plugin-scanner 2.0.1092__tar.gz → 2.0.1094__tar.gz

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1092
+Version: 2.0.1094
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/docs/guard/architecture.md

@@ -52,3 +52,5 @@ Cisco AIBOM stays out of Guard runtime policy in this phase. If it returns later
 - [Package command extension coverage](command-package-extension-coverage.md)
 - [Infrastructure command extension coverage](command-domain-extension-coverage.md)
 - [Cloud command extension coverage](command-cloud-extension-coverage.md)
+- [Storage command extension coverage](command-storage-extension-coverage.md)
+- [Backup command extension coverage](command-backup-extension-coverage.md)

plugin_scanner-2.0.1094/docs/guard/command-backup-extension-coverage.md

@@ -0,0 +1,21 @@
+# Backup Command Extension Coverage
+
+Guard reviews backup operations that can remove snapshots, archives, source data, or destination data. Preview flags suppress review only where the command family documents them as side-effect-free.
+
+| Extension | Reviewed operations | Safe counterparts |
+| --- | --- | --- |
+| `command.backup.rclone` | Delete, purge, move, sync, and bidirectional sync | Help, `--dry-run`, and `-n` |
+| `command.backup.restic` | Forget, prune, and rewrite with original removal | Help and `--dry-run` |
+| `command.backup.borg` | Delete, prune, and recreate | Help; prune/recreate dry run |
+| `command.backup.velero` | Backup, schedule, and restore deletion | Help and describe operations |
+
+Interactive confirmation is not a dry run and remains reviewable.
+
+## References
+
+- [Rclone commands](https://rclone.org/commands/)
+- [Rclone delete](https://rclone.org/commands/rclone_delete/)
+- [Restic removing snapshots](https://restic.readthedocs.io/en/stable/060_forget.html)
+- [Restic repository rewrite](https://restic.readthedocs.io/en/stable/045_working_with_repos.html)
+- [Borg prune](https://borgbackup.readthedocs.io/en/stable/usage/prune.html)
+- [Velero backup reference](https://velero.io/docs/main/backup-reference/)

plugin_scanner-2.0.1094/docs/guard/command-storage-extension-coverage.md

@@ -0,0 +1,25 @@
+# Storage Command Extension Coverage
+
+Guard evaluates object-storage operations from the canonical parsed command model. Global provider options, native Windows launchers, compound commands, and documented preview flags use the same structured matcher path as other command extensions.
+
+## Extensions
+
+| Extension | Reviewed operations | Safe counterparts |
+| --- | --- | --- |
+| `command.storage.aws-s3` | S3 object and bucket removal, delete-enabled sync, S3 API object and bucket deletion | Help; documented high-level S3 dry run |
+| `command.storage.google-cloud` | Google Cloud object and bucket removal, delete-enabled `gcloud` and `gsutil` sync | Help; `gcloud --dry-run`; `gsutil -n` |
+| `command.storage.azure-blob` | Blob, batch, and container deletion | Help; blob batch `--dryrun` |
+| `command.storage.minio` | Object and bucket removal, remove-enabled mirror | Help and listing operations |
+
+Interactive confirmation is not treated as side-effect-free. A preview suppresses review only for the exact command family that officially documents that preview flag.
+
+## References
+
+- [AWS S3 rm](https://docs.aws.amazon.com/cli/latest/reference/s3/rm.html)
+- [AWS S3 sync](https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html)
+- [AWS S3 delete-objects](https://docs.aws.amazon.com/cli/latest/reference/s3api/delete-objects.html)
+- [Google Cloud storage rm](https://cloud.google.com/sdk/gcloud/reference/storage/rm)
+- [Google Cloud storage rsync](https://cloud.google.com/sdk/gcloud/reference/storage/rsync)
+- [Azure storage blob](https://learn.microsoft.com/cli/azure/storage/blob)
+- [MinIO Client rm](https://docs.min.io/community/minio-object-store/reference/minio-mc/mc-rm.html)
+- [MinIO Client mirror](https://docs.min.io/community/minio-object-store/reference/minio-mc/mc-mirror.html)

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1092"
+version = "2.0.1094"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1092"
+version = "2.0.1094"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.1094/src/codex_plugin_scanner/guard/runtime/command_backup_extensions.py

@@ -0,0 +1,242 @@
+"""Structured rules and metadata for backup command extensions."""
+
+from __future__ import annotations
+
+from .command_extension_matchers import executable_matcher, safe_flag_variant
+from .command_extension_specs import CommandExtensionSpec
+from .command_rules import AnyMatcher, CommandSafetyRule, CommandSafeVariant
+
+_RCLONE_GLOBAL_OPTIONS = frozenset({"--config", "--log-file", "--password-command", "--rc-addr"})
+_RESTIC_GLOBAL_OPTIONS = frozenset({"-r", "--repo", "--password-file", "--cache-dir", "-o", "--option"})
+_BORG_GLOBAL_OPTIONS = frozenset(
+    {
+        "-r",
+        "--repo",
+        "--debug-profile",
+        "--debug-topic",
+        "--lock-wait",
+        "--remote-path",
+        "--rsh",
+        "--socket",
+        "--umask",
+        "--upload-buffer",
+        "--upload-ratelimit",
+    }
+)
+_VELERO_GLOBAL_OPTIONS = frozenset(
+    {
+        "--features",
+        "--kubeconfig",
+        "--kubecontext",
+        "--log_backtrace_at",
+        "--log_dir",
+        "--log_file",
+        "--log_file_max_size",
+        "--log-backtrace-at",
+        "--log-dir",
+        "--log-file",
+        "--log-file-max-size",
+        "--namespace",
+        "--stderrthreshold",
+        "--v",
+        "--vmodule",
+        "-n",
+        "-v",
+    }
+)
+_VELERO_GLOBAL_FLAGS = frozenset(
+    {
+        "--add-dir-header",
+        "--add_dir_header",
+        "--alsologtostderr",
+        "--colorized",
+        "--logtostderr",
+        "--one_output",
+        "--skip_headers",
+        "--skip_log_headers",
+        "--skip-headers",
+        "--skip-log-headers",
+    }
+)
+_RCLONE_MUTATION = AnyMatcher(
+    matchers=tuple(
+        executable_matcher(
+            "rclone",
+            command,
+            allow_leading_options=True,
+            leading_options_with_values=_RCLONE_GLOBAL_OPTIONS,
+        )
+        for command in ("delete", "deletefile", "purge", "rmdirs", "sync", "move", "moveto", "bisync")
+    )
+)
+_RESTIC_MUTATION = AnyMatcher(
+    matchers=(
+        executable_matcher(
+            "restic",
+            "forget",
+            allow_leading_options=True,
+            leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+        ),
+        executable_matcher(
+            "restic",
+            "prune",
+            allow_leading_options=True,
+            leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+        ),
+        executable_matcher(
+            "restic",
+            "rewrite",
+            required_flags=frozenset({"--forget"}),
+            allow_leading_options=True,
+            leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+        ),
+    )
+)
+_BORG_MUTATION = AnyMatcher(
+    matchers=tuple(
+        executable_matcher(
+            "borg",
+            command,
+            allow_leading_options=True,
+            leading_options_with_values=_BORG_GLOBAL_OPTIONS,
+        )
+        for command in ("delete", "prune", "recreate")
+    )
+)
+_BORG_DRY_RUN = AnyMatcher(
+    matchers=tuple(
+        executable_matcher(
+            "borg",
+            command,
+            allow_leading_options=True,
+            leading_options_with_values=_BORG_GLOBAL_OPTIONS,
+        )
+        for command in ("prune", "recreate")
+    )
+)
+_VELERO_DELETE = AnyMatcher(
+    matchers=tuple(
+        executable_matcher(
+            "velero",
+            resource,
+            "delete",
+            global_options_with_values=_VELERO_GLOBAL_OPTIONS,
+            global_flags=_VELERO_GLOBAL_FLAGS,
+        )
+        for resource in ("backup", "schedule", "restore")
+    )
+)
+
+
+def _backup_rule(
+    *,
+    rule_id: str,
+    title: str,
+    description: str,
+    matcher: AnyMatcher,
+    action_class: str,
+    safe_variants: tuple[CommandSafeVariant, ...],
+) -> CommandSafetyRule:
+    return CommandSafetyRule(
+        rule_id=rule_id,
+        title=title,
+        description=description,
+        severity="critical",
+        risk_classes=("destructive_shell", "network_egress"),
+        action_classes=(action_class,),
+        safer_alternatives=("List retained backups and run the documented preview before changing backup data.",),
+        matcher=matcher,
+        safe_variants=safe_variants,
+    )
+
+
+BACKUP_COMMAND_RULES = (
+    _backup_rule(
+        rule_id="command.backup.rclone.mutation",
+        title="Rclone destructive synchronization",
+        description="Identifies deletion, purge, move, and synchronization operations that can remove data.",
+        matcher=_RCLONE_MUTATION,
+        action_class="Rclone destructive command",
+        safe_variants=(
+            safe_flag_variant(_RCLONE_MUTATION, variant_id="help", title="Rclone command help", flag="--help"),
+            safe_flag_variant(_RCLONE_MUTATION, variant_id="dry-run", title="Rclone dry run", flag="--dry-run"),
+            safe_flag_variant(_RCLONE_MUTATION, variant_id="no-act", title="Rclone no-act", flag="-n"),
+        ),
+    ),
+    _backup_rule(
+        rule_id="command.backup.restic.mutation",
+        title="Restic backup removal",
+        description="Identifies snapshot forgetting, repository pruning, and rewrite operations that remove originals.",
+        matcher=_RESTIC_MUTATION,
+        action_class="Restic destructive command",
+        safe_variants=(
+            safe_flag_variant(_RESTIC_MUTATION, variant_id="help", title="Restic command help", flag="--help"),
+            safe_flag_variant(_RESTIC_MUTATION, variant_id="dry-run", title="Restic dry run", flag="--dry-run"),
+        ),
+    ),
+    _backup_rule(
+        rule_id="command.backup.borg.mutation",
+        title="Borg backup mutation",
+        description="Identifies archive deletion, retention pruning, and archive recreation operations.",
+        matcher=_BORG_MUTATION,
+        action_class="Borg destructive command",
+        safe_variants=(
+            safe_flag_variant(_BORG_MUTATION, variant_id="help", title="Borg command help", flag="--help"),
+            safe_flag_variant(_BORG_DRY_RUN, variant_id="dry-run", title="Borg dry run", flag="--dry-run"),
+            safe_flag_variant(_BORG_DRY_RUN, variant_id="no-act", title="Borg no-act", flag="-n"),
+        ),
+    ),
+    _backup_rule(
+        rule_id="command.backup.velero.deletion",
+        title="Velero backup deletion",
+        description="Identifies deletion of backups, schedules, and restore records through Velero CLI.",
+        matcher=_VELERO_DELETE,
+        action_class="Velero destructive command",
+        safe_variants=(
+            safe_flag_variant(_VELERO_DELETE, variant_id="help", title="Velero command help", flag="--help"),
+        ),
+    ),
+)
+
+
+BACKUP_COMMAND_EXTENSION_SPECS = (
+    CommandExtensionSpec(
+        extension_id="command.backup.rclone",
+        name="Rclone command protection",
+        description="Reviews rclone operations that delete, move, purge, or synchronize data.",
+        action_classes=("Rclone destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Run the same command with --dry-run and inspect every affected path first.",),
+        reference_urls=("https://rclone.org/commands/", "https://rclone.org/commands/rclone_delete/"),
+    ),
+    CommandExtensionSpec(
+        extension_id="command.backup.restic",
+        name="Restic command protection",
+        description="Reviews restic operations that remove snapshots or repository data.",
+        action_classes=("Restic destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Run forget, prune, or rewrite with --dry-run and inspect retained snapshots.",),
+        reference_urls=(
+            "https://restic.readthedocs.io/en/stable/060_forget.html",
+            "https://restic.readthedocs.io/en/stable/045_working_with_repos.html",
+        ),
+    ),
+    CommandExtensionSpec(
+        extension_id="command.backup.borg",
+        name="Borg command protection",
+        description="Reviews Borg operations that delete, prune, or recreate archives.",
+        action_classes=("Borg destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Use --dry-run where documented and inspect the selected archive set.",),
+        reference_urls=("https://borgbackup.readthedocs.io/en/stable/usage/prune.html",),
+    ),
+    CommandExtensionSpec(
+        extension_id="command.backup.velero",
+        name="Velero command protection",
+        description="Reviews Velero operations that delete backup data or recovery records.",
+        action_classes=("Velero destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Describe the backup and confirm object-storage and snapshot retention first.",),
+        reference_urls=("https://velero.io/docs/main/backup-reference/",),
+    ),
+)

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/src/codex_plugin_scanner/guard/runtime/command_builtin_extension_catalog.py

@@ -2,13 +2,17 @@
 
 from __future__ import annotations
 
+from .command_backup_extensions import BACKUP_COMMAND_EXTENSION_SPECS, BACKUP_COMMAND_RULES
 from .command_cloud_extensions import CLOUD_COMMAND_EXTENSION_SPECS, CLOUD_COMMAND_RULES
 from .command_domain_extensions import DOMAIN_COMMAND_EXTENSION_SPECS, DOMAIN_COMMAND_RULES
 from .command_extension_specs import CommandExtensionValues, command_extension_values
+from .command_storage_extensions import STORAGE_COMMAND_EXTENSION_SPECS, STORAGE_COMMAND_RULES
 
 _DIRECT_EXTENSION_CATALOGS = (
     (DOMAIN_COMMAND_EXTENSION_SPECS, DOMAIN_COMMAND_RULES),
     (CLOUD_COMMAND_EXTENSION_SPECS, CLOUD_COMMAND_RULES),
+    (STORAGE_COMMAND_EXTENSION_SPECS, STORAGE_COMMAND_RULES),
+    (BACKUP_COMMAND_EXTENSION_SPECS, BACKUP_COMMAND_RULES),
 )
 
 DIRECT_COMMAND_EXTENSION_VALUES: tuple[CommandExtensionValues, ...] = tuple(

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/src/codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from .command_backup_extensions import BACKUP_COMMAND_RULES
 from .command_cloud_extensions import CLOUD_COMMAND_RULES
 from .command_domain_extensions import DOMAIN_COMMAND_RULES
 from .command_rules import (
@@ -14,6 +15,7 @@ from .command_rules import (
     ExecutableMatcher,
     PipelineMatcher,
 )
+from .command_storage_extensions import STORAGE_COMMAND_RULES
 
 COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "credential exfiltration shell command": (
@@ -40,6 +42,14 @@ COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "aws destructive command": ("destructive_shell", "network_egress"),
     "google cloud destructive command": ("destructive_shell", "network_egress"),
     "azure destructive command": ("destructive_shell", "network_egress"),
+    "aws storage destructive command": ("destructive_shell", "network_egress"),
+    "google storage destructive command": ("destructive_shell", "network_egress"),
+    "azure storage destructive command": ("destructive_shell", "network_egress"),
+    "minio storage destructive command": ("destructive_shell", "network_egress"),
+    "rclone destructive command": ("destructive_shell", "network_egress"),
+    "restic destructive command": ("destructive_shell", "network_egress"),
+    "borg destructive command": ("destructive_shell", "network_egress"),
+    "velero destructive command": ("destructive_shell", "network_egress"),
 }
 _GIT_GLOBAL_OPTIONS_WITH_VALUES = frozenset(
     {"-c", "-C", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree"}
@@ -331,6 +341,8 @@ BUILT_IN_COMMAND_RULES = (
     ),
     *DOMAIN_COMMAND_RULES,
     *CLOUD_COMMAND_RULES,
+    *STORAGE_COMMAND_RULES,
+    *BACKUP_COMMAND_RULES,
 )
 
 _RULES_BY_EXTENSION: dict[str, tuple[CommandSafetyRule, ...]] = {}

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/src/codex_plugin_scanner/guard/runtime/command_extension_matchers.py

@@ -7,21 +7,33 @@ from .command_rules import AnyMatcher, CommandSafeVariant, ExecutableMatcher
 _EMPTY_STRING_SET: frozenset[str] = frozenset()
 
 
+def executable_names(name: str) -> frozenset[str]:
+    """Return portable launcher names for one command."""
+
+    return frozenset({name, f"{name}.cmd", f"{name}.exe"})
+
+
 def executable_matcher(
     executable: str,
     *subcommands: str,
     required_flags: frozenset[str] = _EMPTY_STRING_SET,
     global_options_with_values: frozenset[str] = _EMPTY_STRING_SET,
     global_flags: frozenset[str] = _EMPTY_STRING_SET,
+    allow_leading_options: bool = False,
+    leading_options_with_values: frozenset[str] = _EMPTY_STRING_SET,
+    options_with_values: frozenset[str] = _EMPTY_STRING_SET,
 ) -> ExecutableMatcher:
-    """Build a portable executable matcher with structured global options."""
+    """Build a portable executable matcher with structured option handling."""
 
     return ExecutableMatcher(
-        executables=frozenset({executable, f"{executable}.cmd", f"{executable}.exe"}),
+        executables=executable_names(executable),
         subcommands=subcommands,
         required_flags=required_flags,
         interspersed_options_with_values=global_options_with_values,
         interspersed_flags=global_flags,
+        allow_leading_options=allow_leading_options,
+        leading_options_with_values=leading_options_with_values,
+        options_with_values=options_with_values,
     )
 
 

{plugin_scanner-2.0.1092 → plugin_scanner-2.0.1094}/src/codex_plugin_scanner/guard/runtime/command_rules.py

@@ -423,12 +423,18 @@ def _without_options(
             retained.extend(arguments[index + 1 :])
             break
         option_name = argument.split("=", 1)[0]
+        attached_short_option = (
+            argument[:2]
+            if len(argument) > 2 and argument[0] == "-" and argument[1] != "-" and argument[:2] in options_with_values
+            else None
+        )
         if option_name in flags:
             index += 1
             continue
-        if option_name not in options_with_values:
+        if option_name not in options_with_values and attached_short_option is None:
             retained.append(argument)
             index += 1
             continue
-        index += 1 if "=" in argument else 2
+        is_attached_short = attached_short_option is not None and option_name not in options_with_values
+        index += 1 if "=" in argument or is_attached_short else 2
     return tuple(retained)