plugin-scanner 2.0.541__tar.gz → 2.0.543__tar.gz

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.541
+Version: 2.0.543
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/dashboard/src/about/components/about-external-link.tsx

@@ -45,9 +45,10 @@ export function AboutExternalLink({
       rel={safe.rel}
       onClick={handleClick}
       className={[
-        `inline-flex items-center gap-1 transition-colors hover:text-brand-blue`,
-        `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2`,
+        `inline-flex items-center gap-1 transition-colors`,
+        className?.includes("hover:") ? "" : "hover:text-brand-blue",
         className ?? "",
+        `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2`,
       ].join(" ")}
     >
       {children}

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/dashboard/src/app.tsx

@@ -11,6 +11,7 @@ import {
   fetchRequest,
   fetchInboxState,
   fetchSettings,
+  fetchGuardUpdateStatus,
   guardAwareHref,
   repairApprovalCenter,
   resolveRequestWithQueueResult,
@@ -229,6 +230,7 @@ export function App() {
   const [helpOpen, setHelpOpen] = useState(false);
   const [clearConfirm, setClearConfirm] = useState<{ harness?: string; all?: boolean } | null>(null);
   const [approvalGate, setApprovalGate] = useState<GuardApprovalGatePublicConfig | null>(null);
+  const [guardVersion, setGuardVersion] = useState<string | null>(null);
   const resolutionInFlight = useRef(false);
 
   useEffect(() => {
@@ -306,6 +308,13 @@ export function App() {
         }
       })
       .catch(() => {});
+    fetchGuardUpdateStatus()
+      .then((status) => {
+        if (!cancelled && status.current_version) {
+          setGuardVersion(status.current_version);
+        }
+      })
+      .catch(() => {});
     return () => { cancelled = true; };
   }, []);
 
@@ -766,7 +775,7 @@ export function App() {
               ? {
                   // TODO: GuardRuntimeSnapshot does not yet expose guard_version or protected_app_count.
                   // When those fields are added, populate them here instead of null/0.
-                  guardVersion: null,
+                  guardVersion: guardVersion,
                   cloudState: runtime.snapshot.cloud_state ?? "unknown",
                   cloudStateLabel: runtime.snapshot.cloud_state_label ?? "Unknown",
                   syncConfigured: runtime.snapshot.sync_configured ?? false,

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.541"
+version = "2.0.543"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.541"
+version = "2.0.543"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/src/codex_plugin_scanner/cli.py

@@ -71,6 +71,10 @@ def _is_guard_program(program_name: str) -> bool:
     return normalized_name in {"plugin-guard"}
 
 
+def _is_hol_guard_binary(program_name: str) -> bool:
+    return Path(program_name).stem.lower() == "hol-guard"
+
+
 def _is_scanner_program(program_name: str) -> bool:
     normalized_name = Path(program_name).stem.lower()
     return normalized_name in {"plugin-scanner", "plugin-ecosystem-scanner"}
@@ -235,6 +239,7 @@ def _resolve_legacy_args(argv: list[str] | None, *, program_mode: str) -> list[s
         "preflight",
         "diff",
         "receipts",
+        "history",
         "inventory",
         "abom",
         "approvals",
@@ -242,15 +247,19 @@ def _resolve_legacy_args(argv: list[str] | None, *, program_mode: str) -> list[s
         "allow",
         "deny",
         "policies",
+        "settings",
         "exceptions",
         "advisories",
         "events",
+        "doctor",
         "connect",
+        "remote-pair",
         "disconnect",
         "login",
         "sync",
         "device",
         "bridge",
+        "daemon",
         "hook",
     }
     if program_mode == "combined" and argv[0] in _guard_subcommands and "--format" not in argv:
@@ -544,6 +553,8 @@ def main(argv: list[str] | None = None) -> int:
         program_mode = "combined"
     parser = _build_parser(program_name, program_mode=program_mode)
     resolved_argv = _resolve_legacy_args(argv or sys.argv[1:], program_mode=program_mode)
+    if _is_hol_guard_binary(program_name) and not resolved_argv:
+        parser.error("the following arguments are required: command")
     args = parser.parse_args(resolved_argv)
     if getattr(args, "list_ecosystems", False):
         for ecosystem in list_supported_ecosystems():

{plugin_scanner-2.0.541 → plugin_scanner-2.0.543}/src/codex_plugin_scanner/guard/cli/commands.py

@@ -220,6 +220,7 @@ from .install_commands import (
     uninstall_confirmation_token,
 )
 from .product import build_guard_start_payload, build_guard_status_payload
+from .remote_pair_flow import dispatch_guard_remote_pair_command
 from .update_commands import run_guard_update
 
 DEFAULT_GUARD_APPS_URL = "https://hol.org/guard/apps"
@@ -402,7 +403,7 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
         metavar=(
             "{start,status,dashboard,init,apps,bootstrap,detect,install,update,uninstall,package-shims,run,protect,preflight,scan,diff,"
             "receipts,inventory,abom,approvals,explain,allow,deny,policies,exceptions,advisories,events,doctor,connect,"
-            "disconnect,"
+            "remote-pair,disconnect,"
             "login,sync,device,bridge}"
         ),
     )
@@ -896,6 +897,33 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
     )
     connect_parser.add_argument("--json", action="store_true")
 
+    remote_pair_parser = guard_subparsers.add_parser(
+        "remote-pair",
+        help="Pair a hosted OpenClaw or Hermes runtime with a Guard Cloud pairing code",
+    )
+    remote_pair_parser.add_argument(
+        "remote_pair_command",
+        nargs="?",
+        choices=("status",),
+        help="Inspect remote pairing status without claiming a new code",
+    )
+    remote_pair_parser.add_argument("--runtime", choices=("openclaw", "hermes"))
+    remote_pair_parser.add_argument("--pair-code")
+    remote_pair_parser.add_argument("--label")
+    remote_pair_parser.add_argument(
+        "--no-root",
+        action="store_true",
+        help="Install and pair using user-space paths only; refuse root or sudo sessions",
+    )
+    remote_pair_parser.add_argument(
+        "--verify",
+        action="store_true",
+        help="Run the first Guard Cloud sync after pairing succeeds",
+    )
+    remote_pair_parser.add_argument("--connect-url", default=DEFAULT_GUARD_CONNECT_URL, type=_guard_http_url)
+    _add_guard_common_args(remote_pair_parser)
+    remote_pair_parser.add_argument("--json", action="store_true")
+
     disconnect_parser = guard_subparsers.add_parser(
         "disconnect",
         help="Revoke local Guard Cloud OAuth credentials and optionally revoke the cloud grant",
@@ -2567,6 +2595,16 @@ def run_guard_command(
         _emit("connect", payload, getattr(args, "json", False))
         return exit_code
 
+    if args.guard_command == "remote-pair":
+        return dispatch_guard_remote_pair_command(
+            args=args,
+            store=store,
+            context=context,
+            emit=_emit,
+            finalize_connect_payload=_finalize_guard_connect_payload,
+            now=_now(),
+        )
+
     if args.guard_command == "connect":
         connect_subcommand = getattr(args, "connect_command", None)
         if connect_subcommand in {"status", "repair", "re-pair"}:

plugin_scanner-2.0.543/src/codex_plugin_scanner/guard/cli/dashboard_sync.py

@@ -0,0 +1,179 @@
+from pathlib import Path
+
+from ..redaction import redact_sensitive_text
+
+
+def sync_dashboard_assets() -> dict[str, object] | None:
+    """Copy pre-built dashboard assets from a local source checkout to the installed package.
+
+    When HOL Guard is installed from PyPI/uv/pipx, the wheel may not include the latest
+    dashboard Vite build. This function detects a local source checkout and copies the
+    already-built assets into the installed package's static directory so the running
+    daemon serves fresh UI. No build step is performed; run ``npm run build`` in the
+    dashboard directory first if assets are stale.
+    """
+    import importlib.util
+    import shutil
+
+    # Find the installed package's static directory
+    spec = importlib.util.find_spec("codex_plugin_scanner.guard.daemon.server")
+    if spec is None or spec.origin is None:
+        return None
+    installed_static = Path(spec.origin).with_name("static")
+    try:
+        if not installed_static.is_dir():
+            return None
+    except OSError:
+        return None
+
+    # Find a local source checkout by walking up from cwd looking for hol-guard/dashboard
+    try:
+        source_checkout = find_source_checkout()
+    except OSError:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+    if source_checkout is None:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+
+    try:
+        dashboard_dir = source_checkout / "dashboard"
+        source_static = dashboard_dir / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+        # Fallback: if the repo builds into src/codex_plugin_scanner/guard/daemon/static
+        if not source_static.is_dir():
+            source_static = source_checkout / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+        if not source_static.is_dir():
+            return {
+                "source_checkout_found": True,
+                "source_checkout": str(source_checkout),
+                "dashboard_dir_found": False,
+                "notes": [
+                    "Source checkout found but no built dashboard assets. "
+                    "Run `npm run build` in the dashboard directory.",
+                ],
+            }
+    except OSError as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed due to file system error."],
+        }
+
+    # Compare source vs installed to decide if copy is needed
+    source_index = source_static / "index.html"
+    installed_index = installed_static / "index.html"
+    needs_copy = True
+    try:
+        if installed_index.is_file() and source_index.is_file():
+            installed_mtime = installed_index.stat().st_mtime
+            source_mtime = source_index.stat().st_mtime
+            needs_copy = source_mtime > installed_mtime
+    except OSError:
+        needs_copy = True
+
+    if not needs_copy:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "reason": "installed assets are already up to date",
+        }
+
+    # Copy all files from source static to installed static
+    copied_count = 0
+    try:
+        for src_file in source_static.rglob("*"):
+            if not src_file.is_file():
+                continue
+            relative = src_file.relative_to(source_static)
+            dest = installed_static / relative
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(src_file, dest)
+            copied_count += 1
+    except OSError as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed. The daemon may serve stale UI."],
+        }
+
+    return {
+        "source_checkout_found": True,
+        "source_checkout": str(source_checkout),
+        "installed_static": str(installed_static),
+        "copied": True,
+        "copied_files": copied_count,
+        "notes": [f"Synced {copied_count} dashboard asset files to the installed package."],
+    }
+
+
+def find_source_checkout() -> Path | None:
+    """Return a local hol-guard source checkout if one is detected nearby.
+
+    Security: Only returns a directory after VCS verification proves it is the
+    real hashgraph-online/hol-guard repository. Trivial directory markers like
+    dashboard/package.json and src/codex_plugin_scanner are NOT sufficient on
+    their own because any untrusted project can create them.
+    """
+    try:
+        cwd = Path.cwd().resolve()
+    except OSError:
+        return None
+    candidates = [cwd, *cwd.parents]
+    for candidate in candidates:
+        checkout = verify_source_checkout(candidate)
+        if checkout is not None:
+            return checkout
+    # Check one level deeper for repo roots that may contain hol-guard as a sub-project
+    for candidate in candidates:
+        try:
+            for sub in candidate.iterdir():
+                try:
+                    checkout = verify_source_checkout(sub)
+                    if checkout is not None:
+                        return checkout
+                except OSError:
+                    continue
+        except OSError:
+            continue
+    return None
+
+
+_TRUSTED_REPO_KEYWORDS = ("hashgraph-online/hol-guard",)
+
+
+def verify_source_checkout(path: Path) -> Path | None:
+    """Verify a candidate directory is the real hol-guard source checkout.
+
+    Returns *path* only when:
+    - It contains the expected source tree markers.
+    - It is a git repository whose remotes reference the trusted upstream.
+
+    Security: This function reads ``.git/config`` directly instead of executing
+    ``git`` in the candidate directory to avoid triggering repository-local Git
+    hooks or configuration that could lead to arbitrary code execution.
+    """
+    try:
+        if not (path / "dashboard" / "package.json").is_file():
+            return None
+        if not (path / "src" / "codex_plugin_scanner").is_dir():
+            return None
+        if not (path / ".git").is_dir():
+            return None
+    except OSError:
+        return None
+
+    try:
+        config_path = path / ".git" / "config"
+        if not config_path.is_file():
+            return None
+        remote_text = config_path.read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return None
+
+    if not any(kw in remote_text for kw in _TRUSTED_REPO_KEYWORDS):
+        return None
+
+    return path