plugin-scanner 2.0.800__tar.gz → 2.0.802__tar.gz

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.800
+Version: 2.0.802
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.800"
+version = "2.0.802"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.800"
+version = "2.0.802"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/src/codex_plugin_scanner/guard/adapters/opencode_artifacts.py

@@ -11,6 +11,7 @@ from ..models import GuardArtifact
 from ..runtime.mcp_skill_firewall import enrich_artifact_with_mcp_skill_firewall
 from .base import HarnessContext
 from .mcp_servers import is_guard_proxy_command, is_verified_guard_mcp_companion
+from .opencode_pretool import PLUGIN_FILENAME as GUARD_PRETOOL_PLUGIN_FILENAME
 
 CONFIG_FILENAMES = ("opencode.json", "opencode.jsonc")
 PLUGIN_SUFFIXES = {".js", ".ts", ".mjs", ".cjs"}
@@ -149,7 +150,7 @@ def append_directory_artifacts(
                 artifact_id=f"opencode:{scope}:{artifact_kind}:{artifact_name}",
                 name=artifact_name,
                 harness="opencode",
-                artifact_type="plugin" if artifact_kind == "plugin-file" else "command",
+                artifact_type=_directory_artifact_type(path, artifact_kind),
                 source_scope=scope,
                 config_path=str(path),
                 metadata=_file_metadata(path),
@@ -178,6 +179,14 @@ def append_directory_artifacts(
             append_artifact(artifacts, seen_artifact_ids, artifact)
 
 
+def _directory_artifact_type(path: Path, artifact_kind: str) -> str:
+    if artifact_kind == "command":
+        return "command"
+    if path.name == GUARD_PRETOOL_PLUGIN_FILENAME:
+        return "daemon_plugin"
+    return "plugin"
+
+
 def runtime_config_path(context: HarnessContext) -> Path:
     return context.guard_home / "opencode" / "runtime-config.json"
 

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/src/codex_plugin_scanner/guard/cli/commands_support_claude_approval.py

@@ -315,10 +315,12 @@ def _persist_claude_guard_question_decision(store: GuardStore, payload: dict[str
     artifact_hash_value = _optional_string(pending.get("artifact_hash"))
     if artifact_id is None or artifact_hash_value is None:
         return False
+    artifact_type = _optional_string(pending.get("artifact_type"))
     saved = _persist_claude_native_permission_policy(
         store=store,
         artifact_id=artifact_id,
         artifact_hash=artifact_hash_value,
+        artifact_type=artifact_type,
         action=action,
         reason=(
             "Allowed through HOL Guard AskUserQuestion approval."

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/src/codex_plugin_scanner/guard/cli/commands_support_permission_store.py

@@ -29,6 +29,7 @@ if TYPE_CHECKING:
     from .commands_support_runtime_resolution import _runtime_capabilities_summary
 
 
+from ..store import _runtime_scoped_exact_match_key
 from ._commands_shared import *
 from .commands_parser_helpers import *
 
@@ -414,19 +415,34 @@ def _persist_claude_native_permission_policy(
     store: GuardStore,
     artifact_id: str,
     artifact_hash: str,
+    artifact_type: str | None = None,
     action: str,
     reason: str,
     now: str,
     source: str = "claude-native-approval",
 ) -> bool:
+    exact_artifact_hash = (
+        _runtime_scoped_exact_match_key(artifact_id) if artifact_type == "tool_action_request" else None
+    )
+    stored_artifact_hash = exact_artifact_hash or artifact_hash
     try:
+        if artifact_type == "tool_action_request" and exact_artifact_hash is None:
+            store.add_event(
+                "claude/native_permission_exact_key_missing",
+                {
+                    "artifact_id": artifact_id,
+                    "artifact_type": artifact_type,
+                    "source": source,
+                },
+                now,
+            )
         store.upsert_policy(
             PolicyDecision(
                 harness="claude-code",
                 scope="artifact",
                 action="allow" if action == "allow" else "block",
                 artifact_id=artifact_id,
-                artifact_hash=artifact_hash,
+                artifact_hash=stored_artifact_hash,
                 reason=reason,
                 source=source,
             ),
@@ -436,7 +452,7 @@ def _persist_claude_native_permission_policy(
             "claude/native_permission_saved",
             {
                 "artifact_id": artifact_id,
-                "artifact_hash": artifact_hash,
+                "artifact_hash": stored_artifact_hash,
                 "action": action,
                 "reason": reason,
             },
@@ -464,6 +480,7 @@ def _persist_claude_native_permission_for_runtime_artifact(
         store=store,
         artifact_id=artifact.artifact_id,
         artifact_hash=artifact_hash,
+        artifact_type=artifact.artifact_type,
         action=action,
         reason=reason,
         now=now,

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/src/codex_plugin_scanner/guard/store.py

@@ -238,6 +238,9 @@ _REMOTE_POLICY_SOURCE_PARAMS = tuple(sorted(REMOTE_POLICY_SOURCES))
 _REMOTE_POLICY_SOURCE_PLACEHOLDERS = "(" + ",".join("?" for _ in _REMOTE_POLICY_SOURCE_PARAMS) + ")"
 _POLICY_SCOPES = frozenset({"artifact", "workspace", "publisher", "harness", "global"})
 _SLOW_STORE_WARNING_ENV = "HOL_GUARD_WARN_SLOW_STORE"
+_SQLITE_CONNECT_TIMEOUT_SECONDS = 30.0
+_SQLITE_LOCK_RETRY_ATTEMPTS = 5
+_SQLITE_LOCK_RETRY_DELAY_SECONDS = 0.1
 _SECRET_FINGERPRINT_PREFIX = "pbkdf2-sha256$"
 _SECRET_FINGERPRINT_SALT = b"hol-guard-secret-fingerprint:v1"
 _OAUTH_REFRESH_LOCK_TIMEOUT_SECONDS = 30.0
@@ -1729,7 +1732,7 @@ class GuardStore:
 
     @contextmanager
     def _connect(self) -> Iterator[sqlite3.Connection]:
-        connection = sqlite3.connect(self.path)
+        connection = sqlite3.connect(self.path, timeout=_SQLITE_CONNECT_TIMEOUT_SECONDS)
         connection.row_factory = sqlite3.Row
         start = time.monotonic()
         try:
@@ -2167,10 +2170,21 @@ class GuardStore:
             self._ensure_local_device(connection)
             if not self._schema_version_applied(connection, version=2):
                 self._record_schema_version(connection, version=2)
-            connection.execute("pragma journal_mode=WAL")
+            self._enable_wal_mode(connection)
             self._repair_store_permissions()
             self._refresh_policy_integrity_state(connection, now=_now(), create_key=False)
 
+    @staticmethod
+    def _enable_wal_mode(connection: sqlite3.Connection) -> None:
+        for attempt in range(_SQLITE_LOCK_RETRY_ATTEMPTS):
+            try:
+                connection.execute("pragma journal_mode=WAL")
+                return
+            except sqlite3.OperationalError as exc:
+                if "database is locked" not in str(exc).lower() or attempt == _SQLITE_LOCK_RETRY_ATTEMPTS - 1:
+                    raise
+                time.sleep(_SQLITE_LOCK_RETRY_DELAY_SECONDS)
+
     @staticmethod
     def _ensure_policy_column(connection: sqlite3.Connection, column_name: str, column_type: str) -> None:
         rows = connection.execute("pragma table_info(policy_decisions)").fetchall()

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.800"
+__version__ = "2.0.802"

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/tests/test_guard_aibom_trust_metadata.py

@@ -747,6 +747,46 @@ def test_inventory_snapshot_attaches_agent_config_trust_resolution(tmp_path: Pat
     )
 
 
+def test_inventory_snapshot_attaches_daemon_plugin_trust_resolution(tmp_path: Path) -> None:
+    workspace = tmp_path / "repo"
+    workspace.mkdir()
+    plugin_config = workspace / "daemon-plugin.json"
+    plugin_config.write_text(
+        json.dumps(
+            {
+                "name": "guard-daemon-helper",
+                "description": "Reviewed local daemon helper plugin.",
+                "governance": "Owned by Platform; changes require review.",
+                "boundaries": "Does not read secrets or execute unapproved commands.",
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    snapshot = _snapshot_for_artifact(
+        artifact=GuardArtifact(
+            artifact_id="codex:project:daemon-plugin:guard-daemon-helper",
+            name="guard-daemon-helper",
+            harness="codex",
+            artifact_type="daemon_plugin",
+            source_scope="project",
+            config_path=str(plugin_config),
+        ),
+        generated_at="2026-06-10T12:00:00+00:00",
+        home_dir=tmp_path,
+        workspace_dir=workspace,
+    )
+    daemon_item = next(item for item in snapshot.items if item.item_kind == "daemon_plugin")
+
+    trust, _metadata = _assert_local_trust(daemon_item.metadata, trust_domain="instructions")
+    components = trust.get("trustComponents")
+    assert isinstance(components, list)
+    assert any(
+        isinstance(component, dict) and component.get("componentId") == "instruction.operational-boundaries:score"
+        for component in components
+    )
+
+
 def test_inventory_snapshot_attaches_mcp_tool_trust_resolution(monkeypatch, tmp_path: Path) -> None:
     verification_key = _install_test_attestation_key(monkeypatch)
     workspace = tmp_path / "repo"

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/tests/test_guard_cli.py

@@ -1447,6 +1447,7 @@ args = ["workspace-skill.js"]
             },
         )
         _write_text(home_dir / ".config" / "opencode" / "plugins" / "global-local.mjs", "export default {};\n")
+        _write_text(home_dir / ".config" / "opencode" / "plugins" / "hol-guard-pretool.ts", "export default {};\n")
         _write_text(workspace_dir / ".opencode" / "plugins" / "project-local.mjs", "export default {};\n")
         _write_text(home_dir / ".config" / "opencode" / "commands" / "global-cmd.md", "# global\n")
         _write_text(workspace_dir / ".opencode" / "commands" / "triage.md", "# triage\n")
@@ -1482,6 +1483,7 @@ args = ["workspace-skill.js"]
         assert "opencode:global:plugin:opencode-global-plugin" in artifacts
         assert "opencode:project:plugin:opencode-project-plugin" in artifacts
         assert "opencode:global:plugin-file:plugins/global-local.mjs" in artifacts
+        assert "opencode:global:plugin-file:plugins/hol-guard-pretool.ts" in artifacts
         assert "opencode:project:plugin-file:plugins/project-local.mjs" in artifacts
         assert "opencode:global:config-command:global-review" in artifacts
         assert "opencode:project:config-command:project-review" in artifacts
@@ -1491,6 +1493,7 @@ args = ["workspace-skill.js"]
         assert "opencode:project:skill:opencode:skills/repo-skill" in artifacts
         assert "opencode:project:skill:claude:skills/claude-skill" in artifacts
         assert artifacts["opencode:project:plugin-file:plugins/project-local.mjs"]["artifact_type"] == "plugin"
+        assert artifacts["opencode:global:plugin-file:plugins/hol-guard-pretool.ts"]["artifact_type"] == "daemon_plugin"
         assert artifacts["opencode:project:config-command:project-review"]["metadata"]["template"] == (
             "Review the workspace change set."
         )

{plugin_scanner-2.0.800 → plugin_scanner-2.0.802}/tests/test_guard_runtime.py

@@ -25,6 +25,7 @@ from typing import ClassVar
 import pytest
 
 from codex_plugin_scanner.cli import main
+from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
 from codex_plugin_scanner.guard.approvals import apply_approval_resolution
 from codex_plugin_scanner.guard.cli import commands as guard_commands_module
@@ -53,7 +54,7 @@ from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
 from codex_plugin_scanner.guard.runtime import secret_file_requests as secret_file_requests_module
 from codex_plugin_scanner.guard.runtime.secret_file_requests import extract_sensitive_tool_action_request
 from codex_plugin_scanner.guard.runtime.signals import RiskSignalV2
-from codex_plugin_scanner.guard.store import GuardStore
+from codex_plugin_scanner.guard.store import GuardStore, _runtime_scoped_exact_match_key
 
 
 def _seed_guard_cloud(store, *, workspace_id=None, sync_url=None, token="demo-token", now="2026-05-19T00:00:00Z"):
@@ -8121,6 +8122,119 @@ def test_guard_hook_claude_ask_user_question_allow_persists_approval(tmp_path, c
     assert policies[0]["source"] == "claude-ask-user-question"
 
 
+def test_guard_hook_claude_ask_user_question_docker_retry_uses_exact_action_policy(
+    tmp_path,
+    capsys,
+    monkeypatch,
+):
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    _build_guard_fixture(home_dir, workspace_dir)
+    monkeypatch.setattr(GuardStore, "_policy_integrity_path_warnings", lambda self: [])
+    monkeypatch.setattr(
+        guard_store_module,
+        "_warn_only_policy_integrity_status",
+        lambda status, state, *, source="local": status == "degraded_mode",
+    )
+    command = "docker compose -f scripts/guard-cloud/docker-lab/docker-compose.yml up -d postgres"
+    first_event = {
+        "session_id": "session-claude-docker-allow",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "Bash",
+        "tool_input": {"command": command},
+        "source_scope": "project",
+    }
+    monkeypatch.setattr(guard_commands_module, "ensure_guard_daemon", lambda _guard_home: "http://127.0.0.1:4455")
+
+    first_rc, first_output = _run_guard_hook(
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+        harness="claude-code",
+        event=first_event,
+        capsys=capsys,
+        monkeypatch=monkeypatch,
+    )
+    permission_rc, permission_output = _run_guard_hook(
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+        harness="claude-code",
+        event={**first_event, "hook_event_name": "PermissionRequest"},
+        capsys=capsys,
+        monkeypatch=monkeypatch,
+    )
+    approval_question, question_options = _load_claude_pending_question_contract(
+        home_dir,
+        "session-claude-docker-allow",
+    )
+    question_rc, question_output = _run_guard_hook(
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+        harness="claude-code",
+        event={
+            "session_id": "session-claude-docker-allow",
+            "hook_event_name": "PostToolUse",
+            "tool_name": "AskUserQuestion",
+            "tool_input": {
+                "questions": [
+                    {
+                        "header": "HOL Guard",
+                        "question": approval_question,
+                        "options": question_options,
+                    }
+                ]
+            },
+            "tool_response": {
+                "questions": [
+                    {
+                        "header": "HOL Guard",
+                        "question": approval_question,
+                        "options": question_options,
+                    }
+                ],
+                "answers": {approval_question: "Allow during this session"},
+            },
+        },
+        capsys=capsys,
+        monkeypatch=monkeypatch,
+    )
+    second_rc, second_output = _run_guard_hook(
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+        harness="claude-code",
+        event={**first_event, "session_id": "session-claude-docker-allow-retry"},
+        capsys=capsys,
+        monkeypatch=monkeypatch,
+    )
+    store = GuardStore(home_dir)
+    policies = store.list_policy_decisions("claude-code")
+    policy = policies[0]
+    artifact_id = str(policy["artifact_id"])
+    stored_hash = str(policy["artifact_hash"])
+    drifted_hash_decision = store.resolve_policy_decision(
+        "claude-code",
+        artifact_id,
+        "runtime-hash-from-retry",
+        str(workspace_dir),
+    )
+    first_payload = json.loads(first_output)
+    permission_payload = json.loads(permission_output)
+    second_payload = json.loads(second_output)
+
+    assert first_rc == 0
+    assert first_payload["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "docker-sensitive command" in first_payload["hookSpecificOutput"]["permissionDecisionReason"]
+    assert permission_rc == 0
+    assert permission_payload["hookSpecificOutput"]["decision"]["behavior"] == "deny"
+    assert question_rc == 0
+    assert question_output == ""
+    assert second_rc == 0
+    assert second_payload["hookSpecificOutput"]["permissionDecision"] == "allow"
+    assert policy["source"] == "claude-ask-user-question"
+    assert stored_hash == _runtime_scoped_exact_match_key(artifact_id)
+    assert drifted_hash_decision is not None
+    assert drifted_hash_decision["action"] == "allow"
+
+
 def test_guard_hook_claude_notification_only_ask_user_question_persists_approval(tmp_path, capsys, monkeypatch):
     home_dir = tmp_path / "home"
     workspace_dir = tmp_path / "workspace"