agent_hypervisor 3.3.0__tar.gz → 3.5.0__tar.gz

{agent_hypervisor-3.3.0 → agent_hypervisor-3.5.0}/.gitignore

@@ -462,3 +462,6 @@ dist/
 .pytest_cache/
 .ruff_cache/
 _site/
+
+# Code Security Assessment artifacts
+.security-assessment/

{agent_hypervisor-3.3.0 → agent_hypervisor-3.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent_hypervisor
-Version: 3.3.0
+Version: 3.5.0
 Summary: Public Preview — Agent Hypervisor: Runtime supervisor for multi-agent Shared Sessions with Execution Rings, Joint Liability, Saga Orchestration, and hash-chained audit trails
 Project-URL: Homepage, https://github.com/microsoft/agent-governance-toolkit
 Project-URL: Repository, https://github.com/microsoft/agent-governance-toolkit

{agent_hypervisor-3.3.0 → agent_hypervisor-3.5.0}/examples/dashboard/requirements.txt

@@ -1,4 +1,4 @@
-streamlit>=1.37.0
+streamlit>=1.54.0
 plotly>=5.18.0
 networkx>=3.2
 pandas>=2.0.0

{agent_hypervisor-3.3.0 → agent_hypervisor-3.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agent_hypervisor"
-version = "3.3.0"
+version = "3.5.0"
 description = "Public Preview — Agent Hypervisor: Runtime supervisor for multi-agent Shared Sessions with Execution Rings, Joint Liability, Saga Orchestration, and hash-chained audit trails"
 readme = "README.md"
 license = {text = "MIT"}

{agent_hypervisor-3.3.0 → agent_hypervisor-3.5.0}/src/hypervisor/api/server.py

@@ -58,6 +58,34 @@ from hypervisor.observability.event_bus import EventType, HypervisorEventBus
 
 logger = logging.getLogger(__name__)
 
+
+def _parse_cors_origins(raw: str) -> list[str]:
+    """Parse, validate, and return CORS origins.
+
+    Rejects ``*`` when credentials are enabled, and validates that each
+    origin has a scheme and a non-empty hostname.
+    """
+    origins: list[str] = []
+    for origin in raw.split(","):
+        origin = origin.strip()
+        if not origin:
+            continue
+        if origin == "*":
+            logger.warning(
+                "CORS origin '*' is not allowed with allow_credentials=True — skipping"
+            )
+            continue
+        from urllib.parse import urlparse
+        parsed = urlparse(origin)
+        if not parsed.scheme or not parsed.hostname:
+            logger.warning("Invalid CORS origin (missing scheme or host): %s — skipping", origin)
+            continue
+        origins.append(origin)
+    if not origins:
+        logger.warning("No valid CORS origins configured — falling back to localhost defaults")
+        origins = ["http://localhost:3000", "http://localhost:8080"]
+    return origins
+
 # ── Global state ────────────────────────────────────────────────────────────
 
 _hypervisor: Hypervisor | None = None
@@ -127,7 +155,7 @@ def create_app() -> FastAPI:
 
     application.add_middleware(
         CORSMiddleware,
-        allow_origins=os.environ.get("CORS_ALLOWED_ORIGINS", "http://localhost:3000,http://localhost:8080").split(","),
+        allow_origins=_parse_cors_origins(os.environ.get("CORS_ALLOWED_ORIGINS", "http://localhost:3000,http://localhost:8080")),
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],