plugin-scanner 2.0.678__tar.gz → 2.0.680__tar.gz

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.678
+Version: 2.0.680
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/dashboard/e2e/fixture-states.ts

@@ -126,7 +126,61 @@ export const degradedStateSnapshot = {
 };
 
 export const emptyReceiptsPayload = { items: [] };
-export const emptyPoliciesPayload = { items: [] };
+export const emptyPoliciesPayload = { items: [], cloud_exceptions: [] };
+
+export const connectedCloudExceptionsPayload = {
+  items: [
+    {
+      id: "artifact:codex:e2e-active",
+      effect: "allow",
+      scope: "artifact",
+      harness: "codex",
+      owner: "owner@example.com",
+      approver: "approver@example.com",
+      expiry: "2099-01-01T00:00:00+00:00",
+      artifact_id: "codex:project:e2e-active",
+      source_receipt_id: "receipt-e2e",
+      bundle_hash: "sha256:e2e-bundle",
+      ack_status: "synced",
+      last_used_at: null,
+      rejection_reason: null,
+    },
+  ],
+};
+
+export const ackFailureCloudExceptionsPayload = {
+  items: [
+    {
+      id: "artifact:codex:e2e-failed",
+      effect: "allow",
+      scope: "artifact",
+      harness: "codex",
+      owner: "owner@example.com",
+      approver: "approver@example.com",
+      expiry: "2099-01-01T00:00:00+00:00",
+      artifact_id: "codex:project:e2e-failed",
+      source_receipt_id: "receipt-e2e-failed",
+      bundle_hash: "sha256:e2e-bundle-failed",
+      ack_status: "failed",
+      last_used_at: null,
+      rejection_reason: "Bundle signature mismatch",
+    },
+  ],
+};
+
+export const pendingCloudExceptionRequestsPayload = {
+  items: [
+    {
+      requestId: "req-e2e-pending",
+      scope: "artifact",
+      status: "pending",
+      reason: "Temporary allow for e2e",
+      owner: "owner@example.com",
+      requestedAt: "2026-06-14T12:00:00+00:00",
+      requestedExpiresAt: "2099-01-01T00:00:00+00:00",
+    },
+  ],
+};
 export const emptyInventoryPayload = { items: [] };
 
 export const defaultSettingsPayload = {

plugin_scanner-2.0.680/dashboard/e2e/policy-cloud-exceptions-states.spec.ts

@@ -0,0 +1,89 @@
+import { test, expect, type Page } from "@playwright/test";
+import {
+  freeStateSnapshot,
+  paidStateSnapshot,
+  connectedCloudExceptionsPayload,
+  ackFailureCloudExceptionsPayload,
+  pendingCloudExceptionRequestsPayload,
+  emptyReceiptsPayload,
+  emptyInventoryPayload,
+  defaultSettingsPayload,
+} from "./fixture-states";
+
+const DAEMON_PARAM = "?guardDaemon=http://127.0.0.1:4175";
+
+async function mountPolicyCloudRoute(
+  page: Page,
+  snapshot: typeof paidStateSnapshot,
+  cloudExceptions: typeof connectedCloudExceptionsPayload,
+) {
+  await page.route("**/v1/**", (route) => {
+    const path = new URL(route.request().url()).pathname;
+    if (path.includes("/initialize")) {
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ auth_token: "e2e-token-policy" }),
+      });
+      return;
+    }
+    if (path.includes("/runtime")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(snapshot) });
+      return;
+    }
+    if (path.includes("/policy/cloud-exception-requests")) {
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(pendingCloudExceptionRequestsPayload),
+      });
+      return;
+    }
+    if (path.includes("/policy/cloud-exceptions") || path.endsWith("/policy")) {
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(cloudExceptions),
+      });
+      return;
+    }
+    if (path.includes("/receipts")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(emptyReceiptsPayload) });
+      return;
+    }
+    if (path.includes("/settings")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(defaultSettingsPayload) });
+      return;
+    }
+    if (path.includes("/inventory")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(emptyInventoryPayload) });
+      return;
+    }
+    route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify({}) });
+  });
+}
+
+test.describe("Policy cloud exceptions states", () => {
+  test("connected cloud shows synced exception groups", async ({ page }) => {
+    await mountPolicyCloudRoute(page, paidStateSnapshot, connectedCloudExceptionsPayload);
+    await page.goto(`/policy${DAEMON_PARAM}`);
+    await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+    await expect(page.getByText("Active on this device")).toBeVisible();
+    await expect(page.getByText("codex:project:e2e-active")).toBeVisible();
+  });
+
+  test("disconnected cloud shows honest offline state", async ({ page }) => {
+    await mountPolicyCloudRoute(page, freeStateSnapshot, { items: [] });
+    await page.goto(`/policy${DAEMON_PARAM}`);
+    await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+    await expect(page.getByText("Guard Cloud is not connected")).toBeVisible();
+  });
+
+  test("ack failure surfaces in exception detail", async ({ page }) => {
+    await mountPolicyCloudRoute(page, paidStateSnapshot, ackFailureCloudExceptionsPayload);
+    await page.goto(`/policy${DAEMON_PARAM}`);
+    await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+    await page.getByText("codex:project:e2e-failed").click();
+    await expect(page.getByText("Ack failed")).toBeVisible();
+  });
+});

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

plugin_scanner-2.0.680/dashboard/src/policy-review-scope.test.ts

@@ -0,0 +1,18 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const reviewSource = readFileSync(join(here, "approval-center-layout.tsx"), "utf8");
+
+assert(!reviewSource.includes("PolicyCloudExceptionsTab"), "review layout must not mount cloud exceptions tab");
+assert(!reviewSource.includes("policy-cloud-exception"), "review layout must not import cloud exception modules");
+assert(reviewSource.includes("Review"), "review layout remains the review surface");
+
+console.log("policy-review-scope.test.ts: all assertions passed");

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.678"
+version = "2.0.680"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.678"
+version = "2.0.680"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.680/scripts/run-cloud-exception-sync-proof.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+python3 -m pytest tests/test_cloud_exception_sync_proof.py -q
+if [ -f "./dashboard/node_modules/.bin/tsx" ]; then
+  ./dashboard/node_modules/.bin/tsx dashboard/src/policy-review-scope.test.ts
+else
+  echo "Warning: tsx not found, skipping policy-review-scope test"
+fi
+
+echo "cloud exception sync proof: ok"

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/src/codex_plugin_scanner/guard/cli/commands_dispatch_records.py

@@ -5,6 +5,7 @@
 
 from __future__ import annotations
 
+from ..aibom_cli import AibomCliOptions, _AIBOM_CLOUD_SYNC_OPTIONS
 from ._commands_shared import *
 from .commands_parser_helpers import *
 
@@ -129,12 +130,31 @@ def _run_guard_aibom_command(
         _emit("aibom.status", payload, getattr(args, "json", False))
         return 0
     if aibom_command == "sync":
+        sync_options = AibomCliOptions(
+            include_symlinks=aibom_options.include_symlinks,
+            follow_unsafe_symlinks=aibom_options.follow_unsafe_symlinks,
+            cisco_skill_scan=getattr(
+                args,
+                "cisco_skill_scan",
+                _AIBOM_CLOUD_SYNC_OPTIONS.cisco_skill_scan,
+            ),
+            cisco_mcp_scan=getattr(
+                args,
+                "cisco_mcp_scan",
+                _AIBOM_CLOUD_SYNC_OPTIONS.cisco_mcp_scan,
+            ),
+            cisco_timeout_seconds=getattr(
+                args,
+                "cisco_timeout_seconds",
+                _AIBOM_CLOUD_SYNC_OPTIONS.cisco_timeout_seconds,
+            ),
+        )
         try:
             payload = sync_aibom_snapshots(
                 store,
                 context,
                 generated_at=generated_at,
-                options=aibom_options,
+                options=sync_options,
             )
         except GuardSyncNotConfiguredError as error:
             message = _guard_sync_failure_message(error)

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/src/codex_plugin_scanner/integrations/cisco_skill_scanner.py

@@ -108,7 +108,7 @@ def _scan_directory_with_timeout(
     os.close(file_descriptor)
 
     env = os.environ.copy()
-    env["PYTHONPATH"] = os.pathsep.join(sys.path)
+    env["PYTHONPATH"] = os.pathsep.join(str(path) for path in sys.path)
     try:
         try:
             result = subprocess.run(

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.678"
+__version__ = "2.0.680"

plugin_scanner-2.0.680/tests/cloud_exception_bundle_fixtures.py

@@ -0,0 +1,98 @@
+"""Code-generated Cloud exception bundle fixtures for sync proof tests."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from codex_plugin_scanner.guard.policy_bundle_parser import computed_policy_bundle_hash
+
+
+def _sample_policy_bundle(*, bundle_hash: str | None = None) -> dict[str, object]:
+    bundle: dict[str, object] = {
+        "contractVersion": "guard-policy-bundle.v1",
+        "bundleVersion": "policy-2026-04-19.1",
+        "bundleHash": bundle_hash or "",
+        "issuedAt": "2026-04-19T00:00:10+00:00",
+        "expiresAt": None,
+        "verifier": {
+            "algorithm": "sha256",
+            "keyId": "guard-policy-bundle-v1",
+            "signature": None,
+        },
+        "rolloutState": "enforcing",
+        "policyDefaults": {
+            "mode": "enforce",
+            "defaultAction": "warn",
+            "unknownPublisherAction": "review",
+            "changedHashAction": "require-reapproval",
+            "newNetworkDomainAction": "warn",
+            "subprocessAction": "block",
+            "telemetryEnabled": False,
+            "syncEnabled": True,
+        },
+        "rules": [
+            {
+                "ruleId": "pkg-block",
+                "action": "block",
+                "reason": "Block risky package installs before execution.",
+                "matcherFamilies": ["package-request"],
+                "scope": {
+                    "agents": [],
+                    "devices": [],
+                    "ecosystems": ["npm"],
+                    "environments": ["development"],
+                    "harnesses": ["codex"],
+                    "locations": [],
+                },
+            }
+        ],
+        "acknowledgements": [],
+    }
+    if bundle_hash is None:
+        bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+    return bundle
+
+
+def build_cloud_exception_bundle_entry(
+    *,
+    exception_id: str = "artifact:codex:sync-proof",
+    expires_at: str = "2099-01-01T00:00:00+00:00",
+    workspace_id: str | None = None,
+) -> dict[str, object]:
+    entry: dict[str, object] = {
+        "exceptionId": exception_id,
+        "effect": "allow",
+        "scope": "artifact",
+        "harness": "codex",
+        "artifactId": "codex:project:sync-proof",
+        "owner": "owner@example.com",
+        "approver": "approver@example.com",
+        "expiresAt": expires_at,
+        "sourceReceiptId": "receipt-sync-proof",
+    }
+    if workspace_id is not None:
+        entry["workspaceId"] = workspace_id
+    return entry
+
+
+def build_cloud_exception_policy_bundle(
+    *,
+    bundle_hash: str | None = None,
+    cloud_exceptions: list[dict[str, object]] | None = None,
+    workspace_id: str = "workspace-sync-proof",
+    device_id: str = "device-sync-proof",
+) -> dict[str, object]:
+    bundle = _sample_policy_bundle(bundle_hash=bundle_hash)
+    bundle["workspaceId"] = workspace_id
+    bundle["cloudExceptions"] = cloud_exceptions or [build_cloud_exception_bundle_entry()]
+    bundle["acknowledgements"] = [
+        {
+            "deviceId": device_id,
+            "deviceName": "Sync proof device",
+            "acknowledgedAt": datetime.now(timezone.utc).isoformat(),
+            "status": "synced",
+        }
+    ]
+    if bundle_hash is None:
+        bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+    return bundle

plugin_scanner-2.0.680/tests/test_cloud_exception_sync_proof.py

@@ -0,0 +1,146 @@
+"""Cross-repo Cloud exception sync proof (HGLP136-HGLP141)."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from codex_plugin_scanner.guard.cloud_exceptions import (
+    build_cloud_exceptions_from_policy_bundle,
+    list_active_cloud_exceptions,
+)
+from codex_plugin_scanner.guard.policy_bundle_parser import validated_policy_bundle_payload
+from codex_plugin_scanner.guard.runtime.runner import _persist_cloud_exceptions
+from codex_plugin_scanner.guard.store import GuardStore
+from tests.cloud_exception_bundle_fixtures import (
+    build_cloud_exception_bundle_entry,
+    build_cloud_exception_policy_bundle,
+)
+from tests.test_policy_bundle_parser import computed_policy_bundle_hash
+
+
+class _JsonResponse:
+    def __init__(self, payload: dict[str, object]) -> None:
+        self._payload = payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+    def read(self) -> bytes:
+        return json.dumps(self._payload).encode("utf-8")
+
+
+def test_hglp136_fixture_is_code_generated_not_static_ui_copy() -> None:
+    bundle = build_cloud_exception_policy_bundle()
+    assert isinstance(bundle.get("cloudExceptions"), list)
+    assert bundle["cloudExceptions"][0]["exceptionId"] == "artifact:codex:sync-proof"
+
+
+def test_hglp137_local_daemon_accepts_valid_exception_bundle(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "home")
+    bundle = build_cloud_exception_policy_bundle()
+    validated, reason = validated_policy_bundle_payload(bundle)
+    assert reason is None
+    assert validated is not None
+    _persist_cloud_exceptions(store, policy_bundle=validated, now="2026-06-14T12:00:00+00:00")
+    listed = store.list_cloud_exceptions()
+    assert len(listed) == 1
+    assert listed[0]["id"] == "artifact:codex:sync-proof"
+
+
+def test_hglp138_local_daemon_rejects_tampered_exception_bundle(tmp_path: Path) -> None:
+    bundle = build_cloud_exception_policy_bundle()
+    bundle["bundleHash"] = "sha256:tampered"
+    validated, reason = validated_policy_bundle_payload(bundle)
+    assert validated is None
+    assert reason == "bundle_hash_mismatch"
+
+
+def test_hglp139_expired_cloud_exception_is_not_active_after_bundle_load() -> None:
+    bundle = build_cloud_exception_policy_bundle(
+        cloud_exceptions=[
+            build_cloud_exception_bundle_entry(
+                exception_id="artifact:codex:expired",
+                expires_at="2020-01-01T00:00:00+00:00",
+            )
+        ]
+    )
+    items = build_cloud_exceptions_from_policy_bundle(bundle, device_id="device-sync-proof")
+    active = list_active_cloud_exceptions(items, now="2026-06-14T12:00:00+00:00")
+    assert active == []
+
+
+def test_hglp140_wrong_workspace_bundle_is_rejected(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
+
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "guard-live-token",
+        "2026-06-14T12:00:00+00:00",
+        workspace_id="workspace-a",
+    )
+    bundle = build_cloud_exception_policy_bundle(workspace_id="workspace-b")
+    bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+
+    def _fake_urlopen(request, timeout):
+        if request.full_url.endswith("/api/v1/guard/events"):
+            return _JsonResponse({"accepted": 0, "rejected": 0, "statuses": []})
+        return _JsonResponse(
+            {
+                "syncedAt": "2026-06-14T12:00:01+00:00",
+                "receiptsStored": 0,
+                "policyBundle": bundle,
+            }
+        )
+
+    monkeypatch.setattr(guard_runner_module.urllib.request, "urlopen", _fake_urlopen)
+    monkeypatch.setattr(guard_runner_module, "sync_pain_signals", lambda _store, auth_context=None: 0)
+
+    guard_runner_module.sync_receipts(store)
+
+    assert store.get_sync_payload("policy_bundle") is None
+    assert store.get_sync_payload("policy_bundle_last_error") == {"reason": "wrong_workspace"}
+
+
+def test_hglp141_bundle_ack_metadata_is_available_for_sync_upload(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
+
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "guard-live-token",
+        "2026-06-14T12:00:00+00:00",
+    )
+    bundle = build_cloud_exception_policy_bundle()
+    bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+    requests: list[dict[str, object]] = []
+
+    def _fake_urlopen(request, timeout):
+        if request.full_url.endswith("/api/v1/guard/events"):
+            return _JsonResponse({"accepted": 0, "rejected": 0, "statuses": []})
+        body = json.loads(request.data.decode("utf-8"))
+        requests.append(body)
+        return _JsonResponse(
+            {
+                "syncedAt": f"2026-06-14T12:00:0{len(requests)}+00:00",
+                "receiptsStored": 0,
+                "policyBundle": bundle,
+            }
+        )
+
+    monkeypatch.setattr(guard_runner_module.urllib.request, "urlopen", _fake_urlopen)
+    monkeypatch.setattr(guard_runner_module, "sync_pain_signals", lambda _store, auth_context=None: 0)
+
+    guard_runner_module.sync_receipts(store)
+    guard_runner_module.sync_receipts(store)
+
+    assert store.get_sync_payload("policy_bundle") is not None
+    assert "policyBundleAcknowledgement" in requests[1]["syncContext"]

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/tests/test_guard_aibom_cli.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import argparse
 import json
 from email.message import Message
 from pathlib import Path
@@ -7,6 +8,9 @@ from pathlib import Path
 import pytest
 
 from codex_plugin_scanner.cli import main
+from codex_plugin_scanner.guard import aibom_cli
+from codex_plugin_scanner.guard.adapters.base import HarnessContext
+from codex_plugin_scanner.guard.cli import commands_dispatch_records as dispatch
 from codex_plugin_scanner.guard.inventory_cisco import CiscoInventoryRun
 from codex_plugin_scanner.guard.inventory_contract import inventory_snapshot_from_detection
 from codex_plugin_scanner.guard.models import GuardArtifact, HarnessDetection
@@ -472,6 +476,46 @@ def test_sync_aibom_snapshots_uses_cloud_sync_cisco_defaults(
     assert options.cisco_timeout_seconds == 30.0
 
 
+def test_guard_aibom_sync_command_uses_cloud_sync_cisco_defaults(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard")
+    context = HarnessContext(
+        home_dir=tmp_path / "home",
+        workspace_dir=tmp_path / "workspace",
+        guard_home=tmp_path / "guard",
+    )
+    observed: dict[str, object] = {}
+
+    def fake_sync_aibom_snapshots(*args: object, **kwargs: object) -> dict[str, object]:
+        observed["kwargs"] = kwargs
+        return {"synced": True}
+
+    monkeypatch.setattr(dispatch, "sync_aibom_snapshots", fake_sync_aibom_snapshots)
+
+    exit_code = dispatch._run_guard_aibom_command(
+        argparse.Namespace(
+            aibom_command="sync",
+            include_symlinks=True,
+            follow_unsafe_symlinks=False,
+            json=True,
+        ),
+        context=context,
+        store=store,
+    )
+
+    assert exit_code == 0
+    kwargs = observed["kwargs"]
+    assert isinstance(kwargs, dict)
+    options = kwargs["options"]
+    assert isinstance(options, aibom_cli.AibomCliOptions)
+    assert options.cisco_skill_scan == "auto"
+    assert options.cisco_mcp_scan == "auto"
+    assert options.cisco_timeout_seconds == 30.0
+    assert options.include_symlinks is True
+    assert options.follow_unsafe_symlinks is False
+
+
 def test_aibom_export_json_includes_redaction_report(tmp_path: Path, capsys) -> None:
     home_dir = tmp_path / "home"
     workspace_dir = tmp_path / "workspace"

{plugin_scanner-2.0.678 → plugin_scanner-2.0.680}/tests/test_guard_cisco_evidence.py

@@ -180,7 +180,7 @@ def test_skill_scanner_reports_timeout_without_marking_scan_failed(monkeypatch,
     assert "timed out" in summary.message
 
 
-def test_skill_scanner_timeout_path_drains_worker_result_before_terminating(monkeypatch, tmp_path: Path) -> None:
+def test_skill_scanner_subprocess_run_success(monkeypatch, tmp_path: Path) -> None:
     output_path = tmp_path / "scan-output.json"
 
     monkeypatch.setattr(cisco_skill_scanner.tempfile, "mkstemp", lambda prefix, suffix: (123, str(output_path)))