plugin-scanner 2.0.985__tar.gz → 2.0.987__tar.gz

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.985
+Version: 2.0.987
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.985"
+version = "2.0.987"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.985"
+version = "2.0.987"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -2405,7 +2405,10 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             return
         request_policy_action = self._optional_string(request_row.get("policy_action"))
         request_recommended_scope = self._optional_string(request_row.get("recommended_scope"))
-        if request_policy_action not in {"review", "require-reapproval"} or request_recommended_scope != "artifact":
+        if request_policy_action not in {"pause", "review", "require-reapproval"} or request_recommended_scope not in {
+            "artifact",
+            "one-time",
+        }:
             self._write_json({"error": "remote_once_not_permitted"}, status=409)
             return
         try:
@@ -2449,7 +2452,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             result = self.server.store.resolve_request_with_signed_remote_result(  # type: ignore[attr-defined]
                 request_id,
                 resolution_action=resolution_action,
-                resolution_scope="artifact",
+                resolution_scope=request_recommended_scope or "artifact",
                 reason="Guard Cloud signed remote approval",
                 resolved_at=_now(),
             )
@@ -2472,7 +2475,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 "receipt_id": receipt_id,
                 "request_id": request_id,
                 "review_command": self._optional_string(resolved_request.get("review_command")),
-                "scope": "artifact",
+                "scope": request_recommended_scope or "artifact",
             },
             resolved_at,
         )

plugin_scanner-2.0.987/src/codex_plugin_scanner/guard/runtime/auto_update.py

@@ -0,0 +1,78 @@
+"""Auto-update check for Guard Cloud command queue daemon.
+
+Throttled to once per AUTO_UPDATE_THROTTLE_HOURS. Only runs when the
+command queue is enabled and no job was leased. Source/editable installs
+are excluded by build_guard_update_status_payload's auto_updatable flag.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+from ..cli.update_commands import build_guard_update_status_payload, run_guard_update
+
+if TYPE_CHECKING:
+    from ..adapters.base import HarnessContext
+    from ..store import GuardStore
+
+AUTO_UPDATE_THROTTLE_HOURS = 6
+AUTO_UPDATE_STATE_KEY = "guard_auto_update_state"
+_LOGGER = logging.getLogger(__name__)
+
+
+def maybe_auto_update(store: GuardStore, context: HarnessContext) -> None:
+    """Check for available updates and self-apply if auto-update is enabled."""
+    raw = store.get_sync_payload(AUTO_UPDATE_STATE_KEY)
+    try:
+        state: dict[str, object] = dict(raw) if isinstance(raw, dict) else {}
+    except (TypeError, ValueError):
+        state = {}
+    last_check = state.get("last_check_at")
+    if isinstance(last_check, str):
+        try:
+            last_dt = datetime.fromisoformat(last_check)
+            elapsed = (datetime.now(timezone.utc) - last_dt).total_seconds()
+            if elapsed < AUTO_UPDATE_THROTTLE_HOURS * 3600:
+                return
+        except (ValueError, TypeError):
+            pass
+    now_str = datetime.now(timezone.utc).isoformat()
+    try:
+        status = build_guard_update_status_payload()
+    except Exception:
+        _LOGGER.debug("Auto-update version check failed", exc_info=True)
+        state["last_check_at"] = now_str
+        state["last_check_error"] = True
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)
+        return
+    state["last_check_at"] = now_str
+    state["last_status"] = status
+    if not status.get("auto_updatable") or status.get("blocked_reason"):
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)
+        return
+    if not status.get("update_available"):
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)
+        return
+    _LOGGER.info(
+        "Auto-update: applying update %s -> %s",
+        status.get("current_version"),
+        status.get("latest_version"),
+    )
+    try:
+        update_payload, exit_code = run_guard_update(
+            dry_run=False,
+            context=context,
+            store=store,
+            workspace=str(context.workspace_dir) if context.workspace_dir is not None else None,
+            now=now_str,
+        )
+        state["last_update_result"] = update_payload
+        state["last_update_exit_code"] = exit_code
+        state["last_update_at"] = now_str
+    except Exception:
+        _LOGGER.warning("Auto-update failed", exc_info=True)
+        state["last_update_error"] = True
+    finally:
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -16,6 +16,10 @@ from ..cli.install_commands import (
     list_harness_setup_items,
     uninstall_confirmation_token,
 )
+from ..cli.update_commands import (
+    build_guard_update_status_payload,
+    run_guard_update,
+)
 from ..config import load_guard_config
 from ..local_supply_chain import (
     build_workspace_audit_payload,
@@ -61,6 +65,8 @@ APP_OPERATIONS: tuple[str, ...] = (
     "guard.app.repair",
     "guard.app.connect",
     "guard.app.remove",
+    "guard.app.update",
+    "guard.app.updateCheck",
 )
 APPROVAL_OPERATIONS: tuple[str, ...] = (
     "guard.approval.resolve",
@@ -203,6 +209,16 @@ def _execute_app_operation(
             return _result({"items": list_harness_setup_items(context, store)}, generated_at=generated_at)
         get_adapter(harness)
         return _result(build_harness_verification(harness, context, store, surface=surface), generated_at=generated_at)
+    if operation == "guard.app.update":
+        return _result(
+            _execute_app_update(context=context, store=store, generated_at=generated_at),
+            generated_at=generated_at,
+        )
+    if operation == "guard.app.updateCheck":
+        return _result(
+            _execute_app_update_check(generated_at=generated_at),
+            generated_at=generated_at,
+        )
     if harness is None:
         return {"failureCode": "harness_required", "failureMessage": "App command requires a harness."}
     get_adapter(harness)
@@ -235,6 +251,30 @@ def _execute_app_operation(
     }
 
 
+def _execute_app_update(
+    *,
+    context: HarnessContext,
+    store: GuardStore,
+    generated_at: str,
+) -> dict[str, object]:
+    update_payload, exit_code = run_guard_update(
+        dry_run=False,
+        context=context,
+        store=store,
+        workspace=str(context.workspace_dir) if context.workspace_dir is not None else None,
+        now=generated_at,
+    )
+    return {
+        "update": update_payload,
+        "exitCode": exit_code,
+        "succeeded": exit_code == 0,
+    }
+
+
+def _execute_app_update_check(generated_at: str) -> dict[str, object]:
+    return build_guard_update_status_payload()
+
+
 def _execute_approval_operation(
     operation: str,
     *,
@@ -280,6 +320,13 @@ def _execute_approval_operation(
         oauth=oauth,
         store=store,
     )
+    request_policy_action = _optional_string(request_row.get("policy_action"))
+    resolution_scope = _optional_string(request_row.get("recommended_scope"))
+    if request_policy_action not in {"pause", "review", "require-reapproval"} or resolution_scope not in {
+        "artifact",
+        "one-time",
+    }:
+        raise ValueError("remote_approval_not_permitted")
     receipt_id = _optional_string(envelope.get("receiptId"))
     if receipt_id is None:
         raise ValueError("invalid_remote_approval_receipt")
@@ -293,12 +340,13 @@ def _execute_approval_operation(
     if envelope_decision not in {"allow_once", "block"}:
         store.release_remote_once_receipt(receipt_id)
         raise ValueError("invalid_remote_approval_decision")
+    resolution_scope = resolution_scope or "artifact"
     resolution_action = "block" if envelope_decision == "block" else "allow"
     try:
         result = store.resolve_request_with_signed_remote_result(
             local_request_id,
             resolution_action=resolution_action,
-            resolution_scope="artifact",
+            resolution_scope=resolution_scope,
             reason=_optional_string(payload.get("reason")) or "Guard Cloud signed remote approval",
             resolved_at=generated_at,
         )

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/src/codex_plugin_scanner/guard/runtime/command_queue.py

@@ -14,6 +14,7 @@ from urllib.parse import urlparse, urlunparse
 from ...version import __version__
 from ..adapters.base import HarnessContext
 from ..store import GuardStore
+from .auto_update import maybe_auto_update
 from .command_executors import (
     COMMAND_OPERATION_SCHEMA_VERSIONS,
     SUPPORTED_COMMAND_OPERATIONS,
@@ -401,6 +402,11 @@ def _retry_pending_result(
     return True
 
 
+def _maybe_auto_update(store: GuardStore, context: HarnessContext) -> None:
+    """Delegate to auto_update.maybe_auto_update."""
+    maybe_auto_update(store, context)
+
+
 def _resolve_command_queue_auth_context(
     store: GuardStore,
     *,
@@ -451,6 +457,7 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
             }
         )
         _save_state(store, state)
+        _maybe_auto_update(store, context)
         return command_queue_status(store)
     state.update(
         {

{plugin_scanner-2.0.985 → plugin_scanner-2.0.987}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.985"
+__version__ = "2.0.987"

plugin_scanner-2.0.987/tests/test_guard_command_executors_update.py

@@ -0,0 +1,205 @@
+"""Tests for guard.app.update and guard.app.updateCheck command executors."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+from unittest.mock import patch
+
+import pytest
+
+from codex_plugin_scanner.guard.adapters.base import HarnessContext
+from codex_plugin_scanner.guard.runtime.command_executors import (
+    APP_OPERATIONS,
+    execute_guard_command_job,
+)
+
+
+def _make_context(tmp_path: Path) -> HarnessContext:
+    return HarnessContext(
+        home_dir=tmp_path / "home",
+        workspace_dir=tmp_path / "workspace",
+        guard_home=tmp_path / "guard",
+    )
+
+
+def _make_job(operation: str, payload: dict[str, object] | None = None) -> dict[str, object]:
+    return {
+        "id": "job-1",
+        "operation": operation,
+        "operationSchemaVersion": 1,
+        "payload": payload or {},
+    }
+
+
+class _FakeStore:
+    """Minimal fake store with get_sync_payload/set_sync_payload for auto-update state."""
+
+    def __init__(self) -> None:
+        self._kv_data: dict[str, object] = {}
+
+    def get_sync_payload(self, key: str) -> object:
+        return self._kv_data.get(key)
+
+    def set_sync_payload(self, key: str, payload: object, now: str) -> None:
+        self._kv_data[key] = payload
+
+
+class TestAppUpdateOperations:
+    """Verify guard.app.update and guard.app.updateCheck are registered and executable."""
+
+    def test_update_operations_in_app_operations(self) -> None:
+        assert "guard.app.update" in APP_OPERATIONS
+        assert "guard.app.updateCheck" in APP_OPERATIONS
+
+    def test_update_check_returns_status_payload(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.updateCheck")
+        expected_status = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": True,
+            "blocked_reason": None,
+        }
+        with patch(
+            "codex_plugin_scanner.guard.runtime.command_executors.build_guard_update_status_payload",
+            return_value=expected_status,
+        ):
+            result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["data"]["current_version"] == "2.0.967"
+        assert result["data"]["latest_version"] == "2.0.970"
+        assert result["data"]["update_available"] is True
+
+    def test_update_calls_run_guard_update(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.update")
+        expected_update = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "status": "updated",
+            "changed": True,
+        }
+        with patch(
+            "codex_plugin_scanner.guard.runtime.command_executors.run_guard_update",
+            return_value=(expected_update, 0),
+        ):
+            result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["data"]["succeeded"] is True
+        assert result["data"]["exitCode"] == 0
+        assert result["data"]["update"]["status"] == "updated"
+        assert result["data"]["update"]["changed"] is True
+
+    def test_update_handles_failure_exit_code(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.update")
+        expected_update = {
+            "current_version": "2.0.967",
+            "status": "failed",
+            "changed": False,
+            "error": "pip install failed",
+        }
+        with patch(
+            "codex_plugin_scanner.guard.runtime.command_executors.run_guard_update",
+            return_value=(expected_update, 1),
+        ):
+            result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["data"]["succeeded"] is False
+        assert result["data"]["exitCode"] == 1
+        assert result["data"]["update"]["error"] == "pip install failed"
+
+    def test_unsupported_app_operation_returns_failure(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.unknownOperation")
+        result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["failureCode"] == "unsupported_operation"
+
+
+class TestAutoUpdateThrottle:
+    """Verify auto-update throttling in maybe_auto_update."""
+
+    def test_auto_update_skipped_within_throttle_window(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        recent = datetime.now(timezone.utc)
+        store._kv_data[auto_update.AUTO_UPDATE_STATE_KEY] = {"last_check_at": recent.isoformat()}
+        with patch.object(auto_update, "build_guard_update_status_payload") as mock:
+            auto_update.maybe_auto_update(store, context)
+        mock.assert_not_called()
+
+    def test_auto_update_runs_after_throttle_window(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        old = datetime(2026, 7, 3, 0, 0, 0, tzinfo=timezone.utc)
+        store._kv_data[auto_update.AUTO_UPDATE_STATE_KEY] = {"last_check_at": old.isoformat()}
+        status = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": True,
+            "blocked_reason": None,
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            with patch.object(auto_update, "run_guard_update", return_value=({"changed": True}, 0)) as mock_update:
+                auto_update.maybe_auto_update(store, context)
+        mock_update.assert_called_once()
+
+    def test_auto_update_skipped_when_not_auto_updatable(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        status = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "auto_updatable": False,
+            "update_available": True,
+            "blocked_reason": "This install was set up from local source code.",
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            with patch.object(auto_update, "run_guard_update") as mock_update:
+                auto_update.maybe_auto_update(store, context)
+        mock_update.assert_not_called()
+
+    def test_auto_update_skipped_when_no_update_available(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        status = {
+            "current_version": "2.0.970",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": False,
+            "blocked_reason": None,
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            with patch.object(auto_update, "run_guard_update") as mock_update:
+                auto_update.maybe_auto_update(store, context)
+        mock_update.assert_not_called()
+
+    def test_auto_update_handles_malformed_state(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        store._kv_data[auto_update.AUTO_UPDATE_STATE_KEY] = "not valid json{{"
+        status = {
+            "current_version": "2.0.970",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": False,
+            "blocked_reason": None,
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            auto_update.maybe_auto_update(store, context)
+        # Should not crash — malformed state is treated as empty