plugin-scanner 2.0.543__tar.gz → 2.0.544__tar.gz

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.543
+Version: 2.0.544
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.543"
+version = "2.0.544"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.543"
+version = "2.0.544"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/src/codex_plugin_scanner/cli.py

@@ -71,10 +71,6 @@ def _is_guard_program(program_name: str) -> bool:
     return normalized_name in {"plugin-guard"}
 
 
-def _is_hol_guard_binary(program_name: str) -> bool:
-    return Path(program_name).stem.lower() == "hol-guard"
-
-
 def _is_scanner_program(program_name: str) -> bool:
     normalized_name = Path(program_name).stem.lower()
     return normalized_name in {"plugin-scanner", "plugin-ecosystem-scanner"}
@@ -184,8 +180,19 @@ def _build_parser(program_name: str, *, program_mode: str) -> argparse.ArgumentP
     return parser
 
 
-def _resolve_legacy_args(argv: list[str] | None, *, program_mode: str) -> list[str] | None:
+def _is_hol_guard_program(program_name: str) -> bool:
+    return Path(program_name).stem.lower() == "hol-guard"
+
+
+def _resolve_legacy_args(
+    argv: list[str] | None,
+    *,
+    program_mode: str,
+    program_name: str = "",
+) -> list[str] | None:
     if not argv:
+        if program_mode == "combined" and _is_hol_guard_program(program_name):
+            return ["guard"]
         return argv
     if program_mode == "guard":
         if argv[0] == "guard":
@@ -261,6 +268,15 @@ def _resolve_legacy_args(argv: list[str] | None, *, program_mode: str) -> list[s
         "bridge",
         "daemon",
         "hook",
+        "admin",
+        "cloud",
+        "supply-chain",
+        "service",
+        "codex-mcp-proxy",
+        "opencode-mcp-proxy",
+        "copilot-mcp-proxy",
+        "cursor-mcp-proxy",
+        "hermes-mcp-proxy",
     }
     if program_mode == "combined" and argv[0] in _guard_subcommands and "--format" not in argv:
         return ["guard", *argv]
@@ -552,9 +568,11 @@ def main(argv: list[str] | None = None) -> int:
     else:
         program_mode = "combined"
     parser = _build_parser(program_name, program_mode=program_mode)
-    resolved_argv = _resolve_legacy_args(argv or sys.argv[1:], program_mode=program_mode)
-    if _is_hol_guard_binary(program_name) and not resolved_argv:
-        parser.error("the following arguments are required: command")
+    resolved_argv = _resolve_legacy_args(
+        argv or sys.argv[1:],
+        program_mode=program_mode,
+        program_name=program_name,
+    )
     args = parser.parse_args(resolved_argv)
     if getattr(args, "list_ecosystems", False):
         for ecosystem in list_supported_ecosystems():

plugin_scanner-2.0.544/src/codex_plugin_scanner/guard/contracts/__init__.py

@@ -0,0 +1 @@
+"""Guard shared contract helpers."""

plugin_scanner-2.0.544/src/codex_plugin_scanner/guard/contracts/supply_chain_decision_evidence_v1.py

@@ -0,0 +1,109 @@
+"""Shared Guard supply-chain decision evidence contract v1."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from codex_plugin_scanner.guard.runtime.supply_chain_package_eval import PackageRequestEvaluation
+
+DECISION_EVIDENCE_CONTRACT_VERSION = "guard-supply-chain-decision-evidence.v1"
+
+DECISION_VALUES = frozenset({"allow", "monitor", "warn", "ask", "block"})
+ENFORCEMENT_VALUES = frozenset({"premium_cloud", "local_fallback", "upgrade_required", "free_local", "offline_cached"})
+ENTITLEMENT_VALUES = frozenset({"premium", "free", "limit_reached"})
+CACHE_STATUS_VALUES = frozenset({"miss", "stale", "upgrade-gated", "hit", "empty"})
+
+REQUIRED_DECISION_EVIDENCE_FIELDS = (
+    "contractVersion",
+    "decision",
+    "recommendation",
+    "enforcement",
+    "entitlementState",
+    "cacheStatus",
+    "policyVersion",
+    "packageIntentHash",
+    "commandShape",
+    "reasons",
+    "evidenceIds",
+)
+
+
+def validate_decision_evidence_v1(payload: Mapping[str, object]) -> list[str]:
+    errors: list[str] = []
+    missing = {field for field in REQUIRED_DECISION_EVIDENCE_FIELDS if field not in payload}
+    for field in missing:
+        errors.append(f"missing field: {field}")
+    contract_version = payload.get("contractVersion")
+    if "contractVersion" not in missing and contract_version != DECISION_EVIDENCE_CONTRACT_VERSION:
+        errors.append(f"unexpected contractVersion: {contract_version!r}")
+    decision = payload.get("decision")
+    if "decision" not in missing and decision not in DECISION_VALUES:
+        errors.append(f"invalid decision: {decision!r}")
+    recommendation = payload.get("recommendation")
+    if recommendation not in DECISION_VALUES:
+        errors.append(f"invalid recommendation: {recommendation!r}")
+    enforcement = payload.get("enforcement")
+    if "enforcement" not in missing and enforcement not in ENFORCEMENT_VALUES:
+        errors.append(f"invalid enforcement: {enforcement!r}")
+    entitlement_state = payload.get("entitlementState")
+    if "entitlementState" not in missing and entitlement_state not in ENTITLEMENT_VALUES:
+        errors.append(f"invalid entitlementState: {entitlement_state!r}")
+    cache_status = payload.get("cacheStatus")
+    if "cacheStatus" not in missing and cache_status not in CACHE_STATUS_VALUES:
+        errors.append(f"invalid cacheStatus: {cache_status!r}")
+    command_shape = payload.get("commandShape")
+    if not isinstance(command_shape, dict):
+        errors.append("commandShape must be an object")
+    elif not isinstance(command_shape.get("redacted"), bool):
+        errors.append("commandShape.redacted must be boolean")
+    reasons = payload.get("reasons")
+    if not isinstance(reasons, list):
+        errors.append("reasons must be an array")
+    evidence_ids = payload.get("evidenceIds")
+    if not isinstance(evidence_ids, list):
+        errors.append("evidenceIds must be an array")
+    return errors
+
+
+def package_evaluation_to_decision_evidence_v1(
+    evaluation: PackageRequestEvaluation,
+    *,
+    command_shape: Mapping[str, object],
+    package_intent_hash: str,
+    recommendation: str | None = None,
+) -> dict[str, object]:
+    resolved_recommendation = recommendation or evaluation.decision
+    return {
+        "contractVersion": DECISION_EVIDENCE_CONTRACT_VERSION,
+        "decision": evaluation.decision,
+        "recommendation": resolved_recommendation,
+        "enforcement": evaluation.enforcement,
+        "entitlementState": evaluation.entitlement_state,
+        "cacheStatus": evaluation.cache_status,
+        "policyVersion": evaluation.policy_version,
+        "packageIntentHash": package_intent_hash,
+        "commandShape": dict(command_shape),
+        "reasons": [dict(item) for item in evaluation.reasons],
+        "evidenceIds": list(evaluation.evidence_ids),
+    }
+
+
+def cloud_evaluate_response_to_decision_evidence_v1(
+    response: Mapping[str, object],
+    *,
+    package_intent_hash: str,
+    command_shape: Mapping[str, object],
+) -> dict[str, object]:
+    return {
+        "contractVersion": DECISION_EVIDENCE_CONTRACT_VERSION,
+        "decision": response.get("decision"),
+        "recommendation": response.get("recommendation", response.get("decision")),
+        "enforcement": response.get("enforcement"),
+        "entitlementState": response.get("entitlementState"),
+        "cacheStatus": response.get("cacheStatus"),
+        "policyVersion": response.get("policyVersion"),
+        "packageIntentHash": package_intent_hash,
+        "commandShape": dict(command_shape),
+        "reasons": list(response.get("reasons") or []),
+        "evidenceIds": list(response.get("evidenceIds") or []),
+    }

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/src/codex_plugin_scanner/guard/protect.py

@@ -123,6 +123,18 @@ def build_protect_payload(
     if len(command) == 0:
         raise ValueError("Guard protect requires a command to wrap.")
     request = parse_protect_command(command)
+    package_payload = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=dry_run,
+        now=now,
+        config=config,
+        unsafe_raw_output=unsafe_raw_output,
+        timeout_seconds=_protect_command_timeout_seconds(),
+    )
+    if package_payload is not None:
+        return package_payload
     advisories = store.list_cached_advisories(limit=None)
     verdict = evaluate_protect_request(request, advisories)
     receipt = _build_install_receipt(request, verdict)
@@ -136,33 +148,6 @@ def build_protect_payload(
         "receipt": receipt.to_dict(),
         "matched_advisories": list(verdict.matched_advisories),
     }
-    if verdict.blocking:
-        store.add_receipt(receipt)
-        store.add_event(
-            f"install_time_{verdict.action}",
-            {
-                "artifact_id": request.targets[0].artifact_id,
-                "artifact_name": request.targets[0].artifact_name,
-                "executor": request.executor,
-                "install_kind": request.install_kind,
-                "action": verdict.action,
-                "risk_signals": list(verdict.risk_signals),
-            },
-            now,
-        )
-        return (payload, 2)
-    package_payload = build_package_protect_payload(
-        command=command,
-        store=store,
-        workspace_dir=workspace_dir,
-        dry_run=dry_run,
-        now=now,
-        config=config,
-        unsafe_raw_output=unsafe_raw_output,
-        timeout_seconds=_protect_command_timeout_seconds(),
-    )
-    if package_payload is not None:
-        return package_payload
     if verdict.blocking or dry_run:
         store.add_receipt(receipt)
         store.add_event(

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py

@@ -249,53 +249,6 @@ def evaluate_package_request_artifact(
         if bundle_response is not None
         else None
     )
-    if bundle_evaluation is not None and bundle_meta is not None and bundle_evaluation.decision != "monitor":
-        result = _finalize_evaluation(
-            bundle_evaluation, package_intent_hash=package_intent_hash, workspace_fingerprint=workspace_fingerprint
-        )
-        store.cache_supply_chain_evaluation(
-            workspace_id=workspace_id or bundle_payload["bundle"]["workspaceId"],
-            package_intent_hash=package_intent_hash,
-            feed_snapshot_hash=bundle_meta["feed_snapshot_hash"],
-            policy_hash=bundle_meta["policy_hash"],
-            scoring_version=bundle_meta["scoring_version"],
-            bundle_version=bundle_meta["bundle_version"],
-            decision=result.to_cache_dict(),
-            now=now_value,
-        )
-        _persist_evidence(store=store, artifact=artifact, evaluation=result, now=now_value)
-        if result.refresh_required:
-            store.add_event(
-                "supply_chain_bundle_refresh_requested",
-                {
-                    "artifact_id": artifact.artifact_id,
-                    "artifact_name": artifact.name,
-                    "reason": "feed_stale",
-                },
-                now_value,
-            )
-        return result
-    if (
-        bundle_evaluation is not None
-        and bundle_evaluation.refresh_required
-        and not bool(store.get_oauth_local_credential_health().get("configured"))
-    ):
-        fallback = _finalize_evaluation(
-            bundle_evaluation,
-            package_intent_hash=package_intent_hash,
-            workspace_fingerprint=workspace_fingerprint,
-        )
-        _persist_evidence(store=store, artifact=artifact, evaluation=fallback, now=now_value)
-        store.add_event(
-            "supply_chain_bundle_refresh_requested",
-            {
-                "artifact_id": artifact.artifact_id,
-                "artifact_name": artifact.name,
-                "reason": "feed_stale",
-            },
-            now_value,
-        )
-        return fallback
     if not _artifact_has_package_material(artifact, targets):
         no_material_result = _empty_package_material_result(
             artifact=artifact,
@@ -306,6 +259,9 @@ def evaluate_package_request_artifact(
         )
         _persist_evidence(store=store, artifact=artifact, evaluation=no_material_result, now=now_value)
         return no_material_result
+    bundle_defer_eligible = bundle_evaluation is not None and (
+        bundle_evaluation.decision == "block" or not bundle_evaluation.refresh_required
+    )
     cloud_result, cloud_fallback_reason = _evaluate_with_cloud(
         artifact=artifact,
         targets=targets,
@@ -313,8 +269,17 @@ def evaluate_package_request_artifact(
         workspace_id=workspace_id,
         workspace_fingerprint=workspace_fingerprint,
         bundle_meta=bundle_meta,
+        bundle_defer_eligible=bundle_defer_eligible,
         store=store,
     )
+    if cloud_result is not None and _cloud_result_should_defer_to_bundle(
+        cloud_result, bundle_evaluation=bundle_evaluation
+    ):
+        if cloud_fallback_reason is None and cloud_result.reasons:
+            first_reason = cloud_result.reasons[0]
+            if isinstance(first_reason, dict):
+                cloud_fallback_reason = dict(first_reason)
+        cloud_result = None
     if cloud_result is not None:
         upgraded = cloud_result
         if cloud_result.enforcement == "upgrade_required":
@@ -345,12 +310,52 @@ def evaluate_package_request_artifact(
                 )
         _persist_evidence(store=store, artifact=artifact, evaluation=upgraded, now=now_value)
         return upgraded
+    if (
+        bundle_evaluation is not None
+        and bundle_evaluation.refresh_required
+        and not bool(store.get_oauth_local_credential_health().get("configured"))
+    ):
+        fallback = _finalize_evaluation(
+            bundle_evaluation,
+            package_intent_hash=package_intent_hash,
+            workspace_fingerprint=workspace_fingerprint,
+        )
+        _persist_evidence(store=store, artifact=artifact, evaluation=fallback, now=now_value)
+        store.add_event(
+            "supply_chain_bundle_refresh_requested",
+            {
+                "artifact_id": artifact.artifact_id,
+                "artifact_name": artifact.name,
+                "reason": "feed_stale",
+            },
+            now_value,
+        )
+        return fallback
     if bundle_evaluation is not None:
         fallback = _finalize_evaluation(
             bundle_evaluation, package_intent_hash=package_intent_hash, workspace_fingerprint=workspace_fingerprint
         )
         if cloud_fallback_reason is not None:
             fallback = _with_additional_reason(fallback, cloud_fallback_reason)
+        if bundle_meta is not None and bundle_evaluation.decision != "monitor" and isinstance(bundle_payload, dict):
+            cache_workspace_id = workspace_id
+            if cache_workspace_id is None:
+                bundle_section = bundle_payload.get("bundle")
+                if isinstance(bundle_section, dict):
+                    bundle_workspace_id = bundle_section.get("workspaceId")
+                    if isinstance(bundle_workspace_id, str) and bundle_workspace_id:
+                        cache_workspace_id = bundle_workspace_id
+            if cache_workspace_id:
+                store.cache_supply_chain_evaluation(
+                    workspace_id=cache_workspace_id,
+                    package_intent_hash=package_intent_hash,
+                    feed_snapshot_hash=bundle_meta["feed_snapshot_hash"],
+                    policy_hash=bundle_meta["policy_hash"],
+                    scoring_version=bundle_meta["scoring_version"],
+                    bundle_version=bundle_meta["bundle_version"],
+                    decision=fallback.to_cache_dict(),
+                    now=now_value,
+                )
         _persist_evidence(store=store, artifact=artifact, evaluation=fallback, now=now_value)
         if fallback.refresh_required:
             store.add_event(
@@ -594,6 +599,7 @@ def _evaluate_with_cloud(
     workspace_id: str | None,
     workspace_fingerprint: str | None,
     bundle_meta: dict[str, str] | None,
+    bundle_defer_eligible: bool,
     store: GuardStore,
 ) -> tuple[PackageRequestEvaluation | None, dict[str, object] | None]:
     if workspace_id is None or workspace_fingerprint is None:
@@ -610,6 +616,13 @@ def _evaluate_with_cloud(
     try:
         auth_context = _resolve_guard_sync_auth_context(store)
     except GuardSyncAuthorizationExpiredError:
+        if bundle_meta is not None and bundle_defer_eligible and resolve_fail_closed_decision() != "block":
+            return None, _cloud_fallback_reason(
+                code="cloud_auth_error",
+                message=(
+                    "Guard cloud evaluation was not authorized, so Guard fell back to signed bundle intelligence."
+                ),
+            )
         return (
             _cloud_fail_closed_evaluation(
                 code="cloud_auth_error",
@@ -3567,6 +3580,26 @@ def _with_additional_reason(
     return replace(evaluation, reasons=updated_reasons, packages=tuple(updated_packages))
 
 
+def _cloud_result_should_defer_to_bundle(
+    evaluation: PackageRequestEvaluation,
+    *,
+    bundle_evaluation: _EvaluationDraft | None,
+) -> bool:
+    if bundle_evaluation is None:
+        return False
+    if not (bundle_evaluation.decision == "block" or not bundle_evaluation.refresh_required):
+        return False
+    reason_codes = {str(reason.get("code") or "") for reason in evaluation.reasons if isinstance(reason, dict)}
+    if evaluation.decision == "block" and evaluation.policy_action == "block":
+        if "cloud_validation_error" in reason_codes and "cloud_timeout" not in reason_codes:
+            return False
+        return False
+    defer_codes = {"cloud_auth_error", "cloud_http_error", "cloud_timeout"}
+    if not any(code in defer_codes for code in reason_codes):
+        return False
+    return _decision_rank(bundle_evaluation.decision) > _decision_rank(evaluation.decision)
+
+
 def _cloud_fallback_reason(*, code: str, message: str) -> dict[str, object]:
     return {
         "code": code,

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.543"
+__version__ = "2.0.544"

plugin_scanner-2.0.544/tests/bundle_first_cloud.py

@@ -0,0 +1,12 @@
+"""Force bundle-first evaluation in integration tests that seed offline bundles."""
+
+from __future__ import annotations
+
+import pytest
+
+from tests.test_guard_supply_chain_evaluator import _force_cloud_fallback
+
+
+@pytest.fixture
+def bundle_first_cloud(monkeypatch: pytest.MonkeyPatch) -> None:
+    _force_cloud_fallback(monkeypatch)

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/tests/test_guard_cli.py

@@ -726,7 +726,7 @@ class TestGuardCli:
             main([])
 
         assert exc_info.value.code == 2
-        assert "Run `hol-guard --help` to inspect available Guard commands." in capsys.readouterr().err
+        assert "Run `hol-guard guard --help` to inspect available Guard commands." in capsys.readouterr().err
 
     def test_guard_detect_reports_supported_harnesses(self, tmp_path, capsys):
         home_dir = tmp_path / "home"

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/tests/test_guard_local_supply_chain_phase15.py

@@ -23,6 +23,9 @@ from codex_plugin_scanner.guard.config import load_guard_config
 from codex_plugin_scanner.guard.protect import build_protect_payload
 from codex_plugin_scanner.guard.store import GuardStore
 
+pytest_plugins = ["tests.bundle_first_cloud"]
+pytestmark = pytest.mark.usefixtures("bundle_first_cloud")
+
 WORKSPACE_ID = "workspace-alpha"
 
 

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/tests/test_guard_mcp_package_proxy_phase14.py

@@ -27,6 +27,9 @@ from codex_plugin_scanner.guard.runtime.package_intent import (
 )
 from codex_plugin_scanner.guard.store import GuardStore
 
+pytest_plugins = ["tests.bundle_first_cloud"]
+pytestmark = pytest.mark.usefixtures("bundle_first_cloud")
+
 WORKSPACE_ID = "workspace-alpha"
 
 

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/tests/test_guard_package_hook.py

@@ -18,6 +18,9 @@ from codex_plugin_scanner.guard.cli import commands as guard_commands_module
 from codex_plugin_scanner.guard.runtime.signals import RiskSignalV2
 from codex_plugin_scanner.guard.store import GuardStore
 
+pytest_plugins = ["tests.bundle_first_cloud"]
+pytestmark = pytest.mark.usefixtures("bundle_first_cloud")
+
 WORKSPACE_ID = "workspace-alpha"
 
 

{plugin_scanner-2.0.543 → plugin_scanner-2.0.544}/tests/test_guard_package_hook_phase14.py

@@ -22,6 +22,9 @@ from codex_plugin_scanner.guard.approvals import apply_approval_resolution
 from codex_plugin_scanner.guard.cli import commands as guard_commands_module
 from codex_plugin_scanner.guard.store import GuardStore
 
+pytest_plugins = ["tests.bundle_first_cloud"]
+pytestmark = pytest.mark.usefixtures("bundle_first_cloud")
+
 WORKSPACE_ID = "workspace-alpha"
 
 
@@ -445,4 +448,4 @@ def test_phase14_claude_daemon_hook_bridge_queues_package_install_without_node(t
     assert "minimist@1.2.8" in result.stdout
     assert payload["hookSpecificOutput"]["hookEventName"] == "PreToolUse"
     assert payload["hookSpecificOutput"]["permissionDecision"] == "ask"
-    assert "policy-review-1" in payload["hookSpecificOutput"]["permissionDecisionReason"]
+    assert "minimist@1.2.8" in payload["hookSpecificOutput"]["permissionDecisionReason"]