plugin-scanner 2.0.554__tar.gz → 2.0.556__tar.gz

{plugin_scanner-2.0.554 → plugin_scanner-2.0.556}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.554
+Version: 2.0.556
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.554 → plugin_scanner-2.0.556}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.554 → plugin_scanner-2.0.556}/dashboard/src/guard-api.ts

@@ -2143,17 +2143,78 @@ function normalizePackageFirewallConnectFlow(
   };
 }
 
+function readPackageShimField(
+  status: Record<string, unknown>,
+  snakeKey: string,
+  camelKey: string,
+): unknown {
+  if (status[snakeKey] !== undefined) {
+    return status[snakeKey];
+  }
+  return status[camelKey];
+}
+
+function readPackageShimStringArray(
+  status: Record<string, unknown>,
+  snakeKey: string,
+  camelKey: string,
+): string[] {
+  return normalizeStringArray(readPackageShimField(status, snakeKey, camelKey));
+}
+
+function buildPackageShimPathSummary(detail: Record<string, unknown> | null): string | null {
+  if (detail === null) {
+    return null;
+  }
+  const shimPath = stringValue(detail.shim_path);
+  const realBinaryPath = stringValue(detail.real_binary_path);
+  if (shimPath !== null && realBinaryPath !== null) {
+    return `${shimPath} precedes ${realBinaryPath}`;
+  }
+  if (shimPath !== null) {
+    return shimPath;
+  }
+  return stringValue(detail.path_state);
+}
+
+function readLastInterceptProofAtByManager(status: Record<string, unknown>): Record<string, string> {
+  const merged: Record<string, string> = {};
+  const sources = [
+    readPackageShimField(status, "last_intercept_proof_at", "lastInterceptProofAt"),
+    readPackageShimField(status, "last_test_at", "lastTestAt"),
+  ];
+  for (const source of sources) {
+    if (!isRecord(source)) {
+      continue;
+    }
+    for (const [manager, timestamp] of Object.entries(source)) {
+      const normalized = stringValue(timestamp);
+      if (normalized !== null) {
+        merged[manager] = normalized;
+      }
+    }
+  }
+  return merged;
+}
+
 function normalizePackageShimEntry(
   manager: string,
   detail: Record<string, unknown> | null,
   pathStatus: PackageManagerProtection["path_status"],
+  coverage: {
+    detected: boolean;
+    pathBroken: boolean;
+    tested: boolean;
+    lastInterceptProofAt: string | null;
+  },
 ): PackageShimEntry {
   const integrity = stringValue(detail?.integrity) ?? "uninstalled";
   const installed = detail !== null && integrity !== "missing";
   const active = booleanValue(detail?.path_active);
+  const pathBroken = coverage.pathBroken || detail?.path_broken === true;
   const activation_state = !installed
     ? "uninstalled"
-    : integrity === "tampered"
+    : integrity === "tampered" || pathBroken
     ? "repair_required"
     : active
     ? "protected"
@@ -2163,14 +2224,19 @@ function normalizePackageShimEntry(
   return {
     active,
     activation_state,
+    detected: coverage.detected,
     installed,
     integrity,
+    last_intercept_proof_at: coverage.lastInterceptProofAt,
     manager,
+    path_broken: pathBroken,
     path_index: numberValue(detail?.path_index),
+    path_summary: buildPackageShimPathSummary(detail),
     real_binary_found: booleanValue(detail?.real_binary_found),
     real_binary_path: stringValue(detail?.real_binary_path),
     real_binary_path_index: numberValue(detail?.real_binary_path_index),
     shim_path: stringValue(detail?.shim_path),
+    tested: coverage.tested,
   };
 }
 
@@ -2180,9 +2246,8 @@ function normalizePackageShimEntries(
   pathStatus: PackageManagerProtection["path_status"],
 ): PackageShimEntry[] {
   const status = isRecord(value) ? value : {};
-  const detailRows = Array.isArray(status.manager_details)
-    ? status.manager_details.filter(isRecord)
-    : [];
+  const managerDetailsValue = readPackageShimField(status, "manager_details", "managerDetails");
+  const detailRows = Array.isArray(managerDetailsValue) ? managerDetailsValue.filter(isRecord) : [];
   const detailByManager = new Map<string, Record<string, unknown>>();
   for (const detail of detailRows) {
     const manager = stringValue(detail.manager);
@@ -2190,15 +2255,45 @@ function normalizePackageShimEntries(
       detailByManager.set(manager, detail);
     }
   }
+  const detectedManagers = readPackageShimStringArray(status, "detected_managers", "detectedManagers");
+  const installedManagers = readPackageShimStringArray(status, "installed_managers", "installedManagers");
+  const testedManagers = readPackageShimStringArray(status, "tested_managers", "testedManagers");
+  const pathBrokenManagers = new Set([
+    ...readPackageShimStringArray(status, "path_broken_managers", "pathBrokenManagers"),
+  ]);
+  const bypassesValue = readPackageShimField(status, "bypasses", "bypasses");
+  if (Array.isArray(bypassesValue)) {
+    for (const entry of bypassesValue) {
+      if (!isRecord(entry)) {
+        continue;
+      }
+      const manager = stringValue(entry.manager);
+      if (manager !== null) {
+        pathBrokenManagers.add(manager);
+      }
+    }
+  }
+  const lastInterceptProofAtByManager = readLastInterceptProofAtByManager(status);
+  const detectedSet = new Set(detectedManagers);
+  const installedSet = new Set(installedManagers);
+  const testedSet = new Set(testedManagers);
   const managers = new Set([
-    ...supportedManagers,
-    ...normalizeStringArray(status.installed_managers),
-    ...normalizeStringArray(status.active_managers),
+    ...detectedManagers,
+    ...installedManagers,
+    ...testedManagers,
     ...detailByManager.keys(),
   ]);
   return Array.from(managers)
+    .filter((manager) => detectedSet.has(manager) || installedSet.has(manager) || testedSet.has(manager))
     .sort()
-    .map((manager) => normalizePackageShimEntry(manager, detailByManager.get(manager) ?? null, pathStatus));
+    .map((manager) =>
+      normalizePackageShimEntry(manager, detailByManager.get(manager) ?? null, pathStatus, {
+        detected: detectedSet.has(manager),
+        pathBroken: pathBrokenManagers.has(manager),
+        tested: testedSet.has(manager),
+        lastInterceptProofAt: lastInterceptProofAtByManager[manager] ?? null,
+      }),
+    );
 }
 
 function actionResultSummary(operation: string, detail: Record<string, unknown>): string {
@@ -2216,17 +2311,19 @@ function actionResultSummary(operation: string, detail: Record<string, unknown>)
   return `${operation} completed.`;
 }
 
-function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusResponse {
+export function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusResponse {
   const record = isRecord(value) ? value : {};
   const supportedManagers = normalizeStringArray(record.supported_managers);
   const shimStatus = isRecord(record.package_shims) ? record.package_shims : {};
-  const installedManagers = normalizeStringArray(shimStatus.installed_managers);
-  const activeManagers = normalizeStringArray(shimStatus.active_managers);
-  const missingManagers = normalizeStringArray(shimStatus.missing_managers);
+  const installedManagers = readPackageShimStringArray(shimStatus, "installed_managers", "installedManagers");
+  const activeManagers = readPackageShimStringArray(shimStatus, "active_managers", "activeManagers");
+  const missingManagers = readPackageShimStringArray(shimStatus, "missing_managers", "missingManagers");
+  const detectedManagers = readPackageShimStringArray(shimStatus, "detected_managers", "detectedManagers");
+  const pathStatusValue = readPackageShimField(shimStatus, "path_status", "pathStatus");
   const rawPathStatus =
-    shimStatus["path_status"] === "in_path"
+    pathStatusValue === "in_path"
       ? "in_path"
-      : shimStatus["path_status"] === "restart_required"
+      : pathStatusValue === "restart_required"
       ? "restart_required"
       : "missing_from_path";
   const packageShims = normalizePackageShimEntries(record.package_shims, supportedManagers, rawPathStatus);
@@ -2234,13 +2331,19 @@ function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusRe
     .filter((shim) => shim.activation_state === "protected")
     .map((shim) => shim.manager);
   const protectedSet = new Set(protectedManagers);
+  const lastAuditProofAt =
+    stringValue(readPackageShimField(shimStatus, "last_audit_proof_at", "lastAuditProofAt")) ?? null;
+  const shellProfilePath = readPackageShimField(shimStatus, "shell_profile_path", "shellProfilePath");
   const protection: PackageManagerProtection = {
     path_status: rawPathStatus,
-    path_contains_shim_dir: shimStatus["path_contains_shim_dir"] === true,
-    restart_shell_required: shimStatus["restart_shell_required"] === true,
-    shell_profile_configured: shimStatus["shell_profile_configured"] === true,
-    shell_profile_path: isStringOrNull(shimStatus["shell_profile_path"]) ? shimStatus["shell_profile_path"] : null,
-    shim_dir: stringValue(shimStatus["shim_dir"]) ?? "",
+    path_contains_shim_dir:
+      readPackageShimField(shimStatus, "path_contains_shim_dir", "pathContainsShimDir") === true,
+    restart_shell_required:
+      readPackageShimField(shimStatus, "restart_shell_required", "restartShellRequired") === true,
+    shell_profile_configured:
+      readPackageShimField(shimStatus, "shell_profile_configured", "shellProfileConfigured") === true,
+    shell_profile_path: isStringOrNull(shellProfilePath) ? (shellProfilePath as string | null) : null,
+    shim_dir: stringValue(readPackageShimField(shimStatus, "shim_dir", "shimDir")) ?? "",
     supported_managers: supportedManagers,
     installed_managers: installedManagers,
     active_managers: activeManagers,
@@ -2252,7 +2355,9 @@ function normalizePackageFirewallStatus(value: unknown): PackageFirewallStatusRe
     actions: normalizePackageFirewallActions(record.actions),
     cli_fallback: normalizePackageFirewallCliFallback(record.cli_fallback),
     connect_flow: normalizePackageFirewallConnectFlow(record.connect_flow),
+    detected_managers: detectedManagers,
     entitlement: normalizePackageFirewallEntitlement(record.entitlement),
+    last_audit_proof_at: lastAuditProofAt,
     operation: stringValue(record.operation) ?? "status",
     package_shims: packageShims,
     protection,

{plugin_scanner-2.0.554 → plugin_scanner-2.0.556}/dashboard/src/guard-types.ts

@@ -653,14 +653,19 @@ export type PackageFirewallEntitlement = {
 export type PackageShimEntry = {
   active: boolean;
   activation_state: "protected" | "restart_required" | "repair_required" | "uninstalled";
+  detected: boolean;
   installed: boolean;
   integrity: string;
+  last_intercept_proof_at: string | null;
   manager: string;
+  path_broken: boolean;
   path_index: number | null;
+  path_summary: string | null;
   real_binary_found: boolean;
   real_binary_path: string | null;
   real_binary_path_index: number | null;
   shim_path: string | null;
+  tested: boolean;
 };
 
 export type PackageFirewallReceipt = {
@@ -693,6 +698,8 @@ export type PackageFirewallStatusResponse = {
   operation: string;
   status: string;
   supported_managers: string[];
+  detected_managers: string[];
+  last_audit_proof_at: string | null;
   protection: PackageManagerProtection | null;
   package_shims: PackageShimEntry[];
   entitlement: PackageFirewallEntitlement;

{plugin_scanner-2.0.554 → plugin_scanner-2.0.556}/dashboard/src/package-firewall-connect.test.tsx

@@ -71,19 +71,26 @@ const connectRequiredStatus: PackageFirewallStatusResponse = {
   operation: "status",
   status: "completed",
   supported_managers: ["npm", "pnpm"],
+  detected_managers: ["pnpm"],
+  last_audit_proof_at: null,
   protection: null,
   package_shims: [
     {
       active: false,
       activation_state: "repair_required",
+      detected: true,
       installed: true,
       integrity: "ok",
+      last_intercept_proof_at: null,
       manager: "pnpm",
+      path_broken: false,
       path_index: null,
+      path_summary: "/guard-home/package-shims/bin/pnpm precedes /opt/homebrew/bin/pnpm",
       real_binary_found: true,
       real_binary_path: "/opt/homebrew/bin/pnpm",
       real_binary_path_index: 2,
       shim_path: "/guard-home/package-shims/bin/pnpm",
+      tested: false,
     },
   ],
   entitlement: {

plugin_scanner-2.0.556/dashboard/src/scsr-phase09-next-action.test.ts

@@ -0,0 +1,100 @@
+import { parsePackageFirewallActionResult } from "./supply-chain-firewall-action-result";
+import { resolvePackageFirewallNextAction } from "./supply-chain-firewall-next-action";
+import type { PackageFirewallStatusResponse, PackageShimEntry } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function makeShim(overrides: Partial<PackageShimEntry> & Pick<PackageShimEntry, "manager">): PackageShimEntry {
+  return {
+    active: false,
+    activation_state: "uninstalled",
+    detected: false,
+    installed: false,
+    integrity: "missing",
+    last_intercept_proof_at: null,
+    path_broken: false,
+    path_index: null,
+    path_summary: null,
+    real_binary_found: false,
+    real_binary_path: null,
+    real_binary_path_index: null,
+    shim_path: null,
+    tested: false,
+    ...overrides,
+  };
+}
+
+const baseStatus: PackageFirewallStatusResponse = {
+  operation: "status",
+  status: "completed",
+  supported_managers: ["npm", "pnpm"],
+  detected_managers: ["npm"],
+  last_audit_proof_at: null,
+  protection: {
+    path_status: "in_path",
+    path_contains_shim_dir: true,
+    restart_shell_required: false,
+    shell_profile_configured: true,
+    shell_profile_path: null,
+    shim_dir: "/shims",
+    supported_managers: ["npm", "pnpm"],
+    installed_managers: [],
+    active_managers: [],
+    missing_shims: ["npm"],
+    protected_managers: [],
+    unprotected_managers: ["npm", "pnpm"],
+  },
+  package_shims: [
+    makeShim({ manager: "npm", detected: true, activation_state: "uninstalled" }),
+  ],
+  entitlement: {
+    allowed: true,
+    reason: "ok",
+    tier: "team",
+    upgrade_cta: null,
+    upgrade_url: null,
+  },
+  actions: {},
+  cli_fallback: null,
+  connect_flow: null,
+};
+
+const protectAction = resolvePackageFirewallNextAction(baseStatus);
+assert(protectAction.op === "install", "SCSR151: detected unprotected manager suggests install");
+assert(protectAction.manager === "npm", "SCSR151: next action targets detected manager");
+
+const pathBrokenStatus: PackageFirewallStatusResponse = {
+  ...baseStatus,
+  package_shims: [
+    makeShim({
+      manager: "pnpm",
+      detected: true,
+      installed: true,
+      integrity: "ok",
+      path_broken: true,
+      activation_state: "repair_required",
+    }),
+  ],
+};
+const repairAction = resolvePackageFirewallNextAction(pathBrokenStatus);
+assert(repairAction.op === "repair", "SCSR161: path broken manager suggests repair");
+
+const auditDetail = parsePackageFirewallActionResult("audit", {
+  result: {
+    decision: "monitor",
+    manifest_paths: ["package.json"],
+    lockfile_paths: ["package-lock.json"],
+    inventory: { packages: 4 },
+  },
+});
+assert(auditDetail !== null, "SCSR153: audit action result parses");
+assert(
+  auditDetail!.lines.some((line) => line.includes("package-lock.json")),
+  "SCSR153: audit result lists scanned lockfiles",
+);
+
+console.log("scsr-phase09-next-action.test.ts: all assertions passed");

plugin_scanner-2.0.556/dashboard/src/scsr-phase09-package-firewall-status.test.ts

@@ -0,0 +1,117 @@
+import { normalizePackageFirewallStatus } from "./guard-api";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const phase11Payload = normalizePackageFirewallStatus({
+  supported_managers: ["npm", "pnpm", "pip"],
+  package_shims: {
+    detectedManagers: ["npm", "pnpm"],
+    installedManagers: ["npm"],
+    protectedManagers: ["npm"],
+    testedManagers: ["npm"],
+    pathBrokenManagers: ["pnpm"],
+    path_status: "in_path",
+    lastAuditProofAt: "2026-06-07T12:00:00Z",
+    lastInterceptProofAt: {
+      npm: "2026-06-07T11:30:00Z",
+    },
+    manager_details: [
+      {
+        manager: "npm",
+        integrity: "ok",
+        path_active: true,
+        shim_path: "/tmp/guard-shims/npm",
+        real_binary_path: "/usr/local/bin/npm",
+      },
+      {
+        manager: "pnpm",
+        integrity: "ok",
+        path_active: false,
+        shim_path: "/tmp/guard-shims/pnpm",
+        real_binary_path: "/usr/local/bin/pnpm",
+      },
+    ],
+  },
+});
+
+assert(phase11Payload.detected_managers.length === 2, "SCSR151: detected managers surface on status response");
+assert(
+  phase11Payload.last_audit_proof_at === "2026-06-07T12:00:00Z",
+  "SCSR151: last audit proof timestamp surfaces on status response",
+);
+
+const npm = phase11Payload.package_shims.find((entry) => entry.manager === "npm");
+const pnpm = phase11Payload.package_shims.find((entry) => entry.manager === "pnpm");
+
+assert(npm !== undefined, "SCSR151: npm shim entry exists");
+assert(pnpm !== undefined, "SCSR151: pnpm shim entry exists");
+assert(npm?.detected === true, "SCSR151: npm marked detected");
+assert(npm?.tested === true, "SCSR151: npm marked tested");
+assert(
+  npm?.last_intercept_proof_at === "2026-06-07T11:30:00Z",
+  "SCSR151: npm intercept proof timestamp normalized",
+);
+assert(
+  npm?.path_summary === "/tmp/guard-shims/npm precedes /usr/local/bin/npm",
+  "SCSR151: npm path summary built from shim and real binary paths",
+);
+assert(pnpm?.path_broken === true, "SCSR151: pnpm marked path broken");
+assert(pnpm?.activation_state === "repair_required", "SCSR151: path broken manager needs repair");
+
+const nestedPayload = normalizePackageFirewallStatus({
+  supported_managers: ["npm"],
+  package_shims: {
+    detected_managers: ["npm"],
+    installed_managers: ["npm"],
+    tested_managers: ["npm"],
+    path_broken_managers: [],
+    path_status: "restart_required",
+    last_intercept_proof_at: {
+      npm: "2026-06-07T10:00:00Z",
+    },
+    manager_details: [
+      {
+        manager: "npm",
+        integrity: "ok",
+        path_active: false,
+        shim_path: "/tmp/guard-shims/npm",
+      },
+    ],
+  },
+});
+
+const nestedNpm = nestedPayload.package_shims.find((entry) => entry.manager === "npm");
+assert(
+  nestedNpm?.activation_state === "restart_required",
+  "SCSR151: restart_required path status maps to restart activation state",
+);
+assert(
+  nestedNpm?.last_intercept_proof_at === "2026-06-07T10:00:00Z",
+  "SCSR151: snake_case intercept proof map is read",
+);
+
+const hiddenManagerPayload = normalizePackageFirewallStatus({
+  supported_managers: ["npm", "yarn"],
+  package_shims: {
+    detectedManagers: ["npm"],
+    installedManagers: [],
+    testedManagers: [],
+    path_status: "in_path",
+    manager_details: [],
+  },
+});
+
+assert(
+  hiddenManagerPayload.package_shims.length === 1,
+  "SCSR151: undetected unsupported managers stay hidden",
+);
+assert(
+  hiddenManagerPayload.package_shims[0]?.manager === "npm",
+  "SCSR151: only detected managers render in shim list",
+);
+
+console.log("scsr-phase09-package-firewall-status.test.ts: all assertions passed");

plugin_scanner-2.0.556/dashboard/src/supply-chain-firewall-action-result.ts

@@ -0,0 +1,143 @@
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(value: unknown): string | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function readStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0)
+    .map((entry) => entry.trim());
+}
+
+export type PackageFirewallActionResultDetail = {
+  emptyState: boolean;
+  lines: string[];
+  summary: string;
+  tone: "success" | "warning" | "neutral";
+};
+
+function parseAuditActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const evaluation = isRecord(result.evaluation) ? result.evaluation : null;
+  const decision = readString(evaluation?.decision) ?? readString(result.decision) ?? "monitor";
+  const manifestPaths = readStringArray(result.manifest_paths);
+  const lockfilePaths = readStringArray(result.lockfile_paths);
+  const inventory = isRecord(result.inventory) ? result.inventory : null;
+  const packageCount = typeof inventory?.packages === "number" ? inventory.packages : null;
+  const lockfileWarnings = Array.isArray(result.lockfile_warnings)
+    ? result.lockfile_warnings.filter(isRecord)
+    : [];
+
+  const lines: string[] = [];
+  if (manifestPaths.length > 0) {
+    lines.push(`Manifests scanned: ${manifestPaths.join(", ")}.`);
+  }
+  if (lockfilePaths.length > 0) {
+    lines.push(`Lockfiles scanned: ${lockfilePaths.join(", ")}.`);
+  }
+  if (packageCount !== null) {
+    lines.push(`${packageCount} dependency ${packageCount === 1 ? "entry" : "entries"} indexed.`);
+  }
+  for (const warning of lockfileWarnings.slice(0, 3)) {
+    const message = readString(warning.message);
+    if (message !== null) {
+      lines.push(message);
+    }
+  }
+
+  const emptyState = manifestPaths.length === 0 && lockfilePaths.length === 0;
+  if (emptyState) {
+    lines.push("No workspace manifests or lockfiles were found for this audit scope.");
+  }
+
+  return {
+    emptyState,
+    lines,
+    summary: `Workspace audit completed with ${decision} decision.`,
+    tone: decision === "block" || decision === "ask" ? "warning" : "success",
+  };
+}
+
+function parseSyncActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const syncedAt =
+    readString(result.synced_at) ??
+    readString(result.generated_at) ??
+    readString(result.updated_at);
+  const receiptsStored = typeof result.receipts_stored === "number" ? result.receipts_stored : null;
+  const bundleVersion = readString(result.bundle_version);
+  const tier = readString(result.tier);
+
+  const lines: string[] = [];
+  if (syncedAt !== null) {
+    lines.push(`Cloud sync marker: ${syncedAt}.`);
+  }
+  if (receiptsStored !== null) {
+    lines.push(`${receiptsStored} receipt${receiptsStored === 1 ? "" : "s"} stored locally.`);
+  }
+  if (bundleVersion !== null) {
+    lines.push(`Advisory bundle ${bundleVersion}${tier ? ` (${tier})` : ""} is now active.`);
+  }
+
+  return {
+    emptyState: lines.length === 0,
+    lines,
+    summary: syncedAt
+      ? "Cloud intel sync completed. Feed freshness should update on the next status refresh."
+      : "Cloud intel sync completed.",
+    tone: "success",
+  };
+}
+
+function parseTestActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const testedManagers = readStringArray(result.tested_managers);
+  const lines =
+    testedManagers.length > 0
+      ? [`Intercept proof recorded for ${testedManagers.join(", ")}.`]
+      : ["Intercept test completed."];
+  return {
+    emptyState: false,
+    lines,
+    summary: "Intercept test completed.",
+    tone: "success",
+  };
+}
+
+export function parsePackageFirewallActionResult(
+  op: string,
+  body: unknown,
+): PackageFirewallActionResultDetail | null {
+  if (!isRecord(body)) {
+    return null;
+  }
+  let result: Record<string, unknown>;
+  if (isRecord(body.result)) {
+    result = body.result;
+  } else if (isRecord(body.result_detail)) {
+    result = body.result_detail;
+  } else {
+    result = body;
+  }
+  if (!isRecord(result)) {
+    return null;
+  }
+
+  if (op === "audit") {
+    return parseAuditActionResult(result);
+  }
+  if (op === "sync") {
+    return parseSyncActionResult(result);
+  }
+  if (op === "test") {
+    return parseTestActionResult(result);
+  }
+  return null;
+}