plugin-scanner 3.0.186__tar.gz → 3.0.187__tar.gz

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.186
+Version: 3.0.187
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.0.186"
+version = "3.0.187"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.0.186"
+version = "3.0.187"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.0.186/release-metadata/plugin-scanner-v3.0.186.toolchain.cdx.json → plugin_scanner-3.0.187/release-metadata/plugin-scanner-v3.0.187.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.0.186"
+      "version": "3.0.187"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/daemon/hook_native_review_approval.py

@@ -55,6 +55,7 @@ _MUTABLE_CODE_LAUNCHERS = {
     "pipx",
 }
 _PYTHON_LAUNCHER = re.compile(r"pythonw?(?:\d+(?:\.\d+)*)?(?:\.exe)?$", re.IGNORECASE)
+_FILE_BACKED_PROGRAM_COMMANDS = {"sed", "grep", "egrep", "fgrep", "rg"}
 _DIRECT_REUSABLE_COMMANDS = {
     "cat",
     "head",
@@ -240,9 +241,45 @@ def _command_reuse_is_payload_bound(command: str) -> bool:
     basename = Path(executable).name.lower()
     if basename in _MUTABLE_CODE_LAUNCHERS or _PYTHON_LAUNCHER.fullmatch(basename):
         return False
+    if basename in _FILE_BACKED_PROGRAM_COMMANDS and _uses_file_backed_program(tokens[1:]):
+        return False
+    if basename == "rg" and _rg_executes_unreviewed_preprocessor(tokens[1:]):
+        return False
     return basename in _DIRECT_REUSABLE_COMMANDS
 
 
+def _rg_executes_unreviewed_preprocessor(tokens: list[str]) -> bool:
+    """Reject ripgrep launches that run a mutable preprocessor."""
+
+    return any(token == "--pre" or token.startswith("--pre=") for token in tokens)
+
+
+def _uses_file_backed_program(tokens: list[str]) -> bool:
+    """Reject programs or patterns loaded from a mutable file instead of argv."""
+
+    skip_next = False
+    for token in tokens:
+        if skip_next:
+            skip_next = False
+            continue
+        if token in {"-f", "--file", "--fi", "--fil"}:
+            return True
+        if token.startswith(("--file=", "--fi=", "--fil=")):
+            return True
+        if token in {"-e", "--expression", "--regexp"}:
+            skip_next = True
+            continue
+        if token.startswith("-") and not token.startswith("--") and token != "-":
+            cluster = token[1:]
+            for index, flag in enumerate(cluster):
+                if flag == "e":
+                    skip_next = index == len(cluster) - 1
+                    break
+                if flag == "f":
+                    return True
+    return False
+
+
 def _native_review_binding(
     harness: str,
     payload: Mapping[str, object],

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/daemon/hook_worker_native.py

@@ -367,7 +367,6 @@ class HookWorkerNativeMixin:
                 recording_only=recording_only,
             )
         raw_receipt = edge.get("receipt")
-        native_receipt = raw_receipt if isinstance(raw_receipt, Mapping) else None
         accepted_receipt = self._record_native_decision_receipt(raw_receipt)
         self.metrics.record_route("native_resident")
         if native_event == "PreToolUse":
@@ -388,7 +387,7 @@ class HookWorkerNativeMixin:
                     harness=native_harness,
                     payload=payload,
                     native_result=native_result,
-                    native_receipt=native_receipt,
+                    native_receipt=accepted_receipt,
                     workspace=workspace,
                     guard_home=guard_home,
                 )
@@ -410,14 +409,18 @@ class HookWorkerNativeMixin:
         return harness_json_from_native_post_tool(native_harness, native_result)
 
     def _record_native_decision_receipt(self: _HookWorkerNativeHost, receipt: object) -> Mapping[str, object] | None:
-        """Hand Rust evidence to the non-authoritative writer without waiting."""
+        """Accept only a validated Rust receipt; persistence remains best-effort."""
 
-        self._last_native_decision_receipt = dict(receipt) if isinstance(receipt, Mapping) else None
+        from ..native_decision_receipt import validate_native_decision_receipt
+
+        self._last_native_decision_receipt = None
+        accepted = validate_native_decision_receipt(receipt)
+        if accepted is None:
+            return None
         writer = self.activity_writer
         submit = getattr(writer, "submit_native_decision_receipt", None)
-        if not callable(submit) or not isinstance(receipt, Mapping):
-            return None
-        with suppress(Exception):
-            if submit(receipt=receipt) is True:
-                return receipt
-        return None
+        if callable(submit):
+            with suppress(Exception):
+                submit(receipt=accepted)
+        self._last_native_decision_receipt = accepted
+        return accepted

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/redaction.py

@@ -122,7 +122,7 @@ _SENSITIVE_INLINE_PREFIX_PATTERNS: tuple[re.Pattern[str], ...] = (
 _SENSITIVE_TEXT_PATTERN = re.compile(
     r"(?i)(sk-[a-z0-9_-]+|(?:token|secret|password|passwd|credential(?:s)?|authorization|"
     r"access[_-]?key|api[_-]?key)(?:\s*[:=]\s*|\s+)(?:bearer\s+|basic\s+)?"
-    r"(?P<value>\"[^\"\r\n]*\"|'[^'\r\n]*'|[^\s,;\"']+))"
+    r"(?P<value>\"(?:\\[^\r\n]|[^\"\\\r\n])*\"|'(?:\\[^\r\n]|[^'\\\r\n])*'|\"(?:\\[^\r\n]|[^\"\\\r\n])*|'(?:\\[^\r\n]|[^'\\\r\n])*|[^\s,;\"']+))"
 )
 _POSIX_USER_PATH_PATTERN = re.compile(
     r"(?P<prefix>^|[\s\"'=({\[])(?P<root>/(?:Users|home)/[^/\s\"'`,;:)}\]]+)(?P<rest>(?:/[^\s\"'`,;:)}\]]*)?)"

plugin_scanner-3.0.187/src/codex_plugin_scanner/guard/runtime/_shell_secret_read_flow.py

@@ -0,0 +1,92 @@
+"""Flow and segment helpers for shell secret-read assessment."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import replace
+from pathlib import Path
+
+from ._shell_execution_context_support import split_shell_tokens
+from ._shell_secret_read_support import (
+    _FLOW_OPERATORS,
+    _OTHER_READERS,
+    _SHELLS,
+    _SHORT_CIRCUITING_CD_FAILURES,
+    _path_qualified,
+    _python_executable,
+)
+from .command_model import CanonicalCommand, CommandSegment
+from .shell_execution_context import ShellExecutionSegment
+
+
+def _parse_execution_segment(
+    execution: ShellExecutionSegment,
+    *,
+    raw_model: CanonicalCommand,
+    raw_segment: CommandSegment | None,
+) -> CanonicalCommand | None:
+    """Keep source syntax and require agreement with the cwd model.
+
+    Re-quoting decoded tokens changes input redirections into ordinary argv
+    and can erase command/exec ambiguity. The raw command parser deliberately
+    skips transparent-wrapper normalization for this inspection path.
+    """
+
+    if not execution.complete or execution.effective_cwd is None or raw_segment is None:
+        return None
+    try:
+        if split_shell_tokens(raw_segment.text) != execution.tokens:
+            return None
+    except ValueError:
+        return None
+    return replace(
+        raw_model,
+        segments=(raw_segment,),
+        redirects=tuple(
+            redirect
+            for redirect in raw_model.redirects
+            if raw_segment.start <= redirect.start and redirect.end <= raw_segment.end
+        ),
+        embedded_commands=(),
+    )
+
+
+def _segment_may_touch_local_data(execution: ShellExecutionSegment) -> bool:
+    """Keep unknown file/code access closed without treating stdout as a file."""
+
+    from .secret_file_request_services.local_read_operands import _shell_segment_file_operand_tokens
+
+    if not execution.tokens:
+        return False
+    token = execution.tokens[0]
+    executable = "." if token == "." else Path(token).name.lower()
+    args = list(execution.tokens[1:])
+    has_input_redirect = any(re.match(r"^\d*<(?!<)", item) for item in execution.tokens)
+    if has_input_redirect or _shell_segment_file_operand_tokens([executable, *args]):
+        return True
+    if executable in _OTHER_READERS:
+        return any(not arg.startswith("-") for arg in args)
+    return (
+        executable in {*_SHELLS, "command", "exec", "node", "bun", "ruby", "perl"}
+        or _python_executable(executable)
+        or _path_qualified(token)
+    )
+
+
+def _flow_operator_before(execution: ShellExecutionSegment) -> str | None:
+    return next((token for token in reversed(execution.control_before) if token in _FLOW_OPERATORS), None)
+
+
+def _failed_cd_short_circuit_state(
+    execution: ShellExecutionSegment,
+    *,
+    active: bool,
+) -> tuple[bool, bool]:
+    """Return the failed-cd state and whether this segment is provably unreachable."""
+
+    operator = _flow_operator_before(execution)
+    if operator in {"||", ";", "&", "|"}:
+        active = False
+    if execution.directory_operation is not None and execution.reason_code in _SHORT_CIRCUITING_CD_FAILURES:
+        return True, False
+    return active, bool(active and operator == "&&")

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/runtime/_shell_secret_read_support.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import re
-from dataclasses import replace
 from pathlib import Path
 
 from ._shell_execution_context_support import (
@@ -12,10 +11,8 @@ from ._shell_execution_context_support import (
     SHELL_CWD_UNREADABLE_DIRECTORY,
     split_shell_tokens,
 )
-from .command_model import CanonicalCommand, CommandSegment
+from .command_model import CanonicalCommand
 from .home_path_text import expand_home, normalize_path
-from .secret_sensitivity import classify_secret_path
-from .shell_execution_context import ShellExecutionSegment
 
 _SHELLS = frozenset({"sh", "bash", "dash", "ash", "zsh", "ksh", "fish", "source", "."})
 _SCRIPT_SUFFIXES = (
@@ -32,7 +29,23 @@ _SCRIPT_SUFFIXES = (
     ".rb",
     ".pl",
 )
-_OTHER_READERS = frozenset({"base64", "xxd", "od", "hexdump", "strings", "tac", "less", "more", "sort", "uniq", "wc"})
+_OTHER_READERS = frozenset(
+    {
+        "base64",
+        "xxd",
+        "od",
+        "hexdump",
+        "strings",
+        "tac",
+        "less",
+        "more",
+        "sort",
+        "uniq",
+        "wc",
+        "ag",
+        "ack",
+    }
+)
 _MAX_SCRIPTS = 16
 _MAX_DEPTH = 4
 _MAX_TOTAL_BYTES = 128 * 1024
@@ -115,6 +128,8 @@ def _command_may_need_read_assessment(
 def _sensitive_path(value: str, *, cwd: Path | None, home_dir: Path | None) -> str | None:
     """Classify a literal or metadata-resolved alias without opening secrets."""
 
+    from .secret_sensitivity import classify_secret_path
+
     match = classify_secret_path(value, cwd=cwd, home_dir=home_dir)
     if match is not None:
         return match.path
@@ -312,12 +327,26 @@ def _script_operand(executable: str, args: tuple[str, ...]) -> tuple[str, bool]
             if arg in {"-o", "-O", "+o", "+O", "--rcfile", "--init-file"}:
                 index += 2
                 continue
+            if is_interpreter and _python_executable(name):
+                from .secret_file_request_services.constants_core import _PYTHON_INTERPRETER_OPTIONS_WITH_VALUES
+
+                if arg in _PYTHON_INTERPRETER_OPTIONS_WITH_VALUES:
+                    if index + 1 >= len(args):
+                        return None
+                    index += 2
+                    continue
+                if any(
+                    arg.startswith(option) and len(arg) > len(option)
+                    for option in _PYTHON_INTERPRETER_OPTIONS_WITH_VALUES
+                ):
+                    index += 1
+                    continue
             if not arg.startswith(("-", "+")):
                 break
             index += 1
         if index < len(args) and args[index] != "-":
             operand = args[index]
-            if is_shell or _script_like_operand(operand):
+            if is_shell or _python_executable(name) or _script_like_operand(operand):
                 return operand, is_shell
             return None
     if name == "bun" and args and args[0].endswith(_SCRIPT_SUFFIXES):
@@ -349,15 +378,26 @@ def _python_module_launch(executable: str, args: tuple[str, ...], *, cwd: Path |
         return False
     if _known_python_module_launch(executable, args, cwd=cwd):
         return False
-    for index, arg in enumerate(args):
+    from .secret_file_request_services.constants_core import _PYTHON_INTERPRETER_OPTIONS_WITH_VALUES
+
+    index = 0
+    while index < len(args):
+        arg = args[index]
         if arg == "--":
             return False
         if arg == "-m" or (arg.startswith("-m") and len(arg) > 2):
             return True
-        if arg in {"-W", "-X"} and index + 1 < len(args):
+        if arg in _PYTHON_INTERPRETER_OPTIONS_WITH_VALUES:
+            if index + 1 >= len(args):
+                return False
+            index += 2
+            continue
+        if any(arg.startswith(option) and len(arg) > len(option) for option in _PYTHON_INTERPRETER_OPTIONS_WITH_VALUES):
+            index += 1
             continue
         if not arg.startswith("-"):
             return False
+        index += 1
     return False
 
 
@@ -444,76 +484,3 @@ def _local_executable_operand(
     if not lexical.is_absolute() or not any(lexical.is_relative_to(root) for root in roots):
         return None
     return executable
-
-
-def _parse_execution_segment(
-    execution: ShellExecutionSegment,
-    *,
-    raw_model: CanonicalCommand,
-    raw_segment: CommandSegment | None,
-) -> CanonicalCommand | None:
-    """Keep source syntax and require agreement with the cwd model.
-
-    Re-quoting decoded tokens changes input redirections into ordinary argv
-    and can erase command/exec ambiguity. The raw command parser deliberately
-    skips transparent-wrapper normalization for this inspection path.
-    """
-
-    if not execution.complete or execution.effective_cwd is None or raw_segment is None:
-        return None
-    try:
-        if split_shell_tokens(raw_segment.text) != execution.tokens:
-            return None
-    except ValueError:
-        return None
-    return replace(
-        raw_model,
-        segments=(raw_segment,),
-        redirects=tuple(
-            redirect
-            for redirect in raw_model.redirects
-            if raw_segment.start <= redirect.start and redirect.end <= raw_segment.end
-        ),
-        embedded_commands=(),
-    )
-
-
-def _segment_may_touch_local_data(execution: ShellExecutionSegment) -> bool:
-    """Keep unknown file/code access closed without treating stdout as a file."""
-
-    from .secret_file_request_services.local_read_operands import _shell_segment_file_operand_tokens
-
-    if not execution.tokens:
-        return False
-    token = execution.tokens[0]
-    executable = "." if token == "." else Path(token).name.lower()
-    args = list(execution.tokens[1:])
-    has_input_redirect = any(re.match(r"^\d*<(?!<)", item) for item in execution.tokens)
-    if has_input_redirect or _shell_segment_file_operand_tokens([executable, *args]):
-        return True
-    if executable in _OTHER_READERS:
-        return any(not arg.startswith("-") for arg in args)
-    return (
-        executable in {*_SHELLS, "command", "exec", "node", "bun", "ruby", "perl"}
-        or _python_executable(executable)
-        or _path_qualified(token)
-    )
-
-
-def _flow_operator_before(execution: ShellExecutionSegment) -> str | None:
-    return next((token for token in reversed(execution.control_before) if token in _FLOW_OPERATORS), None)
-
-
-def _failed_cd_short_circuit_state(
-    execution: ShellExecutionSegment,
-    *,
-    active: bool,
-) -> tuple[bool, bool]:
-    """Return the failed-cd state and whether this segment is provably unreachable."""
-
-    operator = _flow_operator_before(execution)
-    if operator in {"||", ";", "&"}:
-        active = False
-    if execution.directory_operation is not None and execution.reason_code in _SHORT_CIRCUITING_CD_FAILURES:
-        return True, False
-    return active, bool(active and operator in {"&&", "|"})

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_initial_risk.py

@@ -115,7 +115,72 @@ def _missing_workspace_read_only_search(cwd: Path | None, command: CanonicalComm
     executable = segment.executable
     if executable is None or segment.environment_names or segment.pipeline_index != 0:
         return False
-    return Path(executable).name.lower() in _READ_ONLY_SEARCH_COMMANDS
+    if "/" in executable or "\\" in executable or executable.startswith("."):
+        return False
+    name = Path(executable).name.lower()
+    if name not in _READ_ONLY_SEARCH_COMMANDS:
+        return False
+    from .developer_inspection import _read_only_lookup_search_args_are_safe
+
+    return _read_only_lookup_search_args_are_safe(name, list(segment.arguments))
+
+
+def _unwrap_search_invocation(executable: str | None, args: list[str]) -> tuple[str | None, list[str]]:
+    """Strip command/exec prefixes so preprocessor flags stay visible."""
+
+    if executable is None:
+        return None, args
+    name = Path(executable).name.lower()
+    remaining = list(args)
+    for _ in range(8):
+        if name not in {"command", "exec"}:
+            return name, remaining
+        if name == "command":
+            while remaining and remaining[0] == "-p":
+                remaining = remaining[1:]
+            if remaining and remaining[0] == "--":
+                remaining = remaining[1:]
+            elif remaining and remaining[0] in {"-v", "-V"}:
+                return name, remaining
+        else:
+            while remaining:
+                token = remaining[0]
+                if token == "--":
+                    remaining = remaining[1:]
+                    break
+                if token == "-a":
+                    remaining = remaining[2:] if len(remaining) > 1 else []
+                    continue
+                if token.startswith("-a") and len(token) > 2:
+                    remaining = remaining[1:]
+                    continue
+                if len(token) > 1 and token.startswith("-") and set(token[1:]) <= {"c", "l"}:
+                    remaining = remaining[1:]
+                    continue
+                break
+        if not remaining:
+            return None, remaining
+        name = Path(remaining[0]).name.lower()
+        remaining = remaining[1:]
+    return None, remaining
+
+
+def _search_command_executes_unreviewed_code(command: CanonicalCommand) -> bool:
+    """Return True when a search CLI can run a preprocessor or other local program."""
+
+    if command.redirects or command.embedded_commands or len(command.segments) != 1:
+        return False
+    segment = command.segments[0]
+    if segment.environment_names or segment.pipeline_index != 0:
+        return False
+    name, args = _unwrap_search_invocation(segment.executable, list(segment.arguments))
+    if name is None:
+        return True
+    if name not in _READ_ONLY_SEARCH_COMMANDS:
+        return False
+    from .developer_inspection import _read_only_lookup_search_args_are_safe
+
+    return not _read_only_lookup_search_args_are_safe(name, args)
 
 
 def _direct_shell_risk_match(
@@ -193,8 +258,9 @@ def _direct_shell_risk_match(
             script_read_identity_sha256=assessment.identity_sha256,
             interpreter_executable_identities=interpreter_executable_identities,
         )
+    search_executes_code = _search_command_executes_unreviewed_code(canonical_command)
     if assessment.requires_review:
-        if _missing_workspace_read_only_search(cwd, canonical_command):
+        if (not search_executes_code) and _missing_workspace_read_only_search(cwd, canonical_command):
             return None
         return ToolActionRequestMatch(
             tool_name=tool_name,
@@ -208,6 +274,18 @@ def _direct_shell_risk_match(
             script_read_identity_sha256=assessment.identity_sha256,
             interpreter_executable_identities=interpreter_executable_identities,
         )
+    if search_executes_code:
+        return ToolActionRequestMatch(
+            tool_name=tool_name,
+            normalized_tool_name=normalized_tool_name,
+            command_text=command_text,
+            action_class=_LOCAL_SCRIPT_ACTION_CLASS,
+            reason=("This command executes local or incompletely inspected code. Review it before execution."),
+            canonical_command=canonical_command,
+            guard_default_action="require-reapproval",
+            reason_code="shell_local_script_execution_review",
+            interpreter_executable_identities=interpreter_executable_identities,
+        )
     return None
 
 

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/runtime/shell_read_literal_wrapper.py

@@ -25,6 +25,8 @@ def literal_shell_read_payload(command_text: str) -> str:
         tokens = shlex.split(command_text, posix=True, comments=False)
     except ValueError:
         return command_text
-    if len(tokens) != 3 or tokens[0] not in _TRANSPARENT_SHELLS or tokens[1] not in {"-c", "-lc"}:
+    # Login shells (`-lc`) execute user-controlled startup files before the
+    # payload, so they must keep the original invocation for review.
+    if len(tokens) != 3 or tokens[0] not in _TRANSPARENT_SHELLS or tokens[1] != "-c":
         return command_text
     return tokens[2]

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/guard/runtime/shell_secret_reads.py

@@ -17,6 +17,12 @@ from ._shell_execution_context_support import (
     SHELL_CWD_UNRESOLVED_PARENT_SHELL,
     SHELL_CWD_WORKSPACE_ESCAPE,
 )
+from ._shell_secret_read_flow import (
+    _failed_cd_short_circuit_state,
+    _flow_operator_before,
+    _parse_execution_segment,
+    _segment_may_touch_local_data,
+)
 from ._shell_secret_read_support import (
     _MAX_DEPTH,
     _MAX_INLINE_SCRIPT_BYTES,
@@ -26,18 +32,14 @@ from ._shell_secret_read_support import (
     _command_may_need_read_assessment,
     _cwd_shadowed_executable,
     _direct_secret_read_paths_from_tokens,
-    _failed_cd_short_circuit_state,
-    _flow_operator_before,
     _interpreter_inline_launch,
     _interpreter_stdin_launch,
     _known_python_module_launch,
     _literal_read_paths,
     _local_executable_operand,
-    _parse_execution_segment,
     _python_executable,
     _python_module_launch,
     _script_operand,
-    _segment_may_touch_local_data,
     _sensitive_path,
     _shell_command_string,
     _unresolved_local_script_launch,
@@ -106,7 +108,7 @@ def assess_shell_reads(
         # its conditional successor conservatively without inventing a cwd
         # failure for the delay itself.
         delay = re.match(r"^\s*sleep\s+([1-9]\d{0,3})\s*&&\s*", text)
-        if delay is not None and int(delay.group(1)) <= 3600:
+        if delay is not None and int(delay.group(1)) <= 3600 and not _cwd_shadowed_executable("sleep", cwd=current_cwd):
             text = text[delay.end() :]
         context = model_shell_execution_context(
             text,

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "3.0.186"
+__version__ = "3.0.187"

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/tests/fixtures/guard-command-corpus/decision-diff-report.json

@@ -87,7 +87,7 @@
       "source-2f536ba0f104e76b74d4ea8e": "8b24ab067420802c13991c18dd28636d4d56b094ce72636dd4419459a9908abd",
       "source-3025034bc040ba0a2993f316": "d92601f091df8c63a4d41f1fdbde0690c24e1c6603a7285f19c5df3771da3308",
       "source-3065da4e796ef3b53d47786d": "529c8e0582f3f47562e9b26bad622d0bfa43c4275c8117b2ec85b20767e25a40",
-      "source-31fc9e18e2cab6f77d0964fd": "4561d35e54d172a1781d2d29ceabdc493a9cc2d7e46f3e1a58221e0ed7b9ab70",
+      "source-31fc9e18e2cab6f77d0964fd": "1a4e39c6dce41ec167d1a5dcf8e99cb1a975c30e4272bb8007b0119da5c58c3f",
       "source-327dd79d0a3617ffa3cab480": "1d200371b9898ec1bb2205e5146eb18c70445417cf245024d7c4342c0bffe85c",
       "source-340bdca607709665d6c98dbc": "235bfd8ba820a0c7740f783790a075fed1c3eaa7a6c8e227733face1962b35d8",
       "source-343ab305d578c73898a95d1f": "14d80d4beafc4b02e795b0b3537c12900cbc3f16a6ccd25cfeaa52bfc1c7c720",
@@ -137,7 +137,7 @@
       "source-5252fd793b49a537852d881d": "718973d25bf5d91943a27453c26ec505c00c0b89e827757e1ae6edf362955be5",
       "source-52870a8c6d89146820e8a067": "524d92e15a2e89c51cc1fcdb69c379208f2e5684e836cc885b7dc02e1d47cc90",
       "source-5384753b6f0132290e82a624": "23cdf9e4d27d0fe7c669d575108319121b02597ccafd9de77109f785800b3b49",
-      "source-5392a6fb1493c13aac80c872": "8578c90b95aa1ccf49e8e71d5a88ec1f9bbaff8b62b81540cf8dc1c524732268",
+      "source-5392a6fb1493c13aac80c872": "1b40f0b5e3dcd8f479e092416a2cf17fa739b71cbfc76a0b8fefacc91a0e2907",
       "source-53955d708b1f26505c7d4767": "db7bde370c9682b5c24e3fca3f266317660e3c966cedfdca548a6f1a524cca6d",
       "source-54b8965ce6adb239b24474a4": "282c3284ae3cec6a373c11f8b19694a7fad809bd59aa2fd633f0e4c3b41f5218",
       "source-54ca9f8f882d1002ba7d7bac": "47d191710b9a903f539375d25b3b356057d09480874f862ec676173727595ecb",
@@ -295,10 +295,11 @@
       "source-b7d80e334f68594dff5c42ef": "ec6448647fcf1aeb8cf47aaddcc5bb61dc0093984a96946e86f8da46449d6dcf",
       "source-b80a8083541fd7e8874926a6": "70809cdb088f410ad92d127d5436ff235b6e89394c42a4ad062d4a83d3c3796a",
       "source-b933bc50f755d1a32c112e35": "5727d8a9e0f1bf39aa4470f048e346a2eed5b9437bd74c3c63e3420722e3b959",
+      "source-b963185dc65afe968b95501a": "35d71f20306af11caf63794ce3be97b677d8a7fafdcdf5ad247fc63d7b1adda6",
       "source-b970eabd271372ddfe730bf1": "d07b8da7b625a170acee771889ea340c049731b28c032b6179931de746adef5a",
       "source-ba3ba0028bdc49b9008e93d2": "ff785a7ea257c305fbd5d732bc1194d814c638e06d6816f25c4156148dd4e729",
       "source-ba4fee2dac2a5b0da5d61bdb": "b2434db33fbad299c552ab1a60923d451930cd4186b6d085f9fbcc7693aaee21",
-      "source-ba818a9c79b3640ab92f12ac": "9920014bca3dd89a31256dd33e9e71987a9b8e21bd6bc7de72b5d3a31172f82d",
+      "source-ba818a9c79b3640ab92f12ac": "febe7c40315743ff57462be5d8ed62b4e9069922aad2de0191ebea0327d4bfad",
       "source-ba85b41a08ce4b871e40e7b7": "2d5ed4199691c6bee541d2328659ff00180214449d07137d436e28e128d41a26",
       "source-bbf1900d9722bd89273df0a9": "bcd3c7a6bc266408b38e3b9de145fa98c6db549d82e9c79b637085e97a74eda1",
       "source-bc036bfe24f968f06679d17c": "9771e902dc9bca564b291d2e80990a66464e1f4e732f0e5b5bd521600c7e00c4",

{plugin_scanner-3.0.186 → plugin_scanner-3.0.187}/tests/test_guard_command_git_stash_permission.py

@@ -50,8 +50,6 @@ def _permission_layer(permission_id: str, state: ControlState) -> ExtensionContr
     (
         "git stash",
         "git stash push -m wip",
-        "zsh -lc 'git stash'",
-        "zsh -lc 'git stash list'",
     ),
 )
 def test_explicit_git_stash_permission_allows_wrapped_shell_forms(command: str, tmp_path: Path) -> None:
@@ -95,6 +93,34 @@ def test_explicit_git_stash_permission_allows_wrapped_shell_forms(command: str,
     )
 
 
+def test_explicit_git_stash_permission_does_not_unwrap_login_shells(tmp_path: Path) -> None:
+    request = extract_sensitive_tool_action_request(
+        "Shell",
+        {"command": "zsh -lc 'git stash list'"},
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+    snapshot = ExtensionControlRuntimeSnapshot.from_authority_view(
+        ExtensionControlAuthorityView(
+            health=AuthorityHealth.PROTECTED,
+            revision=11,
+            catalog_digest=BUILT_IN_COMMAND_EXTENSION_REGISTRY.catalog_digest,
+            layers=(_permission_layer("command.git.permission.stash", ControlState.ENABLED),),
+        )
+    )
+
+    assert request is not None
+    with use_extension_control_snapshot(snapshot):
+        artifact = build_tool_action_request_artifact(
+            "grok",
+            request,
+            config_path="config.toml",
+            source_scope="project",
+        )
+
+    assert artifact.metadata["command_action_floor"] == "require-reapproval"
+
+
 def test_explicit_permission_allow_keeps_harness_risk_blocks(tmp_path: Path) -> None:
     command = "gh pr merge 5115 --repo example/project --squash --auto"
     request = extract_sensitive_tool_action_request("Shell", {"command": command}, cwd=tmp_path, home_dir=tmp_path)