plugin-scanner 2.0.605__tar.gz → 2.0.607__tar.gz

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.605
+Version: 2.0.607
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.605"
+version = "2.0.607"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.605"
+version = "2.0.607"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -164,7 +164,8 @@ def _finalize_guard_connect_payload(
     payload: dict[str, object],
     now: str,
 ) -> dict[str, object]:
-    payload.pop(CONNECT_SYNC_AUTH_CONTEXT_KEY, None)
+    sync_auth_context = payload.pop(CONNECT_SYNC_AUTH_CONTEXT_KEY, None)
+    resolved_sync_auth_context = sync_auth_context if isinstance(sync_auth_context, dict) else None
     urls = _guard_cloud_urls_for_connect(connect_url)
     for key in ("connect_url", "sync_url", "dashboard_url", "inbox_url", "fleet_url"):
         payload.setdefault(key, urls[key])
@@ -213,7 +214,10 @@ def _finalize_guard_connect_payload(
         return payload
     payload["sync_attempted"] = True
     try:
-        sync_payload = sync_local_guard_cloud_proof(store)
+        sync_payload = sync_local_guard_cloud_proof(
+            store,
+            auth_context=resolved_sync_auth_context,
+        )
     except GuardSyncNotAvailableError as error:
         store.record_latest_guard_connect_sync_result(
             status="connected",
@@ -249,7 +253,7 @@ def _finalize_guard_connect_payload(
             }
         )
         return payload
-    except RuntimeError as error:
+    except (RuntimeError, TimeoutError) as error:
         repair_message = (
             "Guard Cloud pairing finished, but the first proof sync is still pending. "
             "Local Guard will retry automatically while the daemon is running, or run hol-guard sync now."

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -1187,9 +1187,9 @@ def build_connect_status_payload(
     if action in {"repair", "re-pair"}:
         payload["repair_action"] = "rerun_connect"
         payload["repair_message"] = "Run hol-guard connect to start OAuth Device Code approval."
-    elif oauth_repair_required and cloud_profile is None:
-        payload["repair_message"] = "Run hol-guard connect again to repair local Guard Cloud authorization."
-    elif not bool(oauth_storage_health.get("configured")) and payload["status"] == "retry_required":
+    elif (oauth_repair_required and cloud_profile is None) or (
+        not bool(oauth_storage_health.get("configured")) and payload["status"] == "retry_required"
+    ):
         payload["repair_message"] = "Run hol-guard connect again to repair local Guard Cloud authorization."
     return payload
 

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -56,6 +56,7 @@ from ..approvals import (
     build_runtime_snapshot,
 )
 from ..cli.connect_flow import (
+    CONNECT_SYNC_AUTH_CONTEXT_KEY,
     _build_sync_auth_context,
     exchange_guard_authorization_code,
     resolve_connect_url,
@@ -478,6 +479,13 @@ def _queue_headless_cloud_sync(
                 "status": "in_progress",
                 "message": "Guard Cloud sync already running.",
             }
+        # This probe only short-circuits obviously overlapping cross-process work.
+        # sync_local_guard_cloud_proof() still acquires the real cloud sync lock.
+        if store.cloud_sync_in_progress():
+            return {
+                "status": "in_progress",
+                "message": "Guard Cloud sync already running.",
+            }
         _HEADLESS_CLOUD_SYNC_IN_FLIGHT.add(store_key)
 
     def _run_and_finalize() -> None:
@@ -677,7 +685,8 @@ def _finalize_daemon_guard_connect_payload(
     payload: dict[str, object],
     now: str,
 ) -> dict[str, object]:
-    payload.pop("_guard_sync_auth_context", None)
+    sync_auth_context = payload.pop(CONNECT_SYNC_AUTH_CONTEXT_KEY, None)
+    resolved_sync_auth_context = sync_auth_context if isinstance(sync_auth_context, dict) else None
     normalized_connect_url, allowed_origin = resolve_connect_url(connect_url)
     sync_url = f"{allowed_origin}/api/guard/receipts/sync"
     dashboard_url = f"{allowed_origin}/guard"
@@ -730,7 +739,10 @@ def _finalize_daemon_guard_connect_payload(
         return payload
     payload["sync_attempted"] = True
     try:
-        sync_payload = sync_local_guard_cloud_proof(store)
+        sync_payload = sync_local_guard_cloud_proof(
+            store,
+            auth_context=resolved_sync_auth_context,
+        )
     except GuardSyncNotAvailableError as error:
         store.record_latest_guard_connect_sync_result(
             status="connected",
@@ -766,7 +778,7 @@ def _finalize_daemon_guard_connect_payload(
             }
         )
         return payload
-    except RuntimeError as error:
+    except (RuntimeError, TimeoutError) as error:
         repair_message = (
             "Guard Cloud pairing finished, but the first proof sync is still pending. Local Guard will retry while "
             "the daemon is running."
@@ -1214,6 +1226,9 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         if parsed.path == "/v1/policy/sync":
             self._handle_headless_policy_sync(payload)
             return
+        if parsed.path == "/v1/requests/remote-once":
+            self._handle_headless_remote_once(payload)
+            return
         if parsed.path == "/v1/settings":
             self._handle_settings_update(payload)
             return
@@ -1822,6 +1837,111 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             }
         )
 
+    def _handle_headless_remote_once(self, payload: dict[str, object]) -> None:
+        harness = self._optional_string(payload.get("harness"))
+        if harness is None:
+            self._write_json({"error": "missing_harness"}, status=400)
+            return
+        try:
+            adapter = get_adapter(harness)
+        except ValueError:
+            self._write_json({"error": "unknown_harness"}, status=404)
+            return
+        remote_once = self._policy_memory_payload(payload.get("remote_once") or payload.get("remoteOnce"))
+        request_id = self._coalesce_string(remote_once, "request_id", "requestId")
+        request_last_seen_at = self._coalesce_string(remote_once, "request_last_seen_at", "requestLastSeenAt")
+        receipt_id = self._coalesce_string(remote_once, "receipt_id", "receiptId")
+        if request_id is None or request_last_seen_at is None or receipt_id is None:
+            self._write_json({"error": "missing_remote_once_fields"}, status=400)
+            return
+        if self._remote_once_receipt_replayed(receipt_id):
+            self._write_json({"error": "remote_once_replayed"}, status=409)
+            return
+        request_row = self.server.store.get_approval_request(request_id)  # type: ignore[attr-defined]
+        if not isinstance(request_row, dict) or request_row.get("status") != "pending":
+            self._write_json({"error": "remote_once_request_expired"}, status=409)
+            return
+        request_policy_action = self._optional_string(request_row.get("policy_action"))
+        request_recommended_scope = self._optional_string(request_row.get("recommended_scope"))
+        if request_policy_action not in {"review", "require-reapproval"} or request_recommended_scope != "artifact":
+            self._write_json({"error": "remote_once_not_permitted"}, status=409)
+            return
+        if self._optional_string(request_row.get("last_seen_at")) != request_last_seen_at:
+            self._write_json({"error": "remote_once_request_stale"}, status=409)
+            return
+        if not self.server.store.claim_remote_once_receipt(  # type: ignore[attr-defined]
+            receipt_id,
+            request_id=request_id,
+            claimed_at=_now(),
+        ):
+            self._write_json({"error": "remote_once_replayed"}, status=409)
+            return
+        try:
+            result = apply_approval_resolution(
+                store=self.server.store,  # type: ignore[attr-defined]
+                request_id=request_id,
+                action="allow",
+                scope="artifact",
+                workspace=self._optional_string(request_row.get("workspace")),
+                reason=self._optional_string(remote_once.get("reason")) or "Guard Cloud remote once approval",
+                return_queue_result=True,
+                resolve_scope_matches=False,
+                approval_gate_input=approval_gate_input_from_mapping(payload),
+            )
+        except ApprovalRequestNotFoundError:
+            self.server.store.release_remote_once_receipt(receipt_id)  # type: ignore[attr-defined]
+            self._write_json({"error": "remote_once_request_expired"}, status=409)
+            return
+        except ApprovalRequestAlreadyResolvedError:
+            self.server.store.release_remote_once_receipt(receipt_id)  # type: ignore[attr-defined]
+            self._write_json({"error": "remote_once_request_expired"}, status=409)
+            return
+        except ApprovalGateError as error:
+            self._write_approval_gate_error(error)
+            return
+        except ValueError as error:
+            self._write_json({"error": str(error)}, status=400)
+            return
+        if result.get("resolved") is not True:
+            self._write_json({"error": "remote_once_apply_failed"}, status=409)
+            return
+        resolved_request = result.get("resolved_request") if isinstance(result.get("resolved_request"), dict) else {}
+        resolved_at = self._optional_string(resolved_request.get("resolved_at")) or _now()
+        self.server.store.add_event(  # type: ignore[attr-defined]
+            "approval.remote_once_applied",
+            {
+                "approval_url": self._optional_string(resolved_request.get("approval_url")),
+                "receipt_id": receipt_id,
+                "request_id": request_id,
+                "review_command": self._optional_string(resolved_request.get("review_command")),
+                "scope": "artifact",
+            },
+            resolved_at,
+        )
+        artifact_name = self._optional_string(request_row.get("artifact_name")) or request_id
+        receipt = self._record_headless_receipt(
+            harness=adapter.harness,
+            operation="remote_once",
+            payload=payload,
+            result=result,
+            workspace_id=self._optional_string(request_row.get("workspace")),
+            artifact_name=f"Remote once approval for {artifact_name}",
+            scanner_evidence_extra={
+                "receipt_id": receipt_id,
+                "request_id": request_id,
+            },
+        )
+        self._write_json(
+            {
+                "harness": adapter.harness,
+                "operation": "remote_once",
+                "receipt": receipt,
+                "request_id": request_id,
+                "resolved_request": resolved_request,
+                "status": "completed",
+            }
+        )
+
     def _handle_audit_remediation(self, action: str, payload: dict[str, object]) -> None:
         if action != "package_shim_path":
             self._write_json({"error": "unsupported_remediation", "operation": action}, status=404)
@@ -2294,6 +2414,9 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             return parsed if isinstance(parsed, dict) else {}
         return {}
 
+    def _remote_once_receipt_replayed(self, receipt_id: str) -> bool:
+        return self.server.store.has_remote_once_receipt(receipt_id)  # type: ignore[attr-defined]
+
     def _record_headless_receipt(
         self,
         *,
@@ -3420,6 +3543,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             "/v1/operations/start",
             "/v1/operations/block",
             "/v1/requests/clear",
+            "/v1/requests/remote-once",
             "/v1/settings/import",
             "/v1/settings/reset",
             "/v1/policy/clear",
@@ -3691,6 +3815,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             "/v1/receipts/latest",
             "/v1/requests",
             "/v1/requests/clear",
+            "/v1/requests/remote-once",
             "/v1/runtime",
             "/v1/settings",
             "/v1/settings/export",
@@ -3885,6 +4010,13 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             return value.strip()
         return None
 
+    def _coalesce_string(self, mapping: dict[str, object], *keys: str) -> str | None:
+        for key in keys:
+            value = self._optional_string(mapping.get(key))
+            if value is not None:
+                return value
+        return None
+
     @staticmethod
     def _query_string(query_string: str, key: str) -> str | None:
         value = parse_qs(query_string).get(key, [None])[-1]
@@ -4055,6 +4187,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             "/v1/policy/clear",
             "/v1/policy/sync",
             "/v1/requests/clear",
+            "/v1/requests/remote-once",
             "/v1/settings",
             "/v1/settings/import",
             "/v1/settings/reset",

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -1899,39 +1899,39 @@ def sync_local_guard_cloud_proof(
     auth_context: dict[str, object] | None = None,
 ) -> dict[str, object]:
     """Publish the local Guard runtime session before syncing receipts."""
-
-    resolved_auth_context = auth_context if auth_context is not None else _resolve_guard_sync_auth_context(store)
-    runtime_summary = sync_runtime_session(
-        store,
-        session=_local_guard_runtime_session(),
-        auth_context=resolved_auth_context,
-    )
-    receipts_summary = sync_receipts(
-        store,
-        persist_sync_summary=False,
-        persist_connect_state=False,
-        auth_context=resolved_auth_context,
-    )
-    summary = dict(receipts_summary)
-    summary.update(
-        {
-            "runtime_session_id": runtime_summary.get("runtime_session_id"),
-            "runtime_session_synced_at": runtime_summary.get("runtime_session_synced_at"),
-            "runtime_sessions_visible": runtime_summary.get("runtime_sessions_visible"),
-            "local_guard_online_at": runtime_summary.get("local_guard_online_at")
-            or receipts_summary.get("local_guard_online_at"),
-            "runtime_harness": runtime_summary.get("runtime_harness"),
-            "runtime_surface": runtime_summary.get("runtime_surface"),
-            "runtime_workspace": runtime_summary.get("runtime_workspace"),
-            "runtime_device_id": runtime_summary.get("runtime_device_id"),
-            "runtime": runtime_summary,
-            "receipts": dict(receipts_summary),
-        }
-    )
-    recorded_at = str(summary.get("synced_at") or summary.get("runtime_session_synced_at") or _now())
-    store.set_sync_payload("sync_summary", summary, recorded_at)
-    store.record_latest_guard_connect_sync_success(sync_payload=summary, now=recorded_at)
-    return summary
+    with store.hold_cloud_sync_lock():
+        resolved_auth_context = auth_context if auth_context is not None else _resolve_guard_sync_auth_context(store)
+        runtime_summary = sync_runtime_session(
+            store,
+            session=_local_guard_runtime_session(),
+            auth_context=resolved_auth_context,
+        )
+        receipts_summary = sync_receipts(
+            store,
+            persist_sync_summary=False,
+            persist_connect_state=False,
+            auth_context=resolved_auth_context,
+        )
+        summary = dict(receipts_summary)
+        summary.update(
+            {
+                "runtime_session_id": runtime_summary.get("runtime_session_id"),
+                "runtime_session_synced_at": runtime_summary.get("runtime_session_synced_at"),
+                "runtime_sessions_visible": runtime_summary.get("runtime_sessions_visible"),
+                "local_guard_online_at": runtime_summary.get("local_guard_online_at")
+                or receipts_summary.get("local_guard_online_at"),
+                "runtime_harness": runtime_summary.get("runtime_harness"),
+                "runtime_surface": runtime_summary.get("runtime_surface"),
+                "runtime_workspace": runtime_summary.get("runtime_workspace"),
+                "runtime_device_id": runtime_summary.get("runtime_device_id"),
+                "runtime": runtime_summary,
+                "receipts": dict(receipts_summary),
+            }
+        )
+        recorded_at = str(summary.get("synced_at") or summary.get("runtime_session_synced_at") or _now())
+        store.set_sync_payload("sync_summary", summary, recorded_at)
+        store.record_latest_guard_connect_sync_success(sync_payload=summary, now=recorded_at)
+        return summary
 
 
 def sync_pain_signals(

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/src/codex_plugin_scanner/guard/store.py

@@ -181,6 +181,8 @@ _SECRET_FINGERPRINT_PREFIX = "pbkdf2-sha256$"
 _SECRET_FINGERPRINT_SALT = b"hol-guard-secret-fingerprint:v1"
 _OAUTH_REFRESH_LOCK_TIMEOUT_SECONDS = 30.0
 _OAUTH_REFRESH_LOCK_POLL_SECONDS = 0.05
+_CLOUD_SYNC_LOCK_TIMEOUT_SECONDS = 30.0
+_CLOUD_SYNC_LOCK_POLL_SECONDS = 0.05
 _GUARD_STORE_PRIVATE_DIR_MODE = 0o700
 _GUARD_STORE_PRIVATE_FILE_MODE = 0o600
 
@@ -951,6 +953,44 @@ class GuardStore:
                 with suppress(OSError):
                     _release_advisory_file_lock(handle)
 
+    @contextmanager
+    def hold_cloud_sync_lock(
+        self,
+        *,
+        timeout_seconds: float = _CLOUD_SYNC_LOCK_TIMEOUT_SECONDS,
+    ) -> Iterator[None]:
+        lock_path = self.guard_home / "cloud-sync.lock"
+        deadline = time.monotonic() + max(timeout_seconds, 0.0)
+        with lock_path.open("a+b") as handle:
+            while True:
+                try:
+                    _acquire_advisory_file_lock(handle)
+                    break
+                except BlockingIOError:
+                    if time.monotonic() >= deadline:
+                        raise TimeoutError("Timed out waiting for Guard Cloud sync lock.") from None
+                    time.sleep(_CLOUD_SYNC_LOCK_POLL_SECONDS)
+            try:
+                yield
+            finally:
+                with suppress(OSError):
+                    _release_advisory_file_lock(handle)
+
+    def cloud_sync_in_progress(self) -> bool:
+        lock_path = self.guard_home / "cloud-sync.lock"
+        with lock_path.open("a+b") as handle:
+            try:
+                # This is an advisory probe, not a reservation: callers must still
+                # acquire hold_cloud_sync_lock() for the actual sync critical section.
+                _acquire_advisory_file_lock(handle)
+            except BlockingIOError:
+                return True
+            try:
+                return False
+            finally:
+                with suppress(OSError):
+                    _release_advisory_file_lock(handle)
+
     def _initialize(self) -> None:
         statements = (
             """
@@ -1110,6 +1150,13 @@ class GuardStore:
             )
             """,
             """
+            create table if not exists guard_remote_once_receipts (
+              receipt_id text primary key,
+              request_id text not null,
+              claimed_at text not null
+            )
+            """,
+            """
             create table if not exists guard_cloud_events (
               event_id text primary key,
               idempotency_key text not null unique,
@@ -3473,6 +3520,42 @@ class GuardStore:
                 (event_name, json.dumps(payload), now),
             )
 
+    def claim_remote_once_receipt(
+        self,
+        receipt_id: str,
+        *,
+        request_id: str,
+        claimed_at: str,
+    ) -> bool:
+        with self._connect() as connection:
+            connection.execute("begin immediate")
+            try:
+                connection.execute(
+                    """
+                    insert into guard_remote_once_receipts (receipt_id, request_id, claimed_at)
+                    values (?, ?, ?)
+                    """,
+                    (receipt_id, request_id, claimed_at),
+                )
+            except sqlite3.IntegrityError:
+                return False
+            return True
+
+    def release_remote_once_receipt(self, receipt_id: str) -> None:
+        with self._connect() as connection:
+            connection.execute(
+                "delete from guard_remote_once_receipts where receipt_id = ?",
+                (receipt_id,),
+            )
+
+    def has_remote_once_receipt(self, receipt_id: str) -> bool:
+        with self._connect() as connection:
+            row = connection.execute(
+                "select 1 from guard_remote_once_receipts where receipt_id = ?",
+                (receipt_id,),
+            ).fetchone()
+        return row is not None
+
     def list_events(self, limit: int = 100, event_name: str | None = None) -> list[dict[str, object]]:
         query = """
             select event_id, event_name, payload_json, occurred_at

{plugin_scanner-2.0.605 → plugin_scanner-2.0.607}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.605"
+__version__ = "2.0.607"