plugin-scanner 2.0.633__tar.gz → 2.0.635__tar.gz

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.633
+Version: 2.0.635
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/dashboard/src/supply-chain-audit-findings-summary.tsx

@@ -1,13 +1,12 @@
 import { useMemo } from "react";
 import { HiMiniBugAnt, HiMiniExclamationTriangle } from "react-icons/hi2";
-import { SectionLabel, Tag, EmptyState, ActionButton } from "./approval-center-primitives";
+import { SectionLabel, Tag, EmptyState } from "./approval-center-primitives";
 import { formatRelativeTime } from "./approval-center-utils";
 import type { SupplyChainAuditFinding, SupplyChainAuditSnapshot } from "./guard-types";
 
 type SupplyChainAuditFindingsSummaryProps = {
   auditSnapshot: SupplyChainAuditSnapshot | null;
   auditRunning: boolean;
-  onRunAudit?: () => void;
 };
 
 const decisionPriority: Record<string, number> = {
@@ -102,7 +101,6 @@ function FindingSummaryRow({ finding }: FindingSummaryRowProps) {
 export function SupplyChainAuditFindingsSummary({
   auditSnapshot,
   auditRunning,
-  onRunAudit,
 }: SupplyChainAuditFindingsSummaryProps) {
   const topFindings = useMemo(() => {
     if (auditSnapshot === null) {
@@ -147,13 +145,6 @@ export function SupplyChainAuditFindingsSummary({
                 : "Run an audit from the firewall panel to see package risks here."
             }
             tone="teach"
-            action={
-              auditRunning || onRunAudit === undefined ? undefined : (
-                <ActionButton variant="primary" onClick={onRunAudit}>
-                  Run audit
-                </ActionButton>
-              )
-            }
           />
         </div>
       ) : topFindings.length === 0 ? (

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/dashboard/src/supply-chain-firewall-controls.tsx

@@ -16,7 +16,6 @@ import {
 } from "./supply-chain-firewall-views";
 import { resolvePackageFirewallNextAction } from "./supply-chain-firewall-next-action";
 import { ManagerRow, resolveShimStatus } from "./supply-chain-firewall-manager-row";
-import { SupplyChainManagerCards } from "./supply-chain-manager-cards";
 
 export type FirewallOpKey = PackageFirewallActionType | "audit" | "sync";
 
@@ -221,13 +220,6 @@ export function FirewallControlsView({
         protection={data.protection}
       />
 
-      <SupplyChainManagerCards
-        managers={
-          data.supported_managers.length > 0 ? data.supported_managers : data.detected_managers
-        }
-        shims={data.package_shims}
-      />
-
       {lastFailed !== null && <FailureBanner failed={lastFailed} />}
 
       {lastCompleted !== null && (

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/dashboard/src/supply-chain-issue-focus.tsx

@@ -16,6 +16,7 @@ type SupplyChainIssueFocusProps = {
   issues: SupplyChainIssue[];
   onIssueAction: (action: SupplyChainIssueAction) => void;
   actionPending?: boolean;
+  tagline?: React.ReactNode;
 };
 
 function issueSurfaceClass(tone: SupplyChainIssue["tone"]): string {
@@ -58,6 +59,7 @@ export function SupplyChainIssueFocus({
   issues,
   onIssueAction,
   actionPending = false,
+  tagline,
 }: SupplyChainIssueFocusProps) {
   const [activeIndex, setActiveIndex] = useState(0);
 
@@ -116,6 +118,12 @@ export function SupplyChainIssueFocus({
         ) : null}
       </div>
 
+      {tagline ? (
+        <div className="border-b border-black/[0.04] px-4 py-2.5 sm:px-5 bg-white/60">
+          {tagline}
+        </div>
+      ) : null}
+
       <div className="px-4 py-5 sm:px-6 sm:py-6">
         <div className="flex items-start gap-3">
           <span

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/dashboard/src/supply-chain-workspace.tsx

@@ -18,7 +18,6 @@ import type {
 } from "./guard-types";
 import { derivePackageWorkbenchFromReceipts, fetchReceipts, normalizeSupplyChainAuditSnapshot } from "./guard-api";
 import { PackageFirewallPanel, type PackageFirewallPanelHandle } from "./supply-chain-firewall-panel";
-import { PackageWorkbenchPanel } from "./package-workbench-panel";
 import { SupplyChainBundlePanel } from "./supply-chain-bundle-panel";
 import {
   deriveSupplyChainEvidenceRail,
@@ -215,10 +214,6 @@ export function SupplyChainWorkspace({
     setAuditRunning(running);
   }, []);
 
-  const handleRunAudit = useCallback(() => {
-    runAuditRef.current?.();
-  }, []);
-
   return (
     <div className={SUPPLY_CHAIN_WORKSPACE_SHELL_CLASS} data-testid="supply-chain-workspace">
       <div className="flex flex-wrap items-start justify-end gap-3">
@@ -227,7 +222,9 @@ export function SupplyChainWorkspace({
         </ActionButton>
       </div>
 
-      <SupplyChainWorkspaceHero hero={workspaceHero} compact={supplyChainIssues.length > 0} />
+      {supplyChainIssues.length === 0 ? (
+        <SupplyChainWorkspaceHero hero={workspaceHero} />
+      ) : null}
 
       <SupplyChainIssueFocus
         issues={supplyChainIssues}
@@ -235,6 +232,18 @@ export function SupplyChainWorkspace({
           void handleIssueAction(action);
         }}
         actionPending={issueActionPending}
+        tagline={
+          <div className="flex flex-wrap items-center gap-2">
+            <Tag tone={(() => {
+              if (workspaceHero.cloudMode === "paired_active") return "green" as const;
+              if (workspaceHero.cloudMode === "paired_waiting") return "blue" as const;
+              return "attention" as const;
+            })()}>
+              {workspaceHero.cloudLabel}
+            </Tag>
+            <span className="text-xs text-slate-500">{workspaceHero.statLine}</span>
+          </div>
+        }
       />
 
       {supplyChainIssues.length === 0 ? (
@@ -246,7 +255,6 @@ export function SupplyChainWorkspace({
       <SupplyChainAuditFindingsSummary
         auditSnapshot={auditSnapshot}
         auditRunning={auditRunning}
-        onRunAudit={handleRunAudit}
       />
 
       <SupplyChainBundlePanel />
@@ -260,12 +268,6 @@ export function SupplyChainWorkspace({
         runAuditRef={runAuditRef}
       />
 
-      <PackageWorkbenchPanel
-        auditSnapshot={auditSnapshot}
-        onRunAudit={handleRunAudit}
-        auditRunning={auditRunning}
-      />
-
       <div className="rounded-2xl border border-slate-100 bg-white shadow-sm">
         <div className="border-b border-slate-100 px-4 py-3">
           <SectionLabel>Connected apps</SectionLabel>

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.633"
+version = "2.0.635"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.633"
+version = "2.0.635"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/src/codex_plugin_scanner/guard/adapters/grok_config.py

@@ -6,6 +6,7 @@ import json
 import re
 from pathlib import Path
 
+from ..aibom_detection import enrich_mcp_server_metadata
 from ..models import GuardArtifact
 from .base import _json_payload
 
@@ -169,6 +170,22 @@ def append_permission_artifacts(
             )
 
 
+def _mcp_env_keys(server_config: dict[str, object]) -> list[str]:
+    keys: set[str] = set()
+    for field in ("env", "environment"):
+        value = server_config.get(field)
+        if isinstance(value, dict):
+            keys.update(key for key in value if isinstance(key, str))
+    return sorted(keys)
+
+
+def _mcp_headers_keys(server_config: dict[str, object]) -> list[str]:
+    headers = server_config.get("headers")
+    if not isinstance(headers, dict):
+        return []
+    return sorted(key for key in headers if isinstance(key, str))
+
+
 def append_mcp_artifacts(
     *,
     harness: str,
@@ -195,6 +212,18 @@ def append_mcp_artifacts(
             continue
         raw_args = server_config.get("args")
         args = tuple(str(item) for item in raw_args) if isinstance(raw_args, list) else ()
+        transport = "http" if isinstance(url, str) else "stdio"
+        metadata = enrich_mcp_server_metadata(
+            {
+                "name": server_name,
+                "env_keys": _mcp_env_keys(server_config),
+                "headers_keys": _mcp_headers_keys(server_config),
+            },
+            command=command if isinstance(command, str) else None,
+            args=args,
+            url=url if isinstance(url, str) else None,
+            transport=transport,
+        )
         artifacts.append(
             GuardArtifact(
                 artifact_id=f"{harness}:{scope}:mcp:{server_name}",
@@ -206,7 +235,8 @@ def append_mcp_artifacts(
                 command=command if isinstance(command, str) else None,
                 args=args,
                 url=url if isinstance(url, str) else None,
-                transport="http" if isinstance(url, str) else "stdio",
+                transport=transport,
+                metadata=metadata,
             )
         )
 

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/src/codex_plugin_scanner/guard/aibom_detection.py

@@ -106,6 +106,7 @@ def mcp_server_content_hash(
     url: str | None,
     transport: str | None,
     env_keys: tuple[str, ...] = (),
+    headers_keys: tuple[str, ...] = (),
 ) -> str:
     return fingerprint_mapping(
         {
@@ -114,6 +115,7 @@ def mcp_server_content_hash(
             "url": url,
             "transport": transport,
             "env_keys": sorted(env_keys),
+            "headers_keys": sorted(headers_keys),
         }
     )
 
@@ -631,12 +633,17 @@ def enrich_mcp_server_metadata(
     normalized_env_keys: tuple[str, ...] = ()
     if isinstance(env_keys, list):
         normalized_env_keys = tuple(str(key) for key in env_keys if isinstance(key, str))
+    headers_keys = metadata.get("headers_keys")
+    normalized_headers_keys: tuple[str, ...] = ()
+    if isinstance(headers_keys, list):
+        normalized_headers_keys = tuple(str(key) for key in headers_keys if isinstance(key, str))
     content_hash = mcp_server_content_hash(
         command=command,
         args=args,
         url=url,
         transport=transport,
         env_keys=normalized_env_keys,
+        headers_keys=normalized_headers_keys,
     )
     enriched = dict(metadata)
     enriched["content_hash"] = content_hash

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.633"
+__version__ = "2.0.635"

{plugin_scanner-2.0.633 → plugin_scanner-2.0.635}/tests/test_grok_adapter.py

@@ -326,6 +326,124 @@ args = ["-y", "@modelcontextprotocol/server-github"]
         mcp = [artifact for artifact in result.artifacts if artifact.artifact_type == "mcp_server"]
         assert any(artifact.name == "github" for artifact in mcp)
 
+    def test_mcp_env_keys_and_headers_in_metadata(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".grok" / "config.toml"
+        config.parent.mkdir(parents=True, exist_ok=True)
+        config.write_text(
+            """
+[mcp_servers.github]
+command = "npx"
+args = ["-y", "@modelcontextprotocol/server-github"]
+
+[mcp_servers.github.env]
+GITHUB_TOKEN = "redacted"
+
+[mcp_servers.remote]
+url = "https://mcp.example.com/mcp"
+
+[mcp_servers.remote.headers]
+Authorization = "Bearer redacted"
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        result = GrokHarnessAdapter().detect(ctx)
+        github = next(artifact for artifact in result.artifacts if artifact.name == "github")
+        remote = next(artifact for artifact in result.artifacts if artifact.name == "remote")
+        assert github.metadata["env_keys"] == ["GITHUB_TOKEN"]
+        assert remote.metadata["headers_keys"] == ["Authorization"]
+        assert github.metadata["versionInfo"]["versionLabel"] == "github"
+        assert remote.metadata["versionInfo"]["versionLabel"] == "remote"
+
+    def test_mcp_env_change_changes_artifact_hash(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.consumer import artifact_hash
+
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".grok" / "config.toml"
+        config.parent.mkdir(parents=True, exist_ok=True)
+        config.write_text(
+            """
+[mcp_servers.github]
+command = "npx"
+args = ["-y", "@modelcontextprotocol/server-github"]
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        adapter = GrokHarnessAdapter()
+        baseline = next(artifact for artifact in adapter.detect(ctx).artifacts if artifact.name == "github")
+        config.write_text(
+            """
+[mcp_servers.github]
+command = "npx"
+args = ["-y", "@modelcontextprotocol/server-github"]
+
+[mcp_servers.github.env]
+GITHUB_TOKEN = "redacted"
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        changed = next(artifact for artifact in adapter.detect(ctx).artifacts if artifact.name == "github")
+        assert artifact_hash(baseline) != artifact_hash(changed)
+        assert changed.metadata["env_keys"] == ["GITHUB_TOKEN"]
+
+    def test_mcp_headers_change_changes_artifact_hash(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.consumer import artifact_hash
+
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".grok" / "config.toml"
+        config.parent.mkdir(parents=True, exist_ok=True)
+        config.write_text(
+            """
+[mcp_servers.remote]
+url = "https://mcp.example.com/mcp"
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        adapter = GrokHarnessAdapter()
+        baseline = next(artifact for artifact in adapter.detect(ctx).artifacts if artifact.name == "remote")
+        config.write_text(
+            """
+[mcp_servers.remote]
+url = "https://mcp.example.com/mcp"
+
+[mcp_servers.remote.headers]
+Authorization = "Bearer redacted"
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        changed = next(artifact for artifact in adapter.detect(ctx).artifacts if artifact.name == "remote")
+        assert artifact_hash(baseline) != artifact_hash(changed)
+        assert changed.metadata["headers_keys"] == ["Authorization"]
+        assert baseline.metadata["versionInfo"]["contentHash"] != changed.metadata["versionInfo"]["contentHash"]
+
+    def test_mcp_credential_env_emits_secret_risk_signals(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.risk import artifact_risk_signals_typed
+
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".grok" / "config.toml"
+        config.parent.mkdir(parents=True, exist_ok=True)
+        config.write_text(
+            """
+[mcp_servers.github]
+command = "npx"
+args = ["-y", "@modelcontextprotocol/server-github"]
+
+[mcp_servers.github.env]
+GITHUB_TOKEN = "redacted"
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        artifact = next(artifact for artifact in GrokHarnessAdapter().detect(ctx).artifacts if artifact.name == "github")
+        signal_ids = {signal.signal_id for signal in artifact_risk_signals_typed(artifact)}
+        assert "secret:env-keys" in signal_ids
+        assert "secret:env-semantic" in signal_ids
+
     def test_detects_degraded_always_approve_signal(self, tmp_path: Path) -> None:
         ctx = _ctx(tmp_path)
         config = ctx.home_dir / ".grok" / "config.toml"