plugin-scanner 2.0.598__tar.gz → 2.0.600__tar.gz

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.598
+Version: 2.0.600
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.600/docs/guard/review-local-queue-contract.md

@@ -0,0 +1,51 @@
+## Review Local Queue Contract
+
+Guard Local owns live pending requests. Guard Cloud may mirror or reuse this data,
+but it does not replace the local queue.
+
+### Pending request payload
+
+Local pending request payload is already defined by
+`src/codex_plugin_scanner/guard/store_approvals.py` `_row_to_payload(...)` and is
+surfaced through both:
+
+- daemon `GET /v1/requests`
+- `build_runtime_snapshot(..., include_items=True)`
+
+Current payload keys include:
+
+- `request_id`
+- `harness`
+- `artifact_id`, `artifact_name`, `artifact_type`, `artifact_hash`
+- `policy_action`, `recommended_scope`, `source_scope`
+- `workspace`, `publisher`, `config_path`, `launch_target`
+- `action_identity`, `queue_group_id`, `dedupe_count`, `last_seen_at`
+- `risk_summary`, `risk_signals`, `why_now`, `trigger_summary`, `launch_summary`
+- `review_command`, `approval_url`
+- `status`, `resolution_action`, `resolution_scope`, `reason`
+- `created_at`, `resolved_at`
+
+### Resolution scopes
+
+Runtime ask-flow scopes currently exposed in
+`src/codex_plugin_scanner/guard/runtime/decisions.py` are:
+
+- `artifact`
+- `workspace`
+- `publisher`
+- `harness`
+
+Resolution logic in `src/codex_plugin_scanner/guard/approvals.py`
+`apply_approval_resolution(...)` also supports broader local persistence for:
+
+- `global`
+
+### Local lifecycle events
+
+Local queue lifecycle emits:
+
+- `approval.created` when a new pending request row is created
+- `approval.resolved` when a pending request is resolved
+
+Duplicate requeues reuse the first pending request id and should not emit a second
+`approval.created` event for the same pending row.

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.598"
+version = "2.0.600"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.598"
+version = "2.0.600"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/src/codex_plugin_scanner/guard/approvals.py

@@ -228,6 +228,7 @@ def queue_blocked_approvals(
             scanner_evidence=_item_scanner_evidence(item),
         )
         persisted_request_id = store.add_approval_request(request, timestamp)
+        created_new_request = persisted_request_id == request.request_id
         if persisted_request_id != request.request_id:
             request = replace(
                 request,
@@ -235,6 +236,8 @@ def queue_blocked_approvals(
                 review_command=f"{GUARD_COMMAND} approvals approve {persisted_request_id}",
                 approval_url=build_approval_request_url(approval_center_url, persisted_request_id),
             )
+        if created_new_request:
+            _record_created_event(store, request, timestamp)
         _notify_pending_approval(store=store, request=request)
         queued.append(request.to_dict())
     return queued
@@ -441,6 +444,25 @@ def _record_resolution_event(store: GuardStore, request_id: str, action: str, sc
     )
 
 
+def _record_created_event(store: GuardStore, request: GuardApprovalRequest, created_at: str) -> None:
+    store.add_event(
+        "approval.created",
+        {
+            "request_id": request.request_id,
+            "harness": request.harness,
+            "artifact_id": request.artifact_id,
+            "artifact_name": request.artifact_name,
+            "artifact_type": request.artifact_type,
+            "policy_action": request.policy_action,
+            "recommended_scope": request.recommended_scope,
+            "source_scope": request.source_scope,
+            "workspace": request.workspace,
+            "publisher": request.publisher,
+        },
+        created_at,
+    )
+
+
 def _refresh_queue_result(
     store: GuardStore,
     result: dict[str, object],

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/src/codex_plugin_scanner/guard/local_supply_chain.py

@@ -21,6 +21,7 @@ from uuid import uuid4
 from codex_plugin_scanner.path_support import resolve_path_within_allowed_roots, resolves_within_root
 
 from .adapters.base import HarnessContext
+from .advisory_model import ProtectTargetIdentity, advisory_matches_target, build_package_url
 from .config import GuardConfig, resolve_risk_action
 from .models import GuardArtifact
 from .package_firewall_entitlement import resolve_package_firewall_entitlement
@@ -779,13 +780,18 @@ def build_package_protect_payload(
         config_path="hol-guard.toml",
         source_scope="project",
     )
-    artifact_hash = _package_request_artifact_hash(artifact, workspace_dir=workspace_dir)
     evaluation = evaluate_package_request_artifact(
         artifact=artifact,
         store=store,
         workspace_dir=workspace_dir,
         now=now,
     )
+    artifact_hash = _package_request_artifact_hash(
+        artifact,
+        workspace_dir=workspace_dir,
+        store=store,
+        evaluation=evaluation,
+    )
     evaluation = _apply_stored_package_policy_override(
         evaluation,
         store=store,
@@ -984,15 +990,137 @@ def _apply_stored_package_policy_override(
     return evaluation
 
 
-def _package_request_artifact_hash(artifact: GuardArtifact, *, workspace_dir: Path) -> str:
+def recompute_package_protect_artifact_hash(
+    command: Sequence[str],
+    *,
+    store: GuardStore,
+    workspace_dir: Path,
+    now: str | None = None,
+) -> str | None:
+    from .runtime.package_intent_parser import parse_package_intent
+
+    intent = parse_package_intent(shlex.join(command), workspace=workspace_dir)
+    if intent is None:
+        return None
+    sanitized_intent = replace(intent, redacted_command=shlex.join(redacted_command_tokens(command)))
+    artifact = build_package_request_artifact(
+        _LOCAL_SUPPLY_CHAIN_HARNESS,
+        sanitized_intent,
+        config_path="hol-guard.toml",
+        source_scope="project",
+    )
+    evaluation_timestamp = now or datetime.now(timezone.utc).isoformat(timespec="seconds").replace("+00:00", "Z")
+    evaluation = evaluate_package_request_artifact(
+        artifact=artifact,
+        store=store,
+        workspace_dir=workspace_dir,
+        now=evaluation_timestamp,
+    )
+    return _package_request_artifact_hash(
+        artifact,
+        workspace_dir=workspace_dir,
+        store=store,
+        evaluation=evaluation,
+    )
+
+
+def _package_target_identities(artifact: GuardArtifact) -> tuple[ProtectTargetIdentity, ...]:
+    metadata = artifact.metadata if isinstance(artifact.metadata, dict) else {}
+    targets = metadata.get("targets")
+    if not isinstance(targets, list):
+        return ()
+    identities: list[ProtectTargetIdentity] = []
+    for item in targets:
+        if not isinstance(item, dict):
+            continue
+        ecosystem = str(item.get("ecosystem") or "")
+        package_name = item.get("package_name") if isinstance(item.get("package_name"), str) else None
+        raw_spec = str(item.get("raw_spec") or package_name or "")
+        version = item.get("requested_specifier") if isinstance(item.get("requested_specifier"), str) else None
+        source_url = item.get("source_url") if isinstance(item.get("source_url"), str) else None
+        artifact_id = f"{ecosystem}:{package_name or raw_spec}"
+        artifact_name = package_name or raw_spec
+        identities.append(
+            ProtectTargetIdentity(
+                artifact_id=artifact_id,
+                artifact_name=artifact_name,
+                ecosystem=ecosystem,
+                package_name=package_name,
+                package_url=build_package_url(ecosystem, package_name, version),
+                source_url=source_url,
+            )
+        )
+    return tuple(identities)
+
+
+def _package_matched_cached_advisory_ids(store: GuardStore, artifact: GuardArtifact) -> tuple[str, ...]:
+    advisories = store.list_cached_advisories(limit=None)
+    identities = _package_target_identities(artifact)
+    matched_ids: set[str] = set()
+    for advisory in advisories:
+        for identity in identities:
+            if advisory_matches_target(advisory, identity):
+                advisory_id = advisory.get("id")
+                if isinstance(advisory_id, str) and advisory_id:
+                    matched_ids.add(advisory_id)
+                break
+    return tuple(sorted(matched_ids))
+
+
+def _package_feed_snapshot_hash(store: GuardStore) -> str | None:
+    workspace_id = store.get_cloud_workspace_id()
+    if workspace_id is None:
+        return None
+    cached_bundle = store.get_cached_supply_chain_bundle(workspace_id)
+    if not isinstance(cached_bundle, dict):
+        return None
+    bundle = cached_bundle.get("bundle")
+    if not isinstance(bundle, dict):
+        return None
+    value = bundle.get("feedSnapshotHash")
+    return value if isinstance(value, str) and value else None
+
+
+def _package_policy_gate_context(
+    store: GuardStore,
+    artifact: GuardArtifact,
+    evaluation: PackageRequestEvaluation,
+) -> dict[str, object]:
+    return {
+        "bundle_version": evaluation.bundle_version,
+        "decision": evaluation.decision,
+        "feed_snapshot_hash": _package_feed_snapshot_hash(store),
+        "matched_advisory_ids": list(_package_matched_cached_advisory_ids(store, artifact)),
+        "matched_rule_id": evaluation.matched_rule_id,
+        "policy_action": evaluation.policy_action,
+        "policy_version": evaluation.policy_version,
+    }
+
+
+def _package_request_artifact_hash(
+    artifact: GuardArtifact,
+    *,
+    workspace_dir: Path,
+    store: GuardStore,
+    evaluation: PackageRequestEvaluation,
+) -> str:
+    policy_gate = _package_policy_gate_context(store, artifact, evaluation)
     metadata = artifact.metadata if isinstance(artifact.metadata, dict) else {}
     targets = metadata.get("targets")
-    if isinstance(targets, list) and any(isinstance(item, dict) for item in targets):
-        return stable_digest_hex(artifact.artifact_id.encode("utf-8"))
     manifest_paths = tuple(str(item) for item in metadata.get("manifest_paths", []) if isinstance(item, str))
     lockfile_paths = tuple(str(item) for item in metadata.get("lockfile_paths", []) if isinstance(item, str))
-    if not manifest_paths and not lockfile_paths:
-        return stable_digest_hex(artifact.artifact_id.encode("utf-8"))
+    has_targets = isinstance(targets, list) and any(isinstance(item, dict) for item in targets)
+    if has_targets or (not manifest_paths and not lockfile_paths):
+        return stable_digest_hex(
+            json.dumps(
+                {
+                    "artifact_id": artifact.artifact_id,
+                    "policy_gate": policy_gate,
+                },
+                sort_keys=True,
+                separators=(",", ":"),
+            ).encode("utf-8")
+        )
     return stable_digest_hex(
         json.dumps(
             {
@@ -1001,6 +1129,7 @@ def _package_request_artifact_hash(artifact: GuardArtifact, *, workspace_dir: Pa
                 "lockfile_paths": list(lockfile_paths),
                 "manifest_hashes": _hash_existing_paths(workspace_dir, manifest_paths),
                 "lockfile_hashes": _hash_existing_paths(workspace_dir, lockfile_paths),
+                "policy_gate": policy_gate,
             },
             sort_keys=True,
             separators=(",", ":"),

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/src/codex_plugin_scanner/guard/protect.py

@@ -14,7 +14,7 @@ from urllib.parse import urlparse
 
 from .advisory_model import ProtectTargetIdentity, advisory_matches_target, build_package_url
 from .config import GuardConfig
-from .local_supply_chain import build_package_protect_payload
+from .local_supply_chain import build_package_protect_payload, recompute_package_protect_artifact_hash
 from .models import GuardReceipt
 from .receipts import build_receipt
 from .redaction import redact_text
@@ -138,7 +138,13 @@ def build_protect_payload(
         timeout_seconds=_protect_command_timeout_seconds(),
     )
     if package_payload is not None:
-        if cached_gate and not _package_payload_uses_saved_approval(package_payload[0]):
+        if cached_gate and not _package_saved_approval_covers_current_gate(
+            package_payload[0],
+            store=store,
+            workspace_dir=workspace_dir,
+            command=command,
+            now=now,
+        ):
             return _merge_cached_advisory_into_package_payload(
                 package_payload,
                 cached_verdict=cached_verdict,
@@ -224,6 +230,31 @@ def build_protect_payload(
     return (payload, int(execution.returncode))
 
 
+def _package_saved_approval_covers_current_gate(
+    payload: dict[str, object],
+    *,
+    store: GuardStore,
+    workspace_dir: Path,
+    command: list[str],
+    now: str,
+) -> bool:
+    if not _package_payload_uses_saved_approval(payload):
+        return False
+    receipt = payload.get("receipt")
+    if not isinstance(receipt, dict):
+        return False
+    stored_hash = receipt.get("artifact_hash")
+    if not isinstance(stored_hash, str) or not stored_hash:
+        return False
+    current_hash = recompute_package_protect_artifact_hash(
+        command,
+        store=store,
+        workspace_dir=workspace_dir,
+        now=now,
+    )
+    return current_hash == stored_hash
+
+
 def _package_payload_uses_saved_approval(payload: dict[str, object]) -> bool:
     evaluation = payload.get("supply_chain_evaluation")
     verdict = payload.get("verdict")

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.598"
+__version__ = "2.0.600"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/tests/test_guard_approvals.py

@@ -14,7 +14,7 @@ import pytest
 
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import bridge as guard_bridge_module
-from codex_plugin_scanner.guard.approvals import apply_approval_resolution, queue_blocked_approvals
+from codex_plugin_scanner.guard.approvals import build_runtime_snapshot, apply_approval_resolution, queue_blocked_approvals
 from codex_plugin_scanner.guard.bridge import BridgeConfig, GuardBridge
 from codex_plugin_scanner.guard.config import GuardConfig
 from codex_plugin_scanner.guard.consumer import artifact_hash, evaluate_detection
@@ -148,6 +148,42 @@ class TestGuardApprovals:
         assert resolved["action_envelope_json"] == action_envelope_json
         assert resolved["decision_v2_json"] == decision_v2_json
 
+    def test_guard_store_runtime_snapshot_exposes_pending_request_payload_contract(self, tmp_path):
+        store = GuardStore(tmp_path / "guard-home")
+        request = GuardApprovalRequest(
+            request_id="req-snapshot-contract",
+            harness="codex",
+            artifact_id="codex:project:workspace_skill",
+            artifact_name="workspace_skill",
+            artifact_hash="hash-snapshot-contract",
+            policy_action="require-reapproval",
+            recommended_scope="workspace",
+            changed_fields=("args",),
+            source_scope="project",
+            config_path=str(tmp_path / "workspace" / ".codex" / "config.toml"),
+            workspace=str(tmp_path / "workspace"),
+            review_command="hol-guard approvals approve req-snapshot-contract",
+            approval_url="http://127.0.0.1:4455/approvals/req-snapshot-contract",
+        )
+        store.add_approval_request(request, "2026-04-11T00:00:00+00:00")
+
+        snapshot = build_runtime_snapshot(
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-11T00:01:00+00:00",
+        )
+        queue_summary = snapshot["queue_summary"]
+        items = snapshot["items"]
+
+        assert snapshot["pending_count"] == 1
+        assert isinstance(queue_summary, dict)
+        assert queue_summary["next_request_id"] == "req-snapshot-contract"
+        assert isinstance(items, list)
+        assert items[0]["request_id"] == "req-snapshot-contract"
+        assert items[0]["recommended_scope"] == "workspace"
+        assert items[0]["review_command"] == "hol-guard approvals approve req-snapshot-contract"
+        assert items[0]["approval_url"] == "http://127.0.0.1:4455/approvals/req-snapshot-contract"
+
     def test_guard_store_loads_old_approval_rows_without_action_envelope(self, tmp_path):
         guard_home = tmp_path / "guard-home"
         guard_home.mkdir(parents=True, exist_ok=True)
@@ -521,7 +557,7 @@ class TestGuardApprovals:
             config_paths=(artifact.config_path,),
             artifacts=(artifact,),
         )
-        evaluation = {
+        evaluation: dict[str, object] = {
             "artifacts": [
                 {
                     "artifact_id": artifact.artifact_id,
@@ -641,6 +677,74 @@ class TestGuardApprovals:
         assert first[0]["request_id"] == second[0]["request_id"]
         assert notifications == [(first[0]["request_id"], False), (first[0]["request_id"], True)]
 
+    def test_guard_queue_blocked_approvals_emits_created_event_once_for_new_pending_request(self, tmp_path):
+        store = GuardStore(tmp_path / "guard-home")
+        workspace = tmp_path / "workspace"
+        artifact = GuardArtifact(
+            artifact_id="codex:runtime:project:danger_lab:event_notice",
+            name="danger_lab:event_notice",
+            harness="codex",
+            artifact_type="tool_call",
+            source_scope="project",
+            config_path=str(workspace / ".codex" / "config.toml"),
+            command="event_notice",
+        )
+        detection = HarnessDetection(
+            harness="codex",
+            installed=True,
+            command_available=True,
+            config_paths=(artifact.config_path,),
+            artifacts=(artifact,),
+        )
+        evaluation = {
+            "artifacts": [
+                {
+                    "artifact_id": artifact.artifact_id,
+                    "artifact_name": artifact.name,
+                    "artifact_hash": "hash-runtime",
+                    "artifact_type": artifact.artifact_type,
+                    "source_scope": artifact.source_scope,
+                    "config_path": artifact.config_path,
+                    "changed_fields": ["runtime_tool_call"],
+                    "policy_action": "require-reapproval",
+                    "launch_target": "event_notice",
+                }
+            ]
+        }
+
+        first = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-17T00:00:00+00:00",
+        )
+        second = queue_blocked_approvals(
+            detection=detection,
+            evaluation=evaluation,
+            store=store,
+            approval_center_url="http://127.0.0.1:4455",
+            now="2026-04-17T00:01:00+00:00",
+        )
+        events = store.list_events_after(0, limit=10, event_names=("approval.created",))
+        payload = events[0]["payload"]
+
+        assert first[0]["request_id"] == second[0]["request_id"]
+        assert len(events) == 1
+        assert isinstance(payload, dict)
+        assert payload == {
+            "request_id": first[0]["request_id"],
+            "harness": "codex",
+            "artifact_id": artifact.artifact_id,
+            "artifact_name": artifact.name,
+            "artifact_type": artifact.artifact_type,
+            "policy_action": "require-reapproval",
+            "recommended_scope": "artifact",
+            "source_scope": "project",
+            "workspace": str(workspace),
+            "publisher": None,
+        }
+
     def test_guard_queue_respects_disabled_desktop_notifications(self, tmp_path, monkeypatch):
         notifications: list[str] = []
 
@@ -1850,8 +1954,11 @@ class TestGuardApprovals:
 
         assert status == 200
         assert payload["resolved"] is True
+        assert payload["resolved_request"]["request_id"] == request_id
         assert payload["resolved_request"]["resolution_action"] == ("allow" if action == "approve" else "block")
         assert payload["resolved_request"]["resolution_scope"] == scope
+        assert payload["resolved_request"]["approval_url"] == "http://127.0.0.1/pending"
+        assert payload["resolved_request"]["review_command"] == f"hol-guard approvals {action} {request_id}"
         assert payload["remaining_pending_count"] == 1
         assert payload["next_selectable_request_id"] == f"{request_id}-other"
         assert store.get_approval_request(f"{request_id}-other")["status"] == "pending"

{plugin_scanner-2.0.598 → plugin_scanner-2.0.600}/tests/test_guard_package_shims.py

@@ -21,8 +21,10 @@ from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import shims as guard_shims_module
 from codex_plugin_scanner.guard.adapters.base import HarnessContext
 from codex_plugin_scanner.guard.approvals import apply_approval_resolution
+from codex_plugin_scanner.guard.models import PolicyDecision
 from codex_plugin_scanner.guard.cli import commands as guard_commands_module
 from codex_plugin_scanner.guard.protect import build_protect_payload
+from codex_plugin_scanner.guard.runtime import supply_chain_package_eval as supply_chain_package_eval_module
 from codex_plugin_scanner.guard.shim_probe import SHIM_PROBE_ENV_VALUE, SHIM_PROBE_ENV_VAR
 from codex_plugin_scanner.guard.shims import install_package_shims, package_shim_status
 from codex_plugin_scanner.guard.store import GuardStore
@@ -80,6 +82,9 @@ def _bundle_response(
     ecosystem: str,
     package_name: str,
     package_version: str,
+    feed_snapshot_hash: str = "feed-snapshot-shim-proof",
+    policy_hash: str = "policy-hash-shim-proof",
+    bundle_version: str = "1747612800000-shim-proof",
 ) -> dict[str, object]:
     generated_at = datetime(2026, 5, 19, tzinfo=timezone.utc)
     expires_at = generated_at + timedelta(hours=12)
@@ -100,9 +105,9 @@ def _bundle_response(
                 "title": f"High-risk package: {package_name}",
             }
         ],
-        "bundleVersion": "1747612800000-shim-proof",
+        "bundleVersion": bundle_version,
         "expiresAt": _iso(expires_at),
-        "feedSnapshotHash": "feed-snapshot-shim-proof",
+        "feedSnapshotHash": feed_snapshot_hash,
         "generatedAt": _iso(generated_at),
         "keyId": "guard-bundle-key-2026-05",
         "packages": [
@@ -126,7 +131,7 @@ def _bundle_response(
                 "version": package_version,
             }
         ],
-        "policyHash": "policy-hash-shim-proof",
+        "policyHash": policy_hash,
         "policyRules": [],
         "scoringVersion": "scf-v1",
         "sourceHashes": [{"payloadHash": "ghsa-feed-hash", "sourceKey": "ghsa", "staleStatus": "fresh"}],
@@ -1231,6 +1236,121 @@ def test_guard_protect_denied_retry_with_cloud_block_does_not_requeue_local_pack
     assert len(resolved) == 1
 
 
+def test_guard_protect_saved_approval_does_not_bypass_new_bundle_block_for_unpinned_package(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys,
+) -> None:
+    home_dir = tmp_path / "guard-home"
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir(parents=True, exist_ok=True)
+    fake_bin = tmp_path / "fake-bin"
+    fake_bin.mkdir(parents=True, exist_ok=True)
+    marker_path = tmp_path / "npm-somepkg-marker.json"
+    write_fake_manager_script(fake_bin=fake_bin, manager="npm", marker_path=marker_path, exit_code=0)
+    package_name = "somepkg"
+    original_resolved_target_version = supply_chain_package_eval_module._resolved_target_version
+
+    def _resolve_somepkg_version(**kwargs: object) -> str | None:
+        target = kwargs.get("target")
+        if isinstance(target, dict) and str(target.get("normalized_name")) == package_name:
+            return "1.0.0"
+        return original_resolved_target_version(**kwargs)
+
+    monkeypatch.setattr(
+        supply_chain_package_eval_module,
+        "_resolved_target_version",
+        _resolve_somepkg_version,
+    )
+    server, thread, sync_url = _start_cloud_eval_server(
+        decision="allow",
+        package_name=package_name,
+        evaluate_status=401,
+    )
+    monkeypatch.setattr(guard_commands_module, "ensure_guard_daemon", lambda _home: "http://127.0.0.1:5474")
+    try:
+        store = GuardStore(home_dir)
+        _seed_bundle_cache_only(
+            home_dir=home_dir,
+            ecosystem="npm",
+            package_name=package_name,
+            package_version="1.0.0",
+            action="allow",
+        )
+        _seed_workspace_sync_credentials(home_dir, sync_url)
+
+        first_payload, first_exit_code = build_protect_payload(
+            command=["npm", "install", package_name],
+            store=store,
+            workspace_dir=workspace_dir,
+            dry_run=True,
+            now="2026-05-19T00:00:00Z",
+        )
+
+        assert first_exit_code == 2
+        assert first_payload["verdict"]["action"] in {"block", "review"}
+        receipt = first_payload["receipt"]
+        assert isinstance(receipt, dict)
+        store.upsert_policy(
+            PolicyDecision(
+                harness="guard-cli",
+                scope="artifact",
+                action="allow",
+                artifact_id=str(receipt["artifact_id"]),
+                artifact_hash=str(receipt["artifact_hash"]),
+                workspace=None,
+                publisher=None,
+                reason="reviewed",
+            ),
+            "2026-05-19T00:00:00Z",
+        )
+
+        response = _bundle_response(
+            action="block",
+            ecosystem="npm",
+            package_name=package_name,
+            package_version="1.0.0",
+            feed_snapshot_hash="feed-snapshot-block-2",
+            policy_hash="policy-hash-block-2",
+            bundle_version="1747612801000-shim-proof",
+        )
+        store.cache_supply_chain_bundle(WORKSPACE_ID, response, "2026-05-19T01:00:00Z")
+        bundle = response["bundle"]
+        assert isinstance(bundle, dict)
+        store.set_sync_payload(
+            "supply_chain_bundle_entitlement",
+            {
+                "bundle_version": bundle["bundleVersion"],
+                "key_id": bundle["keyId"],
+                "policy_hash": bundle["policyHash"],
+                "tier": bundle["tier"],
+                "workspace_id": WORKSPACE_ID,
+            },
+            "2026-05-19T01:00:00Z",
+        )
+
+        original_path = os.environ.get("PATH", "")
+        monkeypatch.setenv("PATH", os.pathsep.join(filter(None, [str(fake_bin), original_path])))
+        retry_payload, retry_exit_code = build_protect_payload(
+            command=["npm", "install", package_name],
+            store=store,
+            workspace_dir=workspace_dir,
+            dry_run=False,
+            now="2026-05-19T01:00:00Z",
+        )
+    finally:
+        _stop_cloud_eval_server(server, thread)
+
+    assert retry_exit_code == 2
+    assert retry_payload["executed"] is False
+    assert retry_payload["verdict"]["action"] == "block"
+    assert marker_path.exists() is False
+    assert not any(
+        isinstance(reason, dict) and reason.get("code") == "saved_package_approval"
+        for reason in retry_payload["supply_chain_evaluation"]["reasons"]
+    )
+
+
 def test_guard_protect_retry_runs_after_cached_advisory_package_approval(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,