plugin-scanner 2.0.772__tar.gz → 2.0.774__tar.gz

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.772
+Version: 2.0.774
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.772"
+version = "2.0.774"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.772"
+version = "2.0.774"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/cli/commands_support_service.py

@@ -69,13 +69,13 @@ def _guard_service_sync_failure_message(error: GuardSyncNotConfiguredError) -> s
     return _guard_service_sync_prerequisite_message()
 
 def _guard_service_status_payload(store: GuardStore) -> dict[str, object]:
-    credentials = store.get_sync_credentials()
+    cloud_profile = store.get_cloud_sync_profile()
     service_profile = _guard_service_runtime_profile(store)
     return {
-        "configured": credentials is not None and service_profile is not None,
+        "configured": cloud_profile is not None and service_profile is not None,
         "connection": {
-            "configured": credentials is not None,
-            "sync_url": credentials["sync_url"] if credentials is not None else None,
+            "configured": cloud_profile is not None,
+            "sync_url": cloud_profile["sync_url"] if cloud_profile is not None else None,
         },
         "service": service_profile,
         "runtime": store.get_sync_payload("runtime_session_summary") or {},

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -1241,8 +1241,6 @@ def connect_state_requires_oauth(
     if isinstance(request_id, str) and bool(request_id.strip()):
         return True
     auth_mode = cloud_profile.get("auth_mode") if isinstance(cloud_profile, dict) else None
-    if auth_mode == "legacy":
-        return False
     return auth_mode == "oauth"
 
 

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/cli/product.py

@@ -100,7 +100,6 @@ def _build_guard_product_payload(
         "guard_home": _redacted_path(context.guard_home, context.home_dir),
         "workspace": _redacted_path(context.workspace_dir, context.home_dir),
         "sync_configured": store.get_cloud_sync_profile() is not None,
-        "sync_storage_health": store.get_sync_credential_health(),
         "oauth_storage_health": store.get_oauth_local_credential_health(),
         "receipt_count": receipt_count,
         "pending_approvals": store.count_approval_requests(),

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/daemon/manager.py

@@ -94,13 +94,17 @@ def ensure_guard_daemon(
         if existing_url is not None:
             existing_port = _guard_daemon_url_port(existing_url)
             if preferred_port is None or existing_port == preferred_port:
-                _retire_duplicate_guard_daemons(guard_home, keep_port=existing_port)
+                _retire_duplicate_guard_daemons(guard_home, keep_port=existing_port, start_lock_held=True)
                 return existing_url
             retire_all_guard_daemons_for_home(guard_home)
             clear_guard_daemon_state(guard_home)
         adopted_url = _adopt_existing_guard_daemon(guard_home, preferred_port=preferred_port)
         if adopted_url is not None:
-            _retire_duplicate_guard_daemons(guard_home, keep_port=_guard_daemon_url_port(adopted_url))
+            _retire_duplicate_guard_daemons(
+                guard_home,
+                keep_port=_guard_daemon_url_port(adopted_url),
+                start_lock_held=True,
+            )
             return adopted_url
         stale_state = _load_state(guard_home)
         if isinstance(stale_state, dict) and not _guard_daemon_state_matches_current_runtime(stale_state):
@@ -108,7 +112,11 @@ def ensure_guard_daemon(
         if _guard_daemon_start_in_progress(guard_home):
             inflight_url = _wait_for_guard_daemon_url(guard_home, timeout=timeout)
             if inflight_url is not None:
-                _retire_duplicate_guard_daemons(guard_home, keep_port=_guard_daemon_url_port(inflight_url))
+                _retire_duplicate_guard_daemons(
+                    guard_home,
+                    keep_port=_guard_daemon_url_port(inflight_url),
+                    start_lock_held=True,
+                )
                 return inflight_url
         clear_guard_daemon_state(guard_home)
         for candidate_port in _candidate_ports(guard_home, preferred_port=preferred_port):
@@ -148,7 +156,11 @@ def ensure_guard_daemon(
                 process=process,
             )
             if url is not None:
-                _retire_duplicate_guard_daemons(guard_home, keep_port=_guard_daemon_url_port(url))
+                _retire_duplicate_guard_daemons(
+                    guard_home,
+                    keep_port=_guard_daemon_url_port(url),
+                    start_lock_held=True,
+                )
                 return url
     raise RuntimeError(f"Guard approval center did not start. Expected state file at {state_path}.")
 
@@ -333,13 +345,50 @@ def _initialize_existing_guard_daemon(guard_home: Path, port: int) -> _ExistingG
     return {"url": url, "auth_token": auth_token, "pid": pid}
 
 
-def _retire_duplicate_guard_daemons(guard_home: Path, *, keep_port: int | None) -> None:
+def _retire_duplicate_guard_daemons(
+    guard_home: Path,
+    *,
+    keep_port: int | None,
+    start_lock_held: bool = False,
+) -> None:
     if keep_port is None:
         return
+    if start_lock_held:
+        _retire_duplicate_guard_daemons_unlocked(guard_home, keep_port=keep_port)
+        return
+    with _guard_daemon_start_lock(guard_home):
+        _retire_duplicate_guard_daemons_unlocked(guard_home, keep_port=keep_port)
+
+
+def _retire_duplicate_guard_daemons_unlocked(guard_home: Path, *, keep_port: int) -> None:
+    saw_duplicate = False
     for pid, port in _running_guard_daemon_processes_for_guard_home(guard_home):
         if port == keep_port:
             continue
-        _retire_guard_daemon_pid(pid, expected_guard_home=guard_home)
+        saw_duplicate = True
+        if not _retire_guard_daemon_pid(pid, expected_guard_home=guard_home):
+            return
+    if not saw_duplicate:
+        return
+    if any(port != keep_port for _pid, port in _running_guard_daemon_processes_for_guard_home(guard_home)):
+        return
+    _rewrite_kept_daemon_state_if_missing(guard_home, keep_port=keep_port)
+
+
+def _rewrite_kept_daemon_state_if_missing(guard_home: Path, *, keep_port: int) -> None:
+    kept_pid = _guard_daemon_pid_for_guard_home_port(guard_home, keep_port)
+    if kept_pid is None or _daemon_state_points_to(guard_home, pid=kept_pid, port=keep_port):
+        return
+    auth_token = load_guard_daemon_auth_token(guard_home)
+    if auth_token is None:
+        return
+    daemon_url = f"http://127.0.0.1:{keep_port}"
+    details = _daemon_healthz_details_payload(daemon_url, auth_token)
+    if details is None or not _healthz_payload_matches_guard_home(json.dumps(details), guard_home):
+        return
+    if details.get("pid") != kept_pid:
+        return
+    write_guard_daemon_state(guard_home, keep_port, auth_token, pid=kept_pid, write_auth_token=False)
 
 
 def _guard_daemon_pid_for_guard_home_port(guard_home: Path, port: int) -> int | None:
@@ -349,7 +398,14 @@ def _guard_daemon_pid_for_guard_home_port(guard_home: Path, port: int) -> int |
     return None
 
 
-def write_guard_daemon_state(guard_home: Path, port: int, auth_token: str, *, pid: int | None = None) -> None:
+def write_guard_daemon_state(
+    guard_home: Path,
+    port: int,
+    auth_token: str,
+    *,
+    pid: int | None = None,
+    write_auth_token: bool = True,
+) -> None:
     state_path = _state_path(guard_home)
     _ensure_private_directory(state_path.parent)
     _write_private_text(
@@ -368,7 +424,8 @@ def write_guard_daemon_state(guard_home: Path, port: int, auth_token: str, *, pi
             indent=2,
         ),
     )
-    _write_private_text(_auth_token_path(guard_home), auth_token)
+    if write_auth_token:
+        _write_private_text(_auth_token_path(guard_home), auth_token)
 
 
 def clear_guard_daemon_state(guard_home: Path) -> None:
@@ -377,6 +434,26 @@ def clear_guard_daemon_state(guard_home: Path) -> None:
     _write_private_text(state_path, "{}")
 
 
+def clear_guard_daemon_state_if_current(guard_home: Path, *, pid: int, port: int) -> bool:
+    with _guard_daemon_start_lock(guard_home):
+        return _clear_guard_daemon_state_if_current_unlocked(guard_home, pid=pid, port=port)
+
+
+def _clear_guard_daemon_state_if_current_unlocked(guard_home: Path, *, pid: int, port: int) -> bool:
+    payload = _load_state(guard_home)
+    if not isinstance(payload, dict):
+        return False
+    if payload.get("pid") != pid or payload.get("port") != port:
+        return False
+    clear_guard_daemon_state(guard_home)
+    return True
+
+
+def _daemon_state_points_to(guard_home: Path, *, pid: int, port: int) -> bool:
+    payload = _load_state(guard_home)
+    return isinstance(payload, dict) and payload.get("pid") == pid and payload.get("port") == port
+
+
 def repair_approval_center_locator(guard_home: Path) -> dict[str, object]:
     """Remove a stale approval center locator and optionally clear dead daemon state.
 

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -155,7 +155,7 @@ from .command_queue_worker import CommandQueueWorker, start_command_queue_worker
 from .dashboard_update import merge_dashboard_update_progress, schedule_guard_dashboard_update
 from .manager import (
     GUARD_DAEMON_COMPATIBILITY_VERSION,
-    clear_guard_daemon_state,
+    clear_guard_daemon_state_if_current,
     load_guard_daemon_auth_token,
     repair_approval_center_locator,
     write_guard_daemon_state,
@@ -4969,11 +4969,11 @@ class GuardDaemonServer:
 
     def _finish_service(self) -> None:
         if self._shutdown_started.is_set():
-            clear_guard_daemon_state(self._server.store.guard_home)
+            clear_guard_daemon_state_if_current(self._server.store.guard_home, pid=os.getpid(), port=self.port)
             self._server.store.clear_runtime_state(session_id=self._server.runtime_session_id)
             return
         self._shutdown_started.set()
-        clear_guard_daemon_state(self._server.store.guard_home)
+        clear_guard_daemon_state_if_current(self._server.store.guard_home, pid=os.getpid(), port=self.port)
         self._server.store.clear_runtime_state(session_id=self._server.runtime_session_id)
 
     def _start_watchdog(self) -> None:

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -2695,11 +2695,20 @@ def _resolve_guard_sync_auth_context_from_oauth_credentials(
     }
 
 
+# Test-only override: when set, _resolve_guard_sync_auth_context returns this dict
+# directly instead of resolving OAuth credentials (which would refresh tokens over
+# the network). Tests seed OAuth credentials for status/connect-state checks and set
+# this override to keep sync-path exercises hermetic.
+_test_sync_auth_context_override: dict[str, object] | None = None
+
+
 def _resolve_guard_sync_auth_context(
     store: GuardStore,
     *,
     allow_primary_repair: bool = True,
 ) -> dict[str, object]:
+    if _test_sync_auth_context_override is not None:
+        return dict(_test_sync_auth_context_override)
     with _guard_sync_auth_lock(store):
         oauth_health = store.get_oauth_local_credential_health()
         oauth_credentials = store.get_oauth_local_credentials(allow_primary=allow_primary_repair)
@@ -2714,14 +2723,7 @@ def _resolve_guard_sync_auth_context(
                     persist_recovered_secret=allow_primary_repair,
                 )
             raise GuardSyncAuthorizationExpiredError(_guard_oauth_reauthorization_message())
-        credentials = store.get_sync_credentials()
-        if credentials is None:
-            raise GuardSyncNotConfiguredError("Guard is not logged in.")
-        return {
-            "sync_url": _validate_guard_sync_url(str(credentials["sync_url"])),
-            "access_token": str(credentials["token"]),
-            "dpop_key_material": None,
-        }
+        raise GuardSyncNotConfiguredError("Guard is not logged in.")
 
 
 def _guard_sync_headers(

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/guard/store.py

@@ -24,7 +24,7 @@ from uuid import uuid4
 from cryptography.fernet import Fernet, InvalidToken
 
 from .approval_gate import ApprovalGateGrant, require_policy_clear, require_policy_write, require_request_resolution
-from .cli.oauth_client import resolve_guard_oauth_client_config, validate_guard_sync_endpoint
+from .cli.oauth_client import resolve_guard_oauth_client_config
 from .edge_events import build_receipt_event
 from .models import GuardApprovalRequest, GuardArtifact, GuardReceipt, GuardRuntimeState, PolicyDecision
 from .policy_integrity import (
@@ -160,17 +160,14 @@ from .store_threat_intel import (
 )
 from .types import CapabilitySet, TransportKind
 
-_SYNC_TOKEN_REF = "guard-cloud-token"
 _POLICY_INTEGRITY_KEY_REF = "guard-policy-integrity-key"
 _POLICY_INTEGRITY_CONTROL_REF = "guard-policy-integrity-control"
 _OAUTH_LOCAL_CREDENTIALS_REF = "guard-oauth-local-credentials"
-_SYNC_TOKEN_HASH_KEY = "token_sha256"
 _OAUTH_LOCAL_CREDENTIALS_STATE_KEY = "oauth_local_credentials"
 _OAUTH_LOCAL_CREDENTIALS_HASH_KEY = "credentials_sha256"
 _OAUTH_LOCAL_CREDENTIALS_REF_KEY = "credentials_ref"
 _OAUTH_PRIMARY_SECRET_TIMEOUT_SECONDS = 2.0
 _GUARD_CLOUD_RESET_STATE_KEYS = (
-    "credentials",
     "sync_summary",
     "receipt_sync_cursor",
     "policy",
@@ -322,61 +319,6 @@ class SecretStore(Protocol):
         """Delete a secret value if it exists."""
 
 
-class KeychainSecretStore:
-    """macOS keychain-backed secret store."""
-
-    def __init__(self, service_name: str) -> None:
-        self.service_name = service_name
-
-    @staticmethod
-    def _is_available() -> bool:
-        return os.name == "posix" and Path("/usr/bin/security").exists()
-
-    def set_secret(self, secret_id: str, value: str) -> None:
-        if not self._is_available():
-            raise RuntimeError("macOS keychain command is not available")
-        raise RuntimeError("macOS security CLI does not support noninteractive secret writes without argv exposure")
-
-    def get_secret(self, secret_id: str) -> str | None:
-        if not self._is_available():
-            return None
-        result = subprocess.run(
-            [
-                "/usr/bin/security",
-                "find-generic-password",
-                "-a",
-                secret_id,
-                "-s",
-                self.service_name,
-                "-w",
-            ],
-            check=False,
-            capture_output=True,
-            text=True,
-        )
-        if result.returncode != 0:
-            return None
-        value = result.stdout.rstrip("\r\n")
-        return value if value else None
-
-    def delete_secret(self, secret_id: str) -> None:
-        if not self._is_available():
-            return
-        subprocess.run(
-            [
-                "/usr/bin/security",
-                "delete-generic-password",
-                "-a",
-                secret_id,
-                "-s",
-                self.service_name,
-            ],
-            check=False,
-            capture_output=True,
-            text=True,
-        )
-
-
 class SystemKeyringSecretStore:
     """Cross-platform OS credential store backed by the Python keyring library."""
 
@@ -900,16 +842,6 @@ def _system_keyring_is_available(guard_home: Path) -> bool:
     return available
 
 
-def _build_secret_store(guard_home: Path) -> SecretStore:
-    fallback_store = EncryptedFileSecretStore(guard_home)
-    if KeychainSecretStore._is_available():
-        keychain_store = KeychainSecretStore(service_name="hol-guard.sync")
-        if sys.platform == "darwin":
-            return FallbackSecretStore(keychain_store, fallback_store)
-        return FallbackSecretStore(fallback_store, keychain_store)
-    return fallback_store
-
-
 def _build_oauth_secret_store(guard_home: Path) -> SecretStore:
     fallback_store = EncryptedFileSecretStore(guard_home)
     if _system_keyring_is_available(guard_home):
@@ -932,8 +864,6 @@ def _build_policy_integrity_secret_store() -> SystemKeyringSecretStore | None:
 def _secret_store_backend_name(secret_store: SecretStore) -> str:
     if isinstance(secret_store, SystemKeyringSecretStore):
         return "system-keyring"
-    if isinstance(secret_store, KeychainSecretStore):
-        return "keychain"
     if isinstance(secret_store, EncryptedFileSecretStore):
         return "encrypted-file"
     if isinstance(secret_store, FallbackSecretStore):
@@ -979,13 +909,11 @@ class GuardStore:
         self.guard_home = guard_home
         self.guard_home.mkdir(parents=True, exist_ok=True)
         _set_private_mode(self.guard_home, _GUARD_STORE_PRIVATE_DIR_MODE)
-        self._secret_store = _build_secret_store(self.guard_home)
         self._oauth_secret_store = _build_oauth_secret_store(self.guard_home)
         self._policy_integrity_secret_store = _build_policy_integrity_secret_store()
         self._cached_oauth_secret_payload: tuple[str, str, str] | None = None
         self._cached_policy_integrity_secret_material: tuple[str | None, float, tuple[bytes, str]] | None = None
         self._cached_policy_integrity_control_state: tuple[str | None, float, dict[str, object]] | None = None
-        self._sync_token_ref = self._build_scoped_secret_ref(_SYNC_TOKEN_REF)
         self._policy_integrity_key_ref = self._build_scoped_secret_ref(_POLICY_INTEGRITY_KEY_REF)
         self._policy_integrity_control_ref = self._build_scoped_secret_ref(_POLICY_INTEGRITY_CONTROL_REF)
         self._oauth_local_credentials_ref = self._build_scoped_secret_ref(_OAUTH_LOCAL_CREDENTIALS_REF)
@@ -1002,10 +930,6 @@ class GuardStore:
     def _versioned_secret_ref(base_ref: str, value_hash: str) -> str:
         return f"{base_ref}:{value_hash[:16]}"
 
-    def _promote_secret_to_primary(self, secret_store: SecretStore, secret_id: str, value: str) -> None:
-        if isinstance(secret_store, FallbackSecretStore):
-            secret_store.promote_secret(secret_id, value)
-
     def _mirror_oauth_secret_to_fallback(self, secret_id: str, value: str) -> None:
         secret_store = self._oauth_secret_store
         if not isinstance(secret_store, FallbackSecretStore):
@@ -4523,10 +4447,6 @@ class GuardStore:
                 bundle_version=bundle_version,
             )
 
-    def set_sync_credentials(self, sync_url: str, token: str, now: str, workspace_id: str | None = None) -> None:
-        with self._connect() as connection:
-            self._set_sync_credentials_in_connection(connection, sync_url, token, now, workspace_id=workspace_id)
-
     def set_sync_payload(self, state_key: str, payload: Mapping[str, object] | Sequence[object], now: str) -> None:
         with self._connect() as connection:
             connection.execute(
@@ -4822,32 +4742,6 @@ class GuardStore:
             )
         return items
 
-    def get_sync_credentials(self) -> dict[str, str] | None:
-        with self._connect() as connection:
-            row = connection.execute("select payload_json from sync_state where state_key = 'credentials'").fetchone()
-        if row is None:
-            return None
-        payload = json.loads(str(row["payload_json"]))
-        if not isinstance(payload, dict):
-            return None
-        sync_url = payload.get("sync_url")
-        if not isinstance(sync_url, str):
-            return None
-        token_reference = payload.get("token_ref")
-        if isinstance(token_reference, str) and token_reference:
-            if token_reference != self._sync_token_ref:
-                return None
-            expected_hash = payload.get(_SYNC_TOKEN_HASH_KEY)
-            expected_hash_value = expected_hash if isinstance(expected_hash, str) and expected_hash else None
-
-            for token in self._get_secret_candidates(self._secret_store, self._sync_token_ref, expected_hash_value):
-                if expected_hash_value is not None and not _secret_matches_hash(token, expected_hash_value):
-                    continue
-                self._promote_secret_to_primary(self._secret_store, self._sync_token_ref, token)
-                return {"sync_url": sync_url, "token": token}
-            return None
-        return None
-
     def get_cloud_sync_profile(self) -> dict[str, str] | None:
         oauth_payload = self.get_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
         if isinstance(oauth_payload, dict):
@@ -4867,24 +4761,9 @@ class GuardStore:
                 if isinstance(workspace_id, str) and workspace_id.strip():
                     profile["workspace_id"] = workspace_id.strip()
                 return profile
-        credentials = self.get_sync_credentials()
-        if credentials is None:
-            return None
-        profile = {
-            "auth_mode": "legacy",
-            "sync_url": str(credentials["sync_url"]),
-        }
-        workspace_id = self.get_cloud_workspace_id()
-        if isinstance(workspace_id, str) and workspace_id.strip():
-            profile["workspace_id"] = workspace_id.strip()
-        return profile
-
-    def clear_sync_credentials(self) -> None:
-        self._secret_store.delete_secret(self._sync_token_ref)
-        self.delete_sync_payload("credentials")
+        return None
 
     def clear_cloud_sync_state_for_reconnect(self) -> None:
-        self.clear_sync_credentials()
         self.delete_sync_payloads(list(_GUARD_CLOUD_RESET_STATE_KEYS))
 
     def set_oauth_local_credentials(
@@ -5034,44 +4913,6 @@ class GuardStore:
         self._remember_oauth_health_result(secret_hash, health)
         return health
 
-    def get_sync_credential_health(self) -> dict[str, object]:
-        payload = self.get_sync_payload("credentials")
-        health: dict[str, object] = {
-            "configured": isinstance(payload, dict),
-            "state": "not_configured",
-            "backend": _secret_store_backend_name(self._secret_store),
-            "fallback_backend": _secret_store_fallback_backend_name(self._secret_store),
-        }
-        if not isinstance(payload, dict):
-            return health
-        sync_url = payload.get("sync_url")
-        token_reference = payload.get("token_ref")
-        if not isinstance(sync_url, str) or not sync_url:
-            health["state"] = "degraded"
-            return health
-        if not isinstance(token_reference, str) or not token_reference or token_reference != self._sync_token_ref:
-            health["state"] = "degraded"
-            return health
-        expected_hash = payload.get(_SYNC_TOKEN_HASH_KEY)
-        expected_hash_value = expected_hash if isinstance(expected_hash, str) and expected_hash else None
-        secret_candidates = self._get_secret_candidates(
-            self._secret_store,
-            self._sync_token_ref,
-            expected_hash_value,
-        )
-        if not any(
-            expected_hash_value is None or _secret_matches_hash(candidate, expected_hash_value)
-            for candidate in secret_candidates
-        ):
-            health["state"] = "degraded"
-            return health
-        health["state"] = "healthy"
-        health["sync_url"] = sync_url
-        workspace_id = payload.get("workspace_id")
-        if isinstance(workspace_id, str) and workspace_id:
-            health["workspace_id"] = workspace_id
-        return health
-
     @staticmethod
     def _oauth_local_credentials_metadata(payload: dict[str, object]) -> dict[str, object] | None:
         issuer = payload.get("issuer")
@@ -5629,101 +5470,6 @@ class GuardStore:
         }
         return build_connect_state_response(payload, poll_after_ms=0)
 
-    def _credential_payload_token_hash(self, payload: dict[str, object]) -> str | None:
-        token_hash = payload.get(_SYNC_TOKEN_HASH_KEY)
-        if isinstance(token_hash, str) and token_hash:
-            return token_hash
-        legacy_token = payload.get("token")
-        if isinstance(legacy_token, str) and legacy_token:
-            return _secret_fingerprint(legacy_token)
-        token_reference = payload.get("token_ref")
-        if isinstance(token_reference, str) and token_reference:
-            token = self._secret_store.get_secret(token_reference)
-            if isinstance(token, str) and token:
-                return _secret_fingerprint(token)
-        return None
-
-    def _set_sync_credentials_in_connection(
-        self,
-        connection: sqlite3.Connection,
-        sync_url: str,
-        token: str,
-        now: str,
-        *,
-        workspace_id: str | None = None,
-    ) -> None:
-        validated_sync_url = validate_guard_sync_endpoint(sync_url)
-        token_hash = _secret_fingerprint(token)
-        normalized_workspace_id = (
-            workspace_id.strip() if isinstance(workspace_id, str) and workspace_id.strip() else None
-        )
-        previous_payload: dict[str, object] | None = None
-        previous_row = connection.execute(
-            "select payload_json from sync_state where state_key = 'credentials'"
-        ).fetchone()
-        if previous_row is not None:
-            previous_payload_candidate = json.loads(str(previous_row["payload_json"]))
-            if isinstance(previous_payload_candidate, dict):
-                previous_payload = previous_payload_candidate
-        previous_sync_url = previous_payload.get("sync_url") if previous_payload is not None else None
-        previous_token_hash = (
-            self._credential_payload_token_hash(previous_payload) if previous_payload is not None else None
-        )
-        previous_workspace_id = (
-            _string_value(previous_payload.get("workspace_id")) if previous_payload is not None else None
-        )
-        previous_workspace = previous_workspace_id.strip() if previous_workspace_id is not None else None
-        effective_workspace_id = normalized_workspace_id
-        can_preserve_workspace = (
-            previous_sync_url == validated_sync_url
-            and previous_token_hash is not None
-            and previous_token_hash == token_hash
-            and previous_workspace_id is not None
-            and previous_workspace_id.strip()
-        )
-        if effective_workspace_id is None and can_preserve_workspace:
-            effective_workspace_id = previous_workspace
-        workspace_changed = (
-            previous_workspace is not None
-            and effective_workspace_id is not None
-            and previous_workspace != effective_workspace_id
-        )
-        payload = {
-            "sync_url": validated_sync_url,
-            "token_ref": self._sync_token_ref,
-            _SYNC_TOKEN_HASH_KEY: token_hash,
-        }
-        if effective_workspace_id is not None:
-            payload["workspace_id"] = effective_workspace_id
-        if previous_row is None or previous_payload is None:
-            credentials_changed = True
-        else:
-            credentials_changed = (
-                previous_sync_url != validated_sync_url
-                or previous_token_hash is None
-                or previous_token_hash != token_hash
-                or workspace_changed
-            )
-        self._secret_store.set_secret(self._sync_token_ref, token)
-        connection.execute(
-            """
-            insert into sync_state (state_key, payload_json, updated_at)
-            values ('credentials', ?, ?)
-            on conflict(state_key) do update set
-              payload_json = excluded.payload_json,
-              updated_at = excluded.updated_at
-            """,
-            (json.dumps(payload), now),
-        )
-        if credentials_changed:
-            connection.execute("delete from sync_state where state_key != 'credentials'")
-            connection.execute("delete from guard_supply_chain_bundle_cache")
-            connection.execute("delete from guard_supply_chain_eval_cache")
-            connection.execute("delete from publisher_cache")
-            connection.execute(
-                "delete from policy_decisions where source in ('cloud-sync', 'team-policy', 'policy-bundle')"
-            )
-
     @staticmethod
     def _cloud_workspace_id_from_connection(connection: sqlite3.Connection) -> str | None:
         oauth_row = connection.execute(
@@ -5735,15 +5481,6 @@ class GuardStore:
                 workspace_id = oauth_payload.get("workspace_id")
                 if isinstance(workspace_id, str) and workspace_id.strip():
                     return workspace_id
-        row = connection.execute("select payload_json from sync_state where state_key = 'credentials'").fetchone()
-        if row is None:
-            return None
-        payload = json.loads(str(row["payload_json"]))
-        if not isinstance(payload, dict):
-            return None
-        workspace_id = payload.get("workspace_id")
-        if isinstance(workspace_id, str) and workspace_id.strip():
-            return workspace_id
         return None
 
     def upsert_guard_session(

{plugin_scanner-2.0.772 → plugin_scanner-2.0.774}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.772"
+__version__ = "2.0.774"