plugin-scanner 2.0.808__tar.gz → 2.0.810__tar.gz

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.808
+Version: 2.0.810
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.808"
+version = "2.0.810"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.808"
+version = "2.0.810"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/aibom_cli.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import importlib
 import json
 import os
+import time
 import urllib.error
 import uuid
 from dataclasses import dataclass
@@ -60,17 +61,24 @@ def collect_aibom_snapshots(
 ) -> tuple[GuardAgentInventorySnapshot, ...]:
     resolved = options or AibomCliOptions()
     snapshots: list[GuardAgentInventorySnapshot] = []
+    remaining_cisco_timeout_seconds = resolved.cisco_timeout_seconds
     for detection in detect_all(context):
         if not detection.installed and not detection.artifacts:
             continue
+        cisco_started = time.monotonic()
         cisco_runs = run_cisco_inventory_scans(
             harness=str(getattr(detection, "harness", "unknown")),
             context=context,
             detection=detection,
             mcp_mode=resolved.cisco_mcp_scan,
             skill_mode=resolved.cisco_skill_scan,
-            timeout_seconds=resolved.cisco_timeout_seconds,
+            timeout_seconds=remaining_cisco_timeout_seconds,
         )
+        if remaining_cisco_timeout_seconds is not None:
+            remaining_cisco_timeout_seconds = max(
+                remaining_cisco_timeout_seconds - max(time.monotonic() - cisco_started, 0.0),
+                0.0,
+            )
         snapshots.append(
             inventory_snapshot_from_detection(
                 detection,

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -324,6 +324,7 @@ def _finalize_guard_connect_payload(
     latest_state = store.record_latest_guard_connect_sync_success(
         sync_payload=sync_payload,
         now=str(sync_payload.get("synced_at") or now),
+        request_id=str(latest_state.get("request_id") or ""),
     )
     payload.update(
         {

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -1075,6 +1075,7 @@ def _finalize_daemon_guard_connect_payload(
     latest_state = store.record_latest_guard_connect_sync_success(
         sync_payload=sync_payload,
         now=str(sync_payload.get("synced_at") or now),
+        request_id=str(latest_state.get("request_id") or ""),
     )
     payload.update(
         {
@@ -2089,7 +2090,11 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                     device_name=device_name,
                 )
             )
-            self.server.store.replace_remote_policies(existing_remote_decisions, applied_at)  # type: ignore[attr-defined]
+            self.server.store.replace_remote_policies(  # type: ignore[attr-defined]
+                existing_remote_decisions,
+                applied_at,
+                remote_write_authorized=True,
+            )
             _persist_cloud_exceptions(
                 self.server.store,  # type: ignore[attr-defined]
                 policy_bundle=validated_policy_bundle,
@@ -2157,6 +2162,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 decision,
                 _now(),
                 approval_gate_grant=approval_gate_grant,
+                remote_write_authorized=True,
             )
         except ApprovalGateError as error:
             self._write_approval_gate_error(error)

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -35,8 +35,20 @@ def run_cisco_inventory_scans(
     timeout_seconds: float | None = None,
 ) -> tuple[CiscoInventoryRun, ...]:
     runs: list[CiscoInventoryRun] = []
+    remaining_timeout_seconds = timeout_seconds
     if mcp_mode != "off":
-        runs.append(_run_mcp_inventory_scan(context=context, mode=mcp_mode, timeout_seconds=timeout_seconds))
+        mcp_started = time.perf_counter()
+        runs.append(
+            _run_mcp_inventory_scan(
+                context=context,
+                mode=mcp_mode,
+                timeout_seconds=remaining_timeout_seconds,
+            )
+        )
+        remaining_timeout_seconds = _consume_timeout_budget(
+            remaining_timeout_seconds,
+            started_at=mcp_started,
+        )
     if skill_mode != "off":
         runs.extend(
             _run_skill_inventory_scans(
@@ -44,7 +56,7 @@ def run_cisco_inventory_scans(
                 context=context,
                 detection=detection,
                 mode=skill_mode,
-                timeout_seconds=timeout_seconds,
+                timeout_seconds=remaining_timeout_seconds,
             )
         )
     return tuple(runs)
@@ -66,6 +78,15 @@ def _run_mcp_inventory_scan(
             duration_ms=0,
             metadata={"target": "missing", "targetsScanned": 0, "mode": mode},
         )
+    if timeout_seconds is not None and timeout_seconds <= 0:
+        return CiscoInventoryRun(
+            source="cisco-mcp-scanner",
+            status="timed_out",
+            message="Cisco MCP inventory scan timed out before Guard could start it.",
+            findings=(),
+            duration_ms=0,
+            metadata={"target": root.name, "targetsScanned": 0, "mode": mode},
+        )
     started = time.perf_counter()
     summary = run_cisco_mcp_scan(root, mode=mode, timeout_seconds=timeout_seconds)
     duration_ms = int((time.perf_counter() - started) * 1000)
@@ -107,14 +128,25 @@ def _run_skill_inventory_scans(
                 metadata={"target": "missing", "skillsScanned": 0, "mode": mode},
             ),
         )
-    return tuple(
-        _run_single_skill_inventory_scan(
-            root=root,
-            mode=mode,
-            timeout_seconds=timeout_seconds,
+    remaining_timeout_seconds = timeout_seconds
+    runs: list[CiscoInventoryRun] = []
+    for root in roots:
+        if remaining_timeout_seconds is not None and remaining_timeout_seconds <= 0:
+            runs.append(_build_skill_inventory_budget_exhausted_run(root=root, mode=mode))
+            continue
+        started = time.perf_counter()
+        runs.append(
+            _run_single_skill_inventory_scan(
+                root=root,
+                mode=mode,
+                timeout_seconds=remaining_timeout_seconds,
+            )
         )
-        for root in roots
-    )
+        remaining_timeout_seconds = _consume_timeout_budget(
+            remaining_timeout_seconds,
+            started_at=started,
+        )
+    return tuple(runs)
 
 
 def _run_single_skill_inventory_scan(
@@ -145,6 +177,26 @@ def _run_single_skill_inventory_scan(
     )
 
 
+def _build_skill_inventory_budget_exhausted_run(*, root: Path, mode: str) -> CiscoInventoryRun:
+    return CiscoInventoryRun(
+        source="cisco-skill-scanner",
+        status="timed_out",
+        message="Cisco skill scanner timed out before Guard could start this skill collection.",
+        findings=(),
+        duration_ms=0,
+        metadata={
+            "target": str(root),
+            "skillsScanned": 0,
+            "skillsSkipped": (),
+            "totalFindings": 0,
+            "findingsBySeverity": {},
+            "analyzersUsed": (),
+            "policyName": "balanced",
+            "mode": mode,
+        },
+    )
+
+
 def _mcp_scan_root(context: HarnessContext) -> Path | None:
     candidates = []
     if context.workspace_dir is not None:
@@ -190,15 +242,17 @@ def _artifact_skill_root(artifact: object, *, context: HarnessContext) -> Path |
                     continue
                 candidate = (base_dir / skill_root).resolve()
                 if candidate.is_dir():
-                    nested_skill_dirs = _skill_dirs_under(candidate)
-                    if len(nested_skill_dirs) == 1:
-                        return nested_skill_dirs[0]
                     if (candidate / "SKILL.md").is_file():
                         return candidate
+                    if _skill_dirs_under(candidate):
+                        return candidate
     config_path = getattr(artifact, "config_path", None)
     if not isinstance(config_path, str):
         return None
     skill_path = Path(config_path)
+    collection_root = _nearest_skill_collection_dir(skill_path)
+    if collection_root is not None and collection_root.is_dir():
+        return collection_root
     root = _nearest_skill_dir(skill_path)
     if root is not None and root.is_dir():
         return root
@@ -230,3 +284,23 @@ def _nearest_skill_dir(path: Path) -> Path | None:
         if (parent / "SKILL.md").is_file():
             return parent
     return None
+
+
+def _nearest_skill_collection_dir(path: Path) -> Path | None:
+    for parent in path.parents:
+        if parent.name != "skills":
+            continue
+        if _skill_dirs_under(parent):
+            return parent
+    return None
+
+
+def _consume_timeout_budget(
+    timeout_seconds: float | None,
+    *,
+    started_at: float,
+) -> float | None:
+    if timeout_seconds is None:
+        return None
+    elapsed_seconds = max(time.perf_counter() - started_at, 0.0)
+    return max(timeout_seconds - elapsed_seconds, 0.0)

plugin_scanner-2.0.810/src/codex_plugin_scanner/guard/policy_authority.py

@@ -0,0 +1,23 @@
+"""Authority checks for remembered local rules and Cloud policy rows."""
+
+from __future__ import annotations
+
+from .models import PolicyDecision
+from .policy_integrity import is_remote_policy_source
+
+
+class PolicyAuthorityError(ValueError):
+    """Raised when a policy row would cross its allowed authority boundary."""
+
+
+def validate_policy_write_authority(
+    decision: PolicyDecision,
+    *,
+    remote_write_authorized: bool = False,
+) -> None:
+    """Reject local writes that would impersonate stronger authority."""
+
+    if is_remote_policy_source(decision.source):
+        if remote_write_authorized:
+            return
+        raise PolicyAuthorityError("remote_policy_source_requires_validated_sync_path")

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -284,7 +284,7 @@ def _execute_policy_sync(
         source="cloud-sync",
         expires_at=_optional_string(policy_memory.get("expiry")),
     )
-    store.upsert_policy(decision, generated_at)
+    store.upsert_policy(decision, generated_at, remote_write_authorized=True)
     return _result(
         {
             "action": "policy_sync",

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -1397,7 +1397,7 @@ def sync_receipts(
     remote_policies_stored = len(remote_decisions)
     remote_policy_sync_blocked = False
     try:
-        store.replace_remote_policies(list(remote_decisions), now)
+        store.replace_remote_policies(list(remote_decisions), now, remote_write_authorized=True)
     except ApprovalGateError as error:
         remote_policies_stored = 0
         remote_policy_sync_blocked = True

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/guard/store.py

@@ -42,6 +42,7 @@ from .local_trust_contract import (
     TrustStatus,
 )
 from .models import GuardApprovalRequest, GuardArtifact, GuardReceipt, GuardRuntimeState, PolicyDecision
+from .policy_authority import validate_policy_write_authority
 from .policy_integrity import (
     REMOTE_POLICY_SOURCES,
     PolicyIntegrityVerificationResult,
@@ -1015,6 +1016,12 @@ def _system_keyring_is_available(guard_home: Path, *, use_cache: bool = True) ->
 def _build_oauth_secret_store(guard_home: Path) -> SecretStore:
     fallback_store = EncryptedFileSecretStore(guard_home)
     if sys.platform == "darwin":
+        cached_availability = _read_system_keyring_availability_cache(guard_home)
+        if cached_availability is True:
+            return FallbackSecretStore(
+                SystemKeyringSecretStore(service_name="hol-guard.oauth"),
+                fallback_store,
+            )
         if _system_keyring_is_available(guard_home, use_cache=False):
             return FallbackSecretStore(
                 SystemKeyringSecretStore(service_name="hol-guard.oauth"),
@@ -1139,6 +1146,13 @@ class GuardStore:
             if persisted_value == value:
                 return
             raise RuntimeError("Guard could not persist local Guard Cloud authorization securely.")
+        if sys.platform == "darwin" and isinstance(secret_store, FallbackSecretStore):
+            primary = secret_store.primary
+            if isinstance(primary, SystemKeyringSecretStore):
+                persisted_value = self._get_secret_from_primary_store(primary, secret_id)
+                if persisted_value == value:
+                    return
+                raise RuntimeError("Guard could not persist local Guard Cloud authorization securely.")
         if isinstance(secret_store, UnavailableSecretStore):
             raise RuntimeError(
                 "Guard local credentials require an available OS credential store. "
@@ -2826,7 +2840,12 @@ class GuardStore:
         now: str,
         *,
         approval_gate_grant: ApprovalGateGrant | None = None,
+        remote_write_authorized: bool = False,
     ) -> None:
+        validate_policy_write_authority(
+            decision,
+            remote_write_authorized=remote_write_authorized,
+        )
         require_policy_write(
             self.guard_home,
             decision=decision,
@@ -2913,8 +2932,13 @@ class GuardStore:
         now: str,
         *,
         approval_gate_grant: ApprovalGateGrant | None = None,
+        remote_write_authorized: bool = False,
     ) -> None:
         for decision in decisions:
+            validate_policy_write_authority(
+                decision,
+                remote_write_authorized=remote_write_authorized,
+            )
             require_policy_write(
                 self.guard_home,
                 decision=decision,
@@ -5499,26 +5523,33 @@ class GuardStore:
         milestone: str,
         now: str,
         reason: str | None = None,
+        request_id: str | None = None,
         sync_payload: dict[str, object] | None = None,
     ) -> dict[str, object] | None:
         with self._connect() as connection:
-            row = connection.execute(
-                """
-                select request_id
-                from guard_connect_states
-                where status in ('connected', 'retry_required')
-                  and milestone != 'first_sync_succeeded'
-                order by updated_at desc
-                limit 1
-                """
-            ).fetchone()
-            if row is None:
-                return None
-            latest_state = load_connect_state(connection, str(row["request_id"]), now=now)
+            latest_state: dict[str, object] | None
+            if isinstance(request_id, str) and request_id.strip():
+                latest_state = load_connect_state(connection, request_id.strip(), now=now)
+            else:
+                row = connection.execute(
+                    """
+                    select request_id
+                    from guard_connect_states
+                    where status in ('connected', 'retry_required')
+                      and milestone != 'first_sync_succeeded'
+                    order by updated_at desc
+                    limit 1
+                    """
+                ).fetchone()
+                if row is None:
+                    return None
+                latest_state = load_connect_state(connection, str(row["request_id"]), now=now)
             if latest_state is None:
                 return None
             if latest_state.get("status") not in {"connected", "retry_required"}:
                 return latest_state
+            if request_id is None and latest_state.get("status") != "connected":
+                return latest_state
             return persist_connect_result(
                 connection,
                 request_id=str(latest_state["request_id"]),
@@ -5534,12 +5565,14 @@ class GuardStore:
         *,
         sync_payload: dict[str, object],
         now: str,
+        request_id: str | None = None,
     ) -> dict[str, object] | None:
         return self.record_latest_guard_connect_sync_result(
             status="connected",
             milestone="first_sync_succeeded",
             now=now,
             reason=None,
+            request_id=request_id,
             sync_payload=sync_payload,
         )
 

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.808"
+__version__ = "2.0.810"

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/tests/test_guard_aibom_cli.py

@@ -4,6 +4,7 @@ import argparse
 import json
 from email.message import Message
 from pathlib import Path
+from types import SimpleNamespace
 
 import pytest
 
@@ -596,6 +597,55 @@ def test_sync_aibom_snapshots_uses_cloud_sync_cisco_defaults(tmp_path: Path, mon
     assert trust_attestation_context["workspaceId"] is None
 
 
+def test_collect_aibom_snapshots_shares_cisco_timeout_budget_across_detections(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from codex_plugin_scanner.guard import aibom_cli
+    from codex_plugin_scanner.guard.adapters.base import HarnessContext
+
+    context = HarnessContext(
+        home_dir=tmp_path / "home",
+        workspace_dir=tmp_path / "workspace",
+        guard_home=tmp_path / "guard",
+    )
+    context.home_dir.mkdir(parents=True)
+    assert context.workspace_dir is not None
+    context.workspace_dir.mkdir(parents=True)
+    context.guard_home.mkdir(parents=True)
+
+    detections = [
+        SimpleNamespace(installed=True, artifacts=(), harness="codex"),
+        SimpleNamespace(installed=True, artifacts=(), harness="openclaw"),
+    ]
+    observed_timeouts: list[float | None] = []
+    monotonic_values = iter([0.0, 4.0, 4.0, 9.0])
+
+    def fake_monotonic() -> float:
+        return next(monotonic_values)
+
+    monkeypatch.setattr(aibom_cli, "detect_all", lambda _context: detections)
+    monkeypatch.setattr(aibom_cli.time, "monotonic", fake_monotonic)
+    monkeypatch.setattr(
+        aibom_cli,
+        "run_cisco_inventory_scans",
+        lambda **kwargs: observed_timeouts.append(kwargs.get("timeout_seconds")) or (),
+    )
+    monkeypatch.setattr(
+        aibom_cli,
+        "inventory_snapshot_from_detection",
+        lambda *args, **kwargs: {"harness": getattr(args[0], "harness", "unknown"), "kwargs": kwargs},
+    )
+
+    snapshots = aibom_cli.collect_aibom_snapshots(
+        context,
+        generated_at="2026-06-10T12:00:00+00:00",
+        options=aibom_cli.AibomCliOptions(cisco_skill_scan="auto", cisco_timeout_seconds=10.0),
+    )
+
+    assert len(snapshots) == 2
+    assert observed_timeouts == [10.0, 6.0]
+
+
 def test_guard_aibom_sync_command_uses_cloud_sync_cisco_defaults(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/tests/test_guard_command_queue.py

@@ -1089,10 +1089,16 @@ def test_executor_syncs_policy_without_local_request_id(tmp_path: Path) -> None:
     class PolicyStore(FakeStore):
         def __init__(self, guard_home: Path) -> None:
             super().__init__(guard_home)
-            self.upserts: list[tuple[dict[str, object], str]] = []
+            self.upserts: list[tuple[dict[str, object], str, bool]] = []
 
-        def upsert_policy(self, decision: object, generated_at: str) -> None:
-            self.upserts.append((decision.to_dict(), generated_at))
+        def upsert_policy(
+            self,
+            decision: object,
+            generated_at: str,
+            *,
+            remote_write_authorized: bool = False,
+        ) -> None:
+            self.upserts.append((decision.to_dict(), generated_at, remote_write_authorized))
 
     store = PolicyStore(tmp_path / "guard-home")
     result = command_executors.execute_guard_command_job(
@@ -1134,6 +1140,7 @@ def test_executor_syncs_policy_without_local_request_id(tmp_path: Path) -> None:
                 "expires_at": None,
             },
             "2026-06-13T00:00:00+00:00",
+            True,
         )
     ]
 
@@ -1144,8 +1151,15 @@ def test_executor_maps_unknown_cloud_policy_scope_to_artifact(tmp_path: Path) ->
             super().__init__(guard_home)
             self.upserts: list[dict[str, object]] = []
 
-        def upsert_policy(self, decision: object, generated_at: str) -> None:
+        def upsert_policy(
+            self,
+            decision: object,
+            generated_at: str,
+            *,
+            remote_write_authorized: bool = False,
+        ) -> None:
             del generated_at
+            assert remote_write_authorized is True
             self.upserts.append(decision.to_dict())
 
     store = PolicyStore(tmp_path / "guard-home")

{plugin_scanner-2.0.808 → plugin_scanner-2.0.810}/tests/test_guard_connect_flow.py

@@ -392,6 +392,7 @@ def test_record_latest_guard_connect_sync_success_clears_retry_required_state_wh
             "inventory_items": 261,
         },
         now="2026-06-11T22:13:11+00:00",
+        request_id="connect-403",
     )
 
     payload = build_connect_status_payload(
@@ -409,6 +410,45 @@ def test_record_latest_guard_connect_sync_success_clears_retry_required_state_wh
     assert latest_state["milestone"] == "first_sync_succeeded"
 
 
+def test_background_sync_success_does_not_clear_newer_retry_required_connect_request(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now="2026-06-11T22:10:11+00:00",
+        request_id="connect-older",
+    )
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now="2026-06-11T22:11:11+00:00",
+        request_id="connect-newer",
+    )
+    store.record_latest_guard_connect_sync_result(
+        status="retry_required",
+        milestone="first_sync_failed",
+        now="2026-06-11T22:12:11+00:00",
+        reason="Guard authorization expired. Run `hol-guard connect` again.",
+        request_id="connect-newer",
+    )
+
+    latest_state = store.record_latest_guard_connect_sync_success(
+        sync_payload={
+            "synced_at": "2026-06-11T22:13:11+00:00",
+            "receipts_stored": 11,
+            "inventory_items": 261,
+        },
+        now="2026-06-11T22:13:11+00:00",
+    )
+
+    assert latest_state is not None
+    assert latest_state["request_id"] == "connect-newer"
+    assert latest_state["status"] == "retry_required"
+    assert latest_state["milestone"] == "first_sync_failed"
+
+
 def test_browser_connect_caches_paid_package_firewall_entitlement(tmp_path: Path) -> None:
     store = GuardStore(tmp_path / "guard-home")