plugin-scanner 2.0.976__tar.gz → 2.0.978__tar.gz

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.976
+Version: 2.0.978
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.976"
+version = "2.0.978"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.976"
+version = "2.0.978"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/src/codex_plugin_scanner/guard/cli/remote_pair_flow.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import json
 import os
 import re
@@ -21,6 +22,7 @@ from ..remote_pairing_constants import (
     REMOTE_PAIRING_CODE_MIN_LENGTH,
     REMOTE_PAIRING_CODE_PREFIX,
 )
+from ..runtime.runner import sync_runtime_session
 from ..store import GuardStore
 from .connect_flow import (
     CONNECT_REPAIR_COMMAND,
@@ -262,6 +264,38 @@ def build_remote_pair_status_payload(
     )
 
 
+def _sync_runtime_session_after_pair(
+    store: GuardStore,
+    *,
+    runtime: str,
+    label: str,
+) -> None:
+    """Best-effort runtime session sync so the agent appears in Guard Cloud immediately.
+
+    The remote-pair flow installs local protection but previously never pushed a runtime
+    session to Guard Cloud.  The protect dashboard reads runtime sessions to determine
+    which harnesses are "connected".  Without this sync the dashboard shows the agent as
+    unconnected even though the local install succeeded.
+
+    Failures are swallowed so that a transient network error does not roll back a
+    successful pairing.  The daemon's periodic sync will retry.
+    """
+    with contextlib.suppress(Exception):
+        sync_runtime_session(
+            store,
+            session={
+                "harness": runtime,
+                "surface": "remote-pair",
+                "status": "active",
+                "client_name": runtime,
+                "client_title": label,
+                "client_version": None,
+                "workspace": "remote-agent",
+                "capabilities": ["hosted-runtime", "guard-cloud-sync"],
+            },
+        )
+
+
 def run_guard_remote_pair_command(
     *,
     store: GuardStore,
@@ -352,6 +386,8 @@ def run_guard_remote_pair_command(
         if isinstance(warnings, list) and warnings:
             protection_reason = str(warnings[0])
 
+    _sync_runtime_session_after_pair(store, runtime=runtime, label=resolved_label)
+
     sync_url = _oauth_sync_url_from_issuer(oauth_client.issuer)
     return _sanitize_remote_pair_payload(
         {

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import tempfile
 from collections.abc import Callable
 from datetime import datetime, timezone
@@ -69,8 +70,11 @@ APPROVAL_OPERATIONS: tuple[str, ...] = (
 )
 SUPPORTED_COMMAND_OPERATIONS: tuple[str, ...] = (*PACKAGE_SHIM_OPERATIONS, *APP_OPERATIONS, *APPROVAL_OPERATIONS)
 COMMAND_OPERATION_SCHEMA_VERSIONS: dict[str, int] = {operation: 1 for operation in SUPPORTED_COMMAND_OPERATIONS}
-LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT = 10_000
-LOCAL_REQUEST_RESOLVED_SNAPSHOT_LIMIT = 500
+LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT = 200
+LOCAL_REQUEST_RESOLVED_SNAPSHOT_LIMIT = 50
+LOCAL_REQUEST_SNAPSHOT_MAX_BYTES = 600_000
+LOCAL_REQUEST_SNAPSHOT_MAX_STRING_CHARS = 2_000
+LOCAL_REQUEST_SNAPSHOT_MAX_LIST_ITEMS = 20
 
 
 def execute_guard_command_job(
@@ -444,10 +448,15 @@ def _local_request_snapshot_payload(store: GuardStore) -> dict[str, object]:
         status="resolved",
         limit=LOCAL_REQUEST_RESOLVED_SNAPSHOT_LIMIT,
     )
+    requests, pending_byte_complete, resolved_byte_complete = _local_request_snapshot_byte_capped_statuses(
+        pending_items,
+        resolved_items,
+        max_bytes=LOCAL_REQUEST_SNAPSHOT_MAX_BYTES,
+    )
     return {
-        "requests": [*pending_items, *resolved_items],
-        "pendingComplete": pending_complete,
-        "resolvedComplete": resolved_complete,
+        "requests": requests,
+        "pendingComplete": pending_complete and pending_byte_complete,
+        "resolvedComplete": resolved_complete and resolved_byte_complete,
         "pendingLimit": LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT,
         "resolvedLimit": LOCAL_REQUEST_RESOLVED_SNAPSHOT_LIMIT,
         "pendingCount": len(pending_items),
@@ -455,6 +464,96 @@ def _local_request_snapshot_payload(store: GuardStore) -> dict[str, object]:
     }
 
 
+def _local_request_snapshot_byte_capped_statuses(
+    pending_items: list[dict[str, object]],
+    resolved_items: list[dict[str, object]],
+    *,
+    max_bytes: int,
+) -> tuple[list[dict[str, object]], bool, bool]:
+    selected, pending_complete = _local_request_snapshot_byte_capped_items(
+        pending_items,
+        max_bytes=max_bytes,
+    )
+    if not pending_complete:
+        return selected, False, False
+
+    selected, resolved_complete = _local_request_snapshot_byte_capped_items(
+        resolved_items,
+        existing_items=selected,
+        max_bytes=max_bytes,
+    )
+    return selected, True, resolved_complete
+
+
+def _local_request_snapshot_byte_capped_items(
+    items: list[dict[str, object]],
+    *,
+    max_bytes: int,
+    existing_items: list[dict[str, object]] | None = None,
+) -> tuple[list[dict[str, object]], bool]:
+    selected: list[dict[str, object]] = list(existing_items or [])
+    initial_len = len(selected)
+    for item in items:
+        candidate = [*selected, item]
+        candidate_bytes = len(
+            json.dumps({"requests": candidate}, separators=(",", ":"), sort_keys=True).encode(
+                "utf-8",
+            ),
+        )
+        if candidate_bytes > max_bytes:
+            if len(selected) == initial_len:
+                compact_item = _compact_local_request_snapshot_item(item)
+                compact_candidate = [*selected, compact_item]
+                compact_bytes = len(
+                    json.dumps(
+                        {"requests": compact_candidate},
+                        separators=(",", ":"),
+                        sort_keys=True,
+                    ).encode("utf-8"),
+                )
+                if compact_bytes <= max_bytes:
+                    selected.append(compact_item)
+            return selected, False
+        selected.append(item)
+    return selected, True
+
+
+def _compact_local_request_snapshot_item(item: dict[str, object]) -> dict[str, object]:
+    compact = {key: _compact_local_request_snapshot_value(value) for key, value in item.items()}
+    compact_bytes = len(json.dumps(compact, separators=(",", ":"), sort_keys=True).encode("utf-8"))
+    if compact_bytes <= LOCAL_REQUEST_SNAPSHOT_MAX_BYTES:
+        return compact
+    safe_keys = (
+        "localRequestId",
+        "status",
+        "harness",
+        "artifactId",
+        "artifactName",
+        "artifactType",
+        "policyAction",
+        "recommendedScope",
+        "createdAt",
+        "lastSeenAt",
+        "riskHeadline",
+        "riskSummary",
+        "rawCommandText",
+        "reviewCommand",
+    )
+    return {key: compact[key] for key in safe_keys if key in compact}
+
+
+def _compact_local_request_snapshot_value(value: object) -> object:
+    if isinstance(value, str):
+        if len(value) <= LOCAL_REQUEST_SNAPSHOT_MAX_STRING_CHARS:
+            return value
+        return f"{value[:LOCAL_REQUEST_SNAPSHOT_MAX_STRING_CHARS]}...[truncated]"
+    if isinstance(value, list):
+        return [_compact_local_request_snapshot_value(item) for item in value[:LOCAL_REQUEST_SNAPSHOT_MAX_LIST_ITEMS]]
+    if isinstance(value, dict):
+        return {str(key): _compact_local_request_snapshot_value(item) for key, item in value.items()}
+    return value
+
+
 def _local_request_snapshot_items_for_status(
     store: GuardStore,
     *,

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.976"
+__version__ = "2.0.978"

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/tests/test_guard_command_queue.py

@@ -345,7 +345,7 @@ def test_local_request_snapshot_payload_includes_complete_pending_backlog(tmp_pa
         ) -> list[dict[str, object]]:
             del harness, cursor
             if status == "pending":
-                rows = [_approval_request_row(f"req-pending-{index}") for index in range(225)]
+                rows = [_approval_request_row(f"req-pending-{index}") for index in range(125)]
             elif status == "resolved":
                 rows = [
                     {
@@ -363,12 +363,12 @@ def test_local_request_snapshot_payload_includes_complete_pending_backlog(tmp_pa
 
     assert payload["pendingComplete"] is True
     assert payload["resolvedComplete"] is True
-    assert payload["pendingCount"] == 225
+    assert payload["pendingCount"] == 125
     assert payload["resolvedCount"] == 3
-    assert len(payload["requests"]) == 228
+    assert len(payload["requests"]) == 128
     assert {item["localRequestId"] for item in payload["requests"]} >= {
         "req-pending-0",
-        "req-pending-224",
+        "req-pending-124",
         "req-resolved-2",
     }
 
@@ -404,6 +404,103 @@ def test_local_request_snapshot_payload_marks_pending_incomplete_when_truncated(
     ]
 
 
+def test_local_request_snapshot_payload_keeps_pending_complete_when_resolved_truncated(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    class StatusSplitStore(FakeStore):
+        def list_approval_requests(
+            self,
+            status: str | None = "pending",
+            harness: str | None = None,
+            limit: int | None = 50,
+            cursor: str | None = None,
+        ) -> list[dict[str, object]]:
+            del harness, cursor
+            if status == "pending":
+                rows = [_approval_request_row("req-pending-0")]
+            elif status == "resolved":
+                rows = [
+                    {
+                        **_approval_request_row("req-resolved-0"),
+                        "status": "resolved",
+                        "resolved_at": "2026-07-02T12:00:00+00:00",
+                        "action_envelope_json": {
+                            "action_type": "shell_command",
+                            "command": "x" * 20_000,
+                            "tool_name": "Bash",
+                        },
+                    }
+                ]
+            else:
+                rows = []
+            return rows if limit is None else rows[:limit]
+
+    store = StatusSplitStore(tmp_path / "guard-home")
+    pending_items, pending_complete = command_executors._local_request_snapshot_items_for_status(
+        store,
+        status="pending",
+        limit=command_executors.LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT,
+    )
+    pending_only_bytes = len(
+        json.dumps({"requests": pending_items}, separators=(",", ":"), sort_keys=True).encode(
+            "utf-8",
+        ),
+    )
+    monkeypatch.setattr(
+        command_executors,
+        "LOCAL_REQUEST_SNAPSHOT_MAX_BYTES",
+        pending_only_bytes + 512,
+    )
+
+    payload = command_executors._local_request_snapshot_payload(store)
+
+    assert pending_complete is True
+    assert payload["pendingComplete"] is True
+    assert payload["resolvedComplete"] is False
+    assert [item["localRequestId"] for item in payload["requests"]] == ["req-pending-0"]
+
+
+def test_local_request_snapshot_byte_cap_truncates_large_payloads() -> None:
+    items = [{"localRequestId": f"req-large-{index}", "rawCommandText": "x" * 12_000} for index in range(400)]
+
+    selected, complete = command_executors._local_request_snapshot_byte_capped_items(
+        items,
+        max_bytes=command_executors.LOCAL_REQUEST_SNAPSHOT_MAX_BYTES,
+    )
+    encoded = json.dumps({"requests": selected}, separators=(",", ":")).encode("utf-8")
+
+    assert len(encoded) <= command_executors.LOCAL_REQUEST_SNAPSHOT_MAX_BYTES
+    assert complete is False
+    assert 0 < len(selected) < len(items)
+
+
+def test_local_request_snapshot_byte_cap_compacts_oversized_first_item() -> None:
+    items = [
+        {
+            "localRequestId": "req-oversized",
+            "status": "pending",
+            "harness": "cursor",
+            "rawCommandText": "x" * (command_executors.LOCAL_REQUEST_SNAPSHOT_MAX_BYTES + 100_000),
+            "actionEnvelope": {
+                "command": "y" * (command_executors.LOCAL_REQUEST_SNAPSHOT_MAX_BYTES + 100_000),
+            },
+        },
+        {"localRequestId": "req-next"},
+    ]
+
+    selected, complete = command_executors._local_request_snapshot_byte_capped_items(
+        items,
+        max_bytes=command_executors.LOCAL_REQUEST_SNAPSHOT_MAX_BYTES,
+    )
+    encoded = json.dumps({"requests": selected}, separators=(",", ":")).encode("utf-8")
+
+    assert len(encoded) <= command_executors.LOCAL_REQUEST_SNAPSHOT_MAX_BYTES
+    assert complete is False
+    assert [item["localRequestId"] for item in selected] == ["req-oversized"]
+    assert str(selected[0]["rawCommandText"]).endswith("...[truncated]")
+
+
 def test_local_request_snapshot_operation_uses_complete_payload(tmp_path: Path) -> None:
     class ManyPendingStore(FakeStore):
         def list_approval_requests(
@@ -417,7 +514,7 @@ def test_local_request_snapshot_operation_uses_complete_payload(tmp_path: Path)
         ) -> list[dict[str, object]]:
             del harness, cursor, search
             if status == "pending":
-                rows = [_approval_request_row(f"req-pending-{index}") for index in range(225)]
+                rows = [_approval_request_row(f"req-pending-{index}") for index in range(125)]
                 return rows if limit is None else rows[:limit]
             if status == "resolved":
                 rows = [_approval_request_row("req-resolved")]
@@ -435,11 +532,11 @@ def test_local_request_snapshot_operation_uses_complete_payload(tmp_path: Path)
 
     assert payload["pendingComplete"] is True
     assert payload["resolvedComplete"] is True
-    assert payload["pendingCount"] == 225
-    assert len(payload["requests"]) == 226
+    assert payload["pendingCount"] == 125
+    assert len(payload["requests"]) == 126
     assert payload["requests"][0]["localRequestId"] == "req-pending-0"
-    assert payload["requests"][224]["localRequestId"] == "req-pending-224"
-    assert payload["requests"][225]["localRequestId"] == "req-resolved"
+    assert payload["requests"][124]["localRequestId"] == "req-pending-124"
+    assert payload["requests"][125]["localRequestId"] == "req-resolved"
 
 
 def test_local_request_snapshot_items_continues_when_request_claim_is_invalid(tmp_path: Path) -> None:
@@ -1814,6 +1911,7 @@ def test_executor_ignores_stale_remote_approval_request_id(tmp_path: Path) -> No
     assert result["failureCode"] == "remote_approval_request_id_mismatch"
     assert store.claimed_receipts == []
 
+
 def test_executor_releases_remote_once_receipt_when_resolution_not_applied(tmp_path: Path) -> None:
     class ApprovalStore(FakeStore):
         def __init__(self, guard_home: Path) -> None:
@@ -2093,6 +2191,7 @@ def test_executor_rejects_overbroad_signed_allow_memory_rules(tmp_path: Path) ->
     assert store.policies == [([], "2026-06-13T00:00:00+00:00", True)]
     assert store.get_sync_payload("guard_review_memory_policy_version") is None
 
+
 def test_executor_rejects_tampered_decision_memory_bundle_hash(tmp_path: Path) -> None:
     store = _oauth_store(tmp_path)
     bundle = _signed_decision_memory_bundle(store)

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/tests/test_guard_remote_pair_flow.py

@@ -323,3 +323,118 @@ def test_claim_remote_pairing_intent_surfaces_api_error(monkeypatch: pytest.Monk
             public_dpop_jwk={"kty": "EC", "crv": "P-256", "x": "abc", "y": "def"},
             urlopen=fake_urlopen,
         )
+
+
+def test_run_guard_remote_pair_command_syncs_runtime_session(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Remote-pair must push a runtime session to Guard Cloud so the protect dashboard shows it."""
+    context = _context(tmp_path)
+    store = GuardStore(context.guard_home)
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.cli.remote_pair_flow.os.geteuid",
+        lambda: 1000,
+        raising=False,
+    )
+
+    def fake_claim(**_kwargs: object) -> dict[str, object]:
+        return {
+            "intentId": "intent-42",
+            "state": "connected",
+            "tokens": {
+                "access_token": _fake_access_token(),
+                "token_type": "Bearer",
+                "expires_in": 3600,
+                "refresh_token": "refresh-token-value",
+                "scope": "guard:runtime.sync guard:offline_access",
+            },
+        }
+
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.cli.remote_pair_flow.claim_remote_pairing_intent",
+        fake_claim,
+    )
+
+    captured_sessions: list[dict[str, object]] = []
+
+    def fake_sync(store_arg, *, session):
+        captured_sessions.append(dict(session))
+        return {"synced_at": "2025-01-01T00:00:00Z", "runtime_session_id": "rt-1"}
+
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.cli.remote_pair_flow.sync_runtime_session",
+        fake_sync,
+    )
+
+    payload = run_guard_remote_pair_command(
+        store=store,
+        context=context,
+        connect_url="https://hol.org/guard/connect",
+        runtime="hermes",
+        pair_code="HLG-7K3D29",
+        label="Hosted Hermes",
+        no_root=True,
+    )
+
+    assert payload["status"] == "connected"
+    assert len(captured_sessions) == 1
+    session = captured_sessions[0]
+    assert session["harness"] == "hermes"
+    assert session["status"] == "active"
+    assert session["surface"] == "remote-pair"
+    assert session["client_title"] == "Hosted Hermes"
+
+
+def test_run_guard_remote_pair_command_swallows_sync_failure(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A transient sync failure must not roll back a successful pairing."""
+    context = _context(tmp_path)
+    store = GuardStore(context.guard_home)
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.cli.remote_pair_flow.os.geteuid",
+        lambda: 1000,
+        raising=False,
+    )
+
+    def fake_claim(**_kwargs: object) -> dict[str, object]:
+        return {
+            "intentId": "intent-42",
+            "state": "connected",
+            "tokens": {
+                "access_token": _fake_access_token(),
+                "token_type": "Bearer",
+                "expires_in": 3600,
+                "refresh_token": "refresh-token-value",
+                "scope": "guard:runtime.sync guard:offline_access",
+            },
+        }
+
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.cli.remote_pair_flow.claim_remote_pairing_intent",
+        fake_claim,
+    )
+
+    def fake_sync(_store, *, session):
+        raise RuntimeError("network is down")
+
+    monkeypatch.setattr(
+        "codex_plugin_scanner.guard.cli.remote_pair_flow.sync_runtime_session",
+        fake_sync,
+    )
+
+    payload = run_guard_remote_pair_command(
+        store=store,
+        context=context,
+        connect_url="https://hol.org/guard/connect",
+        runtime="hermes",
+        pair_code="HLG-7K3D29",
+        label="Hosted Hermes",
+        no_root=True,
+    )
+
+    # Pairing still succeeds despite sync failure
+    assert payload["status"] == "connected"
+    assert payload["pairing"] == "connected"

{plugin_scanner-2.0.976 → plugin_scanner-2.0.978}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.976"
+version = "2.0.978"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },