plugin-scanner 2.0.795__tar.gz → 2.0.797__tar.gz

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.795
+Version: 2.0.797
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.795"
+version = "2.0.797"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.795"
+version = "2.0.797"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/cli.py

@@ -254,6 +254,7 @@ def _resolve_legacy_args(
         "allow",
         "deny",
         "policies",
+        "trust",
         "settings",
         "exceptions",
         "advisories",

plugin_scanner-2.0.797/src/codex_plugin_scanner/guard/cli/commands_dispatch_trust.py

@@ -0,0 +1,155 @@
+"""Guard local trust CLI dispatch helpers."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+from typing import TextIO
+
+from ..adapters.base import HarnessContext
+from ..config import GuardConfig
+from ..local_trust_contract import TrustStatus
+from ..store import GuardStore
+from .commands_support_interaction import _emit
+
+
+def _now() -> str:
+    from ._commands_shared import _now as _shared_now
+
+    return _shared_now()
+
+
+def _require_guard_store(store: GuardStore | None) -> GuardStore:
+    from ._commands_shared import _require_guard_store as _shared_require_guard_store
+
+    return _shared_require_guard_store(store)
+
+
+def _degraded_safe_trust_status() -> dict[str, object]:
+    return TrustStatus(
+        runtime_protection="degraded",
+        remembered_rules="disabled_degraded",
+        cloud_policies="setup_unavailable",
+        backend="degraded-safe",
+        setup_available=False,
+    ).to_dict()
+
+
+def _unsupported_backend_payload(*, command: str, backend: str) -> dict[str, object]:
+    return {
+        "generated_at": _now(),
+        "command": command,
+        "backend_requested": backend,
+        "backend": backend,
+        "runtime_protection": "degraded",
+        "remembered_rules": "disabled_degraded",
+        "cloud_policies": "setup_unavailable",
+        "degraded_reasons": ["trust_backend_unavailable"],
+        "degraded_reason_labels": {"trust_backend_unavailable": "Local trust backend unavailable"},
+        "setup_available": backend == "macos-native",
+        "no_ui_passive": True,
+        "passive_prompt_allowed": False,
+        "one_time_approvals": "available",
+        "durable_local_rules": "limited",
+        "cloud_policy_authority": "setup_unavailable",
+        "error": (
+            f"Backend {backend!r} is not available for passive {command}. "
+            "Guard will not probe it in the background because that could open an OS credential prompt."
+        ),
+        "next_action": "Use --backend auto or run an explicit setup command when a backend is available.",
+    }
+
+
+def _trust_status_payload(store: GuardStore, *, command: str, backend: str) -> dict[str, object]:
+    if backend == "degraded-safe":
+        trust_status = _degraded_safe_trust_status()
+    else:
+        status_payload = store.get_policy_integrity_status()
+        trust_status = status_payload.get("trust_status")
+        if not isinstance(trust_status, dict):
+            trust_status = TrustStatus.from_policy_integrity_state(status_payload).to_dict()
+    degraded_reasons = trust_status.get("degraded_reasons")
+    reasons = (
+        [reason for reason in degraded_reasons if isinstance(reason, str)] if isinstance(degraded_reasons, list) else []
+    )
+    runtime_protection = str(trust_status.get("runtime_protection") or "unknown")
+    remembered_rules = str(trust_status.get("remembered_rules") or "unknown")
+    cloud_policies = str(trust_status.get("cloud_policies") or "unknown")
+    return {
+        "generated_at": _now(),
+        "command": command,
+        "backend_requested": backend,
+        "backend": trust_status.get("backend") or "unknown",
+        "runtime_protection": runtime_protection,
+        "remembered_rules": remembered_rules,
+        "cloud_policies": cloud_policies,
+        "degraded_reasons": reasons,
+        "degraded_reason_labels": trust_status.get("degraded_reason_labels") or {},
+        "setup_available": bool(trust_status.get("setup_available")),
+        "no_ui_passive": True,
+        "passive_prompt_allowed": False,
+        "one_time_approvals": "available",
+        "durable_local_rules": "enforced" if remembered_rules == "enforced" else "limited",
+        "cloud_policy_authority": cloud_policies,
+        "message": (
+            "Guard is blocking risky actions. Broad remembered local rules are limited until local trust is protected."
+            if remembered_rules != "enforced"
+            else "Guard local trust is protected. Remembered local rules are enforced."
+        ),
+    }
+
+
+def _run_guard_trust_command(
+    args: argparse.Namespace,
+    *,
+    guard_home: Path | None = None,
+    workspace: Path | None = None,
+    context: HarnessContext | None = None,
+    store: GuardStore | None = None,
+    config: GuardConfig | None = None,
+    input_text: str | None = None,
+    output_stream: TextIO | None = None,
+) -> int:
+    del guard_home, workspace, context, config, input_text, output_stream
+    store = _require_guard_store(store)
+    trust_command = getattr(args, "trust_command", None) or "status"
+    backend = str(getattr(args, "backend", None) or "auto")
+    if backend == "macos-native" and trust_command in {"status", "doctor", "test"}:
+        payload = _unsupported_backend_payload(command=trust_command, backend=backend)
+        _emit(f"trust.{trust_command}", payload, getattr(args, "json", False))
+        return 2
+    payload = _trust_status_payload(store, command=trust_command, backend=backend)
+    if trust_command in {"status", "doctor"}:
+        _emit(f"trust.{trust_command}", payload, getattr(args, "json", False))
+        return 0
+    if trust_command == "test":
+        if not bool(getattr(args, "no_ui", False)):
+            payload["error"] = "Use --no-ui so Guard can prove this probe will not open an OS credential prompt."
+            _emit("trust.test", payload, getattr(args, "json", False))
+            return 2
+        payload["probe"] = "passive_no_ui"
+        payload["ok"] = payload["passive_prompt_allowed"] is False
+        payload["trust_health"] = "protected" if payload["remembered_rules"] == "enforced" else "degraded_safe"
+        _emit("trust.test", payload, getattr(args, "json", False))
+        return 0
+    if trust_command in {"setup", "reset"}:
+        if backend == "macos-native":
+            payload["error"] = (
+                f"macOS native trust {trust_command} is not enabled yet. Passive checks remain no-UI and degraded-safe."
+            )
+            payload["next_action"] = "Use one-time approvals or Guard Cloud policies until native setup is available."
+        elif trust_command == "setup":
+            payload["error"] = "No explicit local trust backend is available for setup on this platform."
+            payload["next_action"] = "Runtime protection remains active. Broad remembered local rules stay limited."
+        else:
+            payload["error"] = "No explicit local trust backend is active to reset."
+            payload["next_action"] = "Nothing changed."
+        _emit(f"trust.{trust_command}", payload, getattr(args, "json", False))
+        return 2
+    _emit("trust", {"error": "Use: hol-guard guard trust status|doctor|test|setup|reset"}, getattr(args, "json", False))
+    return 2
+
+
+__all__ = [
+    "_run_guard_trust_command",
+]

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/guard/cli/commands_parser.py

@@ -51,7 +51,7 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
         parser_class=FriendlyArgumentParser,
         metavar=(
             "{start,status,dashboard,init,apps,bootstrap,detect,install,update,uninstall,package-shims,run,protect,preflight,scan,diff,"
-            "receipts,inventory,abom,aibom,approvals,explain,allow,deny,policies,exceptions,advisories,events,doctor,connect,"
+            "receipts,inventory,abom,aibom,approvals,explain,allow,deny,policies,trust,exceptions,advisories,events,doctor,connect,"
             "remote-pair,disconnect,"
             "login,sync,device,commands,bridge}"
         ),

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/guard/cli/commands_parser_policy.py

@@ -62,6 +62,27 @@ def _configure_guard_policy_parsers(
     _add_guard_common_args(policies_parser)
     policies_parser.add_argument("--json", action="store_true")
 
+    trust_parser = guard_subparsers.add_parser("trust", help="Inspect local trust without passive OS prompts")
+    trust_parser.add_argument(
+        "trust_command",
+        nargs="?",
+        default="status",
+        choices=("status", "doctor", "test", "setup", "reset"),
+    )
+    trust_parser.add_argument(
+        "--backend",
+        choices=("auto", "degraded-safe", "macos-native"),
+        default="auto",
+        help="Local trust backend to inspect or set up.",
+    )
+    trust_parser.add_argument(
+        "--no-ui",
+        action="store_true",
+        help="Run only bounded no-user-interaction checks.",
+    )
+    _add_guard_common_args(trust_parser)
+    trust_parser.add_argument("--json", action="store_true")
+
     settings_parser = guard_subparsers.add_parser("settings", help="Show or update local Guard settings")
     _add_guard_common_args(settings_parser)
     settings_parser.add_argument("--json", action="store_true")

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/guard/cli/commands_router.py

@@ -50,6 +50,7 @@ _COMMON_HANDLERS = {
     "aibom": "_run_guard_aibom_command",
     "abom": "_run_guard_abom_command",
     "policies": "_run_guard_policies_command",
+    "trust": "_run_guard_trust_command",
     "settings": "_run_guard_settings_command",
     "exceptions": "_run_guard_exceptions_command",
     "advisories": "_run_guard_advisories_command",

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/guard/cli/commands_support.py

@@ -30,6 +30,7 @@ from . import commands_support_service as _commands_support_service
 from . import commands_dispatch_local as _commands_dispatch_local
 from . import commands_dispatch_proxy as _commands_dispatch_proxy
 from . import commands_dispatch_records as _commands_dispatch_records
+from . import commands_dispatch_trust as _commands_dispatch_trust
 from . import commands_dispatch_admin as _commands_dispatch_admin
 from . import commands_dispatch_cloud as _commands_dispatch_cloud
 from . import commands_hook_copilot as _commands_hook_copilot
@@ -63,6 +64,7 @@ _SOURCE_MODULES: tuple[ModuleType, ...] = (
     _commands_dispatch_local,
     _commands_dispatch_proxy,
     _commands_dispatch_records,
+    _commands_dispatch_trust,
     _commands_dispatch_admin,
     _commands_dispatch_cloud,
     _commands_hook_copilot,

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/guard/local_trust_contract.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import json
 import multiprocessing
 import os
 import pickle
@@ -140,6 +139,10 @@ class TrustBackendProcessFailedError(RuntimeError):
     """Raised when passive trust backend worker exits without a readable result."""
 
 
+class TrustBackendCorruptResultError(ValueError):
+    """Raised when passive trust backend worker writes malformed result data."""
+
+
 def _trust_backend_check_worker(
     operation: Callable[[], object],
     result_path: str,
@@ -193,6 +196,24 @@ def _trust_backend_process_failed_error(process: _ProcessHandle) -> TrustBackend
     return TrustBackendProcessFailedError("trust_backend_process_failed")
 
 
+def _load_trust_backend_result(result_file: Path) -> tuple[bool, object]:
+    try:
+        with result_file.open("rb") as handle:
+            payload = pickle.load(handle)
+    except PermissionError:
+        raise
+    except Exception as error:
+        raise TrustBackendCorruptResultError("trust_backend_result_corrupt") from error
+    if not isinstance(payload, tuple) or len(payload) != 2:
+        raise TrustBackendCorruptResultError("trust_backend_result_corrupt")
+    ok, value = payload
+    if not isinstance(ok, bool):
+        raise TrustBackendCorruptResultError("trust_backend_result_corrupt")
+    if not ok and not isinstance(value, BaseException):
+        raise TrustBackendCorruptResultError("trust_backend_result_corrupt")
+    return ok, value
+
+
 def select_trust_backend(
     backends: tuple[TrustBackend, ...],
     *,
@@ -242,9 +263,8 @@ def run_trust_backend_check(
                 return timeout_result
             return on_error(_trust_backend_process_failed_error(process))
         try:
-            with result_file.open("rb") as handle:
-                ok, value = pickle.load(handle)
-        except (EOFError, OSError, pickle.UnpicklingError) as error:
+            ok, value = _load_trust_backend_result(result_file)
+        except (PermissionError, TrustBackendCorruptResultError) as error:
             if on_error is None:
                 return timeout_result
             return on_error(error)
@@ -264,7 +284,7 @@ def degraded_reason_for_backend_error(error: BaseException) -> str:
         return POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
     if isinstance(error, PermissionError):
         return POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED
-    if isinstance(error, (ValueError, json.JSONDecodeError)):
+    if isinstance(error, ValueError):
         return POLICY_INTEGRITY_REASON_BACKEND_CORRUPT
     return POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
 

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.795"
+__version__ = "2.0.797"

{plugin_scanner-2.0.795 → plugin_scanner-2.0.797}/tests/test_guard_policy_integrity.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import base64
 import json
+import pickle
 import sqlite3
 import sys
 import time
@@ -13,7 +14,7 @@ from typing import cast
 
 import pytest
 
-from codex_plugin_scanner.cli import main
+from codex_plugin_scanner.cli import _resolve_legacy_args, main
 from codex_plugin_scanner.guard import local_trust_contract as local_trust_contract_module
 from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.local_trust_contract import (
@@ -28,6 +29,7 @@ from codex_plugin_scanner.guard.local_trust_contract import (
     POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED,
     POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,
     POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE,
+    TrustBackendCorruptResultError,
     TrustBackendProcessFailedError,
     TrustBackendUnavailableError,
     TrustStatus,
@@ -100,6 +102,14 @@ def _write_corrupt_trust_result(operation, result_path: str) -> None:
     Path(result_path).write_bytes(b"not a pickle")
 
 
+def _write_malformed_trust_result(operation, result_path: str) -> None:
+    Path(result_path).write_bytes(pickle.dumps({"ok": True}))
+
+
+def _write_list_trust_result(operation, result_path: str) -> None:
+    Path(result_path).write_bytes(pickle.dumps([True, {"mode": "protected"}]))
+
+
 def _skip_trust_result(operation, result_path: str) -> None:
     operation()
 
@@ -272,10 +282,99 @@ def test_trust_backend_check_handles_corrupt_result_file(
         lambda: {"mode": "protected"},
         timeout_seconds=1.0,
         timeout_result={"mode": "degraded"},
-        on_error=lambda error: {"mode": "degraded", "error": error.__class__.__name__},
+        on_error=lambda error: {
+            "mode": "degraded",
+            "error": error.__class__.__name__,
+            "reason": degraded_reason_for_backend_error(error),
+        },
     )
 
-    assert result == {"mode": "degraded", "error": "UnpicklingError"}
+    assert result == {
+        "mode": "degraded",
+        "error": "TrustBackendCorruptResultError",
+        "reason": POLICY_INTEGRITY_REASON_BACKEND_CORRUPT,
+    }
+
+
+def test_trust_backend_check_rejects_malformed_result_payload(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(local_trust_contract_module, "_trust_backend_check_worker", _write_malformed_trust_result)
+
+    result = run_trust_backend_check(
+        lambda: {"mode": "protected"},
+        timeout_seconds=1.0,
+        timeout_result={"mode": "degraded"},
+        on_error=lambda error: {
+            "mode": "degraded",
+            "error": error.__class__.__name__,
+            "reason": degraded_reason_for_backend_error(error),
+        },
+    )
+
+    assert result == {
+        "mode": "degraded",
+        "error": "TrustBackendCorruptResultError",
+        "reason": POLICY_INTEGRITY_REASON_BACKEND_CORRUPT,
+    }
+
+
+def test_trust_backend_check_rejects_list_result_payload(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(local_trust_contract_module, "_trust_backend_check_worker", _write_list_trust_result)
+
+    result = run_trust_backend_check(
+        lambda: {"mode": "protected"},
+        timeout_seconds=1.0,
+        timeout_result={"mode": "degraded"},
+        on_error=lambda error: {
+            "mode": "degraded",
+            "error": error.__class__.__name__,
+            "reason": degraded_reason_for_backend_error(error),
+        },
+    )
+
+    assert result == {
+        "mode": "degraded",
+        "error": "TrustBackendCorruptResultError",
+        "reason": POLICY_INTEGRITY_REASON_BACKEND_CORRUPT,
+    }
+
+
+def test_trust_backend_result_loader_preserves_permission_denied() -> None:
+    class PermissionDeniedResultPath:
+        def open(self, mode: str = "rb"):
+            raise PermissionError("denied")
+
+    with pytest.raises(PermissionError):
+        local_trust_contract_module._load_trust_backend_result(cast(Path, PermissionDeniedResultPath()))
+
+
+def test_trust_backend_check_handles_result_permission_denied(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def denied_loader(result_file: Path):
+        raise PermissionError("denied")
+
+    monkeypatch.setattr(local_trust_contract_module, "_load_trust_backend_result", denied_loader)
+
+    result = run_trust_backend_check(
+        lambda: {"mode": "protected"},
+        timeout_seconds=1.0,
+        timeout_result={"mode": "degraded"},
+        on_error=lambda error: {
+            "mode": "degraded",
+            "error": error.__class__.__name__,
+            "reason": degraded_reason_for_backend_error(error),
+        },
+    )
+
+    assert result == {
+        "mode": "degraded",
+        "error": "PermissionError",
+        "reason": POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED,
+    }
 
 
 def test_trust_backend_check_reports_missing_result_with_exit_code(
@@ -371,6 +470,10 @@ def test_trust_backend_errors_normalize_to_safe_degraded_reasons() -> None:
         degraded_reason_for_backend_error(TrustBackendProcessFailedError("worker died"))
         == POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
     )
+    assert (
+        degraded_reason_for_backend_error(TrustBackendCorruptResultError("bad result"))
+        == POLICY_INTEGRITY_REASON_BACKEND_CORRUPT
+    )
     assert (
         degraded_reason_for_backend_error(PermissionError("denied"))
         == POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED
@@ -1170,6 +1273,134 @@ def test_policies_cli_verify_status_migrate_and_repair(
     assert GuardStore(home_dir).list_policy_decisions() == []
 
 
+def test_trust_cli_status_reports_no_passive_prompts(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+    rc = main(["guard", "trust", "status", "--home", str(home_dir), "--json"])
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 0
+    assert payload["command"] == "status"
+    assert payload["no_ui_passive"] is True
+    assert payload["passive_prompt_allowed"] is False
+    assert payload["runtime_protection"] in {"protected", "degraded", "unknown"}
+    assert payload["remembered_rules"] in {"enforced", "disabled_degraded", "unknown"}
+    assert payload["one_time_approvals"] == "available"
+    assert payload["durable_local_rules"] in {"enforced", "limited"}
+    assert "key_id" not in payload
+    assert "last_proof" not in payload
+
+
+def test_trust_cli_bare_combined_command_routes_to_guard() -> None:
+    assert _resolve_legacy_args(["trust", "status", "--json"], program_mode="combined") == [
+        "guard",
+        "trust",
+        "status",
+        "--json",
+    ]
+
+
+def test_trust_cli_no_ui_probe_requires_no_ui_flag(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+
+    missing_flag_rc = main(["guard", "trust", "test", "--home", str(home_dir), "--json"])
+    missing_flag_payload = json.loads(capsys.readouterr().out)
+    assert missing_flag_rc == 2
+    assert "Use --no-ui" in missing_flag_payload["error"]
+    assert missing_flag_payload["passive_prompt_allowed"] is False
+
+    no_ui_rc = main(["guard", "trust", "test", "--home", str(home_dir), "--no-ui", "--json"])
+    no_ui_payload = json.loads(capsys.readouterr().out)
+    assert no_ui_rc == 0
+    assert no_ui_payload["probe"] == "passive_no_ui"
+    assert no_ui_payload["ok"] is True
+    assert no_ui_payload["passive_prompt_allowed"] is False
+    assert no_ui_payload["trust_health"] in {"protected", "degraded_safe"}
+
+
+def test_trust_cli_rejects_unavailable_backend_status(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "status",
+            "--backend",
+            "macos-native",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 2
+    assert payload["backend_requested"] == "macos-native"
+    assert "not available for passive status" in payload["error"]
+    assert payload["passive_prompt_allowed"] is False
+
+
+def test_trust_cli_degraded_safe_backend_is_explicit(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "status",
+            "--backend",
+            "degraded-safe",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 0
+    assert payload["backend_requested"] == "degraded-safe"
+    assert payload["backend"] == "degraded-safe"
+    assert payload["remembered_rules"] == "disabled_degraded"
+    assert payload["durable_local_rules"] == "limited"
+
+
+def test_trust_cli_macos_native_setup_is_explicitly_unavailable(tmp_path: Path, capsys) -> None:
+    home_dir = tmp_path / "home"
+    rc = main(
+        [
+            "guard",
+            "trust",
+            "setup",
+            "--backend",
+            "macos-native",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    payload = json.loads(capsys.readouterr().out)
+
+    assert rc == 2
+    assert payload["backend_requested"] == "macos-native"
+    assert "not enabled yet" in payload["error"]
+    assert "trust setup" in payload["error"]
+    assert payload["passive_prompt_allowed"] is False
+
+    reset_rc = main(
+        [
+            "guard",
+            "trust",
+            "reset",
+            "--backend",
+            "macos-native",
+            "--home",
+            str(home_dir),
+            "--json",
+        ]
+    )
+    reset_payload = json.loads(capsys.readouterr().out)
+    assert reset_rc == 2
+    assert "trust reset" in reset_payload["error"]
+
+
 def test_policies_cli_verify_returns_nonzero_for_rollback_detected(tmp_path: Path, capsys) -> None:
     home_dir = tmp_path / "home"
     store = GuardStore(home_dir)