plugin-scanner 3.0.38__tar.gz → 3.0.39__tar.gz

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.38
+Version: 3.0.39
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/ci/code-quality-baseline.json

@@ -578,7 +578,7 @@
     "src/codex_plugin_scanner/guard/runtime/package_intent_common.py": 599,
     "src/codex_plugin_scanner/guard/runtime/package_intent_parser.py": 1783,
     "src/codex_plugin_scanner/guard/runtime/package_manifest_diff.py": 641,
-    "src/codex_plugin_scanner/guard/runtime/runner.py": 6512,
+    "src/codex_plugin_scanner/guard/runtime/runner.py": 6584,
     "src/codex_plugin_scanner/guard/runtime/secret_file_request_services/benign_requests.py": 584,
     "src/codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_inspection.py": 590,
     "src/codex_plugin_scanner/guard/runtime/secret_file_request_services/github_shell_capabilities.py": 594,
@@ -641,7 +641,7 @@
     "tests/test_guard_codex_resume_endpoints.py": 878,
     "tests/test_guard_command_decision_routing.py": 504,
     "tests/test_guard_command_extensions.py": 993,
-    "tests/test_guard_command_queue.py": 1722,
+    "tests/test_guard_command_queue.py": 1724,
     "tests/test_guard_command_shadow_persistence.py": 544,
     "tests/test_guard_compound_git_inspection.py": 653,
     "tests/test_guard_compound_readonly_auto_allow.py": 547,
@@ -713,7 +713,7 @@
     "tests/test_guard_restricted_archive_download.py": 573,
     "tests/test_guard_risk.py": 4944,
     "tests/test_guard_routine_local_node.py": 686,
-    "tests/test_guard_runtime.py": 25544,
+    "tests/test_guard_runtime.py": 25545,
     "tests/test_guard_runtime_actions.py": 609,
     "tests/test_guard_runtime_detectors.py": 1559,
     "tests/test_guard_runtime_mcp_saved_blocks.py": 2527,

plugin_scanner-3.0.39/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "schema_version": 1,
+  "maximum_collected_cases": 16510,
+  "maximum_test_source_lines": 356922
+}

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.0.38"
+version = "3.0.39"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.0.38"
+version = "3.0.39"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.0.38/release-metadata/plugin-scanner-v3.0.38.toolchain.cdx.json → plugin_scanner-3.0.39/release-metadata/plugin-scanner-v3.0.39.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.0.38"
+      "version": "3.0.39"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -4545,23 +4545,33 @@ def _refresh_guard_oauth_access_token(
     client_id: str,
     refresh_token: str,
     dpop_key_material: GuardDpopKeyMaterial,
+    credential_reloader: Callable[[], tuple[str, GuardDpopKeyMaterial] | None] | None = None,
 ) -> dict[str, object]:
     """Refresh with bounded invalid_grant tolerance.
 
     A single invalid_grant can be an edge 4xx or a rotation race resolved
     server-side without grant revocation; failing once must not declare the
     local sign-in invalid (which used to trigger credential wipes and stop
-    sync). Retry exactly once after a short delay; a second invalid_grant is
+    sync). Retry exactly once after a short delay. Before the retry, ask the
+    caller for the latest stored credentials — a peer process may have
+    rotated the refresh token between attempts. A second invalid_grant is
     treated as genuine revocation and propagates.
+
+    The returned payload includes `_effective_refresh_token` and
+    `_effective_dpop_key_material` reflecting whichever credential snapshot
+    actually succeeded — so callers can persist and return *those*, not the
+    stale inputs.
     """
     last_error: GuardSyncAuthorizationExpiredError | None = None
+    attempt_refresh_token = refresh_token
+    attempt_dpop_key_material = dpop_key_material
     for attempt in range(_OAUTH_INVALID_GRANT_MAX_ATTEMPTS):
         try:
-            return _refresh_guard_oauth_access_token_once(
+            result = _refresh_guard_oauth_access_token_once(
                 token_endpoint=token_endpoint,
                 client_id=client_id,
-                refresh_token=refresh_token,
-                dpop_key_material=dpop_key_material,
+                refresh_token=attempt_refresh_token,
+                dpop_key_material=attempt_dpop_key_material,
             )
         except GuardSyncAuthorizationExpiredError as error:
             if str(error) != _guard_oauth_reconnect_after_revoked_message():
@@ -4570,6 +4580,16 @@ def _refresh_guard_oauth_access_token(
             if attempt + 1 >= _OAUTH_INVALID_GRANT_MAX_ATTEMPTS:
                 break
             time.sleep(_OAUTH_INVALID_GRANT_RETRY_DELAY_SECONDS)
+            if credential_reloader is None:
+                continue
+            reloaded = credential_reloader()
+            if reloaded is None:
+                continue
+            attempt_refresh_token, attempt_dpop_key_material = reloaded
+            continue
+        result["_effective_refresh_token"] = attempt_refresh_token
+        result["_effective_dpop_key_material"] = attempt_dpop_key_material
+        return result
     if last_error is None:  # pragma: no cover - unreachable when MAX_ATTEMPTS >= 1
         raise GuardSyncAuthorizationExpiredError(_guard_oauth_reconnect_after_revoked_message())
     raise last_error
@@ -4744,11 +4764,70 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
             "access_token": cached_access_token,
             "dpop_key_material": dpop_key_material,
         }
+
+    effective_credentials_ref: dict[str, dict[str, object]] = {"value": oauth_credentials}
+
+    def _reload_current_oauth_credentials() -> tuple[str, GuardDpopKeyMaterial] | None:
+        reloaded_credentials = store.get_oauth_local_credentials(allow_primary=True)
+        if not isinstance(reloaded_credentials, dict):
+            return None
+        reloaded_refresh_token = _optional_string(reloaded_credentials.get("refresh_token"))
+        if reloaded_refresh_token is None:
+            return None
+        effective_credentials_ref["value"] = reloaded_credentials
+        return reloaded_refresh_token, _oauth_dpop_key_material(reloaded_credentials)
+
     refreshed = _refresh_guard_oauth_access_token(
         token_endpoint=oauth_client.token_endpoint,
         client_id=client_id,
         refresh_token=refresh_token,
         dpop_key_material=dpop_key_material,
+        credential_reloader=_reload_current_oauth_credentials,
+    )
+    effective_credentials = effective_credentials_ref["value"]
+    effective_dpop_key_material = _apply_refreshed_oauth_credentials(
+        store=store,
+        effective_credentials=effective_credentials,
+        refreshed=refreshed,
+        refresh_token=refresh_token,
+        dpop_key_material=dpop_key_material,
+        persist_recovered_secret=persist_recovered_secret,
+        force_refresh=force_refresh,
+    )
+    sync_url = _validate_guard_sync_url(
+        _oauth_sync_url_from_issuer(oauth_client.issuer),
+        issuer=oauth_client.issuer,
+    )
+    return {
+        "sync_url": sync_url,
+        "access_token": str(refreshed["access_token"]),
+        "dpop_key_material": effective_dpop_key_material,
+    }
+
+
+def _apply_refreshed_oauth_credentials(
+    *,
+    store: GuardStore,
+    effective_credentials: dict[str, object],
+    refreshed: dict[str, object],
+    refresh_token: str,
+    dpop_key_material: GuardDpopKeyMaterial,
+    persist_recovered_secret: bool,
+    force_refresh: bool,
+) -> GuardDpopKeyMaterial:
+    """Project the refresh result onto the credential store and return context.
+
+    Removes the wrapper's internal `_effective_*` markers from `refreshed`,
+    persists the rotated credentials when state actually changed (using the
+    effective snapshot — the one the retry leg may have reloaded), and
+    returns the effective DPoP key material for the caller to sign with.
+    """
+    refreshed.pop("_effective_refresh_token", None)
+    effective_dpop_key_material_raw = refreshed.pop("_effective_dpop_key_material", None)
+    effective_dpop_key_material = (
+        effective_dpop_key_material_raw
+        if isinstance(effective_dpop_key_material_raw, GuardDpopKeyMaterial)
+        else dpop_key_material
     )
     rotated_refresh_token = str(refreshed["refresh_token"])
     refreshed_entitlement = refreshed.get("package_firewall_entitlement")
@@ -4762,14 +4841,17 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
     # When the refresh response includes a guard_local_entitlement but no
     # user_profile, clear the stale profile rather than preserving it.
     # When there's no guard_local_entitlement at all (old server), keep existing.
+    # Sources: prefer the refresh response, then the effective (possibly
+    # reloaded-by-peer) credentials dict; compare against the same effective
+    # snapshot so a peer's newer profile is not treated as a change.
     effective_cloud_user_profile: dict[str, str] | None
     if had_entitlement:
         effective_cloud_user_profile = refreshed_cloud_user_profile
     else:
         effective_cloud_user_profile = refreshed_cloud_user_profile or _extract_dict_field(
-            oauth_credentials, "cloud_user_profile"
+            effective_credentials, "cloud_user_profile"
         )
-    stored_cloud_user_profile = _extract_dict_field(oauth_credentials, "cloud_user_profile")
+    stored_cloud_user_profile = _extract_dict_field(effective_credentials, "cloud_user_profile")
     profile_changed = effective_cloud_user_profile != stored_cloud_user_profile
     if (
         force_refresh
@@ -4780,7 +4862,7 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
     ):
         _persist_rotated_oauth_refresh_token(
             store=store,
-            credentials=oauth_credentials,
+            credentials=effective_credentials,
             package_firewall_entitlement=package_firewall_entitlement,
             cloud_user_profile=effective_cloud_user_profile,
             refresh_token=rotated_refresh_token,
@@ -4788,15 +4870,7 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
             access_token_expires_at=_optional_string(refreshed.get("access_token_expires_at")),
             force_primary_secret_rewrite=force_refresh,
         )
-    sync_url = _validate_guard_sync_url(
-        _oauth_sync_url_from_issuer(oauth_client.issuer),
-        issuer=oauth_client.issuer,
-    )
-    return {
-        "sync_url": sync_url,
-        "access_token": str(refreshed["access_token"]),
-        "dpop_key_material": dpop_key_material,
-    }
+    return effective_dpop_key_material
 
 
 # Test-only override: when set, _resolve_guard_sync_auth_context returns this dict

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "3.0.38"
+__version__ = "3.0.39"

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/tests/fixtures/guard-command-corpus/decision-diff-report.json

@@ -264,7 +264,7 @@
       "source-b6742d8f2f1ac4b54f46e427": "403f6f88f159e6257c04d8ed5726e62ba176cdee9abe04d60b8d0b0d0e3007b2",
       "source-b6d8d4f6c494653d8ac3b90c": "d03decff191f7abfa177fb166496f6ae9ceef34ae0079f6a4c56b4d64f041353",
       "source-b6ee2209355294e94b5580be": "3f2d0512ac75a5366725965aec5174628b5b05f732b00fa156a63b37cf278d88",
-      "source-b72fac2a9933d9c25c221a38": "3a21e417b366625d1e606f4b9828a97c3e97d40a8006090da6f4e8168fb7c011",
+      "source-b72fac2a9933d9c25c221a38": "d6a37fed52b5602d03788bfc0025e4a3c32db8039bd1f53a1faf094cc39b14e4",
       "source-b7d80e334f68594dff5c42ef": "ec6448647fcf1aeb8cf47aaddcc5bb61dc0093984a96946e86f8da46449d6dcf",
       "source-b80a8083541fd7e8874926a6": "70809cdb088f410ad92d127d5436ff235b6e89394c42a4ad062d4a83d3c3796a",
       "source-b933bc50f755d1a32c112e35": "5727d8a9e0f1bf39aa4470f048e346a2eed5b9437bd74c3c63e3420722e3b959",

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/tests/test_guard_command_queue.py

@@ -1130,8 +1130,9 @@ def test_poll_once_reuses_cached_access_token_across_oauth_polls(
         client_id: str,
         refresh_token: str,
         dpop_key_material,
+        credential_reloader=None,
     ) -> dict[str, object]:
-        del token_endpoint, client_id, dpop_key_material
+        del token_endpoint, client_id, dpop_key_material, credential_reloader
         observed_refresh_tokens.append(refresh_token)
         current_index = len(observed_refresh_tokens)
         return {
@@ -1397,8 +1398,9 @@ def test_command_queue_loop_retries_revoked_oauth_auth_and_records_reconnect_sta
         client_id: str,
         refresh_token: str,
         dpop_key_material,
+        credential_reloader=None,
     ) -> dict[str, object]:
-        del token_endpoint, client_id, refresh_token, dpop_key_material
+        del token_endpoint, client_id, refresh_token, dpop_key_material, credential_reloader
         raise guard_runner_module.GuardSyncAuthorizationExpiredError(
             "Guard authorization expired. Run `hol-guard connect` to sign in again."
         )

plugin_scanner-3.0.39/tests/test_guard_oauth_refresh_resilience.py

@@ -0,0 +1,338 @@
+"""Regression tests: transient refresh-token failures must not wipe Guard Cloud sign-in.
+
+Reproduces the production failure where a single transient `invalid_grant`
+response (rotation race against another local process, edge 400s) flowed into
+the daemon repair path and deleted all local OAuth material, forcing users to
+rerun `hol-guard connect` while review items stopped syncing.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.parse
+
+import pytest
+
+from codex_plugin_scanner.guard.cli.oauth_client import generate_dpop_key_pair
+from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
+from codex_plugin_scanner.guard.store import GuardStore
+from tests.support.network import stub_authenticated_urlopen
+
+
+def _store_with_oauth_credentials(tmp_path) -> GuardStore:
+    store = GuardStore(tmp_path / "guard-home")
+    dpop_key_material = generate_dpop_key_pair()
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-token-1",
+        dpop_private_key_pem=dpop_key_material.private_key_pem,
+        dpop_public_jwk=dpop_key_material.public_jwk,
+        dpop_public_jwk_thumbprint=dpop_key_material.public_jwk_thumbprint,
+        grant_id="grant-1",
+        machine_id="machine-1",
+        workspace_id="workspace-1",
+        now="2026-06-01T00:00:00+00:00",
+    )
+    return store
+
+
+def _allow_refresh(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Disable the runtime-upgrade guard so refresh reaches the network stub."""
+    monkeypatch.setattr(guard_runner_module, "_guard_runtime_was_upgraded", lambda: False)
+    monkeypatch.setattr(guard_runner_module.time, "sleep", lambda _seconds: None)
+
+
+class _SuccessResponse:
+    def __init__(self, access_token: str) -> None:
+        self._access_token = access_token
+
+    def read(self) -> bytes:
+        return json.dumps(
+            {
+                "access_token": self._access_token,
+                "token_type": "DPoP",
+                "expires_in": 300,
+            }
+        ).encode("utf-8")
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb) -> None:
+        return None
+
+
+def _invalid_grant_http_error() -> urllib.error.HTTPError:
+    class _ErrorResponse:
+        def read(self) -> bytes:
+            return json.dumps(
+                {
+                    "error": "invalid_grant",
+                    "error_description": "The grant is missing, expired, or already consumed.",
+                }
+            ).encode("utf-8")
+
+        def close(self) -> None:
+            return None
+
+    return urllib.error.HTTPError(
+        "https://hol.org/api/guard/oauth/token",
+        400,
+        "Bad Request",
+        hdrs=None,
+        fp=_ErrorResponse(),
+    )
+
+
+def _transient_invalid_grant_then_success(access_token: str):
+    state = {"calls": 0}
+
+    def _fake_urlopen(_request, timeout):
+        state["calls"] += 1
+        if state["calls"] == 1:
+            raise _invalid_grant_http_error()
+        return _SuccessResponse(access_token)
+
+    return _fake_urlopen, state
+
+
+def test_transient_invalid_grant_does_not_wipe_sign_in_via_daemon_repair(tmp_path, monkeypatch) -> None:
+    """One flaky invalid_grant must not delete local OAuth credentials."""
+    store = _store_with_oauth_credentials(tmp_path)
+    _fake_urlopen, state = _transient_invalid_grant_then_success("access-token-2")
+    stub_authenticated_urlopen(monkeypatch, _fake_urlopen)
+    _allow_refresh(monkeypatch)
+
+    repair = guard_runner_module.repair_guard_cloud_connect_storage(store)
+
+    assert repair["cleared_stale_sign_in"] is False
+    assert repair["existing_sign_in_valid"] is True
+    assert store.get_oauth_local_credentials(allow_primary=True) is not None
+    assert state["calls"] == 0
+
+
+def test_sync_auth_context_recovers_from_transient_invalid_grant(tmp_path, monkeypatch) -> None:
+    """A single invalid_grant hiccup must be retried, not surfaced as auth-expired."""
+    store = _store_with_oauth_credentials(tmp_path)
+    _fake_urlopen, state = _transient_invalid_grant_then_success("access-token-2")
+    stub_authenticated_urlopen(monkeypatch, _fake_urlopen)
+    _allow_refresh(monkeypatch)
+
+    auth_context = guard_runner_module._resolve_guard_sync_auth_context(store)
+
+    assert auth_context["access_token"] == "access-token-2"
+    assert state["calls"] >= 2
+
+
+def test_persistent_invalid_grant_still_clears_sign_in(tmp_path, monkeypatch) -> None:
+    """Genuinely revoked grants must still be cleared on the reconnect pre-check path after bounded refresh retries."""
+    store = _store_with_oauth_credentials(tmp_path)
+    calls = {"count": 0}
+
+    def _always_invalid_grant(_request, timeout):
+        calls["count"] += 1
+        raise _invalid_grant_http_error()
+
+    stub_authenticated_urlopen(monkeypatch, _always_invalid_grant)
+    _allow_refresh(monkeypatch)
+
+    repair = guard_runner_module.prepare_guard_cloud_connect_authorization(store)
+
+    assert repair["cleared_stale_sign_in"] is True
+    assert store.get_oauth_local_credentials(allow_primary=True) is None
+    assert calls["count"] == 2
+
+
+def test_sync_auth_context_raises_after_persistent_invalid_grant(tmp_path, monkeypatch) -> None:
+    store = _store_with_oauth_credentials(tmp_path)
+
+    def _always_invalid_grant(_request, timeout):
+        raise _invalid_grant_http_error()
+
+    stub_authenticated_urlopen(monkeypatch, _always_invalid_grant)
+    _allow_refresh(monkeypatch)
+
+    with pytest.raises(guard_runner_module.GuardSyncAuthorizationExpiredError):
+        guard_runner_module._resolve_guard_sync_auth_context(store)
+
+
+def test_invalid_grant_retry_uses_reloaded_credentials(tmp_path, monkeypatch) -> None:
+    """Refresh retry must read rotated credentials persisted by another process."""
+    store = _store_with_oauth_credentials(tmp_path)
+    seen_tokens: list[str] = []
+
+    def _fake_urlopen(_request, timeout):
+        form = dict(urllib.parse.parse_qsl(_request.data.decode("utf-8")))
+        seen_tokens.append(form["refresh_token"])
+        if len(seen_tokens) == 1:
+            raise _invalid_grant_http_error()
+        return _SuccessResponse("access-token-3")
+
+    stub_authenticated_urlopen(monkeypatch, _fake_urlopen)
+    _allow_refresh(monkeypatch)
+
+    # Simulate peer-process rotation between attempts: change stored refresh token.
+    initial = store.get_oauth_local_credentials(allow_primary=True)
+    assert initial is not None
+    initial["refresh_token"] = "refresh-token-2"
+    # Patch store read used by the reloader to return the rotated credentials.
+    original_get = GuardStore.get_oauth_local_credentials
+
+    def _patched_get(self, *args, **kwargs):
+        if self is store:
+            return initial
+        return original_get(self, *args, **kwargs)
+
+    monkeypatch.setattr(GuardStore, "get_oauth_local_credentials", _patched_get)
+
+    refreshed = guard_runner_module._refresh_guard_oauth_access_token(
+        token_endpoint="https://hol.org/api/guard/oauth/token",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-token-1",
+        dpop_key_material=guard_runner_module._oauth_dpop_key_material(initial),
+        credential_reloader=lambda: (
+            initial["refresh_token"],
+            guard_runner_module._oauth_dpop_key_material(initial),
+        ),
+    )
+
+    assert refreshed["access_token"] == "access-token-3"
+    assert seen_tokens == ["refresh-token-1", "refresh-token-2"]
+
+
+def test_invalid_grant_retry_persists_and_returns_effective_credentials(tmp_path, monkeypatch) -> None:
+    """After reloader swaps credentials mid-retry, persistence + return MUST use the newer snapshot.
+
+    CodeRabbit #2714: before this fix the resolver persisted `oauth_credentials`
+    (stale dpop_key) and returned `dpop_key_material` (stale), even when the
+    reloader supplied newer material on the retry leg — leaving signed sync
+    requests with an outdated key after peer rotation.
+    """
+    store = _store_with_oauth_credentials(tmp_path)
+    initial = store.get_oauth_local_credentials(allow_primary=True)
+    assert initial is not None
+    initial_dpop = guard_runner_module._oauth_dpop_key_material(initial)
+    seen_tokens: list[str] = []
+
+    def _fake_urlopen(_request, timeout):
+        form = dict(urllib.parse.parse_qsl(_request.data.decode("utf-8")))
+        seen_tokens.append(form["refresh_token"])
+        if len(seen_tokens) == 1:
+            raise _invalid_grant_http_error()
+        return _SuccessResponse("access-token-3")
+
+    stub_authenticated_urlopen(monkeypatch, _fake_urlopen)
+    _allow_refresh(monkeypatch)
+
+    rotated = dict(initial)
+    rotated["refresh_token"] = "refresh-token-2"
+    rotated_dpop_pair = generate_dpop_key_pair()
+    rotated["dpop_private_key_pem"] = rotated_dpop_pair.private_key_pem
+    rotated["dpop_public_jwk"] = rotated_dpop_pair.public_jwk
+    rotated["dpop_public_jwk_thumbprint"] = rotated_dpop_pair.public_jwk_thumbprint
+    rotated_dpop = guard_runner_module._oauth_dpop_key_material(rotated)
+    original_get = GuardStore.get_oauth_local_credentials
+    call_count = {"n": 0}
+
+    def _patched_get(self, *args, **kwargs):
+        # The reloader's reads mimic a peer having rotated credentials in the
+        # store between the first (failed) and second (successful) attempts.
+        if self is store:
+            call_count["n"] += 1
+            return rotated
+        return original_get(self, *args, **kwargs)
+
+    monkeypatch.setattr(GuardStore, "get_oauth_local_credentials", _patched_get)
+
+    context = guard_runner_module._resolve_guard_sync_auth_context_from_oauth_credentials(
+        store,
+        initial,
+        force_refresh=True,
+        persist_recovered_secret=False,
+    )
+
+    # Return context must carry the reloaded DPoP material (used to sign
+    # subsequent sync requests). dataclass — compare by value, not identity.
+    actual = context["dpop_key_material"]
+    assert actual == rotated_dpop
+    assert actual != initial_dpop
+
+    # Persistence must record the rotated credentials, not the stale initial.
+    monkeypatch.setattr(GuardStore, "get_oauth_local_credentials", original_get)
+    persisted = original_get(store, allow_primary=True)
+    assert persisted is not None
+    # `_persist_rotated_oauth_refresh_token` stamps the new refresh_token from
+    # the refresh response over whichever credentials dict it received — so
+    # the persisted dict MUST be derived from `rotated`, not `initial`.
+    assert persisted.get("dpop_private_key_pem") == rotated.get("dpop_private_key_pem")
+    assert persisted.get("dpop_public_jwk_thumbprint") == rotated.get("dpop_public_jwk_thumbprint")
+    assert seen_tokens == ["refresh-token-1", "refresh-token-2"]
+
+
+
+def test_profile_fallback_uses_effective_credentials_after_peer_reload(tmp_path, monkeypatch) -> None:
+    """Peer-rotated credentials carrying a newer cloud_user_profile must not be
+    overwritten by the resolver's stale local snapshot when the refresh
+    response has neither an entitlement nor a profile."""
+    store = _store_with_oauth_credentials(tmp_path)
+    initial = store.get_oauth_local_credentials(allow_primary=True)
+    assert initial is not None
+    initial["cloud_user_profile"] = {"name": "stale"}
+
+    rotated = dict(initial)
+    rotated["refresh_token"] = "refresh-token-2"
+    rotated["cloud_user_profile"] = {"name": "fresh-peer"}
+
+    seen_tokens: list[str] = []
+
+    class _ProfileLessResponse:
+        def read(self) -> bytes:
+            return json.dumps(
+                {
+                    "access_token": "access-token-9",
+                    "token_type": "DPoP",
+                    "expires_in": 300,
+                }
+            ).encode("utf-8")
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, exc_type, exc, tb) -> None:
+            return None
+
+    def _fake_urlopen(_request, timeout):
+        form = dict(urllib.parse.parse_qsl(_request.data.decode("utf-8")))
+        seen_tokens.append(form["refresh_token"])
+        if len(seen_tokens) == 1:
+            raise _invalid_grant_http_error()
+        return _ProfileLessResponse()
+
+    stub_authenticated_urlopen(monkeypatch, _fake_urlopen)
+    _allow_refresh(monkeypatch)
+
+    original_get = GuardStore.get_oauth_local_credentials
+
+    def _patched_get(self, *args, **kwargs):
+        if self is store:
+            return rotated
+        return original_get(self, *args, **kwargs)
+
+    monkeypatch.setattr(GuardStore, "get_oauth_local_credentials", _patched_get)
+
+    context = guard_runner_module._resolve_guard_sync_auth_context_from_oauth_credentials(
+        store,
+        initial,
+        force_refresh=True,
+        persist_recovered_secret=False,
+    )
+
+    assert context["access_token"] == "access-token-9"
+
+    monkeypatch.setattr(GuardStore, "get_oauth_local_credentials", original_get)
+    persisted = original_get(store, allow_primary=True)
+    assert persisted is not None
+    assert persisted.get("cloud_user_profile") == {"name": "fresh-peer"}
+    assert seen_tokens == ["refresh-token-1", "refresh-token-2"]

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/tests/test_guard_runtime.py

@@ -23888,8 +23888,9 @@ def test_resolve_guard_sync_auth_context_serializes_refresh_token_rotation(tmp_p
         client_id: str,
         refresh_token: str,
         dpop_key_material,
+        credential_reloader=None,
     ) -> dict[str, object]:
-        del token_endpoint, client_id, dpop_key_material
+        del token_endpoint, client_id, dpop_key_material, credential_reloader
         observed_refresh_tokens.append(refresh_token)
         if refresh_token == "refresh-token-1":
             first_refresh_started.set()

{plugin_scanner-3.0.38 → plugin_scanner-3.0.39}/uv.lock

@@ -1174,7 +1174,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "3.0.38"
+version = "3.0.39"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },

plugin_scanner-3.0.38/ci/test-suite-ratchet-baseline.json

@@ -1,5 +0,0 @@
-{
-  "schema_version": 1,
-  "maximum_collected_cases": 16507,
-  "maximum_test_source_lines": 356714
-}