plugin-scanner 2.0.374__tar.gz → 2.0.376__tar.gz

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.374
+Version: 2.0.376
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.374"
+version = "2.0.376"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.374"
+version = "2.0.376"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/guard/adapters/codex.py

@@ -178,58 +178,40 @@ def _hook_command(context: HarnessContext) -> str:
     return shlex.join(_hook_command_parts(context))
 
 
+def _managed_hook_entry(context: HarnessContext, status_message: str) -> dict[str, object]:
+    return {
+        "type": "command",
+        "command": _hook_command(context),
+        "timeout": 30,
+        "statusMessage": status_message,
+        "env": merge_guard_launcher_env(pin_package=True),
+    }
+
+
 def _pre_tool_hook_group(context: HarnessContext) -> dict[str, object]:
     return {
         "matcher": _CODEX_GUARD_TOOL_MATCHER,
-        "hooks": [
-            {
-                "type": "command",
-                "command": _hook_command(context),
-                "timeout": 30,
-                "statusMessage": _MANAGED_HOOK_STATUS_MESSAGE,
-            }
-        ],
+        "hooks": [_managed_hook_entry(context, _MANAGED_HOOK_STATUS_MESSAGE)],
     }
 
 
 def _prompt_hook_group(context: HarnessContext) -> dict[str, object]:
     return {
-        "hooks": [
-            {
-                "type": "command",
-                "command": _hook_command(context),
-                "timeout": 30,
-                "statusMessage": _MANAGED_PROMPT_HOOK_STATUS_MESSAGE,
-            }
-        ],
+        "hooks": [_managed_hook_entry(context, _MANAGED_PROMPT_HOOK_STATUS_MESSAGE)],
     }
 
 
 def _permission_request_hook_group(context: HarnessContext) -> dict[str, object]:
     return {
         "matcher": _CODEX_GUARD_PERMISSION_MATCHER,
-        "hooks": [
-            {
-                "type": "command",
-                "command": _hook_command(context),
-                "timeout": 30,
-                "statusMessage": _MANAGED_PERMISSION_HOOK_STATUS_MESSAGE,
-            }
-        ],
+        "hooks": [_managed_hook_entry(context, _MANAGED_PERMISSION_HOOK_STATUS_MESSAGE)],
     }
 
 
 def _post_tool_hook_group(context: HarnessContext) -> dict[str, object]:
     return {
         "matcher": "Bash",
-        "hooks": [
-            {
-                "type": "command",
-                "command": _hook_command(context),
-                "timeout": 30,
-                "statusMessage": _MANAGED_POST_TOOL_HOOK_STATUS_MESSAGE,
-            }
-        ],
+        "hooks": [_managed_hook_entry(context, _MANAGED_POST_TOOL_HOOK_STATUS_MESSAGE)],
     }
 
 

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/guard/cli/install_commands.py

@@ -119,6 +119,11 @@ def build_harness_setup_plan(
         "steps": [step.to_dict() for step in steps],
         "workspace": str(context.workspace_dir) if context.workspace_dir is not None else None,
     }
+    if dry_run and action in {"connect", "repair"}:
+        payload["dry_run_effect"] = (
+            "No app config was changed and Guard Cloud was not connected. "
+            f"Run hol-guard apps {action} {adapter.harness} without --dry-run to finish setup."
+        )
     if action == "uninstall":
         confirmation_phrase = uninstall_confirmation_token(adapter.harness)
         payload["confirmation_phrase"] = confirmation_phrase

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/guard/cli/render.py

@@ -837,6 +837,9 @@ def _render_apps(console: Console, payload: dict[str, object]) -> None:
         _render_managed_install(console, payload)
     else:
         _render_fallback(console, payload)
+    dry_run_effect = payload.get("dry_run_effect")
+    if isinstance(dry_run_effect, str) and dry_run_effect:
+        console.print(Panel(dry_run_effect, title="Dry run", border_style="yellow"))
     cloud_app = payload.get("cloud_app")
     if not isinstance(cloud_app, dict):
         return

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -1120,23 +1120,34 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 harness=adapter.harness,
                 action_path=token_action_path,
                 handoff_token=handoff_token,
+                auto_start=True,
                 include_dashboard_session_token=True,
                 local_origin=local_origin,
                 workspace_id=self._optional_string(decoded.get("workspace_id")) or "",
             )
             return
-        if action_path in _CLOUD_APP_HANDOFF_ACTIONS and self._cloud_app_handoff_navigation_is_allowed():
+        is_document_navigation = self._browser_document_navigation_is_allowed()
+        is_hosted_referrer = self._hosted_dashboard_referrer_is_allowed()
+        workspace_id = self._optional_string(handoff_query.get("workspaceId", [None])[-1]) or ""
+        self._apply_cloud_app_sync_credentials(
+            sync_url=self._optional_string(handoff_query.get("syncUrl", [None])[-1]),
+            sync_token=self._optional_string(handoff_query.get("syncToken", [None])[-1]),
+            workspace_id=self._optional_string(handoff_query.get("syncWorkspaceId", [None])[-1]) or workspace_id,
+        )
+        navigation_allowed = is_hosted_referrer or is_document_navigation
+        if action_path in _CLOUD_APP_HANDOFF_ACTIONS and (navigation_allowed or workspace_id):
             self._write_cloud_app_handoff_page(
                 harness=adapter.harness,
                 action_path=action_path,
                 handoff_token=self._cloud_app_handoff_token(
                     harness=adapter.harness,
                     action_path=action_path,
-                    workspace_id=self._optional_string(handoff_query.get("workspaceId", [None])[-1]) or "",
+                    workspace_id=workspace_id,
                 ),
-                include_dashboard_session_token=False,
+                auto_start=navigation_allowed,
+                include_dashboard_session_token=is_document_navigation or not navigation_allowed,
                 local_origin=local_origin,
-                workspace_id=self._optional_string(handoff_query.get("workspaceId", [None])[-1]) or "",
+                workspace_id=workspace_id,
             )
             return
         cloud_params: dict[str, str] = {"guardDaemon": local_origin}
@@ -1163,6 +1174,17 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             or self._optional_string(payload.get("workspaceId"))
             or ""
         )
+        self._apply_cloud_app_sync_credentials(
+            sync_url=self._optional_string(payload.get("sync_url")) or self._optional_string(payload.get("syncUrl")),
+            sync_token=(
+                self._optional_string(payload.get("sync_token")) or self._optional_string(payload.get("syncToken"))
+            ),
+            workspace_id=(
+                self._optional_string(payload.get("sync_workspace_id"))
+                or self._optional_string(payload.get("syncWorkspaceId"))
+                or workspace_id
+            ),
+        )
         local_origin = self._local_daemon_origin()
         handoff_token = self._cloud_app_handoff_token(
             harness=adapter.harness,
@@ -1184,6 +1206,26 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             },
         )
 
+    def _apply_cloud_app_sync_credentials(
+        self,
+        *,
+        sync_url: str | None,
+        sync_token: str | None,
+        workspace_id: str,
+    ) -> None:
+        if sync_url is None or sync_token is None or not workspace_id:
+            return
+        parsed = urlparse(sync_url)
+        sync_origin = f"{parsed.scheme}://{parsed.netloc}"
+        if sync_origin not in _HOSTED_GUARD_DASHBOARD_ORIGINS or not parsed.path.endswith("/api/guard/receipts/sync"):
+            return
+        self.server.store.set_sync_credentials(  # type: ignore[attr-defined]
+            sync_url=sync_url,
+            token=sync_token,
+            now=_now(),
+            workspace_id=workspace_id,
+        )
+
     def _cloud_app_handoff_token(
         self,
         *,
@@ -1250,6 +1292,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         harness: str,
         action_path: str,
         handoff_token: str,
+        auto_start: bool,
         include_dashboard_session_token: bool,
         local_origin: str,
         workspace_id: str,
@@ -1263,6 +1306,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             "localOrigin": local_origin,
             "operation": operation,
             "redirectBase": redirect_base,
+            "autoStart": auto_start,
             "workspaceId": workspace_id,
         }
         success_fragment_args = ""
@@ -1333,6 +1377,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
       padding: 14px 18px;
     }}
     button:disabled {{ cursor: wait; opacity: .72; }}
+    button[hidden] {{ display: none; }}
   </style>
 </head>
 <body>
@@ -1344,11 +1389,14 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
       then it will return you to HOL Cloud.
     </p>
     <div id="status" class="status">Starting local Guard setup...</div>
+    <button id="continue" type="button" disabled>Continue setup</button>
   </main>
   <script id="guard-handoff-data" type="application/json">{script_payload}</script>
   <script>
     const data = JSON.parse(document.getElementById('guard-handoff-data').textContent);
     const statusNode = document.getElementById('status');
+    const continueButton = document.getElementById('continue');
+    window.history.replaceState(null, '', `${{data.localOrigin}}/v1/apps/${{data.harness}}/cloud`);
     const finish = (params, fragmentOnlyParams = {{}}) => {{
       const query = new URLSearchParams(params);
       const fragment = new URLSearchParams(params);
@@ -1405,7 +1453,17 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         fail(error instanceof Error ? error.message : 'Local Guard setup failed');
       }}
     }};
-    completeSetup();
+    if (data.autoStart) {{
+      continueButton.hidden = true;
+      completeSetup();
+    }} else {{
+      statusNode.textContent = 'Ready to connect this browser to local Guard.';
+      continueButton.disabled = false;
+      continueButton.addEventListener('click', () => {{
+        continueButton.disabled = true;
+        completeSetup();
+      }}, {{ once: true }});
+    }}
   </script>
 </body>
 </html>"""
@@ -1436,8 +1494,15 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         signature = _dashboard_session_signature(payload, self.server.auth_token)  # type: ignore[attr-defined]
         return f"gld1.{payload}.{signature}"
 
-    def _cloud_app_handoff_navigation_is_allowed(self) -> bool:
-        return self._hosted_dashboard_referrer_is_allowed()
+    def _browser_document_navigation_is_allowed(self) -> bool:
+        fetch_mode = (self.headers.get("Sec-Fetch-Mode") or "").strip().lower()
+        fetch_dest = (self.headers.get("Sec-Fetch-Dest") or "").strip().lower()
+        fetch_site = (self.headers.get("Sec-Fetch-Site") or "").strip().lower()
+        return (
+            fetch_mode == "navigate"
+            and fetch_dest in {"document", ""}
+            and fetch_site in {"cross-site", "same-site", "none", ""}
+        )
 
     def _hosted_dashboard_referrer_is_allowed(self) -> bool:
         referrer = self.headers.get("Referer")

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/guard/launcher.py

@@ -7,11 +7,15 @@ from collections.abc import Mapping
 from pathlib import Path
 
 
-def merge_guard_launcher_env(env: Mapping[str, str] | None = None) -> dict[str, str]:
-    """Preserve launcher import context when Guard is invoked from source checkouts."""
+def merge_guard_launcher_env(env: Mapping[str, str] | None = None, *, pin_package: bool = False) -> dict[str, str]:
+    """Preserve launcher import context while optionally pinning the current package."""
 
     merged: dict[str, str] = {}
-    pythonpath = _normalize_launcher_pythonpath(os.environ.get("PYTHONPATH"))
+    pythonpath = (
+        str(Path(__file__).resolve().parents[2])
+        if pin_package
+        else _normalize_launcher_pythonpath(os.environ.get("PYTHONPATH"))
+    )
     if pythonpath:
         merged["PYTHONPATH"] = pythonpath
     if env is None:

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -2253,6 +2253,11 @@ def _cloud_runtime_session_payload(store: GuardStore, session: dict[str, object]
         workspace=workspace,
         generated_at=updated_at,
     )
+    local_identity = _cloud_local_identity_payload(
+        device_id,
+        daemon_version=_optional_string(session.get("client_version") or session.get("clientVersion")) or __version__,
+        observed_at=updated_at,
+    )
     return {
         "sessionId": session_id,
         "harness": _optional_string(session.get("harness")) or "hol-guard",
@@ -2264,7 +2269,8 @@ def _cloud_runtime_session_payload(store: GuardStore, session: dict[str, object]
         "clientVersion": _optional_string(session.get("client_version") or session.get("clientVersion")) or __version__,
         "deviceId": device_id,
         "deviceName": device_name,
-        "localIdentity": _cloud_local_identity_payload(device_id),
+        "localIdentity": local_identity,
+        "localIdentitySource": _cloud_local_identity_source_payload(local_identity),
         "packageManagerCoverage": package_manager_coverage,
         "workspace": workspace,
         "capabilities": capabilities,
@@ -2274,13 +2280,22 @@ def _cloud_runtime_session_payload(store: GuardStore, session: dict[str, object]
     }
 
 
-def _cloud_local_identity_payload(device_id: str) -> dict[str, object]:
+def _cloud_local_identity_payload(
+    device_id: str,
+    *,
+    daemon_version: str,
+    observed_at: str,
+) -> dict[str, object]:
     hostname = _safe_hostname()
     private_ip = _safe_private_ip()
+    if private_ip is None:
+        private_ip = _safe_private_ipv6()
     payload: dict[str, object] = {
         "daemonId": device_id,
+        "daemonVersion": daemon_version,
         "daemonStatus": "healthy",
         "relayState": "online",
+        "lastSyncedAt": observed_at,
     }
     if hostname is not None:
         payload["hostname"] = hostname
@@ -2290,6 +2305,24 @@ def _cloud_local_identity_payload(device_id: str) -> dict[str, object]:
     return payload
 
 
+def _cloud_local_identity_source_payload(local_identity: dict[str, object]) -> dict[str, str]:
+    source: dict[str, str] = {
+        "daemonId": "local-guard",
+        "daemonVersion": "local-guard",
+        "daemonStatus": "local-guard",
+        "relayState": "local-guard",
+    }
+    if "hostname" in local_identity:
+        source["hostname"] = "local-guard"
+    if "ipAddress" in local_identity:
+        source["ipAddress"] = "local-guard"
+    if "privateIpAddress" in local_identity:
+        source["privateIpAddress"] = "local-guard"
+    if "publicIpAddress" in local_identity:
+        source["publicIpAddress"] = "local-guard"
+    return source
+
+
 def _safe_hostname() -> str | None:
     with suppress(OSError):
         hostname = socket.gethostname().strip()
@@ -2311,6 +2344,16 @@ def _safe_private_ip() -> str | None:
     return None
 
 
+def _safe_private_ipv6() -> str | None:
+    with suppress(OSError):
+        addresses = socket.getaddrinfo(socket.gethostname(), None, socket.AF_INET6)
+        for entry in addresses:
+            candidate = entry[4][0]
+            if isinstance(candidate, str) and candidate and candidate != "::1":
+                return candidate[:128]
+    return None
+
+
 def _cloud_sync_receipt_fingerprint(receipt: dict[str, object]) -> str:
     encoded_receipt = json.dumps(receipt, sort_keys=True, separators=(",", ":"), default=str)
     return hashlib.sha256(encoded_receipt.encode("utf-8")).hexdigest()

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.374"
+__version__ = "2.0.376"

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/tests/test_guard_cloud_local_sync.py

@@ -679,8 +679,14 @@ def test_sync_runtime_session_emits_package_manager_coverage_payload(
     assert session_payload["deviceId"] == store.get_or_create_installation_id()
     assert session_payload["deviceName"] == store.get_device_metadata()["device_label"]
     assert session_payload["localIdentity"]["daemonId"] == store.get_or_create_installation_id()
+    assert session_payload["localIdentity"]["daemonVersion"] == guard_runner_module.__version__
     assert session_payload["localIdentity"]["daemonStatus"] == "healthy"
     assert session_payload["localIdentity"]["relayState"] == "online"
+    assert session_payload["localIdentity"]["lastSyncedAt"] == "2026-04-24T00:01:00+00:00"
+    assert session_payload["localIdentitySource"]["daemonId"] == "local-guard"
+    assert session_payload["localIdentitySource"]["daemonVersion"] == "local-guard"
+    assert session_payload["localIdentitySource"]["daemonStatus"] == "local-guard"
+    assert session_payload["localIdentitySource"]["relayState"] == "local-guard"
     assert session_payload["packageManagerCoverage"] == {
         "generatedAt": "2026-04-24T00:01:00+00:00",
         "configuredManagers": ["npm"],
@@ -694,3 +700,105 @@ def test_sync_runtime_session_emits_package_manager_coverage_payload(
             "nextRefreshAt": "2026-04-24T00:15:00+00:00",
         },
     }
+
+
+def test_sync_runtime_session_prefers_ipv6_private_identity_when_ipv4_unavailable(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "token-ipv6",
+        "2026-04-24T00:00:00+00:00",
+        workspace_id="workspace-alpha",
+    )
+    monkeypatch.setattr(guard_runner_module, "_safe_private_ip", lambda: None)
+    monkeypatch.setattr(guard_runner_module, "_safe_private_ipv6", lambda: "fd00::42")
+    captured_body: dict[str, object] = {}
+
+    def _runtime_sync_response(**kwargs):
+        request = kwargs["request"]
+        captured_body.update(json.loads(request.data.decode("utf-8")))
+        return {"syncedAt": "2026-04-24T00:01:00+00:00", "items": []}
+
+    monkeypatch.setattr(
+        guard_runner_module,
+        "_urlopen_json_with_timeout_retry",
+        _runtime_sync_response,
+    )
+
+    guard_runner_module.sync_runtime_session(
+        store,
+        session={
+            "harness": "codex",
+            "surface": "cli",
+            "status": "active",
+            "updatedAt": "2026-04-24T00:01:00+00:00",
+            "workspace": str(tmp_path / "workspace"),
+        },
+    )
+
+    session_payload = captured_body["session"]
+    assert isinstance(session_payload, dict)
+    assert session_payload["localIdentity"]["ipAddress"] == "fd00::42"
+    assert session_payload["localIdentity"]["privateIpAddress"] == "fd00::42"
+    assert session_payload["localIdentitySource"]["privateIpAddress"] == "local-guard"
+
+
+def test_sync_runtime_session_keeps_local_identity_when_package_coverage_missing(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "token-no-coverage",
+        "2026-04-24T00:00:00+00:00",
+        workspace_id="workspace-alpha",
+    )
+    monkeypatch.setattr(
+        guard_runner_module,
+        "package_shim_cloud_coverage",
+        lambda *_args, **_kwargs: {
+            "generatedAt": "2026-04-24T00:01:00+00:00",
+            "configuredManagers": [],
+            "protectedManagers": [],
+            "missingManagers": [],
+            "pathActive": False,
+            "bypasses": [],
+            "staleIntel": {
+                "status": "unknown",
+                "lastSyncedAt": None,
+                "nextRefreshAt": None,
+            },
+        },
+    )
+    captured_body: dict[str, object] = {}
+
+    def _runtime_sync_response(**kwargs):
+        request = kwargs["request"]
+        captured_body.update(json.loads(request.data.decode("utf-8")))
+        return {"syncedAt": "2026-04-24T00:01:00+00:00", "items": []}
+
+    monkeypatch.setattr(
+        guard_runner_module,
+        "_urlopen_json_with_timeout_retry",
+        _runtime_sync_response,
+    )
+
+    guard_runner_module.sync_runtime_session(
+        store,
+        session={
+            "harness": "codex",
+            "surface": "cli",
+            "status": "active",
+            "updatedAt": "2026-04-24T00:01:00+00:00",
+            "workspace": str(tmp_path / "workspace"),
+        },
+    )
+
+    session_payload = captured_body["session"]
+    assert isinstance(session_payload, dict)
+    assert session_payload["localIdentity"]["daemonId"] == store.get_or_create_installation_id()
+    assert session_payload["localIdentitySource"]["daemonId"] == "local-guard"

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/tests/test_guard_codex_install.py

@@ -74,9 +74,11 @@ def test_guard_codex_hook_command_does_not_pin_custom_guard_home_in_real_global_
     assert str(stale_guard_home) not in command
 
 
-def test_guard_install_codex_rewrites_workspace_config_with_proxy_entries(tmp_path, capsys):
+def test_guard_install_codex_rewrites_workspace_config_with_proxy_entries(tmp_path, capsys, monkeypatch):
     home_dir = tmp_path / "home"
     workspace_dir = tmp_path / "workspace"
+    source_root = str(Path(__file__).resolve().parents[1] / "src")
+    monkeypatch.setenv("PYTHONPATH", str(tmp_path / "stale-site-packages"))
     _build_guard_fixture(home_dir, workspace_dir)
 
     rc = main(
@@ -136,16 +138,19 @@ def test_guard_install_codex_rewrites_workspace_config_with_proxy_entries(tmp_pa
     assert "codex_plugin_scanner.cli" in prompt_handler["command"]
     assert "hook" in prompt_handler["command"]
     assert "codex" in prompt_handler["command"]
+    assert prompt_handler["env"]["PYTHONPATH"] == source_root
     handler = hooks_payload["PreToolUse"][0]["hooks"][0]
     assert handler["type"] == "command"
     assert "codex_plugin_scanner.cli" in handler["command"]
     assert "hook" in handler["command"]
     assert "codex" in handler["command"]
+    assert handler["env"]["PYTHONPATH"] == source_root
     permission_handler = hooks_payload["PermissionRequest"][0]["hooks"][0]
     assert permission_handler["type"] == "command"
     assert "codex_plugin_scanner.cli" in permission_handler["command"]
     assert "hook" in permission_handler["command"]
     assert "codex" in permission_handler["command"]
+    assert permission_handler["env"]["PYTHONPATH"] == source_root
     zshenv_text = (home_dir / ".zshenv").read_text(encoding="utf-8")
     shell_guard_text = (home_dir / "managed" / "codex" / "codex-zshenv-guard.zsh").read_text(encoding="utf-8")
     bash_guard_text = (home_dir / "managed" / "codex" / "codex-bashenv-guard.bash").read_text(encoding="utf-8")

{plugin_scanner-2.0.374 → plugin_scanner-2.0.376}/tests/test_guard_harness_setup.py

@@ -301,6 +301,32 @@ def test_apps_test_alias_uses_safe_verification(tmp_path: Path, capsys: pytest.C
     assert payload["verification"]["writes_config"] is False
 
 
+def test_apps_repair_dry_run_explains_that_cloud_is_not_connected(
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    args = argparse.Namespace(
+        guard_command="apps",
+        apps_command="repair",
+        harness="codex",
+        dry_run=True,
+        home=str(tmp_path / "home"),
+        guard_home=str(tmp_path / "guard-home"),
+        workspace=str(tmp_path / "workspace"),
+        json=True,
+    )
+
+    exit_code = run_guard_command(args)
+
+    assert exit_code == 0
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["dry_run"] is True
+    assert payload["dry_run_effect"] == (
+        "No app config was changed and Guard Cloud was not connected. "
+        "Run hol-guard apps repair codex without --dry-run to finish setup."
+    )
+
+
 def test_apps_subcommand_preserves_parent_flags(tmp_path: Path) -> None:
     parser = argparse.ArgumentParser()
     add_guard_root_parser(parser)