plugin-scanner 2.0.1038__tar.gz → 2.0.1040__tar.gz

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1038
+Version: 2.0.1040
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/dashboard/src/guard-api.ts

@@ -1113,6 +1113,48 @@ export async function fetchQueueSummary(input: { activeRequestId?: string } = {}
   return normalizeQueueSummary(snapshot.queue_summary, snapshot.pending_count);
 }
 
+export type GuardReadStatePayload = { ids: string[] };
+
+export async function fetchReadState(): Promise<GuardReadStatePayload> {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson<GuardReadStatePayload>("/v1/read-state");
+}
+
+export async function postReadStateMarkRead(requestId: string): Promise<GuardReadStatePayload> {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson<GuardReadStatePayload>("/v1/read-state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...guardAuthHeaders() },
+    body: JSON.stringify({ action: "mark_read", request_id: requestId }),
+  });
+}
+
+export async function postReadStateMarkUnread(requestId: string): Promise<GuardReadStatePayload> {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson<GuardReadStatePayload>("/v1/read-state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...guardAuthHeaders() },
+    body: JSON.stringify({ action: "mark_unread", request_id: requestId }),
+  });
+}
+
+export async function postReadStateMarkAllRead(requestIds: string[]): Promise<GuardReadStatePayload> {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson<GuardReadStatePayload>("/v1/read-state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...guardAuthHeaders() },
+    body: JSON.stringify({ action: "mark_all_read", request_ids: requestIds }),
+  });
+}
+
 export function buildDemoRuntimeSnapshot(): GuardRuntimeSnapshot {
   const demoRequests = getDemoRequests();
   const demoReceipts = getDemoReceipts();

plugin_scanner-2.0.1040/dashboard/src/request-read-state.test.ts

@@ -0,0 +1,33 @@
+import {
+  fetchReadState,
+  postReadStateMarkRead,
+  postReadStateMarkUnread,
+  postReadStateMarkAllRead,
+  type GuardReadStatePayload,
+} from "./guard-api";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+async function testReadStateApiExports(): Promise<void> {
+  assert(typeof fetchReadState === "function", "fetchReadState should be a function");
+  assert(typeof postReadStateMarkRead === "function", "postReadStateMarkRead should be a function");
+  assert(typeof postReadStateMarkUnread === "function", "postReadStateMarkUnread should be a function");
+  assert(typeof postReadStateMarkAllRead === "function", "postReadStateMarkAllRead should be a function");
+
+  const mockPayload: GuardReadStatePayload = { ids: ["req-1", "req-2"] };
+  assert(mockPayload.ids.length === 2, "GuardReadStatePayload should have ids array");
+}
+
+async function main(): Promise<void> {
+  await testReadStateApiExports();
+  console.log("✓ request-read-state API exports verified");
+}
+
+void main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

plugin_scanner-2.0.1040/dashboard/src/request-read-state.ts

@@ -0,0 +1,92 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+
+import {
+  fetchReadState,
+  postReadStateMarkAllRead,
+  postReadStateMarkRead,
+  postReadStateMarkUnread,
+} from './guard-api';
+
+export type RequestReadState = {
+  isRead: (requestId: string) => boolean;
+  markRead: (requestId: string) => void;
+  markUnread: (requestId: string) => void;
+  markAllRead: (requestIds: string[]) => void;
+  readCount: number;
+};
+
+const FETCH_DEBOUNCE_MS = 2_000;
+
+export function useRequestReadState(): RequestReadState {
+  const [readIds, setReadIds] = useState<Set<string>>(() => new Set());
+  const [lastFetch, setLastFetch] = useState<number>(0);
+
+  const refresh = useCallback(async () => {
+    try {
+      const response = await fetchReadState();
+      if (response?.ids) {
+        setReadIds(new Set(response.ids));
+      }
+    } catch {
+      // Daemon may be unreachable during SSR or initial mount; stale state is acceptable.
+    }
+    setLastFetch(Date.now());
+  }, []);
+
+  useEffect(() => {
+    if (Date.now() - lastFetch > FETCH_DEBOUNCE_MS) {
+      void refresh();
+    }
+  }, [lastFetch, refresh]);
+
+  const isRead = useCallback(
+    (requestId: string) => readIds.has(requestId),
+    [readIds],
+  );
+
+  const markRead = useCallback(
+    (requestId: string) => {
+      setReadIds((prev) => {
+        if (prev.has(requestId)) return prev;
+        const next = new Set(prev);
+        next.add(requestId);
+        return next;
+      });
+      void postReadStateMarkRead(requestId).catch(() => {});
+    },
+    [],
+  );
+
+  const markUnread = useCallback(
+    (requestId: string) => {
+      setReadIds((prev) => {
+        if (!prev.has(requestId)) return prev;
+        const next = new Set(prev);
+        next.delete(requestId);
+        return next;
+      });
+      void postReadStateMarkUnread(requestId).catch(() => {});
+    },
+    [],
+  );
+
+  const markAllRead = useCallback(
+    (requestIds: string[]) => {
+      if (requestIds.length === 0) return;
+      setReadIds((prev) => {
+        const next = new Set(prev);
+        for (const id of requestIds) next.add(id);
+        return next;
+      });
+      void postReadStateMarkAllRead(requestIds).catch(() => {});
+    },
+    [],
+  );
+
+  return useMemo(
+    () => ({ isRead, markRead, markUnread, markAllRead, readCount: readIds.size }),
+    [isRead, markRead, markUnread, markAllRead, readIds.size],
+  );
+}
+
+export const REQUEST_READ_STATE_LIMIT = 50000;

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1038"
+version = "2.0.1040"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1038"
+version = "2.0.1040"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -1635,6 +1635,9 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 return
             self._write_json(diff)
             return
+        if parsed.path == "/v1/read-state":
+            self._write_json({"ids": store.get_read_state()})
+            return
         if parsed.path in _ROOT_STATIC_FILES:
             self._write_static_asset(parsed.path.removeprefix("/"))
             return
@@ -1667,6 +1670,14 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 deleted = clear_evidence(conn)
             self._write_json({"deleted": deleted})
             return
+        if parsed.path == "/v1/read-state":
+            body = self._read_delete_body()
+            if body and isinstance(body.get("request_id"), str):
+                store.mark_request_unread(body["request_id"])
+            elif body and body.get("clear_all"):
+                store.clear_read_state()
+            self._write_json({"ok": True})
+            return
         self._write_json({"error": "not_found"}, status=404)
 
     def do_POST(self) -> None:
@@ -1774,6 +1785,9 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         if parsed.path == "/v1/requests/remote-once":
             self._handle_headless_remote_once(payload)
             return
+        if parsed.path == "/v1/read-state":
+            self._handle_read_state_update(payload)
+            return
         if parsed.path == "/v1/settings":
             self._handle_settings_update(payload)
             return
@@ -3682,6 +3696,46 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             return
         self._write_json(result)
 
+    def _handle_read_state_update(self, payload: dict[str, object]) -> None:
+        store = self.server.store  # type: ignore[attr-defined]
+        action = str(payload.get("action") or "mark_read")
+        if action == "mark_all_read":
+            request_ids = payload.get("request_ids")
+            if not isinstance(request_ids, list):
+                self._write_json({"error": "invalid_request_ids"}, status=400)
+                return
+            store.mark_requests_read([str(rid) for rid in request_ids if isinstance(rid, str)])
+            self._write_json({"ok": True, "ids": store.get_read_state()})
+            return
+        if action == "mark_unread":
+            request_id = payload.get("request_id")
+            if not isinstance(request_id, str):
+                self._write_json({"error": "invalid_request_id"}, status=400)
+                return
+            store.mark_request_unread(request_id)
+            self._write_json({"ok": True, "ids": store.get_read_state()})
+            return
+        request_id = payload.get("request_id")
+        if isinstance(request_id, str):
+            store.mark_requests_read([request_id])
+            self._write_json({"ok": True, "ids": store.get_read_state()})
+            return
+        self._write_json({"error": "invalid_action"}, status=400)
+
+    def _read_delete_body(self) -> dict[str, object] | None:
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            return None
+        if length <= 0 or length > self._MAX_BODY_BYTES:
+            return None
+        raw = self.rfile.read(length)
+        try:
+            parsed = json.loads(raw.decode("utf-8"))
+        except (json.JSONDecodeError, UnicodeDecodeError):
+            return None
+        return parsed if isinstance(parsed, dict) else None
+
     def _handle_settings_update(self, payload: dict[str, object]) -> None:
         settings = payload.get("settings")
         if not isinstance(settings, dict):
@@ -4585,6 +4639,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             "/v1/requests/remote-once",
             "/v1/settings/import",
             "/v1/settings/reset",
+            "/v1/read-state",
             "/v1/policy/clear",
             "/v1/approval-gate/cooldown/revoke",
             "/v1/approval-gate/totp/enroll",
@@ -4868,6 +4923,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             "/v1/settings/export",
             "/v1/settings/import",
             "/v1/settings/reset",
+            "/v1/read-state",
             "/v1/update",
             "/v1/update/status",
         }:

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -15130,9 +15130,9 @@ function guardParams() {
 function guardParam(name) {
   return guardParams().get(name);
 }
-function readBrowserStorage(getStorage2, name) {
+function readBrowserStorage(getStorage, name) {
   try {
-    return getStorage2().getItem(name);
+    return getStorage().getItem(name);
   } catch {
     return null;
   }
@@ -15140,9 +15140,9 @@ function readBrowserStorage(getStorage2, name) {
 function readGuardStorage(name) {
   return readBrowserStorage(() => window.sessionStorage, name) ?? readBrowserStorage(() => window.localStorage, name);
 }
-function saveBrowserStorage(getStorage2, name, value) {
+function saveBrowserStorage(getStorage, name, value) {
   try {
-    getStorage2().setItem(name, value);
+    getStorage().setItem(name, value);
   } catch {
   }
 }
@@ -15866,6 +15866,42 @@ async function fetchRuntimeSnapshot(input = {}) {
   const snapshot = await readJson(path);
   return normalizeRuntimeSnapshot(snapshot);
 }
+async function fetchReadState() {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson("/v1/read-state");
+}
+async function postReadStateMarkRead(requestId) {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson("/v1/read-state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...guardAuthHeaders() },
+    body: JSON.stringify({ action: "mark_read", request_id: requestId })
+  });
+}
+async function postReadStateMarkUnread(requestId) {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson("/v1/read-state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...guardAuthHeaders() },
+    body: JSON.stringify({ action: "mark_unread", request_id: requestId })
+  });
+}
+async function postReadStateMarkAllRead(requestIds) {
+  if (isGuardDemoMode()) {
+    return { ids: [] };
+  }
+  return readJson("/v1/read-state", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...guardAuthHeaders() },
+    body: JSON.stringify({ action: "mark_all_read", request_ids: requestIds })
+  });
+}
 function buildDemoRuntimeSnapshot() {
   const demoRequests2 = getDemoRequests();
   const demoReceipts = getDemoReceipts();
@@ -23257,67 +23293,74 @@ function ConsolidatedEvidenceAlert({ items }) {
     /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-sm text-brand-dark", children: current.content })
   ] });
 }
-const REQUEST_READ_STATE_KEY = "hol-guard:read-request-ids";
-const REQUEST_READ_STATE_LIMIT = 2e3;
-function safeReadStorage(storage) {
-  if (!storage) return [];
-  try {
-    const raw = storage.getItem(REQUEST_READ_STATE_KEY);
-    if (!raw) return [];
-    const parsed = JSON.parse(raw);
-    if (!parsed || !Array.isArray(parsed.ids)) return [];
-    return parsed.ids.filter((id) => typeof id === "string");
-  } catch {
-    return [];
-  }
-}
-function safeWriteStorage(storage, ids) {
-  if (!storage) return;
-  try {
-    storage.setItem(REQUEST_READ_STATE_KEY, JSON.stringify({ ids }));
-  } catch {
-  }
-}
-function addReadIds(current, requestIds, limit = REQUEST_READ_STATE_LIMIT) {
-  const uniqueNew = Array.from(new Set(requestIds));
-  const toAdd = new Set(uniqueNew);
-  const next = current.filter((id) => !toAdd.has(id));
-  next.unshift(...uniqueNew);
-  if (next.length > limit) {
-    next.length = limit;
-  }
-  return next;
-}
-function removeReadId(current, requestId) {
-  return current.filter((id) => id !== requestId);
-}
-function getStorage() {
-  return typeof window !== "undefined" ? window.localStorage : null;
-}
+const FETCH_DEBOUNCE_MS = 2e3;
 function useRequestReadState() {
-  const [readIds, setReadIds] = reactExports.useState(() => safeReadStorage(getStorage()));
-  reactExports.useEffect(() => {
-    setReadIds(safeReadStorage(getStorage()));
+  const [readIds, setReadIds] = reactExports.useState(() => /* @__PURE__ */ new Set());
+  const [lastFetch, setLastFetch] = reactExports.useState(0);
+  const refresh = reactExports.useCallback(async () => {
+    try {
+      const response = await fetchReadState();
+      if (response?.ids) {
+        setReadIds(new Set(response.ids));
+      }
+    } catch {
+    }
+    setLastFetch(Date.now());
   }, []);
   reactExports.useEffect(() => {
-    safeWriteStorage(getStorage(), readIds);
-  }, [readIds]);
-  const isRead = reactExports.useCallback((requestId) => readIds.includes(requestId), [readIds]);
-  const markRead = reactExports.useCallback((requestId) => {
-    setReadIds((current) => addReadIds(current, [requestId]));
-  }, []);
-  const markUnread = reactExports.useCallback((requestId) => {
-    setReadIds((current) => removeReadId(current, requestId));
-  }, []);
-  const markAllRead = reactExports.useCallback((requestIds) => {
-    if (requestIds.length === 0) return;
-    setReadIds((current) => addReadIds(current, requestIds));
-  }, []);
+    if (Date.now() - lastFetch > FETCH_DEBOUNCE_MS) {
+      void refresh();
+    }
+  }, [lastFetch, refresh]);
+  const isRead = reactExports.useCallback(
+    (requestId) => readIds.has(requestId),
+    [readIds]
+  );
+  const markRead = reactExports.useCallback(
+    (requestId) => {
+      setReadIds((prev) => {
+        if (prev.has(requestId)) return prev;
+        const next = new Set(prev);
+        next.add(requestId);
+        return next;
+      });
+      void postReadStateMarkRead(requestId).catch(() => {
+      });
+    },
+    []
+  );
+  const markUnread = reactExports.useCallback(
+    (requestId) => {
+      setReadIds((prev) => {
+        if (!prev.has(requestId)) return prev;
+        const next = new Set(prev);
+        next.delete(requestId);
+        return next;
+      });
+      void postReadStateMarkUnread(requestId).catch(() => {
+      });
+    },
+    []
+  );
+  const markAllRead = reactExports.useCallback(
+    (requestIds) => {
+      if (requestIds.length === 0) return;
+      setReadIds((prev) => {
+        const next = new Set(prev);
+        for (const id of requestIds) next.add(id);
+        return next;
+      });
+      void postReadStateMarkAllRead(requestIds).catch(() => {
+      });
+    },
+    []
+  );
   return reactExports.useMemo(
-    () => ({ isRead, markRead, markUnread, markAllRead, readCount: readIds.length }),
-    [isRead, markRead, markUnread, markAllRead, readIds.length]
+    () => ({ isRead, markRead, markUnread, markAllRead, readCount: readIds.size }),
+    [isRead, markRead, markUnread, markAllRead, readIds.size]
   );
 }
+const REQUEST_READ_STATE_LIMIT = 5e4;
 function approvalGateCooldownLabel(seconds) {
   if (seconds === 0) return "Every approval";
   if (seconds === 900) return "15 minutes";

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/src/codex_plugin_scanner/guard/runtime/command_queue.py

@@ -424,19 +424,6 @@ def _maybe_auto_update(store: GuardStore, context: HarnessContext) -> None:
     maybe_auto_update(store, context)
 
 
-def _with_live_sync_identity(
-    store: GuardStore,
-    auth_context: dict[str, object],
-) -> dict[str, object]:
-    machine_id, workspace_id = _oauth_metadata(store)
-    return {
-        **auth_context,
-        "machine_id": machine_id,
-        "workspace_id": workspace_id,
-        "machine_installation_id": store.get_or_create_installation_id(),
-    }
-
-
 def _resolve_command_queue_auth_context(
     store: GuardStore,
     *,
@@ -455,22 +442,6 @@ def _resolve_command_queue_auth_context(
         return _resolve_guard_sync_auth_context(store)
 
 
-def _sync_live_requests_best_effort(store: GuardStore, auth_context: dict[str, object]) -> None:
-    """Sync local approval requests to Cloud live request table.
-
-    Best-effort: failures are logged but do not block the command queue lease.
-    The dedicated endpoint uses cursor-based pagination to ensure all requests
-    are synced regardless of backlog size, eliminating the stale-row
-    accumulation bug caused by the capped snapshot approach.
-    """
-    try:
-        from .live_request_sync import sync_live_requests_once
-
-        sync_live_requests_once(store, _with_live_sync_identity(store, auth_context))
-    except Exception as exc:
-        _LOGGER.debug("Guard live request sync skipped: %s", _redacted_error(exc))
-
-
 def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[str, object]:
     auth_context = _resolve_command_queue_auth_context(store)
     state = _load_state(store)
@@ -483,7 +454,6 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
         }
     )
     _save_state(store, state)
-    _sync_live_requests_best_effort(store, auth_context)
     if _retry_pending_result(store, auth_context, state):
         return command_queue_status(store)
     lease_response = _json_request(

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/src/codex_plugin_scanner/guard/runtime/live_request_sync.py

@@ -1737,8 +1737,21 @@ def stop_cloud_sync_sync_worker(
     if worker is None:
         return None
     worker.stop_event.set()
-    worker.thread.join(timeout=30.0)
-    return worker if worker.thread.is_alive() else None
+    worker.thread.join()
+    return None
+
+
+def _with_live_request_sync_identity(
+    store: GuardStore,
+    auth_context: dict[str, object],
+) -> dict[str, object]:
+    oauth = guard_review_oauth_metadata(store)
+    return {
+        **auth_context,
+        "machine_id": oauth.machine_id,
+        "workspace_id": oauth.workspace_id,
+        "machine_installation_id": oauth.installation_id,
+    }
 
 
 def _resolve_live_request_sync_auth_context(store: GuardStore) -> dict[str, Any]:
@@ -1776,8 +1789,16 @@ def _cloud_sync_sync_loop(
     while not stop_event.is_set():
         try:
             auth_context = _resolve_live_request_sync_auth_context(store)
-            result = cloud_sync_sync_live_requests_once(store, auth_context)
-            if result.get("synced", 0) > 0:
+            live_result = sync_live_requests_once(
+                store,
+                _with_live_request_sync_identity(store, auth_context),
+            )
+            outbox_result = cloud_sync_sync_live_requests_once(store, auth_context)
+            live_synced = live_result.get("synced")
+            outbox_synced = outbox_result.get("synced")
+            if (isinstance(live_synced, int) and live_synced > 0) or (
+                isinstance(outbox_synced, int) and outbox_synced > 0
+            ):
                 error_streak = 0
                 continue
         except GuardSyncAuthorizationExpiredError as exc:

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/src/codex_plugin_scanner/guard/store.py

@@ -19,6 +19,7 @@ from .store_inventory import StoreInventoryMixin
 from .store_oauth import StoreOAuthConnectMixin
 from .store_policy import StorePolicyMixin
 from .store_policy_integrity_runtime import StorePolicyIntegrityAdminMixin
+from .store_read_state import StoreReadStateMixin
 from .store_receipts import StoreReceiptsRuntimeMixin
 from .store_secret_policy_integrity import (
     StoreSecretPolicyIntegrityMixin,
@@ -32,14 +33,15 @@ class GuardStore(
     StoreConnectionSchemaMixin,
     StoreInventoryMixin,
     StorePolicyMixin,
-    StoreReceiptsRuntimeMixin,
-    StoreApprovalsMixin,
     StorePolicyIntegrityAdminMixin,
     StoreCloudEventsMixin,
+    StoreReceiptsRuntimeMixin,
+    StoreApprovalsMixin,
     StoreEventReceiptsMixin,
     StoreOAuthConnectMixin,
     StoreSessionsMixin,
     StoreEvidenceMixin,
+    StoreReadStateMixin,
 ):
     """Local SQLite store for Guard state."""
 

{plugin_scanner-2.0.1038 → plugin_scanner-2.0.1040}/src/codex_plugin_scanner/guard/store_connection_schema.py

@@ -446,6 +446,16 @@ class StoreConnectionSchemaMixin:
               primary key (surface, open_key)
             )
             """,
+            """
+            create table if not exists guard_request_read_state (
+              request_id text primary key,
+              read_at text not null
+            )
+            """,
+            """
+            create index if not exists idx_guard_request_read_state_read_at
+            on guard_request_read_state (read_at desc)
+            """,
             resume_schema_statement(),
             connect_state_schema_statement(),
             connect_request_schema_statement(),