plugin-scanner 2.0.1010__tar.gz → 2.0.1012__tar.gz

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1010
+Version: 2.0.1012
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1010"
+version = "2.0.1012"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1010"
+version = "2.0.1012"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/src/codex_plugin_scanner/guard/adapters/codex.py

@@ -11,6 +11,7 @@ import sys
 from copy import deepcopy
 from pathlib import Path
 from typing import Any
+from urllib.parse import urlencode
 
 from ..aibom_detection import (
     enrich_mcp_server_metadata,
@@ -18,7 +19,7 @@ from ..aibom_detection import (
     extend_detection_with_workspace_aibom,
 )
 from ..codex_config import dump_toml, read_toml_payload, write_toml_payload
-from ..config import MAX_APPROVAL_WAIT_TIMEOUT_SECONDS, load_guard_config
+from ..config import MAX_APPROVAL_WAIT_TIMEOUT_SECONDS, load_guard_config, resolve_guard_home
 from ..launcher import merge_guard_launcher_env
 from ..models import GuardArtifact, HarnessDetection
 from ..shims import install_guard_shim, remove_guard_shim
@@ -175,7 +176,7 @@ def _strict_json_object(path: Path, *, label: str) -> dict[str, object]:
     return payload
 
 
-def _hook_command_parts(context: HarnessContext) -> tuple[str, ...]:
+def _local_hook_command_parts(context: HarnessContext) -> tuple[str, ...]:
     resolved_home = context.home_dir.resolve()
     resolved_user_home = Path.home().resolve()
     guard_args = [
@@ -193,6 +194,48 @@ def _hook_command_parts(context: HarnessContext) -> tuple[str, ...]:
     return (sys.executable, "-m", "codex_plugin_scanner.cli", *guard_args)
 
 
+def _runtime_guard_home(context: HarnessContext) -> Path:
+    if context.home_dir.resolve() == Path.home().resolve():
+        return resolve_guard_home()
+    return context.guard_home
+
+
+def _daemon_start_command(guard_home: Path) -> tuple[str, ...]:
+    package_root = Path(__file__).resolve().parents[3]
+    code = (
+        "import sys;"
+        f"sys.path.insert(0, {str(package_root)!r});"
+        "from pathlib import Path;"
+        "from codex_plugin_scanner.guard.daemon import ensure_guard_daemon;"
+        f"ensure_guard_daemon(Path({str(guard_home)!r}))"
+    )
+    return (sys.executable, "-c", code)
+
+
+def _hook_command_parts(context: HarnessContext) -> tuple[str, ...]:
+    guard_home = _runtime_guard_home(context)
+    query = {"guard-home": str(guard_home)}
+    if context.home_dir.resolve() != Path.home().resolve():
+        query["home"] = str(context.home_dir)
+    if context.workspace_dir is not None:
+        query["workspace"] = str(context.workspace_dir)
+    long_timeout = _post_tool_hook_timeout_seconds(context)
+    config = {
+        "state_path": str(guard_home / "daemon-state.json"),
+        "fallback_command": list(_local_hook_command_parts(context)),
+        "start_command": list(_daemon_start_command(guard_home)),
+        "query": urlencode(query),
+        "hook_timeouts": {
+            "PreToolUse": long_timeout,
+            "PermissionRequest": _MANAGED_HOOK_TIMEOUT_SECONDS,
+            "UserPromptSubmit": _MANAGED_HOOK_TIMEOUT_SECONDS,
+            "PostToolUse": long_timeout,
+        },
+    }
+    bridge_path = Path(__file__).with_name("codex_daemon_hook_bridge.py")
+    return (sys.executable, str(bridge_path), json.dumps(config, separators=(",", ":")))
+
+
 def _hook_command(context: HarnessContext) -> str:
     return shlex.join(_hook_command_parts(context))
 
@@ -283,11 +326,16 @@ def _is_managed_hook_command(command: object) -> bool:
         return False
     if tokens and Path(tokens[0]).name == "hol-guard-codex-hook.sh":
         return True
-    if len(tokens) < 3:
+    if len(tokens) < 2:
         return False
     executable = Path(tokens[0]).name.lower()
     if not executable.startswith("python"):
         return False
+    managed_bridge_path = Path(__file__).with_name("codex_daemon_hook_bridge.py").resolve()
+    if Path(tokens[1]).resolve() == managed_bridge_path:
+        return True
+    if len(tokens) < 3:
+        return False
     if tokens[1] == "-m":
         if len(tokens) < 5:
             return False

plugin_scanner-2.0.1012/src/codex_plugin_scanner/guard/adapters/codex_daemon_hook_bridge.py

@@ -0,0 +1,312 @@
+"""Fast, authenticated bridge from Codex hooks to the local Guard daemon."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+from typing import TypedDict
+from urllib.parse import urlparse
+
+_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+_HOOK_TIMEOUT_GRACE_SECONDS = 2
+_DAEMON_START_TIMEOUT_SECONDS = 8
+_FAIL_CLOSED_REASON = "HOL Guard could not complete local Codex hook review safely."
+
+
+class BridgeConfig(TypedDict):
+    state_path: str
+    fallback_command: tuple[str, ...]
+    start_command: tuple[str, ...]
+    query: str
+    hook_timeouts: dict[str, int]
+
+
+class _LoopbackOnlyRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        _assert_loopback_http_url(newurl)
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+
+def _assert_loopback_http_url(url: str) -> None:
+    parsed = urlparse(url)
+    if parsed.scheme != "http":
+        raise ValueError(f"daemon URL must use http, not {parsed.scheme!r}")
+    if parsed.username is not None or parsed.password is not None:
+        raise ValueError("daemon URL must not contain credentials")
+    host = (parsed.hostname or "").lower()
+    if host not in _LOOPBACK_HOSTS:
+        raise ValueError(f"daemon URL must target loopback, not {host!r}")
+    if parsed.port is None:
+        raise ValueError("daemon URL must include an explicit port")
+
+
+def _json_object(text: str) -> dict[str, object] | None:
+    try:
+        payload = json.loads(text)
+    except json.JSONDecodeError:
+        return None
+    return payload if isinstance(payload, dict) else None
+
+
+def _state_payload(state_path: str | Path) -> dict[str, object]:
+    try:
+        payload = json.loads(Path(state_path).read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+def _daemon_url(state_path: str | Path) -> str:
+    payload = _state_payload(state_path)
+    port = payload.get("port")
+    if isinstance(port, int) and 0 < port <= 65535:
+        return f"http://127.0.0.1:{port}"
+    raise ValueError("daemon state does not contain a valid port")
+
+
+def _daemon_auth_token(state_path: str | Path) -> str | None:
+    path = Path(state_path)
+    try:
+        token = (path.parent / "daemon-auth-token").read_text(encoding="utf-8").strip()
+    except OSError:
+        token = ""
+    if token:
+        return token
+    state_token = _state_payload(path).get("auth_token")
+    return state_token if isinstance(state_token, str) and state_token.strip() else None
+
+
+def _build_loopback_opener() -> urllib.request.OpenerDirector:
+    return urllib.request.build_opener(
+        urllib.request.ProxyHandler({}),
+        _LoopbackOnlyRedirectHandler(),
+    )
+
+
+def _post_to_loopback_daemon(
+    endpoint: str,
+    data: str,
+    *,
+    state_path: str | Path,
+    timeout_seconds: float,
+) -> str:
+    _assert_loopback_http_url(endpoint)
+    headers = {"Content-Type": "application/json"}
+    auth_token = _daemon_auth_token(state_path)
+    if auth_token:
+        headers["X-Guard-Token"] = auth_token
+    request = urllib.request.Request(
+        endpoint,
+        data=data.encode("utf-8"),
+        headers=headers,
+        method="POST",
+    )
+    with _build_loopback_opener().open(request, timeout=timeout_seconds) as response:
+        final_url = response.geturl()
+        if final_url:
+            _assert_loopback_http_url(final_url)
+        return response.read().decode("utf-8", errors="replace")
+
+
+def _event_name(data: str) -> str:
+    payload = _json_object(data)
+    if payload is None:
+        return "PreToolUse"
+    value = payload.get("hook_event_name", payload.get("event", "PreToolUse"))
+    return value.strip() if isinstance(value, str) and value.strip() else "PreToolUse"
+
+
+def _request_timeout(event_name: str, hook_timeouts: Mapping[str, int]) -> float:
+    timeout = hook_timeouts.get(event_name, min(hook_timeouts.values(), default=10))
+    return float(max(1, timeout - _HOOK_TIMEOUT_GRACE_SECONDS))
+
+
+def _fail_closed(event_name: str, reason: str = _FAIL_CLOSED_REASON) -> dict[str, object]:
+    if event_name == "PermissionRequest":
+        return {
+            "hookSpecificOutput": {
+                "hookEventName": event_name,
+                "decision": {
+                    "behavior": "deny",
+                    "message": reason,
+                },
+            }
+        }
+    if event_name == "PreToolUse":
+        return {
+            "hookSpecificOutput": {
+                "hookEventName": event_name,
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }
+        }
+    if event_name == "PostToolUse":
+        return {
+            "continue": False,
+            "stopReason": reason,
+            "systemMessage": reason,
+        }
+    return {
+        "continue": False,
+        "stopReason": reason,
+        "systemMessage": reason,
+    }
+
+
+def _run_daemon_start(start_command: Sequence[str], *, timeout_seconds: float) -> bool:
+    try:
+        result = subprocess.run(
+            list(start_command),
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            timeout=min(timeout_seconds, _DAEMON_START_TIMEOUT_SECONDS),
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    return result.returncode == 0
+
+
+def _run_local_fallback(
+    fallback_command: Sequence[str],
+    *,
+    data: str,
+    timeout_seconds: float,
+) -> dict[str, object] | None:
+    try:
+        result = subprocess.run(
+            list(fallback_command),
+            input=data,
+            capture_output=True,
+            text=True,
+            errors="replace",
+            timeout=timeout_seconds,
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    if result.returncode != 0:
+        return None
+    if not result.stdout.strip():
+        return {}
+    return _json_object(result.stdout.strip())
+
+
+def _daemon_response(
+    *,
+    state_path: str | Path,
+    query: str,
+    data: str,
+    timeout_seconds: float,
+) -> dict[str, object] | None:
+    endpoint = f"{_daemon_url(state_path)}/v1/hooks/codex?{query}"
+    response = _post_to_loopback_daemon(
+        endpoint,
+        data,
+        state_path=state_path,
+        timeout_seconds=timeout_seconds,
+    )
+    return _json_object(response.strip())
+
+
+def main(
+    *,
+    state_path: str | Path,
+    fallback_command: Sequence[str],
+    start_command: Sequence[str],
+    query: str,
+    hook_timeouts: Mapping[str, int],
+) -> int:
+    """Review one Codex hook through the resident daemon or a fail-safe fallback."""
+
+    data = sys.stdin.read().strip() or "{}"
+    event_name = _event_name(data)
+    timeout_seconds = _request_timeout(event_name, hook_timeouts)
+    response: dict[str, object] | None = None
+    try:
+        response = _daemon_response(
+            state_path=state_path,
+            query=query,
+            data=data,
+            timeout_seconds=timeout_seconds,
+        )
+    except (OSError, ValueError, urllib.error.URLError):
+        if _run_daemon_start(start_command, timeout_seconds=timeout_seconds):
+            try:
+                response = _daemon_response(
+                    state_path=state_path,
+                    query=query,
+                    data=data,
+                    timeout_seconds=timeout_seconds,
+                )
+            except (OSError, ValueError, urllib.error.URLError):
+                response = None
+    if response is None:
+        response = _run_local_fallback(
+            fallback_command,
+            data=data,
+            timeout_seconds=timeout_seconds,
+        )
+    if response is None:
+        response = _fail_closed(event_name)
+    sys.stdout.write(json.dumps(response, separators=(",", ":")))
+    return 0
+
+
+def _string_sequence(value: object, *, label: str) -> tuple[str, ...]:
+    if not isinstance(value, list) or not value or not all(isinstance(item, str) for item in value):
+        raise SystemExit(f"codex_daemon_hook_bridge config missing {label}")
+    return tuple(value)
+
+
+def _hook_timeout_mapping(value: object) -> dict[str, int]:
+    if not isinstance(value, dict):
+        raise SystemExit("codex_daemon_hook_bridge config missing hook_timeouts")
+    timeouts = {
+        str(key): timeout
+        for key, timeout in value.items()
+        if isinstance(key, str) and isinstance(timeout, int) and timeout > _HOOK_TIMEOUT_GRACE_SECONDS
+    }
+    if not timeouts:
+        raise SystemExit("codex_daemon_hook_bridge config has no valid hook_timeouts")
+    return timeouts
+
+
+def _bridge_config_from_argv(argv: Sequence[str]) -> BridgeConfig:
+    if len(argv) != 2:
+        raise SystemExit("codex_daemon_hook_bridge expects one JSON config argument")
+    payload = _json_object(argv[1])
+    if payload is None:
+        raise SystemExit("codex_daemon_hook_bridge config must be a JSON object")
+    state_path = payload.get("state_path")
+    query = payload.get("query")
+    if not isinstance(state_path, str):
+        raise SystemExit("codex_daemon_hook_bridge config missing state_path")
+    if not isinstance(query, str):
+        raise SystemExit("codex_daemon_hook_bridge config missing query")
+    return BridgeConfig(
+        state_path=state_path,
+        fallback_command=_string_sequence(payload.get("fallback_command"), label="fallback_command"),
+        start_command=_string_sequence(payload.get("start_command"), label="start_command"),
+        query=query,
+        hook_timeouts=_hook_timeout_mapping(payload.get("hook_timeouts")),
+    )
+
+
+if __name__ == "__main__":
+    _config = _bridge_config_from_argv(sys.argv)
+    raise SystemExit(
+        main(
+            state_path=_config["state_path"],
+            fallback_command=_config["fallback_command"],
+            start_command=_config["start_command"],
+            query=_config["query"],
+            hook_timeouts=_config["hook_timeouts"],
+        )
+    )

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/src/codex_plugin_scanner/guard/adapters/hermes.py

@@ -74,7 +74,7 @@ def _hermes_home(context: HarnessContext) -> Path:
     return context.home_dir / ".hermes"
 
 
-def _hermes_host_home() -> Path | None:
+def _hermes_host_home(context: HarnessContext) -> Path | None:
     """Resolve the host's real Hermes home when running inside a container.
 
     Hermes agents often run inside Docker containers with a minimal sandbox
@@ -82,19 +82,20 @@ def _hermes_host_home() -> Path | None:
     real Hermes installation — with the full config.yaml and 200+ skills — is
     not mounted into the container.
 
-    When the operator sets ``HERMES_HOST_HOME`` (e.g. via ``-e HERMES_HOST_HOME=/home/hol/.hermes``
-    or a Guard-managed env file), ``detect()`` can fall back to scanning the
-    host's real installation even from inside the container.
+    When the operator sets ``HERMES_HOST_HOME``, ``detect()`` can fall back to
+    scanning the mounted host installation even from inside the container.
+    A persisted ``~/hermes-host-home`` mirror is also recognized because
+    Hermes sandbox launchers may not preserve custom environment variables.
 
-    Returns ``None`` when the env var is unset or the path does not exist.
+    Returns ``None`` when neither location exists.
     """
     env_host = os.environ.get("HERMES_HOST_HOME")
-    if not env_host or not env_host.strip():
-        return None
-    host_path = Path(env_host.strip())
-    if not host_path.is_dir():
-        return None
-    return host_path
+    if env_host and env_host.strip():
+        host_path = Path(env_host.strip())
+        return host_path if host_path.is_dir() else None
+
+    fallback_path = context.home_dir / "hermes-host-home"
+    return fallback_path if fallback_path.is_dir() else None
 
 
 def _hermes_home_has_artifacts(hermes_home: Path) -> bool:
@@ -174,12 +175,11 @@ class HermesHarnessAdapter(HarnessAdapter):
             overlay_path=overlay_path,
             pretool_path=pretool_path,
         )
-        source_configs = _load_mcp_server_sources(_hermes_home(context))
-        # When running inside a container with HERMES_HOST_HOME set, also
-        # load MCP server sources from the host's real Hermes config.  This
-        # ensures the manifest captures servers the container can't see.
-        host_home = _hermes_host_home()
-        if host_home and host_home.resolve() != _hermes_home(context).resolve():
+        hermes_home = _hermes_home(context)
+        source_configs = _load_mcp_server_sources(hermes_home)
+        # Only consult the mirror for a minimal sandbox, matching detect().
+        host_home = _hermes_host_home(context)
+        if host_home and host_home.resolve() != hermes_home.resolve() and not _hermes_home_has_artifacts(hermes_home):
             for key, config in _load_mcp_server_sources(host_home).items():
                 source_configs.setdefault(key, config)
         overlay_servers = _overlay_servers(context=context, source_configs=source_configs)
@@ -381,12 +381,9 @@ class HermesHarnessAdapter(HarnessAdapter):
         # Discover MCP servers from both config.yaml and mcp_servers.json.
         artifacts.extend(self._scan_mcp_servers(hermes_home, found_paths))
 
-        # Container fallback: when the container's Hermes home is a minimal
-        # sandbox (empty skills, trivial config), fall back to the host's
-        # real Hermes installation via HERMES_HOST_HOME.  This is the common
-        # case for Hermes agents running inside Docker containers where the
-        # host's ~/.hermes is not mounted.
-        host_home = _hermes_host_home()
+        # Container fallback: use an explicit or persisted host-home mirror
+        # when the sandbox has only empty skills and trivial config.
+        host_home = _hermes_host_home(context)
         if host_home and host_home.resolve() != hermes_home.resolve() and not _hermes_home_has_artifacts(hermes_home):
             artifacts.extend(self._scan_host_home(host_home, found_paths))
 
@@ -404,6 +401,7 @@ class HermesHarnessAdapter(HarnessAdapter):
             artifacts=tuple(artifacts),
             config_paths=tuple(found_paths),
         )
+
     def inventory_snapshot(
         self,
         context: HarnessContext,

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/src/codex_plugin_scanner/guard/aibom_cli.py

@@ -444,6 +444,7 @@ def sync_aibom_snapshots(
     all_statuses: list[dict[str, object]] = []
     synced_at = generated_at
     batches_sent = 0
+
     # Adaptive batch size: when events were chunked (items >= threshold),
     # send 1 per POST to stay within Cloudflare's 100s origin timeout.
     def _event_item_count(e: dict[str, object]) -> int:
@@ -456,9 +457,9 @@ def sync_aibom_snapshots(
         items = snapshot.get("items")
         return len(items) if isinstance(items, list) else 0
 
-    effective_batch_size = 1 if any(
-        _event_item_count(e) >= _AIBOM_MAX_ITEMS_PER_EVENT for e in events
-    ) else _AIBOM_SYNC_BATCH_SIZE
+    effective_batch_size = (
+        1 if any(_event_item_count(e) >= _AIBOM_MAX_ITEMS_PER_EVENT for e in events) else _AIBOM_SYNC_BATCH_SIZE
+    )
     for batch_start in range(0, len(events), effective_batch_size):
         batch = events[batch_start : batch_start + effective_batch_size]
         body = json.dumps({"events": batch}).encode("utf-8")
@@ -479,9 +480,7 @@ def sync_aibom_snapshots(
         except urllib.error.HTTPError as error:
             if error.code == 401 and not auth_refresh_retried:
                 auth_refresh_retried = True
-                resolved_auth_context = runner._resolve_guard_sync_auth_context(
-                    store, force_refresh=True
-                )
+                resolved_auth_context = runner._resolve_guard_sync_auth_context(store, force_refresh=True)
                 request = runner._guard_sync_request(
                     resolved_auth_context,
                     request_url=sync_url,
@@ -838,6 +837,8 @@ def _inventory_snapshot_event(
         "deviceId": device_id,
         "payload": {"snapshot": serialize_inventory_snapshot(snapshot)},
     }
+
+
 def _chunk_inventory_events(
     events: list[dict[str, object]],
     max_items: int = _AIBOM_MAX_ITEMS_PER_EVENT,
@@ -867,9 +868,9 @@ def _chunk_inventory_events(
             result.append(event)
             continue
 
-        original_snapshot_id = str(
-            event.get("idempotencyKey") or snapshot.get("snapshotId") or ""
-        ).strip() or str(uuid.uuid4())
+        original_snapshot_id = str(event.get("idempotencyKey") or snapshot.get("snapshotId") or "").strip() or str(
+            uuid.uuid4()
+        )
         total_chunks = (len(items) + max_items - 1) // max_items
         for chunk_index in range(total_chunks):
             chunk_start = chunk_index * max_items
@@ -883,9 +884,7 @@ def _chunk_inventory_events(
                 chunk_snapshot["drift"] = []
                 chunk_snapshot["sources"] = []
                 chunk_snapshot["dockerProofs"] = []
-            chunk_snapshot["snapshotId"] = (
-                f"{original_snapshot_id}-chunk-{chunk_index + 1}-of-{total_chunks}"
-            )
+            chunk_snapshot["snapshotId"] = f"{original_snapshot_id}-chunk-{chunk_index + 1}-of-{total_chunks}"
             chunk_event = {
                 **event,
                 "eventId": str(uuid.uuid4()),

{plugin_scanner-2.0.1010 → plugin_scanner-2.0.1012}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1010"
+__version__ = "2.0.1012"