plugin-scanner 3.7.3__tar.gz → 3.7.4__tar.gz

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/.github/workflows/ci.yml

@@ -643,6 +643,7 @@ jobs:
           $work = Join-Path $env:RUNNER_TEMP "hol-guard-frozen-work"
           $spec = Join-Path $env:RUNNER_TEMP "hol-guard-frozen-spec"
           $versionFile = Join-Path $env:RUNNER_TEMP "hol-guard-version-info.txt"
+          $versionModule = Join-Path (Get-Location).Path "src/codex_plugin_scanner/version.py"
           New-Item -ItemType Directory -Force -Path $dist, $work, $spec | Out-Null
           uv sync --frozen --extra dev --extra mdm-build --python ${{ matrix.python-version }}
           $version = (uv run --no-sync python scripts/sync_repo_version.py --check).Trim()
@@ -655,6 +656,7 @@ jobs:
           }
           uv run --no-sync pyinstaller --clean --noconfirm --onedir --name hol-guard `
             --collect-submodules codex_plugin_scanner --collect-data codex_plugin_scanner `
+            --add-data "$versionModule;." `
             --version-file $versionFile `
             --distpath $dist --workpath $work --specpath $spec `
             scripts/mdm/hol-guard-entry.py

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/.github/workflows/desktop-core-alpha-feed.yml

@@ -317,6 +317,7 @@ jobs:
               --collect-submodules codex_plugin_scanner --collect-data codex_plugin_scanner \
               --add-data "$NATIVE_RUNTIME:codex_plugin_scanner/_native" \
               --add-data "$NATIVE_MANIFEST:codex_plugin_scanner/_native" \
+              --add-data "$SOURCE/src/codex_plugin_scanner/version.py:." \
               --distpath "$DIST" --workpath "$RUNNER_TEMP/pyinstaller" --specpath "$RUNNER_TEMP/spec" \
               scripts/mdm/hol-guard-entry.py
           )

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/.github/workflows/desktop-core-linux-feed.yml

@@ -312,6 +312,7 @@ jobs:
               --collect-submodules codex_plugin_scanner --collect-data codex_plugin_scanner \
               --add-data "$NATIVE_RUNTIME:codex_plugin_scanner/_native" \
               --add-data "$NATIVE_MANIFEST:codex_plugin_scanner/_native" \
+              --add-data "$SOURCE/src/codex_plugin_scanner/version.py:." \
               --distpath "$DIST" --workpath "$RUNNER_TEMP/pyinstaller" --specpath "$RUNNER_TEMP/spec" \
               scripts/mdm/hol-guard-entry.py
           )

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.7.3
+Version: 3.7.4
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/dashboard/src/app.tsx

@@ -987,7 +987,6 @@ export function App() {
       onRetry={handleRetry}
       onRepair={handleRepair}
       onGuardReconnected={handleRetry}
-      enableUpdateStatus={view !== "inbox"}
       onClearEvidence={handleClearEvidence}
       fleetContent={
         runtime.kind === "ready" ? (

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/dashboard/src/approval-center-layout.tsx

@@ -100,7 +100,6 @@ type LayoutProps = {
   onClearEvidence?: () => void;
   onRetryResume?: () => void;
   onGuardReconnected?: () => void;
-  enableUpdateStatus?: boolean;
 };
 
 function InboxWatchBanner(props: { onRestored?: () => void; onOpenSettings: () => void }) {
@@ -266,7 +265,7 @@ export function ApprovalCenterLayout(props: LayoutProps) {
     onUpdateGuard,
     onReinstallGuard,
     onSetUpdateChannel,
-  } = useGuardUpdate({ onReconnected: props.onGuardReconnected, enabled: props.enableUpdateStatus });
+  } = useGuardUpdate({ onReconnected: props.onGuardReconnected });
 
   return (
     <div className="min-h-screen bg-white text-brand-dark">

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/dashboard/src/shell-navigation.test.tsx

@@ -101,6 +101,7 @@ assert(
 const css = source("./shell-navigation.css");
 const drawerSource = source("./shell-navigation-drawer.tsx");
 const layoutSource = source("./approval-center-layout.tsx");
+const appSource = source("./app.tsx");
 const responsiveSource = source("./responsive-layout.css");
 const mainSource = source("./main.tsx");
 
@@ -138,6 +139,12 @@ assert(
   drawerSource.includes("onSetUpdateChannel={props.onSetUpdateChannel}"),
   "The navigation drawer keeps the alpha update control",
 );
+assert(
+  layoutSource.includes("useGuardUpdate({ onReconnected: props.onGuardReconnected })") &&
+    !layoutSource.includes("enableUpdateStatus") &&
+    !appSource.includes("enableUpdateStatus"),
+  "Update status stays enabled on every view so the Update action cannot disappear on Inbox",
+);
 
 const alphaMarkup = renderToStaticMarkup(
   <ShellNavigation

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.7.3"
+version = "3.7.4"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.7.3"
+version = "3.7.4"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.7.3/release-metadata/plugin-scanner-v3.7.3.toolchain.cdx.json → plugin_scanner-3.7.4/release-metadata/plugin-scanner-v3.7.4.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.7.3"
+      "version": "3.7.4"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/scripts/mdm/hol-guard-entry.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import ast
 import json
 import sys
 from multiprocessing import freeze_support
@@ -10,6 +11,38 @@ from pathlib import Path
 _FROZEN_DAEMON_SERVE_ARG = "--_hol-guard-daemon-serve"
 
 
+def _packaged_version() -> str:
+    """Read the stamped version without importing Guard.
+
+    Desktop's update check runs ``--version`` with a 90s budget. Importing the
+    frozen daemon runtime before that probe extracts and loads the whole
+    command surface, so the check times out and the current CLI stays in place.
+    """
+
+    candidates = []
+    meipass = getattr(sys, "_MEIPASS", None)
+    if isinstance(meipass, str) and meipass:
+        candidates.append(Path(meipass) / "version.py")
+    if not getattr(sys, "frozen", False):
+        candidates.append(
+            Path(__file__).resolve().parents[2] / "src" / "codex_plugin_scanner" / "version.py"
+        )
+    for path in candidates:
+        if not path.is_file():
+            continue
+        tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+        for node in tree.body:
+            if not isinstance(node, ast.Assign):
+                continue
+            if not any(isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets):
+                continue
+            if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                version = node.value.value.strip()
+                if version:
+                    return version
+    raise SystemExit(1)
+
+
 def _consume_frozen_daemon_serve_gate() -> bool:
     """Read the parent gate before importing any Guard package code."""
 
@@ -49,6 +82,9 @@ if __name__ == "__main__":
     # Dispatch PyInstaller multiprocessing children before importing Guard.
     # Otherwise private resource-tracker argv is parsed as a public CLI command.
     freeze_support()
+    if len(sys.argv) > 1 and sys.argv[1] == "--version":
+        print(f"{Path(sys.argv[0]).name} {_packaged_version()}")
+        raise SystemExit(0)
 
     daemon_gate_released = _consume_frozen_daemon_serve_gate()
 

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/scripts/mdm/macos/build-pkg.sh

@@ -11,6 +11,13 @@ readonly RUNTIME="${STAGE}/Library/Application Support/HOL Guard"
 readonly STATE="${STAGE}/Library/Application Support/HOL Guard State"
 readonly LOGS="${STAGE}/Library/Logs/HOL Guard"
 readonly PACKAGE_ID="org.hol.guard"
+readonly SOURCE_VERSION="$(sed -n 's/^__version__ = "\([^"]*\)".*$/\1/p' \
+  "${ROOT}/src/codex_plugin_scanner/version.py")"
+if [[ "${SOURCE_VERSION}" != "${VERSION}" ]]; then
+  printf 'HOL_GUARD_VERSION %s does not match source version %s\n' \
+    "${VERSION}" "${SOURCE_VERSION}" >&2
+  exit 1
+fi
 
 rm -rf "${OUT}"
 mkdir -p "${RUNTIME}" "${STATE}" "${LOGS}" "${STAGE}/Library/LaunchAgents" \
@@ -19,6 +26,7 @@ mkdir -p "${RUNTIME}" "${STATE}" "${LOGS}" "${STAGE}/Library/LaunchAgents" \
 typeset -a pyinstaller_args
 pyinstaller_args=(--clean --noconfirm --onedir --name hol-guard \
   --collect-submodules codex_plugin_scanner --collect-data codex_plugin_scanner \
+  --add-data "${ROOT}/src/codex_plugin_scanner/version.py:." \
   --distpath "${RUNTIME}" --workpath "${OUT}/pyinstaller" --specpath "${OUT}" \
   "${ROOT}/scripts/mdm/hol-guard-entry.py")
 if [[ -n "${HOL_GUARD_INSTALLER_SIGN_IDENTITY:-}" ]]; then

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/scripts/mdm/windows/build-msi.ps1

@@ -11,11 +11,17 @@ $Out = Join-Path $Root 'dist/mdm/windows'
 $Runtime = Join-Path $Out 'runtime'
 Remove-Item -Recurse -Force $Out -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force $Runtime | Out-Null
+$VersionModule = Join-Path $Root 'src/codex_plugin_scanner/version.py'
+$SourceVersion = [regex]::Match((Get-Content -LiteralPath $VersionModule -Raw), '(?m)^__version__ = "([^"]+)"').Groups[1].Value
+if ([string]::IsNullOrWhiteSpace($SourceVersion) -or $SourceVersion -ne $Version) {
+    throw "HOL_GUARD_VERSION $Version does not match source version $SourceVersion"
+}
 $VersionFile = Join-Path $Out 'version-info.txt'
 uv run --no-sync python (Join-Path $PSScriptRoot 'write-version-info.py') --version $Version --output $VersionFile
 
 uv run --no-sync pyinstaller --clean --noconfirm --onedir --name hol-guard `
     --collect-submodules codex_plugin_scanner --collect-data codex_plugin_scanner `
+    --add-data "$(Join-Path $Root 'src/codex_plugin_scanner/version.py');." `
     --version-file $VersionFile `
     --distpath $Runtime --workpath (Join-Path $Out 'pyinstaller') --specpath $Out `
     (Join-Path $Root 'scripts/mdm/hol-guard-entry.py')

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/src/codex_plugin_scanner/guard/adapters/base.py

@@ -16,6 +16,7 @@ from typing import TYPE_CHECKING
 from ...path_support import resolves_within_root
 from ..models import GuardArtifact, HarnessDetection
 from .contracts import HarnessCoverageSummary, HarnessSetupContract, HarnessSetupStep, setup_contract_for
+from .diagnostic_probes import skipped_command_probe
 
 if TYPE_CHECKING:
     from ..inventory_contract import GuardAgentInventorySnapshot
@@ -71,6 +72,9 @@ def _run_command_probe(
     cwd: Path | None = None,
     env: Mapping[str, str] | None = None,
 ) -> dict[str, object]:
+    skipped = skipped_command_probe(command)
+    if skipped is not None:
+        return skipped
     try:
         result = subprocess.run(
             command,

plugin_scanner-3.7.4/src/codex_plugin_scanner/guard/adapters/diagnostic_probes.py

@@ -0,0 +1,34 @@
+"""Scope optional CLI diagnostics without skipping registration validation."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
+
+_COMMAND_PROBES_ENABLED: ContextVar[bool] = ContextVar("guard_diagnostic_command_probes", default=True)
+
+
+@contextmanager
+def without_command_probes() -> Iterator[None]:
+    """Keep passive adapter checks while avoiding subprocess probes in global doctor."""
+
+    token = _COMMAND_PROBES_ENABLED.set(False)
+    try:
+        yield
+    finally:
+        _COMMAND_PROBES_ENABLED.reset(token)
+
+
+def skipped_command_probe(command: list[str]) -> dict[str, object] | None:
+    if _COMMAND_PROBES_ENABLED.get():
+        return None
+    return {
+        "command": command,
+        "ok": None,
+        "return_code": None,
+        "stdout": "",
+        "stderr": "",
+        "skipped": True,
+        "skip_reason": "global_doctor_passive_checks",
+    }

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/src/codex_plugin_scanner/guard/cli/commands_dispatch_admin.py

@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+from contextlib import nullcontext
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -27,6 +28,7 @@ if TYPE_CHECKING:
     )
 
 
+from ..adapters.diagnostic_probes import without_command_probes
 from ..daemon.bounded_http import daemon_admission_snapshot
 from ..native_runtime_admission import native_resident_admission_snapshot
 from ..runtime.command_queue import command_queue_status, repair_command_queue_state
@@ -34,6 +36,7 @@ from ..shims import package_shim_dashboard_status
 from ._commands_shared import *
 from .commands_dispatch_trust import build_trust_doctor_payload
 from .commands_parser_helpers import *
+from .doctor_readiness import doctor_runtime_readiness
 
 
 def _run_guard_exceptions_command(
@@ -297,14 +300,24 @@ def _run_guard_doctor_command(
     if args.harness:
         adapter = get_adapter(args.harness)
         payload: dict[str, object] = adapter.diagnostics(context)
+        payload["runtime_readiness"] = doctor_runtime_readiness(payload)
         payload["runtime_detector_registry"] = _runtime_detector_registry_payload(config)
         payload["connect_health"] = _guard_doctor_connect_health_payload(store)
         if args.harness == "codex":
             payload["codex_resume"] = inspect_codex_resume_capabilities(store)
     else:
+        detected_harnesses = []
+        with without_command_probes():
+            for detection in detect_all(context):
+                item = detection.to_dict()
+                diagnostics = get_adapter(detection.harness).diagnostics(context)
+                item["setup_status"] = diagnostics.get("setup_status")
+                item["warnings"] = diagnostics.get("warnings", [])
+                item["runtime_readiness"] = doctor_runtime_readiness(diagnostics)
+                detected_harnesses.append(item)
         payload = {
             "tables": store.list_table_names(),
-            "adapters": [detection.to_dict() for detection in detect_all(context)],
+            "adapters": detected_harnesses,
             "runtime_detector_registry": _runtime_detector_registry_payload(config),
         }
     if getattr(args, "perf", False):
@@ -356,7 +369,8 @@ def _run_guard_doctor_command(
     }
     payload["trust"] = build_trust_doctor_payload(store)
     payload["supply_chain"] = build_local_supply_chain_posture(store, config, now=_now())
-    payload["aibom"] = build_aibom_status_payload(store, context, generated_at=_now())
+    with nullcontext() if args.harness else without_command_probes():
+        payload["aibom"] = build_aibom_status_payload(store, context, generated_at=_now())
     from ..protection_posture import protection_status_fields
 
     payload.update(protection_status_fields(posture=config.protection_posture, mode=config.mode))

plugin_scanner-3.7.4/src/codex_plugin_scanner/guard/cli/doctor_readiness.py

@@ -0,0 +1,70 @@
+"""Conservative readiness copy for doctor's passive harness diagnostics."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import cast
+
+
+def _command_probe_results(probe: object) -> tuple[Mapping[str, object], ...]:
+    if not isinstance(probe, Mapping):
+        return ()
+    # Hermes/OpenClaw use command; OpenCode uses paths/config. Do not crawl
+    # arbitrary configuration or turn other adapter metadata into probe results.
+    typed_probe = cast(Mapping[str, object], probe)
+    nested = tuple(
+        cast(Mapping[str, object], typed_probe[key])
+        for key in ("command", "paths", "config")
+        if isinstance(typed_probe.get(key), Mapping)
+    )
+    return (typed_probe, *nested)
+
+
+def doctor_runtime_readiness(diagnostics: Mapping[str, object]) -> dict[str, str]:
+    """Do not promote registration, manifest trust or a CLI probe to evaluation proof.
+
+    The current doctor probes do not verify an authenticated Guard decision in
+    the loaded harness session. Until that proof has its own contract, this
+    projection deliberately cannot return a passing readiness result.
+    """
+
+    state = "unknown"
+    reason = "hook_evaluation_unverified"
+    detail = (
+        "Doctor has not verified an authenticated Guard decision from this harness. "
+        "Registration and CLI checks do not prove runtime readiness."
+    )
+    if diagnostics.get("setup_status") == "broken":
+        state = "fail"
+        reason = "guard_setup_broken"
+        detail = (
+            "Guard registration is marked broken. Preserve this report and inspect the warnings "
+            "before changing the installation. The loaded session's evaluation remains unverified."
+        )
+    elif diagnostics.get("setup_status") in ("partial", "not_found"):
+        reason = "hook_registration_unconfirmed"
+        detail = (
+            "Guard registration is incomplete or missing. Doctor has not verified an authenticated "
+            "Guard decision from this harness."
+        )
+    else:
+        probes = _command_probe_results(diagnostics.get("runtime_probe"))
+        if any(probe.get("timed_out") is True for probe in probes):
+            reason = "harness_probe_timed_out"
+            detail = (
+                "The harness diagnostic check timed out. Inspect the probe and daemon diagnostics; "
+                "no authenticated Guard decision was verified."
+            )
+        elif any(probe.get("ok") is False for probe in probes):
+            reason = "harness_probe_failed"
+            detail = (
+                "The harness diagnostic check failed. Inspect the probe and daemon diagnostics; "
+                "no authenticated Guard decision was verified."
+            )
+        elif any(probe.get("skipped") is True for probe in probes):
+            reason = "harness_probe_not_run"
+            detail = (
+                "Global doctor checked registration without running the harness CLI probe. "
+                "No authenticated Guard decision was verified."
+            )
+    return {"state": state, "reason_code": reason, "detail": detail}

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/src/codex_plugin_scanner/guard/cli/render.py

@@ -12,7 +12,9 @@ from typing import TYPE_CHECKING, TextIO, TypeAlias
 
 from ..redaction import redact_text
 from ..value_coercion import coerce_int as _coerce_int
+from .doctor_readiness import doctor_runtime_readiness
 from .protect_output import _protect_harness_message_for_render, _restore_ephemeral_signed_approval_output
+from .render_doctor_readiness import build_doctor_harness_table, readiness_text
 from .render_uninstall import render_self_uninstall
 
 try:
@@ -832,7 +834,9 @@ def _render_doctor(console: Console, payload: dict[str, object]) -> None:
     elif "adapters" in payload:
         tables = _coerce_string_list(payload.get("tables"))
         name, protection_off = _protection_status_copy(payload, "protected")
-        protection_line = f"[bold red]protection: {name} (off)[/bold red]" if protection_off else f"protection: {name}"
+        protection_line = (
+            f"[bold red]protection mode: {name} (off)[/bold red]" if protection_off else f"protection mode: {name}"
+        )
         console.print(
             Panel.fit(
                 f"[bold]HOL Guard doctor[/bold]\n{protection_line}\n{len(tables)} local tables checked",
@@ -840,7 +844,7 @@ def _render_doctor(console: Console, payload: dict[str, object]) -> None:
             )
         )
         adapters = _coerce_dict_list(payload.get("adapters"))
-        console.print(_build_harness_table(adapters))
+        console.print(build_doctor_harness_table(adapters))
     elif "harnesses" in payload and all("install_aliases" in h for h in _coerce_dict_list(payload.get("harnesses"))):
         contracts = _coerce_dict_list(payload.get("harnesses"))
         table = Table(title="HOL Guard supported harnesses", box=box.SIMPLE_HEAD, show_lines=False)
@@ -867,6 +871,10 @@ def _render_doctor(console: Console, payload: dict[str, object]) -> None:
         summary = Table.grid(padding=(0, 1))
         summary.add_row("Harness", f"[bold]{payload.get('harness', 'unknown')}[/bold]")
         summary.add_row("Installed", _bool_label(bool(payload.get("installed"))))
+        summary.add_row("Registration", str(payload.get("setup_status") or "unknown"))
+        readiness = doctor_runtime_readiness(payload)
+        summary.add_row("Runtime readiness", readiness_text(readiness))
+        summary.add_row("Evidence", Text(readiness["detail"]))
         summary.add_row("Command", _bool_label(bool(payload.get("command_available"))))
         summary.add_row("Artifacts", str(len(_coerce_dict_list(payload.get("artifacts")))))
         registry = payload.get("runtime_detector_registry")
@@ -891,7 +899,7 @@ def _render_doctor(console: Console, payload: dict[str, object]) -> None:
         name, protection_off = _protection_status_copy(payload, "")
         if name:
             value = f"[bold red]{name} (off)[/bold red]" if protection_off else name
-            summary.add_row("Protection", value)
+            summary.add_row("Protection mode", value)
         console.print(Panel(summary, title="Guard doctor", border_style="cyan"))
         if warnings:
             warning_text = "\n".join(
@@ -2753,7 +2761,8 @@ def _build_approval_table(items: list[dict[str, object]], *, title: str | None)
 def _build_runtime_probe_panel(runtime_probe: dict[str, object]) -> Panel:
     body = Table.grid(padding=(0, 1))
     body.add_row("Command", _command_text(runtime_probe.get("command")))
-    body.add_row("Succeeded", _bool_label(bool(runtime_probe.get("ok"))))
+    body.add_row("Check succeeded", _bool_label(bool(runtime_probe.get("ok"))))
+    body.add_row("Scope", "Passive check; no Guard evaluation verified")
     if runtime_probe.get("return_code") is not None:
         body.add_row("Return code", str(runtime_probe.get("return_code")))
     if runtime_probe.get("reported_artifacts") is not None:
@@ -2764,7 +2773,7 @@ def _build_runtime_probe_panel(runtime_probe: dict[str, object]) -> Panel:
         stdout = _clean_terminal_output(str(runtime_probe.get("stdout")))
         preview = "\n".join(stdout.splitlines()[:6])
         body.add_row("stdout", preview)
-    return Panel(body, title="Runtime probe", border_style="magenta")
+    return Panel(body, title="Passive probe", border_style="magenta")
 
 
 def _build_cloud_summary_panel(payload: dict[str, object]) -> Panel:

plugin_scanner-3.7.4/src/codex_plugin_scanner/guard/cli/render_doctor_readiness.py

@@ -0,0 +1,64 @@
+"""Doctor readiness rendering, separate from general harness detection output."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import TYPE_CHECKING
+
+from .doctor_readiness import doctor_runtime_readiness
+
+if TYPE_CHECKING:
+    from rich.table import Table
+    from rich.text import Text
+
+
+def readiness_text(readiness: Mapping[str, str]) -> Text:
+    from rich.text import Text
+
+    if readiness["state"] == "fail":
+        return Text("Setup broken", style="red")
+    return Text("Unverified", style="yellow")
+
+
+def build_doctor_harness_table(detections: list[dict[str, object]]) -> Table:
+    from rich import box
+    from rich.table import Table
+    from rich.text import Text
+
+    table = Table(box=box.SIMPLE_HEAVY, show_header=True)
+    table.add_column("Harness", style="bold")
+    table.add_column("Detection")
+    table.add_column("Registration")
+    table.add_column("Runtime readiness")
+    table.add_column("Warnings", justify="right")
+    registration_labels = {"active": "Active", "broken": "Broken", "partial": "Partial", "not_found": "Not found"}
+    reason_labels = {
+        "guard_setup_broken": "Check setup warnings",
+        "hook_registration_unconfirmed": "Registration incomplete",
+        "harness_probe_failed": "CLI check failed",
+        "harness_probe_timed_out": "CLI check timed out",
+        "harness_probe_not_run": "CLI check not run",
+        "hook_evaluation_unverified": "No Guard decision verified",
+    }
+    for detection in detections:
+        readiness = doctor_runtime_readiness(detection)
+        reason_code = readiness["reason_code"]
+        # Global JSON keeps the classified result; it omits raw CLI output.
+        projected = detection.get("runtime_readiness")
+        if readiness["state"] == "unknown" and isinstance(projected, Mapping) and projected.get("state") == "unknown":
+            reason = projected.get("reason_code")
+            if isinstance(reason, str) and reason in reason_labels:
+                reason_code = reason
+        value = readiness_text(readiness)
+        label = reason_labels.get(reason_code)
+        if label:
+            value.append(f"\n{label}")
+        warnings = detection.get("warnings")
+        table.add_row(
+            Text(str(detection.get("harness", "unknown"))),
+            "Found" if detection.get("installed") else "Not found",
+            registration_labels.get(str(detection.get("setup_status")), "Not checked"),
+            value,
+            str(len(warnings) if isinstance(warnings, list) else 0),
+        )
+    return table

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -133,6 +133,7 @@ _PYPI_RESPONSE_LIMIT_BYTES = 8 * 1024 * 1024
 _PYPI_READ_CHUNK_BYTES = 64 * 1024
 _PACKAGE_SHIM_REFRESH_TIMEOUT_SECONDS = 30.0
 _last_pypi_payload: dict[str, object] | None = None
+_last_pypi_stable_version: str | None = None
 _version_network_policy: ContextVar[ManagedNetworkPolicy | None] = ContextVar(
     "guard_update_version_network_policy",
     default=None,
@@ -1339,7 +1340,7 @@ def _version_check_payload(
 
 
 def _latest_version_from_pypi() -> str | None:
-    global _last_pypi_payload
+    global _last_pypi_payload, _last_pypi_stable_version
     request = urllib.request.Request(_PYPI_JSON_URL, headers={"Accept": "application/json"})
     deadline = time.monotonic() + _PYPI_TIMEOUT_SECONDS
     try:
@@ -1350,7 +1351,7 @@ def _latest_version_from_pypi() -> str | None:
         ) as response:
             raw_payload = _read_bounded_pypi_response(response, deadline=deadline)
             if len(raw_payload) > _PYPI_RESPONSE_LIMIT_BYTES:
-                return None
+                return _cached_pypi_latest_version()
             payload = json.loads(raw_payload.decode("utf-8"))
     except (
         ManagedNetworkError,
@@ -1361,15 +1362,48 @@ def _latest_version_from_pypi() -> str | None:
         json.JSONDecodeError,
         UnicodeDecodeError,
     ):
-        return None
+        return _cached_pypi_latest_version()
+    version = _stable_version_from_pypi_payload(payload)
+    if newest_pypi_version(payload, include_stable=True, include_alpha=True) is not None:
+        _last_pypi_payload = payload
+    if version is not None:
+        _last_pypi_stable_version = version
+    return version if version is not None else _cached_pypi_latest_version()
+
+
+def _stable_version_from_pypi_payload(payload: object) -> str | None:
+    """Return the newest stable release in a PyPI payload, or ``None``.
+
+    ``info.version`` can name a pre-release when the newest PyPI upload is an
+    alpha, so stable-channel consumers must reject pre-releases there and fall
+    back to scanning the ``releases`` map.
+    """
+
     if not isinstance(payload, dict):
         return None
-    _last_pypi_payload = payload
     info = payload.get("info")
-    if not isinstance(info, dict):
-        return None
-    version = info.get("version")
-    return version if isinstance(version, str) and version.strip() else None
+    if isinstance(info, dict):
+        version = info.get("version")
+        if isinstance(version, str) and version.strip():
+            try:
+                if not Version(version.strip()).is_prerelease:
+                    return version.strip()
+            except InvalidVersion:
+                pass
+    return newest_pypi_version(payload, include_stable=True, include_alpha=False)
+
+
+def _cached_pypi_latest_version() -> str | None:
+    """Return the last observed stable PyPI release when a fresh lookup fails.
+
+    A transient PyPI outage must not flip ``update_available`` back to
+    unavailable between polls; the last good stable version keeps the stable
+    channel as consistent as the alpha channel, which already reads the cached
+    payload. Tracking the version separately means an alpha-only response
+    cannot displace the stable fallback.
+    """
+
+    return _last_pypi_stable_version
 
 
 def _latest_alpha_version_from_pypi(current_version: str) -> str | None:

{plugin_scanner-3.7.3 → plugin_scanner-3.7.4}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -31473,7 +31473,7 @@ function ApprovalCenterLayout(props) {
     onUpdateGuard,
     onReinstallGuard,
     onSetUpdateChannel
-  } = useGuardUpdate({ onReconnected: props.onGuardReconnected, enabled: props.enableUpdateStatus });
+  } = useGuardUpdate({ onReconnected: props.onGuardReconnected });
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "min-h-screen bg-white text-brand-dark", children: [
     /* @__PURE__ */ jsxRuntimeExports.jsx(
       ShellNavigation,
@@ -32454,7 +32454,6 @@ function App() {
         onRetry: handleRetry,
         onRepair: handleRepair,
         onGuardReconnected: handleRetry,
-        enableUpdateStatus: view !== "inbox",
         onClearEvidence: handleClearEvidence,
         fleetContent: runtime.kind === "ready" ? /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx(LazyFallback, {}), children: /* @__PURE__ */ jsxRuntimeExports.jsx(
           FleetWorkspace,

plugin_scanner-3.7.4/src/codex_plugin_scanner/version.py

@@ -0,0 +1,3 @@
+"""Single source of truth for tool version."""
+
+__version__ = "3.7.4"  # x-release-please-version