plugin-scanner 2.0.920__tar.gz → 2.0.922__tar.gz

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.920
+Version: 2.0.922
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.920"
+version = "2.0.922"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.920"
+version = "2.0.922"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/adapters/pi_extension_source.py

@@ -103,8 +103,8 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "      return;\n"
         "    }\n"
         "    const record = val as Record<string, unknown>;\n"
-        "    // Match collectOutputText: only extract text from {type: \"text\", text: ...}\n"
-        "    // objects, not from metadata keys like \"type\".\n"
+        '    // Match collectOutputText: only extract text from {type: "text", text: ...}\n'
+        '    // objects, not from metadata keys like "type".\n'
         "    if (record.type === 'text' && typeof record.text === 'string') {\n"
         "      update(record.text);\n"
         "      return;\n"
@@ -144,7 +144,8 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "  event: Record<string, unknown>,\n"
         "  toolInput: Record<string, unknown>,\n"
         "  digest: OutputDigest,\n"
-        "): { version: number; kind: string; path: string; tool_input_path: string; output_sha256: string; output_chars: number } | null {\n"
+        "): { version: number; kind: string; path: string; tool_input_path: string;"
+        " output_sha256: string; output_chars: number } | null {\n"
         "  const toolName = typeof event.toolName === 'string' ? event.toolName : '';\n"
         "  if (!GUARD_SOURCE_REF_ALLOWED_TOOL_NAMES.has(toolName)) return null;\n"
         "  if (!digest.sha256 || digest.traversalTruncated) return null;\n"
@@ -596,7 +597,8 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "    const digest = digestOutputText(event.content);\n"
         "    const boundedContent = boundValue(event.content);\n"
         "    const boundedStdout = boundedOutputText(event.content);\n"
-        "    const outputTruncated = boundedContent.truncated || boundedStdout.truncated || digest.excerptTruncated || digest.traversalTruncated;\n"
+        "    const outputTruncated = boundedContent.truncated || boundedStdout.truncated"
+        " || digest.excerptTruncated || digest.traversalTruncated;\n"
         "    const toolOutput = digest.textForExcerpt || (boundedStdout.value as string);\n"
         "    const reviewedContent = outputTruncated ? [{ type: 'text', text: toolOutput }] : boundedContent.value;\n"
         "    const sourceRef = sourceFileRefForPostToolUse(event as Record<string, unknown>, toolInput, digest);\n"
@@ -639,8 +641,10 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "        return undefined;\n"
         "      }\n"
         "      const notice = response.reason ||\n"
-        '        "HOL Guard returned a reviewed excerpt because this output could not be fully proven safe within local limits.";\n'
-        '      if (response.notice === "excerpt" || response.model_output_action === "replace_with_reviewed_excerpt") {\n'
+        '        "HOL Guard returned a reviewed excerpt because this output could not be fully proven safe'
+        ' within local limits.";\n'
+        '      if (response.notice === "excerpt"'
+        ' || response.model_output_action === "replace_with_reviewed_excerpt") {\n'
         '        ctx.ui.notify(notice, "info");\n'
         "      }\n"
         "      return reviewedToolResult(reviewedContent, event.details, event.isError === true);\n"

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/aibom_cli.py

@@ -442,7 +442,7 @@ def sync_aibom_snapshots(
     synced_at = generated_at
     batches_sent = 0
     for batch_start in range(0, len(events), _AIBOM_SYNC_BATCH_SIZE):
-        batch = events[batch_start:batch_start + _AIBOM_SYNC_BATCH_SIZE]
+        batch = events[batch_start : batch_start + _AIBOM_SYNC_BATCH_SIZE]
         body = json.dumps({"events": batch}).encode("utf-8")
         request = runner._guard_sync_request(
             resolved_auth_context,
@@ -516,7 +516,7 @@ def sync_aibom_snapshots(
             }
             store.set_sync_payload("aibom_sync_summary", failure_summary, synced_at)
             raise RuntimeError("Guard Cloud AIBOM sync failed due to a network error.") from error
-        batches_sent += 1
+        batches_sent += 1  # noqa: SIM113
         batch_accepted = payload.get("accepted")
         if isinstance(batch_accepted, int):
             total_accepted += batch_accepted

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/cli/commands_hook.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
+    from ..runtime.hook_review_types import HookOutputSummary, HookSourceFileRef
     from ._commands_shared import _now, _require_guard_config, _require_guard_context, _require_guard_store
     from .commands_support_claude_approval import _persist_claude_guard_question_decision
     from .commands_support_hook_payload import _hook_action_envelope, _load_hook_payload, _normalize_hook_payload
@@ -279,6 +280,7 @@ def _run_guard_hook_command(
         store=store,
     )
 
+
 def _try_source_ref_fast_path(
     args: argparse.Namespace,
     *,
@@ -304,11 +306,12 @@ def _try_source_ref_fast_path(
     if os.environ.get("HOL_GUARD_HOOK_SOURCE_REF", "1") != "1":
         return None
 
+    from collections.abc import Mapping
+
     from ..runtime.hook_content_scanner import ContentScanner
     from ..runtime.hook_decision_cache import HookDecisionCache
     from ..runtime.hook_review_engine import HookReviewEngine
-    from ..runtime.hook_review_types import HookReviewRequest, HookSourceFileRef, HookOutputSummary
-    from collections.abc import Mapping
+    from ..runtime.hook_review_types import HookReviewRequest
 
     source_ref_raw = payload.get("guard_source_ref")
     if not isinstance(source_ref_raw, Mapping):
@@ -319,7 +322,7 @@ def _try_source_ref_fast_path(
 
     request = HookReviewRequest(
         harness=args.harness,
-        event_name=_hook_event_name(payload),
+        event_name=_hook_event_name(payload) or "PreToolUse",
         payload=payload,
         payload_kind="source_file_ref",
         config_path=None,
@@ -380,6 +383,7 @@ def _parse_output_summary(summary_raw: object) -> HookOutputSummary | None:
     from collections.abc import Mapping as _Mapping
 
     from ..runtime.hook_review_types import HookOutputSummary
+
     if not isinstance(summary_raw, _Mapping):
         return None
     text_excerpt = summary_raw.get("text_excerpt") or summary_raw.get("excerpt") or ""

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/cli/commands_support_codex_paths.py

@@ -8,15 +8,11 @@ from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from .commands_support_codex_commands import (
-        _CODEX_BENIGN_SOURCE_DOTFILES,
         _CODEX_SEARCH_OPTION_VALUE_FLAGS,
         _CODEX_SEARCH_OPTION_VALUE_FLAGS_BY_EXECUTABLE,
         _CODEX_SEARCH_PATTERN_VALUE_FLAGS,
         _CODEX_SEARCH_UNSAFE_FLAGS,
         _CODEX_SEARCH_UNSAFE_SHORT_FLAGS_BY_EXECUTABLE,
-        _CODEX_SENSITIVE_SEARCH_BASENAMES,
-        _CODEX_SOURCE_SEARCH_EXTENSIONS,
-        _CODEX_SOURCE_SEARCH_PREFIXES,
     )
     from .commands_support_codex_reads import _codex_sed_args_are_bounded_filter
     from .commands_support_runtime_artifacts import (

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/config.py

@@ -71,6 +71,7 @@ def hook_fast_path_shadow_enabled() -> bool:
 
     return os.environ.get(HOOK_FAST_PATH_SHADOW_ENV, "0") == "1"
 
+
 VALID_GUARD_ACTIONS = {"allow", "warn", "review", "block", "sandbox-required", "require-reapproval"}
 VALID_GUARD_MODES = {"observe", "prompt", "enforce"}
 VALID_SECURITY_LEVELS = {"relaxed", "gentle", "balanced", "strict", "paranoid", "custom"}

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/daemon/hook_metrics.py

@@ -8,7 +8,6 @@ flushed to SQLite asynchronously via ``maybe_flush_to_store()``.
 from __future__ import annotations
 
 import threading
-import time
 from collections import defaultdict
 from typing import TYPE_CHECKING
 
@@ -73,7 +72,9 @@ class HookMetricsRecorder:
         with self._lock:
             if len(self._latencies) < self._max_items:
                 self._latencies.append(latency_ms)
-            key = f"{harness}:{event_name}:{route}:{payload_kind}:{decision}:{reason_code}:{cache_status}:{fallback_kind}"
+            key = (
+                f"{harness}:{event_name}:{route}:{payload_kind}:{decision}:{reason_code}:{cache_status}:{fallback_kind}"
+            )
             self._counters[key] += 1
             self._counters[f"latency:{_latency_bucket(latency_ms)}"] += 1
             self._counters[f"size:{_size_bucket(output_size)}"] += 1
@@ -105,7 +106,7 @@ class HookMetricsRecorder:
         with self._lock:
             if not force and len(self._latencies) < 100:
                 return
-            snapshot = {
+            snapshot: dict[str, object] = {
                 "counters": dict(self._counters),
                 "latency_p50_ms": round(
                     sorted(self._latencies)[len(self._latencies) // 2] if self._latencies else 0.0, 2
@@ -127,4 +128,4 @@ class HookMetricsRecorder:
         )
 
 
-__all__ = ["HookMetricsRecorder", "LATENCY_BUCKETS_MS", "SIZE_BUCKETS"]
+__all__ = ["LATENCY_BUCKETS_MS", "SIZE_BUCKETS", "HookMetricsRecorder"]

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/daemon/hook_worker.py

@@ -13,7 +13,6 @@ Security:
 
 from __future__ import annotations
 
-import os
 from collections.abc import Mapping
 from pathlib import Path
 from typing import TYPE_CHECKING
@@ -24,6 +23,7 @@ from ..runtime.hook_decision_cache import HookDecisionCache
 from ..runtime.hook_review_engine import HookReviewEngine
 from ..runtime.hook_review_types import (
     HookOutputSummary,
+    HookPayloadKind,
     HookReviewRequest,
     HookSourceFileRef,
 )
@@ -32,7 +32,7 @@ if TYPE_CHECKING:
     from ..store import GuardStore
 
 
-class HookWorkerUnsupported(RuntimeError):
+class HookWorkerUnsupported(RuntimeError):  # noqa: N818
     """Raised when the worker cannot handle a request (caller falls back to CLI)."""
 
 
@@ -155,7 +155,7 @@ class HookWorker:
                 return value.strip()
         return "PreToolUse"
 
-    def _payload_kind(self, payload: Mapping[str, object]) -> str:
+    def _payload_kind(self, payload: Mapping[str, object]) -> HookPayloadKind:
         if "guard_payload_ref" in payload:
             return "encrypted_payload_ref"
         if "guard_source_ref" in payload:

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -4017,8 +4017,8 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         params: Mapping[str, list[str]],
         *,
         default_harness: str,
-        home_dir: str,
-        guard_home: str,
+        home_dir: str | None,
+        guard_home: str | None,
         workspace: str | None,
     ) -> dict[str, object] | None:
         """Try the resident hook worker. Return None to fall back to legacy.
@@ -4034,6 +4034,9 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         """
         from .hook_worker import HookWorkerUnsupported
 
+        if home_dir is None or guard_home is None:
+            return None
+
         try:
             worker = self._daemon_server().hook_worker
             return worker.review_http_payload(
@@ -4067,8 +4070,8 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         *,
         hook_env: dict[str, str],
         default_harness: str,
-        home_dir: str,
-        guard_home: str,
+        home_dir: str | None,
+        guard_home: str | None,
         workspace: str | None,
     ) -> None:
         runtime_harness = self._optional_string(params.get("runtime-harness", [None])[-1])

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/false_positive_rules.py

@@ -73,6 +73,7 @@ KNOWN_SKILL_DOC_ROOT_SUFFIXES = (
     ".codex/superpowers/skills",
     ".codex/skills",
     ".agents/skills",
+    ".claude/skills",
 )
 FD_OPTION_VALUE_FLAGS = frozenset(
     {
@@ -115,6 +116,34 @@ def target_is_known_skill_doc_path(target: str, *, home_dir: Path | None = None)
     """Return true for known local skill-doc roots without resolving user path text."""
     if any(marker in target for marker in ("$", "`", "<", ">", "|", ";", "&")):
         return False
+    # Handle skill:// URIs: resolve the skill name against known doc roots.
+    if target.startswith("skill://"):
+        skill_name = target[len("skill://"):].strip().strip("'\"")
+        if skill_name:
+            skill_name = os.path.normpath(skill_name).replace("\\", "/")
+            if (
+                not skill_name
+                or skill_name.startswith("..")
+                or skill_name == "."
+                or skill_name.startswith("/")
+            ):
+                return False
+            home = os.path.normpath(str(home_dir or Path.home())).replace("\\", "/")
+            for suffix in KNOWN_SKILL_DOC_ROOT_SUFFIXES:
+                root = f"{home}/{suffix}"
+                candidate_dir = f"{root}/{skill_name}"
+                candidate_file = f"{candidate_dir}/SKILL.md"
+                if not os.path.isfile(candidate_file):
+                    continue
+                # Skill directories are often symlinks managed by the harness
+                # (e.g. ~/.claude/skills/foo -> /project/.agents/skills/foo).
+                # Require SKILL.md to exist and not be a symlink escaping its dir.
+                real_candidate = os.path.realpath(candidate_dir)
+                real_file = os.path.realpath(candidate_file)
+                if real_file != real_candidate and not real_file.startswith(f"{real_candidate}/"):
+                    continue
+                return True
+        return False
     if target == "~" or target.startswith("~/"):
         expanded = f"{home_dir or Path.home()}{target[1:]}"
     else:

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/hook_content_scanner.py

@@ -16,7 +16,7 @@ from __future__ import annotations
 
 import time
 from collections.abc import Iterable
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 
 from .secret_sensitivity import classify_secret_content, secret_content_rule_version
 
@@ -172,10 +172,7 @@ class ContentScanner:
 
             tail = window[-HOOK_SCANNER_CONTEXT_CHARS:] if len(window) > HOOK_SCANNER_CONTEXT_CHARS else window
 
-        if not matches_by_classifier:
-            reason_code = "clean"
-        else:
-            reason_code = "matches"
+        reason_code = "clean" if not matches_by_classifier else "matches"
 
         return ContentScanResult(
             matches=tuple(matches_by_classifier.values()),
@@ -235,11 +232,11 @@ def _truncate_to_byte_limit(text: str, max_bytes: int) -> str:
 
 
 __all__ = [
-    "ContentScanMatch",
-    "ContentScanResult",
-    "ContentScanner",
     "HOOK_CONTENT_SCANNER_VERSION",
     "HOOK_SCANNER_CONTEXT_CHARS",
     "HOOK_SCANNER_DEFAULT_MAX_BYTES",
     "HOOK_SCANNER_MAX_MATCHES",
+    "ContentScanMatch",
+    "ContentScanResult",
+    "ContentScanner",
 ]

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/hook_decision_cache.py

@@ -17,7 +17,6 @@ from __future__ import annotations
 import hashlib
 import json
 from dataclasses import asdict, dataclass
-from pathlib import Path
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -76,9 +75,7 @@ def hook_config_fingerprint(config: GuardConfig) -> str:
         },
         "approval_surface_policy": config.approval_surface_policy,
     }
-    return hashlib.sha256(
-        json.dumps(material, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    ).hexdigest()
+    return hashlib.sha256(json.dumps(material, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
 
 
 class HookDecisionCache:
@@ -141,9 +138,9 @@ class HookDecisionCache:
 
 
 __all__ = [
-    "HookDecisionCache",
     "SOURCE_CACHE_SCANNER_NAME",
     "SOURCE_CACHE_VERSION",
+    "HookDecisionCache",
     "SourceReadCacheMaterial",
     "hook_config_fingerprint",
 ]

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/hook_enrichment_queue.py

@@ -124,4 +124,4 @@ class HookEnrichmentQueue:
         )
 
 
-__all__ = ["HookEnrichmentTask", "HookEnrichmentQueue"]
+__all__ = ["HookEnrichmentQueue", "HookEnrichmentTask"]

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/hook_review_engine.py

@@ -19,9 +19,11 @@ Security invariants:
 from __future__ import annotations
 
 import time
+from collections.abc import Callable
 from pathlib import Path
-from typing import TYPE_CHECKING, Callable
+from typing import TYPE_CHECKING
 
+from .actions import normalize_harness_payload
 from .hook_content_scanner import ContentScanner
 from .hook_decision_cache import HookDecisionCache
 from .hook_review_types import HookReviewRequest, HookReviewResponse
@@ -29,10 +31,9 @@ from .hook_source_read import (
     SOURCE_READ_MAX_SCAN_BYTES,
     evaluate_source_file_ref,
 )
-from .actions import normalize_harness_payload
 
 if TYPE_CHECKING:
-    from ..config import GuardConfig, load_guard_config
+    from ..config import GuardConfig
     from ..store import GuardStore
 
 HOOK_ENGINE_TOTAL_BUDGET_MS = 9000
@@ -42,7 +43,7 @@ HOOK_SCANNER_DEFAULT_BUDGET_MS = 750
 ARBITRARY_STDOUT_FULL_ALLOW_BYTES = 256 * 1024
 
 
-class HookFailSafe(RuntimeError):
+class HookFailSafe(RuntimeError):  # noqa: N818
     """Raised when the engine must fail safe with a specific reason."""
 
     def __init__(self, reason_code: str, reason: str, *, excerpt: str | None = None):
@@ -222,7 +223,8 @@ class HookReviewEngine:
             # Excerpt is safe, but we cannot prove the full output is safe.
             return HookReviewResponse(
                 decision="allow",
-                reason="HOL Guard returned a reviewed excerpt because this output could not be fully proven safe within local limits.",
+                reason="HOL Guard returned a reviewed excerpt because this output could not be fully"
+                " proven safe within local limits.",
                 model_output_action="replace_with_reviewed_excerpt",
                 reviewed_excerpt=excerpt,
                 notice="excerpt",

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/hook_source_read.py

@@ -25,21 +25,20 @@ from __future__ import annotations
 import hashlib
 import os
 import re
-import time
+import stat
 from dataclasses import dataclass
-from pathlib import Path
 from typing import TYPE_CHECKING, Literal
 
 from .hook_content_scanner import ContentScanMatch, ContentScanner
 from .hook_decision_cache import HookDecisionCache, SourceReadCacheMaterial, hook_config_fingerprint
-from .hook_review_types import HookReviewRequest, HookSourceFileRef
+from .hook_review_types import HookReviewRequest
 from .secret_sensitivity import classify_secret_path
 from .source_paths import SOURCE_CLASSIFIER_VERSION, resolve_source_candidate_path, source_path_is_allowed
 
 if TYPE_CHECKING:
-    from ..actions import GuardActionEnvelope
     from ..config import GuardConfig
     from ..store import GuardStore
+    from .actions import GuardActionEnvelope
 
 SOURCE_READ_FAST_PATH_VERSION = "source-read-fast-v1"
 SOURCE_READ_MAX_SCAN_BYTES = 5 * 1024 * 1024
@@ -212,7 +211,7 @@ def evaluate_source_file_ref(
     except OSError:
         return SourceReadFastPathResult(status="inconclusive", reason_code="stat_failed")
 
-    if not pre_stat.st_mode & 0o170000 == 0o100000:  # S_ISREG
+    if not stat.S_ISREG(pre_stat.st_mode):
         return SourceReadFastPathResult(status="inconclusive", reason_code="not_regular_file")
 
     if pre_stat.st_size > SOURCE_READ_MAX_SCAN_BYTES:

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/secret_file_requests.py

@@ -4479,7 +4479,18 @@ def _read_only_lookup_find_args_are_safe(args: list[str], *, home_dir: Path | No
 _GREP_PATTERN_OPTIONS = frozenset({"-e", "--regexp"})
 _GREP_PATTERN_FILE_OPTIONS = frozenset({"-f", "--file"})
 _GREP_FILTER_FILE_OPTIONS = frozenset({"--exclude-from"})
-_GREP_SKIP_NEXT_OPTIONS = frozenset({"-A", "-B", "-C", "-m", "--after-context", "--before-context", "--context", "--max-count"})
+_GREP_SKIP_NEXT_OPTIONS = frozenset(
+    {
+        "-A",
+        "-B",
+        "-C",
+        "-m",
+        "--after-context",
+        "--before-context",
+        "--context",
+        "--max-count",
+    }
+)
 
 
 def _read_only_lookup_filter_grep_args_are_safe(
@@ -4621,8 +4632,6 @@ def _read_only_lookup_target_is_safe(target: str, *, allow_dirs: bool, home_dir:
     return allow_dirs
 
 
-
-
 _SAFE_GRAPHQL_QUERY_FILE_WORKFLOW_PATTERN = re.compile(
     r"\A\s*cat\s*>\s*(?P<path>'[^']+'|\"[^\"]+\"|[^\s]+)\s*<<(?P<quote>['\"])(?P<label>[A-Za-z_][A-Za-z0-9_]*)(?P=quote)"
     r"\s*\n(?P<body>.*?)\n(?P=label)\s*(?:\n|&&|;)\s*(?P<rest>.+)\Z",

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/secret_sensitivity.py

@@ -323,9 +323,7 @@ def secret_content_rule_version() -> str:
         }
         for classifier, family, sensitivity, pattern, _reason in _SECRET_CONTENT_PATTERNS
     ]
-    return hashlib.sha256(
-        json.dumps(material, sort_keys=True, separators=(",", ":")).encode("utf-8")
-    ).hexdigest()
+    return hashlib.sha256(json.dumps(material, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
 
 
 def _secret_content_match_is_sample(*, classifier: str, text: str, enabled: bool) -> bool:

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/source_paths.py

@@ -11,7 +11,6 @@ these implementations so existing tests and callsites are unchanged.
 
 from __future__ import annotations
 
-import os
 from dataclasses import dataclass
 from pathlib import Path
 

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/runtime/trust_attestation.py

@@ -121,13 +121,13 @@ def resolve_guard_oauth_trust_attestation_signing_config(
         public_jwk_thumbprint=public_jwk_thumbprint,
         signature_algorithm=GUARD_TRUST_ATTESTATION_SIGNATURE_ALGORITHM_ECDSA_P256,
     )
+
+
 def trust_attestation_v2_enabled(environ: Mapping[str, str] | None = None) -> bool:
     """Trust attestation v2 is enabled by default. Set GUARD_AIBOM_TRUST_ATTESTATION_V2=0 to opt out."""
     env = environ or os.environ
     raw = _sanitize_env(env.get("GUARD_AIBOM_TRUST_ATTESTATION_V2")).lower()
-    if raw in _FALSY_ENV_VALUES:
-        return False
-    return True
+    return raw not in _FALSY_ENV_VALUES
 
 
 def _headless_short_lived_attestation_enabled(environ: Mapping[str, str]) -> bool:

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/guard/store_policy.py

@@ -505,7 +505,6 @@ class StorePolicyMixin:
         """
         import hashlib
         import json
-
         from datetime import datetime, timezone
 
         current_time = now or datetime.now(timezone.utc).isoformat()

{plugin_scanner-2.0.920 → plugin_scanner-2.0.922}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.920"
+__version__ = "2.0.922"

plugin_scanner-2.0.922/tests/test_skill_uri_blocking.py

@@ -0,0 +1,105 @@
+"""Tests for skill:// URI handling in target_is_known_skill_doc_path."""
+
+from codex_plugin_scanner.guard.runtime.false_positive_rules import (
+    target_is_known_skill_doc_path,
+)
+
+
+def test_skill_uri_existing():
+    assert target_is_known_skill_doc_path("skill://guard-dev-testing") is True
+
+
+def test_skill_uri_nonexistent():
+    assert target_is_known_skill_doc_path("skill://nonexistent-skill-xyz") is False
+
+
+def test_skill_uri_empty():
+    assert target_is_known_skill_doc_path("skill://") is False
+
+
+def test_skill_uri_path_traversal():
+    assert target_is_known_skill_doc_path("skill://../../etc/passwd") is False
+
+
+def test_skill_uri_parent_dir():
+    assert target_is_known_skill_doc_path("skill://..") is False
+
+
+def test_skill_uri_dot():
+    assert target_is_known_skill_doc_path("skill://.") is False
+
+
+def test_resolved_claude_skill_path():
+    """Filesystem path to a symlinked skill dir is blocked by the symlink check.
+
+    The skill:// URI path is the correct way to read skills — it uses realpath
+    containment. Direct filesystem paths go through the stricter symlink check.
+    """
+    assert target_is_known_skill_doc_path("~/.claude/skills/guard-dev-testing") is False
+
+
+def test_resolved_skill_md_path():
+    """Filesystem path through a symlinked skill dir is also blocked."""
+    assert target_is_known_skill_doc_path("~/.claude/skills/guard-dev-testing/SKILL.md") is False
+
+
+def test_skill_uri_absolute_path():
+    """skill:///etc/passwd must be rejected."""
+    assert target_is_known_skill_doc_path("skill:///etc/passwd") is False
+
+
+def test_skill_uri_root():
+    """skill:/// must be rejected."""
+    assert target_is_known_skill_doc_path("skill:///") is False
+
+
+def test_skill_uri_nonexistent_skill():
+    """A directory without SKILL.md must not be accepted."""
+    assert target_is_known_skill_doc_path("skill://nonexistent-skill-xyz") is False
+
+
+def test_skill_uri_skill_md_symlink_escape(tmp_path):
+    """SKILL.md symlinked to a file outside the skill dir must be rejected."""
+    home = tmp_path / "home"
+    skills_root = home / ".claude" / "skills" / "evil-skill"
+    skills_root.mkdir(parents=True)
+    secret_file = tmp_path / "secret.txt"
+    secret_file.write_text("SECRET=abc123\n")
+    # SKILL.md is a symlink pointing outside the skill dir
+    (skills_root / "SKILL.md").symlink_to(secret_file)
+    assert target_is_known_skill_doc_path("skill://evil-skill", home_dir=home) is False
+
+
+def test_skill_uri_symlinked_dir_without_skill_md(tmp_path):
+    """A symlinked directory without SKILL.md must not be accepted."""
+    home = tmp_path / "home"
+    skills_root = home / ".claude" / "skills"
+    skills_root.mkdir(parents=True)
+    target_dir = tmp_path / "some-dir"
+    target_dir.mkdir()
+    (skills_root / "link").symlink_to(target_dir, target_is_directory=True)
+    assert target_is_known_skill_doc_path("skill://link", home_dir=home) is False
+
+
+def test_skill_uri_legitimate_symlinked_dir(tmp_path):
+    """A symlinked skill dir with a real SKILL.md inside should pass."""
+    home = tmp_path / "home"
+    skills_root = home / ".claude" / "skills"
+    skills_root.mkdir(parents=True)
+    real_skill = tmp_path / "real-skill"
+    real_skill.mkdir()
+    (real_skill / "SKILL.md").write_text("---\nname: test\n---\n")
+    (skills_root / "link").symlink_to(real_skill, target_is_directory=True)
+    assert target_is_known_skill_doc_path("skill://link", home_dir=home) is True
+
+
+def test_non_skill_path():
+    assert target_is_known_skill_doc_path("/etc/passwd") is False
+
+
+def test_codex_skills_root():
+    assert target_is_known_skill_doc_path("~/.codex/skills") is True
+
+
+def test_agents_skills_root():
+    assert target_is_known_skill_doc_path("~/.agents/skills") is True