plugin-scanner 2.0.708__tar.gz → 2.0.710__tar.gz

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.708
+Version: 2.0.710
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.708"
+version = "2.0.710"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.708"
+version = "2.0.710"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/adapters/cursor_hooks.py

@@ -853,20 +853,66 @@ def _normalize_cursor_shell_command(command: str) -> str:
     return stripped
 
 
+# Installed hook helpers below mirror cursor_native_approval.py; keep both copies in sync.
+
+
+def _cursor_hook_payload_is_mcp_execution(payload: Mapping[str, object]) -> bool:
+    source_event = payload.get("cursor_source_hook_event")
+    if isinstance(source_event, str) and source_event.strip().lower() == "beforemcpexecution":
+        return True
+    for key in ("hook_event_name", "hookEventName", "hook_name", "hookName", "event", "eventName"):
+        value = payload.get(key)
+        if isinstance(value, str):
+            lowered = value.strip().lower()
+            if lowered in {"beforemcpexecution", "aftermcpexecution"}:
+                return True
+    return False
+
+
+def _is_shell_wrapper_command(command: str) -> bool:
+    stripped = command.strip()
+    if not stripped:
+        return False
+    try:
+        parts = shlex.split(stripped, posix=True, comments=False)
+    except ValueError:
+        return False
+    if not parts:
+        return False
+    binary = Path(parts[0]).name.lower()
+    if binary == "lean-ctx":
+        return True
+    if binary not in {"ash", "bash", "dash", "fish", "sh", "zsh"}:
+        return False
+    return len(parts) > 1 and parts[1] == "-c"
+
+
+def _nested_cursor_shell_command(tool_input: Mapping[str, object]) -> str | None:
+    for key in ("command", "cmd", "shell_command", "shellCommand"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value.strip():
+            return _normalize_cursor_shell_command(value)
+    return None
+
+
 def _cursor_shell_command(payload: Mapping[str, object]) -> str | None:
     tool_input = payload.get("tool_input")
     nested_command: str | None = None
     if isinstance(tool_input, dict):
-        nested = tool_input.get("command")
-        if isinstance(nested, str) and nested.strip():
-            nested_command = _normalize_cursor_shell_command(nested)
+        nested_command = _nested_cursor_shell_command(tool_input)
     command = payload.get("command")
+    top_level: str | None = None
     if isinstance(command, str) and command.strip():
         top_level = _normalize_cursor_shell_command(command)
+    if _cursor_hook_payload_is_mcp_execution(payload):
         if nested_command is not None:
-            first_token = command.strip().split(maxsplit=1)[0]
-            if Path(first_token).name.lower() == "lean-ctx":
-                return nested_command
+            return nested_command
+        return top_level
+    if nested_command is not None and (
+        top_level is None or (isinstance(command, str) and _is_shell_wrapper_command(command))
+    ):
+        return nested_command
+    if top_level is not None:
         return top_level
     return nested_command
 

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/adapters/cursor_native_approval.py

@@ -24,6 +24,17 @@ _CURSOR_BLOCKING_OBSERVER_EVENTS = {
 }
 _MAX_CURSOR_SHELL_NORMALIZE_BYTES = 8192
 _LEAN_CTX_COMMAND_MARKER = "lean-ctx"
+_SHELL_WRAPPER_BINARIES = frozenset(
+    {
+        _LEAN_CTX_COMMAND_MARKER,
+        "ash",
+        "bash",
+        "dash",
+        "fish",
+        "sh",
+        "zsh",
+    }
+)
 
 
 def _split_posix_single_quoted_argument(text: str) -> tuple[str, str] | None:
@@ -119,6 +130,41 @@ def is_lean_ctx_wrapper_command(command: str) -> bool:
     return Path(first_token).name.lower() == _LEAN_CTX_COMMAND_MARKER
 
 
+def is_shell_wrapper_command(command: str) -> bool:
+    """Return True when a top-level command is wrapping an inner shell invocation."""
+
+    stripped = command.strip()
+    if not stripped:
+        return False
+    if is_lean_ctx_wrapper_command(stripped):
+        return True
+    try:
+        parts = shlex.split(stripped, posix=True, comments=False)
+    except ValueError:
+        return False
+    if not parts:
+        return False
+    binary = Path(parts[0]).name.lower()
+    if binary not in _SHELL_WRAPPER_BINARIES:
+        return False
+    return len(parts) > 1 and parts[1] == "-c"
+
+
+def cursor_hook_payload_is_mcp_execution(payload: Mapping[str, object]) -> bool:
+    """Return True when the payload came from Cursor MCP before/after hooks."""
+
+    source_event = payload.get("cursor_source_hook_event")
+    if isinstance(source_event, str) and source_event.strip().lower() == "beforemcpexecution":
+        return True
+    for key in ("hook_event_name", "hookEventName", "hook_name", "hookName", "event", "eventName"):
+        value = payload.get(key)
+        if isinstance(value, str):
+            lowered = value.strip().lower()
+            if lowered in {"beforemcpexecution", "aftermcpexecution"}:
+                return True
+    return False
+
+
 def cursor_observer_event_for_blocking(blocking_event: str) -> str | None:
     return _CURSOR_BLOCKING_OBSERVER_EVENTS.get(blocking_event.strip())
 
@@ -450,12 +496,14 @@ __all__ = [
     "cursor_after_shell_trusted",
     "cursor_generation_id",
     "cursor_hook_attestation_secret_path",
+    "cursor_hook_payload_is_mcp_execution",
     "cursor_observer_event_for_blocking",
     "cursor_observer_event_for_payload",
     "cursor_shell_binding_path",
     "ensure_cursor_approval_binding",
     "ensure_cursor_hook_attestation_secret",
     "is_lean_ctx_wrapper_command",
+    "is_shell_wrapper_command",
     "managed_cursor_hook_invocation",
     "normalize_cursor_shell_command",
     "read_cursor_shell_binding_file",

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -187,7 +187,9 @@ def _finalize_guard_connect_payload(
     )
     oauth_health = store.get_oauth_local_credential_health()
     oauth_state = str(oauth_health.get("state") or "")
-    if store.get_cloud_sync_profile() is None and oauth_state == "degraded":
+    if store.get_cloud_sync_profile() is None and (
+        oauth_state == "degraded" or not oauth_health.get("configured")
+    ):
         repair_message = (
             "Guard Cloud authorization did not persist locally. "
             "Run hol-guard connect again to repair local sign-in."

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/cli/commands_support_hook_state.py

@@ -290,20 +290,28 @@ def _cursor_conversation_id(payload: dict[str, object]) -> str | None:
 
 def _cursor_shell_command_from_payload(payload: Mapping[str, object]) -> str | None:
     from ..adapters.cursor_native_approval import (
-        is_lean_ctx_wrapper_command,
+        cursor_hook_payload_is_mcp_execution,
+        is_shell_wrapper_command,
         normalize_cursor_shell_command,
     )
 
     tool_input_command = _hook_command_text(payload)
     top_level = _optional_string(payload.get("command"))
+    if cursor_hook_payload_is_mcp_execution(payload):
+        if tool_input_command is not None:
+            return normalize_cursor_shell_command(tool_input_command)
+        if top_level is not None:
+            return normalize_cursor_shell_command(top_level)
+        return None
     if tool_input_command is not None and (
-        top_level is None or is_lean_ctx_wrapper_command(top_level)
+        top_level is None or is_shell_wrapper_command(top_level)
     ):
         return normalize_cursor_shell_command(tool_input_command)
     if top_level is not None:
         return normalize_cursor_shell_command(top_level)
     return None
 
+
 def _cursor_shell_command_fingerprint(command: str) -> str:
     from ..adapters.cursor_native_approval import normalize_cursor_shell_command
 

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/cli/commands_support_permission_store.py

@@ -305,27 +305,27 @@ def _persist_cursor_native_permission_after_shell(
         env=hook_env,
     ):
         return False
-    action_envelope = _hook_action_envelope(
-        harness=harness,
-        payload=prepared,
-        home_dir=home_dir,
-        workspace=workspace,
-    )
-    runtime_artifact = _hook_runtime_artifact(
-        harness=harness,
-        payload=prepared,
-        action_envelope=action_envelope,
-        home_dir=home_dir,
-        guard_home=guard_home,
-        workspace=workspace,
-    )
-    runtime_artifact_hash: str | None = None
-    if runtime_artifact is not None:
+    runtime_artifact = _cursor_runtime_artifact_from_pending(pending)
+    runtime_artifact_hash = _optional_string(pending.get("artifact_hash"))
+    if runtime_artifact is not None and runtime_artifact_hash is None:
         runtime_artifact_hash = artifact_hash(runtime_artifact)
-    else:
-        runtime_artifact = _cursor_runtime_artifact_from_pending(pending)
+    if runtime_artifact is None:
+        action_envelope = _hook_action_envelope(
+            harness=harness,
+            payload=prepared,
+            home_dir=home_dir,
+            workspace=workspace,
+        )
+        runtime_artifact = _hook_runtime_artifact(
+            harness=harness,
+            payload=prepared,
+            action_envelope=action_envelope,
+            home_dir=home_dir,
+            guard_home=guard_home,
+            workspace=workspace,
+        )
         if runtime_artifact is not None:
-            runtime_artifact_hash = _optional_string(pending.get("artifact_hash"))
+            runtime_artifact_hash = artifact_hash(runtime_artifact)
     if runtime_artifact is None or runtime_artifact_hash is None:
         return False
     session_saved = _record_cursor_native_shell_allow_state(

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -864,7 +864,9 @@ def _finalize_daemon_guard_connect_payload(
         }
     )
     oauth_health = store.get_oauth_local_credential_health()
-    if str(oauth_health.get("state") or "") == "degraded":
+    if store.get_cloud_sync_profile() is None and (
+        oauth_health.get("state") == "degraded" or not oauth_health.get("configured")
+    ):
         repair_message = (
             "Guard Cloud authorization did not persist locally. "
             "Start Guard Cloud connect again to repair local sign-in."

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/guard/runtime/secret_file_requests.py

@@ -166,7 +166,6 @@ _SHELL_TOOL_NAMES = frozenset(
         "ash",
         "bash",
         "cmd",
-        "ctx_shell",
         "dash",
         "powershell",
         "pwsh",
@@ -665,6 +664,18 @@ def build_file_read_request_artifact(
     )
 
 
+def _shell_normalized_tool_name(
+    *,
+    normalized_tool_name: str | None,
+    arguments: object,
+) -> str | None:
+    if normalized_tool_name in _SHELL_TOOL_NAMES:
+        return normalized_tool_name
+    if _candidate_command_texts(arguments):
+        return "shell"
+    return normalized_tool_name
+
+
 def extract_sensitive_tool_action_request(
     tool_name: object,
     arguments: object,
@@ -675,20 +686,26 @@ def extract_sensitive_tool_action_request(
     """Extract a sensitive native tool action from arguments."""
 
     normalized_tool_name = _normalize_tool_name(tool_name)
-    if normalized_tool_name is None:
+    if normalized_tool_name is None and not _candidate_command_texts(arguments):
+        return None
+    requested_tool_name = str(tool_name).strip() if isinstance(tool_name, str) and str(tool_name).strip() else "Shell"
+    effective_tool_name = _shell_normalized_tool_name(
+        normalized_tool_name=normalized_tool_name,
+        arguments=arguments,
+    )
+    if effective_tool_name is None:
         return None
-    requested_tool_name = str(tool_name).strip()
     for command_text in _candidate_command_texts(arguments):
         docker_sensitive_request = _docker_sensitive_tool_action_request(
             tool_name=requested_tool_name,
-            normalized_tool_name=normalized_tool_name,
+            normalized_tool_name=effective_tool_name,
             command_text=command_text,
         )
         if docker_sensitive_request is not None:
             return docker_sensitive_request
         docker_config_request = _docker_config_tool_action_request(
             tool_name=requested_tool_name,
-            normalized_tool_name=normalized_tool_name,
+            normalized_tool_name=effective_tool_name,
             command_text=command_text,
             cwd=cwd,
             home_dir=home_dir,
@@ -697,7 +714,7 @@ def extract_sensitive_tool_action_request(
             return docker_config_request
         destructive_shell_request = _destructive_shell_tool_action_request(
             tool_name=requested_tool_name,
-            normalized_tool_name=normalized_tool_name,
+            normalized_tool_name=effective_tool_name,
             command_text=command_text,
             cwd=cwd,
             home_dir=home_dir,

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.708"
+__version__ = "2.0.710"

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/tests/test_cursor_hooks.py

@@ -848,6 +848,107 @@ def test_cursor_shell_command_from_payload_prefers_inner_lean_ctx_command() -> N
     assert command == "rm -rf ./hol-guard-cursor-native-mcp-marker"
 
 
+def test_cursor_shell_command_from_payload_prefers_mcp_tool_input_command() -> None:
+    from codex_plugin_scanner.guard.cli import commands as guard_commands_module
+
+    command = guard_commands_module._cursor_shell_command_from_payload(
+        {
+            "hook_event_name": "beforeMCPExecution",
+            "tool_name": "run_terminal_cmd",
+            "tool_input": {"command": "rm -rf ./hol-guard-cursor-native-mcp-marker"},
+            "command": "/usr/bin/unrelated-mcp-bridge",
+        }
+    )
+    assert command == "rm -rf ./hol-guard-cursor-native-mcp-marker"
+
+
+def test_cursor_shell_command_from_payload_prefers_bash_wrapper_inner_command() -> None:
+    from codex_plugin_scanner.guard.cli import commands as guard_commands_module
+
+    command = guard_commands_module._cursor_shell_command_from_payload(
+        {
+            "hook_event_name": "beforeShellExecution",
+            "command": "bash -c 'rm -rf ./hol-guard-cursor-native-mcp-marker'",
+            "tool_input": {"command": "rm -rf ./hol-guard-cursor-native-mcp-marker"},
+        }
+    )
+    assert command == "rm -rf ./hol-guard-cursor-native-mcp-marker"
+
+
+def test_cursor_native_mcp_session_allow_generic_tool_name(tmp_path: Path) -> None:
+    from codex_plugin_scanner.guard.adapters.cursor_hooks import prepare_cursor_hook_payload
+    from codex_plugin_scanner.guard.cli import commands as guard_commands_module
+    from codex_plugin_scanner.guard.store import GuardStore
+
+    home_dir = tmp_path / "home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    store = GuardStore(home_dir)
+    conversation_id = "conv-cursor-generic-mcp"
+    inner_command = "rm -rf ./hol-guard-cursor-native-mcp-marker"
+    generation_id = "gen-cursor-generic-mcp"
+    before_payload = prepare_cursor_hook_payload(
+        {
+            "conversation_id": conversation_id,
+            "generation_id": generation_id,
+            "hook_event_name": "beforeMCPExecution",
+            "tool_name": "run_terminal_cmd",
+            "tool_input": {"command": inner_command},
+        }
+    )
+    guard_commands_module._record_cursor_pending_shell_permission(
+        store=store,
+        guard_home=home_dir,
+        payload=before_payload,
+        reason="Requests a sensitive native tool action.",
+        artifact=_cursor_shell_artifact(workspace_dir=workspace_dir, command=inner_command),
+        artifact_hash="hash-cursor-generic-mcp-shell",
+    )
+    saved = guard_commands_module._persist_cursor_native_permission_after_shell(
+        store=store,
+        payload=prepare_cursor_hook_payload(
+            {
+                "conversation_id": conversation_id,
+                "generation_id": generation_id,
+                "hook_event_name": "afterMCPExecution",
+                "tool_name": "run_terminal_cmd",
+                "tool_input": {"command": inner_command},
+                "result_json": "{\"ok\": true}",
+                "duration": 12,
+            }
+        ),
+        harness="cursor",
+        home_dir=home_dir,
+        guard_home=home_dir,
+        workspace=workspace_dir,
+        hook_env=_trusted_cursor_after_observer_env(
+            home_dir,
+            conversation_id=conversation_id,
+            command=inner_command,
+            observer_event="afterMCPExecution",
+            approval_binding=generation_id,
+        ),
+    )
+    assert saved is True
+    assert guard_commands_module._cursor_native_shell_is_approved(
+        store,
+        before_payload,
+    )
+
+
+def test_extract_sensitive_tool_action_request_accepts_generic_mcp_tool_command() -> None:
+    from codex_plugin_scanner.guard.runtime.secret_file_requests import (
+        extract_sensitive_tool_action_request,
+    )
+
+    match = extract_sensitive_tool_action_request(
+        "custom_mcp_shell_gateway",
+        {"command": "rm -rf ./hol-guard-cursor-native-mcp-marker"},
+    )
+    assert match is not None
+    assert match.action_class == "destructive shell command"
+
+
 def test_cursor_native_mcp_session_allow_after_trusted_after_mcp(tmp_path: Path) -> None:
     from codex_plugin_scanner.guard.adapters.cursor_hooks import prepare_cursor_hook_payload
     from codex_plugin_scanner.guard.cli import commands as guard_commands_module

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/tests/test_guard_auto_first_sync.py

@@ -157,6 +157,48 @@ def test_finalize_guard_connect_payload_uses_fresh_oauth_access_token_once(tmp_p
     assert CONNECT_SYNC_AUTH_CONTEXT_KEY not in payload
 
 
+def test_finalize_guard_connect_payload_marks_not_configured_oauth_as_retry_required(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    connect_url = "https://hol.org/guard/connect"
+    now = "2026-06-04T12:00:00+00:00"
+
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "stale-sync-token",
+        "2026-06-04T11:59:00+00:00",
+    )
+    monkeypatch.setattr(store, "get_cloud_sync_profile", lambda: None)
+    monkeypatch.setattr(
+        store,
+        "get_oauth_local_credential_health",
+        lambda: {"configured": False, "state": "not_configured"},
+    )
+
+    payload = guard_commands_module._finalize_guard_connect_payload(
+        store=store,
+        connect_url=connect_url,
+        payload={"status": "connected"},
+        now=now,
+    )
+
+    assert payload["status"] == "retry_required"
+    assert payload["milestone"] == "first_sync_failed"
+    assert payload["sync_succeeded"] is False
+    assert payload["sync_error"] == (
+        "Guard Cloud authorization did not persist locally. "
+        "Run hol-guard connect again to repair local sign-in."
+    )
+    assert payload["repair_message"] == payload["sync_error"]
+    latest_state = payload["latest_connect_state"]
+    assert isinstance(latest_state, dict)
+    assert latest_state["status"] == "retry_required"
+    assert latest_state["milestone"] == "first_sync_failed"
+    assert store.get_cloud_sync_profile() is None
+
+
 def test_daemon_finalize_guard_connect_payload_uses_fresh_oauth_access_token_once(
     tmp_path,
     monkeypatch,
@@ -217,6 +259,48 @@ def test_daemon_finalize_guard_connect_payload_uses_fresh_oauth_access_token_onc
     assert CONNECT_SYNC_AUTH_CONTEXT_KEY not in payload
 
 
+def test_daemon_finalize_guard_connect_payload_marks_not_configured_oauth_as_retry_required(
+    tmp_path,
+    monkeypatch,
+) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    connect_url = "https://hol.org/guard/connect"
+    now = "2026-06-04T12:00:00+00:00"
+
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "stale-sync-token",
+        "2026-06-04T11:59:00+00:00",
+    )
+    monkeypatch.setattr(store, "get_cloud_sync_profile", lambda: None)
+    monkeypatch.setattr(
+        store,
+        "get_oauth_local_credential_health",
+        lambda: {"configured": False, "state": "not_configured"},
+    )
+
+    payload = daemon_server_module._finalize_daemon_guard_connect_payload(
+        store=store,
+        connect_url=connect_url,
+        payload={"status": "connected"},
+        now=now,
+    )
+
+    assert payload["status"] == "retry_required"
+    assert payload["milestone"] == "first_sync_failed"
+    assert payload["sync_succeeded"] is False
+    assert payload["sync_error"] == (
+        "Guard Cloud authorization did not persist locally. "
+        "Start Guard Cloud connect again to repair local sign-in."
+    )
+    assert payload["repair_message"] == payload["sync_error"]
+    latest_state = payload["latest_connect_state"]
+    assert isinstance(latest_state, dict)
+    assert latest_state["status"] == "retry_required"
+    assert latest_state["milestone"] == "first_sync_failed"
+    assert store.get_cloud_sync_profile() is None
+
+
 def test_daemon_finalize_guard_connect_payload_keeps_first_sync_pending_on_sync_lock_timeout(
     tmp_path,
     monkeypatch,

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/tests/test_guard_cli.py

@@ -6652,7 +6652,8 @@ url = http://127.0.0.1:8787/guard-canary
         assert run_rc == 0
         assert connect_rc == 0
         assert opened == ["https://hol.org/guard/oauth/device"]
-        assert connect_output["status"] == "connected"
+        assert connect_output["status"] == "retry_required"
+        assert connect_output["milestone"] == "first_sync_failed"
         assert connect_output["connect_mode"] == "device_code"
         assert connect_output["browser_opened"] is True
         assert connect_output["user_code"] == "ABCD-EFGH"
@@ -7091,7 +7092,8 @@ url = http://127.0.0.1:8787/guard-canary
 
         assert login_rc == 0
         assert opened == ["https://hol.org/guard/oauth/device"]
-        assert login_output["status"] == "connected"
+        assert login_output["status"] == "retry_required"
+        assert login_output["milestone"] == "first_sync_failed"
         assert login_output["connect_mode"] == "device_code"
         assert login_output["browser_opened"] is True
         assert login_output["user_code"] == "ZXCV-BNMQ"

{plugin_scanner-2.0.708 → plugin_scanner-2.0.710}/tests/test_guard_init.py

@@ -89,8 +89,9 @@ def test_guard_init_cloud_step_uses_connect_browser_open_and_finalization(tmp_pa
     assert output["cloud"]["browser_opened"] is True
     assert output["cloud"]["wait_timeout_seconds"] == 11
     assert output["cloud"]["announce_copy_present"] is False
-    assert output["cloud"]["milestone"] == "first_sync_pending"
-    assert output["cloud"]["sync_attempted"] is False
+    assert output["cloud"]["status"] == "retry_required"
+    assert output["cloud"]["milestone"] == "first_sync_failed"
+    assert "sync_attempted" not in output["cloud"]
 
 
 def test_guard_init_human_cloud_step_announces_approval_before_waiting(tmp_path, capsys, monkeypatch) -> None: