feat: advisory message appended to block output (#362)

* docs(specs): add custom block messages and package blocklist spec

* docs(specs): add custom block messages and package blocklist implementation plan

* feat(config): add blocked_packages list and custom block messages

* feat(audit): add package_blocklist_blocked event and blocklist model

* feat(proxy): block blocklisted packages in the policy gate before analysis

* feat(guard): block blocklisted packages before trust skip and analysis

* feat(ui): render blocklist blocks and custom messages, fix silent-mode block output

* feat(proxy): append custom messages to malware and go-cooldown block bodies

* test(proxye2e): cover blocklist enforcement and custom block messages

* docs(specs): remove spec and plan documents

* refactor: drop guard-flow blocklist enforcement and trim docs

Guard mode is being deprecated; the blocklist is enforced in proxy mode
only. Remove the trusted_packages mirroring references outside the docs.

* refactor(config): consolidate blocklist and block message under top-level block section

Replace dependency_cooldown.message, malware.message and blocked_packages
with a single block section: block.message is appended to every block
output regardless of which control blocked, and block.packages is the
package blocklist.

* fix(ui): render block.message as info note with clean spacing

* fix(ui): indent wrapped continuation lines in block reasons and messages

* update config template

* refactor(config): replace block section with top-level advisory_message

Remove the package blocklist (will be implemented as part of policies in
the future) and replace block.message with an optional top-level
advisory_message appended to every block output.

* chore(config): move advisory_message near top-level scalar configs in template

test/proxye2e/proxye2e_test.go

@@ -567,3 +567,49 @@ func TestProxyFlow_Go(t *testing.T) {
 		},
 	})
 }
+
+func blockedBody(res ExecResult) string {
+	for _, r := range res.Requests {
+		if r.Blocked {
+			return r.Body
+		}
+	}
+	return ""
+}
+
+func TestProxyFlow_AdvisoryMessage(t *testing.T) {
+	RunCases(t, []TestCase{
+		{
+			Name: "malware block body carries advisory message",
+			Config: func(rc *config.RuntimeConfig) {
+				rc.Config.AdvisoryMessage = "Report false positives in #security-help"
+			},
+			Setup: func(h *Harness) {
+				h.Registry.AddNpm(NpmPackage{Name: "evil", DistTagLatest: "1.0.0",
+					Versions: []NpmVersion{{Version: "1.0.0", PublishedAt: old()}}})
+				h.Analyzer.SetNpm("evil", "1.0.0", VerifiedMalware())
+			},
+			Exec: func(h *Harness) ExecResult { return h.Npm().Install("evil", "1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked())
+				assert.Contains(t, blockedBody(res), "Report false positives in #security-help")
+			},
+		},
+		{
+			Name: "go cooldown block body carries advisory message",
+			Config: func(rc *config.RuntimeConfig) {
+				rc.Config.DependencyCooldown = config.DependencyCooldownConfig{Enabled: true, Days: 7}
+				rc.Config.AdvisoryMessage = "Request an exemption at go/pmg-exceptions"
+			},
+			Setup: func(h *Harness) {
+				h.Registry.AddGoModule(GoModule{Path: "example.com/fresh",
+					Versions: []GoVersion{{Version: "v1.0.0", PublishedAt: recent()}}})
+			},
+			Exec: func(h *Harness) ExecResult { return h.Go().Install("example.com/fresh", "v1.0.0") },
+			Assert: func(t *testing.T, h *Harness, res ExecResult) {
+				assert.True(t, res.Blocked())
+				assert.Contains(t, blockedBody(res), "Request an exemption at go/pmg-exceptions")
+			},
+		},
+	})
+}

test/proxye2e/runner.go

@@ -59,12 +59,13 @@ func applyConfig(t *testing.T, override func(rc *config.RuntimeConfig)) {
 	rc.Config.Paranoid = false
 	rc.Config.TrustedPackages = nil
 	rc.Config.DependencyCooldown = config.DependencyCooldownConfig{}
+	rc.Config.AdvisoryMessage = ""
 
 	if override != nil {
 		override(rc)
 	}
 
-	if err := config.PreprocessTrustedPackages(&rc.Config); err != nil {
+	if err := config.PreprocessPackageRefs(&rc.Config); err != nil {
 		t.Fatalf("failed to preprocess trusted packages: %v", err)
 	}
 }