plugin-scanner 2.0.716__tar.gz → 2.0.718__tar.gz

{plugin_scanner-2.0.716 → plugin_scanner-2.0.718}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.716
+Version: 2.0.718
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.716 → plugin_scanner-2.0.718}/dashboard/src/package-workbench-panel.tsx

@@ -136,9 +136,11 @@ function FindingDetailPanel({ finding }: FindingDetailPanelProps) {
             </span>
           ))}
         </div>
-        <p className="mt-2 text-[11px] text-slate-500">
-          CVE and GHSA aliases are stubbed here until linked advisory intel is available in Guard Cloud.
-        </p>
+        {finding.advisoryAliases.length === 0 ? (
+          <p className="mt-2 text-[11px] text-slate-500">
+            No linked CVE or GHSA aliases for this finding.
+          </p>
+        ) : null}
       </div>
     </div>
   );

{plugin_scanner-2.0.716 → plugin_scanner-2.0.718}/dashboard/src/policy-cloud-exception-detail-panel.tsx

@@ -1,4 +1,9 @@
-import { HiMiniCloudArrowUp, HiMiniXMark } from "react-icons/hi2";
+import {
+  HiMiniCheckCircle,
+  HiMiniCloudArrowUp,
+  HiMiniDocumentText,
+  HiMiniXMark,
+} from "react-icons/hi2";
 import { ActionButton, Badge, SectionLabel, Tag } from "./approval-center-primitives";
 import { formatRelativeTime, scopeLabel } from "./approval-center-utils";
 import type { GuardCloudException } from "./guard-types";
@@ -6,9 +11,12 @@ import {
   isCloudExceptionAckFailure,
   isCloudExceptionActive,
   resolveCloudExceptionBlastRadius,
+  resolveCloudExceptionEffectLabel,
+  resolveCloudExceptionEvidenceUrl,
   resolveCloudExceptionExpiryTimestamp,
   resolveCloudExceptionExpiryValue,
   resolveCloudExceptionHeadline,
+  resolveCloudExceptionScopePath,
   resolveCloudExceptionWhyCopy,
   resolvePersonDisplayLabel,
   resolvePersonInitials,
@@ -59,7 +67,7 @@ function DetailField({ label, value }: { label: string; value: string | null | u
 
 function resolveAckCopy(item: GuardCloudException): { label: string; detail: string } {
   if (item.ack_status === "synced") {
-    return { label: "Synced", detail: "This device acknowledged the signed policy bundle." };
+    return { label: "Acknowledged", detail: "This device acknowledged the signed policy bundle." };
   }
   if (item.ack_status === "pending") {
     return { label: "Pending ack", detail: "Waiting for this device to acknowledge the signed bundle on next sync." };
@@ -79,6 +87,40 @@ function resolveAckCopy(item: GuardCloudException): { label: string; detail: str
   return { label: "Unknown", detail: "Local acknowledgement status is unavailable." };
 }
 
+function ExpiryTimeline({
+  expiryTimestamp,
+  expiryValue,
+}: {
+  expiryTimestamp: Date | null;
+  expiryValue: string | null;
+}) {
+  if (!expiryTimestamp || !expiryValue) {
+    return null;
+  }
+  return (
+    <div className="mt-3">
+      <div className="flex items-center justify-between text-[11px] font-medium text-slate-500">
+        <span>Approved</span>
+        <span>Expires {formatRelativeTime(expiryValue)}</span>
+      </div>
+      <div className="mt-2 h-1.5 overflow-hidden rounded-full bg-slate-200">
+        <div className="h-full w-full animate-pulse rounded-full bg-brand-blue/40" aria-hidden="true" />
+      </div>
+      <p className="mt-2 text-xs text-slate-600">{expiryTimestamp.toLocaleString()}</p>
+    </div>
+  );
+}
+
+function blastRadiusBadgeTone(tone: ReturnType<typeof resolveCloudExceptionBlastRadius>["tone"]) {
+  if (tone === "narrow") {
+    return "success" as const;
+  }
+  if (tone === "medium") {
+    return "warning" as const;
+  }
+  return "destructive" as const;
+}
+
 export function PolicyCloudExceptionDetailPanel({
   exception,
   cloudControlsUrl,
@@ -92,6 +134,9 @@ export function PolicyCloudExceptionDetailPanel({
   const whyCopy = resolveCloudExceptionWhyCopy(exception);
   const isActive = isCloudExceptionActive(exception);
   const isEnforcedLocally = exception.ack_status === "synced";
+  const evidenceUrl = resolveCloudExceptionEvidenceUrl(exception);
+  const scopePath = resolveCloudExceptionScopePath(exception);
+  const effectLabel = resolveCloudExceptionEffectLabel(exception.effect);
 
   return (
     <aside
@@ -100,8 +145,9 @@ export function PolicyCloudExceptionDetailPanel({
     >
       <div className="mb-4 flex min-w-0 items-start justify-between gap-3">
         <div className="min-w-0 flex-1">
-          <SectionLabel>Cloud exception</SectionLabel>
+          <SectionLabel>Temporary cloud exception</SectionLabel>
           <h3 className="mt-1 break-words text-lg font-semibold text-brand-dark">{headline}</h3>
+          <p className="mt-1 text-sm text-slate-600">{effectLabel}</p>
         </div>
         <button
           type="button"
@@ -116,7 +162,7 @@ export function PolicyCloudExceptionDetailPanel({
       <div className="mb-4 flex flex-wrap gap-2">
         {isActive ? <Badge tone="success">Active</Badge> : <Badge tone="default">Expired</Badge>}
         {isEnforcedLocally ? <Tag tone="slate">Enforced locally</Tag> : null}
-        <Badge tone="success">{exception.effect}</Badge>
+        <Badge tone="success">{effectLabel}</Badge>
         {!isEnforcedLocally ? <Badge tone="warning">{ackCopy.label}</Badge> : null}
       </div>
 
@@ -126,13 +172,37 @@ export function PolicyCloudExceptionDetailPanel({
           <p className="mt-2 text-sm leading-relaxed text-brand-dark">{whyCopy}</p>
         </div>
 
-        <div className="rounded-xl border border-slate-100 bg-slate-50/80 p-3">
-          <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Blast radius</p>
-          <p className="mt-1 text-sm font-medium text-brand-dark">{blast.label}</p>
-          <p className="mt-1 text-sm text-slate-600">{blast.detail}</p>
-          <DetailField label="Scope (exact)" value={scopeLabel(exception.scope, "policy")} />
+        <div className="grid gap-3 sm:grid-cols-2">
+          <div className="rounded-xl border border-slate-100 bg-slate-50/80 p-3">
+            <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Blast radius</p>
+            <div className="mt-2">
+              <Badge tone={blastRadiusBadgeTone(blast.tone)}>{blast.label}</Badge>
+            </div>
+            <p className="mt-2 text-sm text-slate-600">{blast.detail}</p>
+          </div>
+          <div className="rounded-xl border border-slate-100 bg-slate-50/80 p-3">
+            <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Scope (exact)</p>
+            <div className="mt-2">
+              <Tag tone="blue">{scopeLabel(exception.scope, "policy")}</Tag>
+            </div>
+            {scopePath ? <p className="mt-2 break-all text-sm text-slate-600">{scopePath}</p> : null}
+          </div>
         </div>
 
+        {evidenceUrl ? (
+          <div className="rounded-xl border border-slate-100 bg-slate-50/80 p-3">
+            <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Source review item</p>
+            <p className="mt-2 text-sm font-medium text-brand-dark">
+              {exception.source_receipt_id?.trim() ?? "Linked approval record"}
+            </p>
+            <div className="mt-3">
+              <ActionButton href={evidenceUrl} variant="secondary">
+                Open in Review
+              </ActionButton>
+            </div>
+          </div>
+        ) : null}
+
         <PersonRow label="Owner" value={exception.owner} />
         <PersonRow label="Approved by" value={exception.approver} />
 
@@ -143,6 +213,7 @@ export function PolicyCloudExceptionDetailPanel({
               ? `${expiryTimestamp.toLocaleString()} (${formatRelativeTime(expiryValue)})`
               : expiryValue ?? "Expiry unavailable"}
           </p>
+          <ExpiryTimeline expiryTimestamp={expiryTimestamp} expiryValue={expiryValue} />
           <DetailField
             label="Last used"
             value={exception.last_used_at ? formatRelativeTime(exception.last_used_at) : null}
@@ -150,12 +221,30 @@ export function PolicyCloudExceptionDetailPanel({
         </div>
 
         <DetailField label="Harness" value={exception.harness} />
-        <DetailField label="Source receipt" value={exception.source_receipt_id} />
-        <DetailField label="Signed bundle hash" value={exception.bundle_hash} />
+
+        {exception.bundle_hash ? (
+          <div className="rounded-xl border border-slate-100 bg-slate-50/80 p-3">
+            <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Signed bundle entry</p>
+            <div className="mt-2 flex items-start gap-2">
+              <HiMiniDocumentText className="mt-0.5 h-4 w-4 shrink-0 text-brand-blue" aria-hidden="true" />
+              <div className="min-w-0">
+                <p className="break-all text-sm font-medium text-brand-dark">{exception.bundle_hash}</p>
+                {exception.source_receipt_id ? (
+                  <p className="mt-1 break-all text-xs text-slate-500">{exception.source_receipt_id}</p>
+                ) : null}
+              </div>
+            </div>
+          </div>
+        ) : null}
 
         <div className="rounded-xl border border-slate-100 bg-slate-50/80 p-3">
           <p className="text-xs font-medium uppercase tracking-wide text-slate-500">Local daemon acknowledgement</p>
-          <p className="mt-1 text-sm font-medium text-brand-dark">{ackCopy.label}</p>
+          <div className="mt-2 flex items-center gap-2">
+            {exception.ack_status === "synced" ? (
+              <HiMiniCheckCircle className="h-4 w-4 text-emerald-600" aria-hidden="true" />
+            ) : null}
+            <p className="text-sm font-medium text-brand-dark">{ackCopy.label}</p>
+          </div>
           <p className="mt-1 text-sm text-slate-600">{ackCopy.detail}</p>
           {isCloudExceptionAckFailure(exception) ? (
             <p className="mt-2 text-xs text-slate-500">Run Guard sync to retry bundle acknowledgement.</p>
@@ -164,7 +253,8 @@ export function PolicyCloudExceptionDetailPanel({
       </div>
 
       {cloudControlsUrl ? (
-        <div className="mt-5 w-full">
+        <div className="mt-5 space-y-2">
+          <p className="text-xs text-slate-500">Open Guard Cloud to revoke or renew this exception.</p>
           <ActionButton href={cloudControlsUrl} variant="secondary">
             <HiMiniCloudArrowUp className="mr-1.5 h-4 w-4" aria-hidden="true" />
             Open in Guard Cloud

{plugin_scanner-2.0.716 → plugin_scanner-2.0.718}/dashboard/src/policy-cloud-exception-request-ia.test.ts

@@ -17,6 +17,8 @@ assert(tabSource.includes("PolicyCloudExceptionRequestPanel"), "cloud exceptions
 assert(panelSource.includes("handleNext"), "request panel supports wizard next step");
 assert(panelSource.includes("handleBack"), "request panel supports wizard back step");
 assert(panelSource.includes("createCloudExceptionRequest"), "request panel submits through Guard Cloud proxy");
+assert(panelSource.includes("SourceReceiptSummary"), "request panel shows source receipt summary");
+assert(panelSource.includes("ResultPreview"), "request panel shows result preview");
 assert(panelSource.includes("sourceReceiptId"), "request panel anchors to source receipt");
 assert(!panelSource.includes("savePolicyDecision"), "request panel must not save local policy decisions");
 assert(guardApiSource.includes("createCloudExceptionRequest"), "guard-api exposes cloud exception request create");

{plugin_scanner-2.0.716 → plugin_scanner-2.0.718}/dashboard/src/policy-cloud-exception-request-layout.tsx

@@ -1,6 +1,8 @@
 import type { ReactNode } from "react";
-import { scopeLabel } from "./approval-center-utils";
+import { HiMiniCheck } from "react-icons/hi2";
+import { harnessDisplayName, scopeLabel } from "./approval-center-utils";
 import type { GuardCloudExceptionRequestCreateInput } from "./guard-api";
+import type { GuardReceipt } from "./guard-types";
 import { resolveCloudExceptionBlastRadius } from "./policy-cloud-exceptions-utils";
 
 export const REQUEST_STEPS = ["Source", "Scope", "Guardrails", "Submit"] as const;
@@ -40,7 +42,7 @@ export function RequestStepper({ activeStep }: RequestStepperProps) {
                     : "bg-slate-200 text-slate-600"
               }`}
             >
-              {index + 1}
+              {complete ? <HiMiniCheck className="h-3 w-3" aria-hidden="true" /> : index + 1}
             </span>
             {step}
           </li>
@@ -168,6 +170,43 @@ export function SafetyPreview({
   );
 }
 
+type SourceReceiptSummaryProps = {
+  receipt: GuardReceipt;
+};
+
+export function SourceReceiptSummary({ receipt }: SourceReceiptSummaryProps) {
+  return (
+    <div className="rounded-xl border border-slate-200 bg-slate-50/80 p-4">
+      <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Source: approval record</p>
+      <p className="mt-2 text-sm font-semibold text-brand-dark">
+        {receipt.artifact_name ?? receipt.artifact_id}
+      </p>
+      <p className="mt-1 text-xs text-slate-600">
+        {harnessDisplayName(receipt.harness)} · {receipt.receipt_id}
+      </p>
+    </div>
+  );
+}
+
+type ResultPreviewProps = {
+  scope: GuardCloudExceptionRequestCreateInput["scope"];
+  harness: string;
+  expiresLabel: string;
+};
+
+export function ResultPreview({ scope, harness, expiresLabel }: ResultPreviewProps) {
+  const showHarness = (scope === "artifact" || scope === "harness") && harness.trim();
+  return (
+    <div className="rounded-xl border border-slate-200 bg-white p-4">
+      <p className="text-xs font-semibold uppercase tracking-wide text-slate-500">Result preview</p>
+      <p className="mt-3 text-sm leading-relaxed text-brand-dark">
+        If approved in Guard Cloud, Guard will apply this exception for {scopeLabel(scope, "policy")}
+        {showHarness ? ` in ${harnessDisplayName(harness)}` : ""} until {expiresLabel}.
+      </p>
+    </div>
+  );
+}
+
 type RequestModalShellProps = {
   title: string;
   stepper: ReactNode;

{plugin_scanner-2.0.716 → plugin_scanner-2.0.718}/dashboard/src/policy-cloud-exception-request-panel.tsx

@@ -9,8 +9,10 @@ import {
   RequestModalShell,
   RequestStepper,
   REQUEST_STEPS,
+  ResultPreview,
   SafetyPreview,
   ScopeCardGrid,
+  SourceReceiptSummary,
 } from "./policy-cloud-exception-request-layout";
 
 const SCOPE_OPTIONS: Array<{
@@ -96,12 +98,18 @@ export function PolicyCloudExceptionRequestPanel({
   const [owner, setOwner] = useState("");
   const [reason, setReason] = useState("");
   const [requestedExpiresAt, setRequestedExpiresAt] = useState(defaultExpiryIso());
+  const [linkedTicket, setLinkedTicket] = useState("");
+  const [maxUses, setMaxUses] = useState("");
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [successMessage, setSuccessMessage] = useState<string | null>(null);
   const [stepIndex, setStepIndex] = useState(0);
 
   const activeStep = REQUEST_STEPS[stepIndex] ?? "Source";
+  const selectedReceipt = useMemo(
+    () => receiptOptions.find((entry) => entry.receipt_id === sourceReceiptId) ?? null,
+    [receiptOptions, sourceReceiptId],
+  );
   const expiryLabel = useMemo(() => {
     const date = new Date(requestedExpiresAt);
     return Number.isNaN(date.getTime()) ? "Not set" : date.toLocaleString();
@@ -153,6 +161,25 @@ export function PolicyCloudExceptionRequestPanel({
     setRequestedExpiresAt(fromDatetimeLocalValue(event.target.value));
   }, []);
 
+  const handleLinkedTicketChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setLinkedTicket(event.target.value);
+  }, []);
+
+  const handleMaxUsesChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setMaxUses(event.target.value);
+  }, []);
+
+  const buildReasonForSubmit = useCallback(() => {
+    const parts = [reason.trim()];
+    if (linkedTicket.trim()) {
+      parts.push(`Ticket: ${linkedTicket.trim()}`);
+    }
+    if (maxUses.trim()) {
+      parts.push(`Max uses: ${maxUses.trim()}`);
+    }
+    return parts.filter(Boolean).join("\n");
+  }, [linkedTicket, maxUses, reason]);
+
   const handleSubmit = useCallback(
     async (event: FormEvent<HTMLFormElement>) => {
       event.preventDefault();
@@ -163,7 +190,7 @@ export function PolicyCloudExceptionRequestPanel({
         scope,
         requestedBy: requestedBy.trim(),
         owner: owner.trim(),
-        reason: reason.trim(),
+        reason: buildReasonForSubmit(),
         requestedExpiresAt,
         sourceReceiptId: sourceReceiptId.trim() || null,
       };
@@ -197,10 +224,10 @@ export function PolicyCloudExceptionRequestPanel({
     },
     [
       artifactId,
+      buildReasonForSubmit,
       harness,
       owner,
       publisher,
-      reason,
       requestedBy,
       requestedExpiresAt,
       scope,
@@ -218,9 +245,11 @@ export function PolicyCloudExceptionRequestPanel({
     (scope !== "artifact" || artifactId.trim()) &&
     (scope !== "publisher" || publisher.trim()) &&
     (scope !== "workspace" || workingDirectory.trim()) &&
-    ((scope === "harness" || scope === "artifact") ? harness.trim() : true);
-  const canAdvanceFromGuardrails =
-    reason.trim().length > 0 && owner.trim().length > 0 && requestedBy.trim().length > 0;
+    ((scope === "harness" || scope === "artifact") ? harness.trim() : true) &&
+    reason.trim().length > 0 &&
+    owner.trim().length > 0 &&
+    requestedExpiresAt.trim().length > 0;
+  const canAdvanceFromGuardrails = requestedBy.trim().length > 0;
   const canSubmit = canAdvanceFromSource && canAdvanceFromScope && canAdvanceFromGuardrails;
 
   const handleBack = useCallback(() => {
@@ -316,10 +345,11 @@ export function PolicyCloudExceptionRequestPanel({
 
       <div className="grid gap-4 lg:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_280px] lg:items-start">
         {activeStep === "Source" ? (
-          <div className="space-y-4 rounded-xl border border-slate-100 bg-slate-50/50 p-4 lg:col-span-2">
+          <div className="space-y-4 lg:col-span-3">
             <SectionLabel>Source</SectionLabel>
+            {selectedReceipt ? <SourceReceiptSummary receipt={selectedReceipt} /> : null}
             <label className="block space-y-1">
-              <span className="text-sm font-medium text-brand-dark">Source receipt</span>
+              <span className="text-sm font-medium text-brand-dark">Or choose a different record</span>
               <select
                 className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
                 value={sourceReceiptId}
@@ -337,111 +367,162 @@ export function PolicyCloudExceptionRequestPanel({
         ) : null}
 
         {activeStep === "Scope" ? (
-          <div className="space-y-4 rounded-xl border border-slate-100 bg-slate-50/50 p-4 lg:col-span-2">
-            <SectionLabel>Scope</SectionLabel>
-            <ScopeCardGrid options={SCOPE_OPTIONS} value={scope} onChange={setScope} />
+          <>
+            <div className="space-y-4 lg:col-start-1">
+              {selectedReceipt ? <SourceReceiptSummary receipt={selectedReceipt} /> : null}
+            </div>
+            <div className="space-y-4 rounded-xl border border-slate-100 bg-slate-50/50 p-4 lg:col-start-2">
+              <SectionLabel>Scope</SectionLabel>
+              <p className="text-sm text-slate-600">Choose the narrowest scope that solves the problem.</p>
+              <ScopeCardGrid options={SCOPE_OPTIONS} value={scope} onChange={setScope} />
+
+              {scope === "artifact" ? (
+                <label className="block space-y-1">
+                  <span className="text-sm font-medium text-brand-dark">Artifact fingerprint</span>
+                  <input
+                    className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                    value={artifactId}
+                    onChange={handleArtifactIdChange}
+                    required
+                  />
+                </label>
+              ) : null}
+
+              {scope === "publisher" ? (
+                <label className="block space-y-1">
+                  <span className="text-sm font-medium text-brand-dark">Publisher</span>
+                  <input
+                    className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                    value={publisher}
+                    onChange={handlePublisherChange}
+                    required
+                  />
+                </label>
+              ) : null}
+
+              {scope === "harness" || scope === "artifact" ? (
+                <label className="block space-y-1">
+                  <span className="text-sm font-medium text-brand-dark">App</span>
+                  <select
+                    className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                    value={harness}
+                    onChange={handleHarnessChange}
+                    required
+                  >
+                    {harnessOptions.map((option) => (
+                      <option key={option} value={option}>
+                        {harnessDisplayName(option)}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+              ) : null}
+
+              {scope === "workspace" ? (
+                <label className="block space-y-1">
+                  <span className="text-sm font-medium text-brand-dark">Project folder</span>
+                  <input
+                    className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                    value={workingDirectory}
+                    onChange={handleWorkingDirectoryChange}
+                    required
+                  />
+                </label>
+              ) : null}
 
-            {scope === "artifact" ? (
               <label className="block space-y-1">
-                <span className="text-sm font-medium text-brand-dark">Artifact fingerprint</span>
+                <span className="text-sm font-medium text-brand-dark">Risk owner</span>
                 <input
                   className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
-                  value={artifactId}
-                  onChange={handleArtifactIdChange}
+                  type="email"
+                  value={owner}
+                  onChange={handleOwnerChange}
                   required
                 />
               </label>
-            ) : null}
 
-            {scope === "publisher" ? (
               <label className="block space-y-1">
-                <span className="text-sm font-medium text-brand-dark">Publisher</span>
-                <input
-                  className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
-                  value={publisher}
-                  onChange={handlePublisherChange}
+                <span className="text-sm font-medium text-brand-dark">Reason (required)</span>
+                <textarea
+                  className="min-h-24 w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                  value={reason}
+                  onChange={handleReasonChange}
+                  maxLength={280}
                   required
                 />
+                <p className="text-xs text-slate-500">{reason.trim().length}/280</p>
+                {!reason.trim() ? <p className="text-xs text-red-600">Reason is required.</p> : null}
               </label>
-            ) : null}
 
-            {scope === "harness" || scope === "artifact" ? (
-              <label className="block space-y-1">
-                <span className="text-sm font-medium text-brand-dark">App</span>
-                <select
-                  className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
-                  value={harness}
-                  onChange={handleHarnessChange}
-                  required
-                >
-                  {harnessOptions.map((option) => (
-                    <option key={option} value={option}>
-                      {harnessDisplayName(option)}
-                    </option>
-                  ))}
-                </select>
-              </label>
-            ) : null}
-
-            {scope === "workspace" ? (
-              <label className="block space-y-1">
-                <span className="text-sm font-medium text-brand-dark">Project folder</span>
+              <label className="block space-y-1 md:max-w-sm">
+                <span className="text-sm font-medium text-brand-dark">Requested expiry (required)</span>
                 <input
                   className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
-                  value={workingDirectory}
-                  onChange={handleWorkingDirectoryChange}
+                  type="datetime-local"
+                  value={toDatetimeLocalValue(requestedExpiresAt)}
+                  onChange={handleExpiryChange}
                   required
                 />
               </label>
-            ) : null}
-          </div>
+
+              <div className="grid gap-4 md:grid-cols-2">
+                <label className="block space-y-1">
+                  <span className="text-sm font-medium text-brand-dark">Max uses (optional)</span>
+                  <input
+                    className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                    type="number"
+                    min={1}
+                    step={1}
+                    value={maxUses}
+                    onChange={handleMaxUsesChange}
+                    placeholder="50"
+                  />
+                </label>
+                <label className="block space-y-1">
+                  <span className="text-sm font-medium text-brand-dark">Linked ticket (optional)</span>
+                  <input
+                    className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm"
+                    value={linkedTicket}
+                    onChange={handleLinkedTicketChange}
+                    placeholder="ENG-123 or URL"
+                  />
+                </label>
+              </div>
+
+              {scope === "harness" || scope === "workspace" ? (
+                <div className="rounded-xl border border-brand-blue/15 bg-brand-blue/[0.04] px-3 py-2 text-xs text-brand-dark/80">
+                  Broad scopes require step-up authentication and Cloud approval.
+                </div>
+              ) : null}
+            </div>
+            <div className="space-y-4 lg:col-start-3">
+              <SafetyPreview
+                scope={scope}
+                harness={harness}
+                artifactId={artifactId}
+                publisher={publisher}
+                workingDirectory={workingDirectory}
+                reason={reason}
+                expiresLabel={expiryLabel}
+              />
+              <ResultPreview scope={scope} harness={harness} expiresLabel={expiryLabel} />
+            </div>
+          </>
         ) : null}
 
         {activeStep === "Guardrails" ? (
           <div className="space-y-4 rounded-xl border border-slate-100 bg-white p-4 lg:col-span-2">
             <SectionLabel>Guardrails</SectionLabel>
-            <div className="grid gap-4 md:grid-cols-2">
-              <label className="block space-y-1">
-                <span className="text-sm font-medium text-brand-dark">Requested by</span>
-                <input
-                  className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
-                  type="email"
-                  value={requestedBy}
-                  onChange={handleRequestedByChange}
-                  required
-                />
-              </label>
-              <label className="block space-y-1">
-                <span className="text-sm font-medium text-brand-dark">Risk owner</span>
-                <input
-                  className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
-                  type="email"
-                  value={owner}
-                  onChange={handleOwnerChange}
-                  required
-                />
-              </label>
-            </div>
-            <label className="block space-y-1">
-              <span className="text-sm font-medium text-brand-dark">Reason (required)</span>
-              <textarea
-                className="min-h-24 w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
-                value={reason}
-                onChange={handleReasonChange}
-                maxLength={280}
-                required
-              />
-              <p className="text-xs text-slate-500">{reason.trim().length}/280</p>
-            </label>
-            <label className="block space-y-1 md:max-w-sm">
-              <span className="text-sm font-medium text-brand-dark">Requested expiry (required)</span>
+            <label className="block space-y-1 md:max-w-md">
+              <span className="text-sm font-medium text-brand-dark">Requested by</span>
               <input
                 className="w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"
-                type="datetime-local"
-                value={toDatetimeLocalValue(requestedExpiresAt)}
-                onChange={handleExpiryChange}
+                type="email"
+                value={requestedBy}
+                onChange={handleRequestedByChange}
                 required
               />
+              {!requestedBy.trim() ? <p className="text-xs text-red-600">Requested by is required.</p> : null}
             </label>
           </div>
         ) : null}
@@ -470,7 +551,7 @@ export function PolicyCloudExceptionRequestPanel({
           </div>
         ) : null}
 
-        {activeStep !== "Source" ? (
+        {activeStep === "Guardrails" || activeStep === "Submit" ? (
           <SafetyPreview
             scope={scope}
             harness={harness}
@@ -481,6 +562,9 @@ export function PolicyCloudExceptionRequestPanel({
             expiresLabel={expiryLabel}
           />
         ) : null}
+        {activeStep === "Submit" ? (
+          <ResultPreview scope={scope} harness={harness} expiresLabel={expiryLabel} />
+        ) : null}
       </div>
 
       {error ? <p className="mt-3 text-sm text-red-600">{error}</p> : null}