plugin-scanner 2.0.968__tar.gz → 2.0.969__tar.gz

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.968
+Version: 2.0.969
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.968"
+version = "2.0.969"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.968"
+version = "2.0.969"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/src/codex_plugin_scanner/guard/approval_scope_support.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import hashlib
+import json
 from collections.abc import Mapping
 from pathlib import Path
 
@@ -47,6 +49,26 @@ def resolve_request_workspace_scope(
     return workspace
 
 
+def package_request_portable_workspace_scope(
+    *,
+    artifact_id: str | None,
+    artifact_hash: str | None,
+    artifact_type: str | None = None,
+) -> str | None:
+    if not _is_package_request_artifact(artifact_id=artifact_id, artifact_type=artifact_type):
+        return None
+    if artifact_hash is None or not artifact_hash.strip() or artifact_hash == "unknown":
+        return None
+    material = {
+        "artifact_hash": artifact_hash.strip(),
+        "artifact_id": artifact_id.strip() if artifact_id is not None else None,
+        "scope": "package-request-workspace",
+        "version": 1,
+    }
+    digest = hashlib.sha256(json.dumps(material, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
+    return f"package-request-workspace:v1:{digest}"
+
+
 def _derived_workspace_scope_target(request: Mapping[str, object]) -> str | None:
     stored_workspace = _string_or_none(request.get("workspace"))
     if stored_workspace is not None:
@@ -63,6 +85,12 @@ def _derived_workspace_scope_target(request: Mapping[str, object]) -> str | None
     return str(workspace_root)
 
 
+def _is_package_request_artifact(*, artifact_id: str | None, artifact_type: str | None) -> bool:
+    if artifact_type == "package_request":
+        return True
+    return isinstance(artifact_id, str) and ":package-request:" in artifact_id
+
+
 def _request_scoped_family_key(request: Mapping[str, object]) -> str | None:
     return _artifact_family_key(_string_or_none(request.get("artifact_id")))
 

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/src/codex_plugin_scanner/guard/approvals.py

@@ -15,7 +15,11 @@ from urllib.parse import ParseResult, parse_qsl, urlencode, urlparse, urlunparse
 from .adapters import get_adapter
 from .adapters.base import HarnessContext
 from .approval_gate import ApprovalGateGrant, ApprovalGateInput, require_approval_decision
-from .approval_scope_support import resolve_request_workspace_scope, supported_request_scopes
+from .approval_scope_support import (
+    package_request_portable_workspace_scope,
+    resolve_request_workspace_scope,
+    supported_request_scopes,
+)
 from .cli.connect_flow import (
     connect_retry_refresh_race_from_reason,
     resolve_guard_cloud_repair_detail,
@@ -501,11 +505,18 @@ def apply_approval_resolution(
         raise ValueError(f"Unsupported approval scope: {scope}")
     if scope not in supported_request_scopes(request):
         raise ValueError("unsupported_request_scope")
-    resolved_workspace = resolve_request_workspace_scope(request, workspace) if scope == "workspace" else None
     workspace_artifact_id, workspace_artifact_hash = _workspace_policy_artifact_keys(request, scope)
     request_artifact_id = _string_or_none(request.get("artifact_id"))
     request_artifact_hash = _string_or_none(request.get("artifact_hash"))
     request_publisher = _string_or_none(request.get("publisher"))
+    resolved_workspace = resolve_request_workspace_scope(request, workspace) if scope == "workspace" else None
+    portable_package_workspace = package_request_portable_workspace_scope(
+        artifact_id=request_artifact_id,
+        artifact_hash=request_artifact_hash,
+        artifact_type=_string_or_none(request.get("artifact_type")),
+    )
+    if scope == "workspace" and portable_package_workspace is not None:
+        resolved_workspace = portable_package_workspace
     scoped_artifact_id = request_artifact_id if scope in {"artifact", "harness", "global"} else workspace_artifact_id
     scoped_artifact_hash = request_artifact_hash if scope == "artifact" else workspace_artifact_hash
     artifact_runtime_exact_match_key = _artifact_scope_runtime_exact_match_key(request, scope)

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/src/codex_plugin_scanner/guard/local_supply_chain.py

@@ -26,6 +26,7 @@ from codex_plugin_scanner.path_support import resolve_path_within_allowed_roots,
 
 from .adapters.base import HarnessContext
 from .advisory_model import ProtectTargetIdentity, advisory_matches_target, build_package_url
+from .approval_scope_support import package_request_portable_workspace_scope
 from .config import GuardConfig, resolve_risk_action
 from .models import GuardAction, GuardArtifact, GuardReceipt
 from .redaction import redact_local_path, redact_text
@@ -1408,14 +1409,22 @@ def _apply_stored_package_policy_override(
     workspace_dir: Path,
     now: str,
 ) -> Any:
-    decision = store.resolve_policy_decision(
-        artifact.harness,
-        artifact.artifact_id,
-        artifact_hash,
-        str(workspace_dir),
-        artifact.publisher,
-        now,
-    )
+    decision = None
+    for policy_workspace in _package_policy_workspace_candidates(
+        artifact=artifact,
+        artifact_hash=artifact_hash,
+        workspace_dir=workspace_dir,
+    ):
+        decision = store.resolve_policy_decision(
+            artifact.harness,
+            artifact.artifact_id,
+            artifact_hash,
+            policy_workspace,
+            artifact.publisher,
+            now,
+        )
+        if isinstance(decision, dict):
+            break
     if not isinstance(decision, dict):
         return evaluation
     if _stored_package_policy_is_stale_policy_bundle_family(decision, store=store):
@@ -1458,6 +1467,24 @@ def _apply_stored_package_policy_override(
     return evaluation
 
 
+def _package_policy_workspace_candidates(
+    *,
+    artifact: GuardArtifact,
+    artifact_hash: str,
+    workspace_dir: Path,
+) -> tuple[str, ...]:
+    candidates: list[str] = []
+    portable_workspace = package_request_portable_workspace_scope(
+        artifact_id=artifact.artifact_id,
+        artifact_hash=artifact_hash,
+        artifact_type=artifact.artifact_type,
+    )
+    if portable_workspace is not None:
+        candidates.append(portable_workspace)
+    candidates.append(str(workspace_dir))
+    return tuple(dict.fromkeys(candidates))
+
+
 def _stored_package_policy_is_stale_policy_bundle_family(decision: dict[str, object], *, store: Any) -> bool:
     """Ignore package family rows only when the current bundle proves they are stale."""
 

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/src/codex_plugin_scanner/guard/store_base.py

@@ -26,6 +26,7 @@ from uuid import uuid4
 
 from cryptography.fernet import Fernet, InvalidToken
 
+from .approval_scope_support import package_request_portable_workspace_scope
 from .approval_gate import ApprovalGateGrant, require_policy_clear, require_policy_write, require_request_resolution
 from .cli.oauth_client import resolve_guard_oauth_client_config
 from .edge_events import build_receipt_event

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/src/codex_plugin_scanner/guard/store_policy.py

@@ -191,6 +191,12 @@ class StorePolicyMixin:
     ) -> PolicyDecisionLookupResult:
         current_time = now or _now()
         workspace_key = _workspace_policy_key(workspace)
+        portable_workspace_key = _workspace_policy_key(
+            package_request_portable_workspace_scope(
+                artifact_id=artifact_id,
+                artifact_hash=artifact_hash,
+            )
+        )
         action_family_key = _artifact_family_key(artifact_id)
         runtime_exact_match_key = (
             _runtime_scoped_exact_match_key(artifact_id, runtime_exact_match_context)
@@ -245,7 +251,7 @@ class StorePolicyMixin:
                     )
                   )
                   or (
-                    scope = 'workspace' and (workspace = ? or workspace = ?) and (
+                    scope = 'workspace' and (workspace = ? or workspace = ? or workspace = ?) and (
                       artifact_id is null or (
                         artifact_id = ? and (
                           artifact_hash is null or (? is not null and artifact_hash = ?)
@@ -285,6 +291,7 @@ class StorePolicyMixin:
                     runtime_exact_match_key,
                     workspace_key,
                     workspace,
+                    portable_workspace_key,
                     artifact_id,
                     artifact_hash,
                     artifact_hash,

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.968"
+__version__ = "2.0.969"

plugin_scanner-2.0.969/tests/test_guard_manifest_install_firewall.py

@@ -0,0 +1,388 @@
+"""Regression tests for manifest-only install supply-chain coverage."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from codex_plugin_scanner.guard.approvals import apply_approval_resolution
+from codex_plugin_scanner.guard.local_supply_chain import (
+    _package_policy_workspace_candidates,
+    build_package_protect_payload,
+)
+from codex_plugin_scanner.guard.models import GuardApprovalRequest, PolicyDecision
+from codex_plugin_scanner.guard.runtime.package_intent import build_package_request_artifact
+from codex_plugin_scanner.guard.runtime.package_intent_parser import parse_package_intent
+from codex_plugin_scanner.guard.runtime.supply_chain_package_eval import evaluate_package_request_artifact
+from codex_plugin_scanner.guard.store import GuardStore
+
+
+@pytest.fixture(autouse=True)
+def _fake_policy_integrity_keyring(install_fake_system_keyring) -> None:
+    install_fake_system_keyring()
+
+
+def _write_pnpm_workspace(workspace_dir: Path, *, extra_dependency: str | None = None) -> None:
+    dependencies = {"lodash": "^4.17.21"}
+    if extra_dependency is not None:
+        dependencies[extra_dependency] = "^1.0.0"
+    (workspace_dir / "package.json").write_text(
+        json.dumps({"name": "demo", "dependencies": dependencies}, indent=2),
+        encoding="utf-8",
+    )
+    (workspace_dir / "pnpm-lock.yaml").write_text(
+        "\n".join(
+            [
+                "lockfileVersion: '9.0'",
+                "packages:",
+                "  lodash@4.17.21:",
+                "    resolution: {integrity: sha256-demo}",
+                "importers:",
+                "  .:",
+                "    dependencies:",
+                "      lodash: 4.17.21",
+            ]
+        ),
+        encoding="utf-8",
+    )
+
+
+def test_parse_package_intent_supports_pnpm_install_alias(tmp_path: Path) -> None:
+    _write_pnpm_workspace(tmp_path)
+
+    intent = parse_package_intent("pnpm i", workspace=tmp_path)
+
+    assert intent is not None
+    assert intent.package_manager == "pnpm"
+    assert intent.intent_kind == "install"
+    assert intent.targets == ()
+    assert intent.manifest_paths == ("package.json",)
+    assert intent.lockfile_paths == ("pnpm-lock.yaml",)
+
+
+def test_evaluate_package_request_artifact_requires_review_for_unsynced_manifest_dependency(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_pnpm_workspace(workspace_dir, extra_dependency="evilpkg")
+
+    intent = parse_package_intent("pnpm install", workspace=workspace_dir)
+    assert intent is not None
+    artifact = build_package_request_artifact(
+        "guard-cli",
+        intent,
+        config_path="hol-guard.toml",
+        source_scope="project",
+    )
+
+    result = evaluate_package_request_artifact(
+        artifact=artifact,
+        store=store,
+        workspace_dir=workspace_dir,
+        now="2026-06-14T00:00:00Z",
+    )
+
+    assert result.decision == "ask"
+    assert result.policy_action == "require-reapproval"
+    assert any(
+        isinstance(reason, dict) and reason.get("code") == "manifest_lockfile_unsynced" for reason in result.reasons
+    )
+    assert any(package.get("name") == "evilpkg" for package in result.packages)
+
+
+def test_build_package_protect_payload_reprompts_after_manifest_edit_despite_saved_allow(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_pnpm_workspace(workspace_dir)
+    command = ["pnpm", "install"]
+
+    baseline_payload, baseline_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=True,
+        now="2026-06-14T00:00:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+    assert baseline_rc == 0
+    receipt = baseline_payload["receipt"]
+    assert isinstance(receipt, dict)
+    store.ensure_policy_integrity_ready_for_write(now="2026-06-14T00:00:00Z")
+    store.upsert_policy(
+        PolicyDecision(
+            harness="guard-cli",
+            scope="artifact",
+            action="allow",
+            artifact_id=str(receipt["artifact_id"]),
+            artifact_hash=str(receipt["artifact_hash"]),
+            workspace=str(workspace_dir),
+            publisher=None,
+            reason="reviewed",
+        ),
+        "2026-06-14T00:00:00Z",
+    )
+
+    _write_pnpm_workspace(workspace_dir, extra_dependency="evilpkg")
+    retry_payload, retry_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=True,
+        now="2026-06-14T00:01:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+
+    assert retry_rc == 2
+    assert retry_payload["verdict"]["action"] == "review"
+    evaluation = retry_payload["supply_chain_evaluation"]
+    assert isinstance(evaluation, dict)
+    assert evaluation["decision"] == "ask"
+    assert not any(
+        isinstance(reason, dict) and reason.get("code") == "saved_package_approval"
+        for reason in evaluation.get("reasons", [])
+    )
+
+
+def test_workspace_package_approval_reuses_same_lockfile_across_worktrees(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    workspace_dir = tmp_path / "workspace"
+    worktree_dir = tmp_path / "workspace-worktree"
+    workspace_dir.mkdir()
+    worktree_dir.mkdir()
+    _write_pnpm_workspace(workspace_dir, extra_dependency="evilpkg")
+    _write_pnpm_workspace(worktree_dir, extra_dependency="evilpkg")
+    command = ["pnpm", "install"]
+
+    baseline_payload, baseline_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=True,
+        now="2026-06-14T00:00:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+    assert baseline_rc == 2
+    receipt = baseline_payload["receipt"]
+    assert isinstance(receipt, dict)
+    store.add_approval_request(
+        GuardApprovalRequest(
+            request_id="req-pnpm-workspace",
+            harness="guard-cli",
+            artifact_id=str(receipt["artifact_id"]),
+            artifact_name="pnpm install pnpm",
+            artifact_type="package_request",
+            artifact_hash=str(receipt["artifact_hash"]),
+            policy_action="require-reapproval",
+            recommended_scope="workspace",
+            changed_fields=("package_request",),
+            source_scope="project",
+            config_path=str(workspace_dir / "hol-guard.toml"),
+            workspace=str(workspace_dir),
+            launch_target="pnpm install",
+            review_command="hol-guard approvals approve req-pnpm-workspace",
+            approval_url="http://127.0.0.1:4455/approvals/req-pnpm-workspace",
+        ),
+        "2026-06-14T00:00:30Z",
+    )
+    apply_approval_resolution(
+        store=store,
+        request_id="req-pnpm-workspace",
+        action="allow",
+        scope="workspace",
+        workspace=str(workspace_dir),
+        reason="same dependency graph",
+        now="2026-06-14T00:01:00Z",
+    )
+
+    retry_payload, retry_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=worktree_dir,
+        dry_run=True,
+        now="2026-06-14T00:02:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+
+    assert retry_rc == 0
+    assert retry_payload["verdict"]["action"] == "allow"
+    retry_receipt = retry_payload["receipt"]
+    assert isinstance(retry_receipt, dict)
+    assert retry_receipt["artifact_id"] == receipt["artifact_id"]
+    assert retry_receipt["artifact_hash"] == receipt["artifact_hash"]
+    evaluation = retry_payload["supply_chain_evaluation"]
+    assert isinstance(evaluation, dict)
+    assert any(
+        isinstance(reason, dict) and reason.get("code") == "saved_package_approval"
+        for reason in evaluation.get("reasons", [])
+    )
+
+
+def test_package_policy_workspace_candidates_prefer_portable_scope(tmp_path: Path) -> None:
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_pnpm_workspace(workspace_dir, extra_dependency="evilpkg")
+    intent = parse_package_intent("pnpm install", workspace=workspace_dir)
+    assert intent is not None
+    artifact = build_package_request_artifact(
+        "guard-cli",
+        intent,
+        config_path="hol-guard.toml",
+        source_scope="project",
+    )
+
+    candidates = _package_policy_workspace_candidates(
+        artifact=artifact,
+        artifact_hash="hash-package",
+        workspace_dir=workspace_dir,
+    )
+
+    assert candidates[0].startswith("package-request-workspace:v1:")
+    assert candidates[1] == str(workspace_dir)
+
+
+def test_workspace_package_approval_still_reprompts_when_worktree_lockfile_changes(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    workspace_dir = tmp_path / "workspace"
+    worktree_dir = tmp_path / "workspace-worktree"
+    workspace_dir.mkdir()
+    worktree_dir.mkdir()
+    _write_pnpm_workspace(workspace_dir, extra_dependency="evilpkg")
+    _write_pnpm_workspace(worktree_dir, extra_dependency="evilpkg")
+    command = ["pnpm", "install"]
+
+    baseline_payload, baseline_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=True,
+        now="2026-06-14T00:00:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+    assert baseline_rc == 2
+    receipt = baseline_payload["receipt"]
+    assert isinstance(receipt, dict)
+    store.add_approval_request(
+        GuardApprovalRequest(
+            request_id="req-pnpm-workspace",
+            harness="guard-cli",
+            artifact_id=str(receipt["artifact_id"]),
+            artifact_name="pnpm install pnpm",
+            artifact_type="package_request",
+            artifact_hash=str(receipt["artifact_hash"]),
+            policy_action="require-reapproval",
+            recommended_scope="workspace",
+            changed_fields=("package_request",),
+            source_scope="project",
+            config_path=str(workspace_dir / "hol-guard.toml"),
+            workspace=str(workspace_dir),
+            launch_target="pnpm install",
+            review_command="hol-guard approvals approve req-pnpm-workspace",
+            approval_url="http://127.0.0.1:4455/approvals/req-pnpm-workspace",
+        ),
+        "2026-06-14T00:00:30Z",
+    )
+    apply_approval_resolution(
+        store=store,
+        request_id="req-pnpm-workspace",
+        action="allow",
+        scope="workspace",
+        workspace=str(workspace_dir),
+        reason="same dependency graph",
+        now="2026-06-14T00:01:00Z",
+    )
+    _write_pnpm_workspace(worktree_dir, extra_dependency="otherpkg")
+
+    retry_payload, retry_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=worktree_dir,
+        dry_run=True,
+        now="2026-06-14T00:02:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+
+    assert retry_rc == 2
+    assert retry_payload["verdict"]["action"] == "review"
+    retry_receipt = retry_payload["receipt"]
+    assert isinstance(retry_receipt, dict)
+    assert retry_receipt["artifact_hash"] != receipt["artifact_hash"]
+    evaluation = retry_payload["supply_chain_evaluation"]
+    assert isinstance(evaluation, dict)
+    assert not any(
+        isinstance(reason, dict) and reason.get("code") == "saved_package_approval"
+        for reason in evaluation.get("reasons", [])
+    )
+
+
+def test_build_package_protect_payload_saved_hashless_block_clear_command_omits_artifact_hash(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    command = ["pnpm", "add", "left-pad"]
+
+    baseline_payload, baseline_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=True,
+        now="2026-06-14T00:00:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+    assert baseline_rc == 0
+    receipt = baseline_payload["receipt"]
+    assert isinstance(receipt, dict)
+    store.upsert_policy(
+        PolicyDecision(
+            harness="guard-cli",
+            scope="artifact",
+            action="block",
+            artifact_id=str(receipt["artifact_id"]),
+            artifact_hash=None,
+            workspace=str(workspace_dir),
+            publisher=None,
+            reason="keep blocked",
+        ),
+        "2026-06-14T00:00:00Z",
+    )
+
+    retry_payload, retry_rc = build_package_protect_payload(
+        command=command,
+        store=store,
+        workspace_dir=workspace_dir,
+        dry_run=True,
+        now="2026-06-14T00:01:00Z",
+        config=None,
+        unsafe_raw_output=False,
+        timeout_seconds=30,
+    )
+
+    assert retry_rc == 2
+    user_copy = retry_payload["supply_chain_evaluation"]["user_copy"]
+    assert "hol-guard policies clear" in user_copy["harness_message"]
+    assert "--decision-id" in user_copy["next_step"]
+    assert "--artifact-hash" not in user_copy["next_step"]
+    assert "--artifact-id" in user_copy["next_step"]
+    assert str(workspace_dir) in user_copy["next_step"]

{plugin_scanner-2.0.968 → plugin_scanner-2.0.969}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.968"
+version = "2.0.969"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },