@westbayberry/dg 1.0.62 → 1.1.0

package/dist/python-hook/dg_pip_hook.py

@@ -0,0 +1,116 @@
+"""Dependency Guardian pip-install interceptor.
+
+Loaded via dg_pip_hook.pth in user site-packages. Patches
+pip._internal.commands.install.InstallCommand.run to route through
+dg __wrap pip-hook before the real install runs.
+
+DEFENSIVE CONTRACT (do not violate):
+- Must never break Python startup. Any exception is swallowed; the
+  user's Python interpreter must always come up.
+- Must patch only InstallCommand.run; nothing else in pip is touched.
+- Must be re-entrant safe via DG_PIP_HOOK_ACTIVE env var.
+- Must live ONLY in user-site (never system-site).
+- Removed cleanly by `dg uninstall`.
+- At .pth-load time pip is NOT yet on sys.path on some systems, so
+  we register a meta-path finder that patches when pip is first
+  imported (and also try an immediate patch as a fast path).
+"""
+
+
+def _build_dg_wrapped_run(orig_run):
+    def dg_wrapped_run(self, options, args):
+        import os, sys, subprocess
+        try:
+            has_target = bool(args) or bool(getattr(options, "requirements", None))
+            if not has_target:
+                return orig_run(self, options, args)
+        except Exception:
+            return orig_run(self, options, args)
+
+        if os.environ.get("DG_PIP_HOOK_ACTIVE"):
+            return orig_run(self, options, args)
+
+        os.environ["DG_PIP_HOOK_ACTIVE"] = "1"
+        try:
+            cmd = ["dg", "__wrap", "pip-hook", "--"] + list(sys.argv[1:])
+            try:
+                proc = subprocess.run(cmd)
+            except FileNotFoundError:
+                return orig_run(self, options, args)
+            if proc.returncode != 0:
+                return proc.returncode
+        finally:
+            os.environ.pop("DG_PIP_HOOK_ACTIVE", None)
+
+        return orig_run(self, options, args)
+    return dg_wrapped_run
+
+
+def _patch_install_command_module(mod):
+    try:
+        if not hasattr(mod, "InstallCommand"):
+            return
+        run = mod.InstallCommand.run
+        if getattr(run, "_dg_wrapped", False):
+            return
+        wrapped = _build_dg_wrapped_run(run)
+        wrapped._dg_wrapped = True
+        mod.InstallCommand.run = wrapped
+    except Exception:
+        pass
+
+
+def _install_hook():
+    import sys
+    try:
+        if "pip._internal.commands.install" in sys.modules:
+            _patch_install_command_module(sys.modules["pip._internal.commands.install"])
+            return
+    except Exception:
+        pass
+
+    try:
+        from importlib.machinery import PathFinder
+    except Exception:
+        return
+
+    if getattr(PathFinder, "_dg_patched", False):
+        return
+
+    orig_find_spec = PathFinder.find_spec
+
+    def dg_find_spec(fullname, path=None, target=None):
+        try:
+            spec = orig_find_spec(fullname, path, target)
+        except Exception:
+            return None
+        if spec is None:
+            return spec
+        if fullname != "pip._internal.commands.install":
+            return spec
+        try:
+            loader = spec.loader
+            if loader is None:
+                return spec
+            orig_exec = loader.exec_module
+
+            def wrapped_exec(module):
+                orig_exec(module)
+                _patch_install_command_module(module)
+
+            loader.exec_module = wrapped_exec
+        except Exception:
+            pass
+        return spec
+
+    try:
+        PathFinder.find_spec = staticmethod(dg_find_spec)
+        PathFinder._dg_patched = True
+    except Exception:
+        pass
+
+
+try:
+    _install_hook()
+except Exception:
+    pass

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "1.0.62",
+  "version": "1.1.0",
   "description": "Supply chain security scanner for npm and Python dependencies — 35 behavioral detectors catch zero-day attacks CVE databases miss. 99.66% catch rate on 155K packages.",
   "bin": {
     "dependency-guardian": "dist/index.mjs",
@@ -42,6 +42,7 @@
     "test": "vitest run",
     "pretest": "node build.mjs",
     "lint": "eslint src",
+    "postinstall": "node dist/postinstall.mjs || true",
     "prepublishOnly": "npm run lint && npm test && npm run build"
   },
   "engines": {