plugin-scanner 2.0.966__tar.gz → 2.0.967__tar.gz

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.966
+Version: 2.0.967
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.966"
+version = "2.0.967"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.966"
+version = "2.0.967"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/src/codex_plugin_scanner/guard/adapters/pi_extension_source.py

@@ -322,10 +322,6 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "  return trimmed.length > 0 ? trimmed : null;\n"
         "}\n"
         "\n"
-        "function guardOpenKey(): string {\n"
-        "  return randomBytes(8).toString('hex');\n"
-        "}\n"
-        "\n"
         "function base64Url(value: Buffer): string {\n"
         "  return value.toString('base64url');\n"
         "}\n"
@@ -354,7 +350,6 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "    config_path: payload.config_path,\n"
         "    tool_name: payload.tool_name,\n"
         "    is_error: payload.is_error,\n"
-        "    guard_operation_open_key: payload.guard_operation_open_key,\n"
         "    guard_payload_ref: {\n"
         "      version: 1,\n"
         "      path,\n"
@@ -518,6 +513,14 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         '  return { decision: "allow" };\n'
         "}\n"
         "\n"
+        "function modelVisibleBlockedReason(reason: string): string {\n"
+        '  const prefix = "HOL Guard blocked this tool output before Pi could use it.";\n'
+        "  const approvalUrl = reason.match(/https?:\\/\\/\\S+/)?.[0]?.replace(/[.,;:]+$/, '');\n"
+        "  const approvalHint = approvalUrl ? ` Human approval is pending in HOL Guard: ${approvalUrl}.` : '';\n"
+        "  return `${prefix}${approvalHint} Do not retry the same tool call automatically; wait for the user to "
+        "approve or change the task.`;\n"
+        "}\n"
+        "\n"
         "function blockedToolResult(reason: string, details: unknown) {\n"
         "  return {\n"
         '    content: [{ type: "text", text: reason }],\n'
@@ -548,8 +551,7 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         '  pi.on("input", async (event, ctx) => {\n'
         '    if (event.source === "extension") return { action: "continue" };\n'
         "    const response = await runGuard(\n"
-        '      { hook_event_name: "UserPromptSubmit", prompt: event.text, config_path: GUARD_CONFIG_PATH,\n'
-        "        guard_operation_open_key: guardOpenKey() },\n"
+        '      { hook_event_name: "UserPromptSubmit", prompt: event.text, config_path: GUARD_CONFIG_PATH },\n'
         "      ctx.cwd,\n"
         "    );\n"
         '    if (response.decision === "deny") {\n'
@@ -570,7 +572,6 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "        config_path: GUARD_CONFIG_PATH,\n"
         "        tool_name: event.toolName,\n"
         "        tool_input: toolInput,\n"
-        "        guard_operation_open_key: guardOpenKey(),\n"
         "      },\n"
         "      ctx.cwd,\n"
         "    );\n"
@@ -616,7 +617,6 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "        tool_input: toolInput,\n"
         "        stdout: toolOutput,\n"
         "        is_error: event.isError === true,\n"
-        "        guard_operation_open_key: guardOpenKey(),\n"
         "    };\n"
         "    if (sourceRef) {\n"
         "      guardPayload.guard_source_ref = sourceRef;\n"
@@ -637,10 +637,11 @@ def managed_extension_source(*, guard_home: Path, home_dir: Path, settings_path:
         "    );\n"
         '    if (response.decision === "deny") {\n'
         '      const reason = response.reason ?? "Blocked by HOL Guard.";\n'
+        "      const modelReason = modelVisibleBlockedReason(reason);\n"
         "      const toolCallId = toolCallIdKey(event.toolCallId);\n"
-        "      if (toolCallId) blockedToolResults.set(toolCallId, reason);\n"
+        "      if (toolCallId) blockedToolResults.set(toolCallId, modelReason);\n"
         '      ctx.ui.notify(reason, "warning");\n'
-        "      return blockedToolResult(reason, event.details);\n"
+        "      return blockedToolResult(modelReason, event.details);\n"
         "    }\n"
         "    if (outputTruncated) {\n"
         '      if (response.model_output_action === "allow_original" &&\n'

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py

@@ -4,7 +4,6 @@
 
 from __future__ import annotations
 
-from collections.abc import Mapping
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -176,7 +175,7 @@ def _review_runtime_artifact_hook(
                             config.approval_surface_policy,
                             approval_flow,
                         ),
-                        open_key=_approval_open_key(args.harness, artifact_id, payload_map),
+                        open_key=artifact_id,
                         redaction_level=config.receipt_redaction_level,
                     )
                     operation = blocked_operation.get("operation")
@@ -375,7 +374,7 @@ def _review_runtime_artifact_hook(
                         config.approval_surface_policy,
                         approval_flow,
                     ),
-                    open_key=_approval_open_key(args.harness, artifact_id, payload_map),
+                    open_key=artifact_id,
                     redaction_level=config.receipt_redaction_level,
                 )
                 operation = blocked_operation.get("operation")
@@ -440,17 +439,6 @@ def _review_runtime_artifact_hook(
     return None
 
 
-def _approval_open_key(harness: str, artifact_id: str, payload: Mapping[str, object] | None = None) -> str:
-    if _canonical_harness_name(harness) == "pi":
-        operation_open_key = (
-            _optional_string(payload.get("guard_operation_open_key")) if isinstance(payload, Mapping) else None
-        )
-        if operation_open_key is not None:
-            return f"pi-approval-center:{operation_open_key}"
-    return artifact_id
-
-
 __all__ = [
-    "_approval_open_key",
     "_review_runtime_artifact_hook",
 ]

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/src/codex_plugin_scanner/guard/runtime/surface_server.py

@@ -256,17 +256,22 @@ class GuardSurfaceRuntime:
             request_id = item.get("request_id")
             if isinstance(request_id, str):
                 seed_request_resume_record(self.store, request_id=request_id, now=_now())
+        approval_open_key = self._approval_surface_open_key(
+            queued,
+            fallback=open_key or str(waiting_operation["operation_id"]),
+        )
         review_url = first_approval_url(
             queued,
             harness=harness,
             approval_center_url=approval_center_url,
+            request_id=_request_id_from_open_key(approval_open_key),
         )
         surface = self.ensure_surface(
             surface="approval-center",
             approval_center_url=approval_center_url,
             browser_url=_browser_url_for_review(browser_url, review_url),
             approval_surface_policy=approval_surface_policy,
-            open_key=open_key or str(waiting_operation["operation_id"]),
+            open_key=approval_open_key,
             opener=opener,
         )
         return {
@@ -370,6 +375,15 @@ class GuardSurfaceRuntime:
             self.record_surface_open(surface=surface, open_key=open_key)
         return {"surface": surface, "opened": True, "reason": "opened", "open_key": open_key}
 
+    def _approval_surface_open_key(self, queued: list[dict[str, object]], *, fallback: str) -> str:
+        request_keys = _approval_request_open_keys(queued)
+        for _request_id, open_key in request_keys:
+            if not self.has_surface_opened("approval-center", open_key):
+                return open_key
+        if request_keys:
+            return request_keys[0][1]
+        return fallback
+
     def _set_session_status(self, session_id: str, status: str) -> None:
         current = self.store.get_guard_session(session_id)
         if current is None:
@@ -463,6 +477,25 @@ def _browser_url_for_review(browser_url: str | None, review_url: str | None) ->
     return review_url
 
 
+def _approval_request_open_keys(queued: list[dict[str, object]]) -> list[tuple[str, str]]:
+    request_keys: list[tuple[str, str]] = []
+    for item in queued:
+        request_id = item.get("request_id")
+        if isinstance(request_id, str) and request_id.strip():
+            stripped = request_id.strip()
+            request_keys.append((stripped, f"approval-request:{stripped}"))
+    return request_keys
+
+
+def _request_id_from_open_key(open_key: str) -> str | None:
+    prefix = "approval-request:"
+    if open_key.startswith(prefix):
+        request_id = open_key[len(prefix) :].strip()
+        if request_id:
+            return request_id
+    return None
+
+
 def _same_origin(left: ParseResult, right: ParseResult) -> bool:
     return (left.scheme, left.netloc) == (right.scheme, right.netloc)
 

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.966"
+__version__ = "2.0.967"

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/tests/test_guard_surface_server.py

@@ -1911,6 +1911,98 @@ class TestGuardSurfaceServer:
 
         assert store.list_guard_operations(session_id=str(session["session_id"])) == []
 
+    def test_surface_runtime_opens_new_request_when_mixed_with_reused_request(self, tmp_path) -> None:
+        store = GuardStore(tmp_path / "guard-home")
+        runtime = GuardSurfaceRuntime(store)
+        opened_urls: list[str] = []
+        session = runtime.start_session(
+            harness="pi",
+            surface="harness-adapter",
+            workspace=str(tmp_path / "workspace"),
+            client_name="pi-hook",
+        )
+        artifact_a = GuardArtifact(
+            artifact_id="pi:project:tool-output:a",
+            name="Bash credential-looking output",
+            harness="pi",
+            artifact_type="tool_action_request",
+            source_scope="project",
+            config_path="~/.pi/agent/settings.json",
+            metadata={},
+        )
+        artifact_b = GuardArtifact(
+            artifact_id="pi:project:tool-output:b",
+            name="Bash credential-looking output",
+            harness="pi",
+            artifact_type="tool_action_request",
+            source_scope="project",
+            config_path="~/.pi/agent/settings.json",
+            metadata={},
+        )
+
+        def block_payload(*artifacts: GuardArtifact) -> tuple[dict[str, object], dict[str, object]]:
+            return (
+                {
+                    "harness": "pi",
+                    "installed": True,
+                    "command_available": True,
+                    "config_paths": ["~/.pi/agent/settings.json"],
+                    "artifacts": [artifact.to_dict() for artifact in artifacts],
+                },
+                {
+                    "artifacts": [
+                        {
+                            "artifact_id": artifact.artifact_id,
+                            "artifact_name": artifact.name,
+                            "artifact_hash": f"hash-{artifact.artifact_id[-1]}",
+                            "artifact_type": artifact.artifact_type,
+                            "source_scope": artifact.source_scope,
+                            "config_path": artifact.config_path,
+                            "policy_action": "require-reapproval",
+                            "changed_fields": ["tool_response"],
+                            "launch_target": f"rg deps.config #{artifact.artifact_id[-1]}",
+                        }
+                        for artifact in artifacts
+                    ]
+                },
+            )
+
+        detection, evaluation = block_payload(artifact_a)
+        first = runtime.queue_blocked_operation(
+            session_id=str(session["session_id"]),
+            operation_type="tool_call",
+            harness="pi",
+            metadata={"event": "PostToolUse"},
+            detection=detection,
+            evaluation=evaluation,
+            approval_center_url="http://127.0.0.1:5474",
+            browser_url="http://127.0.0.1:5474#guard-token=session-token",
+            approval_surface_policy="auto-open-once",
+            open_key="pi-run",
+            opener=lambda url: opened_urls.append(url) or True,
+        )
+        detection, evaluation = block_payload(artifact_a, artifact_b)
+        second = runtime.queue_blocked_operation(
+            session_id=str(session["session_id"]),
+            operation_type="tool_call",
+            harness="pi",
+            metadata={"event": "PostToolUse"},
+            detection=detection,
+            evaluation=evaluation,
+            approval_center_url="http://127.0.0.1:5474",
+            browser_url="http://127.0.0.1:5474#guard-token=session-token",
+            approval_surface_policy="auto-open-once",
+            open_key="pi-run",
+            opener=lambda url: opened_urls.append(url) or True,
+        )
+
+        first_request_id = str(first["approval_requests"][0]["request_id"])
+        second_request_id = str(second["approval_requests"][1]["request_id"])
+        assert str(second["approval_requests"][0]["request_id"]) == first_request_id
+        assert len(opened_urls) == 2
+        assert urllib.parse.urlparse(opened_urls[0]).path == f"/requests/{first_request_id}"
+        assert urllib.parse.urlparse(opened_urls[1]).path == f"/requests/{second_request_id}"
+
     def test_surface_runtime_preserves_prompt_request_explanation(self, tmp_path) -> None:
         store = GuardStore(tmp_path / "guard-home")
         runtime = GuardSurfaceRuntime(store)
@@ -2549,9 +2641,10 @@ class TestGuardSurfaceServer:
             with urllib.request.urlopen(first_block_request, timeout=5) as response:
                 first_block_response = json.loads(response.read().decode("utf-8"))
 
+            second_block_payload = {**block_payload, "open_key": "run-operation-retry"}
             second_block_request = urllib.request.Request(
                 f"http://127.0.0.1:{daemon.port}/v1/operations/block",
-                data=json.dumps(block_payload).encode("utf-8"),
+                data=json.dumps(second_block_payload).encode("utf-8"),
                 headers={
                     "Content-Type": "application/json",
                     "X-Guard-Token": auth_token,
@@ -2570,6 +2663,7 @@ class TestGuardSurfaceServer:
         assert len(first_block_response["approval_requests"]) == 1
         assert first_items[0]["item_type"] == "approval_requested"
         first_request_id = first_block_response["approval_requests"][0]["request_id"]
+        assert second_block_response["approval_requests"][0]["request_id"] == first_request_id
         assert first_items[0]["payload"]["approval_requests"][0]["request_id"] == first_request_id
         assert first_block_response["surface"]["opened"] is True
         assert second_block_response["surface"]["opened"] is False

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/tests/test_pi_adapter.py

@@ -12,8 +12,8 @@ from codex_plugin_scanner.guard.adapters import get_adapter, list_adapters
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
 from codex_plugin_scanner.guard.adapters.contracts import contract_for
 from codex_plugin_scanner.guard.adapters.pi_support import stable_suffix
+from codex_plugin_scanner.guard.approvals import queue_blocked_approvals
 from codex_plugin_scanner.guard.cli.commands_hook_generic import _run_hook_generic_payload
-from codex_plugin_scanner.guard.cli.commands_hook_runtime_review import _approval_open_key
 from codex_plugin_scanner.guard.cli.commands_support_codex_tool_output_messages import (
     _codex_tool_output_request_summary,
     _codex_tool_output_runtime_reason,
@@ -22,7 +22,9 @@ from codex_plugin_scanner.guard.cli.commands_support_codex_tool_output_messages
 from codex_plugin_scanner.guard.cli.commands_support_hook_payload import _approval_surface_policy_for_flow
 from codex_plugin_scanner.guard.cli.commands_support_runtime_artifacts import _codex_post_tool_output_artifact
 from codex_plugin_scanner.guard.config import GuardConfig
+from codex_plugin_scanner.guard.consumer import artifact_hash
 from codex_plugin_scanner.guard.inventory_contract import inventory_snapshot_from_detection
+from codex_plugin_scanner.guard.models import HarnessDetection
 from codex_plugin_scanner.guard.runtime.actions import normalize_harness_payload
 from codex_plugin_scanner.guard.store import GuardStore
 
@@ -77,12 +79,6 @@ class TestPiAdapterIdentity:
         assert flow["prompt_channel"] == "native-fallback"
         assert flow["auto_open_browser"] is True
         assert _approval_surface_policy_for_flow("auto-open-once", flow) == "auto-open-once"
-        assert (
-            _approval_open_key("pi", "pi:project:tool-a", {"guard_operation_open_key": "operation-1"})
-            == "pi-approval-center:operation-1"
-        )
-        assert _approval_open_key("pi", "pi:project:tool-a", {}) == "pi:project:tool-a"
-        assert _approval_open_key("codex", "codex:project:tool-a", {}) == "codex:project:tool-a"
 
     def test_unmanaged_approval_flow_keeps_browser_fallback_visible(self) -> None:
         flow = get_adapter("pi").approval_flow(managed_install=None)
@@ -347,7 +343,12 @@ class TestPiInstall:
         assert "const blockedToolResults = new Map<string, string>();" in text
         assert 'pi.on("message_end"' in text
         assert "const toolCallId = toolCallIdKey(event.toolCallId);" in text
-        assert "if (toolCallId) blockedToolResults.set(toolCallId, reason);" in text
+        assert "function modelVisibleBlockedReason(reason: string): string" in text
+        assert "Do not retry the same tool call automatically" in text
+        assert "const modelReason = modelVisibleBlockedReason(reason);" in text
+        assert "if (toolCallId) blockedToolResults.set(toolCallId, modelReason);" in text
+        assert "return blockedToolResult(modelReason, event.details);" in text
+        assert "return blockedToolResult(reason, event.details);" not in text
         assert "blockedToolResults.delete(toolCallId);" in text
         # Oversized tool results are passed to Guard by reference for full
         # review, not pre-emptively blocked.
@@ -571,6 +572,67 @@ class TestPiRuntime:
             "the exit status, rerun without `2>&1` or keep stderr out of model-visible output."
         )
 
+    def test_pi_repeated_blocked_tool_output_reuses_pending_approval(self, tmp_path: Path) -> None:
+        store = GuardStore(tmp_path / "guard-home")
+        command = 'cd /tmp/fix-skills-503-rb && rg "deps.config" src/api/server/internal/routes.ts 2>&1 | head -5'
+
+        def queue_for(output: str) -> list[dict[str, object]]:
+            payload = {
+                "hook_event_name": "PostToolUse",
+                "tool_name": "Bash",
+                "tool_input": {"command": command},
+                "stdout": output,
+            }
+            artifact = _codex_post_tool_output_artifact(
+                harness="pi",
+                payload=payload,
+                config_path="~/.pi/agent/settings.json",
+                source_scope="project",
+                cwd=tmp_path,
+                home_dir=tmp_path,
+            )
+            assert artifact is not None
+            return queue_blocked_approvals(
+                detection=HarnessDetection(
+                    harness="pi",
+                    installed=True,
+                    command_available=True,
+                    config_paths=("~/.pi/agent/settings.json",),
+                    artifacts=(artifact,),
+                ),
+                evaluation={
+                    "artifacts": [
+                        {
+                            "artifact_id": artifact.artifact_id,
+                            "artifact_name": artifact.name,
+                            "artifact_hash": artifact_hash(artifact),
+                            "policy_action": "require-reapproval",
+                            "changed_fields": ["tool_response"],
+                            "artifact_type": artifact.artifact_type,
+                            "source_scope": artifact.source_scope,
+                            "config_path": artifact.config_path,
+                            "launch_target": artifact.metadata["command_text"],
+                            "risk_summary": artifact.metadata["runtime_request_summary"],
+                            "action_envelope_json": normalize_harness_payload(
+                                "pi",
+                                "PostToolUse",
+                                payload,
+                                workspace=tmp_path,
+                                home_dir=tmp_path,
+                            ).to_dict(),
+                        }
+                    ]
+                },
+                store=store,
+                approval_center_url="http://127.0.0.1:5474",
+            )
+
+        first = queue_for("sk-live-abcdefghijklmnopqrstuvwxyz1234567890")
+        second = queue_for("sk-live-abcdefghijklmnopqrstuvwxyz1234567899")
+
+        assert first[0]["request_id"] == second[0]["request_id"]
+        assert store.get_approval_request(str(first[0]["request_id"]))["dedupe_count"] == 2
+
     def test_pi_block_emits_native_json_and_stderr(self, tmp_path: Path) -> None:
         store = GuardStore(tmp_path / ".hol-guard")
         config = GuardConfig(guard_home=tmp_path / ".hol-guard", workspace=tmp_path)

{plugin_scanner-2.0.966 → plugin_scanner-2.0.967}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.966"
+version = "2.0.967"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },