []).filter((c) => c.untrusted && !c.gated && !c.dispatched);
+  const unresolved = (callers ?? []).some(
+    (c) => c.untrusted && !c.gated && c.dispatched || c.reusable && !c.gated
+  );
+  if (reusable && callers?.length && (open.length || !unresolved)) {
+    return {
+      keys: [...new Set(open.flatMap((c) => c.keys))],
+      untrusted: open.length > 0,
+      reusable: false,
+      secretExposed: open.some((c) => c.secretExposed),
+      privileged: open.some((c) => c.privileged),
+      workflowRun: open.some((c) => c.workflowRun)
+    };
+  }
   const secretExposed = firable.some((t) => /pull_request_target|workflow_run/i.test(t));
   const privileged = untrusted && firable.some(
     (t) => /pull_request_target|pull_request_review|workflow_run|issue|discussion/i.test(t)
@@ -66151,6 +66474,160 @@ function triggerReach(wf, raw) {
 function jobList(wf) {
   return Object.values(wf.jobs ?? {}).filter((j) => j != null);
 }
+var ENV_REF_RE = /\$\{\{\s*env(?:\.([A-Za-z_][A-Za-z0-9_]{0,100})|\[\s*['"]([A-Za-z_][A-Za-z0-9_]{0,100})['"]\s*\])\s*\}\}/g;
+var ENV_REF_HOPS = 3;
+var RESOLVED_MAX_LEN = 1e5;
+function resolveEnvRefs(v, envs) {
+  const holderOf = (name) => envs.find((e) => e != null && typeof e === "object" && name in e);
+  for (let hop = 0; hop < ENV_REF_HOPS && v.includes("env"); hop++) {
+    let projected = v.length;
+    let any = false;
+    for (const m of v.matchAll(ENV_REF_RE)) {
+      const name = m[1] ?? m[2];
+      const holder = holderOf(name);
+      if (holder) {
+        any = true;
+        projected += str(holder[name]).length - m[0].length;
+      }
+      if (projected > RESOLVED_MAX_LEN) return v;
+    }
+    if (!any) break;
+    v = v.replace(ENV_REF_RE, (whole, a, b) => {
+      const name = a ?? b;
+      const holder = holderOf(name);
+      return holder ? str(holder[name]) : whole;
+    });
+  }
+  return v;
+}
+function ifNeverTrue(v) {
+  if (v === false) return true;
+  if (typeof v !== "string") return false;
+  const never = (x2) => {
+    switch (x2.k) {
+      case "atom":
+        return /^false$/i.test(x2.t.trim());
+      case "not":
+        return false;
+      case "and":
+        return x2.c.some(never);
+      case "or":
+        return x2.c.every(never);
+    }
+  };
+  const x = parseIf(v);
+  return x !== null && never(x);
+}
+function normalizeWorkflow(raw) {
+  const wf = raw;
+  const wfEnv = raw.env;
+  const jobs = wf.jobs;
+  if (!jobs || typeof jobs !== "object") return wf;
+  const wfEnvEvent = EVENT_CONTEXT_RE.test(str(wfEnv));
+  for (const [name, job] of Object.entries(jobs)) {
+    if (job == null || typeof job !== "object") continue;
+    if (ifNeverTrue(job.if)) {
+      delete jobs[name];
+      continue;
+    }
+    if (!Array.isArray(job.steps)) continue;
+    job.steps = job.steps.map(
+      (st) => st != null && typeof st === "object" && !Array.isArray(st) ? { ...st } : st
+    );
+    const scopeEnv = {
+      ...wfEnv && typeof wfEnv === "object" ? wfEnv : {},
+      ...job.env && typeof job.env === "object" ? job.env : {}
+    };
+    const scopeEnvEvent = wfEnvEvent || EVENT_CONTEXT_RE.test(str(job.env));
+    for (const step of job.steps) {
+      if (step == null || typeof step !== "object") continue;
+      step.scopeEnv = scopeEnv;
+      step.scopeEnvEvent = scopeEnvEvent;
+      if (step.with == null || typeof step.with !== "object") continue;
+      const out = {};
+      for (const [k, v] of Object.entries(step.with)) {
+        const key = k.toLowerCase();
+        if (key in out) continue;
+        out[key] = typeof v === "string" ? resolveEnvRefs(v, [step.env, job.env, wfEnv]) : v;
+      }
+      step.with = out;
+    }
+  }
+  return wf;
+}
+var LOADED = null;
+function loadWorkflow(content) {
+  if (LOADED !== null && LOADED.content === content) return LOADED;
+  const raw = parseYamlStrict(content) ?? {};
+  const wf = raw && typeof raw === "object" ? normalizeWorkflow(raw) : raw;
+  LOADED = { content, raw, wf };
+  return LOADED;
+}
+var LOCAL_WORKFLOW_USES_RE = /^\s*\.\/\.github\/workflows\/([\w.-]{1,200}\.ya?ml)\s*$/i;
+function localCallsOf(path91, content, autoLabels) {
+  AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  try {
+    return localCallsOfInner(path91, content);
+  } finally {
+    AUTO_LABELS = /* @__PURE__ */ new Set();
+  }
+}
+function localCallsOfInner(path91, content) {
+  let raw;
+  try {
+    raw = loadWorkflow(content).raw;
+  } catch {
+    return [];
+  }
+  if (!raw || typeof raw !== "object") return [];
+  const wf = raw;
+  CALLERS.delete(wf);
+  const reach = triggerReach(wf, raw);
+  const out = [];
+  for (const job of jobList(wf)) {
+    const m = LOCAL_WORKFLOW_USES_RE.exec(str(job.uses));
+    if (!m) continue;
+    out.push({
+      target: `.github/workflows/${m[1]}`,
+      caller: {
+        file: path91,
+        keys: reach.keys,
+        untrusted: reach.untrusted,
+        secretExposed: reach.secretExposed,
+        privileged: reach.privileged,
+        workflowRun: reach.workflowRun,
+        gated: jobGated(job, wf, raw),
+        dispatched: dispatchedByGatedJob(job, wf, raw),
+        reusable: reach.reusable
+      }
+    });
+  }
+  return out;
+}
+function dispatchedByGatedJob(job, wf, raw) {
+  const names = [...str(job.if).matchAll(/needs\.([\w-]{1,100})\.outputs\./g)].map((m) => m[1]);
+  if (!names.length) return false;
+  const jobs = wf.jobs ?? {};
+  const label3 = labelTypeConfigured(wf, raw);
+  const someBranchGated = (x) => {
+    switch (x.k) {
+      case "atom":
+        return exprGated(x, label3);
+      case "not":
+        return false;
+      case "and":
+      case "or":
+        return x.c.some(someBranchGated);
+    }
+  };
+  return names.every((n) => {
+    const up = jobs[n];
+    if (up == null) return false;
+    if (jobGated(up, wf, raw)) return true;
+    const x = parseIf(str(up.if));
+    return x !== null && someBranchGated(x);
+  });
+}
 function allSteps(wf) {
   const out = [];
   for (const job of jobList(wf)) {
@@ -66158,11 +66635,47 @@ function allSteps(wf) {
   }
   return out;
 }
+var AGENT_CLI_RE = new RegExp(
+  [
+    // The binary at a command start, then its "do work" flag anywhere on the same command
+    // (`claude --model x -p`, `claude "$Q" --print`, `npx @anthropic-ai/claude-code -p`): the
+    // flag had to come first (review, round 2). Bounded: at most 300 characters per command.
+    String.raw`(?:^|[\s|;&(])(?:claude|@anthropic-ai/claude-code(?:@[\w.-]{1,40})?)(?=\s)[^\n;&|]{0,300}?\s(?:-p|--print|--continue|--resume)(?=[\s"'=]|$)`,
+    String.raw`(?:^|[\s|;&(])(?:codex|@openai/codex(?:@[\w.-]{1,40})?)(?=\s)[^\n;&|]{0,300}?\sexec\b`,
+    String.raw`(?:^|[\s|;&(])(?:gemini|@google/gemini-cli(?:@[\w.-]{1,40})?)(?=\s)[^\n;&|]{0,300}?\s(?:-p|--prompt)(?=[\s"'=]|$)`,
+    String.raw`(?:^|[\s|;&(])copilot(?=\s)[^\n;&|]{0,300}?\s(?:-p|--prompt|--allow-all-tools)(?=[\s"'=]|$)`,
+    String.raw`\b(?:aider\s|opencode\s+run\b|goose\s+run\b|kilo\s+run\b|pi\s+--print\b|llmproc\s|acpx\s|harbor\s+(?:check|run)\b)`,
+    String.raw`api\.devin\.ai/|software-agent-sdk|\bagent_script\.py\b`
+  ].join("|"),
+  "i"
+);
+var RUN_FUEL_ENV_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|GEMINI_API_KEY|GOOGLE_API_KEY|KILO_API_KEY|OPENCODE_API_KEY|DEVIN_API_KEY|LLM_API_KEY|AWS_BEARER_TOKEN_BEDROCK)$/i;
+var EVENT_CONTEXT_RE = /github\.event|context\.payload/;
+function isRunAgent(step) {
+  return typeof step.run === "string" && !step.uses && AGENT_CLI_RE.test(step.run);
+}
+var FUEL_WITH_KEY_RE = /^(anthropic[_-]api[_-]key|anthropic[_-]auth[_-]token|claude[_-]code[_-]oauth[_-]token|claude[_-]oauth[_-]token|openai[_-]api[_-]key|gemini[_-]api[_-]key|google[_-]api[_-]key)$/i;
+var AGENT_PATH_RE = /(?:^|[/_.-])(claude|codex|gemini|opencode|goose|aider|kilo(?:code)?)(?:$|[/_.-])/i;
+var PROMPT_INPUT_RE = /^(prompt|direct_prompt|prompt_file|prompt-file|agent)$/i;
+function isWrapperAgent(step) {
+  const uses = str(step.uses);
+  const w = step.with ?? {};
+  if (Object.keys(w).some((k) => FUEL_WITH_KEY_RE.test(k))) return true;
+  const env = { ...step.scopeEnv ?? {}, ...step.env ?? {} };
+  const fuelEnv = Object.keys(env).some((k) => RUN_FUEL_ENV_RE.test(k));
+  if (/^\s*\.\//.test(uses)) return fuelEnv;
+  const pathPart = uses.replace(/^\s*[^/@\s]{1,100}\//, "").replace(/@.*$/, "");
+  return AGENT_PATH_RE.test(pathPart) && (Object.keys(w).some((k) => PROMPT_INPUT_RE.test(k)) || fuelEnv);
+}
 function isAgentStep(step) {
   if (step.uses && AGENT_ACTION_RE.test(step.uses)) return true;
-  if (step.run && /\b(claude|aider|codex|gemini)\b/i.test(step.run) && /github\.event/.test(step.run))
+  if (step.uses && isWrapperAgent(step)) return true;
+  if (typeof step.run !== "string" || !step.run) return false;
+  if (/\b(claude|aider|codex|gemini)\b/i.test(step.run) && /github\.event/.test(step.run))
     return true;
-  return false;
+  if (!AGENT_CLI_RE.test(step.run)) return false;
+  const env = { ...step.scopeEnv ?? {}, ...step.env ?? {} };
+  return !!step.scopeEnvEvent || EVENT_CONTEXT_RE.test(str(step.env)) || Object.keys(env).some((k) => RUN_FUEL_ENV_RE.test(k));
 }
 function allowedToolsFromArgs(claudeArgs) {
   let out = "";
@@ -66182,12 +66695,47 @@ function collectTools(steps) {
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + allowedToolsFromArgs(str(w["claude_args"]));
-    s += " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    const args = str(w["claude_args"]) + " " + str(w["codex-args"]) + " " + str(w["codex_args"]);
+    s += " " + allowedToolsFromArgs(args);
+    s += " " + str(w["allowed_tools"]) + " " + str(w["allowedtools"]);
     s += " " + allowedToolsFromSettings(str(w["settings"]));
+    if (PERMISSION_BYPASS_RE.test(args) || /^danger-full-access$/i.test(str(w["sandbox"])))
+      s += " Bash";
+    if (st.run && isRunAgent(st)) {
+      s += " " + allowedToolsFromArgs(st.run);
+      if (PERMISSION_BYPASS_RE.test(st.run)) s += " Bash";
+      s += " " + permissionEnvGrants({ ...st.scopeEnv ?? {}, ...st.env ?? {} });
+    }
   }
   return s;
 }
+var PERMISSION_BYPASS_RE = /--dangerously-skip-permissions|--permission-mode[=\s]+["']?bypassPermissions|--dangerously-bypass-approvals-and-sandbox|--allow-all-tools|--yolo\b/i;
+function permissionEnvGrants(env) {
+  let out = "";
+  for (const key of ["OPENCODE_PERMISSION", "KILO_PERMISSION"]) {
+    const raw = str(env[key]);
+    if (!raw || raw.length > 2e4) continue;
+    let cfg;
+    try {
+      cfg = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (!cfg || typeof cfg !== "object") continue;
+    const c = cfg;
+    const bash = c["bash"];
+    if (bash === "allow") out += " Bash";
+    else if (bash && typeof bash === "object") {
+      for (const [pat, v] of Object.entries(bash)) {
+        if (v !== "allow") continue;
+        const cmd = pat.replace(/\*+\s*$/, "").trim();
+        out += cmd ? ` Bash(${cmd}:*)` : " Bash";
+      }
+    }
+    if (c["webfetch"] === "allow") out += " WebFetch";
+  }
+  return out;
+}
 function toolTokens(blob) {
   const out = [];
   let buf = "";
@@ -66220,11 +66768,21 @@ function matchedBroadTools(blob) {
   }
   return out;
 }
+var GH_PR_CHECKOUT_RE = /\bgh\s+pr\s+checkout\b/;
+var FETCH_PULL_RE = /\bgit\s+fetch\b[^\n]{0,200}\bpull\/[^\s/]{1,80}\/(?:head|merge)\b/;
+var GIT_CHECKOUT_RE = /\bgit\s+(?:checkout|switch)\b/;
+function runChecksOutHead(run) {
+  if (GH_PR_CHECKOUT_RE.test(run)) return true;
+  const m = FETCH_PULL_RE.exec(run);
+  return m !== null && GIT_CHECKOUT_RE.test(run.slice(m.index));
+}
 function untrustedHeadCheckout(steps) {
   for (const step of steps) {
+    if (!step.uses && typeof step.run === "string" && runChecksOutHead(step.run)) return "root";
     if (!step.uses || !/actions\/checkout/.test(step.uses)) continue;
     const ref = str(step.with?.["ref"]);
-    if (/pull_request\.head|head[._]sha|head_ref|expected_head|workflow_run\.head|inputs\.[\w]*head/i.test(
+    if (/refs\/pull\//.test(ref)) return step.with?.["path"] ? "subdir" : "root";
+    if (/pull_request\.head|head[._-]sha|head_ref|expected_head|workflow_run\.head|inputs(?:\.|\[\s*['"])[\w-]*head/i.test(
       ref
     )) {
       return step.with?.["path"] ? "subdir" : "root";
@@ -66234,22 +66792,61 @@ function untrustedHeadCheckout(steps) {
 }
 function promptTakesUntrusted(steps) {
   for (const st of steps) {
-    const blob = str(st.with?.["prompt"]) + " " + str(st.with?.["direct_prompt"]) + " " + collectTools([st]);
+    const blob = str(st.with?.["prompt"]) + " " + str(st.with?.["direct_prompt"]) + " " + collectTools([st]) + // T.2a: a run-step agent's prompt is its command line and the env it reads.
+    (isRunAgent(st) ? " " + st.run + " " + str(st.env) + " " + str(st.scopeEnv) : "");
     if (/github\.event\.(issue|comment|pull_request|review)\.(body|title)/i.test(blob)) return true;
-    if (/pull_request\.number|\/code-review|\/review/i.test(blob)) return true;
+    if (/pull_request\.number|(?<![\w./-])\/(?:code-)?review(?![\w-])/i.test(blob)) return true;
   }
   return false;
 }
 var ITEM_READ_TOOL_RE = /mcp__github__(get_issue|get_issue_comments|get_pull_request|get_pull_request_diff|get_pull_request_files|get_pull_request_comments|get_pull_request_reviews|search_issues|list_issues)\b|Bash\(\s*gh\s+(issue|pr)\s+(view|diff|list)\b|Bash\(\s*gh\s+(api|search)\b|Bash\(\s*gh\s*:/i;
 var ITEM_HANDLE_RE = /github\.event\.(issue|pull_request|discussion)\.number|github\.event\.number\b|github\.event\.comment\.id/i;
 var PAYLOAD_TEXT_RE = /github\.event\.(issue|comment|pull_request|review|discussion)\.(body|title)|context\.payload\.(issue|comment|pull_request|review|discussion)\b|GITHUB_EVENT_PATH|github\.event_path/i;
+var RUN_ARTIFACT_RE = /gh\s+run\s+download\b|\/runs\/\$\{\{\s*github\.event\.workflow_run\.id\s*\}\}\/(?:artifacts|logs)/i;
+var TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
+var UPSTREAM_TRUSTED = false;
+function upstreamRunTrusted(wf, raw) {
+  const on = onObject(wf, raw);
+  const run = on?.["workflow_run"];
+  const names = Array.isArray(run?.workflows) ? run.workflows.map(String) : [];
+  return names.length > 0 && names.every((n) => TRUSTED_RUN_SOURCES.has(n));
+}
+function runSourceOf(path91, content, autoLabels) {
+  AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  try {
+    let raw;
+    try {
+      raw = loadWorkflow(content).raw;
+    } catch {
+      return null;
+    }
+    if (!raw || typeof raw !== "object") return null;
+    const wf = raw;
+    CALLERS.delete(wf);
+    const reach = triggerReach(wf, raw);
+    const name = typeof raw["name"] === "string" && raw["name"] ? raw["name"] : path91;
+    return { name, trusted: !reach.untrusted && !reach.reusable };
+  } finally {
+    AUTO_LABELS = /* @__PURE__ */ new Set();
+  }
+}
+function downloadsRunArtifacts(st) {
+  if (UPSTREAM_TRUSTED) return false;
+  if (/actions\/download-artifact/i.test(str(st.uses)))
+    return /workflow_run\.id/.test(str(st.with?.["run-id"]) + " " + str(st.with?.["run_id"]));
+  return RUN_ARTIFACT_RE.test(str(st.run) + " " + str(st.with?.["script"]));
+}
+var STEP_OUTPUT_REF_RE = /steps\.([\w-]{1,100})\.outputs\./g;
 function jobReadsUntrustedItem(job) {
   const steps = job.steps ?? [];
   const agent = steps.filter(isAgentStep);
   if (!agent.length) return null;
   if (ITEM_READ_TOOL_RE.test(collectTools(agent))) return "tool";
   for (const st of agent)
-    if (ITEM_HANDLE_RE.test(str(st.with) + " " + str(st.env) + " " + str(job.env))) return "handle";
+    if (ITEM_HANDLE_RE.test(
+      str(st.with) + " " + str(st.env) + " " + str(job.env) + " " + (isRunAgent(st) ? str(st.run) : "")
+    ))
+      return "handle";
   for (let i = 0; i < steps.length; i++) {
     const st = steps[i];
     if (!isAgentStep(st) || !str(st.with?.["prompt_file"] ?? st.with?.["prompt-file"])) continue;
@@ -66257,6 +66854,20 @@ function jobReadsUntrustedItem(job) {
     if (earlier.some((p) => PAYLOAD_TEXT_RE.test(str(p.run) + " " + str(p.with) + " " + str(p.env))))
       return "prompt-file";
   }
+  const firstDownload = steps.findIndex(downloadsRunArtifacts);
+  if (firstDownload >= 0 && steps.slice(firstDownload + 1).some(isAgentStep)) return "artifact";
+  for (let i = 0; i < steps.length; i++) {
+    const st = steps[i];
+    if (!isAgentStep(st)) continue;
+    const input = str(st.with?.["prompt"]) + " " + str(st.with?.["direct_prompt"]) + " " + str(st.with?.["prompt_file"] ?? st.with?.["prompt-file"]);
+    const ids = /* @__PURE__ */ new Set();
+    for (const m of input.matchAll(STEP_OUTPUT_REF_RE)) ids.add(m[1]);
+    for (const id of ids) {
+      const src = steps.slice(0, i).find((p) => p.id === id);
+      if (src && PAYLOAD_TEXT_RE.test(str(src.run) + " " + str(src.with) + " " + str(src.env)))
+        return "step-output";
+    }
+  }
   return null;
 }
 var NONCONTAINS_GATE_RE = new RegExp(
@@ -66269,19 +66880,46 @@ var NONCONTAINS_GATE_RE = new RegExp(
   ].join("|"),
   "i"
 );
-var PERMISSION_OUTPUT_GATE_RE = /steps\.[\w-]+\.outputs\.[\w-]*(permission|allowed|authoriz|is[_-]?(admin|member|maintainer|collaborator))[\w-]*\s*==\s*['"]?(true|admin|write|maintain)/i;
+var PERMISSION_OUTPUT_RE = /steps\.[\w-]{1,100}\.outputs\.([\w-]{1,200})\s*==\s*['"]?(?:true|admin|write|maintain)/gi;
+var PERMISSION_OUTPUT_NAME_RE = /permission|allowed|authoriz|is[_-]?(?:admin|member|maintainer|collaborator)/i;
+var PERMISSION_OUTPUT_GATE_RE = {
+  test(ifs) {
+    for (const m of ifs.matchAll(PERMISSION_OUTPUT_RE))
+      if (PERMISSION_OUTPUT_NAME_RE.test(m[1])) return true;
+    return false;
+  }
+};
 var CONTAINS_GATE_RE = /contains\((?:[^()]|\([^()]*\))*(login|actor|association|OWNER|MEMBER|COLLABORATOR)/i;
 var NEGATED_CONTAINS_RE = /!\s*\(?\s*contains\((?:[^()]|\([^()]*\))*(login|actor|association|OWNER|MEMBER|COLLABORATOR)/i;
 function labelTypeConfigured(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
   const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
-  return prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+  const pr = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+  const onObj = onObject(wf, raw) ?? {};
+  const issues = on != null && typeof on === "object" && "issues" in on && triggerKeys(wf, raw).every((k) => /^issues$/i.test(k) || !keyStrangerFirable(onObj, k));
+  return { pr, issues };
+}
+var EVENT_LABEL_GATE_RE = /\blabel\.name\s*==\s*'|\b(?:contains|startsWith)\(\s*github\.event\.label\.name\b/i;
+var ISSUE_LABEL_GATE_RE = /(?<!!\s{0,5}\(?\s{0,5})contains\(\s*github\.event\.issue\.labels\.\*\.name\s*,\s*'[^']{1,100}'\s*\)(?!\s*(?:==\s*false|!=\s*true))/i;
+var PR_LABEL_GATE_RE = /(?<!!\s{0,5}\(?\s{0,5})contains\(\s*github\.event\.(?:pull_request|issue)\.labels\.\*\.name\s*,\s*'[^']{1,100}'\s*\)(?!\s*(?:==\s*false|!=\s*true))/i;
+var NONWRITE_SET_RE = /contains\(\s*(?:fromjson\(\s*['"]\[[^\]]{0,400}|'[^']{0,400})\b(CONTRIBUTOR|FIRST_TIME_CONTRIBUTOR|FIRST_TIMER|NONE|MANNEQUIN)\b/i;
+function allIfText(wf) {
+  const s = jobList(wf).map((j) => str(j.if) + " " + (j.steps ?? []).map((st) => str(st.if)).join(" ")).join(" ");
+  return s.length > IF_MAX_LEN ? "" : s;
+}
+function testsAutoLabel(ifs) {
+  if (AUTO_LABELS.size === 0) return false;
+  for (const m of ifs.matchAll(
+    /labels\.\*\.name\s*,\s*'([^']{1,100})'|label\.name\s*==\s*'([^']{1,100})'/gi
+  ))
+    if (AUTO_LABELS.has((m[1] ?? m[2]).toLowerCase())) return true;
+  return false;
 }
-var PR_LABEL_GATE_RE = /(?<!!\s{0,5}\(?\s{0,5})contains\(\s*github\.event\.pull_request\.labels\.\*\.name\s*,\s*'[^']{1,100}'\s*\)(?!\s*(?:==\s*false|!=\s*true))/i;
-function ifsAreGated(ifs, labelConfigured) {
-  const containsGate = CONTAINS_GATE_RE.test(ifs) && !NEGATED_CONTAINS_RE.test(ifs);
-  const gated = NONCONTAINS_GATE_RE.test(ifs) || containsGate;
-  const labelGated = labelConfigured && (/event\.label|label\.name/i.test(ifs) || PR_LABEL_GATE_RE.test(ifs));
+function ifsAreGated(ifs, label3) {
+  const m = maskLiterals(ifs);
+  const containsGate = CONTAINS_GATE_RE.test(m) && !NEGATED_CONTAINS_RE.test(m) && !NONWRITE_SET_RE.test(ifs);
+  const gated = NONCONTAINS_GATE_RE.test(m) || containsGate;
+  const labelGated = ((label3.pr || label3.issues) && EVENT_LABEL_GATE_RE.test(m) || label3.pr && PR_LABEL_GATE_RE.test(m) || label3.issues && ISSUE_LABEL_GATE_RE.test(m)) && !testsAutoLabel(ifs);
   return gated || labelGated;
 }
 function hasStepMembershipGate(job) {
@@ -66302,6 +66940,7 @@ function parseIf(src) {
   let e = src.trim();
   const wrapped = /^\$\{\{([\s\S]*)\}\}$/.exec(e);
   if (wrapped) e = wrapped[1].trim();
+  if (e.includes("${{")) return null;
   if (!e || e.length > IF_MAX_LEN) return null;
   let i = 0;
   let depth = 0;
@@ -66387,12 +67026,21 @@ function stepIfText(steps) {
   const s = steps.map((st) => str(st.if)).join(" ");
   return s.length > IF_MAX_LEN ? "" : s;
 }
+function maskLiterals(ifs) {
+  return ifs.replace(
+    /(==|!=)?(\s*)'(?:[^']|'')*'/g,
+    (m, op, sp) => op ? m : `${sp}'_'`
+  );
+}
+var CHAINED_COMPARE_RE = /(?:==|!=)[^=!]*(?:==|!=)/;
 function gatedText(ifs, labelConfigured) {
-  return ifsAreGated(ifs, labelConfigured) || ASSIGNEE_GATE_RE.test(ifs) || PERMISSION_OUTPUT_GATE_RE.test(ifs);
+  const masked = maskLiterals(ifs);
+  return ifsAreGated(ifs, labelConfigured) || ASSIGNEE_GATE_RE.test(masked) || PERMISSION_OUTPUT_GATE_RE.test(masked);
 }
 function exprGated(x, labelConfigured) {
   switch (x.k) {
     case "atom":
+      if (CHAINED_COMPARE_RE.test(maskLiterals(x.t))) return false;
       return gatedText(x.t, labelConfigured) || TRUSTED_EVENT_ATOM_RE.test(x.t);
     case "not":
       return false;
@@ -66428,11 +67076,43 @@ function jobOnWorkflowRun(job, workflowRun) {
 }
 function jobActorGate(job, wf, raw) {
   const labelConfigured = labelTypeConfigured(wf, raw);
-  const stepIfs = stepIfText(job.steps ?? []);
-  return jobIfGated(str(job.if), labelConfigured) || gatedText(stepIfs, labelConfigured) || hasStepMembershipGate(job);
+  const agent = (job.steps ?? []).filter(isAgentStep);
+  const ifTotal = agent.reduce((n, s) => n + str(s.if).length, 0);
+  const agentStepsGated = agent.length > 0 && ifTotal <= IF_MAX_LEN && agent.every((s) => {
+    const x = parseIf(str(s.if));
+    return x !== null && exprGated(x, labelConfigured);
+  });
+  return jobIfGated(str(job.if), labelConfigured) || agentStepsGated || hasStepMembershipGate(job);
+}
+var ACTOR_ALLOWLIST_RE = /\.includes\(\s*(?:context\.actor|github\.actor|context\.payload\.sender\.login|[\w.]{0,40}user\.login|login)\b|\b(?:context\.actor|github\.actor)\s*===?\s*['"]/;
+var ACTOR_ALLOWLIST_G = new RegExp(ACTOR_ALLOWLIST_RE.source, "g");
+var BLOCK_LIST_NAME_RE = /block|deny|ban|spam|abuse|exclu|ignore/i;
+function scriptAllowsByActor(code2) {
+  if (code2.length > 2e5) return false;
+  for (const m of code2.matchAll(ACTOR_ALLOWLIST_G)) {
+    const at = m.index ?? 0;
+    const before = code2.slice(Math.max(0, at - 80), at);
+    if (m[0].startsWith(".includes")) {
+      const list = /([\w$.]{1,60})$/.exec(before)?.[1] ?? "";
+      if (BLOCK_LIST_NAME_RE.test(list)) continue;
+    }
+    const negated = /!\s{0,3}\(?\s{0,3}[\w$.]{0,60}$/.test(before);
+    const ternary = /^[^?;\n]{0,150}\?\s{0,5}['"`]?(true|false)\b/.exec(code2.slice(at, at + 200));
+    if (!ternary || ternary[1] === "true" !== negated) return true;
+  }
+  return false;
+}
+function readsOutputPositively(readerIf, name) {
+  const ref = `needs\\.${escapeRe(name)}\\.outputs\\.[\\w-]{1,100}`;
+  if (!new RegExp(ref).test(readerIf)) return false;
+  const no = `'(?:false|no|0|)'(?![\\w'])`;
+  return !new RegExp(
+    `!\\s{0,5}\\(?\\s{0,5}(?:fromjson\\(\\s{0,5})?${ref}|${ref}\\s{0,5}\\)?\\s{0,5}(?:!=\\s{0,5}(?!${no})|==\\s{0,5}${no})`,
+    "i"
+  ).test(readerIf);
 }
 var STATUS_FN_RE = /\b(success|failure|always|cancelled)\s*\(/i;
-var FAILING_STEP_RE = /\bexit\s+[1-9]|core\.setFailed|process\.exit\(\s*[1-9]/;
+var FAILING_STEP_RE = /\bexit\s+[1-9]|core\.setFailed|process\.exit\(\s*[1-9]|actions\.cancelWorkflowRun\b/;
 function needsOf(job) {
   return (Array.isArray(job.needs) ? job.needs : job.needs ? [job.needs] : []).map(String);
 }
@@ -66444,13 +67124,18 @@ function upstreamJobGates(name, dep, wf, raw, readerIf) {
   const label3 = labelTypeConfigured(wf, raw);
   if (depIf && jobIfGated(depIf, label3)) return true;
   const steps = dep.steps ?? [];
-  const stepGated = ifsAreGated(stepIfText(steps), label3) || hasStepMembershipGate(dep);
+  if (readerIf !== null && readsOutputPositively(readerIf, name) && steps.some((st) => {
+    const code2 = str(st.run) + " " + str(st.with?.["script"]);
+    return MEMBERSHIP_CHECK_RE.test(code2) || scriptAllowsByActor(code2);
+  }))
+    return true;
+  const stepGated = ifsAreGated(stepIfText(steps), label3) || hasStepMembershipGate(dep) || steps.some((st) => MEMBERSHIP_CHECK_RE.test(str(st.with?.["script"])));
   if (!stepGated) return false;
   if (steps.some(
     (st) => FAILING_STEP_RE.test(str(st.run)) || FAILING_STEP_RE.test(str(st.with?.["script"]))
   ))
     return true;
-  return readerIf !== null && new RegExp(`needs\\.${escapeRe(name)}\\.outputs\\.`).test(readerIf);
+  return readerIf !== null && readsOutputPositively(readerIf, name);
 }
 function gatingAncestors(job, wf, raw) {
   const out = /* @__PURE__ */ new Set();
@@ -66480,9 +67165,15 @@ function jobGated(job, wf, raw) {
 }
 function bypassArmed(steps) {
   return steps.some(
-    (s) => str(s.with?.["allowed_non_write_users"]) === "*" && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
+    (s) => nonWriteOpen(str(s.with?.["allowed_non_write_users"])) && (!!str(s.with?.["github_token"]) || !!str(s.env?.["OVERRIDE_GITHUB_TOKEN"]))
   );
 }
+var ACTOR_BOUND_RE = /\$\{\{[^}]{0,200}\b(github\.event\.[\w.]{0,80}\b(?:user|sender)\.login|github\.event\.sender\.login|github\.actor|github\.triggering_actor)\b/i;
+function nonWriteOpen(v) {
+  const t = v.trim();
+  if (t === "*") return true;
+  return t.length <= 1e3 && ACTOR_BOUND_RE.test(t);
+}
 function hasImplicitActorGate(agentSteps, bypassActive, workflowRun = false) {
   if (bypassActive) return false;
   return agentSteps.some((s) => {
@@ -66601,14 +67292,28 @@ function severityFromScore(score) {
   if (score >= 1) return "advisory";
   return null;
 }
-function analyzeWorkflow(path91, content) {
+function analyzeWorkflow(path91, content, callers, autoLabels, trustedRunSources) {
+  AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
+  try {
+    return analyzeWorkflowInner(path91, content, callers);
+  } finally {
+    AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
+    UPSTREAM_TRUSTED = false;
+  }
+}
+function analyzeWorkflowInner(path91, content, callers) {
   let raw;
   try {
-    raw = parseYamlStrict(content) ?? {};
+    raw = loadWorkflow(content).raw;
   } catch {
     return null;
   }
   const wf = raw;
+  if (callers?.length) CALLERS.set(wf, callers);
+  else CALLERS.delete(wf);
+  UPSTREAM_TRUSTED = upstreamRunTrusted(wf, raw);
   const steps = allSteps(wf).map((s) => s.step);
   const agentSteps = steps.filter(isAgentStep);
   const agentJobs = [
@@ -66627,17 +67332,19 @@ function analyzeWorkflow(path91, content) {
   } = triggerReach(wf, raw);
   const nonWrite = str(agentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean));
   const nonWriteStar = bypassArmed(agentSteps);
-  const starWithoutToken = nonWrite === "*" && !nonWriteStar;
-  const nonWriteList = !!nonWrite && nonWrite !== "*";
+  const starWithoutToken = nonWriteOpen(nonWrite) && !nonWriteStar;
+  const nonWriteList = !!nonWrite && !nonWriteOpen(nonWrite);
+  const nonWriteActor = nonWrite.trim() !== "*" && nonWriteOpen(nonWrite);
   const untrustedTrigger = forkInput || reusable;
   const bypassActive = nonWriteStar && untrustedTrigger;
-  const head = untrustedHeadCheckout(steps);
+  const head = agentSteps.length && agentSteps.every(readOnlySandbox) ? null : untrustedHeadCheckout(steps);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
   const injJobs = injectableJobs(wf, raw, untrustedTrigger);
   const powerJobs = injJobs.length ? injJobs : agentJobs;
   const powerSteps = injJobs.flatMap((j) => (j.steps ?? []).filter(isAgentStep));
   const scopedSteps = powerSteps.length ? powerSteps : agentSteps;
-  const toolsBlob = collectTools(scopedSteps);
+  const headActionRuns = head === "root" && powerSteps.some((st) => /^\s*\.\//.test(str(st.uses)));
+  const toolsBlob = collectTools(scopedSteps) + (headActionRuns ? " Bash" : "");
   const itemRead = forkInput ? injJobs.map(jobReadsUntrustedItem).find(Boolean) ?? null : null;
   const reach = untrustedTrigger && injJobs.length ? Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
@@ -66685,20 +67392,32 @@ function analyzeWorkflow(path91, content) {
     severity = "medium";
   if (!severity) severity = "advisory";
   const signals = [];
+  const openCallers = (callers ?? []).filter((c) => c.untrusted && !c.gated && !c.dispatched);
+  if (openCallers.length)
+    signals.push(
+      `called by ${openCallers.map((c) => `${safeText(c.file, 120)} (${c.keys.map((k) => safeText(k, 40)).join(", ")})`).join("; ")}`
+    );
   if (secretExposed)
     signals.push(
-      `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).join(", ")})`
+      `runs with base-repo secrets (${triggers.filter((t) => /target|workflow_run/i.test(t)).map((t) => safeText(t, 40)).join(", ")})`
+    );
+  else if (forkInput)
+    signals.push(
+      `triggered by untrusted input (${triggers.map((t) => safeText(t, 40)).join(", ")})`
     );
-  else if (forkInput) signals.push(`triggered by untrusted input (${triggers.join(", ")})`);
   else if (reusable)
     signals.push(
-      reusableLoadedGun ? `reusable workflow (${triggers.join(", ")}) that checks out an untrusted head / ingests untrusted input: exploitable the moment a caller wires a fork trigger (reachability depends on the caller, but this workflow is built to process attacker input)` : `reusable workflow (${triggers.join(", ")}): no untrusted trigger of its own; reachability depends on the caller's trigger + actor gate`
+      reusableLoadedGun ? `reusable workflow (${triggers.map((t) => safeText(t, 40)).join(", ")}) that checks out an untrusted head / ingests untrusted input: exploitable the moment a caller wires a fork trigger (reachability depends on the caller, but this workflow is built to process attacker input)` : `reusable workflow (${triggers.map((t) => safeText(t, 40)).join(", ")}): no untrusted trigger of its own; reachability depends on the caller's trigger + actor gate`
     );
   if (forkInput && !privileged && !reusable)
     signals.push(
       "triggered by `pull_request`: fork PRs run with a read-only token (lower risk than pull_request_target)"
     );
   if (head === "root") signals.push("checks out the untrusted PR head into the workspace root");
+  if (headActionRuns)
+    signals.push(
+      "runs the checked-out head's own action (`uses: ./\u2026`): the PR author's code runs with the job's secrets"
+    );
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
   if (workflowRunJobs.length) {
     const builds = workflowRunJobs.flatMap((j) => (j.steps ?? []).filter(isAgentStep)).map((st) => claudeActionBuild(st.uses)).filter((b) => b !== null);
@@ -66720,7 +67439,7 @@ function analyzeWorkflow(path91, content) {
   if (promptUntrusted) signals.push("feeds untrusted PR/issue text to the agent");
   else if (itemRead)
     signals.push(
-      itemRead === "prompt-file" ? "an earlier step writes untrusted PR/issue text into the prompt file the agent reads" : itemRead === "tool" ? "the agent fetches PR/issue text itself with a read tool (the text never appears in the prompt)" : "the agent is given the PR/issue number and reads the text itself (the text never appears in the prompt)"
+      itemRead === "prompt-file" ? "an earlier step writes untrusted PR/issue text into the prompt file the agent reads" : itemRead === "artifact" ? "the job downloads the artifacts of the triggering run (produced by the PR) before the agent runs" : itemRead === "step-output" ? "the agent's prompt is an earlier step's output, built from untrusted PR/issue text" : itemRead === "tool" ? "the agent fetches PR/issue text itself with a read tool (the text never appears in the prompt)" : "the agent is given the PR/issue number and reads the text itself (the text never appears in the prompt)"
     );
   if (broadTools) {
     const names = matchedBroadTools(toolsBlob);
@@ -66730,7 +67449,7 @@ function analyzeWorkflow(path91, content) {
   }
   if (bypassActive)
     signals.push(
-      'allowed_non_write_users: "*" with github_token, so any user can trigger the agent'
+      nonWriteActor ? "allowed_non_write_users is the triggering user's own login, with github_token, so any user can trigger the agent" : 'allowed_non_write_users: "*" with github_token, so any user can trigger the agent'
     );
   if (elevated) signals.push("elevated permissions (contents/id-token: write)");
   if (pat) signals.push("a static PAT is exposed to the agent (recoverable via injection)");
@@ -66824,7 +67543,7 @@ function analyzeWorkflow(path91, content) {
   return finding;
 }
 var AGENT_FUEL_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_BASE_URL|GEMINI_API_KEY|GOOGLE_API_KEY|GITHUB_TOKEN)$/i;
-var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_url|claude_code_oauth_token|openai_api_key|openai_base_url|gemini_api_key|google_api_key)$/i;
+var FUEL_INPUT_KEYS = /^(anthropic[_-]api[_-]key|anthropic[_-]auth[_-]token|anthropic[_-]base[_-]url|claude[_-]code[_-]oauth[_-]token|claude[_-]oauth[_-]token|openai[_-]api[_-]key|openai[_-]base[_-]url|gemini[_-]api[_-]key|google[_-]api[_-]key)$/i;
 function fuelSecretNames(agentSteps) {
   const out = /* @__PURE__ */ new Set();
   const add = (v) => {
@@ -66897,14 +67616,28 @@ function evalAgentJob(job, wf, raw, untrustedTrigger, reusable) {
   if (reusable && !loadedGun && SEVERITY_RANK2[severity] > SEVERITY_RANK2.medium) severity = "medium";
   return { severity, secrets, injectable, canReadEnv };
 }
-function analyzeWorkflowSecrets(path91, content) {
+function analyzeWorkflowSecrets(path91, content, callers, autoLabels, trustedRunSources) {
+  AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
+  try {
+    return analyzeWorkflowSecretsInner(path91, content, callers);
+  } finally {
+    AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
+    UPSTREAM_TRUSTED = false;
+  }
+}
+function analyzeWorkflowSecretsInner(path91, content, callers) {
   let raw;
   try {
-    raw = parseYamlStrict(content) ?? {};
+    raw = loadWorkflow(content).raw;
   } catch {
     return null;
   }
   const wf = raw;
+  if (callers?.length) CALLERS.set(wf, callers);
+  else CALLERS.delete(wf);
+  UPSTREAM_TRUSTED = upstreamRunTrusted(wf, raw);
   const all = allSteps(wf);
   if (!all.some((s) => isAgentStep(s.step))) return null;
   const { untrusted: forkInput, reusable } = triggerReach(wf, raw);
@@ -66936,70 +67669,281 @@ function analyzeWorkflowSecrets(path91, content) {
     })
   };
 }
-
-// src/ci-check/agent-config.ts
-var import_path72 = __toESM(require("path"));
-
-// src/ci-check/frontmatter.ts
-function parseFrontmatter(content) {
-  const text = content.replace(/^/, "").replace(/^\s*\n/, "");
-  if (!/^---[ \t]*\r?\n/.test(text)) return null;
-  const close = /\r?\n---[ \t]*(\r?\n|$)/.exec(text.slice(3));
-  if (!close) return null;
-  const block = text.slice(3, 3 + close.index);
+var COMMIT_PIN_RE = /[#@][0-9a-f]{40}\b/i;
+function marketplaceOwner(market) {
+  if (/(^|[/\\])\.\.([/\\]|$)/.test(market)) return void 0;
+  return /^(?:https?:\/\/(?:www\.)?|git@|ssh:\/\/git@)?github\.com[:/]([\w.-]{1,100})\/[\w.-]{1,100}(?:\.git)?\/?(?:[#@].*)?$/i.exec(
+    market
+  )?.[1] ?? /^([\w.-]{1,100})\/[\w.-]{1,100}(?:[#@].*)?$/.exec(market)?.[1];
+}
+function analyzeWorkflowPlugins(path91, content, owner) {
+  let raw;
   try {
-    const parsed = parseYamlStrict(block);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    raw = loadWorkflow(content).raw;
   } catch {
-    return salvageTopLevel(block);
+    return [];
+  }
+  if (!raw || typeof raw !== "object") return [];
+  const wf = raw;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { step } of allSteps(wf)) {
+    if (!claudeActionBuild(step.uses)) continue;
+    if (!str(step.with?.["plugins"]).trim()) continue;
+    for (const m of str(step.with?.["plugin_marketplaces"]).split(/[\s,]+/)) {
+      const market = m.trim();
+      if (!market || COMMIT_PIN_RE.test(market)) continue;
+      if (/^\.{1,2}(\/|$)/.test(market)) continue;
+      const mo = marketplaceOwner(market);
+      if (mo && mo.toLowerCase() === "anthropics") continue;
+      if (owner && mo && mo.toLowerCase() === owner.toLowerCase()) continue;
+      if (seen.has(market)) continue;
+      seen.add(market);
+      out.push({
+        check: "CI-3",
+        rule: "CI-3.plugin-unpinned",
+        locator: safeText(market, 200),
+        dimension: "mcp",
+        severity: "medium",
+        title: "Agent installs plugins from a third-party marketplace on every run",
+        file: path91,
+        signals: [
+          `\`plugin_marketplaces: ${safeText(market, 120)}\` is not pinned to a commit: whoever controls it changes the code and prompts the agent runs`
+        ],
+        fix: "Pin the marketplace to a commit (`<url>#<sha>`), or vendor the plugin into this repository."
+      });
+    }
   }
+  return out;
 }
-function salvageTopLevel(block) {
-  const out = {};
-  const lines = block.split(/\r?\n/);
-  for (let i = 0; i < lines.length; i++) {
-    const m = /^([A-Za-z0-9_-]+):[ \t]*(.*)$/.exec(lines[i]);
-    if (!m) continue;
-    const [, key, rest] = m;
-    if (rest.trim()) {
-      out[key] = rest.trim();
-      continue;
+var ITEM_LIST_RE = /gh\s+(?:issue|pr)\s+(?:list|view)\b|gh\s+search\b|gh\s+api\s+[^\n]{0,80}\/(?:issues|pulls)\b|\blist_issues\b|\bsearch_issues\b|issues\.listForRepo|pulls\.list\b|(?<!\b(?:and|to|then|or|will|should|must|may|can|please|you|also)\s)\bopen (?:issues|pull requests)\b/i;
+var WEB_READ_RE = /(^|["\s,])(WebFetch|WebSearch)(\(|\s|,|"|$)/;
+function readsItemList(text) {
+  if (text.length > 2e5) return ITEM_LIST_RE.test(text);
+  return text.replace(/\\\r?\n/g, " ").split("\n").some((l) => ITEM_LIST_RE.test(l) && !sanitizedListing(l));
+}
+function analyzeTrustedReaders(path91, content, autoLabels, callers) {
+  AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  try {
+    return analyzeTrustedReadersInner(path91, content, callers);
+  } finally {
+    AUTO_LABELS = /* @__PURE__ */ new Set();
+  }
+}
+function keysWithCallers(keys, callers) {
+  return [.../* @__PURE__ */ new Set([...keys, ...(callers ?? []).flatMap((c) => c.keys)])];
+}
+function analyzeTrustedReadersInner(path91, content, callers) {
+  let raw;
+  try {
+    raw = loadWorkflow(content).raw;
+  } catch {
+    return [];
+  }
+  if (!raw || typeof raw !== "object") return [];
+  const wf = raw;
+  if (callers?.length) CALLERS.set(wf, callers);
+  else CALLERS.delete(wf);
+  const reach = triggerReach(wf, raw);
+  if (reach.untrusted || reach.reusable) return [];
+  const keys = keysWithCallers(reach.keys, callers);
+  if (!keys.some((k) => /^schedule$/i.test(k))) return [];
+  for (const job of jobList(wf)) {
+    const jobIf = parseIf(str(job.if));
+    if (jobIf !== null && !exprAllowsEvent(jobIf, "schedule")) continue;
+    const steps = job.steps ?? [];
+    const agentIdx = steps.findIndex(isAgentStep);
+    if (agentIdx < 0) continue;
+    const agent = steps.filter(isAgentStep);
+    const tools = collectTools(agent);
+    const promptText = agent.map(
+      (st) => str(st.with?.["prompt"]) + " " + str(st.with?.["direct_prompt"]) + " " + (isRunAgent(st) ? str(st.run) : "")
+    ).join(" ");
+    const earlier = steps.slice(0, agentIdx).filter((st) => !isAgentStep(st)).map((st) => str(st.run) + " " + str(st.with?.["script"]));
+    const reads = [];
+    if (ITEM_READ_TOOL_RE.test(tools) || readsItemList(promptText))
+      reads.push("reads open issues or pull requests");
+    else if (earlier.some(readsItemList))
+      reads.push("an earlier step lists open issues or pull requests for it");
+    if (WEB_READ_RE.test(tools)) reads.push("fetches third-party web content");
+    if (!reads.length) continue;
+    const withheld = agent.every(
+      (st) => str(st.with?.["github_token"]).trim() === "''" || "github_token" in (st.with ?? {}) && str(st.with?.["github_token"]).trim() === "" || "GITHUB_TOKEN" in (st.env ?? {}) && str(st.env?.["GITHUB_TOKEN"]).trim() === ""
+    );
+    const checkouts = steps.slice(0, agentIdx).filter((st) => /actions\/checkout/i.test(str(st.uses)));
+    const persisted = checkouts.some((st) => str(st.with?.["persist-credentials"]) !== "false");
+    const checkoutPat = checkouts.some(
+      (st) => /secrets\.(?!GITHUB_TOKEN\b)[A-Za-z_]/i.test(str(st.with?.["token"]))
+    );
+    const pat = usesPatIn([job]) || checkoutPat;
+    const permWrite = jobsHaveWrite(
+      wf,
+      [job],
+      /["']?(contents|issues|pull-requests)["']?\s*:\s*["']?write/i
+    );
+    const handsToken = agent.some(
+      (st) => !!claudeActionBuild(st.uses) || !!str(st.with?.["github_token"]).trim()
+    );
+    const write2 = pat || permWrite && !withheld && (handsToken || persisted);
+    if (!write2) continue;
+    const writes = pat ? "a static PAT" : "a write token";
+    return [
+      {
+        check: "CI-2",
+        rule: "CI-2.trusted-trigger-reader",
+        dimension: "workflows",
+        severity: "advisory",
+        title: "Agent on a trusted trigger reads content strangers write, with a write token",
+        file: path91,
+        signals: [
+          `runs on ${keys.map((k) => safeText(k, 40)).join(", ")}: no stranger starts it`,
+          ...reads.map((r) => `the agent ${r}`),
+          `it holds ${writes}: injected text in that content can act with it`
+        ],
+        fix: "Give the agent a read-only token and apply its output in a separate step, or filter the items to trusted authors first."
+      }
+    ];
+  }
+  return [];
+}
+var FORK_PR_TRIGGER_RE = /^(pull_request_target|issue_comment|workflow_run)$/i;
+var SAME_REPO_GATE_RE = new RegExp(
+  [
+    String.raw`head(?:\.repo|_repository)\.full_name\s*==\s*github\.(?:repository\b|event\.(?:pull_request\.base\.repo|repository)\.full_name)`,
+    String.raw`github\.repository\s*==\s*github\.event\.(?:pull_request\.head\.repo|workflow_run\.head_repository)\.full_name`,
+    String.raw`head(?:\.repo|_repository)\.fork\s*==\s*false`,
+    String.raw`head(?:\.repo|_repository)\.owner\.login\s*==\s*github\.repository_owner`,
+    String.raw`workflow_run\.pull_requests\[0\]`
+  ].join("|"),
+  "i"
+);
+var NOT_FORK_ATOM_RE = /^github\.event\.(?:pull_request\.head\.repo|workflow_run\.head_repository)\.fork$/i;
+var TRUSTED_AUTHOR_GATE_RE = /\b(?:pull_request|issue)\.user\.login\s*==|github\.event\.(?:pull_request|issue)\.author_association\s*==\s*['"](?:OWNER|MEMBER|COLLABORATOR)|contains\(\s*fromjson\(\s*['"][^'"]{0,200}\b(?:OWNER|MEMBER|COLLABORATOR)\b[^'"]{0,200}['"]\s*\)\s*,\s*github\.event\.(?:pull_request|issue)\.author_association/i;
+function requiresAtom(src, re, events, notRe = NOT_FORK_ATOM_RE) {
+  const x = parseIf(src);
+  if (!x) return false;
+  const req = (e) => {
+    if (events?.length && events.every((ev) => !exprAllowsEvent(e, ev))) return true;
+    switch (e.k) {
+      case "atom": {
+        const m = maskLiterals(e.t);
+        return re.test(m) && !CHAINED_COMPARE_RE.test(m);
+      }
+      case "not":
+        return e.c.k === "atom" && notRe.test(e.c.t.trim());
+      case "and":
+        return e.c.some(req);
+      case "or":
+        return e.c.every(req);
     }
-    const items = [];
-    while (i + 1 < lines.length && /^[ \t]+-[ \t]+/.test(lines[i + 1])) {
-      items.push(lines[++i].replace(/^[ \t]+-[ \t]+/, "").trim());
+  };
+  return req(x);
+}
+var PR_EVENTS = [
+  "pull_request_target",
+  "pull_request",
+  "pull_request_review",
+  "pull_request_review_comment"
+];
+function headRefEvents(heads) {
+  const evs = /* @__PURE__ */ new Set();
+  for (const st of heads) {
+    if (st.uses == null) return null;
+    const m = /^\s*\$\{\{([\s\S]{1,500})\}\}\s*$/.exec(str(st.with?.["ref"]));
+    if (!m) return null;
+    for (const part of m[1].split("||").map((x) => x.trim())) {
+      if (/^github\.event\.workflow_run\.[\w.]+$/.test(part)) evs.add("workflow_run");
+      else if (/^github\.event\.pull_request\.[\w.]+$/.test(part))
+        PR_EVENTS.forEach((e) => evs.add(e));
+      else if (!/^(?:github\.(?:sha|ref|ref_name|event\.repository\.default_branch)|'[^']*')$/.test(part))
+        return null;
     }
-    if (items.length) out[key] = items;
   }
-  return Object.keys(out).length ? out : null;
+  return evs.size ? [...evs] : null;
 }
-function splitGrants(value) {
-  const out = [];
-  let depth = 0;
-  let cur = "";
-  for (const ch of value) {
-    if (ch === "(") depth++;
-    else if (ch === ")") depth = Math.max(0, depth - 1);
-    if (depth === 0 && (ch === "," || /\s/.test(ch))) {
-      if (cur) out.push(cur);
-      cur = "";
-      continue;
+function readOnlySandbox(st) {
+  const args = str(st.with?.["codex-args"]) + " " + str(st.with?.["codex_args"]);
+  return /^read-only$/i.test(str(st.with?.["sandbox"])) && !PERMISSION_BYPASS_RE.test(args);
+}
+function requiresTrustedAuthor(src) {
+  const x = parseIf(src);
+  if (!x) return false;
+  const req = (e) => {
+    switch (e.k) {
+      case "atom":
+        return TRUSTED_AUTHOR_GATE_RE.test(e.t) && !NONWRITE_SET_RE.test(e.t) && !CHAINED_COMPARE_RE.test(maskLiterals(e.t));
+      case "not":
+        return false;
+      case "and":
+        return e.c.some(req);
+      case "or":
+        return e.c.every(req);
     }
-    cur += ch;
+  };
+  return req(x);
+}
+function analyzeForkCodeOnTrust(path91, content, callers, autoLabels) {
+  AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  try {
+    return analyzeForkCodeOnTrustInner(path91, content, callers);
+  } finally {
+    AUTO_LABELS = /* @__PURE__ */ new Set();
   }
-  if (cur) out.push(cur);
-  return out;
 }
-function allowedToolsOf(fm) {
-  const raw = fm?.["allowed-tools"];
-  if (typeof raw === "string") return splitGrants(raw);
-  if (Array.isArray(raw)) {
-    return raw.filter((x) => typeof x === "string").map((x) => x.trim()).filter(Boolean);
+function analyzeForkCodeOnTrustInner(path91, content, callers) {
+  let raw;
+  try {
+    raw = loadWorkflow(content).raw;
+  } catch {
+    return [];
+  }
+  if (!raw || typeof raw !== "object") return [];
+  const wf = raw;
+  if (callers?.length) CALLERS.set(wf, callers);
+  else CALLERS.delete(wf);
+  const reach = triggerReach(wf, raw);
+  const forkKeys = keysWithCallers(reach.keys, callers).filter((k) => FORK_PR_TRIGGER_RE.test(k));
+  if (!forkKeys.length) return [];
+  const inj = new Set(injectableJobs(wf, raw, reach.untrusted || reach.reusable));
+  for (const job of jobList(wf)) {
+    if (inj.has(job)) continue;
+    const steps = job.steps ?? [];
+    const agent = steps.filter(isAgentStep);
+    if (!agent.length) continue;
+    if (untrustedHeadCheckout(steps) !== "root") continue;
+    if (agent.every(readOnlySandbox)) continue;
+    if (requiresAtom(str(job.if), SAME_REPO_GATE_RE)) continue;
+    if (agent.every((st) => requiresAtom(str(st.if), SAME_REPO_GATE_RE))) continue;
+    const heads = steps.filter((st) => untrustedHeadCheckout([st]) === "root");
+    if (heads.length && heads.every((st) => requiresAtom(str(st.if), SAME_REPO_GATE_RE))) continue;
+    const evs = headRefEvents(heads);
+    if (evs && !forkKeys.some((k) => evs.includes(k.toLowerCase()))) continue;
+    if (evs && requiresAtom(str(job.if), SAME_REPO_GATE_RE, evs)) continue;
+    if (requiresTrustedAuthor(str(job.if))) continue;
+    const holdsSecret = /secrets\./i.test(str(job.steps) + " " + str(job.env));
+    if (!holdsSecret && !jobsHaveWrite(wf, [job], /:\s*["']?write/i)) continue;
+    return [
+      {
+        check: "CI-2",
+        rule: "CI-2.fork-code-on-trust",
+        dimension: "workflows",
+        severity: "advisory",
+        title: "A maintainer's action runs the agent inside the fork's code",
+        file: path91,
+        signals: [
+          `triggered by ${forkKeys.map((k) => safeText(k, 40)).join(", ")}, behind a gate a maintainer passes (a comment, a label, a push to the PR branch, a reopen)`,
+          "checks out the untrusted PR head into the workspace root",
+          "the agent loads the fork's CLAUDE.md, .claude/settings.json hooks, .mcp.json and build scripts next to the job's secrets"
+        ],
+        fix: "Check out the base branch and give the agent the diff, or check the PR head out into a subdirectory the agent does not start in; do not let it run the fork's build or hooks."
+      }
+    ];
   }
   return [];
 }
 
 // src/ci-check/agent-config.ts
+var import_path72 = __toESM(require("path"));
 function asStrings(v) {
   return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
 }
@@ -67017,11 +67961,22 @@ function hookCommands(hooks) {
   return out;
 }
 var OPEN_RUNNER_RE = new RegExp(
-  String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(python(?:3(?:\.\d{1,2})?)?|node|deno(?: run)?|bun(?: x)?|ruby|perl|php|uv run|uvx|npx|npm exec|pnpm dlx|yarn dlx|pipx|docker run|` + String.raw`curl|wget|nc|ncat|ssh|scp|rsync|sh|bash|zsh|eval|source|xargs|env|sudo|gh)` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
+  String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(python(?:3(?:\.\d{1,2})?)?|node|deno(?: run)?|bun(?: x)?|ruby|perl|php|uv run|uvx|npx|npm exec|pnpm dlx|yarn dlx|pipx|docker run|` + String.raw`curl|wget|nc|ncat|ssh|scp|rsync|sh|bash|zsh|eval|source|xargs|env|sudo|gh|` + // PowerShell, and the cmdlets that run a string or a program (a PowerShell grant is read
+  // as Bash, review round 2).
+  String.raw`pwsh|powershell|invoke-expression|iex|invoke-command|icm|start-process|invoke-webrequest|iwr|invoke-restmethod|irm)` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
   "i"
 );
 var OPEN_RUNNER_MAX = 300;
 var INFO_FLAG_RE = /\s--(version|help)\b/;
+var EXTRA_RUNNER_RE = new RegExp(
+  String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(awk|gawk|mawk|sed|tee|tar|make(?! -n\b)|vim|vi|nvim|less|man|timeout|dd|install|` + String.raw`dotnet (?:run|script)|cargo run|go run|mvn exec|gradle run|npm start|tmux|` + String.raw`rm|git (?:push|config|submodule|filter-branch)|gh (?:repo|secret|auth|release))` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
+  "i"
+);
+var MCP_EXEC_RE = /^mcp__ide__executeCode$|^mcp__[\w-]{1,80}__(?:execute|exec|run)_(?:code|command|shell|sql|query)$|^mcp__[\w-]{1,80}__(?:ctx_)?(?:batch_)?execute$|^mcp__[\w-]{1,80}__(?:bash|shell|terminal)$/;
+function extraRunner(grant) {
+  if (grant.length > OPEN_RUNNER_MAX || INFO_FLAG_RE.test(grant)) return false;
+  return EXTRA_RUNNER_RE.test(grant.replace(/\s+/g, " ").replace(/\(\s+/, "(")) || MCP_EXEC_RE.test(grant);
+}
 function openRunner(grant) {
   if (grant.length > OPEN_RUNNER_MAX || INFO_FLAG_RE.test(grant)) return false;
   return OPEN_RUNNER_RE.test(grant.replace(/\s+/g, " ").replace(/\(\s+/, "("));
@@ -67029,13 +67984,15 @@ function openRunner(grant) {
 function gradeBroadGrant(allow, deny, opts = {}) {
   const denySupported = opts.denySupported ?? true;
   const scope = opts.scope ?? "for everyone who opens this repo with the agent";
-  const broad = allow.filter(
-    (a) => /^Bash$|^Bash\(\s*\*|^Bash\(git:|^Write\(\s*\*|^Write$|^Edit$/.test(a) || openRunner(a)
-  );
+  const asBash = (a) => a.replace(/^PowerShell(?=$|\()/, "Bash");
+  const broad = allow.filter((raw) => {
+    const a = asBash(raw);
+    return /^Bash$|^Bash\(\s*\*|^Bash\(git:|^Write\(\s*\*|^Write$|^Edit$/.test(a) || openRunner(a) || opts.settings === true && extraRunner(a);
+  });
   if (broad.length === 0) return null;
-  const hasBackstop = deny.some((d) => /Bash|Write|Edit/.test(d));
-  const bashBackstop = deny.some((d) => /^Bash\b/.test(d));
-  const bareShell = broad.some((a) => /^Bash$|^Bash\(\s*\*/.test(a));
+  const hasBackstop = deny.some((d) => /Bash|PowerShell|Write|Edit/.test(d));
+  const bashBackstop = deny.some((d) => /^(?:Bash|PowerShell)\b/.test(d));
+  const bareShell = broad.some((a) => /^Bash$|^Bash\(\s*\*/.test(asBash(a)));
   const high = bareShell && !bashBackstop;
   const signals = [`broad allow(s): ${broad.slice(0, 5).join(", ")}`];
   if (high)
@@ -67052,7 +68009,7 @@ function gradeBroadGrant(allow, deny, opts = {}) {
     );
   if (broad.some((a) => /^Write|^Edit$/.test(a)))
     signals.push("`Write`/`Edit` pre-approve file changes without a prompt");
-  if (broad.some(openRunner))
+  if (broad.some((a) => openRunner(asBash(a))))
     signals.push(
       "an interpreter, network tool, shell runner or `gh` grant ending in a wildcard runs any code or request an injected instruction writes, without a prompt"
     );
@@ -67165,9 +68122,12 @@ function analyzeAgentConfig(path91, content, tree) {
       }
     }
   }
-  const allow = asStrings(cfg.permissions?.allow);
+  const allow = [
+    ...asStrings(cfg.permissions?.allow),
+    ...asStrings(cfg.permissions?.allowedTools)
+  ];
   const deny = asStrings(cfg.permissions?.deny);
-  const grade = gradeBroadGrant(allow, deny);
+  const grade = gradeBroadGrant(allow, deny, { settings: true });
   if (grade) {
     const { high, signals } = grade;
     const at = jsonValueIndex(content, grade.broad[0]);
@@ -67195,6 +68155,26 @@ function analyzeAgentConfig(path91, content, tree) {
   return findings;
 }
 var GRANT_CARRIER_RE = /(^|\/)[Ss][Kk][Ii][Ll][Ll]\.md$|(^|\/)\.claude\/commands\/.+\.md$/;
+var ROOT_SURFACE_RE = /^\.(claude|agents|github|codex|cursor|gemini)\//;
+var ITEM_TEXT_RE = /gh\s+(?:pr|issue)\s+(?:view|diff|list)\b|gh\s+pr\s+checkout\b|git\s+fetch\s+[^\n]{0,80}\bpull\/|gh\s+api\s+graphql\b|gh\s+api\s+[^\n]{0,120}\/(?:pulls|issues)\b|mcp__github__(?:get_issue|get_pull_request|list_issues|search_issues)|--json\s+[^\n]{0,120}\b(?:body|title)\b/;
+var PR_TEXT_RE = /gh\s+pr\s+(?:view|diff)\b|gh\s+api\s+[^\n]{0,120}\/pulls\b/;
+var WEB_TEXT_RE = /\bsearch the web\b|\bfetch (?:the )?(?:url|page)\b/i;
+function skillReadsUntrusted(path91, content, allow, broad) {
+  if (!ROOT_SURFACE_RE.test(path91)) return null;
+  const body = content.replace(/^---[\s\S]*?\n---/, "");
+  const runsCode = broad.map((a) => a.replace(/^PowerShell(?=$|\()/, "Bash")).some((a) => /^Bash$|^Bash\(\s*\*/.test(a) || openRunner(a) && !/^Bash\(\s*gh\b/.test(a));
+  const webGrant = allow.some((a) => /^(WebFetch|WebSearch)\b/.test(a));
+  const reads = (re) => body.replace(/\\\r?\n/g, " ").split("\n").some((l) => re.test(l) && !sanitizedListing(l));
+  if (runsCode && reads(ITEM_TEXT_RE))
+    return "it reads pull request or issue text that strangers write, with a grant that runs code";
+  if (runsCode && (webGrant || WEB_TEXT_RE.test(body)))
+    return "it reads web content anyone can publish, with a grant that runs code";
+  const writes = allow.some((a) => /^(Write|Edit|MultiEdit)$/.test(a));
+  const ghOrGit = allow.some((a) => /^Bash\(\s*(gh|git)\b/.test(a));
+  if (writes && ghOrGit && reads(PR_TEXT_RE))
+    return "it reads pull request text that strangers write, and may edit files and run git/gh on it";
+  return null;
+}
 function analyzeSkillGrants(path91, content) {
   if (!GRANT_CARRIER_RE.test(path91)) return [];
   const allow = allowedToolsOf(parseFrontmatter(content));
@@ -67206,6 +68186,21 @@ function analyzeSkillGrants(path91, content) {
   if (!grade) return [];
   const kind = /commands\//.test(path91) ? "slash command" : "skill";
   const at = content.search(/^allowed-tools\s*:/m);
+  const untrusted = skillReadsUntrusted(path91, content, allow, grade.broad);
+  if (untrusted)
+    return [
+      {
+        check: "CI-1",
+        rule: "CI-1.skill-untrusted-input",
+        ...at >= 0 ? { line: lineAtIndex(content, at) } : {},
+        dimension: "toolRules",
+        severity: "advisory",
+        title: `Committed ${kind} runs code or writes with text strangers control`,
+        file: path91,
+        signals: [...grade.signals, untrusted],
+        fix: "Drop the shell or interpreter grant from a skill that reads PRs, issues or the web, or have it treat that text as data in a read-only step first."
+      }
+    ];
   return [
     {
       check: "CI-1",
@@ -67227,27 +68222,178 @@ function analyzeSkillGrants(path91, content) {
 
 // src/ci-check/mcp.ts
 init_dist();
-var LOCAL_RUNNER_RE = /^npx\s+(?:-y\s+|--yes\s+)?(?:tsx|ts-node|node)\s+(?:\.{1,2}\/|\$\{CLAUDE_PLUGIN_ROOT\}\/)?[\w@./-]+\.(?:m?[jt]s|cjs)(?:\s+[^\s;&|`$<>()]+)*$/;
-function analyzeMcp(path91, content) {
+var LOCAL_RUNNER_RE = /^(?:npx|pnpx|bunx)\s+(?:-y\s+|--yes\s+)?(?:tsx|ts-node|node)\s+(?:\.{1,2}\/|\$\{CLAUDE_PLUGIN_ROOT\}\/)?[\w@./-]+\.(?:m?[jt]s|cjs)(?:\s+[^\s;&|`$<>()]+)*$/;
+var LAUNCHERS = [
+  { re: /\bnpx\b/, name: "npx", registry: "npm" },
+  { re: /\bpnpx\b|\bpnpm\s+dlx\b/, name: "pnpm dlx", registry: "npm" },
+  { re: /\byarn\s+dlx\b/, name: "yarn dlx", registry: "npm" },
+  { re: /\bnpm\s+(?:exec|x)\b/, name: "npm exec", registry: "npm" },
+  { re: /\bbunx\b|\bbun\s+x\b/, name: "bunx", registry: "npm" },
+  { re: /\buvx\b|\buv\s+tool\s+run\b/, name: "uvx", registry: "PyPI" },
+  { re: /\bpipx\s+run\b/, name: "pipx run", registry: "PyPI" }
+];
+var PINNED_RE = /@v?\d|@[0-9a-f]{40}\b|==\s*\d/i;
+var LOCAL_FROM_RE = /(?:^|\s)--from(?:\s+|=)(?:\.{1,2}(?:\/\S*)?|\/\S*|~\/\S*)(?:\s|$)/;
+var RUN_VALUE_FLAGS = new Set(
+  [
+    "-a --attach --add-host --annotation --blkio-weight --blkio-weight-device --cap-add",
+    "--cap-drop --cgroup-parent --cgroupns --cgroups --cgroup-conf --cidfile --cpu-period",
+    "--cpu-quota --cpu-rt-period --cpu-rt-runtime -c --cpu-shares --cpus --cpuset-cpus",
+    "--cpuset-mems --device --device-cgroup-rule --device-read-bps --device-read-iops",
+    "--device-write-bps --device-write-iops --dns --dns-option --dns-search --domainname",
+    "--entrypoint -e --env --env-file --expose --gpus --group-add --health-cmd",
+    "--health-interval --health-retries --health-start-interval --health-start-period",
+    "--health-timeout -h --hostname --ip --ip6 --ipc --isolation --kernel-memory -l --label",
+    "--label-file --link --link-local-ip --log-driver --log-opt --mac-address -m --memory",
+    "--memory-reservation --memory-swap --memory-swappiness --mount --name --network --net",
+    "--network-alias --oom-score-adj --pid --pids-limit --platform -p --publish --pull",
+    "--restart --runtime --security-opt --shm-size --stop-signal --stop-timeout",
+    "--storage-opt --sysctl --tmpfs --ulimit -u --user --userns --uts -v --volume",
+    "--volume-driver --volumes-from -w --workdir --secret --pod --arch --os --variant",
+    "--timezone --umask --requires --uidmap --gidmap --subuidname --subgidname --hooks-dir",
+    "--init-path --seccomp-policy --sdnotify --personality --preserve-fds --chrootdirs"
+  ].join(" ").split(" ")
+);
+function runImage(tokens) {
+  const i = tokens.findIndex(
+    (t, k) => /(^|\/)(docker|podman|nerdctl)$/.test(t) && (tokens[k + 1] === "run" || tokens[k + 1] === "container" && tokens[k + 2] === "run")
+  );
+  if (i < 0) return null;
+  const from = tokens[i + 1] === "run" ? i + 2 : i + 3;
+  for (let k = from; k < tokens.length; k++) {
+    const t = tokens[k];
+    if (t.startsWith("-")) {
+      if (!t.includes("=") && RUN_VALUE_FLAGS.has(t)) k++;
+      continue;
+    }
+    return t;
+  }
+  return null;
+}
+function launchedPackages(argv) {
+  const t = argv.split(/\s+/).filter(Boolean);
+  const i = t.findIndex((x) => /(^|\/)(npx|pnpx|bunx|uvx|dlx|exec|x|run)$/.test(x));
+  if (i < 0) return [];
+  const bare = (v) => v.startsWith("@") ? v.replace(/^(@[^/]+\/[^@]+).*$/, "$1") : v.replace(/(==|@).*$/, "");
+  const flagged = [];
+  let positional = null;
+  for (let k = i + 1; k < t.length; k++) {
+    const tok = t[k];
+    const eq = /^(--from|-p|--package)=(.*)$/.exec(tok);
+    if (eq) {
+      flagged.push(eq[2]);
+      continue;
+    }
+    if (/^(--from|-p|--package)$/.test(tok)) {
+      if (t[k + 1]) flagged.push(t[++k]);
+      continue;
+    }
+    if (tok.startsWith("-")) continue;
+    positional ??= tok;
+  }
+  const names = flagged.length ? flagged : positional ? [positional] : [];
+  return names.map((n) => bare(n).toLowerCase()).filter(Boolean);
+}
+var SHELL_RE = /(?:^|\/)(?:sh|bash|zsh|dash|cmd|pwsh|powershell)(?:\.exe)?$/i;
+var SHELL_OP_RE = /[;&|`$<>()]/;
+function launchesOwnPackage(argv, own) {
+  if (own.size === 0) return false;
+  if (SHELL_OP_RE.test(argv) || SHELL_RE.test(argv.split(/\s+/)[0] ?? "")) return false;
+  const l = LAUNCHERS.find((x) => x.re.test(argv));
+  if (!l) return false;
+  const reg = l.registry === "PyPI" ? "pypi" : "npm";
+  const pkgs = launchedPackages(argv);
+  return pkgs.length > 0 && pkgs.every((p) => own.has(`${reg}:${p}`) || own.has(p));
+}
+function unpinnedLauncher(argv, own) {
+  if (LOCAL_RUNNER_RE.test(argv)) return null;
+  if (!SHELL_OP_RE.test(argv) && LOCAL_FROM_RE.test(argv)) return null;
+  if (launchesOwnPackage(argv, own)) return null;
+  const image = runImage(argv.split(/\s+/));
+  if (image) {
+    if (image.includes("@sha256:")) return null;
+    const tail = image.slice(image.lastIndexOf("/") + 1);
+    const tag = tail.includes(":") ? tail.slice(tail.indexOf(":") + 1) : "";
+    return !tag || tag === "latest" ? { launcher: "docker run", registry: "the image registry" } : null;
+  }
+  const goMod = /\bgo\s+run\s+(?:-\S+\s+)*([^\s@]+)@(\S+)/.exec(argv);
+  if (goMod)
+    return /^v\d/.test(goMod[2]) || /^[0-9a-f]{40}$/.test(goMod[2]) ? null : { launcher: "go run", registry: "the Go module proxy" };
+  const l = LAUNCHERS.find((x) => x.re.test(argv));
+  if (!l) return null;
+  return /@latest\b/.test(argv) || !PINNED_RE.test(argv) ? { launcher: l.name, registry: l.registry } : null;
+}
+function ownPackageNames(manifests) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of manifests) {
+    if (m.path === "package.json") {
+      try {
+        const pkg = JSON.parse(m.content);
+        if (typeof pkg.name === "string" && pkg.name && pkg.private !== true)
+          out.add(`npm:${pkg.name.toLowerCase()}`);
+      } catch {
+      }
+    } else if (m.path === "pyproject.toml") {
+      const sec = /^\[(project|tool\.poetry)\]\s*$([\s\S]*?)(?=^\[|(?![\s\S]))/m.exec(m.content);
+      const name = sec && /^name\s*=\s*["']([^"']{1,200})["']/m.exec(sec[2]);
+      if (name) {
+        out.add(`pypi:${name[1].toLowerCase()}`);
+        out.add(`pypi:${name[1].toLowerCase().replace(/_/g, "-")}`);
+      }
+    }
+  }
+  return out;
+}
+function analyzeMcp(path91, content, own = /* @__PURE__ */ new Set()) {
   let cfg;
   try {
     cfg = JSON.parse(content);
   } catch {
     return [];
   }
-  return analyzeMcpServers(cfg.mcpServers ?? {}, path91, content);
+  if (!cfg || typeof cfg !== "object") return [];
+  const sections = [];
+  const obj = (x) => x && typeof x === "object" && !Array.isArray(x) ? x : {};
+  sections.push(["mcpServers", obj(cfg.mcpServers)]);
+  sections.push(["servers", obj(cfg.servers)]);
+  const opencode = {};
+  for (const [name, s] of Object.entries(obj(cfg.mcp))) {
+    if (!s || typeof s !== "object") continue;
+    const o = s;
+    const cmd = Array.isArray(o.command) ? o.command.map(String) : [];
+    opencode[name] = {
+      command: cmd[0],
+      args: cmd.slice(1),
+      url: o.url,
+      env: obj(o.environment),
+      disabled: o.enabled === false
+    };
+  }
+  sections.push(["mcp", opencode]);
+  const count = /* @__PURE__ */ new Map();
+  for (const [, sec] of sections)
+    for (const name of Object.keys(sec)) count.set(name, (count.get(name) ?? 0) + 1);
+  const servers = {};
+  for (const [section, sec] of sections)
+    for (const [name, spec] of Object.entries(sec)) {
+      if (!spec || typeof spec !== "object") continue;
+      const key = (count.get(name) ?? 0) > 1 ? `${section}.${name}` : name;
+      servers[key] = { ...spec, anchor: name };
+    }
+  return analyzeMcpServers(servers, path91, content, own);
 }
-function analyzeMcpServers(servers, path91, content = "") {
+function analyzeMcpServers(servers, path91, content = "", own = /* @__PURE__ */ new Set()) {
   const findings = [];
   for (const [name, srv] of Object.entries(servers ?? {})) {
     if (!srv || srv.disabled) continue;
     const argv = [srv.command, ...Array.isArray(srv.args) ? srv.args.map(String) : []].join(" ");
-    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const esc = (srv.anchor ?? name).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const at = content.search(
       new RegExp(`"${esc}"\\s*:|^[ \\t]*\\[mcp_servers\\.(?:"${esc}"|${esc})\\]`, "m")
     );
     const line = at >= 0 ? lineAtIndex(content, at) : void 0;
-    if (/\bnpx\b/.test(argv) && (/@latest\b/.test(argv) || !/@\d/.test(argv)) && !LOCAL_RUNNER_RE.test(argv)) {
+    const why = unpinnedLauncher(argv, own);
+    if (why) {
       findings.push({
         check: "CI-3",
         rule: "CI-3.mcp-unpinned",
@@ -67257,9 +68403,16 @@ function analyzeMcpServers(servers, path91, content = "") {
         title: `MCP server "${name}" runs an unpinned executable`,
         file: path91,
         ...line ? { line } : {},
-        signals: [`\`${safeText(argv, 120)}\`: unversioned/@latest npx`],
+        signals: [
+          why.launcher === "npx" ? `\`${safeText(argv, 120)}\`: unversioned/@latest npx` : `\`${safeText(argv, 120)}\`: unversioned/latest ${why.launcher}`
+        ],
         fix: "Pin the MCP server package to an exact version so a PR (or a registry compromise) can\u2019t swap the toolchain.",
-        explain: explainMcp({ name, argv })
+        explain: explainMcp({
+          name,
+          argv,
+          registry: why.registry,
+          pkg: why.launcher === "docker run" ? runImage(argv.split(/\s+/))?.replace(/:[^/:]*$/, "") ?? null : why.launcher === "go run" ? /\bgo\s+run\s+(?:-\S+\s+)*([^\s@]+)@/.exec(argv)?.[1] ?? null : launchedPackages(argv)[0] ?? null
+        })
       });
     }
     for (const [k, v] of Object.entries(srv.env ?? {})) {
@@ -67288,7 +68441,7 @@ function analyzeMcpServers(servers, path91, content = "") {
 
 // src/ci-check/codex.ts
 var import_smol_toml7 = require("smol-toml");
-function analyzeCodexConfig(path91, content) {
+function analyzeCodexConfig(path91, content, own = /* @__PURE__ */ new Set()) {
   let cfg;
   try {
     cfg = (0, import_smol_toml7.parse)(content);
@@ -67296,7 +68449,7 @@ function analyzeCodexConfig(path91, content) {
     return [];
   }
   const findings = [];
-  findings.push(...analyzeMcpServers(cfg.mcp_servers ?? {}, path91, content));
+  findings.push(...analyzeMcpServers(cfg.mcp_servers ?? {}, path91, content, own));
   const sandbox = typeof cfg.sandbox_mode === "string" ? cfg.sandbox_mode : "";
   const approval = typeof cfg.approval_policy === "string" ? cfg.approval_policy : "";
   const fullAccess = /danger-full-access/i.test(sandbox);
@@ -67333,10 +68486,12 @@ var UNREAD_RULES = /* @__PURE__ */ new Set([
   "CI-1.hook-script.unscanned-size",
   "CI-6.skill-script.unscanned-size"
 ]);
-var CONCEALMENT = /* @__PURE__ */ new Set(["CI-6.unicode-tag-chars", "CI-6.bidi-override"]);
+var CONCEALMENT = /* @__PURE__ */ new Set(["CI-6.unicode-tag-chars", "CI-6.bidi-override", "CI-6.homoglyph"]);
 function tierOf(f) {
   const { rule, severity } = f;
   if (rule === "CI-1.skill-allowed-tools") return "review";
+  if (rule === "CI-2.trusted-trigger-reader" || rule === "CI-2.fork-code-on-trust" || rule === "CI-1.skill-untrusted-input")
+    return "alert";
   if (UNREAD_RULES.has(rule)) return "review";
   if (rule.startsWith("CI-2.") || rule.startsWith("CI-4."))
     return severity === "advisory" ? "note" : "alert";
@@ -67701,12 +68856,54 @@ function scanTree(tree) {
     }
     return named.get(dir).has(docPath);
   };
+  const callersOf = /* @__PURE__ */ new Map();
+  const autoLabels = /* @__PURE__ */ new Set();
+  const routeOfFile = (file) => file.route !== void 0 ? file.route : routeOf(file.path, skillDirs, appDirs);
+  const manifests = [];
+  for (const file of tree.files) {
+    if (routeOfFile(file) !== "manifest") continue;
+    try {
+      manifests.push({ path: file.path, content: file.content });
+    } catch {
+    }
+  }
+  const ownPackages = ownPackageNames(manifests);
+  for (const file of tree.files) {
+    if (routeOfFile(file) !== "issue-form") continue;
+    try {
+      for (const l of issueFormLabels(file.content)) autoLabels.add(l);
+    } catch {
+    }
+  }
+  const runSources = /* @__PURE__ */ new Map();
+  for (const file of tree.files) {
+    if (routeOfFile(file) !== "workflow") continue;
+    try {
+      const src = runSourceOf(file.path, file.content, autoLabels);
+      if (src) runSources.set(src.name, (runSources.get(src.name) ?? true) && src.trusted);
+    } catch {
+    }
+  }
+  const trustedRunSources = new Set([...runSources].filter(([, t]) => t).map(([n]) => n));
+  for (const file of tree.files) {
+    if (routeOfFile(file) !== "workflow") continue;
+    try {
+      const content = file.content;
+      for (const { target, caller } of localCallsOf(file.path, content, autoLabels)) {
+        const list = callersOf.get(target) ?? [];
+        list.push(caller);
+        callersOf.set(target, list);
+      }
+    } catch {
+    }
+  }
   for (const file of tree.files) {
     let route = file.route !== void 0 ? file.route : routeOf(file.path, skillDirs, appDirs);
     if (route === "app-doc") {
       if (!namedBy(file.path)) continue;
       route = "instruction";
     }
+    if (route === "issue-form" || route === "manifest") continue;
     inspected.push(file.path);
     if (file.path === SUPPRESSIONS_FILE) continue;
     const testKind = route && CONTENT_ROUTES.has(route) ? testPathKind(file.path, route) : "none";
@@ -67716,10 +68913,20 @@ function scanTree(tree) {
       const content = file.content;
       switch (route) {
         case "workflow": {
-          const f = analyzeWorkflow(file.path, content);
+          const callers = callersOf.get(file.path);
+          const f = analyzeWorkflow(file.path, content, callers, autoLabels, trustedRunSources);
           if (f) findings.push(f);
-          const s = analyzeWorkflowSecrets(file.path, content);
+          const s = analyzeWorkflowSecrets(
+            file.path,
+            content,
+            callers,
+            autoLabels,
+            trustedRunSources
+          );
           if (s) findings.push(s);
+          findings.push(...analyzeWorkflowPlugins(file.path, content, tree.owner));
+          findings.push(...analyzeTrustedReaders(file.path, content, autoLabels, callers));
+          findings.push(...analyzeForkCodeOnTrust(file.path, content, callers, autoLabels));
           break;
         }
         case "agent-config":
@@ -67732,10 +68939,10 @@ function scanTree(tree) {
           findings.push(...analyzeScript(file.path, content, "CI-6.skill-script"));
           break;
         case "mcp":
-          findings.push(...analyzeMcp(file.path, content));
+          findings.push(...analyzeMcp(file.path, content, ownPackages));
           break;
         case "codex":
-          findings.push(...analyzeCodexConfig(file.path, content));
+          findings.push(...analyzeCodexConfig(file.path, content, ownPackages));
           break;
         case "instruction":
           findings.push(...analyzeInstructionFile(file.path, content));
@@ -67743,7 +68950,9 @@ function scanTree(tree) {
           break;
       }
     } catch (err2) {
-      notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
+      notes.push(
+        `checker degraded on ${file.path}: ${err2?.message ?? "error"}; results may be INCOMPLETE`
+      );
     }
     if (testKind === "alerts-only") {
       const kept = findings.splice(before).filter((f) => tierOf(f) === "alert");