plugin-scanner 2.0.734__tar.gz → 2.0.736__tar.gz

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.734
+Version: 2.0.736
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.736/dashboard/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "hol-guard-dashboard",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "test": "tsx src/github-issue-link.test.ts && tsx src/shell-footer.test.ts && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test:e2e": "playwright test",
+    "dev": "vite dev"
+  },
+  "dependencies": {
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-qr-code": "^2.0.16",
+    "react-icons": "^5.6.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.50.0",
+    "@tailwindcss/vite": "^4.1.4",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^5.0.4",
+    "tailwindcss": "^4.1.4",
+    "tsx": "^4.8.1",
+    "typescript": "^5.9.3",
+    "vite": "^7.1.10"
+  }
+}

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/dashboard/src/approval-center-layout.tsx

@@ -15,9 +15,9 @@ import {
   HiMiniInformationCircle,
   HiMiniArrowPath,
 } from "react-icons/hi2";
+import { ShellFooter } from "./shell-footer";
 import {
   ShellHeader,
-  ShellFooter,
   ShellSidebar,
   Surface,
   Badge,
@@ -330,7 +330,7 @@ export function ApprovalCenterLayout(props: LayoutProps) {
           onBulkBlock={props.onBulkBlock}
         />
       )}
-      <div className={`flex flex-col transition-all duration-200 ${sidebarCollapsed ? "lg:pl-20" : "lg:pl-64"}`}>
+      <div className={`flex flex-col transition-all duration-200 lg:min-h-screen ${sidebarCollapsed ? "lg:pl-20" : "lg:pl-64"}`}>
         <main id="main-content" className="flex-1 p-4 sm:p-6 lg:p-8" tabIndex={-1}>
           <div className={props.view === "inbox" ? "mx-auto max-w-none" : "mx-auto max-w-6xl"}>
             {props.view === "home" ? (

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/dashboard/src/approval-center-primitives.tsx

@@ -33,42 +33,6 @@ import { GuardUpdatePanel } from "./guard-update-panel";
 import { GITHUB_ISSUE_BUTTON_LABEL, GITHUB_ISSUE_LINK } from "./github-issue-link";
 import type { GuardUpdatePhase, GuardUpdateStatus } from "./guard-types";
 
-const footerSections = [
-  {
-    title: "Guard",
-    links: [
-      { href: "https://hol.org/guard", label: "Cloud Dashboard" },
-      { href: "https://hol.org/guard/pricing", label: "Pricing" },
-      { href: "https://hol.org/guard/docs", label: "Docs" }
-    ]
-  },
-  {
-    title: "Docs",
-    links: [
-      { href: "https://hol.org/registry/docs", label: "API Reference" },
-      { href: "https://hol.org/docs/libraries/standards-sdk", label: "Standards SDK" },
-      { href: "https://hol.org/docs/standards/hcs-1", label: "Standards" }
-    ]
-  },
-  {
-    title: "Community",
-    links: [
-      { href: "https://x.com/HashgraphOnline", label: "X" },
-      { href: "https://t.me/hashinals", label: "Telegram" }
-    ]
-  },
-  {
-    title: "More",
-    links: [
-      { href: "https://hol.org/blog", label: "Blog" },
-      { href: "https://github.com/hashgraph-online", label: "GitHub" },
-      { href: GITHUB_ISSUE_LINK, label: GITHUB_ISSUE_BUTTON_LABEL },
-      { href: "https://hol.org/points/legal/privacy", label: "Privacy Policy" },
-      { href: "https://hol.org/points/legal/terms", label: "Terms of Service" }
-    ]
-  }
-] as const;
-
 export type AppView =
   | "home"
   | "inbox"
@@ -282,7 +246,7 @@ export function ShellSidebar(props: {
           </div>
         )}
 
-        <div className="mt-auto pt-6">
+        <div className="mt-auto border-t border-slate-200 pt-4">
           {!collapsed ? (
             <div className="mx-2 overflow-hidden rounded-xl border border-brand-blue/25 bg-gradient-to-br from-brand-blue/[0.05] to-brand-dark/[0.03]">
               <div className="space-y-2 px-3 pb-2.5 pt-3">
@@ -333,43 +297,6 @@ export function ShellSidebar(props: {
   );
 }
 
-export function ShellFooter() {
-  return (
-    <footer
-      className="mt-10 bg-gradient-to-r from-[#3f4174] to-brand-blue text-indigo-200"
-      style={{ contain: "layout style paint", minHeight: 200 }}
-    >
-      <nav aria-label="Footer Navigation" className="mx-auto max-w-7xl px-4 py-8 sm:px-6 lg:px-8 lg:py-12">
-        <div className="mb-8 flex flex-col gap-3 rounded-2xl border border-white/15 bg-white/10 p-4 sm:flex-row sm:items-center sm:justify-between">
-          <div>
-            <p className="text-sm font-semibold text-white">Found something Guard should fix?</p>
-            <p className="mt-1 text-sm text-indigo-100">Open a prefilled GitHub issue so the maintainers get the right details.</p>
-          </div>
-          <a
-            href={GITHUB_ISSUE_LINK}
-            target="_blank"
-            rel="noopener noreferrer"
-            className="inline-flex min-h-11 shrink-0 items-center justify-center gap-2 rounded-lg bg-white px-4 py-2 text-sm font-semibold text-brand-blue no-underline transition-colors hover:bg-indigo-50"
-          >
-            <HiMiniBugAnt className="h-4 w-4" aria-hidden="true" />
-            {GITHUB_ISSUE_BUTTON_LABEL}
-          </a>
-        </div>
-        <div className="grid grid-cols-1 gap-0 sm:grid-cols-2 sm:gap-8 lg:grid-cols-4">
-          {footerSections.map((section) => (
-            <FooterLinkList key={section.title} title={section.title} links={section.links} />
-          ))}
-        </div>
-        <div className="mt-8 border-t border-indigo-200/20 pt-8">
-          <p className="text-center text-[13px] font-medium text-blue-200">
-            Copyright © {new Date().getFullYear()} HOL DAO LLC. All rights reserved.
-          </p>
-        </div>
-      </nav>
-    </footer>
-  );
-}
-
 export function Surface(props: {
   children: ReactNode;
   className?: string;
@@ -686,38 +613,6 @@ function actionButtonClass(variant: "primary" | "secondary" | "danger" | "outlin
   return `${base} ${sizeDefault} bg-brand-blue text-white shadow-lg shadow-brand-blue/20 hover:bg-brand-blue/90 hover:shadow-brand-blue/30`;
 }
 
-function FooterLinkList(props: {
-  title: string;
-  links: ReadonlyArray<{ readonly href: string; readonly label: string }>;
-}) {
-  return (
-    <details className="group border-b border-indigo-200/20 py-2 sm:border-none sm:py-0">
-      <summary className="flex cursor-pointer select-none list-none items-center justify-between py-2 text-[15px] font-bold text-white transition-colors hover:text-indigo-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-indigo-300 rounded-sm [&::-webkit-details-marker]:hidden">
-        {props.title}
-        <span className="text-indigo-300 transition-transform duration-300 group-open:rotate-180">
-          <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
-            <path d="m6 9 6 6 6-6" />
-          </svg>
-        </span>
-      </summary>
-      <ul className="mt-3 space-y-4 pb-4 sm:pb-0">
-        {props.links.map((link) => (
-          <li key={`${props.title}-${link.href}`}>
-            <a
-              href={link.href}
-              target="_blank"
-              rel="noreferrer"
-              className="block p-1 -m-1 text-[15px] font-medium text-indigo-100 transition-colors hover:text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-indigo-300 rounded-sm"
-            >
-              {link.label}
-            </a>
-          </li>
-        ))}
-      </ul>
-    </details>
-  );
-}
-
 export function WelcomeState(props: {
   resolutionMessage: string | null;
   dashboardUrl: string | null;

plugin_scanner-2.0.736/dashboard/src/shell-footer.test.ts

@@ -0,0 +1,34 @@
+import {
+  GITHUB_ISSUE_BUTTON_LABEL,
+  GITHUB_ISSUE_LINK,
+} from "./github-issue-link";
+import { SHELL_FOOTER_RESOURCE_LINKS } from "./shell-footer";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+assert(
+  SHELL_FOOTER_RESOURCE_LINKS.length >= 4,
+  "footer keeps a compact set of resource links for the workspace shell"
+);
+
+const labels = SHELL_FOOTER_RESOURCE_LINKS.map((link) => link.label);
+
+assert(labels.includes("Docs"), "footer includes Docs");
+assert(labels.includes("Guard Cloud"), "footer includes Guard Cloud");
+assert(labels.includes("GitHub"), "footer includes GitHub");
+assert(labels.includes(GITHUB_ISSUE_BUTTON_LABEL), "footer includes report bug link");
+
+const bugLink = SHELL_FOOTER_RESOURCE_LINKS.find((link) => link.href === GITHUB_ISSUE_LINK);
+assert(bugLink !== undefined, "footer bug link uses the shared GitHub issue URL");
+
+const hrefs = new Set(SHELL_FOOTER_RESOURCE_LINKS.map((link) => link.href));
+assert(hrefs.size === SHELL_FOOTER_RESOURCE_LINKS.length, "footer links are unique by href");
+
+const labelSet = new Set(labels);
+assert(labelSet.size === SHELL_FOOTER_RESOURCE_LINKS.length, "footer links are unique by label");
+
+console.log("shell-footer.test.ts: all tests passed");

plugin_scanner-2.0.736/dashboard/src/shell-footer.tsx

@@ -0,0 +1,35 @@
+import { GITHUB_ISSUE_BUTTON_LABEL, GITHUB_ISSUE_LINK } from "./github-issue-link";
+
+export const SHELL_FOOTER_RESOURCE_LINKS = [
+  { href: "https://hol.org/guard/docs", label: "Docs" },
+  { href: "https://hol.org/guard", label: "Guard Cloud" },
+  { href: "https://github.com/hashgraph-online/hol-guard", label: "GitHub" },
+  { href: GITHUB_ISSUE_LINK, label: GITHUB_ISSUE_BUTTON_LABEL },
+  { href: "https://hol.org/points/legal/privacy", label: "Privacy" },
+  { href: "https://hol.org/points/legal/terms", label: "Terms" },
+] as const;
+
+export function ShellFooter() {
+  return (
+    <footer className="mt-auto border-t border-slate-200 bg-[#f8fafc]">
+      <div className="mx-auto flex max-w-6xl flex-col gap-3 px-4 py-5 sm:flex-row sm:items-center sm:justify-between sm:px-6 lg:px-8">
+        <p className="text-[11px] font-medium text-slate-400">
+          © {new Date().getFullYear()} HOL DAO LLC
+        </p>
+        <nav aria-label="Guard resources" className="flex flex-wrap gap-x-4 gap-y-1">
+          {SHELL_FOOTER_RESOURCE_LINKS.map((link) => (
+            <a
+              key={link.href}
+              href={link.href}
+              target="_blank"
+              rel="noreferrer"
+              className="rounded-sm text-[11px] font-medium text-slate-500 no-underline transition-colors hover:text-brand-blue focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/30"
+            >
+              {link.label}
+            </a>
+          ))}
+        </nav>
+      </div>
+    </footer>
+  );
+}

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.734"
+version = "2.0.736"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.734"
+version = "2.0.736"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/src/codex_plugin_scanner/guard/approvals.py

@@ -14,6 +14,11 @@ from urllib.parse import ParseResult, parse_qsl, urlencode, urlparse, urlunparse
 from .adapters import get_adapter
 from .adapters.base import HarnessContext
 from .approval_gate import ApprovalGateInput, require_approval_decision
+from .cli.connect_flow import (
+    connect_retry_refresh_race_from_reason,
+    resolve_guard_cloud_repair_detail,
+    resolve_guard_cloud_state,
+)
 from .config import load_guard_config
 from .daemon.manager import load_guard_daemon_auth_token
 from .desktop_notifications import (
@@ -926,10 +931,12 @@ def _build_runtime_cloud_context(
         _optional_string(acknowledgement.get("acknowledgedAt")) if isinstance(acknowledgement, dict) else None
     )
     remote_payload_active = any((sync_summary, remote_policy, team_policy_pack, alert_preferences))
-    cloud_state = _resolve_runtime_cloud_state(
+    cloud_state = resolve_guard_cloud_state(
         sync_configured=cloud_profile is not None,
         sync_completed=bool(sync_summary),
         remote_payload_active=remote_payload_active,
+        oauth_repair_required=oauth_repair_required,
+        connect_retry_required=connect_retry_required,
     )
     dashboard_url, inbox_url, fleet_url, connect_url = _resolve_guard_urls(sync_url)
     sync_health = _build_cloud_sync_health(
@@ -949,6 +956,7 @@ def _build_runtime_cloud_context(
             oauth_repair_required=oauth_repair_required,
             connect_retry_required=connect_retry_required,
             connect_retry_refresh_race=connect_retry_refresh_race,
+            shared_proof_recorded=bool(sync_summary) or remote_payload_active,
         ),
         "cloud_sync_health": sync_health,
         "cloud_pairing_state": {
@@ -959,6 +967,7 @@ def _build_runtime_cloud_context(
                 oauth_repair_required=oauth_repair_required,
                 connect_retry_required=connect_retry_required,
                 connect_retry_refresh_race=connect_retry_refresh_race,
+                shared_proof_recorded=bool(sync_summary) or remote_payload_active,
             ),
             "sync_configured": cloud_profile is not None,
             "dashboard_url": dashboard_url,
@@ -1077,7 +1086,7 @@ def _runtime_proof_status_name(
     if milestone == "sync_not_available":
         return "sync_unavailable"
     if status == "retry_required" or milestone == "first_sync_failed":
-        if _connect_retry_refresh_race_from_reason(reason):
+        if connect_retry_refresh_race_from_reason(reason):
             return "stalled"
         return "failed"
     if milestone == "first_sync_pending":
@@ -1134,11 +1143,7 @@ def _connect_retry_required(latest_state: dict[str, object] | None) -> bool:
 def _connect_retry_refresh_race(latest_state: dict[str, object] | None) -> bool:
     if latest_state is None or not _connect_retry_required(latest_state):
         return False
-    return _connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
-
-
-def _connect_retry_refresh_race_from_reason(reason: str | None) -> bool:
-    return isinstance(reason, str) and "already consumed" in reason.lower()
+    return connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
 
 
 def _build_cloud_sync_health(
@@ -1272,14 +1277,6 @@ def _cloud_sync_health_detail(
     return "Waiting for the first shared Cloud proof from this machine."
 
 
-def _resolve_runtime_cloud_state(*, sync_configured: bool, sync_completed: bool, remote_payload_active: bool) -> str:
-    if not sync_configured:
-        return "local_only"
-    if sync_completed or remote_payload_active:
-        return "paired_active"
-    return "paired_waiting"
-
-
 def _runtime_cloud_state_label(cloud_state: str) -> str:
     labels = {
         "local_only": "Local only",
@@ -1295,6 +1292,7 @@ def _runtime_cloud_state_detail(
     oauth_repair_required: bool = False,
     connect_retry_required: bool = False,
     connect_retry_refresh_race: bool = False,
+    shared_proof_recorded: bool = False,
 ) -> str:
     if oauth_repair_required:
         return (
@@ -1308,9 +1306,16 @@ def _runtime_cloud_state_detail(
             "Run hol-guard connect once when you want shared proof restored."
         )
     if connect_retry_required:
-        return (
-            "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
-            "Run hol-guard connect again."
+        return resolve_guard_cloud_repair_detail(
+            shared_proof_recorded=shared_proof_recorded,
+            first_sync_message=(
+                "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
+                "Run hol-guard connect again."
+            ),
+            resume_message=(
+                "Guard Cloud connection on this machine needs repair before shared proof can resume. "
+                "Run hol-guard connect again."
+            ),
         )
     if cloud_state == "paired_waiting":
         return (

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/src/codex_plugin_scanner/guard/cli/_commands_shared.py

@@ -217,6 +217,7 @@ from .connect_flow import (
     DEFAULT_GUARD_SYNC_URL,
     build_connect_status_payload,
     connect_recovery_command,
+    connect_state_requires_oauth,
     normalize_connect_state_for_missing_oauth,
     resolve_connect_url,
     run_guard_browser_connect_command,

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -35,9 +35,15 @@ def _resolve_policy_expiry(args: argparse.Namespace) -> str | None:
 
 def _guard_doctor_connect_health_payload(store: GuardStore) -> dict[str, object]:
     oauth_storage_health = store.get_oauth_local_credential_health()
+    cloud_profile = store.get_cloud_sync_profile()
+    effective_connect_state = store.get_effective_guard_connect_state(now=_now())
     latest_state = normalize_connect_state_for_missing_oauth(
-        latest_state=store.get_effective_guard_connect_state(now=_now()),
+        latest_state=effective_connect_state,
         oauth_storage_health=oauth_storage_health,
+        oauth_required=connect_state_requires_oauth(
+            latest_state=effective_connect_state,
+            cloud_profile=cloud_profile,
+        ),
     )
     payload: dict[str, object] = {
         "oauth_storage_health": _guard_doctor_oauth_storage_health_payload_from_health(oauth_storage_health),
@@ -100,6 +106,32 @@ def _synced_policy_payload(store: GuardStore) -> dict[str, object] | None:
     payload = store.get_sync_payload("policy")
     return payload if isinstance(payload, dict) else None
 
+
+_PERSISTED_POLICY_BUNDLE_REJECTION_REASONS = frozenset(
+    {
+        "bundle_hash_mismatch",
+        "bundle_version_downgrade",
+        "invalid_acknowledgements",
+        "invalid_bundle_hash",
+        "invalid_bundle_version",
+        "invalid_cloud_exceptions",
+        "invalid_expires_at",
+        "invalid_issued_at",
+        "invalid_policy_bundle",
+        "invalid_policy_defaults",
+        "invalid_rollout_state",
+        "invalid_rules",
+        "invalid_verifier",
+        "invalid_workspace_id",
+        "missing_required_field",
+        "payload_hash_mismatch",
+        "unsupported_contract_version",
+        "unsupported_daemon_version",
+        "wrong_workspace",
+    }
+)
+
+
 def _refresh_cloud_policy_bundle(store: GuardStore) -> None:
     if store.get_cloud_sync_profile() is None:
         return
@@ -146,11 +178,7 @@ def _refresh_cloud_policy_bundle(store: GuardStore) -> None:
         if isinstance(policy_bundle_last_error, dict)
         else None
     )
-    if policy_bundle_rejection_reason not in {
-        "bundle_version_downgrade",
-        "invalid_policy_bundle",
-        "unsupported_daemon_version",
-    }:
+    if policy_bundle_rejection_reason not in _PERSISTED_POLICY_BUNDLE_REJECTION_REASONS:
         store.set_sync_payload("policy_bundle_last_error", {}, now)
 
 def _guard_cloud_urls_for_connect(connect_url: str) -> dict[str, str]:

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -1144,9 +1144,11 @@ def build_connect_status_payload(
     latest_state = store.get_effective_guard_connect_state(now=datetime.now(timezone.utc).isoformat())
     cloud_profile = store.get_cloud_sync_profile()
     oauth_storage_health = store.get_oauth_local_credential_health()
+    oauth_required = connect_state_requires_oauth(latest_state=latest_state, cloud_profile=cloud_profile)
     latest_state = normalize_connect_state_for_missing_oauth(
         latest_state=latest_state,
         oauth_storage_health=oauth_storage_health,
+        oauth_required=oauth_required,
     )
     oauth_repair_required = (
         bool(oauth_storage_health.get("configured")) and oauth_storage_health.get("state") == "degraded"
@@ -1167,7 +1169,7 @@ def build_connect_status_payload(
         milestone = "first_sync_failed"
         reason = "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
         recovery_command = CONNECT_COMMAND
-    elif not bool(oauth_storage_health.get("configured")) and status == "connected":
+    elif oauth_required and not bool(oauth_storage_health.get("configured")) and status == "connected":
         status = "retry_required"
         milestone = "first_sync_failed"
         if not isinstance(reason, str) or not reason.strip():
@@ -1193,19 +1195,36 @@ def build_connect_status_payload(
         payload["repair_action"] = "rerun_connect"
         payload["repair_message"] = "Run hol-guard connect to start OAuth Device Code approval."
     elif (oauth_repair_required and cloud_profile is None) or (
-        not bool(oauth_storage_health.get("configured")) and payload["status"] == "retry_required"
+        oauth_required and not bool(oauth_storage_health.get("configured")) and payload["status"] == "retry_required"
     ):
         payload["repair_message"] = "Run hol-guard connect again to repair local Guard Cloud authorization."
     return payload
 
 
+def connect_state_requires_oauth(
+    *,
+    latest_state: dict[str, object] | None,
+    cloud_profile: dict[str, object] | None,
+) -> bool:
+    request_id = latest_state.get("request_id") if latest_state is not None else None
+    if isinstance(request_id, str) and bool(request_id.strip()):
+        return True
+    auth_mode = cloud_profile.get("auth_mode") if isinstance(cloud_profile, dict) else None
+    if auth_mode == "legacy":
+        return False
+    return auth_mode == "oauth"
+
+
 def normalize_connect_state_for_missing_oauth(
     *,
     latest_state: dict[str, object] | None,
     oauth_storage_health: dict[str, object],
+    oauth_required: bool,
 ) -> dict[str, object] | None:
     if latest_state is None:
         return latest_state
+    if not oauth_required:
+        return latest_state
     oauth_state = str(oauth_storage_health.get("state") or "")
     oauth_configured = bool(oauth_storage_health.get("configured"))
     if oauth_state != "degraded" and oauth_configured:
@@ -1234,3 +1253,35 @@ def connect_recovery_command(latest_state: dict[str, object] | None) -> str:
     if status == "connected" and milestone == "first_sync_succeeded":
         return "hol-guard sync"
     return CONNECT_COMMAND
+
+
+def connect_retry_refresh_race_from_reason(reason: str | None) -> bool:
+    return isinstance(reason, str) and "already consumed" in reason.lower()
+
+
+def resolve_guard_cloud_state(
+    *,
+    sync_configured: bool,
+    sync_completed: bool,
+    remote_payload_active: bool,
+    oauth_repair_required: bool = False,
+    connect_retry_required: bool = False,
+) -> str:
+    if not sync_configured:
+        return "local_only"
+    if oauth_repair_required:
+        return "local_only"
+    if connect_retry_required:
+        return "local_only" if sync_completed or remote_payload_active else "paired_waiting"
+    if sync_completed or remote_payload_active:
+        return "paired_active"
+    return "paired_waiting"
+
+
+def resolve_guard_cloud_repair_detail(
+    *,
+    shared_proof_recorded: bool,
+    first_sync_message: str,
+    resume_message: str,
+) -> str:
+    return resume_message if shared_proof_recorded else first_sync_message

{plugin_scanner-2.0.734 → plugin_scanner-2.0.736}/src/codex_plugin_scanner/guard/cli/product.py

@@ -8,7 +8,6 @@ from urllib.parse import urlparse
 
 from ..adapters import get_adapter
 from ..adapters.base import HarnessContext
-from ..approvals import _connect_retry_refresh_race_from_reason
 from ..config import GuardConfig
 from ..consumer import detect_all
 from ..consumer.service import diff_artifact
@@ -21,7 +20,11 @@ from .connect_flow import (
     CONNECT_REPAIR_COMMAND,
     CONNECT_STATUS_COMMAND,
     connect_recovery_command,
+    connect_retry_refresh_race_from_reason,
+    connect_state_requires_oauth,
     normalize_connect_state_for_missing_oauth,
+    resolve_guard_cloud_repair_detail,
+    resolve_guard_cloud_state,
 )
 
 HARNESS_PRIORITY = ("codex", "claude-code", "copilot", "hermes", "cursor", "antigravity", "gemini", "opencode")
@@ -254,17 +257,24 @@ def _build_cloud_context(store: GuardStore) -> dict[str, object]:
     team_policy_pack = _coerce_payload_dict(store.get_sync_payload("team_policy_pack"))
     sync_summary = _coerce_payload_dict(store.get_sync_payload("sync_summary"))
     last_sync_at = _optional_string(sync_summary.get("synced_at"))
+    effective_connect_state = store.get_effective_guard_connect_state(now=_now())
     latest_connect_state = normalize_connect_state_for_missing_oauth(
-        latest_state=store.get_effective_guard_connect_state(now=_now()),
+        latest_state=effective_connect_state,
         oauth_storage_health=oauth_storage_health,
+        oauth_required=connect_state_requires_oauth(
+            latest_state=effective_connect_state,
+            cloud_profile=cloud_profile,
+        ),
     )
     connect_retry_required = _connect_retry_required(latest_connect_state)
     connect_retry_refresh_race = _connect_retry_refresh_race(latest_connect_state)
     remote_payload_active = bool(advisories or alert_preferences or remote_policy or team_policy_pack)
-    cloud_state = _resolve_cloud_state(
+    cloud_state = resolve_guard_cloud_state(
         sync_configured=cloud_profile is not None,
         sync_completed=bool(sync_summary),
         remote_payload_active=remote_payload_active,
+        oauth_repair_required=oauth_repair_required,
+        connect_retry_required=connect_retry_required,
     )
     return {
         "cloud_state": cloud_state,
@@ -276,6 +286,7 @@ def _build_cloud_context(store: GuardStore) -> dict[str, object]:
             oauth_repair_required=oauth_repair_required,
             connect_retry_required=connect_retry_required,
             connect_retry_refresh_race=connect_retry_refresh_race,
+            shared_proof_recorded=bool(sync_summary) or remote_payload_active,
         ),
         "sync_url": sync_url,
         "dashboard_url": dashboard_url,
@@ -469,14 +480,6 @@ def _resolve_guard_urls(sync_url: str | None) -> tuple[str, str, str, str]:
     )
 
 
-def _resolve_cloud_state(*, sync_configured: bool, sync_completed: bool, remote_payload_active: bool) -> str:
-    if not sync_configured:
-        return "local_only"
-    if not sync_completed and not remote_payload_active:
-        return "paired_waiting"
-    return "paired_active"
-
-
 def _cloud_state_label(cloud_state: str) -> str:
     labels = {
         "local_only": "Local only",
@@ -494,6 +497,7 @@ def _cloud_state_detail(
     oauth_repair_required: bool = False,
     connect_retry_required: bool = False,
     connect_retry_refresh_race: bool = False,
+    shared_proof_recorded: bool = False,
 ) -> str:
     if oauth_repair_required:
         return (
@@ -506,9 +510,16 @@ def _cloud_state_detail(
             f"race. Run `{GUARD_COMMAND} connect` or reopen {connect_url} when you want shared proof restored."
         )
     if connect_retry_required:
-        return (
-            "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
-            f"Run `{GUARD_COMMAND} connect` or reopen {connect_url} to repair the first sync."
+        return resolve_guard_cloud_repair_detail(
+            shared_proof_recorded=shared_proof_recorded,
+            first_sync_message=(
+                "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
+                f"Run `{GUARD_COMMAND} connect` or reopen {connect_url} to repair the first sync."
+            ),
+            resume_message=(
+                "Guard Cloud connection on this machine needs repair before shared proof can resume. "
+                f"Run `{GUARD_COMMAND} connect` or reopen {connect_url} to restore sync."
+            ),
         )
     if cloud_state == "paired_waiting":
         return (
@@ -542,7 +553,7 @@ def _connect_retry_required(latest_state: dict[str, object] | None) -> bool:
 def _connect_retry_refresh_race(latest_state: dict[str, object] | None) -> bool:
     if latest_state is None or not _connect_retry_required(latest_state):
         return False
-    return _connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
+    return connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
 
 
 def _advisory_headline(advisories: list[dict[str, object]]) -> str | None: