plugin-scanner 2.2.113__tar.gz → 2.2.114__tar.gz

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/.github/workflows/ci.yml

@@ -80,7 +80,8 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
-          python-version: ${{ matrix.python-version }}
+          # Every shard must collect under the same patch release or node assignments can overlap.
+          python-version: "3.12.13"
       - name: Set up uv
         id: setup-uv-primary
         continue-on-error: true
@@ -94,7 +95,7 @@ jobs:
         with:
           version: "0.9.26"
           enable-cache: true
-      - run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+      - run: uv sync --frozen --extra dev --python 3.12.13
       - name: Secure the CI virtualenv interpreter
         shell: bash
         run: |

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.2.113
+Version: 2.2.114
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

plugin_scanner-2.2.114/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 12780,
+  "maximum_test_source_lines": 291969,
+  "schema_version": 1
+}

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.2.113"
+version = "2.2.114"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.2.113"
+version = "2.2.114"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.2.113/release-metadata/plugin-scanner-v2.2.113.toolchain.cdx.json → plugin_scanner-2.2.114/release-metadata/plugin-scanner-v2.2.114.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "2.2.113"
+      "version": "2.2.114"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/src/codex_plugin_scanner/guard/config.py

@@ -563,18 +563,33 @@ def update_guard_settings(
         if key not in EDITABLE_GUARD_SETTING_KEYS:
             continue
         next_payload[key] = _coerce_editable_setting(key, value)
+    effective_next_payload = next_payload
     if current_config.managed_policy is not None:
-        composed = apply_managed_policy(next_payload, current_config.managed_policy)
+        effective_next_payload = apply_managed_policy(next_payload, current_config.managed_policy)
         missing = object()
         weakened = [
             key
             for key in current_config.managed_locked_settings
             if (requested := _nested_setting_value(next_payload, key, missing)) is not missing
-            and _nested_setting_value(composed, key, missing) != requested
+            and _nested_setting_value(effective_next_payload, key, missing) != requested
         ]
         if weakened:
             raise ValueError(f"Managed policy locks prevent weakening: {', '.join(sorted(weakened))}")
-    if next_payload.get("sync") is True and not cloud_sync_entitled:
+    preserving_sync_while_switching_to_watch_only = (
+        current.get("sync") is True
+        and current_config.sync is True
+        and next_payload.get("sync") is True
+        and current.get("mode") != "observe"
+        and current_config.mode != "observe"
+        and payload.get("mode") == "observe"
+        and next_payload.get("mode") == "observe"
+        and effective_next_payload.get("mode") == "observe"
+    )
+    if (
+        next_payload.get("sync") is True
+        and not cloud_sync_entitled
+        and not preserving_sync_while_switching_to_watch_only
+    ):
         raise ValueError("Cloud sync requires a paid team plan.")
     _write_guard_config(guard_home / "config.toml", next_payload)
     return load_guard_config(guard_home)

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/src/codex_plugin_scanner/guard/daemon/hook_process_runner.py

@@ -33,7 +33,7 @@ from .hook_process_worker import (
 _HOOK_PROCESS_MAX_LIMIT = 16
 _HOOK_PROCESS_TIMEOUT_SECONDS = 2.8
 _HOOK_PROCESS_READY_TIMEOUT_SECONDS = 14.0
-_HOOK_PROCESS_BACKFILL_DELAY_SECONDS = 2.0
+_HOOK_PROCESS_BACKFILL_DELAY_SECONDS = 30.0
 _HOOK_PROCESS_BACKFILL_MAX_DEFERRAL_SECONDS = 5.0
 _HOOK_PROCESS_RETRY_MAX_SECONDS = 5.0
 _HOOK_PROCESS_RETRY_READY_SECONDS = 0.75
@@ -378,8 +378,16 @@ class HookProcessRunner:
         if adaptive_capacity is None:
             return
         adaptive_capacity.observe_load(queue_p95_ms=queue_p95_ms, queued=queued)
+        if queued > 0:
+            self.notify_queued_work()
         self._refresh_capacity_policy()
 
+    def notify_queued_work(self) -> None:
+        with self._state_lock:
+            self._backfill_not_before = 0.0
+            self._backfill_force_after = 0.0
+        self._recovery_event.set()
+
     def close(self) -> None:
         _ = self.close_contained()
 

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/src/codex_plugin_scanner/guard/daemon/runtime_hook_scheduler.py

@@ -48,6 +48,7 @@ class RuntimeHookScheduler:
         per_client_queued_limit: int = 32,
         retained_bytes_limit: int = 32 * 1024 * 1024,
         monotonic: Callable[[], float] = time.monotonic,
+        queue_listener: Callable[[], None] | None = None,
     ):
         limits = (
             active_limit,
@@ -66,6 +67,7 @@ class RuntimeHookScheduler:
         self._per_client_queued_limit = per_client_queued_limit
         self._retained_bytes_limit = retained_bytes_limit
         self._monotonic = monotonic
+        self._queue_listener = queue_listener
         self._condition = threading.Condition()
         self._queues: dict[
             RuntimeHookLane,
@@ -156,6 +158,8 @@ class RuntimeHookScheduler:
             else:
                 self._retained_bytes += payload_bytes
             self._dispatch()
+            if not item.admitted and self._queue_listener is not None:
+                self._queue_listener()
             while not item.admitted and item.rejection_reason is None:
                 remaining = resolved_deadline.expires_at - self._monotonic()
                 if remaining <= 0:
@@ -275,6 +279,10 @@ class RuntimeHookScheduler:
             self._active_limit = active_limit
             self._dispatch()
 
+    def set_queue_listener(self, listener: Callable[[], None]) -> None:
+        with self._condition:
+            self._queue_listener = listener
+
     def _reject(self, reason_code: RuntimeHookAdmissionReason) -> RuntimeHookAdmission:
         self._rejected[reason_code] = self._rejected.get(reason_code, 0) + 1
         return RuntimeHookAdmission(None, reason_code)

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -551,6 +551,7 @@ class _GuardDaemonHttpServer(HTTPServer):
         self.unclassified_watchdog_thread = None
         self.hook_process_runner = HookProcessRunner(guard_home=store.guard_home)
         self.hook_process_runner.set_capacity_listener(self.runtime_hook_process_scheduler.set_active_limit)
+        self.runtime_hook_process_scheduler.set_queue_listener(self.hook_process_runner.notify_queued_work)
         self.runtime_heartbeat = RuntimeHeartbeatWriter(
             store=store,
             session_id=runtime_session_id,
@@ -3842,7 +3843,15 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         return managers, None
 
     def _supply_chain_entitlement(self) -> dict[str, object]:
-        return resolve_package_firewall_entitlement_with_refresh(self.server.store)  # type: ignore[attr-defined]
+        server = self.server  # type: ignore[attr-defined]
+        with server.guard_cloud_browser_session_lock:
+            cloud_connect = _copy_guard_cloud_connect_state(server)
+            package_connect = _copy_package_firewall_connect_state(server)
+            if _guard_cloud_connect_state_is_in_flight(cloud_connect) or _guard_cloud_connect_state_is_in_flight(
+                package_connect
+            ):
+                return resolve_package_firewall_entitlement(server.store)
+            return resolve_package_firewall_entitlement_with_refresh(server.store)
 
     def _handle_get_supply_chain_bundle(self) -> None:
         store = self.server.store  # type: ignore[attr-defined]
@@ -7711,10 +7720,7 @@ class GuardDaemonServer:
             self._thread = threading.Thread(target=self._serve_forever, daemon=True)
             self._thread.start()
             serve_thread_started = True
-            self._server.hook_process_runner.enable_full_capacity(
-                delay_seconds=0,
-                active_deferral_seconds=0,
-            )
+            self._server.hook_process_runner.enable_full_capacity()
         except BaseException as error:
             self._diagnostics.record_exception("daemon_start_thread_failed")
             serve_thread_contained = True
@@ -7737,10 +7743,7 @@ class GuardDaemonServer:
 
     def serve(self) -> None:
         self._begin_service()
-        self._server.hook_process_runner.enable_full_capacity(
-            delay_seconds=0,
-            active_deferral_seconds=0,
-        )
+        self._server.hook_process_runner.enable_full_capacity()
         self._serve_forever()
 
     def stop(self) -> None:

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/src/codex_plugin_scanner/guard/runtime/false_positive_rules.py

@@ -75,6 +75,10 @@ KNOWN_SKILL_DOC_ROOT_SUFFIXES = (
     ".agents/skills",
     ".claude/skills",
 )
+KNOWN_AGENT_DOC_SUFFIXES = (
+    ".codex/docs/harness-engineering.md",
+    ".codex/docs/token-discipline.md",
+)
 FD_OPTION_VALUE_FLAGS = frozenset(
     {
         "-d",
@@ -152,6 +156,15 @@ def target_is_known_skill_doc_path(target: str, *, home_dir: Path | None = None)
             root=root,
         ):
             return True
+    for suffix in KNOWN_AGENT_DOC_SUFFIXES:
+        expected = f"{home}/{suffix}"
+        if (
+            normalized == expected
+            and os.path.isfile(expected)
+            and not os.path.islink(home)
+            and not _path_has_symlink_component(normalized, root=home)
+        ):
+            return True
     return False
 
 

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.2.113"
+__version__ = "2.2.114"

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/fixtures/guard-command-corpus/decision-diff-report.json

@@ -180,7 +180,7 @@
       "source-b6742d8f2f1ac4b54f46e427": "403f6f88f159e6257c04d8ed5726e62ba176cdee9abe04d60b8d0b0d0e3007b2",
       "source-b6ee2209355294e94b5580be": "3f2d0512ac75a5366725965aec5174628b5b05f732b00fa156a63b37cf278d88",
       "source-b72fac2a9933d9c25c221a38": "6a5d240d43af73dfac7d05a287d6f46bc56850256a0421157c825885b20b6da9",
-      "source-b80a8083541fd7e8874926a6": "39c5cdd4522dbee6a92a8b20ee444d8b2b3d61c24de002d5ccdda129d5f8542c",
+      "source-b80a8083541fd7e8874926a6": "260aeb77123fd9a7fd01d9250b33801d3277f2d54fa45b52b6a48bd40f69f202",
       "source-b933bc50f755d1a32c112e35": "5727d8a9e0f1bf39aa4470f048e346a2eed5b9437bd74c3c63e3420722e3b959",
       "source-b970eabd271372ddfe730bf1": "4446d801098f8517d245904b61eb4ba2992f1b7b25faccf283ee0fe15a2e07a0",
       "source-ba3ba0028bdc49b9008e93d2": "da05e29082f99b488efc23519195206f950c9cb29cb9c5f4c05117c9283266ac",

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_ci_pytest_shard.py

@@ -104,6 +104,8 @@ def test_ci_workflow_cancels_stale_runs_and_executes_each_shard() -> None:
     assert "mutation_gate.py --target command-model" in mutation_job
     assert workflow.count("uv run --no-sync python scripts/ci/pytest_shard.py") == 2
     assert "--shard-count 16" in tests_job
+    assert 'python-version: "3.12.13"' in tests_job
+    assert "uv sync --frozen --extra dev --python 3.12.13" in tests_job
     assert "--granularity node" in tests_job
     assert "PYTHONPATH=scripts/ci GUARD_PYTEST_DURATION_OUTPUT=pytest-durations.json" in tests_job
     assert "--duration-manifest ci/pytest-duration-manifest.json.gz" in tests_job

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_command_keys_and_uri_schemes.py

@@ -200,6 +200,62 @@ def test_common_readers_are_read_only_source_inspection(tmp_path):
         )
 
 
+def test_bounded_agent_guidance_reads_are_read_only_source_inspection(tmp_path):
+    docs = tmp_path / ".codex" / "docs"
+    docs.mkdir(parents=True)
+    (docs / "harness-engineering.md").write_text("# Harness engineering\n", encoding="utf-8")
+    (docs / "token-discipline.md").write_text("# Token discipline\n", encoding="utf-8")
+    command = (
+        "sed -n '1,220p' ~/.codex/docs/harness-engineering.md && sed -n '1,180p' ~/.codex/docs/token-discipline.md"
+    )
+
+    assert _codex_command_is_read_only_source_inspection(command, cwd=tmp_path, home_dir=tmp_path)
+
+
+def test_agent_guidance_read_rejects_non_markdown_and_symlink_escape(tmp_path):
+    docs = tmp_path / ".codex" / "docs"
+    docs.mkdir(parents=True)
+    (docs / "credentials.json").write_text("{}\n", encoding="utf-8")
+    outside = tmp_path / "outside.md"
+    outside.write_text("outside\n", encoding="utf-8")
+    (docs / "harness-engineering.md").symlink_to(outside)
+
+    assert not _codex_command_is_read_only_source_inspection(
+        "sed -n '1,20p' ~/.codex/docs/credentials.json",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+    assert not _codex_command_is_read_only_source_inspection(
+        "sed -n '1,20p' ~/.codex/docs/harness-engineering.md",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+    assert not _codex_command_is_read_only_source_inspection(
+        "sed -n '1,20p' ~/.codex/docs/other.md",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+    assert not _codex_command_is_read_only_source_inspection(
+        "sed -n '1,20p' ~/.codex/docs/token-discipline.md",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+
+def test_agent_guidance_read_rejects_parent_directory_symlink(tmp_path):
+    redirected_home = tmp_path / "redirected"
+    docs = redirected_home / "docs"
+    docs.mkdir(parents=True)
+    (docs / "harness-engineering.md").write_text("outside\n", encoding="utf-8")
+    (tmp_path / ".codex").symlink_to(redirected_home, target_is_directory=True)
+
+    assert not _codex_command_is_read_only_source_inspection(
+        "sed -n '1,20p' ~/.codex/docs/harness-engineering.md",
+        cwd=tmp_path,
+        home_dir=tmp_path,
+    )
+
+
 def test_semicolon_chain_requires_every_segment_to_be_read_only(tmp_path):
     source_file = tmp_path / "src" / "example.ts"
     source_file.parent.mkdir(parents=True)

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_guard_daemon_startup_rollback.py

@@ -18,6 +18,28 @@ from codex_plugin_scanner.guard.daemon.server import GuardDaemonServer
 from codex_plugin_scanner.guard.store import GuardStore
 
 
+def test_daemon_start_preserves_deferred_hook_worker_backfill(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    daemon = GuardDaemonServer(store, host="127.0.0.1", port=0, idle_timeout_seconds=0)
+    runner = daemon._server.hook_process_runner
+    enable_full_capacity = runner.enable_full_capacity
+    calls: list[dict[str, float]] = []
+
+    def recording_enable_full_capacity(**kwargs: float) -> None:
+        calls.append(kwargs)
+        enable_full_capacity(**kwargs)
+
+    monkeypatch.setattr(runner, "enable_full_capacity", recording_enable_full_capacity)
+    try:
+        daemon.start()
+        assert calls == [{}]
+    finally:
+        daemon.stop()
+
+
 def test_occupied_port_preserves_bind_error_during_partial_server_cleanup(tmp_path: Path) -> None:
     diagnostics_threads_before = {
         thread.ident

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_guard_headless_daemon_api.py

@@ -517,6 +517,7 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
     assert isinstance(oauth_payload, dict)
     oauth_payload["credentials_sha256"] = "pbkdf2-sha256$" + ("0" * 64)
     store.set_sync_payload("oauth_local_credentials", oauth_payload, "2026-06-05T01:40:00+00:00")
+    callback_allowed = threading.Event()
 
     class _FakeSession:
         authorize_url = "https://hol.org/mock-authorize"
@@ -533,6 +534,7 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
         )()
 
         def wait_for_callback(self, _timeout_seconds: float):
+            assert callback_allowed.wait(timeout=10), "status poll did not observe the active connect flow"
             return type("Callback", (), {"code": "auth-code-1"})()
 
         def close(self) -> None:
@@ -575,7 +577,14 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
     connect_started = threading.Event()
     connect_finalized = threading.Event()
     connect_failure_details: list[str] = []
+    refresh_calls_during_connect: list[bool] = []
     set_guard_cloud_connect_state = daemon_server._set_guard_cloud_connect_state
+    resolve_entitlement_with_refresh = daemon_server.resolve_package_firewall_entitlement_with_refresh
+
+    def track_entitlement_refresh(store: GuardStore) -> dict[str, object]:
+        if connect_started.is_set() and not connect_finalized.is_set():
+            refresh_calls_during_connect.append(True)
+        return resolve_entitlement_with_refresh(store)
 
     def set_state_and_signal(
         server: daemon_server._GuardDaemonHttpServer,
@@ -595,6 +604,11 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
             connect_finalized.set()
 
     monkeypatch.setattr(daemon_server, "_set_guard_cloud_connect_state", set_state_and_signal)
+    monkeypatch.setattr(
+        daemon_server,
+        "resolve_package_firewall_entitlement_with_refresh",
+        track_entitlement_refresh,
+    )
 
     daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)
     daemon.start()
@@ -627,6 +641,7 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
             assert connect_flow["state"] in {"idle", "running"}
             if connect_flow["state"] == "running":
                 assert connect_flow["authorize_url"] == "https://hol.org/mock-authorize"
+        callback_allowed.set()
         assert connect_finalized.wait(timeout=30), "Guard Cloud connect did not finalize repaired credentials"
         assert not connect_failure_details, f"Guard Cloud connect failed: {connect_failure_details[0]}"
         deadline = time.monotonic() + 30
@@ -650,6 +665,7 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
         assert refreshed["entitlement"]["allowed"] is True
         assert refreshed["entitlement"]["reason"] == "paid_oauth_entitlement_active"
         assert refreshed["connect_flow"] is None
+        assert refresh_calls_during_connect == []
         latest_connect_state = store.get_effective_guard_connect_state(now=datetime.now(timezone.utc).isoformat())
         assert isinstance(latest_connect_state, dict)
         assert latest_connect_state["milestone"] == "first_sync_pending"
@@ -659,6 +675,67 @@ def test_supply_chain_package_firewall_connect_repairs_local_auth_and_unlocks_pa
     assert store.get_oauth_local_credential_health()["state"] == "healthy"
 
 
+def test_supply_chain_entitlement_refresh_serializes_connect_admission(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    refresh_started = threading.Event()
+    refresh_allowed = threading.Event()
+    connect_admitted = threading.Event()
+
+    def blocking_refresh(_store: GuardStore) -> dict[str, object]:
+        refresh_started.set()
+        assert refresh_allowed.wait(timeout=10), "connect admission did not remain serialized with refresh"
+        return {"allowed": False, "reason": "guard_cloud_connect_required"}
+
+    monkeypatch.setattr(
+        daemon_server,
+        "resolve_package_firewall_entitlement_with_refresh",
+        blocking_refresh,
+    )
+    daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)
+    daemon.start()
+    try:
+        token = _dashboard_token_for(store)
+        status_result: list[tuple[int, dict[str, object]]] = []
+
+        def read_status() -> None:
+            status_result.append(
+                _read_json_response(
+                    _request(
+                        daemon.port,
+                        "/v1/supply-chain/package-shims",
+                        method="GET",
+                        token=token,
+                    )
+                )
+            )
+
+        status_thread = threading.Thread(target=read_status, daemon=True)
+        status_thread.start()
+        assert refresh_started.wait(timeout=10), "entitlement refresh did not start"
+
+        def begin_connect() -> None:
+            daemon_server._begin_guard_cloud_connect_state(
+                daemon._server,
+                {"state": "starting", "request_id": "connect-1"},
+            )
+            connect_admitted.set()
+
+        connect_thread = threading.Thread(target=begin_connect, daemon=True)
+        connect_thread.start()
+        assert not connect_admitted.wait(timeout=0.2)
+        refresh_allowed.set()
+        status_thread.join(timeout=10)
+        connect_thread.join(timeout=10)
+        assert status_result[0][0] == 200
+        assert connect_admitted.is_set()
+    finally:
+        refresh_allowed.set()
+        daemon.stop()
+
+
 def test_guard_cloud_connect_starts_local_browser_flow_for_insights_share(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_guard_hook_process_runner.py

@@ -615,6 +615,62 @@ def test_deferred_runner_does_not_adapt_before_backfill_is_enabled(tmp_path: Pat
         runner.close()
 
 
+def test_default_backfill_grace_yields_immediately_to_queued_work(tmp_path: Path) -> None:
+    runner = HookProcessRunner(guard_home=tmp_path)
+    scheduler = RuntimeHookScheduler(active_limit=0)
+    runner.set_capacity_listener(scheduler.set_active_limit)
+    scheduler.set_queue_listener(runner.notify_queued_work)
+    permits = []
+    third_admission = []
+    try:
+        runner.start(defer_backfill=True)
+        enabled_at = time.monotonic()
+        runner.enable_full_capacity()
+
+        assert runner._backfill_not_before - enabled_at >= 29.9  # pyright: ignore[reportPrivateUsage]
+        assert runner.stats()["ready"] == 2
+        for client_key in ("first", "second"):
+            admission = scheduler.acquire(
+                harness="codex",
+                client_key=client_key,
+                lane="decision",
+                payload_bytes=1,
+                deadline=time.monotonic() + 10,
+            )
+            assert admission.permit is not None
+            permits.append(admission.permit)
+        with runner._state_lock:  # pyright: ignore[reportPrivateUsage]
+            runner._backfill_not_before = time.monotonic() - 1  # pyright: ignore[reportPrivateUsage]
+            runner._backfill_force_after = time.monotonic() + 5  # pyright: ignore[reportPrivateUsage]
+            generation = runner._generation  # pyright: ignore[reportPrivateUsage]
+            runner._active_reviews[generation] = 1  # pyright: ignore[reportPrivateUsage]
+
+        def acquire_third() -> None:
+            third_admission.append(
+                scheduler.acquire(
+                    harness="codex",
+                    client_key="third",
+                    lane="decision",
+                    payload_bytes=1,
+                    deadline=time.monotonic() + 10,
+                )
+            )
+
+        queued = threading.Thread(target=acquire_third)
+        queued.start()
+        assert runner.wait_for_capacity(minimum_workers=4, timeout_seconds=8)
+        queued.join(timeout=2)
+        assert third_admission and third_admission[0].permit is not None
+    finally:
+        with runner._state_lock:  # pyright: ignore[reportPrivateUsage]
+            runner._active_reviews.clear()  # pyright: ignore[reportPrivateUsage]
+        for permit in permits:
+            permit.release()
+        if third_admission and third_admission[0].permit is not None:
+            third_admission[0].permit.release()
+        runner.close()
+
+
 def test_deferred_runner_bounds_backfill_deferral_during_active_reviews(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_guard_settings_api.py

@@ -8,9 +8,11 @@ import urllib.request
 from pathlib import Path
 from typing import Any
 
+from codex_plugin_scanner.guard import config as config_module
 from codex_plugin_scanner.guard.config import load_guard_config, resolve_risk_action, update_guard_settings
 from codex_plugin_scanner.guard.daemon import GuardDaemonServer
 from codex_plugin_scanner.guard.daemon import server as daemon_server_module
+from codex_plugin_scanner.guard.mdm.contracts import ManagedPolicy, ManagedPolicyState
 from codex_plugin_scanner.guard.models import GuardApprovalRequest, PolicyDecision
 from codex_plugin_scanner.guard.runtime.runner import (
     _LIVE_REQUEST_PRIVACY_PROJECTION_MARKER,
@@ -306,6 +308,88 @@ def test_cloud_sync_requires_trusted_paid_team_entitlement(tmp_path: Path, monke
     assert expired_payload["message"] == "Cloud sync requires a paid team plan."
 
 
+def test_existing_cloud_sync_does_not_block_switching_to_watch_only(tmp_path: Path) -> None:
+    guard_home = tmp_path / "guard-home"
+    guard_home.mkdir(parents=True)
+    (guard_home / "config.toml").write_text('sync = true\nmode = "prompt"\n', encoding="utf-8")
+    _store, daemon = _with_daemon(guard_home)
+    try:
+        status, payload = _json_request(
+            daemon.port,
+            daemon._server.auth_token,
+            "/v1/settings",
+            method="POST",
+            payload={"settings": {"mode": "observe", "sync": True}},
+        )
+    finally:
+        daemon.stop()
+
+    assert status == 200
+    assert payload["settings"]["mode"] == "observe"
+    assert payload["settings"]["sync"] is True
+
+
+def test_managed_mode_floor_cannot_fake_watch_only_transition(tmp_path: Path, monkeypatch) -> None:
+    guard_home = tmp_path / "guard-home"
+    guard_home.mkdir(parents=True)
+    (guard_home / "config.toml").write_text('sync = true\nmode = "observe"\n', encoding="utf-8")
+    managed_state = ManagedPolicyState(
+        status="active",
+        source="fixture",
+        policy=ManagedPolicy(
+            schema_version="guard-managed-policy.v1",
+            settings={"mode": "prompt"},
+            locked_settings=frozenset(),
+        ),
+    )
+    monkeypatch.setattr(config_module, "load_managed_policy", lambda: managed_state)
+    _store, daemon = _with_daemon(guard_home)
+    try:
+        status, payload = _json_request(
+            daemon.port,
+            daemon._server.auth_token,
+            "/v1/settings",
+            method="POST",
+            payload={"settings": {"mode": "observe", "sync": True, "desktop_notifications": False}},
+        )
+    finally:
+        daemon.stop()
+
+    assert status == 400
+    assert payload["message"] == "Cloud sync requires a paid team plan."
+
+
+def test_managed_sync_cannot_be_persisted_by_watch_only_transition(tmp_path: Path, monkeypatch) -> None:
+    guard_home = tmp_path / "guard-home"
+    guard_home.mkdir(parents=True)
+    (guard_home / "config.toml").write_text('mode = "prompt"\n', encoding="utf-8")
+    managed_state = ManagedPolicyState(
+        status="active",
+        source="fixture",
+        policy=ManagedPolicy(
+            schema_version="guard-managed-policy.v1",
+            settings={"sync": True},
+            locked_settings=frozenset(),
+        ),
+    )
+    monkeypatch.setattr(config_module, "load_managed_policy", lambda: managed_state)
+    _store, daemon = _with_daemon(guard_home)
+    try:
+        status, payload = _json_request(
+            daemon.port,
+            daemon._server.auth_token,
+            "/v1/settings",
+            method="POST",
+            payload={"settings": {"mode": "observe", "sync": True}},
+        )
+    finally:
+        daemon.stop()
+
+    assert status == 400
+    assert payload["message"] == "Cloud sync requires a paid team plan."
+    assert "sync = true" not in (guard_home / "config.toml").read_text(encoding="utf-8")
+
+
 def test_risk_settings_drive_runtime_policy_resolution(tmp_path: Path) -> None:
     guard_home = tmp_path / "guard-home"
     update_guard_settings(

{plugin_scanner-2.2.113 → plugin_scanner-2.2.114}/tests/test_guard_surface_server.py

@@ -989,7 +989,6 @@ class TestGuardSurfaceServer:
         workspace_dir = tmp_path / "workspace"
         workspace_dir.mkdir(parents=True, exist_ok=True)
         store = GuardStore(home_dir)
-        # This test owns response-shape coverage; latency budgets have dedicated tests.
         monkeypatch.setattr(daemon_server_module, "_RUNTIME_HOOK_PROCESS_TIMEOUT_SECONDS", 8.0)
         daemon = GuardDaemonServer(store, host="127.0.0.1", port=0)
         daemon.start()