plugin-scanner 2.0.160__tar.gz → 2.0.162__tar.gz

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.160
+Version: 2.0.162
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.160"
+version = "2.0.162"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.160"
+version = "2.0.162"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/src/codex_plugin_scanner/guard/cli/commands.py

@@ -388,6 +388,13 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
     _add_guard_common_args(receipts_parser)
     receipts_parser.add_argument("--json", action="store_true")
 
+    history_parser = guard_subparsers.add_parser("history", help="Inspect Guard decision history")
+    _add_guard_common_args(history_parser)
+    history_sub = history_parser.add_subparsers(dest="history_command", metavar="COMMAND")
+    history_explain_parser = history_sub.add_parser("explain", help="Show insight and evidence for a receipt ID")
+    history_explain_parser.add_argument("receipt_id", help="Receipt ID to explain")
+    history_explain_parser.add_argument("--json", action="store_true")
+
     inventory_parser = guard_subparsers.add_parser("inventory", help="List the local Guard artifact inventory")
     _add_guard_common_args(inventory_parser)
     inventory_parser.add_argument("--json", action="store_true")
@@ -1178,6 +1185,36 @@ def run_guard_command(
         _emit("receipts", {"generated_at": _now(), "items": store.list_receipts()}, getattr(args, "json", False))
         return 0
 
+    if args.guard_command == "history":
+        history_cmd = getattr(args, "history_command", None)
+        if history_cmd == "explain":
+            receipt_id: str = args.receipt_id
+            match = store.get_receipt(receipt_id)
+            if match is None:
+                msg = f"No receipt found for ID {receipt_id!r}"
+                _emit("history.explain", {"error": msg}, getattr(args, "json", False))
+                return 1
+            evidence = store.list_evidence(request_id=receipt_id, limit=10_000)
+            payload: dict[str, object] = {
+                "receipt_id": receipt_id,
+                "receipt": match,
+                "evidence": [
+                    {
+                        "evidence_id": e.get("evidence_id", ""),
+                        "category": e.get("category", ""),
+                        "severity": e.get("severity", ""),
+                        "summary": e.get("summary", ""),
+                        "action_identity": e.get("action_identity"),
+                        "created_at": e.get("created_at", ""),
+                    }
+                    for e in evidence
+                ],
+            }
+            _emit("history.explain", payload, getattr(args, "json", False))
+            return 0
+        _emit("history", {"error": "Use: hol-guard history explain <receipt_id>"}, getattr(args, "json", False))
+        return 1
+
     if args.guard_command == "inventory":
         _emit("inventory", {"generated_at": _now(), "items": store.list_inventory()}, getattr(args, "json", False))
         return 0

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/src/codex_plugin_scanner/guard/store.py

@@ -99,6 +99,9 @@ from .store_evidence import (
     evidence_index_statements,
     evidence_schema_statement,
 )
+from .store_evidence import (
+    list_evidence as _list_evidence_impl,
+)
 from .store_threat_intel import (
     threat_intel_bundle_schema_statement,
     threat_intel_index_statements,
@@ -716,6 +719,9 @@ class GuardStore:
         with self._connect() as connection:
             for statement in statements:
                 connection.execute(statement)
+            if not self._schema_version_applied(connection, version=4):
+                self._ensure_column(connection, "guard_evidence", "action_identity", "text")
+                self._record_schema_version(connection, version=4)
             for idx_stmt in evidence_index_statements():
                 connection.execute(idx_stmt)
             for idx_stmt in threat_intel_index_statements():
@@ -756,7 +762,8 @@ class GuardStore:
             self._ensure_attachment_column(connection, "lease_id", "text not null default ''")
             self._ensure_attachment_column(connection, "lease_expires_at", "text")
             self._ensure_local_device(connection)
-            self._record_schema_version(connection, version=2)
+            if not self._schema_version_applied(connection, version=2):
+                self._record_schema_version(connection, version=2)
 
     @staticmethod
     def _ensure_policy_column(connection: sqlite3.Connection, column_name: str, column_type: str) -> None:
@@ -782,6 +789,16 @@ class GuardStore:
             return
         connection.execute(f"alter table approval_requests add column {column_name} {column_type}")
 
+    @staticmethod
+    def _ensure_column(
+        connection: sqlite3.Connection, table_name: str, column_name: str, column_type: str
+    ) -> None:
+        rows = connection.execute(f"pragma table_info({table_name})").fetchall()
+        existing = {str(row["name"]) for row in rows}
+        if column_name in existing:
+            return
+        connection.execute(f"alter table {table_name} add column {column_name} {column_type}")
+
     @staticmethod
     def _ensure_attachment_column(connection: sqlite3.Connection, column_name: str, column_type: str) -> None:
         rows = connection.execute("pragma table_info(guard_client_attachments)").fetchall()
@@ -790,6 +807,14 @@ class GuardStore:
             return
         connection.execute(f"alter table guard_client_attachments add column {column_name} {column_type}")
 
+    @staticmethod
+    def _ensure_evidence_column(connection: sqlite3.Connection, column_name: str, column_type: str) -> None:
+        rows = connection.execute("pragma table_info(guard_evidence)").fetchall()
+        existing = {str(row["name"]) for row in rows}
+        if column_name in existing:
+            return
+        connection.execute(f"alter table guard_evidence add column {column_name} {column_type}")
+
     @staticmethod
     def _record_schema_version(connection: sqlite3.Connection, *, version: int) -> None:
         connection.execute(
@@ -3080,6 +3105,46 @@ class GuardStore:
             ).fetchone()
         return row is not None
 
+    def list_evidence(
+        self,
+        *,
+        harness: str | None = None,
+        category: str | None = None,
+        severity: str | None = None,
+        request_id: str | None = None,
+        action_identity: str | None = None,
+        before_cursor: str | None = None,
+        limit: int = 100,
+    ) -> list[dict[str, object]]:
+        with self._connect() as connection:
+            records = _list_evidence_impl(
+                connection,
+                harness=harness,
+                category=category,
+                severity=severity,
+                request_id=request_id,
+                action_identity=action_identity,
+                before_cursor=before_cursor,
+                limit=limit,
+            )
+        return [
+            {
+                "evidence_id": r.evidence_id,
+                "action_id": r.action_id,
+                "request_id": r.request_id,
+                "harness": r.harness,
+                "workspace": r.workspace,
+                "signal_id": r.signal_id,
+                "category": r.category,
+                "severity": r.severity,
+                "confidence": r.confidence,
+                "summary": r.summary,
+                "action_identity": r.action_identity,
+                "created_at": r.created_at,
+            }
+            for r in records
+        ]
+
     @staticmethod
     def _advisory_cache_key(advisory: dict[str, object]) -> str:
         advisory_id = advisory.get("id")

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/src/codex_plugin_scanner/guard/store_evidence.py

@@ -25,24 +25,26 @@ class EvidenceRecord:
     confidence: float
     summary: str
     details: dict[str, object] = field(default_factory=dict)
+    action_identity: str | None = None
     created_at: str = field(default_factory=_now_iso)
 
 
 def evidence_schema_statement() -> str:
     return """
     create table if not exists guard_evidence (
-      evidence_id text not null primary key,
-      action_id   text not null default '',
-      request_id  text not null default '',
-      harness     text not null default '',
-      workspace   text not null default '',
-      signal_id   text not null default '',
-      category    text not null default '',
-      severity    text not null default '',
-      confidence  real not null default 0.0,
-      summary     text not null default '',
-      details_json text not null default '{}',
-      created_at  text not null
+      evidence_id     text not null primary key,
+      action_id       text not null default '',
+      request_id      text not null default '',
+      harness         text not null default '',
+      workspace       text not null default '',
+      signal_id       text not null default '',
+      category        text not null default '',
+      severity        text not null default '',
+      confidence      real not null default 0.0,
+      summary         text not null default '',
+      details_json    text not null default '{}',
+      action_identity text,
+      created_at      text not null
     )
     """
 
@@ -54,6 +56,7 @@ def evidence_index_statements() -> list[str]:
         "create index if not exists idx_evidence_action on guard_evidence(action_id)",
         "create index if not exists idx_evidence_category_severity on guard_evidence(category, severity)",
         "create index if not exists idx_evidence_harness_workspace on guard_evidence(harness, workspace)",
+        "create index if not exists idx_evidence_identity on guard_evidence(action_identity)",
     ]
 
 
@@ -62,6 +65,7 @@ def _row_to_record(row: sqlite3.Row) -> EvidenceRecord:
         details: dict[str, object] = json.loads(row["details_json"])
     except (json.JSONDecodeError, TypeError):
         details = {}
+    columns = set(row.keys())
     return EvidenceRecord(
         evidence_id=row["evidence_id"],
         action_id=row["action_id"],
@@ -74,6 +78,7 @@ def _row_to_record(row: sqlite3.Row) -> EvidenceRecord:
         confidence=row["confidence"],
         summary=row["summary"],
         details=details,
+        action_identity=row["action_identity"] if "action_identity" in columns else None,
         created_at=row["created_at"],
     )
 
@@ -83,8 +88,8 @@ def store_evidence(conn: sqlite3.Connection, record: EvidenceRecord) -> Evidence
         """
         insert or replace into guard_evidence
           (evidence_id, action_id, request_id, harness, workspace, signal_id,
-           category, severity, confidence, summary, details_json, created_at)
-        values (?,?,?,?,?,?,?,?,?,?,?,?)
+           category, severity, confidence, summary, details_json, action_identity, created_at)
+        values (?,?,?,?,?,?,?,?,?,?,?,?,?)
         """,
         (
             record.evidence_id,
@@ -98,6 +103,7 @@ def store_evidence(conn: sqlite3.Connection, record: EvidenceRecord) -> Evidence
             record.confidence,
             record.summary,
             json.dumps(record.details),
+            record.action_identity,
             record.created_at,
         ),
     )
@@ -112,6 +118,7 @@ def list_evidence(
     category: str | None = None,
     severity: str | None = None,
     request_id: str | None = None,
+    action_identity: str | None = None,
     before_cursor: str | None = None,
     limit: int = 100,
 ) -> list[EvidenceRecord]:
@@ -130,6 +137,9 @@ def list_evidence(
     if request_id is not None:
         clauses.append("request_id = ?")
         params.append(request_id)
+    if action_identity is not None:
+        clauses.append("action_identity = ?")
+        params.append(action_identity)
     if before_cursor is not None:
         clauses.append("created_at < ?")
         params.append(before_cursor)
@@ -180,27 +190,35 @@ def export_evidence_json(
     conn: sqlite3.Connection,
     *,
     limit: int = 10_000,
+    redact_fields: tuple[str, ...] | None = None,
 ) -> str:
+    """Export evidence records as JSON, omitting sensitive fields by default.
+
+    Pass ``redact_fields=()`` to include all fields including ``details``.
+    By default ``details`` is redacted (excluded from export).
+    """
+    _redact = {"details"} if redact_fields is None else set(redact_fields)
     records = list_evidence(conn, limit=limit)
-    return json.dumps(
-        [
-            {
-                "evidence_id": r.evidence_id,
-                "action_id": r.action_id,
-                "request_id": r.request_id,
-                "harness": r.harness,
-                "workspace": r.workspace,
-                "signal_id": r.signal_id,
-                "category": r.category,
-                "severity": r.severity,
-                "confidence": r.confidence,
-                "summary": r.summary,
-                "created_at": r.created_at,
-            }
-            for r in records
-        ],
-        indent=2,
-    )
+    rows: list[dict[str, object]] = []
+    for r in records:
+        row: dict[str, object] = {
+            "evidence_id": r.evidence_id,
+            "action_id": r.action_id,
+            "request_id": r.request_id,
+            "harness": r.harness,
+            "workspace": r.workspace,
+            "signal_id": r.signal_id,
+            "category": r.category,
+            "severity": r.severity,
+            "confidence": r.confidence,
+            "summary": r.summary,
+            "action_identity": r.action_identity,
+            "created_at": r.created_at,
+        }
+        if "details" not in _redact:
+            row["details"] = r.details
+        rows.append(row)
+    return json.dumps(rows, indent=2)
 
 
 def clear_evidence(conn: sqlite3.Connection) -> int:

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.160"
+__version__ = "2.0.162"

{plugin_scanner-2.0.160 → plugin_scanner-2.0.162}/tests/test_guard_evidence_store.py

@@ -69,6 +69,7 @@ class TestSchema:
         assert "idx_evidence_action" in names
         assert "idx_evidence_category_severity" in names
         assert "idx_evidence_harness_workspace" in names
+        assert "idx_evidence_identity" in names
 
     def test_indexes_idempotent(self, tmp_path: Path) -> None:
         conn = _db(tmp_path)
@@ -284,3 +285,89 @@ class TestCompactEvidence:
         compact_evidence(conn, retain_days=30)
         removed2 = compact_evidence(conn, retain_days=30)
         assert removed2 == 0
+
+
+class TestActionIdentityField:
+    def test_store_and_retrieve_action_identity(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        rec = _rec(evidence_id="e-ai-1", action_identity="codex:tool:bash")
+        store_evidence(conn, rec)
+        results = list_evidence(conn, action_identity="codex:tool:bash")
+        assert len(results) == 1
+        assert results[0].action_identity == "codex:tool:bash"
+
+    def test_action_identity_none_by_default(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        store_evidence(conn, _rec(evidence_id="e-ai-2"))
+        results = list_evidence(conn)
+        assert results[0].action_identity is None
+
+    def test_filter_by_action_identity_excludes_others(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        store_evidence(conn, _rec(evidence_id="e-ai-3", action_identity="tool:a"))
+        store_evidence(conn, _rec(evidence_id="e-ai-4", action_identity="tool:b"))
+        results = list_evidence(conn, action_identity="tool:a")
+        assert len(results) == 1
+        assert results[0].evidence_id == "e-ai-3"
+
+
+class TestLargeScalePagination:
+    def test_cursor_pagination_covers_all_records(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        total = 250
+        for i in range(total):
+            ts = f"2024-01-{(i // 28) + 1:02d}T{(i % 24):02d}:00:{(i % 60):02d}Z"
+            store_evidence(conn, _rec(evidence_id=f"bulk-{i:04d}", created_at=ts))
+
+        page_size = 50
+        seen: list[str] = []
+        cursor: str | None = None
+
+        for _ in range(total // page_size + 2):
+            page = list_evidence(conn, before_cursor=cursor, limit=page_size)
+            if not page:
+                break
+            seen.extend(r.evidence_id for r in page)
+            cursor = page[-1].created_at
+
+        assert len(seen) == total
+
+    def test_first_page_returns_most_recent(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        for i in range(10):
+            store_evidence(conn, _rec(evidence_id=f"p-{i}", created_at=f"2024-01-01T{i:02d}:00:00Z"))
+        page = list_evidence(conn, limit=3)
+        assert page[0].evidence_id == "p-9"
+        assert page[1].evidence_id == "p-8"
+        assert page[2].evidence_id == "p-7"
+
+
+class TestExportRedaction:
+    def test_export_omits_details_by_default(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        store_evidence(conn, _rec(evidence_id="ex-1", details={"secret": "password123"}))
+        exported = json.loads(export_evidence_json(conn))
+        assert len(exported) == 1
+        assert "details" not in exported[0]
+        assert "password123" not in json.dumps(exported)
+
+    def test_export_includes_details_when_redact_empty(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        store_evidence(conn, _rec(evidence_id="ex-2", details={"key": "val"}))
+        exported = json.loads(export_evidence_json(conn, redact_fields=()))
+        assert len(exported) == 1
+        assert exported[0]["details"] == {"key": "val"}
+
+    def test_export_includes_action_identity(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        store_evidence(conn, _rec(evidence_id="ex-3", action_identity="tool:bash"))
+        exported = json.loads(export_evidence_json(conn))
+        assert exported[0]["action_identity"] == "tool:bash"
+
+    def test_export_fields_include_required_keys(self, tmp_path: Path) -> None:
+        conn = _db(tmp_path)
+        store_evidence(conn, _rec(evidence_id="ex-4"))
+        exported = json.loads(export_evidence_json(conn))
+        row = exported[0]
+        for key in ("evidence_id", "action_id", "request_id", "harness", "category", "severity", "summary"):
+            assert key in row, f"missing key: {key}"