plugin-scanner 2.0.1019__tar.gz → 2.0.1021__tar.gz

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1019
+Version: 2.0.1021
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1019"
+version = "2.0.1021"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1019"
+version = "2.0.1021"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/src/codex_plugin_scanner/guard/aibom_cli.py

@@ -123,6 +123,7 @@ def _resolve_trust_attestation_context(
     *,
     generated_at: str,
     include_upload_session_bindings: bool = False,
+    workspace_id: str | None = None,
 ) -> dict[str, object]:
     from .runtime.trust_attestation import (
         resolve_guard_oauth_trust_attestation_signing_config,
@@ -137,6 +138,7 @@ def _resolve_trust_attestation_context(
         guard_home = store.guard_home if include_upload_session_bindings else None
         signing_config = resolve_trust_attestation_signing_config(guard_home=guard_home)
     enable_v2 = trust_attestation_v2_enabled()
+    resolved_workspace_id = workspace_id or store.get_cloud_workspace_id()
     installation_id = store.get_or_create_installation_id() if enable_v2 else None
     context: dict[str, object] = {
         "analyzerId": "hol-guard" if enable_v2 else None,
@@ -151,7 +153,7 @@ def _resolve_trust_attestation_context(
         "sequence": None,
         "signingConfig": signing_config,
         "uploadId": None,
-        "workspaceId": store.get_cloud_workspace_id() if enable_v2 else None,
+        "workspaceId": resolved_workspace_id if enable_v2 else None,
     }
     if not enable_v2 or not include_upload_session_bindings:
         return context
@@ -360,14 +362,23 @@ def sync_aibom_snapshots_if_due(
     force: bool = False,
     options: AibomCliOptions | None = None,
     auth_context: dict[str, object] | None = None,
+    expected_workspace_id: str | None = None,
     home_dir: Path | None = None,
     workspace_dir: Path | None = None,
 ) -> dict[str, object]:
     runner = _runner_module()
     guard_sync_not_configured_error = runner.GuardSyncNotConfiguredError
 
-    if store.get_cloud_workspace_id() is None:
+    current_workspace_id = store.get_cloud_workspace_id()
+    if current_workspace_id is None:
         return {"synced": False, "skipped": True, "reason": "not_configured"}
+    if expected_workspace_id is not None and current_workspace_id != expected_workspace_id:
+        return {
+            "synced": False,
+            "reason": "workspace_changed",
+            "error": "Guard Cloud workspace changed before AIBOM inventory sync.",
+        }
+    bound_workspace_id = expected_workspace_id or current_workspace_id
     if _aibom_guard_events_endpoint_unavailable_recently(store):
         return {
             "synced": False,
@@ -398,6 +409,7 @@ def sync_aibom_snapshots_if_due(
             generated_at=generated_at,
             options=options,
             auth_context=auth_context,
+            expected_workspace_id=bound_workspace_id,
         )
     except guard_sync_not_configured_error:
         return {"synced": False, "skipped": True, "reason": "not_configured"}
@@ -414,20 +426,28 @@ def sync_aibom_snapshots(
     generated_at: str,
     options: AibomCliOptions | None = None,
     auth_context: dict[str, object] | None = None,
+    expected_workspace_id: str | None = None,
 ) -> dict[str, object]:
     runner = _runner_module()
     guard_sync_not_configured_error = runner.GuardSyncNotConfiguredError
 
-    workspace_id = store.get_cloud_workspace_id()
-    if workspace_id is None:
-        raise guard_sync_not_configured_error("Guard Cloud workspace is not configured. Run `hol-guard connect` first.")
+    with store.hold_oauth_credential_lock():
+        current_workspace_id = store.get_cloud_workspace_id()
+        if current_workspace_id is None:
+            raise guard_sync_not_configured_error(
+                "Guard Cloud workspace is not configured. Run `hol-guard connect` first."
+            )
+        if expected_workspace_id is not None and current_workspace_id != expected_workspace_id:
+            raise ValueError("Guard Cloud workspace changed before AIBOM inventory sync.")
+        workspace_id = expected_workspace_id or current_workspace_id
+        trust_attestation_context = _resolve_trust_attestation_context(
+            store,
+            generated_at=generated_at,
+            include_upload_session_bindings=True,
+            workspace_id=workspace_id,
+        )
 
     resolved_options = options or _AIBOM_CLOUD_SYNC_OPTIONS
-    trust_attestation_context = _resolve_trust_attestation_context(
-        store,
-        generated_at=generated_at,
-        include_upload_session_bindings=True,
-    )
     primary_content_sources: list[GuardAibomPrimaryContentSource] = []
     snapshots = collect_aibom_snapshots(
         context,

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -21,6 +21,7 @@ from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
 
 from ...version import __version__
+from ..package_firewall_defaults import extract_cloud_user_profile as _extract_cloud_user_profile
 from ..package_firewall_entitlement import (
     build_oauth_package_firewall_entitlement,
     reconcile_connect_state_with_oauth_entitlement,
@@ -178,24 +179,6 @@ def _read_nested_string(payload: dict[str, object], *path: str) -> str | None:
     return current if isinstance(current, str) and current else None
 
 
-def _extract_cloud_user_profile(payload: dict[str, object]) -> dict[str, str] | None:
-    """Extract user profile (email, display_name, avatar_url) from guard_local_entitlement."""
-    entitlement = payload.get("guard_local_entitlement")
-    if not isinstance(entitlement, dict):
-        return None
-    profile = entitlement.get("user_profile")
-    if not isinstance(profile, dict):
-        return None
-    email = profile.get("email")
-    if not isinstance(email, str) or not email:
-        return None
-    return {
-        "email": email,
-        "display_name": str(profile.get("display_name") or ""),
-        "avatar_url": str(profile.get("avatar_url") or ""),
-    }
-
-
 def _guard_access_token_expires_at(
     *,
     access_token: str,

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -197,6 +197,7 @@ _SUPPLY_CHAIN_CONNECT_WAIT_TIMEOUT_SECONDS = 180
 _LOCAL_DASHBOARD_SESSION_REFRESH_GRACE_SECONDS = 7 * 24 * 60 * 60
 _DEFAULT_HEADLESS_CLOUD_SYNC_INTERVAL_SECONDS = 30.0
 _DEFAULT_HEADLESS_CLOUD_SYNC_BACKOFF_SECONDS = 10.0
+_AIBOM_REFRESH_STOP_JOIN_TIMEOUT_SECONDS = 5.0
 
 
 class _HookPathValidationError(ValueError):
@@ -5443,6 +5444,9 @@ class GuardDaemonServer:
         self._headless_cloud_sync_interval_seconds = _DEFAULT_HEADLESS_CLOUD_SYNC_INTERVAL_SECONDS
         self._aibom_home_dir = home_dir.expanduser() if home_dir is not None else None
         self._aibom_workspace_dir = workspace_dir.expanduser() if workspace_dir is not None else None
+        self._aibom_context_workspace_id = (
+            store.get_cloud_workspace_id() if self._aibom_workspace_dir is not None else None
+        )
         self._aibom_refresh_thread: threading.Thread | None = None
         self._bundle_refresh_thread: threading.Thread | None = None
         self._command_queue_worker: CommandQueueWorker | None = None
@@ -5478,8 +5482,9 @@ class GuardDaemonServer:
             self._bundle_refresh_thread.join(timeout=5)
             self._bundle_refresh_thread = None
         if self._aibom_refresh_thread is not None:
-            self._aibom_refresh_thread.join(timeout=5)
-            self._aibom_refresh_thread = None
+            self._aibom_refresh_thread.join(timeout=_AIBOM_REFRESH_STOP_JOIN_TIMEOUT_SECONDS)
+            if not self._aibom_refresh_thread.is_alive():
+                self._aibom_refresh_thread = None
         if self._headless_cloud_sync_thread is not None:
             self._headless_cloud_sync_thread.join(timeout=5)
             self._headless_cloud_sync_thread = None
@@ -5487,7 +5492,12 @@ class GuardDaemonServer:
         self._live_request_sync_worker = stop_cloud_sync_sync_worker(self._live_request_sync_worker)
 
     def _begin_service(self) -> None:
+        if self._aibom_refresh_thread is not None:
+            if self._aibom_refresh_thread.is_alive():
+                raise RuntimeError("AIBOM inventory refresh is still stopping")
+            self._aibom_refresh_thread = None
         self._shutdown_started.clear()
+        self._persist_aibom_inventory_context()
         self._server.last_activity_monotonic = time.monotonic()
         write_guard_daemon_state(self._server.store.guard_home, self.port, self._server.auth_token)
         self._server.store.upsert_runtime_state(
@@ -5507,6 +5517,23 @@ class GuardDaemonServer:
             self._live_request_sync_worker,
         )
 
+    def _persist_aibom_inventory_context(self) -> None:
+        workspace_id = self._server.store.get_cloud_workspace_id()
+        if (
+            workspace_id is None
+            or workspace_id != self._aibom_context_workspace_id
+            or self._aibom_workspace_dir is None
+        ):
+            return
+        payload: dict[str, object] = {
+            "workspace_dir": str(self._aibom_workspace_dir),
+            "workspace_id": workspace_id,
+        }
+        if self._aibom_home_dir is not None:
+            payload["home_dir"] = str(self._aibom_home_dir)
+        now = _now()
+        self._server.store.set_sync_payload("aibom_inventory_context", payload, now)
+
     def _serve_forever(self) -> None:
         try:
             self._server.serve_forever()
@@ -5645,25 +5672,33 @@ class GuardDaemonServer:
         )
         self._aibom_refresh_thread.start()
 
-    def _aibom_inventory_context_dirs(self) -> tuple[Path | None, Path | None]:
+    def _aibom_inventory_context_dirs(self) -> tuple[Path | None, Path | None, str | None]:
         payload = self._server.store.get_sync_payload("aibom_inventory_context")
-        if isinstance(payload, dict):
-            home_value = payload.get("home_dir")
-            workspace_value = payload.get("workspace_dir")
+        current_workspace_id = self._server.store.get_cloud_workspace_id()
+        bound_payload: dict[str, object] | None = None
+        if (
+            current_workspace_id is not None
+            and isinstance(payload, dict)
+            and payload.get("workspace_id") == current_workspace_id
+        ):
+            bound_payload = payload
+        if bound_payload is not None:
+            home_value = bound_payload.get("home_dir")
+            workspace_value = bound_payload.get("workspace_dir")
         else:
             home_value = None
             workspace_value = None
-        home_dir = (
-            Path(home_value).expanduser()
-            if isinstance(home_value, str) and home_value.strip()
-            else self._aibom_home_dir
+        explicit_context_is_bound = (
+            self._aibom_workspace_dir is not None and self._aibom_context_workspace_id == current_workspace_id
         )
-        workspace_dir = (
-            Path(workspace_value).expanduser()
-            if isinstance(workspace_value, str) and workspace_value.strip()
-            else self._aibom_workspace_dir
-        )
-        return home_dir, workspace_dir
+        home_dir = self._aibom_home_dir if explicit_context_is_bound else None
+        if home_dir is None and isinstance(home_value, str) and home_value.strip():
+            home_dir = Path(home_value).expanduser()
+        workspace_dir = self._aibom_workspace_dir if explicit_context_is_bound else None
+        if workspace_dir is None and isinstance(workspace_value, str) and workspace_value.strip():
+            workspace_dir = Path(workspace_value).expanduser()
+        bound_workspace_id = current_workspace_id if workspace_dir is not None else None
+        return home_dir, workspace_dir, bound_workspace_id
 
     def _refresh_aibom_inventory_loop(self) -> None:
         interval_seconds = self._aibom_refresh_interval_seconds
@@ -5672,12 +5707,10 @@ class GuardDaemonServer:
         backoff_seconds = (
             self._aibom_refresh_backoff_seconds if self._aibom_refresh_backoff_seconds > 0 else interval_seconds
         )
-        if self._shutdown_started.wait(interval_seconds):
-            return
         while not self._shutdown_started.is_set():
             refreshed_at = _now()
             try:
-                home_dir, workspace_dir = self._aibom_inventory_context_dirs()
+                home_dir, workspace_dir, bound_workspace_id = self._aibom_inventory_context_dirs()
                 if workspace_dir is None:
                     self._server.store.set_sync_payload(
                         "aibom_inventory_daemon",
@@ -5699,16 +5732,23 @@ class GuardDaemonServer:
                         generated_at=refreshed_at,
                         min_interval_seconds=max(int(interval_seconds), 1),
                         auth_context=auth_context,
+                        expected_workspace_id=bound_workspace_id,
                         home_dir=home_dir,
                         workspace_dir=workspace_dir,
                     )
-                status = "synced" if summary.get("synced") is True else str(summary.get("reason") or "skipped")
+                has_error = bool(summary.get("error"))
+                if has_error:
+                    status = "error"
+                elif summary.get("synced") is True:
+                    status = "synced"
+                else:
+                    status = str(summary.get("reason") or "skipped")
                 self._server.store.set_sync_payload(
                     "aibom_inventory_daemon",
                     {**summary, "status": status, "refreshed_at": refreshed_at},
                     refreshed_at,
                 )
-                wait_seconds = interval_seconds
+                wait_seconds = backoff_seconds if has_error or status == "not_configured" else interval_seconds
             except GuardSyncAuthorizationExpiredError as error:
                 self._server.store.set_sync_payload(
                     "aibom_inventory_daemon",

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/src/codex_plugin_scanner/guard/package_firewall_defaults.py

@@ -36,3 +36,28 @@ def build_guard_local_entitlement_defaults(
         "supply_chain_firewall": allowed,
         "supply_chain_plan_id": normalized_tier,
     }
+
+
+def extract_cloud_user_profile(payload: dict[str, object]) -> dict[str, str] | None:
+    """Extract user profile (email, display_name, avatar_url) from guard_local_entitlement.
+
+    Works on both the full token-exchange payload and the raw guard_local_entitlement dict.
+    """
+    entitlement = payload.get("guard_local_entitlement")
+    if not isinstance(entitlement, dict):
+        # If payload IS the entitlement dict, use it directly
+        if "user_profile" in payload:
+            entitlement = payload
+        else:
+            return None
+    profile = entitlement.get("user_profile")
+    if not isinstance(profile, dict):
+        return None
+    email = profile.get("email")
+    if not isinstance(email, str) or not email:
+        return None
+    return {
+        "email": email,
+        "display_name": str(profile.get("display_name") or ""),
+        "avatar_url": str(profile.get("avatar_url") or ""),
+    }

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -46,6 +46,7 @@ from ..cloud_exceptions import (
 from ..config import VALID_RECEIPT_REDACTION_LEVELS, GuardConfig, load_guard_config
 from ..edge_events import build_runtime_session_event
 from ..models import GuardArtifact, HarnessDetection, PolicyDecision
+from ..package_firewall_defaults import extract_cloud_user_profile
 from ..package_firewall_entitlement import (
     build_oauth_package_firewall_entitlement,
     reconcile_connect_state_with_oauth_entitlement,
@@ -1599,6 +1600,9 @@ def sync_receipts(
         aibom_context["home_dir"] = str(home_dir)
     if workspace_dir is not None:
         aibom_context["workspace_dir"] = str(workspace_dir)
+        workspace_id = store.get_cloud_workspace_id()
+        if workspace_id is not None:
+            aibom_context["workspace_id"] = workspace_id
     if aibom_context:
         store.set_sync_payload("aibom_inventory_context", aibom_context, now)
     if persisted_command_detail_backfill_marker is not None:
@@ -3021,6 +3025,8 @@ def _refresh_guard_oauth_access_token(
                 payload,
                 now=datetime.now(timezone.utc),
             ),
+            "cloud_user_profile": extract_cloud_user_profile(payload),
+            "had_guard_local_entitlement": isinstance(payload.get("guard_local_entitlement"), dict),
             "refresh_token": _optional_string(payload.get("refresh_token")) or refresh_token,
         }
 
@@ -3107,6 +3113,7 @@ def _persist_rotated_oauth_refresh_token(
     store: GuardStore,
     credentials: dict[str, object],
     package_firewall_entitlement: dict[str, object] | None = None,
+    cloud_user_profile: dict[str, str] | None = None,
     refresh_token: str,
     access_token: str | None = None,
     access_token_expires_at: str | None = None,
@@ -3156,7 +3163,7 @@ def _persist_rotated_oauth_refresh_token(
             else _optional_string(credentials.get("supply_chain_plan_id"))
         ),
         workspace_id=_optional_string(credentials.get("workspace_id")),
-        cloud_user_profile=_extract_dict_field(credentials, "cloud_user_profile"),
+        cloud_user_profile=cloud_user_profile,
         runtime_id=_optional_string(credentials.get("runtime_id")),
         runtime_label=_optional_string(credentials.get("runtime_label")),
         access_token=access_token,
@@ -3207,16 +3214,34 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
     package_firewall_entitlement: dict[str, object] | None = (
         refreshed_entitlement if isinstance(refreshed_entitlement, dict) else None
     )
+    refreshed_cloud_user_profile = refreshed.get("cloud_user_profile")
+    if not isinstance(refreshed_cloud_user_profile, dict):
+        refreshed_cloud_user_profile = None
+    had_entitlement = bool(refreshed.get("had_guard_local_entitlement"))
+    # When the refresh response includes a guard_local_entitlement but no
+    # user_profile, clear the stale profile rather than preserving it.
+    # When there's no guard_local_entitlement at all (old server), keep existing.
+    effective_cloud_user_profile: dict[str, str] | None
+    if had_entitlement:
+        effective_cloud_user_profile = refreshed_cloud_user_profile
+    else:
+        effective_cloud_user_profile = refreshed_cloud_user_profile or _extract_dict_field(
+            oauth_credentials, "cloud_user_profile"
+        )
+    stored_cloud_user_profile = _extract_dict_field(oauth_credentials, "cloud_user_profile")
+    profile_changed = effective_cloud_user_profile != stored_cloud_user_profile
     if (
         force_refresh
         or rotated_refresh_token != refresh_token
         or package_firewall_entitlement is not None
+        or profile_changed
         or persist_recovered_secret
     ):
         _persist_rotated_oauth_refresh_token(
             store=store,
             credentials=oauth_credentials,
             package_firewall_entitlement=package_firewall_entitlement,
+            cloud_user_profile=effective_cloud_user_profile,
             refresh_token=rotated_refresh_token,
             access_token=_optional_string(refreshed.get("access_token")),
             access_token_expires_at=_optional_string(refreshed.get("access_token_expires_at")),

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.1019"
+__version__ = "2.0.1021"

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/tests/test_guard_aibom_cli.py

@@ -340,6 +340,48 @@ def test_sync_aibom_snapshots_if_due_skips_recent_sync(tmp_path: Path, monkeypat
     assert summary.get("reason") == "recently_synced"
 
 
+def test_sync_aibom_snapshots_if_due_rejects_changed_workspace(tmp_path: Path, monkeypatch) -> None:
+    from codex_plugin_scanner.guard.aibom_cli import sync_aibom_snapshots_if_due
+
+    store = GuardStore(tmp_path / "guard")
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: "workspace-beta")
+
+    summary = sync_aibom_snapshots_if_due(
+        store,
+        generated_at="2026-06-10T13:00:00+00:00",
+        expected_workspace_id="workspace-alpha",
+    )
+
+    assert summary == {
+        "synced": False,
+        "reason": "workspace_changed",
+        "error": "Guard Cloud workspace changed before AIBOM inventory sync.",
+    }
+
+
+def test_sync_aibom_snapshots_if_due_binds_current_workspace(tmp_path: Path, monkeypatch) -> None:
+    from codex_plugin_scanner.guard import aibom_cli
+
+    store = GuardStore(tmp_path / "guard")
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: "workspace-alpha")
+    calls: list[dict[str, object]] = []
+
+    def _fake_sync(*_args: object, **kwargs: object) -> dict[str, object]:
+        calls.append(kwargs)
+        return {"synced": True}
+
+    monkeypatch.setattr(aibom_cli, "sync_aibom_snapshots", _fake_sync)
+
+    summary = aibom_cli.sync_aibom_snapshots_if_due(
+        store,
+        generated_at="2026-06-10T13:00:00+00:00",
+        force=True,
+    )
+
+    assert summary == {"synced": True}
+    assert calls[0]["expected_workspace_id"] == "workspace-alpha"
+
+
 def test_sync_aibom_snapshots_if_due_skips_recent_empty_sync(tmp_path: Path, monkeypatch) -> None:
     from codex_plugin_scanner.guard.aibom_cli import sync_aibom_snapshots_if_due
 
@@ -489,6 +531,24 @@ def test_resolve_trust_attestation_context_includes_workspace_device_for_v2(
     assert context["installationId"] == "device-1"
     assert context["policyVersion"] == "guard-aibom-trust-policy.v1"
     assert context["uploadId"] is None
+
+
+def test_resolve_trust_attestation_context_uses_workspace_override(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    store = GuardStore(tmp_path / "guard")
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: "workspace-beta")
+    monkeypatch.setattr(store, "get_or_create_installation_id", lambda: "device-1")
+    monkeypatch.setenv("GUARD_AIBOM_TRUST_ATTESTATION_V2", "1")
+
+    context = aibom_cli._resolve_trust_attestation_context(
+        store,
+        generated_at="2026-06-10T12:00:00+00:00",
+        workspace_id="workspace-alpha",
+    )
+
+    assert context["workspaceId"] == "workspace-alpha"
     assert context["challengeId"] is None
     assert context["nonce"] is None
     assert context["sequence"] is None

{plugin_scanner-2.0.1019 → plugin_scanner-2.0.1021}/tests/test_guard_event_schema_v1.py

@@ -335,6 +335,7 @@ def test_sync_receipts_runs_aibom_when_deep_sync_is_requested(tmp_path, monkeypa
             store,
             sync_url=f"http://127.0.0.1:{server.server_port}/api/guard/receipts/sync",
             token="token-1",
+            workspace_id="workspace-alpha",
         )
         home_dir = tmp_path / "home"
         workspace_dir = tmp_path / "workspace"
@@ -351,6 +352,11 @@ def test_sync_receipts_runs_aibom_when_deep_sync_is_requested(tmp_path, monkeypa
 
     assert calls == [(home_dir, workspace_dir)]
     assert result["aibom_inventory"] == {"synced": True, "accepted": 1}
+    assert store.get_sync_payload("aibom_inventory_context") == {
+        "home_dir": str(home_dir),
+        "workspace_dir": str(workspace_dir),
+        "workspace_id": "workspace-alpha",
+    }
 
 
 def test_sync_receipts_keeps_receipt_success_when_v1_events_endpoint_is_missing(tmp_path) -> None: