plugin-scanner 2.0.141__tar.gz → 2.0.143__tar.gz

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.141
+Version: 2.0.143
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/dashboard/src/guard-types.ts

@@ -171,6 +171,7 @@ export type GuardRuntimeSnapshot = {
   headline_state: GuardHeadlineState;
   headline_label: string;
   headline_detail: string;
+  thread_count?: number;
   sync_configured: boolean;
   cloud_state: "local_only" | "paired_waiting" | "paired_active";
   cloud_state_label: string;

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/dashboard/src/settings-workspace.tsx

@@ -13,9 +13,9 @@ import {
   SectionLabel,
   Tag
 } from "./approval-center-primitives";
-import { clearEvidence, exportDiagnostics, fetchSettings, updateSettings, clearPolicy, repairApprovalCenter } from "./guard-api";
+import { clearEvidence, exportDiagnostics, fetchRuntimeSnapshot, fetchSettings, updateSettings, clearPolicy, repairApprovalCenter } from "./guard-api";
 import { resolveProtectionLevelCopy } from "./runtime-overview";
-import type { GuardSettings, GuardSettingsPayload } from "./guard-types";
+import type { GuardRuntimeSnapshot, GuardSettings, GuardSettingsPayload } from "./guard-types";
 
 type SettingsState =
   | { kind: "loading" }
@@ -165,6 +165,7 @@ export function SettingsWorkspace() {
   const [exporting, setExporting] = useState(false);
   const [repairing, setRepairing] = useState(false);
   const [actionMessage, setActionMessage] = useState<string | null>(null);
+  const [perfSnapshot, setPerfSnapshot] = useState<GuardRuntimeSnapshot | null>(null);
   const saveSuccessTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   useEffect(() => {
@@ -190,6 +191,20 @@ export function SettingsWorkspace() {
     };
   }, []);
 
+  useEffect(() => {
+    let cancelled = false;
+    fetchRuntimeSnapshot()
+      .then((snapshot) => {
+        if (!cancelled) setPerfSnapshot(snapshot);
+      })
+      .catch((error: unknown) => {
+        console.error("Failed to fetch runtime snapshot:", error);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
   useEffect(() => {
     return () => {
       if (saveSuccessTimerRef.current !== null) {
@@ -610,6 +625,14 @@ export function SettingsWorkspace() {
               <SettingToggle label="Billing features" checked={draft.billing} onChange={handleBooleanChange("billing")} />
             </div>
           </div>
+          {perfSnapshot !== null ? (
+            <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
+              <SectionLabel>Runtime diagnostics</SectionLabel>
+              <div className="mt-4">
+                <DiagnosticsPerfCard snapshot={perfSnapshot} />
+              </div>
+            </div>
+          ) : null}
           <div className="rounded-[1.75rem] border border-red-100 bg-red-50/50 p-5 shadow-sm">
             <SectionLabel>Data management</SectionLabel>
             <div className="mt-4 space-y-3">
@@ -682,6 +705,41 @@ export function SettingsWorkspace() {
   );
 }
 
+function DiagnosticsPerfCard(props: { snapshot: GuardRuntimeSnapshot }) {
+  const { snapshot } = props;
+  const threadCount = snapshot.thread_count;
+  const daemonPort = snapshot.runtime_state?.daemon_port ?? null;
+  const startedAt = snapshot.runtime_state?.started_at ?? null;
+  return (
+    <div>
+      <h3 className="text-sm font-semibold text-brand-dark">Runtime performance</h3>
+      <p className="mt-1 text-xs leading-relaxed text-muted-foreground">
+        Live process metrics for this Guard daemon session.
+      </p>
+      <dl className="mt-3 grid grid-cols-2 gap-2">
+        {threadCount !== undefined ? (
+          <PerfMetric label="Total interpreter threads" value={String(threadCount)} />
+        ) : null}
+        {daemonPort !== null ? (
+          <PerfMetric label="Daemon port" value={String(daemonPort)} />
+        ) : null}
+        {startedAt !== null ? (
+          <PerfMetric label="Started" value={new Date(startedAt).toLocaleTimeString()} />
+        ) : null}
+      </dl>
+    </div>
+  );
+}
+
+function PerfMetric(props: { label: string; value: string }) {
+  return (
+    <div className="rounded-xl bg-surface-1 px-3 py-2">
+      <dt className="text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground">{props.label}</dt>
+      <dd className="mt-0.5 font-mono text-sm font-semibold text-brand-dark">{props.value}</dd>
+    </div>
+  );
+}
+
 function SettingSelect(props: {
   label: string;
   value: string;

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/docs/guard/release-notes.md

@@ -35,3 +35,22 @@ profile. Custom overrides survive a preset switch unless explicitly cleared.
 
 The approval center and evidence log now paginate at 50 items per page. Large workspaces
 with thousands of receipts will no longer cause the dashboard to stall on load.
+
+---
+
+## Release checklist (T608)
+
+Before tagging a release, complete the following items for every harness integration
+path that was touched in this release cycle.
+
+1. Run `pytest -m "not slow" -q` — all non-`slow` tests must pass.
+2. Run `ruff check src/ tests/` — zero violations.
+3. Run `cd dashboard && pnpm test && pnpm build` — dashboard bundle updated.
+4. Build wheel: `uv build` — wheel must build without errors.
+5. Install in temp venv: `pip install dist/*.whl && hol-guard doctor` — doctor shows no fatal errors.
+6. Fill in `tests/fixtures/guard-red-team/smoke-evidence-template.json` for each harness
+   integration touched. Mark each test entry `pass`, `fail`, or `skip` with notes.
+7. Confirm no `.env` file was read during the release build.
+8. Confirm no real secrets appear in committed fixtures or tests.
+9. Confirm no full local paths appear in any committed file.
+10. Merge only after all PR review threads are resolved.

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.141"
+version = "2.0.143"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.141"
+version = "2.0.143"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/src/codex_plugin_scanner/guard/approvals.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import threading
 import time
 import uuid
 from collections.abc import Mapping
@@ -215,6 +216,7 @@ def build_runtime_snapshot(
         "headline_state": headline_state,
         "headline_label": _runtime_headline_label(headline_state),
         "headline_detail": _runtime_headline_detail(headline_state),
+        "thread_count": threading.active_count(),
         "items": pending_requests,
         "latest_receipts": latest_receipts,
         "managed_installs": store.list_managed_installs(),

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -15562,6 +15562,7 @@ function SettingsWorkspace() {
   const [exporting, setExporting] = reactExports.useState(false);
   const [repairing, setRepairing] = reactExports.useState(false);
   const [actionMessage, setActionMessage] = reactExports.useState(null);
+  const [perfSnapshot, setPerfSnapshot] = reactExports.useState(null);
   const saveSuccessTimerRef = reactExports.useRef(null);
   reactExports.useEffect(() => {
     let cancelled = false;
@@ -15583,6 +15584,17 @@ function SettingsWorkspace() {
       cancelled = true;
     };
   }, []);
+  reactExports.useEffect(() => {
+    let cancelled = false;
+    fetchRuntimeSnapshot().then((snapshot) => {
+      if (!cancelled) setPerfSnapshot(snapshot);
+    }).catch((error) => {
+      console.error("Failed to fetch runtime snapshot:", error);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
   reactExports.useEffect(() => {
     return () => {
       if (saveSuccessTimerRef.current !== null) {
@@ -15942,6 +15954,10 @@ function SettingsWorkspace() {
             /* @__PURE__ */ jsxRuntimeExports.jsx(SettingToggle, { label: "Billing features", checked: draft.billing, onChange: handleBooleanChange("billing") })
           ] })
         ] }),
+        perfSnapshot !== null ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx(SectionLabel, { children: "Runtime diagnostics" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "mt-4", children: /* @__PURE__ */ jsxRuntimeExports.jsx(DiagnosticsPerfCard, { snapshot: perfSnapshot }) })
+        ] }) : null,
         /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "rounded-[1.75rem] border border-red-100 bg-red-50/50 p-5 shadow-sm", children: [
           /* @__PURE__ */ jsxRuntimeExports.jsx(SectionLabel, { children: "Data management" }),
           /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-4 space-y-3", children: [
@@ -15976,6 +15992,27 @@ function SettingsWorkspace() {
     ] })
   ] });
 }
+function DiagnosticsPerfCard(props) {
+  const { snapshot } = props;
+  const threadCount = snapshot.thread_count;
+  const daemonPort = snapshot.runtime_state?.daemon_port ?? null;
+  const startedAt = snapshot.runtime_state?.started_at ?? null;
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsx("h3", { className: "text-sm font-semibold text-brand-dark", children: "Runtime performance" }),
+    /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "mt-1 text-xs leading-relaxed text-muted-foreground", children: "Live process metrics for this Guard daemon session." }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("dl", { className: "mt-3 grid grid-cols-2 gap-2", children: [
+      threadCount !== void 0 ? /* @__PURE__ */ jsxRuntimeExports.jsx(PerfMetric, { label: "Total interpreter threads", value: String(threadCount) }) : null,
+      daemonPort !== null ? /* @__PURE__ */ jsxRuntimeExports.jsx(PerfMetric, { label: "Daemon port", value: String(daemonPort) }) : null,
+      startedAt !== null ? /* @__PURE__ */ jsxRuntimeExports.jsx(PerfMetric, { label: "Started", value: new Date(startedAt).toLocaleTimeString() }) : null
+    ] })
+  ] });
+}
+function PerfMetric(props) {
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "rounded-xl bg-surface-1 px-3 py-2", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsx("dt", { className: "text-[10px] font-semibold uppercase tracking-[0.14em] text-muted-foreground", children: props.label }),
+    /* @__PURE__ */ jsxRuntimeExports.jsx("dd", { className: "mt-0.5 font-mono text-sm font-semibold text-brand-dark", children: props.value })
+  ] });
+}
 function SettingSelect(props) {
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "block", children: [
     /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono text-[11px] font-semibold uppercase tracking-[0.18em] text-muted-foreground", children: props.label }),

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/src/codex_plugin_scanner/guard/daemon/static/assets/index.css

@@ -2164,6 +2164,11 @@
     letter-spacing: .2em;
   }
 
+  .tracking-\[0\.14em\] {
+    --tw-tracking: .14em;
+    letter-spacing: .14em;
+  }
+
   .tracking-\[0\.18em\] {
     --tw-tracking: .18em;
     letter-spacing: .18em;

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/src/codex_plugin_scanner/guard/store.py

@@ -4,9 +4,11 @@ from __future__ import annotations
 
 import base64
 import json
+import logging
 import os
 import sqlite3
 import subprocess
+import time
 from collections.abc import Iterator
 from contextlib import contextmanager
 from datetime import datetime, timedelta, timezone
@@ -353,6 +355,10 @@ def _build_secret_store(guard_home: Path) -> SecretStore:
     return fallback_store
 
 
+_SLOW_QUERY_THRESHOLD_MS: int = 200
+_store_logger = logging.getLogger(__name__)
+
+
 class GuardStore:
     """Local SQLite store for Guard state."""
 
@@ -403,11 +409,18 @@ class GuardStore:
     def _connect(self) -> Iterator[sqlite3.Connection]:
         connection = sqlite3.connect(self.path)
         connection.row_factory = sqlite3.Row
+        start = time.monotonic()
         try:
             yield connection
             connection.commit()
         finally:
             connection.close()
+            elapsed_ms = (time.monotonic() - start) * 1000
+            if elapsed_ms >= _SLOW_QUERY_THRESHOLD_MS:
+                _store_logger.warning(
+                    "Guard store slow transaction (%.0fms); consider indexing hot query paths.",
+                    elapsed_ms,
+                )
 
     def _initialize(self) -> None:
         statements = (

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.141"
+__version__ = "2.0.143"

{plugin_scanner-2.0.141 → plugin_scanner-2.0.143}/tests/test_guard_daemon_perf.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import threading
+import time
 from pathlib import Path
 
 import pytest
@@ -176,3 +178,117 @@ class TestDoctorPerfPayload:
         for item in perf:
             expected_slow = int(item["elapsed_ms"]) >= _SLOW_DETECTOR_THRESHOLD_MS
             assert item["slow"] == expected_slow
+
+
+class TestProcessCountBound:
+    """T620 — 100 safe hook evaluations must not spawn persistent threads."""
+
+    @pytest.mark.slow
+    def test_100_harness_start_evaluations_do_not_spawn_threads(self, tmp_path: Path) -> None:
+        action = _make_harness_start_action()
+        context = _make_detector_context(tmp_path)
+        registry = _get_default_detector_registry()
+        baseline_threads = threading.active_count()
+        for _ in range(100):
+            registry.run(action, context, timeout_ms=500)
+        after_threads = threading.active_count()
+        assert after_threads - baseline_threads <= 5, (
+            f"Thread count grew by {after_threads - baseline_threads} after 100 evaluations; "
+            "detectors must not leak persistent threads."
+        )
+
+    def test_100_harness_start_evaluations_complete_without_error(self, tmp_path: Path) -> None:
+        action = _make_harness_start_action()
+        context = _make_detector_context(tmp_path)
+        registry = _get_default_detector_registry()
+        results = [registry.run(action, context, timeout_ms=500) for _ in range(100)]
+        assert all(isinstance(r, DetectorRunResult) for r in results)
+
+
+@pytest.mark.slow
+class TestCPUBenchmark:
+    """T622 — 100 safe hook evaluations must complete in under 10 seconds."""
+
+    def test_100_safe_hook_calls_complete_within_budget(self, tmp_path: Path) -> None:
+        action = _make_harness_start_action()
+        context = _make_detector_context(tmp_path)
+        registry = _get_default_detector_registry()
+        start = time.monotonic()
+        for _ in range(100):
+            registry.run(action, context, timeout_ms=500)
+        elapsed_s = time.monotonic() - start
+        assert elapsed_s < 10.0, f"100 safe hook evaluations took {elapsed_s:.2f}s; budget is 10s."
+
+
+class TestMemoryBenchmark:
+    """T621 — Guard module import stays under 50 MB RSS budget."""
+
+    def test_guard_config_import_does_not_import_heavy_deps(self) -> None:
+        import subprocess
+        import sys
+
+        result = subprocess.run(
+            [
+                sys.executable,
+                "-c",
+                (
+                    "import codex_plugin_scanner.guard.config as _c;"
+                    " import sys;"
+                    " heavy = {'matplotlib', 'numpy', 'pandas', 'scipy', 'torch', 'tensorflow'};"
+                    " leaked = heavy & set(sys.modules);"
+                    " print(repr(leaked))"
+                ),
+            ],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        assert result.returncode == 0, f"Subprocess failed: {result.stderr}"
+        import ast
+        leaked = ast.literal_eval(result.stdout.strip())
+        assert not leaked, f"Guard import leaked heavy dependencies: {leaked}"
+
+
+class TestSlowSQLiteTelemetry:
+    """T624 — Slow store transactions emit a warning via the logging module."""
+
+    def test_slow_query_threshold_is_200ms(self) -> None:
+        from codex_plugin_scanner.guard.store import _SLOW_QUERY_THRESHOLD_MS
+
+        assert _SLOW_QUERY_THRESHOLD_MS == 200
+
+    def test_fast_transaction_does_not_warn(
+        self, tmp_path: Path, caplog: pytest.LogCaptureFixture, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        import logging
+
+        import codex_plugin_scanner.guard.store as store_module
+        from codex_plugin_scanner.guard.store import GuardStore
+
+        monkeypatch.setattr(store_module, "_SLOW_QUERY_THRESHOLD_MS", 10_000)
+        store = GuardStore(guard_home=tmp_path / "guard-home")
+        with caplog.at_level(logging.WARNING, logger="codex_plugin_scanner.guard.store"):
+            _ = store.list_approval_requests()
+        slow_warnings = [r for r in caplog.records if "slow transaction" in r.getMessage().lower()]
+        assert len(slow_warnings) == 0, "Fast transaction must not emit slow transaction warning"
+
+    def test_slow_transaction_emits_warning(
+        self, tmp_path: Path, caplog: pytest.LogCaptureFixture, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        import logging
+
+        import codex_plugin_scanner.guard.store as store_module
+        from codex_plugin_scanner.guard.store import GuardStore
+
+        monkeypatch.setattr(store_module, "_SLOW_QUERY_THRESHOLD_MS", 0)
+        store = GuardStore(guard_home=tmp_path / "guard-home")
+        with caplog.at_level(logging.WARNING, logger="codex_plugin_scanner.guard.store"):
+            _ = store.list_approval_requests()
+        slow_warnings = [r for r in caplog.records if "slow transaction" in r.getMessage().lower()]
+        assert len(slow_warnings) > 0, "Slow transaction (threshold=0ms) must emit a slow transaction warning"
+
+    def test_store_has_slow_query_threshold_constant(self) -> None:
+        from codex_plugin_scanner.guard.store import _SLOW_QUERY_THRESHOLD_MS
+
+        assert isinstance(_SLOW_QUERY_THRESHOLD_MS, int)
+        assert _SLOW_QUERY_THRESHOLD_MS > 0