plugin-scanner 2.0.630__tar.gz → 2.0.632__tar.gz

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.630
+Version: 2.0.632
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/dashboard/src/evidence/evidence-insights-layout.test.ts

@@ -35,13 +35,12 @@ assert(
   "insights workspace: header description mentions full local store",
 );
 assert(shareModalSource.includes("GuardModalLayer"), "insights share modal: uses viewport modal layer");
+assert(shareModalSource.includes('minimal'), "insights share modal: uses minimal connect flow card");
+assert(shareModalSource.includes('purpose="insights_share"'), "insights share modal: insights share connect purpose");
 assert(shareSheetSource.includes("useCopyFeedbackTimeout"), "insights share sheet: clears copy reset timers");
 assert(surfaceSource.includes("handleShareClose"), "insights surface: stable share modal close handler");
 assert(heatmapSource.includes("if (!displayKey) return"), "insights heatmap: avoids idle global scroll listeners");
 assert(modalLayerSource.includes("onCloseRef"), "insights share modal: stable escape close handler");
 assert(modalLayerSource.includes("createPortal"), "insights share modal: portal layer renders to body");
-assert(shareModalSource.includes("startGuardCloudConnect"), "insights share modal: uses local daemon connect");
-assert(!shareModalSource.includes("window.open(connectUrl"), "insights share modal: does not open hol.org connect page");
-assert(shareModalSource.includes("ConnectFlowCard"), "insights share modal: reuses local connect flow card");
 
 console.log("evidence-insights-layout.test.ts: all tests passed");

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/dashboard/src/evidence/evidence-insights-share-modal.tsx

@@ -38,7 +38,7 @@ export function EvidenceInsightsShareModal({
   runtime: initialRuntime,
   onClose,
 }: EvidenceInsightsShareModalProps) {
-  const [runtime, setRuntime] = useState<GuardRuntimeSnapshot | null>(initialRuntime);
+  const [runtime, setRuntime] = useState(initialRuntime);
   const [includeTopArtifacts, setIncludeTopArtifacts] = useState(false);
   const [showDisplayName, setShowDisplayName] = useState(true);
   const [displayName, setDisplayName] = useState("");
@@ -124,12 +124,12 @@ export function EvidenceInsightsShareModal({
     }
   }, [displayName, includeTopArtifacts, showDisplayName]);
 
-  const activeConnectFlow = useMemo(() => {
+  const activeConnectFlow = useMemo((): GuardCloudConnectFlow => {
     if (connectFlow !== null) {
       return connectFlow;
     }
     return {
-      state: "idle" as const,
+      state: "idle",
       title: "Connect Guard Cloud to publish insights",
       detail:
         "Guard keeps protecting this machine locally. Connect Guard Cloud here so the daemon can publish a public share link with preview image support.",
@@ -164,9 +164,11 @@ export function EvidenceInsightsShareModal({
           <div className="flex items-start justify-between gap-3">
             <div>
               <h2 className="text-lg font-semibold text-brand-dark">Share publicly</h2>
-              <p className="mt-1 text-sm text-slate-500">
-                Publish a redacted stats card to HOL Guard Cloud with a link and preview image.
-              </p>
+              {cloudConnected ? (
+                <p className="mt-1 text-sm text-slate-500">
+                  Publish a redacted stats card with a public link and preview image.
+                </p>
+              ) : null}
             </div>
             <button type="button" onClick={onClose} className="text-sm font-medium text-slate-500 hover:text-brand-dark">
               Close
@@ -175,17 +177,15 @@ export function EvidenceInsightsShareModal({
         </div>
 
         {!cloudConnected ? (
-          <div className="px-5 py-5">
-            <ConnectFlowCard
-              compact
-              connectError={connectError}
-              connectStarting={connectStarting}
-              connectFlow={activeConnectFlow}
-              mode={connectMode}
-              purpose="insights_share"
-              onStartConnect={handleStartConnect}
-            />
-          </div>
+          <ConnectFlowCard
+            minimal
+            purpose="insights_share"
+            mode={connectMode}
+            connectFlow={activeConnectFlow}
+            connectStarting={connectStarting}
+            connectError={connectError}
+            onStartConnect={handleStartConnect}
+          />
         ) : (
           <>
             <div className="space-y-4 px-5 py-5">
@@ -260,7 +260,10 @@ export function EvidenceInsightsShareModal({
               </label>
 
               {error ? (
-                <div className={`rounded-xl border px-3 py-2 text-sm ${errorIsReauth ? "border-amber-200 bg-amber-50 text-amber-900" : "border-rose-200 bg-rose-50 text-rose-900"}`} role="alert">
+                <div
+                  className={`rounded-xl border px-3 py-2 text-sm ${errorIsReauth ? "border-amber-200 bg-amber-50 text-amber-900" : "border-rose-200 bg-rose-50 text-rose-900"}`}
+                  role="alert"
+                >
                   <p>{error}</p>
                   {errorIsReauth ? (
                     <ActionButton variant="outline" onClick={handleStartConnect} className="mt-2 w-full">

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/dashboard/src/guard-api.ts

@@ -1486,7 +1486,7 @@ export async function publishInsightsShare(input: {
     return {
       slug: "demo-share",
       publicUrl: "https://hol.org/guard/insights/demo-share",
-      ogImageUrl: "https://hol.org/api/og/guard/insights/demo-share",
+      ogImageUrl: "https://hol.org/hol-og-image.jpg",
       expiresAt: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString(),
     };
   }

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/dashboard/src/supply-chain-firewall-views.tsx

@@ -56,6 +56,7 @@ export function UpgradeCta({ entitlement }: UpgradeCtaProps) {
 
 type ConnectFlowCardProps = {
   compact?: boolean;
+  minimal?: boolean;
   connectError: string | null;
   connectStarting: boolean;
   connectFlow: NonNullable<PackageFirewallStatusResponse["connect_flow"]>;
@@ -143,6 +144,37 @@ function resolveConnectSteps(
   ];
 }
 
+function resolveMinimalHelperText(input: {
+  failed: boolean;
+  mode: "connect" | "repair";
+  running: boolean;
+}): string {
+  if (input.running) {
+    return "Finish sign-in in your browser to publish a public share link.";
+  }
+  if (input.failed) {
+    return "Connect did not finish. Try again or open sign-in manually.";
+  }
+  if (input.mode === "repair") {
+    return "Reconnect Guard Cloud to restore public sharing from this machine.";
+  }
+  return "One quick sign-in unlocks public sharing from this machine.";
+}
+
+function resolveConnectPrimaryLabel(input: {
+  actionLabel: string;
+  failed: boolean;
+  running: boolean;
+}): string {
+  if (input.running) {
+    return "Waiting for browser approval";
+  }
+  if (input.failed) {
+    return "Try connect again";
+  }
+  return input.actionLabel;
+}
+
 function isMacClient(): boolean {
   if (typeof navigator === "undefined") {
     return false;
@@ -155,6 +187,7 @@ function isMacClient(): boolean {
 
 export function ConnectFlowCard({
   compact = false,
+  minimal = false,
   connectError,
   connectStarting,
   connectFlow,
@@ -167,15 +200,47 @@ export function ConnectFlowCard({
   const running = connectFlow.state === "running";
   const failed = connectFlow.state === "failed";
   const primaryBusy = connectStarting || running;
-  const primaryLabel = running
-    ? "Waiting for browser approval"
-    : failed
-    ? "Try connect again"
-    : connectFlow.action_label;
+  const primaryLabel = resolveConnectPrimaryLabel({
+    actionLabel: connectFlow.action_label,
+    failed,
+    running,
+  });
   const steps = resolveConnectSteps(connectFlow, purpose);
   const statusTone = running ? "blue" : mode === "repair" ? "attention" : "blue";
   const statusLabel = running ? "Waiting for approval" : mode === "repair" ? "Repair required" : "Connection required";
   const showManualLink = connectFlow.authorize_url !== null || running || failed;
+  if (minimal) {
+    const helperText = resolveMinimalHelperText({ failed, mode, running });
+    return (
+      <div className="space-y-4 px-5 py-5">
+        <div className="flex flex-wrap items-center gap-2">
+          <Tag tone={statusTone}>{statusLabel}</Tag>
+        </div>
+        <p className="text-sm leading-relaxed text-slate-600">{helperText}</p>
+        {connectError !== null ? (
+          <p className="text-sm text-brand-attention" role="alert">
+            {connectError}
+          </p>
+        ) : null}
+        <div className="flex flex-wrap items-center gap-2">
+          <ActionButton variant="primary" onClick={onStartConnect} disabled={primaryBusy}>
+            {primaryBusy ? (
+              <HiMiniArrowPath className="mr-1.5 h-3.5 w-3.5 animate-spin" aria-hidden="true" />
+            ) : (
+              <HiMiniShieldCheck className="mr-1.5 h-3.5 w-3.5" aria-hidden="true" />
+            )}
+            {primaryLabel}
+          </ActionButton>
+          {showManualLink ? (
+            <ActionButton href={manualHref} variant="outline">
+              Open sign-in
+              <HiMiniArrowTopRightOnSquare className="ml-1.5 h-3.5 w-3.5" aria-hidden="true" />
+            </ActionButton>
+          ) : null}
+        </div>
+      </div>
+    );
+  }
   if (compact) {
     return (
       <div className="space-y-3">

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.630"
+version = "2.0.632"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.630"
+version = "2.0.632"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/src/codex_plugin_scanner/guard/adapters/claude_code.py

@@ -224,6 +224,44 @@ def _claude_digest(path: Path) -> str:
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
+def _claude_mcp_artifact_id(scope: str, server_name: str) -> str:
+    return f"claude-code:{scope}:mcp:{server_name}"
+
+
+_CLAUDE_BUILTIN_HOOK_TOOL_NAMES = frozenset(
+    {
+        "bash",
+        "shell",
+        "sh",
+        "zsh",
+        "terminal",
+        "run_command",
+        "run_terminal_command",
+        "read",
+        "read_file",
+        "open_file",
+        "view",
+        "view_file",
+        "cat_file",
+        "write",
+        "edit",
+        "multiedit",
+        "write_file",
+        "edit_file",
+        "webfetch",
+        "websearch",
+        "askuserquestion",
+    }
+)
+
+
+def claude_hook_fallback_artifact_id(scope: str, tool_name: str) -> str:
+    normalized_tool = tool_name.strip()
+    if normalized_tool.lower() in _CLAUDE_BUILTIN_HOOK_TOOL_NAMES:
+        return f"claude-code:{scope}:{normalized_tool}"
+    return _claude_mcp_artifact_id(scope, normalized_tool)
+
+
 def _metadata_with_digest(path: Path) -> dict[str, object]:
     try:
         digest = _claude_digest(path)
@@ -318,7 +356,7 @@ class ClaudeCodeHarnessAdapter(HarnessAdapter):
                     url = server_config.get("url")
                     artifacts.append(
                         GuardArtifact(
-                            artifact_id=f"claude-code:{scope}:{name}",
+                            artifact_id=_claude_mcp_artifact_id(scope, name),
                             name=name,
                             harness=self.harness,
                             artifact_type="mcp_server",

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/src/codex_plugin_scanner/guard/aibom_detection.py

@@ -539,6 +539,27 @@ def extend_codex_runtime_inventory(
     )
 
 
+def _is_claude_rules_instruction_replacement_target(
+    existing: GuardArtifact,
+    workspace_dir: Path,
+) -> bool:
+    # Defense-in-depth: only Claude rules markdown may be replaced by workspace-root
+    # CLAUDE.md when IDs collide. MCP servers are namespaced under mcp:, and current
+    # rule discovery uses rules-{stem}, but legacy inventories may still carry the
+    # pre-prefix rules ID at the CLAUDE.md legacy artifact_id.
+    if existing.artifact_type != "instruction" or existing.harness != "claude-code":
+        return False
+    config_path = getattr(existing, "config_path", None)
+    if not isinstance(config_path, str):
+        return False
+    try:
+        resolved = Path(config_path).resolve()
+        rules_dir = (workspace_dir / ".claude" / "rules").resolve()
+        return resolved.is_relative_to(rules_dir)
+    except (OSError, ValueError):
+        return False
+
+
 def _is_workspace_root_claude_md(artifact: GuardArtifact, workspace_dir: Path) -> bool:
     metadata = artifact.metadata if isinstance(artifact.metadata, dict) else {}
     if metadata.get("instructionRole") != "claude_md":
@@ -574,10 +595,13 @@ def extend_detection_with_workspace_aibom(
     for artifact in extra:
         if artifact.artifact_id in existing_ids:
             if _is_workspace_root_claude_md(artifact, workspace_dir):
-                merged[artifact_index_by_id[artifact.artifact_id]] = artifact
-                config_path = getattr(artifact, "config_path", None)
-                if isinstance(config_path, str):
-                    found_paths.append(config_path)
+                existing_index = artifact_index_by_id[artifact.artifact_id]
+                existing = merged[existing_index]
+                if _is_claude_rules_instruction_replacement_target(existing, workspace_dir):
+                    merged[existing_index] = artifact
+                    config_path = getattr(artifact, "config_path", None)
+                    if isinstance(config_path, str):
+                        found_paths.append(config_path)
             continue
         merged.append(artifact)
         existing_ids.add(artifact.artifact_id)

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_artifacts.py

@@ -32,7 +32,12 @@ def _artifact_id_from_event(harness: str, payload: dict[str, object]) -> str:
     source_scope = _coalesce_string(payload.get("source_scope"), "project")
     tool_name = payload.get("tool_name")
     if isinstance(tool_name, str) and tool_name.strip():
-        return f"{harness}:{source_scope}:{tool_name.strip()}"
+        normalized_tool = tool_name.strip()
+        if _canonical_harness_name(harness) == "claude-code":
+            from ..adapters.claude_code import claude_hook_fallback_artifact_id
+
+            return claude_hook_fallback_artifact_id(source_scope, normalized_tool)
+        return f"{harness}:{source_scope}:{normalized_tool}"
     event_name = _hook_event_name(payload)
     if isinstance(event_name, str) and event_name.strip():
         return f"{harness}:{source_scope}:{event_name.strip().lower()}"

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.630"
+__version__ = "2.0.632"

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/tests/test_guard_aibom_detection.py

@@ -18,7 +18,7 @@ from codex_plugin_scanner.guard.aibom_detection import (
 )
 from codex_plugin_scanner.guard.consumer.service import artifact_hash, diff_artifact
 from codex_plugin_scanner.guard.inventory_contract import inventory_snapshot_from_detection
-from codex_plugin_scanner.guard.models import HarnessDetection
+from codex_plugin_scanner.guard.models import GuardArtifact, HarnessDetection
 
 
 def test_inventory_item_kinds_align_with_portal_contract() -> None:
@@ -342,6 +342,70 @@ def test_marketplace_escape_path_does_not_read_outside_workspace(tmp_path: Path)
     assert "content_hash" not in evil_plugins[0].metadata
 
 
+def test_extend_detection_replaces_legacy_rules_collision_with_workspace_claude_md(tmp_path: Path) -> None:
+    workspace = tmp_path / "repo"
+    workspace.mkdir()
+    root_claude_md = workspace / "CLAUDE.md"
+    root_claude_md.write_text("# root instructions\n", encoding="utf-8")
+    legacy_rule = workspace / ".claude" / "rules" / "claude-md.md"
+    legacy_rule.parent.mkdir(parents=True)
+    legacy_rule.write_text("# legacy rule id\n", encoding="utf-8")
+
+    base = HarnessDetection(
+        harness="claude-code",
+        installed=True,
+        command_available=True,
+        config_paths=(str(legacy_rule),),
+        artifacts=(
+            GuardArtifact(
+                artifact_id="claude-code:project:instruction:claude-md",
+                name="claude-md",
+                harness="claude-code",
+                artifact_type="instruction",
+                source_scope="project",
+                config_path=str(legacy_rule),
+                metadata={"instructionRole": "cursor_rules"},
+            ),
+        ),
+    )
+    extended = extend_detection_with_workspace_aibom(
+        base,
+        home_dir=tmp_path,
+        workspace_dir=workspace,
+    )
+    artifacts = {artifact.artifact_id: artifact for artifact in extended.artifacts}
+
+    assert artifacts["claude-code:project:instruction:claude-md"].config_path == str(root_claude_md)
+    assert artifacts["claude-code:project:instruction:claude-md"].metadata.get("instructionRole") == "claude_md"
+
+
+def test_extend_detection_does_not_replace_colliding_mcp_server_with_claude_md(tmp_path: Path) -> None:
+    workspace = tmp_path / "repo"
+    workspace.mkdir()
+    (workspace / "CLAUDE.md").write_text("# root instructions\n", encoding="utf-8")
+    mcp_config = workspace / ".mcp.json"
+    mcp_config.write_text(
+        json.dumps(
+            {
+                "mcpServers": {
+                    "instruction:claude-md": {
+                        "command": "python3",
+                        "args": ["-m", "http.server", "9000"],
+                    }
+                }
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    context = HarnessContext(home_dir=tmp_path, workspace_dir=workspace, guard_home=tmp_path / ".hol-guard")
+    detection = ClaudeCodeHarnessAdapter().detect(context)
+    artifacts = {artifact.artifact_id: artifact for artifact in detection.artifacts}
+
+    assert artifacts["claude-code:project:mcp:instruction:claude-md"].artifact_type == "mcp_server"
+    assert artifacts["claude-code:project:instruction:claude-md"].artifact_type == "instruction"
+
+
 def test_extend_detection_prefers_workspace_root_claude_md_on_legacy_id_collision(tmp_path: Path) -> None:
     workspace = tmp_path / "repo"
     workspace.mkdir()

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/tests/test_guard_claude_adapter.py

@@ -632,10 +632,10 @@ def test_claude_detect_discovers_nested_hooks_skills_commands_and_rules(tmp_path
     detection = adapter.detect(context)
     artifacts = {artifact.artifact_id: artifact for artifact in detection.artifacts}
 
-    assert "claude-code:global:global-tools" in artifacts
-    assert artifacts["claude-code:global:global-tools"].metadata["env_keys"] == ["MODE", "OPENROUTER_API_KEY"]
-    assert "claude-code:project:workspace-tools" in artifacts
-    assert artifacts["claude-code:project:workspace-tools"].metadata["headers_keys"] == ["Authorization"]
+    assert "claude-code:global:mcp:global-tools" in artifacts
+    assert artifacts["claude-code:global:mcp:global-tools"].metadata["env_keys"] == ["MODE", "OPENROUTER_API_KEY"]
+    assert "claude-code:project:mcp:workspace-tools" in artifacts
+    assert artifacts["claude-code:project:mcp:workspace-tools"].metadata["headers_keys"] == ["Authorization"]
     assert "claude-code:project:pretooluse:0:0" in artifacts
     assert "claude-code:project:userpromptsubmit:0:0" in artifacts
     assert "claude-code:project:skill:review" in artifacts
@@ -646,6 +646,34 @@ def test_claude_detect_discovers_nested_hooks_skills_commands_and_rules(tmp_path
     assert claude_instruction.metadata.get("instructionRole") == "claude_md"
 
 
+def test_claude_detect_keeps_mcp_server_when_name_collides_with_claude_md_id(tmp_path):
+    context = _build_context(tmp_path)
+    adapter = ClaudeCodeHarnessAdapter()
+    (context.workspace_dir / "CLAUDE.md").write_text("# workspace instructions\n", encoding="utf-8")
+    _write_json(
+        context.workspace_dir / ".mcp.json",
+        {
+            "mcpServers": {
+                "instruction:claude-md": {
+                    "command": "python3",
+                    "args": ["-m", "http.server", "9000"],
+                }
+            }
+        },
+    )
+
+    detection = adapter.detect(context)
+    artifacts = {artifact.artifact_id: artifact for artifact in detection.artifacts}
+
+    mcp_artifact = artifacts.get("claude-code:project:mcp:instruction:claude-md")
+    assert mcp_artifact is not None
+    assert mcp_artifact.artifact_type == "mcp_server"
+    root_instruction = artifacts.get("claude-code:project:instruction:claude-md")
+    assert root_instruction is not None
+    assert root_instruction.artifact_type == "instruction"
+    assert root_instruction.config_path == str(context.workspace_dir / "CLAUDE.md")
+
+
 def test_claude_detect_keeps_root_claude_md_when_rules_stem_collides(tmp_path):
     context = _build_context(tmp_path)
     adapter = ClaudeCodeHarnessAdapter()

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/tests/test_guard_cli.py

@@ -829,7 +829,7 @@ args = ["workspace-skill.js"]
         artifact_ids = [item["artifact_id"] for item in output["harnesses"][0]["artifacts"]]
 
         assert rc == 0
-        assert artifact_ids == ["claude-code:global:shared-tools", "claude-code:project:shared-tools"]
+        assert artifact_ids == ["claude-code:global:mcp:shared-tools", "claude-code:project:mcp:shared-tools"]
 
     def test_guard_detect_scopes_claude_hook_artifact_ids(self, tmp_path, capsys):
         home_dir = tmp_path / "home"

{plugin_scanner-2.0.630 → plugin_scanner-2.0.632}/tests/test_guard_runtime.py

@@ -4264,7 +4264,7 @@ clearer UX and an implementation plan with technical references.
         event = {
             "event": "PreToolUse",
             "tool_name": "workspace-tools",
-            "artifact_id": "claude-code:project:workspace-tools",
+            "artifact_id": "claude-code:project:mcp:workspace-tools",
             "artifact_name": "workspace-tools",
             "policy_action": "require-reapproval",
             "changed_capabilities": ["tool_name"],
@@ -4298,7 +4298,7 @@ clearer UX and an implementation plan with technical references.
         message = "HOL Guard blocked this launch because the action matched a sensitive local secret path."
         event = {
             "event": "PreToolUse",
-            "artifact_id": "claude-code:project:workspace-tools",
+            "artifact_id": "claude-code:project:mcp:workspace-tools",
             "artifact_name": "workspace-tools",
             "policy_action": "block",
             "decision_v2_json": {
@@ -4401,7 +4401,7 @@ clearer UX and an implementation plan with technical references.
         output = json.loads(capsys.readouterr().out)
 
         assert rc == 0
-        assert output["artifact_id"] == "claude-code:project:workspace-tools"
+        assert output["artifact_id"] == "claude-code:project:mcp:workspace-tools"
 
     def test_guard_hook_uses_copilot_repo_hook_runtime_path(self, tmp_path, capsys, monkeypatch):
         home_dir = tmp_path / "home"
@@ -11898,7 +11898,7 @@ def test_guard_run_headless_redetects_before_persisted_resume(tmp_path, monkeypa
 
     store = GuardStore(home_dir)
     baseline = GuardArtifact(
-        artifact_id="claude-code:project:workspace-tools",
+        artifact_id="claude-code:project:mcp:workspace-tools",
         name="workspace-tools",
         harness="claude-code",
         artifact_type="mcp_server",
@@ -12020,7 +12020,7 @@ def test_guard_headless_blocked_run_persists_receipts_and_diffs(tmp_path, monkey
     _build_guard_fixture(home_dir, workspace_dir)
     store = GuardStore(home_dir)
     baseline = GuardArtifact(
-        artifact_id="claude-code:project:workspace-tools",
+        artifact_id="claude-code:project:mcp:workspace-tools",
         name="workspace-tools",
         harness="claude-code",
         artifact_type="mcp_server",
@@ -12176,7 +12176,7 @@ def test_guard_hook_invalid_policy_action_falls_back_to_reapproval(tmp_path, cap
     event = {
         "event": "PreToolUse",
         "tool_name": "workspace-tools",
-        "artifact_id": "claude-code:project:workspace-tools",
+        "artifact_id": "claude-code:project:mcp:workspace-tools",
         "policy_action": "require_reapproval",
         "source_scope": "project",
     }