ghost-hands v0.9.1

ghost-hands 0.9.1 — hardening patch

A security-hardening patch over 0.9.0 — no new features, no new dependencies, governed-action semantics unchanged (classify → record → approve → execute; timeouts and errors still always deny). Full audit detail, pre-fix proofs, and cleared non-findings: HARDENING_091.md in the repo. New regression suite: tests/test_hardening_091.py (35 tests).

Fixed:

• HIGH — Replay-export code injection (export.py): page-controlled element names went raw into # comments in graduated replay scripts; a newline in a name broke out and became executable Python. Comments now fold all control characters to spaces.
• HIGH — Chromium file:// navigation (drivers.py): any scheme was navigable; a governed navigate to file://… classified readonly and a following extract read the local file back to the decider. open/open_tab now allow only http/https (plus data:/about: fixtures), with browser-style whitespace stripping before the scheme check.
• MEDIUM — Governor domain bypass (governor.py): allow/block lists checked only the starting page's host; evaluate() now also checks the target's href and form-action hosts.
• MEDIUM — MCP server crash on hostile messages (mcp_server.py): non-dict payloads / wrong-shape params raised uncaught errors and killed the stdio loop. Now proper -32600/-32602 errors, type-validated args, 16 MiB line cap, generic -32603 on unexpected errors — the loop always survives.
• MEDIUM — BusClient validation (busclient.py): file:///ftp:// bus URLs and workspace ids like ../../admin were accepted. Now http(s)-only, slug-only workspaces, 16 MiB response cap.
• LOW — Response caps in Android driver (32 MiB), PhoneApprover (1 MiB, oversize still fails closed to deny), decider (16 MiB), doctor probes (1 MiB).
• LOW — Credential-file permissions: trail files (which record typed text verbatim) and save_session files now created 0600; pre-existing loose files tightened.
• LOW — Download filename traversal: CDP suggestedFilename reduced to its bare name at ingestion.

Verification: new hardening tests 35/35; full suite 442 passed, 1 failed — the failure (test_hosted_workspace_prefix_end_to_end) is pre-existing on the unmodified 0.9.0 baseline: it depends on an external GhostBus hosted server answering /health, which this environment can't reach; it fails before any ghost-hands code runs. Clean-venv pip install of the 0.9.1 wheel verified: imports 0.9.1, ghost-hands demo exits 0.

By Ghost Developer Studio. MIT licensed.