plugin-scanner 2.0.960__tar.gz → 2.0.961__tar.gz

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.960
+Version: 2.0.961
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.960"
+version = "2.0.961"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.960"
+version = "2.0.961"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/adapters/pi.py

@@ -36,13 +36,29 @@ class PiHarnessAdapter(HarnessAdapter):
     aliases = ("pi", "pi-agent", "pi-coding-agent", "omp", "oh-my-pi")
     executable = "pi"
     launcher_name = "pi"
-    approval_tier = "approval-center"
     approval_summary = (
         "Guard scans Pi packages, extensions, skills, prompts, and themes before launch "
         "and uses a managed Pi extension to review prompts and tool calls inline."
     )
     fallback_hint = "Pi keeps the blocked request in Guard and shows the reason inline before you retry."
 
+    def approval_flow(self, *, managed_install: dict[str, object] | None = None) -> dict[str, object]:
+        if isinstance(managed_install, dict) and bool(managed_install.get("active")):
+            return {
+                "tier": "approval-center",
+                "summary": self.approval_summary,
+                "fallback_hint": self.fallback_hint,
+                "prompt_channel": "native-fallback",
+                "auto_open_browser": True,
+            }
+        return {
+            "tier": "approval-center",
+            "summary": "Guard routes Pi approvals through the local approval center.",
+            "fallback_hint": "Resolve pending Pi requests from the Guard approval center.",
+            "prompt_channel": "browser",
+            "auto_open_browser": True,
+        }
+
     @staticmethod
     def _global_root(context: HarnessContext) -> Path:
         return context.home_dir / PI_AGENT_DIR

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/adapters/pi_extension_source.py

@@ -322,6 +322,10 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "  return trimmed.length > 0 ? trimmed : null;\n"
         "}\n"
         "\n"
+        "function guardOpenKey(): string {\n"
+        "  return randomBytes(8).toString('hex');\n"
+        "}\n"
+        "\n"
         "function base64Url(value: Buffer): string {\n"
         "  return value.toString('base64url');\n"
         "}\n"
@@ -350,6 +354,7 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "    config_path: payload.config_path,\n"
         "    tool_name: payload.tool_name,\n"
         "    is_error: payload.is_error,\n"
+        "    guard_operation_open_key: payload.guard_operation_open_key,\n"
         "    guard_payload_ref: {\n"
         "      version: 1,\n"
         "      path,\n"
@@ -543,7 +548,8 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         '  pi.on("input", async (event, ctx) => {\n'
         '    if (event.source === "extension") return { action: "continue" };\n'
         "    const response = await runGuard(\n"
-        '      { hook_event_name: "UserPromptSubmit", prompt: event.text, config_path: GUARD_CONFIG_PATH },\n'
+        '      { hook_event_name: "UserPromptSubmit", prompt: event.text, config_path: GUARD_CONFIG_PATH,\n'
+        "        guard_operation_open_key: guardOpenKey() },\n"
         "      ctx.cwd,\n"
         "    );\n"
         '    if (response.decision === "deny") {\n'
@@ -564,6 +570,7 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "        config_path: GUARD_CONFIG_PATH,\n"
         "        tool_name: event.toolName,\n"
         "        tool_input: toolInput,\n"
+        "        guard_operation_open_key: guardOpenKey(),\n"
         "      },\n"
         "      ctx.cwd,\n"
         "    );\n"
@@ -609,6 +616,7 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "        tool_input: toolInput,\n"
         "        stdout: toolOutput,\n"
         "        is_error: event.isError === true,\n"
+        "        guard_operation_open_key: guardOpenKey(),\n"
         "    };\n"
         "    if (sourceRef) {\n"
         "      guardPayload.guard_source_ref = sourceRef;\n"

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py

@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -175,7 +176,7 @@ def _review_runtime_artifact_hook(
                             config.approval_surface_policy,
                             approval_flow,
                         ),
-                        open_key=artifact_id,
+                        open_key=_approval_open_key(args.harness, artifact_id, payload_map),
                         redaction_level=config.receipt_redaction_level,
                     )
                     operation = blocked_operation.get("operation")
@@ -374,7 +375,7 @@ def _review_runtime_artifact_hook(
                         config.approval_surface_policy,
                         approval_flow,
                     ),
-                    open_key=artifact_id,
+                    open_key=_approval_open_key(args.harness, artifact_id, payload_map),
                     redaction_level=config.receipt_redaction_level,
                 )
                 operation = blocked_operation.get("operation")
@@ -439,6 +440,17 @@ def _review_runtime_artifact_hook(
     return None
 
 
+def _approval_open_key(harness: str, artifact_id: str, payload: Mapping[str, object] | None = None) -> str:
+    if _canonical_harness_name(harness) == "pi":
+        operation_open_key = (
+            _optional_string(payload.get("guard_operation_open_key")) if isinstance(payload, Mapping) else None
+        )
+        if operation_open_key is not None:
+            return f"pi-approval-center:{operation_open_key}"
+    return artifact_id
+
+
 __all__ = [
+    "_approval_open_key",
     "_review_runtime_artifact_hook",
 ]

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py

@@ -380,8 +380,6 @@ def _approval_surface_policy_for_flow(config_policy: str, approval_flow: dict[st
         return "notify-only"
     if approval_flow.get("auto_open_browser") is False:
         return "never-auto-open"
-    if approval_flow.get("prompt_channel") == "native-fallback":
-        return "never-auto-open"
     return config_policy
 
 def _load_hook_payload(

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py

@@ -111,6 +111,7 @@ def _native_approval_center_context(response_payload: dict[str, object], *, harn
         "opencode": "OpenCode",
         "kimi": "Kimi",
         "grok": "Grok",
+        "pi": "Pi",
     }.get(canonical_harness, "the harness")
     if canonical_harness in {
         "npm",

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/proxy/runtime_mcp.py

@@ -77,8 +77,6 @@ def _approval_surface_policy_for_browser(configured_policy: object, approval_flo
         return "notify-only"
     if approval_flow.get("auto_open_browser") is False:
         return "never-auto-open"
-    if approval_flow.get("prompt_channel") == "native-fallback":
-        return "never-auto-open"
     policy = str(configured_policy or "auto-open-once")
     if policy == "native-only":
         return "never-auto-open"

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/proxy/stdio.py

@@ -41,8 +41,6 @@ def _approval_surface_policy_for_browser(configured_policy: object, approval_flo
         return "notify-only"
     if approval_flow.get("auto_open_browser") is False:
         return "never-auto-open"
-    if approval_flow.get("prompt_channel") == "native-fallback":
-        return "never-auto-open"
     policy = str(configured_policy or "auto-open-once")
     if policy == "native-only":
         return "never-auto-open"

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/guard/runtime/surface_server.py

@@ -5,8 +5,9 @@ from __future__ import annotations
 import uuid
 from collections.abc import Callable
 from datetime import datetime, timezone
+from urllib.parse import ParseResult, parse_qsl, urlencode, urlparse, urlunparse
 
-from ..approvals import queue_blocked_approvals
+from ..approvals import first_approval_url, queue_blocked_approvals
 from ..codex_resume import seed_request_resume_record
 from ..models import GuardArtifact, HarnessDetection
 from ..schemas import build_surface_server_contract
@@ -255,10 +256,15 @@ class GuardSurfaceRuntime:
             request_id = item.get("request_id")
             if isinstance(request_id, str):
                 seed_request_resume_record(self.store, request_id=request_id, now=_now())
+        review_url = first_approval_url(
+            queued,
+            harness=harness,
+            approval_center_url=approval_center_url,
+        )
         surface = self.ensure_surface(
             surface="approval-center",
             approval_center_url=approval_center_url,
-            browser_url=browser_url,
+            browser_url=_browser_url_for_review(browser_url, review_url),
             approval_surface_policy=approval_surface_policy,
             open_key=open_key or str(waiting_operation["operation_id"]),
             opener=opener,
@@ -432,6 +438,56 @@ def _parse_detection(payload: dict[str, object]) -> HarnessDetection:
     )
 
 
+def _browser_url_for_review(browser_url: str | None, review_url: str | None) -> str | None:
+    if review_url is None:
+        return browser_url
+    if browser_url is None:
+        return review_url
+    try:
+        parsed_browser = urlparse(browser_url)
+        parsed_review = urlparse(review_url)
+    except ValueError:
+        return browser_url
+    if not parsed_review.scheme or not parsed_review.netloc:
+        return browser_url
+    if not parsed_browser.scheme or not parsed_browser.netloc:
+        return review_url
+    if _same_origin(parsed_browser, parsed_review):
+        return urlunparse(
+            parsed_review._replace(fragment=_merged_fragment(parsed_review.fragment, parsed_browser.fragment))
+        )
+    if _same_local_approval_port(parsed_browser, parsed_review):
+        return urlunparse(
+            parsed_review._replace(fragment=_merged_fragment(parsed_review.fragment, parsed_browser.fragment))
+        )
+    return review_url
+
+
+def _same_origin(left: ParseResult, right: ParseResult) -> bool:
+    return (left.scheme, left.netloc) == (right.scheme, right.netloc)
+
+
+def _same_local_approval_port(left: ParseResult, right: ParseResult) -> bool:
+    left_host = left.hostname
+    right_host = right.hostname
+    local_hosts = {"0.0.0.0", "::", "127.0.0.1", "::1", "localhost"}
+    if left_host not in local_hosts or right_host not in local_hosts:
+        return False
+    try:
+        return left.port == right.port
+    except ValueError:
+        return False
+
+
+def _merged_fragment(primary_fragment: str, extra_fragment: str) -> str:
+    primary_pairs = parse_qsl(primary_fragment, keep_blank_values=True)
+    extra_pairs = parse_qsl(extra_fragment, keep_blank_values=True)
+    extra_keys = {key for key, _value in extra_pairs}
+    merged_pairs = [(key, value) for key, value in primary_pairs if key not in extra_keys]
+    merged_pairs.extend(extra_pairs)
+    return urlencode(merged_pairs)
+
+
 def _parse_artifact(payload: dict[str, object]) -> GuardArtifact:
     args_payload = payload.get("args")
     metadata_payload = payload.get("metadata")

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.960"
+__version__ = "2.0.961"

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/tests/test_guard_surface_server.py

@@ -26,7 +26,7 @@ from codex_plugin_scanner.guard.local_dashboard_session import (
     build_local_dashboard_session_token,
 )
 from codex_plugin_scanner.guard.models import GuardApprovalRequest, GuardArtifact, PolicyDecision
-from codex_plugin_scanner.guard.runtime.surface_server import GuardSurfaceRuntime
+from codex_plugin_scanner.guard.runtime.surface_server import GuardSurfaceRuntime, _browser_url_for_review
 from codex_plugin_scanner.guard.schemas import build_surface_server_contract
 from codex_plugin_scanner.guard.store import GuardStore
 
@@ -2578,10 +2578,37 @@ class TestGuardSurfaceServer:
         opened_fragment = urllib.parse.parse_qs(opened_url.fragment)
 
         assert len(opened_urls) == 1
-        assert f"{opened_url.scheme}://{opened_url.netloc}{opened_url.path}" == f"http://127.0.0.1:{daemon.port}"
+        assert (
+            f"{opened_url.scheme}://{opened_url.netloc}{opened_url.path}"
+            == f"http://127.0.0.1:{daemon.port}/requests/{first_request_id}"
+        )
         assert opened_fragment["guard-token"][0].startswith("gld1.")
         assert opened_fragment["guard-token"] != [daemon._server.auth_token]
 
+    def test_browser_url_for_review_preserves_token_for_loopback_host_alias(self) -> None:
+        browser_url = "http://127.0.0.1:5474#guard-token=session-token"
+        review_url = "http://localhost:5474/requests/req-localhost"
+
+        result = _browser_url_for_review(browser_url, review_url)
+        assert result is not None
+        parsed = urllib.parse.urlparse(result)
+        fragment = urllib.parse.parse_qs(parsed.fragment)
+
+        assert f"{parsed.scheme}://{parsed.netloc}{parsed.path}" == "http://localhost:5474/requests/req-localhost"
+        assert fragment["guard-token"] == ["session-token"]
+
+    def test_browser_url_for_review_preserves_token_for_bind_host_alias(self) -> None:
+        browser_url = "http://0.0.0.0:5474#guard-token=session-token"
+        review_url = "http://127.0.0.1:5474/requests/req-bind-host"
+
+        result = _browser_url_for_review(browser_url, review_url)
+        assert result is not None
+        parsed = urllib.parse.urlparse(result)
+        fragment = urllib.parse.parse_qs(parsed.fragment)
+
+        assert f"{parsed.scheme}://{parsed.netloc}{parsed.path}" == "http://127.0.0.1:5474/requests/req-bind-host"
+        assert fragment["guard-token"] == ["session-token"]
+
     def test_guard_daemon_rejects_legacy_browser_connect_pairing_endpoint(self, tmp_path) -> None:
         store = GuardStore(tmp_path / "guard-home")
         daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/tests/test_pi_adapter.py

@@ -13,11 +13,13 @@ from codex_plugin_scanner.guard.adapters.base import HarnessContext
 from codex_plugin_scanner.guard.adapters.contracts import contract_for
 from codex_plugin_scanner.guard.adapters.pi_support import stable_suffix
 from codex_plugin_scanner.guard.cli.commands_hook_generic import _run_hook_generic_payload
+from codex_plugin_scanner.guard.cli.commands_hook_runtime_review import _approval_open_key
 from codex_plugin_scanner.guard.cli.commands_support_codex_tool_output_messages import (
     _codex_tool_output_request_summary,
     _codex_tool_output_runtime_reason,
     _codex_tool_output_runtime_summary,
 )
+from codex_plugin_scanner.guard.cli.commands_support_hook_payload import _approval_surface_policy_for_flow
 from codex_plugin_scanner.guard.cli.commands_support_runtime_artifacts import _codex_post_tool_output_artifact
 from codex_plugin_scanner.guard.config import GuardConfig
 from codex_plugin_scanner.guard.inventory_contract import inventory_snapshot_from_detection
@@ -68,6 +70,28 @@ class TestPiAdapterIdentity:
         assert "omp" in contract.install_aliases
         assert "oh-my-pi" in contract.install_aliases
 
+    def test_managed_approval_flow_auto_opens_approval_center_once_as_fallback(self) -> None:
+        flow = get_adapter("pi").approval_flow(managed_install={"active": True, "manifest": {}})
+
+        assert flow["tier"] == "approval-center"
+        assert flow["prompt_channel"] == "native-fallback"
+        assert flow["auto_open_browser"] is True
+        assert _approval_surface_policy_for_flow("auto-open-once", flow) == "auto-open-once"
+        assert (
+            _approval_open_key("pi", "pi:project:tool-a", {"guard_operation_open_key": "operation-1"})
+            == "pi-approval-center:operation-1"
+        )
+        assert _approval_open_key("pi", "pi:project:tool-a", {}) == "pi:project:tool-a"
+        assert _approval_open_key("codex", "codex:project:tool-a", {}) == "codex:project:tool-a"
+
+    def test_unmanaged_approval_flow_keeps_browser_fallback_visible(self) -> None:
+        flow = get_adapter("pi").approval_flow(managed_install=None)
+
+        assert flow["tier"] == "approval-center"
+        assert flow["prompt_channel"] == "browser"
+        assert flow["auto_open_browser"] is True
+        assert _approval_surface_policy_for_flow("auto-open-once", flow) == "auto-open-once"
+
 
 class TestPiDetect:
     def test_detect_marks_omp_cli_as_available(self, tmp_path: Path, monkeypatch) -> None:
@@ -230,7 +254,7 @@ class TestPiInstall:
         assert 'pi.on("input"' in text
         assert 'hook_event_name: "PostToolUse"' in text
         assert 'const GUARD_COMMAND_CANDIDATES = ["plugin-guard", "hol-guard"]' in text
-        assert 'const GUARD_HOME =' in text
+        assert "const GUARD_HOME =" in text
         assert "daemon-state.json" in text
         assert "daemon-auth-token" in text
         assert "/v1/hooks/pi?" in text
@@ -328,7 +352,7 @@ class TestPiInstall:
         # review, not pre-emptively blocked.
         assert "HOL Guard blocked oversized Pi tool output before review" not in text
         assert "oversizeNotice" not in text
-        assert 'ctx.ui.notify(oversizeNotice' not in text
+        assert "ctx.ui.notify(oversizeNotice" not in text
         assert "const response = await runGuard(" in text
         # When truncated, the reviewed excerpt (not the full unreviewed output) is
         # returned to Pi so omitted content never reaches the model.
@@ -351,9 +375,9 @@ class TestPiInstall:
         assert "response.reviewed_output_sha256 === digest.sha256" in text
         # digestOutputText must only hash text-bearing fields, not metadata
         # like {type: "text"} — otherwise structured source reads never match
-        assert 'record.type === \'text\'' in text
-        assert 'record.text' in text
-        assert 'OUTPUT_TEXT_KEYS' in text
+        assert "record.type === 'text'" in text
+        assert "record.text" in text
+        assert "OUTPUT_TEXT_KEYS" in text
         # guard_payload_ref fallback still present
         assert "guard_payload_ref" in text
         # Reviewed excerpt still returned when not proven safe

{plugin_scanner-2.0.960 → plugin_scanner-2.0.961}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.960"
+version = "2.0.961"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },