plugin-scanner 2.0.749__tar.gz → 2.0.750__tar.gz

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.749
+Version: 2.0.750
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/dashboard/src/app.tsx

@@ -15,6 +15,7 @@ import {
   fetchSettings,
   fetchGuardUpdateStatus,
   guardAwareHref,
+  bulkAllowReadOnce,
   repairApprovalCenter,
   resolveRequestWithQueueResult,
   retryResume,
@@ -609,24 +610,28 @@ export function App() {
     if (bulkApproveInFlight.current) {
       return;
     }
+    if (!gateCredentials?.approval_password?.trim()) {
+      throw new Error("Bulk approval requires an approval password.");
+    }
     bulkApproveInFlight.current = true;
     try {
-      const results = await Promise.allSettled(
-        ids.map((id) =>
-          resolveRequestWithQueueResult({ requestId: id, action: "allow", scope: "artifact", reason: "", ...gateCredentials })
-        )
-      );
-      const succeeded = results.filter((r) => r.status === "fulfilled").length;
-      const failed = results.length - succeeded;
+      const result = await bulkAllowReadOnce({
+        requestIds: ids,
+        approval_password: gateCredentials.approval_password,
+        approval_totp_code: gateCredentials.approval_totp_code,
+        approval_gate_use_cooldown: gateCredentials.approval_gate_use_cooldown,
+      });
       await refreshStateAfterAction();
-      if (failed > 0) {
+      if (result.failed.length > 0) {
+        const succeeded = result.resolved_count;
+        const failed = result.failed.length;
         throw new Error(
-          failed === results.length
+          failed === ids.length
             ? "Bulk approval failed. Retry the selected items manually."
             : `${succeeded} approved, ${failed} failed. Retry the failed items manually.`
         );
       }
-      const label = `${succeeded} item${succeeded !== 1 ? "s" : ""} approved.`;
+      const label = `${result.resolved_count} item${result.resolved_count !== 1 ? "s" : ""} approved.`;
       setResolutionMessage(label);
     } finally {
       bulkApproveInFlight.current = false;

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/dashboard/src/approval-center-layout.tsx

@@ -90,8 +90,10 @@ import {
 } from "./queue-state";
 import {
   buildBulkGateCredentials,
+  isBulkApproveGateReady,
   QueueBulkApproveFlow,
   type BulkApproveFlowStep,
+  validateBulkApproveCredentials,
 } from "./queue-bulk-approve-flow";
 import {
   buildDecisionPayload,
@@ -630,7 +632,6 @@ function QueueBrowser(props: {
   const [selectedBulkIds, setSelectedBulkIds] = useState<Set<string>>(() => new Set());
   const [bulkApprovePassword, setBulkApprovePassword] = useState("");
   const [bulkApproveTotpCode, setBulkApproveTotpCode] = useState("");
-  const [bulkApproveUseCooldown, setBulkApproveUseCooldown] = useState(false);
   const [bulkApproveError, setBulkApproveError] = useState<string | null>(null);
   const [bulkCompletedActionCount, setBulkCompletedActionCount] = useState<number | null>(null);
   const harnesses = Array.from(new Set(props.items.map((item) => item.harness).filter(isDisplayableHarness))).sort();
@@ -707,10 +708,7 @@ function QueueBrowser(props: {
     props.onBulkApprove !== undefined &&
     (bulkEligibleGroups.length >= 2 || bulkFlowStep === "completed");
 
-  const showBulkGateFields =
-    showBulkApprove &&
-    props.approvalGate?.enabled === true &&
-    props.approvalGate.configured === true;
+  const bulkGateReady = isBulkApproveGateReady(props.approvalGate);
 
   const selectedBulkGroups = useMemo(
     () => bulkEligibleGroups.filter((group) => selectedBulkIds.has(group.primary.request_id)),
@@ -722,17 +720,19 @@ function QueueBrowser(props: {
     setSelectedBulkIds(new Set());
     setBulkApprovePassword("");
     setBulkApproveTotpCode("");
-    setBulkApproveUseCooldown(false);
     setBulkApproveError(null);
     setBulkCompletedActionCount(null);
   }, []);
 
   const handleBulkFlowStart = useCallback(() => {
+    if (!bulkGateReady) {
+      return;
+    }
     setBulkFlowStep("select");
     setSelectedBulkIds(new Set());
     setBulkApproveError(null);
     setBulkCompletedActionCount(null);
-  }, []);
+  }, [bulkGateReady]);
 
   const handleBulkSelectAll = useCallback(() => {
     setSelectedBulkIds(new Set(bulkApprovePrimaryIds(bulkEligibleGroups)));
@@ -777,21 +777,24 @@ function QueueBrowser(props: {
     setBulkApproveTotpCode(event.target.value);
   }, []);
 
-  const handleBulkApproveUseCooldownChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
-    setBulkApproveUseCooldown(event.target.checked);
-  }, []);
-
   const handleBulkConfirmApprove = useCallback(async () => {
     if (bulkFlowStep === "submitting" || bulkFlowStep === "completed" || selectedBulkGroups.length === 0) {
       return;
     }
     const ids = bulkApprovePrimaryIds(selectedBulkGroups);
     const approvedActionCount = bulkApproveActionCount(selectedBulkGroups);
+    const credentialError = validateBulkApproveCredentials(props.approvalGate, {
+      password: bulkApprovePassword,
+      totpCode: bulkApproveTotpCode,
+    });
+    if (credentialError !== null) {
+      setBulkApproveError(credentialError);
+      return;
+    }
     const gateCredentials = buildBulkGateCredentials(
-      showBulkGateFields,
+      props.approvalGate,
       bulkApprovePassword,
       bulkApproveTotpCode,
-      bulkApproveUseCooldown
     );
     setBulkFlowStep("submitting");
     setBulkApproveError(null);
@@ -801,7 +804,6 @@ function QueueBrowser(props: {
       setBulkFlowStep("completed");
       setBulkApprovePassword("");
       setBulkApproveTotpCode("");
-      setBulkApproveUseCooldown(false);
     } catch (error) {
       setBulkFlowStep("review");
       setBulkApproveError(error instanceof Error ? error.message : "Bulk approval failed.");
@@ -809,11 +811,10 @@ function QueueBrowser(props: {
   }, [
     bulkApprovePassword,
     bulkApproveTotpCode,
-    bulkApproveUseCooldown,
     bulkFlowStep,
+    props.approvalGate,
     props.onBulkApprove,
     selectedBulkGroups,
-    showBulkGateFields,
   ]);
 
   const blockEligibleGroups = useMemo(() => bulkBlockEligibleGroups(groups), [groups]);
@@ -840,9 +841,9 @@ function QueueBrowser(props: {
           completedActionCount={bulkCompletedActionCount}
           sensitiveFileReadCount={sensitiveFileReadCount}
           approvalGate={props.approvalGate ?? null}
+          settingsHref={guardAwareHref("/settings")}
           bulkApprovePassword={bulkApprovePassword}
           bulkApproveTotpCode={bulkApproveTotpCode}
-          bulkApproveUseCooldown={bulkApproveUseCooldown}
           errorMessage={bulkApproveError}
           onStart={handleBulkFlowStart}
           onSelectAll={handleBulkSelectAll}
@@ -853,7 +854,6 @@ function QueueBrowser(props: {
           onConfirmApprove={handleBulkConfirmApprove}
           onBulkApprovePasswordChange={handleBulkApprovePasswordChange}
           onBulkApproveTotpCodeChange={handleBulkApproveTotpCodeChange}
-          onBulkApproveUseCooldownChange={handleBulkApproveUseCooldownChange}
         />
       )}
       {!showBulkApprove && sensitiveFileReadCount > 0 && (

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/dashboard/src/approval-center-utils.ts

@@ -719,9 +719,9 @@ export function buildBulkApproveConsequenceCopy(actionCount: number): string {
     return "No read-only file reads are selected.";
   }
   if (actionCount === 1) {
-    return "Guard will allow one read-only file access and remember this retry only.";
+    return "Guard will approve once for one read-only file access. This applies to the current retry only and does not remember future reads.";
   }
-  return `Guard will allow ${actionCount} read-only file accesses. Each decision applies to this retry only, not future edits, writes, or different paths.`;
+  return `Guard will approve once for ${actionCount} read-only file accesses. Mass approval is risky: you are allowing many paths in one step without reviewing each file individually. Each decision applies to this retry only, not future edits, writes, or different paths.`;
 }
 
 export function buildCodexResumeUx(resume: GuardCodexResumeResult): CodexResumeUx {

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/dashboard/src/guard-api.ts

@@ -2020,6 +2020,45 @@ export async function resolveRequestWithQueueResult(input: {
   return normalizeQueueResolution(payload);
 }
 
+export type BulkAllowReadOnceResult = {
+  resolved_count: number;
+  failed: Array<{ request_id: string; error: string }>;
+  resolution_summary: string;
+};
+
+export async function bulkAllowReadOnce(input: {
+  requestIds: string[];
+  approval_password?: string;
+  approval_totp_code?: string;
+  approval_gate_use_cooldown?: boolean;
+}): Promise<BulkAllowReadOnceResult> {
+  if (isGuardDemoMode()) {
+    return {
+      resolved_count: input.requestIds.length,
+      failed: [],
+      resolution_summary: `${input.requestIds.length} read-only file reads approved once.`,
+    };
+  }
+  const payload = await readJson<BulkAllowReadOnceResult>("/v1/requests/bulk-allow-once", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...guardAuthHeaders(),
+    },
+    body: JSON.stringify({
+      request_ids: input.requestIds,
+      ...(input.approval_password !== undefined ? { approval_password: input.approval_password } : {}),
+      ...(input.approval_totp_code !== undefined ? { approval_totp_code: input.approval_totp_code } : {}),
+      approval_gate_use_cooldown: input.approval_gate_use_cooldown ?? false,
+    }),
+  });
+  return {
+    resolved_count: payload.resolved_count ?? 0,
+    failed: Array.isArray(payload.failed) ? payload.failed : [],
+    resolution_summary: payload.resolution_summary ?? "",
+  };
+}
+
 export async function clearEvidence(): Promise<void> {
   if (isGuardDemoMode()) {
     return;

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/dashboard/src/queue-bulk-approve-flow.tsx

@@ -10,6 +10,28 @@ import { bulkApproveActionCount, type QueueGroup } from "./queue-state";
 
 export type BulkApproveFlowStep = "collapsed" | "select" | "review" | "submitting" | "completed";
 
+export function isBulkApproveGateReady(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+): boolean {
+  return gate?.enabled === true && gate?.configured === true;
+}
+
+export function validateBulkApproveCredentials(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+  credentials: { password: string; totpCode: string },
+): string | null {
+  if (!isBulkApproveGateReady(gate)) {
+    return "Set up an approval password in Settings before bulk approval.";
+  }
+  if (!credentials.password.trim()) {
+    return "Enter your approval password to continue.";
+  }
+  if (gate?.totp_enabled === true && !credentials.totpCode.trim()) {
+    return "Enter your authenticator code to continue.";
+  }
+  return null;
+}
+
 export type QueueBulkApproveFlowProps = {
   step: BulkApproveFlowStep;
   eligibleGroups: QueueGroup[];
@@ -17,9 +39,9 @@ export type QueueBulkApproveFlowProps = {
   completedActionCount: number | null;
   sensitiveFileReadCount: number;
   approvalGate?: GuardApprovalGatePublicConfig | null;
+  settingsHref: string;
   bulkApprovePassword: string;
   bulkApproveTotpCode: string;
-  bulkApproveUseCooldown: boolean;
   errorMessage: string | null;
   onStart: () => void;
   onSelectAll: () => void;
@@ -30,7 +52,6 @@ export type QueueBulkApproveFlowProps = {
   onConfirmApprove: () => void;
   onBulkApprovePasswordChange: (event: ChangeEvent<HTMLInputElement>) => void;
   onBulkApproveTotpCodeChange: (event: ChangeEvent<HTMLInputElement>) => void;
-  onBulkApproveUseCooldownChange: (event: ChangeEvent<HTMLInputElement>) => void;
 };
 
 export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
@@ -55,10 +76,33 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
 
   const selectedActionCount = bulkApproveActionCount(props.selectedGroups);
   const riskLines = summarizeBulkApproveSelection(props.selectedGroups);
-  const showBulkGateFields =
-    props.approvalGate?.enabled === true && props.approvalGate?.configured === true;
+  const gateReady = isBulkApproveGateReady(props.approvalGate);
+  const credentialError = validateBulkApproveCredentials(props.approvalGate, {
+    password: props.bulkApprovePassword,
+    totpCode: props.bulkApproveTotpCode,
+  });
+  const confirmDisabled =
+    props.step === "submitting" ||
+    (props.step === "review" && credentialError !== null);
 
   if (props.step === "collapsed") {
+    if (!gateReady) {
+      return (
+        <div className="mb-4 rounded-xl border border-brand-attention/20 bg-brand-attention/[0.04] px-4 py-3">
+          <p className="text-sm font-semibold text-brand-dark">Bulk approve once requires an approval password</p>
+          <p className="mt-1 text-xs leading-5 text-brand-dark/70">
+            Set up your local approval gate before allowing multiple read-only file reads in one pass.
+            Bulk approval always uses approve once and cannot remember future reads.
+          </p>
+          <a
+            href={props.settingsHref}
+            className="mt-3 inline-flex rounded-full border border-brand-blue/30 bg-white px-4 py-2 text-sm font-medium text-brand-blue no-underline transition-colors hover:bg-brand-blue/5"
+          >
+            Open Settings
+          </a>
+        </div>
+      );
+    }
     return (
       <div className="mb-4 space-y-2">
         <button
@@ -66,7 +110,7 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
           onClick={props.onStart}
           className="rounded-full border border-brand-blue/30 bg-white px-4 py-2 text-sm font-medium text-brand-blue shadow-sm transition-colors hover:bg-brand-blue/5"
         >
-          Approve multiple read-only reads
+          Approve once for multiple read-only reads
         </button>
         {props.sensitiveFileReadCount > 0 && (
           <p className="text-xs text-brand-attention">
@@ -90,7 +134,7 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
   const confirmLabel =
     props.step === "submitting"
       ? "Approving..."
-      : `Approve ${selectedActionCount} read-only ${selectedUnit}`;
+      : `Approve once (${selectedActionCount} ${selectedUnit})`;
 
   return (
     <div className="mb-4 space-y-3 rounded-xl border border-slate-200 bg-white p-4 shadow-sm">
@@ -181,8 +225,16 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
               </p>
             </div>
           )}
-          {showBulkGateFields && (
+          <div className="flex items-start gap-2 rounded-lg border border-brand-attention/20 bg-brand-attention/[0.04] px-3 py-2">
+            <HiMiniExclamationTriangle className="mt-0.5 h-4 w-4 shrink-0 text-brand-attention" aria-hidden="true" />
+            <p className="text-xs leading-5 text-brand-dark/80">
+              Mass approval is risky. You are allowing multiple file reads without opening each request. Bulk approval
+              only supports approve once and never remembers future reads.
+            </p>
+          </div>
+          {gateReady && (
             <div className="space-y-2 rounded-lg border border-slate-200 bg-slate-50 px-3 py-2">
+              <p className="text-xs font-medium text-brand-dark">Confirm with your approval password</p>
               <label className="block">
                 <span className="sr-only">Approval password</span>
                 <input
@@ -210,18 +262,6 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
                   />
                 </label>
               )}
-              {(props.approvalGate?.cooldown_seconds ?? 0) > 0 && props.approvalGate?.totp_enabled !== true && (
-                <label className="flex items-center gap-2 text-xs text-slate-600">
-                  <input
-                    type="checkbox"
-                    checked={props.bulkApproveUseCooldown}
-                    onChange={props.onBulkApproveUseCooldownChange}
-                    disabled={props.step === "submitting"}
-                    className="rounded"
-                  />
-                  Skip password for next approvals (use cooldown)
-                </label>
-              )}
             </div>
           )}
           {props.errorMessage !== null && (
@@ -233,7 +273,7 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
             <button
               type="button"
               onClick={props.onConfirmApprove}
-              disabled={props.step === "submitting"}
+              disabled={confirmDisabled}
               className="rounded-full bg-brand-blue px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-brand-blue/90 disabled:cursor-not-allowed disabled:opacity-60"
             >
               {confirmLabel}
@@ -262,17 +302,16 @@ export function QueueBulkApproveFlow(props: QueueBulkApproveFlowProps) {
 }
 
 export function buildBulkGateCredentials(
-  showGateFields: boolean,
+  gate: GuardApprovalGatePublicConfig | null | undefined,
   password: string,
   totpCode: string,
-  useCooldown: boolean
 ): BulkGateCredentials | undefined {
-  if (!showGateFields) {
+  if (!isBulkApproveGateReady(gate)) {
     return undefined;
   }
   return {
-    approval_password: password,
-    approval_totp_code: totpCode,
-    approval_gate_use_cooldown: useCooldown,
+    approval_password: password.trim(),
+    approval_totp_code: totpCode.trim(),
+    approval_gate_use_cooldown: false,
   };
 }

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/dashboard/src/queue-bulk-approve.test.ts

@@ -3,7 +3,12 @@ import {
   buildBulkApproveConsequenceCopy,
   summarizeBulkApproveSelection,
 } from "./approval-center-utils";
-import { buildBulkGateCredentials } from "./queue-bulk-approve-flow";
+import type { GuardApprovalGatePublicConfig } from "./guard-types";
+import {
+  buildBulkGateCredentials,
+  isBulkApproveGateReady,
+  validateBulkApproveCredentials,
+} from "./queue-bulk-approve-flow";
 
 function assert(condition: boolean, message: string): void {
   if (!condition) {
@@ -73,19 +78,39 @@ assert(summary[0].path === "src/index.ts", "T-BULK-02: summarizeBulkApproveSelec
 assert(summary[1].duplicateCount === 1, "T-BULK-03: summarizeBulkApproveSelection preserves duplicate count");
 
 assert(
-  buildBulkApproveConsequenceCopy(2).includes("2 read-only file accesses"),
-  "T-BULK-04: buildBulkApproveConsequenceCopy pluralizes selected action count"
+  buildBulkApproveConsequenceCopy(2).includes("Mass approval is risky"),
+  "T-BULK-04: buildBulkApproveConsequenceCopy warns about mass approval"
+);
+
+assert(
+  buildBulkApproveConsequenceCopy(1).includes("approve once"),
+  "T-BULK-05: buildBulkApproveConsequenceCopy handles single selection with approve once copy"
 );
 
+const readyGate: GuardApprovalGatePublicConfig = {
+  enabled: true,
+  configured: true,
+  cooldown_seconds: 900,
+  cooldown_active: false,
+  cooldown_expires_at: null,
+  locked_until: null,
+  fail_closed: false,
+  strict_all_decisions: false,
+  totp_enabled: false,
+  totp_pending: false,
+};
+
+assert(isBulkApproveGateReady(readyGate) === true, "T-BULK-06: gate ready when enabled and configured");
+assert(isBulkApproveGateReady({ ...readyGate, configured: false }) === false, "T-BULK-07: gate not ready without password");
 assert(
-  buildBulkApproveConsequenceCopy(1).includes("one read-only file access"),
-  "T-BULK-05: buildBulkApproveConsequenceCopy handles single selection"
+  validateBulkApproveCredentials(readyGate, { password: "", totpCode: "" }) !== null,
+  "T-BULK-08: validateBulkApproveCredentials rejects empty password",
 );
 
-const gateCredentials = buildBulkGateCredentials(true, "secret", "123456", true);
-assert(gateCredentials?.approval_password === "secret", "T-BULK-06: buildBulkGateCredentials includes password when gate fields are shown");
-assert(gateCredentials?.approval_gate_use_cooldown === true, "T-BULK-07: buildBulkGateCredentials includes cooldown preference");
+const gateCredentials = buildBulkGateCredentials(readyGate, "secret", "123456");
+assert(gateCredentials?.approval_password === "secret", "T-BULK-09: buildBulkGateCredentials includes password when gate is ready");
+assert(gateCredentials?.approval_gate_use_cooldown === false, "T-BULK-10: buildBulkGateCredentials never enables cooldown for bulk");
 
-assert(buildBulkGateCredentials(false, "secret", "", false) === undefined, "T-BULK-08: buildBulkGateCredentials omits credentials when gate fields are hidden");
+assert(buildBulkGateCredentials(null, "secret", "") === undefined, "T-BULK-11: buildBulkGateCredentials omits credentials when gate is not ready");
 
 console.log("queue-bulk-approve.test.ts: all tests passed");

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.749"
+version = "2.0.750"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.749 → plugin_scanner-2.0.750}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.749"
+version = "2.0.750"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"