plugin-scanner 2.0.170__tar.gz → 2.0.172__tar.gz

{plugin_scanner-2.0.170 → plugin_scanner-2.0.172}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.170
+Version: 2.0.172
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner
@@ -275,6 +275,8 @@ pip install "plugin-scanner[cisco]"
 
 On Guard surfaces, the Cisco extra adds optional offline evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
 
+Guard inventory snapshots can also carry Cisco MCP and skill-scanner status when a Hermes or OpenClaw inventory run explicitly enables those scanners. The Cloud evidence model records scanner source, status, redacted finding text, duration, mapped artifact ID, and risk component metadata without storing raw local paths or secrets.
+
 Guard does not add Cisco AIBOM runtime integration in this pass. If AIBOM support returns later, it should stay on evidence or export surfaces rather than Guard blocking or approval logic.
 
 ### Cisco package status

{plugin_scanner-2.0.170 → plugin_scanner-2.0.172}/README.md

@@ -235,6 +235,8 @@ pip install "plugin-scanner[cisco]"
 
 On Guard surfaces, the Cisco extra adds optional offline evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
 
+Guard inventory snapshots can also carry Cisco MCP and skill-scanner status when a Hermes or OpenClaw inventory run explicitly enables those scanners. The Cloud evidence model records scanner source, status, redacted finding text, duration, mapped artifact ID, and risk component metadata without storing raw local paths or secrets.
+
 Guard does not add Cisco AIBOM runtime integration in this pass. If AIBOM support returns later, it should stay on evidence or export surfaces rather than Guard blocking or approval logic.
 
 ### Cisco package status

{plugin_scanner-2.0.170 → plugin_scanner-2.0.172}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.170"
+version = "2.0.172"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.170 → plugin_scanner-2.0.172}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.170"
+version = "2.0.172"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.170 → plugin_scanner-2.0.172}/src/codex_plugin_scanner/guard/adapters/hermes.py

@@ -13,6 +13,7 @@ import re
 import sys
 from pathlib import Path
 
+from ..inventory_cisco import run_cisco_inventory_scans
 from ..inventory_contract import GuardAgentInventorySnapshot, inventory_snapshot_from_detection
 from ..models import GuardArtifact, HarnessDetection
 from ..shims import install_guard_shim, remove_guard_shim
@@ -247,12 +248,29 @@ class HermesHarnessAdapter(HarnessAdapter):
             config_paths=tuple(found_paths),
         )
 
-    def inventory_snapshot(self, context: HarnessContext, *, generated_at: str) -> GuardAgentInventorySnapshot:
+    def inventory_snapshot(
+        self,
+        context: HarnessContext,
+        *,
+        generated_at: str,
+        cisco_mcp_scan: str = "off",
+        cisco_skill_scan: str = "off",
+        cisco_timeout_seconds: float | None = None,
+    ) -> GuardAgentInventorySnapshot:
+        detection = self.detect(context)
         return inventory_snapshot_from_detection(
-            self.detect(context),
+            detection,
             generated_at=generated_at,
             home_dir=context.home_dir,
             workspace_dir=context.workspace_dir,
+            cisco_runs=run_cisco_inventory_scans(
+                harness=self.harness,
+                context=context,
+                detection=detection,
+                mcp_mode=cisco_mcp_scan,
+                skill_mode=cisco_skill_scan,
+                timeout_seconds=cisco_timeout_seconds,
+            ),
         )
 
     # ------------------------------------------------------------------

{plugin_scanner-2.0.170 → plugin_scanner-2.0.172}/src/codex_plugin_scanner/guard/adapters/openclaw.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 from pathlib import Path
 
+from ..inventory_cisco import run_cisco_inventory_scans
 from ..inventory_contract import GuardAgentInventorySnapshot, inventory_snapshot_from_detection
 from ..models import GuardArtifact, HarnessDetection
 from ..shims import install_guard_shim, remove_guard_shim
@@ -65,12 +66,29 @@ class OpenClawHarnessAdapter(HarnessAdapter):
             artifacts=tuple(artifacts),
         )
 
-    def inventory_snapshot(self, context: HarnessContext, *, generated_at: str) -> GuardAgentInventorySnapshot:
+    def inventory_snapshot(
+        self,
+        context: HarnessContext,
+        *,
+        generated_at: str,
+        cisco_mcp_scan: str = "off",
+        cisco_skill_scan: str = "off",
+        cisco_timeout_seconds: float | None = None,
+    ) -> GuardAgentInventorySnapshot:
+        detection = self.detect(context)
         return inventory_snapshot_from_detection(
-            self.detect(context),
+            detection,
             generated_at=generated_at,
             home_dir=context.home_dir,
             workspace_dir=context.workspace_dir,
+            cisco_runs=run_cisco_inventory_scans(
+                harness=self.harness,
+                context=context,
+                detection=detection,
+                mcp_mode=cisco_mcp_scan,
+                skill_mode=cisco_skill_scan,
+                timeout_seconds=cisco_timeout_seconds,
+            ),
         )
 
     def install(self, context: HarnessContext) -> dict[str, object]:

plugin_scanner-2.0.172/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -0,0 +1,184 @@
+"""Cisco scanner bridge for Guard inventory snapshots."""
+
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Literal
+
+from ..integrations.cisco_mcp_scanner import run_cisco_mcp_scan
+from ..integrations.cisco_skill_scanner import run_cisco_skill_scan
+from ..models import Finding
+from .adapters.base import HarnessContext
+
+CiscoInventorySource = Literal["cisco-mcp-scanner", "cisco-skill-scanner"]
+
+
+@dataclass(frozen=True, slots=True)
+class CiscoInventoryRun:
+    source: CiscoInventorySource
+    status: str
+    message: str
+    findings: tuple[Finding, ...]
+    duration_ms: int
+    metadata: dict[str, object]
+
+
+def run_cisco_inventory_scans(
+    *,
+    harness: str,
+    context: HarnessContext,
+    detection: object,
+    mcp_mode: str = "off",
+    skill_mode: str = "off",
+    timeout_seconds: float | None = None,
+) -> tuple[CiscoInventoryRun, ...]:
+    runs: list[CiscoInventoryRun] = []
+    if mcp_mode != "off":
+        runs.append(_run_mcp_inventory_scan(context=context, mode=mcp_mode, timeout_seconds=timeout_seconds))
+    if skill_mode != "off":
+        runs.append(
+            _run_skill_inventory_scan(
+                harness=harness,
+                context=context,
+                detection=detection,
+                mode=skill_mode,
+                timeout_seconds=timeout_seconds,
+            )
+        )
+    return tuple(runs)
+
+
+def _run_mcp_inventory_scan(
+    *,
+    context: HarnessContext,
+    mode: str,
+    timeout_seconds: float | None,
+) -> CiscoInventoryRun:
+    root = _mcp_scan_root(context)
+    if root is None:
+        return CiscoInventoryRun(
+            source="cisco-mcp-scanner",
+            status="skipped",
+            message="No .mcp.json found; Cisco MCP inventory scan skipped.",
+            findings=(),
+            duration_ms=0,
+            metadata={"target": "missing", "targetsScanned": 0, "mode": mode},
+        )
+    started = time.perf_counter()
+    summary = run_cisco_mcp_scan(root, mode=mode, timeout_seconds=timeout_seconds)
+    duration_ms = int((time.perf_counter() - started) * 1000)
+    return CiscoInventoryRun(
+        source="cisco-mcp-scanner",
+        status=str(summary.status.value),
+        message=summary.message,
+        findings=summary.findings,
+        duration_ms=duration_ms,
+        metadata={
+            "target": root.name,
+            "targetsScanned": summary.targets_scanned,
+            "totalFindings": summary.total_findings,
+            "findingsBySeverity": summary.findings_by_severity,
+            "analyzersUsed": summary.analyzers_used,
+            "scanMode": summary.scan_mode,
+            "mode": mode,
+        },
+    )
+
+
+def _run_skill_inventory_scan(
+    *,
+    harness: str,
+    context: HarnessContext,
+    detection: object,
+    mode: str,
+    timeout_seconds: float | None,
+) -> CiscoInventoryRun:
+    root = _skill_scan_root(harness=harness, context=context, detection=detection)
+    if root is None:
+        return CiscoInventoryRun(
+            source="cisco-skill-scanner",
+            status="skipped",
+            message="No skill directory found; Cisco skill inventory scan skipped.",
+            findings=(),
+            duration_ms=0,
+            metadata={"target": "missing", "skillsScanned": 0, "mode": mode},
+        )
+    started = time.perf_counter()
+    summary = run_cisco_skill_scan(root, mode=mode, timeout_seconds=timeout_seconds)
+    duration_ms = int((time.perf_counter() - started) * 1000)
+    return CiscoInventoryRun(
+        source="cisco-skill-scanner",
+        status=str(summary.status.value),
+        message=summary.message,
+        findings=summary.findings,
+        duration_ms=duration_ms,
+        metadata={
+            "target": root.name,
+            "skillsScanned": summary.skills_scanned,
+            "skillsSkipped": summary.skills_skipped,
+            "totalFindings": summary.total_findings,
+            "findingsBySeverity": summary.findings_by_severity,
+            "analyzersUsed": summary.analyzers_used,
+            "policyName": summary.policy_name,
+            "mode": mode,
+        },
+    )
+
+
+def _mcp_scan_root(context: HarnessContext) -> Path | None:
+    candidates = []
+    if context.workspace_dir is not None:
+        candidates.append(context.workspace_dir)
+    candidates.append(context.home_dir)
+    for candidate in candidates:
+        if (candidate / ".mcp.json").is_file():
+            return candidate
+    return None
+
+
+def _skill_scan_root(*, harness: str, context: HarnessContext, detection: object) -> Path | None:
+    if harness == "hermes":
+        hermes_skills = context.home_dir / ".hermes" / "skills"
+        if hermes_skills.is_dir():
+            return hermes_skills
+    artifacts = tuple(getattr(detection, "artifacts", ()))
+    for artifact in artifacts:
+        artifact_type = str(getattr(artifact, "artifact_type", ""))
+        if artifact_type not in {"skill", "skill_file"}:
+            continue
+        metadata = getattr(artifact, "metadata", {})
+        if isinstance(metadata, dict):
+            skill_root = metadata.get("skill_root")
+            if isinstance(skill_root, str):
+                root = Path(skill_root)
+                if root.is_dir():
+                    return root
+        config_path = getattr(artifact, "config_path", None)
+        if not isinstance(config_path, str):
+            continue
+        skill_path = Path(config_path)
+        root = _nearest_skills_root(skill_path)
+        if root is not None and root.is_dir():
+            return root
+        root = _nearest_skill_dir(skill_path)
+        if root is not None and root.is_dir():
+            return root
+    return None
+
+
+def _nearest_skills_root(path: Path) -> Path | None:
+    for parent in path.parents:
+        if parent.name == "skills":
+            return parent
+    return None
+
+
+def _nearest_skill_dir(path: Path) -> Path | None:
+    if path.name == "SKILL.md":
+        return path.parent
+    for parent in path.parents:
+        if (parent / "SKILL.md").is_file():
+            return parent
+    return None