plugin-scanner 2.0.368__tar.gz → 2.0.370__tar.gz

{plugin_scanner-2.0.368 → plugin_scanner-2.0.370}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.368
+Version: 2.0.370
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.368 → plugin_scanner-2.0.370}/dashboard/src/approval-center-utils.ts

@@ -513,6 +513,9 @@ function serializeMcpInput(payload: Record<string, unknown>): string | null {
 }
 
 export function harnessDisplayName(harness: string): string {
+  if (typeof harness !== "string") {
+    return "Unknown app";
+  }
   const normalized = normalizeHarnessSlug(harness);
   if (normalized === null) {
     switch (harness.trim().toLowerCase()) {

{plugin_scanner-2.0.368 → plugin_scanner-2.0.370}/dashboard/src/guard-api.test.ts

@@ -54,6 +54,54 @@ assert(
   "T761: runtime normalizer defaults missing supply-chain strings"
 );
 
+const malformedManagedInstallsSnapshot = normalizeRuntimeSnapshot({
+  ...snapshot,
+  items: null,
+  queue_summary: null,
+  managed_installs: [
+    { harness: "claude-code", active: true, workspace: null, manifest: {}, updated_at: "2026-05-27T00:00:00Z" },
+    { harness: { name: "invalid" }, active: true, workspace: null, manifest: {}, updated_at: "2026-05-27T00:00:00Z" },
+    { harness: "opencode", active: false, workspace: "/tmp", manifest: { version: "1.0" }, updated_at: "2026-05-27T00:00:00Z" },
+    null,
+    "invalid-string",
+    { active: true, workspace: null, manifest: {}, updated_at: "2026-05-27T00:00:00Z" },
+  ],
+});
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.length === 2,
+  "T762: runtime normalizer filters out malformed managed_installs"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[0].harness === "claude-code",
+  "T762: runtime normalizer preserves valid managed_installs"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[0].active === true,
+  "T762: runtime normalizer preserves active flag"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[1].harness === "opencode",
+  "T762: runtime normalizer preserves second valid managed_install"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[1].workspace === "/tmp",
+  "T762: runtime normalizer preserves workspace"
+);
+assert(
+  malformedManagedInstallsSnapshot.managed_installs?.[1].manifest.version === "1.0",
+  "T762: runtime normalizer preserves manifest"
+);
+
+const noManagedInstallsSnapshot = normalizeRuntimeSnapshot({
+  ...snapshot,
+  items: null,
+  queue_summary: null,
+});
+assert(
+  noManagedInstallsSnapshot.managed_installs === undefined || noManagedInstallsSnapshot.managed_installs?.length === 0,
+  "T762: runtime normalizer handles missing managed_installs"
+);
+
 assert(
   formatHarnessCommand(["hol-guard", "apps", "connect", "opencode"]) === "hol-guard apps connect opencode",
   "T760: harness setup fallback command should use real hol-guard apps connect command"

{plugin_scanner-2.0.368 → plugin_scanner-2.0.370}/dashboard/src/guard-api.ts

@@ -13,6 +13,15 @@ import type {
   GuardApprovalPage,
   GuardApprovalPageFilters,
   GuardApprovalPageStatus,
+  PackageFirewallActionResponse,
+  PackageFirewallActionState,
+  PackageFirewallActionType,
+  PackageFirewallCliFallback,
+  PackageFirewallEntitlement,
+  PackageFirewallGlobalActionType,
+  PackageFirewallReceipt,
+  PackageShimEntry,
+  PackageFirewallStatusResponse,
   GuardApprovalRequest,
   GuardArtifactDiff,
   GuardDecisionV2,
@@ -564,12 +573,48 @@ function normalizeSupplyChainSnapshot(raw: unknown): SupplyChainSnapshot | undef
   };
 }
 
+function normalizeManagedInstall(raw: unknown): GuardManagedInstall | undefined {
+  if (!isRecord(raw)) {
+    return undefined;
+  }
+  const harness = raw["harness"];
+  if (typeof harness !== "string") {
+    return undefined;
+  }
+  const active = raw["active"] === true;
+  const workspace = isStringOrNull(raw["workspace"]) ? raw["workspace"] : null;
+  const manifest = isRecord(raw["manifest"]) ? raw["manifest"] : {};
+  const updatedAt = typeof raw["updated_at"] === "string" ? raw["updated_at"] : "";
+  return {
+    harness,
+    active,
+    workspace,
+    manifest,
+    updated_at: updatedAt,
+  };
+}
+
+function normalizeManagedInstalls(raw: unknown): GuardManagedInstall[] {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  const result: GuardManagedInstall[] = [];
+  for (const item of raw) {
+    const normalized = normalizeManagedInstall(item);
+    if (normalized !== undefined) {
+      result.push(normalized);
+    }
+  }
+  return result;
+}
+
 export function normalizeRuntimeSnapshot(snapshot: RuntimeSnapshotPayload): GuardRuntimeSnapshot {
   return {
     ...snapshot,
     items: normalizeApprovalRequests(snapshot.items),
     queue_summary: normalizeQueueSummary(snapshot.queue_summary, snapshot.pending_count),
     supply_chain: normalizeSupplyChainSnapshot(snapshot.supply_chain),
+    managed_installs: normalizeManagedInstalls(snapshot.managed_installs),
   };
 }
 
@@ -1408,6 +1453,204 @@ export async function loadAuditPage(): Promise<AuditPageData> {
   return { snapshot, receipts };
 }
 
+function stringValue(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+
+function booleanValue(value: unknown): boolean {
+  return value === true;
+}
+
+function numberValue(value: unknown): number | null {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+
+function normalizePackageFirewallEntitlement(value: unknown): PackageFirewallEntitlement {
+  const record = isRecord(value) ? value : {};
+  return {
+    allowed: booleanValue(record.allowed),
+    reason: stringValue(record.reason) ?? "unknown",
+    tier: stringValue(record.tier) ?? "free",
+    upgrade_cta: stringValue(record.upgrade_cta),
+    upgrade_url: stringValue(record.upgrade_url),
+  };
+}
+
+function normalizePackageFirewallReceipt(value: unknown): PackageFirewallReceipt | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const id = stringValue(value.id);
+  const operation = stringValue(value.operation);
+  const status = stringValue(value.status);
+  const timestamp = stringValue(value.timestamp);
+  if (id === null || operation === null || status === null || timestamp === null) {
+    return null;
+  }
+  return { id, operation, status, timestamp };
+}
+
+function normalizePackageFirewallActions(
+  value: unknown,
+): PackageFirewallStatusResponse["actions"] {
+  if (!isRecord(value)) {
+    return {};
+  }
+  const allowedStates = new Set(["available", "paid_required", "pending", "disabled"]);
+  const entries = Object.entries(value).filter(
+    (entry): entry is [PackageFirewallActionType | PackageFirewallGlobalActionType, PackageFirewallActionState] =>
+      typeof entry[1] === "string" && allowedStates.has(entry[1]),
+  );
+  return Object.fromEntries(entries);
+}
+
+function normalizePackageFirewallCliFallback(value: unknown): PackageFirewallCliFallback | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const fallback: PackageFirewallCliFallback = {};
+  const install = stringValue(value.install);
+  const status = stringValue(value.status);
+  const remove = stringValue(value.remove);
+  if (install !== null) {
+    fallback.install = install;
+  }
+  if (status !== null) {
+    fallback.status = status;
+  }
+  if (remove !== null) {
+    fallback.remove = remove;
+  }
+  return Object.keys(fallback).length > 0 ? fallback : null;
+}
+
+function normalizePackageShimEntry(manager: string, detail: Record<string, unknown> | null): PackageShimEntry {
+  return {
+    active: booleanValue(detail?.path_active),
+    installed: detail !== null && stringValue(detail.integrity) !== "missing",
+    integrity: stringValue(detail?.integrity) ?? "uninstalled",
+    manager,
+    path_index: numberValue(detail?.path_index),
+    real_binary_found: booleanValue(detail?.real_binary_found),
+    real_binary_path: stringValue(detail?.real_binary_path),
+    real_binary_path_index: numberValue(detail?.real_binary_path_index),
+    shim_path: stringValue(detail?.shim_path),
+  };
+}
+
+function normalizePackageShimEntries(value: unknown, supportedManagers: string[]): PackageShimEntry[] {
+  const status = isRecord(value) ? value : {};
+  const detailRows = Array.isArray(status.manager_details)
+    ? status.manager_details.filter(isRecord)
+    : [];
+  const detailByManager = new Map<string, Record<string, unknown>>();
+  for (const detail of detailRows) {
+    const manager = stringValue(detail.manager);
+    if (manager !== null) {
+      detailByManager.set(manager, detail);
+    }
+  }
+  const managers = new Set([
+    ...supportedManagers,
+    ...normalizeStringArray(status.installed_managers),
+    ...normalizeStringArray(status.active_managers),
+    ...detailByManager.keys(),
+  ]);
+  return Array.from(managers)
+    .sort()
+    .map((manager) => normalizePackageShimEntry(manager, detailByManager.get(manager) ?? null));
+}
+
+function actionResultSummary(operation: string, detail: Record<string, unknown>): string {
+  const countKeys = ["installed_now_count", "repaired_count"];
+  for (const key of countKeys) {
+    const count = numberValue(detail[key]);
+    if (count !== null) {
+      return `${operation} completed for ${count} manager${count === 1 ? "" : "s"}.`;
+    }
+  }
+  const tested = normalizeStringArray(detail.tested_managers);
+  if (tested.length > 0) {
+    return `Test completed for ${tested.join(", ")}.`;
+  }
+  return `${operation} completed.`;
+}
+
+function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusResponse {
+  const record = isRecord(value) ? value : {};
+  const supportedManagers = normalizeStringArray(record.supported_managers);
+  return {
+    actions: normalizePackageFirewallActions(record.actions),
+    cli_fallback: normalizePackageFirewallCliFallback(record.cli_fallback),
+    entitlement: normalizePackageFirewallEntitlement(record.entitlement),
+    operation: stringValue(record.operation) ?? "status",
+    package_shims: normalizePackageShimEntries(record.package_shims, supportedManagers),
+    status: stringValue(record.status) ?? "unknown",
+    supported_managers: supportedManagers,
+  };
+}
+
+function normalizePackageFirewallAction(value: unknown): PackageFirewallActionResponse {
+  const record = isRecord(value) ? value : {};
+  const result = isRecord(record.result) ? record.result : {};
+  const operation = stringValue(record.operation) ?? "unknown";
+  return {
+    entitlement: normalizePackageFirewallEntitlement(record.entitlement),
+    operation,
+    receipt: normalizePackageFirewallReceipt(record.receipt),
+    result: typeof record.result === "string" ? record.result : actionResultSummary(operation, result),
+    result_detail: result,
+    status: stringValue(record.status) ?? "unknown",
+  };
+}
+
+export async function fetchPackageFirewallStatus(): Promise<PackageFirewallStatusResponse> {
+  return normalizePackageFirewallStatus(await readJson<unknown>("/v1/supply-chain/package-shims"));
+}
+
+export async function runPackageFirewallAction(
+  action: PackageFirewallActionType,
+  manager: string | null,
+): Promise<PackageFirewallActionResponse> {
+  const payload = manager !== null ? { managers: [manager] } : {};
+  const response = await readJson<unknown>(
+    `/v1/supply-chain/package-shims/${action}`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...guardAuthHeaders(),
+      },
+      body: JSON.stringify(payload),
+    },
+  );
+  return normalizePackageFirewallAction(response);
+}
+
+export async function runPackageAudit(): Promise<PackageFirewallActionResponse> {
+  const response = await readJson<unknown>("/v1/supply-chain/audit", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...guardAuthHeaders(),
+    },
+    body: JSON.stringify({}),
+  });
+  return normalizePackageFirewallAction(response);
+}
+
+export async function runPackageSync(): Promise<PackageFirewallActionResponse> {
+  const response = await readJson<unknown>("/v1/supply-chain/sync", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...guardAuthHeaders(),
+    },
+    body: JSON.stringify({}),
+  });
+  return normalizePackageFirewallAction(response);
+}
+
 export type EvidencePageData = {
   receipts: GuardReceipt[];
 };

{plugin_scanner-2.0.368 → plugin_scanner-2.0.370}/dashboard/src/guard-types.ts

@@ -506,3 +506,62 @@ export type GuardSettingsExport = {
   privacy_warning: string;
   settings: GuardSettings;
 };
+
+export const PACKAGE_FIREWALL_ACTION_TYPES = ["install", "repair", "test", "remove"] as const;
+export type PackageFirewallActionType = (typeof PACKAGE_FIREWALL_ACTION_TYPES)[number];
+export const PACKAGE_FIREWALL_GLOBAL_ACTION_TYPES = ["audit", "sync"] as const;
+export type PackageFirewallGlobalActionType = (typeof PACKAGE_FIREWALL_GLOBAL_ACTION_TYPES)[number];
+
+export type PackageFirewallActionState = "available" | "paid_required" | "pending" | "disabled";
+
+export type PackageFirewallEntitlement = {
+  allowed: boolean;
+  reason: string;
+  tier: string;
+  upgrade_cta: string | null;
+  upgrade_url: string | null;
+};
+
+export type PackageShimEntry = {
+  active: boolean;
+  installed: boolean;
+  integrity: string;
+  manager: string;
+  path_index: number | null;
+  real_binary_found: boolean;
+  real_binary_path: string | null;
+  real_binary_path_index: number | null;
+  shim_path: string | null;
+};
+
+export type PackageFirewallReceipt = {
+  id: string;
+  operation: string;
+  status: string;
+  timestamp: string;
+};
+
+export type PackageFirewallCliFallback = {
+  install?: string;
+  status?: string;
+  remove?: string;
+};
+
+export type PackageFirewallStatusResponse = {
+  operation: string;
+  status: string;
+  supported_managers: string[];
+  package_shims: PackageShimEntry[];
+  entitlement: PackageFirewallEntitlement;
+  actions: Partial<Record<PackageFirewallActionType | PackageFirewallGlobalActionType, PackageFirewallActionState>>;
+  cli_fallback: PackageFirewallCliFallback | null;
+};
+
+export type PackageFirewallActionResponse = {
+  operation: string;
+  status: string;
+  result: string;
+  result_detail: Record<string, unknown>;
+  receipt: PackageFirewallReceipt | null;
+  entitlement: PackageFirewallEntitlement;
+};

{plugin_scanner-2.0.368 → plugin_scanner-2.0.370}/dashboard/src/home-dashboard.test.ts

@@ -148,6 +148,12 @@ for (const { harness, expected } of displayNames) {
   );
 }
 
+assert(harnessDisplayName(undefined as unknown as string) === "Unknown app", "L095: harnessDisplayName handles undefined gracefully");
+assert(harnessDisplayName(null as unknown as string) === "Unknown app", "L095: harnessDisplayName handles null gracefully");
+assert(harnessDisplayName({} as unknown as string) === "Unknown app", "L095: harnessDisplayName handles object gracefully");
+assert(harnessDisplayName([] as unknown as string) === "Unknown app", "L095: harnessDisplayName handles array gracefully");
+assert(harnessDisplayName(42 as unknown as string) === "Unknown app", "L095: harnessDisplayName handles number gracefully");
+
 const queuedCountForInbox = (pendingCount: number): string => {
   const state = buildHomePrimaryState(pendingCount, 1);
   return state.ctaLabel;