plugin-scanner 2.0.1052__tar.gz → 2.0.1053__tar.gz

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1052
+Version: 2.0.1053
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1052"
+version = "2.0.1053"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1052"
+version = "2.0.1053"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/src/codex_plugin_scanner/guard/runtime/live_request_sync.py

@@ -29,8 +29,8 @@ if TYPE_CHECKING:
 
 _LOGGER = logging.getLogger(__name__)
 
-LIVE_REQUEST_SYNC_BATCH_SIZE = 200
-LIVE_REQUEST_SYNC_MAX_BATCHES = 25
+LIVE_REQUEST_SYNC_BATCH_SIZE = 1
+LIVE_REQUEST_SYNC_MAX_BATCHES = 200
 LIVE_REQUEST_SYNC_PROTOCOL_VERSION = "1"
 _LIVE_REQUEST_COMMAND_MAX_UTF16_UNITS = 65_536
 _LIVE_REQUEST_SUMMARY_MAX_UTF16_UNITS = 512
@@ -245,6 +245,15 @@ def _post_sync_events(
     )
 
 
+def _is_terminally_superseded_result(item: dict[str, object]) -> bool:
+    if item.get("code") == "stale_sequence":
+        return True
+    error = item.get("error")
+    if error in {"stale_regression_rejected", "stale_sequence"}:
+        return True
+    return isinstance(error, str) and error.startswith("stale event sequence ")
+
+
 def sync_live_requests_once(
     store: GuardStore,
     auth_context: dict[str, object],
@@ -275,10 +284,12 @@ def sync_live_requests_once(
 
     try:
         while batches < LIVE_REQUEST_SYNC_MAX_BATCHES:
+            newest_first = batches % 10 != 9
             outbox_rows = store.list_ready_live_request_outbox(
                 now=_now(),
                 limit=LIVE_REQUEST_SYNC_BATCH_SIZE,
                 workspace_id=workspace_id,
+                newest_first=newest_first,
             )
             if not outbox_rows:
                 break
@@ -349,8 +360,8 @@ def sync_live_requests_once(
                 all_errors.extend(str(error) for error in errors[:5])
             per_event_results = response.get("perEventResults")
             if isinstance(per_event_results, list) and len(per_event_results) == len(events):
-                accepted_sequences: list[int] = []
-                rejected_sequences: list[int] = []
+                acknowledged_sequences: list[int] = []
+                retry_sequences: list[int] = []
                 valid_results = True
                 for index, item in enumerate(per_event_results):
                     if (
@@ -360,19 +371,24 @@ def sync_live_requests_once(
                     ):
                         valid_results = False
                         break
-                    target = accepted_sequences if item["accepted"] else rejected_sequences
-                    target.append(sequences[index])
-                if valid_results and len(accepted_sequences) == accepted and len(rejected_sequences) == rejected:
-                    store.acknowledge_live_request_outbox(accepted_sequences)
-                    if rejected_sequences:
-                        message = f"{rejected} live request events were rejected."
+                    if item["accepted"] or _is_terminally_superseded_result(item):
+                        acknowledged_sequences.append(sequences[index])
+                    else:
+                        retry_sequences.append(sequences[index])
+                if (
+                    valid_results
+                    and sum(bool(item["accepted"]) for item in per_event_results) == accepted
+                    and len(per_event_results) - accepted == rejected
+                ):
+                    store.acknowledge_live_request_outbox(acknowledged_sequences)
+                    if retry_sequences:
+                        message = f"{len(retry_sequences)} live request events require retry."
                         all_errors.append(message)
                         store.retry_live_request_outbox(
-                            rejected_sequences,
+                            retry_sequences,
                             now=_now(),
                             error=message,
                         )
-                        break
                     continue
 
             accounted = accepted + rejected

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/src/codex_plugin_scanner/guard/store_live_request_outbox.py

@@ -28,6 +28,14 @@ def live_request_outbox_schema_statements() -> tuple[str, ...]:
         on guard_live_request_outbox (next_attempt_at, sequence)
         """,
         """
+        create index if not exists idx_guard_live_request_outbox_newest_ready
+        on guard_live_request_outbox (
+          workspace_id,
+          changed_at desc,
+          sequence desc
+        )
+        """,
+        """
         create index if not exists idx_guard_live_request_outbox_request
         on guard_live_request_outbox (local_request_id, sequence)
         """,
@@ -177,7 +185,9 @@ class StoreLiveRequestOutboxMixin:
         now: str,
         limit: int,
         workspace_id: str | None = None,
+        newest_first: bool = False,
     ) -> list[dict[str, object]]:
+        """List ready events in explicit newest-first or fairness order."""
         query = """
             select sequence, local_request_id, changed_at, attempt_count
             from guard_live_request_outbox
@@ -187,7 +197,10 @@ class StoreLiveRequestOutboxMixin:
         if workspace_id is not None:
             query += " and workspace_id = ?"
             parameters.append(workspace_id)
-        query += " order by sequence limit ?"
+        if newest_first:
+            query += " order by changed_at desc, sequence desc limit ?"
+        else:
+            query += " order by sequence asc limit ?"
         parameters.append(max(1, int(limit)))
         with self._connect() as connection:
             rows = connection.execute(query, parameters).fetchall()

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1052"
+__version__ = "2.0.1053"

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/tests/test_guard_live_request_outbox.py

@@ -252,20 +252,23 @@ def test_rejected_batch_remains_durable_and_is_backed_off(tmp_path, monkeypatch)
 
 def test_partial_acknowledgement_retries_only_rejected_event(tmp_path, monkeypatch) -> None:
     store = GuardStore(tmp_path / "guard")
-    store.add_approval_request(_request("request-accepted"), _NOW)
+    store.add_approval_request(_request("request-accepted"), "2026-07-11T18:00:00+00:00")
     store.add_approval_request(_request("request-rejected"), _NOW)
-    monkeypatch.setattr(
-        live_request_sync,
-        "_post_sync_events",
-        lambda *_args, **_kwargs: {
+    monkeypatch.setattr(live_request_sync, "LIVE_REQUEST_SYNC_BATCH_SIZE", 2)
+
+    def post_events(*_args, **kwargs):
+        return {
             "accepted": 1,
             "rejected": 1,
             "perEventResults": [
-                {"index": 0, "accepted": True},
-                {"index": 1, "accepted": False},
+                {
+                    "index": index,
+                    "accepted": event["localRequestId"] == "request-accepted",
+                }
+                for index, event in enumerate(kwargs["events"])
             ],
-        },
-    )
+        }
+    monkeypatch.setattr(live_request_sync, "_post_sync_events", post_events)
 
     result = live_request_sync.sync_live_requests_once(store, _AUTH)
 
@@ -276,5 +279,122 @@ def test_partial_acknowledgement_retries_only_rejected_event(tmp_path, monkeypat
     assert rows[0]["attempt_count"] == 1
 
 
+def test_stale_rejection_is_acknowledged_while_transient_rejection_retries(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard")
+    store.add_approval_request(_request("request-stale"), _NOW)
+    monkeypatch.setattr(live_request_sync, "LIVE_REQUEST_SYNC_BATCH_SIZE", 2)
+    store.add_approval_request(_request("request-transient"), "2026-07-11T18:00:00+00:00")
+    monkeypatch.setattr(
+        live_request_sync,
+        "_post_sync_events",
+        lambda *_args, **_kwargs: {
+            "accepted": 0,
+            "rejected": 2,
+            "perEventResults": [
+                {"index": 0, "accepted": False, "error": "temporary failure"},
+                {
+                    "index": 1,
+                    "accepted": False,
+                    "error": "stale_sequence",
+                },
+            ],
+        },
+    )
+
+    live_request_sync.sync_live_requests_once(store, _AUTH)
+
+    rows = store.list_ready_live_request_outbox(
+        now="9999-12-31T23:59:59+00:00",
+        limit=10,
+    )
+    assert [row["local_request_id"] for row in rows] == ["request-transient"]
+    assert rows[0]["attempt_count"] == 1
+
+
+def test_newest_outbox_event_preempts_historical_backlog(tmp_path) -> None:
+    store = GuardStore(tmp_path / "guard")
+    store.add_approval_request(_request("historical"), _NOW)
+    store.add_approval_request(_request("new"), "2026-07-11T18:00:00+00:00")
+
+    rows = store.list_ready_live_request_outbox(
+        now="9999-12-31T23:59:59+00:00",
+        limit=1,
+        newest_first=True,
+    )
+
+    assert [row["local_request_id"] for row in rows] == ["new"]
+
+
+def test_sync_reserves_every_tenth_slot_for_oldest_ready_event(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard")
+    for index in range(11):
+        store.add_approval_request(
+            _request(f"request-{index:02d}"),
+            f"2026-07-11T12:{index:02d}:00+00:00",
+        )
+    sent: list[str] = []
+
+    def post_events(*_args, **kwargs):
+        sent.append(kwargs["events"][0]["localRequestId"])
+        return {
+            "accepted": 1,
+            "rejected": 0,
+            "perEventResults": [{"index": 0, "accepted": True}],
+        }
+
+    monkeypatch.setattr(live_request_sync, "LIVE_REQUEST_SYNC_MAX_BATCHES", 10)
+    monkeypatch.setattr(live_request_sync, "_post_sync_events", post_events)
+
+    live_request_sync.sync_live_requests_once(store, _AUTH)
+
+    assert sent[:9] == [f"request-{index:02d}" for index in range(10, 1, -1)]
+    assert sent[9] == "request-00"
+
+
+def test_transient_newest_failures_do_not_reset_oldest_fairness_slot(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard")
+    for index in range(11):
+        store.add_approval_request(
+            _request(f"request-{index:02d}"),
+            f"2026-07-11T12:{index:02d}:00+00:00",
+        )
+
+    def post_events(*_args, **kwargs):
+        request_id = kwargs["events"][0]["localRequestId"]
+        accepted = request_id == "request-00"
+        return {
+            "accepted": int(accepted),
+            "rejected": int(not accepted),
+            "perEventResults": [
+                {
+                    "index": 0,
+                    "accepted": accepted,
+                    "error": None if accepted else "temporary_failure",
+                },
+            ],
+        }
+
+    monkeypatch.setattr(live_request_sync, "LIVE_REQUEST_SYNC_MAX_BATCHES", 10)
+    monkeypatch.setattr(live_request_sync, "_post_sync_events", post_events)
+
+    live_request_sync.sync_live_requests_once(store, _AUTH)
+
+    rows = store.list_ready_live_request_outbox(
+        now="9999-12-31T23:59:59+00:00",
+        limit=20,
+    )
+    assert "request-00" not in {row["local_request_id"] for row in rows}
+
+
 def test_worker_safety_interval_is_subsecond() -> None:
     assert live_request_sync.DEFAULT_POLL_INTERVAL_SECONDS <= 0.1
+    assert live_request_sync.LIVE_REQUEST_SYNC_BATCH_SIZE == 1

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/tests/test_guard_surface_server.py

@@ -1705,7 +1705,7 @@ class TestGuardSurfaceServer:
     def test_guard_daemon_keeps_stream_clients_alive_past_idle_timeout(self, tmp_path) -> None:
         guard_home = tmp_path / "pytest-of-user" / "guard-home"
         store = GuardStore(guard_home)
-        daemon = GuardDaemonServer(store, host="127.0.0.1", port=0, idle_timeout_seconds=0.05)
+        daemon = GuardDaemonServer(store, host="127.0.0.1", port=0, idle_timeout_seconds=0.5)
         daemon.start()
         response = None
 
@@ -1716,7 +1716,7 @@ class TestGuardSurfaceServer:
                 method="GET",
             )
             response = urllib.request.urlopen(stream_request, timeout=5)
-            time.sleep(0.15)
+            time.sleep(0.75)
             daemon_thread = daemon._thread
             daemon_thread_alive = daemon_thread is not None and daemon_thread.is_alive()
             runtime_state = store.get_runtime_state()

{plugin_scanner-2.0.1052 → plugin_scanner-2.0.1053}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.1052"
+version = "2.0.1053"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner" },