plugin-scanner 2.0.935__tar.gz → 2.0.937__tar.gz

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.935
+Version: 2.0.937
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.935"
+version = "2.0.937"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.935"
+version = "2.0.937"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/guard/approvals.py

@@ -36,6 +36,7 @@ from .models import (
     DecisionScope,
     GuardAction,
     GuardApprovalRequest,
+    GuardArtifact,
     HarnessDetection,
     PolicyDecision,
 )
@@ -247,13 +248,133 @@ _GENERIC_TOOL_LABELS = frozenset(
         "Grep",
         "WebFetch",
         "TodoWrite",
+        "mcp_tool",
+        "package_request",
+        "file_read_request",
+        "file_write_request",
+        "tool_action_request",
     }
 )
+_GENERIC_TOOL_LABELS_LOWER = frozenset(label.lower() for label in _GENERIC_TOOL_LABELS)
 
 
 def _is_generic_tool_label(value: str) -> bool:
     """Return True if the value is a generic tool name, not an actual command."""
-    return value in _GENERIC_TOOL_LABELS
+    stripped = value.strip()
+    return stripped in _GENERIC_TOOL_LABELS or stripped.lower() in _GENERIC_TOOL_LABELS_LOWER
+
+
+def _string_from_mapping(mapping: Mapping[str, object], key: str) -> str | None:
+    value = mapping.get(key)
+    if isinstance(value, str) and value.strip():
+        return value.strip()
+    return None
+
+
+def _first_string_from_mapping(mapping: Mapping[str, object], keys: Sequence[str]) -> str | None:
+    for key in keys:
+        value = _string_from_mapping(mapping, key)
+        if value is not None:
+            return value
+    return None
+
+
+def _string_list_from_mapping(mapping: Mapping[str, object], key: str) -> list[str]:
+    value = mapping.get(key)
+    if isinstance(value, str) and value.strip():
+        return [value.strip()]
+    if not isinstance(value, Sequence) or isinstance(value, str):
+        return []
+    return [str(item).strip() for item in value if isinstance(item, str) and item.strip()]
+
+
+def _review_action_text_from_envelope(envelope: Mapping[str, object]) -> str | None:
+    for key in ("raw_command_text", "rawCommandText", "command", "cmd"):
+        direct = _string_from_mapping(envelope, key)
+        if direct is not None and not _is_generic_tool_label(direct):
+            return direct
+
+    action_type = _string_from_mapping(envelope, "action_type")
+    action_identity = _first_string_from_mapping(envelope, ("action_identity", "actionIdentity"))
+    if action_identity is not None and not _is_generic_tool_label(action_identity):
+        return action_identity
+
+    if action_type in {"file_read", "file_write", "file_read_request", "file_write_request"}:
+        paths = _string_list_from_mapping(envelope, "target_paths") or _string_list_from_mapping(
+            envelope,
+            "targetPaths",
+        )
+        if not paths:
+            single_path = _first_string_from_mapping(
+                envelope,
+                ("target_path", "targetPath", "path", "file_path", "filePath"),
+            )
+            paths = [single_path] if single_path is not None else []
+        if paths:
+            verb = "Read" if action_type in {"file_read", "file_read_request"} else "Write"
+            return f"{verb} {', '.join(paths)}"
+
+    if action_type == "mcp_tool":
+        server = _first_string_from_mapping(envelope, ("mcp_server", "mcpServer", "server"))
+        tool = _first_string_from_mapping(envelope, ("mcp_tool", "mcpTool", "tool_name", "toolName"))
+        if server and tool:
+            return f"{server}.{tool}"
+        return server or tool
+
+    package_manager = _first_string_from_mapping(envelope, ("package_manager", "packageManager"))
+    package_name = _first_string_from_mapping(envelope, ("package_name", "packageName"))
+    if package_manager and package_name:
+        targets = _string_list_from_mapping(envelope, "package_targets") or _string_list_from_mapping(
+            envelope,
+            "packageTargets",
+        )
+        package_target = targets[0] if targets else package_name
+        if package_target.startswith(package_name):
+            return f"{package_manager} install {package_target}"
+        return f"{package_manager} install {package_name}@{package_target}"
+
+    return None
+
+
+def _review_action_text_from_item(item: Mapping[str, object], artifact: GuardArtifact | None) -> str | None:
+    candidates: list[object] = []
+    if artifact is not None:
+        candidates.extend(
+            [
+                artifact.metadata.get("raw_command_text"),
+                artifact.metadata.get("command_text"),
+                artifact.command,
+            ]
+        )
+    candidates.extend(
+        [
+            item.get("raw_command_text"),
+            item.get("rawCommandText"),
+            item.get("review_command"),
+            item.get("reviewCommand"),
+            item.get("action_identity"),
+            item.get("actionIdentity"),
+        ]
+    )
+    envelope_raw = item.get("action_envelope_json")
+    envelope = _item_action_envelope_json(item)
+    if envelope is None and isinstance(envelope_raw, str):
+        try:
+            import json as _json
+
+            parsed = _json.loads(envelope_raw)
+        except (ValueError, TypeError):
+            parsed = None
+        if isinstance(parsed, Mapping):
+            envelope = {str(key): value for key, value in parsed.items() if isinstance(key, str)}
+    if envelope is not None:
+        candidates.append(_review_action_text_from_envelope(envelope))
+    for candidate in candidates:
+        if isinstance(candidate, str) and candidate.strip():
+            stripped = candidate.strip()
+            if not _is_generic_tool_label(stripped):
+                return stripped
+    return None
 
 
 def queue_blocked_approvals(
@@ -290,33 +411,10 @@ def queue_blocked_approvals(
         launch_target = _launch_target(artifact, item)
         raw_command_text: str | None = None
         if redaction_level != "full":
-            candidate: object | None = None
-            if artifact is not None:
-                candidate = artifact.metadata.get("raw_command_text")
-                if not isinstance(candidate, str) or not candidate.strip():
-                    candidate = artifact.metadata.get("command_text")
-                if not isinstance(candidate, str) or not candidate.strip():
-                    candidate = artifact.command if artifact.command is not None else None
-            # Fallback: extract command from action_envelope_json (handles both str and dict types)
-            if not isinstance(candidate, str) or not candidate.strip():
-                envelope_raw = item.get("action_envelope_json")
-                envelope: dict[str, object] | None = None
-                if isinstance(envelope_raw, str):
-                    try:
-                        import json as _json
-
-                        envelope = _json.loads(envelope_raw)
-                    except (ValueError, TypeError):
-                        pass
-                elif isinstance(envelope_raw, dict):
-                    envelope = envelope_raw
-                if isinstance(envelope, dict):
-                    candidate = envelope.get("command")
-            if isinstance(candidate, str) and candidate.strip():
-                stripped = candidate.strip()
-                if not _is_generic_tool_label(stripped):
-                    scrubbed = redact_text(stripped)
-                    raw_command_text = scrubbed.text
+            candidate = _review_action_text_from_item(item, artifact)
+            if candidate is not None:
+                scrubbed = redact_text(candidate)
+                raw_command_text = scrubbed.text
         incident = build_incident_context(
             harness=detection.harness,
             artifact=artifact,
@@ -1114,7 +1212,7 @@ def _item_risk_signals(item: dict[str, object], artifact) -> tuple[str, ...]:
     return artifact_risk_signals(artifact) if artifact is not None else ()
 
 
-def _item_action_envelope_json(item: dict[str, object]) -> dict[str, object] | None:
+def _item_action_envelope_json(item: Mapping[str, object]) -> dict[str, object] | None:
     value = item.get("action_envelope_json")
     if not isinstance(value, Mapping):
         return None

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py

@@ -68,6 +68,8 @@ def _run_guard_login_command(
         open_device_browser=False,
         wait_timeout_seconds=int(getattr(args, "wait_timeout_seconds", 180) or 180),
         announce_copy=None if getattr(args, "json", False) else _announce_guard_device_connect_copy,
+        home_dir=context.home_dir if context is not None else None,
+        workspace_dir=context.workspace_dir if context is not None else workspace,
     )
     if payload is None:
         return exit_code
@@ -145,6 +147,8 @@ def _run_guard_connect_command(
             open_device_browser=False,
             wait_timeout_seconds=int(getattr(args, "wait_timeout_seconds", 180) or 180),
             announce_copy=None if getattr(args, "json", False) else _announce_guard_device_connect_copy,
+            home_dir=context.home_dir if context is not None else None,
+            workspace_dir=context.workspace_dir if context is not None else workspace,
         )
         if payload is None:
             return exit_code
@@ -160,6 +164,8 @@ def _run_guard_connect_command(
             announce_copy=None if getattr(args, "json", False) else _announce_guard_device_connect_copy,
             ci_safe=ci_safe,
             machine_label=machine_label,
+            home_dir=context.home_dir if context is not None else None,
+            workspace_dir=context.workspace_dir if context is not None else workspace,
         )
         if payload is None:
             return exit_code
@@ -250,16 +256,29 @@ def _run_guard_sync_command(
     context = _require_guard_context(context)
     try:
         auth_context = _cloud_guard_sync_auth_context(store)
+        # Default CLI sync stays fast; --deep opts into foreground AIBOM refresh.
+        include_aibom = bool(getattr(args, "deep", False))
         from .progress import GuardProgress
 
         with GuardProgress(total=2, title="Guard Sync") as bar:
-            bar.step("Syncing receipts to Guard Cloud...")
-            payload = sync_receipts(
-                store,
-                auth_context=auth_context,
-                home_dir=context.home_dir,
-                workspace_dir=context.workspace_dir,
-            )
+            bar.step("Syncing receipts and Guard events to Guard Cloud...")
+            if include_aibom:
+                with store.hold_cloud_sync_lock():
+                    payload = sync_receipts(
+                        store,
+                        auth_context=auth_context,
+                        home_dir=context.home_dir,
+                        workspace_dir=context.workspace_dir,
+                        include_aibom=True,
+                    )
+            else:
+                payload = sync_receipts(
+                    store,
+                    auth_context=auth_context,
+                    home_dir=context.home_dir,
+                    workspace_dir=context.workspace_dir,
+                    include_aibom=False,
+                )
             bar.step("Syncing supply chain state...")
             with suppress(GuardSyncNotConfiguredError, RuntimeError):
                 payload["supply_chain"] = _validated_supply_chain_sync_payload(
@@ -519,7 +538,16 @@ def _run_guard_daemon_command(
         return _handle_daemon_repair(guard_home, getattr(args, "json", False))
     if daemon_command == "stop":
         return _handle_daemon_stop(guard_home, getattr(args, "json", False))
-    daemon = GuardDaemonServer(store, port=args.port or 0)
+    daemon_home_dir = context.home_dir if context is not None else None
+    daemon_workspace_dir = (
+        context.workspace_dir if context is not None and context.workspace_dir is not None else workspace
+    )
+    daemon = GuardDaemonServer(
+        store,
+        port=args.port or 0,
+        home_dir=daemon_home_dir,
+        workspace_dir=daemon_workspace_dir,
+    )
     if args.serve:
         daemon.serve()
         return 0

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/guard/cli/commands_parser_cloud.py

@@ -129,6 +129,11 @@ def _configure_guard_cloud_parsers(
         help="Named connection profile to sync from. Defaults to 'default'.",
     )
     sync_parser.add_argument("--json", action="store_true")
+    sync_parser.add_argument(
+        "--deep",
+        action="store_true",
+        help="Also refresh AIBOM inventory during this foreground sync.",
+    )
 
     commands_parser = guard_subparsers.add_parser(
         "commands",

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/guard/cli/commands_support_connect.py

@@ -210,6 +210,8 @@ def _finalize_guard_connect_payload(
     connect_url: str,
     payload: dict[str, object],
     now: str,
+    home_dir: Path | None = None,
+    workspace_dir: Path | None = None,
 ) -> dict[str, object]:
     sync_auth_context = payload.pop(CONNECT_SYNC_AUTH_CONTEXT_KEY, None)
     resolved_sync_auth_context = sync_auth_context if isinstance(sync_auth_context, dict) else None
@@ -271,6 +273,8 @@ def _finalize_guard_connect_payload(
                 store,
                 auth_context=resolved_sync_auth_context,
                 now=now,
+                home_dir=home_dir,
+                workspace_dir=workspace_dir,
             )
             sync_bar.step("Syncing supply chain state...")
             try:
@@ -419,6 +423,8 @@ def _build_guard_device_connect_payload(
     announce_copy=None,
     ci_safe: bool = False,
     machine_label: str | None = None,
+    home_dir: Path | None = None,
+    workspace_dir: Path | None = None,
 ) -> tuple[dict[str, object] | None, int]:
     try:
         if use_browser_oauth:
@@ -460,6 +466,8 @@ def _build_guard_device_connect_payload(
         connect_url=connect_url,
         payload=payload,
         now=_now(),
+        home_dir=home_dir,
+        workspace_dir=workspace_dir,
     )
     return payload, 0
 

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/guard/daemon/server.py

@@ -29,6 +29,7 @@ from urllib.parse import parse_qs, parse_qsl, unquote, urlencode, urlparse, urlu
 from ...version import __version__
 from ..adapters import get_adapter
 from ..adapters.base import HarnessContext
+from ..aibom_cli import _AIBOM_AUTO_SYNC_INTERVAL_SECONDS, sync_aibom_snapshots_if_due
 from ..approval_gate import (
     ApprovalGateError,
     begin_totp_enrollment,
@@ -5188,7 +5189,11 @@ class GuardDaemonServer:
         *,
         bundle_refresh_backoff_seconds: float = _DEFAULT_SUPPLY_CHAIN_REFRESH_BACKOFF_SECONDS,
         bundle_refresh_interval_seconds: float | None = _DEFAULT_SUPPLY_CHAIN_REFRESH_INTERVAL_SECONDS,
+        aibom_refresh_backoff_seconds: float = _DEFAULT_SUPPLY_CHAIN_REFRESH_BACKOFF_SECONDS,
+        aibom_refresh_interval_seconds: float | None = float(_AIBOM_AUTO_SYNC_INTERVAL_SECONDS),
         idle_timeout_seconds: float | None = None,
+        home_dir: Path | None = None,
+        workspace_dir: Path | None = None,
     ) -> None:
         _validate_dashboard_bundle()
         self._server = _GuardDaemonHttpServer(
@@ -5207,6 +5212,11 @@ class GuardDaemonServer:
         self.port = self._server.daemon_port()
         self._bundle_refresh_backoff_seconds = bundle_refresh_backoff_seconds
         self._bundle_refresh_interval_seconds = bundle_refresh_interval_seconds
+        self._aibom_refresh_backoff_seconds = aibom_refresh_backoff_seconds
+        self._aibom_refresh_interval_seconds = aibom_refresh_interval_seconds
+        self._aibom_home_dir = home_dir.expanduser() if home_dir is not None else None
+        self._aibom_workspace_dir = workspace_dir.expanduser() if workspace_dir is not None else None
+        self._aibom_refresh_thread: threading.Thread | None = None
         self._bundle_refresh_thread: threading.Thread | None = None
         self._command_queue_worker: CommandQueueWorker | None = None
         self._thread: threading.Thread | None = None
@@ -5238,6 +5248,9 @@ class GuardDaemonServer:
         if self._bundle_refresh_thread is not None:
             self._bundle_refresh_thread.join(timeout=5)
             self._bundle_refresh_thread = None
+        if self._aibom_refresh_thread is not None:
+            self._aibom_refresh_thread.join(timeout=5)
+            self._aibom_refresh_thread = None
         self._command_queue_worker = stop_command_queue_worker(self._command_queue_worker)
 
     def _begin_service(self) -> None:
@@ -5253,6 +5266,7 @@ class GuardDaemonServer:
         )
         self._start_watchdog()
         self._start_supply_chain_bundle_refresh()
+        self._start_aibom_inventory_refresh()
         self._command_queue_worker = start_command_queue_worker(self._server.store, self._command_queue_worker)
 
     def _serve_forever(self) -> None:
@@ -5356,6 +5370,113 @@ class GuardDaemonServer:
             if self._shutdown_started.wait(wait_seconds):
                 return
 
+    def _start_aibom_inventory_refresh(self) -> None:
+        if self._aibom_refresh_interval_seconds is None or self._aibom_refresh_interval_seconds <= 0:
+            return
+        if self._aibom_refresh_thread is not None and self._aibom_refresh_thread.is_alive():
+            return
+        self._aibom_refresh_thread = threading.Thread(
+            target=self._refresh_aibom_inventory_loop,
+            daemon=True,
+        )
+        self._aibom_refresh_thread.start()
+
+    def _aibom_inventory_context_dirs(self) -> tuple[Path | None, Path | None]:
+        payload = self._server.store.get_sync_payload("aibom_inventory_context")
+        if isinstance(payload, dict):
+            home_value = payload.get("home_dir")
+            workspace_value = payload.get("workspace_dir")
+        else:
+            home_value = None
+            workspace_value = None
+        home_dir = (
+            Path(home_value).expanduser()
+            if isinstance(home_value, str) and home_value.strip()
+            else self._aibom_home_dir
+        )
+        workspace_dir = (
+            Path(workspace_value).expanduser()
+            if isinstance(workspace_value, str) and workspace_value.strip()
+            else self._aibom_workspace_dir
+        )
+        return home_dir, workspace_dir
+
+    def _refresh_aibom_inventory_loop(self) -> None:
+        interval_seconds = self._aibom_refresh_interval_seconds
+        if interval_seconds is None or interval_seconds <= 0:
+            return
+        backoff_seconds = (
+            self._aibom_refresh_backoff_seconds if self._aibom_refresh_backoff_seconds > 0 else interval_seconds
+        )
+        if self._shutdown_started.wait(interval_seconds):
+            return
+        while not self._shutdown_started.is_set():
+            refreshed_at = _now()
+            try:
+                home_dir, workspace_dir = self._aibom_inventory_context_dirs()
+                if workspace_dir is None:
+                    self._server.store.set_sync_payload(
+                        "aibom_inventory_daemon",
+                        {
+                            "status": "missing_workspace_context",
+                            "reason": "missing_workspace_context",
+                            "skipped": True,
+                            "refreshed_at": refreshed_at,
+                        },
+                        refreshed_at,
+                    )
+                    if self._shutdown_started.wait(backoff_seconds):
+                        return
+                    continue
+                auth_context = _resolve_guard_sync_auth_context(self._server.store)
+                with self._server.store.hold_cloud_sync_lock():
+                    summary = sync_aibom_snapshots_if_due(
+                        self._server.store,
+                        generated_at=refreshed_at,
+                        min_interval_seconds=max(int(interval_seconds), 1),
+                        auth_context=auth_context,
+                        home_dir=home_dir,
+                        workspace_dir=workspace_dir,
+                    )
+                status = "synced" if summary.get("synced") is True else str(summary.get("reason") or "skipped")
+                self._server.store.set_sync_payload(
+                    "aibom_inventory_daemon",
+                    {**summary, "status": status, "refreshed_at": refreshed_at},
+                    refreshed_at,
+                )
+                wait_seconds = interval_seconds
+            except GuardSyncAuthorizationExpiredError as error:
+                self._server.store.set_sync_payload(
+                    "aibom_inventory_daemon",
+                    {
+                        "status": "auth_expired",
+                        "refreshed_at": refreshed_at,
+                        "message": str(error),
+                    },
+                    refreshed_at,
+                )
+                wait_seconds = backoff_seconds
+            except GuardSyncNotConfiguredError:
+                self._server.store.set_sync_payload(
+                    "aibom_inventory_daemon",
+                    {"status": "not_configured", "refreshed_at": refreshed_at},
+                    refreshed_at,
+                )
+                wait_seconds = backoff_seconds
+            except Exception as error:
+                self._server.store.set_sync_payload(
+                    "aibom_inventory_daemon",
+                    {
+                        "error": str(error),
+                        "refreshed_at": refreshed_at,
+                        "status": "error",
+                    },
+                    refreshed_at,
+                )
+                wait_seconds = backoff_seconds
+            if self._shutdown_started.wait(wait_seconds):
+                return
+
 
 def _approval_center_browser_url(approval_center_url: str, auth_token: str) -> str:
     parsed = urlparse(approval_center_url)

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -1261,6 +1261,7 @@ def sync_receipts(
     auth_context: dict[str, object] | None = None,
     home_dir: Path | None = None,
     workspace_dir: Path | None = None,
+    include_aibom: bool = False,
 ) -> dict[str, object]:
     """Push local receipts to the configured sync endpoint."""
 
@@ -1360,6 +1361,13 @@ def sync_receipts(
             exceptions_payload.extend(item for item in exceptions if isinstance(item, dict))
         remote_decisions.update(_build_remote_policy_decisions(payload))
     now = _sync_timestamp(payload)
+    aibom_context: dict[str, object] = {}
+    if home_dir is not None:
+        aibom_context["home_dir"] = str(home_dir)
+    if workspace_dir is not None:
+        aibom_context["workspace_dir"] = str(workspace_dir)
+    if aibom_context:
+        store.set_sync_payload("aibom_inventory_context", aibom_context, now)
     persisted_cursor_rowid = latest_uploaded_rowid if latest_uploaded_rowid is not None else prior_receipt_cursor
     _persist_receipt_sync_cursor(
         store=store,
@@ -1562,15 +1570,26 @@ def sync_receipts(
     if remote_policy_sync_blocked:
         summary["remote_policy_sync_blocked"] = True
     summary["guard_events_v1"] = sync_guard_events(store, auth_context=resolved_auth_context)
-    from ..aibom_cli import sync_aibom_snapshots_if_due
+    if include_aibom:
+        from ..aibom_cli import sync_aibom_snapshots_if_due
 
-    summary["aibom_inventory"] = sync_aibom_snapshots_if_due(
-        store,
-        generated_at=now,
-        auth_context=resolved_auth_context,
-        home_dir=home_dir,
-        workspace_dir=workspace_dir,
-    )
+        summary["aibom_inventory"] = sync_aibom_snapshots_if_due(
+            store,
+            generated_at=now,
+            auth_context=resolved_auth_context,
+            home_dir=home_dir,
+            workspace_dir=workspace_dir,
+        )
+    else:
+        summary["aibom_inventory"] = {
+            "synced": False,
+            "skipped": True,
+            "reason": "background_deferred",
+            "message": (
+                "AIBOM inventory refresh is deferred to the Guard daemon background lane; "
+                "run hol-guard guard sync --deep to refresh now."
+            ),
+        }
     if persist_sync_summary:
         store.set_sync_payload("sync_summary", summary, now)
     if persist_connect_state:
@@ -2174,6 +2193,9 @@ def sync_local_guard_cloud_proof(
     *,
     auth_context: dict[str, object] | None = None,
     now: str | None = None,
+    home_dir: Path | None = None,
+    workspace_dir: Path | None = None,
+    include_aibom: bool = False,
 ) -> dict[str, object]:
     """Publish the local Guard runtime session before syncing receipts."""
     resolved_now = now or _now()
@@ -2190,6 +2212,9 @@ def sync_local_guard_cloud_proof(
             persist_sync_summary=False,
             persist_connect_state=False,
             auth_context=resolved_auth_context,
+            home_dir=home_dir,
+            workspace_dir=workspace_dir,
+            include_aibom=include_aibom,
         )
         summary = dict(receipts_summary)
         summary.update(

{plugin_scanner-2.0.935 → plugin_scanner-2.0.937}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.935"
+__version__ = "2.0.937"