plugin-scanner 2.0.542__tar.gz → 2.0.543__tar.gz

{plugin_scanner-2.0.542 → plugin_scanner-2.0.543}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.542
+Version: 2.0.543
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.542 → plugin_scanner-2.0.543}/dashboard/src/about/components/about-external-link.tsx

@@ -45,9 +45,10 @@ export function AboutExternalLink({
       rel={safe.rel}
       onClick={handleClick}
       className={[
-        `inline-flex items-center gap-1 transition-colors hover:text-brand-blue`,
-        `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2`,
+        `inline-flex items-center gap-1 transition-colors`,
+        className?.includes("hover:") ? "" : "hover:text-brand-blue",
         className ?? "",
+        `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2`,
       ].join(" ")}
     >
       {children}

{plugin_scanner-2.0.542 → plugin_scanner-2.0.543}/dashboard/src/app.tsx

@@ -11,6 +11,7 @@ import {
   fetchRequest,
   fetchInboxState,
   fetchSettings,
+  fetchGuardUpdateStatus,
   guardAwareHref,
   repairApprovalCenter,
   resolveRequestWithQueueResult,
@@ -229,6 +230,7 @@ export function App() {
   const [helpOpen, setHelpOpen] = useState(false);
   const [clearConfirm, setClearConfirm] = useState<{ harness?: string; all?: boolean } | null>(null);
   const [approvalGate, setApprovalGate] = useState<GuardApprovalGatePublicConfig | null>(null);
+  const [guardVersion, setGuardVersion] = useState<string | null>(null);
   const resolutionInFlight = useRef(false);
 
   useEffect(() => {
@@ -306,6 +308,13 @@ export function App() {
         }
       })
       .catch(() => {});
+    fetchGuardUpdateStatus()
+      .then((status) => {
+        if (!cancelled && status.current_version) {
+          setGuardVersion(status.current_version);
+        }
+      })
+      .catch(() => {});
     return () => { cancelled = true; };
   }, []);
 
@@ -766,7 +775,7 @@ export function App() {
               ? {
                   // TODO: GuardRuntimeSnapshot does not yet expose guard_version or protected_app_count.
                   // When those fields are added, populate them here instead of null/0.
-                  guardVersion: null,
+                  guardVersion: guardVersion,
                   cloudState: runtime.snapshot.cloud_state ?? "unknown",
                   cloudStateLabel: runtime.snapshot.cloud_state_label ?? "Unknown",
                   syncConfigured: runtime.snapshot.sync_configured ?? false,

{plugin_scanner-2.0.542 → plugin_scanner-2.0.543}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.542"
+version = "2.0.543"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.542 → plugin_scanner-2.0.543}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.542"
+version = "2.0.543"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.543/src/codex_plugin_scanner/guard/cli/dashboard_sync.py

@@ -0,0 +1,179 @@
+from pathlib import Path
+
+from ..redaction import redact_sensitive_text
+
+
+def sync_dashboard_assets() -> dict[str, object] | None:
+    """Copy pre-built dashboard assets from a local source checkout to the installed package.
+
+    When HOL Guard is installed from PyPI/uv/pipx, the wheel may not include the latest
+    dashboard Vite build. This function detects a local source checkout and copies the
+    already-built assets into the installed package's static directory so the running
+    daemon serves fresh UI. No build step is performed; run ``npm run build`` in the
+    dashboard directory first if assets are stale.
+    """
+    import importlib.util
+    import shutil
+
+    # Find the installed package's static directory
+    spec = importlib.util.find_spec("codex_plugin_scanner.guard.daemon.server")
+    if spec is None or spec.origin is None:
+        return None
+    installed_static = Path(spec.origin).with_name("static")
+    try:
+        if not installed_static.is_dir():
+            return None
+    except OSError:
+        return None
+
+    # Find a local source checkout by walking up from cwd looking for hol-guard/dashboard
+    try:
+        source_checkout = find_source_checkout()
+    except OSError:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+    if source_checkout is None:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+
+    try:
+        dashboard_dir = source_checkout / "dashboard"
+        source_static = dashboard_dir / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+        # Fallback: if the repo builds into src/codex_plugin_scanner/guard/daemon/static
+        if not source_static.is_dir():
+            source_static = source_checkout / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+        if not source_static.is_dir():
+            return {
+                "source_checkout_found": True,
+                "source_checkout": str(source_checkout),
+                "dashboard_dir_found": False,
+                "notes": [
+                    "Source checkout found but no built dashboard assets. "
+                    "Run `npm run build` in the dashboard directory.",
+                ],
+            }
+    except OSError as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed due to file system error."],
+        }
+
+    # Compare source vs installed to decide if copy is needed
+    source_index = source_static / "index.html"
+    installed_index = installed_static / "index.html"
+    needs_copy = True
+    try:
+        if installed_index.is_file() and source_index.is_file():
+            installed_mtime = installed_index.stat().st_mtime
+            source_mtime = source_index.stat().st_mtime
+            needs_copy = source_mtime > installed_mtime
+    except OSError:
+        needs_copy = True
+
+    if not needs_copy:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "reason": "installed assets are already up to date",
+        }
+
+    # Copy all files from source static to installed static
+    copied_count = 0
+    try:
+        for src_file in source_static.rglob("*"):
+            if not src_file.is_file():
+                continue
+            relative = src_file.relative_to(source_static)
+            dest = installed_static / relative
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(src_file, dest)
+            copied_count += 1
+    except OSError as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed. The daemon may serve stale UI."],
+        }
+
+    return {
+        "source_checkout_found": True,
+        "source_checkout": str(source_checkout),
+        "installed_static": str(installed_static),
+        "copied": True,
+        "copied_files": copied_count,
+        "notes": [f"Synced {copied_count} dashboard asset files to the installed package."],
+    }
+
+
+def find_source_checkout() -> Path | None:
+    """Return a local hol-guard source checkout if one is detected nearby.
+
+    Security: Only returns a directory after VCS verification proves it is the
+    real hashgraph-online/hol-guard repository. Trivial directory markers like
+    dashboard/package.json and src/codex_plugin_scanner are NOT sufficient on
+    their own because any untrusted project can create them.
+    """
+    try:
+        cwd = Path.cwd().resolve()
+    except OSError:
+        return None
+    candidates = [cwd, *cwd.parents]
+    for candidate in candidates:
+        checkout = verify_source_checkout(candidate)
+        if checkout is not None:
+            return checkout
+    # Check one level deeper for repo roots that may contain hol-guard as a sub-project
+    for candidate in candidates:
+        try:
+            for sub in candidate.iterdir():
+                try:
+                    checkout = verify_source_checkout(sub)
+                    if checkout is not None:
+                        return checkout
+                except OSError:
+                    continue
+        except OSError:
+            continue
+    return None
+
+
+_TRUSTED_REPO_KEYWORDS = ("hashgraph-online/hol-guard",)
+
+
+def verify_source_checkout(path: Path) -> Path | None:
+    """Verify a candidate directory is the real hol-guard source checkout.
+
+    Returns *path* only when:
+    - It contains the expected source tree markers.
+    - It is a git repository whose remotes reference the trusted upstream.
+
+    Security: This function reads ``.git/config`` directly instead of executing
+    ``git`` in the candidate directory to avoid triggering repository-local Git
+    hooks or configuration that could lead to arbitrary code execution.
+    """
+    try:
+        if not (path / "dashboard" / "package.json").is_file():
+            return None
+        if not (path / "src" / "codex_plugin_scanner").is_dir():
+            return None
+        if not (path / ".git").is_dir():
+            return None
+    except OSError:
+        return None
+
+    try:
+        config_path = path / ".git" / "config"
+        if not config_path.is_file():
+            return None
+        remote_text = config_path.read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return None
+
+    if not any(kw in remote_text for kw in _TRUSTED_REPO_KEYWORDS):
+        return None
+
+    return path

{plugin_scanner-2.0.542 → plugin_scanner-2.0.543}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -24,6 +24,7 @@ from ..adapters.base import HarnessContext
 from ..adapters.codex import CodexHarnessAdapter, codex_native_hook_state
 from ..redaction import redact_sensitive_text
 from ..store import GuardStore
+from .dashboard_sync import sync_dashboard_assets
 from .install_commands import apply_managed_install
 
 _ALREADY_CURRENT_HINTS = (
@@ -158,7 +159,7 @@ def run_guard_update(
             payload["managed_install"] = repaired_installs[0]
     # Sync dashboard static assets after package update so the daemon serves fresh UI.
     if not dry_run and payload.get("status") in {"updated", "current"}:
-        dashboard_sync = _sync_dashboard_assets()
+        dashboard_sync = sync_dashboard_assets()
         if dashboard_sync:
             payload["dashboard_sync"] = dashboard_sync
             sync_notes = dashboard_sync.get("notes")
@@ -684,143 +685,4 @@ def build_guard_update_status_payload() -> dict[str, object]:
     }
 
 
-def _sync_dashboard_assets() -> dict[str, object] | None:
-    """Copy pre-built dashboard assets from a local source checkout to the installed package.
-
-    When HOL Guard is installed from PyPI/uv/pipx, the wheel may not include the latest
-    dashboard Vite build. This function detects a local source checkout and copies the
-    already-built assets into the installed package's static directory so the running
-    daemon serves fresh UI. No build step is performed; run ``npm run build`` in the
-    dashboard directory first if assets are stale.
-    """
-    import importlib.util
-
-    # Find the installed package's static directory
-    spec = importlib.util.find_spec("codex_plugin_scanner.guard.daemon.server")
-    if spec is None or spec.origin is None:
-        return None
-    installed_static = Path(spec.origin).with_name("static")
-    try:
-        if not installed_static.is_dir():
-            return None
-    except OSError:
-        return None
-
-    # Find a local source checkout by walking up from cwd looking for hol-guard/dashboard
-    try:
-        source_checkout = _find_source_checkout()
-    except OSError:
-        return {"source_checkout_found": False, "installed_static": str(installed_static)}
-    if source_checkout is None:
-        return {"source_checkout_found": False, "installed_static": str(installed_static)}
-
-    try:
-        dashboard_dir = source_checkout / "dashboard"
-        source_static = dashboard_dir / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
-        # Fallback: if the repo builds into src/codex_plugin_scanner/guard/daemon/static
-        if not source_static.is_dir():
-            source_static = source_checkout / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
-        if not source_static.is_dir():
-            return {
-                "source_checkout_found": True,
-                "source_checkout": str(source_checkout),
-                "dashboard_dir_found": False,
-                "notes": [
-                    "Source checkout found but no built dashboard assets. "
-                    "Run `npm run build` in the dashboard directory.",
-                ],
-            }
-    except OSError as error:
-        return {
-            "source_checkout_found": True,
-            "source_checkout": str(source_checkout),
-            "copied": False,
-            "error": redact_sensitive_text(str(error)),
-            "notes": ["Dashboard asset sync failed due to file system error."],
-        }
-
-    # Compare source vs installed to decide if copy is needed
-    source_index = source_static / "index.html"
-    installed_index = installed_static / "index.html"
-    needs_copy = True
-    try:
-        if installed_index.is_file() and source_index.is_file():
-            installed_mtime = installed_index.stat().st_mtime
-            source_mtime = source_index.stat().st_mtime
-            needs_copy = source_mtime > installed_mtime
-    except OSError:
-        needs_copy = True
-
-    if not needs_copy:
-        return {
-            "source_checkout_found": True,
-            "source_checkout": str(source_checkout),
-            "copied": False,
-            "reason": "installed assets are already up to date",
-        }
-
-    # Copy all files from source static to installed static
-    copied_count = 0
-    try:
-        for src_file in source_static.rglob("*"):
-            if not src_file.is_file():
-                continue
-            relative = src_file.relative_to(source_static)
-            dest = installed_static / relative
-            dest.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(src_file, dest)
-            copied_count += 1
-    except OSError as error:
-        return {
-            "source_checkout_found": True,
-            "source_checkout": str(source_checkout),
-            "copied": False,
-            "error": redact_sensitive_text(str(error)),
-            "notes": ["Dashboard asset sync failed. The daemon may serve stale UI."],
-        }
-
-    return {
-        "source_checkout_found": True,
-        "source_checkout": str(source_checkout),
-        "installed_static": str(installed_static),
-        "copied": True,
-        "copied_files": copied_count,
-        "notes": [f"Synced {copied_count} dashboard asset files to the installed package."],
-    }
-
-
-def _find_source_checkout() -> Path | None:
-    """Return a local hol-guard source checkout if one is detected nearby."""
-    try:
-        cwd = Path.cwd().resolve()
-    except OSError:
-        return None
-    candidates = [cwd, *cwd.parents]
-    # Also check common locations near the install
-    for candidate in candidates:
-        try:
-            if (candidate / "dashboard" / "package.json").is_file() and (
-                candidate / "src" / "codex_plugin_scanner"
-            ).is_dir():
-                return candidate
-        except OSError:
-            continue
-    # Check one level deeper for repo roots that may contain hol-guard as a sub-project
-    for candidate in candidates:
-        try:
-            for sub in candidate.iterdir():
-                try:
-                    if (
-                        sub.is_dir()
-                        and (sub / "dashboard" / "package.json").is_file()
-                        and (sub / "src" / "codex_plugin_scanner").is_dir()
-                    ):
-                        return sub
-                except OSError:
-                    continue
-        except OSError:
-            continue
-    return None
-
-
 __all__ = ["build_guard_update_status_payload", "run_guard_update"]