agentlock-browser 0.1.0__py3-none-any.whl

agentlock_browser/__init__.py

@@ -0,0 +1,29 @@
+"""agentlock-browser -- provenance-gated browsing tools for AI agents.
+
+Adversarial and legitimate tool requests are semantically identical.  What
+distinguishes them is not what the request says but where its values came
+from.  This server gates browsing on that, at the infrastructure layer, using
+AgentLock.
+
+Copyright 2026 David Grice
+SPDX-License-Identifier: AGPL-3.0-or-later
+"""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"
+
+from agentlock_browser.config import BrowserConfig
+from agentlock_browser.gate import BrowserGate, Decision
+from agentlock_browser.provenance import Channel, ProvenanceLedger
+from agentlock_browser.service import BrowserService
+
+__all__ = [
+    "BrowserConfig",
+    "BrowserGate",
+    "BrowserService",
+    "Channel",
+    "Decision",
+    "ProvenanceLedger",
+    "__version__",
+]

agentlock_browser/__main__.py

@@ -0,0 +1,21 @@
+"""Entry point: ``agentlock-browser`` runs the MCP server on stdio.
+
+Copyright 2026 David Grice
+SPDX-License-Identifier: AGPL-3.0-or-later
+"""
+
+from __future__ import annotations
+
+import anyio
+
+from agentlock_browser.config import BrowserConfig
+from agentlock_browser.server import build_server
+
+
+def main() -> None:
+    server = build_server(BrowserConfig.load())
+    anyio.run(server.run_stdio_async)
+
+
+if __name__ == "__main__":
+    main()

agentlock_browser/browser.py

@@ -0,0 +1,484 @@
+"""The browser this server owns.
+
+agentlock-browser drives chromium through Playwright directly.  It does not
+wrap @playwright/mcp and shares no code with it.  The probe in probe/REPORT.md
+is the reason: that server returns one undifferentiated text blob per call,
+identifies elements with opaque server-side refs, accepts raw CSS selectors in
+the same field as those refs, and exposes arbitrary JavaScript through
+``browser_evaluate``.  None of that can carry provenance.
+
+What this module guarantees instead:
+
+* every result is structured, and page text arrives as separately identified
+  elements or blocks -- never as one string;
+* element ids are stable for the current page load and regenerate on
+  navigation, so an id cannot outlive the page it describes;
+* there is no evaluate tool.  The extraction script below is a fixed,
+  server-authored constant; no model input reaches it, and nothing in the MCP
+  surface can run JavaScript.
+
+Navigation is intercepted through the CDP ``Fetch`` domain rather than
+Playwright's ``page.route``.  That is not a preference: ``page.route`` never
+offers a redirect hop to a handler, so a 302 to another origin was followed
+before anything could gate it (probe/origin/REPORT.md R1,
+probe/cdp/REPORT.md).  ``Fetch.requestPaused`` does surface the hop, and
+carries ``redirectedRequestId`` pointing back at the request it came from.
+This makes the server chromium-only.
+
+Copyright 2026 David Grice
+SPDX-License-Identifier: AGPL-3.0-or-later
+"""
+
+from __future__ import annotations
+
+import asyncio
+from dataclasses import dataclass
+from typing import Any
+
+from playwright.async_api import Playwright, async_playwright
+
+from agentlock_browser.config import BrowserConfig, origin_of
+
+__all__ = ["BrowserSession", "PageElement", "TextBlock"]
+
+#: Elements an inventory should name: everything interactive, plus the
+#: headings and text containers that make a page readable.
+SNAPSHOT_SEL = (
+    "a[href], button, input, select, textarea, "
+    "h1, h2, h3, h4, h5, h6, p, li, label"
+)
+
+#: Block-level containers for read_text.  Generic containers are included so
+#: text in a bare <div> is not silently missed; the extractor keeps only leaf
+#: matches, so a paragraph's text is attributed to the paragraph and not also
+#: to every ancestor that happens to match.
+BLOCK_SEL = (
+    "h1, h2, h3, h4, h5, h6, p, li, blockquote, pre, td, th, dt, dd, "
+    "figcaption, div, section, article, main, aside, span"
+)
+
+#: Fixed extraction script.  A constant, never interpolated with model input.
+_EXTRACT_JS = """
+({ selector, leafOnly }) => {
+  const nodes = Array.from(document.querySelectorAll(selector));
+  const visible = (el) => {
+    const s = window.getComputedStyle(el);
+    if (s.display === 'none' || s.visibility === 'hidden' || s.opacity === '0')
+      return false;
+    const r = el.getBoundingClientRect();
+    return (r.width > 0 && r.height > 0) || el.tagName === 'OPTION';
+  };
+  const roleOf = (el) => {
+    const explicit = el.getAttribute('role');
+    if (explicit) return explicit;
+    const tag = el.tagName.toLowerCase();
+    if (tag === 'a') return 'link';
+    if (tag === 'button') return 'button';
+    if (tag === 'select') return 'combobox';
+    if (tag === 'textarea') return 'textbox';
+    if (tag === 'input') {
+      const t = (el.getAttribute('type') || 'text').toLowerCase();
+      if (t === 'checkbox') return 'checkbox';
+      if (t === 'radio') return 'radio';
+      if (t === 'submit' || t === 'button') return 'button';
+      return 'textbox';
+    }
+    if (/^h[1-6]$/.test(tag)) return 'heading';
+    if (tag === 'li') return 'listitem';
+    if (tag === 'p') return 'paragraph';
+    if (tag === 'label') return 'label';
+    return tag;
+  };
+  const nameOf = (el) => (
+    el.getAttribute('aria-label') ||
+    el.getAttribute('alt') ||
+    el.getAttribute('placeholder') ||
+    el.getAttribute('title') ||
+    (el.tagName === 'INPUT' ? (el.getAttribute('name') || '') : '') ||
+    (el.innerText || '').trim().slice(0, 120)
+  );
+  return nodes.map((el, i) => ({
+    index: i,
+    leaf: el.querySelector(selector) === null,
+    role: roleOf(el),
+    name: (nameOf(el) || '').trim().slice(0, 200),
+    text: (el.innerText || '').trim().slice(0, 2000),
+    href: el.tagName === 'A' ? (el.href || '') : '',
+    visible: visible(el),
+  })).filter((item) => !leafOnly || item.leaf);
+}
+"""
+
+
+#: Only main-frame document requests are paused.  Subresources are not
+#: navigation and are never gated, so pausing them would cost latency for
+#: nothing.
+_FETCH_PATTERNS = [
+    {"urlPattern": "*", "resourceType": "Document", "requestStage": "Request"}
+]
+
+#: One tab, enforced at launch.  The Fetch interceptor is attached to one
+#: page, so a second top-level page is not gated by it at all: probe/popup
+#: recorded a ``target="_blank"`` link, a ``window.open`` on click, and a
+#: ``window.open`` on load each loading evil.test with the interceptor never
+#: firing and no decision reaching the log.  This flag makes the renderer
+#: refuse to create such a page in the first place.
+_BLOCK_NEW_PAGES_ARG = "--block-new-web-contents"
+
+#: A denied navigation is answered with 204, not failed.  Measured in
+#: probe/cdp/REPORT.md: ``Fetch.failRequest`` leaves the page on
+#: ``chrome-error://chromewebdata/`` even when a document was committed
+#: before, while a 204 leaves it exactly where it was.  "The page stays put"
+#: has to mean the URL it was at before the call.
+_DENY_RESPONSE_CODE = 204
+
+
+@dataclass
+class PageElement:
+    id: str
+    role: str
+    name: str
+    text: str
+    href: str
+
+
+@dataclass
+class TextBlock:
+    id: str
+    text: str
+
+
+class BrowserSession:
+    """Owns one chromium page and the identifiers that describe it."""
+
+    def __init__(self, config: BrowserConfig) -> None:
+        self.config = config
+        self._pw: Playwright | None = None
+        self._browser: Any = None
+        self._context: Any = None
+        self.page: Any = None
+
+        #: Increments on every committed main-frame navigation.  Element ids
+        #: carry it, so an id minted before a navigation can never resolve
+        #: after one.
+        self.epoch = 0
+        #: Ids returned by the most recent snapshot, and the hrefs they
+        #: resolved to.  navigate(link_id) is checked against exactly this.
+        self.snapshot_ids: dict[str, str] = {}
+        self.snapshot_epoch = -1
+
+        #: Set while an authorized goto is in flight.  Its origin is the
+        #: origin the navigation was authorized for, which is what a redirect
+        #: hop is compared against.
+        self._nav_grant: str | None = None
+        #: Called with (url, origin, redirected_from) when a cross-origin
+        #: navigation is intercepted.  Returns True to allow.  Installed by
+        #: the server.
+        self.on_cross_origin: Any = None
+        #: Intercepted-and-refused targets since the last read, for reporting.
+        self.blocked: list[str] = []
+        #: Called with the url of a new top-level page that appeared anyway.
+        #: Installed by the server, which logs it.  The page is closed either
+        #: way; this only decides whether the closure is recorded.
+        self.on_new_page: Any = None
+        #: Urls of pages closed by that listener, for reporting.
+        self.blocked_pages: list[str] = []
+        #: Anything the interceptor itself failed on.  Recorded rather than
+        #: swallowed: the handler fails closed, so a bug here stops browsing
+        #: rather than quietly letting a navigation through.
+        self.interceptor_errors: list[str] = []
+        #: Error text from the last goto, when the navigation was refused.
+        self.last_navigation_error: str = ""
+
+        self._cdp: Any = None
+        self._main_frame_id: str = ""
+        self._loop: Any = None
+
+    # -- lifecycle ---------------------------------------------------------
+
+    async def start(self) -> None:
+        self._pw = await async_playwright().start()
+        args = list(self.config.chromium_args)
+        if _BLOCK_NEW_PAGES_ARG not in args:
+            args.append(_BLOCK_NEW_PAGES_ARG)
+        self._browser = await self._pw.chromium.launch(
+            headless=self.config.headless,
+            args=args,
+        )
+        self._context = await self._browser.new_context(
+            user_agent=self.config.user_agent,
+        )
+        self._context.set_default_navigation_timeout(self.config.nav_timeout_ms)
+        self._context.set_default_timeout(self.config.action_timeout_ms)
+        self.page = await self._context.new_page()
+        self.page.on("framenavigated", self._on_frame_navigated)
+
+        self._loop = asyncio.get_running_loop()
+        # Registered after self.page exists, so the listener never sees the
+        # page this session owns.
+        self._context.on("page", self._on_new_page)
+        self._cdp = await self._context.new_cdp_session(self.page)
+        frame_tree = await self._cdp.send("Page.getFrameTree")
+        self._main_frame_id = frame_tree["frameTree"]["frame"]["id"]
+        await self._cdp.send("Fetch.enable", {"patterns": _FETCH_PATTERNS})
+        self._cdp.on("Fetch.requestPaused", self._on_request_paused)
+
+    async def close(self) -> None:
+        for closer in (self._context, self._browser):
+            if closer is not None:
+                await closer.close()
+        if self._pw is not None:
+            await self._pw.stop()
+        self._pw = self._browser = self._context = self.page = None
+
+    async def __aenter__(self) -> BrowserSession:
+        await self.start()
+        return self
+
+    async def __aexit__(self, *exc: object) -> None:
+        await self.close()
+
+    # -- navigation interception ------------------------------------------
+
+    def _on_frame_navigated(self, frame: Any) -> None:
+        if self.page is not None and frame == self.page.main_frame:
+            self.epoch += 1
+            self.snapshot_ids = {}
+
+    def _on_new_page(self, page: Any) -> None:
+        """A second top-level page appeared.  Close it.
+
+        ``--block-new-web-contents`` should mean this never fires.  It is here
+        because a launch flag is an assumption about chromium, and the one-tab
+        rule should not rest on one: anything the flag misses is closed here
+        and recorded.  The page is never handed to a tool, never snapshotted,
+        and never becomes ``self.page``.
+        """
+        if page is self.page:
+            return
+        if self._loop is not None:
+            self._loop.create_task(self._close_new_page(page))
+
+    async def _close_new_page(self, page: Any) -> None:
+        """Close a page that appeared anyway, and record that it was closed.
+
+        Fails closed: an exception here is appended to ``interceptor_errors``
+        rather than swallowed, because a page this session cannot close is a
+        page outside everything the gate decides.
+        """
+        url = ""
+        try:
+            url = page.url
+            self.blocked_pages.append(url)
+            if self.on_new_page is not None:
+                self.on_new_page(url)
+            await page.close()
+        except Exception as exc:  # noqa: BLE001 - recorded, never swallowed
+            self.interceptor_errors.append(
+                f"{type(exc).__name__}: {exc} (closing new page {url!r})"
+            )
+
+    def _on_request_paused(self, event: dict[str, Any]) -> None:
+        """CDP hands this to us synchronously; the decision runs as a task.
+
+        The request stays paused until the task answers it, so nothing races
+        ahead of the gate.
+        """
+        if self._loop is not None:
+            self._loop.create_task(self._handle_paused(event))
+
+    def _authorized_origin(self) -> str:
+        """The origin this navigation is allowed to be on.
+
+        While an authorized goto is in flight that is the origin the gate
+        approved, not the page's current origin: during a redirect chain the
+        page has not moved yet, and comparing against where it still happens
+        to be would let the first hop off the authorized origin through.
+        """
+        if self._nav_grant is not None:
+            return origin_of(self._nav_grant)
+        return origin_of(self.page.url if self.page else "")
+
+    async def _handle_paused(self, event: dict[str, Any]) -> None:
+        request_id = event.get("requestId", "")
+        target = event.get("request", {}).get("url", "")
+        redirected_from = event.get("redirectedRequestId")
+        try:
+            if event.get("frameId") != self._main_frame_id:
+                # A subframe document.  Not navigation of the page the tools
+                # act on, and not gated in v0.
+                await self._continue(request_id)
+                return
+
+            if self._nav_grant is not None and target == self._nav_grant:
+                # The navigation navigate() just authorized.
+                await self._continue(request_id)
+                return
+
+            authorized = self._authorized_origin()
+            if not authorized or origin_of(target) == authorized:
+                # Same-origin navigation is ungated in v0 (PREDICTIONS.md).
+                await self._continue(request_id)
+                return
+
+            if await self._authorized_cross_origin(target, authorized,
+                                                   redirected_from):
+                await self._continue(request_id)
+            else:
+                self.blocked.append(target)
+                await self._refuse(request_id)
+        except Exception as exc:  # noqa: BLE001 - fails closed, and says so
+            self.interceptor_errors.append(
+                f"{type(exc).__name__}: {exc} (request {request_id} for {target})"
+            )
+            try:
+                await self._refuse(request_id)
+            except Exception as inner:  # noqa: BLE001
+                self.interceptor_errors.append(
+                    f"refuse failed: {type(inner).__name__}: {inner}"
+                )
+
+    async def _continue(self, request_id: str) -> None:
+        await self._cdp.send("Fetch.continueRequest", {"requestId": request_id})
+
+    async def _refuse(self, request_id: str) -> None:
+        """Answer a refused navigation with 204, leaving the page where it is."""
+        await self._cdp.send("Fetch.fulfillRequest", {
+            "requestId": request_id,
+            "responseCode": _DENY_RESPONSE_CODE,
+            "responseHeaders": [],
+            "body": "",
+        })
+
+    async def _authorized_cross_origin(
+        self, target: str, origin: str, redirected_from: str | None
+    ) -> bool:
+        """Ask the owner of this session whether the navigation may proceed."""
+        if self.on_cross_origin is None:
+            return True
+        return bool(self.on_cross_origin(target, origin, redirected_from))
+
+    # -- actions -----------------------------------------------------------
+
+    async def goto(self, url: str) -> None:
+        """Navigate to an already-authorized URL.
+
+        A navigation the interceptor refuses mid-flight surfaces here as an
+        aborted goto.  That is a decision this server made, not a failure, so
+        it is recorded rather than raised: the page is still on the URL it was
+        on before the call, and the caller reports that.
+        """
+        self.last_navigation_error = ""
+        self._nav_grant = url
+        try:
+            await self.page.goto(url, wait_until="domcontentloaded")
+        except Exception as exc:  # noqa: BLE001 - reported, never swallowed
+            self.last_navigation_error = f"{type(exc).__name__}: {exc}".splitlines()[0]
+        finally:
+            self._nav_grant = None
+
+    async def back(self) -> bool:
+        response = await self.page.go_back(wait_until="domcontentloaded")
+        return response is not None
+
+    @property
+    def url(self) -> str:
+        return self.page.url if self.page else ""
+
+    @property
+    def origin(self) -> str:
+        return origin_of(self.url)
+
+    async def title(self) -> str:
+        return await self.page.title()
+
+    async def _extract(
+        self, selector: str, leaf_only: bool = False
+    ) -> list[dict[str, Any]]:
+        return await self.page.evaluate(
+            _EXTRACT_JS, {"selector": selector, "leafOnly": leaf_only}
+        )
+
+    async def snapshot(self) -> list[PageElement]:
+        """Structured element inventory for the current page load.
+
+        Ids are ``<epoch>-e<index>``: deterministic from document order, so
+        two snapshots of the same unchanged page return the same ids, and the
+        epoch makes every id from a previous page load unresolvable.
+        """
+        raw = await self._extract(SNAPSHOT_SEL)
+        elements = [
+            PageElement(
+                id=f"{self.epoch}-e{item['index']}",
+                role=item["role"],
+                name=item["name"],
+                text=item["text"],
+                href=item["href"],
+            )
+            for item in raw
+            if item["visible"] or item["href"]
+        ]
+        self.snapshot_ids = {e.id: e.href for e in elements}
+        self.snapshot_epoch = self.epoch
+        return elements
+
+    async def read_text(self) -> list[TextBlock]:
+        """Page text as separately identified blocks.  Never one string."""
+        raw = await self._extract(BLOCK_SEL, leaf_only=True)
+        return [
+            TextBlock(id=f"{self.epoch}-b{item['index']}", text=item["text"])
+            for item in raw
+            if item["visible"] and item["text"]
+        ]
+
+    def resolve_link(self, element_id: str) -> str | None:
+        """The href a link id resolved to in the most recent snapshot.
+
+        Returns None when the id is unknown, or when it belongs to a previous
+        page load.  This is the whole freshness rule.
+        """
+        if self.snapshot_epoch != self.epoch:
+            return None
+        href = self.snapshot_ids.get(element_id)
+        return href or None
+
+    def _locator(self, element_id: str) -> Any:
+        """Resolve an element id back to a live locator.
+
+        The id encodes the page-load epoch and the element's index in document
+        order under a fixed selector.  A mismatched epoch is refused rather
+        than silently resolved against a different page.
+        """
+        try:
+            epoch_str, kind_index = element_id.split("-", 1)
+            epoch = int(epoch_str)
+            kind, index = kind_index[0], int(kind_index[1:])
+        except (ValueError, IndexError):
+            raise KeyError(f"malformed element id: {element_id!r}") from None
+        if kind != "e":
+            # read_text block ids ("<epoch>-b<n>") index a different node list.
+            # Resolving one here would act on a different element than the id
+            # names, so it is refused rather than coerced.
+            raise KeyError(
+                f"{element_id!r} is a text-block id; click and type take "
+                f"element ids from snapshot (\"<epoch>-e<n>\")"
+            )
+        if epoch != self.epoch:
+            raise KeyError(
+                f"element id {element_id!r} belongs to page load {epoch}, "
+                f"current page load is {self.epoch}"
+            )
+        return self.page.locator(SNAPSHOT_SEL).nth(index)
+
+    async def click(self, element_id: str) -> None:
+        """Click, then let any navigation the click triggered be decided.
+
+        Without the settle wait the click returns before the route handler has
+        seen the navigation request, and the caller reads an interception
+        result that has not happened yet.
+        """
+        await self._locator(element_id).click()
+        await self.page.wait_for_timeout(self.config.settle_ms)
+
+    async def fill(self, element_id: str, value: str) -> None:
+        await self._locator(element_id).fill(value)

agentlock_browser/config.py

@@ -0,0 +1,123 @@
+"""Configuration for the agentlock-browser MCP server.
+
+Everything the operator controls lives here.  Nothing in this module is
+reachable by the model: config is loaded once at startup, from a JSON file
+and/or the environment, before the first tool call is served.
+
+Copyright 2026 David Grice
+SPDX-License-Identifier: AGPL-3.0-or-later
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from urllib.parse import urlsplit
+
+__all__ = ["BrowserConfig", "origin_of"]
+
+
+def origin_of(url: str) -> str:
+    """The scheme://host[:port] origin of a URL, lowercased.
+
+    Returns "" for a URL with no scheme or host (about:blank, data:, "").
+    """
+    parts = urlsplit(url.strip())
+    if not parts.scheme or not parts.netloc:
+        return ""
+    return f"{parts.scheme.lower()}://{parts.netloc.lower()}"
+
+
+@dataclass
+class BrowserConfig:
+    """Operator-controlled configuration.
+
+    Attributes:
+        allowlist: Origins the operator has pre-authorized for navigation.
+            Values in this list are the ALLOWLIST provenance channel.  Compared
+            as origins (scheme://host[:port]), never as substrings.
+        operator_text: The operator's own message text for this session.  This
+            is the USER provenance channel and the ONLY source of it.  See
+            README "The USER channel" for why this is a startup input and not
+            a tool argument.
+        log_path: JSONL decision log.  Every gate decision and every provenance
+            record is appended here.
+        headless: Run chromium headless.  Default True.
+        chromium_args: Extra chromium launch arguments.  Used by the test
+            harness to map evil.test onto a local server.
+        user_agent: Optional user-agent override.
+        nav_timeout_ms: Navigation timeout.
+        action_timeout_ms: Click/type timeout.
+        settle_ms: How long to let work a click triggered settle before
+            reporting the result, so an intercepted navigation is decided
+            before the caller reads the outcome.
+        role: The role presented to the AgentLock gate.
+        signing_key: HMAC-SHA256 receipt signing key.  Generated per process
+            when absent, which makes receipts verifiable only in-process.
+    """
+
+    allowlist: list[str] = field(default_factory=list)
+    operator_text: str = ""
+    log_path: str = "agentlock-browser.jsonl"
+    headless: bool = True
+    chromium_args: list[str] = field(default_factory=list)
+    user_agent: str | None = None
+    nav_timeout_ms: int = 30_000
+    action_timeout_ms: int = 10_000
+    settle_ms: int = 500
+    role: str = "operator"
+    signing_key: bytes | None = None
+
+    def __post_init__(self) -> None:
+        # Normalize the allowlist to origins once, at load, so no comparison
+        # downstream ever has to guess whether it holds a URL or an origin.
+        self.allowlist = [origin_of(a) or a.strip().lower() for a in self.allowlist]
+
+    def is_allowlisted(self, url: str) -> bool:
+        """Is this URL's origin on the operator's allowlist?
+
+        Origin equality, not prefix or substring: "https://evil.com/example.com"
+        does not match an allowlisted "https://example.com".
+        """
+        origin = origin_of(url)
+        return bool(origin) and origin in self.allowlist
+
+    @classmethod
+    def load(cls, path: str | os.PathLike[str] | None = None) -> BrowserConfig:
+        """Load config from a JSON file and the environment.
+
+        Environment overrides the file.  Recognized variables:
+
+        * ``AGENTLOCK_BROWSER_CONFIG``   -- path to the JSON file
+        * ``AGENTLOCK_BROWSER_ALLOWLIST`` -- comma-separated origins
+        * ``AGENTLOCK_BROWSER_OPERATOR_TEXT`` -- the operator's message text
+        * ``AGENTLOCK_BROWSER_LOG``      -- JSONL decision log path
+        * ``AGENTLOCK_BROWSER_HEADLESS`` -- "0"/"false" to run headed
+        """
+        data: dict[str, object] = {}
+        cfg_path = path or os.environ.get("AGENTLOCK_BROWSER_CONFIG")
+        if cfg_path:
+            p = Path(cfg_path).expanduser()
+            if p.exists():
+                data = json.loads(p.read_text())
+
+        allowlist_env = os.environ.get("AGENTLOCK_BROWSER_ALLOWLIST")
+        if allowlist_env is not None:
+            data["allowlist"] = [a for a in allowlist_env.split(",") if a.strip()]
+
+        operator_env = os.environ.get("AGENTLOCK_BROWSER_OPERATOR_TEXT")
+        if operator_env is not None:
+            data["operator_text"] = operator_env
+
+        log_env = os.environ.get("AGENTLOCK_BROWSER_LOG")
+        if log_env:
+            data["log_path"] = log_env
+
+        headless_env = os.environ.get("AGENTLOCK_BROWSER_HEADLESS")
+        if headless_env is not None:
+            data["headless"] = headless_env.strip().lower() not in ("0", "false", "no")
+
+        known = {f for f in cls.__dataclass_fields__ if f != "signing_key"}
+        return cls(**{k: v for k, v in data.items() if k in known})  # type: ignore[arg-type]