plugin-scanner 2.0.934__tar.gz → 2.0.936__tar.gz

{plugin_scanner-2.0.934 → plugin_scanner-2.0.936}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.934
+Version: 2.0.936
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.934 → plugin_scanner-2.0.936}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.934"
+version = "2.0.936"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.934 → plugin_scanner-2.0.936}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.934"
+version = "2.0.936"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.934 → plugin_scanner-2.0.936}/src/codex_plugin_scanner/guard/access_graph_events.py

@@ -215,7 +215,16 @@ def _add_artifact_entities(
 
 
 def _access_graph_entity_type(artifact_type: str) -> str:
-    if artifact_type in {"skill", "mcp_server", "tool", "repository", "agent", "policy", "integration"}:
+    if artifact_type in {
+        "skill",
+        "mcp_server",
+        "tool",
+        "repository",
+        "agent",
+        "policy",
+        "integration",
+        "instruction",
+    }:
         return artifact_type
     return "tool"
 
@@ -225,6 +234,8 @@ def _access_graph_artifact_edge_type(entity_type: str) -> str | None:
         return "agent_uses_skill"
     if entity_type == "mcp_server":
         return "agent_uses_mcp_server"
+    if entity_type == "instruction":
+        return "agent_uses_instruction"
     return None
 
 

{plugin_scanner-2.0.934 → plugin_scanner-2.0.936}/src/codex_plugin_scanner/guard/aibom_trust_metadata.py

@@ -131,7 +131,7 @@ def apply_local_trust_metadata(
         )
     )
 
-    local_security = _local_skill_security_for_artifact(
+    local_security = _local_security_for_artifact(
         artifact,
         item_kind=item_kind,
         metadata=metadata,
@@ -147,6 +147,34 @@ def apply_local_trust_metadata(
     return enriched
 
 
+def _local_security_for_artifact(
+    artifact: object,
+    *,
+    item_kind: InventoryItemKind,
+    metadata: dict[str, object],
+    captured_at: str,
+    cisco_runs: tuple[object, ...],
+    workspace_dir: Path | None,
+) -> dict[str, object] | None:
+    skill_security = _local_skill_security_for_artifact(
+        artifact,
+        item_kind=item_kind,
+        metadata=metadata,
+        captured_at=captured_at,
+        cisco_runs=cisco_runs,
+        workspace_dir=workspace_dir,
+    )
+    if skill_security is not None:
+        return skill_security
+    return _local_mcp_security_for_artifact(
+        artifact,
+        item_kind=item_kind,
+        captured_at=captured_at,
+        cisco_runs=cisco_runs,
+        workspace_dir=workspace_dir,
+    )
+
+
 def _local_skill_security_for_artifact(
     artifact: object,
     *,
@@ -243,6 +271,152 @@ def _local_skill_security_for_artifact(
     }
 
 
+def _local_mcp_security_for_artifact(
+    artifact: object,
+    *,
+    item_kind: InventoryItemKind,
+    captured_at: str,
+    cisco_runs: tuple[object, ...],
+    workspace_dir: Path | None,
+) -> dict[str, object] | None:
+    from .inventory_contract import _normalize_inventory_datetime
+
+    if item_kind != "mcp_server" or getattr(artifact, "artifact_type", None) != "mcp_server":
+        return None
+
+    trust_root = _trust_root_for_artifact(artifact, item_kind=item_kind, workspace_dir=workspace_dir)
+    if trust_root is None:
+        return None
+
+    run = next(
+        (
+            candidate
+            for candidate in cisco_runs
+            if getattr(candidate, "source", None) == "cisco-mcp-scanner"
+            and _matches_mcp_cisco_run(artifact, run=candidate)
+        ),
+        None,
+    )
+    if run is None:
+        return None
+
+    status = str(getattr(run, "status", "unknown"))
+    normalized_captured_at = _normalize_inventory_datetime(captured_at)
+    scan_root = _cisco_run_target_path(run) or trust_root
+    findings = _local_mcp_security_findings(run, scan_root=scan_root)
+    findings = sorted(
+        findings,
+        key=lambda finding: (finding.get("file", ""), finding.get("ruleId", ""), finding.get("message", "")),
+    )
+    severity_counts = _cisco_severity_counts(run)
+    analyzers_used = _cisco_analyzers_used(run)
+    score = _cisco_layer_score(severity_counts, analyzers_used=analyzers_used) if status == "enabled" else None
+    safety = None
+    if score is not None:
+        safety = {
+            "score": score,
+            "label": _local_skill_security_label(score),
+            "findingsTotal": len(findings),
+            "highFindings": sum(1 for finding in findings if finding["severity"] == "high"),
+            "scriptsTotal": _local_mcp_targets_total(run),
+            "targetsScanned": _local_mcp_targets_total(run),
+            "permissionsMissing": [],
+        }
+
+    run_metadata = getattr(run, "metadata", None)
+    metadata_payload: dict[str, object] = {
+        "scannerSource": str(getattr(run, "source", "unknown")),
+        "message": str(getattr(run, "message", "")),
+        "findingsBySeverity": severity_counts,
+        "totalFindings": len(findings),
+    }
+    duration_ms = getattr(run, "duration_ms", None)
+    if isinstance(duration_ms, int):
+        metadata_payload["durationMs"] = duration_ms
+    if isinstance(run_metadata, dict):
+        for key in ("analyzersUsed", "scanMode", "mode", "targetsScanned"):
+            value = run_metadata.get(key)
+            if value is not None:
+                metadata_payload[key] = value
+
+    metadata_payload["evidenceHash"] = guard_evidence_hash(
+        {
+            "capturedAt": normalized_captured_at,
+            "entityType": "mcp_server",
+            "findings": findings,
+            "provider": "cisco-mcp-scanner",
+            "safety": safety,
+            "source": "local_indexed",
+            "status": status,
+        }
+    )
+
+    return {
+        "entityType": "mcp_server",
+        "source": "local_indexed",
+        "provider": "cisco-mcp-scanner",
+        "status": status,
+        "capturedAt": normalized_captured_at,
+        "safety": safety,
+        "findings": findings,
+        "metadata": metadata_payload,
+    }
+
+
+def _local_mcp_security_findings(
+    run: object,
+    *,
+    scan_root: Path,
+) -> list[dict[str, object]]:
+    results: list[dict[str, object]] = []
+    try:
+        resolved_scan_root = scan_root.resolve()
+    except OSError:
+        resolved_scan_root = scan_root
+    for finding in tuple(getattr(run, "findings", ()) or ()):
+        file_path = getattr(finding, "file_path", None)
+        if isinstance(file_path, str) and file_path.strip():
+            raw_path = Path(file_path)
+            path = raw_path if raw_path.is_absolute() else scan_root / raw_path
+            if not _paths_related(scan_root, path):
+                continue
+            try:
+                relative_file = str(path.resolve().relative_to(resolved_scan_root))
+            except ValueError:
+                relative_file = path.name
+        else:
+            relative_file = ".mcp.json"
+
+        results.append(
+            {
+                "ruleId": str(getattr(finding, "rule_id", "unknown")),
+                "severity": _local_skill_security_severity(getattr(finding, "severity", None)),
+                "file": relative_file,
+                "message": _local_mcp_security_message(finding),
+            }
+        )
+    return results
+
+
+def _local_mcp_security_message(finding: object) -> str:
+    description = getattr(finding, "description", None)
+    if isinstance(description, str) and description.strip():
+        return description.strip()
+    title = getattr(finding, "title", None)
+    if isinstance(title, str) and title.strip():
+        return title.strip()
+    return "MCP security finding"
+
+
+def _local_mcp_targets_total(run: object) -> int:
+    metadata = getattr(run, "metadata", None)
+    if isinstance(metadata, dict):
+        value = metadata.get("targetsScanned")
+        if isinstance(value, int):
+            return max(0, value)
+    return 0
+
+
 def _local_skill_security_findings(
     run: object,
     *,
@@ -507,7 +681,14 @@ def _cisco_trust_layers_for_artifact(
                     label="Cisco Skill Scanner",
                 )
             )
-        if source == "cisco-mcp-scanner" and item_kind == "mcp_server" and _matches_mcp_cisco_run(artifact, run=run):
+        if (
+            source == "cisco-mcp-scanner"
+            and item_kind in {"mcp_server", "mcp_tool"}
+            and _matches_mcp_cisco_run(
+                artifact,
+                run=run,
+            )
+        ):
             layers.append(
                 _cisco_trust_layer(
                     run,
@@ -537,11 +718,16 @@ def _matches_skill_cisco_run(
 
 
 def _matches_mcp_cisco_run(artifact: object, *, run: object) -> bool:
-    run_target = _cisco_run_target_path(run)
+    run_config_path = _cisco_run_config_path(run)
     config_path = getattr(artifact, "config_path", None)
-    if run_target is None or not isinstance(config_path, str) or not config_path.strip():
+    if not isinstance(config_path, str) or not config_path.strip():
         return False
     path = Path(config_path)
+    if run_config_path is not None:
+        return _paths_related(path, run_config_path)
+    run_target = _cisco_run_target_path(run)
+    if run_target is None:
+        return False
     if path.is_file() and (_paths_related(path, run_target) or _paths_related(path.parent, run_target)):
         return True
     return _paths_related(path, run_target)
@@ -560,10 +746,23 @@ def _paths_related(left: Path, right: Path) -> bool:
     )
 
 
+def _cisco_run_config_path(run: object) -> Path | None:
+    metadata = getattr(run, "metadata", None)
+    if not isinstance(metadata, dict):
+        return None
+    config_path = metadata.get("_configPath")
+    if not isinstance(config_path, str) or not config_path.strip():
+        return None
+    return Path(config_path)
+
+
 def _cisco_run_target_path(run: object) -> Path | None:
     metadata = getattr(run, "metadata", None)
     if not isinstance(metadata, dict):
         return None
+    target = metadata.get("_targetPath")
+    if isinstance(target, str) and target.strip() and target != "missing":
+        return Path(target)
     target = metadata.get("target")
     if not isinstance(target, str) or not target.strip() or target == "missing":
         return None

{plugin_scanner-2.0.934 → plugin_scanner-2.0.936}/src/codex_plugin_scanner/guard/approvals.py

@@ -36,6 +36,7 @@ from .models import (
     DecisionScope,
     GuardAction,
     GuardApprovalRequest,
+    GuardArtifact,
     HarnessDetection,
     PolicyDecision,
 )
@@ -247,13 +248,133 @@ _GENERIC_TOOL_LABELS = frozenset(
         "Grep",
         "WebFetch",
         "TodoWrite",
+        "mcp_tool",
+        "package_request",
+        "file_read_request",
+        "file_write_request",
+        "tool_action_request",
     }
 )
+_GENERIC_TOOL_LABELS_LOWER = frozenset(label.lower() for label in _GENERIC_TOOL_LABELS)
 
 
 def _is_generic_tool_label(value: str) -> bool:
     """Return True if the value is a generic tool name, not an actual command."""
-    return value in _GENERIC_TOOL_LABELS
+    stripped = value.strip()
+    return stripped in _GENERIC_TOOL_LABELS or stripped.lower() in _GENERIC_TOOL_LABELS_LOWER
+
+
+def _string_from_mapping(mapping: Mapping[str, object], key: str) -> str | None:
+    value = mapping.get(key)
+    if isinstance(value, str) and value.strip():
+        return value.strip()
+    return None
+
+
+def _first_string_from_mapping(mapping: Mapping[str, object], keys: Sequence[str]) -> str | None:
+    for key in keys:
+        value = _string_from_mapping(mapping, key)
+        if value is not None:
+            return value
+    return None
+
+
+def _string_list_from_mapping(mapping: Mapping[str, object], key: str) -> list[str]:
+    value = mapping.get(key)
+    if isinstance(value, str) and value.strip():
+        return [value.strip()]
+    if not isinstance(value, Sequence) or isinstance(value, str):
+        return []
+    return [str(item).strip() for item in value if isinstance(item, str) and item.strip()]
+
+
+def _review_action_text_from_envelope(envelope: Mapping[str, object]) -> str | None:
+    for key in ("raw_command_text", "rawCommandText", "command", "cmd"):
+        direct = _string_from_mapping(envelope, key)
+        if direct is not None and not _is_generic_tool_label(direct):
+            return direct
+
+    action_type = _string_from_mapping(envelope, "action_type")
+    action_identity = _first_string_from_mapping(envelope, ("action_identity", "actionIdentity"))
+    if action_identity is not None and not _is_generic_tool_label(action_identity):
+        return action_identity
+
+    if action_type in {"file_read", "file_write", "file_read_request", "file_write_request"}:
+        paths = _string_list_from_mapping(envelope, "target_paths") or _string_list_from_mapping(
+            envelope,
+            "targetPaths",
+        )
+        if not paths:
+            single_path = _first_string_from_mapping(
+                envelope,
+                ("target_path", "targetPath", "path", "file_path", "filePath"),
+            )
+            paths = [single_path] if single_path is not None else []
+        if paths:
+            verb = "Read" if action_type in {"file_read", "file_read_request"} else "Write"
+            return f"{verb} {', '.join(paths)}"
+
+    if action_type == "mcp_tool":
+        server = _first_string_from_mapping(envelope, ("mcp_server", "mcpServer", "server"))
+        tool = _first_string_from_mapping(envelope, ("mcp_tool", "mcpTool", "tool_name", "toolName"))
+        if server and tool:
+            return f"{server}.{tool}"
+        return server or tool
+
+    package_manager = _first_string_from_mapping(envelope, ("package_manager", "packageManager"))
+    package_name = _first_string_from_mapping(envelope, ("package_name", "packageName"))
+    if package_manager and package_name:
+        targets = _string_list_from_mapping(envelope, "package_targets") or _string_list_from_mapping(
+            envelope,
+            "packageTargets",
+        )
+        package_target = targets[0] if targets else package_name
+        if package_target.startswith(package_name):
+            return f"{package_manager} install {package_target}"
+        return f"{package_manager} install {package_name}@{package_target}"
+
+    return None
+
+
+def _review_action_text_from_item(item: Mapping[str, object], artifact: GuardArtifact | None) -> str | None:
+    candidates: list[object] = []
+    if artifact is not None:
+        candidates.extend(
+            [
+                artifact.metadata.get("raw_command_text"),
+                artifact.metadata.get("command_text"),
+                artifact.command,
+            ]
+        )
+    candidates.extend(
+        [
+            item.get("raw_command_text"),
+            item.get("rawCommandText"),
+            item.get("review_command"),
+            item.get("reviewCommand"),
+            item.get("action_identity"),
+            item.get("actionIdentity"),
+        ]
+    )
+    envelope_raw = item.get("action_envelope_json")
+    envelope = _item_action_envelope_json(item)
+    if envelope is None and isinstance(envelope_raw, str):
+        try:
+            import json as _json
+
+            parsed = _json.loads(envelope_raw)
+        except (ValueError, TypeError):
+            parsed = None
+        if isinstance(parsed, Mapping):
+            envelope = {str(key): value for key, value in parsed.items() if isinstance(key, str)}
+    if envelope is not None:
+        candidates.append(_review_action_text_from_envelope(envelope))
+    for candidate in candidates:
+        if isinstance(candidate, str) and candidate.strip():
+            stripped = candidate.strip()
+            if not _is_generic_tool_label(stripped):
+                return stripped
+    return None
 
 
 def queue_blocked_approvals(
@@ -290,33 +411,10 @@ def queue_blocked_approvals(
         launch_target = _launch_target(artifact, item)
         raw_command_text: str | None = None
         if redaction_level != "full":
-            candidate: object | None = None
-            if artifact is not None:
-                candidate = artifact.metadata.get("raw_command_text")
-                if not isinstance(candidate, str) or not candidate.strip():
-                    candidate = artifact.metadata.get("command_text")
-                if not isinstance(candidate, str) or not candidate.strip():
-                    candidate = artifact.command if artifact.command is not None else None
-            # Fallback: extract command from action_envelope_json (handles both str and dict types)
-            if not isinstance(candidate, str) or not candidate.strip():
-                envelope_raw = item.get("action_envelope_json")
-                envelope: dict[str, object] | None = None
-                if isinstance(envelope_raw, str):
-                    try:
-                        import json as _json
-
-                        envelope = _json.loads(envelope_raw)
-                    except (ValueError, TypeError):
-                        pass
-                elif isinstance(envelope_raw, dict):
-                    envelope = envelope_raw
-                if isinstance(envelope, dict):
-                    candidate = envelope.get("command")
-            if isinstance(candidate, str) and candidate.strip():
-                stripped = candidate.strip()
-                if not _is_generic_tool_label(stripped):
-                    scrubbed = redact_text(stripped)
-                    raw_command_text = scrubbed.text
+            candidate = _review_action_text_from_item(item, artifact)
+            if candidate is not None:
+                scrubbed = redact_text(candidate)
+                raw_command_text = scrubbed.text
         incident = build_incident_context(
             harness=detection.harness,
             artifact=artifact,
@@ -1114,7 +1212,7 @@ def _item_risk_signals(item: dict[str, object], artifact) -> tuple[str, ...]:
     return artifact_risk_signals(artifact) if artifact is not None else ()
 
 
-def _item_action_envelope_json(item: dict[str, object]) -> dict[str, object] | None:
+def _item_action_envelope_json(item: Mapping[str, object]) -> dict[str, object] | None:
     value = item.get("action_envelope_json")
     if not isinstance(value, Mapping):
         return None