plugin-scanner 2.0.557__tar.gz → 2.0.559__tar.gz

{plugin_scanner-2.0.557 → plugin_scanner-2.0.559}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.557
+Version: 2.0.559
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.559/dashboard/src/scsr-phase09c-evidence-rail.test.ts

@@ -0,0 +1,177 @@
+import type { GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
+import {
+  deriveSupplyChainEvidenceRail,
+  resolveSupplyChainCloudDegradedState,
+  supplyChainEvidenceHref,
+} from "./supply-chain-evidence-rail";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const baseSnapshot: GuardRuntimeSnapshot = {
+  generated_at: new Date().toISOString(),
+  approval_center_url: null,
+  runtime_state: {},
+  device: {
+    installation_id: "install-1",
+    device_label: "Test Machine",
+    local_registered: false,
+  },
+  latest_connect_state: null,
+  proof_status: {
+    state: "not_connected",
+    label: "Not connected",
+    detail: "",
+    request_id: null,
+    pairing_completed_at: null,
+    first_synced_at: null,
+    receipts_stored: 0,
+    inventory_items: 0,
+    runtime_session_id: null,
+    runtime_session_synced_at: null,
+  },
+  pending_count: 0,
+  receipt_count: 0,
+  headline_state: "local_only",
+  headline_label: "Local only",
+  headline_detail: "",
+  sync_configured: false,
+  cloud_state: "local_only",
+  cloud_state_label: "Offline, free",
+  cloud_state_detail: "Running locally without Guard Cloud.",
+  cloud_pairing_state: {
+    state: "local_only",
+    label: "Not connected",
+    detail: "",
+    sync_configured: false,
+    dashboard_url: "",
+    inbox_url: "",
+    fleet_url: "",
+    connect_url: "",
+  },
+  cloud_sync_health: {
+    state: "disabled",
+    label: "Sync disabled",
+    detail: "Cloud sync is turned off.",
+    pending_events: 0,
+    last_synced_at: null,
+    next_retry_after: null,
+  },
+  dashboard_url: "",
+  inbox_url: "",
+  fleet_url: "",
+  connect_url: "",
+  items: [],
+  latest_receipts: [],
+  managed_installs: [],
+  supply_chain: undefined,
+};
+
+const blockReceipt: GuardReceipt = {
+  receipt_id: "receipt-block-1",
+  harness: "claude",
+  artifact_id: "package-request:lodash",
+  artifact_hash: "hash-block",
+  policy_decision: "block",
+  capabilities_summary: "Guard blocked lodash before install.",
+  changed_capabilities: [],
+  provenance_summary: "",
+  user_override: null,
+  artifact_name: "lodash@4.17.20",
+  source_scope: "/workspace",
+  timestamp: "2026-06-09T14:00:00.000Z",
+};
+
+const auditReceipt: GuardReceipt = {
+  receipt_id: "receipt-audit-1",
+  harness: "package-firewall",
+  artifact_id: "headless:package-firewall:audit",
+  artifact_hash: "hash-audit",
+  policy_decision: "warn",
+  capabilities_summary: "Workspace audit completed with warn decision across 3 packages.",
+  changed_capabilities: ["audit"],
+  provenance_summary: "",
+  user_override: null,
+  artifact_name: "Workspace supply-chain audit",
+  source_scope: "/workspace",
+  timestamp: "2026-06-09T13:00:00.000Z",
+  scanner_evidence: [
+    {
+      operation: "audit",
+      audit_decision: "warn",
+      blocked_package_count: 1,
+      total_packages: 3,
+    },
+  ] as unknown as GuardReceipt["scanner_evidence"],
+};
+
+const syncReceipt: GuardReceipt = {
+  receipt_id: "receipt-sync-1",
+  harness: "package-firewall",
+  artifact_id: "headless:package-firewall:sync",
+  artifact_hash: "hash-sync",
+  policy_decision: "allow",
+  capabilities_summary: "Guard refreshed local supply-chain policy.",
+  changed_capabilities: ["sync"],
+  provenance_summary: "",
+  user_override: null,
+  artifact_name: "Headless sync",
+  source_scope: "local-daemon",
+  timestamp: "2026-06-09T12:00:00.000Z",
+  scanner_evidence: [
+    {
+      operation: "sync",
+      status: "completed",
+    },
+  ] as unknown as GuardReceipt["scanner_evidence"],
+};
+
+const rail = deriveSupplyChainEvidenceRail([syncReceipt, auditReceipt, blockReceipt]);
+
+assert(rail.block.receiptId === "receipt-block-1", "SCSR154: latest block receipt surfaces on evidence rail");
+assert(rail.block.title.includes("lodash"), "SCSR154: block title includes package name");
+assert(rail.audit.receiptId === "receipt-audit-1", "SCSR154: latest audit receipt surfaces on evidence rail");
+assert(rail.sync.receiptId === "receipt-sync-1", "SCSR154: latest sync receipt surfaces on evidence rail");
+
+const emptyRail = deriveSupplyChainEvidenceRail([]);
+assert(emptyRail.block.timestamp === null, "SCSR154-B: empty receipts keep waiting block state");
+assert(emptyRail.audit.timestamp === null, "SCSR154-B: empty receipts keep waiting audit state");
+assert(emptyRail.sync.timestamp === null, "SCSR154-B: empty receipts keep waiting sync state");
+
+const cloudDegraded = resolveSupplyChainCloudDegradedState(baseSnapshot);
+assert(cloudDegraded.active, "SCSR163: local_only cloud state activates degraded banner");
+assert(
+  cloudDegraded.detail.includes("Running locally without Guard Cloud"),
+  "SCSR163: degraded banner uses snapshot cloud detail",
+);
+
+const pairedSnapshot = { ...baseSnapshot, cloud_state: "paired_active" as const };
+assert(!resolveSupplyChainCloudDegradedState(pairedSnapshot).active, "SCSR163-B: paired cloud clears degraded banner");
+
+const href = supplyChainEvidenceHref("receipt-audit-1", "package-firewall");
+assert(href !== null && href.includes("receipt-audit-1"), "SCSR154-C: evidence href encodes receipt id");
+assert(href !== null && href.includes("harness=package-firewall"), "SCSR154-D: audit evidence href keeps harness");
+
+const blockedHref = supplyChainEvidenceHref("receipt-block-1", "claude");
+assert(blockedHref !== null && blockedHref.includes("harness=claude"), "SCSR154-E: block evidence href uses receipt harness");
+
+const blockedAuditReceipt: GuardReceipt = {
+  ...auditReceipt,
+  receipt_id: "receipt-audit-block-1",
+  policy_decision: "block",
+  timestamp: "2026-06-09T15:00:00.000Z",
+};
+const mixedRail = deriveSupplyChainEvidenceRail([blockedAuditReceipt, blockReceipt]);
+assert(
+  mixedRail.block.receiptId === "receipt-block-1",
+  "SCSR154-F: blocked audit receipts stay in audit slot, not block slot",
+);
+assert(
+  mixedRail.audit.receiptId === "receipt-audit-block-1",
+  "SCSR154-G: blocked audit receipts still surface in audit slot",
+);
+
+console.log("scsr-phase09c-evidence-rail.test.ts: all assertions passed");

plugin_scanner-2.0.559/dashboard/src/scsr-phase09d-intercept-drawer.test.ts

@@ -0,0 +1,80 @@
+import {
+  parseInterceptProofSnapshot,
+  parsePackageFirewallActionResult,
+} from "./supply-chain-firewall-action-result";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const provedPayload = {
+  operation: "test",
+  status: "completed",
+  result: "completed",
+  result_detail: {
+    intercept_proved: true,
+    tested_managers: ["npm"],
+    path_repair_required: [],
+    manager_results: [
+      {
+        manager: "npm",
+        intercept_ran: true,
+        evaluator_invoked: true,
+      },
+    ],
+  },
+  receipt: {
+    id: "receipt-test-1",
+    operation: "test",
+    status: "completed",
+    timestamp: "2026-06-09T16:00:00.000Z",
+  },
+};
+
+const failedPayload = {
+  operation: "test",
+  status: "completed",
+  result_detail: {
+    intercept_proved: false,
+    tested_managers: ["npm"],
+    path_repair_required: ["npm"],
+    manager_results: [
+      {
+        manager: "npm",
+        intercept_ran: false,
+        skipped_reason: "path_inactive",
+      },
+    ],
+  },
+};
+
+const proved = parseInterceptProofSnapshot(provedPayload);
+assert(proved !== null, "SCSR157: intercept proof snapshot parses from test response");
+assert(proved!.interceptProved, "SCSR157: intercept_proved true surfaces in snapshot");
+assert(proved!.managerResults.length === 1, "SCSR157: manager_results normalize");
+assert(proved!.receiptId === "receipt-test-1", "SCSR157: proof receipt id surfaces");
+assert(proved!.tone === "success", "SCSR157: proved test uses success tone");
+
+const failed = parseInterceptProofSnapshot(failedPayload);
+assert(failed !== null, "SCSR157-B: failed intercept proof still parses");
+assert(!failed!.interceptProved, "SCSR157-B: intercept_proved false preserved");
+assert(
+  failed!.managerResults[0]?.skippedReason === "path_inactive",
+  "SCSR157-B: skipped reason preserved",
+);
+assert(
+  failed!.pathRepairRequired.includes("npm"),
+  "SCSR157-B: path repair managers preserved",
+);
+
+const parsedResult = parsePackageFirewallActionResult("test", failedPayload);
+assert(parsedResult !== null, "SCSR157-C: action result parser handles intercept proof");
+assert(parsedResult!.tone === "warning", "SCSR157-C: failed intercept proof warns in inline result");
+assert(
+  parsedResult!.lines.some((line) => line.includes("path inactive")),
+  "SCSR157-C: skipped reason appears in inline lines",
+);
+
+console.log("scsr-phase09d-intercept-drawer.test.ts: all assertions passed");

plugin_scanner-2.0.559/dashboard/src/supply-chain-evidence-rail-panel.tsx

@@ -0,0 +1,119 @@
+import {
+  HiMiniArrowTopRightOnSquare,
+  HiMiniArrowPath,
+  HiMiniDocumentMagnifyingGlass,
+  HiMiniShieldExclamation,
+} from "react-icons/hi2";
+import { SectionLabel, Tag } from "./approval-center-primitives";
+import { formatRelativeTime } from "./approval-center-utils";
+import type {
+  SupplyChainCloudDegradedState,
+  SupplyChainEvidenceRailItem,
+  SupplyChainEvidenceRailSnapshot,
+} from "./supply-chain-evidence-rail";
+import { supplyChainEvidenceHref } from "./supply-chain-evidence-rail";
+
+type SupplyChainEvidenceRailProps = {
+  rail: SupplyChainEvidenceRailSnapshot;
+};
+
+const kindLabels: Record<SupplyChainEvidenceRailItem["kind"], string> = {
+  block: "Last block",
+  audit: "Last audit",
+  sync: "Last sync",
+};
+
+const kindIcons: Record<SupplyChainEvidenceRailItem["kind"], typeof HiMiniShieldExclamation> = {
+  block: HiMiniShieldExclamation,
+  audit: HiMiniDocumentMagnifyingGlass,
+  sync: HiMiniArrowPath,
+};
+
+type EvidenceRailRowProps = {
+  item: SupplyChainEvidenceRailItem;
+};
+
+function EvidenceRailRow({ item }: EvidenceRailRowProps) {
+  const Icon = kindIcons[item.kind];
+  const href = supplyChainEvidenceHref(item.receiptId, item.harness);
+  const tagTone = item.tone === "green" ? "green" : item.tone === "attention" ? "attention" : "slate";
+
+  return (
+    <div className="px-4 py-3">
+      <div className="flex items-start gap-3">
+        <span
+          className="inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-slate-50 text-slate-500"
+          aria-hidden="true"
+        >
+          <Icon className="h-4 w-4" />
+        </span>
+        <div className="min-w-0 flex-1 space-y-1.5">
+          <div className="flex flex-wrap items-center gap-2">
+            <p className="text-[11px] font-semibold uppercase tracking-[0.16em] text-slate-400">
+              {kindLabels[item.kind]}
+            </p>
+            {item.timestamp !== null ? (
+              <Tag tone={tagTone}>{formatRelativeTime(item.timestamp)}</Tag>
+            ) : (
+              <Tag tone="slate">Waiting</Tag>
+            )}
+          </div>
+          <p className="text-sm font-medium text-brand-dark">{item.title}</p>
+          <p className="text-xs leading-relaxed text-slate-500">{item.detail}</p>
+          {href !== null ? (
+            <a
+              href={href}
+              className="inline-flex items-center gap-1 text-xs font-medium text-brand-blue hover:underline focus:outline-none focus:ring-2 focus:ring-brand-blue/30 rounded"
+            >
+              Open evidence
+              <HiMiniArrowTopRightOnSquare className="h-3.5 w-3.5" aria-hidden="true" />
+            </a>
+          ) : null}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export function SupplyChainEvidenceRail({ rail }: SupplyChainEvidenceRailProps) {
+  return (
+    <section
+      className="overflow-hidden rounded-2xl border border-slate-100 bg-white shadow-sm"
+      aria-label="Recent supply chain evidence"
+      data-testid="supply-chain-evidence-rail"
+    >
+      <div className="border-b border-slate-100 px-4 py-3">
+        <SectionLabel>Recent evidence</SectionLabel>
+        <p className="mt-1 text-sm text-slate-500">
+          Latest block, audit, and policy sync recorded on this machine.
+        </p>
+      </div>
+      <div className="divide-y divide-slate-100">
+        <EvidenceRailRow item={rail.block} />
+        <EvidenceRailRow item={rail.audit} />
+        <EvidenceRailRow item={rail.sync} />
+      </div>
+    </section>
+  );
+}
+
+type SupplyChainCloudDegradedBannerProps = {
+  state: SupplyChainCloudDegradedState;
+};
+
+export function SupplyChainCloudDegradedBanner({ state }: SupplyChainCloudDegradedBannerProps) {
+  if (!state.active) {
+    return null;
+  }
+
+  return (
+    <div
+      className="rounded-2xl border border-amber-200 bg-amber-50/70 px-4 py-3"
+      role="status"
+      data-testid="supply-chain-cloud-degraded"
+    >
+      <p className="text-sm font-medium text-amber-950">{state.title}</p>
+      <p className="mt-1 text-xs leading-relaxed text-amber-900/90">{state.detail}</p>
+    </div>
+  );
+}

plugin_scanner-2.0.559/dashboard/src/supply-chain-evidence-rail.ts

@@ -0,0 +1,227 @@
+import type { GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
+
+export type SupplyChainEvidenceRailKind = "block" | "audit" | "sync";
+
+export type SupplyChainEvidenceRailItem = {
+  kind: SupplyChainEvidenceRailKind;
+  timestamp: string | null;
+  title: string;
+  detail: string;
+  receiptId: string | null;
+  harness: string | null;
+  tone: "green" | "attention" | "slate";
+};
+
+export type SupplyChainEvidenceRailSnapshot = {
+  block: SupplyChainEvidenceRailItem;
+  audit: SupplyChainEvidenceRailItem;
+  sync: SupplyChainEvidenceRailItem;
+};
+
+export type SupplyChainCloudDegradedState = {
+  active: boolean;
+  title: string;
+  detail: string;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readOperation(value: unknown): string | null {
+  if (!isRecord(value) || typeof value.operation !== "string") {
+    return null;
+  }
+  const trimmed = value.operation.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function receiptEvidenceOperations(receipt: GuardReceipt): string[] {
+  const operations: string[] = [];
+  for (const entry of receipt.scanner_evidence ?? []) {
+    const operation = readOperation(entry);
+    if (operation !== null) {
+      operations.push(operation);
+    }
+  }
+  return operations;
+}
+
+function isPackageBlockReceipt(receipt: GuardReceipt): boolean {
+  if (receipt.policy_decision !== "block") {
+    return false;
+  }
+  const operations = receiptEvidenceOperations(receipt);
+  if (operations.includes("audit") || operations.includes("sync")) {
+    return false;
+  }
+  if (receipt.harness === "package-firewall") {
+    return true;
+  }
+  const artifactName = receipt.artifact_name?.toLowerCase() ?? "";
+  const artifactId = receipt.artifact_id.toLowerCase();
+  const summary = receipt.capabilities_summary.toLowerCase();
+  return (
+    artifactName.includes("package") ||
+    artifactId.includes("package") ||
+    summary.includes("install") ||
+    summary.includes("package")
+  );
+}
+
+function emptyRailItem(kind: SupplyChainEvidenceRailKind): SupplyChainEvidenceRailItem {
+  const labels: Record<SupplyChainEvidenceRailKind, { title: string; detail: string }> = {
+    block: {
+      title: "No blocked installs yet",
+      detail: "Guard will record the last prevented package install here.",
+    },
+    audit: {
+      title: "No workspace audit yet",
+      detail: "Run an audit to scan lockfiles and manifest paths on this machine.",
+    },
+    sync: {
+      title: "No policy sync yet",
+      detail: "Sync pulls the latest Guard supply-chain policy to this device.",
+    },
+  };
+  return {
+    kind,
+    timestamp: null,
+    title: labels[kind].title,
+    detail: labels[kind].detail,
+    receiptId: null,
+    harness: null,
+    tone: "slate",
+  };
+}
+
+function blockRailItem(receipt: GuardReceipt): SupplyChainEvidenceRailItem {
+  const label = receipt.artifact_name?.trim();
+  return {
+    kind: "block",
+    timestamp: receipt.timestamp,
+    title: label !== undefined && label.length > 0 ? `Blocked: ${label}` : "Blocked package install",
+    detail:
+      receipt.capabilities_summary.trim().length > 0
+        ? receipt.capabilities_summary
+        : "Guard blocked a package install before it completed.",
+    receiptId: receipt.receipt_id,
+    harness: receipt.harness,
+    tone: "attention",
+  };
+}
+
+function auditRailItem(receipt: GuardReceipt): SupplyChainEvidenceRailItem {
+  const evidence = (receipt.scanner_evidence ?? []).find(
+    (entry) => readOperation(entry) === "audit",
+  );
+  const decision =
+    isRecord(evidence) && typeof evidence.audit_decision === "string"
+      ? evidence.audit_decision
+      : receipt.policy_decision;
+  const blockedCount =
+    isRecord(evidence) && typeof evidence.blocked_package_count === "number"
+      ? evidence.blocked_package_count
+      : 0;
+  const totalPackages =
+    isRecord(evidence) && typeof evidence.total_packages === "number"
+      ? evidence.total_packages
+      : blockedCount;
+  const detail =
+    receipt.capabilities_summary.trim().length > 0
+      ? receipt.capabilities_summary
+      : `Workspace audit returned ${decision} across ${totalPackages} package(s).`;
+  return {
+    kind: "audit",
+    timestamp: receipt.timestamp,
+    title: blockedCount > 0 ? `Audit flagged ${blockedCount} package(s)` : "Workspace audit completed",
+    detail,
+    receiptId: receipt.receipt_id,
+    harness: receipt.harness,
+    tone: blockedCount > 0 || decision === "block" ? "attention" : "green",
+  };
+}
+
+function syncRailItem(receipt: GuardReceipt): SupplyChainEvidenceRailItem {
+  return {
+    kind: "sync",
+    timestamp: receipt.timestamp,
+    title: "Policy sync completed",
+    detail:
+      receipt.capabilities_summary.trim().length > 0
+        ? receipt.capabilities_summary
+        : "Guard refreshed local supply-chain policy from the connected source.",
+    receiptId: receipt.receipt_id,
+    harness: receipt.harness,
+    tone: "green",
+  };
+}
+
+function latestReceiptMatching(
+  receipts: GuardReceipt[],
+  predicate: (receipt: GuardReceipt) => boolean,
+): GuardReceipt | null {
+  const matches = receipts
+    .filter(predicate)
+    .sort((left, right) => Date.parse(right.timestamp) - Date.parse(left.timestamp));
+  return matches[0] ?? null;
+}
+
+export function deriveSupplyChainEvidenceRail(
+  receipts: GuardReceipt[],
+): SupplyChainEvidenceRailSnapshot {
+  const blockReceipt = latestReceiptMatching(receipts, isPackageBlockReceipt);
+  const auditReceipt = latestReceiptMatching(receipts, (receipt) => {
+    if (receipt.harness !== "package-firewall") {
+      return false;
+    }
+    return receiptEvidenceOperations(receipt).includes("audit");
+  });
+  const syncReceipt = latestReceiptMatching(receipts, (receipt) => {
+    if (receipt.harness !== "package-firewall") {
+      return false;
+    }
+    return receiptEvidenceOperations(receipt).includes("sync");
+  });
+
+  return {
+    block: blockReceipt !== null ? blockRailItem(blockReceipt) : emptyRailItem("block"),
+    audit: auditReceipt !== null ? auditRailItem(auditReceipt) : emptyRailItem("audit"),
+    sync: syncReceipt !== null ? syncRailItem(syncReceipt) : emptyRailItem("sync"),
+  };
+}
+
+export function resolveSupplyChainCloudDegradedState(
+  snapshot: GuardRuntimeSnapshot,
+): SupplyChainCloudDegradedState {
+  if (snapshot.cloud_state !== "local_only") {
+    return {
+      active: false,
+      title: "",
+      detail: "",
+    };
+  }
+  return {
+    active: true,
+    title: "Guard Cloud unavailable on this device",
+    detail:
+      snapshot.cloud_state_detail.trim().length > 0
+        ? snapshot.cloud_state_detail
+        : "Local protection still runs, but live intel, fleet sync, and cross-device evidence stay offline until you connect Guard Cloud.",
+  };
+}
+
+export function supplyChainEvidenceHref(
+  receiptId: string | null,
+  harness: string | null,
+): string | null {
+  if (receiptId === null) {
+    return null;
+  }
+  const params = new URLSearchParams();
+  if (harness !== null && harness.trim().length > 0) {
+    params.set("harness", harness);
+  }
+  params.set("search", receiptId);
+  return `/evidence?${params.toString()}`;
+}