plugin-scanner 2.0.634__tar.gz → 2.0.636__tar.gz

{plugin_scanner-2.0.634 → plugin_scanner-2.0.636}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.634
+Version: 2.0.636
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.634 → plugin_scanner-2.0.636}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.634 → plugin_scanner-2.0.636}/dashboard/src/app.tsx

@@ -433,6 +433,7 @@ export function App() {
   const handleOpenInsights = useCallback(() => navigate("/evidence?view=insights"), [navigate]);
   const handleOpenSettings = useCallback(() => navigate("/settings"), []);
   const handleOpenSupplyChain = useCallback(() => navigate("/supply-chain"), []);
+  const handleOpenPolicy = useCallback(() => navigate("/policy"), []);
   const handleOpenHelp = useCallback(() => setHelpOpen(true), []);
   const handleCloseHelp = useCallback(() => setHelpOpen(false), []);
   const handleGoHome = useCallback(() => navigate("/"), []);
@@ -537,6 +538,15 @@ export function App() {
     }
   }, [setRuntime, setRequests, setPolicies]);
 
+  const handleRefreshPolicies = useCallback(async () => {
+    try {
+      const items = await fetchPolicies();
+      setPolicies({ kind: "ready", items });
+    } catch {
+      // Keep the current policy list when refresh fails.
+    }
+  }, []);
+
   const handleClearPolicy = useCallback(async (policy: GuardPolicyDecision) => {
     await clearPolicy(buildClearPayload(policy));
     const [inboxResult, policiesResult] = await Promise.allSettled([fetchInboxState(), fetchPolicies()]);
@@ -703,6 +713,41 @@ export function App() {
     );
   }, [view, appDetailHarness, runtime, receipts, policies, inventory, requests, handleGoHome, handleOpenRequest, handleClearAppPolicies, handleClearPolicy, refreshStateAfterAction]);
 
+  const policyContent = useMemo(() => {
+    if (runtime.kind !== "ready") {
+      return null;
+    }
+    if (policies.kind === "ready") {
+      return (
+        <Suspense fallback={<LazyFallback />}>
+          <PolicyWorkspacePage
+            snapshot={runtime.snapshot}
+            policies={policies.items}
+            onClearPolicy={handleClearPolicy}
+            onOpenSettings={handleOpenSettings}
+            onOpenInbox={handleOpenInbox}
+            onRefreshPolicies={handleRefreshPolicies}
+          />
+        </Suspense>
+      );
+    }
+    if (policies.kind === "error") {
+      return (
+        <div className="rounded-2xl border border-red-200 bg-red-50/80 px-4 py-3 text-sm text-red-700">
+          {policies.message}
+        </div>
+      );
+    }
+    return <LazyFallback />;
+  }, [
+    runtime,
+    policies,
+    handleClearPolicy,
+    handleOpenSettings,
+    handleOpenInbox,
+    handleRefreshPolicies,
+  ]);
+
   return (
     <>
       <a
@@ -792,7 +837,9 @@ export function App() {
 	              activeView={view}
 	              snapshot={runtime.snapshot}
 	              receipts={receipts.kind === "ready" ? receipts.items : []}
+	              policies={policies.kind === "ready" ? policies.items : []}
 	              approvalGate={approvalGate}
+	              onClearPolicy={handleClearPolicy}
 	              onOpenSettings={handleOpenSettings}
 	              onGoHome={handleGoHome}
               onNavigate={navigate}
@@ -801,19 +848,7 @@ export function App() {
           </Suspense>
         ) : null
       }
-      policyContent={
-        runtime.kind === "ready" ? (
-          <Suspense fallback={<LazyFallback />}>
-            <PolicyWorkspacePage
-              policies={policies.kind === "ready" ? policies.items : []}
-              snapshot={runtime.snapshot}
-              onClearPolicy={handleClearPolicy}
-              onOpenSettings={handleOpenSettings}
-              onOpenInbox={handleOpenInbox}
-            />
-          </Suspense>
-        ) : null
-      }
+      policyContent={policyContent}
       aboutContent={
         <Suspense fallback={<LazyFallback />}>
           <AboutWorkspace runtimeSummary={

{plugin_scanner-2.0.634 → plugin_scanner-2.0.636}/dashboard/src/guard-api.ts

@@ -1585,6 +1585,30 @@ export async function fetchPolicies(): Promise<GuardPolicyDecision[]> {
   return payload.items;
 }
 
+export async function savePolicyDecision(input: {
+  harness: string;
+  scope: DecisionScope;
+  action: string;
+  artifact_id?: string;
+  workspace?: string;
+  publisher?: string;
+  reason?: string;
+  approval_password?: string;
+  approval_totp_code?: string;
+}): Promise<{ saved: boolean }> {
+  if (isGuardDemoMode()) {
+    return { saved: true };
+  }
+  return readJson<{ saved: boolean }>("/v1/policy/decisions", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...guardAuthHeaders(),
+    },
+    body: JSON.stringify(input),
+  });
+}
+
 export async function clearPolicy(input: {
   harness?: string;
   all?: boolean;

plugin_scanner-2.0.636/dashboard/src/policy-exception-form.tsx

@@ -0,0 +1,369 @@
+import { useCallback, useMemo, useState } from "react";
+import type { ChangeEvent, FormEvent } from "react";
+import { HiMiniChevronLeft, HiMiniChevronRight } from "react-icons/hi2";
+import { ActionButton, SectionLabel } from "./approval-center-primitives";
+import { harnessDisplayName } from "./approval-center-utils";
+import { savePolicyDecision } from "./guard-api";
+import type { DecisionScope, GuardPolicyDecision } from "./guard-types";
+
+const ACTION_FAMILIES = [
+  { id: "package-request", label: "Package installs", example: "npm, pip, pnpm installs" },
+  { id: "tool-action", label: "Shell and tool commands", example: "terminal commands agents run" },
+  { id: "tool-output", label: "Command output", example: "reading prior command output" },
+  { id: "prompt", label: "Prompt submissions", example: "prompts sent to the model" },
+  { id: "file-read", label: "File reads", example: "reading local files" },
+] as const;
+
+const RESPONSE_OPTIONS = [
+  { id: "warn", label: "Warn me", description: "Show a warning but still allow unless I block it." },
+  { id: "require-reapproval", label: "Require review each time", description: "Never auto-allow; always ask in Inbox." },
+  { id: "block", label: "Block", description: "Stop this action type in the chosen scope." },
+  { id: "allow", label: "Allow", description: "Skip future prompts for this action in the chosen scope." },
+] as const;
+
+const SCOPE_OPTIONS: Array<{ value: DecisionScope; label: string; description: string }> = [
+  { value: "workspace", label: "This project", description: "Same action in the current project folder." },
+  { value: "harness", label: "This app", description: "Matching actions anywhere in the selected app." },
+  { value: "artifact", label: "One specific action", description: "Only the exact fingerprint you provide." },
+];
+
+type PolicyExceptionFormProps = {
+  policies: GuardPolicyDecision[];
+  onSaved: () => void;
+  onCancel: () => void;
+};
+
+type FormStep = "app" | "action" | "response" | "review";
+
+export function PolicyExceptionForm({ policies, onSaved, onCancel }: PolicyExceptionFormProps) {
+  const [step, setStep] = useState<FormStep>("app");
+  const [harness, setHarness] = useState("");
+  const [family, setFamily] = useState<string>(ACTION_FAMILIES[0].id);
+  const [scope, setScope] = useState<DecisionScope>("workspace");
+  const [response, setResponse] = useState<string>("warn");
+  const [reason, setReason] = useState("");
+  const [artifactId, setArtifactId] = useState("");
+  const [workspace, setWorkspace] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const harnessOptions = useMemo(() => {
+    const fromPolicies = policies.map((policy) => policy.harness).filter(Boolean);
+    const defaults = ["codex", "cursor", "claude-code", "opencode", "copilot", "kimi"];
+    return [...new Set([...fromPolicies, ...defaults])].sort();
+  }, [policies]);
+
+  const workspaceOptions = useMemo(() => {
+    const fromPolicies = policies
+      .map((policy) => policy.workspace)
+      .filter((value): value is string => Boolean(value?.trim()));
+    return [...new Set(fromPolicies)].sort();
+  }, [policies]);
+
+  const handleWorkspaceSelect = useCallback((event: ChangeEvent<HTMLSelectElement>) => {
+    setWorkspace(event.target.value);
+  }, []);
+
+  const handleHarnessChange = useCallback((event: ChangeEvent<HTMLSelectElement>) => {
+    setHarness(event.target.value);
+  }, []);
+
+  const handleReasonChange = useCallback((event: ChangeEvent<HTMLTextAreaElement>) => {
+    setReason(event.target.value);
+  }, []);
+
+  const handleArtifactChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setArtifactId(event.target.value);
+  }, []);
+
+  const handleWorkspaceChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setWorkspace(event.target.value);
+  }, []);
+
+  const resolvedArtifactId = useMemo(() => {
+    if (scope === "artifact") {
+      return artifactId.trim() || null;
+    }
+    return `family:${family}`;
+  }, [scope, artifactId, family]);
+
+  const canContinue = useMemo(() => {
+    if (step === "app") {
+      return harness.trim().length > 0;
+    }
+    if (step === "action") {
+      return family.trim().length > 0;
+    }
+    if (step === "response") {
+      if (scope === "artifact" && !artifactId.trim()) {
+        return false;
+      }
+      if (scope === "workspace" && !workspace.trim()) {
+        return false;
+      }
+      return response.trim().length > 0 && reason.trim().length > 0;
+    }
+    return true;
+  }, [step, harness, family, scope, artifactId, workspace, response, reason]);
+
+  const handleBack = useCallback(() => {
+    setError(null);
+    if (step === "action") {
+      setStep("app");
+      return;
+    }
+    if (step === "response") {
+      setStep("action");
+      return;
+    }
+    if (step === "review") {
+      setStep("response");
+    }
+  }, [step]);
+
+  const handleNext = useCallback(() => {
+    setError(null);
+    if (step === "app") {
+      setStep("action");
+      return;
+    }
+    if (step === "action") {
+      setStep("response");
+      return;
+    }
+    if (step === "response") {
+      setStep("review");
+    }
+  }, [step]);
+
+  const handleSubmit = useCallback(
+    async (event: FormEvent) => {
+      event.preventDefault();
+      if (!resolvedArtifactId) {
+        setError("Choose what this exception should apply to.");
+        return;
+      }
+      setSubmitting(true);
+      setError(null);
+      try {
+        await savePolicyDecision({
+          harness,
+          scope,
+          action: response,
+          artifact_id: resolvedArtifactId,
+          workspace: scope === "workspace" ? workspace.trim() : undefined,
+          reason: reason.trim(),
+        });
+        onSaved();
+      } catch (submitError) {
+        const message = submitError instanceof Error ? submitError.message : "Could not save this exception.";
+        setError(message);
+      } finally {
+        setSubmitting(false);
+      }
+    },
+    [harness, scope, response, resolvedArtifactId, workspace, reason, onSaved],
+  );
+
+  const familyLabel = ACTION_FAMILIES.find((item) => item.id === family)?.label ?? family;
+  const responseLabel = RESPONSE_OPTIONS.find((item) => item.id === response)?.label ?? response;
+  const scopeLabelText = SCOPE_OPTIONS.find((item) => item.value === scope)?.label ?? scope;
+
+  return (
+    <form onSubmit={handleSubmit} className="rounded-2xl border border-brand-blue/15 bg-white p-5 shadow-sm space-y-5">
+      <div>
+        <SectionLabel>Create exception</SectionLabel>
+        <p className="mt-1 text-sm text-slate-600">
+          Tell Guard how to treat a class of actions before they run. You can change or remove exceptions later.
+        </p>
+      </div>
+
+      {step === "app" ? (
+        <div className="space-y-2">
+          <label htmlFor="exception-harness" className="text-sm font-medium text-brand-dark">
+            Which app should this apply to?
+          </label>
+          <select
+            id="exception-harness"
+            value={harness}
+            onChange={handleHarnessChange}
+            className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2.5 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+          >
+            <option value="">Select an app</option>
+            {harnessOptions.map((option) => (
+              <option key={option} value={option}>
+                {harnessDisplayName(option)}
+              </option>
+            ))}
+          </select>
+        </div>
+      ) : null}
+
+      {step === "action" ? (
+        <div className="space-y-3">
+          <p className="text-sm font-medium text-brand-dark">What kind of action?</p>
+          <div className="grid gap-2 sm:grid-cols-2">
+            {ACTION_FAMILIES.map((option) => (
+              <button
+                key={option.id}
+                type="button"
+                onClick={() => setFamily(option.id)}
+                aria-pressed={family === option.id}
+                className={`rounded-xl border px-3 py-3 text-left transition-colors ${
+                  family === option.id
+                    ? "border-brand-blue bg-brand-blue/[0.06]"
+                    : "border-slate-200 hover:border-slate-300"
+                }`}
+              >
+                <p className="text-sm font-semibold text-brand-dark">{option.label}</p>
+                <p className="mt-0.5 text-xs text-slate-500">{option.example}</p>
+              </button>
+            ))}
+          </div>
+        </div>
+      ) : null}
+
+      {step === "response" ? (
+        <div className="space-y-4">
+          <div className="space-y-2">
+            <p className="text-sm font-medium text-brand-dark">How far should this reach?</p>
+            <div className="grid gap-2">
+              {SCOPE_OPTIONS.map((option) => (
+                <button
+                  key={option.value}
+                  type="button"
+                  onClick={() => setScope(option.value)}
+                  aria-pressed={scope === option.value}
+                  className={`rounded-xl border px-3 py-2.5 text-left ${
+                    scope === option.value ? "border-brand-blue bg-brand-blue/[0.06]" : "border-slate-200"
+                  }`}
+                >
+                  <p className="text-sm font-semibold text-brand-dark">{option.label}</p>
+                  <p className="text-xs text-slate-500">{option.description}</p>
+                </button>
+              ))}
+            </div>
+          </div>
+
+          {scope === "workspace" ? (
+            <div className="space-y-1.5">
+              <label htmlFor="exception-workspace" className="text-sm font-medium text-brand-dark">
+                Which project folder?
+              </label>
+              {workspaceOptions.length > 0 ? (
+                <select
+                  id="exception-workspace"
+                  value={workspace}
+                  onChange={handleWorkspaceSelect}
+                  className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2.5 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+                >
+                  <option value="">Select a remembered project</option>
+                  {workspaceOptions.map((option) => (
+                    <option key={option} value={option}>
+                      {option.startsWith("workspace:") ? "This project (from a prior approval)" : option}
+                    </option>
+                  ))}
+                </select>
+              ) : (
+                <input
+                  id="exception-workspace"
+                  type="text"
+                  value={workspace}
+                  onChange={handleWorkspaceChange}
+                  placeholder="/path/to/your/project"
+                  className="w-full rounded-xl border border-slate-200 px-3 py-2.5 text-sm focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+                />
+              )}
+              <p className="text-xs text-slate-500">
+                Guard matches the project folder where the agent runs. Pick one from your remembered rules, or paste a path.
+              </p>
+            </div>
+          ) : null}
+
+          {scope === "artifact" ? (
+            <div className="space-y-1.5">
+              <label htmlFor="exception-artifact" className="text-sm font-medium text-brand-dark">
+                Exact artifact id (from Inbox or Evidence)
+              </label>
+              <input
+                id="exception-artifact"
+                type="text"
+                value={artifactId}
+                onChange={handleArtifactChange}
+                placeholder="codex:project:tool-action:..."
+                className="w-full rounded-xl border border-slate-200 px-3 py-2.5 font-mono text-xs focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+              />
+            </div>
+          ) : null}
+
+          <div className="space-y-2">
+            <p className="text-sm font-medium text-brand-dark">What should Guard do?</p>
+            <div className="grid gap-2 sm:grid-cols-2">
+              {RESPONSE_OPTIONS.map((option) => (
+                <button
+                  key={option.id}
+                  type="button"
+                  onClick={() => setResponse(option.id)}
+                  aria-pressed={response === option.id}
+                  className={`rounded-xl border px-3 py-2.5 text-left ${
+                    response === option.id ? "border-brand-blue bg-brand-blue/[0.06]" : "border-slate-200"
+                  }`}
+                >
+                  <p className="text-sm font-semibold text-brand-dark">{option.label}</p>
+                  <p className="text-xs text-slate-500">{option.description}</p>
+                </button>
+              ))}
+            </div>
+          </div>
+
+          <div className="space-y-1.5">
+            <label htmlFor="exception-reason" className="text-sm font-medium text-brand-dark">
+              Why are you adding this?
+            </label>
+            <textarea
+              id="exception-reason"
+              value={reason}
+              onChange={handleReasonChange}
+              rows={3}
+              placeholder="Example: Always warn before package installs in this repo."
+              className="w-full rounded-xl border border-slate-200 px-3 py-2.5 text-sm focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+            />
+          </div>
+        </div>
+      ) : null}
+
+      {step === "review" ? (
+        <div className="rounded-xl border border-slate-100 bg-slate-50/80 px-4 py-3 text-sm text-brand-dark space-y-2">
+          <p>
+            <span className="font-semibold">{responseLabel}</span> {familyLabel.toLowerCase()} in{" "}
+            <span className="font-semibold">{harnessDisplayName(harness)}</span> ({scopeLabelText.toLowerCase()}).
+          </p>
+          <p className="text-slate-600">{reason.trim()}</p>
+        </div>
+      ) : null}
+
+      {error ? <p className="text-sm text-red-600">{error}</p> : null}
+
+      <div className="flex flex-wrap items-center justify-between gap-2 pt-1">
+        <ActionButton variant="secondary" type="button" onClick={step === "app" ? onCancel : handleBack}>
+          {step === "app" ? "Cancel" : (
+            <>
+              <HiMiniChevronLeft className="mr-1 h-4 w-4" aria-hidden="true" />
+              Back
+            </>
+          )}
+        </ActionButton>
+        {step === "review" ? (
+          <ActionButton variant="primary" type="submit" disabled={submitting}>
+            {submitting ? "Saving…" : "Save exception"}
+          </ActionButton>
+        ) : (
+          <ActionButton variant="primary" type="button" onClick={handleNext} disabled={!canContinue}>
+            Continue
+            <HiMiniChevronRight className="ml-1 h-4 w-4" aria-hidden="true" />
+          </ActionButton>
+        )}
+      </div>
+    </form>
+  );
+}

plugin_scanner-2.0.636/dashboard/src/policy-workspace-helpers.test.ts

@@ -0,0 +1,106 @@
+import type { GuardPolicyDecision } from "./guard-types";
+import {
+  resolvePolicyDisplay,
+  resolvePolicyEvidenceHref,
+  resolvePolicyMatcherFamily,
+  resolveWorkspaceLabel,
+} from "./policy-workspace-helpers";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const basePolicy = (overrides: Partial<GuardPolicyDecision>): GuardPolicyDecision => ({
+  harness: "opencode",
+  scope: "workspace",
+  artifact_id: "opencode:project:package-request:62de981049ed20f850ae2bb52a9aaa2820c6d9be809592ec0c4b3d207b83f9b6",
+  workspace: "workspace:c188b6362f81cac126242642b9d7baaa7026c681d5c5ea9e4cc92df615049faf",
+  publisher: null,
+  action: "allow",
+  reason: "approved in review",
+  source: "local",
+  updated_at: "2026-06-11T12:00:00.000Z",
+  ...overrides,
+});
+
+const workspacePackageRule = basePolicy({});
+const display = resolvePolicyDisplay(workspacePackageRule);
+
+assert(
+  !display.headline.includes("62de9810"),
+  "POL-H1: headline must not expose artifact hash ids",
+);
+assert(
+  !display.headline.includes("workspace:c188"),
+  "POL-H2: headline must not expose workspace hash ids",
+);
+assert(
+  display.headline.toLowerCase().includes("package install"),
+  "POL-H3: workspace package rule headline names the action family",
+);
+assert(
+  display.subtitle.includes("this project"),
+  "POL-H4: workspace scope subtitle uses plain project language",
+);
+
+const familyHarnessRule = resolvePolicyDisplay(
+  basePolicy({
+    scope: "harness",
+    artifact_id: "family:package-request",
+    workspace: null,
+    harness: "opencode",
+  }),
+);
+assert(
+  familyHarnessRule.headline.toLowerCase().includes("all package install"),
+  "POL-H5: harness family rule explains breadth in plain language",
+);
+
+const meaningfulReason = resolvePolicyDisplay(
+  basePolicy({
+    reason: "Install locked portal dependencies in isolated worktree for Guard connect-flow validation.",
+    scope: "artifact",
+  }),
+);
+assert(
+  meaningfulReason.headline.includes("Install locked portal dependencies"),
+  "POL-H6: meaningful approval reason becomes the headline",
+);
+
+const runtimeRule = resolvePolicyDisplay(
+  basePolicy({
+    scope: "artifact",
+    artifact_id: "opencode:runtime:global:chrome-devtools:navigate_page",
+    reason: "approved in review",
+  }),
+);
+assert(
+  runtimeRule.headline.toLowerCase().includes("chrome devtools"),
+  "POL-H7: runtime actions get readable tool labels",
+);
+
+assert(
+  resolveWorkspaceLabel("workspace:c188b6362f81cac126242642b9d7baaa7026c681d5c5ea9e4cc92df615049faf") ===
+    "this project",
+  "POL-H8: workspace hash labels collapse to this project",
+);
+
+assert(
+  resolvePolicyMatcherFamily(basePolicy({ artifact_id: "family:tool-action" })) === "tool-action",
+  "POL-H9: family matcher ids parse correctly",
+);
+
+const evidenceHref = resolvePolicyEvidenceHref(
+  basePolicy({
+    artifact_hash: "sha256:62de981049ed20f850ae2bb52a9aaa2820c6d9be809592ec0c4b3d207b83f9b6",
+  }),
+);
+assert(
+  evidenceHref.includes("search=62de981049ed"),
+  "POL-H10: evidence link uses short hash prefix search",
+);
+assert(!evidenceHref.includes("harness="), "POL-H11: evidence link does not over-filter by harness");
+
+console.log("policy-workspace-helpers.test.ts: all assertions passed");