plugin-scanner 3.0.45__tar.gz → 3.0.46__tar.gz

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.45
+Version: 3.0.46
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

plugin_scanner-3.0.46/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "schema_version": 1,
+  "maximum_collected_cases": 16826,
+  "maximum_test_source_lines": 365222
+}

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "3.0.45"
+version = "3.0.46"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "3.0.45"
+version = "3.0.46"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-3.0.45/release-metadata/plugin-scanner-v3.0.45.toolchain.cdx.json → plugin_scanner-3.0.46/release-metadata/plugin-scanner-v3.0.46.toolchain.cdx.json

@@ -27,7 +27,7 @@
     "component": {
       "name": "hol-guard-release-toolchain",
       "type": "application",
-      "version": "3.0.45"
+      "version": "3.0.46"
     }
   },
   "specVersion": "1.6",

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/adapters/cursor_hook_script_template_tail.py

@@ -2,20 +2,21 @@
 
 from __future__ import annotations
 
-HOOK_SCRIPT_TEMPLATE_TAIL = """def _recording_only_from_guard_home() -> bool:
+HOOK_SCRIPT_TEMPLATE_TAIL = """def _recording_only_from_guard_home(workspace: str | None = None) -> bool:
     try:
         from codex_plugin_scanner.guard.config import load_guard_config
         from codex_plugin_scanner.guard.protection_posture import protection_is_off
 
-        config = load_guard_config(Path(GUARD_HOME))
+        workspace_path = Path(workspace) if workspace else None
+        config = load_guard_config(Path(GUARD_HOME), workspace=workspace_path)
         return protection_is_off(posture=config.protection_posture, mode=config.mode)
     except Exception:
         return False
 
 
-def _cursor_permission(policy_action: str, guard_payload: dict[str, object]) -> str:
+def _cursor_permission(policy_action: str, guard_payload: dict[str, object], workspace: str | None = None) -> str:
     del guard_payload
-    if _recording_only_from_guard_home():
+    if _recording_only_from_guard_home(workspace):
         return "allow"
     if policy_action not in GUARD_ACTIONS:
         return "deny"
@@ -31,8 +32,9 @@ def _emit_cursor_response(
     hook_event_name: str,
     policy_action: str,
     guard_payload: dict[str, object],
+    workspace: str | None = None,
 ) -> tuple[dict[str, object], int]:
-    permission = _cursor_permission(policy_action, guard_payload)
+    permission = _cursor_permission(policy_action, guard_payload, workspace)
     reason = _cursor_reason(guard_payload)
     if hook_event_name.strip().lower() == "beforereadfile":
         read_permission = "deny" if permission in {"deny", "ask"} else "allow"
@@ -241,6 +243,7 @@ def _cursor_availability_response(
     workspace: str | None,
 ) -> tuple[dict[str, object], int]:
     workspace_path = Path(workspace) if workspace else None
+    recording_only = _recording_only_from_guard_home(workspace)
     try:
         from codex_plugin_scanner.guard.daemon.hook_availability_policy import cursor_fallback_permission
 
@@ -248,8 +251,15 @@ def _cursor_availability_response(
             payload,
             hook_event_name=hook_event_name,
             workspace=workspace_path,
+            guard_home=Path(GUARD_HOME),
+            recording_only=recording_only,
         )
     except Exception:
+        if recording_only:
+            compact = hook_event_name.strip().lower().replace("_", "").replace("-", "")
+            if compact in {"aftershellexecution", "aftermcpexecution"}:
+                return {}, 0
+            return {"permission": "allow"}, 0
         compact = hook_event_name.strip().lower().replace("_", "").replace("-", "")
         if compact in {"aftershellexecution", "aftermcpexecution"}:
             return {}, 0
@@ -298,10 +308,20 @@ def _cursor_availability_response(
         }, 2
 
 
+_LAST_HOOK_EVENT_NAME = ""
+
+
 def main() -> int:
     try:
         return _main_inner()
     except Exception:
+        if _recording_only_from_guard_home():
+            compact = _LAST_HOOK_EVENT_NAME.strip().lower().replace("_", "").replace("-", "")
+            if compact in {"aftershellexecution", "aftermcpexecution"}:
+                print("{}")
+            else:
+                print(json.dumps({"permission": "allow"}))
+            return 0
         print(
             json.dumps(
                 {
@@ -328,6 +348,8 @@ def _main_inner() -> int:
         return 2
     inferred = _infer_cursor_hook_event_name(payload)
     hook_event_name = str(inferred.get("hook_event_name") or inferred.get("hookEventName") or "preToolUse")
+    global _LAST_HOOK_EVENT_NAME
+    _LAST_HOOK_EVENT_NAME = hook_event_name
     prepared = _prepare_cursor_hook_payload(inferred)
     workspace = _workspace_from_cursor_input(prepared)
     guard_argv = list(GUARD_HOOK_ARGV)
@@ -420,7 +442,7 @@ def _main_inner() -> int:
         return 0
     raw_policy_action = guard_payload.get("policy_action")
     if not isinstance(raw_policy_action, str) or raw_policy_action not in GUARD_ACTIONS:
-        if _recording_only_from_guard_home():
+        if _recording_only_from_guard_home(workspace):
             print(json.dumps({"permission": "allow"}))
             return 0
         response, exit_code = _cursor_availability_response(
@@ -443,6 +465,7 @@ def _main_inner() -> int:
         hook_event_name=hook_event_name,
         policy_action=policy_action,
         guard_payload=guard_payload,
+        workspace=workspace,
     )
     print(json.dumps(response))
     return exit_code

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/cli/commands_hook_native_authority.py

@@ -72,6 +72,7 @@ def try_native_hook_authority(
             reason="HOL Guard could not complete the native hook decision safely.",
             workspace=workspace,
             home_dir=home_dir,
+            guard_home=guard_home,
         )
     finally:
         if worker is not None:
@@ -133,6 +134,7 @@ def try_native_or_source_ref_hook(
                 reason="HOL Guard could not complete the native hook decision safely.",
                 workspace=runtime_workspace,
                 home_dir=context.home_dir,
+                guard_home=context.guard_home,
             ),
             getattr(args, "json", False),
         )

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/daemon/hook_availability_policy.py

@@ -23,7 +23,9 @@ _CURSOR_UNAVAILABLE_DENY: dict[str, object] = {
 
 # Native review covers PreToolUse and PostToolUse. Lifecycle events are inventory
 # only: fail-closing them freezes the conversation without adding an enforcement
-# boundary. PostToolUse and PermissionRequest stay withheld/paused.
+# boundary. Protected/Extra careful keep PostToolUse withheld and high-impact
+# PreToolUse paused when native review cannot complete. Watch records those
+# actions and continues them.
 LIFECYCLE_OBSERVE_EVENTS = frozenset(
     {
         "UserPromptSubmit",
@@ -56,6 +58,60 @@ def lifecycle_event_is_observe_only(event_name: str) -> bool:
     return _compact_hook_event_name(event_name) in _LIFECYCLE_CANONICAL_BY_COMPACT
 
 
+def hook_review_is_recording_only(
+    *,
+    guard_home: Path | None = None,
+    workspace: Path | None = None,
+    recording_only: bool = False,
+) -> bool:
+    """True when Watch/observe must record without stopping the harness."""
+
+    if recording_only:
+        return True
+    if guard_home is None:
+        return False
+    try:
+        from ..config import load_guard_config
+        from ..protection_posture import protection_is_off
+
+        config = load_guard_config(guard_home, workspace=workspace)
+    except (OSError, RuntimeError, TypeError, ValueError):
+        return False
+    return protection_is_off(posture=config.protection_posture, mode=config.mode)
+
+
+_DECISION_HOOK_HARNESSES = frozenset({"grok", "hermes", "openclaw", "pi", "omp"})
+
+
+def recording_only_pre_tool_response(
+    harness: str,
+    *,
+    reason_code: str,
+    reason: str,
+) -> dict[str, object]:
+    """Continue a PreToolUse hook in Watch without changing Protected fail-closed JSON."""
+
+    from .hook_worker_responses import harness_json_from_native_pre_tool
+
+    if harness.strip().lower().replace("_", "-") in _DECISION_HOOK_HARNESSES:
+        return {
+            "decision": "allow",
+            "policy_action": "warn",
+            "reason_code": reason_code,
+            "reason": reason,
+        }
+    return harness_json_from_native_pre_tool(
+        harness,
+        {
+            "decision": "allow",
+            "minimum_action": "warn",
+            "policy_action": "warn",
+            "reason_code": reason_code,
+            "reason": reason,
+        },
+    )
+
+
 def availability_harness_response(
     payload: Mapping[str, object],
     *,
@@ -65,6 +121,8 @@ def availability_harness_response(
     reason: str,
     workspace: Path | None = None,
     home_dir: Path | None = None,
+    guard_home: Path | None = None,
+    recording_only: bool = False,
 ) -> dict[str, object]:
     """Render a schema-valid harness result when native review is unavailable."""
 
@@ -81,6 +139,23 @@ def availability_harness_response(
             event_name=canonical_lifecycle,
             reason_code=reason_code,
         )
+    watch_only = hook_review_is_recording_only(
+        guard_home=guard_home,
+        workspace=workspace,
+        recording_only=recording_only,
+    )
+    if watch_only:
+        if event_name != "PreToolUse":
+            return observe_lifecycle_fail_safe_response(
+                harness,
+                event_name=event_name,
+                reason_code=reason_code,
+            )
+        return recording_only_pre_tool_response(
+            harness,
+            reason_code=reason_code,
+            reason=reason,
+        )
     if event_name != "PreToolUse":
         return post_tool_fail_safe_response(harness, reason=reason, reason_code=reason_code)
     if not hook_action_is_emergency_safe(
@@ -116,12 +191,20 @@ def cursor_fallback_permission(
     hook_event_name: str,
     workspace: Path | None = None,
     home_dir: Path | None = None,
+    guard_home: Path | None = None,
+    recording_only: bool = False,
 ) -> tuple[dict[str, object], int]:
     """Return Cursor hook stdout when daemon or native review cannot complete."""
 
     compact = hook_event_name.strip().lower().replace("_", "").replace("-", "")
     if compact in {"aftershellexecution", "aftermcpexecution"}:
         return {}, 0
+    if hook_review_is_recording_only(
+        guard_home=guard_home,
+        workspace=workspace,
+        recording_only=recording_only,
+    ):
+        return {"permission": "allow"}, 0
     if compact in {"beforewritefile", "beforemcpexecution"}:
         return dict(_CURSOR_UNAVAILABLE_DENY), 2
     if hook_action_is_emergency_safe(payload, workspace=workspace, home_dir=home_dir):
@@ -142,5 +225,7 @@ __all__ = [
     "availability_harness_response",
     "cursor_fallback_permission",
     "hook_action_is_emergency_safe",
+    "hook_review_is_recording_only",
     "lifecycle_event_is_observe_only",
+    "recording_only_pre_tool_response",
 ]

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/daemon/hook_worker_native.py

@@ -8,13 +8,15 @@ from pathlib import Path
 from typing import Protocol
 
 from ..cli.commands_support_command_activity import hook_post_succeeded
-from ..config import load_guard_config
 from ..native_mode import python_oracle_surface_enabled
 from ..native_route_receipt import record_python_semantic_hook_route
 from ..native_runtime import NativeRuntimeStatus
-from ..protection_posture import protection_is_off
 from ..runtime.hook_review_types import HookReviewRequest, HookReviewResponse
-from .hook_availability_policy import availability_harness_response
+from .hook_availability_policy import (
+    availability_harness_response,
+    hook_review_is_recording_only,
+    recording_only_pre_tool_response,
+)
 from .hook_request_parsing import pre_tool_command
 from .hook_worker_responses import (
     harness_json_from_native_post_tool,
@@ -23,6 +25,26 @@ from .hook_worker_responses import (
 )
 
 
+def _watch_native_pre_tool_result(native: Mapping[str, object]) -> dict[str, object]:
+    rewritten = dict(native)
+    if str(rewritten.get("minimum_action") or "") == "allow" and rewritten.get("decision") == "allow":
+        return rewritten
+    rewritten["decision"] = "allow"
+    rewritten["minimum_action"] = "warn"
+    rewritten["policy_action"] = "warn"
+    return rewritten
+
+
+def _watch_native_post_tool_result(native: Mapping[str, object]) -> dict[str, object]:
+    rewritten = dict(native)
+    if rewritten.get("decision") == "allow" and rewritten.get("model_output_action") == "allow_original":
+        return rewritten
+    rewritten["decision"] = "allow"
+    rewritten["model_output_action"] = "allow_original"
+    rewritten["policy_action"] = "warn"
+    return rewritten
+
+
 class PythonOracle(Protocol):
     """Minimal response surface accepted from an explicit test oracle."""
 
@@ -53,6 +75,45 @@ class _HookWorkerNativeHost(Protocol):
     _record_native_decision_receipt: Callable[[object], None]
 
 
+def _record_unavailable_native(
+    host: _HookWorkerNativeHost,
+    payload: dict[str, object],
+    *,
+    harness: str,
+    event_name: str,
+    reason_code: str,
+    workspace: Path | None,
+    home_dir: Path,
+    guard_home: Path,
+    recording_only: bool,
+) -> dict[str, object]:
+    response = availability_harness_response(
+        payload,
+        harness=harness,
+        event_name=event_name,
+        reason_code=reason_code,
+        reason="HOL Guard could not complete the native hook decision safely.",
+        workspace=workspace,
+        home_dir=home_dir,
+        guard_home=guard_home,
+        recording_only=recording_only,
+    )
+    route = "native_degraded" if response.get("reason_code") == "native_degraded_emergency_safe" else "native_fail_safe"
+    host.metrics.record_route(route)
+    if event_name == "PreToolUse":
+        writer = host.activity_writer
+        submit = getattr(writer, "submit_command_activity", None)
+        if callable(submit):
+            with suppress(Exception):
+                _ = submit(
+                    harness=harness,
+                    event=event_name,
+                    payload=payload,
+                    succeeded=str(response.get("policy_action") or "") != "block",
+                )
+    return response
+
+
 class HookWorkerNativeMixin:
     """Native edge and explicit-oracle paths kept out of the worker facade."""
 
@@ -96,17 +157,36 @@ class HookWorkerNativeMixin:
         command = pre_tool_command(payload)
         if command is None:
             raise HookWorkerUnsupported("fast path PreToolUse requires a command")
-        config = load_guard_config(guard_home, workspace=workspace)
-        recording_only = protection_is_off(posture=config.protection_posture, mode=config.mode)
+        recording_only = hook_review_is_recording_only(guard_home=guard_home, workspace=workspace)
         native = self._review_pre_tool_native(command, guard_home=guard_home, cwd=workspace, home_dir=home_dir)
         if native is not None:
-            action = str(native.get("minimum_action") or "")
-            if action == "review" or (recording_only and action != "allow"):
-                record_python_semantic_hook_route()
-                raise HookWorkerUnsupported("native PreToolUse review uses CLI approval coordination")
+            if recording_only:
+                action = str(native.get("minimum_action") or "")
+                if action != "allow" or native.get("decision") != "allow":
+                    native = _watch_native_pre_tool_result(native)
+                    return recording_only_pre_tool_response(
+                        harness,
+                        reason_code=str(native.get("reason_code") or "watch_recording_only"),
+                        reason=str(native.get("reason") or "Watch recorded this action without stopping it."),
+                    )
+            else:
+                action = str(native.get("minimum_action") or "")
+                if action == "review":
+                    record_python_semantic_hook_route()
+                    raise HookWorkerUnsupported("native PreToolUse review uses CLI approval coordination")
             return harness_json_from_native_pre_tool(harness, native)
         if recording_only:
-            raise HookWorkerUnsupported("observe PreToolUse uses CLI recording")
+            return _record_unavailable_native(
+                self,
+                payload,
+                harness=harness,
+                event_name="PreToolUse",
+                reason_code="watch_recording_only",
+                workspace=workspace,
+                home_dir=home_dir,
+                guard_home=guard_home,
+                recording_only=True,
+            )
         status = self._native_runtime_status()
         if status.mode == "off":
             raise HookWorkerUnsupported("native PreToolUse runtime is off")
@@ -131,7 +211,9 @@ class HookWorkerNativeMixin:
         deadline: float | None,
     ) -> dict[str, object]:
         policy_snapshot = self._native_policy_snapshot(workspace)
-        recording_only = policy_snapshot is not None and policy_snapshot.get("mode") == "observe"
+        recording_only = hook_review_is_recording_only(guard_home=guard_home, workspace=workspace) or (
+            policy_snapshot is not None and policy_snapshot.get("mode") == "observe"
+        )
         edge = self._review_raw_hook_native(
             payload=payload,
             harness=harness,
@@ -155,46 +237,47 @@ class HookWorkerNativeMixin:
                 "PostToolUse": "native_post_tool_unavailable",
                 "PreToolUse": "native_pre_tool_unavailable",
             }.get(event_name, "native_hook_event_unavailable")
-            response = availability_harness_response(
+            return _record_unavailable_native(
+                self,
                 payload,
                 harness=harness,
                 event_name=event_name,
                 reason_code=reason_code,
-                reason="HOL Guard could not complete the native hook decision safely.",
                 workspace=workspace,
                 home_dir=home_dir,
+                guard_home=guard_home,
+                recording_only=recording_only,
             )
-            route = (
-                "native_degraded"
-                if response.get("reason_code") == "native_degraded_emergency_safe"
-                else "native_fail_safe"
-            )
-            self.metrics.record_route(route)
-            return response
         native_event = str(edge["event_name"])
         native_harness = str(edge["harness"])
         native_result = edge["result"]
         if not isinstance(native_result, Mapping):
-            response = availability_harness_response(
+            return _record_unavailable_native(
+                self,
                 payload,
                 harness=harness,
                 event_name=event_name,
                 reason_code="native_hook_edge_invalid_response",
-                reason="HOL Guard could not complete the native hook decision safely.",
                 workspace=workspace,
                 home_dir=home_dir,
+                guard_home=guard_home,
+                recording_only=recording_only,
             )
-            route = (
-                "native_degraded"
-                if response.get("reason_code") == "native_degraded_emergency_safe"
-                else "native_fail_safe"
-            )
-            self.metrics.record_route(route)
-            return response
         self._record_native_decision_receipt(edge.get("receipt"))
         self.metrics.record_route("native_resident")
         if native_event == "PreToolUse":
+            if recording_only:
+                action = str(native_result.get("minimum_action") or "")
+                if action != "allow" or native_result.get("decision") != "allow":
+                    native_result = _watch_native_pre_tool_result(native_result)
+                    return recording_only_pre_tool_response(
+                        native_harness,
+                        reason_code=str(native_result.get("reason_code") or "watch_recording_only"),
+                        reason=str(native_result.get("reason") or "Watch recorded this action without stopping it."),
+                    )
             return harness_json_from_native_pre_tool(native_harness, native_result)
+        if recording_only:
+            native_result = _watch_native_post_tool_result(native_result)
         self._record_post_tool_activity(
             harness=native_harness,
             payload=payload,

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/daemon/manager.py

@@ -1124,10 +1124,10 @@ def _daemon_healthz_details_match_guard_home(
 
 
 def _daemon_healthz_details_match_current_runtime(payload: dict[str, object]) -> bool:
-    return (
-        payload.get("package_version") == __version__
-        and payload.get("runtime_fingerprint") == _current_guard_daemon_runtime_fingerprint()
-    )
+    """Match live daemon identity including protocol compatibility."""
+
+    # Same-release peers still require a current compatibility version.
+    return _guard_daemon_state_matches_current_runtime(payload)
 
 
 def _guard_daemon_url_port(url: str) -> int | None:
@@ -2598,11 +2598,11 @@ def _running_guard_daemon_processes_for_guard_home(guard_home: Path) -> list[tup
 
 
 def _guard_daemon_state_matches_current_runtime(payload: dict[str, object]) -> bool:
-    compatibility_version = payload.get("compatibility_version")
-    if compatibility_version != GUARD_DAEMON_COMPATIBILITY_VERSION:
-        return False
-    runtime_fingerprint = payload.get("runtime_fingerprint")
-    return isinstance(runtime_fingerprint, str) and runtime_fingerprint == _current_guard_daemon_runtime_fingerprint()
+    fingerprint = payload.get("runtime_fingerprint")
+    compatible = payload.get("compatibility_version") == GUARD_DAEMON_COMPATIBILITY_VERSION
+    current = fingerprint == _current_guard_daemon_runtime_fingerprint()
+    peer = payload.get("package_version") == __version__
+    return compatible and isinstance(fingerprint, str) and bool(fingerprint.strip()) and (current or peer)
 
 
 def _current_guard_daemon_source_root() -> str:

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/daemon/runtime_repair.py

@@ -10,7 +10,6 @@ from ...version import __version__
 from .live_identity import verified_live_guard_daemon_identity
 from .manager import (
     clear_guard_daemon_state,
-    current_guard_daemon_runtime_fingerprint,
     ensure_guard_daemon_after_update,
     guard_daemon_retirement_is_complete,
     repair_approval_center_locator,
@@ -51,11 +50,7 @@ def repair_guard_daemon_runtime(
             current_version = Version(__version__)
         except InvalidVersion as error:
             raise RuntimeError("Installed Guard package version is invalid.") from error
-        current_fingerprint = current_guard_daemon_runtime_fingerprint()
-        if verified_runtime is not None and (
-            verified_runtime[0] > current_version
-            or (verified_runtime[0] == current_version and verified_runtime[2] == current_fingerprint)
-        ):
+        if verified_runtime is not None and verified_runtime[0] >= current_version:
             daemon_version, daemon_version_text, _ = verified_runtime
             return {
                 **result,

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -150,6 +150,7 @@ from ..policy_bundle_trusted_keys import (
     validate_synced_policy_bundle,
 )
 from ..policy_bundle_v2 import POLICY_BUNDLE_V2_CONTRACT
+from ..protection_posture import protection_is_off
 from ..receipts.manager import build_receipt
 from ..runtime.approval_attention import ApprovalAttentionCoordinator
 from ..runtime.cloud_review_sync import CloudReviewSyncWorker, start_cloud_sync_sync_worker, stop_cloud_sync_sync_worker
@@ -5926,48 +5927,31 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
         harness = (runtime_harness or default_harness).strip().lower().replace("_", "-")
         event = self._optional_string(payload.get("hook_event_name", payload.get("event"))) or "PreToolUse"
         daemon_server = getattr(self, "server", None)
+        workspace_path, home_path = self._validated_fail_safe_hook_paths(params)
+        guard_home = None if daemon_server is None else cast(_GuardDaemonHttpServer, daemon_server).store.guard_home
         try:
-            observe_mode = (
-                daemon_server is not None
-                and load_guard_config(cast(_GuardDaemonHttpServer, daemon_server).store.guard_home).mode == "observe"
-            )
+            loaded = None if guard_home is None else load_guard_config(guard_home, workspace=workspace_path)
+            observe_mode = loaded is not None and protection_is_off(posture=loaded.protection_posture, mode=loaded.mode)
         except (OSError, RuntimeError, TypeError, ValueError):
             observe_mode = False
         if observe_mode and not native_authoritative:
             if harness in {"pi", "omp"}:
-                return {
-                    "decision": "allow",
-                    "reason_code": reason_code,
-                    "observed_review_failure": True,
-                }
+                return {"decision": "allow", "reason_code": reason_code, "observed_review_failure": True}
             if event == "PermissionRequest":
                 return {
                     "reason_code": reason_code,
-                    "hookSpecificOutput": {
-                        "hookEventName": event,
-                        "decision": {
-                            "behavior": "allow",
-                        },
-                    },
+                    "hookSpecificOutput": {"hookEventName": event, "decision": {"behavior": "allow"}},
                 }
             if event == "PreToolUse":
                 return {
                     "reason_code": reason_code,
-                    "hookSpecificOutput": {
-                        "hookEventName": event,
-                        "permissionDecision": "allow",
-                    },
+                    "hookSpecificOutput": {"hookEventName": event, "permissionDecision": "allow"},
                 }
-            return {
-                "continue": True,
-                "reason_code": reason_code,
-                "observed_review_failure": True,
-            }
+            return {"continue": True, "reason_code": reason_code, "observed_review_failure": True}
         from .hook_availability_policy import availability_harness_response, lifecycle_event_is_observe_only
 
         if event == "PreToolUse" or lifecycle_event_is_observe_only(event):
             payload_dict = dict(payload) if isinstance(payload, Mapping) else {}
-            workspace_path, home_path = self._validated_fail_safe_hook_paths(params)
             return availability_harness_response(
                 payload_dict,
                 harness=harness,
@@ -5976,6 +5960,8 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 reason=reason,
                 workspace=workspace_path,
                 home_dir=home_path,
+                guard_home=guard_home,
+                recording_only=observe_mode,
             )
         if harness in {"pi", "omp"}:
             return {
@@ -5990,18 +5976,10 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 "reason_code": reason_code,
                 "hookSpecificOutput": {
                     "hookEventName": event,
-                    "decision": {
-                        "behavior": "deny",
-                        "message": reason,
-                    },
+                    "decision": {"behavior": "deny", "message": reason},
                 },
             }
-        return {
-            "continue": False,
-            "stopReason": reason,
-            "systemMessage": reason,
-            "reason_code": reason_code,
-        }
+        return {"continue": False, "stopReason": reason, "systemMessage": reason, "reason_code": reason_code}
 
     def _validated_fail_safe_hook_paths(
         self,

{plugin_scanner-3.0.45 → plugin_scanner-3.0.46}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "3.0.45"
+__version__ = "3.0.46"