plugin-scanner 2.0.710__tar.gz → 2.0.712__tar.gz

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.710
+Version: 2.0.712
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.710"
+version = "2.0.712"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.710"
+version = "2.0.712"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/ecosystems/opencode.py

@@ -70,6 +70,16 @@ def _strip_jsonc(text: str) -> str:
     return "".join(output)
 
 
+def _parse_opencode_config_text(text: str) -> tuple[dict[str, object] | None, str | None]:
+    try:
+        payload = json.loads(text)
+    except json.JSONDecodeError:
+        return None, "invalid-json"
+    if isinstance(payload, dict):
+        return payload, None
+    return None, "not-object"
+
+
 def _load_json_or_jsonc(path: Path) -> tuple[dict[str, object], bool, str | None]:
     try:
         text = path.read_text(encoding="utf-8")
@@ -79,15 +89,19 @@ def _load_json_or_jsonc(path: Path) -> tuple[dict[str, object], bool, str | None
         return {}, True, "permission-denied"
     except OSError:
         return {}, True, "read-error"
-    if path.suffix == ".jsonc":
+    has_comments = "//" in text or "/*" in text
+    if path.suffix == ".jsonc" and has_comments:
         text = _strip_jsonc(text)
-    try:
-        payload = json.loads(text)
-        if isinstance(payload, dict):
-            return payload, False, None
-    except json.JSONDecodeError:
-        return {}, True, "invalid-json"
-    return {}, True, "not-object"
+    parsed, parse_reason = _parse_opencode_config_text(text)
+    if parsed is not None:
+        return parsed, False, None
+    if path.suffix != ".jsonc" and has_comments:
+        stripped = _strip_jsonc(text)
+        if stripped != text:
+            parsed, parse_reason = _parse_opencode_config_text(stripped)
+            if parsed is not None:
+                return parsed, False, None
+    return {}, True, parse_reason or "invalid-json"
 
 
 class OpenCodeAdapter:

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/adapters/mcp_servers.py

@@ -27,6 +27,13 @@ class ManagedMcpServer:
     identity: McpServerIdentity | None = None
 
 
+GUARD_MCP_COMPANION_PREFIX = "hol-guard::"
+
+
+def is_guard_mcp_companion_name(name: str) -> bool:
+    return name.startswith(GUARD_MCP_COMPANION_PREFIX)
+
+
 _GUARD_PROXY_COMMANDS = frozenset(
     {
         "codex-mcp-proxy",
@@ -158,6 +165,8 @@ def proxy_process_env(server_env: dict[str, str]) -> dict[str, str]:
 def _managed_stdio_server(artifact: GuardArtifact) -> ManagedMcpServer | None:
     if artifact.artifact_type != "mcp_server":
         return None
+    if is_guard_mcp_companion_name(artifact.name):
+        return None
     if _bool_metadata(artifact.metadata.get("guard_managed_proxy"), default=False):
         return None
     if artifact.command is None or not artifact.name.strip():
@@ -249,16 +258,29 @@ def _bool_metadata(value: object, *, default: bool) -> bool:
     return default
 
 
+def _hol_guard_command_name(command: str) -> str | None:
+    cmd_name = PurePath(command.replace("\\", "/")).name.lower()
+    for suffix in (".exe", ".cmd", ".bat"):
+        if cmd_name.endswith(suffix):
+            cmd_name = cmd_name[: -len(suffix)]
+            break
+    return cmd_name if cmd_name == "hol-guard" else None
+
+
 def is_guard_proxy_command(command: str | None, args: tuple[str, ...]) -> bool:
     if not isinstance(command, str):
         return False
+    if _hol_guard_command_name(command) is not None:
+        return "guard" in args and any(value in _GUARD_PROXY_COMMANDS for value in args)
     if "codex_plugin_scanner.cli" not in args or "guard" not in args:
         return False
     return any(value in _GUARD_PROXY_COMMANDS for value in args)
 
 
 __all__ = [
+    "GUARD_MCP_COMPANION_PREFIX",
     "ManagedMcpServer",
+    "is_guard_mcp_companion_name",
     "is_guard_proxy_command",
     "managed_stdio_servers",
     "proxy_cli_args",

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/adapters/opencode.py

@@ -15,7 +15,9 @@ from ..shims import install_guard_shim, remove_guard_shim
 from .base import HarnessAdapter, HarnessContext, _command_available, _run_command_probe
 from .hook_python import resolve_guard_hook_python
 from .mcp_servers import (
+    GUARD_MCP_COMPANION_PREFIX,
     ManagedMcpServer,
+    is_guard_mcp_companion_name,
     is_guard_proxy_command,
     managed_stdio_servers,
     proxy_cli_args,
@@ -36,7 +38,7 @@ from .opencode_artifacts import (
 from .opencode_pretool import install_pretool_plugin, remove_pretool_plugin
 
 _OPENCODE_SCHEMA = "https://opencode.ai/config.json"
-_GUARD_MCP_COMPANION_PREFIX = "hol-guard::"
+_GUARD_MCP_COMPANION_PREFIX = GUARD_MCP_COMPANION_PREFIX
 _DEFAULT_BASH_PERMISSION: dict[str, object] = {
     "*": "allow",
     "git checkout *": "deny",
@@ -52,6 +54,10 @@ _DEFAULT_BASH_PERMISSION: dict[str, object] = {
 }
 
 
+class OpenCodeInstallConfigError(RuntimeError):
+    """Raised when Guard cannot safely update an existing OpenCode config file."""
+
+
 class OpenCodeHarnessAdapter(HarnessAdapter):
     """Discover OpenCode config, commands, plugins, and skills."""
 
@@ -170,6 +176,14 @@ class OpenCodeHarnessAdapter(HarnessAdapter):
         managed_servers = managed_stdio_servers(detection)
         skipped_servers = skipped_stdio_server_names(detection)
         target_config_path = self._managed_install_config_path(context)
+        target_payload, parse_error, _parse_reason = _load_json_or_jsonc(target_config_path)
+        if target_config_path.is_file() and (parse_error or not isinstance(target_payload, dict)):
+            raise OpenCodeInstallConfigError(
+                "Refusing to modify an invalid OpenCode root config. "
+                "Fix opencode.json (or opencode.jsonc) syntax and retry install."
+            )
+        if not isinstance(target_payload, dict):
+            target_payload = {}
         original_text = None
         if target_config_path.is_file():
             original_text = target_config_path.read_text(encoding="utf-8")
@@ -195,9 +209,6 @@ class OpenCodeHarnessAdapter(HarnessAdapter):
             + "\n",
             encoding="utf-8",
         )
-        target_payload, parse_error, _parse_reason = _load_json_or_jsonc(target_config_path)
-        if parse_error or not isinstance(target_payload, dict):
-            target_payload = {}
         existing_workspace_server_names = self._workspace_server_names(context)
         _apply_install_baseline(target_payload)
         target_payload["permission"] = self._managed_permission_payload(
@@ -432,8 +443,11 @@ class OpenCodeHarnessAdapter(HarnessAdapter):
             if not isinstance(mcp, dict):
                 continue
             for name, value in mcp.items():
-                if isinstance(name, str) and isinstance(value, dict):
-                    workspace_server_names.add(name)
+                if not isinstance(name, str) or not isinstance(value, dict):
+                    continue
+                if is_guard_mcp_companion_name(name):
+                    continue
+                workspace_server_names.add(name)
         return workspace_server_names
 
     @staticmethod
@@ -628,7 +642,7 @@ class OpenCodeHarnessAdapter(HarnessAdapter):
         return {}
 
 
-__all__ = ["OpenCodeHarnessAdapter"]
+__all__ = ["OpenCodeHarnessAdapter", "OpenCodeInstallConfigError"]
 
 
 def _apply_install_baseline(payload: dict[str, object]) -> None:
@@ -759,6 +773,11 @@ def _persisted_mcp_with_guard_companions(
         if environment:
             entry["environment"] = environment
         persisted[companion_name] = entry
+        native_entry = persisted.get(server.name)
+        if isinstance(native_entry, dict):
+            disabled_native = dict(native_entry)
+            disabled_native["enabled"] = False
+            persisted[server.name] = disabled_native
     return persisted
 
 

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/adapters/opencode_artifacts.py

@@ -10,6 +10,7 @@ from pathlib import Path
 from ..models import GuardArtifact
 from ..runtime.mcp_skill_firewall import enrich_artifact_with_mcp_skill_firewall
 from .base import HarnessContext
+from .mcp_servers import is_guard_mcp_companion_name, is_guard_proxy_command
 
 CONFIG_FILENAMES = ("opencode.json", "opencode.jsonc")
 PLUGIN_SUFFIXES = {".js", ".ts", ".mjs", ".cjs"}
@@ -245,6 +246,8 @@ def _append_mcp_artifacts(
     for name, server_config in mcp_config.items():
         if not isinstance(name, str) or not isinstance(server_config, dict):
             continue
+        if is_guard_mcp_companion_name(name):
+            continue
         command, args = _command_parts(server_config)
         transport = server_config.get("type") if isinstance(server_config.get("type"), str) else None
         url = server_config.get("url") if isinstance(server_config.get("url"), str) else None
@@ -262,6 +265,7 @@ def _append_mcp_artifacts(
             transport=transport or ("remote" if url is not None else "stdio"),
             metadata={
                 "enabled": bool(server_config.get("enabled", True)),
+                "guard_managed_proxy": is_guard_proxy_command(command, args),
                 "env": {
                     str(key): str(value)
                     for key, value in environment.items()

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/cli/_commands_shared.py

@@ -217,6 +217,7 @@ from .connect_flow import (
     DEFAULT_GUARD_SYNC_URL,
     build_connect_status_payload,
     connect_recovery_command,
+    normalize_connect_state_for_missing_oauth,
     resolve_connect_url,
     run_guard_browser_connect_command,
     run_guard_connect_repair_command,

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -34,9 +34,13 @@ def _resolve_policy_expiry(args: argparse.Namespace) -> str | None:
     return (datetime.now(timezone.utc) + timedelta(hours=float(hours))).isoformat()
 
 def _guard_doctor_connect_health_payload(store: GuardStore) -> dict[str, object]:
-    latest_state = store.get_effective_guard_connect_state(now=_now())
+    oauth_storage_health = store.get_oauth_local_credential_health()
+    latest_state = normalize_connect_state_for_missing_oauth(
+        latest_state=store.get_effective_guard_connect_state(now=_now()),
+        oauth_storage_health=oauth_storage_health,
+    )
     payload: dict[str, object] = {
-        "oauth_storage_health": _guard_doctor_oauth_storage_health_payload(store),
+        "oauth_storage_health": _guard_doctor_oauth_storage_health_payload_from_health(oauth_storage_health),
         "connect_recovery_command": connect_recovery_command(latest_state),
     }
     if isinstance(latest_state, dict):
@@ -44,7 +48,11 @@ def _guard_doctor_connect_health_payload(store: GuardStore) -> dict[str, object]
     return payload
 
 def _guard_doctor_oauth_storage_health_payload(store: GuardStore) -> dict[str, str]:
-    oauth_storage_health = store.get_oauth_local_credential_health()
+    return _guard_doctor_oauth_storage_health_payload_from_health(
+        store.get_oauth_local_credential_health(),
+    )
+
+def _guard_doctor_oauth_storage_health_payload_from_health(oauth_storage_health: dict[str, object]) -> dict[str, str]:
     state = "unknown"
     if isinstance(oauth_storage_health, dict):
         raw_state = oauth_storage_health.get("state")

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -22,6 +22,7 @@ from ...version import __version__
 from ..package_firewall_entitlement import build_oauth_package_firewall_entitlement
 from ..runtime.runner import prepare_guard_cloud_connect_authorization
 from ..store import GuardStore
+from ..store_connect import build_connect_state_response
 from .oauth_client import (
     GuardDpopKeyMaterial,
     GuardOAuthClientConfig,
@@ -1143,6 +1144,10 @@ def build_connect_status_payload(
     latest_state = store.get_effective_guard_connect_state(now=datetime.now(timezone.utc).isoformat())
     cloud_profile = store.get_cloud_sync_profile()
     oauth_storage_health = store.get_oauth_local_credential_health()
+    latest_state = normalize_connect_state_for_missing_oauth(
+        latest_state=latest_state,
+        oauth_storage_health=oauth_storage_health,
+    )
     oauth_repair_required = (
         bool(oauth_storage_health.get("configured")) and oauth_storage_health.get("state") == "degraded"
     )
@@ -1194,6 +1199,31 @@ def build_connect_status_payload(
     return payload
 
 
+def normalize_connect_state_for_missing_oauth(
+    *,
+    latest_state: dict[str, object] | None,
+    oauth_storage_health: dict[str, object],
+) -> dict[str, object] | None:
+    if latest_state is None:
+        return latest_state
+    oauth_state = str(oauth_storage_health.get("state") or "")
+    oauth_configured = bool(oauth_storage_health.get("configured"))
+    if oauth_state != "degraded" and oauth_configured:
+        return latest_state
+    status = str(latest_state.get("status") or "")
+    if status != "connected":
+        return latest_state
+    normalized = dict(latest_state)
+    normalized["status"] = "retry_required"
+    normalized["milestone"] = "first_sync_failed"
+    normalized["reason"] = "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
+    poll_after_ms = latest_state.get("poll_after_ms")
+    return build_connect_state_response(
+        normalized,
+        poll_after_ms=poll_after_ms if isinstance(poll_after_ms, int) else None,
+    )
+
+
 def connect_recovery_command(latest_state: dict[str, object] | None) -> str:
     if latest_state is None:
         return CONNECT_COMMAND

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/guard/cli/product.py

@@ -16,7 +16,13 @@ from ..daemon import load_guard_daemon_url
 from ..models import GuardArtifact, HarnessDetection
 from ..redaction import redact_local_path
 from ..store import GuardStore
-from .connect_flow import CONNECT_COMMAND, CONNECT_REPAIR_COMMAND, CONNECT_STATUS_COMMAND, connect_recovery_command
+from .connect_flow import (
+    CONNECT_COMMAND,
+    CONNECT_REPAIR_COMMAND,
+    CONNECT_STATUS_COMMAND,
+    connect_recovery_command,
+    normalize_connect_state_for_missing_oauth,
+)
 
 HARNESS_PRIORITY = ("codex", "claude-code", "copilot", "hermes", "cursor", "antigravity", "gemini", "opencode")
 GUARD_COMMAND = "hol-guard"
@@ -248,7 +254,10 @@ def _build_cloud_context(store: GuardStore) -> dict[str, object]:
     team_policy_pack = _coerce_payload_dict(store.get_sync_payload("team_policy_pack"))
     sync_summary = _coerce_payload_dict(store.get_sync_payload("sync_summary"))
     last_sync_at = _optional_string(sync_summary.get("synced_at"))
-    latest_connect_state = store.get_effective_guard_connect_state(now=_now())
+    latest_connect_state = normalize_connect_state_for_missing_oauth(
+        latest_state=store.get_effective_guard_connect_state(now=_now()),
+        oauth_storage_health=oauth_storage_health,
+    )
     connect_retry_required = _connect_retry_required(latest_connect_state)
     connect_retry_refresh_race = _connect_retry_refresh_race(latest_connect_state)
     remote_payload_active = bool(advisories or alert_preferences or remote_policy or team_policy_pack)

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.710"
+__version__ = "2.0.712"

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/tests/test_guard_cli.py

@@ -2672,10 +2672,7 @@ args = ["workspace-skill.js", "--changed"]
                 guard_home=home_dir,
             )
         )
-        assert (
-            guard_pretool_entry["matcher"]
-            == "Bash|Read|Write|Edit|MultiEdit|WebFetch|WebSearch|mcp__.*"
-        )
+        assert guard_pretool_entry["matcher"] == "Bash|Read|Write|Edit|MultiEdit|WebFetch|WebSearch|mcp__.*"
         assert (
             install_settings_payload["hooks"]["SessionStart"][0]["hooks"][0]["command"]
             == expected_session_start_command
@@ -6960,6 +6957,108 @@ url = http://127.0.0.1:8787/guard-canary
         assert "sign-in on this machine is incomplete" in output["cloud_state_detail"]
         assert output["oauth_storage_health"]["state"] == "degraded"
 
+    def test_guard_status_marks_stale_connected_state_retry_required_when_oauth_is_missing(
+        self,
+        tmp_path,
+        capsys,
+    ):
+        del capsys
+        home_dir = tmp_path / "home"
+        workspace_dir = tmp_path / "workspace"
+        _build_guard_fixture(home_dir, workspace_dir)
+        store = GuardStore(home_dir)
+        store.record_guard_connect_pairing_completed(
+            sync_url="https://hol.org/api/guard/receipts/sync",
+            allowed_origin="https://hol.org",
+            now="2026-06-11T22:11:11+00:00",
+            request_id="connect-401",
+        )
+        store.record_latest_guard_connect_sync_result(
+            status="connected",
+            milestone="first_sync_pending",
+            now="2026-06-11T22:11:11+00:00",
+            reason="Guard Cloud is unavailable. Local Guard keeps protecting this machine.",
+        )
+
+        output = guard_product_module.build_guard_status_payload(
+            HarnessContext(home_dir=home_dir, workspace_dir=workspace_dir, guard_home=home_dir),
+            store,
+            load_guard_config(home_dir),
+        )
+
+        latest_state = output["latest_connect_state"]
+        assert isinstance(latest_state, dict)
+        assert latest_state["status"] == "retry_required"
+        assert latest_state["milestone"] == "first_sync_failed"
+        assert latest_state["reason"] == (
+            "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
+        )
+        assert output["cloud_state"] == "local_only"
+        assert "needs repair before the first shared proof can land" in output["cloud_state_detail"]
+
+    def test_guard_status_marks_stale_connected_state_retry_required_when_oauth_is_degraded(
+        self,
+        tmp_path,
+        capsys,
+        monkeypatch,
+    ):
+        del capsys
+        home_dir = tmp_path / "home"
+        workspace_dir = tmp_path / "workspace"
+        _build_guard_fixture(home_dir, workspace_dir)
+        monkeypatch.setattr(KeychainSecretStore, "_is_available", staticmethod(lambda: False))
+        store = GuardStore(home_dir)
+        store.record_guard_connect_pairing_completed(
+            sync_url="https://hol.org/api/guard/receipts/sync",
+            allowed_origin="https://hol.org",
+            now="2026-06-11T22:11:11+00:00",
+            request_id="connect-403",
+        )
+        store.record_latest_guard_connect_sync_result(
+            status="connected",
+            milestone="first_sync_pending",
+            now="2026-06-11T22:11:11+00:00",
+            reason="Guard Cloud is unavailable. Local Guard keeps protecting this machine.",
+        )
+        store.set_oauth_local_credentials(
+            issuer="https://hol.org",
+            client_id="guard-local-daemon",
+            refresh_token="refresh-secret-value",
+            dpop_private_key_pem="-----BEGIN PRIVATE KEY-----\nsecret-key-material\n-----END PRIVATE KEY-----\n",
+            dpop_public_jwk={
+                "kty": "EC",
+                "crv": "P-256",
+                "x": "x-value",
+                "y": "y-value",
+                "alg": "ES256",
+                "use": "sig",
+            },
+            dpop_public_jwk_thumbprint="thumbprint-123",
+            grant_id="grant-123",
+            machine_id="machine-123",
+            workspace_id="workspace-123",
+            now="2026-06-11T22:12:00+00:00",
+        )
+        oauth_payload = store.get_sync_payload("oauth_local_credentials")
+        assert isinstance(oauth_payload, dict)
+        oauth_payload["credentials_sha256"] = "pbkdf2-sha256$invalid"
+        store.set_sync_payload("oauth_local_credentials", oauth_payload, "2026-06-11T22:12:30+00:00")
+
+        output = guard_product_module.build_guard_status_payload(
+            HarnessContext(home_dir=home_dir, workspace_dir=workspace_dir, guard_home=home_dir),
+            store,
+            load_guard_config(home_dir),
+        )
+
+        latest_state = output["latest_connect_state"]
+        assert isinstance(latest_state, dict)
+        assert latest_state["status"] == "retry_required"
+        assert latest_state["milestone"] == "first_sync_failed"
+        assert latest_state["reason"] == (
+            "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
+        )
+        assert output["oauth_storage_health"]["state"] == "degraded"
+
     def test_guard_disconnect_revokes_cloud_grant_through_oauth_disconnect_helper(
         self,
         tmp_path,
@@ -8826,9 +8925,7 @@ url = http://127.0.0.1:8787/guard-canary
             "reason": "bundle_version_downgrade",
         }
 
-    def test_refresh_cloud_policy_bundle_clears_non_bundle_errors_after_success(
-        self, tmp_path, monkeypatch
-    ):
+    def test_refresh_cloud_policy_bundle_clears_non_bundle_errors_after_success(self, tmp_path, monkeypatch):
         home_dir = tmp_path / "home"
         store = GuardStore(home_dir)
         store.set_sync_credentials(

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/tests/test_guard_connect_flow.py

@@ -146,8 +146,53 @@ def test_connect_status_requires_retry_when_oauth_not_configured(tmp_path: Path)
 
     assert payload["status"] == "retry_required"
     assert payload["milestone"] == "first_sync_failed"
+    assert payload["reason"] == "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
     assert payload["recovery_command"] == "hol-guard connect"
     assert payload["repair_message"] == "Run hol-guard connect again to repair local Guard Cloud authorization."
+    latest_state = payload["latest_connect_state"]
+    assert isinstance(latest_state, dict)
+    assert latest_state["status"] == "retry_required"
+    assert latest_state["milestone"] == "first_sync_failed"
+    assert latest_state["reason"] == (
+        "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
+    )
+
+
+def test_connect_status_requires_retry_when_legacy_sync_profile_exists_but_oauth_is_missing(
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now="2026-06-11T22:11:11+00:00",
+        request_id="connect-402",
+    )
+    store.record_latest_guard_connect_sync_result(
+        status="connected",
+        milestone="first_sync_pending",
+        now="2026-06-11T22:11:11+00:00",
+        reason="Guard Cloud is unavailable. Local Guard keeps protecting this machine.",
+    )
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "legacy-sync-token",
+        "2026-06-11T22:12:00+00:00",
+    )
+
+    payload = build_connect_status_payload(
+        store=store,
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        connect_url="https://hol.org/guard/connect",
+        action="status",
+    )
+
+    assert payload["status"] == "retry_required"
+    assert payload["milestone"] == "first_sync_failed"
+    latest_state = payload["latest_connect_state"]
+    assert isinstance(latest_state, dict)
+    assert latest_state["status"] == "retry_required"
+    assert latest_state["milestone"] == "first_sync_failed"
 
 
 def test_browser_connect_caches_paid_package_firewall_entitlement(tmp_path: Path) -> None:

{plugin_scanner-2.0.710 → plugin_scanner-2.0.712}/tests/test_opencode_adapter.py

@@ -5,8 +5,10 @@ from __future__ import annotations
 import json
 from pathlib import Path
 
+import pytest
+
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
-from codex_plugin_scanner.guard.adapters.opencode import OpenCodeHarnessAdapter
+from codex_plugin_scanner.guard.adapters.opencode import OpenCodeHarnessAdapter, OpenCodeInstallConfigError
 from codex_plugin_scanner.guard.adapters.opencode_artifacts import (
     CONFIG_FILENAMES,
     runtime_config_path,
@@ -340,6 +342,7 @@ class TestOpenCodeInstall:
         managed_config = json.loads(target.read_text(encoding="utf-8"))
         chrome = managed_config["mcp"]["chrome-devtools"]
         assert chrome["command"] == ["npx", "-y", "chrome-devtools-mcp@latest"]
+        assert chrome["enabled"] is False
         assert "opencode-mcp-proxy" not in json.dumps(chrome)
         assert managed_config["mcp"]["my-remote"]["url"] == "https://example.com/mcp"
         companion = managed_config["mcp"]["hol-guard::chrome-devtools"]
@@ -602,6 +605,76 @@ class TestOpenCodeResiliency:
         result = OpenCodeHarnessAdapter().detect(ctx)
         assert result.artifacts == ()
 
+    def test_install_refuses_malformed_existing_config(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".config" / "opencode" / "opencode.json"
+        config.parent.mkdir(parents=True, exist_ok=True)
+        original = '{"model": "gpt-4", "mcp": {"lab": {"type": "local", "command": ["node", "lab.js"]}}}'
+        config.write_text(original + ",", encoding="utf-8")
+        with pytest.raises(OpenCodeInstallConfigError):
+            OpenCodeHarnessAdapter().install(ctx)
+        assert config.read_text(encoding="utf-8") == original + ","
+        assert not OpenCodeHarnessAdapter._backup_path(ctx).exists()
+        assert not OpenCodeHarnessAdapter._state_path(ctx, config).exists()
+
+    def test_install_parses_json_with_comments(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".config" / "opencode" / "opencode.json"
+        config.parent.mkdir(parents=True, exist_ok=True)
+        config.write_text(
+            """
+            {
+              // workspace model
+              "model": "gpt-4",
+              "mcp": {
+                "lab": {
+                  "type": "local",
+                  "command": ["node", "lab.js"]
+                }
+              }
+            }
+            """,
+            encoding="utf-8",
+        )
+        OpenCodeHarnessAdapter().install(ctx)
+        managed_config = json.loads(config.read_text(encoding="utf-8"))
+        assert managed_config["model"] == "gpt-4"
+        assert managed_config["mcp"]["lab"]["command"] == ["node", "lab.js"]
+        assert managed_config["mcp"]["lab"]["enabled"] is False
+        assert "hol-guard::lab" in managed_config["mcp"]
+
+    def test_install_is_idempotent_for_managed_mcp_entries(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".config" / "opencode" / "opencode.json"
+        _write_mcp_config(
+            config,
+            {"chrome-devtools": {"type": "local", "command": ["npx", "-y", "chrome-devtools-mcp@latest"]}},
+        )
+        OpenCodeHarnessAdapter().install(ctx)
+        first = json.loads(config.read_text(encoding="utf-8"))
+        OpenCodeHarnessAdapter().install(ctx)
+        second = json.loads(config.read_text(encoding="utf-8"))
+        assert set(first["mcp"]) == set(second["mcp"])
+        assert list(first["mcp"]).count("chrome-devtools") == 1
+        assert list(first["mcp"]).count("hol-guard::chrome-devtools") == 1
+
+    def test_detect_ignores_guard_companion_mcp_entries(self, tmp_path: Path) -> None:
+        ctx = _ctx(tmp_path)
+        config = ctx.home_dir / ".config" / "opencode" / "opencode.json"
+        _write_mcp_config(
+            config,
+            {
+                "chrome-devtools": {"type": "local", "command": ["npx", "-y", "chrome-devtools-mcp@latest"]},
+                "hol-guard::chrome-devtools": {
+                    "type": "local",
+                    "command": ["/usr/local/bin/hol-guard", "guard", "opencode-mcp-proxy"],
+                },
+            },
+        )
+        result = OpenCodeHarnessAdapter().detect(ctx)
+        artifact_names = {artifact.name for artifact in result.artifacts}
+        assert artifact_names == {"chrome-devtools"}
+
     def test_detect_skips_empty_config_file(self, tmp_path: Path) -> None:
         ctx = _ctx(tmp_path)
         config = ctx.home_dir / ".config" / "opencode" / "opencode.json"