feat: authenticated Malysis analyzer with tenant exclusion support (#313)

* feat: authenticated Malysis analyzer with tenant exclusion support

When SafeDep Cloud credentials are available (keychain or environment),
PMG now uses an authenticated malware analysis query against
api.safedep.io instead of the unauthenticated community endpoint
(community-api.safedep.io). The API key and tenant ID are supplied via
the gRPC connection.

The authenticated response may carry a tenant-specific malicious package
exclusion. This is honored as an opt-in trust signal: a flagged package
is downgraded to allow only when a concrete exclusion (non-empty ID) is
present for the exact package version queried. Exclusions are never
honored for community queries and never weaken the verdict for packages
that were not flagged. Allowed-by-exclusion packages are surfaced as a
warning so the trust decision is never silent.

Changes are additive; non-authenticated usage is unchanged. Credential
resolution is extracted into internal/cloudauth and reused by both the
analyzer factory and the existing cloud sync client.

* fix: surface tenant exclusions in proxy mode; clarify comments

- Warn when proxy interceptor allows a flagged package due to a tenant
  exclusion, matching the guard flow so the trust decision is not silent.
- Remove stray doc comment above warnIfExcluded.
- Clarify that a verified-malware verdict can be downgraded by an
  exclusion in applyExclusion.

---------

Co-authored-by: Claude <noreply@anthropic.com>

analyzer/malysis_query_test.go

@@ -150,6 +150,127 @@ func TestMalysisQueryAnalyzer_AlwaysBlockOnVerifiedMalware(t *testing.T) {
 	assert.Equal(t, ActionBlock, result.Action, "Verified malware must be blocked always")
 }
 
+func TestMalysisQueryAnalyzer_HonorsExclusionForFlaggedPackage(t *testing.T) {
+	cfg := config.Get()
+	origParanoid := cfg.Config.Paranoid
+	cfg.Config.Paranoid = false
+	defer func() { cfg.Config.Paranoid = origParanoid }()
+
+	// Verified malware that would normally be blocked, but the tenant has an
+	// exclusion trusting this exact package version.
+	resp := &malysisv1.QueryPackageAnalysisResponse{
+		AnalysisId: "analysis-excl",
+		Report: &malysisv1pb.Report{
+			Inference: &malysisv1pb.Report_Inference{
+				IsMalware: true,
+				Summary:   "Suspicious patterns detected",
+			},
+		},
+		VerificationRecord: &malysisv1pb.VerificationRecord{
+			IsMalware: true,
+		},
+		MaliciousPackageExclusion: &malysisv1.QueryPackageAnalysisResponse_MaliciousPackageExclusion{
+			ExclusionId: "excl-1",
+			Reason:      "Reviewed and trusted internally",
+		},
+	}
+
+	an := &malysisQueryAnalyzer{
+		client:          &stubMalwareAnalysisServiceClient{resp: resp},
+		honorExclusions: true,
+	}
+
+	pv := makePkgVersion("trusted-internal-pkg", "1.2.3")
+	result, err := an.Analyze(context.Background(), pv)
+	assert.NoError(t, err)
+	assert.Equal(t, ActionAllow, result.Action, "Exclusion should downgrade a flagged package to allow")
+	assert.True(t, result.IsExcluded)
+	assert.Equal(t, "excl-1", result.ExclusionID)
+	assert.Equal(t, "Reviewed and trusted internally", result.ExclusionReason)
+	// Inference flags are retained for reporting/audit
+	assert.True(t, result.IsMalware)
+	assert.True(t, result.IsVerified)
+}
+
+func TestMalysisQueryAnalyzer_IgnoresExclusionWhenNotEnabled(t *testing.T) {
+	// Community analyzer must never honor exclusions even if one is present.
+	resp := &malysisv1.QueryPackageAnalysisResponse{
+		AnalysisId: "analysis-excl-2",
+		Report: &malysisv1pb.Report{
+			Inference: &malysisv1pb.Report_Inference{IsMalware: true},
+		},
+		VerificationRecord: &malysisv1pb.VerificationRecord{IsMalware: true},
+		MaliciousPackageExclusion: &malysisv1.QueryPackageAnalysisResponse_MaliciousPackageExclusion{
+			ExclusionId: "excl-2",
+			Reason:      "Should be ignored",
+		},
+	}
+
+	an := &malysisQueryAnalyzer{
+		client:          &stubMalwareAnalysisServiceClient{resp: resp},
+		honorExclusions: false,
+	}
+
+	pv := makePkgVersion("verified-malware", "9.9.9")
+	result, err := an.Analyze(context.Background(), pv)
+	assert.NoError(t, err)
+	assert.Equal(t, ActionBlock, result.Action, "Exclusions must be ignored when not enabled")
+	assert.False(t, result.IsExcluded)
+}
+
+func TestMalysisQueryAnalyzer_IgnoresEmptyExclusionId(t *testing.T) {
+	// An exclusion with no ID is not a concrete, exact match and must be ignored.
+	resp := &malysisv1.QueryPackageAnalysisResponse{
+		AnalysisId: "analysis-excl-3",
+		Report: &malysisv1pb.Report{
+			Inference: &malysisv1pb.Report_Inference{IsMalware: true},
+		},
+		VerificationRecord: &malysisv1pb.VerificationRecord{IsMalware: true},
+		MaliciousPackageExclusion: &malysisv1.QueryPackageAnalysisResponse_MaliciousPackageExclusion{
+			ExclusionId: "",
+			Reason:      "No id",
+		},
+	}
+
+	an := &malysisQueryAnalyzer{
+		client:          &stubMalwareAnalysisServiceClient{resp: resp},
+		honorExclusions: true,
+	}
+
+	pv := makePkgVersion("verified-malware", "9.9.9")
+	result, err := an.Analyze(context.Background(), pv)
+	assert.NoError(t, err)
+	assert.Equal(t, ActionBlock, result.Action)
+	assert.False(t, result.IsExcluded)
+}
+
+func TestMalysisQueryAnalyzer_ExclusionDoesNotAffectCleanPackage(t *testing.T) {
+	// A non-malware package with a spurious exclusion stays allowed and is not
+	// marked as excluded (nothing to trust).
+	resp := &malysisv1.QueryPackageAnalysisResponse{
+		AnalysisId: "analysis-excl-4",
+		Report: &malysisv1pb.Report{
+			Inference: &malysisv1pb.Report_Inference{IsMalware: false},
+		},
+		VerificationRecord: &malysisv1pb.VerificationRecord{IsMalware: false},
+		MaliciousPackageExclusion: &malysisv1.QueryPackageAnalysisResponse_MaliciousPackageExclusion{
+			ExclusionId: "excl-4",
+			Reason:      "Stale exclusion",
+		},
+	}
+
+	an := &malysisQueryAnalyzer{
+		client:          &stubMalwareAnalysisServiceClient{resp: resp},
+		honorExclusions: true,
+	}
+
+	pv := makePkgVersion("clean-pkg", "1.0.0")
+	result, err := an.Analyze(context.Background(), pv)
+	assert.NoError(t, err)
+	assert.Equal(t, ActionAllow, result.Action)
+	assert.False(t, result.IsExcluded)
+}
+
 // Implement the full client interface surface expected by malysisv1grpc.MalwareAnalysisServiceClient
 func (s *stubMalwareAnalysisServiceClient) AnalyzePackage(ctx context.Context, req *malysisv1.AnalyzePackageRequest, opts ...grpc.CallOption) (*malysisv1.AnalyzePackageResponse, error) {
 	// Not used in these tests; return a nil response with no error