plugin-scanner 2.0.809__tar.gz → 2.0.811__tar.gz

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.809
+Version: 2.0.811
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard
@@ -150,6 +150,8 @@ See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local fl
   Shows what Guard is watching now.
 - `hol-guard install <harness>`
   Creates the launcher shim for that harness.
+- `hol-guard uninstall --self`
+  Removes Guard-managed harness wiring, package shims, local Guard state, and uninstalls the current `hol-guard` package.
 - `hol-guard update`
   Updates the installed `hol-guard` package in the current environment.
 - `hol-guard run <harness> --dry-run`

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/README.md

@@ -107,6 +107,8 @@ See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local fl
   Shows what Guard is watching now.
 - `hol-guard install <harness>`
   Creates the launcher shim for that harness.
+- `hol-guard uninstall --self`
+  Removes Guard-managed harness wiring, package shims, local Guard state, and uninstalls the current `hol-guard` package.
 - `hol-guard update`
   Updates the installed `hol-guard` package in the current environment.
 - `hol-guard run <harness> --dry-run`

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/docs/guard/get-started.md

@@ -125,6 +125,7 @@ For security reviews, sales conversations, and GRC packets, see the
 | :--- | :--- | :--- |
 | I need the current protection posture | `hol-guard status` | What is Guard watching, is sync connected, and what is the next action? |
 | I need first-run setup | `hol-guard init` | Open the local dashboard, install supported harnesses, start optional Cloud connect, and check desktop notifications. |
+| I need to remove Guard from this machine | `hol-guard uninstall --self` | Can Guard disconnect its managed harnesses, remove package shims and local state, then uninstall itself cleanly? |
 | I need install/connect docs | `hol-guard explain install-connect` | Which local-first setup and optional cloud commands should I share? |
 | I need to preview one install before I run it | `hol-guard protect npm install <package> --dry-run` | Would Guard allow, warn, review, or block this exact install request right now? |
 | I need setup or runtime troubleshooting | `hol-guard doctor <harness>` | Why is this harness or Guard runtime not behaving correctly? |

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.809"
+version = "2.0.811"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.809"
+version = "2.0.811"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/cli/_commands_shared.py

@@ -215,6 +215,7 @@ from .install_commands import (
 )
 from .protect_approvals import _queue_local_protect_approvals, _suppress_package_shim_allow_output
 from .remote_pair_flow import dispatch_guard_remote_pair_command
+from .uninstall_commands import run_guard_self_uninstall
 from .update_commands import run_guard_update
 
 DEFAULT_GUARD_APPS_URL = "https://hol.org/guard/apps"
@@ -279,7 +280,7 @@ _GUARD_HELP_GROUPS = (
     "  doctor       Run local diagnostics\n"
     "  bootstrap    Detect, install, and launch the approval center\n"
     "  install      Enable Guard management for a harness\n"
-    "  uninstall    Disable Guard management for a harness\n"
+    "  uninstall    Disable Guard management or remove hol-guard entirely\n"
     "  update       Update hol-guard in the current environment\n"
     "\n"
     "Command selection:\n"

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/cli/commands_dispatch_proxy.py

@@ -166,6 +166,21 @@ def _run_guard_uninstall_command(
 ) -> int:
     context = _require_guard_context(context)
     store = _require_guard_store(store)
+    if bool(getattr(args, "self_uninstall", False)):
+        if getattr(args, "harness", None) is not None or bool(getattr(args, "all", False)):
+            print("Guard self uninstall does not accept a harness or --all.", file=sys.stderr)
+            return 2
+        payload, exit_code = run_guard_self_uninstall(
+            dry_run=bool(getattr(args, "dry_run", False)),
+            context=context,
+            store=store,
+            now=_now(),
+        )
+        _emit("uninstall", payload, getattr(args, "json", False))
+        return exit_code
+    if bool(getattr(args, "dry_run", False)):
+        print("Guard uninstall --dry-run requires --self.", file=sys.stderr)
+        return 2
     try:
         payload = apply_managed_install(
             "uninstall",

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/cli/commands_parser_local.py

@@ -106,10 +106,17 @@ def _configure_guard_local_parsers(
 
     uninstall_parser = guard_subparsers.add_parser(
         "uninstall",
-        help="Disable Guard management for one or more harnesses",
+        help="Disable Guard management or remove hol-guard entirely",
     )
     uninstall_parser.add_argument("harness", nargs="?")
     uninstall_parser.add_argument("--all", action="store_true")
+    uninstall_parser.add_argument(
+        "--self",
+        dest="self_uninstall",
+        action="store_true",
+        help="Remove the installed hol-guard package and local Guard state",
+    )
+    uninstall_parser.add_argument("--dry-run", action="store_true")
     _add_guard_common_args(uninstall_parser)
     uninstall_parser.add_argument("--json", action="store_true")
 

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/cli/install_commands.py

@@ -457,7 +457,8 @@ def _resolve_targets(
         return [get_adapter(requested_harness).harness]
     if not install_all:
         action = "install" if command == "install" else "uninstall"
-        raise ValueError(f"Guard {action} requires a harness or --all.")
+        suffix = " or --self" if command == "uninstall" else ""
+        raise ValueError(f"Guard {action} requires a harness or --all{suffix}.")
     detected = {
         detection.harness
         for detection in detect_all(context)

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/cli/render.py

@@ -12,6 +12,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, TextIO, TypeAlias
 
 from ..redaction import redact_text
+from .render_uninstall import render_self_uninstall
 
 try:
     from ..redaction import redact_local_path
@@ -1053,13 +1054,21 @@ def _render_managed_install(console: Console, payload: dict[str, object]) -> Non
     supply_chain_risks = _coerce_dict_list(payload.get("supply_chain_risks"))
     safe_decode_risks = _coerce_dict_list(payload.get("safe_decode_risks"))
     sandbox_analysis = _coerce_dict_list(payload.get("sandbox_analysis"))
+    if bool(payload.get("self_uninstall")):
+        render_self_uninstall(console, payload)
     managed_install = payload.get("managed_install")
     if isinstance(managed_install, dict):
         _render_single_managed_install(console, managed_install)
     else:
         managed_installs = _coerce_dict_list(payload.get("managed_installs"))
         if not managed_installs:
-            if not skill_scan and not supply_chain_risks and not safe_decode_risks and not sandbox_analysis:
+            if (
+                not bool(payload.get("self_uninstall"))
+                and not skill_scan
+                and not supply_chain_risks
+                and not safe_decode_risks
+                and not sandbox_analysis
+            ):
                 _render_fallback(console, payload)
                 return
         else:

plugin_scanner-2.0.811/src/codex_plugin_scanner/guard/cli/render_uninstall.py

@@ -0,0 +1,74 @@
+"""Rich rendering helpers for Guard self-uninstall output."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from rich.console import Console
+    from rich.text import Text
+
+
+def render_self_uninstall(console: Console, payload: dict[str, object]) -> None:
+    from rich.panel import Panel
+    from rich.table import Table
+
+    body = Table.grid(padding=(0, 1))
+    body.add_row("Current version", str(payload.get("current_version") or "unknown"))
+    body.add_row("Installer", str(payload.get("installer") or "unknown"))
+    command = payload.get("command")
+    if isinstance(command, list) and command:
+        body.add_row("Command", " ".join(str(part) for part in command))
+    body.add_row("Dry run", _bool_label(bool(payload.get("dry_run"))))
+    planned_harnesses = _coerce_string_list(payload.get("planned_managed_harnesses"))
+    if planned_harnesses:
+        body.add_row("Planned harness cleanup", str(len(planned_harnesses)))
+    planned_shims = _coerce_string_list(payload.get("planned_package_shim_managers"))
+    if planned_shims:
+        body.add_row("Planned package shims", str(len(planned_shims)))
+    if payload.get("oauth_credentials_cleared") is not None:
+        body.add_row(
+            "Cloud credentials cleared",
+            _bool_label(bool(payload.get("oauth_credentials_cleared"))),
+        )
+    if payload.get("guard_home_removed") is not None:
+        body.add_row("Guard home removed", _bool_label(bool(payload.get("guard_home_removed"))))
+    if payload.get("message"):
+        body.add_row("Message", str(payload.get("message")))
+    status = str(payload.get("status") or "unknown")
+    border_style = {
+        "planned": "blue",
+        "pending": "yellow",
+        "removed": "green",
+        "failed": "red",
+    }.get(status, "red")
+    console.print(Panel(body, title=f"Guard uninstall: {status}", border_style=border_style))
+    notes = _coerce_string_list(payload.get("notes"))
+    stdout = str(payload.get("stdout") or "").strip()
+    stderr = str(payload.get("stderr") or "").strip()
+    error = str(payload.get("error") or "").strip()
+    if notes:
+        console.print(Panel("\n".join(f"• {note}" for note in notes), title="Notes", border_style="blue"))
+    if status == "removed" and stdout:
+        console.print(Panel(stdout, title="stdout", border_style="green"))
+    if status == "failed" and stdout:
+        console.print(Panel(stdout, title="stdout", border_style="yellow"))
+    if status == "failed" and stderr:
+        console.print(Panel(stderr, title="stderr", border_style="yellow"))
+    if error:
+        console.print(Panel(error, title="error", border_style="red"))
+
+
+def _bool_label(value: bool) -> Text:
+    from rich.text import Text
+
+    return Text("yes" if value else "no", style="green" if value else "red")
+
+
+def _coerce_string_list(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [str(item) for item in value if isinstance(item, str) and item]
+
+
+__all__ = ["render_self_uninstall"]

plugin_scanner-2.0.811/src/codex_plugin_scanner/guard/cli/uninstall_commands.py

@@ -0,0 +1,290 @@
+"""Helpers for removing the installed HOL Guard CLI and local Guard state."""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from ..adapters.base import HarnessContext
+from ..daemon.manager import retire_all_guard_daemons_for_home
+from ..redaction import redact_sensitive_text
+from ..shims import package_shim_status, remove_guard_profile_blocks, uninstall_package_shims
+from ..store import GuardStore
+from .install_commands import apply_managed_install
+from .update_commands import _current_version, _installer_kind
+
+
+def run_guard_self_uninstall(
+    *,
+    dry_run: bool,
+    context: HarnessContext,
+    store: GuardStore,
+    now: str,
+) -> tuple[dict[str, object], int]:
+    current_version = _current_version()
+    installer = _installer_kind()
+    command = _uninstall_command(installer)
+    managed_installs, managed_install_error = _active_managed_installs(store)
+    notes: list[str] = []
+    if managed_install_error is not None:
+        notes.append(managed_install_error)
+    try:
+        shim_status = package_shim_status(context)
+        planned_managers = _string_items(shim_status.get("installed_managers"))
+    except (OSError, RuntimeError, ValueError) as error:
+        planned_managers = []
+        notes.append(f"Could not read package shim state before uninstall: {error}")
+    payload: dict[str, object] = {
+        "self_uninstall": True,
+        "status": "planned" if dry_run else "pending",
+        "current_version": current_version,
+        "installer": installer,
+        "dry_run": dry_run,
+        "command": command,
+        "guard_home": str(context.guard_home),
+        "planned_managed_harnesses": [str(item.get("harness") or "unknown") for item in managed_installs],
+        "planned_package_shim_managers": planned_managers,
+    }
+    if notes:
+        payload["notes"] = [_clean_output(note) for note in notes]
+    if dry_run:
+        payload["changed"] = False
+        payload["message"] = _planned_uninstall_message(
+            managed_count=len(managed_installs),
+            package_shim_count=len(planned_managers),
+        )
+        return payload, 0
+
+    removed_managed_installs: list[dict[str, object]] = []
+    package_shim_uninstall: dict[str, object] | None = None
+    daemon_cleanup: dict[str, object] | None = None
+    profile_cleanup: dict[str, object] | None = None
+
+    try:
+        retired_pids = retire_all_guard_daemons_for_home(context.guard_home)
+        daemon_cleanup = {"retired_pids": retired_pids, "retired_count": len(retired_pids)}
+    except (OSError, RuntimeError) as error:
+        daemon_cleanup = {"retired_pids": [], "retired_count": 0, "error": _clean_output(str(error))}
+        notes.append(f"Could not stop every Guard daemon before uninstall: {error}")
+
+    for managed_install in managed_installs:
+        harness = str(managed_install.get("harness") or "").strip()
+        try:
+            uninstall_context, uninstall_workspace = _managed_install_context(context, managed_install)
+            uninstall_payload = apply_managed_install(
+                "uninstall",
+                harness,
+                False,
+                uninstall_context,
+                store,
+                uninstall_workspace,
+                now,
+            )
+        except (OSError, RuntimeError, ValueError) as error:
+            payload.update(
+                {
+                    "status": "failed",
+                    "changed": bool(removed_managed_installs),
+                    "managed_installs": removed_managed_installs,
+                    "daemon_cleanup": daemon_cleanup,
+                    "message": "HOL Guard removal stopped before the package uninstall command ran.",
+                    "error": _clean_output(str(error)),
+                    "notes": [_clean_output(note) for note in notes],
+                }
+            )
+            return payload, 1
+        removed = uninstall_payload.get("managed_install")
+        if isinstance(removed, dict):
+            removed_managed_installs.append(removed)
+
+    try:
+        package_shim_uninstall = uninstall_package_shims(context, managers=tuple(planned_managers) or None)
+    except (OSError, RuntimeError, ValueError) as error:
+        payload.update(
+            {
+                "status": "failed",
+                "changed": bool(removed_managed_installs),
+                "managed_installs": removed_managed_installs,
+                "daemon_cleanup": daemon_cleanup,
+                "message": "HOL Guard removal stopped before the package uninstall command ran.",
+                "error": _clean_output(str(error)),
+                "notes": [_clean_output(note) for note in notes],
+            }
+        )
+        return payload, 1
+
+    try:
+        profile_cleanup = remove_guard_profile_blocks(context)
+    except OSError as error:
+        profile_cleanup = {"changed": False, "error": _clean_output(str(error))}
+        notes.append(f"Could not remove Guard PATH entries from shell profiles: {error}")
+
+    try:
+        result = subprocess.run(
+            command,
+            capture_output=True,
+            check=False,
+            text=True,
+        )
+    except OSError as error:
+        payload.update(
+            {
+                "status": "failed",
+                "changed": _self_uninstall_changed(
+                    removed_managed_installs=removed_managed_installs,
+                    package_shim_uninstall=package_shim_uninstall,
+                    profile_cleanup=profile_cleanup,
+                    package_removed=False,
+                ),
+                "managed_installs": removed_managed_installs,
+                "package_shim_uninstall": package_shim_uninstall,
+                "daemon_cleanup": daemon_cleanup,
+                "profile_cleanup": profile_cleanup,
+                "package_removed": False,
+                "message": "HOL Guard package uninstall failed before the installer started.",
+                "error": _clean_output(str(error)),
+                "notes": [_clean_output(note) for note in notes],
+            }
+        )
+        return payload, 1
+
+    payload["stdout"] = _clean_output(result.stdout)
+    payload["stderr"] = _clean_output(result.stderr)
+    payload["return_code"] = result.returncode
+    payload["managed_installs"] = removed_managed_installs
+    payload["package_shim_uninstall"] = package_shim_uninstall
+    payload["daemon_cleanup"] = daemon_cleanup
+    payload["profile_cleanup"] = profile_cleanup
+    payload["package_removed"] = result.returncode == 0
+
+    if result.returncode != 0:
+        payload["status"] = "failed"
+        payload["changed"] = _self_uninstall_changed(
+            removed_managed_installs=removed_managed_installs,
+            package_shim_uninstall=package_shim_uninstall,
+            profile_cleanup=profile_cleanup,
+            package_removed=False,
+        )
+        payload["message"] = "HOL Guard package uninstall failed after local protection cleanup."
+        if notes:
+            payload["notes"] = [_clean_output(note) for note in notes]
+        return payload, 1
+
+    oauth_cleared = False
+    cleanup_errors: list[str] = []
+    try:
+        store.clear_oauth_local_credentials()
+        oauth_cleared = True
+    except (OSError, RuntimeError) as error:
+        cleanup_errors.append(f"Could not clear Guard Cloud credentials: {error}")
+
+    guard_home_removed = False
+    if context.guard_home.exists():
+        try:
+            shutil.rmtree(context.guard_home)
+            guard_home_removed = True
+        except OSError as error:
+            cleanup_errors.append(f"Could not remove Guard home {context.guard_home}: {error}")
+    else:
+        guard_home_removed = True
+
+    payload["oauth_credentials_cleared"] = oauth_cleared
+    payload["guard_home_removed"] = guard_home_removed
+    payload["changed"] = _self_uninstall_changed(
+        removed_managed_installs=removed_managed_installs,
+        package_shim_uninstall=package_shim_uninstall,
+        profile_cleanup=profile_cleanup,
+        package_removed=True,
+    )
+    if cleanup_errors:
+        payload["status"] = "failed"
+        payload["message"] = "HOL Guard package was removed, but local cleanup needs attention."
+        notes.extend(cleanup_errors)
+        payload["notes"] = [_clean_output(note) for note in notes]
+        return payload, 1
+
+    payload["status"] = "removed"
+    payload["message"] = _success_uninstall_message(
+        managed_count=len(removed_managed_installs),
+        package_shim_count=len(_string_items(package_shim_uninstall.get("removed_managers"))),
+    )
+    if notes:
+        payload["notes"] = [_clean_output(note) for note in notes]
+    return payload, 0
+
+
+def _uninstall_command(installer: str) -> list[str]:
+    if installer == "uv":
+        return ["uv", "tool", "uninstall", "hol-guard"]
+    if installer == "pipx":
+        return ["pipx", "uninstall", "hol-guard"]
+    return [sys.executable, "-m", "pip", "uninstall", "-y", "hol-guard"]
+
+
+def _active_managed_installs(store: GuardStore) -> tuple[list[dict[str, object]], str | None]:
+    try:
+        installs = [item for item in store.list_managed_installs() if bool(item.get("active"))]
+    except Exception as error:  # pragma: no cover - defensive path depends on local store failures.
+        return [], f"Could not read managed install state before uninstall: {error}"
+    return installs, None
+
+
+def _managed_install_context(
+    context: HarnessContext,
+    managed_install: dict[str, object],
+) -> tuple[HarnessContext, str | None]:
+    managed_workspace = managed_install.get("workspace")
+    if isinstance(managed_workspace, str) and managed_workspace.strip():
+        workspace_path = Path(managed_workspace).expanduser().resolve()
+        return (
+            HarnessContext(
+                home_dir=context.home_dir,
+                workspace_dir=workspace_path,
+                guard_home=context.guard_home,
+            ),
+            str(workspace_path),
+        )
+    return HarnessContext(home_dir=context.home_dir, workspace_dir=None, guard_home=context.guard_home), None
+
+
+def _planned_uninstall_message(*, managed_count: int, package_shim_count: int) -> str:
+    actions: list[str] = ["remove the installed hol-guard package"]
+    if managed_count:
+        actions.append(f"disconnect {managed_count} Guard-managed harness{'es' if managed_count != 1 else ''}")
+    if package_shim_count:
+        actions.append(f"remove {package_shim_count} package-manager shim{'s' if package_shim_count != 1 else ''}")
+    return f"Review the planned steps to {' and '.join(actions)}."
+
+
+def _success_uninstall_message(*, managed_count: int, package_shim_count: int) -> str:
+    parts = ["Removed HOL Guard from this environment"]
+    if managed_count:
+        parts.append(f"disconnected {managed_count} managed harness{'es' if managed_count != 1 else ''}")
+    if package_shim_count:
+        parts.append(f"removed {package_shim_count} package-manager shim{'s' if package_shim_count != 1 else ''}")
+    return "; ".join(parts) + "."
+
+
+def _self_uninstall_changed(
+    *,
+    removed_managed_installs: list[dict[str, object]],
+    package_shim_uninstall: dict[str, object] | None,
+    profile_cleanup: dict[str, object] | None,
+    package_removed: bool,
+) -> bool:
+    removed_managers = _string_items(package_shim_uninstall.get("removed_managers")) if package_shim_uninstall else []
+    profile_changed = bool(profile_cleanup and profile_cleanup.get("changed"))
+    return bool(removed_managed_installs or removed_managers or profile_changed or package_removed)
+
+
+def _string_items(value: object) -> list[str]:
+    return [item for item in value if isinstance(item, str) and item.strip()] if isinstance(value, list) else []
+
+
+def _clean_output(value: str) -> str:
+    return redact_sensitive_text(value.strip())
+
+
+__all__ = ["run_guard_self_uninstall"]

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -2090,7 +2090,11 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                     device_name=device_name,
                 )
             )
-            self.server.store.replace_remote_policies(existing_remote_decisions, applied_at)  # type: ignore[attr-defined]
+            self.server.store.replace_remote_policies(  # type: ignore[attr-defined]
+                existing_remote_decisions,
+                applied_at,
+                remote_write_authorized=True,
+            )
             _persist_cloud_exceptions(
                 self.server.store,  # type: ignore[attr-defined]
                 policy_bundle=validated_policy_bundle,
@@ -2158,6 +2162,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 decision,
                 _now(),
                 approval_gate_grant=approval_gate_grant,
+                remote_write_authorized=True,
             )
         except ApprovalGateError as error:
             self._write_approval_gate_error(error)

plugin_scanner-2.0.811/src/codex_plugin_scanner/guard/policy_authority.py

@@ -0,0 +1,23 @@
+"""Authority checks for remembered local rules and Cloud policy rows."""
+
+from __future__ import annotations
+
+from .models import PolicyDecision
+from .policy_integrity import is_remote_policy_source
+
+
+class PolicyAuthorityError(ValueError):
+    """Raised when a policy row would cross its allowed authority boundary."""
+
+
+def validate_policy_write_authority(
+    decision: PolicyDecision,
+    *,
+    remote_write_authorized: bool = False,
+) -> None:
+    """Reject local writes that would impersonate stronger authority."""
+
+    if is_remote_policy_source(decision.source):
+        if remote_write_authorized:
+            return
+        raise PolicyAuthorityError("remote_policy_source_requires_validated_sync_path")

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -284,7 +284,7 @@ def _execute_policy_sync(
         source="cloud-sync",
         expires_at=_optional_string(policy_memory.get("expiry")),
     )
-    store.upsert_policy(decision, generated_at)
+    store.upsert_policy(decision, generated_at, remote_write_authorized=True)
     return _result(
         {
             "action": "policy_sync",

{plugin_scanner-2.0.809 → plugin_scanner-2.0.811}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -1397,7 +1397,7 @@ def sync_receipts(
     remote_policies_stored = len(remote_decisions)
     remote_policy_sync_blocked = False
     try:
-        store.replace_remote_policies(list(remote_decisions), now)
+        store.replace_remote_policies(list(remote_decisions), now, remote_write_authorized=True)
     except ApprovalGateError as error:
         remote_policies_stored = 0
         remote_policy_sync_blocked = True

plugin_scanner-2.0.811/src/codex_plugin_scanner/guard/shell_profile_cleanup.py

@@ -0,0 +1,67 @@
+"""Helpers for removing Guard-managed shell profile blocks."""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Callable
+from pathlib import Path
+from typing import Protocol
+
+
+class HarnessContextLike(Protocol):
+    @property
+    def home_dir(self) -> Path: ...
+
+
+def remove_guard_profile_blocks(
+    context: HarnessContextLike,
+    *,
+    strip_managed_marker_blocks: Callable[[str, str], str],
+    guard_profile_marker: str,
+    package_profile_marker: str,
+) -> dict[str, object]:
+    if os.name == "nt":
+        return {
+            "changed": False,
+            "changed_paths": [],
+            "removed_paths": [],
+            "markers_removed": [guard_profile_marker, package_profile_marker],
+        }
+    changed_paths: list[str] = []
+    removed_paths: list[str] = []
+    for profile_path in _managed_shell_profile_paths(context.home_dir):
+        if not profile_path.exists():
+            continue
+        existing = profile_path.read_text(encoding="utf-8")
+        if guard_profile_marker not in existing and package_profile_marker not in existing:
+            continue
+        cleaned = existing
+        if guard_profile_marker in cleaned:
+            cleaned = strip_managed_marker_blocks(cleaned, guard_profile_marker)
+        if package_profile_marker in cleaned:
+            cleaned = strip_managed_marker_blocks(cleaned, package_profile_marker)
+        if cleaned == existing:
+            continue
+        if cleaned:
+            profile_path.write_text(cleaned, encoding="utf-8")
+        else:
+            profile_path.unlink()
+            removed_paths.append(str(profile_path))
+        changed_paths.append(str(profile_path))
+    return {
+        "changed": bool(changed_paths),
+        "changed_paths": changed_paths,
+        "removed_paths": removed_paths,
+        "markers_removed": [guard_profile_marker, package_profile_marker],
+    }
+
+
+def _managed_shell_profile_paths(home_dir: Path) -> tuple[Path, ...]:
+    return (
+        home_dir / ".bashrc",
+        home_dir / ".zshrc",
+        home_dir / ".config" / "fish" / "config.fish",
+    )
+
+
+__all__ = ["remove_guard_profile_blocks"]