plugin-scanner 2.0.69__tar.gz → 2.0.71__tar.gz

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.69
+Version: 2.0.71
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/dashboard/src/guard-api.ts

@@ -128,11 +128,23 @@ export async function fetchSettings(): Promise<GuardSettingsPayload> {
       config_path: "~/.hol-guard/config.toml",
       settings: {
         mode: "prompt",
+        security_level: "balanced",
         default_action: "warn",
         unknown_publisher_action: "review",
         changed_hash_action: "require-reapproval",
         new_network_domain_action: "warn",
         subprocess_action: "warn",
+        risk_actions: {
+          local_secret_read: "require-reapproval",
+          credential_exfiltration: "require-reapproval",
+          destructive_shell: "require-reapproval",
+          encoded_execution: "require-reapproval",
+          network_egress: "warn"
+        },
+        risk_action_overrides: {},
+        harness_risk_actions: {
+          codex: {}
+        },
         approval_wait_timeout_seconds: 120,
         approval_surface_policy: "auto-open-once",
         telemetry: false,

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/dashboard/src/guard-types.ts

@@ -136,11 +136,15 @@ export type GuardInventoryItem = {
 
 export type GuardSettings = {
   mode: "observe" | "prompt" | "enforce";
+  security_level: "balanced" | "strict" | "custom";
   default_action: string;
   unknown_publisher_action: string;
   changed_hash_action: string;
   new_network_domain_action: string;
   subprocess_action: string;
+  risk_actions: Record<string, string>;
+  risk_action_overrides: Record<string, string>;
+  harness_risk_actions: Record<string, Record<string, string>>;
   approval_wait_timeout_seconds: number;
   approval_surface_policy: string;
   telemetry: boolean;

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/dashboard/src/settings-workspace.tsx

@@ -30,6 +30,100 @@ const surfacePolicyOptions = [
   { value: "native-only", label: "Harness prompt only" }
 ];
 
+const securityLevels = [
+  {
+    value: "balanced",
+    label: "Balanced",
+    description: "Ask before secret access, hidden execution, exfiltration, and destructive actions."
+  },
+  {
+    value: "strict",
+    label: "Strict",
+    description: "Ask more often, including new network destinations."
+  },
+  {
+    value: "custom",
+    label: "Custom",
+    description: "Use the exact choices below for this machine and connected apps."
+  }
+] as const;
+
+const riskControls = [
+  {
+    key: "local_secret_read",
+    label: "Local secrets",
+    description: "Files such as .env, .npmrc, .netrc, SSH keys, and cloud credentials."
+  },
+  {
+    key: "credential_exfiltration",
+    label: "Credential sharing",
+    description: "Commands or scripts that appear to send keys, tokens, or credentials away."
+  },
+  {
+    key: "destructive_shell",
+    label: "Destructive commands",
+    description: "Shell actions that delete, overwrite, or rewrite local files."
+  },
+  {
+    key: "encoded_execution",
+    label: "Hidden scripts",
+    description: "Encoded, encrypted, or decoded-and-run command payloads."
+  },
+  {
+    key: "network_egress",
+    label: "New network destinations",
+    description: "Outbound connections Guard has not seen in this context."
+  }
+] as const;
+
+type RiskKey = (typeof riskControls)[number]["key"];
+
+const riskProfileActions: Record<"balanced" | "strict" | "custom", Record<RiskKey, string>> = {
+  balanced: {
+    local_secret_read: "require-reapproval",
+    credential_exfiltration: "require-reapproval",
+    destructive_shell: "require-reapproval",
+    encoded_execution: "require-reapproval",
+    network_egress: "warn"
+  },
+  strict: {
+    local_secret_read: "require-reapproval",
+    credential_exfiltration: "require-reapproval",
+    destructive_shell: "require-reapproval",
+    encoded_execution: "require-reapproval",
+    network_egress: "require-reapproval"
+  },
+  custom: {
+    local_secret_read: "require-reapproval",
+    credential_exfiltration: "require-reapproval",
+    destructive_shell: "require-reapproval",
+    encoded_execution: "require-reapproval",
+    network_egress: "warn"
+  }
+};
+
+function normalizeSettingsPayload(payload: GuardSettingsPayload): GuardSettingsPayload {
+  return {
+    ...payload,
+    settings: normalizeGuardSettings(payload.settings)
+  };
+}
+
+function normalizeGuardSettings(settings: GuardSettings): GuardSettings {
+  const defaults = riskProfileActions[settings.security_level];
+  const explicitOverrides = settings.risk_action_overrides ?? {};
+  const effectiveRiskActions = riskControls.reduce<Record<RiskKey, string>>((actions, risk) => {
+    actions[risk.key] = settings.risk_actions?.[risk.key] ?? explicitOverrides[risk.key] ?? defaults[risk.key];
+    return actions;
+  }, {} as Record<RiskKey, string>);
+  return {
+    ...settings,
+    risk_actions: effectiveRiskActions,
+    risk_action_overrides: explicitOverrides,
+    harness_risk_actions: settings.harness_risk_actions ?? {}
+  };
+}
+
 export function SettingsWorkspace() {
   const [state, setState] = useState<SettingsState>({ kind: "loading" });
   const [draft, setDraft] = useState<GuardSettings | null>(null);
@@ -41,8 +135,9 @@ export function SettingsWorkspace() {
     fetchSettings()
       .then((payload) => {
         if (!cancelled) {
-          setState({ kind: "ready", payload });
-          setDraft(payload.settings);
+          const normalizedPayload = normalizeSettingsPayload(payload);
+          setState({ kind: "ready", payload: normalizedPayload });
+          setDraft(normalizedPayload.settings);
         }
       })
       .catch((error: unknown) => {
@@ -66,6 +161,63 @@ export function SettingsWorkspace() {
     []
   );
 
+  const handleSecurityLevelChange = useCallback((securityLevel: GuardSettings["security_level"]) => {
+    setDraft((value) => {
+      if (value === null) return value;
+      if (securityLevel === "custom") {
+        return { ...value, security_level: securityLevel };
+      }
+      return {
+        ...value,
+        security_level: securityLevel,
+        risk_actions: riskProfileActions[securityLevel],
+        risk_action_overrides: {},
+        harness_risk_actions: {}
+      };
+    });
+    setSavedMessage(null);
+  }, []);
+
+  const handleRiskActionChange = useCallback(
+    (riskKey: string) => (event: ChangeEvent<HTMLSelectElement>) => {
+      setDraft((value) => {
+        if (value === null) return value;
+        return {
+          ...value,
+          security_level: "custom",
+          risk_actions: {
+            ...value.risk_actions,
+            [riskKey]: event.target.value
+          },
+          risk_action_overrides: {
+            ...value.risk_action_overrides,
+            [riskKey]: event.target.value
+          }
+        };
+      });
+      setSavedMessage(null);
+    },
+    []
+  );
+
+  const handleCodexSecretReadChange = useCallback((event: ChangeEvent<HTMLSelectElement>) => {
+    setDraft((value) => {
+      if (value === null) return value;
+      return {
+        ...value,
+        security_level: "custom",
+        harness_risk_actions: {
+          ...value.harness_risk_actions,
+          codex: {
+            ...(value.harness_risk_actions.codex ?? {}),
+            local_secret_read: event.target.value
+          }
+        }
+      };
+    });
+    setSavedMessage(null);
+  }, []);
+
   const handleTimeoutChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
     const nextValue = Number.parseInt(event.target.value, 10);
     setDraft((value) => value === null ? value : { ...value, approval_wait_timeout_seconds: Number.isNaN(nextValue) ? 0 : nextValue });
@@ -90,9 +242,13 @@ export function SettingsWorkspace() {
     setSaving(true);
     setSavedMessage(null);
     try {
-      const payload = await updateSettings(draft);
-      setState({ kind: "ready", payload });
-      setDraft(payload.settings);
+      const payload = await updateSettings({
+        ...draft,
+        risk_actions: draft.security_level === "custom" ? draft.risk_actions : draft.risk_action_overrides
+      });
+      const normalizedPayload = normalizeSettingsPayload(payload);
+      setState({ kind: "ready", payload: normalizedPayload });
+      setDraft(normalizedPayload.settings);
       setSavedMessage("Settings saved. New Guard checks use these values immediately.");
     } catch (error) {
       setSavedMessage(error instanceof Error ? error.message : "Unable to save settings.");
@@ -130,10 +286,10 @@ export function SettingsWorkspace() {
             </div>
             <SectionLabel>Settings</SectionLabel>
             <h1 className="mt-2 text-3xl font-semibold tracking-tight text-brand-dark">
-              Tune how HOL Guard pauses risky actions.
+              Choose how protective HOL Guard should be.
             </h1>
             <p className="mt-3 max-w-2xl text-sm leading-6 text-brand-dark/70">
-              These are the same local controls exposed by the CLI config. Use them when you want Guard to ask more often, run quietly, or wait longer for approval decisions.
+              Start with a simple security level, then tune exact risk types when a trusted app needs more room to work.
             </p>
           </div>
           <div className="rounded-[1.65rem] border border-white/80 bg-white/80 p-4 shadow-[0_16px_40px_rgba(63,65,116,0.10)] backdrop-blur">
@@ -148,6 +304,27 @@ export function SettingsWorkspace() {
 
       <section className="grid gap-6 lg:grid-cols-[minmax(0,1fr)_320px]">
         <div className="space-y-6">
+          <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
+            <SectionLabel>Security level</SectionLabel>
+            <div className="mt-4 grid gap-3 md:grid-cols-3">
+              {securityLevels.map((level) => (
+                <button
+                  key={level.value}
+                  type="button"
+                  onClick={() => handleSecurityLevelChange(level.value)}
+                  className={`min-h-32 rounded-[1.5rem] border p-4 text-left transition-all duration-150 ${
+                    draft.security_level === level.value
+                      ? "border-brand-blue/35 bg-brand-blue/[0.07] shadow-[0_12px_32px_rgba(85,153,254,0.14)]"
+                      : "border-transparent bg-surface-1/80 hover:bg-white"
+                  }`}
+                >
+                  <span className="text-base font-semibold text-brand-dark">{level.label}</span>
+                  <span className="mt-2 block text-sm leading-6 text-muted-foreground">{level.description}</span>
+                </button>
+              ))}
+            </div>
+          </div>
+
           <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
             <SectionLabel>Protection mode</SectionLabel>
             <div className="mt-4 grid gap-3 sm:grid-cols-3">
@@ -174,7 +351,45 @@ export function SettingsWorkspace() {
           </div>
 
           <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
-            <SectionLabel>Default decisions</SectionLabel>
+            <SectionLabel>Risk choices</SectionLabel>
+            <div className="mt-4 divide-y divide-slate-200/70 overflow-hidden rounded-[1.35rem] border border-slate-200/70 bg-white">
+              {riskControls.map((risk) => (
+                <div key={risk.key} className="grid gap-3 px-4 py-4 md:grid-cols-[minmax(0,1fr)_220px] md:items-center">
+                  <div>
+                    <p className="text-sm font-semibold text-brand-dark">{risk.label}</p>
+                    <p className="mt-1 text-sm leading-6 text-muted-foreground">{risk.description}</p>
+                  </div>
+                  <SettingSelect
+                    label="Guard should"
+                    value={draft.risk_actions[risk.key] ?? "require-reapproval"}
+                    options={actionOptions}
+                    onChange={handleRiskActionChange(risk.key)}
+                  />
+                </div>
+              ))}
+            </div>
+          </div>
+
+          <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
+            <SectionLabel>Codex override</SectionLabel>
+            <div className="mt-4 grid gap-4 md:grid-cols-[minmax(0,1fr)_260px] md:items-center">
+              <div>
+                <p className="text-sm font-semibold text-brand-dark">Codex reading local secret files</p>
+                <p className="mt-1 text-sm leading-6 text-muted-foreground">
+                  Use this only for trusted projects where Codex should be allowed to open files such as .env or .npmrc.
+                </p>
+              </div>
+              <SettingSelect
+                label="Codex should"
+                value={draft.harness_risk_actions.codex?.local_secret_read ?? draft.risk_actions.local_secret_read ?? "require-reapproval"}
+                options={actionOptions}
+                onChange={handleCodexSecretReadChange}
+              />
+            </div>
+          </div>
+
+          <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
+            <SectionLabel>Advanced defaults</SectionLabel>
             <div className="mt-4 grid gap-4 md:grid-cols-2">
               <SettingSelect label="New action" value={draft.default_action} options={actionOptions} onChange={handleStringChange("default_action")} />
               <SettingSelect label="Unknown source" value={draft.unknown_publisher_action} options={actionOptions} onChange={handleStringChange("unknown_publisher_action")} />

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/docs/guard/harness-support.md

@@ -8,11 +8,13 @@ Current Guard support in this repo:
   - parses configured MCP servers
   - installs Guard-owned Codex `PreToolUse` Bash hooks so native shell commands can be denied before execution even when Codex itself is running in YOLO mode
   - supports wrapper-mode `guard run codex`
+  - wrapper prompt screening now suppresses copied debug and incident context while still escalating risky prompt intent
   - uses same-chat MCP elicitation for live managed MCP tool approvals in the interactive CLI and Codex App
   - falls back to the local approval center only for nonresponsive or headless Codex sessions such as `codex exec`
 - `claude-code`
   - detects global and project settings, hooks, `.mcp.json`, and workspace agents
   - supports local hook install and uninstall in `.claude/settings.local.json`
+  - has native `UserPromptSubmit` and `PreToolUse` Guard hook coverage
   - is the best current harness for graceful approval deferral
 - `copilot`
   - detects read-only user config in `~/.copilot/config.json` and `~/.copilot/mcp-config.json`
@@ -20,9 +22,11 @@ Current Guard support in this repo:
   - detects repo-local Copilot CLI hooks from `.github/hooks/*.json`
   - installs and removes Guard-owned repo hooks in `.github/hooks/hol-guard-copilot.json`
   - supports wrapper-mode `guard run copilot`
+  - has native `userPromptSubmitted`, `preToolUse`, and `postToolUse` hook coverage normalized onto the shared Guard runtime
 - `cursor`
   - detects global and project `mcp.json`
   - supports wrapper-mode management state
+  - wrapper prompt screening is covered for benign debug prompts and risky secret-read prompts
   - leaves native Cursor tool approval in place and focuses Guard on artifact trust
 - `antigravity`
   - detects Antigravity user settings, installed extension profiles, and Antigravity-owned MCP and skill roots
@@ -31,6 +35,7 @@ Current Guard support in this repo:
 - `gemini`
   - detects `.gemini/settings.json`, local extension manifests, embedded MCP declarations, hooks, and Gemini skill directories
   - supports wrapper-mode management state
+  - wrapper prompt screening is covered for benign debug prompts and risky secret-read prompts
   - falls back to the local approval center when Guard blocks a launch
 - `hermes`
   - detects Hermes skills plus MCP servers from `~/.hermes/config.yaml` and `~/.hermes/mcp_servers.json`
@@ -42,6 +47,7 @@ Current Guard support in this repo:
     plugin files, and OpenCode-compatible skill directories
   - supports wrapper-mode management state plus a Guard-owned runtime overlay for native skill approval prompts
   - supports wrapper-mode `guard run opencode`
+  - wrapper prompt screening is covered for benign debug prompts and risky secret-read prompts
   - keeps managed MCP tools on OpenCode native ask so the user can allow once, allow for the session, or reject inline
   - blocks newly introduced OpenCode MCP, plugin, and skill artifacts before launch when local Guard policy requires
     approval
@@ -54,6 +60,14 @@ Approval tiers:
 
 The harness adapters are designed to prefer discovery and reversible overlay behavior over invasive config mutation.
 
+The Guard Surface Server now provides one shared runtime shape across harnesses:
+
+- session attach
+- operation start and status updates
+- approval request items
+- approval-center lease and heartbeat tracking
+- resume or completion after approval
+
 Runtime intent protections:
 
 - Guard evaluates prompt and tool intent for secret-bearing files beyond `.env`, including SSH, AWS, kubeconfig, Docker, npm, and Python credential files.

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/docs/guard/testing-matrix.md

@@ -4,6 +4,8 @@ Automated coverage in this phase includes:
 
 - Guard CLI behavior tests for detect, scan, run, diff, receipts, install, uninstall, login, and sync
 - Guard product-flow tests for `hol-guard start`, `hol-guard status`, and launcher shim creation
+- prompt-risk regressions for Codex, Cursor, Gemini, and OpenCode wrapper launches
+- native prompt-hook regressions for Claude Code and Copilot hook events
 - SQLite persistence through real command execution in temporary homes and workspaces
 - consumer-mode JSON contract generation against scanner fixtures
 - local HTTP sync against a live in-process server instead of mocked transport
@@ -20,6 +22,8 @@ Manual verification should include:
 - `hol-guard detect opencode --json`
 - `hol-guard install opencode --json`
 - `hol-guard update --dry-run --json`
+- `hol-guard run cursor --dry-run --default-action allow --json`
+- `hol-guard run gemini --dry-run --default-action allow --json`
 - `hol-guard run opencode --dry-run --default-action allow --json`
 - `hol-guard run opencode --default-action require-reapproval --json`
 - `hol-guard approvals --json`

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.69"
+version = "2.0.71"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.69"
+version = "2.0.71"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/src/codex_plugin_scanner/guard/adapters/copilot.py

@@ -25,7 +25,7 @@ from .mcp_servers import (
     skipped_stdio_server_names,
 )
 
-_MANAGED_HOOK_EVENTS = ("preToolUse", "postToolUse", "permissionRequest")
+_MANAGED_HOOK_EVENTS = ("userPromptSubmitted", "preToolUse", "postToolUse", "permissionRequest")
 _DETECTABLE_HOOK_EVENTS = (
     "sessionStart",
     "sessionEnd",

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/src/codex_plugin_scanner/guard/adapters/cursor.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from pathlib import Path
+
 from ..models import GuardArtifact, HarnessDetection
 from .base import HarnessAdapter, HarnessContext, _command_available, _json_payload, _run_command_probe
 
@@ -25,6 +27,11 @@ class CursorHarnessAdapter(HarnessAdapter):
             return "project"
         return "global"
 
+    def policy_path(self, context: HarnessContext) -> Path:
+        if context.workspace_dir is not None:
+            return context.workspace_dir / ".cursor" / "mcp.json"
+        return context.home_dir / ".cursor" / "mcp.json"
+
     def detect(self, context: HarnessContext) -> HarnessDetection:
         config_paths = [context.home_dir / ".cursor" / "mcp.json"]
         if context.workspace_dir is not None:

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/src/codex_plugin_scanner/guard/adapters/gemini.py

@@ -39,6 +39,11 @@ class GeminiHarnessAdapter(HarnessAdapter):
             return ()
         return tuple(str(value) for value in raw_args if isinstance(value, str))
 
+    def policy_path(self, context: HarnessContext) -> Path:
+        if context.workspace_dir is not None:
+            return context.workspace_dir / ".gemini" / "settings.json"
+        return context.home_dir / ".gemini" / "settings.json"
+
     def detect(self, context: HarnessContext) -> HarnessDetection:
         artifacts: list[GuardArtifact] = []
         found_paths: list[str] = []

{plugin_scanner-2.0.69 → plugin_scanner-2.0.71}/src/codex_plugin_scanner/guard/adapters/opencode.py

@@ -97,6 +97,11 @@ class OpenCodeHarnessAdapter(HarnessAdapter):
             return "project"
         return "global"
 
+    def policy_path(self, context: HarnessContext) -> Path:
+        if context.workspace_dir is not None:
+            return context.workspace_dir / "opencode.json"
+        return context.home_dir / ".config" / "opencode" / "opencode.json"
+
     def detect(self, context: HarnessContext) -> HarnessDetection:
         artifacts = []
         found_paths: list[str] = []