plugin-scanner 2.0.72__tar.gz → 2.0.74__tar.gz

{plugin_scanner-2.0.72 → plugin_scanner-2.0.74}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.72
+Version: 2.0.74
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner
@@ -21,15 +21,15 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.10
-Requires-Dist: cisco-ai-skill-scanner~=2.0.8
-Requires-Dist: cryptography>=46.0.0
+Requires-Dist: cisco-ai-skill-scanner~=2.0.9
+Requires-Dist: cryptography>=47.0.0
 Requires-Dist: rich>=13.0
 Requires-Dist: tomli>=2.0; python_version < '3.11'
 Provides-Extra: cisco
-Requires-Dist: cisco-ai-mcp-scanner~=4.5; (python_version >= '3.11') and extra == 'cisco'
+Requires-Dist: cisco-ai-mcp-scanner~=4.6; (python_version >= '3.11') and extra == 'cisco'
 Provides-Extra: dev
 Requires-Dist: build>=1.2.2; extra == 'dev'
-Requires-Dist: jsonschema>=4.26.0; extra == 'dev'
+Requires-Dist: jsonschema>=4.23.0; extra == 'dev'
 Requires-Dist: pytest-cov>=7.1.0; extra == 'dev'
 Requires-Dist: pytest>=9.0.3; extra == 'dev'
 Requires-Dist: pyyaml>=6.0.3; extra == 'dev'

{plugin_scanner-2.0.72 → plugin_scanner-2.0.74}/dashboard/pnpm-lock.yaml

@@ -724,8 +724,8 @@ packages:
     resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
-  postcss@8.5.9:
-    resolution: {integrity: sha512-7a70Nsot+EMX9fFU3064K/kdHWZqGVY+BADLyXc8Dfv+mTLLVl6JzJpPaCZ2kQL9gIJvKXSLMHhqdRRjwQeFtw==}
+  postcss@8.5.12:
+    resolution: {integrity: sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==}
     engines: {node: ^10 || ^12 || >=14}
 
   react-dom@19.2.5:
@@ -1372,7 +1372,7 @@ snapshots:
 
   picomatch@4.0.4: {}
 
-  postcss@8.5.9:
+  postcss@8.5.12:
     dependencies:
       nanoid: 3.3.11
       picocolors: 1.1.1
@@ -1450,7 +1450,7 @@ snapshots:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.9
+      postcss: 8.5.12
       rollup: 4.60.1
       tinyglobby: 0.2.16
     optionalDependencies:

{plugin_scanner-2.0.72 → plugin_scanner-2.0.74}/dashboard/src/approval-center-layout.tsx

@@ -1,5 +1,12 @@
 import type { ReactNode } from "react";
 import { useState, useEffect, useCallback, useMemo, type ChangeEvent } from "react";
+import {
+  HiMiniClipboard,
+  HiMiniClipboardDocumentCheck,
+  HiMiniExclamationTriangle,
+  HiMiniNoSymbol,
+  HiMiniArrowTopRightOnSquare,
+} from "react-icons/hi2";
 import {
   ShellHeader,
   ShellSidebar,
@@ -603,6 +610,7 @@ function RuleBuilder(props: {
           allowLabel={allowLabel}
           previewText={previewText}
           submitting={props.submitting}
+          isBlocked={props.item.policy_action === "block"}
           onAllow={() => props.onResolve("allow")}
           onBlock={() => props.onResolve("block")}
         />
@@ -614,10 +622,13 @@ function RuleBuilder(props: {
         <BlockedActionCard item={props.item} />
         <div className="space-y-4">
           <div>
-            <SectionLabel>Trust level</SectionLabel>
+            <SectionLabel>Approval scope</SectionLabel>
             <p className="mt-2 text-sm leading-6 text-brand-dark/75">
               {buildRecommendation(props.item)}
             </p>
+            <p className="mt-1 text-xs text-muted-foreground">
+              Start with the narrowest scope. Broader trust is harder to undo.
+            </p>
           </div>
           <fieldset className="space-y-3">
             <legend className="sr-only">Approval scope</legend>
@@ -635,19 +646,24 @@ function RuleBuilder(props: {
             </div>
             <details>
               <summary className="cursor-pointer select-none py-1 font-mono text-[11px] font-semibold uppercase tracking-[0.2em] text-muted-foreground transition-colors hover:text-brand-dark/70 [&::-webkit-details-marker]:hidden">
-                › Advanced trust levels
+                › Broader approval scopes
               </summary>
-              <div className="mt-2 grid gap-2 sm:grid-cols-3 xl:grid-cols-1">
-                {props.broadScopeOptions.map((option) => (
-                  <ScopeOption
-                    key={option.value}
-                    value={option.value}
-                    label={option.label}
-                    description={option.description}
-                    checked={props.scope === option.value}
-                    onChange={() => props.onScopeChange(option.value)}
-                  />
-                ))}
+              <div className="mt-2 rounded-[1rem] border border-amber-200/60 bg-amber-50/50 p-2 dark:border-amber-500/20 dark:bg-amber-900/10">
+                <p className="mb-2 px-1 text-[11px] font-medium text-amber-700 dark:text-amber-400">
+                  Broader scopes apply across more sessions. Use only when the narrower options are not enough.
+                </p>
+                <div className="grid gap-2 sm:grid-cols-3 xl:grid-cols-1">
+                  {props.broadScopeOptions.map((option) => (
+                    <ScopeOption
+                      key={option.value}
+                      value={option.value}
+                      label={option.label}
+                      description={option.description}
+                      checked={props.scope === option.value}
+                      onChange={() => props.onScopeChange(option.value)}
+                    />
+                  ))}
+                </div>
               </div>
             </details>
           </fieldset>
@@ -677,6 +693,7 @@ function DecisionActionPanel(props: {
   allowLabel: string;
   previewText: string;
   submitting: "allow" | "block" | null;
+  isBlocked: boolean;
   onAllow: () => void;
   onBlock: () => void;
 }) {
@@ -687,11 +704,11 @@ function DecisionActionPanel(props: {
         {props.previewText}
       </p>
       <div className="mt-4 grid gap-2">
-        <ActionButton onClick={props.onAllow} disabled={props.submitting !== null}>
-          {props.submitting === "allow" ? "Saving…" : props.allowLabel}
+        <ActionButton variant="success" onClick={props.onAllow} disabled={props.submitting !== null}>
+          {props.submitting === "allow" ? "Saving…" : (props.isBlocked ? "Allow — override block" : props.allowLabel)}
         </ActionButton>
         <ActionButton variant="danger" onClick={props.onBlock} disabled={props.submitting !== null}>
-          {props.submitting === "block" ? "Saving…" : "Keep blocked"}
+          {props.submitting === "block" ? "Saving…" : (props.isBlocked ? "Keep blocked" : "Block this action")}
         </ActionButton>
       </div>
       <p className="mt-3 text-xs leading-5 text-muted-foreground">
@@ -734,32 +751,97 @@ function DecisionSteps(props: { activeStep: number }) {
   );
 }
 
+function CopyCommandButton(props: { command: string }) {
+  const [copied, setCopied] = useState(false);
+
+  const handleCopy = useCallback(() => {
+    void navigator.clipboard?.writeText(props.command)?.then(() => {
+      setCopied(true);
+      const timer = setTimeout(() => setCopied(false), 2000);
+      return timer;
+    });
+  }, [props.command]);
+
+  return (
+    <button
+      type="button"
+      onClick={handleCopy}
+      aria-label="Copy command to clipboard"
+      className="inline-flex items-center gap-1.5 rounded-full border border-white/20 bg-white/10 px-2.5 py-1 font-mono text-[10px] font-semibold uppercase tracking-[0.18em] text-white/70 transition-colors hover:bg-white/20 hover:text-white"
+    >
+      {copied ? (
+        <HiMiniClipboardDocumentCheck className="h-3.5 w-3.5" aria-hidden="true" />
+      ) : (
+        <HiMiniClipboard className="h-3.5 w-3.5" aria-hidden="true" />
+      )}
+      {copied ? "Copied" : "Copy"}
+    </button>
+  );
+}
+
 function BlockedActionCard(props: { item: GuardApprovalRequest }) {
   const launchText = actionLaunchText(props.item);
+  const isBlocked = props.item.policy_action === "block";
+  const bannerBg = isBlocked
+    ? "bg-gradient-to-r from-brand-purple/90 to-brand-purple/75"
+    : "bg-gradient-to-r from-brand-blue/85 to-brand-dark/80";
+  const bannerLabel = isBlocked ? "Blocked" : "Paused for review";
+  const bannerIcon = isBlocked ? HiMiniNoSymbol : HiMiniExclamationTriangle;
+  const BannerIcon = bannerIcon;
+
   return (
-    <div className="rounded-[1.65rem] border border-brand-blue/15 bg-white/70 p-4 shadow-[inset_0_1px_0_rgba(255,255,255,0.85)]">
-      <div className="flex flex-wrap items-center justify-between gap-2">
-        <SectionLabel>What was stopped</SectionLabel>
-        <Badge tone="warning">{artifactTypeLabel(props.item.artifact_type)}</Badge>
+    <div className="overflow-hidden rounded-[1.65rem] border border-brand-blue/15 bg-white/70 shadow-[inset_0_1px_0_rgba(255,255,255,0.85)]">
+      <div className={`flex items-center gap-2 px-4 py-2.5 ${bannerBg}`}>
+        <BannerIcon className="h-3.5 w-3.5 shrink-0 text-white" aria-hidden="true" />
+        <span className="font-mono text-[11px] font-semibold uppercase tracking-[0.2em] text-white">
+          {bannerLabel}
+        </span>
+        {props.item.approval_url ? (
+          <a
+            href={props.item.approval_url}
+            target="_blank"
+            rel="noreferrer"
+            className="ml-auto inline-flex items-center gap-1 font-mono text-[10px] font-semibold uppercase tracking-[0.18em] text-white/80 transition-colors hover:text-white"
+          >
+            Approval link
+            <HiMiniArrowTopRightOnSquare className="h-3 w-3" aria-hidden="true" />
+          </a>
+        ) : null}
       </div>
-      <h4 className="mt-2 text-xl font-semibold tracking-tight text-brand-dark">
-        {actionDisplayTitle(props.item)}
-      </h4>
-      <p className="mt-2 text-sm leading-6 text-brand-dark/70">
-        {harnessDisplayName(props.item.harness)} paused this because {buildQueueSummary(props.item).toLowerCase()}.
-      </p>
-      <div className="mt-4 rounded-[1.25rem] bg-[#090d1a] p-1 shadow-[0_14px_35px_rgba(9,13,26,0.18)]">
-        <div className="flex items-center gap-1.5 border-b border-white/10 px-3 py-2">
-          <span className="h-2.5 w-2.5 rounded-full bg-brand-purple" />
-          <span className="h-2.5 w-2.5 rounded-full bg-brand-blue" />
-          <span className="h-2.5 w-2.5 rounded-full bg-brand-green" />
-          <span className="ml-2 font-mono text-[10px] uppercase tracking-[0.22em] text-white/45">
-            Command or tool details
-          </span>
+      <div className="p-4">
+        <div className="flex flex-wrap items-center justify-between gap-2">
+          <SectionLabel>What was stopped</SectionLabel>
+          <Badge tone="warning">{artifactTypeLabel(props.item.artifact_type)}</Badge>
+        </div>
+        <h4 className="mt-2 text-xl font-semibold tracking-tight text-brand-dark">
+          {actionDisplayTitle(props.item)}
+        </h4>
+        <p className="mt-2 text-sm leading-6 text-brand-dark/70">
+          {harnessDisplayName(props.item.harness)} paused this because {buildQueueSummary(props.item).toLowerCase()}.
+        </p>
+        <div className="mt-4 rounded-[1.25rem] bg-[#090d1a] p-1 shadow-[0_14px_35px_rgba(9,13,26,0.18)]">
+          <div className="flex items-center gap-1.5 border-b border-white/10 px-3 py-2">
+            <span className="h-2.5 w-2.5 rounded-full bg-brand-purple" />
+            <span className="h-2.5 w-2.5 rounded-full bg-brand-blue" />
+            <span className="h-2.5 w-2.5 rounded-full bg-brand-green" />
+            <span className="ml-2 font-mono text-[10px] uppercase tracking-[0.22em] text-white/45">
+              Stopped command
+            </span>
+            <span className="ml-auto">
+              <CopyCommandButton command={launchText} />
+            </span>
+          </div>
+          <pre className="overflow-x-auto whitespace-pre-wrap break-words px-3 py-3 font-mono text-sm leading-6 text-white">
+            {launchText}
+          </pre>
         </div>
-        <pre className="overflow-x-auto whitespace-pre-wrap break-words px-3 py-3 font-mono text-sm leading-6 text-white">
-          {launchText}
-        </pre>
+        {isBlocked && (
+          <div className="mt-3 rounded-[1rem] border border-brand-purple/20 bg-brand-purple/[0.05] px-3 py-2.5">
+            <p className="text-sm leading-6 text-brand-purple">
+              HOL Guard blocked this based on a saved decision. If this is a false positive, choose <span className="font-semibold">Allow</span> below and pick how broadly to remember the override.
+            </p>
+          </div>
+        )}
       </div>
     </div>
   );

{plugin_scanner-2.0.72 → plugin_scanner-2.0.74}/dashboard/src/approval-center-primitives.tsx

@@ -282,7 +282,7 @@ export function ActionButton(props: {
   children: ReactNode;
   onClick?: () => void;
   href?: string;
-  variant?: "primary" | "secondary" | "danger" | "outline" | "ghost";
+  variant?: "primary" | "secondary" | "danger" | "outline" | "ghost" | "success";
   disabled?: boolean;
 }) {
   const className = actionButtonClass(props.variant);
@@ -460,13 +460,14 @@ function tagToneClass(tone: "blue" | "green" | "purple" | "slate" | "red" | unde
   return "border-transparent bg-blue-500/10 text-blue-700";
 }
 
-function actionButtonClass(variant: "primary" | "secondary" | "danger" | "outline" | "ghost" | undefined): string {
+function actionButtonClass(variant: "primary" | "secondary" | "danger" | "outline" | "ghost" | "success" | undefined): string {
   const base = "inline-flex items-center justify-center rounded-lg text-sm font-semibold ring-offset-background transition-[color,background-color,border-color,opacity,transform,box-shadow] duration-150 active:scale-[0.98] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-brand-blue/40 focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 min-w-0";
   const sizeDefault = "min-h-11 h-auto px-4 py-2";
   if (variant === "outline") return `${base} ${sizeDefault} border border-slate-200 bg-white hover:bg-slate-50 hover:border-slate-300 text-slate-900`;
   if (variant === "secondary") return `${base} ${sizeDefault} border border-slate-200 bg-white hover:bg-slate-50 hover:border-slate-300 text-slate-900`;
   if (variant === "ghost") return `${base} ${sizeDefault} hover:bg-slate-100 hover:text-slate-900`;
   if (variant === "danger") return `${base} ${sizeDefault} bg-brand-purple text-white shadow-lg shadow-brand-blue/10 hover:bg-brand-purple/90 hover:shadow-brand-blue/20`;
+  if (variant === "success") return `${base} ${sizeDefault} bg-[#059669] text-white shadow-lg shadow-emerald-500/15 hover:bg-[#047857] hover:shadow-emerald-500/20`;
   return `${base} ${sizeDefault} bg-brand-blue text-white shadow-lg shadow-brand-blue/20 hover:bg-brand-blue/90 hover:shadow-brand-blue/30`;
 }
 

{plugin_scanner-2.0.72 → plugin_scanner-2.0.74}/dashboard/src/settings-workspace.tsx

@@ -1,4 +1,10 @@
 import { useCallback, useEffect, useState, type ChangeEvent } from "react";
+import {
+  HiMiniShieldCheck,
+  HiMiniLockClosed,
+  HiMiniCog6Tooth,
+  HiMiniCheckCircle,
+} from "react-icons/hi2";
 
 import {
   ActionButton,
@@ -34,17 +40,26 @@ const securityLevels = [
   {
     value: "balanced",
     label: "Balanced",
-    description: "Ask before secret access, hidden execution, exfiltration, and destructive actions."
+    description: "Ask before secret access, hidden execution, exfiltration, and destructive actions.",
+    icon: HiMiniShieldCheck,
+    protects: ["Secret file access", "Credential sharing", "Destructive shell commands", "Hidden scripts"],
+    tone: "blue" as const,
   },
   {
     value: "strict",
     label: "Strict",
-    description: "Ask more often, including new network destinations."
+    description: "Ask more often, including new network destinations.",
+    icon: HiMiniLockClosed,
+    protects: ["Everything in Balanced", "New network destinations"],
+    tone: "purple" as const,
   },
   {
     value: "custom",
     label: "Custom",
-    description: "Use the exact choices below for this machine and connected apps."
+    description: "Use the exact choices below for this machine and connected apps.",
+    icon: HiMiniCog6Tooth,
+    protects: [],
+    tone: "slate" as const,
   }
 ] as const;
 
@@ -306,22 +321,58 @@ export function SettingsWorkspace() {
         <div className="space-y-6">
           <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
             <SectionLabel>Security level</SectionLabel>
+            <p className="mt-2 text-sm leading-6 text-muted-foreground">
+              Pick a level to set up all risk choices at once. Switch to Custom only when you need to override individual behaviors.
+            </p>
             <div className="mt-4 grid gap-3 md:grid-cols-3">
-              {securityLevels.map((level) => (
-                <button
-                  key={level.value}
-                  type="button"
-                  onClick={() => handleSecurityLevelChange(level.value)}
-                  className={`min-h-32 rounded-[1.5rem] border p-4 text-left transition-all duration-150 ${
-                    draft.security_level === level.value
-                      ? "border-brand-blue/35 bg-brand-blue/[0.07] shadow-[0_12px_32px_rgba(85,153,254,0.14)]"
-                      : "border-transparent bg-surface-1/80 hover:bg-white"
-                  }`}
-                >
-                  <span className="text-base font-semibold text-brand-dark">{level.label}</span>
-                  <span className="mt-2 block text-sm leading-6 text-muted-foreground">{level.description}</span>
-                </button>
-              ))}
+              {securityLevels.map((level) => {
+                const LevelIcon = level.icon;
+                const isSelected = draft.security_level === level.value;
+                const iconColorClass =
+                  level.tone === "blue" ? "text-brand-blue" :
+                  level.tone === "purple" ? "text-brand-purple" :
+                  "text-slate-500";
+                const iconBgClass =
+                  level.tone === "blue" ? "bg-brand-blue/10" :
+                  level.tone === "purple" ? "bg-brand-purple/10" :
+                  "bg-slate-100";
+                const selectedBorderClass =
+                  level.tone === "blue" ? "border-brand-blue/35 bg-brand-blue/[0.07] shadow-[0_12px_32px_rgba(85,153,254,0.14)]" :
+                  level.tone === "purple" ? "border-brand-purple/35 bg-brand-purple/[0.06] shadow-[0_12px_32px_rgba(181,108,255,0.12)]" :
+                  "border-slate-300 bg-slate-50 shadow-sm";
+                return (
+                  <button
+                    key={level.value}
+                    type="button"
+                    onClick={() => handleSecurityLevelChange(level.value)}
+                    aria-pressed={isSelected}
+                    className={`relative min-h-36 rounded-[1.5rem] border p-4 text-left transition-all duration-150 ${
+                      isSelected ? selectedBorderClass : "border-transparent bg-surface-1/80 hover:bg-white"
+                    }`}
+                  >
+                    {isSelected && (
+                      <span className="absolute right-3 top-3 flex h-5 w-5 items-center justify-center rounded-full bg-[#059669]">
+                        <HiMiniCheckCircle className="h-4 w-4 text-white" aria-hidden="true" />
+                      </span>
+                    )}
+                    <span className={`inline-flex h-8 w-8 items-center justify-center rounded-lg ${iconBgClass}`}>
+                      <LevelIcon className={`h-4 w-4 ${iconColorClass}`} aria-hidden="true" />
+                    </span>
+                    <span className="mt-3 block text-base font-semibold text-brand-dark">{level.label}</span>
+                    <span className="mt-1.5 block text-sm leading-6 text-muted-foreground">{level.description}</span>
+                    {level.protects.length > 0 && (
+                      <ul className="mt-3 space-y-1">
+                        {level.protects.map((item) => (
+                          <li key={item} className="flex items-center gap-1.5 text-[11px] font-medium text-brand-dark/60">
+                            <span className={`h-1 w-1 shrink-0 rounded-full ${iconColorClass}`} />
+                            {item}
+                          </li>
+                        ))}
+                      </ul>
+                    )}
+                  </button>
+                );
+              })}
             </div>
           </div>
 
@@ -351,8 +402,28 @@ export function SettingsWorkspace() {
           </div>
 
           <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
-            <SectionLabel>Risk choices</SectionLabel>
-            <div className="mt-4 divide-y divide-slate-200/70 overflow-hidden rounded-[1.35rem] border border-slate-200/70 bg-white">
+            <div className="flex flex-wrap items-center justify-between gap-3">
+              <SectionLabel>Risk choices</SectionLabel>
+              {draft.security_level !== "custom" ? (
+                <span className="inline-flex items-center gap-1.5 rounded-full border border-slate-200 bg-slate-50 px-3 py-1 font-mono text-[10px] font-semibold uppercase tracking-[0.18em] text-slate-500">
+                  <HiMiniLockClosed className="h-3 w-3" aria-hidden="true" />
+                  Managed by {draft.security_level === "balanced" ? "Balanced" : "Strict"}
+                </span>
+              ) : (
+                <span className="inline-flex items-center gap-1.5 rounded-full border border-brand-blue/25 bg-brand-blue/[0.06] px-3 py-1 font-mono text-[10px] font-semibold uppercase tracking-[0.18em] text-brand-blue">
+                  <HiMiniCog6Tooth className="h-3 w-3" aria-hidden="true" />
+                  Custom overrides active
+                </span>
+              )}
+            </div>
+            {draft.security_level !== "custom" && (
+              <div className="mt-3 flex items-center justify-between gap-3 rounded-[1rem] border border-slate-200/60 bg-slate-50/80 px-4 py-3">
+                <p className="text-sm text-brand-dark/65">
+                  All risk behaviors are set by the <span className="font-semibold">{draft.security_level === "balanced" ? "Balanced" : "Strict"}</span> level. Select <span className="font-semibold">Custom</span> above to override individual choices.
+                </p>
+              </div>
+            )}
+            <div className={`mt-4 divide-y divide-slate-200/70 overflow-hidden rounded-[1.35rem] border border-slate-200/70 bg-white ${draft.security_level !== "custom" ? "opacity-60" : ""}`}>
               {riskControls.map((risk) => (
                 <div key={risk.key} className="grid gap-3 px-4 py-4 md:grid-cols-[minmax(0,1fr)_220px] md:items-center">
                   <div>
@@ -364,6 +435,7 @@ export function SettingsWorkspace() {
                     value={draft.risk_actions[risk.key] ?? "require-reapproval"}
                     options={actionOptions}
                     onChange={handleRiskActionChange(risk.key)}
+                    disabled={draft.security_level !== "custom"}
                   />
                 </div>
               ))}
@@ -372,7 +444,7 @@ export function SettingsWorkspace() {
 
           <div className="rounded-[1.75rem] border border-slate-200/70 bg-white/80 p-5 shadow-sm">
             <SectionLabel>Codex override</SectionLabel>
-            <div className="mt-4 grid gap-4 md:grid-cols-[minmax(0,1fr)_260px] md:items-center">
+            <div className={`mt-4 grid gap-4 md:grid-cols-[minmax(0,1fr)_260px] md:items-center ${draft.security_level !== "custom" ? "opacity-60" : ""}`}>
               <div>
                 <p className="text-sm font-semibold text-brand-dark">Codex reading local secret files</p>
                 <p className="mt-1 text-sm leading-6 text-muted-foreground">
@@ -384,6 +456,7 @@ export function SettingsWorkspace() {
                 value={draft.harness_risk_actions.codex?.local_secret_read ?? draft.risk_actions.local_secret_read ?? "require-reapproval"}
                 options={actionOptions}
                 onChange={handleCodexSecretReadChange}
+                disabled={draft.security_level !== "custom"}
               />
             </div>
           </div>
@@ -448,6 +521,7 @@ function SettingSelect(props: {
   value: string;
   options: Array<{ value: string; label: string }>;
   onChange: (event: ChangeEvent<HTMLSelectElement>) => void;
+  disabled?: boolean;
 }) {
   return (
     <label className="block">
@@ -455,7 +529,8 @@ function SettingSelect(props: {
       <select
         value={props.value}
         onChange={props.onChange}
-        className="mt-2 min-h-11 w-full rounded-full border border-slate-200 bg-white px-4 text-sm font-medium text-brand-dark transition-colors duration-150 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+        disabled={props.disabled}
+        className="mt-2 min-h-11 w-full rounded-full border border-slate-200 bg-white px-4 text-sm font-medium text-brand-dark transition-colors duration-150 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20 disabled:cursor-not-allowed disabled:opacity-60"
       >
         {props.options.map((option) => (
           <option key={option.value} value={option.value}>{option.label}</option>