plugin-scanner 2.0.644__tar.gz → 2.0.646__tar.gz

{plugin_scanner-2.0.644 → plugin_scanner-2.0.646}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.644
+Version: 2.0.646
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.644 → plugin_scanner-2.0.646}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.644 → plugin_scanner-2.0.646}/dashboard/src/audit-workspace.tsx

@@ -22,6 +22,7 @@ import { GuardHarnessActionError, runAuditRemediation, guardAwareHref } from "./
 import type { AuditRemediationAction } from "./guard-api";
 import type { GuardApprovalGatePublicConfig, GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
 import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
+import { resolveManagerCoverageStatus } from "./supply-chain-protection-stats";
 
 export type AuditSeverity = "critical" | "high" | "medium" | "low" | "info";
 
@@ -89,6 +90,71 @@ export type AuditFilterState = {
   searchQuery: string;
 };
 
+function buildPackageManagerAuditResult(
+  manager: string,
+  protection: NonNullable<GuardRuntimeSnapshot["supply_chain"]>["package_manager_protection"],
+  generatedAt: string,
+): AuditResult | null {
+  const coverage = resolveManagerCoverageStatus(protection, manager);
+  if (coverage === "protected") {
+    return null;
+  }
+
+  if (coverage === "restart_required") {
+    return {
+      id: `unprotected-${manager}`,
+      severity: "medium",
+      title: `${manager} is waiting for restart`,
+      detail: `Guard already updated your shell profile for ${manager}. Open a new shell or restart AI apps so ${manager} resolves through Guard.`,
+      harness: "global",
+      workspace: null,
+      timestamp: generatedAt,
+      remediation: "Open a new shell or restart AI apps to finish package-manager interception.",
+      remediationAction: null,
+      resolved: false,
+      evidenceHref: null,
+    };
+  }
+
+  if (coverage === "path_repair") {
+    return {
+      id: `unprotected-${manager}`,
+      severity: "medium",
+      title: `${manager} shim is installed but PATH still needs repair`,
+      detail: `Guard already installed the ${manager} shim on this machine. Repair PATH so ${manager} commands resolve through Guard before package installs run.`,
+      harness: "global",
+      workspace: null,
+      timestamp: generatedAt,
+      remediation: "Repair PATH from Supply chain or run hol-guard package-shims repair for this manager.",
+      remediationAction: {
+        action: "package_shim_path",
+        manager,
+        label: "Repair PATH",
+      },
+      resolved: false,
+      evidenceHref: `/evidence?harness=global&search=${encodeURIComponent(manager)}`,
+    };
+  }
+
+  return {
+    id: `unprotected-${manager}`,
+    severity: "high",
+    title: `${manager} is not intercepted by Guard`,
+    detail: `The ${manager} shim is missing from PATH. Installs via ${manager} bypass Guard's supply chain protection.`,
+    harness: "global",
+    workspace: null,
+    timestamp: generatedAt,
+    remediation: `Guard can install the shim and update PATH for ${manager} from this dashboard.`,
+    remediationAction: {
+      action: "package_shim_path",
+      manager,
+      label: "Install Guard",
+    },
+    resolved: false,
+    evidenceHref: `/evidence?harness=global&search=${encodeURIComponent(manager)}`,
+  };
+}
+
 export function deriveFrontendAuditResults(
   receipts: GuardReceipt[],
   snapshot: GuardRuntimeSnapshot,
@@ -96,36 +162,15 @@ export function deriveFrontendAuditResults(
   const results: AuditResult[] = [];
 
   const protection = snapshot.supply_chain?.package_manager_protection;
-  if (protection && protection.unprotected_managers.length > 0) {
-    for (const mgr of protection.unprotected_managers) {
-      const restartRequired =
-        protection.path_status === "restart_required" &&
-        protection.installed_managers.includes(mgr);
-      results.push({
-        id: `unprotected-${mgr}`,
-        severity: restartRequired ? "medium" : "high",
-        title: restartRequired ? `${mgr} is waiting for restart` : `${mgr} is not intercepted by Guard`,
-        detail: restartRequired
-          ? `Guard already updated your shell profile for ${mgr}. Open a new shell or restart AI apps so ${mgr} resolves through Guard.`
-          : `The ${mgr} shim is missing from PATH. Installs via ${mgr} bypass Guard's supply chain protection.`,
-        harness: "global",
-        workspace: null,
-        timestamp: snapshot.generated_at,
-        remediation: restartRequired
-          ? "Open a new shell or restart AI apps to finish package-manager interception."
-          : `Guard can install the shim and update PATH for ${mgr} from this dashboard.`,
-        remediationAction: restartRequired
-          ? null
-          : {
-              action: "package_shim_path",
-              manager: mgr,
-              label: "Install Guard",
-            },
-        resolved: false,
-        evidenceHref: restartRequired
-          ? null
-          : `/evidence?harness=global&search=${encodeURIComponent(mgr)}`,
-      });
+  if (protection) {
+    const managersNeedingAttention = protection.supported_managers.filter(
+      (manager) => resolveManagerCoverageStatus(protection, manager) !== "protected",
+    );
+    for (const mgr of managersNeedingAttention) {
+      const auditResult = buildPackageManagerAuditResult(mgr, protection, snapshot.generated_at);
+      if (auditResult !== null) {
+        results.push(auditResult);
+      }
     }
   }
 

{plugin_scanner-2.0.644 → plugin_scanner-2.0.646}/dashboard/src/guard-api.ts

@@ -2596,7 +2596,7 @@ export async function runAuditRemediation(input: AuditRemediationInput): Promise
 }
 
 export async function runPackageAudit(): Promise<PackageFirewallActionResponse> {
-  const response = await readJson<unknown>("/v1/supply-chain/audit", {
+  const response = await fetchGuardApi("/v1/supply-chain/audit", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -2604,11 +2604,18 @@ export async function runPackageAudit(): Promise<PackageFirewallActionResponse>
     },
     body: JSON.stringify({}),
   });
-  return normalizePackageFirewallAction(response);
+  const payloadBody = (await response.json().catch(() => null)) as unknown;
+  if (!response.ok) {
+    throw new GuardHarnessActionError(
+      response.status,
+      isGuardHarnessActionErrorPayload(payloadBody) ? payloadBody : null,
+    );
+  }
+  return normalizePackageFirewallAction(payloadBody);
 }
 
 export async function runPackageSync(): Promise<PackageFirewallActionResponse> {
-  const response = await readJson<unknown>("/v1/supply-chain/sync", {
+  const response = await fetchGuardApi("/v1/supply-chain/sync", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -2616,7 +2623,14 @@ export async function runPackageSync(): Promise<PackageFirewallActionResponse> {
     },
     body: JSON.stringify({}),
   });
-  return normalizePackageFirewallAction(response);
+  const payloadBody = (await response.json().catch(() => null)) as unknown;
+  if (!response.ok) {
+    throw new GuardHarnessActionError(
+      response.status,
+      isGuardHarnessActionErrorPayload(payloadBody) ? payloadBody : null,
+    );
+  }
+  return normalizePackageFirewallAction(payloadBody);
 }
 
 export type EvidencePageData = {

{plugin_scanner-2.0.644 → plugin_scanner-2.0.646}/dashboard/src/package-workbench-panel.tsx

@@ -21,8 +21,11 @@ import {
   packageWorkbenchEcosystems,
   sortPackageWorkbenchFindings,
 } from "./supply-chain-audit-normalize";
+import { ConnectFlowCard } from "./supply-chain-firewall-views";
+import type { AuditConnectGateViewState } from "./supply-chain-firewall-panel";
 
 type PackageWorkbenchPanelProps = {
+  auditConnectGate?: AuditConnectGateViewState | null;
   auditSnapshot: SupplyChainAuditSnapshot | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
@@ -329,15 +332,32 @@ function EcosystemChip({ ecosystem, active, onSelect }: EcosystemChipProps) {
 }
 
 type WorkbenchEmptyStateProps = {
+  auditConnectGate?: AuditConnectGateViewState | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
 };
 
-function WorkbenchEmptyState({ onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
+function WorkbenchEmptyState({ auditConnectGate, onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
+  if (auditConnectGate !== null && auditConnectGate !== undefined) {
+    return (
+      <ConnectFlowCard
+        compact
+        connectError={auditConnectGate.connectError}
+        connectStarting={auditConnectGate.connectStarting}
+        connectFlow={auditConnectGate.connectFlow}
+        detail={auditConnectGate.gate.detail}
+        headline={auditConnectGate.gate.headline}
+        mode={auditConnectGate.gate.mode}
+        onStartConnect={auditConnectGate.onStartConnect}
+        purpose="audit"
+      />
+    );
+  }
+
   return (
     <EmptyState
       title="No workspace audit yet"
-      body="Run a package audit from the firewall panel to index dependencies and surface flagged packages here."
+      body="Run a package audit to index dependencies and surface flagged packages here."
       tone="teach"
       action={
         onRunAudit !== undefined ? (
@@ -352,6 +372,7 @@ function WorkbenchEmptyState({ onRunAudit, auditRunning }: WorkbenchEmptyStatePr
 }
 
 export function PackageWorkbenchPanel({
+  auditConnectGate = null,
   auditSnapshot,
   onRunAudit,
   auditRunning = false,
@@ -439,7 +460,11 @@ export function PackageWorkbenchPanel({
 
       {auditSnapshot === null && (
         <div className="px-4 py-6">
-          <WorkbenchEmptyState onRunAudit={onRunAudit} auditRunning={auditRunning} />
+          <WorkbenchEmptyState
+            auditConnectGate={auditConnectGate}
+            onRunAudit={onRunAudit}
+            auditRunning={auditRunning}
+          />
         </div>
       )}
       {auditSnapshot !== null && findings.length === 0 && (

{plugin_scanner-2.0.644 → plugin_scanner-2.0.646}/dashboard/src/scrg159-170.test.ts

@@ -246,6 +246,57 @@ assert(pipIssue !== undefined, "SCRG162-D: unprotected pip should be flagged");
 assert(pipIssue!.severity === "high", "SCRG162-E: unprotected manager should be high severity");
 assert(pipIssue!.remediation.includes("Guard"), "SCRG162-F: remediation should point back to Guard action");
 
+const auditWithInstalledUnprotected = deriveFrontendAuditResults(
+  [],
+  {
+    ...baseSnapshot,
+    supply_chain: {
+      package_manager_protection: {
+        ...makeProtection([], ["npm", "pnpm"]),
+        installed_managers: ["npm", "pnpm"],
+        active_managers: [],
+        path_status: "missing_from_path",
+        path_contains_shim_dir: false,
+      },
+    },
+  },
+);
+const installedNpmIssue = auditWithInstalledUnprotected.find((r) => r.id === "unprotected-npm");
+assert(installedNpmIssue !== undefined, "SCRG162-F2: installed npm should still appear in audit");
+assert(
+  installedNpmIssue!.title.includes("PATH still needs repair"),
+  "SCRG162-F3: installed manager should not claim shim is missing",
+);
+assert(
+  installedNpmIssue!.remediationAction?.label === "Repair PATH",
+  "SCRG162-F4: installed manager remediation should repair PATH instead of install",
+);
+
+const auditWithRestartInstalled = deriveFrontendAuditResults(
+  [],
+  {
+    ...baseSnapshot,
+    supply_chain: {
+      package_manager_protection: {
+        ...makeProtection([], ["pnpm"]),
+        installed_managers: ["pnpm"],
+        path_status: "restart_required",
+        restart_shell_required: true,
+      },
+    },
+  },
+);
+const restartPnpmIssue = auditWithRestartInstalled.find((r) => r.id === "unprotected-pnpm");
+assert(restartPnpmIssue !== undefined, "SCRG162-F6: restart-required installed manager should appear");
+assert(
+  restartPnpmIssue!.title.includes("waiting for restart"),
+  "SCRG162-F7: restart-required manager should prompt for restart",
+);
+assert(
+  restartPnpmIssue!.remediationAction === null,
+  "SCRG162-F8: restart-required manager should not expose install remediation",
+);
+
 const receiptNow = new Date().toISOString();
 const blockedReceipt = makeReceipt("block", receiptNow);
 const auditWithBlocked = deriveFrontendAuditResults([blockedReceipt], baseSnapshot);

plugin_scanner-2.0.646/dashboard/src/supply-chain-audit-connect.test.tsx

@@ -0,0 +1,107 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { GuardHarnessActionError } from "./guard-api";
+import { ConnectFlowCard } from "./supply-chain-firewall-views";
+import {
+  isSupplyChainAuditConnectError,
+  packageAuditNeedsCloudConnect,
+  resolveSupplyChainAuditConnectGate,
+  supplyChainAuditConnectUserMessage,
+} from "./supply-chain-audit-connect";
+import type { PackageFirewallStatusResponse } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const connectRequiredStatus: PackageFirewallStatusResponse = {
+  operation: "status",
+  status: "completed",
+  supported_managers: ["npm"],
+  detected_managers: ["npm"],
+  last_audit_proof_at: null,
+  protection: null,
+  package_shims: [],
+  entitlement: {
+    allowed: false,
+    reason: "guard_cloud_connect_required",
+    tier: "unknown",
+    upgrade_cta: "Connect HOL Guard Cloud to check package firewall access and run package firewall actions.",
+    upgrade_url: null,
+  },
+  actions: {
+    install: "connect_required",
+    repair: "disabled",
+    test: "connect_required",
+    audit: "connect_required",
+    sync: "connect_required",
+    remove: "disabled",
+  },
+  cli_fallback: {
+    connect: "hol-guard connect",
+  },
+  connect_flow: {
+    state: "idle",
+    title: "Connect HOL Guard Cloud to enable package firewall",
+    detail: "Connect HOL Guard Cloud here so the daemon can verify package-firewall access.",
+    action_label: "Connect HOL Guard Cloud",
+    connect_url: "https://hol.org/guard/connect",
+    authorize_url: null,
+    browser_opened: null,
+    request_id: null,
+    poll_after_ms: null,
+  },
+};
+
+assert(packageAuditNeedsCloudConnect(connectRequiredStatus), "audit action should require cloud connect");
+const gate = resolveSupplyChainAuditConnectGate(connectRequiredStatus, { resumeAfterConnect: true });
+assert(gate !== null, "audit connect gate should resolve for connect-required status");
+assert(
+  gate?.headline.includes("Sign in"),
+  "audit connect gate should use human-readable sign-in copy",
+);
+assert(
+  !gate?.headline.includes("guard_cloud_connect_required"),
+  "audit connect gate should not surface raw daemon error codes",
+);
+
+const connectError = new GuardHarnessActionError(403, {
+  error: "guard_cloud_connect_required",
+  message: "Connect HOL Guard Cloud on this machine before running package firewall actions.",
+  operation: "audit",
+});
+assert(isSupplyChainAuditConnectError(connectError), "structured audit connect errors should be detectable");
+assert(
+  supplyChainAuditConnectUserMessage(connectError)?.includes("Sign in"),
+  "audit connect user message should guide sign-in before retry",
+);
+
+const auditConnectMarkup = renderToStaticMarkup(
+  <ConnectFlowCard
+    compact
+    connectError={null}
+    connectStarting={false}
+    connectFlow={connectRequiredStatus.connect_flow!}
+    detail={gate!.detail}
+    headline={gate!.headline}
+    mode="connect"
+    onStartConnect={() => undefined}
+    purpose="audit"
+  />,
+);
+
+assert(
+  auditConnectMarkup.includes("Run workspace audit"),
+  "audit connect card should show audit-specific final step",
+);
+assert(
+  auditConnectMarkup.includes("Connect HOL Guard Cloud"),
+  "audit connect card should keep the primary connect action",
+);
+assert(
+  !auditConnectMarkup.includes("guard_cloud_connect_required"),
+  "audit connect card markup should not expose raw error codes",
+);
+
+console.log("supply-chain-audit-connect.test.ts: all assertions passed");

plugin_scanner-2.0.646/dashboard/src/supply-chain-audit-connect.ts

@@ -0,0 +1,83 @@
+import { GuardHarnessActionError } from "./guard-api";
+import type { PackageFirewallStatusResponse } from "./guard-types";
+
+export const SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES = [
+  "guard_cloud_connect_required",
+  "guard_cloud_reconnect_required",
+] as const;
+
+export type SupplyChainAuditConnectErrorCode =
+  (typeof SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES)[number];
+
+export type SupplyChainAuditConnectGate = {
+  mode: "connect" | "repair";
+  headline: string;
+  detail: string;
+  resumeAfterConnect: boolean;
+};
+
+export function isSupplyChainAuditConnectError(error: unknown): error is GuardHarnessActionError {
+  if (!(error instanceof GuardHarnessActionError)) {
+    return false;
+  }
+  const code = error.payload?.error;
+  return (
+    typeof code === "string" &&
+    (SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES as readonly string[]).includes(code)
+  );
+}
+
+export function packageAuditNeedsCloudConnect(data: PackageFirewallStatusResponse): boolean {
+  const auditAction = data.actions.audit;
+  return auditAction === "connect_required" || auditAction === "reconnect_required";
+}
+
+function resolveAuditConnectMode(data: PackageFirewallStatusResponse): "connect" | "repair" {
+  if (data.entitlement.reason === "guard_cloud_reconnect_required") {
+    return "repair";
+  }
+  if (
+    data.entitlement.reason === "guard_cloud_connect_required" &&
+    (data.entitlement.tier !== "unknown" || data.package_shims.some((shim) => shim.installed))
+  ) {
+    return "repair";
+  }
+  return "connect";
+}
+
+export function resolveSupplyChainAuditConnectGate(
+  data: PackageFirewallStatusResponse,
+  options?: { resumeAfterConnect?: boolean },
+): SupplyChainAuditConnectGate | null {
+  if (!packageAuditNeedsCloudConnect(data) || data.connect_flow === null) {
+    return null;
+  }
+  const mode = resolveAuditConnectMode(data);
+  if (mode === "repair") {
+    return {
+      mode,
+      headline: "Reconnect Guard Cloud to run the workspace audit",
+      detail:
+        "Guard needs a fresh Cloud sign-in on this machine before it can scan workspace packages and surface findings here.",
+      resumeAfterConnect: options?.resumeAfterConnect ?? false,
+    };
+  }
+  return {
+    mode,
+    headline: "Sign in to Guard Cloud before running the audit",
+    detail:
+      "Package audits run through Guard Cloud. Sign in once on this machine, then Guard can scan dependencies and list flagged packages.",
+    resumeAfterConnect: options?.resumeAfterConnect ?? false,
+  };
+}
+
+export function supplyChainAuditConnectUserMessage(error: unknown): string | null {
+  if (!isSupplyChainAuditConnectError(error)) {
+    return null;
+  }
+  const code = error.payload?.error;
+  if (code === "guard_cloud_reconnect_required") {
+    return "Reconnect HOL Guard Cloud, then run the workspace audit again.";
+  }
+  return "Sign in to HOL Guard Cloud on this machine, then run the workspace audit.";
+}