plugin-scanner 2.0.676__tar.gz → 2.0.678__tar.gz

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.676
+Version: 2.0.678
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.676"
+version = "2.0.678"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.676"
+version = "2.0.678"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -87,100 +87,6 @@ def _run_mcp_inventory_scan(
     )
 
 
-def _run_skill_inventory_scan(
-    *,
-    harness: str,
-    context: HarnessContext,
-    detection: object,
-    mode: str,
-    timeout_seconds: float | None,
-) -> CiscoInventoryRun:
-    roots = _skill_scan_roots(harness=harness, context=context, detection=detection)
-    if not roots:
-        return CiscoInventoryRun(
-            source="cisco-skill-scanner",
-            status="skipped",
-            message="No skill directory found; Cisco skill inventory scan skipped.",
-            findings=(),
-            duration_ms=0,
-            metadata={"target": "missing", "skillsScanned": 0, "mode": mode},
-        )
-    if len(roots) == 1:
-        return _run_single_skill_inventory_scan(root=roots[0], mode=mode, timeout_seconds=timeout_seconds)
-
-    findings: list[Finding] = []
-    severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}
-    analyzers_used: list[str] = []
-    skills_scanned = 0
-    skills_skipped: list[str] = []
-    duration_ms = 0
-    failure_message: str | None = None
-
-    for root in roots:
-        run = _run_single_skill_inventory_scan(root=root, mode=mode, timeout_seconds=timeout_seconds)
-        duration_ms += run.duration_ms
-        metadata = run.metadata if isinstance(run.metadata, dict) else {}
-        for finding in run.findings:
-            findings.append(finding)
-        raw_counts = metadata.get("findingsBySeverity")
-        if isinstance(raw_counts, dict):
-            for key in severity_counts:
-                value = raw_counts.get(key)
-                if isinstance(value, int):
-                    severity_counts[key] += value
-        raw_analyzers = metadata.get("analyzersUsed")
-        if isinstance(raw_analyzers, list):
-            for analyzer in raw_analyzers:
-                if isinstance(analyzer, str) and analyzer and analyzer not in analyzers_used:
-                    analyzers_used.append(analyzer)
-        raw_scanned = metadata.get("skillsScanned")
-        if isinstance(raw_scanned, int):
-            skills_scanned += raw_scanned
-        raw_skipped = metadata.get("skillsSkipped")
-        if isinstance(raw_skipped, list):
-            for entry in raw_skipped:
-                if isinstance(entry, str) and entry:
-                    skills_skipped.append(entry)
-        if run.status in {"failed", "timed_out", "unavailable"}:
-            failure_message = run.message
-            return CiscoInventoryRun(
-                source="cisco-skill-scanner",
-                status=run.status,
-                message=failure_message,
-                findings=tuple(findings),
-                duration_ms=duration_ms,
-                metadata={
-                    "target": str(roots[0].parent),
-                    "skillsScanned": skills_scanned,
-                    "skillsSkipped": tuple(skills_skipped),
-                    "totalFindings": len(findings),
-                    "findingsBySeverity": severity_counts,
-                    "analyzersUsed": tuple(analyzers_used),
-                    "policyName": metadata.get("policyName", "balanced"),
-                    "mode": mode,
-                },
-            )
-
-    return CiscoInventoryRun(
-        source="cisco-skill-scanner",
-        status="enabled",
-        message="Cisco skill scan completed.",
-        findings=tuple(findings),
-        duration_ms=duration_ms,
-        metadata={
-            "target": str(roots[0].parent),
-            "skillsScanned": skills_scanned,
-            "skillsSkipped": tuple(skills_skipped),
-            "totalFindings": len(findings),
-            "findingsBySeverity": severity_counts,
-            "analyzersUsed": tuple(analyzers_used),
-            "policyName": "balanced",
-            "mode": mode,
-            "skillTargets": [str(root) for root in roots],
-        },
-    )
-
-
 def _run_skill_inventory_scans(
     *,
     harness: str,
@@ -283,8 +189,12 @@ def _artifact_skill_root(artifact: object, *, context: HarnessContext) -> Path |
                 if base_dir is None:
                     continue
                 candidate = (base_dir / skill_root).resolve()
-                if candidate.is_dir() and (candidate / "SKILL.md").is_file():
-                    return candidate
+                if candidate.is_dir():
+                    nested_skill_dirs = _skill_dirs_under(candidate)
+                    if len(nested_skill_dirs) == 1:
+                        return nested_skill_dirs[0]
+                    if (candidate / "SKILL.md").is_file():
+                        return candidate
     config_path = getattr(artifact, "config_path", None)
     if not isinstance(config_path, str):
         return None
@@ -313,13 +223,6 @@ def _skill_dirs_under(root: Path) -> tuple[Path, ...]:
     return tuple(skill_dirs)
 
 
-def _nearest_skills_root(path: Path) -> Path | None:
-    for parent in path.parents:
-        if parent.name == "skills":
-            return parent
-    return None
-
-
 def _nearest_skill_dir(path: Path) -> Path | None:
     if path.name == "SKILL.md":
         return path.parent

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/src/codex_plugin_scanner/integrations/cisco_skill_scanner.py

@@ -2,12 +2,14 @@
 
 from __future__ import annotations
 
+import json
+import os
+import subprocess
+import sys
+import tempfile
 from dataclasses import dataclass
 from enum import Enum
-from multiprocessing import get_context
-from multiprocessing.process import BaseProcess
 from pathlib import Path
-from queue import Empty
 
 from ..models import Finding, Severity, severity_from_value
 
@@ -83,20 +85,15 @@ def _scan_directory_payload(skills_dir: Path, policy_name: str) -> dict[str, obj
     return payload if isinstance(payload, dict) else {}
 
 
-def _scan_directory_worker(skills_dir: str, policy_name: str, result_queue: object) -> None:
-    try:
-        payload = _scan_directory_payload(Path(skills_dir), policy_name)
-        result_queue.put(("ok", payload))
-    except BaseException as exc:
-        result_queue.put(("error", type(exc).__name__, str(exc)))
-
+_SUBPROCESS_SCAN_SNIPPET = """
+from pathlib import Path
+import json
+import sys
+from codex_plugin_scanner.integrations.cisco_skill_scanner import _scan_directory_payload
 
-def _terminate_scan_process(process: BaseProcess) -> None:
-    process.terminate()
-    process.join(1)
-    if process.is_alive():
-        process.kill()
-        process.join()
+payload = _scan_directory_payload(Path(sys.argv[1]), sys.argv[2])
+Path(sys.argv[3]).write_text(json.dumps(payload), encoding='utf-8')
+""".strip()
 
 
 def _scan_directory_with_timeout(
@@ -105,35 +102,50 @@ def _scan_directory_with_timeout(
     if timeout_seconds is None:
         return _scan_directory_payload(skills_dir, policy_name)
 
-    context = get_context("spawn")
-    result_queue = context.Queue(maxsize=1)
-    process = context.Process(
-        target=_scan_directory_worker,
-        args=(str(skills_dir), policy_name, result_queue),
-    )
-    process.start()
+    file_descriptor, output_name = tempfile.mkstemp(prefix="cisco-skill-scan-", suffix=".json")
+    output_path = Path(output_name)
+    # Explicit close avoids leaking the temp file descriptor into the child.
+    os.close(file_descriptor)
 
+    env = os.environ.copy()
+    env["PYTHONPATH"] = os.pathsep.join(sys.path)
     try:
-        status, payload, *details = result_queue.get(timeout=timeout_seconds)
-    except Empty as exc:
-        process.join(0)
-        if process.is_alive():
-            _terminate_scan_process(process)
+        try:
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    "-c",
+                    _SUBPROCESS_SCAN_SNIPPET,
+                    str(skills_dir),
+                    policy_name,
+                    str(output_path),
+                ],
+                capture_output=True,
+                check=False,
+                text=True,
+                timeout=timeout_seconds,
+                env=env,
+            )
+        except subprocess.TimeoutExpired as exc:
             raise TimeoutError("Cisco skill scanner timed out") from exc
+
+        if result.returncode != 0:
+            error_output = result.stderr.strip() or result.stdout.strip()
+            if not error_output:
+                error_output = f"Cisco skill scanner exited with code {result.returncode}"
+            raise RuntimeError(error_output)
+
+        if not output_path.is_file():
+            raise RuntimeError("Cisco skill scanner did not produce a result payload")
+
         try:
-            status, payload, *details = result_queue.get(timeout=1)
-        except Empty as empty_exc:
-            raise RuntimeError(f"Cisco skill scanner exited with code {process.exitcode}") from empty_exc
-    else:
-        process.join(1)
-        if process.is_alive():
-            _terminate_scan_process(process)
-
-    if status == "error":
-        error_type = str(payload)
-        error_message = str(details[0]) if details else "unknown error"
-        raise RuntimeError(f"{error_type}: {error_message}")
-    return payload if isinstance(payload, dict) else {}
+            payload = json.loads(output_path.read_text(encoding="utf-8"))
+        except json.JSONDecodeError as exc:
+            raise RuntimeError("Cisco skill scanner produced invalid JSON output") from exc
+
+        return payload if isinstance(payload, dict) else {}
+    finally:
+        output_path.unlink(missing_ok=True)
 
 
 def _to_local_finding(plugin_dir: Path, skill_result: dict[str, object], finding: dict[str, object]) -> Finding:
@@ -241,6 +253,8 @@ def run_cisco_skill_scan(
 
     findings: list[Finding] = []
     results = payload.get("results", [])
+    if not isinstance(results, list):
+        results = []
     for result in results:
         if not isinstance(result, dict):
             continue
@@ -252,6 +266,8 @@ def run_cisco_skill_scan(
                 findings.append(_to_local_finding(skills_dir.parent, result, finding))
 
     summary = payload.get("summary", {})
+    if not isinstance(summary, dict):
+        summary = {}
     counts = _empty_counts()
     findings_by_severity = summary.get("findings_by_severity", {})
     if isinstance(findings_by_severity, dict):

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.676"
+__version__ = "2.0.678"

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/tests/test_guard_cisco_evidence.py

@@ -7,6 +7,9 @@ import sqlite3
 import time
 from pathlib import Path
 from types import ModuleType, SimpleNamespace
+from typing import Any, cast
+
+import pytest
 
 from codex_plugin_scanner.guard.runtime.cisco_evidence import (
     cisco_finding_to_risk_signal,
@@ -91,7 +94,7 @@ def test_scanner_cache_key_changes_with_content_hash_or_version() -> None:
 
 def test_guard_store_invalidates_scanner_cache_when_hash_or_version_changes(tmp_path: Path) -> None:
     store = GuardStore(tmp_path / "guard-home")
-    payload = {"signals": [{"signal_id": "signal-1"}]}
+    payload = cast(dict[str, object], {"signals": [{"signal_id": "signal-1"}]})
 
     store.save_scanner_cache(
         scanner_name="cisco-mcp-scanner",
@@ -158,9 +161,9 @@ def test_skill_scanner_reports_timeout_without_marking_scan_failed(monkeypatch,
         def __init__(self, preset_base: str) -> None:
             self.preset_base = preset_base
 
-    skill_scanner_module = ModuleType("skill_scanner")
+    skill_scanner_module = cast(Any, ModuleType("skill_scanner"))
     skill_scanner_module.SkillScanner = SlowScanner
-    scan_policy_module = ModuleType("skill_scanner.core.scan_policy")
+    scan_policy_module = cast(Any, ModuleType("skill_scanner.core.scan_policy"))
     scan_policy_module.ScanPolicy = ScanPolicy
     monkeypatch.setitem(__import__("sys").modules, "skill_scanner", skill_scanner_module)
     monkeypatch.setitem(__import__("sys").modules, "skill_scanner.core", ModuleType("skill_scanner.core"))
@@ -178,51 +181,42 @@ def test_skill_scanner_reports_timeout_without_marking_scan_failed(monkeypatch,
 
 
 def test_skill_scanner_timeout_path_drains_worker_result_before_terminating(monkeypatch, tmp_path: Path) -> None:
-    class FakeQueue:
-        def __init__(self) -> None:
-            self.process: FakeProcess | None = None
-
-        def get(self, timeout: float) -> tuple[str, dict[str, object]]:
-            if self.process is not None:
-                self.process.alive = False
-            return ("ok", {"summary": {"total_skills_scanned": 0}, "results": []})
-
-    class FakeProcess:
-        def __init__(self, queue: FakeQueue) -> None:
-            self.queue = queue
-            self.alive = True
-            self.exitcode = 0
-            self.terminated = False
-            self.killed = False
-
-        def start(self) -> None:
-            self.queue.process = self
-
-        def join(self, timeout: float | None = None) -> None:
-            return None
-
-        def is_alive(self) -> bool:
-            return self.alive
-
-        def terminate(self) -> None:
-            self.terminated = True
-
-        def kill(self) -> None:
-            self.killed = True
-
-    queue = FakeQueue()
-    process = FakeProcess(queue)
-    context = SimpleNamespace(
-        Queue=lambda maxsize: queue,
-        Process=lambda target, args: process,
-    )
-    monkeypatch.setattr(cisco_skill_scanner, "get_context", lambda method: context)
+    output_path = tmp_path / "scan-output.json"
+
+    monkeypatch.setattr(cisco_skill_scanner.tempfile, "mkstemp", lambda prefix, suffix: (123, str(output_path)))
+    monkeypatch.setattr(cisco_skill_scanner.os, "close", lambda fd: None)
+
+    def fake_run(*args: object, **kwargs: object) -> object:
+        output_path.write_text(
+            json.dumps({"summary": {"total_skills_scanned": 0}, "results": []}),
+            encoding="utf-8",
+        )
+        return SimpleNamespace(returncode=0, stderr="", stdout="")
+
+    monkeypatch.setattr(cisco_skill_scanner.subprocess, "run", fake_run)
 
     payload = cisco_skill_scanner._scan_directory_with_timeout(tmp_path, "balanced", 0.1)
 
     assert payload == {"summary": {"total_skills_scanned": 0}, "results": []}
-    assert process.terminated is False
-    assert process.killed is False
+    assert output_path.exists() is False
+
+
+def test_skill_scanner_timeout_path_cleans_temp_file_on_timeout(monkeypatch, tmp_path: Path) -> None:
+    output_path = tmp_path / "scan-timeout.json"
+
+    monkeypatch.setattr(cisco_skill_scanner.tempfile, "mkstemp", lambda prefix, suffix: (123, str(output_path)))
+    monkeypatch.setattr(cisco_skill_scanner.os, "close", lambda fd: None)
+
+    def fake_run(*args: object, **kwargs: object) -> object:
+        output_path.write_text("{}", encoding="utf-8")
+        raise cisco_skill_scanner.subprocess.TimeoutExpired(cmd="skill-scanner", timeout=0.1)
+
+    monkeypatch.setattr(cisco_skill_scanner.subprocess, "run", fake_run)
+
+    with pytest.raises(TimeoutError, match="timed out"):
+        cisco_skill_scanner._scan_directory_with_timeout(tmp_path, "balanced", 0.1)
+
+    assert output_path.exists() is False
 
 
 def test_mcp_scanner_reports_timeout_without_marking_scan_failed(monkeypatch, tmp_path: Path) -> None:

{plugin_scanner-2.0.676 → plugin_scanner-2.0.678}/tests/test_guard_inventory_cisco.py

@@ -236,6 +236,62 @@ def test_cisco_inventory_scans_use_detected_nonstandard_skill_roots(tmp_path: Pa
     assert calls == [skill_path.parent]
 
 
+def test_cisco_inventory_scans_resolve_skill_root_collection_directories(tmp_path: Path, monkeypatch) -> None:
+    context = _ctx(tmp_path)
+    home_dir = context.home_dir
+    assert home_dir is not None
+    collection_root = home_dir / "shared-openclaw-skills"
+    skill_path = collection_root / "reviewer" / "SKILL.md"
+    skill_path.parent.mkdir(parents=True)
+    skill_path.write_text("---\nname: reviewer\n---\nReview local files.\n")
+    detection = HarnessDetection(
+        harness="openclaw",
+        installed=True,
+        command_available=False,
+        config_paths=(),
+        artifacts=(
+            GuardArtifact(
+                artifact_id="openclaw:skill:extra:reviewer",
+                name="reviewer",
+                harness="openclaw",
+                artifact_type="skill",
+                source_scope="global",
+                config_path=str(collection_root),
+                metadata={"skill_root": str(collection_root)},
+            ),
+        ),
+    )
+    calls: list[Path] = []
+
+    def fake_skill_scan(skills_dir: Path, mode: str, timeout_seconds: float | None = None) -> _SkillSummary:
+        del mode, timeout_seconds
+        calls.append(skills_dir)
+        return _SkillSummary(
+            status=CiscoIntegrationStatus.ENABLED,
+            message="Skill scanner completed.",
+            findings=(),
+            skills_scanned=1,
+            skills_skipped=(),
+            analyzers_used=("prompt-injection",),
+            policy_name="balanced",
+            total_findings=0,
+            findings_by_severity={severity.value: 0 for severity in Severity},
+        )
+
+    monkeypatch.setattr("codex_plugin_scanner.guard.inventory_cisco.run_cisco_skill_scan", fake_skill_scan)
+
+    runs = run_cisco_inventory_scans(
+        harness="openclaw",
+        context=context,
+        detection=detection,
+        skill_mode="auto",
+    )
+
+    assert [run.source for run in runs] == ["cisco-skill-scanner"]
+    assert calls == [skill_path.parent]
+    assert [run.metadata["target"] for run in runs] == [str(skill_path.parent)]
+
+
 def test_cisco_inventory_scans_runs_each_detected_skill_root(tmp_path: Path, monkeypatch) -> None:
     context = _ctx(tmp_path)
     home_dir = context.home_dir