plugin-scanner 2.0.753__tar.gz → 2.0.755__tar.gz

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.753
+Version: 2.0.755
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/package.json

@@ -17,6 +17,7 @@
   },
   "devDependencies": {
     "@playwright/test": "^1.50.0",
+    "@types/node": "^24.0.0",
     "@tailwindcss/vite": "^4.1.4",
     "@types/react": "^19.2.2",
     "@types/react-dom": "^19.2.2",

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/pnpm-lock.yaml

@@ -26,7 +26,10 @@ importers:
         version: 1.60.0
       '@tailwindcss/vite':
         specifier: ^4.1.4
-        version: 4.2.2(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
+        version: 4.2.2(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
+      '@types/node':
+        specifier: ^24.0.0
+        version: 24.13.2
       '@types/react':
         specifier: ^19.2.2
         version: 19.2.14
@@ -35,7 +38,7 @@ importers:
         version: 19.2.3(@types/react@19.2.14)
       '@vitejs/plugin-react':
         specifier: ^5.0.4
-        version: 5.2.0(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
+        version: 5.2.0(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
       tailwindcss:
         specifier: ^4.1.4
         version: 4.2.2
@@ -47,7 +50,7 @@ importers:
         version: 5.9.3
       vite:
         specifier: ^7.1.10
-        version: 7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
+        version: 7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
 
 packages:
 
@@ -561,6 +564,9 @@ packages:
   '@types/estree@1.0.8':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
+  '@types/node@24.13.2':
+    resolution: {integrity: sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==}
+
   '@types/react-dom@19.2.3':
     resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
     peerDependencies:
@@ -861,6 +867,9 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  undici-types@7.18.2:
+    resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
+
   update-browserslist-db@1.2.3:
     resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
     hasBin: true
@@ -1263,12 +1272,12 @@ snapshots:
       '@tailwindcss/oxide-win32-arm64-msvc': 4.2.2
       '@tailwindcss/oxide-win32-x64-msvc': 4.2.2
 
-  '@tailwindcss/vite@4.2.2(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
+  '@tailwindcss/vite@4.2.2(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
     dependencies:
       '@tailwindcss/node': 4.2.2
       '@tailwindcss/oxide': 4.2.2
       tailwindcss: 4.2.2
-      vite: 7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
+      vite: 7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
 
   '@types/babel__core@7.20.5':
     dependencies:
@@ -1293,6 +1302,10 @@ snapshots:
 
   '@types/estree@1.0.8': {}
 
+  '@types/node@24.13.2':
+    dependencies:
+      undici-types: 7.18.2
+
   '@types/react-dom@19.2.3(@types/react@19.2.14)':
     dependencies:
       '@types/react': 19.2.14
@@ -1301,7 +1314,7 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
-  '@vitejs/plugin-react@5.2.0(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
+  '@vitejs/plugin-react@5.2.0(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
     dependencies:
       '@babel/core': 7.29.0
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.0)
@@ -1309,7 +1322,7 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-rc.3
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
-      vite: 7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
+      vite: 7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -1572,13 +1585,15 @@ snapshots:
 
   typescript@5.9.3: {}
 
+  undici-types@7.18.2: {}
+
   update-browserslist-db@1.2.3(browserslist@4.28.2):
     dependencies:
       browserslist: 4.28.2
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0):
+  vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0):
     dependencies:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.4)
@@ -1587,6 +1602,7 @@ snapshots:
       rollup: 4.60.1
       tinyglobby: 0.2.16
     optionalDependencies:
+      '@types/node': 24.13.2
       fsevents: 2.3.3
       jiti: 2.6.1
       lightningcss: 1.32.0

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/approval-center-layout.tsx

@@ -1,4 +1,4 @@
-import type { ReactNode, MouseEvent, KeyboardEvent } from "react";
+import type { ReactNode, MouseEvent, KeyboardEvent as ReactKeyboardEvent } from "react";
 import { useState, useEffect, useCallback, useMemo, useRef, type ChangeEvent } from "react";
 import {
   HiMiniChevronDown,
@@ -1052,7 +1052,7 @@ function QueueCard(props: {
   const isBlocked = props.item.policy_action === "block";
   const statusDotClass = queueCardStatusDotClass(props.active, isBlocked);
   const handleKeyDown = useCallback(
-    (event: KeyboardEvent<HTMLDivElement>) => {
+    (event: ReactKeyboardEvent<HTMLDivElement>) => {
       if (event.key === "Enter" || event.key === " ") {
         event.preventDefault();
         props.onClick();
@@ -1522,7 +1522,7 @@ function DecisionWorkspace(props: {
 
   useEffect(() => {
     if (props.detail.kind !== "ready") return;
-    const onKeyDown = (event: KeyboardEvent) => {
+    const onKeyDown = (event: globalThis.KeyboardEvent) => {
       if (submitting !== null || pendingAction !== null) return;
       const target = event.target as HTMLElement;
       if (

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/approval-center-primitives.tsx

@@ -1,5 +1,5 @@
 import { forwardRef } from "react";
-import type { ButtonHTMLAttributes, ChangeEvent, ReactNode, Ref } from "react";
+import type { ButtonHTMLAttributes, AnchorHTMLAttributes, ChangeEvent, ReactNode, Ref } from "react";
 import {
   HiMiniArrowTopRightOnSquare,
   HiMiniCloud,
@@ -328,9 +328,22 @@ export function Badge(props: {
   );
 }
 
+type TagTone =
+  | "blue"
+  | "green"
+  | "purple"
+  | "slate"
+  | "red"
+  | "amber"
+  | "attention"
+  | "default"
+  | "info"
+  | "warning"
+  | "destructive";
+
 export function Tag(props: {
   children: ReactNode;
-  tone?: "blue" | "green" | "purple" | "slate" | "red" | "attention";
+  tone?: TagTone;
 }) {
   const toneClass = tagToneClass(props.tone);
   return (
@@ -381,11 +394,32 @@ type ActionButtonProps = {
   href?: string;
   variant?: "primary" | "secondary" | "danger" | "outline" | "ghost" | "success" | "quiet";
   disabled?: boolean;
+  className?: string;
+  type?: ButtonHTMLAttributes<HTMLButtonElement>["type"];
 } & Omit<ButtonHTMLAttributes<HTMLButtonElement>, "children" | "className" | "onClick" | "type">;
 
+function anchorPropsFromButtonProps(
+  props: Omit<ButtonHTMLAttributes<HTMLButtonElement>, "children" | "className" | "onClick" | "type">,
+): AnchorHTMLAttributes<HTMLAnchorElement> {
+  const {
+    disabled: _disabled,
+    form: _form,
+    formAction: _formAction,
+    formEncType: _formEncType,
+    formMethod: _formMethod,
+    formNoValidate: _formNoValidate,
+    formTarget: _formTarget,
+    name: _name,
+    value: _value,
+    type: _type,
+    ...rest
+  } = props;
+  return rest;
+}
+
 export const ActionButton = forwardRef<HTMLButtonElement | HTMLAnchorElement, ActionButtonProps>(
-  ({ children, href, variant, disabled, onClick, ...buttonProps }, ref) => {
-    const className = actionButtonClass(variant);
+  ({ children, href, variant, disabled, onClick, className: customClassName, type, ...buttonProps }, ref) => {
+    const className = `${actionButtonClass(variant)}${customClassName ? ` ${customClassName}` : ""}`;
     if (href) {
       return (
         <a
@@ -393,14 +427,16 @@ export const ActionButton = forwardRef<HTMLButtonElement | HTMLAnchorElement, Ac
           href={guardAwareHref(href)}
           target={href.startsWith("https://") ? "_blank" : undefined}
           rel={href.startsWith("https://") ? "noreferrer" : undefined}
+          onClick={onClick}
           className={className}
+          {...anchorPropsFromButtonProps(buttonProps)}
         >
           {children}
         </a>
       );
     }
     return (
-      <button ref={ref as Ref<HTMLButtonElement>} type="button" className={className} onClick={onClick} disabled={disabled} {...buttonProps}>
+      <button ref={ref as Ref<HTMLButtonElement>} type={type ?? "button"} className={className} onClick={onClick} disabled={disabled} {...buttonProps}>
         {children}
       </button>
     );
@@ -592,10 +628,15 @@ function badgeToneClass(tone: "default" | "success" | "warning" | "info" | "dest
   return "border-transparent bg-gray-100 text-gray-600 border-gray-200";
 }
 
-function tagToneClass(tone: "blue" | "green" | "purple" | "slate" | "red" | "attention" | undefined): string {
+function tagToneClass(tone: TagTone | undefined): string {
   if (tone === "green") return "border-transparent bg-brand-green-bg/60 text-brand-green-text";
   if (tone === "purple") return "border-transparent bg-brand-purple/10 text-brand-purple";
+  if (tone === "destructive") return "border-transparent bg-brand-purple/10 text-brand-purple";
   if (tone === "red") return "border-transparent bg-brand-purple/10 text-brand-purple";
+  if (tone === "amber") return "border-transparent bg-amber-50 text-amber-700";
+  if (tone === "warning") return "border-transparent bg-amber-50 text-amber-700";
+  if (tone === "info") return "border-transparent bg-blue-500/10 text-blue-700";
+  if (tone === "default") return "border-gray-200 bg-gray-100 text-gray-500";
   if (tone === "slate") return "border-gray-200 bg-gray-100 text-gray-500";
   if (tone === "attention") return "border-transparent bg-brand-attention-bg text-brand-attention";
   return "border-transparent bg-blue-500/10 text-blue-700";

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/approval-scopes.test.ts

@@ -66,7 +66,7 @@ for (const scope of ["artifact", "publisher", "harness", "global"] as const) {
 
 const fullScopeValues = scopeChoicesForRequest(BASE_REQUEST).map((choice) => choice.value);
 assert(
-  ["artifact", "workspace", "publisher", "harness", "global"].every((scope) => fullScopeValues.includes(scope)),
+  (["artifact", "workspace", "publisher", "harness", "global"] as const).every((scope) => fullScopeValues.includes(scope)),
   "T-AS-03: requests with workspace and publisher expose all approval scope kinds"
 );
 

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/apps/app-detail-workspace.tsx

@@ -1023,7 +1023,7 @@ function PolicyDecisionRow(props: {
   onRequestClear: (key: string) => void;
   onConfirmClear: () => void;
   onCancelClear: () => void;
-  rowConfirmRef?: RefObject<HTMLDivElement>;
+  rowConfirmRef?: RefObject<HTMLDivElement | null>;
 }) {
   const { policy, rowKey, isConfirming, inFlight, showClearButton } = props;
   const label = clearLabelForScope(policy.scope);

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/audit-workspace.tsx

@@ -21,7 +21,13 @@ import { formatRelativeTime, harnessDisplayName } from "./approval-center-utils"
 import { runAuditRemediation, guardAwareHref } from "./guard-api";
 import { isApprovalGateRequiredError } from "./harness-action-errors";
 import type { AuditRemediationAction } from "./guard-api";
-import type { GuardApprovalGatePublicConfig, GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
+import type {
+  GuardApprovalGatePublicConfig,
+  GuardReceipt,
+  GuardRuntimeSnapshot,
+  GuardSupplyChainScannerEvidence,
+} from "./guard-types";
+import { isSupplyChainAuditEvidence } from "./guard-types";
 import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
 import { resolveManagerCoverageStatus } from "./supply-chain-protection-stats";
 import { PackageWorkbenchPanel } from "./package-workbench-panel";
@@ -49,10 +55,6 @@ export type AuditRemediationRequest = {
   label: string;
 };
 
-function isSupplyChainAuditEvidence(value: unknown): value is Record<string, unknown> & { operation: "audit" } {
-  return typeof value === "object" && value !== null && (value as Record<string, unknown>).operation === "audit";
-}
-
 function auditSeverityForDecision(decision: string, blockedCount: number): AuditSeverity {
   if (decision === "block" || blockedCount > 0) {
     return "high";

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/evidence/app-tab.tsx

@@ -11,11 +11,14 @@ import { detectCategory, getCategoryInfo } from "./categories";
 import { guardAwareHref } from "../guard-api";
 import { Sparkline } from "./sparkline";
 import { ScopedEvidenceTable } from "./scoped-evidence-table";
+import type { EvidenceDecision } from "./evidence-types";
 
 interface AppTabProps {
   receipts: GuardReceipt[];
 }
 
+type AppDecisionFilter = Extract<EvidenceDecision, "all" | "allow" | "block">;
+
 function hashString(str: string): number {
   let hash = 0;
   for (let i = 0; i < str.length; i++) {
@@ -77,7 +80,7 @@ function AppListCard({ harness, items, onSelect }: AppListCardProps) {
 function AppTabRaw({ receipts }: AppTabProps) {
   const [selectedApp, setSelectedApp] = useState<string | null>(null);
   const [searchTerm, setSearchTerm] = useState("");
-  const [decisionFilter, setDecisionFilter] = useState<string>("all");
+  const [decisionFilter, setDecisionFilter] = useState<AppDecisionFilter>("all");
   const [categoryFilter, setCategoryFilter] = useState<string>("");
 
   const appReceipts = useMemo(
@@ -135,6 +138,13 @@ function AppTabRaw({ receipts }: AppTabProps) {
     setCategoryFilter(category);
   }, []);
 
+  const handleDecisionFilterChange = useCallback((event: React.ChangeEvent<HTMLSelectElement>) => {
+    const nextValue = event.target.value;
+    if (nextValue === "all" || nextValue === "allow" || nextValue === "block") {
+      setDecisionFilter(nextValue);
+    }
+  }, []);
+
   const categories = useMemo(() => {
     if (!selectedApp) return [];
     const allItems = apps.find(([h]) => h === selectedApp)?.[1] ?? [];
@@ -203,7 +213,7 @@ function AppTabRaw({ receipts }: AppTabProps) {
           </div>
           <select
             value={decisionFilter}
-            onChange={(e) => setDecisionFilter(e.target.value)}
+            onChange={handleDecisionFilterChange}
             className="min-h-7 rounded-lg border border-slate-200 bg-white px-2 text-xs font-medium text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-1 focus:ring-brand-blue/20"
           >
             <option value="all">All decisions</option>

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/evidence/evidence-action-detail.tsx

@@ -13,7 +13,8 @@ import {
   HiMiniDocumentText,
 } from "react-icons/hi2";
 import { useState } from "react";
-import type { GuardReceipt, RiskSignalV2 } from "../guard-types";
+import type { GuardReceipt } from "../guard-types";
+import { isRiskSignalEvidence } from "../guard-types";
 import { harnessDisplayName, formatRelativeTime } from "../approval-center-utils";
 import { plainEnglishDescription, resolveActionTitle, resolveActionType, resolveActionSubtitle, resolveActionDetail } from "./plain-english";
 import { detectCategory, getCategoryInfo } from "./categories";
@@ -296,7 +297,7 @@ export function EvidenceActionDetail({
   const actionType = resolveActionType(receipt);
   const actionSubtitle = resolveActionSubtitle(receipt);
   const actionDetail = resolveActionDetail(receipt);
-  const signals = receipt.scanner_evidence ?? [];
+  const signals = (receipt.scanner_evidence ?? []).filter(isRiskSignalEvidence);
   const primarySignal = signals[0];
   let copyLabel = "Copy receipt ID";
   if (copied) {

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/evidence/evidence-insights-share-modal.tsx

@@ -1,5 +1,10 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
-import type { GuardCloudConnectFlow, GuardReceiptAnalytics, GuardRuntimeSnapshot } from "../guard-types";
+import type {
+  GuardCloudConnectFlow,
+  GuardInsightsShareResult,
+  GuardReceiptAnalytics,
+  GuardRuntimeSnapshot,
+} from "../guard-types";
 import { ActionButton } from "../approval-center-primitives";
 import { GuardModalLayer } from "../guard-modal-layer";
 import {
@@ -7,7 +12,6 @@ import {
   fetchRuntimeSnapshot,
   publishInsightsShare,
   startGuardCloudConnect,
-  type GuardInsightsShareResult,
 } from "../guard-api";
 import { ConnectFlowCard } from "../supply-chain-firewall-views";
 import {

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/evidence/evidence-table.tsx

@@ -33,7 +33,7 @@ export function EvidenceTableHead({ children }: EvidenceTableHeadProps) {
 }
 
 interface EvidenceTableHeaderProps {
-  children: ReactNode;
+  children?: ReactNode;
   className?: string;
 }
 

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/evidence/evidence-types.ts

@@ -2,7 +2,7 @@ export type EvidenceDecision = "allow" | "block" | "ask" | "all";
 export type EvidenceTimeFilter = "all" | "today" | "yesterday" | "week" | "last7d" | "last30d";
 export type EvidenceSortKey = "newest" | "oldest" | "app" | "decision" | "category" | "artifact";
 export type EvidenceExportFormat = "csv" | "json";
-export type EvidenceView = "actions" | "insights" | "apps" | "export" | "categories";
+export type EvidenceView = "actions" | "insights" | "apps" | "export" | "story" | "categories";
 
 export interface EvidenceFilterState {
   search: string;

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/evidence/plain-english.ts

@@ -1,4 +1,9 @@
-import type { GuardReceipt, GuardApprovalRequest, GuardActionEnvelope } from "../guard-types";
+import type {
+  GuardReceipt,
+  GuardApprovalRequest,
+  GuardActionEnvelope,
+} from "../guard-types";
+import { isRiskSignalEvidence } from "../guard-types";
 import { harnessDisplayName } from "../approval-center-utils";
 import { detectCategory, type ReceiptCategory } from "./categories";
 
@@ -93,7 +98,7 @@ export function resolveActionTitle(receipt: GuardReceipt): string {
   }
 
   // Scanner evidence title is usually more descriptive than raw artifact_name
-  const signals = receipt.scanner_evidence ?? [];
+  const signals = (receipt.scanner_evidence ?? []).filter(isRiskSignalEvidence);
   if (signals.length > 0 && signals[0]?.title) {
     return signals[0].title;
   }
@@ -134,7 +139,7 @@ export function resolveActionTitle(receipt: GuardReceipt): string {
 }
 
 export function resolveActionSubtitle(receipt: GuardReceipt): string | null {
-  const signals = receipt.scanner_evidence ?? [];
+  const signals = (receipt.scanner_evidence ?? []).filter(isRiskSignalEvidence);
   const firstSignal = signals[0];
 
   // Highest priority: scanner plain_reason explains the actual risk

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/guard-api.test.ts

@@ -29,7 +29,7 @@ import {
 } from "./approval-center-utils";
 import type { GuardActionEnvelope, GuardApprovalRequest, GuardDecisionV2, RiskSignalV2 } from "./guard-types";
 
-function assert(condition: boolean, message: string): void {
+function assert(condition: unknown, message: string): asserts condition {
   if (!condition) {
     throw new Error(message);
   }
@@ -1423,6 +1423,7 @@ globalThis.fetch = async (input: RequestInfo | URL, init?: RequestInit): Promise
 
 const retriedResume = await retryResume("req-retry-resume");
 assert(retryResumeCalls.length === 3, "L080: retryResume refreshes and retries once");
+assert(retriedResume !== null, "L080: retryResume returns a resume payload after refresh");
 assert(retriedResume.status === "sent", "L080: retryResume returns retried resume status");
 assert(
   headerValue(retryResumeCalls[1].init, "X-Guard-Dashboard-Session") === "stale-retry-resume-token",

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/guard-api.ts

@@ -49,6 +49,7 @@ import type {
   GuardReceiptHarnessStat,
   GuardRuntimeSnapshot,
   GuardCloudConnectStatusResponse,
+  SupplyChainBundle,
   SupplyChainSnapshot,
   GuardSettingsPayload,
   GuardSettingsExport,
@@ -96,10 +97,14 @@ type ApprovalRequestListPayload = {
   status?: unknown;
 };
 
-type RuntimeSnapshotPayload = Omit<GuardRuntimeSnapshot, "items" | "supply_chain"> & {
+type RuntimeSnapshotPayload = Omit<
+  GuardRuntimeSnapshot,
+  "items" | "queue_summary" | "supply_chain" | "managed_installs"
+> & {
   items?: RawGuardApprovalRequest[] | null;
   queue_summary?: unknown;
   supply_chain?: unknown;
+  managed_installs?: unknown;
 };
 
 type QueueResolutionPayload = Omit<
@@ -2723,7 +2728,7 @@ export type AuditRemediationInput = {
 export async function runAuditRemediation(input: AuditRemediationInput): Promise<PackageFirewallActionResponse> {
   if (isGuardDemoMode()) {
     return {
-      entitlement: { allowed: true, tier: "demo" },
+      entitlement: { allowed: true, reason: "demo", tier: "demo", upgrade_cta: null, upgrade_url: null },
       operation: input.action,
       receipt: null,
       result: `${input.action} completed for ${input.manager}.`,

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/guard-demo.ts

@@ -99,6 +99,7 @@ const demoPolicy: GuardPolicyDecision = {
   publisher: demoRequests[1].publisher,
   action: "allow",
   reason: "approved locally after diff review",
+  source: "local",
   updated_at: "2026-04-10T18:42:00Z"
 };
 

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/guard-types.ts

@@ -58,6 +58,21 @@ export type RiskSignalV2 = {
   advisory_id: string | null;
 };
 
+export type GuardSupplyChainScannerEvidence = {
+  operation: string;
+  status?: string;
+  audit_status?: string;
+  audit_decision?: string;
+  blocked_package_count?: number;
+  total_packages?: number;
+  manifest_paths?: string[];
+  lockfile_paths?: string[];
+  package_inventory?: unknown;
+  package_findings?: unknown;
+};
+
+export type GuardScannerEvidence = RiskSignalV2 | GuardSupplyChainScannerEvidence;
+
 export type GuardDecisionV2 = {
   action: GuardDecisionV2Action;
   reason: string;
@@ -391,15 +406,37 @@ export type GuardReceipt = {
   changed_capabilities: string[];
   provenance_summary: string;
   user_override: string | null;
-  artifact_name: string | null;
+  artifact_name?: string | null;
   artifact_type?: string | null;
   source_scope: string | null;
   timestamp: string;
   diff_summary?: string | null;
-  scanner_evidence?: RiskSignalV2[];
+  scanner_evidence?: GuardScannerEvidence[];
   action_envelope_json?: GuardActionEnvelope | null;
 };
 
+export type ReceiptScannerEvidence = NonNullable<GuardReceipt["scanner_evidence"]>[number];
+
+function isScannerEvidenceRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object";
+}
+
+export function isRiskSignalEvidence(signal: ReceiptScannerEvidence): signal is RiskSignalV2 {
+  return isScannerEvidenceRecord(signal) && typeof signal.signal_id === "string";
+}
+
+export function isSupplyChainScannerEvidence(
+  value: ReceiptScannerEvidence,
+): value is GuardSupplyChainScannerEvidence {
+  return isScannerEvidenceRecord(value) && typeof value.operation === "string";
+}
+
+export function isSupplyChainAuditEvidence(
+  value: ReceiptScannerEvidence,
+): value is GuardSupplyChainScannerEvidence & { operation: "audit" } {
+  return isSupplyChainScannerEvidence(value) && value.operation === "audit";
+}
+
 export type GuardReceiptAnalyticsBucket = {
   date_key: string;
   label: string;
@@ -592,6 +629,7 @@ export type GuardHarnessActionErrorPayload = {
   error: string;
   message?: string;
   harness?: string;
+  operation?: string;
   confirmation_phrase?: string;
   confirm_command?: string;
   retryable?: boolean;

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/harness-action-errors.test.ts

@@ -16,14 +16,14 @@ function assert(condition: boolean, message: string): void {
 
 function makeHarnessError(
   status: number,
-  payload: { error: string; message?: string } | null,
+  payload: ConstructorParameters<typeof GuardHarnessActionError>[1],
 ): GuardHarnessActionError {
   return new GuardHarnessActionError(status, payload);
 }
 
 function makeDuckTypedHarnessError(
   status: number,
-  payload: { error: string; message?: string } | null,
+  payload: ConstructorParameters<typeof GuardHarnessActionError>[1],
 ): GuardHarnessActionError {
   const error = makeHarnessError(status, payload);
   return Object.assign(Object.create(GuardHarnessActionError.prototype), error);

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/home-dashboard.tsx

@@ -86,8 +86,8 @@ export function buildDaemonErrorCopy(): { title: string; body: string; primaryCt
   };
 }
 
-export function redactHomeArtifactLabel(value: string | null): string {
-  if (value === null || value.trim().length === 0) {
+export function redactHomeArtifactLabel(value: string | null | undefined): string {
+  if (typeof value !== "string" || value.trim().length === 0) {
     return "a local action";
   }
   const trimmed = value.trim();

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/policy-workspace-helpers.test.ts

@@ -15,7 +15,7 @@ import {
 } from "./policy-workspace-helpers";
 import { scopeLabel } from "./approval-center-utils";
 
-function assert(condition: boolean, message: string): void {
+function assert(condition: unknown, message: string): asserts condition {
   if (!condition) {
     throw new Error(message);
   }

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/runtime-overview.tsx

@@ -261,7 +261,7 @@ export function DeviceProofCard(props: DeviceProofCardProps) {
 export type PackageManagerProtectionCopy = {
   pathLabel: string;
   pathDetail: string;
-  pathTone: "green" | "attention" | "slate";
+  pathTone: "green" | "attention" | "blue" | "slate";
   protectedList: string[];
   unprotectedList: string[];
 };

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/scrg159-170.test.ts

@@ -5,7 +5,7 @@ import { groupPoliciesByHarness, resolveSecurityModeCopy } from "./policy-worksp
 import { resolveFeedSourceMode, resolveFeedStaleness } from "./feed-health-workspace";
 import type { GuardRuntimeSnapshot, GuardManagedInstall, GuardReceipt, GuardPolicyDecision, PackageManagerProtection } from "./guard-types";
 
-function assert(condition: boolean, message: string): void {
+function assert(condition: unknown, message: string): asserts condition {
   if (!condition) {
     throw new Error(message);
   }
@@ -244,7 +244,7 @@ const auditWithUnprotected = deriveFrontendAuditResults(
 const pipIssue = auditWithUnprotected.find((r) => r.id === "unprotected-pip");
 assert(pipIssue !== undefined, "SCRG162-D: unprotected pip should be flagged");
 assert(pipIssue!.severity === "high", "SCRG162-E: unprotected manager should be high severity");
-assert(pipIssue!.remediation.includes("Guard"), "SCRG162-F: remediation should point back to Guard action");
+assert(pipIssue!.remediation !== null && pipIssue.remediation.includes("Guard"), "SCRG162-F: remediation should point back to Guard action");
 
 const auditWithInstalledUnprotected = deriveFrontendAuditResults(
   [],

{plugin_scanner-2.0.753 → plugin_scanner-2.0.755}/dashboard/src/scsr-phase09c-evidence-rail.test.ts

@@ -14,7 +14,7 @@ function assert(condition: boolean, message: string): void {
 const baseSnapshot: GuardRuntimeSnapshot = {
   generated_at: new Date().toISOString(),
   approval_center_url: null,
-  runtime_state: {},
+  runtime_state: null,
   device: {
     installation_id: "install-1",
     device_label: "Test Machine",