plugin-scanner 2.0.941__tar.gz → 2.0.943__tar.gz

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.941
+Version: 2.0.943
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.941"
+version = "2.0.943"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.941"
+version = "2.0.943"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/src/codex_plugin_scanner/guard/cli/commands_dispatch_cloud.py

@@ -408,7 +408,14 @@ def _run_guard_supply_chain_command(
         return exit_code
     if supply_chain_command == "sync":
         try:
-            payload = _validated_supply_chain_sync_payload(sync_supply_chain_bundle(store))
+            auth_context = _cloud_guard_sync_auth_context(store)
+            payload = _validated_supply_chain_sync_payload(
+                sync_supply_chain_cloud_state(
+                    store,
+                    auth_context=auth_context,
+                    workspace_dir=workspace_dir,
+                )
+            )
         except (GuardSyncAuthorizationExpiredError, GuardSyncNotConfiguredError) as error:
             message = _guard_sync_failure_message(error)
             if getattr(args, "json", False):
@@ -416,6 +423,12 @@ def _run_guard_supply_chain_command(
             else:
                 print(message, file=sys.stderr)
             return 1
+        except GuardSyncNotAvailableError as error:
+            if getattr(args, "json", False):
+                _emit("supply-chain-sync", {"synced": False, "error": str(error)}, True)
+            else:
+                print(str(error), file=sys.stderr)
+            return 1
         except RuntimeError as error:
             if getattr(args, "json", False):
                 _emit("supply-chain-sync", {"synced": False, "error": str(error)}, True)

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/src/codex_plugin_scanner/guard/local_supply_chain.py

@@ -2597,6 +2597,7 @@ def sync_managed_workspace_audits(
     workspaces_payload: list[dict[str, object]] = []
     completed_jobs = 0
     failed_jobs = 0
+    incomplete_jobs = 0
     queued_jobs = 0
     skipped_workspaces = 0
     for candidate in _managed_workspace_audit_candidates(store, workspace_dir=workspace_dir):
@@ -2641,22 +2642,40 @@ def sync_managed_workspace_audits(
             final_status = (
                 str(final_response.get("status") or enqueue_response.get("status") or "queued").strip().lower()
             )
-            if final_status == "completed":
-                completed_jobs += 1
-            elif final_status == "failed":
-                failed_jobs += 1
+            cloud_visible_count = _int_value(final_response.get("totalPackages"))
+            cloud_processed_count = _int_value(final_response.get("processedCount"))
+            incomplete_cloud_projection = (
+                final_status == "completed" and cloud_visible_count is not None and cloud_visible_count < len(inventory)
+            )
+            if incomplete_cloud_projection:
+                incomplete_jobs += 1
+                workspace_status = "partial"
             else:
-                queued_jobs += 1
+                workspace_status = final_status
+                if final_status == "completed":
+                    completed_jobs += 1
+                elif final_status == "failed":
+                    failed_jobs += 1
+                else:
+                    queued_jobs += 1
+            message = final_response.get("error")
+            if incomplete_cloud_projection:
+                message = (
+                    "Guard Cloud accepted fewer package rows than hol-guard discovered "
+                    f"({cloud_visible_count} of {len(inventory)} visible)."
+                )
             workspaces_payload.append(
                 {
                     "workspace": workspace_label,
                     "workspace_fingerprint": request_payload.get("workspaceFingerprint"),
                     "job_id": job_id,
-                    "status": final_status,
+                    "status": workspace_status,
                     "package_count": len(inventory),
+                    "cloud_processed_count": cloud_processed_count,
+                    "cloud_visible_count": cloud_visible_count,
                     "manifest_paths": list(manifest_paths),
                     "lockfile_paths": list(lockfile_paths),
-                    "message": final_response.get("error"),
+                    "message": message,
                 }
             )
         except (
@@ -2675,9 +2694,9 @@ def sync_managed_workspace_audits(
                     "package_count": 0,
                 }
             )
-    if failed_jobs > 0 and completed_jobs == 0 and queued_jobs == 0:
+    if failed_jobs > 0 and completed_jobs == 0 and queued_jobs == 0 and incomplete_jobs == 0:
         status = "failed"
-    elif failed_jobs > 0:
+    elif failed_jobs > 0 or incomplete_jobs > 0:
         status = "partial"
     elif completed_jobs > 0 or queued_jobs > 0:
         status = "synced"
@@ -2690,6 +2709,7 @@ def sync_managed_workspace_audits(
         "completed_jobs": completed_jobs,
         "queued_jobs": queued_jobs,
         "failed_jobs": failed_jobs,
+        "incomplete_jobs": incomplete_jobs,
         "skipped_workspaces": skipped_workspaces,
         "workspaces": workspaces_payload,
     }

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/src/codex_plugin_scanner/guard/runtime/command_executors.py

@@ -16,7 +16,7 @@ from ..cli.install_commands import (
     list_harness_setup_items,
     uninstall_confirmation_token,
 )
-from ..config import load_guard_config
+from ..config import VALID_RECEIPT_REDACTION_LEVELS, load_guard_config
 from ..local_supply_chain import (
     build_workspace_audit_payload,
     managed_install_audit_workspace_dirs,
@@ -25,6 +25,7 @@ from ..local_supply_chain import (
 )
 from ..models import DECISION_SCOPE_VALUES, GUARD_ACTION_VALUES, DecisionScope, GuardAction, PolicyDecision
 from ..package_shim_status import record_package_shim_audit_result
+from ..redaction import redact_text
 from ..review_contracts import (
     GuardReviewContractError,
     build_local_review_request_claim,
@@ -418,6 +419,7 @@ def _is_guard_action(value: object) -> TypeGuard[GuardAction]:
 
 def _local_request_snapshot_items(store: GuardStore) -> list[dict[str, object]]:
     items: list[dict[str, object]] = []
+    redaction_level = _resolve_cloud_receipt_redaction_level(store)
     try:
         oauth = guard_review_oauth_metadata(store)
     except GuardReviewContractError:
@@ -445,7 +447,10 @@ def _local_request_snapshot_items(store: GuardStore) -> list[dict[str, object]]:
                     "claim": claim,
                     "localRequestId": request_id,
                     "requestKind": str(item.get("harness") or "guard-review"),
-                    "requestPayload": dict(item),
+                    "requestPayload": _cloud_safe_local_request_payload(
+                        item,
+                        redaction_level=redaction_level,
+                    ),
                     "localStatus": str(item.get("status") or status),
                     "firstSeenAt": created_at,
                     "lastSeenAt": last_seen_at,
@@ -455,6 +460,127 @@ def _local_request_snapshot_items(store: GuardStore) -> list[dict[str, object]]:
     return items[:200]
 
 
+def _resolve_cloud_receipt_redaction_level(store: GuardStore) -> str:
+    payload = store.get_sync_payload("cloud_receipt_redaction_level")
+    if isinstance(payload, dict):
+        level = payload.get("level")
+        if isinstance(level, str) and level in VALID_RECEIPT_REDACTION_LEVELS:
+            return level
+    try:
+        config = load_guard_config(store.guard_home)
+        if config.receipt_redaction_level in VALID_RECEIPT_REDACTION_LEVELS:
+            return config.receipt_redaction_level
+    except Exception:
+        pass
+    return "full"
+
+
+def _optional_payload_mapping(value: object) -> dict[str, object] | None:
+    return dict(value) if isinstance(value, dict) else None
+
+
+def _cloud_safe_local_request_payload(
+    item: dict[str, object],
+    *,
+    redaction_level: str,
+) -> dict[str, object]:
+    payload: dict[str, object] = {}
+    for key in (
+        "request_id",
+        "status",
+        "harness",
+        "artifact_id",
+        "artifact_hash",
+        "policy_action",
+        "recommended_scope",
+        "created_at",
+        "last_seen_at",
+        "queue_group_id",
+        "review_kind",
+        "risk_category",
+        "capability_category",
+        "publisher",
+        "package_manager",
+        "package_name",
+    ):
+        value = item.get(key)
+        if isinstance(value, (str, int, float, bool)) or value is None:
+            payload[key] = value
+
+    envelope = _optional_payload_mapping(item.get("action_envelope_json"))
+    safe_envelope = _cloud_safe_action_envelope(envelope, redaction_level=redaction_level)
+    if safe_envelope is not None:
+        payload["action_envelope_json"] = safe_envelope
+
+    if redaction_level == "full":
+        payload["raw_command_text"] = None
+        payload["command_text"] = None
+        return payload
+
+    command_text = _local_request_command_text(item, envelope)
+    if command_text:
+        scrubbed = redact_text(command_text).text
+        payload["raw_command_text"] = scrubbed
+        payload["command_text"] = scrubbed
+        payload_envelope = payload.get("action_envelope_json")
+        if isinstance(payload_envelope, dict):
+            payload_envelope["command"] = scrubbed
+    return payload
+
+
+def _local_request_command_text(
+    payload: dict[str, object],
+    envelope: dict[str, object] | None,
+) -> str | None:
+    for key in ("raw_command_text", "rawCommandText", "command_text", "commandText"):
+        value = payload.get(key)
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    if envelope is None:
+        return None
+    command = envelope.get("command")
+    return command.strip() if isinstance(command, str) and command.strip() else None
+
+
+def _cloud_safe_action_envelope(
+    envelope: dict[str, object] | None,
+    *,
+    redaction_level: str,
+) -> dict[str, object] | None:
+    if envelope is None:
+        return None
+    safe: dict[str, object] = {}
+    for key in (
+        "schema_version",
+        "action_id",
+        "harness",
+        "event_name",
+        "action_type",
+        "workspace_hash",
+        "tool_name",
+        "mcp_server",
+        "mcp_tool",
+        "target_path_count",
+        "network_host_count",
+        "package_manager",
+    ):
+        value = envelope.get(key)
+        if isinstance(value, (str, int, float, bool)) or value is None:
+            safe[key] = value
+    if redaction_level != "full":
+        command = envelope.get("command")
+        if isinstance(command, str) and command.strip():
+            safe["command"] = redact_text(command).text
+    if redaction_level == "none":
+        for key in ("target_paths", "network_hosts", "package_name", "package_targets"):
+            value = envelope.get(key)
+            if isinstance(value, list):
+                safe[key] = [item for item in value if isinstance(item, str)]
+            elif isinstance(value, str):
+                safe[key] = value
+    return safe or None
+
+
 def _package_shim_context(
     payload: dict[str, object],
     *,

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.941"
+__version__ = "2.0.943"

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/tests/test_guard_cli.py

@@ -9163,6 +9163,102 @@ url = http://127.0.0.1:8787/guard-canary
         assert len(captured_auth_context) == 2
         assert captured_auth_context[0] == captured_auth_context[1]
 
+    def test_guard_supply_chain_sync_includes_workspace_audits(self, tmp_path, capsys, monkeypatch):
+        home_dir = tmp_path / "home"
+        workspace_dir = tmp_path / "workspace"
+        workspace_dir.mkdir()
+        captured: dict[str, object] = {}
+
+        monkeypatch.setattr(
+            guard_commands_module,
+            "_resolve_guard_sync_auth_context",
+            lambda _store: {
+                "access_token": "token",
+                "sync_url": "https://guard.example/api/guard/receipts/sync",
+            },
+        )
+
+        def _fake_sync_supply_chain_cloud_state(_store: GuardStore, **kwargs: object) -> dict[str, object]:
+            captured.update(kwargs)
+            return {
+                "synced_at": "2026-06-18T22:00:01Z",
+                "status": "synced",
+                "workspace_audits": {
+                    "status": "synced",
+                    "completed_jobs": 1,
+                    "workspaces": [{"package_count": 280, "cloud_visible_count": 280}],
+                },
+            }
+
+        monkeypatch.setattr(
+            guard_commands_module,
+            "sync_supply_chain_cloud_state",
+            _fake_sync_supply_chain_cloud_state,
+        )
+
+        rc = main(
+            [
+                "guard",
+                "supply-chain",
+                "sync",
+                "--home",
+                str(home_dir),
+                "--workspace",
+                str(workspace_dir),
+                "--json",
+            ]
+        )
+        output = json.loads(capsys.readouterr().out)
+
+        assert rc == 0
+        assert captured["workspace_dir"] == workspace_dir
+        assert output["workspace_audits"]["completed_jobs"] == 1
+        assert output["workspace_audits"]["workspaces"][0]["package_count"] == 280
+        assert output["workspace_audits"]["workspaces"][0]["cloud_visible_count"] == 280
+
+    def test_guard_supply_chain_sync_reports_unavailable_error(self, tmp_path, capsys, monkeypatch):
+        home_dir = tmp_path / "home"
+        workspace_dir = tmp_path / "workspace"
+        workspace_dir.mkdir()
+
+        monkeypatch.setattr(
+            guard_commands_module,
+            "_resolve_guard_sync_auth_context",
+            lambda _store: {
+                "access_token": "token",
+                "sync_url": "https://guard.example/api/guard/receipts/sync",
+            },
+        )
+
+        def _fail_sync(_store: GuardStore, **_kwargs: object) -> dict[str, object]:
+            raise guard_commands_module.GuardSyncNotAvailableError("Guard supply-chain audit is not available.")
+
+        monkeypatch.setattr(
+            guard_commands_module,
+            "sync_supply_chain_cloud_state",
+            _fail_sync,
+        )
+
+        rc = main(
+            [
+                "guard",
+                "supply-chain",
+                "sync",
+                "--home",
+                str(home_dir),
+                "--workspace",
+                str(workspace_dir),
+                "--json",
+            ]
+        )
+        output = json.loads(capsys.readouterr().out)
+
+        assert rc == 1
+        assert output == {
+            "synced": False,
+            "error": "Guard supply-chain audit is not available.",
+        }
+
     def test_refresh_cloud_policy_bundle_records_auth_expired_reason(self, tmp_path, monkeypatch):
         home_dir = tmp_path / "home"
         _disable_oauth_persistence_assert(monkeypatch)

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/tests/test_guard_command_queue.py

@@ -359,6 +359,87 @@ def test_local_request_snapshot_items_continues_when_request_claim_is_invalid(tm
     assert snapshot[0]["claim"] is None
 
 
+def test_local_request_snapshot_strips_command_when_redaction_is_full(tmp_path: Path) -> None:
+    class RequestStore(FakeStore):
+        def list_approval_requests(
+            self,
+            *,
+            status: str | None = "pending",
+            harness: str | None = None,
+            limit: int | None = 50,
+            cursor: str | None = None,
+            search: str | None = None,
+        ) -> list[dict[str, object]]:
+            del harness, limit, cursor, search
+            if status == "pending":
+                row = _approval_request_row("req-full-redaction")
+                row["raw_command_text"] = "sed -n '1,80p' .env"
+                row["rawCommandText"] = "cat PRIVATE_KEY_FILE"
+                row["commandText"] = "cat CREDENTIAL_FILE"
+                row["raw_target_paths"] = ["secret-config.txt"]
+                row["request_payload_json"] = {"command": "cat secret-config.txt"}
+                return [row]
+            return []
+
+    store = RequestStore(tmp_path / "guard-home")
+    store.payloads["cloud_receipt_redaction_level"] = {"level": "full"}
+
+    snapshot = command_executors._local_request_snapshot_items(store)
+
+    payload = snapshot[0]["requestPayload"]
+    assert isinstance(payload, dict)
+    envelope = payload["action_envelope_json"]
+    assert isinstance(envelope, dict)
+    assert payload["raw_command_text"] is None
+    assert payload["command_text"] is None
+    assert "rawCommandText" not in payload
+    assert "commandText" not in payload
+    assert "raw_target_paths" not in payload
+    assert "request_payload_json" not in payload
+    assert "command" not in envelope
+
+
+def test_local_request_snapshot_syncs_scrubbed_command_when_redaction_is_partial(tmp_path: Path) -> None:
+    class RequestStore(FakeStore):
+        def list_approval_requests(
+            self,
+            *,
+            status: str | None = "pending",
+            harness: str | None = None,
+            limit: int | None = 50,
+            cursor: str | None = None,
+            search: str | None = None,
+        ) -> list[dict[str, object]]:
+            del harness, limit, cursor, search
+            if status == "pending":
+                row = _approval_request_row("req-partial-redaction")
+                row["rawCommandText"] = "grep sk-test-token src/config.ts"
+                row["action_envelope_json"] = {
+                    "action_type": "shell_command",
+                    "command": "cat PRIVATE_KEY_FILE",
+                    "tool_name": "grep",
+                    "target_paths": ["src/config.ts"],
+                }
+                return [row]
+            return []
+
+    store = RequestStore(tmp_path / "guard-home")
+    store.payloads["cloud_receipt_redaction_level"] = {"level": "partial"}
+
+    snapshot = command_executors._local_request_snapshot_items(store)
+
+    payload = snapshot[0]["requestPayload"]
+    assert isinstance(payload, dict)
+    envelope = payload["action_envelope_json"]
+    assert isinstance(envelope, dict)
+    assert payload["raw_command_text"] == "grep sk-***** src/config.ts"
+    assert payload["command_text"] == "grep sk-***** src/config.ts"
+    assert "rawCommandText" not in payload
+    assert "commandText" not in payload
+    assert envelope["command"] == "grep sk-***** src/config.ts"
+    assert "target_paths" not in envelope
+
+
 def test_executor_rejects_remote_approval_without_trusted_keyring(tmp_path: Path) -> None:
     class RequestStore(FakeStore):
         def __init__(self, guard_home: Path) -> None:

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/tests/test_guard_local_supply_chain_audit_phase16.py

@@ -237,6 +237,71 @@ def test_sync_managed_workspace_audits_enqueues_persisted_job_mode_for_managed_w
     assert summary["workspaces"][0]["package_count"] == 1
 
 
+def test_sync_managed_workspace_audits_reports_partial_when_cloud_visible_count_is_lower(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    home_dir = tmp_path / "guard-home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    _write_text(
+        workspace_dir / "package.json",
+        json.dumps({"name": "demo", "dependencies": {"react": "18.2.0"}}, sort_keys=True) + "\n",
+    )
+    _write_text(
+        workspace_dir / "package-lock.json",
+        json.dumps(
+            {
+                "name": "demo",
+                "lockfileVersion": 3,
+                "packages": {
+                    "": {"dependencies": {"react": "18.2.0"}},
+                    "node_modules/react": {"version": "18.2.0"},
+                    "node_modules/scheduler": {"version": "0.23.2"},
+                    "node_modules/loose-envify": {"version": "1.4.0"},
+                },
+            },
+            sort_keys=True,
+        )
+        + "\n",
+    )
+    store = GuardStore(home_dir)
+    _seed_premium_pairing(store, now="2026-05-25T10:00:00+00:00")
+    store.set_managed_install("codex", True, str(workspace_dir), {}, "2026-05-25T10:00:00+00:00")
+
+    monkeypatch.setattr(
+        local_supply_chain_module,
+        "_enqueue_cloud_workspace_audit_job",
+        lambda **_kwargs: {"jobId": "job-1", "status": "queued"},
+    )
+    monkeypatch.setattr(
+        local_supply_chain_module,
+        "_poll_cloud_workspace_audit_job",
+        lambda **_kwargs: {
+            "jobId": "job-1",
+            "status": "completed",
+            "processedCount": 2,
+            "totalPackages": 2,
+        },
+    )
+
+    summary = local_supply_chain_module.sync_managed_workspace_audits(
+        store,
+        auth_context={
+            "access_token": "token",
+            "sync_url": "https://guard.example/api/guard/receipts/sync",
+        },
+    )
+
+    workspace = summary["workspaces"][0]
+    assert summary["status"] == "partial"
+    assert summary["incomplete_jobs"] == 1
+    assert workspace["status"] == "partial"
+    assert workspace["package_count"] == 3
+    assert workspace["cloud_visible_count"] == 2
+    assert "2 of 3 visible" in str(workspace["message"])
+
+
 def test_guard_supply_chain_audit_alias_accepts_sbom_input(
     monkeypatch: pytest.MonkeyPatch, tmp_path: Path, capsys: pytest.CaptureFixture[str]
 ) -> None:

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/tests/test_guard_local_supply_chain_phase15.py

@@ -558,28 +558,39 @@ def test_guard_supply_chain_scan_without_supported_manifests_returns_nonzero(tmp
     assert output["message"] == "No supported manifests or lockfiles found in this workspace."
 
 
-def test_guard_supply_chain_sync_alias_uses_bundle_sync(
+def test_guard_supply_chain_sync_alias_uses_cloud_state_sync(
     monkeypatch: pytest.MonkeyPatch, tmp_path: Path, capsys
 ) -> None:
     home_dir = tmp_path / "guard-home"
     workspace_dir = tmp_path / "workspace"
     workspace_dir.mkdir()
+    captured: dict[str, object] = {}
 
     monkeypatch.setattr(
         commands_module,
-        "sync_supply_chain_bundle",
+        "_resolve_guard_sync_auth_context",
         lambda _store: {
+            "access_token": "token",
+            "sync_url": "https://guard.example/api/guard/receipts/sync",
+        },
+    )
+
+    def fake_sync_supply_chain_cloud_state(_store: GuardStore, **kwargs: object) -> dict[str, object]:
+        captured.update(kwargs)
+        return {
             "status": "synced",
-            "bundle_version": "1747612800000-deadbeef",
-            "workspace_id": WORKSPACE_ID,
             "synced_at": "2026-05-19T12:00:00+00:00",
-            "tier": "premium",
-            "advisory_count": 1,
-            "package_count": 1,
-            "policy_hash": "policy-hash-1",
-            "feed_snapshot_hash": "feed-snapshot-1",
-            "ecosystem_support": [{"ecosystem": "npm", "support_level": "protected", "label": "Protected"}],
-        },
+            "workspace_audits": {
+                "status": "synced",
+                "completed_jobs": 1,
+                "workspaces": [{"package_count": 3, "cloud_visible_count": 3}],
+            },
+        }
+
+    monkeypatch.setattr(
+        commands_module,
+        "sync_supply_chain_cloud_state",
+        fake_sync_supply_chain_cloud_state,
     )
 
     rc = main(
@@ -597,8 +608,15 @@ def test_guard_supply_chain_sync_alias_uses_bundle_sync(
     output = json.loads(capsys.readouterr().out)
 
     assert rc == 0
+    assert captured["workspace_dir"] == workspace_dir
+    assert captured["auth_context"] == {
+        "access_token": "token",
+        "sync_url": "https://guard.example/api/guard/receipts/sync",
+    }
     assert output["status"] == "synced"
-    assert output["bundle_version"] == "1747612800000-deadbeef"
+    assert output["workspace_audits"]["completed_jobs"] == 1
+    assert output["workspace_audits"]["workspaces"][0]["cloud_visible_count"] == 3
+    assert "supply_chain" in output
 
 
 def test_guard_supply_chain_sync_alias_rejects_invalid_payload(
@@ -608,7 +626,15 @@ def test_guard_supply_chain_sync_alias_rejects_invalid_payload(
     workspace_dir = tmp_path / "workspace"
     workspace_dir.mkdir()
 
-    monkeypatch.setattr(commands_module, "sync_supply_chain_bundle", lambda _store: None)
+    monkeypatch.setattr(
+        commands_module,
+        "_resolve_guard_sync_auth_context",
+        lambda _store: {
+            "access_token": "token",
+            "sync_url": "https://guard.example/api/guard/receipts/sync",
+        },
+    )
+    monkeypatch.setattr(commands_module, "sync_supply_chain_cloud_state", lambda _store, **_kwargs: None)
 
     rc = main(
         [

{plugin_scanner-2.0.941 → plugin_scanner-2.0.943}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.941"
+version = "2.0.943"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },