plugin-scanner 2.0.984__tar.gz → 2.0.986__tar.gz

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.984
+Version: 2.0.986
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.984"
+version = "2.0.986"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.984"
+version = "2.0.986"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.986/src/codex_plugin_scanner/guard/runtime/auto_update.py

@@ -0,0 +1,78 @@
+"""Auto-update check for Guard Cloud command queue daemon.
+
+Throttled to once per AUTO_UPDATE_THROTTLE_HOURS. Only runs when the
+command queue is enabled and no job was leased. Source/editable installs
+are excluded by build_guard_update_status_payload's auto_updatable flag.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+from ..cli.update_commands import build_guard_update_status_payload, run_guard_update
+
+if TYPE_CHECKING:
+    from ..adapters.base import HarnessContext
+    from ..store import GuardStore
+
+AUTO_UPDATE_THROTTLE_HOURS = 6
+AUTO_UPDATE_STATE_KEY = "guard_auto_update_state"
+_LOGGER = logging.getLogger(__name__)
+
+
+def maybe_auto_update(store: GuardStore, context: HarnessContext) -> None:
+    """Check for available updates and self-apply if auto-update is enabled."""
+    raw = store.get_sync_payload(AUTO_UPDATE_STATE_KEY)
+    try:
+        state: dict[str, object] = dict(raw) if isinstance(raw, dict) else {}
+    except (TypeError, ValueError):
+        state = {}
+    last_check = state.get("last_check_at")
+    if isinstance(last_check, str):
+        try:
+            last_dt = datetime.fromisoformat(last_check)
+            elapsed = (datetime.now(timezone.utc) - last_dt).total_seconds()
+            if elapsed < AUTO_UPDATE_THROTTLE_HOURS * 3600:
+                return
+        except (ValueError, TypeError):
+            pass
+    now_str = datetime.now(timezone.utc).isoformat()
+    try:
+        status = build_guard_update_status_payload()
+    except Exception:
+        _LOGGER.debug("Auto-update version check failed", exc_info=True)
+        state["last_check_at"] = now_str
+        state["last_check_error"] = True
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)
+        return
+    state["last_check_at"] = now_str
+    state["last_status"] = status
+    if not status.get("auto_updatable") or status.get("blocked_reason"):
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)
+        return
+    if not status.get("update_available"):
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)
+        return
+    _LOGGER.info(
+        "Auto-update: applying update %s -> %s",
+        status.get("current_version"),
+        status.get("latest_version"),
+    )
+    try:
+        update_payload, exit_code = run_guard_update(
+            dry_run=False,
+            context=context,
+            store=store,
+            workspace=str(context.workspace_dir) if context.workspace_dir is not None else None,
+            now=now_str,
+        )
+        state["last_update_result"] = update_payload
+        state["last_update_exit_code"] = exit_code
+        state["last_update_at"] = now_str
+    except Exception:
+        _LOGGER.warning("Auto-update failed", exc_info=True)
+        state["last_update_error"] = True
+    finally:
+        store.set_sync_payload(AUTO_UPDATE_STATE_KEY, state, now_str)

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -16,6 +16,10 @@ from ..cli.install_commands import (
     list_harness_setup_items,
     uninstall_confirmation_token,
 )
+from ..cli.update_commands import (
+    build_guard_update_status_payload,
+    run_guard_update,
+)
 from ..config import load_guard_config
 from ..local_supply_chain import (
     build_workspace_audit_payload,
@@ -61,6 +65,8 @@ APP_OPERATIONS: tuple[str, ...] = (
     "guard.app.repair",
     "guard.app.connect",
     "guard.app.remove",
+    "guard.app.update",
+    "guard.app.updateCheck",
 )
 APPROVAL_OPERATIONS: tuple[str, ...] = (
     "guard.approval.resolve",
@@ -203,6 +209,16 @@ def _execute_app_operation(
             return _result({"items": list_harness_setup_items(context, store)}, generated_at=generated_at)
         get_adapter(harness)
         return _result(build_harness_verification(harness, context, store, surface=surface), generated_at=generated_at)
+    if operation == "guard.app.update":
+        return _result(
+            _execute_app_update(context=context, store=store, generated_at=generated_at),
+            generated_at=generated_at,
+        )
+    if operation == "guard.app.updateCheck":
+        return _result(
+            _execute_app_update_check(generated_at=generated_at),
+            generated_at=generated_at,
+        )
     if harness is None:
         return {"failureCode": "harness_required", "failureMessage": "App command requires a harness."}
     get_adapter(harness)
@@ -235,6 +251,30 @@ def _execute_app_operation(
     }
 
 
+def _execute_app_update(
+    *,
+    context: HarnessContext,
+    store: GuardStore,
+    generated_at: str,
+) -> dict[str, object]:
+    update_payload, exit_code = run_guard_update(
+        dry_run=False,
+        context=context,
+        store=store,
+        workspace=str(context.workspace_dir) if context.workspace_dir is not None else None,
+        now=generated_at,
+    )
+    return {
+        "update": update_payload,
+        "exitCode": exit_code,
+        "succeeded": exit_code == 0,
+    }
+
+
+def _execute_app_update_check(generated_at: str) -> dict[str, object]:
+    return build_guard_update_status_payload()
+
+
 def _execute_approval_operation(
     operation: str,
     *,

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/src/codex_plugin_scanner/guard/runtime/command_queue.py

@@ -14,6 +14,7 @@ from urllib.parse import urlparse, urlunparse
 from ...version import __version__
 from ..adapters.base import HarnessContext
 from ..store import GuardStore
+from .auto_update import maybe_auto_update
 from .command_executors import (
     COMMAND_OPERATION_SCHEMA_VERSIONS,
     SUPPORTED_COMMAND_OPERATIONS,
@@ -379,7 +380,14 @@ def _retry_pending_result(
         state["last_error"] = None
         _save_state(store, state)
         return False
-    _post_result(auth_context, job, payload)
+    try:
+        _post_result(auth_context, job, payload)
+    except urllib.error.HTTPError as error:
+        if error.code != 401:
+            raise
+        _LOGGER.warning("Pending Guard result 401, attempting OAuth refresh retry.")
+        refreshed_auth_context = _resolve_command_queue_auth_context(store, force_refresh=True)
+        _post_result(refreshed_auth_context, job, payload)
     state.pop("pending_result", None)
     state.pop("active_job", None)
     state.update(
@@ -394,8 +402,31 @@ def _retry_pending_result(
     return True
 
 
+def _maybe_auto_update(store: GuardStore, context: HarnessContext) -> None:
+    """Delegate to auto_update.maybe_auto_update."""
+    maybe_auto_update(store, context)
+
+
+def _resolve_command_queue_auth_context(
+    store: GuardStore,
+    *,
+    force_refresh: bool = False,
+) -> dict[str, object]:
+    try:
+        if force_refresh:
+            return _resolve_guard_sync_auth_context(store, force_refresh=True)
+        return _resolve_guard_sync_auth_context(store)
+    except (GuardSyncAuthorizationExpiredError, GuardSyncNotConfiguredError):
+        repair = _repair_guard_cloud_authorization(store)
+        if repair["existing_sign_in_valid"] or repair["repaired_storage"]:
+            if force_refresh:
+                return _resolve_guard_sync_auth_context(store, force_refresh=True)
+            return _resolve_guard_sync_auth_context(store)
+        raise
+
+
 def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[str, object]:
-    auth_context = _resolve_guard_sync_auth_context_with_repair(store)
+    auth_context = _resolve_command_queue_auth_context(store)
     state = _load_state(store)
     state.update(
         {
@@ -408,7 +439,6 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
     _save_state(store, state)
     if _retry_pending_result(store, auth_context, state):
         return command_queue_status(store)
-
     lease_response = _json_request(
         auth_context,
         method="POST",
@@ -427,8 +457,8 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
             }
         )
         _save_state(store, state)
+        _maybe_auto_update(store, context)
         return command_queue_status(store)
-
     state.update(
         {
             "state": "leased",
@@ -440,6 +470,20 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
     _save_state(store, state)
     try:
         _heartbeat(auth_context, item)
+    except urllib.error.HTTPError as error:
+        if error.code != 401:
+            raise
+        _LOGGER.warning("Guard heartbeat 401, attempting OAuth refresh retry.")
+        auth_context = _resolve_command_queue_auth_context(store, force_refresh=True)
+        state["state"] = "auth_expired"
+        _save_state(store, state)
+        try:
+            _heartbeat(auth_context, item)
+        except Exception:
+            state.pop("active_job", None)
+            state.update({"state": "error", "last_error": "Guard command heartbeat failed."})
+            _save_state(store, state)
+            raise
     except Exception:
         state.pop("active_job", None)
         state.update({"state": "error", "last_error": "Guard command heartbeat failed."})
@@ -458,6 +502,34 @@ def poll_command_queue_once(store: GuardStore, context: HarnessContext) -> dict[
     try:
         _heartbeat(auth_context, item)
         _post_result(auth_context, item, payload)
+    except urllib.error.HTTPError as error:
+        if error.code != 401:
+            _LOGGER.warning("Guard command result upload failed: job_id=%s", _job_id(item))
+            state.update(
+                {
+                    "state": "result_pending",
+                    "pending_result": {"job": item, "payload": payload, "recorded_at": _now()},
+                }
+            )
+            _save_state(store, state)
+            raise
+        _LOGGER.warning("Guard result 401, attempting OAuth refresh retry.")
+        auth_context = _resolve_command_queue_auth_context(store, force_refresh=True)
+        state["state"] = "auth_expired"
+        _save_state(store, state)
+        try:
+            _heartbeat(auth_context, item)
+            _post_result(auth_context, item, payload)
+        except Exception:
+            _LOGGER.warning("Guard command result upload failed: job_id=%s", _job_id(item))
+            state.update(
+                {
+                    "state": "result_pending",
+                    "pending_result": {"job": item, "payload": payload, "recorded_at": _now()},
+                }
+            )
+            _save_state(store, state)
+            raise
     except Exception:
         _LOGGER.warning("Guard command result upload failed: job_id=%s", _job_id(item))
         state.update(

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py

@@ -172,7 +172,8 @@ def _local_request_snapshot_items_for_status(
     except GuardReviewContractError:
         oauth = None
     cursor_state = _local_request_snapshot_cursor_state(store)
-    cursor = cursor_state.get(status)
+    use_cursor = status != "pending"
+    cursor = cursor_state.get(status) if use_cursor else None
     rows = store.list_approval_requests(
         status=status,
         limit=limit + 1,
@@ -224,7 +225,7 @@ def _local_request_snapshot_items_for_status(
                 "resolvedAt": str(resolved_at) if isinstance(resolved_at, str) and resolved_at else None,
             }
         )
-    if cursor_supported:
+    if cursor_supported and use_cursor:
         if len(rows) > limit:
             cursor_state[status] = _local_request_snapshot_next_cursor(rows, limit)
         else:

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -3503,6 +3503,17 @@ def _urlopen_with_timeout_retry(
             with urllib.request.urlopen(current_request, timeout=current_timeout_seconds):
                 return
         except urllib.error.HTTPError as error:
+            if error.code == 401:
+                error_payload = _http_error_payload(error)
+                dpop_nonce = _dpop_nonce_from_http_error(error, error_payload)
+                if dpop_nonce is not None and nonce_retry_count < 3:
+                    nonce_retry_count += 1
+                    retry_request = _guard_sync_request_with_nonce(current_request, dpop_nonce)
+                    if retry_request is not None:
+                        current_request = retry_request
+                        current_timeout_seconds = timeout_seconds
+                        retried_timeout = False
+                        continue
             if error.code == 429 and rate_limit_retry_count < 2:
                 retry_after = _parse_retry_after_header(error)
                 time.sleep(min(retry_after, 120))

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.984"
+__version__ = "2.0.986"

plugin_scanner-2.0.986/tests/test_guard_command_executors_update.py

@@ -0,0 +1,205 @@
+"""Tests for guard.app.update and guard.app.updateCheck command executors."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+from unittest.mock import patch
+
+import pytest
+
+from codex_plugin_scanner.guard.adapters.base import HarnessContext
+from codex_plugin_scanner.guard.runtime.command_executors import (
+    APP_OPERATIONS,
+    execute_guard_command_job,
+)
+
+
+def _make_context(tmp_path: Path) -> HarnessContext:
+    return HarnessContext(
+        home_dir=tmp_path / "home",
+        workspace_dir=tmp_path / "workspace",
+        guard_home=tmp_path / "guard",
+    )
+
+
+def _make_job(operation: str, payload: dict[str, object] | None = None) -> dict[str, object]:
+    return {
+        "id": "job-1",
+        "operation": operation,
+        "operationSchemaVersion": 1,
+        "payload": payload or {},
+    }
+
+
+class _FakeStore:
+    """Minimal fake store with get_sync_payload/set_sync_payload for auto-update state."""
+
+    def __init__(self) -> None:
+        self._kv_data: dict[str, object] = {}
+
+    def get_sync_payload(self, key: str) -> object:
+        return self._kv_data.get(key)
+
+    def set_sync_payload(self, key: str, payload: object, now: str) -> None:
+        self._kv_data[key] = payload
+
+
+class TestAppUpdateOperations:
+    """Verify guard.app.update and guard.app.updateCheck are registered and executable."""
+
+    def test_update_operations_in_app_operations(self) -> None:
+        assert "guard.app.update" in APP_OPERATIONS
+        assert "guard.app.updateCheck" in APP_OPERATIONS
+
+    def test_update_check_returns_status_payload(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.updateCheck")
+        expected_status = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": True,
+            "blocked_reason": None,
+        }
+        with patch(
+            "codex_plugin_scanner.guard.runtime.command_executors.build_guard_update_status_payload",
+            return_value=expected_status,
+        ):
+            result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["data"]["current_version"] == "2.0.967"
+        assert result["data"]["latest_version"] == "2.0.970"
+        assert result["data"]["update_available"] is True
+
+    def test_update_calls_run_guard_update(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.update")
+        expected_update = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "status": "updated",
+            "changed": True,
+        }
+        with patch(
+            "codex_plugin_scanner.guard.runtime.command_executors.run_guard_update",
+            return_value=(expected_update, 0),
+        ):
+            result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["data"]["succeeded"] is True
+        assert result["data"]["exitCode"] == 0
+        assert result["data"]["update"]["status"] == "updated"
+        assert result["data"]["update"]["changed"] is True
+
+    def test_update_handles_failure_exit_code(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.update")
+        expected_update = {
+            "current_version": "2.0.967",
+            "status": "failed",
+            "changed": False,
+            "error": "pip install failed",
+        }
+        with patch(
+            "codex_plugin_scanner.guard.runtime.command_executors.run_guard_update",
+            return_value=(expected_update, 1),
+        ):
+            result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["data"]["succeeded"] is False
+        assert result["data"]["exitCode"] == 1
+        assert result["data"]["update"]["error"] == "pip install failed"
+
+    def test_unsupported_app_operation_returns_failure(self, tmp_path: Path) -> None:
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        job = _make_job("guard.app.unknownOperation")
+        result = execute_guard_command_job(job, context=context, store=store, now=lambda: "2026-07-04T00:00:00Z")
+        assert result["failureCode"] == "unsupported_operation"
+
+
+class TestAutoUpdateThrottle:
+    """Verify auto-update throttling in maybe_auto_update."""
+
+    def test_auto_update_skipped_within_throttle_window(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        recent = datetime.now(timezone.utc)
+        store._kv_data[auto_update.AUTO_UPDATE_STATE_KEY] = {"last_check_at": recent.isoformat()}
+        with patch.object(auto_update, "build_guard_update_status_payload") as mock:
+            auto_update.maybe_auto_update(store, context)
+        mock.assert_not_called()
+
+    def test_auto_update_runs_after_throttle_window(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        old = datetime(2026, 7, 3, 0, 0, 0, tzinfo=timezone.utc)
+        store._kv_data[auto_update.AUTO_UPDATE_STATE_KEY] = {"last_check_at": old.isoformat()}
+        status = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": True,
+            "blocked_reason": None,
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            with patch.object(auto_update, "run_guard_update", return_value=({"changed": True}, 0)) as mock_update:
+                auto_update.maybe_auto_update(store, context)
+        mock_update.assert_called_once()
+
+    def test_auto_update_skipped_when_not_auto_updatable(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        status = {
+            "current_version": "2.0.967",
+            "latest_version": "2.0.970",
+            "auto_updatable": False,
+            "update_available": True,
+            "blocked_reason": "This install was set up from local source code.",
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            with patch.object(auto_update, "run_guard_update") as mock_update:
+                auto_update.maybe_auto_update(store, context)
+        mock_update.assert_not_called()
+
+    def test_auto_update_skipped_when_no_update_available(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        status = {
+            "current_version": "2.0.970",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": False,
+            "blocked_reason": None,
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            with patch.object(auto_update, "run_guard_update") as mock_update:
+                auto_update.maybe_auto_update(store, context)
+        mock_update.assert_not_called()
+
+    def test_auto_update_handles_malformed_state(self, tmp_path: Path) -> None:
+        from codex_plugin_scanner.guard.runtime import auto_update
+
+        context = _make_context(tmp_path)
+        store = _FakeStore()
+        store._kv_data[auto_update.AUTO_UPDATE_STATE_KEY] = "not valid json{{"
+        status = {
+            "current_version": "2.0.970",
+            "latest_version": "2.0.970",
+            "auto_updatable": True,
+            "update_available": False,
+            "blocked_reason": None,
+        }
+        with patch.object(auto_update, "build_guard_update_status_payload", return_value=status):
+            auto_update.maybe_auto_update(store, context)
+        # Should not crash — malformed state is treated as empty

{plugin_scanner-2.0.984 → plugin_scanner-2.0.986}/tests/test_guard_command_queue.py

@@ -4,8 +4,9 @@ import json
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
-import pytest
+import urllib.error
 
+import pytest
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
@@ -1068,6 +1069,60 @@ def test_poll_once_persists_result_retry_when_result_upload_fails(
     assert isinstance(state["pending_result"], dict)
 
 
+def test_poll_once_persists_result_when_result_upload_http_error(tmp_path: Path, monkeypatch) -> None:
+    """Regression: HTTPError 500/429 on result upload must persist pending_result (PR #1308)."""
+    store = FakeStore(tmp_path / "guard-home")
+
+    monkeypatch.setattr(
+        command_queue,
+        "_resolve_guard_sync_auth_context",
+        lambda current_store: {"sync_url": "https://hol.test/api/guard/receipts/sync", "access_token": "token"},
+    )
+    monkeypatch.setattr(command_executors, "package_shim_status", lambda context: {"active_managers": []})
+
+    class FakeHTTPError(urllib.error.HTTPError):
+        def __init__(self) -> None:
+            super().__init__(
+                "https://hol.test/api/guard/commands/job-3/result",
+                500,
+                "Internal Server Error",
+                {},
+                None,
+            )
+
+    def fake_json_request(
+        auth_context: dict[str, object],
+        *,
+        method: str,
+        path: str,
+        payload: dict[str, object],
+    ) -> dict[str, object]:
+        if path == "/lease":
+            return {
+                "item": {
+                    "id": "job-3",
+                    "leaseId": "lease-3",
+                    "operation": "guard.packageShims.status",
+                }
+            }
+        if path.endswith("/result"):
+            raise FakeHTTPError()
+        return {"ok": True}
+
+    monkeypatch.setattr(command_queue, "_json_request", fake_json_request)
+
+    with pytest.raises(urllib.error.HTTPError):
+        command_queue.poll_command_queue_once(store, _context(tmp_path))
+
+    state = store.get_sync_payload(command_queue.COMMAND_QUEUE_STATE_KEY)
+    assert isinstance(state, dict)
+    assert state["state"] == "result_pending"
+    pending = state["pending_result"]
+    assert isinstance(pending, dict)
+    assert pending["job"]["id"] == "job-3"
+    assert "payload" in pending
+
+
 def test_poll_once_clears_active_job_when_heartbeat_fails(tmp_path: Path, monkeypatch) -> None:
     store = FakeStore(tmp_path / "guard-home")
     monkeypatch.setattr(
@@ -1515,8 +1570,8 @@ def test_poll_once_keeps_auth_expired_state_when_auth_refresh_fails(
         "2026-06-23T10:00:00+00:00",
     )
 
-    def fake_auth_context(current_store, *, allow_primary_repair: bool = True):
-        del current_store, allow_primary_repair
+    def fake_auth_context(current_store, *, allow_primary_repair: bool = True, force_refresh: bool = False):
+        del current_store, allow_primary_repair, force_refresh
         raise guard_runner_module.GuardSyncAuthorizationExpiredError(existing_error)
 
     monkeypatch.setattr(command_queue, "_resolve_guard_sync_auth_context", fake_auth_context)
@@ -1536,8 +1591,8 @@ def test_poll_once_repairs_oauth_storage_and_retries_before_leasing(
     store = _oauth_store(tmp_path)
     resolve_calls = {"count": 0}
 
-    def fake_auth_context(current_store, *, allow_primary_repair: bool = True):
-        del current_store, allow_primary_repair
+    def fake_auth_context(current_store, *, allow_primary_repair: bool = True, force_refresh: bool = False):
+        del current_store, allow_primary_repair, force_refresh
         resolve_calls["count"] += 1
         if resolve_calls["count"] == 1:
             raise guard_runner_module.GuardSyncNotConfiguredError("Guard is not logged in.")