plugin-scanner 2.0.909__tar.gz → 2.0.911__tar.gz

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.909
+Version: 2.0.911
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/github-issue-link.test.ts && tsx src/shell-footer.test.ts && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test": "tsx src/github-issue-link.test.ts && tsx src/shell-footer.test.ts && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts && tsx src/consolidated-evidence-alert.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

plugin_scanner-2.0.911/dashboard/src/consolidated-evidence-alert.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "node:test";
+import { strict as assert } from "node:assert";
+import { renderToString } from "react-dom/server";
+import { createElement } from "react";
+import { ConsolidatedEvidenceAlert, type EvidenceItem } from "./consolidated-evidence-alert";
+
+function makeItem(id: string, title: string, content?: string): EvidenceItem {
+  return {
+    id,
+    title,
+    tone: "blue",
+    content: content ? createElement("p", null, content) : null,
+  };
+}
+
+describe("ConsolidatedEvidenceAlert", () => {
+  it("returns null for empty items", () => {
+    const html = renderToString(createElement(ConsolidatedEvidenceAlert, { items: [] }));
+    assert.ok(html.includes("<!-- -->") || html === "<!-- -->" || html.trim() === "");
+  });
+
+  it("renders single item without Next button", () => {
+    const items = [makeItem("scanner", "Scanner evidence", "Found 2 signals")];
+    const html = renderToString(createElement(ConsolidatedEvidenceAlert, { items }));
+    assert.ok(html.includes("Scanner evidence"));
+    assert.ok(html.includes("Found 2 signals"));
+    assert.ok(!html.includes("Next"));
+    assert.ok(!html.includes("1 of 1"));
+  });
+
+  it("renders multiple items with Next button and counter", () => {
+    const items = [
+      makeItem("scanner", "Scanner evidence", "Signals found"),
+      makeItem("data-flow", "Data flow detected", "Source to sink"),
+    ];
+    const html = renderToString(createElement(ConsolidatedEvidenceAlert, { items }));
+    assert.ok(html.includes("Scanner evidence"));
+    assert.ok(html.includes("Next"));
+    assert.ok(/1.*of.*2/.test(html));
+  });
+
+  it("renders only the first item initially", () => {
+    const items = [
+      makeItem("scanner", "Scanner evidence", "First content"),
+      makeItem("data-flow", "Data flow detected", "Second content"),
+    ];
+    const html = renderToString(createElement(ConsolidatedEvidenceAlert, { items }));
+    assert.ok(html.includes("First content"));
+    assert.ok(!html.includes("Second content"));
+  });
+});

plugin_scanner-2.0.911/dashboard/src/consolidated-evidence-alert.tsx

@@ -0,0 +1,77 @@
+import { useCallback, useEffect, useState, type ReactNode } from "react";
+import { HiMiniChevronRight, HiMiniInformationCircle } from "react-icons/hi2";
+
+export interface EvidenceItem {
+  id: string;
+  title: string;
+  tone: "blue" | "purple" | "amber" | "slate";
+  content: ReactNode;
+}
+
+/**
+ * Consolidates multiple evidence cards into a single alert with a Next button.
+ * The caller must pre-filter to non-empty items — this component renders all
+ * items it receives.
+ */
+export function ConsolidatedEvidenceAlert({ items }: { items: EvidenceItem[] }) {
+  const [index, setIndex] = useState(0);
+
+  useEffect(() => {
+    if (index >= items.length) {
+      setIndex(0);
+    }
+  }, [items.length, index]);
+
+  const handleNext = useCallback(() => {
+    setIndex((prev) => (prev + 1) % items.length);
+  }, [items.length]);
+
+  if (items.length === 0) return null;
+
+  const current = items[Math.min(index, items.length - 1)];
+  const hasMultiple = items.length > 1;
+
+  const iconClasses: Record<EvidenceItem["tone"], string> = {
+    blue: "text-brand-blue",
+    purple: "text-brand-purple",
+    amber: "text-brand-attention",
+    slate: "text-slate-400",
+  };
+
+  return (
+    <div className="space-y-2">
+      <div className="flex items-start justify-between gap-3">
+        <div className="flex items-start gap-2.5 min-w-0 flex-1">
+          <HiMiniInformationCircle
+            className={`mt-0.5 h-4 w-4 shrink-0 ${iconClasses[current.tone]}`}
+            aria-hidden="true"
+          />
+          <div className="min-w-0 flex-1">
+            <p className="text-xs font-semibold uppercase tracking-[0.16em] text-muted-foreground">
+              {current.title}
+            </p>
+          </div>
+        </div>
+        {hasMultiple && (
+          <div className="flex items-center gap-2 shrink-0">
+            <span className="text-xs font-medium text-muted-foreground tabular-nums">
+              {index + 1} of {items.length}
+            </span>
+            <button
+              type="button"
+              onClick={handleNext}
+              className="flex items-center gap-1 rounded-lg border border-slate-200 px-2.5 py-1 text-xs font-medium text-brand-dark transition-colors hover:bg-slate-50 focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+              aria-label="Next insight"
+            >
+              Next
+              <HiMiniChevronRight className="h-3.5 w-3.5" aria-hidden="true" />
+            </button>
+          </div>
+        )}
+      </div>
+      <div className="text-sm text-brand-dark">
+        {current.content}
+      </div>
+    </div>
+  );
+}

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/dashboard/src/policy-strict-config-tab.tsx

@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
-import type { ChangeEvent } from "react";
+import type { ChangeEvent, ReactNode } from "react";
 import { EmptyState } from "./approval-center-primitives";
 import { fetchSettings, updateSettings } from "./guard-api";
 import type { GuardRuntimeSnapshot, GuardSettings } from "./guard-types";
@@ -21,6 +21,23 @@ import {
 } from "./policy-strict-config-utils";
 import { formatPolicyDateTime, resolveCloudPolicyBundleCopy } from "./policy-workspace-helpers";
 
+function isUnauthorizedError(error: string): boolean {
+  return /HTTP Error 401|unauthorized/i.test(error.trim());
+}
+
+function humanizeStrictConfigError(error: string): { title: string; body: string } {
+  if (isUnauthorizedError(error)) {
+    return {
+      title: "Guard Cloud authorization expired",
+      body: "Local remembered rules and strict config still apply on this device. Run connect again to refresh signed access.",
+    };
+  }
+  return {
+    title: "Could not load strict config",
+    body: error || "Try again from Settings if the daemon is unavailable.",
+  };
+}
+
 type PolicyStrictConfigTabProps = {
   snapshot: GuardRuntimeSnapshot;
   cloudControlsUrl?: string | null;
@@ -198,10 +215,20 @@ export function PolicyStrictConfigTab({
   }
 
   if (loadState === "error" || !settings) {
+    const is401 = loadError !== null && isUnauthorizedError(loadError);
+    const humanized = loadError !== null ? humanizeStrictConfigError(loadError) : { title: "Could not load strict config", body: "Try again from Settings if the daemon is unavailable." };
     return (
       <EmptyState
-        title="Could not load strict config"
-        body={loadError ?? "Try again from Settings if the daemon is unavailable."}
+        title={humanized.title}
+        body={humanized.body}
+        action={is401 && cloudControlsUrl ? (
+          <a
+            href={cloudControlsUrl}
+            className="inline-flex items-center gap-2 rounded-xl bg-brand-blue px-4 py-2.5 text-sm font-semibold text-white transition-colors hover:bg-brand-blue/90 focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+          >
+            Connect Guard Cloud
+          </a>
+        ) : undefined}
       />
     );
   }

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/dashboard/src/review-workspace.tsx

@@ -56,6 +56,13 @@ import {
   normalizeDecisionScope,
   standardScopeChoicesForRequest,
 } from "./approval-scopes";
+import { ConsolidatedEvidenceAlert, type EvidenceItem } from "./consolidated-evidence-alert";
+import {
+  deriveDataFlowEvidence,
+  deriveSkillRiskSignals,
+  deriveSupplyChainRiskSignals,
+  deriveEncodedLayerSignals,
+} from "./approval-center-utils";
 import type {
   GuardApprovalGatePublicConfig,
   GuardApprovalRequest,
@@ -1164,6 +1171,61 @@ function ReviewDecisionCard(props: {
   const hasEvidence = hasReviewEvidence(item);
   const pauseReason = whyPaused(item);
 
+  const evidenceItems: EvidenceItem[] = [];
+  const allSignals = item.decision_v2_json?.signals ?? [];
+  if (allSignals.some((s) => s.category === "skill" || s.category === "mcp")) {
+    evidenceItems.push({
+      id: "scanner",
+      title: "Scanner evidence",
+      tone: "blue",
+      content: <ScannerEvidenceSection signals={allSignals} />,
+    });
+  }
+  if (item.why_now) {
+    evidenceItems.push({
+      id: "why-now",
+      title: "Why now",
+      tone: "purple",
+      content: <p className="text-sm text-brand-dark">{item.why_now}</p>,
+    });
+  }
+  if (deriveDataFlowEvidence(item) !== null) {
+    evidenceItems.push({
+      id: "data-flow",
+      title: "Data flow detected",
+      tone: "blue",
+      content: <DataFlowEvidenceCard item={item} />,
+    });
+  }
+  if (deriveSkillRiskSignals(item).length > 0) {
+    evidenceItems.push({
+      id: "skill-risk",
+      title: "Skill risk",
+      tone: "blue",
+      content: <SkillRiskCard item={item} />,
+    });
+  }
+  const isSupplyChainArtifact =
+    item.artifact_type === "supply_chain" ||
+    item.artifact_type === "package_request" ||
+    (typeof item.artifact_type === "string" && item.artifact_type.endsWith("_package"));
+  if (deriveSupplyChainRiskSignals(item).length > 0 || isSupplyChainArtifact) {
+    evidenceItems.push({
+      id: "supply-chain",
+      title: "Supply chain risk",
+      tone: "amber",
+      content: <SupplyChainRiskCard item={item} />,
+    });
+  }
+  if (deriveEncodedLayerSignals(item).length > 0) {
+    evidenceItems.push({
+      id: "decoded-layer",
+      title: "Decoded layer",
+      tone: "slate",
+      content: <DecodedLayerCard item={item} />,
+    });
+  }
+
   return (
     <div className="space-y-5">
       {resolved && (
@@ -1367,17 +1429,8 @@ function ReviewDecisionCard(props: {
             )}
           </button>
           {showEvidence && (
-            <div className="mt-4 space-y-3">
-              <ScannerEvidenceSection signals={item.decision_v2_json?.signals ?? []} />
-              {item.why_now && (
-                <div className="rounded-xl border border-brand-purple/15 bg-brand-purple/[0.04] p-4">
-                  <p className="text-sm text-brand-dark">{item.why_now}</p>
-                </div>
-              )}
-              <DataFlowEvidenceCard item={item} />
-              <SkillRiskCard item={item} />
-              <SupplyChainRiskCard item={item} />
-              <DecodedLayerCard item={item} />
+            <div className="mt-4">
+              <ConsolidatedEvidenceAlert items={evidenceItems} />
             </div>
           )}
         </div>

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.909"
+version = "2.0.911"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.909"
+version = "2.0.911"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/src/codex_plugin_scanner/guard/approvals.py

@@ -295,6 +295,16 @@ def queue_blocked_approvals(
                 candidate = artifact.metadata.get("command_text")
             if not isinstance(candidate, str) or not candidate.strip():
                 candidate = artifact.command if artifact.command is not None else None
+            if not isinstance(candidate, str) or not candidate.strip():
+                envelope_raw = item.get("action_envelope_json")
+                if isinstance(envelope_raw, str):
+                    try:
+                        import json as _json
+
+                        envelope = _json.loads(envelope_raw)
+                        candidate = envelope.get("command") if isinstance(envelope, dict) else None
+                    except (ValueError, TypeError):
+                        pass
             if isinstance(candidate, str) and candidate.strip():
                 stripped = candidate.strip()
                 if not _is_generic_tool_label(stripped):

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.909"
+__version__ = "2.0.911"

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/tests/test_raw_command_text.py

@@ -330,3 +330,35 @@ class TestRawCommandTextPropagation:
         )
         assert len(queued) == 1
         assert queued[0]["raw_command_text"] is None
+
+    def test_raw_command_text_falls_back_to_action_envelope_command(self, tmp_path):
+        """PreToolUse shell command blocks store command in action_envelope_json,
+        not in artifact metadata. The extraction should parse it as final fallback."""
+        import json as _json
+        store = GuardStore(tmp_path / "guard-home")
+        artifact = GuardArtifact(
+            artifact_id="pi:project:pretool:test",
+            name="bash docker-sensitive command",
+            harness="pi",
+            artifact_type="tool_action_request",
+            source_scope="project",
+            config_path=str(tmp_path / "config.toml"),
+            command=None,
+            metadata={},
+        )
+        detection = _make_detection(artifact, tmp_path)
+        envelope = _json.dumps({"action_type": "shell_command", "command": "docker run --rm alpine cat /etc/passwd"})
+        evaluation = _make_evaluation("pi:project:pretool:test", tmp_path)
+        evaluation["artifacts"][0]["action_envelope_json"] = envelope
+        queued = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1/pending",
+            redaction_level="none",
+        )
+        assert len(queued) == 1
+        raw = queued[0]["raw_command_text"]
+        assert raw is not None
+        assert "docker run" in raw
+        assert "alpine" in raw

{plugin_scanner-2.0.909 → plugin_scanner-2.0.911}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.909"
+version = "2.0.911"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },