plugin-scanner 3.0.0a199__tar.gz → 3.0.0a200__tar.gz

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.0a199
+Version: 3.0.0a200
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/ci/code-quality-baseline.json

@@ -420,19 +420,19 @@
     ".github/workflows/ci.yml": 553,
     ".github/workflows/publish.yml": 1644,
     "dashboard/src/app.tsx": 1051,
-    "dashboard/src/approval-center-primitives.tsx": 1041,
+    "dashboard/src/approval-center-primitives.tsx": 1049,
     "dashboard/src/approval-center-utils.ts": 901,
-    "dashboard/src/apps/app-detail-workspace.tsx": 1933,
+    "dashboard/src/apps/app-detail-workspace.tsx": 1935,
     "dashboard/src/audit-workspace.tsx": 705,
     "dashboard/src/evidence/evidence-activity-heatmap.tsx": 527,
-    "dashboard/src/fleet-workspace.tsx": 519,
+    "dashboard/src/fleet-workspace.tsx": 530,
     "dashboard/src/guard-api.test.ts": 1929,
     "dashboard/src/guard-api.ts": 4291,
     "dashboard/src/guard-types.ts": 1159,
     "dashboard/src/history-analytics.tsx": 594,
     "dashboard/src/history-charts.tsx": 561,
-    "dashboard/src/home-dashboard.test.ts": 505,
-    "dashboard/src/home-dashboard.tsx": 1152,
+    "dashboard/src/home-dashboard.test.ts": 536,
+    "dashboard/src/home-dashboard.tsx": 1174,
     "dashboard/src/mcp-policy-request-panel.tsx": 531,
     "dashboard/src/phase09-review.test.ts": 1495,
     "dashboard/src/policy-cloud-exception-request-layout.tsx": 555,
@@ -484,7 +484,7 @@
     "src/codex_plugin_scanner/guard/aibom_trust_metadata.py": 1042,
     "src/codex_plugin_scanner/guard/approval_gate.py": 1411,
     "src/codex_plugin_scanner/guard/approval_scope_support.py": 568,
-    "src/codex_plugin_scanner/guard/approvals.py": 2687,
+    "src/codex_plugin_scanner/guard/approvals.py": 2708,
     "src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py": 754,
     "src/codex_plugin_scanner/guard/cli/commands_dispatch_local.py": 630,
     "src/codex_plugin_scanner/guard/cli/commands_dispatch_records.py": 666,

plugin_scanner-3.0.0a200/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 15155,
+  "maximum_test_source_lines": 327222,
+  "schema_version": 1
+}

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/approval-center-primitives.tsx

@@ -16,6 +16,7 @@ import {
   HiMiniCheckCircle,
   HiMiniArrowRight,
   HiMiniExclamationTriangle,
+  HiMiniArrowPath,
   HiMiniChevronDown,
   HiMiniChevronUp,
   HiMiniChevronLeft,
@@ -775,7 +776,7 @@ function TrustCard(props: { title: string; body: string }) {
 }
 
 export function GuardHero(props: {
-  status: "clear" | "needs_review" | "setup_gap" | "partial" | "degraded" | "neutral";
+  status: "clear" | "needs_review" | "setup_gap" | "partial" | "degraded" | "neutral" | "checking";
   headline: string;
   subheadline: string;
   cta?: ReactNode;
@@ -792,12 +793,19 @@ export function GuardHero(props: {
   let HeroIcon = HiMiniShieldCheck;
   let iconColorClass = "text-brand-green";
   let iconBgClass = "bg-brand-green/10";
+  let iconSpinClass = "";
 
   if (props.status === "needs_review") {
     statusBadge = <Badge tone="attention">Needs your choice</Badge>;
     HeroIcon = HiMiniExclamationTriangle;
     iconColorClass = "text-brand-attention";
     iconBgClass = "bg-brand-attention/10";
+  } else if (props.status === "checking") {
+    statusBadge = <Badge tone="info">Checking</Badge>;
+    HeroIcon = HiMiniArrowPath;
+    iconColorClass = "text-brand-blue";
+    iconBgClass = "bg-brand-blue/10";
+    iconSpinClass = "animate-spin";
   } else if (props.status === "degraded") {
     statusBadge = <Badge tone="attention">Degraded</Badge>;
     HeroIcon = HiMiniInformationCircle;
@@ -834,7 +842,7 @@ export function GuardHero(props: {
         <div className="max-w-3xl">
           <div className="flex items-start gap-3">
             <span className={`mt-0.5 inline-flex h-8 w-8 shrink-0 items-center justify-center rounded-full ${iconBgClass}`}>
-              <HeroIcon className={`h-4 w-4 ${iconColorClass}`} aria-hidden="true" />
+              <HeroIcon className={`h-4 w-4 ${iconColorClass} ${iconSpinClass}`.trim()} aria-hidden="true" />
             </span>
             <div>
               <h2 className="text-xl font-semibold tracking-tight text-brand-dark sm:text-2xl">{props.headline}</h2>

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/apps/app-detail-workspace.tsx

@@ -50,7 +50,7 @@ import { appSetupTarget } from "./harness-setup-target";
 import { DEFAULT_FILTER_STATE } from "../evidence/evidence-url-state";
 import type { EvidenceFilterState, EvidenceSortKey } from "../evidence/evidence-types";
 import { CommandActivityWorkspace } from "../command-activity/command-activity-workspace";
-import { protectionHealthFor } from "../protection-health";
+import { protectionHealthFor, protectionPresentationState } from "../protection-health";
 import {
   AppCommandActivityModeTabs,
   type AppActivityMode,
@@ -116,8 +116,8 @@ function writeTabToUrl(tab: TabKey) {
 
 function resolveHeroStatus(
   status: "active" | "needs_setup" | "observed" | "unknown",
-  protectionState: GuardProtectionState,
-): "clear" | "setup_gap" | "needs_review" | "partial" | "degraded" {
+  protectionState: GuardProtectionState | "checking",
+): "clear" | "setup_gap" | "needs_review" | "partial" | "degraded" | "checking" {
   if (status === "active") return protectionState === "protected" ? "clear" : protectionState;
   if (status === "needs_setup") return "setup_gap";
   return "needs_review";
@@ -127,13 +127,14 @@ function resolveHeroHeadline(
   status: "active" | "needs_setup" | "observed" | "unknown",
   harness: string,
   isObserved: boolean,
-  protectionState: GuardProtectionState,
+  protectionState: GuardProtectionState | "checking",
   limited: boolean,
 ): string {
   if (status === "active" && protectionState === "protected" && limited) {
     return `${harnessDisplayName(harness)} is limited`;
   }
   if (status === "active" && protectionState === "protected") return `${harnessDisplayName(harness)} is protected`;
+  if (status === "active" && protectionState === "checking") return `Checking ${harnessDisplayName(harness)} protection`;
   if (status === "active" && protectionState === "partial") return `${harnessDisplayName(harness)} is partially protected`;
   if (status === "active") return `${harnessDisplayName(harness)} protection is degraded`;
   if (status === "needs_setup") return `${harnessDisplayName(harness)} needs setup`;
@@ -144,11 +145,12 @@ function resolveHeroHeadline(
 function resolveHeroSubheadline(
   status: "active" | "needs_setup" | "observed" | "unknown",
   isObserved: boolean,
-  protectionState: GuardProtectionState,
+  protectionState: GuardProtectionState | "checking",
   honestySentence: string | undefined,
 ): string {
   if (status === "active" && honestySentence) return honestySentence;
   if (status === "active" && protectionState === "protected") return "All required protection checks have current proof.";
+  if (status === "active" && protectionState === "checking") return "Guard is confirming local protection. This takes a moment.";
   if (status === "active" && protectionState === "partial") return "Core protection passes, but decision-stream evidence is incomplete.";
   if (status === "active") return "One or more required protection checks failed or remain unproven.";
   if (status === "needs_setup") return "Finish setup so Guard can protect this app.";
@@ -159,7 +161,7 @@ function resolveHeroSubheadline(
 function resolveHeroCta(opts: {
   pendingCount: number;
   status: "active" | "needs_setup" | "observed" | "unknown";
-  protectionState: GuardProtectionState;
+  protectionState: GuardProtectionState | "checking";
   onGoActivity: () => void;
   onGoSettings: () => void;
 }): React.ReactNode {
@@ -170,7 +172,7 @@ function resolveHeroCta(opts: {
       </ActionButton>
     );
   }
-  if (opts.status === "needs_setup" || (opts.status === "active" && opts.protectionState !== "protected")) {
+  if (opts.status === "needs_setup" || (opts.status === "active" && opts.protectionState !== "protected" && opts.protectionState !== "checking")) {
     return (
       <ActionButton onClick={opts.onGoSettings} data-primary="true">
         Open Settings
@@ -325,7 +327,7 @@ export function AppDetailWorkspace(props: AppDetailWorkspaceProps) {
     : "unknown";
 
   const appProtection = protectionHealthFor(runtime, harness);
-  const protectionState = appProtection.state;
+  const protectionState = protectionPresentationState(appProtection);
   const capability = runtime.protection_capabilities?.find((item) => item.harness === harness);
   const limited = capability?.limited === true;
   const heroStatus = resolveHeroStatus(status, protectionState);

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/fleet-workspace.test.ts

@@ -103,6 +103,14 @@ assert(degradedWithApps.status === "degraded", "active installs cannot imply pro
 assert(degradedWithApps.headline === "App protection is degraded", "degraded fleet copy is explicit");
 assert(pairedActiveNoApps.status === "setup_gap", "F5: paired_active no apps status should be setup_gap");
 
+const checkingWithApps = resolveFleetHeroCopy("paired_active", 2, "checking", urls);
+assert(checkingWithApps.status === "checking", "unproven fleet health must not look degraded");
+assert(checkingWithApps.headline === "Checking app protection", "checking fleet copy is explicit");
+assert(
+  !checkingWithApps.headline.toLowerCase().includes("degraded"),
+  "checking fleet copy must not use degraded language",
+);
+
 const targetedRepairs = repairHarnessesFor(
   [
     { harness: "codex", active: true },

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/fleet-workspace.tsx

@@ -24,7 +24,7 @@ import {
   APP_STATUS_LABELS,
 } from "./apps/app-catalog";
 import { isConnectableAppHarness } from "./apps/harness-setup-target";
-import { protectionHealthFor } from "./protection-health";
+import { protectionHealthFor, protectionPresentationState } from "./protection-health";
 import {
   FleetProtectionRecovery,
 } from "./fleet-protection-recovery";
@@ -60,7 +60,7 @@ type FleetHeroUrls = {
 };
 
 export type FleetHeroCopy = {
-  status: "clear" | "setup_gap" | "partial" | "degraded";
+  status: "clear" | "setup_gap" | "partial" | "degraded" | "checking";
   headline: string;
   subheadline: string;
   primaryCtaLabel: string;
@@ -74,10 +74,21 @@ const SUPPORTED_APPS_COPY = SUPPORTED_APPS_BRIEF;
 export function resolveFleetHeroCopy(
   cloudState: "local_only" | "paired_waiting" | "paired_active",
   activeInstallCount: number,
-  protectionState: GuardProtectionState,
+  protectionState: GuardProtectionState | "checking",
   urls: FleetHeroUrls
 ): FleetHeroCopy {
   const hasApps = activeInstallCount > 0;
+  if (hasApps && protectionState === "checking") {
+    return {
+      status: "checking",
+      headline: "Checking app protection",
+      subheadline: "Guard is confirming local protection. This takes a moment.",
+      primaryCtaLabel: "Open Protect",
+      primaryCtaHref: urls.fleet_url,
+      secondaryCtaLabel: "Open Home",
+      secondaryCtaHref: urls.dashboard_url,
+    };
+  }
   if (hasApps && protectionState !== "protected") {
     return {
       status: protectionState,
@@ -289,7 +300,7 @@ export function FleetWorkspace(props: FleetWorkspaceProps) {
   const heroCopy = resolveFleetHeroCopy(
     props.runtime.cloud_state,
     activeInstalls.length,
-    protectionHealth.state,
+    protectionPresentationState(protectionHealth),
     {
       fleet_url: props.runtime.fleet_url,
       dashboard_url: props.runtime.dashboard_url,
@@ -326,7 +337,7 @@ export function FleetWorkspace(props: FleetWorkspaceProps) {
         ]}
       />
 
-      {protectionHealth.state !== "protected" ? (
+      {protectionPresentationState(protectionHealth) !== "checking" && protectionHealth.state !== "protected" ? (
         <FleetProtectionRecovery
           cloudPolicy={{
             cloudState: props.runtime.cloud_state,

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/home-dashboard.test.ts

@@ -11,6 +11,7 @@ import {
   deriveHomeState,
   redactHomeArtifactLabel,
   resolveCloudUpsellVisible,
+  resolveHomeQueuedCount,
   resolveNewAppDiscoveries,
   STREAK_MILESTONE_MESSAGES,
 } from "./home-dashboard";
@@ -503,3 +504,33 @@ assert(
   Object.values(STREAK_MILESTONE_MESSAGES).every((message) => !message.includes("!")),
   "GR186: streak milestone copy should stay calm, not gamified"
 );
+
+const checkingHomeState = deriveHomeState({
+  hasActiveInstalls: true,
+  hasObservedHarnesses: true,
+  queuedCount: 0,
+  watchedAppsCount: 2,
+  protectionState: "checking",
+});
+assert(
+  checkingHomeState.heroStatus === "checking" &&
+    checkingHomeState.headline === "Checking protection" &&
+    !checkingHomeState.headline.toLowerCase().includes("degraded"),
+  "unproven protection must not render as degraded while checks are still settling"
+);
+
+const pendingOverDegraded = deriveHomeState({
+  hasActiveInstalls: true,
+  hasObservedHarnesses: true,
+  queuedCount: 12,
+  watchedAppsCount: 2,
+  protectionState: "degraded",
+});
+assert(
+  pendingOverDegraded.heroStatus === "needs_review" &&
+    pendingOverDegraded.headline === "12 actions need review",
+  "home must prefer the live queue over a degraded protection badge"
+);
+assert(resolveHomeQueuedCount({ pendingCount: 12474, requestCount: 0 }) === 12474, "runtime pending count wins when the home queue payload is empty");
+assert(resolveHomeQueuedCount({ pendingCount: 0, requestCount: 5 }) === 5, "ready queue items still surface when the snapshot count is stale");
+assert(resolveHomeQueuedCount({ pendingCount: null, requestCount: null }) === 0, "missing counts stay at zero");

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/home-dashboard.tsx

@@ -29,7 +29,7 @@ import { EvidenceInsightsHomePreview } from "./evidence/evidence-insights-home-p
 import { EvidenceInsightsShareModal } from "./evidence/evidence-insights-share-modal";
 import { useReceiptAnalytics } from "./evidence/use-receipt-analytics";
 import { HomeCommandActivityCard } from "./command-activity/command-activity-home-card";
-import { protectionHealthFor } from "./protection-health";
+import { protectionHealthFor, protectionPresentationState } from "./protection-health";
 import { WatchProtectionBanner } from "./watch-protection-banner";
 import { updateSettings } from "./guard-api";
 import { guardActionActivityCopy, guardActionDisposition } from "./guard-action";
@@ -233,7 +233,10 @@ export function HomeWorkspace(props: {
   }, [clearPassword, clearTotpCode, props.clearConfirm, props.onConfirmClear, showToast]);
 
   const snapshot = props.runtime.kind === "ready" ? props.runtime.snapshot : null;
-  const queuedCount = props.requests.kind === "ready" ? props.requests.items.length : 0;
+  const queuedCount = resolveHomeQueuedCount({
+    pendingCount: snapshot?.pending_count ?? null,
+    requestCount: props.requests.kind === "ready" ? props.requests.items.length : null,
+  });
   const policyItems = props.policies.kind === "ready" ? props.policies.items : [];
   const managedInstalls = (snapshot?.managed_installs ?? []).filter((item: GuardManagedInstall) => isConnectableAppHarness(item.harness));
   const activeInstalls = managedInstalls.filter((item: GuardManagedInstall) => item.active);
@@ -248,7 +251,9 @@ export function HomeWorkspace(props: {
     : [];
   const clearHarnesses = activeInstalls.length > 0 ? activeInstalls.map((i: GuardManagedInstall) => i.harness) : observedHarnesses;
   const watchedAppsCount = activeInstalls.length > 0 ? activeInstalls.length : observedHarnesses.length;
-  const protectionState = snapshot ? protectionHealthFor(snapshot).state : "degraded";
+  const protectionState = snapshot
+    ? protectionPresentationState(protectionHealthFor(snapshot))
+    : "checking";
 
   const state = useMemo(
     () =>
@@ -555,14 +560,21 @@ function ClearConfirmDialog(props: {
   );
 }
 
+export function resolveHomeQueuedCount(input: {
+  pendingCount: number | null;
+  requestCount: number | null;
+}): number {
+  return Math.max(input.pendingCount ?? 0, input.requestCount ?? 0);
+}
+
 export function deriveHomeState(input: {
   hasActiveInstalls: boolean;
   hasObservedHarnesses: boolean;
   queuedCount: number;
   watchedAppsCount: number;
-  protectionState: GuardProtectionState;
+  protectionState: GuardProtectionState | "checking";
 }): {
-  heroStatus: "clear" | "needs_review" | "setup_gap" | "partial" | "degraded";
+  heroStatus: "clear" | "needs_review" | "setup_gap" | "partial" | "degraded" | "checking";
   headline: string;
   subheadline: string;
   ctaLabel: string;
@@ -600,6 +612,16 @@ export function deriveHomeState(input: {
     };
   }
 
+  if (protectionState === "checking") {
+    return {
+      heroStatus: "checking",
+      headline: "Checking protection",
+      subheadline: "Guard is confirming local protection. This takes a moment.",
+      ctaLabel: "Open Protect",
+      ctaTarget: "protect",
+    };
+  }
+
   if (protectionState === "degraded") {
     return {
       heroStatus: "degraded",

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/protection-health.test.ts

@@ -6,7 +6,9 @@ import {
   PROTECTION_CHECK_IDS,
   protectionHeadlineFor,
   protectionHealthFor,
+  protectionPresentationState,
   remainingProtectionRepairParts,
+  unavailableProtectionHealth,
 } from "./protection-health";
 import type { GuardProtectionCheck, GuardRuntimeSnapshot } from "./guard-types";
 
@@ -113,10 +115,25 @@ assert.equal(
   "setup",
 );
 
+assert.equal(protectionPresentationState(unavailableProtectionHealth()), "checking");
+assert.equal(protectionPresentationState(normalizeProtectionHealth(payload(decisionFailure))), "degraded");
+assert.equal(protectionPresentationState(protectedHealth), "protected");
+const unprovenCore = checks();
+unprovenCore[PROTECTION_CHECK_IDS.indexOf("harness_hooks")] = {
+  check_id: "harness_hooks",
+  status: "unknown",
+  reason_code: "hook_verification_unavailable",
+};
+assert.equal(
+  protectionPresentationState(normalizeProtectionHealth(payload(unprovenCore))),
+  "degraded",
+);
+
 const appSource = readFileSync(new URL("./app.tsx", import.meta.url), "utf8");
 const appDetailSource = readFileSync(new URL("./apps/app-detail-workspace.tsx", import.meta.url), "utf8");
 const fleetSource = readFileSync(new URL("./fleet-workspace.tsx", import.meta.url), "utf8");
 const reviewStatesSource = readFileSync(new URL("./review-states.tsx", import.meta.url), "utf8");
+const homeSource = readFileSync(new URL("./home-dashboard.tsx", import.meta.url), "utf8");
 assert.match(appSource, /const handleRepairProtection = useCallback/);
 assert.match(appSource, /onRepairProtection=\{handleRepairProtection\}/);
 assert.match(appSource, /remainingProtectionRepairParts\(remainingHealth\)/);
@@ -183,6 +200,13 @@ assert.deepEqual(remainingProtectionRepairParts(hookFailureHealth), {
 });
 assert.match(appDetailSource, /Install state" value=\{active \? "Installed"/);
 assert.match(appDetailSource, /protectionHealthFor\(runtime, harness\)/);
+assert.match(appDetailSource, /protectionPresentationState\(appProtection\)/);
 assert.match(fleetSource, /resolveAppStatus\(install, appProtection,/);
 assert.match(fleetSource, /hookCheck\?\.status === "fail"/);
 assert.match(reviewStatesSource, /protectedAppsCount = protectionHealth\.apps\.filter/);
+assert.match(reviewStatesSource, /if \(runtime === null\)/);
+assert.match(reviewStatesSource, /guard-skeleton/);
+assert.match(homeSource, /snapshot\?\.pending_count/);
+assert.match(homeSource, /resolveHomeQueuedCount/);
+assert.match(homeSource, /protectionPresentationState/);
+assert.doesNotMatch(homeSource, /protectionHealthFor\(snapshot\)\.state : "degraded"/);

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/protection-health.ts

@@ -23,6 +23,8 @@ export const PROTECTION_CHECK_IDS = [
 const CORE_CHECK_IDS = PROTECTION_CHECK_IDS.filter((checkId) => checkId !== "decision_stream");
 const STABLE_ID = /^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/;
 
+export type ProtectionPresentationState = GuardProtectionState | "checking";
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -96,6 +98,17 @@ export function unavailableProtectionHealth(): GuardProtectionHealth {
   };
 }
 
+export function protectionPresentationState(
+  health: Pick<GuardProtectionHealth, "state" | "checks">,
+): ProtectionPresentationState {
+  const byId = new Map(health.checks.map((check) => [check.check_id, check.status]));
+  const coreUnknown = CORE_CHECK_IDS.every((checkId) => byId.get(checkId) === "unknown");
+  if (coreUnknown && !health.checks.some((check) => check.status === "fail")) {
+    return "checking";
+  }
+  return health.state;
+}
+
 function normalizeApp(value: unknown): GuardProtectionAppHealth | null {
   if (!isRecord(value)) return null;
   const harness = value.harness;

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/dashboard/src/review-states.tsx

@@ -21,7 +21,7 @@ import type {
 } from "./guard-types";
 import { normalizeGuardAction } from "./guard-action";
 import { LoggedActionPanel } from "./logged-action-panel";
-import { protectionHealthFor, unavailableProtectionHealth } from "./protection-health";
+import { protectionHealthFor, protectionPresentationState } from "./protection-health";
 
 const PROTECTION_APPEARANCE = {
   protected: {
@@ -102,27 +102,48 @@ function ReviewCodexResumePanel({ resume, onRetry }: ReviewCodexResumePanelProps
 }
 
 export function ReviewEmptyState({ runtime, resolutionMessage, codexResume, onRetryResume }: { runtime: GuardRuntimeSnapshot | null; resolutionMessage: string | null; codexResume: GuardCodexResumeResult | null; onRetryResume?: () => void }) {
-  const protectionHealth = runtime ? protectionHealthFor(runtime) : unavailableProtectionHealth();
+  if (runtime === null) {
+    return (
+      <div className="space-y-4" aria-busy="true" aria-live="polite">
+        <div className="guard-skeleton h-36 w-full" />
+        <div className="guard-skeleton h-16 w-full" />
+        <div className="guard-skeleton h-48 w-full" />
+      </div>
+    );
+  }
+
+  const protectionHealth = protectionHealthFor(runtime);
+  const presentation = protectionPresentationState(protectionHealth);
   const protectedAppsCount = protectionHealth.apps.filter((app) => app.state === "protected").length;
-  const heroStatus = protectionHealth.state === "protected" ? "clear" : protectionHealth.state;
+  const heroStatus = presentation === "protected" ? "clear" : presentation;
+  const appearanceState = presentation === "checking" ? "partial" : protectionHealth.state;
   const {
     Icon: ProtectionIcon,
     cardClass: healthCardClass,
     iconClass: healthIconClass,
-  } = PROTECTION_APPEARANCE[protectionHealth.state];
+  } = PROTECTION_APPEARANCE[appearanceState];
+  const protectionLabel = presentation === "checking" ? "Checking" : protectionHealth.label;
+  const protectionDetail =
+    presentation === "checking"
+      ? "Guard is confirming local protection. This takes a moment."
+      : protectionHealth.detail;
 
   return (
     <div className="space-y-6">
       <GuardHero
         status={heroStatus}
-        headline="Nothing to review"
-        subheadline={`No actions need your decision right now. ${protectionHealth.detail}`}
+        headline={presentation === "checking" ? "Checking protection" : "Nothing to review"}
+        subheadline={
+          presentation === "checking"
+            ? protectionDetail
+            : `No actions need your decision right now. ${protectionDetail}`
+        }
       />
 
       <ProofStrip
         items={[
           { label: "Queue", value: "All clear", tone: "green" },
-          { label: "Protection", value: protectionHealth.label, tone: protectionHealth.state === "protected" ? "green" : "slate" },
+          { label: "Protection", value: protectionLabel, tone: protectionHealth.state === "protected" ? "green" : "slate" },
           { label: "Apps protected", value: protectedAppsCount, tone: protectedAppsCount > 0 ? "green" : "slate" },
         ]}
       />
@@ -145,9 +166,9 @@ export function ReviewEmptyState({ runtime, resolutionMessage, codexResume, onRe
               <ProtectionIcon className="h-5 w-5" aria-hidden="true" />
             </span>
             <div>
-              <SectionLabel>{protectionHealth.label}</SectionLabel>
+              <SectionLabel>{protectionLabel}</SectionLabel>
               <p className="mt-2 text-sm text-muted-foreground">
-                {protectionHealth.detail} When something needs review, it will appear here.
+                {protectionDetail} When something needs review, it will appear here.
               </p>
             </div>
           </div>

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.0.0a199"
+version = "3.0.0a200"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.0.0a199"
+version = "3.0.0a200"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.0.0a199/release-metadata/plugin-scanner-v3.0.0a199.toolchain.cdx.json → plugin_scanner-3.0.0a200/release-metadata/plugin-scanner-v3.0.0a200.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.0.0a199"
+      "version": "3.0.0a200"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/src/codex_plugin_scanner/guard/approvals.py

@@ -1462,6 +1462,21 @@ def attach_primary_approval_link(
         payload["primary_approval_url"] = review_url
 
 
+_UNPROVEN_HOOK_REASONS = frozenset({"guard_cursor_cli_attestation_unavailable"})
+
+
+def _recorded_hook_verification(value: object) -> bool | None:
+    """Return proven hook state, or None when current proof is still unavailable."""
+
+    if isinstance(value, bool):
+        return value
+    if not isinstance(value, Mapping):
+        return None
+    if value.get("reason") in _UNPROVEN_HOOK_REASONS or value.get("integrity_status") == "attestation-unavailable":
+        return None
+    return value.get("protection_active") is True
+
+
 def _live_hook_verification(
     managed_installs: Sequence[Mapping[str, object]],
     store: GuardStore,
@@ -1480,12 +1495,18 @@ def _live_hook_verification(
             if harness == "codex":
                 from .adapters.codex import codex_native_hook_state
 
-                verified[harness] = codex_native_hook_state(context).get("protection_active") is True
+                proven = _recorded_hook_verification(codex_native_hook_state(context))
+                if proven is None:
+                    continue
+                verified[harness] = proven
                 continue
             if harness == "cursor":
                 from .adapters.cursor_hooks import cursor_native_hook_state
 
-                verified[harness] = cursor_native_hook_state(context).get("protection_active") is True
+                proven = _recorded_hook_verification(cursor_native_hook_state(context))
+                if proven is None:
+                    continue
+                verified[harness] = proven
                 continue
             if harness == "grok":
                 from .cli.install_commands import grok_hooks_protection_ready

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/about-workspace.js

@@ -1,4 +1,4 @@
-import { j as jsxRuntimeExports, aq as Tag, bT as Surface, M as Badge, r as reactExports, S as SectionLabel, bf as HiMiniArrowTopRightOnSquare, bU as HiMiniCheckBadge } from "../guard-dashboard.js";
+import { j as jsxRuntimeExports, ar as Tag, bU as Surface, N as Badge, r as reactExports, S as SectionLabel, bg as HiMiniArrowTopRightOnSquare, bV as HiMiniCheckBadge } from "../guard-dashboard.js";
 const ABOUT_PARTNER_SECTION_TITLE = "Standards partner program";
 const ABOUT_PARTNER_SECTION_BODY = "Join teams building on HOL open standards. Partners get early access to protocol drafts, co-marketing, and direct engineering support.";
 const ABOUT_PARTNER_CTA = "Explore partner programs";

{plugin_scanner-3.0.0a199 → plugin_scanner-3.0.0a200}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-detail-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, aJ as fetchApprovalPage, aK as fetchPolicy, s as guardActionDisposition, p as protectionHealthFor, aG as HiMiniArrowLeft, c as HiMiniChevronRight, i as harnessDisplayName, n as GuardHero, R as ProofStrip, aL as HiMiniHome, L as HiMiniBolt, a3 as HiMiniAdjustmentsHorizontal, S as SectionLabel, A as ActionButton, q as HiMiniShieldCheck, t as formatRelativeTime, K as HiMiniExclamationTriangle, aM as guardActionPresentation, M as Badge, aN as DEFAULT_FILTER_STATE, aO as filterEvidence, aP as sortEvidence, aQ as computeMetrics, aR as CommandActivityWorkspace, k as EmptyState, aS as EvidenceFilterBar, aT as EvidenceInsightStrip, aU as EvidenceActionList, aV as EvidenceActionDetail, I as useFocusTrap, aW as policyIdentityKey, C as HiMiniCloud, aX as HiMiniChartBar, aq as Tag, m as HiMiniCheckCircle, U as HiMiniXCircle, aY as runHarnessAction, aZ as GuardHarnessActionError, a_ as HiMiniRocketLaunch, au as HiMiniArrowPath, a$ as HiMiniTrash, b0 as clearLabelForScope, b1 as formatHarnessCommand } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, aK as fetchApprovalPage, aL as fetchPolicy, t as guardActionDisposition, k as protectionHealthFor, p as protectionPresentationState, aH as HiMiniArrowLeft, c as HiMiniChevronRight, i as harnessDisplayName, o as GuardHero, T as ProofStrip, aM as HiMiniHome, M as HiMiniBolt, a4 as HiMiniAdjustmentsHorizontal, S as SectionLabel, A as ActionButton, s as HiMiniShieldCheck, v as formatRelativeTime, L as HiMiniExclamationTriangle, aN as guardActionPresentation, N as Badge, aO as DEFAULT_FILTER_STATE, aP as filterEvidence, aQ as sortEvidence, aR as computeMetrics, aS as CommandActivityWorkspace, l as EmptyState, aT as EvidenceFilterBar, aU as EvidenceInsightStrip, aV as EvidenceActionList, aW as EvidenceActionDetail, J as useFocusTrap, aX as policyIdentityKey, F as HiMiniCloud, aY as HiMiniChartBar, ar as Tag, n as HiMiniCheckCircle, V as HiMiniXCircle, aZ as runHarnessAction, a_ as GuardHarnessActionError, a$ as HiMiniRocketLaunch, av as HiMiniArrowPath, b0 as HiMiniTrash, b1 as clearLabelForScope, b2 as formatHarnessCommand } from "../guard-dashboard.js";
 import { a as appSetupTarget } from "./harness-setup-target.js";
 function ActivityModeButton(props) {
   const active = props.mode === props.value;
@@ -83,6 +83,7 @@ function resolveHeroHeadline(status, harness, isObserved, protectionState, limit
     return `${harnessDisplayName(harness)} is limited`;
   }
   if (status === "active" && protectionState === "protected") return `${harnessDisplayName(harness)} is protected`;
+  if (status === "active" && protectionState === "checking") return `Checking ${harnessDisplayName(harness)} protection`;
   if (status === "active" && protectionState === "partial") return `${harnessDisplayName(harness)} is partially protected`;
   if (status === "active") return `${harnessDisplayName(harness)} protection is degraded`;
   if (status === "needs_setup") return `${harnessDisplayName(harness)} needs setup`;
@@ -92,6 +93,7 @@ function resolveHeroHeadline(status, harness, isObserved, protectionState, limit
 function resolveHeroSubheadline(status, isObserved, protectionState, honestySentence) {
   if (status === "active" && honestySentence) return honestySentence;
   if (status === "active" && protectionState === "protected") return "All required protection checks have current proof.";
+  if (status === "active" && protectionState === "checking") return "Guard is confirming local protection. This takes a moment.";
   if (status === "active" && protectionState === "partial") return "Core protection passes, but decision-stream evidence is incomplete.";
   if (status === "active") return "One or more required protection checks failed or remain unproven.";
   if (status === "needs_setup") return "Finish setup so Guard can protect this app.";
@@ -106,7 +108,7 @@ function resolveHeroCta(opts) {
       " pending"
     ] });
   }
-  if (opts.status === "needs_setup" || opts.status === "active" && opts.protectionState !== "protected") {
+  if (opts.status === "needs_setup" || opts.status === "active" && opts.protectionState !== "protected" && opts.protectionState !== "checking") {
     return /* @__PURE__ */ jsxRuntimeExports.jsx(ActionButton, { onClick: opts.onGoSettings, "data-primary": "true", children: "Open Settings" });
   }
   return /* @__PURE__ */ jsxRuntimeExports.jsx(ActionButton, { onClick: opts.onGoActivity, "data-primary": "true", children: "View Activity" });
@@ -214,7 +216,7 @@ function AppDetailWorkspace(props) {
   const policyError = harnessPolicy.kind === "error" ? harnessPolicy.message : null;
   const status = isActive ? "active" : install !== void 0 ? "needs_setup" : isObserved ? "observed" : "unknown";
   const appProtection = protectionHealthFor(runtime, harness);
-  const protectionState = appProtection.state;
+  const protectionState = protectionPresentationState(appProtection);
   const capability = runtime.protection_capabilities?.find((item) => item.harness === harness);
   const limited = capability?.limited === true;
   const heroStatus = resolveHeroStatus(status, protectionState);