plugin-scanner 2.0.171__tar.gz → 2.0.173__tar.gz

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.171
+Version: 2.0.173
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner
@@ -275,6 +275,8 @@ pip install "plugin-scanner[cisco]"
 
 On Guard surfaces, the Cisco extra adds optional offline evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
 
+Guard inventory snapshots can also carry Cisco MCP and skill-scanner status when a Hermes or OpenClaw inventory run explicitly enables those scanners. The Cloud evidence model records scanner source, status, redacted finding text, duration, mapped artifact ID, and risk component metadata without storing raw local paths or secrets.
+
 Guard does not add Cisco AIBOM runtime integration in this pass. If AIBOM support returns later, it should stay on evidence or export surfaces rather than Guard blocking or approval logic.
 
 ### Cisco package status

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/README.md

@@ -235,6 +235,8 @@ pip install "plugin-scanner[cisco]"
 
 On Guard surfaces, the Cisco extra adds optional offline evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
 
+Guard inventory snapshots can also carry Cisco MCP and skill-scanner status when a Hermes or OpenClaw inventory run explicitly enables those scanners. The Cloud evidence model records scanner source, status, redacted finding text, duration, mapped artifact ID, and risk component metadata without storing raw local paths or secrets.
+
 Guard does not add Cisco AIBOM runtime integration in this pass. If AIBOM support returns later, it should stay on evidence or export surfaces rather than Guard blocking or approval logic.
 
 ### Cisco package status

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.171"
+version = "2.0.173"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.171"
+version = "2.0.173"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/src/codex_plugin_scanner/guard/adapters/hermes.py

@@ -13,6 +13,7 @@ import re
 import sys
 from pathlib import Path
 
+from ..inventory_cisco import run_cisco_inventory_scans
 from ..inventory_contract import GuardAgentInventorySnapshot, inventory_snapshot_from_detection
 from ..models import GuardArtifact, HarnessDetection
 from ..shims import install_guard_shim, remove_guard_shim
@@ -247,12 +248,29 @@ class HermesHarnessAdapter(HarnessAdapter):
             config_paths=tuple(found_paths),
         )
 
-    def inventory_snapshot(self, context: HarnessContext, *, generated_at: str) -> GuardAgentInventorySnapshot:
+    def inventory_snapshot(
+        self,
+        context: HarnessContext,
+        *,
+        generated_at: str,
+        cisco_mcp_scan: str = "off",
+        cisco_skill_scan: str = "off",
+        cisco_timeout_seconds: float | None = None,
+    ) -> GuardAgentInventorySnapshot:
+        detection = self.detect(context)
         return inventory_snapshot_from_detection(
-            self.detect(context),
+            detection,
             generated_at=generated_at,
             home_dir=context.home_dir,
             workspace_dir=context.workspace_dir,
+            cisco_runs=run_cisco_inventory_scans(
+                harness=self.harness,
+                context=context,
+                detection=detection,
+                mcp_mode=cisco_mcp_scan,
+                skill_mode=cisco_skill_scan,
+                timeout_seconds=cisco_timeout_seconds,
+            ),
         )
 
     # ------------------------------------------------------------------

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/src/codex_plugin_scanner/guard/adapters/openclaw.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 from pathlib import Path
 
+from ..inventory_cisco import run_cisco_inventory_scans
 from ..inventory_contract import GuardAgentInventorySnapshot, inventory_snapshot_from_detection
 from ..models import GuardArtifact, HarnessDetection
 from ..shims import install_guard_shim, remove_guard_shim
@@ -65,12 +66,29 @@ class OpenClawHarnessAdapter(HarnessAdapter):
             artifacts=tuple(artifacts),
         )
 
-    def inventory_snapshot(self, context: HarnessContext, *, generated_at: str) -> GuardAgentInventorySnapshot:
+    def inventory_snapshot(
+        self,
+        context: HarnessContext,
+        *,
+        generated_at: str,
+        cisco_mcp_scan: str = "off",
+        cisco_skill_scan: str = "off",
+        cisco_timeout_seconds: float | None = None,
+    ) -> GuardAgentInventorySnapshot:
+        detection = self.detect(context)
         return inventory_snapshot_from_detection(
-            self.detect(context),
+            detection,
             generated_at=generated_at,
             home_dir=context.home_dir,
             workspace_dir=context.workspace_dir,
+            cisco_runs=run_cisco_inventory_scans(
+                harness=self.harness,
+                context=context,
+                detection=detection,
+                mcp_mode=cisco_mcp_scan,
+                skill_mode=cisco_skill_scan,
+                timeout_seconds=cisco_timeout_seconds,
+            ),
         )
 
     def install(self, context: HarnessContext) -> dict[str, object]:

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/src/codex_plugin_scanner/guard/cli/commands.py

@@ -5170,6 +5170,9 @@ def _codex_command_is_read_only_source_inspection(command_text: str, *, cwd: Pat
         return False
     if _codex_command_has_unquoted_glob_metachar(command):
         return False
+    chained_segments = _split_codex_safe_read_only_chain(command)
+    if chained_segments is not None:
+        return all(_codex_command_is_read_only_source_inspection(segment, cwd=cwd) for segment in chained_segments)
     segments = _split_codex_safe_read_only_pipeline(command)
     if segments is None:
         return _codex_command_is_read_only_source_search(command, cwd=cwd) or _codex_command_is_read_only_source_view(
@@ -5186,6 +5189,53 @@ def _codex_command_is_read_only_source_inspection(command_text: str, *, cwd: Pat
     return all(_codex_command_is_bounded_read_only_filter(segment) for segment in filter_segments)
 
 
+def _split_codex_safe_read_only_chain(command: str) -> list[str] | None:
+    segments: list[str] = []
+    start = 0
+    quote: str | None = None
+    escaped = False
+    found_chain = False
+    index = 0
+    while index < len(command):
+        char = command[index]
+        if escaped:
+            escaped = False
+            index += 1
+            continue
+        if char == "\\":
+            escaped = True
+            index += 1
+            continue
+        if quote is not None:
+            if char == quote:
+                quote = None
+            index += 1
+            continue
+        if char in {"'", '"'}:
+            quote = char
+            index += 1
+            continue
+        if command.startswith("&&", index):
+            segment = command[start:index].strip()
+            if not segment:
+                return None
+            segments.append(segment)
+            found_chain = True
+            index += 2
+            start = index
+            continue
+        if command.startswith("||", index) or char in {";", "&"}:
+            return None
+        index += 1
+    if quote is not None or escaped or not found_chain:
+        return None
+    segment = command[start:].strip()
+    if not segment:
+        return None
+    segments.append(segment)
+    return segments if len(segments) > 1 else None
+
+
 def _codex_command_has_unquoted_glob_metachar(command: str) -> bool:
     quote: str | None = None
     escaped = False

plugin_scanner-2.0.173/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -0,0 +1,184 @@
+"""Cisco scanner bridge for Guard inventory snapshots."""
+
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Literal
+
+from ..integrations.cisco_mcp_scanner import run_cisco_mcp_scan
+from ..integrations.cisco_skill_scanner import run_cisco_skill_scan
+from ..models import Finding
+from .adapters.base import HarnessContext
+
+CiscoInventorySource = Literal["cisco-mcp-scanner", "cisco-skill-scanner"]
+
+
+@dataclass(frozen=True, slots=True)
+class CiscoInventoryRun:
+    source: CiscoInventorySource
+    status: str
+    message: str
+    findings: tuple[Finding, ...]
+    duration_ms: int
+    metadata: dict[str, object]
+
+
+def run_cisco_inventory_scans(
+    *,
+    harness: str,
+    context: HarnessContext,
+    detection: object,
+    mcp_mode: str = "off",
+    skill_mode: str = "off",
+    timeout_seconds: float | None = None,
+) -> tuple[CiscoInventoryRun, ...]:
+    runs: list[CiscoInventoryRun] = []
+    if mcp_mode != "off":
+        runs.append(_run_mcp_inventory_scan(context=context, mode=mcp_mode, timeout_seconds=timeout_seconds))
+    if skill_mode != "off":
+        runs.append(
+            _run_skill_inventory_scan(
+                harness=harness,
+                context=context,
+                detection=detection,
+                mode=skill_mode,
+                timeout_seconds=timeout_seconds,
+            )
+        )
+    return tuple(runs)
+
+
+def _run_mcp_inventory_scan(
+    *,
+    context: HarnessContext,
+    mode: str,
+    timeout_seconds: float | None,
+) -> CiscoInventoryRun:
+    root = _mcp_scan_root(context)
+    if root is None:
+        return CiscoInventoryRun(
+            source="cisco-mcp-scanner",
+            status="skipped",
+            message="No .mcp.json found; Cisco MCP inventory scan skipped.",
+            findings=(),
+            duration_ms=0,
+            metadata={"target": "missing", "targetsScanned": 0, "mode": mode},
+        )
+    started = time.perf_counter()
+    summary = run_cisco_mcp_scan(root, mode=mode, timeout_seconds=timeout_seconds)
+    duration_ms = int((time.perf_counter() - started) * 1000)
+    return CiscoInventoryRun(
+        source="cisco-mcp-scanner",
+        status=str(summary.status.value),
+        message=summary.message,
+        findings=summary.findings,
+        duration_ms=duration_ms,
+        metadata={
+            "target": root.name,
+            "targetsScanned": summary.targets_scanned,
+            "totalFindings": summary.total_findings,
+            "findingsBySeverity": summary.findings_by_severity,
+            "analyzersUsed": summary.analyzers_used,
+            "scanMode": summary.scan_mode,
+            "mode": mode,
+        },
+    )
+
+
+def _run_skill_inventory_scan(
+    *,
+    harness: str,
+    context: HarnessContext,
+    detection: object,
+    mode: str,
+    timeout_seconds: float | None,
+) -> CiscoInventoryRun:
+    root = _skill_scan_root(harness=harness, context=context, detection=detection)
+    if root is None:
+        return CiscoInventoryRun(
+            source="cisco-skill-scanner",
+            status="skipped",
+            message="No skill directory found; Cisco skill inventory scan skipped.",
+            findings=(),
+            duration_ms=0,
+            metadata={"target": "missing", "skillsScanned": 0, "mode": mode},
+        )
+    started = time.perf_counter()
+    summary = run_cisco_skill_scan(root, mode=mode, timeout_seconds=timeout_seconds)
+    duration_ms = int((time.perf_counter() - started) * 1000)
+    return CiscoInventoryRun(
+        source="cisco-skill-scanner",
+        status=str(summary.status.value),
+        message=summary.message,
+        findings=summary.findings,
+        duration_ms=duration_ms,
+        metadata={
+            "target": root.name,
+            "skillsScanned": summary.skills_scanned,
+            "skillsSkipped": summary.skills_skipped,
+            "totalFindings": summary.total_findings,
+            "findingsBySeverity": summary.findings_by_severity,
+            "analyzersUsed": summary.analyzers_used,
+            "policyName": summary.policy_name,
+            "mode": mode,
+        },
+    )
+
+
+def _mcp_scan_root(context: HarnessContext) -> Path | None:
+    candidates = []
+    if context.workspace_dir is not None:
+        candidates.append(context.workspace_dir)
+    candidates.append(context.home_dir)
+    for candidate in candidates:
+        if (candidate / ".mcp.json").is_file():
+            return candidate
+    return None
+
+
+def _skill_scan_root(*, harness: str, context: HarnessContext, detection: object) -> Path | None:
+    if harness == "hermes":
+        hermes_skills = context.home_dir / ".hermes" / "skills"
+        if hermes_skills.is_dir():
+            return hermes_skills
+    artifacts = tuple(getattr(detection, "artifacts", ()))
+    for artifact in artifacts:
+        artifact_type = str(getattr(artifact, "artifact_type", ""))
+        if artifact_type not in {"skill", "skill_file"}:
+            continue
+        metadata = getattr(artifact, "metadata", {})
+        if isinstance(metadata, dict):
+            skill_root = metadata.get("skill_root")
+            if isinstance(skill_root, str):
+                root = Path(skill_root)
+                if root.is_dir():
+                    return root
+        config_path = getattr(artifact, "config_path", None)
+        if not isinstance(config_path, str):
+            continue
+        skill_path = Path(config_path)
+        root = _nearest_skills_root(skill_path)
+        if root is not None and root.is_dir():
+            return root
+        root = _nearest_skill_dir(skill_path)
+        if root is not None and root.is_dir():
+            return root
+    return None
+
+
+def _nearest_skills_root(path: Path) -> Path | None:
+    for parent in path.parents:
+        if parent.name == "skills":
+            return parent
+    return None
+
+
+def _nearest_skill_dir(path: Path) -> Path | None:
+    if path.name == "SKILL.md":
+        return path.parent
+    for parent in path.parents:
+        if (parent / "SKILL.md").is_file():
+            return parent
+    return None

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/src/codex_plugin_scanner/guard/inventory_contract.py

@@ -64,6 +64,7 @@ _SENSITIVE_KEY_RE = re.compile(
     r"(auth|authorization|bearer|token|secret|password|credential|api[^a-z0-9]?key)",
     re.IGNORECASE,
 )
+_SENSITIVE_VALUE_RE = re.compile(r"(?i)(gh[pousr]_[a-z0-9_]+|sk-[a-z0-9_-]+|guard_live_[a-z0-9_-]+|bearer\s+\S+)")
 _WHITESPACE_RE = re.compile(r"\s+")
 _MCP_READ_RE = re.compile(
     r"(?<![a-z0-9])(read|reads|reading|search|searches|list|lists)(?![a-z0-9])",
@@ -217,6 +218,7 @@ def inventory_snapshot_from_detection(
     home_dir: Path,
     workspace_dir: Path | None = None,
     runtime_version: str | None = None,
+    cisco_runs: tuple[object, ...] = (),
 ) -> GuardAgentInventorySnapshot:
     harness = str(getattr(detection, "harness", "unknown"))
     artifacts = tuple(getattr(detection, "artifacts", ()))
@@ -231,7 +233,7 @@ def inventory_snapshot_from_detection(
         items.append(item)
         items.extend(_mcp_tool_items_from_artifact(harness, artifact, item))
     config_paths = tuple(dict.fromkeys(str(path) for path in getattr(detection, "config_paths", ())))
-    sources = tuple(
+    config_sources = tuple(
         GuardInventorySource(
             source_id=f"{harness}:config:{fingerprint_text(redact_local_path(path, home_dir=home_dir))[:12]}",
             source_type="config",
@@ -241,11 +243,19 @@ def inventory_snapshot_from_detection(
         )
         for path in config_paths
     )
+    cisco_findings = _cisco_inventory_findings(
+        cisco_runs,
+        items=tuple(items),
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+    )
+    sources = (*config_sources, *_cisco_inventory_sources(cisco_runs))
     snapshot_hash = fingerprint_mapping(
         {
             "agent_type": harness,
             "generated_at": generated_at,
             "item_ids": [item.item_id for item in items],
+            "finding_ids": [finding.finding_id for finding in cisco_findings],
         }
     )
     return GuardAgentInventorySnapshot(
@@ -255,10 +265,11 @@ def inventory_snapshot_from_detection(
         generated_at=generated_at,
         runtime_version=runtime_version,
         items=tuple(items),
+        findings=cisco_findings,
         sources=sources,
         redaction_report={
             "rawSecretsIncluded": False,
-            "redactedFields": ("headers", "env", "url", "paths"),
+            "redactedFields": ("headers", "env", "url", "paths", "ciscoFindingText"),
         },
     )
 
@@ -542,6 +553,162 @@ def _risk_level_for_capabilities(capabilities: tuple[InventoryCapability, ...])
     return "info"
 
 
+def _cisco_inventory_findings(
+    cisco_runs: tuple[object, ...],
+    *,
+    items: tuple[GuardAgentInventoryItem, ...],
+    home_dir: Path,
+    workspace_dir: Path | None,
+) -> tuple[GuardAgentInventoryFinding, ...]:
+    findings: list[GuardAgentInventoryFinding] = []
+    seen: set[str] = set()
+    for run in cisco_runs:
+        source = _cisco_source(run)
+        if source is None:
+            continue
+        run_status = str(getattr(run, "status", "unknown"))
+        run_message = _safe_finding_text(
+            str(getattr(run, "message", "")),
+            home_dir=home_dir,
+            workspace_dir=workspace_dir,
+        )
+        duration_ms = getattr(run, "duration_ms", None)
+        for raw_finding in tuple(getattr(run, "findings", ()) or ()):
+            rule_id = str(getattr(raw_finding, "rule_id", "cisco-finding") or "cisco-finding")
+            title = _safe_finding_text(
+                str(getattr(raw_finding, "title", "Cisco scanner finding") or "Cisco scanner finding"),
+                home_dir=home_dir,
+                workspace_dir=workspace_dir,
+            )
+            file_path = getattr(raw_finding, "file_path", None)
+            safe_path = (
+                _redact_known_path(str(file_path), home_dir, workspace_dir)
+                if isinstance(file_path, str) and file_path
+                else None
+            )
+            line_number = getattr(raw_finding, "line_number", None)
+            finding_hash = fingerprint_mapping(
+                {
+                    "source": source,
+                    "rule_id": rule_id,
+                    "title": title,
+                    "path": safe_path,
+                    "line": line_number if isinstance(line_number, int) else None,
+                }
+            )
+            finding_id = f"{source}:{rule_id}:{finding_hash[:16]}"
+            if finding_id in seen:
+                continue
+            seen.add(finding_id)
+            severity = _inventory_severity(getattr(raw_finding, "severity", "info"))
+            findings.append(
+                GuardAgentInventoryFinding(
+                    finding_id=finding_id,
+                    source=source,
+                    severity=severity,
+                    confidence="high" if run_status == "enabled" else "unknown",
+                    title=title,
+                    artifact_id=_artifact_id_for_cisco_finding(safe_path, items),
+                    check_id=rule_id,
+                    summary=_safe_finding_text(
+                        str(getattr(raw_finding, "description", "") or ""),
+                        home_dir=home_dir,
+                        workspace_dir=workspace_dir,
+                    ),
+                    evidence={
+                        "scannerStatus": run_status,
+                        "scannerMessage": run_message,
+                        "filePath": safe_path,
+                        "lineNumber": line_number if isinstance(line_number, int) else None,
+                        "durationMs": duration_ms if isinstance(duration_ms, int) else None,
+                        "riskComponent": {
+                            "source": source,
+                            "severity": severity,
+                            "confidence": "high" if run_status == "enabled" else "unknown",
+                            "scoreDelta": _score_delta_for_severity(severity),
+                        },
+                    },
+                )
+            )
+    return tuple(findings)
+
+
+def _cisco_inventory_sources(cisco_runs: tuple[object, ...]) -> tuple[GuardInventorySource, ...]:
+    sources: list[GuardInventorySource] = []
+    for run in cisco_runs:
+        source = _cisco_source(run)
+        if source is None:
+            continue
+        status = str(getattr(run, "status", "unknown"))
+        detail = _safe_source_detail(run)
+        sources.append(
+            GuardInventorySource(
+                source_id=f"{source}:{fingerprint_mapping({'status': status, 'detail': detail})[:12]}",
+                source_type="scanner",
+                status=_source_status_for_cisco_status(status),
+                detail=detail,
+            )
+        )
+    return tuple(sources)
+
+
+def _cisco_source(run: object) -> InventoryFindingSource | None:
+    source = str(getattr(run, "source", ""))
+    if source in {"cisco-mcp-scanner", "cisco-skill-scanner"}:
+        return source
+    return None
+
+
+def _inventory_severity(value: object) -> InventorySeverity:
+    severity_value = str(getattr(value, "value", value)).strip().lower()
+    if severity_value in {"critical", "high", "medium", "low", "info"}:
+        return severity_value
+    return "info"
+
+
+def _score_delta_for_severity(severity: InventorySeverity) -> int:
+    return {"critical": -40, "high": -25, "medium": -12, "low": -5, "info": 0}[severity]
+
+
+def _artifact_id_for_cisco_finding(
+    safe_path: str | None,
+    items: tuple[GuardAgentInventoryItem, ...],
+) -> str:
+    if safe_path is None:
+        return "unknown"
+    for item in items:
+        config_path = item.metadata.get("configPath")
+        if isinstance(config_path, str) and (config_path == safe_path or config_path.endswith(safe_path)):
+            return item.item_id
+    return "unknown"
+
+
+def _source_status_for_cisco_status(status: str) -> Literal["available", "missing", "failed"]:
+    if status == "enabled":
+        return "available"
+    if status in {"failed", "timed_out"}:
+        return "failed"
+    return "missing"
+
+
+def _safe_source_detail(run: object) -> str:
+    status = str(getattr(run, "status", "unknown"))
+    metadata = getattr(run, "metadata", {})
+    finding_count = None
+    if isinstance(metadata, dict):
+        candidate = metadata.get("totalFindings")
+        if isinstance(candidate, int):
+            finding_count = candidate
+    suffix = f", findings={finding_count}" if finding_count is not None else ""
+    return f"status={status}{suffix}"
+
+
+def _safe_finding_text(value: str, *, home_dir: Path, workspace_dir: Path | None) -> str:
+    redacted = _SENSITIVE_VALUE_RE.sub("redacted", value)
+    redacted = _redact_command_value(redacted, home_dir, workspace_dir)
+    return redacted[:500]
+
+
 def _agent_type(value: str) -> AgentInventoryType:
     for agent_type in _AGENT_INVENTORY_TYPES:
         if value == agent_type:

{plugin_scanner-2.0.171 → plugin_scanner-2.0.173}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.171"
+__version__ = "2.0.173"