plugin-scanner 2.0.655__tar.gz → 2.0.657__tar.gz

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.655
+Version: 2.0.657
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/scsr-phase09c-evidence-rail.test.ts

@@ -174,4 +174,27 @@ assert(
   "SCSR154-G: blocked audit receipts still surface in audit slot",
 );
 
+const incompleteAuditReceipt: GuardReceipt = {
+  ...auditReceipt,
+  receipt_id: "receipt-audit-incomplete-1",
+  policy_decision: "ask",
+  capabilities_summary: "Sync Guard supply-chain intel on this device before auditing workspace packages.",
+  timestamp: "2026-06-09T16:00:00.000Z",
+  scanner_evidence: [
+    {
+      operation: "audit",
+      audit_status: "incomplete",
+      audit_decision: "monitor",
+      blocked_package_count: 0,
+      total_packages: 0,
+    },
+  ] as unknown as GuardReceipt["scanner_evidence"],
+};
+const incompleteRail = deriveSupplyChainEvidenceRail([incompleteAuditReceipt]);
+assert(
+  incompleteRail.audit.title === "Workspace audit did not complete",
+  "SCSR154-H: incomplete audit receipts surface warning copy on evidence rail",
+);
+assert(incompleteRail.audit.tone === "attention", "SCSR154-I: incomplete audit receipts use attention tone");
+
 console.log("scsr-phase09c-evidence-rail.test.ts: all assertions passed");

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/scsr-phase10-package-workbench.test.ts

@@ -4,6 +4,7 @@ import {
   normalizeSupplyChainAuditSnapshot,
   sortPackageWorkbenchFindings,
 } from "./supply-chain-audit-normalize";
+import { isSupplyChainAuditIncomplete } from "./supply-chain-audit-result";
 import type { GuardReceipt } from "./guard-types";
 
 function assert(condition: boolean, message: string): void {
@@ -142,5 +143,21 @@ assert(
   normalizeSupplyChainAuditSnapshot({ generated_at: "2026-06-09T12:00:00.000Z" }) === null,
   "SCSR175-B: empty audit payload returns null snapshot",
 );
+assert(
+  normalizeSupplyChainAuditSnapshot({
+    generated_at: "2026-06-09T12:00:00.000Z",
+    lockfile_paths: ["package-lock.json"],
+    audit_status: "incomplete",
+  }) === null,
+  "SCSR175-C: incomplete lockfile-only audit does not masquerade as clean findings",
+);
+assert(
+  isSupplyChainAuditIncomplete({
+    generated_at: "2026-06-09T12:00:00.000Z",
+    exit_code: 2,
+    evaluation: { decision: "block", packages: [{ name: "risky-lib", decision: "block" }] },
+  }) === false,
+  "SCSR175-D: blocked completed audits are not treated as incomplete",
+);
 
 console.log("scsr-phase10-package-workbench.test.ts: all assertions passed");

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/supply-chain-audit-connect.ts

@@ -1,5 +1,8 @@
 import { GuardHarnessActionError } from "./guard-api";
 import type { PackageFirewallStatusResponse } from "./guard-types";
+import { isSupplyChainAuditIncomplete, resolveSupplyChainAuditFailure } from "./supply-chain-audit-result";
+
+export { isSupplyChainAuditIncomplete, resolveSupplyChainAuditFailure };
 
 export const SUPPLY_CHAIN_AUDIT_CONNECT_ERROR_CODES = [
   "guard_cloud_connect_required",

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/supply-chain-audit-normalize.ts

@@ -9,6 +9,7 @@ import type {
   SupplyChainAuditSeverity,
   SupplyChainAuditSnapshot,
 } from "./guard-types";
+import { isSupplyChainAuditIncomplete } from "./supply-chain-audit-result";
 
 const SEVERITY_RANK: Record<SupplyChainAuditSeverity, number> = {
   critical: 4,
@@ -264,6 +265,9 @@ export function normalizeSupplyChainAuditSnapshot(
   if (!isRecord(raw)) {
     return null;
   }
+  if (isSupplyChainAuditIncomplete(raw)) {
+    return null;
+  }
   const evaluation = isRecord(raw.evaluation) ? raw.evaluation : null;
   const findingsFromEvidence = normalizePackageFindings(raw.package_findings);
   const findings =
@@ -277,8 +281,6 @@ export function normalizeSupplyChainAuditSnapshot(
   const hasAuditContext =
     findings.length > 0 ||
     inventory.totalPackages > 0 ||
-    manifestPaths.length > 0 ||
-    lockfilePaths.length > 0 ||
     evaluation !== null;
   if (!hasAuditContext) {
     return null;
@@ -310,6 +312,7 @@ export function derivePackageWorkbenchFromReceipts(receipts: GuardReceipt[]): Su
     const snapshot = normalizeSupplyChainAuditSnapshot(
       {
         generated_at: receipt.timestamp,
+        audit_status: evidenceRaw.audit_status,
         evaluation: {
           decision: evidenceRaw.audit_decision,
           packages: evidenceRaw.package_findings,

plugin_scanner-2.0.657/dashboard/src/supply-chain-audit-result.test.ts

@@ -0,0 +1,48 @@
+import {
+  isSupplyChainAuditIncomplete,
+  resolveSupplyChainAuditFailure,
+} from "./supply-chain-audit-result";
+import { normalizeSupplyChainAuditSnapshot } from "./supply-chain-audit-normalize";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const incompletePayload = {
+  generated_at: "2026-06-13T18:22:54.785483+00:00",
+  mode: "audit",
+  manifest_paths: [],
+  lockfile_paths: ["package-lock.json"],
+  audit_outcome: "sync_required",
+  audit_status: "incomplete",
+  message: "Sync Guard supply-chain intel on this device before auditing workspace packages.",
+  supply_chain: {
+    status: "sync_required",
+    detail: "Run `hol-guard supply-chain sync` to fetch the latest signed bundle.",
+  },
+};
+
+assert(
+  isSupplyChainAuditIncomplete(incompletePayload),
+  "incomplete audit payload is detected",
+);
+assert(
+  resolveSupplyChainAuditFailure(incompletePayload)?.includes("Sync Guard supply-chain intel"),
+  "sync_required audit returns actionable failure copy",
+);
+assert(
+  normalizeSupplyChainAuditSnapshot(incompletePayload) === null,
+  "incomplete audit does not hydrate a clean findings snapshot",
+);
+
+assert(
+  isSupplyChainAuditIncomplete({
+    exit_code: 2,
+    evaluation: { decision: "block" },
+  }) === false,
+  "blocked completed audits with non-zero exit code stay complete",
+);
+
+console.log("supply-chain-audit-result.test.ts: all assertions passed");

plugin_scanner-2.0.657/dashboard/src/supply-chain-audit-result.ts

@@ -0,0 +1,50 @@
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(value: unknown): string | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+export function isSupplyChainAuditIncomplete(detail: unknown): boolean {
+  if (!isRecord(detail)) {
+    return false;
+  }
+  return readString(detail.audit_status) === "incomplete";
+}
+
+export function resolveSupplyChainAuditFailure(detail: unknown): string | null {
+  if (!isRecord(detail) || !isSupplyChainAuditIncomplete(detail)) {
+    return null;
+  }
+  const outcome = readString(detail.audit_outcome);
+  const message = readString(detail.message);
+  const supplyChain = isRecord(detail.supply_chain) ? detail.supply_chain : null;
+  const supplyStatus = readString(supplyChain?.status);
+  if (outcome === "sync_required" || supplyStatus === "sync_required") {
+    return (
+      message ??
+      "Guard supply-chain intel is not synced on this device. Run Sync, then audit again."
+    );
+  }
+  if (outcome === "inventory_empty") {
+    return (
+      message ??
+      "Guard found project files but could not index any packages for audit."
+    );
+  }
+  if (outcome === "no_project_files") {
+    return (
+      message ??
+      "No supported manifests or lockfiles were found in the audit workspace."
+    );
+  }
+  if (message !== null) {
+    return message;
+  }
+  return "Workspace audit did not complete. Review supply-chain status and try again.";
+}

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/supply-chain-evidence-rail.ts

@@ -115,6 +115,24 @@ function auditRailItem(receipt: GuardReceipt): SupplyChainEvidenceRailItem {
   const evidence = (receipt.scanner_evidence ?? []).find(
     (entry) => readOperation(entry) === "audit",
   );
+  const auditStatus =
+    isRecord(evidence) && typeof evidence.audit_status === "string"
+      ? evidence.audit_status
+      : null;
+  if (auditStatus === "incomplete") {
+    return {
+      kind: "audit",
+      timestamp: receipt.timestamp,
+      title: "Workspace audit did not complete",
+      detail:
+        receipt.capabilities_summary.trim().length > 0
+          ? receipt.capabilities_summary
+          : "Guard could not index workspace packages for audit.",
+      receiptId: receipt.receipt_id,
+      harness: receipt.harness,
+      tone: "attention",
+    };
+  }
   const decision =
     isRecord(evidence) && typeof evidence.audit_decision === "string"
       ? evidence.audit_decision

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/supply-chain-firewall-action-result.ts

@@ -1,3 +1,8 @@
+import {
+  isSupplyChainAuditIncomplete,
+  resolveSupplyChainAuditFailure,
+} from "./supply-chain-audit-result";
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -27,6 +32,28 @@ export type PackageFirewallActionResultDetail = {
 };
 
 function parseAuditActionResult(result: Record<string, unknown>): PackageFirewallActionResultDetail {
+  if (isSupplyChainAuditIncomplete(result)) {
+    const failureMessage = resolveSupplyChainAuditFailure(result);
+    const manifestPaths = readStringArray(result.manifest_paths);
+    const lockfilePaths = readStringArray(result.lockfile_paths);
+    const lines: string[] = [];
+    if (manifestPaths.length > 0) {
+      lines.push(`Manifests found: ${manifestPaths.join(", ")}.`);
+    }
+    if (lockfilePaths.length > 0) {
+      lines.push(`Lockfiles found: ${lockfilePaths.join(", ")}.`);
+    }
+    if (failureMessage !== null) {
+      lines.push(failureMessage);
+    }
+    return {
+      emptyState: false,
+      lines,
+      summary: "Workspace audit did not complete.",
+      tone: "warning",
+    };
+  }
+
   const evaluation = isRecord(result.evaluation) ? result.evaluation : null;
   const decision = readString(evaluation?.decision) ?? readString(result.decision) ?? "monitor";
   const manifestPaths = readStringArray(result.manifest_paths);

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -23,6 +23,7 @@ import {
   isSupplyChainAuditConnectError,
   packageAuditNeedsCloudConnect,
   resolveSupplyChainAuditConnectGate,
+  resolveSupplyChainAuditFailure,
   supplyChainAuditUserMessage,
   type SupplyChainAuditConnectGate,
 } from "./supply-chain-audit-connect";
@@ -251,6 +252,16 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       });
       try {
         const response = await runPackageAudit({ workspaceDir });
+        const failureMessage = resolveSupplyChainAuditFailure(response.result_detail);
+        if (failureMessage !== null) {
+          setLastFailed({ op: "audit", manager: null, message: failureMessage });
+          setLastCompleted(null);
+          onAuditErrorChange?.(failureMessage);
+          clearAuditConnectGate();
+          await refreshAfterOp();
+          await onStateChanged?.();
+          return;
+        }
         setLastCompleted({ op: "audit", manager: null, response });
         onAuditCompleted?.(response.result_detail);
         clearAuditConnectGate();

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/dashboard/src/supply-chain-workspace.tsx

@@ -17,6 +17,7 @@ import type {
   SupplyChainAuditSnapshot,
 } from "./guard-types";
 import { derivePackageWorkbenchFromReceipts, fetchReceipts, normalizeSupplyChainAuditSnapshot } from "./guard-api";
+import { resolveSupplyChainAuditFailure } from "./supply-chain-audit-connect";
 import { PackageFirewallPanel, type PackageFirewallPanelHandle } from "./supply-chain-firewall-panel";
 import type { AuditConnectGateViewState } from "./supply-chain-firewall-panel";
 import { SupplyChainBundlePanel } from "./supply-chain-bundle-panel";
@@ -213,6 +214,12 @@ export function SupplyChainWorkspace({
   }, [snapshot.generated_at, snapshot.receipt_count]);
 
   const handleAuditCompleted = useCallback((resultDetail: Record<string, unknown>) => {
+    const failureMessage = resolveSupplyChainAuditFailure(resultDetail);
+    if (failureMessage !== null) {
+      setAuditSnapshot(null);
+      setAuditError(failureMessage);
+      return;
+    }
     const normalized = normalizeSupplyChainAuditSnapshot(resultDetail);
     setAuditSnapshot(normalized);
     setAuditError(null);

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.655"
+version = "2.0.657"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.655"
+version = "2.0.657"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -2250,12 +2250,17 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 else None
             ),
         )
+        response_status = "completed"
+        if operation == "audit":
+            audit_status = result.get("audit_status")
+            if audit_status == "incomplete":
+                response_status = "incomplete"
         response_payload: dict[str, object] = {
             "entitlement": entitlement,
             "operation": operation,
             "receipt": receipt,
             "result": result,
-            "status": "completed",
+            "status": response_status,
         }
         if operation == "audit":
             cloud_sync = _queue_headless_cloud_sync(store=self.server.store)  # type: ignore[attr-defined]

{plugin_scanner-2.0.655 → plugin_scanner-2.0.657}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/supply-chain-workspace.js

@@ -1,4 +1,4 @@
-import { au as GuardHarnessActionError, r as reactExports, j as jsxRuntimeExports, d as HiMiniCheckCircle, aw as HiMiniArrowPath, w as HiMiniExclamationTriangle, ac as Tag, m as formatRelativeTime, aG as HiMiniClock, aH as IconActionButton, I as HiMiniXCircle, ax as HiMiniTrash, l as HiMiniShieldCheck, F as HiMiniWrenchScrewdriver, aI as HiMiniBeaker, aJ as ActivationSummary, aK as ActionResultPanel, ad as HiMiniMagnifyingGlass, b as EmptyState, A as ActionButton, aL as HiMiniBugAnt, o as HiMiniXMark, aM as fetchPackageFirewallStatus, aN as runPackageAudit, aO as startPackageFirewallConnect, aP as runPackageFirewallAction, aQ as parseInterceptProofSnapshot, aR as runPackageSync, aS as openPackageFirewallShell, S as SectionLabel, aT as EntitlementNotice, aU as fetchSupplyChainBundle, aE as HiMiniArrowTopRightOnSquare, B as Badge, aV as HiMiniDocumentMagnifyingGlass, aW as HiMiniShieldExclamation, aX as HiMiniComputerDesktop, t as HiMiniCloud, aY as ConnectFlowCard, aZ as HiMiniArrowDown, a_ as HiMiniArrowUp, ah as HiMiniArrowLeft, a$ as HiMiniArrowRight, b0 as HiMiniCloudArrowUp, b1 as HiMiniInformationCircle, b2 as fetchReceipts, h as harnessDisplayName, p as HiMiniChevronUp, q as HiMiniChevronDown } from "../guard-dashboard.js";
+import { aG as isSupplyChainAuditIncomplete, au as GuardHarnessActionError, r as reactExports, j as jsxRuntimeExports, d as HiMiniCheckCircle, aw as HiMiniArrowPath, w as HiMiniExclamationTriangle, ac as Tag, m as formatRelativeTime, aH as HiMiniClock, aI as IconActionButton, I as HiMiniXCircle, ax as HiMiniTrash, l as HiMiniShieldCheck, F as HiMiniWrenchScrewdriver, aJ as HiMiniBeaker, aK as ActivationSummary, aL as ActionResultPanel, ad as HiMiniMagnifyingGlass, b as EmptyState, A as ActionButton, aM as HiMiniBugAnt, o as HiMiniXMark, aN as fetchPackageFirewallStatus, aO as runPackageAudit, aP as resolveSupplyChainAuditFailure, aQ as startPackageFirewallConnect, aR as runPackageFirewallAction, aS as parseInterceptProofSnapshot, aT as runPackageSync, aU as openPackageFirewallShell, S as SectionLabel, aV as EntitlementNotice, aW as fetchSupplyChainBundle, aE as HiMiniArrowTopRightOnSquare, B as Badge, aX as HiMiniDocumentMagnifyingGlass, aY as HiMiniShieldExclamation, aZ as HiMiniComputerDesktop, t as HiMiniCloud, a_ as ConnectFlowCard, a$ as HiMiniArrowDown, b0 as HiMiniArrowUp, ah as HiMiniArrowLeft, b1 as HiMiniArrowRight, b2 as HiMiniCloudArrowUp, b3 as HiMiniInformationCircle, b4 as fetchReceipts, h as harnessDisplayName, p as HiMiniChevronUp, q as HiMiniChevronDown } from "../guard-dashboard.js";
 import { u as useResolvedApprovalGate, A as ApprovalProofModal, b as buildSupplyChainStats } from "./supply-chain-protection-stats.js";
 import { resolveFeedStaleness } from "./feed-health-workspace.js";
 import { r as resolveHomeProtectionStatus } from "./home-protection-module.js";
@@ -222,6 +222,9 @@ function normalizeSupplyChainAuditSnapshot(raw, receiptId = null) {
   if (!isRecord$1(raw)) {
     return null;
   }
+  if (isSupplyChainAuditIncomplete(raw)) {
+    return null;
+  }
   const evaluation = isRecord$1(raw.evaluation) ? raw.evaluation : null;
   const findingsFromEvidence = normalizePackageFindings(raw.package_findings);
   const findings = findingsFromEvidence.length > 0 ? findingsFromEvidence : packageRecordsFromEvaluation(evaluation);
@@ -230,7 +233,7 @@ function normalizeSupplyChainAuditSnapshot(raw, receiptId = null) {
   const decision = normalizeDecision(evaluation?.decision ?? raw.audit_decision);
   const manifestPaths = readStringArray(raw.manifest_paths);
   const lockfilePaths = readStringArray(raw.lockfile_paths);
-  const hasAuditContext = findings.length > 0 || inventory.totalPackages > 0 || manifestPaths.length > 0 || lockfilePaths.length > 0 || evaluation !== null;
+  const hasAuditContext = findings.length > 0 || inventory.totalPackages > 0 || evaluation !== null;
   if (!hasAuditContext) {
     return null;
   }
@@ -257,6 +260,7 @@ function derivePackageWorkbenchFromReceipts(receipts) {
     const snapshot = normalizeSupplyChainAuditSnapshot(
       {
         generated_at: receipt.timestamp,
+        audit_status: evidenceRaw.audit_status,
         evaluation: {
           decision: evidenceRaw.audit_decision,
           packages: evidenceRaw.package_findings
@@ -1152,6 +1156,16 @@ const PackageFirewallPanel = reactExports.forwardRef(function PackageFirewallPan
       });
       try {
         const response = await runPackageAudit({ workspaceDir });
+        const failureMessage = resolveSupplyChainAuditFailure(response.result_detail);
+        if (failureMessage !== null) {
+          setLastFailed({ op: "audit", manager: null, message: failureMessage });
+          setLastCompleted(null);
+          onAuditErrorChange?.(failureMessage);
+          clearAuditConnectGate();
+          await refreshAfterOp();
+          await onStateChanged?.();
+          return;
+        }
         setLastCompleted({ op: "audit", manager: null, response });
         onAuditCompleted?.(response.result_detail);
         clearAuditConnectGate();
@@ -1744,6 +1758,18 @@ function auditRailItem(receipt) {
   const evidence = (receipt.scanner_evidence ?? []).find(
     (entry) => readOperation(entry) === "audit"
   );
+  const auditStatus = isRecord(evidence) && typeof evidence.audit_status === "string" ? evidence.audit_status : null;
+  if (auditStatus === "incomplete") {
+    return {
+      kind: "audit",
+      timestamp: receipt.timestamp,
+      title: "Workspace audit did not complete",
+      detail: receipt.capabilities_summary.trim().length > 0 ? receipt.capabilities_summary : "Guard could not index workspace packages for audit.",
+      receiptId: receipt.receipt_id,
+      harness: receipt.harness,
+      tone: "attention"
+    };
+  }
   const decision = isRecord(evidence) && typeof evidence.audit_decision === "string" ? evidence.audit_decision : receipt.policy_decision;
   const blockedCount = isRecord(evidence) && typeof evidence.blocked_package_count === "number" ? evidence.blocked_package_count : 0;
   const totalPackages = isRecord(evidence) && typeof evidence.total_packages === "number" ? evidence.total_packages : blockedCount;
@@ -2924,6 +2950,12 @@ function SupplyChainWorkspace({
     };
   }, [snapshot.generated_at, snapshot.receipt_count]);
   const handleAuditCompleted = reactExports.useCallback((resultDetail) => {
+    const failureMessage = resolveSupplyChainAuditFailure(resultDetail);
+    if (failureMessage !== null) {
+      setAuditSnapshot(null);
+      setAuditError(failureMessage);
+      return;
+    }
     const normalized = normalizeSupplyChainAuditSnapshot(resultDetail);
     setAuditSnapshot(normalized);
     setAuditError(null);