plugin-scanner 2.0.748__tar.gz → 2.0.750__tar.gz

{plugin_scanner-2.0.748 → plugin_scanner-2.0.750}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.748
+Version: 2.0.750
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.748 → plugin_scanner-2.0.750}/dashboard/src/app.tsx

@@ -15,6 +15,7 @@ import {
   fetchSettings,
   fetchGuardUpdateStatus,
   guardAwareHref,
+  bulkAllowReadOnce,
   repairApprovalCenter,
   resolveRequestWithQueueResult,
   retryResume,
@@ -609,24 +610,28 @@ export function App() {
     if (bulkApproveInFlight.current) {
       return;
     }
+    if (!gateCredentials?.approval_password?.trim()) {
+      throw new Error("Bulk approval requires an approval password.");
+    }
     bulkApproveInFlight.current = true;
     try {
-      const results = await Promise.allSettled(
-        ids.map((id) =>
-          resolveRequestWithQueueResult({ requestId: id, action: "allow", scope: "artifact", reason: "", ...gateCredentials })
-        )
-      );
-      const succeeded = results.filter((r) => r.status === "fulfilled").length;
-      const failed = results.length - succeeded;
+      const result = await bulkAllowReadOnce({
+        requestIds: ids,
+        approval_password: gateCredentials.approval_password,
+        approval_totp_code: gateCredentials.approval_totp_code,
+        approval_gate_use_cooldown: gateCredentials.approval_gate_use_cooldown,
+      });
       await refreshStateAfterAction();
-      if (failed > 0) {
+      if (result.failed.length > 0) {
+        const succeeded = result.resolved_count;
+        const failed = result.failed.length;
         throw new Error(
-          failed === results.length
+          failed === ids.length
             ? "Bulk approval failed. Retry the selected items manually."
             : `${succeeded} approved, ${failed} failed. Retry the failed items manually.`
         );
       }
-      const label = `${succeeded} item${succeeded !== 1 ? "s" : ""} approved.`;
+      const label = `${result.resolved_count} item${result.resolved_count !== 1 ? "s" : ""} approved.`;
       setResolutionMessage(label);
     } finally {
       bulkApproveInFlight.current = false;

{plugin_scanner-2.0.748 → plugin_scanner-2.0.750}/dashboard/src/approval-center-layout.tsx

@@ -90,8 +90,10 @@ import {
 } from "./queue-state";
 import {
   buildBulkGateCredentials,
+  isBulkApproveGateReady,
   QueueBulkApproveFlow,
   type BulkApproveFlowStep,
+  validateBulkApproveCredentials,
 } from "./queue-bulk-approve-flow";
 import {
   buildDecisionPayload,
@@ -630,7 +632,6 @@ function QueueBrowser(props: {
   const [selectedBulkIds, setSelectedBulkIds] = useState<Set<string>>(() => new Set());
   const [bulkApprovePassword, setBulkApprovePassword] = useState("");
   const [bulkApproveTotpCode, setBulkApproveTotpCode] = useState("");
-  const [bulkApproveUseCooldown, setBulkApproveUseCooldown] = useState(false);
   const [bulkApproveError, setBulkApproveError] = useState<string | null>(null);
   const [bulkCompletedActionCount, setBulkCompletedActionCount] = useState<number | null>(null);
   const harnesses = Array.from(new Set(props.items.map((item) => item.harness).filter(isDisplayableHarness))).sort();
@@ -707,10 +708,7 @@ function QueueBrowser(props: {
     props.onBulkApprove !== undefined &&
     (bulkEligibleGroups.length >= 2 || bulkFlowStep === "completed");
 
-  const showBulkGateFields =
-    showBulkApprove &&
-    props.approvalGate?.enabled === true &&
-    props.approvalGate.configured === true;
+  const bulkGateReady = isBulkApproveGateReady(props.approvalGate);
 
   const selectedBulkGroups = useMemo(
     () => bulkEligibleGroups.filter((group) => selectedBulkIds.has(group.primary.request_id)),
@@ -722,17 +720,19 @@ function QueueBrowser(props: {
     setSelectedBulkIds(new Set());
     setBulkApprovePassword("");
     setBulkApproveTotpCode("");
-    setBulkApproveUseCooldown(false);
     setBulkApproveError(null);
     setBulkCompletedActionCount(null);
   }, []);
 
   const handleBulkFlowStart = useCallback(() => {
+    if (!bulkGateReady) {
+      return;
+    }
     setBulkFlowStep("select");
     setSelectedBulkIds(new Set());
     setBulkApproveError(null);
     setBulkCompletedActionCount(null);
-  }, []);
+  }, [bulkGateReady]);
 
   const handleBulkSelectAll = useCallback(() => {
     setSelectedBulkIds(new Set(bulkApprovePrimaryIds(bulkEligibleGroups)));
@@ -777,21 +777,24 @@ function QueueBrowser(props: {
     setBulkApproveTotpCode(event.target.value);
   }, []);
 
-  const handleBulkApproveUseCooldownChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
-    setBulkApproveUseCooldown(event.target.checked);
-  }, []);
-
   const handleBulkConfirmApprove = useCallback(async () => {
     if (bulkFlowStep === "submitting" || bulkFlowStep === "completed" || selectedBulkGroups.length === 0) {
       return;
     }
     const ids = bulkApprovePrimaryIds(selectedBulkGroups);
     const approvedActionCount = bulkApproveActionCount(selectedBulkGroups);
+    const credentialError = validateBulkApproveCredentials(props.approvalGate, {
+      password: bulkApprovePassword,
+      totpCode: bulkApproveTotpCode,
+    });
+    if (credentialError !== null) {
+      setBulkApproveError(credentialError);
+      return;
+    }
     const gateCredentials = buildBulkGateCredentials(
-      showBulkGateFields,
+      props.approvalGate,
       bulkApprovePassword,
       bulkApproveTotpCode,
-      bulkApproveUseCooldown
     );
     setBulkFlowStep("submitting");
     setBulkApproveError(null);
@@ -801,7 +804,6 @@ function QueueBrowser(props: {
       setBulkFlowStep("completed");
       setBulkApprovePassword("");
       setBulkApproveTotpCode("");
-      setBulkApproveUseCooldown(false);
     } catch (error) {
       setBulkFlowStep("review");
       setBulkApproveError(error instanceof Error ? error.message : "Bulk approval failed.");
@@ -809,11 +811,10 @@ function QueueBrowser(props: {
   }, [
     bulkApprovePassword,
     bulkApproveTotpCode,
-    bulkApproveUseCooldown,
     bulkFlowStep,
+    props.approvalGate,
     props.onBulkApprove,
     selectedBulkGroups,
-    showBulkGateFields,
   ]);
 
   const blockEligibleGroups = useMemo(() => bulkBlockEligibleGroups(groups), [groups]);
@@ -840,9 +841,9 @@ function QueueBrowser(props: {
           completedActionCount={bulkCompletedActionCount}
           sensitiveFileReadCount={sensitiveFileReadCount}
           approvalGate={props.approvalGate ?? null}
+          settingsHref={guardAwareHref("/settings")}
           bulkApprovePassword={bulkApprovePassword}
           bulkApproveTotpCode={bulkApproveTotpCode}
-          bulkApproveUseCooldown={bulkApproveUseCooldown}
           errorMessage={bulkApproveError}
           onStart={handleBulkFlowStart}
           onSelectAll={handleBulkSelectAll}
@@ -853,7 +854,6 @@ function QueueBrowser(props: {
           onConfirmApprove={handleBulkConfirmApprove}
           onBulkApprovePasswordChange={handleBulkApprovePasswordChange}
           onBulkApproveTotpCodeChange={handleBulkApproveTotpCodeChange}
-          onBulkApproveUseCooldownChange={handleBulkApproveUseCooldownChange}
         />
       )}
       {!showBulkApprove && sensitiveFileReadCount > 0 && (

{plugin_scanner-2.0.748 → plugin_scanner-2.0.750}/dashboard/src/approval-center-utils.ts

@@ -719,9 +719,9 @@ export function buildBulkApproveConsequenceCopy(actionCount: number): string {
     return "No read-only file reads are selected.";
   }
   if (actionCount === 1) {
-    return "Guard will allow one read-only file access and remember this retry only.";
+    return "Guard will approve once for one read-only file access. This applies to the current retry only and does not remember future reads.";
   }
-  return `Guard will allow ${actionCount} read-only file accesses. Each decision applies to this retry only, not future edits, writes, or different paths.`;
+  return `Guard will approve once for ${actionCount} read-only file accesses. Mass approval is risky: you are allowing many paths in one step without reviewing each file individually. Each decision applies to this retry only, not future edits, writes, or different paths.`;
 }
 
 export function buildCodexResumeUx(resume: GuardCodexResumeResult): CodexResumeUx {

{plugin_scanner-2.0.748 → plugin_scanner-2.0.750}/dashboard/src/guard-api.ts

@@ -2020,6 +2020,45 @@ export async function resolveRequestWithQueueResult(input: {
   return normalizeQueueResolution(payload);
 }
 
+export type BulkAllowReadOnceResult = {
+  resolved_count: number;
+  failed: Array<{ request_id: string; error: string }>;
+  resolution_summary: string;
+};
+
+export async function bulkAllowReadOnce(input: {
+  requestIds: string[];
+  approval_password?: string;
+  approval_totp_code?: string;
+  approval_gate_use_cooldown?: boolean;
+}): Promise<BulkAllowReadOnceResult> {
+  if (isGuardDemoMode()) {
+    return {
+      resolved_count: input.requestIds.length,
+      failed: [],
+      resolution_summary: `${input.requestIds.length} read-only file reads approved once.`,
+    };
+  }
+  const payload = await readJson<BulkAllowReadOnceResult>("/v1/requests/bulk-allow-once", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...guardAuthHeaders(),
+    },
+    body: JSON.stringify({
+      request_ids: input.requestIds,
+      ...(input.approval_password !== undefined ? { approval_password: input.approval_password } : {}),
+      ...(input.approval_totp_code !== undefined ? { approval_totp_code: input.approval_totp_code } : {}),
+      approval_gate_use_cooldown: input.approval_gate_use_cooldown ?? false,
+    }),
+  });
+  return {
+    resolved_count: payload.resolved_count ?? 0,
+    failed: Array.isArray(payload.failed) ? payload.failed : [],
+    resolution_summary: payload.resolution_summary ?? "",
+  };
+}
+
 export async function clearEvidence(): Promise<void> {
   if (isGuardDemoMode()) {
     return;

plugin_scanner-2.0.750/dashboard/src/policy-strict-config-enforcement-preview.tsx

@@ -0,0 +1,63 @@
+import { Fragment } from "react";
+import { HiMiniArrowRight, HiMiniArrowTopRightOnSquare } from "react-icons/hi2";
+import { ActionButton, SectionLabel } from "./approval-center-primitives";
+import {
+  POLICY_PANEL_CARD_CLASS,
+  STRICT_CONFIG_EVALUATION_STEPS,
+} from "./policy-strict-config-surfaces";
+import { STRICT_POLICY_EVALUATION_ORDER } from "./policy-strict-config-utils";
+
+type PolicyEnforcementPreviewCardProps = {
+  cloudControlsUrl: string | null;
+};
+
+export function PolicyEnforcementPreviewCard({ cloudControlsUrl }: PolicyEnforcementPreviewCardProps) {
+  return (
+    <div className={`${POLICY_PANEL_CARD_CLASS} p-5`}>
+      <SectionLabel>Local enforcement preview</SectionLabel>
+      <p className="mt-2 text-sm leading-relaxed text-slate-600">
+        Evaluation order when Guard decides what to do next.
+      </p>
+
+      <div className="mt-5 -mx-1 overflow-x-auto px-1 pb-1">
+        <div className="flex min-w-[52rem] items-stretch">
+          {STRICT_CONFIG_EVALUATION_STEPS.map((step, index) => {
+            const Icon = step.icon;
+            const isLast = index === STRICT_CONFIG_EVALUATION_STEPS.length - 1;
+            return (
+              <Fragment key={step.label}>
+                <div className={`flex min-w-[9.75rem] flex-1 flex-col rounded-xl border p-3 ${step.surfaceClass}`}>
+                  <span className={`flex h-8 w-8 items-center justify-center rounded-lg bg-white/80 ${step.iconClass}`}>
+                    <Icon className="h-4 w-4" aria-hidden="true" />
+                  </span>
+                  <p className="mt-2 text-sm font-semibold text-brand-dark">{step.label}</p>
+                  <p className="mt-1 text-xs leading-relaxed text-slate-600">{step.description}</p>
+                </div>
+                {!isLast ? (
+                  <div className="flex w-7 shrink-0 items-center justify-center" aria-hidden="true">
+                    <HiMiniArrowRight className="h-4 w-4 text-slate-300" />
+                  </div>
+                ) : null}
+              </Fragment>
+            );
+          })}
+        </div>
+      </div>
+
+      <div className="mt-5 flex flex-col gap-3 border-t border-slate-100 pt-4 sm:flex-row sm:items-center sm:justify-between">
+        <p className="max-w-xl text-xs leading-relaxed text-slate-500">
+          Evaluation order: {STRICT_POLICY_EVALUATION_ORDER.join(" → ")}. Team-wide exceptions are managed in Guard
+          Cloud.
+        </p>
+        {cloudControlsUrl ? (
+          <div className="shrink-0">
+            <ActionButton href={cloudControlsUrl} variant="secondary">
+              Open Guard Cloud
+              <HiMiniArrowTopRightOnSquare className="ml-1.5 h-4 w-4" aria-hidden="true" />
+            </ActionButton>
+          </div>
+        ) : null}
+      </div>
+    </div>
+  );
+}

plugin_scanner-2.0.750/dashboard/src/policy-strict-config-ia.test.ts

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const workspaceSource = readFileSync(join(here, "policy-workspace.tsx"), "utf8");
+const tabSource = readFileSync(join(here, "policy-strict-config-tab.tsx"), "utf8");
+const enforcementSource = readFileSync(join(here, "policy-strict-config-enforcement-preview.tsx"), "utf8");
+const rightRailSource = readFileSync(join(here, "policy-strict-config-right-rail.tsx"), "utf8");
+
+assert(workspaceSource.includes("PolicyStrictConfigTab"), "policy workspace mounts strict config tab");
+assert(!workspaceSource.includes("StrictModeView"), "legacy strict mode view removed");
+assert(tabSource.includes("fetchSettings"), "strict config tab loads settings");
+assert(enforcementSource.includes("Evaluation order"), "strict config shows evaluation order");
+assert(rightRailSource.includes("Policy simulator outcome"), "strict config includes simulator");
+assert(enforcementSource.includes("Local enforcement preview"), "strict config shows enforcement preview");
+assert(rightRailSource.includes("Run simulation"), "strict config exposes run simulation");
+assert(tabSource.includes("PolicyStrictModeCard"), "strict config tab uses extracted cards");
+assert(enforcementSource.includes("min-w-[52rem]"), "strict config uses horizontal enforcement flow");
+assert(rightRailSource.includes("Learn more"), "strict config links to cloud docs");
+assert(workspaceSource.includes("cloudControlsUrl={resolveCloudPolicyControlsUrl(snapshot)}"), "strict config receives cloud controls url");
+
+console.log("policy-strict-config-ia.test.ts: all assertions passed");

plugin_scanner-2.0.750/dashboard/src/policy-strict-config-local-policy-card.tsx

@@ -0,0 +1,121 @@
+import type { ReactNode } from "react";
+import {
+  HiMiniArrowPath,
+  HiMiniBolt,
+  HiMiniCodeBracket,
+  HiMiniCommandLine,
+  HiMiniDocumentText,
+  HiMiniGlobeAlt,
+  HiMiniInformationCircle,
+} from "react-icons/hi2";
+import { SectionLabel } from "./approval-center-primitives";
+import type { GuardSettings } from "./guard-types";
+import {
+  StrictConfigActionSegmented,
+  type StrictConfigSettingKey,
+} from "./policy-strict-config-segmented";
+import { POLICY_PANEL_CARD_CLASS } from "./policy-strict-config-surfaces";
+import { resolveStrictFileWriteAction } from "./policy-strict-config-utils";
+
+function PolicyInfoBanner({ children }: { children: ReactNode }) {
+  return (
+    <div className="flex items-start gap-2 rounded-xl border border-slate-200/80 bg-slate-50 px-3 py-2.5 text-xs leading-relaxed text-slate-600">
+      <HiMiniInformationCircle className="mt-0.5 h-4 w-4 shrink-0 text-slate-400" aria-hidden="true" />
+      <span>{children}</span>
+    </div>
+  );
+}
+
+type PolicyLocalStrictPolicyCardProps = {
+  settings: GuardSettings;
+  controlsDisabled: boolean;
+  saveError: string | null;
+  savingKey: string | null;
+  onResetDefaults: () => void;
+  onSettingChange: (key: StrictConfigSettingKey, value: string) => void;
+};
+
+export function PolicyLocalStrictPolicyCard({
+  settings,
+  controlsDisabled,
+  saveError,
+  savingKey,
+  onResetDefaults,
+  onSettingChange,
+}: PolicyLocalStrictPolicyCardProps) {
+  const fileWriteAction = resolveStrictFileWriteAction(settings);
+
+  return (
+    <div className={`${POLICY_PANEL_CARD_CLASS} p-5`}>
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div className="min-w-0">
+          <SectionLabel>Local strict policy</SectionLabel>
+          <p className="mt-2 text-sm leading-relaxed text-slate-600">
+            Fallback controls when no remembered rule, Cloud policy, or Cloud exception matches.
+          </p>
+        </div>
+        <button
+          type="button"
+          onClick={onResetDefaults}
+          disabled={controlsDisabled}
+          className="inline-flex shrink-0 items-center gap-1.5 text-sm font-medium text-brand-blue hover:underline disabled:opacity-50"
+        >
+          <HiMiniArrowPath className="h-4 w-4" aria-hidden="true" />
+          Reset to defaults
+        </button>
+      </div>
+      <div className="mt-4 divide-y divide-slate-100">
+        <StrictConfigActionSegmented
+          label="Default action"
+          help="For any action not explicitly allowed."
+          icon={HiMiniBolt}
+          value={settings.default_action}
+          settingKey="default_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="Changed tool hash action"
+          help="When a tool or script hash is new."
+          icon={HiMiniCodeBracket}
+          value={settings.changed_hash_action}
+          settingKey="changed_hash_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="New network domain action"
+          help="When a process tries to contact a new domain."
+          icon={HiMiniGlobeAlt}
+          value={settings.new_network_domain_action}
+          settingKey="new_network_domain_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="Subprocess action"
+          help="When a process tries to launch another program."
+          icon={HiMiniCommandLine}
+          value={settings.subprocess_action}
+          settingKey="subprocess_action"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+        <StrictConfigActionSegmented
+          label="File write action"
+          help="When a process writes to disk."
+          icon={HiMiniDocumentText}
+          value={fileWriteAction}
+          settingKey="destructive_shell"
+          onSettingChange={onSettingChange}
+          disabled={controlsDisabled}
+        />
+      </div>
+      <div className="mt-4">
+        <PolicyInfoBanner>These settings apply only when no local or Cloud rules cover the action.</PolicyInfoBanner>
+      </div>
+      {saveError ? <p className="mt-3 text-sm text-red-600">{saveError}</p> : null}
+      {savingKey ? <p className="mt-3 text-sm text-slate-500">Saving {savingKey.replace(/_/g, " ")}…</p> : null}
+    </div>
+  );
+}

plugin_scanner-2.0.750/dashboard/src/policy-strict-config-right-rail.tsx

@@ -0,0 +1,159 @@
+import type { ChangeEvent } from "react";
+import {
+  HiMiniArrowRight,
+  HiMiniBeaker,
+  HiMiniCheckCircle,
+  HiMiniPlay,
+} from "react-icons/hi2";
+import { ActionButton, Badge, SectionLabel } from "./approval-center-primitives";
+import { policyActionLabel } from "./approval-center-utils";
+import { POLICY_PANEL_CARD_CLASS, STRICT_CONFIG_WHAT_CHANGES } from "./policy-strict-config-surfaces";
+import type { StrictPolicySimulationResult, StrictScenarioId } from "./policy-strict-config-utils";
+
+const TEST_SCENARIOS: Array<{
+  id: StrictScenarioId;
+  label: string;
+}> = [
+  { id: "first-time", label: "New tool contacting unknown domain" },
+  { id: "remembered-allow", label: "Remembered allow wins" },
+  { id: "cloud-exception", label: "Active Cloud exception" },
+];
+
+function resolveExpectedActionTone(action: string): "success" | "destructive" | "warning" | "default" {
+  if (action === "block") {
+    return "destructive";
+  }
+  if (action === "allow") {
+    return "success";
+  }
+  if (action === "warn" || action === "review" || action === "require-reapproval") {
+    return "warning";
+  }
+  return "default";
+}
+
+type PolicyStrictConfigRightRailProps = {
+  pendingInboxCount: number;
+  cloudControlsUrl: string | null;
+  scenarioId: StrictScenarioId;
+  expectedAction: string;
+  expectedReasoning: string;
+  simulationVisible: boolean;
+  simulation: StrictPolicySimulationResult | null;
+  onOpenInbox?: () => void;
+  onScenarioChange: (event: ChangeEvent<HTMLSelectElement>) => void;
+  onRunSimulation: () => void;
+};
+
+export function PolicyStrictConfigRightRail({
+  pendingInboxCount,
+  cloudControlsUrl,
+  scenarioId,
+  expectedAction,
+  expectedReasoning,
+  simulationVisible,
+  simulation,
+  onOpenInbox,
+  onScenarioChange,
+  onRunSimulation,
+}: PolicyStrictConfigRightRailProps) {
+  return (
+    <aside className="min-w-0 space-y-4 xl:sticky xl:top-6 xl:self-start">
+      <div className={`${POLICY_PANEL_CARD_CLASS} p-4`}>
+        <SectionLabel>What this changes</SectionLabel>
+        <ul className="mt-3 space-y-2.5 text-sm leading-relaxed text-slate-600">
+          {STRICT_CONFIG_WHAT_CHANGES.map((item) => (
+            <li key={item} className="flex gap-2">
+              <HiMiniCheckCircle className="mt-0.5 h-4 w-4 shrink-0 text-emerald-600" aria-hidden="true" />
+              <span>{item}</span>
+            </li>
+          ))}
+        </ul>
+      </div>
+
+      <div className={`${POLICY_PANEL_CARD_CLASS} p-4`}>
+        <SectionLabel>Affected pending Inbox items</SectionLabel>
+        <p className="mt-2 text-4xl font-semibold tabular-nums text-brand-blue">
+          {pendingInboxCount}
+          <span className="ml-1.5 text-lg font-medium text-brand-blue/75">items</span>
+        </p>
+        <p className="mt-1 text-sm leading-relaxed text-slate-600">
+          Pending review items may be affected by stricter fallback controls.
+        </p>
+        {onOpenInbox && pendingInboxCount > 0 ? (
+          <div className="mt-3">
+            <ActionButton variant="secondary" onClick={onOpenInbox}>
+              Open Inbox
+              <HiMiniArrowRight className="ml-1.5 h-4 w-4" aria-hidden="true" />
+            </ActionButton>
+          </div>
+        ) : null}
+      </div>
+
+      <div className={`${POLICY_PANEL_CARD_CLASS} p-4 text-sm leading-relaxed text-slate-600`}>
+        <p className="font-medium text-brand-dark">Cloud exceptions still apply</p>
+        <p className="mt-2">
+          Signed Cloud exceptions still require bundle acknowledgement before they apply locally.
+        </p>
+        {cloudControlsUrl ? (
+          <a
+            href={cloudControlsUrl}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="mt-3 inline-flex items-center gap-1 text-sm font-medium text-brand-blue hover:underline"
+          >
+            Learn more
+            <HiMiniArrowRight className="h-3.5 w-3.5" aria-hidden="true" />
+          </a>
+        ) : null}
+      </div>
+
+      <div className={`${POLICY_PANEL_CARD_CLASS} border-brand-blue/15 bg-brand-blue/[0.03] p-4`}>
+        <div className="flex items-start gap-2">
+          <HiMiniBeaker className="mt-0.5 h-5 w-5 shrink-0 text-brand-blue" aria-hidden="true" />
+          <div className="min-w-0 flex-1">
+            <SectionLabel>Test policy</SectionLabel>
+            <p className="mt-2 text-sm leading-relaxed text-slate-600">Simulate how Guard will respond.</p>
+          </div>
+        </div>
+        <label className="mt-4 block space-y-1.5">
+          <span className="text-sm font-medium text-brand-dark">Scenario</span>
+          <select
+            value={scenarioId}
+            onChange={onScenarioChange}
+            className="w-full rounded-xl border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark"
+          >
+            {TEST_SCENARIOS.map((scenario) => (
+              <option key={scenario.id} value={scenario.id}>
+                {scenario.label}
+              </option>
+            ))}
+          </select>
+        </label>
+        <div className="mt-4 space-y-2">
+          <p className="text-xs font-medium uppercase tracking-wide text-slate-500">Expected action</p>
+          <Badge tone={resolveExpectedActionTone(expectedAction)}>{policyActionLabel(expectedAction)}</Badge>
+          {expectedReasoning ? <p className="text-sm leading-relaxed text-slate-600">{expectedReasoning}</p> : null}
+        </div>
+        <div className="mt-4">
+          <ActionButton variant="secondary" onClick={onRunSimulation}>
+            <HiMiniPlay className="mr-1.5 h-4 w-4" aria-hidden="true" />
+            Run simulation
+          </ActionButton>
+        </div>
+        {simulationVisible && simulation ? (
+          <div className="mt-4 rounded-xl border border-slate-100 bg-white p-4">
+            <p className="text-sm font-medium text-brand-dark">
+              Policy simulator outcome: {policyActionLabel(simulation.outcome)} ({simulation.winningStep})
+            </p>
+            <ul className="mt-2 space-y-1 text-xs text-slate-600">
+              {simulation.path.map((step) => (
+                <li key={step}>{step}</li>
+              ))}
+            </ul>
+          </div>
+        ) : null}
+      </div>
+    </aside>
+  );
+}

{plugin_scanner-2.0.748 → plugin_scanner-2.0.750}/dashboard/src/policy-strict-config-segmented.tsx

@@ -40,8 +40,8 @@ export function StrictConfigActionSegmented({
   const showAdvanced = !PRIMARY_STRICT_ACTION_VALUES.has(value);
 
   return (
-    <div className="flex flex-col gap-4 py-4 first:pt-0 last:pb-0 sm:flex-row sm:items-center sm:justify-between">
-      <div className="flex min-w-0 items-start gap-3 sm:max-w-[45%]">
+    <div className="grid gap-4 py-5 first:pt-0 last:pb-0 lg:grid-cols-[minmax(0,1fr)_auto] lg:items-center lg:gap-6">
+      <div className="flex min-w-0 items-start gap-3">
         {Icon ? (
           <span className="mt-0.5 flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-slate-100 text-slate-500">
             <Icon className="h-4 w-4" aria-hidden="true" />
@@ -52,9 +52,9 @@ export function StrictConfigActionSegmented({
           {help ? <p className="mt-0.5 text-xs leading-relaxed text-slate-500">{help}</p> : null}
         </div>
       </div>
-      <div className="sm:shrink-0">
+      <div className="min-w-0 lg:justify-self-end">
         <div
-          className="inline-flex flex-wrap gap-1 rounded-xl border border-slate-200 bg-slate-50/80 p-1"
+          className="inline-flex max-w-full flex-wrap gap-1 rounded-xl border border-slate-200 bg-slate-100/80 p-1"
           role="group"
           aria-label={label}
         >