plugin-scanner 2.0.887__tar.gz → 2.0.888__tar.gz

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.887
+Version: 2.0.888
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.887"
+version = "2.0.888"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.887"
+version = "2.0.888"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/src/codex_plugin_scanner/guard/cli/commands_support_codex_commands.py

@@ -23,7 +23,11 @@ if TYPE_CHECKING:
     from .commands_support_runtime_artifacts import _codex_command_references_sensitive_local_source
 
 
-from ..runtime.secret_file_requests import COMMAND_LIST_KEYS
+from ..runtime.secret_file_requests import (
+    COMMAND_CANDIDATE_LIST_KEYS,
+    COMMAND_SEQUENCE_KEYS,
+    command_list_candidate_texts,
+)
 from ._commands_shared import *
 from .commands_parser_helpers import *
 from .commands_support_codex_tool_output import (
@@ -156,26 +160,35 @@ def _codex_post_tool_command_is_read_only_source_inspection(
     cwd: Path | None,
     home_dir: Path | None,
 ) -> bool:
-    command_text = _codex_post_tool_command_text(payload)
-    return bool(command_text) and _codex_command_is_read_only_source_inspection(
-        command_text,
-        cwd=cwd,
-        home_dir=home_dir,
+    command_texts = _codex_post_tool_command_texts(payload)
+    return bool(command_texts) and all(
+        _codex_command_is_read_only_source_inspection(command_text, cwd=cwd, home_dir=home_dir)
+        for command_text in command_texts
     )
 
+
 def _codex_post_tool_command_text(payload: dict[str, object]) -> str:
+    command_texts = _codex_post_tool_command_texts(payload)
+    return command_texts[0] if command_texts else ""
+
+
+def _codex_post_tool_command_texts(payload: dict[str, object]) -> tuple[str, ...]:
     tool_input = payload.get("tool_input")
     if isinstance(tool_input, dict):
+        candidates: list[str] = []
         command = tool_input.get("command")
         if isinstance(command, str):
-            return command.strip()
-        for key in COMMAND_LIST_KEYS:
+            stripped = command.strip()
+            if stripped:
+                candidates.append(stripped)
+        for key in COMMAND_CANDIDATE_LIST_KEYS:
             candidate = tool_input.get(key)
             if isinstance(candidate, list):
-                string_values = [item.strip() for item in candidate if isinstance(item, str) and item.strip()]
-                if string_values:
-                    return shlex.join(string_values)
-    return ""
+                candidates.extend(
+                    command_list_candidate_texts(candidate, preserve_items=key in COMMAND_SEQUENCE_KEYS)
+                )
+        return tuple(dict.fromkeys(text for text in candidates if text))
+    return ()
 
 _CODEX_READ_ONLY_SEARCH_COMMANDS = frozenset({"fd", "rg", "grep", "egrep", "fgrep"})
 

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py

@@ -13,7 +13,7 @@ if TYPE_CHECKING:
         _codex_local_secret_source_label,
         _codex_pipeline_segment_may_read_local_content,
         _codex_post_tool_command_is_read_only_source_inspection,
-        _codex_post_tool_command_text,
+        _codex_post_tool_command_texts,
         _codex_shell_split,
         _codex_source_inspection_can_skip_secret_output,
     )
@@ -42,7 +42,7 @@ from .commands_support_codex_commands import (
     _codex_local_secret_source_label,
     _codex_pipeline_segment_may_read_local_content,
     _codex_post_tool_command_is_read_only_source_inspection,
-    _codex_post_tool_command_text,
+    _codex_post_tool_command_texts,
     _codex_shell_split,
     _codex_source_inspection_can_skip_secret_output,
 )
@@ -347,14 +347,32 @@ def _codex_post_tool_output_artifact(
     if stdout_text:
         response_text = f"{response_text}\n{stdout_text}".strip() if response_text else stdout_text
     tool_name = _coalesce_string(payload.get("tool_name"), "Bash")
-    command_text = _codex_post_tool_command_text(payload)
-    if not command_text:
-        command_text = tool_name
+    command_texts = _codex_post_tool_command_texts(payload)
+    command_text = command_texts[0] if command_texts else tool_name
     local_source_matches = _codex_sensitive_local_source_matches(command_text, cwd=cwd)
     normalized_command = normalize_transparent_shell_command(
         command_text, cwd=cwd, home_dir=home_dir
     ).normalized_command
     kubernetes_secret_source = kubernetes_secret_read_source(normalized_command)
+    for candidate_command_text in command_texts[1:]:
+        candidate_local_source_matches = _codex_sensitive_local_source_matches(candidate_command_text, cwd=cwd)
+        candidate_normalized_command = normalize_transparent_shell_command(
+            candidate_command_text, cwd=cwd, home_dir=home_dir
+        ).normalized_command
+        candidate_kubernetes_secret_source = kubernetes_secret_read_source(candidate_normalized_command)
+        candidate_references_local_content = (
+            bool(candidate_local_source_matches)
+            or candidate_kubernetes_secret_source is not None
+            or _codex_command_may_read_local_content(candidate_command_text, cwd=cwd)
+        )
+        if not candidate_references_local_content:
+            continue
+        command_text = candidate_command_text
+        local_source_matches = candidate_local_source_matches
+        normalized_command = candidate_normalized_command
+        kubernetes_secret_source = candidate_kubernetes_secret_source
+        if candidate_kubernetes_secret_source is not None:
+            break
     sensitive_file_request = extract_sensitive_file_read_request(
         payload.get("tool_name"),
         payload.get("tool_input", payload.get("arguments")),

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/src/codex_plugin_scanner/guard/runtime/secret_file_requests.py

@@ -88,6 +88,8 @@ _SHELL_CONTROL_PREFIX_TOKENS = frozenset(
     {"!", "(", "{", "case", "do", "elif", "else", "for", "if", "select", "then", "until", "while"}
 )
 COMMAND_LIST_KEYS = ("argv", "command_args", "commandArgs")
+COMMAND_SEQUENCE_KEYS = ("commands",)
+COMMAND_CANDIDATE_LIST_KEYS = (*COMMAND_LIST_KEYS, *COMMAND_SEQUENCE_KEYS)
 _COMMAND_LIST_KEYS = COMMAND_LIST_KEYS
 _DOCKER_ALWAYS_SENSITIVE_SUBCOMMANDS = frozenset({"compose", "login", "push", "run"})
 _DOCKER_BUILD_SUBCOMMANDS = frozenset({"build"})
@@ -3519,6 +3521,21 @@ def _candidate_command_texts(value: object) -> list[str]:
     return results
 
 
+def command_list_candidate_texts(
+    values: list[str],
+    *,
+    preserve_items: bool = False,
+) -> tuple[str, ...]:
+    string_values = [item.strip() for item in values if isinstance(item, str) and item.strip()]
+    if not string_values:
+        return ()
+    if preserve_items:
+        return tuple(string_values)
+    if len(string_values) == 1:
+        return (string_values[0],)
+    return (shlex.join(string_values),)
+
+
 def _collect_candidate_commands(value: object, results: list[str], *, depth: int) -> None:
     if depth > 4:
         return
@@ -3528,9 +3545,7 @@ def _collect_candidate_commands(value: object, results: list[str], *, depth: int
             results.append(stripped)
         return
     if isinstance(value, list):
-        string_values = [item.strip() for item in value if isinstance(item, str) and item.strip()]
-        if string_values:
-            results.append(shlex.join(string_values))
+        results.extend(command_list_candidate_texts(value))
         for child in value:
             if isinstance(child, (dict, list)):
                 _collect_candidate_commands(child, results, depth=depth + 1)
@@ -3541,13 +3556,13 @@ def _collect_candidate_commands(value: object, results: list[str], *, depth: int
         candidate = value.get(key)
         if isinstance(candidate, str) and candidate.strip():
             results.append(candidate.strip())
-    for key in _COMMAND_LIST_KEYS:
+    for key in COMMAND_CANDIDATE_LIST_KEYS:
         candidate = value.get(key)
         if isinstance(candidate, list):
-            string_values = [item.strip() for item in candidate if isinstance(item, str) and item.strip()]
-            if string_values:
-                results.append(shlex.join(string_values))
-    for child in value.values():
+            results.extend(command_list_candidate_texts(candidate, preserve_items=key in COMMAND_SEQUENCE_KEYS))
+    for key, child in value.items():
+        if key in COMMAND_CANDIDATE_LIST_KEYS:
+            continue
         if isinstance(child, (dict, list)):
             _collect_candidate_commands(child, results, depth=depth + 1)
 

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.887"
+__version__ = "2.0.888"

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/tests/test_guard_kubernetes_runtime.py

@@ -8,6 +8,9 @@ import sys
 from pathlib import Path
 
 from codex_plugin_scanner.cli import main
+from codex_plugin_scanner.guard.cli.commands_support_codex_commands import (
+    _codex_post_tool_command_is_read_only_source_inspection,
+)
 from codex_plugin_scanner.guard.cli.commands_support_runtime_artifacts import _codex_post_tool_output_artifact
 from codex_plugin_scanner.guard.runtime.kubernetes_commands import kubernetes_secret_read_source
 from codex_plugin_scanner.guard.runtime.secret_file_requests import extract_sensitive_tool_action_request
@@ -104,6 +107,49 @@ def test_kubectl_secret_reads_are_detected_in_command_substitutions(tmp_path: Pa
     )
 
 
+def test_kubectl_secret_reads_are_detected_in_single_item_command_lists(tmp_path: Path) -> None:
+    command = "kubectl get secret prod -o yaml"
+
+    for arguments in (
+        {"commands": [command]},
+        {"command_args": [command]},
+        {"commandArgs": [command]},
+    ):
+        request = extract_sensitive_tool_action_request(
+            "Bash",
+            arguments,
+            cwd=tmp_path,
+            home_dir=tmp_path,
+        )
+
+        assert request is not None
+        assert request.action_class == "Kubernetes secret read command"
+
+
+def test_kubectl_secret_reads_are_detected_in_batched_command_lists(tmp_path: Path) -> None:
+    request = extract_sensitive_tool_action_request(
+        "Bash",
+        {"commands": ["kubectl get secret prod -o yaml", "echo ok"]},
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+    assert request is not None
+    assert request.action_class == "Kubernetes secret read command"
+
+
+def test_kubectl_secret_reads_are_detected_when_later_batched_command_is_sensitive(tmp_path: Path) -> None:
+    request = extract_sensitive_tool_action_request(
+        "Bash",
+        {"commands": ["echo ok", "kubectl get secret prod -o yaml"]},
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+    assert request is not None
+    assert request.action_class == "Kubernetes secret read command"
+
+
 def test_kubectl_exec_shell_expansion_secret_reads_are_detected(tmp_path: Path) -> None:
     command = "kubectl exec registry-frontend -- sh -c 'echo \"$GUARD_GITHUB_APP_PRIVATE_KEY\"'"
 
@@ -325,6 +371,109 @@ def test_pi_post_tool_output_labels_argv_wrapped_kubernetes_secret_source(tmp_pa
     assert artifact.metadata["secret_source_family"] == "Kubernetes Secret resource"
 
 
+def test_pi_post_tool_output_labels_single_item_command_args_kubernetes_secret_source(tmp_path: Path) -> None:
+    artifact = _codex_post_tool_output_artifact(
+        harness="pi",
+        payload={
+            "tool_name": "Bash",
+            "tool_input": {"command_args": ["kubectl get secret prod -o yaml"]},
+            "stdout": "-----BEGIN RSA PRIVATE KEY-----\nMIIE" + ("A" * 64) + "\n-----END RSA PRIVATE KEY-----\n",
+        },
+        config_path="~/.pi/agent/settings.json",
+        source_scope="project",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+    assert artifact is not None
+    assert artifact.metadata["action_class"] == "Kubernetes secret read command"
+    assert artifact.metadata["secret_source_family"] == "Kubernetes Secret resource"
+
+
+def test_pi_post_tool_output_labels_commands_payload_kubernetes_secret_source(tmp_path: Path) -> None:
+    artifact = _codex_post_tool_output_artifact(
+        harness="pi",
+        payload={
+            "tool_name": "Bash",
+            "tool_input": {"commands": ["kubectl get secret prod -o yaml"]},
+            "stdout": "-----BEGIN RSA PRIVATE KEY-----\nMIIE" + ("A" * 64) + "\n-----END RSA PRIVATE KEY-----\n",
+        },
+        config_path="~/.pi/agent/settings.json",
+        source_scope="project",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+    assert artifact is not None
+    assert artifact.metadata["action_class"] == "Kubernetes secret read command"
+    assert artifact.metadata["secret_source_family"] == "Kubernetes Secret resource"
+
+
+def test_pi_post_tool_output_labels_later_commands_payload_kubernetes_secret_source(tmp_path: Path) -> None:
+    artifact = _codex_post_tool_output_artifact(
+        harness="pi",
+        payload={
+            "tool_name": "Bash",
+            "tool_input": {"commands": ["echo ok", "kubectl get secret prod -o yaml"]},
+            "stdout": "-----BEGIN RSA PRIVATE KEY-----\nMIIE" + ("A" * 64) + "\n-----END RSA PRIVATE KEY-----\n",
+        },
+        config_path="~/.pi/agent/settings.json",
+        source_scope="project",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+    assert artifact is not None
+    assert artifact.metadata["action_class"] == "Kubernetes secret read command"
+    assert artifact.metadata["secret_source_family"] == "Kubernetes Secret resource"
+
+
+def test_pi_post_tool_output_keeps_sensitive_batched_command_even_with_read_only_sibling(
+    tmp_path: Path, monkeypatch, capsys
+) -> None:
+    home_dir = tmp_path / "home"
+    guard_home = tmp_path / "guard-home"
+    workspace_dir = tmp_path / "workspace"
+    _write_text(home_dir / "config.toml", "approval_wait_timeout_seconds = 0\n")
+    event = {
+        "hook_event_name": "PostToolUse",
+        "tool_name": "Bash",
+        "tool_input": {"commands": ["kubectl get secret prod -o yaml", "rg foo src"]},
+        "stdout": "ok\n",
+        "source_scope": "project",
+    }
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(event)))
+    rc = main(
+        [
+            "guard",
+            "hook",
+            "--home",
+            str(home_dir),
+            "--guard-home",
+            str(guard_home),
+            "--workspace",
+            str(workspace_dir),
+            "--harness",
+            "pi",
+        ]
+    )
+    output = json.loads(capsys.readouterr().out)
+
+    assert rc == 2
+    assert output["decision"] == "deny"
+    assert "kubernetes secret read command" in output["reason"].lower()
+
+
+def test_read_only_command_batches_stay_read_only_for_post_tool_skip(tmp_path: Path) -> None:
+    payload = {"tool_input": {"commands": ["rg foo src", "grep bar src/app.py"]}}
+
+    assert _codex_post_tool_command_is_read_only_source_inspection(
+        payload=payload,
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+
 def test_pi_post_tool_output_labels_wrapped_kubernetes_secret_source(tmp_path: Path) -> None:
     command = (
         'bash -lc "kubectl exec -n registry-broker registry-frontend-7fb9bf6b46-2fcj8 '

{plugin_scanner-2.0.887 → plugin_scanner-2.0.888}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.887"
+version = "2.0.888"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },