plugin-scanner 2.0.817__tar.gz → 2.0.818__tar.gz

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.817
+Version: 2.0.818
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.817"
+version = "2.0.818"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.817"
+version = "2.0.818"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/src/codex_plugin_scanner/guard/cli/_commands_shared.py

@@ -110,10 +110,12 @@ from ..harness_usage import record_harness_usage_events
 from ..incident import build_incident_context
 from ..local_dashboard_session import build_local_dashboard_session_token
 from ..local_supply_chain import (
+    _resolve_guard_sync_auth_context,
     apply_stored_package_policy_override,
     build_local_supply_chain_posture,
     build_supply_chain_explain_payload,
     build_supply_chain_status_payload,
+    sync_supply_chain_cloud_state,
     build_workspace_audit_payload,
     build_workspace_scan_payload,
     package_request_policy_hash,

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py

@@ -236,12 +236,19 @@ def _run_guard_sync_command(
     store = _require_guard_store(store)
     context = _require_guard_context(context)
     try:
+        auth_context = _resolve_guard_sync_auth_context(store)
         payload = sync_receipts(
             store,
+            auth_context=auth_context,
             home_dir=context.home_dir,
             workspace_dir=context.workspace_dir,
         )
-    except GuardSyncNotConfiguredError as error:
+        payload["supply_chain"] = sync_supply_chain_cloud_state(
+            store,
+            auth_context=auth_context,
+            workspace_dir=context.workspace_dir,
+        )
+    except (GuardSyncAuthorizationExpiredError, GuardSyncNotConfiguredError) as error:
         message = _guard_sync_failure_message(error)
         if getattr(args, "json", False):
             _emit("sync", {"synced": False, "error": message}, True)
@@ -340,8 +347,15 @@ def _run_guard_supply_chain_command(
         return exit_code
     if supply_chain_command == "sync":
         try:
-            payload = _validated_supply_chain_sync_payload(sync_supply_chain_bundle(store))
-        except GuardSyncNotConfiguredError as error:
+            auth_context = _resolve_guard_sync_auth_context(store)
+            payload = _validated_supply_chain_sync_payload(
+                sync_supply_chain_cloud_state(
+                    store,
+                    auth_context=auth_context,
+                    workspace_dir=workspace_dir,
+                )
+            )
+        except (GuardSyncAuthorizationExpiredError, GuardSyncNotConfiguredError) as error:
             message = _guard_sync_failure_message(error)
             if getattr(args, "json", False):
                 _emit("supply-chain-sync", {"synced": False, "error": message}, True)

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -144,25 +144,9 @@ def _refresh_cloud_policy_bundle(store: GuardStore) -> None:
         return
     now = _now()
     try:
-        sync_receipts(store)
-    except GuardSyncAuthorizationExpiredError as error:
-        store.set_sync_payload(
-            "policy_bundle_last_error",
-            {"reason": "auth_expired", "message": str(error)},
-            now,
-        )
-        return
-    except GuardSyncNotConfiguredError:
-        return
-    except RuntimeError as error:
-        store.set_sync_payload(
-            "policy_bundle_last_error",
-            {"reason": "sync_failed", "message": str(error)},
-            now,
-        )
-        return
-    try:
-        sync_supply_chain_bundle(store)
+        auth_context = _resolve_guard_sync_auth_context(store)
+        sync_receipts(store, auth_context=auth_context)
+        sync_supply_chain_cloud_state(store, auth_context=auth_context)
     except GuardSyncAuthorizationExpiredError as error:
         store.set_sync_payload(
             "policy_bundle_last_error",
@@ -337,7 +321,10 @@ def _finalize_guard_connect_payload(
         }
     )
     try:
-        payload["supply_chain"] = sync_supply_chain_bundle(store)
+        payload["supply_chain"] = sync_supply_chain_cloud_state(
+            store,
+            auth_context=resolved_sync_auth_context,
+        )
     except (GuardSyncNotConfiguredError, GuardSyncNotAvailableError, RuntimeError) as error:
         payload["supply_chain_error"] = str(error)
     return payload

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -6,6 +6,7 @@ import argparse
 import base64
 import hashlib
 import hmac
+import inspect
 import io
 import json
 import mimetypes
@@ -102,6 +103,7 @@ from ..local_supply_chain import (
     managed_install_audit_workspace_dirs,
     resolve_package_firewall_entitlement_with_refresh,
     resolve_supply_chain_audit_workspace_dir,
+    sync_supply_chain_cloud_state,
 )
 from ..models import DECISION_SCOPE_VALUES, GUARD_ACTION_VALUES, DecisionScope, GuardAction, PolicyDecision
 from ..package_firewall_action_rate_limit import PackageFirewallActionRateLimiter
@@ -110,6 +112,7 @@ from ..package_firewall_entitlement import (
     package_firewall_available_actions,
     package_firewall_block_details,
     package_firewall_operation_allowed,
+    resolve_package_firewall_entitlement,
 )
 from ..package_firewall_receipts import package_firewall_receipt_metadata
 from ..package_shim_status import record_package_shim_audit_result
@@ -129,6 +132,7 @@ from ..runtime.runner import (
     _policy_bundle_acknowledgement_payload,
     _policy_bundle_is_version_downgrade,
     prepare_guard_cloud_connect_authorization,
+    _resolve_guard_sync_auth_context,
     sync_local_guard_cloud_proof,
     sync_supply_chain_bundle,
 )
@@ -544,7 +548,12 @@ def _run_headless_cloud_sync(
     recorded_at = _now()
     summary: dict[str, object]
     try:
-        sync_payload = sync_local_guard_cloud_proof(store)
+        auth_context = _resolve_guard_sync_auth_context(store)
+        sync_payload = sync_local_guard_cloud_proof(store, auth_context=auth_context)
+        supply_chain_payload = _sync_supply_chain_cloud_state_with_optional_auth_context(
+            store,
+            auth_context,
+        )
         summary = {
             "status": "synced",
             "synced_at": sync_payload.get("synced_at"),
@@ -552,6 +561,7 @@ def _run_headless_cloud_sync(
             "runtime_session_id": sync_payload.get("runtime_session_id"),
             "runtime_session_synced_at": sync_payload.get("runtime_session_synced_at"),
             "runtime_sessions_visible": sync_payload.get("runtime_sessions_visible"),
+            "supply_chain": supply_chain_payload,
         }
     except GuardSyncAuthorizationExpiredError as error:
         store.record_latest_guard_connect_sync_result(
@@ -948,6 +958,24 @@ def _guard_cloud_connect_succeeded(store: GuardStore) -> bool:
     return not _guard_cloud_connect_required_for_insights(store)
 
 
+def _sync_supply_chain_cloud_state_with_optional_auth_context(
+    store: GuardStore,
+    auth_context: dict[str, object] | None,
+    *,
+    workspace_dir: Path | None = None,
+) -> dict[str, object]:
+    try:
+        parameters = inspect.signature(sync_supply_chain_cloud_state).parameters
+    except (TypeError, ValueError):
+        parameters = {}
+    kwargs: dict[str, object] = {}
+    if auth_context is not None and "auth_context" in parameters:
+        kwargs["auth_context"] = auth_context
+    if workspace_dir is not None and "workspace_dir" in parameters:
+        kwargs["workspace_dir"] = workspace_dir
+    return sync_supply_chain_cloud_state(store, **kwargs)
+
+
 def _finalize_daemon_guard_connect_payload(
     *,
     store: GuardStore,
@@ -1088,7 +1116,10 @@ def _finalize_daemon_guard_connect_payload(
         }
     )
     try:
-        payload["supply_chain"] = sync_supply_chain_bundle(store)
+        payload["supply_chain"] = _sync_supply_chain_cloud_state_with_optional_auth_context(
+            store,
+            resolved_sync_auth_context,
+        )
     except (GuardSyncNotConfiguredError, GuardSyncNotAvailableError, RuntimeError) as error:
         payload["supply_chain_error"] = str(error)
     return payload
@@ -2549,7 +2580,11 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                 record_package_shim_audit_result(context, audited_at=now)
             return audit_payload
         if operation == "sync":
-            return sync_supply_chain_bundle(self.server.store)  # type: ignore[attr-defined]
+            return _sync_supply_chain_cloud_state_with_optional_auth_context(
+                self.server.store,  # type: ignore[attr-defined]
+                None,
+                workspace_dir=context.workspace_dir,
+            )
         raise ValueError("unsupported_supply_chain_operation")
 
     def _resolve_supply_chain_workspace_dir(self, payload: dict[str, object]) -> Path | None:
@@ -2739,7 +2774,7 @@ class _GuardDaemonHandler(BaseHTTPRequestHandler):
                     },
                     now=timestamp,
                 )
-                resolved_entitlement = resolve_package_firewall_entitlement_with_refresh(store)
+                resolved_entitlement = resolve_package_firewall_entitlement(store)
                 resolved_reason = str(resolved_entitlement.get("reason") or "")
                 if bool(resolved_entitlement.get("allowed")) or resolved_reason == "paid_guard_cloud_required":
                     _set_package_firewall_connect_state(self.server, None)  # type: ignore[arg-type]

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/src/codex_plugin_scanner/guard/daemon/static/assets/guard-dashboard.js

@@ -20519,11 +20519,8 @@ function openPackageFirewallAuthorizeWindow(authorizeUrl) {
   }
   return false;
 }
-function openPackageFirewallAuthorizeFallback(authorizeUrl, browserOpened) {
-  if (browserOpened === true) {
-    return true;
-  }
-  return openPackageFirewallAuthorizeWindow(authorizeUrl);
+function openPackageFirewallAuthorizeFallback(_authorizeUrl, browserOpened) {
+  return browserOpened === true;
 }
 function FiShare2(props) {
   return GenIcon({ "attr": { "viewBox": "0 0 24 24", "fill": "none", "stroke": "currentColor", "strokeWidth": "2", "strokeLinecap": "round", "strokeLinejoin": "round" }, "child": [{ "tag": "circle", "attr": { "cx": "18", "cy": "5", "r": "3" }, "child": [] }, { "tag": "circle", "attr": { "cx": "6", "cy": "12", "r": "3" }, "child": [] }, { "tag": "circle", "attr": { "cx": "18", "cy": "19", "r": "3" }, "child": [] }, { "tag": "line", "attr": { "x1": "8.59", "y1": "13.51", "x2": "15.42", "y2": "17.49" }, "child": [] }, { "tag": "line", "attr": { "x1": "15.41", "y1": "6.51", "x2": "8.59", "y2": "10.49" }, "child": [] }] })(props);

{plugin_scanner-2.0.817 → plugin_scanner-2.0.818}/src/codex_plugin_scanner/guard/local_supply_chain.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import importlib
+import inspect
 import json
 import os
 import shlex
@@ -133,6 +134,10 @@ _STALE_REFRESH_GRACE_SECONDS = 5 * 60
 _CLOUD_AUDIT_TIMEOUT_SECONDS = 20
 _CLOUD_AUDIT_PAGE_SIZE = 500
 _CLOUD_AUDIT_MAX_PAGES = 100
+_CLOUD_AUDIT_JOB_PAGE_SIZE = 1
+_CLOUD_AUDIT_JOB_POLL_INTERVAL_SECONDS = 0.5
+_CLOUD_AUDIT_JOB_POLL_TIMEOUT_SECONDS = 20
+_CLOUD_AUDIT_SYNC_PAGE_SIZE = 25
 _MAX_SBOM_BYTES = 10 * 1024 * 1024
 _ECOSYSTEM_BY_LOCKFILE = {
     "package-lock.json": "npm",
@@ -212,12 +217,20 @@ def _supply_chain_package_eval_module():
     return importlib.import_module(".runtime.supply_chain_package_eval", __package__)
 
 
-def sync_local_guard_cloud_proof(store: GuardStore) -> dict[str, object]:
-    return _runtime_runner_module().sync_local_guard_cloud_proof(store)
+def sync_local_guard_cloud_proof(
+    store: GuardStore,
+    *,
+    auth_context: dict[str, object] | None = None,
+) -> dict[str, object]:
+    return _runtime_runner_module().sync_local_guard_cloud_proof(store, auth_context=auth_context)
 
 
-def sync_supply_chain_bundle(store: GuardStore) -> dict[str, object] | None:
-    return _runtime_runner_module().sync_supply_chain_bundle(store)
+def sync_supply_chain_bundle(
+    store: GuardStore,
+    *,
+    auth_context: dict[str, object] | None = None,
+) -> dict[str, object] | None:
+    return _runtime_runner_module().sync_supply_chain_bundle(store, auth_context=auth_context)
 
 
 def _resolve_guard_sync_auth_context(store: GuardStore):
@@ -409,6 +422,21 @@ def build_supply_chain_status_payload(
     }
 
 
+def _call_sync_with_optional_auth_context(
+    refresh: Any,
+    *,
+    store: Any,
+    auth_context: dict[str, object],
+) -> dict[str, object]:
+    try:
+        parameters = inspect.signature(refresh).parameters
+    except (TypeError, ValueError):
+        parameters = {}
+    if "auth_context" in parameters:
+        return refresh(store, auth_context=auth_context)
+    return refresh(store)
+
+
 def resolve_package_firewall_entitlement_with_refresh(store: Any) -> dict[str, object]:
     """Resolve package-firewall access and opportunistically heal stale cloud state."""
 
@@ -437,9 +465,26 @@ def resolve_package_firewall_entitlement_with_refresh(store: Any) -> dict[str, o
         ):
             return entitlement
         _write_package_firewall_refresh_state(store.guard_home, now)
+    try:
+        shared_auth_context = runner._resolve_guard_sync_auth_context(store)
+    except runner.GuardSyncAuthorizationExpiredError as error:
+        if str(entitlement.get("reason") or "") == "guard_cloud_connect_required":
+            store.record_latest_guard_connect_sync_result(
+                status="retry_required",
+                milestone="first_sync_failed",
+                now=now_iso,
+                reason=str(error),
+            )
+        return entitlement_module.resolve_package_firewall_entitlement(store)
+    except (runner.GuardSyncNotAvailableError, runner.GuardSyncNotConfiguredError, OSError, RuntimeError):
+        return entitlement_module.resolve_package_firewall_entitlement(store)
     for refresh in (sync_local_guard_cloud_proof, sync_supply_chain_bundle):
         try:
-            refresh(store)
+            _call_sync_with_optional_auth_context(
+                refresh,
+                store=store,
+                auth_context=shared_auth_context,
+            )
         except runner.GuardSyncAuthorizationExpiredError as error:
             if str(entitlement.get("reason") or "") == "guard_cloud_connect_required":
                 store.record_latest_guard_connect_sync_result(
@@ -497,6 +542,32 @@ def managed_install_audit_workspace_dirs(store: Any) -> tuple[str, ...]:
     return tuple(candidates)
 
 
+def _managed_workspace_audit_candidates(
+    store: Any,
+    *,
+    workspace_dir: Path | None = None,
+) -> tuple[Path, ...]:
+    candidates: list[Path] = []
+    seen: set[str] = set()
+    raw_candidates: list[Path] = []
+    if workspace_dir is not None:
+        raw_candidates.append(workspace_dir)
+    raw_candidates.extend(Path(entry).expanduser() for entry in managed_install_audit_workspace_dirs(store))
+    for candidate in raw_candidates:
+        try:
+            resolved = candidate.resolve()
+        except OSError:
+            continue
+        normalized = str(resolved)
+        if normalized in seen or not resolved.exists() or not resolved.is_dir():
+            continue
+        if not _workspace_has_project_markers(resolved):
+            continue
+        seen.add(normalized)
+        candidates.append(resolved)
+    return tuple(candidates)
+
+
 def resolve_supply_chain_audit_workspace_dir(
     *,
     workspace_dir_value: object,
@@ -2197,6 +2268,8 @@ def _build_cloud_audit_payload(
     manifest_paths: tuple[str, ...],
     lockfile_paths: tuple[str, ...],
     inventory: tuple[dict[str, object], ...],
+    mode: str = "paged",
+    page_size: int | None = None,
 ) -> dict[str, object]:
     summary = store.get_sync_payload("supply_chain_bundle_summary")
     policy_version = "local:none"
@@ -2221,8 +2294,8 @@ def _build_cloud_audit_payload(
         },
         "harness": _LOCAL_SUPPLY_CHAIN_HARNESS,
         "lockfileContext": _workspace_audit_lockfile_context(workspace_dir, manifest_paths, lockfile_paths, inventory),
-        "mode": "paged",
-        "pageSize": min(_CLOUD_AUDIT_PAGE_SIZE, max(len(inventory), 1)),
+        "mode": mode,
+        "pageSize": min(_CLOUD_AUDIT_PAGE_SIZE, max(page_size or len(inventory), 1)),
         "packages": [
             {
                 "direct": bool(item.get("direct")),
@@ -2242,6 +2315,121 @@ def _build_cloud_audit_payload(
     return payload
 
 
+def _execute_cloud_workspace_audit_request(
+    *,
+    auth_context: dict[str, object],
+    request_url: str,
+    method: str,
+    payload: dict[str, object] | None = None,
+) -> dict[str, object]:
+    runner = _runtime_runner_module()
+    request_headers = runner._guard_sync_headers(auth_context, request_url=request_url, method=method)
+    if payload is not None:
+        request_headers["Content-Type"] = "application/json"
+    request = urllib.request.Request(
+        request_url,
+        data=json.dumps(payload).encode("utf-8") if payload is not None else None,
+        headers=request_headers,
+        method=method,
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=_CLOUD_AUDIT_TIMEOUT_SECONDS) as response:
+            response_payload = json.load(response)
+    except urllib.error.HTTPError as error:
+        if error.code == 403:
+            is_plan_restricted, message = runner._check_plan_restriction_403(error)
+            if is_plan_restricted:
+                raise runner.GuardSyncNotAvailableError(message) from error
+            raise RuntimeError(message) from error
+        message, retryable = runner._guard_cloud_http_error_details(error)
+        if retryable:
+            raise runner.GuardSyncNotAvailableError(message, retryable=True) from error
+        raise RuntimeError(message) from error
+    except OSError as error:
+        raise RuntimeError(runner._sync_url_error_message(error)) from error
+    except (ValueError, json.JSONDecodeError) as error:
+        raise RuntimeError("Guard cloud workspace audit returned an invalid response.") from error
+    if not isinstance(response_payload, dict):
+        raise RuntimeError("Guard cloud workspace audit returned an invalid response.")
+    return response_payload
+
+
+def _normalized_supply_chain_batch_job_url(
+    sync_url: str,
+    workspace_id: str,
+    job_id: str,
+    *,
+    page_size: int,
+) -> str:
+    batch_url = _normalized_supply_chain_batch_url(sync_url, workspace_id)
+    parsed = urllib.parse.urlsplit(batch_url)
+    query_pairs = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True)
+    query_pairs = [(key, value) for key, value in query_pairs if key not in {"cursor", "pageSize"}]
+    query_pairs.append(("pageSize", str(max(page_size, 1))))
+    return urllib.parse.urlunsplit(
+        (
+            parsed.scheme,
+            parsed.netloc,
+            f"{parsed.path.rstrip('/')}/{urllib.parse.quote(job_id, safe='')}",
+            urllib.parse.urlencode(query_pairs),
+            "",
+        )
+    )
+
+
+def _enqueue_cloud_workspace_audit_job(
+    *,
+    auth_context: dict[str, object],
+    request_payload: dict[str, object],
+    workspace_id: str,
+) -> dict[str, object]:
+    sync_url = str(auth_context["sync_url"])
+    request_url = _normalized_supply_chain_batch_url(sync_url, workspace_id)
+    response_payload = _execute_cloud_workspace_audit_request(
+        auth_context=auth_context,
+        request_url=request_url,
+        method="POST",
+        payload=request_payload,
+    )
+    job_id = response_payload.get("jobId")
+    if not isinstance(job_id, str) or not job_id.strip():
+        raise RuntimeError("Guard cloud workspace audit did not return a batch job id.")
+    return response_payload
+
+
+def _poll_cloud_workspace_audit_job(
+    *,
+    auth_context: dict[str, object],
+    job_id: str,
+    workspace_id: str,
+) -> dict[str, object]:
+    sync_url = str(auth_context["sync_url"])
+    request_url = _normalized_supply_chain_batch_job_url(
+        sync_url,
+        workspace_id,
+        job_id,
+        page_size=_CLOUD_AUDIT_JOB_PAGE_SIZE,
+    )
+    deadline = time.monotonic() + _CLOUD_AUDIT_JOB_POLL_TIMEOUT_SECONDS
+    last_response: dict[str, object] = {
+        "jobId": job_id,
+        "status": "queued",
+        "workspaceId": workspace_id,
+    }
+    while time.monotonic() < deadline:
+        response_payload = _execute_cloud_workspace_audit_request(
+            auth_context=auth_context,
+            request_url=request_url,
+            method="GET",
+        )
+        status = str(response_payload.get("status") or "").strip().lower()
+        last_response = response_payload
+        if status in {"completed", "failed"}:
+            return response_payload
+        time.sleep(_CLOUD_AUDIT_JOB_POLL_INTERVAL_SECONDS)
+    return last_response
+
+
 def _workspace_audit_lockfile_context(
     workspace_dir: Path,
     manifest_paths: tuple[str, ...],
@@ -2394,6 +2582,145 @@ def _normalized_supply_chain_batch_url(sync_url: str, workspace_id: str) -> str:
     )
 
 
+def sync_managed_workspace_audits(
+    store: GuardStore,
+    *,
+    auth_context: dict[str, object] | None = None,
+    workspace_dir: Path | None = None,
+) -> dict[str, object]:
+    runner = _runtime_runner_module()
+    resolved_auth_context = auth_context if auth_context is not None else runner._resolve_guard_sync_auth_context(store)
+    workspace_id = store.get_cloud_workspace_id()
+    if not isinstance(workspace_id, str) or not workspace_id.strip():
+        raise runner.GuardSyncNotConfiguredError(
+            "Guard Cloud is not connected yet. Run `hol-guard connect` to sign in and pair this machine, "
+            "or use `hol-guard login` as a compatibility alias for the same browser flow."
+        )
+    synced_at = datetime.now(timezone.utc).isoformat()
+    workspaces_payload: list[dict[str, object]] = []
+    completed_jobs = 0
+    failed_jobs = 0
+    queued_jobs = 0
+    skipped_workspaces = 0
+    for candidate in _managed_workspace_audit_candidates(store, workspace_dir=workspace_dir):
+        workspace_label = candidate.name or str(candidate)
+        try:
+            manifest_paths, lockfile_paths, _sbom_paths, inventory = _workspace_audit_inventory(
+                candidate,
+                sbom_paths=(),
+            )
+            if not inventory:
+                skipped_workspaces += 1
+                workspaces_payload.append(
+                    {
+                        "workspace": workspace_label,
+                        "status": "skipped",
+                        "message": "No supported package inventory was detected for workspace audit sync.",
+                        "package_count": 0,
+                    }
+                )
+                continue
+            request_payload = _build_cloud_audit_payload(
+                workspace_dir=candidate,
+                workspace_id=workspace_id,
+                store=store,
+                manifest_paths=manifest_paths,
+                lockfile_paths=lockfile_paths,
+                inventory=inventory,
+                mode="job",
+                page_size=min(_CLOUD_AUDIT_SYNC_PAGE_SIZE, max(len(inventory), 1)),
+            )
+            enqueue_response = _enqueue_cloud_workspace_audit_job(
+                auth_context=resolved_auth_context,
+                request_payload=request_payload,
+                workspace_id=workspace_id,
+            )
+            job_id = str(enqueue_response.get("jobId") or "").strip()
+            final_response = _poll_cloud_workspace_audit_job(
+                auth_context=resolved_auth_context,
+                job_id=job_id,
+                workspace_id=workspace_id,
+            )
+            final_status = str(final_response.get("status") or enqueue_response.get("status") or "queued").strip().lower()
+            if final_status == "completed":
+                completed_jobs += 1
+            elif final_status == "failed":
+                failed_jobs += 1
+            else:
+                queued_jobs += 1
+            workspaces_payload.append(
+                {
+                    "workspace": workspace_label,
+                    "workspace_fingerprint": request_payload.get("workspaceFingerprint"),
+                    "job_id": job_id,
+                    "status": final_status,
+                    "package_count": len(inventory),
+                    "manifest_paths": list(manifest_paths),
+                    "lockfile_paths": list(lockfile_paths),
+                    "message": final_response.get("error"),
+                }
+            )
+        except (
+            runner.GuardSyncAuthorizationExpiredError,
+            runner.GuardSyncNotAvailableError,
+            runner.GuardSyncNotConfiguredError,
+        ):
+            raise
+        except (OSError, RuntimeError, ValueError) as error:
+            failed_jobs += 1
+            workspaces_payload.append(
+                {
+                    "workspace": workspace_label,
+                    "status": "failed",
+                    "message": str(error),
+                    "package_count": 0,
+                }
+            )
+    if failed_jobs > 0 and completed_jobs == 0 and queued_jobs == 0:
+        status = "failed"
+    elif failed_jobs > 0:
+        status = "partial"
+    elif completed_jobs > 0 or queued_jobs > 0:
+        status = "synced"
+    else:
+        status = "idle"
+    summary = {
+        "synced_at": synced_at,
+        "status": status,
+        "workspace_count": len(workspaces_payload),
+        "completed_jobs": completed_jobs,
+        "queued_jobs": queued_jobs,
+        "failed_jobs": failed_jobs,
+        "skipped_workspaces": skipped_workspaces,
+        "workspaces": workspaces_payload,
+    }
+    store.set_sync_payload("workspace_audits_sync_summary", summary, synced_at)
+    return summary
+
+
+def sync_supply_chain_cloud_state(
+    store: GuardStore,
+    *,
+    auth_context: dict[str, object] | None = None,
+    workspace_dir: Path | None = None,
+) -> dict[str, object]:
+    resolved_auth_context = auth_context if auth_context is not None else _resolve_guard_sync_auth_context(store)
+    bundle_summary = _call_sync_with_optional_auth_context(
+        sync_supply_chain_bundle,
+        store=store,
+        auth_context=resolved_auth_context,
+    )
+    payload = dict(bundle_summary) if isinstance(bundle_summary, dict) else {}
+    workspace_audits = sync_managed_workspace_audits(
+        store,
+        auth_context=resolved_auth_context,
+        workspace_dir=workspace_dir,
+    )
+    payload["workspace_audits"] = workspace_audits
+    payload.setdefault("synced_at", workspace_audits.get("synced_at"))
+    return payload
+
+
 def _target_from_manifest_dependency(ecosystem: str, package_name: str, version: str) -> PackageIntentTarget:
     clean_name = package_name.strip()
     clean_version = version.strip()