plugin-scanner 2.0.863__tar.gz → 2.0.865__tar.gz

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.863
+Version: 2.0.865
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.863"
+version = "2.0.865"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.863"
+version = "2.0.865"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/approvals.py

@@ -40,7 +40,12 @@ from .models import (
     PolicyDecision,
 )
 from .risk import artifact_risk_signals, artifact_risk_summary
-from .store import GuardStore, _runtime_scoped_exact_match_key, runtime_tool_action_exact_match_context
+from .store import (
+    GuardStore,
+    _runtime_scoped_exact_match_key,
+    browser_mcp_exact_match_context,
+    runtime_tool_action_exact_match_context,
+)
 
 GUARD_COMMAND = "hol-guard"
 GUARD_DASHBOARD_URL = "https://hol.org/guard"
@@ -357,6 +362,9 @@ def apply_approval_resolution(
     broad_runtime_exact_match_key = _broad_runtime_exact_match_key(request, scope)
     if broad_runtime_exact_match_key is not None:
         scoped_artifact_hash = broad_runtime_exact_match_key
+    browser_mcp_exact_key = _browser_mcp_exact_match_key(request, scope)
+    if browser_mcp_exact_key is not None:
+        scoped_artifact_hash = browser_mcp_exact_key
     decision = PolicyDecision(
         harness="*" if scope == "global" else str(request["harness"]),
         scope=scope,
@@ -546,6 +554,42 @@ def _broad_runtime_exact_match_key(request: Mapping[str, object], scope: str) ->
     return _runtime_scoped_exact_match_key(artifact_id)
 
 
+def _extract_surface_flags(browser_intent: Mapping[str, object]) -> list[str] | None:
+    raw = browser_intent.get("sensitive_surface_flags")
+    if isinstance(raw, (list, tuple)):
+        return [str(f) for f in raw]
+    return None
+
+
+def _browser_mcp_exact_match_key(request: Mapping[str, object], scope: str) -> str | None:
+    """Build a browser MCP exact-match key for tool_call artifacts with browser intent.
+
+    Only activates for artifact_type == 'tool_call' when browser intent
+    metadata is present. Returns a runtime-exact key scoped to the browser
+    identity (intent, origin, path, profile, sensitive surfaces).
+    """
+    if scope != "artifact" or request.get("artifact_type") != "tool_call":
+        return None
+    browser_intent = request.get("browser_intent")
+    if not isinstance(browser_intent, Mapping):
+        return None
+    artifact_id = request.get("artifact_id")
+    if not isinstance(artifact_id, str) or not artifact_id:
+        return None
+    context = browser_mcp_exact_match_context(
+        intent=_string_or_none(browser_intent.get("intent")),
+        operation=_string_or_none(browser_intent.get("operation")),
+        target_origin=_string_or_none(browser_intent.get("target_origin")),
+        target_path_prefix=_string_or_none(browser_intent.get("target_path_prefix")),
+        profile_mode=_string_or_none(browser_intent.get("profile_mode")),
+        mcp_server_identity_hash=_string_or_none(browser_intent.get("mcp_server_identity_hash")),
+        mcp_tool_identity_hash=_string_or_none(browser_intent.get("mcp_tool_identity_hash")),
+        mcp_schema_hash=_string_or_none(browser_intent.get("mcp_schema_hash")),
+        sensitive_surface_flags=_extract_surface_flags(browser_intent),
+    )
+    return _runtime_scoped_exact_match_key(artifact_id, context) if context else None
+
+
 def _append_guard_token_to_url(url: str, auth_token: str) -> str:
     """Append a fresh guard-token fragment to an approval URL."""
     parsed = urlparse(url)

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py

@@ -434,6 +434,7 @@ def _normalize_hook_payload(
         ("changedCapabilities", "changed_capabilities"),
         ("hookEventName", "hook_event_name"),
         ("hookName", "hook_name"),
+        ("preExecutionResult", "pre_execution_result"),
         ("policyAction", "policy_action"),
         ("sourceScope", "source_scope"),
         ("toolName", "tool_name"),

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py

@@ -464,10 +464,11 @@ def _post_tool_package_request_was_already_evaluated(
     event_name = _hook_event_name(dict(payload))
     if event_name != "PostToolUse":
         return False
-    pre_execution_result = _coalesce_string(
-        payload.get("pre_execution_result"),
-        action_envelope.pre_execution_result if action_envelope is not None else None,
-    )
+    pre_execution_result = _optional_string(payload.get("pre_execution_result"))
+    if pre_execution_result is None:
+        pre_execution_result = _optional_string(payload.get("preExecutionResult"))
+    if pre_execution_result is None and action_envelope is not None:
+        pre_execution_result = _optional_string(action_envelope.pre_execution_result)
     return pre_execution_result is not None
 
 

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/mcp_tool_calls.py

@@ -13,6 +13,7 @@ from .approval_gate import ApprovalGateGrant
 from .config import DEFAULT_SECURITY_LEVEL, GuardConfig, resolve_risk_action
 from .models import GUARD_ACTION_VALUES, GuardAction, GuardArtifact, GuardReceipt, PolicyDecision
 from .receipts import build_receipt
+from .runtime.browser_mcp_intent import normalize_browser_mcp_intent
 from .runtime.mcp_protection import (
     McpServerIdentity,
     build_mcp_tool_identity,
@@ -177,7 +178,8 @@ def _configured_risk_action(config: GuardConfig, risk_class: str, *, harness: st
 
 
 def tool_call_risk_signals(artifact: GuardArtifact, arguments: object) -> tuple[str, ...]:
-    signals_by_category = {
+    browser_intent = normalize_browser_mcp_intent(artifact, arguments)
+    signals_by_category: dict[str, str] = {
         "filesystem_access": "call shape implies filesystem path access",
         "destructive_mutation": "tool name implies destructive file or system changes",
         "command_execution": "tool name implies shell or command execution",
@@ -186,6 +188,22 @@ def tool_call_risk_signals(artifact: GuardArtifact, arguments: object) -> tuple[
         "privileged_system_mutation": "call arguments imply privileged system mutation",
         "tool_schema_mismatch": "tool name understates dangerous schema capabilities",
     }
+    if browser_intent is not None:
+        target = browser_intent.target_domain or browser_intent.target_origin or "unknown target"
+        signals_by_category.update(
+            {
+                "browser_navigation": f"browser navigation to {target}",
+                "browser_inspection": f"browser inspection of {target}",
+                "browser_interaction": f"browser interaction on {target}",
+                "browser_transfer": f"browser file transfer involving {target}",
+                "browser_privileged": f"privileged browser access to {target}",
+                "browser_external_domain": f"first navigation to external domain {target}",
+                "browser_shared_profile": "browser MCP uses a shared or remote-debugging profile",
+                "browser_sensitive_surface": (
+                    "browser action touches sensitive surfaces: " + ", ".join(browser_intent.sensitive_surface_flags)
+                ),
+            }
+        )
     return tuple(signals_by_category[category] for category in tool_call_risk_categories(artifact, arguments))
 
 
@@ -201,6 +219,14 @@ def tool_call_risk_categories(artifact: GuardArtifact, arguments: object) -> tup
         "privileged_system_mutation",
         "secret_access",
         "tool_schema_mismatch",
+        "browser_navigation",
+        "browser_inspection",
+        "browser_interaction",
+        "browser_transfer",
+        "browser_privileged",
+        "browser_external_domain",
+        "browser_shared_profile",
+        "browser_sensitive_surface",
     )
     return tuple(category for category in order if category in categories)
 
@@ -215,17 +241,27 @@ def _tool_call_risk_category_set(artifact: GuardArtifact, arguments: object) ->
     schema_categories = _schema_risk_categories(artifact.metadata.get("tool_schema"))
     description_categories = _description_risk_categories(artifact.metadata.get("tool_description"))
 
+    # Extract browser intent early so we can suppress outbound_network for
+    # browser navigation targets.
+    browser_intent = normalize_browser_mcp_intent(artifact, arguments)
+    is_browser_navigation = browser_intent is not None and browser_intent.intent == "browser.navigation"
+
     if len(tool_name_tokens.intersection({"delete", "remove", "rm", "destroy", "erase"})) > 0:
         categories.add("destructive_mutation")
     if len(tool_name_tokens.intersection({"shell", "bash", "exec", "execute", "command", "powershell"})) > 0:
         categories.add("command_execution")
-    if _matches_any(
-        combined,
-        (
-            r"https?://",
-            _token_pattern("curl", "wget", "fetch", "axios", "requests"),
-        ),
+    if (
+        _matches_any(
+            combined,
+            (
+                r"https?://",
+                _token_pattern("curl", "wget", "fetch", "axios", "requests"),
+            ),
+        )
+        and not is_browser_navigation
     ):
+        # Browser navigation intent suppresses generic outbound_network;
+        # browser-specific categories below capture the actual risk surface.
         categories.add("outbound_network")
     if _matches_any(
         combined,
@@ -247,6 +283,36 @@ def _tool_call_risk_category_set(artifact: GuardArtifact, arguments: object) ->
     categories.update(description_categories)
     if _tool_schema_understates_name(tool_name_tokens, schema_categories):
         categories.add("tool_schema_mismatch")
+
+    # Browser intent categories (HGBM034-HGBM043)
+    if browser_intent is not None:
+        if browser_intent.intent == "browser.navigation":
+            categories.add("browser_navigation")
+            # Suppress outbound_network for browser navigation — argument
+            # keys like 'url' would otherwise re-add it.
+            categories.discard("outbound_network")
+            # External domain = public and not localhost/loopback
+            if browser_intent.target_domain and browser_intent.target_domain not in (
+                "localhost",
+                "127.0.0.1",
+                "::1",
+            ):
+                categories.add("browser_external_domain")
+        elif browser_intent.intent == "browser.inspect":
+            categories.add("browser_inspection")
+        elif browser_intent.intent == "browser.interact":
+            categories.add("browser_interaction")
+        elif browser_intent.intent == "browser.transfer":
+            categories.add("browser_transfer")
+        elif browser_intent.intent == "browser.privileged":
+            categories.add("browser_privileged")
+
+        if browser_intent.profile_mode in ("shared", "remote-debugging"):
+            categories.add("browser_shared_profile")
+
+        if browser_intent.sensitive_surface_flags:
+            categories.add("browser_sensitive_surface")
+
     return categories
 
 

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/models.py

@@ -178,6 +178,7 @@ class GuardReceipt:
     approval_source: str | None = None
     approval_request_id: str | None = None
     scanner_evidence: tuple[dict[str, object], ...] = ()
+    browser_intent: dict[str, object] | None = None
 
     def to_dict(self) -> dict[str, object]:
         payload = asdict(self)
@@ -223,6 +224,7 @@ class GuardApprovalRequest:
     dedupe_count: int = 1
     last_seen_at: str | None = None
     scanner_evidence: tuple[dict[str, object], ...] = ()
+    browser_intent: dict[str, object] | None = None
 
     def to_dict(self) -> dict[str, object]:
         payload = asdict(self)

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/policy_bundle_parser.py

@@ -39,9 +39,34 @@ _POLICY_BUNDLE_RULE_ACTIONS = frozenset({"allow", "block", "review", "ignore"})
 _POLICY_BUNDLE_ROLLOUT_STATES = frozenset(
     {"draft", "simulated", "pending_approval", "enforcing", "enforced", "rollback_available"}
 )
-_POLICY_BUNDLE_SCOPE_KEYS = frozenset({"agents", "devices", "ecosystems", "environments", "harnesses", "locations"})
+_POLICY_BUNDLE_SCOPE_KEYS = frozenset(
+    {
+        "agents",
+        "devices",
+        "ecosystems",
+        "environments",
+        "harnesses",
+        "locations",
+        "browserIntent",
+        "browserOperation",
+        "browserProfile",
+        "origin",
+        "pathPrefix",
+        "sensitiveSurface",
+    }
+)
+_VALID_BROWSER_INTENTS = frozenset(
+    {
+        "browser.navigation",
+        "browser.inspect",
+        "browser.interact",
+        "browser.transfer",
+        "browser.privileged",
+    }
+)
+_VALID_BROWSER_PROFILES = frozenset({"isolated", "dedicated", "shared", "remote-debugging", "unknown"})
 _POLICY_BUNDLE_RULE_MATCHER_FAMILIES = frozenset(
-    {"file-read", "mcp", "package-request", "prompt", "prompt-env-read", "tool-action"}
+    {"file-read", "mcp", "mcp-tool", "package-request", "prompt", "prompt-env-read", "tool-action"}
 )
 _POLICY_BUNDLE_DEFAULT_ENVIRONMENTS = frozenset({"development"})
 
@@ -115,9 +140,28 @@ def _policy_bundle_rule_is_valid(rule: object) -> bool:
     if audit_event_ids is not None and not _policy_bundle_string_list(audit_event_ids):
         return False
     scope = rule.get("scope")
-    return isinstance(scope, dict) and all(
-        _policy_bundle_string_list(scope.get(key)) for key in _POLICY_BUNDLE_SCOPE_KEYS
-    )
+    if not isinstance(scope, dict):
+        return False
+    # Validate that all present scope keys map to string lists
+    for key in _POLICY_BUNDLE_SCOPE_KEYS:
+        if key in scope and not _policy_bundle_string_list(scope.get(key)):
+            return False
+    # Validate browser scope enum values (HGBM073)
+    browser_intent = scope.get("browserIntent")
+    if browser_intent is not None:
+        if not _policy_bundle_string_list(browser_intent):
+            return False
+        for intent_value in browser_intent:
+            if intent_value not in _VALID_BROWSER_INTENTS:
+                return False
+    browser_profile = scope.get("browserProfile")
+    if browser_profile is not None:
+        if not _policy_bundle_string_list(browser_profile):
+            return False
+        for profile_value in browser_profile:
+            if profile_value not in _VALID_BROWSER_PROFILES:
+                return False
+    return True
 
 
 def _policy_bundle_acknowledgement_is_valid(acknowledgement: object) -> bool:

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/proxy/runtime_mcp.py

@@ -28,6 +28,7 @@ from ..mcp_tool_calls import (
 )
 from ..models import GuardAction, HarnessDetection
 from ..policy.engine import build_decision_v2
+from ..runtime.browser_mcp_intent import normalize_browser_mcp_intent
 from ..runtime.mcp_protection import McpServerIdentity, build_mcp_server_identity
 from ..runtime.package_intent import build_package_request_artifact, extract_package_intent_request
 from ..runtime.signals import RiskSeverityLabel, RiskSignalV2
@@ -1119,6 +1120,69 @@ class RuntimeMcpGuardProxy:
                 output_stream.write(json.dumps(response) + "\n")
                 output_stream.flush()
 
+    def _build_artifact_payload(
+        self,
+        artifact: Any,
+        artifact_hash: str,
+        tool_name: str,
+        params: dict[str, Any],
+        signals: tuple[str, ...],
+        *,
+        policy_action: str = "require-reapproval",
+    ) -> dict[str, Any]:
+        """Build the artifact payload for approval center queueing.
+
+        Includes browser intent metadata when the MCP tool call is a browser
+        automation call (HGBM063-HGBM065).
+        """
+        arguments = params.get("arguments")
+        browser_intent = normalize_browser_mcp_intent(artifact, arguments)
+        changed_fields: list[str] = ["runtime_tool_call"]
+        launch_target = self._launch_target(tool_name, arguments)
+
+        if browser_intent is not None:
+            changed_fields.append("runtime_browser_tool_call")
+            # Build a safer browser-specific launch target label
+            target = browser_intent.target_domain or browser_intent.target_origin or "unknown"
+            launch_target = f"{browser_intent.mcp_server_name} {browser_intent.operation} {target}"
+            browser_intent_dict = {
+                "version": browser_intent.version,
+                "intent": browser_intent.intent,
+                "operation": browser_intent.operation,
+                "target_url": browser_intent.target_url,
+                "target_origin": browser_intent.target_origin,
+                "target_domain": browser_intent.target_domain,
+                "target_path_prefix": browser_intent.target_path_prefix,
+                "method": browser_intent.method,
+                "profile_mode": browser_intent.profile_mode,
+                "mcp_server_name": browser_intent.mcp_server_name,
+                "mcp_server_identity_hash": browser_intent.mcp_server_identity_hash,
+                "mcp_tool_name": browser_intent.mcp_tool_name,
+                "mcp_tool_identity_hash": browser_intent.mcp_tool_identity_hash,
+                "mcp_schema_hash": browser_intent.mcp_schema_hash,
+                "sensitive_surface_flags": list(browser_intent.sensitive_surface_flags),
+                "volatile_fields_dropped": list(browser_intent.volatile_fields_dropped),
+            }
+        else:
+            browser_intent_dict = None
+
+        payload: dict[str, Any] = {
+            "artifact_id": artifact.artifact_id,
+            "artifact_name": artifact.name,
+            "artifact_hash": artifact_hash,
+            "artifact_type": artifact.artifact_type,
+            "source_scope": artifact.source_scope,
+            "config_path": artifact.config_path,
+            "changed_fields": changed_fields,
+            "policy_action": policy_action,
+            "launch_target": launch_target,
+            "risk_summary": tool_call_risk_summary(artifact, arguments),
+            "risk_signals": list(signals),
+        }
+        if browser_intent_dict is not None:
+            payload["browser_intent"] = browser_intent_dict
+        return payload
+
     def _queue_approval_center_response(
         self,
         *,
@@ -1140,19 +1204,7 @@ class RuntimeMcpGuardProxy:
             ),
             evaluation={
                 "artifacts": [
-                    {
-                        "artifact_id": artifact.artifact_id,
-                        "artifact_name": artifact.name,
-                        "artifact_hash": artifact_hash,
-                        "artifact_type": artifact.artifact_type,
-                        "source_scope": artifact.source_scope,
-                        "config_path": artifact.config_path,
-                        "changed_fields": ["runtime_tool_call"],
-                        "policy_action": "require-reapproval",
-                        "launch_target": self._launch_target(tool_name, params.get("arguments")),
-                        "risk_summary": tool_call_risk_summary(artifact, params.get("arguments")),
-                        "risk_signals": list(signals),
-                    }
+                    self._build_artifact_payload(artifact, artifact_hash, tool_name, params, signals),
                 ]
             },
             store=self.store,
@@ -1227,6 +1279,30 @@ class RuntimeMcpGuardProxy:
             "risk_summary": risk_summary,
             "risk_signals": risk_signals,
         }
+        # Include browser intent metadata when present
+        browser_intent = normalize_browser_mcp_intent(artifact, params.get("arguments"))
+        if browser_intent is not None:
+            artifact_payload["changed_fields"].append("runtime_browser_tool_call")
+            target = browser_intent.target_domain or browser_intent.target_origin or "unknown"
+            artifact_payload["launch_target"] = f"{browser_intent.mcp_server_name} {browser_intent.operation} {target}"
+            artifact_payload["browser_intent"] = {
+                "version": browser_intent.version,
+                "intent": browser_intent.intent,
+                "operation": browser_intent.operation,
+                "target_url": browser_intent.target_url,
+                "target_origin": browser_intent.target_origin,
+                "target_domain": browser_intent.target_domain,
+                "target_path_prefix": browser_intent.target_path_prefix,
+                "method": browser_intent.method,
+                "profile_mode": browser_intent.profile_mode,
+                "mcp_server_name": browser_intent.mcp_server_name,
+                "mcp_server_identity_hash": browser_intent.mcp_server_identity_hash,
+                "mcp_tool_name": browser_intent.mcp_tool_name,
+                "mcp_tool_identity_hash": browser_intent.mcp_tool_identity_hash,
+                "mcp_schema_hash": browser_intent.mcp_schema_hash,
+                "sensitive_surface_flags": list(browser_intent.sensitive_surface_flags),
+                "volatile_fields_dropped": list(browser_intent.volatile_fields_dropped),
+            }
         if decision_v2_payload is not None:
             artifact_payload["decision_v2_json"] = decision_v2_payload
         if extra_fields:

{plugin_scanner-2.0.863 → plugin_scanner-2.0.865}/src/codex_plugin_scanner/guard/runtime/action_identity.py

@@ -85,3 +85,34 @@ def normalize_mcp_identity(call: dict[str, object]) -> str:
     )
     identity_source = f"{server_id}:{tool_name}:{stable_args}:{schema_hash}"
     return hashlib.sha256(identity_source.encode("utf-8")).hexdigest()
+
+
+def normalize_browser_mcp_identity(call: dict[str, object]) -> str:
+    """Return a stable identity hash for a browser MCP tool call.
+
+    Uses browser-aware fields: server identity, tool identity, intent,
+    operation, origin, path prefix, profile mode, sensitive flags, and
+    schema hash. Volatile fields (timeout, pageId, etc.) are dropped.
+
+    Returns a hex digest suitable for equality comparison.
+    """
+    server_id = str(call.get("server_id", call.get("server_identity_hash", "")))
+    tool_name = str(call.get("tool_name", call.get("operation", "")))
+    intent = str(call.get("intent", ""))
+    operation = str(call.get("operation", tool_name))
+    target_origin = str(call.get("target_origin", ""))
+    target_path_prefix = str(call.get("target_path_prefix", ""))
+    profile_mode = str(call.get("profile_mode", ""))
+    schema_hash = str(call.get("schema_hash", call.get("mcp_schema_hash", "")))
+    sensitive_flags = call.get("sensitive_surface_flags") or ()
+    if isinstance(sensitive_flags, (list, tuple)):
+        sensitive_flags_str = ",".join(sorted(str(f) for f in sensitive_flags))
+    else:
+        sensitive_flags_str = str(sensitive_flags)
+
+    identity_source = (
+        f"{server_id}:{tool_name}:{intent}:{operation}:"
+        + f"{target_origin}:{target_path_prefix}:{profile_mode}:"
+        + f"{schema_hash}:{sensitive_flags_str}"
+    )
+    return hashlib.sha256(identity_source.encode("utf-8")).hexdigest()