plugin-scanner 2.0.844__tar.gz → 2.0.846__tar.gz

{plugin_scanner-2.0.844 → plugin_scanner-2.0.846}/.github/workflows/publish.yml

@@ -26,6 +26,7 @@ concurrency:
 jobs:
   build:
     name: Build + Verify
+    if: github.event_name != 'push' || github.ref != 'refs/heads/main' || !contains(github.event.head_commit.message, '[skip release publish]')
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
@@ -48,7 +49,7 @@ jobs:
           GITHUB_EVENT_NAME: ${{ github.event_name }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          BASE_VERSION=$(python3 -c "import tomllib; p=tomllib.load(open('pyproject.toml','rb')); print(p['project']['version'])")
+          BASE_VERSION=$(uv run --no-sync python scripts/sync_repo_version.py --check)
           VERSION="$BASE_VERSION"
           if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
             VERSION="${GITHUB_REF#refs/tags/v}"
@@ -91,8 +92,7 @@ jobs:
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          sed -i "1,/^version = /{s/^version = .*/version = \"$VERSION\"/}" pyproject.toml
-          sed -i "1,/^__version__ = /{s/^__version__ = .*/__version__ = \"$VERSION\"/}" src/codex_plugin_scanner/version.py
+          uv run --no-sync python scripts/sync_repo_version.py --version "$VERSION"
       - name: Build Guard package (hol-guard)
         run: |
           cp pyproject.toml pyproject.toml.bak
@@ -315,12 +315,17 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - name: Install packaging
+        run: |
+          python3 -m pip install packaging
       - name: Stamp package version
         env:
           VERSION: ${{ needs.build.outputs.version }}
         run: |
-          sed -i "1,/^version = /{s/^version = .*/version = \"$VERSION\"/}" pyproject.toml
-          sed -i "1,/^__version__ = /{s/^__version__ = .*/__version__ = \"$VERSION\"/}" src/codex_plugin_scanner/version.py
+          python3 scripts/sync_repo_version.py --version "$VERSION"
       - name: Prepare image tags
         id: tags
         env:
@@ -348,3 +353,44 @@ jobs:
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.version=${{ needs.build.outputs.version }}
             org.opencontainers.image.revision=${{ github.sha }}
+
+  sync-repository-version:
+    name: Sync repository version
+    if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip release publish]') && needs.build.result == 'success' && needs.publish-pypi.result == 'success' && contains(fromJSON('["success","skipped"]'), needs.release.result) && contains(fromJSON('["success","skipped"]'), needs.publish-container.result)
+    needs: [build, publish-pypi, release, publish-container]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          ref: main
+          fetch-depth: 0
+      - name: Prepare main branch
+        run: |
+          git checkout -B main origin/main
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: "3.12"
+      - name: Install packaging
+        run: |
+          python3 -m pip install packaging
+      - name: Sync repository version files
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          python3 scripts/sync_repo_version.py --version "$VERSION"
+      - name: Commit repository version
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          if git diff --quiet -- pyproject.toml src/codex_plugin_scanner/version.py uv.lock; then
+            echo "Repository version already synced."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add pyproject.toml src/codex_plugin_scanner/version.py uv.lock
+          git commit -m "chore(release): sync repository version to ${VERSION} [skip release publish]"
+          git pull --rebase origin main
+          git push origin HEAD:main

{plugin_scanner-2.0.844 → plugin_scanner-2.0.846}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.844
+Version: 2.0.846
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.844 → plugin_scanner-2.0.846}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.844"
+version = "2.0.846"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.844 → plugin_scanner-2.0.846}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.844"
+version = "2.0.846"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.846/scripts/sync_repo_version.py

@@ -0,0 +1,271 @@
+#!/usr/bin/env python3
+"""Keep repository version files aligned."""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+from packaging.version import InvalidVersion, Version
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - Python 3.10 fallback
+    import tomli as tomllib
+
+PYPROJECT_RELATIVE_PATH = Path("pyproject.toml")
+MODULE_RELATIVE_PATH = Path("src/codex_plugin_scanner/version.py")
+LOCKFILE_RELATIVE_PATH = Path("uv.lock")
+TOML_TABLE_HEADER_PATTERN = re.compile(r"^\[[A-Za-z0-9_.-]+\]$")
+PYPROJECT_VERSION_LINE_PATTERN = re.compile(
+    r'^(?P<prefix>\s*version\s*=\s*["\'])(?P<version>[^"\']+)(?P<suffix>["\'](?:\s+#.*)?\s*)$'
+)
+MODULE_VERSION_LINE_PATTERN = re.compile(
+    r'^(?P<prefix>\s*__version__\s*=\s*["\'])(?P<version>[^"\']+)(?P<suffix>["\'](?:\s+#.*)?\s*)$',
+    re.MULTILINE,
+)
+
+
+@dataclass(frozen=True)
+class RepoVersionState:
+    pyproject: str
+    module: str
+    lockfile: str
+
+
+def _default_repo_root() -> Path:
+    return Path(__file__).resolve().parents[1]
+
+
+def _validate_version_token(version: str) -> str:
+    try:
+        Version(version)
+    except InvalidVersion:
+        raise ValueError(f"Unsupported version format: {version}")
+    return version
+
+
+def _read_text(path: Path) -> str:
+    return path.read_text(encoding="utf-8")
+
+
+def _read_pyproject_version(path: Path) -> str:
+    project = tomllib.loads(_read_text(path)).get("project")
+    if not isinstance(project, dict):
+        raise ValueError(f"Could not find [project] table in {path}")
+    version = project.get("version")
+    if not isinstance(version, str):
+        raise ValueError(f"Could not find [project].version in {path}")
+    return version
+
+
+def _extract_version(path: Path, pattern: re.Pattern[str], label: str) -> str:
+    match = pattern.search(_read_text(path))
+    if match is None:
+        raise ValueError(f"Could not find {label} version in {path}")
+    return match.group("version")
+
+
+def read_repo_version_state(repo_root: Path) -> RepoVersionState:
+    return RepoVersionState(
+        pyproject=_read_pyproject_version(repo_root / PYPROJECT_RELATIVE_PATH),
+        module=_extract_version(
+            repo_root / MODULE_RELATIVE_PATH,
+            MODULE_VERSION_LINE_PATTERN,
+            "module",
+        ),
+        lockfile=_read_lockfile_version(repo_root / LOCKFILE_RELATIVE_PATH),
+    )
+
+
+def assert_repo_version(repo_root: Path, expected_version: str | None = None) -> str:
+    if expected_version is not None:
+        _validate_version_token(expected_version)
+    state = read_repo_version_state(repo_root)
+    if state.pyproject != state.module or state.pyproject != state.lockfile:
+        raise ValueError(
+            "Repository version mismatch: "
+            f"{PYPROJECT_RELATIVE_PATH} has {state.pyproject}, "
+            f"{MODULE_RELATIVE_PATH} has {state.module}, "
+            f"{LOCKFILE_RELATIVE_PATH} has {state.lockfile}"
+        )
+    if expected_version is not None and state.pyproject != expected_version:
+        raise ValueError(
+            "Repository version mismatch: "
+            f"expected {expected_version}, found {state.pyproject}"
+        )
+    return state.pyproject
+
+
+def _replace_matching_line(line: str, pattern: re.Pattern[str], version: str) -> str:
+    line_body = line.rstrip("\r\n")
+    line_ending = line[len(line_body) :]
+    match = pattern.match(line_body)
+    if match is None:
+        return line
+    return f'{match.group("prefix")}{version}{match.group("suffix")}{line_ending}'
+
+
+def _replace_project_version(path: Path, version: str) -> tuple[str, bool]:
+    text = _read_text(path)
+    lines = text.splitlines(keepends=True)
+    in_project_table = False
+    project_version_index: int | None = None
+
+    for index, line in enumerate(lines):
+        stripped = line.strip()
+        if stripped == "[project]":
+            in_project_table = True
+            continue
+        if in_project_table and TOML_TABLE_HEADER_PATTERN.fullmatch(stripped):
+            break
+        if not in_project_table:
+            continue
+        replaced_line = _replace_matching_line(line, PYPROJECT_VERSION_LINE_PATTERN, version)
+        if replaced_line != line:
+            lines[index] = replaced_line
+            project_version_index = index
+            break
+
+    if project_version_index is None:
+        raise ValueError(f"Could not update [project].version in {path}")
+
+    updated_text = "".join(lines)
+    return updated_text, updated_text != text
+
+
+def _replace_module_version(path: Path, version: str) -> tuple[str, bool]:
+    text = _read_text(path)
+    lines = text.splitlines(keepends=True)
+    module_version_index: int | None = None
+
+    for index, line in enumerate(lines):
+        replaced_line = _replace_matching_line(line, MODULE_VERSION_LINE_PATTERN, version)
+        if replaced_line != line:
+            lines[index] = replaced_line
+            module_version_index = index
+            break
+
+    if module_version_index is None:
+        raise ValueError(f"Could not update module version line in {path}")
+
+    updated_text = "".join(lines)
+    return updated_text, updated_text != text
+
+
+def _find_lockfile_version_index(lines: list[str], path: Path) -> int:
+    in_package_block = False
+    package_name_matches = False
+    editable_source_matches = False
+    version_index: int | None = None
+
+    for index, line in enumerate(lines):
+        stripped = line.strip()
+        if stripped == "[[package]]":
+            if in_package_block and package_name_matches and editable_source_matches and version_index is not None:
+                return version_index
+            in_package_block = True
+            package_name_matches = False
+            editable_source_matches = False
+            version_index = None
+            continue
+        if not in_package_block:
+            continue
+        if stripped.startswith("name = "):
+            package_name_matches = stripped == 'name = "hol-guard"'
+            continue
+        if stripped.startswith("version = ") and version_index is None:
+            version_index = index
+            continue
+        if stripped.startswith("source = "):
+            editable_source_matches = stripped == 'source = { editable = "." }'
+
+    if in_package_block and package_name_matches and editable_source_matches and version_index is not None:
+        return version_index
+    raise ValueError(f"Could not find editable hol-guard package version in {path}")
+
+
+def _read_lockfile_version(path: Path) -> str:
+    lines = _read_text(path).splitlines(keepends=True)
+    version_index = _find_lockfile_version_index(lines, path)
+    version_line = lines[version_index].rstrip("\r\n")
+    match = PYPROJECT_VERSION_LINE_PATTERN.match(version_line)
+    if match is None:
+        raise ValueError(f"Could not parse lockfile version in {path}")
+    return match.group("version")
+
+
+def _replace_lockfile_version(path: Path, version: str) -> tuple[str, bool]:
+    lines = _read_text(path).splitlines(keepends=True)
+    version_index = _find_lockfile_version_index(lines, path)
+    replaced_line = _replace_matching_line(lines[version_index], PYPROJECT_VERSION_LINE_PATTERN, version)
+    if replaced_line == lines[version_index]:
+        return "".join(lines), False
+    lines[version_index] = replaced_line
+    return "".join(lines), True
+
+
+def sync_repo_version(repo_root: Path, version: str) -> bool:
+    normalized_version = _validate_version_token(version)
+    pyproject_path = repo_root / PYPROJECT_RELATIVE_PATH
+    module_path = repo_root / MODULE_RELATIVE_PATH
+    lockfile_path = repo_root / LOCKFILE_RELATIVE_PATH
+
+    pyproject_text, pyproject_changed = _replace_project_version(pyproject_path, normalized_version)
+    module_text, module_changed = _replace_module_version(module_path, normalized_version)
+    lockfile_text, lockfile_changed = _replace_lockfile_version(lockfile_path, normalized_version)
+
+    if pyproject_changed:
+        pyproject_path.write_text(pyproject_text, encoding="utf-8")
+    if module_changed:
+        module_path.write_text(module_text, encoding="utf-8")
+    if lockfile_changed:
+        lockfile_path.write_text(lockfile_text, encoding="utf-8")
+
+    assert_repo_version(repo_root, normalized_version)
+    return pyproject_changed or module_changed or lockfile_changed
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    mode = parser.add_mutually_exclusive_group()
+    mode.add_argument(
+        "--check",
+        action="store_true",
+        help="Validate that repository version files match and print the current version.",
+    )
+    mode.add_argument(
+        "--version",
+        help="Sync both repository version files to the supplied semantic version.",
+    )
+    parser.add_argument(
+        "--repo-root",
+        type=Path,
+        default=_default_repo_root(),
+        help="Repository root to inspect. Defaults to the current hol-guard checkout.",
+    )
+    return parser
+
+
+def main() -> int:
+    parser = _build_parser()
+    args = parser.parse_args()
+    repo_root = args.repo_root.resolve()
+    try:
+        if args.version is not None:
+            sync_repo_version(repo_root, args.version)
+            print(_validate_version_token(args.version))
+            return 0
+        current_version = assert_repo_version(repo_root)
+        print(current_version)
+        return 0
+    except ValueError as error:
+        print(f"Error: {error}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{plugin_scanner-2.0.844 → plugin_scanner-2.0.846}/src/codex_plugin_scanner/guard/approvals.py

@@ -378,17 +378,41 @@ def apply_approval_resolution(
         now=resolved_at,
     )
     persisted_rule = persist_policy is True or (persist_policy is None and scope != "artifact")
+    local_once_fallback = False
     if persisted_rule:
+        store.ensure_policy_integrity_ready_for_write(
+            harness=decision.harness if decision.harness != "*" else None,
+            approval_gate_grant=resolved_gate_grant,
+            now=resolved_at,
+        )
         store.upsert_policy(decision, resolved_at, approval_gate_grant=resolved_gate_grant)
+        if action == "allow" and _should_record_local_once_replay(request):
+            local_once_fallback = _record_local_once_approval(
+                store,
+                request_id=request_id,
+                decision=decision,
+                harness=str(request["harness"]),
+                created_at=resolved_at,
+            )
     elif persist_policy is None and scope == "artifact":
+        once_decision = replace(
+            decision,
+            expires_at=_approval_once_policy_expires_at(resolved_at),
+        )
         store.upsert_policy(
-            replace(
-                decision,
-                expires_at=_approval_once_policy_expires_at(resolved_at),
-            ),
+            once_decision,
             resolved_at,
             approval_gate_grant=resolved_gate_grant,
         )
+        if action == "allow" and _should_record_local_once_replay(request):
+            local_once_fallback = _record_local_once_approval(
+                store,
+                request_id=request_id,
+                decision=once_decision,
+                harness=str(request["harness"]),
+                created_at=resolved_at,
+            )
+
     resolution_harness = None if scope == "global" else str(request["harness"])
     if return_queue_result:
         result = store.resolve_request_with_queue_result(
@@ -431,6 +455,7 @@ def apply_approval_resolution(
             scope,
             resolved_at,
             persisted_rule=persisted_rule,
+            local_once_fallback=local_once_fallback,
         )
         return result
     resolved_ids: list[str] = []
@@ -470,6 +495,7 @@ def apply_approval_resolution(
         scope,
         resolved_at,
         persisted_rule=persisted_rule,
+        local_once_fallback=local_once_fallback,
     )
     return updated
 
@@ -591,15 +617,27 @@ def _record_resolution_event(
     resolved_at: str,
     *,
     persisted_rule: bool,
+    local_once_fallback: bool = False,
 ) -> None:
     store.add_event(
         "approval.resolved",
-        {"request_id": request_id, "action": action, "scope": scope, "persisted_rule": persisted_rule},
+        {
+            "request_id": request_id,
+            "action": action,
+            "scope": scope,
+            "persisted_rule": persisted_rule,
+            "local_once_fallback": local_once_fallback,
+        },
         resolved_at,
     )
     store.add_event(
         "rule.remembered.local" if persisted_rule else "approval.once",
-        {"request_id": request_id, "action": action, "scope": scope},
+        {
+            "request_id": request_id,
+            "action": action,
+            "scope": scope,
+            "local_once_fallback": local_once_fallback,
+        },
         resolved_at,
     )
 
@@ -1014,6 +1052,41 @@ def _approval_once_policy_expires_at(resolved_at: str) -> str:
     return (parsed + _APPROVAL_ONCE_POLICY_TTL).isoformat()
 
 
+def _should_record_local_once_replay(request: Mapping[str, object]) -> bool:
+    artifact_type = request.get("artifact_type")
+    if artifact_type == "package_request":
+        return True
+    artifact_id = request.get("artifact_id")
+    if isinstance(artifact_id, str) and ":package-request:" in artifact_id:
+        return True
+    launch_target = request.get("launch_target")
+    if not isinstance(launch_target, str):
+        return False
+    return launch_target.startswith(("npm ", "npx ", "pnpm ", "yarn ", "bun "))
+
+
+def _record_local_once_approval(
+    store: GuardStore,
+    *,
+    request_id: str,
+    decision: PolicyDecision,
+    harness: str,
+    created_at: str,
+) -> bool:
+    approval_id = store.record_local_once_approval(
+        request_id=request_id,
+        harness=harness,
+        artifact_id=decision.artifact_id,
+        artifact_hash=decision.artifact_hash,
+        workspace=decision.workspace,
+        publisher=decision.publisher,
+        action=decision.action,
+        created_at=created_at,
+        expires_at=decision.expires_at or _approval_once_policy_expires_at(created_at),
+    )
+    return approval_id is not None
+
+
 def _build_runtime_cloud_context(
     store: GuardStore,
     latest_connect_state: dict[str, object] | None,