plugin-scanner 2.0.547__tar.gz → 2.0.549__tar.gz

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.547
+Version: 2.0.549
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/dashboard/src/audit-workspace.tsx

@@ -45,6 +45,43 @@ export type AuditRemediationRequest = {
   label: string;
 };
 
+function isSupplyChainAuditEvidence(value: unknown): value is Record<string, unknown> & { operation: "audit" } {
+  return typeof value === "object" && value !== null && (value as Record<string, unknown>).operation === "audit";
+}
+
+function auditSeverityForDecision(decision: string, blockedCount: number): AuditSeverity {
+  if (decision === "block" || blockedCount > 0) {
+    return "high";
+  }
+  if (decision === "ask") {
+    return "medium";
+  }
+  if (decision === "warn") {
+    return "medium";
+  }
+  return "info";
+}
+
+function workspaceAuditTitle(decision: string): string {
+  if (decision === "block") {
+    return "Workspace audit found blocked packages";
+  }
+  if (decision === "ask") {
+    return "Workspace audit needs review";
+  }
+  return "Workspace audit completed";
+}
+
+function workspaceAuditRemediation(decision: string, blockedCount: number): string {
+  if (blockedCount > 0) {
+    return "Review blocked packages in Evidence and update lockfiles before retrying installs.";
+  }
+  if (decision === "ask") {
+    return "Review flagged packages and repair lockfiles before continuing.";
+  }
+  return "Re-run workspace audit after dependency changes.";
+}
+
 export type AuditFilterState = {
   severityFilter: AuditSeverity | "all";
   harnessFilter: string;
@@ -114,6 +151,50 @@ export function deriveFrontendAuditResults(
     });
   }
 
+  for (const receipt of receipts) {
+    if (receipt.harness !== "package-firewall") {
+      continue;
+    }
+    const evidence = receipt.scanner_evidence?.find(isSupplyChainAuditEvidence);
+    if (evidence === undefined) {
+      continue;
+    }
+    const decision =
+      typeof evidence.audit_decision === "string" ? evidence.audit_decision : "monitor";
+    const blockedCount =
+      typeof evidence.blocked_package_count === "number" ? evidence.blocked_package_count : 0;
+    const totalPackages =
+      typeof evidence.total_packages === "number" ? evidence.total_packages : blockedCount;
+    const manifestPaths = Array.isArray(evidence.manifest_paths)
+      ? evidence.manifest_paths.filter((entry): entry is string => typeof entry === "string")
+      : [];
+    const lockfilePaths = Array.isArray(evidence.lockfile_paths)
+      ? evidence.lockfile_paths.filter((entry): entry is string => typeof entry === "string")
+      : [];
+    const inventorySummary = [
+      manifestPaths.length > 0 ? `${manifestPaths.length} manifest(s)` : null,
+      lockfilePaths.length > 0 ? `${lockfilePaths.length} lockfile(s)` : null,
+      `${totalPackages} package(s)`,
+    ]
+      .filter((entry): entry is string => entry !== null)
+      .join(", ");
+    results.push({
+      id: `workspace-audit-${receipt.receipt_id}`,
+      severity: auditSeverityForDecision(decision, blockedCount),
+      title: workspaceAuditTitle(decision),
+      detail:
+        receipt.capabilities_summary ||
+        `Guard scanned ${inventorySummary} and returned a ${decision} decision.`,
+      harness: "package-firewall",
+      workspace: receipt.source_scope,
+      timestamp: receipt.timestamp,
+      remediation: workspaceAuditRemediation(decision, blockedCount),
+      remediationAction: null,
+      resolved: decision === "monitor" && blockedCount === 0,
+      evidenceHref: `/evidence?harness=package-firewall&search=${encodeURIComponent(receipt.receipt_id)}`,
+    });
+  }
+
   if (snapshot.runtime_state === null) {
     results.push({
       id: "daemon-offline",

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/dashboard/src/scrg159-170.test.ts

@@ -253,6 +253,33 @@ const blockedItem = auditWithBlocked.find((r) => r.id === `blocked-${blockedRece
 assert(blockedItem !== undefined, "SCRG162-G: blocked receipt should appear in audit");
 assert(blockedItem!.severity === "medium", "SCRG162-H: blocked receipt should be medium");
 
+const workspaceAuditReceipt = {
+  ...makeReceipt("block", receiptNow),
+  harness: "package-firewall",
+  artifact_name: "Workspace supply-chain audit",
+  capabilities_summary: "Workspace audit completed with block decision across 3 packages.",
+  scanner_evidence: [
+    {
+      operation: "audit",
+      audit_decision: "block",
+      blocked_package_count: 1,
+      manifest_paths: ["package.json"],
+      lockfile_paths: ["package-lock.json"],
+      total_packages: 3,
+    },
+  ],
+};
+const auditWithWorkspaceScan = deriveFrontendAuditResults([workspaceAuditReceipt], baseSnapshot);
+const workspaceAuditItem = auditWithWorkspaceScan.find(
+  (result) => result.id === `workspace-audit-${workspaceAuditReceipt.receipt_id}`,
+);
+assert(workspaceAuditItem !== undefined, "SCRG162-I: workspace audit receipt should render in audit tab");
+assert(workspaceAuditItem!.severity === "high", "SCRG162-J: blocked workspace audit should be high severity");
+assert(
+  workspaceAuditItem!.detail.includes("Workspace audit completed"),
+  "SCRG162-K: workspace audit detail should summarize the receipt",
+);
+
 const policies = [makePolicy("claude"), makePolicy("claude"), makePolicy("cursor")];
 const grouped = groupPoliciesByHarness(policies);
 assert(grouped.get("claude")?.length === 2, "SCRG164-A: 2 claude policies");

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.547"
+version = "2.0.549"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.547"
+version = "2.0.549"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.549/src/codex_plugin_scanner/guard/cli/dashboard_sync.py

@@ -0,0 +1,294 @@
+"""Dashboard asset sync helpers with trusted-source verification."""
+
+from __future__ import annotations
+
+import importlib.util
+import re
+import subprocess
+from pathlib import Path
+from urllib.parse import urlparse
+
+from ..redaction import redact_sensitive_text
+
+_TRUSTED_REPO_SLUG = "hashgraph-online/hol-guard"
+_GIT_HOOKS_DISABLED = ("/dev/null",)
+_GIT_TIMEOUT_SECONDS = 10.0
+_RUN_PROCESS = subprocess.run
+
+
+def sync_dashboard_assets() -> dict[str, object] | None:
+    """Copy committed dashboard assets from a verified hol-guard checkout."""
+    spec = importlib.util.find_spec("codex_plugin_scanner.guard.daemon.server")
+    if spec is None or spec.origin is None:
+        return None
+    installed_static = Path(spec.origin).with_name("static")
+    try:
+        if not installed_static.is_dir():
+            return None
+    except OSError:
+        return None
+
+    try:
+        source_checkout = find_source_checkout()
+    except OSError:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+    if source_checkout is None:
+        return {"source_checkout_found": False, "installed_static": str(installed_static)}
+
+    source_static = _resolve_source_static(source_checkout)
+    if source_static is None:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "dashboard_dir_found": False,
+            "notes": [
+                "Source checkout found but no built dashboard assets. Run `npm run build` in the dashboard directory.",
+            ],
+        }
+
+    static_prefix = source_static.relative_to(source_checkout).as_posix()
+    installed_index = installed_static / "index.html"
+    needs_copy = True
+    try:
+        if installed_index.is_file():
+            committed_index = _read_committed_file(source_checkout, f"{static_prefix}/index.html")
+            if committed_index is not None:
+                needs_copy = committed_index != installed_index.read_bytes()
+    except OSError:
+        needs_copy = True
+
+    if not needs_copy:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "reason": "installed assets are already up to date",
+        }
+
+    try:
+        copied_count = _export_committed_static_files(
+            source_checkout=source_checkout,
+            static_prefix=static_prefix,
+            installed_static=installed_static,
+        )
+    except (OSError, ValueError) as error:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "copied": False,
+            "error": redact_sensitive_text(str(error)),
+            "notes": ["Dashboard asset sync failed. The daemon may serve stale UI."],
+        }
+    if copied_count == 0:
+        return {
+            "source_checkout_found": True,
+            "source_checkout": str(source_checkout),
+            "dashboard_dir_found": False,
+            "notes": [
+                "Trusted checkout found but no committed dashboard assets at HEAD. "
+                "Commit a dashboard build before syncing.",
+            ],
+        }
+
+    return {
+        "source_checkout_found": True,
+        "source_checkout": str(source_checkout),
+        "installed_static": str(installed_static),
+        "copied": True,
+        "copied_files": copied_count,
+        "notes": [f"Synced {copied_count} committed dashboard asset files to the installed package."],
+    }
+
+
+def find_source_checkout() -> Path | None:
+    """Return a verified local hol-guard checkout near the current working directory."""
+    try:
+        cwd = Path.cwd().resolve()
+    except OSError:
+        return None
+    candidates = [cwd, *cwd.parents]
+    for candidate in candidates:
+        checkout = verify_source_checkout(candidate)
+        if checkout is not None:
+            return checkout
+    for candidate in candidates:
+        try:
+            for sub in candidate.iterdir():
+                try:
+                    checkout = verify_source_checkout(sub)
+                    if checkout is not None:
+                        return checkout
+                except OSError:
+                    continue
+        except OSError:
+            continue
+    return None
+
+
+def verify_source_checkout(path: Path) -> Path | None:
+    """Accept only the canonical hol-guard GitHub origin and source tree markers."""
+    try:
+        if not (path / "dashboard" / "package.json").is_file():
+            return None
+        if not (path / "src" / "codex_plugin_scanner").is_dir():
+            return None
+        if not (path / ".git").exists():
+            return None
+    except OSError:
+        return None
+
+    try:
+        config_path = path / ".git" / "config"
+        if not config_path.is_file():
+            return None
+        remote_text = config_path.read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return None
+
+    origin_urls = _origin_urls_from_git_config(remote_text)
+    if not any(_is_trusted_hol_guard_origin(url) for url in origin_urls):
+        return None
+    if not _git_head_exists(path):
+        return None
+    return path
+
+
+def _resolve_source_static(checkout: Path) -> Path | None:
+    dashboard_dir = checkout / "dashboard"
+    source_static = dashboard_dir / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+    if source_static.is_dir():
+        return source_static
+    fallback = checkout / "src" / "codex_plugin_scanner" / "guard" / "daemon" / "static"
+    if fallback.is_dir():
+        return fallback
+    return None
+
+
+def _origin_urls_from_git_config(config_text: str) -> list[str]:
+    urls: list[str] = []
+    in_origin = False
+    for line in config_text.splitlines():
+        stripped = line.strip()
+        if stripped.startswith("[") and stripped.endswith("]"):
+            section_match = re.fullmatch(r'\[remote "(.+)"\]', stripped)
+            in_origin = section_match is not None and section_match.group(1) == "origin"
+            continue
+        if in_origin and stripped.startswith("url ="):
+            urls.append(stripped.split("=", 1)[1].strip())
+    return urls
+
+
+def _normalize_github_repo_slug(url: str) -> str | None:
+    candidate = url.strip()
+    if candidate == "":
+        return None
+    if candidate.startswith("git@"):
+        host_and_path = candidate[4:]
+        if ":" not in host_and_path:
+            return None
+        host, repo_path = host_and_path.split(":", 1)
+        if host != "github.com":
+            return None
+        return repo_path.strip("/").removesuffix(".git")
+    parsed = urlparse(candidate)
+    if parsed.scheme not in {"http", "https", "ssh"}:
+        return None
+    host = parsed.hostname
+    if host is None:
+        return None
+    if host != "github.com":
+        return None
+    return parsed.path.strip("/").removesuffix(".git")
+
+
+def _is_trusted_hol_guard_origin(url: str) -> bool:
+    slug = _normalize_github_repo_slug(url)
+    return slug == _TRUSTED_REPO_SLUG
+
+
+def _git_head_exists(checkout: Path) -> bool:
+    result = _git_run(checkout, "rev-parse", "--verify", "HEAD")
+    return result is not None and result.returncode == 0
+
+
+def _git_run(
+    checkout: Path,
+    *args: str,
+    text: bool = True,
+) -> subprocess.CompletedProcess[str] | subprocess.CompletedProcess[bytes] | None:
+    try:
+        return _RUN_PROCESS(
+            [
+                "git",
+                "-c",
+                f"core.hooksPath={_GIT_HOOKS_DISABLED[0]}",
+                "-C",
+                str(checkout),
+                *args,
+            ],
+            capture_output=True,
+            check=False,
+            text=text,
+            timeout=_GIT_TIMEOUT_SECONDS,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+
+
+def _list_committed_static_files(checkout: Path, static_prefix: str) -> list[str]:
+    result = _git_run(checkout, "ls-tree", "-r", "--name-only", "HEAD", "--", static_prefix)
+    if result is None or result.returncode != 0:
+        return []
+    files: list[str] = []
+    prefix = f"{static_prefix.rstrip('/')}/"
+    for line in result.stdout.splitlines():
+        relative = line.strip()
+        if relative == "" or relative.endswith("/") or not relative.startswith(prefix):
+            continue
+        files.append(relative)
+    return files
+
+
+def _read_committed_file(checkout: Path, relative_path: str) -> bytes | None:
+    result = _git_run(checkout, "show", f"HEAD:{relative_path}", text=False)
+    if result is None or result.returncode != 0:
+        return None
+    stdout = result.stdout
+    if not isinstance(stdout, bytes):
+        return None
+    return stdout
+
+
+def _relative_static_path(relative_path: str, static_prefix: str) -> Path | None:
+    normalized_prefix = static_prefix.rstrip("/")
+    if not relative_path.startswith(f"{normalized_prefix}/"):
+        return None
+    return Path(relative_path.removeprefix(f"{normalized_prefix}/"))
+
+
+def _export_committed_static_files(
+    *,
+    source_checkout: Path,
+    static_prefix: str,
+    installed_static: Path,
+) -> int:
+    copied_count = 0
+    for relative_path in _list_committed_static_files(source_checkout, static_prefix):
+        payload = _read_committed_file(source_checkout, relative_path)
+        if payload is None:
+            continue
+        relative_to_static = _relative_static_path(relative_path, static_prefix)
+        if relative_to_static is None:
+            continue
+        dest = installed_static / relative_to_static
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_bytes(payload)
+        copied_count += 1
+    return copied_count
+
+
+__all__ = [
+    "find_source_checkout",
+    "sync_dashboard_assets",
+    "verify_source_checkout",
+]

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -24,7 +24,7 @@ from ..adapters.base import HarnessContext
 from ..adapters.codex import CodexHarnessAdapter, codex_native_hook_state
 from ..redaction import redact_sensitive_text
 from ..store import GuardStore
-from .dashboard_sync import sync_dashboard_assets
+from .dashboard_sync import sync_dashboard_assets as _sync_dashboard_assets
 from .install_commands import apply_managed_install
 
 _ALREADY_CURRENT_HINTS = (
@@ -159,7 +159,7 @@ def run_guard_update(
             payload["managed_install"] = repaired_installs[0]
     # Sync dashboard static assets after package update so the daemon serves fresh UI.
     if not dry_run and payload.get("status") in {"updated", "current"}:
-        dashboard_sync = sync_dashboard_assets()
+        dashboard_sync = _sync_dashboard_assets()
         if dashboard_sync:
             payload["dashboard_sync"] = dashboard_sync
             sync_notes = dashboard_sync.get("notes")

{plugin_scanner-2.0.547 → plugin_scanner-2.0.549}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -24,7 +24,6 @@ from pathlib import Path
 from typing import Any, cast
 from urllib.parse import parse_qs, parse_qsl, unquote, urlencode, urlparse, urlunparse
 
-from ...path_support import resolve_path_within_allowed_roots
 from ...version import __version__
 from ..adapters import get_adapter
 from ..adapters.base import HarnessContext
@@ -91,8 +90,10 @@ from ..desktop_notifications import (
 from ..insights_share import publish_insights_share
 from ..local_dashboard_session import LOCAL_DASHBOARD_SESSION_AUDIENCE, build_local_dashboard_session_token
 from ..local_supply_chain import (
+    audit_receipt_metadata,
     build_workspace_audit_payload,
     resolve_package_firewall_entitlement_with_refresh,
+    resolve_supply_chain_audit_workspace_dir,
 )
 from ..models import DECISION_SCOPE_VALUES, GUARD_ACTION_VALUES, PolicyDecision
 from ..package_firewall_entitlement import (
@@ -1950,6 +1951,9 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         except ValueError as error:
             self._write_json({"error": str(error), "operation": operation}, status=400)
             return
+        receipt_overrides: dict[str, object] = {}
+        if operation == "audit":
+            receipt_overrides = audit_receipt_metadata(result)
         receipt = self._record_headless_receipt(
             harness="package-firewall",
             operation=operation,
@@ -1957,16 +1961,27 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             result=result,
             workspace_id=self._optional_string(payload.get("workspace_id"))
             or self.server.store.get_cloud_workspace_id(),  # type: ignore[attr-defined]
+            policy_decision=self._optional_string(receipt_overrides.get("policy_decision")),
+            capabilities_summary=self._optional_string(receipt_overrides.get("capabilities_summary")),
+            artifact_name=self._optional_string(receipt_overrides.get("artifact_name")),
+            scanner_evidence_extra=(
+                receipt_overrides.get("scanner_evidence")
+                if isinstance(receipt_overrides.get("scanner_evidence"), dict)
+                else None
+            ),
         )
-        self._write_json(
-            {
-                "entitlement": entitlement,
-                "operation": operation,
-                "receipt": receipt,
-                "result": result,
-                "status": "completed",
-            }
-        )
+        response_payload: dict[str, object] = {
+            "entitlement": entitlement,
+            "operation": operation,
+            "receipt": receipt,
+            "result": result,
+            "status": "completed",
+        }
+        if operation == "audit":
+            cloud_sync = _queue_headless_cloud_sync(store=self.server.store)  # type: ignore[attr-defined]
+            receipt["cloud_sync"] = cloud_sync
+            response_payload["cloud_sync"] = cloud_sync
+        self._write_json(response_payload)
 
     def _run_supply_chain_package_action(
         self,
@@ -2007,22 +2022,20 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         raise ValueError("unsupported_supply_chain_operation")
 
     @staticmethod
-    def _resolve_supply_chain_workspace_dir(value: object) -> Path | None:
-        if not isinstance(value, str):
-            return None
+    def _resolve_supply_chain_workspace_dir(payload: dict[str, object]) -> Path | None:
         allowed_roots = (
             Path.home().resolve(),
             Path.cwd().resolve(),
             Path(tempfile.gettempdir()).resolve(),
         )
-        return resolve_path_within_allowed_roots(
-            value,
-            allowed_roots,
-            require_exists=True,
+        return resolve_supply_chain_audit_workspace_dir(
+            workspace_dir_value=payload.get("workspace_dir"),
+            workspace_value=payload.get("workspace"),
+            allowed_roots=allowed_roots,
         )
 
     def _supply_chain_context(self, payload: dict[str, object]) -> HarnessContext:
-        workspace_dir = self._resolve_supply_chain_workspace_dir(payload.get("workspace_dir"))
+        workspace_dir = self._resolve_supply_chain_workspace_dir(payload)
         return HarnessContext(
             home_dir=Path.home().resolve(),
             workspace_dir=workspace_dir,
@@ -2259,6 +2272,10 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         result: dict[str, object],
         workspace_id: str | None,
         cloud_sync: dict[str, object] | None = None,
+        policy_decision: str | None = None,
+        capabilities_summary: str | None = None,
+        artifact_name: str | None = None,
+        scanner_evidence_extra: dict[str, object] | None = None,
     ) -> dict[str, object]:
         cursor_receipt_context = self._cursor_receipt_context(
             harness=harness,
@@ -2281,19 +2298,22 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         artifact_hash = stable_digest_hex(material.encode("utf-8"))
         changed_capabilities = [] if operation in {"status", "scan"} else [operation]
         artifact_id = f"headless:{harness}:{operation}"
-        artifact_name = f"Headless {operation}"
-        capabilities_summary = f"Guard local daemon completed headless {operation}."
+        resolved_artifact_name = artifact_name or f"Headless {operation}"
+        resolved_capabilities_summary = capabilities_summary or f"Guard local daemon completed headless {operation}."
         source_scope = "local-daemon"
+        resolved_policy_decision = policy_decision or "allow"
         scanner_evidence: dict[str, object] = {
             "operation": operation,
             "location_id": location_id,
             "workspace_id": workspace_id,
             "status": "completed",
         }
+        if scanner_evidence_extra is not None:
+            scanner_evidence.update(scanner_evidence_extra)
         if cursor_receipt_context is not None:
             artifact_id = str(cursor_receipt_context["action_scope"])
-            artifact_name = str(cursor_receipt_context["artifact_name"])
-            capabilities_summary = str(cursor_receipt_context["capabilities_summary"])
+            resolved_artifact_name = str(cursor_receipt_context["artifact_name"])
+            resolved_capabilities_summary = str(cursor_receipt_context["capabilities_summary"])
             source_scope = str(cursor_receipt_context["source_scope"])
             changed_capabilities = [str(cursor_receipt_context["changed_capability"])]
             scanner_evidence.update(cursor_receipt_context["scanner_evidence"])
@@ -2301,11 +2321,11 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             harness=harness,
             artifact_id=artifact_id,
             artifact_hash=artifact_hash,
-            policy_decision="allow",
-            capabilities_summary=capabilities_summary,
+            policy_decision=resolved_policy_decision,
+            capabilities_summary=resolved_capabilities_summary,
             changed_capabilities=changed_capabilities,
             provenance_summary="Guard Cloud local daemon API",
-            artifact_name=artifact_name,
+            artifact_name=resolved_artifact_name,
             source_scope=source_scope,
             scanner_evidence=(scanner_evidence,),
             approval_source="guard-cloud-headless",