From 7412828da86563a116f77220482614b46a36030e Mon Sep 17 00:00:00 2001
From: Jesse Merhi <79823012+jesse-merhi@users.noreply.github.com>
Date: Mon, 10 Aug 2026 15:03:18 +1000
Subject: [PATCH] fix(security): surface refreshed gateway warnings

---
 src/plugins/install-security-scan.runtime.test.ts | 13 +++++++++++++
 src/plugins/install-security-scan.runtime.ts      | 11 +++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/plugins/install-security-scan.runtime.test.ts b/src/plugins/install-security-scan.runtime.test.ts
index 51c94ad75e32..9f1a6ad20a36 100644
--- a/src/plugins/install-security-scan.runtime.test.ts
+++ b/src/plugins/install-security-scan.runtime.test.ts
@@ -375,6 +375,19 @@ describe("legacy file install scan compatibility", () => {
 
     expect(result?.blocked).toMatchObject({
       code: "security_scan_blocked",
+      installPolicyWarning: {
+        targetName: "payload",
+        targetType: "plugin",
+        requestMode: "install",
+        reason: "review the new finding",
+        findings: [
+          {
+            ruleId: "changed-warning",
+            severity: "warn",
+            message: "new finding",
+          },
+        ],
+      },
     });
     expect(result?.blocked?.reason).toContain("Reason: review the new finding");
     expect(result?.blocked?.reason).toContain("new finding");
diff --git a/src/plugins/install-security-scan.runtime.ts b/src/plugins/install-security-scan.runtime.ts
index d1b7b38d17dc..6092cac0b817 100644
--- a/src/plugins/install-security-scan.runtime.ts
+++ b/src/plugins/install-security-scan.runtime.ts
@@ -878,6 +878,13 @@ async function runOperatorInstallPolicy(params: {
         return {
           blocked: {
             code: "security_scan_blocked",
+            installPolicyWarning: {
+              targetName: params.targetName,
+              targetType: params.targetType,
+              requestMode: params.requestMode,
+              reason: reevaluated.warning.reason,
+              ...(reevaluated.findings?.length ? { findings: reevaluated.findings } : {}),
+            },
             reason: formatInstallPolicyNotice({
               decision: "warn",
               findings: reevaluated.findings,
@@ -895,8 +902,8 @@ async function runOperatorInstallPolicy(params: {
     } else {
       logPolicyResult(reevaluated);
     }
-    // Approval covers this warning only after a fresh evaluation. Callers that
-    // offer one-shot approval still reject warnings from later scan stages.
+    // Approval covers only an unchanged warning after a fresh evaluation.
+    // One-shot callers still reject later or changed warnings.
     return undefined;
   }
   if (acknowledgement.status === "unavailable") {