plugin-scanner 2.0.1085__tar.gz → 2.0.1087__tar.gz

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1085
+Version: 2.0.1087
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/docs/guard/architecture.md

@@ -43,3 +43,11 @@ For Microsoft Copilot, Guard supports two real local boundaries only:
 That does not extend to VS Code Copilot extension-host interception.
 
 Cisco AIBOM stays out of Guard runtime policy in this phase. If it returns later, it should attach to evidence or export paths rather than launch blocking or approval flow.
+
+## Command protection references
+
+- [Command extension architecture](command-extension-architecture.md)
+- [Command extension precedence](command-extension-precedence.md)
+- [Command extension threat model](command-extension-threat-model.md)
+- [Package command extension coverage](command-package-extension-coverage.md)
+- [Infrastructure command extension coverage](command-domain-extension-coverage.md)

plugin_scanner-2.0.1087/docs/guard/command-domain-extension-coverage.md

@@ -0,0 +1,38 @@
+# Infrastructure command extension coverage
+
+Guard's domain command extensions use the shared canonical parser, structured matchers, extension registry, and
+composite evaluation path. They add rule-level evidence to the same runtime artifacts, approvals, memory, receipts,
+and sync behavior used by existing command protection.
+
+## Initial coverage matrix
+
+| Extension | Reviewed operations | Safe forms |
+| --- | --- | --- |
+| `command.container-runtime` | Broad system prune, forced container removal, privileged container launch | Command help |
+| `command.kubernetes-secrets` | Secret reads through supported cluster clients | Existing metadata-only and non-secret reads |
+| `command.kubernetes-operations` | Resource deletion, node drain, Helm release removal | Help and documented dry-run forms |
+| `command.infrastructure-as-code` | Terraform/OpenTofu destroy, destroy-mode apply, Pulumi destroy | Plan and preview commands |
+
+Global command options such as Docker contexts, cluster contexts and namespaces, Terraform/OpenTofu working
+directories, and Pulumi stacks are normalized before matching. A safe variant suppresses only its owning rule and
+cannot hide an unrelated match in another command segment.
+
+## Primary command references
+
+- Container cleanup and privilege boundaries: [Docker system prune](https://docs.docker.com/reference/cli/docker/system/prune/),
+  [container removal](https://docs.docker.com/reference/cli/docker/container/rm/), and
+  [privileged container execution](https://docs.docker.com/reference/cli/docker/container/run/).
+- Cluster mutations: [kubectl delete](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_delete/),
+  [kubectl drain](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_drain/), and
+  [Helm uninstall](https://helm.sh/docs/helm/helm_uninstall/).
+- Infrastructure teardown: [Terraform destroy](https://developer.hashicorp.com/terraform/cli/commands/destroy),
+  [OpenTofu destroy](https://opentofu.org/docs/cli/commands/destroy/), and
+  [Pulumi destroy](https://www.pulumi.com/docs/iac/cli/commands/pulumi_destroy/).
+
+## Security and usability boundaries
+
+- Rules match canonical executable and argument structures, not raw command substrings.
+- Quoted examples and source-search commands remain data and do not trigger execution rules.
+- Destructive operations produce one composite decision even when compatibility and structured rules both match.
+- Help, plan, preview, and supported dry-run forms remain side-effect-free inspection paths.
+- Primary references and positive and safe fixtures are required when expanding the catalog.

plugin_scanner-2.0.1087/docs/guard/command-package-extension-coverage.md

@@ -0,0 +1,57 @@
+# Package command extension coverage
+
+Guard exposes package ecosystems as command safety extensions while keeping the existing package firewall as the
+single enforcement engine. The extension registry supplies stable IDs, setup detection, and inspectable metadata. It
+does not duplicate package intent parsing, shim behavior, advisory policy, provenance checks, approvals, or receipts.
+
+## Setup detection
+
+Run a read-only workspace preview:
+
+```bash
+hol-guard command setup --detect --workspace .
+```
+
+Project marker names drive recommendations. Package managers found on `PATH` appear as available context but do not
+cause unrelated ecosystems to be recommended. Detection does not read manifest contents, package credentials, source
+configuration, or secret files, and it does not change Guard settings.
+
+## Coverage matrix
+
+| Extension | Managers | Project markers | Enforcement owner |
+| --- | --- | --- | --- |
+| `command.package.node` | npm, npx, pnpm, yarn, bun, bunx | `package.json` and Node lockfiles | Package firewall |
+| `command.package.python` | pip, pipx, uv, uvx, Poetry, Pipenv | `pyproject.toml`, requirements, and Python lockfiles | Package firewall |
+| `command.package.rust` | Cargo | `Cargo.toml`, `Cargo.lock` | Package firewall |
+| `command.package.go` | Go modules and tools | `go.mod`, `go.sum`, `go.work` | Package firewall |
+| `command.package.jvm` | Maven, Gradle | Maven and Gradle build or lock files | Package firewall |
+| `command.package.ruby` | RubyGems, Bundler | Gem manifests and lockfiles | Package firewall |
+| `command.package.php` | Composer | `composer.json`, `composer.lock` | Package firewall |
+| `command.package.system` | apt, yum, dnf, apk, pacman, zypper, Homebrew | `Brewfile` | Package firewall |
+
+## Command references
+
+The metadata and fixtures follow primary command documentation:
+
+- Node: [npm install](https://docs.npmjs.com/cli/install/), [pnpm add](https://pnpm.io/cli/add),
+  [Yarn add](https://yarnpkg.com/cli/add), and [Bun add](https://bun.sh/docs/pm/cli/add).
+- Python: [pip install](https://pip.pypa.io/en/stable/cli/pip_install/),
+  [uv CLI](https://docs.astral.sh/uv/reference/cli/), [Poetry CLI](https://python-poetry.org/docs/cli/), and
+  [Pipenv commands](https://pipenv.pypa.io/en/latest/commands.html).
+- Rust: [cargo install](https://doc.rust-lang.org/cargo/commands/cargo-install.html).
+- Go: [Go modules reference](https://go.dev/ref/mod#go-install).
+- JVM: [Maven dependency management](https://maven.apache.org/plugins/maven-dependency-plugin/examples/managing-dependencies.html)
+  and [Gradle dependency locking](https://docs.gradle.org/current/userguide/dependency_locking.html).
+- Ruby: [RubyGems command reference](https://guides.rubygems.org/command-reference/#gem-install) and
+  [bundle install](https://bundler.io/man/bundle-install.1.html).
+- PHP: [Composer commands](https://getcomposer.org/doc/03-cli.md#require-r).
+- System packages: [Homebrew manual](https://docs.brew.sh/Manpage#install-options-formulacask-) and
+  [apt-get manual](https://manpages.debian.org/bookworm/apt/apt-get.8.en.html).
+
+## Security invariants
+
+- A command-local `PATH` override invalidates Guard package-shim trust, including explicit local-only runner flags.
+- Project markers and lockfiles can support package intent decisions, but repository-controlled files never prove that a
+  shim or executable is trusted by themselves.
+- Package extension metadata cannot own command rules while protection is delegated to the package firewall.
+- External extension sources cannot replace required built-in command protections or become final policy authority.

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1085"
+version = "2.0.1087"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1085"
+version = "2.0.1087"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/src/codex_plugin_scanner/guard/cli/commands_dispatch_local.py

@@ -31,12 +31,21 @@ def _run_guard_command_inspection_command(
 
     command_command = str(getattr(args, "command_command", ""))
     try:
+        if command_command == "setup":
+            from ..runtime.command_ecosystem_detection import command_setup_detection_payload
+
+            workspace = Path(str(getattr(args, "workspace", "."))).resolve()
+            if not workspace.is_dir():
+                raise ValueError("Command setup workspace must be an existing directory")
+            payload = command_setup_detection_payload(workspace)
+            _emit("command-setup", payload, bool(getattr(args, "json", False)))
+            return 0
         if command_command == "extensions":
             payload = command_extensions_payload(getattr(args, "extension_id", None))
             _emit("command-extensions", payload, bool(getattr(args, "json", False)))
             return 0
         if command_command not in {"test", "explain"}:
-            print("Choose command test, command explain, or command extensions.", file=sys.stderr)
+            print("Choose command test, command explain, command extensions, or command setup.", file=sys.stderr)
             return 2
         payload = inspect_command(str(getattr(args, "command_text", "")), cwd=Path.cwd(), home_dir=Path.home())
     except ValueError as error:

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/src/codex_plugin_scanner/guard/cli/commands_parser_local.py

@@ -189,6 +189,13 @@ def _configure_guard_local_parsers(
     )
     extensions_parser.add_argument("extension_id", nargs="?")
     extensions_parser.add_argument("--json", action="store_true")
+    setup_parser = command_subparsers.add_parser(
+        "setup",
+        help="Detect command ecosystems and preview recommended protection",
+    )
+    setup_parser.add_argument("--detect", action="store_true", required=True)
+    setup_parser.add_argument("--workspace", default=".")
+    setup_parser.add_argument("--json", action="store_true")
 
     preflight_parser = guard_subparsers.add_parser(
         "preflight",

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/src/codex_plugin_scanner/guard/cli/render.py

@@ -540,6 +540,39 @@ def _render_command_extensions(console: Console, payload: dict[str, object]) ->
     console.print(table)
 
 
+def _render_command_setup(console: Console, payload: dict[str, object]) -> None:
+    detections = _coerce_dict_list(payload.get("detections"))
+    table = Table(title="Command ecosystem setup", box=box.SIMPLE_HEAD, show_lines=False)
+    table.add_column("Ecosystem", style="bold cyan", no_wrap=True)
+    table.add_column("Status", no_wrap=True)
+    table.add_column("Detected from")
+    table.add_column("Protection")
+    for detection in detections:
+        marker_names = _coerce_string_list(detection.get("project_markers"))
+        executables = _coerce_string_list(detection.get("available_executables"))
+        evidence = [*(f"file:{name}" for name in marker_names), *(f"command:{name}" for name in executables)]
+        detected = bool(detection.get("detected"))
+        recommended = bool(detection.get("recommended"))
+        if recommended:
+            status = "recommended"
+            style = "green"
+        elif detected:
+            status = "available"
+            style = "cyan"
+        else:
+            status = "not detected"
+            style = "dim"
+        table.add_row(
+            str(detection.get("extension_id") or ""),
+            status,
+            ", ".join(evidence) or "none",
+            str(detection.get("delegated_protection") or "command rules"),
+            style=style,
+        )
+    console.print(table)
+    console.print("[dim]Detection is read-only. No Guard settings were changed.[/dim]")
+
+
 def _plain_text_command_inspection(payload: PayloadDict) -> str:
     classification = _coerce_object_dict(payload.get("classification"))
     extensions = _coerce_dict_list(payload.get("extensions"))
@@ -565,6 +598,17 @@ def _plain_text_command_extensions(payload: PayloadDict) -> str:
     return "\n".join(lines)
 
 
+def _plain_text_command_setup(payload: PayloadDict) -> str:
+    detections = _coerce_dict_list(payload.get("detections"))
+    lines = [f"Recommended command ecosystems ({payload.get('recommended_count') or 0})"]
+    for item in detections:
+        if not item.get("recommended"):
+            continue
+        lines.append(f"{item.get('extension_id')} - recommended")
+    lines.append("Detection is read-only. No Guard settings were changed.")
+    return "\n".join(lines)
+
+
 def _init_plan_panel(plan: list[dict[str, object]], status: str) -> Panel:
     table = Table.grid(padding=(0, 1))
     for step in plan:
@@ -2772,6 +2816,7 @@ def _clean_terminal_output(value: str) -> str:
 _PLAIN_TEXT_RENDERERS: dict[str, PlainTextRenderer] = {
     "command-extensions": _plain_text_command_extensions,
     "command-inspection": _plain_text_command_inspection,
+    "command-setup": _plain_text_command_setup,
     "protect": _plain_text_protect,
 }
 
@@ -2779,6 +2824,7 @@ _PLAIN_TEXT_RENDERERS: dict[str, PlainTextRenderer] = {
 _RENDERERS: dict[str, Renderer] = {
     "command-extensions": _render_command_extensions,
     "command-inspection": _render_command_inspection,
+    "command-setup": _render_command_setup,
     "approvals": _render_approvals,
     "init": _render_init,
     "start": _render_start,

{plugin_scanner-2.0.1085 → plugin_scanner-2.0.1087}/src/codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from .command_domain_extensions import DOMAIN_COMMAND_RULES
 from .command_rules import (
     AnyMatcher,
     ArgumentMatcher,
@@ -33,6 +34,8 @@ COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "git destructive command": ("destructive_shell",),
     "system destructive command": ("destructive_shell",),
     "windows destructive command": ("destructive_shell",),
+    "kubernetes destructive command": ("destructive_shell", "network_egress"),
+    "infrastructure destructive command": ("destructive_shell", "network_egress"),
 }
 _GIT_GLOBAL_OPTIONS_WITH_VALUES = frozenset(
     {"-c", "-C", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree"}
@@ -322,6 +325,7 @@ BUILT_IN_COMMAND_RULES = (
             ),
         ),
     ),
+    *DOMAIN_COMMAND_RULES,
 )
 
 _RULES_BY_EXTENSION: dict[str, tuple[CommandSafetyRule, ...]] = {}