plugin-scanner 2.0.923__tar.gz → 2.0.924__tar.gz

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.923
+Version: 2.0.924
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.923"
+version = "2.0.924"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.923"
+version = "2.0.924"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/src/codex_plugin_scanner/guard/runtime/secret_file_requests.py

@@ -104,7 +104,7 @@ COMMAND_LIST_KEYS = ("argv", "command_args", "commandArgs")
 COMMAND_SEQUENCE_KEYS = ("commands",)
 COMMAND_CANDIDATE_LIST_KEYS = (*COMMAND_LIST_KEYS, *COMMAND_SEQUENCE_KEYS)
 _COMMAND_LIST_KEYS = COMMAND_LIST_KEYS
-_DOCKER_ALWAYS_SENSITIVE_SUBCOMMANDS = frozenset({"compose", "login", "push", "run"})
+_DOCKER_ALWAYS_SENSITIVE_SUBCOMMANDS = frozenset({"login", "push", "run"})
 _DOCKER_BUILD_SUBCOMMANDS = frozenset({"build"})
 _DOCKER_BUILDX_BUILD_SUBCOMMANDS = frozenset({"b", "build"})
 _DOCKER_BUILD_SECRET_FLAGS = frozenset({"--allow", "--secret", "--ssh"})
@@ -127,6 +127,58 @@ _DOCKER_GLOBAL_OPTIONS_WITH_VALUES = frozenset(
     }
 )
 _DOCKER_GLOBAL_FLAG_OPTIONS = frozenset({"--debug", "--tls", "--tlsverify"})
+# Docker global options that point Compose at a non-default/remotable control plane
+# or credential material; any non-default value keeps a Compose command sensitive.
+_DOCKER_GLOBAL_SENSITIVE_CONTEXT_OPTIONS = frozenset(
+    {"--config", "--context", "--host", "--tlscacert", "--tlscert", "--tlskey", "-c", "-H"}
+)
+# Docker global flag options (no value) that signal a non-default/TLS control plane.
+_DOCKER_GLOBAL_SENSITIVE_CONTEXT_FLAGS = frozenset({"--tls", "--tlsverify"})
+_DOCKER_COMPOSE_SUBCOMMAND = "compose"
+_DOCKER_COMPOSE_OPTIONS_WITH_VALUES = frozenset(
+    {
+        "--ansi",
+        "--env-file",
+        "--file",
+        "--parallel",
+        "--profile",
+        "--profiles",
+        "--project-directory",
+        "--project-name",
+        "--progress",
+        "-f",
+        "-p",
+    }
+)
+_DOCKER_COMPOSE_FLAG_OPTIONS = frozenset(
+    {"--all-resources", "--compatibility", "--dry-run", "--no-ansi", "--no-interpolate", "--verbose", "--volumes", "-q"}
+)
+_DOCKER_COMPOSE_SAFE_SUBCOMMANDS = frozenset(
+    {
+        "build",
+        "config",
+        "create",
+        "down",
+        "events",
+        "images",
+        "logs",
+        "ls",
+        "pause",
+        "port",
+        "ps",
+        "pull",
+        "restart",
+        "rm",
+        "start",
+        "stop",
+        "top",
+        "unpause",
+        "up",
+        "version",
+        "wait",
+    }
+)
+_DOCKER_COMPOSE_SENSITIVE_SUBCOMMANDS = frozenset({"cp", "exec", "publish", "push", "run", "watch"})
 _DOCKER_BUILDX_OPTIONS_WITH_VALUES = frozenset({"--builder"})
 _DOCKER_BUILDX_FLAG_OPTIONS = frozenset({"--debug"})
 _DOCKER_BUILD_ARG_SECRET_MARKERS = frozenset(
@@ -976,9 +1028,12 @@ def _docker_sensitive_tool_action_request(
         command_text=command_text,
         action_class="docker-sensitive command",
         reason=(
-            "Guard treats Docker login, run, compose, push, and credential-bearing build "
-            "actions as sensitive because they "
-            "can expose credentials or execute privileged container workflows."
+            "Guard treats Docker login, run, push, and credential-bearing build "
+            "actions as sensitive because they can expose credentials or execute privileged "
+            "container workflows. Docker Compose actions are sensitive when they use "
+            "subcommands that execute arbitrary commands or copy files (run, exec, cp, push, "
+            "publish, watch), supply secret-bearing input (--env-file), target a non-default "
+            "Docker host or context, or carry TLS/credential material."
         ),
     )
 
@@ -3904,15 +3959,22 @@ def _docker_sensitive_reason(command_text: str) -> str | None:
         command_name, command_index = _shell_segment_primary_command(segment)
         if command_name != "docker" or command_index is None:
             continue
-        subcommand_index = _docker_subcommand_index(segment[command_index + 1 :])
+        global_tokens = segment[command_index + 1 :]
+        subcommand_index = _docker_subcommand_index(global_tokens)
         if subcommand_index is None:
             continue
-        args = segment[command_index + 1 + subcommand_index :]
+        sensitive_context = _docker_global_context_is_sensitive(global_tokens[:subcommand_index])
+        args = global_tokens[subcommand_index:]
         subcommand = args[0].lower()
         if subcommand in _DOCKER_ALWAYS_SENSITIVE_SUBCOMMANDS:
             return subcommand
         if subcommand in _DOCKER_BUILD_SUBCOMMANDS and _docker_build_args_are_sensitive(args[1:]):
             return "build-sensitive-flags"
+        if subcommand == _DOCKER_COMPOSE_SUBCOMMAND:
+            reason = _docker_compose_sensitive_reason(args[1:], sensitive_context=sensitive_context)
+            if reason is not None:
+                return reason
+            continue
         if subcommand == "buildx" and len(args) > 1:
             buildx_subcommand_index = _docker_buildx_subcommand_index(args[1:])
             if buildx_subcommand_index is None:
@@ -3958,6 +4020,120 @@ def _docker_global_flag_option_matches(token: str) -> bool:
     )
 
 
+def _docker_global_context_is_sensitive(global_tokens: list[str]) -> bool:
+    index = 0
+    while index < len(global_tokens):
+        token = global_tokens[index]
+        attached_short = _docker_attached_short_context_option(token)
+        if attached_short is not None:
+            flag, value = attached_short
+            if _docker_global_context_value_is_sensitive(flag, value):
+                return True
+            index += 1
+            continue
+        if _docker_global_option_has_value(token):
+            if "=" in token:
+                flag, value = token.split("=", 1)
+                if _docker_global_context_value_is_sensitive(flag, value):
+                    return True
+                index += 1
+                continue
+            flag = token
+            value = global_tokens[index + 1] if index + 1 < len(global_tokens) else ""
+            if _docker_global_context_value_is_sensitive(flag, value):
+                return True
+            index += 2
+            continue
+        if token in _DOCKER_GLOBAL_SENSITIVE_CONTEXT_FLAGS or any(
+            token.startswith(f"{flag}=") for flag in _DOCKER_GLOBAL_SENSITIVE_CONTEXT_FLAGS
+        ):
+            return True
+        index += 1
+    return False
+
+
+def _docker_attached_short_context_option(token: str) -> tuple[str, str] | None:
+    for flag in ("-c", "-H"):
+        if token.startswith(flag) and token not in {flag, f"{flag}="}:
+            value = token[len(flag) :]
+            if value.startswith("="):
+                value = value[1:]
+            return flag, value
+    return None
+
+
+def _docker_global_context_value_is_sensitive(flag: str, value: str) -> bool:
+    if flag not in _DOCKER_GLOBAL_SENSITIVE_CONTEXT_OPTIONS:
+        return False
+    normalized_value = value.strip().strip("\"'")
+    if flag in {"--context", "-c"}:
+        # ``default`` (and an empty value) still targets the local engine.
+        return normalized_value.lower() not in {"", "default"}
+    # ``--host``/``-H``, ``--config``, and TLS cert/key flags always point at a
+    # non-default/remotable control plane or credential material.
+    return True
+
+
+def _docker_compose_sensitive_reason(args: list[str], *, sensitive_context: bool) -> str | None:
+    if sensitive_context:
+        return "compose-sensitive-context"
+    index = 0
+    while index < len(args):
+        token = args[index]
+        if token == "--":
+            remaining = args[index + 1 :]
+            if remaining:
+                compose_subcommand = remaining[0].lower()
+                return _docker_compose_subcommand_reason(compose_subcommand, remaining[1:])
+            return None
+        if _docker_compose_option_has_value(token):
+            if _docker_compose_option_is_secret_bearing(token):
+                return "compose-env-file"
+            index += 1 if "=" in token else 2
+            continue
+        if _docker_compose_flag_option_matches(token):
+            index += 1
+            continue
+        if token.startswith("-") and not token.startswith("--"):
+            index += 1
+            continue
+        return _docker_compose_subcommand_reason(token.lower(), args[index + 1 :])
+    return None
+
+
+def _docker_compose_subcommand_reason(compose_subcommand: str, subcommand_args: list[str]) -> str | None:
+    if compose_subcommand in _DOCKER_COMPOSE_SENSITIVE_SUBCOMMANDS:
+        return f"compose-{compose_subcommand}"
+    if _docker_compose_args_include_secret_bearing_option(subcommand_args):
+        return "compose-env-file"
+    if compose_subcommand in _DOCKER_BUILD_SUBCOMMANDS and _docker_build_args_are_sensitive(subcommand_args):
+        return "compose-build-sensitive-flags"
+    if compose_subcommand in _DOCKER_COMPOSE_SAFE_SUBCOMMANDS:
+        return None
+    # Unknown Compose subcommands stay sensitive by default.
+    return "compose-unknown-subcommand"
+
+
+def _docker_compose_option_has_value(token: str) -> bool:
+    return token in _DOCKER_COMPOSE_OPTIONS_WITH_VALUES or any(
+        token.startswith(f"{option}=") for option in _DOCKER_COMPOSE_OPTIONS_WITH_VALUES
+    )
+
+
+def _docker_compose_option_is_secret_bearing(token: str) -> bool:
+    return token == "--env-file" or token.startswith("--env-file=")
+
+
+def _docker_compose_args_include_secret_bearing_option(args: list[str]) -> bool:
+    return any(_docker_compose_option_is_secret_bearing(token) for token in args)
+
+
+def _docker_compose_flag_option_matches(token: str) -> bool:
+    return token in _DOCKER_COMPOSE_FLAG_OPTIONS or any(
+        token.startswith(f"{option}=") for option in _DOCKER_COMPOSE_FLAG_OPTIONS
+    )
+
+
 def _docker_buildx_subcommand_index(args: list[str]) -> int | None:
     index = 0
     while index < len(args):

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.923"
+__version__ = "2.0.924"

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/tests/test_guard_risk.py

@@ -850,6 +850,54 @@ def test_tool_action_request_classifier_blocks_docker_push():
     assert buildx_push_request.action_class == "docker-sensitive command"
 
 
+@pytest.mark.parametrize(
+    "command",
+    [
+        "docker compose up -d postgres",
+        "docker compose logs -f api",
+        "docker compose ps",
+        "docker compose down",
+        "docker compose build",
+        "docker compose build --platform linux/amd64 -t app:v1 .",
+        "docker compose -f docker-compose.yml up -d postgres",
+        "docker compose --file=docker-compose.yml up",
+        "docker compose -f docker-compose.yml ps",
+        "docker compose --profile dev up -d",
+        "docker compose --profile=dev logs -f api",
+        "docker --debug compose --profile dev logs -f api",
+        "docker compose --project-name=app ps",
+        "docker compose -p app ls",
+        "docker compose --project-directory . up -d",
+        "docker compose --project-directory=. up -d",
+        "docker compose --parallel 4 pull",
+        "docker compose --parallel=4 pull",
+        "docker compose --ansi never ps",
+        "docker compose --ansi=never ps",
+        "docker compose version",
+        "docker compose create web",
+        "docker compose stop redis",
+        "docker compose restart web",
+        "docker compose pull",
+        "docker compose images",
+        "docker compose top",
+        "docker compose events",
+        "docker compose port web 8080",
+        "docker compose rm -f web",
+        "docker compose pause web",
+        "docker compose unpause web",
+        "docker compose wait web",
+        "docker compose config",
+        "docker compose up --build",
+        "docker --context default compose up",
+        "docker --context=default compose ps",
+    ],
+)
+def test_tool_action_request_classifier_allows_local_compose_workflows(command):
+    request = extract_sensitive_tool_action_request("bash", {"command": command})
+
+    assert request is None
+
+
 def test_tool_action_request_classifier_blocks_python_test_module_invocation():
     request = extract_sensitive_tool_action_request(
         "bash",
@@ -903,7 +951,37 @@ def test_tool_action_request_classifier_blocks_python_test_module_with_read_only
         "docker login registry.example.com",
         "docker --context prod login registry.example.com",
         "docker run -v ~/.ssh:/root/.ssh ubuntu:latest",
-        "docker compose up --build",
+        "docker compose run --rm app",
+        "docker compose exec web sh",
+        "docker compose cp file web:/tmp",
+        "docker compose push",
+        "docker compose publish",
+        "docker compose watch",
+        "docker compose frobnicate up",
+        "docker compose --env-file .env up",
+        "docker compose --env-file=.env up",
+        "docker compose up --env-file .env",
+        "docker compose up --env-file=.env",
+        "docker compose build --secret id=npm,src=.npmrc",
+        "docker compose build --ssh default",
+        "docker compose build --build-arg NPM_TOKEN=$NPM_TOKEN",
+        "docker compose build --build-arg FOO=sk-test",
+        "docker compose build --allow security.insecure",
+        "docker compose build --push",
+        "docker --context prod compose up",
+        "docker --context=prod compose ps",
+        "docker -H tcp://docker.example compose up",
+        "docker -Htcp://docker.example compose ps",
+        "docker --host=tcp://docker.example compose ps",
+        "docker --config /custom/docker compose up",
+        "docker --tlsverify compose up",
+        "docker --tls compose up",
+        "docker --tlsverify=false compose ps",
+        "docker --tlscacert /ca.pem compose up",
+        "docker --tlscert /cert.pem compose up",
+        "docker --tlskey /key.pem compose up",
+        "docker -c prod compose up",
+        "docker -cprod compose up",
         "docker build --secret id=npm,src=.npmrc -t registry.example.com/app:v1 .",
         "docker --context prod build --secret id=npm,src=.npmrc -t registry.example.com/app:v1 .",
         "docker -H tcp://docker.example build --secret id=npm,src=.npmrc -t registry.example.com/app:v1 .",

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/tests/test_guard_runtime.py

@@ -8213,7 +8213,7 @@ def test_guard_hook_claude_ask_user_question_docker_retry_uses_exact_action_poli
         "_warn_only_policy_integrity_status",
         lambda status, state, *, source="local": status == "degraded_mode",
     )
-    command = "docker compose -f scripts/guard-cloud/docker-lab/docker-compose.yml up -d postgres"
+    command = "docker compose run --rm app"
     first_event = {
         "session_id": "session-claude-docker-allow",
         "hook_event_name": "PreToolUse",

{plugin_scanner-2.0.923 → plugin_scanner-2.0.924}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.923"
+version = "2.0.924"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },