plugin-scanner 2.0.680__tar.gz → 2.0.682__tar.gz

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.680
+Version: 2.0.682
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.682/dashboard/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "hol-guard-dashboard",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "test": "tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test:e2e": "playwright test",
+    "dev": "vite dev"
+  },
+  "dependencies": {
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-qr-code": "^2.0.16",
+    "react-icons": "^5.6.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.50.0",
+    "@tailwindcss/vite": "^4.1.4",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^5.0.4",
+    "tailwindcss": "^4.1.4",
+    "tsx": "^4.8.1",
+    "typescript": "^5.9.3",
+    "vite": "^7.1.10"
+  }
+}

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/dashboard/src/audit-workspace.tsx

@@ -18,7 +18,8 @@ import {
 import { SectionLabel, Badge, Tag, ActionButton, IconActionButton, EmptyState } from "./approval-center-primitives";
 import { ApprovalProofModal } from "./approval-proof-modal";
 import { formatRelativeTime, harnessDisplayName } from "./approval-center-utils";
-import { GuardHarnessActionError, runAuditRemediation, guardAwareHref } from "./guard-api";
+import { runAuditRemediation, guardAwareHref } from "./guard-api";
+import { isApprovalGateRequiredError } from "./harness-action-errors";
 import type { AuditRemediationAction } from "./guard-api";
 import type { GuardApprovalGatePublicConfig, GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
 import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
@@ -470,11 +471,7 @@ export function AuditWorkspace({ snapshot, receipts, approvalGate }: AuditWorksp
           [result.id]: "Remediation completed. Restart your shell before retrying package installs.",
         }));
       } catch (error) {
-        if (
-          credentials === undefined &&
-          error instanceof GuardHarnessActionError &&
-          error.payload?.error === "approval_gate_required"
-        ) {
+        if (credentials === undefined && isApprovalGateRequiredError(error)) {
           await resolveApprovalGate();
           setPendingRemediation(result);
           setRemediationMessages((prev) => {

plugin_scanner-2.0.682/dashboard/src/harness-action-errors.test.ts

@@ -0,0 +1,114 @@
+import { GuardHarnessActionError } from "./guard-api";
+import {
+  isApprovalGateRequiredError,
+  isGuardHarnessActionError,
+  resolveApprovalGateSyncFailure,
+} from "./harness-action-errors";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function makeHarnessError(
+  status: number,
+  payload: { error: string; message?: string } | null,
+): GuardHarnessActionError {
+  return new GuardHarnessActionError(status, payload);
+}
+
+function makeDuckTypedHarnessError(
+  status: number,
+  payload: { error: string; message?: string } | null,
+): GuardHarnessActionError {
+  const error = makeHarnessError(status, payload);
+  return Object.assign(Object.create(GuardHarnessActionError.prototype), error);
+}
+
+assert(
+  isGuardHarnessActionError(makeHarnessError(403, { error: "approval_gate_required" })),
+  "instanceof GuardHarnessActionError is recognized",
+);
+assert(
+  isGuardHarnessActionError(
+    makeDuckTypedHarnessError(403, {
+      error: "approval_gate_required",
+      message: "Approval password is required.",
+    }),
+  ),
+  "duck-typed GuardHarnessActionError is recognized",
+);
+assert(
+  isApprovalGateRequiredError(
+    makeHarnessError(403, {
+      error: "approval_gate_required",
+      message: "Approval password is required.",
+    }),
+  ),
+  "approval_gate_required code is detected",
+);
+assert(
+  isApprovalGateRequiredError(
+    makeHarnessError(403, {
+      error: "Approval password is required.",
+    }),
+  ),
+  "human-readable error field is detected",
+);
+assert(
+  isApprovalGateRequiredError(
+    makeDuckTypedHarnessError(403, {
+      error: "approval_gate_required",
+      message: "Approval password is required.",
+    }),
+  ),
+  "duck-typed approval_gate_required is detected",
+);
+assert(
+  isApprovalGateRequiredError(
+    makeHarnessError(403, {
+      error: "approval_gate_password_required",
+      message: "Approval gate password is required.",
+    }),
+  ),
+  "approval_gate_password_required code is detected",
+);
+assert(
+  isApprovalGateRequiredError(
+    makeHarnessError(403, {
+      error: "approval_gate_totp_required",
+      message: "TOTP code is required.",
+    }),
+  ),
+  "approval_gate_totp_required code is detected",
+);
+assert(
+  isApprovalGateRequiredError(new Error("Approval password is required.")),
+  "plain Error message fallback is detected",
+);
+assert(
+  !isApprovalGateRequiredError(makeHarnessError(403, { error: "approval_gate_locked" })),
+  "locked gate is not treated as missing password",
+);
+
+const withoutCredentials = resolveApprovalGateSyncFailure(
+  makeHarnessError(403, {
+    error: "Approval password is required.",
+  }),
+);
+assert(
+  withoutCredentials.kind === "approval_required",
+  "missing credentials route to approval step",
+);
+
+const withCredentials = resolveApprovalGateSyncFailure(
+  makeHarnessError(403, {
+    error: "approval_gate_required",
+    message: "Approval password is required.",
+  }),
+  { hasCredentials: true },
+);
+assert(withCredentials.kind === "failed", "wrong password stays on approval form with error");
+
+console.log("harness-action-errors.test.ts: all assertions passed");

plugin_scanner-2.0.682/dashboard/src/harness-action-errors.ts

@@ -0,0 +1,99 @@
+import { GuardHarnessActionError } from "./guard-api";
+
+const APPROVAL_GATE_REQUIRED_CODES = new Set([
+  "approval_gate_required",
+  "approval_gate_password_required",
+  "approval_gate_totp_required",
+]);
+
+const APPROVAL_GATE_NON_CREDENTIAL_CODES = new Set([
+  "approval_gate_locked",
+  "approval_gate_invalid_password",
+  "approval_gate_totp_invalid",
+  "approval_gate_recovery_required",
+  "approval_gate_weak_password",
+]);
+
+const APPROVAL_CREDENTIAL_PROMPT_MESSAGE =
+  /approval(?:\s+gate)?\s+password is required|totp code is required/i;
+
+export function isGuardHarnessActionError(error: unknown): error is GuardHarnessActionError {
+  if (error instanceof GuardHarnessActionError) {
+    return true;
+  }
+  if (typeof error !== "object" || error === null) {
+    return false;
+  }
+  const candidate = error as GuardHarnessActionError;
+  return candidate.name === "GuardHarnessActionError" && typeof candidate.status === "number";
+}
+
+export function readHarnessActionErrorCode(error: unknown): string | null {
+  if (!isGuardHarnessActionError(error)) {
+    return null;
+  }
+  const code = error.payload?.error;
+  if (typeof code !== "string") {
+    return null;
+  }
+  const trimmed = code.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+export function readHarnessActionErrorMessage(error: unknown): string | null {
+  if (!isGuardHarnessActionError(error)) {
+    if (error instanceof Error && error.message.trim()) {
+      return error.message.trim();
+    }
+    return null;
+  }
+  const message = error.payload?.message ?? error.message;
+  if (typeof message !== "string") {
+    return null;
+  }
+  const trimmed = message.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function isApprovalCredentialPromptCode(code: string | null): boolean {
+  if (code === null) {
+    return false;
+  }
+  if (APPROVAL_GATE_REQUIRED_CODES.has(code)) {
+    return true;
+  }
+  return APPROVAL_CREDENTIAL_PROMPT_MESSAGE.test(code);
+}
+
+export function isApprovalGateRequiredError(error: unknown): boolean {
+  const code = readHarnessActionErrorCode(error);
+  if (code !== null && APPROVAL_GATE_NON_CREDENTIAL_CODES.has(code)) {
+    return false;
+  }
+  if (isApprovalCredentialPromptCode(code)) {
+    return true;
+  }
+  const message = readHarnessActionErrorMessage(error);
+  if (message !== null && APPROVAL_CREDENTIAL_PROMPT_MESSAGE.test(message)) {
+    return true;
+  }
+  return false;
+}
+
+export type ApprovalGateSyncFailureResolution =
+  | { kind: "approval_required" }
+  | { kind: "failed"; message: string };
+
+export function resolveApprovalGateSyncFailure(
+  error: unknown,
+  options?: { hasCredentials?: boolean },
+): ApprovalGateSyncFailureResolution {
+  const hasCredentials = options?.hasCredentials === true;
+  if (!hasCredentials && isApprovalGateRequiredError(error)) {
+    return { kind: "approval_required" };
+  }
+  return {
+    kind: "failed",
+    message: readHarnessActionErrorMessage(error) ?? "Sync failed.",
+  };
+}

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/dashboard/src/policy-cloud-exception-detail-panel.tsx

@@ -34,9 +34,9 @@ function PersonRow({
       >
         {initials}
       </span>
-      <div>
+      <div className="min-w-0">
         <p className="text-xs font-medium uppercase tracking-wide text-slate-500">{label}</p>
-        <p className="text-sm font-medium text-brand-dark">{display}</p>
+        <p className="break-words text-sm font-medium text-brand-dark">{display}</p>
       </div>
     </div>
   );
@@ -88,13 +88,13 @@ export function PolicyCloudExceptionDetailPanel({
 
   return (
     <aside
-      className="rounded-2xl border border-slate-200 bg-white p-5 shadow-sm"
+      className="min-w-0 rounded-2xl border border-slate-200 bg-white p-5 shadow-sm"
       aria-label="Cloud exception details"
     >
-      <div className="mb-4 flex items-start justify-between gap-3">
-        <div>
+      <div className="mb-4 flex min-w-0 items-start justify-between gap-3">
+        <div className="min-w-0 flex-1">
           <SectionLabel>Exception detail</SectionLabel>
-          <h3 className="mt-1 text-lg font-semibold text-brand-dark">{headline}</h3>
+          <h3 className="mt-1 break-words text-lg font-semibold text-brand-dark">{headline}</h3>
         </div>
         <button
           type="button"

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/dashboard/src/policy-cloud-exceptions-list.tsx

@@ -82,7 +82,7 @@ function ExceptionCard({
       type="button"
       onClick={handleSelect}
       aria-pressed={selected}
-      className={`w-full rounded-xl border px-3.5 py-3 text-left transition ${
+      className={`min-w-0 w-full rounded-xl border px-3.5 py-3 text-left transition ${
         selected
           ? "border-brand-blue/30 bg-brand-blue/[0.04] ring-1 ring-brand-blue/20"
           : "border-slate-100 bg-white hover:border-brand-blue/20 hover:bg-brand-blue/[0.02]"
@@ -93,8 +93,8 @@ function ExceptionCard({
         <Tag tone="slate">{scopeLabel(item.scope)}</Tag>
         {isCloudExceptionAckFailure(item) ? <Badge tone="warning">Ack issue</Badge> : null}
       </div>
-      <p className="mt-2 text-sm font-semibold text-brand-dark">{headline}</p>
-      <p className="mt-1 text-xs text-slate-500">
+      <p className="mt-2 break-words text-sm font-semibold text-brand-dark">{headline}</p>
+      <p className="mt-1 break-words text-xs text-slate-500">
         Owner {resolvePersonDisplayLabel(item.owner)}
         {expiryTimestamp && expiryValue ? ` · expires ${formatRelativeTime(expiryValue)}` : null}
       </p>
@@ -104,13 +104,13 @@ function ExceptionCard({
 
 function PendingRequestCard({ item }: { item: GuardCloudExceptionRequestItem }) {
   return (
-    <article className="rounded-xl border border-amber-100 bg-amber-50/40 px-3.5 py-3">
+    <article className="min-w-0 rounded-xl border border-amber-100 bg-amber-50/40 px-3.5 py-3">
       <div className="flex flex-wrap items-center gap-2">
         <Badge tone="warning">Pending</Badge>
         <Tag tone="slate">{scopeLabel(item.scope)}</Tag>
       </div>
-      <p className="mt-2 text-sm font-semibold text-brand-dark">{item.reason}</p>
-      <p className="mt-1 text-xs text-slate-600">
+      <p className="mt-2 break-words text-sm font-semibold text-brand-dark">{item.reason}</p>
+      <p className="mt-1 break-words text-xs text-slate-600">
         Requested by {resolvePersonDisplayLabel(item.owner)} · expires{" "}
         {formatRelativeTime(item.requestedExpiresAt)}
       </p>

plugin_scanner-2.0.682/dashboard/src/policy-final-release-guard.test.ts

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+const POLICY_RELEASE_FILES = [
+  "policy-workspace.tsx",
+  "policy-workspace-page.tsx",
+  "policy-cloud-exceptions-tab.tsx",
+  "policy-cloud-exceptions-list.tsx",
+  "policy-cloud-exceptions-summary.tsx",
+  "policy-cloud-exception-detail-panel.tsx",
+  "policy-cloud-exception-request-panel.tsx",
+  "policy-strict-config-tab.tsx",
+  "policy-workspace-helpers.ts",
+];
+
+for (const fileName of POLICY_RELEASE_FILES) {
+  const filePath = join(here, fileName);
+  assert(existsSync(filePath), `missing policy release file: ${fileName}`);
+  const source = readFileSync(filePath, "utf8");
+  assert(!/\bbypass\b/i.test(source), `${fileName} must not use bypass copy`);
+}
+
+const listSource = readFileSync(join(here, "policy-cloud-exceptions-list.tsx"), "utf8");
+const detailSource = readFileSync(join(here, "policy-cloud-exception-detail-panel.tsx"), "utf8");
+const tabSource = readFileSync(join(here, "policy-cloud-exceptions-tab.tsx"), "utf8");
+
+assert(listSource.includes("min-w-0"), "exception list cards constrain width in grid layouts");
+assert(detailSource.includes("break-words"), "exception detail panel guards long copy overflow");
+assert(tabSource.includes("lg:grid-cols-[minmax(0,1fr)_320px]"), "cloud exceptions tab keeps responsive split layout");
+
+console.log("policy-final-release-guard.test.ts: all assertions passed");

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/dashboard/src/supply-chain-audit-recovery.ts

@@ -30,6 +30,21 @@ const SYNC_RECOVERY_STEPS = [
   },
 ] as const;
 
+export function createSupplyChainSyncApprovalGate(options?: {
+  autoRetryAuditAfterPrimary?: boolean;
+}): SupplyChainAuditRecoveryGate {
+  return {
+    obstacle: "sync_required",
+    headline: "Sync supply-chain intel before auditing",
+    detail:
+      "Enter your local approval password so Guard can download the latest signed supply-chain bundle on this device.",
+    steps: [...SYNC_RECOVERY_STEPS],
+    primaryAction: "sync",
+    primaryLabel: "Sync supply-chain intel",
+    autoRetryAuditAfterPrimary: options?.autoRetryAuditAfterPrimary ?? false,
+  };
+}
+
 export function resolveSupplyChainAuditRecoveryGate(
   detail: unknown,
 ): SupplyChainAuditRecoveryGate | null {

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -10,13 +10,16 @@ import type {
 } from "./guard-types";
 import {
   fetchPackageFirewallStatus,
-  GuardHarnessActionError,
   openPackageFirewallShell,
   runPackageFirewallAction,
   runPackageAudit,
   runPackageSync,
   startPackageFirewallConnect,
 } from "./guard-api";
+import {
+  isApprovalGateRequiredError,
+  resolveApprovalGateSyncFailure,
+} from "./harness-action-errors";
 import { EntitlementNotice, ConnectFlowCard } from "./supply-chain-firewall-views";
 import type { CompletedOp } from "./supply-chain-firewall-views";
 import {
@@ -38,7 +41,7 @@ import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
 import { parseInterceptProofSnapshot, type InterceptProofSnapshot } from "./supply-chain-firewall-action-result";
 import { InterceptProofModal } from "./supply-chain-intercept-proof-modal";
 import { SupplyChainManagerDrawer } from "./supply-chain-manager-drawer";
-import { resolveSupplyChainAuditRecoveryGate, type SupplyChainAuditRecoveryGate } from "./supply-chain-audit-recovery";
+import { resolveSupplyChainAuditRecoveryGate, createSupplyChainSyncApprovalGate, type SupplyChainAuditRecoveryGate } from "./supply-chain-audit-recovery";
 import {
   AuditRecoveryModal,
   type AuditRecoveryModalPhase,
@@ -192,6 +195,21 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
   const [auditRecoveryError, setAuditRecoveryError] = useState<string | null>(null);
   const { resolvedApprovalGate, resolveApprovalGate } = useResolvedApprovalGate(approvalGate);
 
+  const openSyncApprovalRecovery = useCallback(
+    async (options?: { autoRetryAuditAfterPrimary?: boolean }) => {
+      await resolveApprovalGate();
+      setAuditRecoveryGate(
+        createSupplyChainSyncApprovalGate({
+          autoRetryAuditAfterPrimary:
+            options?.autoRetryAuditAfterPrimary ?? auditRecoveryGate?.autoRetryAuditAfterPrimary ?? false,
+        }),
+      );
+      setAuditRecoveryPhase("approval");
+      setAuditRecoveryError(null);
+    },
+    [resolveApprovalGate],
+  );
+
   const closeAuditRecovery = useCallback(() => {
     setAuditRecoveryGate(null);
     setAuditRecoveryPhase("ready");
@@ -364,28 +382,26 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
           setAuditRecoveryError(null);
           return;
         }
-        if (
-          credentials === undefined &&
-          err instanceof GuardHarnessActionError &&
-          err.payload?.error === "approval_gate_required"
-        ) {
-          await resolveApprovalGate();
-          setAuditRecoveryPhase("approval");
-          setAuditRecoveryError(null);
+        const failure = resolveApprovalGateSyncFailure(err, {
+          hasCredentials: credentials !== undefined,
+        });
+        if (failure.kind === "approval_required") {
+          await openSyncApprovalRecovery({
+            autoRetryAuditAfterPrimary: auditRecoveryGate?.autoRetryAuditAfterPrimary ?? true,
+          });
           return;
         }
-        const message = err instanceof Error ? err.message : "Sync failed.";
-        setAuditRecoveryError(message);
+        setAuditRecoveryError(failure.message);
         setAuditRecoveryPhase(credentials === undefined ? "failed" : "approval");
-        setLastFailed({ op: "sync", manager: null, message });
+        setLastFailed({ op: "sync", manager: null, message: failure.message });
       }
     },
     [
       auditRecoveryGate,
       continueAuditAfterRecovery,
       onStateChanged,
+      openSyncApprovalRecovery,
       refreshAfterOp,
-      resolveApprovalGate,
     ],
   );
 
@@ -535,8 +551,7 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
         if (
           credentials === undefined &&
           manager !== null &&
-          err instanceof GuardHarnessActionError &&
-          err.payload?.error === "approval_gate_required"
+          isApprovalGateRequiredError(err)
         ) {
           await resolveApprovalGate();
           setPendingApprovalOp({ op, manager });
@@ -571,13 +586,17 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
         await refreshAfterOp();
         await onStateChanged?.();
       } catch (err) {
+        if (isApprovalGateRequiredError(err)) {
+          await openSyncApprovalRecovery();
+          return;
+        }
         const message = err instanceof Error ? err.message : "Operation failed.";
         setLastFailed({ op, manager: null, message });
       } finally {
         setPendingOp(null);
       }
     },
-    [onStateChanged, openAuditConnectGate, panelLoad, refreshAfterOp, runAuditOperation],
+    [onStateChanged, openAuditConnectGate, openSyncApprovalRecovery, panelLoad, refreshAfterOp, runAuditOperation],
   );
 
   const handleInstall = useCallback(

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/docs/guard/policy-cloud-exceptions-boundary.md

@@ -177,3 +177,29 @@ Do not rewrite Review/Inbox components to implement Policy features.
 Phase 0 delivers this boundary doc, audit notes, and automated boundary tests.
 Phase 3 adds the local Cloud exception DTO (`cloud_exceptions.py`), separate sync
 storage, and `/v1/policy` + `/v1/policy/cloud-exceptions` API fields.
+
+## Final architecture (2026-06-14)
+
+Implementation is complete across local dashboard, daemon, and Guard Cloud bundle
+delivery:
+
+| Layer | Delivered behavior |
+| --- | --- |
+| **Policy tabs** | Remembered rules, Cloud exceptions, Strict config |
+| **Cloud exceptions UI** | Summary cards, grouped lists, detail panel, in-dashboard request flow, disconnected/error/loading states |
+| **Strict config** | Local fallback controls, simulator, evaluation order, bundle ack copy |
+| **Local daemon** | Validates signed bundles, persists active Cloud exceptions, rejects tampered/wrong-workspace payloads |
+| **Guard Cloud bundle** | Active exceptions compiled into `cloudExceptions` on receipt sync; expired/revoked rows omitted |
+| **Integrity** | Bundle hash/signing excludes `cloudExceptions` so local parser verification stays aligned |
+
+Release audit command:
+
+```bash
+./scripts/run-policy-cloud-exceptions-release-audit.sh
+```
+
+Focused portal contract proof:
+
+```bash
+pnpm test -- __tests__/guard-policy-cloud-exceptions-sync.test.ts
+```

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.680"
+version = "2.0.682"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.680"
+version = "2.0.682"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.682/scripts/run-policy-cloud-exceptions-release-audit.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+git diff --check
+
+python3 -m pytest tests/test_cloud_exception_sync_proof.py tests/test_guard_cloud_exceptions.py -q
+
+cd dashboard
+npx tsx src/policy-final-release-guard.test.ts
+npx tsx src/policy-cloud-exceptions-ia.test.tsx
+npx tsx src/policy-data-truth.test.ts
+npx tsx src/policy-ui-hardening.test.ts
+npx tsx src/policy-review-scope.test.ts
+
+echo "policy cloud exceptions release audit: ok"

{plugin_scanner-2.0.680 → plugin_scanner-2.0.682}/src/codex_plugin_scanner/guard/daemon/static/assets/chunks/audit-workspace.js

@@ -1,5 +1,5 @@
-import { r as reactExports, b9 as runAuditRemediation, au as GuardHarnessActionError, j as jsxRuntimeExports, B as Badge, S as SectionLabel, ad as HiMiniMagnifyingGlass, b as EmptyState, d as HiMiniCheckCircle, I as HiMiniXCircle, w as HiMiniExclamationTriangle, h as harnessDisplayName, m as formatRelativeTime, y as HiMiniChevronRight, A as ActionButton, ba as HiMiniDocumentText, bb as guardAwareHref, aI as IconActionButton, aw as HiMiniArrowPath, l as HiMiniShieldCheck } from "../guard-dashboard.js";
-import { u as useResolvedApprovalGate, r as resolveManagerCoverageStatus, A as ApprovalProofModal } from "./supply-chain-protection-stats.js";
+import { r as reactExports, b9 as runAuditRemediation, j as jsxRuntimeExports, B as Badge, S as SectionLabel, ad as HiMiniMagnifyingGlass, b as EmptyState, d as HiMiniCheckCircle, I as HiMiniXCircle, w as HiMiniExclamationTriangle, h as harnessDisplayName, m as formatRelativeTime, y as HiMiniChevronRight, A as ActionButton, ba as HiMiniDocumentText, bb as guardAwareHref, aI as IconActionButton, aw as HiMiniArrowPath, l as HiMiniShieldCheck } from "../guard-dashboard.js";
+import { u as useResolvedApprovalGate, i as isApprovalGateRequiredError, c as resolveManagerCoverageStatus, a as ApprovalProofModal } from "./supply-chain-protection-stats.js";
 function isSupplyChainAuditEvidence(value) {
   return typeof value === "object" && value !== null && value.operation === "audit";
 }
@@ -335,7 +335,7 @@ function AuditWorkspace({ snapshot, receipts, approvalGate }) {
           [result.id]: "Remediation completed. Restart your shell before retrying package installs."
         }));
       } catch (error) {
-        if (credentials === void 0 && error instanceof GuardHarnessActionError && error.payload?.error === "approval_gate_required") {
+        if (credentials === void 0 && isApprovalGateRequiredError(error)) {
           await resolveApprovalGate();
           setPendingRemediation(result);
           setRemediationMessages((prev) => {