plugin-scanner 2.0.648__tar.gz → 2.0.650__tar.gz

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.648
+Version: 2.0.650
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/guard-api.ts

@@ -2423,6 +2423,7 @@ export function normalizePackageFirewallStatus(value: unknown): PackageFirewallS
   const protectedSet = new Set(protectedManagers);
   const lastAuditProofAt =
     stringValue(readPackageShimField(shimStatus, "last_audit_proof_at", "lastAuditProofAt")) ?? null;
+  const auditWorkspaceDir = stringValue(record.audit_workspace_dir) ?? null;
   const shellProfilePath = readPackageShimField(shimStatus, "shell_profile_path", "shellProfilePath");
   const protection: PackageManagerProtection = {
     path_status: rawPathStatus,
@@ -2443,6 +2444,7 @@ export function normalizePackageFirewallStatus(value: unknown): PackageFirewallS
   };
   return {
     actions: normalizePackageFirewallActions(record.actions),
+    audit_workspace_dir: auditWorkspaceDir,
     cli_fallback: normalizePackageFirewallCliFallback(record.cli_fallback),
     connect_flow: normalizePackageFirewallConnectFlow(record.connect_flow),
     detected_managers: detectedManagers,
@@ -2595,14 +2597,21 @@ export async function runAuditRemediation(input: AuditRemediationInput): Promise
   return normalizePackageFirewallAction(payload);
 }
 
-export async function runPackageAudit(): Promise<PackageFirewallActionResponse> {
+export async function runPackageAudit(input?: {
+  workspaceDir?: string | null;
+}): Promise<PackageFirewallActionResponse> {
+  const workspaceDir = input?.workspaceDir?.trim() ?? null;
+  const body: Record<string, string> = {};
+  if (workspaceDir) {
+    body.workspace_dir = workspaceDir;
+  }
   const response = await fetchGuardApi("/v1/supply-chain/audit", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
       ...guardAuthHeaders(),
     },
-    body: JSON.stringify({}),
+    body: JSON.stringify(body),
   });
   const payloadBody = (await response.json().catch(() => null)) as unknown;
   if (!response.ok) {

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/guard-types.ts

@@ -708,6 +708,7 @@ export type PackageFirewallStatusResponse = {
   supported_managers: string[];
   detected_managers: string[];
   last_audit_proof_at: string | null;
+  audit_workspace_dir?: string | null;
   protection: PackageManagerProtection | null;
   package_shims: PackageShimEntry[];
   entitlement: PackageFirewallEntitlement;

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/package-workbench-panel.tsx

@@ -4,6 +4,7 @@ import {
   HiMiniArrowDown,
   HiMiniArrowUp,
   HiMiniBugAnt,
+  HiMiniExclamationTriangle,
   HiMiniMagnifyingGlass,
 } from "react-icons/hi2";
 import { SectionLabel, Tag, ActionButton, EmptyState } from "./approval-center-primitives";
@@ -26,6 +27,7 @@ import type { AuditConnectGateViewState } from "./supply-chain-firewall-panel";
 
 type PackageWorkbenchPanelProps = {
   auditConnectGate?: AuditConnectGateViewState | null;
+  auditError?: string | null;
   auditSnapshot: SupplyChainAuditSnapshot | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
@@ -333,11 +335,29 @@ function EcosystemChip({ ecosystem, active, onSelect }: EcosystemChipProps) {
 
 type WorkbenchEmptyStateProps = {
   auditConnectGate?: AuditConnectGateViewState | null;
+  auditError?: string | null;
   onRunAudit?: () => void;
   auditRunning?: boolean;
 };
 
-function WorkbenchEmptyState({ auditConnectGate, onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
+function WorkbenchAuditErrorBanner({ message }: { message: string }) {
+  return (
+    <div
+      className="mb-4 flex items-start gap-2 rounded-xl border border-brand-attention/30 bg-brand-attention/[0.04] px-3 py-2.5"
+      role="alert"
+      aria-live="assertive"
+      data-testid="workbench-audit-error"
+    >
+      <HiMiniExclamationTriangle className="mt-0.5 h-4 w-4 shrink-0 text-brand-attention" aria-hidden="true" />
+      <div className="min-w-0">
+        <p className="text-sm font-medium text-brand-dark">Workspace audit could not start</p>
+        <p className="mt-0.5 text-xs leading-relaxed text-slate-600">{message}</p>
+      </div>
+    </div>
+  );
+}
+
+function WorkbenchEmptyState({ auditConnectGate, auditError, onRunAudit, auditRunning }: WorkbenchEmptyStateProps) {
   if (auditConnectGate !== null && auditConnectGate !== undefined) {
     return (
       <ConnectFlowCard
@@ -355,24 +375,28 @@ function WorkbenchEmptyState({ auditConnectGate, onRunAudit, auditRunning }: Wor
   }
 
   return (
-    <EmptyState
-      title="No workspace audit yet"
-      body="Run a package audit to index dependencies and surface flagged packages here."
-      tone="teach"
-      action={
-        onRunAudit !== undefined ? (
-          <ActionButton variant="outline" onClick={onRunAudit} disabled={auditRunning} aria-busy={auditRunning}>
-            <HiMiniBugAnt className="mr-1.5 h-4 w-4" aria-hidden="true" />
-            Run audit
-          </ActionButton>
-        ) : undefined
-      }
-    />
+    <>
+      {auditError ? <WorkbenchAuditErrorBanner message={auditError} /> : null}
+      <EmptyState
+        title="No workspace audit yet"
+        body="Run a package audit to index dependencies and surface flagged packages here."
+        tone="teach"
+        action={
+          onRunAudit !== undefined ? (
+            <ActionButton variant="outline" onClick={onRunAudit} disabled={auditRunning} aria-busy={auditRunning}>
+              <HiMiniBugAnt className="mr-1.5 h-4 w-4" aria-hidden="true" />
+              Run audit
+            </ActionButton>
+          ) : undefined
+        }
+      />
+    </>
   );
 }
 
 export function PackageWorkbenchPanel({
   auditConnectGate = null,
+  auditError = null,
   auditSnapshot,
   onRunAudit,
   auditRunning = false,
@@ -462,6 +486,7 @@ export function PackageWorkbenchPanel({
         <div className="px-4 py-6">
           <WorkbenchEmptyState
             auditConnectGate={auditConnectGate}
+            auditError={auditError}
             onRunAudit={onRunAudit}
             auditRunning={auditRunning}
           />

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/supply-chain-audit-connect.test.tsx

@@ -6,6 +6,7 @@ import {
   packageAuditNeedsCloudConnect,
   resolveSupplyChainAuditConnectGate,
   supplyChainAuditConnectUserMessage,
+  supplyChainAuditUserMessage,
 } from "./supply-chain-audit-connect";
 import type { PackageFirewallStatusResponse } from "./guard-types";
 
@@ -77,6 +78,21 @@ assert(
   "audit connect user message should guide sign-in before retry",
 );
 
+const workspaceError = new GuardHarnessActionError(400, {
+  error: "workspace_dir_required",
+  message:
+    "Guard needs a project folder with package manifests before it can run the workspace audit.",
+  operation: "audit",
+});
+assert(
+  supplyChainAuditUserMessage(workspaceError)?.includes("project folder"),
+  "workspace audit errors should surface actionable copy instead of raw codes",
+);
+assert(
+  !isSupplyChainAuditConnectError(workspaceError),
+  "workspace_dir_required should not be treated as a cloud connect gate",
+);
+
 const auditConnectMarkup = renderToStaticMarkup(
   <ConnectFlowCard
     compact

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/supply-chain-audit-connect.ts

@@ -81,3 +81,19 @@ export function supplyChainAuditConnectUserMessage(error: unknown): string | nul
   }
   return "Sign in to HOL Guard Cloud on this machine, then run the workspace audit.";
 }
+
+export function supplyChainAuditUserMessage(error: unknown): string | null {
+  if (error instanceof GuardHarnessActionError) {
+    if (error.payload?.error === "workspace_dir_required") {
+      return (
+        error.payload.message ??
+        "Guard needs a connected app project folder with package manifests before it can run the workspace audit."
+      );
+    }
+    return supplyChainAuditConnectUserMessage(error);
+  }
+  if (error instanceof Error && error.message.trim()) {
+    return error.message;
+  }
+  return null;
+}

plugin_scanner-2.0.650/dashboard/src/supply-chain-audit-workspace.test.ts

@@ -0,0 +1,51 @@
+import {
+  resolveSupplyChainAuditWorkspaceDir,
+  resolveSupplyChainAuditWorkspaceTarget,
+} from "./supply-chain-audit-workspace";
+import type { GuardManagedInstall } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const installs: GuardManagedInstall[] = [
+  {
+    harness: "codex",
+    active: false,
+    workspace: "workspace/inactive",
+    manifest: {},
+    updated_at: "2026-06-08T11:00:00.000Z",
+  },
+  {
+    harness: "cursor",
+    active: true,
+    workspace: "workspace/active-project",
+    manifest: {},
+    updated_at: "2026-06-08T10:00:00.000Z",
+  },
+];
+
+assert(
+  resolveSupplyChainAuditWorkspaceDir(installs) === "workspace/active-project",
+  "audit workspace resolver should prefer active managed installs",
+);
+
+assert(
+  resolveSupplyChainAuditWorkspaceTarget({
+    managedWorkspaceDir: "workspace/managed",
+    statusWorkspaceDir: "workspace/status",
+  }) === "workspace/managed",
+  "audit workspace target should prefer managed install workspace",
+);
+
+assert(
+  resolveSupplyChainAuditWorkspaceTarget({
+    managedWorkspaceDir: null,
+    statusWorkspaceDir: "workspace/status",
+  }) === "workspace/status",
+  "audit workspace target should fall back to daemon status workspace",
+);
+
+console.log("supply-chain-audit-workspace.test.ts passed");

plugin_scanner-2.0.650/dashboard/src/supply-chain-audit-workspace.ts

@@ -0,0 +1,34 @@
+import type { GuardManagedInstall } from "./guard-types";
+
+export function resolveSupplyChainAuditWorkspaceDir(
+  managedInstalls: readonly GuardManagedInstall[],
+): string | null {
+  const ordered = [...managedInstalls].sort((left, right) => {
+    if (left.active !== right.active) {
+      return left.active ? -1 : 1;
+    }
+    return right.updated_at.localeCompare(left.updated_at);
+  });
+  for (const install of ordered) {
+    const workspace = install.workspace?.trim();
+    if (workspace) {
+      return workspace;
+    }
+  }
+  return null;
+}
+
+export function resolveSupplyChainAuditWorkspaceTarget(input: {
+  managedWorkspaceDir?: string | null;
+  statusWorkspaceDir?: string | null;
+}): string | null {
+  const managed = input.managedWorkspaceDir?.trim();
+  if (managed) {
+    return managed;
+  }
+  const status = input.statusWorkspaceDir?.trim();
+  if (status) {
+    return status;
+  }
+  return null;
+}

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -23,8 +23,10 @@ import {
   isSupplyChainAuditConnectError,
   packageAuditNeedsCloudConnect,
   resolveSupplyChainAuditConnectGate,
+  supplyChainAuditUserMessage,
   type SupplyChainAuditConnectGate,
 } from "./supply-chain-audit-connect";
+import { resolveSupplyChainAuditWorkspaceTarget } from "./supply-chain-audit-workspace";
 import {
   FirewallControlsView,
   type FirewallFailedOp,
@@ -141,7 +143,9 @@ export type AuditConnectGateViewState = {
 export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   props: {
   approvalGate: GuardApprovalGatePublicConfig | null;
+  auditWorkspaceDir?: string | null;
   onAuditConnectGateChange?: (state: AuditConnectGateViewState | null) => void;
+  onAuditErrorChange?: (message: string | null) => void;
   onStateChanged?: () => Promise<void> | void;
   onAuditCompleted?: (resultDetail: Record<string, unknown>) => void;
   onAuditRunningChange?: (running: boolean) => void;
@@ -151,7 +155,9 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
 ) {
   const {
     approvalGate,
+    auditWorkspaceDir,
     onAuditConnectGateChange,
+    onAuditErrorChange,
     onStateChanged,
     onAuditCompleted,
     onAuditRunningChange,
@@ -235,12 +241,20 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       setLastFailed(null);
       setConnectError(null);
       setActivationAssistError(null);
+      onAuditErrorChange?.(null);
       onAuditRunningChange?.(true);
+      const statusWorkspaceDir =
+        panelLoad.phase === "loaded" ? panelLoad.data.audit_workspace_dir ?? null : null;
+      const workspaceDir = resolveSupplyChainAuditWorkspaceTarget({
+        managedWorkspaceDir: auditWorkspaceDir,
+        statusWorkspaceDir,
+      });
       try {
-        const response = await runPackageAudit();
+        const response = await runPackageAudit({ workspaceDir });
         setLastCompleted({ op: "audit", manager: null, response });
         onAuditCompleted?.(response.result_detail);
         clearAuditConnectGate();
+        onAuditErrorChange?.(null);
         await refreshAfterOp();
         await onStateChanged?.();
       } catch (err) {
@@ -248,19 +262,23 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
           openAuditConnectGate(true);
           return;
         }
-        const message = err instanceof Error ? err.message : "Operation failed.";
+        const message = supplyChainAuditUserMessage(err) ?? "Operation failed.";
         setLastFailed({ op: "audit", manager: null, message });
+        onAuditErrorChange?.(message);
       } finally {
         onAuditRunningChange?.(false);
         setPendingOp(null);
       }
     },
     [
+      auditWorkspaceDir,
       clearAuditConnectGate,
       onAuditCompleted,
+      onAuditErrorChange,
       onAuditRunningChange,
       onStateChanged,
       openAuditConnectGate,
+      panelLoad,
       refreshAfterOp,
     ],
   );

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/dashboard/src/supply-chain-workspace.tsx

@@ -31,7 +31,7 @@ import { resolveSupplyChainCloudCapabilities } from "./supply-chain-cloud-capabi
 import { SupplyChainCloudCapabilitiesPanel } from "./supply-chain-cloud-capabilities-panel";
 import { PackageWorkbenchPanel } from "./package-workbench-panel";
 import { resolveSupplyChainIssues, type SupplyChainIssueAction } from "./supply-chain-issues";
-import { resolveSupplyChainWorkspaceHero } from "./supply-chain-workspace-hero-state";
+import { resolveSupplyChainAuditWorkspaceDir } from "./supply-chain-audit-workspace";
 import { SupplyChainStatusHeader } from "./supply-chain-status-header";
 import { SUPPLY_CHAIN_WORKSPACE_SHELL_CLASS } from "./supply-chain-workspace-layout";
 
@@ -128,6 +128,7 @@ export function SupplyChainWorkspace({
   const [auditSnapshot, setAuditSnapshot] = useState<SupplyChainAuditSnapshot | null>(null);
   const [evidenceRail, setEvidenceRail] = useState<SupplyChainEvidenceRailSnapshot | null>(null);
   const [auditRunning, setAuditRunning] = useState(false);
+  const [auditError, setAuditError] = useState<string | null>(null);
   const [auditConnectGate, setAuditConnectGate] = useState<AuditConnectGateViewState | null>(null);
   const runAuditRef = useRef<(() => void) | null>(null);
   const firewallPanelRef = useRef<PackageFirewallPanelHandle>(null);
@@ -173,6 +174,10 @@ export function SupplyChainWorkspace({
   );
 
 
+  const auditWorkspaceDir = useMemo(
+    () => resolveSupplyChainAuditWorkspaceDir(managedInstalls),
+    [managedInstalls],
+  );
   const supplyChainIssues = useMemo(() => resolveSupplyChainIssues(snapshot), [snapshot]);
   const workspaceHero = useMemo(
     () => resolveSupplyChainWorkspaceHero(snapshot, { openIssueCount: supplyChainIssues.length }),
@@ -209,6 +214,11 @@ export function SupplyChainWorkspace({
   const handleAuditCompleted = useCallback((resultDetail: Record<string, unknown>) => {
     const normalized = normalizeSupplyChainAuditSnapshot(resultDetail);
     setAuditSnapshot(normalized);
+    setAuditError(null);
+  }, []);
+
+  const handleAuditErrorChange = useCallback((message: string | null) => {
+    setAuditError(message);
   }, []);
 
   const handleAuditRunningChange = useCallback((running: boolean) => {
@@ -244,6 +254,7 @@ export function SupplyChainWorkspace({
 
       <PackageWorkbenchPanel
         auditConnectGate={auditConnectGate}
+        auditError={auditError}
         auditSnapshot={auditSnapshot}
         auditRunning={auditRunning}
         onRunAudit={handleRunAudit}
@@ -254,7 +265,9 @@ export function SupplyChainWorkspace({
       <PackageFirewallPanel
         ref={firewallPanelRef}
         approvalGate={approvalGate}
+        auditWorkspaceDir={auditWorkspaceDir}
         onAuditConnectGateChange={setAuditConnectGate}
+        onAuditErrorChange={handleAuditErrorChange}
         onStateChanged={onRuntimeRefresh}
         onAuditCompleted={handleAuditCompleted}
         onAuditRunningChange={handleAuditRunningChange}

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.648"
+version = "2.0.650"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.648"
+version = "2.0.650"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/src/codex_plugin_scanner/guard/adapters/antigravity.py

@@ -211,27 +211,37 @@ class AntigravityHarnessAdapter(HarnessAdapter):
             if manifest_payload:
                 self._append_found_path(found_paths, manifest_path)
             publisher = (
-                manifest_payload.get("publisher") if isinstance(manifest_payload.get("publisher"), str) else None
+                manifest_payload.get("publisher")
+                if manifest_payload is not None and isinstance(manifest_payload.get("publisher"), str)
+                else None
             )
             if publisher is None and isinstance(metadata, dict):
                 publisher_display_name = metadata.get("publisherDisplayName")
                 if isinstance(publisher_display_name, str):
                     publisher = publisher_display_name
+            display_name = (
+                manifest_payload.get("displayName")
+                if manifest_payload is not None and isinstance(manifest_payload.get("displayName"), str)
+                else None
+            )
+            manifest_description = (
+                manifest_payload.get("description")
+                if manifest_payload is not None and isinstance(manifest_payload.get("description"), str)
+                else None
+            )
             artifacts.append(
                 GuardArtifact(
                     artifact_id=f"antigravity:global:{extension_id}",
-                    name=extension_id,
+                    name=display_name or extension_id,
                     harness=self.harness,
                     artifact_type="extension",
                     source_scope="global",
                     config_path=str(manifest_path if manifest_payload else Path(location_path)),
                     publisher=publisher,
                     metadata={
-                        "display_name": (
-                            manifest_payload.get("displayName")
-                            if isinstance(manifest_payload.get("displayName"), str)
-                            else None
-                        )
+                        "display_name": display_name,
+                        "description": manifest_description,
+                        "extension_id": extension_id,
                     },
                 )
             )

{plugin_scanner-2.0.648 → plugin_scanner-2.0.650}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -92,6 +92,7 @@ from ..insights_share import publish_insights_share
 from ..local_dashboard_session import LOCAL_DASHBOARD_SESSION_AUDIENCE, build_local_dashboard_session_token
 from ..local_supply_chain import (
     build_workspace_audit_payload,
+    managed_install_audit_workspace_dirs,
     resolve_package_firewall_entitlement_with_refresh,
     resolve_supply_chain_audit_workspace_dir,
 )
@@ -2144,12 +2145,14 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
     def _handle_supply_chain_package_firewall_status(self) -> None:
         entitlement = self._supply_chain_entitlement()
         status = package_shim_status(self._harness_context({}))
+        audit_workspace_dir = self._resolve_supply_chain_workspace_dir({})
         self._write_json(
             {
                 "actions": package_firewall_action_states(
                     entitlement,
                     has_installed_managers=bool(status.get("installed_managers")),
                 ),
+                "audit_workspace_dir": (str(audit_workspace_dir) if audit_workspace_dir is not None else None),
                 "cli_fallback": {
                     "connect": "hol-guard connect",
                     "install": "hol-guard package-shims install --json",
@@ -2215,7 +2218,15 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             self._write_approval_gate_error(error)
             return
         except ValueError as error:
-            self._write_json({"error": str(error), "operation": operation}, status=400)
+            error_code = str(error)
+            error_payload: dict[str, object] = {"error": error_code, "operation": operation}
+            if error_code == "workspace_dir_required":
+                error_payload["message"] = (
+                    "Guard needs a project folder with package manifests before it can run "
+                    "the workspace audit. Open Guard from a connected app workspace or pass "
+                    "workspace_dir in the audit request."
+                )
+            self._write_json(error_payload, status=400)
             return
         receipt_overrides = package_firewall_receipt_metadata(
             operation=operation,
@@ -2292,17 +2303,18 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             return sync_supply_chain_bundle(self.server.store)  # type: ignore[attr-defined]
         raise ValueError("unsupported_supply_chain_operation")
 
-    @staticmethod
-    def _resolve_supply_chain_workspace_dir(payload: dict[str, object]) -> Path | None:
+    def _resolve_supply_chain_workspace_dir(self, payload: dict[str, object]) -> Path | None:
         allowed_roots = (
             Path.home().resolve(),
             Path.cwd().resolve(),
             Path(tempfile.gettempdir()).resolve(),
         )
+        managed_workspace_dirs = managed_install_audit_workspace_dirs(self.server.store)  # type: ignore[attr-defined]
         return resolve_supply_chain_audit_workspace_dir(
             workspace_dir_value=payload.get("workspace_dir"),
             workspace_value=payload.get("workspace"),
             allowed_roots=allowed_roots,
+            managed_workspace_dirs=managed_workspace_dirs,
         )
 
     def _supply_chain_context(self, payload: dict[str, object]) -> HarnessContext: