plugin-scanner 2.0.736__tar.gz → 2.0.738__tar.gz

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.736
+Version: 2.0.738
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/dashboard/src/shell-footer.test.ts

@@ -2,7 +2,7 @@ import {
   GITHUB_ISSUE_BUTTON_LABEL,
   GITHUB_ISSUE_LINK,
 } from "./github-issue-link";
-import { SHELL_FOOTER_RESOURCE_LINKS } from "./shell-footer";
+import { SHELL_FOOTER_LICENSE_HREF, SHELL_FOOTER_RESOURCE_LINKS } from "./shell-footer";
 
 function assert(condition: boolean, message: string): void {
   if (!condition) {
@@ -10,6 +10,11 @@ function assert(condition: boolean, message: string): void {
   }
 }
 
+assert(
+  SHELL_FOOTER_LICENSE_HREF.endsWith("/hol-guard/blob/main/LICENSE"),
+  "footer license link points at the repository LICENSE file"
+);
+
 assert(
   SHELL_FOOTER_RESOURCE_LINKS.length >= 4,
   "footer keeps a compact set of resource links for the workspace shell"

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/dashboard/src/shell-footer.tsx

@@ -1,5 +1,8 @@
 import { GITHUB_ISSUE_BUTTON_LABEL, GITHUB_ISSUE_LINK } from "./github-issue-link";
 
+export const SHELL_FOOTER_LICENSE_HREF =
+  "https://github.com/hashgraph-online/hol-guard/blob/main/LICENSE";
+
 export const SHELL_FOOTER_RESOURCE_LINKS = [
   { href: "https://hol.org/guard/docs", label: "Docs" },
   { href: "https://hol.org/guard", label: "Guard Cloud" },
@@ -14,7 +17,16 @@ export function ShellFooter() {
     <footer className="mt-auto border-t border-slate-200 bg-[#f8fafc]">
       <div className="mx-auto flex max-w-6xl flex-col gap-3 px-4 py-5 sm:flex-row sm:items-center sm:justify-between sm:px-6 lg:px-8">
         <p className="text-[11px] font-medium text-slate-400">
-          © {new Date().getFullYear()} HOL DAO LLC
+          HOL Guard is open source under{" "}
+          <a
+            href={SHELL_FOOTER_LICENSE_HREF}
+            target="_blank"
+            rel="noreferrer"
+            className="rounded-sm text-slate-500 no-underline transition-colors hover:text-brand-blue focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/30"
+          >
+            Apache-2.0
+          </a>
+          . Built by Hashgraph Online.
         </p>
         <nav aria-label="Guard resources" className="flex flex-wrap gap-x-4 gap-y-1">
           {SHELL_FOOTER_RESOURCE_LINKS.map((link) => (

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.736"
+version = "2.0.738"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.736"
+version = "2.0.738"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -255,6 +255,7 @@ def _finalize_guard_connect_payload(
         sync_payload = sync_local_guard_cloud_proof(
             store,
             auth_context=resolved_sync_auth_context,
+            now=now,
         )
     except GuardSyncNotAvailableError as error:
         store.record_latest_guard_connect_sync_result(

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -19,7 +19,10 @@ from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
 
 from ...version import __version__
-from ..package_firewall_entitlement import build_oauth_package_firewall_entitlement
+from ..package_firewall_entitlement import (
+    build_oauth_package_firewall_entitlement,
+    reconcile_connect_state_with_oauth_entitlement,
+)
 from ..runtime.runner import prepare_guard_cloud_connect_authorization
 from ..store import GuardStore
 from ..store_connect import build_connect_state_response
@@ -866,6 +869,7 @@ def _persist_oauth_local_credentials(
         runtime_label=runtime_label,
         now=now,
     )
+    reconcile_connect_state_with_oauth_entitlement(store, now=now)
 
 
 def run_guard_disconnect_command(

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -16144,6 +16144,7 @@ function buildGitHubIssueUrl(options) {
   return url.toString();
 }
 const GITHUB_ISSUE_LINK = buildGitHubIssueUrl();
+const SHELL_FOOTER_LICENSE_HREF = "https://github.com/hashgraph-online/hol-guard/blob/main/LICENSE";
 const SHELL_FOOTER_RESOURCE_LINKS = [
   { href: "https://hol.org/guard/docs", label: "Docs" },
   { href: "https://hol.org/guard", label: "Guard Cloud" },
@@ -16155,9 +16156,19 @@ const SHELL_FOOTER_RESOURCE_LINKS = [
 function ShellFooter() {
   return /* @__PURE__ */ jsxRuntimeExports.jsx("footer", { className: "mt-auto border-t border-slate-200 bg-[#f8fafc]", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mx-auto flex max-w-6xl flex-col gap-3 px-4 py-5 sm:flex-row sm:items-center sm:justify-between sm:px-6 lg:px-8", children: [
     /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "text-[11px] font-medium text-slate-400", children: [
-      "© ",
-      (/* @__PURE__ */ new Date()).getFullYear(),
-      " HOL DAO LLC"
+      "HOL Guard is open source under",
+      " ",
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        "a",
+        {
+          href: SHELL_FOOTER_LICENSE_HREF,
+          target: "_blank",
+          rel: "noreferrer",
+          className: "rounded-sm text-slate-500 no-underline transition-colors hover:text-brand-blue focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/30",
+          children: "Apache-2.0"
+        }
+      ),
+      ". Built by Hashgraph Online."
     ] }),
     /* @__PURE__ */ jsxRuntimeExports.jsx("nav", { "aria-label": "Guard resources", className: "flex flex-wrap gap-x-4 gap-y-1", children: SHELL_FOOTER_RESOURCE_LINKS.map((link) => /* @__PURE__ */ jsxRuntimeExports.jsx(
       "a",

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/src/codex_plugin_scanner/guard/package_firewall_entitlement.py

@@ -203,6 +203,33 @@ def _requires_guard_cloud_connect(
     return not (bundle is not None and bool(bundle.get("allowed")))
 
 
+def reconcile_connect_state_with_oauth_entitlement(
+    store: GuardStore,
+    *,
+    now: str,
+) -> dict[str, object] | None:
+    """Clear stale sync_not_available when OAuth credentials reflect a paid plan."""
+    latest_state = store.get_effective_guard_connect_state(now=now)
+    if not isinstance(latest_state, dict):
+        return None
+    milestone = _optional_string(latest_state.get("milestone"))
+    if milestone != "sync_not_available":
+        return None
+    oauth_payload = store.get_sync_payload("oauth_local_credentials")
+    oauth_fields = _oauth_entitlement_fields_from_sync_payload(oauth_payload)
+    if not isinstance(oauth_fields, dict):
+        return None
+    plan_id = _optional_string(oauth_fields.get("supply_chain_plan_id"))
+    if plan_id is None or plan_id.lower() not in PACKAGE_FIREWALL_PAID_TIERS:
+        return None
+    return store.record_latest_guard_connect_sync_result(
+        status="connected",
+        milestone="first_sync_pending",
+        now=now,
+        reason=None,
+    )
+
+
 def resolve_package_firewall_entitlement(
     store: GuardStore,
     *,

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -46,7 +46,10 @@ from ..config import GuardConfig
 from ..consumer import detect_harness, evaluate_detection
 from ..edge_events import build_runtime_session_event
 from ..models import GuardArtifact, HarnessDetection, PolicyDecision
-from ..package_firewall_entitlement import build_oauth_package_firewall_entitlement
+from ..package_firewall_entitlement import (
+    build_oauth_package_firewall_entitlement,
+    reconcile_connect_state_with_oauth_entitlement,
+)
 from ..policy_bundle_parser import (
     POLICY_BUNDLE_DEFAULT_ENVIRONMENTS,
     POLICY_BUNDLE_RULE_ACTIONS,
@@ -1984,9 +1987,12 @@ def sync_local_guard_cloud_proof(
     store: GuardStore,
     *,
     auth_context: dict[str, object] | None = None,
+    now: str | None = None,
 ) -> dict[str, object]:
     """Publish the local Guard runtime session before syncing receipts."""
+    resolved_now = now or _now()
     with store.hold_cloud_sync_lock():
+        reconcile_connect_state_with_oauth_entitlement(store, now=resolved_now)
         resolved_auth_context = auth_context if auth_context is not None else _resolve_guard_sync_auth_context(store)
         runtime_summary = sync_runtime_session(
             store,

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.736"
+__version__ = "2.0.738"

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/tests/test_guard_auto_first_sync.py

@@ -32,6 +32,7 @@ def test_finalize_guard_connect_payload_keeps_first_sync_pending_on_transient_sy
         _store: GuardStore,
         *,
         auth_context: dict[str, object] | None = None,
+        now: str | None = None,
     ) -> dict[str, object]:
         assert auth_context is None
         raise RuntimeError("temporary receipt sync failure")
@@ -80,6 +81,7 @@ def test_finalize_guard_connect_payload_keeps_first_sync_pending_on_sync_lock_ti
         _store: GuardStore,
         *,
         auth_context: dict[str, object] | None = None,
+        now: str | None = None,
     ) -> dict[str, object]:
         assert auth_context is None
         raise TimeoutError("Timed out waiting for Guard Cloud sync lock.")
@@ -121,6 +123,7 @@ def test_finalize_guard_connect_payload_uses_fresh_oauth_access_token_once(tmp_p
         _store: GuardStore,
         *,
         auth_context: dict[str, object] | None = None,
+        now: str | None = None,
     ) -> dict[str, object]:
         sync_calls.append(auth_context)
         return {
@@ -223,6 +226,7 @@ def test_daemon_finalize_guard_connect_payload_uses_fresh_oauth_access_token_onc
         _store: GuardStore,
         *,
         auth_context: dict[str, object] | None = None,
+        now: str | None = None,
     ) -> dict[str, object]:
         sync_calls.append(auth_context)
         return {
@@ -324,6 +328,7 @@ def test_daemon_finalize_guard_connect_payload_keeps_first_sync_pending_on_sync_
         _store: GuardStore,
         *,
         auth_context: dict[str, object] | None = None,
+        now: str | None = None,
     ) -> dict[str, object]:
         assert auth_context is None
         raise TimeoutError("Timed out waiting for Guard Cloud sync lock.")
@@ -457,6 +462,7 @@ def test_finalize_guard_connect_payload_keeps_reauth_failures_in_retry_required_
         _store: GuardStore,
         *,
         auth_context: dict[str, object] | None = None,
+        now: str | None = None,
     ) -> dict[str, object]:
         assert auth_context is None
         raise guard_commands_module.GuardSyncAuthorizationExpiredError("reauth required")
@@ -498,7 +504,12 @@ def test_headless_first_sync_auth_expiry_marks_connect_state_for_repair(tmp_path
         lambda: {"configured": True, "state": "healthy"},
     )
 
-    def _raise_auth_expired(_store: GuardStore) -> dict[str, object]:
+    def _raise_auth_expired(
+        _store: GuardStore,
+        *,
+        auth_context: dict[str, object] | None = None,
+        now: str | None = None,
+    ) -> dict[str, object]:
         raise guard_commands_module.GuardSyncAuthorizationExpiredError("reauth required")
 
     def _record_queue(*, store: GuardStore) -> dict[str, object]:

{plugin_scanner-2.0.736 → plugin_scanner-2.0.738}/tests/test_guard_cli.py

@@ -6712,6 +6712,7 @@ url = http://127.0.0.1:8787/guard-canary
             store: GuardStore,
             *,
             auth_context: dict[str, object] | None = None,
+            now: str | None = None,
         ) -> dict[str, object]:
             del store
             assert auth_context is None

plugin_scanner-2.0.738/tests/test_guard_package_firewall_entitlement.py

@@ -0,0 +1,135 @@
+"""Tests for package-firewall entitlement helpers."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from pathlib import Path
+
+from codex_plugin_scanner.guard.package_firewall_entitlement import (
+    build_oauth_package_firewall_entitlement,
+    reconcile_connect_state_with_oauth_entitlement,
+)
+from codex_plugin_scanner.guard.store import GuardStore
+
+
+def test_build_oauth_package_firewall_entitlement_preserves_team_tier() -> None:
+    entitlement = build_oauth_package_firewall_entitlement(
+        {
+            "guard_local_entitlement": {
+                "plan_id": "team",
+                "tier": "team",
+                "supply_chain_firewall": True,
+                "expires_at": "2026-06-30T00:00:00.000Z",
+            }
+        },
+        now=datetime(2026, 5, 31, tzinfo=timezone.utc),
+    )
+
+    assert entitlement == {
+        "plan_id": "team",
+        "supply_chain_entitlement_expires_at": "2026-06-30T00:00:00.000Z",
+        "supply_chain_firewall": True,
+        "supply_chain_plan_id": "team",
+    }
+
+
+def test_reconcile_connect_state_clears_stale_sync_not_available_for_paid_oauth(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    now = "2026-05-31T09:00:00.000Z"
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now=now,
+    )
+    store.record_latest_guard_connect_sync_result(
+        status="connected",
+        milestone="sync_not_available",
+        now=now,
+        reason="Guard sync requires a Pro or Team plan.",
+    )
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-token",
+        dpop_private_key_pem="-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VuBCIEIA==\n-----END PRIVATE KEY-----\n",
+        dpop_public_jwk={"kty": "OKP", "crv": "Ed25519", "x": "test"},
+        dpop_public_jwk_thumbprint="thumbprint-1",
+        supply_chain_plan_id="team",
+        supply_chain_firewall=True,
+        supply_chain_entitlement_expires_at="2026-06-30T00:00:00.000Z",
+        workspace_id="workspace-1",
+        now=now,
+    )
+
+    reconciled = reconcile_connect_state_with_oauth_entitlement(store, now=now)
+
+    assert reconciled is not None
+    assert reconciled.get("milestone") == "first_sync_pending"
+    effective = store.get_effective_guard_connect_state(now=now)
+    assert isinstance(effective, dict)
+    assert effective.get("milestone") == "first_sync_pending"
+
+
+def test_reconcile_connect_state_ignores_non_sync_not_available_milestones(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    now = "2026-05-31T09:00:00.000Z"
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now=now,
+    )
+
+    assert reconcile_connect_state_with_oauth_entitlement(store, now=now) is None
+
+
+def test_reconcile_connect_state_ignores_missing_oauth_credentials(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    now = "2026-05-31T09:00:00.000Z"
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now=now,
+    )
+    store.record_latest_guard_connect_sync_result(
+        status="connected",
+        milestone="sync_not_available",
+        now=now,
+        reason="Guard sync requires a Pro or Team plan.",
+    )
+
+    assert reconcile_connect_state_with_oauth_entitlement(store, now=now) is None
+
+
+def test_reconcile_connect_state_ignores_free_oauth_plan(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    now = "2026-05-31T09:00:00.000Z"
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now=now,
+    )
+    store.record_latest_guard_connect_sync_result(
+        status="connected",
+        milestone="sync_not_available",
+        now=now,
+        reason="Guard sync requires a Pro or Team plan.",
+    )
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-token",
+        dpop_private_key_pem="-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VuBCIEIA==\n-----END PRIVATE KEY-----\n",
+        dpop_public_jwk={"kty": "OKP", "crv": "Ed25519", "x": "test"},
+        dpop_public_jwk_thumbprint="thumbprint-1",
+        supply_chain_plan_id="free",
+        supply_chain_firewall=False,
+        supply_chain_entitlement_expires_at="2026-06-30T00:00:00.000Z",
+        workspace_id="workspace-1",
+        now=now,
+    )
+
+    assert reconcile_connect_state_with_oauth_entitlement(store, now=now) is None