plugin-scanner 2.0.855__tar.gz → 2.0.857__tar.gz

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.855
+Version: 2.0.857
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/dashboard/src/guard-update-panel.tsx

@@ -33,6 +33,28 @@ function updateStatusLabel(status: GuardUpdateStatus | null | undefined): string
   return `Version ${status.current_version}`;
 }
 
+function shouldPromptRecoveryReinstall(status: GuardUpdateStatus | null | undefined): boolean {
+  return (
+    status?.recovery_reinstall_available === true &&
+    status?.auto_updatable !== true &&
+    status?.version_check?.update_available === true
+  );
+}
+
+function recoveryReinstallHelpCopy(status: GuardUpdateStatus | null | undefined): string | null {
+  if (!shouldPromptRecoveryReinstall(status)) {
+    return null;
+  }
+  const blockedReason = status?.blocked_reason ?? "";
+  if (blockedReason.includes("local wheel whose source file is no longer available")) {
+    return "This install came from a local wheel whose source file is no longer available, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+  }
+  if (blockedReason.includes("local wheel")) {
+    return "This install came from a local wheel, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+  }
+  return "This install came from a local folder, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+}
+
 function updateHelpCopy(status: GuardUpdateStatus | null | undefined, phase: GuardUpdatePhase): string | null {
   if (phase === "updating") {
     return "Guard is installing the update. The dashboard will pause briefly and reopen when ready.";
@@ -55,9 +77,8 @@ function updateHelpCopy(status: GuardUpdateStatus | null | undefined, phase: Gua
   if (status?.update_available) {
     return "This restarts Guard for a moment. Open approvals will stay saved.";
   }
-  // Recovery case gets calmer copy that frames the fix instead of the dead end.
   if (status && !status.auto_updatable && status.recovery_reinstall_available) {
-    return "This install came from a local folder, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+    return recoveryReinstallHelpCopy(status);
   }
   if (status && !status.auto_updatable && status.blocked_reason) {
     return status.blocked_reason;
@@ -75,11 +96,7 @@ export function GuardUpdatePanel(props: GuardUpdatePanelProps) {
     props.updateStatus.update_suppressed !== true &&
     phase !== "updating" &&
     phase !== "reconnecting";
-  const showReinstallButton =
-    props.updateStatus?.recovery_reinstall_available === true &&
-    props.updateStatus.auto_updatable !== true &&
-    phase !== "updating" &&
-    phase !== "reconnecting";
+  const showReinstallButton = shouldPromptRecoveryReinstall(props.updateStatus) && phase !== "updating" && phase !== "reconnecting";
   const busy = phase === "updating" || phase === "reconnecting";
 
   return (

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/dashboard/src/guard-update.test.ts

@@ -1,4 +1,8 @@
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+
 import { buildGuardDaemonCandidatePorts, normalizeGuardUpdateStatus, updateReconnectSucceeded } from "./guard-api";
+import { GuardUpdatePanel } from "./guard-update-panel";
 
 function assert(condition: boolean, message: string): void {
   if (!condition) {
@@ -55,6 +59,95 @@ assert(
   "recovery_reinstall_command should pass through",
 );
 
+const currentLocalWheelMarkup = renderToStaticMarkup(
+  createElement(GuardUpdatePanel, {
+    updateStatus: normalizeGuardUpdateStatus({
+      current_version: "2.0.855",
+      latest_version: "2.0.855",
+      auto_updatable: false,
+      update_available: false,
+      version_check: {
+        source: "pypi",
+        status: "current",
+        current_version: "2.0.855",
+        latest_version: "2.0.855",
+        update_available: false,
+      },
+      blocked_reason:
+        "This install was set up from a local wheel. Re-run `hol-guard update --wheel <wheel-or-directory>` or your usual local install command instead.",
+      recovery_reinstall_available: true,
+    }),
+    onReinstallGuard: () => undefined,
+  }),
+);
+
+assert(
+  !currentLocalWheelMarkup.includes("Reinstall from PyPI"),
+  "current local wheel installs should not keep showing the PyPI recovery CTA",
+);
+assert(
+  !currentLocalWheelMarkup.includes("automatic updates are off"),
+  "current local wheel installs should not keep showing the recovery warning",
+);
+
+const staleLocalWheelMarkup = renderToStaticMarkup(
+  createElement(GuardUpdatePanel, {
+    updateStatus: normalizeGuardUpdateStatus({
+      current_version: "2.0.855",
+      latest_version: "2.0.856",
+      auto_updatable: false,
+      update_available: false,
+      version_check: {
+        source: "pypi",
+        status: "stale",
+        current_version: "2.0.855",
+        latest_version: "2.0.856",
+        update_available: true,
+      },
+      blocked_reason:
+        "This install was set up from a local wheel. Re-run `hol-guard update --wheel <wheel-or-directory>` or your usual local install command instead.",
+      recovery_reinstall_available: true,
+    }),
+    onReinstallGuard: () => undefined,
+  }),
+);
+
+assert(
+  staleLocalWheelMarkup.includes("This install came from a local wheel"),
+  "stale local wheel installs should explain the real install source",
+);
+assert(
+  staleLocalWheelMarkup.includes("Reinstall from PyPI"),
+  "stale local wheel installs should keep the PyPI recovery CTA",
+);
+
+const staleLocalFolderMarkup = renderToStaticMarkup(
+  createElement(GuardUpdatePanel, {
+    updateStatus: normalizeGuardUpdateStatus({
+      current_version: "2.0.855",
+      latest_version: "2.0.856",
+      auto_updatable: false,
+      update_available: false,
+      version_check: {
+        source: "pypi",
+        status: "stale",
+        current_version: "2.0.855",
+        latest_version: "2.0.856",
+        update_available: true,
+      },
+      blocked_reason:
+        "This install was set up from a local folder. Re-run your usual local install command instead.",
+      recovery_reinstall_available: true,
+    }),
+    onReinstallGuard: () => undefined,
+  }),
+);
+
+assert(
+  staleLocalFolderMarkup.includes("This install came from a local folder"),
+  "stale local folder installs should keep the folder-specific recovery copy",
+);
+
 const noRecovery = normalizeGuardUpdateStatus({
   auto_updatable: false,
   update_available: false,

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.855"
+version = "2.0.857"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.855"
+version = "2.0.857"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -16978,6 +16978,22 @@ function updateStatusLabel(status) {
   }
   return `Version ${status.current_version}`;
 }
+function shouldPromptRecoveryReinstall(status) {
+  return status?.recovery_reinstall_available === true && status?.auto_updatable !== true && status?.version_check?.update_available === true;
+}
+function recoveryReinstallHelpCopy(status) {
+  if (!shouldPromptRecoveryReinstall(status)) {
+    return null;
+  }
+  const blockedReason = status?.blocked_reason ?? "";
+  if (blockedReason.includes("local wheel whose source file is no longer available")) {
+    return "This install came from a local wheel whose source file is no longer available, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+  }
+  if (blockedReason.includes("local wheel")) {
+    return "This install came from a local wheel, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+  }
+  return "This install came from a local folder, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+}
 function updateHelpCopy(status, phase) {
   if (phase === "updating") {
     return "Guard is installing the update. The dashboard will pause briefly and reopen when ready.";
@@ -17001,7 +17017,7 @@ function updateHelpCopy(status, phase) {
     return "This restarts Guard for a moment. Open approvals will stay saved.";
   }
   if (status && !status.auto_updatable && status.recovery_reinstall_available) {
-    return "This install came from a local folder, so automatic updates are off. Reinstall from PyPI to switch it back to a normal package; Guard restarts briefly and saved approvals stay.";
+    return recoveryReinstallHelpCopy(status);
   }
   if (status && !status.auto_updatable && status.blocked_reason) {
     return status.blocked_reason;
@@ -17013,7 +17029,7 @@ function GuardUpdatePanel(props) {
   const phase = props.updatePhase ?? "idle";
   const helpCopy = updateHelpCopy(props.updateStatus, phase);
   const showUpdateButton = props.updateStatus?.update_available === true && props.updateStatus.auto_updatable && props.updateStatus.update_suppressed !== true && phase !== "updating" && phase !== "reconnecting";
-  const showReinstallButton = props.updateStatus?.recovery_reinstall_available === true && props.updateStatus.auto_updatable !== true && phase !== "updating" && phase !== "reconnecting";
+  const showReinstallButton = shouldPromptRecoveryReinstall(props.updateStatus) && phase !== "updating" && phase !== "reconnecting";
   const busy = phase === "updating" || phase === "reconnecting";
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: props.compact ? "space-y-1" : "space-y-2", children: [
     version ? /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "font-mono text-[10px] text-brand-dark/60", "aria-label": `Guard version ${version}`, children: [

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/src/codex_plugin_scanner/guard/store.py

@@ -19,7 +19,10 @@ from .store_oauth import StoreOAuthConnectMixin
 from .store_policy import StorePolicyMixin
 from .store_policy_integrity_runtime import StorePolicyIntegrityAdminMixin
 from .store_receipts import StoreReceiptsRuntimeMixin
-from .store_secret_policy_integrity import StoreSecretPolicyIntegrityMixin
+from .store_secret_policy_integrity import (
+    StoreSecretPolicyIntegrityMixin,
+    _POLICY_INTEGRITY_LOOKUP_UNSET,
+)
 from .store_sessions import StoreSessionsMixin
 
 

{plugin_scanner-2.0.855 → plugin_scanner-2.0.857}/src/codex_plugin_scanner/guard/store_connection_schema.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 
 # ruff: noqa: F403,F405
 from .store_base import *
+from .store_secret_policy_integrity import _POLICY_INTEGRITY_LOOKUP_UNSET
 
 
 def _facade_store_attr(name: str, fallback: object) -> object:
@@ -42,6 +43,14 @@ def _sleep_compat(seconds: float) -> None:
 
 
 class StoreConnectionSchemaMixin:
+    _startup_prefetched_policy_integrity_secret_material: object | tuple[bytes | None, str | None] = (
+        _POLICY_INTEGRITY_LOOKUP_UNSET
+    )
+    _startup_prefetched_policy_integrity_trusted_state: object | dict[str, object] | None = (
+        _POLICY_INTEGRITY_LOOKUP_UNSET
+    )
+    _startup_prefetched_policy_integrity_repair_failed = False
+
     @contextmanager
     def _connect(self) -> Iterator[sqlite3.Connection]:
         connection = sqlite3.connect(self.path, timeout=SQLITE_CONNECT_TIMEOUT_SECONDS)
@@ -524,7 +533,22 @@ class StoreConnectionSchemaMixin:
                 self._record_schema_version(connection, version=2)
             self._enable_wal_mode(connection)
             self._repair_store_permissions()
-            self._refresh_policy_integrity_state(connection, now=_now(), create_key=False)
+        # Prime policy-integrity secrets outside the SQLite transaction. Some
+        # credential-store lookups can block long enough to stall other Guard
+        # processes if initialization still holds the writer lock.
+        self._startup_prefetched_policy_integrity_secret_material = self._policy_integrity_secret_material(create=False)
+        self._startup_prefetched_policy_integrity_trusted_state = self._load_policy_integrity_control_state(
+            create=False
+        )
+        self._startup_prefetched_policy_integrity_repair_failed = False
+        self._prepare_startup_prefetched_policy_integrity_state()
+        try:
+            with self._connect() as connection:
+                self._refresh_policy_integrity_state(connection, now=_now(), create_key=False)
+        finally:
+            self._startup_prefetched_policy_integrity_secret_material = _POLICY_INTEGRITY_LOOKUP_UNSET
+            self._startup_prefetched_policy_integrity_trusted_state = _POLICY_INTEGRITY_LOOKUP_UNSET
+            self._startup_prefetched_policy_integrity_repair_failed = False
 
     @staticmethod
     def _enable_wal_mode(connection: sqlite3.Connection) -> None: