{
  "intent": "Fix pacman_wrapper.sh so whitelist/blocklist matching works for `pacman -U <file>.pkg.tar.zst` installs, which yay always uses — previously a whitelisted package installed via -U could be misidentified because the check compared raw filenames instead of bare package names.",
  "scope": [
    "linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh",
    "linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_whitelist.txt",
    "linux_configuration/tests/test_pacman_wrapper_security.sh",
    "Non-goal: no change to blocklist policy content beyond the ungoogled-chromium/plain-chromium swap needed for the browser migration"
  ],
  "changes": [
    "Added strip_pkgfile_suffix() to pacman_wrapper.sh to derive a bare package name from a -U <file>.pkg.tar.zst argument before whitelist/blocklist matching",
    "Updated pacman_whitelist.txt: added ungoogled-chromium, ungoogled-chromium-bin, ungoogled-chromium-bin-debug; removed stale chromium/ublock-origin entries (Chromium 151 dropped MV2, package was uninstalled)",
    "Added a regression test to test_pacman_wrapper_security.sh covering strip_pkgfile_suffix + is_blocked_package_name against -U package-file arguments"
  ],
  "verification": [
    {
      "command": "bash tests/test_pacman_wrapper_security.sh",
      "result": "pass",
      "evidence": "=== All Tests Passed! === including new TEST: 'Verifying strip_pkgfile_suffix + is_blocked_package_name handle -U package-file arguments' -> strip_pkgfile_suffix bares -U filenames; whitelisted packages are allowed via -U, non-whitelisted blocked keywords still blocked"
    },
    {
      "command": "shellcheck pacman/pacman_wrapper.sh && shfmt -d pacman/pacman_wrapper.sh",
      "result": "pass",
      "evidence": "shellcheck exit 0, shfmt reported no diff"
    }
  ],
  "risks": [
    "strip_pkgfile_suffix uses a regex/glob to strip the pkg.tar.zst suffix and arch/version fields — a package name containing unusual characters could in theory mismatch, but the whitelist only contains conventional pacman package names",
    "Whitelist changes remove blanket chromium/ublock-origin entries — any script still assuming those names are whitelisted will now be blocked by the wrapper until updated"
  ],
  "rollback": [
    "git revert this commit",
    "Re-run bash tests/test_pacman_wrapper_security.sh after rollback to confirm no residual state from the new test"
  ]
}