plugin-scanner 2.0.590__tar.gz → 2.0.592__tar.gz

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.590
+Version: 2.0.592
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/dashboard/src/guard-api.test.ts

@@ -9,9 +9,10 @@ import {
 	  formatHarnessCommand,
 	  normalizeRuntimeSnapshot,
 	  normalizeApprovalRequest,
-	  parseActionEnvelope,
-	  parseDecisionV2,
-	  runPackageFirewallAction,
+  parseActionEnvelope,
+  parseDecisionV2,
+  readGuardToken,
+  runPackageFirewallAction,
 	  startPackageFirewallConnect,
 	  runAuditRemediation,
 	  resolveRequestWithQueueResult,
@@ -568,9 +569,11 @@ type StorageShape = {
   readonly length: number;
 };
 
-function installGuardWindow(search: string): void {
-  const storage = new Map<string, string>();
-  const sessionStorage: StorageShape = {
+function createStorage(storage: Map<string, string> | StorageShape): StorageShape {
+  if (!(storage instanceof Map)) {
+    return storage;
+  }
+  return {
     getItem(key: string): string | null {
       return storage.get(key) ?? null;
     },
@@ -590,6 +593,17 @@ function installGuardWindow(search: string): void {
       return storage.size;
     }
   };
+}
+
+function installGuardWindow(
+  search: string,
+  options?: {
+    sessionStorage?: Map<string, string> | StorageShape;
+    localStorage?: Map<string, string> | StorageShape;
+  }
+): void {
+  const sessionStorage = createStorage(options?.sessionStorage ?? new Map<string, string>());
+  const localStorage = createStorage(options?.localStorage ?? new Map<string, string>());
   Object.defineProperty(globalThis, "window", {
     configurable: true,
     value: {
@@ -599,7 +613,17 @@ function installGuardWindow(search: string): void {
         search,
         hash: ""
       },
-      sessionStorage
+      sessionStorage,
+      localStorage
+    }
+  });
+}
+
+function installThrowingLocalStorageGetter(message: string): void {
+  Object.defineProperty(globalThis.window, "localStorage", {
+    configurable: true,
+    get(): never {
+      throw new Error(message);
     }
   });
 }
@@ -670,6 +694,54 @@ assert(approvalPage.next_cursor === "cursor-two", "L078: fetchApprovalPage retur
 assert(approvalPage.total_pending_count === 3, "L078: fetchApprovalPage returns pending total");
 assert(approvalPage.total_count === 7, "L078: fetchApprovalPage returns filtered total");
 
+const sharedLocalStorage = new Map<string, string>();
+installGuardWindow("?guard-token=token-shared-tabs&guardDaemon=http%3A%2F%2F127.0.0.1%3A4781", {
+  localStorage: sharedLocalStorage,
+});
+assert(readGuardToken() === "token-shared-tabs", "L078aa: readGuardToken stores the URL token");
+installGuardWindow("?guardDaemon=http%3A%2F%2F127.0.0.1%3A4781", {
+  localStorage: sharedLocalStorage,
+});
+const sharedTabCalls = installFetchStub({
+  "/v1/requests": {
+    items: [pageItem],
+    next_cursor: null,
+    total_pending_count: 1,
+    total_count: 1,
+    status: "pending"
+  }
+});
+await fetchApprovalPage();
+assert(
+  headerValue(sharedTabCalls[0].init, "X-Guard-Dashboard-Session") === "token-shared-tabs",
+  "L078ab: fetchApprovalPage reuses dashboard session from localStorage in a new tab"
+);
+
+const sharedSessionStorage = new Map<string, string>();
+installGuardWindow("?guard-token=token-session-only&guardDaemon=http%3A%2F%2F127.0.0.1%3A4781", {
+  sessionStorage: sharedSessionStorage,
+});
+installThrowingLocalStorageGetter("localStorage unavailable");
+assert(readGuardToken() === "token-session-only", "L078ac: readGuardToken tolerates disabled localStorage");
+installGuardWindow("?guardDaemon=http%3A%2F%2F127.0.0.1%3A4781", {
+  sessionStorage: sharedSessionStorage,
+});
+installThrowingLocalStorageGetter("localStorage unavailable");
+const sessionOnlyCalls = installFetchStub({
+  "/v1/requests": {
+    items: [pageItem],
+    next_cursor: null,
+    total_pending_count: 1,
+    total_count: 1,
+    status: "pending"
+  }
+});
+await fetchApprovalPage();
+assert(
+  headerValue(sessionOnlyCalls[0].init, "X-Guard-Dashboard-Session") === "token-session-only",
+  "L078ad: fetchApprovalPage falls back to sessionStorage when localStorage is unavailable"
+);
+
 installGuardWindow("?guard-token=token-pending-pages&guardDaemon=http%3A%2F%2F127.0.0.1%3A4781");
 const codexPageItem: GuardApprovalRequest = {
   ...BASE_REQUEST,

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/dashboard/src/guard-api.ts

@@ -172,6 +172,31 @@ function guardParam(name: string): string | null {
   return guardParams().get(name);
 }
 
+function readBrowserStorage(getStorage: () => Storage, name: string): string | null {
+  try {
+    return getStorage().getItem(name);
+  } catch {
+    return null;
+  }
+}
+
+function readGuardStorage(name: string): string | null {
+  return readBrowserStorage(() => window.sessionStorage, name) ?? readBrowserStorage(() => window.localStorage, name);
+}
+
+function saveBrowserStorage(getStorage: () => Storage, name: string, value: string): void {
+  try {
+    getStorage().setItem(name, value);
+  } catch {
+    // Fall back to whichever storage remains available.
+  }
+}
+
+function saveGuardStorage(name: string, value: string): void {
+  saveBrowserStorage(() => window.sessionStorage, name, value);
+  saveBrowserStorage(() => window.localStorage, name, value);
+}
+
 export function readGuardToken(): string | null {
   const locationKey = `${window.location.origin}${window.location.pathname}${window.location.search}${window.location.hash}`;
   if (guardTokenLocationKey !== locationKey) {
@@ -183,19 +208,19 @@ export function readGuardToken(): string | null {
   }
   const guardToken = guardParam(GUARD_TOKEN_PARAM);
   if (guardToken) {
-    window.sessionStorage.setItem(GUARD_TOKEN_PARAM, guardToken);
+    saveGuardStorage(GUARD_TOKEN_PARAM, guardToken);
     return guardToken;
   }
-  return window.sessionStorage.getItem(GUARD_TOKEN_PARAM);
+  return readGuardStorage(GUARD_TOKEN_PARAM);
 }
 
 function saveGuardToken(guardToken: string): void {
   guardTokenOverride = guardToken;
-  window.sessionStorage.setItem(GUARD_TOKEN_PARAM, guardToken);
+  saveGuardStorage(GUARD_TOKEN_PARAM, guardToken);
 }
 
 function saveGuardDaemonOrigin(daemonOrigin: string): void {
-  window.sessionStorage.setItem(GUARD_DAEMON_PARAM, daemonOrigin);
+  saveGuardStorage(GUARD_DAEMON_PARAM, daemonOrigin);
 }
 
 function preferredGuardDaemonPort(): number {
@@ -406,11 +431,11 @@ function readGuardDaemonOrigin(): string | null {
   if (rawDaemonUrl) {
     const daemonOrigin = localGuardDaemonOrigin(rawDaemonUrl);
     if (daemonOrigin) {
-      window.sessionStorage.setItem(GUARD_DAEMON_PARAM, daemonOrigin);
+      saveGuardStorage(GUARD_DAEMON_PARAM, daemonOrigin);
       return daemonOrigin;
     }
   }
-  const storedDaemonUrl = window.sessionStorage.getItem(GUARD_DAEMON_PARAM);
+  const storedDaemonUrl = readGuardStorage(GUARD_DAEMON_PARAM);
   return storedDaemonUrl ? localGuardDaemonOrigin(storedDaemonUrl) : null;
 }
 

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.590"
+version = "2.0.592"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.590"
+version = "2.0.592"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/src/codex_plugin_scanner/guard/approvals.py

@@ -35,6 +35,7 @@ GUARD_CONNECT_URL = f"{GUARD_DASHBOARD_URL}/connect"
 _WORKSPACE_SCOPED_RUNTIME_ARTIFACT_TYPES = frozenset(
     {
         "file_read_request",
+        "package_request",
         "prompt_request",
         "tool_action_request",
     }
@@ -55,6 +56,27 @@ def build_approval_request_url(approval_center_url: str, request_id: str) -> str
     return f"{approval_center_url.rstrip('/')}/requests/{request_id.strip()}"
 
 
+def build_approval_browser_url(approval_url: str | None, *, auth_token: str | None) -> str | None:
+    """Build a browser-openable approval URL with a scoped Guard session token."""
+
+    if not approval_url or auth_token is None:
+        return approval_url
+    parsed = urlparse(approval_url)
+    fragment_pairs = [
+        (key, value) for key, value in parse_qsl(parsed.fragment, keep_blank_values=True) if key != "guard-token"
+    ]
+    fragment_pairs.append(
+        (
+            "guard-token",
+            build_local_dashboard_session_token(
+                auth_token=auth_token,
+                surface="approval-center",
+            ),
+        )
+    )
+    return urlunparse(parsed._replace(fragment=urlencode(fragment_pairs)))
+
+
 def _normalize_harness_slug(harness: str | None) -> str | None:
     if not isinstance(harness, str):
         return None
@@ -448,12 +470,13 @@ def approval_center_hint(
     managed_install: dict[str, object] | None = None,
     request_id: str | None = None,
     artifact_id: str | None = None,
+    review_url: str | None = None,
 ) -> str:
     del context
     flow = approval_prompt_flow(harness, managed_install=managed_install)
     count = len(queued)
     risk_summary = _queue_risk_summary(queued)
-    review_url = (
+    resolved_review_url = review_url or (
         primary_approval_url(
             queued,
             harness=harness,
@@ -466,7 +489,7 @@ def approval_center_hint(
     return (
         f"Guard queued {count} approval request{'s' if count != 1 else ''} for {harness}. "
         f"{flow['summary']} "
-        f"Review them in the Guard approval center at {review_url}. "
+        f"Review them in the Guard approval center at {resolved_review_url}. "
         f"{risk_summary} "
         f"{flow['fallback_hint']}"
     )

{plugin_scanner-2.0.590 → plugin_scanner-2.0.592}/src/codex_plugin_scanner/guard/cli/commands.py

@@ -57,6 +57,7 @@ from ..approvals import (
     approval_delivery_payload,
     approval_prompt_flow,
     attach_primary_approval_link,
+    build_approval_browser_url,
     first_approval_url,
     queue_blocked_approvals,
     wait_for_approval_requests,
@@ -228,6 +229,7 @@ from .install_commands import (
     uninstall_confirmation_token,
 )
 from .product import build_guard_start_payload, build_guard_status_payload
+from .protect_approvals import _queue_local_protect_approvals, _suppress_package_shim_allow_output
 from .remote_pair_flow import dispatch_guard_remote_pair_command
 from .update_commands import run_guard_update
 
@@ -557,6 +559,7 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
     protect_parser.add_argument("--dry-run", action="store_true")
     protect_parser.add_argument("--unsafe-raw-output", action="store_true")
     protect_parser.add_argument("--json", action="store_true")
+    protect_parser.add_argument("--package-shim-ui", action="store_true", help=argparse.SUPPRESS)
     protect_parser.add_argument("protect_command", nargs=argparse.REMAINDER)
 
     preflight_parser = guard_subparsers.add_parser(
@@ -1989,7 +1992,20 @@ def run_guard_command(
             config=config,
             unsafe_raw_output=bool(getattr(args, "unsafe_raw_output", False)),
         )
-        _emit("protect", payload, getattr(args, "json", False))
+        _queue_local_protect_approvals(
+            payload,
+            store=store,
+            guard_home=guard_home,
+            workspace=workspace or Path.cwd(),
+            ensure_approval_daemon=ensure_guard_daemon,
+            approval_delivery_payload=_approval_delivery_payload,
+            localize_pending_approval_copy=lambda response_payload, harness: _localize_pending_approval_copy(
+                response_payload,
+                harness=harness,
+            ),
+        )
+        if not _suppress_package_shim_allow_output(args, payload):
+            _emit("protect", payload, getattr(args, "json", False))
         return exit_code
 
     if args.guard_command == "start":
@@ -3305,6 +3321,7 @@ def run_guard_command(
                 managed_install=managed_install,
                 request_id=_optional_string(response_payload.get("primary_approval_request_id")),
                 artifact_id=_optional_string(response_payload.get("artifact_id")),
+                review_url=_preferred_approval_review_url(response_payload, harness=args.harness),
             )
             _localize_pending_approval_copy(response_payload, harness=args.harness)
             _record_harness_usage_for_hook(
@@ -3909,6 +3926,7 @@ def run_guard_command(
                         managed_install=managed_install,
                         request_id=_optional_string(response_payload.get("primary_approval_request_id")),
                         artifact_id=_optional_string(response_payload.get("artifact_id")),
+                        review_url=_preferred_approval_review_url(response_payload, harness=args.harness),
                     )
                     response_payload["approval_delivery"] = _approval_delivery_payload(
                         args.harness,
@@ -4332,7 +4350,7 @@ def _codex_browser_approval_decision(
     if wait_timeout_seconds <= 0:
         return None
     if event_name == "PreToolUse":
-        _open_codex_live_approval(response_payload)
+        _open_codex_live_approval(response_payload, guard_home=store.guard_home)
     wait_result = wait_for_approval_requests(
         store=store,
         request_ids=request_ids,
@@ -4462,25 +4480,22 @@ def _primary_approval_lookup_kwargs(response_payload: dict[str, object], *, harn
     }
 
 
-def _open_codex_live_approval(response_payload: Mapping[str, object]) -> None:
+def _preferred_approval_review_url(response_payload: Mapping[str, object], *, harness: str) -> str | None:
     queued = response_payload.get("approval_requests")
-    lookup: dict[str, object] = {
-        "harness": _optional_string(response_payload.get("harness")),
-        "approval_center_url": _optional_string(response_payload.get("approval_center_url")),
-        "request_id": _optional_string(response_payload.get("primary_approval_request_id")),
-        "artifact_id": _optional_string(response_payload.get("artifact_id")),
-    }
-    review_url = (
+    return (
         _optional_string(response_payload.get("primary_approval_url"))
         or (
-            first_approval_url(queued, **lookup)
+            first_approval_url(queued, **_primary_approval_lookup_kwargs(dict(response_payload), harness=harness))
             if isinstance(queued, list)
             else None
         )
+        or _optional_string(response_payload.get("approval_center_url"))
     )
-    if not review_url:
-        approval_center_url = response_payload.get("approval_center_url")
-        review_url = approval_center_url.strip() if isinstance(approval_center_url, str) else None
+
+
+def _open_codex_live_approval(response_payload: Mapping[str, object], *, guard_home: Path | None = None) -> None:
+    harness = _optional_string(response_payload.get("harness")) or "codex"
+    review_url = _preferred_approval_review_url(response_payload, harness=harness)
     if not review_url:
         return
     print(
@@ -4488,8 +4503,17 @@ def _open_codex_live_approval(response_payload: Mapping[str, object]) -> None:
         file=sys.stderr,
         flush=True,
     )
+    browser_url = review_url
+    if guard_home is not None:
+        browser_url = (
+            build_approval_browser_url(
+                review_url,
+                auth_token=load_guard_daemon_auth_token(guard_home),
+            )
+            or review_url
+        )
     with suppress(Exception):
-        webbrowser.open(review_url)
+        webbrowser.open(browser_url)
 
 
 def _update_codex_browser_operation_status(
@@ -5930,25 +5954,36 @@ def _native_approval_center_context(response_payload: dict[str, object], *, harn
     approval_center_url = response_payload.get("approval_center_url")
     if not isinstance(approval_center_url, str) or not approval_center_url.strip():
         return None
-    queued = response_payload.get("approval_requests")
-    review_url = (
-        _optional_string(response_payload.get("primary_approval_url"))
-        or (
-            first_approval_url(
-                queued,
-                **_primary_approval_lookup_kwargs(response_payload, harness=harness),
-            )
-            if isinstance(queued, list)
-            else None
-        )
-        or approval_center_url.strip()
-    )
+    review_url = _preferred_approval_review_url(response_payload, harness=harness) or approval_center_url.strip()
+    canonical_harness = _canonical_harness_name(harness)
     harness_label = {
         "claude-code": "Claude Code",
         "codex": "Codex",
         "copilot": "Copilot",
+        "guard-cli": "package install",
         "opencode": "OpenCode",
-    }.get(_canonical_harness_name(harness), "the harness")
+    }.get(canonical_harness, "the harness")
+    if canonical_harness in {
+        "npm",
+        "npx",
+        "pnpm",
+        "yarn",
+        "bun",
+        "pip",
+        "pip3",
+        "pipenv",
+        "pipx",
+        "poetry",
+        "uv",
+        "uvx",
+        "cargo",
+        "go",
+        "composer",
+        "bundle",
+        "mvn",
+        "gradle",
+    }:
+        harness_label = "package install"
     return (
         f"Open HOL Guard to approve or keep this blocked: {review_url}. "
         f"After you choose, retry the same {harness_label} action."
@@ -5960,20 +5995,7 @@ def _localize_pending_approval_copy(response_payload: dict[str, object], *, harn
     if review_context is None:
         return
     queued = response_payload.get("approval_requests")
-    review_url = (
-        _optional_string(response_payload.get("primary_approval_url"))
-        or (
-            first_approval_url(
-                queued,
-                **_primary_approval_lookup_kwargs(response_payload, harness=harness),
-            )
-            if isinstance(queued, list)
-            else None
-        )
-    )
-    approval_center_url = response_payload.get("approval_center_url")
-    if review_url is None and isinstance(approval_center_url, str) and approval_center_url.strip():
-        review_url = approval_center_url.strip()
+    review_url = _preferred_approval_review_url(response_payload, harness=harness)
     if review_url is None:
         return
     decision_v2 = response_payload.get("decision_v2_json")
@@ -6960,12 +6982,18 @@ def _headless_approval_resolver(
                 now=_now(),
             )
             payload["approval_requests"] = queued
+            _attach_primary_approval_link(
+                payload,
+                harness=args.harness,
+                approval_center_url=approval_center_url,
+            )
             payload["approval_center_url"] = approval_center_url
             payload["review_hint"] = approval_center_hint(
                 context=context,
                 harness=args.harness,
                 approval_center_url=approval_center_url,
                 queued=queued,
+                review_url=_preferred_approval_review_url(payload, harness=args.harness),
             )
             payload["approval_delivery"] = _approval_delivery_payload(args.harness, managed_install=managed_install)
             _localize_pending_approval_copy(payload, harness=args.harness)
@@ -7026,6 +7054,11 @@ def _headless_approval_resolver(
         payload["session_id"] = str(session["session_id"])
         payload["operation_id"] = str(operation["operation_id"])
         payload["approval_requests"] = queued
+        _attach_primary_approval_link(
+            payload,
+            harness=args.harness,
+            approval_center_url=approval_center_url,
+        )
         payload["approval_center_url"] = approval_center_url
         payload["review_hint"] = approval_center_hint(
             context=context,
@@ -7033,6 +7066,7 @@ def _headless_approval_resolver(
             approval_center_url=approval_center_url,
             queued=queued,
             managed_install=managed_install,
+            review_url=_preferred_approval_review_url(payload, harness=args.harness),
         )
         payload["approval_delivery"] = _approval_delivery_payload(args.harness, managed_install=managed_install)
         _localize_pending_approval_copy(payload, harness=args.harness)