plugin-scanner 2.0.1005__tar.gz → 2.0.1007__tar.gz

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/.github/workflows/devcontainer-features.yml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   validate:
@@ -25,7 +24,7 @@ jobs:
           for dir in devcontainer-features/*/; do
             if [ -f "${dir}devcontainer-feature.json" ]; then
               echo "Checking ${dir}devcontainer-feature.json"
-              python3 -c "import json; json.load(open('${dir}devcontainer-feature.json'))" \
+              python3 -m json.tool "${dir}devcontainer-feature.json" > /dev/null \
                 || { echo "Invalid JSON: ${dir}devcontainer-feature.json"; exit 1; }
               echo "  OK"
             fi
@@ -47,6 +46,9 @@ jobs:
     needs: validate
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
 

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1005
+Version: 2.0.1007
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard
@@ -425,7 +425,7 @@ Options:
 | Option | Default | Description |
 | :--- | :--- | :--- |
 | `version` | `latest` | Pin to a specific release (e.g. `2.0.1004`) |
-| `initHarness` | `auto` | Configure for a specific harness: `codex`, `claude-code`, `cursor`, `gemini`, `opencode`, `pi`, or `auto` |
+| `initHarness` | `auto` | Harness to configure: `auto` (detect installed), `none` (skip init), or a specific name (`codex`, `claude-code`, `cursor`, `gemini`, `opencode`, `pi`) — informational, Guard auto-detects regardless |
 | `strictMode` | `false` | Enable strict mode on install |
 
 See [`devcontainer-features/hol-guard/README.md`](devcontainer-features/hol-guard/README.md) for details.

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/README.md

@@ -380,7 +380,7 @@ Options:
 | Option | Default | Description |
 | :--- | :--- | :--- |
 | `version` | `latest` | Pin to a specific release (e.g. `2.0.1004`) |
-| `initHarness` | `auto` | Configure for a specific harness: `codex`, `claude-code`, `cursor`, `gemini`, `opencode`, `pi`, or `auto` |
+| `initHarness` | `auto` | Harness to configure: `auto` (detect installed), `none` (skip init), or a specific name (`codex`, `claude-code`, `cursor`, `gemini`, `opencode`, `pi`) — informational, Guard auto-detects regardless |
 | `strictMode` | `false` | Enable strict mode on install |
 
 See [`devcontainer-features/hol-guard/README.md`](devcontainer-features/hol-guard/README.md) for details.

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/devcontainer-features/hol-guard/README.md

@@ -22,7 +22,7 @@ That's it. HOL Guard installs automatically on container build.
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
 | `version` | string | `latest` | HOL Guard version (`latest` or specific like `2.0.1004`) |
-| `initHarness` | string | `auto` | Harness to configure: `auto`, `codex`, `claude-code`, `cursor`, `gemini`, `opencode`, `pi`, or `none` |
+| `initHarness` | string | `auto` | `auto` (detect installed harnesses), `none` (skip init), or a specific name (`codex`, `claude-code`, `cursor`, `gemini`, `opencode`, `pi`) — informational only, Guard auto-detects regardless |
 | `strictMode` | boolean | `false` | Enable strict mode (blocks untrusted tool actions by default) |
 
 ## Example: Cursor + Strict Mode

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/devcontainer-features/hol-guard/devcontainer-feature.json

@@ -1,14 +1,14 @@
 {
   "name": "HOL Guard",
   "id": "hol-guard",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Installs HOL Guard — local-first security for AI coding agents. Intercepts tool actions before files change or networks are contacted.",
   "documentationURL": "https://hol.org/guard",
   "licenseURL": "https://github.com/hashgraph-online/hol-guard/blob/main/LICENSE",
   "options": {
     "version": {
       "type": "string",
-      "enum": ["latest", "2.0.1004"],
+      "proposals": ["latest", "2.0.1004"],
       "default": "latest",
       "description": "Select the HOL Guard version to install"
     },
@@ -16,7 +16,7 @@
       "type": "string",
       "enum": ["none", "auto", "codex", "claude-code", "cursor", "gemini", "opencode", "pi"],
       "default": "auto",
-      "description": "Which AI harness to configure HOL Guard for during install (auto = detect)"
+      "description": "Which AI harness to configure HOL Guard for during install. Guard auto-detects installed harnesses; the selected value is informational. Use 'none' to skip init."
     },
     "strictMode": {
       "type": "boolean",

plugin_scanner-2.0.1007/devcontainer-features/hol-guard/install.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# HOL Guard DevContainer Feature
+# Installs HOL Guard into a dev container for AI agent security
+
+VERSION="${VERSION:-latest}"
+INIT_HARNESS="${INITHARNESS:-auto}"
+STRICT_MODE="${STRICTMODE:-false}"
+
+echo "================================================"
+echo "  HOL Guard DevContainer Feature"
+echo "  https://hol.org/guard"
+echo "================================================"
+
+# Ensure Python is available
+if ! command -v python3 >/dev/null 2>&1; then
+    echo "ERROR: Python 3.10+ is required. Please install the Python feature first."
+    echo "  Add to devcontainer.json: \"ghcr.io/devcontainers/features/python\""
+    exit 1
+fi
+
+PY_VERSION=$(python3 -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
+echo "Detected Python: ${PY_VERSION}"
+
+# Check minimum version (3.10+)
+MAJOR=$(echo "$PY_VERSION" | cut -d. -f1)
+MINOR=$(echo "$PY_VERSION" | cut -d. -f2)
+if [ "$MAJOR" -lt 3 ] || { [ "$MAJOR" -eq 3 ] && [ "$MINOR" -lt 10 ]; }; then
+    echo "ERROR: HOL Guard requires Python 3.10+. Found ${PY_VERSION}."
+    exit 1
+fi
+
+# Validate VERSION to prevent shell injection via su -c.
+# Allow "latest" or PEP 440 version specifiers: release segment (N.N*)
+# followed by any combination of pre/post/dev segments (e.g. 2.1,
+# 2.0.1004, 2.0.1004.post1, 2.0.0a1, 2.0.0rc1, 2.0.0a1.post2).
+# Reject shell metacharacters, spaces, or path separators.
+if [ "$VERSION" != "latest" ]; then
+    if ! echo "$VERSION" | grep -qE '^[0-9]+(\.[0-9]+)*((a|b|rc|c|\.post|\.dev)[0-9]*)*$'; then
+        echo "ERROR: Invalid version '${VERSION}'. Use 'latest' or a PEP 440 version like '2.0.1004'."
+        exit 1
+    fi
+fi
+
+# Determine the target non-root user (devcontainer provides these env vars)
+USERNAME="${_REMOTE_USER:-${_CONTAINER_USER:-auto}}"
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "root" ]; then
+    for u in vscode node codespace; do
+        if id "$u" >/dev/null 2>&1; then
+            USERNAME="$u"
+            break
+        fi
+    done
+fi
+if [ "${USERNAME}" = "auto" ]; then
+    USERNAME="root"
+fi
+
+# Resolve the user's home directory; never guess /home/root.
+if [ "${USERNAME}" = "root" ]; then
+    USER_HOME="/root"
+else
+    USER_HOME=$(getent passwd "${USERNAME}" 2>/dev/null | cut -d: -f6 || true)
+    if [ -z "$USER_HOME" ]; then
+        USER_HOME="/home/${USERNAME}"
+    fi
+fi
+echo "Installing for user: ${USERNAME} (${USER_HOME})"
+
+# Run a command as the target user. Uses exec for root (no shell overhead)
+# and su for non-root. The command argument must be a pre-validated argv
+# string — never interpolate untrusted input.
+run_as_user() {
+    if [ "${USERNAME}" = "root" ]; then
+        "$@"
+    else
+        su "${USERNAME}" -c "$*"
+    fi
+}
+
+# Check if a binary is available in the target user's PATH.
+user_has() {
+    if [ "${USERNAME}" = "root" ]; then
+        command -v "$1" >/dev/null 2>&1
+    else
+        su "${USERNAME}" -c "command -v $1" >/dev/null 2>&1
+    fi
+}
+
+# Install pipx if not present in the target user's PATH (PEP 668-safe).
+if ! user_has pipx; then
+    echo "Installing pipx..."
+    if command -v apt-get >/dev/null 2>&1; then
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update && apt-get install -y pipx
+        apt-get clean && rm -rf /var/lib/apt/lists/*
+    elif command -v apk >/dev/null 2>&1; then
+        apk add pipx
+        rm -rf /var/cache/apk/*
+    elif command -v dnf >/dev/null 2>&1; then
+        dnf install -y pipx
+        dnf clean all
+    else
+        # Fallback: install into the user's site-packages.
+        # --user lands in a writable directory for non-root users.
+        # --break-system-packages bypasses PEP 668 (externally-managed-environment)
+        # on distros where it applies. Both flags together are correct:
+        # --user controls the install location, --break-system-packages
+        # bypasses the externally-managed guard.
+        run_as_user python3 -m pip install --user --break-system-packages pipx
+    fi
+fi
+
+# Ensure pipx is in the user's PATH
+run_as_user pipx ensurepath >/dev/null 2>&1 || true
+
+# Determine pipx binary path
+PIPX_BIN="pipx"
+if ! user_has pipx; then
+    PIPX_BIN="${USER_HOME}/.local/bin/pipx"
+fi
+
+# Install hol-guard (--force for idempotent re-runs)
+if [ "$VERSION" = "latest" ]; then
+    echo "Installing HOL Guard (latest)..."
+    run_as_user "${PIPX_BIN}" install --force hol-guard
+else
+    echo "Installing HOL Guard v${VERSION}..."
+    run_as_user "${PIPX_BIN}" install --force "hol-guard==${VERSION}"
+fi
+
+# Determine hol-guard binary path
+GUARD_BIN="hol-guard"
+if ! user_has hol-guard; then
+    GUARD_BIN="${USER_HOME}/.local/bin/hol-guard"
+fi
+
+# Initialize for harness if requested.
+# The Guard CLI auto-detects installed harnesses via `init --yes`.
+# A specific harness name is informational only — it does not change
+# the init command, since the CLI has no --harness flag. The harness
+# will be configured automatically if it is installed in the container.
+if [ "$INIT_HARNESS" != "none" ]; then
+    echo ""
+    echo "Initializing HOL Guard (harness: ${INIT_HARNESS})..."
+    run_as_user "${GUARD_BIN}" init --yes
+
+    if [ "$STRICT_MODE" = "true" ]; then
+        echo "Enabling strict mode..."
+        run_as_user "${GUARD_BIN}" settings set security-level strict
+    fi
+fi
+
+echo ""
+echo "HOL Guard installed successfully."
+echo "  Docs: https://hol.org/guard"
+echo "  CLI:  hol-guard --help"
+echo "================================================"

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1005"
+version = "2.0.1007"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1005"
+version = "2.0.1007"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1005"
+__version__ = "2.0.1007"

{plugin_scanner-2.0.1005 → plugin_scanner-2.0.1007}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.1005"
+version = "2.0.1007"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },

plugin_scanner-2.0.1005/devcontainer-features/hol-guard/install.sh

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# HOL Guard DevContainer Feature
-# Installs HOL Guard into a dev container for AI agent security
-
-VERSION="${VERSION:-latest}"
-INIT_HARNESS="${INITHARNESS:-auto}"
-STRICT_MODE="${STRICTMODE:-false}"
-
-echo "================================================"
-echo "  HOL Guard DevContainer Feature"
-echo "  https://hol.org/guard"
-echo "================================================"
-
-# Ensure Python is available
-if ! command -v python3 &>/dev/null; then
-    echo "ERROR: Python 3.10+ is required. Please install the Python feature first."
-    echo "  Add to devcontainer.json: \"ghcr.io/devcontainers/features/python\""
-    exit 1
-fi
-
-PY_VERSION=$(python3 -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
-echo "Detected Python: ${PY_VERSION}"
-
-# Check minimum version (3.10+)
-MAJOR=$(echo "$PY_VERSION" | cut -d. -f1)
-MINOR=$(echo "$PY_VERSION" | cut -d. -f2)
-if [ "$MAJOR" -lt 3 ] || { [ "$MAJOR" -eq 3 ] && [ "$MINOR" -lt 10 ]; }; then
-    echo "ERROR: HOL Guard requires Python 3.10+. Found ${PY_VERSION}."
-    exit 1
-fi
-
-# Install pipx if not present
-if ! command -v pipx &>/dev/null; then
-    echo "Installing pipx..."
-    python3 -m pip install --user pipx
-    export PATH="${PATH}:${HOME}/.local/bin"
-fi
-
-# Install hol-guard
-if [ "$VERSION" = "latest" ]; then
-    echo "Installing HOL Guard (latest)..."
-    pipx install hol-guard
-else
-    echo "Installing HOL Guard v${VERSION}..."
-    pipx install "hol-guard==${VERSION}"
-fi
-
-# Initialize for harness if requested
-if [ "$INIT_HARNESS" != "none" ]; then
-    echo ""
-    echo "Initializing HOL Guard for harness: ${INIT_HARNESS}..."
-    if [ "$INIT_HARNESS" = "auto" ]; then
-        hol-guard init
-    else
-        hol-guard init --harness "$INIT_HARNESS"
-    fi
-
-    if [ "$STRICT_MODE" = "true" ]; then
-        echo "Enabling strict mode..."
-        hol-guard config set strict true
-    fi
-fi
-
-echo ""
-echo "HOL Guard installed successfully."
-echo "  Docs: https://hol.org/guard"
-echo "  CLI:  hol-guard --help"
-echo "================================================"