plugin-scanner 2.2.113__py3-none-any.whl → 2.2.115__py3-none-any.whl

codex_plugin_scanner/guard/config.py

@@ -563,18 +563,33 @@ def update_guard_settings(
         if key not in EDITABLE_GUARD_SETTING_KEYS:
             continue
         next_payload[key] = _coerce_editable_setting(key, value)
+    effective_next_payload = next_payload
     if current_config.managed_policy is not None:
-        composed = apply_managed_policy(next_payload, current_config.managed_policy)
+        effective_next_payload = apply_managed_policy(next_payload, current_config.managed_policy)
         missing = object()
         weakened = [
             key
             for key in current_config.managed_locked_settings
             if (requested := _nested_setting_value(next_payload, key, missing)) is not missing
-            and _nested_setting_value(composed, key, missing) != requested
+            and _nested_setting_value(effective_next_payload, key, missing) != requested
         ]
         if weakened:
             raise ValueError(f"Managed policy locks prevent weakening: {', '.join(sorted(weakened))}")
-    if next_payload.get("sync") is True and not cloud_sync_entitled:
+    preserving_sync_while_switching_to_watch_only = (
+        current.get("sync") is True
+        and current_config.sync is True
+        and next_payload.get("sync") is True
+        and current.get("mode") != "observe"
+        and current_config.mode != "observe"
+        and payload.get("mode") == "observe"
+        and next_payload.get("mode") == "observe"
+        and effective_next_payload.get("mode") == "observe"
+    )
+    if (
+        next_payload.get("sync") is True
+        and not cloud_sync_entitled
+        and not preserving_sync_while_switching_to_watch_only
+    ):
         raise ValueError("Cloud sync requires a paid team plan.")
     _write_guard_config(guard_home / "config.toml", next_payload)
     return load_guard_config(guard_home)

codex_plugin_scanner/guard/daemon/hook_process_runner.py

@@ -33,7 +33,7 @@ from .hook_process_worker import (
 _HOOK_PROCESS_MAX_LIMIT = 16
 _HOOK_PROCESS_TIMEOUT_SECONDS = 2.8
 _HOOK_PROCESS_READY_TIMEOUT_SECONDS = 14.0
-_HOOK_PROCESS_BACKFILL_DELAY_SECONDS = 2.0
+_HOOK_PROCESS_BACKFILL_DELAY_SECONDS = 30.0
 _HOOK_PROCESS_BACKFILL_MAX_DEFERRAL_SECONDS = 5.0
 _HOOK_PROCESS_RETRY_MAX_SECONDS = 5.0
 _HOOK_PROCESS_RETRY_READY_SECONDS = 0.75
@@ -378,8 +378,16 @@ class HookProcessRunner:
         if adaptive_capacity is None:
             return
         adaptive_capacity.observe_load(queue_p95_ms=queue_p95_ms, queued=queued)
+        if queued > 0:
+            self.notify_queued_work()
         self._refresh_capacity_policy()
 
+    def notify_queued_work(self) -> None:
+        with self._state_lock:
+            self._backfill_not_before = 0.0
+            self._backfill_force_after = 0.0
+        self._recovery_event.set()
+
     def close(self) -> None:
         _ = self.close_contained()
 

codex_plugin_scanner/guard/daemon/runtime_hook_scheduler.py

@@ -48,6 +48,7 @@ class RuntimeHookScheduler:
         per_client_queued_limit: int = 32,
         retained_bytes_limit: int = 32 * 1024 * 1024,
         monotonic: Callable[[], float] = time.monotonic,
+        queue_listener: Callable[[], None] | None = None,
     ):
         limits = (
             active_limit,
@@ -66,6 +67,7 @@ class RuntimeHookScheduler:
         self._per_client_queued_limit = per_client_queued_limit
         self._retained_bytes_limit = retained_bytes_limit
         self._monotonic = monotonic
+        self._queue_listener = queue_listener
         self._condition = threading.Condition()
         self._queues: dict[
             RuntimeHookLane,
@@ -156,6 +158,8 @@ class RuntimeHookScheduler:
             else:
                 self._retained_bytes += payload_bytes
             self._dispatch()
+            if not item.admitted and self._queue_listener is not None:
+                self._queue_listener()
             while not item.admitted and item.rejection_reason is None:
                 remaining = resolved_deadline.expires_at - self._monotonic()
                 if remaining <= 0:
@@ -275,6 +279,10 @@ class RuntimeHookScheduler:
             self._active_limit = active_limit
             self._dispatch()
 
+    def set_queue_listener(self, listener: Callable[[], None]) -> None:
+        with self._condition:
+            self._queue_listener = listener
+
     def _reject(self, reason_code: RuntimeHookAdmissionReason) -> RuntimeHookAdmission:
         self._rejected[reason_code] = self._rejected.get(reason_code, 0) + 1
         return RuntimeHookAdmission(None, reason_code)

codex_plugin_scanner/guard/daemon/server.py

@@ -551,6 +551,7 @@ class _GuardDaemonHttpServer(HTTPServer):
         self.unclassified_watchdog_thread = None
         self.hook_process_runner = HookProcessRunner(guard_home=store.guard_home)
         self.hook_process_runner.set_capacity_listener(self.runtime_hook_process_scheduler.set_active_limit)
+        self.runtime_hook_process_scheduler.set_queue_listener(self.hook_process_runner.notify_queued_work)
         self.runtime_heartbeat = RuntimeHeartbeatWriter(
             store=store,
             session_id=runtime_session_id,
@@ -3842,7 +3843,15 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         return managers, None
 
     def _supply_chain_entitlement(self) -> dict[str, object]:
-        return resolve_package_firewall_entitlement_with_refresh(self.server.store)  # type: ignore[attr-defined]
+        server = self.server  # type: ignore[attr-defined]
+        with server.guard_cloud_browser_session_lock:
+            cloud_connect = _copy_guard_cloud_connect_state(server)
+            package_connect = _copy_package_firewall_connect_state(server)
+            if _guard_cloud_connect_state_is_in_flight(cloud_connect) or _guard_cloud_connect_state_is_in_flight(
+                package_connect
+            ):
+                return resolve_package_firewall_entitlement(server.store)
+            return resolve_package_firewall_entitlement_with_refresh(server.store)
 
     def _handle_get_supply_chain_bundle(self) -> None:
         store = self.server.store  # type: ignore[attr-defined]
@@ -7711,10 +7720,7 @@ class GuardDaemonServer:
             self._thread = threading.Thread(target=self._serve_forever, daemon=True)
             self._thread.start()
             serve_thread_started = True
-            self._server.hook_process_runner.enable_full_capacity(
-                delay_seconds=0,
-                active_deferral_seconds=0,
-            )
+            self._server.hook_process_runner.enable_full_capacity()
         except BaseException as error:
             self._diagnostics.record_exception("daemon_start_thread_failed")
             serve_thread_contained = True
@@ -7737,10 +7743,7 @@ class GuardDaemonServer:
 
     def serve(self) -> None:
         self._begin_service()
-        self._server.hook_process_runner.enable_full_capacity(
-            delay_seconds=0,
-            active_deferral_seconds=0,
-        )
+        self._server.hook_process_runner.enable_full_capacity()
         self._serve_forever()
 
     def stop(self) -> None:

codex_plugin_scanner/guard/runtime/false_positive_rules.py

@@ -75,6 +75,10 @@ KNOWN_SKILL_DOC_ROOT_SUFFIXES = (
     ".agents/skills",
     ".claude/skills",
 )
+KNOWN_AGENT_DOC_SUFFIXES = (
+    ".codex/docs/harness-engineering.md",
+    ".codex/docs/token-discipline.md",
+)
 FD_OPTION_VALUE_FLAGS = frozenset(
     {
         "-d",
@@ -152,6 +156,15 @@ def target_is_known_skill_doc_path(target: str, *, home_dir: Path | None = None)
             root=root,
         ):
             return True
+    for suffix in KNOWN_AGENT_DOC_SUFFIXES:
+        expected = f"{home}/{suffix}"
+        if (
+            normalized == expected
+            and os.path.isfile(expected)
+            and not os.path.islink(home)
+            and not _path_has_symlink_component(normalized, root=home)
+        ):
+            return True
     return False
 
 

codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.2.113"
+__version__ = "2.2.115"

{plugin_scanner-2.2.113.dist-info → plugin_scanner-2.2.115.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.2.113
+Version: 2.2.115
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security
@@ -9,6 +9,7 @@ Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/m
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard
 Project-URL: Issues, https://github.com/hashgraph-online/hol-guard/issues
 Project-URL: Changelog, https://github.com/hashgraph-online/hol-guard/releases
+Project-URL: Dataset, https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security
 Author-email: HOL <support@hol.org>
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -949,6 +950,7 @@ Plugins that pass the scanner with a high score are candidates for listing in th
 ## Resources
 
 - [HOL Plugin Registry](https://hol.org/registry/plugins)
+- [HOL Plugin Security dataset on Hugging Face](https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security)
 - [HOL Standards Documentation](https://hol.org/docs/standards)
 - [OpenAI Codex Plugin Documentation](https://developers.openai.com/codex/plugins)
 - [Model Context Protocol Documentation](https://modelcontextprotocol.io)
@@ -956,6 +958,8 @@ Plugins that pass the scanner with a high score are candidates for listing in th
 - [Cisco AI MCP Scanner](https://pypi.org/project/cisco-ai-mcp-scanner/)
 - [HOL GitHub Organization](https://github.com/hashgraph-online)
 
+A scan is not a safety guarantee. Runtime benchmark fixtures in the dataset are modeled, not live attacks. The dataset's ~205 scored plugins are the plugin catalog, not the Registry Broker agent catalog. Hashgraph Online's org-wide GitHub star total is not a star count for this repository.
+
 ## License
 
 Apache-2.0

{plugin_scanner-2.2.113.dist-info → plugin_scanner-2.2.115.dist-info}/RECORD

@@ -28,7 +28,7 @@ codex_plugin_scanner/trust_scoring.py,sha256=t_Lw13HZ766UCJzTtNNwllZK_k2ks_x-8St
 codex_plugin_scanner/trust_skill_scoring.py,sha256=e-SrMBgAruzFn4RD0pGpP9rtPXxc2ji_CKpcnFPRh3M,12542
 codex_plugin_scanner/trust_specs.py,sha256=aYGSB8M9RQp1uwhsRaWlVa1M9Vk51kUIxmBXkW8noZU,10729
 codex_plugin_scanner/verification.py,sha256=J2nsnYlxNYecSvmSQhV_leImLslCOotIK2FSmEoIjg0,27896
-codex_plugin_scanner/version.py,sha256=KgFbHTUEzOtocytyfrjipxG2nB-W_SCggizSg8V1BW0,72
+codex_plugin_scanner/version.py,sha256=JXWXgt0gmKSN9EVXj5CPjdQPxrIAGpASQT6Y45ltqm8,72
 codex_plugin_scanner/checks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codex_plugin_scanner/checks/best_practices.py,sha256=uB3DXLggqxjfyBMH_1yvX4nyFhpIvaRHjTyyueoO-GQ,8473
 codex_plugin_scanner/checks/claude.py,sha256=cMucH5pmKgQtBnDcycOzMMlKL-Q5HQemPqUmTLF0DzE,10189
@@ -92,7 +92,7 @@ codex_plugin_scanner/guard/codex_hook_sources.py,sha256=eVc0ZQa7gQnc0BTdoDTAllaw
 codex_plugin_scanner/guard/codex_hook_windows_job.py,sha256=OudOk-RS-0nFFLxfZ4zrdkyDDyvEka6CWWRF3qYJTCM,13215
 codex_plugin_scanner/guard/codex_resume.py,sha256=t7xDUNu2SNXkmXraCSaxKZT6Go2JS_Dx1N7rNWGj0o8,15287
 codex_plugin_scanner/guard/codex_skill_config.py,sha256=XRTY74DiZBf41hdB2HEAr0MzxElhPoN8m9ATle5BzYY,3888
-codex_plugin_scanner/guard/config.py,sha256=sLjWWrWa6_j28c_Ikl14mJHAsxqZXCetDHSvGdeMFCU,46772
+codex_plugin_scanner/guard/config.py,sha256=-9pCQlMLu8DqUWTVJceEUcs-KGVSpAI6o6Xdyw1c6u8,47354
 codex_plugin_scanner/guard/contained_node_execution.py,sha256=jMZjMAG-T2-Sr-wW1ATF195teCtHL2VX0jpUcLvsXA4,10142
 codex_plugin_scanner/guard/contained_package_script_execution.py,sha256=CfXrKpchS1nKLgYIMGHXOBpIFd7T1aInYQ6xtz0RY5U,9821
 codex_plugin_scanner/guard/contained_typescript_execution.py,sha256=daiudtJEkzvWl9yFItDE9cuWiUsxp3-qLtdCfjALP50,9701
@@ -379,7 +379,7 @@ codex_plugin_scanner/guard/daemon/hook_process_capacity.py,sha256=slI6INGDoze-Ql
 codex_plugin_scanner/guard/daemon/hook_process_entrypoint.py,sha256=9EEP1bU1R2mXW5cLJaNQPv2xpplI3qWbad5_bfAj5Fs,10105
 codex_plugin_scanner/guard/daemon/hook_process_metrics.py,sha256=QzZm_476SgDj2lZubrJaqEIgwhMTVZtWjvKZ9HOYSMU,1186
 codex_plugin_scanner/guard/daemon/hook_process_protocol.py,sha256=rJPrSUh5zpxVVqy-iv51d1jZ1isI1KUex06jFwehLcU,2886
-codex_plugin_scanner/guard/daemon/hook_process_runner.py,sha256=BJD-nij6aUzsupU4Mk7NXTMMrJGUPpl_RBanYphZQ58,30068
+codex_plugin_scanner/guard/daemon/hook_process_runner.py,sha256=FCHW112Z9HH0pDHIqwvPcI6VhJL1OdaWFFaxsNUMMOc,30328
 codex_plugin_scanner/guard/daemon/hook_process_spawner.py,sha256=Ddt6csH4NKsY-3BgolcvWJOAFw4PPJOwKgPNTSoh_V8,2510
 codex_plugin_scanner/guard/daemon/hook_process_worker.py,sha256=JmU9w4LYfvN4UVheSutOTr8iiOllpLRH5GogIOVgq4U,5341
 codex_plugin_scanner/guard/daemon/hook_worker.py,sha256=Kxh71Va1YCO8YmuWgkM_HbvAPX5Gkylre63E5C8lD3o,13522
@@ -390,11 +390,11 @@ codex_plugin_scanner/guard/daemon/request_executor.py,sha256=kaQlyO3mFFQwvpkO_ix
 codex_plugin_scanner/guard/daemon/runtime_heartbeat.py,sha256=m7Rsx-XZ8yr8KFBb0WLlBOlJQwoubjbFClSKU5KVj-w,3250
 codex_plugin_scanner/guard/daemon/runtime_hook_deadline.py,sha256=A0eahNg0qESgx6w8hoeDBGsLX--eHTEb09szX5nFbzg,2127
 codex_plugin_scanner/guard/daemon/runtime_hook_evidence_writer.py,sha256=ik4CdGOONj2dliINuz5F0ABhkOAPq3ewzOpH9ivfMK0,17142
-codex_plugin_scanner/guard/daemon/runtime_hook_scheduler.py,sha256=lbhZRhLJJNIyCmhmBLjD3Yj244VaYC18VV7TVt4Vgdk,23096
+codex_plugin_scanner/guard/daemon/runtime_hook_scheduler.py,sha256=be9VH8FP6AnNsNBcRsLTXBPkQju8Sn0u_1HoHCITO-0,23457
 codex_plugin_scanner/guard/daemon/runtime_hook_scheduler_contracts.py,sha256=xRA1qtZmR0ahj9uemONijTnMKL1YborwH91n4bJ41Cg,4712
 codex_plugin_scanner/guard/daemon/runtime_hook_scheduler_types.py,sha256=MvLMtsPRep3IxloxVCcfJMLuErfo2BYE1XZtTt57tEs,361
 codex_plugin_scanner/guard/daemon/runtime_hook_work_item.py,sha256=6MqBrA14jydaLHJ8B2x0tdkPq_weaVeNV6oIlB0va2Y,1246
-codex_plugin_scanner/guard/daemon/server.py,sha256=jruYNaVv286RN0yPXckNjIcFE40-zX2QYci0ot9qFeY,372657
+codex_plugin_scanner/guard/daemon/server.py,sha256=PjajE4KYb2XZK_4w6OnIO3NdD7cdr3EZEkxiVZph5Kw,373059
 codex_plugin_scanner/guard/daemon/static/apple-touch-icon.png,sha256=thrVc0duH3ETg03qlRer9714JpRh0DGYqp2RpvVGTdc,12211
 codex_plugin_scanner/guard/daemon/static/favicon-16x16.png,sha256=jcclKW2ZXshOJUMLjY8RkvWtd7gy60dibk4gftGyY8c,519
 codex_plugin_scanner/guard/daemon/static/favicon-32x32.png,sha256=kFgVF3ZorfAwCCc5BlCL6GYaoPilCf3m5H4elkPUeso,1352
@@ -528,7 +528,7 @@ codex_plugin_scanner/guard/runtime/extension_control_contract.py,sha256=t2NLJP5D
 codex_plugin_scanner/guard/runtime/extension_control_proof.py,sha256=uHrDTkunxlFrpFULiZXyrh8v4H6jbTKFyWhkSmbsgkE,6194
 codex_plugin_scanner/guard/runtime/extension_control_resolver.py,sha256=aNmVrVjtKv6EAZlFhU64BijfzBABWXutvZDZly5B-4s,8420
 codex_plugin_scanner/guard/runtime/extension_evidence.py,sha256=6gS05shn1OI5bmuFxGu5El4rHuICsvpI65WJV7oezmY,10583
-codex_plugin_scanner/guard/runtime/false_positive_rules.py,sha256=OcXN1FItvuapKosg7kRNiys9YcJN4ALVzN2hKdX4VCw,24316
+codex_plugin_scanner/guard/runtime/false_positive_rules.py,sha256=JgrrdxI_2af9AdklCzOAHTJ38tVPpFtStqSL1A9p8gI,24746
 codex_plugin_scanner/guard/runtime/git_execution_safety.py,sha256=D2Ma5jnvTFosfoTt9hmN2c95ZZGLOc1NTxFR9E_57HY,28722
 codex_plugin_scanner/guard/runtime/git_index_inspection.py,sha256=XlQwb_cFmdjfWoTTC3nGzJfjVEt3BIb9Gyt7_q1EQqY,14467
 codex_plugin_scanner/guard/runtime/git_pathspecs.py,sha256=skNNsz-60pnFUqsaYJI9RRkwzUGGttCF-fvMdpOq7iE,12785
@@ -700,8 +700,8 @@ codex_plugin_scanner/integrations/cisco_skill_scanner.py,sha256=3tW9Ya5riLsIbU9Y
 codex_plugin_scanner/rules/__init__.py,sha256=bhAnNlVvEiAoksf_-Vd4f74JNz66pTINhUO2mMc8kvs,293
 codex_plugin_scanner/rules/registry.py,sha256=7BaRerM26teDUM0S48d3sPHbqzmq2JhuelC0_ni3364,4580
 codex_plugin_scanner/rules/specs.py,sha256=gpU0lijxqdSEZMMf28vciQxob-lvBEPcMQ4BG6N_r3I,650
-plugin_scanner-2.2.113.dist-info/METADATA,sha256=fiqzYiXI-fXoa2tKa1TR-zZ9k33Zrj4y4t7qoMj1Jdg,47988
-plugin_scanner-2.2.113.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
-plugin_scanner-2.2.113.dist-info/entry_points.txt,sha256=SLGKi3GvvSsPwave-k2JQt2meG0pM7aaC6VlUy47Crg,122
-plugin_scanner-2.2.113.dist-info/licenses/LICENSE,sha256=UbiP0-niTtzc4d0UWk_KLc0SkRQH8AsG36b_YA-XM8E,11358
-plugin_scanner-2.2.113.dist-info/RECORD,,
+plugin_scanner-2.2.115.dist-info/METADATA,sha256=FfYtwLepDhWnO6diFUleazcOrGe5Yx5tKAHAjc7LywI,48487
+plugin_scanner-2.2.115.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+plugin_scanner-2.2.115.dist-info/entry_points.txt,sha256=SLGKi3GvvSsPwave-k2JQt2meG0pM7aaC6VlUy47Crg,122
+plugin_scanner-2.2.115.dist-info/licenses/LICENSE,sha256=UbiP0-niTtzc4d0UWk_KLc0SkRQH8AsG36b_YA-XM8E,11358
+plugin_scanner-2.2.115.dist-info/RECORD,,