plugin-scanner 2.0.834__tar.gz → 2.0.835__tar.gz

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.834
+Version: 2.0.835
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.834"
+version = "2.0.835"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.834"
+version = "2.0.835"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/src/codex_plugin_scanner/guard/cli/commands_hook_copilot.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
+    from ..mcp_tool_calls import ToolCallDecision
     from ._commands_shared import _hook_command_text, _now
     from .commands_support_hook_payload import _action_envelope_json, _approval_surface_policy_for_flow
     from .commands_support_interaction import (
@@ -31,6 +32,98 @@ from ._commands_shared import *
 from .commands_parser_helpers import *
 
 
+def _queue_observed_copilot_approval(
+    *,
+    artifact: GuardArtifact,
+    artifact_hash: str,
+    artifact_name: str,
+    args: argparse.Namespace,
+    action_envelope: GuardActionEnvelope | None,
+    config: GuardConfig,
+    context: HarnessContext,
+    decision: ToolCallDecision,
+    guard_home: Path,
+    managed_install: dict[str, object] | None,
+    payload: Mapping[str, object],
+    runtime_arguments: object,
+    runtime_workspace: Path | None,
+    store: GuardStore,
+) -> list[dict[str, object]]:
+    approval_center_url = ensure_guard_daemon(guard_home)
+    runtime_detection = _runtime_detection(args.harness, artifact)
+    evaluation_payload: dict[str, object] = {
+        "artifacts": [
+            {
+                "artifact_id": artifact.artifact_id,
+                "artifact_name": artifact_name,
+                "artifact_hash": artifact_hash,
+                "policy_action": "require-reapproval",
+                "changed_fields": ["runtime_tool_call", *decision.signals],
+                "artifact_type": artifact.artifact_type,
+                "source_scope": artifact.source_scope,
+                "config_path": artifact.config_path,
+                "launch_target": json.dumps(runtime_arguments, sort_keys=True)
+                if runtime_arguments is not None
+                else artifact.command,
+                "action_envelope_json": _action_envelope_json(action_envelope),
+            }
+        ]
+    }
+    approval_flow = get_adapter(args.harness).approval_flow(managed_install=managed_install)
+    try:
+        daemon_client = load_guard_surface_daemon_client(guard_home)
+    except RuntimeError:
+        queued = queue_blocked_approvals(
+            detection=runtime_detection,
+            evaluation=evaluation_payload,
+            store=store,
+            approval_center_url=approval_center_url,
+            now=_now(),
+        )
+    else:
+        session = daemon_client.start_session(
+            harness=args.harness,
+            surface="harness-adapter",
+            workspace=str(runtime_workspace) if runtime_workspace else None,
+            client_name=f"{args.harness}-permission-hook",
+            client_title=f"{args.harness} permission hook",
+            client_version="1.0.0",
+            capabilities=["approval-resolution", "receipt-view"],
+        )
+        blocked_operation = daemon_client.queue_blocked_operation(
+            session_id=str(session["session_id"]),
+            operation_type="tool_call",
+            harness=args.harness,
+            metadata={
+                "tool_name": str(payload.get("tool_name", "")),
+                "hook_name": "permissionRequest",
+                "hook_event_name": "PermissionRequest",
+                **_codex_browser_wait_metadata(
+                    args=args,
+                    event_name="PermissionRequest",
+                    policy_action="require-reapproval",
+                    config=config,
+                    payload=payload,
+                ),
+                "command_text": _hook_command_text(payload),
+                "workspace": str(runtime_workspace) if runtime_workspace else None,
+                **codex_resume_metadata_from_hook_payload(payload),
+            },
+            detection=runtime_detection.to_dict(),
+            evaluation=evaluation_payload,
+            approval_center_url=approval_center_url,
+            approval_surface_policy=_approval_surface_policy_for_flow(
+                config.approval_surface_policy,
+                approval_flow,
+            ),
+            open_key=artifact.artifact_id,
+        )
+        queued = blocked_operation.get("approval_requests")
+        if not isinstance(queued, list):
+            queued = []
+    return queued
+
+
 def _run_hook_copilot_pretool(
     args: argparse.Namespace,
     *,
@@ -63,6 +156,24 @@ def _run_hook_copilot_pretool(
         "require-reapproval": "require-reapproval",
     }.get(decision.action, "require-reapproval")
     now = _now()
+    if config.mode == "observe" and policy_action != "allow":
+        _queue_observed_copilot_approval(
+            artifact=runtime_artifact,
+            artifact_hash=runtime_artifact_hash,
+            artifact_name=runtime_artifact.name,
+            args=args,
+            action_envelope=action_envelope,
+            config=config,
+            context=context,
+            decision=decision,
+            guard_home=context.guard_home,
+            managed_install=None,
+            payload=payload,
+            runtime_arguments=runtime_arguments,
+            runtime_workspace=runtime_workspace,
+            store=store,
+        )
+        policy_action = "allow"
     if policy_action == "allow":
         allow_tool_call(
             store=store,
@@ -176,6 +287,26 @@ def _run_hook_copilot_permission_request(
         if runtime_arguments is not None
         else runtime_artifact.command,
     }
+    if config.mode == "observe" and policy_action != "allow":
+        queued = _queue_observed_copilot_approval(
+            artifact=runtime_artifact,
+            artifact_hash=runtime_artifact_hash,
+            artifact_name=artifact_name,
+            args=args,
+            action_envelope=action_envelope,
+            config=config,
+            context=context,
+            decision=decision,
+            guard_home=guard_home,
+            managed_install=managed_install,
+            payload=payload,
+            runtime_arguments=runtime_arguments,
+            runtime_workspace=runtime_workspace,
+            store=store,
+        )
+        response_payload["approval_requests"] = queued
+        policy_action = "allow"
+        response_payload["policy_action"] = "allow"
     if policy_action == "allow":
         allow_tool_call(
             store=store,

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py

@@ -86,7 +86,134 @@ def _review_runtime_artifact_hook(
         policy_action=policy_action,
         guard_payload=response_payload,
     )
+    observe_mode = config.mode == "observe"
     if policy_action in {"block", "sandbox-required", "require-reapproval"} or cursor_native_queue:
+        if observe_mode:
+            should_queue_approval_center = not (policy_action == "block" and stored_policy_action == "block")
+            if should_queue_approval_center:
+                approval_flow = get_adapter(args.harness).approval_flow(managed_install=managed_install)
+                approval_center_url = ensure_guard_daemon(guard_home)
+                runtime_detection = _runtime_detection(args.harness, runtime_artifact)
+                queued_policy_action = (
+                    "require-reapproval"
+                    if cursor_native_queue and policy_action in {"warn", "review"}
+                    else policy_action
+                )
+                package_evaluation_to_dict = getattr(package_evaluation, "to_dict", None)
+                evaluation_payload: dict[str, object] = {
+                    "artifacts": [
+                        {
+                            "artifact_id": artifact_id,
+                            "artifact_name": artifact_name,
+                            "artifact_hash": runtime_artifact_hash,
+                            "policy_action": queued_policy_action,
+                            "changed_fields": changed_capabilities,
+                            "artifact_type": runtime_artifact.artifact_type,
+                            "source_scope": runtime_artifact.source_scope,
+                            "config_path": runtime_artifact.config_path,
+                            "launch_target": _runtime_request_summary(runtime_artifact),
+                            "risk_summary": risk_summary,
+                            "action_envelope_json": _action_envelope_json(action_envelope),
+                            "decision_v2_json": decision_v2_payload,
+                            "scanner_evidence": scanner_evidence_payload,
+                            "supply_chain_evaluation": (
+                                package_evaluation_to_dict() if callable(package_evaluation_to_dict) else None
+                            ),
+                        }
+                    ]
+                }
+                browser_approval_daemon_client = None
+                try:
+                    browser_approval_daemon_client = load_guard_surface_daemon_client(guard_home)
+                except RuntimeError:
+                    queued = queue_blocked_approvals(
+                        detection=runtime_detection,
+                        evaluation=evaluation_payload,
+                        store=store,
+                        approval_center_url=approval_center_url,
+                        now=_now(),
+                    )
+                else:
+                    session = browser_approval_daemon_client.start_session(
+                        harness=args.harness,
+                        surface="harness-adapter",
+                        workspace=str(workspace) if workspace else None,
+                        client_name=f"{args.harness}-hook",
+                        client_title=f"{args.harness} hook",
+                        client_version="1.0.0",
+                        capabilities=["approval-resolution", "receipt-view"],
+                    )
+                    response_payload["session_id"] = str(session["session_id"])
+                    blocked_operation = browser_approval_daemon_client.queue_blocked_operation(
+                        session_id=str(session["session_id"]),
+                        operation_type="tool_call",
+                        harness=args.harness,
+                        metadata={
+                            "tool_name": str(payload.get("tool_name", "")),
+                            "event": str(payload.get("event", "")),
+                            "hook_event_name": event_name,
+                            **_codex_browser_wait_metadata(
+                                args=args,
+                                event_name=event_name,
+                                policy_action=policy_action,
+                                config=config,
+                                payload=payload_map,
+                            ),
+                            "command_text": _hook_command_text(payload_map),
+                            "workspace": str(workspace) if workspace else None,
+                            **codex_resume_metadata_from_hook_payload(payload_map),
+                        },
+                        detection=runtime_detection.to_dict(),
+                        evaluation=evaluation_payload,
+                        approval_center_url=approval_center_url,
+                        approval_surface_policy=_approval_surface_policy_for_flow(
+                            config.approval_surface_policy,
+                            approval_flow,
+                        ),
+                        open_key=artifact_id,
+                    )
+                    operation = blocked_operation.get("operation")
+                    if not isinstance(operation, dict):
+                        operation = {}
+                    queued = blocked_operation.get("approval_requests")
+                    if not isinstance(queued, list):
+                        queued = []
+                    operation_id = _optional_string(operation.get("operation_id"))
+                    if operation_id is not None:
+                        response_payload["operation_id"] = operation_id
+                    response_payload["operation"] = operation
+                    approval_request_ids = operation.get("approval_request_ids")
+                    if isinstance(approval_request_ids, list):
+                        response_payload["approval_request_ids"] = approval_request_ids
+                response_payload["approval_requests"] = queued
+                _attach_primary_approval_link(
+                    response_payload,
+                    harness=_optional_string(args.harness) or args.harness,
+                    approval_center_url=approval_center_url,
+                )
+                response_payload["approval_center_url"] = approval_center_url
+                response_payload["review_hint"] = approval_center_hint(
+                    context=context,
+                    harness=args.harness,
+                    approval_center_url=approval_center_url,
+                    queued=queued,
+                    managed_install=managed_install,
+                    request_id=_optional_string(response_payload.get("primary_approval_request_id")),
+                    artifact_id=_optional_string(response_payload.get("artifact_id")),
+                    review_url=_preferred_approval_review_url(response_payload, harness=args.harness),
+                )
+                response_payload["approval_delivery"] = _approval_delivery_payload(
+                    args.harness,
+                    managed_install=managed_install,
+                )
+                _localize_pending_approval_copy(response_payload, harness=args.harness)
+            policy_action = "allow"
+            response_payload["policy_action"] = "allow"
+            state.action_envelope = action_envelope
+            state.browser_approval_daemon_client = locals().get("browser_approval_daemon_client")
+            state.policy_action = policy_action
+            state.response_payload = response_payload
+            return None
         native_reason = _runtime_artifact_native_reason(runtime_artifact, response_payload)
         additional_context = _claude_prompt_additional_context(
             harness=args.harness,

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/src/codex_plugin_scanner/guard/proxy/runtime_mcp.py

@@ -452,6 +452,34 @@ class RuntimeMcpGuardProxy:
                         **event,
                         "decision": "deny-inline-invalid",
                     }
+            if self.config.mode == "observe":
+                self._queue_observed_approval_requests(
+                    artifact=artifact,
+                    artifact_hash=tool_artifact_hash,
+                    tool_name=tool_name,
+                    params=params,
+                    policy_action="require-reapproval",
+                    risk_summary=decision.summary,
+                    risk_signals=list(decision.signals),
+                )
+                response, package_event = self._handle_package_request(
+                    message=message,
+                    child_stdin=child_stdin,
+                    child_stdout=child_stdout,
+                    client_input=client_input,
+                    server_output=server_output,
+                    tool_name=tool_name,
+                    params=params,
+                    artifact=package_artifact,
+                    remember_allow=True,
+                    remember_decision_source="policy-allow",
+                    remember_signals=decision.signals,
+                    remember_risk_categories=decision.risk_categories,
+                )
+                return response, {
+                    **package_event,
+                    "decision": "observe-tool-call",
+                }
             response, queued_event = self._queue_approval_center_response(
                 message_id=message.get("id"),
                 artifact=artifact,
@@ -545,6 +573,33 @@ class RuntimeMcpGuardProxy:
                     **event,
                     "decision": "deny-inline-invalid",
                 }
+        if self.config.mode == "observe":
+            self._queue_observed_approval_requests(
+                artifact=artifact,
+                artifact_hash=tool_artifact_hash,
+                tool_name=tool_name,
+                params=params,
+                policy_action="require-reapproval",
+                risk_summary=decision.summary,
+                risk_signals=list(decision.signals),
+            )
+            response, observe_event = self._allow_and_forward(
+                message=message,
+                child_stdin=child_stdin,
+                child_stdout=child_stdout,
+                client_input=client_input,
+                server_output=server_output,
+                artifact=artifact,
+                artifact_hash=tool_artifact_hash,
+                decision_source="policy-allow",
+                signals=decision.signals,
+                risk_categories=decision.risk_categories,
+                params=params,
+            )
+            return response, {
+                **observe_event,
+                "decision": "observe-tool-call",
+            }
         response, queued_event = self._queue_approval_center_response(
             message_id=message.get("id"),
             artifact=artifact,
@@ -639,6 +694,66 @@ class RuntimeMcpGuardProxy:
                 "decision": "timeout" if _is_timeout_response(response) else f"package-{queue_policy_action}",
                 "redacted_params": _redact_json(params),
             }
+        if self.config.mode == "observe":
+            decision_v2_payload = build_decision_v2(
+                _guard_action(queue_policy_action),
+                reason=queue_policy_action,
+                signals=_package_reason_signals(package_evaluation.reasons),
+            ).to_dict()
+            decision_v2_payload["user_title"] = package_evaluation.user_copy.title
+            decision_v2_payload["user_body"] = package_evaluation.user_copy.summary
+            decision_v2_payload["harness_message"] = package_evaluation.user_copy.harness_message
+            decision_v2_payload["dashboard_primary_detail"] = package_evaluation.user_copy.summary
+            self._queue_observed_approval_requests(
+                artifact=artifact,
+                artifact_hash=artifact_digest,
+                tool_name=tool_name,
+                params=params,
+                policy_action=queue_policy_action,
+                risk_summary=package_evaluation.risk_summary,
+                risk_signals=[
+                    str(item.get("message") or item.get("code") or "") for item in package_evaluation.reasons
+                ],
+                decision_v2_payload=decision_v2_payload,
+                extra_fields={
+                    "changed_fields": ["runtime_tool_call", "package_request"],
+                    "supply_chain_evaluation": package_evaluation.to_dict(),
+                },
+            )
+            if remember_allow and remember_decision_source is not None:
+                try:
+                    allow_tool_call(
+                        store=self.store,
+                        artifact=artifact,
+                        artifact_hash=artifact_digest,
+                        decision_source=remember_decision_source,
+                        now=_now(),
+                        signals=remember_signals,
+                        risk_categories=remember_risk_categories,
+                        remember=True,
+                    )
+                except ApprovalGateError:
+                    return self._queue_approval_center_response(
+                        message_id=message.get("id"),
+                        artifact=artifact,
+                        artifact_hash=artifact_digest,
+                        tool_name=tool_name,
+                        signals=remember_signals,
+                        params=params,
+                    )
+            response = self._forward_message(
+                message,
+                child_stdin,
+                child_stdout,
+                client_input=client_input,
+                server_output=server_output,
+            )
+            return response, {
+                "method": "tools/call",
+                "tool_name": tool_name,
+                "decision": "timeout" if _is_timeout_response(response) else "observe-package",
+                "redacted_params": _redact_json(params),
+            }
         approval_center_url = ensure_guard_daemon(self.context.guard_home)
         decision_v2_payload = build_decision_v2(
             _guard_action(queue_policy_action),
@@ -1083,6 +1198,53 @@ class RuntimeMcpGuardProxy:
             "review_url": review_url,
         }
 
+    def _queue_observed_approval_requests(
+        self,
+        *,
+        artifact: Any,
+        artifact_hash: str,
+        tool_name: str,
+        params: dict[str, Any],
+        policy_action: str,
+        risk_summary: str,
+        risk_signals: list[str],
+        decision_v2_payload: dict[str, Any] | None = None,
+        extra_fields: dict[str, Any] | None = None,
+    ) -> list[dict[str, Any]]:
+        if policy_action not in {"block", "sandbox-required", "require-reapproval"}:
+            return []
+        approval_center_url = ensure_guard_daemon(self.context.guard_home)
+        artifact_payload: dict[str, Any] = {
+            "artifact_id": artifact.artifact_id,
+            "artifact_name": artifact.name,
+            "artifact_hash": artifact_hash,
+            "artifact_type": artifact.artifact_type,
+            "source_scope": artifact.source_scope,
+            "config_path": artifact.config_path,
+            "changed_fields": ["runtime_tool_call"],
+            "policy_action": policy_action,
+            "launch_target": self._launch_target(tool_name, params.get("arguments")),
+            "risk_summary": risk_summary,
+            "risk_signals": risk_signals,
+        }
+        if decision_v2_payload is not None:
+            artifact_payload["decision_v2_json"] = decision_v2_payload
+        if extra_fields:
+            artifact_payload.update(extra_fields)
+        return queue_blocked_approvals(
+            detection=HarnessDetection(
+                harness=self.harness,
+                installed=True,
+                command_available=True,
+                config_paths=(self.config_path,),
+                artifacts=(artifact,),
+            ),
+            evaluation={"artifacts": [artifact_payload]},
+            store=self.store,
+            approval_center_url=approval_center_url,
+            now=_now(),
+        )
+
     def _capture_tools_catalog(
         self,
         response: dict[str, Any],

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.834"
+__version__ = "2.0.835"

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/tests/test_guard_cli.py

@@ -4900,6 +4900,36 @@ curl --data-binary @"$1" http://127.0.0.1:8787/guard-canary
         assert "http://127.0.0.1:" in reason
         assert "Approve it in HOL Guard, then retry." not in reason
 
+    def test_guard_codex_hook_observe_mode_does_not_pause_risky_tool_use(self, tmp_path, capsys):
+        home_dir = tmp_path / "home"
+        workspace_dir = tmp_path / "workspace"
+        payload_path = workspace_dir / "hook-event.json"
+        _write_codex_pre_tool_payload(payload_path, workspace_dir, "echo MALICIOUS > dangerous-marker.json")
+        _write_text(home_dir / "config.toml", 'mode = "observe"\n')
+
+        rc = main(
+            [
+                "guard",
+                "hook",
+                "--harness",
+                "codex",
+                "--home",
+                str(home_dir),
+                "--workspace",
+                str(workspace_dir),
+                "--event-file",
+                str(payload_path),
+            ]
+        )
+        captured = capsys.readouterr()
+        store = GuardStore(home_dir)
+
+        assert rc == 0
+        assert captured.out == ""
+        pending = store.list_approval_requests(limit=5)
+        assert len(pending) == 1
+        assert pending[0]["policy_action"] == "require-reapproval"
+
     def test_guard_codex_pretooluse_returns_without_browser_wait_for_secret_exfil(self, tmp_path, monkeypatch, capsys):
         home_dir = tmp_path / "home"
         workspace_dir = tmp_path / "workspace"

{plugin_scanner-2.0.834 → plugin_scanner-2.0.835}/tests/test_guard_codex_proxy.py

@@ -412,6 +412,40 @@ def test_codex_guard_proxy_falls_back_to_approval_center_when_client_cannot_elic
     assert pending[0]["artifact_type"] == "tool_call"
 
 
+def test_codex_guard_proxy_observe_mode_allows_risky_tool_calls_and_still_queues_review(tmp_path):
+    context = _context(tmp_path)
+    store = GuardStore(context.guard_home)
+    config = GuardConfig(guard_home=context.guard_home, workspace=context.workspace_dir, mode="observe")
+    marker_path = tmp_path / "dangerous-call.json"
+    proxy = CodexMcpGuardProxy(
+        server_name="workspace_skill",
+        command=_child_command(marker_path),
+        context=context,
+        store=store,
+        config=config,
+        source_scope="project",
+        config_path=str(context.workspace_dir / ".codex" / "config.toml"),
+    )
+
+    result = proxy.run_session(
+        [
+            {"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {"capabilities": {}}},
+            {
+                "jsonrpc": "2.0",
+                "id": 2,
+                "method": "tools/call",
+                "params": {"name": "dangerous_delete", "arguments": {"target": ".env"}},
+            },
+        ]
+    )
+    pending = store.list_approval_requests()
+
+    assert result["responses"][1]["result"]["content"][0]["text"] == "dangerous_delete"
+    assert json.loads(marker_path.read_text(encoding="utf-8"))["name"] == "dangerous_delete"
+    assert len(pending) == 1
+    assert store.list_receipts(limit=1)[0]["policy_decision"] == "allow"
+
+
 def test_codex_guard_proxy_queues_approval_when_inline_prompt_gets_no_response(tmp_path):
     context = _context(tmp_path)
     store = GuardStore(context.guard_home)