plugin-scanner 2.0.564__tar.gz → 2.0.565__tar.gz

{plugin_scanner-2.0.564 → plugin_scanner-2.0.565}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.564
+Version: 2.0.565
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.564 → plugin_scanner-2.0.565}/docs/guard/get-started.md

@@ -5,6 +5,12 @@ Install `plugin-scanner` separately when you want maintainer or CI checks for pl
 
 Use it when you want to protect a harness before local MCP servers, skills, hooks, or plugin surfaces run.
 
+Local Guard protects your machine without requiring sign-in. Guard Cloud is an optional
+paid service providing cloud history, visibility, sync, and management on top of that
+protection. See
+[Local Guard vs Guard Cloud](./local-vs-cloud.md) for the full subscription
+boundary.
+
 ## The everyday flow
 
 1. Start the guided first-run setup:

{plugin_scanner-2.0.564 → plugin_scanner-2.0.565}/docs/guard/harness-support.md

@@ -1,5 +1,9 @@
 # Harness Support Matrix
 
+Local harness protection works without signing in to Guard Cloud. Cloud adds synced
+history, visibility, and team controls around the same adapters. See
+[Local Guard vs Guard Cloud](./local-vs-cloud.md).
+
 Current Guard support in this repo:
 
 - `codex`

plugin_scanner-2.0.565/docs/guard/local-vs-cloud.md

@@ -0,0 +1,105 @@
+# Local Guard vs Guard Cloud
+
+Guard protects your machine first. Guard Cloud is an optional paid service
+providing cloud history, visibility, sync, and management around that protection.
+
+## Local Guard baseline
+
+Available without a Cloud subscription or sign-in:
+
+- **Launch interception and wrappers** — `hol-guard install` and `hol-guard run`
+  sit in front of supported AI harnesses before tools, MCP servers, or skills
+  execute.
+- **Local policy decisions** — home config, project overrides, saved allow/deny
+  rules, and built-in recommendations resolve on this machine.
+- **Local blocking and warnings** — Guard can stop or warn on supported risky
+  shell commands, file reads, MCP tool calls, skill loads, and prompt-sensitive
+  actions before side effects occur.
+- **Package-manager protection where supported** — supported managers (for
+  example npm and PyPI) can be intercepted locally through shims and runtime
+  evaluation. Unsupported or monitor-only managers stay advisory only.
+- **Local receipts and explain output** — `hol-guard receipts`, `hol-guard
+  explain`, and the local approval center record what Guard decided and why.
+- **Local approval and review paths** — inline harness approval, the local
+  approval center on `127.0.0.1`, and `hol-guard approvals` resolve decisions
+  without Cloud.
+- **Cloud-outage independence** — if Guard Cloud is unavailable, you are signed
+  out, or never connected, local interception, policy, blocking, receipts, and
+  approvals continue on the machine.
+
+Guard does not meter local safety features. You can detect harnesses, install
+launchers, diff changes, prompt for approval, and inspect receipts without
+signing in.
+
+Safe Decode runs locally too. It inspects encoded payload layers for review
+evidence, but never executes decoded payloads and only syncs redacted summaries
+when optional Cloud receipt sync is enabled.
+
+## Guard Cloud for individual developers
+
+Guard Cloud is a personal AI safety cockpit and memory layer. It does not gate
+baseline local protection.
+
+Paid Cloud value for a solo developer or vibe coder includes:
+
+- **Synced history** across sessions, devices, and hosted or local agents
+- **Searchable activity** — blocked actions, approvals, package installs,
+  MCP/Skill changes, and risky activity in one timeline
+- **Decision memory and policy suggestions** — safe repeated choices stop
+  becoming repeated interruptions
+- **MCP/Skill drift visibility over time** — changed schemas, commands,
+  transports, scopes, and dependencies stay visible after first trust
+- **Incident-style summaries** — what happened, why it mattered, and what to
+  do next without digging through raw logs
+- **Cloud Firewall UI** — package risk, feed freshness, remediation guidance,
+  and safer fix paths on top of local enforcement
+- **Exports and shareable records** — audit-ready evidence packages when you
+  need to show what Guard handled
+- **Digests and notifications** — calm routing for what needs attention
+
+Optional Cloud pairing commands:
+
+```bash
+hol-guard connect
+hol-guard connect status
+hol-guard connect repair
+hol-guard sync
+hol-guard supply-chain sync
+```
+
+`hol-guard connect` is the canonical way to pair a machine with Guard Cloud.
+`hol-guard connect --headless` uses OAuth Device Code for SSH/CI hosts.
+`hol-guard login` remains only as a redirecting compatibility alias. These
+commands add sync and visibility; they do not unlock core local protection.
+
+## Guard Cloud for teams
+
+Team plans add shared ownership, routing, RBAC, billing, and evidence exports
+on top of the individual Cloud value:
+
+- **Shared workspaces** with members, roles, service principals, and ownership
+- **Shared review workflow** with assignment, SLA, policy memory, cases, and
+  audit history
+- **Integrations** — Slack, GitHub, Jira, PagerDuty, email, and webhooks where
+  setup and delivery are available
+- **Team package firewall visibility** and exception governance
+- **Billing, plan limits, admin controls, exports, and enterprise materials**
+
+## Quick comparison
+
+| Capability | Local Guard | Guard Cloud |
+| --- | --- | --- |
+| Launch interception and local policy | Included | Included |
+| Local blocking/warnings on supported actions | Included | Included |
+| Local receipts and approvals | Included | Included |
+| Works when Cloud is offline | Yes | Local protection continues; sync pauses |
+| Cross-device history and search | Device-local only | Included on paid plans |
+| Decision memory across machines | No | Included on paid plans |
+| Cloud Firewall UI and exports | No | Included on paid plans |
+| Team RBAC, routing, and shared policy | No | Team plans |
+
+## Related docs
+
+- [Get started](./get-started.md)
+- [Harness support](./harness-support.md)
+- [Remediation](./remediation.md)

{plugin_scanner-2.0.564 → plugin_scanner-2.0.565}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.564"
+version = "2.0.565"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.564 → plugin_scanner-2.0.565}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.564"
+version = "2.0.565"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.564 → plugin_scanner-2.0.565}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.564"
+__version__ = "2.0.565"

plugin_scanner-2.0.564/docs/guard/local-vs-cloud.md

@@ -1,39 +0,0 @@
-# Works Locally First
-
-Guard works on your machine before you sign in anywhere.
-
-Local features available without sign-in:
-
-- harness discovery
-- artifact snapshots
-- local diffs
-- local policy decisions
-- wrapper-mode launch enforcement
-- local receipts and explain output
-- local policy overrides from home or workspace config
-
-Guard does not meter local safety features. You can detect harnesses, install launchers, diff changes, prompt for approval, and inspect receipts without signing in.
-
-Safe Decode runs locally too. It inspects encoded payload layers for review evidence, but never executes decoded payloads and only syncs redacted summaries when optional cloud receipt sync is enabled.
-
-Optional cloud features:
-
-- receipt sync to an optional Guard endpoint
-- trust enrichment
-- revocation feeds
-- billing and entitlements
-- shared team policy
-
-The local runtime does not require any hosted service. `hol-guard connect` is the canonical way to pair a machine with Guard Cloud later, and `hol-guard connect --headless` uses OAuth Device Code for SSH/CI hosts. `hol-guard login` remains only as a redirecting compatibility alias. These commands do not unlock the core safety workflow.
-
-Use these commands when you need to check or repair optional cloud pairing without disturbing local protection:
-
-```bash
-hol-guard connect status
-hol-guard connect repair
-hol-guard sync
-hol-guard supply-chain sync
-hol-guard supply-chain scan
-hol-guard supply-chain explain minimist@1.2.5 --ecosystem npm
-hol-guard explain install-connect
-```