plugin-scanner 2.0.598__tar.gz → 2.0.599__tar.gz

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.598
+Version: 2.0.599
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.599/docs/guard/review-local-queue-contract.md

@@ -0,0 +1,51 @@
+## Review Local Queue Contract
+
+Guard Local owns live pending requests. Guard Cloud may mirror or reuse this data,
+but it does not replace the local queue.
+
+### Pending request payload
+
+Local pending request payload is already defined by
+`src/codex_plugin_scanner/guard/store_approvals.py` `_row_to_payload(...)` and is
+surfaced through both:
+
+- daemon `GET /v1/requests`
+- `build_runtime_snapshot(..., include_items=True)`
+
+Current payload keys include:
+
+- `request_id`
+- `harness`
+- `artifact_id`, `artifact_name`, `artifact_type`, `artifact_hash`
+- `policy_action`, `recommended_scope`, `source_scope`
+- `workspace`, `publisher`, `config_path`, `launch_target`
+- `action_identity`, `queue_group_id`, `dedupe_count`, `last_seen_at`
+- `risk_summary`, `risk_signals`, `why_now`, `trigger_summary`, `launch_summary`
+- `review_command`, `approval_url`
+- `status`, `resolution_action`, `resolution_scope`, `reason`
+- `created_at`, `resolved_at`
+
+### Resolution scopes
+
+Runtime ask-flow scopes currently exposed in
+`src/codex_plugin_scanner/guard/runtime/decisions.py` are:
+
+- `artifact`
+- `workspace`
+- `publisher`
+- `harness`
+
+Resolution logic in `src/codex_plugin_scanner/guard/approvals.py`
+`apply_approval_resolution(...)` also supports broader local persistence for:
+
+- `global`
+
+### Local lifecycle events
+
+Local queue lifecycle emits:
+
+- `approval.created` when a new pending request row is created
+- `approval.resolved` when a pending request is resolved
+
+Duplicate requeues reuse the first pending request id and should not emit a second
+`approval.created` event for the same pending row.

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.598"
+version = "2.0.599"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.598"
+version = "2.0.599"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/src/codex_plugin_scanner/guard/approvals.py

@@ -228,6 +228,7 @@ def queue_blocked_approvals(
             scanner_evidence=_item_scanner_evidence(item),
         )
         persisted_request_id = store.add_approval_request(request, timestamp)
+        created_new_request = persisted_request_id == request.request_id
         if persisted_request_id != request.request_id:
             request = replace(
                 request,
@@ -235,6 +236,8 @@ def queue_blocked_approvals(
                 review_command=f"{GUARD_COMMAND} approvals approve {persisted_request_id}",
                 approval_url=build_approval_request_url(approval_center_url, persisted_request_id),
             )
+        if created_new_request:
+            _record_created_event(store, request, timestamp)
         _notify_pending_approval(store=store, request=request)
         queued.append(request.to_dict())
     return queued
@@ -441,6 +444,25 @@ def _record_resolution_event(store: GuardStore, request_id: str, action: str, sc
     )
 
 
+def _record_created_event(store: GuardStore, request: GuardApprovalRequest, created_at: str) -> None:
+    store.add_event(
+        "approval.created",
+        {
+            "request_id": request.request_id,
+            "harness": request.harness,
+            "artifact_id": request.artifact_id,
+            "artifact_name": request.artifact_name,
+            "artifact_type": request.artifact_type,
+            "policy_action": request.policy_action,
+            "recommended_scope": request.recommended_scope,
+            "source_scope": request.source_scope,
+            "workspace": request.workspace,
+            "publisher": request.publisher,
+        },
+        created_at,
+    )
+
+
 def _refresh_queue_result(
     store: GuardStore,
     result: dict[str, object],

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.598"
+__version__ = "2.0.599"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/tests/test_guard_approvals.py

@@ -14,7 +14,7 @@ import pytest
 
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import bridge as guard_bridge_module
-from codex_plugin_scanner.guard.approvals import apply_approval_resolution, queue_blocked_approvals
+from codex_plugin_scanner.guard.approvals import build_runtime_snapshot, apply_approval_resolution, queue_blocked_approvals
 from codex_plugin_scanner.guard.bridge import BridgeConfig, GuardBridge
 from codex_plugin_scanner.guard.config import GuardConfig
 from codex_plugin_scanner.guard.consumer import artifact_hash, evaluate_detection
@@ -148,6 +148,42 @@ class TestGuardApprovals:
         assert resolved["action_envelope_json"] == action_envelope_json
         assert resolved["decision_v2_json"] == decision_v2_json
 
+    def test_guard_store_runtime_snapshot_exposes_pending_request_payload_contract(self, tmp_path):
+        store = GuardStore(tmp_path / "guard-home")
+        request = GuardApprovalRequest(
+            request_id="req-snapshot-contract",
+            harness="codex",
+            artifact_id="codex:project:workspace_skill",
+            artifact_name="workspace_skill",
+            artifact_hash="hash-snapshot-contract",
+            policy_action="require-reapproval",
+            recommended_scope="workspace",
+            changed_fields=("args",),
+            source_scope="project",
+            config_path=str(tmp_path / "workspace" / ".codex" / "config.toml"),
+            workspace=str(tmp_path / "workspace"),
+            review_command="hol-guard approvals approve req-snapshot-contract",
+            approval_url="http://127.0.0.1:4455/approvals/req-snapshot-contract",
+        )
+        store.add_approval_request(request, "2026-04-11T00:00:00+00:00")
+
+        snapshot = build_runtime_snapshot(
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-11T00:01:00+00:00",
+        )
+        queue_summary = snapshot["queue_summary"]
+        items = snapshot["items"]
+
+        assert snapshot["pending_count"] == 1
+        assert isinstance(queue_summary, dict)
+        assert queue_summary["next_request_id"] == "req-snapshot-contract"
+        assert isinstance(items, list)
+        assert items[0]["request_id"] == "req-snapshot-contract"
+        assert items[0]["recommended_scope"] == "workspace"
+        assert items[0]["review_command"] == "hol-guard approvals approve req-snapshot-contract"
+        assert items[0]["approval_url"] == "http://127.0.0.1:4455/approvals/req-snapshot-contract"
+
     def test_guard_store_loads_old_approval_rows_without_action_envelope(self, tmp_path):
         guard_home = tmp_path / "guard-home"
         guard_home.mkdir(parents=True, exist_ok=True)
@@ -521,7 +557,7 @@ class TestGuardApprovals:
             config_paths=(artifact.config_path,),
             artifacts=(artifact,),
         )
-        evaluation = {
+        evaluation: dict[str, object] = {
             "artifacts": [
                 {
                     "artifact_id": artifact.artifact_id,
@@ -641,6 +677,74 @@ class TestGuardApprovals:
         assert first[0]["request_id"] == second[0]["request_id"]
         assert notifications == [(first[0]["request_id"], False), (first[0]["request_id"], True)]
 
+    def test_guard_queue_blocked_approvals_emits_created_event_once_for_new_pending_request(self, tmp_path):
+        store = GuardStore(tmp_path / "guard-home")
+        workspace = tmp_path / "workspace"
+        artifact = GuardArtifact(
+            artifact_id="codex:runtime:project:danger_lab:event_notice",
+            name="danger_lab:event_notice",
+            harness="codex",
+            artifact_type="tool_call",
+            source_scope="project",
+            config_path=str(workspace / ".codex" / "config.toml"),
+            command="event_notice",
+        )
+        detection = HarnessDetection(
+            harness="codex",
+            installed=True,
+            command_available=True,
+            config_paths=(artifact.config_path,),
+            artifacts=(artifact,),
+        )
+        evaluation = {
+            "artifacts": [
+                {
+                    "artifact_id": artifact.artifact_id,
+                    "artifact_name": artifact.name,
+                    "artifact_hash": "hash-runtime",
+                    "artifact_type": artifact.artifact_type,
+                    "source_scope": artifact.source_scope,
+                    "config_path": artifact.config_path,
+                    "changed_fields": ["runtime_tool_call"],
+                    "policy_action": "require-reapproval",
+                    "launch_target": "event_notice",
+                }
+            ]
+        }
+
+        first = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-17T00:00:00+00:00",
+        )
+        second = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-17T00:01:00+00:00",
+        )
+        events = store.list_events_after(0, limit=10, event_names=("approval.created",))
+        payload = events[0]["payload"]
+
+        assert first[0]["request_id"] == second[0]["request_id"]
+        assert len(events) == 1
+        assert isinstance(payload, dict)
+        assert payload == {
+            "request_id": first[0]["request_id"],
+            "harness": "codex",
+            "artifact_id": artifact.artifact_id,
+            "artifact_name": artifact.name,
+            "artifact_type": artifact.artifact_type,
+            "policy_action": "require-reapproval",
+            "recommended_scope": "artifact",
+            "source_scope": "project",
+            "workspace": str(workspace),
+            "publisher": None,
+        }
+
     def test_guard_queue_respects_disabled_desktop_notifications(self, tmp_path, monkeypatch):
         notifications: list[str] = []
 
@@ -1850,8 +1954,11 @@ class TestGuardApprovals:
 
         assert status == 200
         assert payload["resolved"] is True
+        assert payload["resolved_request"]["request_id"] == request_id
         assert payload["resolved_request"]["resolution_action"] == ("allow" if action == "approve" else "block")
         assert payload["resolved_request"]["resolution_scope"] == scope
+        assert payload["resolved_request"]["approval_url"] == "http://127.0.0.1/pending"
+        assert payload["resolved_request"]["review_command"] == f"hol-guard approvals {action} {request_id}"
         assert payload["remaining_pending_count"] == 1
         assert payload["next_selectable_request_id"] == f"{request_id}-other"
         assert store.get_approval_request(f"{request_id}-other")["status"] == "pending"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.599}/tests/test_guard_phase05_approval_memory.py

@@ -875,6 +875,7 @@ def test_gr124_resolution_events_can_wake_polling_harness_clients(tmp_path: Path
 
     assert events[0]["payload"]["request_id"] == "req-event"
     assert events[0]["payload"]["action"] == "allow"
+    assert events[0]["payload"]["scope"] == "artifact"
 
 
 def test_gr122_duplicate_resolution_returns_idempotent_already_resolved_result(tmp_path: Path) -> None: