[JetSquirrel]

Shows plugin analyses in the desktop window, so an investigator can see why a resource was flagged without leaving it. The window knows nothing about AWS: it shows whatever a plugin declares (#55).

Merge order: #47, then this. This branch is built on it, so its diff shows that work until it lands. It targets main. Please merge these with merge commits, not squash or rebase, or each later branch stops containing the one before it (#55).

How the window stays generic

• It asks plugins what they offer, and shows an analysis on nodes with a label the plugin declared. There's no check for Instance, and a test fails if the window's code names a provider's labels or rules.
• All the words come from the plugin, including the Chinese. A verdict's tone sets how it's shown.
• It holds the graph only while reading, not while the plugin works, and Stop ends a run. A plugin not approved as it is now isn't started just to ask what it offers.
• The same findings as the command. A test compares the command with the library calls the window makes. The window's own wrapper around those calls isn't under test.

What changes

Selecting an instance on a graph canvas adds an Exposure section to the inspector, with a Run analysis button. Each finding shows:

• the verdict and rule
• each condition's status, with the AWS fields and values it read
• the candidate path
• what wasn't checked

There are two actions on each finding:

• Show path on canvas narrows the canvas to the path, as a walk. Back returns to the earlier view, Path Explorer can go on from it, and selecting a node on the path shows its evidence.
• Copy finding as JSON copies the same record as the CLI.

The check covers the whole graph, not just the canvas. It runs only when asked, and the result is dropped when the canvas gets a new result.

Checked in the real window

I ran the top of this chain (#54) on Windows against plugins/aws/tests/fixture-exposure, after moving the rules:

Case	Result
Selecting db-1	Exposure and Run analysis appear, from the plugin's declaration
Run analysis	Lateral finding is Potential exposure, and the direct one Not indicated, with conditions, fields and the claim
Show path on canvas	The five hops are listed, the path draws, Back appears, and the button hides while that path shows
Chinese interface	Verdicts, rule titles and condition statements switch, using the plugin's translations

Not checked in the window:

• After the move: web-1 and legacy-1, clicking Back, Stop, and Copy finding as JSON. Stop's cancellation has an end-to-end test below the window, and the rest were checked before the move, except the clipboard.
• macOS: I didn't run the window there.
• khonsu open --cypher ... --run right after launch: it reported delivered, but the query tab didn't change. I didn't look into it. It may be the known problem of a second open being dropped during startup, so I ran the query by hand.

Limits

• Partly English in Chinese: verdicts, rule titles and condition statements are translated. Each condition's detail and the "not checked" list come from the plugin in English.
• Only from a selected node: there's no account-wide findings list in the window, so you need a node with a label the analysis declares on the canvas first. khonsu plugin analyze gives the whole list.
• Path Explorer's copy button: on a shown finding, "Copy path evidence" has rule_id unknown, because it copies the walk. Copy finding as JSON has the rule.
• Scroll position: the inspector keeps its scroll position when you select another node, so a new selection can open partway down. It already behaved this way, but the longer section makes it easier to notice.

Testing

• cargo test --locked --workspace passes on Windows, and CI will cover macOS.
• New tests check that a plugin's words are used with its own as the fallback, that findings match the selected node, that a new result drops them and stops a running analysis, and that a finding becomes a walk drawing only its own path. In the AWS plugin, a test checks that every rule, verdict and condition has a translation.
• The rendering itself has no automated test.

Issue status

For #35, the walkthrough still hasn't been timed with a new engineer, so I'm leaving the issue open for that criterion.

Refs #55, #35

🤖 Generated with Claude Code