plugin-scanner 2.0.912__tar.gz → 2.0.913__tar.gz

{plugin_scanner-2.0.912 → plugin_scanner-2.0.913}/.gitignore

@@ -50,3 +50,4 @@ Thumbs.db
 .env.*
 !.env.example
 .worktrees/
+.venv

plugin_scanner-2.0.913/.pr-body.md

@@ -0,0 +1,39 @@
+# Fast Secure Hook Review Engine for Pi/OMP
+
+## Summary
+
+Add a daemon-resident, typed hook review engine that targets ~200ms p95 for safe source-file reads while preserving local-first security.
+
+## Changes
+
+### New modules
+
+- `runtime/hook_review_types.py` — `HookReviewRequest`/`HookReviewResponse` typed API with `to_harness_json()` serialization
+- `runtime/hook_content_scanner.py` — bounded streaming secret scanner wrapping `classify_secret_content()` with byte/match/deadline budgets and rolling context windows
+- `runtime/source_paths.py` — shared source-path classification refactored from CLI `commands_support_codex_paths.py` (old functions kept as thin wrappers)
+- `runtime/hook_decision_cache.py` — exact source-read cache wrapper around existing `scanner_cache` with config/policy fingerprint invalidation
+- `runtime/hook_source_read.py` — source-read fast-path evaluator with TOCTOU guard (stat-before/read/stat-after), output hash verification, symlink/sensitive-path rejection
+- `runtime/hook_review_engine.py` — resident decision core with fail-safe deny/block on any exception
+- `daemon/hook_worker.py` — resident HTTP payload handler that avoids CLI startup cost
+- `daemon/hook_metrics.py` — in-memory metrics recorder (stores only buckets and counters, never raw content)
+
+### Modified files
+
+- `runtime/secret_sensitivity.py` — added `secret_content_rule_version()` for cache invalidation
+- `cli/commands_support_codex_paths.py` — path functions refactored to delegate to `runtime/source_paths.py`
+- `store_policy.py` — added `policy_fingerprint()` for cache invalidation
+- `daemon/server.py` — `_handle_runtime_hook` split into fast worker + legacy CLI paths behind `HOL_GUARD_HOOK_FAST_PATH=1` feature flag
+
+## Security
+
+- Never trusts `guard_source_ref` alone; re-reads, re-stats, re-hashes files
+- Never allows original output without exact hash match
+- Never calls LLM or network in the hot path
+- Fail-safe deny/block on timeout, exception, cache miss, scanner budget exhaustion
+- Cache invalidates on content, stat, policy, config, or scanner version changes
+- Metrics/receipts contain no raw output, prompt text, or secret samples
+- Legacy CLI path unchanged when feature flag is disabled
+
+## Tests
+
+144 tests pass across all new modules. Existing Pi adapter, payload reference, and daemon surface server tests continue passing.

{plugin_scanner-2.0.912 → plugin_scanner-2.0.913}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.912
+Version: 2.0.913
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.913/docs/guard/hook-review-engine.md

@@ -0,0 +1,79 @@
+# Hook Review Engine
+
+## Architecture
+
+The hook review engine is a daemon-resident, typed decision core that avoids Python startup/import cost and CLI command layering for normal hook decisions.
+
+## Components
+
+### `HookReviewRequest` / `HookReviewResponse`
+
+The typed API contract between adapters, the daemon worker, the CLI fallback, and the engine. Defined in `runtime/hook_review_types.py`.
+
+Key fields:
+- `model_output_action`: Controls what the adapter does with the output (`allow_original`, `replace_with_reviewed_excerpt`, `block`, `not_applicable`)
+- `reviewed_output_sha256`: The hash the adapter must verify before preserving original content
+- `reason_code`: Machine-readable reason for the decision
+
+### `ContentScanner`
+
+A bounded streaming scanner wrapping `classify_secret_content()` with:
+- Byte budget (`max_bytes`)
+- Match limit (`HOOK_SCANNER_MAX_MATCHES`)
+- Wall-clock deadline (`deadline_monotonic`)
+- Rolling context window (`HOOK_SCANNER_CONTEXT_CHARS`)
+
+Never produces secret sample text. Never runs an LLM. Never calls the network.
+
+### `HookDecisionCache`
+
+Exact source-read cache using the existing `scanner_cache` SQLite table. Cache key includes:
+- Content hash, stat metadata (dev, ino, size, mtime_ns)
+- Scanner version, source classifier version
+- Policy fingerprint, config fingerprint
+- Harness, event, realpath, workspace
+
+Any change in any field invalidates the cache entry.
+
+### `evaluate_source_file_ref()`
+
+The source-read fast-path evaluator with:
+- Shape validation (event, source ref, action type, target paths)
+- Path resolution and sensitive path rejection
+- TOCTOU guard (stat-before/read/stat-after)
+- Output hash verification
+- Streaming scan
+- Cache check and save
+
+### `HookReviewEngine`
+
+The resident decision core:
+1. Loads config
+2. Normalizes payload into `GuardActionEnvelope`
+3. Tries source-read fast path for PostToolUse with `guard_source_ref`
+4. Falls back to standard path for non-source or inconclusive requests
+5. Fail-safe deny/block on any exception
+
+### `HookWorker`
+
+The daemon HTTP handler:
+- Builds `HookReviewRequest` from HTTP payload
+- Calls `HookReviewEngine.review()`
+- Returns `HookReviewResponse.to_harness_json()`
+- Never calls `run_guard_command()`
+
+## Budgets
+
+```python
+HOOK_ENGINE_TOTAL_BUDGET_MS = 9000      # Total budget under the 10s timeout
+HOOK_ENGINE_NORMAL_BUDGET_MS = 1000    # Normal decision target
+HOOK_SOURCE_FAST_PATH_BUDGET_MS = 250   # Source-read fast path budget
+HOOK_SCANNER_DEFAULT_BUDGET_MS = 750    # Scanner budget
+ARBITRARY_STDOUT_FULL_ALLOW_BYTES = 256 * 1024  # Max arbitrary stdout for full allow
+```
+
+## Integration Points
+
+- **Daemon**: `daemon/server.py` `_handle_runtime_hook()` dispatches to fast worker or legacy CLI
+- **CLI**: `cli/commands_hook.py` `_try_source_ref_fast_path()` calls the engine for source-ref payloads
+- **Adapter**: Pi extension generates `guard_source_ref` and verifies `reviewed_output_sha256`

plugin_scanner-2.0.913/docs/guard/pi-fast-hook-review.md

@@ -0,0 +1,70 @@
+# Fast Hook Review for Pi/OMP
+
+## Overview
+
+HOL Guard's fast hook review engine enables extremely fast hook review for AI harnesses — especially Pi and Oh-My-Pi — while preserving best-in-class local security. Normal daemon-backed hook review targets ~200ms p95, making the 10s hook timeout ample headroom rather than the normal operating budget.
+
+## How It Works
+
+### Source-File Read Fast Path
+
+When a Pi/OMP tool reads a direct source file (e.g., `src/foo.ts`, `docs/spec.md`), the managed extension can include a `guard_source_ref` object in the hook payload. This reference contains:
+
+- The file path
+- An output SHA-256 hash computed over the model-visible text
+- The output character count
+- Optional adapter stat metadata
+
+The Guard daemon (or CLI fallback) uses this reference to:
+
+1. **Re-read the file** from disk (never trusts the adapter's claim alone)
+2. **Verify path safety** — rejects symlinks, path escapes, sensitive basenames (`.env`, `.npmrc`, etc.), and unsafe hidden directories
+3. **TOCTOU guard** — stat before read, stat after read, compare identity
+4. **Verify output hash** — the file content hash must match the adapter's claimed `output_sha256`
+5. **Scan for secrets** — streaming scan with byte, match, and deadline budgets
+6. **Cache the decision** — keyed by content hash, stat metadata, policy/config fingerprint, and scanner version
+
+When all checks pass, the engine returns `model_output_action: "allow_original"` with the `reviewed_output_sha256`. The Pi extension verifies this hash matches its locally computed digest before returning `undefined` (preserving original content).
+
+### Arbitrary Stdout
+
+Arbitrary stdout (shell commands, crash dumps, env output) remains conservative. If full safety cannot be proven within budget, the engine returns a reviewed safe excerpt, blocks, or requires approval.
+
+## When Excerpts Still Happen
+
+- **Output hash mismatch**: The adapter's claimed hash doesn't match the file content
+- **Symlink path**: Any path component is a symlink
+- **Sensitive path**: The file is `.env`, `.npmrc`, credentials, etc.
+- **Secret in file**: The scanner found a credential pattern
+- **Binary file**: The file contains null bytes
+- **Invalid UTF-8**: The file is not valid UTF-8
+- **File too large**: Exceeds the 5MB scan limit
+- **Scanner budget exhausted**: The deadline expired before scanning completed
+- **File changed during read**: TOCTOU detection triggered
+- **Cache miss with no source ref**: No `guard_source_ref` was provided
+
+## Feature Flags
+
+```bash
+# Enable the daemon fast path (default: off)
+export HOL_GUARD_HOOK_FAST_PATH=1
+
+# Enable source-ref generation in the Pi extension (default: on)
+export HOL_GUARD_HOOK_SOURCE_REF=1
+
+# Shadow mode: evaluate fast path but return legacy behavior (for testing)
+export HOL_GUARD_HOOK_FAST_PATH_SHADOW=1
+```
+
+## No Cloud Dependency
+
+Local allow/block decisions work fully offline. Guard Cloud can sync redacted receipts later, but the hot path never calls the network.
+
+## Security Guarantees
+
+- Never lets unreviewed tool output reach the model
+- Never passes raw oversized output through on timeout, daemon failure, or malformed payload
+- Never weakens credential detection, sensitive file protections, deny policies, or approval gates
+- Never uses an LLM in the allow/block hot path
+- Never depends on Guard Cloud for local decisions
+- Fail-safe: oversized or adversarial payloads block, require approval, or return only a reviewed safe excerpt

plugin_scanner-2.0.913/docs/guard/troubleshooting.md

@@ -0,0 +1,59 @@
+# Troubleshooting Fast Hook Review
+
+## Daemon Not Using Fast Path
+
+**Symptom**: Hook decisions still go through the legacy CLI path.
+
+**Check**:
+1. Verify `HOL_GUARD_HOOK_FAST_PATH=1` is set in the daemon's environment.
+2. Check that the daemon is running: `hol-guard status`.
+3. Look for `reason_code: "daemon_worker_exception"` in responses — this indicates the worker crashed and returned a fail-safe deny.
+
+**Resolution**: The fast path is behind a feature flag. Set `HOL_GUARD_HOOK_FAST_PATH=1` and restart the daemon.
+
+## Source Reads Still Return Excerpts
+
+**Symptom**: Safe source-file reads still get `replace_with_reviewed_excerpt` instead of `allow_original`.
+
+**Check**:
+1. Verify the Pi extension is generating `guard_source_ref` (check `HOL_GUARD_HOOK_SOURCE_REF=1`).
+2. Check the `reason_code` in the response:
+   - `output_mismatch`: The adapter's hash doesn't match the file content
+   - `sensitive_path`: The file is `.env`, `.npmrc`, etc.
+   - `symlink_in_path`: A path component is a symlink
+   - `binary_file`: The file contains null bytes
+   - `invalid_utf8`: The file is not valid UTF-8
+   - `source_file_too_large`: Exceeds 5MB
+   - `scanner_budget_exhausted`: Scanner deadline expired
+   - `source_stat_changed`: TOCTOU detection (file changed during read)
+
+**Resolution**: Fix the underlying issue. For `output_mismatch`, ensure the extension hashes the exact same text the model sees. For `scanner_budget_exhausted`, the file may be too large or the system too slow.
+
+## Cache Not Hitting
+
+**Symptom**: Source reads that were previously fast are now slow (no `source_cache_hit`).
+
+**Check**:
+1. The file content changed (different `content_sha256`).
+2. The file stat changed (different `stat_mtime_ns` or `stat_size`).
+3. The policy changed (different `policy_fingerprint`).
+4. The config changed (different `config_fingerprint`).
+5. The scanner rules changed (different `scanner_version`).
+
+**Resolution**: Cache misses are expected when any of these change. The next read will re-scan and cache the result.
+
+## Daemon Worker Exception
+
+**Symptom**: Response has `reason_code: "daemon_worker_exception"`.
+
+**Check**: The worker encountered an unexpected exception. This is a fail-safe deny/block — no raw output reaches the model.
+
+**Resolution**: Check the daemon logs. The legacy CLI path is not used as a fallback for worker exceptions on source-ref requests (to avoid passing unreviewed output through).
+
+## CLI Fallback Not Understanding Source Refs
+
+**Symptom**: CLI fallback returns an error or doesn't handle `guard_source_ref`.
+
+**Check**: Ensure you're running a recent version of `hol-guard` that includes `_try_source_ref_fast_path()` in `commands_hook.py`.
+
+**Resolution**: Update HOL Guard: `hol-guard update`.

{plugin_scanner-2.0.912 → plugin_scanner-2.0.913}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.912"
+version = "2.0.913"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.912 → plugin_scanner-2.0.913}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.912"
+version = "2.0.913"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.913/scripts/bench_guard_hooks.py

@@ -0,0 +1,322 @@
+#!/usr/bin/env python3
+"""Benchmark script for HOL Guard fast hook review.
+
+Measures p50/p95/p99 latency for various hook review cases.
+Never prints raw secret fixture values.
+
+Usage:
+    python scripts/bench_guard_hooks.py \\
+        --harness pi \\
+        --daemon warm \\
+        --cases small-post,read-ts-250kb,read-md-1mb,secret-early \\
+        --iterations 50 \\
+        --json .artifacts/hook-bench-pi-warm.json
+
+Threshold mode:
+    python scripts/bench_guard_hooks.py \\
+        --harness pi \\
+        --daemon warm \\
+        --cases small-post,read-ts-250kb \\
+        --fail-p95 small-post=75ms,read-ts-250kb=200ms
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import statistics
+import sys
+import tempfile
+import time
+from pathlib import Path
+
+# Ensure the package is importable
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "src"))
+
+from codex_plugin_scanner.guard.config import GuardConfig
+from codex_plugin_scanner.guard.runtime.hook_content_scanner import ContentScanner
+from codex_plugin_scanner.guard.runtime.hook_decision_cache import HookDecisionCache
+from codex_plugin_scanner.guard.runtime.hook_review_engine import HookReviewEngine
+from codex_plugin_scanner.guard.runtime.hook_review_types import HookReviewRequest, HookSourceFileRef, HookOutputSummary
+from codex_plugin_scanner.guard.runtime.hook_source_read import sha256_text
+from codex_plugin_scanner.guard.store import GuardStore
+
+
+def _create_workspace(tmp: Path) -> Path:
+    ws = tmp / "workspace"
+    ws.mkdir(parents=True, exist_ok=True)
+    (ws / "src").mkdir(exist_ok=True)
+    (ws / "docs").mkdir(exist_ok=True)
+    return ws
+
+
+def _make_source_ref(path: str, text: str) -> HookSourceFileRef:
+    stripped = text.rstrip("\n")
+    return HookSourceFileRef(
+        version=1,
+        path=path,
+        output_sha256=sha256_text(stripped),
+        output_chars=len(stripped),
+        tool_input_path=path,
+    )
+
+
+def _make_request(
+    *,
+    harness: str,
+    event_name: str,
+    cwd: Path,
+    home_dir: Path,
+    guard_home: Path,
+    source_ref: HookSourceFileRef | None = None,
+    output_summary: HookOutputSummary | None = None,
+) -> HookReviewRequest:
+    payload: dict[str, object] = {
+        "hook_event_name": event_name,
+        "tool_name": "Read",
+    }
+    if source_ref is not None:
+        payload["tool_input"] = {"file_path": source_ref.path}
+        payload["guard_source_ref"] = {
+            "version": source_ref.version,
+            "path": source_ref.path,
+            "output_sha256": source_ref.output_sha256,
+            "output_chars": source_ref.output_chars,
+            "tool_input_path": source_ref.tool_input_path,
+        }
+    return HookReviewRequest(
+        harness=harness,
+        event_name=event_name,
+        payload=payload,
+        payload_kind="source_file_ref" if source_ref else "inline",
+        config_path=None,
+        cwd=cwd,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_scope="project",
+        source_ref=source_ref,
+        output_summary=output_summary,
+    )
+
+
+def _bench_case(
+    name: str,
+    engine: HookReviewEngine,
+    request: HookReviewRequest,
+    iterations: int,
+) -> dict[str, object]:
+    latencies: list[float] = []
+    for _ in range(iterations):
+        start = time.perf_counter()
+        engine.review(request)
+        elapsed_ms = (time.perf_counter() - start) * 1000.0
+        latencies.append(elapsed_ms)
+
+    latencies.sort()
+    p50 = statistics.median(latencies)
+    p95 = latencies[int(len(latencies) * 0.95)] if len(latencies) > 1 else latencies[0]
+    p99 = latencies[int(len(latencies) * 0.99)] if len(latencies) > 1 else latencies[0]
+
+    return {
+        "case": name,
+        "iterations": iterations,
+        "p50_ms": round(p50, 2),
+        "p95_ms": round(p95, 2),
+        "p99_ms": round(p99, 2),
+        "min_ms": round(min(latencies), 2),
+        "max_ms": round(max(latencies), 2),
+    }
+
+
+def _setup_cases(tmp: Path, workspace: Path) -> dict[str, HookReviewRequest]:
+    """Create benchmark fixtures. Never stores raw secret values in output."""
+    home_dir = tmp / "home"
+    home_dir.mkdir(exist_ok=True)
+    guard_home = tmp / "guard-home"
+    guard_home.mkdir(exist_ok=True)
+
+    cases: dict[str, HookReviewRequest] = {}
+
+    # small-post: 1KB output
+    small_content = "export const x = 1;\n" * 50
+    small_file = workspace / "src" / "small.ts"
+    small_file.write_text(small_content)
+    cases["small-post"] = _make_request(
+        harness="pi",
+        event_name="PostToolUse",
+        cwd=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_ref=_make_source_ref("src/small.ts", small_content),
+    )
+
+    # read-ts-250kb: 250KB TypeScript file
+    ts_content = "// TypeScript source file\n" + "const x = 1;\n" * 12000
+    ts_file = workspace / "src" / "large.ts"
+    ts_file.write_text(ts_content)
+    cases["read-ts-250kb"] = _make_request(
+        harness="pi",
+        event_name="PostToolUse",
+        cwd=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_ref=_make_source_ref("src/large.ts", ts_content),
+    )
+
+    # read-md-1mb: 1MB Markdown file
+    md_content = "# Markdown spec\n\n" + "Paragraph text here.\n\n" * 50000
+    md_file = workspace / "docs" / "spec.md"
+    md_file.write_text(md_content)
+    cases["read-md-1mb"] = _make_request(
+        harness="pi",
+        event_name="PostToolUse",
+        cwd=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_ref=_make_source_ref("docs/spec.md", md_content),
+    )
+
+    # secret-early: secret at byte ~100
+    secret_content = 'x = 1;\nconst credential = "BENCH_FIXTURE_CREDENTIAL_VALUE";\n' + "y = 2;\n" * 100
+    secret_file = workspace / "src" / "secret.ts"
+    secret_file.write_text(secret_content)
+    cases["secret-early"] = _make_request(
+        harness="pi",
+        event_name="PostToolUse",
+        cwd=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_ref=_make_source_ref("src/secret.ts", secret_content),
+    )
+
+    # stdout-1mb: arbitrary stdout (no source ref, just excerpt)
+    stdout_content = "line of output\n" * 60000
+    cases["stdout-1mb"] = _make_request(
+        harness="pi",
+        event_name="PostToolUse",
+        cwd=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_ref=None,
+        output_summary=HookOutputSummary(
+            text_excerpt=stdout_content[:12000],
+            excerpt_truncated=True,
+            output_sha256=sha256_text(stdout_content),
+            output_chars=len(stdout_content),
+        ),
+    )
+
+    # adversarial-json-1mb: large JSON payload
+    adv_content = '{"key": "value", "items": [' + ", ".join(['"item"'] * 50000) + "]}\n"
+    adv_file = workspace / "src" / "data.json"
+    adv_file.write_text(adv_content)
+    cases["adversarial-json-1mb"] = _make_request(
+        harness="pi",
+        event_name="PostToolUse",
+        cwd=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        source_ref=_make_source_ref("src/data.json", adv_content),
+    )
+
+    return cases
+
+
+def _parse_thresholds(threshold_str: str) -> dict[str, float]:
+    """Parse 'case=75ms,other=200ms' into {'case': 75.0, 'other': 200.0}."""
+    thresholds: dict[str, float] = {}
+    for part in threshold_str.split(","):
+        part = part.strip()
+        if "=" not in part:
+            continue
+        name, value = part.split("=", 1)
+        name = name.strip()
+        value = value.strip().rstrip("ms").strip()
+        try:
+            thresholds[name] = float(value)
+        except ValueError:
+            pass
+    return thresholds
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Benchmark HOL Guard fast hook review")
+    parser.add_argument("--harness", default="pi", help="Harness name")
+    parser.add_argument("--daemon", default="warm", help="Daemon state (warm/cold)")
+    parser.add_argument("--cases", default="small-post,read-ts-250kb,read-md-1mb,secret-early", help="Comma-separated case names")
+    parser.add_argument("--iterations", type=int, default=50, help="Iterations per case")
+    parser.add_argument("--json", default=None, help="Output JSON file path")
+    parser.add_argument("--fail-p95", default=None, help="Threshold mode: case=p95ms,...")
+    args = parser.parse_args()
+
+    tmp = Path(tempfile.mkdtemp(prefix="hol-guard-bench-"))
+    workspace = _create_workspace(tmp)
+    store = GuardStore(tmp / "guard-home")
+    scanner = ContentScanner()
+    cache = HookDecisionCache(store)
+
+    def config_loader(guard_home: Path, ws: Path | None) -> GuardConfig:
+        return GuardConfig(guard_home=guard_home, workspace=ws)
+
+    engine = HookReviewEngine(
+        store=store,
+        scanner=scanner,
+        cache=cache,
+        config_loader=config_loader,
+    )
+
+    all_cases = _setup_cases(tmp, workspace)
+    requested = [c.strip() for c in args.cases.split(",") if c.strip()]
+    thresholds = _parse_thresholds(args.fail_p95) if args.fail_p95 else {}
+
+    results: list[dict[str, object]] = []
+    failed: list[str] = []
+
+    for case_name in requested:
+        if case_name not in all_cases:
+            print(f"  UNKNOWN: {case_name}", file=sys.stderr)
+            continue
+
+        # Warm up
+        engine.review(all_cases[case_name])
+
+        result = _bench_case(case_name, engine, all_cases[case_name], args.iterations)
+        results.append(result)
+
+        print(f"  {case_name}: p50={result['p50_ms']}ms p95={result['p95_ms']}ms p99={result['p99_ms']}ms")
+
+        if case_name in thresholds:
+            if result["p95_ms"] > thresholds[case_name]:
+                failed.append(f"{case_name}: p95={result['p95_ms']}ms > {thresholds[case_name]}ms")
+
+    if args.json:
+        output_path = Path(args.json)
+        output_path.parent.mkdir(parents=True, exist_ok=True)
+        output_path.write_text(
+            json.dumps(
+                {
+                    "harness": args.harness,
+                    "daemon": args.daemon,
+                    "iterations": args.iterations,
+                    "results": results,
+                },
+                indent=2,
+            ),
+            encoding="utf-8",
+        )
+        print(f"\n  JSON output: {output_path}")
+
+    if failed:
+        print("\n  THRESHOLD FAILURES:", file=sys.stderr)
+        for f in failed:
+            print(f"    {f}", file=sys.stderr)
+        return 1
+
+    if thresholds:
+        print("\n  All thresholds passed.")
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())