plugin-scanner 2.0.552__py3-none-any.whl → 2.0.554__py3-none-any.whl

codex_plugin_scanner/guard/cli/dashboard_sync.py

@@ -235,6 +235,12 @@ def _git_run(
         return None
 
 
+def _is_safe_committed_tree_path(path: str) -> bool:
+    if path == "" or path.startswith(("/", "\\")) or "\\" in path or "\0" in path:
+        return False
+    return all(part not in {"", ".", ".."} for part in path.split("/"))
+
+
 def _list_committed_static_files(checkout: Path, static_prefix: str) -> list[str]:
     result = _git_run(checkout, "ls-tree", "-r", "--name-only", "HEAD", "--", static_prefix)
     if result is None or result.returncode != 0:
@@ -243,13 +249,20 @@ def _list_committed_static_files(checkout: Path, static_prefix: str) -> list[str
     prefix = f"{static_prefix.rstrip('/')}/"
     for line in result.stdout.splitlines():
         relative = line.strip()
-        if relative == "" or relative.endswith("/") or not relative.startswith(prefix):
+        if (
+            relative == ""
+            or relative.endswith("/")
+            or not relative.startswith(prefix)
+            or not _is_safe_committed_tree_path(relative)
+        ):
             continue
         files.append(relative)
     return files
 
 
 def _read_committed_file(checkout: Path, relative_path: str) -> bytes | None:
+    if not _is_safe_committed_tree_path(relative_path):
+        return None
     result = _git_run(checkout, "show", f"HEAD:{relative_path}", text=False)
     if result is None or result.returncode != 0:
         return None
@@ -263,7 +276,20 @@ def _relative_static_path(relative_path: str, static_prefix: str) -> Path | None
     normalized_prefix = static_prefix.rstrip("/")
     if not relative_path.startswith(f"{normalized_prefix}/"):
         return None
-    return Path(relative_path.removeprefix(f"{normalized_prefix}/"))
+    suffix = relative_path.removeprefix(f"{normalized_prefix}/")
+    if not _is_safe_committed_tree_path(suffix):
+        return None
+    return Path(suffix)
+
+
+def _resolve_static_export_path(installed_static: Path, relative_to_static: Path) -> Path | None:
+    base = installed_static.resolve()
+    destination = (base / relative_to_static).resolve()
+    try:
+        destination.relative_to(base)
+    except ValueError:
+        return None
+    return destination
 
 
 def _export_committed_static_files(
@@ -280,7 +306,9 @@ def _export_committed_static_files(
         relative_to_static = _relative_static_path(relative_path, static_prefix)
         if relative_to_static is None:
             continue
-        dest = installed_static / relative_to_static
+        dest = _resolve_static_export_path(installed_static, relative_to_static)
+        if dest is None:
+            continue
         dest.parent.mkdir(parents=True, exist_ok=True)
         dest.write_bytes(payload)
         copied_count += 1

codex_plugin_scanner/guard/daemon/server.py

@@ -103,6 +103,7 @@ from ..package_firewall_entitlement import (
     package_firewall_block_details,
     package_firewall_operation_allowed,
 )
+from ..package_shim_status import record_package_shim_audit_result
 from ..receipts.manager import build_receipt
 from ..runtime.runner import (
     GuardSyncAuthorizationExpiredError,
@@ -2027,6 +2028,8 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 workspace_dir=context.workspace_dir,
             )
             audit_payload["exit_code"] = exit_code
+            if exit_code == 0:
+                record_package_shim_audit_result(context, audited_at=now)
             return audit_payload
         if operation == "sync":
             return sync_supply_chain_bundle(self.server.store)  # type: ignore[attr-defined]

codex_plugin_scanner/guard/package_shim_status.py

@@ -0,0 +1,61 @@
+"""Package shim status enrichment and audit proof persistence."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from .adapters.base import HarnessContext
+
+
+def enrich_package_shim_status_payload(
+    status: dict[str, object],
+    manifest: dict[str, object],
+) -> dict[str, object]:
+    bypasses = status.get("bypasses", [])
+    path_broken_managers = sorted(
+        {
+            str(entry["manager"])
+            for entry in bypasses
+            if isinstance(entry, dict) and isinstance(entry.get("manager"), str)
+        }
+    )
+    last_test_at = status.get("last_test_at", {})
+    tested_managers = (
+        sorted(manager for manager in last_test_at if isinstance(manager, str))
+        if isinstance(last_test_at, dict)
+        else []
+    )
+    last_audit_proof_at = manifest.get("last_audit_at")
+    normalized_last_audit = last_audit_proof_at if isinstance(last_audit_proof_at, str) else None
+    normalized_last_tests = last_test_at if isinstance(last_test_at, dict) else {}
+
+    enriched = dict(status)
+    enriched["path_broken_managers"] = path_broken_managers
+    enriched["tested_managers"] = tested_managers
+    enriched["pathBrokenManagers"] = path_broken_managers
+    enriched["testedManagers"] = tested_managers
+    enriched["last_intercept_proof_at"] = normalized_last_tests
+    enriched["lastInterceptProofAt"] = normalized_last_tests
+    enriched["detectedManagers"] = list(status.get("detected_managers", []))
+    enriched["protectedManagers"] = list(status.get("protected_managers", []))
+    enriched["installedManagers"] = list(status.get("installed_managers", []))
+    enriched["activeManagers"] = list(status.get("active_managers", []))
+    enriched["missingManagers"] = list(status.get("missing_managers", []))
+    enriched["undetectedManagers"] = list(status.get("undetected_managers", []))
+    enriched["last_audit_proof_at"] = normalized_last_audit
+    enriched["lastAuditProofAt"] = normalized_last_audit
+    return enriched
+
+
+def record_package_shim_audit_result(
+    context: HarnessContext,
+    *,
+    audited_at: str | None = None,
+) -> None:
+    from .shims import _load_package_shim_manifest, _write_package_shim_manifest
+
+    manifest = _load_package_shim_manifest(context)
+    manifest["last_audit_at"] = audited_at if audited_at is not None else datetime.now(timezone.utc).isoformat()
+    _write_package_shim_manifest(context, manifest)

codex_plugin_scanner/guard/shims.py

@@ -13,6 +13,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING
 
 from .launcher import merge_guard_launcher_env
+from .package_shim_status import enrich_package_shim_status_payload
 from .shim_probe import (
     SHIM_PROBE_ENV_VALUE,
     SHIM_PROBE_ENV_VAR,
@@ -448,27 +449,30 @@ def package_shim_status(context: HarnessContext) -> dict[str, object]:
         path_contains_shim_dir=path_contains_shim_dir,
         shell_profile_configured=bool(profile_status["shell_profile_configured"]),
     )
-    return {
-        "active_managers": active_managers,
-        "detected_managers": detected_managers,
-        "installed_managers": installed_managers,
-        "last_test_at": normalized_last_tests,
-        "protected_managers": protected_managers,
-        "path_active": bool(installed_managers) and len(protected_managers) == len(installed_managers),
-        "path_contains_shim_dir": path_contains_shim_dir,
-        "path_status": activation_path_status,
-        "bypasses": bypasses,
-        "manager_details": manager_details,
-        "manifest_path": str(_package_shim_manifest_path(context)),
-        "missing_managers": missing_managers,
-        "restart_shell_required": activation_path_status == "restart_required",
-        "shell_profile_configured": bool(profile_status["shell_profile_configured"]),
-        "shell_profile_path": profile_status["shell_profile_path"],
-        "shell_hints": _path_export_hints(shim_dir),
-        "shim_dir": str(shim_dir),
-        "supported_managers": list(package_shim_supported_managers()),
-        "undetected_managers": undetected_managers,
-    }
+    return enrich_package_shim_status_payload(
+        {
+            "active_managers": active_managers,
+            "detected_managers": detected_managers,
+            "installed_managers": installed_managers,
+            "last_test_at": normalized_last_tests,
+            "protected_managers": protected_managers,
+            "path_active": bool(installed_managers) and len(protected_managers) == len(installed_managers),
+            "path_contains_shim_dir": path_contains_shim_dir,
+            "path_status": activation_path_status,
+            "bypasses": bypasses,
+            "manager_details": manager_details,
+            "manifest_path": str(_package_shim_manifest_path(context)),
+            "missing_managers": missing_managers,
+            "restart_shell_required": activation_path_status == "restart_required",
+            "shell_profile_configured": bool(profile_status["shell_profile_configured"]),
+            "shell_profile_path": profile_status["shell_profile_path"],
+            "shell_hints": _path_export_hints(shim_dir),
+            "shim_dir": str(shim_dir),
+            "supported_managers": list(package_shim_supported_managers()),
+            "undetected_managers": undetected_managers,
+        },
+        manifest,
+    )
 
 
 def package_shim_cloud_coverage(

codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.552"
+__version__ = "2.0.554"

{plugin_scanner-2.0.552.dist-info → plugin_scanner-2.0.554.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.552
+Version: 2.0.554
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.552.dist-info → plugin_scanner-2.0.554.dist-info}/RECORD

@@ -25,7 +25,7 @@ codex_plugin_scanner/trust_scoring.py,sha256=t_Lw13HZ766UCJzTtNNwllZK_k2ks_x-8St
 codex_plugin_scanner/trust_skill_scoring.py,sha256=xbXZCyDlHIWL91eH65Fq97lLQrZo94HvouKlTWtx8r8,11872
 codex_plugin_scanner/trust_specs.py,sha256=edZ8UvWB4Lqotz0v5dhBO3LFePGv43eLK4tqSmg4DQU,9222
 codex_plugin_scanner/verification.py,sha256=ZqDw9-JFVgUTOplVgXjYMHQjSvsZgwJu60nCndTTjdU,27697
-codex_plugin_scanner/version.py,sha256=QVX17ZpIvYj4eCY2heBI9cX8KY-gazCr46TFTxxYqyc,72
+codex_plugin_scanner/version.py,sha256=5HiQwN3TA5dvDGDAJwia8JTcvEtsNj3h5WLeeybvDso,72
 codex_plugin_scanner/checks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codex_plugin_scanner/checks/best_practices.py,sha256=aSSDWVGoGW7KT71GgWEJ7M8kzAWO77Vr4zeYLrXUhWA,7892
 codex_plugin_scanner/checks/claude.py,sha256=cMucH5pmKgQtBnDcycOzMMlKL-Q5HQemPqUmTLF0DzE,10189
@@ -75,6 +75,7 @@ codex_plugin_scanner/guard/mcp_tool_calls.py,sha256=Np5kvR-G4KIDqva2EZJf5tMvTne3
 codex_plugin_scanner/guard/models.py,sha256=5rNzFMbvtrMru9XfmKae4bt-eSQXfO_lYsaD_cg2NiE,7190
 codex_plugin_scanner/guard/package_firewall_action_rate_limit.py,sha256=X3vq2gUYV-5rhOzc6P4YCU0qTYTJ_odqTxyiLDsHDmA,1163
 codex_plugin_scanner/guard/package_firewall_entitlement.py,sha256=Sb7dkqFmuMnpvFKd9zFXQpctEVs7bkgLpLRI-xxrmn4,11896
+codex_plugin_scanner/guard/package_shim_status.py,sha256=pMUo90kHCYtScOKlklAwtiiXXXMF1E7xEMqiPD8kKfg,2471
 codex_plugin_scanner/guard/policy_bundle_parser.py,sha256=fHQGnGHOj0W3Iye4cV_6K4rIdErGYv-kPVM1nadBTlI,7889
 codex_plugin_scanner/guard/product_model.py,sha256=ku6Sa9y4G2wD0cWLgqbu2huhHYNBsQDq867tws1BtPY,14799
 codex_plugin_scanner/guard/protect.py,sha256=wx-OuBkvw5Ap3YO3LC6YiZ0538YjZrGP1r5t9SYfNhQ,34723
@@ -83,7 +84,7 @@ codex_plugin_scanner/guard/redaction.py,sha256=9y1pNnz858KWFop0nxXBFvsP5daQ-9yl4
 codex_plugin_scanner/guard/remote_pairing_constants.py,sha256=ffeZlOha06zBlmr_XSQff8j71u-r9n_EcApfkhSCP6E,163
 codex_plugin_scanner/guard/risk.py,sha256=GNQQ-WPcRLSBV_tZYTaGB1JtOK8CRobf6xD0gwdWzTU,18550
 codex_plugin_scanner/guard/shim_probe.py,sha256=uYdNWc6BymV7efLqsFWqq1Elc0QHs9mAwABZ7P08tUI,2532
-codex_plugin_scanner/guard/shims.py,sha256=ZXYY5pWog5RaaPriyaUlO-kG8L8lp7mw9RAWmEkRTio,37828
+codex_plugin_scanner/guard/shims.py,sha256=2Q6dD5K_IcGG4O6WP_R3dd09qipISsGGhTlGWYsI9Us,38045
 codex_plugin_scanner/guard/stable_digest.py,sha256=O4Ts-kGtetRtHZPgMAaFZ8VRC2_x-pSbhZh4X-oZmm4,569
 codex_plugin_scanner/guard/store.py,sha256=6VH_n7YuUUDmYGD-A1B0XSzQ3OKgNteNv6REr-scC-E,206032
 codex_plugin_scanner/guard/store_approvals.py,sha256=k3J6Y4seRgKw7hjXUptHRefiwjctXH1nesul5NkOh-0,38486
@@ -125,7 +126,7 @@ codex_plugin_scanner/guard/cli/bootstrap.py,sha256=M3XSSl6k5E6gb0pyHa55AuiC0b30v
 codex_plugin_scanner/guard/cli/commands.py,sha256=R95TJ0-dZd291fXubmjIvqXgV6X7Ge8-24qeU0LQ1mU,435167
 codex_plugin_scanner/guard/cli/connect_flow.py,sha256=_G8JltZxSLAhGTo-K2dZtZrpw3LLQSo5mUPuDiZgjI0,45647
 codex_plugin_scanner/guard/cli/cursor_actions.py,sha256=w0jkfq_fQoyPAI_IiYWKU4AwaAOMj2wz10m-nbkSnD4,6393
-codex_plugin_scanner/guard/cli/dashboard_sync.py,sha256=1NvcGumOIE4FAUPWyXsGp9lTscRt0bfEyG5dZiIdSQc,9768
+codex_plugin_scanner/guard/cli/dashboard_sync.py,sha256=o6vcn9WvNUSwjRtUNjmYnjd0gP2MiNy0hIVTL2U5ieE,10651
 codex_plugin_scanner/guard/cli/docs.py,sha256=oN_-tDLHr56-fLbAjw_zxF_RGBDc2tKHrFLKqJReB5w,4137
 codex_plugin_scanner/guard/cli/install_commands.py,sha256=wL__cnDt557D1UItUecJ7sKQqGKUSf9B70PXixsRd1w,17431
 codex_plugin_scanner/guard/cli/oauth_client.py,sha256=MO87ZwksEA2c_XyIreYwjm9IXvkq5K-H0xp4MQNNvMM,7135
@@ -143,7 +144,7 @@ codex_plugin_scanner/guard/daemon/client.py,sha256=S8d-rRhupMTEDJzMlnV0xdbLRaHQx
 codex_plugin_scanner/guard/daemon/dashboard_update.py,sha256=yr7ApIs4jm6rFICqVjprK-B83AGp-n05l_Murw3fzf4,6604
 codex_plugin_scanner/guard/daemon/dashboard_update_runner.py,sha256=ad6xCvCPlwn5gKzwyKo492s8_SJlJ6t8AUgQlVmvGdc,2168
 codex_plugin_scanner/guard/daemon/manager.py,sha256=PEd1mDNbEFt1L7EKoIunmpTIfpg2-nv-nVip28rpn8E,38382
-codex_plugin_scanner/guard/daemon/server.py,sha256=Z0Ay5u4EHTJ6S1jY3B_pPw1dWN5AFVgLxjOmnLspYmU,191998
+codex_plugin_scanner/guard/daemon/server.py,sha256=d1NCzbhQ1oCkT0BiaYtp3f701ZYzbCbscyfcU8uQ50Q,192170
 codex_plugin_scanner/guard/daemon/static/apple-touch-icon.png,sha256=thrVc0duH3ETg03qlRer9714JpRh0DGYqp2RpvVGTdc,12211
 codex_plugin_scanner/guard/daemon/static/favicon-16x16.png,sha256=jcclKW2ZXshOJUMLjY8RkvWtd7gy60dibk4gftGyY8c,519
 codex_plugin_scanner/guard/daemon/static/favicon-32x32.png,sha256=kFgVF3ZorfAwCCc5BlCL6GYaoPilCf3m5H4elkPUeso,1352
@@ -230,8 +231,8 @@ codex_plugin_scanner/integrations/cisco_skill_scanner.py,sha256=LKdGaikJKsn9DL6N
 codex_plugin_scanner/rules/__init__.py,sha256=bhAnNlVvEiAoksf_-Vd4f74JNz66pTINhUO2mMc8kvs,293
 codex_plugin_scanner/rules/registry.py,sha256=7BaRerM26teDUM0S48d3sPHbqzmq2JhuelC0_ni3364,4580
 codex_plugin_scanner/rules/specs.py,sha256=gpU0lijxqdSEZMMf28vciQxob-lvBEPcMQ4BG6N_r3I,650
-plugin_scanner-2.0.552.dist-info/METADATA,sha256=wT9mEHEN65gPXElHoSpHT-EkpsKRD7PnCuYE8CgnSwo,37810
-plugin_scanner-2.0.552.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-plugin_scanner-2.0.552.dist-info/entry_points.txt,sha256=SLGKi3GvvSsPwave-k2JQt2meG0pM7aaC6VlUy47Crg,122
-plugin_scanner-2.0.552.dist-info/licenses/LICENSE,sha256=M6h9Xc242NSFZx5h6wBOKJpEQkFl_Wmz03yNrZd0_3E,5688
-plugin_scanner-2.0.552.dist-info/RECORD,,
+plugin_scanner-2.0.554.dist-info/METADATA,sha256=RhQZ12914LFb23Zs2y0idbI45ooS91ET0I84yafpK-I,37810
+plugin_scanner-2.0.554.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+plugin_scanner-2.0.554.dist-info/entry_points.txt,sha256=SLGKi3GvvSsPwave-k2JQt2meG0pM7aaC6VlUy47Crg,122
+plugin_scanner-2.0.554.dist-info/licenses/LICENSE,sha256=M6h9Xc242NSFZx5h6wBOKJpEQkFl_Wmz03yNrZd0_3E,5688
+plugin_scanner-2.0.554.dist-info/RECORD,,