plugin-scanner 2.0.832__tar.gz → 2.0.834__tar.gz

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.832
+Version: 2.0.834
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.832"
+version = "2.0.834"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.832"
+version = "2.0.834"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/src/codex_plugin_scanner/guard/cli/commands_dispatch_trust.py

@@ -17,6 +17,7 @@ from ..local_trust_controller import macos_native_backend_supported, resolve_pas
 from ..policy_integrity import is_remote_policy_source
 from ..store import GuardStore
 from .commands_support_interaction import _emit
+from .update_commands import build_guard_install_surface_payload
 
 
 def _now() -> str:
@@ -86,6 +87,10 @@ def _installed_trust_cli_payload() -> dict[str, object]:
     installation_mode = "unknown"
     editable_install = False
     official_install = False
+    install_surface = build_guard_install_surface_payload()
+    binary_diagnostics = install_surface.get("binary_diagnostics")
+    if not isinstance(binary_diagnostics, dict):
+        binary_diagnostics = {}
     try:
         distribution = importlib.metadata.distribution("hol-guard")
     except importlib.metadata.PackageNotFoundError:
@@ -113,12 +118,25 @@ def _installed_trust_cli_payload() -> dict[str, object]:
             installation_mode = "editable"
         else:
             installation_mode = "packaged"
+    active_command_status = str(binary_diagnostics.get("path_status") or "unknown")
+    active_command_verified = active_command_status in {
+        "pipx_shim_detected",
+        "uv_tool_shim_detected",
+        "matches_installer",
+    }
     return {
         "package": "hol-guard",
         "version": version,
         "installation_mode": installation_mode,
         "official_install": official_install,
+        "official_install_verified": official_install and active_command_status == "pipx_shim_detected",
         "editable_install": editable_install,
+        "installer": install_surface.get("installer"),
+        "active_command_path": binary_diagnostics.get("resolved_hol_guard"),
+        "active_command_status": active_command_status,
+        "active_command_verified": active_command_verified,
+        "expected_script_dir": binary_diagnostics.get("expected_script_dir"),
+        "self_check_command": "command -v hol-guard && hol-guard --version",
         "update_command": "hol-guard update",
         "dry_run_command": "hol-guard update --dry-run --json",
     }
@@ -184,6 +202,7 @@ def build_trust_doctor_payload(store: GuardStore, *, backend: str = "auto") -> d
         "local_rules_protected": remembered_rules == "enforced",
         "cloud_policy_available": payload.get("cloud_policy_status") == "available",
         "approval_center_active": bool(approval_center.get("active")),
+        "official_install_verified": bool(install_info.get("official_install_verified")),
     }
     payload["recommended_actions"] = (
         [
@@ -205,6 +224,16 @@ def build_trust_doctor_payload(store: GuardStore, *, backend: str = "auto") -> d
         payload["recommended_actions"].append(
             "Use the official pipx install before relying on packaged update and daemon lifecycle checks."
         )
+    if not bool(install_info.get("active_command_verified")):
+        if install_info.get("active_command_status") == "not_on_path":
+            payload["recommended_actions"].append(
+                "hol-guard is not on PATH. Reinstall it or add the install script directory to PATH."
+            )
+        else:
+            payload["recommended_actions"].append(
+                "Run `command -v hol-guard` and `hol-guard --version` "
+                "to confirm the active command matches this install."
+            )
     payload["approval_center"] = approval_center
     payload["approval_url_base"] = approval_center.get("approval_url_base")
     payload["passive_read_guarantee"] = _passive_read_guarantee()

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/src/codex_plugin_scanner/guard/cli/render.py

@@ -753,6 +753,10 @@ def _build_trust_doctor_panel(trust: dict[str, object]) -> Panel:
         update_command = official_install.get("update_command") or "hol-guard update"
         body.add_row("Installed package", f"hol-guard {version}")
         body.add_row("Install mode", str(official_install.get("installation_mode") or "unknown"))
+        body.add_row("Install check", str(official_install.get("active_command_status") or "unknown"))
+        active_command_path = official_install.get("active_command_path")
+        if isinstance(active_command_path, str) and active_command_path.strip():
+            body.add_row("Active command", active_command_path.strip())
         body.add_row("Update", str(update_command))
     summary = trust.get("summary")
     if isinstance(summary, str) and summary.strip():

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -31,6 +31,7 @@ from ..adapters.opencode_pretool import (
     pretool_plugin_source,
 )
 from ..redaction import redact_sensitive_text
+from ..shims import _trusted_import_root, _trusted_python_flags
 from ..store import GuardStore
 from .dashboard_sync import sync_dashboard_assets as _sync_dashboard_assets
 from .install_commands import apply_managed_install
@@ -354,12 +355,23 @@ def _binary_diagnostics(command: list[str], installer: str) -> dict[str, object]
 def _expected_script_dir(installer_binary: str, installer: str) -> Path | None:
     if installer != "pip" or not installer_binary:
         return None
-    scripts_dir = sysconfig.get_path("scripts")
+    try:
+        scripts_dir = sysconfig.get_path("scripts")
+    except Exception:
+        scripts_dir = None
     if scripts_dir:
         return _directory_path(scripts_dir)
     return _script_dir(installer_binary)
 
 
+def build_guard_install_surface_payload() -> dict[str, object]:
+    installer = _installer_kind()
+    return {
+        "installer": installer,
+        "binary_diagnostics": _binary_diagnostics(_update_command(installer, use_pypi=False), installer),
+    }
+
+
 def _script_dir(path: str) -> Path:
     return _directory_path(Path(path).expanduser().parent)
 
@@ -922,11 +934,15 @@ def _refresh_package_shims_after_update(
         "guard_home": str(context.guard_home),
     }
     try:
+        refresh_env = dict(os.environ)
+        refresh_env.pop("PYTHONPATH", None)
         result = subprocess.run(
-            [sys.executable, "-c", _PACKAGE_SHIM_REFRESH_SCRIPT],
+            [sys.executable, *_trusted_python_flags(), "-c", _PACKAGE_SHIM_REFRESH_SCRIPT],
             input=json.dumps(refresh_context),
             capture_output=True,
             check=False,
+            cwd=str(_trusted_import_root()),
+            env=refresh_env,
             text=True,
             timeout=_PACKAGE_SHIM_REFRESH_TIMEOUT_SECONDS,
         )
@@ -1146,7 +1162,11 @@ def _codex_backup_repair_contexts(context: HarnessContext) -> tuple[HarnessConte
 
 def build_guard_update_status_payload() -> dict[str, object]:
     current_version = _current_version()
-    installer = _installer_kind()
+    install_surface = build_guard_install_surface_payload()
+    installer = str(install_surface.get("installer") or "")
+    binary_diagnostics = install_surface.get("binary_diagnostics")
+    if not isinstance(binary_diagnostics, dict):
+        binary_diagnostics = {}
     direct_url = _direct_url_payload()
     local_source_install = _local_source_install_payload(direct_url)
     version_check = _version_check_payload(current_version)
@@ -1180,6 +1200,7 @@ def build_guard_update_status_payload() -> dict[str, object]:
         "current_version": current_version,
         "latest_version": latest_version if isinstance(latest_version, str) else None,
         "installer": installer,
+        "binary_diagnostics": binary_diagnostics,
         "version_check": version_check,
         "auto_updatable": auto_updatable,
         "update_available": update_available,
@@ -1190,4 +1211,4 @@ def build_guard_update_status_payload() -> dict[str, object]:
     }
 
 
-__all__ = ["build_guard_update_status_payload", "run_guard_update"]
+__all__ = ["build_guard_install_surface_payload", "build_guard_update_status_payload", "run_guard_update"]

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/src/codex_plugin_scanner/guard/protect.py

@@ -18,6 +18,7 @@ from .advisory_model import ProtectTargetIdentity, advisory_matches_target, buil
 from .config import GuardConfig
 from .models import GuardReceipt
 from .redaction import redact_text
+from .runtime.package_manager_command import strip_package_manager_global_options
 
 ProtectAction = Literal["allow", "review", "block"]
 SeverityLabel = Literal["low", "medium", "high", "critical"]
@@ -422,27 +423,51 @@ def evaluate_protect_request(
 
 
 def _parse_npm_request(command: list[str]) -> ProtectRequest:
-    specs = _collect_package_specs(command[2:]) if len(command) > 1 and command[1] in {"install", "add", "i"} else ()
+    normalized_command = list(strip_package_manager_global_options(command))
+    specs = (
+        _collect_package_specs(normalized_command[2:])
+        if len(normalized_command) > 1 and normalized_command[1] in {"install", "add", "i"}
+        else ()
+    )
     return _package_manager_request(command, "npm", specs)
 
 
 def _parse_pnpm_request(command: list[str]) -> ProtectRequest:
-    specs = _collect_package_specs(command[2:]) if len(command) > 1 and command[1] in {"add", "install"} else ()
+    normalized_command = list(strip_package_manager_global_options(command))
+    specs = (
+        _collect_package_specs(normalized_command[2:])
+        if len(normalized_command) > 1 and normalized_command[1] in {"add", "install"}
+        else ()
+    )
     return _package_manager_request(command, "pnpm", specs)
 
 
 def _parse_yarn_request(command: list[str]) -> ProtectRequest:
-    specs = _collect_package_specs(command[2:]) if len(command) > 1 and command[1] == "add" else ()
+    normalized_command = tuple(strip_package_manager_global_options(command))
+    working_command = normalized_command
+    if len(normalized_command) >= 4 and normalized_command[1] == "workspace":
+        working_command = (normalized_command[0], *normalized_command[3:])
+    specs = (
+        _collect_package_specs(list(working_command[2:]))
+        if len(working_command) > 1 and working_command[1] == "add"
+        else ()
+    )
     return _package_manager_request(command, "yarn", specs)
 
 
 def _parse_pip_request(command: list[str]) -> ProtectRequest:
-    specs = _collect_package_specs(command[2:]) if len(command) > 1 and command[1] == "install" else ()
+    normalized_command = list(strip_package_manager_global_options(command))
+    specs = (
+        _collect_package_specs(normalized_command[2:])
+        if len(normalized_command) > 1 and normalized_command[1] == "install"
+        else ()
+    )
     return _package_manager_request(command, "pip", specs)
 
 
 def _parse_uv_request(command: list[str]) -> ProtectRequest:
-    specs = _collect_uv_specs(command)
+    normalized_command = list(strip_package_manager_global_options(command))
+    specs = _collect_uv_specs(normalized_command)
     return _package_manager_request(command, "uv", specs)
 
 

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/src/codex_plugin_scanner/guard/runtime/package_intent_parser.py

@@ -26,6 +26,7 @@ from .package_intent_common import (
     redacted_command,
     version_target,
 )
+from .package_manager_command import strip_package_manager_global_options
 from .secret_file_requests import _SHELL_TOOL_NAMES, _candidate_command_texts, _normalize_tool_name
 
 _CONTROL_TOKENS = {"&&", "||", ";", "|", "|&", "&"}
@@ -120,19 +121,20 @@ def extract_package_intent_request(
 
 
 def _parse_npm_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 2:
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 2:
         return None
-    if tokens[1] in {"install", "i", "add", "update"}:
+    if working_tokens[1] in {"install", "i", "add", "update"}:
         return _build_intent(
             "npm",
             "install",
             tokens,
-            tuple(js_target(spec) for spec in _collect_package_specs(list(tokens[2:]))),
+            tuple(js_target(spec) for spec in _collect_package_specs(list(working_tokens[2:]))),
             workspace=workspace,
             manifest_candidates=("package.json",),
             lockfile_candidates=("package-lock.json",),
         )
-    if tokens[1] == "ci" or (len(tokens) >= 3 and tokens[1:3] == ("audit", "fix")):
+    if working_tokens[1] == "ci" or (len(working_tokens) >= 3 and working_tokens[1:3] == ("audit", "fix")):
         return _build_intent(
             "npm",
             "sync",
@@ -142,35 +144,38 @@ def _parse_npm_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> Pac
             manifest_candidates=("package.json",),
             lockfile_candidates=("package-lock.json",),
         )
-    if tokens[1] in {"exec", "x"}:
-        return _parse_exec_intent(tokens, workspace=workspace)
+    if working_tokens[1] in {"exec", "x"}:
+        return _parse_exec_intent(working_tokens, workspace=workspace)
     return None
 
 
 def _parse_pnpm_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 2:
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 2:
         return None
-    if tokens[1] in {"add", "install", "i"}:
+    if working_tokens[1] in {"add", "install", "i"}:
         return _build_intent(
             "pnpm",
             "install",
             tokens,
-            tuple(js_target(spec) for spec in _collect_specs(tokens[2:], skip_value_options={"--filter", "-F"})),
+            tuple(
+                js_target(spec) for spec in _collect_specs(working_tokens[2:], skip_value_options={"--filter", "-F"})
+            ),
             workspace=workspace,
             manifest_candidates=("package.json", "pnpm-workspace.yaml"),
             lockfile_candidates=("pnpm-lock.yaml",),
         )
-    if tokens[1] == "dlx":
-        return _parse_exec_intent(tokens, workspace=workspace)
+    if working_tokens[1] == "dlx":
+        return _parse_exec_intent(working_tokens, workspace=workspace)
     return None
 
 
 def _parse_yarn_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
     notes: tuple[str, ...] = ()
-    working_tokens = tokens
-    if len(tokens) >= 4 and tokens[1] == "workspace":
-        notes = (f"workspace:{tokens[2]}",)
-        working_tokens = (tokens[0], *tokens[3:])
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) >= 4 and working_tokens[1] == "workspace":
+        notes = (f"workspace:{working_tokens[2]}",)
+        working_tokens = (working_tokens[0], *working_tokens[3:])
     if len(working_tokens) < 2:
         return None
     if working_tokens[1] in {"add", "install", "up"}:
@@ -213,15 +218,16 @@ def _parse_exec_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> Pa
 
 
 def _parse_pip_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 2 or tokens[1] != "install":
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 2 or working_tokens[1] != "install":
         return None
     targets: list[PackageIntentTarget] = []
     manifest_paths: list[str] = []
     index = 2
-    while index < len(tokens):
-        token = tokens[index]
-        if token in {"-r", "--requirement", "-c", "--constraint"} and index + 1 < len(tokens):
-            manifest_paths.append(tokens[index + 1])
+    while index < len(working_tokens):
+        token = working_tokens[index]
+        if token in {"-r", "--requirement", "-c", "--constraint"} and index + 1 < len(working_tokens):
+            manifest_paths.append(working_tokens[index + 1])
             index += 2
             continue
         if token.startswith("--requirement=") or token.startswith("--constraint="):
@@ -236,8 +242,8 @@ def _parse_pip_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> Pac
             manifest_paths.append(token[2:])
             index += 1
             continue
-        if token in {"-e", "--editable"} and index + 1 < len(tokens):
-            targets.append(python_target(tokens[index + 1], editable=True))
+        if token in {"-e", "--editable"} and index + 1 < len(working_tokens):
+            targets.append(python_target(working_tokens[index + 1], editable=True))
             index += 2
             continue
         if token in {"--index-url", "--extra-index-url", "--hash"} and index + 1 < len(tokens):
@@ -259,14 +265,15 @@ def _parse_pip_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> Pac
 
 
 def _parse_pipx_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 3 or tokens[1] not in {"install", "run"}:
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 3 or working_tokens[1] not in {"install", "run"}:
         return None
-    target_spec = first_positional(tokens[2:], skip_value_options={"--python"})
+    target_spec = first_positional(working_tokens[2:], skip_value_options={"--python"})
     if target_spec is None:
         return None
     return _build_intent(
         "pipx",
-        "execute" if tokens[1] == "run" else "install",
+        "execute" if working_tokens[1] == "run" else "install",
         tokens,
         (python_target(target_spec),),
         workspace=workspace,
@@ -274,29 +281,30 @@ def _parse_pipx_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> Pa
 
 
 def _parse_uv_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 2:
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 2:
         return None
-    if tokens[1] == "add":
+    if working_tokens[1] == "add":
         return _build_intent(
             "uv",
             "install",
             tokens,
-            tuple(python_target(spec) for spec in _collect_package_specs(list(tokens[2:]))),
+            tuple(python_target(spec) for spec in _collect_package_specs(list(working_tokens[2:]))),
             workspace=workspace,
             manifest_candidates=("pyproject.toml",),
             lockfile_candidates=("uv.lock",),
         )
-    if len(tokens) >= 3 and tokens[1:3] == ("pip", "install"):
+    if len(working_tokens) >= 3 and working_tokens[1:3] == ("pip", "install"):
         return _build_intent(
             "uv",
             "install",
             tokens,
-            tuple(python_target(spec) for spec in _collect_package_specs(list(tokens[3:]))),
+            tuple(python_target(spec) for spec in _collect_package_specs(list(working_tokens[3:]))),
             workspace=workspace,
             manifest_candidates=("pyproject.toml",),
             lockfile_candidates=("uv.lock",),
         )
-    if tokens[1] == "sync":
+    if working_tokens[1] == "sync":
         return _build_intent(
             "uv",
             "sync",
@@ -310,9 +318,10 @@ def _parse_uv_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> Pack
 
 
 def _parse_poetry_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 2:
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 2:
         return None
-    if tokens[1] == "install":
+    if working_tokens[1] == "install":
         return _build_intent(
             "poetry",
             "sync",
@@ -322,13 +331,14 @@ def _parse_poetry_intent(tokens: tuple[str, ...], *, workspace: Path | None) ->
             manifest_candidates=("pyproject.toml",),
             lockfile_candidates=("poetry.lock",),
         )
-    if tokens[1] != "add":
+    if working_tokens[1] != "add":
         return None
-    group = option_value(tokens, "--group") or option_value(tokens, "-G")
-    extras_value = option_value(tokens, "--extras")
+    group = option_value(working_tokens, "--group") or option_value(working_tokens, "-G")
+    extras_value = option_value(working_tokens, "--extras")
     extras = tuple(item for item in (extras_value or "").split(",") if item)
     targets = tuple(
-        python_target(spec, dependency_group=group, extras=extras) for spec in _collect_package_specs(list(tokens[2:]))
+        python_target(spec, dependency_group=group, extras=extras)
+        for spec in _collect_package_specs(list(working_tokens[2:]))
     )
     return _build_intent(
         "poetry",
@@ -342,9 +352,10 @@ def _parse_poetry_intent(tokens: tuple[str, ...], *, workspace: Path | None) ->
 
 
 def _parse_pipenv_intent(tokens: tuple[str, ...], *, workspace: Path | None) -> PackageIntent | None:
-    if len(tokens) < 2:
+    working_tokens = strip_package_manager_global_options(tokens)
+    if len(working_tokens) < 2:
         return None
-    if tokens[1] == "sync":
+    if working_tokens[1] == "sync":
         return _build_intent(
             "pipenv",
             "sync",
@@ -354,13 +365,13 @@ def _parse_pipenv_intent(tokens: tuple[str, ...], *, workspace: Path | None) ->
             manifest_candidates=("Pipfile",),
             lockfile_candidates=("Pipfile.lock",),
         )
-    if tokens[1] != "install":
+    if working_tokens[1] != "install":
         return None
     return _build_intent(
         "pipenv",
         "install",
         tokens,
-        tuple(python_target(spec) for spec in _collect_package_specs(list(tokens[2:]))),
+        tuple(python_target(spec) for spec in _collect_package_specs(list(working_tokens[2:]))),
         workspace=workspace,
         manifest_candidates=("Pipfile",),
         lockfile_candidates=("Pipfile.lock",),

plugin_scanner-2.0.834/src/codex_plugin_scanner/guard/runtime/package_manager_command.py

@@ -0,0 +1,162 @@
+"""Normalize package-manager commands before install/execute parsing."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True, slots=True)
+class _GlobalOptionConfig:
+    subcommands: frozenset[str]
+    value_options: frozenset[str] = frozenset()
+
+
+_MANAGER_ALIASES = {
+    "pip3": "pip",
+}
+
+_MANAGER_GLOBAL_OPTIONS: dict[str, _GlobalOptionConfig] = {
+    "npm": _GlobalOptionConfig(
+        subcommands=frozenset({"add", "audit", "ci", "exec", "i", "install", "update", "x"}),
+        value_options=frozenset(
+            {
+                "--cache",
+                "--config",
+                "--prefix",
+                "--registry",
+                "--userconfig",
+                "-C",
+            }
+        ),
+    ),
+    "pnpm": _GlobalOptionConfig(
+        subcommands=frozenset({"add", "dlx", "i", "install"}),
+        value_options=frozenset(
+            {
+                "--dir",
+                "--filter",
+                "--registry",
+                "--store-dir",
+                "--workspace-dir",
+                "-C",
+                "-F",
+            }
+        ),
+    ),
+    "yarn": _GlobalOptionConfig(
+        subcommands=frozenset({"add", "dlx", "install", "up", "workspace"}),
+        value_options=frozenset(
+            {
+                "--cache-folder",
+                "--cwd",
+                "--modules-folder",
+                "--registry",
+            }
+        ),
+    ),
+    "pip": _GlobalOptionConfig(
+        subcommands=frozenset({"install"}),
+        value_options=frozenset(
+            {
+                "--cache-dir",
+                "--cert",
+                "--client-cert",
+                "--extra-index-url",
+                "--find-links",
+                "--index-url",
+                "--proxy",
+                "--python",
+                "--retries",
+                "--timeout",
+                "--trusted-host",
+                "-f",
+                "-i",
+            }
+        ),
+    ),
+    "pipx": _GlobalOptionConfig(
+        subcommands=frozenset({"install", "run"}),
+        value_options=frozenset({"--index-url", "--pip-args", "--python"}),
+    ),
+    "uv": _GlobalOptionConfig(
+        subcommands=frozenset({"add", "pip", "sync"}),
+        value_options=frozenset({"--cache-dir", "--directory", "--index", "--python", "--project"}),
+    ),
+    "poetry": _GlobalOptionConfig(
+        subcommands=frozenset({"add", "install"}),
+        value_options=frozenset({"--directory", "-C"}),
+    ),
+    "pipenv": _GlobalOptionConfig(
+        subcommands=frozenset({"install", "sync"}),
+        value_options=frozenset({"--python"}),
+    ),
+}
+
+
+def strip_package_manager_global_options(tokens: Sequence[str]) -> tuple[str, ...]:
+    normalized_tokens = tuple(str(token) for token in tokens)
+    if len(normalized_tokens) < 2:
+        return normalized_tokens
+    config = _MANAGER_GLOBAL_OPTIONS.get(_manager_key(normalized_tokens[0]))
+    if config is None:
+        return normalized_tokens
+    index = 1
+    while index < len(normalized_tokens):
+        token = normalized_tokens[index]
+        if token in config.subcommands:
+            return (normalized_tokens[0], *normalized_tokens[index:])
+        if token == "--":
+            break
+        if not token.startswith("-"):
+            return (normalized_tokens[0], *normalized_tokens[index:])
+        index += _leading_option_width(normalized_tokens, index, config)
+    return normalized_tokens
+
+
+def _manager_key(command_name: str) -> str:
+    normalized = Path(command_name).name.lower()
+    return _MANAGER_ALIASES.get(normalized, normalized)
+
+
+def _leading_option_width(
+    tokens: tuple[str, ...],
+    index: int,
+    config: _GlobalOptionConfig,
+) -> int:
+    token = tokens[index]
+    next_index = index + 1
+    if next_index < len(tokens) and tokens[next_index] in config.subcommands:
+        return 1
+    if token in config.value_options:
+        return 2 if next_index < len(tokens) else 1
+    if _matches_inline_value_option(token, config.value_options):
+        return 1
+    next_token = tokens[next_index] if next_index < len(tokens) else None
+    if token.startswith("--"):
+        if (
+            "=" not in token
+            and next_token is not None
+            and not next_token.startswith("-")
+            and next_token not in config.subcommands
+        ):
+            return 2
+        return 1
+    if (
+        len(token) == 2
+        and next_token is not None
+        and not next_token.startswith("-")
+        and next_token not in config.subcommands
+    ):
+        return 2
+    return 1
+
+
+def _matches_inline_value_option(token: str, value_options: frozenset[str]) -> bool:
+    for option in value_options:
+        if option.startswith("--") and token.startswith(f"{option}="):
+            return True
+        if option.startswith("-") and not option.startswith("--") and token.startswith(option) and token != option:
+            return True
+    return False

{plugin_scanner-2.0.832 → plugin_scanner-2.0.834}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.832"
+__version__ = "2.0.834"