plugin-scanner 2.0.873__tar.gz → 2.0.875__tar.gz

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.873
+Version: 2.0.875
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/app.tsx

@@ -610,8 +610,8 @@ export function App() {
     if (bulkApproveInFlight.current) {
       return;
     }
-    if (!gateCredentials?.approval_password?.trim()) {
-      throw new Error("Bulk approval requires an approval password.");
+    if (!gateCredentials?.approval_password?.trim() && !gateCredentials?.approval_totp_code?.trim()) {
+      throw new Error("Bulk approval requires approval proof.");
     }
     bulkApproveInFlight.current = true;
     try {

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/approval-center-review-cards.tsx

@@ -2,6 +2,7 @@ import { useCallback, useEffect, useRef, type ChangeEvent } from "react";
 import { HiMiniCheck, HiMiniXMark, HiMiniKey } from "react-icons/hi2";
 import type { GuardApprovalRequest, GuardApprovalGatePublicConfig } from "./guard-types";
 import { approvalGateCooldownLabel } from "./approval-gate-utils";
+import { approvalProofRequiresPassword } from "./approval-proof-inline";
 
 type WhyThisPausedProps = {
   item: GuardApprovalRequest;
@@ -110,12 +111,18 @@ type ApprovalPasswordModalProps = {
 
 export function ApprovalPasswordModal(props: ApprovalPasswordModalProps) {
   const passwordRef = useRef<HTMLInputElement>(null);
+  const totpRef = useRef<HTMLInputElement>(null);
+  const needsPassword = approvalProofRequiresPassword(props.gate);
   useEffect(() => {
     const timer = setTimeout(() => {
-      passwordRef.current?.focus();
+      if (needsPassword) {
+        passwordRef.current?.focus();
+      } else {
+        totpRef.current?.focus();
+      }
     }, 50);
     return () => clearTimeout(timer);
-  }, []);
+  }, [needsPassword]);
 
   const showCooldownOption =
     props.gate.cooldown_seconds > 0 &&
@@ -158,7 +165,7 @@ export function ApprovalPasswordModal(props: ApprovalPasswordModalProps) {
               id="approval-password-modal-title"
               className="text-lg font-semibold tracking-tight text-brand-dark"
             >
-              Approval password required
+              {needsPassword ? "Approval password required" : "Authenticator code required"}
             </h2>
             <p className="text-sm text-brand-dark/70">
               Guard needs a fresh proof before it can save this decision.
@@ -167,24 +174,27 @@ export function ApprovalPasswordModal(props: ApprovalPasswordModalProps) {
         </div>
 
         <div className="mt-5 space-y-3">
-          <label className="block">
-            <span className="text-sm font-semibold text-brand-dark">Approval password</span>
-            <input
-              ref={passwordRef}
-              type="password"
-              autoComplete="current-password"
-              value={props.approvalPassword}
-              onChange={props.onApprovalPasswordChange}
-              className="mt-1 min-h-10 w-full rounded-lg border border-slate-200 bg-white px-3 py-1.5 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
-            />
-          </label>
-          {props.gate.totp_enabled === true && (
+          {needsPassword ? (
+            <label className="block">
+              <span className="text-sm font-semibold text-brand-dark">Approval password</span>
+              <input
+                ref={passwordRef}
+                type="password"
+                autoComplete="current-password"
+                value={props.approvalPassword}
+                onChange={props.onApprovalPasswordChange}
+                className="mt-1 min-h-10 w-full rounded-lg border border-slate-200 bg-white px-3 py-1.5 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+              />
+            </label>
+          ) : (
             <label className="block">
               <span className="text-sm font-semibold text-brand-dark">Authenticator code</span>
               <input
+                ref={totpRef}
                 type="text"
                 inputMode="numeric"
                 pattern="[0-9]*"
+                autoComplete="one-time-code"
                 value={props.approvalTotpCode}
                 onChange={props.onApprovalTotpCodeChange}
                 className="mt-1 min-h-10 w-full rounded-lg border border-slate-200 bg-white px-3 py-1.5 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/approval-gate.test.ts

@@ -1,5 +1,6 @@
 import type { GuardApprovalGatePublicConfig, GuardSettings } from "./guard-types";
 import { approvalGateCooldownLabel, requiresApprovalPasswordPrompt } from "./approval-gate-utils";
+import { buildApprovalProofCredentials, isApprovalProofSubmitDisabled } from "./approval-proof-inline";
 import { applyApprovalGateDraft, hasUnsavedChanges } from "./settings-workspace";
 
 function assert(condition: boolean, message: string): void {
@@ -231,6 +232,28 @@ function testBulkApproveGateCredentialsPayload(): void {
   assert(!("approval_gate_use_cooldown" in withoutGate), "bulk payload should not include approval_gate_use_cooldown when no gate credentials");
 }
 
+function testApprovalProofTotpOverridesPassword(): void {
+  const totpGate: GuardApprovalGatePublicConfig = {
+    enabled: true,
+    configured: true,
+    cooldown_seconds: 0,
+    cooldown_active: false,
+    cooldown_expires_at: null,
+    locked_until: null,
+    fail_closed: false,
+    strict_all_decisions: false,
+    totp_enabled: true,
+    totp_pending: false,
+  };
+  assert(
+    isApprovalProofSubmitDisabled(totpGate, { approvalPassword: "", approvalTotpCode: "123456" }, false) === false,
+    "totp approval proof should not require password",
+  );
+  const credentials = buildApprovalProofCredentials(totpGate, { approvalPassword: "ignored", approvalTotpCode: "123456" });
+  assert(credentials.approval_totp_code === "123456", "totp approval proof should include authenticator code");
+  assert(!("approval_password" in credentials), "totp approval proof should omit password");
+}
+
 const tests: Array<[string, () => void]> = [
   ["testApprovalGatePublicConfigEnabled", testApprovalGatePublicConfigEnabled],
   ["testApprovalGatePublicConfigDisabled", testApprovalGatePublicConfigDisabled],
@@ -240,6 +263,7 @@ const tests: Array<[string, () => void]> = [
   ["testApprovalGateToggleReflectedInDraftApprovalGate", testApprovalGateToggleReflectedInDraftApprovalGate],
   ["testApprovalGateCooldownReflectedInDraftApprovalGate", testApprovalGateCooldownReflectedInDraftApprovalGate],
   ["testBulkApproveGateCredentialsPayload", testBulkApproveGateCredentialsPayload],
+  ["testApprovalProofTotpOverridesPassword", testApprovalProofTotpOverridesPassword],
 ];
 
 let passed = 0;

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/approval-proof-inline.tsx

@@ -13,21 +13,51 @@ type ApprovalProofFieldInputsProps = {
   onApprovalTotpCodeChange: (event: ChangeEvent<HTMLInputElement>) => void;
 };
 
+export function approvalProofRequiresPassword(gate: GuardApprovalGatePublicConfig | null | undefined): boolean {
+  return gate?.totp_enabled !== true;
+}
+
+export function isApprovalProofSubmitDisabled(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+  credentials: { approvalPassword: string; approvalTotpCode: string },
+  busy: boolean,
+): boolean {
+  if (busy) {
+    return true;
+  }
+  if (approvalProofRequiresPassword(gate)) {
+    return credentials.approvalPassword.trim() === "";
+  }
+  return credentials.approvalTotpCode.trim() === "";
+}
+
+export function buildApprovalProofCredentials(
+  gate: GuardApprovalGatePublicConfig | null | undefined,
+  credentials: { approvalPassword: string; approvalTotpCode: string },
+): { approval_password?: string; approval_totp_code?: string } {
+  if (approvalProofRequiresPassword(gate)) {
+    return { approval_password: credentials.approvalPassword };
+  }
+  return { approval_totp_code: credentials.approvalTotpCode };
+}
+
 export function ApprovalProofFieldInputs(props: ApprovalProofFieldInputsProps) {
+  const needsPassword = approvalProofRequiresPassword(props.approvalGate);
   return (
     <div className="space-y-3">
-      <label className="block">
-        <span className="text-sm font-semibold text-brand-dark">Approval password</span>
-        <input
-          ref={props.passwordRef}
-          type="password"
-          autoComplete="current-password"
-          value={props.approvalPassword}
-          onChange={props.onApprovalPasswordChange}
-          className="mt-1 min-h-11 w-full rounded-lg border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
-        />
-      </label>
-      {props.approvalGate?.totp_enabled === true ? (
+      {needsPassword ? (
+        <label className="block">
+          <span className="text-sm font-semibold text-brand-dark">Approval password</span>
+          <input
+            ref={props.passwordRef}
+            type="password"
+            autoComplete="current-password"
+            value={props.approvalPassword}
+            onChange={props.onApprovalPasswordChange}
+            className="mt-1 min-h-11 w-full rounded-lg border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+          />
+        </label>
+      ) : (
         <label className="block">
           <span className="text-sm font-semibold text-brand-dark">Authenticator code</span>
           <input
@@ -40,7 +70,7 @@ export function ApprovalProofFieldInputs(props: ApprovalProofFieldInputsProps) {
             className="mt-1 min-h-11 w-full rounded-lg border border-slate-200 bg-white px-3 py-2 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
           />
         </label>
-      ) : null}
+      )}
     </div>
   );
 }
@@ -68,10 +98,14 @@ export function ApprovalProofInline(props: ApprovalProofInlineProps) {
     return () => window.clearTimeout(timer);
   }, []);
 
-  const submitDisabled =
-    props.submitBusy ||
-    props.approvalPassword.trim() === "" ||
-    (props.approvalGate?.totp_enabled === true && props.approvalTotpCode.trim() === "");
+  const submitDisabled = isApprovalProofSubmitDisabled(
+    props.approvalGate,
+    {
+      approvalPassword: props.approvalPassword,
+      approvalTotpCode: props.approvalTotpCode,
+    },
+    props.submitBusy,
+  );
 
   const handleKeyDown = useCallback(
     (event: KeyboardEvent<HTMLDivElement>) => {
@@ -93,7 +127,7 @@ export function ApprovalProofInline(props: ApprovalProofInlineProps) {
           <div className="min-w-0">
             <h3 className="text-sm font-semibold text-brand-dark">Approval proof required</h3>
             <p className="mt-1 text-sm leading-relaxed text-slate-600">
-              Enter your local approval password before Guard syncs supply-chain intel on this device.
+              Enter your local approval proof before Guard syncs supply-chain intel on this device.
             </p>
           </div>
         </div>

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/approval-proof-modal.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useState } from "react";
 import type { ChangeEvent } from "react";
 import { ActionButton, SectionLabel } from "./approval-center-primitives";
-import { ApprovalProofFieldInputs } from "./approval-proof-inline";
+import { ApprovalProofFieldInputs, buildApprovalProofCredentials, isApprovalProofSubmitDisabled } from "./approval-proof-inline";
 import type { GuardApprovalGatePublicConfig } from "./guard-types";
 
 type ApprovalProofModalProps = {
@@ -27,14 +27,14 @@ export function ApprovalProofModal(props: ApprovalProofModalProps) {
   }, []);
 
   const handleConfirm = useCallback(() => {
-    onConfirm({
-      approval_password: password,
-      ...(approvalGate?.totp_enabled === true ? { approval_totp_code: totpCode } : {}),
-    });
+    onConfirm(buildApprovalProofCredentials(approvalGate, { approvalPassword: password, approvalTotpCode: totpCode }));
   }, [approvalGate, onConfirm, password, totpCode]);
 
-  const confirmDisabled =
-    password.trim() === "" || (approvalGate?.totp_enabled === true && totpCode.trim() === "");
+  const confirmDisabled = isApprovalProofSubmitDisabled(
+    approvalGate,
+    { approvalPassword: password, approvalTotpCode: totpCode },
+    false,
+  );
 
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-950/40 px-4">

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/guard-api.ts

@@ -1889,7 +1889,7 @@ export async function revokeApprovalGateCooldown(password: string, totpCode?: st
     },
     body: JSON.stringify({
       approval_gate: {
-        password,
+        ...(password.trim().length > 0 ? { password } : {}),
         ...(totpCode !== undefined && totpCode.trim().length > 0 ? { totp_code: totpCode } : {})
       }
     })
@@ -1967,7 +1967,7 @@ export async function disableApprovalGateTotp(
     },
     body: JSON.stringify({
       approval_gate: {
-        password: currentPassword
+        ...(currentPassword.trim().length > 0 ? { password: currentPassword } : {})
       },
       approval_totp_code: code
     })

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/home-dashboard.tsx

@@ -24,6 +24,7 @@ import { harnessDisplayName, formatRelativeTime, formatNumber, isDisplayableHarn
 import { useFocusTrap } from "./use-focus-trap";
 import { DeviceProofCard, resolveCloudIntelCopy } from "./runtime-overview";
 import { HomeProtectionModule } from "./home-protection-module";
+import { approvalProofRequiresPassword } from "./approval-proof-inline";
 import { EvidenceInsightsHomePreview } from "./evidence/evidence-insights-home-preview";
 import { EvidenceInsightsShareModal } from "./evidence/evidence-insights-share-modal";
 import { useReceiptAnalytics } from "./evidence/use-receipt-analytics";
@@ -444,6 +445,7 @@ function ClearConfirmDialog(props: {
   const dialogRef = useRef<HTMLDivElement>(null);
   useFocusTrap(true, dialogRef);
   const needsProof = props.approvalGate?.enabled === true && props.approvalGate.configured === true;
+  const needsPassword = approvalProofRequiresPassword(props.approvalGate);
 
   return (
     <div className="guard-fade-in fixed inset-0 z-50 flex items-center justify-center bg-black/30 p-4 backdrop-blur-sm" role="dialog" aria-modal="true" aria-label="Confirm clear decisions">
@@ -459,17 +461,18 @@ function ClearConfirmDialog(props: {
                 </p>
                 {needsProof && (
                   <div className="mt-4 grid gap-3">
-                    <label className="block">
-                      <span className="text-xs font-semibold uppercase tracking-[0.18em] text-slate-500">Approval password</span>
-                      <input
-                        type="password"
-                        autoComplete="current-password"
-                        value={props.clearPassword}
-                        onChange={props.onClearPasswordChange}
-                        className="mt-1 min-h-10 w-full rounded-xl border border-slate-200 bg-white px-3 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
-                      />
-                    </label>
-                    {props.approvalGate?.totp_enabled === true && (
+                    {needsPassword ? (
+                      <label className="block">
+                        <span className="text-xs font-semibold uppercase tracking-[0.18em] text-slate-500">Approval password</span>
+                        <input
+                          type="password"
+                          autoComplete="current-password"
+                          value={props.clearPassword}
+                          onChange={props.onClearPasswordChange}
+                          className="mt-1 min-h-10 w-full rounded-xl border border-slate-200 bg-white px-3 text-sm text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
+                        />
+                      </label>
+                    ) : (
                       <label className="block">
                         <span className="text-xs font-semibold uppercase tracking-[0.18em] text-slate-500">Authenticator code</span>
                         <input
@@ -480,6 +483,7 @@ function ClearConfirmDialog(props: {
                           value={props.clearTotpCode}
                           onChange={props.onClearTotpCodeChange}
                           placeholder="123456"
+                          autoComplete="one-time-code"
                           className="mt-1 min-h-10 w-full rounded-xl border border-slate-200 bg-white px-3 text-sm tracking-[0.28em] text-brand-dark focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20"
                         />
                       </label>

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/queue-bulk-approve-flow.tsx

@@ -29,14 +29,14 @@ export function validateBulkApproveCredentials(
   credentials: { password: string; totpCode: string },
 ): string | null {
   if (!isBulkApproveGateReady(gate)) {
-    return "Set up an approval password in Settings before bulk approval.";
+    return "Set up an approval gate in Settings before bulk approval.";
+  }
+  if (gate?.totp_enabled === true) {
+    return credentials.totpCode.trim() ? null : "Enter your authenticator code to continue.";
   }
   if (!credentials.password.trim()) {
     return "Enter your approval password to continue.";
   }
-  if (gate?.totp_enabled === true && !credentials.totpCode.trim()) {
-    return "Enter your authenticator code to continue.";
-  }
   return null;
 }
 
@@ -48,9 +48,14 @@ export function buildBulkGateCredentials(
   if (!isBulkApproveGateReady(gate)) {
     return undefined;
   }
+  if (gate?.totp_enabled === true) {
+    return {
+      approval_totp_code: totpCode.trim(),
+      approval_gate_use_cooldown: false,
+    };
+  }
   return {
     approval_password: password.trim(),
-    approval_totp_code: totpCode.trim(),
     approval_gate_use_cooldown: false,
   };
 }
@@ -436,27 +441,14 @@ export function QueueBulkDrawer(props: QueueBulkDrawerProps) {
 
         {gateReady ? (
           <div className="mt-3 space-y-3 rounded-xl border border-slate-200 bg-white p-4">
-            <div className="flex items-center gap-2">
-              <HiMiniKey className="h-4 w-4 text-brand-blue" aria-hidden="true" />
-              <label htmlFor="guard-bulk-approval-password" className="text-sm font-semibold text-brand-dark">
-                Approval password
-              </label>
-            </div>
-            <input
-              id="guard-bulk-approval-password"
-              type="password"
-              value={props.bulkApprovePassword}
-              onChange={props.onBulkApprovePasswordChange}
-              placeholder="Enter your approval password"
-              autoComplete="current-password"
-              disabled={props.step === "submitting"}
-              className="min-h-11 w-full rounded-lg border border-slate-200 bg-white px-3 text-sm text-brand-dark placeholder:text-slate-400 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20 disabled:opacity-60"
-            />
             {props.approvalGate?.totp_enabled === true && (
               <>
-                <label htmlFor="guard-bulk-approval-totp" className="block text-sm font-semibold text-brand-dark">
-                  Authenticator code
-                </label>
+                <div className="flex items-center gap-2">
+                  <HiMiniKey className="h-4 w-4 text-brand-blue" aria-hidden="true" />
+                  <label htmlFor="guard-bulk-approval-totp" className="text-sm font-semibold text-brand-dark">
+                    Authenticator code
+                  </label>
+                </div>
                 <input
                   id="guard-bulk-approval-totp"
                   type="text"
@@ -470,6 +462,26 @@ export function QueueBulkDrawer(props: QueueBulkDrawerProps) {
                 />
               </>
             )}
+            {props.approvalGate?.totp_enabled !== true && (
+              <>
+                <div className="flex items-center gap-2">
+                  <HiMiniKey className="h-4 w-4 text-brand-blue" aria-hidden="true" />
+                  <label htmlFor="guard-bulk-approval-password" className="text-sm font-semibold text-brand-dark">
+                    Approval password
+                  </label>
+                </div>
+                <input
+                  id="guard-bulk-approval-password"
+                  type="password"
+                  value={props.bulkApprovePassword}
+                  onChange={props.onBulkApprovePasswordChange}
+                  placeholder="Enter your approval password"
+                  autoComplete="current-password"
+                  disabled={props.step === "submitting"}
+                  className="min-h-11 w-full rounded-lg border border-slate-200 bg-white px-3 text-sm text-brand-dark placeholder:text-slate-400 focus:border-brand-blue focus:outline-none focus:ring-2 focus:ring-brand-blue/20 disabled:opacity-60"
+                />
+              </>
+            )}
             {disclosure.requiresTypedConfirm && (
               <div className="rounded-lg bg-brand-attention/[0.05] px-3 py-2.5">
                 <label htmlFor="guard-bulk-typed-confirm" className="block text-xs font-semibold text-brand-dark">

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/queue-bulk-approve.test.ts

@@ -110,7 +110,15 @@ assert(
 const gateCredentials = buildBulkGateCredentials(readyGate, "secret", "123456");
 assert(gateCredentials?.approval_password === "secret", "T-BULK-09: buildBulkGateCredentials includes password when gate is ready");
 assert(gateCredentials?.approval_gate_use_cooldown === false, "T-BULK-10: buildBulkGateCredentials never enables cooldown for bulk");
+const totpGate = { ...readyGate, totp_enabled: true };
+assert(
+  validateBulkApproveCredentials(totpGate, { password: "", totpCode: "123456" }) === null,
+  "T-BULK-11: validateBulkApproveCredentials accepts totp without password when MFA is enabled",
+);
+const totpCredentials = buildBulkGateCredentials(totpGate, "", "123456");
+assert(totpCredentials?.approval_totp_code === "123456", "T-BULK-12: buildBulkGateCredentials includes totp when MFA is enabled");
+assert(!("approval_password" in (totpCredentials ?? {})), "T-BULK-13: buildBulkGateCredentials omits password when MFA is enabled");
 
-assert(buildBulkGateCredentials(null, "secret", "") === undefined, "T-BULK-11: buildBulkGateCredentials omits credentials when gate is not ready");
+assert(buildBulkGateCredentials(null, "secret", "") === undefined, "T-BULK-14: buildBulkGateCredentials omits credentials when gate is not ready");
 
 console.log("queue-bulk-approve.test.ts: all tests passed");

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/review-workspace.tsx

@@ -83,6 +83,7 @@ import {
 import { plainEnglishRequestTitle, whyPaused } from "./evidence/plain-english";
 import { requiresApprovalPasswordPrompt, type BulkGateCredentials } from "./approval-gate-utils";
 import { ApprovalPasswordModal } from "./approval-center-review-cards";
+import { approvalProofRequiresPassword } from "./approval-proof-inline";
 import { guardAwareHref } from "./guard-api";
 import { LoggedActionPanel } from "./logged-action-panel";
 import {
@@ -1058,6 +1059,7 @@ function ReviewDecisionCard(props: {
       setErrorMessage(null);
       try {
         const gate = props.approvalGate;
+        const needsPassword = approvalProofRequiresPassword(gate);
         const includeGateFields =
           gate?.enabled === true &&
           gate?.configured === true &&
@@ -1069,10 +1071,8 @@ function ReviewDecisionCard(props: {
             scope,
             reason: action === "allow" ? "approved in review" : "blocked in review",
           }),
-          ...(includeGateFields ? { approval_password: approvalPassword } : {}),
-          ...(includeGateFields && gate?.totp_enabled === true
-            ? { approval_totp_code: approvalTotpCode }
-            : {}),
+          ...(includeGateFields && needsPassword ? { approval_password: approvalPassword } : {}),
+          ...(includeGateFields && !needsPassword ? { approval_totp_code: approvalTotpCode } : {}),
           ...(includeGateFields ? { approval_gate_use_cooldown: useCooldown } : {}),
         });
         setResolved(action);

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/settings-save-proof-modal.test.ts

@@ -73,12 +73,20 @@ assert(
 );
 assert(
   isSettingsSaveProofSubmitDisabled("verify-save", { currentPassword: "secret" }, true) === true,
-  "save-proof: verify requires totp when enabled",
+  "save-proof: verify rejects missing totp when enabled",
 );
 
 assert(
-  isSettingsSaveProofSubmitDisabled("verify-save", { currentPassword: "secret" }, true) === true,
-  "save-proof: verify requires totp when enabled",
+  isSettingsSaveProofSubmitDisabled("verify-save", { totpCode: "123456" }, true) === false,
+  "save-proof: verify accepts totp without password when enabled",
+);
+assert(
+  isSettingsSaveProofSubmitDisabled(
+    "change-password",
+    { newPassword: "next-secret", confirmPassword: "next-secret", totpCode: "123456" },
+    true,
+  ) === false,
+  "save-proof: change-password accepts totp without current password when enabled",
 );
 assert(
   isSettingsSaveProofSubmitDisabled("setup-gate", { newPassword: "alpha", confirmPassword: "beta" }, false) === true,

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/settings-save-proof-modal.tsx

@@ -77,7 +77,7 @@ export function resolveSettingsSaveProofModalCopy(input: {
   if (input.mode === "change-password") {
     return {
       title: "Change approval password",
-      detail: "Enter your current password, then choose a new one.",
+      detail: "Confirm your approval proof, then choose a new password.",
       confirmLabel: "Update password",
     };
   }
@@ -106,7 +106,7 @@ export function resolveSettingsSaveProofModalCopy(input: {
     if (input.maintenanceAction === "disable-totp") {
       return {
         title: "Disconnect authenticator",
-        detail: "Confirm your approval password and a current app code to remove this second factor.",
+        detail: "Confirm a current app code to remove this second factor.",
         confirmLabel: "Disconnect",
       };
     }
@@ -133,13 +133,13 @@ export function resolveSettingsSaveProofModalCopy(input: {
   if (input.gateSettingsChanged) {
     return {
       title: "Confirm before saving gate changes",
-      detail: "Enter your approval password so Guard can apply the gate updates you chose.",
+      detail: "Enter your approval proof so Guard can apply the gate updates you chose.",
       confirmLabel: "Save settings",
     };
   }
   return {
     title: "Confirm before saving",
-    detail: "Enter your approval password so Guard can save these settings.",
+    detail: "Enter your approval proof so Guard can save these settings.",
     confirmLabel: "Save settings",
   };
 }
@@ -158,20 +158,24 @@ export function isSettingsSaveProofSubmitDisabled(
     return next.length === 0 || confirm.length === 0 || next !== confirm;
   }
   if (mode === "change-password") {
-    if (current.length === 0 || next.length === 0 || confirm.length === 0 || next !== confirm) {
+    if (next.length === 0 || confirm.length === 0 || next !== confirm) {
       return true;
     }
-    return totpRequired && totp.length === 0;
+    return totpRequired ? totp.length === 0 : current.length === 0;
+  }
+  if (totpRequired) {
+    return totp.length === 0;
   }
   if (current.length === 0) {
     return true;
   }
-  return totpRequired && totp.length === 0;
+  return false;
 }
 
 export function SettingsSaveProofModal(props: SettingsSaveProofModalProps) {
   const dialogRef = useRef<HTMLDivElement>(null);
   const passwordRef = useRef<HTMLInputElement>(null);
+  const totpRef = useRef<HTMLInputElement>(null);
   const [currentPassword, setCurrentPassword] = useState("");
   const [newPassword, setNewPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
@@ -188,10 +192,17 @@ export function SettingsSaveProofModal(props: SettingsSaveProofModalProps) {
       return;
     }
     const timer = setTimeout(() => {
-      passwordRef.current?.focus();
+      if (
+        props.gate?.totp_enabled === true
+        && (props.mode === "verify-save" || props.mode === "change-password" || props.mode === "maintenance")
+      ) {
+        totpRef.current?.focus();
+      } else {
+        passwordRef.current?.focus();
+      }
     }, 50);
     return () => clearTimeout(timer);
-  }, [props.open, props.mode]);
+  }, [props.gate?.totp_enabled, props.open, props.mode]);
 
   useEffect(() => {
     if (props.open) {
@@ -212,6 +223,7 @@ export function SettingsSaveProofModal(props: SettingsSaveProofModalProps) {
 
   const totpRequired = props.gate?.totp_enabled === true
     && (props.mode === "verify-save" || props.mode === "change-password" || props.mode === "maintenance");
+  const needsCurrentPassword = props.mode !== "setup-gate" && !totpRequired;
 
   const handleCurrentPasswordChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
     setCurrentPassword(event.target.value);
@@ -285,7 +297,7 @@ export function SettingsSaveProofModal(props: SettingsSaveProofModalProps) {
         </div>
 
         <div className="mt-5 space-y-3">
-          {props.mode !== "setup-gate" ? (
+          {needsCurrentPassword ? (
             <label className="block">
               <span className="text-sm font-semibold text-brand-dark">Approval password</span>
               <input
@@ -333,6 +345,8 @@ export function SettingsSaveProofModal(props: SettingsSaveProofModalProps) {
                 inputMode="numeric"
                 pattern="[0-9]*"
                 maxLength={6}
+                ref={totpRef}
+                autoComplete="one-time-code"
                 value={totpCode}
                 onChange={handleTotpChange}
                 placeholder="123456"

{plugin_scanner-2.0.873 → plugin_scanner-2.0.875}/dashboard/src/supply-chain-audit-recovery-modal.tsx

@@ -7,7 +7,7 @@ import {
   HiMiniCloudArrowDown,
   HiMiniShieldCheck,
 } from "react-icons/hi2";
-import { ApprovalProofInline } from "./approval-proof-inline";
+import { ApprovalProofInline, buildApprovalProofCredentials } from "./approval-proof-inline";
 import { ActionButton, Tag } from "./approval-center-primitives";
 import { GuardModalLayer } from "./guard-modal-layer";
 import type { GuardApprovalGatePublicConfig, PackageFirewallStatusResponse } from "./guard-types";
@@ -172,10 +172,7 @@ export function AuditRecoveryModal({
 
   const handleApprovalSubmit = useCallback(() => {
     setApprovalSubmitting(true);
-    onApprovalSubmit({
-      approval_password: approvalPassword,
-      ...(approvalGate?.totp_enabled === true ? { approval_totp_code: approvalTotpCode } : {}),
-    });
+    onApprovalSubmit(buildApprovalProofCredentials(approvalGate, { approvalPassword, approvalTotpCode }));
   }, [approvalGate, approvalPassword, approvalTotpCode, onApprovalSubmit]);
 
   return (