plugin-scanner 2.0.789__tar.gz → 2.0.791__tar.gz

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/.github/workflows/ci.yml

@@ -64,12 +64,12 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
-          python-version: "3.12"
+          python-version: "3.13"
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
         with:
           enable-cache: true
-      - run: python3.12 -m pip install --dry-run --no-deps --require-hashes -r docker-requirements.txt
-      - run: uv sync --frozen --extra dev --extra cisco --python 3.12
+      - run: python3.13 -m pip install --dry-run --no-deps --require-hashes -r docker-requirements.txt
+      - run: uv sync --frozen --extra dev --extra cisco --group cisco-mcp --python 3.13
       - run: uv run --no-sync pytest tests/test_cisco_install_surfaces.py tests/test_mcp_security.py tests/test_cli.py tests/test_action_runner.py tests/test_live_cisco_smoke.py --tb=short
 
   cross-platform:

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/CONTRIBUTING.md

@@ -18,7 +18,7 @@ This repository ships:
 ```bash
 git clone https://github.com/hashgraph-online/ai-plugin-scanner.git
 cd ai-plugin-scanner
-uv sync --extra dev --extra cisco
+uv sync --extra dev --extra cisco --group cisco-mcp
 ```
 
 For lean baseline validation on Python 3.10, use `uv sync --extra dev --python 3.10` instead.
@@ -31,7 +31,7 @@ source .venv/bin/activate
 pip install -e ".[dev,cisco]"
 ```
 
-The editable Cisco extra is intended for Python 3.11+ contributor environments.
+The editable Cisco extra is intended for Python 3.11+ contributor environments and keeps published metadata resolver-safe. Use uv with `--group cisco-mcp` when you need the repo-controlled Cisco MCP scanner surface.
 
 ## Validation Requirements
 

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14-slim@sha256:44dd04494ee8f3b538294360e7c4b3acb87c8268e4d0a4828a6500b1eff50061
+FROM python:3.13-slim@sha256:c33f0bc4364a6881bed1ec0cc2665e6c53c87a43e774aaeab88e6f17af105e4f
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.789
+Version: 2.0.791
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard
@@ -20,7 +20,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
-Requires-Python: >=3.10
+Requires-Python: <3.14,>=3.10
 Requires-Dist: cisco-ai-skill-scanner~=2.0.11
 Requires-Dist: cryptography>=49.0.0
 Requires-Dist: keyring>=25.0
@@ -28,7 +28,7 @@ Requires-Dist: packaging>=24.0
 Requires-Dist: rich<15,>=14.0
 Requires-Dist: tomli>=2.0; python_version < '3.11'
 Provides-Extra: cisco
-Requires-Dist: cisco-ai-mcp-scanner~=4.6; (python_version >= '3.11') and extra == 'cisco'
+Requires-Dist: litellm==1.89.1; (python_version >= '3.11' and python_version < '3.14') and extra == 'cisco'
 Provides-Extra: dev
 Requires-Dist: basedpyright>=1.39.8; extra == 'dev'
 Requires-Dist: build>=1.5.0; extra == 'dev'
@@ -322,7 +322,7 @@ This keeps the quality grade and the trust score separate. Signals like `SECURIT
 ```bash
 git clone https://github.com/hashgraph-online/hol-guard.git
 cd hol-guard
-uv sync --extra dev --extra cisco
+uv sync --extra dev --extra cisco --group cisco-mcp
 pytest -q
 ```
 
@@ -344,11 +344,11 @@ Scanner package:
 pip install plugin-scanner
 ```
 
-The lean baseline keeps Python 3.10 support intact and always includes the shipped `cisco-ai-skill-scanner` integration.
+The lean baseline keeps Python 3.10 support intact and includes the shipped `cisco-ai-skill-scanner` integration on Python 3.10 through 3.13.
 
-### Full Cisco coverage
+### Resolver-safe Cisco extra
 
-Install the Cisco extra on Python 3.11+ when you want static MCP coverage in addition to the baseline skill scanner:
+Install the Cisco extra on Python 3.11 through 3.13 when you want the Cisco-compatible LiteLLM pin in addition to the baseline skill scanner:
 
 ```bash
 pip install "hol-guard[cisco]"
@@ -358,9 +358,9 @@ pip install "hol-guard[cisco]"
 pip install "plugin-scanner[cisco]"
 ```
 
-`cisco-ai-mcp-scanner` stays in the optional `cisco` extra because it is Python 3.11+ only and adds a heavier YARA-backed install surface than the lean baseline should require. Cisco currently supports the published `litellm==1.84.0` release across the scanner install surface, so this repository keeps that Cisco-compatible pin for full coverage.
+`cisco-ai-mcp-scanner` stays in the repo-controlled `cisco-mcp` uv dependency group because its published wheel metadata still pins an older exact LiteLLM release. Docker and CI install that scanner with the lock-derived requirements and uv overrides, while the published `cisco` extra remains resolver-safe for pip users.
 
-On Guard surfaces, the Cisco extra adds optional offline evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
+On Guard surfaces, the Cisco extra keeps the LiteLLM-dependent Cisco skill-scanner path on a patched resolver-safe version. Repo-controlled Docker and `uv sync --extra dev --extra cisco --group cisco-mcp --python 3.13` installs add optional Cisco MCP evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
 
 Guard inventory snapshots can also carry Cisco MCP and skill-scanner status when a Hermes or OpenClaw inventory run explicitly enables those scanners. The Cloud evidence model records scanner source, status, redacted finding text, duration, mapped artifact ID, and risk component metadata without storing raw local paths or secrets.
 
@@ -373,7 +373,7 @@ Credit to [Cisco AI Defense](https://github.com/cisco-ai-defense) for open-sourc
 | Package | Status in this repo | Notes |
 | :--- | :--- | :--- |
 | `cisco-ai-skill-scanner` | shipped by default | Included in the lean baseline install. |
-| `cisco-ai-mcp-scanner` | shipped via `[cisco]` | Recommended for full Cisco coverage on Python 3.11+, including repo-controlled CI and Docker. |
+| `cisco-ai-mcp-scanner` | repo-controlled CI/Docker only | Installed through the uv `cisco-mcp` group and Docker requirements until Cisco publishes LiteLLM-compatible metadata. |
 | `cisco-ai-a2a-scanner` | deferred | Requires live A2A endpoints and is not added in this pass. |
 | `cisco-aibom` | deferred | No Guard runtime integration in this pass. Revisit later only for evidence or export workflows. |
 
@@ -384,7 +384,7 @@ pipx install hol-guard
 pipx install plugin-scanner
 ```
 
-Container-first environments can use the published image instead. The repo-controlled image installs a lock-derived Cisco dependency set on Python 3.12 so the container has full static Cisco coverage by default.
+Container-first environments can use the published image instead. The repo-controlled image installs a lock-derived Cisco dependency set on Python 3.13 so the container has full static Cisco coverage by default.
 
 ```bash
 docker run --rm \
@@ -598,7 +598,7 @@ The scanner currently detects or validates:
 - Publishability issues in `interface` metadata, HTTPS links, and declared asset paths
 - Workflow hardening gaps including unpinned third-party actions, `write-all`, privileged checkout patterns, missing Dependabot, and missing lockfiles
 - Skill-level issues surfaced by Cisco `skill-scanner` when the optional integration is installed
-- Static MCP findings surfaced by Cisco `mcp-scanner` when the optional `cisco` extra is installed
+- Static MCP findings surfaced by Cisco `mcp-scanner` when the repo-controlled Docker image or `cisco-mcp` uv group is installed
 
 ## CI And Automation
 
@@ -649,7 +649,7 @@ repos:
 The Marketplace action lives in the dedicated repository [hashgraph-online/ai-plugin-scanner-action](https://github.com/hashgraph-online/ai-plugin-scanner-action).
 
 The Marketplace action bundle is maintained in [`action/`](./action) and published automatically to [hashgraph-online/ai-plugin-scanner-action](https://github.com/hashgraph-online/ai-plugin-scanner-action) by [`.github/workflows/publish-action-repo.yml`](./.github/workflows/publish-action-repo.yml) after each PyPI release. The legacy alias [hashgraph-online/hol-codex-plugin-scanner-action](https://github.com/hashgraph-online/hol-codex-plugin-scanner-action) remains available for existing workflows.
-When you run the scanner in your own job instead of the packaged action, install `plugin-scanner[cisco]` on Python 3.11+ and set `CISCO_MCP_SCAN=auto` or `CISCO_MCP_SCAN=on` for full Cisco MCP coverage.
+When you run the scanner in your own job instead of the packaged action, install `plugin-scanner[cisco]` on Python 3.11 through 3.13 for the resolver-safe Cisco skill-scanner path. Use the repo-controlled Docker image or `uv sync --extra dev --extra cisco --group cisco-mcp --python 3.13` when you also need Cisco MCP coverage with `CISCO_MCP_SCAN=auto` or `CISCO_MCP_SCAN=on`.
 
 ### Plugin Author Submission Flow
 

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/README.md

@@ -279,7 +279,7 @@ This keeps the quality grade and the trust score separate. Signals like `SECURIT
 ```bash
 git clone https://github.com/hashgraph-online/hol-guard.git
 cd hol-guard
-uv sync --extra dev --extra cisco
+uv sync --extra dev --extra cisco --group cisco-mcp
 pytest -q
 ```
 
@@ -301,11 +301,11 @@ Scanner package:
 pip install plugin-scanner
 ```
 
-The lean baseline keeps Python 3.10 support intact and always includes the shipped `cisco-ai-skill-scanner` integration.
+The lean baseline keeps Python 3.10 support intact and includes the shipped `cisco-ai-skill-scanner` integration on Python 3.10 through 3.13.
 
-### Full Cisco coverage
+### Resolver-safe Cisco extra
 
-Install the Cisco extra on Python 3.11+ when you want static MCP coverage in addition to the baseline skill scanner:
+Install the Cisco extra on Python 3.11 through 3.13 when you want the Cisco-compatible LiteLLM pin in addition to the baseline skill scanner:
 
 ```bash
 pip install "hol-guard[cisco]"
@@ -315,9 +315,9 @@ pip install "hol-guard[cisco]"
 pip install "plugin-scanner[cisco]"
 ```
 
-`cisco-ai-mcp-scanner` stays in the optional `cisco` extra because it is Python 3.11+ only and adds a heavier YARA-backed install surface than the lean baseline should require. Cisco currently supports the published `litellm==1.84.0` release across the scanner install surface, so this repository keeps that Cisco-compatible pin for full coverage.
+`cisco-ai-mcp-scanner` stays in the repo-controlled `cisco-mcp` uv dependency group because its published wheel metadata still pins an older exact LiteLLM release. Docker and CI install that scanner with the lock-derived requirements and uv overrides, while the published `cisco` extra remains resolver-safe for pip users.
 
-On Guard surfaces, the Cisco extra adds optional offline evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
+On Guard surfaces, the Cisco extra keeps the LiteLLM-dependent Cisco skill-scanner path on a patched resolver-safe version. Repo-controlled Docker and `uv sync --extra dev --extra cisco --group cisco-mcp --python 3.13` installs add optional Cisco MCP evidence to `hol-guard scan`, `hol-guard preflight`, and `hol-guard explain <path>`. Use `--cisco-mode {auto,on,off}` to control that consumer-mode evidence path for local artifact scans. `hol-guard run` and Guard runtime prompt/file-read protection remain native Guard behavior in this pass.
 
 Guard inventory snapshots can also carry Cisco MCP and skill-scanner status when a Hermes or OpenClaw inventory run explicitly enables those scanners. The Cloud evidence model records scanner source, status, redacted finding text, duration, mapped artifact ID, and risk component metadata without storing raw local paths or secrets.
 
@@ -330,7 +330,7 @@ Credit to [Cisco AI Defense](https://github.com/cisco-ai-defense) for open-sourc
 | Package | Status in this repo | Notes |
 | :--- | :--- | :--- |
 | `cisco-ai-skill-scanner` | shipped by default | Included in the lean baseline install. |
-| `cisco-ai-mcp-scanner` | shipped via `[cisco]` | Recommended for full Cisco coverage on Python 3.11+, including repo-controlled CI and Docker. |
+| `cisco-ai-mcp-scanner` | repo-controlled CI/Docker only | Installed through the uv `cisco-mcp` group and Docker requirements until Cisco publishes LiteLLM-compatible metadata. |
 | `cisco-ai-a2a-scanner` | deferred | Requires live A2A endpoints and is not added in this pass. |
 | `cisco-aibom` | deferred | No Guard runtime integration in this pass. Revisit later only for evidence or export workflows. |
 
@@ -341,7 +341,7 @@ pipx install hol-guard
 pipx install plugin-scanner
 ```
 
-Container-first environments can use the published image instead. The repo-controlled image installs a lock-derived Cisco dependency set on Python 3.12 so the container has full static Cisco coverage by default.
+Container-first environments can use the published image instead. The repo-controlled image installs a lock-derived Cisco dependency set on Python 3.13 so the container has full static Cisco coverage by default.
 
 ```bash
 docker run --rm \
@@ -555,7 +555,7 @@ The scanner currently detects or validates:
 - Publishability issues in `interface` metadata, HTTPS links, and declared asset paths
 - Workflow hardening gaps including unpinned third-party actions, `write-all`, privileged checkout patterns, missing Dependabot, and missing lockfiles
 - Skill-level issues surfaced by Cisco `skill-scanner` when the optional integration is installed
-- Static MCP findings surfaced by Cisco `mcp-scanner` when the optional `cisco` extra is installed
+- Static MCP findings surfaced by Cisco `mcp-scanner` when the repo-controlled Docker image or `cisco-mcp` uv group is installed
 
 ## CI And Automation
 
@@ -606,7 +606,7 @@ repos:
 The Marketplace action lives in the dedicated repository [hashgraph-online/ai-plugin-scanner-action](https://github.com/hashgraph-online/ai-plugin-scanner-action).
 
 The Marketplace action bundle is maintained in [`action/`](./action) and published automatically to [hashgraph-online/ai-plugin-scanner-action](https://github.com/hashgraph-online/ai-plugin-scanner-action) by [`.github/workflows/publish-action-repo.yml`](./.github/workflows/publish-action-repo.yml) after each PyPI release. The legacy alias [hashgraph-online/hol-codex-plugin-scanner-action](https://github.com/hashgraph-online/hol-codex-plugin-scanner-action) remains available for existing workflows.
-When you run the scanner in your own job instead of the packaged action, install `plugin-scanner[cisco]` on Python 3.11+ and set `CISCO_MCP_SCAN=auto` or `CISCO_MCP_SCAN=on` for full Cisco MCP coverage.
+When you run the scanner in your own job instead of the packaged action, install `plugin-scanner[cisco]` on Python 3.11 through 3.13 for the resolver-safe Cisco skill-scanner path. Use the repo-controlled Docker image or `uv sync --extra dev --extra cisco --group cisco-mcp --python 3.13` when you also need Cisco MCP coverage with `CISCO_MCP_SCAN=auto` or `CISCO_MCP_SCAN=on`.
 
 ### Plugin Author Submission Flow
 

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/evidence/evidence-insights-share-modal.tsx

@@ -15,7 +15,7 @@ import {
 } from "../guard-api";
 import { ConnectFlowCard } from "../supply-chain-firewall-views";
 import {
-  openPackageFirewallAuthorizeWindow,
+  openPackageFirewallAuthorizeFallback,
   PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
 } from "../package-firewall-connect-browser";
 import { EvidenceInsightsShareSheet } from "./evidence-insights-share-sheet";
@@ -85,7 +85,7 @@ export function EvidenceInsightsShareModal({
   }, [cloudConnected, refreshConnectState]);
 
   useEffect(() => {
-    if (connectFlow?.state !== "running") {
+    if (connectFlow?.state !== "running" && connectFlow?.state !== "starting") {
       return;
     }
     const handle = window.setTimeout(() => {
@@ -102,7 +102,10 @@ export function EvidenceInsightsShareModal({
       setConnectFlow(status.connect_flow);
       if (
         status.connect_flow?.authorize_url &&
-        !openPackageFirewallAuthorizeWindow(status.connect_flow.authorize_url)
+        !openPackageFirewallAuthorizeFallback(
+          status.connect_flow.authorize_url,
+          status.connect_flow.browser_opened,
+        )
       ) {
         setConnectError(PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE);
       }

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/guard-api.ts

@@ -2371,7 +2371,7 @@ function normalizePackageFirewallConnectFlow(
     return null;
   }
   const state = value.state;
-  if (state !== "idle" && state !== "running" && state !== "failed") {
+  if (state !== "idle" && state !== "starting" && state !== "running" && state !== "failed") {
     return null;
   }
   const title = stringValue(value.title);

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/guard-types.ts

@@ -765,7 +765,7 @@ export type PackageFirewallCliFallback = {
 };
 
 export type PackageFirewallConnectFlow = {
-  state: "idle" | "running" | "failed";
+  state: "idle" | "starting" | "running" | "failed";
   title: string;
   detail: string;
   action_label: string;

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/package-firewall-connect-browser.test.ts

@@ -1,4 +1,5 @@
 import {
+  openPackageFirewallAuthorizeFallback,
   openPackageFirewallAuthorizeWindow,
   PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
 } from "./package-firewall-connect-browser";
@@ -30,6 +31,25 @@ assert(
   "expected authorize URL to be passed to window.open",
 );
 
+openedUrls.length = 0;
+assert(
+  openPackageFirewallAuthorizeFallback(
+    "https://hol.org/api/guard/oauth/authorize?client_id=test",
+    true,
+  ),
+  "daemon-opened browser flow should be treated as handled",
+);
+assert(openedUrls.length === 0, "daemon-opened browser flow should not call window.open");
+
+assert(
+  openPackageFirewallAuthorizeFallback(
+    "https://hol.org/api/guard/oauth/authorize?client_id=test",
+    false,
+  ),
+  "daemon-blocked browser flow should open dashboard fallback window",
+);
+assert(openedUrls.length === 1, "daemon-blocked browser flow should call window.open once");
+
 openedUrls.length = 0;
 assert(!openPackageFirewallAuthorizeWindow(null), "null authorize URL should not open");
 assert(openedUrls.length === 0, "null authorize URL should not call window.open");

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/package-firewall-connect-browser.ts

@@ -14,3 +14,13 @@ export function openPackageFirewallAuthorizeWindow(
   }
   return false;
 }
+
+export function openPackageFirewallAuthorizeFallback(
+  authorizeUrl: string | null | undefined,
+  browserOpened: boolean | null | undefined,
+): boolean {
+  if (browserOpened === true) {
+    return true;
+  }
+  return openPackageFirewallAuthorizeWindow(authorizeUrl);
+}

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/package-firewall-connect.test.tsx

@@ -67,6 +67,32 @@ assert(
   "PF1: compact connect state should not render the nested security card",
 );
 
+const startingMarkup = renderToStaticMarkup(
+  <ConnectFlowCard
+    compact
+    connectError={null}
+    connectStarting={false}
+    connectFlow={{
+      state: "starting",
+      title: "Finish Guard Cloud sign-in in your browser",
+      detail: "HOL Guard is opening the secure sign-in flow in your browser.",
+      action_label: "Repair Guard Cloud access",
+      connect_url: "https://hol.org/guard/connect",
+      authorize_url: null,
+      browser_opened: false,
+      request_id: "guard-connect-2",
+      poll_after_ms: 1500,
+    }}
+    mode="repair"
+    onStartConnect={() => undefined}
+  />,
+);
+
+assert(
+  !startingMarkup.includes("Open sign-in page"),
+  "PF2: starting connect card should not link to generic connect before authorize URL exists",
+);
+
 const connectRequiredStatus: PackageFirewallStatusResponse = {
   operation: "status",
   status: "completed",

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -24,7 +24,7 @@ import {
   resolveApprovalGateSyncFailure,
 } from "./harness-action-errors";
 import {
-  openPackageFirewallAuthorizeWindow,
+  openPackageFirewallAuthorizeFallback,
   PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
 } from "./package-firewall-connect-browser";
 import { EntitlementNotice, ConnectFlowCard } from "./supply-chain-firewall-views";
@@ -258,7 +258,7 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       return;
     }
     const flow = panelLoad.data.connect_flow;
-    if (flow === null || flow.state !== "running") {
+    if (flow === null || (flow.state !== "running" && flow.state !== "starting")) {
       return;
     }
     const handle = window.setTimeout(() => {
@@ -444,7 +444,10 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       const connectFlow = await startPackageFirewallConnect();
       if (
         connectFlow?.authorize_url &&
-        !openPackageFirewallAuthorizeWindow(connectFlow.authorize_url)
+        !openPackageFirewallAuthorizeFallback(
+          connectFlow.authorize_url,
+          connectFlow.browser_opened,
+        )
       ) {
         setConnectError(PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE);
       }

{plugin_scanner-2.0.789 → plugin_scanner-2.0.791}/dashboard/src/supply-chain-firewall-views.tsx

@@ -231,7 +231,7 @@ function resolveConnectSteps(
   connectFlow: NonNullable<PackageFirewallStatusResponse["connect_flow"]>,
   purpose: "package_firewall" | "insights_share" | "audit" = "package_firewall",
 ): Array<{ body: string; current: boolean; done: boolean; title: string }> {
-  const running = connectFlow.state === "running";
+  const running = connectFlow.state === "running" || connectFlow.state === "starting";
   const failed = connectFlow.state === "failed";
   const browserOpened = connectFlow.browser_opened === true;
   const unlockCopy = resolveConnectUnlockCopy(purpose);
@@ -328,9 +328,9 @@ export function ConnectFlowCard({
   onStartConnect,
   purpose = "package_firewall",
 }: ConnectFlowCardProps) {
-  const manualHref = connectFlow.authorize_url ?? connectFlow.connect_url;
-  const running = connectFlow.state === "running";
+  const running = connectFlow.state === "running" || connectFlow.state === "starting";
   const failed = connectFlow.state === "failed";
+  const manualHref = connectFlow.authorize_url ?? (failed ? connectFlow.connect_url : null);
   const primaryBusy = connectStarting || running;
   const primaryLabel = resolveConnectPrimaryLabel({
     actionLabel: connectFlow.action_label,
@@ -340,7 +340,7 @@ export function ConnectFlowCard({
   const steps = resolveConnectSteps(connectFlow, purpose);
   const statusTone = running ? "blue" : mode === "repair" ? "attention" : "blue";
   const statusLabel = running ? "Waiting for approval" : mode === "repair" ? "Repair required" : "Connection required";
-  const showManualLink = connectFlow.authorize_url !== null || running || failed;
+  const showManualLink = manualHref !== null;
   const titleCopy = headline ?? connectFlow.title;
   const detailCopy = detail ?? connectFlow.detail;
   if (minimal) {