plugin-scanner 3.0.0a201__tar.gz → 3.0.0a204__tar.gz

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.0a201
+Version: 3.0.0a204
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security
@@ -957,6 +957,7 @@ Plugins that pass the scanner with a high score are candidates for listing in th
 ## Resources
 
 - [HOL Plugin Registry](https://hol.org/registry/plugins)
+- [HOL Plugin Security dataset on Hugging Face](https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security)
 - [HOL Standards Documentation](https://hol.org/docs/standards)
 - [OpenAI Codex Plugin Documentation](https://developers.openai.com/codex/plugins)
 - [Model Context Protocol Documentation](https://modelcontextprotocol.io)
@@ -964,6 +965,8 @@ Plugins that pass the scanner with a high score are candidates for listing in th
 - [Cisco AI MCP Scanner](https://pypi.org/project/cisco-ai-mcp-scanner/)
 - [HOL GitHub Organization](https://github.com/hashgraph-online)
 
+A scan is not a safety guarantee. Runtime benchmark fixtures in the dataset are modeled, not live attacks. The dataset's ~205 scored plugins are the plugin catalog, not the Registry Broker agent catalog. Hashgraph Online's org-wide GitHub star total is not a star count for this repository.
+
 ## License
 
 Apache-2.0

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/README.md

@@ -901,6 +901,7 @@ Plugins that pass the scanner with a high score are candidates for listing in th
 ## Resources
 
 - [HOL Plugin Registry](https://hol.org/registry/plugins)
+- [HOL Plugin Security dataset on Hugging Face](https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security)
 - [HOL Standards Documentation](https://hol.org/docs/standards)
 - [OpenAI Codex Plugin Documentation](https://developers.openai.com/codex/plugins)
 - [Model Context Protocol Documentation](https://modelcontextprotocol.io)
@@ -908,6 +909,8 @@ Plugins that pass the scanner with a high score are candidates for listing in th
 - [Cisco AI MCP Scanner](https://pypi.org/project/cisco-ai-mcp-scanner/)
 - [HOL GitHub Organization](https://github.com/hashgraph-online)
 
+A scan is not a safety guarantee. Runtime benchmark fixtures in the dataset are modeled, not live attacks. The dataset's ~205 scored plugins are the plugin catalog, not the Registry Broker agent catalog. Hashgraph Online's org-wide GitHub star total is not a star count for this repository.
+
 ## License
 
 Apache-2.0

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/ci/code-quality-baseline.json

@@ -546,13 +546,13 @@
     "src/codex_plugin_scanner/guard/runtime/command_executors.py": 1032,
     "src/codex_plugin_scanner/guard/runtime/command_queue.py": 735,
     "src/codex_plugin_scanner/guard/runtime/command_rules.py": 541,
-    "src/codex_plugin_scanner/guard/runtime/compound_git_inspection.py": 559,
+    "src/codex_plugin_scanner/guard/runtime/compound_git_inspection.py": 573,
     "src/codex_plugin_scanner/guard/runtime/data_flow_rules.py": 610,
     "src/codex_plugin_scanner/guard/runtime/decisions.py": 1071,
     "src/codex_plugin_scanner/guard/runtime/detectors.py": 882,
     "src/codex_plugin_scanner/guard/runtime/direct_vitest.py": 617,
     "src/codex_plugin_scanner/guard/runtime/false_positive_rules.py": 738,
-    "src/codex_plugin_scanner/guard/runtime/git_execution_safety.py": 833,
+    "src/codex_plugin_scanner/guard/runtime/git_execution_safety.py": 835,
     "src/codex_plugin_scanner/guard/runtime/github_command_capabilities.py": 647,
     "src/codex_plugin_scanner/guard/runtime/kubernetes_commands.py": 607,
     "src/codex_plugin_scanner/guard/runtime/linux_artifact_lifecycle.py": 678,
@@ -707,7 +707,7 @@
     "tests/test_guard_runtime_detectors.py": 1559,
     "tests/test_guard_runtime_mcp_saved_blocks.py": 2527,
     "tests/test_guard_shell_execution_context.py": 745,
-    "tests/test_guard_standalone_git_routine.py": 622,
+    "tests/test_guard_standalone_git_routine.py": 625,
     "tests/test_guard_store_migrations.py": 2442,
     "tests/test_guard_supply_chain_bundle.py": 655,
     "tests/test_guard_supply_chain_daemon.py": 613,

plugin_scanner-3.0.0a204/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 15173,
+  "maximum_test_source_lines": 327407,
+  "schema_version": 1
+}

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.0.0a201"
+version = "3.0.0a204"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.0.0a201"
+version = "3.0.0a204"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.0.0a201/release-metadata/plugin-scanner-v3.0.0a201.toolchain.cdx.json → plugin_scanner-3.0.0a204/release-metadata/plugin-scanner-v3.0.0a204.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.0.0a201"
+      "version": "3.0.0a204"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/src/codex_plugin_scanner/guard/runtime/command_builtin_extension_registry.py

@@ -54,12 +54,16 @@ _CORE_COMMAND_EXTENSION_SPECS: Final[tuple[CommandExtensionSpec, ...]] = (
     CommandExtensionSpec(
         extension_id="command.git",
         name="Git protection",
-        description="Reviews local and remote Git operations that can discard work or replace history.",
-        action_classes=("git destructive command",),
-        risk_classes=("destructive_shell",),
+        description=(
+            "Reviews local and remote Git operations that can discard work, replace history, "
+            "or refresh a remote Guard cannot verify."
+        ),
+        action_classes=("git destructive command", "git origin refresh"),
+        risk_classes=("destructive_shell", "network_egress"),
         safer_alternatives=(
             "Preview affected files and refs before destructive repository operations.",
             "Create a temporary branch or stash before discarding local work.",
+            "Run fetch from the repository with a named origin instead of a URL remote.",
         ),
         reference_urls=(),
         required=True,

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/src/codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -43,6 +43,7 @@ COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "github pr body shell substitution": ("execution",),
     "filesystem destructive command": ("destructive_shell",),
     "git destructive command": ("destructive_shell",),
+    "git origin refresh": ("network_egress",),
     "system destructive command": ("destructive_shell",),
     "windows destructive command": ("destructive_shell",),
     "kubernetes destructive command": ("destructive_shell", "network_egress"),
@@ -117,6 +118,7 @@ def _compatibility_rule(
     safer_alternative: str,
     matcher: CommandMatcher | None = None,
     example_command: str | None = None,
+    family: str | None = None,
 ) -> CommandSafetyRule:
     return CommandSafetyRule(
         rule_id=rule_id,
@@ -129,6 +131,7 @@ def _compatibility_rule(
         matcher=matcher,
         compatibility_fallback=True,
         example_command=example_command,
+        family=family,
     )
 
 
@@ -292,6 +295,15 @@ BUILT_IN_COMMAND_RULES = (
         action_class="filesystem destructive command",
         safer_alternative="Preview affected paths and apply the change to the narrowest directory possible.",
     ),
+    _compatibility_rule(
+        rule_id="command.git.unverified-fetch",
+        family="git-remote",
+        example_command="git fetch origin",
+        title="Git origin refresh",
+        description="Identifies named-origin Git fetch operations that Guard cannot verify as safe.",
+        action_class="git origin refresh",
+        safer_alternative="Run fetch from the repository with a named origin, optional quiet flags, and named refs.",
+    ),
     _structured_rule(
         rule_id="command.git.hard-reset",
         family="git-destructive",

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/src/codex_plugin_scanner/guard/runtime/compound_git_inspection.py

@@ -272,10 +272,24 @@ def _safe_bounded_log_args(args: tuple[str, ...]) -> bool:
     return len(refs) <= 1 and all(_safe_ref(ref) for ref in refs)
 
 
+_SAFE_FETCH_FLAGS: Final = frozenset({"-q", "--quiet", "--no-tags"})
+
+
 def _safe_fetch_args(args: tuple[str, ...]) -> bool:
-    if args in {("origin",), ("origin", "--quiet"), ("--quiet", "origin")}:
-        return True
-    return len(args) == 2 and args[0] == "origin" and _safe_ref(args[1])
+    if not args or len(args) > 16:
+        return False
+    remote: str | None = None
+    refs: list[str] = []
+    for arg in args:
+        if arg in _SAFE_FETCH_FLAGS:
+            continue
+        if arg.startswith("-") or (remote is None and arg != "origin"):
+            return False
+        if remote is None:
+            remote = arg
+            continue
+        refs.append(arg)
+    return remote == "origin" and len(refs) <= 12 and all(_safe_ref(ref) for ref in refs)
 
 
 def _safe_ls_remote_args(args: tuple[str, ...]) -> bool:

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/src/codex_plugin_scanner/guard/runtime/git_execution_safety.py

@@ -626,6 +626,8 @@ def _git_fetch_config_routes_execution(config: dict[str, tuple[str, ...]]) -> bo
         return True
     if any(value.strip() for value in config.get("core.askpass", ())):
         return True
+    if any(value.strip() for value in config.get("core.sshcommand", ())):
+        return True
     for key, values in config.items():
         if not (key.startswith("url.") and key.endswith(".insteadof")):
             continue

plugin_scanner-3.0.0a204/src/codex_plugin_scanner/guard/runtime/git_origin_refresh.py

@@ -0,0 +1,97 @@
+"""Origin-shaped Git fetch recognition for extension ownership."""
+
+from __future__ import annotations
+
+import re
+from typing import Final
+
+from .secret_file_request_services.shell_tokenization import _shell_segment_primary_command
+
+_ORIGIN_REFRESH_FLAGS: Final = frozenset({"-q", "--quiet", "--no-tags", "--prune", "-p"})
+_ORIGIN_REF: Final = re.compile(r"[A-Za-z0-9][A-Za-z0-9._/-]{0,255}")
+_GIT_GLOBAL_FLAG_OPTIONS: Final = frozenset(
+    {
+        "--bare",
+        "--literal-pathspecs",
+        "--no-advice",
+        "--no-lazy-fetch",
+        "--no-optional-locks",
+        "--no-pager",
+        "--no-replace-objects",
+        "--paginate",
+        "-P",
+        "-p",
+    }
+)
+_GIT_GLOBAL_VALUE_OPTIONS: Final = frozenset({"-C", "--git-dir", "--namespace", "--super-prefix", "--work-tree"})
+_GIT_EXECUTION_VALUE_OPTIONS: Final = frozenset({"-c", "--config-env", "--exec-path"})
+
+
+def origin_shaped_git_fetch_args(args: tuple[str, ...]) -> bool:
+    """Return whether fetch operands are a named-origin refresh, not a URL or --all."""
+
+    if not args or len(args) > 16:
+        return False
+    remote: str | None = None
+    refs: list[str] = []
+    for arg in args:
+        if arg in _ORIGIN_REFRESH_FLAGS:
+            continue
+        if arg.startswith("-") or (remote is None and arg != "origin"):
+            return False
+        if remote is None:
+            remote = arg
+            continue
+        if _ORIGIN_REF.fullmatch(arg) is None:
+            return False
+        refs.append(arg)
+    return remote == "origin" and len(refs) <= 12
+
+
+def git_fetch_operands(tokens: tuple[str, ...]) -> tuple[str, ...] | None:
+    """Return arguments after a git fetch subcommand, if the segment is a fetch."""
+
+    command_name, command_index = _shell_segment_primary_command(list(tokens))
+    if command_name != "git" or command_index is None:
+        return None
+    args = tokens[command_index + 1 :]
+    index = 0
+    while index < len(args):
+        token = args[index]
+        option_name = token.partition("=")[0]
+        if token in _GIT_GLOBAL_FLAG_OPTIONS:
+            index += 1
+            continue
+        if option_name in _GIT_EXECUTION_VALUE_OPTIONS:
+            return None
+        if option_name in _GIT_GLOBAL_VALUE_OPTIONS:
+            if "=" in token:
+                if not token.partition("=")[2]:
+                    return None
+                index += 1
+                continue
+            if index + 1 >= len(args):
+                return None
+            index += 2
+            continue
+        if token.startswith("-"):
+            index += 1
+            continue
+        if token != "fetch":
+            return None
+        return args[index + 1 :]
+    return None
+
+
+def command_is_origin_shaped_git_fetch(segments: tuple[tuple[str, ...], ...]) -> bool:
+    """Return whether every fetch segment is a named-origin refresh."""
+
+    saw_fetch = False
+    for tokens in segments:
+        operands = git_fetch_operands(tokens)
+        if operands is None:
+            continue
+        saw_fetch = True
+        if not origin_shaped_git_fetch_args(operands):
+            return False
+    return saw_fetch

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/src/codex_plugin_scanner/guard/runtime/secret_file_request_services/tool_action_requests.py

@@ -13,6 +13,7 @@ from ..compound_git_inspection import (
     is_low_risk_standalone_git_routine,
 )
 from ..git_execution_safety import git_status_args_are_read_only, git_status_has_execution_free_config
+from ..git_origin_refresh import command_is_origin_shaped_git_fetch
 from ..kubernetes_commands import kubernetes_secret_read_source
 from ..shell_command_wrappers import normalize_transparent_shell_command
 from ..shell_execution_context import ShellExecutionContext, model_shell_execution_context
@@ -341,11 +342,13 @@ def _unverified_git_fetch_request(
         for segment in context.segments
     ):
         return None
+    origin_shaped = command_is_origin_shaped_git_fetch(tuple(segment.tokens for segment in context.segments))
+    action_class = "git origin refresh" if origin_shaped else "unverified Git remote refresh"
     return ToolActionRequestMatch(
         tool_name=tool_name,
         normalized_tool_name=normalized_tool_name,
         command_text=command_text,
-        action_class="unverified Git remote refresh",
+        action_class=action_class,
         reason=(
             "Git fetch needs a repository-bound origin Guard can verify. "
             "Run it from that repository, or use git -C with a path under your "

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "3.0.0a201"
+__version__ = "3.0.0a204"

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/tests/fixtures/extension-controls/catalog-baseline.v1.json

@@ -7,7 +7,7 @@
     "canonical_diff_digest",
     "effective"
   ],
-  "catalog_digest": "55ea7e94ec7e23eea92e9664bd90c6afbe9725e139982a0d76a694c8124b4dd7",
+  "catalog_digest": "191ed88959909b2ae5d299d6b52cc4fcd33b04a6a0f49200cb79e7fec0542e95",
   "control_schema_version": "1.0.0",
   "daemon_api_schema": "guard.daemon.extension-controls.v1",
   "effective_shape": [
@@ -86,7 +86,7 @@
   "extension_schema_version": 2,
   "installed_browser_config": "dashboard/playwright.installed.config.ts",
   "overview_route": "/extensions",
-  "permission_count": 99,
+  "permission_count": 100,
   "permission_examples": {
     "command.api-gateway.permission.delete": "aws apigateway delete-rest-api",
     "command.backup.borg.permission.mutation": "borg delete",
@@ -125,6 +125,7 @@
     "command.git.permission.hard-reset": "git reset --hard",
     "command.git.permission.local-branch-delete": "git branch -D stale-feature",
     "command.git.permission.remote-branch-delete": "git push --delete",
+    "command.git.permission.unverified-fetch": "git fetch origin",
     "command.github.permission.read-local": "gh auth status",
     "command.github.permission.read-remote": "gh pr view 123",
     "command.github.permission.propose-remote": "gh pr create --title \"Fix login\" --body \"Summary\"",
@@ -194,6 +195,7 @@
     "command.git.permission.hard-reset": "git-destructive",
     "command.git.permission.local-branch-delete": "git-destructive",
     "command.git.permission.remote-branch-delete": "git-destructive",
+    "command.git.permission.unverified-fetch": "git-remote",
     "command.github.permission.routine-merge-remote": "gh-pr-merge",
     "command.github.permission.merge-remote": "gh-pr-merge",
     "command.github.permission.merge-admin": "gh-pr-merge"
@@ -236,6 +238,7 @@
     "command.git.permission.hard-reset",
     "command.git.permission.local-branch-delete",
     "command.git.permission.remote-branch-delete",
+    "command.git.permission.unverified-fetch",
     "command.github.permission.read-local",
     "command.github.permission.read-remote",
     "command.github.permission.propose-remote",
@@ -309,7 +312,7 @@
     "controls",
     "semantic_preview"
   ],
-  "rule_count": 87,
+  "rule_count": 88,
   "rule_ids": [
     "command.api-gateway.delete",
     "command.backup.borg.mutation",
@@ -343,6 +346,7 @@
     "command.feature-flags.delete",
     "command.filesystem.recursive-delete",
     "command.filesystem.recursive-permission-change",
+    "command.git.unverified-fetch",
     "command.git.hard-reset",
     "command.git.force-clean",
     "command.git.force-push",

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/tests/fixtures/guard-command-corpus/decision-diff-report.json

@@ -12,7 +12,7 @@
     },
     "sources_sha256": {
       "source-0181b7136f7bc07d3738def8": "198f5e851641f0efc2187c46877c61d6049d9aac53943f205febbcf8ef29c45a",
-      "source-01febcca4015bcd1b7aeebc7": "a9a8ef9a75eec21ad377db812cffde0e8ab1d835c671f97b859db8506e591256",
+      "source-01febcca4015bcd1b7aeebc7": "03a70a38cff8a1118493423cee1e4d99aefa83eada3936db59072026b47b5577",
       "source-02697a55adfb35c263740ec9": "70763bb670c4a0afaa87f9929dc77a66086fd70c5d6611525209754b710e2ce3",
       "source-02aeab3ad023a11ada3b7743": "82eb33d49c84e6d2b907b0de245fc1ff9bc991af96124cff3071e9bb02fa1e34",
       "source-02c7cfdf8b65ef460436b48e": "5b5011a12fd773494eb3cfd9d56700a9f39a99ff8e9518deeeb29a7803271389",
@@ -143,6 +143,7 @@
       "source-6d28402078e14daca3299eaa": "aa060f42617a7b4eebbb1d294053c04a151728d4c4ba04bdc2e00df9fc829e17",
       "source-6e0fd59c619d8d5e34001b74": "9a2987b06f6ee8ee0a597282a5e7657d8933e4cf1e5b90df35200e7c9b3b6d0b",
       "source-6f8faae894b8474f30fadb98": "0a6a3cb4db6742310d3d772d5d3544b389f43bd1b11bccf7f9b8b59d56121b4b",
+      "source-7061aba1321fda05d911769d": "4cc91bcd2a07a77ee9a13a57ddf7a9b45eeff387fc45f3743031af69dc6acc9c",
       "source-717dde356f05f0b19bf4540f": "5c77cfedce6b3a0d1ed4ba7c5f5e7e5151ac9a90c14270362abfbe7de84df055",
       "source-71bdae7042930d1190f04dbf": "0fb2b0d5d001eb9bb9ee8973a8f562ce947f09fc7d742dd7c4eb037c0812f03e",
       "source-737fca030ed75d2ac94016a1": "a7ea04992330e74b84065fb4c142d7731ce08f7e0fbea814ab16d56a94b7b9fc",
@@ -195,7 +196,7 @@
       "source-9bf21c89e8dff6638b4092d6": "3900de0b921dce9deac0424228f22ccd1febb021a9db8f3f1d7f0d2c75905846",
       "source-9ca3fd305c10b44c67fa2c53": "0b5276227df0b6a9f15079aac2dcfb229651d0c20b367e496855ad2bc6442efa",
       "source-9df5813f3e985972060c0e37": "57d26320b6fbaf43c7e409654198a2369ee1cb2668e8fa30bcc80f9d6a0fe682",
-      "source-9e3a96c5287017c496886547": "a51c25fca9ce73eac5daa3e53c9457ec487001f53abc505677e141d0665b5dd4",
+      "source-9e3a96c5287017c496886547": "a7c82021dcabd52c6f506764d3b4027d24e633d62d2465d03c5b6c109b808405",
       "source-9ede03d120a175084586751a": "b1949b71cd9e81935a3bb51b26ce564b9a496db0f83986114023f277bc510256",
       "source-9f0568215682047e5f813120": "4d20fbbea469478da9f650cd69ba9bf3b08d51442a769e3b8cd40e42dd0416d7",
       "source-9f4463a8839e64022c7ae1d4": "d13e2f78105c69e5c83db06c207a89a6dea216632b9cb239d2eb81bd7ad35cf3",
@@ -225,7 +226,7 @@
       "source-b80a8083541fd7e8874926a6": "39c5cdd4522dbee6a92a8b20ee444d8b2b3d61c24de002d5ccdda129d5f8542c",
       "source-b933bc50f755d1a32c112e35": "5727d8a9e0f1bf39aa4470f048e346a2eed5b9437bd74c3c63e3420722e3b959",
       "source-b970eabd271372ddfe730bf1": "4446d801098f8517d245904b61eb4ba2992f1b7b25faccf283ee0fe15a2e07a0",
-      "source-ba3ba0028bdc49b9008e93d2": "6bf9db2888395afd224d9312c97b4b0f8c98c9b8b2512c284a3b39b4fddd2efc",
+      "source-ba3ba0028bdc49b9008e93d2": "83aa9303d53bf28acbbdcb1442573765417c027797a5cb3c4b348651f7db159c",
       "source-ba4fee2dac2a5b0da5d61bdb": "b2434db33fbad299c552ab1a60923d451930cd4186b6d085f9fbcc7693aaee21",
       "source-ba85b41a08ce4b871e40e7b7": "1a9a60a02fce05949372ea32386aba0df79f1836cea2f6ab4505ab9e1cf55558",
       "source-bbf1900d9722bd89273df0a9": "bcd3c7a6bc266408b38e3b9de145fa98c6db549d82e9c79b637085e97a74eda1",
@@ -278,7 +279,7 @@
       "source-e1e3ba2136aa4a1ad13ed7b0": "2e94d7ecc093c0db50c1192de637b199ff75e0c1eb791c6f8dfbac303d605353",
       "source-e31d22ca92b4aad1eac7c5d8": "9d16c2628d68ff812dc8027119ef4250b7ff44781b7f01232f0fab6ec5d5031e",
       "source-e4a25e12163ae68c101bcc17": "f8656c3eb136e7985b7e4d6467d32740a5d72e761e16006d80f17b2e5a073be9",
-      "source-e5092effd9878194fc7b1756": "377ebe9823b75ea00a4e93df108361b99fa0c31239d5bec397567ef19412ca6f",
+      "source-e5092effd9878194fc7b1756": "ad64602a055c1a2941290acdbd1755a35b63e1f88108050f5454398cc2ac82ef",
       "source-e5ba5048b35cbfbc904173cd": "932581669b068054176699fc27bc21ddd59f327fb85af33086952399cef36bb2",
       "source-e5c394cae3e8083cb2617097": "5f306f62566cb14346cf564fb0c3d88ea6612a265233170eb6d5ea30779674bd",
       "source-e61ec49b032b12089dfeafdb": "57b66c38b0f98e6125ce7edaf7a7e3e164f91395979903275f346f00571e6aae",

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/tests/test_guard_command_extensions.py

@@ -118,7 +118,7 @@ def test_command_extension_registry_is_deterministic_and_complete() -> None:
     assert BUILT_IN_COMMAND_EXTENSION_REGISTRY.rule_for_action_class("destructive shell command") is not None
     assert BUILT_IN_COMMAND_EXTENSION_REGISTRY.for_action_class("GitHub merge command") is not None
     assert BUILT_IN_COMMAND_EXTENSION_REGISTRY.rule_for_action_class("GitHub merge command") is not None
-    assert sum(extension["rule_count"] for extension in payload["extensions"]) == 87
+    assert sum(extension["rule_count"] for extension in payload["extensions"]) == 88
 
 
 @pytest.mark.parametrize(

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/tests/test_guard_command_permission_catalog.py

@@ -145,11 +145,17 @@ def test_shared_action_classes_keep_unique_rule_permissions() -> None:
         "command.git.permission.hard-reset",
         "command.git.permission.local-branch-delete",
         "command.git.permission.remote-branch-delete",
+        "command.git.permission.unverified-fetch",
     }
     assert all(permission.configurable for permission in git.permissions)
-    assert all(permission.action_classes == ("git destructive command",) for permission in git.permissions)
-    first = min(git.permissions, key=lambda permission: permission.permission_id)
+    fetch_id = "command.git.permission.unverified-fetch"
+    destructive = [permission for permission in git.permissions if permission.permission_id != fetch_id]
+    fetch = next(permission for permission in git.permissions if permission.permission_id == fetch_id)
+    assert all(permission.action_classes == ("git destructive command",) for permission in destructive)
+    assert fetch.action_classes == ("git origin refresh",)
+    first = min(destructive, key=lambda permission: permission.permission_id)
     assert registry.permission_for_action_class("git destructive command") is first
+    assert registry.permission_for_action_class("git origin refresh") is fetch
     for permission in git.permissions:
         assert registry.permission_for_rule_id(permission.rule_ids[0]) is permission
 
@@ -164,7 +170,7 @@ def test_permission_catalog_serialization_and_digest_are_deterministic() -> None
     reversed_registry = CommandSafetyExtensionRegistry(tuple(reversed(registry.extensions)))
 
     assert reversed_registry.catalog_digest == registry.catalog_digest
-    assert registry.catalog_digest == "55ea7e94ec7e23eea92e9664bd90c6afbe9725e139982a0d76a694c8124b4dd7"
+    assert registry.catalog_digest == "191ed88959909b2ae5d299d6b52cc4fcd33b04a6a0f49200cb79e7fec0542e95"
     assert [permission.permission_id for permission in registry.permissions] == sorted(
         permission.permission_id for permission in registry.permissions
     )

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/tests/test_guard_command_permission_examples.py

@@ -56,6 +56,7 @@ def test_matcher_derived_examples_use_the_canonical_executable_form() -> None:
 def test_explicit_rule_examples_override_matcher_derivation() -> None:
     permissions = {permission.permission_id: permission for permission in _all_permissions()}
     assert permissions["command.git.permission.local-branch-delete"].example_command == "git branch -D stale-feature"
+    assert permissions["command.git.permission.unverified-fetch"].example_command == "git fetch origin"
 
 
 def test_git_destructive_family_groups_exactly_the_five_git_rules() -> None:

{plugin_scanner-3.0.0a201 → plugin_scanner-3.0.0a204}/tests/test_guard_extension_control_catalog_detail.py

@@ -166,6 +166,7 @@ def test_catalog_exposes_deterministic_full_extension_permission_and_rule_contra
         "command.git.permission.hard-reset",
         "command.git.permission.local-branch-delete",
         "command.git.permission.remote-branch-delete",
+        "command.git.permission.unverified-fetch",
     }
     assert all(permission["configurable"] is True for permission in git["permissions"])
     assert all(len(permission["rule_ids"]) == 1 for permission in git["permissions"])