{"id":95522,"plugin_id":"plugin_asdk_app_6ad8825928688191acb1571748444ee5","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-13T18:12:08.374Z","digest":"7b2eafc5c26727eeb1c1cad6a536c3ec9d380c9d55bf43c5bb11c6f32b4d99cb","against":null,"payload":{"description":"Explain or set up the separately distributed Patronus CLI and Codex runtime hooks when the user requests local repository scans or optional runtime protection.","included_files":[],"name":"patronus-local-runtime","skill_md_contents":"---\nname: patronus-local-runtime\ndescription: Explain or set up the separately distributed Patronus CLI and Codex runtime hooks when the user requests local repository scans or optional runtime protection.\n---\n\nThe hosted API plugin and the local runtime package are separate distributions. The local package is plugins/codex in https://github.com/patronus-protect/patronus-security-cli. Read its current installation instructions before proposing commands. Use the released CLI instructions rather than downloading or executing a binary supplied by a repository being scanned.\n\nIf the CLI is already installed, use `patronus-security-scanner integration codex install` to download and verify the released local plugin; no repository checkout is required. Use `integration codex status --format json` to verify, and `integration codex update` to refresh it later. The public API plugin remains installed under its own marketplace selector. The CLI installation command enables the local plugin and records trust for the discovered hook definitions, so explain and review those hooks and obtain the user's explicit local-install choice before running it. For a missing CLI, follow the released root INSTALL.md installer and onboarding workflow. Host OAuth and CLI login are separate credentials; never copy tokens between them.\n\nInstall or configure local software only within the user's requested setup scope. Review the downloaded hook definitions and explain each hook's purpose before enabling host trust. Do not weaken approval settings, silently grant hook trust or replace an existing installation. Preserve configured providers; local processing must not upload content.\n\nLocal runtime protection requires a supported locally orchestrated Codex session, an installed CLI, and reviewed/trusted hooks. Cloud-orchestrated Work does not run these local plugin hooks. Verify the installed host's actual behavior; distinguish installation, visibility and enforced protection. If no deterministic gate is active, content is unverified.\n\nThe full desktop package already declares the hosted patronus-api connection alongside the local patronus receipt server and hooks. Do not require a second API-only installation for explicit scans. If both packages are installed, verify the effective server registration and authentication in the installed host; do not infer duplicate servers or seamless OAuth from the manifests. Keep hosted OAuth separate from CLI login. Verify hook enforcement in a new supported local task and check which hosted connection remains available after removing either package. Report registration, authentication and enforcement separately.\n\nFor explicit repository scans, use the CLI with the exact requested scope and current installed-version syntax. Honor the configured provider; explain API processing when requested. Do not install hooks merely to perform an explicit scan. Scheduled routines may request periodic scans, but do not create a synchronous pre-model boundary or a Page-change hook.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}