plugin-scanner 2.0.698__tar.gz → 2.0.700__tar.gz

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.698
+Version: 2.0.700
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/dashboard/src/evidence/evidence-insights-share-modal.tsx

@@ -10,6 +10,10 @@ import {
   type GuardInsightsShareResult,
 } from "../guard-api";
 import { ConnectFlowCard } from "../supply-chain-firewall-views";
+import {
+  openPackageFirewallAuthorizeWindow,
+  PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
+} from "../package-firewall-connect-browser";
 import { EvidenceInsightsShareSheet } from "./evidence-insights-share-sheet";
 import { GuardStatMetric } from "./guard-stat-metric";
 import { HomeInsightsMetrics } from "./evidence-insights-headline-bento";
@@ -92,6 +96,12 @@ export function EvidenceInsightsShareModal({
     try {
       const status = await startGuardCloudConnect();
       setConnectFlow(status.connect_flow);
+      if (
+        status.connect_flow?.authorize_url &&
+        !openPackageFirewallAuthorizeWindow(status.connect_flow.authorize_url)
+      ) {
+        setConnectError(PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE);
+      }
       if (!status.connect_required) {
         await refreshConnectState();
       }

plugin_scanner-2.0.700/dashboard/src/package-firewall-connect-browser.test.ts

@@ -0,0 +1,51 @@
+import {
+  openPackageFirewallAuthorizeWindow,
+  PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
+} from "./package-firewall-connect-browser";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const openedUrls: string[] = [];
+
+Object.assign(globalThis, {
+  window: {
+    open: (url: string) => {
+      openedUrls.push(url);
+      return {};
+    },
+  },
+});
+
+assert(
+  openPackageFirewallAuthorizeWindow("https://hol.org/api/guard/oauth/authorize?client_id=test"),
+  "expected authorize window to open",
+);
+assert(openedUrls.length === 1, "expected one window.open call");
+assert(
+  openedUrls[0] === "https://hol.org/api/guard/oauth/authorize?client_id=test",
+  "expected authorize URL to be passed to window.open",
+);
+
+openedUrls.length = 0;
+assert(!openPackageFirewallAuthorizeWindow(null), "null authorize URL should not open");
+assert(openedUrls.length === 0, "null authorize URL should not call window.open");
+
+Object.assign(globalThis, {
+  window: {
+    open: () => null,
+  },
+});
+assert(
+  !openPackageFirewallAuthorizeWindow("https://hol.org/api/guard/oauth/authorize?client_id=test"),
+  "popup blocked should return false",
+);
+assert(
+  PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE.includes("manual sign-in link"),
+  "popup blocked message should mention manual sign-in link",
+);
+
+console.log("package-firewall-connect-browser.test.ts: all assertions passed");

plugin_scanner-2.0.700/dashboard/src/package-firewall-connect-browser.ts

@@ -0,0 +1,16 @@
+export const PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE =
+  "Your browser blocked the Guard Cloud sign-in window. Use the manual sign-in link below.";
+
+export function openPackageFirewallAuthorizeWindow(
+  authorizeUrl: string | null | undefined,
+): boolean {
+  if (!authorizeUrl || typeof window === "undefined") {
+    return false;
+  }
+  const popup = window.open(authorizeUrl, "_blank");
+  if (popup) {
+    popup.opener = null;
+    return true;
+  }
+  return false;
+}

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -23,6 +23,10 @@ import {
   readHarnessActionUserMessage,
   resolveApprovalGateSyncFailure,
 } from "./harness-action-errors";
+import {
+  openPackageFirewallAuthorizeWindow,
+  PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
+} from "./package-firewall-connect-browser";
 import { EntitlementNotice, ConnectFlowCard } from "./supply-chain-firewall-views";
 import type { CompletedOp } from "./supply-chain-firewall-views";
 import {
@@ -433,7 +437,13 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     setConnectError(null);
     setActivationAssistError(null);
     try {
-      await startPackageFirewallConnect();
+      const connectFlow = await startPackageFirewallConnect();
+      if (
+        connectFlow?.authorize_url &&
+        !openPackageFirewallAuthorizeWindow(connectFlow.authorize_url)
+      ) {
+        setConnectError(PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE);
+      }
       await refreshAfterOp();
       await onStateChanged?.();
     } catch (error) {

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.698"
+version = "2.0.700"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.698"
+version = "2.0.700"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/src/codex_plugin_scanner/guard/adapters/cursor_hooks.py

@@ -20,7 +20,7 @@ _BLOCKING_MANAGED_HOOK_EVENTS = (
     "beforeMCPExecution",
     "beforeReadFile",
 )
-_OBSERVER_MANAGED_HOOK_EVENTS = ("afterShellExecution",)
+_OBSERVER_MANAGED_HOOK_EVENTS = ("afterShellExecution", "afterMCPExecution")
 _MANAGED_HOOK_EVENTS = _BLOCKING_MANAGED_HOOK_EVENTS + _OBSERVER_MANAGED_HOOK_EVENTS
 _MANAGED_HOOK_TIMEOUT_SECONDS = 45
 _LEGACY_MANAGED_COMMAND_MARKERS = (
@@ -48,6 +48,10 @@ def _infer_cursor_hook_event_name(payload: Mapping[str, object]) -> dict[str, ob
     return normalized
 
 
+# Payload normalizers below are mirrored inside _HOOK_SCRIPT_TEMPLATE for the installed
+# Cursor hook script. Keep both copies in sync when changing observer or MCP behavior.
+
+
 def _cursor_shell_hook_payload(normalized: dict[str, object], *, hook_event_name: str) -> dict[str, object]:
     payload = dict(normalized)
     payload["hook_event_name"] = hook_event_name
@@ -63,6 +67,19 @@ def _cursor_shell_hook_payload(normalized: dict[str, object], *, hook_event_name
     return payload
 
 
+def _cursor_mcp_hook_payload(normalized: dict[str, object], *, hook_event_name: str) -> dict[str, object]:
+    payload = dict(normalized)
+    payload["hook_event_name"] = hook_event_name
+    tool_input = _tool_input_dict(payload.get("tool_input"))
+    payload["tool_input"] = tool_input
+    tool_name = payload.get("tool_name")
+    if isinstance(tool_name, str) and tool_name.strip():
+        payload["tool_name"] = tool_name.strip()
+    else:
+        payload.setdefault("tool_name", "MCP")
+    return payload
+
+
 def prepare_cursor_hook_payload(payload: Mapping[str, object]) -> dict[str, object]:
     """Map Cursor hook stdin JSON into Guard hook normalization shape."""
 
@@ -70,22 +87,22 @@ def prepare_cursor_hook_payload(payload: Mapping[str, object]) -> dict[str, obje
     raw_event = _raw_hook_event_name(normalized)
     if raw_event == "aftershellexecution":
         return _cursor_shell_hook_payload(normalized, hook_event_name="afterShellExecution")
+    if raw_event == "aftermcpexecution":
+        return _cursor_mcp_hook_payload(normalized, hook_event_name="afterMCPExecution")
     if raw_event == "beforeshellexecution":
-        return _cursor_shell_hook_payload(normalized, hook_event_name="PreToolUse")
+        prepared = _cursor_shell_hook_payload(normalized, hook_event_name="PreToolUse")
+        prepared["cursor_source_hook_event"] = "beforeShellExecution"
+        return prepared
     if raw_event == "beforemcpexecution":
-        normalized["hook_event_name"] = "PreToolUse"
-        tool_name = normalized.get("tool_name")
-        if isinstance(tool_name, str) and tool_name.strip():
-            normalized["tool_name"] = tool_name.strip()
-        else:
-            normalized.setdefault("tool_name", "MCP")
-        tool_input = _tool_input_dict(normalized.get("tool_input"))
+        prepared = _cursor_mcp_hook_payload(normalized, hook_event_name="PreToolUse")
+        tool_input = _tool_input_dict(prepared.get("tool_input"))
         for key in ("url", "command"):
             value = normalized.get(key)
             if isinstance(value, str) and value.strip():
                 tool_input.setdefault(key, value.strip())
-        normalized["tool_input"] = tool_input
-        return normalized
+        prepared["tool_input"] = tool_input
+        prepared["cursor_source_hook_event"] = "beforeMCPExecution"
+        return prepared
     if raw_event == "beforereadfile":
         normalized["hook_event_name"] = "PreToolUse"
         normalized.setdefault("tool_name", "Read")
@@ -133,6 +150,23 @@ def cursor_hook_would_prompt_user(
     )
 
 
+def cursor_hook_requires_approval_center_queue(
+    *,
+    policy_action: str,
+    guard_payload: Mapping[str, object] | None = None,
+) -> bool:
+    """Return True when Cursor native prompts should also appear in the approval center.
+
+    Currently equivalent to ``cursor_hook_would_prompt_user``; kept separate so the
+    two concepts can diverge without touching call sites.
+    """
+
+    return cursor_hook_would_prompt_user(
+        policy_action=policy_action,
+        guard_payload=guard_payload,
+    )
+
+
 def cursor_hook_response_from_guard(
     *,
     policy_action: str,
@@ -620,27 +654,40 @@ def _cursor_shell_hook_payload(normalized: dict[str, object], hook_event_name: s
     return payload
 
 
+def _cursor_mcp_hook_payload(normalized: dict[str, object], hook_event_name: str) -> dict[str, object]:
+    payload = dict(normalized)
+    payload["hook_event_name"] = hook_event_name
+    tool_input = _tool_input_dict(payload.get("tool_input"))
+    payload["tool_input"] = tool_input
+    tool_name = payload.get("tool_name")
+    if isinstance(tool_name, str) and tool_name.strip():
+        payload["tool_name"] = tool_name.strip()
+    else:
+        payload.setdefault("tool_name", "MCP")
+    return payload
+
+
 def _prepare_cursor_hook_payload(payload: dict[str, object]) -> dict[str, object]:
     normalized = _infer_cursor_hook_event_name(payload)
     raw_event = _raw_hook_event_name(normalized)
     if raw_event == "aftershellexecution":
         return _cursor_shell_hook_payload(normalized, "afterShellExecution")
+    if raw_event == "aftermcpexecution":
+        return _cursor_mcp_hook_payload(normalized, "afterMCPExecution")
     if raw_event == "beforeshellexecution":
-        return _cursor_shell_hook_payload(normalized, "PreToolUse")
+        prepared = _cursor_shell_hook_payload(normalized, "PreToolUse")
+        prepared["cursor_source_hook_event"] = "beforeShellExecution"
+        return prepared
     if raw_event == "beforemcpexecution":
-        normalized["hook_event_name"] = "PreToolUse"
-        tool_name = normalized.get("tool_name")
-        if isinstance(tool_name, str) and tool_name.strip():
-            normalized["tool_name"] = tool_name.strip()
-        else:
-            normalized.setdefault("tool_name", "MCP")
-        tool_input = _tool_input_dict(normalized.get("tool_input"))
+        prepared = _cursor_mcp_hook_payload(normalized, "PreToolUse")
+        tool_input = _tool_input_dict(prepared.get("tool_input"))
         for key in ("url", "command"):
             value = normalized.get(key)
             if isinstance(value, str) and value.strip():
                 tool_input.setdefault(key, value.strip())
-        normalized["tool_input"] = tool_input
-        return normalized
+        prepared["tool_input"] = tool_input
+        prepared["cursor_source_hook_event"] = "beforeMCPExecution"
+        return prepared
     if raw_event == "beforereadfile":
         normalized["hook_event_name"] = "PreToolUse"
         normalized.setdefault("tool_name", "Read")
@@ -807,15 +854,21 @@ def _normalize_cursor_shell_command(command: str) -> str:
 
 
 def _cursor_shell_command(payload: Mapping[str, object]) -> str | None:
-    command = payload.get("command")
-    if isinstance(command, str) and command.strip():
-        return _normalize_cursor_shell_command(command)
     tool_input = payload.get("tool_input")
+    nested_command: str | None = None
     if isinstance(tool_input, dict):
         nested = tool_input.get("command")
         if isinstance(nested, str) and nested.strip():
-            return _normalize_cursor_shell_command(nested)
-    return None
+            nested_command = _normalize_cursor_shell_command(nested)
+    command = payload.get("command")
+    if isinstance(command, str) and command.strip():
+        top_level = _normalize_cursor_shell_command(command)
+        if nested_command is not None:
+            first_token = command.strip().split(maxsplit=1)[0]
+            if Path(first_token).name.lower() == "lean-ctx":
+                return nested_command
+        return top_level
+    return nested_command
 
 
 def _cursor_shell_binding_path(conversation_id: str, command: str) -> Path:
@@ -858,8 +911,9 @@ def _load_cursor_hook_attestation_secret() -> bytes | None:
     return secret or None
 
 
-def _compute_cursor_after_shell_proof(
+def _compute_cursor_after_observer_proof(
     payload: Mapping[str, object],
+    observer_event: str,
     approval_binding: str | None = None,
 ) -> str | None:
     conversation_id = _cursor_conversation_id(payload)
@@ -869,7 +923,7 @@ def _compute_cursor_after_shell_proof(
     if conversation_id is None or command is None or resolved_binding is None or secret is None:
         return None
     message = chr(0).join(
-        (conversation_id, command, resolved_binding, "afterShellExecution")
+        (conversation_id, command, resolved_binding, observer_event.strip())
     ).encode("utf-8")
     return hmac.new(secret, message, hashlib.sha256).hexdigest()
 
@@ -901,9 +955,9 @@ def main() -> int:
             guard_argv.extend(["--workspace", workspace])
     guard_env = _hook_process_env()
     guard_env["HOL_GUARD_MANAGED_CURSOR_HOOK"] = "1"
-    if hook_event_name.strip().lower() == "aftershellexecution":
+    if hook_event_name.strip().lower() in {"aftershellexecution", "aftermcpexecution"}:
         approval_binding = _resolve_approval_binding(prepared)
-        proof = _compute_cursor_after_shell_proof(prepared, approval_binding)
+        proof = _compute_cursor_after_observer_proof(prepared, hook_event_name, approval_binding)
         if approval_binding:
             guard_env["HOL_GUARD_CURSOR_APPROVAL_BINDING"] = approval_binding
         if proof:
@@ -950,7 +1004,7 @@ def main() -> int:
         except json.JSONDecodeError:
             guard_payload = {}
     policy_action = str(guard_payload.get("policy_action") or "allow")
-    if hook_event_name.strip().lower() == "aftershellexecution":
+    if hook_event_name.strip().lower() in {"aftershellexecution", "aftermcpexecution"}:
         print("{}")
         return 0
     if proc.returncode != 0 and not guard_payload:

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/src/codex_plugin_scanner/guard/adapters/cursor_native_approval.py

@@ -1,4 +1,4 @@
-"""Cursor native shell approval attestation for afterShell observer hooks."""
+"""Cursor native approval attestation for afterShell and afterMCP observer hooks."""
 
 from __future__ import annotations
 
@@ -17,6 +17,11 @@ _MANAGED_HOOK_ENV = "HOL_GUARD_MANAGED_CURSOR_HOOK"
 _AFTER_SHELL_PROOF_ENV = "HOL_GUARD_CURSOR_AFTER_SHELL_PROOF"
 _APPROVAL_BINDING_ENV = "HOL_GUARD_CURSOR_APPROVAL_BINDING"
 _AFTER_SHELL_PROOF_EVENT = "afterShellExecution"
+_AFTER_MCP_PROOF_EVENT = "afterMCPExecution"
+_CURSOR_BLOCKING_OBSERVER_EVENTS = {
+    "beforeShellExecution": _AFTER_SHELL_PROOF_EVENT,
+    "beforeMCPExecution": _AFTER_MCP_PROOF_EVENT,
+}
 _MAX_CURSOR_SHELL_NORMALIZE_BYTES = 8192
 _LEAN_CTX_COMMAND_MARKER = "lean-ctx"
 
@@ -106,11 +111,37 @@ def _cursor_shell_binding_segment(conversation_id: str) -> str:
     return cleaned
 
 
-def cursor_after_shell_proof_message(
+def is_lean_ctx_wrapper_command(command: str) -> bool:
+    stripped = command.strip()
+    if not stripped:
+        return False
+    first_token = stripped.split(maxsplit=1)[0]
+    return Path(first_token).name.lower() == _LEAN_CTX_COMMAND_MARKER
+
+
+def cursor_observer_event_for_blocking(blocking_event: str) -> str | None:
+    return _CURSOR_BLOCKING_OBSERVER_EVENTS.get(blocking_event.strip())
+
+
+def cursor_observer_event_for_payload(payload: Mapping[str, object]) -> str:
+    for key in ("hook_event_name", "hookEventName", "cursor_source_hook_event"):
+        value = payload.get(key)
+        if isinstance(value, str) and value.strip():
+            normalized = value.strip()
+            if normalized in {_AFTER_SHELL_PROOF_EVENT, _AFTER_MCP_PROOF_EVENT}:
+                return normalized
+            mapped = cursor_observer_event_for_blocking(normalized)
+            if mapped is not None:
+                return mapped
+    return _AFTER_SHELL_PROOF_EVENT
+
+
+def cursor_after_observer_proof_message(
     *,
     conversation_id: str,
     command: str,
     approval_binding: str,
+    observer_event: str,
 ) -> bytes:
     return (
         chr(0)
@@ -119,13 +150,27 @@ def cursor_after_shell_proof_message(
                 conversation_id.strip(),
                 command.strip(),
                 approval_binding.strip(),
-                _AFTER_SHELL_PROOF_EVENT,
+                observer_event.strip(),
             )
         )
         .encode("utf-8")
     )
 
 
+def cursor_after_shell_proof_message(
+    *,
+    conversation_id: str,
+    command: str,
+    approval_binding: str,
+) -> bytes:
+    return cursor_after_observer_proof_message(
+        conversation_id=conversation_id,
+        command=command,
+        approval_binding=approval_binding,
+        observer_event=_AFTER_SHELL_PROOF_EVENT,
+    )
+
+
 def cursor_hook_attestation_secret_path(guard_home: Path) -> Path:
     return guard_home / _CURSOR_HOOK_ATTESTATION_RELATIVE
 
@@ -246,42 +291,80 @@ def ensure_cursor_approval_binding(payload: Mapping[str, object]) -> str:
     return f"hol-guard:{secrets.token_urlsafe(24)}"
 
 
-def compute_cursor_after_shell_proof(
+def compute_cursor_after_observer_proof(
     *,
     secret: bytes,
     conversation_id: str,
     command: str,
     approval_binding: str,
+    observer_event: str,
 ) -> str:
     normalized_command = normalize_cursor_shell_command(command)
-    message = cursor_after_shell_proof_message(
+    message = cursor_after_observer_proof_message(
         conversation_id=conversation_id,
         command=normalized_command,
         approval_binding=approval_binding,
+        observer_event=observer_event,
     )
     digest = hmac.new(secret, message, hashlib.sha256).hexdigest()
     return digest
 
 
-def verify_cursor_after_shell_proof(
+def compute_cursor_after_shell_proof(
+    *,
+    secret: bytes,
+    conversation_id: str,
+    command: str,
+    approval_binding: str,
+) -> str:
+    return compute_cursor_after_observer_proof(
+        secret=secret,
+        conversation_id=conversation_id,
+        command=command,
+        approval_binding=approval_binding,
+        observer_event=_AFTER_SHELL_PROOF_EVENT,
+    )
+
+
+def verify_cursor_after_observer_proof(
     *,
     secret: bytes,
     conversation_id: str,
     command: str,
     approval_binding: str,
     proof: str,
+    observer_event: str,
 ) -> bool:
     if not proof.strip():
         return False
-    expected = compute_cursor_after_shell_proof(
+    expected = compute_cursor_after_observer_proof(
         secret=secret,
         conversation_id=conversation_id,
         command=command,
         approval_binding=approval_binding,
+        observer_event=observer_event,
     )
     return hmac.compare_digest(expected, proof.strip())
 
 
+def verify_cursor_after_shell_proof(
+    *,
+    secret: bytes,
+    conversation_id: str,
+    command: str,
+    approval_binding: str,
+    proof: str,
+) -> bool:
+    return verify_cursor_after_observer_proof(
+        secret=secret,
+        conversation_id=conversation_id,
+        command=command,
+        approval_binding=approval_binding,
+        proof=proof,
+        observer_event=_AFTER_SHELL_PROOF_EVENT,
+    )
+
+
 def managed_cursor_hook_invocation(env: Mapping[str, str] | None = None) -> bool:
     source = os.environ if env is None else env
     return source.get(_MANAGED_HOOK_ENV) == "1"
@@ -292,7 +375,7 @@ def after_shell_proof_from_env(env: Mapping[str, str] | None = None) -> str | No
     return _optional_string(source.get(_AFTER_SHELL_PROOF_ENV))
 
 
-def cursor_after_shell_trusted(
+def cursor_after_observer_trusted(
     *,
     guard_home: Path,
     pending: Mapping[str, object],
@@ -323,34 +406,62 @@ def cursor_after_shell_trusted(
         return False
     if not hmac.compare_digest(expected_proof.strip(), proof.strip()):
         return False
+    observer_event = _optional_string(pending.get("observer_event")) or cursor_observer_event_for_payload(payload)
     try:
         secret = ensure_cursor_hook_attestation_secret(guard_home)
     except OSError:
         return False
-    return verify_cursor_after_shell_proof(
+    return verify_cursor_after_observer_proof(
         secret=secret,
         conversation_id=conversation_id,
         command=normalize_cursor_shell_command(command),
         approval_binding=payload_binding,
         proof=proof,
+        observer_event=observer_event,
+    )
+
+
+def cursor_after_shell_trusted(
+    *,
+    guard_home: Path,
+    pending: Mapping[str, object],
+    payload: Mapping[str, object],
+    conversation_id: str,
+    command: str,
+    env: Mapping[str, str] | None = None,
+) -> bool:
+    return cursor_after_observer_trusted(
+        guard_home=guard_home,
+        pending=pending,
+        payload=payload,
+        conversation_id=conversation_id,
+        command=command,
+        env=env,
     )
 
 
 __all__ = [
     "after_shell_proof_from_env",
+    "compute_cursor_after_observer_proof",
     "compute_cursor_after_shell_proof",
+    "cursor_after_observer_proof_message",
+    "cursor_after_observer_trusted",
     "cursor_after_shell_proof_message",
     "cursor_after_shell_trusted",
     "cursor_generation_id",
     "cursor_hook_attestation_secret_path",
+    "cursor_observer_event_for_blocking",
+    "cursor_observer_event_for_payload",
     "cursor_shell_binding_path",
     "ensure_cursor_approval_binding",
     "ensure_cursor_hook_attestation_secret",
+    "is_lean_ctx_wrapper_command",
     "managed_cursor_hook_invocation",
     "normalize_cursor_shell_command",
     "read_cursor_shell_binding_file",
     "remove_cursor_shell_binding_file",
     "resolve_cursor_approval_binding",
+    "verify_cursor_after_observer_proof",
     "verify_cursor_after_shell_proof",
     "write_cursor_shell_binding_file",
 ]

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/src/codex_plugin_scanner/guard/cli/commands_hook.py

@@ -61,7 +61,7 @@ def _run_guard_hook_command(
                 runtime_workspace = current_workspace
     if (
         _canonical_harness_name(args.harness) == "cursor"
-        and _hook_event_name(payload) == "afterShellExecution"
+        and _hook_event_name(payload) in {"afterShellExecution", "afterMCPExecution"}
     ):
         if runtime_workspace is None:
             runtime_workspace = _workspace_from_cursor_project_dir()

{plugin_scanner-2.0.698 → plugin_scanner-2.0.700}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py

@@ -37,7 +37,16 @@ def _review_runtime_artifact_hook(
     runtime_artifact_hash = state.runtime_artifact_hash
     scanner_evidence_payload = state.scanner_evidence_payload
     stored_policy_action = state.stored_policy_action
-    if policy_action in {"block", "sandbox-required", "require-reapproval"}:
+    from ..adapters.cursor_hooks import cursor_hook_requires_approval_center_queue
+
+    cursor_native_queue = (
+        _canonical_harness_name(args.harness) == "cursor"
+        and cursor_hook_requires_approval_center_queue(
+            policy_action=policy_action,
+            guard_payload=response_payload,
+        )
+    )
+    if policy_action in {"block", "sandbox-required", "require-reapproval"} or cursor_native_queue:
         native_reason = _runtime_artifact_native_reason(runtime_artifact, response_payload)
         additional_context = _claude_prompt_additional_context(
             harness=args.harness,
@@ -115,13 +124,18 @@ def _review_runtime_artifact_hook(
             approval_flow = get_adapter(args.harness).approval_flow(managed_install=managed_install)
             approval_center_url = ensure_guard_daemon(guard_home)
             runtime_detection = _runtime_detection(args.harness, runtime_artifact)
+            queued_policy_action = (
+                "require-reapproval"
+                if cursor_native_queue and policy_action in {"warn", "review"}
+                else policy_action
+            )
             evaluation_payload = {
                 "artifacts": [
                     {
                         "artifact_id": artifact_id,
                         "artifact_name": artifact_name,
                         "artifact_hash": runtime_artifact_hash,
-                        "policy_action": policy_action,
+                        "policy_action": queued_policy_action,
                         "changed_fields": changed_capabilities,
                         "artifact_type": runtime_artifact.artifact_type,
                         "source_scope": runtime_artifact.source_scope,
@@ -210,6 +224,10 @@ def _review_runtime_artifact_hook(
                 _canonical_harness_name(args.harness) == "cursor"
                 and event_name == "PreToolUse"
                 and runtime_artifact.artifact_type == "tool_action_request"
+                and cursor_hook_requires_approval_center_queue(
+                    policy_action=policy_action,
+                    guard_payload=response_payload,
+                )
             ):
                 from ..adapters.cursor_hooks import cursor_hook_would_prompt_user