Description
The supply chain guardian saves normalized package names for persisted uv add approvals, but _is_uv_add_blocked() checks the raw package spec.
Example: approving a versioned spec saves the base package name. A later command with the same versioned spec can still ask again because the check compares the unnormalized token.
Expected behavior
A saved allow for a package should also match versioned specs for that package, the same way the other package allowlists work.
Suggested fix
Use the shared allowlist normalization path in _is_uv_add_blocked() and add a regression test for versioned uv add specs. Apply the same fix to plugin, canonical, and package copies.
Environment
- OS: Darwin 25.3.0
- Shell: zsh
- Git: 2.50.1 (Apple Git-155)
- agentic-config: 0.3.0
Reported via /skill:ac-tools-ac-issue command
Description
The supply chain guardian saves normalized package names for persisted
uv addapprovals, but_is_uv_add_blocked()checks the raw package spec.Example: approving a versioned spec saves the base package name. A later command with the same versioned spec can still ask again because the check compares the unnormalized token.
Expected behavior
A saved allow for a package should also match versioned specs for that package, the same way the other package allowlists work.
Suggested fix
Use the shared allowlist normalization path in
_is_uv_add_blocked()and add a regression test for versioneduv addspecs. Apply the same fix to plugin, canonical, and package copies.Environment
Reported via
/skill:ac-tools-ac-issuecommand