plugin-scanner 2.0.843__tar.gz → 2.0.844__tar.gz

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.843
+Version: 2.0.844
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.843"
+version = "2.0.844"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.843"
+version = "2.0.844"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/src/codex_plugin_scanner/guard/shims.py

@@ -22,6 +22,7 @@ from .shim_probe import (
     parse_protect_json_stdout,
     protect_evaluator_evidence,
 )
+from .sqlite_tuning import SQLITE_CONNECT_TIMEOUT_SECONDS
 from .stable_digest import stable_digest_hex
 
 
@@ -61,6 +62,7 @@ _PACKAGE_SHIM_COMMANDS = {
 _PACKAGE_SHIM_MANIFEST = "manifest.json"
 _GUARD_PROFILE_MARKER = "# HOL Guard harness launchers"
 _PACKAGE_PROFILE_MARKER = "# HOL Guard package manager shims"
+_PACKAGE_SHIM_PROBE_TIMEOUT_SECONDS = int(SQLITE_CONNECT_TIMEOUT_SECONDS) + 5
 # Path fragments that indicate a shim dir lives in an ephemeral location (a test
 # temp dir, the system temp root, etc.). Such paths must never be written into a
 # long-lived shell profile: they vanish and leave broken PATH entries behind.
@@ -1275,7 +1277,7 @@ def probe_package_shim_intercepts(
                 cwd=target_workspace,
                 env=probe_env,
                 text=True,
-                timeout=15,
+                timeout=_PACKAGE_SHIM_PROBE_TIMEOUT_SECONDS,
             )
         except (subprocess.TimeoutExpired, OSError):
             manager_results.append(

plugin_scanner-2.0.844/src/codex_plugin_scanner/guard/sqlite_tuning.py

@@ -0,0 +1,7 @@
+"""Shared SQLite timing configuration for Guard local storage."""
+
+from __future__ import annotations
+
+SQLITE_CONNECT_TIMEOUT_SECONDS = 30.0
+SQLITE_BUSY_TIMEOUT_MS = int(SQLITE_CONNECT_TIMEOUT_SECONDS * 1000)
+SQLITE_WAL_BUSY_TIMEOUT_MS = 1000

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/src/codex_plugin_scanner/guard/store.py

@@ -53,6 +53,7 @@ from .policy_integrity import (
 from .runtime.actions import GuardActionEnvelope
 from .runtime.scanner_cache import scanner_cache_key
 from .schemas.guard_event_v1 import GuardEventV1
+from .sqlite_tuning import SQLITE_BUSY_TIMEOUT_MS, SQLITE_CONNECT_TIMEOUT_SECONDS, SQLITE_WAL_BUSY_TIMEOUT_MS
 from .store_approvals import (
     _json_object,
     _json_object_list,
@@ -270,7 +271,6 @@ _REMOTE_POLICY_SOURCE_PARAMS = tuple(sorted(REMOTE_POLICY_SOURCES))
 _REMOTE_POLICY_SOURCE_PLACEHOLDERS = "(" + ",".join("?" for _ in _REMOTE_POLICY_SOURCE_PARAMS) + ")"
 _POLICY_SCOPES = frozenset({"artifact", "workspace", "publisher", "harness", "global"})
 _SLOW_STORE_WARNING_ENV = "HOL_GUARD_WARN_SLOW_STORE"
-_SQLITE_CONNECT_TIMEOUT_SECONDS = 30.0
 _SQLITE_LOCK_RETRY_ATTEMPTS = 5
 _SQLITE_LOCK_RETRY_DELAY_SECONDS = 0.1
 _SECRET_FINGERPRINT_PREFIX = "scrypt$"
@@ -1870,11 +1870,11 @@ class GuardStore:
 
     @contextmanager
     def _connect(self) -> Iterator[sqlite3.Connection]:
-        connection = sqlite3.connect(self.path, timeout=_SQLITE_CONNECT_TIMEOUT_SECONDS)
+        connection = sqlite3.connect(self.path, timeout=SQLITE_CONNECT_TIMEOUT_SECONDS)
         connection.row_factory = sqlite3.Row
         start = time.monotonic()
         try:
-            connection.execute("pragma busy_timeout=10000")
+            connection.execute(f"pragma busy_timeout={SQLITE_BUSY_TIMEOUT_MS}")
             yield connection
             connection.commit()
         finally:
@@ -2335,14 +2335,21 @@ class GuardStore:
 
     @staticmethod
     def _enable_wal_mode(connection: sqlite3.Connection) -> None:
-        for attempt in range(_SQLITE_LOCK_RETRY_ATTEMPTS):
-            try:
-                connection.execute("pragma journal_mode=WAL")
-                return
-            except sqlite3.OperationalError as exc:
-                if "database is locked" not in str(exc).lower() or attempt == _SQLITE_LOCK_RETRY_ATTEMPTS - 1:
-                    raise
-                time.sleep(_SQLITE_LOCK_RETRY_DELAY_SECONDS)
+        original_busy_timeout_row = connection.execute("pragma busy_timeout").fetchone()
+        original_busy_timeout_ms = int(original_busy_timeout_row[0]) if original_busy_timeout_row else 0
+        wal_busy_timeout_ms = min(original_busy_timeout_ms, SQLITE_WAL_BUSY_TIMEOUT_MS)
+        connection.execute(f"pragma busy_timeout={wal_busy_timeout_ms}")
+        try:
+            for attempt in range(_SQLITE_LOCK_RETRY_ATTEMPTS):
+                try:
+                    connection.execute("pragma journal_mode=WAL")
+                    return
+                except sqlite3.OperationalError as exc:
+                    if "database is locked" not in str(exc).lower() or attempt == _SQLITE_LOCK_RETRY_ATTEMPTS - 1:
+                        raise
+                    time.sleep(_SQLITE_LOCK_RETRY_DELAY_SECONDS)
+        finally:
+            connection.execute(f"pragma busy_timeout={original_busy_timeout_ms}")
 
     @staticmethod
     def _ensure_policy_column(connection: sqlite3.Connection, column_name: str, column_type: str) -> None:

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.843"
+__version__ = "2.0.844"

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/tests/test_guard_package_shims.py

@@ -6,10 +6,13 @@ import base64
 import hashlib
 import json
 import os
+import sqlite3
 import subprocess
 import threading
+import time
 from datetime import datetime, timedelta, timezone
 from http.server import HTTPServer
+from multiprocessing import Event, Process
 from pathlib import Path
 
 import pytest
@@ -19,6 +22,7 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, generat
 
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import shims as guard_shims_module
+from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
 from codex_plugin_scanner.guard.approvals import apply_approval_resolution
 from codex_plugin_scanner.guard.cli import commands as guard_commands_module
@@ -284,6 +288,71 @@ def _install_single_manager_shim(
     return Path(str(payload["shim_dir"])) / manager
 
 
+def _hold_guard_db_writer_lock(
+    database_path: str,
+    hold_seconds: int,
+    ready_event: Event | None = None,
+) -> None:
+    connection = sqlite3.connect(database_path, timeout=1)
+    try:
+        connection.execute("BEGIN IMMEDIATE")
+        connection.execute(
+            "insert into guard_events (event_name, payload_json, occurred_at) values (?, ?, ?)",
+            ("lock-test", "{}", "2026-06-20T00:00:00Z"),
+        )
+        if ready_event is not None:
+            ready_event.set()
+        time.sleep(hold_seconds)
+        connection.rollback()
+    finally:
+        connection.close()
+
+
+def test_enable_wal_mode_uses_bounded_busy_timeout(monkeypatch: pytest.MonkeyPatch) -> None:
+    sleep_calls: list[float] = []
+
+    class _Cursor:
+        def __init__(self, row):
+            self._row = row
+
+        def fetchone(self):
+            return self._row
+
+    class _Connection:
+        def __init__(self) -> None:
+            self.busy_timeout_ms = guard_store_module.SQLITE_BUSY_TIMEOUT_MS
+            self.wal_attempts = 0
+            self.commands: list[str] = []
+
+        def execute(self, sql: str):
+            self.commands.append(sql)
+            if sql == "pragma busy_timeout":
+                return _Cursor((self.busy_timeout_ms,))
+            if sql.startswith("pragma busy_timeout="):
+                self.busy_timeout_ms = int(sql.split("=", 1)[1])
+                return _Cursor(None)
+            if sql == "pragma journal_mode=WAL":
+                self.wal_attempts += 1
+                if self.wal_attempts < 2:
+                    raise sqlite3.OperationalError("database is locked")
+                return _Cursor(("wal",))
+            raise AssertionError(f"unexpected SQL: {sql}")
+
+    monkeypatch.setattr(guard_store_module.time, "sleep", lambda seconds: sleep_calls.append(seconds))
+    connection = _Connection()
+
+    guard_store_module.GuardStore._enable_wal_mode(connection)
+
+    assert connection.wal_attempts == 2
+    assert connection.commands[:2] == [
+        "pragma busy_timeout",
+        f"pragma busy_timeout={guard_store_module.SQLITE_WAL_BUSY_TIMEOUT_MS}",
+    ]
+    assert connection.commands[-1] == f"pragma busy_timeout={guard_store_module.SQLITE_BUSY_TIMEOUT_MS}"
+    assert connection.busy_timeout_ms == guard_store_module.SQLITE_BUSY_TIMEOUT_MS
+    assert sleep_calls == [guard_store_module._SQLITE_LOCK_RETRY_DELAY_SECONDS]
+
+
 def _write_npm_ci_workspace(workspace_dir: Path, *, package_name: str, package_version: str) -> None:
     (workspace_dir / "package.json").write_text(
         json.dumps(
@@ -451,6 +520,46 @@ def test_package_manager_shim_runs_allowed_command_once_when_shim_dir_is_on_path
     assert marker_payload["cwd"] == str(workspace_dir)
 
 
+def test_package_manager_shim_waits_out_transient_store_writer_lock(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "guard-home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True, exist_ok=True)
+    fake_bin = tmp_path / "fake-bin"
+    fake_bin.mkdir()
+    marker_path = tmp_path / "bun-after-lock.json"
+    write_fake_manager_script(fake_bin=fake_bin, manager="bun", marker_path=marker_path, exit_code=0)
+    shim_path = _install_single_manager_shim(
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+        manager="bun",
+        capsys=capsys,
+    )
+    ready_event = Event()
+    lock_process = Process(target=_hold_guard_db_writer_lock, args=(str(home_dir / "guard.db"), 13, ready_event))
+    lock_process.start()
+    assert ready_event.wait(timeout=5)
+    env = dict(os.environ)
+    env["HOME"] = str(home_dir)
+    env["PATH"] = f"{shim_path.parent}{os.pathsep}{fake_bin}{os.pathsep}{env.get('PATH', '')}"
+
+    try:
+        result = subprocess.run(
+            [str(shim_path), "install", "-g", "@oh-my-pi/pi-coding-agent"],
+            cwd=workspace_dir,
+            env=env,
+            capture_output=True,
+            check=False,
+            text=True,
+            timeout=60,
+        )
+    finally:
+        lock_process.join(timeout=20)
+
+    assert result.returncode == 0
+    assert marker_path.exists()
+    assert "database is locked" not in result.stderr
+
+
 @pytest.mark.parametrize(
     ("manager", "argv", "expected"),
     [

{plugin_scanner-2.0.843 → plugin_scanner-2.0.844}/tests/test_guard_shim_intercept_proofs.py

@@ -163,6 +163,40 @@ def test_package_shim_intercept_probe_marks_hung_manager_as_probe_failed(
     ]
 
 
+def test_package_shim_intercept_probe_timeout_covers_store_busy_wait(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True)
+    context = _harness_context(tmp_path, workspace_dir=workspace_dir)
+    install_package_shims(context, managers=("npm",))
+    shim_dir = context.guard_home / "package-shims" / "bin"
+    fake_bin = tmp_path / "fake-bin"
+    fake_bin.mkdir(parents=True)
+    write_fake_manager_script(
+        fake_bin=fake_bin,
+        manager="npm",
+        marker_path=tmp_path / "npm-never-runs.json",
+        exit_code=0,
+    )
+    monkeypatch.setenv("PATH", os.pathsep.join([str(shim_dir), str(fake_bin)]))
+    captured_timeout: dict[str, int] = {}
+
+    def raise_timeout(*_args, **kwargs):
+        captured_timeout["value"] = kwargs["timeout"]
+        raise subprocess.TimeoutExpired(cmd=["npm"], timeout=kwargs["timeout"])
+
+    monkeypatch.setattr(shims_module.subprocess, "run", raise_timeout)
+
+    result = probe_package_shim_intercepts(context, managers=("npm",), workspace_dir=workspace_dir)
+
+    assert result["intercept_proved"] is False
+    assert result["manager_results"][0]["skipped_reason"] == "probe_failed"
+    assert captured_timeout["value"] == shims_module._PACKAGE_SHIM_PROBE_TIMEOUT_SECONDS
+    assert captured_timeout["value"] > 15
+
+
 def test_package_shim_intercept_probe_omits_manager_stdout_secrets(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,