plugin-scanner 2.0.790__tar.gz → 2.0.791__tar.gz

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.790
+Version: 2.0.791
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/evidence/evidence-insights-share-modal.tsx

@@ -15,7 +15,7 @@ import {
 } from "../guard-api";
 import { ConnectFlowCard } from "../supply-chain-firewall-views";
 import {
-  openPackageFirewallAuthorizeWindow,
+  openPackageFirewallAuthorizeFallback,
   PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
 } from "../package-firewall-connect-browser";
 import { EvidenceInsightsShareSheet } from "./evidence-insights-share-sheet";
@@ -85,7 +85,7 @@ export function EvidenceInsightsShareModal({
   }, [cloudConnected, refreshConnectState]);
 
   useEffect(() => {
-    if (connectFlow?.state !== "running") {
+    if (connectFlow?.state !== "running" && connectFlow?.state !== "starting") {
       return;
     }
     const handle = window.setTimeout(() => {
@@ -102,7 +102,10 @@ export function EvidenceInsightsShareModal({
       setConnectFlow(status.connect_flow);
       if (
         status.connect_flow?.authorize_url &&
-        !openPackageFirewallAuthorizeWindow(status.connect_flow.authorize_url)
+        !openPackageFirewallAuthorizeFallback(
+          status.connect_flow.authorize_url,
+          status.connect_flow.browser_opened,
+        )
       ) {
         setConnectError(PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE);
       }

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/guard-api.ts

@@ -2371,7 +2371,7 @@ function normalizePackageFirewallConnectFlow(
     return null;
   }
   const state = value.state;
-  if (state !== "idle" && state !== "running" && state !== "failed") {
+  if (state !== "idle" && state !== "starting" && state !== "running" && state !== "failed") {
     return null;
   }
   const title = stringValue(value.title);

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/guard-types.ts

@@ -765,7 +765,7 @@ export type PackageFirewallCliFallback = {
 };
 
 export type PackageFirewallConnectFlow = {
-  state: "idle" | "running" | "failed";
+  state: "idle" | "starting" | "running" | "failed";
   title: string;
   detail: string;
   action_label: string;

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/package-firewall-connect-browser.test.ts

@@ -1,4 +1,5 @@
 import {
+  openPackageFirewallAuthorizeFallback,
   openPackageFirewallAuthorizeWindow,
   PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
 } from "./package-firewall-connect-browser";
@@ -30,6 +31,25 @@ assert(
   "expected authorize URL to be passed to window.open",
 );
 
+openedUrls.length = 0;
+assert(
+  openPackageFirewallAuthorizeFallback(
+    "https://hol.org/api/guard/oauth/authorize?client_id=test",
+    true,
+  ),
+  "daemon-opened browser flow should be treated as handled",
+);
+assert(openedUrls.length === 0, "daemon-opened browser flow should not call window.open");
+
+assert(
+  openPackageFirewallAuthorizeFallback(
+    "https://hol.org/api/guard/oauth/authorize?client_id=test",
+    false,
+  ),
+  "daemon-blocked browser flow should open dashboard fallback window",
+);
+assert(openedUrls.length === 1, "daemon-blocked browser flow should call window.open once");
+
 openedUrls.length = 0;
 assert(!openPackageFirewallAuthorizeWindow(null), "null authorize URL should not open");
 assert(openedUrls.length === 0, "null authorize URL should not call window.open");

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/package-firewall-connect-browser.ts

@@ -14,3 +14,13 @@ export function openPackageFirewallAuthorizeWindow(
   }
   return false;
 }
+
+export function openPackageFirewallAuthorizeFallback(
+  authorizeUrl: string | null | undefined,
+  browserOpened: boolean | null | undefined,
+): boolean {
+  if (browserOpened === true) {
+    return true;
+  }
+  return openPackageFirewallAuthorizeWindow(authorizeUrl);
+}

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/package-firewall-connect.test.tsx

@@ -67,6 +67,32 @@ assert(
   "PF1: compact connect state should not render the nested security card",
 );
 
+const startingMarkup = renderToStaticMarkup(
+  <ConnectFlowCard
+    compact
+    connectError={null}
+    connectStarting={false}
+    connectFlow={{
+      state: "starting",
+      title: "Finish Guard Cloud sign-in in your browser",
+      detail: "HOL Guard is opening the secure sign-in flow in your browser.",
+      action_label: "Repair Guard Cloud access",
+      connect_url: "https://hol.org/guard/connect",
+      authorize_url: null,
+      browser_opened: false,
+      request_id: "guard-connect-2",
+      poll_after_ms: 1500,
+    }}
+    mode="repair"
+    onStartConnect={() => undefined}
+  />,
+);
+
+assert(
+  !startingMarkup.includes("Open sign-in page"),
+  "PF2: starting connect card should not link to generic connect before authorize URL exists",
+);
+
 const connectRequiredStatus: PackageFirewallStatusResponse = {
   operation: "status",
   status: "completed",

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/supply-chain-firewall-panel.tsx

@@ -24,7 +24,7 @@ import {
   resolveApprovalGateSyncFailure,
 } from "./harness-action-errors";
 import {
-  openPackageFirewallAuthorizeWindow,
+  openPackageFirewallAuthorizeFallback,
   PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE,
 } from "./package-firewall-connect-browser";
 import { EntitlementNotice, ConnectFlowCard } from "./supply-chain-firewall-views";
@@ -258,7 +258,7 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       return;
     }
     const flow = panelLoad.data.connect_flow;
-    if (flow === null || flow.state !== "running") {
+    if (flow === null || (flow.state !== "running" && flow.state !== "starting")) {
       return;
     }
     const handle = window.setTimeout(() => {
@@ -444,7 +444,10 @@ export const PackageFirewallPanel = forwardRef(function PackageFirewallPanel(
       const connectFlow = await startPackageFirewallConnect();
       if (
         connectFlow?.authorize_url &&
-        !openPackageFirewallAuthorizeWindow(connectFlow.authorize_url)
+        !openPackageFirewallAuthorizeFallback(
+          connectFlow.authorize_url,
+          connectFlow.browser_opened,
+        )
       ) {
         setConnectError(PACKAGE_FIREWALL_CONNECT_POPUP_BLOCKED_MESSAGE);
       }

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/dashboard/src/supply-chain-firewall-views.tsx

@@ -231,7 +231,7 @@ function resolveConnectSteps(
   connectFlow: NonNullable<PackageFirewallStatusResponse["connect_flow"]>,
   purpose: "package_firewall" | "insights_share" | "audit" = "package_firewall",
 ): Array<{ body: string; current: boolean; done: boolean; title: string }> {
-  const running = connectFlow.state === "running";
+  const running = connectFlow.state === "running" || connectFlow.state === "starting";
   const failed = connectFlow.state === "failed";
   const browserOpened = connectFlow.browser_opened === true;
   const unlockCopy = resolveConnectUnlockCopy(purpose);
@@ -328,9 +328,9 @@ export function ConnectFlowCard({
   onStartConnect,
   purpose = "package_firewall",
 }: ConnectFlowCardProps) {
-  const manualHref = connectFlow.authorize_url ?? connectFlow.connect_url;
-  const running = connectFlow.state === "running";
+  const running = connectFlow.state === "running" || connectFlow.state === "starting";
   const failed = connectFlow.state === "failed";
+  const manualHref = connectFlow.authorize_url ?? (failed ? connectFlow.connect_url : null);
   const primaryBusy = connectStarting || running;
   const primaryLabel = resolveConnectPrimaryLabel({
     actionLabel: connectFlow.action_label,
@@ -340,7 +340,7 @@ export function ConnectFlowCard({
   const steps = resolveConnectSteps(connectFlow, purpose);
   const statusTone = running ? "blue" : mode === "repair" ? "attention" : "blue";
   const statusLabel = running ? "Waiting for approval" : mode === "repair" ? "Repair required" : "Connection required";
-  const showManualLink = connectFlow.authorize_url !== null || running || failed;
+  const showManualLink = manualHref !== null;
   const titleCopy = headline ?? connectFlow.title;
   const detailCopy = detail ?? connectFlow.detail;
   if (minimal) {

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.790"
+version = "2.0.791"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.790"
+version = "2.0.791"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/src/codex_plugin_scanner/guard/cli/protect_approvals.py

@@ -81,6 +81,8 @@ def _queue_local_protect_approvals(
 def _should_queue_local_protect_approval(response_payload: dict[str, object]) -> bool:
     if os.environ.get(SHIM_PROBE_ENV_VAR) == SHIM_PROBE_ENV_VALUE:
         return False
+    if os.environ.get("PYTEST_CURRENT_TEST") and os.environ.get("HOL_GUARD_TEST_SKIP_LOCAL_APPROVAL_QUEUE") == "1":
+        return False
     return not _protect_has_reason_code(response_payload, "saved_package_block")
 
 

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -245,6 +245,7 @@ class _GuardDaemonHttpServer(ThreadingHTTPServer):
     package_firewall_connect_state_lock: threading.Lock
     guard_cloud_connect_state: dict[str, object] | None
     guard_cloud_connect_state_lock: threading.Lock
+    guard_cloud_browser_session_lock: threading.Lock
     package_firewall_action_rate_limiter: PackageFirewallActionRateLimiter
     package_firewall_session_nonces: dict[str, float]
     package_firewall_session_nonces_lock: threading.Lock
@@ -277,6 +278,7 @@ class _GuardDaemonHttpServer(ThreadingHTTPServer):
         self.package_firewall_connect_state_lock = threading.Lock()
         self.guard_cloud_connect_state = None
         self.guard_cloud_connect_state_lock = threading.Lock()
+        self.guard_cloud_browser_session_lock = threading.Lock()
         self.package_firewall_action_rate_limiter = PackageFirewallActionRateLimiter()
         self.package_firewall_session_nonces = {}
         self.package_firewall_session_nonces_lock = threading.Lock()
@@ -679,6 +681,25 @@ def _set_package_firewall_connect_state(server: _GuardDaemonHttpServer, state: d
         server.package_firewall_connect_state = dict(state) if isinstance(state, dict) else None
 
 
+def _guard_cloud_connect_state_is_in_flight(state: dict[str, object] | None) -> TypeGuard[dict[str, object]]:
+    return isinstance(state, dict) and str(state.get("state") or "") in {"starting", "running"}
+
+
+def _begin_package_firewall_connect_state(
+    server: _GuardDaemonHttpServer,
+    starting_state: dict[str, object],
+) -> tuple[bool, dict[str, object]]:
+    with server.guard_cloud_browser_session_lock:
+        current = _copy_package_firewall_connect_state(server)
+        if _guard_cloud_connect_state_is_in_flight(current):
+            return False, dict(current)
+        current = _copy_guard_cloud_connect_state(server)
+        if _guard_cloud_connect_state_is_in_flight(current):
+            return False, dict(current)
+        _set_package_firewall_connect_state(server, starting_state)
+        return True, dict(starting_state)
+
+
 def _default_package_firewall_connect_flow(
     *,
     store: GuardStore,
@@ -772,9 +793,14 @@ def _resolve_package_firewall_connect_flow(
     reason = str(entitlement.get("reason") or "").strip().lower()
     if reason not in {"guard_cloud_connect_required", "guard_cloud_reconnect_required"}:
         return None
-    current = _copy_package_firewall_connect_state(server)
-    if current is None:
-        current = _copy_guard_cloud_connect_state(server)
+    package_current = _copy_package_firewall_connect_state(server)
+    cloud_current = _copy_guard_cloud_connect_state(server)
+    if _guard_cloud_connect_state_is_in_flight(cloud_current):
+        current = cloud_current
+    elif package_current is not None:
+        current = package_current
+    else:
+        current = cloud_current
     if current is None:
         return _default_package_firewall_connect_flow(store=server.store, reason=reason)
     state = str(current.get("state") or "idle")
@@ -782,7 +808,7 @@ def _resolve_package_firewall_connect_flow(
         **_default_package_firewall_connect_flow(store=server.store, reason=reason),
         **current,
     }
-    if state == "running":
+    if state in {"starting", "running"}:
         flow["title"] = "Finish Guard Cloud sign-in in your browser"
         browser_opened = flow.get("browser_opened") is True
         flow["detail"] = (
@@ -790,8 +816,12 @@ def _resolve_package_firewall_connect_flow(
             "unlock package-firewall controls automatically."
             if browser_opened
             else (
-                "HOL Guard is waiting for browser approval. Open the sign-in page below if your browser did "
-                "not open automatically."
+                "HOL Guard is opening the secure sign-in flow in your browser."
+                if state == "starting"
+                else (
+                    "HOL Guard is waiting for browser approval. Open the sign-in page below if your browser did "
+                    "not open automatically."
+                )
             )
         )
         flow["poll_after_ms"] = _SUPPLY_CHAIN_CONNECT_POLL_AFTER_MS
@@ -814,6 +844,21 @@ def _set_guard_cloud_connect_state(server: _GuardDaemonHttpServer, state: dict[s
         server.guard_cloud_connect_state = dict(state) if isinstance(state, dict) else None
 
 
+def _begin_guard_cloud_connect_state(
+    server: _GuardDaemonHttpServer,
+    starting_state: dict[str, object],
+) -> tuple[bool, dict[str, object]]:
+    with server.guard_cloud_browser_session_lock:
+        current = _copy_guard_cloud_connect_state(server)
+        if _guard_cloud_connect_state_is_in_flight(current):
+            return False, dict(current)
+        current = _copy_package_firewall_connect_state(server)
+        if _guard_cloud_connect_state_is_in_flight(current):
+            return False, dict(current)
+        _set_guard_cloud_connect_state(server, starting_state)
+        return True, dict(starting_state)
+
+
 def _guard_cloud_connect_repair_mode_from_health(oauth_health: dict[str, object]) -> bool:
     return bool(oauth_health.get("configured")) and str(oauth_health.get("state") or "") == "degraded"
 
@@ -864,7 +909,9 @@ def _resolve_guard_cloud_connect_flow(*, server: _GuardDaemonHttpServer, store:
     if not _guard_cloud_connect_required_for_insights(store):
         return None
     repair_mode = _guard_cloud_connect_repair_mode(store)
-    current = _copy_guard_cloud_connect_state(server)
+    cloud_current = _copy_guard_cloud_connect_state(server)
+    package_current = _copy_package_firewall_connect_state(server)
+    current = package_current if _guard_cloud_connect_state_is_in_flight(package_current) else cloud_current
     if current is None:
         return _default_guard_cloud_connect_flow(store=store, repair_mode=repair_mode)
     state = str(current.get("state") or "idle")
@@ -872,7 +919,7 @@ def _resolve_guard_cloud_connect_flow(*, server: _GuardDaemonHttpServer, store:
         **_default_guard_cloud_connect_flow(store=store, repair_mode=repair_mode),
         **current,
     }
-    if state == "running":
+    if state in {"starting", "running"}:
         flow["title"] = "Finish Guard Cloud sign-in in your browser"
         browser_opened = flow.get("browser_opened") is True
         flow["detail"] = (
@@ -880,8 +927,12 @@ def _resolve_guard_cloud_connect_flow(*, server: _GuardDaemonHttpServer, store:
             "unlock public sharing automatically."
             if browser_opened
             else (
-                "HOL Guard is waiting for browser approval. Open the sign-in page below if your browser did "
-                "not open automatically."
+                "HOL Guard is opening the secure sign-in flow in your browser."
+                if state == "starting"
+                else (
+                    "HOL Guard is waiting for browser approval. Open the sign-in page below if your browser did "
+                    "not open automatically."
+                )
             )
         )
         flow["poll_after_ms"] = _SUPPLY_CHAIN_CONNECT_POLL_AFTER_MS
@@ -2549,16 +2600,31 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 status=409,
             )
             return
-        current = _copy_package_firewall_connect_state(self.server)  # type: ignore[arg-type]
-        if isinstance(current, dict) and str(current.get("state") or "") == "running":
-            self._write_json(current, status=202)
-            return
         store = self.server.store  # type: ignore[attr-defined]
         connect_url = _package_firewall_connect_url(store)
         action_label = _package_firewall_connect_action_label(
             reason,
             repair_copy=_package_firewall_connect_needs_repair(store, reason),
         )
+        request_id = f"guard-connect-{uuid.uuid4().hex}"
+        starting_state = {
+            **_default_package_firewall_connect_flow(store=store, reason=reason),
+            "state": "starting",
+            "title": "Opening Guard Cloud sign-in",
+            "detail": "HOL Guard is opening the secure sign-in flow in your browser.",
+            "action_label": action_label,
+            "authorize_url": None,
+            "browser_opened": None,
+            "request_id": request_id,
+            "poll_after_ms": _SUPPLY_CHAIN_CONNECT_POLL_AFTER_MS,
+        }
+        started, current = _begin_package_firewall_connect_state(  # type: ignore[arg-type]
+            self.server,
+            starting_state,
+        )
+        if not started:
+            self._write_json(current, status=202)
+            return
         try:
             prepare_guard_cloud_connect_authorization(store)
             device = store.get_device_metadata()
@@ -2580,7 +2646,6 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             self._write_json(failure, status=500)
             return
 
-        request_id = f"guard-connect-{uuid.uuid4().hex}"
         running_state = {
             **_default_package_firewall_connect_flow(store=store, reason=reason),
             "state": "running",
@@ -2719,12 +2784,27 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             )
             return
         repair_mode = _guard_cloud_connect_repair_mode(store)
-        current = _copy_guard_cloud_connect_state(self.server)  # type: ignore[arg-type]
-        if isinstance(current, dict) and str(current.get("state") or "") == "running":
-            self._write_json({"connect_required": True, "connect_flow": current}, status=202)
-            return
         connect_url = _package_firewall_connect_url(store)
         action_label = "Repair Guard Cloud access" if repair_mode else "Connect Guard Cloud"
+        request_id = f"guard-connect-{uuid.uuid4().hex}"
+        starting_state = {
+            **_default_guard_cloud_connect_flow(store=store, repair_mode=repair_mode),
+            "state": "starting",
+            "title": "Opening Guard Cloud sign-in",
+            "detail": "HOL Guard is opening the secure sign-in flow in your browser.",
+            "action_label": action_label,
+            "authorize_url": None,
+            "browser_opened": None,
+            "request_id": request_id,
+            "poll_after_ms": _SUPPLY_CHAIN_CONNECT_POLL_AFTER_MS,
+        }
+        started, current = _begin_guard_cloud_connect_state(  # type: ignore[arg-type]
+            self.server,
+            starting_state,
+        )
+        if not started:
+            self._write_json({"connect_required": True, "connect_flow": current}, status=202)
+            return
         try:
             prepare_guard_cloud_connect_authorization(store)
             device = store.get_device_metadata()
@@ -2749,7 +2829,6 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             )
             return
 
-        request_id = f"guard-connect-{uuid.uuid4().hex}"
         running_state = {
             **_default_guard_cloud_connect_flow(store=store, repair_mode=repair_mode),
             "state": "running",

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -2706,13 +2706,42 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
 _test_sync_auth_context_override: dict[str, object] | None = None
 
 
+def _test_sync_auth_context_from_env() -> dict[str, object] | None:
+    if not os.environ.get("PYTEST_CURRENT_TEST"):
+        return None
+    raw = os.environ.get("HOL_GUARD_TEST_SYNC_AUTH_CONTEXT_JSON")
+    if raw is None:
+        return None
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError:
+        return None
+    if not isinstance(payload, dict):
+        return None
+    sync_url = payload.get("sync_url")
+    access_token = payload.get("access_token")
+    if not isinstance(sync_url, str) or not isinstance(access_token, str):
+        return None
+    sync_url = _validate_guard_sync_url(sync_url)
+    return {
+        "sync_url": sync_url,
+        "access_token": access_token,
+        "dpop_key_material": None,
+    }
+
+
 def _resolve_guard_sync_auth_context(
     store: GuardStore,
     *,
     allow_primary_repair: bool = True,
 ) -> dict[str, object]:
     if _test_sync_auth_context_override is not None:
-        return dict(_test_sync_auth_context_override)
+        override = dict(_test_sync_auth_context_override)
+        override["sync_url"] = _validate_guard_sync_url(_auth_context_sync_url(override))
+        return override
+    env_override = _test_sync_auth_context_from_env()
+    if env_override is not None:
+        return env_override
     with _guard_sync_auth_lock(store):
         oauth_health = store.get_oauth_local_credential_health()
         oauth_credentials = store.get_oauth_local_credentials(allow_primary=allow_primary_repair)

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py

@@ -656,6 +656,20 @@ def _evaluate_with_cloud(
             None,
         )
     except GuardSyncNotConfiguredError:
+        if bool(store.get_oauth_local_credential_health().get("configured")):
+            return (
+                _cloud_fail_closed_evaluation(
+                    code="cloud_validation_error",
+                    message="Guard cloud evaluation endpoint was not trusted, so this package request needs review.",
+                    artifact=artifact,
+                    targets=targets,
+                    workspace_dir=workspace_dir,
+                    workspace_fingerprint=workspace_fingerprint,
+                    bundle_meta=bundle_meta,
+                    fail_closed_decision=resolve_fail_closed_decision(),
+                ),
+                None,
+            )
         return None, None
     except RuntimeError:
         if can_defer_auth_failure_to_bundle():

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/src/codex_plugin_scanner/guard/store.py

@@ -353,6 +353,9 @@ class SystemKeyringSecretStore:
         backend init error, etc.) is allowed to propagate so callers can surface
         it rather than silently degrading credential storage.
         """
+        test_keyring = SystemKeyringSecretStore._test_keyring_module()
+        if test_keyring is not None:
+            return test_keyring
         try:
             return importlib.import_module("keyring")
         except ModuleNotFoundError as exc:
@@ -378,6 +381,67 @@ class SystemKeyringSecretStore:
             )
             return None
 
+    @staticmethod
+    def _test_keyring_module():
+        if not os.environ.get("PYTEST_CURRENT_TEST"):
+            return None
+        store_path_raw = os.environ.get("HOL_GUARD_TEST_KEYRING_FILE", "").strip()
+        if not store_path_raw:
+            return None
+
+        class _TestKeyringModule:
+            @staticmethod
+            def _store_path() -> Path:
+                return Path(store_path_raw)
+
+            @classmethod
+            def _load(cls) -> dict[tuple[str, str], str]:
+                store_path = cls._store_path()
+                if not store_path.is_file():
+                    return {}
+                payload = json.loads(store_path.read_text(encoding="utf-8"))
+                return {
+                    (str(service_name), str(secret_id)): str(secret_value)
+                    for service_name, secrets in payload.items()
+                    if isinstance(service_name, str) and isinstance(secrets, dict)
+                    for secret_id, secret_value in secrets.items()
+                    if isinstance(secret_id, str) and isinstance(secret_value, str)
+                }
+
+            @classmethod
+            def _persist(cls, secrets: dict[tuple[str, str], str]) -> None:
+                payload: dict[str, dict[str, str]] = {}
+                for (service_name, secret_id), secret_value in secrets.items():
+                    payload.setdefault(service_name, {})[secret_id] = secret_value
+                store_path = cls._store_path()
+                store_path.parent.mkdir(parents=True, exist_ok=True)
+                store_path.write_text(json.dumps(payload, sort_keys=True, separators=(",", ":")), encoding="utf-8")
+
+            @staticmethod
+            def get_keyring():
+                class _Backend:
+                    priority = 1
+
+                return _Backend()
+
+            @classmethod
+            def set_password(cls, service_name: str, secret_id: str, value: str) -> None:
+                secrets = cls._load()
+                secrets[(service_name, secret_id)] = value
+                cls._persist(secrets)
+
+            @classmethod
+            def get_password(cls, service_name: str, secret_id: str) -> str | None:
+                return cls._load().get((service_name, secret_id))
+
+            @classmethod
+            def delete_password(cls, service_name: str, secret_id: str) -> None:
+                secrets = cls._load()
+                secrets.pop((service_name, secret_id), None)
+                cls._persist(secrets)
+
+        return _TestKeyringModule
+
     @staticmethod
     def _load_macos_keyring_api_module():
         from keyring.backends.macOS import api as macos_keyring_api
@@ -487,6 +551,8 @@ class SystemKeyringSecretStore:
 
     @classmethod
     def _is_available(cls) -> bool:
+        if cls._test_keyring_module() is not None:
+            return True
         if not cls._backend_is_available():
             return False
         if sys.platform == "darwin" and not cls._macos_default_keychain_is_usable():
@@ -2948,7 +3014,11 @@ class GuardStore:
                     key_id=key_id,
                     trusted_generation=_mapping_int(state, "generation"),
                 )
-                if integrity_result.status == "valid":
+                if integrity_result.status == "valid" or _warn_only_policy_integrity_status(
+                    integrity_result.status,
+                    state,
+                    source=str(candidate["source"]),
+                ):
                     selected_payload = self._policy_row_payload(
                         candidate,
                         integrity_result=integrity_result,
@@ -6237,12 +6307,12 @@ def _scoped_runtime_row_requires_exact_match(
 def _warn_only_policy_integrity_status(status: str, state: Mapping[str, object], *, source: str = "local") -> bool:
     if state.get("enforcement") != "warn":
         return False
+    if source != "approval-gate":
+        return False
     if status == "missing_integrity":
         return True
     if status != "degraded_mode":
         return False
-    if source != "approval-gate":
-        return False
     reasons = state.get("degraded_reasons")
     if not isinstance(reasons, list):
         return False

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.790"
+__version__ = "2.0.791"

{plugin_scanner-2.0.790 → plugin_scanner-2.0.791}/tests/test_guard_config_paths.py

@@ -400,7 +400,14 @@ def test_resolve_guard_home_does_not_migrate_retired_legacy_credentials(tmp_path
     legacy_home = home_dir / ".ai-plugin-scanner-guard"
     GuardStore(canonical_home)
     legacy_store = GuardStore(legacy_home)
-    _seed_guard_cloud(legacy_store)
+    legacy_store.set_sync_payload(
+        "credentials",
+        {
+            "sync_url": "https://hol.org/api/guard/receipts/sync",
+            "access_token": "demo-token",
+        },
+        "2026-05-19T00:00:00Z",
+    )
     monkeypatch.setattr(Path, "home", lambda: home_dir)
 
     resolved_home = resolve_guard_home()