plugin-scanner 2.0.776__tar.gz → 2.0.778__tar.gz

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.776
+Version: 2.0.778
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.776"
+version = "2.0.778"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.776"
+version = "2.0.778"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/src/codex_plugin_scanner/guard/package_firewall_entitlement.py

@@ -152,11 +152,19 @@ def _connect_state_entitlement(store: GuardStore, *, now: datetime) -> dict[str,
         return None
     status = _optional_string(latest_state.get("status"))
     milestone = _optional_string(latest_state.get("milestone"))
-    if status not in {"retry_required", "expired"} and milestone not in {
-        "first_sync_failed",
-        "expired",
-        "sync_not_available",
-    }:
+    missing_oauth_after_success = (
+        status == "connected" and milestone == "first_sync_succeeded" and not isinstance(oauth_payload, dict)
+    )
+    if (
+        not missing_oauth_after_success
+        and status not in {"retry_required", "expired"}
+        and milestone
+        not in {
+            "first_sync_failed",
+            "expired",
+            "sync_not_available",
+        }
+    ):
         return None
     tier = "unknown"
     if isinstance(oauth_fields, dict):

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/src/codex_plugin_scanner/guard/store.py

@@ -5320,6 +5320,15 @@ class GuardStore:
         now: str,
     ) -> dict[str, object] | None:
         if cloud_profile is None:
+            if latest_state is not None and self._guard_connect_state_requires_oauth(latest_state):
+                return self._coerce_guard_connect_state_status(
+                    state=latest_state,
+                    status="retry_required",
+                    milestone="first_sync_failed",
+                    reason="Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again.",
+                    sync_summary=sync_summary,
+                    now=now,
+                )
             return latest_state
         normalized = self._hydrate_guard_connect_state_from_cloud_profile(
             latest_state=latest_state,
@@ -5356,6 +5365,13 @@ class GuardStore:
             )
         return normalized
 
+    def _guard_connect_state_requires_oauth(self, latest_state: dict[str, object]) -> bool:
+        request_id = latest_state.get("request_id")
+        if not isinstance(request_id, str) or not request_id.strip():
+            return False
+        status = str(latest_state.get("status") or "")
+        return status == "connected"
+
     def _hydrate_guard_connect_state_from_cloud_profile(
         self,
         *,

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.776"
+__version__ = "2.0.778"

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/tests/test_guard_cloud_local_sync.py

@@ -422,6 +422,7 @@ def test_runtime_snapshot_exposes_cloud_policy_bundle_fields(tmp_path: Path) ->
 
 def test_runtime_snapshot_exposes_latest_connect_proof_without_pairing_secrets(tmp_path: Path) -> None:
     store = GuardStore(tmp_path / "guard-home")
+    _seed_guard_cloud(store, workspace_id="workspace-alpha")
     request_id = "connect-imported-state"
     with store._connect() as connection:
         connection.execute(
@@ -502,6 +503,68 @@ def test_runtime_snapshot_exposes_latest_connect_proof_without_pairing_secrets(t
     }
 
 
+def test_runtime_snapshot_marks_connected_state_retry_required_when_oauth_missing(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    request_id = "connect-missing-oauth"
+    with store._connect() as connection:
+        connection.execute(
+            """
+            insert into guard_connect_states (
+              request_id,
+              sync_url,
+              allowed_origin,
+              status,
+              milestone,
+              reason,
+              created_at,
+              updated_at,
+              expires_at,
+              completed_at,
+              proof_json
+            )
+            values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """,
+            (
+                request_id,
+                "https://hol.org/api/guard/receipts/sync",
+                "https://hol.org",
+                "connected",
+                "first_sync_succeeded",
+                None,
+                "2026-04-24T00:00:00+00:00",
+                "2026-04-24T00:02:00+00:00",
+                "2026-04-24T00:05:00+00:00",
+                "2026-04-24T00:01:00+00:00",
+                json.dumps(
+                    {
+                        "pairing_completed_at": "2026-04-24T00:01:00+00:00",
+                        "first_synced_at": "2026-04-24T00:02:00+00:00",
+                        "receipts_stored": 3,
+                        "inventory_items": 5,
+                    }
+                ),
+            ),
+        )
+
+    snapshot = build_runtime_snapshot(
+        store=store,
+        approval_center_url=None,
+        now="2026-04-24T00:03:00+00:00",
+    )
+    latest_connect_state = snapshot["latest_connect_state"]
+
+    assert isinstance(latest_connect_state, dict)
+    assert latest_connect_state["request_id"] == request_id
+    assert latest_connect_state["status"] == "retry_required"
+    assert latest_connect_state["milestone"] == "first_sync_failed"
+    assert latest_connect_state["reason"] == (
+        "Guard Cloud authorization on this machine is incomplete. Run hol-guard connect again."
+    )
+    assert snapshot["cloud_state"] == "local_only"
+    assert snapshot["sync_configured"] is False
+    assert snapshot["proof_status"]["state"] == "failed"
+
+
 @pytest.mark.parametrize(
     ("status", "milestone", "expected_state", "expected_label", "expected_detail"),
     [
@@ -547,6 +610,8 @@ def test_runtime_snapshot_uses_oauth_connect_copy_for_proof_statuses(
     expected_detail: str,
 ) -> None:
     store = GuardStore(tmp_path / "guard-home")
+    if status == "connected":
+        _seed_guard_cloud(store, workspace_id="workspace-alpha")
     request_id = f"connect-{expected_state}"
     with store._connect() as connection:
         connection.execute(

{plugin_scanner-2.0.776 → plugin_scanner-2.0.778}/tests/test_guard_connect_flow.py

@@ -476,6 +476,40 @@ def test_cached_paid_bundle_does_not_hide_retry_required_connect_state(tmp_path:
     }
 
 
+def test_cached_paid_bundle_does_not_hide_missing_oauth_after_success(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_payload(
+        "supply_chain_bundle_entitlement",
+        {
+            "tier": "premium",
+        },
+        "2026-06-15T18:38:57+00:00",
+    )
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now="2026-06-15T00:52:39+00:00",
+        request_id="connect-1",
+    )
+    store.record_latest_guard_connect_sync_success(
+        sync_payload={
+            "synced_at": "2026-06-15T18:38:57+00:00",
+            "receipts_stored": 11,
+            "inventory_items": 261,
+        },
+        now="2026-06-15T18:38:57+00:00",
+    )
+
+    entitlement = resolve_package_firewall_entitlement(store)
+
+    assert entitlement == {
+        "allowed": False,
+        "reason": "guard_cloud_reconnect_required",
+        "tier": "unknown",
+        "upgrade_cta": "Reconnect HOL Guard Cloud to refresh package firewall access.",
+    }
+
+
 def test_sync_local_guard_cloud_proof_repairs_degraded_oauth_from_encrypted_fallback(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,