plugin-scanner 2.0.373__tar.gz → 2.0.375__tar.gz

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.373
+Version: 2.0.375
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.373"
+version = "2.0.375"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.373"
+version = "2.0.375"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/src/codex_plugin_scanner/guard/codex_app_server.py

@@ -6,10 +6,8 @@ import base64
 import hashlib
 import json
 import os
-import shutil
 import socket
 import struct
-import subprocess
 import tempfile
 import threading
 import time
@@ -132,6 +130,14 @@ def resume_codex_thread_for_request(
     thread_id = _first_string(metadata, ("codex_thread_id", "thread_id", "threadId", "session_id", "sessionId"))
     if thread_id is None:
         return None
+    if not _is_safe_codex_thread_id(thread_id):
+        return {
+            "status": "skipped",
+            "reason": "unsafe_thread_id",
+            "thread_id": thread_id,
+            "strategy": "codex-app-server-thread",
+            "supported": False,
+        }
     codex_home = _first_string(metadata, _CODEX_HOME_KEYS)
     socket_path = _first_string(metadata, _SOCKET_KEYS) or str(
         default_codex_app_server_socket_path(environ={"CODEX_HOME": codex_home or ""})
@@ -145,11 +151,17 @@ def resume_codex_thread_for_request(
     command_text = _first_string(metadata, _COMMAND_TEXT_KEYS)
     prompt = build_codex_continuation_prompt(action, request_id=request_id, command_text=command_text)
     if not Path(socket_path).expanduser().exists():
-        return _resume_codex_thread_with_cli(
-            metadata=metadata,
-            thread_id=thread_id,
-            prompt=prompt,
-        )
+        return {
+            "status": "failed",
+            "reason": "socket_not_available",
+            "thread_id": thread_id,
+            "strategy": "codex-app-server-thread",
+            "supported": True,
+            "message": (
+                "Codex App remote-control socket is unavailable. HOL Guard will not start `codex exec resume` "
+                "because that creates a separate background run instead of continuing the visible Codex chat."
+            ),
+        }
     request_payloads = [
         {
             "jsonrpc": "2.0",
@@ -284,102 +296,6 @@ def _send_codex_resume_worker(
         ready.set()
 
 
-def _resume_codex_thread_with_cli(
-    *,
-    metadata: Mapping[str, object],
-    thread_id: str,
-    prompt: str,
-) -> dict[str, object]:
-    """Resume a saved Codex exec thread when the live app-server socket is gone."""
-
-    if not _is_safe_codex_thread_id(thread_id):
-        return {
-            "status": "skipped",
-            "reason": "unsafe_thread_id",
-            "thread_id": thread_id,
-            "strategy": "codex-headless-exec",
-            "supported": False,
-        }
-    workspace = _first_string(metadata, _WORKSPACE_KEYS)
-    if workspace is None:
-        return {
-            "status": "skipped",
-            "reason": "workspace_not_available",
-            "thread_id": thread_id,
-            "strategy": "codex-headless-exec",
-            "supported": False,
-        }
-    workspace_path = Path(workspace).expanduser()
-    if not workspace_path.is_dir():
-        return {
-            "status": "skipped",
-            "reason": "workspace_not_available",
-            "thread_id": thread_id,
-            "strategy": "codex-headless-exec",
-            "supported": False,
-        }
-    codex_home = _first_string(metadata, _CODEX_HOME_KEYS)
-    if codex_home is not None and not Path(codex_home).expanduser().is_dir():
-        return {
-            "status": "skipped",
-            "reason": "codex_home_not_available",
-            "thread_id": thread_id,
-            "strategy": "codex-headless-exec",
-            "supported": False,
-        }
-    codex_binary = shutil.which("codex")
-    if codex_binary is None:
-        return {
-            "status": "skipped",
-            "reason": "codex_binary_not_found",
-            "thread_id": thread_id,
-            "strategy": "codex-headless-exec",
-            "supported": False,
-        }
-    command = [
-        codex_binary,
-        "exec",
-        "resume",
-        "--json",
-        "--skip-git-repo-check",
-    ]
-    model = _first_string(metadata, _MODEL_KEYS)
-    if model is not None and _is_safe_codex_model(model):
-        command.extend(["--model", model])
-    command.append("--")
-    command.extend([thread_id, prompt])
-    env = os.environ.copy()
-    if codex_home is not None:
-        env["CODEX_HOME"] = str(Path(codex_home).expanduser())
-    try:
-        process = subprocess.Popen(
-            command,
-            cwd=workspace_path,
-            env=env,
-            stdin=subprocess.DEVNULL,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            start_new_session=True,
-        )
-    except OSError as error:
-        return {
-            "status": "failed",
-            "reason": "headless_resume_launch_failed",
-            "last_error": str(error),
-            "thread_id": thread_id,
-            "strategy": "codex-headless-exec",
-            "supported": True,
-        }
-    return {
-        "status": "sent",
-        "reason": "headless_resume_started",
-        "thread_id": thread_id,
-        "strategy": "codex-headless-exec",
-        "supported": True,
-        "pid": process.pid,
-    }
-
-
 def _find_codex_operation_for_request(store: _OperationStore, request_id: str) -> dict[str, object] | None:
     operation = store.get_guard_operation_for_approval_request(request_id)
     if operation is not None and str(operation.get("harness")) == "codex":
@@ -632,15 +548,6 @@ def _is_safe_codex_thread_id(thread_id: str) -> bool:
     )
 
 
-def _is_safe_codex_model(model: str) -> bool:
-    return (
-        0 < len(model) <= 128
-        and not model.startswith("-")
-        and bool(model.strip())
-        and all(char.isalnum() or char in "-_.:" for char in model)
-    )
-
-
 def _first_string(payload: Mapping[str, object], keys: tuple[str, ...]) -> str | None:
     for key in keys:
         value = payload.get(key)

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/src/codex_plugin_scanner/guard/codex_resume.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import shutil
 from collections.abc import Mapping
 from datetime import datetime, timezone
 
@@ -163,24 +162,20 @@ def defer_request_resume_to_live_hook(
 
 
 def inspect_codex_resume_capabilities(store: GuardStore) -> dict[str, object]:
-    binary_path = shutil.which("codex")
     socket_available = default_codex_app_server_socket_available()
     latest_attempt = store.get_latest_request_resume(harness="codex")
     return {
-        "codex_binary_found": binary_path is not None,
+        "codex_binary_found": False,
         "app_server_support": socket_available,
         "app_server_support_reason": (
             "Same-chat continuation requires the Codex app-server remote-control socket. "
             "When the socket is missing, HOL Guard cannot visibly continue the open Codex App chat."
         ),
         "app_server_socket_available": socket_available,
-        "headless_resume_support": binary_path is not None,
+        "headless_resume_support": False,
         "headless_resume_support_reason": (
-            "When the live app-server socket is gone, HOL Guard resumes saved Codex exec threads with "
-            "`codex exec resume` from the original workspace. This is a background retry, not a visible "
-            "message in the open Codex App chat."
-            if binary_path is not None
-            else "`codex` was not found on PATH, so HOL Guard can only save the approval for manual retry."
+            "Disabled by design. `codex exec resume` starts a separate background run and does not continue "
+            "the visible Codex App chat. HOL Guard only auto-continues Codex through the app-server socket."
         ),
         "latest_attempt": latest_attempt,
     }
@@ -352,15 +347,7 @@ def _normalize_dispatch_result(
     raw_supported = raw_result.get("supported")
     supported = raw_supported if isinstance(raw_supported, bool) else raw_status != "skipped"
     if raw_status == "sent":
-        message = (
-            "HOL Guard sent Codex a continuation message in the original chat."
-            if effective_strategy != "codex-headless-exec"
-            else (
-                "HOL Guard started a background `codex exec resume` retry for this saved thread. "
-                "The command can complete in Codex history, but this open Codex App chat will not visibly "
-                "continue unless the Codex app-server remote-control socket is enabled."
-            )
-        )
+        message = "HOL Guard sent Codex a continuation message in the original chat."
         return {
             "status": "sent",
             "reason": raw_reason,

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -14681,13 +14681,6 @@ function buildCodexResumeUx(resume) {
     };
   }
   if (resume.status === "sent" || resume.status === "already_sent") {
-    if (resume.strategy === "codex-headless-exec" || resume.reason === "headless_resume_started") {
-      return {
-        headline: "Codex resumed in background.",
-        body: resume.message ?? "HOL Guard started a background Codex resume. This open Codex App chat may not visibly continue until Codex remote control is enabled.",
-        showRetry: false
-      };
-    }
     return {
       headline: "Codex chat notified.",
       body: resume.message ?? "HOL Guard sent Codex a continuation message in the original chat.",

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -2253,6 +2253,11 @@ def _cloud_runtime_session_payload(store: GuardStore, session: dict[str, object]
         workspace=workspace,
         generated_at=updated_at,
     )
+    local_identity = _cloud_local_identity_payload(
+        device_id,
+        daemon_version=_optional_string(session.get("client_version") or session.get("clientVersion")) or __version__,
+        observed_at=updated_at,
+    )
     return {
         "sessionId": session_id,
         "harness": _optional_string(session.get("harness")) or "hol-guard",
@@ -2264,7 +2269,8 @@ def _cloud_runtime_session_payload(store: GuardStore, session: dict[str, object]
         "clientVersion": _optional_string(session.get("client_version") or session.get("clientVersion")) or __version__,
         "deviceId": device_id,
         "deviceName": device_name,
-        "localIdentity": _cloud_local_identity_payload(device_id),
+        "localIdentity": local_identity,
+        "localIdentitySource": _cloud_local_identity_source_payload(local_identity),
         "packageManagerCoverage": package_manager_coverage,
         "workspace": workspace,
         "capabilities": capabilities,
@@ -2274,13 +2280,22 @@ def _cloud_runtime_session_payload(store: GuardStore, session: dict[str, object]
     }
 
 
-def _cloud_local_identity_payload(device_id: str) -> dict[str, object]:
+def _cloud_local_identity_payload(
+    device_id: str,
+    *,
+    daemon_version: str,
+    observed_at: str,
+) -> dict[str, object]:
     hostname = _safe_hostname()
     private_ip = _safe_private_ip()
+    if private_ip is None:
+        private_ip = _safe_private_ipv6()
     payload: dict[str, object] = {
         "daemonId": device_id,
+        "daemonVersion": daemon_version,
         "daemonStatus": "healthy",
         "relayState": "online",
+        "lastSyncedAt": observed_at,
     }
     if hostname is not None:
         payload["hostname"] = hostname
@@ -2290,6 +2305,24 @@ def _cloud_local_identity_payload(device_id: str) -> dict[str, object]:
     return payload
 
 
+def _cloud_local_identity_source_payload(local_identity: dict[str, object]) -> dict[str, str]:
+    source: dict[str, str] = {
+        "daemonId": "local-guard",
+        "daemonVersion": "local-guard",
+        "daemonStatus": "local-guard",
+        "relayState": "local-guard",
+    }
+    if "hostname" in local_identity:
+        source["hostname"] = "local-guard"
+    if "ipAddress" in local_identity:
+        source["ipAddress"] = "local-guard"
+    if "privateIpAddress" in local_identity:
+        source["privateIpAddress"] = "local-guard"
+    if "publicIpAddress" in local_identity:
+        source["publicIpAddress"] = "local-guard"
+    return source
+
+
 def _safe_hostname() -> str | None:
     with suppress(OSError):
         hostname = socket.gethostname().strip()
@@ -2311,6 +2344,16 @@ def _safe_private_ip() -> str | None:
     return None
 
 
+def _safe_private_ipv6() -> str | None:
+    with suppress(OSError):
+        addresses = socket.getaddrinfo(socket.gethostname(), None, socket.AF_INET6)
+        for entry in addresses:
+            candidate = entry[4][0]
+            if isinstance(candidate, str) and candidate and candidate != "::1":
+                return candidate[:128]
+    return None
+
+
 def _cloud_sync_receipt_fingerprint(receipt: dict[str, object]) -> str:
     encoded_receipt = json.dumps(receipt, sort_keys=True, separators=(",", ":"), default=str)
     return hashlib.sha256(encoded_receipt.encode("utf-8")).hexdigest()

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.373"
+__version__ = "2.0.375"

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/tests/test_guard_cloud_local_sync.py

@@ -679,8 +679,14 @@ def test_sync_runtime_session_emits_package_manager_coverage_payload(
     assert session_payload["deviceId"] == store.get_or_create_installation_id()
     assert session_payload["deviceName"] == store.get_device_metadata()["device_label"]
     assert session_payload["localIdentity"]["daemonId"] == store.get_or_create_installation_id()
+    assert session_payload["localIdentity"]["daemonVersion"] == guard_runner_module.__version__
     assert session_payload["localIdentity"]["daemonStatus"] == "healthy"
     assert session_payload["localIdentity"]["relayState"] == "online"
+    assert session_payload["localIdentity"]["lastSyncedAt"] == "2026-04-24T00:01:00+00:00"
+    assert session_payload["localIdentitySource"]["daemonId"] == "local-guard"
+    assert session_payload["localIdentitySource"]["daemonVersion"] == "local-guard"
+    assert session_payload["localIdentitySource"]["daemonStatus"] == "local-guard"
+    assert session_payload["localIdentitySource"]["relayState"] == "local-guard"
     assert session_payload["packageManagerCoverage"] == {
         "generatedAt": "2026-04-24T00:01:00+00:00",
         "configuredManagers": ["npm"],
@@ -694,3 +700,105 @@ def test_sync_runtime_session_emits_package_manager_coverage_payload(
             "nextRefreshAt": "2026-04-24T00:15:00+00:00",
         },
     }
+
+
+def test_sync_runtime_session_prefers_ipv6_private_identity_when_ipv4_unavailable(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "token-ipv6",
+        "2026-04-24T00:00:00+00:00",
+        workspace_id="workspace-alpha",
+    )
+    monkeypatch.setattr(guard_runner_module, "_safe_private_ip", lambda: None)
+    monkeypatch.setattr(guard_runner_module, "_safe_private_ipv6", lambda: "fd00::42")
+    captured_body: dict[str, object] = {}
+
+    def _runtime_sync_response(**kwargs):
+        request = kwargs["request"]
+        captured_body.update(json.loads(request.data.decode("utf-8")))
+        return {"syncedAt": "2026-04-24T00:01:00+00:00", "items": []}
+
+    monkeypatch.setattr(
+        guard_runner_module,
+        "_urlopen_json_with_timeout_retry",
+        _runtime_sync_response,
+    )
+
+    guard_runner_module.sync_runtime_session(
+        store,
+        session={
+            "harness": "codex",
+            "surface": "cli",
+            "status": "active",
+            "updatedAt": "2026-04-24T00:01:00+00:00",
+            "workspace": str(tmp_path / "workspace"),
+        },
+    )
+
+    session_payload = captured_body["session"]
+    assert isinstance(session_payload, dict)
+    assert session_payload["localIdentity"]["ipAddress"] == "fd00::42"
+    assert session_payload["localIdentity"]["privateIpAddress"] == "fd00::42"
+    assert session_payload["localIdentitySource"]["privateIpAddress"] == "local-guard"
+
+
+def test_sync_runtime_session_keeps_local_identity_when_package_coverage_missing(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "token-no-coverage",
+        "2026-04-24T00:00:00+00:00",
+        workspace_id="workspace-alpha",
+    )
+    monkeypatch.setattr(
+        guard_runner_module,
+        "package_shim_cloud_coverage",
+        lambda *_args, **_kwargs: {
+            "generatedAt": "2026-04-24T00:01:00+00:00",
+            "configuredManagers": [],
+            "protectedManagers": [],
+            "missingManagers": [],
+            "pathActive": False,
+            "bypasses": [],
+            "staleIntel": {
+                "status": "unknown",
+                "lastSyncedAt": None,
+                "nextRefreshAt": None,
+            },
+        },
+    )
+    captured_body: dict[str, object] = {}
+
+    def _runtime_sync_response(**kwargs):
+        request = kwargs["request"]
+        captured_body.update(json.loads(request.data.decode("utf-8")))
+        return {"syncedAt": "2026-04-24T00:01:00+00:00", "items": []}
+
+    monkeypatch.setattr(
+        guard_runner_module,
+        "_urlopen_json_with_timeout_retry",
+        _runtime_sync_response,
+    )
+
+    guard_runner_module.sync_runtime_session(
+        store,
+        session={
+            "harness": "codex",
+            "surface": "cli",
+            "status": "active",
+            "updatedAt": "2026-04-24T00:01:00+00:00",
+            "workspace": str(tmp_path / "workspace"),
+        },
+    )
+
+    session_payload = captured_body["session"]
+    assert isinstance(session_payload, dict)
+    assert session_payload["localIdentity"]["daemonId"] == store.get_or_create_installation_id()
+    assert session_payload["localIdentitySource"]["daemonId"] == "local-guard"

{plugin_scanner-2.0.373 → plugin_scanner-2.0.375}/tests/test_guard_codex_resume_commands.py

@@ -9,17 +9,10 @@ import pytest
 
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import codex_app_server as codex_app_server_module
-from codex_plugin_scanner.guard import codex_resume as codex_resume_module
 from codex_plugin_scanner.guard.models import GuardApprovalRequest
 from codex_plugin_scanner.guard.store import GuardStore
 
 
-def _stub_codex_binary(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(
-        codex_resume_module.shutil, "which", lambda command: "/usr/bin/codex" if command == "codex" else None
-    )
-
-
 def _request(request_id: str) -> GuardApprovalRequest:
     return GuardApprovalRequest(
         request_id=request_id,
@@ -231,37 +224,33 @@ def test_guard_doctor_codex_reports_resume_diagnostics(
     output = json.loads(capsys.readouterr().out)
 
     assert rc == 0
-    assert output["codex_resume"]["codex_binary_found"] in {True, False}
+    assert output["codex_resume"]["codex_binary_found"] is False
     assert output["codex_resume"]["app_server_support"] in {True, False}
     assert "remote-control socket" in output["codex_resume"]["app_server_support_reason"]
     assert output["codex_resume"]["app_server_socket_available"] in {True, False}
-    assert output["codex_resume"]["headless_resume_support"] in {True, False}
-    assert "codex exec resume" in output["codex_resume"]["headless_resume_support_reason"] or (
-        "codex` was not found" in output["codex_resume"]["headless_resume_support_reason"]
-    )
+    assert output["codex_resume"]["headless_resume_support"] is False
+    assert "Disabled by design" in output["codex_resume"]["headless_resume_support_reason"]
     assert output["codex_resume"]["latest_attempt"] is None
 
 
-def test_guard_doctor_codex_reports_app_server_support_from_codex_binary(
+def test_guard_doctor_codex_reports_headless_resume_disabled(
     tmp_path: Path,
     capsys: pytest.CaptureFixture[str],
-    monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     home_dir = tmp_path / "home"
     guard_home = tmp_path / "guard-home"
     GuardStore(guard_home)
-    _stub_codex_binary(monkeypatch)
 
     rc = main(["guard", "doctor", "codex", "--home", str(home_dir), "--guard-home", str(guard_home), "--json"])
     output = json.loads(capsys.readouterr().out)
 
     assert rc == 0
-    assert output["codex_resume"]["codex_binary_found"] is True
+    assert output["codex_resume"]["codex_binary_found"] is False
     assert output["codex_resume"]["app_server_support"] in {True, False}
     assert "remote-control socket" in output["codex_resume"]["app_server_support_reason"]
     assert output["codex_resume"]["app_server_socket_available"] in {True, False}
-    assert output["codex_resume"]["headless_resume_support"] is True
-    assert "codex exec resume" in output["codex_resume"]["headless_resume_support_reason"]
+    assert output["codex_resume"]["headless_resume_support"] is False
+    assert "does not continue the visible Codex App chat" in output["codex_resume"]["headless_resume_support_reason"]
     assert "remote_control_support" not in output["codex_resume"]
 
 
@@ -296,31 +285,14 @@ def test_guard_approvals_resume_rejects_unsafe_headless_thread_id(
     assert rc == 0
     assert output["status"] == "skipped"
     assert output["reason"] == "unsafe_thread_id"
-    assert output["strategy"] == "codex-headless-exec"
+    assert output["strategy"] == "codex-app-server-thread"
     assert "retry the same request" in output["message"]
 
 
-def test_guard_approvals_resume_starts_headless_codex_when_app_server_unavailable(
+def test_guard_approvals_resume_requires_app_server_when_socket_unavailable(
     tmp_path: Path,
     capsys: pytest.CaptureFixture[str],
-    monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    launched: list[dict[str, object]] = []
-
-    class _FakeProcess:
-        pid = 4455
-
-    def _fake_popen(command, **kwargs):
-        launched.append({"command": command, **kwargs})
-        return _FakeProcess()
-
-    monkeypatch.setattr(
-        codex_app_server_module.shutil,
-        "which",
-        lambda command: "/usr/local/bin/codex" if command == "codex" else None,
-    )
-    monkeypatch.setattr(codex_app_server_module.subprocess, "Popen", _fake_popen)
-
     home_dir = tmp_path / "guard-home"
     workspace = tmp_path / "workspace"
     codex_home = tmp_path / "codex-home"
@@ -347,35 +319,16 @@ def test_guard_approvals_resume_starts_headless_codex_when_app_server_unavailabl
     output = json.loads(capsys.readouterr().out)
 
     assert rc == 0
-    assert output["status"] == "sent"
-    assert output["reason"] == "headless_resume_started"
-    assert output["strategy"] == "codex-headless-exec"
-    assert "background" in output["message"]
-    assert "open Codex App chat" in output["message"]
-    assert len(launched) == 1
-    assert launched[0]["cwd"] == workspace
-    assert launched[0]["command"][:5] == ["/usr/local/bin/codex", "exec", "resume", "--json", "--skip-git-repo-check"]
-    assert "--" in launched[0]["command"]
-    assert "thread-1" in launched[0]["command"]
-    assert launched[0]["env"]["CODEX_HOME"] == str(codex_home)
+    assert output["status"] == "failed"
+    assert output["reason"] == "socket_not_available"
+    assert output["strategy"] == "codex-app-server-thread"
+    assert "original chat" in output["message"]
 
 
 def test_guard_approvals_resume_does_not_start_headless_codex_for_blocked_request(
     tmp_path: Path,
     capsys: pytest.CaptureFixture[str],
-    monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    monkeypatch.setattr(
-        codex_app_server_module.shutil,
-        "which",
-        lambda command: "/usr/local/bin/codex" if command == "codex" else None,
-    )
-    monkeypatch.setattr(
-        codex_app_server_module.subprocess,
-        "Popen",
-        lambda *_args, **_kwargs: pytest.fail("blocked requests must not start codex exec resume"),
-    )
-
     home_dir = tmp_path / "guard-home"
     workspace = tmp_path / "workspace"
     codex_home = tmp_path / "codex-home"
@@ -408,13 +361,10 @@ def test_guard_approvals_resume_does_not_start_headless_codex_for_blocked_reques
     assert "blocked this Codex request" in output["message"]
 
 
-def test_guard_approvals_resume_reports_missing_codex_home_without_spawning(
+def test_guard_approvals_resume_reports_missing_app_server_without_spawning(
     tmp_path: Path,
     capsys: pytest.CaptureFixture[str],
-    monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    monkeypatch.setattr(codex_app_server_module.subprocess, "Popen", lambda *_args, **_kwargs: pytest.fail("no spawn"))
-
     home_dir = tmp_path / "guard-home"
     workspace = tmp_path / "workspace"
     workspace.mkdir()
@@ -439,6 +389,6 @@ def test_guard_approvals_resume_reports_missing_codex_home_without_spawning(
     output = json.loads(capsys.readouterr().out)
 
     assert rc == 0
-    assert output["status"] == "skipped"
-    assert output["reason"] == "codex_home_not_available"
-    assert output["strategy"] == "codex-headless-exec"
+    assert output["status"] == "failed"
+    assert output["reason"] == "socket_not_available"
+    assert output["strategy"] == "codex-app-server-thread"