plugin-scanner 2.0.962__tar.gz → 2.0.964__tar.gz

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.962
+Version: 2.0.964
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.962"
+version = "2.0.964"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.962"
+version = "2.0.964"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/src/codex_plugin_scanner/guard/aibom_trust_metadata.py

@@ -860,10 +860,12 @@ def _cisco_trust_layer(
     safe_metadata: dict[str, object] = {
         "scannerSource": str(getattr(run, "source", "unknown")),
         "message": message,
-        "durationMs": getattr(run, "duration_ms", None) if isinstance(getattr(run, "duration_ms", None), int) else None,
         "totalFindings": sum(severity_counts.values()),
         "findingsBySeverity": severity_counts,
     }
+    duration_ms = getattr(run, "duration_ms", None)
+    if isinstance(duration_ms, int):
+        safe_metadata["durationMs"] = duration_ms
     if isinstance(run_metadata, dict):
         for key in (
             "analyzersUsed",
@@ -878,19 +880,19 @@ def _cisco_trust_layer(
             if value is not None:
                 safe_metadata[key] = value
     safe_metadata["attestationStatus"] = "unsigned"
-    safe_metadata["evidenceHash"] = _trust_evidence_hash(
-        {
-            "capturedAt": _normalize_inventory_datetime(captured_at),
-            "layerId": layer_id,
-            "layerType": layer_id,
-            "status": status,
-            "trustScore": trust_score,
-            "trustComponents": trust_components,
-            "metadata": {
-                key: value for key, value in safe_metadata.items() if key not in {"attestationStatus", "evidenceHash"}
-            },
-        }
+    safe_metadata["evidenceSchemaVersion"] = "guard-aibom-cisco-scanner-evidence.v1"
+    evidence_payload = _cisco_evidence_payload(
+        layer_id=layer_id,
+        label=label,
+        status=status,
+        message=message,
+        captured_at=_normalize_inventory_datetime(captured_at),
+        trust_score=trust_score,
+        trust_components=trust_components,
+        metadata=safe_metadata,
     )
+    safe_metadata["evidence"] = evidence_payload
+    safe_metadata["evidenceHash"] = _trust_evidence_hash(evidence_payload)
 
     return {
         "layerId": layer_id,
@@ -903,6 +905,45 @@ def _cisco_trust_layer(
     }
 
 
+def _cisco_evidence_payload(
+    *,
+    layer_id: TrustLayerType,
+    label: str,
+    status: str,
+    message: str,
+    captured_at: object,
+    trust_score: int | None,
+    trust_components: list[dict[str, object]],
+    metadata: dict[str, object],
+) -> dict[str, object]:
+    payload: dict[str, object] = {
+        "source": metadata.get("scannerSource", "unknown"),
+        "layerId": layer_id,
+        "label": label,
+        "status": status,
+        "message": message,
+        "capturedAt": captured_at,
+        "trustScore": trust_score,
+        "componentCount": len(trust_components),
+        "totalFindings": metadata.get("totalFindings", 0),
+        "findingsBySeverity": metadata.get("findingsBySeverity", {}),
+    }
+    for key in (
+        "analyzersUsed",
+        "policyName",
+        "scanMode",
+        "mode",
+        "targetsScanned",
+        "skillsScanned",
+        "skillsSkipped",
+        "durationMs",
+    ):
+        value = metadata.get(key)
+        if value is not None:
+            payload[key] = value
+    return payload
+
+
 def _cisco_severity_counts(run: object) -> dict[str, int]:
     counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
     metadata = getattr(run, "metadata", None)

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -302,7 +302,7 @@ _RUNTIME_SYNC_RETRY_TIMEOUT_SECONDS = 90
 _RECEIPT_SYNC_BATCH_SIZE = 50
 _RECEIPT_SYNC_CURSOR_PAGE_SIZE = 200
 _RECEIPT_SYNC_CURSOR_BACKFILL_ROWS = 200
-_RECEIPT_COMMAND_DETAIL_BACKFILL_DAYS = 7
+_RECEIPT_COMMAND_DETAIL_BACKFILL_DAYS = 30
 _RECEIPT_COMMAND_DETAIL_BACKFILL_LIMIT = 5000
 _PAIN_SIGNAL_TIMEOUT_SECONDS = 10
 _PAIN_SIGNAL_RETRY_TIMEOUT_SECONDS = 90
@@ -4079,7 +4079,7 @@ _RECEIPT_REDACTION_LEVEL_RANK: dict[str, int] = {
     "none": 2,
 }
 _RELAXED_RECEIPT_REDACTION_RESYNC_MARKER = "cloud_receipt_redaction_relaxed_resync_v1"
-_RECEIPT_COMMAND_DETAIL_BACKFILL_MARKER = "cloud_receipt_command_detail_backfill_v1"
+_RECEIPT_COMMAND_DETAIL_BACKFILL_MARKER = "cloud_receipt_command_detail_backfill_v2"
 
 
 def _receipt_redaction_level_rank(level: str | None) -> int:

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/src/codex_plugin_scanner/guard/store_receipts.py

@@ -239,7 +239,7 @@ class StoreReceiptsRuntimeMixin:
         query = self._receipt_base_query(
             f"""
             where r.timestamp >= ?
-              and r.policy_decision in ('block', 'review', 'require-reapproval')
+              and r.policy_decision in ('block', 'review', 'require-reapproval', 'sandbox-required')
               and (e.envelope_full_json is not null or a.action_envelope_json is not null)
               {rowid_clause}
             order by r.rowid desc

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.962"
+__version__ = "2.0.964"

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/tests/test_guard_inventory_contract.py

@@ -21,6 +21,7 @@ from codex_plugin_scanner.guard.inventory_contract import (
     serialize_inventory_snapshot,
 )
 from codex_plugin_scanner.guard.models import GuardArtifact, HarnessDetection
+from codex_plugin_scanner.guard.runtime.evidence_hash import guard_evidence_hash
 from codex_plugin_scanner.models import Finding, Severity
 
 
@@ -468,6 +469,9 @@ def test_inventory_snapshot_attaches_cisco_mcp_trust_layer_to_server_and_tool(tm
         and layer.get("trustScore") == 70
         and isinstance(layer.get("metadata"), dict)
         and layer["metadata"].get("attestationStatus") == "unsigned"
+        and isinstance(layer["metadata"].get("evidence"), dict)
+        and layer["metadata"]["evidence"].get("status") == "enabled"
+        and layer["metadata"]["evidence"].get("trustScore") == 70
         and isinstance(layer["metadata"].get("evidenceHash"), str)
         for layer in server_layers
     )
@@ -486,6 +490,80 @@ def test_inventory_snapshot_attaches_cisco_mcp_trust_layer_to_server_and_tool(tm
     assert str(workspace) not in encoded
 
 
+def test_inventory_snapshot_attaches_cisco_unavailable_status_evidence(tmp_path: Path) -> None:
+    workspace = tmp_path / "repo"
+    workspace.mkdir()
+    mcp_file = workspace / ".mcp.json"
+    mcp_file.write_text('{"mcpServers": {"local-demo": {"command": "python"}}}\n', encoding="utf-8")
+    detection = HarnessDetection(
+        harness="codex",
+        installed=True,
+        command_available=True,
+        config_paths=(str(mcp_file),),
+        artifacts=(
+            GuardArtifact(
+                artifact_id="codex:project:mcp:local-demo",
+                name="local-demo",
+                harness="codex",
+                artifact_type="mcp_server",
+                source_scope="project",
+                config_path=str(mcp_file),
+                transport="stdio",
+            ),
+        ),
+    )
+    cisco_run = CiscoInventoryRun(
+        source="cisco-mcp-scanner",
+        status="unavailable",
+        message="Cisco MCP scanner runtime unavailable.",
+        findings=(),
+        duration_ms=cast(Any, None),
+        metadata={
+            "target": ".mcp.json",
+            "_targetPath": str(workspace),
+            "_configPath": str(mcp_file),
+            "targetsScanned": 0,
+            "totalFindings": 0,
+            "findingsBySeverity": {"critical": 0, "high": 0, "medium": 0, "low": 0},
+            "analyzersUsed": [],
+            "scanMode": "static",
+            "mode": "auto",
+        },
+    )
+
+    snapshot = inventory_snapshot_from_detection(
+        detection,
+        generated_at="2026-06-10T00:00:00Z",
+        home_dir=tmp_path,
+        workspace_dir=workspace,
+        cisco_runs=(cisco_run,),
+    )
+    server_item = next(item for item in snapshot.items if item.item_kind == "mcp_server")
+    trust_layers = server_item.metadata.get("trustLayers")
+    encoded = json.dumps(serialize_inventory_snapshot(snapshot), sort_keys=True)
+
+    assert isinstance(trust_layers, list)
+    cisco_layer = next(
+        layer for layer in trust_layers if isinstance(layer, dict) and layer.get("layerType") == "cisco_mcp_scanner"
+    )
+    assert cisco_layer.get("status") == "unavailable"
+    assert cisco_layer.get("trustScore") is None
+    assert cisco_layer.get("trustComponents") == []
+    metadata = cisco_layer.get("metadata")
+    assert isinstance(metadata, dict)
+    assert metadata.get("evidenceSchemaVersion") == "guard-aibom-cisco-scanner-evidence.v1"
+    assert "durationMs" not in metadata
+    evidence = metadata.get("evidence")
+    assert isinstance(evidence, dict)
+    assert evidence.get("status") == "unavailable"
+    assert evidence.get("message") == "Cisco MCP scanner runtime unavailable."
+    assert evidence.get("totalFindings") == 0
+    assert evidence.get("targetsScanned") == 0
+    assert "durationMs" not in evidence
+    assert metadata.get("evidenceHash") == guard_evidence_hash(evidence)
+    assert str(workspace) not in encoded
+
+
 def test_inventory_snapshot_handles_missing_mcp_tool_schema_and_scale(tmp_path: Path) -> None:
     tools = [{"name": f"tool_{index}", "description": "No schema available."} for index in range(500)]
     detection = HarnessDetection(

plugin_scanner-2.0.964/tests/test_guard_receipt_command_detail_backfill.py

@@ -0,0 +1,119 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from codex_plugin_scanner.guard.models import GuardReceipt
+from codex_plugin_scanner.guard.runtime.actions import GuardActionEnvelope
+from codex_plugin_scanner.guard.runtime.runner import (
+    _cloud_sync_receipt_payload,
+    _receipt_sync_rows_with_command_detail_backfill,
+)
+from codex_plugin_scanner.guard.store import GuardStore
+
+
+def _store_command_receipt(
+    store: GuardStore,
+    *,
+    receipt_id: str,
+    policy_decision: str = "block",
+) -> None:
+    store.add_receipt(
+        GuardReceipt(
+            receipt_id=receipt_id,
+            timestamp=datetime.now(timezone.utc).isoformat(),
+            harness="codex",
+            artifact_id=f"codex:tool-action:{receipt_id}",
+            artifact_hash=f"hash-{receipt_id}",
+            policy_decision=policy_decision,
+            capabilities_summary="tool action request",
+            changed_capabilities=(),
+            provenance_summary="",
+            user_override=None,
+            artifact_name="bash",
+            source_scope="project",
+            diff_summary=None,
+            approval_source=None,
+            approval_request_id=None,
+            scanner_evidence=(),
+            browser_intent=None,
+        ),
+        action_envelope=GuardActionEnvelope(
+            schema_version=1,
+            action_id=f"action-{receipt_id}",
+            harness="codex",
+            event_name="PreToolUse",
+            action_type="shell_command",
+            workspace=None,
+            workspace_hash="workspace",
+            tool_name="bash",
+            command="cd repo && npx vitest run example.test.ts --reporter=verbose",
+            prompt_excerpt=None,
+            prompt_text=None,
+            target_paths=(),
+            network_hosts=(),
+            mcp_server=None,
+            mcp_tool=None,
+            package_manager=None,
+            package_name=None,
+            package_intent_kind=None,
+            package_targets=(),
+        ),
+    )
+
+
+def test_command_detail_backfill_ignores_legacy_v1_completion_marker(tmp_path) -> None:
+    store = GuardStore(tmp_path)
+    _store_command_receipt(store, receipt_id="guard-receipt-backfill-v2")
+    store.set_sync_payload(
+        "cloud_receipt_command_detail_backfill_v1",
+        {"level": "none", "updated_at": "2026-04-15T00:01:00Z", "complete": True},
+        "2026-04-15T00:01:00Z",
+    )
+
+    rows, marker = _receipt_sync_rows_with_command_detail_backfill(
+        store,
+        receipts=[],
+        redaction_level="none",
+        synced_at="2026-04-15T00:02:00Z",
+    )
+
+    assert [row["receipt_id"] for row in rows] == ["guard-receipt-backfill-v2"]
+    assert marker is not None
+    assert marker["complete"] is True
+
+
+def test_command_detail_backfill_replays_sandbox_required_receipts(tmp_path) -> None:
+    store = GuardStore(tmp_path)
+    _store_command_receipt(
+        store,
+        receipt_id="guard-receipt-sandbox-required",
+        policy_decision="sandbox-required",
+    )
+
+    rows, marker = _receipt_sync_rows_with_command_detail_backfill(
+        store,
+        receipts=[],
+        redaction_level="none",
+        synced_at="2026-04-15T00:02:00Z",
+    )
+
+    assert [row["receipt_id"] for row in rows] == ["guard-receipt-sandbox-required"]
+    assert marker is not None
+
+
+def test_redaction_disabled_backfill_payload_keeps_review_command_detail(tmp_path) -> None:
+    store = GuardStore(tmp_path)
+    _store_command_receipt(store, receipt_id="guard-receipt-command-payload")
+    receipt = store.get_receipt("guard-receipt-command-payload")
+    assert receipt is not None
+
+    payload = _cloud_sync_receipt_payload(
+        receipt,
+        device_id="device",
+        device_name="Developer Mac",
+        redaction_level="none",
+    )
+
+    envelope = payload["envelopeRedacted"]
+    assert isinstance(envelope, dict)
+    assert envelope["command"] == "cd repo && npx vitest run example.test.ts --reporter=verbose"

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/tests/test_guard_receipt_redaction_cursor.py

@@ -360,7 +360,7 @@ def test_relaxed_redaction_sync_adds_recent_blocked_command_detail_backfill(tmp_
     assert marker == {
         "level": "partial",
         "updated_at": "2026-04-15T00:01:00Z",
-        "days": 7,
+        "days": 30,
         "limit": 5000,
         "receipts": 1,
         "queried": 1,

{plugin_scanner-2.0.962 → plugin_scanner-2.0.964}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.962"
+version = "2.0.964"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },