plugin-scanner 2.0.1020__tar.gz → 2.0.1022__tar.gz

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1020
+Version: 2.0.1022
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1020"
+version = "2.0.1022"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1020"
+version = "2.0.1022"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/src/codex_plugin_scanner/guard/aibom_content_upload.py

@@ -87,8 +87,6 @@ def primary_content_sources_from_artifacts(
     *,
     workspace_dir: Path | None,
 ) -> tuple[GuardAibomPrimaryContentSource, ...]:
-    if snapshot.agent_type != "hermes":
-        return ()
     items_by_id = {item.item_id: item for item in snapshot.items}
     sources: list[GuardAibomPrimaryContentSource] = []
     for artifact in artifacts:

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -21,6 +21,7 @@ from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
 
 from ...version import __version__
+from ..package_firewall_defaults import extract_cloud_user_profile as _extract_cloud_user_profile
 from ..package_firewall_entitlement import (
     build_oauth_package_firewall_entitlement,
     reconcile_connect_state_with_oauth_entitlement,
@@ -178,24 +179,6 @@ def _read_nested_string(payload: dict[str, object], *path: str) -> str | None:
     return current if isinstance(current, str) and current else None
 
 
-def _extract_cloud_user_profile(payload: dict[str, object]) -> dict[str, str] | None:
-    """Extract user profile (email, display_name, avatar_url) from guard_local_entitlement."""
-    entitlement = payload.get("guard_local_entitlement")
-    if not isinstance(entitlement, dict):
-        return None
-    profile = entitlement.get("user_profile")
-    if not isinstance(profile, dict):
-        return None
-    email = profile.get("email")
-    if not isinstance(email, str) or not email:
-        return None
-    return {
-        "email": email,
-        "display_name": str(profile.get("display_name") or ""),
-        "avatar_url": str(profile.get("avatar_url") or ""),
-    }
-
-
 def _guard_access_token_expires_at(
     *,
     access_token: str,

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/src/codex_plugin_scanner/guard/inventory_contract.py

@@ -15,6 +15,8 @@ from types import SimpleNamespace
 from typing import Literal
 from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
 
+from ..path_support import resolves_within_root
+
 InventoryItemKind = Literal[
     "agent",
     "daemon_plugin",
@@ -391,7 +393,7 @@ def cloud_inventory_artifacts_from_detection(
 ) -> tuple[object, ...]:
     """Return artifacts eligible for the cloud inventory contract.
 
-    Hermes supplementary skill files remain part of local detection and policy
+    Supplementary skill files remain part of local detection and policy
     evaluation, but the cloud inventory represents the primary SKILL.md once.
     """
     harness = str(getattr(detection, "harness", "unknown"))
@@ -406,8 +408,7 @@ def cloud_inventory_artifacts_from_detection(
             if artifact.artifact_id not in existing_ids:
                 artifacts.append(artifact)
                 existing_ids.add(artifact.artifact_id)
-    if harness == "hermes":
-        artifacts = [artifact for artifact in artifacts if str(getattr(artifact, "artifact_type", "")) != "skill_file"]
+    artifacts = [artifact for artifact in artifacts if str(getattr(artifact, "artifact_type", "")) != "skill_file"]
     return tuple(artifacts)
 
 
@@ -726,7 +727,16 @@ def _item_from_artifact(
             "metadata": _stable_snapshot_value(safe_metadata),
         }
     )
-    content_hash = _resolve_item_content_hash(safe_metadata, semantic_text)
+    primary_content_hash = _primary_artifact_content_hash(
+        artifact,
+        artifact_type=artifact_type,
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+    )
+    if artifact_type in {"skill", "instruction"}:
+        content_hash = primary_content_hash or semantic_text
+    else:
+        content_hash = _resolve_item_content_hash(safe_metadata, semantic_text)
     from .runtime.trust_attestation import (
         GuardTrustAttestationSigningConfig,
         apply_trust_attestation_metadata,
@@ -1332,15 +1342,93 @@ def _resolve_item_content_hash(metadata: dict[str, object], semantic_text: str)
     for key in ("content_hash", "directory_hash"):
         candidate = metadata.get(key)
         if isinstance(candidate, str) and candidate:
-            return candidate
+            return _canonical_inventory_content_hash(candidate)
     version_info = metadata.get("versionInfo")
     if isinstance(version_info, dict):
         version_hash = version_info.get("contentHash")
         if isinstance(version_hash, str) and version_hash:
-            return version_hash
+            return _canonical_inventory_content_hash(version_hash)
     return semantic_text
 
 
+def _primary_artifact_content_hash(
+    artifact: object,
+    *,
+    artifact_type: str,
+    home_dir: Path,
+    workspace_dir: Path | None,
+) -> str | None:
+    path_value = getattr(artifact, "config_path", None)
+    if not isinstance(path_value, str) or not path_value.strip():
+        return None
+    path = Path(path_value).expanduser()
+    if artifact_type == "skill":
+        if path.name != "SKILL.md":
+            return None
+        skills_root = next((parent for parent in path.parents if parent.name.lower() == "skills"), None)
+        if skills_root is None:
+            return None
+        try:
+            relative = path.relative_to(skills_root)
+        except ValueError:
+            return None
+        if len(relative.parts) < 2:
+            return None
+        outer_root = next(
+            (
+                root
+                for root in (home_dir, workspace_dir)
+                if root is not None and resolves_within_root(root, skills_root, require_exists=True)
+            ),
+            None,
+        )
+        if outer_root is None:
+            return None
+        allowed_roots = (skills_root,)
+    elif artifact_type == "instruction":
+        if workspace_dir is None or path.suffix.lower() not in {".md", ".mdc"}:
+            return None
+        allowed_roots = (workspace_dir,)
+    else:
+        return None
+    allowed_root = next(
+        (root for root in allowed_roots if root is not None and resolves_within_root(root, path, require_exists=True)),
+        None,
+    )
+    if allowed_root is None or _path_has_symlink_component(path, allowed_root=allowed_root):
+        return None
+    try:
+        digest = hashlib.sha256()
+        with path.open("rb") as handle:
+            for chunk in iter(lambda: handle.read(64 * 1024), b""):
+                digest.update(chunk)
+    except OSError:
+        return None
+    return f"sha256:{digest.hexdigest()}"
+
+
+def _path_has_symlink_component(path: Path, *, allowed_root: Path) -> bool:
+    try:
+        relative = path.relative_to(allowed_root)
+    except ValueError:
+        return True
+    current = allowed_root
+    if current.is_symlink():
+        return True
+    for part in relative.parts:
+        current = current / part
+        if current.is_symlink():
+            return True
+    return False
+
+
+def _canonical_inventory_content_hash(value: str) -> str:
+    normalized = value.lower()
+    if re.fullmatch(r"[0-9a-f]{64}", normalized):
+        return f"sha256:{normalized}"
+    return value
+
+
 def _safe_roots_for_inspection(
     *,
     home_dir: Path,

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/src/codex_plugin_scanner/guard/package_firewall_defaults.py

@@ -36,3 +36,28 @@ def build_guard_local_entitlement_defaults(
         "supply_chain_firewall": allowed,
         "supply_chain_plan_id": normalized_tier,
     }
+
+
+def extract_cloud_user_profile(payload: dict[str, object]) -> dict[str, str] | None:
+    """Extract user profile (email, display_name, avatar_url) from guard_local_entitlement.
+
+    Works on both the full token-exchange payload and the raw guard_local_entitlement dict.
+    """
+    entitlement = payload.get("guard_local_entitlement")
+    if not isinstance(entitlement, dict):
+        # If payload IS the entitlement dict, use it directly
+        if "user_profile" in payload:
+            entitlement = payload
+        else:
+            return None
+    profile = entitlement.get("user_profile")
+    if not isinstance(profile, dict):
+        return None
+    email = profile.get("email")
+    if not isinstance(email, str) or not email:
+        return None
+    return {
+        "email": email,
+        "display_name": str(profile.get("display_name") or ""),
+        "avatar_url": str(profile.get("avatar_url") or ""),
+    }

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -46,6 +46,7 @@ from ..cloud_exceptions import (
 from ..config import VALID_RECEIPT_REDACTION_LEVELS, GuardConfig, load_guard_config
 from ..edge_events import build_runtime_session_event
 from ..models import GuardArtifact, HarnessDetection, PolicyDecision
+from ..package_firewall_defaults import extract_cloud_user_profile
 from ..package_firewall_entitlement import (
     build_oauth_package_firewall_entitlement,
     reconcile_connect_state_with_oauth_entitlement,
@@ -3024,6 +3025,8 @@ def _refresh_guard_oauth_access_token(
                 payload,
                 now=datetime.now(timezone.utc),
             ),
+            "cloud_user_profile": extract_cloud_user_profile(payload),
+            "had_guard_local_entitlement": isinstance(payload.get("guard_local_entitlement"), dict),
             "refresh_token": _optional_string(payload.get("refresh_token")) or refresh_token,
         }
 
@@ -3110,6 +3113,7 @@ def _persist_rotated_oauth_refresh_token(
     store: GuardStore,
     credentials: dict[str, object],
     package_firewall_entitlement: dict[str, object] | None = None,
+    cloud_user_profile: dict[str, str] | None = None,
     refresh_token: str,
     access_token: str | None = None,
     access_token_expires_at: str | None = None,
@@ -3159,7 +3163,7 @@ def _persist_rotated_oauth_refresh_token(
             else _optional_string(credentials.get("supply_chain_plan_id"))
         ),
         workspace_id=_optional_string(credentials.get("workspace_id")),
-        cloud_user_profile=_extract_dict_field(credentials, "cloud_user_profile"),
+        cloud_user_profile=cloud_user_profile,
         runtime_id=_optional_string(credentials.get("runtime_id")),
         runtime_label=_optional_string(credentials.get("runtime_label")),
         access_token=access_token,
@@ -3210,16 +3214,34 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
     package_firewall_entitlement: dict[str, object] | None = (
         refreshed_entitlement if isinstance(refreshed_entitlement, dict) else None
     )
+    refreshed_cloud_user_profile = refreshed.get("cloud_user_profile")
+    if not isinstance(refreshed_cloud_user_profile, dict):
+        refreshed_cloud_user_profile = None
+    had_entitlement = bool(refreshed.get("had_guard_local_entitlement"))
+    # When the refresh response includes a guard_local_entitlement but no
+    # user_profile, clear the stale profile rather than preserving it.
+    # When there's no guard_local_entitlement at all (old server), keep existing.
+    effective_cloud_user_profile: dict[str, str] | None
+    if had_entitlement:
+        effective_cloud_user_profile = refreshed_cloud_user_profile
+    else:
+        effective_cloud_user_profile = refreshed_cloud_user_profile or _extract_dict_field(
+            oauth_credentials, "cloud_user_profile"
+        )
+    stored_cloud_user_profile = _extract_dict_field(oauth_credentials, "cloud_user_profile")
+    profile_changed = effective_cloud_user_profile != stored_cloud_user_profile
     if (
         force_refresh
         or rotated_refresh_token != refresh_token
         or package_firewall_entitlement is not None
+        or profile_changed
         or persist_recovered_secret
     ):
         _persist_rotated_oauth_refresh_token(
             store=store,
             credentials=oauth_credentials,
             package_firewall_entitlement=package_firewall_entitlement,
+            cloud_user_profile=effective_cloud_user_profile,
             refresh_token=rotated_refresh_token,
             access_token=_optional_string(refreshed.get("access_token")),
             access_token_expires_at=_optional_string(refreshed.get("access_token_expires_at")),

{plugin_scanner-2.0.1020 → plugin_scanner-2.0.1022}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1020"
+__version__ = "2.0.1022"