plugin-scanner 2.0.1064__tar.gz → 2.0.1065__tar.gz

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1064
+Version: 2.0.1065
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1064"
+version = "2.0.1065"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1064"
+version = "2.0.1065"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/src/codex_plugin_scanner/guard/cli/commands_support_codex_commands.py

@@ -230,6 +230,7 @@ _CODEX_SEARCH_OPTION_VALUE_FLAGS = frozenset(
 )
 
 _CODEX_SEARCH_OPTION_VALUE_FLAGS_BY_EXECUTABLE = {
+    "grep": frozenset({"-d", "--directories"}),
     "rg": frozenset({"-T"}),
 }
 

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/src/codex_plugin_scanner/guard/cli/commands_support_codex_paths.py

@@ -150,9 +150,22 @@ def _codex_search_targets_are_source_like(
     targets = _codex_search_targets(args, executable=executable)
     if not targets:
         return False
-    return bool(targets) and all(
-        _codex_search_target_is_source_like(target, cwd=cwd, home_dir=home_dir) for target in targets
+    from ..runtime.source_paths import source_path_is_allowed
+
+    allow_external_source = executable == "grep"
+    decisions = tuple(
+        source_path_is_allowed(
+            target,
+            cwd=cwd,
+            home_dir=home_dir,
+            allow_external_source=allow_external_source,
+        )
+        for target in targets
     )
+    if not all(decision.allowed for decision in decisions):
+        return False
+    has_external_target = any(decision.reason_code == "external_source_path" for decision in decisions)
+    return not (has_external_target and executable == "grep" and _codex_grep_args_request_recursive_search(args))
 
 
 def _codex_fd_targets_are_source_like(args: list[str], *, cwd: Path | None, home_dir: Path | None) -> bool:
@@ -183,6 +196,44 @@ def _codex_fd_exec_is_bounded_read_only(args: list[str]) -> bool:
     return _codex_sed_args_are_bounded_filter(sed_args)
 
 
+def _codex_grep_args_request_recursive_search(args: list[str]) -> bool:
+    skip_next = False
+    for index, arg in enumerate(args):
+        if skip_next:
+            skip_next = False
+            continue
+        if arg == "--":
+            return False
+        if arg in _CODEX_SEARCH_PATTERN_VALUE_FLAGS:
+            skip_next = True
+            continue
+        if any(arg.startswith(flag) and len(arg) > len(flag) for flag in ("-e", "-f")):
+            continue
+        if arg in {"--dereference-recursive", "--recursive"}:
+            return True
+        if arg == "-d":
+            if index + 1 >= len(args) or args[index + 1] not in {"read", "skip"}:
+                return True
+            skip_next = True
+            continue
+        if arg.startswith("-d"):
+            if arg.removeprefix("-d") not in {"read", "skip"}:
+                return True
+            continue
+        if arg == "--directories":
+            if index + 1 >= len(args) or args[index + 1] not in {"read", "skip"}:
+                return True
+            skip_next = True
+            continue
+        if arg.startswith("--directories="):
+            if arg.removeprefix("--directories=") not in {"read", "skip"}:
+                return True
+            continue
+        if arg.startswith("-") and not arg.startswith("--") and "r" in arg[1:]:
+            return True
+    return False
+
+
 def _codex_search_targets(args: list[str], *, executable: str) -> tuple[str, ...]:
     positional: list[str] = []
     skip_next = False
@@ -244,10 +295,38 @@ def _codex_search_arg_is_unsafe(arg: str, *, executable: str, option_value_flags
     return False
 
 
-def _codex_search_target_is_source_like(target: str, *, cwd: Path | None, home_dir: Path | None) -> bool:
+def _codex_search_target_is_source_like(
+    target: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None,
+    allow_external_source: bool = False,
+) -> bool:
+    from ..runtime.source_paths import source_path_is_allowed
+
+    return source_path_is_allowed(
+        target,
+        cwd=cwd,
+        home_dir=home_dir,
+        allow_external_source=allow_external_source,
+    ).allowed
+
+
+def _codex_search_target_is_external_source_like(
+    target: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None,
+) -> bool:
     from ..runtime.source_paths import source_path_is_allowed
 
-    return source_path_is_allowed(target, cwd=cwd, home_dir=home_dir).allowed
+    decision = source_path_is_allowed(
+        target,
+        cwd=cwd,
+        home_dir=home_dir,
+        allow_external_source=True,
+    )
+    return decision.reason_code == "external_source_path"
 
 
 def _codex_resolve_source_like_path(target: str, *, cwd: Path | None, home_dir: Path | None) -> Path | None:
@@ -459,6 +538,7 @@ __all__ = [
     "_codex_prompt_display_text",
     "_codex_resolve_source_like_path",
     "_codex_search_arg_is_unsafe",
+    "_codex_search_target_is_external_source_like",
     "_codex_search_target_is_source_like",
     "_codex_search_targets",
     "_codex_search_targets_are_source_like",

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/src/codex_plugin_scanner/guard/cli/commands_support_codex_reads.py

@@ -26,6 +26,7 @@ if TYPE_CHECKING:
         _codex_fd_targets,
         _codex_fd_targets_are_source_like,
         _codex_resolve_source_like_path,
+        _codex_search_target_is_external_source_like,
         _codex_search_target_is_source_like,
         _codex_search_targets,
         _codex_search_targets_are_source_like,
@@ -73,6 +74,34 @@ def _codex_source_inspection_target_tokens(parts: list[str]) -> tuple[str, ...]:
     return ()
 
 
+def _codex_command_has_external_source_search_target(
+    command_text: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None,
+) -> bool:
+    chained_segments = _split_codex_safe_read_only_chain(command_text)
+    if chained_segments is not None:
+        return any(
+            _codex_command_has_external_source_search_target(segment, cwd=cwd, home_dir=home_dir)
+            for segment in chained_segments
+        )
+    pipeline_segments = _split_codex_safe_read_only_pipeline(command_text)
+    if pipeline_segments:
+        return any(
+            _codex_command_has_external_source_search_target(segment, cwd=cwd, home_dir=home_dir)
+            for segment in pipeline_segments
+        )
+    try:
+        parts = shlex.split(command_text)
+    except ValueError:
+        return False
+    return any(
+        _codex_search_target_is_external_source_like(target, cwd=cwd, home_dir=home_dir)
+        for target in _codex_source_inspection_target_tokens(parts)
+    )
+
+
 def _codex_cat_targets(args: list[str]) -> list[str]:
     targets: list[str] = []
     after_option_terminator = False
@@ -100,6 +129,15 @@ def _codex_command_is_read_only_source_inspection(
         return False
     if _codex_command_has_unquoted_glob_metachar(command):
         return False
+    if _codex_command_has_external_source_search_target(command, cwd=cwd, home_dir=home_dir):
+        try:
+            parts = shlex.split(command)
+        except ValueError:
+            return False
+        if not parts or parts[0] != "grep":
+            return False
+        # External targets are allowed only for one direct plain grep command.
+        return _codex_command_is_read_only_source_search(command, cwd=cwd, home_dir=home_dir)
     chained_segments = _split_codex_safe_read_only_chain(command)
     if chained_segments is not None:
         current_cwd = cwd
@@ -529,6 +567,7 @@ def _codex_sed_args_are_bounded_filter(args: list[str]) -> bool:
 __all__ = [
     "_codex_cat_targets",
     "_codex_cat_targets_are_source_like",
+    "_codex_command_has_external_source_search_target",
     "_codex_command_has_unquoted_glob_metachar",
     "_codex_command_is_bounded_read_only_filter",
     "_codex_command_is_read_only_source_inspection",

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/src/codex_plugin_scanner/guard/runtime/source_paths.py

@@ -28,6 +28,26 @@ SOURCE_CLASSIFIER_VERSION = "source-paths-v1"
 # does not depend on CLI internals. They are kept in sync via re-import.
 _BENIGN_SOURCE_DOTFILES = SOURCE_INSPECTION_BENIGN_DOTFILES | frozenset({".worktrees"})
 _SENSITIVE_SEARCH_BASENAMES = SOURCE_INSPECTION_SENSITIVE_PARTS | frozenset({"id_rsa"})
+_EXTERNAL_SOURCE_SENSITIVE_PARTS = _SENSITIVE_SEARCH_BASENAMES | frozenset(
+    {
+        "auth",
+        "authorization",
+        "credential",
+        "credentials",
+        "id_dsa",
+        "id_ecdsa",
+        "id_ed25519",
+        "id_rsa",
+        "passwd",
+        "password",
+        "private-key",
+        "private_key",
+        "secret",
+        "secrets",
+        "token",
+        "tokens",
+    }
+)
 _SOURCE_SEARCH_PREFIXES = tuple(f"{part}/" for part in sorted(SOURCE_INSPECTION_PARTS))
 _SOURCE_SEARCH_EXTENSIONS = SOURCE_INSPECTION_EXTENSIONS
 
@@ -65,6 +85,53 @@ def path_contains_symlink(path: Path, *, base_dir: Path) -> bool:
     return False
 
 
+def _path_contains_symlink_component(path: Path) -> bool:
+    """Return True if any existing component of an absolute path is a symlink."""
+    candidate = Path(path.anchor)
+    for part in path.parts:
+        if part in {"", path.anchor, "."}:
+            continue
+        if part == "..":
+            candidate = candidate.parent
+            continue
+        candidate /= part
+        try:
+            if candidate.is_symlink():
+                return True
+        except OSError:
+            return True
+    return False
+
+
+def _is_immediate_sibling_git_checkout_path(path: Path, *, workspace_dir: Path) -> bool:
+    try:
+        sibling_relative = path.relative_to(workspace_dir.parent)
+    except ValueError:
+        return False
+    if not sibling_relative.parts:
+        return False
+    checkout_root = workspace_dir.parent / sibling_relative.parts[0]
+    if checkout_root == workspace_dir:
+        return False
+    git_marker = checkout_root / ".git"
+    try:
+        return not git_marker.is_symlink() and (git_marker.is_file() or git_marker.is_dir())
+    except OSError:
+        return False
+
+
+def _external_source_filename_is_sensitive(path: Path) -> bool:
+    filename = path.name.lower()
+    stem = Path(filename).stem
+    if filename in _EXTERNAL_SOURCE_SENSITIVE_PARTS or stem in _EXTERNAL_SOURCE_SENSITIVE_PARTS:
+        return True
+    tokens = stem.replace("-", "_").replace(".", "_").split("_")
+    return any(
+        token and (token in _EXTERNAL_SOURCE_SENSITIVE_PARTS or f".{token}" in _EXTERNAL_SOURCE_SENSITIVE_PARTS)
+        for token in tokens
+    )
+
+
 def resolve_source_candidate_path(
     target: str,
     *,
@@ -98,6 +165,7 @@ def source_path_is_allowed(
     *,
     cwd: Path | None,
     home_dir: Path | None,
+    allow_external_source: bool = False,
 ) -> SourcePathDecision:
     """Classify whether ``target`` is an allowed source-like path.
 
@@ -106,7 +174,8 @@ def source_path_is_allowed(
     2. ``~`` path requires ``home_dir``; otherwise reject.
     3. Known skill/doc path is allowed.
     4. Glob characters reject.
-    5. Absolute paths must be inside ``cwd`` after resolve.
+    5. Absolute paths must be inside ``cwd`` after resolve, unless the caller
+       explicitly opts into an existing, source-like external search target.
     6. Relative paths resolve under ``cwd``.
     7. Reject if any symlink component.
     8. Reject if any sensitive basename.
@@ -131,21 +200,83 @@ def source_path_is_allowed(
         return SourcePathDecision(allowed=False, reason_code="glob_pattern")
 
     base_dir = (cwd or Path.cwd()).resolve()
-    target_path = resolve_source_candidate_path(stripped, cwd=base_dir, home_dir=home_dir)
+    external_path_requested = Path(stripped).is_absolute() or stripped.startswith("~/")
+    if stripped.startswith("~/") and home_dir is not None:
+        # Keep the lexical path so external symlink components cannot be hidden
+        # by the normal tilde-resolution helper.
+        target_path = home_dir / stripped[2:]
+    else:
+        target_path = resolve_source_candidate_path(stripped, cwd=base_dir, home_dir=home_dir)
     if target_path is None:
         return SourcePathDecision(allowed=False, reason_code="unresolved_path")
 
     if target_path.is_absolute():
         # Check for symlinks BEFORE resolving — resolve() follows symlinks
         # and would hide them, making path_contains_symlink a no-op.
-        if path_contains_symlink(target_path, base_dir=base_dir):
-            return SourcePathDecision(allowed=False, reason_code="symlink_in_path")
+        try:
+            target_path.relative_to(base_dir)
+        except ValueError:
+            if not allow_external_source or not external_path_requested:
+                return SourcePathDecision(allowed=False, reason_code="absolute_path_outside_workspace")
+            if _path_contains_symlink_component(target_path):
+                return SourcePathDecision(allowed=False, reason_code="symlink_in_path")
+        else:
+            if path_contains_symlink(target_path, base_dir=base_dir):
+                return SourcePathDecision(allowed=False, reason_code="symlink_in_path")
         try:
             candidate = target_path.resolve(strict=False)
-            relative_candidate = candidate.relative_to(base_dir)
         except (RuntimeError, ValueError):
             return SourcePathDecision(allowed=False, reason_code="absolute_path_outside_workspace")
-        parts = [part for part in relative_candidate.parts if part not in {"", "."}]
+        try:
+            relative_candidate = candidate.relative_to(base_dir)
+        except ValueError:
+            if not allow_external_source or not external_path_requested:
+                return SourcePathDecision(allowed=False, reason_code="absolute_path_outside_workspace")
+            if home_dir is None:
+                return SourcePathDecision(allowed=False, reason_code="external_home_unavailable")
+            try:
+                resolved_home_dir = home_dir.resolve(strict=True)
+            except (OSError, RuntimeError, ValueError):
+                return SourcePathDecision(allowed=False, reason_code="external_home_unavailable")
+            if not resolved_home_dir.is_dir():
+                return SourcePathDecision(allowed=False, reason_code="external_home_unavailable")
+            try:
+                candidate.relative_to(resolved_home_dir)
+            except ValueError:
+                return SourcePathDecision(allowed=False, reason_code="external_target_outside_home")
+            if not _is_immediate_sibling_git_checkout_path(candidate, workspace_dir=base_dir):
+                return SourcePathDecision(allowed=False, reason_code="external_target_not_sibling_git_checkout")
+            if not candidate.exists() or not (candidate.is_file() or candidate.is_dir()):
+                return SourcePathDecision(allowed=False, reason_code="external_target_not_readable")
+            parts = [part for part in candidate.parts if part not in {"", candidate.anchor, "."}]
+            lowered_parts = [part.lower() for part in parts]
+            if any(part in _EXTERNAL_SOURCE_SENSITIVE_PARTS for part in lowered_parts) or (
+                _external_source_filename_is_sensitive(candidate)
+            ):
+                return SourcePathDecision(allowed=False, reason_code="sensitive_basename")
+            hidden_parts = [part for part in lowered_parts if part.startswith(".")]
+            if hidden_parts and not all(part in _BENIGN_SOURCE_DOTFILES for part in hidden_parts):
+                return SourcePathDecision(allowed=False, reason_code="unsafe_hidden_dir")
+            normalized = "/".join(parts)
+            if not (
+                any(normalized.startswith(prefix) for prefix in _SOURCE_SEARCH_PREFIXES)
+                or any(part in SOURCE_INSPECTION_PARTS for part in lowered_parts)
+                or Path(stripped).suffix.lower() in _SOURCE_SEARCH_EXTENSIONS
+            ):
+                return SourcePathDecision(
+                    allowed=False,
+                    reason_code="not_source_like",
+                    resolved_path=candidate,
+                    relative_path=normalized,
+                )
+            return SourcePathDecision(
+                allowed=True,
+                reason_code="external_source_path",
+                resolved_path=candidate,
+                relative_path=normalized,
+            )
+        else:
+            parts = [part for part in relative_candidate.parts if part not in {"", "."}]
     else:
         unresolved_candidate = base_dir / target_path
         if path_contains_symlink(unresolved_candidate, base_dir=base_dir):

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1064"
+__version__ = "2.0.1065"

{plugin_scanner-2.0.1064 → plugin_scanner-2.0.1065}/tests/test_guard_runtime.py

@@ -19617,6 +19617,57 @@ def test_sync_runtime_session_treats_token_endpoint_503_as_retryable_error(tmp_p
     assert not isinstance(error.value, guard_runner_module.GuardSyncAuthorizationExpiredError)
 
 
+def test_codex_read_only_source_inspection_external_targets_require_plain_non_recursive_grep(
+    tmp_path: Path,
+) -> None:
+    home_dir = tmp_path / "home"
+    projects_dir = home_dir / "projects"
+    workspace_dir = projects_dir / "workspace"
+    source_root = projects_dir / "sibling-worktree"
+    source_file = source_root / "src" / "safe.ts"
+    workspace_dir.mkdir(parents=True)
+    source_file.parent.mkdir(parents=True)
+    source_file.write_text("export const browser = true;\n")
+    (source_root / ".git").write_text("gitdir: ../.git/worktrees/test-checkout\n")
+
+    assert guard_commands_module._codex_command_is_read_only_source_inspection(
+        f"grep 'browser' {source_file}",
+        cwd=workspace_dir,
+        home_dir=home_dir,
+    )
+
+    workspace_source = workspace_dir / "src" / "local.ts"
+    workspace_source.parent.mkdir()
+    workspace_source.write_text("export const browser = true;\n")
+    assert guard_commands_module._codex_command_is_read_only_source_inspection(
+        f"grep -r 'browser' {workspace_source.parent}",
+        cwd=workspace_dir,
+        home_dir=home_dir,
+    )
+
+    rejected_commands = (
+        f"grep -r 'browser' {source_file.parent}",
+        f"grep -R 'browser' {source_file.parent}",
+        f"grep -rn 'browser' {source_file.parent}",
+        f"grep -nR 'browser' {source_file.parent}",
+        f"grep --recursive 'browser' {source_file.parent}",
+        f"grep --dereference-recursive 'browser' {source_file.parent}",
+        f"grep -d recurse 'browser' {source_file.parent}",
+        f"grep -drecurse 'browser' {source_file.parent}",
+        f"grep --directories=recurse 'browser' {source_file.parent}",
+        f"grep --directories recurse 'browser' {source_file.parent}",
+        f"rg 'browser' {source_file}",
+        f"git grep 'browser' {source_file}",
+        f"bash -c \"grep 'browser' {source_file}\"",
+    )
+    for command in rejected_commands:
+        assert not guard_commands_module._codex_command_is_read_only_source_inspection(
+            command,
+            cwd=workspace_dir,
+            home_dir=home_dir,
+        )
+
+
 def test_codex_read_only_source_inspection_rejects_globbed_targets(tmp_path: Path) -> None:
     workspace_dir = tmp_path / "workspace"
     (workspace_dir / "src").mkdir(parents=True)