@westbayberry/dg 1.2.0 → 1.3.0

package/dist/index.mjs

@@ -1894,6 +1894,7 @@ __export(auth_exports, {
   pollAuthSession: () => pollAuthSession,
   preflightAuthCheck: () => preflightAuthCheck,
   readTermsAcceptedAt: () => readTermsAcceptedAt,
+  recordScanCapReached: () => recordScanCapReached,
   recordScanNoticeShown: () => recordScanNoticeShown,
   saveCredentials: () => saveCredentials,
   saveCredentialsFromToken: () => saveCredentialsFromToken,
@@ -2283,18 +2284,28 @@ function writeCachedAuthStatus(status) {
   } catch {
   }
 }
+function recordScanCapReached(scansUsed, maxScans, reason) {
+  writeCachedAuthStatus({
+    authenticated: !!getStoredApiKey(),
+    freeTierCapReached: true,
+    scansUsed,
+    scansLimit: maxScans,
+    capReason: reason,
+    fetchedAt: Date.now()
+  });
+}
 async function preflightAuthCheck(apiUrl) {
   if (process.env.DG_SIMULATE_FREE_CAP_REACHED === "1") {
     throw new PreflightFreeCapReachedError(5, 5);
   }
+  const apiKey = getStoredApiKey();
   const cached = readCachedAuthStatus();
-  if (cached) {
+  if (cached && cached.authenticated === !!apiKey) {
     if (cached.freeTierCapReached) {
       throw new PreflightFreeCapReachedError(cached.scansUsed, cached.scansLimit ?? cached.scansUsed, cached.capReason ?? "monthly_limit");
     }
     return cached;
   }
-  const apiKey = getStoredApiKey();
   const headers = {};
   if (apiKey) {
     headers["Authorization"] = `Bearer ${apiKey}`;
@@ -2324,17 +2335,17 @@ async function preflightAuthCheck(apiUrl) {
     } catch {
     }
     if (body.freeTierCapReached) {
-      const capReason = body.capReason === "prefix_cap" ? "prefix_cap" : "monthly_limit";
+      const capReason2 = body.capReason === "prefix_cap" ? "prefix_cap" : "monthly_limit";
       const status2 = {
         authenticated: !!apiKey,
         freeTierCapReached: true,
         scansUsed: body.scansUsed ?? 0,
         scansLimit: body.maxScans ?? 0,
-        capReason,
+        capReason: capReason2,
         fetchedAt: Date.now()
       };
       writeCachedAuthStatus(status2);
-      throw new PreflightFreeCapReachedError(status2.scansUsed, status2.scansLimit ?? 0, capReason);
+      throw new PreflightFreeCapReachedError(status2.scansUsed, status2.scansLimit ?? 0, capReason2);
     }
   }
   if (!resp.ok) {
@@ -2352,18 +2363,20 @@ async function preflightAuthCheck(apiUrl) {
     data = await resp.json();
   } catch {
   }
+  const capReason = data.capReason === "prefix_cap" ? "prefix_cap" : "monthly_limit";
   const status = {
     authenticated: !!apiKey,
     freeTierCapReached: !!data.freeTierCapReached,
     scansUsed: data.scansUsed ?? 0,
     scansLimit: data.scansLimit ?? null,
+    capReason,
     tier: data.tier,
     name: data.name,
     fetchedAt: Date.now()
   };
   writeCachedAuthStatus(status);
   if (status.freeTierCapReached) {
-    throw new PreflightFreeCapReachedError(status.scansUsed, status.scansLimit ?? 0);
+    throw new PreflightFreeCapReachedError(status.scansUsed, status.scansLimit ?? 0, capReason);
   }
   return status;
 }
@@ -2555,9 +2568,9 @@ function loadDgrc() {
 `);
     }
   }
-  if (cwdPath !== homePath && existsSync2(cwdPath) && process.env.DG_QUIET !== "1") {
+  if (cwdPath !== homePath && existsSync2(cwdPath)) {
     process.stderr.write(
-      `dg: note: ./.dgrc.json is ignored (repo-controlled config is no longer honored). Use ~/.dg/.dgrc.json, env vars (DG_MODE, DG_API_URL), or CLI flags.
+      `dg: note: ./.dgrc.json is ignored (repo-controlled config is no longer honored). Use ~/.dg/.dgrc.json or CLI flags.
 `
     );
   }
@@ -2655,7 +2668,7 @@ function parseConfig(argv, strictFlags = true) {
   const apiKey = dgrc.apiKey && typeof dgrc.apiKey === "string" && (dgrc.apiKey.startsWith("dg_live_") || dgrc.apiKey.startsWith("dg_test_")) ? dgrc.apiKey : null;
   const isProtectiveWrapper = command === "npm" || command === "pip";
   const defaultMode = isProtectiveWrapper ? "block" : "warn";
-  const modeRaw = values.mode ?? process.env.DG_MODE ?? dgrc.mode ?? defaultMode;
+  const modeRaw = values.mode ?? dgrc.mode ?? defaultMode;
   if (!["block", "warn", "off"].includes(modeRaw)) {
     process.stderr.write(
       `Error: Invalid mode "${modeRaw}". Must be block, warn, or off.
@@ -2683,7 +2696,7 @@ function parseConfig(argv, strictFlags = true) {
     sarif: values.sarif || false,
     scanAll: !values["changed-only"],
     baseLockfile: values["base-lockfile"] ?? null,
-    workspace: values.workspace ?? process.env.DG_WORKSPACE ?? null,
+    workspace: values.workspace ?? null,
     outputFile: values.output ?? null,
     command,
     debug,
@@ -2692,7 +2705,6 @@ function parseConfig(argv, strictFlags = true) {
     quiet: (() => {
       if (values["no-quiet"]) return false;
       if (values.quiet) return true;
-      if (process.env.DG_QUIET === "1") return true;
       if (process.env.CI === "1" || process.env.CI === "true") return true;
       return false;
     })(),
@@ -2801,8 +2813,7 @@ var init_config = __esm({
     --api-url <url>          API base URL (default: https://api.westbayberry.com)
 
   Install-wrapper flags (work on \`npm install\`, \`pip install\`, etc.):
-    --dg-force               Bypass a block (audit-visible \u2014 record it)
-    --dg-force-reason "..."  Reason recorded with the override
+    --dg-force               Bypass a block (audit-visible)
     --dg-no-scripts          Add \`--ignore-scripts\` to the real install
     --strict                 Strongest protection: implies --dg-no-scripts and
                              refuses any partial-coverage scan
@@ -2811,16 +2822,11 @@ var init_config = __esm({
     DG_API_KEY               CI auth token (dg_live_* or dg_test_*).
                              Used when ~/.dg/config.json is absent.
                              File beats env if both are present.
-    DG_API_URL               API base URL
-    DG_MODE                  Mode (block | warn | off)
-    DG_DEBUG=1               Enable debug output
-    DG_QUIET=1               Same as passing --quiet
-    DG_WORKSPACE             Workspace subdirectory to scan
-    DG_TELEMETRY=0           Opt out of anonymous crash reports (on by default; DO_NOT_TRACK=1 also opts out)
-    DG_FORCE_POSTINSTALL=1   Force postinstall to run even outside a TTY
-                             (useful for re-running setup manually)
+    DG_TELEMETRY=0           Opt out of anonymous crash reports (on by default;
+                             DO_NOT_TRACK=1 also opts out)
     DG_NO_RC_EDIT=1          Postinstall installs shims but does not edit
                              shell rc files; you set PATH yourself
+    NO_COLOR=1               Disable colored output
     CI=1                     Auto-enables --ci output mode + --quiet
 
   Exit Codes:
@@ -2837,8 +2843,8 @@ var init_config = __esm({
       if the verdict permits. Top-level versions are pinned to the
       exact version we scanned (TOCTOU defense).
     - Warn verdict in a TTY: shows findings and prompts \`Proceed? (Y/n)\`.
-    - Block verdict: refuses install, prints the override command.
-      Override always requires \`--dg-force-reason\`.
+    - Block verdict: refuses install, prints the override command
+      (re-run with \`--dg-force\` to install anyway).
     - Read-only subcommands (npm view, pip show, pnpm list, etc.) skip
       the wrapper entirely \u2014 fast pass-through to the real binary.
     - \`dg scan\` is read-only and never blocks. It does not consume
@@ -2851,7 +2857,7 @@ var init_config = __esm({
     bun add some-pkg
     uv pip install numpy
     pipx install black
-    npm install risky-pkg --dg-force --dg-force-reason="emergency hotfix"
+    npm install risky-pkg --dg-force
     dg scan --json | jq                     # CI-friendly
     dg status                               # see what's protected
 `.trimStart();
@@ -3993,7 +3999,6 @@ dg publish-check \u2014 scan a package about to be published
 
 Usage:
   dg publish-check [--ecosystem npm|pypi] [--json] [--dg-force]
-                   [--dg-force-reason <text>]
 
 What it does:
   Scans the package artifact you're about to publish for bundled secrets,
@@ -4005,7 +4010,6 @@ Flags:
   --ecosystem <npm|pypi>    Force ecosystem detection
   --json                    JSON output to stdout
   --dg-force                Bypass block verdict (audited)
-  --dg-force-reason <text>  Reason string stored with override
 
 Exit codes:
   0  pass    No risks detected
@@ -14026,7 +14030,7 @@ var require_react_reconciler_development = __commonJS({
         var HostPortal = 4;
         var HostComponent = 5;
         var HostText = 6;
-        var Fragment6 = 7;
+        var Fragment7 = 7;
         var Mode = 8;
         var ContextConsumer = 9;
         var ContextProvider = 10;
@@ -14166,7 +14170,7 @@ var require_react_reconciler_development = __commonJS({
               return "DehydratedFragment";
             case ForwardRef:
               return getWrappedName$1(type, type.render, "ForwardRef");
-            case Fragment6:
+            case Fragment7:
               return "Fragment";
             case HostComponent:
               return type;
@@ -17300,7 +17304,7 @@ var require_react_reconciler_development = __commonJS({
             }
           }
           function updateFragment2(returnFiber, current2, fragment, lanes, key) {
-            if (current2 === null || current2.tag !== Fragment6) {
+            if (current2 === null || current2.tag !== Fragment7) {
               var created = createFiberFromFragment(fragment, returnFiber.mode, lanes, key);
               created.return = returnFiber;
               return created;
@@ -17703,7 +17707,7 @@ var require_react_reconciler_development = __commonJS({
               if (child.key === key) {
                 var elementType = element.type;
                 if (elementType === REACT_FRAGMENT_TYPE) {
-                  if (child.tag === Fragment6) {
+                  if (child.tag === Fragment7) {
                     deleteRemainingChildren(returnFiber, child.sibling);
                     var existing = useFiber(child, element.props.children);
                     existing.return = returnFiber;
@@ -23194,7 +23198,7 @@ var require_react_reconciler_development = __commonJS({
               var _resolvedProps2 = workInProgress2.elementType === type ? _unresolvedProps2 : resolveDefaultProps(type, _unresolvedProps2);
               return updateForwardRef(current2, workInProgress2, type, _resolvedProps2, renderLanes2);
             }
-            case Fragment6:
+            case Fragment7:
               return updateFragment(current2, workInProgress2, renderLanes2);
             case Mode:
               return updateMode(current2, workInProgress2, renderLanes2);
@@ -23631,7 +23635,7 @@ var require_react_reconciler_development = __commonJS({
             case SimpleMemoComponent:
             case FunctionComponent:
             case ForwardRef:
-            case Fragment6:
+            case Fragment7:
             case Mode:
             case Profiler:
             case ContextConsumer:
@@ -28399,7 +28403,7 @@ var require_react_reconciler_development = __commonJS({
           return fiber;
         }
         function createFiberFromFragment(elements, mode, lanes, key) {
-          var fiber = createFiber(Fragment6, elements, key, mode);
+          var fiber = createFiber(Fragment7, elements, key, mode);
           fiber.lanes = lanes;
           return fiber;
         }
@@ -42574,6 +42578,24 @@ var init_lockfile = __esm({
 });
 
 // src/commands/wrapper-shared.ts
+import { spawn as spawn2 } from "node:child_process";
+function spawnTrimmed(bin, args, env3) {
+  return new Promise((resolve3) => {
+    const child = spawn2(bin, args, { stdio: ["inherit", "pipe", "pipe"], shell: false, env: { ...env3, FORCE_COLOR: "1" } });
+    let buf = "";
+    const onData = (c) => {
+      buf += c.toString();
+    };
+    child.stdout?.on("data", onData);
+    child.stderr?.on("data", onData);
+    child.on("error", () => resolve3(1));
+    child.on("close", (code) => {
+      const lines = buf.split("\n").filter((l) => l.replace(ANSI_RE, "").trim() !== "");
+      if (lines.length) process.stdout.write(lines.join("\n") + "\n");
+      resolve3(code ?? 1);
+    });
+  });
+}
 function injectIgnoreScripts(args, opts) {
   if (!opts.isNpmFamily) return args;
   if (!(opts.strict || opts.dgNoScripts)) return args;
@@ -42582,7 +42604,6 @@ function injectIgnoreScripts(args, opts) {
 }
 function stripDgFlags(args) {
   let dgForce = false;
-  let dgForceReason;
   let dgNoScripts = false;
   const filtered = [];
   for (let i = 0; i < args.length; i++) {
@@ -42591,15 +42612,6 @@ function stripDgFlags(args) {
       dgForce = true;
       continue;
     }
-    if (arg === "--dg-force-reason") {
-      dgForceReason = (args[i + 1] ?? "").slice(0, 500);
-      i++;
-      continue;
-    }
-    if (arg.startsWith("--dg-force-reason=")) {
-      dgForceReason = arg.slice("--dg-force-reason=".length).slice(0, 500);
-      continue;
-    }
     if (arg === "--dg-no-scripts") {
       dgNoScripts = true;
       continue;
@@ -42619,12 +42631,13 @@ function stripDgFlags(args) {
     if (consumed) continue;
     filtered.push(arg);
   }
-  return { filtered, dgForce, dgForceReason, dgNoScripts };
+  return { filtered, dgForce, dgNoScripts };
 }
-var DG_VALUE_FLAGS, DG_BOOLEAN_FLAGS;
+var ANSI_RE, DG_VALUE_FLAGS, DG_BOOLEAN_FLAGS;
 var init_wrapper_shared = __esm({
   "src/commands/wrapper-shared.ts"() {
     "use strict";
+    ANSI_RE = /\x1b\[[0-9;]*m/g;
     DG_VALUE_FLAGS = /* @__PURE__ */ new Set([
       "--mode",
       "--api-url",
@@ -42633,6 +42646,8 @@ var init_wrapper_shared = __esm({
       "--workspace",
       "--output",
       "-o",
+      // Removed flag: still consumed (with its value) so a legacy invocation is
+      // silently stripped rather than leaking to the real installer as a package.
       "--dg-force-reason"
     ]);
     DG_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
@@ -42650,7 +42665,7 @@ var init_wrapper_shared = __esm({
 });
 
 // src/commands/npm-wrapper.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { readFileSync as readFileSync9, existsSync as existsSync12, mkdtempSync, writeFileSync as writeFileSync8, rmSync } from "node:fs";
 import { join as join7 } from "node:path";
 import { tmpdir } from "node:os";
@@ -42665,7 +42680,7 @@ function shimSentinelEnv() {
   return childInstallEnv();
 }
 function parseNpmArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS.has(command);
   const packages = [];
@@ -42686,7 +42701,6 @@ function parseNpmArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -42742,7 +42756,7 @@ async function resolveVersion(spec) {
     return null;
   }
   return new Promise((resolve3) => {
-    const child = spawn2(realNpmBinary(), ["view", spec, "version", "--json"], {
+    const child = spawn3(realNpmBinary(), ["view", spec, "version", "--json"], {
       stdio: ["pipe", "pipe", "pipe"],
       env: shimSentinelEnv()
     });
@@ -42818,9 +42832,12 @@ async function resolvePackages(specs) {
   return { resolved, failed };
 }
 function runNpm(args, opts) {
+  if (opts?.trim) {
+    return spawnTrimmed(realNpmBinary(), args, shimSentinelEnv());
+  }
   return new Promise((resolve3) => {
     const stdio = opts?.stdoutToStderr ? ["inherit", "pipe", "inherit"] : ["inherit", "inherit", "inherit"];
-    const child = spawn2(realNpmBinary(), args, { stdio, shell: false, env: shimSentinelEnv() });
+    const child = spawn3(realNpmBinary(), args, { stdio, shell: false, env: shimSentinelEnv() });
     if (opts?.stdoutToStderr && child.stdout) {
       child.stdout.on("data", (chunk) => {
         process.stderr.write(chunk);
@@ -42840,7 +42857,7 @@ async function resolveTreeNpm(specs) {
   try {
     writeFileSync8(join7(dir, "package.json"), '{"name":"_dg_resolve","version":"1.0.0","private":true}');
     const stdout = await new Promise((resolve3) => {
-      const child = spawn2(
+      const child = spawn3(
         realNpmBinary(),
         [
           "install",
@@ -43000,10 +43017,10 @@ var init_npm_wrapper = __esm({
 });
 
 // src/commands/pip-wrapper.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync13 } from "node:fs";
 function parsePipArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS2.has(command);
   const packages = [];
@@ -43030,7 +43047,6 @@ function parsePipArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan,
     requirementsFile
@@ -43202,7 +43218,7 @@ async function detectPipBinary() {
     try {
       const parts = cmd.split(" ");
       const code = await new Promise((resolve3) => {
-        const child = spawn3(parts[0], [...parts.slice(1), "--version"], {
+        const child = spawn4(parts[0], [...parts.slice(1), "--version"], {
           stdio: ["pipe", "pipe", "pipe"],
           timeout: 5e3,
           env: shimSentinelEnv2()
@@ -43221,9 +43237,12 @@ async function detectPipBinary() {
 async function runPip(args, opts) {
   const pipCmd = await detectPipBinary();
   const parts = pipCmd.split(" ");
+  if (opts?.trim) {
+    return spawnTrimmed(parts[0], [...parts.slice(1), ...args], shimSentinelEnv2());
+  }
   return new Promise((resolve3) => {
     const stdio = opts?.stdoutToStderr ? ["inherit", "pipe", "inherit"] : ["inherit", "inherit", "inherit"];
-    const child = spawn3(parts[0], [...parts.slice(1), ...args], { stdio, shell: false, env: shimSentinelEnv2() });
+    const child = spawn4(parts[0], [...parts.slice(1), ...args], { stdio, shell: false, env: shimSentinelEnv2() });
     if (opts?.stdoutToStderr && child.stdout) {
       child.stdout.on("data", (chunk) => {
         process.stderr.write(chunk);
@@ -43238,7 +43257,7 @@ async function pipVersion() {
     const pipCmd = await detectPipBinary();
     const parts = pipCmd.split(" ");
     return await new Promise((resolve3) => {
-      const child = spawn3(parts[0], [...parts.slice(1), "--version"], {
+      const child = spawn4(parts[0], [...parts.slice(1), "--version"], {
         stdio: ["pipe", "pipe", "pipe"],
         timeout: 5e3,
         env: shimSentinelEnv2()
@@ -43296,7 +43315,7 @@ async function resolveTreePip(specs) {
   const pipCmd = await detectPipBinary();
   const parts = pipCmd.split(" ");
   const runDryRun = (extraFlags) => new Promise((resolve3) => {
-    const child = spawn3(
+    const child = spawn4(
       parts[0],
       [
         ...parts.slice(1),
@@ -43388,6 +43407,153 @@ var init_pip_wrapper = __esm({
   }
 });
 
+// src/wrapper/route.ts
+function routeVerdict(input) {
+  const { verdict, mode, strict, dgForce } = input;
+  const refuseHard = mode === "block" || strict;
+  const refuseWarn = strict;
+  const D = (outcome, refuseExitCode, extra) => ({
+    verdict,
+    outcome,
+    refuseExitCode,
+    bypassed: false,
+    ...extra
+  });
+  if (verdict === "free_cap") return D("refuse", 1);
+  if (verdict === "pass") return D("install", 0);
+  if (dgForce && (verdict === "warn" || verdict === "block")) {
+    return D("install", 0, { audit: "override", bypassed: true });
+  }
+  switch (verdict) {
+    case "warn":
+      if (mode === "off") return D("install", 0);
+      if (refuseWarn) return D("refuse", 1);
+      return D("prompt", 1);
+    // warn/block mode → prompt; decline → 1
+    case "block":
+      if (mode === "off") return D("install", 0);
+      return D("refuse", 2, { audit: "block" });
+    case "analysis_incomplete":
+      if (dgForce) return D("install", 0, { bypassed: true });
+      if (refuseHard) return D("refuse", 4);
+      return D("install", 0);
+    // off/warn → install with a "could not verify" notice
+    case "scan_failed":
+    case "tree_failed":
+      if (dgForce) return D("install", 0, { bypassed: true });
+      if (refuseHard) return D("refuse", 2);
+      return D("install", 0);
+    // best-effort under off/warn
+    case "resolve_failed":
+      if (dgForce) return D("passthrough", 0, { bypassed: true });
+      if (refuseHard) return D("refuse", 2);
+      return D("passthrough", 0);
+    // nothing resolved to scan → hand off to the installer
+    default: {
+      const _never = verdict;
+      void _never;
+      return D(refuseHard ? "refuse" : "install", refuseHard ? 4 : 0);
+    }
+  }
+}
+var init_route = __esm({
+  "src/wrapper/route.ts"() {
+    "use strict";
+  }
+});
+
+// src/wrapper/run.ts
+function verdictFromResult(result, gates = {}) {
+  if (gates.scanFailed) return "scan_failed";
+  if (gates.treeFailed) return "tree_failed";
+  if (gates.resolveFailed) return "resolve_failed";
+  const action = result?.action;
+  if (action === "pass" || action === "warn" || action === "block") return action;
+  return "analysis_incomplete";
+}
+function scanVerdictOf(decision) {
+  if (decision.bypassed && (decision.verdict === "warn" || decision.verdict === "block")) {
+    return "override";
+  }
+  switch (decision.verdict) {
+    case "pass":
+      return "pass";
+    case "warn":
+      return "warn";
+    case "block":
+      return "block";
+    case "analysis_incomplete":
+      return "analysis_incomplete";
+    case "scan_failed":
+    case "tree_failed":
+    case "resolve_failed":
+      return "scan_failed";
+    default:
+      return "skipped";
+  }
+}
+async function executeDecision(decision, ctx, presenter) {
+  await presenter.announce(decision, ctx);
+  if (decision.audit) {
+    await presenter.audit(decision.audit, ctx);
+  }
+  const scanVerdict = scanVerdictOf(decision);
+  const base = (installRan, installExitCode) => ({
+    scanVerdict,
+    installRan,
+    installExitCode,
+    error: ctx.error,
+    suppressedByAllowlist: ctx.suppressedCount > 0 ? ctx.suppressedCount : void 0
+  });
+  switch (decision.outcome) {
+    case "refuse":
+      presenter.emit(base(false, null));
+      return decision.refuseExitCode;
+    case "install": {
+      const code = await presenter.runInstall(ctx.installArgs);
+      presenter.emit(base(true, code));
+      return code;
+    }
+    case "passthrough": {
+      const code = await presenter.runInstall(ctx.passthroughArgs);
+      presenter.emit(base(true, code));
+      return code;
+    }
+    case "prompt": {
+      const proceed = await presenter.confirmProceed(ctx);
+      if (!proceed) {
+        presenter.emit(base(false, null));
+        return decision.refuseExitCode;
+      }
+      if (presenter.onPromptAccepted) await presenter.onPromptAccepted(ctx);
+      const code = await presenter.runInstall(ctx.installArgs);
+      presenter.emit(base(true, code));
+      return code;
+    }
+    default: {
+      const _never = decision.outcome;
+      void _never;
+      return 1;
+    }
+  }
+}
+var init_run = __esm({
+  "src/wrapper/run.ts"() {
+    "use strict";
+  }
+});
+
+// src/wrapper/json.ts
+function emitWrapperJson(config, result) {
+  if (!config.json) return;
+  process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+}
+var init_json = __esm({
+  "src/wrapper/json.ts"() {
+    "use strict";
+  }
+});
+
 // src/security/artifact_integrity.ts
 function normalize(h, algo) {
   if (!h) return void 0;
@@ -44795,7 +44961,6 @@ async function dispatchPublishCheckAudit(opts) {
         score: opts.score,
         action: opts.decisionAction,
         bypassed: opts.bypassed,
-        bypass_reason: opts.bypassReason,
         event_kind: "publish_check"
       },
       { apiUrl: opts.apiUrl }
@@ -44817,7 +44982,6 @@ function recordBypassLocally(record) {
       ecosystem: record.ecosystem,
       verdict: record.verdict,
       trigger: record.trigger,
-      reason: record.reason,
       packages: record.packages
     };
     appendFileSync3(path, JSON.stringify(full) + "\n", { mode: 384 });
@@ -44840,7 +45004,6 @@ async function dispatchInstallAudit(opts) {
             score: p.score,
             action: opts.decisionAction,
             bypassed: opts.bypassed,
-            bypass_reason: opts.bypassReason,
             project_hash: opts.projectHash
           },
           { apiUrl: opts.apiUrl }
@@ -44879,10 +45042,6 @@ function note(config, text) {
   if (config.quiet) return;
   process.stderr.write(text);
 }
-function emitWrapperJson(config, result) {
-  if (!config.json) return;
-  process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-}
 function wrapperPackagesFromResult(result, topLevelNames) {
   return result.packages.map((p) => ({
     name: p.name,
@@ -45367,11 +45526,7 @@ async function runStatic(config) {
   printTrialBanner(result, config);
   process.exit(scanExitCode(result.action, config.mode));
 }
-function mergeProjectConfig(config, _argv) {
-  return config;
-}
 async function runStaticNpm(npmArgs, config) {
-  config = mergeProjectConfig(config, process.argv.slice(2));
   const parsed = parseNpmArgs(npmArgs);
   if (!parsed.shouldScan) {
     const code = await runNpm(parsed.rawArgs);
@@ -45623,156 +45778,106 @@ async function scanAndInstallStatic(resolved, parsed, config) {
       );
     }
   }
-  if (result.action === "pass") {
-    const topLevel = resolved.map((p) => `${p.name} ${p.version}`);
-    const passLine = topLevel.length === 1 ? `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel[0]} is safe` : `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel.length} packages safe`;
-    const installLine = topLevel.length === 1 ? `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel[0]}` : `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel.join(", ")}`;
-    process.stderr.write(`${passLine}
+  const npmInstallArgs = buildInstallArgs(parsed, topLevelSpecs, tree.packages, config);
+  const npmTopLevelNames = new Set(resolved.map((p) => p.name));
+  const npmDecision = routeVerdict({
+    verdict: verdictFromResult(result),
+    mode: config.mode,
+    strict: config.strict,
+    dgForce: parsed.dgForce
+  });
+  const npmPresenter = {
+    async announce(d) {
+      if (d.verdict === "pass") {
+        const topLevel2 = resolved.map((p) => `${p.name} ${p.version}`);
+        const passLine = topLevel2.length === 1 ? `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel2[0]} is safe` : `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel2.length} packages safe`;
+        const installLine = topLevel2.length === 1 ? `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel2[0]}` : `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel2.join(", ")}`;
+        process.stderr.write(`${passLine}
 ${installLine}
 `);
-    if (parsed.dgNoScripts || config.strict) {
-      const why = config.strict ? "--strict" : "--dg-no-scripts";
-      process.stderr.write(import_chalk5.default.dim(`  ${why}: lifecycle scripts will be suppressed during install.
+        if (parsed.dgNoScripts || config.strict) {
+          const why = config.strict ? "--strict" : "--dg-no-scripts";
+          process.stderr.write(import_chalk5.default.dim(`  ${why}: lifecycle scripts will be suppressed during install.
 `));
-    }
-    printTrialBanner(result, config);
-    process.stderr.write("\n");
-    const code = await runNpm(buildInstallArgs(parsed, topLevelSpecs, tree.packages, config), { stdoutToStderr: !!config.json });
-    emitWrapperJson(config, {
-      ecosystem: "npm",
-      packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-      scanVerdict: "pass",
-      installRan: true,
-      installExitCode: code
-    });
-    process.exit(code);
-  }
-  const output = renderResultStatic(result, config);
-  (config.json ? process.stderr : process.stdout).write(output + "\n");
-  printTrialBanner(result, config);
-  if (result.action === "warn") {
-    const { promptYesNo: promptYesNo2 } = await Promise.resolve().then(() => (init_prompt(), prompt_exports));
-    const topLevel = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    process.stderr.write(
-      `  ${import_chalk5.default.yellow("\u26A0")} ${import_chalk5.default.bold("DG flagged")} ${topLevel}.
+        }
+        printTrialBanner(result, config);
+        process.stderr.write("\n");
+        return;
+      }
+      const output = renderResultStatic(result, config);
+      (config.json ? process.stderr : process.stdout).write(output + "\n");
+      printTrialBanner(result, config);
+      const topLevel = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
+      if (d.verdict === "warn") {
+        process.stderr.write(`  ${import_chalk5.default.yellow("\u26A0")} ${import_chalk5.default.bold("DG flagged")} ${topLevel}.
+`);
+      } else if (d.verdict === "block") {
+        if (d.outcome === "install") {
+          process.stderr.write(import_chalk5.default.yellow(import_chalk5.default.bold("  --dg-force: Bypassing block. Install at your own risk.\n\n")));
+        } else {
+          const blockedSpecArg = topLevelSpecs.length > 0 ? topLevelSpecs.join(" ") : topLevel.split(", ").map((s) => s.replace(/ /g, "@")).join(" ");
+          process.stderr.write(
+            `  ${import_chalk5.default.red("\u2717")} ${import_chalk5.default.bold("DG blocked")} ${topLevel}.
+  ${import_chalk5.default.dim(`install anyway: npm install ${blockedSpecArg} --dg-force`)}
+
 `
-    );
-    const proceed = await promptYesNo2({
-      defaultAnswer: "y",
-      message: `  Proceed?`
-    });
-    if (!proceed) {
-      process.stderr.write(import_chalk5.default.dim("  Install cancelled by user.\n\n"));
-      emitWrapperJson(config, {
-        ecosystem: "npm",
-        packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-        scanVerdict: "warn",
-        installRan: false,
-        installExitCode: null
-      });
-      process.exit(1);
-    }
-    const code = await runNpm(buildInstallArgs(parsed, topLevelSpecs, tree.packages, config), { stdoutToStderr: !!config.json });
-    emitWrapperJson(config, {
-      ecosystem: "npm",
-      packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-      scanVerdict: "warn",
-      installRan: true,
-      installExitCode: code
-    });
-    process.exit(code);
-  }
-  if (result.action === "block") {
-    if (parsed.dgForce) {
-      const { dispatchInstallAudit: dispatchInstallAudit3 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-      await dispatchInstallAudit3({
+          );
+        }
+      } else if (d.verdict === "analysis_incomplete") {
+        if (d.outcome === "refuse") {
+          const specArg = topLevelSpecs.length > 0 ? topLevelSpecs.join(" ") : resolved.map((p) => `${p.name}@${p.version}`).join(" ");
+          process.stderr.write(
+            `  ${import_chalk5.default.cyan("?")} ${import_chalk5.default.bold("DG couldn't verify")} ${topLevel} \u2014 unverified, not safe.
+  ${import_chalk5.default.dim(`install anyway: npm install ${specArg} --dg-force`)}
+
+`
+          );
+        } else {
+          process.stderr.write(import_chalk5.default.dim(`  DG could not fully verify ${topLevel}; proceeding (mode is not block).
+
+`));
+        }
+      }
+    },
+    async confirmProceed() {
+      const { promptYesNo: promptYesNo2 } = await Promise.resolve().then(() => (init_prompt(), prompt_exports));
+      const proceed = await promptYesNo2({ defaultAnswer: "y", message: `  Proceed?` });
+      if (!proceed) process.stderr.write(import_chalk5.default.dim("  Install cancelled by user.\n\n"));
+      return proceed;
+    },
+    runInstall: (args) => runNpm(args, { stdoutToStderr: !!config.json }),
+    async audit(kind) {
+      const { dispatchInstallAudit: dispatchInstallAudit2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
+      await dispatchInstallAudit2({
         ecosystem: "npm",
         packages: result.packages,
-        decisionAction: "override",
-        bypassed: true,
-        bypassReason: parsed.dgForceReason
-      });
-      process.stderr.write(
-        import_chalk5.default.yellow(
-          import_chalk5.default.bold(
-            "  --dg-force: Bypassing block. Install at your own risk.\n\n"
-          )
-        )
-      );
-      const code = await runNpm(buildInstallArgs(parsed, topLevelSpecs, tree.packages, config), { stdoutToStderr: !!config.json });
-      emitWrapperJson(config, {
-        ecosystem: "npm",
-        packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-        scanVerdict: "override",
-        installRan: true,
-        installExitCode: code
+        decisionAction: kind,
+        bypassed: kind === "override"
       });
-      process.exit(code);
-    }
-    const { dispatchInstallAudit: dispatchInstallAudit2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-    await dispatchInstallAudit2({
-      ecosystem: "npm",
-      packages: result.packages,
-      decisionAction: "block",
-      bypassed: false
-    });
-    const topLevelBlocked = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    const blockedSpecArg = topLevelSpecs.length > 0 ? topLevelSpecs.join(" ") : topLevelBlocked.split(", ").map((s) => s.replace(/ /g, "@")).join(" ");
-    process.stderr.write(
-      `  ${import_chalk5.default.red("\u2717")} ${import_chalk5.default.bold("DG blocked")} ${topLevelBlocked}.
-  Real install was NOT run. To override:
-` + import_chalk5.default.dim(`    npm install ${blockedSpecArg} --dg-force --dg-force-reason="<reason>"
-
-`)
-    );
-    emitWrapperJson(config, {
-      ecosystem: "npm",
-      packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-      scanVerdict: "block",
-      installRan: false,
-      installExitCode: null
-    });
-    process.exit(2);
-  }
-  if (result.action === "analysis_incomplete") {
-    const topLevel = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    const refuse = (config.mode === "block" || config.strict) && !parsed.dgForce;
-    if (refuse) {
-      const specArg = topLevelSpecs.length > 0 ? topLevelSpecs.join(" ") : resolved.map((p) => `${p.name}@${p.version}`).join(" ");
-      process.stderr.write(
-        `  ${import_chalk5.default.cyan("?")} ${import_chalk5.default.bold("DG could not verify")} ${topLevel} \u2014 treating as unverified, not safe.
-  Real install was NOT run (--mode block). To override:
-` + import_chalk5.default.dim(`    npm install ${specArg} --dg-force --dg-force-reason="<reason>"
-
-`)
-      );
+    },
+    emit(record) {
       emitWrapperJson(config, {
         ecosystem: "npm",
-        packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-        scanVerdict: "analysis_incomplete",
-        installRan: false,
-        installExitCode: null
+        packages: wrapperPackagesFromResult(result, npmTopLevelNames),
+        scanVerdict: record.scanVerdict,
+        installRan: record.installRan,
+        installExitCode: record.installExitCode,
+        error: record.error
       });
-      process.exit(4);
     }
-    process.stderr.write(
-      import_chalk5.default.dim(`  DG could not fully verify ${topLevel}; proceeding (mode is not block).
-
-`)
-    );
-    const code = await runNpm(buildInstallArgs(parsed, topLevelSpecs, tree.packages, config), { stdoutToStderr: !!config.json });
-    emitWrapperJson(config, {
-      ecosystem: "npm",
-      packages: wrapperPackagesFromResult(result, new Set(resolved.map((p) => p.name))),
-      scanVerdict: "analysis_incomplete",
-      installRan: true,
-      installExitCode: code
-    });
-    process.exit(code);
-  }
+  };
+  const npmCtx = {
+    ecosystem: "npm",
+    apiKind: "npm",
+    installArgs: npmInstallArgs,
+    passthroughArgs: parsed.rawArgs,
+    result,
+    resolved,
+    suppressedCount: 0
+  };
+  process.exit(await executeDecision(npmDecision, npmCtx, npmPresenter));
 }
 async function runStaticPip(pipArgs, config) {
-  config = mergeProjectConfig(config, process.argv.slice(2));
   const parsed = parsePipArgs(pipArgs);
   if (!parsed.shouldScan) {
     const code = await runPip(parsed.rawArgs, { stdoutToStderr: !!config.json });
@@ -45933,141 +46038,97 @@ async function runStaticPip(pipArgs, config) {
     }
   }
   const pipTopLevelNames = new Set(resolved.map((p) => p.name));
-  if (result.action === "pass") {
-    const topLevel = resolved.map((p) => `${p.name} ${p.version}`);
-    const passLine = topLevel.length === 1 ? `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel[0]} is safe` : `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel.length} packages safe`;
-    const installLine = topLevel.length === 1 ? `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel[0]}` : `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel.join(", ")}`;
-    process.stderr.write(`${passLine}
+  const pipDecision = routeVerdict({
+    verdict: verdictFromResult(result),
+    mode: config.mode,
+    strict: config.strict,
+    dgForce: parsed.dgForce
+  });
+  const pipPresenter = {
+    async announce(d) {
+      if (d.verdict === "pass") {
+        const topLevel2 = resolved.map((p) => `${p.name} ${p.version}`);
+        const passLine = topLevel2.length === 1 ? `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel2[0]} is safe` : `  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("DG verified:")} ${topLevel2.length} packages safe`;
+        const installLine = topLevel2.length === 1 ? `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel2[0]}` : `  ${import_chalk5.default.green("\u2713")} Installing ${topLevel2.join(", ")}`;
+        process.stderr.write(`${passLine}
 ${installLine}
 `);
-    printTrialBanner(result, config);
-    process.stderr.write("\n");
-    const code = await runPip(pipInstallArgs, { stdoutToStderr: !!config.json });
-    emitWrapperJson(config, {
-      ecosystem: "pypi",
-      packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-      scanVerdict: "pass",
-      installRan: true,
-      installExitCode: code
-    });
-    process.exit(code);
-  }
-  const output = renderResultStatic(result, config);
-  (config.json ? process.stderr : process.stdout).write(output + "\n");
-  printTrialBanner(result, config);
-  if (result.action === "warn") {
-    const { promptYesNo: promptYesNo2 } = await Promise.resolve().then(() => (init_prompt(), prompt_exports));
-    const topLevel = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    process.stderr.write(
-      `  ${import_chalk5.default.yellow("\u26A0")} ${import_chalk5.default.bold("DG flagged")} ${topLevel}.
+        printTrialBanner(result, config);
+        process.stderr.write("\n");
+        return;
+      }
+      const output = renderResultStatic(result, config);
+      (config.json ? process.stderr : process.stdout).write(output + "\n");
+      printTrialBanner(result, config);
+      const topLevel = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
+      if (d.verdict === "warn") {
+        process.stderr.write(`  ${import_chalk5.default.yellow("\u26A0")} ${import_chalk5.default.bold("DG flagged")} ${topLevel}.
+`);
+      } else if (d.verdict === "block") {
+        if (d.outcome === "install") {
+          process.stderr.write(import_chalk5.default.yellow(import_chalk5.default.bold("  --dg-force: Bypassing block. Install at your own risk.\n\n")));
+        } else {
+          const pipBlockedSpecArg = resolved.map((p) => `${p.name}==${p.version}`).join(" ");
+          process.stderr.write(
+            `  ${import_chalk5.default.red("\u2717")} ${import_chalk5.default.bold("DG blocked")} ${topLevel}.
+  ${import_chalk5.default.dim(`install anyway: pip install ${pipBlockedSpecArg} --dg-force`)}
+
 `
-    );
-    const proceed = await promptYesNo2({ defaultAnswer: "y", message: "  Proceed?" });
-    if (!proceed) {
-      process.stderr.write(import_chalk5.default.dim("  Install cancelled by user.\n\n"));
-      emitWrapperJson(config, {
-        ecosystem: "pypi",
-        packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-        scanVerdict: "warn",
-        installRan: false,
-        installExitCode: null
-      });
-      process.exit(1);
-    }
-    const code = await runPip(pipInstallArgs, { stdoutToStderr: !!config.json });
-    emitWrapperJson(config, {
-      ecosystem: "pypi",
-      packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-      scanVerdict: "warn",
-      installRan: true,
-      installExitCode: code
-    });
-    process.exit(code);
-  }
-  if (result.action === "block") {
-    if (parsed.dgForce) {
-      const { dispatchInstallAudit: dispatchInstallAudit3 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-      await dispatchInstallAudit3({
+          );
+        }
+      } else if (d.verdict === "analysis_incomplete") {
+        if (d.outcome === "refuse") {
+          const pipSpecArg = resolved.map((p) => `${p.name}==${p.version}`).join(" ");
+          process.stderr.write(
+            `  ${import_chalk5.default.cyan("?")} ${import_chalk5.default.bold("DG couldn't verify")} ${topLevel} \u2014 unverified, not safe.
+  ${import_chalk5.default.dim(`install anyway: pip install ${pipSpecArg} --dg-force`)}
+
+`
+          );
+        } else {
+          process.stderr.write(import_chalk5.default.dim(`  DG could not fully verify ${topLevel}; proceeding (mode is not block).
+
+`));
+        }
+      }
+    },
+    async confirmProceed() {
+      const { promptYesNo: promptYesNo2 } = await Promise.resolve().then(() => (init_prompt(), prompt_exports));
+      const proceed = await promptYesNo2({ defaultAnswer: "y", message: "  Proceed?" });
+      if (!proceed) process.stderr.write(import_chalk5.default.dim("  Install cancelled by user.\n\n"));
+      return proceed;
+    },
+    runInstall: (args) => runPip(args, { stdoutToStderr: !!config.json }),
+    async audit(kind) {
+      const { dispatchInstallAudit: dispatchInstallAudit2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
+      await dispatchInstallAudit2({
         ecosystem: "pypi",
         packages: result.packages,
-        decisionAction: "override",
-        bypassed: true,
-        bypassReason: parsed.dgForceReason
+        decisionAction: kind,
+        bypassed: kind === "override"
       });
-      process.stderr.write(
-        import_chalk5.default.yellow(import_chalk5.default.bold("  --dg-force: Bypassing block. Install at your own risk.\n\n"))
-      );
-      const code = await runPip(pipInstallArgs, { stdoutToStderr: !!config.json });
-      emitWrapperJson(config, {
-        ecosystem: "pypi",
-        packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-        scanVerdict: "override",
-        installRan: true,
-        installExitCode: code
-      });
-      process.exit(code);
-    }
-    const { dispatchInstallAudit: dispatchInstallAudit2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-    await dispatchInstallAudit2({
-      ecosystem: "pypi",
-      packages: result.packages,
-      decisionAction: "block",
-      bypassed: false
-    });
-    const pipTopLevelBlocked = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    const pipBlockedSpecArg = resolved.map((p) => `${p.name}==${p.version}`).join(" ");
-    process.stderr.write(
-      `  ${import_chalk5.default.red("\u2717")} ${import_chalk5.default.bold("DG blocked")} ${pipTopLevelBlocked}.
-  Real install was NOT run. To override:
-` + import_chalk5.default.dim(`    pip install ${pipBlockedSpecArg} --dg-force --dg-force-reason="<reason>"
-
-`)
-    );
-    emitWrapperJson(config, {
-      ecosystem: "pypi",
-      packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-      scanVerdict: "block",
-      installRan: false,
-      installExitCode: null
-    });
-    process.exit(2);
-  }
-  if (result.action === "analysis_incomplete") {
-    const pipTopLevel = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    const refuse = (config.mode === "block" || config.strict) && !parsed.dgForce;
-    if (refuse) {
-      const pipSpecArg = resolved.map((p) => `${p.name}==${p.version}`).join(" ");
-      process.stderr.write(
-        `  ${import_chalk5.default.cyan("?")} ${import_chalk5.default.bold("DG could not verify")} ${pipTopLevel} \u2014 treating as unverified, not safe.
-  Real install was NOT run (--mode block). To override:
-` + import_chalk5.default.dim(`    pip install ${pipSpecArg} --dg-force --dg-force-reason="<reason>"
-
-`)
-      );
+    },
+    emit(record) {
       emitWrapperJson(config, {
         ecosystem: "pypi",
         packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-        scanVerdict: "analysis_incomplete",
-        installRan: false,
-        installExitCode: null
+        scanVerdict: record.scanVerdict,
+        installRan: record.installRan,
+        installExitCode: record.installExitCode,
+        error: record.error
       });
-      process.exit(4);
     }
-    process.stderr.write(
-      import_chalk5.default.dim(`  DG could not fully verify ${pipTopLevel}; proceeding (mode is not block).
-
-`)
-    );
-    const code = await runPip(pipInstallArgs, { stdoutToStderr: !!config.json });
-    emitWrapperJson(config, {
-      ecosystem: "pypi",
-      packages: wrapperPackagesFromResult(result, pipTopLevelNames),
-      scanVerdict: "analysis_incomplete",
-      installRan: true,
-      installExitCode: code
-    });
-    process.exit(code);
-  }
+  };
+  const pipCtx = {
+    ecosystem: "pypi",
+    apiKind: "pypi",
+    installArgs: pipInstallArgs,
+    passthroughArgs: parsed.rawArgs,
+    result,
+    resolved,
+    suppressedCount: 0
+  };
+  process.exit(await executeDecision(pipDecision, pipCtx, pipPresenter));
 }
 async function runStaticLogin() {
   const {
@@ -46181,6 +46242,9 @@ var init_static_output = __esm({
     init_npm_wrapper();
     init_pip_wrapper();
     init_wrapper_shared();
+    init_route();
+    init_run();
+    init_json();
     init_artifact_integrity();
     init_sanitize();
     init_format_helpers();
@@ -48680,7 +48744,7 @@ __export(publish_check_exports, {
   scanPayload: () => scanPayload,
   summarize: () => summarize
 });
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { readFileSync as readFileSync13, existsSync as existsSync19, readdirSync as readdirSync3 } from "node:fs";
 import { join as join12, basename as basename2 } from "node:path";
 import { createGunzip } from "node:zlib";
@@ -48692,7 +48756,7 @@ function sanitizeSnippet(s, max = 40) {
 }
 async function npmPackDryRun(cwd2 = process.cwd()) {
   return new Promise((resolve3) => {
-    const child = spawn4("npm", ["pack", "--dry-run", "--json"], {
+    const child = spawn5("npm", ["pack", "--dry-run", "--json"], {
       cwd: cwd2,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -50847,6 +50911,11 @@ async function runNpmScan(packages, skippedCount, config, dispatch) {
     dispatch({ type: "SCAN_COMPLETE", result, durationMs: Date.now() - startMs, skippedCount });
   } catch (error) {
     if (error instanceof FreeCapReachedError) {
+      try {
+        const { recordScanCapReached: recordScanCapReached2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+        recordScanCapReached2(error.scansUsed, error.maxScans, error.reason);
+      } catch {
+      }
       dispatch({ type: "FREE_CAP_REACHED", scansUsed: error.scansUsed, maxScans: error.maxScans, capReason: error.reason });
       return;
     }
@@ -50926,6 +50995,11 @@ async function scanProjects(projects, config, dispatch) {
     dispatch({ type: "SCAN_COMPLETE", result: merged, durationMs: merged.durationMs, skippedCount: 0, discoveredTotal });
   } catch (error) {
     if (error instanceof FreeCapReachedError) {
+      try {
+        const { recordScanCapReached: recordScanCapReached2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+        recordScanCapReached2(error.scansUsed, error.maxScans, error.reason);
+      } catch {
+      }
       dispatch({ type: "FREE_CAP_REACHED", scansUsed: error.scansUsed, maxScans: error.maxScans, capReason: error.reason });
       return;
     }
@@ -51726,22 +51800,18 @@ var init_readonly = __esm({
 // src/ui/hooks/useWrapperBase.ts
 function reducer4(_state, action) {
   switch (action.type) {
-    case "PASSTHROUGH":
-      return { phase: "passthrough" };
     case "RESOLVING":
       return { phase: "resolving", count: action.count };
     case "SCANNING":
       return { phase: "scanning", count: action.count };
-    case "PASS":
-      return { phase: "pass", count: action.count, result: action.result };
     case "WARN":
-      return { phase: "warn", result: action.result, dgForce: action.dgForce };
-    case "BLOCKED":
-      return { phase: "blocked", result: action.result, dgForce: action.dgForce };
-    case "INCOMPLETE":
-      return { phase: "incomplete", result: action.result, message: action.message, proceed: action.proceed };
+      return { phase: "warn", result: action.result };
+    case "REFUSED":
+      return { phase: "refused", result: action.result, verdict: action.verdict, cmd: action.cmd, exitCode: action.exitCode };
+    case "DECLINED":
+      return { phase: "declined", line: action.line, exitCode: action.exitCode };
     case "INSTALLING":
-      return { phase: "installing" };
+      return { phase: "installing", line: action.line };
     case "DONE":
       return { phase: "done", exitCode: action.exitCode };
     case "ERROR":
@@ -51750,12 +51820,17 @@ function reducer4(_state, action) {
       return { phase: "free_cap_reached" };
   }
 }
-function useInstallWrapper(rawArgs, config, opts, exit) {
+function useInstallWrapper(rawArgs, config, opts, handoff) {
   const [state, dispatch] = (0, import_react37.useReducer)(reducer4, { phase: "resolving", count: 0 });
   const started = (0, import_react37.useRef)(false);
   const parsedRef = (0, import_react37.useRef)(opts.parseArgs(rawArgs));
   const pendingInstall = (0, import_react37.useRef)(null);
   const rejectRef = (0, import_react37.useRef)(null);
+  const ho = handoff ?? { install: null };
+  const requestInstall = (args, line) => {
+    ho.install = { run: opts.runInstall, args };
+    dispatch({ type: "INSTALLING", line });
+  };
   const confirmInstall = () => {
     if (pendingInstall.current) {
       pendingInstall.current();
@@ -51778,18 +51853,14 @@ function useInstallWrapper(rawArgs, config, opts, exit) {
     (async () => {
       try {
         if (!parsed.shouldScan) {
-          dispatch({ type: "PASSTHROUGH" });
-          const code = await opts.runInstall(parsed.rawArgs);
-          dispatch({ type: "DONE", exitCode: code });
+          requestInstall(parsed.rawArgs, null);
           return;
         }
         let specs;
         if (parsed.packages.length === 0) {
           specs = opts.inferSpecsFromContext(parsed);
           if (specs.length === 0) {
-            dispatch({ type: "PASSTHROUGH" });
-            const code = await opts.runInstall(parsed.rawArgs);
-            dispatch({ type: "DONE", exitCode: code });
+            requestInstall(parsed.rawArgs, null);
             return;
           }
         } else {
@@ -51798,9 +51869,7 @@ function useInstallWrapper(rawArgs, config, opts, exit) {
         dispatch({ type: "RESOLVING", count: specs.length });
         const { resolved } = await opts.resolvePackages(specs);
         if (resolved.length === 0) {
-          dispatch({ type: "PASSTHROUGH" });
-          const code = await opts.runInstall(parsed.rawArgs);
-          dispatch({ type: "DONE", exitCode: code });
+          requestInstall(parsed.rawArgs, null);
           return;
         }
         const isRequirementsInstall = opts.ecosystem === "pypi" && (parsed.rawArgs.includes("-r") || parsed.rawArgs.includes("--requirement"));
@@ -51810,7 +51879,6 @@ function useInstallWrapper(rawArgs, config, opts, exit) {
             message: `A -r requirements install cannot be pinned to the exact scanned versions; refusing in ${config.strict ? "--strict" : "--mode block"} (resolve\u2192install mismatch risk). Use --mode warn or --dg-force to bypass.`,
             proceed: false
           });
-          dispatch({ type: "DONE", exitCode: 2 });
           return;
         }
         const pinnedArgs = isRequirementsInstall ? parsed.rawArgs : opts.ecosystem === "npm" ? pinTopLevelArgs(parsed.rawArgs, parsed.packages, resolved) : pinPipArgs(parsed.rawArgs, parsed.packages, resolved);
@@ -51830,114 +51898,61 @@ function useInstallWrapper(rawArgs, config, opts, exit) {
               message: `Could not enumerate the dependency tree (${tree.errorMessage ?? "dry-run produced no tree"}); transitive deps would install unscanned. Install aborted in ${config.strict ? "--strict" : "--mode block"}. Use --dg-force to bypass.`,
               proceed: false
             });
-            dispatch({ type: "DONE", exitCode: 2 });
             return;
           }
         }
         dispatch({ type: "SCANNING", count: scanSet.length });
         const result = await opts.callAnalyze(scanSet, config);
-        if (result.action === "pass") {
-          if (exit) exit();
-          const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
-          const line = formatPassLine(result, chalk18);
-          process.stderr.write("  " + line + "\n\n");
-          const code = await opts.runInstall(installArgs);
-          process.exit(code);
+        const decision = routeVerdict({
+          verdict: verdictFromResult(result),
+          mode: config.mode,
+          strict: config.strict,
+          dgForce: parsed.dgForce
+        });
+        if (decision.outcome === "refuse") {
+          const cmd = `${opts.ecosystem === "npm" ? "npm" : "pip"} ${parsed.rawArgs.join(" ")} --dg-force`;
+          const v = decision.verdict === "analysis_incomplete" ? "incomplete" : decision.verdict === "block" ? "block" : "warn";
+          dispatch({ type: "REFUSED", result, verdict: v, cmd, exitCode: decision.refuseExitCode });
           return;
         }
-        if (result.action === "warn") {
-          if (parsed.dgForce) {
-            const { recordBypassLocally: recordBypassLocally2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-            recordBypassLocally2({
-              ecosystem: opts.ecosystem,
-              verdict: "warn",
-              trigger: "dg-force",
-              reason: parsed.dgForceReason,
-              packages: result.packages.map((p) => ({ name: p.name, version: p.version, score: p.score }))
-            });
-            dispatch({ type: "WARN", result, dgForce: true });
-            dispatch({ type: "INSTALLING" });
-            const code = await opts.runInstall(installArgs);
-            dispatch({ type: "DONE", exitCode: code });
-            return;
-          }
-          dispatch({ type: "WARN", result, dgForce: false });
-          const shouldProceed = await new Promise((resolve3) => {
-            pendingInstall.current = () => resolve3(true);
-            rejectRef.current = () => resolve3(false);
+        const recordBypass = async (trigger) => {
+          const { recordBypassLocally: recordBypassLocally2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
+          recordBypassLocally2({
+            ecosystem: opts.ecosystem,
+            verdict: decision.verdict === "block" ? "block" : "warn",
+            trigger,
+            packages: result.packages.map((p) => ({ name: p.name, version: p.version, score: p.score }))
           });
-          if (shouldProceed) {
-            const { recordBypassLocally: recordBypassLocally2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-            recordBypassLocally2({
-              ecosystem: opts.ecosystem,
-              verdict: "warn",
-              trigger: "interactive-confirm",
-              packages: result.packages.map((p) => ({ name: p.name, version: p.version, score: p.score }))
-            });
-            dispatch({ type: "INSTALLING" });
-            const code = await opts.runInstall(installArgs);
-            dispatch({ type: "DONE", exitCode: code });
-          } else {
-            dispatch({ type: "DONE", exitCode: 1 });
-          }
-          return;
-        }
-        if (result.action === "block") {
-          if (parsed.dgForce) {
-            const { recordBypassLocally: recordBypassLocally2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-            recordBypassLocally2({
-              ecosystem: opts.ecosystem,
-              verdict: "block",
-              trigger: "dg-force",
-              reason: parsed.dgForceReason,
-              packages: result.packages.map((p) => ({ name: p.name, version: p.version, score: p.score }))
-            });
-            dispatch({ type: "BLOCKED", result, dgForce: true });
-            dispatch({ type: "INSTALLING" });
-            const code = await opts.runInstall(installArgs);
-            dispatch({ type: "DONE", exitCode: code });
-            return;
-          }
-          dispatch({ type: "BLOCKED", result, dgForce: false });
-          const shouldProceed = await new Promise((resolve3) => {
+        };
+        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
+        const top = result.packages.length === 1 ? result.packages[0] : null;
+        const name = top ? `${top.name}@${top.version}` : `${result.packages.length} packages`;
+        const pinnedLine = (() => {
+          if (decision.bypassed) {
+            const sig = decision.verdict === "block" ? chalk18.red("\u2718") : chalk18.yellow("\u26A0");
+            return `  ${sig} ${name} ${chalk18.dim(`(${decision.verdict}) \u2014 --dg-force override, installing`)}`;
+          }
+          if (decision.verdict === "analysis_incomplete") return `  ${chalk18.cyan("?")} ${name} ${chalk18.dim("\u2014 could not verify; proceeding")}`;
+          if (decision.verdict === "pass") return `  ${chalk18.green("\u2713")} ${name} ${chalk18.dim("\u2014 clean")}`;
+          return null;
+        })();
+        if (decision.outcome === "prompt") {
+          dispatch({ type: "WARN", result });
+          const accepted = await new Promise((resolve3) => {
             pendingInstall.current = () => resolve3(true);
             rejectRef.current = () => resolve3(false);
           });
-          if (shouldProceed) {
-            const { recordBypassLocally: recordBypassLocally2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
-            recordBypassLocally2({
-              ecosystem: opts.ecosystem,
-              verdict: "block",
-              trigger: "interactive-confirm",
-              packages: result.packages.map((p) => ({ name: p.name, version: p.version, score: p.score }))
-            });
-            dispatch({ type: "INSTALLING" });
-            const code = await opts.runInstall(installArgs);
-            dispatch({ type: "DONE", exitCode: code });
-          } else {
-            dispatch({ type: "DONE", exitCode: 2 });
-          }
-          return;
-        }
-        {
-          const refuseHard = config.mode === "block" || config.strict;
-          const baseMsg = "DG could not fully analyze the install set (analysis incomplete).";
-          if (refuseHard && !parsed.dgForce) {
-            dispatch({
-              type: "INCOMPLETE",
-              result,
-              proceed: false,
-              message: `${baseMsg} Refusing install in ${config.strict ? "--strict" : "--mode block"} \u2014 unverified is not safe. Use --mode warn or --dg-force to bypass.`
-            });
-            dispatch({ type: "DONE", exitCode: 4 });
+          if (!accepted) {
+            dispatch({ type: "DECLINED", line: `  ${chalk18.yellow("\u2717")} ${name} ${chalk18.dim("\u2014 not installed")}`, exitCode: decision.refuseExitCode });
             return;
           }
-          dispatch({ type: "INCOMPLETE", result, proceed: true, message: baseMsg });
-          dispatch({ type: "INSTALLING" });
-          const code = await opts.runInstall(installArgs);
-          dispatch({ type: "DONE", exitCode: code });
+          await recordBypass("interactive-confirm");
+          requestInstall(installArgs, null);
           return;
         }
+        if (decision.bypassed) await recordBypass("dg-force");
+        requestInstall(decision.outcome === "passthrough" ? parsed.rawArgs : installArgs, pinnedLine);
+        return;
       } catch (error) {
         if (error instanceof FreeCapReachedError) {
           dispatch({ type: "FREE_CAP_REACHED" });
@@ -51950,27 +51965,17 @@ function useInstallWrapper(rawArgs, config, opts, exit) {
             message: `Scan failed (${message}) and --mode is block. Install aborted. Use --dg-force to bypass.`,
             proceed: false
           });
-          dispatch({ type: "DONE", exitCode: 2 });
           return;
         }
-        dispatch({ type: "ERROR", message, proceed: true });
-        dispatch({ type: "INSTALLING" });
-        const code = await opts.runInstall(installArgs);
-        dispatch({ type: "DONE", exitCode: code });
+        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
+        requestInstall(installArgs, `  ${chalk18.yellow("\u26A0")} ${chalk18.dim(`scan failed (${message}); proceeding`)}`);
       }
     })();
   }, [rawArgs, config]);
   return { state, confirmInstall, rejectInstall };
 }
-function formatPassLine(result, chalk18) {
-  if (result.packages.length === 1) {
-    const p = result.packages[0];
-    return chalk18.green("\u2713 ") + `${p.name}@${p.version}` + chalk18.dim(" \u2014 clean. Installing.");
-  }
-  return chalk18.green("\u2713 ") + `${result.packages.length} packages` + chalk18.dim(" \u2014 all clean. Installing.");
-}
-function useWrapper(args, config, ecosystem, exit) {
-  return useInstallWrapper(args, config, ecosystem === "npm" ? NPM_OPTIONS : PIP_OPTIONS, exit);
+function useWrapper(args, config, ecosystem, handoff) {
+  return useInstallWrapper(args, config, ecosystem === "npm" ? NPM_OPTIONS : PIP_OPTIONS, handoff);
 }
 var import_react37, NPM_OPTIONS, PIP_OPTIONS;
 var init_useWrapperBase = __esm({
@@ -51979,6 +51984,8 @@ var init_useWrapperBase = __esm({
     import_react37 = __toESM(require_react(), 1);
     init_client();
     init_wrapper_shared();
+    init_route();
+    init_run();
     init_npm_wrapper();
     init_pip_wrapper();
     NPM_OPTIONS = {
@@ -51986,7 +51993,7 @@ var init_useWrapperBase = __esm({
       resolvePackages,
       resolveTree: resolveTreeNpm,
       callAnalyze: callAnalyzeAPI,
-      runInstall: runNpm,
+      runInstall: (args) => runNpm(args, { trim: true }),
       inferSpecsFromContext: () => readBareInstallPackages(process.cwd()),
       ecosystem: "npm"
     };
@@ -51995,7 +52002,7 @@ var init_useWrapperBase = __esm({
       resolvePackages: resolvePackages2,
       resolveTree: resolveTreePip,
       callAnalyze: callPyPIAnalyzeAPI,
-      runInstall: runPip,
+      runInstall: (args) => runPip(args, { trim: true }),
       inferSpecsFromContext: (parsed) => {
         const file = parsed.requirementsFile;
         return file ? parseRequirementsFile(file) : [];
@@ -52177,6 +52184,7 @@ var init_ConfirmPrompt = __esm({
           onReject();
         }
       });
+      if (!message) return null;
       return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(Box_default, { flexDirection: "column", children: [
         /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(Text, { children: [
           import_chalk17.default.red.bold("\u26A0"),
@@ -52232,7 +52240,8 @@ var init_WrapperVerdictLine = __esm({
     WrapperVerdictLine = ({
       result,
       verdict,
-      dgForce
+      dgForce,
+      refusal
     }) => {
       const total = result.packages.length;
       const counts = countSummary(result);
@@ -52258,12 +52267,13 @@ var init_WrapperVerdictLine = __esm({
           /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { dimColor: true, children: " \u2014 all clean. Installing." })
         ] });
       }
-      const sigil = verdict === "block" ? "\u2718" : "\u26A0";
-      const color = verdict === "block" ? "red" : "yellow";
+      const sigil = verdict === "block" ? "\u2718" : verdict === "incomplete" ? "?" : "\u26A0";
+      const color = verdict === "block" ? "red" : verdict === "incomplete" ? "cyan" : "yellow";
       const prompt = verdict === "block" ? "install anyway?" : "install?";
       if (total === 1) {
         const p = topPackage(result);
         const score = p ? p.score : result.score;
+        const meta = verdict === "incomplete" ? `(could not verify)${reasonTag(p)}` : `(${verdict}, score ${score})${reasonTag(p)}`;
         return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Box_default, { flexDirection: "row", children: [
           /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { color, children: [
             sigil,
@@ -52274,18 +52284,23 @@ var init_WrapperVerdictLine = __esm({
             "@",
             p?.version
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { dimColor: true, children: [
-            " (",
-            verdict,
-            ", score ",
-            score,
-            ")",
-            reasonTag(p),
-            " \u2014 "
-          ] }),
-          dgForce ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color, bold: true, children: "--dg-force: bypassing. Installing." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { bold: true, children: [
-            prompt,
-            " [y/N]"
+          refusal ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { dimColor: true, children: [
+            " ",
+            meta
+          ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { dimColor: true, children: [
+              " ",
+              meta,
+              " \u2014 "
+            ] }),
+            dgForce ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color, bold: true, children: "--dg-force: bypassing. Installing." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { bold: true, children: [
+              prompt,
+              " [",
+              /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color: "green", children: "y" }),
+              "/",
+              /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color: "red", children: "N" }),
+              "]"
+            ] })
           ] })
         ] });
       }
@@ -52303,14 +52318,23 @@ var init_WrapperVerdictLine = __esm({
           total,
           " packages"
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { dimColor: true, children: [
+        refusal ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { dimColor: true, children: [
           ": ",
-          parts.join(", "),
-          " \u2014 "
-        ] }),
-        dgForce ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color, bold: true, children: "--dg-force: bypassing. Installing." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { bold: true, children: [
-          prompt,
-          " [y/N]  [d] details"
+          parts.join(", ")
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { dimColor: true, children: [
+            ": ",
+            parts.join(", "),
+            " \u2014 "
+          ] }),
+          dgForce ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color, bold: true, children: "--dg-force: bypassing. Installing." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { bold: true, children: [
+            prompt,
+            " [",
+            /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color: "green", children: "y" }),
+            "/",
+            /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Text, { color: "red", children: "N" }),
+            "]  [d] details"
+          ] })
         ] })
       ] });
     };
@@ -52348,21 +52372,30 @@ var init_WrapperApp = __esm({
         installing: "Installing with pip..."
       }
     };
-    WrapperApp = ({ args, config, ecosystem }) => {
+    WrapperApp = ({ args, config, ecosystem, handoff }) => {
       const { exit } = use_app_default();
-      const { state, confirmInstall, rejectInstall } = useWrapper(args, config, ecosystem, exit);
+      const { state, confirmInstall, rejectInstall } = useWrapper(args, config, ecosystem, handoff);
       const [showDetails, setShowDetails] = (0, import_react38.useState)(false);
       use_input_default((input) => {
-        if (input === "d" && (state.phase === "warn" || state.phase === "blocked")) {
+        if (input === "d" && state.phase === "warn") {
           setShowDetails((v) => !v);
         }
       });
       (0, import_react38.useEffect)(() => {
-        if (state.phase === "done") {
+        if (state.phase === "done" || state.phase === "refused" || state.phase === "declined") {
           process.exitCode = state.exitCode;
           const timer = setTimeout(() => exit(), 0);
           return () => clearTimeout(timer);
         }
+        if (state.phase === "installing") {
+          const timer = setTimeout(() => exit(), 0);
+          return () => clearTimeout(timer);
+        }
+        if (state.phase === "error") {
+          process.exitCode = 2;
+          const timer = setTimeout(() => exit(), 0);
+          return () => clearTimeout(timer);
+        }
         if (state.phase === "free_cap_reached") {
           process.exitCode = 1;
           const timer = setTimeout(() => exit(), 0);
@@ -52377,43 +52410,30 @@ var init_WrapperApp = __esm({
           return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Spinner2, { label: labels.resolving(state.count, state.count !== 1 ? "s" : "") });
         case "scanning":
           return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Spinner2, { label: labels.scanning(state.count, state.count !== 1 ? "s" : "") });
-        case "pass":
-          return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(WrapperVerdictLine, { result: state.result, verdict: "pass" });
         case "warn":
           return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(Box_default, { flexDirection: "column", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(WrapperVerdictLine, { result: state.result, verdict: "warn", dgForce: state.dgForce }),
+            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(WrapperVerdictLine, { result: state.result, verdict: "warn" }),
             showDetails && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Box_default, { marginTop: 1, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ResultsView, { result: state.result, config, durationMs: state.result.durationMs }) }),
-            !state.dgForce && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ConfirmPrompt, { message: "", onConfirm: handleConfirm, onReject: handleReject })
+            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ConfirmPrompt, { message: "", onConfirm: handleConfirm, onReject: handleReject })
           ] });
-        case "blocked":
+        case "refused":
           return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(Box_default, { flexDirection: "column", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(WrapperVerdictLine, { result: state.result, verdict: "block", dgForce: state.dgForce }),
-            showDetails && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Box_default, { marginTop: 1, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ResultsView, { result: state.result, config, durationMs: state.result.durationMs }) }),
-            !state.dgForce && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ConfirmPrompt, { message: "", onConfirm: handleConfirm, onReject: handleReject })
+            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(WrapperVerdictLine, { result: state.result, verdict: state.verdict, refusal: true }),
+            /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(Text, { dimColor: true, children: [
+              "  install anyway: ",
+              state.cmd
+            ] })
           ] });
-        case "incomplete":
-          if (state.proceed) {
-            return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(Text, { color: "yellow", children: [
-              state.message,
-              " Proceeding with install."
-            ] });
-          }
-          return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ErrorView, { error: new Error(state.message) });
+        case "declined":
+          return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Text, { children: state.line });
+        // The verdict line is Ink's final frame; it stays on screen after unmount and
+        // the installer's (trimmed) output is printed under it by bin.ts.
         case "installing":
-          return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Spinner2, { label: labels.installing });
+          return state.line ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Text, { children: state.line }) : null;
         case "done":
           return null;
         case "error":
-          if (state.proceed) {
-            return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(Text, { color: "yellow", children: [
-              "Warning: Scan failed (",
-              state.message,
-              "). Proceeding with install."
-            ] });
-          }
           return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ErrorView, { error: new Error(state.message) });
-        case "passthrough":
-          return null;
         case "free_cap_reached": {
           let hasKey = false;
           try {
@@ -52449,9 +52469,9 @@ __export(conda_wrapper_exports, {
   adapter: () => adapter,
   runStaticConda: () => runStaticConda
 });
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 function parseCondaArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS3.has(command);
   const packages = [];
@@ -52470,7 +52490,6 @@ function parseCondaArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -52504,7 +52523,7 @@ async function runStaticConda(args, ecosystem, config) {
     return 127;
   }
   return await new Promise((resolve3) => {
-    const child = spawn5(real, parsed.rawArgs, { stdio: "inherit", env: childInstallEnv() });
+    const child = spawn6(real, parsed.rawArgs, { stdio: "inherit", env: childInstallEnv() });
     child.on("close", (code) => resolve3(code ?? 1));
     child.on("error", () => resolve3(1));
   });
@@ -52551,7 +52570,7 @@ function pnpmFlagTakesValue(flag) {
   return valueFlagPrefixes.includes(flag);
 }
 function parsePnpmArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS4.has(command);
   const packages = [];
@@ -52570,7 +52589,6 @@ function parsePnpmArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -52649,7 +52667,7 @@ function yarnFlagTakesValue(flag) {
   return valueFlagPrefixes.includes(flag);
 }
 function parseYarnArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS5.has(command);
   const packages = [];
@@ -52668,7 +52686,6 @@ function parseYarnArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -52748,7 +52765,7 @@ function bunFlagTakesValue(flag) {
   return valueFlagPrefixes.includes(flag);
 }
 function parseBunArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS6.has(command);
   const packages = [];
@@ -52767,7 +52784,6 @@ function parseBunArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -52854,7 +52870,7 @@ function uvFlagTakesValue(flag) {
   return valueFlagPrefixes.includes(flag);
 }
 function parseUvArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const first = filtered[0] ?? "";
   let command = "";
   let argStart = 1;
@@ -52903,7 +52919,6 @@ function parseUvArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -52915,7 +52930,6 @@ async function resolveTopLevel5(parsed) {
     if (at <= 0) return s;
     return `${s.slice(0, at)}==${s.slice(at + 1)}`;
   });
-  void parsePipSpec;
   return await resolvePackages2(normalized);
 }
 async function resolveTransitive4(parsed) {
@@ -52966,7 +52980,7 @@ function pipxFlagTakesValue(flag) {
   return valueFlagPrefixes.includes(flag);
 }
 function parsePipxArgs(args) {
-  const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
+  const { filtered, dgForce, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
   const shouldScan = INSTALL_COMMANDS7.has(command) && command !== "upgrade-all";
   const packages = [];
@@ -52989,7 +53003,6 @@ function parsePipxArgs(args) {
     packages,
     rawArgs: filtered,
     dgForce,
-    dgForceReason,
     dgNoScripts,
     shouldScan
   };
@@ -53043,11 +53056,7 @@ var wrapper_factory_exports = {};
 __export(wrapper_factory_exports, {
   runEcosystemWrapper: () => runEcosystemWrapper
 });
-import { spawn as spawn6 } from "node:child_process";
-function emitJson(config, result) {
-  if (!config.json) return;
-  process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-}
+import { spawn as spawn7 } from "node:child_process";
 function shimSentinelEnv3() {
   return childInstallEnv();
 }
@@ -53059,7 +53068,7 @@ async function spawnRealBinary(adapter7, args) {
     return 127;
   }
   return await new Promise((resolve3) => {
-    const child = spawn6(real, args, { stdio: "inherit", env: shimSentinelEnv3() });
+    const child = spawn7(real, args, { stdio: "inherit", env: shimSentinelEnv3() });
     child.on("close", (code) => resolve3(code ?? 1));
     child.on("error", () => resolve3(1));
   });
@@ -53110,7 +53119,7 @@ async function runEcosystemWrapper(adapter7, args, config) {
 `)
       );
     }
-    emitJson(config, {
+    emitWrapperJson(config, {
       ecosystem: adapter7.ecosystem,
       packages: [],
       scanVerdict: "scan_failed",
@@ -53167,7 +53176,7 @@ async function runEcosystemWrapper(adapter7, args, config) {
 `)
       );
     }
-    emitJson(config, {
+    emitWrapperJson(config, {
       ecosystem: adapter7.ecosystem,
       packages: [],
       scanVerdict: "scan_failed",
@@ -53198,7 +53207,7 @@ async function runEcosystemWrapper(adapter7, args, config) {
 
 `)
       );
-      emitJson(config, {
+      emitWrapperJson(config, {
         ecosystem: adapter7.ecosystem,
         packages: [],
         scanVerdict: "scan_failed",
@@ -53215,7 +53224,7 @@ async function runEcosystemWrapper(adapter7, args, config) {
 
 `)
       );
-      emitJson(config, {
+      emitWrapperJson(config, {
         ecosystem: adapter7.ecosystem,
         packages: [],
         scanVerdict: "scan_failed",
@@ -53231,184 +53240,152 @@ async function runEcosystemWrapper(adapter7, args, config) {
 `)
       );
     }
-    const code2 = await spawnRealBinary(adapter7, installArgs);
-    emitJson(config, {
+    const code = await spawnRealBinary(adapter7, installArgs);
+    emitWrapperJson(config, {
       ecosystem: adapter7.ecosystem,
       packages: [],
       scanVerdict: "scan_failed",
       installRan: true,
-      installExitCode: code2,
+      installExitCode: code,
       error: { code: "scan_failed", message: err.message }
     });
-    return code2;
+    return code;
   }
   const allowlist = loadAllowlist(process.cwd());
   const { result: filteredResult, suppressedCount } = applyAllowlist(allowlist, result, adapter7.apiKind);
   result = filteredResult;
   const topLevelNames = new Set(resolved.map((p) => p.name));
-  if (result.action === "pass") {
-    const topLevel = resolved.map((p) => `${p.name} ${p.version}`);
-    const passLine = topLevel.length === 1 ? `  ${import_chalk19.default.green("\u2713")} ${import_chalk19.default.bold("DG verified:")} ${topLevel[0]} is safe` : `  ${import_chalk19.default.green("\u2713")} ${import_chalk19.default.bold("DG verified:")} ${topLevel.length} packages safe`;
-    const installLine = topLevel.length === 1 ? `  ${import_chalk19.default.green("\u2713")} Installing ${topLevel[0]}` : `  ${import_chalk19.default.green("\u2713")} Installing ${topLevel.join(", ")}`;
-    if (!config.json && !config.quiet) {
-      process.stderr.write(`${passLine}
+  const verdict = verdictFromResult(result);
+  const decision = routeVerdict({
+    verdict,
+    mode: config.mode,
+    strict: config.strict,
+    dgForce: parsed.dgForce
+  });
+  const ctx = {
+    ecosystem: adapter7.ecosystem,
+    apiKind: adapter7.apiKind,
+    installArgs,
+    passthroughArgs: parsed.rawArgs,
+    result,
+    resolved,
+    suppressedCount,
+    error: verdict === "analysis_incomplete" && decision.outcome === "refuse" ? { code: "analysis_incomplete", message: "scanner could not fully analyze the install set" } : void 0
+  };
+  const presenter = {
+    announce(d) {
+      switch (d.verdict) {
+        case "pass": {
+          if (config.json || config.quiet) return;
+          const topLevel = resolved.map((p) => `${p.name} ${p.version}`);
+          const passLine = topLevel.length === 1 ? `  ${import_chalk19.default.green("\u2713")} ${import_chalk19.default.bold("DG verified:")} ${topLevel[0]} is safe` : `  ${import_chalk19.default.green("\u2713")} ${import_chalk19.default.bold("DG verified:")} ${topLevel.length} packages safe`;
+          const installLine = topLevel.length === 1 ? `  ${import_chalk19.default.green("\u2713")} Installing ${topLevel[0]}` : `  ${import_chalk19.default.green("\u2713")} Installing ${topLevel.join(", ")}`;
+          process.stderr.write(`${passLine}
 ${installLine}
 `);
-      if (suppressedCount > 0) {
-        process.stderr.write(import_chalk19.default.dim(`  (${suppressedCount} finding${suppressedCount === 1 ? "" : "s"} suppressed by .dg-allowlist.json)
+          if (suppressedCount > 0) {
+            process.stderr.write(import_chalk19.default.dim(`  (${suppressedCount} finding${suppressedCount === 1 ? "" : "s"} suppressed by .dg-allowlist.json)
 `));
-      }
-      process.stderr.write("\n");
-    }
-    const code2 = await spawnRealBinary(adapter7, installArgs);
-    emitJson(config, {
-      ecosystem: adapter7.ecosystem,
-      packages: packagesFromResult(result, topLevelNames),
-      scanVerdict: "pass",
-      installRan: true,
-      installExitCode: code2,
-      suppressedByAllowlist: suppressedCount > 0 ? suppressedCount : void 0
-    });
-    return code2;
-  }
-  if (result.action === "warn") {
-    if (!config.json && !config.quiet) {
-      const topLevelList = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-      process.stderr.write(`  ${import_chalk19.default.yellow("\u26A0")} ${import_chalk19.default.bold("DG flagged")} ${topLevelList}.
+          }
+          process.stderr.write("\n");
+          return;
+        }
+        case "warn": {
+          if (config.json || config.quiet) return;
+          const topLevelList = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
+          process.stderr.write(`  ${import_chalk19.default.yellow("\u26A0")} ${import_chalk19.default.bold("DG flagged")} ${topLevelList}.
 `);
-      const blockedPkgs = result.packages.filter((p) => derivePackageActionPublic(p) === "warn");
-      for (const p of blockedPkgs.slice(0, 5)) {
-        if (p.findings && p.findings.length > 0) {
-          for (const f of p.findings.slice(0, 3)) {
-            process.stderr.write(import_chalk19.default.dim(`    \u2022 ${f.title ?? "finding"}
+          const flaggedPkgs = result.packages.filter((p) => derivePackageActionPublic(p) === "warn");
+          for (const p of flaggedPkgs.slice(0, 5)) {
+            if (p.findings && p.findings.length > 0) {
+              for (const f of p.findings.slice(0, 3)) {
+                process.stderr.write(import_chalk19.default.dim(`    \u2022 ${f.title ?? "finding"}
+`));
+              }
+            }
+          }
+          if (suppressedCount > 0) {
+            process.stderr.write(import_chalk19.default.dim(`  (${suppressedCount} additional finding${suppressedCount === 1 ? "" : "s"} suppressed by .dg-allowlist.json)
 `));
           }
+          return;
         }
-      }
-      if (suppressedCount > 0) {
-        process.stderr.write(import_chalk19.default.dim(`  (${suppressedCount} additional finding${suppressedCount === 1 ? "" : "s"} suppressed by .dg-allowlist.json)
+        case "block": {
+          if (d.outcome === "install") {
+            if (!config.json && !config.quiet) {
+              process.stderr.write(import_chalk19.default.yellow.bold(`  --dg-force: bypassing block. Install at your own risk.
+
 `));
+            }
+          } else if (!config.json) {
+            const blockedList = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
+            process.stderr.write(
+              `  ${import_chalk19.default.red("\u2717")} ${import_chalk19.default.bold("DG blocked")} ${blockedList}.
+  ${import_chalk19.default.dim(`install anyway: ${adapter7.realBinaryName} ${parsed.rawArgs.join(" ")} --dg-force`)}
+
+`
+            );
+          }
+          return;
+        }
+        case "analysis_incomplete": {
+          const list = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
+          if (d.outcome === "refuse") {
+            if (!config.json) {
+              process.stderr.write(
+                `  ${import_chalk19.default.cyan("?")} ${import_chalk19.default.bold("DG couldn't verify")} ${list} \u2014 unverified, not safe.
+  ${import_chalk19.default.dim(`install anyway: ${adapter7.realBinaryName} ${parsed.rawArgs.join(" ")} --dg-force`)}
+
+`
+              );
+            }
+          } else if (!config.json && !config.quiet) {
+            process.stderr.write(
+              import_chalk19.default.yellow(`  \u26A0 DG could not fully verify ${list} (analysis incomplete). Proceeding with install (mode=${config.mode}).
+`)
+            );
+          }
+          return;
+        }
+        default:
+          return;
+      }
+    },
+    async confirmProceed() {
+      if (!(process.stderr.isTTY && !process.env.CI && !config.json)) {
+        if (!config.json && !config.quiet) process.stderr.write(import_chalk19.default.dim("  Proceeding (non-interactive).\n"));
+        return true;
       }
-    }
-    if (process.stderr.isTTY && !process.env.CI && !config.json) {
       const { promptYesNo: promptYesNo2 } = await Promise.resolve().then(() => (init_prompt(), prompt_exports));
       const proceed = await promptYesNo2({ defaultAnswer: "y", message: "  Proceed?" });
-      if (!proceed) {
-        process.stderr.write(import_chalk19.default.dim("  Install cancelled by user.\n\n"));
-        emitJson(config, {
-          ecosystem: adapter7.ecosystem,
-          packages: packagesFromResult(result, topLevelNames),
-          scanVerdict: "warn",
-          installRan: false,
-          installExitCode: null
-        });
-        return 1;
-      }
-    } else if (!config.json && !config.quiet) {
-      process.stderr.write(import_chalk19.default.dim("  Proceeding (non-interactive).\n"));
-    }
-    const code2 = await spawnRealBinary(adapter7, installArgs);
-    emitJson(config, {
-      ecosystem: adapter7.ecosystem,
-      packages: packagesFromResult(result, topLevelNames),
-      scanVerdict: "warn",
-      installRan: true,
-      installExitCode: code2,
-      suppressedByAllowlist: suppressedCount > 0 ? suppressedCount : void 0
-    });
-    return code2;
-  }
-  if (result.action === "block") {
-    if (parsed.dgForce) {
+      if (!proceed) process.stderr.write(import_chalk19.default.dim("  Install cancelled by user.\n\n"));
+      return proceed;
+    },
+    runInstall: (args2) => spawnRealBinary(adapter7, args2),
+    async audit(kind) {
       try {
         await dispatchInstallAudit({
           ecosystem: adapter7.apiKind,
           packages: result.packages,
-          decisionAction: "override",
-          bypassed: true,
-          bypassReason: parsed.dgForceReason
+          decisionAction: kind,
+          bypassed: kind === "override"
         });
       } catch {
       }
-      if (!config.json && !config.quiet) {
-        process.stderr.write(import_chalk19.default.yellow.bold(`  --dg-force: bypassing block. Install at your own risk.
-
-`));
-      }
-      const code2 = await spawnRealBinary(adapter7, installArgs);
-      emitJson(config, {
+    },
+    emit(record) {
+      emitWrapperJson(config, {
         ecosystem: adapter7.ecosystem,
         packages: packagesFromResult(result, topLevelNames),
-        scanVerdict: "override",
-        installRan: true,
-        installExitCode: code2
+        scanVerdict: record.scanVerdict,
+        installRan: record.installRan,
+        installExitCode: record.installExitCode,
+        error: record.error,
+        suppressedByAllowlist: record.suppressedByAllowlist
       });
-      return code2;
-    }
-    try {
-      await dispatchInstallAudit({
-        ecosystem: adapter7.apiKind,
-        packages: result.packages,
-        decisionAction: "block",
-        bypassed: false
-      });
-    } catch {
-    }
-    const blockedList = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-    if (!config.json) {
-      process.stderr.write(
-        `  ${import_chalk19.default.red("\u2717")} ${import_chalk19.default.bold("DG blocked")} ${blockedList}.
-  Real install was NOT run. To override:
-` + import_chalk19.default.dim(`    ${adapter7.realBinaryName} ${parsed.rawArgs.join(" ")} --dg-force --dg-force-reason="<reason>"
-
-`)
-      );
-    }
-    emitJson(config, {
-      ecosystem: adapter7.ecosystem,
-      packages: packagesFromResult(result, topLevelNames),
-      scanVerdict: "block",
-      installRan: false,
-      installExitCode: null
-    });
-    return 2;
-  }
-  const refuseHard = config.mode === "block" || config.strict;
-  const unverifiedList = resolved.map((p) => `${p.name} ${p.version}`).join(", ");
-  if (refuseHard && !parsed.dgForce) {
-    if (!config.json) {
-      process.stderr.write(
-        `  ${import_chalk19.default.red("\u2717")} ${import_chalk19.default.bold("DG could not verify")} ${unverifiedList} \u2014 analysis incomplete.
-` + import_chalk19.default.dim(`  --mode ${config.strict ? "strict" : "block"} \u21D2 refusing install (unverified is not safe). Use --mode warn or --dg-force to bypass.
-
-`)
-      );
     }
-    emitJson(config, {
-      ecosystem: adapter7.ecosystem,
-      packages: packagesFromResult(result, topLevelNames),
-      scanVerdict: "analysis_incomplete",
-      installRan: false,
-      installExitCode: null,
-      error: { code: "analysis_incomplete", message: "scanner could not fully analyze the install set" }
-    });
-    return 4;
-  }
-  if (!config.json && !config.quiet) {
-    process.stderr.write(
-      import_chalk19.default.yellow(`  \u26A0 DG could not fully verify ${unverifiedList} (analysis incomplete). Proceeding with install (mode=${config.mode}).
-`)
-    );
-  }
-  const code = await spawnRealBinary(adapter7, installArgs);
-  emitJson(config, {
-    ecosystem: adapter7.ecosystem,
-    packages: packagesFromResult(result, topLevelNames),
-    scanVerdict: "analysis_incomplete",
-    installRan: true,
-    installExitCode: code
-  });
-  return code;
+  };
+  return await executeDecision(decision, ctx, presenter);
 }
 var import_chalk19;
 var init_wrapper_factory = __esm({
@@ -53423,6 +53400,9 @@ var init_wrapper_factory = __esm({
     init_wrapper_shared();
     init_npm_wrapper();
     init_pip_wrapper();
+    init_route();
+    init_run();
+    init_json();
   }
 });
 
@@ -53675,8 +53655,6 @@ async function main() {
     }
     if (result.action === "block") {
       try {
-        const reasonIdx = args.indexOf("--dg-force-reason");
-        const bypassReason = reasonIdx >= 0 ? args[reasonIdx + 1] : void 0;
         const { dispatchPublishCheckAudit: dispatchPublishCheckAudit2 } = await Promise.resolve().then(() => (init_audit_dispatcher(), audit_dispatcher_exports));
         const at = result.artifact.lastIndexOf("@");
         const pkgName = at > 0 ? result.artifact.slice(0, at) : result.artifact;
@@ -53687,8 +53665,7 @@ async function main() {
           packageVersion: pkgVersion,
           score: result.score,
           decisionAction: force ? "override" : "block",
-          bypassed: !!force,
-          bypassReason
+          bypassed: !!force
         });
       } catch {
       }
@@ -53860,6 +53837,12 @@ async function main() {
     return;
   }
 }
+async function runHandoff(handoff) {
+  if (!handoff.install) {
+    return typeof process.exitCode === "number" ? process.exitCode : 0;
+  }
+  return handoff.install.run(handoff.install.args);
+}
 async function handleWrapInternal(argv) {
   let ecosystem = argv[0];
   if (!ecosystem) {
@@ -53896,9 +53879,9 @@ async function handleWrapInternal(argv) {
   const { isReadonlySubcommand: isReadonlySubcommand2 } = await Promise.resolve().then(() => (init_readonly(), readonly_exports));
   const ecoTyped = ecosystem;
   const spawnReal = async (real, args) => {
-    const { spawn: spawn7 } = await import("node:child_process");
+    const { spawn: spawn8 } = await import("node:child_process");
     const { childInstallEnv: childInstallEnv2 } = await Promise.resolve().then(() => (init_install(), install_exports));
-    const child = spawn7(real, args, { stdio: "inherit", env: childInstallEnv2() });
+    const child = spawn8(real, args, { stdio: "inherit", env: childInstallEnv2() });
     return await new Promise((resolve3) => {
       child.on("close", (code) => resolve3(code ?? 1));
       child.on("error", () => resolve3(1));
@@ -53925,11 +53908,12 @@ async function handleWrapInternal(argv) {
     const { render: render2 } = await init_build2().then(() => build_exports);
     const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
     const { WrapperApp: WrapperApp2 } = await init_WrapperApp().then(() => WrapperApp_exports);
+    const handoff = { install: null };
     const { waitUntilExit } = render2(
-      React22.createElement(WrapperApp2, { config, args: wrapperArgs, ecosystem: "npm" })
+      React22.createElement(WrapperApp2, { config, args: wrapperArgs, ecosystem: "npm", handoff })
     );
     await waitUntilExit();
-    return 0;
+    return runHandoff(handoff);
   }
   if (ecosystem === "pip" || ecosystem === "pip3") {
     if (config.json || !process.stdout.isTTY) {
@@ -53940,11 +53924,12 @@ async function handleWrapInternal(argv) {
     const { render: render2 } = await init_build2().then(() => build_exports);
     const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
     const { WrapperApp: WrapperApp2 } = await init_WrapperApp().then(() => WrapperApp_exports);
+    const handoff = { install: null };
     const { waitUntilExit } = render2(
-      React22.createElement(WrapperApp2, { config, args: wrapperArgs, ecosystem: "pypi" })
+      React22.createElement(WrapperApp2, { config, args: wrapperArgs, ecosystem: "pypi", handoff })
     );
     await waitUntilExit();
-    return 0;
+    return runHandoff(handoff);
   }
   if (ecosystem === "conda" || ecosystem === "mamba") {
     const { runStaticConda: runStaticConda2 } = await Promise.resolve().then(() => (init_conda_wrapper(), conda_wrapper_exports));