plugin-scanner 2.0.555__tar.gz → 2.0.556__tar.gz

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.555
+Version: 2.0.556
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

plugin_scanner-2.0.556/dashboard/src/scsr-phase09-next-action.test.ts

@@ -0,0 +1,100 @@
+import { parsePackageFirewallActionResult } from "./supply-chain-firewall-action-result";
+import { resolvePackageFirewallNextAction } from "./supply-chain-firewall-next-action";
+import type { PackageFirewallStatusResponse, PackageShimEntry } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function makeShim(overrides: Partial<PackageShimEntry> & Pick<PackageShimEntry, "manager">): PackageShimEntry {
+  return {
+    active: false,
+    activation_state: "uninstalled",
+    detected: false,
+    installed: false,
+    integrity: "missing",
+    last_intercept_proof_at: null,
+    path_broken: false,
+    path_index: null,
+    path_summary: null,
+    real_binary_found: false,
+    real_binary_path: null,
+    real_binary_path_index: null,
+    shim_path: null,
+    tested: false,
+    ...overrides,
+  };
+}
+
+const baseStatus: PackageFirewallStatusResponse = {
+  operation: "status",
+  status: "completed",
+  supported_managers: ["npm", "pnpm"],
+  detected_managers: ["npm"],
+  last_audit_proof_at: null,
+  protection: {
+    path_status: "in_path",
+    path_contains_shim_dir: true,
+    restart_shell_required: false,
+    shell_profile_configured: true,
+    shell_profile_path: null,
+    shim_dir: "/shims",
+    supported_managers: ["npm", "pnpm"],
+    installed_managers: [],
+    active_managers: [],
+    missing_shims: ["npm"],
+    protected_managers: [],
+    unprotected_managers: ["npm", "pnpm"],
+  },
+  package_shims: [
+    makeShim({ manager: "npm", detected: true, activation_state: "uninstalled" }),
+  ],
+  entitlement: {
+    allowed: true,
+    reason: "ok",
+    tier: "team",
+    upgrade_cta: null,
+    upgrade_url: null,
+  },
+  actions: {},
+  cli_fallback: null,
+  connect_flow: null,
+};
+
+const protectAction = resolvePackageFirewallNextAction(baseStatus);
+assert(protectAction.op === "install", "SCSR151: detected unprotected manager suggests install");
+assert(protectAction.manager === "npm", "SCSR151: next action targets detected manager");
+
+const pathBrokenStatus: PackageFirewallStatusResponse = {
+  ...baseStatus,
+  package_shims: [
+    makeShim({
+      manager: "pnpm",
+      detected: true,
+      installed: true,
+      integrity: "ok",
+      path_broken: true,
+      activation_state: "repair_required",
+    }),
+  ],
+};
+const repairAction = resolvePackageFirewallNextAction(pathBrokenStatus);
+assert(repairAction.op === "repair", "SCSR161: path broken manager suggests repair");
+
+const auditDetail = parsePackageFirewallActionResult("audit", {
+  result: {
+    decision: "monitor",
+    manifest_paths: ["package.json"],
+    lockfile_paths: ["package-lock.json"],
+    inventory: { packages: 4 },
+  },
+});
+assert(auditDetail !== null, "SCSR153: audit action result parses");
+assert(
+  auditDetail!.lines.some((line) => line.includes("package-lock.json")),
+  "SCSR153: audit result lists scanned lockfiles",
+);
+
+console.log("scsr-phase09-next-action.test.ts: all assertions passed");

plugin_scanner-2.0.556/dashboard/src/supply-chain-firewall-action-result.ts

@@ -0,0 +1,143 @@
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(value: unknown): string | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function readStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0)
+    .map((entry) => entry.trim());
+}
+
+export type PackageFirewallActionResultDetail = {
+  emptyState: boolean;
+  lines: string[];
+  summary: string;
+  tone: "success" | "warning" | "neutral";
+};
+
+function parseAuditActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const evaluation = isRecord(result.evaluation) ? result.evaluation : null;
+  const decision = readString(evaluation?.decision) ?? readString(result.decision) ?? "monitor";
+  const manifestPaths = readStringArray(result.manifest_paths);
+  const lockfilePaths = readStringArray(result.lockfile_paths);
+  const inventory = isRecord(result.inventory) ? result.inventory : null;
+  const packageCount = typeof inventory?.packages === "number" ? inventory.packages : null;
+  const lockfileWarnings = Array.isArray(result.lockfile_warnings)
+    ? result.lockfile_warnings.filter(isRecord)
+    : [];
+
+  const lines: string[] = [];
+  if (manifestPaths.length > 0) {
+    lines.push(`Manifests scanned: ${manifestPaths.join(", ")}.`);
+  }
+  if (lockfilePaths.length > 0) {
+    lines.push(`Lockfiles scanned: ${lockfilePaths.join(", ")}.`);
+  }
+  if (packageCount !== null) {
+    lines.push(`${packageCount} dependency ${packageCount === 1 ? "entry" : "entries"} indexed.`);
+  }
+  for (const warning of lockfileWarnings.slice(0, 3)) {
+    const message = readString(warning.message);
+    if (message !== null) {
+      lines.push(message);
+    }
+  }
+
+  const emptyState = manifestPaths.length === 0 && lockfilePaths.length === 0;
+  if (emptyState) {
+    lines.push("No workspace manifests or lockfiles were found for this audit scope.");
+  }
+
+  return {
+    emptyState,
+    lines,
+    summary: `Workspace audit completed with ${decision} decision.`,
+    tone: decision === "block" || decision === "ask" ? "warning" : "success",
+  };
+}
+
+function parseSyncActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const syncedAt =
+    readString(result.synced_at) ??
+    readString(result.generated_at) ??
+    readString(result.updated_at);
+  const receiptsStored = typeof result.receipts_stored === "number" ? result.receipts_stored : null;
+  const bundleVersion = readString(result.bundle_version);
+  const tier = readString(result.tier);
+
+  const lines: string[] = [];
+  if (syncedAt !== null) {
+    lines.push(`Cloud sync marker: ${syncedAt}.`);
+  }
+  if (receiptsStored !== null) {
+    lines.push(`${receiptsStored} receipt${receiptsStored === 1 ? "" : "s"} stored locally.`);
+  }
+  if (bundleVersion !== null) {
+    lines.push(`Advisory bundle ${bundleVersion}${tier ? ` (${tier})` : ""} is now active.`);
+  }
+
+  return {
+    emptyState: lines.length === 0,
+    lines,
+    summary: syncedAt
+      ? "Cloud intel sync completed. Feed freshness should update on the next status refresh."
+      : "Cloud intel sync completed.",
+    tone: "success",
+  };
+}
+
+function parseTestActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const testedManagers = readStringArray(result.tested_managers);
+  const lines =
+    testedManagers.length > 0
+      ? [`Intercept proof recorded for ${testedManagers.join(", ")}.`]
+      : ["Intercept test completed."];
+  return {
+    emptyState: false,
+    lines,
+    summary: "Intercept test completed.",
+    tone: "success",
+  };
+}
+
+export function parsePackageFirewallActionResult(
+  op: string,
+  body: unknown,
+): PackageFirewallActionResultDetail | null {
+  if (!isRecord(body)) {
+    return null;
+  }
+  let result: Record<string, unknown>;
+  if (isRecord(body.result)) {
+    result = body.result;
+  } else if (isRecord(body.result_detail)) {
+    result = body.result_detail;
+  } else {
+    result = body;
+  }
+  if (!isRecord(result)) {
+    return null;
+  }
+
+  if (op === "audit") {
+    return parseAuditActionResult(result);
+  }
+  if (op === "sync") {
+    return parseSyncActionResult(result);
+  }
+  if (op === "test") {
+    return parseTestActionResult(result);
+  }
+  return null;
+}

plugin_scanner-2.0.556/dashboard/src/supply-chain-firewall-next-action.ts

@@ -0,0 +1,87 @@
+import type { PackageFirewallStatusResponse } from "./guard-types";
+
+export type PackageFirewallNextAction = {
+  detail: string;
+  label: string;
+  manager: string | null;
+  op: "install" | "repair" | "test" | "sync" | null;
+};
+
+export function resolvePackageFirewallNextAction(
+  data: PackageFirewallStatusResponse | null,
+): PackageFirewallNextAction {
+  if (data === null) {
+    return {
+      detail: "Refresh status to see the next package firewall step on this machine.",
+      label: "Check package firewall status",
+      manager: null,
+      op: null,
+    };
+  }
+
+  const protection = data.protection;
+  const shims = data.package_shims;
+
+  const unprotectedDetected = shims.find(
+    (entry) => entry.detected && !entry.installed && entry.activation_state === "uninstalled",
+  );
+  if (unprotectedDetected) {
+    return {
+      detail: `${unprotectedDetected.manager} is on this machine but not protected yet.`,
+      label: `Protect ${unprotectedDetected.manager}`,
+      manager: unprotectedDetected.manager,
+      op: "install",
+    };
+  }
+
+  const pathBroken = shims.find((entry) => entry.path_broken);
+  if (pathBroken) {
+    return {
+      detail: `${pathBroken.manager} shim PATH order needs repair before installs are intercepted.`,
+      label: `Repair ${pathBroken.manager} PATH`,
+      manager: pathBroken.manager,
+      op: "repair",
+    };
+  }
+
+  if (protection?.path_status === "restart_required" || protection?.restart_shell_required) {
+    const protectedManager =
+      shims.find((entry) => entry.activation_state === "protected")?.manager ??
+      protection?.protected_managers[0] ??
+      null;
+    return {
+      detail: "Restart your shell so updated PATH exports load before testing intercepts.",
+      label: "Restart shell, then test intercept",
+      manager: protectedManager,
+      op: "test",
+    };
+  }
+
+  const untested = shims.find(
+    (entry) => entry.activation_state === "protected" && entry.last_intercept_proof_at === null,
+  );
+  if (untested) {
+    return {
+      detail: `${untested.manager} is protected but has no recent intercept proof.`,
+      label: `Run intercept test for ${untested.manager}`,
+      manager: untested.manager,
+      op: "test",
+    };
+  }
+
+  if (data.detected_managers.length === 0) {
+    return {
+      detail: "Guard did not detect package managers on this machine yet.",
+      label: "Install a package manager, then refresh",
+      manager: null,
+      op: null,
+    };
+  }
+
+  return {
+    detail: "Cloud intel and local shims look healthy. Sync if advisory bundles are stale.",
+    label: "Sync Cloud intel",
+    manager: null,
+    op: "sync",
+  };
+}

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -31,7 +31,13 @@ import {
   runPackageSync,
   startPackageFirewallConnect,
 } from "./guard-api";
-import { EntitlementNotice, ActionResultPanel, ActivationSummary } from "./supply-chain-firewall-views";
+import {
+  EntitlementNotice,
+  ActionResultPanel,
+  ActivationSummary,
+  NextActionHero,
+} from "./supply-chain-firewall-views";
+import { resolvePackageFirewallNextAction } from "./supply-chain-firewall-next-action";
 import type { CompletedOp } from "./supply-chain-firewall-views";
 import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
 
@@ -447,6 +453,31 @@ function FirewallControlsView({
   onRefreshStatus,
 }: FirewallControlsViewProps) {
   const anyPending = pendingOp !== null;
+  const nextAction = useMemo(() => resolvePackageFirewallNextAction(data), [data]);
+  const handleNextAction = useCallback(
+    (op: "install" | "repair" | "test" | "sync", manager: string | null) => {
+      if (op === "install" && manager !== null) {
+        onInstall(manager);
+        return;
+      }
+      if (op === "repair" && manager !== null) {
+        onRepair(manager);
+        return;
+      }
+      if (op === "test") {
+        if (manager !== null) {
+          onTest(manager);
+          return;
+        }
+        onOpenShell();
+        return;
+      }
+      if (op === "sync") {
+        onSync();
+      }
+    },
+    [onInstall, onOpenShell, onRepair, onSync, onTest],
+  );
 
   const filteredManagers = useMemo(() => {
     const shimsByManager = new Map(data.package_shims.map((s) => [s.manager, s]));
@@ -479,6 +510,8 @@ function FirewallControlsView({
 
   return (
     <div className="space-y-4 px-4 py-4">
+      <NextActionHero action={nextAction} anyPending={anyPending} onRunAction={handleNextAction} />
+
       <div className="flex flex-wrap items-center justify-between gap-2">
         <p className="text-sm font-medium text-brand-dark">Per-manager controls</p>
         {showGlobalActions && (

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/dashboard/src/supply-chain-firewall-views.tsx

@@ -1,3 +1,4 @@
+import { useCallback } from "react";
 import {
   HiMiniShieldCheck,
   HiMiniArrowTopRightOnSquare,
@@ -14,6 +15,8 @@ import type {
   PackageFirewallEntitlement,
 } from "./guard-types";
 import { formatRelativeTime } from "./approval-center-utils";
+import { parsePackageFirewallActionResult } from "./supply-chain-firewall-action-result";
+import type { PackageFirewallNextAction } from "./supply-chain-firewall-next-action";
 import { resolvePackageManagerProtectionCopy } from "./runtime-overview";
 
 type UpgradeCtaProps = {
@@ -515,6 +518,36 @@ export type CompletedOp = {
   response: PackageFirewallActionResponse;
 };
 
+type NextActionHeroProps = {
+  action: PackageFirewallNextAction;
+  anyPending: boolean;
+  onRunAction: (op: NonNullable<PackageFirewallNextAction["op"]>, manager: string | null) => void;
+};
+
+export function NextActionHero({ action, anyPending, onRunAction }: NextActionHeroProps) {
+  const handleClick = useCallback(() => {
+    if (action.op === null) {
+      return;
+    }
+    onRunAction(action.op, action.manager);
+  }, [action.manager, action.op, onRunAction]);
+
+  return (
+    <div className="rounded-2xl border border-brand-blue/15 bg-gradient-to-br from-brand-blue/[0.05] to-white px-4 py-4 sm:px-5 sm:py-5">
+      <p className="text-[10px] font-semibold uppercase tracking-[0.2em] text-brand-blue">Next step</p>
+      <p className="mt-2 text-lg font-semibold text-brand-dark">{action.label}</p>
+      <p className="mt-1 max-w-2xl text-sm leading-relaxed text-slate-600">{action.detail}</p>
+      {action.op !== null && (
+        <div className="mt-4">
+          <ActionButton variant="primary" onClick={handleClick} disabled={anyPending}>
+            {action.label}
+          </ActionButton>
+        </div>
+      )}
+    </div>
+  );
+}
+
 type ActionResultPanelProps = {
   completed: CompletedOp;
   onDismiss: () => void;
@@ -524,12 +557,19 @@ export function ActionResultPanel({ completed, onDismiss }: ActionResultPanelPro
   const { response } = completed;
   const isOk = ["completed", "ok", "success", "succeeded"].includes(response.status);
   const detail = response.result_detail;
-  const resultMessage =
-    detail["activation_state"] === "restart_required"
-      ? "Guard installed the shim and updated your shell profile. Open a new shell or restart AI apps to route package-manager commands through Guard."
-      : detail["activation_state"] === "in_path"
-      ? "Guard installed the shim and protection is live in this session."
-      : response.result;
+  const parsed = isOk ? parsePackageFirewallActionResult(completed.op, response) : null;
+  let resultMessage: string;
+  if (parsed?.summary != null) {
+    resultMessage = parsed.summary;
+  } else if (detail["activation_state"] === "restart_required") {
+    resultMessage =
+      "Guard installed the shim and updated your shell profile. Open a new shell or restart AI apps to route package-manager commands through Guard.";
+  } else if (detail["activation_state"] === "in_path") {
+    resultMessage = "Guard installed the shim and protection is live in this session.";
+  } else {
+    resultMessage = response.result;
+  }
+  const resultLines = parsed?.lines ?? [];
   return (
     <div
       className={`rounded-xl border px-4 py-3 ${
@@ -559,6 +599,13 @@ export function ActionResultPanel({ completed, onDismiss }: ActionResultPanelPro
               {completed.manager !== null ? ` — ${completed.manager}` : ""}
             </p>
             <p className="mt-0.5 text-xs text-slate-600">{resultMessage}</p>
+            {resultLines.length > 0 && (
+              <ul className="mt-2 space-y-1 text-xs text-slate-600">
+                {resultLines.map((line, index) => (
+                  <li key={index}>{line}</li>
+                ))}
+              </ul>
+            )}
           </div>
         </div>
         <DismissButton onDismiss={onDismiss} />

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.555"
+version = "2.0.556"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.555"
+version = "2.0.556"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/audit-workspace.js

@@ -1,5 +1,38 @@
-import { r as reactExports, aI as runAuditRemediation, am as GuardHarnessActionError, j as jsxRuntimeExports, B as Badge, S as SectionLabel, ab as HiMiniMagnifyingGlass, p as EmptyState, g as HiMiniCheckCircle, h as HiMiniXCircle, b as HiMiniExclamationTriangle, n as harnessDisplayName, f as formatRelativeTime, C as HiMiniChevronRight, A as ActionButton, aJ as HiMiniDocumentText, aK as guardAwareHref, aF as IconActionButton, ao as HiMiniArrowPath, H as HiMiniShieldCheck } from "../guard-dashboard.js";
+import { r as reactExports, aJ as runAuditRemediation, am as GuardHarnessActionError, j as jsxRuntimeExports, B as Badge, S as SectionLabel, ab as HiMiniMagnifyingGlass, p as EmptyState, g as HiMiniCheckCircle, h as HiMiniXCircle, b as HiMiniExclamationTriangle, n as harnessDisplayName, f as formatRelativeTime, C as HiMiniChevronRight, A as ActionButton, aK as HiMiniDocumentText, aL as guardAwareHref, aG as IconActionButton, ao as HiMiniArrowPath, H as HiMiniShieldCheck } from "../guard-dashboard.js";
 import { u as useResolvedApprovalGate, A as ApprovalProofModal } from "./use-resolved-approval-gate.js";
+function isSupplyChainAuditEvidence(value) {
+  return typeof value === "object" && value !== null && value.operation === "audit";
+}
+function auditSeverityForDecision(decision, blockedCount) {
+  if (decision === "block" || blockedCount > 0) {
+    return "high";
+  }
+  if (decision === "ask") {
+    return "medium";
+  }
+  if (decision === "warn") {
+    return "medium";
+  }
+  return "info";
+}
+function workspaceAuditTitle(decision) {
+  if (decision === "block") {
+    return "Workspace audit found blocked packages";
+  }
+  if (decision === "ask") {
+    return "Workspace audit needs review";
+  }
+  return "Workspace audit completed";
+}
+function workspaceAuditRemediation(decision, blockedCount) {
+  if (blockedCount > 0) {
+    return "Review blocked packages in Evidence and update lockfiles before retrying installs.";
+  }
+  if (decision === "ask") {
+    return "Review flagged packages and repair lockfiles before continuing.";
+  }
+  return "Re-run workspace audit after dependency changes.";
+}
 function deriveFrontendAuditResults(receipts, snapshot) {
   const results = [];
   const protection = snapshot.supply_chain?.package_manager_protection;
@@ -46,6 +79,38 @@ function deriveFrontendAuditResults(receipts, snapshot) {
       evidenceHref: `/evidence?${evidenceParams.toString()}`
     });
   }
+  for (const receipt of receipts) {
+    if (receipt.harness !== "package-firewall") {
+      continue;
+    }
+    const evidence = receipt.scanner_evidence?.find(isSupplyChainAuditEvidence);
+    if (evidence === void 0) {
+      continue;
+    }
+    const decision = typeof evidence.audit_decision === "string" ? evidence.audit_decision : "monitor";
+    const blockedCount = typeof evidence.blocked_package_count === "number" ? evidence.blocked_package_count : 0;
+    const totalPackages = typeof evidence.total_packages === "number" ? evidence.total_packages : blockedCount;
+    const manifestPaths = Array.isArray(evidence.manifest_paths) ? evidence.manifest_paths.filter((entry) => typeof entry === "string") : [];
+    const lockfilePaths = Array.isArray(evidence.lockfile_paths) ? evidence.lockfile_paths.filter((entry) => typeof entry === "string") : [];
+    const inventorySummary = [
+      manifestPaths.length > 0 ? `${manifestPaths.length} manifest(s)` : null,
+      lockfilePaths.length > 0 ? `${lockfilePaths.length} lockfile(s)` : null,
+      `${totalPackages} package(s)`
+    ].filter((entry) => entry !== null).join(", ");
+    results.push({
+      id: `workspace-audit-${receipt.receipt_id}`,
+      severity: auditSeverityForDecision(decision, blockedCount),
+      title: workspaceAuditTitle(decision),
+      detail: receipt.capabilities_summary || `Guard scanned ${inventorySummary} and returned a ${decision} decision.`,
+      harness: "package-firewall",
+      workspace: receipt.source_scope,
+      timestamp: receipt.timestamp,
+      remediation: workspaceAuditRemediation(decision, blockedCount),
+      remediationAction: null,
+      resolved: decision === "monitor" && blockedCount === 0,
+      evidenceHref: `/evidence?harness=package-firewall&search=${encodeURIComponent(receipt.receipt_id)}`
+    });
+  }
   if (snapshot.runtime_state === null) {
     results.push({
       id: "daemon-offline",

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/feed-health-workspace.js

@@ -1,4 +1,4 @@
-import { j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, b as HiMiniExclamationTriangle, ao as HiMiniArrowPath, g as HiMiniCheckCircle, aN as HiMiniSignal, h as HiMiniXCircle, aO as HiMiniClock, f as formatRelativeTime, B as Badge, T as Tag } from "../guard-dashboard.js";
+import { j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, b as HiMiniExclamationTriangle, ao as HiMiniArrowPath, g as HiMiniCheckCircle, aO as HiMiniSignal, h as HiMiniXCircle, aF as HiMiniClock, f as formatRelativeTime, B as Badge, T as Tag } from "../guard-dashboard.js";
 function resolveFeedSourceMode(cloudState) {
   if (cloudState === "local_only") return "sample";
   if (cloudState === "paired_waiting") return "full";

{plugin_scanner-2.0.555 → plugin_scanner-2.0.556}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/policy-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, S as SectionLabel, T as Tag, ab as HiMiniMagnifyingGlass, p as EmptyState, n as harnessDisplayName, B as Badge, aJ as HiMiniDocumentText, aK as guardAwareHref, ap as HiMiniTrash, A as ActionButton, g as HiMiniCheckCircle, aL as HiMiniBarsArrowUp, aM as HiMiniBarsArrowDown, f as formatRelativeTime } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, S as SectionLabel, T as Tag, ab as HiMiniMagnifyingGlass, p as EmptyState, n as harnessDisplayName, B as Badge, aK as HiMiniDocumentText, aL as guardAwareHref, ap as HiMiniTrash, A as ActionButton, g as HiMiniCheckCircle, aM as HiMiniBarsArrowUp, aN as HiMiniBarsArrowDown, f as formatRelativeTime } from "../guard-dashboard.js";
 function groupPoliciesByHarness(policies) {
   const map = /* @__PURE__ */ new Map();
   for (const p of policies) {