plugin-scanner 2.0.675__tar.gz → 2.0.677__tar.gz

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.675
+Version: 2.0.677
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/dashboard/src/policy-cloud-exception-request-panel.tsx

@@ -217,7 +217,13 @@ export function PolicyCloudExceptionRequestPanel({
 
   if (receiptOptions.length === 0) {
     return (
-      <div className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm">
+      <div
+        className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm"
+        aria-labelledby="cloud-exception-request-title"
+      >
+        <h2 id="cloud-exception-request-title" className="sr-only">
+          Request cloud exception
+        </h2>
         <SectionLabel>Request cloud exception</SectionLabel>
         <p className="mt-2 text-sm text-brand-dark/75">
           Guard needs at least one receipt on this device to anchor a Cloud exception request.
@@ -245,8 +251,15 @@ export function PolicyCloudExceptionRequestPanel({
   }
 
   return (
-    <form className="space-y-5 rounded-2xl border border-slate-200 bg-white p-5 shadow-sm" onSubmit={handleSubmit}>
+    <form
+      className="space-y-5 rounded-2xl border border-slate-200 bg-white p-5 shadow-sm"
+      onSubmit={handleSubmit}
+      aria-labelledby="cloud-exception-request-title"
+    >
       <div>
+        <h2 id="cloud-exception-request-title" className="sr-only">
+          Request cloud exception
+        </h2>
         <SectionLabel>Request cloud exception</SectionLabel>
         <p className="mt-2 text-sm text-brand-dark/75">
           Submit a governed risk acceptance to Guard Cloud. This does not create a local remembered rule.

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/dashboard/src/policy-cloud-exceptions-boundary.test.ts

@@ -54,6 +54,12 @@ const FORBIDDEN_FIXTURE_PATTERNS = [
   /policy-2026-\d/,
   /receipt_[a-f0-9]{8,}/i,
   /exception_request_[a-f0-9-]{8,}/i,
+  /\bLorem ipsum\b/i,
+  /\bMock Exception\b/i,
+  /\bSample Exception\b/i,
+  /\bPlaceholder Owner\b/i,
+  /\bDemo User\b/i,
+  /\bfixture-row\b/i,
 ];
 
 const REVIEW_INBOX_DENYLIST = [

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/dashboard/src/policy-cloud-exceptions-list.tsx

@@ -37,12 +37,13 @@ function GroupSection({ title, description, defaultOpen = true, children }: Grou
   }, []);
 
   return (
-    <section className="rounded-2xl border border-slate-100 bg-white shadow-sm">
+    <section className="rounded-2xl border border-slate-100 bg-white shadow-sm" aria-label={title}>
       <button
         type="button"
         onClick={handleToggle}
         className="flex w-full items-start justify-between gap-3 px-4 py-3 text-left"
         aria-expanded={open}
+        aria-label={`${title} group`}
       >
         <div>
           <h3 className="text-sm font-semibold text-brand-dark">{title}</h3>
@@ -117,6 +118,16 @@ function PendingRequestCard({ item }: { item: GuardCloudExceptionRequestItem })
   );
 }
 
+export function PolicyCloudExceptionsListSkeleton() {
+  return (
+    <div className="space-y-3" aria-busy="true" aria-label="Loading Cloud exceptions">
+      {[0, 1, 2].map((index) => (
+        <div key={index} className="h-28 animate-pulse rounded-2xl border border-slate-100 bg-slate-100" />
+      ))}
+    </div>
+  );
+}
+
 export function PolicyCloudExceptionsList({
   active,
   pending,

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/dashboard/src/policy-cloud-exceptions-tab.tsx

@@ -7,7 +7,7 @@ import type { GuardCloudExceptionRequestItem } from "./guard-api";
 import type { GuardRuntimeSnapshot } from "./guard-types";
 import { PolicyCloudExceptionDetailPanel } from "./policy-cloud-exception-detail-panel";
 import { PolicyCloudExceptionRequestPanel } from "./policy-cloud-exception-request-panel";
-import { PolicyCloudExceptionsList } from "./policy-cloud-exceptions-list";
+import { PolicyCloudExceptionsList, PolicyCloudExceptionsListSkeleton } from "./policy-cloud-exceptions-list";
 import { PolicyCloudExceptionsSummary } from "./policy-cloud-exceptions-summary";
 import {
   groupCloudExceptions,
@@ -160,7 +160,7 @@ export function PolicyCloudExceptionsTab({
       ) : loadState === "error" ? (
         <EmptyState
           title="Could not load Cloud exceptions"
-          body={loadError ?? "Try again after Guard Cloud sync completes."}
+          body={`${loadError ?? "Try again after Guard Cloud sync completes."} Local remembered rules and strict config still apply on this device.`}
           action={
             <ActionButton variant="secondary" onClick={handleRetryLoad}>
               Retry
@@ -178,14 +178,18 @@ export function PolicyCloudExceptionsTab({
           />
 
           <div className="grid gap-4 lg:grid-cols-[minmax(0,1fr)_320px] lg:items-start">
-            <PolicyCloudExceptionsList
-              active={groups.active}
-              pending={groups.pending}
-              expiringSoon={groups.expiringSoon}
-              selectedExceptionId={selectedExceptionId}
-              onSelectException={handleSelectException}
-              cloudConnected={cloudConnected}
-            />
+            {loadState === "loading" ? (
+              <PolicyCloudExceptionsListSkeleton />
+            ) : (
+              <PolicyCloudExceptionsList
+                active={groups.active}
+                pending={groups.pending}
+                expiringSoon={groups.expiringSoon}
+                selectedExceptionId={selectedExceptionId}
+                onSelectException={handleSelectException}
+                cloudConnected={cloudConnected}
+              />
+            )}
             {selectedException ? (
               <PolicyCloudExceptionDetailPanel
                 exception={selectedException}

plugin_scanner-2.0.677/dashboard/src/policy-data-truth.test.ts

@@ -0,0 +1,82 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  groupCloudExceptions,
+  isCloudExceptionActive,
+  resolvePersonDisplayLabel,
+  resolvePersonInitials,
+  summarizeCloudExceptions,
+} from "./policy-cloud-exceptions-utils";
+import type { GuardCloudException } from "./guard-types";
+import type { GuardCloudExceptionRequestItem } from "./guard-api";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+const now = new Date("2026-06-13T12:00:00+00:00");
+
+const activeException: GuardCloudException = {
+  id: "artifact:codex:project:live",
+  effect: "allow",
+  scope: "artifact",
+  harness: "codex",
+  owner: "owner@example.com",
+  approver: "approver@example.com",
+  expiry: "2099-01-01T00:00:00+00:00",
+  artifact_id: "codex:project:live",
+  source_receipt_id: "receipt-live",
+  bundle_hash: "sha256:live-bundle",
+  ack_status: "synced",
+  last_used_at: null,
+  rejection_reason: null,
+};
+
+const expiredException: GuardCloudException = {
+  ...activeException,
+  id: "artifact:codex:project:expired",
+  artifact_id: "codex:project:expired",
+  expiry: "2020-01-01T00:00:00+00:00",
+};
+
+const pendingRequest: GuardCloudExceptionRequestItem = {
+  requestId: "req-pending",
+  scope: "artifact",
+  status: "pending",
+  reason: "Temporary allow for rollout",
+  owner: "owner@example.com",
+  requestedAt: "2026-06-13T00:00:00+00:00",
+  requestedExpiresAt: "2099-01-01T00:00:00+00:00",
+};
+
+assert(
+  groupCloudExceptions([], []).active.length === 0 && groupCloudExceptions([], []).pending.length === 0,
+  "empty API payloads produce empty active and pending groups",
+);
+
+const pendingGroups = groupCloudExceptions([], [pendingRequest], now);
+assert(pendingGroups.pending.length === 1, "pending request renders from API response");
+assert(pendingGroups.active.length === 0, "pending-only response keeps active group empty");
+
+const activeGroups = groupCloudExceptions([activeException, expiredException], [], now);
+assert(activeGroups.active.length === 1, "only non-expired synced exceptions stay active");
+assert(activeGroups.active[0]?.id === activeException.id, "active exception id preserved from DTO");
+assert(!isCloudExceptionActive(expiredException, now), "expired exception is not active");
+
+const summary = summarizeCloudExceptions([activeException, expiredException], [pendingRequest], now);
+assert(summary.activeCount === 1, "summary counts only active synced exceptions");
+assert(summary.pendingCount === 1, "summary counts pending requests");
+
+assert(resolvePersonDisplayLabel(null) === "Unknown", "missing owner falls back safely");
+assert(resolvePersonInitials(undefined) === "UN", "missing approver initials fall back safely");
+
+const viewsSource = readFileSync(join(here, "policy-workspace-views.tsx"), "utf8");
+assert(viewsSource.includes("!cloudManaged"), "local remove action gated to non-cloud rules");
+assert(viewsSource.includes("canClear = onClear !== undefined && !cloudManaged"), "cloud exceptions cannot be removed locally");
+
+console.log("policy-data-truth.test.ts: all assertions passed");

plugin_scanner-2.0.677/dashboard/src/policy-ui-hardening.test.ts

@@ -0,0 +1,94 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readSource(relativePath: string): string {
+  return readFileSync(join(here, relativePath), "utf8");
+}
+
+const POLICY_UI_FILES = [
+  "policy-workspace.tsx",
+  "policy-cloud-exceptions-tab.tsx",
+  "policy-cloud-exceptions-list.tsx",
+  "policy-cloud-exceptions-summary.tsx",
+  "policy-cloud-exception-detail-panel.tsx",
+  "policy-cloud-exception-request-panel.tsx",
+  "policy-strict-config-tab.tsx",
+];
+
+const MOCKUP_FIXTURE_PATTERNS = [
+  /\bLorem ipsum\b/i,
+  /\bMock Exception\b/i,
+  /\bSample Exception\b/i,
+  /\bPlaceholder Owner\b/i,
+  /\bDemo User\b/i,
+  /\bfixture-row\b/i,
+  /\bhardcodedCount\s*=\s*\d+/,
+];
+
+const HARDCODED_EXCEPTION_ROW_PATTERNS = [
+  /\[\s*\{\s*id:\s*["']artifact:/,
+  /const\s+(MOCK|FAKE|SAMPLE)_EXCEPTIONS\s*=/,
+  /defaultExceptions\s*=\s*\[/,
+];
+
+const HARDCODED_METRIC_PATTERNS = [
+  /activeCount=\{\d+\}/,
+  /pendingCount=\{\d+\}/,
+  /value=\{\d+\}.*(?:Active|Pending|Expiring)/,
+  /sha256:[a-f0-9]{32,}/i,
+  /2026-0[1-9]-[0-3]\dT[0-2]\d:/,
+];
+
+for (const file of POLICY_UI_FILES) {
+  const source = readSource(file);
+  for (const pattern of MOCKUP_FIXTURE_PATTERNS) {
+    assert(!pattern.test(source), `${file} must not contain mockup fixture pattern ${pattern}`);
+  }
+  for (const pattern of HARDCODED_EXCEPTION_ROW_PATTERNS) {
+    assert(!pattern.test(source), `${file} must not hardcode exception rows ${pattern}`);
+  }
+  for (const pattern of HARDCODED_METRIC_PATTERNS) {
+    assert(!pattern.test(source), `${file} must not hardcode counts/dates/hashes ${pattern}`);
+  }
+}
+
+const workspaceSource = readSource("policy-workspace.tsx");
+assert(workspaceSource.includes('role="tablist"'), "policy tablist exposes tablist role");
+assert(workspaceSource.includes('role="tab"'), "policy tabs expose tab role");
+assert(workspaceSource.includes("tabIndex={activeView === view ? 0 : -1}"), "policy tabs use roving tabindex");
+assert(workspaceSource.includes("nextTab?.focus()") || workspaceSource.includes(".focus()"), "policy tablist moves focus on arrow keys");
+
+const listSource = readSource("policy-cloud-exceptions-list.tsx");
+assert(listSource.includes('aria-label="Cloud exception groups"'), "grouped list exposes list label");
+assert(listSource.includes("aria-pressed"), "exception cards expose selection state");
+
+const detailSource = readSource("policy-cloud-exception-detail-panel.tsx");
+assert(detailSource.includes('aria-label="Cloud exception details"'), "detail panel exposes label");
+
+const requestSource = readSource("policy-cloud-exception-request-panel.tsx");
+assert(requestSource.includes("Request cloud exception"), "request panel contains section title");
+assert(requestSource.includes("aria-labelledby=\"cloud-exception-request-title\""), "request panel exposes labelled heading");
+
+const tabSource = readSource("policy-cloud-exceptions-tab.tsx");
+assert(tabSource.includes("PolicyCloudExceptionsListSkeleton"), "cloud exceptions tab preserves loading layout");
+assert(
+  tabSource.includes("Local remembered rules and strict config still apply"),
+  "API error state preserves local protection message",
+);
+
+const summarySource = readSource("policy-cloud-exceptions-summary.tsx");
+assert(summarySource.includes("SummarySkeleton"), "summary cards preserve skeleton layout while loading");
+
+const strictSource = readSource("policy-strict-config-tab.tsx");
+assert(strictSource.includes("aria-busy"), "strict config tab exposes loading busy state");
+
+console.log("policy-ui-hardening.test.ts: all assertions passed");

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/dashboard/src/policy-workspace.tsx

@@ -1,7 +1,8 @@
-import { useCallback, useMemo, useState } from "react";
+import { useCallback, useMemo, useState, type KeyboardEvent } from "react";
 import { SectionLabel, Tag, ActionButton } from "./approval-center-primitives";
 import type { GuardPolicyDecision, GuardRuntimeSnapshot } from "./guard-types";
 import { PolicyCloudExceptionsTab } from "./policy-cloud-exceptions-tab";
+import { PolicyRememberedRulesTab } from "./policy-remembered-rules-tab";
 import { PolicyStrictConfigTab } from "./policy-strict-config-tab";
 import {
   resolveCloudBundleSurfaceClass,
@@ -12,6 +13,8 @@ import {
 
 export type PolicyPageView = "rules" | "exceptions" | "strict";
 
+const POLICY_VIEWS: PolicyPageView[] = ["rules", "exceptions", "strict"];
+
 export function resolvePolicyViewLabel(view: PolicyPageView): string {
   if (view === "rules") {
     return "Remembered rules";
@@ -54,6 +57,27 @@ export function PolicyWorkspace({
     setActiveView("exceptions");
   }, []);
 
+  const handleTabKeyDown = useCallback(
+    (event: KeyboardEvent<HTMLButtonElement>, view: PolicyPageView) => {
+      const index = POLICY_VIEWS.indexOf(view);
+      if (index < 0) {
+        return;
+      }
+      let nextView: PolicyPageView | undefined;
+      if (event.key === "ArrowRight") {
+        nextView = POLICY_VIEWS[(index + 1) % POLICY_VIEWS.length];
+      } else if (event.key === "ArrowLeft") {
+        nextView = POLICY_VIEWS[(index - 1 + POLICY_VIEWS.length) % POLICY_VIEWS.length];
+      }
+      if (nextView) {
+        event.preventDefault();
+        setActiveView(nextView);
+        document.getElementById(`policy-tab-${nextView}`)?.focus();
+      }
+    },
+    [],
+  );
+
   const modeCopy = useMemo(() => resolveSecurityModeCopy(snapshot.security_level), [snapshot.security_level]);
   const cloudBundleCopy = useMemo(() => resolveCloudPolicyBundleCopy(snapshot), [snapshot]);
 
@@ -84,13 +108,22 @@ export function PolicyWorkspace({
         ) : null}
       </div>
 
-      <div className="flex flex-wrap gap-2 border-b border-slate-100 pb-3">
-        {(["rules", "exceptions", "strict"] as const).map((view) => (
+      <div
+        className="flex flex-wrap gap-2 border-b border-slate-100 pb-3"
+        role="tablist"
+        aria-label="Policy sections"
+      >
+        {POLICY_VIEWS.map((view) => (
           <button
             key={view}
             type="button"
+            role="tab"
+            id={`policy-tab-${view}`}
+            aria-controls={`policy-panel-${view}`}
+            aria-selected={activeView === view}
+            tabIndex={activeView === view ? 0 : -1}
             onClick={() => handleViewChange(view)}
-            aria-pressed={activeView === view}
+            onKeyDown={(event) => handleTabKeyDown(event, view)}
             className={`rounded-full px-4 py-1.5 text-sm font-medium transition-colors focus:outline-none focus:ring-2 focus:ring-brand-blue/30 ${
               activeView === view
                 ? "bg-brand-blue text-white"
@@ -103,18 +136,26 @@ export function PolicyWorkspace({
       </div>
 
       {activeView === "rules" ? (
-        <PolicyRememberedRulesTab
-          policies={policies}
-          cloudControlsUrl={resolveCloudPolicyControlsUrl(snapshot)}
-          onClearPolicy={onClearPolicy}
-          onOpenCloudExceptions={handleOpenCloudExceptions}
-        />
+        <div id="policy-panel-rules" role="tabpanel" aria-labelledby="policy-tab-rules">
+          <PolicyRememberedRulesTab
+            policies={policies}
+            cloudControlsUrl={resolveCloudPolicyControlsUrl(snapshot)}
+            onClearPolicy={onClearPolicy}
+            onOpenCloudExceptions={handleOpenCloudExceptions}
+          />
+        </div>
       ) : null}
 
-      {activeView === "exceptions" ? <PolicyCloudExceptionsTab snapshot={snapshot} /> : null}
+      {activeView === "exceptions" ? (
+        <div id="policy-panel-exceptions" role="tabpanel" aria-labelledby="policy-tab-exceptions">
+          <PolicyCloudExceptionsTab snapshot={snapshot} />
+        </div>
+      ) : null}
 
       {activeView === "strict" ? (
-        <PolicyStrictConfigTab snapshot={snapshot} onOpenSettings={onOpenSettings} onOpenInbox={onOpenInbox} />
+        <div id="policy-panel-strict" role="tabpanel" aria-labelledby="policy-tab-strict">
+          <PolicyStrictConfigTab snapshot={snapshot} onOpenSettings={onOpenSettings} onOpenInbox={onOpenInbox} />
+        </div>
       ) : null}
     </div>
   );

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.675"
+version = "2.0.677"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.675"
+version = "2.0.677"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -87,100 +87,6 @@ def _run_mcp_inventory_scan(
     )
 
 
-def _run_skill_inventory_scan(
-    *,
-    harness: str,
-    context: HarnessContext,
-    detection: object,
-    mode: str,
-    timeout_seconds: float | None,
-) -> CiscoInventoryRun:
-    roots = _skill_scan_roots(harness=harness, context=context, detection=detection)
-    if not roots:
-        return CiscoInventoryRun(
-            source="cisco-skill-scanner",
-            status="skipped",
-            message="No skill directory found; Cisco skill inventory scan skipped.",
-            findings=(),
-            duration_ms=0,
-            metadata={"target": "missing", "skillsScanned": 0, "mode": mode},
-        )
-    if len(roots) == 1:
-        return _run_single_skill_inventory_scan(root=roots[0], mode=mode, timeout_seconds=timeout_seconds)
-
-    findings: list[Finding] = []
-    severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}
-    analyzers_used: list[str] = []
-    skills_scanned = 0
-    skills_skipped: list[str] = []
-    duration_ms = 0
-    failure_message: str | None = None
-
-    for root in roots:
-        run = _run_single_skill_inventory_scan(root=root, mode=mode, timeout_seconds=timeout_seconds)
-        duration_ms += run.duration_ms
-        metadata = run.metadata if isinstance(run.metadata, dict) else {}
-        for finding in run.findings:
-            findings.append(finding)
-        raw_counts = metadata.get("findingsBySeverity")
-        if isinstance(raw_counts, dict):
-            for key in severity_counts:
-                value = raw_counts.get(key)
-                if isinstance(value, int):
-                    severity_counts[key] += value
-        raw_analyzers = metadata.get("analyzersUsed")
-        if isinstance(raw_analyzers, list):
-            for analyzer in raw_analyzers:
-                if isinstance(analyzer, str) and analyzer and analyzer not in analyzers_used:
-                    analyzers_used.append(analyzer)
-        raw_scanned = metadata.get("skillsScanned")
-        if isinstance(raw_scanned, int):
-            skills_scanned += raw_scanned
-        raw_skipped = metadata.get("skillsSkipped")
-        if isinstance(raw_skipped, list):
-            for entry in raw_skipped:
-                if isinstance(entry, str) and entry:
-                    skills_skipped.append(entry)
-        if run.status in {"failed", "timed_out", "unavailable"}:
-            failure_message = run.message
-            return CiscoInventoryRun(
-                source="cisco-skill-scanner",
-                status=run.status,
-                message=failure_message,
-                findings=tuple(findings),
-                duration_ms=duration_ms,
-                metadata={
-                    "target": str(roots[0].parent),
-                    "skillsScanned": skills_scanned,
-                    "skillsSkipped": tuple(skills_skipped),
-                    "totalFindings": len(findings),
-                    "findingsBySeverity": severity_counts,
-                    "analyzersUsed": tuple(analyzers_used),
-                    "policyName": metadata.get("policyName", "balanced"),
-                    "mode": mode,
-                },
-            )
-
-    return CiscoInventoryRun(
-        source="cisco-skill-scanner",
-        status="enabled",
-        message="Cisco skill scan completed.",
-        findings=tuple(findings),
-        duration_ms=duration_ms,
-        metadata={
-            "target": str(roots[0].parent),
-            "skillsScanned": skills_scanned,
-            "skillsSkipped": tuple(skills_skipped),
-            "totalFindings": len(findings),
-            "findingsBySeverity": severity_counts,
-            "analyzersUsed": tuple(analyzers_used),
-            "policyName": "balanced",
-            "mode": mode,
-            "skillTargets": [str(root) for root in roots],
-        },
-    )
-
-
 def _run_skill_inventory_scans(
     *,
     harness: str,
@@ -283,8 +189,12 @@ def _artifact_skill_root(artifact: object, *, context: HarnessContext) -> Path |
                 if base_dir is None:
                     continue
                 candidate = (base_dir / skill_root).resolve()
-                if candidate.is_dir() and (candidate / "SKILL.md").is_file():
-                    return candidate
+                if candidate.is_dir():
+                    nested_skill_dirs = _skill_dirs_under(candidate)
+                    if len(nested_skill_dirs) == 1:
+                        return nested_skill_dirs[0]
+                    if (candidate / "SKILL.md").is_file():
+                        return candidate
     config_path = getattr(artifact, "config_path", None)
     if not isinstance(config_path, str):
         return None
@@ -313,13 +223,6 @@ def _skill_dirs_under(root: Path) -> tuple[Path, ...]:
     return tuple(skill_dirs)
 
 
-def _nearest_skills_root(path: Path) -> Path | None:
-    for parent in path.parents:
-        if parent.name == "skills":
-            return parent
-    return None
-
-
 def _nearest_skill_dir(path: Path) -> Path | None:
     if path.name == "SKILL.md":
         return path.parent

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.675"
+__version__ = "2.0.677"

{plugin_scanner-2.0.675 → plugin_scanner-2.0.677}/tests/test_guard_inventory_cisco.py

@@ -236,6 +236,62 @@ def test_cisco_inventory_scans_use_detected_nonstandard_skill_roots(tmp_path: Pa
     assert calls == [skill_path.parent]
 
 
+def test_cisco_inventory_scans_resolve_skill_root_collection_directories(tmp_path: Path, monkeypatch) -> None:
+    context = _ctx(tmp_path)
+    home_dir = context.home_dir
+    assert home_dir is not None
+    collection_root = home_dir / "shared-openclaw-skills"
+    skill_path = collection_root / "reviewer" / "SKILL.md"
+    skill_path.parent.mkdir(parents=True)
+    skill_path.write_text("---\nname: reviewer\n---\nReview local files.\n")
+    detection = HarnessDetection(
+        harness="openclaw",
+        installed=True,
+        command_available=False,
+        config_paths=(),
+        artifacts=(
+            GuardArtifact(
+                artifact_id="openclaw:skill:extra:reviewer",
+                name="reviewer",
+                harness="openclaw",
+                artifact_type="skill",
+                source_scope="global",
+                config_path=str(collection_root),
+                metadata={"skill_root": str(collection_root)},
+            ),
+        ),
+    )
+    calls: list[Path] = []
+
+    def fake_skill_scan(skills_dir: Path, mode: str, timeout_seconds: float | None = None) -> _SkillSummary:
+        del mode, timeout_seconds
+        calls.append(skills_dir)
+        return _SkillSummary(
+            status=CiscoIntegrationStatus.ENABLED,
+            message="Skill scanner completed.",
+            findings=(),
+            skills_scanned=1,
+            skills_skipped=(),
+            analyzers_used=("prompt-injection",),
+            policy_name="balanced",
+            total_findings=0,
+            findings_by_severity={severity.value: 0 for severity in Severity},
+        )
+
+    monkeypatch.setattr("codex_plugin_scanner.guard.inventory_cisco.run_cisco_skill_scan", fake_skill_scan)
+
+    runs = run_cisco_inventory_scans(
+        harness="openclaw",
+        context=context,
+        detection=detection,
+        skill_mode="auto",
+    )
+
+    assert [run.source for run in runs] == ["cisco-skill-scanner"]
+    assert calls == [skill_path.parent]
+    assert [run.metadata["target"] for run in runs] == [str(skill_path.parent)]
+
+
 def test_cisco_inventory_scans_runs_each_detected_skill_root(tmp_path: Path, monkeypatch) -> None:
     context = _ctx(tmp_path)
     home_dir = context.home_dir