plugin-scanner 2.0.870__tar.gz → 2.0.872__tar.gz

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.870
+Version: 2.0.872
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.870"
+version = "2.0.872"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.870"
+version = "2.0.872"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -762,17 +762,57 @@ def refresh_guard_access_token(
                 dpop_nonce = challenge_nonce
                 nonce_retry_count += 1
                 continue
-            message = (
-                str(payload.get("error_description") or payload.get("error") or error.reason)
-                if isinstance(payload, dict)
-                else str(error.reason)
-            )
-            raise RuntimeError(f"Guard OAuth token exchange failed: {message}") from error
+            raise _guard_oauth_token_exchange_error_from_http_error(error, payload) from error
         if not isinstance(payload, dict):
             raise RuntimeError("Guard OAuth token exchange failed: invalid response.")
         return _parse_guard_token_exchange_payload(payload)
 
 
+class GuardOAuthTokenExchangeError(RuntimeError):
+    def __init__(
+        self,
+        *,
+        oauth_error: str | None,
+        oauth_error_description: str | None,
+        status_code: int | None,
+        reason: str | None,
+    ) -> None:
+        self.oauth_error = oauth_error
+        self.oauth_error_description = oauth_error_description
+        self.status_code = status_code
+        self.reason = reason
+        message = oauth_error_description or oauth_error or reason or "token exchange failed."
+        super().__init__(f"Guard OAuth token exchange failed: {message}")
+
+
+def _guard_oauth_token_exchange_error_from_http_error(
+    error: urllib.error.HTTPError,
+    payload: object,
+) -> GuardOAuthTokenExchangeError:
+    oauth_error = payload.get("error") if isinstance(payload, dict) else None
+    oauth_error_description = payload.get("error_description") if isinstance(payload, dict) else None
+    return GuardOAuthTokenExchangeError(
+        oauth_error=str(oauth_error).strip() if isinstance(oauth_error, str) and oauth_error.strip() else None,
+        oauth_error_description=(
+            str(oauth_error_description).strip()
+            if isinstance(oauth_error_description, str) and oauth_error_description.strip()
+            else None
+        ),
+        status_code=error.code,
+        reason=str(error.reason).strip() if str(error.reason).strip() else None,
+    )
+
+
+def _oauth_refresh_error_means_grant_inactive(error: Exception) -> bool:
+    if isinstance(error, GuardOAuthTokenExchangeError):
+        oauth_error = (error.oauth_error or "").strip().lower()
+        if error.status_code not in {400, 401, 403}:
+            return False
+        return oauth_error == "invalid_grant"
+    message = str(error).strip().lower()
+    return "missing, expired, or already consumed" in message
+
+
 def revoke_guard_self_oauth_grant(
     *,
     oauth_client: GuardOAuthClientConfig,
@@ -923,14 +963,26 @@ def run_guard_disconnect_command(
     oauth_client = resolve_guard_oauth_client_config(issuer)
     exchange_now = datetime.fromisoformat(now) if isinstance(now, str) else datetime.now(timezone.utc)
     timestamp = now or exchange_now.isoformat()
-    token_result = refresh_guard_access_token(
-        token_endpoint=oauth_client.token_endpoint,
-        client_id=client_id,
-        refresh_token=refresh_token,
-        dpop_key_material=dpop_key_material,
-        urlopen=urlopen,
-        now=exchange_now,
-    )
+    try:
+        token_result = refresh_guard_access_token(
+            token_endpoint=oauth_client.token_endpoint,
+            client_id=client_id,
+            refresh_token=refresh_token,
+            dpop_key_material=dpop_key_material,
+            urlopen=urlopen,
+            now=exchange_now,
+        )
+    except RuntimeError as error:
+        if not _oauth_refresh_error_means_grant_inactive(error):
+            raise
+        store.clear_oauth_local_credentials()
+        return {
+            "status": "disconnected",
+            "cloud_grant_revoked": False,
+            "cloud_grant_status": "already_inactive",
+            "detail": "Guard Cloud grant was already expired. Cleared local sign-in on this machine.",
+            "reconnect_command": CONNECT_COMMAND,
+        }
     rotated_refresh_token = token_result.refresh_token
     if rotated_refresh_token and rotated_refresh_token != refresh_token:
         _persist_oauth_local_credentials(

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/src/codex_plugin_scanner/guard/config.py

@@ -33,6 +33,12 @@ NON_MIGRATED_GUARD_RUNTIME_FILES = frozenset(
         "guard.db-wal",
     }
 )
+GUARD_HOME_METADATA_FILES = frozenset(
+    {
+        "oauth-keychain-access.json",
+        "system-keyring-availability.json",
+    }
+)
 GUARD_DB_BACKUP_TIMEOUT_SECONDS = 5.0
 GUARD_DB_BACKUP_SLEEP_SECONDS = 0.05
 WORKSPACE_CONFIG_FILENAMES = (".ai-plugin-scanner-guard.toml", ".hol-guard.toml")
@@ -792,7 +798,7 @@ def _copy_guard_database(*, source: Path, destination: Path) -> None:
 def _prune_retired_guard_db_sync_state(database_path: Path) -> None:
     try:
         with sqlite3.connect(database_path) as connection:
-            connection.execute("delete from sync_state where state_key in ('credentials', 'oauth_local_credentials')")
+            connection.execute("delete from sync_state where state_key = 'credentials'")
     except sqlite3.Error:
         return
 
@@ -837,7 +843,7 @@ def _guard_home_has_state(path: Path) -> bool:
     entries = list(path.iterdir())
     if not entries:
         return False
-    if any(entry.name != "guard.db" for entry in entries):
+    if any(entry.name not in {"guard.db", *GUARD_HOME_METADATA_FILES} for entry in entries):
         return True
     database_path = path / "guard.db"
     if not database_path.is_file():
@@ -882,7 +888,7 @@ def _guard_home_has_sync_credentials(path: Path) -> bool:
                 """
                 select 1
                 from sync_state
-                where state_key in ('credentials', 'oauth_local_credentials')
+                where state_key = 'oauth_local_credentials'
                 limit 1
                 """
             ).fetchone()

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/src/codex_plugin_scanner/guard/store_oauth.py

@@ -417,14 +417,14 @@ class StoreOAuthConnectMixin:
             and isinstance(self._oauth_secret_store, FallbackSecretStore)
             and isinstance(self._oauth_secret_store.primary, SystemKeyringSecretStore)
         )
-        if not skip_fallback_first:
-            fallback_secret_payload = self._load_validated_oauth_fallback_secret_payload(
-                fallback_secret_json,
-                secret_hash,
-            )
-            if fallback_secret_payload is not None:
-                self._remember_oauth_secret_payload(secret_ref, secret_hash, fallback_secret_json)
-                return fallback_secret_payload
+        fallback_secret_payload = self._load_validated_oauth_fallback_secret_payload(
+            fallback_secret_json,
+            secret_hash,
+        )
+        prefer_primary_over_fallback = skip_fallback_first and allow_primary
+        if fallback_secret_payload is not None and not prefer_primary_over_fallback:
+            self._remember_oauth_secret_payload(secret_ref, secret_hash, fallback_secret_json)
+            return fallback_secret_payload
         if not allow_primary:
             return None
         for candidate in self._get_secret_candidates(

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/src/codex_plugin_scanner/guard/store_secret_policy_integrity.py

@@ -116,6 +116,10 @@ class StoreSecretPolicyIntegrityMixin:
                     return
                 if self._oauth_primary_direct_test_reads_are_safe() and primary.get_secret(secret_id) == value:
                     return
+                if isinstance(secret_store.fallback, EncryptedFileSecretStore):
+                    fallback_value = self._get_secret_from_store(secret_store.fallback, secret_id)
+                    if fallback_value == value:
+                        return
                 raise RuntimeError("Guard could not persist local Guard Cloud authorization securely.")
         if isinstance(secret_store, UnavailableSecretStore):
             raise RuntimeError(

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.870"
+__version__ = "2.0.872"

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/tests/test_guard_cli.py

@@ -9095,12 +9095,12 @@ url = http://127.0.0.1:8787/guard-canary
         store = GuardStore(home_dir)
         _seed_guard_cloud(store)
 
-        def _fail_auth(_store: GuardStore) -> dict[str, object]:
+        def _fail_auth(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
             raise guard_commands_module.GuardSyncAuthorizationExpiredError(
                 "Guard authorization expired. Run `hol-guard connect` to sign in again."
             )
 
-        monkeypatch.setattr(guard_commands_module, "_resolve_guard_sync_auth_context", _fail_auth)
+        monkeypatch.setattr(guard_commands_module, "sync_supply_chain_bundle", _fail_auth)
 
         guard_commands_module._refresh_cloud_policy_bundle(store, bundle_only=True)
 

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/tests/test_guard_config_paths.py

@@ -394,6 +394,46 @@ def test_migrate_guard_home_state_copies_guard_db_with_sqlite_backup(tmp_path):
     assert row == ("legacy",)
 
 
+def test_migrate_guard_home_state_preserves_oauth_local_credentials(tmp_path):
+    canonical_home = tmp_path / ".hol-guard"
+    legacy_home = tmp_path / ".config" / ".ai-plugin-scanner-guard"
+    legacy_store = GuardStore(legacy_home)
+    _seed_guard_cloud(legacy_store, workspace_id="workspace-123")
+
+    _migrate_guard_home_state(source=legacy_home, destination=canonical_home)
+
+    canonical_store = GuardStore(canonical_home)
+    oauth_payload = canonical_store.get_sync_payload("oauth_local_credentials")
+
+    assert isinstance(oauth_payload, dict)
+    assert canonical_store.get_cloud_workspace_id() == "workspace-123"
+
+
+def test_migrate_guard_home_state_replaces_retired_credentials_only_destination(tmp_path):
+    canonical_home = tmp_path / ".hol-guard"
+    legacy_home = tmp_path / ".config" / ".ai-plugin-scanner-guard"
+    canonical_store = GuardStore(canonical_home)
+    canonical_store.set_sync_payload(
+        "credentials",
+        {
+            "sync_url": "https://hol.org/api/guard/receipts/sync",
+            "access_token": "demo-token",
+        },
+        "2026-05-19T00:00:00Z",
+    )
+    legacy_store = GuardStore(legacy_home)
+    _seed_guard_cloud(legacy_store, workspace_id="workspace-123")
+
+    _migrate_guard_home_state(source=legacy_home, destination=canonical_home)
+
+    migrated_store = GuardStore(canonical_home)
+    oauth_payload = migrated_store.get_sync_payload("oauth_local_credentials")
+
+    assert isinstance(oauth_payload, dict)
+    assert migrated_store.get_cloud_workspace_id() == "workspace-123"
+    assert migrated_store.get_sync_payload("credentials") is None
+
+
 def test_resolve_guard_home_does_not_migrate_retired_legacy_credentials(tmp_path, monkeypatch):
     home_dir = tmp_path / "home"
     canonical_home = home_dir / ".hol-guard"

{plugin_scanner-2.0.870 → plugin_scanner-2.0.872}/tests/test_guard_oauth_device_connect.py

@@ -56,6 +56,10 @@ def _install_fake_system_keyring(monkeypatch) -> _FakeSystemKeyringModule:
     return module
 
 
+def _disable_oauth_persistence_assert(monkeypatch) -> None:
+    monkeypatch.setattr(GuardStore, "_assert_oauth_secret_persisted", lambda self, secret_id, value: None)
+
+
 class _Args:
     guard_command = "login"
     token = None
@@ -404,8 +408,11 @@ def test_headless_connect_ci_safe_uses_explicit_label_and_restricted_scopes(tmp_
 
 def test_disconnect_revokes_cloud_grant_with_runtime_access_token_and_clears_local_oauth_credentials(
     tmp_path: Path,
+    monkeypatch,
 ) -> None:
     guard_home = tmp_path / "guard-home"
+    _install_fake_system_keyring(monkeypatch)
+    _disable_oauth_persistence_assert(monkeypatch)
     store = GuardStore(guard_home)
     dpop_key_material = generate_dpop_key_pair()
     store.set_oauth_local_credentials(
@@ -502,8 +509,13 @@ def test_disconnect_revokes_cloud_grant_with_runtime_access_token_and_clears_loc
     assert "refresh-123" not in str(requests[1]["body"])
 
 
-def test_disconnect_keeps_local_oauth_credentials_when_self_revoke_fails(tmp_path: Path) -> None:
+def test_disconnect_keeps_local_oauth_credentials_when_self_revoke_fails(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
     guard_home = tmp_path / "guard-home"
+    _install_fake_system_keyring(monkeypatch)
+    _disable_oauth_persistence_assert(monkeypatch)
     store = GuardStore(guard_home)
     dpop_key_material = generate_dpop_key_pair()
     store.set_oauth_local_credentials(
@@ -579,6 +591,241 @@ def test_disconnect_keeps_local_oauth_credentials_when_self_revoke_fails(tmp_pat
     assert credentials["refresh_token"] == "refresh-rotated"
 
 
+def test_disconnect_clears_local_oauth_credentials_when_refresh_grant_is_already_expired(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    guard_home = tmp_path / "guard-home"
+    _install_fake_system_keyring(monkeypatch)
+    _disable_oauth_persistence_assert(monkeypatch)
+    store = GuardStore(guard_home)
+    dpop_key_material = generate_dpop_key_pair()
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-123",
+        dpop_private_key_pem=dpop_key_material.private_key_pem,
+        dpop_public_jwk=dpop_key_material.public_jwk,
+        dpop_public_jwk_thumbprint=dpop_key_material.public_jwk_thumbprint,
+        grant_id="grant-123",
+        machine_id="machine-123",
+        workspace_id="workspace-123",
+        runtime_id="hol-guard",
+        runtime_label="HOL Guard CLI",
+        now="2026-06-01T12:00:00+00:00",
+    )
+    requests: list[str] = []
+
+    def fake_urlopen(request: urllib.request.Request, timeout: int):
+        del timeout
+        requests.append(request.full_url)
+        raise urllib.error.HTTPError(
+            request.full_url,
+            400,
+            "invalid_grant",
+            hdrs={"Content-Type": "application/json"},
+            fp=io.BytesIO(
+                json.dumps(
+                    {
+                        "error": "invalid_grant",
+                        "error_description": "The grant is missing, expired, or already consumed.",
+                    }
+                ).encode("utf-8")
+            ),
+        )
+
+    payload = connect_flow.run_guard_disconnect_command(
+        store=store,
+        revoke_cloud_grant=True,
+        urlopen=fake_urlopen,
+        now="2026-06-01T12:05:00+00:00",
+    )
+
+    assert payload == {
+        "status": "disconnected",
+        "cloud_grant_revoked": False,
+        "cloud_grant_status": "already_inactive",
+        "detail": "Guard Cloud grant was already expired. Cleared local sign-in on this machine.",
+        "reconnect_command": "hol-guard connect",
+    }
+    assert requests == ["https://hol.org/api/guard/oauth/token"]
+    assert store.get_oauth_local_credentials() is None
+
+
+def test_disconnect_keeps_local_oauth_credentials_when_refresh_error_is_not_invalid_grant(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    guard_home = tmp_path / "guard-home"
+    _install_fake_system_keyring(monkeypatch)
+    _disable_oauth_persistence_assert(monkeypatch)
+    store = GuardStore(guard_home)
+    dpop_key_material = generate_dpop_key_pair()
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-123",
+        dpop_private_key_pem=dpop_key_material.private_key_pem,
+        dpop_public_jwk=dpop_key_material.public_jwk,
+        dpop_public_jwk_thumbprint=dpop_key_material.public_jwk_thumbprint,
+        grant_id="grant-123",
+        machine_id="machine-123",
+        workspace_id="workspace-123",
+        runtime_id="hol-guard",
+        runtime_label="HOL Guard CLI",
+        now="2026-06-01T12:00:00+00:00",
+    )
+    requests: list[str] = []
+
+    def fake_urlopen(request: urllib.request.Request, timeout: int):
+        del timeout
+        requests.append(request.full_url)
+        raise urllib.error.HTTPError(
+            request.full_url,
+            400,
+            "invalid_grant_type",
+            hdrs={"Content-Type": "application/json"},
+            fp=io.BytesIO(
+                json.dumps(
+                    {
+                        "error": "invalid_grant_type",
+                        "error_description": "unsupported refresh flow",
+                    }
+                ).encode("utf-8")
+            ),
+        )
+
+    with pytest.raises(RuntimeError, match="Guard OAuth token exchange failed: unsupported refresh flow"):
+        connect_flow.run_guard_disconnect_command(
+            store=store,
+            revoke_cloud_grant=True,
+            urlopen=fake_urlopen,
+            now="2026-06-01T12:05:00+00:00",
+        )
+
+    assert requests == ["https://hol.org/api/guard/oauth/token"]
+    credentials = store.get_oauth_local_credentials()
+    assert credentials is not None
+    assert credentials["refresh_token"] == "refresh-123"
+
+
+def test_disconnect_keeps_local_oauth_credentials_when_invalid_grant_comes_from_server_error(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    guard_home = tmp_path / "guard-home"
+    _install_fake_system_keyring(monkeypatch)
+    _disable_oauth_persistence_assert(monkeypatch)
+    store = GuardStore(guard_home)
+    dpop_key_material = generate_dpop_key_pair()
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-123",
+        dpop_private_key_pem=dpop_key_material.private_key_pem,
+        dpop_public_jwk=dpop_key_material.public_jwk,
+        dpop_public_jwk_thumbprint=dpop_key_material.public_jwk_thumbprint,
+        grant_id="grant-123",
+        machine_id="machine-123",
+        workspace_id="workspace-123",
+        runtime_id="hol-guard",
+        runtime_label="HOL Guard CLI",
+        now="2026-06-01T12:00:00+00:00",
+    )
+    requests: list[str] = []
+
+    def fake_urlopen(request: urllib.request.Request, timeout: int):
+        del timeout
+        requests.append(request.full_url)
+        raise urllib.error.HTTPError(
+            request.full_url,
+            500,
+            "server_error",
+            hdrs={"Content-Type": "application/json"},
+            fp=io.BytesIO(
+                json.dumps(
+                    {
+                        "error": "invalid_grant",
+                        "error_description": "temporary upstream mismatch",
+                    }
+                ).encode("utf-8")
+            ),
+        )
+
+    with pytest.raises(RuntimeError, match="Guard OAuth token exchange failed: temporary upstream mismatch"):
+        connect_flow.run_guard_disconnect_command(
+            store=store,
+            revoke_cloud_grant=True,
+            urlopen=fake_urlopen,
+            now="2026-06-01T12:05:00+00:00",
+        )
+
+    assert requests == ["https://hol.org/api/guard/oauth/token"]
+    credentials = store.get_oauth_local_credentials()
+    assert credentials is not None
+    assert credentials["refresh_token"] == "refresh-123"
+
+
+def test_disconnect_keeps_local_oauth_credentials_when_description_matches_but_oauth_error_does_not(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    guard_home = tmp_path / "guard-home"
+    _install_fake_system_keyring(monkeypatch)
+    _disable_oauth_persistence_assert(monkeypatch)
+    store = GuardStore(guard_home)
+    dpop_key_material = generate_dpop_key_pair()
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-123",
+        dpop_private_key_pem=dpop_key_material.private_key_pem,
+        dpop_public_jwk=dpop_key_material.public_jwk,
+        dpop_public_jwk_thumbprint=dpop_key_material.public_jwk_thumbprint,
+        grant_id="grant-123",
+        machine_id="machine-123",
+        workspace_id="workspace-123",
+        runtime_id="hol-guard",
+        runtime_label="HOL Guard CLI",
+        now="2026-06-01T12:00:00+00:00",
+    )
+    requests: list[str] = []
+
+    def fake_urlopen(request: urllib.request.Request, timeout: int):
+        del timeout
+        requests.append(request.full_url)
+        raise urllib.error.HTTPError(
+            request.full_url,
+            400,
+            "invalid_request",
+            hdrs={"Content-Type": "application/json"},
+            fp=io.BytesIO(
+                json.dumps(
+                    {
+                        "error": "invalid_request",
+                        "error_description": "The grant is missing, expired, or already consumed.",
+                    }
+                ).encode("utf-8")
+            ),
+        )
+
+    with pytest.raises(
+        RuntimeError,
+        match="Guard OAuth token exchange failed: The grant is missing, expired, or already consumed.",
+    ):
+        connect_flow.run_guard_disconnect_command(
+            store=store,
+            revoke_cloud_grant=True,
+            urlopen=fake_urlopen,
+            now="2026-06-01T12:05:00+00:00",
+        )
+
+    assert requests == ["https://hol.org/api/guard/oauth/token"]
+    credentials = store.get_oauth_local_credentials()
+    assert credentials is not None
+    assert credentials["refresh_token"] == "refresh-123"
+
+
 def test_headless_connect_polls_until_success_and_persists_oauth_credentials(tmp_path: Path) -> None:
     guard_home = tmp_path / "guard-home"
     store = GuardStore(guard_home)
@@ -788,7 +1035,7 @@ def test_headless_connect_slows_down_polling_when_server_requests_it(tmp_path: P
     assert sleeps == [7]
 
 
-def test_headless_connect_rejects_macos_keychain_readback_failure(
+def test_headless_connect_uses_encrypted_fallback_when_macos_keychain_readback_fails(
     tmp_path: Path,
     monkeypatch,
 ) -> None:
@@ -827,28 +1074,30 @@ def test_headless_connect_rejects_macos_keychain_readback_failure(
         def read(self) -> bytes:
             return json.dumps(self._payload).encode("utf-8")
 
-    with pytest.raises(RuntimeError, match="persist local Guard Cloud authorization securely"):
-        connect_flow.run_guard_device_connect_command(
-            store=store,
-            connect_url="https://hol.org/guard/connect",
-            request_device_authorization=fake_request,
-            token_urlopen=lambda request, timeout: _Response(
-                {
-                    "access_token": _fake_access_token(
-                        grant_id="grant-123",
-                        machine_id="machine-123",
-                        workspace_id="workspace-123",
-                    ),
-                    "refresh_token": "refresh-123",
-                    "expires_in": 3600,
-                    "scope": "guard:runtime.sync guard:offline_access",
-                    "token_type": "Bearer",
-                }
-            ),
-            now="2026-06-01T12:00:00+00:00",
-        )
+    payload = connect_flow.run_guard_device_connect_command(
+        store=store,
+        connect_url="https://hol.org/guard/connect",
+        request_device_authorization=fake_request,
+        token_urlopen=lambda request, timeout: _Response(
+            {
+                "access_token": _fake_access_token(
+                    grant_id="grant-123",
+                    machine_id="machine-123",
+                    workspace_id="workspace-123",
+                ),
+                "refresh_token": "refresh-123",
+                "expires_in": 3600,
+                "scope": "guard:runtime.sync guard:offline_access",
+                "token_type": "Bearer",
+            }
+        ),
+        now="2026-06-01T12:00:00+00:00",
+    )
 
-    assert store.get_oauth_local_credentials() is None
+    assert payload["status"] == "connected"
+    credentials = store.get_oauth_local_credentials(allow_primary=False)
+    assert credentials is not None
+    assert credentials["workspace_id"] == "workspace-123"
 
 
 def test_headless_connect_expired_code_surfaces_retry_command(tmp_path: Path) -> None: