plugin-scanner 2.0.668__tar.gz → 2.0.669__tar.gz

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.668
+Version: 2.0.669
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/dashboard/src/guard-api.ts

@@ -1588,6 +1588,66 @@ export async function fetchCloudExceptions(harness?: string): Promise<GuardCloud
   return payload.items;
 }
 
+export type GuardCloudExceptionRequestCreateInput = {
+  scope: "artifact" | "publisher" | "harness" | "workspace";
+  harness?: string | null;
+  artifactId?: string | null;
+  publisher?: string | null;
+  requestedBy: string;
+  reason: string;
+  owner: string;
+  requestedExpiresAt: string;
+  sourceReceiptId?: string | null;
+  sourceReviewItemId?: string | null;
+  projectId?: string | null;
+  workspaceId?: string | null;
+  workingDirectory?: string | null;
+  teamId?: string | null;
+  stepUpChallengeId?: string | null;
+};
+
+export type GuardCloudExceptionRequestListResponse = {
+  generatedAt: string;
+  items: Array<{
+    requestId: string;
+    scope: GuardCloudExceptionRequestCreateInput["scope"];
+    status: "pending" | "approved" | "rejected";
+    reason: string;
+    owner: string;
+    requestedAt: string;
+    requestedExpiresAt: string;
+  }>;
+};
+
+export async function createCloudExceptionRequest(
+  input: GuardCloudExceptionRequestCreateInput,
+): Promise<GuardCloudExceptionRequestListResponse> {
+  if (isGuardDemoMode()) {
+    return {
+      generatedAt: new Date().toISOString(),
+      items: [
+        {
+          requestId: "demo-exception-request",
+          scope: input.scope,
+          status: "pending",
+          reason: input.reason,
+          owner: input.owner,
+          requestedAt: new Date().toISOString(),
+          requestedExpiresAt: input.requestedExpiresAt,
+        },
+      ],
+    };
+  }
+  return readJson<GuardCloudExceptionRequestListResponse>("/v1/policy/cloud-exception-requests", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...guardAuthHeaders(),
+    },
+    body: JSON.stringify(input),
+  });
+}
+
 export async function fetchPolicies(): Promise<GuardPolicyDecision[]> {
   if (isGuardDemoMode()) {
     return getDemoPolicy("codex");

plugin_scanner-2.0.669/dashboard/src/policy-cloud-exception-request-ia.test.ts

@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const tabSource = readFileSync(join(here, "policy-cloud-exceptions-tab.tsx"), "utf8");
+const panelSource = readFileSync(join(here, "policy-cloud-exception-request-panel.tsx"), "utf8");
+const guardApiSource = readFileSync(join(here, "guard-api.ts"), "utf8");
+
+assert(tabSource.includes("PolicyCloudExceptionRequestPanel"), "cloud exceptions tab mounts request panel");
+assert(panelSource.includes("createCloudExceptionRequest"), "request panel submits through Guard Cloud proxy");
+assert(panelSource.includes("sourceReceiptId"), "request panel anchors to source receipt");
+assert(!panelSource.includes("savePolicyDecision"), "request panel must not save local policy decisions");
+assert(guardApiSource.includes("createCloudExceptionRequest"), "guard-api exposes cloud exception request create");
+assert(guardApiSource.includes("/v1/policy/cloud-exception-requests"), "guard-api calls daemon proxy endpoint");
+
+console.log("policy-cloud-exception-request-ia.test.ts: all assertions passed");

plugin_scanner-2.0.669/dashboard/src/policy-cloud-exception-request-panel.tsx

@@ -0,0 +1,395 @@
+import { useCallback, useMemo, useState } from "react";
+import type { ChangeEvent, FormEvent } from "react";
+import { ActionButton, SectionLabel } from "./approval-center-primitives";
+import { harnessDisplayName } from "./approval-center-utils";
+import { createCloudExceptionRequest } from "./guard-api";
+import type { GuardCloudExceptionRequestCreateInput } from "./guard-api";
+import type { GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
+
+const SCOPE_VALUES = ["artifact", "publisher", "harness", "workspace"] as const;
+
+const SCOPE_OPTIONS: Array<{
+  value: GuardCloudExceptionRequestCreateInput["scope"];
+  label: string;
+  description: string;
+}> = [
+  {
+    value: "artifact",
+    label: "One specific action",
+    description: "Limit the exception to a single artifact fingerprint.",
+  },
+  {
+    value: "publisher",
+    label: "Publisher",
+    description: "Apply to packages or plugins from one publisher.",
+  },
+  {
+    value: "harness",
+    label: "App",
+    description: "Apply across one harness such as Codex or Cursor.",
+  },
+  {
+    value: "workspace",
+    label: "Project",
+    description: "Apply within the current project folder on this device.",
+  },
+];
+
+type PolicyCloudExceptionRequestPanelProps = {
+  snapshot: GuardRuntimeSnapshot;
+  onSubmitted: () => void;
+  onCancel: () => void;
+};
+
+function defaultExpiryIso(): string {
+  const date = new Date();
+  date.setDate(date.getDate() + 30);
+  return date.toISOString();
+}
+
+function toDatetimeLocalValue(iso: string): string {
+  const date = new Date(iso);
+  if (Number.isNaN(date.getTime())) {
+    return "";
+  }
+  const pad = (value: number) => String(value).padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}T${pad(date.getHours())}:${pad(date.getMinutes())}`;
+}
+
+function fromDatetimeLocalValue(value: string): string {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return new Date().toISOString();
+  }
+  return date.toISOString();
+}
+
+function parseScopeValue(value: string): GuardCloudExceptionRequestCreateInput["scope"] | null {
+  if ((SCOPE_VALUES as readonly string[]).includes(value)) {
+    return value as GuardCloudExceptionRequestCreateInput["scope"];
+  }
+  return null;
+}
+
+function resolveDefaultWorkingDirectory(snapshot: GuardRuntimeSnapshot): string {
+  const install = snapshot.managed_installs?.find((entry) => entry.workspace?.trim());
+  return install?.workspace?.trim() ?? "";
+}
+
+export function PolicyCloudExceptionRequestPanel({
+  snapshot,
+  onSubmitted,
+  onCancel,
+}: PolicyCloudExceptionRequestPanelProps) {
+  const receiptOptions = snapshot.latest_receipts ?? [];
+  const harnessOptions = useMemo(() => {
+    const fromReceipts = receiptOptions.map((receipt) => receipt.harness).filter(Boolean);
+    const fromInstalls = (snapshot.managed_installs ?? []).map((entry) => entry.harness).filter(Boolean);
+    return [...new Set([...fromReceipts, ...fromInstalls, "codex", "cursor"])].sort();
+  }, [receiptOptions, snapshot.managed_installs]);
+
+  const [scope, setScope] = useState<GuardCloudExceptionRequestCreateInput["scope"]>("artifact");
+  const [harness, setHarness] = useState(harnessOptions[0] ?? "codex");
+  const [artifactId, setArtifactId] = useState(receiptOptions[0]?.artifact_id ?? "");
+  const [publisher, setPublisher] = useState("");
+  const [workingDirectory, setWorkingDirectory] = useState(resolveDefaultWorkingDirectory(snapshot));
+  const [sourceReceiptId, setSourceReceiptId] = useState(receiptOptions[0]?.receipt_id ?? "");
+  const [requestedBy, setRequestedBy] = useState("");
+  const [owner, setOwner] = useState("");
+  const [reason, setReason] = useState("");
+  const [requestedExpiresAt, setRequestedExpiresAt] = useState(defaultExpiryIso());
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [successMessage, setSuccessMessage] = useState<string | null>(null);
+
+  const handleScopeChange = useCallback((event: ChangeEvent<HTMLSelectElement>) => {
+    const nextScope = parseScopeValue(event.target.value);
+    if (nextScope) {
+      setScope(nextScope);
+    }
+  }, []);
+
+  const handleReceiptChange = useCallback(
+    (event: ChangeEvent<HTMLSelectElement>) => {
+      const receiptId = event.target.value;
+      setSourceReceiptId(receiptId);
+      const receipt = receiptOptions.find((entry) => entry.receipt_id === receiptId);
+      if (!receipt) {
+        return;
+      }
+      setHarness(receipt.harness);
+      setArtifactId(receipt.artifact_id);
+    },
+    [receiptOptions],
+  );
+
+  const handleArtifactIdChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setArtifactId(event.target.value);
+  }, []);
+
+  const handlePublisherChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setPublisher(event.target.value);
+  }, []);
+
+  const handleHarnessChange = useCallback((event: ChangeEvent<HTMLSelectElement>) => {
+    setHarness(event.target.value);
+  }, []);
+
+  const handleWorkingDirectoryChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setWorkingDirectory(event.target.value);
+  }, []);
+
+  const handleRequestedByChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setRequestedBy(event.target.value);
+  }, []);
+
+  const handleOwnerChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setOwner(event.target.value);
+  }, []);
+
+  const handleReasonChange = useCallback((event: ChangeEvent<HTMLTextAreaElement>) => {
+    setReason(event.target.value);
+  }, []);
+
+  const handleExpiryChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setRequestedExpiresAt(fromDatetimeLocalValue(event.target.value));
+  }, []);
+
+  const handleSubmit = useCallback(
+    async (event: FormEvent<HTMLFormElement>) => {
+      event.preventDefault();
+      setSubmitting(true);
+      setError(null);
+      setSuccessMessage(null);
+      const payload: GuardCloudExceptionRequestCreateInput = {
+        scope,
+        requestedBy: requestedBy.trim(),
+        owner: owner.trim(),
+        reason: reason.trim(),
+        requestedExpiresAt,
+        sourceReceiptId: sourceReceiptId.trim() || null,
+      };
+      if (scope === "artifact") {
+        payload.harness = harness.trim() || null;
+        payload.artifactId = artifactId.trim() || null;
+      } else if (scope === "publisher") {
+        payload.publisher = publisher.trim() || null;
+      } else if (scope === "harness") {
+        payload.harness = harness.trim() || null;
+      } else if (scope === "workspace") {
+        payload.workingDirectory = workingDirectory.trim() || null;
+      }
+      try {
+        const response = await createCloudExceptionRequest(payload);
+        const created = response.items.find((item) => item.status === "pending") ?? response.items[0];
+        setSuccessMessage(
+          created
+            ? `Cloud exception request ${created.requestId} is pending Guard Cloud review.`
+            : "Cloud exception request submitted.",
+        );
+      } catch (submitError) {
+        const message =
+          submitError instanceof Error && submitError.message.trim()
+            ? submitError.message
+            : "Unable to submit the Cloud exception request.";
+        setError(message);
+      } finally {
+        setSubmitting(false);
+      }
+    },
+    [
+      artifactId,
+      harness,
+      owner,
+      publisher,
+      reason,
+      requestedBy,
+      requestedExpiresAt,
+      scope,
+      sourceReceiptId,
+      workingDirectory,
+    ],
+  );
+
+  const handleDone = useCallback(() => {
+    onSubmitted();
+  }, [onSubmitted]);
+
+  if (receiptOptions.length === 0) {
+    return (
+      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <SectionLabel>Request cloud exception</SectionLabel>
+        <p className="mt-2 text-sm text-brand-dark/75">
+          Guard needs at least one receipt on this device to anchor a Cloud exception request.
+          Run a protected action first, then return here from Evidence or Inbox.
+        </p>
+        <div className="mt-4">
+          <ActionButton variant="secondary" onClick={onCancel}>
+            Back
+          </ActionButton>
+        </div>
+      </div>
+    );
+  }
+
+  if (successMessage) {
+    return (
+      <div className="space-y-4 rounded-2xl border border-emerald-200 bg-emerald-50/60 p-5 shadow-sm">
+        <SectionLabel>Request submitted</SectionLabel>
+        <p className="text-sm text-emerald-800">{successMessage}</p>
+        <ActionButton variant="primary" onClick={handleDone}>
+          Done
+        </ActionButton>
+      </div>
+    );
+  }
+
+  return (
+    <form className="space-y-5 rounded-2xl border border-slate-200 bg-white p-5 shadow-sm" onSubmit={handleSubmit}>
+      <div>
+        <SectionLabel>Request cloud exception</SectionLabel>
+        <p className="mt-2 text-sm text-brand-dark/75">
+          Submit a governed risk acceptance to Guard Cloud. This does not create a local remembered rule.
+        </p>
+      </div>
+
+      <label className="block space-y-1">
+        <span className="text-sm font-medium text-brand-dark">Source receipt</span>
+        <select
+          className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+          value={sourceReceiptId}
+          onChange={handleReceiptChange}
+          required
+        >
+          {receiptOptions.map((receipt: GuardReceipt) => (
+            <option key={receipt.receipt_id} value={receipt.receipt_id}>
+              {harnessDisplayName(receipt.harness)} · {receipt.artifact_name ?? receipt.artifact_id}
+            </option>
+          ))}
+        </select>
+      </label>
+
+      <label className="block space-y-1">
+        <span className="text-sm font-medium text-brand-dark">Scope</span>
+        <select className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm" value={scope} onChange={handleScopeChange}>
+          {SCOPE_OPTIONS.map((option) => (
+            <option key={option.value} value={option.value}>
+              {option.label}
+            </option>
+          ))}
+        </select>
+        <p className="text-xs text-slate-500">
+          {SCOPE_OPTIONS.find((option) => option.value === scope)?.description}
+        </p>
+      </label>
+
+      {scope === "artifact" ? (
+        <label className="block space-y-1">
+          <span className="text-sm font-medium text-brand-dark">Artifact fingerprint</span>
+          <input
+            className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+            value={artifactId}
+            onChange={handleArtifactIdChange}
+            required
+          />
+        </label>
+      ) : null}
+
+      {scope === "publisher" ? (
+        <label className="block space-y-1">
+          <span className="text-sm font-medium text-brand-dark">Publisher</span>
+          <input
+            className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+            value={publisher}
+            onChange={handlePublisherChange}
+            required
+          />
+        </label>
+      ) : null}
+
+      {scope === "harness" || scope === "artifact" ? (
+        <label className="block space-y-1">
+          <span className="text-sm font-medium text-brand-dark">App</span>
+          <select
+            className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+            value={harness}
+            onChange={handleHarnessChange}
+            required
+          >
+            {harnessOptions.map((option) => (
+              <option key={option} value={option}>
+                {harnessDisplayName(option)}
+              </option>
+            ))}
+          </select>
+        </label>
+      ) : null}
+
+      {scope === "workspace" ? (
+        <label className="block space-y-1">
+          <span className="text-sm font-medium text-brand-dark">Project folder</span>
+          <input
+            className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+            value={workingDirectory}
+            onChange={handleWorkingDirectoryChange}
+            required
+          />
+        </label>
+      ) : null}
+
+      <label className="block space-y-1">
+        <span className="text-sm font-medium text-brand-dark">Requested by</span>
+        <input
+          className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+          type="email"
+          value={requestedBy}
+          onChange={handleRequestedByChange}
+          required
+        />
+      </label>
+
+      <label className="block space-y-1">
+        <span className="text-sm font-medium text-brand-dark">Risk owner</span>
+        <input
+          className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+          type="email"
+          value={owner}
+          onChange={handleOwnerChange}
+          required
+        />
+      </label>
+
+      <label className="block space-y-1">
+        <span className="text-sm font-medium text-brand-dark">Reason</span>
+        <textarea
+          className="min-h-24 w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+          value={reason}
+          onChange={handleReasonChange}
+          required
+        />
+      </label>
+
+      <label className="block space-y-1">
+        <span className="text-sm font-medium text-brand-dark">Expires</span>
+        <input
+          className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
+          type="datetime-local"
+          value={toDatetimeLocalValue(requestedExpiresAt)}
+          onChange={handleExpiryChange}
+          required
+        />
+      </label>
+
+      {error ? <p className="text-sm text-red-600">{error}</p> : null}
+
+      <div className="flex flex-wrap gap-2">
+        <ActionButton variant="primary" type="submit" disabled={submitting}>
+          {submitting ? "Submitting…" : "Submit to Guard Cloud"}
+        </ActionButton>
+        <ActionButton variant="secondary" type="button" onClick={onCancel} disabled={submitting}>
+          Cancel
+        </ActionButton>
+      </div>
+    </form>
+  );
+}

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/dashboard/src/policy-cloud-exceptions-boundary.test.ts

@@ -37,6 +37,8 @@ const POLICY_SOURCE_FILES = [
   "policy-remembered-cloud-rules.tsx",
   "policy-remembered-rules-tab.tsx",
   "policy-remembered-rules-right-rail.tsx",
+  "policy-cloud-exceptions-tab.tsx",
+  "policy-cloud-exception-request-panel.tsx",
 ];
 
 const FORBIDDEN_FIXTURE_PATTERNS = [
@@ -120,6 +122,7 @@ assert(guardApiSource.includes("savePolicyDecision"), "guard-api must expose sav
 assert(guardApiSource.includes("clearPolicy"), "guard-api must expose clearPolicy");
 assert(guardApiSource.includes("/v1/policy"), "guard-api must call /v1/policy endpoints");
 assert(guardApiSource.includes("fetchCloudExceptions"), "guard-api must expose fetchCloudExceptions");
+assert(guardApiSource.includes("createCloudExceptionRequest"), "guard-api must expose createCloudExceptionRequest");
 
 assert(boundaryDoc.includes("Remembered rules"), "boundary doc must define Remembered rules");
 assert(boundaryDoc.includes("Cloud exceptions"), "boundary doc must define Cloud exceptions");

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/dashboard/src/policy-cloud-exceptions-ia.test.tsx

@@ -23,6 +23,7 @@ const sidebarSource = readFileSync(join(here, "approval-center-primitives.tsx"),
 assert(!workspaceSource.includes("PolicyExceptionForm"), "policy workspace no longer mounts PolicyExceptionForm");
 assert(!workspaceSource.includes("New exception"), "policy workspace removes local New exception copy");
 assert(tabSource.includes("Request cloud exception"), "cloud exceptions tab exposes request CTA");
+assert(tabSource.includes("PolicyCloudExceptionRequestPanel"), "cloud exceptions tab opens in-dashboard request panel");
 assert(tabSource.includes("Open Guard Cloud"), "cloud exceptions tab exposes Open Guard Cloud CTA");
 assert(tabSource.includes("Guard Cloud is not connected"), "disconnected Cloud copy present");
 assert(!pageSource.includes("add custom exceptions"), "page header removes local exception authoring copy");

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/dashboard/src/policy-cloud-exceptions-tab.tsx

@@ -1,11 +1,12 @@
+import { useCallback, useState } from "react";
 import { HiMiniCloudArrowUp } from "react-icons/hi2";
 import { ActionButton, EmptyState, SectionLabel } from "./approval-center-primitives";
 import type { GuardRuntimeSnapshot } from "./guard-types";
+import { PolicyCloudExceptionRequestPanel } from "./policy-cloud-exception-request-panel";
 import { resolveCloudPolicyControlsUrl } from "./policy-workspace-helpers";
 
 type PolicyCloudExceptionsTabProps = {
   snapshot: GuardRuntimeSnapshot;
-  onRequestCloudException?: () => void;
 };
 
 function resolveCloudExceptionsConnected(snapshot: GuardRuntimeSnapshot): boolean {
@@ -14,12 +15,34 @@ function resolveCloudExceptionsConnected(snapshot: GuardRuntimeSnapshot): boolea
 
 export function PolicyCloudExceptionsTab({
   snapshot,
-  onRequestCloudException,
 }: PolicyCloudExceptionsTabProps) {
+  const [requestOpen, setRequestOpen] = useState(false);
   const cloudControlsUrl = resolveCloudPolicyControlsUrl(snapshot);
   const cloudConnected = resolveCloudExceptionsConnected(snapshot);
   const connectUrl = snapshot.connect_url?.trim() || null;
 
+  const handleOpenRequestPanel = useCallback(() => {
+    setRequestOpen(true);
+  }, []);
+
+  const handleCloseRequestPanel = useCallback(() => {
+    setRequestOpen(false);
+  }, []);
+
+  const handleRequestSubmitted = useCallback(() => {
+    setRequestOpen(false);
+  }, []);
+
+  if (requestOpen) {
+    return (
+      <PolicyCloudExceptionRequestPanel
+        snapshot={snapshot}
+        onSubmitted={handleRequestSubmitted}
+        onCancel={handleCloseRequestPanel}
+      />
+    );
+  }
+
   return (
     <div className="space-y-4">
       <div className="rounded-2xl border border-brand-blue/10 bg-brand-blue/[0.03] p-5 shadow-sm">
@@ -37,8 +60,8 @@ export function PolicyCloudExceptionsTab({
       <div className="flex flex-wrap items-center gap-2">
         <ActionButton
           variant="primary"
-          onClick={onRequestCloudException}
-          disabled={!cloudConnected || onRequestCloudException === undefined}
+          onClick={handleOpenRequestPanel}
+          disabled={!cloudConnected}
         >
           Request cloud exception
         </ActionButton>
@@ -71,4 +94,3 @@ export function PolicyCloudExceptionsTab({
     </div>
   );
 }
-

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/dashboard/src/policy-workspace.tsx

@@ -54,14 +54,6 @@ export function PolicyWorkspace({
     setActiveView("exceptions");
   }, []);
 
-  const cloudControlsUrl = useMemo(() => resolveCloudPolicyControlsUrl(snapshot), [snapshot]);
-
-  const handleRequestCloudException = useCallback(() => {
-    if (cloudControlsUrl) {
-      window.open(cloudControlsUrl, "_blank", "noopener,noreferrer");
-    }
-  }, [cloudControlsUrl]);
-
   const modeCopy = useMemo(() => resolveSecurityModeCopy(snapshot.security_level), [snapshot.security_level]);
   const cloudBundleCopy = useMemo(() => resolveCloudPolicyBundleCopy(snapshot), [snapshot]);
 
@@ -113,15 +105,13 @@ export function PolicyWorkspace({
       {activeView === "rules" ? (
         <PolicyRememberedRulesTab
           policies={policies}
-          cloudControlsUrl={cloudControlsUrl}
+          cloudControlsUrl={resolveCloudPolicyControlsUrl(snapshot)}
           onClearPolicy={onClearPolicy}
           onOpenCloudExceptions={handleOpenCloudExceptions}
         />
       ) : null}
 
-      {activeView === "exceptions" ? (
-        <PolicyCloudExceptionsTab snapshot={snapshot} onRequestCloudException={cloudControlsUrl ? handleRequestCloudException : undefined} />
-      ) : null}
+      {activeView === "exceptions" ? <PolicyCloudExceptionsTab snapshot={snapshot} /> : null}
 
       {activeView === "strict" ? (
         <StrictModeView snapshot={snapshot} onOpenSettings={onOpenSettings} onOpenInbox={onOpenInbox} />

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.668"
+version = "2.0.669"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.668 → plugin_scanner-2.0.669}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.668"
+version = "2.0.669"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"