@westbayberry/dg 1.1.5 → 1.2.1

package/dist/postinstall.mjs

@@ -111,16 +111,29 @@ var ECOSYSTEMS = [
   "mamba"
 ];
 var UNIX_SHIM_BODY = `#!/bin/sh
+nonce=$(cat "$HOME/.dg/state/shim-nonce" 2>/dev/null)
 if [ -n "\${DG_SHIM_ACTIVE:-}" ]; then
   cleaned_path=$(printf '%s' "$PATH" | awk -v RS=':' -v ORS=':' '$0 != ENVIRON["HOME"]"/.dg/shims"' | sed 's/:$//')
-  real_bin=$(PATH="$cleaned_path" command -v __ECOSYSTEM__)
-  if [ -n "$real_bin" ]; then
-    exec "$real_bin" "$@"
+  # Only honor DG_SHIM_ACTIVE as the recursion guard when it equals the
+  # on-disk nonce \u2014 that is the value our own wrapper sets before running the
+  # real installer. A non-matching value was set outside dg (stale or a
+  # bypass attempt) and must NOT skip scanning.
+  if [ -n "$nonce" ] && [ "$DG_SHIM_ACTIVE" = "$nonce" ]; then
+    real_bin=$(PATH="$cleaned_path" command -v __ECOSYSTEM__)
+    if [ -n "$real_bin" ]; then
+      exec "$real_bin" "$@"
+    fi
+    echo "dg: real __ECOSYSTEM__ not found on PATH" >&2
+    exit 127
+  fi
+  if [ -z "$nonce" ]; then
+    echo "dg: shim nonce missing (reinstall dg) \u2014 cannot verify; passing through __ECOSYSTEM__ UNSCANNED." >&2
+    real_bin=$(PATH="$cleaned_path" command -v __ECOSYSTEM__)
+    if [ -n "$real_bin" ]; then exec "$real_bin" "$@"; fi
+    exit 127
   fi
-  echo "dg: real __ECOSYSTEM__ not found on PATH" >&2
-  exit 127
+  echo "dg: ignoring externally-set DG_SHIM_ACTIVE (nonce mismatch); scanning __ECOSYSTEM__." >&2
 fi
-nonce=$(cat "$HOME/.dg/state/shim-nonce" 2>/dev/null)
 dg_entry=$(cat "$HOME/.dg/state/dg-entry" 2>/dev/null)
 if [ -n "$dg_entry" ] && [ -x "$dg_entry" ]; then
   DG_SHIM_ACTIVE="$nonce" DG_SHIM_PARENT_PATH="$PATH" exec "$dg_entry" __wrap __ECOSYSTEM__ "$@"
@@ -140,6 +153,8 @@ exit 127
 `;
 var WINDOWS_SHIM_BODY = `@echo off
 setlocal enabledelayedexpansion
+set "DG_SHIM_NONCE="
+if exist "%USERPROFILE%\\.dg\\state\\shim-nonce" set /p DG_SHIM_NONCE=<"%USERPROFILE%\\.dg\\state\\shim-nonce"
 if not "%DG_SHIM_ACTIVE%"=="" (
   set "_dg_realpath="
   for /f "tokens=*" %%i in ('where __ECOSYSTEM__ 2^>nul') do (
@@ -147,15 +162,25 @@ if not "%DG_SHIM_ACTIVE%"=="" (
       if not defined _dg_realpath set "_dg_realpath=%%i"
     )
   )
-  if defined _dg_realpath (
-    "!_dg_realpath!" %*
-    exit /b !errorlevel!
+  rem Only honor DG_SHIM_ACTIVE as the recursion guard when it equals the nonce.
+  if "%DG_SHIM_ACTIVE%"=="!DG_SHIM_NONCE!" (
+    if defined _dg_realpath (
+      "!_dg_realpath!" %*
+      exit /b !errorlevel!
+    )
+    echo dg: real __ECOSYSTEM__ not found on PATH 1>&2
+    exit /b 127
+  )
+  if "!DG_SHIM_NONCE!"=="" (
+    echo dg: shim nonce missing ^(reinstall dg^) -- passing through __ECOSYSTEM__ UNSCANNED. 1>&2
+    if defined _dg_realpath (
+      "!_dg_realpath!" %*
+      exit /b !errorlevel!
+    )
+    exit /b 127
   )
-  echo dg: real __ECOSYSTEM__ not found on PATH 1>&2
-  exit /b 127
+  echo dg: ignoring externally-set DG_SHIM_ACTIVE ^(nonce mismatch^); scanning __ECOSYSTEM__. 1>&2
 )
-set "DG_SHIM_NONCE="
-if exist "%USERPROFILE%\\.dg\\state\\shim-nonce" set /p DG_SHIM_NONCE=<"%USERPROFILE%\\.dg\\state\\shim-nonce"
 set "DG_ENTRY="
 if exist "%USERPROFILE%\\.dg\\state\\dg-entry" set /p DG_ENTRY=<"%USERPROFILE%\\.dg\\state\\dg-entry"
 set "DG_SHIM_ACTIVE=!DG_SHIM_NONCE!"

package/dist/python-hook/dg_pip_hook.py

@@ -32,10 +32,24 @@ def _build_dg_wrapped_run(orig_run):
 
         os.environ["DG_PIP_HOOK_ACTIVE"] = "1"
         try:
-            cmd = ["dg", "__wrap", "pip-hook", "--"] + list(sys.argv[1:])
+            # Resolve the absolute dg-entry rather than a bare "dg" on PATH:
+            # a PATH entry ahead of the real dg would otherwise intercept every
+            # hooked install. Fall back to "dg" only if the entry isn't usable.
+            dg_cmd = "dg"
+            try:
+                entry_path = os.path.join(os.path.expanduser("~"), ".dg", "state", "dg-entry")
+                if sys.platform != "win32" and os.path.isfile(entry_path):
+                    with open(entry_path, "r") as fh:
+                        candidate = fh.read().strip()
+                    if candidate and os.access(candidate, os.X_OK):
+                        dg_cmd = candidate
+            except Exception:
+                dg_cmd = "dg"
+            cmd = [dg_cmd, "__wrap", "pip-hook", "--"] + list(sys.argv[1:])
             try:
                 proc = subprocess.run(cmd)
             except FileNotFoundError:
+                sys.stderr.write("dg: scanner not found; pip install proceeding UNSCANNED.\n")
                 return orig_run(self, options, args)
             if proc.returncode != 0:
                 return proc.returncode

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@westbayberry/dg",
-  "version": "1.1.5",
+  "version": "1.2.1",
   "type": "module",
-  "description": "Supply chain security scanner for npm and Python dependencies — 35 behavioral detectors catch zero-day attacks CVE databases miss. 99.66% catch rate on 155K packages.",
+  "description": "Supply chain security scanner for npm and Python dependencies",
   "bin": {
     "dependency-guardian": "dist/index.mjs",
     "dg": "dist/index.mjs"