plugin-scanner 2.0.553__tar.gz → 2.0.555__tar.gz

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.553
+Version: 2.0.555
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/dashboard/src/guard-api.ts

@@ -2143,17 +2143,78 @@ function normalizePackageFirewallConnectFlow(
   };
 }
 
+function readPackageShimField(
+  status: Record<string, unknown>,
+  snakeKey: string,
+  camelKey: string,
+): unknown {
+  if (status[snakeKey] !== undefined) {
+    return status[snakeKey];
+  }
+  return status[camelKey];
+}
+
+function readPackageShimStringArray(
+  status: Record<string, unknown>,
+  snakeKey: string,
+  camelKey: string,
+): string[] {
+  return normalizeStringArray(readPackageShimField(status, snakeKey, camelKey));
+}
+
+function buildPackageShimPathSummary(detail: Record<string, unknown> | null): string | null {
+  if (detail === null) {
+    return null;
+  }
+  const shimPath = stringValue(detail.shim_path);
+  const realBinaryPath = stringValue(detail.real_binary_path);
+  if (shimPath !== null && realBinaryPath !== null) {
+    return `${shimPath} precedes ${realBinaryPath}`;
+  }
+  if (shimPath !== null) {
+    return shimPath;
+  }
+  return stringValue(detail.path_state);
+}
+
+function readLastInterceptProofAtByManager(status: Record<string, unknown>): Record<string, string> {
+  const merged: Record<string, string> = {};
+  const sources = [
+    readPackageShimField(status, "last_intercept_proof_at", "lastInterceptProofAt"),
+    readPackageShimField(status, "last_test_at", "lastTestAt"),
+  ];
+  for (const source of sources) {
+    if (!isRecord(source)) {
+      continue;
+    }
+    for (const [manager, timestamp] of Object.entries(source)) {
+      const normalized = stringValue(timestamp);
+      if (normalized !== null) {
+        merged[manager] = normalized;
+      }
+    }
+  }
+  return merged;
+}
+
 function normalizePackageShimEntry(
   manager: string,
   detail: Record<string, unknown> | null,
   pathStatus: PackageManagerProtection["path_status"],
+  coverage: {
+    detected: boolean;
+    pathBroken: boolean;
+    tested: boolean;
+    lastInterceptProofAt: string | null;
+  },
 ): PackageShimEntry {
   const integrity = stringValue(detail?.integrity) ?? "uninstalled";
   const installed = detail !== null && integrity !== "missing";
   const active = booleanValue(detail?.path_active);
+  const pathBroken = coverage.pathBroken || detail?.path_broken === true;
   const activation_state = !installed
     ? "uninstalled"
-    : integrity === "tampered"
+    : integrity === "tampered" || pathBroken
     ? "repair_required"
     : active
     ? "protected"
@@ -2163,14 +2224,19 @@ function normalizePackageShimEntry(
   return {
     active,
     activation_state,
+    detected: coverage.detected,
     installed,
     integrity,
+    last_intercept_proof_at: coverage.lastInterceptProofAt,
     manager,
+    path_broken: pathBroken,
     path_index: numberValue(detail?.path_index),
+    path_summary: buildPackageShimPathSummary(detail),
     real_binary_found: booleanValue(detail?.real_binary_found),
     real_binary_path: stringValue(detail?.real_binary_path),
     real_binary_path_index: numberValue(detail?.real_binary_path_index),
     shim_path: stringValue(detail?.shim_path),
+    tested: coverage.tested,
   };
 }
 
@@ -2180,9 +2246,8 @@ function normalizePackageShimEntries(
   pathStatus: PackageManagerProtection["path_status"],
 ): PackageShimEntry[] {
   const status = isRecord(value) ? value : {};
-  const detailRows = Array.isArray(status.manager_details)
-    ? status.manager_details.filter(isRecord)
-    : [];
+  const managerDetailsValue = readPackageShimField(status, "manager_details", "managerDetails");
+  const detailRows = Array.isArray(managerDetailsValue) ? managerDetailsValue.filter(isRecord) : [];
   const detailByManager = new Map<string, Record<string, unknown>>();
   for (const detail of detailRows) {
     const manager = stringValue(detail.manager);
@@ -2190,15 +2255,45 @@ function normalizePackageShimEntries(
       detailByManager.set(manager, detail);
     }
   }
+  const detectedManagers = readPackageShimStringArray(status, "detected_managers", "detectedManagers");
+  const installedManagers = readPackageShimStringArray(status, "installed_managers", "installedManagers");
+  const testedManagers = readPackageShimStringArray(status, "tested_managers", "testedManagers");
+  const pathBrokenManagers = new Set([
+    ...readPackageShimStringArray(status, "path_broken_managers", "pathBrokenManagers"),
+  ]);
+  const bypassesValue = readPackageShimField(status, "bypasses", "bypasses");
+  if (Array.isArray(bypassesValue)) {
+    for (const entry of bypassesValue) {
+      if (!isRecord(entry)) {
+        continue;
+      }
+      const manager = stringValue(entry.manager);
+      if (manager !== null) {
+        pathBrokenManagers.add(manager);
+      }
+    }
+  }
+  const lastInterceptProofAtByManager = readLastInterceptProofAtByManager(status);
+  const detectedSet = new Set(detectedManagers);
+  const installedSet = new Set(installedManagers);
+  const testedSet = new Set(testedManagers);
   const managers = new Set([
-    ...supportedManagers,
-    ...normalizeStringArray(status.installed_managers),
-    ...normalizeStringArray(status.active_managers),
+    ...detectedManagers,
+    ...installedManagers,
+    ...testedManagers,
     ...detailByManager.keys(),
   ]);
   return Array.from(managers)
+    .filter((manager) => detectedSet.has(manager) || installedSet.has(manager) || testedSet.has(manager))
     .sort()
-    .map((manager) => normalizePackageShimEntry(manager, detailByManager.get(manager) ?? null, pathStatus));
+    .map((manager) =>
+      normalizePackageShimEntry(manager, detailByManager.get(manager) ?? null, pathStatus, {
+        detected: detectedSet.has(manager),
+        pathBroken: pathBrokenManagers.has(manager),
+        tested: testedSet.has(manager),
+        lastInterceptProofAt: lastInterceptProofAtByManager[manager] ?? null,
+      }),
+    );
 }
 
 function actionResultSummary(operation: string, detail: Record<string, unknown>): string {
@@ -2216,17 +2311,19 @@ function actionResultSummary(operation: string, detail: Record<string, unknown>)
   return `${operation} completed.`;
 }
 
-function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusResponse {
+export function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusResponse {
   const record = isRecord(value) ? value : {};
   const supportedManagers = normalizeStringArray(record.supported_managers);
   const shimStatus = isRecord(record.package_shims) ? record.package_shims : {};
-  const installedManagers = normalizeStringArray(shimStatus.installed_managers);
-  const activeManagers = normalizeStringArray(shimStatus.active_managers);
-  const missingManagers = normalizeStringArray(shimStatus.missing_managers);
+  const installedManagers = readPackageShimStringArray(shimStatus, "installed_managers", "installedManagers");
+  const activeManagers = readPackageShimStringArray(shimStatus, "active_managers", "activeManagers");
+  const missingManagers = readPackageShimStringArray(shimStatus, "missing_managers", "missingManagers");
+  const detectedManagers = readPackageShimStringArray(shimStatus, "detected_managers", "detectedManagers");
+  const pathStatusValue = readPackageShimField(shimStatus, "path_status", "pathStatus");
   const rawPathStatus =
-    shimStatus["path_status"] === "in_path"
+    pathStatusValue === "in_path"
       ? "in_path"
-      : shimStatus["path_status"] === "restart_required"
+      : pathStatusValue === "restart_required"
       ? "restart_required"
       : "missing_from_path";
   const packageShims = normalizePackageShimEntries(record.package_shims, supportedManagers, rawPathStatus);
@@ -2234,13 +2331,19 @@ function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusRe
     .filter((shim) => shim.activation_state === "protected")
     .map((shim) => shim.manager);
   const protectedSet = new Set(protectedManagers);
+  const lastAuditProofAt =
+    stringValue(readPackageShimField(shimStatus, "last_audit_proof_at", "lastAuditProofAt")) ?? null;
+  const shellProfilePath = readPackageShimField(shimStatus, "shell_profile_path", "shellProfilePath");
   const protection: PackageManagerProtection = {
     path_status: rawPathStatus,
-    path_contains_shim_dir: shimStatus["path_contains_shim_dir"] === true,
-    restart_shell_required: shimStatus["restart_shell_required"] === true,
-    shell_profile_configured: shimStatus["shell_profile_configured"] === true,
-    shell_profile_path: isStringOrNull(shimStatus["shell_profile_path"]) ? shimStatus["shell_profile_path"] : null,
-    shim_dir: stringValue(shimStatus["shim_dir"]) ?? "",
+    path_contains_shim_dir:
+      readPackageShimField(shimStatus, "path_contains_shim_dir", "pathContainsShimDir") === true,
+    restart_shell_required:
+      readPackageShimField(shimStatus, "restart_shell_required", "restartShellRequired") === true,
+    shell_profile_configured:
+      readPackageShimField(shimStatus, "shell_profile_configured", "shellProfileConfigured") === true,
+    shell_profile_path: isStringOrNull(shellProfilePath) ? (shellProfilePath as string | null) : null,
+    shim_dir: stringValue(readPackageShimField(shimStatus, "shim_dir", "shimDir")) ?? "",
     supported_managers: supportedManagers,
     installed_managers: installedManagers,
     active_managers: activeManagers,
@@ -2252,7 +2355,9 @@ function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusRe
     actions: normalizePackageFirewallActions(record.actions),
     cli_fallback: normalizePackageFirewallCliFallback(record.cli_fallback),
     connect_flow: normalizePackageFirewallConnectFlow(record.connect_flow),
+    detected_managers: detectedManagers,
     entitlement: normalizePackageFirewallEntitlement(record.entitlement),
+    last_audit_proof_at: lastAuditProofAt,
     operation: stringValue(record.operation) ?? "status",
     package_shims: packageShims,
     protection,

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/dashboard/src/guard-types.ts

@@ -653,14 +653,19 @@ export type PackageFirewallEntitlement = {
 export type PackageShimEntry = {
   active: boolean;
   activation_state: "protected" | "restart_required" | "repair_required" | "uninstalled";
+  detected: boolean;
   installed: boolean;
   integrity: string;
+  last_intercept_proof_at: string | null;
   manager: string;
+  path_broken: boolean;
   path_index: number | null;
+  path_summary: string | null;
   real_binary_found: boolean;
   real_binary_path: string | null;
   real_binary_path_index: number | null;
   shim_path: string | null;
+  tested: boolean;
 };
 
 export type PackageFirewallReceipt = {
@@ -693,6 +698,8 @@ export type PackageFirewallStatusResponse = {
   operation: string;
   status: string;
   supported_managers: string[];
+  detected_managers: string[];
+  last_audit_proof_at: string | null;
   protection: PackageManagerProtection | null;
   package_shims: PackageShimEntry[];
   entitlement: PackageFirewallEntitlement;

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/dashboard/src/package-firewall-connect.test.tsx

@@ -71,19 +71,26 @@ const connectRequiredStatus: PackageFirewallStatusResponse = {
   operation: "status",
   status: "completed",
   supported_managers: ["npm", "pnpm"],
+  detected_managers: ["pnpm"],
+  last_audit_proof_at: null,
   protection: null,
   package_shims: [
     {
       active: false,
       activation_state: "repair_required",
+      detected: true,
       installed: true,
       integrity: "ok",
+      last_intercept_proof_at: null,
       manager: "pnpm",
+      path_broken: false,
       path_index: null,
+      path_summary: "/guard-home/package-shims/bin/pnpm precedes /opt/homebrew/bin/pnpm",
       real_binary_found: true,
       real_binary_path: "/opt/homebrew/bin/pnpm",
       real_binary_path_index: 2,
       shim_path: "/guard-home/package-shims/bin/pnpm",
+      tested: false,
     },
   ],
   entitlement: {

plugin_scanner-2.0.555/dashboard/src/scsr-phase09-package-firewall-status.test.ts

@@ -0,0 +1,117 @@
+import { normalizePackageFirewallStatus } from "./guard-api";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const phase11Payload = normalizePackageFirewallStatus({
+  supported_managers: ["npm", "pnpm", "pip"],
+  package_shims: {
+    detectedManagers: ["npm", "pnpm"],
+    installedManagers: ["npm"],
+    protectedManagers: ["npm"],
+    testedManagers: ["npm"],
+    pathBrokenManagers: ["pnpm"],
+    path_status: "in_path",
+    lastAuditProofAt: "2026-06-07T12:00:00Z",
+    lastInterceptProofAt: {
+      npm: "2026-06-07T11:30:00Z",
+    },
+    manager_details: [
+      {
+        manager: "npm",
+        integrity: "ok",
+        path_active: true,
+        shim_path: "/tmp/guard-shims/npm",
+        real_binary_path: "/usr/local/bin/npm",
+      },
+      {
+        manager: "pnpm",
+        integrity: "ok",
+        path_active: false,
+        shim_path: "/tmp/guard-shims/pnpm",
+        real_binary_path: "/usr/local/bin/pnpm",
+      },
+    ],
+  },
+});
+
+assert(phase11Payload.detected_managers.length === 2, "SCSR151: detected managers surface on status response");
+assert(
+  phase11Payload.last_audit_proof_at === "2026-06-07T12:00:00Z",
+  "SCSR151: last audit proof timestamp surfaces on status response",
+);
+
+const npm = phase11Payload.package_shims.find((entry) => entry.manager === "npm");
+const pnpm = phase11Payload.package_shims.find((entry) => entry.manager === "pnpm");
+
+assert(npm !== undefined, "SCSR151: npm shim entry exists");
+assert(pnpm !== undefined, "SCSR151: pnpm shim entry exists");
+assert(npm?.detected === true, "SCSR151: npm marked detected");
+assert(npm?.tested === true, "SCSR151: npm marked tested");
+assert(
+  npm?.last_intercept_proof_at === "2026-06-07T11:30:00Z",
+  "SCSR151: npm intercept proof timestamp normalized",
+);
+assert(
+  npm?.path_summary === "/tmp/guard-shims/npm precedes /usr/local/bin/npm",
+  "SCSR151: npm path summary built from shim and real binary paths",
+);
+assert(pnpm?.path_broken === true, "SCSR151: pnpm marked path broken");
+assert(pnpm?.activation_state === "repair_required", "SCSR151: path broken manager needs repair");
+
+const nestedPayload = normalizePackageFirewallStatus({
+  supported_managers: ["npm"],
+  package_shims: {
+    detected_managers: ["npm"],
+    installed_managers: ["npm"],
+    tested_managers: ["npm"],
+    path_broken_managers: [],
+    path_status: "restart_required",
+    last_intercept_proof_at: {
+      npm: "2026-06-07T10:00:00Z",
+    },
+    manager_details: [
+      {
+        manager: "npm",
+        integrity: "ok",
+        path_active: false,
+        shim_path: "/tmp/guard-shims/npm",
+      },
+    ],
+  },
+});
+
+const nestedNpm = nestedPayload.package_shims.find((entry) => entry.manager === "npm");
+assert(
+  nestedNpm?.activation_state === "restart_required",
+  "SCSR151: restart_required path status maps to restart activation state",
+);
+assert(
+  nestedNpm?.last_intercept_proof_at === "2026-06-07T10:00:00Z",
+  "SCSR151: snake_case intercept proof map is read",
+);
+
+const hiddenManagerPayload = normalizePackageFirewallStatus({
+  supported_managers: ["npm", "yarn"],
+  package_shims: {
+    detectedManagers: ["npm"],
+    installedManagers: [],
+    testedManagers: [],
+    path_status: "in_path",
+    manager_details: [],
+  },
+});
+
+assert(
+  hiddenManagerPayload.package_shims.length === 1,
+  "SCSR151: undetected unsupported managers stay hidden",
+);
+assert(
+  hiddenManagerPayload.package_shims[0]?.manager === "npm",
+  "SCSR151: only detected managers render in shim list",
+);
+
+console.log("scsr-phase09-package-firewall-status.test.ts: all assertions passed");

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -9,9 +9,11 @@ import {
   HiMiniBeaker,
   HiMiniTrash,
   HiMiniCheckCircle,
+  HiMiniClock,
   HiMiniMagnifyingGlass,
   HiMiniXCircle,
 } from "react-icons/hi2";
+import { formatRelativeTime } from "./approval-center-utils";
 import { ApprovalProofModal } from "./approval-proof-modal";
 import { SectionLabel, Tag, ActionButton, IconActionButton, EmptyState } from "./approval-center-primitives";
 import type {
@@ -63,9 +65,18 @@ function resolveShimStatus(shim: PackageShimEntry | undefined): {
   tone: "green" | "blue" | "attention" | "slate";
   icon: "check" | "restart" | "warning" | "none";
 } {
-  if (!shim || !shim.installed) {
+  if (!shim) {
     return { label: "Unprotected", tone: "attention", icon: "warning" };
   }
+  if (!shim.installed && shim.detected) {
+    return { label: "Detected, not protected", tone: "slate", icon: "warning" };
+  }
+  if (!shim.installed) {
+    return { label: "Unprotected", tone: "attention", icon: "warning" };
+  }
+  if (shim.path_broken) {
+    return { label: "PATH broken", tone: "attention", icon: "warning" };
+  }
   if (shim.activation_state === "protected") {
     return { label: "Protected", tone: "green", icon: "check" };
   }
@@ -126,7 +137,10 @@ function ManagerRow({
   const removeAvailable = actionIsAvailable(removeState);
 
   const showInstall = (!shim || !shim.installed) && installAvailable;
-  const showRepair = shim?.installed && shim.activation_state === "repair_required" && repairAvailable;
+  const showRepair =
+    shim?.installed &&
+    (shim.activation_state === "repair_required" || shim.path_broken) &&
+    repairAvailable;
   const showTest = shim?.installed && shim.activation_state === "protected" && testAvailable;
   const showRemove = shim?.installed && removeAvailable;
 
@@ -139,21 +153,42 @@ function ManagerRow({
   return (
     <div className="border-b border-slate-100 last:border-b-0" role="row">
       <div className="flex flex-col gap-2 px-4 py-3 sm:flex-row sm:items-center sm:justify-between">
-        <div className="flex min-w-0 items-center gap-2" role="cell">
-          {status.icon === "check" ? (
-            <HiMiniCheckCircle className="h-4 w-4 shrink-0 text-brand-green" aria-hidden="true" />
-          ) : status.icon === "restart" ? (
-            <HiMiniArrowPath className="h-4 w-4 shrink-0 text-brand-blue" aria-hidden="true" />
-          ) : (
-            <HiMiniExclamationTriangle className="h-4 w-4 shrink-0 text-brand-attention" aria-hidden="true" />
-          )}
-          <span className="truncate font-mono text-sm font-semibold text-brand-dark">{manager}</span>
-          {isMine && (
-            <HiMiniArrowPath
-              className="h-3.5 w-3.5 shrink-0 animate-spin text-brand-blue"
-              aria-label="Running…"
-            />
+        <div className="flex min-w-0 flex-col gap-1 sm:flex-1" role="cell">
+          <div className="flex min-w-0 items-center gap-2">
+            {status.icon === "check" ? (
+              <HiMiniCheckCircle className="h-4 w-4 shrink-0 text-brand-green" aria-hidden="true" />
+            ) : status.icon === "restart" ? (
+              <HiMiniArrowPath className="h-4 w-4 shrink-0 text-brand-blue" aria-hidden="true" />
+            ) : (
+              <HiMiniExclamationTriangle className="h-4 w-4 shrink-0 text-brand-attention" aria-hidden="true" />
+            )}
+            <span className="truncate font-mono text-sm font-semibold text-brand-dark">{manager}</span>
+            {shim?.detected && (
+              <Tag tone="green">Detected</Tag>
+            )}
+            {isMine && (
+              <HiMiniArrowPath
+                className="h-3.5 w-3.5 shrink-0 animate-spin text-brand-blue"
+                aria-label="Running…"
+              />
+            )}
+          </div>
+          {shim?.path_summary !== null && shim?.path_summary !== undefined && (
+            <p className="break-all pl-6 font-mono text-[11px] leading-relaxed text-slate-500">
+              PATH: {shim.path_summary}
+            </p>
           )}
+          {shim?.last_intercept_proof_at !== null && shim?.last_intercept_proof_at !== undefined ? (
+            <p className="flex items-center gap-1.5 pl-6 text-[11px] text-slate-500">
+              <HiMiniCheckCircle className="h-3.5 w-3.5 shrink-0 text-brand-green" aria-hidden="true" />
+              Last intercept proof {formatRelativeTime(shim.last_intercept_proof_at)}
+            </p>
+          ) : shim?.installed ? (
+            <p className="flex items-center gap-1.5 pl-6 text-[11px] text-slate-500">
+              <HiMiniClock className="h-3.5 w-3.5 shrink-0" aria-hidden="true" />
+              No intercept proof recorded yet
+            </p>
+          ) : null}
         </div>
 
         <div className="flex flex-wrap items-center gap-2 sm:gap-3" role="cell">
@@ -161,7 +196,7 @@ function ManagerRow({
             <Tag tone={status.tone}>{status.label}</Tag>
           </div>
 
-          <div className="shrink-0">
+          <div className="shrink-0 [&_button]:min-h-11 [&_button]:h-11">
             {isConfirmingRemove ? (
               <div className="flex items-center gap-1.5">
                 <IconActionButton
@@ -239,9 +274,11 @@ function ManagerRow({
         </div>
       )}
 
-      {shim?.shim_path !== null && shim?.shim_path !== undefined && (
+      {shim?.path_broken && (
         <div className="px-4 pb-2">
-          <p className="break-all font-mono text-[10px] text-slate-400">{shim.shim_path}</p>
+          <p className="text-xs text-brand-attention">
+            Restart your shell after repair so PATH exports reload.
+          </p>
         </div>
       )}
     </div>
@@ -413,7 +450,13 @@ function FirewallControlsView({
 
   const filteredManagers = useMemo(() => {
     const shimsByManager = new Map(data.package_shims.map((s) => [s.manager, s]));
-    let managers = data.supported_managers;
+    const visibleManagers = data.package_shims
+      .filter((shim) => shim.detected || shim.installed || shim.tested)
+      .map((shim) => shim.manager);
+    let managers =
+      visibleManagers.length > 0
+        ? Array.from(new Set(visibleManagers)).sort()
+        : data.supported_managers;
 
     if (managerFilter) {
       const q = managerFilter.toLowerCase();
@@ -450,6 +493,7 @@ function FirewallControlsView({
 
       <ActivationSummary
         activationAssistError={activationAssistError}
+        lastAuditProofAt={data.last_audit_proof_at}
         openingShell={openingShell}
         onOpenShell={onOpenShell}
         onRefreshStatus={onRefreshStatus}

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/dashboard/src/supply-chain-firewall-views.tsx

@@ -13,6 +13,7 @@ import type {
   PackageFirewallActionResponse,
   PackageFirewallEntitlement,
 } from "./guard-types";
+import { formatRelativeTime } from "./approval-center-utils";
 import { resolvePackageManagerProtectionCopy } from "./runtime-overview";
 
 type UpgradeCtaProps = {
@@ -386,6 +387,7 @@ function activationHeadline(protection: PackageManagerProtection | null): string
 
 type ActivationSummaryProps = {
   activationAssistError: string | null;
+  lastAuditProofAt?: string | null;
   openingShell: boolean;
   onOpenShell: () => void;
   onRefreshStatus: () => void;
@@ -394,6 +396,7 @@ type ActivationSummaryProps = {
 
 export function ActivationSummary({
   activationAssistError,
+  lastAuditProofAt = null,
   openingShell,
   onOpenShell,
   onRefreshStatus,
@@ -432,6 +435,11 @@ export function ActivationSummary({
         <div className="min-w-0">
           <p className="text-sm font-medium text-brand-dark">{activationHeadline(protection)}</p>
           <p className="mt-0.5 text-xs text-slate-600">{copy.pathDetail}</p>
+          {lastAuditProofAt !== null && (
+            <p className="mt-1 text-xs text-slate-500">
+              Last audit proof {formatRelativeTime(lastAuditProofAt)}
+            </p>
+          )}
           {protection.path_status === "restart_required" && (
             <div className="mt-3 flex flex-wrap items-center gap-2">
               {canOpenShell && (

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.553"
+version = "2.0.555"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.553"
+version = "2.0.555"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.553 → plugin_scanner-2.0.555}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -103,6 +103,7 @@ from ..package_firewall_entitlement import (
     package_firewall_block_details,
     package_firewall_operation_allowed,
 )
+from ..package_shim_status import record_package_shim_audit_result
 from ..receipts.manager import build_receipt
 from ..runtime.runner import (
     GuardSyncAuthorizationExpiredError,
@@ -2027,6 +2028,8 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 workspace_dir=context.workspace_dir,
             )
             audit_payload["exit_code"] = exit_code
+            if exit_code == 0:
+                record_package_shim_audit_result(context, audited_at=now)
             return audit_payload
         if operation == "sync":
             return sync_supply_chain_bundle(self.server.store)  # type: ignore[attr-defined]