fix(guard): preserve inline table arrays in config

Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>

Author: kantorcodes

src/codex_plugin_scanner/guard/config.py

@@ -286,9 +286,19 @@ def _toml_literal(value: object) -> str:
         return json.dumps(value)
     if isinstance(value, list):
         return "[" + ", ".join(_toml_literal(item) for item in value) + "]"
+    if isinstance(value, dict):
+        return _toml_inline_table(value)
     return json.dumps(str(value))
 
 
+def _toml_inline_table(value: dict[object, object]) -> str:
+    items: list[str] = []
+    for key, item in sorted(value.items(), key=lambda entry: str(entry[0])):
+        if isinstance(key, str):
+            items.append(f"{_toml_key(key)} = {_toml_literal(item)}")
+    return "{ " + ", ".join(items) + " }"
+
+
 def overlay_synced_guard_policy(
     config: GuardConfig,
     payload: dict[str, object] | None,

tests/test_guard_config_paths.py

@@ -172,6 +172,25 @@ def test_dashboard_settings_update_preserves_existing_array_config_values(tmp_pa
     assert config_payload["trusted_harnesses"] == ["codex", "claude-code"]
 
 
+def test_dashboard_settings_update_preserves_existing_inline_table_array_config_values(tmp_path):
+    guard_home = tmp_path / ".hol-guard"
+    _write_text(
+        guard_home / "config.toml",
+        'mode = "prompt"\nrules = [{ name = "canary", action = "review", weight = 0.5 }]\n',
+    )
+
+    updated = update_guard_settings(
+        guard_home,
+        {
+            "mode": "enforce",
+        },
+    )
+    config_payload = guard_config_module._read_toml(guard_home / "config.toml")
+
+    assert updated.mode == "enforce"
+    assert config_payload["rules"] == [{"name": "canary", "action": "review", "weight": 0.5}]
+
+
 def test_resolve_guard_home_migrates_legacy_directory_into_canonical_home(tmp_path, monkeypatch):
     home_dir = tmp_path / "home"
     legacy_home = home_dir / ".config" / ".ai-plugin-scanner-guard"