plugin-scanner 2.0.997__tar.gz → 2.0.999__tar.gz

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.997
+Version: 2.0.999
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/dashboard/src/guard-types.ts

@@ -147,6 +147,8 @@ export type GuardApprovalRequest = {
   resolved_at: string | null;
   action_envelope_json?: GuardActionEnvelope | null;
   decision_v2_json?: GuardDecisionV2 | null;
+  fallback_cli_command?: string | null;
+  raw_command_text?: string | null;
   action_identity?: string | null;
   queue_group_id?: string | null;
   dedupe_count?: number;

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/dashboard/src/queue-state.test.ts

@@ -437,6 +437,31 @@ const promptTextResults = searchQueue([BASE_REQUEST, longPromptItem], "zigzag-xy
 assert(promptTextResults.length === 1, "T-QS-38a: searchQueue matches full prompt_text not just prompt_excerpt");
 assert(promptTextResults[0].request_id === "req-long-prompt", "T-QS-38b: searchQueue returns correct item for prompt_text search");
 
+const rawCommandSummaryItem: GuardApprovalRequest = {
+  ...BASE_REQUEST,
+  request_id: "req-raw-command-summary",
+  artifact_name: "Bash",
+  raw_command_text: "hol-guard approvals bulk allow once",
+};
+
+const rawCommandResults = searchQueue([BASE_REQUEST, rawCommandSummaryItem], "bulk");
+assert(rawCommandResults.length === 1, "T-QS-38c: searchQueue matches raw command text from queue summaries");
+assert(rawCommandResults[0].request_id === "req-raw-command-summary", "T-QS-38d: searchQueue returns raw-command summary matches");
+
+const rawPayloadCommandItem: GuardApprovalRequest = {
+  ...BASE_REQUEST,
+  request_id: "req-raw-payload-command",
+  action_envelope_json: {
+    ...shellEnvelope,
+    command: null,
+    raw_payload_redacted: { commandText: "python manage.py bulk_import --dry-run" },
+  },
+};
+
+const rawPayloadResults = searchQueue([BASE_REQUEST, rawPayloadCommandItem], "bulk_import");
+assert(rawPayloadResults.length === 1, "T-QS-38e: searchQueue matches command text preserved in redacted raw payloads");
+assert(rawPayloadResults[0].request_id === "req-raw-payload-command", "T-QS-38f: searchQueue returns raw-payload command matches");
+
 assert(
   resolveStaleRequestRecovery("req-1", [BASE_REQUEST, req2]) === "req-1",
   "T-QS-39: resolveStaleRequestRecovery returns active ID when request is still in queue"

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/dashboard/src/queue-state.ts

@@ -1125,10 +1125,15 @@ export function searchQueue(items: GuardApprovalRequest[], term: string): GuardA
       item.launch_summary ?? "",
       item.why_now ?? "",
       envelope?.command ?? "",
+      item.raw_command_text ?? "",
+      item.fallback_cli_command ?? "",
+      item.review_command ?? "",
       (envelope?.prompt_text ?? envelope?.prompt_excerpt) ?? "",
       envelope?.mcp_server ?? "",
       envelope?.mcp_tool ?? "",
       envelope?.package_name ?? "",
+      envelope?.script_name ?? "",
+      JSON.stringify(envelope?.raw_payload_redacted ?? {}),
       category.label,
       category.shortLabel,
       ...(envelope?.network_hosts ?? []),

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/dashboard/src/review-workspace.tsx

@@ -965,6 +965,7 @@ function queueItemPreview(item: GuardApprovalRequest): string {
   const envelope = item.action_envelope_json;
   return (
     envelope?.command ??
+    item.raw_command_text ??
     envelope?.mcp_tool ??
     (envelope?.prompt_text ?? envelope?.prompt_excerpt) ??
     envelope?.package_name ??

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.997"
+version = "2.0.999"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.997"
+version = "2.0.999"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/settings-workspace.js

@@ -153,7 +153,7 @@ function requireRSBlock() {
     [1, 70, 44],
     [2, 35, 17],
     [2, 35, 13],
-    // 4
+    // 4		
     [1, 100, 80],
     [2, 50, 32],
     [2, 50, 24],
@@ -168,7 +168,7 @@ function requireRSBlock() {
     [4, 43, 27],
     [4, 43, 19],
     [4, 43, 15],
-    // 7
+    // 7		
     [2, 98, 78],
     [4, 49, 31],
     [2, 32, 14, 4, 33, 15],
@@ -183,7 +183,7 @@ function requireRSBlock() {
     [3, 58, 36, 2, 59, 37],
     [4, 36, 16, 4, 37, 17],
     [4, 36, 12, 4, 37, 13],
-    // 10
+    // 10		
     [2, 86, 68, 2, 87, 69],
     [4, 69, 43, 1, 70, 44],
     [6, 43, 19, 2, 44, 20],

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -13933,10 +13933,15 @@ function searchQueue(items, term) {
       item.launch_summary ?? "",
       item.why_now ?? "",
       envelope?.command ?? "",
+      item.raw_command_text ?? "",
+      item.fallback_cli_command ?? "",
+      item.review_command ?? "",
       envelope?.prompt_text ?? envelope?.prompt_excerpt ?? "",
       envelope?.mcp_server ?? "",
       envelope?.mcp_tool ?? "",
       envelope?.package_name ?? "",
+      envelope?.script_name ?? "",
+      JSON.stringify(envelope?.raw_payload_redacted ?? {}),
       category.label,
       category.shortLabel,
       ...envelope?.network_hosts ?? [],
@@ -24883,7 +24888,7 @@ function iconForQueueCategory(categoryId) {
 }
 function queueItemPreview(item) {
   const envelope = item.action_envelope_json;
-  return envelope?.command ?? envelope?.mcp_tool ?? (envelope?.prompt_text ?? envelope?.prompt_excerpt) ?? envelope?.package_name ?? displayArtifactName(item);
+  return envelope?.command ?? item.raw_command_text ?? envelope?.mcp_tool ?? (envelope?.prompt_text ?? envelope?.prompt_excerpt) ?? envelope?.package_name ?? displayArtifactName(item);
 }
 function ReviewDecisionCard(props) {
   const detail = props.detail;

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/src/codex_plugin_scanner/guard/store_approvals.py

@@ -419,19 +419,9 @@ def list_approval_requests(
         clauses.append("created_at < ?")
         params.append(created_before)
     if search is not None:
-        search_clause = (
-            "(lower(artifact_name) like lower(?)"
-            " or lower(artifact_id) like lower(?)"
-            " or lower(coalesce(risk_summary, '')) like lower(?)"
-            " or lower(coalesce(launch_target, '')) like lower(?)"
-            " or lower(coalesce(action_identity, '')) like lower(?)"
-            " or lower(coalesce(action_envelope_json, '')) like lower(?)"
-            " or lower(coalesce(decision_v2_json, '')) like lower(?)"
-            " or lower(config_path) like lower(?))"
-        )
+        search_clause, search_params = _approval_search_clause(search)
         clauses.append(search_clause)
-        pattern = f"%{search}%"
-        params.extend([pattern, pattern, pattern, pattern, pattern, pattern, pattern, pattern])
+        params.extend(search_params)
     where_clause = f"where {' and '.join(clauses)}" if clauses else ""
     query = f"""
         select request_id, harness, artifact_id, artifact_name, artifact_type, artifact_hash, publisher, policy_action,
@@ -492,6 +482,31 @@ def _column_expr(existing: set[str], column_name: str, fallback_sql: str) -> str
     return f"{fallback_sql} as {column_name}"
 
 
+def _approval_search_clause(search: str) -> tuple[str, list[object]]:
+    pattern = f"%{search}%"
+    columns = [
+        "artifact_name",
+        "artifact_id",
+        "risk_summary",
+        "risk_headline",
+        "trigger_summary",
+        "why_now",
+        "launch_summary",
+        "launch_target",
+        "raw_command_text",
+        "fallback_cli_command",
+        "review_command",
+        "action_identity",
+        "action_envelope_json",
+        "decision_v2_json",
+        "config_path",
+    ]
+    return (
+        "(" + " or ".join(f"lower(coalesce({column}, '')) like lower(?)" for column in columns) + ")",
+        [pattern] * len(columns),
+    )
+
+
 def resolve_approval_request(
     connection: sqlite3.Connection,
     request_id: str,
@@ -531,18 +546,9 @@ def count_approval_requests(
         clauses.append("harness = ?")
         params.append(harness)
     if search is not None:
-        clauses.append(
-            "(lower(artifact_name) like lower(?)"
-            " or lower(artifact_id) like lower(?)"
-            " or lower(coalesce(risk_summary, '')) like lower(?)"
-            " or lower(coalesce(launch_target, '')) like lower(?)"
-            " or lower(coalesce(action_identity, '')) like lower(?)"
-            " or lower(coalesce(action_envelope_json, '')) like lower(?)"
-            " or lower(coalesce(decision_v2_json, '')) like lower(?)"
-            " or lower(config_path) like lower(?))"
-        )
-        pattern = f"%{search}%"
-        params.extend([pattern, pattern, pattern, pattern, pattern, pattern, pattern, pattern])
+        search_clause, search_params = _approval_search_clause(search)
+        clauses.append(search_clause)
+        params.extend(search_params)
     where_clause = f"where {' and '.join(clauses)}" if clauses else ""
     row = connection.execute(f"select count(*) as total from approval_requests {where_clause}", params).fetchone()
     return int(row["total"]) if row is not None else 0
@@ -700,18 +706,9 @@ def _approval_summary_where_clause(
         clauses.append("(last_seen_at < ? or (last_seen_at = ? and request_id < ?))")
         params.extend([marker["last_seen_at"], marker["last_seen_at"], marker["request_id"]])
     if search is not None:
-        clauses.append(
-            "(lower(artifact_name) like lower(?)"
-            " or lower(artifact_id) like lower(?)"
-            " or lower(coalesce(risk_summary, '')) like lower(?)"
-            " or lower(coalesce(launch_target, '')) like lower(?)"
-            " or lower(coalesce(action_identity, '')) like lower(?)"
-            " or lower(coalesce(action_envelope_json, '')) like lower(?)"
-            " or lower(coalesce(decision_v2_json, '')) like lower(?)"
-            " or lower(config_path) like lower(?))"
-        )
-        pattern = f"%{search}%"
-        params.extend([pattern, pattern, pattern, pattern, pattern, pattern, pattern, pattern])
+        search_clause, search_params = _approval_search_clause(search)
+        clauses.append(search_clause)
+        params.extend(search_params)
     where_clause = f"where {' and '.join(clauses)}" if clauses else ""
     return where_clause, params
 
@@ -731,6 +728,9 @@ def _row_to_approval_summary(row: sqlite3.Row) -> dict[str, object]:
         "launch_target": row["launch_target"],
         "risk_summary": row["risk_summary"],
         "risk_headline": row["risk_headline"],
+        "raw_command_text": row["raw_command_text"],
+        "fallback_cli_command": row["fallback_cli_command"],
+        "review_command": str(row["review_command"]),
         "action_identity": row["action_identity"],
         "queue_group_id": row["queue_group_id"],
         "dedupe_count": int(row["dedupe_count"] or 1),
@@ -759,7 +759,7 @@ def list_approval_request_summary_rows(
         select request_id, harness, artifact_id, artifact_name, artifact_type, policy_action,
                changed_fields_json, source_scope, config_path, workspace, launch_target,
                risk_summary, risk_headline, action_identity, queue_group_id, dedupe_count,
-               created_at, last_seen_at, status
+               raw_command_text, fallback_cli_command, review_command, created_at, last_seen_at, status
         from approval_requests
         {where_clause}
         order by last_seen_at desc, request_id desc

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/src/codex_plugin_scanner/integrations/cisco_skill_scanner.py

@@ -86,6 +86,7 @@ def _build_unavailable_summary(message: str, *, status: CiscoIntegrationStatus)
 
 
 def _scan_directory_payload(skills_dir: Path, policy_name: str) -> dict[str, object]:
+    _validate_skill_scanner_import()
     from skill_scanner import SkillScanner
     from skill_scanner.core.scan_policy import ScanPolicy
 
@@ -95,6 +96,126 @@ def _scan_directory_payload(skills_dir: Path, policy_name: str) -> dict[str, obj
     return payload if isinstance(payload, dict) else {}
 
 
+def _is_inside_prefix(path: Path) -> bool:
+    """Return True if ``path`` is inside the active venv or stdlib prefix.
+
+    Paths inside ``sys.prefix`` or ``sys.base_prefix`` are trusted even when
+    they happen to live under CWD (e.g. a local ``.venv/`` directory).
+    """
+    for prefix in (sys.prefix, sys.base_prefix):
+        try:
+            path.relative_to(Path(prefix).resolve())
+            return True
+        except ValueError:
+            pass
+    return False
+
+
+def _is_safe_sys_path_entry(entry: str) -> bool:
+    """Return True for ``sys.path`` entries safe to pass to the scanner subprocess.
+
+    Rejects empty strings, relative paths, and bare CWD — which could shadow the
+    real ``skill_scanner`` package from an attacker-controlled checkout. Paths
+    inside the active venv or stdlib prefix are always allowed, even if they
+    live under CWD (common for local ``.venv/`` setups).
+    """
+    if not entry or not entry.strip():
+        return False
+    path = Path(entry)
+    if not path.is_absolute():
+        return False
+    resolved = path.resolve()
+
+    # Always trust venv/stdlib prefixes, even inside CWD.
+    if _is_inside_prefix(resolved):
+        return True
+
+    cwd = Path.cwd().resolve()
+    if resolved == cwd:
+        return False
+    # Reject entries that are ancestors of CWD (could contain shadowing dirs).
+    try:
+        cwd.relative_to(resolved)
+        return False
+    except ValueError:
+        pass
+    return True
+
+
+def _validate_skill_scanner_import() -> None:
+    """Ensure ``skill_scanner`` resolves to a legitimate installed package.
+
+    Raises ``ImportError`` if the package is shadowed by a file or directory in
+    the current working directory or a relative ``sys.path`` entry, which would
+    allow an attacker-controlled checkout to execute arbitrary code during a
+    default Guard sync.
+    """
+    import importlib.util
+
+    try:
+        spec = importlib.util.find_spec("skill_scanner")
+    except (ValueError, ModuleNotFoundError):
+        # find_spec raises ValueError when a mock module in sys.modules
+        # has __spec__ = None. Treat as not-a-real-package: if it's already
+        # in sys.modules (test mock), let __import__ handle it; otherwise raise.
+        if "skill_scanner" not in sys.modules:
+            raise ImportError("skill_scanner package not found") from None
+        return
+    if spec is None:
+        # Not installed as a real package. If it's already in sys.modules
+        # (e.g. test mock), let __import__ handle it. Otherwise raise.
+        if "skill_scanner" not in sys.modules:
+            raise ImportError("skill_scanner package not found")
+        return
+    if spec.origin is None:
+        # Namespace package (no __init__.py) — origin is None but search
+        # locations may still point to CWD. Fall through to check them below
+        # rather than skipping validation entirely.
+        pass
+    else:
+        origin = Path(spec.origin).resolve()
+        cwd = Path.cwd().resolve()
+        if not _is_inside_prefix(origin):
+            if origin == cwd:
+                raise ImportError(
+                    "skill_scanner resolves to the current directory; refusing to import a shadowed module."
+                )
+            try:
+                origin.relative_to(cwd)
+                raise ImportError(
+                    "skill_scanner resolves inside the current working directory; refusing to import a shadowed module."
+                )
+            except ValueError:
+                pass
+    # Verify the spec's submodule search locations are also safe.
+    cwd = Path.cwd().resolve()
+    search_locations = getattr(spec, "submodule_search_locations", None) or []
+    for location in search_locations:
+        if not location:
+            continue
+        loc_path = Path(location).resolve()
+        if _is_inside_prefix(loc_path):
+            continue
+        if loc_path == cwd:
+            raise ImportError(
+                "skill_scanner search path includes the current directory; refusing to import a shadowed module."
+            )
+        try:
+            loc_path.relative_to(cwd)
+            raise ImportError(
+                "skill_scanner search path includes a CWD-relative entry; refusing to import a shadowed module."
+            )
+        except ValueError:
+            pass
+
+
+def _safe_import_skill_scanner() -> None:
+    """Validate and import ``skill_scanner`` with shadowing protection."""
+    _validate_skill_scanner_import()
+    __import__("skill_scanner")
+    __import__("skill_scanner.core.scan_policy")
+
+
 _SUBPROCESS_SCAN_SNIPPET = """
 from pathlib import Path
 import json
@@ -118,7 +239,12 @@ def _scan_directory_with_timeout(
     os.close(file_descriptor)
 
     env = os.environ.copy()
-    env["PYTHONPATH"] = os.pathsep.join(str(path) for path in sys.path)
+    # Filter sys.path to exclude CWD and relative paths that could shadow
+    # the real skill_scanner package from an attacker-controlled checkout.
+    safe_path_entries = [str(path) for path in sys.path if isinstance(path, str) and _is_safe_sys_path_entry(path)]
+    env["PYTHONPATH"] = os.pathsep.join(safe_path_entries)
+    # PYTHONSAFEPATH disables automatic CWD insertion into sys.path in the child.
+    env["PYTHONSAFEPATH"] = "1"
     try:
         try:
             result = subprocess.run(
@@ -241,16 +367,16 @@ def run_cisco_skill_scan(
         )
 
     try:
-        __import__("skill_scanner")
-        __import__("skill_scanner.core.scan_policy")
+        _safe_import_skill_scanner()
     except ImportError:
         if mode == "on":
             return _build_unavailable_summary(
-                "Cisco skill scanner is required but not installed. Ensure package dependencies are installed.",
+                "Cisco skill scanner is required but not installed or resolves to an unsafe path."
+                " Ensure package dependencies are installed from a trusted source.",
                 status=CiscoIntegrationStatus.UNAVAILABLE,
             )
         return _build_unavailable_summary(
-            "Cisco skill scanner not installed; deep skill scan skipped.",
+            "Cisco skill scanner not installed or resolves to an unsafe path; deep skill scan skipped.",
             status=CiscoIntegrationStatus.UNAVAILABLE,
         )
 

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.997"
+__version__ = "2.0.999"

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/tests/test_guard_approval_store_scale.py

@@ -292,6 +292,49 @@ class TestSearchFilter:
         results = list_approval_requests(conn, search="specialtool")
         assert len(results) == 1
 
+    def test_search_matches_raw_command_text_in_queue_pages(self) -> None:
+        conn = _make_conn()
+        req = _make_request()
+        base = dataclasses.asdict(req)
+        mod = GuardApprovalRequest(
+            **{
+                **base,
+                "request_id": str(uuid.uuid4()),
+                "artifact_name": "Bash",
+                "artifact_id": "codex:project:bash",
+                "raw_command_text": "hol-guard approvals bulk allow once",
+            }
+        )
+        _insert(conn, req)
+        _insert(conn, mod)
+
+        page = list_pending_approval_summaries(conn, search="bulk")
+
+        assert page["total_count"] == 1
+        assert page["items"][0]["request_id"] == mod.request_id
+        assert page["items"][0]["raw_command_text"] == "hol-guard approvals bulk allow once"
+
+    def test_search_matches_fallback_cli_command(self) -> None:
+        conn = _make_conn()
+        req = _make_request()
+        base = dataclasses.asdict(req)
+        mod = GuardApprovalRequest(
+            **{
+                **base,
+                "request_id": str(uuid.uuid4()),
+                "artifact_name": "Bash",
+                "artifact_id": "codex:project:bash",
+                "fallback_cli_command": "hol-guard approvals approve --reason bulk-import",
+            }
+        )
+        _insert(conn, req)
+        _insert(conn, mod)
+
+        results = list_approval_requests(conn, search="bulk-import")
+
+        assert len(results) == 1
+        assert results[0]["request_id"] == mod.request_id
+
     def test_search_no_match_returns_empty(self) -> None:
         conn = _make_conn()
         _insert(conn, _make_request())

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/tests/test_skill_security.py

@@ -109,7 +109,7 @@ def test_run_cisco_skill_scan_on_mode_requires_cisco_dependency_when_missing(mon
     summary = run_cisco_skill_scan(FIXTURES / "good-plugin" / "skills", mode="on", policy_name="balanced")
 
     assert summary.status == CiscoIntegrationStatus.UNAVAILABLE
-    assert "Ensure package dependencies are installed." in summary.message
+    assert "Ensure package dependencies are installed" in summary.message
 
 
 def test_scan_plugin_includes_cisco_findings(monkeypatch):
@@ -341,3 +341,54 @@ def test_scan_plugin_ignores_symlinked_skill_files_outside_plugin_root(tmp_path)
 
     assert analyzable_check.applicable is False
     assert "outside the plugin root" in analyzable_check.message
+def test_cisco_skill_scanner_rejects_shadowed_import_from_cwd(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """A skill_scanner module shadowed in the CWD must not be imported during sync."""
+    from codex_plugin_scanner.integrations.cisco_skill_scanner import _is_safe_sys_path_entry
+
+    # Empty, relative, and bare CWD are unsafe
+    assert _is_safe_sys_path_entry("") is False
+    assert _is_safe_sys_path_entry(".") is False
+    assert _is_safe_sys_path_entry("relative/path") is False
+
+    # Absolute paths outside CWD are safe
+    assert _is_safe_sys_path_entry("/usr/lib/python3.13/site-packages") is True
+
+    # CWD as absolute path is unsafe
+    cwd = str(Path.cwd().resolve())
+    assert _is_safe_sys_path_entry(cwd) is False
+
+    # Ancestor of CWD is unsafe (could contain shadowing dirs)
+    parent = str(Path.cwd().resolve().parent)
+    assert _is_safe_sys_path_entry(parent) is False
+
+def test_cisco_skill_scanner_validates_import_source(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """_validate_skill_scanner_import must reject modules originating from CWD."""
+    from codex_plugin_scanner.integrations import cisco_skill_scanner as scanner_mod
+    from codex_plugin_scanner.integrations.cisco_skill_scanner import _validate_skill_scanner_import
+    import importlib.util
+
+    # When skill_scanner is not installed and not in sys.modules, it should raise ImportError
+    monkeypatch.delitem(sys.modules, "skill_scanner", raising=False)
+    monkeypatch.delitem(sys.modules, "skill_scanner.core", raising=False)
+    monkeypatch.delitem(sys.modules, "skill_scanner.core.scan_policy", raising=False)
+
+    # Mock find_spec to return None (simulating package not installed)
+    monkeypatch.setattr(importlib.util, "find_spec", lambda name: None)
+
+    with pytest.raises(ImportError, match="skill_scanner package not found"):
+        _validate_skill_scanner_import()
+
+    # Restore real find_spec and mock a spec with CWD origin to test shadowing rejection
+    monkeypatch.undo()
+    monkeypatch.delitem(sys.modules, "skill_scanner", raising=False)
+
+    cwd_origin = str(Path.cwd().resolve() / "skill_scanner" / "__init__.py")
+    fake_spec = importlib.util.spec_from_file_location(
+        "skill_scanner",
+        cwd_origin,
+        submodule_search_locations=[str(Path.cwd().resolve() / "skill_scanner")],
+    )
+    monkeypatch.setattr(importlib.util, "find_spec", lambda name: fake_spec)
+
+    with pytest.raises(ImportError, match="shadowed module"):
+        _validate_skill_scanner_import()

{plugin_scanner-2.0.997 → plugin_scanner-2.0.999}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.997"
+version = "2.0.999"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },