plugin-scanner 2.0.167__tar.gz → 2.0.169__tar.gz

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.167
+Version: 2.0.169
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/approval-center-layout.test.ts

@@ -5,6 +5,8 @@ import {
   displayArtifactName,
   EMPTY_QUEUE_TITLE,
   STALE_REQUEST_COPY,
+  buildRecommendation,
+  scopeLabel,
 } from "./approval-center-utils";
 import type { GuardActionEnvelope, GuardApprovalRequest } from "./guard-types";
 
@@ -208,3 +210,18 @@ assert(
   STALE_REQUEST_COPY.toLowerCase().includes("already decided"),
   'C6: Stale request copy contains "already decided" — not approve/block buttons'
 );
+
+assert(
+  scopeLabel("artifact") === "This retry only",
+  "C7: Artifact scope copy makes one-retry behavior clear"
+);
+
+assert(
+  scopeLabel("workspace") === "Same action in this project",
+  "C8: Workspace scope copy makes same-action project behavior clear"
+);
+
+assert(
+  buildRecommendation(BASE_REQUEST).includes("Project approval remembers this same action"),
+  "C9: Recommendation explains project approval does not trust new sensitive actions"
+);

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/approval-center-layout.tsx

@@ -59,6 +59,7 @@ import {
 } from "./approval-center-review-cards";
 import {
   buildProgressCopy,
+  buildNextUpChipText,
   sortQueue,
   searchQueue,
   groupDuplicates,
@@ -130,8 +131,16 @@ type LayoutProps = {
 };
 
 const scopeOptions: Array<{ value: DecisionScope; label: string; description: string }> = [
-  { value: "artifact", label: "This exact action", description: "Ask again if the command or tool details change." },
-  { value: "workspace", label: "This project folder", description: "Remember this choice only for this project." },
+  {
+    value: "artifact",
+    label: "This retry only",
+    description: "Remember this exact prompt, command, tool, path, or host fingerprint."
+  },
+  {
+    value: "workspace",
+    label: "Same action in this project",
+    description: "Skip the next prompt for this same action here; different sensitive actions still ask."
+  },
   { value: "publisher", label: "This source", description: "Trust future actions from the same source in this app." },
   { value: "harness", label: "This app", description: "Trust matching actions from this app." },
   { value: "global", label: "Every project", description: "Use this choice across this machine." }
@@ -279,15 +288,25 @@ function QueueWorkspace(props: {
   if (props.requests.kind === "error") {
     const approvalUrl =
       props.runtime.kind === "ready" ? props.runtime.snapshot.approval_center_url : null;
+    const handleOpenDaemon = () => {
+      if (approvalUrl !== null) {
+        window.open(approvalUrl, "_blank", "noopener,noreferrer");
+      } else {
+        void handleRepair();
+      }
+    };
     return (
       <div className="space-y-4">
         <Surface tone="danger">
-          <p className="text-sm font-semibold text-brand-purple">Guard connection lost. Check if the daemon is running.</p>
+          <p className="text-sm font-semibold text-brand-purple">Guard daemon not responding — click to reconnect.</p>
           <p className="mt-1 text-sm text-brand-purple/80">{props.requests.message}</p>
           <div className="mt-4 flex flex-wrap gap-3">
+            <ActionButton onClick={handleOpenDaemon}>
+              Repair
+            </ActionButton>
             {props.onRepair !== undefined && (
-              <ActionButton onClick={handleRepair} disabled={repairing}>
-                {repairing ? "Repairing…" : "Repair"}
+              <ActionButton onClick={handleRepair} disabled={repairing} variant="outline">
+                {repairing ? "Repairing…" : "Reconnect"}
               </ActionButton>
             )}
             <code className="inline-flex min-h-10 items-center rounded-lg border border-brand-purple/30 bg-slate-50 px-3 py-2 font-mono text-sm text-brand-purple select-all">hol-guard start</code>
@@ -515,7 +534,7 @@ function QueueBrowser(props: {
             className="min-h-11 w-full rounded-lg border border-slate-200 bg-white px-3 text-sm text-brand-dark placeholder:text-slate-400 transition-colors duration-150 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
           />
         </label>
-        {harnesses.length > 0 && (
+        {harnesses.length >= 2 && (
           <QueueChipFilter
             harnesses={harnesses}
             activeFilter={harnessFilter}
@@ -589,8 +608,8 @@ function QueueCardRow(props: {
       {props.nextUpItem !== null && (
         <div className="border-t border-slate-100 bg-slate-50/60 px-4 py-2">
           <p className="truncate text-[11px] text-muted-foreground">
-            <span className="font-semibold">Next up:</span>{" "}
-            {displayArtifactName(props.nextUpItem)}
+            <span className="font-semibold">Next:</span>{" "}
+            {buildNextUpChipText(props.nextUpItem)}
           </p>
         </div>
       )}
@@ -687,6 +706,7 @@ function DecisionWorkspace(props: {
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
   const [confirmPending, setConfirmPending] = useState<"allow" | "block" | null>(null);
   const [resolvedBanner, setResolvedBanner] = useState<"allow" | "block" | null>(null);
+  const [resolvedState, setResolvedState] = useState<"idle" | "decided" | "loaded">("idle");
   const bannerTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
   const prevRequestIdRef = useRef<string | null>(null);
 
@@ -696,6 +716,7 @@ function DecisionWorkspace(props: {
       prevRequestIdRef.current = props.detail.item.request_id;
       if (isNewItem) {
         setResolvedBanner(null);
+        setResolvedState("loaded");
         if (bannerTimerRef.current !== null) {
           clearTimeout(bannerTimerRef.current);
           bannerTimerRef.current = null;
@@ -731,6 +752,7 @@ function DecisionWorkspace(props: {
           reason,
           workspace: scope === "workspace" ? readyWorkspace : undefined,
         });
+        setResolvedState("decided");
         setResolvedBanner(action);
         bannerTimerRef.current = setTimeout(() => {
           setResolvedBanner(null);
@@ -800,6 +822,16 @@ function DecisionWorkspace(props: {
   if (props.detail.kind === "loading") {
     return (
       <div className="space-y-4">
+        {resolvedState === "decided" && (
+          <div
+            className="flex items-center gap-3 rounded-2xl border border-brand-green/25 bg-brand-green-bg/30 px-4 py-3"
+            role="status"
+            aria-live="polite"
+          >
+            <HiMiniCheckCircle className="h-4 w-4 shrink-0 text-brand-green" aria-hidden="true" />
+            <p className="text-sm font-medium text-brand-green-text">Decided — loading next…</p>
+          </div>
+        )}
         <div className="guard-skeleton h-8 w-48" />
         <div className="guard-skeleton h-40 w-full" />
         <div className="guard-skeleton h-56 w-full" />

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/approval-center-primitives.tsx

@@ -1,4 +1,4 @@
-import type { ChangeEvent, ReactNode } from "react";
+import type { ButtonHTMLAttributes, ChangeEvent, ReactNode } from "react";
 import {
   HiMiniArrowTopRightOnSquare,
   HiMiniCloud,
@@ -92,11 +92,13 @@ export function ShellHeader(props: {
           <button
             type="button"
             onClick={props.onOpenMobileQueue}
-            aria-label="Open queue list"
+            aria-label={`Open queue list — ${props.queuedCount} decisions waiting`}
             className="inline-flex min-h-11 shrink-0 items-center gap-1.5 rounded-full border border-white/25 bg-white/10 px-3 py-2 text-sm font-semibold text-white no-underline transition-colors duration-150 hover:bg-white/15"
           >
             <HiBars3 className="h-4 w-4" aria-hidden="true" />
-            {props.queuedCount > 99 ? "99+" : props.queuedCount}
+            {props.queuedCount > 1
+              ? `${props.queuedCount > 99 ? "99+" : props.queuedCount} decisions waiting`
+              : props.queuedCount}
           </button>
         )}
         {(!props.onOpenMobileQueue || props.view !== "inbox" || props.queuedCount === 0) && (
@@ -294,29 +296,31 @@ export function EmptyState(props: {
   );
 }
 
-export function ActionButton(props: {
+type ActionButtonProps = {
   children: ReactNode;
   onClick?: () => void;
   href?: string;
   variant?: "primary" | "secondary" | "danger" | "outline" | "ghost" | "success";
   disabled?: boolean;
-}) {
-  const className = actionButtonClass(props.variant);
-  if (props.href) {
+} & Omit<ButtonHTMLAttributes<HTMLButtonElement>, "children" | "className" | "onClick" | "type">;
+
+export function ActionButton({ children, href, variant, disabled, onClick, ...buttonProps }: ActionButtonProps) {
+  const className = actionButtonClass(variant);
+  if (href) {
     return (
       <a
-        href={guardAwareHref(props.href)}
-        target={props.href.startsWith("https://") ? "_blank" : undefined}
-        rel={props.href.startsWith("https://") ? "noreferrer" : undefined}
+        href={guardAwareHref(href)}
+        target={href.startsWith("https://") ? "_blank" : undefined}
+        rel={href.startsWith("https://") ? "noreferrer" : undefined}
         className={className}
       >
-        {props.children}
+        {children}
       </a>
     );
   }
   return (
-    <button type="button" className={className} onClick={props.onClick} disabled={props.disabled}>
-      {props.children}
+    <button type="button" className={className} onClick={onClick} disabled={disabled} {...buttonProps}>
+      {children}
     </button>
   );
 }
@@ -541,7 +545,7 @@ export function WelcomeState(props: {
       </div>
       <h2 className="text-2xl font-semibold tracking-tight text-brand-dark sm:text-3xl">{EMPTY_QUEUE_TITLE}</h2>
       <p className="mx-auto mt-4 max-w-lg text-[15px] leading-relaxed text-muted-foreground">
-        Guard is still watching your apps. You'll be notified here if something needs your approval.
+        Guard is still watching your apps.
       </p>
       
       <div className="mt-12 text-left w-full max-w-3xl">

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/approval-center-utils.ts

@@ -131,12 +131,12 @@ export function buildPauseLine(item: GuardApprovalRequest): string {
 
 export function buildRecommendation(item: GuardApprovalRequest): string {
   if (item.changed_fields.length === 1 && item.changed_fields[0] === "first_seen") {
-    return "If this is what you expected, approve the exact action. Use broader trust only when you deliberately want Guard to ask less often.";
+    return "If this is what you expected, approve this retry. Project approval remembers this same action here without trusting new sensitive actions.";
   }
   if (item.policy_action === "block") {
     return "Keep it blocked unless you are sure this action is safe and expected.";
   }
-  return "Approve the smallest choice that matches what you meant to do. Broader trust should be a deliberate second step.";
+  return "Approve the smallest choice that matches what you meant to do. Different commands, prompts, paths, hosts, or tools should ask again.";
 }
 
 export function buildQueueSummary(item: GuardApprovalRequest): string {
@@ -162,9 +162,9 @@ export function buildMemorySummary(
 export function scopeLabel(scope: string): string {
   switch (scope) {
     case "artifact":
-      return "This exact action";
+      return "This retry only";
     case "workspace":
-      return "This project folder";
+      return "Same action in this project";
     case "publisher":
       return "This source in this app";
     case "harness":

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/home-dashboard.tsx

@@ -4,6 +4,7 @@ import {
   HiMiniCheckCircle,
   HiMiniExclamationCircle,
   HiMiniMinusCircle,
+  HiMiniArrowTopRightOnSquare,
 } from "react-icons/hi2";
 import {
   ActionButton,
@@ -50,6 +51,55 @@ function heroBackgroundClass(status: HomeProtectionStatus): string {
   return "bg-[radial-gradient(circle_at_top_left,rgba(85,153,254,0.12),transparent_32%),linear-gradient(135deg,#ffffff_0%,#ffffff_58%,rgba(72,223,123,0.10)_100%)]";
 }
 
+const KNOWN_HARNESSES = [
+  "codex",
+  "claude-code",
+  "opencode",
+  "copilot",
+  "gemini",
+  "cursor",
+  "hermes",
+  "openclaw",
+] as const;
+
+type SetupSuggestionRowProps = {
+  harness: string;
+};
+
+function SetupSuggestionRow(props: SetupSuggestionRowProps) {
+  return (
+    <li className="flex items-center justify-between gap-3 border-b border-slate-200/70 px-4 py-3 last:border-b-0">
+      <p className="text-sm text-brand-dark">
+        Set up <span className="font-medium">{harnessDisplayName(props.harness)}</span> →{" "}
+        <span className="font-mono text-xs text-brand-blue">
+          hol-guard apps connect {props.harness}
+        </span>
+      </p>
+    </li>
+  );
+}
+
+type SetupSuggestionsSectionProps = {
+  configuredHarnesses: string[];
+};
+
+function SetupSuggestionsSection(props: SetupSuggestionsSectionProps) {
+  const unconfigured = KNOWN_HARNESSES.filter(
+    (h) => !props.configuredHarnesses.includes(h)
+  );
+  if (unconfigured.length === 0) return null;
+  return (
+    <section className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm sm:p-6">
+      <SectionLabel>Connect more apps</SectionLabel>
+      <ul className="mt-3 overflow-hidden rounded-[1.25rem] border border-slate-200/70">
+        {unconfigured.slice(0, 4).map((harness) => (
+          <SetupSuggestionRow key={harness} harness={harness} />
+        ))}
+      </ul>
+    </section>
+  );
+}
+
 function ClearHarnessButton(props: {
   harness: string;
   onClearPolicies: (scope: { harness?: string; all?: boolean }) => Promise<void>;
@@ -126,8 +176,6 @@ export function HomeWorkspace(props: {
         cloudState={snapshot.cloud_state}
         connectUrl={snapshot.connect_url}
         fleetUrl={snapshot.fleet_url}
-        activeInstallsCount={activeInstalls.length}
-        latestReceiptsCount={snapshot.latest_receipts.length}
         onOpenInbox={props.onOpenInbox}
         onOpenFleet={props.onOpenFleet}
       />
@@ -145,6 +193,10 @@ export function HomeWorkspace(props: {
         observedHarnesses={observedHarnesses}
       />
 
+      {primaryState.status === "setup_needed" && (
+        <SetupSuggestionsSection configuredHarnesses={observedHarnesses} />
+      )}
+
       {snapshot.latest_receipts.length > 0 && (
         <RecentProtectionSection receipts={snapshot.latest_receipts} />
       )}
@@ -185,8 +237,6 @@ function ProtectionHero(props: {
   cloudState: "local_only" | "paired_waiting" | "paired_active";
   connectUrl: string;
   fleetUrl: string;
-  activeInstallsCount: number;
-  latestReceiptsCount: number;
   onOpenInbox: () => void;
   onOpenFleet: () => void;
 }) {
@@ -211,34 +261,43 @@ function ProtectionHero(props: {
   const showConnectCta =
     props.cloudState === "local_only" && !props.syncConfigured;
 
-  const showTestProtection =
-    props.activeInstallsCount > 0 && props.latestReceiptsCount === 0;
+  const showGuardCloud = props.cloudState !== "local_only";
 
   return (
     <section
       className={`guard-surface-in relative overflow-hidden rounded-[2rem] border border-brand-blue/15 ${heroBg} p-5 shadow-[0_20px_60px_rgba(63,65,116,0.08)] sm:p-6 lg:p-7`}
+      role="region"
+      aria-label="Protection status"
     >
       <div className="pointer-events-none absolute right-10 top-8 h-24 w-24 rounded-full bg-brand-blue/20 blur-3xl" />
       <div className="relative space-y-4">
         <div className="flex flex-wrap items-center gap-2">
           <SectionLabel>Protection status</SectionLabel>
           {statusBadge}
-          {props.cloudState !== "local_only" && <Tag tone="blue">Cloud synced</Tag>}
+          {props.cloudState !== "local_only" && <Tag tone="blue">Cloud backup up to date</Tag>}
         </div>
         <h2 className="text-xl font-semibold tracking-tight text-brand-dark">{props.copy}</h2>
         <div className="flex flex-wrap gap-3">
-          <ActionButton onClick={handlePrimaryCta}>{props.ctaLabel}</ActionButton>
-          {showTestProtection && (
-            <ActionButton href={props.fleetUrl} variant="secondary">
-              Test protection
-            </ActionButton>
-          )}
+          <ActionButton onClick={handlePrimaryCta} data-primary="true" aria-label={props.ctaLabel}>
+            {props.ctaLabel}
+          </ActionButton>
           {showConnectCta && props.status !== "needs_decision" && (
             <ActionButton href={props.connectUrl} variant="secondary">
               Connect this machine
             </ActionButton>
           )}
         </div>
+        {showGuardCloud && (
+          <a
+            href={props.fleetUrl}
+            target="_blank"
+            rel="noreferrer"
+            className="inline-flex items-center gap-1 text-sm font-medium text-brand-blue transition-colors hover:text-brand-blue/70"
+          >
+            Open Guard Cloud
+            <HiMiniArrowTopRightOnSquare className="h-3.5 w-3.5" aria-hidden="true" />
+          </a>
+        )}
       </div>
     </section>
   );

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/queue-state.ts

@@ -1,3 +1,4 @@
+import { useRef, useCallback } from "react";
 import type { GuardApprovalRequest, GuardQueueResolutionResult } from "./guard-types";
 
 export type QueueSortDirection = "newest" | "oldest";
@@ -163,6 +164,29 @@ export function resolveStaleRequestRecovery(
   return items[0]?.request_id ?? null;
 }
 
+export type IsResolvingGuard = {
+  isResolvingRef: React.RefObject<boolean>;
+  setResolving: (value: boolean) => void;
+};
+
+export function useIsResolving(): IsResolvingGuard {
+  const isResolvingRef = useRef(false);
+  const setResolving = useCallback((value: boolean) => {
+    isResolvingRef.current = value;
+  }, []);
+  return { isResolvingRef, setResolving };
+}
+
+export function buildNextUpChipText(item: GuardApprovalRequest): string {
+  const envelope = item.action_envelope_json;
+  const preview =
+    envelope?.command?.slice(0, 40) ??
+    envelope?.mcp_tool ??
+    envelope?.prompt_excerpt?.slice(0, 40) ??
+    item.artifact_type;
+  return `${item.harness} — ${preview}`;
+}
+
 export function buildHomePrimaryState(
   pendingCount: number,
   watchedAppsCount: number

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/dashboard/src/runtime-overview.tsx

@@ -120,7 +120,9 @@ function cloudSyncHealthTone(state: GuardCloudSyncHealth["state"]): "blue" | "sl
 
 function humanizeCloudSyncHealthLabel(label: string): string {
   const labels: Record<string, string> = {
-    "Cloud sync stale": "Your protection history hasn't synced recently",
+    "Cloud sync stale": "Cloud backup is out of date",
+    "Cloud sync healthy": "Cloud backup up to date",
+    "First shared proof": "First cloud backup",
   };
   return labels[label] ?? label;
 }
@@ -131,7 +133,7 @@ function CloudSyncHealthCard(props: { health: GuardCloudSyncHealth }) {
     <div className="rounded-xl border border-border bg-white px-5 py-4">
       <div className="flex flex-wrap items-center justify-between gap-2">
         <p className="text-xs font-semibold uppercase tracking-[0.18em] text-brand-blue">
-          Cloud sync health
+          Guard cloud backup
         </p>
         <Tag tone={cloudSyncHealthTone(props.health.state)}>{humanizeCloudSyncHealthLabel(copy.label)}</Tag>
       </div>

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.167"
+version = "2.0.169"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.167"
+version = "2.0.169"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/src/codex_plugin_scanner/guard/approvals.py

@@ -23,6 +23,13 @@ GUARD_DASHBOARD_URL = "https://hol.org/guard"
 GUARD_INBOX_URL = f"{GUARD_DASHBOARD_URL}/inbox"
 GUARD_FLEET_URL = f"{GUARD_DASHBOARD_URL}/fleet"
 GUARD_CONNECT_URL = f"{GUARD_DASHBOARD_URL}/connect"
+_WORKSPACE_SCOPED_RUNTIME_ARTIFACT_TYPES = frozenset(
+    {
+        "file_read_request",
+        "prompt_request",
+        "tool_action_request",
+    }
+)
 
 
 class ApprovalRequestNotFoundError(ValueError):
@@ -133,12 +140,13 @@ def apply_approval_resolution(
         raise ValueError(f"Approval request {request_id} requires --workspace for workspace scope.")
     if scope == "publisher" and not isinstance(request.get("publisher"), str):
         raise ValueError(f"Approval request {request_id} has no publisher scope to approve.")
+    workspace_artifact_id, workspace_artifact_hash = _workspace_policy_artifact_keys(request, scope)
     decision = PolicyDecision(
         harness="*" if scope == "global" else str(request["harness"]),
         scope=scope,
         action="allow" if action == "allow" else "block",
-        artifact_id=str(request["artifact_id"]) if scope == "artifact" else None,
-        artifact_hash=str(request["artifact_hash"]) if scope == "artifact" else None,
+        artifact_id=str(request["artifact_id"]) if scope == "artifact" else workspace_artifact_id,
+        artifact_hash=str(request["artifact_hash"]) if scope == "artifact" else workspace_artifact_hash,
         workspace=workspace if scope == "workspace" else None,
         publisher=str(request["publisher"]) if scope == "publisher" else None,
         reason=reason,
@@ -164,7 +172,7 @@ def apply_approval_resolution(
             resolved_scope_ids = store.resolve_matching_approval_requests(
                 harness=resolution_harness,
                 scope=scope,
-                artifact_id=str(request["artifact_id"]) if scope == "artifact" else None,
+                artifact_id=str(request["artifact_id"]) if scope == "artifact" else workspace_artifact_id,
                 workspace=workspace if scope == "workspace" else None,
                 publisher=(
                     str(request["publisher"])
@@ -184,7 +192,7 @@ def apply_approval_resolution(
         resolved_ids = store.resolve_matching_approval_requests(
             harness=resolution_harness,
             scope=scope,
-            artifact_id=str(request["artifact_id"]) if scope == "artifact" else None,
+            artifact_id=str(request["artifact_id"]) if scope == "artifact" else workspace_artifact_id,
             workspace=workspace if scope == "workspace" else None,
             publisher=(
                 str(request["publisher"])
@@ -210,6 +218,18 @@ def apply_approval_resolution(
     return updated
 
 
+def _workspace_policy_artifact_keys(request: Mapping[str, object], scope: str) -> tuple[str | None, str | None]:
+    if scope != "workspace" or request.get("artifact_type") not in _WORKSPACE_SCOPED_RUNTIME_ARTIFACT_TYPES:
+        return None, None
+    artifact_id = request.get("artifact_id")
+    artifact_hash = request.get("artifact_hash")
+    if not isinstance(artifact_id, str) or not artifact_id:
+        return None, None
+    if not isinstance(artifact_hash, str) or not artifact_hash:
+        return artifact_id, None
+    return artifact_id, artifact_hash
+
+
 def _refresh_queue_result(
     store: GuardStore,
     result: dict[str, object],

{plugin_scanner-2.0.167 → plugin_scanner-2.0.169}/src/codex_plugin_scanner/guard/cli/commands.py

@@ -3399,6 +3399,13 @@ def _runtime_stored_policy_action(
         and scope in {"workspace", "publisher", "harness", "global"}
         and _runtime_artifact_risk_classes(artifact)
     ):
+        if scope == "workspace":
+            decision_artifact_id = _optional_string(decision.get("artifact_id"))
+            decision_artifact_hash = _optional_string(decision.get("artifact_hash"))
+            if decision_artifact_id == artifact_id and (
+                decision_artifact_hash is None or decision_artifact_hash == artifact_hash
+            ):
+                return action
         return None
     return action