plugin-scanner 2.0.673__tar.gz → 2.0.675__tar.gz

{plugin_scanner-2.0.673 → plugin_scanner-2.0.675}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.673
+Version: 2.0.675
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.673 → plugin_scanner-2.0.675}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.673 → plugin_scanner-2.0.675}/dashboard/src/policy-cloud-exceptions-boundary.test.ts

@@ -43,6 +43,8 @@ const POLICY_SOURCE_FILES = [
   "policy-cloud-exceptions-summary.tsx",
   "policy-cloud-exceptions-list.tsx",
   "policy-cloud-exception-detail-panel.tsx",
+  "policy-strict-config-tab.tsx",
+  "policy-strict-config-utils.ts",
 ];
 
 const FORBIDDEN_FIXTURE_PATTERNS = [

plugin_scanner-2.0.675/dashboard/src/policy-strict-config-ia.test.ts

@@ -0,0 +1,22 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const workspaceSource = readFileSync(join(here, "policy-workspace.tsx"), "utf8");
+const tabSource = readFileSync(join(here, "policy-strict-config-tab.tsx"), "utf8");
+
+assert(workspaceSource.includes("PolicyStrictConfigTab"), "policy workspace mounts strict config tab");
+assert(!workspaceSource.includes("StrictModeView"), "legacy strict mode view removed");
+assert(tabSource.includes("fetchSettings"), "strict config tab loads settings");
+assert(tabSource.includes("Evaluation order"), "strict config tab shows evaluation order");
+assert(tabSource.includes("Policy simulator"), "strict config tab includes simulator");
+assert(tabSource.includes("Signed Cloud bundle ack"), "strict config tab explains bundle acknowledgement");
+
+console.log("policy-strict-config-ia.test.ts: all assertions passed");

plugin_scanner-2.0.675/dashboard/src/policy-strict-config-tab.tsx

@@ -0,0 +1,434 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import type { ChangeEvent } from "react";
+import { ActionButton, EmptyState, SectionLabel, Tag } from "./approval-center-primitives";
+import { formatRelativeTime, policyActionLabel } from "./approval-center-utils";
+import { fetchSettings, updateSettings } from "./guard-api";
+import type { GuardRuntimeSnapshot, GuardSettings } from "./guard-types";
+import {
+  fingerprintLocalPolicySettings,
+  resolveStrictFileWriteAction,
+  simulateStrictPolicyOutcome,
+  STRICT_CONFIG_ACTION_OPTIONS,
+  STRICT_POLICY_LAYER_OPTIONS,
+  STRICT_POLICY_EVALUATION_ORDER,
+} from "./policy-strict-config-utils";
+import { resolveCloudPolicyBundleCopy } from "./policy-workspace-helpers";
+
+type PolicyStrictConfigTabProps = {
+  snapshot: GuardRuntimeSnapshot;
+  onOpenSettings?: () => void;
+  onOpenInbox?: () => void;
+};
+
+type LoadState = "loading" | "ready" | "error";
+
+type StrictConfigSettingKey =
+  | "default_action"
+  | "changed_hash_action"
+  | "new_network_domain_action"
+  | "subprocess_action"
+  | "destructive_shell";
+
+type StrictConfigSelectOption = {
+  value: string;
+  label: string;
+};
+
+type StrictConfigSelectProps = {
+  label: string;
+  value: string;
+  settingKey: StrictConfigSettingKey;
+  onSettingChange: (key: StrictConfigSettingKey, value: string) => void;
+  options?: readonly StrictConfigSelectOption[];
+  disabled?: boolean;
+  help?: string;
+};
+
+function StrictConfigSelect({
+  label,
+  value,
+  settingKey,
+  onSettingChange,
+  options = STRICT_CONFIG_ACTION_OPTIONS,
+  disabled = false,
+  help,
+}: StrictConfigSelectProps) {
+  const handleChange = useCallback(
+    (event: ChangeEvent<HTMLSelectElement>) => {
+      onSettingChange(settingKey, event.target.value);
+    },
+    [onSettingChange, settingKey],
+  );
+
+  return (
+    <label className="block space-y-1.5">
+      <span className="text-sm font-medium text-brand-dark">{label}</span>
+      {help ? <span className="block text-xs text-slate-500">{help}</span> : null}
+      <select
+        value={value}
+        onChange={handleChange}
+        disabled={disabled}
+        className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark disabled:cursor-not-allowed disabled:bg-slate-50"
+      >
+        {options.map((option) => (
+          <option key={option.value} value={option.value}>
+            {option.label}
+          </option>
+        ))}
+      </select>
+    </label>
+  );
+}
+
+type SimLayerSelectProps = {
+  label: string;
+  value: "allow" | "block" | "none";
+  onChange: (value: "allow" | "block" | "none") => void;
+};
+
+function SimLayerSelect({ label, value, onChange }: SimLayerSelectProps) {
+  const handleChange = useCallback(
+    (event: ChangeEvent<HTMLSelectElement>) => {
+      const nextValue = event.target.value;
+      if (nextValue === "allow" || nextValue === "block" || nextValue === "none") {
+        onChange(nextValue);
+      }
+    },
+    [onChange],
+  );
+
+  return (
+    <label className="block space-y-1.5">
+      <span className="text-sm font-medium text-brand-dark">{label}</span>
+      <select
+        value={value}
+        onChange={handleChange}
+        className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark"
+      >
+        {STRICT_POLICY_LAYER_OPTIONS.map((option) => (
+          <option key={option.value} value={option.value}>
+            {option.label}
+          </option>
+        ))}
+      </select>
+    </label>
+  );
+}
+
+export function PolicyStrictConfigTab({
+  snapshot,
+  onOpenSettings,
+  onOpenInbox,
+}: PolicyStrictConfigTabProps) {
+  const [loadState, setLoadState] = useState<LoadState>("loading");
+  const [loadError, setLoadError] = useState<string | null>(null);
+  const [settings, setSettings] = useState<GuardSettings | null>(null);
+  const [configPath, setConfigPath] = useState<string | null>(null);
+  const [saveError, setSaveError] = useState<string | null>(null);
+  const [savingKey, setSavingKey] = useState<string | null>(null);
+  const [simRemembered, setSimRemembered] = useState<"allow" | "block" | "none">("none");
+  const [simCloudPolicy, setSimCloudPolicy] = useState<"allow" | "block" | "none">("none");
+  const [simCloudException, setSimCloudException] = useState(false);
+
+  const isStrict = settings?.security_level === "strict";
+  const cloudBundleCopy = resolveCloudPolicyBundleCopy(snapshot);
+  const pendingInboxCount = snapshot.queue_summary?.remaining_pending_count ?? snapshot.pending_count ?? 0;
+
+  useEffect(() => {
+    let cancelled = false;
+    setLoadState("loading");
+    setLoadError(null);
+    void fetchSettings()
+      .then((payload) => {
+        if (cancelled) {
+          return;
+        }
+        setSettings(payload.settings);
+        setConfigPath(payload.config_path);
+        setLoadState("ready");
+      })
+      .catch((error) => {
+        if (cancelled) {
+          return;
+        }
+        setLoadState("error");
+        setLoadError(error instanceof Error ? error.message : "Unable to load strict config.");
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const localPolicyHash = useMemo(
+    () => (settings ? fingerprintLocalPolicySettings(settings) : null),
+    [settings],
+  );
+
+  const simulation = useMemo(() => {
+    if (!settings) {
+      return null;
+    }
+    return simulateStrictPolicyOutcome({
+      rememberedRuleAction: simRemembered,
+      cloudPolicyAction: simCloudPolicy,
+      cloudExceptionActive: simCloudException,
+      fallbackAction: settings.default_action,
+    });
+  }, [settings, simRemembered, simCloudPolicy, simCloudException]);
+
+  const persistSetting = useCallback(async (key: StrictConfigSettingKey, value: string) => {
+    if (!settings) {
+      return;
+    }
+    const previousSettings = settings;
+    const updatedSettings: GuardSettings =
+      key === "destructive_shell"
+        ? {
+            ...settings,
+            risk_actions: {
+              ...settings.risk_actions,
+              destructive_shell: value,
+            },
+          }
+        : {
+            ...settings,
+            [key]: value,
+          };
+
+    setSettings(updatedSettings);
+    setSavingKey(key);
+    setSaveError(null);
+
+    const nextSettings: Partial<GuardSettings> =
+      key === "destructive_shell"
+        ? {
+            risk_actions: {
+              ...settings.risk_actions,
+              destructive_shell: value,
+            },
+          }
+        : { [key]: value };
+
+    try {
+      const payload = await updateSettings(nextSettings);
+      setSettings(payload.settings);
+    } catch (error) {
+      setSettings(previousSettings);
+      setSaveError(error instanceof Error ? error.message : "Unable to save strict config.");
+    } finally {
+      setSavingKey(null);
+    }
+  }, [settings]);
+
+  const handleStrictConfigChange = useCallback(
+    (key: StrictConfigSettingKey, value: string) => {
+      void persistSetting(key, value);
+    },
+    [persistSetting],
+  );
+
+  const handleSimCloudExceptionChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setSimCloudException(event.target.checked);
+  }, []);
+  const handleSimRememberedChange = useCallback((value: "allow" | "block" | "none") => {
+    setSimRemembered(value);
+  }, []);
+  const handleSimCloudPolicyChange = useCallback((value: "allow" | "block" | "none") => {
+    setSimCloudPolicy(value);
+  }, []);
+
+  if (loadState === "loading") {
+    return (
+      <div className="space-y-3" aria-busy="true">
+        {[0, 1, 2].map((index) => (
+          <div key={index} className="h-24 animate-pulse rounded-2xl border border-slate-200 bg-slate-100" />
+        ))}
+      </div>
+    );
+  }
+
+  if (loadState === "error" || !settings) {
+    return (
+      <EmptyState
+        title="Could not load strict config"
+        body={loadError ?? "Try again from Settings if the daemon is unavailable."}
+      />
+    );
+  }
+
+  const fileWriteAction = resolveStrictFileWriteAction(settings);
+  const controlsDisabled = savingKey !== null;
+
+  return (
+    <div className="space-y-4">
+      <div className={`rounded-2xl border p-5 ${isStrict ? "border-brand-green/20 bg-brand-green/[0.04]" : "border-slate-200 bg-slate-50/40"}`}>
+        <div className="mb-2 flex flex-wrap items-center gap-2">
+          <SectionLabel>Strict mode</SectionLabel>
+          <Tag tone={isStrict ? "green" : "slate"}>{isStrict ? "Enabled" : "Disabled"}</Tag>
+        </div>
+        <p className="text-sm text-brand-dark/75">
+          Strict config tunes local fallback enforcement only. Authentication, MFA, and general Guard settings stay in
+          Settings.
+        </p>
+        {!isStrict && onOpenSettings ? (
+          <div className="mt-3">
+            <ActionButton variant="secondary" onClick={onOpenSettings}>
+              Enable strict mode in Settings
+            </ActionButton>
+          </div>
+        ) : null}
+      </div>
+
+      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <SectionLabel>Local policy state</SectionLabel>
+        <dl className="mt-3 grid gap-3 text-sm sm:grid-cols-2">
+          <div>
+            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Local policy hash</dt>
+            <dd className="mt-1 font-mono text-xs text-brand-dark">{localPolicyHash}</dd>
+          </div>
+          <div>
+            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Config file</dt>
+            <dd className="mt-1 break-all text-brand-dark">{configPath ?? "Unavailable"}</dd>
+          </div>
+          <div>
+            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Daemon last reload</dt>
+            <dd className="mt-1 text-brand-dark">
+              {snapshot.runtime_state?.started_at
+                ? formatRelativeTime(snapshot.runtime_state.started_at)
+                : "Unavailable"}
+            </dd>
+          </div>
+          <div>
+            <dt className="text-xs font-medium uppercase tracking-wide text-slate-500">Daemon heartbeat</dt>
+            <dd className="mt-1 text-brand-dark">
+              {snapshot.runtime_state?.last_heartbeat_at
+                ? formatRelativeTime(snapshot.runtime_state.last_heartbeat_at)
+                : "Unavailable"}
+            </dd>
+          </div>
+        </dl>
+        {cloudBundleCopy ? (
+          <div className="mt-4 rounded-xl border border-slate-100 bg-slate-50/80 p-3">
+            <p className="text-xs font-medium uppercase tracking-wide text-slate-500">Signed Cloud bundle ack</p>
+            <p className="mt-1 text-sm font-medium text-brand-dark">{cloudBundleCopy.label}</p>
+            <p className="mt-1 text-sm text-slate-600">{cloudBundleCopy.detail}</p>
+            {snapshot.cloud_policy_bundle_hash ? (
+              <p className="mt-2 break-all font-mono text-[11px] text-slate-500">{snapshot.cloud_policy_bundle_hash}</p>
+            ) : null}
+            <p className="mt-2 text-xs text-slate-500">
+              Cloud exceptions apply through signed bundle acknowledgement on this device.
+            </p>
+          </div>
+        ) : (
+          <p className="mt-4 text-sm text-slate-600">
+            No signed Cloud policy bundle is synced yet. Cloud exceptions still require bundle acknowledgement before
+            they apply locally.
+          </p>
+        )}
+      </div>
+
+      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <SectionLabel>Local fallback controls</SectionLabel>
+        <p className="mt-2 text-sm text-slate-600">
+          These controls apply when no remembered rule, Cloud policy, or Cloud exception matches.
+        </p>
+        <div className="mt-4 grid gap-4 md:grid-cols-2">
+          <StrictConfigSelect
+            label="Default action"
+            help="First-time actions with no prior decision."
+            value={settings.default_action}
+            settingKey="default_action"
+            onSettingChange={handleStrictConfigChange}
+            disabled={controlsDisabled}
+          />
+          <StrictConfigSelect
+            label="Changed tool hash action"
+            value={settings.changed_hash_action}
+            settingKey="changed_hash_action"
+            onSettingChange={handleStrictConfigChange}
+            disabled={controlsDisabled}
+          />
+          <StrictConfigSelect
+            label="New network domain action"
+            value={settings.new_network_domain_action}
+            settingKey="new_network_domain_action"
+            onSettingChange={handleStrictConfigChange}
+            disabled={controlsDisabled}
+          />
+          <StrictConfigSelect
+            label="Subprocess action"
+            value={settings.subprocess_action}
+            settingKey="subprocess_action"
+            onSettingChange={handleStrictConfigChange}
+            disabled={controlsDisabled}
+          />
+          <StrictConfigSelect
+            label="Destructive file write action"
+            help="Backed by the destructive shell risk control."
+            value={fileWriteAction}
+            settingKey="destructive_shell"
+            onSettingChange={handleStrictConfigChange}
+            disabled={controlsDisabled}
+          />
+        </div>
+        {saveError ? <p className="mt-3 text-sm text-red-600">{saveError}</p> : null}
+        {savingKey ? <p className="mt-3 text-sm text-slate-500">Saving {savingKey.replace(/_/g, " ")}…</p> : null}
+      </div>
+
+      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <SectionLabel>Pending Inbox impact</SectionLabel>
+        <p className="mt-2 text-sm text-brand-dark/75">
+          {pendingInboxCount > 0
+            ? `${pendingInboxCount} pending review item${pendingInboxCount === 1 ? "" : "s"} may be affected by stricter fallback controls.`
+            : "No pending Inbox items are waiting for review right now."}
+        </p>
+        {onOpenInbox && pendingInboxCount > 0 ? (
+          <div className="mt-3">
+            <ActionButton variant="secondary" onClick={onOpenInbox}>
+              Open Inbox
+            </ActionButton>
+          </div>
+        ) : null}
+      </div>
+
+      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+        <SectionLabel>Evaluation order</SectionLabel>
+        <ol className="mt-3 space-y-2 text-sm text-brand-dark/80">
+          {STRICT_POLICY_EVALUATION_ORDER.map((step, index) => (
+            <li key={step} className="flex gap-2">
+              <span className="font-semibold text-brand-blue">{index + 1}.</span>
+              <span>{step}</span>
+            </li>
+          ))}
+        </ol>
+      </div>
+
+      <div className="rounded-2xl border border-brand-blue/10 bg-brand-blue/[0.03] p-5 shadow-sm">
+        <SectionLabel>Policy simulator</SectionLabel>
+        <p className="mt-2 text-sm text-slate-600">
+          Preview which layer wins for a hypothetical action without changing live policy.
+        </p>
+        <div className="mt-4 grid gap-3 md:grid-cols-3">
+          <SimLayerSelect label="Remembered rule" value={simRemembered} onChange={handleSimRememberedChange} />
+          <SimLayerSelect label="Cloud policy" value={simCloudPolicy} onChange={handleSimCloudPolicyChange} />
+          <label className="flex items-center gap-2 rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark">
+            <input type="checkbox" checked={simCloudException} onChange={handleSimCloudExceptionChange} />
+            Active Cloud exception
+          </label>
+        </div>
+        {simulation ? (
+          <div className="mt-4 rounded-xl border border-slate-100 bg-white p-4">
+            <p className="text-sm font-medium text-brand-dark">
+              Outcome: {policyActionLabel(simulation.outcome)} ({simulation.winningStep})
+            </p>
+            <ul className="mt-2 space-y-1 text-xs text-slate-600">
+              {simulation.path.map((step) => (
+                <li key={step}>{step}</li>
+              ))}
+            </ul>
+          </div>
+        ) : null}
+      </div>
+    </div>
+  );
+}

plugin_scanner-2.0.675/dashboard/src/policy-strict-config-utils.test.ts

@@ -0,0 +1,78 @@
+import {
+  fingerprintLocalPolicySettings,
+  simulateStrictPolicyOutcome,
+  STRICT_POLICY_EVALUATION_ORDER,
+} from "./policy-strict-config-utils";
+import type { GuardSettings } from "./guard-types";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const baseSettings: GuardSettings = {
+  mode: "prompt",
+  security_level: "strict",
+  default_action: "review",
+  unknown_publisher_action: "review",
+  changed_hash_action: "require-reapproval",
+  new_network_domain_action: "review",
+  subprocess_action: "review",
+  risk_actions: {
+    destructive_shell: "review",
+  },
+  risk_action_overrides: {},
+  harness_risk_actions: {},
+  approval_wait_timeout_seconds: 120,
+  approval_surface_policy: "auto-open-once",
+  telemetry: false,
+  sync: true,
+  billing: false,
+};
+
+assert(
+  fingerprintLocalPolicySettings(baseSettings).startsWith("local-"),
+  "policy hash uses local prefix",
+);
+assert(STRICT_POLICY_EVALUATION_ORDER.length === 5, "evaluation order has five steps");
+
+const remembered = simulateStrictPolicyOutcome({
+  rememberedRuleAction: "allow",
+  cloudPolicyAction: "block",
+  cloudExceptionActive: true,
+  fallbackAction: "block",
+});
+assert(remembered.winningStep === "Local remembered rule", "remembered rule wins first");
+
+const cloudException = simulateStrictPolicyOutcome({
+  rememberedRuleAction: "none",
+  cloudPolicyAction: "none",
+  cloudExceptionActive: true,
+  fallbackAction: "block",
+});
+assert(cloudException.winningStep === "Cloud exception", "cloud exception wins after empty policy layers");
+
+const sandboxFallback = simulateStrictPolicyOutcome({
+  rememberedRuleAction: "none",
+  cloudPolicyAction: "none",
+  cloudExceptionActive: false,
+  fallbackAction: "sandbox-required",
+});
+assert(
+  sandboxFallback.outcome === "sandbox-required",
+  "sandbox-required fallback preserves configured outcome",
+);
+
+const reapprovalFallback = simulateStrictPolicyOutcome({
+  rememberedRuleAction: "none",
+  cloudPolicyAction: "none",
+  cloudExceptionActive: false,
+  fallbackAction: "require-reapproval",
+});
+assert(
+  reapprovalFallback.outcome === "require-reapproval",
+  "require-reapproval fallback preserves configured outcome",
+);
+
+console.log("policy-strict-config-utils.test.ts: all assertions passed");

plugin_scanner-2.0.675/dashboard/src/policy-strict-config-utils.ts

@@ -0,0 +1,103 @@
+import type { GuardSettings } from "./guard-types";
+
+export const STRICT_POLICY_LAYER_OPTIONS = [
+  { value: "none", label: "No match" },
+  { value: "allow", label: "Allow" },
+  { value: "block", label: "Block" },
+] as const;
+
+export const STRICT_CONFIG_ACTION_OPTIONS = [
+  { value: "allow", label: "Allow without asking" },
+  { value: "warn", label: "Warn only" },
+  { value: "review", label: "Ask me first" },
+  { value: "require-reapproval", label: "Ask every time" },
+  { value: "sandbox-required", label: "Run in sandbox" },
+  { value: "block", label: "Block" },
+] as const;
+
+export const STRICT_POLICY_EVALUATION_ORDER = [
+  "Local remembered rule",
+  "Guard Cloud policy",
+  "Cloud exception",
+  "Strict fallback",
+  "Ask or block",
+] as const;
+
+export type StrictPolicySimulationInput = {
+  rememberedRuleAction: "allow" | "block" | "none";
+  cloudPolicyAction: "allow" | "block" | "none";
+  cloudExceptionActive: boolean;
+  fallbackAction: string;
+};
+
+export type StrictPolicySimulationResult = {
+  outcome: string;
+  winningStep: (typeof STRICT_POLICY_EVALUATION_ORDER)[number];
+  path: string[];
+};
+
+export function fingerprintLocalPolicySettings(settings: GuardSettings): string {
+  const payload = JSON.stringify({
+    mode: settings.mode,
+    security_level: settings.security_level,
+    default_action: settings.default_action,
+    changed_hash_action: settings.changed_hash_action,
+    new_network_domain_action: settings.new_network_domain_action,
+    subprocess_action: settings.subprocess_action,
+    destructive_shell: settings.risk_actions?.destructive_shell ?? null,
+  });
+  let hash = 5381;
+  for (let index = 0; index < payload.length; index += 1) {
+    hash = ((hash << 5) + hash) ^ payload.charCodeAt(index);
+  }
+  return `local-${(hash >>> 0).toString(16).padStart(8, "0")}`;
+}
+
+export function resolveStrictFileWriteAction(settings: GuardSettings): string {
+  return settings.risk_actions?.destructive_shell ?? settings.default_action;
+}
+
+export function simulateStrictPolicyOutcome(input: StrictPolicySimulationInput): StrictPolicySimulationResult {
+  const path: string[] = [];
+  if (input.rememberedRuleAction !== "none") {
+    path.push(`Local remembered rule → ${input.rememberedRuleAction}`);
+    return {
+      outcome: input.rememberedRuleAction,
+      winningStep: "Local remembered rule",
+      path,
+    };
+  }
+  path.push("Local remembered rule → none");
+  if (input.cloudPolicyAction !== "none") {
+    path.push(`Guard Cloud policy → ${input.cloudPolicyAction}`);
+    return {
+      outcome: input.cloudPolicyAction,
+      winningStep: "Guard Cloud policy",
+      path,
+    };
+  }
+  path.push("Guard Cloud policy → none");
+  if (input.cloudExceptionActive) {
+    path.push("Cloud exception → allow");
+    return {
+      outcome: "allow",
+      winningStep: "Cloud exception",
+      path,
+    };
+  }
+  path.push("Cloud exception → none");
+  path.push(`Strict fallback → ${input.fallbackAction}`);
+  if (input.fallbackAction === "allow" || input.fallbackAction === "warn") {
+    return {
+      outcome: input.fallbackAction,
+      winningStep: "Strict fallback",
+      path,
+    };
+  }
+  path.push(`Ask or block → ${input.fallbackAction}`);
+  return {
+    outcome: input.fallbackAction,
+    winningStep: "Ask or block",
+    path,
+  };
+}