plugin-scanner 2.0.884__tar.gz → 2.0.886__tar.gz

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.884
+Version: 2.0.886
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.884"
+version = "2.0.886"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.884"
+version = "2.0.886"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/guard/cli/_commands_shared.py

@@ -200,6 +200,7 @@ from .connect_flow import (
     build_connect_status_payload,
     connect_recovery_command,
     connect_state_requires_oauth,
+    guard_api_base_path,
     normalize_connect_state_for_missing_oauth,
     resolve_connect_url,
     run_guard_browser_connect_command,

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -191,10 +191,12 @@ def _refresh_cloud_policy_bundle(store: GuardStore, *, bundle_only: bool = False
 
 def _guard_cloud_urls_for_connect(connect_url: str) -> dict[str, str]:
     normalized_connect_url, allowed_origin = resolve_connect_url(connect_url)
-    dashboard_url = f"{allowed_origin}/guard"
+    prefix = guard_api_base_path(allowed_origin)
+    dashboard_url = f"{allowed_origin}{prefix}/guard"
+    api_base = f"{allowed_origin}{prefix}/api/guard"
     return {
         "connect_url": normalized_connect_url,
-        "sync_url": f"{allowed_origin}/api/guard/receipts/sync",
+        "sync_url": f"{api_base}/receipts/sync",
         "dashboard_url": dashboard_url,
         "inbox_url": f"{dashboard_url}/inbox",
         "fleet_url": f"{dashboard_url}/protect",

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/guard/cli/connect_flow.py

@@ -34,6 +34,7 @@ from .oauth_client import (
     build_pkce_s256_challenge,
     generate_dpop_key_pair,
     generate_pkce_verifier,
+    guard_api_base_path,
     resolve_guard_oauth_client_config,
 )
 
@@ -449,7 +450,8 @@ def resolve_connect_url(connect_url: str) -> tuple[str, str]:
 
 def _oauth_sync_url_from_issuer(issuer: str) -> str:
     oauth_client = resolve_guard_oauth_client_config(issuer)
-    return f"{oauth_client.issuer}/api/guard/receipts/sync"
+    prefix = guard_api_base_path(issuer)
+    return f"{oauth_client.issuer}{prefix}/api/guard/receipts/sync"
 
 
 def _build_sync_auth_context(

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/guard/cli/oauth_client.py

@@ -19,13 +19,18 @@ LOCAL_GUARD_OAUTH_CLIENT_ID = "guard-local-daemon-local"
 
 PRODUCTION_GUARD_ISSUER = "https://hol.org"
 STAGING_GUARD_ISSUER = "https://staging.hol.org"
+REGISTRY_STAGING_GUARD_ISSUER = "https://registry-staging.hol.org"
 LOCAL_GUARD_ISSUER = "http://127.0.0.1:3000"
 
 _ALLOWED_PRODUCTION_GUARD_ORIGINS = frozenset({PRODUCTION_GUARD_ISSUER})
-_ALLOWED_STAGING_GUARD_ORIGINS = frozenset({STAGING_GUARD_ISSUER})
+_ALLOWED_STAGING_GUARD_ORIGINS = frozenset({STAGING_GUARD_ISSUER, REGISTRY_STAGING_GUARD_ISSUER})
 _LOOPBACK_GUARD_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
 _DOCKER_LAB_GUARD_HOSTS = frozenset({"host.docker.internal"})
 
+_GUARD_OAUTH_PATH_PREFIXES: dict[str, str] = {
+    REGISTRY_STAGING_GUARD_ISSUER: "/points",
+}
+
 _PKCE_ALLOWED_CHARACTERS = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~")
 
 
@@ -101,12 +106,13 @@ def _oauth_endpoints(origin: str) -> GuardOAuthClientConfig:
         "staging": STAGING_GUARD_OAUTH_CLIENT_ID,
         "local": LOCAL_GUARD_OAUTH_CLIENT_ID,
     }[environment]
+    prefix = _GUARD_OAUTH_PATH_PREFIXES.get(origin.lower(), "")
     return GuardOAuthClientConfig(
         issuer=origin,
-        authorize_endpoint=f"{origin}/api/guard/oauth/authorize",
-        token_endpoint=f"{origin}/api/guard/oauth/token",
-        device_authorization_endpoint=f"{origin}/api/guard/oauth/device/authorize",
-        jwks_endpoint=f"{origin}/api/guard/oauth/jwks",
+        authorize_endpoint=f"{origin}{prefix}/api/guard/oauth/authorize",
+        token_endpoint=f"{origin}{prefix}/api/guard/oauth/token",
+        device_authorization_endpoint=f"{origin}{prefix}/api/guard/oauth/device/authorize",
+        jwks_endpoint=f"{origin}{prefix}/api/guard/oauth/jwks",
         client_id=client_id,
     )
 
@@ -120,6 +126,12 @@ def detect_guard_oauth_environment(issuer: str) -> str:
     return "production"
 
 
+def guard_api_base_path(issuer: str) -> str:
+    """Return the API path prefix for a given issuer (e.g. '/points' for registry-staging)."""
+    origin = _require_allowlisted_guard_oauth_origin(issuer)
+    return _GUARD_OAUTH_PATH_PREFIXES.get(origin.lower(), "")
+
+
 def resolve_guard_oauth_client_config(issuer: str) -> GuardOAuthClientConfig:
     return _oauth_endpoints(_require_allowlisted_guard_oauth_origin(issuer))
 

plugin_scanner-2.0.886/src/codex_plugin_scanner/guard/package_firewall_defaults.py

@@ -0,0 +1,38 @@
+"""Shared package-firewall entitlement defaults with no GuardStore dependency."""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+
+PACKAGE_FIREWALL_PAID_TIERS = frozenset({"paid", "premium", "pro", "team", "enterprise", "guard_cloud", "guard-cloud"})
+_OAUTH_ENTITLEMENT_FALLBACK_TTL = timedelta(days=30)
+
+
+def _optional_string(value: object) -> str | None:
+    if not isinstance(value, str):
+        return None
+    normalized = value.strip()
+    return normalized or None
+
+
+def build_guard_local_entitlement_defaults(
+    record: dict[str, object],
+    *,
+    now: datetime | None = None,
+) -> dict[str, object] | None:
+    plan_id = _optional_string(record.get("plan_id")) or _optional_string(record.get("tier"))
+    if plan_id is None:
+        return None
+    normalized_tier = plan_id.lower()
+    allowed_value = record.get("supply_chain_firewall")
+    allowed = allowed_value if isinstance(allowed_value, bool) else normalized_tier in PACKAGE_FIREWALL_PAID_TIERS
+    expires_at = _optional_string(record.get("expires_at"))
+    if expires_at is None:
+        resolved_now = now or datetime.now(timezone.utc)
+        expires_at = (resolved_now + _OAUTH_ENTITLEMENT_FALLBACK_TTL).isoformat()
+    return {
+        "plan_id": normalized_tier,
+        "supply_chain_entitlement_expires_at": expires_at,
+        "supply_chain_firewall": allowed,
+        "supply_chain_plan_id": normalized_tier,
+    }

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/guard/package_firewall_entitlement.py

@@ -2,17 +2,19 @@
 
 from __future__ import annotations
 
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 
+from .package_firewall_defaults import (
+    PACKAGE_FIREWALL_PAID_TIERS,
+    build_guard_local_entitlement_defaults,
+)
 from .store import GuardStore
 
-PACKAGE_FIREWALL_PAID_TIERS = frozenset({"paid", "premium", "pro", "team", "enterprise", "guard_cloud", "guard-cloud"})
 PACKAGE_FIREWALL_CONNECT_CTA = (
     "Connect HOL Guard Cloud to check package firewall access and run package firewall actions."
 )
 PACKAGE_FIREWALL_RECONNECT_CTA = "Reconnect HOL Guard Cloud to refresh package firewall access."
 PACKAGE_FIREWALL_UPGRADE_CTA = "Upgrade to HOL Guard Cloud to run package firewall actions."
-_OAUTH_ENTITLEMENT_FALLBACK_TTL = timedelta(days=30)
 
 
 def _optional_string(value: object) -> str | None:
@@ -44,22 +46,7 @@ def build_oauth_package_firewall_entitlement(
     record = payload.get("guard_local_entitlement")
     if not isinstance(record, dict):
         return None
-    plan_id = _optional_string(record.get("plan_id")) or _optional_string(record.get("tier"))
-    if plan_id is None:
-        return None
-    normalized_tier = plan_id.lower()
-    allowed_value = record.get("supply_chain_firewall")
-    allowed = allowed_value if isinstance(allowed_value, bool) else normalized_tier in PACKAGE_FIREWALL_PAID_TIERS
-    expires_at = _optional_string(record.get("expires_at"))
-    if expires_at is None:
-        resolved_now = now or datetime.now(timezone.utc)
-        expires_at = (resolved_now + _OAUTH_ENTITLEMENT_FALLBACK_TTL).isoformat()
-    return {
-        "plan_id": normalized_tier,
-        "supply_chain_entitlement_expires_at": expires_at,
-        "supply_chain_firewall": allowed,
-        "supply_chain_plan_id": normalized_tier,
-    }
+    return build_guard_local_entitlement_defaults(record, now=now)
 
 
 def _bundle_entitlement(payload: object) -> dict[str, object] | None:

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/guard/store_oauth.py

@@ -4,6 +4,8 @@
 
 from __future__ import annotations
 
+from .package_firewall_defaults import build_guard_local_entitlement_defaults
+
 # ruff: noqa: F403,F405
 from .store_base import *
 
@@ -11,6 +13,8 @@ from .store_base import *
 class StoreOAuthConnectMixin:
     def get_cloud_sync_profile(self) -> dict[str, str] | None:
         oauth_payload = self.get_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
+        if not isinstance(oauth_payload, dict) and self.repair_oauth_local_credential_storage_from_primary():
+            oauth_payload = self.get_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
         if isinstance(oauth_payload, dict):
             oauth_health = self.get_oauth_local_credential_health()
             if not isinstance(oauth_health, dict) or oauth_health.get("state") != "healthy":
@@ -201,6 +205,8 @@ class StoreOAuthConnectMixin:
 
     def get_oauth_local_credential_health(self) -> dict[str, object]:
         payload = self.get_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
+        if not isinstance(payload, dict) and self.repair_oauth_local_credential_storage_from_primary():
+            payload = self.get_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
         health: dict[str, object] = {
             "configured": isinstance(payload, dict),
             "state": "not_configured",
@@ -330,7 +336,11 @@ class StoreOAuthConnectMixin:
         with self.hold_oauth_credential_lock():
             payload = self.get_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
             if not isinstance(payload, dict):
-                return False
+                recovered_payload = self._recover_missing_oauth_local_credentials_payload(now=_now())
+                if recovered_payload is None:
+                    return False
+                self.set_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY, recovered_payload, _now())
+                return True
             repaired_payload = None
             if self._should_attempt_oauth_storage_repair():
                 self._mark_oauth_storage_repair_attempt()
@@ -364,6 +374,128 @@ class StoreOAuthConnectMixin:
                 _OAUTH_HEALTH_RESULT_PROCESS_CACHE.pop(cache_key, None)
             return True
 
+    def _recover_missing_oauth_local_credentials_payload(self, *, now: str) -> dict[str, object] | None:
+        secret_ref = self._oauth_local_credentials_ref
+        secret_json = self._load_oauth_secret_json_without_payload(secret_ref)
+        if secret_json is None:
+            return None
+        secret_payload = self._parse_oauth_secret_payload(secret_json)
+        if secret_payload is None:
+            return None
+        latest_state = self.get_latest_guard_connect_state(now=now)
+        issuer = self._recover_oauth_issuer_for_missing_metadata(latest_state)
+        if issuer is None:
+            return None
+        try:
+            oauth_client = resolve_guard_oauth_client_config(issuer)
+        except ValueError:
+            return None
+        workspace_metadata = self._recover_oauth_workspace_metadata()
+        recovered_payload: dict[str, object] = {
+            "issuer": oauth_client.issuer,
+            "client_id": oauth_client.client_id,
+            _OAUTH_LOCAL_CREDENTIALS_REF_KEY: secret_ref,
+            _OAUTH_LOCAL_CREDENTIALS_HASH_KEY: _secret_fingerprint(secret_json),
+        }
+        device = self.get_device_metadata()
+        installation_id = device.get("installation_id")
+        if isinstance(installation_id, str) and installation_id:
+            recovered_payload["machine_id"] = installation_id
+        for key in ("workspace_id", "supply_chain_plan_id", "supply_chain_entitlement_expires_at"):
+            value = workspace_metadata.get(key)
+            if isinstance(value, str) and value:
+                recovered_payload[key] = value
+        supply_chain_firewall = workspace_metadata.get("supply_chain_firewall")
+        if isinstance(supply_chain_firewall, bool):
+            recovered_payload["supply_chain_firewall"] = supply_chain_firewall
+        if (
+            self._build_oauth_local_credentials_result(
+                metadata=self._oauth_local_credentials_metadata(recovered_payload) or {},
+                secret_payload=secret_payload,
+            )
+            is None
+        ):
+            return None
+        self._mirror_oauth_secret_to_fallback(secret_ref, secret_json)
+        self._remember_oauth_secret_payload(
+            secret_ref,
+            str(recovered_payload[_OAUTH_LOCAL_CREDENTIALS_HASH_KEY]),
+            secret_json,
+        )
+        return recovered_payload
+
+    def _load_oauth_secret_json_without_payload(self, secret_ref: str) -> str | None:
+        primary_secret_json = None
+        secret_store = self._oauth_secret_store
+        if isinstance(secret_store, FallbackSecretStore):
+            primary_secret_json = self._get_secret_from_primary_store(secret_store.primary, secret_ref)
+        else:
+            primary_secret_json = self._get_secret_from_store(secret_store, secret_ref)
+        if isinstance(primary_secret_json, str) and self._parse_oauth_secret_payload(primary_secret_json) is not None:
+            return primary_secret_json
+        if not self._oauth_fallback_recovery_allowed():
+            return None
+        if self._oauth_primary_repair_available() and not self._oauth_primary_secret_definitely_missing(secret_ref):
+            return None
+        fallback_secret_json = self._load_oauth_fallback_secret_json(secret_ref)
+        if isinstance(fallback_secret_json, str) and self._parse_oauth_secret_payload(fallback_secret_json) is not None:
+            return fallback_secret_json
+        return None
+
+    @staticmethod
+    def _recover_oauth_issuer_for_missing_metadata(latest_state: dict[str, object] | None) -> str | None:
+        if not isinstance(latest_state, dict):
+            return None
+        allowed_origin = latest_state.get("allowed_origin")
+        if isinstance(allowed_origin, str) and allowed_origin.strip():
+            return allowed_origin.strip()
+        sync_url = latest_state.get("sync_url")
+        if isinstance(sync_url, str) and sync_url.strip():
+            return _allowed_origin_from_sync_url(sync_url.strip())
+        return None
+
+    def _recover_oauth_workspace_metadata(self) -> dict[str, object]:
+        payload = self.get_sync_payload("supply_chain_bundle_entitlement")
+        workspace_id = None
+        entitlement_fields: dict[str, object] = {}
+        if isinstance(payload, dict):
+            raw_workspace_id = payload.get("workspace_id")
+            if isinstance(raw_workspace_id, str) and raw_workspace_id.strip():
+                workspace_id = raw_workspace_id.strip()
+            raw_tier = payload.get("tier")
+            if isinstance(raw_tier, str) and raw_tier.strip():
+                recovered_entitlement = build_guard_local_entitlement_defaults(
+                    {"tier": raw_tier.strip()},
+                    now=datetime.now(timezone.utc),
+                )
+                if isinstance(recovered_entitlement, dict):
+                    entitlement_fields.update(recovered_entitlement)
+        if workspace_id is None:
+            with self._connect() as connection:
+                row = connection.execute(
+                    """
+                    select workspace_id
+                    from guard_supply_chain_bundle_cache
+                    order by cached_at desc
+                    limit 1
+                    """
+                ).fetchone()
+            if row is not None:
+                raw_workspace_id = row["workspace_id"]
+                if isinstance(raw_workspace_id, str) and raw_workspace_id.strip():
+                    workspace_id = raw_workspace_id.strip()
+        metadata: dict[str, object] = {}
+        if workspace_id is not None:
+            metadata["workspace_id"] = workspace_id
+        for key in ("supply_chain_plan_id", "supply_chain_entitlement_expires_at"):
+            value = entitlement_fields.get(key)
+            if isinstance(value, str) and value:
+                metadata[key] = value
+        supply_chain_firewall = entitlement_fields.get("supply_chain_firewall")
+        if isinstance(supply_chain_firewall, bool):
+            metadata["supply_chain_firewall"] = supply_chain_firewall
+        return metadata
+
     @staticmethod
     def _build_recovered_oauth_local_credentials_inputs(
         credentials: dict[str, object],

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.884"
+__version__ = "2.0.886"

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/tests/test_guard_connect_flow.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import sys
 import time
 import urllib.error
 import urllib.request
@@ -23,6 +24,7 @@ from codex_plugin_scanner.guard.daemon import server as daemon_server_module
 from codex_plugin_scanner.guard.package_firewall_entitlement import resolve_package_firewall_entitlement
 from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
 from codex_plugin_scanner.guard.store import GuardStore
+from codex_plugin_scanner.guard.store_base import SystemKeyringSecretStore
 from tests.test_guard_store_migrations import _install_fake_system_keyring
 
 
@@ -769,6 +771,158 @@ def test_sync_local_guard_cloud_proof_repairs_degraded_oauth_from_encrypted_fall
     assert latest_state["milestone"] == "first_sync_succeeded"
 
 
+def test_connect_status_recovers_missing_oauth_metadata_from_surviving_secret(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _install_fake_system_keyring(monkeypatch)
+    monkeypatch.setattr(
+        SystemKeyringSecretStore,
+        "get_secret_with_timeout",
+        lambda self, secret_id, timeout_seconds=0.0: self.get_secret(secret_id),
+    )
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_oauth_local_credentials(
+        issuer="https://hol.org",
+        client_id="guard-local-daemon",
+        refresh_token="refresh-token-1",
+        dpop_private_key_pem="private-key-1",
+        dpop_public_jwk={"kty": "EC", "crv": "P-256", "x": "x-value-1", "y": "y-value-1"},
+        dpop_public_jwk_thumbprint="thumbprint-1",
+        grant_id="grant-1",
+        machine_id="machine-1",
+        workspace_id="workspace-1",
+        supply_chain_plan_id="premium",
+        supply_chain_firewall=True,
+        now="2026-06-24T18:20:00+00:00",
+    )
+    store.set_sync_payload(
+        "supply_chain_bundle_entitlement",
+        {
+            "workspace_id": "workspace-1",
+            "tier": "premium",
+        },
+        "2026-06-24T18:20:00+00:00",
+    )
+    store.set_sync_payload(
+        "sync_summary",
+        {
+            "synced_at": "2026-06-24T18:21:00+00:00",
+            "receipts_stored": 5,
+            "inventory_tracked": 3,
+        },
+        "2026-06-24T18:21:00+00:00",
+    )
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now="2026-06-24T18:20:00+00:00",
+        request_id="connect-1",
+    )
+    store.record_latest_guard_connect_sync_success(
+        sync_payload={
+            "synced_at": "2026-06-24T18:21:00+00:00",
+            "receipts_stored": 5,
+            "inventory_items": 3,
+        },
+        now="2026-06-24T18:21:00+00:00",
+        request_id="connect-1",
+    )
+    store.delete_sync_payload("oauth_local_credentials")
+
+    payload = build_connect_status_payload(
+        store=store,
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        connect_url="https://hol.org/guard/connect",
+    )
+
+    assert payload["status"] == "connected"
+    assert payload["milestone"] == "first_sync_succeeded"
+    latest_state = payload["latest_connect_state"]
+    assert isinstance(latest_state, dict)
+    assert latest_state["status"] == "connected"
+    assert latest_state["milestone"] == "first_sync_succeeded"
+    repaired_payload = store.get_sync_payload("oauth_local_credentials")
+    assert isinstance(repaired_payload, dict)
+    assert repaired_payload["workspace_id"] == "workspace-1"
+    assert repaired_payload["supply_chain_plan_id"] == "premium"
+    assert repaired_payload["supply_chain_firewall"] is True
+    assert isinstance(repaired_payload["supply_chain_entitlement_expires_at"], str)
+    assert store.get_oauth_local_credential_health()["state"] == "healthy"
+    assert store.get_cloud_sync_profile() == {
+        "auth_mode": "oauth",
+        "sync_url": "https://hol.org/api/guard/receipts/sync",
+        "workspace_id": "workspace-1",
+    }
+    entitlement = resolve_package_firewall_entitlement(store)
+    assert entitlement["allowed"] is True
+    assert entitlement["tier"] == "premium"
+    assert entitlement["upgrade_cta"] is None
+
+
+def test_connect_status_does_not_recover_missing_oauth_metadata_from_fallback_only_secret_on_macos(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "darwin")
+    keyring_module = _install_fake_system_keyring(monkeypatch)
+    monkeypatch.setattr(
+        SystemKeyringSecretStore,
+        "get_secret_with_timeout",
+        lambda self, secret_id, timeout_seconds=0.0: self.get_secret(secret_id),
+    )
+    store = GuardStore(tmp_path / "guard-home")
+    store.record_guard_connect_pairing_completed(
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        allowed_origin="https://hol.org",
+        now="2026-06-24T18:20:00+00:00",
+        request_id="connect-1",
+    )
+    store.record_latest_guard_connect_sync_success(
+        sync_payload={
+            "synced_at": "2026-06-24T18:21:00+00:00",
+            "receipts_stored": 5,
+            "inventory_items": 3,
+        },
+        now="2026-06-24T18:21:00+00:00",
+        request_id="connect-1",
+    )
+    store.set_sync_payload(
+        "supply_chain_bundle_entitlement",
+        {
+            "workspace_id": "workspace-1",
+            "tier": "premium",
+        },
+        "2026-06-24T18:20:00+00:00",
+    )
+    fallback_store = store._resolve_oauth_fallback_store()
+    assert fallback_store is not None
+    fallback_store.set_secret(
+        store._oauth_local_credentials_ref,
+        json.dumps(
+            {
+                "refresh_token": "refresh-token-1",
+                "dpop_private_key_pem": "private-key-1",
+                "dpop_public_jwk": {"kty": "EC", "crv": "P-256", "x": "x-value-1", "y": "y-value-1"},
+                "dpop_public_jwk_thumbprint": "thumbprint-1",
+            },
+            sort_keys=True,
+            separators=(",", ":"),
+        ),
+    )
+    keyring_module.delete_password("hol-guard.oauth", store._oauth_local_credentials_ref)
+
+    payload = build_connect_status_payload(
+        store=store,
+        sync_url="https://hol.org/api/guard/receipts/sync",
+        connect_url="https://hol.org/guard/connect",
+    )
+
+    assert payload["status"] == "retry_required"
+    assert payload["milestone"] == "first_sync_failed"
+    assert store.get_sync_payload("oauth_local_credentials") is None
+
+
 def test_retry_required_connect_state_prefers_reconnect_over_false_paywall(tmp_path: Path) -> None:
     store = GuardStore(tmp_path / "guard-home")
     store.set_oauth_local_credentials(

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/tests/test_guard_oauth_client.py

@@ -9,6 +9,7 @@ from codex_plugin_scanner.guard.cli.oauth_client import (
     detect_guard_oauth_environment,
     generate_dpop_key_pair,
     generate_pkce_verifier,
+    guard_api_base_path,
     resolve_guard_oauth_client_config,
     validate_guard_sync_endpoint,
 )
@@ -33,6 +34,32 @@ def test_resolve_guard_oauth_client_config_for_staging() -> None:
     assert detect_guard_oauth_environment(config.issuer) == "staging"
 
 
+def test_resolve_guard_oauth_client_config_for_registry_staging() -> None:
+    config = resolve_guard_oauth_client_config("https://registry-staging.hol.org")
+
+    assert config.client_id == STAGING_GUARD_OAUTH_CLIENT_ID
+    assert config.issuer == "https://registry-staging.hol.org"
+    assert config.authorize_endpoint == "https://registry-staging.hol.org/points/api/guard/oauth/authorize"
+    assert config.token_endpoint == "https://registry-staging.hol.org/points/api/guard/oauth/token"
+    assert config.device_authorization_endpoint == "https://registry-staging.hol.org/points/api/guard/oauth/device/authorize"
+    assert config.jwks_endpoint == "https://registry-staging.hol.org/points/api/guard/oauth/jwks"
+    assert detect_guard_oauth_environment(config.issuer) == "staging"
+    assert guard_api_base_path(config.issuer) == "/points"
+
+
+def test_guard_api_base_path_is_empty_for_non_registry_origins() -> None:
+    assert guard_api_base_path("https://hol.org") == ""
+    assert guard_api_base_path("https://staging.hol.org") == ""
+    assert guard_api_base_path("http://127.0.0.1:3000") == ""
+
+
+def test_validate_guard_sync_endpoint_allows_registry_staging() -> None:
+    issuer = "https://registry-staging.hol.org"
+    sync_url = "https://registry-staging.hol.org/points/api/guard/receipts/sync"
+
+    assert validate_guard_sync_endpoint(sync_url, issuer=issuer) == sync_url
+
+
 def test_resolve_guard_oauth_client_config_for_local_loopback() -> None:
     config = resolve_guard_oauth_client_config("http://127.0.0.1:3000")
 

{plugin_scanner-2.0.884 → plugin_scanner-2.0.886}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.884"
+version = "2.0.886"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },