plugin-scanner 2.0.891__tar.gz → 2.0.893__tar.gz

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.891
+Version: 2.0.893
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.891"
+version = "2.0.893"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.891"
+version = "2.0.893"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/adapters/pi_extension_source.py

@@ -21,6 +21,10 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
     config_path_json = json.dumps(str(settings_path))
     return (
         'import { spawnSync } from "node:child_process";\n'
+        'import { createCipheriv, createHash, randomBytes } from "node:crypto";\n'
+        'import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";\n'
+        'import { tmpdir } from "node:os";\n'
+        'import { join } from "node:path";\n'
         'import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";\n'
         "\n"
         f"const GUARD_ARGS = {guard_args_json};\n"
@@ -193,6 +197,51 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "  return trimmed.length > 0 ? trimmed : null;\n"
         "}\n"
         "\n"
+        "function base64Url(value: Buffer): string {\n"
+        "  return value.toString('base64url');\n"
+        "}\n"
+        "\n"
+        "function encryptedPayload(serializedPayload: string) {\n"
+        "  const key = randomBytes(32);\n"
+        "  const nonce = randomBytes(12);\n"
+        "  const cipher = createCipheriv('aes-256-gcm', key, nonce);\n"
+        "  const ciphertext = Buffer.concat([\n"
+        "    cipher.update(serializedPayload, 'utf8'),\n"
+        "    cipher.final(),\n"
+        "    cipher.getAuthTag(),\n"
+        "  ]);\n"
+        "  return { ciphertext, key: base64Url(key), nonce: base64Url(nonce) };\n"
+        "}\n"
+        "\n"
+        "function referencedPayload(payload: Record<string, unknown>, serializedPayload: string) {\n"
+        "  const directory = mkdtempSync(join(tmpdir(), 'hol-guard-hook-payload-'));\n"
+        "  try { chmodSync(directory, 0o700); } catch {}\n"
+        "  const path = join(directory, 'payload.json');\n"
+        "  const encrypted = encryptedPayload(serializedPayload);\n"
+        "  writeFileSync(path, encrypted.ciphertext, { mode: 0o600 });\n"
+        "  const sha256 = createHash('sha256').update(encrypted.ciphertext).digest('hex');\n"
+        "  const referencePayload: Record<string, unknown> = {\n"
+        "    hook_event_name: payload.hook_event_name,\n"
+        "    config_path: payload.config_path,\n"
+        "    tool_name: payload.tool_name,\n"
+        "    is_error: payload.is_error,\n"
+        "    guard_payload_ref: {\n"
+        "      version: 1,\n"
+        "      path,\n"
+        "      sha256,\n"
+        "      encoding: 'json',\n"
+        "      encryption: 'aes-256-gcm',\n"
+        "      key: encrypted.key,\n"
+        "      nonce: encrypted.nonce,\n"
+        "      serialized_chars: serializedPayload.length,\n"
+        "    },\n"
+        "  };\n"
+        "  return {\n"
+        "    payload: referencePayload,\n"
+        "    cleanup: () => { try { rmSync(directory, { recursive: true, force: true }); } catch {} },\n"
+        "  };\n"
+        "}\n"
+        "\n"
         "function runGuard(\n"
         "  payload: Record<string, unknown>,\n"
         "  cwd?: string,\n"
@@ -203,6 +252,7 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         '  if (workspace) args.push("--workspace", workspace);\n'
         "  let payloadToSend = payload;\n"
         "  let serializedPayload = '';\n"
+        "  let cleanupPayloadReference = () => {};\n"
         "  try {\n"
         "    serializedPayload = JSON.stringify(payloadToSend);\n"
         "  } catch (error) {\n"
@@ -215,24 +265,28 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "  }\n"
         "  if (\n"
         "    options?.enforceSizeCap === true &&\n"
-        "    serializedPayload.length > GUARD_MAX_SERIALIZED_PAYLOAD_CHARS &&\n"
-        '    payloadToSend.hook_event_name === "PostToolUse" &&\n'
-        '    typeof payloadToSend.stdout === "string"\n'
+        "    serializedPayload.length > GUARD_MAX_SERIALIZED_PAYLOAD_CHARS\n"
         "  ) {\n"
-        "    const reducedPayload = { ...payloadToSend };\n"
-        "    delete reducedPayload.stdout;\n"
+        "    const referenced = referencedPayload(payloadToSend, serializedPayload);\n"
+        "    payloadToSend = referenced.payload;\n"
+        "    cleanupPayloadReference = referenced.cleanup;\n"
         "    try {\n"
-        "      const reducedSerializedPayload = JSON.stringify(reducedPayload);\n"
-        "      if (reducedSerializedPayload.length <= GUARD_MAX_SERIALIZED_PAYLOAD_CHARS) {\n"
-        "        payloadToSend = reducedPayload;\n"
-        "        serializedPayload = reducedSerializedPayload;\n"
-        "      }\n"
-        "    } catch {}\n"
+        "      serializedPayload = JSON.stringify(payloadToSend);\n"
+        "    } catch (error) {\n"
+        "      cleanupPayloadReference();\n"
+        "      return {\n"
+        '        decision: "deny",\n'
+        "        reason: `HOL Guard could not serialize Pi hook payload reference: ${\n"
+        "          error instanceof Error ? error.message : String(error)\n"
+        "        }`,\n"
+        "      };\n"
+        "    }\n"
         "  }\n"
         "  if (\n"
         "    options?.enforceSizeCap === true &&\n"
         "    serializedPayload.length > GUARD_MAX_SERIALIZED_PAYLOAD_CHARS\n"
         "  ) {\n"
+        "    cleanupPayloadReference();\n"
         "    return {\n"
         '      decision: "deny",\n'
         '      reason: "HOL Guard blocked this Pi hook payload before review because it exceeded "\n'
@@ -244,6 +298,7 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         '    encoding: "utf-8",\n'
         "    timeout: GUARD_TIMEOUT_MS,\n"
         "  });\n"
+        "  cleanupPayloadReference();\n"
         "  if (result.error) {\n"
         "    const resultError = result.error as (Error & { code?: unknown }) | undefined;\n"
         "    const errorMessage = resultError instanceof Error ? resultError.message : String(result.error);\n"
@@ -348,12 +403,11 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "    };\n"
         "  });\n"
         '  pi.on("tool_result", async (event, ctx) => {\n'
-        "    const boundedToolInput = boundValue(\n"
+        "    const toolInput =\n"
         "      (event as { input?: Record<string, unknown> }).input ??\n"
         "      (event as { toolInput?: Record<string, unknown> }).toolInput ??\n"
         "      (event as { arguments?: Record<string, unknown> }).arguments ??\n"
-        "      {},\n"
-        "    );\n"
+        "      {};\n"
         "    const boundedContent = boundValue(event.content);\n"
         "    const boundedStdout = boundedOutputText(event.content);\n"
         "    // Only the reviewed *output* content determines whether the result is\n"
@@ -363,19 +417,17 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "    const toolOutput = boundedStdout.value as string;\n"
         "    const reviewedContent = outputTruncated ? [{ type: 'text', text: toolOutput }] : boundedContent.value;\n"
         "    const oversizeNotice = outputTruncated\n"
-        '        ? "HOL Guard reviewed a size-bounded excerpt of a large Pi tool result; "\n'
+        '        ? "HOL Guard reviewed the full large Pi tool result; "\n'
         '          + "the model receives the reviewed excerpt, not the full output."\n'
         "        : null;\n"
         '    if (oversizeNotice) ctx.ui.notify(oversizeNotice, "info");\n'
-        "    const toolInput =\n"
-        "      boundedToolInput.value as Record<string, unknown>;\n"
         "    const response = runGuard(\n"
         "      {\n"
         '        hook_event_name: "PostToolUse",\n'
         "        config_path: GUARD_CONFIG_PATH,\n"
         "        tool_name: event.toolName,\n"
         "        tool_input: toolInput,\n"
-        "        tool_response: reviewedContent,\n"
+        "        tool_response: event.content,\n"
         "        stdout: toolOutput,\n"
         "        is_error: event.isError === true,\n"
         "      },\n"

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/cli/commands_hook_copilot.py

@@ -107,7 +107,6 @@ def _queue_observed_copilot_approval(
                 ),
                 "command_text": _hook_command_text(payload),
                 "workspace": str(runtime_workspace) if runtime_workspace else None,
-                **codex_resume_metadata_from_hook_payload(payload),
             },
             detection=runtime_detection.to_dict(),
             evaluation=evaluation_payload,
@@ -383,7 +382,6 @@ def _run_hook_copilot_permission_request(
                 ),
                 "command_text": _hook_command_text(payload),
                 "workspace": str(runtime_workspace) if runtime_workspace else None,
-                **codex_resume_metadata_from_hook_payload(payload),
             },
             detection=runtime_detection.to_dict(),
             evaluation=evaluation_payload,

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py

@@ -161,7 +161,11 @@ def _review_runtime_artifact_hook(
                             ),
                             "command_text": _hook_command_text(payload_map),
                             "workspace": str(workspace) if workspace else None,
-                            **codex_resume_metadata_from_hook_payload(payload_map),
+                            **(
+                                codex_resume_metadata_from_hook_payload(payload_map)
+                                if _canonical_harness_name(args.harness) == "codex"
+                                else {}
+                            ),
                         },
                         detection=runtime_detection.to_dict(),
                         evaluation=evaluation_payload,
@@ -354,7 +358,11 @@ def _review_runtime_artifact_hook(
                         ),
                         "command_text": _hook_command_text(payload_map),
                         "workspace": str(workspace) if workspace else None,
-                        **codex_resume_metadata_from_hook_payload(payload_map),
+                        **(
+                            codex_resume_metadata_from_hook_payload(payload_map)
+                            if _canonical_harness_name(args.harness) == "codex"
+                            else {}
+                        ),
                     },
                     detection=runtime_detection.to_dict(),
                     evaluation=evaluation_payload,

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/cli/commands_support_codex_commands.py

@@ -187,6 +187,18 @@ def _codex_post_tool_command_texts(payload: dict[str, object]) -> tuple[str, ...
                 candidates.extend(
                     command_list_candidate_texts(candidate, preserve_items=key in COMMAND_SEQUENCE_KEYS)
                 )
+        if not candidates and str(payload.get("tool_name", "")).strip().lower() in {
+            "cat_file",
+            "open_file",
+            "read",
+            "read_file",
+            "view",
+            "view_file",
+        }:
+            for key in ("path", "file_path", "filePath", "filepath", "file", "filename"):
+                value = tool_input.get(key)
+                if isinstance(value, str) and value.strip():
+                    candidates.append(f"cat -- {shlex.quote(value.strip())}")
         return tuple(dict.fromkeys(text for text in candidates if text))
     return ()
 

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py

@@ -21,6 +21,7 @@ if TYPE_CHECKING:
 from ._commands_shared import *
 from .commands_parser_helpers import *
 from ..adapters.kimi_hooks import normalize_kimi_prompt
+from ..runtime.hook_payload_reference import hydrate_hook_payload_reference
 
 def _emit_native_hook_response(
     *,
@@ -389,11 +390,15 @@ def _load_hook_payload(
 ) -> dict[str, object]:
     if event_file:
         payload = json.loads(Path(event_file).read_text(encoding="utf-8"))
+        if isinstance(payload, dict):
+            payload = hydrate_hook_payload_reference(payload)
         return _normalize_hook_payload(payload, harness=harness) if isinstance(payload, dict) else {}
     raw = input_text.strip() if isinstance(input_text, str) else sys.stdin.read().strip()
     if not raw:
         return {}
     payload = json.loads(raw)
+    if isinstance(payload, dict):
+        payload = hydrate_hook_payload_reference(payload)
     return _normalize_hook_payload(payload, harness=harness) if isinstance(payload, dict) else {}
 
 _ACTION_ENVELOPE_HARNESSES = frozenset(

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py

@@ -326,7 +326,7 @@ _CODEX_PROMPT_SECRET_KEY_MARKERS = ("TOKEN", "SECRET", "PASSWORD", "PASS", "API_
 
 _CODEX_TOOL_RESPONSE_MAX_DEPTH = 5
 
-_CODEX_TOOL_RESPONSE_TEXT_LIMIT = 20000
+_CODEX_TOOL_RESPONSE_TEXT_LIMIT = 5 * 1024 * 1024
 
 _CODEX_PROMPT_FILE_FINGERPRINT_LENGTH = 24
 

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -5239,6 +5239,7 @@ _HARNESS_RETRY_COPY: dict[str, str] = {
     "claude-code": "Return to Claude and retry",
     "opencode": "Return to OpenCode and retry",
     "copilot": "Return to Copilot and retry",
+    "pi": "Return to Pi and retry",
 }
 _DEFAULT_RETRY_COPY = "Return to your AI assistant and retry"
 

plugin_scanner-2.0.893/src/codex_plugin_scanner/guard/runtime/hook_payload_reference.py

@@ -0,0 +1,92 @@
+"""Local hook payload reference hydration."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import tempfile
+from base64 import urlsafe_b64decode
+from collections.abc import Mapping
+from pathlib import Path
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+HOOK_PAYLOAD_REFERENCE_KEY = "guard_payload_ref"
+MAX_HOOK_PAYLOAD_REFERENCE_BYTES = 5 * 1024 * 1024
+_REFERENCE_DIR_PREFIX = "hol-guard-hook-payload-"
+
+
+class HookPayloadReferenceError(ValueError):
+    """Raised when a hook payload reference cannot be safely hydrated."""
+
+
+def hydrate_hook_payload_reference(payload: Mapping[str, object]) -> dict[str, object]:
+    ref = payload.get(HOOK_PAYLOAD_REFERENCE_KEY)
+    if not isinstance(ref, Mapping):
+        return dict(payload)
+    path_value = ref.get("path")
+    sha256_value = ref.get("sha256")
+    if ref.get("version") != 1 or not isinstance(path_value, str) or not isinstance(sha256_value, str):
+        raise HookPayloadReferenceError("Invalid HOL Guard hook payload reference metadata.")
+    expected_sha256 = sha256_value.strip().lower()
+    if len(expected_sha256) != 64 or any(char not in "0123456789abcdef" for char in expected_sha256):
+        raise HookPayloadReferenceError("Invalid HOL Guard hook payload reference digest.")
+    path = _safe_reference_path(path_value)
+    try:
+        size = path.stat().st_size
+    except OSError as error:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference is not readable.") from error
+    if size > MAX_HOOK_PAYLOAD_REFERENCE_BYTES:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference exceeds the safe local size limit.")
+    try:
+        raw = path.read_bytes()
+    except OSError as error:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference is not readable.") from error
+    actual_sha256 = hashlib.sha256(raw).hexdigest()
+    if actual_sha256 != expected_sha256:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference digest mismatch.")
+    if ref.get("encryption") == "aes-256-gcm":
+        raw = _decrypt_payload_reference(raw, ref)
+    try:
+        loaded = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference is not valid JSON.") from error
+    if not isinstance(loaded, dict):
+        raise HookPayloadReferenceError("HOL Guard hook payload reference must contain a JSON object.")
+    return loaded
+
+
+def _decrypt_payload_reference(raw: bytes, ref: Mapping[str, object]) -> bytes:
+    key = _base64url_bytes(ref.get("key"), expected_length=32, label="key")
+    nonce = _base64url_bytes(ref.get("nonce"), expected_length=12, label="nonce")
+    try:
+        return AESGCM(key).decrypt(nonce, raw, None)
+    except ValueError as error:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference could not be decrypted.") from error
+
+
+def _base64url_bytes(value: object, *, expected_length: int, label: str) -> bytes:
+    if not isinstance(value, str) or not value.strip():
+        raise HookPayloadReferenceError(f"HOL Guard hook payload reference missing encryption {label}.")
+    padded = value.strip() + "=" * (-len(value.strip()) % 4)
+    try:
+        decoded = urlsafe_b64decode(padded.encode("ascii"))
+    except (ValueError, UnicodeEncodeError) as error:
+        raise HookPayloadReferenceError(f"HOL Guard hook payload reference has invalid encryption {label}.") from error
+    if len(decoded) != expected_length:
+        raise HookPayloadReferenceError(f"HOL Guard hook payload reference has invalid encryption {label}.")
+    return decoded
+
+
+def _safe_reference_path(path_value: str) -> Path:
+    try:
+        path = Path(path_value).resolve(strict=True)
+        temp_root = Path(tempfile.gettempdir()).resolve(strict=True)
+    except OSError as error:
+        raise HookPayloadReferenceError("HOL Guard hook payload reference path is invalid.") from error
+    parent = path.parent
+    if parent.parent != temp_root or not parent.name.startswith(_REFERENCE_DIR_PREFIX):
+        raise HookPayloadReferenceError("HOL Guard hook payload reference must be in a Guard-owned temp directory.")
+    if not path.is_file():
+        raise HookPayloadReferenceError("HOL Guard hook payload reference must be a file.")
+    return path

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.891"
+__version__ = "2.0.893"

plugin_scanner-2.0.893/tests/test_guard_hook_payload_reference.py

@@ -0,0 +1,91 @@
+"""Tests for generic hook payload references."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import tempfile
+from base64 import urlsafe_b64encode
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from codex_plugin_scanner.guard.cli.commands_support_hook_payload import _load_hook_payload
+from codex_plugin_scanner.guard.cli.commands_support_runtime_artifacts import _codex_post_tool_output_artifact
+from codex_plugin_scanner.guard.runtime.hook_payload_reference import HookPayloadReferenceError
+
+
+def _b64url(value: bytes) -> str:
+    return urlsafe_b64encode(value).decode("ascii").rstrip("=")
+
+
+def _referenced_input(payload: dict[str, object], reference_dir: Path, *, sha256: str | None = None) -> str:
+    raw_payload = json.dumps(payload).encode("utf-8")
+    key = os.urandom(32)
+    nonce = os.urandom(12)
+    ciphertext = AESGCM(key).encrypt(nonce, raw_payload, None)
+    reference_path = reference_dir / "payload.json"
+    reference_path.write_bytes(ciphertext)
+    return json.dumps(
+        {
+            "hook_event_name": payload.get("hook_event_name"),
+            "tool_name": payload.get("tool_name"),
+            "guard_payload_ref": {
+                "version": 1,
+                "path": str(reference_path),
+                "sha256": sha256 or hashlib.sha256(ciphertext).hexdigest(),
+                "encoding": "json",
+                "encryption": "aes-256-gcm",
+                "key": _b64url(key),
+                "nonce": _b64url(nonce),
+            },
+        }
+    )
+
+
+def test_hook_payload_reference_hydrates_full_payload_for_runtime_review(tmp_path: Path) -> None:
+    secret_path = tmp_path / ".npmrc"
+    secret_line = "//registry.npmjs.org/:" + "_authToken=npm_" + "abcdefghijklmnopqrstuvwxyz012345"
+    full_output = ("markdown context\n" * 2500) + secret_line
+    full_payload = {
+        "hook_event_name": "PostToolUse",
+        "tool_name": "Read",
+        "tool_input": {"file_path": str(secret_path)},
+        "tool_response": [{"type": "text", "text": full_output}],
+        "stdout": full_output[:12_000],
+    }
+
+    with tempfile.TemporaryDirectory(prefix="hol-guard-hook-payload-") as reference_dir:
+        loaded_payload = _load_hook_payload(
+            None,
+            input_text=_referenced_input(full_payload, Path(reference_dir)),
+            harness="pi",
+        )
+
+    assert loaded_payload["tool_response"] == full_payload["tool_response"]
+    artifact = _codex_post_tool_output_artifact(
+        harness="pi",
+        payload=loaded_payload,
+        config_path="~/.pi/agent/settings.json",
+        source_scope="project",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+    assert artifact is not None
+    assert artifact.harness == "pi"
+
+
+def test_hook_payload_reference_rejects_digest_mismatch() -> None:
+    payload = {"hook_event_name": "PostToolUse", "tool_name": "Read", "tool_response": []}
+
+    with (
+        pytest.raises(HookPayloadReferenceError, match="digest mismatch"),
+        tempfile.TemporaryDirectory(prefix="hol-guard-hook-payload-") as reference_dir,
+    ):
+        _load_hook_payload(
+            None,
+            input_text=_referenced_input(payload, Path(reference_dir), sha256="0" * 64),
+            harness="pi",
+        )

plugin_scanner-2.0.893/tests/test_guard_non_codex_resume.py

@@ -0,0 +1,85 @@
+"""Non-Codex approval resolution must not trigger Codex resume."""
+
+from __future__ import annotations
+
+import json
+import urllib.request
+from pathlib import Path
+
+from codex_plugin_scanner.guard.daemon import GuardDaemonServer
+from codex_plugin_scanner.guard.models import GuardApprovalRequest
+from codex_plugin_scanner.guard.store import GuardStore
+
+
+def _post_json(port: int, token: str, path: str, payload: dict[str, object]) -> dict[str, object]:
+    request = urllib.request.Request(
+        f"http://127.0.0.1:{port}{path}",
+        data=json.dumps(payload).encode("utf-8"),
+        headers={"Content-Type": "application/json", "X-Guard-Token": token},
+        method="POST",
+    )
+    with urllib.request.urlopen(request, timeout=5) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+def test_pi_approval_with_session_id_metadata_does_not_attempt_codex_resume(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    request = GuardApprovalRequest(
+        request_id="req-pi",
+        harness="pi",
+        artifact_id="pi:project:read-source",
+        artifact_name="Read credential-looking source",
+        artifact_hash="hash-pi",
+        publisher=None,
+        policy_action="require-reapproval",
+        recommended_scope="artifact",
+        changed_fields=("tool_response",),
+        source_scope="project",
+        config_path=str(tmp_path / ".pi" / "settings.json"),
+        workspace=str(tmp_path),
+        launch_target="Read src/lib/guard-notion-api.ts",
+        action_envelope_json={"action_type": "file_read", "tool_name": "Read", "target_paths": ["src/file.ts"]},
+        review_command="hol-guard approvals approve req-pi",
+        approval_url="http://127.0.0.1/pending/req-pi",
+    )
+    store.add_approval_request(request, "2026-05-08T10:00:00+00:00")
+    session = store.upsert_guard_session(
+        session_id="pi-session",
+        harness="pi",
+        surface="harness-adapter",
+        status="waiting_on_approval",
+        client_name="pi-hook",
+        client_title="Pi hook",
+        client_version="1.0.0",
+        workspace=str(tmp_path),
+        capabilities=["approval-resolution"],
+        now="2026-05-08T10:00:00+00:00",
+    )
+    store.upsert_guard_operation(
+        operation_id="pi-operation",
+        session_id=str(session["session_id"]),
+        harness="pi",
+        operation_type="tool_call",
+        status="waiting_on_approval",
+        approval_request_ids=["req-pi"],
+        resume_token="resume-token",
+        metadata={"session_id": "pi-session-id-that-must-not-be-codex"},
+        now="2026-05-08T10:00:00+00:00",
+    )
+    daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)
+    daemon.start()
+
+    try:
+        payload = _post_json(
+            daemon.port,
+            daemon._server.auth_token,
+            "/v1/requests/req-pi/approve",
+            {"scope": "artifact"},
+        )
+    finally:
+        daemon.stop()
+
+    assert payload["resolved"] is True
+    assert "codex_resume" not in payload
+    assert payload["copy"]["body"] == "Return to Pi and retry"
+    assert store.list_events(event_name="codex/thread_resume") == []

{plugin_scanner-2.0.891 → plugin_scanner-2.0.893}/tests/test_pi_adapter.py

@@ -192,7 +192,7 @@ class TestPiInstall:
         assert 'pi.on("tool_result"' in text
         assert 'pi.on("input"' in text
         assert 'hook_event_name: "PostToolUse"' in text
-        assert "tool_response: reviewedContent" in text
+        assert "tool_response: event.content" in text
         assert "const GUARD_CONFIG_PATH =" in text
         assert "config_path: GUARD_CONFIG_PATH" in text
         assert '"--harness", "pi"' in text
@@ -245,7 +245,13 @@ class TestPiInstall:
         assert "function truncateText(" in text
         assert "function boundValue(" in text
         assert "function boundedOutputText(" in text
+        assert "function referencedPayload(" in text
         assert "function toolCallIdKey(" in text
+        assert "guard_payload_ref" in text
+        assert "mkdtempSync(join(tmpdir(), 'hol-guard-hook-payload-'))" in text
+        assert "createCipheriv('aes-256-gcm', key, nonce)" in text
+        assert "createHash('sha256').update(encrypted.ciphertext).digest('hex')" in text
+        assert "encryption: 'aes-256-gcm'" in text
         assert "if (value === undefined) return { value: undefined, truncated: false };" in text
         assert "typeof value === 'bigint'" in text
         assert "value.toString()" in text
@@ -257,16 +263,19 @@ class TestPiInstall:
             "const reviewedContent = outputTruncated ? [{ type: 'text', text: toolOutput }] : boundedContent.value;"
             in text
         )
-        # Only output truncation gates the reviewed-result replacement; a
-        # truncated tool input alone must not replace the result.
+        # Only output truncation gates the reviewed-result replacement. Guard
+        # still receives full tool input and full tool response data through
+        # the generic payload-reference path when the payload is too large.
         assert "boundedContent.truncated || boundedStdout.truncated" in text
         assert "boundedToolInput.truncated || boundedContent.truncated" not in text
+        assert "const boundedToolInput = boundValue(" not in text
         assert "const blockedToolResults = new Map<string, string>();" in text
         assert 'pi.on("message_end"' in text
         assert "const toolCallId = toolCallIdKey(event.toolCallId);" in text
         assert "if (toolCallId) blockedToolResults.set(toolCallId, reason);" in text
         assert "blockedToolResults.delete(toolCallId);" in text
-        # Oversized tool results are truncated and reviewed, not pre-emptively blocked.
+        # Oversized tool results are passed to Guard by reference for full
+        # review, not pre-emptively blocked.
         assert "HOL Guard blocked oversized Pi tool output before review" not in text
         assert "oversizeNotice" in text
         assert 'ctx.ui.notify(oversizeNotice, "info")' in text
@@ -275,12 +284,12 @@ class TestPiInstall:
         # returned to Pi so omitted content never reaches the model.
         assert "function reviewedToolResult(" in text
         assert "return reviewedToolResult(reviewedContent, event.details, event.isError === true);" in text
-        assert "tool_response: reviewedContent" in text
+        assert "tool_response: event.content" in text
         assert "stdout: toolOutput" in text
         assert "contentText(event.content)" not in text
         assert "options?.enforceSizeCap === true" in text
-        assert 'payloadToSend.hook_event_name === "PostToolUse"' in text
-        assert "delete reducedPayload.stdout;" in text
+        assert 'payloadToSend.hook_event_name === "PostToolUse"' not in text
+        assert "delete reducedPayload.stdout;" not in text
 
     def test_uninstall_removes_managed_extension(self, tmp_path: Path, monkeypatch) -> None:
         ctx = _ctx(tmp_path)
@@ -387,6 +396,26 @@ class TestPiRuntime:
         assert artifact.harness == "pi"
         assert artifact.artifact_id.startswith("pi:")
 
+    def test_pi_source_file_read_with_credential_like_code_does_not_block(self, tmp_path: Path) -> None:
+        source_path = tmp_path / "src" / "lib" / "guard-notion-api.ts"
+        source_path.parent.mkdir(parents=True)
+        source_path.write_text("export const NOTION_API_KEY = process.env.NOTION_API_KEY;\n", encoding="utf-8")
+
+        artifact = _codex_post_tool_output_artifact(
+            harness="pi",
+            payload={
+                "tool_name": "Read",
+                "tool_input": {"file_path": str(source_path)},
+                "tool_response": [{"type": "text", "text": source_path.read_text(encoding="utf-8")}],
+            },
+            config_path="~/.pi/agent/settings.json",
+            source_scope="project",
+            cwd=tmp_path,
+            home_dir=tmp_path,
+        )
+
+        assert artifact is None
+
     def test_pi_focused_pytest_messages_label_pi_runtime(self) -> None:
         assert _codex_tool_output_request_summary(
             harness_label="Pi",