plugin-scanner 2.0.618__tar.gz → 2.0.619__tar.gz

{plugin_scanner-2.0.618 → plugin_scanner-2.0.619}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.618
+Version: 2.0.619
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.618 → plugin_scanner-2.0.619}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.618"
+version = "2.0.619"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.618 → plugin_scanner-2.0.619}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.618"
+version = "2.0.619"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.618/src/codex_plugin_scanner/cli.py → plugin_scanner-2.0.619/src/codex_plugin_scanner/_scanner_commands.py

@@ -1,4 +1,4 @@
-"""Plugin Scanner CLI entry point."""
+"""Scanner command runners for the combined CLI."""
 
 from __future__ import annotations
 
@@ -7,21 +7,12 @@ import json
 import os
 import sys
 import zipfile
+from collections.abc import Callable
 from dataclasses import asdict, replace
 from pathlib import Path
 
-from .argparse_utils import FriendlyArgumentParser, should_default_to_scan_target
-from .cli_ui import (
-    build_cli_epilog,
-    build_plain_text,
-    build_scan_help_epilog,
-    build_verification_text,
-    emit_hint,
-    emit_scan_provenance,
-)
+from .cli_ui import build_plain_text, build_verification_text, emit_hint, emit_scan_provenance
 from .config import DEFAULT_CONFIG_FILES, ConfigError, load_baseline_rule_ids, load_scanner_config
-from .ecosystems.registry import list_supported_ecosystems
-from .guard.cli import add_guard_parser, add_guard_root_parser, run_guard_command
 from .lint_fixes import apply_safe_autofixes
 from .models import ScanOptions, get_grade
 from .policy import POLICY_PROFILES, build_rule_inventory, evaluate_policy, resolve_profile
@@ -32,14 +23,11 @@ from .rules import get_rule_spec, list_rule_specs
 from .scanner import scan_plugin
 from .suppressions import apply_severity_overrides, apply_suppressions, compute_effective_score
 from .verification import build_doctor_report, build_verification_payload, verify_plugin
-from .version import __version__
 
+RuleSpecLookup = Callable[[str], object | None]
 
-def format_text(result) -> str:
-    return build_plain_text(result)
 
-
-def format_json(
+def _format_scan_json(
     result,
     *,
     profile: str = "default",
@@ -58,240 +46,13 @@ def format_json(
     )
 
 
-def _add_common_policy_args(parser: argparse.ArgumentParser) -> None:
-    parser.add_argument("--profile", choices=("default", "public-marketplace", "strict-security"))
-    parser.add_argument("--config", help="Path to a scanner config file such as .plugin-scanner.toml")
-    parser.add_argument("--baseline", help="Path to baseline suppression file")
-    parser.add_argument("--strict", action="store_true", help="Fail if any finding is present")
-    parser.add_argument("--diff-base", help="Not implemented yet. Guard exits with an error if this flag is used.")
-
-
-def _is_guard_program(program_name: str) -> bool:
-    normalized_name = Path(program_name).stem.lower()
-    return normalized_name in {"plugin-guard"}
-
-
-def _is_scanner_program(program_name: str) -> bool:
-    normalized_name = Path(program_name).stem.lower()
-    return normalized_name in {"plugin-scanner", "plugin-ecosystem-scanner"}
-
-
-def _build_parser(program_name: str, *, program_mode: str) -> argparse.ArgumentParser:
-    if program_mode == "guard":
-        parser = FriendlyArgumentParser(
-            prog=program_name,
-            description="Protect local harnesses before tools run.",
-            epilog=build_cli_epilog(program_name, include_guard=False),
-            formatter_class=argparse.RawDescriptionHelpFormatter,
-        )
-        parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
-        add_guard_root_parser(parser)
-        return parser
-
-    description = "Scan plugin ecosystems for CI and publish readiness."
-    if program_mode == "combined":
-        description = "Run HOL Guard locally or scan plugin ecosystems for CI and publish readiness."
-
-    parser = FriendlyArgumentParser(
-        prog=program_name,
-        description=description,
-        epilog=build_cli_epilog(program_name, include_guard=program_mode == "combined"),
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-    )
-    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
-    parser.add_argument("--list-ecosystems", action="store_true", help="List supported plugin ecosystems and exit")
-    subparsers = parser.add_subparsers(dest="command", parser_class=FriendlyArgumentParser)
-
-    scan_parser = subparsers.add_parser(
-        "scan",
-        help="Run full weighted scan",
-        epilog=build_scan_help_epilog(program_name),
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-    )
-    scan_parser.add_argument("plugin_dir")
-    scan_parser.add_argument("--json", action="store_true")
-    scan_parser.add_argument("--format", choices=("text", "json", "markdown", "sarif"), default="text")
-    scan_parser.add_argument("--output", "-o")
-    _add_common_policy_args(scan_parser)
-    scan_parser.add_argument("--min-score", type=int, default=0)
-    scan_parser.add_argument(
-        "--fail-on-severity",
-        choices=("none", "critical", "high", "medium", "low", "info"),
-        default="none",
-    )
-    scan_parser.add_argument(
-        "--cisco-skill-scan",
-        choices=("auto", "on", "off"),
-        default="auto",
-        help="Run Cisco skill scanning from the baseline install.",
-    )
-    scan_parser.add_argument(
-        "--cisco-mcp-scan",
-        choices=("auto", "on", "off"),
-        default="auto",
-        help="Run Cisco MCP static analysis. Requires the optional [cisco] extra on Python 3.11+.",
-    )
-    scan_parser.add_argument("--cisco-policy", choices=("permissive", "balanced", "strict"), default="balanced")
-    scan_parser.add_argument(
-        "--ecosystem",
-        choices=("auto", "codex", "claude", "gemini", "opencode"),
-        default="auto",
-        help="Target one ecosystem explicitly or auto-detect all supported ecosystems.",
-    )
-
-    lint_parser = subparsers.add_parser("lint", help="Run rule-level lint evaluation")
-    lint_parser.add_argument("plugin_dir", nargs="?", default=".")
-    _add_common_policy_args(lint_parser)
-    lint_parser.add_argument("--format", choices=("text", "json"), default="text")
-    lint_parser.add_argument("--list-rules", action="store_true")
-    lint_parser.add_argument("--explain")
-    lint_parser.add_argument("--fix", action="store_true")
-
-    verify_parser = subparsers.add_parser("verify", help="Run runtime verification checks")
-    verify_parser.add_argument("plugin_dir", nargs="?", default=".")
-    verify_parser.add_argument("--online", action="store_true")
-    verify_parser.add_argument("--format", choices=("text", "json"), default="text")
-
-    submit_parser = subparsers.add_parser("submit", help="Emit artifact after scan+verify+policy pass")
-    submit_parser.add_argument("plugin_dir", nargs="?", default=".")
-    submit_parser.add_argument("--profile", choices=("default", "public-marketplace", "strict-security"))
-    submit_parser.add_argument("--config")
-    submit_parser.add_argument("--baseline")
-    submit_parser.add_argument("--attest", required=True)
-    submit_parser.add_argument("--online", action="store_true")
-    submit_parser.add_argument(
-        "--min-score",
-        type=int,
-        default=None,
-        help="Override the minimum score gate. Defaults to the selected policy profile minimum.",
-    )
-
-    doctor_parser = subparsers.add_parser("doctor", help="Emit component diagnostics")
-    doctor_parser.add_argument("plugin_dir", nargs="?", default=".")
-    doctor_parser.add_argument(
-        "--component",
-        choices=("all", "manifest", "marketplace", "mcp", "skills", "apps", "assets"),
-        default="all",
-    )
-    doctor_parser.add_argument("--bundle")
-    if program_mode == "combined":
-        add_guard_parser(subparsers)
-
-    return parser
-
-
-def _is_hol_guard_program(program_name: str) -> bool:
-    return Path(program_name).stem.lower() == "hol-guard"
-
-
-def _resolve_legacy_args(
-    argv: list[str] | None,
-    *,
-    program_mode: str,
-    program_name: str = "",
-) -> list[str] | None:
-    if not argv:
-        if program_mode == "combined" and _is_hol_guard_program(program_name):
-            return ["guard"]
-        return argv
-    if program_mode == "guard":
-        if argv[0] == "guard":
-            return argv[1:]
-        if argv[0] == "hermes":
-            if len(argv) == 1:
-                return ["bootstrap", "hermes"]
-            if argv[1] == "bootstrap":
-                return ["bootstrap", "hermes", *argv[2:]]
-            if argv[1] == "pretool":
-                return ["hook", "--harness", "hermes", *argv[2:]]
-            if argv[1] == "mcp-proxy":
-                return ["hermes-mcp-proxy", *argv[2:]]
-        return argv
-    if program_mode == "combined" and argv[0] == "hook":
-        return ["guard", *argv]
-    if program_mode == "combined" and argv[0] == "hermes":
-        resolved_guard_args = _resolve_legacy_args(argv, program_mode="guard")
-        if resolved_guard_args is None:
-            return ["guard"]
-        return ["guard", *resolved_guard_args]
-    known_commands = {
-        "scan",
-        "lint",
-        "verify",
-        "submit",
-        "doctor",
-        "--version",
-        "--list-ecosystems",
-        "-h",
-        "--help",
-    }
-    if program_mode == "combined":
-        known_commands.add("guard")
-    if argv[0] in known_commands:
-        return argv
-    _guard_subcommands = {
-        "start",
-        "status",
-        "dashboard",
-        "init",
-        "apps",
-        "bootstrap",
-        "detect",
-        "install",
-        "update",
-        "uninstall",
-        "package-shims",
-        "run",
-        "protect",
-        "preflight",
-        "diff",
-        "receipts",
-        "history",
-        "inventory",
-        "abom",
-        "approvals",
-        "explain",
-        "allow",
-        "deny",
-        "policies",
-        "settings",
-        "exceptions",
-        "advisories",
-        "events",
-        "doctor",
-        "connect",
-        "remote-pair",
-        "disconnect",
-        "login",
-        "sync",
-        "device",
-        "bridge",
-        "daemon",
-        "hook",
-        "admin",
-        "cloud",
-        "supply-chain",
-        "service",
-        "codex-mcp-proxy",
-        "opencode-mcp-proxy",
-        "copilot-mcp-proxy",
-        "cursor-mcp-proxy",
-        "hermes-mcp-proxy",
-    }
-    if program_mode == "combined" and argv[0] in _guard_subcommands and "--format" not in argv:
-        return ["guard", *argv]
-    if not should_default_to_scan_target(argv[0], known_commands=known_commands):
-        return argv
-    return ["scan", *argv]
-
-
 def _print_lint_rules() -> None:
     for spec in list_rule_specs():
         print(f"{spec.rule_id}\t{spec.category}\t{spec.default_severity.value}\tfixable={spec.fixable}")
 
 
-def _print_lint_explain(rule_id: str) -> int:
-    spec = get_rule_spec(rule_id)
+def _print_lint_explain(rule_id: str, *, get_rule_spec_fn: RuleSpecLookup = get_rule_spec) -> int:
+    spec = get_rule_spec_fn(rule_id)
     if spec is None:
         print(f"Unknown rule id: {rule_id}", file=sys.stderr)
         emit_hint("run `lint --list-rules` to inspect the available rule identifiers.")
@@ -362,7 +123,7 @@ def _scan_with_policy(args: argparse.Namespace, plugin_dir: Path):
     return raw_result, result, profile, policy_eval, effective_score, config_path, baseline_path
 
 
-def _run_scan(args: argparse.Namespace) -> int:
+def run_scan(args: argparse.Namespace) -> int:
     plugin_dir = getattr(args, "plugin_dir", ".")
     resolved = Path(plugin_dir).resolve()
     if not resolved.is_dir():
@@ -380,7 +141,7 @@ def _run_scan(args: argparse.Namespace) -> int:
     if output_format == "text":
         emit_scan_provenance(profile=profile, config_path=config_path, baseline_path=baseline_path)
     if output_format == "json":
-        output = format_json(
+        output = _format_scan_json(
             result,
             profile=profile,
             policy_pass=policy_eval.policy_pass,
@@ -428,12 +189,12 @@ def _run_scan(args: argparse.Namespace) -> int:
     return 0
 
 
-def _run_lint(args: argparse.Namespace) -> int:
+def run_lint(args: argparse.Namespace, *, get_rule_spec_fn: RuleSpecLookup = get_rule_spec) -> int:
     if args.list_rules:
         _print_lint_rules()
         return 0
     if args.explain:
-        return _print_lint_explain(args.explain)
+        return _print_lint_explain(args.explain, get_rule_spec_fn=get_rule_spec_fn)
 
     resolved = Path(args.plugin_dir).resolve()
     if not resolved.is_dir():
@@ -462,7 +223,7 @@ def _run_lint(args: argparse.Namespace) -> int:
                 "category": finding.category,
                 "title": finding.title,
                 "description": finding.description,
-                "fixable": bool((spec := get_rule_spec(finding.rule_id)) and spec.fixable),
+                "fixable": bool((spec := get_rule_spec_fn(finding.rule_id)) and spec.fixable),
             }
             for finding in result.findings
         ],
@@ -479,7 +240,7 @@ def _run_lint(args: argparse.Namespace) -> int:
     return 0 if policy_eval.policy_pass else 1
 
 
-def _run_verify(args: argparse.Namespace) -> int:
+def run_verify(args: argparse.Namespace) -> int:
     resolved = Path(args.plugin_dir).resolve()
     if not resolved.is_dir():
         print(f'Error: "{resolved}" is not a directory.', file=sys.stderr)
@@ -493,7 +254,7 @@ def _run_verify(args: argparse.Namespace) -> int:
     return 0 if verification.verify_pass else 1
 
 
-def _run_submit(args: argparse.Namespace) -> int:
+def run_submit(args: argparse.Namespace) -> int:
     resolved = Path(args.plugin_dir).resolve()
     if not resolved.is_dir():
         print(f'Error: "{resolved}" is not a directory.', file=sys.stderr)
@@ -529,7 +290,7 @@ def _run_submit(args: argparse.Namespace) -> int:
     return 0
 
 
-def _run_doctor(args: argparse.Namespace) -> int:
+def run_doctor(args: argparse.Namespace) -> int:
     resolved = Path(args.plugin_dir).resolve()
     if not resolved.is_dir():
         print(f'Error: "{resolved}" is not a directory.', file=sys.stderr)
@@ -557,49 +318,3 @@ def _run_doctor(args: argparse.Namespace) -> int:
     else:
         print(rendered)
     return 0
-
-
-def main(argv: list[str] | None = None) -> int:
-    program_name = Path(sys.argv[0]).name or "plugin-scanner"
-    if _is_guard_program(program_name):
-        program_mode = "guard"
-    elif _is_scanner_program(program_name):
-        program_mode = "scanner"
-    else:
-        program_mode = "combined"
-    parser = _build_parser(program_name, program_mode=program_mode)
-    resolved_argv = _resolve_legacy_args(
-        argv or sys.argv[1:],
-        program_mode=program_mode,
-        program_name=program_name,
-    )
-    args = parser.parse_args(resolved_argv)
-    if getattr(args, "list_ecosystems", False):
-        for ecosystem in list_supported_ecosystems():
-            print(ecosystem)
-        return 0
-    if getattr(args, "diff_base", None):
-        parser.error("--diff-base is not implemented yet. Remove the flag and rerun without diff-aware gating.")
-    if args.command in {None, "scan"}:
-        return _run_scan(args)
-    if args.command == "lint":
-        return _run_lint(args)
-    if args.command == "verify":
-        return _run_verify(args)
-    if args.command == "submit":
-        return _run_submit(args)
-    if args.command == "doctor":
-        return _run_doctor(args)
-    if args.command == "guard":
-        try:
-            return run_guard_command(args)
-        except ValueError as exc:
-            parser.error(str(exc))
-        except Exception as exc:
-            print(str(exc), file=sys.stderr)
-            return 1
-    return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

{plugin_scanner-2.0.618 → plugin_scanner-2.0.619}/src/codex_plugin_scanner/action_runner.py

@@ -10,7 +10,7 @@ from pathlib import Path
 from urllib.error import HTTPError, URLError
 
 from . import __version__
-from .cli import _scan_with_policy
+from ._scanner_commands import _scan_with_policy
 from .cli_ui import build_plain_text, build_verification_text
 from .config import ConfigError, load_scanner_config
 from .github_reporting import (