plugin-scanner 2.0.659__tar.gz → 2.0.661__tar.gz

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.659
+Version: 2.0.661
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/dashboard/src/policy-cloud-exceptions-boundary.test.ts

@@ -56,7 +56,7 @@ const POLICY_SLICE_MARKERS = [
 ];
 
 // Phase 1 removes local exception authoring. Flip this flag in that PR.
-const PHASE0_EXPECT_LOCAL_EXCEPTION_AUTHORING = true;
+const PHASE0_EXPECT_LOCAL_EXCEPTION_AUTHORING = false;
 
 const primitivesSource = readDashboardSource("approval-center-primitives.tsx");
 for (const label of EXPECTED_SIDEBAR_LABELS) {

plugin_scanner-2.0.661/dashboard/src/policy-cloud-exceptions-ia.test.tsx

@@ -0,0 +1,32 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { resolvePolicyViewLabel } from "./policy-workspace";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+assert(resolvePolicyViewLabel("exceptions") === "Cloud exceptions", "exceptions view label is Cloud exceptions");
+assert(resolvePolicyViewLabel("rules") === "Remembered rules", "rules view label unchanged");
+
+const workspaceSource = readFileSync(join(here, "policy-workspace.tsx"), "utf8");
+const tabSource = readFileSync(join(here, "policy-cloud-exceptions-tab.tsx"), "utf8");
+const pageSource = readFileSync(join(here, "policy-workspace-page.tsx"), "utf8");
+const sidebarSource = readFileSync(join(here, "approval-center-primitives.tsx"), "utf8");
+
+assert(!workspaceSource.includes("PolicyExceptionForm"), "policy workspace no longer mounts PolicyExceptionForm");
+assert(!workspaceSource.includes("New exception"), "policy workspace removes local New exception copy");
+assert(tabSource.includes("Request cloud exception"), "cloud exceptions tab exposes request CTA");
+assert(tabSource.includes("Open Guard Cloud"), "cloud exceptions tab exposes Open Guard Cloud CTA");
+assert(tabSource.includes("Guard Cloud is not connected"), "disconnected Cloud copy present");
+assert(!pageSource.includes("add custom exceptions"), "page header removes local exception authoring copy");
+assert(!workspaceSource.includes("bypass"), "policy workspace removes bypass copy");
+assert(sidebarSource.includes('label: "Policy"'), "sidebar Policy label unchanged");
+
+console.log("policy-cloud-exceptions-ia.test.ts: all assertions passed");

plugin_scanner-2.0.661/dashboard/src/policy-cloud-exceptions-tab.tsx

@@ -0,0 +1,91 @@
+import { useCallback } from "react";
+import { HiMiniCloudArrowUp } from "react-icons/hi2";
+import { ActionButton, EmptyState, SectionLabel } from "./approval-center-primitives";
+import type { GuardRuntimeSnapshot } from "./guard-types";
+import { resolveCloudPolicyControlsUrl } from "./policy-workspace-helpers";
+
+type PolicyCloudExceptionsTabProps = {
+  snapshot: GuardRuntimeSnapshot;
+  onRequestCloudException?: () => void;
+};
+
+function resolveCloudExceptionsConnected(snapshot: GuardRuntimeSnapshot): boolean {
+  return snapshot.cloud_state === "paired_active" || snapshot.cloud_state === "paired_waiting";
+}
+
+export function PolicyCloudExceptionsTab({
+  snapshot,
+  onRequestCloudException,
+}: PolicyCloudExceptionsTabProps) {
+  const cloudControlsUrl = resolveCloudPolicyControlsUrl(snapshot);
+  const cloudConnected = resolveCloudExceptionsConnected(snapshot);
+  const connectUrl = snapshot.connect_url?.trim() || null;
+
+  const handleRequestCloudException = useCallback(() => {
+    onRequestCloudException?.();
+  }, [onRequestCloudException]);
+
+  return (
+    <div className="space-y-4">
+      <div className="rounded-2xl border border-brand-blue/10 bg-brand-blue/[0.03] p-5 shadow-sm">
+        <SectionLabel>Cloud risk acceptances</SectionLabel>
+        <p className="mt-2 text-sm text-brand-dark/75">
+          Cloud exceptions are governed risk acceptances with an owner, approver, reason, expiry, and
+          signed bundle. They are managed in Guard Cloud and synced to this device after approval.
+        </p>
+        <p className="mt-2 text-sm text-slate-600">
+          Fast remembered approvals from Review stay on the Remembered rules tab. They are separate
+          from Cloud exceptions.
+        </p>
+      </div>
+
+      <div className="flex flex-wrap items-center gap-2">
+        <ActionButton
+          variant="primary"
+          onClick={handleRequestCloudException}
+          disabled={!cloudConnected || onRequestCloudException === undefined}
+        >
+          Request cloud exception
+        </ActionButton>
+        {cloudControlsUrl ? (
+          <ActionButton href={cloudControlsUrl} variant="secondary">
+            <HiMiniCloudArrowUp className="mr-1.5 h-4 w-4" aria-hidden="true" />
+            Open Guard Cloud
+          </ActionButton>
+        ) : null}
+        {!cloudConnected && connectUrl ? (
+          <ActionButton href={connectUrl} variant="secondary">
+            Connect Guard Cloud
+          </ActionButton>
+        ) : null}
+      </div>
+
+      {!cloudConnected ? (
+        <EmptyState
+          title="Guard Cloud is not connected"
+          body="Cloud exceptions are managed in Guard Cloud. Connect this device to request a risk acceptance or view synced exceptions here."
+          tone="teach"
+        />
+      ) : (
+        <EmptyState
+          title="No Cloud exceptions synced yet"
+          body="Approved Cloud risk acceptances will appear here after Guard Cloud syncs a signed policy bundle to this device."
+          tone="teach"
+        />
+      )}
+    </div>
+  );
+}
+
+export function PolicyRememberedRulesHelper() {
+  return (
+    <div className="rounded-2xl border border-slate-200 bg-slate-50/80 p-4 text-sm text-slate-600">
+      <p className="font-medium text-brand-dark">Remembered approvals vs Cloud exceptions</p>
+      <ul className="mt-2 list-disc space-y-1 pl-5">
+        <li>Review and Inbox keep fast allow/block decisions for the work in front of you.</li>
+        <li>Remembered rules on this tab explain what Guard will do next time for matching actions.</li>
+        <li>Cloud exceptions are separate governed risk acceptances managed in Guard Cloud.</li>
+      </ul>
+    </div>
+  );
+}

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/dashboard/src/policy-workspace-page.tsx

@@ -27,7 +27,7 @@ export function PolicyWorkspacePage(props: {
       <WorkspacePageHeader
         eyebrow="Policy"
         title="Remembered rules and exceptions"
-        description="See what Guard will do next time, in plain language. Remove local rules or add custom exceptions here."
+        description="See what Guard will do next time, in plain language. Remove local remembered rules here or request Cloud exceptions when Guard Cloud is connected."
       />
       <Suspense fallback={<PolicyFallback />}>
         <PolicyWorkspace

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/dashboard/src/policy-workspace.tsx

@@ -1,10 +1,13 @@
 import { useCallback, useMemo, useState } from "react";
 import type { ChangeEvent } from "react";
-import { HiMiniMagnifyingGlass, HiMiniCloudArrowUp, HiMiniPlus } from "react-icons/hi2";
-import { SectionLabel, Tag, ActionButton, EmptyState } from "./approval-center-primitives";
+import { HiMiniMagnifyingGlass } from "react-icons/hi2";
+import { SectionLabel, Tag, ActionButton } from "./approval-center-primitives";
 import { harnessDisplayName, policyActionLabel } from "./approval-center-utils";
 import type { GuardPolicyDecision, GuardRuntimeSnapshot } from "./guard-types";
-import { PolicyExceptionForm } from "./policy-exception-form";
+import {
+  PolicyCloudExceptionsTab,
+  PolicyRememberedRulesHelper,
+} from "./policy-cloud-exceptions-tab";
 import {
   isCloudManagedPolicy,
   resolveCloudBundleSurfaceClass,
@@ -16,19 +19,18 @@ import {
 } from "./policy-workspace-helpers";
 import {
   GroupedPolicySection,
-  PolicyRuleList,
   resolveFamilyFilterLabel,
   groupPoliciesByFamily,
 } from "./policy-workspace-views";
 
 export type PolicyPageView = "rules" | "exceptions" | "strict";
 
-function resolvePolicyViewLabel(view: PolicyPageView): string {
+export function resolvePolicyViewLabel(view: PolicyPageView): string {
   if (view === "rules") {
     return "Remembered rules";
   }
   if (view === "exceptions") {
-    return "Exceptions";
+    return "Cloud exceptions";
   }
   return "Strict config";
 }
@@ -54,13 +56,11 @@ export function PolicyWorkspace({
   onClearPolicy,
   onOpenSettings,
   onOpenInbox,
-  onRefreshPolicies,
 }: PolicyWorkspaceProps) {
   const [activeView, setActiveView] = useState<PolicyPageView>("rules");
   const [searchQuery, setSearchQuery] = useState("");
   const [appFilter, setAppFilter] = useState("");
   const [familyFilter, setFamilyFilter] = useState("");
-  const [showExceptionForm, setShowExceptionForm] = useState(false);
 
   const handleSearchChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
     setSearchQuery(event.target.value);
@@ -68,24 +68,17 @@ export function PolicyWorkspace({
 
   const handleViewChange = useCallback((view: PolicyPageView) => {
     setActiveView(view);
-    setShowExceptionForm(false);
-  }, []);
-
-  const handleOpenExceptionForm = useCallback(() => {
-    setShowExceptionForm(true);
   }, []);
 
-  const handleCloseExceptionForm = useCallback(() => {
-    setShowExceptionForm(false);
-  }, []);
+  const cloudControlsUrl = useMemo(() => resolveCloudPolicyControlsUrl(snapshot), [snapshot]);
 
-  const handleExceptionSaved = useCallback(() => {
-    setShowExceptionForm(false);
-    onRefreshPolicies?.();
-  }, [onRefreshPolicies]);
+  const handleRequestCloudException = useCallback(() => {
+    if (cloudControlsUrl) {
+      window.open(cloudControlsUrl, "_blank", "noopener,noreferrer");
+    }
+  }, [cloudControlsUrl]);
 
   const modeCopy = useMemo(() => resolveSecurityModeCopy(snapshot.security_level), [snapshot.security_level]);
-  const cloudControlsUrl = useMemo(() => resolveCloudPolicyControlsUrl(snapshot), [snapshot]);
   const cloudBundleCopy = useMemo(() => resolveCloudPolicyBundleCopy(snapshot), [snapshot]);
 
   const filteredPolicies = useMemo(() => {
@@ -141,14 +134,6 @@ export function PolicyWorkspace({
     [rememberedRules],
   );
 
-  const exceptionPolicies = useMemo(
-    () =>
-      filteredPolicies
-        .filter((policy) => policy.action !== "allow" && policy.action !== "block")
-        .sort((a, b) => new Date(b.updated_at || 0).getTime() - new Date(a.updated_at || 0).getTime()),
-    [filteredPolicies],
-  );
-
   const appOptions = useMemo(
     () => [...new Set(policies.map((policy) => policy.harness).filter(Boolean))].sort(),
     [policies],
@@ -202,6 +187,7 @@ export function PolicyWorkspace({
 
       {activeView === "rules" ? (
         <div className="space-y-4">
+          <PolicyRememberedRulesHelper />
           <div className="flex flex-col gap-3 lg:flex-row lg:items-center lg:justify-between">
             <div className="flex flex-1 items-center gap-1.5 rounded-xl border border-slate-200 bg-white px-3 py-2">
               <HiMiniMagnifyingGlass className="h-4 w-4 shrink-0 text-slate-400" aria-hidden="true" />
@@ -267,55 +253,7 @@ export function PolicyWorkspace({
       ) : null}
 
       {activeView === "exceptions" ? (
-        <div className="space-y-4">
-          <div className="flex flex-wrap items-center justify-between gap-3">
-            <p className="text-sm text-slate-600">
-              Exceptions change how Guard responds (warn, require review, block, or allow) without waiting for Inbox.
-            </p>
-            {!showExceptionForm ? (
-              <ActionButton variant="primary" onClick={handleOpenExceptionForm}>
-                <HiMiniPlus className="mr-1.5 h-4 w-4" aria-hidden="true" />
-                New exception
-              </ActionButton>
-            ) : null}
-          </div>
-
-          {showExceptionForm ? (
-            <PolicyExceptionForm
-              policies={policies}
-              onSaved={handleExceptionSaved}
-              onCancel={handleCloseExceptionForm}
-            />
-          ) : null}
-
-          {exceptionPolicies.length === 0 && !showExceptionForm ? (
-            <EmptyState
-              title="No exceptions yet"
-              body="Create one when you want Guard to warn, always review, block, or allow a whole class of actions."
-              tone="teach"
-            />
-          ) : (
-            <PolicyRuleList
-              policies={exceptionPolicies}
-              cloudControlsUrl={cloudControlsUrl}
-              onClearPolicy={onClearPolicy}
-              emptyTitle="No active exceptions"
-              emptyBody="Saved warn, review, and custom rules appear here."
-            />
-          )}
-
-          {cloudControlsUrl ? (
-            <a
-              href={cloudControlsUrl}
-              target="_blank"
-              rel="noopener noreferrer"
-              className="inline-flex items-center gap-1 text-sm font-medium text-brand-blue hover:underline"
-            >
-              <HiMiniCloudArrowUp className="h-4 w-4" aria-hidden="true" />
-              Manage team exceptions in Guard Cloud
-            </a>
-          ) : null}
-        </div>
+        <PolicyCloudExceptionsTab snapshot={snapshot} onRequestCloudException={handleRequestCloudException} />
       ) : null}
 
       {activeView === "strict" ? (

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.659"
+version = "2.0.661"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.659"
+version = "2.0.661"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 from ._commands_shared import *
 from .commands_parser_helpers import *
+from ..runtime.command_queue import command_queue_status
 
 def _run_guard_login_command(
     args: argparse.Namespace,
@@ -428,9 +429,28 @@ def _run_guard_daemon_command(
     _emit("doctor", {"daemon_url": f"http://127.0.0.1:{daemon.port}"}, getattr(args, "json", False))
     return 0
 
+def _run_guard_commands_command(
+    args: argparse.Namespace,
+    *,
+    guard_home: Path | None = None,
+    workspace: Path | None = None,
+    context: HarnessContext | None = None,
+    store: GuardStore | None = None,
+    config: GuardConfig | None = None,
+    input_text: str | None = None,
+    output_stream: TextIO | None = None,
+) -> int:
+    commands_command = getattr(args, "commands_command", None)
+    if commands_command == "status":
+        _emit("commands", command_queue_status(store), getattr(args, "json", False))
+        return 0
+    print("commands subcommand is required", file=sys.stderr)
+    return 2
+
 __all__ = [
     "_run_guard_bridge_command",
     "_run_guard_cloud_command",
+    "_run_guard_commands_command",
     "_run_guard_connect_command",
     "_run_guard_daemon_command",
     "_run_guard_device_command",

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/cli/commands_parser.py

@@ -50,7 +50,7 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
             "{start,status,dashboard,init,apps,bootstrap,detect,install,update,uninstall,package-shims,run,protect,preflight,scan,diff,"
             "receipts,inventory,abom,aibom,approvals,explain,allow,deny,policies,exceptions,advisories,events,doctor,connect,"
             "remote-pair,disconnect,"
-            "login,sync,device,bridge}"
+            "login,sync,device,commands,bridge}"
         ),
     )
     _configure_guard_local_parsers(guard_subparsers)

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/cli/commands_parser_cloud.py

@@ -104,6 +104,23 @@ def _configure_guard_cloud_parsers(
     sync_parser.add_argument("--guard-home")
     sync_parser.add_argument("--json", action="store_true")
 
+    commands_parser = guard_subparsers.add_parser(
+        "commands",
+        help="Inspect Guard Cloud command queue state",
+    )
+    _add_guard_common_args(commands_parser)
+    commands_subparsers = commands_parser.add_subparsers(
+        dest="commands_command",
+        required=True,
+        parser_class=FriendlyArgumentParser,
+    )
+    commands_status_parser = commands_subparsers.add_parser(
+        "status",
+        help="Show local Guard Cloud command queue status",
+    )
+    _add_guard_common_args(commands_status_parser)
+    commands_status_parser.add_argument("--json", action="store_true")
+
     cloud_parser = guard_subparsers.add_parser(
         "cloud",
         help="Sync Guard Cloud supply-chain intelligence and diagnostics",

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/cli/commands_router.py

@@ -62,6 +62,7 @@ _COMMON_HANDLERS = {
     "supply-chain": "_run_guard_supply_chain_command",
     "service": "_run_guard_service_command",
     "device": "_run_guard_device_command",
+    "commands": "_run_guard_commands_command",
     "daemon": "_run_guard_daemon_command",
     "hook": "_run_guard_hook_command",
 }

plugin_scanner-2.0.661/src/codex_plugin_scanner/guard/daemon/command_queue_worker.py

@@ -0,0 +1,47 @@
+"""Daemon lifecycle helpers for the Guard Cloud command queue poller."""
+
+from __future__ import annotations
+
+import threading
+from dataclasses import dataclass
+
+from ..runtime.command_queue import command_queue_enabled, command_queue_loop, default_command_context
+from ..store import GuardStore
+
+_COMMAND_QUEUE_THREAD_JOIN_TIMEOUT_SECONDS = 100
+
+
+@dataclass
+class CommandQueueWorker:
+    thread: threading.Thread
+    stop_event: threading.Event
+
+
+def start_command_queue_worker(
+    store: GuardStore,
+    existing: CommandQueueWorker | None = None,
+) -> CommandQueueWorker | None:
+    if not command_queue_enabled():
+        return existing if existing is not None and existing.thread.is_alive() else None
+    if existing is not None and existing.thread.is_alive() and not existing.stop_event.is_set():
+        return existing
+    stop_event = threading.Event()
+    thread = threading.Thread(
+        target=command_queue_loop,
+        kwargs={
+            "store": store,
+            "context": default_command_context(store),
+            "stop_event": stop_event,
+        },
+        daemon=True,
+    )
+    thread.start()
+    return CommandQueueWorker(thread=thread, stop_event=stop_event)
+
+
+def stop_command_queue_worker(worker: CommandQueueWorker | None) -> CommandQueueWorker | None:
+    if worker is None:
+        return None
+    worker.stop_event.set()
+    worker.thread.join(timeout=_COMMAND_QUEUE_THREAD_JOIN_TIMEOUT_SECONDS)
+    return worker if worker.thread.is_alive() else None

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -142,6 +142,7 @@ from ..store_evidence import (
     export_evidence_json,
     list_evidence,
 )
+from .command_queue_worker import CommandQueueWorker, start_command_queue_worker, stop_command_queue_worker
 from .dashboard_update import merge_dashboard_update_progress, schedule_guard_dashboard_update
 from .manager import (
     GUARD_DAEMON_COMPATIBILITY_VERSION,
@@ -4719,6 +4720,7 @@ class GuardDaemonServer:
         self._bundle_refresh_backoff_seconds = bundle_refresh_backoff_seconds
         self._bundle_refresh_interval_seconds = bundle_refresh_interval_seconds
         self._bundle_refresh_thread: threading.Thread | None = None
+        self._command_queue_worker: CommandQueueWorker | None = None
         self._thread: threading.Thread | None = None
         self._watchdog_thread: threading.Thread | None = None
         self._shutdown_started = threading.Event()
@@ -4748,6 +4750,7 @@ class GuardDaemonServer:
         if self._bundle_refresh_thread is not None:
             self._bundle_refresh_thread.join(timeout=5)
             self._bundle_refresh_thread = None
+        self._command_queue_worker = stop_command_queue_worker(self._command_queue_worker)
 
     def _begin_service(self) -> None:
         self._shutdown_started.clear()
@@ -4762,6 +4765,7 @@ class GuardDaemonServer:
         )
         self._start_watchdog()
         self._start_supply_chain_bundle_refresh()
+        self._command_queue_worker = start_command_queue_worker(self._server.store, self._command_queue_worker)
 
     def _serve_forever(self) -> None:
         try:

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/audit-workspace.js

@@ -1,4 +1,4 @@
-import { r as reactExports, b3 as runAuditRemediation, au as GuardHarnessActionError, j as jsxRuntimeExports, B as Badge, S as SectionLabel, ad as HiMiniMagnifyingGlass, b as EmptyState, d as HiMiniCheckCircle, I as HiMiniXCircle, w as HiMiniExclamationTriangle, h as harnessDisplayName, m as formatRelativeTime, y as HiMiniChevronRight, A as ActionButton, b4 as HiMiniDocumentText, b5 as guardAwareHref, aH as IconActionButton, aw as HiMiniArrowPath, l as HiMiniShieldCheck } from "../guard-dashboard.js";
+import { r as reactExports, b5 as runAuditRemediation, au as GuardHarnessActionError, j as jsxRuntimeExports, B as Badge, S as SectionLabel, ad as HiMiniMagnifyingGlass, b as EmptyState, d as HiMiniCheckCircle, I as HiMiniXCircle, w as HiMiniExclamationTriangle, h as harnessDisplayName, m as formatRelativeTime, y as HiMiniChevronRight, A as ActionButton, b6 as HiMiniDocumentText, b7 as guardAwareHref, aI as IconActionButton, aw as HiMiniArrowPath, l as HiMiniShieldCheck } from "../guard-dashboard.js";
 import { u as useResolvedApprovalGate, r as resolveManagerCoverageStatus, A as ApprovalProofModal } from "./supply-chain-protection-stats.js";
 function isSupplyChainAuditEvidence(value) {
   return typeof value === "object" && value !== null && value.operation === "audit";

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/feed-health-workspace.js

@@ -1,4 +1,4 @@
-import { j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, w as HiMiniExclamationTriangle, aw as HiMiniArrowPath, d as HiMiniCheckCircle, b6 as HiMiniSignal, I as HiMiniXCircle, aG as HiMiniClock, m as formatRelativeTime, B as Badge, ac as Tag } from "../guard-dashboard.js";
+import { j as jsxRuntimeExports, A as ActionButton, S as SectionLabel, w as HiMiniExclamationTriangle, aw as HiMiniArrowPath, d as HiMiniCheckCircle, b8 as HiMiniSignal, I as HiMiniXCircle, aH as HiMiniClock, m as formatRelativeTime, B as Badge, ac as Tag } from "../guard-dashboard.js";
 function resolveFeedSourceMode(cloudState) {
   if (cloudState === "local_only") return "sample";
   if (cloudState === "paired_waiting") return "full";

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/home-protection-module.js

@@ -1,4 +1,4 @@
-import { r as reactExports, j as jsxRuntimeExports, l as HiMiniShieldCheck, b1 as HiMiniInformationCircle, w as HiMiniExclamationTriangle, S as SectionLabel, A as ActionButton, a$ as HiMiniArrowRight, ac as Tag, m as formatRelativeTime, p as HiMiniChevronUp, q as HiMiniChevronDown, d as HiMiniCheckCircle, I as HiMiniXCircle } from "../guard-dashboard.js";
+import { r as reactExports, j as jsxRuntimeExports, l as HiMiniShieldCheck, b3 as HiMiniInformationCircle, w as HiMiniExclamationTriangle, S as SectionLabel, A as ActionButton, b1 as HiMiniArrowRight, ac as Tag, m as formatRelativeTime, p as HiMiniChevronUp, q as HiMiniChevronDown, d as HiMiniCheckCircle, I as HiMiniXCircle } from "../guard-dashboard.js";
 function resolveHomeProtectionStatus(snapshot) {
   const protection = snapshot.supply_chain?.package_manager_protection;
   if (!protection) return "unknown";

{plugin_scanner-2.0.659 → plugin_scanner-2.0.661}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/policy-workspace-page.js

@@ -16,7 +16,7 @@ function PolicyWorkspacePage(props) {
       {
         eyebrow: "Policy",
         title: "Remembered rules and exceptions",
-        description: "See what Guard will do next time, in plain language. Remove local rules or add custom exceptions here."
+        description: "See what Guard will do next time, in plain language. Remove local remembered rules here or request Cloud exceptions when Guard Cloud is connected."
       }
     ),
     /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx(PolicyFallback, {}), children: /* @__PURE__ */ jsxRuntimeExports.jsx(