plugin-scanner 2.0.558__tar.gz → 2.0.560__tar.gz

{plugin_scanner-2.0.558 → plugin_scanner-2.0.560}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.558
+Version: 2.0.560
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.560/dashboard/src/scsr-phase09d-intercept-drawer.test.ts

@@ -0,0 +1,80 @@
+import {
+  parseInterceptProofSnapshot,
+  parsePackageFirewallActionResult,
+} from "./supply-chain-firewall-action-result";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const provedPayload = {
+  operation: "test",
+  status: "completed",
+  result: "completed",
+  result_detail: {
+    intercept_proved: true,
+    tested_managers: ["npm"],
+    path_repair_required: [],
+    manager_results: [
+      {
+        manager: "npm",
+        intercept_ran: true,
+        evaluator_invoked: true,
+      },
+    ],
+  },
+  receipt: {
+    id: "receipt-test-1",
+    operation: "test",
+    status: "completed",
+    timestamp: "2026-06-09T16:00:00.000Z",
+  },
+};
+
+const failedPayload = {
+  operation: "test",
+  status: "completed",
+  result_detail: {
+    intercept_proved: false,
+    tested_managers: ["npm"],
+    path_repair_required: ["npm"],
+    manager_results: [
+      {
+        manager: "npm",
+        intercept_ran: false,
+        skipped_reason: "path_inactive",
+      },
+    ],
+  },
+};
+
+const proved = parseInterceptProofSnapshot(provedPayload);
+assert(proved !== null, "SCSR157: intercept proof snapshot parses from test response");
+assert(proved!.interceptProved, "SCSR157: intercept_proved true surfaces in snapshot");
+assert(proved!.managerResults.length === 1, "SCSR157: manager_results normalize");
+assert(proved!.receiptId === "receipt-test-1", "SCSR157: proof receipt id surfaces");
+assert(proved!.tone === "success", "SCSR157: proved test uses success tone");
+
+const failed = parseInterceptProofSnapshot(failedPayload);
+assert(failed !== null, "SCSR157-B: failed intercept proof still parses");
+assert(!failed!.interceptProved, "SCSR157-B: intercept_proved false preserved");
+assert(
+  failed!.managerResults[0]?.skippedReason === "path_inactive",
+  "SCSR157-B: skipped reason preserved",
+);
+assert(
+  failed!.pathRepairRequired.includes("npm"),
+  "SCSR157-B: path repair managers preserved",
+);
+
+const parsedResult = parsePackageFirewallActionResult("test", failedPayload);
+assert(parsedResult !== null, "SCSR157-C: action result parser handles intercept proof");
+assert(parsedResult!.tone === "warning", "SCSR157-C: failed intercept proof warns in inline result");
+assert(
+  parsedResult!.lines.some((line) => line.includes("path inactive")),
+  "SCSR157-C: skipped reason appears in inline lines",
+);
+
+console.log("scsr-phase09d-intercept-drawer.test.ts: all assertions passed");

plugin_scanner-2.0.560/dashboard/src/scsr-phase09e-posture-banners.test.ts

@@ -0,0 +1,205 @@
+import { resolveSupplyChainPostureAlerts } from "./supply-chain-posture";
+import type { GuardRuntimeSnapshot, PackageManagerProtection } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const makeProtection = (
+  overrides: Partial<PackageManagerProtection> = {},
+): PackageManagerProtection => ({
+  path_status: "in_path",
+  path_contains_shim_dir: true,
+  restart_shell_required: false,
+  shell_profile_configured: true,
+  shell_profile_path: null,
+  shim_dir: "/shims",
+  supported_managers: ["npm", "pip"],
+  installed_managers: [],
+  active_managers: [],
+  missing_shims: [],
+  protected_managers: [],
+  unprotected_managers: ["npm", "pip"],
+  ...overrides,
+});
+
+const baseSnapshot: GuardRuntimeSnapshot = {
+  generated_at: new Date().toISOString(),
+  approval_center_url: null,
+  runtime_state: {},
+  device: {
+    installation_id: "install-1",
+    device_label: "Test Machine",
+    local_registered: false,
+  },
+  latest_connect_state: null,
+  proof_status: {
+    state: "not_connected",
+    label: "Not connected",
+    detail: "",
+    request_id: null,
+    pairing_completed_at: null,
+    first_synced_at: null,
+    receipts_stored: 0,
+    inventory_items: 0,
+    runtime_session_id: null,
+    runtime_session_synced_at: null,
+  },
+  pending_count: 0,
+  receipt_count: 0,
+  headline_state: "local_only",
+  headline_label: "Local only",
+  headline_detail: "",
+  sync_configured: false,
+  cloud_state: "paired_active",
+  cloud_state_label: "Connected",
+  cloud_state_detail: "Live cloud feed",
+  cloud_pairing_state: {
+    state: "paired_active",
+    label: "Connected",
+    detail: "",
+    sync_configured: true,
+    dashboard_url: "",
+    inbox_url: "",
+    fleet_url: "",
+    connect_url: "",
+  },
+  cloud_sync_health: {
+    state: "healthy",
+    label: "Healthy",
+    detail: "",
+    pending_events: 0,
+    last_synced_at: new Date().toISOString(),
+    next_retry_after: null,
+  },
+  dashboard_url: "",
+  inbox_url: "",
+  fleet_url: "",
+  connect_url: "",
+  items: [],
+  latest_receipts: [],
+  managed_installs: [],
+  supply_chain: undefined,
+};
+
+const partialAlerts = resolveSupplyChainPostureAlerts({
+  ...baseSnapshot,
+  supply_chain: {
+    package_manager_protection: makeProtection({
+      protected_managers: ["npm"],
+      unprotected_managers: ["pip"],
+      installed_managers: ["npm"],
+    }),
+  },
+});
+assert(
+  partialAlerts.some((alert) => alert.kind === "partial_protection"),
+  "SCSR160: partial protection surfaces posture banner",
+);
+
+const repairAlerts = resolveSupplyChainPostureAlerts({
+  ...baseSnapshot,
+  supply_chain: {
+    package_manager_protection: makeProtection({
+      installed_managers: ["pnpm"],
+      protected_managers: [],
+      unprotected_managers: ["pnpm", "npm"],
+      supported_managers: ["pnpm", "npm"],
+      path_status: "in_path",
+    }),
+  },
+});
+assert(
+  repairAlerts.some((alert) => alert.kind === "path_repair" && alert.tone === "attention"),
+  "SCSR161: path repair required surfaces repair banner",
+);
+
+const missingPathAlerts = resolveSupplyChainPostureAlerts({
+  ...baseSnapshot,
+  supply_chain: {
+    package_manager_protection: makeProtection({
+      path_status: "missing_from_path",
+      installed_managers: [],
+      protected_managers: [],
+      unprotected_managers: ["npm", "pip"],
+    }),
+  },
+});
+assert(
+  missingPathAlerts.some(
+    (alert) =>
+      alert.kind === "path_repair" &&
+      alert.title === "Guard shims are missing from PATH" &&
+      !alert.detail.includes("0 manager"),
+  ),
+  "SCSR161-C: missing PATH with no installed managers uses shim-missing copy",
+);
+
+const restartAlerts = resolveSupplyChainPostureAlerts({
+  ...baseSnapshot,
+  supply_chain: {
+    package_manager_protection: makeProtection({
+      installed_managers: ["npm"],
+      protected_managers: ["npm"],
+      unprotected_managers: [],
+      path_status: "restart_required",
+      restart_shell_required: true,
+    }),
+  },
+});
+assert(
+  restartAlerts.some((alert) => alert.kind === "path_repair" && alert.tone === "blue"),
+  "SCSR161-B: restart-required PATH surfaces staged repair banner",
+);
+
+const staleDate = new Date(Date.now() - 8 * 24 * 60 * 60 * 1000).toISOString();
+const staleAlerts = resolveSupplyChainPostureAlerts({
+  ...baseSnapshot,
+  latest_receipts: [
+    {
+      receipt_id: "receipt-stale",
+      harness: "claude",
+      artifact_id: "artifact",
+      artifact_hash: "hash",
+      policy_decision: "allow",
+      capabilities_summary: "",
+      changed_capabilities: [],
+      provenance_summary: "",
+      user_override: null,
+      source_scope: null,
+      timestamp: staleDate,
+    },
+  ],
+});
+assert(
+  staleAlerts.some((alert) => alert.kind === "stale_intel"),
+  "SCSR162: stale paired intel surfaces stale banner",
+);
+
+const localOnlyStale = resolveSupplyChainPostureAlerts({
+  ...baseSnapshot,
+  cloud_state: "local_only",
+  latest_receipts: [
+    {
+      receipt_id: "receipt-stale-local",
+      harness: "claude",
+      artifact_id: "artifact",
+      artifact_hash: "hash",
+      policy_decision: "allow",
+      capabilities_summary: "",
+      changed_capabilities: [],
+      provenance_summary: "",
+      user_override: null,
+      source_scope: null,
+      timestamp: staleDate,
+    },
+  ],
+});
+assert(
+  !localOnlyStale.some((alert) => alert.kind === "stale_intel"),
+  "SCSR162-B: local-only mode skips stale intel banner",
+);
+
+console.log("scsr-phase09e-posture-banners.test.ts: all assertions passed");

plugin_scanner-2.0.560/dashboard/src/supply-chain-firewall-action-result.ts

@@ -0,0 +1,268 @@
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(value: unknown): string | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function readStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0)
+    .map((entry) => entry.trim());
+}
+
+export type PackageFirewallActionResultDetail = {
+  emptyState: boolean;
+  lines: string[];
+  summary: string;
+  tone: "success" | "warning" | "neutral";
+};
+
+function parseAuditActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const evaluation = isRecord(result.evaluation) ? result.evaluation : null;
+  const decision = readString(evaluation?.decision) ?? readString(result.decision) ?? "monitor";
+  const manifestPaths = readStringArray(result.manifest_paths);
+  const lockfilePaths = readStringArray(result.lockfile_paths);
+  const inventory = isRecord(result.inventory) ? result.inventory : null;
+  const packageCount = typeof inventory?.packages === "number" ? inventory.packages : null;
+  const lockfileWarnings = Array.isArray(result.lockfile_warnings)
+    ? result.lockfile_warnings.filter(isRecord)
+    : [];
+
+  const lines: string[] = [];
+  if (manifestPaths.length > 0) {
+    lines.push(`Manifests scanned: ${manifestPaths.join(", ")}.`);
+  }
+  if (lockfilePaths.length > 0) {
+    lines.push(`Lockfiles scanned: ${lockfilePaths.join(", ")}.`);
+  }
+  if (packageCount !== null) {
+    lines.push(`${packageCount} dependency ${packageCount === 1 ? "entry" : "entries"} indexed.`);
+  }
+  for (const warning of lockfileWarnings.slice(0, 3)) {
+    const message = readString(warning.message);
+    if (message !== null) {
+      lines.push(message);
+    }
+  }
+
+  const emptyState = manifestPaths.length === 0 && lockfilePaths.length === 0;
+  if (emptyState) {
+    lines.push("No workspace manifests or lockfiles were found for this audit scope.");
+  }
+
+  return {
+    emptyState,
+    lines,
+    summary: `Workspace audit completed with ${decision} decision.`,
+    tone: decision === "block" || decision === "ask" ? "warning" : "success",
+  };
+}
+
+function parseSyncActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const syncedAt =
+    readString(result.synced_at) ??
+    readString(result.generated_at) ??
+    readString(result.updated_at);
+  const receiptsStored = typeof result.receipts_stored === "number" ? result.receipts_stored : null;
+  const bundleVersion = readString(result.bundle_version);
+  const tier = readString(result.tier);
+
+  const lines: string[] = [];
+  if (syncedAt !== null) {
+    lines.push(`Cloud sync marker: ${syncedAt}.`);
+  }
+  if (receiptsStored !== null) {
+    lines.push(`${receiptsStored} receipt${receiptsStored === 1 ? "" : "s"} stored locally.`);
+  }
+  if (bundleVersion !== null) {
+    lines.push(`Advisory bundle ${bundleVersion}${tier ? ` (${tier})` : ""} is now active.`);
+  }
+
+  return {
+    emptyState: lines.length === 0,
+    lines,
+    summary: syncedAt
+      ? "Cloud intel sync completed. Feed freshness should update on the next status refresh."
+      : "Cloud intel sync completed.",
+    tone: "success",
+  };
+}
+
+function parseTestActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  const interceptProved = result.intercept_proved === true;
+  const testedManagers = readStringArray(result.tested_managers);
+  const pathRepairRequired = readStringArray(result.path_repair_required);
+  const managerResults = Array.isArray(result.manager_results)
+    ? result.manager_results.filter(isRecord)
+    : [];
+
+  const lines: string[] = [];
+  for (const entry of managerResults) {
+    const manager = readString(entry.manager) ?? "manager";
+    if (entry.intercept_ran === true) {
+      lines.push(
+        `${manager}: intercept probe ran${
+          entry.evaluator_invoked === true ? " with evaluator proof" : ""
+        }.`,
+      );
+      continue;
+    }
+    const skippedReason = readString(entry.skipped_reason);
+    if (skippedReason !== null) {
+      lines.push(`${manager}: skipped (${skippedReason.replaceAll("_", " ")}).`);
+      continue;
+    }
+    lines.push(`${manager}: no intercept proof recorded.`);
+  }
+
+  if (pathRepairRequired.length > 0) {
+    lines.push(`PATH repair still required for ${pathRepairRequired.join(", ")}.`);
+  }
+
+  if (lines.length === 0 && testedManagers.length > 0) {
+    lines.push(`Tested ${testedManagers.join(", ")}.`);
+  }
+  if (lines.length === 0) {
+    lines.push("Intercept test completed.");
+  }
+
+  return {
+    emptyState: false,
+    lines,
+    summary: interceptProved
+      ? "Intercept test proved Guard blocked the package manager call."
+      : "Intercept test finished without full proof. Review manager details below.",
+    tone: interceptProved ? "success" : "warning",
+  };
+}
+
+export function parsePackageFirewallActionResult(
+  op: string,
+  body: unknown,
+): PackageFirewallActionResultDetail | null {
+  if (!isRecord(body)) {
+    return null;
+  }
+  let result: Record<string, unknown>;
+  if (isRecord(body.result)) {
+    result = body.result;
+  } else if (isRecord(body.result_detail)) {
+    result = body.result_detail;
+  } else {
+    result = body;
+  }
+  if (!isRecord(result)) {
+    return null;
+  }
+
+  if (op === "audit") {
+    return parseAuditActionResult(result);
+  }
+  if (op === "sync") {
+    return parseSyncActionResult(result);
+  }
+  if (op === "test") {
+    return parseTestActionResult(result);
+  }
+  return null;
+}
+
+function readActionResultRecord(body: unknown): Record<string, unknown> | null {
+  if (!isRecord(body)) {
+    return null;
+  }
+  if (isRecord(body.result_detail)) {
+    return body.result_detail;
+  }
+  if (isRecord(body.result)) {
+    return body.result;
+  }
+  return body;
+}
+
+export type InterceptProofManagerResult = {
+  manager: string;
+  interceptRan: boolean;
+  evaluatorInvoked: boolean;
+  skippedReason: string | null;
+  detail: string;
+};
+
+export type InterceptProofSnapshot = {
+  interceptProved: boolean;
+  testedManagers: string[];
+  pathRepairRequired: string[];
+  managerResults: InterceptProofManagerResult[];
+  receiptId: string | null;
+  timestamp: string | null;
+  summary: string;
+  tone: "success" | "warning";
+};
+
+function buildInterceptProofManagerResult(entry: Record<string, unknown>): InterceptProofManagerResult {
+  const manager = readString(entry.manager) ?? "manager";
+  const interceptRan = entry.intercept_ran === true;
+  const evaluatorInvoked = entry.evaluator_invoked === true;
+  const skippedReason = readString(entry.skipped_reason);
+  let detail = `${manager}: no intercept proof recorded.`;
+  if (interceptRan) {
+    detail = evaluatorInvoked
+      ? `${manager}: intercept probe ran with evaluator proof.`
+      : `${manager}: intercept probe ran.`;
+  } else if (skippedReason !== null) {
+    detail = `${manager}: skipped (${skippedReason.replaceAll("_", " ")}).`;
+  }
+  return {
+    manager,
+    interceptRan,
+    evaluatorInvoked,
+    skippedReason,
+    detail,
+  };
+}
+
+export function parseInterceptProofSnapshot(body: unknown): InterceptProofSnapshot | null {
+  const result = readActionResultRecord(body);
+  if (result === null) {
+    return null;
+  }
+  const managerResultsRaw = Array.isArray(result.manager_results)
+    ? result.manager_results.filter(isRecord)
+    : [];
+  const testedManagers = readStringArray(result.tested_managers);
+  const pathRepairRequired = readStringArray(result.path_repair_required);
+  const interceptProved = result.intercept_proved === true;
+  const managerResults = managerResultsRaw.map(buildInterceptProofManagerResult);
+  const hasProofContext =
+    managerResults.length > 0 || testedManagers.length > 0 || pathRepairRequired.length > 0;
+  if (!hasProofContext && result.intercept_proved === undefined) {
+    return null;
+  }
+
+  const receipt = isRecord(body) && isRecord(body.receipt) ? body.receipt : null;
+  const receiptId = receipt !== null ? readString(receipt.id) : null;
+  const timestamp = receipt !== null ? readString(receipt.timestamp) : null;
+  const summary = interceptProved
+    ? "Intercept test proved Guard blocked the package manager call."
+    : "Intercept test finished without full proof. Review manager details below.";
+
+  return {
+    interceptProved,
+    testedManagers,
+    pathRepairRequired,
+    managerResults,
+    receiptId,
+    timestamp,
+    summary,
+    tone: interceptProved ? "success" : "warning",
+  };
+}

{plugin_scanner-2.0.558 → plugin_scanner-2.0.560}/dashboard/src/supply-chain-firewall-controls.tsx

@@ -105,6 +105,7 @@ export type FirewallControlsViewProps = {
   onDismissResult: () => void;
   onOpenShell: () => void;
   onRefreshStatus: () => void;
+  onOpenManagerDetails: (manager: string) => void;
 };
 
 export function FirewallControlsView({
@@ -131,6 +132,7 @@ export function FirewallControlsView({
   onDismissResult,
   onOpenShell,
   onRefreshStatus,
+  onOpenManagerDetails,
 }: FirewallControlsViewProps) {
   const anyPending = pendingOp !== null;
   const nextAction = useMemo(() => resolvePackageFirewallNextAction(data), [data]);
@@ -318,6 +320,7 @@ export function FirewallControlsView({
                   onRemoveRequest={onRemoveRequest}
                   onRemoveConfirm={onRemoveConfirm}
                   onRemoveCancel={onRemoveCancel}
+                  onOpenDetails={onOpenManagerDetails}
                 />
               );
             })}

{plugin_scanner-2.0.558 → plugin_scanner-2.0.560}/dashboard/src/supply-chain-firewall-manager-row.tsx

@@ -60,6 +60,7 @@ type ManagerRowProps = {
   onRemoveRequest: (manager: string) => void;
   onRemoveConfirm: (manager: string) => void;
   onRemoveCancel: () => void;
+  onOpenDetails: (manager: string) => void;
 };
 
 export function ManagerRow({
@@ -75,6 +76,7 @@ export function ManagerRow({
   onRemoveRequest,
   onRemoveConfirm,
   onRemoveCancel,
+  onOpenDetails,
 }: ManagerRowProps) {
   const status = resolveShimStatus(shim);
   const installState = actions.install ?? "disabled";
@@ -99,6 +101,7 @@ export function ManagerRow({
   const handleTest = useCallback(() => onTest(manager), [onTest, manager]);
   const handleRemoveRequest = useCallback(() => onRemoveRequest(manager), [onRemoveRequest, manager]);
   const handleRemoveConfirm = useCallback(() => onRemoveConfirm(manager), [onRemoveConfirm, manager]);
+  const handleOpenDetails = useCallback(() => onOpenDetails(manager), [onOpenDetails, manager]);
 
   return (
     <div className="border-b border-slate-100 last:border-b-0" role="row">
@@ -112,7 +115,14 @@ export function ManagerRow({
             ) : (
               <HiMiniExclamationTriangle className="h-4 w-4 shrink-0 text-brand-attention" aria-hidden="true" />
             )}
-            <span className="truncate font-mono text-sm font-semibold text-brand-dark">{manager}</span>
+            <button
+              type="button"
+              onClick={handleOpenDetails}
+              className="truncate text-left font-mono text-sm font-semibold text-brand-dark hover:text-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/30 rounded"
+              aria-label={`Open ${manager} manager details`}
+            >
+              {manager}
+            </button>
             {shim?.detected && <Tag tone="green">Detected</Tag>}
             {isMine && (
               <HiMiniArrowPath