plugin-scanner 2.0.585__tar.gz → 2.0.586__tar.gz

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.585
+Version: 2.0.586
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.585"
+version = "2.0.586"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.585"
+version = "2.0.586"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/src/codex_plugin_scanner/guard/local_supply_chain.py

@@ -315,8 +315,13 @@ def resolve_package_firewall_entitlement_with_refresh(store: GuardStore) -> dict
         return entitlement
     if store.get_cloud_sync_profile() is None:
         return entitlement
-    if str(entitlement.get("reason") or "") not in {"guard_cloud_reconnect_required", "paid_guard_cloud_required"}:
+    if str(entitlement.get("reason") or "") not in {
+        "guard_cloud_connect_required",
+        "guard_cloud_reconnect_required",
+        "paid_guard_cloud_required",
+    }:
         return entitlement
+    now_iso = datetime.now(timezone.utc).isoformat()
     now = time.time()
     with _PACKAGE_FIREWALL_REFRESH_LOCK:
         state = _read_package_firewall_refresh_state(store.guard_home)
@@ -330,13 +335,16 @@ def resolve_package_firewall_entitlement_with_refresh(store: GuardStore) -> dict
     for refresh in (sync_local_guard_cloud_proof, sync_supply_chain_bundle):
         try:
             refresh(store)
-        except (
-            GuardSyncAuthorizationExpiredError,
-            GuardSyncNotAvailableError,
-            GuardSyncNotConfiguredError,
-            OSError,
-            RuntimeError,
-        ):
+        except GuardSyncAuthorizationExpiredError as error:
+            if str(entitlement.get("reason") or "") == "guard_cloud_connect_required":
+                store.record_latest_guard_connect_sync_result(
+                    status="retry_required",
+                    milestone="first_sync_failed",
+                    now=now_iso,
+                    reason=str(error),
+                )
+            break
+        except (GuardSyncNotAvailableError, GuardSyncNotConfiguredError, OSError, RuntimeError):
             continue
     return resolve_package_firewall_entitlement(store)
 

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -2341,6 +2341,15 @@ def _refresh_guard_oauth_access_token(
     dpop_nonce: str | None = None
     nonce_retry_count = 0
     while True:
+        try:
+            dpop_proof = _sign_guard_dpop_proof(
+                request_url=token_endpoint,
+                method="POST",
+                dpop_key_material=dpop_key_material,
+                nonce=dpop_nonce,
+            )
+        except (RuntimeError, TypeError, ValueError) as error:
+            raise GuardSyncAuthorizationExpiredError(f"{_guard_oauth_reauthorization_message()} {error}") from error
         request = urllib.request.Request(
             token_endpoint,
             data=request_body,
@@ -2349,12 +2358,7 @@ def _refresh_guard_oauth_access_token(
                 "Content-Type": "application/x-www-form-urlencoded",
                 "Accept": "application/json",
                 "User-Agent": _GUARD_SYNC_USER_AGENT,
-                "DPoP": _sign_guard_dpop_proof(
-                    request_url=token_endpoint,
-                    method="POST",
-                    dpop_key_material=dpop_key_material,
-                    nonce=dpop_nonce,
-                ),
+                "DPoP": dpop_proof,
             },
         )
         try:

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.585"
+__version__ = "2.0.586"

plugin_scanner-2.0.586/tests/conftest.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import os
+import sys
+from collections.abc import Callable
+from pathlib import Path
+
+import pytest
+
+SRC_PATH = Path(__file__).resolve().parents[1] / "src"
+
+if str(SRC_PATH) not in sys.path:
+    sys.path.insert(0, str(SRC_PATH))
+
+existing_pythonpath = os.environ.get("PYTHONPATH", "")
+pythonpath_entries = [entry for entry in existing_pythonpath.split(os.pathsep) if entry]
+if str(SRC_PATH) not in pythonpath_entries:
+    os.environ["PYTHONPATH"] = os.pathsep.join([str(SRC_PATH), *pythonpath_entries])
+
+
+@pytest.fixture(autouse=True)
+def _disable_real_macos_keychain(monkeypatch: pytest.MonkeyPatch) -> None:
+    from codex_plugin_scanner.guard.store import KeychainSecretStore
+
+    monkeypatch.setattr(KeychainSecretStore, "_is_available", staticmethod(lambda: False))
+
+
+@pytest.fixture
+def seed_connected_oauth_without_entitlement() -> Callable[["GuardStore"], None]:
+    from codex_plugin_scanner.guard.store import GuardStore
+
+    def _seed(store: GuardStore) -> None:
+        store.set_oauth_local_credentials(
+            issuer="https://hol.org",
+            client_id="guard-local-daemon",
+            refresh_token="refresh-token-1",
+            dpop_private_key_pem="private-key",
+            dpop_public_jwk={"kty": "EC", "crv": "P-256", "x": "x-value", "y": "y-value"},
+            dpop_public_jwk_thumbprint="thumbprint-1",
+            grant_id="grant-1",
+            machine_id="machine-1",
+            workspace_id="workspace-1",
+            now="2026-06-05T01:39:51+00:00",
+        )
+        store.record_guard_connect_pairing_completed(
+            sync_url="https://hol.org/api/guard/receipts/sync",
+            allowed_origin="https://hol.org",
+            now="2026-06-05T01:39:51+00:00",
+            request_id="connect-1",
+        )
+
+    return _seed

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/tests/test_guard_headless_daemon_api.py

@@ -476,6 +476,68 @@ def test_supply_chain_package_firewall_install_requires_reconnect_when_cloud_aut
     assert payload["entitlement"]["tier"] == "unknown"
 
 
+def test_supply_chain_package_firewall_status_self_heals_connected_cloud_auth_without_cached_entitlement(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    seed_connected_oauth_without_entitlement,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    seed_connected_oauth_without_entitlement(store)
+    calls: list[str] = []
+
+    def fake_sync_local_guard_cloud_proof(current_store: GuardStore) -> dict[str, object]:
+        assert current_store is store
+        calls.append("proof")
+        current_store.record_latest_guard_connect_sync_success(
+            sync_payload={"synced_at": "2026-06-05T01:41:00+00:00", "receipts_stored": 1},
+            now="2026-06-05T01:41:00+00:00",
+        )
+        return {"synced_at": "2026-06-05T01:41:00+00:00", "receipts_stored": 1}
+
+    def fake_sync_supply_chain_bundle(current_store: GuardStore) -> dict[str, object]:
+        assert current_store is store
+        calls.append("bundle")
+        current_store.set_sync_payload(
+            "supply_chain_bundle_entitlement",
+            {
+                "bundle_version": "bundle-version-test",
+                "key_id": "bundle-key-test",
+                "policy_hash": "policy-hash-test",
+                "tier": "pro",
+                "workspace_id": "workspace-1",
+            },
+            "2026-06-05T01:41:05+00:00",
+        )
+        return {"bundle_version": "bundle-version-test", "tier": "pro"}
+
+    monkeypatch.setattr(local_supply_chain_module, "sync_local_guard_cloud_proof", fake_sync_local_guard_cloud_proof)
+    monkeypatch.setattr(local_supply_chain_module, "sync_supply_chain_bundle", fake_sync_supply_chain_bundle)
+    daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)
+    daemon.start()
+    try:
+        token = _dashboard_token_for(store)
+        status, payload = _read_json_response(
+            _request(
+                daemon.port,
+                "/v1/supply-chain/package-shims",
+                method="GET",
+                token=token,
+            ),
+        )
+    finally:
+        daemon.stop()
+
+    assert status == 200
+    assert calls == ["proof", "bundle"]
+    assert payload["entitlement"] == {
+        "allowed": True,
+        "reason": "paid_entitlement_active",
+        "tier": "pro",
+        "upgrade_cta": None,
+    }
+    assert payload["actions"]["install"] == "available"
+
+
 def test_supply_chain_package_firewall_install_self_heals_retry_required_cloud_auth(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/tests/test_guard_oauth_reconnect.py

@@ -115,3 +115,17 @@ def test_prepare_guard_cloud_connect_authorization_tolerates_network_errors(tmp_
     assert result["cleared_stale_sign_in"] is False
     assert result["existing_sign_in_valid"] is True
     assert store.get_oauth_local_credentials(allow_primary=True) is not None
+
+
+def test_invalid_dpop_curve_refresh_uses_reconnect_message(tmp_path, monkeypatch) -> None:
+    store = _store_with_oauth_credentials(tmp_path)
+
+    def _raise_invalid_curve(**_kwargs):
+        raise RuntimeError("Guard DPoP key must be a P-256 EC private key.")
+
+    monkeypatch.setattr(guard_runner_module, "_sign_guard_dpop_proof", _raise_invalid_curve)
+
+    with pytest.raises(guard_runner_module.GuardSyncAuthorizationExpiredError) as error:
+        guard_runner_module._resolve_guard_sync_auth_context(store)
+
+    assert "hol-guard connect" in str(error.value)

{plugin_scanner-2.0.585 → plugin_scanner-2.0.586}/tests/test_guard_package_shims_cli.py

@@ -139,6 +139,92 @@ def test_package_shims_status_reports_reconnect_required_when_cloud_auth_expired
     assert payload["actions"]["remove"] == "disabled"
 
 
+def test_package_shims_status_self_heals_connected_cloud_auth_without_cached_entitlement(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    seed_connected_oauth_without_entitlement,
+) -> None:
+    guard_home = tmp_path / "guard-home"
+    seed_connected_oauth_without_entitlement(GuardStore(guard_home))
+    calls: list[str] = []
+
+    def _fake_sync_local_guard_cloud_proof(store: GuardStore) -> dict[str, object]:
+        calls.append("proof")
+        store.record_latest_guard_connect_sync_success(
+            sync_payload={"synced_at": "2026-06-05T01:41:00+00:00", "receipts_stored": 1},
+            now="2026-06-05T01:41:00+00:00",
+        )
+        return {"synced_at": "2026-06-05T01:41:00+00:00", "receipts_stored": 1}
+
+    def _fake_sync_supply_chain_bundle(store: GuardStore) -> dict[str, object]:
+        calls.append("bundle")
+        store.set_sync_payload(
+            "supply_chain_bundle_entitlement",
+            {
+                "bundle_version": "bundle-version-test",
+                "key_id": "bundle-key-test",
+                "policy_hash": "policy-hash-test",
+                "tier": "pro",
+                "workspace_id": "workspace-1",
+            },
+            "2026-06-05T01:41:05+00:00",
+        )
+        return {"bundle_version": "bundle-version-test", "tier": "pro"}
+
+    monkeypatch.setattr(local_supply_chain_module, "sync_local_guard_cloud_proof", _fake_sync_local_guard_cloud_proof)
+    monkeypatch.setattr(local_supply_chain_module, "sync_supply_chain_bundle", _fake_sync_supply_chain_bundle)
+
+    rc = main(["guard", "package-shims", "status", "--home", str(guard_home), "--json"])
+
+    payload = json.loads(capsys.readouterr().out)
+    assert rc == 0
+    assert calls == ["proof", "bundle"]
+    assert payload["entitlement"] == {
+        "allowed": True,
+        "reason": "paid_entitlement_active",
+        "tier": "pro",
+        "upgrade_cta": None,
+    }
+    assert payload["actions"]["install"] == "available"
+
+
+def test_package_shims_status_preserves_reconnect_gate_when_connected_auth_refresh_expires(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    seed_connected_oauth_without_entitlement,
+) -> None:
+    guard_home = tmp_path / "guard-home"
+    seed_connected_oauth_without_entitlement(GuardStore(guard_home))
+    monkeypatch.setattr(
+        local_supply_chain_module,
+        "sync_local_guard_cloud_proof",
+        lambda _store: (_ for _ in ()).throw(
+            local_supply_chain_module.GuardSyncAuthorizationExpiredError(
+                "Guard authorization expired. Run `hol-guard connect` again."
+            )
+        ),
+    )
+    monkeypatch.setattr(
+        local_supply_chain_module,
+        "sync_supply_chain_bundle",
+        lambda _store: (_ for _ in ()).throw(RuntimeError("bundle refresh blocked")),
+    )
+
+    rc = main(["guard", "package-shims", "status", "--home", str(guard_home), "--json"])
+
+    payload = json.loads(capsys.readouterr().out)
+    assert rc == 0
+    assert payload["entitlement"] == {
+        "allowed": False,
+        "reason": "guard_cloud_reconnect_required",
+        "tier": "unknown",
+        "upgrade_cta": "Reconnect HOL Guard Cloud to refresh package firewall access.",
+    }
+    assert payload["actions"]["install"] == "reconnect_required"
+
+
 def test_package_shims_install_requires_reconnect_when_cloud_auth_expired(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

plugin_scanner-2.0.585/tests/conftest.py

@@ -1,24 +0,0 @@
-from __future__ import annotations
-
-import os
-import sys
-from pathlib import Path
-
-import pytest
-
-SRC_PATH = Path(__file__).resolve().parents[1] / "src"
-
-if str(SRC_PATH) not in sys.path:
-    sys.path.insert(0, str(SRC_PATH))
-
-existing_pythonpath = os.environ.get("PYTHONPATH", "")
-pythonpath_entries = [entry for entry in existing_pythonpath.split(os.pathsep) if entry]
-if str(SRC_PATH) not in pythonpath_entries:
-    os.environ["PYTHONPATH"] = os.pathsep.join([str(SRC_PATH), *pythonpath_entries])
-
-
-@pytest.fixture(autouse=True)
-def _disable_real_macos_keychain(monkeypatch: pytest.MonkeyPatch) -> None:
-    from codex_plugin_scanner.guard.store import KeychainSecretStore
-
-    monkeypatch.setattr(KeychainSecretStore, "_is_available", staticmethod(lambda: False))