plugin-scanner 2.0.983__tar.gz → 2.0.985__tar.gz

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.983
+Version: 2.0.985
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.983"
+version = "2.0.985"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.983"
+version = "2.0.985"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/src/codex_plugin_scanner/guard/runtime/command_queue.py

@@ -262,11 +262,7 @@ def _local_requests_snapshot(store: GuardStore) -> dict[str, object]:
         return {"requests": []}
     if not isinstance(payload, dict):
         return {"requests": []}
-    return {
-        key: payload[key]
-        for key in _LEASE_LOCAL_REQUEST_SNAPSHOT_KEYS
-        if key in payload
-    }
+    return {key: payload[key] for key in _LEASE_LOCAL_REQUEST_SNAPSHOT_KEYS if key in payload}
 
 
 def _repair_guard_cloud_authorization(store: GuardStore) -> dict[str, bool]:
@@ -383,7 +379,14 @@ def _retry_pending_result(
         state["last_error"] = None
         _save_state(store, state)
         return False
-    _post_result(auth_context, job, payload)
+    try:
+        _post_result(auth_context, job, payload)
+    except urllib.error.HTTPError as error:
+        if error.code != 401:
+            raise
+        _LOGGER.warning("Pending Guard result 401, attempting OAuth refresh retry.")
+        refreshed_auth_context = _resolve_command_queue_auth_context(store, force_refresh=True)
+        _post_result(refreshed_auth_context, job, payload)
     state.pop("pending_result", None)
     state.pop("active_job", None)
     state.update(
@@ -398,8 +401,26 @@ def _retry_pending_result(
     return True
 
 
+def _resolve_command_queue_auth_context(
+    store: GuardStore,
+    *,
+    force_refresh: bool = False,
+) -> dict[str, object]:
+    try:
+        if force_refresh:
+            return _resolve_guard_sync_auth_context(store, force_refresh=True)
+        return _resolve_guard_sync_auth_context(store)
+    except (GuardSyncAuthorizationExpiredError, GuardSyncNotConfiguredError):
+        repair = _repair_guard_cloud_authorization(store)
+        if repair["existing_sign_in_valid"] or repair["repaired_storage"]:
+            if force_refresh:
+                return _resolve_guard_sync_auth_context(store, force_refresh=True)
+            return _resolve_guard_sync_auth_context(store)
+        raise
+
+
 def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[str, object]:
-    auth_context = _resolve_guard_sync_auth_context_with_repair(store)
+    auth_context = _resolve_command_queue_auth_context(store)
     state = _load_state(store)
     state.update(
         {
@@ -412,7 +433,6 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
     _save_state(store, state)
     if _retry_pending_result(store, auth_context, state):
         return command_queue_status(store)
-
     lease_response = _json_request(
         auth_context,
         method="POST",
@@ -432,7 +452,6 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
         )
         _save_state(store, state)
         return command_queue_status(store)
-
     state.update(
         {
             "state": "leased",
@@ -444,6 +463,20 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
     _save_state(store, state)
     try:
         _heartbeat(auth_context, item)
+    except urllib.error.HTTPError as error:
+        if error.code != 401:
+            raise
+        _LOGGER.warning("Guard heartbeat 401, attempting OAuth refresh retry.")
+        auth_context = _resolve_command_queue_auth_context(store, force_refresh=True)
+        state["state"] = "auth_expired"
+        _save_state(store, state)
+        try:
+            _heartbeat(auth_context, item)
+        except Exception:
+            state.pop("active_job", None)
+            state.update({"state": "error", "last_error": "Guard command heartbeat failed."})
+            _save_state(store, state)
+            raise
     except Exception:
         state.pop("active_job", None)
         state.update({"state": "error", "last_error": "Guard command heartbeat failed."})
@@ -462,6 +495,34 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
     try:
         _heartbeat(auth_context, item)
         _post_result(auth_context, item, payload)
+    except urllib.error.HTTPError as error:
+        if error.code != 401:
+            _LOGGER.warning("Guard command result upload failed: job_id=%s", _job_id(item))
+            state.update(
+                {
+                    "state": "result_pending",
+                    "pending_result": {"job": item, "payload": payload, "recorded_at": _now()},
+                }
+            )
+            _save_state(store, state)
+            raise
+        _LOGGER.warning("Guard result 401, attempting OAuth refresh retry.")
+        auth_context = _resolve_command_queue_auth_context(store, force_refresh=True)
+        state["state"] = "auth_expired"
+        _save_state(store, state)
+        try:
+            _heartbeat(auth_context, item)
+            _post_result(auth_context, item, payload)
+        except Exception:
+            _LOGGER.warning("Guard command result upload failed: job_id=%s", _job_id(item))
+            state.update(
+                {
+                    "state": "result_pending",
+                    "pending_result": {"job": item, "payload": payload, "recorded_at": _now()},
+                }
+            )
+            _save_state(store, state)
+            raise
     except Exception:
         _LOGGER.warning("Guard command result upload failed: job_id=%s", _job_id(item))
         state.update(

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py

@@ -172,7 +172,8 @@ def _local_request_snapshot_items_for_status(
     except GuardReviewContractError:
         oauth = None
     cursor_state = _local_request_snapshot_cursor_state(store)
-    cursor = cursor_state.get(status)
+    use_cursor = status != "pending"
+    cursor = cursor_state.get(status) if use_cursor else None
     rows = store.list_approval_requests(
         status=status,
         limit=limit + 1,
@@ -224,7 +225,7 @@ def _local_request_snapshot_items_for_status(
                 "resolvedAt": str(resolved_at) if isinstance(resolved_at, str) and resolved_at else None,
             }
         )
-    if cursor_supported:
+    if cursor_supported and use_cursor:
         if len(rows) > limit:
             cursor_state[status] = _local_request_snapshot_next_cursor(rows, limit)
         else:

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -3503,6 +3503,17 @@ def _urlopen_with_timeout_retry(
             with urllib.request.urlopen(current_request, timeout=current_timeout_seconds):
                 return
         except urllib.error.HTTPError as error:
+            if error.code == 401:
+                error_payload = _http_error_payload(error)
+                dpop_nonce = _dpop_nonce_from_http_error(error, error_payload)
+                if dpop_nonce is not None and nonce_retry_count < 3:
+                    nonce_retry_count += 1
+                    retry_request = _guard_sync_request_with_nonce(current_request, dpop_nonce)
+                    if retry_request is not None:
+                        current_request = retry_request
+                        current_timeout_seconds = timeout_seconds
+                        retried_timeout = False
+                        continue
             if error.code == 429 and rate_limit_retry_count < 2:
                 retry_after = _parse_retry_after_header(error)
                 time.sleep(min(retry_after, 120))

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.983"
+__version__ = "2.0.985"

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/tests/test_guard_command_queue.py

@@ -4,8 +4,9 @@ import json
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
-import pytest
+import urllib.error
 
+import pytest
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
@@ -1068,6 +1069,60 @@ def test_poll_once_persists_result_retry_when_result_upload_fails(
     assert isinstance(state["pending_result"], dict)
 
 
+def test_poll_once_persists_result_when_result_upload_http_error(tmp_path: Path, monkeypatch) -> None:
+    """Regression: HTTPError 500/429 on result upload must persist pending_result (PR #1308)."""
+    store = FakeStore(tmp_path / "guard-home")
+
+    monkeypatch.setattr(
+        command_queue,
+        "_resolve_guard_sync_auth_context",
+        lambda current_store: {"sync_url": "https://hol.test/api/guard/receipts/sync", "access_token": "token"},
+    )
+    monkeypatch.setattr(command_executors, "package_shim_status", lambda context: {"active_managers": []})
+
+    class FakeHTTPError(urllib.error.HTTPError):
+        def __init__(self) -> None:
+            super().__init__(
+                "https://hol.test/api/guard/commands/job-3/result",
+                500,
+                "Internal Server Error",
+                {},
+                None,
+            )
+
+    def fake_json_request(
+        auth_context: dict[str, object],
+        *,
+        method: str,
+        path: str,
+        payload: dict[str, object],
+    ) -> dict[str, object]:
+        if path == "/lease":
+            return {
+                "item": {
+                    "id": "job-3",
+                    "leaseId": "lease-3",
+                    "operation": "guard.packageShims.status",
+                }
+            }
+        if path.endswith("/result"):
+            raise FakeHTTPError()
+        return {"ok": True}
+
+    monkeypatch.setattr(command_queue, "_json_request", fake_json_request)
+
+    with pytest.raises(urllib.error.HTTPError):
+        command_queue.poll_command_queue_once(store, _context(tmp_path))
+
+    state = store.get_sync_payload(command_queue.COMMAND_QUEUE_STATE_KEY)
+    assert isinstance(state, dict)
+    assert state["state"] == "result_pending"
+    pending = state["pending_result"]
+    assert isinstance(pending, dict)
+    assert pending["job"]["id"] == "job-3"
+    assert "payload" in pending
+
+
 def test_poll_once_clears_active_job_when_heartbeat_fails(tmp_path: Path, monkeypatch) -> None:
     store = FakeStore(tmp_path / "guard-home")
     monkeypatch.setattr(
@@ -1515,8 +1570,8 @@ def test_poll_once_keeps_auth_expired_state_when_auth_refresh_fails(
         "2026-06-23T10:00:00+00:00",
     )
 
-    def fake_auth_context(current_store, *, allow_primary_repair: bool = True):
-        del current_store, allow_primary_repair
+    def fake_auth_context(current_store, *, allow_primary_repair: bool = True, force_refresh: bool = False):
+        del current_store, allow_primary_repair, force_refresh
         raise guard_runner_module.GuardSyncAuthorizationExpiredError(existing_error)
 
     monkeypatch.setattr(command_queue, "_resolve_guard_sync_auth_context", fake_auth_context)
@@ -1536,8 +1591,8 @@ def test_poll_once_repairs_oauth_storage_and_retries_before_leasing(
     store = _oauth_store(tmp_path)
     resolve_calls = {"count": 0}
 
-    def fake_auth_context(current_store, *, allow_primary_repair: bool = True):
-        del current_store, allow_primary_repair
+    def fake_auth_context(current_store, *, allow_primary_repair: bool = True, force_refresh: bool = False):
+        del current_store, allow_primary_repair, force_refresh
         resolve_calls["count"] += 1
         if resolve_calls["count"] == 1:
             raise guard_runner_module.GuardSyncNotConfiguredError("Guard is not logged in.")

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/tests/test_guard_command_snapshot_paging.py

@@ -116,22 +116,109 @@ def test_local_request_snapshot_payload_stays_under_cloud_byte_budget(tmp_path:
     assert "truncated" in str(request_payload["command_text"])
 
 
-def test_local_request_snapshot_pages_large_pending_backlog(tmp_path: Path) -> None:
+def test_local_request_snapshot_pending_is_cursorless(tmp_path: Path) -> None:
+    """Pending snapshots must NOT persist cursors so every call sees the newest batch.
+
+    The implementation invariant (local_request_snapshots.py line 175) is
+    ``use_cursor = status != "pending"`` — pending status never reads or
+    writes a paging cursor.  Each call therefore returns the same first
+    batch (rows 0-124) regardless of prior calls.
+    """
     store = PagingStore(tmp_path / "guard-home")
 
+    # First snapshot: rows 0-124 (limit = 125).
     first_payload = command_executors._local_request_snapshot_payload(store)
-    second_payload = command_executors._local_request_snapshot_payload(store)
-    third_payload = command_executors._local_request_snapshot_payload(store)
-
     assert first_payload["pendingComplete"] is False
     assert first_payload["pendingCount"] == command_executors.LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT
     assert first_payload["requests"][0]["localRequestId"] == "req-pending-000"
     assert first_payload["requests"][-1]["localRequestId"] == "req-pending-124"
+
+    # Second snapshot: pending status does NOT persist cursors,
+    # so every call returns the same first batch (rows 0-124).
+    # This is the new live-request invariant: each lease covers
+    # the newest pending rows without advancing a store cursor.
+    second_payload = command_executors._local_request_snapshot_payload(store)
     assert second_payload["pendingComplete"] is False
-    assert second_payload["pendingCount"] == 5
-    assert second_payload["requests"][0]["localRequestId"] == "req-pending-125"
-    assert second_payload["requests"][-1]["localRequestId"] == "req-pending-129"
+    assert second_payload["pendingCount"] == command_executors.LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT
+    assert second_payload["requests"][0]["localRequestId"] == "req-pending-000"
+    assert second_payload["requests"][-1]["localRequestId"] == "req-pending-124"
+
+    # Third snapshot confirms the invariant holds across repeated calls.
+    third_payload = command_executors._local_request_snapshot_payload(store)
     assert third_payload["pendingComplete"] is False
     assert third_payload["pendingCount"] == command_executors.LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT
     assert third_payload["requests"][0]["localRequestId"] == "req-pending-000"
     assert third_payload["requests"][-1]["localRequestId"] == "req-pending-124"
+
+
+def test_local_request_snapshot_includes_newest_pending_after_truncation(tmp_path: Path) -> None:
+    """Prove a newly inserted request appears on the next snapshot despite prior truncation."""
+
+    class FreshRowStore(PagingStore):
+        def __init__(self, guard_home: Path) -> None:
+            super().__init__(guard_home)
+            self.inserted_rows: list[dict[str, object]] = []
+
+        def list_approval_requests(
+            self,
+            *,
+            status: str | None = "pending",
+            harness: str | None = None,
+            limit: int | None = 50,
+            cursor: str | None = None,
+            search: str | None = None,
+        ) -> list[dict[str, object]]:
+            del harness, search
+            if status != "pending":
+                return []
+            # In the DB, newest requests come first. Insert fresh rows
+            # at the front so they naturally rank within the limit window.
+            rows = list(self.inserted_rows) + [_approval_request_row(i) for i in range(125)]
+            return rows if limit is None else rows[:limit]
+
+    store = FreshRowStore(tmp_path / "guard-home")
+
+    # Initial snapshot: truncated at 125, so rows 125-129 are hidden.
+    first_payload = command_executors._local_request_snapshot_payload(store)
+    assert len(first_payload["requests"]) == command_executors.LOCAL_REQUEST_PENDING_SNAPSHOT_LIMIT
+    assert first_payload["requests"][-1]["localRequestId"] == "req-pending-124"
+
+    # Insert a brand-new request whose created_at is later than all backlog rows.
+    now_iso = "2026-07-04T12:00:00.000Z"
+    new_request = {
+        "request_id": "req-pending-fresh",
+        "status": "pending",
+        "harness": "codex",
+        "artifact_id": "artifact-new",
+        "artifact_hash": "a" * 64,
+        "policy_action": "require-approval",
+        "recommended_scope": "artifact",
+        "created_at": now_iso,
+        "last_seen_at": now_iso,
+        "queue_group_id": "queue-group-1",
+        "action_envelope_json": {
+            "action_type": "shell_command",
+            "command": "npm install fresh-pkg@2.0.0",
+            "tool_name": "Bash",
+        },
+    }
+    store.inserted_rows.append(new_request)
+
+    # Second snapshot: the newly inserted request must be visible in the
+    # returned batch because pending snapshots never store a cursor that
+    # would hide it.
+    second_payload = command_executors._local_request_snapshot_payload(store)
+    request_ids = {r["localRequestId"] for r in second_payload["requests"]}
+    assert "req-pending-fresh" in request_ids
+
+    # Third snapshot: the fresh request persists across repeated calls,
+    # proving the cursorless invariant holds for injected rows too.
+    third_payload = command_executors._local_request_snapshot_payload(store)
+    third_ids = {r["localRequestId"] for r in third_payload["requests"]}
+    assert "req-pending-fresh" in third_ids
+    # The persisted snapshot cursor key must NOT contain a pending cursor,
+    # otherwise the next call could skip fresh rows.
+    stored_cursor = store.get_sync_payload(
+        "guard_command_local_request_snapshot_cursor"
+    )
+    assert stored_cursor is None or "pending" not in stored_cursor

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/tests/test_guard_receipt_redaction_cursor.py

@@ -361,7 +361,7 @@ def test_relaxed_redaction_sync_adds_recent_blocked_command_detail_backfill(tmp_
         "level": "partial",
         "updated_at": "2026-04-15T00:01:00Z",
         "days": 30,
-        "limit": 1000,
+        "limit": 200,
         "receipts": 1,
         "queried": 1,
         "before_rowid": 1,

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/tests/test_guard_supply_chain_daemon.py

@@ -174,7 +174,7 @@ def test_daemon_bundle_refresh_reports_retryable_error(
     assert "oauth upstream down" in str(summary["error"])
 
 
-def _wait_for_aibom_status(store, *, expected: str, timeout: float = 1.0) -> dict[str, object]:
+def _wait_for_aibom_status(store, *, expected: str, timeout: float = 5.0) -> dict[str, object]:
     """Poll until the AIBOM daemon payload carries the expected status string."""
     deadline = time.time() + timeout
     while time.time() < deadline:

{plugin_scanner-2.0.983 → plugin_scanner-2.0.985}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.983"
+version = "2.0.985"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },