@westbayberry/dg 1.1.4 → 1.1.5

package/dist/index.mjs

@@ -44516,7 +44516,29 @@ function findingFingerprint(pkg, f) {
 function buildSarif(response, opts = {}) {
   const ruleMap = /* @__PURE__ */ new Map();
   const results = [];
+  const INCOMPLETE_RULE = "dg.analysis_incomplete";
   for (const pkg of response.packages) {
+    if (pkg.action === "analysis_incomplete") {
+      if (!ruleMap.has(INCOMPLETE_RULE)) {
+        ruleMap.set(INCOMPLETE_RULE, {
+          id: INCOMPLETE_RULE,
+          name: INCOMPLETE_RULE,
+          shortDescription: { text: "Package could not be fully analyzed \u2014 treat as unverified" },
+          defaultConfiguration: { level: "warning" }
+        });
+      }
+      results.push({
+        ruleId: INCOMPLETE_RULE,
+        level: "warning",
+        message: { text: `${pkg.name} ${pkg.version}: analysis incomplete \u2014 the scanner could not fully evaluate this package. Treat as unverified, not safe.` },
+        locations: [{
+          physicalLocation: {
+            artifactLocation: { uri: opts.lockfileUri ?? `dg:${pkg.name}@${pkg.version}` }
+          }
+        }],
+        partialFingerprints: { dg_finding: `${pkg.name}@${pkg.version}#${INCOMPLETE_RULE}`.slice(0, 240) }
+      });
+    }
     const findings = pkg.findings ?? [];
     for (const f of findings) {
       const id = findingId(f);
@@ -44941,6 +44963,7 @@ function handleFreeCapReached2(error, jsonMode = false) {
 function actionColor(action) {
   if (action === "block") return import_chalk5.default.red;
   if (action === "warn") return import_chalk5.default.yellow;
+  if (action === "analysis_incomplete") return import_chalk5.default.cyan;
   return import_chalk5.default.green;
 }
 function actionBadge(pkg) {
@@ -44957,6 +44980,9 @@ function isBlocked(p) {
 function isWarned(p) {
   return p.action === "warn";
 }
+function isIncomplete(p) {
+  return p.action === "analysis_incomplete";
+}
 function renderResultClean(result, _config) {
   const lines = [];
   const total = result.packages.length;
@@ -44968,7 +44994,8 @@ function renderResultClean(result, _config) {
   }
   const blocked = result.packages.filter(isBlocked);
   const warned = result.packages.filter(isWarned);
-  if (result.action === "pass" && blocked.length === 0 && warned.length === 0) {
+  const incomplete = result.packages.filter(isIncomplete);
+  if (result.action === "pass" && blocked.length === 0 && warned.length === 0 && incomplete.length === 0) {
     lines.push("");
     lines.push(`  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("Dependency Guardian")} checked ${total} package${total !== 1 ? "s" : ""}. ${import_chalk5.default.green("No risky behavior found.")}`);
     if (result.durationMs) {
@@ -44977,11 +45004,18 @@ function renderResultClean(result, _config) {
     lines.push("");
     return lines.join("\n");
   }
-  const headerColor = result.action === "block" ? import_chalk5.default.red : import_chalk5.default.yellow;
-  const headerLabel = result.action === "block" ? "BLOCK" : "WARN";
+  const headerLabel = result.action === "block" ? "BLOCK" : result.action === "warn" ? "WARN" : result.action === "analysis_incomplete" ? "UNKNOWN" : "PASS";
+  const headerColor = actionColor(result.action);
+  const cleanCount = total - blocked.length - warned.length - incomplete.length;
+  const countParts = [
+    `${blocked.length} block`,
+    `${warned.length} warn`,
+    ...incomplete.length > 0 ? [`${incomplete.length} unknown`] : [],
+    `${cleanCount} clean`
+  ];
   lines.push("");
   lines.push(`  ${headerColor(import_chalk5.default.bold(headerLabel))}  ${import_chalk5.default.bold("Dependency Guardian")} ${import_chalk5.default.dim(`(score ${result.score})`)}`);
-  lines.push(`  ${import_chalk5.default.dim(`${total} package${total !== 1 ? "s" : ""} scanned \xB7 ${blocked.length} block \xB7 ${warned.length} warn \xB7 ${total - blocked.length - warned.length} clean`)}`);
+  lines.push(`  ${import_chalk5.default.dim(`${total} package${total !== 1 ? "s" : ""} scanned \xB7 ${countParts.join(" \xB7 ")}`)}`);
   lines.push("");
   const showFirst = (pkgs, color, label) => {
     if (pkgs.length === 0) return;
@@ -44997,10 +45031,13 @@ function renderResultClean(result, _config) {
   };
   showFirst(blocked, import_chalk5.default.red, "Blocked");
   showFirst(warned, import_chalk5.default.yellow, "Warnings");
+  showFirst(incomplete, import_chalk5.default.cyan, "Could not analyze");
   if (result.action === "block") {
     lines.push(`  ${import_chalk5.default.dim("Next step:")} review the findings above, then either pin a safe version or use ${import_chalk5.default.bold("--dg-force")} to bypass.`);
   } else if (result.action === "warn") {
     lines.push(`  ${import_chalk5.default.dim("Next step:")} review the warnings; install proceeds unless you set ${import_chalk5.default.bold("--mode block")}.`);
+  } else if (result.action === "analysis_incomplete") {
+    lines.push(`  ${import_chalk5.default.dim("Next step:")} one or more packages could not be fully analyzed \u2014 treat as unverified, not safe. Re-run to retry.`);
   }
   lines.push("");
   return lines.join("\n");
@@ -45019,13 +45056,21 @@ function renderResultDetails(result, _config) {
   lines.push("");
   const blocked = result.packages.filter(isBlocked);
   const warned = result.packages.filter(isWarned);
-  const passWithScore = result.packages.filter((p) => p.score > 0 && p.score < 60);
-  const clean = result.packages.filter((p) => p.score === 0);
+  const incomplete = result.packages.filter(isIncomplete);
+  const rest = result.packages.filter((p) => !isBlocked(p) && !isWarned(p) && !isIncomplete(p));
+  const passWithScore = rest.filter((p) => p.score > 0 && p.score < 60);
+  const clean = rest.filter((p) => p.score === 0);
   const total = result.packages.length;
   const needsAttention = blocked.length + warned.length;
-  if (needsAttention > 0) {
+  if (needsAttention > 0 || incomplete.length > 0) {
+    const segs = [
+      import_chalk5.default.red(`${blocked.length} block`),
+      import_chalk5.default.yellow(`${warned.length} warn`),
+      ...incomplete.length > 0 ? [import_chalk5.default.cyan(`${incomplete.length} unknown`)] : [],
+      import_chalk5.default.green(`${clean.length + passWithScore.length} pass`)
+    ];
     lines.push(
-      `  ${total} package${total !== 1 ? "s" : ""} scanned ${import_chalk5.default.dim("\u2502")} ${import_chalk5.default.red(`${blocked.length} block`)} ${import_chalk5.default.dim("\u2502")} ${import_chalk5.default.yellow(`${warned.length} warn`)} ${import_chalk5.default.dim("\u2502")} ${import_chalk5.default.green(`${clean.length + passWithScore.length} pass`)}`
+      `  ${total} package${total !== 1 ? "s" : ""} scanned ${import_chalk5.default.dim("\u2502")} ${segs.join(` ${import_chalk5.default.dim("\u2502")} `)}`
     );
   } else {
     lines.push(
@@ -45038,8 +45083,8 @@ function renderResultDetails(result, _config) {
     lines.push("");
     return lines.join("\n");
   }
-  if (needsAttention > 0) {
-    const groups = groupPackages([...blocked, ...warned]);
+  if (needsAttention > 0 || incomplete.length > 0) {
+    const groups = groupPackages([...blocked, ...warned, ...incomplete]);
     lines.push(`  ${import_chalk5.default.bold("Needs Attention")}`);
     lines.push(`  ${import_chalk5.default.dim("\u2500".repeat(60))}`);
     for (const group of groups) {
@@ -46763,11 +46808,11 @@ var init_InteractiveResultsView = __esm({
       const scanUsage = usageDisplay ? usageDisplay.text : result.freeScansRemaining !== void 0 ? `${result.freeScansRemaining.toLocaleString()} packages left` : scanUsageProp;
       const usageNearLimit = usageDisplay?.nearLimit ?? false;
       const flagged = (0, import_react30.useMemo)(
-        () => result.packages.filter((p) => p.score > 0),
+        () => result.packages.filter((p) => p.score > 0 || p.action === "analysis_incomplete"),
         [result.packages]
       );
       const clean = (0, import_react30.useMemo)(
-        () => result.packages.filter((p) => p.score === 0),
+        () => result.packages.filter((p) => p.score === 0 && p.action !== "analysis_incomplete"),
         [result.packages]
       );
       const total = result.packages.length;
@@ -51787,8 +51832,8 @@ var init_ResultsView = __esm({
       config: _config,
       durationMs
     }) => {
-      const flagged = result.packages.filter((p) => p.score > 0);
-      const clean = result.packages.filter((p) => p.score === 0);
+      const flagged = result.packages.filter((p) => p.score > 0 || p.action === "analysis_incomplete");
+      const clean = result.packages.filter((p) => p.score === 0 && p.action !== "analysis_incomplete");
       const total = result.packages.length;
       const groups = groupPackages(flagged);
       return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 2, children: [
@@ -51943,13 +51988,15 @@ function reasonTag(pkg) {
 function countSummary(result) {
   let block = 0;
   let warn = 0;
+  let unknown = 0;
   let clean = 0;
   for (const p of result.packages) {
     if (p.action === "block") block++;
     else if (p.action === "warn") warn++;
+    else if (p.action === "analysis_incomplete") unknown++;
     else clean++;
   }
-  return { block, warn, clean };
+  return { block, warn, unknown, clean };
 }
 var import_jsx_runtime17, WrapperVerdictLine;
 var init_WrapperVerdictLine = __esm({
@@ -52020,6 +52067,7 @@ var init_WrapperVerdictLine = __esm({
       const parts = [];
       if (counts.block > 0) parts.push(`${counts.block} block`);
       if (counts.warn > 0) parts.push(`${counts.warn} warn`);
+      if (counts.unknown > 0) parts.push(`${counts.unknown} unknown`);
       if (counts.clean > 0) parts.push(`${counts.clean} clean`);
       return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Box_default, { flexDirection: "row", children: [
         /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { color, children: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "type": "module",
   "description": "Supply chain security scanner for npm and Python dependencies — 35 behavioral detectors catch zero-day attacks CVE databases miss. 99.66% catch rate on 155K packages.",
   "bin": {