plugin-scanner 2.0.1102__tar.gz → 2.0.1104__tar.gz

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1102
+Version: 2.0.1104
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1102"
+version = "2.0.1104"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1102"
+version = "2.0.1104"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_backup_extensions.py

@@ -6,8 +6,30 @@ from .command_extension_matchers import executable_matcher, safe_flag_variant
 from .command_extension_specs import CommandExtensionSpec
 from .command_rules import AnyMatcher, CommandSafetyRule, CommandSafeVariant
 
-_RCLONE_GLOBAL_OPTIONS = frozenset({"--config", "--log-file", "--password-command", "--rc-addr"})
-_RESTIC_GLOBAL_OPTIONS = frozenset({"-r", "--repo", "--password-file", "--cache-dir", "-o", "--option"})
+_RCLONE_GLOBAL_OPTIONS = frozenset({"--config", "--log-file", "--log-level", "--password-command", "--rc-addr"})
+_RESTIC_GLOBAL_OPTIONS = frozenset(
+    {
+        "--cacert",
+        "--cache-dir",
+        "--compression",
+        "--http-user-agent",
+        "--key-hint",
+        "--limit-download",
+        "--limit-upload",
+        "--option",
+        "--pack-size",
+        "--password-command",
+        "--password-file",
+        "--repo",
+        "--repository-file",
+        "--retry-lock",
+        "--stuck-request-timeout",
+        "--tls-client-cert",
+        "-o",
+        "-p",
+        "-r",
+    }
+)
 _BORG_GLOBAL_OPTIONS = frozenset(
     {
         "-r",
@@ -16,6 +38,7 @@ _BORG_GLOBAL_OPTIONS = frozenset(
         "--debug-topic",
         "--lock-wait",
         "--remote-path",
+        "--remote-ratelimit",
         "--rsh",
         "--socket",
         "--umask",
@@ -65,6 +88,7 @@ _RCLONE_MUTATION = AnyMatcher(
             command,
             allow_leading_options=True,
             leading_options_with_values=_RCLONE_GLOBAL_OPTIONS,
+            fail_secure_unknown_options=True,
         )
         for command in ("delete", "deletefile", "purge", "rmdirs", "sync", "move", "moveto", "bisync")
     )
@@ -76,12 +100,14 @@ _RESTIC_MUTATION = AnyMatcher(
             "forget",
             allow_leading_options=True,
             leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+            fail_secure_unknown_options=True,
         ),
         executable_matcher(
             "restic",
             "prune",
             allow_leading_options=True,
             leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+            fail_secure_unknown_options=True,
         ),
         executable_matcher(
             "restic",
@@ -89,6 +115,7 @@ _RESTIC_MUTATION = AnyMatcher(
             required_flags=frozenset({"--forget"}),
             allow_leading_options=True,
             leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+            fail_secure_unknown_options=True,
         ),
     )
 )
@@ -99,6 +126,7 @@ _BORG_MUTATION = AnyMatcher(
             command,
             allow_leading_options=True,
             leading_options_with_values=_BORG_GLOBAL_OPTIONS,
+            fail_secure_unknown_options=True,
         )
         for command in ("delete", "prune", "recreate")
     )
@@ -110,6 +138,7 @@ _BORG_DRY_RUN = AnyMatcher(
             command,
             allow_leading_options=True,
             leading_options_with_values=_BORG_GLOBAL_OPTIONS,
+            fail_secure_unknown_options=True,
         )
         for command in ("prune", "recreate")
     )
@@ -122,6 +151,7 @@ _VELERO_DELETE = AnyMatcher(
             "delete",
             global_options_with_values=_VELERO_GLOBAL_OPTIONS,
             global_flags=_VELERO_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         )
         for resource in ("backup", "schedule", "restore")
     )

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -19,6 +19,7 @@ from .command_rules import (
 )
 from .command_search_messaging_extensions import SEARCH_MESSAGING_COMMAND_RULES
 from .command_storage_extensions import STORAGE_COMMAND_RULES
+from .command_structured_matchers import SubcommandOperandPrefixMatcher
 
 COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "credential exfiltration shell command": (
@@ -73,6 +74,13 @@ _GIT_SUBCOMMAND_OPTIONS_WITH_VALUES = {
     "push": frozenset({"--exec", "--push-option", "--receive-pack", "--repo", "-o"}),
     "reset": frozenset({"--pathspec-from-file"}),
 }
+_GIT_FORCE_REFSPEC = SubcommandOperandPrefixMatcher(
+    executables=frozenset({"git"}),
+    subcommands=("push",),
+    operand_prefixes=frozenset({"+"}),
+    leading_options_with_values=_GIT_GLOBAL_OPTIONS_WITH_VALUES,
+    options_with_values=_GIT_SUBCOMMAND_OPTIONS_WITH_VALUES["push"],
+)
 
 
 def _git_matcher(subcommand: str, *, required_flags: frozenset[str]) -> ExecutableMatcher:
@@ -279,6 +287,7 @@ BUILT_IN_COMMAND_RULES = (
             matchers=(
                 _git_matcher("push", required_flags=frozenset({"--force"})),
                 _git_matcher("push", required_flags=frozenset({"-f"})),
+                _GIT_FORCE_REFSPEC,
             )
         ),
         action_class="git destructive command",

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_cloud_extensions.py

@@ -38,10 +38,15 @@ _GCLOUD_GLOBAL_OPTIONS = frozenset(
         "--account",
         "--billing-project",
         "--configuration",
+        "--filter",
         "--flags-file",
+        "--flatten",
         "--format",
         "--impersonate-service-account",
+        "--limit",
+        "--page-size",
         "--project",
+        "--sort-by",
         "--trace-token",
         "--verbosity",
     }
@@ -67,6 +72,7 @@ _AWS_RESOURCE_DELETE = AnyMatcher(
             "terminate-instances",
             global_options_with_values=_AWS_GLOBAL_OPTIONS,
             global_flags=_AWS_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         ),
         executable_matcher(
             "aws",
@@ -74,6 +80,7 @@ _AWS_RESOURCE_DELETE = AnyMatcher(
             "delete-db-instance",
             global_options_with_values=_AWS_GLOBAL_OPTIONS,
             global_flags=_AWS_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         ),
         executable_matcher(
             "aws",
@@ -81,6 +88,7 @@ _AWS_RESOURCE_DELETE = AnyMatcher(
             "delete-db-cluster",
             global_options_with_values=_AWS_GLOBAL_OPTIONS,
             global_flags=_AWS_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         ),
         executable_matcher(
             "aws",
@@ -88,6 +96,7 @@ _AWS_RESOURCE_DELETE = AnyMatcher(
             "delete-cluster",
             global_options_with_values=_AWS_GLOBAL_OPTIONS,
             global_flags=_AWS_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         ),
     )
 )
@@ -99,6 +108,7 @@ _AWS_EC2_TERMINATE = AnyMatcher(
             "terminate-instances",
             global_options_with_values=_AWS_GLOBAL_OPTIONS,
             global_flags=_AWS_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         ),
     )
 )
@@ -111,6 +121,7 @@ _GCLOUD_RESOURCE_DELETE = AnyMatcher(
                 *operation,
                 global_options_with_values=_GCLOUD_GLOBAL_OPTIONS,
                 global_flags=_GCLOUD_GLOBAL_FLAGS,
+                fail_secure_unknown_options=True,
             )
             for track in ((), ("alpha",), ("beta",), ("preview",))
             for operation in (("compute", "instances", "delete"),)
@@ -124,6 +135,7 @@ _GCLOUD_RESOURCE_DELETE = AnyMatcher(
                 "delete",
                 global_options_with_values=_GCLOUD_GLOBAL_OPTIONS,
                 global_flags=_GCLOUD_GLOBAL_FLAGS,
+                fail_secure_unknown_options=True,
             )
             for track in ((), ("alpha",), ("beta",))
         ),
@@ -137,6 +149,7 @@ _AZURE_RESOURCE_DELETE = AnyMatcher(
             "delete",
             global_options_with_values=_AZURE_GLOBAL_OPTIONS,
             global_flags=_AZURE_GLOBAL_FLAGS,
+            fail_secure_unknown_options=True,
         ),
     )
 )

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_extension_matchers.py

@@ -23,6 +23,7 @@ def executable_matcher(
     allow_leading_options: bool = False,
     leading_options_with_values: frozenset[str] = _EMPTY_STRING_SET,
     options_with_values: frozenset[str] = _EMPTY_STRING_SET,
+    fail_secure_unknown_options: bool = False,
 ) -> ExecutableMatcher:
     """Build a portable executable matcher with structured option handling."""
 
@@ -36,6 +37,7 @@ def executable_matcher(
         allow_leading_options=allow_leading_options,
         leading_options_with_values=leading_options_with_values,
         options_with_values=options_with_values,
+        fail_secure_unknown_options=fail_secure_unknown_options,
     )
 
 
@@ -57,6 +59,7 @@ def with_required_flag(matcher: AnyMatcher, flag: str) -> AnyMatcher:
                 interspersed_flags=child.interspersed_flags,
                 options_with_values=child.options_with_values,
                 required_flags_in_all_arguments=True,
+                fail_secure_unknown_options=child.fail_secure_unknown_options,
             )
             for child in matcher.matchers
             if isinstance(child, ExecutableMatcher)

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_managed_service_extensions.py

@@ -38,10 +38,15 @@ _GCLOUD_OPTIONS = frozenset(
         "--account",
         "--billing-project",
         "--configuration",
+        "--filter",
         "--flags-file",
+        "--flatten",
         "--format",
         "--impersonate-service-account",
+        "--limit",
+        "--page-size",
         "--project",
+        "--sort-by",
         "--trace-token",
         "--verbosity",
     }
@@ -90,6 +95,7 @@ def _aws(*subcommands: str):
         *subcommands,
         global_options_with_values=_AWS_OPTIONS,
         global_flags=_AWS_FLAGS,
+        fail_secure_unknown_options=True,
     )
 
 
@@ -101,6 +107,7 @@ def _gcloud(*subcommands: str, tracks: tuple[str, ...] = ("", "alpha", "beta")):
             *subcommands,
             global_options_with_values=_GCLOUD_OPTIONS,
             global_flags=_GCLOUD_FLAGS,
+            fail_secure_unknown_options=True,
         )
         for track in tracks
     )
@@ -112,6 +119,7 @@ def _azure(*subcommands: str):
         *subcommands,
         global_options_with_values=_AZURE_OPTIONS,
         global_flags=_AZURE_FLAGS,
+        fail_secure_unknown_options=True,
     )
 
 

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_model.py

@@ -333,6 +333,16 @@ def _embedded_execution(
         )
         executable = executable_name(owner.executable) if owner is not None else None
         if executable not in _SHELL_SCRIPT_EXECUTABLES:
+            if not heredoc.quoted:
+                _append_substitution_execution(
+                    heredoc.body,
+                    source_offset=heredoc.body_start,
+                    context_prefix=f"heredoc:{index}:substitution",
+                    excluded_ranges=(),
+                    embedded=embedded,
+                    segments=segments,
+                    depth=0,
+                )
             continue
         context = f"heredoc:{index}"
         embedded.append(

plugin_scanner-2.0.1104/src/codex_plugin_scanner/guard/runtime/command_option_parsing.py

@@ -0,0 +1,128 @@
+"""Conservative option parsing for destructive command matchers."""
+
+from __future__ import annotations
+
+from functools import cache
+
+
+def matches_subcommands_conservatively(
+    arguments: tuple[str, ...],
+    subcommands: tuple[str, ...],
+    *,
+    options_with_values: frozenset[str],
+    known_flags: frozenset[str],
+) -> bool:
+    """Match a destructive prefix under any plausible unknown-option shape."""
+
+    @cache
+    def matches(argument_index: int, subcommand_index: int) -> bool:
+        if subcommand_index == len(subcommands):
+            return True
+        if argument_index >= len(arguments):
+            return False
+        argument = arguments[argument_index]
+        if argument == "--":
+            remaining = len(subcommands) - subcommand_index
+            return arguments[argument_index + 1 : argument_index + 1 + remaining] == subcommands[subcommand_index:]
+        if _is_option(argument):
+            option_name = argument.split("=", 1)[0]
+            attached_short_option = _attached_short_value_option(argument, options_with_values)
+            last_short_is_known_flag = _last_short_option_is_known_flag(argument, known_flags)
+            if option_name in options_with_values:
+                advance = 1 if "=" in argument else 2
+                return matches(argument_index + advance, subcommand_index)
+            if attached_short_option is not None or "=" in argument or last_short_is_known_flag:
+                return matches(argument_index + 1, subcommand_index)
+            if option_name in known_flags:
+                return matches(argument_index + 1, subcommand_index)
+            return matches(argument_index + 1, subcommand_index) or matches(
+                argument_index + 2,
+                subcommand_index,
+            )
+        if argument != subcommands[subcommand_index]:
+            return False
+        return matches(argument_index + 1, subcommand_index + 1)
+
+    return matches(0, 0)
+
+
+def flags_present_in_all_option_parses(
+    arguments: tuple[str, ...],
+    required_flags: frozenset[str],
+    *,
+    options_with_values: frozenset[str],
+    known_flags: frozenset[str],
+) -> bool:
+    """Return whether every plausible option parse contains each required flag."""
+
+    return all(
+        _flag_present_in_all_option_parses(
+            arguments,
+            required_flag,
+            options_with_values=options_with_values,
+            known_flags=known_flags,
+        )
+        for required_flag in required_flags
+    )
+
+
+def _flag_present_in_all_option_parses(
+    arguments: tuple[str, ...],
+    required_flag: str,
+    *,
+    options_with_values: frozenset[str],
+    known_flags: frozenset[str],
+) -> bool:
+    @cache
+    def present(argument_index: int, seen: bool) -> bool:
+        if argument_index >= len(arguments):
+            return seen
+        argument = arguments[argument_index]
+        if argument == "--":
+            return seen
+        if not _is_option(argument):
+            return present(argument_index + 1, seen)
+        option_name = argument.split("=", 1)[0]
+        attached_short_option = _attached_short_value_option(argument, options_with_values)
+        if option_name in options_with_values:
+            advance = 1 if "=" in argument else 2
+            return present(argument_index + advance, seen)
+        if attached_short_option is not None:
+            return present(argument_index + 1, seen)
+        token_flags = _flags_in_option_token(argument, options_with_values)
+        next_seen = seen or required_flag in token_flags
+        if option_name in known_flags or "=" in argument or _last_short_option_is_known_flag(argument, known_flags):
+            return present(argument_index + 1, next_seen)
+        return present(argument_index + 1, next_seen) and present(argument_index + 2, seen)
+
+    return present(0, False)
+
+
+def _is_option(argument: str) -> bool:
+    return len(argument) > 1 and argument.startswith("-")
+
+
+def _attached_short_value_option(argument: str, options_with_values: frozenset[str]) -> str | None:
+    if len(argument) <= 2 or not argument.startswith("-") or argument.startswith("--"):
+        return None
+    option = argument[:2]
+    return option if option in options_with_values else None
+
+
+def _last_short_option_is_known_flag(argument: str, known_flags: frozenset[str]) -> bool:
+    return len(argument) > 2 and not argument.startswith("--") and f"-{argument[-1]}" in known_flags
+
+
+def _flags_in_option_token(argument: str, options_with_values: frozenset[str]) -> frozenset[str]:
+    flags = {argument}
+    if "=" in argument:
+        flags.add(argument.split("=", 1)[0])
+    if argument.startswith("-") and not argument.startswith("--") and len(argument) > 2:
+        for character in argument[1:]:
+            if not character.isalnum():
+                continue
+            short_flag = f"-{character}"
+            flags.add(short_flag)
+            if short_flag in options_with_values:
+                break
+    return frozenset(flags)

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_rules.py

@@ -7,6 +7,7 @@ from typing import Literal, final
 
 from .command_matcher_contracts import CommandMatcher, MatcherEvidence
 from .command_model import CanonicalCommand, CommandSegment
+from .command_option_parsing import flags_present_in_all_option_parses, matches_subcommands_conservatively
 
 CommandRuleSeverity = Literal["critical", "high", "medium", "low"]
 CommandRuleMode = Literal["required", "enforce", "review", "monitor", "disabled"]
@@ -14,6 +15,7 @@ CommandRuleMode = Literal["required", "enforce", "review", "monitor", "disabled"
 _VALID_SEVERITIES = frozenset({"critical", "high", "medium", "low"})
 _VALID_MODES = frozenset({"required", "enforce", "review", "monitor", "disabled"})
 _EMPTY_STRING_SET: frozenset[str] = frozenset()
+_TRUTHY_FLAG_VALUES = frozenset({"1", "on", "true", "yes"})
 
 
 @final
@@ -31,6 +33,7 @@ class ExecutableMatcher:
     interspersed_flags: frozenset[str] = frozenset()
     options_with_values: frozenset[str] = frozenset()
     required_flags_in_all_arguments: bool = False
+    fail_secure_unknown_options: bool = False
 
     def __post_init__(self) -> None:
         normalized = frozenset(value.strip().lower() for value in self.executables if value.strip())
@@ -76,7 +79,23 @@ class ExecutableMatcher:
                     subcommand_arguments,
                     self.leading_options_with_values,
                 )
-            if self.subcommands and subcommand_arguments[: len(self.subcommands)] != self.subcommands:
+            if (
+                self.subcommands
+                and subcommand_arguments[: len(self.subcommands)] != self.subcommands
+                and (
+                    not self.fail_secure_unknown_options
+                    or not matches_subcommands_conservatively(
+                        lowered_arguments,
+                        self.subcommands,
+                        options_with_values=(
+                            self.options_with_values
+                            | self.leading_options_with_values
+                            | self.interspersed_options_with_values
+                        ),
+                        known_flags=self.interspersed_flags,
+                    )
+                )
+            ):
                 continue
             if self.required_flags_in_all_arguments:
                 flag_arguments = lowered_arguments
@@ -90,7 +109,19 @@ class ExecutableMatcher:
                     self.options_with_values | self.leading_options_with_values | self.interspersed_options_with_values
                 ),
             )
-            if not self.required_flags <= present_flags or self.forbidden_flags & present_flags:
+            required_flags_present = self.required_flags <= present_flags
+            if self.fail_secure_unknown_options and self.required_flags_in_all_arguments:
+                required_flags_present = flags_present_in_all_option_parses(
+                    lowered_arguments,
+                    self.required_flags,
+                    options_with_values=(
+                        self.options_with_values
+                        | self.leading_options_with_values
+                        | self.interspersed_options_with_values
+                    ),
+                    known_flags=self.interspersed_flags | self.required_flags | self.forbidden_flags,
+                )
+            if not required_flags_present or self.forbidden_flags & present_flags:
                 continue
             evidence.append(
                 MatcherEvidence(
@@ -366,24 +397,41 @@ def _present_flags(
     options_with_values: frozenset[str] = _EMPTY_STRING_SET,
 ) -> frozenset[str]:
     flags: set[str] = set()
+    # Safe variants honor the final long-option assignment, matching common CLI parsers.
+    effective_long_options: dict[str, tuple[str, str | None, bool]] = {}
     index = 0
     while index < len(arguments):
         argument = arguments[index]
         if argument == "--":
             break
-        flags.add(argument)
-        if argument.startswith("-") and "=" in argument:
-            flags.add(argument.split("=", 1)[0])
-        if argument.startswith("-") and not argument.startswith("--") and len(argument) > 2:
-            for character in argument[1:]:
+        option_name, separator, option_value = argument.partition("=")
+        is_long_option = argument.startswith("--")
+        is_value_option = option_name in options_with_values
+        if is_long_option:
+            if is_value_option and not separator:
+                option_value = arguments[index + 1] if index + 1 < len(arguments) else ""
+            effective_long_options[option_name] = (
+                argument,
+                option_value if separator or is_value_option else None,
+                is_value_option,
+            )
+        else:
+            flags.add(argument)
+            if argument.startswith("-") and separator:
+                flags.add(option_name)
+        if option_name.startswith("-") and not option_name.startswith("--") and len(option_name) > 2:
+            for character in option_name[1:]:
                 if not character.isalnum():
                     continue
                 short_flag = f"-{character}"
                 flags.add(short_flag)
                 if short_flag in options_with_values:
                     break
-        option_name = argument.split("=", 1)[0]
         index += 2 if option_name in options_with_values and "=" not in argument else 1
+    for option_name, (argument, option_value, is_value_option) in effective_long_options.items():
+        flags.add(argument)
+        if is_value_option or option_value is None or option_value in _TRUTHY_FLAG_VALUES:
+            flags.add(option_name)
     return frozenset(flags)
 
 

{plugin_scanner-2.0.1102 → plugin_scanner-2.0.1104}/src/codex_plugin_scanner/guard/runtime/command_search_messaging_extensions.py

@@ -68,17 +68,20 @@ class CurlElasticsearchDeleteMatcher:
         return tuple(evidence)
 
     def _matches_target(self, target: str) -> bool:
-        lowered = target.lower()
+        normalized = target.strip("'\"")
+        lowered = normalized.lower()
         if lowered.startswith(("$elasticsearch_", "${elasticsearch_")):
             return "/" in lowered
         try:
-            parsed = urlsplit(target)
+            explicit_scheme = "://" in normalized
+            parsed = urlsplit(normalized if explicit_scheme else f"//{normalized}")
             port = parsed.port
         except ValueError:
             return False
         hostname = parsed.hostname or ""
         recognizable_host = port in self.service_ports or "elasticsearch" in hostname.split(".")
-        return parsed.scheme in {"http", "https"} and recognizable_host and parsed.path not in {"", "/"}
+        supported_scheme = parsed.scheme in {"http", "https"} if explicit_scheme else not parsed.scheme
+        return supported_scheme and recognizable_host and parsed.path not in {"", "/"}
 
 
 def _curl_method_and_targets(arguments: tuple[str, ...]) -> tuple[str | None, tuple[str, ...]]:
@@ -98,11 +101,19 @@ def _curl_method_and_targets(arguments: tuple[str, ...]) -> tuple[str | None, tu
             method = arguments[index + 1].lower()
             index += 2
             continue
+        if lowered == "--url" and index + 1 < len(arguments):
+            targets.append(arguments[index + 1].strip("'\""))
+            index += 2
+            continue
+        if lowered.startswith("--url="):
+            targets.append(argument.split("=", 1)[1].strip("'\""))
+            index += 1
+            continue
         if lowered.startswith("--request="):
             method = lowered.split("=", 1)[1]
         elif argument.startswith("-X") and len(argument) > 2:
             method = argument[2:].lower()
-        if argument.startswith(("http://", "https://", "$")):
+        if not argument.startswith("-"):
             targets.append(argument.strip("'\""))
         index += 1
     return method, tuple(targets)