plugin-scanner 2.0.1081__tar.gz → 2.0.1083__tar.gz

plugin_scanner-2.0.1083/.github/workflows/mdm-artifacts.yml

@@ -0,0 +1,72 @@
+name: MDM artifacts
+
+on:
+  workflow_dispatch:
+    inputs:
+      build_id:
+        description: Immutable release build identifier
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-14, macos-15, windows-2022, windows-2025]
+        python: ['3.12']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen --extra dev --python ${{ matrix.python }}
+      - run: uv run --no-sync pytest tests/test_guard_mdm_*.py --tb=short
+      - run: uv run --no-sync basedpyright --level error
+      - run: uv run --no-sync ruff check src/ tests/test_guard_mdm_*.py scripts/mdm/generate-release-manifest.py
+
+  unsigned-artifact:
+    needs: tests
+    strategy:
+      matrix:
+        include:
+          - os: macos-14
+            platform: macos
+          - os: windows-2022
+            platform: windows
+    runs-on: ${{ matrix.os }}
+    env:
+      HOL_GUARD_BUILD_ID: ${{ inputs.build_id }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen --extra mdm-build --python 3.12
+      - shell: bash
+        run: echo "HOL_GUARD_VERSION=$(uv run python -c 'from codex_plugin_scanner.version import __version__; print(__version__)')" >> "$GITHUB_ENV"
+      - if: matrix.platform == 'macos'
+        run: scripts/mdm/macos/build-pkg.sh
+      - if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          binary="dist/mdm/macos/stage/Library/Application Support/HOL Guard/hol-guard/hol-guard"
+          "$binary" --version
+          if "$binary" mdm status --scope machine --machine-root "dist/mdm/macos/stage/Library/Application Support/HOL Guard" --json; then exit 1; fi
+      - if: matrix.platform == 'windows'
+        shell: pwsh
+        run: dotnet tool install --global wix --version 6.0.2
+      - if: matrix.platform == 'windows'
+        shell: pwsh
+        run: scripts/mdm/windows/build-msi.ps1
+      - if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          $binary = 'dist/mdm/windows/runtime/hol-guard/hol-guard.exe'
+          & $binary --version
+          & $binary mdm status --scope machine --machine-root 'dist/mdm/windows/runtime' --json
+          if ($LASTEXITCODE -eq 0) { throw 'Unsigned fixture must not report healthy.' }
+      - uses: actions/upload-artifact@v4
+        with:
+          name: hol-guard-${{ matrix.platform }}-unsigned-${{ inputs.build_id }}
+          path: dist/mdm/${{ matrix.platform }}/
+          if-no-files-found: error

{plugin_scanner-2.0.1081 → plugin_scanner-2.0.1083}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1081
+Version: 2.0.1083
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard
@@ -42,6 +42,8 @@ Requires-Dist: pytest-cov>=7.1.0; extra == 'dev'
 Requires-Dist: pytest>=9.0.3; extra == 'dev'
 Requires-Dist: pyyaml>=6.0.3; extra == 'dev'
 Requires-Dist: ruff>=0.15.15; extra == 'dev'
+Provides-Extra: mdm-build
+Requires-Dist: pyinstaller<7,>=6.16; extra == 'mdm-build'
 Provides-Extra: publish
 Requires-Dist: twine>=6.2.0; extra == 'publish'
 Description-Content-Type: text/markdown

plugin_scanner-2.0.1083/docs/guard/adr/0001-mdm-managed-install-contract.md

@@ -0,0 +1,20 @@
+# ADR 0001: MDM managed-install contract
+
+Status: accepted for implementation; customer platform inputs remain release gates.
+
+## Decision
+
+- Package ownership is per-machine. macOS uses receipt `org.hol.guard`; Windows uses per-machine MSI upgrade code `B15D39B1-6395-4FEA-98A9-5D734DDC455D`.
+- Machine runtime/state/log paths are `/Library/Application Support/HOL Guard`, `/Library/Application Support/HOL Guard State`, `/Library/Logs/HOL Guard` and `%ProgramFiles%\HOL Guard`, `%ProgramData%\HOL Guard`.
+- User state remains `~/.hol-guard`. Mutating lifecycle commands require the target user session; root/SYSTEM cannot substitute its profile.
+- macOS uses a LaunchAgent. Windows uses Active Setup. Both call idempotent repair at user login; runtime daemons remain on-demand by default.
+- Managed policy comes only from `org.hol.guard` managed preferences or `HKLM\Software\Policies\HOL\Guard`. Machine policy wins non-action conflicts. Security actions and modes compose to the strongest outcome; local sources may tighten locks.
+- MDM owns version changes when `update.owner=mdm`. Downgrades and self-removal fail closed. Evidence is preserved by default.
+- External HTTP uses one mandatory-TLS policy supporting system, explicit, or no proxy; private CA trust is additive. Public registry intelligence can be disabled independently from Guard Cloud.
+- Production packages require both a signed Ed25519 release manifest and native platform signatures. Unsigned artifacts are CI fixtures and must fail healthy detection.
+
+## Consequences
+
+The package never guesses a user from root/SYSTEM. A device install can succeed with no logged-in user, and each eligible user converges at login without reinstalling. Customer MDM assignment details, minimum OS/CPU scope, publisher identities, signing credentials, and Cloud enrollment remain certification inputs and cannot be inferred in code.
+
+This decision implements the threat boundaries and acceptance criteria in [the MDM PRD](../mdm-compatibility-prd.md), with schemas under [`schemas/`](../schemas/), deployment operations in [mdm-deployment.md](../mdm-deployment.md), and network controls in [mdm-networking.md](../mdm-networking.md).

{plugin_scanner-2.0.1081 → plugin_scanner-2.0.1083}/docs/guard/enterprise-packet.md

@@ -14,6 +14,11 @@ Related docs:
 - [Harness support matrix](./harness-support.md)
 - [Enterprise event taxonomy](./enterprise-event-taxonomy.md)
 - [Enterprise export examples](./enterprise-export-examples.md)
+- [MDM compatibility PRD](./mdm-compatibility-prd.md)
+- [MDM compatibility implementation TODO](./mdm-compatibility-todo.md)
+- [MDM deployment and Intune contract](./mdm-deployment.md)
+- [MDM proxy, private CA, and endpoint contract](./mdm-networking.md)
+- [MDM release evidence template](./mdm-release-evidence-template.md)
 
 ## Control maps
 

plugin_scanner-2.0.1083/docs/guard/mdm-deployment.md

@@ -0,0 +1,23 @@
+# HOL Guard MDM deployment
+
+## Supported contract
+
+HOL Guard uses package identity `org.hol.guard` on macOS and the stable MSI upgrade code `B15D39B1-6395-4FEA-98A9-5D734DDC455D` on Windows. The package owns the machine runtime; activation owns only the target user's `~/.hol-guard` state and reversible harness integrations.
+
+Builds require Python 3.12, the locked `uv` environment, and PyInstaller. macOS additionally requires Xcode command-line tools; Windows requires WiX 4 and SignTool. Production artifacts must be signed and, on macOS, notarized and stapled. Unsigned builds are test fixtures only.
+
+## Vendor-neutral deployment contract
+
+All MDM products use the same signed package, machine-policy schema, lifecycle commands, JSON status schema, and exit-code contract. Organization-specific assignment, proxy, trust, enrollment, retention, and policy values remain external configuration. Vendor adapters may translate these contracts into native packaging and detection formats, but must not fork Guard behavior or require a custom binary.
+
+## Intune adapter example
+
+- macOS install: `/usr/sbin/installer -pkg hol-guard.pkg -target /`
+- macOS uninstall: run the signed `uninstall.sh` as root.
+- Windows install: `msiexec /i hol-guard.msi /qn /norestart /l*v hol-guard-install.log`
+- Windows uninstall: `msiexec /x {product-code} /qn /norestart /l*v hol-guard-uninstall.log`
+- Detection runs the platform `detect` script in device context. Exit `0` means healthy, `1` means absent/degraded, `2` means invalid input, and `3` means removal authorization is required.
+- User activation runs the platform activation command in user context. Device installation must never substitute SYSTEM/root's home.
+- Managed deactivation is two-context: the device authority creates a ≤2-minute authorization under machine state, then the user-context command consumes it and restores that user's adapters. macOS `deactivate-user.sh` performs both steps; Windows uses `authorize-deactivation.ps1`, assigns `deactivate-user.ps1` in user context, then removes the authorization in device context.
+
+Use Intune supersedence for upgrades. The MSI blocks downgrades. Rollback requires an administrator-authorized package and managed policy permitting the target version. Preserve user evidence by default; remove it only through an explicit organization retention decision.

plugin_scanner-2.0.1083/docs/guard/mdm-endpoints.v1.json

@@ -0,0 +1,95 @@
+{
+  "schemaVersion": "hol-guard-endpoints.v1",
+  "endpoints": [
+    {
+      "hostname": "hol.org",
+      "port": 443,
+      "purpose": "Guard Cloud policy, identity, and evidence synchronization",
+      "required": false,
+      "methods": ["GET", "POST"],
+      "dataClass": "policy-and-security-evidence",
+      "offlineFallback": "Local enforcement continues with the last validated policy and freshness warning"
+    },
+    {
+      "hostname": "pypi.org",
+      "port": 443,
+      "purpose": "Optional package metadata intelligence for Python",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "registry.npmjs.org",
+      "port": 443,
+      "purpose": "Optional package metadata intelligence for npm",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "files.pythonhosted.org",
+      "port": 443,
+      "purpose": "Optional Python package artifact intelligence",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-artifact",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "registry.yarnpkg.com",
+      "port": 443,
+      "purpose": "Optional Yarn package metadata intelligence",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "crates.io",
+      "port": 443,
+      "purpose": "Optional Cargo package metadata intelligence",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "rubygems.org",
+      "port": 443,
+      "purpose": "Optional Ruby package metadata intelligence",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "repo.maven.apache.org",
+      "port": 443,
+      "purpose": "Optional Maven package metadata intelligence",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "proxy.golang.org",
+      "port": 443,
+      "purpose": "Optional Go module metadata intelligence",
+      "required": false,
+      "methods": ["GET"],
+      "dataClass": "public-package-metadata",
+      "offlineFallback": "Use signed cached intelligence or an approved internal mirror"
+    },
+    {
+      "hostname": "api.telegram.org",
+      "port": 443,
+      "purpose": "Optional administrator-configured approval notification bridge",
+      "required": false,
+      "methods": ["GET", "POST"],
+      "dataClass": "approval-notification",
+      "offlineFallback": "Use local approval center or another configured notification backend"
+    }
+  ]
+}

plugin_scanner-2.0.1083/docs/guard/mdm-general-availability-roadmap.md

@@ -0,0 +1,36 @@
+# HOL Guard MDM General Availability Roadmap
+
+HOL Guard's managed deployment contract is organization-neutral. Every organization receives the same signed artifacts and lifecycle behavior. Tenant-specific policy, trust, proxy, enrollment, assignment, and retention values enter through managed configuration rather than source changes or custom packages.
+
+## P0: production foundation
+
+1. Publish signed, notarized macOS packages and Authenticode-signed Windows installers for every supported OS/architecture combination.
+2. Publish a versioned support matrix and conformance results for package lifecycle, user activation, managed policy, enterprise networking, and removal.
+3. Freeze and version the managed-policy, deployment-profile, status, event, and exit-code schemas with backward-compatibility tests.
+4. Build a repeatable real-device lab covering generic Apple MDM and Windows MDM contracts, with Intune as an adapter rather than the product boundary.
+5. Ship an organization intake template that produces policy and deployment profiles without code changes or embedded secrets.
+6. Run pilots with at least two organizations using different MDM vendors and network models; publish anonymized pass/fail evidence.
+
+## P1: broad administrator usability
+
+1. Certify vendor adapter packs in demand order, initially Intune and one Apple-focused platform such as Jamf Pro, Kandji, or Mosyle.
+2. Provide a local validator that checks organization policy, certificates, proxy settings, package compatibility, and detection configuration before rollout.
+3. Add fleet health export and SIEM mappings based on the canonical event schema, without making Guard Cloud mandatory.
+4. Publish migration, coexistence, rollback, incident-response, certificate-rotation, and support runbooks.
+5. Define a deprecation policy for schemas, OS versions, architectures, signing identities, and vendor adapters.
+
+## P2: ecosystem scale
+
+1. Publish a vendor-adapter conformance kit so partners and customers can validate additional MDM products without changing Guard core.
+2. Automate certification evidence collection and release attestations.
+3. Add optional zero-touch workspace enrollment using short-lived, organization-scoped bootstrap credentials.
+4. Establish compatibility SLAs and a public support matrix tied to Guard release channels.
+
+## Generalization rules
+
+- One artifact per platform and architecture, never per organization.
+- One canonical policy and lifecycle contract, never vendor-specific core behavior.
+- Vendor adapters translate packaging, assignment, detection, and remediation only.
+- Organization identifiers and secrets remain outside installers and repositories.
+- Local enforcement and health reporting continue when Guard Cloud or an MDM control plane is unavailable.
+- A compatibility claim requires repeatable evidence from the published matrix, not success in a single customer environment.

plugin_scanner-2.0.1083/docs/guard/mdm-networking.md

@@ -0,0 +1,7 @@
+# HOL Guard enterprise networking
+
+HOL Guard always validates TLS certificates. Managed policy may select the platform system proxy, an explicit HTTPS proxy, or direct networking. An administrator-approved PEM CA bundle is added to—not substituted for—the operating system trust store. Proxy URLs containing credentials are rejected; credentialed proxies must use the operating system's approved credential mechanism.
+
+Public registry intelligence is optional and can be disabled with `network.allowPublicRegistries=false`. Local enforcement remains active during DNS, proxy, TLS, Guard Cloud, or registry outages. The machine-readable allowlist is [mdm-endpoints.v1.json](mdm-endpoints.v1.json).
+
+Installers are self-contained and do not contact these endpoints. Administrators should test endpoint trust from the same user or daemon context that runs Guard; user shell environment variables are not managed-policy authority.

plugin_scanner-2.0.1083/docs/guard/mdm-release-evidence-template.md

@@ -0,0 +1,19 @@
+# MDM release evidence
+
+- Version / build ID / source commit:
+- macOS architectures, minimum OS, package receipt:
+- Windows architectures, minimum OS, MSI product/upgrade code:
+- SHA-256 / CycloneDX SBOM / provenance verified:
+- Manifest Ed25519 key ID and signature verified:
+- macOS executable/package signature, notarization, and staple verified:
+- Windows executable/MSI Authenticode publisher verified:
+- Clean install / silent activation / detection:
+- Upgrade / authorized rollback / failed-install recovery:
+- Repair / deactivation / uninstall / reinstall:
+- Standard-user policy, update, removal, tamper attempts:
+- Direct / system proxy / explicit proxy / private CA / offline tests:
+- Gatekeeper / WDAC / AppLocker tests:
+- Real MDM vendor, assignment context, deployment ring, result:
+- Security / release engineering / support / customer IT approvals:
+
+Unsigned CI artifacts are structural test fixtures and never satisfy production signature rows.

plugin_scanner-2.0.1083/docs/guard/schemas/mdm-policy-v1.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hol.org/schemas/guard/mdm-policy-v1.schema.json",
+  "title": "HOL Guard managed policy v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion"],
+  "properties": {
+    "schemaVersion": {"const": "hol-guard-mdm-policy.v1"},
+    "settings": {"type": "object"},
+    "lockedSettings": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
+    "requiredHarnesses": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
+    "network": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "proxyMode": {"enum": ["system", "explicit", "none"]},
+        "proxyUrl": {"type": ["string", "null"]},
+        "caBundlePath": {"type": ["string", "null"]},
+        "allowPublicRegistries": {"type": "boolean"}
+      }
+    },
+    "update": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "owner": {"enum": ["user", "mdm"]},
+        "channel": {"type": "string", "minLength": 1},
+        "minimumVersion": {"type": ["string", "null"]},
+        "maximumVersion": {"type": ["string", "null"]},
+        "allowDowngrade": {"type": "boolean"}
+      }
+    },
+    "daemonStartup": {"enum": ["on-demand", "login"]}
+  }
+}

plugin_scanner-2.0.1083/docs/guard/schemas/mdm-status-v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hol.org/schemas/guard/mdm-status-v1.schema.json",
+  "title": "HOL Guard MDM lifecycle result v1",
+  "type": "object",
+  "required": ["schemaVersion", "operation"],
+  "properties": {
+    "schemaVersion": {"const": "hol-guard-mdm-status.v1"},
+    "operation": {"enum": ["status", "activate", "repair", "deactivate", "authorize-deactivation", "network-diagnose"]},
+    "scope": {"enum": ["machine", "user"]},
+    "healthy": {"type": "boolean"},
+    "state": {"enum": ["absent", "installed", "activated", "protected", "degraded", "repairable", "policy-invalid", "tampered", "unsupported"]},
+    "reasonCodes": {"type": "array", "items": {"type": ["string", "null"]}}
+  },
+  "additionalProperties": true
+}

{plugin_scanner-2.0.1081 → plugin_scanner-2.0.1083}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1081"
+version = "2.0.1083"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"
@@ -67,6 +67,9 @@ dev = [
     "pytest-cov>=7.1.0",
     "ruff>=0.15.15",
 ]
+mdm-build = [
+    "pyinstaller>=6.16,<7",
+]
 publish = [
     "twine>=6.2.0",
 ]

{plugin_scanner-2.0.1081 → plugin_scanner-2.0.1083}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1081"
+version = "2.0.1083"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"
@@ -67,6 +67,9 @@ dev = [
     "pytest-cov>=7.1.0",
     "ruff>=0.15.15",
 ]
+mdm-build = [
+    "pyinstaller>=6.16,<7",
+]
 publish = [
     "twine>=6.2.0",
 ]

plugin_scanner-2.0.1083/scripts/mdm/generate-release-manifest.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Generate a deterministic release manifest before platform signing."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import json
+import platform
+import subprocess
+from pathlib import Path
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+SCHEMA = "hol-guard-release-manifest.v1"
+POLICY_SCHEMA = "hol-guard-mdm-policy.v1"
+
+
+def _commit() -> str:
+    try:
+        result = subprocess.run(["git", "rev-parse", "HEAD"], check=True, capture_output=True, text=True)
+    except (OSError, subprocess.SubprocessError):
+        return "unknown"
+    return result.stdout.strip() or "unknown"
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--runtime-root", type=Path, required=True)
+    parser.add_argument("--version", required=True)
+    parser.add_argument("--build-id", required=True)
+    parser.add_argument("--platform", required=True, choices=("macos", "windows"))
+    parser.add_argument("--architecture", default=platform.machine().lower())
+    parser.add_argument("--installer-identity", required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--signing-key", type=Path)
+    parser.add_argument("--key-id")
+    args = parser.parse_args()
+    root = args.runtime_root.resolve(strict=True)
+    output = args.output.resolve()
+    files = []
+    for path in sorted(item for item in root.rglob("*") if item.is_file()):
+        if path.resolve() == output:
+            continue
+        files.append(
+            {
+                "path": path.relative_to(root).as_posix(),
+                "sha256": hashlib.sha256(path.read_bytes()).hexdigest(),
+            }
+        )
+    payload = {
+        "schemaVersion": SCHEMA,
+        "version": args.version,
+        "buildId": args.build_id,
+        "sourceCommit": _commit(),
+        "platform": args.platform,
+        "architecture": args.architecture,
+        "policySchemaVersion": POLICY_SCHEMA,
+        "installerIdentity": args.installer_identity,
+        "files": files,
+    }
+    if (args.signing_key is None) != (args.key_id is None):
+        parser.error("--signing-key and --key-id must be supplied together")
+    if args.signing_key is not None:
+        private_key = serialization.load_pem_private_key(args.signing_key.read_bytes(), password=None)
+        if not isinstance(private_key, Ed25519PrivateKey):
+            parser.error("--signing-key must contain an Ed25519 private key")
+        canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+        payload["signature"] = {
+            "keyId": args.key_id,
+            "value": base64.b64encode(private_key.sign(canonical)).decode(),
+        }
+    output.parent.mkdir(parents=True, exist_ok=True)
+    output.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

plugin_scanner-2.0.1083/scripts/mdm/generate-sbom.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Generate a deterministic CycloneDX dependency inventory for frozen runtimes."""
+
+from __future__ import annotations
+
+import argparse
+import importlib.metadata
+import json
+from pathlib import Path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--version", required=True)
+    args = parser.parse_args()
+    components = []
+    for distribution in sorted(importlib.metadata.distributions(), key=lambda item: item.metadata["Name"].lower()):
+        name = distribution.metadata["Name"]
+        if not name:
+            continue
+        components.append(
+            {
+                "type": "library",
+                "name": name,
+                "version": distribution.version,
+                "purl": f"pkg:pypi/{name.lower().replace('_', '-')}@{distribution.version}",
+            }
+        )
+    payload = {
+        "bomFormat": "CycloneDX",
+        "specVersion": "1.6",
+        "version": 1,
+        "metadata": {"component": {"type": "application", "name": "HOL Guard", "version": args.version}},
+        "components": components,
+    }
+    args.output.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

plugin_scanner-2.0.1083/scripts/mdm/hol-guard-entry.py

@@ -0,0 +1,6 @@
+"""PyInstaller entrypoint for the machine-owned HOL Guard runtime."""
+
+from codex_plugin_scanner.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

plugin_scanner-2.0.1083/scripts/mdm/macos/activate-current-user.sh

@@ -0,0 +1,8 @@
+#!/bin/zsh
+set -euo pipefail
+
+readonly GUARD="/Library/Application Support/HOL Guard/hol-guard/hol-guard"
+readonly USER_NAME="$(id -un)"
+readonly USER_HOME="$(dscl . -read "/Users/${USER_NAME}" NFSHomeDirectory | sed -n 's/^NFSHomeDirectory: //p')"
+[[ -n "${USER_HOME}" && -d "${USER_HOME}" ]] || exit 0
+exec "${GUARD}" mdm repair --home "${USER_HOME}" --user "${USER_NAME}" --json

plugin_scanner-2.0.1083/scripts/mdm/macos/build-pkg.sh

@@ -0,0 +1,58 @@
+#!/bin/zsh
+set -euo pipefail
+
+readonly ROOT="${0:A:h:h:h:h}"
+readonly VERSION="${HOL_GUARD_VERSION:?Set HOL_GUARD_VERSION}"
+readonly BUILD_ID="${HOL_GUARD_BUILD_ID:?Set HOL_GUARD_BUILD_ID}"
+readonly ARCH="$(uname -m)"
+readonly OUT="${ROOT}/dist/mdm/macos"
+readonly STAGE="${OUT}/stage"
+readonly RUNTIME="${STAGE}/Library/Application Support/HOL Guard"
+readonly PACKAGE_ID="org.hol.guard"
+
+rm -rf "${OUT}"
+mkdir -p "${RUNTIME}" "${STAGE}/Library/LaunchAgents" "${OUT}"
+
+uv run --no-sync pyinstaller --clean --noconfirm --onedir --name hol-guard \
+  --collect-submodules codex_plugin_scanner --collect-data codex_plugin_scanner \
+  --distpath "${RUNTIME}" --workpath "${OUT}/pyinstaller" --specpath "${OUT}" \
+  "${ROOT}/scripts/mdm/hol-guard-entry.py"
+
+cp "${ROOT}/scripts/mdm/macos/org.hol.guard.user-activation.plist" \
+  "${STAGE}/Library/LaunchAgents/org.hol.guard.user-activation.plist"
+cp "${ROOT}/scripts/mdm/macos/activate-current-user.sh" "${RUNTIME}/activate-current-user"
+typeset -a manifest_args
+manifest_args=(--runtime-root "${RUNTIME}" --version "${VERSION}" --build-id "${BUILD_ID}" \
+  --platform macos --architecture "${ARCH}" --installer-identity "${PACKAGE_ID}" \
+  --output "${RUNTIME}/release-manifest.json")
+if [[ -n "${HOL_GUARD_MANIFEST_SIGNING_KEY:-}" ]]; then
+  [[ -n "${HOL_GUARD_MANIFEST_KEY_ID:-}" && -n "${HOL_GUARD_MANIFEST_PUBLIC_KEYS:-}" ]] || exit 2
+  cp "${HOL_GUARD_MANIFEST_PUBLIC_KEYS}" "${RUNTIME}/release-trusted-keys.json"
+  manifest_args+=(--signing-key "${HOL_GUARD_MANIFEST_SIGNING_KEY}" --key-id "${HOL_GUARD_MANIFEST_KEY_ID}")
+fi
+python3 "${ROOT}/scripts/mdm/generate-release-manifest.py" "${manifest_args[@]}"
+
+find "${STAGE}" -type d -exec chmod 0755 {} +
+find "${STAGE}" -type f -exec chmod 0644 {} +
+chmod 0755 "${RUNTIME}/hol-guard/hol-guard" "${RUNTIME}/activate-current-user"
+
+typeset -a pkg_args
+pkg_args=(--root "${STAGE}" --identifier "${PACKAGE_ID}" --version "${VERSION}" \
+  --scripts "${ROOT}/scripts/mdm/macos/pkg-scripts")
+if [[ -n "${HOL_GUARD_INSTALLER_SIGN_IDENTITY:-}" ]]; then
+  [[ -n "${HOL_GUARD_MANIFEST_SIGNING_KEY:-}" ]] || exit 2
+  pkg_args+=(--sign "${HOL_GUARD_INSTALLER_SIGN_IDENTITY}")
+fi
+pkgbuild "${pkg_args[@]}" "${OUT}/hol-guard-${VERSION}-${ARCH}.pkg"
+
+if [[ -n "${HOL_GUARD_NOTARY_PROFILE:-}" ]]; then
+  xcrun notarytool submit "${OUT}/hol-guard-${VERSION}-${ARCH}.pkg" \
+    --keychain-profile "${HOL_GUARD_NOTARY_PROFILE}" --wait
+  xcrun stapler staple "${OUT}/hol-guard-${VERSION}-${ARCH}.pkg"
+fi
+
+python3 "${ROOT}/scripts/mdm/generate-sbom.py" --version "${VERSION}" --output "${OUT}/sbom.cdx.json"
+python3 "${ROOT}/scripts/mdm/write-release-evidence.py" \
+  --artifact "${OUT}/hol-guard-${VERSION}-${ARCH}.pkg" \
+  --manifest "${RUNTIME}/release-manifest.json" --sbom "${OUT}/sbom.cdx.json" \
+  --output "${OUT}/release-evidence.json"

plugin_scanner-2.0.1083/scripts/mdm/macos/deactivate-user.sh

@@ -0,0 +1,20 @@
+#!/bin/zsh
+set -euo pipefail
+
+[[ "$(id -u)" -eq 0 ]] || exit 3
+[[ "$#" -eq 2 ]] || exit 2
+readonly USER_NAME="$1"
+readonly USER_HOME="$2"
+readonly USER_UID="$(id -u "${USER_NAME}")"
+readonly GUARD="/Library/Application Support/HOL Guard/hol-guard/hol-guard"
+readonly AUTH_ROOT="/Library/Application Support/HOL Guard State/removal-authorizations"
+readonly AUTH_FILE="${AUTH_ROOT}/${USER_UID}-$(uuidgen).json"
+readonly TOKEN_NAME="${AUTH_FILE:t}"
+
+trap 'chmod -a "${USER_NAME} allow search,delete_child" "${AUTH_ROOT}" 2>/dev/null || true; rm -f "${AUTH_FILE}"' EXIT
+"${GUARD}" mdm authorize-deactivation --home "${USER_HOME}" --user "${USER_NAME}" \
+  --token-name "${TOKEN_NAME}" --json >/dev/null
+chmod +a "${USER_NAME} allow search,delete_child" "${AUTH_ROOT}"
+launchctl asuser "${USER_UID}" sudo -u "${USER_NAME}" -- \
+  "${GUARD}" mdm deactivate --home "${USER_HOME}" --user "${USER_NAME}" \
+  --authorization-file "${AUTH_FILE}" --json

plugin_scanner-2.0.1083/scripts/mdm/macos/detect.sh

@@ -0,0 +1,6 @@
+#!/bin/zsh
+set -u
+
+readonly GUARD="/Library/Application Support/HOL Guard/hol-guard/hol-guard"
+[[ -x "${GUARD}" ]] || exit 1
+exec "${GUARD}" mdm status --scope machine --json