plugin-scanner 2.0.670__tar.gz → 2.0.671__tar.gz

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.670
+Version: 2.0.671
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.670"
+version = "2.0.671"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.670"
+version = "2.0.671"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/src/codex_plugin_scanner/guard/cloud_exceptions.py

@@ -154,9 +154,10 @@ def cloud_exception_from_mapping(
         bundle_hash=resolved_bundle_hash,
         ack_status=resolved_ack,  # type: ignore[arg-type]
         last_used_at=last_used_at,
-        rejection_reason=_non_empty_string(item.get("rejectionReason") or item.get("rejection_reason"))
-        or rejection_reason,
-        provenance=provenance if provenance in {"receipt-sync", "policy-bundle"} else "receipt-sync",  # type: ignore[arg-type]
+        rejection_reason=(
+            _non_empty_string(item.get("rejectionReason") or item.get("rejection_reason")) or rejection_reason
+        ),
+        provenance=(provenance if provenance in {"receipt-sync", "policy-bundle"} else "receipt-sync"),  # type: ignore[arg-type]
     )
 
 

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -20,6 +20,7 @@ from ..local_supply_chain import (
     managed_install_audit_workspace_dirs,
     resolve_supply_chain_audit_workspace_dir,
 )
+from ..models import PolicyDecision
 from ..package_shim_status import record_package_shim_audit_result
 from ..runtime.runner import sync_supply_chain_bundle
 from ..shims import (
@@ -46,7 +47,11 @@ APP_OPERATIONS: tuple[str, ...] = (
     "guard.app.connect",
     "guard.app.remove",
 )
-SUPPORTED_COMMAND_OPERATIONS: tuple[str, ...] = (*PACKAGE_SHIM_OPERATIONS, *APP_OPERATIONS)
+APPROVAL_OPERATIONS: tuple[str, ...] = (
+    "guard.approval.resolve",
+    "guard.localRequests.snapshot",
+)
+SUPPORTED_COMMAND_OPERATIONS: tuple[str, ...] = (*PACKAGE_SHIM_OPERATIONS, *APP_OPERATIONS, *APPROVAL_OPERATIONS)
 COMMAND_OPERATION_SCHEMA_VERSIONS: dict[str, int] = {operation: 1 for operation in SUPPORTED_COMMAND_OPERATIONS}
 
 
@@ -77,6 +82,13 @@ def execute_guard_command_job(
                 store=store,
                 generated_at=generated_at,
             )
+        if operation in APPROVAL_OPERATIONS:
+            return _execute_approval_operation(
+                operation,
+                payload=payload,
+                store=store,
+                generated_at=generated_at,
+            )
     except ValueError as error:
         failure_code = str(error) or "invalid_payload"
         return {
@@ -205,6 +217,124 @@ def _execute_app_operation(
     }
 
 
+def _execute_approval_operation(
+    operation: str,
+    *,
+    payload: dict[str, object],
+    store: GuardStore,
+    generated_at: str,
+) -> dict[str, object]:
+    if operation == "guard.localRequests.snapshot":
+        return _result({"requests": _local_request_snapshot_items(store)}, generated_at=generated_at)
+    if operation != "guard.approval.resolve":
+        return {
+            "failureCode": "unsupported_operation",
+            "failureMessage": f"Unsupported approval operation: {operation}",
+        }
+    action = _optional_string(payload.get("action"))
+    local_request_id = _optional_string(payload.get("localRequestId")) or _optional_string(
+        payload.get("local_request_id")
+    )
+    if action not in {"allow_once", "block", "policy_sync"}:
+        raise ValueError("invalid_approval_payload")
+    if action == "policy_sync":
+        return _execute_policy_sync(payload, store=store, generated_at=generated_at)
+    if local_request_id is None:
+        raise ValueError("invalid_approval_payload")
+    resolution_action = "allow" if action == "allow_once" else "block"
+    result = store.resolve_request_with_queue_result(
+        local_request_id,
+        resolution_action=resolution_action,
+        resolution_scope=_optional_string(payload.get("scope")) or "artifact",
+        reason=_optional_string(payload.get("reason")) or "Guard Cloud approval command",
+        resolved_at=generated_at,
+    )
+    return _result(
+        {
+            "action": action,
+            "localRequestId": local_request_id,
+            "resolution": result,
+            "status": "completed" if result.get("resolved") is True else "not_resolved",
+        },
+        generated_at=generated_at,
+    )
+
+
+def _execute_policy_sync(
+    payload: dict[str, object],
+    *,
+    store: GuardStore,
+    generated_at: str,
+) -> dict[str, object]:
+    policy_memory = payload.get("policyMemory") or payload.get("policy_memory")
+    if not isinstance(policy_memory, dict):
+        raise ValueError("missing_policy_memory")
+    target = policy_memory.get("target")
+    target_payload = target if isinstance(target, dict) else {}
+    harness = _optional_string(payload.get("harness")) or _optional_string(target_payload.get("harness"))
+    artifact_id = _optional_string(target_payload.get("artifactId")) or _optional_string(
+        target_payload.get("artifact_id")
+    )
+    if harness is None or artifact_id is None:
+        raise ValueError("missing_policy_target")
+    scope = _local_policy_scope(_optional_string(policy_memory.get("scope")))
+    decision = PolicyDecision(
+        harness=harness,
+        scope=scope,
+        action="allow",
+        artifact_id=artifact_id,
+        artifact_hash=None,
+        workspace=_optional_string(target_payload.get("workspaceId")) if scope == "workspace" else None,
+        publisher=None,
+        reason=_optional_string(policy_memory.get("reason")) or "Guard Cloud policy memory sync",
+        source="cloud-sync",
+        expires_at=_optional_string(policy_memory.get("expiry")),
+    )
+    store.upsert_policy(decision, generated_at)
+    return _result(
+        {
+            "action": "policy_sync",
+            "decision": decision.to_dict(),
+            "localRequestId": _optional_string(payload.get("localRequestId")),
+            "status": "completed",
+        },
+        generated_at=generated_at,
+    )
+
+
+def _local_policy_scope(scope: str | None) -> str:
+    """Map Cloud policy scopes onto the narrower local policy model."""
+    if scope in {"workspace", "team", "policy", "machine", "project"}:
+        return "workspace"
+    if scope == "item":
+        return "artifact"
+    return "artifact"
+
+
+def _local_request_snapshot_items(store: GuardStore) -> list[dict[str, object]]:
+    items: list[dict[str, object]] = []
+    for status in ("pending", "resolved"):
+        for item in store.list_approval_requests(status=status, limit=100):
+            request_id = item.get("request_id")
+            if not isinstance(request_id, str) or not request_id:
+                continue
+            created_at = str(item.get("created_at") or _now())
+            last_seen_at = str(item.get("last_seen_at") or created_at)
+            resolved_at = item.get("resolved_at")
+            items.append(
+                {
+                    "localRequestId": request_id,
+                    "requestKind": str(item.get("harness") or "guard-review"),
+                    "requestPayload": dict(item),
+                    "localStatus": str(item.get("status") or status),
+                    "firstSeenAt": created_at,
+                    "lastSeenAt": last_seen_at,
+                    "resolvedAt": str(resolved_at) if isinstance(resolved_at, str) and resolved_at else None,
+                }
+            )
+    return items[:200]
+
+
 def _package_shim_context(
     payload: dict[str, object],
     *,

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/src/codex_plugin_scanner/guard/runtime/command_queue.py

@@ -17,6 +17,7 @@ from ..store import GuardStore
 from .command_executors import (
     COMMAND_OPERATION_SCHEMA_VERSIONS,
     SUPPORTED_COMMAND_OPERATIONS,
+    _local_request_snapshot_items,
     command_job_operation,
     execute_guard_command_job,
 )
@@ -192,11 +193,20 @@ def _lease_payload(store: GuardStore) -> dict[str, object]:
             "operations": list(SUPPORTED_COMMAND_OPERATIONS),
             "schemaVersions": dict(COMMAND_OPERATION_SCHEMA_VERSIONS),
         },
+        "localRequestsSnapshot": _local_requests_snapshot(store),
         "maxJobs": 1,
         "waitMs": _env_int(COMMAND_QUEUE_LEASE_WAIT_MS_ENV, _DEFAULT_LEASE_WAIT_MS),
     }
 
 
+def _local_requests_snapshot(store: GuardStore) -> dict[str, object]:
+    try:
+        return {"requests": _local_request_snapshot_items(store)}
+    except Exception as exc:
+        _LOGGER.warning("Guard command local request snapshot failed: %s", _redacted_error(exc))
+        return {"requests": []}
+
+
 def _job_id(job: dict[str, object]) -> str:
     job_id = job.get("id")
     if not isinstance(job_id, str) or not job_id:

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.670"
+__version__ = "2.0.671"

{plugin_scanner-2.0.670 → plugin_scanner-2.0.671}/tests/test_guard_command_queue.py

@@ -38,6 +38,18 @@ class FakeStore:
             "workspace_id": "workspace-1",
         }
 
+    def list_approval_requests(
+        self,
+        *,
+        status: str | None = "pending",
+        harness: str | None = None,
+        limit: int | None = 50,
+        cursor: str | None = None,
+        search: str | None = None,
+    ) -> list[dict[str, object]]:
+        del status, harness, limit, cursor, search
+        return []
+
 
 def _context(tmp_path: Path) -> HarnessContext:
     return HarnessContext(
@@ -98,6 +110,7 @@ def test_poll_once_leases_heartbeats_executes_and_posts_result(
                 "operations": list(command_executors.SUPPORTED_COMMAND_OPERATIONS),
                 "schemaVersions": dict(command_executors.COMMAND_OPERATION_SCHEMA_VERSIONS),
             },
+            "localRequestsSnapshot": {"requests": []},
             "maxJobs": 1,
             "waitMs": 25000,
         },
@@ -113,6 +126,64 @@ def test_poll_once_leases_heartbeats_executes_and_posts_result(
     assert "machineInstallationId" not in calls[3][2]
 
 
+def test_poll_once_continues_when_local_request_snapshot_fails(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    class BrokenSnapshotStore(FakeStore):
+        def list_approval_requests(
+            self,
+            *,
+            status: str | None = "pending",
+            harness: str | None = None,
+            limit: int | None = 50,
+            cursor: str | None = None,
+            search: str | None = None,
+        ) -> list[dict[str, object]]:
+            del status, harness, limit, cursor, search
+            raise OSError("approval store locked")
+
+    store = BrokenSnapshotStore(tmp_path / "guard-home")
+    calls: list[tuple[str, str, dict[str, object]]] = []
+    monkeypatch.setattr(
+        command_queue,
+        "_resolve_guard_sync_auth_context",
+        lambda current_store: {"sync_url": "https://hol.test/api/guard/receipts/sync", "access_token": "token"},
+    )
+
+    def fake_json_request(
+        auth_context: dict[str, object],
+        *,
+        method: str,
+        path: str,
+        payload: dict[str, object],
+    ) -> dict[str, object]:
+        calls.append((method, path, payload))
+        if path == "/lease":
+            return {
+                "item": {
+                    "id": "job-1",
+                    "leaseId": "lease-1",
+                    "operation": "guard.packageShims.status",
+                }
+            }
+        return {"ok": True}
+
+    monkeypatch.setattr(command_queue, "_json_request", fake_json_request)
+    monkeypatch.setattr(
+        command_executors,
+        "package_shim_status",
+        lambda context: {"active_managers": []},
+    )
+
+    status = command_queue.poll_command_queue_once(store, _context(tmp_path))
+
+    assert status["state"] == "idle"
+    assert calls[0][0:2] == ("POST", "/lease")
+    assert calls[0][2]["localRequestsSnapshot"] == {"requests": []}
+    assert calls[-1][0:2] == ("POST", "/job-1/result")
+
+
 def test_poll_once_persists_result_retry_when_result_upload_fails(
     tmp_path: Path,
     monkeypatch,
@@ -537,12 +608,137 @@ def test_executor_dispatches_app_connect(tmp_path: Path, monkeypatch) -> None:
     assert isinstance(result["data"], dict)
 
 
-def test_executor_rejects_approval_resolve_until_inbox_phase(tmp_path: Path) -> None:
+def test_executor_resolves_local_approval_request(tmp_path: Path) -> None:
+    class ApprovalStore(FakeStore):
+        def __init__(self, guard_home: Path) -> None:
+            super().__init__(guard_home)
+            self.resolved: list[dict[str, object]] = []
+
+        def resolve_request_with_queue_result(
+            self,
+            request_id: str,
+            *,
+            resolution_action: str,
+            resolution_scope: str,
+            reason: str | None,
+            resolved_at: str,
+        ) -> dict[str, object]:
+            self.resolved.append(
+                {
+                    "request_id": request_id,
+                    "resolution_action": resolution_action,
+                    "resolution_scope": resolution_scope,
+                    "reason": reason,
+                    "resolved_at": resolved_at,
+                }
+            )
+            return {"resolved": True, "resolved_request": {"request_id": request_id}}
+
+    store = ApprovalStore(tmp_path / "guard-home")
     result = command_executors.execute_guard_command_job(
-        {"operation": "guard.approval.resolve", "payload": {"requestId": "request-1", "action": "allow_once"}},
+        {
+            "operation": "guard.approval.resolve",
+            "payload": {"localRequestId": "request-1", "action": "allow_once", "scope": "artifact"},
+        },
         context=_context(tmp_path),
-        store=FakeStore(tmp_path / "guard-home"),  # type: ignore[arg-type]
+        store=store,  # type: ignore[arg-type]
+        now=lambda: "2026-06-13T00:00:00+00:00",
+    )
+
+    assert result["generatedAt"] == "2026-06-13T00:00:00+00:00"
+    assert result["data"]["status"] == "completed"
+    assert store.resolved == [
+        {
+            "request_id": "request-1",
+            "resolution_action": "allow",
+            "resolution_scope": "artifact",
+            "reason": "Guard Cloud approval command",
+            "resolved_at": "2026-06-13T00:00:00+00:00",
+        }
+    ]
+
+
+def test_executor_syncs_policy_without_local_request_id(tmp_path: Path) -> None:
+    class PolicyStore(FakeStore):
+        def __init__(self, guard_home: Path) -> None:
+            super().__init__(guard_home)
+            self.upserts: list[tuple[dict[str, object], str]] = []
+
+        def upsert_policy(self, decision: object, generated_at: str) -> None:
+            self.upserts.append((decision.to_dict(), generated_at))
+
+    store = PolicyStore(tmp_path / "guard-home")
+    result = command_executors.execute_guard_command_job(
+        {
+            "operation": "guard.approval.resolve",
+            "payload": {
+                "action": "policy_sync",
+                "policyMemory": {
+                    "scope": "workspace",
+                    "reason": "approved in cloud",
+                    "target": {
+                        "artifactId": "pkg:npm/react",
+                        "harness": "package-install",
+                        "workspaceId": "workspace-1",
+                    },
+                },
+            },
+        },
+        context=_context(tmp_path),
+        store=store,  # type: ignore[arg-type]
+        now=lambda: "2026-06-13T00:00:00+00:00",
+    )
+
+    assert result["data"]["status"] == "completed"
+    assert result["data"]["localRequestId"] is None
+    assert store.upserts == [
+        (
+            {
+                "harness": "package-install",
+                "scope": "workspace",
+                "action": "allow",
+                "artifact_id": "pkg:npm/react",
+                "artifact_hash": None,
+                "workspace": "workspace-1",
+                "publisher": None,
+                "reason": "approved in cloud",
+                "owner": None,
+                "source": "cloud-sync",
+                "expires_at": None,
+            },
+            "2026-06-13T00:00:00+00:00",
+        )
+    ]
+
+
+def test_executor_maps_unknown_cloud_policy_scope_to_artifact(tmp_path: Path) -> None:
+    class PolicyStore(FakeStore):
+        def __init__(self, guard_home: Path) -> None:
+            super().__init__(guard_home)
+            self.upserts: list[dict[str, object]] = []
+
+        def upsert_policy(self, decision: object, generated_at: str) -> None:
+            del generated_at
+            self.upserts.append(decision.to_dict())
+
+    store = PolicyStore(tmp_path / "guard-home")
+    command_executors.execute_guard_command_job(
+        {
+            "operation": "guard.approval.resolve",
+            "payload": {
+                "action": "policy_sync",
+                "policyMemory": {
+                    "scope": "global",
+                    "target": {
+                        "artifactId": "pkg:npm/react",
+                        "harness": "package-install",
+                    },
+                },
+            },
+        },
+        context=_context(tmp_path),
+        store=store,  # type: ignore[arg-type]
         now=lambda: "2026-06-13T00:00:00+00:00",
     )
 
-    assert result["failureCode"] == "unsupported_operation"
+    assert store.upserts[0]["scope"] == "artifact"