plugin-scanner 2.0.583__tar.gz → 2.0.585__tar.gz

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.583
+Version: 2.0.585
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/action/action.yml

@@ -198,7 +198,14 @@ runs:
       env:
         INSTALL_SOURCE: ${{ inputs.install_source }}
         INSTALL_CISCO: ${{ inputs.install_cisco }}
+        PYTHONNOUSERSITE: "1"
+        PYTHONSAFEPATH: "1"
       run: |
+        ACTION_RUNTIME_ROOT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+        ACTION_RUNTIME_DIR="$(mktemp -d "$ACTION_RUNTIME_ROOT/hol-guard-action-XXXXXX")"
+        trap 'cd "$ACTION_RUNTIME_ROOT" 2>/dev/null || cd /; rm -rf "$ACTION_RUNTIME_DIR"' EXIT
+        cd "$ACTION_RUNTIME_DIR"
+
         LOCAL_SOURCE=""
         for candidate in "$GITHUB_ACTION_PATH" "$GITHUB_ACTION_PATH/.."; do
           if [ -f "$candidate/pyproject.toml" ] && [ -d "$candidate/src/codex_plugin_scanner" ]; then
@@ -212,7 +219,7 @@ runs:
             echo "install_source=local requires the hol-guard source checkout (for example: uses: ./action inside hol-guard)." >&2
             exit 1
           fi
-          python3 -m pip install "$LOCAL_SOURCE[cisco]"
+          python3 -P -m pip install "$LOCAL_SOURCE[cisco]"
         elif [ "$INSTALL_SOURCE" = "pypi" ]; then
           SCANNER_VERSION_FILE="$GITHUB_ACTION_PATH/scanner-version.txt"
           SCANNER_SHA256_FILE="$GITHUB_ACTION_PATH/scanner-sha256.txt"
@@ -228,18 +235,18 @@ runs:
           CISCO_VERSION="$(tr -d '[:space:]' < "$CISCO_VERSION_FILE")"
           PYPI_ATTESTATIONS_VERSION="$(tr -d '[:space:]' < "$PYPI_ATTESTATIONS_VERSION_FILE")"
           SCANNER_REPOSITORY="https://github.com/hashgraph-online/hol-guard"
-          DIST_DIR="${RUNNER_TEMP:-$GITHUB_WORKSPACE/.ai-plugin-scanner-dist}"
+          DIST_DIR="$ACTION_RUNTIME_DIR/ai-plugin-scanner-dist"
           mkdir -p "$DIST_DIR"
 
-          python3 -m pip install "pypi-attestations==${PYPI_ATTESTATIONS_VERSION}"
-          python3 -m pip download --only-binary=:all: --no-deps --dest "$DIST_DIR" "plugin-scanner==${SCANNER_VERSION}"
+          python3 -P -m pip install "pypi-attestations==${PYPI_ATTESTATIONS_VERSION}"
+          python3 -P -m pip download --only-binary=:all: --no-deps --dest "$DIST_DIR" "plugin-scanner==${SCANNER_VERSION}"
 
           DIST_BASENAME="$(
-            DIST_DIR="$DIST_DIR" python3 -c "import os, sys; from pathlib import Path; candidates = sorted(Path(os.environ['DIST_DIR']).glob('plugin_scanner-*.whl')); (len(candidates) == 1) or sys.exit(f'Expected exactly one downloaded scanner wheel, found {len(candidates)}'); print(candidates[0].name)"
+            DIST_DIR="$DIST_DIR" python3 -P -c "import os, sys; from pathlib import Path; candidates = sorted(Path(os.environ['DIST_DIR']).glob('plugin_scanner-*.whl')); (len(candidates) == 1) or sys.exit(f'Expected exactly one downloaded scanner wheel, found {len(candidates)}'); print(candidates[0].name)"
           )"
 
           ACTUAL_SHA256="$(
-            DIST_DIR="$DIST_DIR" DIST_BASENAME="$DIST_BASENAME" python3 -c "import hashlib, os; from pathlib import Path; wheel = Path(os.environ['DIST_DIR']) / os.environ['DIST_BASENAME']; print(hashlib.sha256(wheel.read_bytes()).hexdigest())"
+            DIST_DIR="$DIST_DIR" DIST_BASENAME="$DIST_BASENAME" python3 -P -c "import hashlib, os; from pathlib import Path; wheel = Path(os.environ['DIST_DIR']) / os.environ['DIST_BASENAME']; print(hashlib.sha256(wheel.read_bytes()).hexdigest())"
           )"
           if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
             echo "Downloaded scanner wheel SHA256 does not match scanner-sha256.txt." >&2
@@ -247,16 +254,16 @@ runs:
           fi
 
           WHEEL_PATH="$DIST_DIR/$DIST_BASENAME"
-          if ! python3 -m pypi_attestations verify pypi \
+          if ! python3 -P -m pypi_attestations verify pypi \
             --repository "$SCANNER_REPOSITORY" \
             "$WHEEL_PATH"; then
             echo "Failed to verify PyPI provenance for plugin-scanner==${SCANNER_VERSION}." >&2
             exit 1
           fi
 
-          python3 -m pip install "$WHEEL_PATH"
+          python3 -P -m pip install "$WHEEL_PATH"
           if [ "$INSTALL_CISCO" = "true" ]; then
-            python3 -m pip install "cisco-ai-skill-scanner==${CISCO_VERSION}"
+            python3 -P -m pip install "cisco-ai-skill-scanner==${CISCO_VERSION}"
           fi
         else
           echo "Unsupported install_source: $INSTALL_SOURCE" >&2
@@ -296,7 +303,9 @@ runs:
         PR_COMMENT_STYLE: ${{ inputs.pr_comment_style }}
         PR_COMMENT_MAX_FINDINGS: ${{ inputs.pr_comment_max_findings }}
         GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
-      run: python3 -m codex_plugin_scanner.action_runner
+        PYTHONNOUSERSITE: "1"
+        PYTHONSAFEPATH: "1"
+      run: python3 -P -m codex_plugin_scanner.action_runner
 
     - name: Upload SARIF
       if: ${{ inputs.upload_sarif == 'true' && inputs.mode == 'scan' && steps.scan.outputs.report_path != '' }}

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.583"
+version = "2.0.585"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.583"
+version = "2.0.585"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/src/codex_plugin_scanner/guard/access_graph_events.py

@@ -51,6 +51,8 @@ def queue_access_graph_snapshot(
         edges=edges,
         artifacts=artifacts,
         agent_fingerprint=agent_fingerprint,
+        harness=detection.harness,
+        agent_id=agent_id,
         now=now,
     )
     snapshot_seed = {
@@ -166,6 +168,8 @@ def _add_artifact_entities(
     edges: list[dict[str, object]],
     artifacts: list[dict[str, object]],
     agent_fingerprint: str,
+    harness: str,
+    agent_id: str,
     now: str,
 ) -> None:
     for artifact in artifacts:
@@ -182,7 +186,11 @@ def _add_artifact_entities(
                 "displayName": _non_empty_string(artifact.get("artifact_name")) or artifact_id,
                 "fingerprint": fingerprint,
                 "metadata": {
+                    "agentId": agent_id,
+                    # agentType and harness both carry the harness slug for portal topology resolution.
+                    "agentType": harness,
                     "artifactType": artifact_type,
+                    "harness": harness,
                     "sourceScope": _non_empty_string(artifact.get("source_scope")),
                     "policyAction": _non_empty_string(artifact.get("policy_action")),
                     "present": artifact.get("removed") is not True,

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/src/codex_plugin_scanner/guard/aibom_cli.py

@@ -3,8 +3,11 @@
 from __future__ import annotations
 
 import json
+import os
+import urllib.error
 import uuid
 from dataclasses import dataclass
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Literal
 
@@ -137,12 +140,113 @@ def build_aibom_export_payload(
     return payload
 
 
+_AIBOM_AUTO_SYNC_INTERVAL_SECONDS = 60 * 60
+
+
+def _aware_utc_timestamp(value: str) -> datetime:
+    parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+def _aibom_sync_is_due(
+    store: GuardStore,
+    *,
+    generated_at: str,
+    min_interval_seconds: int,
+) -> bool:
+    prior = store.get_sync_payload("aibom_sync_summary")
+    if not isinstance(prior, dict):
+        return True
+    if prior.get("synced") is not True:
+        return True
+    if prior.get("snapshots") == 0:
+        return True
+    synced_at = prior.get("synced_at")
+    if not isinstance(synced_at, str) or not synced_at.strip():
+        return True
+    try:
+        last_sync = _aware_utc_timestamp(synced_at)
+        now = _aware_utc_timestamp(generated_at)
+        elapsed = (now - last_sync).total_seconds()
+    except (ValueError, OverflowError, TypeError):
+        return True
+    return elapsed >= min_interval_seconds
+
+
+def _resolve_operator_home_dir(home_dir: Path | None = None) -> Path:
+    if home_dir is not None:
+        return home_dir.expanduser().resolve()
+    home_env = os.environ.get("HOME")
+    if home_env:
+        return Path(home_env).expanduser().resolve()
+    return Path.home().resolve()
+
+
+def sync_aibom_snapshots_if_due(
+    store: GuardStore,
+    *,
+    generated_at: str,
+    min_interval_seconds: int = _AIBOM_AUTO_SYNC_INTERVAL_SECONDS,
+    options: AibomCliOptions | None = None,
+    auth_context: dict[str, object] | None = None,
+    home_dir: Path | None = None,
+    workspace_dir: Path | None = None,
+) -> dict[str, object]:
+    from .runtime.runner import (
+        GuardSyncNotConfiguredError,
+        _guard_events_endpoint_unavailable_recently,
+    )
+
+    if store.get_cloud_workspace_id() is None:
+        return {"synced": False, "skipped": True, "reason": "not_configured"}
+    if _guard_events_endpoint_unavailable_recently(store):
+        return {
+            "synced": False,
+            "skipped": True,
+            "reason": "guard_events_endpoint_unavailable",
+        }
+    if not _aibom_sync_is_due(
+        store,
+        generated_at=generated_at,
+        min_interval_seconds=min_interval_seconds,
+    ):
+        prior = store.get_sync_payload("aibom_sync_summary")
+        return {
+            "synced": False,
+            "skipped": True,
+            "reason": "recently_synced",
+            "last_sync_at": prior.get("synced_at") if isinstance(prior, dict) else None,
+        }
+    context = HarnessContext(
+        home_dir=_resolve_operator_home_dir(home_dir),
+        workspace_dir=workspace_dir,
+        guard_home=store.guard_home,
+    )
+    try:
+        return sync_aibom_snapshots(
+            store,
+            context,
+            generated_at=generated_at,
+            options=options,
+            auth_context=auth_context,
+        )
+    except GuardSyncNotConfiguredError:
+        return {"synced": False, "skipped": True, "reason": "not_configured"}
+    except ValueError as error:
+        return {"synced": False, "error": str(error)}
+    except (OSError, RuntimeError) as error:
+        return {"synced": False, "error": str(error)}
+
+
 def sync_aibom_snapshots(
     store: GuardStore,
     context: HarnessContext,
     *,
     generated_at: str,
     options: AibomCliOptions | None = None,
+    auth_context: dict[str, object] | None = None,
 ) -> dict[str, object]:
     from .runtime.runner import (
         GuardSyncNotConfiguredError,
@@ -169,7 +273,7 @@ def sync_aibom_snapshots(
         store.set_sync_payload("aibom_sync_summary", summary, synced_at)
         return summary
 
-    resolved_auth_context = _resolve_guard_sync_auth_context(store)
+    resolved_auth_context = auth_context if auth_context is not None else _resolve_guard_sync_auth_context(store)
     sync_url = _guard_events_sync_url(str(resolved_auth_context["sync_url"]))
     events = [
         _inventory_snapshot_event(
@@ -193,6 +297,29 @@ def sync_aibom_snapshots(
             timeout_seconds=30,
             retry_timeout_seconds=60,
         )
+    except urllib.error.HTTPError as error:
+        if error.code == 404:
+            synced_at = generated_at
+            store.set_sync_payload(
+                "guard_events_v1_summary",
+                {
+                    "synced_at": synced_at,
+                    "events": 0,
+                    "accepted": 0,
+                    "skipped": 0,
+                    "sync_skipped": True,
+                    "sync_reason": "guard_events_endpoint_unavailable",
+                },
+                synced_at,
+            )
+            summary = {
+                "synced": False,
+                "skipped": True,
+                "reason": "guard_events_endpoint_unavailable",
+            }
+            store.set_sync_payload("aibom_sync_summary", summary, synced_at)
+            return summary
+        raise RuntimeError("Guard Cloud AIBOM sync failed due to an HTTP error.") from error
     except OSError as error:
         raise RuntimeError("Guard Cloud AIBOM sync failed due to a network error.") from error
     accepted = payload.get("accepted")
@@ -390,7 +517,7 @@ def _aibom_connection_status(store: GuardStore) -> str:
     if store.get_cloud_workspace_id() is None:
         return "workspace_required"
     sync_summary = _sync_summary(store)
-    if sync_summary.get("synced_at"):
+    if sync_summary.get("synced") is True and sync_summary.get("synced_at"):
         return "synced"
     return "sync_required"
 

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/src/codex_plugin_scanner/guard/cli/commands.py

@@ -1655,6 +1655,8 @@ def _resolve_guard_workspace(
     guard_command = getattr(args, "guard_command", None)
     if guard_command in _INSTALL_WORKSPACE_COMMANDS:
         return _resolve_default_install_workspace(args, guard_home=guard_home)
+    if guard_command == "sync":
+        return Path.cwd().resolve()
     if guard_command != "apps":
         return None
     if getattr(args, "apps_command", None) not in {"connect", "disconnect", "repair", "test"}:
@@ -2826,7 +2828,11 @@ def run_guard_command(
 
     if args.guard_command == "sync":
         try:
-            payload = sync_receipts(store)
+            payload = sync_receipts(
+                store,
+                home_dir=context.home_dir,
+                workspace_dir=context.workspace_dir,
+            )
         except GuardSyncNotConfiguredError as error:
             message = _guard_sync_failure_message(error)
             if getattr(args, "json", False):

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -1120,6 +1120,8 @@ def sync_receipts(
     persist_sync_summary: bool = True,
     persist_connect_state: bool = True,
     auth_context: dict[str, object] | None = None,
+    home_dir: Path | None = None,
+    workspace_dir: Path | None = None,
 ) -> dict[str, object]:
     """Push local receipts to the configured sync endpoint."""
 
@@ -1360,6 +1362,15 @@ def sync_receipts(
     if remote_policy_sync_blocked:
         summary["remote_policy_sync_blocked"] = True
     summary["guard_events_v1"] = sync_guard_events(store, auth_context=resolved_auth_context)
+    from ..aibom_cli import sync_aibom_snapshots_if_due
+
+    summary["aibom_inventory"] = sync_aibom_snapshots_if_due(
+        store,
+        generated_at=now,
+        auth_context=resolved_auth_context,
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
+    )
     if persist_sync_summary:
         store.set_sync_payload("sync_summary", summary, now)
     if persist_connect_state:

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.583"
+__version__ = "2.0.585"

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/tests/test_action_bundle.py

@@ -1,5 +1,8 @@
 """Regression checks for the GitHub Action bundle and Marketplace packaging."""
 
+import os
+import subprocess
+import sys
 from pathlib import Path
 
 import pytest
@@ -24,28 +27,34 @@ def test_action_metadata_includes_marketplace_branding_and_pypi_install() -> Non
     assert 'icon: "check-circle"' in action_text
     assert 'color: "blue"' in action_text
     assert "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405" in action_text
-    assert 'python3 -m pip install "pypi-attestations==' in action_text
+    assert 'python3 -P -m pip install "pypi-attestations==' in action_text
     assert "install_source:" in action_text
     assert 'default: "pypi"' in action_text
     assert "INSTALL_SOURCE: ${{ inputs.install_source }}" in action_text
     assert "install_cisco:" in action_text
     assert "INSTALL_CISCO: ${{ inputs.install_cisco }}" in action_text
+    assert 'PYTHONNOUSERSITE: "1"' in action_text
+    assert 'PYTHONSAFEPATH: "1"' in action_text
+    assert 'ACTION_RUNTIME_ROOT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"' in action_text
+    assert 'ACTION_RUNTIME_DIR="$(mktemp -d "$ACTION_RUNTIME_ROOT/hol-guard-action-XXXXXX")"' in action_text
+    assert 'trap \'cd "$ACTION_RUNTIME_ROOT" 2>/dev/null || cd /; rm -rf "$ACTION_RUNTIME_DIR"\' EXIT' in action_text
+    assert 'cd "$ACTION_RUNTIME_DIR"' in action_text
     assert 'if [ "$INSTALL_CISCO" = "true" ]; then' in action_text
     assert 'if [ "$INSTALL_SOURCE" = "local" ]; then' in action_text
     assert "install_source=local requires the hol-guard source checkout" in action_text
-    assert 'python3 -m pip install "$LOCAL_SOURCE[cisco]"' in action_text
+    assert 'python3 -P -m pip install "$LOCAL_SOURCE[cisco]"' in action_text
     assert 'elif [ "$INSTALL_SOURCE" = "pypi" ]; then' in action_text
     assert (
-        'python3 -m pip download --only-binary=:all: --no-deps --dest "$DIST_DIR" '
+        'python3 -P -m pip download --only-binary=:all: --no-deps --dest "$DIST_DIR" '
         '"plugin-scanner==${SCANNER_VERSION}"'
     ) in action_text
     assert "scanner-sha256.txt" in action_text
     assert 'SCANNER_SHA256_FILE="$GITHUB_ACTION_PATH/scanner-sha256.txt"' in action_text
     assert 'echo "Downloaded scanner wheel SHA256 does not match scanner-sha256.txt."' in action_text
-    assert "python3 -m pypi_attestations verify pypi \\" in action_text
+    assert "python3 -P -m pypi_attestations verify pypi" in action_text
     assert '"$WHEEL_PATH"' in action_text
-    assert 'python3 -m pip install "$WHEEL_PATH"' in action_text
-    assert 'python3 -m pip install "cisco-ai-skill-scanner==${CISCO_VERSION}"' in action_text
+    assert 'python3 -P -m pip install "$WHEEL_PATH"' in action_text
+    assert 'python3 -P -m pip install "cisco-ai-skill-scanner==${CISCO_VERSION}"' in action_text
     assert "scanner-version.txt" in action_text
     scanner_version = (ROOT / "action" / "scanner-version.txt").read_text(encoding="utf-8").strip()
     scanner_sha256 = (ROOT / "action" / "scanner-sha256.txt").read_text(encoding="utf-8").strip()
@@ -54,10 +63,77 @@ def test_action_metadata_includes_marketplace_branding_and_pypi_install() -> Non
     assert "cisco-version.txt" in action_text
     assert "pypi-attestations-version.txt" in action_text
     assert 'SCANNER_REPOSITORY="https://github.com/hashgraph-online/hol-guard"' in action_text
-    assert "python3 -m codex_plugin_scanner.action_runner" in action_text
+    assert "python3 -P -m codex_plugin_scanner.action_runner" in action_text
     assert "github/codeql-action/upload-sarif@" in action_text
 
 
+def test_action_steps_enable_python_safe_path() -> None:
+    yaml = pytest.importorskip("yaml")
+
+    parsed = yaml.safe_load((ROOT / "action" / "action.yml").read_text(encoding="utf-8"))
+    steps = parsed["runs"]["steps"]
+    install_step = next(step for step in steps if step["name"] == "Install scanner")
+    scan_step = next(step for step in steps if step["name"] == "Run scanner")
+
+    assert install_step["env"]["PYTHONNOUSERSITE"] == "1"
+    assert install_step["env"]["PYTHONSAFEPATH"] == "1"
+    assert 'cd "$ACTION_RUNTIME_DIR"' in install_step["run"]
+    assert "python3 -P -m pip install" in install_step["run"]
+    assert scan_step["env"]["PYTHONNOUSERSITE"] == "1"
+    assert scan_step["env"]["PYTHONSAFEPATH"] == "1"
+    assert scan_step["run"] == "python3 -P -m codex_plugin_scanner.action_runner"
+
+
+def test_python_safe_path_blocks_workspace_module_shadowing(tmp_path: Path) -> None:
+    if sys.version_info < (3, 11):
+        pytest.skip("python -P requires Python 3.11+")
+
+    module_name = "shadowdemo_pkg"
+    trusted_root = tmp_path / "trusted-root"
+    trusted_package = trusted_root / module_name
+    trusted_package.mkdir(parents=True)
+    (trusted_package / "__main__.py").write_text(
+        "print('trusted-module')\n",
+        encoding="utf-8",
+    )
+    workspace = tmp_path / "workspace"
+    shadow_package = workspace / module_name
+    shadow_package.mkdir(parents=True)
+    (shadow_package / "__main__.py").write_text(
+        "raise SystemExit('workspace-shadowed')\n",
+        encoding="utf-8",
+    )
+    hijacked_env = {
+        key: value
+        for key, value in os.environ.items()
+        if key not in {"PYTHONSAFEPATH", "PYTHONNOUSERSITE"}
+    }
+    hijacked_env["PYTHONPATH"] = str(trusted_root)
+
+    hijacked = subprocess.run(
+        [sys.executable, "-m", module_name],
+        cwd=workspace,
+        env=hijacked_env,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert hijacked.returncode != 0
+    assert "workspace-shadowed" in f"{hijacked.stdout}{hijacked.stderr}"
+
+    protected = subprocess.run(
+        [sys.executable, "-P", "-m", module_name],
+        cwd=workspace,
+        env=hijacked_env,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert protected.returncode == 0
+    assert "trusted-module" in protected.stdout
+    assert "workspace-shadowed" not in f"{protected.stdout}{protected.stderr}"
+
+
 def test_publish_action_repo_workflow_syncs_action_repository() -> None:
     workflow_text = (
         ROOT / ".github" / "workflows" / "publish-action-repo.yml"

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/tests/test_guard_aibom_cli.py

@@ -209,6 +209,24 @@ def test_aibom_symlink_flags_control_source_metadata(tmp_path: Path) -> None:
     assert follow_metadata.get("validationState") == "valid"
 
 
+def test_sync_aibom_snapshots_if_due_skips_recent_sync(tmp_path: Path, monkeypatch) -> None:
+    from codex_plugin_scanner.guard.aibom_cli import sync_aibom_snapshots_if_due
+
+    store = GuardStore(tmp_path / "guard")
+    monkeypatch.setattr(store, "get_cloud_workspace_id", lambda: "workspace-1")
+    now = "2026-06-10T13:00:00+00:00"
+    store.set_sync_payload(
+        "aibom_sync_summary",
+        {"synced": True, "synced_at": "2026-06-10T12:30:00+00:00"},
+        "2026-06-10T12:30:00+00:00",
+    )
+
+    summary = sync_aibom_snapshots_if_due(store, generated_at=now)
+
+    assert summary.get("skipped") is True
+    assert summary.get("reason") == "recently_synced"
+
+
 def test_aibom_export_json_includes_redaction_report(tmp_path: Path, capsys) -> None:
     home_dir = tmp_path / "home"
     workspace_dir = tmp_path / "workspace"

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/tests/test_guard_cli.py

@@ -7274,7 +7274,7 @@ url = http://127.0.0.1:8787/guard-canary
                 "runtime_sessions_visible": 1,
             }
 
-        def fake_sync_receipts(current_store: GuardStore) -> dict[str, object]:
+        def fake_sync_receipts(current_store: GuardStore, **_kwargs: object) -> dict[str, object]:
             assert current_store is not None
             return {
                 "synced_at": now,
@@ -7335,7 +7335,7 @@ url = http://127.0.0.1:8787/guard-canary
                 "runtime_sessions_visible": 1,
             }
 
-        def fake_sync_receipts(current_store: GuardStore) -> dict[str, object]:
+        def fake_sync_receipts(current_store: GuardStore, **_kwargs: object) -> dict[str, object]:
             assert current_store is not None
             return {
                 "synced_at": now,
@@ -8740,7 +8740,7 @@ url = http://127.0.0.1:8787/guard-canary
     def test_guard_sync_surfaces_auth_expired_reauth_message(self, tmp_path, capsys, monkeypatch):
         home_dir = tmp_path / "home"
 
-        def _fail_sync(_store: GuardStore) -> dict[str, object]:
+        def _fail_sync(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
             raise guard_commands_module.GuardSyncAuthorizationExpiredError(
                 "Guard authorization expired. Run `hol-guard connect` to sign in again."
             )
@@ -8765,7 +8765,7 @@ url = http://127.0.0.1:8787/guard-canary
             "2026-04-09T00:00:00Z",
         )
 
-        def _fail_sync(_store: GuardStore) -> dict[str, object]:
+        def _fail_sync(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
             raise guard_commands_module.GuardSyncAuthorizationExpiredError(
                 "Guard authorization expired. Run `hol-guard connect` to sign in again."
             )
@@ -8788,7 +8788,7 @@ url = http://127.0.0.1:8787/guard-canary
             "2026-04-09T00:00:00Z",
         )
 
-        def _bundle_rejected(current_store: GuardStore) -> dict[str, object]:
+        def _bundle_rejected(current_store: GuardStore, **_kwargs: object) -> dict[str, object]:
             current_store.set_sync_payload(
                 "policy_bundle_last_error",
                 {"reason": "bundle_version_downgrade"},
@@ -8821,7 +8821,11 @@ url = http://127.0.0.1:8787/guard-canary
             "2026-04-09T00:00:00Z",
         )
 
-        monkeypatch.setattr(guard_commands_module, "sync_receipts", lambda _store: {"synced": True})
+        monkeypatch.setattr(
+            guard_commands_module,
+            "sync_receipts",
+            lambda _store, **_kwargs: {"synced": True},
+        )
         monkeypatch.setattr(guard_commands_module, "sync_supply_chain_bundle", lambda _store: None)
 
         guard_commands_module._refresh_cloud_policy_bundle(store)

{plugin_scanner-2.0.583 → plugin_scanner-2.0.585}/tests/test_guard_supply_chain_daemon.py

@@ -61,7 +61,7 @@ def test_daemon_bundle_refresh_stays_quiet_when_not_configured(
 ) -> None:
     store = GuardStore(tmp_path / "guard-home")
 
-    def _fail_sync(_store: GuardStore) -> dict[str, object]:
+    def _fail_sync(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
         raise GuardSyncNotConfiguredError("Guard is not logged in.")
 
     monkeypatch.setattr(guard_daemon_module, "sync_supply_chain_bundle", _fail_sync)
@@ -92,7 +92,7 @@ def test_daemon_bundle_refresh_reports_auth_expired(
 ) -> None:
     store = GuardStore(tmp_path / "guard-home")
 
-    def _fail_sync(_store: GuardStore) -> dict[str, object]:
+    def _fail_sync(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
         raise GuardSyncAuthorizationExpiredError(
             "Guard authorization expired. Run `hol-guard connect` to sign in again."
         )
@@ -124,7 +124,7 @@ def test_daemon_bundle_refresh_reports_retryable_error(
 ) -> None:
     store = GuardStore(tmp_path / "guard-home")
 
-    def _fail_sync(_store: GuardStore) -> dict[str, object]:
+    def _fail_sync(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
         raise RuntimeError("Guard OAuth token refresh failed: oauth upstream down")
 
     monkeypatch.setattr(guard_daemon_module, "sync_supply_chain_bundle", _fail_sync)