Function applyVerdict

apps/cursor/src/lib/plugins/scan.ts:659–717

(
  pluginId: string,
  prevActive: boolean,
  verdict: AgentVerdict,
)

}

async function applyVerdict(
  pluginId: string,
  prevActive: boolean,
  verdict: AgentVerdict,
) {
  const supabase = await createClient();

  const now = new Date().toISOString();
  const baseUpdate = {
    last_scanned_at: now,
    scan_run_id: verdict.runId,
    scan_verdict: {
      verdict: verdict.verdict,
      severity: verdict.severity,
      categories: verdict.categories,
      reasons: verdict.reasons,
      summary: verdict.summary,
    } satisfies ScanVerdict,
  };

  if (verdict.verdict === "safe") {
    await supabase
      .from("plugins")
      .update({
        ...baseUpdate,
        active: true,
        scan_status: "safe",
        flag_summary: null,
        flag_reasons: [],
        flag_severity: null,
        flagged_at: null,
      })
      .eq("id", pluginId);
    return;
  }

  // Severity policy: only delist a previously-live plugin if the new verdict
  // is malicious or high severity. Lower-severity flags surface in the admin
  // queue without yanking the plugin.
  const shouldHide =
    !prevActive ||
    verdict.verdict === "malicious" ||
    verdict.severity === "high";

  await supabase
    .from("plugins")
    .update({
      ...baseUpdate,
      active: !shouldHide,
      scan_status: "flagged",
      flag_summary: verdict.summary,
      flag_reasons: verdict.reasons.length
        ? verdict.reasons
        : verdict.categories,
      flag_severity: verdict.severity,
      flagged_at: now,
    })
    .eq("id", pluginId);