plugin-scanner 2.0.644__tar.gz → 2.0.645__tar.gz

{plugin_scanner-2.0.644 → plugin_scanner-2.0.645}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.644
+Version: 2.0.645
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.644 → plugin_scanner-2.0.645}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.644 → plugin_scanner-2.0.645}/dashboard/src/guard-api.ts

@@ -2596,7 +2596,7 @@ export async function runAuditRemediation(input: AuditRemediationInput): Promise
 }
 
 export async function runPackageAudit(): Promise<PackageFirewallActionResponse> {
-  const response = await readJson<unknown>("/v1/supply-chain/audit", {
+  const response = await fetchGuardApi("/v1/supply-chain/audit", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -2604,11 +2604,18 @@ export async function runPackageAudit(): Promise<PackageFirewallActionResponse>
     },
     body: JSON.stringify({}),
   });
-  return normalizePackageFirewallAction(response);
+  const payloadBody = (await response.json().catch(() => null)) as unknown;
+  if (!response.ok) {
+    throw new GuardHarnessActionError(
+      response.status,
+      isGuardHarnessActionErrorPayload(payloadBody) ? payloadBody : null,
+    );
+  }
+  return normalizePackageFirewallAction(payloadBody);
 }
 
 export async function runPackageSync(): Promise<PackageFirewallActionResponse> {
-  const response = await readJson<unknown>("/v1/supply-chain/sync", {
+  const response = await fetchGuardApi("/v1/supply-chain/sync", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -2616,7 +2623,14 @@ export async function runPackageSync(): Promise<PackageFirewallActionResponse> {
     },
     body: JSON.stringify({}),
   });
-  return normalizePackageFirewallAction(response);
+  const payloadBody = (await response.json().catch(() => null)) as unknown;
+  if (!response.ok) {
+    throw new GuardHarnessActionError(
+      response.status,
+      isGuardHarnessActionErrorPayload(payloadBody) ? payloadBody : null,
+    );
+  }
+  return normalizePackageFirewallAction(payloadBody);
 }
 
 export type EvidencePageData = {

{plugin_scanner-2.0.644 → plugin_scanner-2.0.645}/dashboard/src/package-workbench-panel.tsx

@@ -21,8 +21,11 @@ import {
   packageWorkbenchEcosystems,
   sortPackageWorkbenchFindings,
 } from "./supply-chain-audit-normalize";
+import { ConnectFlowCard } from "./supply-chain-firewall-views";
+import type { AuditConnectGateViewState } from "./supply-chain-firewall-panel";
 
 type PackageWorkbenchPanelProps = {
+  auditConnectGate?: AuditConnectGateViewState | null;
   auditSnapshot: SupplyChainAuditSnapshot | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
@@ -329,15 +332,32 @@ function EcosystemChip({ ecosystem, active, onSelect }: EcosystemChipProps) {
 }
 
 type WorkbenchEmptyStateProps = {
+  auditConnectGate?: AuditConnectGateViewState | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
 };
 
-function WorkbenchEmptyState({ onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
+function WorkbenchEmptyState({ auditConnectGate, onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
+  if (auditConnectGate !== null && auditConnectGate !== undefined) {
+    return (
+      <ConnectFlowCard
+        compact
+        connectError={auditConnectGate.connectError}
+        connectStarting={auditConnectGate.connectStarting}
+        connectFlow={auditConnectGate.connectFlow}
+        detail={auditConnectGate.gate.detail}
+        headline={auditConnectGate.gate.headline}
+        mode={auditConnectGate.gate.mode}
+        onStartConnect={auditConnectGate.onStartConnect}
+        purpose="audit"
+      />
+    );
+  }
+
   return (
     <EmptyState
       title="No workspace audit yet"
-      body="Run a package audit from the firewall panel to index dependencies and surface flagged packages here."
+      body="Run a package audit to index dependencies and surface flagged packages here."
       tone="teach"
       action={
         onRunAudit !== undefined ? (
@@ -352,6 +372,7 @@ function WorkbenchEmptyState({ onRunAudit, auditRunning }: WorkbenchEmptyStatePr
 }
 
 export function PackageWorkbenchPanel({
+  auditConnectGate = null,
   auditSnapshot,
   onRunAudit,
   auditRunning = false,
@@ -439,7 +460,11 @@ export function PackageWorkbenchPanel({
 
       {auditSnapshot === null && (
         <div className="px-4 py-6">
-          <WorkbenchEmptyState onRunAudit={onRunAudit} auditRunning={auditRunning} />
+          <WorkbenchEmptyState
+            auditConnectGate={auditConnectGate}
+            onRunAudit={onRunAudit}
+            auditRunning={auditRunning}
+          />
         </div>
       )}
       {auditSnapshot !== null && findings.length === 0 && (

plugin_scanner-2.0.645/dashboard/src/supply-chain-audit-connect.test.tsx

@@ -0,0 +1,107 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { GuardHarnessActionError } from "./guard-api";
+import { ConnectFlowCard } from "./supply-chain-firewall-views";
+import {
+  isSupplyChainAuditConnectError,
+  packageAuditNeedsCloudConnect,
+  resolveSupplyChainAuditConnectGate,
+  supplyChainAuditConnectUserMessage,
+} from "./supply-chain-audit-connect";
+import type { PackageFirewallStatusResponse } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const connectRequiredStatus: PackageFirewallStatusResponse = {
+  operation: "status",
+  status: "completed",
+  supported_managers: ["npm"],
+  detected_managers: ["npm"],
+  last_audit_proof_at: null,
+  protection: null,
+  package_shims: [],
+  entitlement: {
+    allowed: false,
+    reason: "guard_cloud_connect_required",
+    tier: "unknown",
+    upgrade_cta: "Connect HOL Guard Cloud to check package firewall access and run package firewall actions.",
+    upgrade_url: null,
+  },
+  actions: {
+    install: "connect_required",
+    repair: "disabled",
+    test: "connect_required",
+    audit: "connect_required",
+    sync: "connect_required",
+    remove: "disabled",
+  },
+  cli_fallback: {
+    connect: "hol-guard connect",
+  },
+  connect_flow: {
+    state: "idle",
+    title: "Connect HOL Guard Cloud to enable package firewall",
+    detail: "Connect HOL Guard Cloud here so the daemon can verify package-firewall access.",
+    action_label: "Connect HOL Guard Cloud",
+    connect_url: "https://hol.org/guard/connect",
+    authorize_url: null,
+    browser_opened: null,
+    request_id: null,
+    poll_after_ms: null,
+  },
+};
+
+assert(packageAuditNeedsCloudConnect(connectRequiredStatus), "audit action should require cloud connect");
+const gate = resolveSupplyChainAuditConnectGate(connectRequiredStatus, { resumeAfterConnect: true });
+assert(gate !== null, "audit connect gate should resolve for connect-required status");
+assert(
+  gate?.headline.includes("Sign in"),
+  "audit connect gate should use human-readable sign-in copy",
+);
+assert(
+  !gate?.headline.includes("guard_cloud_connect_required"),
+  "audit connect gate should not surface raw daemon error codes",
+);
+
+const connectError = new GuardHarnessActionError(403, {
+  error: "guard_cloud_connect_required",
+  message: "Connect HOL Guard Cloud on this machine before running package firewall actions.",
+  operation: "audit",
+});
+assert(isSupplyChainAuditConnectError(connectError), "structured audit connect errors should be detectable");
+assert(
+  supplyChainAuditConnectUserMessage(connectError)?.includes("Sign in"),
+  "audit connect user message should guide sign-in before retry",
+);
+
+const auditConnectMarkup = renderToStaticMarkup(
+  <ConnectFlowCard
+    compact
+    connectError={null}
+    connectStarting={false}
+    connectFlow={connectRequiredStatus.connect_flow!}
+    detail={gate!.detail}
+    headline={gate!.headline}
+    mode="connect"
+    onStartConnect={() => undefined}
+    purpose="audit"
+  />,
+);
+
+assert(
+  auditConnectMarkup.includes("Run workspace audit"),
+  "audit connect card should show audit-specific final step",
+);
+assert(
+  auditConnectMarkup.includes("Connect HOL Guard Cloud"),
+  "audit connect card should keep the primary connect action",
+);
+assert(
+  !auditConnectMarkup.includes("guard_cloud_connect_required"),
+  "audit connect card markup should not expose raw error codes",
+);
+
+console.log("supply-chain-audit-connect.test.ts: all assertions passed");

plugin_scanner-2.0.645/dashboard/src/supply-chain-audit-connect.ts

@@ -0,0 +1,83 @@
+import { GuardHarnessActionError } from "./guard-api";
+import type { PackageFirewallStatusResponse } from "./guard-types";
+
+export const SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES = [
+  "guard_cloud_connect_required",
+  "guard_cloud_reconnect_required",
+] as const;
+
+export type SupplyChainAuditConnectErrorCode =
+  (typeof SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES)[number];
+
+export type SupplyChainAuditConnectGate = {
+  mode: "connect" | "repair";
+  headline: string;
+  detail: string;
+  resumeAfterConnect: boolean;
+};
+
+export function isSupplyChainAuditConnectError(error: unknown): error is GuardHarnessActionError {
+  if (!(error instanceof GuardHarnessActionError)) {
+    return false;
+  }
+  const code = error.payload?.error;
+  return (
+    typeof code === "string" &&
+    (SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES as readonly string[]).includes(code)
+  );
+}
+
+export function packageAuditNeedsCloudConnect(data: PackageFirewallStatusResponse): boolean {
+  const auditAction = data.actions.audit;
+  return auditAction === "connect_required" || auditAction === "reconnect_required";
+}
+
+function resolveAuditConnectMode(data: PackageFirewallStatusResponse): "connect" | "repair" {
+  if (data.entitlement.reason === "guard_cloud_reconnect_required") {
+    return "repair";
+  }
+  if (
+    data.entitlement.reason === "guard_cloud_connect_required" &&
+    (data.entitlement.tier !== "unknown" || data.package_shims.some((shim) => shim.installed))
+  ) {
+    return "repair";
+  }
+  return "connect";
+}
+
+export function resolveSupplyChainAuditConnectGate(
+  data: PackageFirewallStatusResponse,
+  options?: { resumeAfterConnect?: boolean },
+): SupplyChainAuditConnectGate | null {
+  if (!packageAuditNeedsCloudConnect(data) || data.connect_flow === null) {
+    return null;
+  }
+  const mode = resolveAuditConnectMode(data);
+  if (mode === "repair") {
+    return {
+      mode,
+      headline: "Reconnect Guard Cloud to run the workspace audit",
+      detail:
+        "Guard needs a fresh Cloud sign-in on this machine before it can scan workspace packages and surface findings here.",
+      resumeAfterConnect: options?.resumeAfterConnect ?? false,
+    };
+  }
+  return {
+    mode,
+    headline: "Sign in to Guard Cloud before running the audit",
+    detail:
+      "Package audits run through Guard Cloud. Sign in once on this machine, then Guard can scan dependencies and list flagged packages.",
+    resumeAfterConnect: options?.resumeAfterConnect ?? false,
+  };
+}
+
+export function supplyChainAuditConnectUserMessage(error: unknown): string | null {
+  if (!isSupplyChainAuditConnectError(error)) {
+    return null;
+  }
+  const code = error.payload?.error;
+  if (code === "guard_cloud_reconnect_required") {
+    return "Reconnect HOL Guard Cloud, then run the workspace audit again.";
+  }
+  return "Sign in to HOL Guard Cloud on this machine, then run the workspace audit.";
+}

{plugin_scanner-2.0.644 → plugin_scanner-2.0.645}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -17,8 +17,14 @@ import {
   runPackageSync,
   startPackageFirewallConnect,
 } from "./guard-api";
-import { EntitlementNotice } from "./supply-chain-firewall-views";
+import { EntitlementNotice, ConnectFlowCard } from "./supply-chain-firewall-views";
 import type { CompletedOp } from "./supply-chain-firewall-views";
+import {
+  isSupplyChainAuditConnectError,
+  packageAuditNeedsCloudConnect,
+  resolveSupplyChainAuditConnectGate,
+  type SupplyChainAuditConnectGate,
+} from "./supply-chain-audit-connect";
 import {
   FirewallControlsView,
   type FirewallFailedOp,
@@ -124,9 +130,18 @@ function RefreshButton({ disabled, spinning, onRefresh }: RefreshButtonProps) {
   );
 }
 
+export type AuditConnectGateViewState = {
+  gate: SupplyChainAuditConnectGate;
+  connectError: string | null;
+  connectStarting: boolean;
+  connectFlow: NonNullable<PackageFirewallStatusResponse["connect_flow"]>;
+  onStartConnect: () => void;
+};
+
 export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   props: {
   approvalGate: GuardApprovalGatePublicConfig | null;
+  onAuditConnectGateChange?: (state: AuditConnectGateViewState | null) => void;
   onStateChanged?: () => Promise<void> | void;
   onAuditCompleted?: (resultDetail: Record<string, unknown>) => void;
   onAuditRunningChange?: (running: boolean) => void;
@@ -134,7 +149,14 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
 },
   ref,
 ) {
-  const { approvalGate, onStateChanged, onAuditCompleted, onAuditRunningChange, runAuditRef } = props;
+  const {
+    approvalGate,
+    onAuditConnectGateChange,
+    onStateChanged,
+    onAuditCompleted,
+    onAuditRunningChange,
+    runAuditRef,
+  } = props;
   const rootRef = useRef<HTMLDivElement>(null);
   const [panelLoad, setPanelLoad] = useState<PanelLoadState>({ phase: "loading" });
   const [pendingOp, setPendingOp] = useState<PendingOp | null>(null);
@@ -150,6 +172,8 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   const [managerFilter, setManagerFilter] = useState("");
   const [interceptProof, setInterceptProof] = useState<InterceptProofSnapshot | null>(null);
   const [managerDrawerTarget, setManagerDrawerTarget] = useState<string | null>(null);
+  const [auditConnectGateActive, setAuditConnectGateActive] = useState(false);
+  const [resumeAuditAfterConnect, setResumeAuditAfterConnect] = useState(false);
   const { resolvedApprovalGate, resolveApprovalGate } = useResolvedApprovalGate(approvalGate);
 
   const load = useCallback(async () => {
@@ -193,6 +217,113 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     return () => window.clearTimeout(handle);
   }, [panelLoad, refreshAfterOp]);
 
+  const openAuditConnectGate = useCallback((resumeAfterConnect: boolean) => {
+    setAuditConnectGateActive(true);
+    setResumeAuditAfterConnect(resumeAfterConnect);
+    setLastFailed(null);
+    rootRef.current?.scrollIntoView({ behavior: "smooth", block: "start" });
+  }, []);
+
+  const clearAuditConnectGate = useCallback(() => {
+    setAuditConnectGateActive(false);
+    setResumeAuditAfterConnect(false);
+  }, []);
+
+  const runAuditOperation = useCallback(
+    async () => {
+      setPendingOp({ op: "audit", manager: null });
+      setLastFailed(null);
+      setConnectError(null);
+      setActivationAssistError(null);
+      onAuditRunningChange?.(true);
+      try {
+        const response = await runPackageAudit();
+        setLastCompleted({ op: "audit", manager: null, response });
+        onAuditCompleted?.(response.result_detail);
+        clearAuditConnectGate();
+        await refreshAfterOp();
+        await onStateChanged?.();
+      } catch (err) {
+        if (isSupplyChainAuditConnectError(err)) {
+          openAuditConnectGate(true);
+          return;
+        }
+        const message = err instanceof Error ? err.message : "Operation failed.";
+        setLastFailed({ op: "audit", manager: null, message });
+      } finally {
+        onAuditRunningChange?.(false);
+        setPendingOp(null);
+      }
+    },
+    [
+      clearAuditConnectGate,
+      onAuditCompleted,
+      onAuditRunningChange,
+      onStateChanged,
+      openAuditConnectGate,
+      refreshAfterOp,
+    ],
+  );
+
+  const handleStartConnect = useCallback(async () => {
+    setStartingConnect(true);
+    setConnectError(null);
+    setActivationAssistError(null);
+    try {
+      await startPackageFirewallConnect();
+      await refreshAfterOp();
+      await onStateChanged?.();
+    } catch (error) {
+      setConnectError(
+        error instanceof Error ? error.message : "Unable to start Guard Cloud connect.",
+      );
+    } finally {
+      setStartingConnect(false);
+    }
+  }, [onStateChanged, refreshAfterOp]);
+
+  useEffect(() => {
+    if (panelLoad.phase !== "loaded" || !auditConnectGateActive) {
+      onAuditConnectGateChange?.(null);
+      return;
+    }
+    const gate = resolveSupplyChainAuditConnectGate(panelLoad.data, {
+      resumeAfterConnect: resumeAuditAfterConnect,
+    });
+    if (gate === null || panelLoad.data.connect_flow === null) {
+      onAuditConnectGateChange?.(null);
+      return;
+    }
+    onAuditConnectGateChange?.({
+      gate,
+      connectError,
+      connectStarting: startingConnect,
+      connectFlow: panelLoad.data.connect_flow,
+      onStartConnect: () => {
+        void handleStartConnect();
+      },
+    });
+  }, [
+    auditConnectGateActive,
+    connectError,
+    handleStartConnect,
+    onAuditConnectGateChange,
+    panelLoad,
+    resumeAuditAfterConnect,
+    startingConnect,
+  ]);
+
+  useEffect(() => {
+    if (panelLoad.phase !== "loaded" || !resumeAuditAfterConnect) {
+      return;
+    }
+    if (!panelLoad.data.entitlement.allowed || packageAuditNeedsCloudConnect(panelLoad.data)) {
+      return;
+    }
+    setResumeAuditAfterConnect(false);
+    void runAuditOperation();
+  }, [panelLoad, resumeAuditAfterConnect, runAuditOperation]);
+
   const handleAction = useCallback(
     async (
       op: PackageFirewallActionType,
@@ -237,32 +368,31 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
 
   const handleGlobalOp = useCallback(
     async (op: "audit" | "sync") => {
+      if (op === "audit") {
+        if (panelLoad.phase === "loaded" && packageAuditNeedsCloudConnect(panelLoad.data)) {
+          openAuditConnectGate(true);
+          return;
+        }
+        await runAuditOperation();
+        return;
+      }
       setPendingOp({ op, manager: null });
       setLastFailed(null);
       setConnectError(null);
       setActivationAssistError(null);
-      if (op === "audit") {
-        onAuditRunningChange?.(true);
-      }
       try {
-        const response = op === "audit" ? await runPackageAudit() : await runPackageSync();
+        const response = await runPackageSync();
         setLastCompleted({ op, manager: null, response });
-        if (op === "audit") {
-          onAuditCompleted?.(response.result_detail);
-        }
         await refreshAfterOp();
         await onStateChanged?.();
       } catch (err) {
         const message = err instanceof Error ? err.message : "Operation failed.";
         setLastFailed({ op, manager: null, message });
       } finally {
-        if (op === "audit") {
-          onAuditRunningChange?.(false);
-        }
         setPendingOp(null);
       }
     },
-    [onAuditCompleted, onAuditRunningChange, onStateChanged, refreshAfterOp],
+    [onStateChanged, openAuditConnectGate, panelLoad, refreshAfterOp, runAuditOperation],
   );
 
   const handleInstall = useCallback(
@@ -289,7 +419,13 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     [handleAction],
   );
   const handleRemoveCancel = useCallback(() => setConfirmRemoveManager(null), []);
-  const handleAudit = useCallback(() => void handleGlobalOp("audit"), [handleGlobalOp]);
+  const handleAudit = useCallback(() => {
+    if (panelLoad.phase === "loaded" && packageAuditNeedsCloudConnect(panelLoad.data)) {
+      openAuditConnectGate(true);
+      return;
+    }
+    void runAuditOperation();
+  }, [openAuditConnectGate, panelLoad, runAuditOperation]);
   const handleSync = useCallback(() => void handleGlobalOp("sync"), [handleGlobalOp]);
 
   useEffect(() => {
@@ -303,22 +439,6 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   }, [handleAudit, runAuditRef]);
   const handleDismissResult = useCallback(() => setLastCompleted(null), []);
   const handleRetry = useCallback(() => void load(), [load]);
-  const handleStartConnect = useCallback(async () => {
-    setStartingConnect(true);
-    setConnectError(null);
-    setActivationAssistError(null);
-    try {
-      await startPackageFirewallConnect();
-      await refreshAfterOp();
-      await onStateChanged?.();
-    } catch (error) {
-      setConnectError(
-        error instanceof Error ? error.message : "Unable to start Guard Cloud connect.",
-      );
-    } finally {
-      setStartingConnect(false);
-    }
-  }, [onStateChanged, refreshAfterOp]);
   const handleOpenShell = useCallback(async () => {
     setOpeningShell(true);
     setActivationAssistError(null);
@@ -390,6 +510,11 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       ? panelLoad.data.package_shims.find((entry) => entry.manager === managerDrawerTarget)
       : undefined;
 
+  const auditConnectGate =
+    panelLoad.phase === "loaded" && auditConnectGateActive
+      ? resolveSupplyChainAuditConnectGate(panelLoad.data, { resumeAfterConnect: resumeAuditAfterConnect })
+      : null;
+
   const anyPending = pendingOp !== null;
   return (
     <div ref={rootRef} className="rounded-2xl border border-slate-100 bg-white shadow-sm" data-testid="package-firewall-panel">
@@ -417,8 +542,11 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
             <div className="border-b border-slate-100">
               <EntitlementNotice
                 connectError={connectError}
+                connectPurpose={auditConnectGateActive ? "audit" : "package_firewall"}
                 connectStarting={startingConnect}
                 data={panelLoad.data}
+                headline={auditConnectGate?.headline}
+                detail={auditConnectGate?.detail}
                 onStartConnect={handleStartConnect}
               />
             </div>