plugin-scanner 2.0.597__tar.gz → 2.0.599__tar.gz

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.597
+Version: 2.0.599
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.599/docs/guard/review-local-queue-contract.md

@@ -0,0 +1,51 @@
+## Review Local Queue Contract
+
+Guard Local owns live pending requests. Guard Cloud may mirror or reuse this data,
+but it does not replace the local queue.
+
+### Pending request payload
+
+Local pending request payload is already defined by
+`src/codex_plugin_scanner/guard/store_approvals.py` `_row_to_payload(...)` and is
+surfaced through both:
+
+- daemon `GET /v1/requests`
+- `build_runtime_snapshot(..., include_items=True)`
+
+Current payload keys include:
+
+- `request_id`
+- `harness`
+- `artifact_id`, `artifact_name`, `artifact_type`, `artifact_hash`
+- `policy_action`, `recommended_scope`, `source_scope`
+- `workspace`, `publisher`, `config_path`, `launch_target`
+- `action_identity`, `queue_group_id`, `dedupe_count`, `last_seen_at`
+- `risk_summary`, `risk_signals`, `why_now`, `trigger_summary`, `launch_summary`
+- `review_command`, `approval_url`
+- `status`, `resolution_action`, `resolution_scope`, `reason`
+- `created_at`, `resolved_at`
+
+### Resolution scopes
+
+Runtime ask-flow scopes currently exposed in
+`src/codex_plugin_scanner/guard/runtime/decisions.py` are:
+
+- `artifact`
+- `workspace`
+- `publisher`
+- `harness`
+
+Resolution logic in `src/codex_plugin_scanner/guard/approvals.py`
+`apply_approval_resolution(...)` also supports broader local persistence for:
+
+- `global`
+
+### Local lifecycle events
+
+Local queue lifecycle emits:
+
+- `approval.created` when a new pending request row is created
+- `approval.resolved` when a pending request is resolved
+
+Duplicate requeues reuse the first pending request id and should not emit a second
+`approval.created` event for the same pending row.

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.597"
+version = "2.0.599"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.597"
+version = "2.0.599"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/src/codex_plugin_scanner/guard/approvals.py

@@ -228,6 +228,7 @@ def queue_blocked_approvals(
             scanner_evidence=_item_scanner_evidence(item),
         )
         persisted_request_id = store.add_approval_request(request, timestamp)
+        created_new_request = persisted_request_id == request.request_id
         if persisted_request_id != request.request_id:
             request = replace(
                 request,
@@ -235,6 +236,8 @@ def queue_blocked_approvals(
                 review_command=f"{GUARD_COMMAND} approvals approve {persisted_request_id}",
                 approval_url=build_approval_request_url(approval_center_url, persisted_request_id),
             )
+        if created_new_request:
+            _record_created_event(store, request, timestamp)
         _notify_pending_approval(store=store, request=request)
         queued.append(request.to_dict())
     return queued
@@ -441,6 +444,25 @@ def _record_resolution_event(store: GuardStore, request_id: str, action: str, sc
     )
 
 
+def _record_created_event(store: GuardStore, request: GuardApprovalRequest, created_at: str) -> None:
+    store.add_event(
+        "approval.created",
+        {
+            "request_id": request.request_id,
+            "harness": request.harness,
+            "artifact_id": request.artifact_id,
+            "artifact_name": request.artifact_name,
+            "artifact_type": request.artifact_type,
+            "policy_action": request.policy_action,
+            "recommended_scope": request.recommended_scope,
+            "source_scope": request.source_scope,
+            "workspace": request.workspace,
+            "publisher": request.publisher,
+        },
+        created_at,
+    )
+
+
 def _refresh_queue_result(
     store: GuardStore,
     result: dict[str, object],

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -2283,18 +2283,17 @@ def _oauth_authorization_error_requires_fresh_sign_in(error: Exception) -> bool:
 
 def clear_revoked_guard_oauth_sign_in(store: GuardStore) -> bool:
     """Return True when refresh proves the local OAuth grant was revoked and cleared."""
-    if store.get_oauth_local_credentials(allow_primary=True) is None:
-        return False
     try:
-        credentials = store.get_oauth_local_credentials(allow_primary=True)
-        if credentials is None:
-            return False
-        _resolve_guard_sync_auth_context_from_oauth_credentials(store, credentials)
+        with _guard_sync_auth_lock(store):
+            credentials = store.get_oauth_local_credentials(allow_primary=True)
+            if credentials is None:
+                return False
+            _resolve_guard_sync_auth_context_from_oauth_credentials(store, credentials)
     except GuardSyncAuthorizationExpiredError as error:
         if _oauth_authorization_error_requires_fresh_sign_in(error):
             return store.get_oauth_local_credentials(allow_primary=True) is None
         return False
-    except (RuntimeError, OSError):
+    except (RuntimeError, OSError, TimeoutError):
         return False
     return False
 

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.597"
+__version__ = "2.0.599"

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/tests/test_guard_approvals.py

@@ -14,7 +14,7 @@ import pytest
 
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import bridge as guard_bridge_module
-from codex_plugin_scanner.guard.approvals import apply_approval_resolution, queue_blocked_approvals
+from codex_plugin_scanner.guard.approvals import build_runtime_snapshot, apply_approval_resolution, queue_blocked_approvals
 from codex_plugin_scanner.guard.bridge import BridgeConfig, GuardBridge
 from codex_plugin_scanner.guard.config import GuardConfig
 from codex_plugin_scanner.guard.consumer import artifact_hash, evaluate_detection
@@ -148,6 +148,42 @@ class TestGuardApprovals:
         assert resolved["action_envelope_json"] == action_envelope_json
         assert resolved["decision_v2_json"] == decision_v2_json
 
+    def test_guard_store_runtime_snapshot_exposes_pending_request_payload_contract(self, tmp_path):
+        store = GuardStore(tmp_path / "guard-home")
+        request = GuardApprovalRequest(
+            request_id="req-snapshot-contract",
+            harness="codex",
+            artifact_id="codex:project:workspace_skill",
+            artifact_name="workspace_skill",
+            artifact_hash="hash-snapshot-contract",
+            policy_action="require-reapproval",
+            recommended_scope="workspace",
+            changed_fields=("args",),
+            source_scope="project",
+            config_path=str(tmp_path / "workspace" / ".codex" / "config.toml"),
+            workspace=str(tmp_path / "workspace"),
+            review_command="hol-guard approvals approve req-snapshot-contract",
+            approval_url="http://127.0.0.1:4455/approvals/req-snapshot-contract",
+        )
+        store.add_approval_request(request, "2026-04-11T00:00:00+00:00")
+
+        snapshot = build_runtime_snapshot(
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-11T00:01:00+00:00",
+        )
+        queue_summary = snapshot["queue_summary"]
+        items = snapshot["items"]
+
+        assert snapshot["pending_count"] == 1
+        assert isinstance(queue_summary, dict)
+        assert queue_summary["next_request_id"] == "req-snapshot-contract"
+        assert isinstance(items, list)
+        assert items[0]["request_id"] == "req-snapshot-contract"
+        assert items[0]["recommended_scope"] == "workspace"
+        assert items[0]["review_command"] == "hol-guard approvals approve req-snapshot-contract"
+        assert items[0]["approval_url"] == "http://127.0.0.1:4455/approvals/req-snapshot-contract"
+
     def test_guard_store_loads_old_approval_rows_without_action_envelope(self, tmp_path):
         guard_home = tmp_path / "guard-home"
         guard_home.mkdir(parents=True, exist_ok=True)
@@ -521,7 +557,7 @@ class TestGuardApprovals:
             config_paths=(artifact.config_path,),
             artifacts=(artifact,),
         )
-        evaluation = {
+        evaluation: dict[str, object] = {
             "artifacts": [
                 {
                     "artifact_id": artifact.artifact_id,
@@ -641,6 +677,74 @@ class TestGuardApprovals:
         assert first[0]["request_id"] == second[0]["request_id"]
         assert notifications == [(first[0]["request_id"], False), (first[0]["request_id"], True)]
 
+    def test_guard_queue_blocked_approvals_emits_created_event_once_for_new_pending_request(self, tmp_path):
+        store = GuardStore(tmp_path / "guard-home")
+        workspace = tmp_path / "workspace"
+        artifact = GuardArtifact(
+            artifact_id="codex:runtime:project:danger_lab:event_notice",
+            name="danger_lab:event_notice",
+            harness="codex",
+            artifact_type="tool_call",
+            source_scope="project",
+            config_path=str(workspace / ".codex" / "config.toml"),
+            command="event_notice",
+        )
+        detection = HarnessDetection(
+            harness="codex",
+            installed=True,
+            command_available=True,
+            config_paths=(artifact.config_path,),
+            artifacts=(artifact,),
+        )
+        evaluation = {
+            "artifacts": [
+                {
+                    "artifact_id": artifact.artifact_id,
+                    "artifact_name": artifact.name,
+                    "artifact_hash": "hash-runtime",
+                    "artifact_type": artifact.artifact_type,
+                    "source_scope": artifact.source_scope,
+                    "config_path": artifact.config_path,
+                    "changed_fields": ["runtime_tool_call"],
+                    "policy_action": "require-reapproval",
+                    "launch_target": "event_notice",
+                }
+            ]
+        }
+
+        first = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-17T00:00:00+00:00",
+        )
+        second = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-17T00:01:00+00:00",
+        )
+        events = store.list_events_after(0, limit=10, event_names=("approval.created",))
+        payload = events[0]["payload"]
+
+        assert first[0]["request_id"] == second[0]["request_id"]
+        assert len(events) == 1
+        assert isinstance(payload, dict)
+        assert payload == {
+            "request_id": first[0]["request_id"],
+            "harness": "codex",
+            "artifact_id": artifact.artifact_id,
+            "artifact_name": artifact.name,
+            "artifact_type": artifact.artifact_type,
+            "policy_action": "require-reapproval",
+            "recommended_scope": "artifact",
+            "source_scope": "project",
+            "workspace": str(workspace),
+            "publisher": None,
+        }
+
     def test_guard_queue_respects_disabled_desktop_notifications(self, tmp_path, monkeypatch):
         notifications: list[str] = []
 
@@ -1850,8 +1954,11 @@ class TestGuardApprovals:
 
         assert status == 200
         assert payload["resolved"] is True
+        assert payload["resolved_request"]["request_id"] == request_id
         assert payload["resolved_request"]["resolution_action"] == ("allow" if action == "approve" else "block")
         assert payload["resolved_request"]["resolution_scope"] == scope
+        assert payload["resolved_request"]["approval_url"] == "http://127.0.0.1/pending"
+        assert payload["resolved_request"]["review_command"] == f"hol-guard approvals {action} {request_id}"
         assert payload["remaining_pending_count"] == 1
         assert payload["next_selectable_request_id"] == f"{request_id}-other"
         assert store.get_approval_request(f"{request_id}-other")["status"] == "pending"

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/tests/test_guard_oauth_reconnect.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from contextlib import contextmanager
 import json
 import urllib.error
 
@@ -117,6 +118,65 @@ def test_prepare_guard_cloud_connect_authorization_tolerates_network_errors(tmp_
     assert store.get_oauth_local_credentials(allow_primary=True) is not None
 
 
+def test_prepare_guard_cloud_connect_authorization_refreshes_under_lock(tmp_path, monkeypatch) -> None:
+    store = _store_with_oauth_credentials(tmp_path)
+    lock_state = {"held": False}
+
+    @contextmanager
+    def _fake_refresh_lock(*, timeout_seconds: float = 30.0):
+        del timeout_seconds
+        assert lock_state["held"] is False
+        lock_state["held"] = True
+        try:
+            yield
+        finally:
+            lock_state["held"] = False
+
+    def _fake_resolve(_store, credentials, *, persist_recovered_secret: bool = False):
+        del _store, persist_recovered_secret
+        assert lock_state["held"] is True
+        assert credentials["refresh_token"] == "refresh-token-1"
+        return {
+            "sync_url": "https://hol.org/api/guard/receipts/sync",
+            "access_token": "access-token-1",
+            "dpop_key_material": None,
+        }
+
+    monkeypatch.setattr(store, "hold_oauth_refresh_lock", _fake_refresh_lock)
+    monkeypatch.setattr(
+        guard_runner_module,
+        "_resolve_guard_sync_auth_context_from_oauth_credentials",
+        _fake_resolve,
+    )
+
+    result = guard_runner_module.prepare_guard_cloud_connect_authorization(store)
+
+    assert result["cleared_stale_sign_in"] is False
+    assert result["existing_sign_in_valid"] is True
+    assert store.get_oauth_local_credentials(allow_primary=True) is not None
+
+
+def test_prepare_guard_cloud_connect_authorization_tolerates_refresh_lock_timeout(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    store = _store_with_oauth_credentials(tmp_path)
+
+    @contextmanager
+    def _fake_refresh_lock(*, timeout_seconds: float = 30.0):
+        del timeout_seconds
+        raise TimeoutError("refresh lock busy")
+        yield
+
+    monkeypatch.setattr(store, "hold_oauth_refresh_lock", _fake_refresh_lock)
+
+    result = guard_runner_module.prepare_guard_cloud_connect_authorization(store)
+
+    assert result["cleared_stale_sign_in"] is False
+    assert result["existing_sign_in_valid"] is True
+    assert store.get_oauth_local_credentials(allow_primary=True) is not None
+
+
 def test_invalid_dpop_curve_refresh_uses_reconnect_message(tmp_path, monkeypatch) -> None:
     store = _store_with_oauth_credentials(tmp_path)
 

{plugin_scanner-2.0.597 → plugin_scanner-2.0.599}/tests/test_guard_phase05_approval_memory.py

@@ -875,6 +875,7 @@ def test_gr124_resolution_events_can_wake_polling_harness_clients(tmp_path: Path
 
     assert events[0]["payload"]["request_id"] == "req-event"
     assert events[0]["payload"]["action"] == "allow"
+    assert events[0]["payload"]["scope"] == "artifact"
 
 
 def test_gr122_duplicate_resolution_returns_idempotent_already_resolved_result(tmp_path: Path) -> None: