plugin-scanner 2.2.107__tar.gz → 2.2.109__tar.gz

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.2.107
+Version: 2.2.109
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security
@@ -512,6 +512,7 @@ See [`devcontainer-features/hol-guard/README.md`](devcontainer-features/hol-guar
 | Codex | `.codex-plugin/plugin.json`, `marketplace.json`, `.agents/plugins/marketplace.json` |
 | Claude Code | `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json` |
 | Gemini CLI | `gemini-extension.json`, `commands/**/*.toml` |
+| Kimi Code | `kimi.plugin.json`, `.kimi-plugin/plugin.json`, declared skills, agents, commands, prompts, and MCP servers |
 | OpenCode | `opencode.json`, `opencode.jsonc`, `.opencode/commands`, `.opencode/plugins` |
 
 Use `--ecosystem auto` (default) to scan all detected packages in a repository, or select a single ecosystem explicitly.
@@ -550,6 +551,9 @@ plugin-scanner scan ./plugins-repo --ecosystem auto
 # Scan only Claude package surfaces
 plugin-scanner scan ./plugins-repo --ecosystem claude
 
+# Scan only native Kimi Code plugin surfaces
+plugin-scanner scan ./plugins-repo --ecosystem kimi
+
 # List supported ecosystems
 plugin-scanner --list-ecosystems
 

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/README.md

@@ -459,6 +459,7 @@ See [`devcontainer-features/hol-guard/README.md`](devcontainer-features/hol-guar
 | Codex | `.codex-plugin/plugin.json`, `marketplace.json`, `.agents/plugins/marketplace.json` |
 | Claude Code | `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json` |
 | Gemini CLI | `gemini-extension.json`, `commands/**/*.toml` |
+| Kimi Code | `kimi.plugin.json`, `.kimi-plugin/plugin.json`, declared skills, agents, commands, prompts, and MCP servers |
 | OpenCode | `opencode.json`, `opencode.jsonc`, `.opencode/commands`, `.opencode/plugins` |
 
 Use `--ecosystem auto` (default) to scan all detected packages in a repository, or select a single ecosystem explicitly.
@@ -497,6 +498,9 @@ plugin-scanner scan ./plugins-repo --ecosystem auto
 # Scan only Claude package surfaces
 plugin-scanner scan ./plugins-repo --ecosystem claude
 
+# Scan only native Kimi Code plugin surfaces
+plugin-scanner scan ./plugins-repo --ecosystem kimi
+
 # List supported ecosystems
 plugin-scanner --list-ecosystems
 

plugin_scanner-2.2.109/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 12741,
+  "maximum_test_source_lines": 291218,
+  "schema_version": 1
+}

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/dashboard/src/app.tsx

@@ -28,7 +28,7 @@ import type { AppView } from "./approval-center-primitives";
 import { buildClearPayload } from "./clear-policy-payload";
 import { harnessDisplayName, normalizeHarnessSlug } from "./approval-center-utils";
 import { ErrorBoundary } from "./error-boundary";
-import { protectionHealthFor } from "./protection-health";
+import { protectionHealthFor, remainingProtectionRepairParts } from "./protection-health";
 import { selectNextAfterResolution } from "./queue-state";
 import { useRouteFocus } from "./use-route-focus";
 
@@ -793,11 +793,19 @@ export function App() {
     }
     const remainingHealth = protectionHealthFor(refreshedSnapshot);
     if (remainingHealth.state !== "protected") {
-      const failedApps = remainingHealth.apps
-        .filter((app) => app.checks.some((check) => check.status === "fail"))
-        .map((app) => harnessDisplayName(app.harness));
-      const remaining = failedApps.length > 0
-        ? `${failedApps.join(", ")} still ${failedApps.length === 1 ? "needs" : "need"} repair.`
+      const remainingParts = remainingProtectionRepairParts(remainingHealth);
+      const failedHookApps = remainingParts.failedHookHarnesses.map((harness) => harnessDisplayName(harness));
+      const remainingMessages: string[] = [];
+      if (failedHookApps.length > 0) {
+        remainingMessages.push(
+          `${failedHookApps.join(", ")} still ${failedHookApps.length === 1 ? "needs" : "need"} hook repair.`,
+        );
+      }
+      if (remainingParts.evidenceFailed) {
+        remainingMessages.push("Command evidence still needs repair.");
+      }
+      const remaining = remainingMessages.length > 0
+        ? remainingMessages.join(" ")
         : "A local protection check still needs attention.";
       throw new Error(`${remaining} Open the repair details below for the exact check.`);
     }

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/dashboard/src/protection-health.test.ts

@@ -6,6 +6,7 @@ import {
   PROTECTION_CHECK_IDS,
   protectionHeadlineFor,
   protectionHealthFor,
+  remainingProtectionRepairParts,
 } from "./protection-health";
 import type { GuardProtectionCheck, GuardRuntimeSnapshot } from "./guard-types";
 
@@ -118,6 +119,68 @@ const fleetSource = readFileSync(new URL("./fleet-workspace.tsx", import.meta.ur
 const reviewStatesSource = readFileSync(new URL("./review-states.tsx", import.meta.url), "utf8");
 assert.match(appSource, /const handleRepairProtection = useCallback/);
 assert.match(appSource, /onRepairProtection=\{handleRepairProtection\}/);
+assert.match(appSource, /remainingProtectionRepairParts\(remainingHealth\)/);
+assert.match(appSource, /Command evidence still needs repair/);
+assert.doesNotMatch(appSource, /app\.checks\.some\(\(check\) => check\.status === "fail"\)/);
+
+const evidenceOnlyHealth = normalizeProtectionHealth({
+  ...payload(decisionFailure),
+  apps: [
+    {
+      harness: "grok",
+      state: "degraded",
+      label: "Degraded",
+      detail: "Shared evidence failed.",
+      evidence_gap: false,
+      reason_codes: ["hooks_verified"],
+      checks: checks().map((check) => (
+        check.check_id === "decision_stream"
+          ? { check_id: "decision_stream", status: "fail", reason_code: "decision_stream_failed" }
+          : check
+      )),
+    },
+  ],
+});
+assert.deepEqual(remainingProtectionRepairParts(evidenceOnlyHealth), {
+  failedHookHarnesses: [],
+  evidenceFailed: true,
+});
+
+const evidenceUnknown = checks();
+evidenceUnknown[PROTECTION_CHECK_IDS.indexOf("decision_stream")] = {
+  check_id: "decision_stream",
+  status: "unknown",
+  reason_code: "decision_stream_gap",
+};
+assert.equal(
+  remainingProtectionRepairParts(normalizeProtectionHealth(payload(evidenceUnknown))).evidenceFailed,
+  true,
+);
+
+const hookFailureChecks = checks();
+hookFailureChecks[PROTECTION_CHECK_IDS.indexOf("harness_hooks")] = {
+  check_id: "harness_hooks",
+  status: "fail",
+  reason_code: "hook_verification_failed",
+};
+const hookFailureHealth = normalizeProtectionHealth({
+  ...payload(hookFailureChecks),
+  apps: [
+    {
+      harness: "grok",
+      state: "degraded",
+      label: "Degraded",
+      detail: "Hooks failed.",
+      evidence_gap: false,
+      reason_codes: ["hook_verification_failed"],
+      checks: hookFailureChecks,
+    },
+  ],
+});
+assert.deepEqual(remainingProtectionRepairParts(hookFailureHealth), {
+  failedHookHarnesses: ["grok"],
+  evidenceFailed: false,
+});
 assert.match(appDetailSource, /Install state" value=\{active \? "Installed"/);
 assert.match(appDetailSource, /protectionHealthFor\(runtime, harness\)/);
 assert.match(fleetSource, /resolveAppStatus\(install, appProtection,/);

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/dashboard/src/protection-health.ts

@@ -172,3 +172,15 @@ export function protectionHealthFor(
   const fallback = healthFromChecks(fallbackChecks());
   return { harness: STABLE_ID.test(harness) && harness.length <= 64 ? harness : "unknown", ...fallback };
 }
+
+export function remainingProtectionRepairParts(health: GuardProtectionHealth): {
+  failedHookHarnesses: string[];
+  evidenceFailed: boolean;
+} {
+  return {
+    failedHookHarnesses: health.apps
+      .filter((app) => app.checks.some((check) => check.check_id === "harness_hooks" && check.status === "fail"))
+      .map((app) => app.harness),
+    evidenceFailed: health.checks.some((check) => check.check_id === "decision_stream" && check.status !== "pass"),
+  };
+}

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.2.107"
+version = "2.2.109"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.2.107"
+version = "2.2.109"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.2.107/release-metadata/plugin-scanner-v2.2.107.toolchain.cdx.json → plugin_scanner-2.2.109/release-metadata/plugin-scanner-v2.2.109.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "2.2.107"
+      "version": "2.2.109"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-2.2.107 → plugin_scanner-2.2.109}/src/codex_plugin_scanner/checks/code_quality.py

@@ -20,8 +20,17 @@ SHELL_INJECT_RE = re.compile(
 )
 
 
-def _find_code_files(plugin_dir: Path) -> list[Path]:
-    files = []
+def _find_code_files(plugin_dir: Path, files: tuple[Path, ...] | None = None) -> list[Path]:
+    if files is not None:
+        return [
+            path
+            for path in files
+            if path.is_file()
+            and not path.is_symlink()
+            and path.suffix in CODE_EXTS
+            and resolves_within_root(plugin_dir, path, require_exists=True)
+        ]
+    discovered: list[Path] = []
     for p in plugin_dir.rglob("*"):
         if not p.is_file() or p.suffix not in CODE_EXTS:
             continue
@@ -29,13 +38,13 @@ def _find_code_files(plugin_dir: Path) -> list[Path]:
             continue
         if not resolves_within_root(plugin_dir, p, require_exists=True):
             continue
-        files.append(p)
-    return files
+        discovered.append(p)
+    return discovered
 
 
-def check_no_eval(plugin_dir: Path) -> CheckResult:
+def check_no_eval(plugin_dir: Path, files: tuple[Path, ...] | None = None) -> CheckResult:
     findings: list[str] = []
-    for fpath in _find_code_files(plugin_dir):
+    for fpath in _find_code_files(plugin_dir, files):
         try:
             content = fpath.read_text(encoding="utf-8", errors="ignore")
         except OSError:
@@ -73,9 +82,9 @@ def check_no_eval(plugin_dir: Path) -> CheckResult:
     )
 
 
-def check_no_shell_injection(plugin_dir: Path) -> CheckResult:
+def check_no_shell_injection(plugin_dir: Path, files: tuple[Path, ...] | None = None) -> CheckResult:
     findings: list[str] = []
-    for fpath in _find_code_files(plugin_dir):
+    for fpath in _find_code_files(plugin_dir, files):
         try:
             content = fpath.read_text(encoding="utf-8", errors="ignore")
         except OSError: