plugin-scanner 3.0.0a210__tar.gz → 3.0.0a212__tar.gz

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.0a210
+Version: 3.0.0a212
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

plugin_scanner-3.0.0a212/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 15223,
+  "maximum_test_source_lines": 328278,
+  "schema_version": 1
+}

plugin_scanner-3.0.0a212/dashboard/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "hol-guard-dashboard",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "test:operator-health": "bun src/operator-health.test.tsx",
+    "build": "vite build",
+    "pretest": "bun src/operator-health.test.tsx && tsx src/guard-daemon-origin.test.ts && tsx src/supply-chain-fix-all.test.tsx && tsx src/supply-chain-issues.test.ts && tsx src/scsr-phase09e-posture-banners.test.ts && tsx src/guard-action.test.ts && tsx src/authoritative-action-surfaces.test.tsx && tsx src/protection-health.test.ts && tsx src/protection-center/protection-landing.test.tsx",
+    "test:command-ui": "tsx src/command-activity/command-activity-state.test.ts && tsx src/command-activity/command-activity-presenters.test.ts && tsx src/command-activity/command-activity-ui-contract.test.ts",
+    "test": "tsx src/local-cli-api.test.ts && tsx src/protection-center/custom-extension-commands.test.ts && tsx src/protection-center/protection-final-contract.test.ts && tsx src/protection-center/protection-telemetry.test.ts && tsx src/protection-center/protection-terminology.test.tsx && tsx src/protection-center/protection-final-a11y.test.tsx && tsx src/protection-center/model/protection-author-metadata.test.ts && tsx src/protection-center/model/extension-brand.test.ts && tsx src/protection-center/model/protection-performance-budgets.test.ts && tsx src/protection-center/protection-center.test.tsx && tsx src/extension-controls-normalize.test.ts && tsx src/protection-center/protection-module-detail.test.tsx && tsx src/extension-policy-panel.copy.test.tsx && tsx src/extension-control-projection-normalize.test.ts && tsx src/protection-center/protection-test-lab.test.tsx && tsx src/protection-center/protection-history-repair.test.ts && tsx src/extension-control-preview-normalize.test.ts && tsx src/extension-policy-draft.test.ts && tsx src/extension-policy-rebase.test.ts && tsx src/extension-control-center-model.test.ts && tsx src/extensions-workspace.test.ts && tsx src/protection-center/extension-navigation.test.ts && tsx src/github-issue-link.test.ts && tsx src/lazy-workspace.test.ts && tsx src/error-boundary.test.ts && tsx src/shell-footer.test.ts && tsx src/shell-navigation.test.tsx && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/command-activity/command-activity-normalizers.test.ts && tsx src/command-activity/command-activity-state.test.ts && tsx src/command-activity/command-activity-api.test.ts && tsx src/command-activity/command-activity-presenters.test.ts && tsx src/command-activity/command-activity-ui-contract.test.ts && tsx src/guard-update.test.ts && tsx src/guard-update-reconnect-security.test.ts && tsx src/temporary-mcp-approval.test.tsx && tsx src/local-tool-approval.test.tsx && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/protection-posture-copy.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/plain-english.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts && tsx src/request-read-state.test.ts && tsx src/consolidated-evidence-alert.test.ts && tsx src/user-reported-regressions.test.ts && tsx src/sidebar-local-guard-card.test.ts && tsx src/assurance/protection-status.test.ts",
+
+    "test:e2e": "playwright test",
+    "test:e2e:installed": "playwright test --config playwright.installed.config.ts",
+    "dev": "vite dev",
+    "test:temporary-mcp": "tsx src/temporary-mcp-approval.test.tsx",
+    "test:local-tool": "tsx src/local-tool-approval.test.tsx"
+  },
+  "dependencies": {
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-qr-code": "^2.0.16",
+    "react-icons": "^5.6.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.50.0",
+    "@tailwindcss/vite": "^4.1.4",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^5.0.4",
+    "tailwindcss": "^4.1.4",
+    "tsx": "^4.8.1",
+    "typescript": "^5.9.3",
+    "vite": "^7.1.10"
+  }
+}

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/dashboard/src/app.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState, useCallback, useRef, useMemo, lazy, Suspense } from "react";
+import { useEffect, useState, useCallback, useRef, useMemo, Suspense } from "react";
 
 import {
   clearPolicy,
@@ -29,28 +29,26 @@ import type { AppView } from "./approval-center-primitives";
 import { buildClearPayload } from "./clear-policy-payload";
 import { harnessDisplayName, normalizeHarnessSlug } from "./approval-center-utils";
 import { ErrorBoundary } from "./error-boundary";
+import { lazyWorkspace } from "./lazy-workspace";
 import { protectionHealthFor, remainingProtectionRepairParts } from "./protection-health";
 import { selectNextAfterResolution } from "./queue-state";
 import { useRouteFocus } from "./use-route-focus";
 
-const HomeWorkspace = lazy(() => import("./home-dashboard").then((m) => ({ default: m.HomeWorkspace })));
-const FleetWorkspace = lazy(() => import("./fleet-workspace").then((m) => ({ default: m.FleetWorkspace })));
-const SettingsWorkspace = lazy(() => import("./settings-workspace").then((m) => ({ default: m.SettingsWorkspace })));
-const ExtensionsWorkspace = lazy(() =>
+const HomeWorkspace = lazyWorkspace(() => import("./home-dashboard").then((m) => ({ default: m.HomeWorkspace })));
+const FleetWorkspace = lazyWorkspace(() => import("./fleet-workspace").then((m) => ({ default: m.FleetWorkspace })));
+const SettingsWorkspace = lazyWorkspace(() => import("./settings-workspace").then((m) => ({ default: m.SettingsWorkspace })));
+const ExtensionsWorkspace = lazyWorkspace(() =>
   import("./extensions-workspace").then((module) => ({ default: module.ExtensionsWorkspace }))
 );
-const AppDetailWorkspace = lazy(() => import("./apps/app-detail-workspace").then((m) => ({ default: m.AppDetailWorkspace })));
-const HelpModal = lazy(() => import("./help-modal").then((m) => ({ default: m.HelpModal })));
-const SupplyChainHubWorkspace = lazy(() =>
+const AppDetailWorkspace = lazyWorkspace(() => import("./apps/app-detail-workspace").then((m) => ({ default: m.AppDetailWorkspace })));
+const HelpModal = lazyWorkspace(() => import("./help-modal").then((m) => ({ default: m.HelpModal })));
+const SupplyChainHubWorkspace = lazyWorkspace(() =>
   import("./supply-chain-hub-workspace").then((m) => ({ default: m.SupplyChainHubWorkspace }))
 );
-const PolicyWorkspacePage = lazy(() =>
+const PolicyWorkspacePage = lazyWorkspace(() =>
   import("./policy-workspace-page").then((m) => ({ default: m.PolicyWorkspacePage }))
 );
-const McpPolicyRequestPanel = lazy(() =>
-  import("./mcp-policy-request-panel").then((m) => ({ default: m.McpPolicyRequestPanel }))
-);
-const AboutWorkspace = lazy(() =>
+const AboutWorkspace = lazyWorkspace(() =>
   import("./about/about-workspace").then((m) => ({ default: m.AboutWorkspace }))
 );
 
@@ -1043,9 +1041,11 @@ export function App() {
       }
     />
     {helpOpen && (
-      <Suspense fallback={null}>
-        <HelpModal open={helpOpen} onClose={handleCloseHelp} />
-      </Suspense>
+      <ErrorBoundary onReset={handleCloseHelp}>
+        <Suspense fallback={null}>
+          <HelpModal open={helpOpen} onClose={handleCloseHelp} />
+        </Suspense>
+      </ErrorBoundary>
     )}
     </>);
 }

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/dashboard/src/approval-center-layout.tsx

@@ -1,4 +1,4 @@
-import { lazy, Suspense, useCallback, useState } from "react";
+import { Suspense, useCallback, useState } from "react";
 import type { ReactNode } from "react";
 
 import type { AppView } from "./approval-center-primitives";
@@ -7,10 +7,8 @@ import { ShellNavigation } from "./shell-navigation";
 import { ReceiptsWorkspace } from "./receipts-workspace";
 import { ReviewWorkspace } from "./review-workspace";
 import { QueueConnectionError } from "./queue-connection-error";
-
-const McpPolicyRequestPanel = lazy(() =>
-  import("./mcp-policy-request-panel").then((m) => ({ default: m.McpPolicyRequestPanel })),
-);
+import { ErrorBoundary } from "./error-boundary";
+import { lazyWorkspace } from "./lazy-workspace";
 import type { BulkGateCredentials } from "./approval-gate-utils";
 import type {
   GuardApprovalGatePublicConfig,
@@ -27,6 +25,10 @@ import { useGuardUpdate } from "./guard-update-panel";
 import { updateSettings } from "./guard-api";
 import { WatchProtectionBanner } from "./watch-protection-banner";
 
+const McpPolicyRequestPanel = lazyWorkspace(() =>
+  import("./mcp-policy-request-panel").then((m) => ({ default: m.McpPolicyRequestPanel })),
+);
+
 type RequestState =
   | { kind: "loading" }
   | { kind: "error"; message: string }
@@ -313,7 +315,9 @@ export function ApprovalCenterLayout(props: LayoutProps) {
                 />
               </div>
             ) : null}
-            {renderViewContent(props)}
+            <ErrorBoundary key={props.view} onReset={props.onGoHome}>
+              {renderViewContent(props)}
+            </ErrorBoundary>
           </div>
         </main>
         <ShellFooter />

plugin_scanner-3.0.0a212/dashboard/src/error-boundary.test.ts

@@ -0,0 +1,60 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+
+import {
+  CHUNK_LOAD_ERROR_BODY,
+  CHUNK_LOAD_ERROR_HEADLINE,
+  DASHBOARD_GO_HOME_LABEL,
+  DASHBOARD_RELOAD_LABEL,
+  DASHBOARD_TRY_AGAIN_LABEL,
+  ErrorBoundary,
+  GENERIC_ERROR_BODY,
+  GENERIC_ERROR_HEADLINE,
+  dashboardErrorCopy,
+} from "./error-boundary";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const chunkError = new TypeError(
+  "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/extensions-workspace.js",
+);
+const chunkCopy = dashboardErrorCopy(chunkError);
+assert(chunkCopy.kind === "chunk", "dynamic import failures use the chunk-load recovery copy");
+assert(chunkCopy.headline === CHUNK_LOAD_ERROR_HEADLINE, "chunk-load headline names the failed screen");
+assert(chunkCopy.body === CHUNK_LOAD_ERROR_BODY, "chunk-load body tells the operator to reload Guard");
+assert(!chunkCopy.body.toLowerCase().includes("typeerror"), "chunk-load copy hides the raw exception type");
+assert(!chunkCopy.body.includes("5474"), "chunk-load copy hides local ports");
+assert(!chunkCopy.body.includes("extensions-workspace.js"), "chunk-load copy hides bundle filenames");
+
+const genericCopy = dashboardErrorCopy(new Error("Cannot read properties of undefined"));
+assert(genericCopy.kind === "generic", "render failures use generic recovery copy");
+assert(genericCopy.headline === GENERIC_ERROR_HEADLINE, "generic headline stays non-technical");
+assert(genericCopy.body === GENERIC_ERROR_BODY, "generic body offers reload or home");
+assert(!genericCopy.body.includes("Cannot read properties"), "generic copy hides the raw exception");
+
+const markup = renderToStaticMarkup(
+  createElement(
+    ErrorBoundary,
+    { onReset: () => undefined },
+    createElement("p", null, "workspace"),
+  ),
+);
+assert(markup.includes("workspace"), "error boundary renders children while healthy");
+assert(!markup.includes(CHUNK_LOAD_ERROR_HEADLINE), "healthy tree does not show the chunk-load headline");
+
+const source = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "error-boundary.tsx"), "utf8");
+assert(source.includes(DASHBOARD_RELOAD_LABEL), "error boundary offers a dashboard reload action");
+assert(source.includes(DASHBOARD_GO_HOME_LABEL), "error boundary offers a go-home action");
+assert(source.includes(DASHBOARD_TRY_AGAIN_LABEL), "error boundary keeps in-place retry for generic failures");
+assert(source.includes("role=\"alert\""), "error boundary announces the failure");
+assert(!source.includes("this.state.error?.message"), "error boundary does not dump raw exception text");
+assert(source.includes("copy.kind === \"generic\""), "in-place retry stays off for cached chunk-load failures");
+
+console.log("error-boundary.test.ts: all assertions passed");

plugin_scanner-3.0.0a212/dashboard/src/error-boundary.tsx

@@ -0,0 +1,139 @@
+import { Component, type ReactNode } from "react";
+
+import { isChunkLoadError } from "./lazy-workspace";
+
+export const CHUNK_LOAD_ERROR_HEADLINE = "This screen couldn't load";
+export const CHUNK_LOAD_ERROR_BODY =
+  "Guard lost its connection while opening this page. Reload once Guard is running on this device.";
+export const GENERIC_ERROR_HEADLINE = "This screen ran into a problem";
+export const GENERIC_ERROR_BODY = "Reload this page, or go back home and try again.";
+export const DASHBOARD_RELOAD_LABEL = "Reload dashboard";
+export const DASHBOARD_GO_HOME_LABEL = "Go home";
+export const DASHBOARD_TRY_AGAIN_LABEL = "Try again";
+
+export function dashboardErrorCopy(error: Error | null): {
+  kind: "chunk" | "generic";
+  headline: string;
+  body: string;
+} {
+  if (error && isChunkLoadError(error)) {
+    return {
+      kind: "chunk",
+      headline: CHUNK_LOAD_ERROR_HEADLINE,
+      body: CHUNK_LOAD_ERROR_BODY,
+    };
+  }
+  return {
+    kind: "generic",
+    headline: GENERIC_ERROR_HEADLINE,
+    body: GENERIC_ERROR_BODY,
+  };
+}
+
+interface Props {
+  children: ReactNode;
+  fallback?: ReactNode;
+  onReset?: () => void;
+  reload?: () => void;
+}
+
+interface State {
+  hasError: boolean;
+  error: Error | null;
+}
+
+export class ErrorBoundary extends Component<Props, State> {
+  constructor(props: Props) {
+    super(props);
+    this.state = { hasError: false, error: null };
+  }
+
+  static getDerivedStateFromError(error: Error): State {
+    return { hasError: true, error };
+  }
+
+  componentDidCatch(error: Error, errorInfo: React.ErrorInfo) {
+    console.error("ErrorBoundary caught:", error, errorInfo);
+  }
+
+  private handleReload = () => {
+    if (this.props.reload) {
+      this.props.reload();
+      return;
+    }
+    window.location.reload();
+  };
+
+  private handleGoHome = () => {
+    this.setState({ hasError: false, error: null });
+    this.props.onReset?.();
+  };
+
+  private handleTryAgain = () => {
+    this.setState({ hasError: false, error: null });
+  };
+
+  render() {
+    if (!this.state.hasError) {
+      return this.props.children;
+    }
+    if (this.props.fallback) {
+      return this.props.fallback;
+    }
+    const copy = dashboardErrorCopy(this.state.error);
+    const showTryAgain = copy.kind === "generic";
+    const showGoHome = Boolean(this.props.onReset);
+    return (
+      <div
+        className="guard-surface-in flex flex-col items-center justify-center py-12 text-center"
+        role="alert"
+      >
+        <div className="mb-4 flex h-14 w-14 items-center justify-center rounded-full bg-brand-attention/10">
+          <svg
+            className="h-7 w-7 text-brand-attention"
+            fill="none"
+            viewBox="0 0 24 24"
+            stroke="currentColor"
+            strokeWidth={2}
+            aria-hidden="true"
+          >
+            <path
+              strokeLinecap="round"
+              strokeLinejoin="round"
+              d="M12 9v3.75m9-.75a9 9 0 11-18 0 9 9 0 0118 0zm-9 3.75h.008v.008H12v-.008z"
+            />
+          </svg>
+        </div>
+        <h3 className="text-lg font-semibold tracking-tight text-brand-dark">{copy.headline}</h3>
+        <p className="mx-auto mt-2 max-w-md text-sm text-brand-dark/70">{copy.body}</p>
+        <div className="mt-6 flex flex-wrap items-center justify-center gap-3">
+          <button
+            type="button"
+            onClick={this.handleReload}
+            className="inline-flex min-h-11 items-center rounded-lg bg-brand-blue px-4 text-sm font-semibold text-white transition-colors hover:bg-brand-blue/90 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-brand-blue"
+          >
+            {DASHBOARD_RELOAD_LABEL}
+          </button>
+          {showGoHome ? (
+            <button
+              type="button"
+              onClick={this.handleGoHome}
+              className="inline-flex min-h-11 items-center rounded-lg border border-brand-dark/15 bg-white px-4 text-sm font-semibold text-brand-dark transition-colors hover:bg-slate-50 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-brand-blue"
+            >
+              {DASHBOARD_GO_HOME_LABEL}
+            </button>
+          ) : null}
+          {showTryAgain ? (
+            <button
+              type="button"
+              onClick={this.handleTryAgain}
+              className="inline-flex min-h-11 items-center rounded-lg border border-brand-dark/15 bg-white px-4 text-sm font-semibold text-brand-dark transition-colors hover:bg-slate-50 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-brand-blue"
+            >
+              {DASHBOARD_TRY_AGAIN_LABEL}
+            </button>
+          ) : null}
+        </div>
+      </div>
+    );
+  }
+}

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/dashboard/src/extension-control-center-model.test.ts

@@ -8,6 +8,7 @@ import {
   DEFAULT_EXTENSION_DETAIL_URL_STATE,
   extensionDetailHref,
   extensionDetailSearch,
+  extensionDisplayName,
   extensionStateLabel,
   filterDetailPermissions,
   filterDetailRules,
@@ -225,4 +226,16 @@ assert.equal(sortedById.at(-1)?.rule_id, "command.git.rule-99");
   assert.equal(noExamples.families[0]!.heading, noExamples.families[0]!.permissions[0]!.label);
 }
 
+// Row display names strip the uniform catalog suffix where it is pure noise.
+{
+  assert.equal(extensionDisplayName("AWS command protection"), "AWS");
+  assert.equal(extensionDisplayName("Git protection"), "Git");
+  assert.equal(extensionDisplayName("Shell, Git, and filesystem protection"), "Shell, Git, and filesystem");
+  assert.equal(extensionDisplayName("Command data protection"), "Command data");
+  // "Guard self-protection" must not collapse to a dangling "Guard self-".
+  assert.equal(extensionDisplayName("Guard self-protection"), "Guard self-protection");
+  assert.equal(extensionDisplayName("kubectl"), "kubectl");
+  assert.equal(extensionDisplayName("protection"), "protection");
+}
+
 console.log("extension-control-center-model.test.ts: all assertions passed");

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/dashboard/src/extension-control-center-model.ts

@@ -171,6 +171,23 @@ export function permissionEffectiveState(
     (permission.default_enabled ? "enabled" : "disabled");
 }
 
+/**
+ * Catalog names carry a uniform "… command protection" / "… protection"
+ * suffix. Inside the Extensions list every row already sits under that
+ * context, so rows and search headings show the distinguishing part only.
+ * Names whose remainder would be mangled ("Guard self-protection") stay
+ * verbatim. Detail pages keep the full catalog name.
+ */
+export function extensionDisplayName(name: string): string {
+  for (const suffix of [" command protection", " protection"]) {
+    if (!name.toLowerCase().endsWith(suffix)) continue;
+    const shortened = name.slice(0, name.length - suffix.length);
+    if (shortened.length < 3 || /[-\s,.]$/.test(shortened)) break;
+    return shortened;
+  }
+  return name;
+}
+
 export function extensionStateLabel(
   effective: EffectiveExtensionControls,
   extension: ExtensionCatalogItem,

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/dashboard/src/extension-policy-panel.copy.test.tsx

@@ -8,8 +8,9 @@ for (const expected of [
   "Recommended",
   "Allow",
   "Block",
-  "Stricter",
-  "Custom",
+  "Reset to Recommended",
+  "Block all changeable variants",
+  "Apply to every pattern you can change",
   "What will change",
   "Emergency Lockdown",
   "Technical setting details",

{plugin_scanner-3.0.0a210 → plugin_scanner-3.0.0a212}/dashboard/src/extension-policy-panel.tsx

@@ -369,10 +369,10 @@ export function ExtensionPolicyPanel(props: {
       <p className="mt-2 max-w-2xl text-sm leading-6 text-brand-dark/80">
         Recommended follows Guard defaults. Allow is available only where built-in safety and organization policy still permit it. Block is a stricter local floor.
       </p>
-      <div className="mt-4 flex flex-wrap gap-2">
-        <button type="button" disabled={baseEffective.health !== "protected" || refreshRequired} onClick={() => applyProfile(policyExtension.permissions, "recommended")} className="min-h-10 px-1 text-xs font-semibold text-brand-blue disabled:opacity-40">Recommended</button>
-        <button type="button" disabled={baseEffective.health !== "protected" || refreshRequired} onClick={() => applyProfile(policyExtension.permissions, "stricter")} className="min-h-10 px-1 text-xs font-semibold text-brand-dark disabled:opacity-40">Stricter</button>
-        <button type="button" disabled className="min-h-10 px-1 text-xs font-semibold text-brand-dark/55">Custom</button>
+      <div className="mt-4 flex flex-wrap items-center gap-x-3 gap-y-2">
+        <span className="text-xs font-semibold text-brand-dark/60">Apply to every pattern you can change:</span>
+        <button type="button" disabled={baseEffective.health !== "protected" || refreshRequired} onClick={() => applyProfile(policyExtension.permissions, "recommended")} className="min-h-10 px-1 text-xs font-semibold text-brand-blue disabled:opacity-40">Reset to Recommended</button>
+        <button type="button" disabled={baseEffective.health !== "protected" || refreshRequired} onClick={() => applyProfile(policyExtension.permissions, "stricter")} className="min-h-10 px-1 text-xs font-semibold text-brand-dark disabled:opacity-40">Block all changeable variants</button>
       </div>
       <div id="extension-settings-history"><ProtectionSettingsHistory catalogDigest={baseEffective.catalog_digest} disabled={baseEffective.health !== "protected" || refreshRequired} onUse={(layers) => useHistoricalDraft(layers)} /></div>
       {baseEffective.global_lockdown ? (

plugin_scanner-3.0.0a212/dashboard/src/lazy-workspace.test.ts

@@ -0,0 +1,223 @@
+import {
+  CHUNK_RELOAD_DELAY_MS,
+  CHUNK_RELOAD_STORAGE_KEY,
+  isChunkLoadError,
+  loadWorkspaceModule,
+} from "./lazy-workspace";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+assert(
+  isChunkLoadError(
+    new TypeError(
+      "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/extensions-workspace.js",
+    ),
+  ),
+  "Chrome chunk fetch failures are chunk-load errors",
+);
+assert(
+  isChunkLoadError(new TypeError("error loading dynamically imported module")),
+  "Firefox module load failures are chunk-load errors",
+);
+assert(
+  isChunkLoadError(new Error("Importing a module script failed.")),
+  "Safari module script failures are chunk-load errors",
+);
+assert(!isChunkLoadError(new Error("policy save failed")), "unrelated errors are not chunk-load errors");
+
+const memoryStorage = (): Pick<Storage, "getItem" | "setItem" | "removeItem"> => {
+  const values = new Map<string, string>();
+  return {
+    getItem(key) {
+      return values.get(key) ?? null;
+    },
+    setItem(key, value) {
+      values.set(key, value);
+    },
+    removeItem(key) {
+      values.delete(key);
+    },
+  };
+};
+
+const ok = { default: "workspace" };
+
+{
+  const storage = memoryStorage();
+  storage.setItem(CHUNK_RELOAD_STORAGE_KEY, "1");
+  const loaded = await loadWorkspaceModule(async () => ok, { storage });
+  assert(loaded === ok, "successful loads return the module");
+  assert(
+    storage.getItem(CHUNK_RELOAD_STORAGE_KEY) === "1",
+    "successful parent loads keep the one-shot flag so a nested child failure cannot reload forever",
+  );
+}
+
+{
+  const storage = memoryStorage();
+  let reloads = 0;
+  let waited = 0;
+  try {
+    await loadWorkspaceModule(
+      async () => {
+        throw new TypeError(
+          "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/extensions-workspace.js",
+        );
+      },
+      {
+        storage,
+        delayMs: CHUNK_RELOAD_DELAY_MS,
+        wait: async (ms) => {
+          waited = ms;
+        },
+        reload: () => {
+          reloads += 1;
+          throw new Error("dashboard-reload");
+        },
+      },
+    );
+    throw new Error("chunk recovery must not resolve a module while reloading");
+  } catch (error) {
+    assert(
+      error instanceof Error && error.message === "dashboard-reload",
+      "chunk recovery reloads instead of returning a cached failed module",
+    );
+  }
+  assert(waited === CHUNK_RELOAD_DELAY_MS, "chunk recovery waits before reload so the daemon can return");
+  assert(reloads === 1, "first chunk failure reloads the dashboard once");
+  assert(storage.getItem(CHUNK_RELOAD_STORAGE_KEY) === "1", "first chunk failure records the reload flag");
+}
+
+{
+  const storage = memoryStorage();
+  storage.setItem(CHUNK_RELOAD_STORAGE_KEY, "1");
+  let reloads = 0;
+  try {
+    await loadWorkspaceModule(
+      async () => {
+        throw new TypeError(
+          "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/extensions-workspace.js",
+        );
+      },
+      {
+        storage,
+        reload: () => {
+          reloads += 1;
+        },
+      },
+    );
+    throw new Error("second chunk failure must surface to the error boundary");
+  } catch (error) {
+    assert(isChunkLoadError(error), "second chunk failure rethrows the module load error");
+  }
+  assert(reloads === 0, "a second chunk failure does not loop reloads");
+}
+
+{
+  let reloads = 0;
+  try {
+    await loadWorkspaceModule(
+      async () => {
+        throw new TypeError(
+          "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/extensions-workspace.js",
+        );
+      },
+      {
+        reload: () => {
+          reloads += 1;
+        },
+      },
+    );
+    throw new Error("missing storage must not auto-reload");
+  } catch (error) {
+    assert(isChunkLoadError(error), "missing storage surfaces the module load error");
+  }
+  assert(reloads === 0, "privacy-mode sessions do not auto-reload without a one-shot flag");
+}
+
+{
+  try {
+    await loadWorkspaceModule(async () => {
+      throw new Error("policy save failed");
+    });
+    throw new Error("non-chunk errors must propagate");
+  } catch (error) {
+    assert(error instanceof Error && error.message === "policy save failed", "non-chunk errors stay unchanged");
+  }
+}
+
+{
+  let reloads = 0;
+  const blockedStorage: Pick<Storage, "getItem" | "setItem" | "removeItem"> = {
+    getItem() {
+      throw new Error("blocked");
+    },
+    setItem() {
+      throw new Error("blocked");
+    },
+    removeItem() {
+      throw new Error("blocked");
+    },
+  };
+  try {
+    await loadWorkspaceModule(
+      async () => {
+        throw new TypeError(
+          "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/extensions-workspace.js",
+        );
+      },
+      {
+        storage: blockedStorage,
+        reload: () => {
+          reloads += 1;
+        },
+      },
+    );
+    throw new Error("blocked storage must not swallow the chunk-load error");
+  } catch (error) {
+    assert(isChunkLoadError(error), "blocked storage keeps the original chunk-load error");
+  }
+  assert(reloads === 0, "blocked storage disables automatic reload");
+}
+
+{
+  const storage = memoryStorage();
+  let reloads = 0;
+  const failingChild = async () => {
+    throw new TypeError(
+      "Failed to fetch dynamically imported module: http://127.0.0.1:5474/assets/chunks/audit-workspace.js",
+    );
+  };
+  await loadWorkspaceModule(async () => ok, { storage });
+  try {
+    await loadWorkspaceModule(failingChild, {
+      storage,
+      wait: async () => undefined,
+      reload: () => {
+        reloads += 1;
+        throw new Error("dashboard-reload");
+      },
+    });
+  } catch (error) {
+    assert(error instanceof Error && error.message === "dashboard-reload", "nested child failure still reloads once");
+  }
+  await loadWorkspaceModule(async () => ok, { storage });
+  try {
+    await loadWorkspaceModule(failingChild, {
+      storage,
+      reload: () => {
+        reloads += 1;
+      },
+    });
+    throw new Error("nested child failure must stop after the one-shot reload");
+  } catch (error) {
+    assert(isChunkLoadError(error), "nested child failure surfaces after the one-shot reload");
+  }
+  assert(reloads === 1, "parent success must not reset the nested child reload budget");
+}
+
+console.log("lazy-workspace.test.ts: all assertions passed");