plugin-scanner 2.0.846__tar.gz → 2.0.848__tar.gz

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/.github/workflows/publish.yml

@@ -361,6 +361,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
@@ -380,17 +381,61 @@ jobs:
           VERSION: ${{ needs.build.outputs.version }}
         run: |
           python3 scripts/sync_repo_version.py --version "$VERSION"
-      - name: Commit repository version
+      - name: Open repository version sync PR
         env:
+          ACTION_REPO_TOKEN: ${{ secrets.ACTION_REPO_TOKEN }}
+          GH_TOKEN: ${{ secrets.ACTION_REPO_TOKEN }}
           VERSION: ${{ needs.build.outputs.version }}
         run: |
           if git diff --quiet -- pyproject.toml src/codex_plugin_scanner/version.py uv.lock; then
             echo "Repository version already synced."
             exit 0
           fi
+          if [[ -z "$ACTION_REPO_TOKEN" ]]; then
+            echo "ACTION_REPO_TOKEN must be configured to sync repository version files after publish." >&2
+            exit 1
+          fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${ACTION_REPO_TOKEN}@github.com/${{ github.repository }}.git"
+          branch="release/sync-repository-version-v${VERSION}"
+          head_ref="${{ github.repository_owner }}:${branch}"
+          title="chore(release): sync repository version to ${VERSION} [skip release publish]"
+          body_file="$(mktemp)"
+          trap 'rm -f "$body_file"' EXIT
+          cat > "$body_file" <<EOF
+          ## Summary
+          - sync repository version files to ${VERSION} after publish
+          - keep repo-visible version metadata aligned with the released package artifacts
+
+          ## Testing
+          - \`python3 scripts/sync_repo_version.py --version "${VERSION}"\`
+          EOF
+          git checkout -B "$branch"
           git add pyproject.toml src/codex_plugin_scanner/version.py uv.lock
+          changed_files="$(git diff --cached --name-only)"
+          unexpected_files="$(printf '%s\n' "$changed_files" | rg -vx 'pyproject.toml|src/codex_plugin_scanner/version.py|uv.lock' || true)"
+          if [[ -n "$unexpected_files" ]]; then
+            echo "Unexpected files staged for repository version sync:" >&2
+            printf '%s\n' "$unexpected_files" >&2
+            exit 1
+          fi
           git commit -m "chore(release): sync repository version to ${VERSION} [skip release publish]"
-          git pull --rebase origin main
-          git push origin HEAD:main
+          git push --force-with-lease --set-upstream origin "$branch"
+          head_sha="$(git rev-parse HEAD)"
+          pr_number="$(gh pr list --repo ${{ github.repository }} --base main --head "$head_ref" --state open --json number --jq '.[0].number // empty')"
+          if [[ -n "$pr_number" ]]; then
+            gh pr edit "$pr_number" --repo ${{ github.repository }} --title "$title" --body-file "$body_file"
+          else
+            gh pr create --repo ${{ github.repository }} --base main --head "$head_ref" --title "$title" --body-file "$body_file"
+            pr_number="$(gh pr list --repo ${{ github.repository }} --base main --head "$head_ref" --state open --json number --jq '.[0].number // empty')"
+          fi
+          if [[ -z "$pr_number" ]]; then
+            echo "Failed to create or locate repository version sync PR." >&2
+            exit 1
+          fi
+          if [[ "$(gh api repos/${{ github.repository }} --jq .allow_auto_merge)" != "true" ]]; then
+            echo "Repository auto-merge is disabled; leaving PR #${pr_number} open for manual merge after checks." >&2
+            exit 1
+          fi
+          gh pr merge "$pr_number" --repo ${{ github.repository }} --auto --squash --delete-branch --match-head-commit "$head_sha" --subject "chore(release): sync repository version to ${VERSION} [skip release publish]" --body ""

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.846
+Version: 2.0.848
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.846"
+version = "2.0.848"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.846"
+version = "2.0.848"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/adapters/base.py

@@ -105,7 +105,7 @@ class HarnessAdapter:
     legacy_launcher_names: tuple[str, ...] = ()
     approval_tier = "approval-center"
     approval_summary = "Guard pauses the launch and routes approval through the local approval center."
-    fallback_hint = "Use `hol-guard approvals` if you want to resolve it from the terminal."
+    fallback_hint = "Use the Guard approval center or native harness prompt to resolve pending requests."
     approval_prompt_channel = "browser"
     approval_auto_open_browser = True
 

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/adapters/cursor_hooks.py

@@ -1025,7 +1025,7 @@ def main() -> int:
                     "permission": "deny",
                     "user_message": (
                         f"HOL Guard hook timed out after {GUARD_HOOK_TIMEOUT_SECONDS}s. "
-                        "Run `hol-guard status`, approve pending requests, then retry."
+                        "Open the Guard approval center or native Cursor prompt, resolve pending requests, then retry."
                     ),
                 }
             )

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/adapters/grok.py

@@ -66,7 +66,7 @@ class GrokHarnessAdapter(HarnessAdapter):
     )
     fallback_hint = (
         "Grok receives plain-language allow or deny responses from Guard hooks. "
-        "Use `hol-guard approvals` if you want to resolve pending requests from the terminal."
+        "Use the Guard approval center when native prompting is unavailable."
     )
 
     @staticmethod

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/adapters/hermes.py

@@ -205,7 +205,7 @@ class HermesHarnessAdapter(HarnessAdapter):
         return {
             "tier": "approval-center",
             "summary": "Guard keeps Hermes approvals in the local approval center without forcing a browser open.",
-            "fallback_hint": "Resolve pending Hermes requests from the Guard approval center or `hol-guard approvals`.",
+            "fallback_hint": "Resolve pending Hermes requests from the Guard approval center.",
             "prompt_channel": "native-fallback",
             "auto_open_browser": False,
         }

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/adapters/openclaw.py

@@ -220,9 +220,7 @@ class OpenClawHarnessAdapter(HarnessAdapter):
         return {
             "tier": "approval-center",
             "summary": "Guard keeps OpenClaw approvals in the local approval center without forcing a browser open.",
-            "fallback_hint": (
-                "Resolve pending OpenClaw requests from the Guard approval center or `hol-guard approvals`."
-            ),
+            "fallback_hint": "Resolve pending OpenClaw requests from the Guard approval center.",
             "prompt_channel": "native-fallback",
             "auto_open_browser": False,
         }

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/adapters/zcode.py

@@ -70,7 +70,7 @@ class ZCodeHarnessAdapter(HarnessAdapter):
     )
     fallback_hint = (
         "ZCode gets preflight approval through Guard until it exposes a richer native approval surface. "
-        "Use `hol-guard approvals` to resolve pending requests from the terminal."
+        "Use the Guard approval center when native prompting is unavailable."
     )
 
     @staticmethod

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/cli/approval_commands.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import os
 import urllib.parse
 import webbrowser
 from datetime import datetime, timezone
@@ -14,6 +15,7 @@ from ..approvals import apply_approval_resolution, build_runtime_snapshot
 from ..codex_resume import retry_request_resume
 from ..config import load_guard_config
 from ..daemon import load_guard_daemon_url
+from ..runtime.self_approval import SELF_APPROVAL_REASON, approval_resolution_invoked_from_agent
 from ..runtime.surface_server import GuardSurfaceRuntime
 from ..store import GuardStore
 from .approval_gate_prompt import approval_gate_cli_payload, prompt_for_approval_gate
@@ -222,6 +224,14 @@ def run_approval_command(
             "cooldown_expires_at": gate.cooldown_expires_at,
             "exit_code": 0,
         }
+    if command in {"approve", "deny"} and approval_resolution_invoked_from_agent(os.environ):
+        return {
+            "resolved": False,
+            "error": "approval_cli_blocked_in_agent_context",
+            "message": SELF_APPROVAL_REASON,
+            "next_action": "Open the original Guard request in the local approval center or native harness prompt.",
+            "exit_code": 4,
+        }
     try:
         gate_input = (
             prompt_for_approval_gate(store.guard_home)

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/guard/runtime/secret_file_requests.py

@@ -32,6 +32,11 @@ from .false_positive_rules import (
 from .secret_sensitivity import SecretPathMatch as SensitivePathMatch
 from .secret_sensitivity import classify_secret_path
 from .sed_scripts import sed_script_is_bounded_print
+from .self_approval import (
+    SELF_APPROVAL_ACTION_CLASS,
+    SELF_APPROVAL_REASON,
+    is_guard_approval_mutation_command,
+)
 from .shell_command_wrappers import normalize_transparent_shell_command
 
 _FILE_READ_TOOL_NAMES = frozenset(
@@ -859,6 +864,14 @@ def _destructive_shell_tool_action_request(
 ) -> ToolActionRequestMatch | None:
     if normalized_tool_name not in _SHELL_TOOL_NAMES:
         return None
+    if is_guard_approval_mutation_command(command_text):
+        return ToolActionRequestMatch(
+            tool_name=tool_name,
+            normalized_tool_name=normalized_tool_name,
+            command_text=command_text,
+            action_class=SELF_APPROVAL_ACTION_CLASS,
+            reason=SELF_APPROVAL_REASON,
+        )
     if _contains_encoded_or_encrypted_shell_command(command_text, cwd=cwd, home_dir=home_dir):
         return ToolActionRequestMatch(
             tool_name=tool_name,

plugin_scanner-2.0.848/src/codex_plugin_scanner/guard/runtime/self_approval.py

@@ -0,0 +1,216 @@
+"""Detect Guard approval mutation attempts from agent-controlled shells."""
+
+from __future__ import annotations
+
+import os
+import shlex
+from collections.abc import Mapping
+from pathlib import Path
+
+SELF_APPROVAL_ACTION_CLASS = "Guard approval self-authorization command"
+SELF_APPROVAL_REASON = (
+    "Guard blocks AI agents from approving or weakening Guard approval state from inside a protected shell. "
+    "Review the original request in the local approval center or native harness prompt."
+)
+
+_APPROVAL_ROOTS = frozenset({"approvals", "requests"})
+_APPROVAL_MUTATION_COMMANDS = frozenset({"approve", "allow", "deny", "block", "clear-history", "unlock"})
+_GUARD_BINARIES = frozenset({"hol-guard", "plugin-guard"})
+_PYTHON_MODULES = frozenset({"codex_plugin_scanner", "codex_plugin_scanner.cli"})
+_PYTHON_OPTIONS_WITH_VALUES = frozenset({"-W", "-X", "--check-hash-based-pycs"})
+_RUN_WRAPPERS = frozenset({"hatch", "mise", "nix", "pipx", "poetry", "uv", "uvx"})
+_SHELL_SEPARATORS = frozenset({";", "&&", "||", "|", "|&", "&"})
+_AGENT_ENV_MARKERS = frozenset(
+    {
+        "HOL_GUARD_HOOK_ARGV",
+        "HOL_GUARD_MANAGED_CURSOR_HOOK",
+        "HOL_GUARD_CURSOR_APPROVAL_BINDING",
+        "HOL_GUARD_CURSOR_AFTER_SHELL_PROOF",
+        "CURSOR_SESSION_ID",
+        "CURSOR_TRACE_ID",
+        "CURSOR_TRANSCRIPT_PATH",
+        "CLAUDECODE",
+        "OPENCODE_CONFIG_CONTENT",
+        "CODEX_SANDBOX",
+    }
+)
+
+
+def is_guard_approval_mutation_command(command_text: str) -> bool:
+    """Return True for commands that let an agent mutate Guard approval state."""
+
+    parts = _split_shell_parts(command_text)
+    if not parts:
+        return False
+    return any(_segment_is_guard_approval_mutation(segment) for segment in _shell_segments(parts))
+
+
+def approval_resolution_invoked_from_agent(env: Mapping[str, str] | None = None) -> bool:
+    """Detect known AI harness hook contexts for approval CLI mutation defense-in-depth."""
+
+    source = env if env is not None else os.environ
+    return any(str(source.get(key) or "").strip() for key in _AGENT_ENV_MARKERS)
+
+
+def _split_shell_parts(command_text: str) -> list[str]:
+    try:
+        lexer = shlex.shlex(command_text.replace("\n", " ; "), posix=True, punctuation_chars=";&|")
+        lexer.whitespace_split = True
+        return list(lexer)
+    except ValueError:
+        return command_text.split()
+
+
+def _shell_segments(parts: list[str]) -> list[list[str]]:
+    segments: list[list[str]] = []
+    current: list[str] = []
+    for part in parts:
+        if part in _SHELL_SEPARATORS:
+            if current:
+                segments.append(current)
+                current = []
+            continue
+        current.append(part)
+    if current:
+        segments.append(current)
+    return segments
+
+
+def _segment_is_guard_approval_mutation(segment: list[str], *, depth: int = 0) -> bool:
+    if depth > 3:
+        return False
+    index = _first_executable_index(segment)
+    if index is None:
+        return False
+    command_name = Path(segment[index]).name.lower()
+    if command_name in _GUARD_BINARIES:
+        return _guard_args_mutate_approvals(segment[index + 1 :])
+    if _is_python_interpreter(command_name):
+        return _python_module_args_mutate_approvals(segment[index + 1 :])
+    wrapper_tail = _runner_wrapper_tail(command_name, segment[index + 1 :])
+    if wrapper_tail is not None:
+        return _segment_is_guard_approval_mutation(wrapper_tail, depth=depth + 1)
+    return False
+
+
+def _first_executable_index(segment: list[str]) -> int | None:
+    for index, token in enumerate(segment):
+        if not token or _looks_env_assignment(token):
+            continue
+        return index
+    return None
+
+
+def _looks_env_assignment(token: str) -> bool:
+    name, separator, _ = token.partition("=")
+    if separator != "=" or not name:
+        return False
+    if name.endswith("+"):
+        name = name[:-1]
+    return (
+        bool(name)
+        and (name[0].isalpha() or name[0] == "_")
+        and all(character.isalnum() or character == "_" for character in name[1:])
+    )
+
+
+def _is_python_interpreter(command_name: str) -> bool:
+    return command_name in {"python", "py"} or command_name.startswith("python") or command_name.startswith("py3")
+
+
+def _python_module_args_mutate_approvals(args: list[str]) -> bool:
+    index = 0
+    while index < len(args):
+        token = args[index]
+        if token == "-m" and index + 1 < len(args):
+            module_name = args[index + 1].strip()
+            if module_name in _PYTHON_MODULES:
+                return _guard_args_mutate_approvals(args[index + 2 :])
+            return False
+        if token == "-c":
+            return False
+        if token in _PYTHON_OPTIONS_WITH_VALUES:
+            index += 2
+            continue
+        if any(token.startswith(f"{option}=") for option in _PYTHON_OPTIONS_WITH_VALUES):
+            index += 1
+            continue
+        if token.startswith("-"):
+            index += 1
+            continue
+        return False
+    return False
+
+
+def _runner_wrapper_tail(command_name: str, args: list[str]) -> list[str] | None:
+    if command_name not in _RUN_WRAPPERS:
+        return None
+    if command_name == "uv":
+        if args and args[0] == "tool":
+            return _tail_after_subcommand(args[1:], {"run"})
+        return _tail_after_subcommand(args, {"run"})
+    if command_name == "uvx":
+        return args
+    if command_name in {"pipx", "poetry", "hatch"}:
+        return _tail_after_subcommand(args, {"run"})
+    if command_name == "mise":
+        return _tail_after_subcommand(args, {"exec"})
+    if command_name == "nix":
+        return _tail_after_flag(args, "--command")
+    return None
+
+
+def _tail_after_subcommand(args: list[str], subcommands: set[str]) -> list[str] | None:
+    for index, token in enumerate(args):
+        if token == "--":
+            break
+        if token in subcommands:
+            tail = args[index + 1 :]
+            if tail and tail[0] == "--":
+                tail = tail[1:]
+            return tail
+    return None
+
+
+def _tail_after_flag(args: list[str], flag: str) -> list[str] | None:
+    for index, token in enumerate(args):
+        if token == flag:
+            remaining = args[index + 1 :]
+            if not remaining:
+                return []
+            try:
+                return shlex.split(" ".join(remaining))
+            except ValueError:
+                return remaining
+        if token.startswith(f"{flag}="):
+            try:
+                return shlex.split(token.split("=", 1)[1])
+            except ValueError:
+                return []
+    return None
+
+
+def _guard_args_mutate_approvals(args: list[str]) -> bool:
+    if args and args[0] == "guard":
+        args = args[1:]
+    for index, token in enumerate(args):
+        if token not in _APPROVAL_ROOTS:
+            continue
+        return _approval_tail_has_mutation(args[index + 1 :])
+    return False
+
+
+def _approval_tail_has_mutation(args: list[str]) -> bool:
+    for token in args:
+        if token.startswith("-"):
+            continue
+        return token in _APPROVAL_MUTATION_COMMANDS
+    return False
+
+
+__all__ = [
+    "SELF_APPROVAL_ACTION_CLASS",
+    "SELF_APPROVAL_REASON",
+    "approval_resolution_invoked_from_agent",
+    "is_guard_approval_mutation_command",
+]

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.846"
+__version__ = "2.0.848"

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/tests/test_guard_approval_gate.py

@@ -542,6 +542,32 @@ def test_approval_gate_cli_noninteractive_fails_closed(tmp_path: Path, monkeypat
     assert store.get_approval_request("req-cli")["status"] == "pending"
 
 
+def test_approval_cli_refuses_agent_managed_self_authorization(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = _store(tmp_path)
+    _add_request(store, "req-agent-cli")
+    monkeypatch.setenv("HOL_GUARD_HOOK_ARGV", "codex-pretool")
+
+    payload = run_approval_command(
+        SimpleNamespace(
+            approvals_command="approve",
+            request_id="req-agent-cli",
+            approval_action="allow",
+            scope="artifact",
+            reason=None,
+        ),
+        store=store,
+        workspace=None,
+    )
+
+    assert payload["resolved"] is False
+    assert payload["error"] == "approval_cli_blocked_in_agent_context"
+    assert payload["exit_code"] == 4
+    assert store.get_approval_request("req-agent-cli")["status"] == "pending"
+
+
 def test_approval_gate_cli_noninteractive_uses_active_cooldown(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/tests/test_guard_risk.py

@@ -2950,6 +2950,72 @@ def test_tool_action_request_classifier_does_not_promote_echoed_interpreter_text
     assert request is None
 
 
+def test_tool_action_request_classifier_blocks_guard_approval_self_authorization():
+    request = extract_sensitive_tool_action_request(
+        "bash",
+        {"command": "cd app && hol-guard approvals approve req-123 --scope global"},
+    )
+
+    assert request is not None
+    assert request.action_class == "Guard approval self-authorization command"
+    assert "AI agents" in request.reason
+
+
+def test_tool_action_request_classifier_blocks_python_module_guard_approval_mutation():
+    request = extract_sensitive_tool_action_request(
+        "bash",
+        {"command": "python3 -m codex_plugin_scanner.cli guard approvals deny req-123"},
+    )
+
+    assert request is not None
+    assert request.action_class == "Guard approval self-authorization command"
+
+
+def test_tool_action_request_classifier_blocks_runner_wrapped_guard_approval_mutation():
+    request = extract_sensitive_tool_action_request(
+        "bash",
+        {"command": "uv run hol-guard approvals approve req-123"},
+    )
+
+    assert request is not None
+    assert request.action_class == "Guard approval self-authorization command"
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "poetry -C project run hol-guard approvals approve req-123",
+        "nix develop --command 'hol-guard approvals approve req-123'",
+        "py -m codex_plugin_scanner.cli guard approvals approve req-123",
+    ],
+)
+def test_tool_action_request_classifier_blocks_wrapped_guard_approval_variants(command: str):
+    request = extract_sensitive_tool_action_request("bash", {"command": command})
+
+    assert request is not None
+    assert request.action_class == "Guard approval self-authorization command"
+
+
+def test_tool_action_request_classifier_allows_guard_approval_read_only_commands():
+    assert (
+        extract_sensitive_tool_action_request(
+            "bash",
+            {"command": "hol-guard approvals open req-123 && hol-guard --version"},
+        )
+        is None
+    )
+
+
+def test_tool_action_request_classifier_does_not_block_quoted_guard_approval_text():
+    assert (
+        extract_sensitive_tool_action_request(
+            "bash",
+            {"command": "printf '%s\\n' 'hol-guard approvals approve req-123'"},
+        )
+        is None
+    )
+
+
 def test_explicitly_benign_tool_action_request_requires_all_command_variants_to_be_benign():
     assert not is_explicitly_benign_tool_action_request(
         "bash",

{plugin_scanner-2.0.846 → plugin_scanner-2.0.848}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.846"
+version = "2.0.848"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },