plugin-scanner 2.0.1107__tar.gz → 2.0.1109__tar.gz

{plugin_scanner-2.0.1107 → plugin_scanner-2.0.1109}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1107
+Version: 2.0.1109
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1107 → plugin_scanner-2.0.1109}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1107"
+version = "2.0.1109"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1107 → plugin_scanner-2.0.1109}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1107"
+version = "2.0.1109"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1107 → plugin_scanner-2.0.1109}/src/codex_plugin_scanner/guard/runtime/command_backup_extensions.py

@@ -7,6 +7,7 @@ from .command_extension_specs import CommandExtensionSpec
 from .command_rules import AnyMatcher, CommandSafetyRule, CommandSafeVariant
 
 _RCLONE_GLOBAL_OPTIONS = frozenset({"--config", "--log-file", "--log-level", "--password-command", "--rc-addr"})
+_RCLONE_GLOBAL_FLAGS = frozenset({"--dry-run", "--quiet", "--verbose", "-n", "-q", "-v"})
 _RESTIC_GLOBAL_OPTIONS = frozenset(
     {
         "--cacert",
@@ -30,8 +31,12 @@ _RESTIC_GLOBAL_OPTIONS = frozenset(
         "-r",
     }
 )
+_RESTIC_GLOBAL_FLAGS = frozenset({"--quiet", "--verbose", "-q", "-v"})
 _BORG_GLOBAL_OPTIONS = frozenset(
     {
+        "-P",
+        "-a",
+        "-e",
         "-r",
         "--repo",
         "--debug-profile",
@@ -46,6 +51,7 @@ _BORG_GLOBAL_OPTIONS = frozenset(
         "--upload-ratelimit",
     }
 )
+_BORG_GLOBAL_FLAGS = frozenset({"--debug", "--show-rc", "--show-version", "--verbose", "-n", "-v"})
 _VELERO_GLOBAL_OPTIONS = frozenset(
     {
         "--features",
@@ -88,6 +94,7 @@ _RCLONE_MUTATION = AnyMatcher(
             command,
             allow_leading_options=True,
             leading_options_with_values=_RCLONE_GLOBAL_OPTIONS,
+            global_flags=_RCLONE_GLOBAL_FLAGS,
             fail_secure_unknown_options=True,
         )
         for command in ("delete", "deletefile", "purge", "rmdirs", "sync", "move", "moveto", "bisync")
@@ -100,6 +107,7 @@ _RESTIC_MUTATION = AnyMatcher(
             "forget",
             allow_leading_options=True,
             leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+            global_flags=_RESTIC_GLOBAL_FLAGS,
             fail_secure_unknown_options=True,
         ),
         executable_matcher(
@@ -107,6 +115,7 @@ _RESTIC_MUTATION = AnyMatcher(
             "prune",
             allow_leading_options=True,
             leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+            global_flags=_RESTIC_GLOBAL_FLAGS,
             fail_secure_unknown_options=True,
         ),
         executable_matcher(
@@ -115,6 +124,7 @@ _RESTIC_MUTATION = AnyMatcher(
             required_flags=frozenset({"--forget"}),
             allow_leading_options=True,
             leading_options_with_values=_RESTIC_GLOBAL_OPTIONS,
+            global_flags=_RESTIC_GLOBAL_FLAGS,
             fail_secure_unknown_options=True,
         ),
     )
@@ -126,6 +136,7 @@ _BORG_MUTATION = AnyMatcher(
             command,
             allow_leading_options=True,
             leading_options_with_values=_BORG_GLOBAL_OPTIONS,
+            global_flags=_BORG_GLOBAL_FLAGS,
             fail_secure_unknown_options=True,
         )
         for command in ("delete", "prune", "recreate")
@@ -138,6 +149,7 @@ _BORG_DRY_RUN = AnyMatcher(
             command,
             allow_leading_options=True,
             leading_options_with_values=_BORG_GLOBAL_OPTIONS,
+            global_flags=_BORG_GLOBAL_FLAGS,
             fail_secure_unknown_options=True,
         )
         for command in ("prune", "recreate")

{plugin_scanner-2.0.1107 → plugin_scanner-2.0.1109}/src/codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -80,6 +80,8 @@ _GIT_FORCE_REFSPEC = SubcommandOperandPrefixMatcher(
     operand_prefixes=frozenset({"+"}),
     leading_options_with_values=_GIT_GLOBAL_OPTIONS_WITH_VALUES,
     options_with_values=_GIT_SUBCOMMAND_OPTIONS_WITH_VALUES["push"],
+    leading_operands_to_skip=1,
+    options_supplying_leading_operands=frozenset({"--repo"}),
 )
 
 
@@ -310,10 +312,19 @@ BUILT_IN_COMMAND_RULES = (
             CommandSafeVariant(
                 variant_id="dry-run",
                 title="Git push preview",
-                matcher=_git_matcher(
-                    "push",
-                    required_flags=frozenset({"--dry-run"}),
-                    inverse_flag_pairs=frozenset({("--dry-run", "--no-dry-run")}),
+                matcher=AnyMatcher(
+                    matchers=(
+                        _git_matcher(
+                            "push",
+                            required_flags=frozenset({"-n"}),
+                            inverse_flag_pairs=frozenset({("-n", "--no-dry-run")}),
+                        ),
+                        _git_matcher(
+                            "push",
+                            required_flags=frozenset({"--dry-run"}),
+                            inverse_flag_pairs=frozenset({("--dry-run", "--no-dry-run")}),
+                        ),
+                    )
                 ),
             ),
         ),

plugin_scanner-2.0.1109/src/codex_plugin_scanner/guard/runtime/command_curl_parsing.py

@@ -0,0 +1,244 @@
+"""Structured curl operation parsing for command safety matchers."""
+
+from __future__ import annotations
+
+CURL_SHORT_OPTIONS_WITH_VALUES = frozenset(
+    {
+        "A",
+        "b",
+        "c",
+        "C",
+        "d",
+        "D",
+        "e",
+        "E",
+        "F",
+        "H",
+        "K",
+        "m",
+        "o",
+        "P",
+        "Q",
+        "r",
+        "t",
+        "T",
+        "u",
+        "U",
+        "w",
+        "x",
+        "X",
+        "y",
+        "Y",
+        "z",
+    }
+)
+CURL_LONG_OPTIONS_WITH_VALUES = frozenset(
+    {
+        "--abstract-unix-socket",
+        "--alt-svc",
+        "--aws-sigv4",
+        "--cacert",
+        "--capath",
+        "--cert",
+        "--cert-type",
+        "--ciphers",
+        "--config",
+        "--connect-timeout",
+        "--connect-to",
+        "--cookie",
+        "--cookie-jar",
+        "--create-file-mode",
+        "--crlfile",
+        "--curves",
+        "--data",
+        "--data-ascii",
+        "--data-binary",
+        "--data-raw",
+        "--data-urlencode",
+        "--delegation",
+        "--dns-interface",
+        "--dns-ipv4-addr",
+        "--dns-ipv6-addr",
+        "--dns-servers",
+        "--doh-url",
+        "--dump-header",
+        "--ech",
+        "--egd-file",
+        "--engine",
+        "--etag-compare",
+        "--etag-save",
+        "--expect100-timeout",
+        "--form",
+        "--form-string",
+        "--ftp-account",
+        "--ftp-alternative-to-user",
+        "--ftp-method",
+        "--ftp-port",
+        "--ftp-ssl-ccc-mode",
+        "--happy-eyeballs-timeout-ms",
+        "--haproxy-clientip",
+        "--header",
+        "--hostpubmd5",
+        "--hostpubsha256",
+        "--hsts",
+        "--interface",
+        "--ip-tos",
+        "--ipfs-gateway",
+        "--json",
+        "--keepalive-time",
+        "--keepalive-cnt",
+        "--key",
+        "--key-type",
+        "--krb",
+        "--libcurl",
+        "--limit-rate",
+        "--local-port",
+        "--login-options",
+        "--mail-auth",
+        "--mail-from",
+        "--mail-rcpt",
+        "--max-filesize",
+        "--max-redirs",
+        "--max-time",
+        "--netrc-file",
+        "--noproxy",
+        "--oauth2-bearer",
+        "--output",
+        "--output-dir",
+        "--parallel-max",
+        "--parallel-max-host",
+        "--pass",
+        "--pinnedpubkey",
+        "--preproxy",
+        "--proto",
+        "--proto-default",
+        "--proto-redir",
+        "--proxy",
+        "--proxy-cacert",
+        "--proxy-capath",
+        "--proxy-cert",
+        "--proxy-cert-type",
+        "--proxy-ciphers",
+        "--proxy-crlfile",
+        "--proxy-header",
+        "--proxy-key",
+        "--proxy-key-type",
+        "--proxy-pass",
+        "--proxy-pinnedpubkey",
+        "--proxy-service-name",
+        "--proxy-tls13-ciphers",
+        "--proxy-tlsauthtype",
+        "--proxy-tlspassword",
+        "--proxy-tlsuser",
+        "--proxy-user",
+        "--proxy1.0",
+        "--pubkey",
+        "--quote",
+        "--random-file",
+        "--range",
+        "--rate",
+        "--referer",
+        "--request-target",
+        "--resolve",
+        "--retry",
+        "--retry-delay",
+        "--retry-max-time",
+        "--sasl-authzid",
+        "--service-name",
+        "--speed-limit",
+        "--speed-time",
+        "--socks4",
+        "--socks4a",
+        "--socks5",
+        "--socks5-hostname",
+        "--socks5-gssapi-service",
+        "--stderr",
+        "--telnet-option",
+        "--tftp-blksize",
+        "--tls-max",
+        "--tls-earlydata",
+        "--tls13-ciphers",
+        "--tlsauthtype",
+        "--tlspassword",
+        "--tlsuser",
+        "--time-cond",
+        "--trace",
+        "--trace-ascii",
+        "--trace-config",
+        "--unix-socket",
+        "--upload-file",
+        "--upload-flags",
+        "--user",
+        "--user-agent",
+        "--url-query",
+        "--variable",
+        "--vlan-priority",
+        "--write-out",
+    }
+)
+
+
+def curl_operations(arguments: tuple[str, ...]) -> tuple[tuple[str | None, tuple[str, ...]], ...]:
+    """Return request methods and URL targets grouped by curl operation."""
+
+    operations: list[tuple[str | None, tuple[str, ...]]] = []
+    method: str | None = None
+    targets: list[str] = []
+    index = 0
+    parse_options = True
+    while index < len(arguments):
+        argument = arguments[index]
+        lowered = argument.lower()
+        if parse_options and argument == "--":
+            parse_options = False
+            index += 1
+            continue
+        if not parse_options:
+            targets.append(argument.strip("'\""))
+            index += 1
+            continue
+        if lowered == "--next":
+            operations.append((method, tuple(targets)))
+            method = None
+            targets = []
+            index += 1
+            continue
+        if lowered == "--request" and index + 1 < len(arguments):
+            method = arguments[index + 1].lower()
+            index += 2
+            continue
+        if lowered.startswith("--request="):
+            method = argument.split("=", 1)[1].lower()
+            index += 1
+            continue
+        if lowered == "--url" and index + 1 < len(arguments):
+            targets.append(arguments[index + 1].strip("'\""))
+            index += 2
+            continue
+        if lowered.startswith("--url="):
+            targets.append(argument.split("=", 1)[1].strip("'\""))
+            index += 1
+            continue
+        long_option = lowered.split("=", 1)[0]
+        if long_option in CURL_LONG_OPTIONS_WITH_VALUES:
+            index += 1 if "=" in argument else 2
+            continue
+        if argument.startswith("-") and not argument.startswith("--") and len(argument) > 1:
+            consumed_next = False
+            for offset, short_option in enumerate(argument[1:], start=1):
+                if short_option not in CURL_SHORT_OPTIONS_WITH_VALUES:
+                    continue
+                attached_value = argument[offset + 1 :]
+                if not attached_value and index + 1 < len(arguments):
+                    attached_value = arguments[index + 1]
+                    consumed_next = True
+                if short_option == "X":
+                    method = attached_value.lower()
+                break
+            index += 2 if consumed_next else 1
+            continue
+        if not argument.startswith("-"):
+            targets.append(argument.strip("'\""))
+        index += 1
+    operations.append((method, tuple(targets)))
+    return tuple(operations)

{plugin_scanner-2.0.1107 → plugin_scanner-2.0.1109}/src/codex_plugin_scanner/guard/runtime/command_model.py

@@ -6,6 +6,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Literal
 
+from .command_segment_parsing import shell_tokens_without_redirects
 from .command_structure import (
     CommandRedirect,
     EmbeddedCommand,
@@ -17,6 +18,7 @@ from .data_flow import (
     ShellHeredoc,
     extract_command_segments,
     extract_command_substitution_spans,
+    extract_expanded_heredoc_substitution_spans,
     extract_heredocs,
     extract_pipes,
     mask_heredoc_bodies,
@@ -37,22 +39,6 @@ MAX_COMMAND_TOKENS = 2_048
 _SHELL_SCRIPT_EXECUTABLES = frozenset({"ash", "bash", "dash", "sh", "zsh"})
 
 
-def _shell_tokens_without_redirects(
-    command: str,
-    *,
-    source_offset: int,
-    redirects: tuple[CommandRedirect, ...],
-) -> tuple[str, ...]:
-    masked = list(command)
-    for redirect in redirects:
-        local_start = redirect.start - source_offset
-        local_end = redirect.end - source_offset
-        if local_start < 0 or local_end > len(masked):
-            continue
-        masked[local_start:local_end] = " " * (local_end - local_start)
-    return shell_tokens("".join(masked))[0]
-
-
 @dataclass(frozen=True, slots=True)
 class CommandSegment:
     """One executable segment from a normalized command string."""
@@ -251,7 +237,7 @@ def parse_shell_command(
             start = min(cursor, len(normalized_text))
         end = min(start + len(segment_text), len(normalized_text))
         cursor = end
-        command_tokens = _shell_tokens_without_redirects(
+        command_tokens = shell_tokens_without_redirects(
             segment_text,
             source_offset=start,
             redirects=command_redirects,
@@ -282,6 +268,8 @@ def parse_shell_command(
         normalized_text,
         heredocs=heredocs,
         top_level_segments=tuple(segments),
+        cwd=cwd,
+        home_dir=home_dir,
     )
     segments.extend(embedded_segments)
     if len(segments) > MAX_COMMAND_SEGMENTS or sum(len(segment.tokens) for segment in segments) > MAX_COMMAND_TOKENS:
@@ -336,6 +324,8 @@ def _embedded_execution(
     *,
     heredocs: tuple[ShellHeredoc, ...],
     top_level_segments: tuple[CommandSegment, ...],
+    cwd: Path | None,
+    home_dir: Path | None,
 ) -> tuple[tuple[EmbeddedCommand, ...], tuple[CommandSegment, ...]]:
     embedded: list[EmbeddedCommand] = []
     segments: list[CommandSegment] = []
@@ -347,6 +337,8 @@ def _embedded_execution(
         embedded=embedded,
         segments=segments,
         depth=0,
+        cwd=cwd,
+        home_dir=home_dir,
     )
 
     for index, heredoc in enumerate(heredocs):
@@ -365,6 +357,9 @@ def _embedded_execution(
                     embedded=embedded,
                     segments=segments,
                     depth=0,
+                    expanded_heredoc=True,
+                    cwd=cwd,
+                    home_dir=home_dir,
                 )
             continue
         context = f"heredoc:{index}"
@@ -382,6 +377,8 @@ def _embedded_execution(
                 heredoc.body,
                 execution_context=context,
                 source_offset=heredoc.body_start,
+                cwd=cwd,
+                home_dir=home_dir,
             )
         )
         _append_substitution_execution(
@@ -392,6 +389,8 @@ def _embedded_execution(
             embedded=embedded,
             segments=segments,
             depth=0,
+            cwd=cwd,
+            home_dir=home_dir,
         )
     return tuple(embedded), tuple(segments)
 
@@ -405,10 +404,14 @@ def _append_substitution_execution(
     embedded: list[EmbeddedCommand],
     segments: list[CommandSegment],
     depth: int,
+    cwd: Path | None,
+    home_dir: Path | None,
+    expanded_heredoc: bool = False,
 ) -> None:
     if depth >= 4:
         return
-    for index, substitution in enumerate(extract_command_substitution_spans(command)):
+    extractor = extract_expanded_heredoc_substitution_spans if expanded_heredoc else extract_command_substitution_spans
+    for index, substitution in enumerate(extractor(command)):
         absolute_start = source_offset + substitution.body_start
         if any(start <= absolute_start < end for start, end in excluded_ranges):
             continue
@@ -427,6 +430,8 @@ def _append_substitution_execution(
                 substitution.body,
                 execution_context=context,
                 source_offset=absolute_start,
+                cwd=cwd,
+                home_dir=home_dir,
             )
         )
         _append_substitution_execution(
@@ -437,6 +442,8 @@ def _append_substitution_execution(
             embedded=embedded,
             segments=segments,
             depth=depth + 1,
+            cwd=cwd,
+            home_dir=home_dir,
         )
 
 
@@ -445,16 +452,22 @@ def _segments_for_embedded(
     *,
     execution_context: str,
     source_offset: int,
+    cwd: Path | None,
+    home_dir: Path | None,
 ) -> tuple[CommandSegment, ...]:
     results: list[CommandSegment] = []
-    heredocs = extract_heredocs(command)
-    redirects = extract_command_redirects(mask_heredoc_bodies(command, heredocs), heredocs)
+    normalization = normalize_transparent_shell_command(command, cwd=cwd, home_dir=home_dir)
+    heredocs = extract_heredocs(normalization.normalized_command)
+    redirects = extract_command_redirects(
+        mask_heredoc_bodies(normalization.normalized_command, heredocs),
+        heredocs,
+    )
     for context, pipeline_index, segment_text, local_offset in _execution_segment_texts(
-        command,
+        normalization.normalized_command,
         context_prefix=execution_context,
     ):
         tokens, _exact = shell_tokens(segment_text)
-        command_tokens = _shell_tokens_without_redirects(
+        command_tokens = shell_tokens_without_redirects(
             segment_text,
             source_offset=local_offset,
             redirects=redirects,
@@ -462,7 +475,8 @@ def _segments_for_embedded(
         environment_names, executable_index, wrappers = leading_environment(command_tokens)
         executable = command_tokens[executable_index] if executable_index < len(command_tokens) else None
         arguments = command_tokens[executable_index + 1 :] if executable is not None else ()
-        start = source_offset + local_offset
+        original_offset = command.find(segment_text)
+        start = source_offset + (original_offset if original_offset >= 0 else local_offset)
         results.append(
             CommandSegment(
                 text=segment_text,
@@ -470,7 +484,7 @@ def _segments_for_embedded(
                 executable=executable,
                 arguments=arguments,
                 environment_names=environment_names,
-                wrapper_chain=wrappers,
+                wrapper_chain=(*normalization.wrapper_chain, *wrappers),
                 path_overridden="PATH" in environment_names,
                 execution_context=context,
                 pipeline_index=pipeline_index,