plugin-scanner 2.0.769__tar.gz → 2.0.770__tar.gz

{plugin_scanner-2.0.769 → plugin_scanner-2.0.770}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.769
+Version: 2.0.770
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.770/dashboard/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "hol-guard-dashboard",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "test": "tsx src/github-issue-link.test.ts && tsx src/shell-footer.test.ts && tsx src/harness-action-errors.test.ts && tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/queue-bulk-approve.test.ts && tsx src/queue-bulk-risk-disclosure.test.ts && tsx src/use-queue-bulk-approve.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-final-release-guard.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test:e2e": "playwright test",
+    "dev": "vite dev"
+  },
+  "dependencies": {
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-qr-code": "^2.0.16",
+    "react-icons": "^5.6.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.50.0",
+    "@types/node": "^24.0.0",
+    "@tailwindcss/vite": "^4.1.4",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^5.0.4",
+    "tailwindcss": "^4.1.4",
+    "tsx": "^4.8.1",
+    "typescript": "^5.9.3",
+    "vite": "^7.1.10"
+  }
+}

plugin_scanner-2.0.770/dashboard/src/queue-bulk-approve-flow.tsx

@@ -0,0 +1,495 @@
+import type { ChangeEvent } from "react";
+import {
+  HiMiniCheckCircle,
+  HiMiniExclamationTriangle,
+  HiMiniShieldCheck,
+  HiMiniXMark,
+  HiMiniKey,
+} from "react-icons/hi2";
+import {
+  buildBulkApproveConsequenceCopy,
+  summarizeBulkApproveSelection,
+} from "./approval-center-utils";
+import { approvalGateCooldownLabel } from "./approval-gate-utils";
+import type { GuardApprovalGatePublicConfig } from "./guard-types";
+import type { QueueGroup } from "./queue-state";
+import type {
+  BulkRiskDisclosure,
+  BulkRiskTier,
+  BulkRiskTone,
+} from "./queue-bulk-risk-disclosure";
+
+export function isBulkApproveGateReady(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+): boolean {
+  return gate?.enabled === true && gate?.configured === true;
+}
+
+export function validateBulkApproveCredentials(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+  credentials: { password: string; totpCode: string },
+): string | null {
+  if (!isBulkApproveGateReady(gate)) {
+    return "Set up an approval password in Settings before bulk approval.";
+  }
+  if (!credentials.password.trim()) {
+    return "Enter your approval password to continue.";
+  }
+  if (gate?.totp_enabled === true && !credentials.totpCode.trim()) {
+    return "Enter your authenticator code to continue.";
+  }
+  return null;
+}
+
+export function buildBulkGateCredentials(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+  password: string,
+  totpCode: string,
+) {
+  if (!isBulkApproveGateReady(gate)) {
+    return undefined;
+  }
+  return {
+    approval_password: password.trim(),
+    approval_totp_code: totpCode.trim(),
+    approval_gate_use_cooldown: false,
+  };
+}
+
+const TIER_LABEL: Record<BulkRiskTier, string> = {
+  low: "Low risk",
+  elevated: "Elevated risk",
+  high: "High risk",
+};
+
+function toneRing(tone: BulkRiskTone): string {
+  if (tone === "attention") {
+    return "border-brand-attention/30 bg-brand-attention/[0.06]";
+  }
+  if (tone === "amber") {
+    return "border-amber-300/60 bg-amber-50/70";
+  }
+  return "border-brand-green/30 bg-brand-green-bg/40";
+}
+
+function toneChip(tone: BulkRiskTone): string {
+  if (tone === "attention") {
+    return "bg-brand-attention/10 text-brand-attention";
+  }
+  if (tone === "amber") {
+    return "bg-amber-100 text-amber-800";
+  }
+  return "bg-brand-green/15 text-brand-green-text";
+}
+
+function toneIcon(tone: BulkRiskTone) {
+  if (tone === "attention" || tone === "amber") {
+    return HiMiniExclamationTriangle;
+  }
+  return HiMiniShieldCheck;
+}
+
+export type QueueBulkStickyBarProps = {
+  visible: boolean;
+  selectedGroupCount: number;
+  selectedActionCount: number;
+  riskTier: BulkRiskTier;
+  riskTone: BulkRiskTone;
+  gateReady: boolean;
+  onStartReview: () => void;
+  onClearSelection: () => void;
+};
+
+export function QueueBulkStickyBar(props: QueueBulkStickyBarProps) {
+  if (!props.visible) return null;
+  const unit = props.selectedActionCount === 1 ? "read" : "reads";
+  const ChipIcon = toneIcon(props.riskTone);
+  return (
+    <div
+      className="sticky top-2 z-20 mb-4 flex flex-wrap items-center gap-3 rounded-xl border border-slate-200 bg-white/95 px-4 py-3 shadow-md backdrop-blur"
+      role="region"
+      aria-label="Bulk approval selection"
+    >
+      <span
+        className={`inline-flex items-center gap-1.5 rounded-full px-2.5 py-1 text-[11px] font-semibold uppercase tracking-[0.12em] ${toneChip(props.riskTone)}`}
+      >
+        <ChipIcon className="h-3.5 w-3.5" aria-hidden="true" />
+        {TIER_LABEL[props.riskTier]}
+      </span>
+      <p className="min-w-0 flex-1 text-sm font-medium text-brand-dark">
+        <span className="font-mono text-base font-semibold">{props.selectedActionCount}</span>
+        {" "}
+        {unit} selected · approve once
+      </p>
+      <div className="flex items-center gap-2">
+        <button
+          type="button"
+          onClick={props.onStartReview}
+          className="inline-flex min-h-9 items-center rounded-full bg-brand-blue px-4 py-1.5 text-sm font-semibold text-white shadow-sm transition-colors hover:bg-brand-blue/90"
+        >
+          Review &amp; approve
+        </button>
+        <button
+          type="button"
+          onClick={props.onClearSelection}
+          className="inline-flex min-h-9 items-center rounded-full border border-slate-200 bg-white px-3 py-1.5 text-sm font-medium text-muted-foreground transition-colors hover:bg-slate-50 hover:text-brand-dark"
+        >
+          Clear
+        </button>
+      </div>
+    </div>
+  );
+}
+
+export type QueueBulkStatusBannerProps = {
+  visible: boolean;
+  sensitiveFileReadCount: number;
+};
+
+export function QueueBulkStatusBanner(props: QueueBulkStatusBannerProps) {
+  if (!props.visible) return null;
+  return (
+    <div className="mb-4 rounded-lg border border-brand-attention/20 bg-brand-attention/[0.04] px-3 py-2">
+      <p className="text-xs text-brand-attention">
+        {props.sensitiveFileReadCount} sensitive file{" "}
+        {props.sensitiveFileReadCount === 1 ? "read" : "reads"} in queue — review each path before approving.
+      </p>
+    </div>
+  );
+}
+
+export type QueueBulkGatePromptProps = {
+  visible: boolean;
+  eligibleActionCount: number;
+  settingsHref: string;
+};
+
+/**
+ * Discovery prompt shown when eligible reads exist in the queue but the
+ * approval gate is not configured. Ambient selection (and the bulk drawer)
+ * require the gate, so without this banner users would never learn that bulk
+ * approval is available once they set up an approval password.
+ */
+export function QueueBulkGatePrompt(props: QueueBulkGatePromptProps) {
+  if (!props.visible) return null;
+  const unit = props.eligibleActionCount === 1 ? "read" : "reads";
+  return (
+    <div className="mb-4 rounded-xl border border-brand-blue/20 bg-brand-blue/[0.04] px-4 py-3">
+      <div className="flex flex-wrap items-start gap-3">
+        <div className="min-w-0 flex-1">
+          <p className="text-sm font-semibold text-brand-dark">
+            Approve {props.eligibleActionCount} {unit} at once
+          </p>
+          <p className="mt-1 text-xs leading-5 text-brand-dark/70">
+            Set up a local approval password to unlock bulk approval for read-only file reads.
+            Bulk approval always approves once and never remembers future reads.
+          </p>
+        </div>
+        <a
+          href={props.settingsHref}
+          className="inline-flex shrink-0 rounded-full border border-brand-blue/30 bg-white px-4 py-2 text-sm font-medium text-brand-blue no-underline transition-colors hover:bg-brand-blue/5"
+        >
+          Open Settings
+        </a>
+      </div>
+    </div>
+  );
+}
+
+export type QueueBulkDrawerProps = {
+  open: boolean;
+  step: "review" | "submitting" | "completed";
+  selectedGroups: QueueGroup[];
+  selectedActionCount: number;
+  sensitiveFileReadCount: number;
+  riskDisclosure: BulkRiskDisclosure;
+  approvalGate: GuardApprovalGatePublicConfig | null;
+  settingsHref: string;
+  bulkApprovePassword: string;
+  bulkApproveTotpCode: string;
+  typedConfirm: string;
+  confirmMatches: boolean;
+  canConfirm: boolean;
+  completedActionCount: number | null;
+  errorMessage: string | null;
+  onBulkApprovePasswordChange: (event: ChangeEvent<HTMLInputElement>) => void;
+  onBulkApproveTotpCodeChange: (event: ChangeEvent<HTMLInputElement>) => void;
+  onTypedConfirmChange: (event: ChangeEvent<HTMLInputElement>) => void;
+  onConfirmApprove: () => void;
+  onCancel: () => void;
+};
+
+export function QueueBulkDrawer(props: QueueBulkDrawerProps) {
+  if (!props.open) return null;
+
+  if (props.step === "completed") {
+    const approved = props.completedActionCount ?? 0;
+    const unit = approved === 1 ? "action was" : "actions were";
+    return (
+      <BulkDrawerShell onClose={props.onCancel} labelledBy="guard-bulk-drawer-title">
+        <div className="flex items-start gap-3 rounded-xl border border-brand-green/25 bg-brand-green-bg/30 px-4 py-3">
+          <HiMiniCheckCircle className="mt-0.5 h-5 w-5 shrink-0 text-brand-green" aria-hidden="true" />
+          <div>
+            <h2 id="guard-bulk-drawer-title" className="text-base font-semibold text-brand-dark">
+              {approved} read-only {unit} approved
+            </h2>
+            <p className="mt-1 text-sm text-muted-foreground">
+              This bulk approval cannot be repeated. Reload the queue to see the latest state.
+            </p>
+          </div>
+        </div>
+        <div className="mt-5 flex justify-end">
+          <button
+            type="button"
+            onClick={props.onCancel}
+            className="rounded-full bg-brand-blue px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-brand-blue/90"
+          >
+            Done
+          </button>
+        </div>
+      </BulkDrawerShell>
+    );
+  }
+
+  const disclosure = props.riskDisclosure;
+  const DisclosureIcon = toneIcon(disclosure.tone);
+  const riskLines = summarizeBulkApproveSelection(props.selectedGroups);
+  const previewLines = riskLines.slice(0, 5);
+  const hiddenCount = Math.max(0, riskLines.length - previewLines.length);
+  const unit = props.selectedActionCount === 1 ? "action" : "actions";
+  const submitLabel =
+    props.step === "submitting"
+      ? "Approving…"
+      : `Approve once (${props.selectedActionCount} ${unit})`;
+
+  return (
+    <BulkDrawerShell onClose={props.onCancel} labelledBy="guard-bulk-drawer-title">
+      <div className="flex items-start justify-between gap-3">
+        <div>
+          <p className="font-mono text-[11px] font-semibold uppercase tracking-[0.2em] text-brand-blue">
+            Bulk approval
+          </p>
+          <h2 id="guard-bulk-drawer-title" className="mt-1 text-lg font-semibold text-brand-dark">
+            Review {props.selectedActionCount} selected {unit}
+          </h2>
+        </div>
+        <button
+          type="button"
+          onClick={props.onCancel}
+          aria-label="Close bulk approval"
+          className="inline-flex h-8 w-8 shrink-0 items-center justify-center rounded-full text-slate-400 transition-colors hover:bg-slate-100 hover:text-brand-dark"
+        >
+          <HiMiniXMark className="h-4 w-4" aria-hidden="true" />
+        </button>
+      </div>
+
+      {/* Risk disclosure — escalates with selection size and composition */}
+      <section
+        aria-label="Risk disclosure"
+        className={`mt-4 rounded-xl border p-4 ${toneRing(disclosure.tone)}`}
+      >
+        <div className="flex items-start gap-2.5">
+          <DisclosureIcon
+            className={`mt-0.5 h-5 w-5 shrink-0 ${
+              disclosure.tone === "attention"
+                ? "text-brand-attention"
+                : disclosure.tone === "amber"
+                  ? "text-amber-600"
+                  : "text-brand-green"
+            }`}
+            aria-hidden="true"
+          />
+          <div className="min-w-0 flex-1">
+            <div className="flex flex-wrap items-center gap-2">
+              <h3 className="text-sm font-semibold text-brand-dark">{disclosure.headline}</h3>
+              <span
+                className={`inline-flex items-center rounded-full px-2 py-0.5 text-[10px] font-bold uppercase tracking-wider ${toneChip(disclosure.tone)}`}
+              >
+                {TIER_LABEL[disclosure.tier]}
+              </span>
+            </div>
+            <p className="mt-1.5 text-xs leading-5 text-brand-dark/80">{disclosure.body}</p>
+            {disclosure.bullets.length > 0 && (
+              <ul className="mt-2 space-y-1">
+                {disclosure.bullets.map((bullet) => (
+                  <li
+                    key={bullet}
+                    className="flex items-start gap-1.5 text-xs leading-5 text-brand-dark/85"
+                  >
+                    <span className="mt-1.5 h-1 w-1 shrink-0 rounded-full bg-current opacity-60" aria-hidden="true" />
+                    <span>{bullet}</span>
+                  </li>
+                ))}
+              </ul>
+            )}
+            <p className="mt-2 text-[11px] leading-4 text-muted-foreground">
+              {buildBulkApproveConsequenceCopy(props.selectedActionCount)}
+            </p>
+          </div>
+        </div>
+      </section>
+
+      <div className="mt-4">
+        <p className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">
+          What you are approving
+        </p>
+        <ul className="mt-2 space-y-2 rounded-lg bg-slate-50 px-3 py-2">
+          {previewLines.map((line) => (
+            <li key={line.requestId} className="text-xs text-brand-dark">
+              <span className="font-medium">{line.harnessLabel}</span>
+              {line.path !== null ? (
+                <span className="mt-0.5 block truncate font-mono text-[11px] text-brand-dark/70">{line.path}</span>
+              ) : (
+                <span className="mt-0.5 block text-brand-dark/70">{line.title}</span>
+              )}
+              {line.duplicateCount > 0 && (
+                <span className="mt-0.5 block text-muted-foreground">
+                  Includes {line.duplicateCount} duplicate {line.duplicateCount === 1 ? "retry" : "retries"}.
+                </span>
+              )}
+            </li>
+          ))}
+          {hiddenCount > 0 && (
+            <li className="text-xs text-muted-foreground">and {hiddenCount} more selected reads</li>
+          )}
+        </ul>
+      </div>
+
+      {props.sensitiveFileReadCount > 0 && (
+        <div className="mt-3 flex items-start gap-2 rounded-lg bg-brand-attention/[0.06] px-3 py-2">
+          <HiMiniExclamationTriangle className="mt-0.5 h-4 w-4 shrink-0 text-brand-attention" aria-hidden="true" />
+          <p className="text-xs text-brand-attention">
+            {props.sensitiveFileReadCount} sensitive file{" "}
+            {props.sensitiveFileReadCount === 1 ? "read remains" : "reads remain"} in the queue and will not be
+            approved here.
+          </p>
+        </div>
+      )}
+
+      {isBulkApproveGateReady(props.approvalGate) ? (
+        <div className="mt-4 space-y-3 rounded-lg border border-slate-200 bg-white p-3">
+          <div className="flex items-center gap-2">
+            <HiMiniKey className="h-4 w-4 text-brand-blue" aria-hidden="true" />
+            <p className="text-xs font-semibold text-brand-dark">Confirm with your approval password</p>
+          </div>
+          <label className="block">
+            <span className="sr-only">Approval password</span>
+            <input
+              type="password"
+              value={props.bulkApprovePassword}
+              onChange={props.onBulkApprovePasswordChange}
+              placeholder="Approval password"
+              autoComplete="current-password"
+              disabled={props.step === "submitting"}
+              className="w-full rounded-lg border border-slate-200 bg-white px-3 py-1.5 text-sm text-brand-dark placeholder:text-slate-400 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20 disabled:opacity-60"
+            />
+          </label>
+          {props.approvalGate?.totp_enabled === true && (
+            <label className="block">
+              <span className="sr-only">Authenticator code</span>
+              <input
+                type="text"
+                inputMode="numeric"
+                pattern="[0-9]*"
+                value={props.bulkApproveTotpCode}
+                onChange={props.onBulkApproveTotpCodeChange}
+                placeholder="Authenticator code"
+                disabled={props.step === "submitting"}
+                className="w-full rounded-lg border border-slate-200 bg-white px-3 py-1.5 text-sm text-brand-dark placeholder:text-slate-400 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20 disabled:opacity-60"
+              />
+            </label>
+          )}
+          {props.approvalGate?.cooldown_seconds && props.approvalGate.cooldown_seconds > 0 ? (
+            <p className="text-[11px] text-muted-foreground">
+              Bulk approval never uses the cooldown shortcut ({approvalGateCooldownLabel(props.approvalGate.cooldown_seconds).toLowerCase()}).
+            </p>
+          ) : null}
+        </div>
+      ) : (
+        <div className="mt-4 rounded-lg border border-brand-attention/20 bg-brand-attention/[0.04] px-3 py-3">
+          <p className="text-sm font-semibold text-brand-dark">Approval password required</p>
+          <p className="mt-1 text-xs leading-5 text-brand-dark/70">
+            Set up your local approval gate before approving multiple reads at once.
+          </p>
+          <a
+            href={props.settingsHref}
+            className="mt-2 inline-flex rounded-full border border-brand-blue/30 bg-white px-3 py-1.5 text-xs font-medium text-brand-blue no-underline transition-colors hover:bg-brand-blue/5"
+          >
+            Open Settings
+          </a>
+        </div>
+      )}
+
+      {disclosure.requiresTypedConfirm && isBulkApproveGateReady(props.approvalGate) && (
+        <div className="mt-3 space-y-1.5 rounded-lg border border-brand-attention/25 bg-brand-attention/[0.05] px-3 py-2.5">
+          <label className="block">
+            <span className="text-xs font-semibold text-brand-dark">
+              Type <span className="font-mono font-bold text-brand-attention">{disclosure.confirmPhrase}</span> to confirm
+            </span>
+            <input
+              type="text"
+              value={props.typedConfirm}
+              onChange={props.onTypedConfirmChange}
+              autoComplete="off"
+              spellCheck={false}
+              disabled={props.step === "submitting"}
+              aria-invalid={props.typedConfirm.length > 0 && !props.confirmMatches}
+              className="mt-1.5 w-full rounded-lg border border-slate-200 bg-white px-3 py-1.5 font-mono text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20 disabled:opacity-60"
+              placeholder={disclosure.confirmPhrase}
+            />
+          </label>
+          <p className="text-[11px] text-muted-foreground">
+            High-impact bulk approval: retype the phrase to enable the confirm button.
+          </p>
+        </div>
+      )}
+
+      {props.errorMessage !== null && (
+        <p className="mt-3 text-xs text-brand-purple" role="alert">
+          {props.errorMessage}
+        </p>
+      )}
+
+      <div className="mt-5 flex flex-wrap justify-end gap-2">
+        <button
+          type="button"
+          onClick={props.onCancel}
+          disabled={props.step === "submitting"}
+          className="rounded-full border border-slate-300 px-4 py-2 text-sm font-medium text-brand-dark transition-colors hover:bg-slate-50 disabled:opacity-50"
+        >
+          Cancel
+        </button>
+        <button
+          type="button"
+          onClick={props.onConfirmApprove}
+          disabled={props.step === "submitting" || !props.canConfirm}
+          className="rounded-full bg-brand-blue px-4 py-2 text-sm font-semibold text-white shadow-sm transition-colors hover:bg-brand-blue/90 disabled:cursor-not-allowed disabled:opacity-60"
+        >
+          {submitLabel}
+        </button>
+      </div>
+    </BulkDrawerShell>
+  );
+}
+
+function BulkDrawerShell(props: {
+  onClose: () => void;
+  labelledBy: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-end justify-center bg-black/30 p-0 backdrop-blur-sm sm:items-center sm:p-4"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby={props.labelledBy}
+      onClick={(event) => {
+        if (event.target === event.currentTarget) props.onClose();
+      }}
+    >
+      <div className="guard-fade-in max-h-[92vh] w-full max-w-lg overflow-y-auto rounded-t-2xl border border-slate-200 bg-white p-5 shadow-2xl sm:rounded-2xl sm:p-6">
+        {props.children}
+      </div>
+    </div>
+  );
+}

plugin_scanner-2.0.770/dashboard/src/queue-bulk-risk-disclosure.test.ts

@@ -0,0 +1,144 @@
+import {
+  BULK_HIGH_TIER_THRESHOLD,
+  BULK_LOW_TIER_THRESHOLD,
+  buildBulkConfirmPhrase,
+  buildBulkRiskDisclosure,
+  bulkConfirmMatches,
+  bulkRiskTone,
+  resolveBulkRiskTier,
+  type BulkSelectionStats,
+} from "./queue-bulk-risk-disclosure";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function baseStats(overrides: Partial<BulkSelectionStats> = {}): BulkSelectionStats {
+  return {
+    actionCount: 0,
+    groupCount: 0,
+    duplicateActionCount: 0,
+    sensitiveCount: 0,
+    sensitiveSamplePaths: [],
+    ...overrides,
+  };
+}
+
+// T-RISK-01: low tier copy + no typed confirm
+const low = buildBulkRiskDisclosure(baseStats({ actionCount: 3, groupCount: 3 }));
+assert(low.tier === "low", "T-RISK-01a: 3 reads is low tier");
+assert(low.requiresTypedConfirm === false, "T-RISK-01b: low tier does not require typed confirm");
+assert(low.tone === "green", "T-RISK-01c: low tier tone is green");
+assert(low.headline.includes("3 reads"), "T-RISK-01d: low headline includes action count");
+assert(low.confirmPhrase === "approve 3 reads", "T-RISK-01e: low confirm phrase format");
+
+// T-RISK-02: elevated tier (6 reads, no sensitive)
+const elevated = buildBulkRiskDisclosure(baseStats({ actionCount: 6, groupCount: 5 }));
+assert(elevated.tier === "elevated", "T-RISK-02a: 6 reads is elevated tier");
+assert(elevated.tone === "amber", "T-RISK-02b: elevated tone is amber");
+assert(elevated.requiresTypedConfirm === false, "T-RISK-02c: elevated does not require typed confirm");
+assert(elevated.headline.includes("6 reads"), "T-RISK-02d: elevated headline includes count");
+
+// T-RISK-02b: elevated via duplicate retries
+const elevatedDup = buildBulkRiskDisclosure(
+  baseStats({ actionCount: 4, groupCount: 3, duplicateActionCount: 1 }),
+);
+assert(elevatedDup.tier === "elevated", "T-RISK-02e: duplicate retries escalate to elevated");
+assert(
+  elevatedDup.bullets.some((b) => b.includes("duplicate retr") && b.includes("included")),
+  "T-RISK-02f: elevated dup copy mentions duplicate retry",
+);
+
+// T-RISK-03: high tier at threshold
+const high = buildBulkRiskDisclosure(
+  baseStats({ actionCount: BULK_HIGH_TIER_THRESHOLD, groupCount: 8 }),
+);
+assert(high.tier === "high", "T-RISK-03a: 10 reads is high tier");
+assert(high.tone === "attention", "T-RISK-03b: high tone is attention");
+assert(high.requiresTypedConfirm === true, "T-RISK-03c: high tier requires typed confirm");
+assert(
+  high.headline.toLowerCase().includes("high-impact"),
+  "T-RISK-03d: high headline flags high-impact",
+);
+assert(
+  high.body.toLowerCase().includes("mass approval"),
+  "T-RISK-03e: high body warns about mass approval",
+);
+
+// T-RISK-03b: high tier forced by sensitive items even at low count
+const highSensitive = buildBulkRiskDisclosure(
+  baseStats({ actionCount: 2, groupCount: 2, sensitiveCount: 1, sensitiveSamplePaths: [".env"] }),
+);
+assert(highSensitive.tier === "high", "T-RISK-03f: sensitive items force high tier");
+assert(highSensitive.requiresTypedConfirm === true, "T-RISK-03g: sensitive requires typed confirm");
+assert(
+  highSensitive.bullets.some((b) => b.includes("sensitive") && b.includes("NOT")),
+  "T-RISK-03h: sensitive bullets call out exclusion",
+);
+assert(
+  highSensitive.bullets.some((b) => b.includes(".env")),
+  "T-RISK-03i: sensitive sample paths included in copy",
+);
+
+// T-RISK-04: threshold boundaries (5 = low, 6 = elevated, 9 = elevated, 10 = high)
+assert(
+  resolveBulkRiskTier(baseStats({ actionCount: BULK_LOW_TIER_THRESHOLD, groupCount: 5 })) === "low",
+  "T-RISK-04a: 5 reads is low boundary",
+);
+assert(
+  resolveBulkRiskTier(baseStats({ actionCount: BULK_LOW_TIER_THRESHOLD + 1, groupCount: 6 })) === "elevated",
+  "T-RISK-04b: 6 reads crosses into elevated",
+);
+assert(
+  resolveBulkRiskTier(baseStats({ actionCount: BULK_HIGH_TIER_THRESHOLD - 1, groupCount: 8 })) === "elevated",
+  "T-RISK-04c: 9 reads stays elevated",
+);
+assert(
+  resolveBulkRiskTier(baseStats({ actionCount: BULK_HIGH_TIER_THRESHOLD, groupCount: 9 })) === "high",
+  "T-RISK-04d: 10 reads crosses into high",
+);
+
+// T-RISK-05: confirm phrase formatting + pluralization
+assert(buildBulkConfirmPhrase(1) === "approve 1 read", "T-RISK-05a: single-count phrase is grammatical");
+assert(buildBulkConfirmPhrase(12) === "approve 12 reads", "T-RISK-05b: multi-count phrase");
+assert(buildBulkConfirmPhrase(0) === "approve 0 reads", "T-RISK-05c: zero-count phrase");
+
+// T-RISK-06: typed-confirmation matching (case-insensitive, whitespace-trimmed)
+assert(
+  bulkConfirmMatches("Approve 12 reads", "approve 12 reads") === true,
+  "T-RISK-06a: case-insensitive match",
+);
+assert(
+  bulkConfirmMatches("  approve   12  reads  ", "approve 12 reads") === true,
+  "T-RISK-06b: whitespace-tolerant match",
+);
+assert(
+  bulkConfirmMatches("approve 12", "approve 12 reads") === false,
+  "T-RISK-06c: partial phrase does not match",
+);
+assert(
+  bulkConfirmMatches("", "approve 12 reads") === false,
+  "T-RISK-06d: empty input never matches",
+);
+assert(
+  bulkConfirmMatches("approve 5 reads", "approve 12 reads") === false,
+  "T-RISK-06e: wrong count does not match",
+);
+
+// T-RISK-07: zero selection guard returns low tier with no bullets
+const zero = buildBulkRiskDisclosure(baseStats());
+assert(zero.tier === "low", "T-RISK-07a: zero selection is low tier");
+assert(zero.bullets.length === 0, "T-RISK-07b: zero selection has no bullets");
+assert(
+  zero.headline.toLowerCase().includes("select"),
+  "T-RISK-07c: zero selection headline invites selection",
+);
+
+// T-RISK-08: tone mapping helper
+assert(bulkRiskTone("low") === "green", "T-RISK-08a: low tone green");
+assert(bulkRiskTone("elevated") === "amber", "T-RISK-08b: elevated tone amber");
+assert(bulkRiskTone("high") === "attention", "T-RISK-08c: high tone attention");
+
+console.log("queue-bulk-risk-disclosure.test.ts: all tests passed");