plugin-scanner 2.2.111__py3-none-any.whl → 2.2.113__py3-none-any.whl

codex_plugin_scanner/guard/local_supply_chain.py

@@ -1418,7 +1418,11 @@ def _build_package_protect_authority(
         guard_home=store.guard_home,
         launch_cwd=launch_cwd,
     )
-    intent = _package_intent_parser_module().parse_package_intent(shlex.join(command), workspace=launch_cwd)
+    intent = _package_intent_parser_module().parse_package_intent(
+        shlex.join(command),
+        workspace=launch_cwd,
+        environment=launch_environment,
+    )
     if intent is None:
         return None
     sanitized_intent = replace(intent, redacted_command=shlex.join(redacted_command_tokens(command)))

codex_plugin_scanner/guard/runtime/command_builtin_extension_registry.py

@@ -53,12 +53,16 @@ _CORE_COMMAND_EXTENSION_SPECS: Final[tuple[CommandExtensionSpec, ...]] = (
     CommandExtensionSpec(
         extension_id="command.git",
         name="Git protection",
-        description="Reviews local and remote Git operations that can discard work or replace history.",
-        action_classes=("git destructive command",),
-        risk_classes=("destructive_shell",),
+        description=(
+            "Reviews local and remote Git operations that can discard work, replace history, "
+            "or read a staged index Guard cannot bound."
+        ),
+        action_classes=("git destructive command", "git index inspection"),
+        risk_classes=("destructive_shell", "local_secret_read"),
         safer_alternatives=(
             "Preview affected files and refs before destructive repository operations.",
             "Create a temporary branch or stash before discarding local work.",
+            "Inspect the staged index with git diff --cached --check or lockfile excludes.",
         ),
         reference_urls=(),
         required=True,

codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -42,6 +42,7 @@ COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "github pr body shell substitution": ("execution",),
     "filesystem destructive command": ("destructive_shell",),
     "git destructive command": ("destructive_shell",),
+    "git index inspection": ("local_secret_read",),
     "system destructive command": ("destructive_shell",),
     "windows destructive command": ("destructive_shell",),
     "kubernetes destructive command": ("destructive_shell", "network_egress"),
@@ -243,6 +244,13 @@ BUILT_IN_COMMAND_RULES = (
         action_class="GitHub PR body shell substitution",
         safer_alternative="Use a literal body file whose contents can be reviewed before submission.",
     ),
+    _compatibility_rule(
+        rule_id="command.git.index-inspection",
+        title="Git index inspection",
+        description="Identifies staged-index Git reads that Guard cannot verify as a bounded inspection.",
+        action_class="git index inspection",
+        safer_alternative="Run git diff --cached --check, or exclude lockfiles and scan the staged patch on stdin.",
+    ),
     _structured_rule(
         rule_id="command.filesystem.recursive-delete",
         title="Recursive filesystem deletion",

codex_plugin_scanner/guard/runtime/compound_git_inspection.py

@@ -131,7 +131,7 @@ def is_low_risk_git_inspection_segment(segment: ShellExecutionSegment) -> bool:
     if operation == "rev-parse":
         return _safe_rev_parse_args(args)
     if operation == "diff":
-        return _safe_diff_args(args)
+        return _safe_diff_args(args) and _git_show_has_execution_free_config(segment, repository_path=repository_path)
     if operation == "ls-files":
         return _safe_ls_files_args(args)
     if operation == "show":

codex_plugin_scanner/guard/runtime/git_index_inspection.py

@@ -0,0 +1,408 @@
+"""Staged-index Git inspection recognition for allow and extension ownership."""
+
+from __future__ import annotations
+
+import os
+from dataclasses import replace
+from pathlib import Path
+from typing import Final, Literal
+
+from .compound_git_inspection import (
+    _git_show_has_execution_free_config,
+    _safe_repository_path,
+    is_low_risk_git_inspection_segment,
+    is_low_risk_standalone_git_routine,
+)
+from .secret_file_request_services.shell_tokenization import _shell_segment_primary_command
+from .shell_execution_context import ShellExecutionContext, ShellExecutionSegment, model_shell_execution_context
+
+_CONTROL_PREFIXES: Final = frozenset({"!", "elif", "else", "fi", "if", "then"})
+_ALLOWED_CONTROLS: Final = frozenset({"&&", "||", "|", ";", "\n"})
+_RG_BOOLEAN_FLAGS: Final = frozenset({"--ignore-case", "--line-number", "--no-config", "-i", "-in", "-n", "-ni"})
+_GIT_GLOBAL_FLAG_OPTIONS: Final = frozenset(
+    {
+        "--literal-pathspecs",
+        "--no-advice",
+        "--no-lazy-fetch",
+        "--no-optional-locks",
+        "--no-pager",
+        "--no-replace-objects",
+    }
+)
+_GIT_GLOBAL_VALUE_OPTIONS: Final = frozenset(
+    {"--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree", "-C", "-c"}
+)
+_EXECUTION_ROUTING_OPTIONS: Final = frozenset({"-c", "--config-env", "--exec-path"})
+_REPOSITORY_SELECTOR_OPTIONS: Final = frozenset(
+    {"--bare", "--git-dir", "--namespace", "--paginate", "--super-prefix", "--work-tree", "-P", "-p"}
+)
+_INDEX_DIFF_FLAGS: Final = frozenset({"--cached", "--staged"})
+_CACHED_DIFF_KIND = Literal["owned", "routed"]
+_MAX_SEGMENTS: Final = 32
+
+
+def executable_tokens(tokens: tuple[str, ...]) -> tuple[str, ...] | None:
+    """Strip shell reserved-word prefixes. Empty means a no-op such as fi."""
+
+    index = 0
+    while index < len(tokens) and tokens[index] in _CONTROL_PREFIXES:
+        if tokens[index] == "fi" and len(tokens) != 1:
+            return None
+        index += 1
+    return tokens[index:]
+
+
+def _static_echo_arg_is_safe(arg: str) -> bool:
+    if "`" in arg or "$(" in arg or "<(" in arg or ">(" in arg:
+        return False
+    return "$" not in arg.replace("$?", "")
+
+
+def _index_scan_rg_args_are_safe(args: tuple[str, ...]) -> bool:
+    """Accept stdin-only ripgrep with one inline pattern after a cached diff."""
+
+    if os.environ.get("RIPGREP_CONFIG_PATH") and "--no-config" not in args:
+        return False
+    saw_pattern = False
+    for arg in args:
+        if arg.startswith("RIPGREP_CONFIG_PATH="):
+            return False
+        if arg in _RG_BOOLEAN_FLAGS:
+            continue
+        if not arg or arg.startswith("-"):
+            return False
+        if saw_pattern:
+            return False
+        if "$" in arg or any(marker in arg for marker in ("$(", "`", "<(", ">(", "\x00")):
+            return False
+        saw_pattern = True
+    return saw_pattern
+
+
+def _tokens_are_cached_diff(tokens: tuple[str, ...]) -> bool:
+    kind = cached_diff_kind(tokens)
+    return kind == "owned"
+
+
+def cached_diff_kind(tokens: tuple[str, ...]) -> _CACHED_DIFF_KIND | None:
+    """Classify one segment as an owned or execution-routed cached diff."""
+
+    stripped = executable_tokens(tokens)
+    if not stripped:
+        return None
+    command_name, command_index = _shell_segment_primary_command(list(stripped))
+    if command_name != "git" or command_index is None:
+        return None
+    args = stripped[command_index + 1 :]
+    index = 0
+    routed = False
+    while index < len(args):
+        token = args[index]
+        option_name = token.partition("=")[0]
+        if token in _GIT_GLOBAL_FLAG_OPTIONS:
+            index += 1
+            continue
+        if token == "-c" or (token.startswith("-c") and not token.startswith("-C")):
+            routed = True
+            if token == "-c":
+                if index + 1 >= len(args):
+                    return None
+                index += 2
+                continue
+            index += 1
+            continue
+        if option_name in _GIT_GLOBAL_VALUE_OPTIONS:
+            if option_name in _EXECUTION_ROUTING_OPTIONS:
+                routed = True
+            if "=" in token:
+                if not token.partition("=")[2]:
+                    return None
+                index += 1
+                continue
+            if index + 1 >= len(args):
+                return None
+            index += 2
+            continue
+        if token.startswith("-"):
+            index += 1
+            continue
+        if token != "diff":
+            return None
+        operands = args[index + 1 :]
+        options = operands[: operands.index("--")] if "--" in operands else operands
+        if not _INDEX_DIFF_FLAGS.intersection(options):
+            return None
+        return "routed" if routed else "owned"
+    return None
+
+
+def command_has_execution_routed_git_cached_diff(segments: tuple[tuple[str, ...], ...]) -> bool:
+    """Return whether any cached-diff segment overrides Git execution routing."""
+
+    return any(cached_diff_kind(tokens) == "routed" for tokens in segments)
+
+
+def command_has_owned_git_cached_diff(segments: tuple[tuple[str, ...], ...]) -> bool:
+    """Return whether the command contains a named cached-diff Guard can own."""
+
+    if command_has_execution_routed_git_cached_diff(segments):
+        return False
+    return any(cached_diff_kind(tokens) == "owned" for tokens in segments)
+
+
+def is_low_risk_git_index_inspection(
+    command_text: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None = None,
+) -> bool:
+    """Recognize a repo-bound staged-index inspection, including if/then scans."""
+
+    return index_inspection_execution_context(command_text, cwd=cwd, home_dir=home_dir) is not None
+
+
+def index_inspection_execution_context(
+    command_text: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None = None,
+) -> ShellExecutionContext | None:
+    """Return the modeled context when a staged-index scan is repo-bound."""
+
+    if cwd is None:
+        return None
+    try:
+        execution_cwd = cwd.resolve()
+    except (OSError, RuntimeError):
+        return None
+    context = model_shell_execution_context(
+        command_text,
+        cwd=execution_cwd,
+        workspace_root=execution_cwd,
+        home_dir=home_dir,
+    )
+    if not _context_is_low_risk_git_index_inspection(context, home_dir=home_dir):
+        return None
+    return context
+
+
+def _segment_has_mutating_redirection(tokens: tuple[str, ...]) -> bool:
+    for token in tokens:
+        if token in {">", ">>", ">|", "1>", "1>>", "1>|"}:
+            return True
+        if ">" in token and not token.startswith("--"):
+            return True
+    return False
+
+
+def _flow_controls(controls: tuple[str, ...]) -> tuple[str, ...]:
+    return tuple(control for control in controls if control != "\n")
+
+
+def _context_is_low_risk_git_index_inspection(
+    context: ShellExecutionContext,
+    *,
+    home_dir: Path | None,
+) -> bool:
+    if not context.segments or len(context.segments) > _MAX_SEGMENTS:
+        return False
+    if not context.complete and context.reason_code != "shell_cwd_unresolved_syntax":
+        return False
+    saw_cached_diff = False
+    previous_was_cached_diff = False
+    for segment in context.segments:
+        if any(control not in _ALLOWED_CONTROLS for control in (*segment.control_before, *segment.control_after)):
+            return False
+        tokens = executable_tokens(segment.tokens)
+        if tokens is None:
+            return False
+        if not tokens:
+            previous_was_cached_diff = False
+            continue
+        if _segment_has_mutating_redirection(segment.tokens):
+            return False
+        command_name, command_index = _shell_segment_primary_command(list(tokens))
+        if command_name is None or command_index is None:
+            return False
+        executable = tokens[command_index]
+        if "/" in executable or "\\" in executable:
+            return False
+        args = tokens[command_index + 1 :]
+        if command_name == "git":
+            if not _git_cached_diff_segment_is_safe(segment, tokens, home_dir=home_dir):
+                return False
+            saw_cached_diff = True
+            previous_was_cached_diff = True
+            continue
+        if command_name == "echo":
+            if not all(_static_echo_arg_is_safe(arg) for arg in args):
+                return False
+            previous_was_cached_diff = False
+            continue
+        if command_name == "rg":
+            if _flow_controls(segment.control_before) != ("|",) or not previous_was_cached_diff:
+                return False
+            if any(token.startswith("RIPGREP_CONFIG_PATH=") for token in segment.tokens) and "--no-config" not in args:
+                return False
+            if not _index_scan_rg_args_are_safe(args):
+                return False
+            previous_was_cached_diff = False
+            continue
+        return False
+    return saw_cached_diff
+
+
+def owned_git_index_inspection_action_class(
+    command_text: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None,
+) -> str | None:
+    """Return the Git-protection action class for an unproven cached diff."""
+
+    if "git" not in command_text or "diff" not in command_text or "--cached" not in command_text:
+        return None
+    parsing_cwd = cwd or home_dir or Path.cwd()
+    context = model_shell_execution_context(
+        command_text,
+        cwd=parsing_cwd,
+        workspace_root=parsing_cwd,
+        home_dir=home_dir,
+    )
+    segment_tokens = tuple(segment.tokens for segment in context.segments)
+    if command_has_execution_routed_git_cached_diff(segment_tokens):
+        return None
+    if not command_has_owned_git_cached_diff(segment_tokens):
+        return None
+    if cwd is not None and is_low_risk_git_index_inspection(command_text, cwd=cwd, home_dir=home_dir):
+        return None
+    if cwd is not None and is_low_risk_standalone_git_routine(context):
+        return None
+    return "git index inspection"
+
+
+_SAFE_CACHED_DIFF_FLAGS: Final = frozenset(
+    {"--cached", "--check", "--name-only", "--name-status", "--staged", "--stat", "HEAD"}
+)
+
+
+def _safe_exclude_pathspec(value: str) -> bool:
+    if not value.startswith((":!", ":^")):
+        return False
+    remainder = value[2:]
+    if not remainder or remainder.startswith((":", "/", "~")):
+        return False
+    return _safe_repository_path(remainder)
+
+
+def _cached_diff_operands_are_safe(args: tuple[str, ...]) -> bool:
+    if len(args) > 20:
+        return False
+    if "--" not in args:
+        return bool(_INDEX_DIFF_FLAGS.intersection(args)) and all(
+            arg in _SAFE_CACHED_DIFF_FLAGS or arg == "--cached" for arg in args
+        )
+    separator = args.index("--")
+    revisions = args[:separator]
+    if not _INDEX_DIFF_FLAGS.intersection(revisions):
+        return False
+    paths = args[separator + 1 :]
+    if not paths or len(paths) > 16:
+        return False
+    if any(arg not in _SAFE_CACHED_DIFF_FLAGS for arg in revisions):
+        return False
+    return all(_safe_repository_path(path) or _safe_exclude_pathspec(path) for path in paths)
+
+
+def _proof_cached_diff_tokens(tokens: tuple[str, ...]) -> tuple[str, ...]:
+    command_name, command_index = _shell_segment_primary_command(list(tokens))
+    if command_name != "git" or command_index is None:
+        return ("git", "diff", "--cached", "--check")
+    prefix = tokens[: command_index + 1]
+    args = tokens[command_index + 1 :]
+    if args[:1] == ("-C",) and len(args) >= 2:
+        return (*prefix, "-C", args[1], "diff", "--cached", "--check")
+    return (*prefix, "diff", "--cached", "--check")
+
+
+def _args_have_repository_selector(args: tuple[str, ...]) -> bool:
+    index = 0
+    while index < len(args):
+        token = args[index]
+        option_name = token.partition("=")[0]
+        if token == "-C" or token.startswith("-C") or option_name in _REPOSITORY_SELECTOR_OPTIONS:
+            return True
+        if token in _GIT_GLOBAL_FLAG_OPTIONS:
+            index += 1
+            continue
+        if option_name in _GIT_GLOBAL_VALUE_OPTIONS:
+            index += 1 if "=" in token else 2
+            continue
+        if token.startswith("-"):
+            index += 1
+            continue
+        return False
+    return False
+
+
+def _has_unproven_repository_selector(tokens: tuple[str, ...]) -> bool:
+    stripped = executable_tokens(tokens)
+    if not stripped:
+        return True
+    command_name, command_index = _shell_segment_primary_command(list(stripped))
+    if command_name != "git" or command_index is None:
+        return True
+    args = stripped[command_index + 1 :]
+    if args[:1] == ("-C",):
+        if len(args) < 2 or not args[1] or args[1].startswith("-"):
+            return True
+        return _args_have_repository_selector(args[2:])
+    return _args_have_repository_selector(args)
+
+
+def _git_cached_diff_segment_is_safe(
+    segment: ShellExecutionSegment,
+    tokens: tuple[str, ...],
+    *,
+    home_dir: Path | None,
+) -> bool:
+    if not _tokens_are_cached_diff(tokens) or _has_unproven_repository_selector(tokens):
+        return False
+    operands = git_diff_operands(tokens)
+    if operands is None or not _cached_diff_operands_are_safe(operands):
+        return False
+    synthetic = replace(segment, tokens=_proof_cached_diff_tokens(tokens))
+    repository_path = tokens[2] if tokens[:2] == ("git", "-C") and len(tokens) > 2 else None
+    return is_low_risk_git_inspection_segment(synthetic) and _git_show_has_execution_free_config(
+        synthetic, repository_path=repository_path
+    )
+
+
+def git_diff_operands(tokens: tuple[str, ...]) -> tuple[str, ...] | None:
+    kind = cached_diff_kind(tokens)
+    if kind != "owned":
+        return None
+    stripped = executable_tokens(tokens)
+    if not stripped:
+        return None
+    command_name, command_index = _shell_segment_primary_command(list(stripped))
+    if command_name != "git" or command_index is None:
+        return None
+    args = stripped[command_index + 1 :]
+    index = 0
+    while index < len(args):
+        token = args[index]
+        option_name = token.partition("=")[0]
+        if token in _GIT_GLOBAL_FLAG_OPTIONS:
+            index += 1
+            continue
+        if option_name in _GIT_GLOBAL_VALUE_OPTIONS:
+            index += 1 if "=" in token else 2
+            continue
+        if token.startswith("-"):
+            index += 1
+            continue
+        if token != "diff":
+            return None
+        return args[index + 1 :]
+    return None

codex_plugin_scanner/guard/runtime/package_intent_parser.py

@@ -10,7 +10,7 @@ import re
 import shlex
 import shutil
 import stat
-from collections.abc import Iterable
+from collections.abc import Iterable, Mapping
 from dataclasses import dataclass, replace
 from pathlib import Path
 
@@ -61,6 +61,7 @@ _CONTROL_CONTEXT_LABELS = {
 }
 _EXECUTION_CONTEXT_HMAC_KEY = os.urandom(32)
 _ENV_ASSIGNMENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=.*$")
+_ENV_REFERENCE_RE = re.compile(r"\$(?:\{(?P<braced>[A-Za-z_][A-Za-z0-9_]*)\}|(?P<plain>[A-Za-z_][A-Za-z0-9_]*))")
 _LOCAL_EXECUTION_COMMANDS = frozenset({"bunx", "npx"})
 _PACKAGE_COMMAND_NAMES = frozenset(
     {
@@ -139,6 +140,7 @@ def parse_package_intent(
     workspace: Path | None = None,
     home_dir: Path | None = None,
     canonical_command: CanonicalCommand | None = None,
+    environment: Mapping[str, str] | None = None,
 ) -> PackageIntent | None:
     handlers = {
         "npm": _parse_npm_intent,
@@ -175,7 +177,12 @@ def parse_package_intent(
         "helm": _parse_helm_intent,
     }
     intents: list[PackageIntent] = []
-    for segment in _normalized_command_segments(command_text, workspace=workspace, home_dir=home_dir):
+    for segment in _normalized_command_segments(
+        command_text,
+        workspace=workspace,
+        home_dir=home_dir,
+        environment=environment,
+    ):
         if not segment.tokens:
             continue
         command_name = _command_name(segment.tokens[0])
@@ -1191,7 +1198,9 @@ def _normalized_command_segments(
     *,
     workspace: Path | None = None,
     home_dir: Path | None = None,
+    environment: Mapping[str, str] | None = None,
 ) -> tuple[_CommandSegment, ...]:
+    inherited_environment = environment if environment is not None else os.environ
     execution_context = model_shell_execution_context(
         command_text,
         cwd=workspace,
@@ -1241,6 +1250,7 @@ def _normalized_command_segments(
                 workspace=workspace,
                 initial_cwd=modeled_cwd,
                 initial_cwd_source=context_segment.cwd_source,
+                environment=inherited_environment,
             )
         context_complete = validation_reason is None and context_segment.complete
         segments.append(
@@ -1431,10 +1441,12 @@ def _effective_execution_context(
     workspace: Path | None,
     initial_cwd: Path | None = None,
     initial_cwd_source: str | None = None,
+    environment: Mapping[str, str] | None = None,
 ) -> tuple[str | None, str, Path, str]:
+    supplied_environment = environment if environment is not None else os.environ
     effective_cwd = (initial_cwd or workspace or Path.cwd()).expanduser().resolve()
     cwd_source = initial_cwd_source or ("workspace" if workspace is not None else "process")
-    effective_path = os.environ.get("PATH")
+    effective_path = supplied_environment.get("PATH")
     path_source = "inherited" if effective_path is not None else "inherited_unset"
     index, effective_path, path_source = _consume_path_assignments(
         raw_segment,
@@ -1442,6 +1454,7 @@ def _effective_execution_context(
         effective_path,
         path_source,
         direct_source="inline",
+        environment=supplied_environment,
     )
     if index >= len(raw_segment):
         return _path_for_resolution(effective_path, effective_cwd), path_source, effective_cwd, cwd_source
@@ -1465,6 +1478,7 @@ def _effective_execution_context(
             effective_path,
             path_source,
             direct_source="inline",
+            environment=supplied_environment,
         )
         if index >= len(raw_segment):
             return _path_for_resolution(effective_path, effective_cwd), path_source, effective_cwd, cwd_source
@@ -1472,7 +1486,7 @@ def _effective_execution_context(
     if command_name != "env":
         return _path_for_resolution(effective_path, effective_cwd), path_source, effective_cwd, cwd_source
 
-    inherited_environment = dict(os.environ)
+    inherited_environment = dict(supplied_environment)
     if effective_path is None:
         inherited_environment.pop("PATH", None)
     else:
@@ -1490,10 +1504,18 @@ def _effective_execution_context(
         None,
     )
     if parsed_env.option_effects.search_path is not None:
-        effective_path = _expanded_path_assignment(parsed_env.option_effects.search_path, effective_path)
+        effective_path = _expanded_path_assignment(
+            parsed_env.option_effects.search_path,
+            effective_path,
+            environment=inherited_environment,
+        )
         path_source = "env_search_path" if effective_path is not None else "env_search_path_unresolved"
     elif path_assignment is not None:
-        effective_path = _expanded_path_assignment(path_assignment, effective_path)
+        effective_path = _expanded_path_assignment(
+            path_assignment,
+            effective_path,
+            environment=inherited_environment,
+        )
         path_source = "env" if effective_path is not None else "env_unresolved"
     elif parsed_env.option_effects.ignore_environment or path_was_unset:
         effective_path = os.defpath
@@ -1517,12 +1539,13 @@ def _consume_path_assignments(
     current_source: str,
     *,
     direct_source: str,
+    environment: Mapping[str, str],
 ) -> tuple[int, str | None, str]:
     path_source = current_source
     while index < len(tokens) and _ENV_ASSIGNMENT_RE.match(tokens[index]):
         name, _, value = tokens[index].partition("=")
         if name == "PATH":
-            current_path = _expanded_path_assignment(value, current_path)
+            current_path = _expanded_path_assignment(value, current_path, environment=environment)
             path_source = direct_source if current_path is not None else f"{direct_source}_unresolved"
         index += 1
     return index, current_path, path_source
@@ -1553,9 +1576,20 @@ def _updated_effective_cwd(current_cwd: Path, value: str) -> tuple[Path, str]:
         return current_cwd, "env_chdir_unresolved"
 
 
-def _expanded_path_assignment(value: str, current_path: str | None) -> str | None:
-    expanded = value.replace("${PATH}", current_path or "").replace("$PATH", current_path or "")
-    expanded = os.path.expandvars(expanded)
+def _expanded_path_assignment(
+    value: str,
+    current_path: str | None,
+    *,
+    environment: Mapping[str, str],
+) -> str | None:
+    expansion_environment = dict(environment)
+    expansion_environment["PATH"] = current_path or ""
+
+    def replace_reference(match: re.Match[str]) -> str:
+        name = match.group("braced") or match.group("plain")
+        return expansion_environment.get(name, match.group(0))
+
+    expanded = _ENV_REFERENCE_RE.sub(replace_reference, value)
     if "$" in expanded or "\x00" in expanded:
         return None
     return expanded

codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_routines.py

@@ -6,6 +6,7 @@ from pathlib import Path
 
 from ..compound_git_inspection import is_low_risk_git_inspection_segment
 from ..git_execution_safety import trusted_git_binary_for_cwd
+from ..git_index_inspection import is_low_risk_git_index_inspection
 from ..kubernetes_commands import kubernetes_read_only_inventory_args
 from ..shell_command_wrappers import is_trusted_absolute_command_path
 from ..shell_execution_context import ShellExecutionContext, ShellExecutionSegment, model_shell_execution_context
@@ -75,7 +76,7 @@ def _looks_like_safe_compound_developer_inspection(
 
     graph = _compound_developer_effect_graph(command_text, cwd=cwd, home_dir=home_dir)
     if graph is None or not graph.context.complete:
-        return False
+        return is_low_risk_git_index_inspection(command_text, cwd=cwd, home_dir=home_dir)
     silently_verified_effects = {
         DeveloperShellEffect.DIRECTORY,
         DeveloperShellEffect.LOCAL_READ,
@@ -151,7 +152,7 @@ def _git_segment_is_silently_verified(
         return "|" not in (*segment.control_before, *segment.control_after) and is_low_risk_git_inspection_segment(
             segment
         )
-    if operation in {"blame", "branch", "show", "worktree"}:
+    if operation in {"blame", "branch", "diff", "show", "worktree"}:
         return is_low_risk_git_inspection_segment(segment)
     return operation in {"ls-files", "rev-parse"}
 

codex_plugin_scanner/guard/runtime/secret_file_request_services/source_edit_context.py

@@ -7,6 +7,7 @@ import re
 from dataclasses import replace
 from pathlib import Path
 
+from ..git_index_inspection import index_inspection_execution_context
 from ..shell_execution_context import ShellExecutionContext, model_shell_execution_context
 from .developer_inspection import (
     _low_risk_compound_developer_execution_context,
@@ -37,11 +38,15 @@ def low_risk_compound_developer_execution_context(
         )
         return replace(recovered, command_text=command_text) if recovered is not None else None
 
-    return _low_risk_compound_developer_execution_context(
-        command_text,
-        cwd=cwd,
-        home_dir=home_dir,
-    ) or _bounded_verified_source_edit_execution_context(command_text, home_dir=home_dir)
+    return (
+        _low_risk_compound_developer_execution_context(
+            command_text,
+            cwd=cwd,
+            home_dir=home_dir,
+        )
+        or index_inspection_execution_context(command_text, cwd=cwd, home_dir=home_dir)
+        or _bounded_verified_source_edit_execution_context(command_text, home_dir=home_dir)
+    )
 
 
 def _bounded_verified_source_edit_execution_context(

codex_plugin_scanner/guard/runtime/secret_file_request_services/tool_action_requests.py

@@ -10,6 +10,7 @@ from typing import cast
 from ..command_model import CanonicalCommand
 from ..compound_git_inspection import is_low_risk_git_inspection_segment, is_low_risk_standalone_git_routine
 from ..git_execution_safety import git_status_args_are_read_only, git_status_has_execution_free_config
+from ..git_index_inspection import owned_git_index_inspection_action_class
 from ..kubernetes_commands import kubernetes_secret_read_source
 from ..shell_command_wrappers import normalize_transparent_shell_command
 from ..shell_execution_context import ShellExecutionContext, model_shell_execution_context
@@ -266,7 +267,7 @@ def _unverified_git_fetch_request(
     cwd: Path | None,
     home_dir: Path | None,
 ) -> ToolActionRequestMatch | None:
-    if "git" not in command_text or "fetch" not in command_text:
+    if "git" not in command_text:
         return None
     parsing_cwd = cwd or home_dir or Path.cwd()
     context = model_shell_execution_context(
@@ -276,7 +277,24 @@ def _unverified_git_fetch_request(
         home_dir=home_dir,
     )
     if not any(_segment_invokes_git_fetch(segment.tokens) for segment in context.segments):
-        return None
+        action_class = owned_git_index_inspection_action_class(
+            command_text,
+            cwd=cwd,
+            home_dir=home_dir,
+        )
+        if action_class is None:
+            return None
+        return ToolActionRequestMatch(
+            tool_name=tool_name,
+            normalized_tool_name=normalized_tool_name,
+            command_text=command_text,
+            action_class=action_class,
+            reason=(
+                "Git cached diff needs a repository-bound index inspection Guard can verify. "
+                "Use git diff --cached with check/stat flags or lockfile excludes, "
+                "or confirm the exact index read in Guard."
+            ),
+        )
     if cwd is not None and is_low_risk_standalone_git_routine(context):
         return None
     if context.complete and all(

codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.2.111"
+__version__ = "2.2.113"

{plugin_scanner-2.2.111.dist-info → plugin_scanner-2.2.113.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.2.111
+Version: 2.2.113
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-2.2.111.dist-info → plugin_scanner-2.2.113.dist-info}/RECORD

@@ -28,7 +28,7 @@ codex_plugin_scanner/trust_scoring.py,sha256=t_Lw13HZ766UCJzTtNNwllZK_k2ks_x-8St
 codex_plugin_scanner/trust_skill_scoring.py,sha256=e-SrMBgAruzFn4RD0pGpP9rtPXxc2ji_CKpcnFPRh3M,12542
 codex_plugin_scanner/trust_specs.py,sha256=aYGSB8M9RQp1uwhsRaWlVa1M9Vk51kUIxmBXkW8noZU,10729
 codex_plugin_scanner/verification.py,sha256=J2nsnYlxNYecSvmSQhV_leImLslCOotIK2FSmEoIjg0,27896
-codex_plugin_scanner/version.py,sha256=e2ZatvkDrTaf1ARU9WqTwI2Tlf2HJDngTRYJ2tE9ngc,72
+codex_plugin_scanner/version.py,sha256=KgFbHTUEzOtocytyfrjipxG2nB-W_SCggizSg8V1BW0,72
 codex_plugin_scanner/checks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codex_plugin_scanner/checks/best_practices.py,sha256=uB3DXLggqxjfyBMH_1yvX4nyFhpIvaRHjTyyueoO-GQ,8473
 codex_plugin_scanner/checks/claude.py,sha256=cMucH5pmKgQtBnDcycOzMMlKL-Q5HQemPqUmTLF0DzE,10189
@@ -112,7 +112,7 @@ codex_plugin_scanner/guard/inventory_item_description.py,sha256=vSSxbQLAYQHGE0oY
 codex_plugin_scanner/guard/launcher.py,sha256=2iD2taiyxGTdnWV-9PCIgVMJwEG7iowmE0K0Yt5mCC0,2533
 codex_plugin_scanner/guard/local_authority_integrity.py,sha256=dS_7IUhg__Ea5esUUklEL0ZBOgSTnqBcQ982V1bO6_Q,5832
 codex_plugin_scanner/guard/local_dashboard_session.py,sha256=LpSDyNjhblUyD589uQQUyFdsecpPmw2yWThgAKIjyHI,1722
-codex_plugin_scanner/guard/local_supply_chain.py,sha256=pOBbNgwCZsjgSdtSopb_McXlIQg5bhwOBgmiDKkuNhw,171701
+codex_plugin_scanner/guard/local_supply_chain.py,sha256=6lRbkKbzFO6Fbu30RdMUIGb3nS3ySDuvdIwyS1YiqhY,171764
 codex_plugin_scanner/guard/local_trust_contract.py,sha256=F2J3KygnvXrGtuBJ9I96RBLJg-NFqxE3gQGSPx8n-3g,14903
 codex_plugin_scanner/guard/local_trust_controller.py,sha256=6AY-kf-Q1OjPE63F4La5uX6UQqGcWhYXKkyw23jSwiU,10853
 codex_plugin_scanner/guard/managed_install_proof.py,sha256=GecgR6J6jjnV0zZ25cAJvrTfJTycuVDbCJjFn7DeCVs,3343
@@ -462,8 +462,8 @@ codex_plugin_scanner/guard/runtime/command_activity_lifecycle.py,sha256=N6MZQsCH
 codex_plugin_scanner/guard/runtime/command_activity_privacy.py,sha256=X9ytuqSTDtIDRlo294MbImLVlUjAnl5-O_FnaaXqfaM,12695
 codex_plugin_scanner/guard/runtime/command_backup_extensions.py,sha256=9lX8La9_YIicQ8J76iBC9fPGsJhxhH4YzBuzamY0GLU,10105
 codex_plugin_scanner/guard/runtime/command_builtin_extension_catalog.py,sha256=Yogu6iiOCWQU7DaPr4gfa8gOsTmu-HJns5c2DsaZUrE,2200
-codex_plugin_scanner/guard/runtime/command_builtin_extension_registry.py,sha256=0tszfUNg0Km4ROHTxbBbl-em2Aq0vDRZZR8pfzzEkIk,7923
-codex_plugin_scanner/guard/runtime/command_builtin_rules.py,sha256=FuaAdtRxdm1iwN0a1p0UiPKF__y3K_BlQFms9NF0Y18,19746
+codex_plugin_scanner/guard/runtime/command_builtin_extension_registry.py,sha256=2gXikIL5m0iO_CNRkZUgb5UMnLKcucX0wFEXySgyZqw,8139
+codex_plugin_scanner/guard/runtime/command_builtin_rules.py,sha256=-sWYS27t0kmE7vRDrnic_hZAnq4O4iMyQQ8wGGsaVXU,20185
 codex_plugin_scanner/guard/runtime/command_capability.py,sha256=12xyfo2T8YYqnX9NCcKE3eNdKKgRvyJRmgUKjZeh9Fw,25185
 codex_plugin_scanner/guard/runtime/command_cicd_extensions.py,sha256=QSyP5EP0pdeAKsTf3cZL_mEX3fyihG6KazoD7TdFEJc,6819
 codex_plugin_scanner/guard/runtime/command_cloud_extensions.py,sha256=-C9NJvqRXbIBZa11t-hh4qHwYkgjinKCoVomsHy1UEU,9601
@@ -506,7 +506,7 @@ codex_plugin_scanner/guard/runtime/command_tokens.py,sha256=GY9ehRZB8O_CGHxGh3xh
 codex_plugin_scanner/guard/runtime/command_verified_read_candidates.py,sha256=Qh_0bMm3VCp6GUkEeagcLtwYvtO0X1A_HN9_lgU-6eI,6599
 codex_plugin_scanner/guard/runtime/command_workspace_write_candidates.py,sha256=AANBnFfGC-Jzg3RL6nYkamF3ndn7obB6LhKuaH1DdaE,6633
 codex_plugin_scanner/guard/runtime/composition_rules.py,sha256=5oo0b1kL6hmFYyMSD9kCKcgA-m6fDKWy4pDeq3i1Ajk,6797
-codex_plugin_scanner/guard/runtime/compound_git_inspection.py,sha256=_KDl3nXLAs5X7-EpsijjUqOJDzXGaY0zmsuIMXxX3BM,17705
+codex_plugin_scanner/guard/runtime/compound_git_inspection.py,sha256=XxQ_pqurgsYN621nEEW2RPEZgT1iS8QRVUevZxU9t6A,17787
 codex_plugin_scanner/guard/runtime/containment_contract.py,sha256=8UN1_-Qmr8i3VmBGddlxz3Vt7Pr3q-HHQBC10hBumq0,17963
 codex_plugin_scanner/guard/runtime/containment_executor.py,sha256=RYQ2GnxRy3kHPyxTYaVEYjwIL__fMDzL5zsF2EPUHck,16454
 codex_plugin_scanner/guard/runtime/containment_health.py,sha256=Ji0wdiLjACZL0f-r5JHtOenoXEFv1JkNIELrA0iALkM,13292
@@ -530,6 +530,7 @@ codex_plugin_scanner/guard/runtime/extension_control_resolver.py,sha256=aNmVrVjt
 codex_plugin_scanner/guard/runtime/extension_evidence.py,sha256=6gS05shn1OI5bmuFxGu5El4rHuICsvpI65WJV7oezmY,10583
 codex_plugin_scanner/guard/runtime/false_positive_rules.py,sha256=OcXN1FItvuapKosg7kRNiys9YcJN4ALVzN2hKdX4VCw,24316
 codex_plugin_scanner/guard/runtime/git_execution_safety.py,sha256=D2Ma5jnvTFosfoTt9hmN2c95ZZGLOc1NTxFR9E_57HY,28722
+codex_plugin_scanner/guard/runtime/git_index_inspection.py,sha256=XlQwb_cFmdjfWoTTC3nGzJfjVEt3BIb9Gyt7_q1EQqY,14467
 codex_plugin_scanner/guard/runtime/git_pathspecs.py,sha256=skNNsz-60pnFUqsaYJI9RRkwzUGGttCF-fvMdpOq7iE,12785
 codex_plugin_scanner/guard/runtime/github_actions_read_workflow.py,sha256=-SFO8GLLBFw1iURh9TePVFCid1DCJPzKkzx45u92VCY,16904
 codex_plugin_scanner/guard/runtime/github_capability_contract.py,sha256=c7OLPdG6X_naoOrq-XpFyeoB2i0BvBzj_ynYPTjcILE,13091
@@ -585,7 +586,7 @@ codex_plugin_scanner/guard/runtime/offline_archive_worker.py,sha256=mimHsG9u6O4K
 codex_plugin_scanner/guard/runtime/package_execution_policy.py,sha256=duV4_QIDmkb6JGXOIYK9ilgfd3R0gFE8I1ON89QTuEQ,555
 codex_plugin_scanner/guard/runtime/package_intent.py,sha256=rqiGU_XnLE-xk6gN6_eVRVIIYXSBGmrBzdjwnI95BWk,681
 codex_plugin_scanner/guard/runtime/package_intent_common.py,sha256=dZizvm7vKw978ntat-uR4OzQLu-3_a-TjzlYxLtVkFg,23883
-codex_plugin_scanner/guard/runtime/package_intent_parser.py,sha256=-RNnHw_RRmZO-hZzC9CFUFdWmvdUMysbQOxakeVOL6k,65069
+codex_plugin_scanner/guard/runtime/package_intent_parser.py,sha256=VCh2qU0pGnghjD9AXvJWlhFxgDjSjm_aFzGKTGtWxcw,66214
 codex_plugin_scanner/guard/runtime/package_manager_command.py,sha256=KTxy8LFadce-GxprijT83_vxSrz2otiyoiPnvsA4dMg,5213
 codex_plugin_scanner/guard/runtime/package_manifest_diff.py,sha256=49pranXVP4qNdm0wJB232WUG_lckqeLSAn1EPEQXJpA,26327
 codex_plugin_scanner/guard/runtime/persistence_rules.py,sha256=SP8JPsL_B_ebICm2l9QG7btcblrb90VjaIeYN3WaYno,6587
@@ -650,7 +651,7 @@ codex_plugin_scanner/guard/runtime/secret_file_request_services/constants_patter
 codex_plugin_scanner/guard/runtime/secret_file_request_services/credential_exfiltration.py,sha256=y-knVxmSJyMTcgsmnbzBbcbaInmHFIJuejAvBlylLyA,12911
 codex_plugin_scanner/guard/runtime/secret_file_request_services/destructive_shell_detection.py,sha256=-KO2-JEBIn820jHxdwe0xiSI5EZPtQ8aj6MM13Nz33s,12148
 codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_inspection.py,sha256=3YImzaN_7G020orTLn6TQ4xoavSgPkdX5D_mzi29z7c,22430
-codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_routines.py,sha256=eui3zTGogz-fyPRy_NBT3r4-i6Rm1NpPL2vbnn48ZRg,11095
+codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_routines.py,sha256=UnufG04UyQ7xbwhxZHdzofIwjKlbYUjOPHiewqgBa4k,11240
 codex_plugin_scanner/guard/runtime/secret_file_request_services/docker_requests.py,sha256=c-8PEQVOG6KbryJaDKZQw9wCIlaniV_ULKPG48BC5Eg,15308
 codex_plugin_scanner/guard/runtime/secret_file_request_services/encoded_payloads.py,sha256=kiEG_GxK1Rwhji3G8mZE0VZBQ32RDqHoEEIqGgLJI7A,16106
 codex_plugin_scanner/guard/runtime/secret_file_request_services/git_routines.py,sha256=xsfuu3TPK8Ox1lFUDukN3xHG838-8Bm7FTJgbRChjWI,10335
@@ -684,8 +685,8 @@ codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_request_cl
 codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_static_safety.py,sha256=h1ew2l9euL5fIQYn2hj8b0PQiM7CUvHGR-WsS-gJ4WA,15237
 codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_stdin_sources.py,sha256=dvGdc8dJvYjFF29fdQNtixuyQsjUEXo54cx7Pf_RN_g,9887
 codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_tokenization.py,sha256=2beHCIfbvsPoF2qfqrZ5rpgpJORFf1qeSH9JNPsZTCo,12861
-codex_plugin_scanner/guard/runtime/secret_file_request_services/source_edit_context.py,sha256=uPHtXx2o-Wl4dQzI2qXp697lEh_zcVX302d4vDfjA7Q,10869
-codex_plugin_scanner/guard/runtime/secret_file_request_services/tool_action_requests.py,sha256=yOQD_b7YyXDmC1Gua_Qz7p1bCCnTC1X8NT9xNPwfsj0,16628
+codex_plugin_scanner/guard/runtime/secret_file_request_services/source_edit_context.py,sha256=iV5Z2PtenR8nWixOta4nxOYcxGYqxGRdupi-x5JjvBw,11067
+codex_plugin_scanner/guard/runtime/secret_file_request_services/tool_action_requests.py,sha256=Q8LUU6SNM8z6tCrX-AYmCwnH_7blbTJ7ypWM5M4vcVk,17352
 codex_plugin_scanner/guard/runtime/secret_file_request_services/typescript_graphql_safety.py,sha256=OFj97zDy-WjVgbVu76eONG315Z1rPUMapySb-9b52RU,13041
 codex_plugin_scanner/guard/runtime/secret_file_request_services/upload_arguments.py,sha256=25ZGoYVG5kiCK1SChRt6OdyWuDc5M6CjZS6rSNW7k1U,10579
 codex_plugin_scanner/guard/schemas/__init__.py,sha256=YFJmxLMTfLclVIQ7ngTwRkeRLdBJEAF_ljc2jJTgvjE,220
@@ -699,8 +700,8 @@ codex_plugin_scanner/integrations/cisco_skill_scanner.py,sha256=3tW9Ya5riLsIbU9Y
 codex_plugin_scanner/rules/__init__.py,sha256=bhAnNlVvEiAoksf_-Vd4f74JNz66pTINhUO2mMc8kvs,293
 codex_plugin_scanner/rules/registry.py,sha256=7BaRerM26teDUM0S48d3sPHbqzmq2JhuelC0_ni3364,4580
 codex_plugin_scanner/rules/specs.py,sha256=gpU0lijxqdSEZMMf28vciQxob-lvBEPcMQ4BG6N_r3I,650
-plugin_scanner-2.2.111.dist-info/METADATA,sha256=D-4utaCuLhWmbPskoNk_4CnHy4GHf0MlsXWry_20Vvo,47988
-plugin_scanner-2.2.111.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
-plugin_scanner-2.2.111.dist-info/entry_points.txt,sha256=SLGKi3GvvSsPwave-k2JQt2meG0pM7aaC6VlUy47Crg,122
-plugin_scanner-2.2.111.dist-info/licenses/LICENSE,sha256=UbiP0-niTtzc4d0UWk_KLc0SkRQH8AsG36b_YA-XM8E,11358
-plugin_scanner-2.2.111.dist-info/RECORD,,
+plugin_scanner-2.2.113.dist-info/METADATA,sha256=fiqzYiXI-fXoa2tKa1TR-zZ9k33Zrj4y4t7qoMj1Jdg,47988
+plugin_scanner-2.2.113.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+plugin_scanner-2.2.113.dist-info/entry_points.txt,sha256=SLGKi3GvvSsPwave-k2JQt2meG0pM7aaC6VlUy47Crg,122
+plugin_scanner-2.2.113.dist-info/licenses/LICENSE,sha256=UbiP0-niTtzc4d0UWk_KLc0SkRQH8AsG36b_YA-XM8E,11358
+plugin_scanner-2.2.113.dist-info/RECORD,,