plugin-scanner 2.0.542__tar.gz → 2.0.544__tar.gz

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.542
+Version: 2.0.544
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/dashboard/src/about/components/about-external-link.tsx

@@ -45,9 +45,10 @@ export function AboutExternalLink({
       rel={safe.rel}
       onClick={handleClick}
       className={[
-        `inline-flex items-center gap-1 transition-colors hover:text-brand-blue`,
-        `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2`,
+        `inline-flex items-center gap-1 transition-colors`,
+        className?.includes("hover:") ? "" : "hover:text-brand-blue",
         className ?? "",
+        `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2`,
       ].join(" ")}
     >
       {children}

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/dashboard/src/app.tsx

@@ -11,6 +11,7 @@ import {
   fetchRequest,
   fetchInboxState,
   fetchSettings,
+  fetchGuardUpdateStatus,
   guardAwareHref,
   repairApprovalCenter,
   resolveRequestWithQueueResult,
@@ -229,6 +230,7 @@ export function App() {
   const [helpOpen, setHelpOpen] = useState(false);
   const [clearConfirm, setClearConfirm] = useState<{ harness?: string; all?: boolean } | null>(null);
   const [approvalGate, setApprovalGate] = useState<GuardApprovalGatePublicConfig | null>(null);
+  const [guardVersion, setGuardVersion] = useState<string | null>(null);
   const resolutionInFlight = useRef(false);
 
   useEffect(() => {
@@ -306,6 +308,13 @@ export function App() {
         }
       })
       .catch(() => {});
+    fetchGuardUpdateStatus()
+      .then((status) => {
+        if (!cancelled && status.current_version) {
+          setGuardVersion(status.current_version);
+        }
+      })
+      .catch(() => {});
     return () => { cancelled = true; };
   }, []);
 
@@ -766,7 +775,7 @@ export function App() {
               ? {
                   // TODO: GuardRuntimeSnapshot does not yet expose guard_version or protected_app_count.
                   // When those fields are added, populate them here instead of null/0.
-                  guardVersion: null,
+                  guardVersion: guardVersion,
                   cloudState: runtime.snapshot.cloud_state ?? "unknown",
                   cloudStateLabel: runtime.snapshot.cloud_state_label ?? "Unknown",
                   syncConfigured: runtime.snapshot.sync_configured ?? false,

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.542"
+version = "2.0.544"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.542"
+version = "2.0.544"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/src/codex_plugin_scanner/cli.py

@@ -71,10 +71,6 @@ def _is_guard_program(program_name: str) -> bool:
     return normalized_name in {"plugin-guard"}
 
 
-def _is_hol_guard_binary(program_name: str) -> bool:
-    return Path(program_name).stem.lower() == "hol-guard"
-
-
 def _is_scanner_program(program_name: str) -> bool:
     normalized_name = Path(program_name).stem.lower()
     return normalized_name in {"plugin-scanner", "plugin-ecosystem-scanner"}
@@ -184,8 +180,19 @@ def _build_parser(program_name: str, *, program_mode: str) -> argparse.ArgumentP
     return parser
 
 
-def _resolve_legacy_args(argv: list[str] | None, *, program_mode: str) -> list[str] | None:
+def _is_hol_guard_program(program_name: str) -> bool:
+    return Path(program_name).stem.lower() == "hol-guard"
+
+
+def _resolve_legacy_args(
+    argv: list[str] | None,
+    *,
+    program_mode: str,
+    program_name: str = "",
+) -> list[str] | None:
     if not argv:
+        if program_mode == "combined" and _is_hol_guard_program(program_name):
+            return ["guard"]
         return argv
     if program_mode == "guard":
         if argv[0] == "guard":
@@ -261,6 +268,15 @@ def _resolve_legacy_args(argv: list[str] | None, *, program_mode: str) -> list[s
         "bridge",
         "daemon",
         "hook",
+        "admin",
+        "cloud",
+        "supply-chain",
+        "service",
+        "codex-mcp-proxy",
+        "opencode-mcp-proxy",
+        "copilot-mcp-proxy",
+        "cursor-mcp-proxy",
+        "hermes-mcp-proxy",
     }
     if program_mode == "combined" and argv[0] in _guard_subcommands and "--format" not in argv:
         return ["guard", *argv]
@@ -552,9 +568,11 @@ def main(argv: list[str] | None = None) -> int:
     else:
         program_mode = "combined"
     parser = _build_parser(program_name, program_mode=program_mode)
-    resolved_argv = _resolve_legacy_args(argv or sys.argv[1:], program_mode=program_mode)
-    if _is_hol_guard_binary(program_name) and not resolved_argv:
-        parser.error("the following arguments are required: command")
+    resolved_argv = _resolve_legacy_args(
+        argv or sys.argv[1:],
+        program_mode=program_mode,
+        program_name=program_name,
+    )
     args = parser.parse_args(resolved_argv)
     if getattr(args, "list_ecosystems", False):
         for ecosystem in list_supported_ecosystems():

plugin_scanner-2.0.544/src/codex_plugin_scanner/guard/cli/dashboard_sync.py

@@ -0,0 +1,179 @@
+from pathlib import Path
+
+from ..redaction import redact_sensitive_text
+
+
+def sync_dashboard_assets() -> dict[str, object] | None:
+    """Copy pre-built dashboard assets from a local source checkout to the installed package.
+
+    When HOL Guard is installed from PyPI/uv/pipx, the wheel may not include the latest
+    dashboard Vite build. This function detects a local source checkout and copies the
+    already-built assets into the installed package's static directory so the running
+    daemon serves fresh UI. No build step is performed; run ``npm run build`` in the
+    dashboard directory first if assets are stale.
+    """
+    import importlib.util
+    import shutil
+
+    # Find the installed package's static directory
+    spec = importlib.util.find_spec("codex_plugin_scanner.guard.daemon.server")
+    if spec is None or spec.origin is None:
+        return None
+    installed_static = Path(spec.origin).with_name("static")
+    try:
+        if not installed_static.is_dir():
+            return None
+    except OSError:
+        return None
+
+    # Find a local source checkout by walking up from cwd looking for hol-guard/dashboard
+    try:
+        source_checkout = find_source_checkout()
+    except OSError:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+    if source_checkout is None:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+
+    try:
+        dashboard_dir = source_checkout / "dashboard"
+        source_static = dashboard_dir / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+        # Fallback: if the repo builds into src/codex_plugin_scanner/guard/daemon/static
+        if not source_static.is_dir():
+            source_static = source_checkout / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+        if not source_static.is_dir():
+            return {
+                "source_checkout_found": True,
+                "source_checkout": str(source_checkout),
+                "dashboard_dir_found": False,
+                "notes": [
+                    "Source checkout found but no built dashboard assets. "
+                    "Run `npm run build` in the dashboard directory.",
+                ],
+            }
+    except OSError as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed due to file system error."],
+        }
+
+    # Compare source vs installed to decide if copy is needed
+    source_index = source_static / "index.html"
+    installed_index = installed_static / "index.html"
+    needs_copy = True
+    try:
+        if installed_index.is_file() and source_index.is_file():
+            installed_mtime = installed_index.stat().st_mtime
+            source_mtime = source_index.stat().st_mtime
+            needs_copy = source_mtime > installed_mtime
+    except OSError:
+        needs_copy = True
+
+    if not needs_copy:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "reason": "installed assets are already up to date",
+        }
+
+    # Copy all files from source static to installed static
+    copied_count = 0
+    try:
+        for src_file in source_static.rglob("*"):
+            if not src_file.is_file():
+                continue
+            relative = src_file.relative_to(source_static)
+            dest = installed_static / relative
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(src_file, dest)
+            copied_count += 1
+    except OSError as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed. The daemon may serve stale UI."],
+        }
+
+    return {
+        "source_checkout_found": True,
+        "source_checkout": str(source_checkout),
+        "installed_static": str(installed_static),
+        "copied": True,
+        "copied_files": copied_count,
+        "notes": [f"Synced {copied_count} dashboard asset files to the installed package."],
+    }
+
+
+def find_source_checkout() -> Path | None:
+    """Return a local hol-guard source checkout if one is detected nearby.
+
+    Security: Only returns a directory after VCS verification proves it is the
+    real hashgraph-online/hol-guard repository. Trivial directory markers like
+    dashboard/package.json and src/codex_plugin_scanner are NOT sufficient on
+    their own because any untrusted project can create them.
+    """
+    try:
+        cwd = Path.cwd().resolve()
+    except OSError:
+        return None
+    candidates = [cwd, *cwd.parents]
+    for candidate in candidates:
+        checkout = verify_source_checkout(candidate)
+        if checkout is not None:
+            return checkout
+    # Check one level deeper for repo roots that may contain hol-guard as a sub-project
+    for candidate in candidates:
+        try:
+            for sub in candidate.iterdir():
+                try:
+                    checkout = verify_source_checkout(sub)
+                    if checkout is not None:
+                        return checkout
+                except OSError:
+                    continue
+        except OSError:
+            continue
+    return None
+
+
+_TRUSTED_REPO_KEYWORDS = ("hashgraph-online/hol-guard",)
+
+
+def verify_source_checkout(path: Path) -> Path | None:
+    """Verify a candidate directory is the real hol-guard source checkout.
+
+    Returns *path* only when:
+    - It contains the expected source tree markers.
+    - It is a git repository whose remotes reference the trusted upstream.
+
+    Security: This function reads ``.git/config`` directly instead of executing
+    ``git`` in the candidate directory to avoid triggering repository-local Git
+    hooks or configuration that could lead to arbitrary code execution.
+    """
+    try:
+        if not (path / "dashboard" / "package.json").is_file():
+            return None
+        if not (path / "src" / "codex_plugin_scanner").is_dir():
+            return None
+        if not (path / ".git").is_dir():
+            return None
+    except OSError:
+        return None
+
+    try:
+        config_path = path / ".git" / "config"
+        if not config_path.is_file():
+            return None
+        remote_text = config_path.read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return None
+
+    if not any(kw in remote_text for kw in _TRUSTED_REPO_KEYWORDS):
+        return None
+
+    return path

{plugin_scanner-2.0.542 → plugin_scanner-2.0.544}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -24,6 +24,7 @@ from ..adapters.base import HarnessContext
 from ..adapters.codex import CodexHarnessAdapter, codex_native_hook_state
 from ..redaction import redact_sensitive_text
 from ..store import GuardStore
+from .dashboard_sync import sync_dashboard_assets
 from .install_commands import apply_managed_install
 
 _ALREADY_CURRENT_HINTS = (
@@ -158,7 +159,7 @@ def run_guard_update(
             payload["managed_install"] = repaired_installs[0]
     # Sync dashboard static assets after package update so the daemon serves fresh UI.
     if not dry_run and payload.get("status") in {"updated", "current"}:
-        dashboard_sync = _sync_dashboard_assets()
+        dashboard_sync = sync_dashboard_assets()
         if dashboard_sync:
             payload["dashboard_sync"] = dashboard_sync
             sync_notes = dashboard_sync.get("notes")
@@ -684,143 +685,4 @@ def build_guard_update_status_payload() -> dict[str, object]:
     }
 
 
-def _sync_dashboard_assets() -> dict[str, object] | None:
-    """Copy pre-built dashboard assets from a local source checkout to the installed package.
-
-    When HOL Guard is installed from PyPI/uv/pipx, the wheel may not include the latest
-    dashboard Vite build. This function detects a local source checkout and copies the
-    already-built assets into the installed package's static directory so the running
-    daemon serves fresh UI. No build step is performed; run ``npm run build`` in the
-    dashboard directory first if assets are stale.
-    """
-    import importlib.util
-
-    # Find the installed package's static directory
-    spec = importlib.util.find_spec("codex_plugin_scanner.guard.daemon.server")
-    if spec is None or spec.origin is None:
-        return None
-    installed_static = Path(spec.origin).with_name("static")
-    try:
-        if not installed_static.is_dir():
-            return None
-    except OSError:
-        return None
-
-    # Find a local source checkout by walking up from cwd looking for hol-guard/dashboard
-    try:
-        source_checkout = _find_source_checkout()
-    except OSError:
-        return {"source_checkout_found": False, "installed_static": str(installed_static)}
-    if source_checkout is None:
-        return {"source_checkout_found": False, "installed_static": str(installed_static)}
-
-    try:
-        dashboard_dir = source_checkout / "dashboard"
-        source_static = dashboard_dir / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
-        # Fallback: if the repo builds into src/codex_plugin_scanner/guard/daemon/static
-        if not source_static.is_dir():
-            source_static = source_checkout / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
-        if not source_static.is_dir():
-            return {
-                "source_checkout_found": True,
-                "source_checkout": str(source_checkout),
-                "dashboard_dir_found": False,
-                "notes": [
-                    "Source checkout found but no built dashboard assets. "
-                    "Run `npm run build` in the dashboard directory.",
-                ],
-            }
-    except OSError as error:
-        return {
-            "source_checkout_found": True,
-            "source_checkout": str(source_checkout),
-            "copied": False,
-            "error": redact_sensitive_text(str(error)),
-            "notes": ["Dashboard asset sync failed due to file system error."],
-        }
-
-    # Compare source vs installed to decide if copy is needed
-    source_index = source_static / "index.html"
-    installed_index = installed_static / "index.html"
-    needs_copy = True
-    try:
-        if installed_index.is_file() and source_index.is_file():
-            installed_mtime = installed_index.stat().st_mtime
-            source_mtime = source_index.stat().st_mtime
-            needs_copy = source_mtime > installed_mtime
-    except OSError:
-        needs_copy = True
-
-    if not needs_copy:
-        return {
-            "source_checkout_found": True,
-            "source_checkout": str(source_checkout),
-            "copied": False,
-            "reason": "installed assets are already up to date",
-        }
-
-    # Copy all files from source static to installed static
-    copied_count = 0
-    try:
-        for src_file in source_static.rglob("*"):
-            if not src_file.is_file():
-                continue
-            relative = src_file.relative_to(source_static)
-            dest = installed_static / relative
-            dest.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(src_file, dest)
-            copied_count += 1
-    except OSError as error:
-        return {
-            "source_checkout_found": True,
-            "source_checkout": str(source_checkout),
-            "copied": False,
-            "error": redact_sensitive_text(str(error)),
-            "notes": ["Dashboard asset sync failed. The daemon may serve stale UI."],
-        }
-
-    return {
-        "source_checkout_found": True,
-        "source_checkout": str(source_checkout),
-        "installed_static": str(installed_static),
-        "copied": True,
-        "copied_files": copied_count,
-        "notes": [f"Synced {copied_count} dashboard asset files to the installed package."],
-    }
-
-
-def _find_source_checkout() -> Path | None:
-    """Return a local hol-guard source checkout if one is detected nearby."""
-    try:
-        cwd = Path.cwd().resolve()
-    except OSError:
-        return None
-    candidates = [cwd, *cwd.parents]
-    # Also check common locations near the install
-    for candidate in candidates:
-        try:
-            if (candidate / "dashboard" / "package.json").is_file() and (
-                candidate / "src" / "codex_plugin_scanner"
-            ).is_dir():
-                return candidate
-        except OSError:
-            continue
-    # Check one level deeper for repo roots that may contain hol-guard as a sub-project
-    for candidate in candidates:
-        try:
-            for sub in candidate.iterdir():
-                try:
-                    if (
-                        sub.is_dir()
-                        and (sub / "dashboard" / "package.json").is_file()
-                        and (sub / "src" / "codex_plugin_scanner").is_dir()
-                    ):
-                        return sub
-                except OSError:
-                    continue
-        except OSError:
-            continue
-    return None
-
-
 __all__ = ["build_guard_update_status_payload", "run_guard_update"]

plugin_scanner-2.0.544/src/codex_plugin_scanner/guard/contracts/__init__.py

@@ -0,0 +1 @@
+"""Guard shared contract helpers."""

plugin_scanner-2.0.544/src/codex_plugin_scanner/guard/contracts/supply_chain_decision_evidence_v1.py

@@ -0,0 +1,109 @@
+"""Shared Guard supply-chain decision evidence contract v1."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from codex_plugin_scanner.guard.runtime.supply_chain_package_eval import PackageRequestEvaluation
+
+DECISION_EVIDENCE_CONTRACT_VERSION = "guard-supply-chain-decision-evidence.v1"
+
+DECISION_VALUES = frozenset({"allow", "monitor", "warn", "ask", "block"})
+ENFORCEMENT_VALUES = frozenset({"premium_cloud", "local_fallback", "upgrade_required", "free_local", "offline_cached"})
+ENTITLEMENT_VALUES = frozenset({"premium", "free", "limit_reached"})
+CACHE_STATUS_VALUES = frozenset({"miss", "stale", "upgrade-gated", "hit", "empty"})
+
+REQUIRED_DECISION_EVIDENCE_FIELDS = (
+    "contractVersion",
+    "decision",
+    "recommendation",
+    "enforcement",
+    "entitlementState",
+    "cacheStatus",
+    "policyVersion",
+    "packageIntentHash",
+    "commandShape",
+    "reasons",
+    "evidenceIds",
+)
+
+
+def validate_decision_evidence_v1(payload: Mapping[str, object]) -> list[str]:
+    errors: list[str] = []
+    missing = {field for field in REQUIRED_DECISION_EVIDENCE_FIELDS if field not in payload}
+    for field in missing:
+        errors.append(f"missing field: {field}")
+    contract_version = payload.get("contractVersion")
+    if "contractVersion" not in missing and contract_version != DECISION_EVIDENCE_CONTRACT_VERSION:
+        errors.append(f"unexpected contractVersion: {contract_version!r}")
+    decision = payload.get("decision")
+    if "decision" not in missing and decision not in DECISION_VALUES:
+        errors.append(f"invalid decision: {decision!r}")
+    recommendation = payload.get("recommendation")
+    if recommendation not in DECISION_VALUES:
+        errors.append(f"invalid recommendation: {recommendation!r}")
+    enforcement = payload.get("enforcement")
+    if "enforcement" not in missing and enforcement not in ENFORCEMENT_VALUES:
+        errors.append(f"invalid enforcement: {enforcement!r}")
+    entitlement_state = payload.get("entitlementState")
+    if "entitlementState" not in missing and entitlement_state not in ENTITLEMENT_VALUES:
+        errors.append(f"invalid entitlementState: {entitlement_state!r}")
+    cache_status = payload.get("cacheStatus")
+    if "cacheStatus" not in missing and cache_status not in CACHE_STATUS_VALUES:
+        errors.append(f"invalid cacheStatus: {cache_status!r}")
+    command_shape = payload.get("commandShape")
+    if not isinstance(command_shape, dict):
+        errors.append("commandShape must be an object")
+    elif not isinstance(command_shape.get("redacted"), bool):
+        errors.append("commandShape.redacted must be boolean")
+    reasons = payload.get("reasons")
+    if not isinstance(reasons, list):
+        errors.append("reasons must be an array")
+    evidence_ids = payload.get("evidenceIds")
+    if not isinstance(evidence_ids, list):
+        errors.append("evidenceIds must be an array")
+    return errors
+
+
+def package_evaluation_to_decision_evidence_v1(
+    evaluation: PackageRequestEvaluation,
+    *,
+    command_shape: Mapping[str, object],
+    package_intent_hash: str,
+    recommendation: str | None = None,
+) -> dict[str, object]:
+    resolved_recommendation = recommendation or evaluation.decision
+    return {
+        "contractVersion": DECISION_EVIDENCE_CONTRACT_VERSION,
+        "decision": evaluation.decision,
+        "recommendation": resolved_recommendation,
+        "enforcement": evaluation.enforcement,
+        "entitlementState": evaluation.entitlement_state,
+        "cacheStatus": evaluation.cache_status,
+        "policyVersion": evaluation.policy_version,
+        "packageIntentHash": package_intent_hash,
+        "commandShape": dict(command_shape),
+        "reasons": [dict(item) for item in evaluation.reasons],
+        "evidenceIds": list(evaluation.evidence_ids),
+    }
+
+
+def cloud_evaluate_response_to_decision_evidence_v1(
+    response: Mapping[str, object],
+    *,
+    package_intent_hash: str,
+    command_shape: Mapping[str, object],
+) -> dict[str, object]:
+    return {
+        "contractVersion": DECISION_EVIDENCE_CONTRACT_VERSION,
+        "decision": response.get("decision"),
+        "recommendation": response.get("recommendation", response.get("decision")),
+        "enforcement": response.get("enforcement"),
+        "entitlementState": response.get("entitlementState"),
+        "cacheStatus": response.get("cacheStatus"),
+        "policyVersion": response.get("policyVersion"),
+        "packageIntentHash": package_intent_hash,
+        "commandShape": dict(command_shape),
+        "reasons": list(response.get("reasons") or []),
+        "evidenceIds": list(response.get("evidenceIds") or []),
+    }