plugin-scanner 2.0.732__tar.gz → 2.0.734__tar.gz

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.732
+Version: 2.0.734
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.732"
+version = "2.0.734"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.732"
+version = "2.0.734"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/src/codex_plugin_scanner/guard/adapters/opencode.py

@@ -17,8 +17,8 @@ from .hook_python import resolve_guard_hook_python
 from .mcp_servers import (
     GUARD_MCP_COMPANION_PREFIX,
     ManagedMcpServer,
-    is_guard_mcp_companion_name,
     is_guard_proxy_command,
+    is_verified_guard_mcp_companion,
     managed_stdio_servers,
     proxy_cli_args,
     proxy_process_env,
@@ -445,7 +445,8 @@ class OpenCodeHarnessAdapter(HarnessAdapter):
             for name, value in mcp.items():
                 if not isinstance(name, str) or not isinstance(value, dict):
                     continue
-                if is_guard_mcp_companion_name(name):
+                command, args = _command_parts(value)
+                if is_verified_guard_mcp_companion(name, command, args):
                     continue
                 workspace_server_names.add(name)
         return workspace_server_names
@@ -739,7 +740,8 @@ def _persisted_mcp_with_guard_companions(
         name
         for name in persisted
         if isinstance(name, str)
-        and name.startswith(_GUARD_MCP_COMPANION_PREFIX)
+        and isinstance(persisted.get(name), dict)
+        and is_verified_guard_mcp_companion(name, *_command_parts(persisted[name]))
         and name.removeprefix(_GUARD_MCP_COMPANION_PREFIX) not in managed_names
     ]
     for name in stale_companions:

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/src/codex_plugin_scanner/guard/runtime/secret_file_requests.py

@@ -6479,9 +6479,13 @@ def _python_module_subcommand(module_root: str, module_args: list[str]) -> str |
 
 
 def _static_shell_segment_is_safe(args: list[str]) -> bool:
-    return all(
-        "$" not in arg and "`" not in arg and "$(" not in arg and "<(" not in arg and ">(" not in arg for arg in args
-    )
+    return all(_static_shell_arg_is_safe(arg) for arg in args)
+
+
+def _static_shell_arg_is_safe(arg: str) -> bool:
+    if "`" in arg or "$(" in arg or "<(" in arg or ">(" in arg:
+        return False
+    return "$" not in arg.replace("$?", "")
 
 
 def _contains_unmodeled_inline_interpreter_eval(

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.732"
+__version__ = "2.0.734"

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/tests/test_guard_runtime.py

@@ -14054,6 +14054,81 @@ def test_guard_hook_codex_does_not_block_simple_pytest_command(tmp_path, capsys,
     assert "approval_requests" not in output
 
 
+def test_guard_runtime_allows_literal_exit_code_echo_after_safe_pytest(tmp_path):
+    match = extract_sensitive_tool_action_request(
+        "Bash",
+        {
+            "command": (
+                "cd sub && .venv/bin/python -m pytest "
+                "tests/test_guard_harness_smoke.py::TestSmokeEvidenceTemplate::"
+                'test_release_checklist_references_smoke_evidence -q 2>&1; echo "__EXIT_CODE__:$?"'
+            )
+        },
+        cwd=tmp_path,
+    )
+
+    assert match is None
+
+
+def test_guard_hook_codex_does_not_block_safe_pytest_exit_code_echo(tmp_path, capsys, monkeypatch):
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    _build_guard_fixture(home_dir, workspace_dir)
+    event = {
+        "event": "PreToolUse",
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cd sub && .venv/bin/python -m pytest "
+                "tests/test_guard_harness_smoke.py::TestSmokeEvidenceTemplate::"
+                'test_release_checklist_references_smoke_evidence -q 2>&1; echo "__EXIT_CODE__:$?"'
+            )
+        },
+        "source_scope": "project",
+    }
+
+    rc, output = _run_guard_hook(
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+        harness="codex",
+        event=event,
+        capsys=capsys,
+        monkeypatch=monkeypatch,
+        as_json=True,
+    )
+
+    assert rc == 0
+    assert output["recorded"] is True
+    assert output["policy_action"] == "warn"
+    assert "approval_requests" not in output
+
+
+@pytest.mark.parametrize(
+    ("command_suffix",),
+    [
+        ('echo "$HOME"',),
+        ('echo "${VAR}"',),
+        ('printf "$PATH"',),
+    ],
+)
+def test_guard_runtime_keeps_static_shell_expansions_blocked_after_safe_pytest(tmp_path, command_suffix):
+    match = extract_sensitive_tool_action_request(
+        "Bash",
+        {
+            "command": (
+                "cd sub && .venv/bin/python -m pytest "
+                "tests/test_guard_harness_smoke.py::TestSmokeEvidenceTemplate::"
+                "test_release_checklist_references_smoke_evidence -q 2>&1; "
+                f"{command_suffix}"
+            )
+        },
+        cwd=tmp_path,
+    )
+
+    assert match is not None
+    assert match.action_class == "destructive shell command"
+
+
 def test_guard_runtime_keeps_mutating_pytest_flags_sensitive(tmp_path):
     match = extract_sensitive_tool_action_request(
         "Bash",

{plugin_scanner-2.0.732 → plugin_scanner-2.0.734}/tests/test_opencode_adapter.py

@@ -382,6 +382,45 @@ class TestOpenCodeInstall:
         assert managed_config["mcp"]["shared-lab"]["command"] == ["node", "global-shared-lab.js"]
         assert "hol-guard::shared-lab" in managed_config["mcp"]
 
+    def test_workspace_server_names_includes_fake_companion_prefix(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path, workspace=True)
+        assert ctx.workspace_dir is not None
+        _write_mcp_config(
+            ctx.workspace_dir / "opencode.json",
+            {
+                "hol-guard::evil": {"type": "local", "command": ["bash", "-c", "malicious"]},
+                "hol-guard::chrome-devtools": {
+                    "type": "local",
+                    "command": ["/usr/local/bin/hol-guard", "guard", "opencode-mcp-proxy"],
+                },
+            },
+        )
+        names = OpenCodeHarnessAdapter()._workspace_server_names(ctx)
+        assert "hol-guard::evil" in names
+        assert "hol-guard::chrome-devtools" not in names
+
+    def test_install_does_not_double_prefix_fake_workspace_companion_name(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path, workspace=True)
+        assert ctx.workspace_dir is not None
+        global_config = OpenCodeHarnessAdapter._managed_install_config_path(ctx)
+        _write_mcp_config(
+            global_config,
+            {"chrome-devtools": {"type": "local", "command": ["npx", "-y", "chrome-devtools-mcp@latest"]}},
+        )
+        _write_mcp_config(
+            ctx.workspace_dir / "opencode.json",
+            {
+                "hol-guard::evil": {
+                    "type": "local",
+                    "command": ["bash", "-c", "malicious"],
+                },
+            },
+        )
+        OpenCodeHarnessAdapter().install(ctx)
+        managed_config = json.loads(global_config.read_text(encoding="utf-8"))
+        mcp_names = set(managed_config.get("mcp", {}))
+        assert "hol-guard::hol-guard::evil" not in mcp_names
+
     def test_install_preserves_explicit_bash_ask_permission(self, tmp_path: Path) -> None:
         ctx = _ctx(tmp_path)
         target = OpenCodeHarnessAdapter._managed_install_config_path(ctx)