plugin-scanner 2.0.906__tar.gz → 2.0.908__tar.gz

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.906
+Version: 2.0.908
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.906"
+version = "2.0.908"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.906"
+version = "2.0.908"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/adapters/cursor_hooks.py

@@ -610,9 +610,42 @@ def _daemon_hook_result(
         auth_token = token_path.read_text(encoding="utf-8").strip()
     except (OSError, ValueError):
         return None
-    port = state.get("port") if isinstance(state, dict) else None
+    if not isinstance(state, dict):
+        return None
+    port = state.get("port")
     if not isinstance(port, int) or port <= 0 or not auth_token:
         return None
+    # Validate the recorded PID is still alive before trusting the state file.
+    # A stale state file after a crash could point at an attacker-controlled listener.
+    pid = state.get("pid")
+    if not isinstance(pid, int) or pid <= 0:
+        return None
+    try:
+        os.kill(pid, 0)
+    except OSError:
+        return None
+    # Probe /healthz before sending the hook payload and auth token.
+    # Ensures the listener is actually the Guard daemon, not a spoofed process.
+    # Validate the response body — not just HTTP 200 — so an attacker listener
+    # that returns 200 but doesn't know the daemon's compatibility version is rejected.
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+    try:
+        health_req = urllib.request.Request(f"http://127.0.0.1:{port}/healthz", method="GET")
+        with opener.open(health_req, timeout=2) as health_response:
+            if health_response.status != 200:
+                return None
+            health_body = health_response.read().decode("utf-8", errors="replace")
+    except (OSError, urllib.error.URLError):
+        return None
+    try:
+        health_json = json.loads(health_body)
+    except ValueError:
+        return None
+    if not isinstance(health_json, dict) or health_json.get("ok") is not True:
+        return None
+    state_compat = state.get("compatibility_version")
+    if isinstance(state_compat, str) and health_json.get("compatibility_version") != state_compat:
+        return None
     params = [("guard-home", GUARD_HOME)]
     if workspace:
         params.append(("workspace", workspace))
@@ -637,13 +670,23 @@ def _daemon_hook_result(
         },
         method="POST",
     )
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
     try:
         with opener.open(request, timeout=max(GUARD_HOOK_TIMEOUT_SECONDS - 2, 1)) as response:
             body = response.read().decode("utf-8", errors="replace")
     except (OSError, urllib.error.URLError):
         return None
-    return (0, body if body.strip() else "{}", "")
+    # Reject empty or non-dict responses — they default policy_action to "allow".
+    # Fall through to the CLI subprocess path instead of trusting a malformed response.
+    body_stripped = body.strip()
+    if not body_stripped:
+        return None
+    try:
+        parsed_body = json.loads(body_stripped)
+    except ValueError:
+        return None
+    if not isinstance(parsed_body, dict):
+        return None
+    return (0, body_stripped, "")
 
 
 def _validated_hol_guard_src_path(path_str: str) -> str | None:

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/cli/commands_hook_copilot.py

@@ -117,6 +117,7 @@ def _queue_observed_copilot_approval(
                 approval_flow,
             ),
             open_key=artifact.artifact_id,
+            redaction_level=config.receipt_redaction_level,
         )
         queued = blocked_operation.get("approval_requests")
         if not isinstance(queued, list):
@@ -393,6 +394,7 @@ def _run_hook_copilot_permission_request(
                 approval_flow,
             ),
             open_key=artifact_id,
+            redaction_level=config.receipt_redaction_level,
         )
         operation = blocked_operation.get("operation")
         if not isinstance(operation, dict):

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_eval.py

@@ -206,6 +206,7 @@ def _evaluate_runtime_artifact_hook(
                 artifact_digest=runtime_artifact_hash,
                 approval_center_url=load_guard_daemon_url(guard_home) or "http://127.0.0.1:5474",
                 action_envelope=action_envelope,
+                redaction_level=config.receipt_redaction_level,
             )
         _record_harness_usage_for_hook(
             store=store,

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py

@@ -132,6 +132,7 @@ def _review_runtime_artifact_hook(
                         store=store,
                         approval_center_url=approval_center_url,
                         now=_now(),
+                        redaction_level=config.receipt_redaction_level,
                     )
                 else:
                     session = browser_approval_daemon_client.start_session(
@@ -175,6 +176,7 @@ def _review_runtime_artifact_hook(
                             approval_flow,
                         ),
                         open_key=artifact_id,
+                        redaction_level=config.receipt_redaction_level,
                     )
                     operation = blocked_operation.get("operation")
                     if not isinstance(operation, dict):
@@ -373,6 +375,7 @@ def _review_runtime_artifact_hook(
                         approval_flow,
                     ),
                     open_key=artifact_id,
+                    redaction_level=config.receipt_redaction_level,
                 )
                 operation = blocked_operation.get("operation")
                 if not isinstance(operation, dict):

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py

@@ -243,6 +243,7 @@ def _headless_approval_resolver(
                 approval_flow,
             ),
             open_key=None,
+            redaction_level=config.receipt_redaction_level,
         )
         operation = blocked_operation["operation"] if isinstance(blocked_operation.get("operation"), dict) else {}
         queued = (

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_resolution.py

@@ -340,10 +340,9 @@ def _queue_claude_native_approval_gate_fallback(
     artifact_digest: str,
     approval_center_url: str,
     action_envelope: GuardActionEnvelope | None = None,
+    redaction_level: str = "full",
 ) -> list[dict[str, object]]:
     now = _now()
-    # TODO: pass redaction_level from GuardConfig when available;
-    # for now, default to "full" so no raw command text is exposed
     queued = queue_blocked_approvals(
         detection=_runtime_detection(harness, artifact),
         evaluation={
@@ -366,6 +365,7 @@ def _queue_claude_native_approval_gate_fallback(
         store=store,
         approval_center_url=approval_center_url,
         now=now,
+        redaction_level=redaction_level,
     )
     store.add_event(
         "approval_gate/native_fallback_queued",

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/daemon/client.py

@@ -94,6 +94,7 @@ class GuardSurfaceDaemonClient:
         approval_center_url: str,
         approval_surface_policy: str,
         open_key: str | None = None,
+        redaction_level: str = "full",
     ) -> dict[str, object]:
         return self._post(
             "/v1/operations/block",
@@ -107,6 +108,7 @@ class GuardSurfaceDaemonClient:
                 "approval_center_url": approval_center_url,
                 "approval_surface_policy": approval_surface_policy,
                 "open_key": open_key,
+                "redaction_level": redaction_level,
             },
         )
 

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -3794,6 +3794,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             return
         metadata = payload.get("metadata")
         try:
+            redaction_level = self._optional_string(payload.get("redaction_level")) or "full"
             response = self.server.runtime.queue_blocked_operation(  # type: ignore[attr-defined]
                 session_id=session_id,
                 operation_type=operation_type,
@@ -3806,6 +3807,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 approval_surface_policy=approval_surface_policy,
                 open_key=self._optional_string(payload.get("open_key")),
                 opener=webbrowser.open,
+                redaction_level=redaction_level,
             )
         except ValueError as error:
             self._write_json({"error": str(error)}, status=400)

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/guard/runtime/surface_server.py

@@ -223,18 +223,18 @@ class GuardSurfaceRuntime:
         approval_surface_policy: str,
         open_key: str | None,
         opener: Callable[[str], object],
+        redaction_level: str = "full",
     ) -> dict[str, object]:
         if self.store.get_guard_session(session_id) is None:
             raise ValueError(f"Unknown guard session: {session_id}")
         parsed_detection = _parse_detection(detection)
-        # TODO: pass redaction_level from GuardConfig when available;
-        # for now, default to "full" so no raw command text is exposed
         queued = queue_blocked_approvals(
             detection=parsed_detection,
             evaluation=evaluation,
             store=self.store,
             approval_center_url=approval_center_url,
             now=_now(),
+            redaction_level=redaction_level,
         )
         operation = self.start_operation(
             session_id=session_id,

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.906"
+__version__ = "2.0.908"

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/tests/test_cursor_hooks.py

@@ -1109,3 +1109,122 @@ def test_uninstall_cursor_hooks_restores_backup(tmp_path: Path, monkeypatch: pyt
     result = uninstall_cursor_hooks(context)
     assert result["restored"] is True
     assert json.loads(hooks_path.read_text(encoding="utf-8")) == {"version": 1, "hooks": {"preToolUse": []}}
+
+
+def test_cursor_hook_daemon_fast_path_rejects_stale_pid(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Fast path returns None when daemon-state.json points at a dead PID."""
+    from codex_plugin_scanner.guard.adapters.cursor_hooks import cursor_hook_script_source
+
+    home_dir = tmp_path / "home"
+    guard_home = tmp_path / "guard"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True, exist_ok=True)
+
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.adapters.cursor_hooks._resolve_guard_cli_command",
+        lambda: [sys.executable, "-m", "codex_plugin_scanner.cli"],
+    )
+    context = HarnessContext(home_dir=home_dir, guard_home=guard_home, workspace_dir=workspace_dir)
+    script_path = tmp_path / "cursor-hook.py"
+    script_path.write_text(cursor_hook_script_source(context), encoding="utf-8")
+    script_path.chmod(0o755)
+
+    # Write stale daemon state pointing at a dead PID and a real-looking port.
+    guard_home.mkdir(parents=True, exist_ok=True)
+    (guard_home / "daemon-state.json").write_text(
+        json.dumps({"port": 59999, "pid": 999999, "compatibility_version": "v1"}),
+        encoding="utf-8",
+    )
+    (guard_home / "daemon-auth-token").write_text("stale-token", encoding="utf-8")
+
+    payload = {
+        "hook_event_name": "beforeShellExecution",
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo hi"},
+        "command": "echo hi",
+        "cwd": str(workspace_dir),
+    }
+    proc = subprocess.run(
+        [sys.executable, str(script_path)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        env={**os.environ, "CURSOR_PROJECT_DIR": str(workspace_dir)},
+        timeout=30,
+    )
+    # Should fall through to the subprocess CLI path, not crash or default-allow.
+    assert proc.returncode in (0, 2)
+
+
+def test_cursor_hook_daemon_fast_path_rejects_empty_response(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """Fast path returns None when daemon returns an empty body, falling through to CLI."""
+    import http.server
+    import threading
+
+    from codex_plugin_scanner.guard.adapters.cursor_hooks import cursor_hook_script_source
+
+    home_dir = tmp_path / "home"
+    guard_home = tmp_path / "guard"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True, exist_ok=True)
+
+    # Spin up a minimal HTTP server that returns a valid /healthz but empty body on POST.
+    class _EmptyResponseHandler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self) -> None:
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(json.dumps({"ok": True, "compatibility_version": "v1"}).encode())
+
+        def do_POST(self) -> None:
+            self.send_response(200)
+            self.end_headers()
+            # Empty body — should be rejected by the fast path.
+
+        def log_message(self, *args: object) -> None:
+            pass
+
+    server = http.server.HTTPServer(("127.0.0.1", 0), _EmptyResponseHandler)
+    port = server.server_address[1]
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+
+    try:
+        monkeypatch.setattr(
+            "codex_plugin_scanner.guard.adapters.cursor_hooks._resolve_guard_cli_command",
+            lambda: [sys.executable, "-m", "codex_plugin_scanner.cli"],
+        )
+        context = HarnessContext(home_dir=home_dir, guard_home=guard_home, workspace_dir=workspace_dir)
+        script_path = tmp_path / "cursor-hook.py"
+        script_path.write_text(cursor_hook_script_source(context), encoding="utf-8")
+        script_path.chmod(0o755)
+
+        # Write daemon state pointing at our test server with the current PID.
+        guard_home.mkdir(parents=True, exist_ok=True)
+        (guard_home / "daemon-state.json").write_text(
+            json.dumps({"port": port, "pid": os.getpid(), "compatibility_version": "v1"}),
+            encoding="utf-8",
+        )
+        (guard_home / "daemon-auth-token").write_text("test-token", encoding="utf-8")
+
+        payload = {
+            "hook_event_name": "beforeShellExecution",
+            "tool_name": "Bash",
+            "tool_input": {"command": "echo hi"},
+            "command": "echo hi",
+            "cwd": str(workspace_dir),
+        }
+        proc = subprocess.run(
+            [sys.executable, str(script_path)],
+            input=json.dumps(payload),
+            capture_output=True,
+            text=True,
+            env={**os.environ, "CURSOR_PROJECT_DIR": str(workspace_dir)},
+            timeout=30,
+        )
+    finally:
+        server.shutdown()
+
+    # The fast path should reject the empty response and fall through to CLI.
+    # The CLI path may fail (no real daemon), but it must not default-allow.
+    assert proc.returncode in (0, 2)

plugin_scanner-2.0.908/tests/test_raw_command_text.py

@@ -0,0 +1,279 @@
+"""Tests that raw_command_text flows through the approval pipeline with redaction."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from codex_plugin_scanner.guard.approvals import (
+    queue_blocked_approvals,
+)
+from codex_plugin_scanner.guard.models import (
+    GuardApprovalRequest,
+    GuardArtifact,
+    HarnessDetection,
+)
+from codex_plugin_scanner.guard.store import GuardStore
+from codex_plugin_scanner.guard.store_approvals import (
+    add_approval_request,
+    get_approval_request,
+    list_approval_requests,
+)
+
+
+def _make_detection(artifact: GuardArtifact, tmp_path: Path) -> HarnessDetection:
+    return HarnessDetection(
+        harness="codex",
+        installed=True,
+        command_available=True,
+        config_paths=(str(tmp_path / "config.toml"),),
+        artifacts=(artifact,),
+    )
+
+
+def _make_evaluation(artifact_id: str, tmp_path: Path) -> dict:
+    return {
+        "artifacts": [
+            {
+                "artifact_id": artifact_id,
+                "artifact_name": "blocked-cmd",
+                "artifact_hash": "hash-1",
+                "artifact_type": "command",
+                "policy_action": "require-reapproval",
+                "changed_fields": ["command"],
+                "source_scope": "project",
+                "config_path": str(tmp_path / "config.toml"),
+                "risk_summary": "Blocked command",
+                "risk_signals": ["blocked"],
+            }
+        ]
+    }
+
+
+class TestRawCommandTextPropagation:
+    """Tests that raw_command_text flows through the approval pipeline with redaction."""
+
+    def test_raw_command_text_included_when_redaction_none(self, tmp_path):
+        """With redaction_level='none', the actual blocked command is included."""
+        store = GuardStore(tmp_path / "guard-home")
+        artifact = GuardArtifact(
+            artifact_id="codex:cmd:test",
+            name="blocked-cmd",
+            harness="codex",
+            artifact_type="command",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command="rm -rf /var/tmp/*",
+            metadata={"raw_command_text": "rm -rf /var/tmp/*"},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        evaluation = _make_evaluation("codex:cmd:test", tmp_path)
+        queued = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1/pending",
+            redaction_level="none",
+        )
+        assert len(queued) == 1
+        assert queued[0]["raw_command_text"] == "rm -rf /var/tmp/*"
+
+    def test_raw_command_text_excluded_when_redaction_full(self, tmp_path):
+        """With redaction_level='full', raw_command_text is None."""
+        store = GuardStore(tmp_path / "guard-home")
+        artifact = GuardArtifact(
+            artifact_id="codex:cmd:test2",
+            name="blocked-cmd",
+            harness="codex",
+            artifact_type="command",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command="rm -rf /var/tmp/*",
+            metadata={"raw_command_text": "rm -rf /var/tmp/*"},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        evaluation = _make_evaluation("codex:cmd:test2", tmp_path)
+        queued = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1/pending",
+            redaction_level="full",
+        )
+        assert len(queued) == 1
+        assert queued[0]["raw_command_text"] is None
+
+    def test_raw_command_text_scrubs_secrets(self, tmp_path):
+        """Secrets in raw_command_text are scrubbed by redact_text()."""
+        store = GuardStore(tmp_path / "guard-home")
+        token = "ghp_" + "abc123def456"
+        secret_cmd = f"curl -H 'Authorization: Bearer {token}' https://api.internal/data"
+        artifact = GuardArtifact(
+            artifact_id="codex:cmd:secret",
+            name="curl-with-token",
+            harness="codex",
+            artifact_type="command",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command=secret_cmd,
+            metadata={"raw_command_text": secret_cmd},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        evaluation = _make_evaluation("codex:cmd:secret", tmp_path)
+        queued = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1/pending",
+            redaction_level="none",
+        )
+        assert len(queued) == 1
+        raw = queued[0]["raw_command_text"]
+        assert raw is not None
+        assert token not in raw
+        assert "curl" in raw
+
+    def test_raw_command_text_falls_back_to_artifact_command(self, tmp_path):
+        """When metadata lacks raw_command_text, falls back to artifact.command."""
+        store = GuardStore(tmp_path / "guard-home")
+        artifact = GuardArtifact(
+            artifact_id="codex:cmd:fallback",
+            name="fallback-cmd",
+            harness="codex",
+            artifact_type="command",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command="npm install evil-pkg",
+            metadata={},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        evaluation = _make_evaluation("codex:cmd:fallback", tmp_path)
+        queued = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1/pending",
+            redaction_level="none",
+        )
+        assert len(queued) == 1
+        assert queued[0]["raw_command_text"] == "npm install evil-pkg"
+
+    def test_raw_command_text_persisted_in_store(self, tmp_path):
+        """raw_command_text survives store round-trip (INSERT then SELECT)."""
+        store = GuardStore(tmp_path / "guard-home")
+        req = GuardApprovalRequest(
+            request_id="store-test-1",
+            harness="codex",
+            artifact_id="codex:cmd:store",
+            artifact_name="store-cmd",
+            artifact_hash="hash-store",
+            policy_action="require-reapproval",
+            recommended_scope="artifact",
+            changed_fields=("command",),
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            review_command="hol-guard approvals approve store-test-1",
+            approval_url="http://127.0.0.1/pending",
+            raw_command_text="rm -rf /var/tmp/*",
+        )
+        store.add_approval_request(req, "2026-06-27T00:00:00+00:00")
+        with store._connect() as conn:
+            rows = list_approval_requests(conn, limit=10)
+            assert len(rows) == 1
+            assert rows[0]["raw_command_text"] == "rm -rf /var/tmp/*"
+            single = get_approval_request(conn, "store-test-1")
+            assert single["raw_command_text"] == "rm -rf /var/tmp/*"
+
+    def test_surface_runtime_passes_redaction_level(self, tmp_path):
+        """GuardSurfaceRuntime.queue_blocked_operation passes redaction_level
+        through to queue_blocked_approvals, so 'none' includes the command."""
+        from codex_plugin_scanner.guard.runtime.surface_server import GuardSurfaceRuntime
+
+        store = GuardStore(tmp_path / "guard-home")
+        runtime = GuardSurfaceRuntime(store=store)
+        store.upsert_guard_session(
+            session_id="surf-1",
+            harness="codex",
+            surface="cli",
+            status="active",
+            client_name="test",
+            client_title="Test",
+            client_version="1.0",
+            workspace=None,
+            capabilities=["approval-resolution"],
+            now="2026-06-27T00:00:00+00:00",
+        )
+        artifact = GuardArtifact(
+            artifact_id="codex:cmd:surf",
+            name="surf-cmd",
+            harness="codex",
+            artifact_type="command",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command="docker run --rm alpine cat /etc/passwd",
+            metadata={"raw_command_text": "docker run --rm alpine cat /etc/passwd"},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        evaluation = _make_evaluation("codex:cmd:surf", tmp_path)
+        response = runtime.queue_blocked_operation(
+            session_id="surf-1",
+            operation_type="run",
+            harness="codex",
+            metadata={},
+            detection=detection.to_dict(),
+            evaluation=evaluation,
+            approval_center_url="http://127.0.0.1/pending",
+            approval_surface_policy="always",
+            open_key=None,
+            opener=lambda url: None,
+            redaction_level="none",
+        )
+        queued = response.get("approval_requests", [])
+        assert len(queued) == 1
+        assert queued[0]["raw_command_text"] == "docker run --rm alpine cat /etc/passwd"
+
+    def test_surface_runtime_redaction_full_suppresses_command(self, tmp_path):
+        """GuardSurfaceRuntime with redaction_level='full' suppresses raw_command_text."""
+        from codex_plugin_scanner.guard.runtime.surface_server import GuardSurfaceRuntime
+
+        store = GuardStore(tmp_path / "guard-home")
+        runtime = GuardSurfaceRuntime(store=store)
+        store.upsert_guard_session(
+            session_id="surf-2",
+            harness="codex",
+            surface="cli",
+            status="active",
+            client_name="test",
+            client_title="Test",
+            client_version="1.0",
+            workspace=None,
+            capabilities=["approval-resolution"],
+            now="2026-06-27T00:00:00+00:00",
+        )
+        artifact = GuardArtifact(
+            artifact_id="codex:cmd:surf2",
+            name="surf-cmd2",
+            harness="codex",
+            artifact_type="command",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command="docker run --rm alpine cat /etc/passwd",
+            metadata={"raw_command_text": "docker run --rm alpine cat /etc/passwd"},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        evaluation = _make_evaluation("codex:cmd:surf2", tmp_path)
+        response = runtime.queue_blocked_operation(
+            session_id="surf-2",
+            operation_type="run",
+            harness="codex",
+            metadata={},
+            detection=detection.to_dict(),
+            evaluation=evaluation,
+            approval_center_url="http://127.0.0.1/pending",
+            approval_surface_policy="always",
+            open_key=None,
+            opener=lambda url: None,
+            redaction_level="full",
+        )
+        queued = response.get("approval_requests", [])
+        assert len(queued) == 1
+        assert queued[0]["raw_command_text"] is None

{plugin_scanner-2.0.906 → plugin_scanner-2.0.908}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.906"
+version = "2.0.908"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },