plugin-scanner 2.0.661__tar.gz → 2.0.663__tar.gz

{plugin_scanner-2.0.661 → plugin_scanner-2.0.663}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.661
+Version: 2.0.663
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.661 → plugin_scanner-2.0.663}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

plugin_scanner-2.0.663/dashboard/src/supply-chain-audit-recovery-modal.tsx

@@ -0,0 +1,227 @@
+import { useCallback } from "react";
+import {
+  HiMiniArrowPath,
+  HiMiniArrowTopRightOnSquare,
+  HiMiniBugAnt,
+  HiMiniCloudArrowDown,
+  HiMiniShieldCheck,
+} from "react-icons/hi2";
+import { ActionButton, Tag } from "./approval-center-primitives";
+import { GuardModalLayer } from "./guard-modal-layer";
+import type { PackageFirewallStatusResponse } from "./guard-types";
+import { ConnectFlowCard } from "./supply-chain-firewall-views";
+import type { SupplyChainAuditRecoveryGate } from "./supply-chain-audit-recovery";
+
+export type AuditRecoveryModalPhase =
+  | "ready"
+  | "syncing"
+  | "connecting"
+  | "auditing"
+  | "failed";
+
+type AuditRecoveryModalProps = {
+  gate: SupplyChainAuditRecoveryGate;
+  phase: AuditRecoveryModalPhase;
+  error: string | null;
+  connectError: string | null;
+  connectStarting: boolean;
+  connectFlow: PackageFirewallStatusResponse["connect_flow"];
+  onClose: () => void;
+  onPrimaryAction: () => void;
+  onStartConnect: () => void;
+};
+
+function resolvePhaseLabel(phase: AuditRecoveryModalPhase): string {
+  if (phase === "syncing") {
+    return "Syncing intel";
+  }
+  if (phase === "connecting") {
+    return "Waiting for Cloud";
+  }
+  if (phase === "auditing") {
+    return "Running audit";
+  }
+  if (phase === "failed") {
+    return "Needs attention";
+  }
+  return "Setup required";
+}
+
+function resolvePhaseTone(phase: AuditRecoveryModalPhase): "blue" | "attention" | "green" {
+  if (phase === "failed") {
+    return "attention";
+  }
+  if (phase === "auditing") {
+    return "green";
+  }
+  return "blue";
+}
+
+function resolvePrimaryIcon(
+  gate: SupplyChainAuditRecoveryGate,
+  phase: AuditRecoveryModalPhase,
+): typeof HiMiniCloudArrowDown {
+  if (phase === "auditing") {
+    return HiMiniBugAnt;
+  }
+  if (gate.primaryAction === "connect") {
+    return HiMiniShieldCheck;
+  }
+  if (gate.primaryAction === "retry_audit") {
+    return HiMiniBugAnt;
+  }
+  return HiMiniCloudArrowDown;
+}
+
+function resolvePrimaryLabel(
+  gate: SupplyChainAuditRecoveryGate,
+  phase: AuditRecoveryModalPhase,
+): string {
+  if (phase === "syncing") {
+    return "Syncing supply-chain intel";
+  }
+  if (phase === "connecting") {
+    return "Waiting for Guard Cloud";
+  }
+  if (phase === "auditing") {
+    return "Running workspace audit";
+  }
+  return gate.primaryLabel;
+}
+
+function resolveActiveStepIndex(
+  gate: SupplyChainAuditRecoveryGate,
+  phase: AuditRecoveryModalPhase,
+): number {
+  if (phase === "auditing") {
+    return gate.steps.length;
+  }
+  if (phase === "syncing") {
+    return gate.obstacle === "cloud_auth" ? 2 : 1;
+  }
+  if (phase === "connecting") {
+    return 1;
+  }
+  return 0;
+}
+
+export function AuditRecoveryModal({
+  gate,
+  phase,
+  error,
+  connectError,
+  connectStarting,
+  connectFlow,
+  onClose,
+  onPrimaryAction,
+  onStartConnect,
+}: AuditRecoveryModalProps) {
+  const activeStep = resolveActiveStepIndex(gate, phase);
+  const primaryBusy = phase === "syncing" || phase === "connecting" || phase === "auditing";
+  const PrimaryIcon = resolvePrimaryIcon(gate, phase);
+  const showConnectFlow =
+    gate.primaryAction === "connect" && connectFlow !== null && phase !== "auditing";
+
+  const handlePrimaryClick = useCallback(() => {
+    if (primaryBusy) {
+      return;
+    }
+    onPrimaryAction();
+  }, [onPrimaryAction, primaryBusy]);
+
+  return (
+    <GuardModalLayer ariaLabel="Finish workspace audit setup" onClose={onClose}>
+      <div className="rounded-2xl border border-slate-200 bg-white shadow-xl">
+        <div className="border-b border-slate-100 px-5 py-4">
+          <div className="flex items-start justify-between gap-3">
+            <div className="min-w-0 space-y-2">
+              <div className="flex flex-wrap items-center gap-2">
+                <p className="text-[10px] font-semibold uppercase tracking-[0.18em] text-brand-blue">
+                  Workspace audit
+                </p>
+                <Tag tone={resolvePhaseTone(phase)}>{resolvePhaseLabel(phase)}</Tag>
+              </div>
+              <h2 className="text-lg font-semibold tracking-[-0.02em] text-brand-dark">
+                {gate.headline}
+              </h2>
+              <p className="max-w-xl text-sm leading-relaxed text-slate-600">{gate.detail}</p>
+            </div>
+            <button
+              type="button"
+              onClick={onClose}
+              className="shrink-0 text-sm font-medium text-slate-500 hover:text-brand-dark"
+            >
+              Close
+            </button>
+          </div>
+        </div>
+
+        {showConnectFlow ? (
+          <ConnectFlowCard
+            minimal
+            purpose="audit"
+            mode="repair"
+            connectFlow={connectFlow}
+            connectStarting={connectStarting}
+            connectError={connectError}
+            headline={gate.headline}
+            detail={gate.detail}
+            onStartConnect={onStartConnect}
+          />
+        ) : (
+          <div className="space-y-5 px-5 py-5">
+            <ol className="grid gap-3 sm:grid-cols-2">
+              {gate.steps.map((step, index) => {
+                const stepNumber = index + 1;
+                const isActive = stepNumber === activeStep;
+                const isComplete = stepNumber < activeStep;
+                return (
+                  <li
+                    key={step.title}
+                    className={`rounded-xl border px-3 py-3 ${
+                      isActive
+                        ? "border-brand-blue/25 bg-brand-blue/[0.04]"
+                        : isComplete
+                          ? "border-slate-200 bg-slate-50/80"
+                          : "border-slate-200 bg-white"
+                    }`}
+                  >
+                    <p className="text-xs font-semibold uppercase tracking-[0.14em] text-slate-500">
+                      Step {stepNumber}
+                      {isComplete ? " · Done" : isActive ? " · In progress" : ""}
+                    </p>
+                    <p className="mt-1 text-sm font-semibold text-brand-dark">{step.title}</p>
+                    <p className="mt-0.5 text-xs leading-relaxed text-slate-600">{step.body}</p>
+                  </li>
+                );
+              })}
+            </ol>
+
+            {error !== null ? (
+              <p className="text-sm text-brand-attention" role="alert">
+                {error}
+              </p>
+            ) : null}
+
+            <div className="flex flex-wrap items-center gap-2">
+              <ActionButton variant="primary" onClick={handlePrimaryClick} disabled={primaryBusy}>
+                {primaryBusy ? (
+                  <HiMiniArrowPath className="mr-1.5 h-4 w-4 animate-spin" aria-hidden="true" />
+                ) : (
+                  <PrimaryIcon className="mr-1.5 h-4 w-4" aria-hidden="true" />
+                )}
+                {resolvePrimaryLabel(gate, phase)}
+              </ActionButton>
+              {gate.primaryAction === "connect" && connectFlow?.authorize_url ? (
+                <ActionButton href={connectFlow.authorize_url} variant="outline">
+                  Open sign-in
+                  <HiMiniArrowTopRightOnSquare className="ml-1.5 h-3.5 w-3.5" aria-hidden="true" />
+                </ActionButton>
+              ) : null}
+            </div>
+          </div>
+        )}
+      </div>
+    </GuardModalLayer>
+  );
+}

plugin_scanner-2.0.663/dashboard/src/supply-chain-audit-recovery.test.ts

@@ -0,0 +1,46 @@
+import { resolveSupplyChainAuditRecoveryGate } from "./supply-chain-audit-recovery";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const syncRequiredPayload = {
+  audit_status: "incomplete",
+  audit_outcome: "sync_required",
+  message: "Sync Guard supply-chain intel on this device before auditing workspace packages.",
+  supply_chain: { status: "sync_required" },
+};
+
+const syncGate = resolveSupplyChainAuditRecoveryGate(syncRequiredPayload);
+assert(syncGate !== null, "sync_required resolves recovery gate");
+assert(syncGate!.primaryAction === "sync", "sync_required offers sync action");
+assert(syncGate!.autoRetryAuditAfterPrimary === true, "sync_required auto-retries audit");
+assert(syncGate!.steps.length === 2, "sync_required shows two-step flow");
+
+const inventoryEmptyGate = resolveSupplyChainAuditRecoveryGate({
+  audit_status: "incomplete",
+  audit_outcome: "inventory_empty",
+});
+assert(inventoryEmptyGate?.primaryAction === "sync", "inventory_empty offers sync recovery");
+
+const noProjectGate = resolveSupplyChainAuditRecoveryGate({
+  audit_status: "incomplete",
+  audit_outcome: "no_project_files",
+});
+assert(noProjectGate?.primaryAction === "retry_audit", "no_project_files offers retry only");
+assert(
+  noProjectGate?.autoRetryAuditAfterPrimary === false,
+  "no_project_files does not auto-chain sync",
+);
+
+assert(
+  resolveSupplyChainAuditRecoveryGate({
+    exit_code: 2,
+    evaluation: { decision: "block" },
+  }) === null,
+  "completed blocked audits do not open recovery",
+);
+
+console.log("supply-chain-audit-recovery.test.ts: all assertions passed");

plugin_scanner-2.0.663/dashboard/src/supply-chain-audit-recovery.ts

@@ -0,0 +1,136 @@
+import { isRecord, isSupplyChainAuditIncomplete, readString } from "./supply-chain-audit-result";
+
+export type SupplyChainAuditRecoveryAction = "sync" | "connect" | "retry_audit";
+
+export type SupplyChainAuditRecoveryObstacle =
+  | "sync_required"
+  | "cloud_auth"
+  | "inventory_empty"
+  | "no_project_files"
+  | "unknown";
+
+export type SupplyChainAuditRecoveryGate = {
+  obstacle: SupplyChainAuditRecoveryObstacle;
+  headline: string;
+  detail: string;
+  steps: Array<{ title: string; body: string }>;
+  primaryAction: SupplyChainAuditRecoveryAction;
+  primaryLabel: string;
+  autoRetryAuditAfterPrimary: boolean;
+};
+
+const SYNC_RECOVERY_STEPS = [
+  {
+    title: "Sync intel",
+    body: "Guard downloads the latest signed supply-chain bundle on this device.",
+  },
+  {
+    title: "Run audit",
+    body: "Guard scans workspace manifests and lists flagged packages automatically.",
+  },
+] as const;
+
+export function resolveSupplyChainAuditRecoveryGate(
+  detail: unknown,
+): SupplyChainAuditRecoveryGate | null {
+  if (!isSupplyChainAuditIncomplete(detail)) {
+    return null;
+  }
+  const outcome = readString(detail.audit_outcome);
+  const message = readString(detail.message);
+  const supplyChain = isRecord(detail.supply_chain) ? detail.supply_chain : null;
+  const supplyStatus = readString(supplyChain?.status);
+
+  if (outcome === "sync_required" || supplyStatus === "sync_required") {
+    return {
+      obstacle: "sync_required",
+      headline: "Sync supply-chain intel before auditing",
+      detail:
+        message ??
+        "Guard needs the latest signed package intelligence on this device. Sync once, then Guard reruns the workspace audit for you.",
+      steps: [...SYNC_RECOVERY_STEPS],
+      primaryAction: "sync",
+      primaryLabel: "Sync supply-chain intel",
+      autoRetryAuditAfterPrimary: true,
+    };
+  }
+
+  if (
+    outcome === "not_connected" ||
+    outcome === "expired" ||
+    outcome === "degraded" ||
+    supplyStatus === "not_connected" ||
+    supplyStatus === "expired" ||
+    supplyStatus === "degraded"
+  ) {
+    return {
+      obstacle: "cloud_auth",
+      headline: "Reconnect Guard Cloud before auditing",
+      detail:
+        message ??
+        "Guard Cloud sign-in is missing or stale on this machine. Reconnect once, then Guard can sync intel and rerun the audit.",
+      steps: [
+        {
+          title: "Reconnect Cloud",
+          body: "Approve Guard Cloud access in your browser on this device.",
+        },
+        {
+          title: "Sync and audit",
+          body: "Guard refreshes supply-chain intel, then reruns the workspace audit.",
+        },
+      ],
+      primaryAction: "connect",
+      primaryLabel: "Reconnect Guard Cloud",
+      autoRetryAuditAfterPrimary: true,
+    };
+  }
+
+  if (outcome === "inventory_empty") {
+    return {
+      obstacle: "inventory_empty",
+      headline: "Refresh intel before auditing packages",
+      detail:
+        message ??
+        "Guard found project files but could not index packages yet. Syncing intel often fixes stale inventory, then Guard reruns the audit.",
+      steps: [...SYNC_RECOVERY_STEPS],
+      primaryAction: "sync",
+      primaryLabel: "Sync and retry audit",
+      autoRetryAuditAfterPrimary: true,
+    };
+  }
+
+  if (outcome === "no_project_files") {
+    return {
+      obstacle: "no_project_files",
+      headline: "Add project manifests before auditing",
+      detail:
+        message ??
+        "Guard could not find supported manifests or lockfiles in the audit workspace. Open the connected project folder, add package files, then try the audit again.",
+      steps: [
+        {
+          title: "Open workspace",
+          body: "Use the connected app project folder with package.json, lockfiles, or Python manifests.",
+        },
+        {
+          title: "Run audit",
+          body: "Guard indexes dependencies and surfaces flagged packages.",
+        },
+      ],
+      primaryAction: "retry_audit",
+      primaryLabel: "Run audit again",
+      autoRetryAuditAfterPrimary: false,
+    };
+  }
+
+  return {
+    obstacle: "unknown",
+    headline: "Finish setup before auditing",
+    detail:
+      message ??
+      "The workspace audit did not complete. Sync supply-chain intel, then try the audit again.",
+    steps: [...SYNC_RECOVERY_STEPS],
+    primaryAction: "sync",
+    primaryLabel: "Sync supply-chain intel",
+    autoRetryAuditAfterPrimary: true,
+  };
+}

{plugin_scanner-2.0.661 → plugin_scanner-2.0.663}/dashboard/src/supply-chain-audit-result.ts

@@ -1,8 +1,8 @@
-function isRecord(value: unknown): value is Record<string, unknown> {
+export function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-function readString(value: unknown): string | null {
+export function readString(value: unknown): string | null {
   if (typeof value !== "string") {
     return null;
   }

{plugin_scanner-2.0.661 → plugin_scanner-2.0.663}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -38,6 +38,11 @@ import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
 import { parseInterceptProofSnapshot, type InterceptProofSnapshot } from "./supply-chain-firewall-action-result";
 import { InterceptProofModal } from "./supply-chain-intercept-proof-modal";
 import { SupplyChainManagerDrawer } from "./supply-chain-manager-drawer";
+import { resolveSupplyChainAuditRecoveryGate, type SupplyChainAuditRecoveryGate } from "./supply-chain-audit-recovery";
+import {
+  AuditRecoveryModal,
+  type AuditRecoveryModalPhase,
+} from "./supply-chain-audit-recovery-modal";
 
 type PanelLoadState =
   | { phase: "loading" }
@@ -165,6 +170,7 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     runAuditRef,
   } = props;
   const rootRef = useRef<HTMLDivElement>(null);
+  const recoveryConnectHandledRef = useRef(false);
   const [panelLoad, setPanelLoad] = useState<PanelLoadState>({ phase: "loading" });
   const [pendingOp, setPendingOp] = useState<PendingOp | null>(null);
   const [lastCompleted, setLastCompleted] = useState<CompletedOp | null>(null);
@@ -181,8 +187,17 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   const [managerDrawerTarget, setManagerDrawerTarget] = useState<string | null>(null);
   const [auditConnectGateActive, setAuditConnectGateActive] = useState(false);
   const [resumeAuditAfterConnect, setResumeAuditAfterConnect] = useState(false);
+  const [auditRecoveryGate, setAuditRecoveryGate] = useState<SupplyChainAuditRecoveryGate | null>(null);
+  const [auditRecoveryPhase, setAuditRecoveryPhase] = useState<AuditRecoveryModalPhase>("ready");
+  const [auditRecoveryError, setAuditRecoveryError] = useState<string | null>(null);
   const { resolvedApprovalGate, resolveApprovalGate } = useResolvedApprovalGate(approvalGate);
 
+  const closeAuditRecovery = useCallback(() => {
+    setAuditRecoveryGate(null);
+    setAuditRecoveryPhase("ready");
+    setAuditRecoveryError(null);
+  }, []);
+
   const load = useCallback(async () => {
     setPanelLoad({ phase: "loading" });
     try {
@@ -237,7 +252,8 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   }, []);
 
   const runAuditOperation = useCallback(
-    async () => {
+    async (options?: { openRecoveryModal?: boolean }) => {
+      const openRecoveryModal = options?.openRecoveryModal ?? true;
       setPendingOp({ op: "audit", manager: null });
       setLastFailed(null);
       setConnectError(null);
@@ -252,30 +268,46 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       });
       try {
         const response = await runPackageAudit({ workspaceDir });
+        const recoveryGate = resolveSupplyChainAuditRecoveryGate(response.result_detail);
         const failureMessage = resolveSupplyChainAuditFailure(response.result_detail);
         if (failureMessage !== null) {
+          if (openRecoveryModal && recoveryGate !== null) {
+            setAuditRecoveryGate(recoveryGate);
+            setAuditRecoveryPhase("ready");
+            setAuditRecoveryError(null);
+            onAuditErrorChange?.(null);
+            clearAuditConnectGate();
+            await refreshAfterOp();
+            await onStateChanged?.();
+            return false;
+          }
           setLastFailed({ op: "audit", manager: null, message: failureMessage });
           setLastCompleted(null);
           onAuditErrorChange?.(failureMessage);
           clearAuditConnectGate();
           await refreshAfterOp();
           await onStateChanged?.();
-          return;
+          return false;
         }
         setLastCompleted({ op: "audit", manager: null, response });
         onAuditCompleted?.(response.result_detail);
         clearAuditConnectGate();
+        closeAuditRecovery();
         onAuditErrorChange?.(null);
         await refreshAfterOp();
         await onStateChanged?.();
+        return true;
       } catch (err) {
         if (isSupplyChainAuditConnectError(err)) {
           openAuditConnectGate(true);
-          return;
+          return false;
         }
         const message = supplyChainAuditUserMessage(err) ?? "Operation failed.";
         setLastFailed({ op: "audit", manager: null, message });
         onAuditErrorChange?.(message);
+        setAuditRecoveryPhase("failed");
+        setAuditRecoveryError(message);
+        return false;
       } finally {
         onAuditRunningChange?.(false);
         setPendingOp(null);
@@ -284,6 +316,7 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     [
       auditWorkspaceDir,
       clearAuditConnectGate,
+      closeAuditRecovery,
       onAuditCompleted,
       onAuditErrorChange,
       onAuditRunningChange,
@@ -294,6 +327,49 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     ],
   );
 
+  const continueAuditAfterRecovery = useCallback(async () => {
+    setAuditRecoveryPhase("auditing");
+    setAuditRecoveryError(null);
+    const succeeded = await runAuditOperation({ openRecoveryModal: true });
+    if (succeeded) {
+      return;
+    }
+    setAuditRecoveryPhase((currentPhase) => (currentPhase === "failed" ? "failed" : "ready"));
+  }, [runAuditOperation]);
+
+  const runRecoverySync = useCallback(async () => {
+    setAuditRecoveryPhase("syncing");
+    setAuditRecoveryError(null);
+    try {
+      const response = await runPackageSync();
+      setLastCompleted({ op: "sync", manager: null, response });
+      await refreshAfterOp();
+      await onStateChanged?.();
+      if (auditRecoveryGate?.autoRetryAuditAfterPrimary) {
+        await continueAuditAfterRecovery();
+        return;
+      }
+      setAuditRecoveryPhase("ready");
+    } catch (err) {
+      if (isSupplyChainAuditConnectError(err)) {
+        const connectGate = resolveSupplyChainAuditRecoveryGate({
+          audit_status: "incomplete",
+          audit_outcome: "not_connected",
+        });
+        if (connectGate !== null) {
+          setAuditRecoveryGate(connectGate);
+        }
+        setAuditRecoveryPhase("ready");
+        setAuditRecoveryError(null);
+        return;
+      }
+      const message = err instanceof Error ? err.message : "Sync failed.";
+      setAuditRecoveryError(message);
+      setAuditRecoveryPhase("failed");
+      setLastFailed({ op: "sync", manager: null, message });
+    }
+  }, [auditRecoveryGate, continueAuditAfterRecovery, onStateChanged, refreshAfterOp]);
+
   const handleStartConnect = useCallback(async () => {
     setStartingConnect(true);
     setConnectError(null);
@@ -311,6 +387,32 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     }
   }, [onStateChanged, refreshAfterOp]);
 
+  const handleRecoveryPrimary = useCallback(() => {
+    if (
+      auditRecoveryGate === null ||
+      (auditRecoveryPhase !== "ready" && auditRecoveryPhase !== "failed")
+    ) {
+      return;
+    }
+    if (auditRecoveryGate.primaryAction === "sync") {
+      void runRecoverySync();
+      return;
+    }
+    if (auditRecoveryGate.primaryAction === "connect") {
+      setAuditRecoveryPhase("connecting");
+      setAuditRecoveryError(null);
+      void handleStartConnect();
+      return;
+    }
+    void continueAuditAfterRecovery();
+  }, [
+    auditRecoveryGate,
+    auditRecoveryPhase,
+    continueAuditAfterRecovery,
+    handleStartConnect,
+    runRecoverySync,
+  ]);
+
   useEffect(() => {
     if (panelLoad.phase !== "loaded" || !auditConnectGateActive) {
       onAuditConnectGateChange?.(null);
@@ -353,6 +455,29 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
     void runAuditOperation();
   }, [panelLoad, resumeAuditAfterConnect, runAuditOperation]);
 
+  useEffect(() => {
+    if (auditRecoveryPhase === "connecting") {
+      recoveryConnectHandledRef.current = false;
+    }
+  }, [auditRecoveryPhase]);
+
+  useEffect(() => {
+    if (panelLoad.phase !== "loaded" || auditRecoveryGate === null) {
+      return;
+    }
+    if (auditRecoveryPhase !== "connecting") {
+      return;
+    }
+    if (recoveryConnectHandledRef.current) {
+      return;
+    }
+    if (!panelLoad.data.entitlement.allowed || packageAuditNeedsCloudConnect(panelLoad.data)) {
+      return;
+    }
+    recoveryConnectHandledRef.current = true;
+    void runRecoverySync();
+  }, [auditRecoveryGate, auditRecoveryPhase, panelLoad, runRecoverySync]);
+
   const handleAction = useCallback(
     async (
       op: PackageFirewallActionType,
@@ -640,6 +765,23 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       {interceptProof !== null && (
         <InterceptProofModal proof={interceptProof} onClose={handleCloseInterceptProof} />
       )}
+
+      {auditRecoveryGate !== null ? (
+        <AuditRecoveryModal
+          gate={auditRecoveryGate}
+          phase={auditRecoveryPhase}
+          error={auditRecoveryError}
+          connectError={connectError}
+          connectStarting={startingConnect}
+          connectFlow={panelLoad.phase === "loaded" ? panelLoad.data.connect_flow : null}
+          onClose={closeAuditRecovery}
+          onPrimaryAction={handleRecoveryPrimary}
+          onStartConnect={() => {
+            setAuditRecoveryPhase("connecting");
+            void handleStartConnect();
+          }}
+        />
+      ) : null}
     </div>
   );
 });