plugin-scanner 2.0.861__tar.gz → 2.0.863__tar.gz

{plugin_scanner-2.0.861 → plugin_scanner-2.0.863}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.861
+Version: 2.0.863
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.861 → plugin_scanner-2.0.863}/dashboard/src/approval-center-utils.ts

@@ -79,14 +79,12 @@ export function buildRetryAfterApprovalCopy(item: GuardApprovalRequest, action:
 }
 
 export function resolveEnvelopeDisplayText(envelope: GuardActionEnvelope): string | null {
-  if (envelope.action_type === "shell_command" && envelope.command !== null) {
+  if (envelope.action_type === "shell_command" && envelope.command !== null && envelope.command.length > 0) {
     return envelope.command;
   }
-  if (
-    envelope.action_type === "prompt" &&
-    (envelope.prompt_excerpt !== null || (envelope.prompt_text ?? null) !== null)
-  ) {
-    return envelope.prompt_text ?? envelope.prompt_excerpt;
+  const promptText = envelope.prompt_text ?? envelope.prompt_excerpt;
+  if (envelope.action_type === "prompt" && promptText !== null && promptText.length > 0) {
+    return promptText;
   }
   if (envelope.action_type === "mcp_tool" && envelope.mcp_server !== null && envelope.mcp_tool !== null) {
     return `${envelope.mcp_server} / ${envelope.mcp_tool}`;
@@ -100,6 +98,43 @@ export function resolveEnvelopeDisplayText(envelope: GuardActionEnvelope): strin
   return envelope.action_type === "harness_start" ? null : envelope.action_type;
 }
 
+export function resolveActionEnvelopeDetailText(
+  envelope: GuardActionEnvelope,
+  options: { mcpInputMaxLength?: number | null } = {}
+): string | null {
+  if (envelope.action_type === "shell_command") {
+    return envelope.command !== null && envelope.command.length > 0 ? envelope.command : null;
+  }
+  const promptText = envelope.prompt_text ?? envelope.prompt_excerpt;
+  if (envelope.action_type === "prompt") {
+    return promptText !== null && promptText.length > 0 ? promptText : null;
+  }
+  if (
+    (envelope.action_type === "file_read" || envelope.action_type === "file_write") &&
+    envelope.target_paths.length > 0
+  ) {
+    return envelope.target_paths.join("\n");
+  }
+  if (envelope.action_type === "network_request" && envelope.network_hosts.length > 0) {
+    return envelope.network_hosts.join("\n");
+  }
+  if (envelope.action_type === "mcp_tool") {
+    const baseText =
+      resolveEnvelopeDisplayText(envelope) ?? envelope.mcp_tool ?? envelope.tool_name ?? envelope.action_type;
+    const inputSummary = serializeMcpInput(envelope.raw_payload_redacted, options.mcpInputMaxLength ?? null);
+    return inputSummary === null ? baseText : `${baseText}\n\nInput:\n${inputSummary}`;
+  }
+  if (envelope.action_type === "package_script") {
+    if (envelope.package_manager && envelope.package_name) {
+      return `${envelope.package_manager} install ${envelope.package_name}`;
+    }
+    if (envelope.package_name) {
+      return envelope.package_name;
+    }
+  }
+  return resolveEnvelopeDisplayText(envelope);
+}
+
 export function humanizeList(values: string[]): string {
   if (values.length === 0) {
     return "nothing tracked yet";
@@ -479,13 +514,18 @@ function stripDuplicateReviewContextPrefix(value: string): string | null {
 }
 
 export function primaryReviewActionToggleLabel(isVisible: boolean): string {
-  return isVisible ? "Hide" : "Show";
+  return isVisible ? "Collapse" : "Expand";
 }
 
 export function resolveStoppedCommandText(item: GuardApprovalRequest): string {
   if (item.action_envelope_json) {
-    const envelopeText = resolveEnvelopeDisplayText(item.action_envelope_json);
-    if (envelopeText !== null) {
+    const envelope = item.action_envelope_json;
+    const envelopeText = resolveEnvelopeDisplayText(envelope);
+    const shouldFallbackFromGenericActionType =
+      envelopeText !== null &&
+      (envelope.action_type === "shell_command" || envelope.action_type === "prompt") &&
+      envelopeText === envelope.action_type;
+    if (envelopeText !== null && !shouldFallbackFromGenericActionType) {
       return envelopeText;
     }
   }
@@ -503,20 +543,17 @@ export function resolveStoppedCommandText(item: GuardApprovalRequest): string {
 }
 
 function resolvePrimaryReviewText(item: GuardApprovalRequest): string {
-  const baseText = resolveStoppedCommandText(item);
   const envelope = item.action_envelope_json;
-  if (envelope?.action_type !== "mcp_tool") {
-    return baseText;
-  }
-
-  const inputSummary = serializeMcpInput(envelope.raw_payload_redacted);
-  if (inputSummary === null) {
-    return baseText;
+  if (envelope) {
+    const envelopeText = resolveActionEnvelopeDetailText(envelope, { mcpInputMaxLength: null });
+    if (envelopeText !== null) {
+      return envelopeText;
+    }
   }
-  return `${baseText}\n\nInput:\n${inputSummary}`;
+  return resolveStoppedCommandText(item);
 }
 
-function serializeMcpInput(payload: Record<string, unknown>): string | null {
+function serializeMcpInput(payload: Record<string, unknown>, maxLength: number | null = null): string | null {
   const input = payload.arguments ?? payload.input ?? payload.params ?? null;
   if (input === null || input === undefined) {
     return null;
@@ -527,7 +564,10 @@ function serializeMcpInput(payload: Record<string, unknown>): string | null {
     if (serialized === undefined || serialized.trim().length === 0 || serialized === "{}") {
       return null;
     }
-    return serialized.length > 4000 ? `${serialized.slice(0, 4000)}...` : serialized;
+    if (maxLength !== null && serialized.length > maxLength) {
+      return `${serialized.slice(0, maxLength)}...`;
+    }
+    return serialized;
   } catch {
     return null;
   }

{plugin_scanner-2.0.861 → plugin_scanner-2.0.863}/dashboard/src/evidence/evidence-action-detail.tsx

@@ -16,10 +16,11 @@ import { useState } from "react";
 import type { GuardReceipt } from "../guard-types";
 import { isRiskSignalEvidence } from "../guard-types";
 import { harnessDisplayName, formatRelativeTime } from "../approval-center-utils";
-import { plainEnglishDescription, resolveActionTitle, resolveActionType, resolveActionSubtitle, resolveActionDetail } from "./plain-english";
+import { plainEnglishDescription, resolveActionTitle, resolveActionType, resolveActionDetail } from "./plain-english";
 import { detectCategory, getCategoryInfo } from "./categories";
 import { SectionLabel } from "../approval-center-primitives";
 import { DecisionBadge } from "./decision-badge";
+import { LoggedActionPanel } from "../logged-action-panel";
 
 interface EvidenceActionDetailProps {
   receipt: GuardReceipt | null;
@@ -295,7 +296,6 @@ export function EvidenceActionDetail({
   const description = plainEnglishDescription(receipt);
   const actionTitle = resolveActionTitle(receipt);
   const actionType = resolveActionType(receipt);
-  const actionSubtitle = resolveActionSubtitle(receipt);
   const actionDetail = resolveActionDetail(receipt);
   const signals = (receipt.scanner_evidence ?? []).filter(isRiskSignalEvidence);
   const primarySignal = signals[0];
@@ -354,11 +354,16 @@ export function EvidenceActionDetail({
         <p className="text-sm text-brand-dark leading-relaxed">{description}</p>
 
         {actionDetail && (
-          <div className="rounded-lg border border-slate-200 bg-slate-50 px-3 py-2.5">
+          <div className="space-y-2">
             <SectionLabel>{actionType}</SectionLabel>
-            <p className="mt-1 text-xs font-mono text-brand-dark break-all whitespace-pre-line leading-relaxed">
-              {actionDetail}
-            </p>
+            <LoggedActionPanel
+              key={receipt.receipt_id}
+              label={actionType}
+              text={actionDetail}
+              copyAriaLabel={`Copy full ${actionType.toLowerCase()} to clipboard`}
+              expandAriaLabel={`Expand full ${actionType.toLowerCase()}`}
+              collapseAriaLabel={`Collapse full ${actionType.toLowerCase()}`}
+            />
           </div>
         )}
 

{plugin_scanner-2.0.861 → plugin_scanner-2.0.863}/dashboard/src/evidence/evidence-detail.test.ts

@@ -1,9 +1,12 @@
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
-import type { GuardReceipt } from "../guard-types";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import type { GuardActionEnvelope, GuardReceipt } from "../guard-types";
 import { detectCategory, getCategoryInfo } from "./categories";
-import { humanFileName, plainEnglishDescription } from "./plain-english";
+import { EvidenceActionDetail } from "./evidence-action-detail";
+import { humanFileName, plainEnglishDescription, resolveActionDetail } from "./plain-english";
 
 function assert(condition: boolean, message: string): void {
   if (!condition) throw new Error(`FAIL: ${message}`);
@@ -11,6 +14,28 @@ function assert(condition: boolean, message: string): void {
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
+const BASE_ENVELOPE: GuardActionEnvelope = {
+  schema_version: 1,
+  action_id: "act-evidence",
+  harness: "codex",
+  event_name: "tool_call",
+  action_type: "shell_command",
+  workspace: null,
+  workspace_hash: null,
+  tool_name: null,
+  command: null,
+  prompt_excerpt: null,
+  prompt_text: null,
+  target_paths: [],
+  network_hosts: [],
+  mcp_server: null,
+  mcp_tool: null,
+  package_manager: null,
+  package_name: null,
+  script_name: null,
+  raw_payload_redacted: {},
+};
+
 function makeReceipt(id: string, overrides: Partial<GuardReceipt> = {}): GuardReceipt {
   return {
     receipt_id: id,
@@ -29,6 +54,47 @@ function makeReceipt(id: string, overrides: Partial<GuardReceipt> = {}): GuardRe
   };
 }
 
+const longEvidenceText = `${"cat ~/.guard/secrets.json && ".repeat(10)}printenv HOL_GUARD_TEST_TOKEN`;
+const longEvidenceReceipt = makeReceipt("detail-long", {
+  artifact_type: "command",
+  action_envelope_json: {
+    ...BASE_ENVELOPE,
+    command: longEvidenceText,
+  },
+});
+
+assert(
+  resolveActionDetail(longEvidenceReceipt) === longEvidenceText,
+  "GR232: resolveActionDetail preserves the full logged command text for Evidence copy"
+);
+
+const emptyCommandReceipt = makeReceipt("detail-empty-command", {
+  artifact_type: "command",
+  action_envelope_json: {
+    ...BASE_ENVELOPE,
+    command: "",
+  },
+});
+
+assert(
+  resolveActionDetail(emptyCommandReceipt) === null,
+  "GR232: resolveActionDetail ignores empty shell commands instead of surfacing blank content"
+);
+
+const evidenceDetailMarkup = renderToStaticMarkup(
+  createElement(EvidenceActionDetail, { receipt: longEvidenceReceipt, onClose: () => undefined }),
+);
+
+assert(
+  evidenceDetailMarkup.includes("Expand"),
+  "GR233: evidence action detail renders an expand control for long logged content"
+);
+
+assert(
+  evidenceDetailMarkup.includes("Copy"),
+  "GR233: evidence action detail renders a copy control for logged content"
+);
+
 const networkReceipt = makeReceipt("net1", {
   capabilities_summary: "calls http://api.example.com",
   artifact_name: "fetch-tool",
@@ -77,6 +143,7 @@ const descGeneric = plainEnglishDescription(makeReceipt("gen1", { capabilities_s
 assert(typeof descGeneric === "string" && descGeneric.length > 0, "GR232: plainEnglishDescription handles empty capabilities_summary");
 
 const detailSource = readFileSync(join(__dirname, "evidence-action-detail.tsx"), "utf8");
+const loggedPanelSource = readFileSync(join(__dirname, "../logged-action-panel.tsx"), "utf8");
 
 assert(
   detailSource.includes('aria-expanded') || detailSource.includes('details') || detailSource.includes('hidden'),
@@ -88,6 +155,21 @@ assert(
   "GR232: clipboard unavailable state is handled in evidence-action-detail"
 );
 
+assert(
+  loggedPanelSource.includes("navigator.clipboard.writeText(props.text)"),
+  "GR232: logged action panel copies the full logged text to the clipboard"
+);
+
+assert(
+  loggedPanelSource.includes("}, [props.text, resetCopied]);"),
+  "GR233: logged action panel resets copy state on text changes without coupling expansion state to props.text"
+);
+
+assert(
+  !loggedPanelSource.includes("}, [canExpand, props.text, resetCopied]);"),
+  "GR233: logged action panel no longer resets expansion state on every text change"
+);
+
 assert(
   !detailSource.includes("// clipboard"),
   "GR232: no inline clipboard comment in evidence-action-detail"

{plugin_scanner-2.0.861 → plugin_scanner-2.0.863}/dashboard/src/evidence/plain-english.ts

@@ -4,7 +4,7 @@ import type {
   GuardActionEnvelope,
 } from "../guard-types";
 import { isRiskSignalEvidence } from "../guard-types";
-import { harnessDisplayName } from "../approval-center-utils";
+import { harnessDisplayName, resolveActionEnvelopeDetailText } from "../approval-center-utils";
 import { detectCategory, type ReceiptCategory } from "./categories";
 
 function getArtifactType(receipt: GuardReceipt): string {
@@ -186,35 +186,7 @@ export function resolveActionSubtitle(receipt: GuardReceipt): string | null {
 export function resolveActionDetail(receipt: GuardReceipt): string | null {
   const envelope = getEnvelope(receipt);
   if (!envelope) return null;
-
-  const type = resolveActionType(receipt);
-
-  if (type === "Shell command" && envelope.command) {
-    return envelope.command;
-  }
-  if ((type === "File read" || type === "File write") && envelope.target_paths && envelope.target_paths.length > 0) {
-    return envelope.target_paths.join("\n");
-  }
-  if (type === "Prompt" && (envelope.prompt_text || envelope.prompt_excerpt)) {
-    return (envelope.prompt_text || envelope.prompt_excerpt) as string;
-  }
-  if (type === "Network request" && envelope.network_hosts && envelope.network_hosts.length > 0) {
-    return envelope.network_hosts.join("\n");
-  }
-  if (type === "Tool call") {
-    const server = envelope.mcp_server ?? envelope.tool_name;
-    const tool = envelope.mcp_tool;
-    if (server && tool) return `${server} → ${tool}`;
-    if (tool) return tool;
-    if (server) return server;
-  }
-  if (type === "Package") {
-    const pm = envelope.package_manager;
-    const name = envelope.package_name;
-    if (pm && name) return `${pm} install ${name}`;
-    if (name) return name;
-  }
-  return null;
+  return resolveActionEnvelopeDetailText(envelope, { mcpInputMaxLength: null });
 }
 
 function formatSubtitle(subtitle: string): string {

plugin_scanner-2.0.863/dashboard/src/logged-action-panel.tsx

@@ -0,0 +1,124 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+  HiMiniChevronDown,
+  HiMiniChevronUp,
+  HiMiniClipboard,
+  HiMiniClipboardDocumentCheck,
+} from "react-icons/hi2";
+
+import { useCopyFeedbackTimeout } from "./use-copy-feedback-timeout";
+
+const EXPAND_CHAR_THRESHOLD = 180;
+const EXPAND_LINE_THRESHOLD = 4;
+
+export function shouldOfferLoggedActionExpand(text: string): boolean {
+  const trimmed = text.trim();
+  if (trimmed.length === 0) {
+    return false;
+  }
+  if (trimmed.length > EXPAND_CHAR_THRESHOLD) {
+    return true;
+  }
+  return trimmed.split(/\r?\n/).length > EXPAND_LINE_THRESHOLD;
+}
+
+export function LoggedActionPanel(props: {
+  label: string;
+  text: string;
+  copyAriaLabel?: string;
+  expandAriaLabel?: string;
+  collapseAriaLabel?: string;
+}) {
+  const canExpand = useMemo(() => shouldOfferLoggedActionExpand(props.text), [props.text]);
+  const [expanded, setExpanded] = useState(!canExpand);
+  const { copied, flashCopied, resetCopied } = useCopyFeedbackTimeout(2000);
+
+  useEffect(() => {
+    resetCopied();
+  }, [props.text, resetCopied]);
+
+  useEffect(() => {
+    if (!canExpand) {
+      setExpanded(true);
+    }
+  }, [canExpand]);
+
+  const handleCopy = useCallback(async () => {
+    if (!navigator.clipboard?.writeText) {
+      resetCopied();
+      return;
+    }
+    try {
+      await navigator.clipboard.writeText(props.text);
+      flashCopied();
+    } catch {
+      resetCopied();
+    }
+  }, [flashCopied, props.text, resetCopied]);
+
+  const handleToggleExpanded = useCallback(() => {
+    setExpanded((value) => !value);
+  }, []);
+
+  return (
+    <div className="overflow-hidden rounded-xl bg-[#0f172a]">
+      <div className="flex min-h-11 flex-wrap items-center gap-1.5 border-b border-white/10 px-3 py-2 sm:flex-nowrap">
+        <span className="h-2.5 w-2.5 rounded-full bg-brand-purple" />
+        <span className="h-2.5 w-2.5 rounded-full bg-brand-blue" />
+        <span className="h-2.5 w-2.5 rounded-full bg-brand-green" />
+        <span className="ml-2 min-w-0 flex-1 truncate font-mono text-[10px] uppercase tracking-[0.2em] text-white/45">
+          {props.label}
+        </span>
+        <span className="ml-auto flex shrink-0 items-center gap-1.5">
+          <button
+            type="button"
+            onClick={handleCopy}
+            aria-label={props.copyAriaLabel ?? `Copy full ${props.label.toLowerCase()} to clipboard`}
+            className="inline-flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/15 bg-white/[0.08] px-2 font-mono text-[10px] font-semibold uppercase tracking-[0.12em] text-white/70 transition-colors hover:border-white/25 hover:bg-white/15 hover:text-white focus-visible:outline-white/50"
+          >
+            {copied ? (
+              <HiMiniClipboardDocumentCheck className="h-3.5 w-3.5" aria-hidden="true" />
+            ) : (
+              <HiMiniClipboard className="h-3.5 w-3.5" aria-hidden="true" />
+            )}
+            <span className="hidden sm:inline">{copied ? "Copied" : "Copy"}</span>
+          </button>
+          {canExpand ? (
+            <button
+              type="button"
+              onClick={handleToggleExpanded}
+              aria-label={
+                expanded
+                  ? (props.collapseAriaLabel ?? `Collapse full ${props.label.toLowerCase()}`)
+                  : (props.expandAriaLabel ?? `Expand full ${props.label.toLowerCase()}`)
+              }
+              aria-expanded={expanded}
+              className="inline-flex h-7 shrink-0 items-center gap-1 rounded-lg border border-white/15 bg-white/[0.08] px-2 font-mono text-[10px] font-semibold uppercase tracking-[0.12em] text-white/70 transition-colors hover:border-white/25 hover:bg-white/15 hover:text-white focus-visible:outline-white/50"
+            >
+              {expanded ? (
+                <HiMiniChevronUp className="h-3.5 w-3.5" aria-hidden="true" />
+              ) : (
+                <HiMiniChevronDown className="h-3.5 w-3.5" aria-hidden="true" />
+              )}
+              <span className="hidden sm:inline">{expanded ? "Collapse" : "Expand"}</span>
+            </button>
+          ) : null}
+        </span>
+      </div>
+      <div className="relative">
+        <pre
+          className={`whitespace-pre-wrap break-words px-3 py-3 font-mono text-[13px] leading-6 text-white/90 sm:text-sm ${
+            expanded
+              ? "max-h-[min(34rem,48vh)] overflow-auto [scrollbar-gutter:stable]"
+              : "max-h-40 overflow-hidden"
+          }`}
+        >
+          {props.text}
+        </pre>
+        {canExpand && !expanded ? (
+          <div className="pointer-events-none absolute inset-x-0 bottom-0 h-14 bg-gradient-to-t from-[#0f172a] to-transparent" />
+        ) : null}
+      </div>
+    </div>
+  );
+}

{plugin_scanner-2.0.861 → plugin_scanner-2.0.863}/dashboard/src/phase09-review.test.ts

@@ -468,12 +468,12 @@ assert(
 );
 
 assert(
-  primaryReviewActionToggleLabel(true) === "Hide",
-  "GR211-01: primary review card can hide the stopped prompt or command"
+  primaryReviewActionToggleLabel(true) === "Collapse",
+  "GR211-01: primary review card can collapse expanded stopped content"
 );
 assert(
-  primaryReviewActionToggleLabel(false) === "Show",
-  "GR211-02: primary review card can restore the stopped prompt or command"
+  primaryReviewActionToggleLabel(false) === "Expand",
+  "GR211-02: primary review card can expand collapsed stopped content"
 );
 
 const PRIMARY_PROMPT_ACTION = buildPrimaryReviewAction({
@@ -770,6 +770,17 @@ assert(
   "GR211-15: primary review card exposes shell command without opening technical details"
 );
 
+const EMPTY_COMMAND_WITH_LAUNCH_TARGET = {
+  ...BASE_REQUEST,
+  request_id: "ph09-empty-command",
+  launch_target: "python -m hol_guard.resume",
+  action_envelope_json: { ...BASE_ENVELOPE, command: "" },
+};
+assert(
+  resolveStoppedCommandText(EMPTY_COMMAND_WITH_LAUNCH_TARGET) === "python -m hol_guard.resume",
+  "GR211-16: empty shell command falls back to the launch target instead of rendering a blank panel"
+);
+
 const PRIMARY_MCP_ACTION = buildPrimaryReviewAction({
   ...BASE_REQUEST,
   request_id: "ph09-primary-mcp",
@@ -795,6 +806,28 @@ assert(
   "GR211-09: primary review card exposes redacted MCP arguments without opening technical details"
 );
 
+const LONG_MCP_INPUT_TEXT = `${"0123456789abcdef".repeat(320)}-keep-the-entire-input`;
+const PRIMARY_MCP_ACTION_FULL_INPUT = buildPrimaryReviewAction({
+  ...BASE_REQUEST,
+  request_id: "ph09-primary-mcp-full-input",
+  action_envelope_json: {
+    ...BASE_ENVELOPE,
+    action_type: "mcp_tool",
+    command: null,
+    mcp_server: "danger_lab",
+    mcp_tool: "dangerous_delete",
+    raw_payload_redacted: {
+      arguments: {
+        payload: LONG_MCP_INPUT_TEXT,
+      },
+    },
+  },
+});
+assert(
+  PRIMARY_MCP_ACTION_FULL_INPUT.text.includes(LONG_MCP_INPUT_TEXT),
+  "GR211-10: primary review copy preserves the full MCP input instead of truncating it"
+);
+
 const RESOLVED_ITEM: GuardApprovalRequest = {
   ...BASE_REQUEST,
   request_id: "ph09-resolved",