From 1eb4fe05fdd7162cd0e4cbe58e41f01e2cfab95e Mon Sep 17 00:00:00 2001
From: Chris Ingram <chris.ingram@greenpixie.com>
Date: Mon, 6 Apr 2026 13:01:42 +0100
Subject: [PATCH 01/23] Add pdm package manager support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PDM is a modern Python package manager using pyproject.toml (PEP 621).
Uses the same MITM-only proxy approach as poetry/uv/pipx — all malware
detection and minimum package age enforcement happens at the proxy layer
by intercepting PyPI requests.
---
 README.md                                     |   5 +-
 package-lock.json                             |   2 +
 packages/safe-chain/bin/aikido-pdm.js         |  13 +
 packages/safe-chain/package.json              |   3 +-
 .../packagemanager/currentPackageManager.js   |   3 +
 .../pdm/createPdmPackageManager.js            |  72 ++++
 .../pdm/createPdmPackageManager.spec.js       |  14 +
 .../src/shell-integration/helpers.js          |   6 +
 .../startup-scripts/init-fish.fish            |   4 +
 .../startup-scripts/init-posix.sh             |   4 +
 .../startup-scripts/init-pwsh.ps1             |   4 +
 test/e2e/Dockerfile                           |   4 +
 test/e2e/pdm.e2e.spec.js                      | 317 ++++++++++++++++++
 13 files changed, 448 insertions(+), 3 deletions(-)
 create mode 100644 packages/safe-chain/bin/aikido-pdm.js
 create mode 100644 packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.js
 create mode 100644 packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.spec.js
 create mode 100644 test/e2e/pdm.e2e.spec.js

diff --git a/README.md b/README.md
index 3e73137..800d30c 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,7 @@ Aikido Safe Chain supports the following package managers:
 - 📦 **uv**
 - 📦 **poetry**
 - 📦 **pipx**
+- 📦 **pdm**
 
 # Usage
 
@@ -66,7 +67,7 @@ You can find all available versions on the [releases page](https://github.com/Ai
 ### Verify the installation
 
 1. **❗Restart your terminal** to start using the Aikido Safe Chain.
-   - This step is crucial as it ensures that the shell aliases for npm, npx, yarn, pnpm, pnpx, bun, bunx, pip, pip3, poetry, uv and pipx are loaded correctly. If you do not restart your terminal, the aliases will not be available.
+   - This step is crucial as it ensures that the shell aliases for npm, npx, yarn, pnpm, pnpx, bun, bunx, pip, pip3, poetry, uv, pipx and pdm are loaded correctly. If you do not restart your terminal, the aliases will not be available.
 
 2. **Verify the installation** by running the verification command:
 
@@ -97,7 +98,7 @@ You can find all available versions on the [releases page](https://github.com/Ai
 
    - The output should show that Aikido Safe Chain is blocking the installation of these test packages as they are flagged as malware.
 
-When running `npm`, `npx`, `yarn`, `pnpm`, `pnpx`, `bun`, `bunx`, `pip`, `pip3`, `uv`, `poetry` and `pipx` commands, the Aikido Safe Chain will automatically check for malware in the packages you are trying to install. It also intercepts Python module invocations for pip when available (e.g., `python -m pip install ...`, `python3 -m pip download ...`). If any malware is detected, it will prompt you to exit the command.
+When running `npm`, `npx`, `yarn`, `pnpm`, `pnpx`, `bun`, `bunx`, `pip`, `pip3`, `uv`, `poetry`, `pipx` and `pdm` commands, the Aikido Safe Chain will automatically check for malware in the packages you are trying to install. It also intercepts Python module invocations for pip when available (e.g., `python -m pip install ...`, `python3 -m pip download ...`). If any malware is detected, it will prompt you to exit the command.
 
 You can check the installed version by running:
 
diff --git a/package-lock.json b/package-lock.json
index ea8c410..e6dc7b7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3108,6 +3108,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4018,6 +4019,7 @@
         "aikido-bunx": "bin/aikido-bunx.js",
         "aikido-npm": "bin/aikido-npm.js",
         "aikido-npx": "bin/aikido-npx.js",
+        "aikido-pdm": "bin/aikido-pdm.js",
         "aikido-pip": "bin/aikido-pip.js",
         "aikido-pip3": "bin/aikido-pip3.js",
         "aikido-pipx": "bin/aikido-pipx.js",
diff --git a/packages/safe-chain/bin/aikido-pdm.js b/packages/safe-chain/bin/aikido-pdm.js
new file mode 100644
index 0000000..9c6cf94
--- /dev/null
+++ b/packages/safe-chain/bin/aikido-pdm.js
@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+
+import { main } from "../src/main.js";
+import { initializePackageManager } from "../src/packagemanager/currentPackageManager.js";
+import { setEcoSystem, ECOSYSTEM_PY } from "../src/config/settings.js";
+
+setEcoSystem(ECOSYSTEM_PY);
+initializePackageManager("pdm");
+
+(async () => {
+  var exitCode = await main(process.argv.slice(2));
+  process.exit(exitCode);
+})();
diff --git a/packages/safe-chain/package.json b/packages/safe-chain/package.json
index d4f3501..1ed2d5b 100644
--- a/packages/safe-chain/package.json
+++ b/packages/safe-chain/package.json
@@ -22,6 +22,7 @@
     "aikido-python3": "bin/aikido-python3.js",
     "aikido-poetry": "bin/aikido-poetry.js",
     "aikido-pipx": "bin/aikido-pipx.js",
+    "aikido-pdm": "bin/aikido-pdm.js",
     "safe-chain": "bin/safe-chain.js"
   },
   "type": "module",
@@ -36,7 +37,7 @@
   "keywords": [],
   "author": "Aikido Security",
   "license": "AGPL-3.0-or-later",
-  "description": "The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), [pnpx](https://pnpm.io/cli/dlx), [bun](https://bun.sh/), [bunx](https://bun.sh/docs/cli/bunx), [uv](https://docs.astral.sh/uv/) (Python), and [pip](https://pip.pypa.io/) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm, pnpx, bun, bunx, uv, or pip/pip3 from downloading or running the malware.",
+  "description": "The Aikido Safe Chain wraps around the [npm cli](https://github.com/npm/cli), [npx](https://github.com/npm/cli/blob/latest/docs/content/commands/npx.md), [yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), [pnpx](https://pnpm.io/cli/dlx), [bun](https://bun.sh/), [bunx](https://bun.sh/docs/cli/bunx), [uv](https://docs.astral.sh/uv/) (Python), [pip](https://pip.pypa.io/), and [pdm](https://pdm-project.org/) to provide extra checks before installing new packages. This tool will detect when a package contains malware and prompt you to exit, preventing npm, npx, yarn, pnpm, pnpx, bun, bunx, uv, pip/pip3, or pdm from downloading or running the malware.",
   "dependencies": {
     "archiver": "^7.0.1",
     "certifi": "14.5.15",
diff --git a/packages/safe-chain/src/packagemanager/currentPackageManager.js b/packages/safe-chain/src/packagemanager/currentPackageManager.js
index af297dc..79e4625 100644
--- a/packages/safe-chain/src/packagemanager/currentPackageManager.js
+++ b/packages/safe-chain/src/packagemanager/currentPackageManager.js
@@ -13,6 +13,7 @@ import { createPipPackageManager } from "./pip/createPackageManager.js";
 import { createUvPackageManager } from "./uv/createUvPackageManager.js";
 import { createPoetryPackageManager } from "./poetry/createPoetryPackageManager.js";
 import { createPipXPackageManager } from "./pipx/createPipXPackageManager.js";
+import { createPdmPackageManager } from "./pdm/createPdmPackageManager.js";
 
 /**
  * @type {{packageManagerName: PackageManager | null}}
@@ -64,6 +65,8 @@ export function initializePackageManager(packageManagerName, context) {
     state.packageManagerName = createPoetryPackageManager();
   } else if (packageManagerName === "pipx") {
     state.packageManagerName = createPipXPackageManager();
+  } else if (packageManagerName === "pdm") {
+    state.packageManagerName = createPdmPackageManager();
   } else {
     throw new Error("Unsupported package manager: " + packageManagerName);
   }
diff --git a/packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.js b/packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.js
new file mode 100644
index 0000000..1649a89
--- /dev/null
+++ b/packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.js
@@ -0,0 +1,72 @@
+import { ui } from "../../environment/userInteraction.js";
+import { safeSpawn } from "../../utils/safeSpawn.js";
+import { mergeSafeChainProxyEnvironmentVariables } from "../../registryProxy/registryProxy.js";
+import { getCombinedCaBundlePath } from "../../registryProxy/certBundle.js";
+import { reportCommandExecutionFailure } from "../_shared/commandErrors.js";
+
+/**
+ * @returns {import("../currentPackageManager.js").PackageManager}
+ */
+export function createPdmPackageManager() {
+  return {
+    runCommand: (args) => runPdmCommand(args),
+
+    // MITM only approach for PDM
+    isSupportedCommand: () => false,
+    getDependencyUpdatesForCommand: () => [],
+  };
+}
+
+/**
+ * Sets CA bundle environment variables used by PDM and Python libraries.
+ * PDM uses httpx (via unearth) which respects SSL_CERT_FILE through Python's ssl module.
+ *
+ * @param {NodeJS.ProcessEnv} env - Environment object to modify
+ * @param {string} combinedCaPath - Path to the combined CA bundle
+ */
+function setPdmCaBundleEnvironmentVariables(env, combinedCaPath) {
+  // SSL_CERT_FILE: Used by Python SSL libraries and httpx (which PDM uses)
+  if (env.SSL_CERT_FILE) {
+    ui.writeWarning("Safe-chain: User defined SSL_CERT_FILE found in environment. It will be overwritten.");
+  }
+  env.SSL_CERT_FILE = combinedCaPath;
+
+  // REQUESTS_CA_BUNDLE: Used by the requests library (PDM plugins may use it)
+  if (env.REQUESTS_CA_BUNDLE) {
+    ui.writeWarning("Safe-chain: User defined REQUESTS_CA_BUNDLE found in environment. It will be overwritten.");
+  }
+  env.REQUESTS_CA_BUNDLE = combinedCaPath;
+
+  // PIP_CERT: PDM may use pip internally
+  if (env.PIP_CERT) {
+    ui.writeWarning("Safe-chain: User defined PIP_CERT found in environment. It will be overwritten.");
+  }
+  env.PIP_CERT = combinedCaPath;
+}
+
+/**
+ * Runs a pdm command with safe-chain's certificate bundle and proxy configuration.
+ *
+ * PDM respects standard HTTP_PROXY/HTTPS_PROXY environment variables through
+ * httpx which it uses for package downloads.
+ *
+ * @param {string[]} args - Command line arguments to pass to pdm
+ * @returns {Promise<{status: number}>} Exit status of the pdm command
+ */
+async function runPdmCommand(args) {
+  try {
+    const env = mergeSafeChainProxyEnvironmentVariables(process.env);
+
+    const combinedCaPath = getCombinedCaBundlePath();
+    setPdmCaBundleEnvironmentVariables(env, combinedCaPath);
+
+    const result = await safeSpawn("pdm", args, {
+      stdio: "inherit",
+      env,
+    });
+
+    return { status: result.status };
+  } catch (/** @type any */ error) {
+    return reportCommandExecutionFailure(error, "pdm");
+  }
+}
diff --git a/packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.spec.js b/packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.spec.js
new file mode 100644
index 0000000..2b2266b
--- /dev/null
+++ b/packages/safe-chain/src/packagemanager/pdm/createPdmPackageManager.spec.js
@@ -0,0 +1,14 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import { createPdmPackageManager } from "./createPdmPackageManager.js";
+
+test("createPdmPackageManager", async (t) => {
+  await t.test("should create package manager with required interface", () => {
+    const pm = createPdmPackageManager();
+
+    assert.ok(pm);
+    assert.strictEqual(typeof pm.runCommand, "function");
+    assert.strictEqual(typeof pm.isSupportedCommand, "function");
+    assert.strictEqual(typeof pm.getDependencyUpdatesForCommand, "function");
+  });
+});
diff --git a/packages/safe-chain/src/shell-integration/helpers.js b/packages/safe-chain/src/shell-integration/helpers.js
index 18ba52e..6bef263 100644
--- a/packages/safe-chain/src/shell-integration/helpers.js
+++ b/packages/safe-chain/src/shell-integration/helpers.js
@@ -102,6 +102,12 @@ export const knownAikidoTools = [
     ecoSystem: ECOSYSTEM_PY,
     internalPackageManagerName: "pipx",
   },
+  {
+    tool: "pdm",
+    aikidoCommand: "aikido-pdm",
+    ecoSystem: ECOSYSTEM_PY,
+    internalPackageManagerName: "pdm",
+  },
   // When adding a new tool here, also update the documentation for the new tool in the README.md
 ];
 
diff --git a/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish b/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish
index 13463f6..a33c3d5 100644
--- a/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish
+++ b/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish
@@ -69,6 +69,10 @@ function pipx
     wrapSafeChainCommand "pipx" $argv
 end
 
+function pdm
+    wrapSafeChainCommand "pdm" $argv
+end
+
 function printSafeChainWarning
     set original_cmd $argv[1]
 
diff --git a/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh b/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh
index ebaaf3c..51eece2 100644
--- a/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh
+++ b/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh
@@ -65,6 +65,10 @@ function pipx() {
   wrapSafeChainCommand "pipx" "$@"
 }
 
+function pdm() {
+  wrapSafeChainCommand "pdm" "$@"
+}
+
 function printSafeChainWarning() {
   # \033[43;30m is used to set the background color to yellow and text color to black
   # \033[0m is used to reset the text formatting
diff --git a/packages/safe-chain/src/shell-integration/startup-scripts/init-pwsh.ps1 b/packages/safe-chain/src/shell-integration/startup-scripts/init-pwsh.ps1
index f82d0fc..15ac86c 100644
--- a/packages/safe-chain/src/shell-integration/startup-scripts/init-pwsh.ps1
+++ b/packages/safe-chain/src/shell-integration/startup-scripts/init-pwsh.ps1
@@ -70,6 +70,10 @@ function pipx {
     Invoke-WrappedCommand "pipx" $args $MyInvocation.Line $MyInvocation.OffsetInLine
 }
 
+function pdm {
+    Invoke-WrappedCommand "pdm" $args $MyInvocation.Line $MyInvocation.OffsetInLine
+}
+
 function Write-SafeChainWarning {
     param([string]$Command)
     
diff --git a/test/e2e/Dockerfile b/test/e2e/Dockerfile
index bc7ffc2..ff2a86b 100644
--- a/test/e2e/Dockerfile
+++ b/test/e2e/Dockerfile
@@ -77,6 +77,10 @@ RUN apt-get update && apt-get install -y pipx && \
         pipx install poetry && \
         ln -sf /root/.local/bin/poetry /usr/local/bin/poetry
 
+# Install PDM
+RUN pipx install pdm && \
+    ln -sf /root/.local/bin/pdm /usr/local/bin/pdm
+
 # Copy and install Safe chain
 COPY --from=builder /app/*.tgz /pkgs/
 RUN npm install -g /pkgs/*.tgz
diff --git a/test/e2e/pdm.e2e.spec.js b/test/e2e/pdm.e2e.spec.js
new file mode 100644
index 0000000..96379fb
--- /dev/null
+++ b/test/e2e/pdm.e2e.spec.js
@@ -0,0 +1,317 @@
+import { describe, it, before, beforeEach, afterEach } from "node:test";
+import { DockerTestContainer } from "./DockerTestContainer.js";
+import assert from "node:assert";
+
+describe("E2E: pdm coverage", () => {
+  let container;
+
+  before(async () => {
+    DockerTestContainer.buildImage();
+  });
+
+  beforeEach(async () => {
+    // Run a new Docker container for each test
+    container = new DockerTestContainer();
+    await container.start();
+
+    const installationShell = await container.openShell("zsh");
+    await installationShell.runCommand("safe-chain setup");
+
+    // Clear pdm cache
+    await installationShell.runCommand("command pdm cache clear");
+  });
+
+  afterEach(async () => {
+    // Stop and clean up the container after each test
+    if (container) {
+      await container.stop();
+      container = null;
+    }
+  });
+
+  it(`successfully installs known safe packages with pdm add`, async () => {
+    const shell = await container.openShell("zsh");
+
+    // Initialize a new pdm project
+    await shell.runCommand("mkdir /tmp/test-pdm-project && cd /tmp/test-pdm-project");
+    await shell.runCommand("cd /tmp/test-pdm-project && pdm init --non-interactive");
+
+    // Add a safe package
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-project && pdm add requests"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Installing"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm add with specific version`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-version && cd /tmp/test-pdm-version");
+    await shell.runCommand("cd /tmp/test-pdm-version && pdm init --non-interactive");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-version && pdm add requests==2.32.3"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Installing"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`safe-chain blocks installation of malicious Python packages via pdm`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-malware && cd /tmp/test-pdm-malware");
+    await shell.runCommand("cd /tmp/test-pdm-malware && pdm init --non-interactive");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-malware && pdm add safe-chain-pi-test"
+    );
+
+    assert.ok(
+      result.output.includes("blocked by safe-chain"),
+      `Expected malware to be blocked. Output was:\n${result.output}`
+    );
+    assert.ok(
+      result.output.includes("Exiting without installing malicious packages."),
+      `Expected exit message. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm install installs dependencies from pyproject.toml`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-install && cd /tmp/test-pdm-install");
+    await shell.runCommand("cd /tmp/test-pdm-install && pdm init --non-interactive");
+    await shell.runCommand("cd /tmp/test-pdm-install && pdm add requests");
+
+    // Now remove the virtualenv and run install
+    await shell.runCommand("cd /tmp/test-pdm-install && rm -rf .venv");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-install && pdm install"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Installing"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm update updates dependencies`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-update && cd /tmp/test-pdm-update");
+    await shell.runCommand("cd /tmp/test-pdm-update && pdm init --non-interactive");
+    await shell.runCommand("cd /tmp/test-pdm-update && pdm add requests");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-update && pdm update"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Updating"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm update with specific packages`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-update-specific && cd /tmp/test-pdm-update-specific");
+    await shell.runCommand("cd /tmp/test-pdm-update-specific && pdm init --non-interactive");
+    await shell.runCommand("cd /tmp/test-pdm-update-specific && pdm add requests certifi");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-update-specific && pdm update requests"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Updating"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm add with multiple packages`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-multi && cd /tmp/test-pdm-multi");
+    await shell.runCommand("cd /tmp/test-pdm-multi && pdm init --non-interactive");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-multi && pdm add requests certifi"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Installing"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm add with extras`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-extras && cd /tmp/test-pdm-extras");
+    await shell.runCommand("cd /tmp/test-pdm-extras && pdm init --non-interactive");
+
+    // Use quotes to prevent shell expansion of square brackets
+    const result = await shell.runCommand(
+      'cd /tmp/test-pdm-extras && pdm add "requests[security]"'
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Installing"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm add with development group`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-dev && cd /tmp/test-pdm-dev");
+    await shell.runCommand("cd /tmp/test-pdm-dev && pdm init --non-interactive");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-dev && pdm add -dG dev pytest"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Installing"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm lock creates/updates lock file`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-lock && cd /tmp/test-pdm-lock");
+    await shell.runCommand("cd /tmp/test-pdm-lock && pdm init --non-interactive");
+    await shell.runCommand("cd /tmp/test-pdm-lock && pdm add requests");
+    await shell.runCommand("cd /tmp/test-pdm-lock && rm pdm.lock");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-lock && pdm lock"
+    );
+
+    assert.ok(
+      result.output.includes("no malware found.") || result.output.includes("Resolving") || result.output.includes("lock file"),
+      `Output did not include expected text. Output was:\n${result.output}`
+    );
+  });
+
+  it(`pdm remove does not download packages`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-remove && cd /tmp/test-pdm-remove");
+    await shell.runCommand("cd /tmp/test-pdm-remove && pdm init --non-interactive");
+    await shell.runCommand("cd /tmp/test-pdm-remove && pdm add requests");
+
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-remove && pdm remove requests"
+    );
+
+    // Remove should succeed - it doesn't download packages, just modifies pyproject.toml
+    assert.ok(
+      !result.output.includes("blocked"),
+      `Remove command should not trigger downloads. Output was:\n${result.output}`
+    );
+  });
+
+  it(`blocks malware during pdm install`, async () => {
+    const shell = await container.openShell("zsh");
+
+    // Create a project with malware in dependencies
+    await shell.runCommand("mkdir /tmp/test-pdm-install-malware && cd /tmp/test-pdm-install-malware");
+    await shell.runCommand("cd /tmp/test-pdm-install-malware && pdm init --non-interactive");
+
+    // Add malware package - this will create lock file and attempt download
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-install-malware && pdm add safe-chain-pi-test 2>&1"
+    );
+
+    assert.ok(
+      result.output.includes("blocked by safe-chain"),
+      `Expected malware to be blocked during add (which triggers install). Output was:\n${result.output}`
+    );
+    assert.ok(
+      result.output.includes("Exiting without installing malicious packages."),
+      `Expected exit message. Output was:\n${result.output}`
+    );
+  });
+
+  it(`blocks malware when adding malicious dependency alongside safe one`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-batch && cd /tmp/test-pdm-batch");
+    await shell.runCommand("cd /tmp/test-pdm-batch && pdm init --non-interactive");
+
+    // Try to add malware alongside safe package
+    const result = await shell.runCommand(
+      "cd /tmp/test-pdm-batch && pdm add safe-chain-pi-test requests 2>&1"
+    );
+
+    assert.ok(
+      result.output.includes("blocked by safe-chain"),
+      `Expected malware to be blocked. Output was:\n${result.output}`
+    );
+    assert.ok(
+      result.output.includes("Exiting without installing malicious packages."),
+      `Expected exit message. Output was:\n${result.output}`
+    );
+
+    // Verify safe package was also not installed due to malware in batch
+    const listResult = await shell.runCommand("cd /tmp/test-pdm-batch && pdm list");
+    assert.ok(
+      !listResult.output.includes("requests"),
+      `Safe package should not be installed when batch includes malware. Output was:\n${listResult.output}`
+    );
+  });
+
+  it(`pdm non-network commands work correctly`, async () => {
+    const shell = await container.openShell("zsh");
+
+    await shell.runCommand("mkdir /tmp/test-pdm-nonnetwork && cd /tmp/test-pdm-nonnetwork");
+    await shell.runCommand("cd /tmp/test-pdm-nonnetwork && pdm init --non-interactive");
+    await shell.runCommand("cd /tmp/test-pdm-nonnetwork && pdm add requests");
+
+    // Test pdm --version
+    const versionResult = await shell.runCommand("pdm --version");
+    assert.ok(
+      versionResult.output.includes("PDM") || versionResult.output.includes("pdm"),
+      `Expected version output. Output was:\n${versionResult.output}`
+    );
+
+    // Test pdm list (list installed packages)
+    const listResult = await shell.runCommand("cd /tmp/test-pdm-nonnetwork && pdm list");
+    assert.ok(
+      listResult.output.includes("requests"),
+      `Expected to see installed package. Output was:\n${listResult.output}`
+    );
+
+    // Test pdm info (show project info)
+    const infoResult = await shell.runCommand("cd /tmp/test-pdm-nonnetwork && pdm info");
+    assert.ok(
+      infoResult.output.includes("PDM") || infoResult.output.includes("Python") || infoResult.output.includes("Project"),
+      `Expected project info. Output was:\n${infoResult.output}`
+    );
+
+    // Test pdm config (show configuration)
+    const configResult = await shell.runCommand("pdm config");
+    assert.ok(
+      configResult.output.length > 0,
+      `Expected configuration output. Output was:\n${configResult.output}`
+    );
+
+    // Test pdm run (execute command in virtualenv) - non-network command
+    const runResult = await shell.runCommand("cd /tmp/test-pdm-nonnetwork && pdm run python --version");
+    assert.ok(
+      runResult.output.includes("Python"),
+      `Expected Python version output. Output was:\n${runResult.output}`
+    );
+  });
+});

From ced5e264208cb3959b4d95ef2ed5800fcfb3d5c0 Mon Sep 17 00:00:00 2001
From: Chris Ingram <chris.ingram@greenpixie.com>
Date: Tue, 7 Apr 2026 11:19:04 +0100
Subject: [PATCH 02/23] File mode on aikido-pdm.js

---
 packages/safe-chain/bin/aikido-pdm.js | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 packages/safe-chain/bin/aikido-pdm.js

diff --git a/packages/safe-chain/bin/aikido-pdm.js b/packages/safe-chain/bin/aikido-pdm.js
old mode 100644
new mode 100755

From d9b7aefd343c98e9bbc6b1e89b49596c48e19cd5 Mon Sep 17 00:00:00 2001
From: Reinier Criel <reinier.criel@gmail.com>
Date: Wed, 13 May 2026 14:33:58 -0700
Subject: [PATCH 03/23] unset PKG_EXECPATH before invoking safe-chain binary

---
 packages/safe-chain/bin/safe-chain.js         |  6 ++
 .../templates/unix-wrapper.template.sh        |  5 +-
 .../pkg-execpath-cleanup.spec.js              | 60 +++++++++++++++++++
 .../startup-scripts/init-fish.fish            |  6 +-
 .../startup-scripts/init-posix.sh             |  6 +-
 5 files changed, 78 insertions(+), 5 deletions(-)
 create mode 100644 packages/safe-chain/src/shell-integration/pkg-execpath-cleanup.spec.js

diff --git a/packages/safe-chain/bin/safe-chain.js b/packages/safe-chain/bin/safe-chain.js
index 900bd83..53b6617 100755
--- a/packages/safe-chain/bin/safe-chain.js
+++ b/packages/safe-chain/bin/safe-chain.js
@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 
+// Strip PKG_EXECPATH from the environment so any child process safe-chain
+// spawns (npm, uv, pip, …) doesn't inherit it. If it leaks into a subsequent
+// safe-chain invocation (e.g. via a shim) the yao-pkg bootstrap would treat
+// argv[1] as a script path and fail with MODULE_NOT_FOUND.
+delete process.env.PKG_EXECPATH;
+
 import chalk from "chalk";
 import { ui } from "../src/environment/userInteraction.js";
 import { setup } from "../src/shell-integration/setup.js";
diff --git a/packages/safe-chain/src/shell-integration/path-wrappers/templates/unix-wrapper.template.sh b/packages/safe-chain/src/shell-integration/path-wrappers/templates/unix-wrapper.template.sh
index 5b318ff..30ab833 100644
--- a/packages/safe-chain/src/shell-integration/path-wrappers/templates/unix-wrapper.template.sh
+++ b/packages/safe-chain/src/shell-integration/path-wrappers/templates/unix-wrapper.template.sh
@@ -20,7 +20,10 @@ remove_shim_from_path() {
 }
 
 if command -v safe-chain >/dev/null 2>&1; then
-  # Remove shim directory from PATH when calling {{AIKIDO_COMMAND}} to prevent infinite loops
+  # Remove shim directory from PATH when calling {{AIKIDO_COMMAND}} to prevent infinite loops.
+  # Unset PKG_EXECPATH so the yao-pkg bootstrap inside the safe-chain binary doesn't
+  # mistake argv[1] for a script path and try to resolve "{{PACKAGE_MANAGER}}" against cwd.
+  unset PKG_EXECPATH
   PATH=$(remove_shim_from_path) exec safe-chain {{PACKAGE_MANAGER}} "$@"
 else
   # safe-chain is not reachable — warn the user so they know protection is inactive
diff --git a/packages/safe-chain/src/shell-integration/pkg-execpath-cleanup.spec.js b/packages/safe-chain/src/shell-integration/pkg-execpath-cleanup.spec.js
new file mode 100644
index 0000000..4057224
--- /dev/null
+++ b/packages/safe-chain/src/shell-integration/pkg-execpath-cleanup.spec.js
@@ -0,0 +1,60 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, "..", "..");
+
+describe("PKG_EXECPATH cleanup", () => {
+  it("unix shim template unsets PKG_EXECPATH before invoking safe-chain", () => {
+    const file = path.join(
+      repoRoot,
+      "src/shell-integration/path-wrappers/templates/unix-wrapper.template.sh",
+    );
+    const content = fs.readFileSync(file, "utf-8");
+    assert.match(
+      content,
+      /unset PKG_EXECPATH[\s\S]*exec safe-chain/,
+      "unix-wrapper.template.sh must `unset PKG_EXECPATH` before `exec safe-chain`",
+    );
+  });
+
+  it("posix shell function unsets PKG_EXECPATH before invoking safe-chain", () => {
+    const file = path.join(
+      repoRoot,
+      "src/shell-integration/startup-scripts/init-posix.sh",
+    );
+    const content = fs.readFileSync(file, "utf-8");
+    // Scoped subshell so we don't mutate the user's interactive env.
+    assert.match(
+      content,
+      /\(unset PKG_EXECPATH;\s*safe-chain "\$@"\)/,
+      "init-posix.sh must invoke safe-chain in a subshell that unsets PKG_EXECPATH",
+    );
+  });
+
+  it("fish shell function unsets PKG_EXECPATH before invoking safe-chain", () => {
+    const file = path.join(
+      repoRoot,
+      "src/shell-integration/startup-scripts/init-fish.fish",
+    );
+    const content = fs.readFileSync(file, "utf-8");
+    assert.match(
+      content,
+      /env -u PKG_EXECPATH safe-chain/,
+      "init-fish.fish must invoke safe-chain via `env -u PKG_EXECPATH`",
+    );
+  });
+
+  it("safe-chain entry point deletes PKG_EXECPATH from process.env", () => {
+    const file = path.join(repoRoot, "bin/safe-chain.js");
+    const content = fs.readFileSync(file, "utf-8");
+    assert.match(
+      content,
+      /delete process\.env\.PKG_EXECPATH/,
+      "bin/safe-chain.js must delete process.env.PKG_EXECPATH so spawned children don't inherit it",
+    );
+  });
+});
diff --git a/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish b/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish
index 728aff1..68a3df0 100644
--- a/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish
+++ b/packages/safe-chain/src/shell-integration/startup-scripts/init-fish.fish
@@ -120,8 +120,10 @@ function wrapSafeChainCommand
     end
 
     if type -q safe-chain
-        # If the safe-chain command is available, just run it with the provided arguments
-        safe-chain $original_cmd $cmd_args
+        # If the safe-chain command is available, just run it with the provided arguments.
+        # Unset PKG_EXECPATH for this invocation so the yao-pkg bootstrap inside the
+        # safe-chain binary doesn't mistake argv[1] for a script path to resolve against cwd.
+        env -u PKG_EXECPATH safe-chain $original_cmd $cmd_args
     else
         # If the safe-chain command is not available, print a warning and run the original command
         printSafeChainWarning $original_cmd
diff --git a/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh b/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh
index cde8f48..258c281 100644
--- a/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh
+++ b/packages/safe-chain/src/shell-integration/startup-scripts/init-posix.sh
@@ -109,8 +109,10 @@ function wrapSafeChainCommand() {
   fi
 
   if command -v safe-chain > /dev/null 2>&1; then
-    # If the aikido command is available, just run it with the provided arguments
-    safe-chain "$@"
+    # If the aikido command is available, just run it with the provided arguments.
+    # Unset PKG_EXECPATH so the yao-pkg bootstrap inside the safe-chain binary doesn't
+    # mistake argv[1] for a script path and try to resolve it against cwd.
+    (unset PKG_EXECPATH; safe-chain "$@")
   else
     # If the aikido command is not available, print a warning and run the original command
     printSafeChainWarning "$original_cmd"

From 6cdad3df98bae5036c0142b5233a61546d0808d9 Mon Sep 17 00:00:00 2001
From: Reinier Criel <reinier.criel@gmail.com>
Date: Wed, 13 May 2026 20:27:27 -0700
Subject: [PATCH 04/23] Fix tests

---
 test/e2e/bun.e2e.spec.js                   | 10 ++++++----
 test/e2e/npm.e2e.spec.js                   |  5 +++--
 test/e2e/pip.e2e.spec.js                   |  5 +++--
 test/e2e/pnpm.e2e.spec.js                  |  5 +++--
 test/e2e/safe-chain-cli-python.e2e.spec.js |  5 +++--
 test/e2e/uv.e2e.spec.js                    | 20 ++++++++++++--------
 test/e2e/yarn.e2e.spec.js                  |  5 +++--
 7 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/test/e2e/bun.e2e.spec.js b/test/e2e/bun.e2e.spec.js
index fb6e99a..c4d2e25 100644
--- a/test/e2e/bun.e2e.spec.js
+++ b/test/e2e/bun.e2e.spec.js
@@ -46,8 +46,9 @@ describe("E2E: bun coverage", () => {
 
     var result = await shell.runCommand("bun install");
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -65,8 +66,9 @@ describe("E2E: bun coverage", () => {
 
     const result = await shell.runCommand("bunx safe-chain-test");
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/npm.e2e.spec.js b/test/e2e/npm.e2e.spec.js
index e8ba7c8..c1a09ab 100644
--- a/test/e2e/npm.e2e.spec.js
+++ b/test/e2e/npm.e2e.spec.js
@@ -70,8 +70,9 @@ describe("E2E: npm coverage", () => {
 
     var result = await shell.runCommand("npm install");
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/pip.e2e.spec.js b/test/e2e/pip.e2e.spec.js
index af979dc..ecf8ad9 100644
--- a/test/e2e/pip.e2e.spec.js
+++ b/test/e2e/pip.e2e.spec.js
@@ -131,8 +131,9 @@ describe("E2E: pip coverage", () => {
       "pip3 install --break-system-packages numpy==2.4.4 --safe-chain-logging=verbose"
     );
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads:"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/pnpm.e2e.spec.js b/test/e2e/pnpm.e2e.spec.js
index a15250a..4411492 100644
--- a/test/e2e/pnpm.e2e.spec.js
+++ b/test/e2e/pnpm.e2e.spec.js
@@ -70,8 +70,9 @@ describe("E2E: pnpm coverage", () => {
 
     var result = await shell.runCommand("pnpm install");
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/safe-chain-cli-python.e2e.spec.js b/test/e2e/safe-chain-cli-python.e2e.spec.js
index cf3fda2..9d59fb3 100644
--- a/test/e2e/safe-chain-cli-python.e2e.spec.js
+++ b/test/e2e/safe-chain-cli-python.e2e.spec.js
@@ -100,8 +100,9 @@ describe("E2E: safe-chain CLI python/pip support", () => {
       "safe-chain pip3 install --break-system-packages numpy==2.4.4"
     );
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads/,
       `Should have blocked malware. Output was:\n${result.output}`
     );
   });
diff --git a/test/e2e/uv.e2e.spec.js b/test/e2e/uv.e2e.spec.js
index 5536e22..8fd633a 100644
--- a/test/e2e/uv.e2e.spec.js
+++ b/test/e2e/uv.e2e.spec.js
@@ -129,8 +129,9 @@ describe("E2E: uv coverage", () => {
       "uv pip install --system --break-system-packages numpy==2.4.4"
     );
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads:"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -416,8 +417,9 @@ describe("E2E: uv coverage", () => {
       "cd test-project-malware && uv add numpy==2.4.4"
     );
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads:"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -447,8 +449,9 @@ describe("E2E: uv coverage", () => {
     const shell = await container.openShell("zsh");
     const result = await shell.runCommand("uv tool install numpy==2.4.4");
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads:"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -485,8 +488,9 @@ describe("E2E: uv coverage", () => {
       "uv run --with numpy==2.4.4 test_script2.py"
     );
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads:"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
   });
diff --git a/test/e2e/yarn.e2e.spec.js b/test/e2e/yarn.e2e.spec.js
index 5e56d12..6f892a0 100644
--- a/test/e2e/yarn.e2e.spec.js
+++ b/test/e2e/yarn.e2e.spec.js
@@ -70,8 +70,9 @@ describe("E2E: yarn coverage", () => {
 
     var result = await shell.runCommand("yarn");
 
-    assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+    assert.match(
+      result.output,
+      /blocked \d+ malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(

From e0e06431d166883bba74631fd28cf4b470d68845 Mon Sep 17 00:00:00 2001
From: Reinier Criel <reinier.criel@gmail.com>
Date: Wed, 13 May 2026 20:28:58 -0700
Subject: [PATCH 05/23] Fix tests

---
 test/e2e/bun.e2e.spec.js                   | 4 ++--
 test/e2e/npm.e2e.spec.js                   | 2 +-
 test/e2e/pip.e2e.spec.js                   | 2 +-
 test/e2e/pnpm.e2e.spec.js                  | 2 +-
 test/e2e/rush.e2e.spec.js                  | 2 +-
 test/e2e/rushx.e2e.spec.js                 | 2 +-
 test/e2e/safe-chain-cli-python.e2e.spec.js | 2 +-
 test/e2e/uv.e2e.spec.js                    | 8 ++++----
 test/e2e/yarn.e2e.spec.js                  | 2 +-
 9 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/test/e2e/bun.e2e.spec.js b/test/e2e/bun.e2e.spec.js
index c4d2e25..589d863 100644
--- a/test/e2e/bun.e2e.spec.js
+++ b/test/e2e/bun.e2e.spec.js
@@ -48,7 +48,7 @@ describe("E2E: bun coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -68,7 +68,7 @@ describe("E2E: bun coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/npm.e2e.spec.js b/test/e2e/npm.e2e.spec.js
index c1a09ab..810359e 100644
--- a/test/e2e/npm.e2e.spec.js
+++ b/test/e2e/npm.e2e.spec.js
@@ -72,7 +72,7 @@ describe("E2E: npm coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/pip.e2e.spec.js b/test/e2e/pip.e2e.spec.js
index ecf8ad9..8044a0f 100644
--- a/test/e2e/pip.e2e.spec.js
+++ b/test/e2e/pip.e2e.spec.js
@@ -133,7 +133,7 @@ describe("E2E: pip coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads:/,
+      /blocked [1-9]\d* malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/pnpm.e2e.spec.js b/test/e2e/pnpm.e2e.spec.js
index 4411492..6f9dacf 100644
--- a/test/e2e/pnpm.e2e.spec.js
+++ b/test/e2e/pnpm.e2e.spec.js
@@ -72,7 +72,7 @@ describe("E2E: pnpm coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/rush.e2e.spec.js b/test/e2e/rush.e2e.spec.js
index a5471a0..fb6895f 100644
--- a/test/e2e/rush.e2e.spec.js
+++ b/test/e2e/rush.e2e.spec.js
@@ -109,7 +109,7 @@ describe("E2E: rush coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/rushx.e2e.spec.js b/test/e2e/rushx.e2e.spec.js
index b7d5078..ec5ff75 100644
--- a/test/e2e/rushx.e2e.spec.js
+++ b/test/e2e/rushx.e2e.spec.js
@@ -57,7 +57,7 @@ describe("E2E: rushx coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/safe-chain-cli-python.e2e.spec.js b/test/e2e/safe-chain-cli-python.e2e.spec.js
index 9d59fb3..43187d8 100644
--- a/test/e2e/safe-chain-cli-python.e2e.spec.js
+++ b/test/e2e/safe-chain-cli-python.e2e.spec.js
@@ -102,7 +102,7 @@ describe("E2E: safe-chain CLI python/pip support", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Should have blocked malware. Output was:\n${result.output}`
     );
   });
diff --git a/test/e2e/uv.e2e.spec.js b/test/e2e/uv.e2e.spec.js
index 8fd633a..728d4c5 100644
--- a/test/e2e/uv.e2e.spec.js
+++ b/test/e2e/uv.e2e.spec.js
@@ -131,7 +131,7 @@ describe("E2E: uv coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads:/,
+      /blocked [1-9]\d* malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -419,7 +419,7 @@ describe("E2E: uv coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads:/,
+      /blocked [1-9]\d* malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -451,7 +451,7 @@ describe("E2E: uv coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads:/,
+      /blocked [1-9]\d* malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -490,7 +490,7 @@ describe("E2E: uv coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads:/,
+      /blocked [1-9]\d* malicious package downloads:/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
   });
diff --git a/test/e2e/yarn.e2e.spec.js b/test/e2e/yarn.e2e.spec.js
index 6f892a0..e70d6fc 100644
--- a/test/e2e/yarn.e2e.spec.js
+++ b/test/e2e/yarn.e2e.spec.js
@@ -72,7 +72,7 @@ describe("E2E: yarn coverage", () => {
 
     assert.match(
       result.output,
-      /blocked \d+ malicious package downloads/,
+      /blocked [1-9]\d* malicious package downloads/,
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(

From 54db058ac70810cbcc57507cc8d2d61c04401352 Mon Sep 17 00:00:00 2001
From: Chris Ingram <chris.ingram@greenpixie.com>
Date: Thu, 14 May 2026 10:04:18 +0100
Subject: [PATCH 06/23] Use getPackageManagerList in safe-chain setup help text

The install message in `safe-chain setup` help was hardcoding a stale
list of package managers (missing uv, uvx, poetry, pipx, pdm). Use the
existing getPackageManagerList() helper so the list stays in sync with
knownAikidoTools.
---
 packages/safe-chain/bin/safe-chain.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/safe-chain/bin/safe-chain.js b/packages/safe-chain/bin/safe-chain.js
index 900bd83..8853467 100755
--- a/packages/safe-chain/bin/safe-chain.js
+++ b/packages/safe-chain/bin/safe-chain.js
@@ -15,7 +15,7 @@ import { main } from "../src/main.js";
 import path from "path";
 import { fileURLToPath } from "url";
 import fs from "fs";
-import { knownAikidoTools } from "../src/shell-integration/helpers.js";
+import { knownAikidoTools, getPackageManagerList } from "../src/shell-integration/helpers.js";
 import { getInstalledSafeChainDir } from "../src/installLocation.js";
 
 /** @type {string} */
@@ -108,7 +108,7 @@ function writeHelp() {
   ui.writeInformation(
     `- ${chalk.cyan(
       "safe-chain setup",
-    )}: This will setup your shell to wrap safe-chain around npm, npx, yarn, pnpm, pnpx, rush, rushx, bun, bunx, pip and pip3.`,
+    )}: This will setup your shell to wrap safe-chain around ${getPackageManagerList()}.`,
   );
   ui.writeInformation(
     `- ${chalk.cyan(

From ffe7f8de1f03c887c8697e86bad31b37d684b1bf Mon Sep 17 00:00:00 2001
From: Chris Ingram <chris.ingram@greenpixie.com>
Date: Thu, 14 May 2026 16:28:50 +0100
Subject: [PATCH 07/23] Use numpy==2.4.4 as test malware in pdm e2e tests

The safe-chain-pi-test package no longer exists on PyPI. Aikido now
patches numpy==2.4.4 into the malware list for tests, matching the
pattern already used in the poetry e2e suite.
---
 test/e2e/pdm.e2e.spec.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/e2e/pdm.e2e.spec.js b/test/e2e/pdm.e2e.spec.js
index 96379fb..f9d1ee6 100644
--- a/test/e2e/pdm.e2e.spec.js
+++ b/test/e2e/pdm.e2e.spec.js
@@ -70,7 +70,7 @@ describe("E2E: pdm coverage", () => {
     await shell.runCommand("cd /tmp/test-pdm-malware && pdm init --non-interactive");
 
     const result = await shell.runCommand(
-      "cd /tmp/test-pdm-malware && pdm add safe-chain-pi-test"
+      "cd /tmp/test-pdm-malware && pdm add numpy==2.4.4"
     );
 
     assert.ok(
@@ -231,7 +231,7 @@ describe("E2E: pdm coverage", () => {
 
     // Add malware package - this will create lock file and attempt download
     const result = await shell.runCommand(
-      "cd /tmp/test-pdm-install-malware && pdm add safe-chain-pi-test 2>&1"
+      "cd /tmp/test-pdm-install-malware && pdm add numpy==2.4.4 2>&1"
     );
 
     assert.ok(
@@ -252,7 +252,7 @@ describe("E2E: pdm coverage", () => {
 
     // Try to add malware alongside safe package
     const result = await shell.runCommand(
-      "cd /tmp/test-pdm-batch && pdm add safe-chain-pi-test requests 2>&1"
+      "cd /tmp/test-pdm-batch && pdm add numpy==2.4.4 requests 2>&1"
     );
 
     assert.ok(

From 8ab5cebd4f5c693999f2b36e1a8bc9463ed6fcd3 Mon Sep 17 00:00:00 2001
From: Chris Ingram <chris.ingram@greenpixie.com>
Date: Thu, 14 May 2026 16:48:18 +0100
Subject: [PATCH 08/23] Match actual block output in pdm e2e assertions

The user-facing message is "Safe-chain: blocked N malicious package
downloads", not "blocked by safe-chain" (which only appears in the
proxy's HTTP response, not the rendered CLI output).
---
 test/e2e/pdm.e2e.spec.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/e2e/pdm.e2e.spec.js b/test/e2e/pdm.e2e.spec.js
index f9d1ee6..5287ca6 100644
--- a/test/e2e/pdm.e2e.spec.js
+++ b/test/e2e/pdm.e2e.spec.js
@@ -74,7 +74,7 @@ describe("E2E: pdm coverage", () => {
     );
 
     assert.ok(
-      result.output.includes("blocked by safe-chain"),
+      result.output.includes("blocked") && result.output.includes("malicious package downloads"),
       `Expected malware to be blocked. Output was:\n${result.output}`
     );
     assert.ok(
@@ -235,7 +235,7 @@ describe("E2E: pdm coverage", () => {
     );
 
     assert.ok(
-      result.output.includes("blocked by safe-chain"),
+      result.output.includes("blocked") && result.output.includes("malicious package downloads"),
       `Expected malware to be blocked during add (which triggers install). Output was:\n${result.output}`
     );
     assert.ok(
@@ -256,7 +256,7 @@ describe("E2E: pdm coverage", () => {
     );
 
     assert.ok(
-      result.output.includes("blocked by safe-chain"),
+      result.output.includes("blocked") && result.output.includes("malicious package downloads"),
       `Expected malware to be blocked. Output was:\n${result.output}`
     );
     assert.ok(

From a1b89a55f8d04e0d9b286308c3ff0c9b351b6edf Mon Sep 17 00:00:00 2001
From: Chris Ingram <chris.ingram@greenpixie.com>
Date: Thu, 14 May 2026 17:16:57 +0100
Subject: [PATCH 09/23] Make block-count assertions count-agnostic in bun e2e

Bun retries blocked downloads, so the count in "blocked N malicious
package downloads" can be >1. Match on the surrounding text rather than
a fixed count to keep the assertion robust.

Also drops the brittle "pdm update updates dependencies" case.
---
 test/e2e/bun.e2e.spec.js |  4 ++--
 test/e2e/pdm.e2e.spec.js | 17 -----------------
 2 files changed, 2 insertions(+), 19 deletions(-)

diff --git a/test/e2e/bun.e2e.spec.js b/test/e2e/bun.e2e.spec.js
index fb6e99a..494ded2 100644
--- a/test/e2e/bun.e2e.spec.js
+++ b/test/e2e/bun.e2e.spec.js
@@ -47,7 +47,7 @@ describe("E2E: bun coverage", () => {
     var result = await shell.runCommand("bun install");
 
     assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+      result.output.includes("blocked") && result.output.includes("malicious package downloads"),
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
@@ -66,7 +66,7 @@ describe("E2E: bun coverage", () => {
     const result = await shell.runCommand("bunx safe-chain-test");
 
     assert.ok(
-      result.output.includes("blocked 1 malicious package downloads"),
+      result.output.includes("blocked") && result.output.includes("malicious package downloads"),
       `Output did not include expected text. Output was:\n${result.output}`
     );
     assert.ok(
diff --git a/test/e2e/pdm.e2e.spec.js b/test/e2e/pdm.e2e.spec.js
index 5287ca6..94bb5e0 100644
--- a/test/e2e/pdm.e2e.spec.js
+++ b/test/e2e/pdm.e2e.spec.js
@@ -103,23 +103,6 @@ describe("E2E: pdm coverage", () => {
     );
   });
 
-  it(`pdm update updates dependencies`, async () => {
-    const shell = await container.openShell("zsh");
-
-    await shell.runCommand("mkdir /tmp/test-pdm-update && cd /tmp/test-pdm-update");
-    await shell.runCommand("cd /tmp/test-pdm-update && pdm init --non-interactive");
-    await shell.runCommand("cd /tmp/test-pdm-update && pdm add requests");
-
-    const result = await shell.runCommand(
-      "cd /tmp/test-pdm-update && pdm update"
-    );
-
-    assert.ok(
-      result.output.includes("no malware found.") || result.output.includes("Updating"),
-      `Output did not include expected text. Output was:\n${result.output}`
-    );
-  });
-
   it(`pdm update with specific packages`, async () => {
     const shell = await container.openShell("zsh");
 

From 34898980d7aaef03c12e3b2a792b6b2f1fe47830 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander.declerck@aikido.dev>
Date: Mon, 18 May 2026 10:24:37 +0200
Subject: [PATCH 10/23] Remove obsolete npm token from pipeline

---
 .github/workflows/build-and-release.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index 36dad7b..08f714a 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -144,8 +144,6 @@ jobs:
         with:
           node-version: "lts/*"
           registry-url: "https://registry.npmjs.org/"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
 
       - name: Setup safe-chain
         run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci

From b38aba43ddd179ef9d6c4d7572679d6d325a39c3 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:37:02 -0700
Subject: [PATCH 11/23] Create a bump-endpoint.yml workflow

---
 .github/workflows/bump-endpoint.yml | 82 +++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 .github/workflows/bump-endpoint.yml

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
new file mode 100644
index 0000000..595e820
--- /dev/null
+++ b/.github/workflows/bump-endpoint.yml
@@ -0,0 +1,82 @@
+name: Bump safechain-internals endpoint
+
+on:
+  schedule:
+    - cron: '0 * * * *' # every hour
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump-endpoint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get latest safechain-internals release
+        id: latest
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=$(gh api repos/AikidoSec/safechain-internals/releases/latest --jq '.tag_name')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Get current version from install script
+        id: current
+        run: |
+          CURRENT=$(grep -oP '(?<=releases/download/)[^/]+(?=/EndpointProtection\.pkg)' install-scripts/install-endpoint-mac.sh)
+          echo "version=$CURRENT" >> $GITHUB_OUTPUT
+
+      - name: Download assets and compute checksums
+        if: steps.latest.outputs.version != steps.current.outputs.version
+        id: checksums
+        run: |
+          VERSION="${{ steps.latest.outputs.version }}"
+          BASE="https://github.com/AikidoSec/safechain-internals/releases/download/${VERSION}"
+          curl -fsSL "${BASE}/EndpointProtection.pkg" -o /tmp/EndpointProtection.pkg
+          curl -fsSL "${BASE}/EndpointProtection.msi" -o /tmp/EndpointProtection.msi
+          echo "mac=$(sha256sum /tmp/EndpointProtection.pkg | cut -d' ' -f1)" >> $GITHUB_OUTPUT
+          echo "win=$(sha256sum /tmp/EndpointProtection.msi | cut -d' ' -f1)" >> $GITHUB_OUTPUT
+
+      - name: Update install scripts
+        if: steps.latest.outputs.version != steps.current.outputs.version
+        run: |
+          NEW="${{ steps.latest.outputs.version }}"
+          OLD="${{ steps.current.outputs.version }}"
+          MAC_SHA="${{ steps.checksums.outputs.mac }}"
+          WIN_SHA="${{ steps.checksums.outputs.win }}"
+
+          sed -i "s|${OLD}/EndpointProtection.pkg|${NEW}/EndpointProtection.pkg|" install-scripts/install-endpoint-mac.sh
+          sed -i "s|^DOWNLOAD_SHA256=\"[^\"]*\"|DOWNLOAD_SHA256=\"${MAC_SHA}\"|" install-scripts/install-endpoint-mac.sh
+
+          sed -i "s|${OLD}/EndpointProtection.msi|${NEW}/EndpointProtection.msi|" install-scripts/install-endpoint-windows.ps1
+          sed -i 's|^\$DownloadSha256 = "[^"]*"|\$DownloadSha256 = "'"${WIN_SHA}"'"|' install-scripts/install-endpoint-windows.ps1
+
+      - name: Open PR
+        if: steps.latest.outputs.version != steps.current.outputs.version
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          NEW="${{ steps.latest.outputs.version }}"
+          OLD="${{ steps.current.outputs.version }}"
+          BRANCH="bump/endpoint-${NEW}"
+
+          # Skip if a PR for this version already exists
+          if gh pr list --head "$BRANCH" --json number --jq '.[0].number' | grep -q '[0-9]'; then
+            echo "PR for $NEW already open, skipping."
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          git add install-scripts/install-endpoint-mac.sh install-scripts/install-endpoint-windows.ps1
+          git commit -m "Bump Endpoint to ${NEW}"
+          git push origin "$BRANCH"
+          gh pr create \
+            --title "Bump Endpoint to ${NEW}" \
+            --body "Automated bump of safechain-internals endpoint from \`${OLD}\` to \`${NEW}\`." \
+            --head "$BRANCH" \
+            --base main

From 9d44eca1d169c4c1714c9c39eb48bc20548d9468 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:39:04 -0700
Subject: [PATCH 12/23] Apply suggestion from @bitterpanda63

---
 .github/workflows/bump-endpoint.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index 595e820..0968115 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -1,4 +1,4 @@
-name: Bump safechain-internals endpoint
+name: Bump Device Protection Automatically
 
 on:
   schedule:

From cbbbe703d316912cedcf3ad0127f10956f123f04 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:45:10 -0700
Subject: [PATCH 13/23] Add a slack webhook curl req for endpoint bumps

---
 .github/workflows/bump-endpoint.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index 0968115..db7e3b6 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -75,8 +75,12 @@ jobs:
           git add install-scripts/install-endpoint-mac.sh install-scripts/install-endpoint-windows.ps1
           git commit -m "Bump Endpoint to ${NEW}"
           git push origin "$BRANCH"
-          gh pr create \
+          PR_URL=$(gh pr create \
             --title "Bump Endpoint to ${NEW}" \
             --body "Automated bump of safechain-internals endpoint from \`${OLD}\` to \`${NEW}\`." \
             --head "$BRANCH" \
-            --base main
+            --base main)
+
+          curl -s -X POST "https://hooks.slack.com/triggers/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" \
+            -H "Content-Type: application/json" \
+            -d "{\"text\": \"update to ${NEW} - ${PR_URL}\"}"

From 47e9ed0f6cd94f5b67d0ada88311fc30f367ec34 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:47:33 -0700
Subject: [PATCH 14/23] temp: trigger bump-endpoint on push to test

---
 .github/workflows/bump-endpoint.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index db7e3b6..d289893 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -1,6 +1,9 @@
 name: Bump Device Protection Automatically
 
 on:
+  push:
+    branches:
+      - create-bump-endpoint-workflow
   schedule:
     - cron: '0 * * * *' # every hour
   workflow_dispatch:

From 3f0837c65a30aafdb0d81bbdf6bdb65d72ff6bb1 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:48:23 -0700
Subject: [PATCH 15/23] temp: use open-source-releaser runner

---
 .github/workflows/bump-endpoint.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index d289893..3da395f 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   bump-endpoint:
-    runs-on: ubuntu-latest
+    runs-on: open-source-releaser
     steps:
       - uses: actions/checkout@v4
 

From 07b8571758638539db7327c19f63061936224e07 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:52:37 -0700
Subject: [PATCH 16/23] temp: post compare URL to Slack instead of creating PR

---
 .github/workflows/bump-endpoint.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index 3da395f..b204c5b 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -78,11 +78,7 @@ jobs:
           git add install-scripts/install-endpoint-mac.sh install-scripts/install-endpoint-windows.ps1
           git commit -m "Bump Endpoint to ${NEW}"
           git push origin "$BRANCH"
-          PR_URL=$(gh pr create \
-            --title "Bump Endpoint to ${NEW}" \
-            --body "Automated bump of safechain-internals endpoint from \`${OLD}\` to \`${NEW}\`." \
-            --head "$BRANCH" \
-            --base main)
+          PR_URL="https://github.com/${{ github.repository }}/compare/main...${BRANCH}?expand=1"
 
           curl -s -X POST "https://hooks.slack.com/triggers/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" \
             -H "Content-Type: application/json" \

From 0b46c5408b18ad924b19f8672590ea28ddb1c24a Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:55:22 -0700
Subject: [PATCH 17/23] Update bump-endpoint.yml

---
 .github/workflows/bump-endpoint.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index b204c5b..becdb77 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -1,9 +1,6 @@
 name: Bump Device Protection Automatically
 
 on:
-  push:
-    branches:
-      - create-bump-endpoint-workflow
   schedule:
     - cron: '0 * * * *' # every hour
   workflow_dispatch:

From f2cce7b7e90edad50d1ba3b8bf43a59103d9db99 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:56:04 -0700
Subject: [PATCH 18/23] temp: skip if branch already exists instead of checking
 for PR

---
 .github/workflows/bump-endpoint.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index becdb77..9a7df3b 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -63,9 +63,8 @@ jobs:
           OLD="${{ steps.current.outputs.version }}"
           BRANCH="bump/endpoint-${NEW}"
 
-          # Skip if a PR for this version already exists
-          if gh pr list --head "$BRANCH" --json number --jq '.[0].number' | grep -q '[0-9]'; then
-            echo "PR for $NEW already open, skipping."
+          if git ls-remote --exit-code --heads origin "$BRANCH" &>/dev/null; then
+            echo "Branch $BRANCH already exists, skipping."
             exit 0
           fi
 

From ab058367f1908260d5c1478c4cad620925a175d5 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:56:46 -0700
Subject: [PATCH 19/23] temp: re-add push trigger for testing

---
 .github/workflows/bump-endpoint.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index 9a7df3b..6d4a93e 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -1,6 +1,9 @@
 name: Bump Device Protection Automatically
 
 on:
+  push:
+    branches:
+      - create-bump-endpoint-workflow
   schedule:
     - cron: '0 * * * *' # every hour
   workflow_dispatch:

From f6145d5c20226fcba96c3505290dacac7495e073 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Tue, 19 May 2026 14:58:55 -0700
Subject: [PATCH 20/23] Update bump-endpoint.yml

---
 .github/workflows/bump-endpoint.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index 6d4a93e..9a7df3b 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -1,9 +1,6 @@
 name: Bump Device Protection Automatically
 
 on:
-  push:
-    branches:
-      - create-bump-endpoint-workflow
   schedule:
     - cron: '0 * * * *' # every hour
   workflow_dispatch:

From aed0aebdae85825be0b56fd0bb7cd3a5bdc2dc41 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander.declerck@aikido.dev>
Date: Wed, 20 May 2026 09:20:03 +0200
Subject: [PATCH 21/23] Store the slack url as a secret

---
 .github/workflows/bump-endpoint.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bump-endpoint.yml b/.github/workflows/bump-endpoint.yml
index 9a7df3b..8c61826 100644
--- a/.github/workflows/bump-endpoint.yml
+++ b/.github/workflows/bump-endpoint.yml
@@ -58,6 +58,7 @@ jobs:
         if: steps.latest.outputs.version != steps.current.outputs.version
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
         run: |
           NEW="${{ steps.latest.outputs.version }}"
           OLD="${{ steps.current.outputs.version }}"
@@ -76,6 +77,6 @@ jobs:
           git push origin "$BRANCH"
           PR_URL="https://github.com/${{ github.repository }}/compare/main...${BRANCH}?expand=1"
 
-          curl -s -X POST "https://hooks.slack.com/triggers/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" \
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
             -H "Content-Type: application/json" \
             -d "{\"text\": \"update to ${NEW} - ${PR_URL}\"}"

From 70b5e4d0125ade2fa53b3c42f5f76c6586d3918c Mon Sep 17 00:00:00 2001
From: Reinier Criel <reinier.criel@gmail.com>
Date: Wed, 20 May 2026 08:39:03 -0700
Subject: [PATCH 22/23] Bump Endpoint

---
 install-scripts/install-endpoint-mac.sh      | 4 ++--
 install-scripts/install-endpoint-windows.ps1 | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/install-scripts/install-endpoint-mac.sh b/install-scripts/install-endpoint-mac.sh
index feabeb1..429dcc8 100755
--- a/install-scripts/install-endpoint-mac.sh
+++ b/install-scripts/install-endpoint-mac.sh
@@ -7,8 +7,8 @@
 set -e  # Exit on error
 
 # Configuration
-INSTALL_URL="https://github.com/AikidoSec/safechain-internals/releases/download/v1.3.4/EndpointProtection.pkg"
-DOWNLOAD_SHA256="f2ea55588d42e4aa17545ad787f46dd36001009e2ddb9655c497b1a36edf3581"
+INSTALL_URL="https://github.com/AikidoSec/safechain-internals/releases/download/v1.5.3/EndpointProtection.pkg"
+DOWNLOAD_SHA256="9a05eaf314876f236efd8a597aba6831b8569774d6cb4d0df4af4e74706a31eb"
 TOKEN_FILE="/tmp/aikido_endpoint_token.txt"
 
 # Colors for output
diff --git a/install-scripts/install-endpoint-windows.ps1 b/install-scripts/install-endpoint-windows.ps1
index 29bc873..c47df95 100644
--- a/install-scripts/install-endpoint-windows.ps1
+++ b/install-scripts/install-endpoint-windows.ps1
@@ -7,8 +7,8 @@ param(
 )
 
 # Configuration
-$InstallUrl = "https://github.com/AikidoSec/safechain-internals/releases/download/v1.3.4/EndpointProtection.msi"
-$DownloadSha256 = "0699379716a9a8b1531befa538befb237252af9f7fd780b33f4dce73588c6f83"
+$InstallUrl = "https://github.com/AikidoSec/safechain-internals/releases/download/v1.5.3/EndpointProtection.msi"
+$DownloadSha256 = "e6d3d52a9c16b98014adb451dc7e544db15a55db59c83433f8d6f93aadd0c3d5"
 
 # Ensure TLS 1.2 is enabled for downloads
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

From 2621f6f974c1d2ec9ac25ba5cdc380a81641d5ef Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 21 May 2026 17:39:03 +0000
Subject: [PATCH 23/23] Bump Endpoint to v1.5.4

---
 install-scripts/install-endpoint-mac.sh      | 4 ++--
 install-scripts/install-endpoint-windows.ps1 | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/install-scripts/install-endpoint-mac.sh b/install-scripts/install-endpoint-mac.sh
index 429dcc8..4cb9e9a 100755
--- a/install-scripts/install-endpoint-mac.sh
+++ b/install-scripts/install-endpoint-mac.sh
@@ -7,8 +7,8 @@
 set -e  # Exit on error
 
 # Configuration
-INSTALL_URL="https://github.com/AikidoSec/safechain-internals/releases/download/v1.5.3/EndpointProtection.pkg"
-DOWNLOAD_SHA256="9a05eaf314876f236efd8a597aba6831b8569774d6cb4d0df4af4e74706a31eb"
+INSTALL_URL="https://github.com/AikidoSec/safechain-internals/releases/download/v1.5.4/EndpointProtection.pkg"
+DOWNLOAD_SHA256="ad800f9e476b0a75bf32b1c079f060ecb98bc16972a4e8cca29cf165388ea9fe"
 TOKEN_FILE="/tmp/aikido_endpoint_token.txt"
 
 # Colors for output
diff --git a/install-scripts/install-endpoint-windows.ps1 b/install-scripts/install-endpoint-windows.ps1
index c47df95..05da8b4 100644
--- a/install-scripts/install-endpoint-windows.ps1
+++ b/install-scripts/install-endpoint-windows.ps1
@@ -7,8 +7,8 @@ param(
 )
 
 # Configuration
-$InstallUrl = "https://github.com/AikidoSec/safechain-internals/releases/download/v1.5.3/EndpointProtection.msi"
-$DownloadSha256 = "e6d3d52a9c16b98014adb451dc7e544db15a55db59c83433f8d6f93aadd0c3d5"
+$InstallUrl = "https://github.com/AikidoSec/safechain-internals/releases/download/v1.5.4/EndpointProtection.msi"
+$DownloadSha256 = "e2750c59124f53456a8f9cdb9e81fd9ce2f2491869f68f01602444ad519be5be"
 
 # Ensure TLS 1.2 is enabled for downloads
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12