plugin-scanner 2.0.1079__tar.gz → 2.0.1081__tar.gz

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1079
+Version: 2.0.1081
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/dashboard/src/approval-scopes.test.ts

@@ -1,5 +1,6 @@
 import {
   buildDecisionPayload,
+  normalizeDecisionScope,
   scopeChoicesForRequest,
   isAdvancedScope,
   advancedScopeChoicesForRequest,
@@ -84,6 +85,28 @@ assert(limitedScopeValues.includes("global"), "T-AS-04: global scope is availabl
 assert(!limitedScopeValues.includes("workspace"), "T-AS-04: workspace scope is hidden when the request has no workspace");
 assert(!limitedScopeValues.includes("publisher"), "T-AS-04: publisher scope is hidden when the request has no publisher");
 
+const requestWithDaemonScopeRestrictions: GuardApprovalRequest = {
+  ...BASE_REQUEST,
+  request_id: "request-restricted-by-daemon",
+  allowed_scopes: ["artifact", "workspace", "publisher"],
+};
+const daemonRestrictedScopeValues = scopeChoicesForRequest(requestWithDaemonScopeRestrictions).map(
+  (choice) => choice.value,
+);
+
+assert(
+  !daemonRestrictedScopeValues.includes("harness"),
+  "T-AS-05: This app is hidden when the daemon does not allow harness scope",
+);
+assert(
+  !daemonRestrictedScopeValues.includes("global"),
+  "T-AS-05: Everywhere is hidden when the daemon does not allow global scope",
+);
+assert(
+  normalizeDecisionScope(requestWithDaemonScopeRestrictions, "global") === "artifact",
+  "T-AS-06: a stale unsupported selection falls back to an allowed scope",
+);
+
 assert(
   ADVANCED_SCOPE_VALUES.has("global"),
   "T-AS-GR118-01: ADVANCED_SCOPE_VALUES contains global"

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/dashboard/src/approval-scopes.ts

@@ -40,6 +40,9 @@ export const DEFAULT_SCOPE_CHOICES: ApprovalScopeChoice[] = [
 ];
 
 export function requestSupportsScope(item: GuardApprovalRequest, scope: DecisionScope): boolean {
+  if (Array.isArray(item.allowed_scopes)) {
+    return item.allowed_scopes.includes(scope);
+  }
   if (scope === "workspace") {
     return typeof item.workspace === "string" && item.workspace.trim().length > 0;
   }

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/dashboard/src/guard-types.ts

@@ -125,6 +125,7 @@ export type GuardApprovalRequest = {
   publisher: string | null;
   policy_action: string;
   recommended_scope: DecisionScope;
+  allowed_scopes?: DecisionScope[];
   risk_headline?: string;
   risk_summary?: string;
   risk_signals?: string[];

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1079"
+version = "2.0.1081"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1079"
+version = "2.0.1081"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py

@@ -432,6 +432,11 @@ def _runtime_artifact_risk_classes(artifact: GuardArtifact) -> list[str]:
         return risk_classes
     if artifact.artifact_type != "tool_action_request":
         return []
+    composite_risk_classes = artifact.metadata.get("risk_classes")
+    if isinstance(composite_risk_classes, list):
+        normalized = [value for value in composite_risk_classes if isinstance(value, str) and value.strip()]
+        if normalized:
+            return list(dict.fromkeys(normalized))
     action_class = artifact.metadata.get("action_class")
     if not isinstance(action_class, str):
         return []

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -23189,6 +23189,9 @@ const DEFAULT_SCOPE_CHOICES = [
   }
 ];
 function requestSupportsScope(item, scope) {
+  if (Array.isArray(item.allowed_scopes)) {
+    return item.allowed_scopes.includes(scope);
+  }
   if (scope === "workspace") {
     return typeof item.workspace === "string" && item.workspace.trim().length > 0;
   }

plugin_scanner-2.0.1081/src/codex_plugin_scanner/guard/runtime/command_evaluation.py

@@ -0,0 +1,106 @@
+"""Composite command evaluation shared by inspection and runtime policy."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from .command_extensions import BUILT_IN_COMMAND_EXTENSION_REGISTRY, CommandSafetyExtension
+from .command_model import CanonicalCommand, parse_shell_command
+from .command_rules import CommandRuleMatch
+
+
+@dataclass(frozen=True, slots=True)
+class OwnedCommandRuleMatch:
+    """One rule match with its owning extension."""
+
+    extension: CommandSafetyExtension
+    match: CommandRuleMatch
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "extension_id": self.extension.extension_id,
+            **self.match.to_dict(),
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class CompositeCommandEvaluation:
+    """All command matches plus the compatibility-preserving controlling action."""
+
+    command: CanonicalCommand
+    matches: tuple[OwnedCommandRuleMatch, ...]
+    controlling_action_class: str | None
+    controlling_reason: str | None
+
+    @property
+    def risk_classes(self) -> tuple[str, ...]:
+        return tuple(sorted({risk for owned in self.matches for risk in owned.match.rule.risk_classes}))
+
+    @property
+    def matched(self) -> bool:
+        return self.controlling_action_class is not None or bool(self.matches)
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "security_identity": self.command.security_identity,
+            "controlling_action_class": self.controlling_action_class,
+            "controlling_reason": self.controlling_reason,
+            "risk_classes": list(self.risk_classes),
+            "matches": [owned.to_dict() for owned in self.matches],
+            "parse_confidence": self.command.confidence,
+            "uncertainty_reason": self.command.uncertainty_reason,
+        }
+
+
+def evaluate_command(
+    command_text: str,
+    *,
+    canonical_command: CanonicalCommand | None = None,
+    compatibility_action_class: str | None = None,
+    compatibility_reason: str | None = None,
+    cwd: Path | None = None,
+    home_dir: Path | None = None,
+) -> CompositeCommandEvaluation:
+    """Evaluate every built-in rule without executing or persisting the command."""
+
+    command = canonical_command or parse_shell_command(command_text, cwd=cwd, home_dir=home_dir)
+    structured = BUILT_IN_COMMAND_EXTENSION_REGISTRY.matching_rules(command)
+    selected = list(structured)
+    selected_rule_ids = {rule.rule_id for _extension, rule, _evidence in selected}
+    if compatibility_action_class is not None:
+        extension = BUILT_IN_COMMAND_EXTENSION_REGISTRY.for_action_class(compatibility_action_class)
+        rule = BUILT_IN_COMMAND_EXTENSION_REGISTRY.rule_for_action_class(compatibility_action_class)
+        if extension is not None and rule is not None and rule.rule_id not in selected_rule_ids:
+            selected.append((extension, rule, ()))
+
+    owned_matches: list[OwnedCommandRuleMatch] = []
+    for extension, rule, evidence in selected:
+        action_class = rule.action_classes[0] if rule.action_classes else compatibility_action_class
+        reason = rule.description
+        if rule.compatibility_fallback and compatibility_reason is not None:
+            reason = compatibility_reason
+        owned_matches.append(
+            OwnedCommandRuleMatch(
+                extension=extension,
+                match=CommandRuleMatch(
+                    rule=rule,
+                    action_class=action_class,
+                    reason=reason,
+                    command=command,
+                    matcher_evidence=evidence,
+                ),
+            )
+        )
+
+    controlling_action_class = compatibility_action_class
+    controlling_reason = compatibility_reason
+    if controlling_action_class is None and owned_matches:
+        controlling_action_class = owned_matches[0].match.action_class
+        controlling_reason = owned_matches[0].match.reason
+    return CompositeCommandEvaluation(
+        command=command,
+        matches=tuple(owned_matches),
+        controlling_action_class=controlling_action_class,
+        controlling_reason=controlling_reason,
+    )

{plugin_scanner-2.0.1079 → plugin_scanner-2.0.1081}/src/codex_plugin_scanner/guard/runtime/command_inspection.py

@@ -5,12 +5,12 @@ from __future__ import annotations
 from pathlib import Path
 
 from codex_plugin_scanner.guard.risk import artifact_risk_signals_v2
+from codex_plugin_scanner.guard.runtime.command_evaluation import evaluate_command
 from codex_plugin_scanner.guard.runtime.command_extensions import (
     BUILT_IN_COMMAND_EXTENSION_REGISTRY,
     COMMAND_EXTENSION_SCHEMA_VERSION,
 )
 from codex_plugin_scanner.guard.runtime.command_model import parse_shell_command
-from codex_plugin_scanner.guard.runtime.command_rules import CommandRuleMatch
 from codex_plugin_scanner.guard.runtime.secret_file_requests import (
     build_tool_action_request_artifact,
     extract_sensitive_tool_action_request,
@@ -34,7 +34,21 @@ def inspect_command(
     canonical_command = parse_shell_command(command_text, cwd=workspace, home_dir=home)
     arguments = {"command": command_text}
     benign = is_explicitly_benign_tool_action_request("Shell", arguments, cwd=workspace, home_dir=home)
-    match = extract_sensitive_tool_action_request("Shell", arguments, cwd=workspace, home_dir=home)
+    match = extract_sensitive_tool_action_request(
+        "Shell",
+        arguments,
+        cwd=workspace,
+        home_dir=home,
+        canonical_command=canonical_command,
+    )
+    evaluation = evaluate_command(
+        command_text,
+        canonical_command=canonical_command,
+        compatibility_action_class=match.action_class if match is not None else None,
+        compatibility_reason=match.reason if match is not None else None,
+        cwd=workspace,
+        home_dir=home,
+    )
     trace: list[dict[str, object]] = [
         {
             "step": "canonical-parse",
@@ -52,15 +66,14 @@ def inspect_command(
             "detail": "Ran the same sensitive command parser used by Guard harness hooks.",
         },
     ]
-    structured_matches = BUILT_IN_COMMAND_EXTENSION_REGISTRY.matching_rules(canonical_command)
     trace.append(
         {
             "step": "structured-rule-matching",
-            "result": str(len(structured_matches)),
+            "result": str(len(evaluation.matches)),
             "detail": "Matched versioned command rules against the canonical command model.",
         }
     )
-    if match is None and not structured_matches:
+    if not evaluation.matched:
         return {
             "schema_version": COMMAND_EXTENSION_SCHEMA_VERSION,
             "status": "no_match",
@@ -86,21 +99,6 @@ def inspect_command(
             "side_effects": "none",
         }
 
-    compatibility_extension = (
-        BUILT_IN_COMMAND_EXTENSION_REGISTRY.for_action_class(match.action_class) if match is not None else None
-    )
-    compatibility_rule = (
-        BUILT_IN_COMMAND_EXTENSION_REGISTRY.rule_for_action_class(match.action_class) if match is not None else None
-    )
-    selected_matches = list(structured_matches)
-    selected_rule_ids = {rule.rule_id for _extension, rule, _evidence in selected_matches}
-    if (
-        compatibility_extension is not None
-        and compatibility_rule is not None
-        and compatibility_rule.rule_id not in selected_rule_ids
-    ):
-        selected_matches.append((compatibility_extension, compatibility_rule, ()))
-
     signals = ()
     if match is not None:
         artifact = build_tool_action_request_artifact(
@@ -110,25 +108,7 @@ def inspect_command(
             source_scope="inspection",
         )
         signals = artifact_risk_signals_v2(artifact)
-    extensions_by_id = {extension.extension_id: extension for extension, _rule, _evidence in selected_matches}
-    rule_matches: list[CommandRuleMatch] = []
-    for _extension, rule, evidence in selected_matches:
-        rule_action_class = rule.action_classes[0] if rule.action_classes else None
-        if rule_action_class is None and match is not None:
-            rule_action_class = match.action_class
-        rule_reason = rule.description
-        if match is not None and rule.compatibility_fallback:
-            rule_reason = match.reason
-        rule_matches.append(
-            CommandRuleMatch(
-                rule=rule,
-                action_class=rule_action_class,
-                reason=rule_reason,
-                command=canonical_command,
-                matcher_evidence=evidence,
-            )
-        )
-    risk_classes = sorted({risk for rule_match in rule_matches for risk in rule_match.rule.risk_classes})
+    extensions_by_id = {owned.extension.extension_id: owned.extension for owned in evaluation.matches}
     trace.extend(
         (
             {
@@ -138,7 +118,7 @@ def inspect_command(
             },
             {
                 "step": "rule-ownership",
-                "result": ",".join(rule_match.rule.rule_id for rule_match in rule_matches) or "unowned",
+                "result": ",".join(owned.match.rule.rule_id for owned in evaluation.matches) or "unowned",
                 "detail": "Selected every matching structured rule without making a policy decision.",
             },
             {
@@ -148,13 +128,10 @@ def inspect_command(
             },
         )
     )
-    primary_rule_match = rule_matches[0] if rule_matches else None
-    classification_action_class = match.action_class if match is not None else None
-    classification_reason = match.reason if match is not None else None
-    if primary_rule_match is not None:
-        classification_action_class = classification_action_class or primary_rule_match.action_class
-        classification_reason = classification_reason or primary_rule_match.rule.description
-    classification_reason = classification_reason or "Sensitive command matched without registered rule metadata."
+    classification_reason = evaluation.controlling_reason or (
+        "Sensitive command matched without registered rule metadata."
+    )
+    wrapper_chain = list(dict.fromkeys((*canonical_command.wrapper_chain, *(match.wrapper_chain if match else ()))))
     return {
         "schema_version": COMMAND_EXTENSION_SCHEMA_VERSION,
         "status": "review",
@@ -162,15 +139,15 @@ def inspect_command(
         "classification": {
             "matched": True,
             "explicitly_benign": benign,
-            "action_class": classification_action_class,
+            "action_class": evaluation.controlling_action_class,
             "reason": classification_reason,
             "normalized_command": match.command_text if match is not None else canonical_command.normalized_text,
-            "wrapper_chain": list(match.wrapper_chain) if match is not None else list(canonical_command.wrapper_chain),
+            "wrapper_chain": wrapper_chain,
         },
-        "risk_classes": risk_classes,
+        "risk_classes": list(evaluation.risk_classes),
         "signals": [signal.to_dict() for signal in signals],
         "extensions": [extensions_by_id[extension_id].to_dict() for extension_id in sorted(extensions_by_id)],
-        "rules": [rule_match.to_dict() for rule_match in rule_matches],
+        "rules": [owned.to_dict() for owned in evaluation.matches],
         "command_model": canonical_command.to_dict(),
         "trace": trace,
         "policy_evaluation": "not_run",