plugin-scanner 2.0.717__tar.gz → 2.0.719__tar.gz

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.717
+Version: 2.0.719
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/dashboard/src/package-workbench-panel.tsx

@@ -136,9 +136,11 @@ function FindingDetailPanel({ finding }: FindingDetailPanelProps) {
             </span>
           ))}
         </div>
-        <p className="mt-2 text-[11px] text-slate-500">
-          CVE and GHSA aliases are stubbed here until linked advisory intel is available in Guard Cloud.
-        </p>
+        {finding.advisoryAliases.length === 0 ? (
+          <p className="mt-2 text-[11px] text-slate-500">
+            No linked CVE or GHSA aliases for this finding.
+          </p>
+        ) : null}
       </div>
     </div>
   );

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/dashboard/src/scsr-phase10-package-workbench.test.ts

@@ -101,7 +101,7 @@ const camelCaseAliases = normalizeSupplyChainAuditSnapshot({
 const lodashFinding = camelCaseAliases?.findings.find((finding) => finding.packageName === "lodash");
 assert(lodashFinding !== undefined, "SCSR173-B: camelCase advisory ids normalize");
 assert(
-  lodashFinding!.advisoryAliases.includes("GHSA-xx99-yy88-zz77"),
+  lodashFinding!.advisoryAliases.includes("GHSA-XX99-YY88-ZZ77"),
   "SCSR173-B: relatedAdvisoryIds preserved",
 );
 assert(
@@ -109,6 +109,55 @@ assert(
   "SCSR173-B: reason advisoryId preserved",
 );
 
+const cloudAdvisoryIds = normalizeSupplyChainAuditSnapshot({
+  generated_at: "2026-06-09T12:00:00.000Z",
+  source: "cloud",
+  evaluation: {
+    decision: "block",
+    packages: [
+      {
+        name: "minimist",
+        ecosystem: "npm",
+        decision: "block",
+        advisoryIds: ["GHSA-vh95-rmgr-6w4w"],
+        reasons: [{ code: "known_malware", message: "Known malware", severity: "critical" }],
+      },
+    ],
+  },
+});
+const cloudFinding = cloudAdvisoryIds?.findings.find((finding) => finding.packageName === "minimist");
+assert(cloudFinding !== undefined, "SCSR173-C: cloud advisoryIds normalize");
+assert(
+  cloudFinding!.advisoryAliases.includes("GHSA-VH95-RMGR-6W4W"),
+  "SCSR173-C: cloud advisoryIds surface as aliases",
+);
+
+const enrichedAliases = normalizeSupplyChainAuditSnapshot({
+  generated_at: "2026-06-09T12:00:00.000Z",
+  evaluation: {
+    decision: "block",
+    packages: [
+      {
+        name: "lodash",
+        ecosystem: "npm",
+        decision: "block",
+        advisoryAliases: ["GHSA-xx99-yy88-zz77", "CVE-2024-12345"],
+        reasons: [],
+      },
+    ],
+  },
+});
+const enrichedFinding = enrichedAliases?.findings.find((finding) => finding.packageName === "lodash");
+assert(enrichedFinding !== undefined, "SCSR173-D: backend advisoryAliases normalize");
+assert(
+  enrichedFinding!.advisoryAliases.includes("CVE-2024-12345"),
+  "SCSR173-D: backend advisoryAliases preserved",
+);
+assert(
+  !enrichedFinding!.advisoryAliases.some((alias) => alias.includes("pending")),
+  "SCSR173-D: pending alias stubs are not emitted",
+);
+
 const receipt: GuardReceipt = {
   receipt_id: "receipt-audit-1",
   harness: "package-firewall",

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/dashboard/src/supply-chain-audit-normalize.ts

@@ -146,11 +146,15 @@ function addAdvisoryAlias(aliases: Set<string>, rawId: string): void {
   if (trimmed.length === 0) {
     return;
   }
-  if (trimmed.startsWith("GHSA-") || trimmed.startsWith("CVE-")) {
-    aliases.add(trimmed);
-    return;
+  const upper = trimmed.toUpperCase();
+  if (
+    upper.startsWith("GHSA-") ||
+    upper.startsWith("CVE-") ||
+    upper.startsWith("PYSEC-") ||
+    upper.startsWith("GO-")
+  ) {
+    aliases.add(upper);
   }
-  aliases.add(`GHSA-${trimmed.slice(0, 8).toLowerCase()}`);
 }
 
 function readAdvisoryIdList(value: unknown): string[] {
@@ -162,21 +166,46 @@ function readAdvisoryIdList(value: unknown): string[] {
     .map((entry) => entry.trim());
 }
 
-function buildAdvisoryAliasStubs(
+function buildAdvisoryAliases(
   packageRecord: Record<string, unknown>,
   reasons: SupplyChainAuditFindingReason[],
 ): string[] {
+  const precomputed = readAdvisoryIdList(packageRecord.advisoryAliases).concat(
+    readAdvisoryIdList(packageRecord.advisory_aliases),
+  );
+  if (precomputed.length > 0) {
+    const normalized = new Set<string>();
+    for (const id of precomputed) {
+      addAdvisoryAlias(normalized, id);
+    }
+    return Array.from(normalized);
+  }
+
   const aliases = new Set<string>();
   const packageAdvisoryId = readString(packageRecord.advisoryId) ?? readString(packageRecord.advisory_id);
   if (packageAdvisoryId !== null) {
     addAdvisoryAlias(aliases, packageAdvisoryId);
   }
   for (const entry of [
+    ...readAdvisoryIdList(packageRecord.advisoryIds),
+    ...readAdvisoryIdList(packageRecord.advisory_ids),
     ...readAdvisoryIdList(packageRecord.related_advisory_ids),
     ...readAdvisoryIdList(packageRecord.relatedAdvisoryIds),
   ]) {
     addAdvisoryAlias(aliases, entry);
   }
+  const rawReasons = packageRecord.reasons;
+  if (Array.isArray(rawReasons)) {
+    for (const entry of rawReasons) {
+      if (!isRecord(entry)) {
+        continue;
+      }
+      const advisoryId = readString(entry.advisoryId) ?? readString(entry.advisory_id);
+      if (advisoryId !== null) {
+        addAdvisoryAlias(aliases, advisoryId);
+      }
+    }
+  }
   for (const reason of reasons) {
     const match = reason.message.match(/\b(CVE-\d{4}-\d+)\b/i);
     if (match !== null) {
@@ -187,13 +216,6 @@ function buildAdvisoryAliasStubs(
       aliases.add(ghsaMatch[1].toUpperCase());
     }
   }
-  if (aliases.size === 0) {
-    const severity = resolveFindingSeverity(packageRecord, reasons);
-    if (SEVERITY_RANK[severity] >= SEVERITY_RANK.medium) {
-      aliases.add("GHSA-alias-pending");
-      aliases.add("CVE-alias-pending");
-    }
-  }
   return Array.from(aliases);
 }
 
@@ -219,7 +241,7 @@ function normalizePackageFinding(
     decision,
     severity,
     reasons,
-    advisoryAliases: buildAdvisoryAliasStubs(packageRecord, reasons),
+    advisoryAliases: buildAdvisoryAliases(packageRecord, reasons),
     status: readString(packageRecord.status),
   };
 }

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.717"
+version = "2.0.719"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.717"
+version = "2.0.719"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/guard/adapters/opencode_pretool.py

@@ -15,6 +15,8 @@ _HOOK_ARGV_ENV = "HOL_GUARD_HOOK_ARGV"
 _INHERIT_ENV_KEYS = ("PATH", "HOME", "USER", "TMPDIR", "TEMP", "TMP", "LANG", "LC_ALL", "SYSTEMROOT")
 
 _PLUGIN_TEMPLATE = """// Managed by HOL Guard. Re-run `hol-guard install opencode` after moving Guard home.
+import { spawn as nodeSpawn } from "node:child_process";
+
 const GUARD_HOME = __GUARD_HOME__;
 const GUARD_PYTHON = __GUARD_PYTHON__;
 const GUARD_HOOK_LAUNCHER = __GUARD_HOOK_LAUNCHER__;
@@ -50,28 +52,8 @@ async function spawnGuardProcess(options: {
   env: Record<string, string>;
   stdin: string;
 }): Promise<{ exitCode: number; stdout: string; stderr: string }> {
-  const bun = (globalThis as { Bun?: { spawn?: Function } }).Bun;
-  if (typeof bun?.spawn === "function") {
-    const proc = bun.spawn(options.command, {
-      cwd: options.cwd,
-      env: options.env,
-      stdin: new Blob([options.stdin]),
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    const stdoutPromise = new Response(proc.stdout).text();
-    const stderrPromise = new Response(proc.stderr).text();
-    const exitCode = await proc.exited;
-    return {
-      exitCode,
-      stdout: await stdoutPromise,
-      stderr: await stderrPromise,
-    };
-  }
-
-  const { spawn } = await import("node:child_process");
   return new Promise((resolve, reject) => {
-    const proc = spawn(options.command[0], options.command.slice(1), {
+    const proc = nodeSpawn(options.command[0], options.command.slice(1), {
       cwd: options.cwd,
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/guard/cli/update_commands.py

@@ -22,6 +22,12 @@ from packaging.version import InvalidVersion, Version
 
 from ..adapters.base import HarnessContext
 from ..adapters.codex import CodexHarnessAdapter, codex_native_hook_state
+from ..adapters.opencode_pretool import (
+    global_plugin_path,
+    install_pretool_plugin,
+    managed_plugin_path,
+    pretool_plugin_source,
+)
 from ..redaction import redact_sensitive_text
 from ..store import GuardStore
 from .dashboard_sync import sync_dashboard_assets as _sync_dashboard_assets
@@ -597,9 +603,59 @@ def _repair_supported_harnesses(
     )
     repaired_installs = [repaired_codex] if repaired_codex is not None else []
     repair_notes = [codex_warning] if codex_warning is not None else []
+    opencode_note = _refresh_opencode_pretool_plugin(context=context, store=store)
+    if opencode_note is not None:
+        repair_notes.append(opencode_note)
     return repaired_installs, repair_notes
 
 
+def _refresh_opencode_pretool_plugin(
+    *,
+    context: HarnessContext,
+    store: GuardStore,
+) -> str | None:
+    try:
+        managed_install = store.get_managed_install("opencode")
+    except (json.JSONDecodeError, sqlite3.Error):
+        return None
+    if managed_install is None or not bool(managed_install.get("active")):
+        return None
+    repair_context, _ = _repair_context_from_managed_install(context, managed_install)
+    global_path = global_plugin_path(repair_context)
+    managed_path = managed_plugin_path(repair_context)
+    expected_source = pretool_plugin_source(repair_context)
+    try:
+        global_source = global_path.read_text(encoding="utf-8") if global_path.is_file() else ""
+        managed_source = managed_path.read_text(encoding="utf-8") if managed_path.is_file() else ""
+    except OSError as error:
+        return f"Could not inspect OpenCode pretool plugin during update: {error}"
+    if global_source == expected_source and managed_source == expected_source:
+        return None
+    try:
+        install_pretool_plugin(repair_context)
+    except OSError as error:
+        return f"Could not refresh OpenCode pretool plugin during update: {error}"
+    return "Refreshed the OpenCode pretool plugin during update. Restart OpenCode to load it."
+
+
+def _repair_context_from_managed_install(
+    context: HarnessContext,
+    managed_install: dict[str, object],
+) -> tuple[HarnessContext, str | None]:
+    managed_workspace = managed_install.get("workspace")
+    if isinstance(managed_workspace, str) and managed_workspace.strip():
+        workspace_path = Path(managed_workspace).expanduser().resolve()
+        return (
+            HarnessContext(
+                home_dir=context.home_dir,
+                workspace_dir=workspace_path,
+                guard_home=context.guard_home,
+            ),
+            str(workspace_path),
+        )
+    return HarnessContext(context.home_dir, None, context.guard_home), None
+
+
 def _repair_codex_install(
     *,
     context: HarnessContext,
@@ -639,18 +695,7 @@ def _codex_repair_target(context: HarnessContext, store: GuardStore) -> tuple[Ha
     except (json.JSONDecodeError, sqlite3.Error):
         return _codex_backup_repair_target(context)
     if managed_install is not None and bool(managed_install.get("active")):
-        managed_workspace = managed_install.get("workspace")
-        if isinstance(managed_workspace, str) and managed_workspace.strip():
-            workspace_path = Path(managed_workspace).expanduser().resolve()
-            return (
-                HarnessContext(
-                    home_dir=context.home_dir,
-                    workspace_dir=workspace_path,
-                    guard_home=context.guard_home,
-                ),
-                str(workspace_path),
-            )
-        return HarnessContext(context.home_dir, None, context.guard_home), None
+        return _repair_context_from_managed_install(context, managed_install)
     return _codex_backup_repair_target(context)
 
 

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -2313,6 +2313,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
             result=result,
             managers=managers,
             workspace_dir=context.workspace_dir,
+            store=self.server.store,  # type: ignore[attr-defined]
         )
         receipt = self._record_headless_receipt(
             harness="package-firewall",

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/guard/local_supply_chain.py

@@ -493,10 +493,134 @@ def _audit_lockfile_warnings(
     return tuple(warnings)
 
 
+def _package_advisory_ids(package: dict[str, object]) -> list[str]:
+    advisory_ids: list[str] = []
+    seen: set[str] = set()
+
+    def add_id(value: object) -> None:
+        if not isinstance(value, str):
+            return
+        trimmed = value.strip()
+        if not trimmed or trimmed in seen:
+            return
+        seen.add(trimmed)
+        advisory_ids.append(trimmed)
+
+    for key in ("advisoryIds", "advisory_ids", "relatedAdvisoryIds", "related_advisory_ids"):
+        raw = package.get(key)
+        if isinstance(raw, list):
+            for entry in raw:
+                add_id(entry)
+    add_id(package.get("advisoryId"))
+    add_id(package.get("advisory_id"))
+    reasons = package.get("reasons")
+    if isinstance(reasons, list):
+        for reason in reasons:
+            if not isinstance(reason, dict):
+                continue
+            add_id(reason.get("advisoryId"))
+            add_id(reason.get("advisory_id"))
+    return advisory_ids
+
+
+def _cached_supply_chain_bundle_payload(store: GuardStore) -> dict[str, object] | None:
+    workspace_id = store.get_cloud_workspace_id()
+    if workspace_id is None:
+        return None
+    cached_bundle = store.get_cached_supply_chain_bundle(workspace_id)
+    if not isinstance(cached_bundle, dict):
+        return None
+    bundle_payload = cached_bundle.get("bundle")
+    if isinstance(bundle_payload, dict):
+        return bundle_payload
+    return None
+
+
+def _resolve_advisory_aliases_from_bundle(
+    bundle: dict[str, object] | None,
+    advisory_ids: list[str],
+) -> list[str]:
+    aliases: list[str] = []
+    seen: set[str] = set()
+    lookup: dict[str, tuple[str, ...]] = {}
+    if isinstance(bundle, dict):
+        advisories = bundle.get("advisories")
+        if isinstance(advisories, list):
+            for advisory in advisories:
+                if not isinstance(advisory, dict):
+                    continue
+                advisory_id = advisory.get("advisoryId")
+                if not isinstance(advisory_id, str) or not advisory_id.strip():
+                    continue
+                raw_aliases = advisory.get("aliases")
+                alias_tuple: tuple[str, ...] = (advisory_id,)
+                if isinstance(raw_aliases, list):
+                    alias_tuple = (
+                        advisory_id,
+                        *[alias for alias in raw_aliases if isinstance(alias, str) and alias.strip()],
+                    )
+                upper_tuple = tuple(alias.upper() for alias in alias_tuple)
+                lookup[advisory_id.upper()] = upper_tuple
+                for alias in alias_tuple:
+                    lookup.setdefault(alias.upper(), upper_tuple)
+
+    def add_alias(value: str) -> None:
+        trimmed = value.strip().upper()
+        if not trimmed or trimmed in seen:
+            return
+        seen.add(trimmed)
+        aliases.append(trimmed)
+
+    for advisory_id in advisory_ids:
+        add_alias(advisory_id)
+        resolved = lookup.get(advisory_id.upper())
+        if resolved is None:
+            continue
+        for alias in resolved:
+            add_alias(alias)
+    return aliases
+
+
+def _enrich_package_with_advisory_aliases(
+    package: dict[str, object],
+    *,
+    bundle: dict[str, object] | None,
+) -> dict[str, object]:
+    existing_aliases = package.get("advisoryAliases")
+    if isinstance(existing_aliases, list) and existing_aliases:
+        return package
+    advisory_ids = _package_advisory_ids(package)
+    if not advisory_ids:
+        return package
+    aliases = _resolve_advisory_aliases_from_bundle(bundle, advisory_ids)
+    if not aliases:
+        return package
+    enriched = dict(package)
+    enriched["advisoryAliases"] = aliases
+    return enriched
+
+
+def _enrich_evaluation_packages_with_advisory_aliases(
+    evaluation: dict[str, object],
+    store: GuardStore,
+) -> dict[str, object]:
+    packages = evaluation.get("packages")
+    if not isinstance(packages, list):
+        return evaluation
+    bundle = _cached_supply_chain_bundle_payload(store)
+    enriched_packages: list[dict[str, object]] = []
+    for package in packages:
+        if not isinstance(package, dict):
+            continue
+        enriched_packages.append(_enrich_package_with_advisory_aliases(package, bundle=bundle))
+    return {**evaluation, "packages": enriched_packages}
+
+
 def _audit_package_findings_for_receipt(
     package_items: list[dict[str, object]],
     *,
     limit: int = 100,
+    bundle: dict[str, object] | None = None,
 ) -> list[dict[str, object]]:
     decision_rank_map = {"block": 4, "ask": 3, "warn": 2, "monitor": 1, "allow": 0}
     ranked: list[tuple[int, int, dict[str, object]]] = []
@@ -508,7 +632,7 @@ def _audit_package_findings_for_receipt(
         decision_rank = decision_rank_map.get(decision, 0)
         ranked.append((decision_rank, severity_rank, item))
     ranked.sort(key=lambda entry: (entry[0], entry[1]), reverse=True)
-    return [item for _, _, item in ranked[:limit]]
+    return [_enrich_package_with_advisory_aliases(item, bundle=bundle) for _, _, item in ranked[:limit]]
 
 
 def workspace_audit_path_hashes(
@@ -591,6 +715,7 @@ def audit_receipt_metadata(
     result: dict[str, object],
     *,
     workspace_dir: Path | None = None,
+    store: GuardStore | None = None,
 ) -> dict[str, object]:
     evaluation = result.get("evaluation")
     if not isinstance(evaluation, dict):
@@ -599,7 +724,8 @@ def audit_receipt_metadata(
     packages = evaluation.get("packages")
     package_items = [item for item in packages if isinstance(item, dict)] if isinstance(packages, list) else []
     blocked_packages = [item for item in package_items if str(item.get("decision") or "") == "block"]
-    package_findings = _audit_package_findings_for_receipt(package_items)
+    bundle = _cached_supply_chain_bundle_payload(store) if store is not None else None
+    package_findings = _audit_package_findings_for_receipt(package_items, bundle=bundle)
     policy_decision = "allow"
     if decision == "block":
         policy_decision = "block"
@@ -753,6 +879,7 @@ def build_workspace_audit_payload(
             command_name=command_name,
             now=now,
         )
+    evaluation = _enrich_evaluation_packages_with_advisory_aliases(evaluation, store)
     payload = {
         "generated_at": now,
         "mode": command_name,

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/guard/package_firewall_receipts.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 from pathlib import Path
 
 from .local_supply_chain import audit_receipt_metadata
+from .store import GuardStore
 
 
 def _read_string_list(value: object) -> list[str]:
@@ -78,12 +79,13 @@ def package_firewall_receipt_metadata(
     result: dict[str, object],
     managers: tuple[str, ...] | None = None,
     workspace_dir: Path | None = None,
+    store: GuardStore | None = None,
 ) -> dict[str, object]:
     """Build receipt override fields for package-firewall headless operations."""
 
     manager_subset = _resolve_manager_subset(managers, result, operation)
     if operation == "audit":
-        metadata = audit_receipt_metadata(result, workspace_dir=workspace_dir)
+        metadata = audit_receipt_metadata(result, workspace_dir=workspace_dir, store=store)
         scanner_evidence = metadata.get("scanner_evidence")
         if isinstance(scanner_evidence, dict):
             enriched = dict(scanner_evidence)

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/guard/runtime/supply_chain_package_eval.py

@@ -1122,6 +1122,34 @@ def _primary_bundle_advisory_id(
     return package.related_advisory_ids[0]
 
 
+def _bundle_advisory_aliases(
+    bundle_response: SupplyChainBundleResponse,
+    package: SupplyChainBundlePackage,
+) -> list[str]:
+    advisory_ids = list(package.related_advisory_ids)
+    primary_id = _primary_bundle_advisory_id(bundle_response, package)
+    if primary_id is not None and primary_id not in advisory_ids:
+        advisory_ids.append(primary_id)
+    if not advisory_ids:
+        return []
+    advisory_lookup: dict[str, tuple[str, ...]] = {}
+    for advisory in bundle_response.bundle.advisories:
+        alias_tuple = (advisory.advisory_id, *advisory.aliases)
+        upper_tuple = tuple(alias.upper() for alias in alias_tuple)
+        advisory_lookup[advisory.advisory_id.upper()] = upper_tuple
+        for alias in alias_tuple:
+            advisory_lookup.setdefault(alias.upper(), upper_tuple)
+    aliases: list[str] = []
+    seen: set[str] = set()
+    for advisory_id in advisory_ids:
+        for alias in advisory_lookup.get(advisory_id.upper(), (advisory_id.upper(),)):
+            if alias in seen:
+                continue
+            seen.add(alias)
+            aliases.append(alias)
+    return aliases
+
+
 def _heuristic_result(
     *,
     artifact: GuardArtifact,
@@ -1652,7 +1680,8 @@ def _bundle_package_result(
     resolved_version: str,
 ) -> dict[str, object]:
     severity = package.normalized_severity if stale is False else "unknown"
-    return {
+    advisory_aliases = _bundle_advisory_aliases(bundle_response, package)
+    result: dict[str, object] = {
         "decision": decision,
         "ecosystem": package.ecosystem,
         "name": package.name,
@@ -1666,6 +1695,7 @@ def _bundle_package_result(
         "packageManager": _optional_string(target.get("package_manager")) or "npm",
         "redactedCommand": _optional_string(target.get("redacted_command")),
         "alias": _optional_string(target.get("alias")),
+        "relatedAdvisoryIds": list(package.related_advisory_ids),
         "reasons": (
             {
                 "advisoryId": _primary_bundle_advisory_id(bundle_response, package),
@@ -1676,6 +1706,9 @@ def _bundle_package_result(
             },
         ),
     }
+    if advisory_aliases:
+        result["advisoryAliases"] = advisory_aliases
+    return result
 
 
 def _system_package_monitor_result(target: dict[str, object]) -> dict[str, object]:

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.717"
+__version__ = "2.0.719"

{plugin_scanner-2.0.717 → plugin_scanner-2.0.719}/tests/test_guard_local_supply_chain_audit_phase16.py

@@ -669,3 +669,56 @@ def test_guard_supply_chain_scan_falls_back_when_oauth_refresh_fails(
         "code": "cloud_auth_error",
         "message": "Guard cloud authorization could not be refreshed, so Guard fell back locally.",
     }
+
+
+def test_audit_receipt_metadata_enriches_cloud_advisory_aliases_from_bundle(
+    tmp_path: Path,
+) -> None:
+    from tests.test_guard_local_supply_chain_phase15 import _bundle_response, _package
+
+    home_dir = tmp_path / "guard-home"
+    store = GuardStore(home_dir)
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "demo-token",
+        "2026-05-25T10:00:00+00:00",
+        workspace_id=WORKSPACE_ID,
+    )
+    store.cache_supply_chain_bundle(
+        WORKSPACE_ID,
+        _bundle_response(
+            packages=[
+                _package(
+                    name="minimist",
+                    version="1.2.5",
+                    default_action="block",
+                )
+            ]
+        ),
+        "2026-05-25T10:00:00+00:00",
+    )
+
+    payload = {
+        "evaluation": {
+            "decision": "block",
+            "packages": [
+                {
+                    "name": "minimist",
+                    "ecosystem": "npm",
+                    "decision": "block",
+                    "reasons": [{"code": "known_malware", "message": "known malware", "severity": "critical"}],
+                    "advisoryIds": ["GHSA-vh95-rmgr-6w4m"],
+                }
+            ],
+        },
+        "inventory": {"total_packages": 1},
+        "manifest_paths": ["package.json"],
+        "lockfile_paths": ["package-lock.json"],
+    }
+    metadata = local_supply_chain_module.audit_receipt_metadata(payload, store=store)
+    findings = metadata["scanner_evidence"]["package_findings"]
+    assert findings
+    aliases = findings[0].get("advisoryAliases")
+    assert isinstance(aliases, list)
+    assert "GHSA-VH95-RMGR-6W4M" in aliases
+    assert "CVE-2020-7598" in aliases