fix: remove policy simulation from upstream resolution preview (#36)

* fix: remove policy simulation from upstream resolution preview

- Strip policy fetch path from previewResolution(), now only loads local package state and upstream configs
- Delete dead simulatePolicies() helper from upstreamChecker.js
- Add WebView rendering tests for upstream content and error states without policy data

* chore: add changelog entry for v2.1.1

Author: DevonL

CHANGELOG.md

@@ -1,3 +1,7 @@
+## 2.1.1 - March 2026
+### Fixed
+- Upstream Resolution Preview no longer throws an error when policy simulation endpoint returns 404
+
 ## 2.1.0 - March 2026
 ### Terraform Export
 

package.json

@@ -3,7 +3,7 @@
   "publisher": "Cloudsmith",
   "displayName": "Cloudsmith VS Code",
   "description": "Access packages from a Cloudsmith instance.",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/cloudsmith-io/cloudsmith-vscode-extension/blob/main/README.md",
   "bugs": {

test/upstreamChecker.test.js

@@ -553,3 +553,43 @@ suite("UpstreamChecker shared helper and format handling", () => {
     assert.strictEqual(updates.length, 0);
   });
 });
+
+suite("UpstreamChecker preview resolution", () => {
+  test("previewResolution does not trigger policy fetches and still returns upstream data", async () => {
+    const checker = new UpstreamChecker({});
+    let policyFetchCount = 0;
+
+    checker.existsLocally = async () => ({
+      data: null,
+      error: null,
+    });
+    checker.getUpstreamsForFormat = async () => ({
+      data: [
+        {
+          name: "PyPI",
+          upstream_url: "https://pypi.org/simple/",
+          is_active: true,
+        },
+        {
+          name: "Disabled mirror",
+          upstream_url: "https://disabled.example/python",
+          is_active: false,
+        },
+      ],
+      error: null,
+    });
+    checker.api.getV2 = async () => {
+      policyFetchCount += 1;
+      return [];
+    };
+
+    const result = await checker.previewResolution("acme", "example-repo", "flask", "python");
+
+    assert.strictEqual(policyFetchCount, 0);
+    assert.strictEqual("policies" in result, false);
+    assert.strictEqual(result.canResolveViaUpstream, true);
+    assert.strictEqual(result.upstreams.data.total, 2);
+    assert.strictEqual(result.upstreams.data.active, 1);
+    assert.strictEqual(result.upstreams.data.configs[0].name, "PyPI");
+  });
+});

test/upstreamPreviewProvider.test.js

@@ -0,0 +1,75 @@
+const assert = require("assert");
+const { UpstreamPreviewProvider } = require("../views/upstreamPreviewProvider");
+
+suite("UpstreamPreviewProvider Test Suite", () => {
+  test("renders upstream resolution details without any policy section", () => {
+    const provider = new UpstreamPreviewProvider({});
+
+    const html = provider._getHtmlContent({
+      name: "flask",
+      format: "python",
+      workspace: "acme",
+      repo: "example-repo",
+      local: {
+        data: null,
+        error: null,
+      },
+      upstreams: {
+        data: {
+          total: 2,
+          active: 1,
+          configs: [
+            {
+              name: "PyPI",
+              upstream_url: "https://pypi.org/simple/",
+              is_active: true,
+            },
+            {
+              name: "Legacy mirror",
+              upstream_url: "https://legacy.example/python",
+              is_active: false,
+            },
+          ],
+        },
+        error: null,
+      },
+      canResolveViaUpstream: true,
+    });
+
+    assert.ok(html.includes("Upstream resolution preview"));
+    assert.ok(html.includes("PyPI"));
+    assert.ok(html.includes("Legacy mirror"));
+    assert.ok(html.includes("Upstreams (1 active of 2)"));
+    assert.ok(!html.includes("Active policies"));
+    assert.ok(!html.includes("policy simulation"));
+    assert.ok(!html.includes("Block Until Scan"));
+    assert.ok(!html.includes("policy evaluation"));
+  });
+
+  test("renders upstream errors without expecting policy data", () => {
+    const provider = new UpstreamPreviewProvider({});
+
+    const html = provider._getHtmlContent({
+      name: "flask",
+      format: "python",
+      workspace: "acme",
+      repo: "example-repo",
+      local: {
+        data: null,
+        error: null,
+      },
+      upstreams: {
+        data: {
+          total: 0,
+          active: 0,
+          configs: [],
+        },
+        error: "Response status: 503 - Service Unavailable",
+      },
+      canResolveViaUpstream: false,
+    });
+
+    assert.ok(html.includes("Could not load upstream data"));
+    assert.ok(!html.includes("Active policies"));
+  });
+});

util/upstreamChecker.js

@@ -450,44 +450,24 @@ class UpstreamChecker {
     return state.upstreams;
   }
 
-  /**
-   * Simulate policy evaluation for a workspace.
-   * Uses the v2 API endpoint.
-   *
-   * @param   {string} workspace  Workspace slug.
-   * @returns {Object|null}       Policy simulation results, or null on error.
-   */
-  async simulatePolicies(workspace) {
-    const result = await this.api.getV2(
-      `workspaces/${workspace}/policies/simulate/`
-    );
-    if (typeof result === "string") {
-      console.warn(`[UpstreamChecker] Policy simulation error: ${result}`);
-      return { data: null, error: result };
-    }
-    return { data: result, error: null };
-  }
-
   /**
    * Orchestrate a full upstream resolution preview.
-   * Checks local existence, upstream configs, and active policies.
+   * Checks local existence and upstream configs for a package preview.
    *
    * @param   {string} workspace  Workspace slug.
    * @param   {string} repo       Repository slug.
    * @param   {string} name       Package name.
    * @param   {string} format     Package format.
-   * @returns {Object}            Combined result with local, upstream, and policy info.
+   * @returns {Object}            Combined result with local and upstream info.
    */
   async previewResolution(workspace, repo, name, format) {
-    // Run all checks in parallel
-    const [localPkg, upstreams, policies] = await Promise.all([
+    const [localPkg, upstreams] = await Promise.all([
       this.existsLocally(workspace, repo, name, format),
       this.getUpstreamsForFormat(workspace, repo, format),
-      this.simulatePolicies(workspace),
     ]);
 
     const upstreamList = Array.isArray(upstreams.data) ? upstreams.data : [];
-    const activeUpstreams = upstreamList.filter(u => u.is_active !== false);
+    const activeUpstreams = upstreamList.filter((upstream) => upstream.is_active !== false);
 
     return {
       name,
@@ -503,7 +483,6 @@ class UpstreamChecker {
         },
         error: upstreams.error,
       },
-      policies,
       canResolveViaUpstream: activeUpstreams.length > 0,
     };
   }

views/upstreamPreviewProvider.js

@@ -59,29 +59,8 @@ class UpstreamPreviewProvider {
       upstreamHtml += "</tbody></table>";
     }
 
-    let policyHtml = "";
-    if (result.policies.error) {
-      policyHtml = `<p class="error-banner">Could not load policy simulation: ${this._escapeHtml(result.policies.error)}</p>`;
-    } else {
-      const pols = Array.isArray(result.policies.data) ? result.policies.data : (result.policies.data && result.policies.data.results) || [];
-      if (pols.length === 0) {
-        policyHtml = '<p class="muted">No active policies found.</p>';
-      } else {
-        policyHtml = '<table class="data-table"><thead><tr><th>Policy</th><th>Type</th><th>Action</th></tr></thead><tbody>';
-        for (const p of pols) {
-          policyHtml += `<tr>
-            <td>${this._escapeHtml(p.name || p.slug_perm || "Unknown")}</td>
-            <td>${this._escapeHtml(p.policy_type || p.type || "")}</td>
-            <td>${this._escapeHtml(p.on_violation_quarantine ? "Quarantine" : (p.action || "Tag or warn"))}</td>
-          </tr>`;
-        }
-        policyHtml += "</tbody></table>";
-      }
-    }
-
     const resolutionSummary = result.canResolveViaUpstream
-      ? `<div class="resolution-yes">This package can likely resolve through ${result.upstreams.data.active} active upstream${result.upstreams.data.active === 1 ? "" : "s"}. ` +
-        "If Block Until Scan is enabled, the package stays blocked until policy evaluation completes.</div>"
+      ? `<div class="resolution-yes">This package can likely resolve through ${result.upstreams.data.active} active upstream${result.upstreams.data.active === 1 ? "" : "s"}.</div>`
       : '<div class="resolution-no">No active upstreams for this format. Upload the package directly.</div>';
 
     return `<!DOCTYPE html>
@@ -124,9 +103,6 @@ class UpstreamPreviewProvider {
 
   <h3>Upstreams (${result.upstreams.data.active} active of ${result.upstreams.data.total})</h3>
   ${upstreamHtml}
-
-  <h3>Active policies</h3>
-  ${policyHtml}
 </body>
 </html>`;
   }