plugin-scanner 2.0.803__tar.gz → 2.0.805__tar.gz

{plugin_scanner-2.0.803 → plugin_scanner-2.0.805}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.803
+Version: 2.0.805
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.803 → plugin_scanner-2.0.805}/dashboard/src/policy-active-mode-card.tsx

@@ -1,6 +1,7 @@
 import { HiMiniShieldCheck } from "react-icons/hi2";
 import { SectionLabel } from "./approval-center-primitives";
 import type { GuardRuntimeSnapshot } from "./guard-types";
+import { POLICY_SUMMARY_CARD_CLASS } from "./policy-summary-surfaces";
 import { resolveSecurityModeCopy } from "./policy-workspace-helpers";
 
 type PolicyActiveModeCardProps = {
@@ -11,15 +12,15 @@ export function PolicyActiveModeCard({ snapshot }: PolicyActiveModeCardProps) {
   const modeCopy = resolveSecurityModeCopy(snapshot.security_level);
 
   return (
-    <div className="rounded-2xl border border-slate-200/70 bg-white p-4 shadow-sm">
+    <div className={`${POLICY_SUMMARY_CARD_CLASS} self-start p-4`}>
       <SectionLabel>Active mode</SectionLabel>
-      <div className="mt-3 flex items-start gap-3">
-        <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-brand-blue/10 text-brand-blue">
-          <HiMiniShieldCheck className="h-5 w-5" aria-hidden="true" />
+      <div className="mt-2 flex items-start gap-2.5">
+        <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-brand-blue/10 text-brand-blue">
+          <HiMiniShieldCheck className="h-4 w-4" aria-hidden="true" />
         </span>
         <div className="min-w-0">
           <p className="text-sm font-semibold text-brand-dark">{modeCopy.label}</p>
-          <p className="mt-1 text-sm leading-relaxed text-slate-600">{modeCopy.description}</p>
+          <p className="mt-0.5 line-clamp-3 text-sm leading-snug text-slate-600">{modeCopy.description}</p>
         </div>
       </div>
     </div>

plugin_scanner-2.0.805/dashboard/src/policy-cloud-exception-request-draft.test.ts

@@ -0,0 +1,132 @@
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function assertEqual<T>(actual: T, expected: T, message: string): void {
+  if (actual !== expected) {
+    throw new Error(`${message}: expected ${String(expected)}, got ${String(actual)}`);
+  }
+}
+
+import {
+  canAdvanceFromGuardrails,
+  canAdvanceFromScope,
+  canSubmitDraft,
+  createDefaultDraft,
+  hasValidSourceAnchor,
+  isDraftRecord,
+  isEmailValid,
+  isExpiryValid,
+  isReasonValid,
+  loadDraftFromStorage,
+  mergeDraft,
+  buildSubmitPayload,
+} from "./policy-cloud-exception-request-draft";
+import type { GuardRuntimeSnapshot } from "./guard-types";
+
+function makeSnapshot(overrides: Partial<GuardRuntimeSnapshot> = {}): GuardRuntimeSnapshot {
+  return {
+    generated_at: new Date().toISOString(),
+    approval_center_url: null,
+    runtime_state: null,
+    device: { device_id: "device-1", label: "This machine" },
+    latest_connect_state: null,
+    proof_status: {
+      state: "not_connected",
+      label: "Not connected",
+      detail: "",
+      request_id: null,
+      verified: false,
+      verified_at: null,
+      subject: null,
+      issuer: null,
+    },
+    pending_count: 0,
+    receipt_count: 1,
+    headline_state: "protected",
+    headline_label: "Protected",
+    headline_detail: "",
+    sync_configured: false,
+    cloud_state: "local_only",
+    cloud_state_label: "Local only",
+    cloud_state_detail: "",
+    cloud_pairing_state: "unpaired",
+    cloud_sync_health: "unknown",
+    dashboard_url: "/",
+    inbox_url: "/inbox",
+    fleet_url: "/fleet",
+    connect_url: "/connect",
+    items: [],
+    latest_receipts: [
+      {
+        receipt_id: "receipt-local-1",
+        harness: "codex",
+        artifact_id: "artifact-1",
+        artifact_hash: "hash",
+        policy_decision: "allow",
+        capabilities_summary: "",
+        changed_capabilities: [],
+        provenance_summary: "",
+        user_override: null,
+        timestamp: new Date().toISOString(),
+      },
+    ],
+    ...overrides,
+  };
+}
+
+assertEqual(isReasonValid("short"), false, "short reason invalid");
+assertEqual(isReasonValid("This reason is long enough for validation."), true, "valid reason");
+assertEqual(isExpiryValid(new Date(Date.now() - 1000).toISOString()), false, "past expiry invalid");
+assertEqual(isExpiryValid(new Date(Date.now() + 86400000).toISOString()), true, "future expiry valid");
+
+const baseDraft = createDefaultDraft(makeSnapshot());
+assertEqual(hasValidSourceAnchor({ ...baseDraft, sourceMode: "receipt", sourceReceiptId: "receipt-local-1" }), true, "receipt anchor");
+assertEqual(hasValidSourceAnchor({ ...baseDraft, sourceMode: "receipt", sourceReceiptId: "" }), false, "empty receipt");
+assertEqual(canAdvanceFromScope({ ...baseDraft, scope: "workspace", workingDirectory: "/tmp/project" }), true, "workspace scope");
+assertEqual(canAdvanceFromScope({ ...baseDraft, scope: "workspace", workingDirectory: "" }), false, "empty workspace");
+assert(
+  canAdvanceFromGuardrails({
+    ...baseDraft,
+    owner: "owner@example.com",
+    requestedBy: "requester@example.com",
+    reason: "Needed for local development work on dependencies.",
+    requestedExpiresAt: new Date(Date.now() + 86400000).toISOString(),
+  }),
+  "guardrails valid",
+);
+
+const submitDraft = {
+  ...baseDraft,
+  sourceMode: "receipt" as const,
+  sourceReceiptId: "receipt-local-1",
+  scope: "workspace" as const,
+  workingDirectory: "/tmp/project",
+  owner: "owner@example.com",
+  requestedBy: "requester@example.com",
+  reason: "Needed for local development work on dependencies.",
+  requestedExpiresAt: new Date(Date.now() + 86400000).toISOString(),
+};
+assert(canSubmitDraft(submitDraft), "can submit valid draft");
+const payload = buildSubmitPayload(submitDraft);
+assertEqual(payload.scope, "workspace", "payload scope");
+assertEqual(payload.sourceReceiptId, "receipt-local-1", "payload receipt");
+assertEqual(payload.workingDirectory, "/tmp/project", "payload workspace");
+
+assertEqual(isEmailValid("not-an-email"), false, "invalid email");
+assertEqual(isEmailValid("owner@example.com"), true, "valid email");
+assertEqual(isDraftRecord([1, 2]), false, "array is not draft record");
+assertEqual(isDraftRecord({ sourceReceiptId: "x" }), true, "draft record");
+assertEqual(isDraftRecord(null), false, "not draft record");
+assertEqual(mergeDraft(baseDraft, { reason: "saved" }).reason, "saved", "merge draft");
+
+try {
+  localStorage.setItem("hol-guard:cloud-exception-request-draft", "{not-json");
+  assertEqual(loadDraftFromStorage(), null, "corrupt draft ignored");
+} catch {
+  // ignore when localStorage unavailable
+}
+
+console.log("policy-cloud-exception-request-draft.test.ts: all assertions passed");

plugin_scanner-2.0.805/dashboard/src/policy-cloud-exception-request-draft.ts

@@ -0,0 +1,324 @@
+import type { GuardCloudExceptionRequestCreateInput } from "./guard-api";
+import type { GuardApprovalRequest, GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
+import type { RequestScopeValue } from "./policy-cloud-exception-request-layout";
+
+export const DRAFT_STORAGE_KEY = "hol-guard:cloud-exception-request-draft";
+
+export const WIZARD_STEPS = ["Source", "Scope", "Guardrails", "Review"] as const;
+export type WizardStep = (typeof WIZARD_STEPS)[number];
+
+export type SourceMode = "approval" | "receipt" | "paste-id";
+
+export type CloudExceptionRequestDraft = {
+  sourceMode: SourceMode;
+  sourceReceiptId: string;
+  sourceReviewItemId: string;
+  pastedRequestId: string;
+  scope: RequestScopeValue;
+  harness: string;
+  artifactId: string;
+  publisher: string;
+  workingDirectory: string;
+  owner: string;
+  requestedBy: string;
+  reason: string;
+  requestedExpiresAt: string;
+  linkedTicket: string;
+  maxUses: string;
+  stepIndex: number;
+};
+
+export type SubmittedRequestState = {
+  requestId: string;
+  submittedAt: string;
+  status: "pending";
+};
+
+export function defaultExpiryIso(): string {
+  const date = new Date();
+  date.setDate(date.getDate() + 30);
+  return date.toISOString();
+}
+
+export function toDatetimeLocalValue(iso: string): string {
+  const date = new Date(iso);
+  if (Number.isNaN(date.getTime())) {
+    return "";
+  }
+  const pad = (value: number) => String(value).padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}T${pad(date.getHours())}:${pad(date.getMinutes())}`;
+}
+
+export function fromDatetimeLocalValue(value: string): string {
+  if (!value) {
+    return "";
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return "";
+  }
+  return date.toISOString();
+}
+
+export function resolveDefaultWorkingDirectory(snapshot: GuardRuntimeSnapshot): string {
+  const install = snapshot.managed_installs?.find((entry) => entry.workspace?.trim());
+  return install?.workspace?.trim() ?? "";
+}
+
+export function resolveResolvedApprovals(snapshot: GuardRuntimeSnapshot): GuardApprovalRequest[] {
+  return (snapshot.items ?? []).filter(
+    (item) => Boolean(item.resolved_at?.trim()) || Boolean(item.resolution_action?.trim()),
+  );
+}
+
+export function resolveApprovalById(
+  snapshot: GuardRuntimeSnapshot,
+  requestId: string,
+): GuardApprovalRequest | null {
+  const trimmed = requestId.trim();
+  if (!trimmed) {
+    return null;
+  }
+  return (snapshot.items ?? []).find((item) => item.request_id === trimmed) ?? null;
+}
+
+export function createDefaultDraft(snapshot: GuardRuntimeSnapshot): CloudExceptionRequestDraft {
+  const receipts = snapshot.latest_receipts ?? [];
+  const approvals = resolveResolvedApprovals(snapshot);
+  const firstReceipt = receipts[0];
+  const firstApproval = approvals[0];
+  const hasApproval = Boolean(firstApproval);
+  const sourceMode: SourceMode = hasApproval ? "approval" : receipts.length > 0 ? "receipt" : "receipt";
+
+  return {
+    sourceMode,
+    sourceReceiptId: hasApproval ? "" : (firstReceipt?.receipt_id ?? ""),
+    sourceReviewItemId: hasApproval ? (firstApproval?.request_id ?? "") : "",
+    pastedRequestId: "",
+    scope: "workspace",
+    harness: firstReceipt?.harness ?? firstApproval?.harness ?? "codex",
+    artifactId: firstReceipt?.artifact_id ?? firstApproval?.artifact_id ?? "",
+    publisher: firstApproval?.publisher?.trim() ?? "",
+    workingDirectory:
+      firstApproval?.workspace?.trim() ||
+      resolveDefaultWorkingDirectory(snapshot) ||
+      firstReceipt?.source_scope?.trim() ||
+      "",
+    owner: "",
+    requestedBy: "",
+    reason: "",
+    requestedExpiresAt: defaultExpiryIso(),
+    linkedTicket: "",
+    maxUses: "",
+    stepIndex: 0,
+  };
+}
+
+export function isDraftRecord(value: unknown): value is Partial<CloudExceptionRequestDraft> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function loadDraftFromStorage(): Partial<CloudExceptionRequestDraft> | null {
+  try {
+    const saved = localStorage.getItem(DRAFT_STORAGE_KEY);
+    if (!saved) {
+      return null;
+    }
+    const parsed: unknown = JSON.parse(saved);
+    return isDraftRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+export function saveDraftToStorage(draft: CloudExceptionRequestDraft): void {
+  try {
+    localStorage.setItem(DRAFT_STORAGE_KEY, JSON.stringify(draft));
+  } catch {
+    // ignore storage failures
+  }
+}
+
+export function mergeDraft(
+  base: CloudExceptionRequestDraft,
+  saved: Partial<CloudExceptionRequestDraft> | null,
+): CloudExceptionRequestDraft {
+  if (!saved) {
+    return base;
+  }
+  return {
+    ...base,
+    ...saved,
+    stepIndex: typeof saved.stepIndex === "number" ? saved.stepIndex : base.stepIndex,
+  };
+}
+
+export function hasValidSourceAnchor(draft: CloudExceptionRequestDraft): boolean {
+  if (draft.sourceMode === "receipt") {
+    return Boolean(draft.sourceReceiptId.trim());
+  }
+  if (draft.sourceMode === "approval") {
+    return Boolean(draft.sourceReviewItemId.trim());
+  }
+  if (draft.sourceMode === "paste-id") {
+    return Boolean(draft.pastedRequestId.trim());
+  }
+  return false;
+}
+
+export function isReasonValid(reason: string): boolean {
+  const trimmed = reason.trim();
+  return trimmed.length >= 24 && trimmed.length <= 280;
+}
+
+export function isExpiryValid(requestedExpiresAt: string): boolean {
+  const date = new Date(requestedExpiresAt);
+  if (Number.isNaN(date.getTime())) {
+    return false;
+  }
+  return date.getTime() > Date.now();
+}
+
+export function canAdvanceFromScope(draft: CloudExceptionRequestDraft): boolean {
+  if (draft.scope === "team-policy") {
+    return false;
+  }
+  if (draft.scope === "artifact" && !draft.artifactId.trim()) {
+    return false;
+  }
+  if (draft.scope === "publisher" && !draft.publisher.trim()) {
+    return false;
+  }
+  if (draft.scope === "workspace" && !draft.workingDirectory.trim()) {
+    return false;
+  }
+  if ((draft.scope === "harness" || draft.scope === "artifact") && !draft.harness.trim()) {
+    return false;
+  }
+  return true;
+}
+
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export function isEmailValid(value: string): boolean {
+  return EMAIL_REGEX.test(value.trim());
+}
+
+export function canAdvanceFromGuardrails(draft: CloudExceptionRequestDraft): boolean {
+  return (
+    isEmailValid(draft.owner) &&
+    isEmailValid(draft.requestedBy) &&
+    isReasonValid(draft.reason) &&
+    isExpiryValid(draft.requestedExpiresAt)
+  );
+}
+
+export function canSubmitDraft(draft: CloudExceptionRequestDraft): boolean {
+  return hasValidSourceAnchor(draft) && canAdvanceFromScope(draft) && canAdvanceFromGuardrails(draft);
+}
+
+export function buildReasonForSubmit(draft: CloudExceptionRequestDraft): string {
+  const parts = [draft.reason.trim()];
+  if (draft.linkedTicket.trim()) {
+    parts.push(`Ticket: ${draft.linkedTicket.trim()}`);
+  }
+  if (draft.maxUses.trim()) {
+    parts.push(`Max uses: ${draft.maxUses.trim()}`);
+  }
+  return parts.filter(Boolean).join("\n");
+}
+
+export function buildSubmitPayload(draft: CloudExceptionRequestDraft): GuardCloudExceptionRequestCreateInput {
+  if (draft.scope === "team-policy") {
+    throw new Error("Team policy exceptions must be created directly in Guard Cloud.");
+  }
+
+  const payload: GuardCloudExceptionRequestCreateInput = {
+    scope: draft.scope,
+    requestedBy: draft.requestedBy.trim(),
+    owner: draft.owner.trim(),
+    reason: buildReasonForSubmit(draft),
+    requestedExpiresAt: draft.requestedExpiresAt,
+    sourceReceiptId: null,
+    sourceReviewItemId: null,
+  };
+
+  if (draft.sourceMode === "receipt") {
+    payload.sourceReceiptId = draft.sourceReceiptId.trim() || null;
+  } else if (draft.sourceMode === "approval") {
+    payload.sourceReviewItemId = draft.sourceReviewItemId.trim() || null;
+  } else if (draft.sourceMode === "paste-id") {
+    payload.sourceReviewItemId = draft.pastedRequestId.trim() || null;
+  }
+
+  if (draft.scope === "artifact") {
+    payload.harness = draft.harness.trim() || null;
+    payload.artifactId = draft.artifactId.trim() || null;
+  } else if (draft.scope === "publisher") {
+    payload.publisher = draft.publisher.trim() || null;
+  } else if (draft.scope === "harness") {
+    payload.harness = draft.harness.trim() || null;
+  } else if (draft.scope === "workspace") {
+    payload.workingDirectory = draft.workingDirectory.trim() || null;
+  }
+
+  return payload;
+}
+
+export function resolveSelectedReceipt(
+  receipts: GuardReceipt[],
+  draft: CloudExceptionRequestDraft,
+): GuardReceipt | null {
+  if (draft.sourceMode === "receipt" && draft.sourceReceiptId.trim()) {
+    return receipts.find((entry) => entry.receipt_id === draft.sourceReceiptId) ?? null;
+  }
+  return null;
+}
+
+export function resolveSelectedApproval(
+  snapshot: GuardRuntimeSnapshot,
+  draft: CloudExceptionRequestDraft,
+): GuardApprovalRequest | null {
+  if (draft.sourceMode === "approval" && draft.sourceReviewItemId.trim()) {
+    return resolveApprovalById(snapshot, draft.sourceReviewItemId);
+  }
+  if (draft.sourceMode === "paste-id" && draft.pastedRequestId.trim()) {
+    return resolveApprovalById(snapshot, draft.pastedRequestId);
+  }
+  return null;
+}
+
+export function resolvePublisherFromSource(
+  snapshot: GuardRuntimeSnapshot,
+  draft: CloudExceptionRequestDraft,
+  receipts: GuardReceipt[],
+): string | null {
+  const approval = resolveSelectedApproval(snapshot, draft);
+  if (approval?.publisher?.trim()) {
+    return approval.publisher.trim();
+  }
+  const receipt = resolveSelectedReceipt(receipts, draft);
+  if (receipt?.source_scope?.trim()) {
+    return receipt.source_scope.trim();
+  }
+  return null;
+}
+
+export function formatRelativeTime(value: string | null | undefined): string | null {
+  if (!value?.trim()) {
+    return null;
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return null;
+  }
+  const diffMs = Date.now() - date.getTime();
+  const diffDays = Math.round(diffMs / (24 * 60 * 60 * 1000));
+  if (diffDays <= 0) {
+    return "Today";
+  }
+  if (diffDays === 1) {
+    return "1 day ago";
+  }
+  return `${diffDays} days ago`;
+}

plugin_scanner-2.0.805/dashboard/src/policy-cloud-exception-request-ia.test.ts

@@ -0,0 +1,58 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const tabSource = readFileSync(join(here, "policy-cloud-exceptions-tab.tsx"), "utf8");
+const panelSource = readFileSync(join(here, "policy-cloud-exception-request-panel.tsx"), "utf8");
+const layoutSource = readFileSync(join(here, "policy-cloud-exception-request-layout.tsx"), "utf8");
+const stepsSource = readFileSync(join(here, "policy-cloud-exception-request-steps.tsx"), "utf8");
+const draftSource = readFileSync(join(here, "policy-cloud-exception-request-draft.ts"), "utf8");
+const guardApiSource = readFileSync(join(here, "guard-api.ts"), "utf8");
+
+const REQUIRED_STEPS = ["Source", "Scope", "Guardrails", "Review", "Submitted"];
+
+assert(tabSource.includes("PolicyCloudExceptionRequestPanel"), "cloud exceptions tab mounts request panel");
+assert(panelSource.includes("handleNext") || panelSource.includes("handleBack"), "request panel supports wizard navigation");
+assert(panelSource.includes("createCloudExceptionRequest"), "request panel submits through Guard Cloud proxy");
+assert(stepsSource.includes("CloudExceptionSourceStep"), "source step is isolated component");
+assert(stepsSource.includes("CloudExceptionScopeStep"), "scope step is isolated component");
+assert(stepsSource.includes("CloudExceptionGuardrailsStep"), "guardrails step is isolated component");
+assert(stepsSource.includes("CloudExceptionReviewStep"), "review step is isolated component");
+assert(stepsSource.includes("CloudExceptionSubmittedStep"), "submitted step is isolated component");
+assert(layoutSource.includes("RequestSummaryRail"), "modal includes request summary rail");
+assert(layoutSource.includes("max-w-5xl"), "modal shell uses focused width instead of page-like max-w-6xl");
+assert(!layoutSource.includes("max-w-6xl"), "modal shell must not use max-w-6xl");
+assert(draftSource.includes("CloudExceptionRequestDraft"), "request panel uses typed draft object");
+assert(draftSource.includes("WIZARD_STEPS"), "wizard steps are centralized");
+for (const step of REQUIRED_STEPS) {
+  assert(layoutSource.includes(`"${step}"`) || draftSource.includes(`"${step}"`), `flow includes ${step} step`);
+}
+assert(!layoutSource.includes('"Submit"'), "wizard must not expose Submit as a step label");
+assert(panelSource.includes("Submit request"), "review step uses Submit request button text");
+assert(panelSource.includes("sourceReceiptId") || draftSource.includes("sourceReceiptId"), "request anchors to source receipt");
+assert(draftSource.includes("sourceReviewItemId"), "request supports source review item anchoring");
+assert(!panelSource.includes("savePolicyDecision"), "request panel must not save local policy decisions");
+assert(guardApiSource.includes("createCloudExceptionRequest"), "guard-api exposes cloud exception request create");
+assert(guardApiSource.includes("/v1/policy/cloud-exception-requests"), "guard-api calls daemon proxy endpoint");
+
+const forbiddenFixturePatterns = [
+  /\bLorem ipsum\b/i,
+  /\bMock Exception\b/i,
+  /\breceipt_demo\b/i,
+  /\breq_3f9a7b1c\b/i,
+  /\breceipt_8f7c2b1a\b/i,
+];
+
+for (const pattern of forbiddenFixturePatterns) {
+  assert(!panelSource.match(pattern), `request panel must not contain fixture pattern ${pattern}`);
+  assert(!stepsSource.match(pattern), `request steps must not contain fixture pattern ${pattern}`);
+}
+
+console.log("policy-cloud-exception-request-ia.test.ts: all assertions passed");