plugin-scanner 2.0.828__tar.gz → 2.0.830__tar.gz

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.828
+Version: 2.0.830
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.828"
+version = "2.0.830"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.828"
+version = "2.0.830"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py

@@ -15,6 +15,7 @@ if TYPE_CHECKING:
 
 
 from ..store import _runtime_scoped_exact_match_key, runtime_tool_action_exact_match_context
+from ..text import ensure_terminal_punctuation as _ensure_terminal_punctuation
 from ._commands_shared import *
 from .commands_parser_helpers import *
 
@@ -84,12 +85,6 @@ def _native_hook_reason(*values: object | None) -> str:
         return " ".join(messages)
     return "HOL Guard flagged this tool call for review."
 
-def _ensure_terminal_punctuation(message: str) -> str:
-    trimmed = message.strip()
-    if trimmed.endswith((".", "!", "?")):
-        return trimmed
-    return f"{trimmed}."
-
 def _native_hook_reason_for_harness(harness: str, *values: object | None) -> str:
     reason = _native_hook_reason(*values)
     if harness != "codex":

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/src/codex_plugin_scanner/guard/cli/render.py

@@ -1959,7 +1959,13 @@ def _render_protect(console: Console, payload: dict[str, object]) -> None:
         if isinstance(user_copy, dict):
             harness_message = str(user_copy.get("harness_message") or "").strip()
             if harness_message:
-                console.print(Panel(Text(harness_message), title="Guard guidance", border_style="magenta"))
+                console.print(
+                    Panel(
+                        Text(harness_message, no_wrap=False, overflow="fold"),
+                        title="Guard guidance",
+                        border_style="magenta",
+                    )
+                )
     supply_chain = payload.get("supply_chain")
     if isinstance(supply_chain, dict):
         console.print(_build_supply_chain_posture_panel(supply_chain))

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -41,7 +41,40 @@ _ALREADY_CURRENT_HINTS = (
 )
 _PYPI_JSON_URL = "https://pypi.org/pypi/hol-guard/json"
 _PYPI_TIMEOUT_SECONDS = 3.0
+_PACKAGE_SHIM_REFRESH_TIMEOUT_SECONDS = 30.0
 _last_pypi_payload: dict[str, object] | None = None
+_PACKAGE_SHIM_REFRESH_SCRIPT = """
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+from codex_plugin_scanner.guard.adapters.base import HarnessContext
+from codex_plugin_scanner.guard.shims import package_shim_status, repair_package_shims
+
+
+def _resolve_path(value: object) -> Path | None:
+    if not isinstance(value, str) or not value.strip():
+        return None
+    return Path(value).expanduser().resolve()
+
+
+payload = json.loads(sys.stdin.read())
+home_dir = _resolve_path(payload.get("home_dir")) or Path.home().resolve()
+guard_home = _resolve_path(payload.get("guard_home")) or (home_dir / ".hol-guard")
+context = HarnessContext(
+    home_dir=home_dir,
+    workspace_dir=_resolve_path(payload.get("workspace_dir")),
+    guard_home=guard_home,
+)
+before = package_shim_status(context)
+repair = None
+if before.get("installed_managers"):
+    repair = repair_package_shims(context)
+after = package_shim_status(context)
+print(json.dumps({"before": before, "repair": repair, "after": after}))
+""".strip()
 
 
 def _read_direct_url_dir_info(direct_url: dict[str, object] | None) -> dict[str, object]:
@@ -228,6 +261,14 @@ def run_guard_update(
         notes = [*notes, nonzero_success_note]
     if notes:
         payload["notes"] = notes
+    if payload.get("changed") is True or payload.get("status") == "current":
+        package_shims, package_shim_note = _refresh_package_shims_after_update(
+            context=context,
+            dry_run=dry_run,
+        )
+        if package_shims is not None:
+            payload["package_shims"] = package_shims
+        _append_payload_note(payload, package_shim_note)
     repaired_installs, repair_notes = _repair_supported_harnesses(
         context=context,
         store=store,
@@ -236,7 +277,7 @@ def run_guard_update(
         dry_run=dry_run,
     )
     if repair_notes:
-        payload["notes"] = [*notes, *repair_notes]
+        payload["notes"] = [*_payload_notes(payload), *repair_notes]
     if repaired_installs:
         payload["managed_installs"] = repaired_installs
         if len(repaired_installs) == 1:
@@ -258,6 +299,22 @@ def _normalize_output_text(value: str) -> str:
     return redact_sensitive_text(value.strip())
 
 
+def _string_list(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    return [item for item in value if isinstance(item, str)]
+
+
+def _payload_notes(payload: dict[str, object]) -> list[str]:
+    return _string_list(payload.get("notes"))
+
+
+def _append_payload_note(payload: dict[str, object], note: str | None) -> None:
+    if note is None or not note.strip():
+        return
+    payload["notes"] = [*_payload_notes(payload), note]
+
+
 def _shell_command(command: list[str]) -> str:
     if os.name == "nt":
         return subprocess.list2cmdline(command)
@@ -807,6 +864,93 @@ def _current_version_from_subprocess() -> str:
     return version or _current_version()
 
 
+def _refresh_package_shims_after_update(
+    *,
+    context: HarnessContext | None,
+    dry_run: bool,
+) -> tuple[dict[str, object] | None, str | None]:
+    if dry_run or context is None or not _package_shim_manifest_has_installed_managers(context):
+        return None, None
+    refresh_context = {
+        "home_dir": str(context.home_dir),
+        "workspace_dir": str(context.workspace_dir) if context.workspace_dir is not None else None,
+        "guard_home": str(context.guard_home),
+    }
+    try:
+        result = subprocess.run(
+            [sys.executable, "-c", _PACKAGE_SHIM_REFRESH_SCRIPT],
+            input=json.dumps(refresh_context),
+            capture_output=True,
+            check=False,
+            text=True,
+            timeout=_PACKAGE_SHIM_REFRESH_TIMEOUT_SECONDS,
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        return None, f"Could not refresh package firewall shims during update: {redact_sensitive_text(str(error))}"
+    stdout = _normalize_output_text(result.stdout)
+    stderr = _normalize_output_text(result.stderr)
+    if result.returncode != 0:
+        details = stderr or stdout or f"exit code {result.returncode}"
+        return None, f"Could not refresh package firewall shims during update: {details}"
+    try:
+        refresh_payload = json.loads(stdout) if stdout else {}
+    except json.JSONDecodeError as error:
+        return None, f"Could not parse package firewall refresh output during update: {error}"
+    if not isinstance(refresh_payload, dict):
+        return None, "Could not parse package firewall refresh output during update: invalid payload"
+    after_status = refresh_payload.get("after")
+    if not isinstance(after_status, dict):
+        return None, "Could not parse package firewall refresh output during update: missing status"
+    installed_managers = _string_list(after_status.get("installed_managers"))
+    if not installed_managers:
+        return None, None
+    return refresh_payload, _package_shim_refresh_note(refresh_payload)
+
+
+def _package_shim_manifest_has_installed_managers(context: HarnessContext) -> bool:
+    manifest_path = context.guard_home / "package-shims" / "manifest.json"
+    try:
+        raw_manifest = manifest_path.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    try:
+        manifest = json.loads(raw_manifest)
+    except json.JSONDecodeError:
+        return False
+    if not isinstance(manifest, dict):
+        return False
+    return bool(_string_list(manifest.get("installed_managers")))
+
+
+def _package_shim_refresh_note(refresh_payload: dict[str, object]) -> str | None:
+    after_status = refresh_payload.get("after")
+    if not isinstance(after_status, dict):
+        return None
+    manager_details = after_status.get("manager_details")
+    detail_items = manager_details if isinstance(manager_details, list) else []
+    unhealthy_managers = [
+        str(detail.get("manager"))
+        for detail in detail_items
+        if isinstance(detail, dict) and detail.get("integrity") in {"missing", "stale", "tampered"}
+    ]
+    path_repair_required = _string_list(after_status.get("path_repair_required"))
+    if unhealthy_managers:
+        return f"Package firewall shims still need repair after update for {', '.join(unhealthy_managers)}."
+    repair_result = refresh_payload.get("repair")
+    repaired = _string_list(repair_result.get("repaired")) if isinstance(repair_result, dict) else []
+    if repaired:
+        note = f"Refreshed package firewall shims during update for {', '.join(repaired)}."
+        if path_repair_required:
+            note += f" Restart your shell to reactivate {', '.join(path_repair_required)}."
+        return note
+    if path_repair_required:
+        return (
+            "Package firewall shims are current, but PATH repair is still required for "
+            f"{', '.join(path_repair_required)}."
+        )
+    return None
+
+
 def _repair_supported_harnesses(
     *,
     context: HarnessContext | None,

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py

@@ -32,6 +32,7 @@ from ..models import GuardArtifact
 from ..stable_digest import stable_digest_hex
 from ..store import GuardStore
 from ..store_evidence import EvidenceRecord
+from ..text import ensure_terminal_punctuation as _ensure_terminal_punctuation
 from .js_semver import highest_js_version_for_selector, version_matches_js_selector
 from .manifest_dependency_targets import evaluation_targets as _manifest_evaluation_targets
 from .package_intent_common import split_python_extras
@@ -553,7 +554,7 @@ def _finalize_evaluation(
             summary = f"{summary} Also flagged: {others}."
     harness_parts = [risk_summary]
     if reason_message:
-        harness_parts.append(f"Reason: {reason_message}.")
+        harness_parts.append(f"Reason: {_ensure_terminal_punctuation(reason_message)}")
     if fix_command:
         harness_parts.append(f"Fix: install `{fix_command}` or choose a team exception.")
     user_copy = _normalize_package_user_copy(

plugin_scanner-2.0.830/src/codex_plugin_scanner/guard/text.py

@@ -0,0 +1,14 @@
+"""Shared text-formatting helpers for Guard surfaces."""
+
+from __future__ import annotations
+
+
+def ensure_terminal_punctuation(message: str | None) -> str:
+    """Normalize trailing terminal punctuation for user-facing copy."""
+
+    trimmed = (message or "").strip()
+    if not trimmed:
+        return ""
+    if trimmed.endswith((".", "!", "?")):
+        return trimmed
+    return f"{trimmed}."

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.828"
+__version__ = "2.0.830"

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/tests/test_guard_package_shims.py

@@ -1180,6 +1180,71 @@ def test_guard_protect_probe_skips_local_approval_queue_on_block(
     assert store.list_approval_requests(limit=None) == []
 
 
+def test_guard_protect_pnpm_install_alias_renders_wrapped_review_link_for_cloud_validation_error(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys,
+) -> None:
+    home_dir = tmp_path / "guard-home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True, exist_ok=True)
+    (workspace_dir / "package.json").write_text(
+        json.dumps({"name": "demo", "dependencies": {"lodash": "^4.17.21"}}),
+        encoding="utf-8",
+    )
+    (workspace_dir / "pnpm-lock.yaml").write_text(
+        "\n".join(
+            [
+                "lockfileVersion: '9.0'",
+                "packages:",
+                "  lodash@4.17.21:",
+                "    resolution: {integrity: sha256-demo}",
+                "importers:",
+                "  .:",
+                "    dependencies:",
+                "      lodash: 4.17.21",
+            ]
+        ),
+        encoding="utf-8",
+    )
+    server, thread, sync_url = _start_cloud_eval_server(
+        decision="allow",
+        package_name="lodash",
+        evaluate_status=400,
+    )
+    monkeypatch.setattr(guard_commands_module, "ensure_guard_daemon", lambda _home: "http://127.0.0.1:5474")
+    try:
+        _seed_bundle(
+            home_dir=home_dir,
+            ecosystem="npm",
+            package_name="lodash",
+            package_version="4.17.21",
+            action="allow",
+        )
+        _seed_workspace_sync_credentials(home_dir, sync_url)
+        rc = main(
+            [
+                "guard",
+                "protect",
+                "--home",
+                str(home_dir),
+                "--workspace",
+                str(workspace_dir),
+                "pnpm",
+                "i",
+            ]
+        )
+    finally:
+        _stop_cloud_eval_server(server, thread)
+
+    output = capsys.readouterr().out
+
+    assert rc == 2
+    assert "approve or keep this blocked" in output
+    assert "http://127.0.0.1:5474/requests/" in output
+    assert "review.. Open HOL Guard" not in output
+
+
 def test_guard_protect_retry_runs_after_local_package_approval(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.0.828 → plugin_scanner-2.0.830}/tests/test_guard_phase03_local_install.py

@@ -476,6 +476,172 @@ def test_update_syncs_dashboard_assets_after_partial_stale_upgrade(monkeypatch:
     assert "synced dashboard" in payload["notes"]
 
 
+def test_refresh_package_shims_after_update_uses_fresh_python_process(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    context = _context(tmp_path)
+    manifest_path = context.guard_home / "package-shims" / "manifest.json"
+    manifest_path.parent.mkdir(parents=True, exist_ok=True)
+    manifest_path.write_text(json.dumps({"installed_managers": ["pnpm"]}), encoding="utf-8")
+
+    def fake_run(command: list[str], **kwargs: object) -> subprocess.CompletedProcess[str]:
+        assert command == [update_commands.sys.executable, "-c", update_commands._PACKAGE_SHIM_REFRESH_SCRIPT]
+        refresh_context = json.loads(str(kwargs.get("input")))
+        assert refresh_context == {
+            "home_dir": str(context.home_dir),
+            "workspace_dir": str(context.workspace_dir),
+            "guard_home": str(context.guard_home),
+        }
+        assert kwargs.get("timeout") == update_commands._PACKAGE_SHIM_REFRESH_TIMEOUT_SECONDS
+        refresh_payload = {
+            "before": {"installed_managers": ["pnpm"]},
+            "repair": {"repaired": ["pnpm"], "repaired_count": 1},
+            "after": {
+                "installed_managers": ["pnpm"],
+                "manager_details": [{"manager": "pnpm", "integrity": "ok"}],
+                "path_repair_required": [],
+            },
+        }
+        return subprocess.CompletedProcess(command, 0, json.dumps(refresh_payload), "")
+
+    monkeypatch.setattr(update_commands.subprocess, "run", fake_run)
+
+    payload, note = update_commands._refresh_package_shims_after_update(context=context, dry_run=False)
+
+    assert payload is not None
+    assert payload["repair"] == {"repaired": ["pnpm"], "repaired_count": 1}
+    assert note == "Refreshed package firewall shims during update for pnpm."
+
+
+def test_update_records_package_shim_refresh_after_successful_update(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(update_commands, "_current_version", lambda: "2.0.826")
+    monkeypatch.setattr(update_commands, "_current_version_from_subprocess", lambda: "2.0.830")
+    monkeypatch.setattr(update_commands, "_latest_version_from_pypi", lambda: "2.0.830")
+    monkeypatch.setattr(update_commands, "_direct_url_payload", lambda: None)
+    monkeypatch.setattr(update_commands, "_installer_kind", lambda: "pipx")
+    monkeypatch.setattr(
+        update_commands.shutil,
+        "which",
+        lambda name: "/mock-home/.local/bin/hol-guard" if name == "hol-guard" else None,
+    )
+    monkeypatch.setattr(update_commands, "_sync_dashboard_assets", lambda: None)
+    monkeypatch.setattr(
+        update_commands,
+        "_refresh_package_shims_after_update",
+        lambda **_: (
+            {
+                "before": {"installed_managers": ["pnpm"]},
+                "repair": {"repaired": ["pnpm"], "repaired_count": 1},
+                "after": {
+                    "installed_managers": ["pnpm"],
+                    "manager_details": [{"manager": "pnpm", "integrity": "ok"}],
+                    "path_repair_required": [],
+                },
+            },
+            "Refreshed package firewall shims during update for pnpm.",
+        ),
+    )
+
+    def fake_run(command: list[str], **kwargs: object) -> subprocess.CompletedProcess[str]:
+        assert command == ["pipx", "upgrade", "hol-guard"]
+        return subprocess.CompletedProcess(command, 0, "installed hol-guard 2.0.830", "")
+
+    monkeypatch.setattr(update_commands.subprocess, "run", fake_run)
+
+    payload, exit_code = update_commands.run_guard_update(dry_run=False, context=_context(tmp_path))
+
+    assert exit_code == 0
+    assert payload["status"] == "updated"
+    assert payload["package_shims"]["repair"] == {"repaired": ["pnpm"], "repaired_count": 1}
+    assert "Refreshed package firewall shims during update for pnpm." in payload["notes"]
+
+
+def test_update_keeps_success_when_package_shim_refresh_warns(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(update_commands, "_current_version", lambda: "2.0.826")
+    monkeypatch.setattr(update_commands, "_current_version_from_subprocess", lambda: "2.0.830")
+    monkeypatch.setattr(update_commands, "_latest_version_from_pypi", lambda: "2.0.830")
+    monkeypatch.setattr(update_commands, "_direct_url_payload", lambda: None)
+    monkeypatch.setattr(update_commands, "_installer_kind", lambda: "pipx")
+    monkeypatch.setattr(
+        update_commands.shutil,
+        "which",
+        lambda name: "/mock-home/.local/bin/hol-guard" if name == "hol-guard" else None,
+    )
+    monkeypatch.setattr(update_commands, "_sync_dashboard_assets", lambda: None)
+    monkeypatch.setattr(
+        update_commands,
+        "_refresh_package_shims_after_update",
+        lambda **_: (None, "Could not refresh package firewall shims during update: import failed"),
+    )
+
+    def fake_run(command: list[str], **kwargs: object) -> subprocess.CompletedProcess[str]:
+        assert command == ["pipx", "upgrade", "hol-guard"]
+        return subprocess.CompletedProcess(command, 0, "installed hol-guard 2.0.830", "")
+
+    monkeypatch.setattr(update_commands.subprocess, "run", fake_run)
+
+    payload, exit_code = update_commands.run_guard_update(dry_run=False, context=_context(tmp_path))
+
+    assert exit_code == 0
+    assert payload["status"] == "updated"
+    assert "Could not refresh package firewall shims during update: import failed" in payload["notes"]
+
+
+def test_update_skips_package_shim_refresh_for_stale_no_change(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(update_commands, "_current_version", lambda: "2.0.584")
+    monkeypatch.setattr(update_commands, "_current_version_from_subprocess", lambda: "2.0.584")
+    monkeypatch.setattr(update_commands, "_latest_version_from_pypi", lambda: "2.0.585")
+    monkeypatch.setattr(update_commands, "_direct_url_payload", lambda: None)
+    monkeypatch.setattr(update_commands, "_installer_kind", lambda: "pipx")
+    monkeypatch.setattr(
+        update_commands.shutil,
+        "which",
+        lambda name: "/mock-home/.local/bin/hol-guard" if name == "hol-guard" else None,
+    )
+    monkeypatch.setattr(update_commands, "_sync_dashboard_assets", lambda: None)
+
+    refresh_attempted = False
+
+    def fake_refresh(**_: object) -> tuple[dict[str, object] | None, str | None]:
+        nonlocal refresh_attempted
+        refresh_attempted = True
+        return None, None
+
+    monkeypatch.setattr(update_commands, "_refresh_package_shims_after_update", fake_refresh)
+
+    captured_commands: list[list[str]] = []
+
+    def fake_run(command: list[str], **kwargs: object) -> subprocess.CompletedProcess[str]:
+        captured_commands.append(command)
+        return subprocess.CompletedProcess(
+            command,
+            0,
+            "hol-guard is already at latest version 2.0.584",
+            "upgrading shared libraries...\nupgrading hol-guard...\n",
+        )
+
+    monkeypatch.setattr(update_commands.subprocess, "run", fake_run)
+
+    payload, exit_code = update_commands.run_guard_update(dry_run=False)
+
+    assert exit_code == 0
+    assert captured_commands == [
+        ["pipx", "upgrade", "hol-guard"],
+        ["pipx", "install", "--force", "hol-guard==2.0.585"],
+    ]
+    assert payload["status"] == "stale"
+    assert refresh_attempted is False
+
+
 def test_update_marks_plain_pipx_upgrade_as_stale_when_version_does_not_change(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: