plugin-scanner 3.0.0a213__tar.gz → 3.0.0a215__tar.gz

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.0a213
+Version: 3.0.0a215
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/ci/code-quality-baseline.json

@@ -43,7 +43,7 @@
     "src/codex_plugin_scanner/guard/consumer/service.py::evaluate_detection": 132,
     "src/codex_plugin_scanner/guard/daemon/hook_process_runner.py::HookProcessRunner.review": 45,
     "src/codex_plugin_scanner/guard/daemon/manager.py::_guard_daemon_process_inventory_for_guard_home": 31,
-    "src/codex_plugin_scanner/guard/daemon/manager.py::ensure_guard_daemon": 34,
+    "src/codex_plugin_scanner/guard/daemon/manager.py::ensure_guard_daemon": 35,
     "src/codex_plugin_scanner/guard/daemon/manager.py::retire_all_guard_daemons_for_home": 38,
     "src/codex_plugin_scanner/guard/daemon/server.py::GuardDaemonServer._finish_service_locked": 32,
     "src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_headless_remote_once": 31,
@@ -252,7 +252,7 @@
     "src/codex_plugin_scanner/guard/consumer/service.py::evaluate_detection": 743,
     "src/codex_plugin_scanner/guard/daemon/extension_control_semantic_preview.py::build_extension_control_semantic_preview": 152,
     "src/codex_plugin_scanner/guard/daemon/hook_process_runner.py::HookProcessRunner.review": 171,
-    "src/codex_plugin_scanner/guard/daemon/manager.py::ensure_guard_daemon": 133,
+    "src/codex_plugin_scanner/guard/daemon/manager.py::ensure_guard_daemon": 135,
     "src/codex_plugin_scanner/guard/daemon/manager.py::retire_all_guard_daemons_for_home": 103,
     "src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_guard_cloud_connect_start": 172,
     "src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_headless_policy_sync": 133,
@@ -518,7 +518,7 @@
     "src/codex_plugin_scanner/guard/consumer/service.py": 1859,
     "src/codex_plugin_scanner/guard/daemon/dashboard_update.py": 663,
     "src/codex_plugin_scanner/guard/daemon/hook_process_runner.py": 707,
-    "src/codex_plugin_scanner/guard/daemon/manager.py": 2999,
+    "src/codex_plugin_scanner/guard/daemon/manager.py": 3071,
     "src/codex_plugin_scanner/guard/daemon/runtime_hook_scheduler.py": 527,
     "src/codex_plugin_scanner/guard/daemon/server.py": 8883,
     "src/codex_plugin_scanner/guard/inventory_contract.py": 1818,
@@ -613,7 +613,7 @@
     "tests/test_guard_approval_reuse.py": 1793,
     "tests/test_guard_approval_scope_contract.py": 998,
     "tests/test_guard_approval_store_scale.py": 737,
-    "tests/test_guard_approvals.py": 3921,
+    "tests/test_guard_approvals.py": 3968,
     "tests/test_guard_authoritative_decision.py": 1045,
     "tests/test_guard_auto_first_sync.py": 797,
     "tests/test_guard_browser_mcp_intent.py": 1065,
@@ -637,7 +637,7 @@
     "tests/test_guard_consumer_approval_precedence.py": 2762,
     "tests/test_guard_copilot_adapter.py": 970,
     "tests/test_guard_daemon_decision_boundary.py": 912,
-    "tests/test_guard_daemon_manager.py": 2952,
+    "tests/test_guard_daemon_manager.py": 3086,
     "tests/test_guard_dashboard_launcher.py": 516,
     "tests/test_guard_direct_vitest.py": 832,
     "tests/test_guard_events.py": 1279,
@@ -740,9 +740,9 @@
     "src/codex_plugin_scanner/guard/cli/commands_support_service.py::_handle_daemon_status::Exception::221",
     "src/codex_plugin_scanner/guard/daemon/diagnostics.py::DaemonDiagnostics.__init__::Exception::100",
     "src/codex_plugin_scanner/guard/daemon/diagnostics.py::DaemonDiagnostics._run::Exception::170",
-    "src/codex_plugin_scanner/guard/daemon/manager.py::_runtime_state_age_seconds::Exception::2053",
-    "src/codex_plugin_scanner/guard/daemon/manager.py::_schedule_duplicate_guard_daemon_retirement.retire::Exception::1141",
-    "src/codex_plugin_scanner/guard/daemon/manager.py::_schedule_stale_ephemeral_guard_daemon_reap.reap::Exception::1884",
+    "src/codex_plugin_scanner/guard/daemon/manager.py::_runtime_state_age_seconds::Exception::2073",
+    "src/codex_plugin_scanner/guard/daemon/manager.py::_schedule_duplicate_guard_daemon_retirement.retire::Exception::1161",
+    "src/codex_plugin_scanner/guard/daemon/manager.py::_schedule_stale_ephemeral_guard_daemon_reap.reap::Exception::1904",
     "src/codex_plugin_scanner/guard/daemon/server.py::_maybe_queue_first_cloud_sync::Exception::1349",
     "src/codex_plugin_scanner/guard/daemon/server.py::_maybe_queue_first_cloud_sync::Exception::1357",
     "src/codex_plugin_scanner/guard/desktop_notifications.py::_ensure_desktop_notification_setup_worker::Exception::290",

plugin_scanner-3.0.0a215/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 15243,
+  "maximum_test_source_lines": 328706,
+  "schema_version": 1
+}

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.0.0a213"
+version = "3.0.0a215"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.0.0a213"
+version = "3.0.0a215"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.0.0a213/release-metadata/plugin-scanner-v3.0.0a213.toolchain.cdx.json → plugin_scanner-3.0.0a215/release-metadata/plugin-scanner-v3.0.0a215.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.0.0a213"
+      "version": "3.0.0a215"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/src/codex_plugin_scanner/guard/cli/commands_dispatch_desktop.py

@@ -16,7 +16,7 @@ if TYPE_CHECKING:
     from ..config import GuardConfig
     from ..store import GuardStore
 
-from ..dashboard_launcher import build_desktop_dashboard_session_url
+from ..dashboard_launcher import build_desktop_dashboard_session_url, desktop_bootstrap_is_preflight
 from ._commands_shared import *  # noqa: F403
 
 DESKTOP_BOOTSTRAP_SCHEMA = "guard-desktop-bootstrap.v1"
@@ -353,7 +353,11 @@ def _run_guard_desktop_command(
 
     resolved_guard_home = guard_home or context.guard_home
     # Start/adopt the matching local runtime before projecting protection.
-    session_url = build_desktop_dashboard_session_url(guard_home=resolved_guard_home)
+    # Candidate preflight must not spawn a disposable-home daemon.
+    if desktop_bootstrap_is_preflight():
+        session_url = None
+    else:
+        session_url = build_desktop_dashboard_session_url(guard_home=resolved_guard_home)
     status_payload = importlib.import_module(".product", __package__).build_guard_status_payload(
         context,
         store,
@@ -386,7 +390,8 @@ def _run_guard_desktop_command(
     )
     dashboard = payload.get("dashboard")
     if isinstance(dashboard, dict):
-        dashboard["sessionUrl"] = session_url
+        if session_url is not None:
+            dashboard["sessionUrl"] = session_url
         dashboard["canonical"] = True
     print(json.dumps(payload, sort_keys=True), file=output_stream or sys.stdout)
     return 0

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/src/codex_plugin_scanner/guard/daemon/manager.py

@@ -76,6 +76,8 @@ _GUARD_DAEMON_PROCESS_QUERY_TIMEOUT_SECONDS = 5.0
 _GUARD_DAEMON_PROCESS_QUERY_OUTPUT_LIMIT_BYTES = 1024 * 1024
 _GUARD_DAEMON_PROCESS_QUERY_MONITOR_INTERVAL_SECONDS = 0.01
 _GUARD_DAEMON_PROCESS_QUERY_TERMINATE_GRACE_SECONDS = 0.25
+_RUNTIME_FINGERPRINT_CACHE_MAX_BYTES = 4096
+_RUNTIME_FINGERPRINT_HEX_LENGTH = 64
 _WINDOWS_CREATE_NEW_PROCESS_GROUP = 0x00000200
 _WINDOWS_DETACHED_PROCESS = 0x00000008
 _WINDOWS_CREATE_BREAKAWAY_FROM_JOB = 0x01000000
@@ -100,6 +102,7 @@ _GUARD_DAEMON_ENV_KEYS = frozenset(
         "APPDATA",
         "COMSPEC",
         "HOME",
+        "HOL_GUARD_DESKTOP",
         "LANG",
         "LC_ALL",
         "LC_CTYPE",
@@ -132,7 +135,7 @@ _EPHEMERAL_REAP_IN_FLIGHT = False
 _DUPLICATE_RETIRE_SCHEDULE_LOCK = threading.Lock()
 _DUPLICATE_RETIRE_IN_FLIGHT: set[str] = set()
 _LAST_EPHEMERAL_REAP_AT = 0.0
-_runtime_fingerprint_cache: str | None = None
+_runtime_fingerprint_cache: tuple[str, str] | None = None
 
 GuardDaemonHookFailureKind = Literal[
     "authenticated-control-plane-failure",
@@ -190,8 +193,6 @@ def _daemon_launcher_env(
     )
     if getattr(sys, "frozen", False) is True:
         env["PYINSTALLER_RESET_ENVIRONMENT"] = "1"
-        if os.environ.get("HOL_GUARD_DESKTOP") == "1":
-            env["HOL_GUARD_DESKTOP"] = "1"
     if os.name == "nt":
         env["USERPROFILE"] = str(trusted_home)
     if guard_home is not None and not _guard_home_is_ephemeral(guard_home):
@@ -326,6 +327,16 @@ def _guard_daemon_launch_command(
     )
 
 
+def desktop_preflight_requested() -> bool:
+    return os.environ.get("HOL_GUARD_DESKTOP_PREFLIGHT", "").strip().lower() in {"1", "true", "yes"}
+
+
+def _default_guard_daemon_start_timeout() -> float:
+    if os.environ.get("HOL_GUARD_DESKTOP", "").strip() == "1":
+        return GUARD_DAEMON_POST_UPDATE_START_TIMEOUT_SECONDS
+    return GUARD_DAEMON_START_TIMEOUT_SECONDS
+
+
 def ensure_guard_daemon(
     guard_home: Path,
     *,
@@ -334,7 +345,9 @@ def ensure_guard_daemon(
     preferred_port: int | None = None,
     allow_windows_job_breakaway: bool = False,
 ) -> str:
-    timeout = GUARD_DAEMON_START_TIMEOUT_SECONDS if start_timeout is None else start_timeout
+    if desktop_preflight_requested():
+        raise RuntimeError("Guard daemon start is disabled during Desktop preflight.")
+    timeout = _default_guard_daemon_start_timeout() if start_timeout is None else start_timeout
     start_deadline = time.monotonic() + max(0.0, timeout)
     launch_cwd = _trusted_daemon_home(home_dir)
     _schedule_stale_ephemeral_guard_daemon_reap(exclude_guard_home=guard_home)
@@ -885,18 +898,25 @@ def schedule_guard_daemon_ensure(
     *,
     home_dir: Path | None = None,
 ) -> str:
-    """Reserve one detached daemon ensure without delaying a hook response."""
+    """Reserve one detached daemon ensure without delaying a hook response.
 
+    When a healthy daemon is not ready yet, return the predicted loopback origin
+    so approval deep links stay absolute and repairable. Callers must not treat
+    that predicted origin as a verified live URL.
+    """
+
+    if desktop_preflight_requested():
+        return load_guard_daemon_url(guard_home) or ""
     existing_url = load_guard_daemon_url(guard_home)
     if existing_url is not None:
         return existing_url
-    fallback_url = guard_daemon_url_for_home(guard_home)
+    predicted_url = guard_daemon_url_for_home(guard_home)
     try:
         wake_token = _claim_guard_daemon_wake_reservation(guard_home)
     except (OSError, RuntimeError, ValueError):
-        return fallback_url
+        return predicted_url
     if wake_token is None:
-        return fallback_url
+        return predicted_url
     try:
         trusted_home = _trusted_daemon_home(home_dir)
         command = _isolated_python_module_command(
@@ -938,7 +958,7 @@ def schedule_guard_daemon_ensure(
     except (OSError, RuntimeError, subprocess.SubprocessError, ValueError):
         with suppress(OSError, RuntimeError, ValueError):
             clear_guard_daemon_wake_reservation(guard_home, token=wake_token)
-    return fallback_url
+    return predicted_url
 
 
 def load_guard_daemon_url(guard_home: Path) -> str | None:
@@ -2505,9 +2525,6 @@ def _guard_daemon_state_matches_current_runtime(payload: dict[str, object]) -> b
     compatibility_version = payload.get("compatibility_version")
     if compatibility_version != GUARD_DAEMON_COMPATIBILITY_VERSION:
         return False
-    source_root = payload.get("source_root")
-    if not isinstance(source_root, str) or source_root != _current_guard_daemon_source_root():
-        return False
     runtime_fingerprint = payload.get("runtime_fingerprint")
     return isinstance(runtime_fingerprint, str) and runtime_fingerprint == _current_guard_daemon_runtime_fingerprint()
 
@@ -2516,28 +2533,120 @@ def _current_guard_daemon_source_root() -> str:
     return str(Path(__file__).resolve().parents[3])
 
 
-def _current_guard_daemon_runtime_fingerprint() -> str:
-    global _runtime_fingerprint_cache
-    if _runtime_fingerprint_cache is not None:
-        return _runtime_fingerprint_cache
-    source_root = Path(_current_guard_daemon_source_root())
+def _runtime_identity_paths(source_root: Path) -> list[Path]:
     package_root = source_root / "codex_plugin_scanner"
     static_root = package_root / "guard" / "daemon" / "static"
-    digest = hashlib.sha256()
-    digest.update(__version__.encode("utf-8"))
     paths = [*package_root.rglob("*.py")]
     if static_root.is_dir():
         paths.extend(path for path in static_root.rglob("*") if path.is_file())
+    return paths
+
+
+def _runtime_tree_signature(source_root: Path, paths: list[Path]) -> str:
+    digest = hashlib.sha256()
+    digest.update(__version__.encode("utf-8"))
     for path in sorted(paths):
         try:
             stat_result = path.stat()
         except OSError:
             continue
         digest.update(str(path.relative_to(source_root)).encode("utf-8"))
+        digest.update(str(stat_result.st_size).encode("utf-8"))
         digest.update(str(stat_result.st_mtime_ns).encode("utf-8"))
+    return digest.hexdigest()
+
+
+def _hash_runtime_contents(source_root: Path, paths: list[Path]) -> str:
+    digest = hashlib.sha256()
+    digest.update(__version__.encode("utf-8"))
+    for path in sorted(paths):
+        try:
+            stat_result = path.stat()
+        except OSError:
+            continue
+        digest.update(str(path.relative_to(source_root)).encode("utf-8"))
         digest.update(str(stat_result.st_size).encode("utf-8"))
-    _runtime_fingerprint_cache = digest.hexdigest()
-    return _runtime_fingerprint_cache
+        try:
+            with path.open("rb") as handle:
+                while chunk := handle.read(65536):
+                    digest.update(chunk)
+        except OSError:
+            continue
+    return digest.hexdigest()
+
+
+def _runtime_fingerprint_cache_path(source_root: Path) -> Path:
+    digest = hashlib.sha256(os.fsencode(str(source_root))).hexdigest()
+    return Path.home() / ".hol-guard" / "runtime-fingerprint-cache" / f"{digest}.json"
+
+
+def _is_sha256_hex(value: object) -> bool:
+    return (
+        isinstance(value, str)
+        and len(value) == _RUNTIME_FINGERPRINT_HEX_LENGTH
+        and not set(value) - set("0123456789abcdef")
+    )
+
+
+def _load_runtime_fingerprint_cache(source_root: Path, tree_sig: str) -> str | None:
+    raw_payload = read_private_regular_text(
+        _runtime_fingerprint_cache_path(source_root),
+        max_bytes=_RUNTIME_FINGERPRINT_CACHE_MAX_BYTES,
+        require_private_parent=True,
+    )
+    if raw_payload is None:
+        return None
+    try:
+        payload = json.loads(raw_payload)
+    except json.JSONDecodeError:
+        return None
+    if not isinstance(payload, dict):
+        return None
+    if payload.get("source_root") != str(source_root):
+        return None
+    cached_tree_sig = payload.get("tree_sig")
+    cached_fingerprint = payload.get("content_fingerprint")
+    if cached_tree_sig != tree_sig or not isinstance(cached_fingerprint, str):
+        return None
+    if not _is_sha256_hex(cached_fingerprint):
+        return None
+    return cached_fingerprint
+
+
+def _store_runtime_fingerprint_cache(source_root: Path, tree_sig: str, fingerprint: str) -> None:
+    cache_path = _runtime_fingerprint_cache_path(source_root)
+    try:
+        _ensure_private_directory(cache_path.parent)
+        _write_private_atomic_text(
+            cache_path,
+            json.dumps(
+                {
+                    "content_fingerprint": fingerprint,
+                    "source_root": str(source_root),
+                    "tree_sig": tree_sig,
+                },
+                sort_keys=True,
+            ),
+        )
+    except (OSError, RuntimeError, ValueError):
+        return
+
+
+def _current_guard_daemon_runtime_fingerprint() -> str:
+    global _runtime_fingerprint_cache
+    if _runtime_fingerprint_cache is not None:
+        return _runtime_fingerprint_cache[1]
+    source_root = Path(_current_guard_daemon_source_root())
+    paths = _runtime_identity_paths(source_root)
+    tree_sig = _runtime_tree_signature(source_root, paths)
+    cached = _load_runtime_fingerprint_cache(source_root, tree_sig)
+    if cached is not None:
+        _runtime_fingerprint_cache = (tree_sig, cached)
+        return cached
+    fingerprint = _hash_runtime_contents(source_root, paths)
+    _store_runtime_fingerprint_cache(source_root, tree_sig, fingerprint)
+    _runtime_fingerprint_cache = (tree_sig, fingerprint)
+    return fingerprint
 
 
 def current_guard_daemon_runtime_fingerprint() -> str:
@@ -2548,10 +2657,7 @@ def current_guard_daemon_runtime_fingerprint() -> str:
 
 def _guard_daemon_start_in_progress(guard_home: Path) -> bool:
     payload = _load_state(guard_home)
-    if not isinstance(payload, dict):
-        return False
-    compatibility_version = payload.get("compatibility_version")
-    if compatibility_version != GUARD_DAEMON_COMPATIBILITY_VERSION:
+    if not isinstance(payload, dict) or not _guard_daemon_state_matches_current_runtime(payload):
         return False
     pid = payload.get("pid")
     return isinstance(pid, int) and pid > 0 and _guard_daemon_pid_is_running(pid)

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/src/codex_plugin_scanner/guard/dashboard_launcher.py

@@ -28,7 +28,11 @@ if TYPE_CHECKING:
     from codex_plugin_scanner.guard.config import GuardConfig
     from codex_plugin_scanner.guard.store import GuardStore
 
-from .daemon.manager import ensure_guard_daemon, load_guard_daemon_auth_token
+from .daemon.manager import (
+    desktop_preflight_requested,
+    ensure_guard_daemon,
+    load_guard_daemon_auth_token,
+)
 from .local_dashboard_session import build_local_dashboard_session_token
 from .runtime.surface_server import GuardSurfaceRuntime
 from .secret_redaction import sanitize_secret
@@ -73,6 +77,12 @@ _in_flight = False
 _last_result: DashboardLaunchResult | None = None
 
 
+def desktop_bootstrap_is_preflight() -> bool:
+    """True when Desktop is validating a candidate Core without starting a daemon."""
+
+    return desktop_preflight_requested()
+
+
 def build_desktop_dashboard_session_url(*, guard_home: Path) -> str:
     """Return a short-lived canonical dashboard URL for trusted Desktop embedding.
 
@@ -83,6 +93,8 @@ def build_desktop_dashboard_session_url(*, guard_home: Path) -> str:
     remain non-frameable.
     """
 
+    if desktop_bootstrap_is_preflight():
+        raise RuntimeError("Desktop preflight does not start a local daemon")
     approval_center_url = ensure_guard_daemon(guard_home)
     auth_token = load_guard_daemon_auth_token(guard_home)
     if auth_token is None:

plugin_scanner-3.0.0a215/src/codex_plugin_scanner/guard/sqlite_recovery.py

@@ -0,0 +1,67 @@
+"""Bounded proof helpers for recovering an unusable Guard SQLite store."""
+
+from __future__ import annotations
+
+import sqlite3
+from contextlib import suppress
+from pathlib import Path
+from typing import Literal
+from uuid import uuid4
+
+FATAL_SQLITE_ERROR_MARKERS = (
+    "database disk image is malformed",
+    "database corruption",
+    "file is not a database",
+)
+SQLITE_IO_ERROR_MARKER = "disk i/o error"
+SQLiteStoreProbe = Literal["fatal", "healthy", "io", "unknown"]
+
+
+def _probe_sqlite_store(path: Path) -> SQLiteStoreProbe:
+    try:
+        with sqlite3.connect(path, timeout=0.1) as connection:
+            result = connection.execute("pragma quick_check").fetchone()
+    except sqlite3.DatabaseError as error:
+        message = str(error).lower()
+        if any(marker in message for marker in FATAL_SQLITE_ERROR_MARKERS):
+            return "fatal"
+        if SQLITE_IO_ERROR_MARKER in message:
+            return "io"
+        return "unknown"
+    return "healthy" if result == ("ok",) else "fatal"
+
+
+def _guard_home_accepts_sqlite_write(guard_home: Path) -> bool:
+    probe_path = guard_home / f"storage-probe-{uuid4().hex}.db"
+    try:
+        with sqlite3.connect(probe_path, timeout=0.1) as probe:
+            probe.execute("create table probe (value integer)")
+            probe.execute("insert into probe values (1)")
+        return probe_path.is_file()
+    except sqlite3.DatabaseError:
+        return False
+    finally:
+        with suppress(OSError):
+            probe_path.unlink()
+
+
+def sqlite_store_is_proven_unusable(
+    *,
+    path: Path,
+    guard_home: Path,
+    error: BaseException,
+    fatal_error: bool,
+) -> bool:
+    """Revalidate the current path before permitting destructive recovery."""
+
+    io_error = SQLITE_IO_ERROR_MARKER in str(error).lower()
+    if not fatal_error and not io_error:
+        return False
+    state = _probe_sqlite_store(path)
+    if state == "healthy":
+        return False
+    if state == "fatal":
+        return True
+    if state != "io" or not _guard_home_accepts_sqlite_write(guard_home):
+        return False
+    return _probe_sqlite_store(path) in {"fatal", "io"}

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/src/codex_plugin_scanner/guard/store_connection_schema.py

@@ -18,6 +18,11 @@ from .sqlite_profile import (
     SQLiteProfileSnapshot,
     sqlite_error_is_busy_locked,
 )
+from .sqlite_recovery import (
+    FATAL_SQLITE_ERROR_MARKERS,
+    SQLITE_IO_ERROR_MARKER,
+    sqlite_store_is_proven_unusable,
+)
 
 # ruff: noqa: F403,F405
 from .store_base import *
@@ -155,12 +160,6 @@ _REQUIRED_SCHEMA_MIGRATION_VERSIONS = (
     *range(2, STORAGE_QUERY_INDEX_MIGRATION_VERSION + 1),
     WORKFLOW_CAPABILITY_RECEIPT_EVENT_INDEX_MIGRATION_VERSION,
 )
-_FATAL_SQLITE_ERROR_MARKERS = (
-    "database disk image is malformed",
-    "database corruption",
-    "file is not a database",
-)
-_SQLITE_IO_ERROR_MARKER = "disk i/o error"
 
 
 @dataclass
@@ -190,7 +189,7 @@ class StoreConnectionSchemaMixin:
     @staticmethod
     def _is_fatal_sqlite_error(error: BaseException) -> bool:
         return isinstance(error, sqlite3.DatabaseError) and any(
-            marker in str(error).lower() for marker in _FATAL_SQLITE_ERROR_MARKERS
+            marker in str(error).lower() for marker in FATAL_SQLITE_ERROR_MARKERS
         )
 
     @contextmanager
@@ -250,29 +249,20 @@ class StoreConnectionSchemaMixin:
                     fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
 
     def _store_is_proven_unusable(self, error: BaseException) -> bool:
-        if self._is_fatal_sqlite_error(error):
-            return True
-        if _SQLITE_IO_ERROR_MARKER not in str(error).lower():
-            return False
-        # An I/O error alone does not prove corruption. Only replace the active
-        # path when the same directory supports a fresh SQLite transaction and
-        # the existing database remains unreadable on a second probe.
-        probe_path = self.guard_home / f"storage-probe-{uuid4().hex}.db"
-        try:
-            with sqlite3.connect(probe_path, timeout=0.1) as probe:
-                probe.execute("create table probe (value integer)")
-                probe.execute("insert into probe values (1)")
-            with sqlite3.connect(self.path, timeout=0.1) as existing:
-                _ = existing.execute("pragma schema_version").fetchone()
-                return False
-        except sqlite3.DatabaseError as probe_error:
-            return _SQLITE_IO_ERROR_MARKER in str(probe_error).lower() and probe_path.is_file()
-        finally:
-            with suppress(OSError):
-                probe_path.unlink()
+        return sqlite_store_is_proven_unusable(
+            path=self.path,
+            guard_home=self.guard_home,
+            error=error,
+            fatal_error=self._is_fatal_sqlite_error(error),
+        )
 
-    def _recover_fatal_sqlite_store(self, error: BaseException) -> bool:
-        is_io_error = _SQLITE_IO_ERROR_MARKER in str(error).lower()
+    def _recover_fatal_sqlite_store(
+        self,
+        error: BaseException,
+        *,
+        failed_identity: tuple[int, int] | None = None,
+    ) -> bool:
+        is_io_error = SQLITE_IO_ERROR_MARKER in str(error).lower()
         if (
             not isinstance(error, sqlite3.DatabaseError)
             or (not self._is_fatal_sqlite_error(error) and not is_io_error)
@@ -280,11 +270,12 @@ class StoreConnectionSchemaMixin:
             or self.path.is_symlink()
         ):
             return False
-        try:
-            failed_stat = self.path.stat()
-            failed_identity = failed_stat.st_dev, failed_stat.st_ino
-        except OSError:
-            failed_identity = None
+        if failed_identity is None:
+            try:
+                failed_stat = self.path.stat()
+                failed_identity = failed_stat.st_dev, failed_stat.st_ino
+            except OSError:
+                failed_identity = None
         with self._hold_storage_gate(exclusive=True):
             # Another process may already have replaced the failed store.
             try:
@@ -344,14 +335,20 @@ class StoreConnectionSchemaMixin:
                 yield connection
             return
         fatal_error: sqlite3.DatabaseError | None = None
+        failed_identity: tuple[int, int] | None = None
         with self._hold_storage_gate(exclusive=False):
             try:
                 with self._connect_once() as connection:
                     yield connection
             except sqlite3.DatabaseError as error:
                 fatal_error = error
+                try:
+                    failed_stat = self.path.stat()
+                    failed_identity = failed_stat.st_dev, failed_stat.st_ino
+                except OSError:
+                    failed_identity = None
         if fatal_error is not None:
-            self._recover_fatal_sqlite_store(fatal_error)
+            self._recover_fatal_sqlite_store(fatal_error, failed_identity=failed_identity)
             raise fatal_error
 
     @contextmanager

{plugin_scanner-3.0.0a213 → plugin_scanner-3.0.0a215}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "3.0.0a213"
+__version__ = "3.0.0a215"