plugin-scanner 2.0.649__tar.gz → 2.0.651__tar.gz

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.649
+Version: 2.0.651
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/dashboard/src/supply-chain-ux-consolidation.test.ts

@@ -31,6 +31,14 @@ assert(
   workspaceSource.includes("PackageWorkbenchPanel"),
   "workspace keeps single audit findings workbench",
 );
+assert(
+  workspaceSource.includes("supply-chain-workspace-hero-state"),
+  "workspace imports supply chain hero state helpers",
+);
+assert(
+  workspaceSource.includes("resolveSupplyChainWorkspaceHero"),
+  "workspace resolves hero state for status header",
+);
 assert(
   !controlsSource.includes("NextActionHero"),
   "firewall controls drop duplicate next-step hero",

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/dashboard/src/supply-chain-workspace.tsx

@@ -32,6 +32,7 @@ import { SupplyChainCloudCapabilitiesPanel } from "./supply-chain-cloud-capabili
 import { PackageWorkbenchPanel } from "./package-workbench-panel";
 import { resolveSupplyChainIssues, type SupplyChainIssueAction } from "./supply-chain-issues";
 import { resolveSupplyChainAuditWorkspaceDir } from "./supply-chain-audit-workspace";
+import { resolveSupplyChainWorkspaceHero } from "./supply-chain-workspace-hero-state";
 import { SupplyChainStatusHeader } from "./supply-chain-status-header";
 import { SUPPLY_CHAIN_WORKSPACE_SHELL_CLASS } from "./supply-chain-workspace-layout";
 

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.649"
+version = "2.0.651"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.649"
+version = "2.0.651"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/src/codex_plugin_scanner/guard/adapters/antigravity.py

@@ -211,27 +211,37 @@ class AntigravityHarnessAdapter(HarnessAdapter):
             if manifest_payload:
                 self._append_found_path(found_paths, manifest_path)
             publisher = (
-                manifest_payload.get("publisher") if isinstance(manifest_payload.get("publisher"), str) else None
+                manifest_payload.get("publisher")
+                if manifest_payload is not None and isinstance(manifest_payload.get("publisher"), str)
+                else None
             )
             if publisher is None and isinstance(metadata, dict):
                 publisher_display_name = metadata.get("publisherDisplayName")
                 if isinstance(publisher_display_name, str):
                     publisher = publisher_display_name
+            display_name = (
+                manifest_payload.get("displayName")
+                if manifest_payload is not None and isinstance(manifest_payload.get("displayName"), str)
+                else None
+            )
+            manifest_description = (
+                manifest_payload.get("description")
+                if manifest_payload is not None and isinstance(manifest_payload.get("description"), str)
+                else None
+            )
             artifacts.append(
                 GuardArtifact(
                     artifact_id=f"antigravity:global:{extension_id}",
-                    name=extension_id,
+                    name=display_name or extension_id,
                     harness=self.harness,
                     artifact_type="extension",
                     source_scope="global",
                     config_path=str(manifest_path if manifest_payload else Path(location_path)),
                     publisher=publisher,
                     metadata={
-                        "display_name": (
-                            manifest_payload.get("displayName")
-                            if isinstance(manifest_payload.get("displayName"), str)
-                            else None
-                        )
+                        "display_name": display_name,
+                        "description": manifest_description,
+                        "extension_id": extension_id,
                     },
                 )
             )

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/supply-chain-workspace.js

@@ -2473,6 +2473,85 @@ function resolveSupplyChainIssues(snapshot) {
   }
   return issues;
 }
+function protectionTitle(status) {
+  if (status === "protected") {
+    return "Package installs are protected on this device";
+  }
+  if (status === "partial") {
+    return "Protection is only partly set up";
+  }
+  if (status === "staged") {
+    return "Finish setup in a new terminal";
+  }
+  if (status === "unprotected") {
+    return "Package installs are not protected yet";
+  }
+  return "Checking package protection on this device";
+}
+function protectionDetail(snapshot, status) {
+  const protection = snapshot.supply_chain?.package_manager_protection;
+  if (status === "protected" && protection) {
+    return `${protection.protected_managers.length} package tool${protection.protected_managers.length === 1 ? "" : "s"} active. Guard can block risky installs before they run.`;
+  }
+  if (status === "partial" && protection) {
+    return `${protection.unprotected_managers.length} tool${protection.unprotected_managers.length === 1 ? "" : "s"} still open: ${protection.unprotected_managers.join(", ")}.`;
+  }
+  if (status === "staged") {
+    return "Guard updated your shell profile. Open a new terminal, then run a protection test.";
+  }
+  if (status === "unprotected") {
+    return "Turn on protection for npm, pip, and other tools in the firewall panel below.";
+  }
+  return "Refresh status after installing package tools on this machine.";
+}
+function protectionTone(status) {
+  if (status === "protected") {
+    return "green";
+  }
+  if (status === "staged") {
+    return "blue";
+  }
+  if (status === "partial" || status === "unprotected") {
+    return "attention";
+  }
+  return "slate";
+}
+function cloudLabel(snapshot) {
+  const label = snapshot.cloud_state_label ?? "";
+  if (snapshot.cloud_state === "paired_active") {
+    return label.trim().length > 0 ? label : "Guard Cloud connected";
+  }
+  if (snapshot.cloud_state === "paired_waiting") {
+    return label.trim().length > 0 ? label : "Pairing in progress";
+  }
+  return label.trim().length > 0 ? label : "On this device only";
+}
+function resolveSupplyChainWorkspaceHero(snapshot, options) {
+  const protectionStatus = resolveHomeProtectionStatus(snapshot);
+  const stats = buildSupplyChainStats(snapshot);
+  const preventedLabel = stats.preventedInstalls > 0 ? `${stats.preventedInstalls} blocked install${stats.preventedInstalls === 1 ? "" : "s"}` : "No blocked installs yet";
+  const openIssueCount = options?.openIssueCount ?? 0;
+  if (openIssueCount > 0) {
+    return {
+      cloudMode: snapshot.cloud_state,
+      cloudLabel: cloudLabel(snapshot),
+      protectionStatus,
+      title: "Work through the steps below",
+      detail: `${openIssueCount} setup step${openIssueCount === 1 ? "" : "s"} need attention on this device.`,
+      tone: protectionTone(protectionStatus),
+      statLine: `${stats.protectedManagers} protected · ${stats.unprotectedManagers} open · ${preventedLabel}`
+    };
+  }
+  return {
+    cloudMode: snapshot.cloud_state,
+    cloudLabel: cloudLabel(snapshot),
+    protectionStatus,
+    title: protectionTitle(protectionStatus),
+    detail: protectionDetail(snapshot, protectionStatus),
+    tone: protectionTone(protectionStatus),
+    statLine: `${stats.protectedManagers} protected · ${stats.unprotectedManagers} open · ${preventedLabel}`
+  };
+}
 function supplyChainCloudTagTone(mode) {
   if (mode === "paired_active") {
     return "green";

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/src/codex_plugin_scanner/guard/inventory_contract.py

@@ -234,6 +234,7 @@ class GuardAgentInventoryItem:
     item_id: str
     item_kind: InventoryItemKind
     display_name: str
+    description: str
     source_fingerprint: str
     content_hash: str
     capability_categories: tuple[InventoryCapability, ...]
@@ -393,7 +394,15 @@ def inventory_snapshot_from_detection(
             follow_unsafe_symlinks=follow_unsafe_symlinks,
         )
         items.append(item)
-        items.extend(_mcp_tool_items_from_artifact(harness, artifact, item))
+        items.extend(
+            _mcp_tool_items_from_artifact(
+                harness,
+                artifact,
+                item,
+                home_dir=home_dir,
+                workspace_dir=workspace_dir,
+            )
+        )
     config_paths = tuple(dict.fromkeys(str(path) for path in getattr(detection, "config_paths", ())))
     config_sources = tuple(
         GuardInventorySource(
@@ -586,10 +595,24 @@ def _item_from_artifact(
         item_kind=item_kind,
         content_hash=content_hash,
     )
+    publisher = getattr(artifact, "publisher", None)
+    publisher_text = publisher if isinstance(publisher, str) else None
+    from .inventory_item_description import resolve_inventory_item_description
+
+    description = resolve_inventory_item_description(
+        harness=harness,
+        item_kind=item_kind,
+        display_name=name,
+        metadata=safe_metadata,
+        publisher=publisher_text,
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+    )
     return GuardAgentInventoryItem(
         item_id=artifact_id,
         item_kind=item_kind,
         display_name=name,
+        description=description,
         source_fingerprint=fingerprint_mapping({"harness": harness, "artifact_id": artifact_id}),
         content_hash=content_hash,
         capability_categories=_capabilities_for_artifact(artifact_type, safe_metadata),
@@ -603,6 +626,9 @@ def _mcp_tool_items_from_artifact(
     harness: str,
     artifact: object,
     server_item: GuardAgentInventoryItem,
+    *,
+    home_dir: Path,
+    workspace_dir: Path | None,
 ) -> tuple[GuardAgentInventoryItem, ...]:
     artifact_type = str(getattr(artifact, "artifact_type", "unknown"))
     if artifact_type != "mcp_server":
@@ -670,11 +696,23 @@ def _mcp_tool_items_from_artifact(
                 "annotations": safe_annotations,
             }
         )
+        from .inventory_item_description import resolve_inventory_item_description
+
+        tool_description = resolve_inventory_item_description(
+            harness=harness,
+            item_kind="mcp_tool",
+            display_name=display_name,
+            metadata=metadata,
+            explicit_description=description or None,
+            home_dir=home_dir,
+            workspace_dir=workspace_dir,
+        )
         items.append(
             GuardAgentInventoryItem(
                 item_id=f"{server_item.item_id}:tool:{name}",
                 item_kind="mcp_tool",
                 display_name=display_name,
+                description=tool_description,
                 source_fingerprint=fingerprint_mapping(
                     {"harness": harness, "server": server_item.item_id, "tool": name}
                 ),

plugin_scanner-2.0.651/src/codex_plugin_scanner/guard/inventory_item_description.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from .inventory_contract import InventoryItemKind
+
+_MAX_DESCRIPTION_LENGTH = 500
+_WHITESPACE_RE = re.compile(r"\s+")
+
+_DESCRIPTION_METADATA_KEYS = (
+    "description",
+    "summary",
+    "pluginDescription",
+    "displayDescription",
+)
+
+
+def _clean_description_text(value: str) -> str:
+    collapsed = _WHITESPACE_RE.sub(" ", value.strip())
+    if not collapsed:
+        return ""
+    if len(collapsed) <= _MAX_DESCRIPTION_LENGTH:
+        return collapsed
+    trimmed = collapsed[: _MAX_DESCRIPTION_LENGTH - 1].rstrip()
+    return f"{trimmed}…"
+
+
+def _metadata_description(metadata: dict[str, object]) -> str | None:
+    for key in _DESCRIPTION_METADATA_KEYS:
+        value = metadata.get(key)
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    return None
+
+
+def _publisher_clause(publisher: str | None) -> str:
+    if not publisher or not publisher.strip():
+        return ""
+    return f" published by {publisher.strip()}"
+
+
+def _kind_fallback_description(
+    *,
+    harness: str,
+    item_kind: InventoryItemKind,
+    display_name: str,
+    publisher: str | None,
+) -> str:
+    name = display_name.strip() or "This item"
+    harness_label = harness.replace("_", " ")
+    publisher_text = _publisher_clause(publisher)
+    templates: dict[InventoryItemKind, str] = {
+        "agent": f"{name} configures agent behavior for {harness_label}.",
+        "daemon_plugin": f"{name} is a Guard daemon plugin on this machine.",
+        "harness": f"{name} is the protected harness runtime Guard monitors.",
+        "model_provider": f"{name} is a model provider configured for {harness_label}.",
+        "package": f"{name} is an installed package used by {harness_label}.",
+        "prompt_pack": f"{name} is a prompt or command pack available to {harness_label}.",
+        "skill": f"{name} is an agent skill with instructions {harness_label} can load.",
+        "mcp_server": f"{name} is an MCP server connected to {harness_label}.",
+        "mcp_tool": f"{name} is an MCP tool exposed by a connected server.",
+        "plugin": f"{name} is an extension{publisher_text} installed for {harness_label}.",
+        "channel": f"{name} is a messaging channel configured for {harness_label}.",
+        "hook": f"{name} is a lifecycle hook invoked by {harness_label}.",
+        "overlay": f"{name} is workspace guidance or rules consumed by {harness_label}.",
+        "repository": f"{name} is a repository context linked to {harness_label}.",
+        "container_image": f"{name} is a container image referenced by {harness_label}.",
+        "policy": f"{name} is a policy artifact governing {harness_label} behavior.",
+        "secret_reference": f"{name} references credentials used by {harness_label}.",
+        "network_endpoint": f"{name} is a network endpoint reachable from {harness_label}.",
+    }
+    return templates.get(item_kind, f"{name} is an inventory item detected for {harness_label}.")
+
+
+def resolve_inventory_item_description(
+    *,
+    harness: str,
+    item_kind: InventoryItemKind,
+    display_name: str,
+    metadata: dict[str, object],
+    publisher: str | None = None,
+    explicit_description: str | None = None,
+    home_dir: Path | None = None,
+    workspace_dir: Path | None = None,
+) -> str:
+    from .inventory_contract import (
+        _SAFE_SERIALIZED_MARKERS,
+        _safe_finding_text,
+        _sanitize_serializer_string,
+    )
+
+    candidate = explicit_description or _metadata_description(metadata)
+    if candidate:
+        sanitized = _sanitize_serializer_string(candidate, parent_key="description")
+        if home_dir is not None:
+            sanitized = _safe_finding_text(
+                sanitized,
+                home_dir=home_dir,
+                workspace_dir=workspace_dir,
+            )
+        cleaned = _clean_description_text(sanitized)
+        if cleaned and cleaned not in _SAFE_SERIALIZED_MARKERS:
+            return cleaned
+
+    return _clean_description_text(
+        _kind_fallback_description(
+            harness=harness,
+            item_kind=item_kind,
+            display_name=display_name,
+            publisher=publisher,
+        )
+    )

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.649"
+__version__ = "2.0.651"

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/tests/test_guard_aibom_detection.py

@@ -17,7 +17,7 @@ from codex_plugin_scanner.guard.aibom_detection import (
     instruction_role_for_path,
 )
 from codex_plugin_scanner.guard.consumer.service import artifact_hash, diff_artifact
-from codex_plugin_scanner.guard.inventory_contract import inventory_snapshot_from_detection
+from codex_plugin_scanner.guard.inventory_contract import inventory_snapshot_from_detection, serialize_inventory_snapshot
 from codex_plugin_scanner.guard.models import GuardArtifact, HarnessDetection
 
 
@@ -240,6 +240,48 @@ def test_inventory_snapshot_includes_workspace_instructions(tmp_path: Path) -> N
     overlay_items = [item for item in snapshot.items if item.item_kind == "overlay"]
     assert len(overlay_items) == 1
     assert overlay_items[0].metadata.get("instructionRole") == "agents_md"
+    assert overlay_items[0].description
+
+
+def test_inventory_snapshot_items_include_descriptions(tmp_path: Path) -> None:
+    workspace = tmp_path / "repo"
+    workspace.mkdir()
+    skill_dir = workspace / "skills" / "review"
+    skill_dir.mkdir(parents=True)
+    (skill_dir / "SKILL.md").write_text(
+        "---\nname: review\ndescription: Review code changes carefully.\n---\n",
+        encoding="utf-8",
+    )
+
+    snapshot = inventory_snapshot_from_detection(
+        HarnessDetection(
+            harness="hermes",
+            installed=True,
+            command_available=False,
+            config_paths=(),
+            artifacts=(
+                GuardArtifact(
+                    artifact_id="hermes:skill:review:review",
+                    name="review",
+                    harness="hermes",
+                    artifact_type="skill",
+                    source_scope="workspace",
+                    config_path=str(skill_dir / "SKILL.md"),
+                    metadata={"description": "Review code changes carefully."},
+                ),
+            ),
+        ),
+        generated_at="2026-06-10T00:00:00Z",
+        home_dir=tmp_path,
+        workspace_dir=workspace,
+    )
+
+    skill_items = [item for item in snapshot.items if item.item_kind == "skill"]
+    assert skill_items
+    assert "Review code changes carefully." in skill_items[0].description
+
+    payload = serialize_inventory_snapshot(snapshot)
+    assert payload["items"][0]["description"] == skill_items[0].description
 
 
 def test_hermes_and_openclaw_inventory_snapshots_include_workspace_agents_md(tmp_path: Path) -> None:

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/tests/test_guard_aibom_serializer_security.py

@@ -29,6 +29,7 @@ def _snapshot_with_metadata(metadata: dict[str, object]) -> GuardAgentInventoryS
                 item_id="hermes:skill:serializer-security",
                 item_kind="skill",
                 display_name="Serializer security",
+                description="Serializer security regression fixture.",
                 source_fingerprint="fp-serializer-security",
                 content_hash="sha256:serializer-security",
                 capability_categories=(),

{plugin_scanner-2.0.649 → plugin_scanner-2.0.651}/tests/test_guard_inventory_contract.py

@@ -48,6 +48,7 @@ def test_inventory_snapshot_serialization_redacts_raw_secrets(tmp_path: Path) ->
                 item_id="skill-danger",
                 item_kind="skill",
                 display_name="Danger skill",
+                description="Danger skill instructions for testing redaction.",
                 source_fingerprint=fingerprint_path_tree(skill_dir, home_dir=tmp_path / "home"),
                 content_hash=fingerprint_text((skill_dir / "SKILL.md").read_text()),
                 capability_categories=("reads_secrets", "network_egress"),
@@ -123,6 +124,7 @@ def test_inventory_snapshot_serialization_preserves_free_form_metadata_keys() ->
                 item_id="cursor:mcp:local",
                 item_kind="mcp_server",
                 display_name="Local MCP",
+                description="Local MCP server for schema preservation tests.",
                 source_fingerprint="sha256:source",
                 content_hash="sha256:content",
                 capability_categories=(),
@@ -196,6 +198,7 @@ def test_fingerprint_path_tree_skips_large_ignored_and_path_objects(tmp_path: Pa
                 item_id="item",
                 item_kind="repository",
                 display_name="Repo",
+                description="Repository inventory item for path object serialization.",
                 source_fingerprint=fingerprint,
                 content_hash=fingerprint_text("repo"),
                 capability_categories=("reads_files",),

plugin_scanner-2.0.651/tests/test_inventory_item_description.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from codex_plugin_scanner.guard.inventory_item_description import resolve_inventory_item_description
+
+
+def test_resolve_inventory_item_description_prefers_metadata_description() -> None:
+    result = resolve_inventory_item_description(
+        harness="antigravity",
+        item_kind="plugin",
+        display_name="Pyrefly",
+        metadata={"description": "Fast Python type checker and language server."},
+        publisher="meta",
+    )
+
+    assert result == "Fast Python type checker and language server."
+
+
+def test_resolve_inventory_item_description_uses_explicit_mcp_tool_description() -> None:
+    result = resolve_inventory_item_description(
+        harness="cursor",
+        item_kind="mcp_tool",
+        display_name="read_file",
+        metadata={"toolName": "read_file"},
+        explicit_description="Read a file from the workspace.",
+    )
+
+    assert result == "Read a file from the workspace."
+
+
+def test_resolve_inventory_item_description_falls_back_for_plugins() -> None:
+    result = resolve_inventory_item_description(
+        harness="antigravity",
+        item_kind="plugin",
+        display_name="meta.pyrefly",
+        metadata={},
+        publisher="meta",
+    )
+
+    assert "meta.pyrefly" in result
+    assert "extension" in result
+    assert "meta" in result
+    assert "antigravity" in result
+
+
+def test_resolve_inventory_item_description_truncates_long_text() -> None:
+    long_text = "a" * 600
+    result = resolve_inventory_item_description(
+        harness="codex",
+        item_kind="skill",
+        display_name="Long Skill",
+        metadata={"description": long_text},
+    )
+
+    assert len(result) == 500
+    assert result.endswith("…")
+
+
+def test_resolve_inventory_item_description_falls_back_when_redacted() -> None:
+    result = resolve_inventory_item_description(
+        harness="cursor",
+        item_kind="mcp_tool",
+        display_name="read_file",
+        metadata={},
+        explicit_description="Reads files under /Users/agent/workspace",
+    )
+
+    assert "read_file" in result
+    assert "MCP tool" in result
+    assert "[REDACTED]" not in result