plugin-scanner 2.0.1036__tar.gz → 2.0.1038__tar.gz

{plugin_scanner-2.0.1036 → plugin_scanner-2.0.1038}/.gitignore

@@ -26,6 +26,7 @@ coverage/
 # Tooling
 .ruff_cache/
 dashboard/node_modules/
+dashboard/node_modules
 dashboard/.vite/
 dashboard/dist/
 output/playwright/

{plugin_scanner-2.0.1036 → plugin_scanner-2.0.1038}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1036
+Version: 2.0.1038
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1036 → plugin_scanner-2.0.1038}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/github-issue-link.test.ts && tsx src/shell-footer.test.ts && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts && tsx src/consolidated-evidence-alert.test.ts",
+    "test": "tsx src/github-issue-link.test.ts && tsx src/shell-footer.test.ts && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/package-workbench-panel.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts && tsx src/request-read-state.test.ts && tsx src/consolidated-evidence-alert.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

plugin_scanner-2.0.1038/dashboard/src/request-read-state.test.ts

@@ -0,0 +1,106 @@
+import { addReadIds, removeReadId, createRequestReadState, REQUEST_READ_STATE_KEY, REQUEST_READ_STATE_LIMIT } from "./request-read-state";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function makeStorage(initial: Record<string, string> = {}): Storage {
+  const store = new Map<string, string>(Object.entries(initial));
+  return {
+    getItem(key: string): string | null {
+      return store.get(key) ?? null;
+    },
+    setItem(key: string, value: string): void {
+      store.set(key, value);
+    },
+    removeItem(key: string): void {
+      store.delete(key);
+    },
+    clear(): void {
+      store.clear();
+    },
+    get length(): number {
+      return store.size;
+    },
+    key(index: number): string | null {
+      return Array.from(store.keys())[index] ?? null;
+    },
+  } as Storage;
+}
+
+// addReadIds marks ids as read and moves them to the front.
+assert(
+  JSON.stringify(addReadIds(["a", "b"], ["c"])) === JSON.stringify(["c", "a", "b"]),
+  "T-RRS-01: addReadIds prepends newly-read ids"
+);
+
+assert(
+  JSON.stringify(addReadIds(["a", "b"], ["b"])) === JSON.stringify(["b", "a"]),
+  "T-RRS-02: addReadIds reorders existing ids to the front"
+);
+
+assert(
+  JSON.stringify(addReadIds(["a", "b"], ["a", "b"])) === JSON.stringify(["a", "b"]),
+  "T-RRS-03: addReadIds preserves order when ids already at front"
+);
+
+assert(
+  JSON.stringify(addReadIds(["a", "b"], ["c", "c", "c"])) === JSON.stringify(["c", "a", "b"]),
+  "T-RRS-03b: addReadIds deduplicates repeated input ids"
+);
+
+assert(
+  addReadIds(new Array(REQUEST_READ_STATE_LIMIT).fill(0).map((_, i) => `id-${i}`), ["new"]).length === REQUEST_READ_STATE_LIMIT,
+  "T-RRS-04: addReadIds respects the limit"
+);
+
+assert(
+  !addReadIds(new Array(REQUEST_READ_STATE_LIMIT).fill(0).map((_, i) => `id-${i}`), ["new"]).includes(`id-${REQUEST_READ_STATE_LIMIT - 1}`),
+  "T-RRS-05: addReadIds evicts the oldest id at the limit"
+);
+
+// removeReadId unmarks an id.
+assert(
+  JSON.stringify(removeReadId(["a", "b", "c"], "b")) === JSON.stringify(["a", "c"]),
+  "T-RRS-06: removeReadId removes the target id"
+);
+
+assert(
+  JSON.stringify(removeReadId(["a", "b"], "c")) === JSON.stringify(["a", "b"]),
+  "T-RRS-07: removeReadId is a no-op for unknown ids"
+);
+
+// createRequestReadState reads and writes through storage.
+const storage = makeStorage({ [REQUEST_READ_STATE_KEY]: JSON.stringify({ ids: ["old-1"] }) });
+const state = createRequestReadState(storage);
+
+assert(state.isRead("old-1"), "T-RRS-08: state reflects persisted read ids");
+assert(!state.isRead("new-1"), "T-RRS-09: unknown ids are unread");
+
+state.markRead("new-1");
+assert(state.isRead("new-1"), "T-RRS-10: markRead makes an id read");
+assert(
+  JSON.parse(storage.getItem(REQUEST_READ_STATE_KEY)!).ids[0] === "new-1",
+  "T-RRS-11: markRead persists the id to storage"
+);
+
+state.markUnread("old-1");
+assert(!state.isRead("old-1"), "T-RRS-12: markUnread makes an id unread");
+assert(
+  !JSON.parse(storage.getItem(REQUEST_READ_STATE_KEY)!).ids.includes("old-1"),
+  "T-RRS-13: markUnread persists the removal"
+);
+
+state.markAllRead(["batch-1", "batch-2"]);
+assert(state.isRead("batch-1") && state.isRead("batch-2"), "T-RRS-14: markAllRead marks every id");
+
+// Graceful handling of corrupt storage.
+const corruptStorage = makeStorage({ [REQUEST_READ_STATE_KEY]: "not-json" });
+const corruptState = createRequestReadState(corruptStorage);
+assert(!corruptState.isRead("x"), "T-RRS-15: corrupt storage is treated as empty");
+corruptState.markRead("x");
+assert(corruptState.isRead("x"), "T-RRS-16: state recovers and writes valid JSON after corrupt storage");
+
+console.log("request-read-state tests passed");

plugin_scanner-2.0.1038/dashboard/src/request-read-state.ts

@@ -0,0 +1,119 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+
+export const REQUEST_READ_STATE_KEY = "hol-guard:read-request-ids";
+export const REQUEST_READ_STATE_LIMIT = 2000;
+
+export type RequestReadState = {
+  isRead: (requestId: string) => boolean;
+  markRead: (requestId: string) => void;
+  markUnread: (requestId: string) => void;
+  markAllRead: (requestIds: string[]) => void;
+  readCount: number;
+};
+
+export type ReadStateShape = {
+  ids: string[];
+};
+
+function safeReadStorage(storage: Storage | null | undefined): string[] {
+  if (!storage) return [];
+  try {
+    const raw = storage.getItem(REQUEST_READ_STATE_KEY);
+    if (!raw) return [];
+    const parsed = JSON.parse(raw) as ReadStateShape;
+    if (!parsed || !Array.isArray(parsed.ids)) return [];
+    return parsed.ids.filter((id): id is string => typeof id === "string");
+  } catch {
+    return [];
+  }
+}
+
+function safeWriteStorage(storage: Storage | null | undefined, ids: string[]): void {
+  if (!storage) return;
+  try {
+    storage.setItem(REQUEST_READ_STATE_KEY, JSON.stringify({ ids }));
+  } catch {
+    // Ignore quota or disabled-storage errors.
+  }
+}
+
+export function addReadIds(current: string[], requestIds: string[], limit = REQUEST_READ_STATE_LIMIT): string[] {
+  const uniqueNew = Array.from(new Set(requestIds));
+  const toAdd = new Set(uniqueNew);
+  const next = current.filter((id) => !toAdd.has(id));
+  next.unshift(...uniqueNew);
+  if (next.length > limit) {
+    next.length = limit;
+  }
+  return next;
+}
+
+export function removeReadId(current: string[], requestId: string): string[] {
+  return current.filter((id) => id !== requestId);
+}
+
+export function createRequestReadState(
+  storage: Storage | null | undefined = typeof window !== "undefined" ? window.localStorage : null
+): RequestReadState {
+  let ids = safeReadStorage(storage);
+
+  const persist = (): void => {
+    safeWriteStorage(storage, ids);
+  };
+
+  return {
+    isRead: (requestId: string) => ids.includes(requestId),
+    markRead: (requestId: string) => {
+      ids = addReadIds(ids, [requestId]);
+      persist();
+    },
+    markUnread: (requestId: string) => {
+      ids = removeReadId(ids, requestId);
+      persist();
+    },
+    markAllRead: (requestIds: string[]) => {
+      if (requestIds.length === 0) return;
+      ids = addReadIds(ids, requestIds);
+      persist();
+    },
+    get readCount(): number {
+      return ids.length;
+    },
+  };
+}
+
+function getStorage(): Storage | null {
+  return typeof window !== "undefined" ? window.localStorage : null;
+}
+
+export function useRequestReadState(): RequestReadState {
+  const [readIds, setReadIds] = useState<string[]>(() => safeReadStorage(getStorage()));
+
+  useEffect(() => {
+    setReadIds(safeReadStorage(getStorage()));
+  }, []);
+
+  useEffect(() => {
+    safeWriteStorage(getStorage(), readIds);
+  }, [readIds]);
+
+  const isRead = useCallback((requestId: string) => readIds.includes(requestId), [readIds]);
+
+  const markRead = useCallback((requestId: string) => {
+    setReadIds((current) => addReadIds(current, [requestId]));
+  }, []);
+
+  const markUnread = useCallback((requestId: string) => {
+    setReadIds((current) => removeReadId(current, requestId));
+  }, []);
+
+  const markAllRead = useCallback((requestIds: string[]) => {
+    if (requestIds.length === 0) return;
+    setReadIds((current) => addReadIds(current, requestIds));
+  }, []);
+
+  return useMemo(
+    () => ({ isRead, markRead, markUnread, markAllRead, readCount: readIds.length }),
+    [isRead, markRead, markUnread, markAllRead, readIds.length]
+  );
+}

{plugin_scanner-2.0.1036 → plugin_scanner-2.0.1038}/dashboard/src/review-workspace.tsx

@@ -56,6 +56,7 @@ import {
   standardScopeChoicesForRequest,
 } from "./approval-scopes";
 import { ConsolidatedEvidenceAlert, type EvidenceItem } from "./consolidated-evidence-alert";
+import { useRequestReadState, type RequestReadState, REQUEST_READ_STATE_LIMIT } from "./request-read-state";
 import {
   deriveDataFlowEvidence,
   deriveSkillRiskSignals,
@@ -164,6 +165,7 @@ const commonScopeValues = new Set<DecisionScope>(["artifact"]);
 
 export function ReviewWorkspace(props: ReviewWorkspaceProps) {
   const { requests, activeRequestId, detail } = props;
+  const readState = useRequestReadState();
   const queueRef = useRef<HTMLDivElement>(null);
   const [searchTerm, setSearchTerm] = useState("");
   const [categoryFilter, setCategoryFilter] = useState<QueueCategoryId | "all">("all");
@@ -174,11 +176,16 @@ export function ReviewWorkspace(props: ReviewWorkspaceProps) {
   const [mobileQueueOpen, setMobileQueueOpen] = useState(false);
   const [page, setPage] = useState(1);
 
-  const handleOpenRequest = useCallback((id: string) => {
+  const selectRequest = useCallback((id: string) => {
     props.onOpenRequest(id);
     setMobileQueueOpen(false);
   }, [props.onOpenRequest]);
 
+  const handleOpenRequest = useCallback((id: string) => {
+    selectRequest(id);
+    readState.markRead(id);
+  }, [selectRequest, readState]);
+
   const handleToggleMobileQueue = useCallback(() => {
     setMobileQueueOpen((v) => !v);
   }, []);
@@ -216,23 +223,39 @@ export function ReviewWorkspace(props: ReviewWorkspaceProps) {
       : null;
 
   useEffect(() => {
+    function isNestedQueueActionButton(target: EventTarget | null): boolean {
+      return (
+        target instanceof HTMLElement &&
+        target.tagName.toLowerCase() === "button" &&
+        target.getAttribute("role") !== "option"
+      );
+    }
+
     function handleKeyDown(event: KeyboardEvent) {
       if (pagedRequests.length === 0) return;
+      // Only fire queue navigation when focus is inside the review queue listbox
+      // and not on a nested action button such as "Mark unread".
+      if (
+        !(event.target instanceof HTMLElement) ||
+        !event.target.closest('[role="listbox"]') ||
+        isNestedQueueActionButton(event.target)
+      )
+        return;
       const activeIdx = pagedRequests.findIndex((r) => r.request_id === activeRequestId);
       if (event.key === "ArrowDown") {
         event.preventDefault();
         const nextIdx = Math.min(activeIdx + 1, pagedRequests.length - 1);
-        if (nextIdx !== activeIdx) props.onOpenRequest(pagedRequests[nextIdx].request_id);
+        if (nextIdx !== activeIdx) handleOpenRequest(pagedRequests[nextIdx].request_id);
       }
       if (event.key === "ArrowUp") {
         event.preventDefault();
         const prevIdx = Math.max(activeIdx - 1, 0);
-        if (prevIdx !== activeIdx) props.onOpenRequest(pagedRequests[prevIdx].request_id);
+        if (prevIdx !== activeIdx) handleOpenRequest(pagedRequests[prevIdx].request_id);
       }
     }
     window.addEventListener("keydown", handleKeyDown);
     return () => window.removeEventListener("keydown", handleKeyDown);
-  }, [pagedRequests, activeRequestId, props.onOpenRequest]);
+  }, [pagedRequests, activeRequestId, handleOpenRequest]);
 
   useEffect(() => {
     if (filteredRequests.length === 0) {
@@ -244,8 +267,8 @@ export function ReviewWorkspace(props: ReviewWorkspaceProps) {
     if (activeRequestId !== null && activeInRequests) {
       return;
     }
-    props.onOpenRequest(filteredRequests[0].request_id);
-  }, [activeRequestId, requests, filteredRequests, detail?.item.request_id, props.onOpenRequest]);
+    selectRequest(filteredRequests[0].request_id);
+  }, [activeRequestId, requests, filteredRequests, detail?.item.request_id, selectRequest]);
 
   useEffect(() => {
     if (pagedRequests.length === 0) return;
@@ -253,9 +276,9 @@ export function ReviewWorkspace(props: ReviewWorkspaceProps) {
       pagedRequests.some((item) => item.request_id === activeRequestId) ||
       detail?.item.request_id === activeRequestId;
     if (!activeOnPage) {
-      props.onOpenRequest(pagedRequests[0].request_id);
+      selectRequest(pagedRequests[0].request_id);
     }
-  }, [currentPage, pagedRequests, activeRequestId, detail?.item.request_id, props.onOpenRequest]);
+  }, [currentPage, pagedRequests, activeRequestId, detail?.item.request_id, selectRequest]);
 
   const bulkApprove = useQueueBulkApprove({
     items: filteredRequests,
@@ -362,6 +385,7 @@ export function ReviewWorkspace(props: ReviewWorkspaceProps) {
             totalCount={requests.length}
             filteredCount={filteredRequests.length}
             activeRequestId={activeItem.request_id}
+            readState={readState}
             categoryOptions={categoryOptions}
             categoryFilter={categoryFilter}
             searchTerm={searchTerm}
@@ -439,6 +463,7 @@ const ReviewQueueList = forwardRef<HTMLDivElement, {
   totalCount: number;
   filteredCount: number;
   activeRequestId: string | null;
+  readState: RequestReadState;
   categoryOptions: QueueCategory[];
   categoryFilter: QueueCategoryId | "all";
   searchTerm: string;
@@ -468,6 +493,7 @@ const ReviewQueueList = forwardRef<HTMLDivElement, {
   totalCount,
   filteredCount,
   activeRequestId,
+  readState,
   categoryOptions,
   categoryFilter,
   searchTerm,
@@ -588,9 +614,40 @@ const ReviewQueueList = forwardRef<HTMLDivElement, {
     <aside className="space-y-3" ref={ref}>
       <div className="flex items-center justify-between gap-3">
         <SectionLabel>Queue</SectionLabel>
-        <span className="font-mono text-[11px] font-semibold text-muted-foreground">
-          {filteredCount}/{totalCount}
-        </span>
+        <div className="flex items-center gap-3">
+          <button
+            type="button"
+            disabled={
+              allFilteredRequests.length > 0 &&
+              allFilteredRequests.length +
+                readState.readCount -
+                allFilteredRequests.filter((item) => readState.isRead(item.request_id)).length >
+                REQUEST_READ_STATE_LIMIT
+            }
+            title={
+              allFilteredRequests.length +
+                readState.readCount -
+                allFilteredRequests.filter((item) => readState.isRead(item.request_id)).length >
+                REQUEST_READ_STATE_LIMIT
+                ? `Cannot mark all read: doing so would exceed the read-state storage cap (${REQUEST_READ_STATE_LIMIT.toLocaleString()}). Reduce filters to shrink the visible queue, or mark requests read one by one.`
+                : `Marks every visible filtered request as read (remembering up to ${REQUEST_READ_STATE_LIMIT.toLocaleString()}).`
+            }
+            onClick={() => readState.markAllRead(allFilteredRequests.map((item) => item.request_id))}
+            className={`text-xs font-medium transition-colors ${
+              allFilteredRequests.length +
+                readState.readCount -
+                allFilteredRequests.filter((item) => readState.isRead(item.request_id)).length >
+                REQUEST_READ_STATE_LIMIT
+                ? "text-slate-400 cursor-not-allowed"
+                : "text-brand-blue hover:text-brand-dark"
+            }`}
+          >
+            Mark all read
+          </button>
+          <span className="font-mono text-[11px] font-semibold text-muted-foreground">
+            {filteredCount}/{totalCount}
+          </span>
+        </div>
       </div>
       <div className="space-y-2 rounded-xl border border-slate-100 bg-white p-3">
         <label className="block">
@@ -713,6 +770,7 @@ const ReviewQueueList = forwardRef<HTMLDivElement, {
               key={item.request_id}
               item={item}
               active={item.request_id === activeRequestId}
+              readState={readState}
               index={index}
               onOpenRequest={onOpenRequest}
               selectionMode={selectionMode}
@@ -785,9 +843,10 @@ function SemanticFilterButton(props: {
   );
 }
 
-function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = false, selectable = false, selected = false, onToggleSelect }: {
+function QueueItemRow({ item, active, readState, index, onOpenRequest, selectionMode = false, selectable = false, selected = false, onToggleSelect }: {
   item: GuardApprovalRequest;
   active: boolean;
+  readState: RequestReadState;
   index: number;
   onOpenRequest: (requestId: string) => void;
   selectionMode?: boolean;
@@ -799,6 +858,7 @@ function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = fals
   const category = resolveQueueCategory(item);
   const CategoryIcon = iconForQueueCategory(category.id);
   const preview = queueItemPreview(item);
+  const isRead = readState.isRead(item.request_id);
   // Checkboxes render whenever bulk selection is active so the affordance is
   // always discoverable. Non-eligible rows show a disabled checkbox with a
   // tooltip instead of silently hiding the control.
@@ -809,6 +869,14 @@ function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = fals
     onOpenRequest(item.request_id);
   }, [item.request_id, onOpenRequest]);
 
+  const handleMarkUnread = useCallback(
+    (event: React.MouseEvent<HTMLButtonElement>) => {
+      event.stopPropagation();
+      readState.markUnread(item.request_id);
+    },
+    [item.request_id, readState],
+  );
+
   const handleCheckboxChange = useCallback(
     (event: ChangeEvent<HTMLInputElement>) => {
       event.stopPropagation();
@@ -839,7 +907,7 @@ function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = fals
   return (
     <div
       role="none"
-      className={`w-full rounded-lg py-2.5 px-2 transition-all ${
+      className={`group w-full rounded-lg py-2.5 px-2 transition-all ${
         selected
           ? "border border-brand-blue/60 bg-brand-blue/[0.08] ring-1 ring-brand-blue/20"
           : active
@@ -873,7 +941,7 @@ function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = fals
           aria-posinset={index + 1}
           aria-setsize={undefined}
           tabIndex={active ? 0 : -1}
-          className="flex min-w-0 flex-1 items-center justify-between gap-2 text-left"
+          className="group flex min-w-0 flex-1 items-center justify-between gap-2 text-left"
         >
           <div className="flex min-w-0 items-center gap-2">
             <span
@@ -883,7 +951,10 @@ function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = fals
               aria-hidden="true"
             />
             <div className="min-w-0">
-              <p className="truncate text-sm font-medium text-brand-dark">{preview}</p>
+              <p className={`truncate text-sm ${isRead ? "font-medium text-brand-dark" : "font-bold text-brand-dark"}`}>
+                {!isRead && <span className="sr-only">Unread request:</span>}
+                {preview}
+              </p>
               <p className="truncate text-[11px] text-muted-foreground">
                 {harnessDisplayName(item.harness)} · {category.shortLabel} · {formatQueueRequestDate(item)}
               </p>
@@ -897,6 +968,15 @@ function QueueItemRow({ item, active, index, onOpenRequest, selectionMode = fals
             <CategoryIcon className="h-4 w-4" aria-hidden="true" />
           </span>
         </button>
+        <button
+          type="button"
+          onClick={handleMarkUnread}
+          aria-label={`Mark request ${preview} unread`}
+          title="Mark unread"
+          className="opacity-0 group-hover:opacity-100 focus:opacity-100 shrink-0 rounded-md p-1 text-[11px] font-medium text-slate-500 hover:bg-slate-100 hover:text-brand-dark transition-opacity"
+        >
+          Mark unread
+        </button>
       </div>
     </div>
   );

{plugin_scanner-2.0.1036 → plugin_scanner-2.0.1038}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1036"
+version = "2.0.1038"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1036 → plugin_scanner-2.0.1038}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1036"
+version = "2.0.1038"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"