# HOL Guard release/3.0 code-quality audit

This inventory is generated by `scripts/ci/code_quality_audit.py`. It records structural debt without treating a large file or complex function as proof of a bug.

## Summary

| Metric | Count |
| --- | ---: |
| Code/config files scanned | 2213 |
| Files over 500 lines | 322 |
| Handwritten files over 500 lines | 309 |
| Generated files over 500 lines | 13 |
| Production/tooling Python functions | 11534 |
| Python functions at least 100 lines | 247 |
| Python functions at complexity 30+ | 154 |
| Exact Python function-copy groups | 1 |
| Functions in exact-copy groups | 2 |
| Silent broad exception handlers | 36 |
| Forbidden one-shot delivery artifacts | 0 |

## Files over 500 lines

| Lines | Category | Generated | Path |
| ---: | --- | --- | --- |
| 31158 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js` |
| 25646 | test | no | `tests/test_guard_runtime.py` |
| 10103 | test | no | `tests/test_guard_cli.py` |
| 9056 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/index.css` |
| 8837 | production | no | `src/codex_plugin_scanner/guard/daemon/server.py` |
| 6435 | production | no | `src/codex_plugin_scanner/guard/runtime/runner.py` |
| 4996 | production | no | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py` |
| 4888 | test | no | `tests/test_guard_risk.py` |
| 4614 | test | no | `tests/test_guard_surface_server.py` |
| 4436 | production | no | `src/codex_plugin_scanner/guard/local_supply_chain.py` |
| 4421 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/settings-workspace.js` |
| 4281 | production | no | `dashboard/src/guard-api.ts` |
| 4247 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/policy-workspace-page.js` |
| 4061 | test | no | `tests/test_guard_headless_daemon_api.py` |
| 3921 | test | no | `tests/test_guard_approvals.py` |
| 3899 | production | no | `src/codex_plugin_scanner/guard/proxy/runtime_mcp.py` |
| 3817 | test | no | `tests/test_guard_command_queue.py` |
| 3803 | test | no | `tests/test_guard_policy_integrity.py` |
| 3283 | test | no | `tests/test_guard_supply_chain_evaluator.py` |
| 3161 | test | no | `tests/test_guard_package_shims.py` |
| 2952 | test | no | `tests/test_guard_daemon_manager.py` |
| 2941 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/extensions-workspace.js` |
| 2928 | production | no | `src/codex_plugin_scanner/guard/daemon/manager.py` |
| 2884 | production | no | `src/codex_plugin_scanner/guard/cli/render.py` |
| 2834 | test | no | `tests/test_guard_codex_install.py` |
| 2792 | production | no | `src/codex_plugin_scanner/guard/cli/update_commands.py` |
| 2762 | test | no | `tests/test_guard_consumer_approval_precedence.py` |
| 2659 | production | no | `src/codex_plugin_scanner/guard/approvals.py` |
| 2562 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/supply-chain-hub-workspace.js` |
| 2527 | test | no | `tests/test_guard_runtime_mcp_saved_blocks.py` |
| 2509 | production | no | `dashboard/src/settings-workspace.tsx` |
| 2444 | test | no | `tests/test_cursor_hooks.py` |
| 2442 | test | no | `tests/test_guard_store_migrations.py` |
| 2422 | test | no | `tests/test_guard_phase03_local_install.py` |
| 2167 | test | no | `tests/test_guard_approval_gate.py` |
| 2154 | production | no | `src/codex_plugin_scanner/guard/cli/update_subprocess.py` |
| 2153 | production | no | `src/codex_plugin_scanner/guard/store_policy.py` |
| 2126 | test | no | `tests/test_guard_manifest_install_firewall.py` |
| 2116 | test | no | `tests/test_guard_oauth_device_connect.py` |
| 2050 | test | no | `tests/test_guard_update_subprocess.py` |
| 1929 | test | no | `tests/test_guard_codex_proxy.py` |
| 1929 | test | no | `dashboard/src/guard-api.test.ts` |
| 1925 | production | no | `dashboard/src/apps/app-detail-workspace.tsx` |
| 1859 | production | no | `src/codex_plugin_scanner/guard/consumer/service.py` |
| 1819 | production | no | `src/codex_plugin_scanner/guard/inventory_contract.py` |
| 1800 | production | no | `src/codex_plugin_scanner/guard/adapters/codex.py` |
| 1793 | test | no | `tests/test_guard_approval_reuse.py` |
| 1767 | test | no | `tests/test_dashboard_update.py` |
| 1749 | production | no | `src/codex_plugin_scanner/guard/runtime/package_intent_parser.py` |
| 1724 | production | no | `src/codex_plugin_scanner/guard/runtime/approval_context.py` |
| 1656 | production | no | `src/codex_plugin_scanner/guard/store_base.py` |
| 1655 | test | no | `tests/test_guard_approval_precedence_generic_stdio.py` |
| 1648 | production | no | `src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py` |
| 1646 | test | no | `tests/test_hermes_adapter.py` |
| 1611 | production | yes | `dashboard/pnpm-lock.yaml` |
| 1605 | production | no | `src/codex_plugin_scanner/guard/shims.py` |
| 1591 | workflow | no | `.github/workflows/publish.yml` |
| 1564 | production | no | `src/codex_plugin_scanner/guard/mcp_tool_calls.py` |
| 1559 | test | no | `tests/test_guard_runtime_detectors.py` |
| 1495 | test | no | `dashboard/src/phase09-review.test.ts` |
| 1483 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/app-detail-workspace.js` |
| 1467 | test | no | `tests/test_guard_phase05_approval_memory.py` |
| 1455 | production | no | `src/codex_plugin_scanner/guard/cli/connect_flow.py` |
| 1451 | production | no | `src/codex_plugin_scanner/guard/store_approvals.py` |
| 1414 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/audit-workspace.js` |
| 1411 | test | no | `tests/test_guard_mcp_protection.py` |
| 1409 | production | no | `src/codex_plugin_scanner/guard/adapters/hermes.py` |
| 1381 | test | no | `tests/test_guard_launch_env.py` |
| 1379 | production | no | `src/codex_plugin_scanner/guard/cli/commands_hook_generic.py` |
| 1356 | production | no | `src/codex_plugin_scanner/guard/store_connection_schema.py` |
| 1354 | production | no | `src/codex_plugin_scanner/guard/approval_gate.py` |
| 1315 | test | no | `tests/test_guard_aibom_cli.py` |
| 1288 | test | no | `tests/test_guard_hook_process_runner.py` |
| 1287 | test | no | `tests/test_guard_protect.py` |
| 1284 | production | no | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_eval.py` |
| 1280 | production | no | `src/codex_plugin_scanner/guard/cli/update_artifact.py` |
| 1279 | test | no | `tests/test_guard_events.py` |
| 1272 | test | no | `dashboard/src/queue-state.test.ts` |
| 1262 | test | no | `tests/test_guard_cloud_local_sync.py` |
| 1258 | production | no | `dashboard/src/queue-state.ts` |
| 1216 | test | no | `tests/test_policy_bundle_parser.py` |
| 1197 | production | no | `src/codex_plugin_scanner/guard/store_secret_policy_integrity.py` |
| 1194 | test | no | `tests/test_guard_mcp_package_proxy_phase14.py` |
| 1182 | production | no | `src/codex_plugin_scanner/guard/runtime/actions.py` |
| 1178 | production | no | `src/codex_plugin_scanner/guard/config.py` |
| 1169 | test | no | `tests/test_guard_approval_precedence_consumers.py` |
| 1153 | production | no | `src/codex_plugin_scanner/guard/store_oauth.py` |
| 1149 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_hook_state.py` |
| 1140 | production | no | `dashboard/src/guard-types.ts` |
| 1133 | production | no | `dashboard/src/home-dashboard.tsx` |
| 1132 | test | no | `tests/test_guard_hook_post_claim_freshness.py` |
| 1130 | production | no | `src/codex_plugin_scanner/guard/protect.py` |
| 1122 | test | no | `tests/test_guard_oci_plan_generator.py` |
| 1120 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py` |
| 1089 | test | no | `tests/test_guard_aibom_trust_metadata.py` |
| 1088 | test | no | `tests/test_guard_update_artifact.py` |
| 1084 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/supply-chain-workspace.js` |
| 1074 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py` |
| 1071 | production | no | `src/codex_plugin_scanner/guard/runtime/decisions.py` |
| 1066 | test | no | `tests/test_guard_github_command_capabilities.py` |
| 1065 | test | no | `tests/test_guard_render.py` |
| 1065 | test | no | `tests/test_guard_browser_mcp_intent.py` |
| 1063 | test | no | `tests/test_guard_extension_control_authority.py` |
| 1057 | test | no | `tests/test_guard_connect_flow.py` |
| 1052 | production | no | `src/codex_plugin_scanner/guard/aibom_cli.py` |
| 1049 | test | no | `tests/test_guard_local_supply_chain_audit_phase16.py` |
| 1049 | production | no | `src/codex_plugin_scanner/guard/runtime/oci_plan_generator.py` |
| 1046 | production | no | `dashboard/src/supply-chain-firewall-panel.tsx` |
| 1045 | test | no | `tests/test_guard_authoritative_decision.py` |
| 1043 | test | no | `tests/test_guard_js_supply_chain_phase11.py` |
| 1042 | test | no | `tests/test_opencode_adapter.py` |
| 1042 | production | no | `src/codex_plugin_scanner/guard/aibom_trust_metadata.py` |
| 1034 | test | no | `tests/test_codex_daemon_hook_bridge.py` |
| 1032 | production | no | `src/codex_plugin_scanner/guard/runtime/command_executors.py` |
| 1030 | production | no | `dashboard/src/approval-center-primitives.tsx` |
| 1028 | production | no | `dashboard/src/app.tsx` |
| 1008 | production | no | `dashboard/src/shell-navigation.css` |
| 1006 | production | no | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py` |
| 997 | test | no | `tests/test_guard_live_request_outbox.py` |
| 995 | production | no | `src/codex_plugin_scanner/guard/runtime/oci_isolation_provider.py` |
| 987 | test | no | `tests/test_guard_mcp_policy_tools.py` |
| 982 | production | no | `src/codex_plugin_scanner/guard/store_receipt_rollups.py` |
| 981 | test | no | `tests/test_guard_package_intent.py` |
| 976 | test | no | `tests/test_pi_adapter.py` |
| 972 | test | no | `tests/test_guard_approval_scope_contract.py` |
| 971 | production | no | `src/codex_plugin_scanner/guard/runtime/browser_mcp_intent.py` |
| 971 | production | no | `src/codex_plugin_scanner/guard/proxy/stdio.py` |
| 965 | production | no | `src/codex_plugin_scanner/guard/secrets/secret_detection.py` |
| 957 | test | no | `tests/test_guard_copilot_adapter.py` |
| 950 | test | no | `tests/test_guard_product_flow.py` |
| 941 | test | no | `tests/test_guard_queue_api_contract.py` |
| 938 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/home-dashboard.js` |
| 937 | test | no | `tests/test_guard_codex_resume_endpoints.py` |
| 918 | production | no | `src/codex_plugin_scanner/guard/store_policy_source_context.py` |
| 912 | test | no | `tests/test_guard_daemon_decision_boundary.py` |
| 901 | production | no | `dashboard/src/policy-cloud-exception-request-steps.tsx` |
| 901 | production | no | `dashboard/src/approval-center-utils.ts` |
| 886 | test | no | `tests/test_guard_supply_chain_sync.py` |
| 882 | production | no | `src/codex_plugin_scanner/guard/runtime/detectors.py` |
| 872 | production | no | `src/codex_plugin_scanner/guard/store_live_request_outbox.py` |
| 870 | test | no | `tests/test_guard_command_extensions.py` |
| 865 | test | no | `tests/test_guard_local_supply_chain_phase15.py` |
| 864 | production | no | `rust/crates/guard-runtime/src/main.rs` |
| 860 | production | no | `src/codex_plugin_scanner/guard/store_receipts.py` |
| 856 | test | no | `tests/test_guard_package_hook.py` |
| 854 | production | no | `src/codex_plugin_scanner/guard/adapters/copilot.py` |
| 851 | test | no | `tests/test_guard_phase06_workspace_audit.py` |
| 844 | test | no | `tests/test_hook_source_read_fast_path.py` |
| 844 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_codex_reads.py` |
| 843 | test | no | `tests/test_guard_inventory_contract.py` |
| 838 | production | no | `src/codex_plugin_scanner/guard/adapters/opencode.py` |
| 833 | production | no | `src/codex_plugin_scanner/guard/runtime/git_execution_safety.py` |
| 832 | test | no | `tests/test_guard_direct_vitest.py` |
| 817 | test | no | `tests/test_guard_approval_decisions.py` |
| 812 | test | no | `tests/test_guard_receipt_redaction_cursor.py` |
| 812 | test | no | `tests/test_guard_oauth_reconnect.py` |
| 807 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_resolution.py` |
| 797 | test | no | `tests/test_guard_auto_first_sync.py` |
| 795 | test | no | `tests/test_guard_k8s_runtimeclass_provider.py` |
| 793 | test | no | `tests/test_guard_hook_worker.py` |
| 789 | production | no | `dashboard/src/supply-chain-firewall-views.tsx` |
| 787 | production | no | `src/codex_plugin_scanner/verification.py` |
| 786 | test | no | `tests/test_opencode_pretool.py` |
| 776 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_interaction.py` |
| 768 | test | no | `tests/test_guard_live_request_sync.py` |
| 764 | test | no | `tests/test_guard_queue_contract.py` |
| 764 | production | no | `src/codex_plugin_scanner/guard/runtime/live_request_sync.py` |
| 760 | test | no | `tests/test_guard_hook_executable_identity.py` |
| 754 | production | no | `src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py` |
| 748 | test | no | `tests/test_guard_config_paths.py` |
| 745 | test | no | `tests/test_guard_shell_execution_context.py` |
| 745 | test | no | `tests/test_guard_cisco_runtime_cli.py` |
| 738 | production | no | `src/codex_plugin_scanner/guard/runtime/false_positive_rules.py` |
| 738 | production | no | `src/codex_plugin_scanner/guard/aibom_detection.py` |
| 737 | test | no | `tests/test_guard_approval_store_scale.py` |
| 735 | production | no | `src/codex_plugin_scanner/guard/runtime/command_queue.py` |
| 733 | production | no | `rust/crates/guard-secure-fs/src/lib.rs` |
| 732 | production | no | `src/codex_plugin_scanner/checks/security.py` |
| 724 | production | no | `src/codex_plugin_scanner/guard/store_policy_integrity_runtime.py` |
| 722 | production | no | `src/codex_plugin_scanner/guard/adapters/opencode_pretool.py` |
| 720 | test | no | `tests/test_guard_claude_adapter.py` |
| 713 | test | no | `tests/test_guard_phase03_remainder.py` |
| 712 | production | no | `src/codex_plugin_scanner/guard/policy_bundle_parser.py` |
| 711 | test | no | `tests/test_guard_approval_copy_commands.py` |
| 710 | test | no | `tests/test_guard_codex_browser_authority.py` |
| 707 | test | no | `tests/test_action_runner.py` |
| 707 | production | no | `src/codex_plugin_scanner/guard/daemon/hook_process_runner.py` |
| 705 | production | no | `dashboard/src/audit-workspace.tsx` |
| 702 | test | no | `tests/test_guard_interpreted_entrypoint_identity.py` |
| 689 | test | no | `tests/test_guard_mdm_lifecycle.py` |
| 687 | production | no | `src/codex_plugin_scanner/guard/adapters/pi.py` |
| 686 | test | no | `tests/test_policy_bundle_trust_regressions.py` |
| 686 | test | no | `tests/test_guard_routine_local_node.py` |
| 680 | production | no | `src/codex_plugin_scanner/guard/native_runtime.py` |
| 679 | test | no | `tests/test_policy_document_io.py` |
| 678 | test | no | `tests/test_mcp_security.py` |
| 678 | production | no | `src/codex_plugin_scanner/guard/runtime/linux_artifact_lifecycle.py` |
| 677 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/about-workspace.js` |
| 670 | test | no | `tests/test_guard_mdm_policy.py` |
| 670 | production | no | `dashboard/src/styles.css` |
| 669 | production | no | `src/codex_plugin_scanner/action_runner.py` |
| 666 | production | no | `src/codex_plugin_scanner/guard/cli/commands_dispatch_records.py` |
| 665 | production | no | `src/codex_plugin_scanner/integrations/cisco_mcp_scanner.py` |
| 663 | production | no | `src/codex_plugin_scanner/guard/daemon/dashboard_update.py` |
| 658 | production | no | `src/codex_plugin_scanner/guard/policy_bundle_trusted_keys.py` |
| 657 | test | no | `tests/test_guard_package_shims_cli.py` |
| 655 | test | no | `tests/test_guard_supply_chain_bundle.py` |
| 653 | test | no | `tests/test_guard_compound_git_inspection.py` |
| 649 | production | no | `src/codex_plugin_scanner/guard/runtime/command_capability.py` |
| 645 | production | no | `src/codex_plugin_scanner/guard/runtime/github_command_capabilities.py` |
| 641 | production | no | `src/codex_plugin_scanner/guard/runtime/package_manifest_diff.py` |
| 636 | test | no | `tests/test_guard_hook_saved_block_terminal.py` |
| 635 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_permission_store.py` |
| 633 | production | no | `src/codex_plugin_scanner/guard/cli/product.py` |
| 632 | test | no | `tests/test_guard_bulk_allow_once.py` |
| 631 | production | no | `src/codex_plugin_scanner/guard/adapters/cline_hooks.py` |
| 630 | production | no | `src/codex_plugin_scanner/guard/cli/commands_dispatch_local.py` |
| 627 | test | no | `tests/test_guard_phase04_harness_ux.py` |
| 627 | production | no | `src/codex_plugin_scanner/guard/codex_app_server.py` |
| 625 | production | no | `dashboard/src/runtime-overview.tsx` |
| 620 | test | no | `tests/test_guard_temporary_mcp_approvals.py` |
| 618 | production | no | `src/codex_plugin_scanner/guard/runtime/direct_vitest.py` |
| 618 | production | no | `dashboard/src/policy-workspace-helpers.ts` |
| 617 | tooling | no | `scripts/codex-auto-resume-smoke.py` |
| 615 | production | no | `src/codex_plugin_scanner/scanner.py` |
| 614 | test | no | `tests/test_guard_receipt_persistence.py` |
| 613 | test | no | `tests/test_guard_supply_chain_daemon.py` |
| 610 | production | no | `src/codex_plugin_scanner/guard/runtime/data_flow_rules.py` |
| 609 | test | no | `tests/test_guard_runtime_actions.py` |
| 609 | production | no | `rust/crates/guard-command/src/lib.rs` |
| 606 | production | no | `src/codex_plugin_scanner/guard/runtime/kubernetes_commands.py` |
| 604 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py` |
| 602 | production | no | `src/codex_plugin_scanner/guard/cli/commands_hook.py` |
| 601 | test | no | `tests/test_guard_oci_isolation_provider.py` |
| 601 | production | no | `src/codex_plugin_scanner/guard/cli/commands_dispatch_trust.py` |
| 599 | production | no | `src/codex_plugin_scanner/guard/runtime/package_intent_common.py` |
| 597 | test | no | `tests/test_guard_kubernetes_runtime.py` |
| 597 | production | no | `src/codex_plugin_scanner/guard/adapters/pi_extension_source.py` |
| 594 | test | no | `tests/test_guard_evidence_store.py` |
| 594 | production | no | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/github_shell_capabilities.py` |
| 594 | production | no | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_inspection.py` |
| 594 | production | no | `dashboard/src/history-analytics.tsx` |
| 589 | production | no | `src/codex_plugin_scanner/guard/store_approval_facade.py` |
| 583 | test | no | `tests/test_codex_hook_fallback_isolation.py` |
| 583 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_codex_paths.py` |
| 582 | test | no | `tests/test_guard_harness_setup.py` |
| 579 | test | no | `tests/test_guard_mcp_contract.py` |
| 579 | production | no | `src/codex_plugin_scanner/guard/runtime/linux_udp_dns_enforcement.py` |
| 579 | production | no | `src/codex_plugin_scanner/guard/review_contracts.py` |
| 577 | test | no | `tests/test_guard_threat_intel.py` |
| 573 | test | no | `tests/test_guard_restricted_archive_download.py` |
| 571 | test | no | `tests/test_pi_hook_latency.py` |
| 569 | test | no | `tests/test_guard_aibom_detection.py` |
| 568 | test | no | `tests/test_guard_python_supply_chain_phase12.py` |
| 567 | production | no | `src/codex_plugin_scanner/guard/native_runtime_resident.py` |
| 564 | production | no | `src/codex_plugin_scanner/guard/adapters/zcode_config.py` |
| 563 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_connect.py` |
| 562 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_codex_commands.py` |
| 561 | test | no | `tests/test_guard_standalone_git_routine.py` |
| 561 | production | no | `dashboard/src/queue-bulk-approve-flow.tsx` |
| 561 | production | no | `dashboard/src/history-charts.tsx` |
| 560 | production | no | `src/codex_plugin_scanner/guard/approval_scope_support.py` |
| 557 | production | yes | `src/codex_plugin_scanner/guard/daemon/static/assets/chunks/fleet-workspace.js` |
| 556 | test | no | `tests/test_cli.py` |
| 555 | production | no | `dashboard/src/policy-cloud-exception-request-layout.tsx` |
| 553 | production | no | `src/codex_plugin_scanner/guard/mdm/lifecycle.py` |
| 553 | production | no | `dashboard/src/review-decision-card.tsx` |
| 550 | production | no | `src/codex_plugin_scanner/guard/store_extension_control_authority.py` |
| 550 | production | no | `src/codex_plugin_scanner/guard/store_event_receipts.py` |
| 549 | test | no | `tests/test_guard_python_supply_chain_heuristics_phase12.py` |
| 548 | production | no | `src/codex_plugin_scanner/guard/runtime/surface_server.py` |
| 547 | test | no | `tests/test_guard_compound_readonly_auto_allow.py` |
| 547 | production | no | `src/codex_plugin_scanner/guard/runtime/_shell_execution_context_support.py` |
| 546 | production | no | `src/codex_plugin_scanner/guard/cli/commands_hook_copilot.py` |
| 546 | production | no | `src/codex_plugin_scanner/guard/adapters/cline_plugin.py` |
| 545 | production | no | `src/codex_plugin_scanner/guard/cli/install_commands.py` |
| 544 | test | no | `tests/test_guard_command_shadow_persistence.py` |
| 543 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_claude_approval.py` |
| 542 | workflow | no | `.github/workflows/ci.yml` |
| 541 | production | no | `src/codex_plugin_scanner/guard/runtime/mcp_skill_firewall.py` |
| 541 | production | no | `src/codex_plugin_scanner/guard/runtime/command_rules.py` |
| 540 | test | no | `dashboard/src/scrg171-172.test.ts` |
| 539 | production | no | `src/codex_plugin_scanner/guard/cli/commands_support_prompts.py` |
| 536 | production | no | `src/codex_plugin_scanner/guard/store_sessions.py` |
| 534 | test | no | `tests/test_policy_bundle_v2.py` |
| 531 | production | no | `src/codex_plugin_scanner/guard/mdm/policy.py` |
| 531 | production | no | `src/codex_plugin_scanner/guard/adapters/cursor_hooks.py` |
| 531 | production | no | `dashboard/src/mcp-policy-request-panel.tsx` |
| 530 | test | no | `tests/test_guard_mdm_health_lease.py` |
| 528 | production | no | `src/codex_plugin_scanner/guard/risk.py` |
| 527 | test | no | `tests/test_guard_linux_artifact_lifecycle.py` |
| 527 | production | no | `src/codex_plugin_scanner/guard/daemon/runtime_hook_scheduler.py` |
| 527 | production | no | `src/codex_plugin_scanner/guard/adapters/claude_code.py` |
| 527 | production | no | `dashboard/src/evidence/evidence-activity-heatmap.tsx` |
| 526 | production | no | `src/codex_plugin_scanner/guard/adapters/contracts.py` |
| 525 | test | no | `tests/test_grok_adapter.py` |
| 523 | test | no | `tests/dockerlabs/command-extension-analytics/runner.ts` |
| 522 | test | no | `tests/test_guard_hook_process_deadline_contract.py` |
| 521 | production | no | `src/codex_plugin_scanner/guard/policy_document_yaml.py` |
| 519 | production | no | `dashboard/src/fleet-workspace.tsx` |
| 516 | test | no | `tests/test_guard_dashboard_launcher.py` |
| 515 | production | no | `src/codex_plugin_scanner/guard/adapters/cursor_native_approval.py` |
| 514 | test | no | `tests/test_release_train_workflow.py` |
| 514 | test | no | `tests/test_guard_linux_udp_dns_enforcement.py` |
| 512 | test | no | `tests/test_guard_policy_bundle_browser_scopes.py` |
| 511 | test | no | `tests/test_guard_package_hook_phase14.py` |
| 511 | production | no | `src/codex_plugin_scanner/guard/adapters/claude_daemon_hook_bridge.py` |
| 509 | production | no | `src/codex_plugin_scanner/guard/runtime/compound_git_inspection.py` |
| 508 | test | no | `tests/test_command_keys_and_uri_schemes.py` |
| 508 | production | no | `dashboard/src/policy-workspace-views.tsx` |
| 507 | production | no | `src/codex_plugin_scanner/guard/runtime/command_critical_floors.py` |
| 505 | test | no | `tests/test_guard_inventory_cisco.py` |
| 505 | test | no | `tests/test_guard_extension_control_api.py` |
| 505 | production | no | `src/codex_plugin_scanner/guard/mdm/cloud_control.py` |
| 505 | production | no | `src/codex_plugin_scanner/guard/adapters/hook_python.py` |
| 505 | test | no | `dashboard/src/home-dashboard.test.ts` |
| 504 | test | no | `tests/test_guard_command_decision_routing.py` |
| 504 | production | no | `dashboard/src/receipts-workspace.tsx` |
| 502 | tooling | no | `scripts/build_native_hol_guard_wheel.py` |
| 501 | test | no | `tests/test_hook_security_regressions.py` |
| 501 | production | no | `src/codex_plugin_scanner/checks/manifest.py` |
| 501 | tooling | no | `scripts/mdm/macos/device-key-helper.swift` |

## Exact Python function-copy groups

### Group 1: 34 lines, 2 instances

- `scripts/mdm/generate-release-manifest.py:41` `_open_readonly_no_follow`
- `src/codex_plugin_scanner/guard/mdm/manifest.py:108` `_open_readonly_no_follow`


## Python functions at least 100 lines

| Lines | Complexity | Function |
| ---: | ---: | --- |
| 1036 | 205 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_eval.py::_evaluate_runtime_artifact_hook` |
| 743 | 132 | `src/codex_plugin_scanner/guard/consumer/service.py::evaluate_detection` |
| 708 | 126 | `src/codex_plugin_scanner/guard/cli/commands_hook_generic.py::_run_hook_generic_payload` |
| 578 | 108 | `src/codex_plugin_scanner/guard/runtime/runner.py::sync_receipts` |
| 574 | 53 | `src/codex_plugin_scanner/guard/proxy/runtime_mcp.py::RuntimeMcpGuardProxy._handle_package_request` |
| 567 | 5 | `src/codex_plugin_scanner/guard/adapters/pi_extension_source.py::managed_extension_source` |
| 554 | 122 | `src/codex_plugin_scanner/guard/cli/update_commands.py::run_guard_update` |
| 551 | 74 | `src/codex_plugin_scanner/guard/store_policy.py::StorePolicyMixin.resolve_policy_decision_lookup` |
| 550 | 150 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler.do_POST` |
| 543 | 22 | `src/codex_plugin_scanner/guard/store_connection_schema.py::StoreConnectionSchemaMixin._initialize_schema` |
| 534 | 102 | `src/codex_plugin_scanner/guard/runtime/runner.py::guard_run` |
| 521 | 48 | `src/codex_plugin_scanner/guard/proxy/runtime_mcp.py::RuntimeMcpGuardProxy._handle_message_serialized` |
| 458 | 3 | `src/codex_plugin_scanner/guard/cli/commands_parser_cloud.py::_configure_guard_cloud_parsers` |
| 448 | 8 | `src/codex_plugin_scanner/guard/cli/commands_parser_local.py::_configure_guard_local_parsers` |
| 441 | 73 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_evaluate_package_request_artifact_uncached` |
| 428 | 105 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_request_classifier.py::_destructive_shell_tool_action_request` |
| 405 | 38 | `src/codex_plugin_scanner/guard/cli/commands_hook.py::_run_guard_hook_command` |
| 403 | 111 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler.do_GET` |
| 384 | 54 | `src/codex_plugin_scanner/action_runner.py::main` |
| 383 | 45 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_evaluate_with_cloud` |
| 365 | 61 | `src/codex_plugin_scanner/guard/proxy/stdio.py::StdioGuardProxy._forward_message` |
| 363 | 1 | `src/codex_plugin_scanner/guard/cli/commands_parser_policy.py::_configure_guard_policy_parsers` |
| 345 | 92 | `src/codex_plugin_scanner/guard/approvals.py::apply_approval_resolution` |
| 342 | 57 | `src/codex_plugin_scanner/guard/runtime/offline_archive_worker.py::_inspect_archive` |
| 327 | 37 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_finish.py::_finalize_runtime_artifact_hook` |
| 315 | 35 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_policy_document.py::_run_guard_policy_document_command` |
| 304 | 35 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py::_review_runtime_artifact_hook` |
| 304 | 1 | `src/codex_plugin_scanner/guard/adapters/cline_plugin.py::_plugin_source` |
| 303 | 26 | `src/codex_plugin_scanner/guard/cli/commands_hook_copilot.py::_run_hook_copilot_permission_request` |
| 270 | 22 | `src/codex_plugin_scanner/guard/store_extension_control_authority.py::StoreExtensionControlAuthorityMixin.commit_extension_control_layers` |
| 266 | 1 | `src/codex_plugin_scanner/guard/adapters/cline_hooks.py::_hook_source` |
| 257 | 34 | `src/codex_plugin_scanner/guard/runtime/hook_source_read.py::evaluate_source_file_ref` |
| 256 | 44 | `src/codex_plugin_scanner/guard/runtime/live_request_sync.py::sync_live_requests_once` |
| 254 | 42 | `src/codex_plugin_scanner/guard/runtime/github_shell_capabilities.py::classify_github_shell_capabilities` |
| 247 | 29 | `src/codex_plugin_scanner/guard/proxy/runtime_mcp.py::RuntimeMcpGuardProxy._allow_and_forward` |
| 243 | 18 | `src/codex_plugin_scanner/guard/local_supply_chain.py::build_package_protect_payload` |
| 242 | 39 | `src/codex_plugin_scanner/guard/aibom_cli.py::sync_aibom_snapshots` |
| 240 | 72 | `src/codex_plugin_scanner/guard/runtime/command_evaluation.py::evaluate_command` |
| 239 | 49 | `src/codex_plugin_scanner/guard/runtime/oci_plan_generator.py::OCIPlanGenerator.generate` |
| 236 | 55 | `src/codex_plugin_scanner/guard/mdm/manifest.py::verify_release_manifest` |
| 228 | 39 | `src/codex_plugin_scanner/scanner.py::_scan_mixed_packages` |
| 223 | 59 | `src/codex_plugin_scanner/guard/runtime/github_command_capabilities.py::classify_github_cli` |
| 223 | 52 | `src/codex_plugin_scanner/guard/runtime/env_wrapper.py::parse_env_wrapper` |
| 219 | 16 | `src/codex_plugin_scanner/guard/store_approvals.py::add_approval_request` |
| 211 | 32 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/tool_action_requests.py::extract_sensitive_tool_action_request` |
| 210 | 60 | `src/codex_plugin_scanner/guard/adapters/claude_code.py::ClaudeCodeHarnessAdapter.detect` |
| 205 | 24 | `src/codex_plugin_scanner/guard/protect.py::build_protect_payload` |
| 201 | 43 | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py::apply_trust_attestation_metadata` |
| 201 | 72 | `src/codex_plugin_scanner/guard/runtime/source_paths.py::source_path_is_allowed` |
| 198 | 38 | `src/codex_plugin_scanner/guard/cli/approval_commands.py::run_approval_command` |
| 197 | 31 | `src/codex_plugin_scanner/guard/cli/uninstall_commands.py::run_guard_self_uninstall` |
| 196 | 3 | `src/codex_plugin_scanner/guard/shims.py::_build_package_manager_python_shim` |
| 195 | 50 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_heuristic_result` |
| 194 | 25 | `src/codex_plugin_scanner/guard/local_supply_chain.py::_final_package_protect_authority` |
| 189 | 33 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py::_hook_runtime_artifact` |
| 186 | 17 | `src/codex_plugin_scanner/guard/runtime/command_queue.py::poll_command_queue_once` |
| 185 | 36 | `src/codex_plugin_scanner/guard/local_supply_chain.py::_resolve_stored_package_policy_override` |
| 184 | 54 | `src/codex_plugin_scanner/trust_skill_scoring.py::build_skill_domain` |
| 184 | 15 | `src/codex_plugin_scanner/checks/marketplace.py::check_marketplace_json` |
| 182 | 1 | `src/codex_plugin_scanner/guard/store_command_activity_schema.py::command_activity_schema_statements` |
| 179 | 27 | `src/codex_plugin_scanner/guard/secrets/secret_repository_scanner.py::scan_repository_secrets` |
| 179 | 1 | `src/codex_plugin_scanner/guard/schemas/surface_server.py::build_surface_server_contract` |
| 177 | 38 | `src/codex_plugin_scanner/guard/runtime/launch_identity_binding.py::observe_launch_identity_binding` |
| 175 | 33 | `src/codex_plugin_scanner/trust_plugin_scoring.py::build_plugin_domain` |
| 175 | 21 | `src/codex_plugin_scanner/guard/codex_app_server.py::resume_codex_thread_for_request` |
| 174 | 6 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_supply_chain_package_firewall_connect` |
| 173 | 39 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_records.py::_run_guard_policies_command` |
| 172 | 6 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_guard_cloud_connect_start` |
| 172 | 1 | `src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py::_headless_approval_resolver` |
| 171 | 34 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_transitive_lockfile_results` |
| 171 | 45 | `src/codex_plugin_scanner/guard/daemon/hook_process_runner.py::HookProcessRunner.review` |
| 167 | 13 | `src/codex_plugin_scanner/guard/store_workflow_capabilities.py::StoreWorkflowCapabilitiesMixin.claim_workflow_capability` |
| 167 | 21 | `src/codex_plugin_scanner/guard/runtime/command_model.py::parse_shell_command` |
| 166 | 17 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_runtime_hook` |
| 165 | 68 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_inspection.py::_compound_developer_effect_graph` |
| 165 | 26 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py::_runtime_hook_approval_context_token` |
| 165 | 31 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py::_codex_post_tool_output_artifact` |
| 164 | 18 | `src/codex_plugin_scanner/guard/risk.py::artifact_risk_signals_typed` |
| 164 | 37 | `src/codex_plugin_scanner/guard/inventory_contract.py::_mcp_tool_items_from_artifact` |
| 163 | 69 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/encoded_payloads.py::_looks_destructive_shell_command` |
| 163 | 34 | `src/codex_plugin_scanner/guard/inventory_contract.py::_item_from_artifact` |
| 163 | 17 | `src/codex_plugin_scanner/guard/daemon/server.py::_run_headless_cloud_sync` |
| 163 | 26 | `src/codex_plugin_scanner/guard/adapters/codex.py::CodexHarnessAdapter.install` |
| 161 | 16 | `src/codex_plugin_scanner/guard/runtime/runner.py::extract_prompt_requests` |
| 161 | 19 | `src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py::_headless_approval_resolver.resolve` |
| 160 | 43 | `src/codex_plugin_scanner/guard/runtime/git_pathspecs.py::resolve_git_pathspecs` |
| 159 | 29 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_evaluate_with_bundle` |
| 158 | 24 | `src/codex_plugin_scanner/guard/store_policy.py::StorePolicyMixin._claim_approval_reuse_decision_locked` |
| 155 | 21 | `src/codex_plugin_scanner/guard/cli/commands_support_connect.py::_finalize_guard_connect_payload` |
| 153 | 1 | `src/codex_plugin_scanner/guard/store_live_request_outbox.py::live_request_outbox_schema_statements` |
| 153 | 48 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/network_upload_detection.py::_curl_segment_uses_file_upload` |
| 153 | 30 | `src/codex_plugin_scanner/guard/runtime/command_executors.py::_execute_approval_operation` |
| 153 | 32 | `src/codex_plugin_scanner/guard/codex_hook_launch_runtime.py::run_isolated_hook_process` |
| 152 | 28 | `src/codex_plugin_scanner/guard/daemon/extension_control_semantic_preview.py::build_extension_control_semantic_preview` |
| 151 | 32 | `src/codex_plugin_scanner/guard/runtime/offline_archive_inspection.py::inspect_archive_offline` |
| 151 | 21 | `src/codex_plugin_scanner/guard/daemon/server.py::_finalize_daemon_guard_connect_payload` |
| 150 | 20 | `src/codex_plugin_scanner/guard/runtime/approval_context.py::_direct_executable_runtime_entrypoint_identity` |
| 149 | 25 | `src/codex_plugin_scanner/guard/cli/update_artifact.py::stage_trusted_wheel` |
| 148 | 45 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/benign_requests.py::is_explicitly_benign_tool_action_request` |
| 148 | 63 | `src/codex_plugin_scanner/guard/policy_bundle_parser.py::validated_policy_bundle_payload` |
| 148 | 14 | `src/codex_plugin_scanner/guard/cli/prompt.py::resolve_interactive_decisions` |
| 146 | 75 | `src/codex_plugin_scanner/guard/native_command_model.py::_decode_command_model` |
| 146 | 39 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_trust.py::_run_guard_trust_command` |
| 146 | 28 | `src/codex_plugin_scanner/guard/approvals.py::queue_blocked_approvals` |
| 145 | 14 | `src/codex_plugin_scanner/guard/cli/commands_hook_copilot.py::_run_hook_copilot_pretool` |
| 144 | 33 | `src/codex_plugin_scanner/guard/cli/commands_support_workspace.py::_run_init_command` |
| 144 | 24 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_state.py::set_runtime_artifact_hook_final_action` |
| 142 | 16 | `src/codex_plugin_scanner/guard/runtime/data_flow_rules.py::detect_data_flow_exfiltration` |
| 142 | 33 | `src/codex_plugin_scanner/guard/cli/commands_support_interaction.py::_codex_browser_approval_decision` |
| 141 | 23 | `src/codex_plugin_scanner/guard/adapters/hermes.py::HermesHarnessAdapter._scan_skill` |
| 140 | 1 | `src/codex_plugin_scanner/guard/store_receipt_rollups.py::receipt_rollup_schema_statements` |
| 139 | 20 | `src/codex_plugin_scanner/guard/runtime/command_inspection.py::inspect_command` |
| 139 | 1 | `scripts/bench_guard_hooks.py::_setup_cases` |
| 137 | 49 | `src/codex_plugin_scanner/guard/runtime/shell_execution_context.py::model_shell_execution_context` |
| 137 | 12 | `src/codex_plugin_scanner/guard/runtime/detectors.py::FalsePositiveSuppressorDetector.detect` |
| 137 | 19 | `src/codex_plugin_scanner/guard/runtime/approval_reuse.py::evaluate_approval_reuse` |
| 137 | 26 | `src/codex_plugin_scanner/guard/mdm/integrity.py::machine_integrity_snapshot` |
| 136 | 33 | `src/codex_plugin_scanner/verification.py::_check_manifest` |
| 136 | 31 | `src/codex_plugin_scanner/guard/store_live_request_outbox.py::StoreLiveRequestOutboxMixin.live_request_outbox_status` |
| 136 | 26 | `src/codex_plugin_scanner/guard/local_supply_chain.py::sync_managed_workspace_audits` |
| 136 | 38 | `src/codex_plugin_scanner/guard/cli/update_commands.py::build_guard_update_status_payload` |
| 134 | 16 | `src/codex_plugin_scanner/reporting.py::build_json_payload` |
| 134 | 33 | `src/codex_plugin_scanner/guard/adapters/hermes_file_inspection.py::inspect_hermes_text_file` |
| 133 | 14 | `src/codex_plugin_scanner/guard/local_supply_chain.py::build_workspace_audit_payload` |
| 133 | 19 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_headless_policy_sync` |
| 133 | 34 | `src/codex_plugin_scanner/guard/daemon/manager.py::ensure_guard_daemon` |
| 133 | 25 | `scripts/stress_guard_daemon.py::run_stress` |
| 132 | 31 | `src/codex_plugin_scanner/guard/store_receipt_rollups.py::load_receipt_analytics` |
| 132 | 30 | `src/codex_plugin_scanner/guard/store_extension_control_authority_transitions.py::_ExtensionControlAuthorityTransitionMixin._resume_idempotent_transition` |
| 132 | 55 | `src/codex_plugin_scanner/guard/runtime/decisions.py::_validate_artifact_approval_projection` |
| 132 | 15 | `src/codex_plugin_scanner/guard/cli/update_subprocess.py::build_trusted_update_context` |
| 131 | 17 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/benign_requests.py::build_tool_action_request_artifact` |
| 131 | 43 | `src/codex_plugin_scanner/guard/policy_recipe.py::parse_policy_recipe` |
| 131 | 36 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py::_compound_runtime_artifact` |
| 131 | 21 | `src/codex_plugin_scanner/guard/adapters/zcode_config.py::append_plugin_manifest_artifacts` |
| 130 | 14 | `src/codex_plugin_scanner/guard/store_policy.py::_bounded_policy_approval_reuse_diagnostic_rows` |
| 130 | 32 | `src/codex_plugin_scanner/guard/adapters/codex.py::CodexHarnessAdapter.detect` |
| 129 | 12 | `src/codex_plugin_scanner/guard/store_policy.py::_bounded_non_consuming_policy_rows` |
| 129 | 23 | `src/codex_plugin_scanner/guard/runtime/runner.py::sync_supply_chain_bundle` |
| 129 | 38 | `src/codex_plugin_scanner/guard/runtime/oci_isolation_provider.py::_read_linux` |
| 129 | 17 | `src/codex_plugin_scanner/guard/codex_hook_inventory.py::_handler_record` |
| 129 | 37 | `src/codex_plugin_scanner/guard/cli/update_subprocess.py::_run_bounded_process` |
| 129 | 27 | `src/codex_plugin_scanner/guard/adapters/grok.py::GrokHarnessAdapter.detect` |
| 128 | 11 | `src/codex_plugin_scanner/guard/runtime/prompt_injection.py::detect_prompt_injection_requests` |
| 128 | 22 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_protection_repair` |
| 127 | 52 | `src/codex_plugin_scanner/guard/store_policy_source_context.py::build_policy_source_context_index` |
| 124 | 13 | `src/codex_plugin_scanner/guard/store_receipts.py::StoreReceiptsRuntimeMixin.add_receipt` |
| 124 | 24 | `src/codex_plugin_scanner/guard/shims.py::probe_package_shim_intercepts` |
| 124 | 40 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_desktop.py::build_desktop_bootstrap_payload` |
| 123 | 17 | `src/codex_plugin_scanner/guard/runtime/local_node_runner_evidence.py::build_local_node_runner_evidence` |
| 123 | 12 | `src/codex_plugin_scanner/guard/runtime/hook_review_engine.py::HookReviewEngine._review_output_scan` |
| 123 | 13 | `src/codex_plugin_scanner/guard/cli/update_subprocess.py::_inspect_windows_filesystem_path` |
| 122 | 50 | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py::verify_trust_attestation` |
| 122 | 33 | `src/codex_plugin_scanner/guard/protect.py::_merge_cached_advisory_into_package_payload` |
| 121 | 7 | `src/codex_plugin_scanner/guard/store_receipt_rollups.py::backfill_receipt_rollups` |
| 121 | 35 | `src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py::_cloud_safe_action_envelope` |
| 121 | 1 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHttpServer.__init__` |
| 120 | 16 | `src/codex_plugin_scanner/guard/cli/update_artifact.py::record_local_wheel_receipt` |
| 119 | 24 | `src/codex_plugin_scanner/guard/skill_directory_discovery.py::discover_skill_documents` |
| 118 | 17 | `src/codex_plugin_scanner/guard/cli/remote_pair_flow.py::run_guard_remote_pair_command` |
| 118 | 18 | `src/codex_plugin_scanner/guard/cli/product.py::_build_connect_steps` |
| 118 | 11 | `src/codex_plugin_scanner/guard/aibom_content_upload.py::upload_primary_content_sources` |
| 118 | 29 | `src/codex_plugin_scanner/cli.py::_resolve_legacy_args` |
| 117 | 10 | `src/codex_plugin_scanner/guard/store_policy_document.py::StorePolicyDocumentMixin._import_policy_rows_on_connection` |
| 117 | 42 | `src/codex_plugin_scanner/guard/runtime/linux_artifact_ownership.py::verify_linux_artifact_ownership` |
| 117 | 44 | `src/codex_plugin_scanner/guard/runtime/command_extensions.py::CommandSafetyExtensionRegistry.__init__` |
| 117 | 30 | `src/codex_plugin_scanner/guard/cli/update_artifact.py::recover_local_wheel_original` |
| 116 | 30 | `src/codex_plugin_scanner/guard/runtime/linux_udp_dns_enforcement.py::compile_linux_udp_dns_policy` |
| 115 | 30 | `src/codex_plugin_scanner/verification.py::_check_marketplace` |
| 115 | 21 | `src/codex_plugin_scanner/guard/native_runtime.py::review_post_tool_native` |
| 115 | 32 | `src/codex_plugin_scanner/guard/cli/render.py::_render_doctor` |
| 114 | 17 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/interpreter_identity.py::_python_interpreter_executable_identities` |
| 114 | 28 | `src/codex_plugin_scanner/guard/adapters/codex_daemon_hook_bridge.py::main` |
| 113 | 37 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/typescript_graphql_safety.py::_redacted_node_inline_string_literals` |
| 113 | 13 | `src/codex_plugin_scanner/guard/runtime/sandbox.py::run_sandbox` |
| 113 | 15 | `src/codex_plugin_scanner/guard/mcp_tool_calls.py::evaluate_tool_call` |
| 113 | 39 | `src/codex_plugin_scanner/guard/decision_projection_boundaries.py::canonical_approval_decision` |
| 113 | 28 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py::_runtime_stored_policy_decision` |
| 113 | 25 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_admin.py::_run_guard_doctor_command` |
| 113 | 41 | `src/codex_plugin_scanner/guard/adapters/hermes.py::HermesHarnessAdapter._mcp_artifacts` |
| 112 | 12 | `src/codex_plugin_scanner/guard/store_command_activity_schema.py::_validate_command_activity_schema` |
| 112 | 16 | `src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py::_cloud_safe_local_request_payload` |
| 112 | 38 | `src/codex_plugin_scanner/guard/mdm/adapter_conformance.py::ObserverAdapterConformanceHarness.evaluate` |
| 112 | 23 | `src/codex_plugin_scanner/guard/adapters/copilot.py::CopilotHarnessAdapter.install` |
| 111 | 38 | `src/codex_plugin_scanner/guard/runtime/composition_rules.py::compose_action_from_signals` |
| 111 | 15 | `src/codex_plugin_scanner/guard/mcp_tool_calls.py::_revalidate_claimed_tool_call_approval` |
| 111 | 16 | `src/codex_plugin_scanner/guard/adapters/opencode.py::OpenCodeHarnessAdapter.install` |
| 110 | 21 | `src/codex_plugin_scanner/guard/shims.py::package_shim_status` |
| 110 | 17 | `src/codex_plugin_scanner/guard/runtime/runner.py::sync_guard_events` |
| 110 | 7 | `src/codex_plugin_scanner/guard/mdm/health_reporter.py::run_machine_health_cadence` |
| 110 | 15 | `src/codex_plugin_scanner/guard/cli/commands_support_permission_store.py::_persist_cursor_native_permission_after_shell` |
| 110 | 15 | `scripts/bench_guard_native_release_gate.py::main` |
| 109 | 18 | `src/codex_plugin_scanner/guard/store_policy_integrity_runtime.py::StorePolicyIntegrityAdminMixin.migrate_local_policy_integrity` |
| 109 | 44 | `src/codex_plugin_scanner/guard/cli/render.py::_render_policies` |
| 109 | 34 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_mdm.py::_run_guard_mdm_command` |
| 108 | 23 | `src/codex_plugin_scanner/integrations/cisco_mcp_scanner.py::run_cisco_mcp_scan` |
| 108 | 17 | `src/codex_plugin_scanner/guard/secrets/secret_staged_scanner.py::scan_staged_secrets` |
| 108 | 18 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py::_run_guard_supply_chain_command` |
| 108 | 3 | `src/codex_plugin_scanner/guard/cli/approval_commands.py::add_approval_parser` |
| 107 | 20 | `src/codex_plugin_scanner/trust_instruction_scoring.py::build_instruction_domain` |
| 107 | 39 | `src/codex_plugin_scanner/guard/runtime/approval_context.py::build_runtime_executable_identity` |
| 107 | 24 | `src/codex_plugin_scanner/guard/local_supply_chain.py::_run_cloud_workspace_audit` |
| 106 | 13 | `src/codex_plugin_scanner/guard/store_receipts.py::StoreReceiptsRuntimeMixin.update_receipt_policy_decision` |
| 106 | 44 | `src/codex_plugin_scanner/guard/store_policy.py::StorePolicyMixin.approval_reuse_validation_reason` |
| 106 | 26 | `src/codex_plugin_scanner/guard/runtime/oci_plan_generator.py::_map_guarantees` |
| 106 | 16 | `src/codex_plugin_scanner/guard/local_risk_report.py::build_local_risk_report` |
| 106 | 18 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_supply_chain_package_firewall_action` |
| 105 | 16 | `src/codex_plugin_scanner/guard/mdm/network_diagnostics.py::diagnose_endpoint` |
| 105 | 15 | `scripts/bench_guard_native_full_path.py::main` |
| 104 | 35 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/read_only_filters.py::_read_only_lookup_filter_grep_args_are_safe` |
| 104 | 38 | `src/codex_plugin_scanner/guard/runtime/linux_performance_acceptance.py::assess_linux_network_performance` |
| 104 | 28 | `src/codex_plugin_scanner/guard/mcp_tool_calls.py::_tool_call_risk_category_set` |
| 104 | 17 | `src/codex_plugin_scanner/guard/capabilities.py::compute_capability_delta` |
| 103 | 21 | `src/codex_plugin_scanner/guard/shim_refresh.py::refresh_stale_harness_shims` |
| 103 | 13 | `src/codex_plugin_scanner/guard/runtime/hook_content_scanner.py::ContentScanner.scan_chunks` |
| 103 | 23 | `src/codex_plugin_scanner/guard/local_supply_chain.py::build_local_supply_chain_posture` |
| 103 | 7 | `src/codex_plugin_scanner/guard/dashboard_launcher.py::open_dashboard` |
| 103 | 11 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._handle_mcp_policy_decision` |
| 103 | 38 | `src/codex_plugin_scanner/guard/daemon/manager.py::retire_all_guard_daemons_for_home` |
| 103 | 17 | `src/codex_plugin_scanner/guard/cli/commands_support_interaction.py::_run_apps_command` |
| 103 | 6 | `scripts/codex-auto-resume-smoke.py::_queue_pending_request` |
| 102 | 5 | `src/codex_plugin_scanner/guard/store_live_request_outbox.py::StoreLiveRequestOutboxMixin.reassign_quarantined_live_request_outbox` |
| 102 | 21 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_finalize_evaluation` |
| 102 | 57 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/pytest_target_detection.py::_inline_python_payload_runs_pytest` |
| 102 | 46 | `src/codex_plugin_scanner/guard/runtime/linux_udp_dns_enforcement.py::evaluate_linux_udp_dns_artifact` |
| 102 | 30 | `src/codex_plugin_scanner/guard/runtime/git_execution_safety.py::git_push_origin_has_execution_free_config` |
| 102 | 21 | `src/codex_plugin_scanner/guard/runtime/cisco_preflight.py::scan_action_for_cisco_evidence` |
| 102 | 19 | `src/codex_plugin_scanner/guard/runtime/approval_context.py::build_runtime_launch_identity` |
| 102 | 23 | `src/codex_plugin_scanner/guard/package_shim_status.py::enrich_package_shim_status_payload` |
| 102 | 21 | `src/codex_plugin_scanner/guard/native_command_model.py::review_command_model_native` |
| 102 | 20 | `src/codex_plugin_scanner/guard/mcp_tool_calls.py::_schema_property_key_names` |
| 102 | 35 | `src/codex_plugin_scanner/guard/insights_share.py::build_insights_share_payload` |
| 102 | 15 | `src/codex_plugin_scanner/guard/adapters/codex_daemon_hook_transport.py::_daemon_response_once` |
| 102 | 19 | `src/codex_plugin_scanner/guard/adapters/antigravity.py::AntigravityHarnessAdapter.detect` |
| 102 | 4 | `src/codex_plugin_scanner/cli.py::_build_parser` |
| 101 | 26 | `src/codex_plugin_scanner/guard/runtime/shell_command_wrappers.py::_normalize_parts` |
| 101 | 40 | `src/codex_plugin_scanner/guard/runtime/manifest_dependency_targets.py::_manifest_dependency_targets` |
| 101 | 26 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._local_surface_session_request_is_allowed` |
| 101 | 14 | `src/codex_plugin_scanner/guard/cli/connect_flow.py::run_guard_device_connect_command` |
| 101 | 36 | `src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py::_emit_native_hook_response` |
| 100 | 20 | `src/codex_plugin_scanner/guard/runtime/restricted_archive_download.py::download_restricted_archive` |
| 100 | 23 | `src/codex_plugin_scanner/guard/runtime/restricted_archive_destination.py::_resolve_public_addresses` |
| 100 | 19 | `src/codex_plugin_scanner/guard/package_execution_context.py::build_package_execution_context` |
| 100 | 46 | `src/codex_plugin_scanner/guard/mdm/health_snapshot_validation.py::validate_health_snapshot_binding` |
| 100 | 24 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_local.py::_run_guard_protect_command` |
| 100 | 21 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py::_run_guard_connect_command` |

## Python functions at complexity 30+

| Complexity | Lines | Function |
| ---: | ---: | --- |
| 205 | 1036 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_eval.py::_evaluate_runtime_artifact_hook` |
| 150 | 550 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler.do_POST` |
| 132 | 743 | `src/codex_plugin_scanner/guard/consumer/service.py::evaluate_detection` |
| 126 | 708 | `src/codex_plugin_scanner/guard/cli/commands_hook_generic.py::_run_hook_generic_payload` |
| 122 | 554 | `src/codex_plugin_scanner/guard/cli/update_commands.py::run_guard_update` |
| 111 | 403 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler.do_GET` |
| 108 | 578 | `src/codex_plugin_scanner/guard/runtime/runner.py::sync_receipts` |
| 105 | 428 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/shell_request_classifier.py::_destructive_shell_tool_action_request` |
| 102 | 534 | `src/codex_plugin_scanner/guard/runtime/runner.py::guard_run` |
| 92 | 345 | `src/codex_plugin_scanner/guard/approvals.py::apply_approval_resolution` |
| 75 | 146 | `src/codex_plugin_scanner/guard/native_command_model.py::_decode_command_model` |
| 74 | 551 | `src/codex_plugin_scanner/guard/store_policy.py::StorePolicyMixin.resolve_policy_decision_lookup` |
| 73 | 441 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_evaluate_package_request_artifact_uncached` |
| 72 | 240 | `src/codex_plugin_scanner/guard/runtime/command_evaluation.py::evaluate_command` |
| 72 | 201 | `src/codex_plugin_scanner/guard/runtime/source_paths.py::source_path_is_allowed` |
| 69 | 163 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/encoded_payloads.py::_looks_destructive_shell_command` |
| 68 | 165 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_inspection.py::_compound_developer_effect_graph` |
| 63 | 148 | `src/codex_plugin_scanner/guard/policy_bundle_parser.py::validated_policy_bundle_payload` |
| 61 | 365 | `src/codex_plugin_scanner/guard/proxy/stdio.py::StdioGuardProxy._forward_message` |
| 60 | 210 | `src/codex_plugin_scanner/guard/adapters/claude_code.py::ClaudeCodeHarnessAdapter.detect` |
| 59 | 223 | `src/codex_plugin_scanner/guard/runtime/github_command_capabilities.py::classify_github_cli` |
| 57 | 342 | `src/codex_plugin_scanner/guard/runtime/offline_archive_worker.py::_inspect_archive` |
| 57 | 102 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/pytest_target_detection.py::_inline_python_payload_runs_pytest` |
| 55 | 236 | `src/codex_plugin_scanner/guard/mdm/manifest.py::verify_release_manifest` |
| 55 | 132 | `src/codex_plugin_scanner/guard/runtime/decisions.py::_validate_artifact_approval_projection` |
| 54 | 384 | `src/codex_plugin_scanner/action_runner.py::main` |
| 54 | 184 | `src/codex_plugin_scanner/trust_skill_scoring.py::build_skill_domain` |
| 53 | 574 | `src/codex_plugin_scanner/guard/proxy/runtime_mcp.py::RuntimeMcpGuardProxy._handle_package_request` |
| 52 | 223 | `src/codex_plugin_scanner/guard/runtime/env_wrapper.py::parse_env_wrapper` |
| 52 | 127 | `src/codex_plugin_scanner/guard/store_policy_source_context.py::build_policy_source_context_index` |
| 50 | 195 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_heuristic_result` |
| 50 | 122 | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py::verify_trust_attestation` |
| 49 | 239 | `src/codex_plugin_scanner/guard/runtime/oci_plan_generator.py::OCIPlanGenerator.generate` |
| 49 | 137 | `src/codex_plugin_scanner/guard/runtime/shell_execution_context.py::model_shell_execution_context` |
| 48 | 521 | `src/codex_plugin_scanner/guard/proxy/runtime_mcp.py::RuntimeMcpGuardProxy._handle_message_serialized` |
| 48 | 153 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/network_upload_detection.py::_curl_segment_uses_file_upload` |
| 46 | 102 | `src/codex_plugin_scanner/guard/runtime/linux_udp_dns_enforcement.py::evaluate_linux_udp_dns_artifact` |
| 46 | 100 | `src/codex_plugin_scanner/guard/mdm/health_snapshot_validation.py::validate_health_snapshot_binding` |
| 45 | 383 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_evaluate_with_cloud` |
| 45 | 171 | `src/codex_plugin_scanner/guard/daemon/hook_process_runner.py::HookProcessRunner.review` |
| 45 | 148 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/benign_requests.py::is_explicitly_benign_tool_action_request` |
| 45 | 98 | `src/codex_plugin_scanner/guard/store_policy_source_context.py::_build_policy_source_context_from_rows` |
| 44 | 256 | `src/codex_plugin_scanner/guard/runtime/live_request_sync.py::sync_live_requests_once` |
| 44 | 117 | `src/codex_plugin_scanner/guard/runtime/command_extensions.py::CommandSafetyExtensionRegistry.__init__` |
| 44 | 109 | `src/codex_plugin_scanner/guard/cli/render.py::_render_policies` |
| 44 | 106 | `src/codex_plugin_scanner/guard/store_policy.py::StorePolicyMixin.approval_reuse_validation_reason` |
| 43 | 201 | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py::apply_trust_attestation_metadata` |
| 43 | 160 | `src/codex_plugin_scanner/guard/runtime/git_pathspecs.py::resolve_git_pathspecs` |
| 43 | 131 | `src/codex_plugin_scanner/guard/policy_recipe.py::parse_policy_recipe` |
| 42 | 254 | `src/codex_plugin_scanner/guard/runtime/github_shell_capabilities.py::classify_github_shell_capabilities` |
| 42 | 117 | `src/codex_plugin_scanner/guard/runtime/linux_artifact_ownership.py::verify_linux_artifact_ownership` |
| 42 | 90 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_routines.py::_safe_dependency_symlink_execution_context` |
| 41 | 113 | `src/codex_plugin_scanner/guard/adapters/hermes.py::HermesHarnessAdapter._mcp_artifacts` |
| 41 | 73 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/github_shell_capabilities.py::_persistent_github_environment_requires_review` |
| 40 | 124 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_desktop.py::build_desktop_bootstrap_payload` |
| 40 | 101 | `src/codex_plugin_scanner/guard/runtime/manifest_dependency_targets.py::_manifest_dependency_targets` |
| 40 | 55 | `src/codex_plugin_scanner/guard/runtime/command_extensions.py::_validate_extension` |
| 39 | 242 | `src/codex_plugin_scanner/guard/aibom_cli.py::sync_aibom_snapshots` |
| 39 | 228 | `src/codex_plugin_scanner/scanner.py::_scan_mixed_packages` |
| 39 | 173 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_records.py::_run_guard_policies_command` |
| 39 | 146 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_trust.py::_run_guard_trust_command` |
| 39 | 113 | `src/codex_plugin_scanner/guard/decision_projection_boundaries.py::canonical_approval_decision` |
| 39 | 107 | `src/codex_plugin_scanner/guard/runtime/approval_context.py::build_runtime_executable_identity` |
| 38 | 405 | `src/codex_plugin_scanner/guard/cli/commands_hook.py::_run_guard_hook_command` |
| 38 | 198 | `src/codex_plugin_scanner/guard/cli/approval_commands.py::run_approval_command` |
| 38 | 177 | `src/codex_plugin_scanner/guard/runtime/launch_identity_binding.py::observe_launch_identity_binding` |
| 38 | 136 | `src/codex_plugin_scanner/guard/cli/update_commands.py::build_guard_update_status_payload` |
| 38 | 129 | `src/codex_plugin_scanner/guard/runtime/oci_isolation_provider.py::_read_linux` |
| 38 | 112 | `src/codex_plugin_scanner/guard/mdm/adapter_conformance.py::ObserverAdapterConformanceHarness.evaluate` |
| 38 | 111 | `src/codex_plugin_scanner/guard/runtime/composition_rules.py::compose_action_from_signals` |
| 38 | 104 | `src/codex_plugin_scanner/guard/runtime/linux_performance_acceptance.py::assess_linux_network_performance` |
| 38 | 103 | `src/codex_plugin_scanner/guard/daemon/manager.py::retire_all_guard_daemons_for_home` |
| 37 | 327 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_finish.py::_finalize_runtime_artifact_hook` |
| 37 | 164 | `src/codex_plugin_scanner/guard/inventory_contract.py::_mcp_tool_items_from_artifact` |
| 37 | 129 | `src/codex_plugin_scanner/guard/cli/update_subprocess.py::_run_bounded_process` |
| 37 | 113 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/typescript_graphql_safety.py::_redacted_node_inline_string_literals` |
| 37 | 73 | `src/codex_plugin_scanner/guard/runtime/command_option_parsing.py::argument_semantics` |
| 36 | 185 | `src/codex_plugin_scanner/guard/local_supply_chain.py::_resolve_stored_package_policy_override` |
| 36 | 131 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py::_compound_runtime_artifact` |
| 36 | 101 | `src/codex_plugin_scanner/guard/cli/commands_support_hook_payload.py::_emit_native_hook_response` |
| 36 | 70 | `src/codex_plugin_scanner/guard/runtime/benign_dx_guard.py::_classify_benign_raw` |
| 35 | 315 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_policy_document.py::_run_guard_policy_document_command` |
| 35 | 304 | `src/codex_plugin_scanner/guard/cli/commands_hook_runtime_review.py::_review_runtime_artifact_hook` |
| 35 | 121 | `src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py::_cloud_safe_action_envelope` |
| 35 | 104 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/read_only_filters.py::_read_only_lookup_filter_grep_args_are_safe` |
| 35 | 102 | `src/codex_plugin_scanner/guard/insights_share.py::build_insights_share_payload` |
| 35 | 81 | `src/codex_plugin_scanner/guard/cli/connect_flow.py::build_connect_status_payload` |
| 35 | 73 | `src/codex_plugin_scanner/guard/runtime/command_activity_contract.py::_validate_activity_state` |
| 34 | 257 | `src/codex_plugin_scanner/guard/runtime/hook_source_read.py::evaluate_source_file_ref` |
| 34 | 171 | `src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py::_transitive_lockfile_results` |
| 34 | 163 | `src/codex_plugin_scanner/guard/inventory_contract.py::_item_from_artifact` |
| 34 | 133 | `src/codex_plugin_scanner/guard/daemon/manager.py::ensure_guard_daemon` |
| 34 | 109 | `src/codex_plugin_scanner/guard/cli/commands_dispatch_mdm.py::_run_guard_mdm_command` |
| 34 | 94 | `src/codex_plugin_scanner/trust_mcp_scoring.py::build_mcp_domain` |
| 34 | 85 | `src/codex_plugin_scanner/guard/adapters/bounded_cli_hook_bridge.py::_daemon_response_to_native` |
| 34 | 79 | `src/codex_plugin_scanner/guard/cli/extension_controls_commands.py::_patterns` |
| 34 | 71 | `src/codex_plugin_scanner/guard/runtime/decisions.py::_validate_composition_trace` |
| 34 | 58 | `src/codex_plugin_scanner/trust_skill_scoring.py::_normalized_skill_metadata` |
| 34 | 52 | `src/codex_plugin_scanner/submission.py::resolve_submission_metadata` |
| 33 | 189 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py::_hook_runtime_artifact` |
| 33 | 175 | `src/codex_plugin_scanner/trust_plugin_scoring.py::build_plugin_domain` |
| 33 | 144 | `src/codex_plugin_scanner/guard/cli/commands_support_workspace.py::_run_init_command` |
| 33 | 142 | `src/codex_plugin_scanner/guard/cli/commands_support_interaction.py::_codex_browser_approval_decision` |
| 33 | 136 | `src/codex_plugin_scanner/verification.py::_check_manifest` |
| 33 | 134 | `src/codex_plugin_scanner/guard/adapters/hermes_file_inspection.py::inspect_hermes_text_file` |
| 33 | 122 | `src/codex_plugin_scanner/guard/protect.py::_merge_cached_advisory_into_package_payload` |
| 33 | 99 | `src/codex_plugin_scanner/guard/runtime/git_execution_safety.py::git_fetch_origin_has_execution_free_config` |
| 33 | 83 | `src/codex_plugin_scanner/guard/runtime/package_intent_parser.py::_effective_execution_context` |
| 33 | 65 | `src/codex_plugin_scanner/guard/mdm/harness_coverage.py::_validate_registry_users` |
| 33 | 64 | `src/codex_plugin_scanner/guard/mdm/supervisor.py::_windows_registration_status` |
| 33 | 56 | `src/codex_plugin_scanner/guard/policy_bundle_parser.py::_policy_bundle_rule_is_valid` |
| 33 | 55 | `src/codex_plugin_scanner/guard/runtime/command_rules.py::ExecutableMatcher.__post_init__` |
| 33 | 48 | `src/codex_plugin_scanner/guard/runtime/direct_typescript_diagnostics.py::_typescript_no_emit_args_are_safe` |
| 33 | 44 | `src/codex_plugin_scanner/guard/config.py::_coerce_editable_setting` |
| 33 | 41 | `src/codex_plugin_scanner/guard/runtime/read_only_git_audit.py::_safe_status_suffix` |
| 32 | 211 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/tool_action_requests.py::extract_sensitive_tool_action_request` |
| 32 | 153 | `src/codex_plugin_scanner/guard/codex_hook_launch_runtime.py::run_isolated_hook_process` |
| 32 | 151 | `src/codex_plugin_scanner/guard/runtime/offline_archive_inspection.py::inspect_archive_offline` |
| 32 | 130 | `src/codex_plugin_scanner/guard/adapters/codex.py::CodexHarnessAdapter.detect` |
| 32 | 115 | `src/codex_plugin_scanner/guard/cli/render.py::_render_doctor` |
| 32 | 84 | `src/codex_plugin_scanner/guard/runtime/network_capability_reachability.py::validate_reachability_manifest` |
| 32 | 77 | `src/codex_plugin_scanner/guard/daemon/server.py::GuardDaemonServer._finish_service_locked` |
| 32 | 75 | `src/codex_plugin_scanner/guard/policy_document_diff.py::_classify_rule_changes` |
| 32 | 70 | `src/codex_plugin_scanner/guard/runtime/decisions.py::evaluation_authority_error` |
| 32 | 65 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/github_pr_ephemeral_body.py::gh_pr_create_uses_safe_ephemeral_body` |
| 32 | 64 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/perl_read_only.py::_looks_like_read_only_perl_filter` |
| 32 | 63 | `src/codex_plugin_scanner/guard/runtime/direct_typescript_diagnostics.py::_routine_typescript_diagnostic_context` |
| 32 | 58 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/routine_directory_creation.py::is_safe_routine_directory_creation` |
| 32 | 56 | `src/codex_plugin_scanner/guard/mdm/acl.py::_windows_result` |
| 32 | 53 | `src/codex_plugin_scanner/guard/runtime/command_critical_floors.py::_critical_floor` |
| 31 | 197 | `src/codex_plugin_scanner/guard/cli/uninstall_commands.py::run_guard_self_uninstall` |
| 31 | 165 | `src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py::_codex_post_tool_output_artifact` |
| 31 | 136 | `src/codex_plugin_scanner/guard/store_live_request_outbox.py::StoreLiveRequestOutboxMixin.live_request_outbox_status` |
| 31 | 132 | `src/codex_plugin_scanner/guard/store_receipt_rollups.py::load_receipt_analytics` |
| 31 | 84 | `src/codex_plugin_scanner/guard/daemon/manager.py::_guard_daemon_process_inventory_for_guard_home` |
| 31 | 72 | `src/codex_plugin_scanner/guard/daemon/server.py::_GuardDaemonHandler._requires_header_token` |
| 31 | 67 | `src/codex_plugin_scanner/guard/policy_bundle_trusted_keys.py::load_policy_bundle_verification_keys` |
| 31 | 66 | `src/codex_plugin_scanner/guard/policy_bundle_trusted_keys.py::PolicyBundleVerificationKey.from_dict` |
| 31 | 53 | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py::_validate_attestation_payload` |
| 31 | 46 | `src/codex_plugin_scanner/guard/runtime/effect_decision.py::DecisionFactor.__post_init__` |
| 31 | 34 | `src/codex_plugin_scanner/guard/memory_decision_event.py::_display_from_action_envelope` |
| 30 | 153 | `src/codex_plugin_scanner/guard/runtime/command_executors.py::_execute_approval_operation` |
| 30 | 132 | `src/codex_plugin_scanner/guard/store_extension_control_authority_transitions.py::_ExtensionControlAuthorityTransitionMixin._resume_idempotent_transition` |
| 30 | 117 | `src/codex_plugin_scanner/guard/cli/update_artifact.py::recover_local_wheel_original` |
| 30 | 116 | `src/codex_plugin_scanner/guard/runtime/linux_udp_dns_enforcement.py::compile_linux_udp_dns_policy` |
| 30 | 115 | `src/codex_plugin_scanner/verification.py::_check_marketplace` |
| 30 | 102 | `src/codex_plugin_scanner/guard/runtime/git_execution_safety.py::git_push_origin_has_execution_free_config` |
| 30 | 92 | `src/codex_plugin_scanner/guard/native_command_model.py::_canonical_command_from_native` |
| 30 | 76 | `src/codex_plugin_scanner/guard/runtime/restricted_archive_destination.py::_canonical_destination` |
| 30 | 73 | `src/codex_plugin_scanner/guard/codex_app_server.py::_send_app_server_websocket_messages` |
| 30 | 71 | `src/codex_plugin_scanner/guard/mdm/lifecycle.py::machine_status` |
| 30 | 70 | `scripts/verify_native_runtime_release.py::local_native_hashes` |
| 30 | 65 | `src/codex_plugin_scanner/guard/runtime/secret_file_request_services/developer_routines.py::_looks_like_safe_compound_developer_inspection` |

## Silent broad exception handlers

These require review before modification because many are deliberate fail-safe or best-effort boundaries.

| Exception | Location | Function |
| --- | --- | --- |
| `Exception` | `src/codex_plugin_scanner/guard/bridge/__init__.py:175` | `_parse_pending_request` |
| `Exception` | `src/codex_plugin_scanner/guard/cli/commands_dispatch_local.py:49` | `_migrate_legacy_macos_secrets` |
| `Exception` | `src/codex_plugin_scanner/guard/cli/commands_support_service.py:221` | `_handle_daemon_status` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/diagnostics.py:100` | `DaemonDiagnostics.__init__` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/diagnostics.py:170` | `DaemonDiagnostics._run` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/manager.py:1130` | `_schedule_duplicate_guard_daemon_retirement.retire` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/manager.py:1813` | `_schedule_stale_ephemeral_guard_daemon_reap.reap` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/manager.py:1982` | `_runtime_state_age_seconds` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/server.py:1405` | `_maybe_queue_first_cloud_sync` |
| `Exception` | `src/codex_plugin_scanner/guard/daemon/server.py:1413` | `_maybe_queue_first_cloud_sync` |
| `Exception` | `src/codex_plugin_scanner/guard/desktop_notifications.py:290` | `_ensure_desktop_notification_setup_worker` |
| `Exception` | `src/codex_plugin_scanner/guard/mcp/policy_store.py:410` | `MCPolicyRequestRepository.apply_request` |
| `Exception` | `src/codex_plugin_scanner/guard/mcp/policy_tools.py:138` | `_read_policy_integrity_generation` |
| `Exception` | `src/codex_plugin_scanner/guard/mcp/server.py:146` | `GuardMCPServer._build_approval_url_builder` |
| `Exception` | `src/codex_plugin_scanner/guard/memory_decision_outbox.py:105` | `_resolve_workspace_id` |
| `Exception` | `src/codex_plugin_scanner/guard/memory_decision_outbox.py:290` | `_oauth_credentials` |
| `Exception` | `src/codex_plugin_scanner/guard/proxy/stdio.py:349` | `_quarantine_process` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/approval_attention.py:182` | `ApprovalAttentionCoordinator._open_if_still_blocking` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/command_capability.py:622` | `_audit` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/github_workflow_runtime.py:202` | `issue_github_workflow_capability_for_resolution` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/local_request_snapshots.py:360` | `_resolve_cloud_receipt_redaction_level` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/runner.py:1083` | `_resolve_hermes_guard_access_token` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/runner.py:5886` | `_local_receipt_redaction_level` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/safe_decode.py:233` | `_try_url_percent` |
| `Exception` | `src/codex_plugin_scanner/guard/runtime/trust_attestation.py:205` | `_resolve_persistent_trust_attestation_signing_config` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:585` | `SystemKeyringSecretStore._run_macos_security_command` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:737` | `SystemKeyringSecretStore._get_secret_without_macos_ui` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:841` | `SystemKeyringSecretStore.delete_secret` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:1039` | `FallbackSecretStore.get_secret` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:1051` | `FallbackSecretStore.promote_secret` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:1094` | `MigratingFallbackSecretStore._get_secret_and_migrate` |
| `Exception` | `src/codex_plugin_scanner/guard/store_base.py:1100` | `MigratingFallbackSecretStore._get_secret_and_migrate` |
| `Exception` | `src/codex_plugin_scanner/guard/store_secret_policy_integrity.py:263` | `StoreSecretPolicyIntegrityMixin._get_secret_from_store` |
| `Exception` | `src/codex_plugin_scanner/guard/store_secret_policy_integrity.py:287` | `StoreSecretPolicyIntegrityMixin._get_policy_integrity_secret_from_store` |
| `Exception` | `src/codex_plugin_scanner/install_integrity.py:40` | `detect_shadowed_install` |
| `Exception` | `src/codex_plugin_scanner/install_integrity.py:93` | `warn_if_shadowed` |
