plugin-scanner 2.0.734__tar.gz → 2.0.735__tar.gz

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.734
+Version: 2.0.735
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.734"
+version = "2.0.735"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.734"
+version = "2.0.735"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/guard/approvals.py

@@ -14,6 +14,11 @@ from urllib.parse import ParseResult, parse_qsl, urlencode, urlparse, urlunparse
 from .adapters import get_adapter
 from .adapters.base import HarnessContext
 from .approval_gate import ApprovalGateInput, require_approval_decision
+from .cli.connect_flow import (
+    connect_retry_refresh_race_from_reason,
+    resolve_guard_cloud_repair_detail,
+    resolve_guard_cloud_state,
+)
 from .config import load_guard_config
 from .daemon.manager import load_guard_daemon_auth_token
 from .desktop_notifications import (
@@ -926,10 +931,12 @@ def _build_runtime_cloud_context(
         _optional_string(acknowledgement.get("acknowledgedAt")) if isinstance(acknowledgement, dict) else None
     )
     remote_payload_active = any((sync_summary, remote_policy, team_policy_pack, alert_preferences))
-    cloud_state = _resolve_runtime_cloud_state(
+    cloud_state = resolve_guard_cloud_state(
         sync_configured=cloud_profile is not None,
         sync_completed=bool(sync_summary),
         remote_payload_active=remote_payload_active,
+        oauth_repair_required=oauth_repair_required,
+        connect_retry_required=connect_retry_required,
     )
     dashboard_url, inbox_url, fleet_url, connect_url = _resolve_guard_urls(sync_url)
     sync_health = _build_cloud_sync_health(
@@ -949,6 +956,7 @@ def _build_runtime_cloud_context(
             oauth_repair_required=oauth_repair_required,
             connect_retry_required=connect_retry_required,
             connect_retry_refresh_race=connect_retry_refresh_race,
+            shared_proof_recorded=bool(sync_summary) or remote_payload_active,
         ),
         "cloud_sync_health": sync_health,
         "cloud_pairing_state": {
@@ -959,6 +967,7 @@ def _build_runtime_cloud_context(
                 oauth_repair_required=oauth_repair_required,
                 connect_retry_required=connect_retry_required,
                 connect_retry_refresh_race=connect_retry_refresh_race,
+                shared_proof_recorded=bool(sync_summary) or remote_payload_active,
             ),
             "sync_configured": cloud_profile is not None,
             "dashboard_url": dashboard_url,
@@ -1077,7 +1086,7 @@ def _runtime_proof_status_name(
     if milestone == "sync_not_available":
         return "sync_unavailable"
     if status == "retry_required" or milestone == "first_sync_failed":
-        if _connect_retry_refresh_race_from_reason(reason):
+        if connect_retry_refresh_race_from_reason(reason):
             return "stalled"
         return "failed"
     if milestone == "first_sync_pending":
@@ -1134,11 +1143,7 @@ def _connect_retry_required(latest_state: dict[str, object] | None) -> bool:
 def _connect_retry_refresh_race(latest_state: dict[str, object] | None) -> bool:
     if latest_state is None or not _connect_retry_required(latest_state):
         return False
-    return _connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
-
-
-def _connect_retry_refresh_race_from_reason(reason: str | None) -> bool:
-    return isinstance(reason, str) and "already consumed" in reason.lower()
+    return connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
 
 
 def _build_cloud_sync_health(
@@ -1272,14 +1277,6 @@ def _cloud_sync_health_detail(
     return "Waiting for the first shared Cloud proof from this machine."
 
 
-def _resolve_runtime_cloud_state(*, sync_configured: bool, sync_completed: bool, remote_payload_active: bool) -> str:
-    if not sync_configured:
-        return "local_only"
-    if sync_completed or remote_payload_active:
-        return "paired_active"
-    return "paired_waiting"
-
-
 def _runtime_cloud_state_label(cloud_state: str) -> str:
     labels = {
         "local_only": "Local only",
@@ -1295,6 +1292,7 @@ def _runtime_cloud_state_detail(
     oauth_repair_required: bool = False,
     connect_retry_required: bool = False,
     connect_retry_refresh_race: bool = False,
+    shared_proof_recorded: bool = False,
 ) -> str:
     if oauth_repair_required:
         return (
@@ -1308,9 +1306,16 @@ def _runtime_cloud_state_detail(
             "Run hol-guard connect once when you want shared proof restored."
         )
     if connect_retry_required:
-        return (
-            "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
-            "Run hol-guard connect again."
+        return resolve_guard_cloud_repair_detail(
+            shared_proof_recorded=shared_proof_recorded,
+            first_sync_message=(
+                "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
+                "Run hol-guard connect again."
+            ),
+            resume_message=(
+                "Guard Cloud connection on this machine needs repair before shared proof can resume. "
+                "Run hol-guard connect again."
+            ),
         )
     if cloud_state == "paired_waiting":
         return (

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/guard/cli/_commands_shared.py

@@ -217,6 +217,7 @@ from .connect_flow import (
     DEFAULT_GUARD_SYNC_URL,
     build_connect_status_payload,
     connect_recovery_command,
+    connect_state_requires_oauth,
     normalize_connect_state_for_missing_oauth,
     resolve_connect_url,
     run_guard_browser_connect_command,

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -35,9 +35,15 @@ def _resolve_policy_expiry(args: argparse.Namespace) -> str | None:
 
 def _guard_doctor_connect_health_payload(store: GuardStore) -> dict[str, object]:
     oauth_storage_health = store.get_oauth_local_credential_health()
+    cloud_profile = store.get_cloud_sync_profile()
+    effective_connect_state = store.get_effective_guard_connect_state(now=_now())
     latest_state = normalize_connect_state_for_missing_oauth(
-        latest_state=store.get_effective_guard_connect_state(now=_now()),
+        latest_state=effective_connect_state,
         oauth_storage_health=oauth_storage_health,
+        oauth_required=connect_state_requires_oauth(
+            latest_state=effective_connect_state,
+            cloud_profile=cloud_profile,
+        ),
     )
     payload: dict[str, object] = {
         "oauth_storage_health": _guard_doctor_oauth_storage_health_payload_from_health(oauth_storage_health),
@@ -100,6 +106,32 @@ def _synced_policy_payload(store: GuardStore) -> dict[str, object] | None:
     payload = store.get_sync_payload("policy")
     return payload if isinstance(payload, dict) else None
 
+
+_PERSISTED_POLICY_BUNDLE_REJECTION_REASONS = frozenset(
+    {
+        "bundle_hash_mismatch",
+        "bundle_version_downgrade",
+        "invalid_acknowledgements",
+        "invalid_bundle_hash",
+        "invalid_bundle_version",
+        "invalid_cloud_exceptions",
+        "invalid_expires_at",
+        "invalid_issued_at",
+        "invalid_policy_bundle",
+        "invalid_policy_defaults",
+        "invalid_rollout_state",
+        "invalid_rules",
+        "invalid_verifier",
+        "invalid_workspace_id",
+        "missing_required_field",
+        "payload_hash_mismatch",
+        "unsupported_contract_version",
+        "unsupported_daemon_version",
+        "wrong_workspace",
+    }
+)
+
+
 def _refresh_cloud_policy_bundle(store: GuardStore) -> None:
     if store.get_cloud_sync_profile() is None:
         return
@@ -146,11 +178,7 @@ def _refresh_cloud_policy_bundle(store: GuardStore) -> None:
         if isinstance(policy_bundle_last_error, dict)
         else None
     )
-    if policy_bundle_rejection_reason not in {
-        "bundle_version_downgrade",
-        "invalid_policy_bundle",
-        "unsupported_daemon_version",
-    }:
+    if policy_bundle_rejection_reason not in _PERSISTED_POLICY_BUNDLE_REJECTION_REASONS:
         store.set_sync_payload("policy_bundle_last_error", {}, now)
 
 def _guard_cloud_urls_for_connect(connect_url: str) -> dict[str, str]:

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -1144,9 +1144,11 @@ def build_connect_status_payload(
     latest_state = store.get_effective_guard_connect_state(now=datetime.now(timezone.utc).isoformat())
     cloud_profile = store.get_cloud_sync_profile()
     oauth_storage_health = store.get_oauth_local_credential_health()
+    oauth_required = connect_state_requires_oauth(latest_state=latest_state, cloud_profile=cloud_profile)
     latest_state = normalize_connect_state_for_missing_oauth(
         latest_state=latest_state,
         oauth_storage_health=oauth_storage_health,
+        oauth_required=oauth_required,
     )
     oauth_repair_required = (
         bool(oauth_storage_health.get("configured")) and oauth_storage_health.get("state") == "degraded"
@@ -1167,7 +1169,7 @@ def build_connect_status_payload(
         milestone = "first_sync_failed"
         reason = "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
         recovery_command = CONNECT_COMMAND
-    elif not bool(oauth_storage_health.get("configured")) and status == "connected":
+    elif oauth_required and not bool(oauth_storage_health.get("configured")) and status == "connected":
         status = "retry_required"
         milestone = "first_sync_failed"
         if not isinstance(reason, str) or not reason.strip():
@@ -1193,19 +1195,36 @@ def build_connect_status_payload(
         payload["repair_action"] = "rerun_connect"
         payload["repair_message"] = "Run hol-guard connect to start OAuth Device Code approval."
     elif (oauth_repair_required and cloud_profile is None) or (
-        not bool(oauth_storage_health.get("configured")) and payload["status"] == "retry_required"
+        oauth_required and not bool(oauth_storage_health.get("configured")) and payload["status"] == "retry_required"
     ):
         payload["repair_message"] = "Run hol-guard connect again to repair local Guard Cloud authorization."
     return payload
 
 
+def connect_state_requires_oauth(
+    *,
+    latest_state: dict[str, object] | None,
+    cloud_profile: dict[str, object] | None,
+) -> bool:
+    request_id = latest_state.get("request_id") if latest_state is not None else None
+    if isinstance(request_id, str) and bool(request_id.strip()):
+        return True
+    auth_mode = cloud_profile.get("auth_mode") if isinstance(cloud_profile, dict) else None
+    if auth_mode == "legacy":
+        return False
+    return auth_mode == "oauth"
+
+
 def normalize_connect_state_for_missing_oauth(
     *,
     latest_state: dict[str, object] | None,
     oauth_storage_health: dict[str, object],
+    oauth_required: bool,
 ) -> dict[str, object] | None:
     if latest_state is None:
         return latest_state
+    if not oauth_required:
+        return latest_state
     oauth_state = str(oauth_storage_health.get("state") or "")
     oauth_configured = bool(oauth_storage_health.get("configured"))
     if oauth_state != "degraded" and oauth_configured:
@@ -1234,3 +1253,35 @@ def connect_recovery_command(latest_state: dict[str, object] | None) -> str:
     if status == "connected" and milestone == "first_sync_succeeded":
         return "hol-guard sync"
     return CONNECT_COMMAND
+
+
+def connect_retry_refresh_race_from_reason(reason: str | None) -> bool:
+    return isinstance(reason, str) and "already consumed" in reason.lower()
+
+
+def resolve_guard_cloud_state(
+    *,
+    sync_configured: bool,
+    sync_completed: bool,
+    remote_payload_active: bool,
+    oauth_repair_required: bool = False,
+    connect_retry_required: bool = False,
+) -> str:
+    if not sync_configured:
+        return "local_only"
+    if oauth_repair_required:
+        return "local_only"
+    if connect_retry_required:
+        return "local_only" if sync_completed or remote_payload_active else "paired_waiting"
+    if sync_completed or remote_payload_active:
+        return "paired_active"
+    return "paired_waiting"
+
+
+def resolve_guard_cloud_repair_detail(
+    *,
+    shared_proof_recorded: bool,
+    first_sync_message: str,
+    resume_message: str,
+) -> str:
+    return resume_message if shared_proof_recorded else first_sync_message

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/guard/cli/product.py

@@ -8,7 +8,6 @@ from urllib.parse import urlparse
 
 from ..adapters import get_adapter
 from ..adapters.base import HarnessContext
-from ..approvals import _connect_retry_refresh_race_from_reason
 from ..config import GuardConfig
 from ..consumer import detect_all
 from ..consumer.service import diff_artifact
@@ -21,7 +20,11 @@ from .connect_flow import (
     CONNECT_REPAIR_COMMAND,
     CONNECT_STATUS_COMMAND,
     connect_recovery_command,
+    connect_retry_refresh_race_from_reason,
+    connect_state_requires_oauth,
     normalize_connect_state_for_missing_oauth,
+    resolve_guard_cloud_repair_detail,
+    resolve_guard_cloud_state,
 )
 
 HARNESS_PRIORITY = ("codex", "claude-code", "copilot", "hermes", "cursor", "antigravity", "gemini", "opencode")
@@ -254,17 +257,24 @@ def _build_cloud_context(store: GuardStore) -> dict[str, object]:
     team_policy_pack = _coerce_payload_dict(store.get_sync_payload("team_policy_pack"))
     sync_summary = _coerce_payload_dict(store.get_sync_payload("sync_summary"))
     last_sync_at = _optional_string(sync_summary.get("synced_at"))
+    effective_connect_state = store.get_effective_guard_connect_state(now=_now())
     latest_connect_state = normalize_connect_state_for_missing_oauth(
-        latest_state=store.get_effective_guard_connect_state(now=_now()),
+        latest_state=effective_connect_state,
         oauth_storage_health=oauth_storage_health,
+        oauth_required=connect_state_requires_oauth(
+            latest_state=effective_connect_state,
+            cloud_profile=cloud_profile,
+        ),
     )
     connect_retry_required = _connect_retry_required(latest_connect_state)
     connect_retry_refresh_race = _connect_retry_refresh_race(latest_connect_state)
     remote_payload_active = bool(advisories or alert_preferences or remote_policy or team_policy_pack)
-    cloud_state = _resolve_cloud_state(
+    cloud_state = resolve_guard_cloud_state(
         sync_configured=cloud_profile is not None,
         sync_completed=bool(sync_summary),
         remote_payload_active=remote_payload_active,
+        oauth_repair_required=oauth_repair_required,
+        connect_retry_required=connect_retry_required,
     )
     return {
         "cloud_state": cloud_state,
@@ -276,6 +286,7 @@ def _build_cloud_context(store: GuardStore) -> dict[str, object]:
             oauth_repair_required=oauth_repair_required,
             connect_retry_required=connect_retry_required,
             connect_retry_refresh_race=connect_retry_refresh_race,
+            shared_proof_recorded=bool(sync_summary) or remote_payload_active,
         ),
         "sync_url": sync_url,
         "dashboard_url": dashboard_url,
@@ -469,14 +480,6 @@ def _resolve_guard_urls(sync_url: str | None) -> tuple[str, str, str, str]:
     )
 
 
-def _resolve_cloud_state(*, sync_configured: bool, sync_completed: bool, remote_payload_active: bool) -> str:
-    if not sync_configured:
-        return "local_only"
-    if not sync_completed and not remote_payload_active:
-        return "paired_waiting"
-    return "paired_active"
-
-
 def _cloud_state_label(cloud_state: str) -> str:
     labels = {
         "local_only": "Local only",
@@ -494,6 +497,7 @@ def _cloud_state_detail(
     oauth_repair_required: bool = False,
     connect_retry_required: bool = False,
     connect_retry_refresh_race: bool = False,
+    shared_proof_recorded: bool = False,
 ) -> str:
     if oauth_repair_required:
         return (
@@ -506,9 +510,16 @@ def _cloud_state_detail(
             f"race. Run `{GUARD_COMMAND} connect` or reopen {connect_url} when you want shared proof restored."
         )
     if connect_retry_required:
-        return (
-            "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
-            f"Run `{GUARD_COMMAND} connect` or reopen {connect_url} to repair the first sync."
+        return resolve_guard_cloud_repair_detail(
+            shared_proof_recorded=shared_proof_recorded,
+            first_sync_message=(
+                "Guard Cloud connection on this machine needs repair before the first shared proof can land. "
+                f"Run `{GUARD_COMMAND} connect` or reopen {connect_url} to repair the first sync."
+            ),
+            resume_message=(
+                "Guard Cloud connection on this machine needs repair before shared proof can resume. "
+                f"Run `{GUARD_COMMAND} connect` or reopen {connect_url} to restore sync."
+            ),
         )
     if cloud_state == "paired_waiting":
         return (
@@ -542,7 +553,7 @@ def _connect_retry_required(latest_state: dict[str, object] | None) -> bool:
 def _connect_retry_refresh_race(latest_state: dict[str, object] | None) -> bool:
     if latest_state is None or not _connect_retry_required(latest_state):
         return False
-    return _connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
+    return connect_retry_refresh_race_from_reason(_optional_string(latest_state.get("reason")))
 
 
 def _advisory_headline(advisories: list[dict[str, object]]) -> str | None:

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/guard/store.py

@@ -5201,7 +5201,11 @@ class GuardStore:
         status = str(normalized.get("status") or "")
         milestone = str(normalized.get("milestone") or "")
         has_sync_summary = bool(sync_summary)
-        if has_sync_summary:
+        if (
+            has_sync_summary
+            and status != "retry_required"
+            and milestone not in {"first_sync_failed", "sync_not_available"}
+        ):
             return self._coerce_guard_connect_state_status(
                 state=normalized,
                 status="connected",

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.734"
+__version__ = "2.0.735"

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/tests/test_guard_cli.py

@@ -8925,6 +8925,32 @@ url = http://127.0.0.1:8787/guard-canary
             "reason": "bundle_version_downgrade",
         }
 
+    def test_refresh_cloud_policy_bundle_preserves_bundle_hash_mismatch_reason(self, tmp_path, monkeypatch):
+        home_dir = tmp_path / "home"
+        store = GuardStore(home_dir)
+        store.set_sync_credentials(
+            "https://hol.org/api/guard/receipts/sync",
+            "oauth_access_token_fixture",
+            "2026-04-09T00:00:00Z",
+        )
+
+        def _bundle_rejected(current_store: GuardStore, **_kwargs: object) -> dict[str, object]:
+            current_store.set_sync_payload(
+                "policy_bundle_last_error",
+                {"reason": "bundle_hash_mismatch"},
+                "2026-04-09T00:00:00Z",
+            )
+            return {"synced": True}
+
+        monkeypatch.setattr(guard_commands_module, "sync_receipts", _bundle_rejected)
+        monkeypatch.setattr(guard_commands_module, "sync_supply_chain_bundle", lambda _store: None)
+
+        guard_commands_module._refresh_cloud_policy_bundle(store)
+
+        assert store.get_sync_payload("policy_bundle_last_error") == {
+            "reason": "bundle_hash_mismatch",
+        }
+
     def test_refresh_cloud_policy_bundle_clears_non_bundle_errors_after_success(self, tmp_path, monkeypatch):
         home_dir = tmp_path / "home"
         store = GuardStore(home_dir)

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/tests/test_guard_product_flow.py

@@ -542,6 +542,74 @@ args = ["workspace-skill.js", "--changed"]
         assert "stays locally protected" in output["cloud_state_detail"]
         assert "needs repair before the first shared proof can land" not in output["cloud_state_detail"]
 
+    def test_guard_status_reports_post_sync_reauth_as_local_only(self, tmp_path, capsys):
+        home_dir = tmp_path / "home"
+        guard_home = home_dir / ".hol-guard"
+        workspace_dir = tmp_path / "workspace"
+        workspace_dir.mkdir(parents=True)
+        store = GuardStore(guard_home)
+        store.set_oauth_local_credentials(
+            issuer="https://hol.org",
+            client_id="guard-local-daemon",
+            refresh_token="refresh-secret-value",
+            dpop_private_key_pem="-----BEGIN PRIVATE KEY-----\nsecret-key-material\n-----END PRIVATE KEY-----\n",
+            dpop_public_jwk={
+                "kty": "EC",
+                "crv": "P-256",
+                "x": "x-value",
+                "y": "y-value",
+                "alg": "ES256",
+                "use": "sig",
+            },
+            dpop_public_jwk_thumbprint="thumbprint-123",
+            grant_id="grant-123",
+            machine_id="machine-123",
+            workspace_id="workspace-123",
+            now="2026-06-04T18:30:00+00:00",
+        )
+        store.record_guard_connect_pairing_completed(
+            sync_url="https://hol.org/api/guard/receipts/sync",
+            allowed_origin="https://hol.org",
+            now="2026-06-04T18:30:00+00:00",
+            request_id="connect-post-sync-401",
+        )
+        store.record_latest_guard_connect_sync_result(
+            status="retry_required",
+            milestone="first_sync_failed",
+            now="2026-06-04T19:00:00+00:00",
+            reason="Guard Cloud sign-in on this device is no longer valid. Run `hol-guard disconnect` then `hol-guard connect` to sign in again.",
+        )
+        store.set_sync_payload(
+            "sync_summary",
+            {
+                "synced_at": "2026-06-04T18:45:00+00:00",
+                "receipts_stored": 11,
+                "inventory": 0,
+                "inventory_tracked": 261,
+            },
+            "2026-06-04T18:45:00+00:00",
+        )
+
+        rc = main(
+            [
+                "guard",
+                "status",
+                "--home",
+                str(home_dir),
+                "--guard-home",
+                str(guard_home),
+                "--workspace",
+                str(workspace_dir),
+                "--json",
+            ]
+        )
+        output = json.loads(capsys.readouterr().out)
+
+        assert rc == 0
+        assert output["cloud_state"] == "local_only"
+        assert "needs repair before shared proof can resume" in output["cloud_state_detail"]
+        assert output["latest_connect_state"]["status"] == "retry_required"
+
     def test_guard_start_human_output_highlights_guard_loop(self, tmp_path, capsys):
         home_dir = tmp_path / "home"
         workspace_dir = tmp_path / "workspace"

{plugin_scanner-2.0.734 → plugin_scanner-2.0.735}/tests/test_guard_surface_server.py

@@ -1208,6 +1208,67 @@ class TestGuardSurfaceServer:
         assert payload["cloud_sync_health"]["state"] == "failed"
         assert payload["cloud_sync_health"]["detail"].startswith("Local protection is active.")
 
+    def test_guard_daemon_runtime_snapshot_reports_post_sync_reauth_as_local_only(self, tmp_path) -> None:
+        store = GuardStore(tmp_path / "guard-home")
+        store.set_oauth_local_credentials(
+            issuer="https://hol.org",
+            client_id="guard-local-daemon",
+            refresh_token="refresh-secret-value",
+            dpop_private_key_pem="-----BEGIN PRIVATE KEY-----\nsecret-key-material\n-----END PRIVATE KEY-----\n",
+            dpop_public_jwk={
+                "kty": "EC",
+                "crv": "P-256",
+                "x": "x-value",
+                "y": "y-value",
+                "alg": "ES256",
+                "use": "sig",
+            },
+            dpop_public_jwk_thumbprint="thumbprint-123",
+            grant_id="grant-123",
+            machine_id="machine-123",
+            workspace_id="workspace-123",
+            now="2026-06-04T18:30:00+00:00",
+        )
+        store.record_guard_connect_pairing_completed(
+            sync_url="https://hol.org/api/guard/receipts/sync",
+            allowed_origin="https://hol.org",
+            now="2026-06-04T18:30:00+00:00",
+            request_id="connect-post-sync-401",
+        )
+        store.record_latest_guard_connect_sync_result(
+            status="retry_required",
+            milestone="first_sync_failed",
+            now="2026-06-04T19:00:00+00:00",
+            reason="Guard Cloud sign-in on this device is no longer valid. Run `hol-guard disconnect` then `hol-guard connect` to sign in again.",
+        )
+        store.set_sync_payload(
+            "sync_summary",
+            {
+                "synced_at": "2026-06-04T18:45:00+00:00",
+                "receipts_stored": 11,
+                "inventory": 0,
+                "inventory_tracked": 261,
+            },
+            "2026-06-04T18:45:00+00:00",
+        )
+        daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)
+        daemon.start()
+
+        try:
+            with urllib.request.urlopen(
+                _guard_get_request(daemon.port, "/v1/runtime", daemon._server.auth_token),
+                timeout=5,
+            ) as response:
+                payload = json.loads(response.read().decode("utf-8"))
+        finally:
+            daemon.stop()
+
+        assert payload["cloud_state"] == "local_only"
+        assert payload["cloud_pairing_state"]["state"] == "local_only"
+        assert "needs repair before shared proof can resume" in payload["cloud_state_detail"]
+        assert payload["cloud_pairing_state"]["detail"] == payload["cloud_state_detail"]
+        assert payload["cloud_sync_health"]["state"] == "failed"
+
     def test_guard_daemon_runtime_snapshot_keeps_failed_sync_copy_distinct_from_oauth_repair(self, tmp_path) -> None:
         store = GuardStore(tmp_path / "guard-home")
         store.set_oauth_local_credentials(