plugin-scanner 2.0.747__tar.gz → 2.0.749__tar.gz

{plugin_scanner-2.0.747 → plugin_scanner-2.0.749}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.747
+Version: 2.0.749
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.749/dashboard/src/policy-strict-config-enforcement-preview.tsx

@@ -0,0 +1,63 @@
+import { Fragment } from "react";
+import { HiMiniArrowRight, HiMiniArrowTopRightOnSquare } from "react-icons/hi2";
+import { ActionButton, SectionLabel } from "./approval-center-primitives";
+import {
+  POLICY_PANEL_CARD_CLASS,
+  STRICT_CONFIG_EVALUATION_STEPS,
+} from "./policy-strict-config-surfaces";
+import { STRICT_POLICY_EVALUATION_ORDER } from "./policy-strict-config-utils";
+
+type PolicyEnforcementPreviewCardProps = {
+  cloudControlsUrl: string | null;
+};
+
+export function PolicyEnforcementPreviewCard({ cloudControlsUrl }: PolicyEnforcementPreviewCardProps) {
+  return (
+    <div className={`${POLICY_PANEL_CARD_CLASS} p-5`}>
+      <SectionLabel>Local enforcement preview</SectionLabel>
+      <p className="mt-2 text-sm leading-relaxed text-slate-600">
+        Evaluation order when Guard decides what to do next.
+      </p>
+
+      <div className="mt-5 -mx-1 overflow-x-auto px-1 pb-1">
+        <div className="flex min-w-[52rem] items-stretch">
+          {STRICT_CONFIG_EVALUATION_STEPS.map((step, index) => {
+            const Icon = step.icon;
+            const isLast = index === STRICT_CONFIG_EVALUATION_STEPS.length - 1;
+            return (
+              <Fragment key={step.label}>
+                <div className={`flex min-w-[9.75rem] flex-1 flex-col rounded-xl border p-3 ${step.surfaceClass}`}>
+                  <span className={`flex h-8 w-8 items-center justify-center rounded-lg bg-white/80 ${step.iconClass}`}>
+                    <Icon className="h-4 w-4" aria-hidden="true" />
+                  </span>
+                  <p className="mt-2 text-sm font-semibold text-brand-dark">{step.label}</p>
+                  <p className="mt-1 text-xs leading-relaxed text-slate-600">{step.description}</p>
+                </div>
+                {!isLast ? (
+                  <div className="flex w-7 shrink-0 items-center justify-center" aria-hidden="true">
+                    <HiMiniArrowRight className="h-4 w-4 text-slate-300" />
+                  </div>
+                ) : null}
+              </Fragment>
+            );
+          })}
+        </div>
+      </div>
+
+      <div className="mt-5 flex flex-col gap-3 border-t border-slate-100 pt-4 sm:flex-row sm:items-center sm:justify-between">
+        <p className="max-w-xl text-xs leading-relaxed text-slate-500">
+          Evaluation order: {STRICT_POLICY_EVALUATION_ORDER.join(" → ")}. Team-wide exceptions are managed in Guard
+          Cloud.
+        </p>
+        {cloudControlsUrl ? (
+          <div className="shrink-0">
+            <ActionButton href={cloudControlsUrl} variant="secondary">
+              Open Guard Cloud
+              <HiMiniArrowTopRightOnSquare className="ml-1.5 h-4 w-4" aria-hidden="true" />
+            </ActionButton>
+          </div>
+        ) : null}
+      </div>
+    </div>
+  );
+}

plugin_scanner-2.0.749/dashboard/src/policy-strict-config-ia.test.ts

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const workspaceSource = readFileSync(join(here, "policy-workspace.tsx"), "utf8");
+const tabSource = readFileSync(join(here, "policy-strict-config-tab.tsx"), "utf8");
+const enforcementSource = readFileSync(join(here, "policy-strict-config-enforcement-preview.tsx"), "utf8");
+const rightRailSource = readFileSync(join(here, "policy-strict-config-right-rail.tsx"), "utf8");
+
+assert(workspaceSource.includes("PolicyStrictConfigTab"), "policy workspace mounts strict config tab");
+assert(!workspaceSource.includes("StrictModeView"), "legacy strict mode view removed");
+assert(tabSource.includes("fetchSettings"), "strict config tab loads settings");
+assert(enforcementSource.includes("Evaluation order"), "strict config shows evaluation order");
+assert(rightRailSource.includes("Policy simulator outcome"), "strict config includes simulator");
+assert(enforcementSource.includes("Local enforcement preview"), "strict config shows enforcement preview");
+assert(rightRailSource.includes("Run simulation"), "strict config exposes run simulation");
+assert(tabSource.includes("PolicyStrictModeCard"), "strict config tab uses extracted cards");
+assert(enforcementSource.includes("min-w-[52rem]"), "strict config uses horizontal enforcement flow");
+assert(rightRailSource.includes("Learn more"), "strict config links to cloud docs");
+assert(workspaceSource.includes("cloudControlsUrl={resolveCloudPolicyControlsUrl(snapshot)}"), "strict config receives cloud controls url");
+
+console.log("policy-strict-config-ia.test.ts: all assertions passed");

plugin_scanner-2.0.749/dashboard/src/policy-strict-config-local-policy-card.tsx

@@ -0,0 +1,121 @@
+import type { ReactNode } from "react";
+import {
+  HiMiniArrowPath,
+  HiMiniBolt,
+  HiMiniCodeBracket,
+  HiMiniCommandLine,
+  HiMiniDocumentText,
+  HiMiniGlobeAlt,
+  HiMiniInformationCircle,
+} from "react-icons/hi2";
+import { SectionLabel } from "./approval-center-primitives";
+import type { GuardSettings } from "./guard-types";
+import {
+  StrictConfigActionSegmented,
+  type StrictConfigSettingKey,
+} from "./policy-strict-config-segmented";
+import { POLICY_PANEL_CARD_CLASS } from "./policy-strict-config-surfaces";
+import { resolveStrictFileWriteAction } from "./policy-strict-config-utils";
+
+function PolicyInfoBanner({ children }: { children: ReactNode }) {
+  return (
+    <div className="flex items-start gap-2 rounded-xl border border-slate-200/80 bg-slate-50 px-3 py-2.5 text-xs leading-relaxed text-slate-600">
+      <HiMiniInformationCircle className="mt-0.5 h-4 w-4 shrink-0 text-slate-400" aria-hidden="true" />
+      <span>{children}</span>
+    </div>
+  );
+}
+
+type PolicyLocalStrictPolicyCardProps = {
+  settings: GuardSettings;
+  controlsDisabled: boolean;
+  saveError: string | null;
+  savingKey: string | null;
+  onResetDefaults: () => void;
+  onSettingChange: (key: StrictConfigSettingKey, value: string) => void;
+};
+
+export function PolicyLocalStrictPolicyCard({
+  settings,
+  controlsDisabled,
+  saveError,
+  savingKey,
+  onResetDefaults,
+  onSettingChange,
+}: PolicyLocalStrictPolicyCardProps) {
+  const fileWriteAction = resolveStrictFileWriteAction(settings);
+
+  return (
+    <div className={`${POLICY_PANEL_CARD_CLASS} p-5`}>
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div className="min-w-0">
+          <SectionLabel>Local strict policy</SectionLabel>
+          <p className="mt-2 text-sm leading-relaxed text-slate-600">
+            Fallback controls when no remembered rule, Cloud policy, or Cloud exception matches.
+          </p>
+        </div>
+        <button
+          type="button"
+          onClick={onResetDefaults}
+          disabled={controlsDisabled}
+          className="inline-flex shrink-0 items-center gap-1.5 text-sm font-medium text-brand-blue hover:underline disabled:opacity-50"
+        >
+          <HiMiniArrowPath className="h-4 w-4" aria-hidden="true" />
+          Reset to defaults
+        </button>
+      </div>
+      <div className="mt-4 divide-y divide-slate-100">
+        <StrictConfigActionSegmented
+          label="Default action"
+          help="For any action not explicitly allowed."
+          icon={HiMiniBolt}
+          value={settings.default_action}
+          settingKey="default_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="Changed tool hash action"
+          help="When a tool or script hash is new."
+          icon={HiMiniCodeBracket}
+          value={settings.changed_hash_action}
+          settingKey="changed_hash_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="New network domain action"
+          help="When a process tries to contact a new domain."
+          icon={HiMiniGlobeAlt}
+          value={settings.new_network_domain_action}
+          settingKey="new_network_domain_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="Subprocess action"
+          help="When a process tries to launch another program."
+          icon={HiMiniCommandLine}
+          value={settings.subprocess_action}
+          settingKey="subprocess_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="File write action"
+          help="When a process writes to disk."
+          icon={HiMiniDocumentText}
+          value={fileWriteAction}
+          settingKey="destructive_shell"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+      </div>
+      <div className="mt-4">
+        <PolicyInfoBanner>These settings apply only when no local or Cloud rules cover the action.</PolicyInfoBanner>
+      </div>
+      {saveError ? <p className="mt-3 text-sm text-red-600">{saveError}</p> : null}
+      {savingKey ? <p className="mt-3 text-sm text-slate-500">Saving {savingKey.replace(/_/g, " ")}…</p> : null}
+    </div>
+  );
+}

plugin_scanner-2.0.749/dashboard/src/policy-strict-config-right-rail.tsx

@@ -0,0 +1,159 @@
+import type { ChangeEvent } from "react";
+import {
+  HiMiniArrowRight,
+  HiMiniBeaker,
+  HiMiniCheckCircle,
+  HiMiniPlay,
+} from "react-icons/hi2";
+import { ActionButton, Badge, SectionLabel } from "./approval-center-primitives";
+import { policyActionLabel } from "./approval-center-utils";
+import { POLICY_PANEL_CARD_CLASS, STRICT_CONFIG_WHAT_CHANGES } from "./policy-strict-config-surfaces";
+import type { StrictPolicySimulationResult, StrictScenarioId } from "./policy-strict-config-utils";
+
+const TEST_SCENARIOS: Array<{
+  id: StrictScenarioId;
+  label: string;
+}> = [
+  { id: "first-time", label: "New tool contacting unknown domain" },
+  { id: "remembered-allow", label: "Remembered allow wins" },
+  { id: "cloud-exception", label: "Active Cloud exception" },
+];
+
+function resolveExpectedActionTone(action: string): "success" | "destructive" | "warning" | "default" {
+  if (action === "block") {
+    return "destructive";
+  }
+  if (action === "allow") {
+    return "success";
+  }
+  if (action === "warn" || action === "review" || action === "require-reapproval") {
+    return "warning";
+  }
+  return "default";
+}
+
+type PolicyStrictConfigRightRailProps = {
+  pendingInboxCount: number;
+  cloudControlsUrl: string | null;
+  scenarioId: StrictScenarioId;
+  expectedAction: string;
+  expectedReasoning: string;
+  simulationVisible: boolean;
+  simulation: StrictPolicySimulationResult | null;
+  onOpenInbox?: () => void;
+  onScenarioChange: (event: ChangeEvent<HTMLSelectElement>) => void;
+  onRunSimulation: () => void;
+};
+
+export function PolicyStrictConfigRightRail({
+  pendingInboxCount,
+  cloudControlsUrl,
+  scenarioId,
+  expectedAction,
+  expectedReasoning,
+  simulationVisible,
+  simulation,
+  onOpenInbox,
+  onScenarioChange,
+  onRunSimulation,
+}: PolicyStrictConfigRightRailProps) {
+  return (
+    <aside className="min-w-0 space-y-4 xl:sticky xl:top-6 xl:self-start">
+      <div className={`${POLICY_PANEL_CARD_CLASS} p-4`}>
+        <SectionLabel>What this changes</SectionLabel>
+        <ul className="mt-3 space-y-2.5 text-sm leading-relaxed text-slate-600">
+          {STRICT_CONFIG_WHAT_CHANGES.map((item) => (
+            <li key={item} className="flex gap-2">
+              <HiMiniCheckCircle className="mt-0.5 h-4 w-4 shrink-0 text-emerald-600" aria-hidden="true" />
+              <span>{item}</span>
+            </li>
+          ))}
+        </ul>
+      </div>
+
+      <div className={`${POLICY_PANEL_CARD_CLASS} p-4`}>
+        <SectionLabel>Affected pending Inbox items</SectionLabel>
+        <p className="mt-2 text-4xl font-semibold tabular-nums text-brand-blue">
+          {pendingInboxCount}
+          <span className="ml-1.5 text-lg font-medium text-brand-blue/75">items</span>
+        </p>
+        <p className="mt-1 text-sm leading-relaxed text-slate-600">
+          Pending review items may be affected by stricter fallback controls.
+        </p>
+        {onOpenInbox && pendingInboxCount > 0 ? (
+          <div className="mt-3">
+            <ActionButton variant="secondary" onClick={onOpenInbox}>
+              Open Inbox
+              <HiMiniArrowRight className="ml-1.5 h-4 w-4" aria-hidden="true" />
+            </ActionButton>
+          </div>
+        ) : null}
+      </div>
+
+      <div className={`${POLICY_PANEL_CARD_CLASS} p-4 text-sm leading-relaxed text-slate-600`}>
+        <p className="font-medium text-brand-dark">Cloud exceptions still apply</p>
+        <p className="mt-2">
+          Signed Cloud exceptions still require bundle acknowledgement before they apply locally.
+        </p>
+        {cloudControlsUrl ? (
+          <a
+            href={cloudControlsUrl}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="mt-3 inline-flex items-center gap-1 text-sm font-medium text-brand-blue hover:underline"
+          >
+            Learn more
+            <HiMiniArrowRight className="h-3.5 w-3.5" aria-hidden="true" />
+          </a>
+        ) : null}
+      </div>
+
+      <div className={`${POLICY_PANEL_CARD_CLASS} border-brand-blue/15 bg-brand-blue/[0.03] p-4`}>
+        <div className="flex items-start gap-2">
+          <HiMiniBeaker className="mt-0.5 h-5 w-5 shrink-0 text-brand-blue" aria-hidden="true" />
+          <div className="min-w-0 flex-1">
+            <SectionLabel>Test policy</SectionLabel>
+            <p className="mt-2 text-sm leading-relaxed text-slate-600">Simulate how Guard will respond.</p>
+          </div>
+        </div>
+        <label className="mt-4 block space-y-1.5">
+          <span className="text-sm font-medium text-brand-dark">Scenario</span>
+          <select
+            value={scenarioId}
+            onChange={onScenarioChange}
+            className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark"
+          >
+            {TEST_SCENARIOS.map((scenario) => (
+              <option key={scenario.id} value={scenario.id}>
+                {scenario.label}
+              </option>
+            ))}
+          </select>
+        </label>
+        <div className="mt-4 space-y-2">
+          <p className="text-xs font-medium uppercase tracking-wide text-slate-500">Expected action</p>
+          <Badge tone={resolveExpectedActionTone(expectedAction)}>{policyActionLabel(expectedAction)}</Badge>
+          {expectedReasoning ? <p className="text-sm leading-relaxed text-slate-600">{expectedReasoning}</p> : null}
+        </div>
+        <div className="mt-4">
+          <ActionButton variant="secondary" onClick={onRunSimulation}>
+            <HiMiniPlay className="mr-1.5 h-4 w-4" aria-hidden="true" />
+            Run simulation
+          </ActionButton>
+        </div>
+        {simulationVisible && simulation ? (
+          <div className="mt-4 rounded-xl border border-slate-100 bg-white p-4">
+            <p className="text-sm font-medium text-brand-dark">
+              Policy simulator outcome: {policyActionLabel(simulation.outcome)} ({simulation.winningStep})
+            </p>
+            <ul className="mt-2 space-y-1 text-xs text-slate-600">
+              {simulation.path.map((step) => (
+                <li key={step}>{step}</li>
+              ))}
+            </ul>
+          </div>
+        ) : null}
+      </div>
+    </aside>
+  );
+}

{plugin_scanner-2.0.747 → plugin_scanner-2.0.749}/dashboard/src/policy-strict-config-segmented.tsx

@@ -40,8 +40,8 @@ export function StrictConfigActionSegmented({
   const showAdvanced = !PRIMARY_STRICT_ACTION_VALUES.has(value);
 
   return (
-    <div className="flex flex-col gap-4 py-4 first:pt-0 last:pb-0 sm:flex-row sm:items-center sm:justify-between">
-      <div className="flex min-w-0 items-start gap-3 sm:max-w-[45%]">
+    <div className="grid gap-4 py-5 first:pt-0 last:pb-0 lg:grid-cols-[minmax(0,1fr)_auto] lg:items-center lg:gap-6">
+      <div className="flex min-w-0 items-start gap-3">
         {Icon ? (
           <span className="mt-0.5 flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-slate-100 text-slate-500">
             <Icon className="h-4 w-4" aria-hidden="true" />
@@ -52,9 +52,9 @@ export function StrictConfigActionSegmented({
           {help ? <p className="mt-0.5 text-xs leading-relaxed text-slate-500">{help}</p> : null}
         </div>
       </div>
-      <div className="sm:shrink-0">
+      <div className="min-w-0 lg:justify-self-end">
         <div
-          className="inline-flex flex-wrap gap-1 rounded-xl border border-slate-200 bg-slate-50/80 p-1"
+          className="inline-flex max-w-full flex-wrap gap-1 rounded-xl border border-slate-200 bg-slate-100/80 p-1"
           role="group"
           aria-label={label}
         >

plugin_scanner-2.0.749/dashboard/src/policy-strict-config-strict-mode-card.tsx

@@ -0,0 +1,142 @@
+import {
+  HiMiniArrowPath,
+  HiMiniCheckCircle,
+  HiMiniClipboardDocument,
+  HiMiniShieldCheck,
+} from "react-icons/hi2";
+import { ActionButton } from "./approval-center-primitives";
+import { formatRelativeTime } from "./approval-center-utils";
+import { POLICY_PANEL_CARD_CLASS } from "./policy-strict-config-surfaces";
+import { formatPolicyDateTime } from "./policy-workspace-helpers";
+
+type PolicyStrictModeCardProps = {
+  isStrict: boolean;
+  controlsDisabled: boolean;
+  localPolicyHash: string | null;
+  daemonAckSynced: boolean;
+  daemonAckLabel: string;
+  lastAckAt: string | null;
+  lastReloadFormatted: string | null;
+  lastReloadAt: string | null;
+  reloadingPolicy: boolean;
+  onStrictToggle: () => void;
+  onCopyHash: () => void;
+  onOpenSettings?: () => void;
+  onReloadPolicy?: () => void;
+};
+
+export function PolicyStrictModeCard({
+  isStrict,
+  controlsDisabled,
+  localPolicyHash,
+  daemonAckSynced,
+  daemonAckLabel,
+  lastAckAt,
+  lastReloadFormatted,
+  lastReloadAt,
+  reloadingPolicy,
+  onStrictToggle,
+  onCopyHash,
+  onOpenSettings,
+  onReloadPolicy,
+}: PolicyStrictModeCardProps) {
+  return (
+    <div className={`${POLICY_PANEL_CARD_CLASS} p-5`}>
+      <div className="flex flex-wrap items-start justify-between gap-4">
+        <div className="flex min-w-0 items-start gap-3">
+          <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-brand-blue/10 text-brand-blue">
+            <HiMiniShieldCheck className="h-5 w-5" aria-hidden="true" />
+          </span>
+          <div className="min-w-0">
+            <h3 className="text-base font-semibold text-brand-dark">Strict mode</h3>
+            <p className="mt-1 text-sm leading-relaxed text-slate-600">
+              Local enforcement tuning when no remembered rule, Cloud policy, or Cloud exception matches.
+            </p>
+          </div>
+        </div>
+        <div className="flex shrink-0 items-center gap-2">
+          <span className="text-xs font-medium text-slate-500">{isStrict ? "Enabled" : "Disabled"}</span>
+          <button
+            type="button"
+            role="switch"
+            aria-checked={isStrict}
+            aria-label="Toggle strict mode"
+            disabled={controlsDisabled}
+            onClick={onStrictToggle}
+            className={`relative h-7 w-12 shrink-0 rounded-full transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/60 ${
+              isStrict ? "bg-brand-blue" : "bg-slate-200"
+            } ${controlsDisabled ? "cursor-not-allowed opacity-50" : "cursor-pointer"}`}
+          >
+            <span
+              className={`absolute top-0.5 left-0.5 h-6 w-6 rounded-full bg-white shadow-sm transition-transform ${
+                isStrict ? "translate-x-5" : "translate-x-0"
+              }`}
+            />
+          </button>
+        </div>
+      </div>
+
+      <dl className="mt-5 grid gap-4 border-t border-slate-100 pt-4 sm:grid-cols-2 xl:grid-cols-4">
+        <div>
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Strict mode</dt>
+          <dd className="mt-1.5 text-sm font-medium text-brand-dark">{isStrict ? "Enabled" : "Disabled"}</dd>
+        </div>
+        <div className="min-w-0">
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Policy hash</dt>
+          <dd className="mt-1.5 flex min-w-0 items-center gap-1.5 font-mono text-sm text-brand-dark">
+            <span className="truncate" title={localPolicyHash ?? undefined}>
+              {localPolicyHash}
+            </span>
+            <button
+              type="button"
+              onClick={onCopyHash}
+              className="shrink-0 rounded-md p-1 text-slate-400 hover:bg-slate-100 hover:text-brand-dark"
+              aria-label="Copy policy hash"
+            >
+              <HiMiniClipboardDocument className="h-4 w-4" aria-hidden="true" />
+            </button>
+          </dd>
+        </div>
+        <div>
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Daemon ack</dt>
+          <dd className="mt-1.5 flex items-center gap-1.5 text-sm text-brand-dark">
+            {daemonAckSynced ? (
+              <HiMiniCheckCircle className="h-4 w-4 shrink-0 text-emerald-600" aria-hidden="true" />
+            ) : null}
+            <span>
+              {daemonAckLabel}
+              {lastAckAt ? ` · ${formatRelativeTime(lastAckAt)}` : ""}
+            </span>
+          </dd>
+        </div>
+        <div>
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Last reload</dt>
+          <dd className="mt-1.5 text-sm text-brand-dark">
+            {lastReloadFormatted ?? (lastReloadAt ? formatRelativeTime(lastReloadAt) : "Unavailable")}
+          </dd>
+          <p className="mt-1 flex items-center gap-1 text-xs text-emerald-700">
+            <HiMiniCheckCircle className="h-3.5 w-3.5 shrink-0" aria-hidden="true" />
+            Auto-reload on
+          </p>
+        </div>
+      </dl>
+
+      {!isStrict && onOpenSettings ? (
+        <div className="mt-4 border-t border-slate-100 pt-4">
+          <ActionButton variant="secondary" onClick={onOpenSettings}>
+            Enable in Settings
+          </ActionButton>
+        </div>
+      ) : null}
+
+      {onReloadPolicy ? (
+        <div className="mt-4 flex justify-end border-t border-slate-100 pt-4">
+          <ActionButton variant="secondary" onClick={onReloadPolicy} disabled={reloadingPolicy}>
+            <HiMiniArrowPath className={`mr-1.5 h-4 w-4 ${reloadingPolicy ? "animate-spin" : ""}`} aria-hidden="true" />
+            Reload policy
+          </ActionButton>
+        </div>
+      ) : null}
+    </div>
+  );
+}

plugin_scanner-2.0.749/dashboard/src/policy-strict-config-surfaces.ts

@@ -0,0 +1,61 @@
+import type { ComponentType } from "react";
+import {
+  HiMiniCloud,
+  HiMiniNoSymbol,
+  HiMiniQueueList,
+  HiMiniShieldCheck,
+} from "react-icons/hi2";
+
+export const POLICY_PANEL_CARD_CLASS =
+  "rounded-2xl border border-slate-200/80 bg-white shadow-[0_1px_2px_rgba(15,23,42,0.04),0_10px_28px_rgba(15,23,42,0.05)]";
+
+export const STRICT_CONFIG_EVALUATION_STEPS: Array<{
+  label: string;
+  description: string;
+  icon: ComponentType<{ className?: string }>;
+  surfaceClass: string;
+  iconClass: string;
+}> = [
+  {
+    label: "Local rule",
+    description: "If a remembered local rule matches, apply it.",
+    icon: HiMiniQueueList,
+    surfaceClass: "border-violet-200 bg-violet-50",
+    iconClass: "text-violet-600",
+  },
+  {
+    label: "Cloud policy",
+    description: "Then apply the signed Cloud policy bundle.",
+    icon: HiMiniCloud,
+    surfaceClass: "border-sky-200 bg-sky-50",
+    iconClass: "text-sky-600",
+  },
+  {
+    label: "Cloud exception",
+    description: "Matching Cloud exception allows the action.",
+    icon: HiMiniCloud,
+    surfaceClass: "border-cyan-200 bg-cyan-50",
+    iconClass: "text-cyan-700",
+  },
+  {
+    label: "Strict fallback",
+    description: "If nothing allows it, this strict config is used.",
+    icon: HiMiniShieldCheck,
+    surfaceClass: "border-amber-200 bg-amber-50",
+    iconClass: "text-amber-700",
+  },
+  {
+    label: "Ask or block",
+    description: "Guard asks (or blocks) according to your choice.",
+    icon: HiMiniNoSymbol,
+    surfaceClass: "border-rose-200 bg-rose-50",
+    iconClass: "text-rose-600",
+  },
+];
+
+export const STRICT_CONFIG_WHAT_CHANGES = [
+  "First-time actions follow your default strict action.",
+  "Changed tool hashes trigger your configured review path.",
+  "New network domains and subprocesses use strict fallback rules.",
+  "Cloud exceptions and remembered rules still win when they match.",
+] as const;