plugin-scanner 2.0.365__tar.gz → 2.0.369__tar.gz

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.365
+Version: 2.0.369
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/dashboard/src/approval-center-utils.ts

@@ -513,6 +513,9 @@ function serializeMcpInput(payload: Record<string, unknown>): string | null {
 }
 
 export function harnessDisplayName(harness: string): string {
+  if (typeof harness !== "string") {
+    return "Unknown app";
+  }
   const normalized = normalizeHarnessSlug(harness);
   if (normalized === null) {
     switch (harness.trim().toLowerCase()) {

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/dashboard/src/guard-api.test.ts

@@ -54,6 +54,54 @@ assert(
   "T761: runtime normalizer defaults missing supply-chain strings"
 );
 
+const malformedManagedInstallsSnapshot = normalizeRuntimeSnapshot({
+  ...snapshot,
+  items: null,
+  queue_summary: null,
+  managed_installs: [
+    { harness: "claude-code", active: true, workspace: null, manifest: {}, updated_at: "2026-05-27T00:00:00Z" },
+    { harness: { name: "invalid" }, active: true, workspace: null, manifest: {}, updated_at: "2026-05-27T00:00:00Z" },
+    { harness: "opencode", active: false, workspace: "/tmp", manifest: { version: "1.0" }, updated_at: "2026-05-27T00:00:00Z" },
+    null,
+    "invalid-string",
+    { active: true, workspace: null, manifest: {}, updated_at: "2026-05-27T00:00:00Z" },
+  ],
+});
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.length === 2,
+  "T762: runtime normalizer filters out malformed managed_installs"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[0].harness === "claude-code",
+  "T762: runtime normalizer preserves valid managed_installs"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[0].active === true,
+  "T762: runtime normalizer preserves active flag"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[1].harness === "opencode",
+  "T762: runtime normalizer preserves second valid managed_install"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[1].workspace === "/tmp",
+  "T762: runtime normalizer preserves workspace"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[1].manifest.version === "1.0",
+  "T762: runtime normalizer preserves manifest"
+);
+
+const noManagedInstallsSnapshot = normalizeRuntimeSnapshot({
+  ...snapshot,
+  items: null,
+  queue_summary: null,
+});
+assert(
+  noManagedInstallsSnapshot.managed_installs === undefined || noManagedInstallsSnapshot.managed_installs?.length === 0,
+  "T762: runtime normalizer handles missing managed_installs"
+);
+
 assert(
   formatHarnessCommand(["hol-guard", "apps", "connect", "opencode"]) === "hol-guard apps connect opencode",
   "T760: harness setup fallback command should use real hol-guard apps connect command"

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/dashboard/src/guard-api.ts

@@ -564,12 +564,48 @@ function normalizeSupplyChainSnapshot(raw: unknown): SupplyChainSnapshot | undef
   };
 }
 
+function normalizeManagedInstall(raw: unknown): GuardManagedInstall | undefined {
+  if (!isRecord(raw)) {
+    return undefined;
+  }
+  const harness = raw["harness"];
+  if (typeof harness !== "string") {
+    return undefined;
+  }
+  const active = raw["active"] === true;
+  const workspace = isStringOrNull(raw["workspace"]) ? raw["workspace"] : null;
+  const manifest = isRecord(raw["manifest"]) ? raw["manifest"] : {};
+  const updatedAt = typeof raw["updated_at"] === "string" ? raw["updated_at"] : "";
+  return {
+    harness,
+    active,
+    workspace,
+    manifest,
+    updated_at: updatedAt,
+  };
+}
+
+function normalizeManagedInstalls(raw: unknown): GuardManagedInstall[] {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  const result: GuardManagedInstall[] = [];
+  for (const item of raw) {
+    const normalized = normalizeManagedInstall(item);
+    if (normalized !== undefined) {
+      result.push(normalized);
+    }
+  }
+  return result;
+}
+
 export function normalizeRuntimeSnapshot(snapshot: RuntimeSnapshotPayload): GuardRuntimeSnapshot {
   return {
     ...snapshot,
     items: normalizeApprovalRequests(snapshot.items),
     queue_summary: normalizeQueueSummary(snapshot.queue_summary, snapshot.pending_count),
     supply_chain: normalizeSupplyChainSnapshot(snapshot.supply_chain),
+    managed_installs: normalizeManagedInstalls(snapshot.managed_installs),
   };
 }
 

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/dashboard/src/home-dashboard.test.ts

@@ -148,6 +148,12 @@ for (const { harness, expected } of displayNames) {
   );
 }
 
+assert(harnessDisplayName(undefined as unknown as string) === "Unknown app", "L095: harnessDisplayName handles undefined gracefully");
+assert(harnessDisplayName(null as unknown as string) === "Unknown app", "L095: harnessDisplayName handles null gracefully");
+assert(harnessDisplayName({} as unknown as string) === "Unknown app", "L095: harnessDisplayName handles object gracefully");
+assert(harnessDisplayName([] as unknown as string) === "Unknown app", "L095: harnessDisplayName handles array gracefully");
+assert(harnessDisplayName(42 as unknown as string) === "Unknown app", "L095: harnessDisplayName handles number gracefully");
+
 const queuedCountForInbox = (pendingCount: number): string => {
   const state = buildHomePrimaryState(pendingCount, 1);
   return state.ctaLabel;

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.365"
+version = "2.0.369"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.365"
+version = "2.0.369"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/cli/prompt.py

@@ -81,6 +81,20 @@ def resolve_interactive_decisions(
             evaluation["blocked"] = True
             return evaluation
         if choice == "allow_once":
+            try:
+                _interactive_gate_grant(
+                    store,
+                    action="allow",
+                    scope="artifact",
+                    now=now,
+                )
+            except (EOFError, KeyboardInterrupt):
+                evaluation["review_hint"] = (
+                    "Guard needs an interactive terminal to approve changes. "
+                    f"Run `hol-guard diff {artifact.harness}` and allow or deny the artifact before launch."
+                )
+                evaluation["blocked"] = True
+                return evaluation
             _record_override_receipt(store, artifact, "allow", "allow-once", now)
             _set_decision_payload(decisions_by_artifact, artifact.artifact_id, "allow", "allow-once")
             continue

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-detail-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, $ as fetchApprovalPage, a0 as fetchPolicy, j as jsxRuntimeExports, a1 as HiMiniArrowLeft, s as HiMiniChevronRight, h as harnessDisplayName, G as GuardHero, P as ProofStrip, a2 as HiMiniHome, q as HiMiniBolt, a3 as HiMiniAdjustmentsHorizontal, A as ActionButton, S as SectionLabel, f as formatRelativeTime, a as HiMiniExclamationTriangle, T as Tag, a4 as detectCategory, a5 as CATEGORIES, B as Badge, E as EmptyState, a6 as policyIdentityKey, o as HiMiniCloud, a7 as HiMiniChartBar, d as HiMiniCheckCircle, e as HiMiniXCircle, a8 as runHarnessAction, a9 as GuardHarnessActionError, aa as HiMiniRocketLaunch, H as HiMiniShieldCheck, ab as HiMiniArrowPath, ac as HiMiniTrash, ad as clearLabelForScope, n as HiMiniChevronDown, ae as formatHarnessCommand } from "../guard-dashboard.js";
+import { r as reactExports, $ as fetchApprovalPage, a0 as fetchPolicy, j as jsxRuntimeExports, a1 as HiMiniArrowLeft, s as HiMiniChevronRight, i as harnessDisplayName, G as GuardHero, P as ProofStrip, a2 as HiMiniHome, q as HiMiniBolt, a3 as HiMiniAdjustmentsHorizontal, A as ActionButton, S as SectionLabel, f as formatRelativeTime, a as HiMiniExclamationTriangle, T as Tag, a4 as detectCategory, a5 as CATEGORIES, B as Badge, E as EmptyState, a6 as policyIdentityKey, o as HiMiniCloud, a7 as HiMiniChartBar, g as HiMiniCheckCircle, h as HiMiniXCircle, a8 as runHarnessAction, a9 as GuardHarnessActionError, aa as HiMiniRocketLaunch, H as HiMiniShieldCheck, ab as HiMiniArrowPath, ac as HiMiniTrash, ad as clearLabelForScope, e as HiMiniChevronDown, ae as formatHarnessCommand } from "../guard-dashboard.js";
 import { u as useFocusTrap } from "./use-focus-trap.js";
 const tabOrder = ["overview", "activity", "settings"];
 const TAB_DEFINITIONS = [

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/audit-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, B as Badge, S as SectionLabel, W as HiMiniMagnifyingGlass, E as EmptyState, d as HiMiniCheckCircle, e as HiMiniXCircle, a as HiMiniExclamationTriangle, h as harnessDisplayName, f as formatRelativeTime, s as HiMiniChevronRight, A as ActionButton } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, B as Badge, S as SectionLabel, W as HiMiniMagnifyingGlass, E as EmptyState, g as HiMiniCheckCircle, h as HiMiniXCircle, a as HiMiniExclamationTriangle, i as harnessDisplayName, f as formatRelativeTime, s as HiMiniChevronRight, A as ActionButton } from "../guard-dashboard.js";
 function deriveFrontendAuditResults(receipts, snapshot) {
   const results = [];
   const protection = snapshot.supply_chain?.package_manager_protection;

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/feed-health-workspace.js

@@ -1,4 +1,4 @@
-import { j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, a as HiMiniExclamationTriangle, ab as HiMiniArrowPath, d as HiMiniCheckCircle, ag as HiMiniSignal, e as HiMiniXCircle, ah as HiMiniClock, f as formatRelativeTime, B as Badge, T as Tag } from "../guard-dashboard.js";
+import { j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, a as HiMiniExclamationTriangle, ab as HiMiniArrowPath, g as HiMiniCheckCircle, ag as HiMiniSignal, h as HiMiniXCircle, ah as HiMiniClock, f as formatRelativeTime, B as Badge, T as Tag } from "../guard-dashboard.js";
 function resolveFeedSourceMode(cloudState) {
   if (cloudState === "local_only") return "sample";
   if (cloudState === "paired_waiting") return "full";

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/fleet-workspace.js

@@ -1,4 +1,4 @@
-import { i as isDisplayableHarness, j as jsxRuntimeExports, G as GuardHero, A as ActionButton, P as ProofStrip, S as SectionLabel, E as EmptyState, r as reactExports, h as harnessDisplayName, s as HiMiniChevronRight, d as HiMiniCheckCircle, u as HiMiniEye, v as HiMiniWrenchScrewdriver, e as HiMiniXCircle, w as HiMiniExclamationCircle, x as HiMiniClipboardDocumentCheck, y as HiMiniClipboard } from "../guard-dashboard.js";
+import { k as isDisplayableHarness, j as jsxRuntimeExports, G as GuardHero, A as ActionButton, P as ProofStrip, S as SectionLabel, E as EmptyState, r as reactExports, i as harnessDisplayName, s as HiMiniChevronRight, g as HiMiniCheckCircle, u as HiMiniEye, v as HiMiniWrenchScrewdriver, h as HiMiniXCircle, w as HiMiniExclamationCircle, x as HiMiniClipboardDocumentCheck, y as HiMiniClipboard } from "../guard-dashboard.js";
 import { S as SUPPORTED_APPS_BRIEF, A as APP_STATUS_LABELS } from "./app-catalog.js";
 const SUPPORTED_APPS_COPY = SUPPORTED_APPS_BRIEF;
 function resolveFleetHeroCopy(cloudState, activeInstallCount, urls) {

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/help-modal.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, af as HiMiniCommandLine, l as HiMiniXMark, p as HiMiniQuestionMarkCircle } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, af as HiMiniCommandLine, n as HiMiniXMark, p as HiMiniQuestionMarkCircle } from "../guard-dashboard.js";
 import { u as useFocusTrap } from "./use-focus-trap.js";
 const shortcuts = [
   {

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/policy-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, T as Tag, W as HiMiniMagnifyingGlass, E as EmptyState, h as harnessDisplayName, B as Badge, ac as HiMiniTrash, d as HiMiniCheckCircle, f as formatRelativeTime } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, T as Tag, W as HiMiniMagnifyingGlass, E as EmptyState, i as harnessDisplayName, B as Badge, ac as HiMiniTrash, g as HiMiniCheckCircle, f as formatRelativeTime } from "../guard-dashboard.js";
 function groupPoliciesByHarness(policies) {
   const map = /* @__PURE__ */ new Map();
   for (const p of policies) {

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/settings-workspace.js

@@ -1,4 +1,4 @@
-import { z as requireReact, C as getDefaultExportFromCjs, j as jsxRuntimeExports, r as reactExports, D as fetchSettings, F as fetchRuntimeSnapshot, I as revokeApprovalGateCooldown, J as enrollApprovalGateTotp, K as verifyApprovalGateTotp, L as disableApprovalGateTotp, M as updateSettings, N as clearPolicy, O as clearReviewQueue, Q as clearEvidence, R as exportDiagnostics, U as repairApprovalCenter, V as setupDesktopNotifications, E as EmptyState, G as GuardHero, T as Tag, W as HiMiniMagnifyingGlass, S as SectionLabel, H as HiMiniShieldCheck, X as HiMiniLockClosed, Y as HiMiniCog6Tooth, B as Badge, A as ActionButton, d as HiMiniCheckCircle, a as HiMiniExclamationTriangle, m as HiMiniChevronUp, n as HiMiniChevronDown, Z as HiMiniBellAlert, _ as approvalGateCooldownLabel, l as HiMiniXMark } from "../guard-dashboard.js";
+import { z as requireReact, C as getDefaultExportFromCjs, j as jsxRuntimeExports, r as reactExports, D as fetchSettings, F as fetchRuntimeSnapshot, I as revokeApprovalGateCooldown, J as enrollApprovalGateTotp, K as verifyApprovalGateTotp, L as disableApprovalGateTotp, M as updateSettings, N as clearPolicy, O as clearReviewQueue, Q as clearEvidence, R as exportDiagnostics, U as repairApprovalCenter, V as setupDesktopNotifications, E as EmptyState, G as GuardHero, T as Tag, W as HiMiniMagnifyingGlass, S as SectionLabel, H as HiMiniShieldCheck, X as HiMiniLockClosed, Y as HiMiniCog6Tooth, B as Badge, A as ActionButton, g as HiMiniCheckCircle, a as HiMiniExclamationTriangle, d as HiMiniChevronUp, e as HiMiniChevronDown, Z as HiMiniBellAlert, _ as approvalGateCooldownLabel, n as HiMiniXMark } from "../guard-dashboard.js";
 import { a as resolveProtectionLevelCopy } from "./runtime-overview.js";
 import { f as filterSettingsBySearch, R as RISK_CONTROL_CONSEQUENCES, s as securityLevelLabel } from "./app-catalog.js";
 import { u as useFocusTrap } from "./use-focus-trap.js";

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/supply-chain-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, T as Tag, b as HiMiniInformationCircle, E as EmptyState, d as HiMiniCheckCircle, a as HiMiniExclamationTriangle, e as HiMiniXCircle, h as harnessDisplayName, B as Badge, m as HiMiniChevronUp, n as HiMiniChevronDown, f as formatRelativeTime, ab as HiMiniArrowPath } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, T as Tag, b as HiMiniInformationCircle, E as EmptyState, g as HiMiniCheckCircle, a as HiMiniExclamationTriangle, h as HiMiniXCircle, i as harnessDisplayName, B as Badge, d as HiMiniChevronUp, e as HiMiniChevronDown, f as formatRelativeTime, ab as HiMiniArrowPath } from "../guard-dashboard.js";
 import { b as resolvePackageManagerProtectionCopy } from "./runtime-overview.js";
 function buildSupplyChainStats(snapshot) {
   const managedInstalls = snapshot.managed_installs ?? [];

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -13090,12 +13090,46 @@ function normalizeSupplyChainSnapshot(raw) {
     package_manager_protection: packageManagerProtection
   };
 }
+function normalizeManagedInstall(raw) {
+  if (!isRecord(raw)) {
+    return void 0;
+  }
+  const harness = raw["harness"];
+  if (typeof harness !== "string") {
+    return void 0;
+  }
+  const active = raw["active"] === true;
+  const workspace = isStringOrNull(raw["workspace"]) ? raw["workspace"] : null;
+  const manifest = isRecord(raw["manifest"]) ? raw["manifest"] : {};
+  const updatedAt = typeof raw["updated_at"] === "string" ? raw["updated_at"] : "";
+  return {
+    harness,
+    active,
+    workspace,
+    manifest,
+    updated_at: updatedAt
+  };
+}
+function normalizeManagedInstalls(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  const result = [];
+  for (const item of raw) {
+    const normalized = normalizeManagedInstall(item);
+    if (normalized !== void 0) {
+      result.push(normalized);
+    }
+  }
+  return result;
+}
 function normalizeRuntimeSnapshot(snapshot) {
   return {
     ...snapshot,
     items: normalizeApprovalRequests(snapshot.items),
     queue_summary: normalizeQueueSummary(snapshot.queue_summary, snapshot.pending_count),
-    supply_chain: normalizeSupplyChainSnapshot(snapshot.supply_chain)
+    supply_chain: normalizeSupplyChainSnapshot(snapshot.supply_chain),
+    managed_installs: normalizeManagedInstalls(snapshot.managed_installs)
   };
 }
 function normalizeQueueCopy(raw) {
@@ -14373,6 +14407,9 @@ function serializeMcpInput(payload) {
   }
 }
 function harnessDisplayName(harness) {
+  if (typeof harness !== "string") {
+    return "Unknown app";
+  }
   const normalized = normalizeHarnessSlug(harness);
   if (normalized === null) {
     switch (harness.trim().toLowerCase()) {

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/daemon/static/assets/index.css

@@ -3972,6 +3972,16 @@
       }
     }
 
+    .hover\:bg-brand-blue\/\[0\.06\]:hover {
+      background-color: var(--brand-blue);
+    }
+
+    @supports (color: color-mix(in lab, red, red)) {
+      .hover\:bg-brand-blue\/\[0\.06\]:hover {
+        background-color: color-mix(in oklab, var(--brand-blue) 6%, transparent);
+      }
+    }
+
     .hover\:bg-brand-blue\/\[0\.08\]:hover {
       background-color: var(--brand-blue);
     }

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -206,6 +206,8 @@ _SYNC_HTTP_RETRY_TIMEOUT_SECONDS = 120
 _RUNTIME_SYNC_TIMEOUT_SECONDS = 10
 _RUNTIME_SYNC_RETRY_TIMEOUT_SECONDS = 90
 _RECEIPT_SYNC_BATCH_SIZE = 50
+_RECEIPT_SYNC_CURSOR_PAGE_SIZE = 200
+_RECEIPT_SYNC_CURSOR_BACKFILL_ROWS = 200
 _PAIN_SIGNAL_TIMEOUT_SECONDS = 10
 _PAIN_SIGNAL_RETRY_TIMEOUT_SECONDS = 90
 _GUARD_EVENTS_ENDPOINT_UNAVAILABLE_RETRY_HOURS = 24
@@ -827,7 +829,8 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
     if credentials is None:
         raise GuardSyncNotConfiguredError("Guard is not logged in.")
     sync_url = _normalized_receipts_sync_url(str(credentials["sync_url"]))
-    receipts = store.list_receipts(limit=200)
+    prior_receipt_cursor = _receipt_sync_cursor_rowid(store)
+    receipts = _receipt_sync_rows_for_upload(store, cursor_rowid=prior_receipt_cursor)
     inventory = store.list_inventory()
     payload: dict[str, object] = {}
     receipts_stored_total = 0
@@ -838,6 +841,9 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
     team_policy_pack_payload: dict[str, object] | None = None
     remote_decisions: set[PolicyDecision] = set()
     device_id, device_name = _guard_device_metadata(store)
+    local_guard_online_at = _now()
+    sync_context = _receipt_sync_context(store=store, local_guard_online_at=local_guard_online_at)
+    latest_uploaded_rowid: int | None = None
     for receipt_batch in _iter_receipt_sync_batches(receipts):
         body = json.dumps(
             {
@@ -845,7 +851,8 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
                     receipt_batch,
                     device_id=device_id,
                     device_name=device_name,
-                )
+                ),
+                "syncContext": sync_context,
             }
         ).encode("utf-8")
         request = urllib.request.Request(
@@ -869,6 +876,17 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
             raise RuntimeError(_sync_http_error_message(error)) from error
         except OSError as error:
             raise RuntimeError(_sync_url_error_message(error)) from error
+        batch_rowids = [item.get("receipt_rowid") for item in receipt_batch]
+        for rowid in batch_rowids:
+            if isinstance(rowid, int) and (latest_uploaded_rowid is None or rowid > latest_uploaded_rowid):
+                latest_uploaded_rowid = rowid
+        batch_synced_at = _sync_timestamp(payload)
+        if latest_uploaded_rowid is not None:
+            _persist_receipt_sync_cursor(
+                store=store,
+                latest_uploaded_rowid=latest_uploaded_rowid,
+                synced_at=batch_synced_at,
+            )
         batch_receipts_stored = payload.get("receiptsStored")
         if isinstance(batch_receipts_stored, int):
             receipts_stored_total += batch_receipts_stored
@@ -889,6 +907,12 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
             exceptions_payload.extend(item for item in exceptions if isinstance(item, dict))
         remote_decisions.update(_build_remote_policy_decisions(payload))
     now = _sync_timestamp(payload)
+    persisted_cursor_rowid = latest_uploaded_rowid if latest_uploaded_rowid is not None else prior_receipt_cursor
+    _persist_receipt_sync_cursor(
+        store=store,
+        latest_uploaded_rowid=persisted_cursor_rowid,
+        synced_at=now,
+    )
     deduped_advisories = _dedupe_sync_payload_items(advisories_payload)
     deduped_exceptions = _dedupe_sync_payload_items(exceptions_payload)
     advisories_stored = 0
@@ -939,6 +963,15 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
         "remote_policies_stored": remote_policies_stored,
         "pain_signals_uploaded": pain_signals_uploaded,
         "receipts": len(receipts),
+        "receipt_cursor_rowid": persisted_cursor_rowid,
+        "receipt_cursor_backfill": bool(
+            prior_receipt_cursor is not None
+            and len(receipts) > 0
+            and not any(
+                isinstance(item.get("receipt_rowid"), int) and int(item.get("receipt_rowid")) > prior_receipt_cursor
+                for item in receipts
+            )
+        ),
         "inventory": 0,
         "inventory_tracked": len(inventory),
         "value_metrics": value_metrics,
@@ -1400,6 +1433,11 @@ def sync_runtime_session(
                 "runtime_sessions_visible": 0,
                 "runtime_session_sync_skipped": True,
                 "runtime_session_sync_reason": "runtime_session_endpoint_unavailable",
+                "local_guard_online_at": recorded_at,
+                "runtime_harness": session_payload["harness"],
+                "runtime_surface": session_payload["surface"],
+                "runtime_workspace": session_payload["workspace"],
+                "runtime_device_id": session_payload["deviceId"],
             }
             store.set_sync_payload("runtime_session_summary", summary, recorded_at)
             return summary
@@ -1414,6 +1452,11 @@ def sync_runtime_session(
         "runtime_session_synced_at": synced_at,
         "runtime_session_id": session_payload["sessionId"],
         "runtime_sessions_visible": len(payload.get("items", [])) if isinstance(payload.get("items"), list) else 0,
+        "local_guard_online_at": synced_at,
+        "runtime_harness": session_payload["harness"],
+        "runtime_surface": session_payload["surface"],
+        "runtime_workspace": session_payload["workspace"],
+        "runtime_device_id": session_payload["deviceId"],
     }
     store.set_sync_payload("runtime_session_summary", summary, synced_at)
     workspace_id = store.get_cloud_workspace_id()
@@ -2078,6 +2121,72 @@ def _iter_receipt_sync_batches(receipts: list[dict[str, object]]) -> tuple[list[
     )
 
 
+def _receipt_sync_cursor_rowid(store: GuardStore) -> int | None:
+    payload = store.get_sync_payload("receipt_sync_cursor")
+    if not isinstance(payload, dict):
+        return None
+    value = payload.get("last_rowid")
+    if isinstance(value, int) and not isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        stripped = value.strip()
+        if stripped.isdigit():
+            return int(stripped)
+    return None
+
+
+def _receipt_sync_rows_for_upload(store: GuardStore, *, cursor_rowid: int | None) -> list[dict[str, object]]:
+    if cursor_rowid is None:
+        return store.list_receipts(limit=_RECEIPT_SYNC_CURSOR_PAGE_SIZE)
+    latest_rowid = store.latest_receipt_rowid()
+    if latest_rowid is None:
+        return []
+    if cursor_rowid > latest_rowid:
+        backfill_after = max(latest_rowid - _RECEIPT_SYNC_CURSOR_BACKFILL_ROWS, 0)
+        return store.list_receipts_since_rowid(after_rowid=backfill_after, limit=_RECEIPT_SYNC_CURSOR_PAGE_SIZE)
+    return store.list_receipts_since_rowid(after_rowid=cursor_rowid, limit=_RECEIPT_SYNC_CURSOR_PAGE_SIZE)
+
+
+def _receipt_sync_context(store: GuardStore, *, local_guard_online_at: str) -> dict[str, object]:
+    runtime_summary = store.get_sync_payload("runtime_session_summary")
+    runtime_synced_at = (
+        _optional_string(runtime_summary.get("runtime_session_synced_at"))
+        if isinstance(runtime_summary, dict)
+        else None
+    )
+    prior_summary = store.get_sync_payload("sync_summary")
+    receipt_synced_at = (
+        _optional_string(prior_summary.get("synced_at")) or _optional_string(prior_summary.get("syncedAt"))
+        if isinstance(prior_summary, dict)
+        else None
+    )
+    sync_health = "healthy" if runtime_synced_at is not None else "degraded"
+    context: dict[str, object] = {
+        "localGuardOnlineAt": local_guard_online_at,
+        "syncHealth": sync_health,
+    }
+    if runtime_synced_at is not None:
+        context["lastRuntimeSyncAt"] = runtime_synced_at
+    if receipt_synced_at is not None:
+        context["lastReceiptSyncAt"] = receipt_synced_at
+    return context
+
+
+def _persist_receipt_sync_cursor(
+    *,
+    store: GuardStore,
+    latest_uploaded_rowid: int | None,
+    synced_at: str,
+) -> None:
+    if latest_uploaded_rowid is None:
+        return
+    payload = {
+        "last_rowid": latest_uploaded_rowid,
+        "synced_at": synced_at,
+    }
+    store.set_sync_payload("receipt_sync_cursor", payload, synced_at)
+
+
 def _cloud_sync_receipt_payload(
     receipt: dict[str, object],
     *,

{plugin_scanner-2.0.365 → plugin_scanner-2.0.369}/src/codex_plugin_scanner/guard/store.py

@@ -1583,8 +1583,9 @@ class GuardStore:
     def list_receipts(self, limit: int = 50, harness: str | None = None) -> list[dict[str, object]]:
         if harness is not None:
             query = """
-                select receipt_id, harness, artifact_id, artifact_hash, policy_decision, capabilities_summary,
-                        changed_capabilities_json,
+                select rowid as receipt_rowid, receipt_id, harness, artifact_id, artifact_hash, policy_decision,
+                       capabilities_summary,
+                       changed_capabilities_json,
                        provenance_summary, user_override, artifact_name, source_scope, scanner_evidence_json,
                        diff_summary, approval_source, timestamp
                 from runtime_receipts
@@ -1595,8 +1596,9 @@ class GuardStore:
             params: tuple[object, ...] = (harness, limit)
         else:
             query = """
-                select receipt_id, harness, artifact_id, artifact_hash, policy_decision, capabilities_summary,
-                        changed_capabilities_json,
+                select rowid as receipt_rowid, receipt_id, harness, artifact_id, artifact_hash, policy_decision,
+                       capabilities_summary,
+                       changed_capabilities_json,
                        provenance_summary, user_override, artifact_name, source_scope, scanner_evidence_json,
                        diff_summary, approval_source, timestamp
                 from runtime_receipts
@@ -1608,6 +1610,64 @@ class GuardStore:
             rows = connection.execute(query, params).fetchall()
         return [
             {
+                "receipt_rowid": int(row["receipt_rowid"]),
+                "receipt_id": str(row["receipt_id"]),
+                "harness": str(row["harness"]),
+                "artifact_id": str(row["artifact_id"]),
+                "artifact_hash": str(row["artifact_hash"]),
+                "policy_decision": str(row["policy_decision"]),
+                "capabilities_summary": str(row["capabilities_summary"]),
+                "changed_capabilities": json.loads(str(row["changed_capabilities_json"])),
+                "provenance_summary": str(row["provenance_summary"]),
+                "user_override": row["user_override"],
+                "artifact_name": row["artifact_name"],
+                "source_scope": row["source_scope"],
+                "scanner_evidence": _json_object_list(row["scanner_evidence_json"]),
+                "diff_summary": row["diff_summary"],
+                "approval_source": row["approval_source"],
+                "timestamp": str(row["timestamp"]),
+            }
+            for row in rows
+        ]
+
+    def list_receipts_since_rowid(
+        self,
+        *,
+        after_rowid: int | None,
+        limit: int = 200,
+        harness: str | None = None,
+    ) -> list[dict[str, object]]:
+        if harness is not None:
+            query = """
+                select rowid as receipt_rowid, receipt_id, harness, artifact_id, artifact_hash, policy_decision,
+                       capabilities_summary, changed_capabilities_json, provenance_summary, user_override,
+                       artifact_name, source_scope, scanner_evidence_json, diff_summary, approval_source, timestamp
+                from runtime_receipts
+                where rowid > ? and harness = ?
+                order by rowid asc
+                limit ?
+                """
+            params: tuple[object, ...] = (
+                after_rowid if after_rowid is not None else 0,
+                harness,
+                limit,
+            )
+        else:
+            query = """
+                select rowid as receipt_rowid, receipt_id, harness, artifact_id, artifact_hash, policy_decision,
+                       capabilities_summary, changed_capabilities_json, provenance_summary, user_override,
+                       artifact_name, source_scope, scanner_evidence_json, diff_summary, approval_source, timestamp
+                from runtime_receipts
+                where rowid > ?
+                order by rowid asc
+                limit ?
+                """
+            params = (after_rowid if after_rowid is not None else 0, limit)
+        with self._connect() as connection:
+            rows = connection.execute(query, params).fetchall()
+        return [
+            {
+                "receipt_rowid": int(row["receipt_rowid"]),
                 "receipt_id": str(row["receipt_id"]),
                 "harness": str(row["harness"]),
                 "artifact_id": str(row["artifact_id"]),
@@ -1627,6 +1687,23 @@ class GuardStore:
             for row in rows
         ]
 
+    def latest_receipt_rowid(self, *, harness: str | None = None) -> int | None:
+        query = "select max(rowid) as max_rowid from runtime_receipts"
+        params: tuple[object, ...] = ()
+        if harness is not None:
+            query += " where harness = ?"
+            params = (harness,)
+        with self._connect() as connection:
+            row = connection.execute(query, params).fetchone()
+        if row is None:
+            return None
+        max_rowid = row["max_rowid"]
+        if isinstance(max_rowid, int):
+            return max_rowid
+        if isinstance(max_rowid, str) and max_rowid.isdigit():
+            return int(max_rowid)
+        return None
+
     def get_receipt(self, receipt_id: str) -> dict[str, object] | None:
         with self._connect() as connection:
             row = connection.execute(
@@ -3019,6 +3096,11 @@ class GuardStore:
             self._credential_payload_token_hash(previous_payload) if previous_payload is not None else None
         )
         previous_workspace_id = previous_payload.get("workspace_id") if previous_payload is not None else None
+        previous_workspace = (
+            previous_workspace_id.strip()
+            if isinstance(previous_workspace_id, str) and previous_workspace_id.strip()
+            else None
+        )
         effective_workspace_id = normalized_workspace_id
         can_preserve_workspace = (
             previous_sync_url == sync_url
@@ -3029,6 +3111,11 @@ class GuardStore:
         )
         if effective_workspace_id is None and can_preserve_workspace:
             effective_workspace_id = previous_workspace_id.strip()
+        workspace_changed = (
+            previous_workspace is not None
+            and effective_workspace_id is not None
+            and previous_workspace != effective_workspace_id
+        )
         payload = {
             "sync_url": sync_url,
             "token_ref": self._sync_token_ref,
@@ -3040,7 +3127,10 @@ class GuardStore:
             credentials_changed = True
         else:
             credentials_changed = (
-                previous_sync_url != sync_url or previous_token_hash is None or previous_token_hash != token_hash
+                previous_sync_url != sync_url
+                or previous_token_hash is None
+                or previous_token_hash != token_hash
+                or workspace_changed
             )
         self._secret_store.set_secret(self._sync_token_ref, token)
         connection.execute(