plugin-scanner 3.0.99__tar.gz → 3.0.101__tar.gz

{plugin_scanner-3.0.99 → plugin_scanner-3.0.101}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.99
+Version: 3.0.101
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.0.99 → plugin_scanner-3.0.101}/dashboard/e2e/extension-authority-recovery.spec.ts

@@ -79,7 +79,7 @@ for (const configured of [false, true]) {
     page.on("pageerror", (error) => runtimeErrors.push(error.message));
     await mountRecoveryFixture(page, { configured, enabled: false, failSettings: false });
     await page.goto(`/extensions?${DAEMON}`);
-    await expect(page.getByRole("heading", { name: "Set up approval before enrollment" })).toBeVisible();
+    await expect(page.getByRole("heading", { name: "Set up local approval before enrollment" })).toBeVisible();
     await expect(page.getByText("hol-guard command controls enroll", { exact: true })).toHaveCount(0);
     await page.getByRole("button", { name: "Set up approval", exact: true }).click();
     await expect(page).toHaveURL(/\/settings\?.*section=approval/);

plugin_scanner-3.0.101/dashboard/e2e/policy-connect-oauth.spec.ts

@@ -0,0 +1,86 @@
+import { expect, test, type Page } from "@playwright/test";
+
+import {
+  defaultSettingsPayload,
+  emptyInventoryPayload,
+  emptyPoliciesPayload,
+  emptyReceiptsPayload,
+  freeStateSnapshot,
+} from "./fixture-states";
+
+const DAEMON_ORIGIN = "http://127.0.0.1:4175";
+
+const localOnlySnapshot = {
+  ...freeStateSnapshot,
+  connect_url: "https://hol.org/guard/connect",
+};
+
+async function mount(page: Page) {
+  await page.route("**/v1/**", async (route) => {
+    const path = new URL(route.request().url()).pathname;
+    let body: unknown = {};
+    if (path.endsWith("/initialize")) body = { auth_token: "fixture-session-token" };
+    else if (path.endsWith("/runtime")) body = localOnlySnapshot;
+    else if (path.endsWith("/requests")) body = { items: [], next_cursor: null, total_pending_count: 0, total_count: 0, status: "pending" };
+    else if (path.endsWith("/receipts")) body = emptyReceiptsPayload;
+    else if (path.endsWith("/policy")) body = emptyPoliciesPayload;
+    else if (path.endsWith("/settings")) body = defaultSettingsPayload;
+    else if (path.endsWith("/inventory")) body = emptyInventoryPayload;
+    await route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(body) });
+  });
+}
+
+test("policy exceptions connect action starts the daemon OAuth flow", async ({ page }) => {
+  await mount(page);
+  let postStarts = 0;
+  let connected = false;
+  await page.route("**/v1/cloud/connect", async (route) => {
+    if (route.request().method() === "POST") {
+      postStarts += 1;
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          connect_required: true,
+          connect_flow: {
+            state: "running",
+            title: "Connect Guard Cloud",
+            detail: "Complete sign-in.",
+            action_label: "Connect Guard Cloud",
+            connect_url: "https://hol.org/guard/connect",
+            authorize_url: "https://example.test/authorize",
+            browser_opened: true,
+            request_id: "request-1",
+            poll_after_ms: 100,
+          },
+        }),
+      });
+      return;
+    }
+    connected = true;
+    await route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify({
+        connect_required: false,
+        connect_flow: null,
+        dashboard_url: "https://hol.org/guard",
+      }),
+    });
+  });
+
+  await page.goto(`/policy?guardDaemon=${DAEMON_ORIGIN}`);
+  await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+  const connectButton = page.getByRole("button", { name: "Connect Guard Cloud" });
+  await expect(connectButton).toBeVisible();
+  expect(await page.locator('a[href="https://hol.org/guard/connect"]').count()).toBe(0);
+
+  await connectButton.click();
+  await expect
+    .poll(() => postStarts, { message: "clicking connect must POST /v1/cloud/connect" })
+    .toBeGreaterThan(0);
+  await expect
+    .poll(() => connected, { message: "the flow must poll connection status until it lands" })
+    .toBe(true);
+  await expect(page.getByRole("button", { name: "Guard Cloud connected" })).toBeVisible();
+});

{plugin_scanner-3.0.99 → plugin_scanner-3.0.101}/dashboard/package.json

@@ -8,7 +8,7 @@
     "build": "vite build",
     "pretest": "bun src/operator-health.test.tsx && tsx src/guard-daemon-origin.test.ts && tsx src/supply-chain-fix-all.test.tsx && tsx src/supply-chain-issues.test.ts && tsx src/scsr-phase09e-posture-banners.test.ts && tsx src/guard-action.test.ts && tsx src/authoritative-action-surfaces.test.tsx && tsx src/protection-health.test.ts && tsx src/protection-center/protection-landing.test.tsx",
     "test:command-ui": "tsx src/command-activity/command-activity-state.test.ts && tsx src/command-activity/command-activity-presenters.test.ts && tsx src/command-activity/command-activity-ui-contract.test.ts",
-    "test": "tsx src/presentation-mode.test.ts && tsx src/settings-presentation.test.ts && tsx src/local-cli-api.test.ts && tsx src/protection-center/custom-extension-commands.test.ts && tsx src/protection-center/add-custom-extension-support.test.ts && tsx src/protection-center/protection-final-contract.test.ts && tsx src/protection-center/protection-telemetry.test.ts && tsx src/protection-center/protection-terminology.test.tsx && tsx src/protection-center/protection-final-a11y.test.tsx && tsx src/protection-center/model/protection-author-metadata.test.ts && tsx src/protection-center/model/extension-brand.test.ts && tsx src/protection-center/model/protection-performance-budgets.test.ts && tsx src/protection-center/protection-center.test.tsx && tsx src/extension-controls-normalize.test.ts && tsx src/protection-center/protection-module-detail.test.tsx && tsx src/extension-policy-panel.copy.test.tsx && tsx src/extension-control-projection-normalize.test.ts && tsx src/protection-center/protection-test-lab.test.tsx && tsx src/protection-center/protection-history-repair.test.ts && tsx src/extension-control-preview-normalize.test.ts && tsx src/extension-policy-draft.test.ts && tsx src/extension-policy-rebase.test.ts && tsx src/extension-control-center-model.test.ts && tsx src/extensions-workspace.test.ts && tsx src/protection-center/extension-navigation.test.ts && tsx src/github-issue-link.test.ts && tsx src/lazy-workspace.test.ts && tsx src/error-boundary.test.ts && tsx src/shell-footer.test.ts && tsx src/shell-navigation.test.tsx && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/command-activity/command-activity-normalizers.test.ts && tsx src/command-activity/command-activity-state.test.ts && tsx src/command-activity/command-activity-api.test.ts && tsx src/command-activity/command-activity-presenters.test.ts && tsx src/command-activity/command-activity-ui-contract.test.ts && tsx src/guard-update.test.ts && tsx src/guard-update-reconnect-security.test.ts && tsx src/temporary-mcp-approval.test.tsx && tsx src/local-tool-approval.test.tsx && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/protection-posture-copy.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/plain-english.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/secondary-risk-dedupe.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts && tsx src/request-read-state.test.ts && tsx src/consolidated-evidence-alert.test.ts && tsx src/user-reported-regressions.test.ts && tsx src/sidebar-local-guard-card.test.ts && tsx src/assurance/protection-status.test.ts && tsx src/managed-controls/local-protection-model.test.ts && tsx src/managed-controls/rules-exceptions-model.test.ts && tsx src/managed-controls/custom-extension-continuity.test.ts && tsx src/open-guard-cloud-action.test.tsx && tsx src/guard-cloud-connect-flow.test.ts",
+    "test": "tsx src/presentation-mode.test.ts && tsx src/settings-presentation.test.ts && tsx src/local-cli-api.test.ts && tsx src/protection-center/custom-extension-commands.test.ts && tsx src/protection-center/add-custom-extension-support.test.ts && tsx src/protection-center/protection-final-contract.test.ts && tsx src/protection-center/protection-telemetry.test.ts && tsx src/protection-center/protection-terminology.test.tsx && tsx src/protection-center/protection-final-a11y.test.tsx && tsx src/protection-center/model/protection-author-metadata.test.ts && tsx src/protection-center/model/extension-brand.test.ts && tsx src/protection-center/model/protection-performance-budgets.test.ts && tsx src/protection-center/protection-center.test.tsx && tsx src/extension-controls-normalize.test.ts && tsx src/protection-center/protection-module-detail.test.tsx && tsx src/extension-policy-panel.copy.test.tsx && tsx src/extension-control-projection-normalize.test.ts && tsx src/protection-center/protection-test-lab.test.tsx && tsx src/protection-center/protection-history-repair.test.ts && tsx src/extension-control-preview-normalize.test.ts && tsx src/extension-policy-draft.test.ts && tsx src/extension-policy-rebase.test.ts && tsx src/extension-control-center-model.test.ts && tsx src/extensions-workspace.test.ts && tsx src/protection-center/extension-navigation.test.ts && tsx src/github-issue-link.test.ts && tsx src/lazy-workspace.test.ts && tsx src/error-boundary.test.ts && tsx src/shell-footer.test.ts && tsx src/shell-navigation.test.tsx && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/command-activity/command-activity-normalizers.test.ts && tsx src/command-activity/command-activity-state.test.ts && tsx src/command-activity/command-activity-api.test.ts && tsx src/command-activity/command-activity-presenters.test.ts && tsx src/command-activity/command-activity-ui-contract.test.ts && tsx src/guard-update.test.ts && tsx src/guard-update-reconnect-security.test.ts && tsx src/temporary-mcp-approval.test.tsx && tsx src/local-tool-approval.test.tsx && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/protection-posture-copy.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/plain-english.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/secondary-risk-dedupe.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts && tsx src/request-read-state.test.ts && tsx src/consolidated-evidence-alert.test.ts && tsx src/user-reported-regressions.test.ts && tsx src/sidebar-local-guard-card.test.ts && tsx src/assurance/protection-status.test.ts && tsx src/managed-controls/local-protection-model.test.ts && tsx src/managed-controls/rules-exceptions-model.test.ts && tsx src/managed-controls/custom-extension-continuity.test.ts && tsx src/open-guard-cloud-action.test.tsx && tsx src/guard-cloud-connect-flow.test.ts && tsx src/connect-guard-cloud-button.test.tsx",
     "test:managed-controls-ui": "tsx src/managed-controls/extension-managed-controls-panel.test.tsx && tsx src/managed-controls/local-protection-model.test.ts && tsx src/protection-center/protection-module-detail.test.tsx && tsx src/protection-center/extension-activity.test.tsx && tsx src/extension-policy-panel.managed-controls.test.ts && tsx src/extension-controls-normalize.test.ts",
     "test:e2e": "playwright test",
     "test:e2e:installed": "playwright test --config playwright.installed.config.ts",

plugin_scanner-3.0.101/dashboard/src/connect-guard-cloud-button.test.tsx

@@ -0,0 +1,268 @@
+import { renderToStaticMarkup } from "react-dom/server";
+
+import type { GuardCloudOpenStatus } from "./guard-cloud-connect-flow";
+import {
+  ConnectGuardCloudButton,
+  runGuardCloudConnectFlow,
+  type GuardCloudConnectFlowDeps,
+  type GuardCloudConnectUiState,
+} from "./connect-guard-cloud-button";
+import { PolicyExceptionsToolbar } from "./policy-page-chrome";
+import { PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE } from "./package-firewall-connect-browser";
+
+function assert(condition: unknown, message: string): asserts condition {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const AUTHORIZE_URL = "https://hol.org/api/guard/oauth/authorize?request_id=test-1";
+const CONNECT_URL = "https://hol.org/guard/connect";
+
+function connectStatus(overrides: {
+  connectRequired?: boolean;
+  authorizeUrl?: string | null;
+  connectUrl?: string | null;
+  browserOpened?: boolean | null;
+}): GuardCloudOpenStatus {
+  return {
+    connect_required: overrides.connectRequired ?? true,
+    connect_flow: {
+      state: "running",
+      title: "Finish Guard Cloud sign-in in your browser",
+      detail: "HOL Guard opened the secure sign-in flow in your browser.",
+      action_label: "Connect Guard Cloud",
+      connect_url: (overrides.connectUrl === undefined ? CONNECT_URL : overrides.connectUrl) as string,
+      authorize_url: overrides.authorizeUrl ?? null,
+      browser_opened: overrides.browserOpened ?? null,
+      request_id: "guard-connect-test",
+      poll_after_ms: 100,
+    },
+    dashboard_url: null,
+  };
+}
+
+async function runFlow(
+  startStatus: GuardCloudOpenStatus,
+  connectedStatus: GuardCloudOpenStatus = startStatus,
+  options: { openAuthorize?: () => boolean } = {},
+): Promise<GuardCloudConnectUiState[]> {
+  const states: GuardCloudConnectUiState[] = [];
+  await runGuardCloudConnectFlow(
+    new AbortController().signal,
+    (state) => states.push(state),
+    {
+      start: async () => startStatus,
+      waitAuthorize: async (status) => status,
+      waitConnection: async () => connectedStatus,
+      openAuthorize: options.openAuthorize ?? (() => true),
+    } satisfies GuardCloudConnectFlowDeps,
+  );
+  return states;
+}
+
+const connectedStatus: GuardCloudOpenStatus = {
+  connect_required: false,
+  connect_flow: null,
+  dashboard_url: "https://hol.org/guard",
+};
+
+let states = await runFlow(connectedStatus);
+assert(
+  states.length === 2 && states[0]?.status === "working" && states[1]?.status === "connected",
+  "already-connected machines should move from working straight to connected",
+);
+
+states = await runFlow(
+  connectStatus({ authorizeUrl: AUTHORIZE_URL }),
+  connectedStatus,
+);
+assert(states[0]?.status === "working", "connect starts in the working state");
+const authorizePending = states.find((state) => state.status === "pending");
+assert(
+  authorizePending?.status === "pending" &&
+    authorizePending.message.includes("Complete sign-in in the opened window") &&
+    authorizePending.manualUrl === AUTHORIZE_URL,
+  "opened authorize URL should surface a pending state with the manual sign-in link",
+);
+assert(
+  states[states.length - 1]?.status === "connected",
+  "a finished browser sign-in should end connected",
+);
+
+states = await runFlow(
+  connectStatus({ authorizeUrl: AUTHORIZE_URL }),
+  connectedStatus,
+  { openAuthorize: () => false },
+);
+assert(
+  states.some(
+    (state) =>
+      state.status === "pending" &&
+      state.message === PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE &&
+      state.manualUrl === AUTHORIZE_URL,
+  ),
+  "a blocked sign-in window must keep the manual authorize URL reachable",
+);
+
+states = await runFlow(
+  connectStatus({ authorizeUrl: AUTHORIZE_URL }),
+  connectStatus({ authorizeUrl: AUTHORIZE_URL }),
+);
+const lastPending = [...states].reverse().find((state) => state.status === "pending");
+assert(
+  lastPending?.status === "pending" &&
+    lastPending.message.includes("Sign-in is still pending") &&
+    lastPending.manualUrl === AUTHORIZE_URL,
+  "an unfinished sign-in should stay pending with a retryable manual link",
+);
+
+states = await runFlow(
+  connectStatus({ authorizeUrl: AUTHORIZE_URL }),
+  {
+    connect_required: true,
+    connect_flow: {
+      state: "failed",
+      title: "Guard Cloud sign-in failed",
+      detail: "Sign-in was denied in the browser.",
+      action_label: "Connect Guard Cloud",
+      connect_url: CONNECT_URL,
+      authorize_url: null,
+      browser_opened: null,
+      request_id: "guard-connect-test",
+      poll_after_ms: 100,
+    },
+    dashboard_url: null,
+  },
+);
+const failedState = states[states.length - 1];
+assert(
+  failedState?.status === "error" && failedState.message === "Sign-in was denied in the browser.",
+  "a failed daemon flow should surface the daemon detail as an error",
+);
+
+states = await runFlow(connectStatus({ connectUrl: CONNECT_URL }), connectedStatus);
+const connectOnlyPending = states.find((state) => state.status === "pending");
+assert(
+  connectOnlyPending?.status === "pending" &&
+    connectOnlyPending.manualUrl === CONNECT_URL &&
+    connectOnlyPending.message.includes("Open sign-in to continue"),
+  "connect_url-only flows should offer the daemon link instead of opening a dead-end page",
+);
+assert(
+  states[states.length - 1]?.status === "connected",
+  "connect_url-only flows should still reach connected after the daemon confirms",
+);
+
+states = await runFlow(
+  connectStatus({ connectUrl: CONNECT_URL }),
+  {
+    connect_required: true,
+    connect_flow: {
+      state: "failed",
+      title: "Guard Cloud sign-in failed",
+      detail: "The connect window was closed before sign-in finished.",
+      action_label: "Connect Guard Cloud",
+      connect_url: CONNECT_URL,
+      authorize_url: null,
+      browser_opened: null,
+      request_id: "guard-connect-test",
+      poll_after_ms: 100,
+    },
+    dashboard_url: null,
+  },
+);
+const connectOnlyFailed = states[states.length - 1];
+assert(
+  connectOnlyFailed?.status === "error" &&
+    connectOnlyFailed.message === "The connect window was closed before sign-in finished." &&
+    connectOnlyFailed.manualUrl === CONNECT_URL,
+  "a failed connect_url-only flow must surface the daemon failure instead of staying pending",
+);
+
+states = await runFlow(
+  connectStatus({ connectUrl: null }),
+  connectStatus({ connectUrl: null }),
+);
+const noLinkState = states[states.length - 1];
+assert(
+  noLinkState?.status === "error" &&
+    noLinkState.message === "HOL Guard opened the secure sign-in flow in your browser." &&
+    noLinkState.manualUrl === null,
+  "a flow with no authorize or connect URL must fail honestly with the daemon detail and no link",
+);
+
+let startErrorStates: GuardCloudConnectUiState[] = [];
+let startFailureSeen = false;
+try {
+  await runGuardCloudConnectFlow(
+    new AbortController().signal,
+    (state) => startErrorStates.push(state),
+    {
+      start: async () => {
+        throw new Error("daemon offline");
+      },
+      waitAuthorize: async (status) => status,
+      waitConnection: async () => connectedStatus,
+      openAuthorize: () => true,
+    } satisfies GuardCloudConnectFlowDeps,
+  );
+} catch {
+  startFailureSeen = true;
+}
+assert(!startFailureSeen, "runGuardCloudConnectFlow must not reject; errors arrive as states");
+const startErrorState = startErrorStates[startErrorStates.length - 1];
+assert(
+  startErrorState?.status === "error" && startErrorState.message === "daemon offline",
+  "a failed start should surface the daemon error message",
+);
+
+const abortController = new AbortController();
+const abortedStates: GuardCloudConnectUiState[] = [];
+abortController.abort();
+await runGuardCloudConnectFlow(
+  abortController.signal,
+  (state) => abortedStates.push(state),
+  {
+    start: async () => connectedStatus,
+    waitAuthorize: async (status) => status,
+    waitConnection: async () => connectedStatus,
+    openAuthorize: () => true,
+  } satisfies GuardCloudConnectFlowDeps,
+);
+assert(
+  abortedStates.length === 0,
+  "an aborted flow must not emit any UI state",
+);
+
+const buttonMarkup = renderToStaticMarkup(<ConnectGuardCloudButton />);
+assert(
+  buttonMarkup.includes('type="button"') && buttonMarkup.includes("Connect Guard Cloud"),
+  "Connect Guard Cloud renders as a button with its action label",
+);
+assert(
+  !buttonMarkup.includes("href="),
+  "Connect Guard Cloud must not render a static connect-page href",
+);
+
+const toolbarMarkup = renderToStaticMarkup(
+  <PolicyExceptionsToolbar
+    cloudConnected={false}
+    cloudControlsUrl="https://hol.org/guard/connect"
+    onRequestException={() => undefined}
+  />,
+);
+assert(
+  toolbarMarkup.includes("Connect Guard Cloud") && toolbarMarkup.includes('type="button"'),
+  "disconnected exceptions toolbar should offer a connect button",
+);
+assert(
+  !toolbarMarkup.includes('href="https://hol.org/guard/connect"'),
+  "exceptions toolbar must not blind-link to the static connect page while disconnected",
+);
+assert(
+  !toolbarMarkup.includes("Open Guard Cloud"),
+  "exceptions toolbar should not offer a cloud dashboard link while disconnected",
+);
+
+console.log("connect-guard-cloud-button.test.tsx passed");

plugin_scanner-3.0.101/dashboard/src/connect-guard-cloud-button.tsx

@@ -0,0 +1,230 @@
+import { useCallback, useEffect, useRef, useState, type ReactNode } from "react";
+import { HiMiniCloudArrowUp } from "react-icons/hi2";
+
+import { ActionButton } from "./approval-center-primitives";
+import type { GuardCloudConnectStatusResponse } from "./guard-types";
+import {
+  safeCloudConnectUrl,
+  startOrRecoverCloudConnect,
+  waitForAuthorizeUrl,
+  waitForCloudConnection,
+  type GuardCloudOpenStatus,
+} from "./guard-cloud-connect-flow";
+import {
+  openPackageFirewallAuthorizeFallback,
+  PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
+} from "./package-firewall-connect-browser";
+
+export type GuardCloudConnectUiState =
+  | { status: "idle" }
+  | { status: "working" }
+  | { status: "pending"; message: string; manualUrl: string | null }
+  | { status: "connected" }
+  | { status: "error"; message: string; manualUrl: string | null };
+
+const SIGN_IN_PENDING_MESSAGE =
+  "Sign-in is still pending. Complete it in the opened window, or open sign-in again.";
+
+function cloudConnectPendingMessage(opened: boolean): string {
+  return opened
+    ? "Complete sign-in in the opened window. This page will update automatically."
+    : PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE;
+}
+
+function connectOnlyPendingMessage(): string {
+  return "Open sign-in to continue. This page will update automatically.";
+}
+
+function postWaitState(
+  connectedStatus: GuardCloudConnectStatusResponse,
+  fallbackUrl: string,
+): GuardCloudConnectUiState {
+  const flow = connectedStatus.connect_flow;
+  if (connectedStatus.connect_required && flow?.state === "failed") {
+    return {
+      status: "error",
+      message: flow.detail || "Guard Cloud sign-in could not finish. Try again.",
+      manualUrl: safeCloudConnectUrl(flow.authorize_url) ?? safeCloudConnectUrl(flow.connect_url) ?? fallbackUrl,
+    };
+  }
+  if (!connectedStatus.connect_required) {
+    return { status: "connected" };
+  }
+  return {
+    status: "pending",
+    message: SIGN_IN_PENDING_MESSAGE,
+    manualUrl: safeCloudConnectUrl(flow?.authorize_url) ?? fallbackUrl,
+  };
+}
+
+export type GuardCloudConnectFlowDeps = {
+  start: (signal: AbortSignal) => Promise<GuardCloudOpenStatus>;
+  waitAuthorize: (
+    status: GuardCloudOpenStatus,
+    signal: AbortSignal,
+  ) => Promise<GuardCloudOpenStatus>;
+  waitConnection: typeof waitForCloudConnection;
+  openAuthorize: typeof openPackageFirewallAuthorizeFallback;
+};
+
+const defaultGuardCloudConnectFlowDeps: GuardCloudConnectFlowDeps = {
+  start: startOrRecoverCloudConnect,
+  waitAuthorize: waitForAuthorizeUrl,
+  waitConnection: waitForCloudConnection,
+  openAuthorize: openPackageFirewallAuthorizeFallback,
+};
+
+/**
+ * Runs the daemon-mediated Guard Cloud OAuth flow: start (or recover) the
+ * connect request, wait for the daemon's authorize URL, open it, then poll
+ * until the daemon reports the connection landed. Emits UI states as the flow
+ * progresses; never rejects — failures arrive as an "error" state.
+ */
+export async function runGuardCloudConnectFlow(
+  signal: AbortSignal,
+  emit: (state: GuardCloudConnectUiState) => void,
+  deps: GuardCloudConnectFlowDeps = defaultGuardCloudConnectFlowDeps,
+): Promise<void> {
+  const emitIfLive = (state: GuardCloudConnectUiState): void => {
+    if (!signal.aborted) emit(state);
+  };
+
+  emitIfLive({ status: "working" });
+  try {
+    const status = await deps.waitAuthorize(await deps.start(signal), signal);
+    if (signal.aborted) return;
+    if (!status.connect_required) {
+      emitIfLive({ status: "connected" });
+      return;
+    }
+    const flow = status.connect_flow;
+    const authorizeUrl = safeCloudConnectUrl(flow?.authorize_url);
+    if (flow && authorizeUrl) {
+      const opened = deps.openAuthorize(authorizeUrl, flow.browser_opened);
+      emitIfLive({
+        status: "pending",
+        message: cloudConnectPendingMessage(opened),
+        manualUrl: authorizeUrl,
+      });
+      const connectedStatus = await deps.waitConnection(status, { signal });
+      if (signal.aborted) return;
+      emitIfLive(postWaitState(connectedStatus, authorizeUrl));
+      return;
+    }
+    const connectUrl = safeCloudConnectUrl(flow?.connect_url);
+    if (flow && connectUrl) {
+      emitIfLive({
+        status: "pending",
+        message: connectOnlyPendingMessage(),
+        manualUrl: connectUrl,
+      });
+      const connectedStatus = await deps.waitConnection(status, { signal });
+      if (signal.aborted) return;
+      emitIfLive(postWaitState(connectedStatus, connectUrl));
+      return;
+    }
+    emitIfLive({
+      status: "error",
+      message: flow?.detail || "Guard could not start sign-in. Try again.",
+      manualUrl: null,
+    });
+  } catch (error: unknown) {
+    if (signal.aborted) return;
+    emitIfLive({
+      status: "error",
+      message:
+        error instanceof Error ? error.message : "Guard could not start sign-in. Try again.",
+      manualUrl: null,
+    });
+  }
+}
+
+export function useGuardCloudConnect(
+  deps: GuardCloudConnectFlowDeps = defaultGuardCloudConnectFlowDeps,
+): { state: GuardCloudConnectUiState; startConnect: () => void } {
+  const [state, setState] = useState<GuardCloudConnectUiState>({ status: "idle" });
+  const controllerRef = useRef<AbortController | null>(null);
+
+  useEffect(() => {
+    return () => {
+      controllerRef.current?.abort();
+    };
+  }, []);
+
+  const startConnect = useCallback(() => {
+    controllerRef.current?.abort();
+    const controller = new AbortController();
+    controllerRef.current = controller;
+    void runGuardCloudConnectFlow(controller.signal, setState, deps);
+  }, [deps]);
+
+  return { state, startConnect };
+}
+
+type ConnectGuardCloudButtonProps = {
+  label?: string;
+  variant?: "primary" | "secondary" | "outline" | "ghost" | "quiet";
+  workingLabel?: string;
+  connectedLabel?: string;
+  className?: string;
+};
+
+/**
+ * Guard Cloud connect action that starts the daemon-mediated OAuth sign-in
+ * flow instead of linking straight to the hol.org connect page.
+ */
+export function ConnectGuardCloudButton({
+  label = "Connect Guard Cloud",
+  variant = "secondary",
+  workingLabel = "Starting sign-in…",
+  connectedLabel = "Guard Cloud connected",
+  className,
+}: ConnectGuardCloudButtonProps) {
+  const { state, startConnect } = useGuardCloudConnect();
+
+  let buttonLabel = label;
+  if (state.status === "working") {
+    buttonLabel = workingLabel;
+  } else if (state.status === "connected") {
+    buttonLabel = connectedLabel;
+  }
+
+  let statusLine: ReactNode = null;
+  if (state.status === "pending" || state.status === "error") {
+    statusLine = (
+      <span
+        role="status"
+        className={`flex flex-wrap items-center justify-end gap-1.5 text-xs leading-relaxed ${
+          state.status === "error" ? "text-red-600" : "text-slate-500"
+        }`}
+      >
+        <span>{state.message}</span>
+        {state.manualUrl ? (
+          <a
+            href={state.manualUrl}
+            target="_blank"
+            rel="noreferrer"
+            className="font-semibold text-brand-blue underline"
+          >
+            Open sign-in
+          </a>
+        ) : null}
+      </span>
+    );
+  }
+
+  return (
+    <span className="inline-flex flex-col items-end gap-1">
+      <ActionButton
+        variant={variant}
+        onClick={startConnect}
+        disabled={state.status === "working"}
+        className={className}
+      >
+        <HiMiniCloudArrowUp className="mr-1.5 h-4 w-4" aria-hidden="true" />
+        {buttonLabel}
+      </ActionButton>
+      {statusLine}
+    </span>
+  );
+}

{plugin_scanner-3.0.99 → plugin_scanner-3.0.101}/dashboard/src/extensions-workspace.test.ts

@@ -93,8 +93,13 @@ const approvalSetupMarkup = renderToStaticMarkup(createElement(ProtectionAuthori
   onCheckAgain: () => undefined,
   onOpenApprovalSettings: () => undefined,
 }));
-assert.match(approvalSetupMarkup, /Set up approval before enrollment/);
+assert.match(approvalSetupMarkup, /Set up local approval before enrollment/);
 assert.match(approvalSetupMarkup, /Set up approval/);
+assert.match(approvalSetupMarkup, /Guard Cloud sign-in and account MFA are separate and do not enable this gate/);
+assert.match(approvalSetupMarkup, /Settings > Approval gate/);
+assert.match(approvalSetupMarkup, /Ask for proof on allow decisions/);
+assert.match(approvalSetupMarkup, /Optionally connect an Authenticator app; once enabled, its code replaces the Approval password for every protected action and disables cooldown/);
+assert.doesNotMatch(approvalSetupMarkup, /Authy/);
 assert.doesNotMatch(approvalSetupMarkup, /command controls enroll/);
 assert.doesNotMatch(approvalSetupMarkup, /Copy setup command/);
 
@@ -105,7 +110,7 @@ const disabledApprovalMarkup = renderToStaticMarkup(createElement(ProtectionAuth
   onCheckAgain: () => undefined,
   onOpenApprovalSettings: () => undefined,
 }));
-assert.match(disabledApprovalMarkup, /Set up approval before enrollment/);
+assert.match(disabledApprovalMarkup, /Set up local approval before enrollment/);
 assert.doesNotMatch(disabledApprovalMarkup, /command controls enroll/);
 
 const pendingApprovalMarkup = renderToStaticMarkup(createElement(ProtectionAuthorityNotice, {