Function runPluginScan

apps/cursor/src/lib/plugins/scan.ts:147–189

(pluginId: string)

 * error.
 */
export async function runPluginScan(pluginId: string): Promise<void> {
  logInfo(pluginId, "scan start");

  const loaded = await loadPlugin(pluginId);
  if (!loaded) {
    logInfo(pluginId, "loadPlugin returned null; nothing to scan");
    return;
  }

  const tag = loaded.plugin.slug;

  if (loaded.permanentlyBlocked) {
    logInfo(tag, "permanently blocked; short-circuiting");
    await applyBlockedShortCircuit(pluginId);
    return;
  }

  await markScanning(pluginId);
  try {
    const similar = await findSimilarPlugins(pluginId);
    if (similar.length > 0) {
      logInfo(tag, "candidate duplicates", {
        count: similar.length,
        topSimilarity: similar[0].similarity,
      });
    }
    const verdict = await runSecurityAgent(loaded.plugin, similar);
    await applyVerdict(pluginId, loaded.prevActive, verdict);
    logInfo(tag, "scan complete", {
      verdict: verdict.verdict,
      severity: verdict.severity,
    });
  } catch (err) {
    // Compensation: without this the row stays at scan_status='scanning'
    // forever (no scan_run_id, no flag), which is invisible to admins
    // until the 15-min staleness threshold in getStuckScans() trips.
    // Surfacing as 'error' lets the admin re-scan or delete it.
    const message = err instanceof Error ? err.message : String(err);
    logError(tag, "scan failed; marking scan_status=error", err);
    await markScanFailed(pluginId, message);
    throw err;
  }
}

async function loadPlugin(pluginId: string): Promise<LoadResult | null> {
  const supabase = await createClient();