plugin-scanner 2.0.754__tar.gz → 2.0.756__tar.gz

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.754
+Version: 2.0.756
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/package.json

@@ -17,6 +17,7 @@
   },
   "devDependencies": {
     "@playwright/test": "^1.50.0",
+    "@types/node": "^24.0.0",
     "@tailwindcss/vite": "^4.1.4",
     "@types/react": "^19.2.2",
     "@types/react-dom": "^19.2.2",

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/pnpm-lock.yaml

@@ -26,7 +26,10 @@ importers:
         version: 1.60.0
       '@tailwindcss/vite':
         specifier: ^4.1.4
-        version: 4.2.2(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
+        version: 4.2.2(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
+      '@types/node':
+        specifier: ^24.0.0
+        version: 24.13.2
       '@types/react':
         specifier: ^19.2.2
         version: 19.2.14
@@ -35,7 +38,7 @@ importers:
         version: 19.2.3(@types/react@19.2.14)
       '@vitejs/plugin-react':
         specifier: ^5.0.4
-        version: 5.2.0(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
+        version: 5.2.0(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))
       tailwindcss:
         specifier: ^4.1.4
         version: 4.2.2
@@ -47,7 +50,7 @@ importers:
         version: 5.9.3
       vite:
         specifier: ^7.1.10
-        version: 7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
+        version: 7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
 
 packages:
 
@@ -561,6 +564,9 @@ packages:
   '@types/estree@1.0.8':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
+  '@types/node@24.13.2':
+    resolution: {integrity: sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==}
+
   '@types/react-dom@19.2.3':
     resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
     peerDependencies:
@@ -861,6 +867,9 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  undici-types@7.18.2:
+    resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
+
   update-browserslist-db@1.2.3:
     resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
     hasBin: true
@@ -1263,12 +1272,12 @@ snapshots:
       '@tailwindcss/oxide-win32-arm64-msvc': 4.2.2
       '@tailwindcss/oxide-win32-x64-msvc': 4.2.2
 
-  '@tailwindcss/vite@4.2.2(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
+  '@tailwindcss/vite@4.2.2(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
     dependencies:
       '@tailwindcss/node': 4.2.2
       '@tailwindcss/oxide': 4.2.2
       tailwindcss: 4.2.2
-      vite: 7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
+      vite: 7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
 
   '@types/babel__core@7.20.5':
     dependencies:
@@ -1293,6 +1302,10 @@ snapshots:
 
   '@types/estree@1.0.8': {}
 
+  '@types/node@24.13.2':
+    dependencies:
+      undici-types: 7.18.2
+
   '@types/react-dom@19.2.3(@types/react@19.2.14)':
     dependencies:
       '@types/react': 19.2.14
@@ -1301,7 +1314,7 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
-  '@vitejs/plugin-react@5.2.0(vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
+  '@vitejs/plugin-react@5.2.0(vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0))':
     dependencies:
       '@babel/core': 7.29.0
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.0)
@@ -1309,7 +1322,7 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-rc.3
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
-      vite: 7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
+      vite: 7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -1572,13 +1585,15 @@ snapshots:
 
   typescript@5.9.3: {}
 
+  undici-types@7.18.2: {}
+
   update-browserslist-db@1.2.3(browserslist@4.28.2):
     dependencies:
       browserslist: 4.28.2
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  vite@7.3.2(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0):
+  vite@7.3.2(@types/node@24.13.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0):
     dependencies:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.4)
@@ -1587,6 +1602,7 @@ snapshots:
       rollup: 4.60.1
       tinyglobby: 0.2.16
     optionalDependencies:
+      '@types/node': 24.13.2
       fsevents: 2.3.3
       jiti: 2.6.1
       lightningcss: 1.32.0

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/approval-center-layout.tsx

@@ -1,4 +1,4 @@
-import type { ReactNode, MouseEvent, KeyboardEvent } from "react";
+import type { ReactNode, MouseEvent, KeyboardEvent as ReactKeyboardEvent } from "react";
 import { useState, useEffect, useCallback, useMemo, useRef, type ChangeEvent } from "react";
 import {
   HiMiniChevronDown,
@@ -79,22 +79,16 @@ import {
   sortQueue,
   searchQueue,
   groupDuplicates,
-  isReadOnlyQueueGroup,
   isDuplicateGroup,
   bulkApproveActionCount,
-  bulkApprovePrimaryIds,
   bulkBlockEligibleGroups,
   bulkBlockPrimaryIds,
-  countSensitiveFileReadGroups,
   type QueueSortDirection,
 } from "./queue-state";
 import {
-  buildBulkGateCredentials,
-  isBulkApproveGateReady,
   QueueBulkApproveFlow,
-  type BulkApproveFlowStep,
-  validateBulkApproveCredentials,
 } from "./queue-bulk-approve-flow";
+import { useQueueBulkApprove } from "./use-queue-bulk-approve";
 import {
   buildDecisionPayload,
   filterScopeChoicesForRequest,
@@ -251,6 +245,7 @@ function renderInboxContent(props: LayoutProps): ReactNode {
       onResolve={props.onResolve}
       onGoHome={props.onGoHome}
       onRetryResume={props.onRetryResume}
+      onBulkApprove={props.onBulkApprove}
     />
   );
 }
@@ -628,12 +623,6 @@ function QueueBrowser(props: {
   const [sortDirection, setSortDirection] = useState<QueueSortDirection>("newest");
   const [page, setPage] = useState(1);
   const [showFilters, setShowFilters] = useState(false);
-  const [bulkFlowStep, setBulkFlowStep] = useState<BulkApproveFlowStep>("collapsed");
-  const [selectedBulkIds, setSelectedBulkIds] = useState<Set<string>>(() => new Set());
-  const [bulkApprovePassword, setBulkApprovePassword] = useState("");
-  const [bulkApproveTotpCode, setBulkApproveTotpCode] = useState("");
-  const [bulkApproveError, setBulkApproveError] = useState<string | null>(null);
-  const [bulkCompletedActionCount, setBulkCompletedActionCount] = useState<number | null>(null);
   const harnesses = Array.from(new Set(props.items.map((item) => item.harness).filter(isDisplayableHarness))).sort();
 
   const filteredItems = useMemo(() => {
@@ -645,7 +634,13 @@ function QueueBrowser(props: {
     return sortQueue(searched, sortDirection);
   }, [harnessFilter, props.items, searchTerm, sortDirection]);
 
-  const groups = useMemo(() => groupDuplicates(filteredItems), [filteredItems]);
+  const bulkApprove = useQueueBulkApprove({
+    items: filteredItems,
+    approvalGate: props.approvalGate ?? null,
+    onBulkApprove: props.onBulkApprove,
+    settingsHref: guardAwareHref("/settings"),
+  });
+  const groups = bulkApprove.groups;
   const totalPages = Math.max(1, Math.ceil(groups.length / queuePageSize));
   const currentPage = Math.min(page, totalPages);
   const pageStart = (currentPage - 1) * queuePageSize;
@@ -689,133 +684,15 @@ function QueueBrowser(props: {
     setSortDirection("newest");
   }, []);
 
-  const isReadOnlyGroup = useCallback(
-    (group: ReturnType<typeof groupDuplicates>[number]) => isReadOnlyQueueGroup(group),
-    []
-  );
-
-  const bulkEligibleGroups = useMemo(
-    () => groups.filter(isReadOnlyGroup),
-    [groups, isReadOnlyGroup]
-  );
-
-  const sensitiveFileReadCount = useMemo(
-    () => countSensitiveFileReadGroups(groups),
-    [groups]
-  );
-
-  const showBulkApprove =
-    props.onBulkApprove !== undefined &&
-    (bulkEligibleGroups.length >= 2 || bulkFlowStep === "completed");
-
-  const bulkGateReady = isBulkApproveGateReady(props.approvalGate);
-
-  const selectedBulkGroups = useMemo(
-    () => bulkEligibleGroups.filter((group) => selectedBulkIds.has(group.primary.request_id)),
-    [bulkEligibleGroups, selectedBulkIds]
-  );
-
-  const resetBulkFlow = useCallback(() => {
-    setBulkFlowStep("collapsed");
-    setSelectedBulkIds(new Set());
-    setBulkApprovePassword("");
-    setBulkApproveTotpCode("");
-    setBulkApproveError(null);
-    setBulkCompletedActionCount(null);
-  }, []);
-
-  const handleBulkFlowStart = useCallback(() => {
-    if (!bulkGateReady) {
-      return;
-    }
-    setBulkFlowStep("select");
-    setSelectedBulkIds(new Set());
-    setBulkApproveError(null);
-    setBulkCompletedActionCount(null);
-  }, [bulkGateReady]);
-
-  const handleBulkSelectAll = useCallback(() => {
-    setSelectedBulkIds(new Set(bulkApprovePrimaryIds(bulkEligibleGroups)));
-  }, [bulkEligibleGroups]);
-
-  const handleBulkClearSelection = useCallback(() => {
-    setSelectedBulkIds(new Set());
-  }, []);
-
-  const handleBulkContinueToReview = useCallback(() => {
-    if (selectedBulkIds.size === 0) {
-      return;
-    }
-    setBulkFlowStep("review");
-    setBulkApproveError(null);
-  }, [selectedBulkIds.size]);
-
-  const handleBulkBackToSelect = useCallback(() => {
-    if (bulkFlowStep === "submitting" || bulkFlowStep === "completed") {
-      return;
-    }
-    setBulkFlowStep("select");
-    setBulkApproveError(null);
-  }, [bulkFlowStep]);
-
-  const handleBulkToggleSelect = useCallback((requestId: string) => {
-    setSelectedBulkIds((current) => {
-      const next = new Set(current);
-      if (next.has(requestId)) {
-        next.delete(requestId);
-      } else {
-        next.add(requestId);
+  const handleBulkToggleSelect = useCallback(
+    (requestId: string) => {
+      const item = filteredItems.find((candidate) => candidate.request_id === requestId);
+      if (item !== undefined) {
+        bulkApprove.bulkSelection.onToggle(item);
       }
-      return next;
-    });
-  }, []);
-
-  const handleBulkApprovePasswordChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
-    setBulkApprovePassword(event.target.value);
-  }, []);
-  const handleBulkApproveTotpCodeChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
-    setBulkApproveTotpCode(event.target.value);
-  }, []);
-
-  const handleBulkConfirmApprove = useCallback(async () => {
-    if (bulkFlowStep === "submitting" || bulkFlowStep === "completed" || selectedBulkGroups.length === 0) {
-      return;
-    }
-    const ids = bulkApprovePrimaryIds(selectedBulkGroups);
-    const approvedActionCount = bulkApproveActionCount(selectedBulkGroups);
-    const credentialError = validateBulkApproveCredentials(props.approvalGate, {
-      password: bulkApprovePassword,
-      totpCode: bulkApproveTotpCode,
-    });
-    if (credentialError !== null) {
-      setBulkApproveError(credentialError);
-      return;
-    }
-    const gateCredentials = buildBulkGateCredentials(
-      props.approvalGate,
-      bulkApprovePassword,
-      bulkApproveTotpCode,
-    );
-    setBulkFlowStep("submitting");
-    setBulkApproveError(null);
-    try {
-      setBulkCompletedActionCount(approvedActionCount);
-      await props.onBulkApprove?.(ids, gateCredentials);
-      setBulkFlowStep("completed");
-      setBulkApprovePassword("");
-      setBulkApproveTotpCode("");
-    } catch (error) {
-      setBulkFlowStep("review");
-      setBulkApproveError(error instanceof Error ? error.message : "Bulk approval failed.");
-    }
-  }, [
-    bulkApprovePassword,
-    bulkApproveTotpCode,
-    bulkFlowStep,
-    props.approvalGate,
-    props.onBulkApprove,
-    selectedBulkGroups,
-  ]);
+    },
+    [filteredItems, bulkApprove.bulkSelection.onToggle],
+  );
 
   const blockEligibleGroups = useMemo(() => bulkBlockEligibleGroups(groups), [groups]);
   const blockEligibleActionCount = useMemo(() => bulkApproveActionCount(blockEligibleGroups), [blockEligibleGroups]);
@@ -833,33 +710,13 @@ function QueueBrowser(props: {
 
   return (
     <section>
-      {showBulkApprove && (
-        <QueueBulkApproveFlow
-          step={bulkFlowStep}
-          eligibleGroups={bulkEligibleGroups}
-          selectedGroups={selectedBulkGroups}
-          completedActionCount={bulkCompletedActionCount}
-          sensitiveFileReadCount={sensitiveFileReadCount}
-          approvalGate={props.approvalGate ?? null}
-          settingsHref={guardAwareHref("/settings")}
-          bulkApprovePassword={bulkApprovePassword}
-          bulkApproveTotpCode={bulkApproveTotpCode}
-          errorMessage={bulkApproveError}
-          onStart={handleBulkFlowStart}
-          onSelectAll={handleBulkSelectAll}
-          onClearSelection={handleBulkClearSelection}
-          onContinueToReview={handleBulkContinueToReview}
-          onBackToSelect={handleBulkBackToSelect}
-          onCancel={resetBulkFlow}
-          onConfirmApprove={handleBulkConfirmApprove}
-          onBulkApprovePasswordChange={handleBulkApprovePasswordChange}
-          onBulkApproveTotpCodeChange={handleBulkApproveTotpCodeChange}
-        />
+      {bulkApprove.bulkFlowProps !== null && (
+        <QueueBulkApproveFlow {...bulkApprove.bulkFlowProps} />
       )}
-      {!showBulkApprove && sensitiveFileReadCount > 0 && (
+      {bulkApprove.showSensitiveOnlyWarning && (
         <div className="mb-4 rounded-lg border border-brand-attention/20 bg-brand-attention/[0.04] px-3 py-2">
           <p className="text-xs text-brand-attention">
-            {sensitiveFileReadCount} sensitive file {sensitiveFileReadCount === 1 ? "read" : "reads"} in queue — review each path before approving.
+            {bulkApprove.sensitiveFileReadCount} sensitive file {bulkApprove.sensitiveFileReadCount === 1 ? "read" : "reads"} in queue — review each path before approving.
           </p>
         </div>
       )}
@@ -933,9 +790,9 @@ function QueueBrowser(props: {
               group={group}
               activeRequestId={props.activeRequestId}
               onOpenRequest={props.onOpenRequest}
-              selectionMode={bulkFlowStep === "select"}
-              selectable={isReadOnlyQueueGroup(group)}
-              selected={selectedBulkIds.has(group.primary.request_id)}
+              selectionMode={bulkApprove.bulkSelection.selectionMode}
+              selectable={bulkApprove.bulkSelection.isSelectable(group.primary)}
+              selected={bulkApprove.bulkSelection.isSelected(group.primary)}
               onToggleSelect={handleBulkToggleSelect}
             />
           ))
@@ -1052,7 +909,7 @@ function QueueCard(props: {
   const isBlocked = props.item.policy_action === "block";
   const statusDotClass = queueCardStatusDotClass(props.active, isBlocked);
   const handleKeyDown = useCallback(
-    (event: KeyboardEvent<HTMLDivElement>) => {
+    (event: ReactKeyboardEvent<HTMLDivElement>) => {
       if (event.key === "Enter" || event.key === " ") {
         event.preventDefault();
         props.onClick();
@@ -1522,7 +1379,7 @@ function DecisionWorkspace(props: {
 
   useEffect(() => {
     if (props.detail.kind !== "ready") return;
-    const onKeyDown = (event: KeyboardEvent) => {
+    const onKeyDown = (event: globalThis.KeyboardEvent) => {
       if (submitting !== null || pendingAction !== null) return;
       const target = event.target as HTMLElement;
       if (

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/approval-center-primitives.tsx

@@ -1,5 +1,5 @@
 import { forwardRef } from "react";
-import type { ButtonHTMLAttributes, ChangeEvent, ReactNode, Ref } from "react";
+import type { ButtonHTMLAttributes, AnchorHTMLAttributes, ChangeEvent, ReactNode, Ref } from "react";
 import {
   HiMiniArrowTopRightOnSquare,
   HiMiniCloud,
@@ -328,9 +328,22 @@ export function Badge(props: {
   );
 }
 
+type TagTone =
+  | "blue"
+  | "green"
+  | "purple"
+  | "slate"
+  | "red"
+  | "amber"
+  | "attention"
+  | "default"
+  | "info"
+  | "warning"
+  | "destructive";
+
 export function Tag(props: {
   children: ReactNode;
-  tone?: "blue" | "green" | "purple" | "slate" | "red" | "attention";
+  tone?: TagTone;
 }) {
   const toneClass = tagToneClass(props.tone);
   return (
@@ -381,11 +394,32 @@ type ActionButtonProps = {
   href?: string;
   variant?: "primary" | "secondary" | "danger" | "outline" | "ghost" | "success" | "quiet";
   disabled?: boolean;
+  className?: string;
+  type?: ButtonHTMLAttributes<HTMLButtonElement>["type"];
 } & Omit<ButtonHTMLAttributes<HTMLButtonElement>, "children" | "className" | "onClick" | "type">;
 
+function anchorPropsFromButtonProps(
+  props: Omit<ButtonHTMLAttributes<HTMLButtonElement>, "children" | "className" | "onClick" | "type">,
+): AnchorHTMLAttributes<HTMLAnchorElement> {
+  const {
+    disabled: _disabled,
+    form: _form,
+    formAction: _formAction,
+    formEncType: _formEncType,
+    formMethod: _formMethod,
+    formNoValidate: _formNoValidate,
+    formTarget: _formTarget,
+    name: _name,
+    value: _value,
+    type: _type,
+    ...rest
+  } = props;
+  return rest;
+}
+
 export const ActionButton = forwardRef<HTMLButtonElement | HTMLAnchorElement, ActionButtonProps>(
-  ({ children, href, variant, disabled, onClick, ...buttonProps }, ref) => {
-    const className = actionButtonClass(variant);
+  ({ children, href, variant, disabled, onClick, className: customClassName, type, ...buttonProps }, ref) => {
+    const className = `${actionButtonClass(variant)}${customClassName ? ` ${customClassName}` : ""}`;
     if (href) {
       return (
         <a
@@ -393,14 +427,16 @@ export const ActionButton = forwardRef<HTMLButtonElement | HTMLAnchorElement, Ac
           href={guardAwareHref(href)}
           target={href.startsWith("https://") ? "_blank" : undefined}
           rel={href.startsWith("https://") ? "noreferrer" : undefined}
+          onClick={onClick}
           className={className}
+          {...anchorPropsFromButtonProps(buttonProps)}
         >
           {children}
         </a>
       );
     }
     return (
-      <button ref={ref as Ref<HTMLButtonElement>} type="button" className={className} onClick={onClick} disabled={disabled} {...buttonProps}>
+      <button ref={ref as Ref<HTMLButtonElement>} type={type ?? "button"} className={className} onClick={onClick} disabled={disabled} {...buttonProps}>
         {children}
       </button>
     );
@@ -592,10 +628,15 @@ function badgeToneClass(tone: "default" | "success" | "warning" | "info" | "dest
   return "border-transparent bg-gray-100 text-gray-600 border-gray-200";
 }
 
-function tagToneClass(tone: "blue" | "green" | "purple" | "slate" | "red" | "attention" | undefined): string {
+function tagToneClass(tone: TagTone | undefined): string {
   if (tone === "green") return "border-transparent bg-brand-green-bg/60 text-brand-green-text";
   if (tone === "purple") return "border-transparent bg-brand-purple/10 text-brand-purple";
+  if (tone === "destructive") return "border-transparent bg-brand-purple/10 text-brand-purple";
   if (tone === "red") return "border-transparent bg-brand-purple/10 text-brand-purple";
+  if (tone === "amber") return "border-transparent bg-amber-50 text-amber-700";
+  if (tone === "warning") return "border-transparent bg-amber-50 text-amber-700";
+  if (tone === "info") return "border-transparent bg-blue-500/10 text-blue-700";
+  if (tone === "default") return "border-gray-200 bg-gray-100 text-gray-500";
   if (tone === "slate") return "border-gray-200 bg-gray-100 text-gray-500";
   if (tone === "attention") return "border-transparent bg-brand-attention-bg text-brand-attention";
   return "border-transparent bg-blue-500/10 text-blue-700";

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/approval-scopes.test.ts

@@ -66,7 +66,7 @@ for (const scope of ["artifact", "publisher", "harness", "global"] as const) {
 
 const fullScopeValues = scopeChoicesForRequest(BASE_REQUEST).map((choice) => choice.value);
 assert(
-  ["artifact", "workspace", "publisher", "harness", "global"].every((scope) => fullScopeValues.includes(scope)),
+  (["artifact", "workspace", "publisher", "harness", "global"] as const).every((scope) => fullScopeValues.includes(scope)),
   "T-AS-03: requests with workspace and publisher expose all approval scope kinds"
 );
 

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/apps/app-detail-workspace.tsx

@@ -1023,7 +1023,7 @@ function PolicyDecisionRow(props: {
   onRequestClear: (key: string) => void;
   onConfirmClear: () => void;
   onCancelClear: () => void;
-  rowConfirmRef?: RefObject<HTMLDivElement>;
+  rowConfirmRef?: RefObject<HTMLDivElement | null>;
 }) {
   const { policy, rowKey, isConfirming, inFlight, showClearButton } = props;
   const label = clearLabelForScope(policy.scope);

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/audit-workspace.tsx

@@ -21,7 +21,13 @@ import { formatRelativeTime, harnessDisplayName } from "./approval-center-utils"
 import { runAuditRemediation, guardAwareHref } from "./guard-api";
 import { isApprovalGateRequiredError } from "./harness-action-errors";
 import type { AuditRemediationAction } from "./guard-api";
-import type { GuardApprovalGatePublicConfig, GuardReceipt, GuardRuntimeSnapshot } from "./guard-types";
+import type {
+  GuardApprovalGatePublicConfig,
+  GuardReceipt,
+  GuardRuntimeSnapshot,
+  GuardSupplyChainScannerEvidence,
+} from "./guard-types";
+import { isSupplyChainAuditEvidence } from "./guard-types";
 import { useResolvedApprovalGate } from "./use-resolved-approval-gate";
 import { resolveManagerCoverageStatus } from "./supply-chain-protection-stats";
 import { PackageWorkbenchPanel } from "./package-workbench-panel";
@@ -49,10 +55,6 @@ export type AuditRemediationRequest = {
   label: string;
 };
 
-function isSupplyChainAuditEvidence(value: unknown): value is Record<string, unknown> & { operation: "audit" } {
-  return typeof value === "object" && value !== null && (value as Record<string, unknown>).operation === "audit";
-}
-
 function auditSeverityForDecision(decision: string, blockedCount: number): AuditSeverity {
   if (decision === "block" || blockedCount > 0) {
     return "high";

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/evidence/app-tab.tsx

@@ -11,11 +11,14 @@ import { detectCategory, getCategoryInfo } from "./categories";
 import { guardAwareHref } from "../guard-api";
 import { Sparkline } from "./sparkline";
 import { ScopedEvidenceTable } from "./scoped-evidence-table";
+import type { EvidenceDecision } from "./evidence-types";
 
 interface AppTabProps {
   receipts: GuardReceipt[];
 }
 
+type AppDecisionFilter = Extract<EvidenceDecision, "all" | "allow" | "block">;
+
 function hashString(str: string): number {
   let hash = 0;
   for (let i = 0; i < str.length; i++) {
@@ -77,7 +80,7 @@ function AppListCard({ harness, items, onSelect }: AppListCardProps) {
 function AppTabRaw({ receipts }: AppTabProps) {
   const [selectedApp, setSelectedApp] = useState<string | null>(null);
   const [searchTerm, setSearchTerm] = useState("");
-  const [decisionFilter, setDecisionFilter] = useState<string>("all");
+  const [decisionFilter, setDecisionFilter] = useState<AppDecisionFilter>("all");
   const [categoryFilter, setCategoryFilter] = useState<string>("");
 
   const appReceipts = useMemo(
@@ -135,6 +138,13 @@ function AppTabRaw({ receipts }: AppTabProps) {
     setCategoryFilter(category);
   }, []);
 
+  const handleDecisionFilterChange = useCallback((event: React.ChangeEvent<HTMLSelectElement>) => {
+    const nextValue = event.target.value;
+    if (nextValue === "all" || nextValue === "allow" || nextValue === "block") {
+      setDecisionFilter(nextValue);
+    }
+  }, []);
+
   const categories = useMemo(() => {
     if (!selectedApp) return [];
     const allItems = apps.find(([h]) => h === selectedApp)?.[1] ?? [];
@@ -203,7 +213,7 @@ function AppTabRaw({ receipts }: AppTabProps) {
           </div>
           <select
             value={decisionFilter}
-            onChange={(e) => setDecisionFilter(e.target.value)}
+            onChange={handleDecisionFilterChange}
             className="min-h-7 rounded-lg border border-slate-200 bg-white px-2 text-xs font-medium text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-1 focus:ring-brand-blue/20"
           >
             <option value="all">All decisions</option>

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/evidence/evidence-action-detail.tsx

@@ -13,7 +13,8 @@ import {
   HiMiniDocumentText,
 } from "react-icons/hi2";
 import { useState } from "react";
-import type { GuardReceipt, RiskSignalV2 } from "../guard-types";
+import type { GuardReceipt } from "../guard-types";
+import { isRiskSignalEvidence } from "../guard-types";
 import { harnessDisplayName, formatRelativeTime } from "../approval-center-utils";
 import { plainEnglishDescription, resolveActionTitle, resolveActionType, resolveActionSubtitle, resolveActionDetail } from "./plain-english";
 import { detectCategory, getCategoryInfo } from "./categories";
@@ -296,7 +297,7 @@ export function EvidenceActionDetail({
   const actionType = resolveActionType(receipt);
   const actionSubtitle = resolveActionSubtitle(receipt);
   const actionDetail = resolveActionDetail(receipt);
-  const signals = receipt.scanner_evidence ?? [];
+  const signals = (receipt.scanner_evidence ?? []).filter(isRiskSignalEvidence);
   const primarySignal = signals[0];
   let copyLabel = "Copy receipt ID";
   if (copied) {

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/evidence/evidence-insights-share-modal.tsx

@@ -1,5 +1,10 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
-import type { GuardCloudConnectFlow, GuardReceiptAnalytics, GuardRuntimeSnapshot } from "../guard-types";
+import type {
+  GuardCloudConnectFlow,
+  GuardInsightsShareResult,
+  GuardReceiptAnalytics,
+  GuardRuntimeSnapshot,
+} from "../guard-types";
 import { ActionButton } from "../approval-center-primitives";
 import { GuardModalLayer } from "../guard-modal-layer";
 import {
@@ -7,7 +12,6 @@ import {
   fetchRuntimeSnapshot,
   publishInsightsShare,
   startGuardCloudConnect,
-  type GuardInsightsShareResult,
 } from "../guard-api";
 import { ConnectFlowCard } from "../supply-chain-firewall-views";
 import {

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/evidence/evidence-table.tsx

@@ -33,7 +33,7 @@ export function EvidenceTableHead({ children }: EvidenceTableHeadProps) {
 }
 
 interface EvidenceTableHeaderProps {
-  children: ReactNode;
+  children?: ReactNode;
   className?: string;
 }
 

{plugin_scanner-2.0.754 → plugin_scanner-2.0.756}/dashboard/src/evidence/evidence-types.ts

@@ -2,7 +2,7 @@ export type EvidenceDecision = "allow" | "block" | "ask" | "all";
 export type EvidenceTimeFilter = "all" | "today" | "yesterday" | "week" | "last7d" | "last30d";
 export type EvidenceSortKey = "newest" | "oldest" | "app" | "decision" | "category" | "artifact";
 export type EvidenceExportFormat = "csv" | "json";
-export type EvidenceView = "actions" | "insights" | "apps" | "export" | "categories";
+export type EvidenceView = "actions" | "insights" | "apps" | "export" | "story" | "categories";
 
 export interface EvidenceFilterState {
   search: string;