plugin-scanner 2.0.1067__tar.gz → 2.0.1069__tar.gz

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1067
+Version: 2.0.1069
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/dashboard/src/guard-api.ts

@@ -1305,7 +1305,9 @@ export async function fetchSettings(): Promise<GuardSettingsPayload> {
           codex: {}
         },
         approval_wait_timeout_seconds: 120,
-        approval_surface_policy: "auto-open-once",
+        approval_surface_policy: "attention-aware",
+        approval_browser_delay_seconds: 20,
+        approval_browser_immediate_severity: "critical",
         telemetry: false,
         sync: false,
         billing: false

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/dashboard/src/guard-types.ts

@@ -695,6 +695,8 @@ export type GuardSettings = {
   harness_risk_actions: Record<string, Record<string, string>>;
   approval_wait_timeout_seconds: number;
   approval_surface_policy: string;
+  approval_browser_delay_seconds: number;
+  approval_browser_immediate_severity: RiskSignalV2Severity;
   telemetry: boolean;
   sync: boolean;
   billing: boolean;

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/dashboard/src/settings-workspace.tsx

@@ -181,9 +181,16 @@ const actionOptions = [
 ];
 
 const surfacePolicyOptions = [
-  { value: "auto-open-once", label: "Open this dashboard once" },
-  { value: "approval-center", label: "Show in this dashboard" },
-  { value: "native-only", label: "Show in my AI app only" },
+  { value: "attention-aware", label: "Smart (recommended)" },
+  { value: "approval-center", label: "Open prompts immediately" },
+  { value: "native-only", label: "Never open the browser" },
+];
+
+const attentionSeverityOptions = [
+  { value: "critical", label: "Critical risk" },
+  { value: "high", label: "High or critical risk" },
+  { value: "medium", label: "Medium risk or higher" },
+  { value: "low", label: "Any identified risk" },
 ];
 
 const protectionModeChoices = [
@@ -599,6 +606,16 @@ export function SettingsWorkspace({ onApprovalGateChange }: SettingsWorkspacePro
     setSaveError(null);
   }, []);
 
+  const handleNumberChange = useCallback(
+    (key: keyof GuardSettings) => (event: ChangeEvent<HTMLInputElement>) => {
+      const parsed = Number.parseInt(event.target.value, 10);
+      const value = Number.isNaN(parsed) ? 0 : parsed;
+      setDraft((settings) => settings === null ? settings : { ...settings, [key]: value });
+      setSaveError(null);
+    },
+    [],
+  );
+
   const handleModeChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
     const nextMode = event.target.value as GuardSettings["mode"];
     if (nextMode === "observe") { setPendingMode(nextMode); return; }
@@ -1576,6 +1593,27 @@ export function SettingsWorkspace({ onApprovalGateChange }: SettingsWorkspacePro
                 <SettingSelect label="Nested commands" value={draft.subprocess_action} options={actionOptions} onChange={handleStringChange("subprocess_action")} />
                 <SettingSelect label="Where to ask" value={draft.approval_surface_policy} options={surfacePolicyOptions} onChange={handleStringChange("approval_surface_policy")} />
               </div>
+              {draft.approval_surface_policy === "attention-aware" ? (
+                <div className="grid gap-3 border-t border-slate-100 py-3 sm:grid-cols-2">
+                  <SettingNumber
+                    label="Browser delay"
+                    value={draft.approval_browser_delay_seconds}
+                    min={0}
+                    max={300}
+                    suffix="seconds"
+                    onChange={handleNumberChange("approval_browser_delay_seconds")}
+                  />
+                  <SettingSelect
+                    label="Open immediately for"
+                    value={draft.approval_browser_immediate_severity}
+                    options={attentionSeverityOptions}
+                    onChange={handleStringChange("approval_browser_immediate_severity")}
+                  />
+                  <p className="text-xs leading-5 text-slate-500 sm:col-span-2">
+                    Guard cancels the browser prompt when your AI app continues with a different action. Desktop and in-app notices still appear immediately.
+                  </p>
+                </div>
+              ) : null}
             </SettingsFormSection>
           </div>
         )}
@@ -1879,6 +1917,34 @@ function SettingSelect(props: {
   );
 }
 
+function SettingNumber(props: {
+  label: string;
+  value: number;
+  min: number;
+  max: number;
+  suffix: string;
+  onChange: (event: ChangeEvent<HTMLInputElement>) => void;
+}) {
+  const inputId = `setting-${props.label.toLowerCase().replaceAll(" ", "-")}`;
+  return (
+    <label htmlFor={inputId} className="space-y-2">
+      <span className="block text-sm font-medium text-brand-dark">{props.label}</span>
+      <span className="flex min-h-11 items-center rounded-lg border border-slate-200 bg-white focus-within:border-brand-blue focus-within:ring-1 focus-within:ring-brand-blue/20">
+        <input
+          id={inputId}
+          type="number"
+          min={props.min}
+          max={props.max}
+          value={props.value}
+          onChange={props.onChange}
+          className="min-w-0 flex-1 bg-transparent px-3 py-2 text-sm text-brand-dark focus:outline-none"
+        />
+        <span className="border-l border-slate-100 px-3 text-xs text-slate-500">{props.suffix}</span>
+      </span>
+    </label>
+  );
+}
+
 function SettingToggle(props: {
   id: string;
   label: string;

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1067"
+version = "2.0.1069"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1067"
+version = "2.0.1069"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/src/codex_plugin_scanner/guard/cli/approval_commands.py

@@ -288,6 +288,8 @@ def _auto_open_first_pending_request(*, store: GuardStore, workspace: Path | Non
     approval_surface_policy = config.approval_surface_policy
     if approval_surface_policy == "native-only":
         approval_surface_policy = "never-auto-open"
+    elif approval_surface_policy == "attention-aware":
+        approval_surface_policy = "approval-center"
     result = GuardSurfaceRuntime(store).ensure_surface(
         surface="approval-center",
         approval_center_url=approval_center_url,

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/src/codex_plugin_scanner/guard/cli/commands_support_codex_commands.py

@@ -38,6 +38,7 @@ from .commands_support_codex_tool_output import (
     _codex_strip_env_wrapper,
     _codex_unwrapped_command_parts,
 )
+from .commands_support_native_search import native_post_tool_search_is_read_only
 
 
 def _codex_pipeline_segment_may_read_local_content(segment: str, *, index: int, cwd: Path | None) -> bool:
@@ -368,8 +369,19 @@ def _codex_source_inspection_can_skip_secret_output(
     content_matches: tuple[SecretContentMatch, ...],
     cwd: Path | None,
     home_dir: Path | None = None,
+    payload: dict[str, object] | None = None,
 ) -> bool:
-    if not _codex_command_is_read_only_source_inspection(command_text, cwd=cwd, home_dir=home_dir):
+    command_is_read_only = _codex_command_is_read_only_source_inspection(
+        command_text,
+        cwd=cwd,
+        home_dir=home_dir,
+    )
+    native_search_is_read_only = payload is not None and native_post_tool_search_is_read_only(
+        payload=payload,
+        cwd=cwd,
+        home_dir=home_dir,
+    )
+    if not command_is_read_only and not native_search_is_read_only:
         return False
     if _codex_command_references_sensitive_local_source(command_text, cwd=cwd):
         return False

plugin_scanner-2.0.1069/src/codex_plugin_scanner/guard/cli/commands_support_native_search.py

@@ -0,0 +1,105 @@
+"""Validation for structured, read-only native source-search tool calls."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from ..runtime.secret_file_requests import _read_only_lookup_target_is_safe
+from ..runtime.source_paths import resolve_source_candidate_path
+
+_NATIVE_SEARCH_TOOLS = frozenset({"grep", "egrep", "fgrep", "rg"})
+_EXPLICIT_COMMAND_KEYS = ("command", "cmd", "shell_command", "shellCommand")
+_PATTERN_KEYS = ("pattern", "query", "search", "regex")
+_TARGET_KEYS = ("path", "file_path", "filePath", "filepath", "file", "filename")
+_PLURAL_TARGET_KEYS = ("paths", "files")
+_GLOB_KEYS = ("glob", "include", "includes")
+
+
+def native_post_tool_search_is_read_only(
+    *,
+    payload: dict[str, object],
+    cwd: Path | None,
+    home_dir: Path | None,
+) -> bool:
+    """Return whether a structured native search payload is bounded and read-only."""
+    tool_name = str(payload.get("tool_name", "")).strip().lower()
+    if tool_name not in _NATIVE_SEARCH_TOOLS:
+        return False
+    tool_input = payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return False
+    if any(_nonempty_string(tool_input.get(key)) for key in _EXPLICIT_COMMAND_KEYS):
+        return False
+
+    present_patterns = [tool_input[key] for key in _PATTERN_KEYS if key in tool_input]
+    if not present_patterns or any(not _nonempty_string(value) for value in present_patterns):
+        return False
+    if tool_input.get("follow") not in (None, False) or tool_input.get("hidden") not in (None, False):
+        return False
+
+    present_globs = [tool_input[key] for key in _GLOB_KEYS if key in tool_input]
+    if any(not _safe_glob(value, home_dir=home_dir) for value in present_globs):
+        return False
+
+    targets = _native_search_targets(tool_input)
+    if targets is None:
+        return False
+    if not targets:
+        targets = (".",)
+    return all(_native_search_target_is_safe(target, cwd=cwd, home_dir=home_dir) for target in targets)
+
+
+def _native_search_targets(tool_input: dict[str, object]) -> tuple[str, ...] | None:
+    targets: list[str] = []
+    for key in _TARGET_KEYS:
+        if key not in tool_input:
+            continue
+        value = tool_input[key]
+        if not _nonempty_string(value):
+            return None
+        targets.append(str(value).strip())
+    for key in _PLURAL_TARGET_KEYS:
+        if key not in tool_input:
+            continue
+        value = tool_input[key]
+        if not isinstance(value, list) or not value or any(not _nonempty_string(item) for item in value):
+            return None
+        targets.extend(str(item).strip() for item in value)
+    return tuple(targets)
+
+
+def _safe_glob(value: object, *, home_dir: Path | None) -> bool:
+    return _nonempty_string(value) and _read_only_lookup_target_is_safe(
+        str(value),
+        allow_dirs=False,
+        home_dir=home_dir,
+    )
+
+
+def _native_search_target_is_safe(
+    target: str,
+    *,
+    cwd: Path | None,
+    home_dir: Path | None,
+) -> bool:
+    if any(marker in target for marker in ("*", "?", "[", "]")):
+        return False
+    if not _read_only_lookup_target_is_safe(target, allow_dirs=True, home_dir=home_dir):
+        return False
+    candidate = resolve_source_candidate_path(target, cwd=cwd, home_dir=home_dir)
+    if candidate is None:
+        return False
+    try:
+        resolved = candidate.resolve(strict=True)
+    except (OSError, RuntimeError, ValueError):
+        return False
+    return (resolved.is_file() or resolved.is_dir()) and _read_only_lookup_target_is_safe(
+        str(resolved), allow_dirs=True, home_dir=home_dir
+    )
+
+
+def _nonempty_string(value: object) -> bool:
+    return isinstance(value, str) and bool(value.strip())
+
+
+__all__ = ["native_post_tool_search_is_read_only"]

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py

@@ -430,6 +430,7 @@ def _codex_post_tool_output_artifact(
         content_matches=content_matches,
         cwd=cwd,
         home_dir=home_dir,
+        payload=payload,
     ):
         return None
     if _codex_focused_pytest_can_skip_secret_output(

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/src/codex_plugin_scanner/guard/config.py

@@ -203,6 +203,8 @@ EDITABLE_GUARD_SETTING_KEYS = frozenset(
         "harness_risk_actions",
         "approval_wait_timeout_seconds",
         "approval_surface_policy",
+        "approval_browser_delay_seconds",
+        "approval_browser_immediate_severity",
         "desktop_notifications",
         "telemetry",
         "sync",
@@ -212,7 +214,8 @@ EDITABLE_GUARD_SETTING_KEYS = frozenset(
 )
 VALID_RECEIPT_REDACTION_LEVELS = frozenset({"full", "partial", "none"})
 
-VALID_APPROVAL_SURFACE_POLICIES = {"auto-open-once", "native-only", "approval-center"}
+VALID_APPROVAL_SURFACE_POLICIES = {"attention-aware", "auto-open-once", "native-only", "approval-center"}
+VALID_APPROVAL_BROWSER_SEVERITIES = frozenset({"info", "low", "medium", "high", "critical"})
 BARE_TOML_KEY = re.compile(r"^[A-Za-z0-9_-]+$")
 WORKSPACE_BLOCKED_POLICY_KEYS = frozenset(
     {
@@ -303,7 +306,9 @@ class GuardConfig:
     new_network_domain_action: GuardAction = "warn"
     subprocess_action: GuardAction = "warn"
     approval_wait_timeout_seconds: int = 120
-    approval_surface_policy: str = "auto-open-once"
+    approval_surface_policy: str = "attention-aware"
+    approval_browser_delay_seconds: int = 20
+    approval_browser_immediate_severity: str = "critical"
     desktop_notifications: bool = True
     telemetry: bool = False
     sync: bool = False
@@ -405,7 +410,15 @@ def load_guard_config(guard_home: Path, workspace: Path | None = None) -> GuardC
             merged.get("approval_wait_timeout_seconds"),
             120,
         ),
-        approval_surface_policy=str(merged.get("approval_surface_policy", "auto-open-once")),
+        approval_surface_policy=_coerce_loaded_approval_surface_policy(merged.get("approval_surface_policy")),
+        approval_browser_delay_seconds=_coerce_loaded_bounded_int(
+            merged.get("approval_browser_delay_seconds"),
+            default=20,
+            maximum=300,
+        ),
+        approval_browser_immediate_severity=_coerce_loaded_approval_browser_severity(
+            merged.get("approval_browser_immediate_severity")
+        ),
         desktop_notifications=_coerce_loaded_bool(merged.get("desktop_notifications", True)),
         telemetry=bool(merged.get("telemetry", False)),
         sync=bool(merged.get("sync", False)),
@@ -443,6 +456,8 @@ def editable_guard_settings(config: GuardConfig) -> dict[str, object]:
         "harness_risk_actions": dict(config.harness_risk_actions or {}),
         "approval_wait_timeout_seconds": config.approval_wait_timeout_seconds,
         "approval_surface_policy": config.approval_surface_policy,
+        "approval_browser_delay_seconds": config.approval_browser_delay_seconds,
+        "approval_browser_immediate_severity": config.approval_browser_immediate_severity,
         "desktop_notifications": config.desktop_notifications,
         "telemetry": config.telemetry,
         "sync": config.sync,
@@ -512,8 +527,16 @@ def _coerce_editable_setting(key: str, value: object) -> object:
         raise ValueError("Invalid Guard action.")
     if key == "approval_surface_policy":
         if isinstance(value, str) and value in VALID_APPROVAL_SURFACE_POLICIES:
-            return value
+            return "attention-aware" if value == "auto-open-once" else value
         raise ValueError("Invalid approval surface policy.")
+    if key == "approval_browser_delay_seconds":
+        if isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= 300:
+            return value
+        raise ValueError("Browser attention delay must be between 0 and 300 seconds.")
+    if key == "approval_browser_immediate_severity":
+        if isinstance(value, str) and value in VALID_APPROVAL_BROWSER_SEVERITIES:
+            return value
+        raise ValueError("Invalid immediate browser attention severity.")
     if key == "approval_wait_timeout_seconds":
         if isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= MAX_APPROVAL_WAIT_TIMEOUT_SECONDS:
             return value
@@ -582,6 +605,26 @@ def _coerce_loaded_non_negative_int(value: object, fallback: int) -> int:
     return fallback
 
 
+def _coerce_loaded_bounded_int(value: object, *, default: int, maximum: int) -> int:
+    if isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= maximum:
+        return value
+    return default
+
+
+def _coerce_loaded_approval_surface_policy(value: object) -> str:
+    if value == "auto-open-once":
+        return "attention-aware"
+    if isinstance(value, str) and value in VALID_APPROVAL_SURFACE_POLICIES:
+        return value
+    return "attention-aware"
+
+
+def _coerce_loaded_approval_browser_severity(value: object) -> str:
+    if isinstance(value, str) and value in VALID_APPROVAL_BROWSER_SEVERITIES:
+        return value
+    return "critical"
+
+
 def _coerce_loaded_positive_int(value: object, fallback: int) -> int:
     if isinstance(value, int) and not isinstance(value, bool) and value > 0:
         return value

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -56,6 +56,7 @@ from ..approvals import (
     ApprovalRequestAlreadyResolvedError,
     ApprovalRequestNotFoundError,
     apply_approval_resolution,
+    build_approval_browser_url,
     build_runtime_snapshot,
     bulk_allow_read_only_once,
 )
@@ -131,6 +132,7 @@ from ..review_contracts import (
     validate_remote_approval_request_binding,
     validated_remote_approval_envelope,
 )
+from ..runtime.approval_attention import ApprovalAttentionCoordinator
 from ..runtime.live_request_sync import LiveRequestSyncWorker, start_cloud_sync_sync_worker, stop_cloud_sync_sync_worker
 from ..runtime.runner import (
     GuardSyncAuthorizationExpiredError,
@@ -269,6 +271,7 @@ class _GuardDaemonHttpServer(ThreadingHTTPServer):
     package_firewall_action_rate_limiter: PackageFirewallActionRateLimiter
     package_firewall_session_nonces: dict[str, float]
     package_firewall_session_nonces_lock: threading.Lock
+    approval_attention: ApprovalAttentionCoordinator
 
     def __init__(
         self,
@@ -305,6 +308,11 @@ class _GuardDaemonHttpServer(ThreadingHTTPServer):
         from .hook_worker import HookWorker
 
         self.hook_worker = HookWorker(store=store)
+        self.approval_attention = ApprovalAttentionCoordinator(
+            store=store,
+            runtime=self.runtime,
+            opener=webbrowser.open,
+        )
 
     def daemon_host(self) -> str:
         return str(self.server_address[0])
@@ -4041,6 +4049,30 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         except ValueError as error:
             self._write_json({"error": str(error)}, status=400)
             return
+        surface = response.get("surface")
+        operation = response.get("operation")
+        requests = response.get("approval_requests")
+        if (
+            isinstance(surface, dict)
+            and surface.get("reason") == "attention-deferred"
+            and isinstance(operation, dict)
+            and isinstance(operation.get("operation_id"), str)
+            and isinstance(requests, list)
+        ):
+            typed_requests = [request for request in requests if _is_string_object_dict(request)]
+            first_url: str | None = None
+            for request in typed_requests:
+                candidate_url = request.get("approval_url")
+                if isinstance(candidate_url, str):
+                    first_url = candidate_url
+                    break
+            browser_url = build_approval_browser_url(first_url, auth_token=self.server.auth_token)  # type: ignore[attr-defined]
+            if browser_url is not None:
+                self.server.approval_attention.schedule(  # type: ignore[attr-defined]
+                    operation_id=str(operation["operation_id"]),
+                    requests=typed_requests,
+                    browser_url=browser_url,
+                )
         self._write_json(response)
 
     def _handle_operation_item(self, operation_id: str, payload: dict[str, object]) -> None:
@@ -5553,6 +5585,9 @@ class GuardDaemonServer:
             started_at=self._server.runtime_started_at,
             last_heartbeat_at=_now(),
         )
+        approval_attention = getattr(self._server, "approval_attention", None)
+        if approval_attention is not None:
+            approval_attention.start()
         self._start_watchdog()
         self._start_headless_cloud_sync()
         self._start_supply_chain_bundle_refresh()
@@ -5589,6 +5624,9 @@ class GuardDaemonServer:
 
     def _finish_service(self) -> None:
         self._shutdown_started.set()
+        approval_attention = getattr(self._server, "approval_attention", None)
+        if approval_attention is not None:
+            approval_attention.stop()
         self._command_queue_worker = stop_command_queue_worker(self._command_queue_worker)
         self._live_request_sync_worker = stop_cloud_sync_sync_worker(self._live_request_sync_worker)
         clear_guard_daemon_state_if_current(self._server.store.guard_home, pid=os.getpid(), port=self.port)

{plugin_scanner-2.0.1067 → plugin_scanner-2.0.1069}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/policy-workspace-page.js

@@ -1,4 +1,4 @@
-import { j as jsxRuntimeExports, S as SectionLabel, o as HiMiniXMark, B as Badge, ad as Tag, aB as HiMiniCommandLine, x as HiMiniExclamationTriangle, b6 as scopeLabel, h as harnessDisplayName, A as ActionButton, b7 as guardAwareHref, m as formatRelativeTime$1, b8 as HiMiniDocumentText, d as HiMiniCheckCircle, b9 as HiMiniCloudArrowUp, ba as HiMiniCheck, bb as HiMiniCodeBracket, bc as HiMiniClipboardDocument, bd as HiMiniUsers, aL as HiMiniBeaker, be as HiMiniFolder, Q as HiMiniLockClosed, l as HiMiniShieldCheck, bf as HiMiniInformationCircle, aT as HiMiniCloudArrowDown, aS as HiMiniArrowTopRightOnSquare, bg as HiMiniIdentification, bh as policyActionLabel, r as reactExports, bi as createCloudExceptionRequest, bj as HiMiniArrowRight, b as EmptyState, ae as HiMiniMagnifyingGlass, p as HiMiniChevronUp, q as HiMiniChevronDown, z as HiMiniChevronRight, bk as HiMiniPuzzlePiece, bl as HiMiniGlobeAlt, aJ as HiMiniClock, bm as fetchCloudExceptions, bn as fetchCloudExceptionRequests, bo as downloadBlob, bp as PolicyStatField, bq as PaginationControls, br as HiMiniNoSymbol, bs as HiMiniCube, ax as HiMiniArrowPath, t as HiMiniCloud, U as HiMiniAdjustmentsHorizontal, bt as HiMiniArrowDownTray, bu as HiMiniQueueList, y as HiMiniBolt, bv as HiMiniPlay, Z as fetchSettings, $ as updateSettings, b4 as WorkspacePageHeader, b5 as __vitePreload } from "../guard-dashboard.js";
+import { j as jsxRuntimeExports, S as SectionLabel, o as HiMiniXMark, B as Badge, ad as Tag, aB as HiMiniCommandLine, x as HiMiniExclamationTriangle, b6 as scopeLabel, h as harnessDisplayName, A as ActionButton, b7 as guardAwareHref, m as formatRelativeTime$1, b8 as HiMiniDocumentText, d as HiMiniCheckCircle, b9 as HiMiniCloudArrowUp, ba as HiMiniCheck, bb as HiMiniCodeBracket, bc as HiMiniClipboardDocument, bd as HiMiniUsers, aL as HiMiniBeaker, be as HiMiniFolder, R as HiMiniLockClosed, l as HiMiniShieldCheck, bf as HiMiniInformationCircle, aT as HiMiniCloudArrowDown, aS as HiMiniArrowTopRightOnSquare, bg as HiMiniIdentification, bh as policyActionLabel, r as reactExports, bi as createCloudExceptionRequest, bj as HiMiniArrowRight, b as EmptyState, ae as HiMiniMagnifyingGlass, p as HiMiniChevronUp, q as HiMiniChevronDown, z as HiMiniChevronRight, bk as HiMiniPuzzlePiece, bl as HiMiniGlobeAlt, aJ as HiMiniClock, bm as fetchCloudExceptions, bn as fetchCloudExceptionRequests, bo as downloadBlob, bp as PolicyStatField, bq as PaginationControls, br as HiMiniNoSymbol, bs as HiMiniCube, ax as HiMiniArrowPath, t as HiMiniCloud, U as HiMiniAdjustmentsHorizontal, bt as HiMiniArrowDownTray, bu as HiMiniQueueList, y as HiMiniBolt, bv as HiMiniPlay, Z as fetchSettings, $ as updateSettings, b4 as WorkspacePageHeader, b5 as __vitePreload } from "../guard-dashboard.js";
 const CLOUD_EXCEPTION_EXPIRING_SOON_DAYS = 7;
 function parseCloudExceptionTimestamp(value) {
   if (!value || !value.trim()) {