@node9/proxy 2.30.0 → 2.30.1

package/dist/cli.js

@@ -66445,7 +66445,7 @@ function triggerReach(wf, raw) {
   const on = onObject(wf, raw) ?? {};
   const keys = triggerKeys(wf, raw);
   const firable = keys.filter(
-    (k) => keyStrangerFirable(on, k) || /^issues$/i.test(k) && testsAutoLabel(allIfText(wf))
+    (k) => keyStrangerFirable(on, k) && !(/^workflow_run$/i.test(k) && upstreamRunTrusted(wf, raw)) || /^issues$/i.test(k) && testsAutoLabel(allIfText(wf))
   );
   const untrusted = firable.length > 0;
   const reusable = !untrusted && keys.some((k) => /^workflow_call$/i.test(k));
@@ -66564,12 +66564,14 @@ function loadWorkflow(content) {
   return LOADED;
 }
 var LOCAL_WORKFLOW_USES_RE = /^\s*\.\/\.github\/workflows\/([\w.-]{1,200}\.ya?ml)\s*$/i;
-function localCallsOf(path91, content, autoLabels) {
+function localCallsOf(path91, content, autoLabels, trustedRunSources) {
   AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
   try {
     return localCallsOfInner(path91, content);
   } finally {
     AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
   }
 }
 function localCallsOfInner(path91, content) {
@@ -67179,8 +67181,9 @@ function hasImplicitActorGate(agentSteps, bypassActive, workflowRun = false) {
   return agentSteps.some((s) => {
     const build = claudeActionBuild(s.uses);
     if (!build) return false;
+    if (!build.official) return false;
     if (!workflowRun) return true;
-    return build.official && workflowRunChecked(build.ref);
+    return workflowRunChecked(build.ref);
   });
 }
 function claudeActionBuild(uses) {
@@ -67419,13 +67422,13 @@ function analyzeWorkflowInner(path91, content, callers) {
       "runs the checked-out head's own action (`uses: ./\u2026`): the PR author's code runs with the job's secrets"
     );
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
+  const thirdParty = agentSteps.map((st) => claudeActionBuild(st.uses)).find((b) => b !== null && !b.official);
+  if (thirdParty && !implicitGate)
+    signals.push(
+      `third-party build of claude-code-action (\`${safeText(thirdParty.owner, 40)}\`): not assumed to check the actor's write access like the official action`
+    );
   if (workflowRunJobs.length) {
     const builds = workflowRunJobs.flatMap((j) => (j.steps ?? []).filter(isAgentStep)).map((st) => claudeActionBuild(st.uses)).filter((b) => b !== null);
-    const thirdParty = builds.find((b) => !b.official);
-    if (thirdParty)
-      signals.push(
-        `third-party build of claude-code-action (\`${safeText(thirdParty.owner, 40)}\`): on workflow_run it is not assumed to check the actor (the official action does from v1.0.185)`
-      );
     const old = builds.find((b) => b.official && !workflowRunChecked(b.ref));
     if (old)
       signals.push(
@@ -67722,12 +67725,14 @@ function readsItemList(text) {
   if (text.length > 2e5) return ITEM_LIST_RE.test(text);
   return text.replace(/\\\r?\n/g, " ").split("\n").some((l) => ITEM_LIST_RE.test(l) && !sanitizedListing(l));
 }
-function analyzeTrustedReaders(path91, content, autoLabels, callers) {
+function analyzeTrustedReaders(path91, content, autoLabels, callers, trustedRunSources) {
   AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
   try {
     return analyzeTrustedReadersInner(path91, content, callers);
   } finally {
     AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
   }
 }
 function keysWithCallers(keys, callers) {
@@ -67882,12 +67887,14 @@ function requiresTrustedAuthor(src) {
   };
   return req(x);
 }
-function analyzeForkCodeOnTrust(path91, content, callers, autoLabels) {
+function analyzeForkCodeOnTrust(path91, content, callers, autoLabels, trustedRunSources) {
   AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
   try {
     return analyzeForkCodeOnTrustInner(path91, content, callers);
   } finally {
     AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
   }
 }
 function analyzeForkCodeOnTrustInner(path91, content, callers) {
@@ -67972,6 +67979,16 @@ var EXTRA_RUNNER_RE = new RegExp(
   String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(awk|gawk|mawk|sed|tee|tar|make(?! -n\b)|vim|vi|nvim|less|man|timeout|dd|install|` + String.raw`dotnet (?:run|script)|cargo run|go run|mvn exec|gradle run|npm start|tmux|` + String.raw`rm|git (?:push|config|submodule|filter-branch)|gh (?:repo|secret|auth|release))` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
   "i"
 );
+var EXEC_ESCAPE_RE = new RegExp(
+  String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(find|make -n)` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
+  "i"
+);
+function execEscape(grant) {
+  if (grant.length > OPEN_RUNNER_MAX) return false;
+  return EXEC_ESCAPE_RE.test(
+    grant.replace(/^PowerShell(?=$|\()/, "Bash").replace(/\s+/g, " ").replace(/\(\s+/, "(")
+  );
+}
 var MCP_EXEC_RE = /^mcp__ide__executeCode$|^mcp__[\w-]{1,80}__(?:execute|exec|run)_(?:code|command|shell|sql|query)$|^mcp__[\w-]{1,80}__(?:ctx_)?(?:batch_)?execute$|^mcp__[\w-]{1,80}__(?:bash|shell|terminal)$/;
 function extraRunner(grant) {
   if (grant.length > OPEN_RUNNER_MAX || INFO_FLAG_RE.test(grant)) return false;
@@ -68152,6 +68169,24 @@ function analyzeAgentConfig(path91, content, tree) {
       })
     });
   }
+  const escapes = allow.filter(execEscape);
+  if (escapes.length) {
+    const at = jsonValueIndex(content, escapes[0]);
+    findings.push({
+      ...at >= 0 ? { line: lineAtIndex(content, at) } : {},
+      check: "CI-1",
+      rule: "CI-1.exec-escape-grant",
+      dimension: "toolRules",
+      severity: "medium",
+      title: "Committed agent config pre-approves a command that can run other programs",
+      file: path91,
+      signals: [
+        `pre-approved: ${escapes.slice(0, 5).map((e) => `\`${safeText(e, 80)}\``).join(", ")}`,
+        "`find -exec` and `make -n --eval` run other programs without a prompt"
+      ],
+      fix: "Pre-approve the exact command you need (for example `Bash(find . -name *.ts)` or `Bash(make test)`), not every argument."
+    });
+  }
   return findings;
 }
 var GRANT_CARRIER_RE = /(^|\/)[Ss][Kk][Ii][Ll][Ll]\.md$|(^|\/)\.claude\/commands\/.+\.md$/;
@@ -68490,6 +68525,7 @@ var CONCEALMENT = /* @__PURE__ */ new Set(["CI-6.unicode-tag-chars", "CI-6.bidi-
 function tierOf(f) {
   const { rule, severity } = f;
   if (rule === "CI-1.skill-allowed-tools") return "review";
+  if (rule === "CI-1.exec-escape-grant") return "review";
   if (rule === "CI-2.trusted-trigger-reader" || rule === "CI-2.fork-code-on-trust" || rule === "CI-1.skill-untrusted-input")
     return "alert";
   if (UNREAD_RULES.has(rule)) return "review";
@@ -68517,6 +68553,8 @@ function reviewQuestion(rule) {
     return "Does this hook exist on every machine that runs it?";
   if (/hidden-chars/.test(rule))
     return "Why does this script hold invisible characters? A list of them to detect is fine.";
+  if (/exec-escape/.test(rule))
+    return "Does the agent need this command with any arguments, or only one exact form?";
   if (/unscanned/.test(rule))
     return "node9 did not read this script (too large, or outside the folders it reads). What does it run?";
   return "Is this an instruction the agent follows, or text for a person?";
@@ -68889,7 +68927,12 @@ function scanTree(tree) {
     if (routeOfFile(file) !== "workflow") continue;
     try {
       const content = file.content;
-      for (const { target, caller } of localCallsOf(file.path, content, autoLabels)) {
+      for (const { target, caller } of localCallsOf(
+        file.path,
+        content,
+        autoLabels,
+        trustedRunSources
+      )) {
         const list = callersOf.get(target) ?? [];
         list.push(caller);
         callersOf.set(target, list);
@@ -68925,8 +68968,12 @@ function scanTree(tree) {
           );
           if (s) findings.push(s);
           findings.push(...analyzeWorkflowPlugins(file.path, content, tree.owner));
-          findings.push(...analyzeTrustedReaders(file.path, content, autoLabels, callers));
-          findings.push(...analyzeForkCodeOnTrust(file.path, content, callers, autoLabels));
+          findings.push(
+            ...analyzeTrustedReaders(file.path, content, autoLabels, callers, trustedRunSources)
+          );
+          findings.push(
+            ...analyzeForkCodeOnTrust(file.path, content, callers, autoLabels, trustedRunSources)
+          );
           break;
         }
         case "agent-config":

package/dist/cli.mjs

@@ -66427,7 +66427,7 @@ function triggerReach(wf, raw) {
   const on = onObject(wf, raw) ?? {};
   const keys = triggerKeys(wf, raw);
   const firable = keys.filter(
-    (k) => keyStrangerFirable(on, k) || /^issues$/i.test(k) && testsAutoLabel(allIfText(wf))
+    (k) => keyStrangerFirable(on, k) && !(/^workflow_run$/i.test(k) && upstreamRunTrusted(wf, raw)) || /^issues$/i.test(k) && testsAutoLabel(allIfText(wf))
   );
   const untrusted = firable.length > 0;
   const reusable = !untrusted && keys.some((k) => /^workflow_call$/i.test(k));
@@ -66546,12 +66546,14 @@ function loadWorkflow(content) {
   return LOADED;
 }
 var LOCAL_WORKFLOW_USES_RE = /^\s*\.\/\.github\/workflows\/([\w.-]{1,200}\.ya?ml)\s*$/i;
-function localCallsOf(path91, content, autoLabels) {
+function localCallsOf(path91, content, autoLabels, trustedRunSources) {
   AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
   try {
     return localCallsOfInner(path91, content);
   } finally {
     AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
   }
 }
 function localCallsOfInner(path91, content) {
@@ -67161,8 +67163,9 @@ function hasImplicitActorGate(agentSteps, bypassActive, workflowRun = false) {
   return agentSteps.some((s) => {
     const build = claudeActionBuild(s.uses);
     if (!build) return false;
+    if (!build.official) return false;
     if (!workflowRun) return true;
-    return build.official && workflowRunChecked(build.ref);
+    return workflowRunChecked(build.ref);
   });
 }
 function claudeActionBuild(uses) {
@@ -67401,13 +67404,13 @@ function analyzeWorkflowInner(path91, content, callers) {
       "runs the checked-out head's own action (`uses: ./\u2026`): the PR author's code runs with the job's secrets"
     );
   if (head === "subdir") signals.push("checks out the untrusted PR head into an isolated subdir");
+  const thirdParty = agentSteps.map((st) => claudeActionBuild(st.uses)).find((b) => b !== null && !b.official);
+  if (thirdParty && !implicitGate)
+    signals.push(
+      `third-party build of claude-code-action (\`${safeText(thirdParty.owner, 40)}\`): not assumed to check the actor's write access like the official action`
+    );
   if (workflowRunJobs.length) {
     const builds = workflowRunJobs.flatMap((j) => (j.steps ?? []).filter(isAgentStep)).map((st) => claudeActionBuild(st.uses)).filter((b) => b !== null);
-    const thirdParty = builds.find((b) => !b.official);
-    if (thirdParty)
-      signals.push(
-        `third-party build of claude-code-action (\`${safeText(thirdParty.owner, 40)}\`): on workflow_run it is not assumed to check the actor (the official action does from v1.0.185)`
-      );
     const old = builds.find((b) => b.official && !workflowRunChecked(b.ref));
     if (old)
       signals.push(
@@ -67704,12 +67707,14 @@ function readsItemList(text) {
   if (text.length > 2e5) return ITEM_LIST_RE.test(text);
   return text.replace(/\\\r?\n/g, " ").split("\n").some((l) => ITEM_LIST_RE.test(l) && !sanitizedListing(l));
 }
-function analyzeTrustedReaders(path91, content, autoLabels, callers) {
+function analyzeTrustedReaders(path91, content, autoLabels, callers, trustedRunSources) {
   AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
   try {
     return analyzeTrustedReadersInner(path91, content, callers);
   } finally {
     AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
   }
 }
 function keysWithCallers(keys, callers) {
@@ -67864,12 +67869,14 @@ function requiresTrustedAuthor(src) {
   };
   return req(x);
 }
-function analyzeForkCodeOnTrust(path91, content, callers, autoLabels) {
+function analyzeForkCodeOnTrust(path91, content, callers, autoLabels, trustedRunSources) {
   AUTO_LABELS = autoLabels ?? /* @__PURE__ */ new Set();
+  TRUSTED_RUN_SOURCES = trustedRunSources ?? /* @__PURE__ */ new Set();
   try {
     return analyzeForkCodeOnTrustInner(path91, content, callers);
   } finally {
     AUTO_LABELS = /* @__PURE__ */ new Set();
+    TRUSTED_RUN_SOURCES = /* @__PURE__ */ new Set();
   }
 }
 function analyzeForkCodeOnTrustInner(path91, content, callers) {
@@ -67954,6 +67961,16 @@ var EXTRA_RUNNER_RE = new RegExp(
   String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(awk|gawk|mawk|sed|tee|tar|make(?! -n\b)|vim|vi|nvim|less|man|timeout|dd|install|` + String.raw`dotnet (?:run|script)|cargo run|go run|mvn exec|gradle run|npm start|tmux|` + String.raw`rm|git (?:push|config|submodule|filter-branch)|gh (?:repo|secret|auth|release))` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
   "i"
 );
+var EXEC_ESCAPE_RE = new RegExp(
+  String.raw`^Bash\((?:[A-Z_][A-Z0-9_]{0,40}=\S{0,200} )*(?:/[\w./-]{0,80}/)?` + String.raw`(find|make -n)` + String.raw`(?: --?[A-Za-z][\w-]{0,30}){0,4} ?['"]?(?::\*| \*|\*)\)$`,
+  "i"
+);
+function execEscape(grant) {
+  if (grant.length > OPEN_RUNNER_MAX) return false;
+  return EXEC_ESCAPE_RE.test(
+    grant.replace(/^PowerShell(?=$|\()/, "Bash").replace(/\s+/g, " ").replace(/\(\s+/, "(")
+  );
+}
 var MCP_EXEC_RE = /^mcp__ide__executeCode$|^mcp__[\w-]{1,80}__(?:execute|exec|run)_(?:code|command|shell|sql|query)$|^mcp__[\w-]{1,80}__(?:ctx_)?(?:batch_)?execute$|^mcp__[\w-]{1,80}__(?:bash|shell|terminal)$/;
 function extraRunner(grant) {
   if (grant.length > OPEN_RUNNER_MAX || INFO_FLAG_RE.test(grant)) return false;
@@ -68134,6 +68151,24 @@ function analyzeAgentConfig(path91, content, tree) {
       })
     });
   }
+  const escapes = allow.filter(execEscape);
+  if (escapes.length) {
+    const at = jsonValueIndex(content, escapes[0]);
+    findings.push({
+      ...at >= 0 ? { line: lineAtIndex(content, at) } : {},
+      check: "CI-1",
+      rule: "CI-1.exec-escape-grant",
+      dimension: "toolRules",
+      severity: "medium",
+      title: "Committed agent config pre-approves a command that can run other programs",
+      file: path91,
+      signals: [
+        `pre-approved: ${escapes.slice(0, 5).map((e) => `\`${safeText(e, 80)}\``).join(", ")}`,
+        "`find -exec` and `make -n --eval` run other programs without a prompt"
+      ],
+      fix: "Pre-approve the exact command you need (for example `Bash(find . -name *.ts)` or `Bash(make test)`), not every argument."
+    });
+  }
   return findings;
 }
 var GRANT_CARRIER_RE = /(^|\/)[Ss][Kk][Ii][Ll][Ll]\.md$|(^|\/)\.claude\/commands\/.+\.md$/;
@@ -68472,6 +68507,7 @@ var CONCEALMENT = /* @__PURE__ */ new Set(["CI-6.unicode-tag-chars", "CI-6.bidi-
 function tierOf(f) {
   const { rule, severity } = f;
   if (rule === "CI-1.skill-allowed-tools") return "review";
+  if (rule === "CI-1.exec-escape-grant") return "review";
   if (rule === "CI-2.trusted-trigger-reader" || rule === "CI-2.fork-code-on-trust" || rule === "CI-1.skill-untrusted-input")
     return "alert";
   if (UNREAD_RULES.has(rule)) return "review";
@@ -68499,6 +68535,8 @@ function reviewQuestion(rule) {
     return "Does this hook exist on every machine that runs it?";
   if (/hidden-chars/.test(rule))
     return "Why does this script hold invisible characters? A list of them to detect is fine.";
+  if (/exec-escape/.test(rule))
+    return "Does the agent need this command with any arguments, or only one exact form?";
   if (/unscanned/.test(rule))
     return "node9 did not read this script (too large, or outside the folders it reads). What does it run?";
   return "Is this an instruction the agent follows, or text for a person?";
@@ -68871,7 +68909,12 @@ function scanTree(tree) {
     if (routeOfFile(file) !== "workflow") continue;
     try {
       const content = file.content;
-      for (const { target, caller } of localCallsOf(file.path, content, autoLabels)) {
+      for (const { target, caller } of localCallsOf(
+        file.path,
+        content,
+        autoLabels,
+        trustedRunSources
+      )) {
         const list = callersOf.get(target) ?? [];
         list.push(caller);
         callersOf.set(target, list);
@@ -68907,8 +68950,12 @@ function scanTree(tree) {
           );
           if (s) findings.push(s);
           findings.push(...analyzeWorkflowPlugins(file.path, content, tree.owner));
-          findings.push(...analyzeTrustedReaders(file.path, content, autoLabels, callers));
-          findings.push(...analyzeForkCodeOnTrust(file.path, content, callers, autoLabels));
+          findings.push(
+            ...analyzeTrustedReaders(file.path, content, autoLabels, callers, trustedRunSources)
+          );
+          findings.push(
+            ...analyzeForkCodeOnTrust(file.path, content, callers, autoLabels, trustedRunSources)
+          );
           break;
         }
         case "agent-config":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.30.0",
+  "version": "2.30.1",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",