Repository navigation
feat(plugins): add NkAntony777/scansci-pdf academic paper retrieval plugin - #64
NkAntony777 wants to merge 15 commits into
Conversation
…lugin Wraps the upstream scansci-pdf engine (Rimagination/scansci-pdf, Apache-2.0, v1.17.0) as two Skills (download/search/troubleshoot + large-list triage) and a stdio MCP server (scansci-pdf run). Engine installed from PyPI, not vendored; credentials and config stay local.
- add .minimax-plugin/plugin.json (MiniMax V1 manifest) required by marketplace validation - rename mcp.json -> scansci-pdf.mcp.json and align with *.mcp.json schemaVersion format - add icon.png referenced by the manifest
- re-encode icon.png to a clean 512x512 RGBA PNG (drops the non-standard caBX chunk carried from the source image, matching the standard chunk profile of icons already accepted by the marketplace) - bump package version after content change per submission guide
…17.2 The description contained 'DOIs): classify' - a colon+space inside an unquoted YAML scalar breaks frontmatter parsing (Marketplace V1 check SKILL_FRONTMATTER_INVALID). Reworded to a comma construction; verified both SKILL.md frontmatters parse with a YAML parser.
hetaoBackend
left a comment
hetaoBackend
left a comment
There was a problem hiding this comment.
Request changes for exact current head b523ef43ec9fef79c83dc03efbdba07b689290d6.
Blocking supply-chain/security/host-contract issues:
- The public
oa_urlqueue field is fetched with redirects and no loopback/private/link-local/metadata/DNS-rebinding policy. A controlled loopback PDF URL was accepted and requested. Enforce per-hop public HTTPS/IP validation at the actual connection boundary and add redirect/rebinding regressions. - The MCP-exposed Tor installer downloads a tar and uses unchecked
tarfile.extractall(), then marks discovered binaries executable. A../member was reproduced writing outside the target directory. Reject absolute/traversal/link members and verify a pinned signature/hash before extraction/execution. - Plugin manifests say 1.17.2, but that upstream/PyPI version does not exist; README references 1.17.0, installation is unpinned, and MCP executes bare
scansci-pdffrom PATH. Pin an existing audited package plus integrity/provenance and bind the launched executable/version. springer_api_keyis omitted from masking and can be returned byscansci_pdf_config; config/cookie state is written without restrictive mode (reproduced as 0644 under umask 022). Mask all credentials and use 0600/symlink-safe persistence.- Core Skill workflows reference
scripts/sort_finalize_writeback.pyandscripts/sort_mdpi_res_batch.py, but those scripts are not packaged. The nonstandardscansci-pdf.mcp.jsonis also not validated by the repository’s rootmcp.jsoncontract. Ship and test the actual package/host layout. - Cache/output/destructive paths lack workspace containment, symlink policy and confirmation; paper content is returned into model context without an explicit prompt-injection trust boundary.
Exact-head CI/CodeQL are action_required; the only visible check is [code]smith = SKIPPED, which is not evidence.
|
@hetaoBackend — updated PR #64 to commit Thanks for the detailed review. This revision vendors and patches the engine directly, based The actual connection layer now validates DNS answers and uses numeric destination addresses, Local Windows evidence: 429 engine tests passed, 3 skipped; actual stdio MCP integration and REVIEW-NOTES.md contains the details and limitations: remote browser daemons/private-intranet Additional disclosure: the repository-wide Please re-review the updated head when convenient. |
hetaoBackend
left a comment
hetaoBackend
left a comment
There was a problem hiding this comment.
Request changes for exact current head f3d8b1c9529d3221b4b423d995897263f1da04b1.
The unified public-HTTPS transport and source-hash checks improve the previous SSRF and vendoring findings, but this exact head still exposes multiple merge-blocking security surfaces:
- RemoteAssist is an unauthenticated LAN control surface.
vendor/scansci-pdf/src/scansci_pdf/remote_assist.py:229-237bindsHTTPServer(("0.0.0.0", port), ...); focused probes received unauthenticated 200 responses from/api/statusand/api/done. Bind to loopback by default; if LAN access is required, add explicit owner confirmation, short-lived authentication and CSRF protection. Escape dynamicpublisher/browser_urlvalues before inserting them into the HTML template. - The optional web UI also defaults to unauthenticated
0.0.0.0.src/scansci_pdf/main.py:64-78defaultsweb --hostto0.0.0.0;src/scansci_pdf/web.py:97-190exposes unauthenticated/api/download,/api/search, and/api/status. Bind loopback by default or remove this entrypoint from the hosted package; add authentication, CSRF protection, and complete workspace/path containment for downloads. - Proxy credentials can be disclosed in diagnostics and recommendations.
vendor/.../sources/scoring.py:153-165,201-213places rawSCANSCI_PDF_PROXY/config proxy URLs into report fields and error recommendations. This includesuser:password@hostforms and bypasses the otherwise improved masking path. Redact structurally at every MCP/CLI/health/recommendation/error boundary, including empty usernames, IPv6 and encoded credentials; never return raw proxy URLs. - Browser login persists more credential state than necessary.
vendor/.../browser_login.py:171-187falls back from publisher cookies to the entire cookie jar;browser_cookies.py:108-150persists all cookies and all discovered localStorage origins. This can retain unrelated IdP/SSO sessions and other domains. Restrict custom login destinations to an allowlist, save only the target-domain minimum cookie fields, disable localStorage persistence by default, and require explicit confirmation for any broader capture. - The secure launcher is not self-contained in a clean environment.
vendor/scansci-pdf/run_secure.py:52-83importspackagingbutvendor/scansci-pdf/pyproject.tomldoes not declare it as a direct dependency; isolatedrun_secure.py --verifyfails withModuleNotFoundError: packaging. Add it to the package dependency and lock/bootstrap contract, then run the launcher and actual stdio MCP in a clean environment. Version-only checks are not independent provenance for the executing distribution. - Browser executable provenance remains uncontrolled. The browser backend accepts PATH-discovered or arbitrary configured executables without a release signature/hash and does not apply the same symlink/provenance gate consistently. Restrict to verified allowlisted binaries and document the install/update provenance.
Repository validation passed and the vendored source hash manifest matched, but Python tests, actual stdio MCP, browser/Tor integration, and launcher verification were not independently green in this review environment. [code]smith = SKIPPED was not used as evidence. Do not approve or merge until the network surfaces, credential persistence/redaction, launcher dependency contract, and exact-head runtime evidence are fixed.
…enance Addresses the six merge-blocking findings on the previous head. RemoteAssist bound 0.0.0.0 and answered unauthenticated /api/status and /api/done, so anyone on the LAN could drive the verification flow. It now binds 127.0.0.1 unless the caller passes allow_lan=True *and* the config sets remote_assist_lan, and every request carries a per-start bearer token compared with hmac.compare_digest. The loopback bind is authenticated too: every process on the host can reach 127.0.0.1, and one code path means auth cannot be skipped by accident. POST /api/done additionally requires X-Requested-With, which a cross-site form post cannot set. The page's publisher and browser_url are html.escape'd before interpolation. The optional web UI defaulted --host to 0.0.0.0 behind unauthenticated /api/download, /api/search and /api/status. The default is now 127.0.0.1 and the endpoints require a bearer token plus the same CSRF header. /api/download resolves and containment-checks the returned path against the configured output directory and refuses symlinks, instead of serving any path the download layer returned. This also fixes a pre-existing defect: _PAGE_TEMPLATE.format() raised KeyError on the inline CSS braces, so the assist page returned 500 on every request. Slots are filled explicitly instead. Raw proxy URLs reached report fields, recommendations and error strings. redact_proxy_url delegates to the existing config.mask_config_value rather than adding another implementation, and covers the empty-username form that helper missed; mask_config_value itself now masks that form too. No raw proxy URL is returned on any boundary, including the ProxyError path. Browser login no longer falls back to the entire cookie jar, and cookies and localStorage are persisted scoped to the target domain; localStorage is opt-in. Custom login destinations are allowlisted, and the publisher-cookie match is dot-anchored so evil-sciencedirect.com is no longer accepted. run_secure.py imported packaging without declaring it, so an isolated --verify failed with ModuleNotFoundError. It is now a declared dependency, and a missing one produces an actionable install message. --verify also states what it actually proves: local hashes and installed dependency versions, not upstream provenance. Browser executables were accepted from PATH or arbitrary config. A new provenance gate requires an allowlisted system-browser root or the engine cache, reuses the existing no_symlinks gate, and honours a pinned digest; SCANSCI_PDF_TRUST_BROWSER_PATH is the explicit opt-out. Provenance here is "the file the owner approved", not a vendor code-signature check. 493 tests pass. The 2 remaining failures need the optional camoufox and cloakbrowser backends and fail identically before these changes. No live SSO round-trip was exercised: cookie scoping is covered by unit tests.
…t survived Follow-up to the previous head, addressing what a second review could still reach. Proxy credentials still escaped through paths other than network_diagnose. The failure-tips builder in sources/__init__.py interpolated raw proxy URLs into tips returned to the model and the CLI, config-cmd echoed the value it was given and printed network_proxy and browser_static_proxy directly, and a credential with no scheme (user:pass@host) was passed through unredacted. mask_config_value is now the single implementation and covers the schemeless form; the duplicate regex in redact_proxy_url is gone. One test pinned the schemeless pass-through; that expectation encoded the leak and was inverted. Cookie scoping stayed wider than the target domain: scoped_cookies kept every known publisher's cookie, so one login left a live session behind for all of them. It is now target-domain only. WebVPN/EZProxy are unaffected because they proxy the publisher under the proxy hostname, which is the target. _is_publisher_cookie is dot-anchored so evil-sciencedirect.com cannot match. browser_persist_localstorage joins the confirmed:true set in strict mode, so the model can no longer enable it without owner confirmation. Browser provenance had three bypasses. channel="chrome" — the default backend path — launched whatever Playwright resolved, ungated; the browser is now resolved through the gate and passed as executable_path, and the bundled Chromium retry is gated too. CLOAKBROWSER_BINARY_PATH was accepted without validation. And SCANSCI_PDF_TRUST_BROWSER_PATH returned before the digest comparison, so the escape hatch also disabled hashing; it now relaxes only the allowlist, never a pinned digest. Cache-root binaries require a pinned digest because the cache is writable at runtime. Per-user installs are reachable but also require a digest, so a per-user Chrome is a configuration step rather than a dead end. Token exposure was wider than the authenticated routes. The web page rendered the bearer token into an inline script while loading Tailwind and Alpine from two CDNs, any of which could read it and call the local API. The token is no longer rendered at all: the ?t= link hands it over once as an HttpOnly, SameSite=strict cookie, and page JavaScript authenticates via that cookie. A CSP now constrains script/style/connect sources on every response, and /docs, /redoc and /openapi.json are disabled on an authenticated surface. uvicorn's access log records the full request target, so it no longer runs at all for the web command. RemoteAssist keeps its inline token but serves a CSP that permits no external script, stops logging the authenticated URL, and refuses an expired token even when the constant-time comparison would match. 517 tests pass. The 4 remaining failures need the optional camoufox, cloakbrowser and pymupdf4llm packages and fail identically before these changes. Manifest regenerated and verified in both directions (167 entries, no mismatches, no tracked source missing). No live SSO round-trip was exercised; cookie scoping is covered by unit tests.
…arty Program Files was treated as a user-writable root, so the stock Chrome and Edge installs were rejected without a pinned digest, and a rejected bundled Chromium aborted a browser that had already passed the gate. The web UI no longer loads third-party scripts. Its own code is nonce-bound, and setup --show masks proxy passwords. Co-authored-by: Cursor <cursoragent@cursor.com>
|
@hetaoBackend — updated PR #64 to commit
Local evidence: the provenance, token-exposure, and proxy-redaction tests passed (60 passed, 1 skipped because this environment cannot create symlinks). I am not counting approval-pending GitHub jobs as passes. Please re-review the updated head when convenient. |
hetaoBackend
left a comment
hetaoBackend
left a comment
There was a problem hiding this comment.
Request changes for exact current head 9e83a1bccc8a48e7b0f58a0edee746e207fb3968.
The new head closes important portions of the prior review: RemoteAssist and the optional Web UI default to loopback with auth/CSRF, proxy diagnostics in scoring.py are redacted, packaging is declared and locked, and source-hash verification is stronger. The following exact-head blockers remain:
- Browser credential persistence still has bypass paths. Although
browser_login.pyhas scoped/minimal helpers, restore accepts all cookies/localStorage frombrowser_state.jsonwithout reapplying domain scope or the localStorage opt-in. Other login flows directly persist fullcontext.cookies(), includingauth.py,instsci.py, and_publisher_strategies_core.pythroughsession_store.py. This can retain unrelated IdP/SSO and other-publisher sessions. Route every persistence/restore path through target-domain filtering and minimum fields; default localStorage persistence off and enforce the same policy on restore. - Camoufox launch paths are not provenance-gated.
browser_backend.py:588-691callsNewBrowser(...)directly; strict mode only checks the installation directory exists (:736-741,:786-789) and does not verify the actual executable with the Patchright-style symlink/signature/hash gate. An altered binary inside the directory can therefore execute despite the new provenance policy. Gate both ordinary and persistent Camoufox launches on the actual executable and verified provenance. - Exact-head runtime evidence is absent. GitHub reports zero check-runs/statuses for this head (
gh pr checksreports no checks), so the workflow file and producer's local “429 passed” claim do not establish the Python suite, clean launcher, stdio MCP, browser, Tor, or Windows/Ubuntu contract. Run and retain the exact-head workflow results before approval. - The explicit non-loopback streamable HTTP mode remains unauthenticated.
main.py:50-54launchesmcp_app.streamable_http_app()directly when--mode streamable_http --host 0.0.0.0is supplied, bypassing the Web UI's auth middleware. Either reject non-loopback HTTP without an authenticated transport or enforce auth at this entrypoint. - Proxy redaction is not a single egress boundary. Raw proxy values still reach at least
auth.pylogging/launch arguments and other source failure/result paths outsidescoring.py. Ensure logs, process arguments, MCP results and exception/source-failure objects cannot contain credential-bearing proxy URLs.
node validation/source-hash checks are positive, but they do not close these runtime and provenance gaps. [code]smith = SKIPPED was not used as evidence. Do not merge this head.
… 3.11 floor The browser and base locks pinned networkx==3.7 and numpy==2.5.3, which exclude Python 3.11 (networkx 3.7 via file-level Requires-Python, numpy 2.5.x by shipping only cp312+ wheels). requires-python is >=3.11 and the engine CI matrix includes 3.11, so the first real CI run failed at dependency install. Repin to the highest 3.11-compatible versions (networkx 3.6.1, numpy 2.4.6) with full PyPI hashes in both locks and regenerate SOURCE-HASHES.json. Verified: hash-locked installs on Python 3.11 and 3.13; full engine suite 767 passed / 5 skipped on both.
The first Linux CI run exposed four test-harness assumptions that held only on a wide Windows console: - Typer help assertions matched raw stdout; at CI's 80-column default the Rich output wraps and styles those substrings away. Normalize ANSI and whitespace before asserting. - Two stdio lifecycle tests closed stdin by hand before communicate(); POSIX Popen.communicate() then flushes the closed stdin and raises. communicate(input=...) writes, flushes and closes stdin itself. - The taskkill tree-kill test relied on the host being Windows to select the branch; patch os.name like the posix test does. - The real-Chromium guard ignored SCANSCI_AUDIT_BROWSER and hardcoded the Windows Chrome path, so the ubuntu leg skipped the round trip. Read the env var (Windows default unchanged) and point the ubuntu matrix at /usr/bin/google-chrome. Full suite 767 passed / 5 skipped at COLUMNS=80 with the real Chrome round trip enabled.
…e real Chrome binary Two leftovers from the first Linux run: - The staged stdio handshake test closed stdin immediately after the write, racing the server's EOF shutdown against the tools/list answer on fast hosts: initialize was answered, tools was dropped. Read the responses with stdin still open (a real client waits before closing), then close to confirm the clean exit. - The ubuntu matrix pointed at /usr/bin/google-chrome, which is a symlink to /opt/google/chrome/chrome; the provenance gate refuses symlinks by design, so the real-browser round trip failed with SecurityError. Point at the real binary.
On POSIX, Popen.communicate() flushes self.stdin unconditionally, so calling it after a manual stdin.close() raises 'flush of closed file' even with input=None — exactly what the handshake test hit after waiting for the tools response. Drain both pipes with reader threads and await the child with wait() instead; the finally path gets the same treatment (a second communicate() after the first failed mid-state raised AttributeError: no attribute '_fileobj2output').
|
Reply to the third-round review (head
Local verification at this head: 767 passed / 5 skipped on Windows Python 3.11 and 3.13 with Not claimed: real Camoufox/Firefox launch evidence, Linux desktop testing beyond CI, or physical power-loss durability. |
hetaoBackend
left a comment
hetaoBackend
left a comment
There was a problem hiding this comment.
Request changes for exact current head 0acd104afbfc088b3411cedd45f3f3a803c8b6a8.
The head adds substantial hardening and tests, but exact-head review still found merge-blocking credential and trust-boundary gaps:
- Native persistent browser profiles bypass the scoped credential policy.
browser_engine.py:331-343intentionally preserves all cookies/localStorage across restarts, and real publisher/auth/batch flows use this persistent context. Those browser-native profile writes and restores do not pass through target-domain/minimum-field filtering or thebrowser_persist_localstorageopt-in, so unrelated IdP/SSO state and legacy profile credentials remain persistent. - Legacy cookie migration accepts partially specified security state.
browser_cookies.py:320-335treats a record as non-legacy when it contains any one security field, after which missing attributes are filled with defaults. A cookie containing onlysecure:true, or onlyexpires, was restored with missinghttpOnly/other fields weakened. Require the complete security-field set or discard/migrate explicitly. - Zotero API credentials can cross origins on redirects.
zotero.py:142-149,323-361uses ordinaryrequests.postwithZotero-API-Key, whilecredential_transport.py:7-10confines only Elsevier/Authorization headers. A controlled requests redirect fromapi.zotero.orgto another origin retained the syntheticZotero-API-Key. Use an origin-confined session that also covers Zotero headers; independently allowlist and confine any response-supplied upload URL/authorization secret. - Browser provenance configuration is not enforced at every launch site. Multiple real calls to
browser_backend.launch/get_persistent_contextomitconfig, bypassing owner-selected backend/executable/digest pins even though the lower-level provenance gate is stronger. Propagate one trusted config through every Patchright/Camoufox/persistent launch path and assert the actual executable. - Sensitive-output and trust-write boundaries remain incomplete.
elsevier-checkprints the full institutional token,config-cmdechoes arbitrary secret values, and several trust-sensitive proxy/backend settings can still be saved without the unified owner-confirmation gate. Apply one global secret scrubber to CLI/log/error/MCP egress and route every trust-sensitive update through a mandatory confirmation boundary. - The secure launcher contract is not fully isolated or portable.
mcp.jsoninvokes barepython, which is absent on supported environments that expose onlypython3;run_secure.pydoes not independently enforce the declared Python >=3.11 floor or isolate inherited interpreter startup state. Bind a supported interpreter/bootstrap path and add a clean-environment stdio handshake. - No main-repository exact-head Checks are visible.
statusCheckRollupis empty, so the claimed Python 3.11/3.13 suite, stdio handshake, browser integration and credential regressions are not service-side evidence for this PR head.
Source hashes and syntax checks are positive, but they do not close these runtime boundaries. Do not approve or merge this head.
|
@hetaoBackend — CI permissions clarification, verified on 2026-10-14. I do not have permission to approve/start the approval-gated CI runs or re-run workflows in the upstream For the current PR head I can trigger workflows in my own fork. The corresponding exact-head engine-check run there is verified That fork-hosted result is separate evidence; it does not unblock or substitute for the upstream PR checks. Could a maintainer with the necessary permissions please approve the pending upstream workflows for this head and re-run them if needed? I cannot remove this approval gate myself. |
|
@hetaoBackend — the October 12 review fixes are now committed and pushed in Implementation points 1-6:
Fresh validation, repeated both before commit and from a clean Git archive of the submitted commit:
New-head fork CI is success (all four jobs): Ubuntu Python 3.11/3.13 each: 1001 passed / 6 skipped / 0 failed. Windows Python 3.11/3.13 each: 1005 passed / 2 skipped / 0 failed. All four record the exact SHA, verify source/dependency locks, run browser-enabled regressions and pass delivered MCP stdio acceptance. Linux skips two Windows junction cases, two approved-Edge-specific cases, the absent second checkout and the optional Generic prefix case; Windows skips only the last two. This supersedes the older fork result for Point 7 remains an upstream release gate, not a code fix I can authorize. The new-head upstream engine checks, CI and CodeQL are I re-tested approval and re-run on that new-head run after refreshing my fork workflow credentials: both still return HTTP 403: Other explicit limits: no live institutional account login/publisher entitlement, physical power-loss test, macOS coverage or native OS sandbox is claimed. Details and reproducible checks are in |
hetaoBackend
left a comment
hetaoBackend
left a comment
There was a problem hiding this comment.
Request changes for exact current head a31c76828bf1f31500fe10f7e4c475da53821f36.
The current diff appears to close the previously reported native-profile persistence, cookie-scope/migration, Zotero upload-origin/credential, browser-executable provenance, trust-sensitive config, secret-egress, and packaged launcher boundaries. A focused exact-head run of the new browser/config/Zotero/source-loader regressions reported 198 passed, 3 skipped, 0 failed on macOS/Python 3.13.
One release blocker remains: this exact head has no upstream GitHub Checks at all. The submitted workflow declares Ubuntu/Windows × Python 3.11/3.13 coverage and the local notes explicitly distinguish local/fork runs from upstream evidence, but GitHub currently exposes no completed ScanSci workflow, main CI, or CodeQL job for a31c7682.... Run the approval-gated workflows on this exact head and retain successful cross-platform results before approval. Local results and author-reported Windows runs cannot replace repository-owned exact-head Checks.
No previously closed code finding is being re-opened here; this review is limited to the missing exact-head release evidence. [code]smith = SKIPPED, if it appears, is not test evidence.
|
@hetaoBackend — thank you for the fifth-round review, and for independently running the new browser/config/Zotero/source-loader regressions on macOS/Python 3.13. The head is unchanged since your review:
The three runs pending approval for this exact head, all currently
Each run page exposes an "Approve and run" control (they also appear under "Awaiting approval" in the Actions tab). Approving them will produce exactly the repository-owned, exact-head, cross-platform Checks your review requires — no code change is involved. For the record: the same workflow file at this exact commit SHA is green when hosted in the fork — all four jobs (Ubuntu/Windows × Python 3.11/3.13), each job recording the verified SHA and re-verifying the source/dependency locks: https://github.com/NkAntony777/MiniMax-Code-Plugins/actions/runs/38521185585 . As stated previously, this remains separate evidence and not a substitute for the upstream Checks. Please approve the three pending runs when convenient; I will confirm the results here as soon as they complete. |
hetaoBackend
left a comment
hetaoBackend
left a comment
There was a problem hiding this comment.
Approve exact current head a31c76828bf1f31500fe10f7e4c475da53821f36.
The previously reported browser profile/cookie scope, Zotero upload-origin and credential confinement, browser executable provenance, trust-sensitive config, secret-egress, and packaged launcher concerns are closed by the current diff. Local focused coverage is 198 passed / 3 skipped / 0 failed, and the repository-owned exact-head Checks are now green for CI, CodeQL, and ScanSci Ubuntu/Windows Python 3.11/3.13. The PR is MERGEABLE/CLEAN at this exact head.
…the official dev environment 15.0.24 was removed from the primary dist.torproject.org mirror and 15.0.25 is a security update (Firefox fixes, Tor 0.4.9.14, OpenSSL 3.5.9). All six TOR_HASHES pins come from the release sha256sums-signed-build.txt fetched from both mirrors; the real Windows x86_64 archive matched the new pin and passed guarded extraction. README now defines the official CPython 3.11 .venv provisioned from requirements-browser.lock, mirroring CI. Full suite: 1002 passed / 5 skipped / 0 failed (147.13s, real Edge).
|
@hetaoBackend — confirming results, plus one new commit. Previous head
New head
This new head's upstream runs are
The exact-head fork-hosted engine run is in progress: https://github.com/NkAntony777/MiniMax-Code-Plugins/actions/runs/38677749671 (as always, separate evidence, not an upstream Check). Please approve the three pending upstream runs when convenient. |
2 participants
Add ScanSci PDF: source-only academic paper retrieval plugin
Package and maintenance
This plugin supplies two Skills (
scansci-pdfandscansci-sort) and a localstdio MCP server for DOI/arXiv retrieval, search, citations and reading-list
triage. It vendors a patched source-only fork of upstream ScanSci PDF v1.18.0,
commit
ec812f085f392a9b67768fbcad7ddeb340e0245f, under Apache-2.0.The submitted plugin is
1.18.0-minimax.2; the vendored engine is1.18.0.post2. It includes Python source and packaged helper scripts, not onlyMarkdown/JSON. It does not use a PyPI engine installation or a
scansci-pdfexecutable found on PATH. No precompiled engine extensions, browser binaries,
credentials or downloaded Tor executables are bundled.
Dependencies and startup
from
vendor/scansci-pdf/requirements.lockinto a prepared Python environment;browser workflows use
requirements-browser.lockand an owner-installed browser.mcp.jsonstartslaunch_secure.mjs, which probes a supported interpreter,binds its absolute path and launches
run_secure.pywith Python-I.SCANSCI_PDF_PYTHONcan name the absolute interpreter of the prepared environment.These checks are local integrity checks, not upstream signatures or an
interpreter/site-package authenticity attestation.
workspace. Direct Python invocation requires
python -I .../run_secure.py.Data and network behavior
Configuration, caches and scoped credential exports stay in the active project's
private
.scansci-pdf/directory, not an implicit home-directory engine state.Python path/write checks reject existing symlink/junction escapes. Destructive
cache operations and workbook overwrite require explicit owner confirmation.
Requests contact scholarly APIs, publisher/CDN endpoints, enabled mirrors and
user-authorized institutional gateways. Users can select
legal_onlyto restrictretrieval sources. Unpaywall requires the user's real email. Institutional routes
require the user's own account/entitlement; no account or access is supplied.
Hosted transport requires public HTTPS, validates destinations at connection and
redirect boundaries, and retains hostname TLS validation. Explicit owner-configured
proxies remain supported. Local browser traffic uses an authenticated CONNECT guard;
remote browser services are unavailable in hosted mode. Paper content, links and
metadata are treated as untrusted external data, not instructions.
Response to the October 12 review
This revision targets the seven findings on
0acd104:exports are restored; localStorage requires opt-in and an exact origin.
migration. Incomplete legacy records require re-login rather than weakened defaults.
allowlisted; uploads do not receive API keys or follow redirects. One multipart
stream is followed by checked API-origin registration.
selection and verify the actual program and digest, including Camoufox.
saves use typed trust-change comparison and independent mutable defaults, and require
actual boolean confirmation. A valid replacement for a corrupt stored pin requires
confirmation too, rather than silently inheriting trust or permanently blocking repair.
locked SDK, including its current and legacy schema attribute names.
read-only access to the upstream repository; actual approval and re-run API requests
were rejected with HTTP 403 on October 14. Local tests and successful fork runs do not
substitute for upstream Checks.
Validation and explicit limits
Local results, reproducible checks and skipped cases are recorded in
REVIEW-NOTES.md;REVIEW-REPLY.mdis the corresponding review response.The submitted SHA and service-side workflow results are recorded separately in the PR.
These local documents do not claim upstream CI/CodeQL approval or a green upstream check.
an approved installed Edge browser and local intercepted fixtures.
mcp.json-> Node -> isolated Python stdio: both versions pass, 18 tools.and no mismatches. Repository schema validation and static checks pass.
one symlink-privilege failure and five unchanged octopus-meme-maker smoke assertions.
No repository-wide green result is claimed.
Windows Python 3.11/3.13 and locally intercepted real Edge fixtures are the local
runtime coverage. Live institutional login, publisher entitlement, successful live
Zotero upload, real Camoufox/Firefox, and Linux/macOS runtime behavior are not
established by those fixtures. Python audit checks are not an OS sandbox and do not
claim resistance to concurrent replacement of filesystem ancestors.
This description supersedes the original PyPI/PATH-only packaging description: the
submitted package vendors and executes the verified source-only engine described here.
Submitted Head and Fork CI - October 14
The repaired commit is
a31c76828bf1f31500fe10f7e4c475da53821f36, now pushed to this PR.Its exact-head fork-hosted engine workflow is success:
https://github.com/NkAntony777/MiniMax-Code-Plugins/actions/runs/38521185585
All four jobs record the checked-out SHA, verify delivered source/dependency
locks, execute browser-enabled engine regressions and pass actual packaged
Node/isolated-Python MCP stdio acceptance (18 tools).
Linux skips two Windows junction cases, two approved-Edge-specific cases, the
absent second-checkout comparison and the optional Generic-strategy prefix case.
Windows skips only the last two. These are scoped fork results, not upstream
Checks or live-account/Zotero-upload evidence.
Local tests were also repeated from a clean Git archive of this submitted SHA:
Python 3.11.17 and 3.13.16 each give 1002 passed / 5 skipped / 0 failed on the
local Windows host; both actual delivered stdio checks pass. The root npm suite
still has the six unrelated/host-permission failures disclosed earlier.
Upstream release gate: this commit's upstream CI, CodeQL and engine-check
runs remain
action_required; no upstream check runs are visible and theengine workflow has zero jobs:
https://github.com/MiniMax-AI/MiniMax-Code-Plugins/actions/runs/38521089253
After refreshing the credentials needed to push the fork workflow, I tested
approval and re-run on that new-head upstream run again: both returned HTTP 403,
Must have admin rights to Repository.My upstream repository access remainsread-only. A maintainer must approve/run these workflows; fork success does not
substitute for successful upstream PR Checks.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.