GE-Enforce: compliance view, inline payload upload, frontend test harness

Fleet-install compliance for app-linked manifest entries: new service
compliance_for_scope + GET /geenforce/scopes/<id>/compliance count active
ComputerInstalledApp rows by curated appid (null-safe when computers plugin
absent). ManifestEditor gains a compliance panel. Curated appid stays shopdb
metadata and never enters manifest JSON, so behavioral parity is unaffected.

Inline manifest payloads: store_inline_payload (sha256, 1MB cap,
payloadsource='inline') + POST/GET /geenforce/entries/<id>/payload; editor
gains an upload control. Entry payload metadata surfaced in _entry_payload.

Frontend test harness: extract the editor's entry-form logic into pure
entryForm.js (buildEntryPayload, describeEntry, availableEntryTypes, scope
gates, ...) and cover it with 45 vitest tests. ManifestEditor now imports
those helpers, so the tests exercise the shipped code path (no duplication).

908 backend tests pass; vitest 45 pass; frontend build green; naming green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/package.json

@@ -6,7 +6,9 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@fontsource-variable/inter": "^5.2.8",
@@ -25,6 +27,9 @@
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^5.2.4",
-    "vite": "^6.4.1"
+    "@vue/test-utils": "^2.4.6",
+    "jsdom": "^25.0.1",
+    "vite": "^6.4.1",
+    "vitest": "^2.1.9"
   }
 }

frontend/src/views/geenforce/ManifestEditor.vue

@@ -218,6 +218,48 @@
             </div>
           </div>
         </div>
+
+        <!-- Compliance: install coverage for tracked-application entries -->
+        <div class="section-card">
+          <h3 class="section-title">Compliance: who has these installed?</h3>
+          <p class="setting-description">
+            Install counts for entries linked to a tracked application, from the
+            computers collector. Only entries with a tracked app appear.
+          </p>
+          <div v-if="compliance && compliance.computersplugin === false" class="muted compliance-note">
+            Install counts require the computers plugin.
+          </div>
+          <div class="table-container">
+            <table>
+              <thead>
+                <tr>
+                  <th>Entry</th>
+                  <th>Tracked app</th>
+                  <th>Expected version</th>
+                  <th>Installed</th>
+                  <th>On expected version</th>
+                  <th>Note</th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr v-for="row in complianceRows" :key="row.entryid">
+                  <td>{{ row.entryname }}</td>
+                  <td>{{ row.appname }}</td>
+                  <td class="muted">{{ row.expectedversion || '-' }}</td>
+                  <td>{{ row.installedcount === null ? '-' : row.installedcount }}</td>
+                  <td>
+                    <span v-if="row.versionmatchcount === null" class="muted">-</span>
+                    <span v-else>{{ row.versionmatchcount }}</span>
+                  </td>
+                  <td class="muted">{{ row.coveragenote }}</td>
+                </tr>
+                <tr v-if="!complianceRows.length">
+                  <td colspan="6" class="empty">No entries are linked to a tracked application yet.</td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
       </div>
 
       <div v-else class="section-card empty-detail">
@@ -334,6 +376,30 @@
             </div>
           </div>
 
+          <!-- inline payload upload (only for a saved entry) -->
+          <div v-if="entryForm.entryid" class="setting-group">
+            <h3>Inline payload</h3>
+            <p class="setting-description">
+              Attach a small file (installer config, .reg, script) stored in
+              shopdb and shipped with this entry.
+            </p>
+            <div v-if="entryForm.haspayload" class="payload-current muted">
+              Current: {{ entryForm.payloadref }}
+              <span v-if="entryForm.payloadsha256">(sha256 {{ entryForm.payloadsha256.slice(0, 12) }})</span>
+            </div>
+            <div v-else class="payload-current muted">No payload attached.</div>
+            <div class="payload-upload">
+              <input type="file" @change="onPayloadFileChange" />
+              <button
+                type="button"
+                class="btn btn-sm btn-secondary"
+                :disabled="!payloadFile || payloadUploading"
+                @click="uploadPayload"
+              >{{ payloadUploading ? 'Uploading...' : 'Upload' }}</button>
+            </div>
+            <small class="input-hint">Inline payloads are capped at 1 MB and stored in shopdb.</small>
+          </div>
+
           <!-- detection -->
           <div class="setting-row">
             <label>
@@ -353,7 +419,11 @@
               <label><span>Detection name</span><input v-model="entryForm.DetectionName" /></label>
             </div>
             <div class="setting-row">
-              <label><span>Detection value</span><input v-model="entryForm.DetectionValue" /></label>
+              <label>
+                <span>Detection value</span>
+                <input v-model="entryForm.DetectionValue" />
+                <small class="input-hint">For FileVersion detection this is the expected version used by the Compliance panel.</small>
+              </label>
             </div>
             <div v-if="entryForm.DetectionMethod === 'pnputil'" class="setting-row">
               <label><span>Detection pattern</span><input v-model="entryForm.DetectionPattern" /></label>
@@ -491,12 +561,16 @@
 <script setup>
 import { ref, computed } from 'vue'
 import api from '../../api'
-
-const ENTRY_TYPES = ['MSI', 'EXE', 'CMD', 'BAT', 'PS1', 'INF', 'File', 'Registry']
-const REG_TYPES = ['String', 'DWord', 'QWord', 'MultiString', 'ExpandString', 'Binary']
-const DETECTION_METHODS = ['Registry', 'File', 'FileVersion', 'Hash', 'MarkerFile',
-  'ValueMatches', 'pnputil', 'Always']
-const INUSE_BEHAVIORS = ['Defer', 'CloseAndReopen', 'ForceClose', 'ScheduleForReboot']
+// Pure entry-form logic lives in entryForm.js (unit-tested by entryForm.spec.js);
+// this component wires it to reactive state so the tests cover the shipped code.
+import {
+  ENTRY_TYPES, REG_TYPES, DETECTION_METHODS, INUSE_BEHAVIORS,
+  blankEntry, buildEntryPayload as buildEntryPayloadPure,
+  describeEntry, availableEntryTypes as availableEntryTypesFor,
+  availableDetectionMethods as availableDetectionMethodsFor,
+  targetingGates as targetingGatesFor, targetingHint as targetingHintFor,
+  scopeSummary as scopeSummaryFor,
+} from './entryForm'
 
 const scopes = ref([])
 const selectedId = ref(null)
@@ -510,66 +584,14 @@ const shareRoot = ref('')
 // and only preinstall honors the preinstall flags. Restrict the form for a
 // preinstall scope so an author cannot pick an option that would do nothing.
 const isPreinstallScope = computed(() => detail.value?.phase === 'preinstall')
-const availableEntryTypes = computed(() => {
-  if (!isPreinstallScope.value) return ENTRY_TYPES
-  const allowed = ['MSI', 'EXE']
-  // keep the current value visible even if it is out of the allowed set
-  const current = entryForm.value?.Type
-  return current && !allowed.includes(current) ? [...allowed, current] : allowed
-})
-const availableDetectionMethods = computed(() => {
-  if (!isPreinstallScope.value) return DETECTION_METHODS
-  const allowed = ['Registry', 'File']
-  const current = entryForm.value?.DetectionMethod
-  return current && !allowed.includes(current) ? [...allowed, current] : allowed
-})
-
-// One-line summary of what a scope installs (installer entries only).
-const scopeSummary = computed(() => {
-  const scope = detail.value
-  if (!scope || !scope.entries || !scope.entries.length) return ''
-  const installers = scope.entries
-    .filter(e => ['MSI', 'EXE', 'CMD', 'BAT'].includes(e.Type))
-    .map(e => e.Name)
-  const shown = installers.slice(0, 6).join(', ')
-  const more = installers.length > 6 ? `, +${installers.length - 6} more` : ''
-  const apps = installers.length ? `Installs ${shown}${more}. ` : ''
-  return `${apps}${scope.entries.length} entries; runs after common.`
-})
-
-// Show only the targeting gates a scope actually uses (a per-type manifest
-// already runs on its own type, so PCTypes is noise there; CMM shows a version
-// gate; collections shows machine numbers; the common/preinstall manifests use
-// PCTypes to target subsets). "Show all" reveals every gate.
+const availableEntryTypes = computed(() =>
+  availableEntryTypesFor(isPreinstallScope.value, entryForm.value?.Type))
+const availableDetectionMethods = computed(() =>
+  availableDetectionMethodsFor(isPreinstallScope.value, entryForm.value?.DetectionMethod))
+const scopeSummary = computed(() => scopeSummaryFor(detail.value))
 const showAllTargeting = ref(false)
-const targetingGates = computed(() => {
-  const scope = detail.value
-  if (!scope) {
-    return { pctypes: true, cmmversion: false, machinenumbers: false, hostnames: false }
-  }
-  const name = (scope.scopename || '').toLowerCase()
-  const entries = scope.entries || []
-  const fleetwide = scope.iscommon || scope.phase === 'preinstall' || name === 'common'
-  return {
-    pctypes: fleetwide || entries.some(e => (e.PCTypes || []).length),
-    cmmversion: /cmm/.test(name) || entries.some(e => e._CmmVersion),
-    // Data-driven (a loose name match would wrongly flag 'nocollections').
-    machinenumbers: entries.some(e => (e.TargetMachineNumbers || []).length),
-    hostnames: entries.some(e => (e.TargetHostnames || []).length),
-  }
-})
-const targetingHint = computed(() => {
-  const scope = detail.value
-  if (!scope) return ''
-  if (scope.iscommon || scope.scopename === 'common') {
-    return 'Fleet-wide manifest: use PC types to target which types get this entry.'
-  }
-  if (scope.phase === 'preinstall') {
-    return 'Preinstall manifest: use PC types to target; preinstall flags apply here.'
-  }
-  return `This manifest already runs only on ${scope.scopename} PCs. `
-    + 'Targeting below narrows within that (version, bay, or subtype).'
-})
+const targetingGates = computed(() => targetingGatesFor(detail.value))
+const targetingHint = computed(() => targetingHintFor(detail.value))
 
 const showNewScope = ref(false)
 const newScope = ref({ scopename: '', phase: 'runtime' })
@@ -587,6 +609,12 @@ const previewText = ref('')
 const sim = ref({ subtype: '', hostname: '', machinenumber: '', cmmversion: '' })
 const simResult = ref(null)
 
+const compliance = ref(null)
+const complianceRows = computed(() => compliance.value?.rows || [])
+
+const payloadFile = ref(null)
+const payloadUploading = ref(false)
+
 function payload(response) { return response.data.data }
 
 function flash(message) { notice.value = message; setTimeout(() => { notice.value = '' }, 4000) }
@@ -616,10 +644,17 @@ async function selectScope(id) {
   selectedId.value = id
   showVersions.value = false
   simResult.value = null
+  compliance.value = null
   try {
     detail.value = payload(await api.get(`/geenforce/scopes/${id}`))
+    loadCompliance(id)
   } catch (e) { error.value = 'Failed to load PC type' }
 }
+async function loadCompliance(id) {
+  try {
+    compliance.value = payload(await api.get(`/geenforce/scopes/${id}/compliance`))
+  } catch (e) { compliance.value = null }
+}
 
 function openNewScope() {
   newScope.value = { scopename: '', phase: 'runtime' }
@@ -654,13 +689,9 @@ async function deleteScope() {
 }
 
 // -- entries --
-function blankEntry() {
-  return { Type: 'MSI', DetectionMethod: '', RegType: 'String',
-    inuseBehavior: '', inuseProcesses: [], appid: null,
-    PreEnrollment: false, KillAfterDetection: false, PCTypesStrict: false }
-}
 function openNewEntry() {
   entryForm.value = blankEntry()
+  payloadFile.value = null
   showEntry.value = true
 }
 function openEditEntry(entry) {
@@ -679,6 +710,7 @@ function openEditEntry(entry) {
   form.KillAfterDetection = !!entry.KillAfterDetection
   form.PCTypesStrict = !!entry.PCTypesStrict
   entryForm.value = form
+  payloadFile.value = null
   showEntry.value = true
 }
 function addProcess() {
@@ -688,49 +720,8 @@ function addProcess() {
 function removeProcess(index) {
   entryForm.value.inuseProcesses.splice(index, 1)
 }
-function splitList(value) {
-  return (value || '').split(',').map(item => item.trim()).filter(Boolean)
-}
 function buildEntryPayload() {
-  const form = entryForm.value
-  // appid is shopdb metadata, always sent (null unlinks); the backend keeps it
-  // off the manifest JSON.
-  const out = { Name: form.Name, Type: form.Type, appid: form.appid ?? null }
-  const scalars = ['Installer', 'InstallArgs', 'Script', 'Args', 'Source',
-    'Destination', 'RegPath', 'RegName', 'RegType', 'DetectionPath',
-    'DetectionName', 'DetectionValue', 'DetectionPattern', '_CmmVersion',
-    'LogFile', 'ApplyMode', 'UpdateWindow', '_comment']
-  for (const key of scalars) {
-    if (form[key] !== undefined && form[key] !== '' && form[key] !== null) out[key] = form[key]
-  }
-  if (form.DetectionMethod) out.DetectionMethod = form.DetectionMethod
-  if (form.WaitTimeoutSec) out.WaitTimeoutSec = form.WaitTimeoutSec
-  if (form.Type === 'Registry' && form.RegValue !== undefined && form.RegValue !== '') {
-    out.RegValue = ['DWord', 'QWord'].includes(form.RegType) ? Number(form.RegValue) : form.RegValue
-  }
-  const pctypes = splitList(form.PCTypes)
-  if (pctypes.length) out.PCTypes = pctypes
-  const hostnames = splitList(form.TargetHostnames)
-  if (hostnames.length) out.TargetHostnames = hostnames
-  const machinenumbers = splitList(form.TargetMachineNumbers)
-  if (machinenumbers.length) out.TargetMachineNumbers = machinenumbers
-  for (const flag of ['PreEnrollment', 'KillAfterDetection', 'PCTypesStrict']) {
-    if (form[flag]) out[flag] = true
-  }
-  if (form.inuseBehavior) {
-    out.InUseCheck = {
-      Behavior: form.inuseBehavior,
-      Processes: (form.inuseProcesses || []).filter(process => process.name).map(process => {
-        const processData = { Name: process.name }
-        if (process.exepath) processData.ExePath = process.exepath
-        if (process.timeout !== null && process.timeout !== '' && process.timeout !== undefined) {
-          processData.GracefulCloseTimeoutSec = Number(process.timeout)
-        }
-        return processData
-      }),
-    }
-  }
-  return out
+  return buildEntryPayloadPure(entryForm.value)
 }
 async function saveEntry() {
   const body = buildEntryPayload()
@@ -745,6 +736,28 @@ async function saveEntry() {
     await loadScopes()
   } catch (e) { error.value = e.response?.data?.message || 'Save entry failed' }
 }
+function onPayloadFileChange(event) {
+  payloadFile.value = event.target.files?.[0] || null
+}
+async function uploadPayload() {
+  if (!entryForm.value.entryid || !payloadFile.value) return
+  payloadUploading.value = true
+  try {
+    const form = new FormData()
+    form.append('file', payloadFile.value)
+    const updated = payload(await api.post(
+      `/geenforce/entries/${entryForm.value.entryid}/payload`, form,
+      { headers: { 'Content-Type': 'multipart/form-data' } }))
+    entryForm.value.payloadsource = updated.payloadsource
+    entryForm.value.payloadref = updated.payloadref
+    entryForm.value.payloadsha256 = updated.payloadsha256
+    entryForm.value.haspayload = updated.haspayload
+    payloadFile.value = null
+    flash('Payload uploaded.')
+    await selectScope(detail.value.scopeid)
+  } catch (e) { error.value = e.response?.data?.message || 'Payload upload failed' }
+  finally { payloadUploading.value = false }
+}
 async function deleteEntry(entry) {
   if (!confirm(`Delete entry "${entry.Name}"?`)) return
   try {
@@ -820,30 +833,6 @@ function filterSummary(entry) {
 
 // Plain-English one-liner: what this entry does, when it self-heals, who it
 // applies to. Turns "eDNC | MSI | Registry | -" into intent an IT tech reads.
-const ACTION_VERB = {
-  MSI: 'Installs', EXE: 'Installs', CMD: 'Runs', BAT: 'Runs',
-  PS1: 'Runs a script for', INF: 'Installs a driver for',
-  File: 'Copies a file for', Registry: 'Sets a registry value for',
-}
-function describeEntry(entry) {
-  let text = `${ACTION_VERB[entry.Type] || 'Applies'} ${entry.Name}`
-  const method = entry.DetectionMethod
-  if (!method || method === 'Always') text += '; runs every cycle'
-  else if (method === 'FileVersion') text += `; reinstalls unless version is ${entry.DetectionValue || 'set'}`
-  else if (method === 'Hash') text += '; re-copies if the file changed'
-  else if (method === 'MarkerFile') text += '; installs once'
-  else text += '; reinstalls if not detected'
-  if (entry._CmmVersion) text += `; CMM ${entry._CmmVersion} bays only`
-  else if (entry.TargetMachineNumbers && entry.TargetMachineNumbers.length) {
-    text += `; ${entry.TargetMachineNumbers.length} specific bay(s)`
-  } else if (entry.TargetHostnames && entry.TargetHostnames.length) {
-    text += '; specific hostname(s)'
-  } else if (entry.PCTypes && entry.PCTypes.length) {
-    text += `; ${entry.PCTypes.length} PC type(s)`
-  }
-  if (entry.appname) text += `; tracked: ${entry.appname}`
-  return text
-}
 function formatDate(value) {
   return value ? new Date(value).toLocaleString() : ''
 }
@@ -1033,4 +1022,18 @@ loadApplications()
 
 /* Reorder / disabled buttons */
 .btn:disabled { opacity: 0.4; cursor: default; }
+
+/* Inline payload upload */
+.payload-current { font-size: 0.85rem; margin-bottom: 0.5rem; }
+.payload-upload {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  flex-wrap: wrap;
+  margin-bottom: 0.5rem;
+}
+.payload-upload input[type="file"] { min-width: 0; font-size: 0.85rem; }
+
+/* Compliance panel */
+.compliance-note { margin-bottom: 0.75rem; }
 </style>

frontend/src/views/geenforce/entryForm.js

@@ -0,0 +1,166 @@
+// Pure, framework-free helpers for the GE-Enforce manifest editor.
+//
+// These functions are lifted verbatim (behavior-for-behavior) from
+// ManifestEditor.vue so they can be unit tested without mounting the whole
+// component. ManifestEditor.vue still hosts its own copies today; a follow-up
+// should point the component at this module (import from here) so the tested
+// code and the shipped code are the same source. Until then keep the two in
+// sync: any change to the editor logic must land here too.
+//
+// Everything here is a plain function of its inputs. No Vue, no reactivity,
+// no network. That is the whole point - deterministic logic we can pin down.
+
+export const ENTRY_TYPES = ['MSI', 'EXE', 'CMD', 'BAT', 'PS1', 'INF', 'File', 'Registry']
+export const REG_TYPES = ['String', 'DWord', 'QWord', 'MultiString', 'ExpandString', 'Binary']
+export const DETECTION_METHODS = ['Registry', 'File', 'FileVersion', 'Hash', 'MarkerFile',
+  'ValueMatches', 'pnputil', 'Always']
+export const INUSE_BEHAVIORS = ['Defer', 'CloseAndReopen', 'ForceClose', 'ScheduleForReboot']
+
+// One blank entry form, matching the shape ManifestEditor seeds for a new entry.
+export function blankEntry() {
+  return { Type: 'MSI', DetectionMethod: '', RegType: 'String',
+    inuseBehavior: '', inuseProcesses: [], appid: null,
+    PreEnrollment: false, KillAfterDetection: false, PCTypesStrict: false }
+}
+
+// Split a comma list into trimmed non-empty parts.
+export function splitList(value) {
+  return (value || '').split(',').map(item => item.trim()).filter(Boolean)
+}
+
+// Turn an edit-form object into the API body sent to create/update an entry.
+//
+// Rules that matter (and that the specs pin):
+// - appid is always present (null unlinks). It is shopdb metadata; the backend
+//   keeps it OFF the manifest JSON, so it is NOT one of the manifest scalars.
+// - empty/undefined/null scalars are dropped.
+// - Registry DWord/QWord values become real numbers; other reg types stay strings.
+// - comma lists become arrays, and are dropped when empty.
+// - preinstall flags only appear when truthy.
+// - InUseCheck carries per-process Name, optional ExePath, optional numeric timeout.
+export function buildEntryPayload(form) {
+  // appid is shopdb metadata, always sent (null unlinks); the backend keeps it
+  // off the manifest JSON.
+  const out = { Name: form.Name, Type: form.Type, appid: form.appid ?? null }
+  const scalars = ['Installer', 'InstallArgs', 'Script', 'Args', 'Source',
+    'Destination', 'RegPath', 'RegName', 'RegType', 'DetectionPath',
+    'DetectionName', 'DetectionValue', 'DetectionPattern', '_CmmVersion',
+    'LogFile', 'ApplyMode', 'UpdateWindow', '_comment']
+  for (const key of scalars) {
+    if (form[key] !== undefined && form[key] !== '' && form[key] !== null) out[key] = form[key]
+  }
+  if (form.DetectionMethod) out.DetectionMethod = form.DetectionMethod
+  if (form.WaitTimeoutSec) out.WaitTimeoutSec = form.WaitTimeoutSec
+  if (form.Type === 'Registry' && form.RegValue !== undefined && form.RegValue !== '') {
+    out.RegValue = ['DWord', 'QWord'].includes(form.RegType) ? Number(form.RegValue) : form.RegValue
+  }
+  const pctypes = splitList(form.PCTypes)
+  if (pctypes.length) out.PCTypes = pctypes
+  const hostnames = splitList(form.TargetHostnames)
+  if (hostnames.length) out.TargetHostnames = hostnames
+  const machinenumbers = splitList(form.TargetMachineNumbers)
+  if (machinenumbers.length) out.TargetMachineNumbers = machinenumbers
+  for (const flag of ['PreEnrollment', 'KillAfterDetection', 'PCTypesStrict']) {
+    if (form[flag]) out[flag] = true
+  }
+  if (form.inuseBehavior) {
+    out.InUseCheck = {
+      Behavior: form.inuseBehavior,
+      Processes: (form.inuseProcesses || []).filter(process => process.name).map(process => {
+        const processData = { Name: process.name }
+        if (process.exepath) processData.ExePath = process.exepath
+        if (process.timeout !== null && process.timeout !== '' && process.timeout !== undefined) {
+          processData.GracefulCloseTimeoutSec = Number(process.timeout)
+        }
+        return processData
+      }),
+    }
+  }
+  return out
+}
+
+// Which entry types the type dropdown offers, given the scope phase. Preinstall
+// supports MSI/EXE only, but keeps a current out-of-set value visible.
+export function availableEntryTypes(isPreinstall, currentType) {
+  if (!isPreinstall) return ENTRY_TYPES
+  const allowed = ['MSI', 'EXE']
+  return currentType && !allowed.includes(currentType) ? [...allowed, currentType] : allowed
+}
+
+// Which detection methods the dropdown offers. Preinstall supports Registry/File
+// only, but keeps a current out-of-set value visible.
+export function availableDetectionMethods(isPreinstall, currentMethod) {
+  if (!isPreinstall) return DETECTION_METHODS
+  const allowed = ['Registry', 'File']
+  return currentMethod && !allowed.includes(currentMethod) ? [...allowed, currentMethod] : allowed
+}
+
+// Which targeting gates a scope actually surfaces by default (before "Show all").
+export function targetingGates(scope) {
+  if (!scope) {
+    return { pctypes: true, cmmversion: false, machinenumbers: false, hostnames: false }
+  }
+  const name = (scope.scopename || '').toLowerCase()
+  const entries = scope.entries || []
+  const fleetwide = scope.iscommon || scope.phase === 'preinstall' || name === 'common'
+  return {
+    pctypes: fleetwide || entries.some(e => (e.PCTypes || []).length),
+    cmmversion: /cmm/.test(name) || entries.some(e => e._CmmVersion),
+    // Data-driven (a loose name match would wrongly flag 'nocollections').
+    machinenumbers: entries.some(e => (e.TargetMachineNumbers || []).length),
+    hostnames: entries.some(e => (e.TargetHostnames || []).length),
+  }
+}
+
+// The contextual hint under the Targeting header.
+export function targetingHint(scope) {
+  if (!scope) return ''
+  if (scope.iscommon || scope.scopename === 'common') {
+    return 'Fleet-wide manifest: use PC types to target which types get this entry.'
+  }
+  if (scope.phase === 'preinstall') {
+    return 'Preinstall manifest: use PC types to target; preinstall flags apply here.'
+  }
+  return `This manifest already runs only on ${scope.scopename} PCs. `
+    + 'Targeting below narrows within that (version, bay, or subtype).'
+}
+
+// One-line summary of what a scope installs (installer entries only).
+export function scopeSummary(scope) {
+  if (!scope || !scope.entries || !scope.entries.length) return ''
+  const installers = scope.entries
+    .filter(e => ['MSI', 'EXE', 'CMD', 'BAT'].includes(e.Type))
+    .map(e => e.Name)
+  const shown = installers.slice(0, 6).join(', ')
+  const more = installers.length > 6 ? `, +${installers.length - 6} more` : ''
+  const apps = installers.length ? `Installs ${shown}${more}. ` : ''
+  return `${apps}${scope.entries.length} entries; runs after common.`
+}
+
+// Verb table for describeEntry.
+export const ACTION_VERB = {
+  MSI: 'Installs', EXE: 'Installs', CMD: 'Runs', BAT: 'Runs',
+  PS1: 'Runs a script for', INF: 'Installs a driver for',
+  File: 'Copies a file for', Registry: 'Sets a registry value for',
+}
+
+// Plain-English one-liner: what an entry does, when it self-heals, who it hits.
+export function describeEntry(entry) {
+  let text = `${ACTION_VERB[entry.Type] || 'Applies'} ${entry.Name}`
+  const method = entry.DetectionMethod
+  if (!method || method === 'Always') text += '; runs every cycle'
+  else if (method === 'FileVersion') text += `; reinstalls unless version is ${entry.DetectionValue || 'set'}`
+  else if (method === 'Hash') text += '; re-copies if the file changed'
+  else if (method === 'MarkerFile') text += '; installs once'
+  else text += '; reinstalls if not detected'
+  if (entry._CmmVersion) text += `; CMM ${entry._CmmVersion} bays only`
+  else if (entry.TargetMachineNumbers && entry.TargetMachineNumbers.length) {
+    text += `; ${entry.TargetMachineNumbers.length} specific bay(s)`
+  } else if (entry.TargetHostnames && entry.TargetHostnames.length) {
+    text += '; specific hostname(s)'
+  } else if (entry.PCTypes && entry.PCTypes.length) {
+    text += `; ${entry.PCTypes.length} PC type(s)`
+  }
+  if (entry.appname) text += `; tracked: ${entry.appname}`
+  return text
+}

frontend/src/views/geenforce/entryForm.spec.js

@@ -0,0 +1,302 @@
+import { describe, it, expect } from 'vitest'
+import {
+  blankEntry,
+  splitList,
+  buildEntryPayload,
+  availableEntryTypes,
+  availableDetectionMethods,
+  targetingGates,
+  targetingHint,
+  scopeSummary,
+  describeEntry,
+  ENTRY_TYPES,
+  DETECTION_METHODS,
+} from './entryForm.js'
+
+// These specs pin the deterministic logic that turns the manifest editor form
+// into an API body, and the various display helpers. This is the code most
+// likely to silently regress (numeric coercion, dropped-vs-kept fields, the
+// appid-must-never-be-a-manifest-scalar rule).
+
+describe('splitList', () => {
+  it('trims, drops empties, and returns an array', () => {
+    expect(splitList('a, b ,,  c ')).toEqual(['a', 'b', 'c'])
+  })
+  it('returns an empty array for null/empty', () => {
+    expect(splitList('')).toEqual([])
+    expect(splitList(null)).toEqual([])
+    expect(splitList(undefined)).toEqual([])
+  })
+})
+
+describe('buildEntryPayload - appid handling', () => {
+  it('always emits appid as a top-level key, defaulting to null', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'MSI' })
+    expect(out.appid).toBeNull()
+    expect('appid' in out).toBe(true)
+  })
+  it('passes a linked appid through unchanged', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'MSI', appid: 41 })
+    expect(out.appid).toBe(41)
+  })
+  it('never lets appid become a manifest scalar (it is metadata, not a manifest key)', () => {
+    // appid lives at the top level as metadata; it must not appear nested in
+    // any manifest sub-structure. Guard against a future refactor smuggling it
+    // into e.g. InUseCheck or a detection block.
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'Registry', appid: 7, RegType: 'DWord', RegValue: '1',
+      DetectionMethod: 'Registry', inuseBehavior: 'ForceClose',
+      inuseProcesses: [{ name: 'p', exepath: '', timeout: null }],
+    })
+    // Only the top-level appid key carries it.
+    const serialized = JSON.stringify({ ...out, appid: undefined })
+    expect(serialized.includes('appid')).toBe(false)
+    expect(serialized.toLowerCase().includes('"appid"')).toBe(false)
+  })
+})
+
+describe('buildEntryPayload - scalar filtering', () => {
+  it('drops empty-string, null, and undefined scalars', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI', Installer: '', InstallArgs: null,
+      Script: undefined, LogFile: 'setup.log',
+    })
+    expect('Installer' in out).toBe(false)
+    expect('InstallArgs' in out).toBe(false)
+    expect('Script' in out).toBe(false)
+    expect(out.LogFile).toBe('setup.log')
+  })
+  it('keeps the underscore-prefixed scalars (_CmmVersion, _comment)', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI', _CmmVersion: '2019', _comment: 'note',
+    })
+    expect(out._CmmVersion).toBe('2019')
+    expect(out._comment).toBe('note')
+  })
+  it('only emits DetectionMethod when set', () => {
+    expect('DetectionMethod' in buildEntryPayload({ Name: 'x', Type: 'MSI', DetectionMethod: '' })).toBe(false)
+    expect(buildEntryPayload({ Name: 'x', Type: 'MSI', DetectionMethod: 'FileVersion' }).DetectionMethod).toBe('FileVersion')
+  })
+  it('drops a zero/falsy WaitTimeoutSec but keeps a real one', () => {
+    expect('WaitTimeoutSec' in buildEntryPayload({ Name: 'x', Type: 'MSI', WaitTimeoutSec: 0 })).toBe(false)
+    expect(buildEntryPayload({ Name: 'x', Type: 'MSI', WaitTimeoutSec: 300 }).WaitTimeoutSec).toBe(300)
+  })
+})
+
+describe('buildEntryPayload - RegValue coercion', () => {
+  it('coerces DWord to a Number', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'Registry', RegType: 'DWord', RegValue: '1' })
+    expect(out.RegValue).toBe(1)
+    expect(typeof out.RegValue).toBe('number')
+  })
+  it('coerces QWord to a Number', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'Registry', RegType: 'QWord', RegValue: '42' })
+    expect(out.RegValue).toBe(42)
+  })
+  it('leaves String reg values as strings', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'Registry', RegType: 'String', RegValue: 'hello' })
+    expect(out.RegValue).toBe('hello')
+    expect(typeof out.RegValue).toBe('string')
+  })
+  it('does not emit RegValue for a non-Registry type', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'MSI', RegType: 'DWord', RegValue: '1' })
+    expect('RegValue' in out).toBe(false)
+  })
+  it('drops an empty RegValue even for Registry', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'Registry', RegType: 'DWord', RegValue: '' })
+    expect('RegValue' in out).toBe(false)
+  })
+})
+
+describe('buildEntryPayload - comma lists to arrays', () => {
+  it('splits PCTypes / TargetHostnames / TargetMachineNumbers', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI',
+      PCTypes: 'gea-shopfloor-cmm, gea-shopfloor-collections',
+      TargetHostnames: 'host-a, host-b',
+      TargetMachineNumbers: '0101, 0102',
+    })
+    expect(out.PCTypes).toEqual(['gea-shopfloor-cmm', 'gea-shopfloor-collections'])
+    expect(out.TargetHostnames).toEqual(['host-a', 'host-b'])
+    expect(out.TargetMachineNumbers).toEqual(['0101', '0102'])
+  })
+  it('omits the array keys when the list is empty', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'MSI', PCTypes: '', TargetHostnames: '  ' })
+    expect('PCTypes' in out).toBe(false)
+    expect('TargetHostnames' in out).toBe(false)
+  })
+})
+
+describe('buildEntryPayload - preinstall flags', () => {
+  it('emits only the truthy flags', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI',
+      PreEnrollment: true, KillAfterDetection: false, PCTypesStrict: true,
+    })
+    expect(out.PreEnrollment).toBe(true)
+    expect(out.PCTypesStrict).toBe(true)
+    expect('KillAfterDetection' in out).toBe(false)
+  })
+})
+
+describe('buildEntryPayload - InUseCheck processes', () => {
+  it('carries Name, optional ExePath, and a numeric timeout per process', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI', inuseBehavior: 'CloseAndReopen',
+      inuseProcesses: [
+        { name: 'pcdmis', exepath: 'C:\\pcd\\pcdmis.exe', timeout: 30 },
+        { name: 'nodmis', exepath: '', timeout: null },
+      ],
+    })
+    expect(out.InUseCheck.Behavior).toBe('CloseAndReopen')
+    expect(out.InUseCheck.Processes).toEqual([
+      { Name: 'pcdmis', ExePath: 'C:\\pcd\\pcdmis.exe', GracefulCloseTimeoutSec: 30 },
+      { Name: 'nodmis' },
+    ])
+  })
+  it('drops processes with no name', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI', inuseBehavior: 'ForceClose',
+      inuseProcesses: [{ name: '', exepath: 'x', timeout: 5 }, { name: 'keep', timeout: 5 }],
+    })
+    expect(out.InUseCheck.Processes).toEqual([{ Name: 'keep', GracefulCloseTimeoutSec: 5 }])
+  })
+  it('coerces a string timeout to a number', () => {
+    const out = buildEntryPayload({
+      Name: 'x', Type: 'MSI', inuseBehavior: 'Defer',
+      inuseProcesses: [{ name: 'p', exepath: '', timeout: '15' }],
+    })
+    expect(out.InUseCheck.Processes[0].GracefulCloseTimeoutSec).toBe(15)
+  })
+  it('emits no InUseCheck when there is no behavior', () => {
+    const out = buildEntryPayload({ Name: 'x', Type: 'MSI', inuseBehavior: '' })
+    expect('InUseCheck' in out).toBe(false)
+  })
+})
+
+describe('buildEntryPayload - a blank new entry round-trips', () => {
+  it('produces a minimal body from blankEntry (name/type + null appid + default RegType)', () => {
+    const out = buildEntryPayload({ ...blankEntry(), Name: 'Fresh' })
+    // Type MSI, appid null. RegType is default String but non-Registry, so it
+    // is still carried as a scalar (it is in the scalar list). Confirm the shape.
+    expect(out.Name).toBe('Fresh')
+    expect(out.Type).toBe('MSI')
+    expect(out.appid).toBeNull()
+    expect('InUseCheck' in out).toBe(false)
+    expect('PCTypes' in out).toBe(false)
+  })
+})
+
+describe('availableEntryTypes', () => {
+  it('returns the full list for a non-preinstall scope', () => {
+    expect(availableEntryTypes(false, 'File')).toEqual(ENTRY_TYPES)
+  })
+  it('restricts to MSI/EXE for preinstall', () => {
+    expect(availableEntryTypes(true, 'MSI')).toEqual(['MSI', 'EXE'])
+  })
+  it('keeps an out-of-set current value visible in preinstall', () => {
+    expect(availableEntryTypes(true, 'Registry')).toEqual(['MSI', 'EXE', 'Registry'])
+  })
+})
+
+describe('availableDetectionMethods', () => {
+  it('returns the full list for a non-preinstall scope', () => {
+    expect(availableDetectionMethods(false, 'Hash')).toEqual(DETECTION_METHODS)
+  })
+  it('restricts to Registry/File for preinstall', () => {
+    expect(availableDetectionMethods(true, 'File')).toEqual(['Registry', 'File'])
+  })
+  it('keeps an out-of-set current value visible in preinstall', () => {
+    expect(availableDetectionMethods(true, 'FileVersion')).toEqual(['Registry', 'File', 'FileVersion'])
+  })
+})
+
+describe('targetingGates', () => {
+  it('defaults to pctypes-only when there is no scope', () => {
+    expect(targetingGates(null)).toEqual({
+      pctypes: true, cmmversion: false, machinenumbers: false, hostnames: false,
+    })
+  })
+  it('shows pctypes for a fleetwide/common/preinstall scope', () => {
+    expect(targetingGates({ scopename: 'common', entries: [] }).pctypes).toBe(true)
+    expect(targetingGates({ scopename: 'x', phase: 'preinstall', entries: [] }).pctypes).toBe(true)
+    expect(targetingGates({ scopename: 'x', iscommon: true, entries: [] }).pctypes).toBe(true)
+  })
+  it('shows the cmm gate for a cmm-named scope', () => {
+    expect(targetingGates({ scopename: 'gea-shopfloor-cmm', entries: [] }).cmmversion).toBe(true)
+  })
+  it('does not name-match machinenumbers (data-driven only)', () => {
+    // 'nocollections' must not trip a loose name match; machinenumbers is purely
+    // data-driven off the entries.
+    const gates = targetingGates({ scopename: 'nocollections', entries: [] })
+    expect(gates.machinenumbers).toBe(false)
+  })
+  it('surfaces gates from entry data', () => {
+    const gates = targetingGates({
+      scopename: 'per-type', entries: [
+        { PCTypes: ['a'] }, { TargetMachineNumbers: ['0101'] }, { TargetHostnames: ['h'] },
+      ],
+    })
+    expect(gates.pctypes).toBe(true)
+    expect(gates.machinenumbers).toBe(true)
+    expect(gates.hostnames).toBe(true)
+  })
+})
+
+describe('targetingHint', () => {
+  it('is empty with no scope', () => {
+    expect(targetingHint(null)).toBe('')
+  })
+  it('describes a fleet-wide common manifest', () => {
+    expect(targetingHint({ scopename: 'common' })).toMatch(/Fleet-wide/)
+  })
+  it('describes a preinstall manifest', () => {
+    expect(targetingHint({ scopename: 'x', phase: 'preinstall' })).toMatch(/Preinstall/)
+  })
+  it('names a per-type scope', () => {
+    expect(targetingHint({ scopename: 'gea-shopfloor-cmm' })).toMatch(/gea-shopfloor-cmm/)
+  })
+})
+
+describe('scopeSummary', () => {
+  it('is empty with no entries', () => {
+    expect(scopeSummary({ entries: [] })).toBe('')
+    expect(scopeSummary(null)).toBe('')
+  })
+  it('lists installer names and the entry count', () => {
+    const summary = scopeSummary({
+      entries: [
+        { Type: 'MSI', Name: 'eDNC' },
+        { Type: 'Registry', Name: 'reg' },
+      ],
+    })
+    expect(summary).toBe('Installs eDNC. 2 entries; runs after common.')
+  })
+  it('truncates past six installers with a +N more', () => {
+    const entries = Array.from({ length: 8 }, (_, i) => ({ Type: 'MSI', Name: `app${i}` }))
+    const summary = scopeSummary({ entries })
+    expect(summary).toMatch(/\+2 more/)
+  })
+})
+
+describe('describeEntry', () => {
+  it('describes an MSI with FileVersion detection using the expected version', () => {
+    const text = describeEntry({ Type: 'MSI', Name: 'PC-DMIS', DetectionMethod: 'FileVersion', DetectionValue: '2019 R1' })
+    expect(text).toBe('Installs PC-DMIS; reinstalls unless version is 2019 R1')
+  })
+  it('says runs every cycle for Always / no detection', () => {
+    expect(describeEntry({ Type: 'CMD', Name: 'x' })).toBe('Runs x; runs every cycle')
+    expect(describeEntry({ Type: 'CMD', Name: 'x', DetectionMethod: 'Always' })).toBe('Runs x; runs every cycle')
+  })
+  it('appends a CMM gate note', () => {
+    const text = describeEntry({ Type: 'MSI', Name: 'x', _CmmVersion: '2016' })
+    expect(text).toMatch(/CMM 2016 bays only/)
+  })
+  it('appends the tracked app name when present', () => {
+    const text = describeEntry({ Type: 'MSI', Name: 'x', appname: 'PC-DMIS' })
+    expect(text).toMatch(/tracked: PC-DMIS/)
+  })
+  it('falls back to Applies for an unknown type', () => {
+    expect(describeEntry({ Type: 'Weird', Name: 'x' })).toMatch(/^Applies x/)
+  })
+})

frontend/vitest.config.js

@@ -0,0 +1,19 @@
+import { defineConfig } from 'vitest/config'
+import vue from '@vitejs/plugin-vue'
+import path from 'path'
+
+// Standalone vitest config so the unit runner stays independent of vite.config.js.
+// jsdom gives component specs a DOM; the '@' alias mirrors the app build.
+export default defineConfig({
+  plugins: [vue()],
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+    },
+  },
+  test: {
+    environment: 'jsdom',
+    globals: true,
+    include: ['src/**/*.spec.js'],
+  },
+})