plugin-scanner 2.0.806__tar.gz → 2.0.809__tar.gz

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.806
+Version: 2.0.809
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.806"
+version = "2.0.809"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.806"
+version = "2.0.809"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/aibom_cli.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import importlib
 import json
 import os
+import time
 import urllib.error
 import uuid
 from dataclasses import dataclass
@@ -60,17 +61,24 @@ def collect_aibom_snapshots(
 ) -> tuple[GuardAgentInventorySnapshot, ...]:
     resolved = options or AibomCliOptions()
     snapshots: list[GuardAgentInventorySnapshot] = []
+    remaining_cisco_timeout_seconds = resolved.cisco_timeout_seconds
     for detection in detect_all(context):
         if not detection.installed and not detection.artifacts:
             continue
+        cisco_started = time.monotonic()
         cisco_runs = run_cisco_inventory_scans(
             harness=str(getattr(detection, "harness", "unknown")),
             context=context,
             detection=detection,
             mcp_mode=resolved.cisco_mcp_scan,
             skill_mode=resolved.cisco_skill_scan,
-            timeout_seconds=resolved.cisco_timeout_seconds,
+            timeout_seconds=remaining_cisco_timeout_seconds,
         )
+        if remaining_cisco_timeout_seconds is not None:
+            remaining_cisco_timeout_seconds = max(
+                remaining_cisco_timeout_seconds - max(time.monotonic() - cisco_started, 0.0),
+                0.0,
+            )
         snapshots.append(
             inventory_snapshot_from_detection(
                 detection,

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/approvals.py

@@ -46,6 +46,7 @@ GUARD_DASHBOARD_URL = "https://hol.org/guard"
 GUARD_INBOX_URL = f"{GUARD_DASHBOARD_URL}/inbox"
 GUARD_FLEET_URL = f"{GUARD_DASHBOARD_URL}/protect"
 GUARD_CONNECT_URL = f"{GUARD_DASHBOARD_URL}/connect"
+_APPROVAL_ONCE_POLICY_TTL = timedelta(minutes=15)
 _WORKSPACE_SCOPED_RUNTIME_ARTIFACT_TYPES = frozenset(
     {
         "file_read_request",
@@ -329,7 +330,7 @@ def apply_approval_resolution(
     resolve_scope_matches: bool = True,
     approval_gate_input: ApprovalGateInput | None = None,
     approval_gate_grant: ApprovalGateGrant | None = None,
-    persist_policy: bool = True,
+    persist_policy: bool | None = None,
 ) -> dict[str, object]:
     request = store.get_approval_request(request_id)
     if request is None:
@@ -374,8 +375,17 @@ def apply_approval_resolution(
         approval_gate_grant=approval_gate_grant,
         now=resolved_at,
     )
-    if persist_policy:
+    if persist_policy is True or (persist_policy is None and scope != "artifact"):
         store.upsert_policy(decision, resolved_at, approval_gate_grant=resolved_gate_grant)
+    elif persist_policy is None and scope == "artifact":
+        store.upsert_policy(
+            replace(
+                decision,
+                expires_at=_approval_once_policy_expires_at(resolved_at),
+            ),
+            resolved_at,
+            approval_gate_grant=resolved_gate_grant,
+        )
     resolution_harness = None if scope == "global" else str(request["harness"])
     if return_queue_result:
         result = store.resolve_request_with_queue_result(
@@ -969,6 +979,11 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _approval_once_policy_expires_at(resolved_at: str) -> str:
+    parsed = datetime.fromisoformat(resolved_at.replace("Z", "+00:00"))
+    return (parsed + _APPROVAL_ONCE_POLICY_TTL).isoformat()
+
+
 def _build_runtime_cloud_context(
     store: GuardStore,
     latest_connect_state: dict[str, object] | None,

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/cli/approval_commands.py

@@ -28,7 +28,7 @@ _DEFAULT_RETRY_COPY = "Return to your AI assistant and retry"
 
 
 def _build_retry_hint(action: str, harness: str) -> dict[str, str]:
-    title = "Approved. Retry in chat." if action == "allow" else "Blocked. Guard will remember this decision."
+    title = "Approved. Retry in chat." if action == "allow" else "Blocked. Decision saved."
     return {"title": title, "body": _HARNESS_RETRY_COPY.get(harness, _DEFAULT_RETRY_COPY)}
 
 
@@ -54,6 +54,11 @@ def add_approval_parser(
             default="artifact",
         )
         decision_parser.add_argument("--reason")
+        decision_parser.add_argument(
+            "--remember",
+            action="store_true",
+            help="Save an exact-action remembered rule for artifact scope instead of resolving only this request.",
+        )
         add_common_args(decision_parser)
         decision_parser.add_argument("--json", action="store_true")
         decision_parser.set_defaults(approval_action=action)
@@ -235,6 +240,7 @@ def run_approval_command(
             reason=args.reason,
             now=_now(),
             approval_gate_input=gate_input,
+            persist_policy=True if bool(getattr(args, "remember", False)) else None,
         )
     except ApprovalGateError as error:
         return approval_gate_cli_payload(error)

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -324,6 +324,7 @@ def _finalize_guard_connect_payload(
     latest_state = store.record_latest_guard_connect_sync_success(
         sync_payload=sync_payload,
         now=str(sync_payload.get("synced_at") or now),
+        request_id=str(latest_state.get("request_id") or ""),
     )
     payload.update(
         {

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -1075,6 +1075,7 @@ def _finalize_daemon_guard_connect_payload(
     latest_state = store.record_latest_guard_connect_sync_success(
         sync_payload=sync_payload,
         now=str(sync_payload.get("synced_at") or now),
+        request_id=str(latest_state.get("request_id") or ""),
     )
     payload.update(
         {
@@ -1665,6 +1666,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             self._write_json({"resolved": False, "error": "missing_required_fields"}, status=400)
             return
         try:
+            persist_policy = self._approval_persist_policy(payload)
             updated = apply_approval_resolution(
                 store=self.server.store,  # type: ignore[attr-defined]
                 request_id=request_id,
@@ -1675,6 +1677,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 return_queue_result=True,
                 resolve_scope_matches=False,
                 approval_gate_input=approval_gate_input_from_mapping(payload),
+                persist_policy=persist_policy,
             )
         except ApprovalRequestNotFoundError:
             self._write_json(
@@ -3356,6 +3359,13 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 return False
         raise ValueError("invalid boolean value")
 
+    def _approval_persist_policy(self, payload: dict[str, object]) -> bool | None:
+        if "persist_policy" in payload:
+            return True if self._optional_bool(payload.get("persist_policy"), default=False) else None
+        if "remember" in payload:
+            return True if self._optional_bool(payload.get("remember"), default=False) else None
+        return None
+
     def _write_approval_gate_error(self, error: ApprovalGateError, *, resolved: bool | None = None) -> None:
         payload = error.to_payload()
         if resolved is not None:
@@ -5185,7 +5195,7 @@ _DEFAULT_RETRY_COPY = "Return to your AI assistant and retry"
 
 
 def _build_resolution_copy(action: str, harness: str) -> dict[str, str]:
-    title = "Approved. Retry in chat." if action == "allow" else "Blocked. Guard will remember this decision."
+    title = "Approved. Retry in chat." if action == "allow" else "Blocked. Decision saved."
     return {"title": title, "body": _HARNESS_RETRY_COPY.get(harness, _DEFAULT_RETRY_COPY)}
 
 

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -35,8 +35,20 @@ def run_cisco_inventory_scans(
     timeout_seconds: float | None = None,
 ) -> tuple[CiscoInventoryRun, ...]:
     runs: list[CiscoInventoryRun] = []
+    remaining_timeout_seconds = timeout_seconds
     if mcp_mode != "off":
-        runs.append(_run_mcp_inventory_scan(context=context, mode=mcp_mode, timeout_seconds=timeout_seconds))
+        mcp_started = time.perf_counter()
+        runs.append(
+            _run_mcp_inventory_scan(
+                context=context,
+                mode=mcp_mode,
+                timeout_seconds=remaining_timeout_seconds,
+            )
+        )
+        remaining_timeout_seconds = _consume_timeout_budget(
+            remaining_timeout_seconds,
+            started_at=mcp_started,
+        )
     if skill_mode != "off":
         runs.extend(
             _run_skill_inventory_scans(
@@ -44,7 +56,7 @@ def run_cisco_inventory_scans(
                 context=context,
                 detection=detection,
                 mode=skill_mode,
-                timeout_seconds=timeout_seconds,
+                timeout_seconds=remaining_timeout_seconds,
             )
         )
     return tuple(runs)
@@ -66,6 +78,15 @@ def _run_mcp_inventory_scan(
             duration_ms=0,
             metadata={"target": "missing", "targetsScanned": 0, "mode": mode},
         )
+    if timeout_seconds is not None and timeout_seconds <= 0:
+        return CiscoInventoryRun(
+            source="cisco-mcp-scanner",
+            status="timed_out",
+            message="Cisco MCP inventory scan timed out before Guard could start it.",
+            findings=(),
+            duration_ms=0,
+            metadata={"target": root.name, "targetsScanned": 0, "mode": mode},
+        )
     started = time.perf_counter()
     summary = run_cisco_mcp_scan(root, mode=mode, timeout_seconds=timeout_seconds)
     duration_ms = int((time.perf_counter() - started) * 1000)
@@ -107,14 +128,25 @@ def _run_skill_inventory_scans(
                 metadata={"target": "missing", "skillsScanned": 0, "mode": mode},
             ),
         )
-    return tuple(
-        _run_single_skill_inventory_scan(
-            root=root,
-            mode=mode,
-            timeout_seconds=timeout_seconds,
+    remaining_timeout_seconds = timeout_seconds
+    runs: list[CiscoInventoryRun] = []
+    for root in roots:
+        if remaining_timeout_seconds is not None and remaining_timeout_seconds <= 0:
+            runs.append(_build_skill_inventory_budget_exhausted_run(root=root, mode=mode))
+            continue
+        started = time.perf_counter()
+        runs.append(
+            _run_single_skill_inventory_scan(
+                root=root,
+                mode=mode,
+                timeout_seconds=remaining_timeout_seconds,
+            )
         )
-        for root in roots
-    )
+        remaining_timeout_seconds = _consume_timeout_budget(
+            remaining_timeout_seconds,
+            started_at=started,
+        )
+    return tuple(runs)
 
 
 def _run_single_skill_inventory_scan(
@@ -145,6 +177,26 @@ def _run_single_skill_inventory_scan(
     )
 
 
+def _build_skill_inventory_budget_exhausted_run(*, root: Path, mode: str) -> CiscoInventoryRun:
+    return CiscoInventoryRun(
+        source="cisco-skill-scanner",
+        status="timed_out",
+        message="Cisco skill scanner timed out before Guard could start this skill collection.",
+        findings=(),
+        duration_ms=0,
+        metadata={
+            "target": str(root),
+            "skillsScanned": 0,
+            "skillsSkipped": (),
+            "totalFindings": 0,
+            "findingsBySeverity": {},
+            "analyzersUsed": (),
+            "policyName": "balanced",
+            "mode": mode,
+        },
+    )
+
+
 def _mcp_scan_root(context: HarnessContext) -> Path | None:
     candidates = []
     if context.workspace_dir is not None:
@@ -190,15 +242,17 @@ def _artifact_skill_root(artifact: object, *, context: HarnessContext) -> Path |
                     continue
                 candidate = (base_dir / skill_root).resolve()
                 if candidate.is_dir():
-                    nested_skill_dirs = _skill_dirs_under(candidate)
-                    if len(nested_skill_dirs) == 1:
-                        return nested_skill_dirs[0]
                     if (candidate / "SKILL.md").is_file():
                         return candidate
+                    if _skill_dirs_under(candidate):
+                        return candidate
     config_path = getattr(artifact, "config_path", None)
     if not isinstance(config_path, str):
         return None
     skill_path = Path(config_path)
+    collection_root = _nearest_skill_collection_dir(skill_path)
+    if collection_root is not None and collection_root.is_dir():
+        return collection_root
     root = _nearest_skill_dir(skill_path)
     if root is not None and root.is_dir():
         return root
@@ -230,3 +284,23 @@ def _nearest_skill_dir(path: Path) -> Path | None:
         if (parent / "SKILL.md").is_file():
             return parent
     return None
+
+
+def _nearest_skill_collection_dir(path: Path) -> Path | None:
+    for parent in path.parents:
+        if parent.name != "skills":
+            continue
+        if _skill_dirs_under(parent):
+            return parent
+    return None
+
+
+def _consume_timeout_budget(
+    timeout_seconds: float | None,
+    *,
+    started_at: float,
+) -> float | None:
+    if timeout_seconds is None:
+        return None
+    elapsed_seconds = max(time.perf_counter() - started_at, 0.0)
+    return max(timeout_seconds - elapsed_seconds, 0.0)

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/guard/store.py

@@ -183,6 +183,7 @@ _OAUTH_LOCAL_CREDENTIALS_STATE_KEY = "oauth_local_credentials"
 _OAUTH_LOCAL_CREDENTIALS_HASH_KEY = "credentials_sha256"
 _OAUTH_LOCAL_CREDENTIALS_REF_KEY = "credentials_ref"
 _OAUTH_PRIMARY_SECRET_TIMEOUT_SECONDS = 2.0
+_APPROVAL_GATE_POLICY_SOURCE = "approval-gate"
 _GUARD_CLOUD_RESET_STATE_KEYS = (
     "sync_summary",
     "receipt_sync_cursor",
@@ -198,6 +199,12 @@ _GUARD_CLOUD_RESET_STATE_KEYS = (
     "supply_chain_bundle_daemon",
     "headless_app_sync_summary",
 )
+
+
+def _is_approval_gate_one_shot_policy(row: sqlite3.Row) -> bool:
+    return str(row["source"]) == _APPROVAL_GATE_POLICY_SOURCE and row["expires_at"] is not None
+
+
 _DEVICE_ROW_KEY = "local-device"
 _MAX_RESOLVED_SCOPE_IDS = 200
 _SQLITE_ID_BATCH_SIZE = 500
@@ -1006,11 +1013,20 @@ def _system_keyring_is_available(guard_home: Path, *, use_cache: bool = True) ->
 
 
 def _build_oauth_secret_store(guard_home: Path) -> SecretStore:
+    fallback_store = EncryptedFileSecretStore(guard_home)
     if sys.platform == "darwin":
+        cached_availability = _read_system_keyring_availability_cache(guard_home)
+        if cached_availability is True:
+            return FallbackSecretStore(
+                SystemKeyringSecretStore(service_name="hol-guard.oauth"),
+                fallback_store,
+            )
         if _system_keyring_is_available(guard_home, use_cache=False):
-            return SystemKeyringSecretStore(service_name="hol-guard.oauth")
+            return FallbackSecretStore(
+                SystemKeyringSecretStore(service_name="hol-guard.oauth"),
+                fallback_store,
+            )
         return UnavailableSecretStore(guard_home)
-    fallback_store = EncryptedFileSecretStore(guard_home)
     if _system_keyring_is_available(guard_home):
         return FallbackSecretStore(
             SystemKeyringSecretStore(service_name="hol-guard.oauth"),
@@ -1187,7 +1203,10 @@ class GuardStore:
         self._cached_policy_integrity_control_state = None
 
     def _oauth_primary_reads_are_no_ui_safe(self) -> bool:
-        return sys.platform == "darwin" and isinstance(self._oauth_secret_store, SystemKeyringSecretStore)
+        secret_store = self._oauth_secret_store
+        if isinstance(secret_store, FallbackSecretStore):
+            secret_store = secret_store.primary
+        return sys.platform == "darwin" and isinstance(secret_store, SystemKeyringSecretStore)
 
     def _get_secret_candidates(
         self,
@@ -3087,6 +3106,11 @@ class GuardStore:
                         integrity_result=integrity_result,
                         state=state,
                     )
+                    if _is_approval_gate_one_shot_policy(candidate):
+                        connection.execute(
+                            "delete from policy_decisions where decision_id = ?",
+                            (int(candidate["decision_id"]),),
+                        )
                     break
                 events.append(
                     (
@@ -3954,10 +3978,12 @@ class GuardStore:
                    payload_hash, payload_mac, integrity_key_id, signed_at
             from policy_decisions
         """
-        params: tuple[object, ...] = ()
+        params: tuple[object, ...] = (_APPROVAL_GATE_POLICY_SOURCE,)
+        conditions = ["not (source = ? and expires_at is not null)"]
         if harness is not None:
-            query += " where harness = ?"
-            params = (harness,)
+            conditions.append("harness = ?")
+            params = (_APPROVAL_GATE_POLICY_SOURCE, harness)
+        query += " where " + " and ".join(conditions)
         query += " order by updated_at desc"
         with self._connect() as connection:
             state = self._refresh_policy_integrity_state(connection, now=_now(), create_key=True)
@@ -5479,26 +5505,33 @@ class GuardStore:
         milestone: str,
         now: str,
         reason: str | None = None,
+        request_id: str | None = None,
         sync_payload: dict[str, object] | None = None,
     ) -> dict[str, object] | None:
         with self._connect() as connection:
-            row = connection.execute(
-                """
-                select request_id
-                from guard_connect_states
-                where status = 'connected'
-                  and milestone != 'first_sync_succeeded'
-                order by updated_at desc
-                limit 1
-                """
-            ).fetchone()
-            if row is None:
-                return None
-            latest_state = load_connect_state(connection, str(row["request_id"]), now=now)
+            latest_state: dict[str, object] | None
+            if isinstance(request_id, str) and request_id.strip():
+                latest_state = load_connect_state(connection, request_id.strip(), now=now)
+            else:
+                row = connection.execute(
+                    """
+                    select request_id
+                    from guard_connect_states
+                    where status in ('connected', 'retry_required')
+                      and milestone != 'first_sync_succeeded'
+                    order by updated_at desc
+                    limit 1
+                    """
+                ).fetchone()
+                if row is None:
+                    return None
+                latest_state = load_connect_state(connection, str(row["request_id"]), now=now)
             if latest_state is None:
                 return None
             if latest_state.get("status") not in {"connected", "retry_required"}:
                 return latest_state
+            if request_id is None and latest_state.get("status") != "connected":
+                return latest_state
             return persist_connect_result(
                 connection,
                 request_id=str(latest_state["request_id"]),
@@ -5514,12 +5547,14 @@ class GuardStore:
         *,
         sync_payload: dict[str, object],
         now: str,
+        request_id: str | None = None,
     ) -> dict[str, object] | None:
         return self.record_latest_guard_connect_sync_result(
             status="connected",
             milestone="first_sync_succeeded",
             now=now,
             reason=None,
+            request_id=request_id,
             sync_payload=sync_payload,
         )
 

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.806"
+__version__ = "2.0.809"

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/tests/test_guard_aibom_cli.py

@@ -4,6 +4,7 @@ import argparse
 import json
 from email.message import Message
 from pathlib import Path
+from types import SimpleNamespace
 
 import pytest
 
@@ -596,6 +597,55 @@ def test_sync_aibom_snapshots_uses_cloud_sync_cisco_defaults(tmp_path: Path, mon
     assert trust_attestation_context["workspaceId"] is None
 
 
+def test_collect_aibom_snapshots_shares_cisco_timeout_budget_across_detections(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from codex_plugin_scanner.guard import aibom_cli
+    from codex_plugin_scanner.guard.adapters.base import HarnessContext
+
+    context = HarnessContext(
+        home_dir=tmp_path / "home",
+        workspace_dir=tmp_path / "workspace",
+        guard_home=tmp_path / "guard",
+    )
+    context.home_dir.mkdir(parents=True)
+    assert context.workspace_dir is not None
+    context.workspace_dir.mkdir(parents=True)
+    context.guard_home.mkdir(parents=True)
+
+    detections = [
+        SimpleNamespace(installed=True, artifacts=(), harness="codex"),
+        SimpleNamespace(installed=True, artifacts=(), harness="openclaw"),
+    ]
+    observed_timeouts: list[float | None] = []
+    monotonic_values = iter([0.0, 4.0, 4.0, 9.0])
+
+    def fake_monotonic() -> float:
+        return next(monotonic_values)
+
+    monkeypatch.setattr(aibom_cli, "detect_all", lambda _context: detections)
+    monkeypatch.setattr(aibom_cli.time, "monotonic", fake_monotonic)
+    monkeypatch.setattr(
+        aibom_cli,
+        "run_cisco_inventory_scans",
+        lambda **kwargs: observed_timeouts.append(kwargs.get("timeout_seconds")) or (),
+    )
+    monkeypatch.setattr(
+        aibom_cli,
+        "inventory_snapshot_from_detection",
+        lambda *args, **kwargs: {"harness": getattr(args[0], "harness", "unknown"), "kwargs": kwargs},
+    )
+
+    snapshots = aibom_cli.collect_aibom_snapshots(
+        context,
+        generated_at="2026-06-10T12:00:00+00:00",
+        options=aibom_cli.AibomCliOptions(cisco_skill_scan="auto", cisco_timeout_seconds=10.0),
+    )
+
+    assert len(snapshots) == 2
+    assert observed_timeouts == [10.0, 6.0]
+
+
 def test_guard_aibom_sync_command_uses_cloud_sync_cisco_defaults(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.0.806 → plugin_scanner-2.0.809}/tests/test_guard_approval_copy_commands.py

@@ -686,7 +686,7 @@ class TestApprovalsRetryHintCommand:
         output = json.loads(capsys.readouterr().out)
 
         assert rc == 0
-        assert output["title"] == "Blocked. Guard will remember this decision."
+        assert output["title"] == "Blocked. Decision saved."
 
     def test_retry_hint_missing_request(self, tmp_path: Path, capsys) -> None:
         """T737: retry-hint with unknown request_id returns error."""