@westbayberry/dg 2.0.10 → 2.1.0

package/dist/scan-ui/components/InteractiveResultsView.js

@@ -5,11 +5,14 @@ import chalk from "chalk";
 import { writeFileSync } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 import { isLoggedIn } from "../shims.js";
+import { packageKey } from "../../decisions/apply.js";
 import { ScoreHeader, COMPACT_ROWS } from "./ScoreHeader.js";
 import { useExpandAnimation } from "../hooks/useExpandAnimation.js";
 import { useTerminalSize } from "../hooks/useTerminalSize.js";
 import { clearScreen } from "../alt-screen.js";
 import { pad, truncate, groupPackages as sharedGroupPackages, formatUsage } from "../format-helpers.js";
+import { provenanceLabel, provenanceDowngradeLine } from "../../presentation/provenance.js";
+const ACK_PREVIEW_LIMIT = 3;
 function groupPackages(packages) {
     return sharedGroupPackages(packages, "fingerprint");
 }
@@ -50,6 +53,19 @@ export function packageBadge(pkg) {
         return { label: "Unverified", color: chalk.yellow };
     return actionBadge(pkg.action);
 }
+export function provenanceMarker(pkg) {
+    const prov = pkg.provenance;
+    if (!prov)
+        return "  ";
+    if (prov.downgrade)
+        return chalk.yellow("◇ ");
+    if (prov.status === "attested")
+        return chalk.dim("◆ ");
+    return "  ";
+}
+function packageDowngradeLine(pkg) {
+    return pkg.provenance ? provenanceDowngradeLine(pkg.version, pkg.provenance) : null;
+}
 const EVIDENCE_LIMIT = 2;
 const BADGE_COL = "Unverified".length + 1;
 // Fixed lines outside the scrollable group area:
@@ -80,6 +96,8 @@ function findingsSummaryHeight(group) {
     let h = 0;
     if (rep.license)
         h += 1;
+    if (packageDowngradeLine(rep))
+        h += 1;
     if (isFree) {
         h += 1;
     }
@@ -140,6 +158,14 @@ function buildDetailLines(group, safeVersion, maxWidth) {
         lines.push(_jsxs(Text, { dimColor: true, children: ["Score: ", rep.score, "/100"] }, "score-info"));
         lines.push(_jsx(Text, { children: "" }, "score-gap"));
     }
+    if (rep.provenance) {
+        lines.push(_jsxs(Text, { dimColor: true, children: ["Provenance: ", provenanceLabel(rep.provenance)] }, "provenance"));
+        const downgrade = packageDowngradeLine(rep);
+        if (downgrade) {
+            lines.push(_jsx(Text, { wrap: "truncate-end", children: chalk.yellow(downgrade) }, "provenance-downgrade"));
+        }
+        lines.push(_jsx(Text, { children: "" }, "provenance-gap"));
+    }
     if (visibleFindings.length > 0) {
         for (let i = 0; i < visibleFindings.length; i++) {
             const f = visibleFindings[i];
@@ -194,7 +220,7 @@ function viewReducer(_state, action) {
             return { ..._state, expandedKey: action.expandedKey, expandLevel: action.expandLevel, viewport: action.viewport };
     }
 }
-export const InteractiveResultsView = ({ result, config: _config, durationMs, onExit, onBack, discoveredTotal, userStatus, scanUsage: scanUsageProp, initialView, }) => {
+export const InteractiveResultsView = ({ result, config: _config, durationMs, onExit, onBack, discoveredTotal, userStatus, scanUsage: scanUsageProp, initialView, decisions, }) => {
     // Prefer the server's uniform usage block ("used / limit packages this
     // month"); fall back to the legacy freeScansRemaining field, then to the
     // generic placeholder from bin.ts. usageNearLimit drives the yellow + nudge.
@@ -212,7 +238,20 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
     const clean = useMemo(() => result.packages.filter((p) => (p.action ?? "pass") === "pass"), [result.packages]);
     const total = result.packages.length;
     const [searchQuery, setSearchQuery] = useState("");
-    const allGroups = useMemo(() => groupPackages(flagged), [flagged]);
+    const ackByKey = useMemo(() => {
+        const map = new Map();
+        if (decisions) {
+            for (const [key, annotation] of Object.entries(decisions.packages)) {
+                if (annotation.acknowledged)
+                    map.set(key, annotation.acknowledged);
+            }
+        }
+        return map;
+    }, [decisions]);
+    const activeFlagged = useMemo(() => flagged.filter((p) => !ackByKey.has(packageKey(p.name, p.version))), [flagged, ackByKey]);
+    const acked = useMemo(() => flagged.filter((p) => ackByKey.has(packageKey(p.name, p.version))), [flagged, ackByKey]);
+    const ackGroups = useMemo(() => groupPackages(acked), [acked]);
+    const allGroups = useMemo(() => groupPackages(activeFlagged), [activeFlagged]);
     const groups = useMemo(() => {
         if (!searchQuery)
             return allGroups;
@@ -223,13 +262,18 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
             if (members.length > 0)
                 matched.push({ packages: members, key: g.key });
         }
+        for (const p of acked) {
+            if (p.name.toLowerCase().includes(q)) {
+                matched.push({ packages: [p], key: `ack|${p.name}@${p.version ?? ""}` });
+            }
+        }
         for (const p of clean) {
             if (p.name.toLowerCase().includes(q)) {
                 matched.push({ packages: [p], key: `pass|${p.name}@${p.version ?? ""}` });
             }
         }
         return matched;
-    }, [allGroups, clean, searchQuery]);
+    }, [allGroups, acked, clean, searchQuery]);
     const matchCount = useMemo(() => groups.reduce((n, g) => n + g.packages.length, 0), [groups]);
     const [view, dispatchView] = useReducer(viewReducer, {
         cursor: 0,
@@ -619,7 +663,10 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
     searchModeRef.current = searchMode;
     const { rows: termRows, cols: termCols } = useTerminalSize();
     const compact = termRows < COMPACT_ROWS;
-    const availableRows = Math.max(5, termRows - (compact ? FIXED_CHROME_COMPACT : FIXED_CHROME));
+    const ackSectionLines = acked.length > 0
+        ? 2 + Math.min(ackGroups.length, ACK_PREVIEW_LIMIT) + (ackGroups.length > ACK_PREVIEW_LIMIT ? 1 : 0)
+        : 0;
+    const availableRows = Math.max(5, termRows - (compact ? FIXED_CHROME_COMPACT : FIXED_CHROME) - ackSectionLines);
     const innerWidth = Math.max(40, termCols - 6);
     const detailGroup = useMemo(() => {
         if (!detailPane)
@@ -1014,7 +1061,7 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
     const aboveCount = view.viewport;
     const belowCount = groups.length - visibleEnd;
     const lcCol = 16; // fixed width for license column
-    const nameCol = Math.max(20, innerWidth - BADGE_COL - 14 - lcCol);
+    const nameCol = Math.max(20, innerWidth - BADGE_COL - 16 - lcCol);
     // Clamp cursor to valid range (groups may shrink via search filter)
     const clampedCursor = groups.length > 0 ? Math.min(view.cursor, groups.length - 1) : 0;
     // ── Export menu overlay ──
@@ -1156,8 +1203,14 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
                                         : (lcInfo.riskCategory === "no-license" || lcInfo.riskCategory === "unlicensed" || lcInfo.riskCategory === "network-copyleft") ? chalk.red
                                             : chalk.yellow;
                                 const arrow = level === "summary" ? "\u25BE" : "\u25B8"; // ▾ expanded, ▸ collapsed
-                                return (_jsxs(Box, { flexDirection: "column", children: [isCursor ? (_jsxs(Text, { backgroundColor: "#1a1a2e", wrap: "truncate-end", children: [chalk.cyan("\u258C"), " ", chalk.cyan(arrow), " ", ` `, color(pad(label, BADGE_COL)), chalk.bold(pad(truncate(names, nameCol - 2), nameCol)), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3)), "  "] })) : (_jsxs(Text, { wrap: "truncate-end", children: [`  ${chalk.dim(arrow)}  `, color(pad(label, BADGE_COL)), pad(truncate(names, nameCol - 2), nameCol), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3))] })), level === "summary" && (_jsx(FindingsSummary, { group: group, maxWidth: innerWidth - 8, maxLines: group.key === view.expandedKey ? animVisibleLines : undefined }))] }, group.key));
-                            }), belowCount > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", belowCount, " more below"] }))] })] })), searchQuery && groups.length === 0 && (_jsx(Text, { dimColor: true, children: `  No packages match "${searchQuery}"` })), !compact && _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [discoveredTotal !== undefined && discoveredTotal > total && (_jsxs(Text, { dimColor: true, children: ["Scanned ", total, " of ", discoveredTotal, " packages"] })), _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { wrap: "truncate-end", children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] })] }), !compact && _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { wrap: "truncate-end", children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("\u2588"), "   ", chalk.dim("Esc clear")] })) : searchQuery ? (_jsxs(Text, { wrap: "truncate-end", children: [" ", chalk.bold.cyan("/"), " ", searchQuery, "   ", chalk.dim(`${matchCount} of ${total} packages`), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("clear"), "   ", chalk.bold.cyan("q"), " ", chalk.dim("quit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] })) : (_jsxs(Text, { wrap: "truncate-end", children: [" ", groups.length > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("\u23CE"), " ", chalk.dim("expand"), "   "] })), total > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("l"), " ", chalk.dim("licenses"), "   ", chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", onBack && _jsxs(_Fragment, { children: [chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   "] }), chalk.bold.cyan("q"), " ", chalk.dim("quit"), "   ", chalk.dim("\u00B7 Ctrl+C or q to exit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] }))] }));
+                                return (_jsxs(Box, { flexDirection: "column", children: [isCursor ? (_jsxs(Text, { backgroundColor: "#1a1a2e", wrap: "truncate-end", children: [chalk.cyan("\u258C"), " ", chalk.cyan(arrow), " ", ` `, color(pad(label, BADGE_COL)), chalk.bold(pad(truncate(names, nameCol - 2), nameCol)), provenanceMarker(rep), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3)), "  "] })) : (_jsxs(Text, { wrap: "truncate-end", children: [`  ${chalk.dim(arrow)}  `, color(pad(label, BADGE_COL)), pad(truncate(names, nameCol - 2), nameCol), provenanceMarker(rep), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3))] })), level === "summary" && (_jsx(FindingsSummary, { group: group, maxWidth: innerWidth - 8, maxLines: group.key === view.expandedKey ? animVisibleLines : undefined }))] }, group.key));
+                            }), belowCount > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", belowCount, " more below"] }))] })] })), searchQuery && groups.length === 0 && (_jsx(Text, { dimColor: true, children: `  No packages match "${searchQuery}"` })), acked.length > 0 && !searchQuery && (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [_jsxs(Text, { bold: true, dimColor: true, children: ["Acknowledged (", acked.length, ") \\u00b7 dg.json"] }), ackGroups.slice(0, ACK_PREVIEW_LIMIT).map((group) => {
+                        const rep = firstPackage(group);
+                        const ack = ackByKey.get(packageKey(rep.name, rep.version));
+                        const who = ack?.by ?? "unknown";
+                        const when = ack?.at ? ` on ${ack.at.slice(0, 10)}` : "";
+                        return (_jsxs(Text, { dimColor: true, wrap: "truncate-end", children: ["  ", chalk.yellow("\u25b8"), " ", groupNames(group), "  ", chalk.dim(`accepted by ${who}${when}`)] }, `ack-${group.key}`));
+                    }), ackGroups.length > ACK_PREVIEW_LIMIT && (_jsx(Text, { dimColor: true, children: `  +${ackGroups.length - ACK_PREVIEW_LIMIT} more \u2014 dg decisions` }))] })), !compact && _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [discoveredTotal !== undefined && discoveredTotal > total && (_jsxs(Text, { dimColor: true, children: ["Scanned ", total, " of ", discoveredTotal, " packages"] })), acked.length > 0 && (_jsxs(Text, { wrap: "truncate-end", children: [chalk.yellow("\u26a0"), " ", chalk.yellow(String(acked.length)), " ", chalk.dim(`acknowledged warn${acked.length !== 1 ? "s" : ""} \u00b7 dg.json \u00b7 review with 'dg decisions'`)] })), _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { wrap: "truncate-end", children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] })] }), !compact && _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { wrap: "truncate-end", children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("\u2588"), "   ", chalk.dim("Esc clear")] })) : exportMsg ? (_jsxs(Text, { wrap: "truncate-end", children: [" ", chalk.green(exportMsg)] })) : searchQuery ? (_jsxs(Text, { wrap: "truncate-end", children: [" ", chalk.bold.cyan("/"), " ", searchQuery, "   ", chalk.dim(`${matchCount} of ${total} packages`), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("clear"), "   ", chalk.bold.cyan("q"), " ", chalk.dim("quit")] })) : (_jsxs(Text, { wrap: "truncate-end", children: [" ", groups.length > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("\u23CE"), " ", chalk.dim("expand"), "   "] })), total > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("l"), " ", chalk.dim("licenses"), "   ", chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", onBack && _jsxs(_Fragment, { children: [chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   "] }), chalk.bold.cyan("q"), " ", chalk.dim("quit")] }))] }));
 };
 const T = {
     branch: chalk.dim("\u251C\u2500\u2500"),
@@ -1197,6 +1250,10 @@ const FindingsSummary = ({ group, maxWidth, maxLines }) => {
     const lcLine = licenseLine(rep);
     if (lcLine)
         allLines.push(lcLine);
+    const downgrade = packageDowngradeLine(rep);
+    if (downgrade) {
+        allLines.push(_jsxs(Text, { wrap: "truncate-end", children: [T.branch, " ", chalk.yellow(downgrade)] }, "provenance-downgrade"));
+    }
     // Render findings — API returns tier-gated data:
     //   Free: { category, severity } — don't show raw IDs, just upgrade prompt
     //   Pro:  { category, severity, title } — show category + title

package/dist/scan-ui/hooks/useScan.js

@@ -1,6 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { useReducer, useEffect, useRef, useCallback, useState } from "react";
 import { analyzePackages, AnalyzeError, mergeAnalyzeResponses } from "../../api/analyze.js";
+import { applyDecisions, packageKey } from "../../decisions/apply.js";
+import { findProjectRoot, loadDgFile } from "../../project/dgfile.js";
 import { collectScanPackages, discoverScanProjectsAsync } from "../../scan/collect.js";
 function reducer(_state, action) {
     switch (action.type) {
@@ -21,7 +23,8 @@ function reducer(_state, action) {
                 result: action.result,
                 durationMs: action.durationMs,
                 skippedCount: action.skippedCount,
-                ...(action.discoveredTotal !== undefined ? { discoveredTotal: action.discoveredTotal } : {})
+                ...(action.discoveredTotal !== undefined ? { discoveredTotal: action.discoveredTotal } : {}),
+                ...(action.decisions !== undefined ? { decisions: action.decisions } : {})
             };
         case "ERROR":
             return { phase: "error", error: action.error };
@@ -79,6 +82,28 @@ export function useScan(config) {
         restartSelection: multiProjects ? restartSelection : null
     };
 }
+function computeProjectDecisions(result, entries) {
+    try {
+        const root = findProjectRoot(process.cwd());
+        if (!root) {
+            return undefined;
+        }
+        const file = loadDgFile(root);
+        if (!file.readable) {
+            return undefined;
+        }
+        const ecosystems = new Map();
+        for (const [ecosystem, packages] of entries) {
+            for (const pkg of packages) {
+                ecosystems.set(packageKey(pkg.name, pkg.version), ecosystem);
+            }
+        }
+        return applyDecisions(result.packages, (pkg) => ecosystems.get(packageKey(pkg.name, pkg.version)), file, result.action);
+    }
+    catch {
+        return undefined;
+    }
+}
 async function scanProjects(projects, dispatch, signal) {
     const startMs = Date.now();
     let skipped = 0;
@@ -134,12 +159,15 @@ async function scanProjects(projects, dispatch, signal) {
         const firstFailure = outcomes.find((outcome) => "error" in outcome);
         if (responses.length > 0) {
             const merged = mergeAnalyzeResponses(responses);
+            const result = firstFailure && merged.action === "pass" ? { ...merged, action: "analysis_incomplete" } : merged;
+            const decisions = computeProjectDecisions(result, entries);
             dispatch({
                 type: "SCAN_COMPLETE",
-                result: firstFailure && merged.action === "pass" ? { ...merged, action: "analysis_incomplete" } : merged,
+                result,
                 durationMs: Date.now() - startMs,
                 skippedCount: skipped,
-                discoveredTotal: total
+                discoveredTotal: total,
+                ...(decisions ? { decisions } : {})
             });
             return;
         }

package/dist/scan-ui/launch.js

@@ -31,11 +31,14 @@ export async function launchScanTui(initialView = "results") {
         ? `Update available: ${update.current} → ${update.latest} · run dg update`
         : undefined;
     enterTui();
+    const instance = render(react.default.createElement(app.App, { config, initialView, updateAvailable }), { exitOnCtrlC: true });
+    const clearStaleFrameOnResize = () => instance.clear();
+    process.stdout.on("resize", clearStaleFrameOnResize);
     try {
-        const instance = render(react.default.createElement(app.App, { config, initialView, updateAvailable }), { exitOnCtrlC: true });
         await instance.waitUntilExit();
     }
     finally {
+        process.stdout.off("resize", clearStaleFrameOnResize);
         leaveTui();
     }
 }

package/dist/scan-ui/shims.js

@@ -16,6 +16,9 @@ export function getStoredApiKey() {
         return null;
     }
 }
+export function effectiveScanAction(raw, effective, mode) {
+    return mode === "strict" || effective === undefined ? raw : effective;
+}
 export function scanExitCode(action, mode) {
     if (action === "block") {
         return 2;

package/dist/scripts/detect.js

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+const LIFECYCLE_HOOKS = ["preinstall", "install", "postinstall"];
+export function computeScriptsHash(scripts, hasGyp) {
+    const canonical = JSON.stringify({
+        preinstall: lifecycleCommand(scripts, "preinstall"),
+        install: lifecycleCommand(scripts, "install"),
+        postinstall: lifecycleCommand(scripts, "postinstall"),
+        gyp: hasGyp
+    });
+    return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+export function detectScriptWanters(projectDir) {
+    const nodeModules = join(projectDir, "node_modules");
+    const fromLockfile = wantersFromHiddenLockfile(projectDir, nodeModules);
+    const wanters = fromLockfile ?? wantersFromWalk(nodeModules);
+    const byName = new Map();
+    for (const wanter of wanters) {
+        if (!byName.has(wanter.name)) {
+            byName.set(wanter.name, wanter);
+        }
+    }
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+export function detectPnpmIgnoredBuilds(projectDir) {
+    const modulesYamlPath = join(projectDir, "node_modules", ".modules.yaml");
+    let content;
+    try {
+        content = readFileSync(modulesYamlPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split("\n");
+    const startIndex = lines.findIndex((line) => /^ignoredBuilds:/.test(line));
+    if (startIndex === -1) {
+        return [];
+    }
+    const startLine = lines[startIndex] ?? "";
+    if (/\[\s*\]\s*$/.test(startLine)) {
+        return [];
+    }
+    const names = [];
+    for (const line of lines.slice(startIndex + 1)) {
+        const match = /^\s+-\s+(.+?)\s*$/.exec(line);
+        if (!match || !match[1]) {
+            break;
+        }
+        names.push(stripYamlQuotes(match[1]));
+    }
+    return names;
+}
+function stripYamlQuotes(value) {
+    if (value.length >= 2 && ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"')))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+function wantersFromHiddenLockfile(projectDir, nodeModules) {
+    const lockfilePath = join(nodeModules, ".package-lock.json");
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(lockfilePath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!isPlainObject(parsed) || !isPlainObject(parsed.packages)) {
+        return null;
+    }
+    const wanters = [];
+    for (const [packagePath, entry] of Object.entries(parsed.packages)) {
+        if (!isPlainObject(entry) || entry.hasInstallScript !== true || !packagePath.startsWith("node_modules/")) {
+            continue;
+        }
+        const wanter = wanterFromManifestDir(join(projectDir, packagePath));
+        if (wanter) {
+            wanters.push(wanter);
+        }
+    }
+    return wanters;
+}
+function wantersFromWalk(nodeModules) {
+    const wanters = [];
+    for (const dir of packageDirs(nodeModules)) {
+        const wanter = wanterFromManifestDir(dir);
+        if (wanter) {
+            wanters.push(wanter);
+        }
+    }
+    return wanters;
+}
+function packageDirs(nodeModules) {
+    const dirs = [];
+    for (const entry of safeReaddir(nodeModules)) {
+        if (entry.startsWith(".")) {
+            continue;
+        }
+        if (entry.startsWith("@")) {
+            for (const scoped of safeReaddir(join(nodeModules, entry))) {
+                if (!scoped.startsWith(".")) {
+                    dirs.push(join(nodeModules, entry, scoped));
+                }
+            }
+            continue;
+        }
+        dirs.push(join(nodeModules, entry));
+    }
+    return dirs;
+}
+function wanterFromManifestDir(dir) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!isPlainObject(manifest) || typeof manifest.name !== "string" || manifest.name.length === 0) {
+        return null;
+    }
+    const scripts = isPlainObject(manifest.scripts) ? manifest.scripts : {};
+    const hasGyp = existsSync(join(dir, "binding.gyp"));
+    const hooks = LIFECYCLE_HOOKS.filter((hook) => typeof lifecycleCommand(scripts, hook) === "string");
+    if (hasGyp) {
+        hooks.push("gyp");
+    }
+    if (hooks.length === 0) {
+        return null;
+    }
+    return {
+        name: manifest.name,
+        version: typeof manifest.version === "string" ? manifest.version : "",
+        hooks,
+        scriptsHash: computeScriptsHash(scripts, hasGyp)
+    };
+}
+function lifecycleCommand(scripts, hook) {
+    const command = scripts[hook];
+    return typeof command === "string" && command.length > 0 ? command : null;
+}
+function safeReaddir(dir) {
+    try {
+        return readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/scripts/gate.js

@@ -0,0 +1,170 @@
+import { loadUserConfig } from "../config/settings.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+import { loadDgFile, saveDgFile } from "../project/dgfile.js";
+import { detectPnpmIgnoredBuilds, detectScriptWanters } from "./detect.js";
+export function evaluateScriptGate(wanters, approvals) {
+    const approved = [];
+    const denied = [];
+    const pending = [];
+    const drifted = [];
+    for (const wanter of wanters) {
+        const entry = approvals[wanter.name];
+        if (!entry) {
+            pending.push(wanter);
+            continue;
+        }
+        if (entry.scriptsHash !== wanter.scriptsHash) {
+            drifted.push({ wanter, priorHash: entry.scriptsHash });
+            continue;
+        }
+        if (entry.decision === "allow") {
+            approved.push(wanter);
+        }
+        else {
+            denied.push(wanter);
+        }
+    }
+    return { approved, denied, pending, drifted };
+}
+export function applyScriptDecisions(file, decisions, now) {
+    if (decisions.length === 0) {
+        return file;
+    }
+    const npm = { ...file.scriptApprovals.npm };
+    for (const input of decisions) {
+        npm[input.wanter.name] = {
+            decision: input.decision,
+            scriptsHash: input.wanter.scriptsHash,
+            hooks: input.wanter.hooks,
+            ...(input.wanter.version ? { approvedVersion: input.wanter.version } : {}),
+            ...(input.reason ? { reason: input.reason } : {}),
+            approvedAt: now.toISOString(),
+            provenance: input.provenance ?? "prompt"
+        };
+    }
+    return {
+        ...file,
+        scriptApprovals: { ...file.scriptApprovals, npm }
+    };
+}
+export function recordScriptObservations(options) {
+    const file = loadDgFile(options.projectDir);
+    if (!file.readable || (!file.exists && !options.createIfMissing) || options.wanters.length === 0) {
+        return { written: false, path: file.path };
+    }
+    const observed = { ...file.scriptApprovals.observed };
+    let changed = false;
+    for (const wanter of options.wanters) {
+        const existing = observed[wanter.name];
+        if (existing &&
+            existing.version === wanter.version &&
+            existing.scriptsHash === wanter.scriptsHash &&
+            sameHooks(existing.hooks, wanter.hooks)) {
+            continue;
+        }
+        observed[wanter.name] = {
+            version: wanter.version,
+            hooks: wanter.hooks,
+            scriptsHash: wanter.scriptsHash,
+            firstSeen: existing ? existing.firstSeen : options.now.toISOString()
+        };
+        changed = true;
+    }
+    if (!changed) {
+        return { written: false, path: file.path };
+    }
+    saveDgFile({ ...file, scriptApprovals: { ...file.scriptApprovals, observed } });
+    return { written: true, path: file.path };
+}
+function sameHooks(a, b) {
+    return a.length === b.length && a.every((hook, index) => hook === b[index]);
+}
+export function hasExplicitScriptPreference(args, env) {
+    if (args.some((arg) => arg === "--ignore-scripts" || arg.startsWith("--ignore-scripts="))) {
+        return true;
+    }
+    return env.npm_config_ignore_scripts !== undefined && env.npm_config_ignore_scripts !== "";
+}
+export function scriptGateInstallArgs(options) {
+    if (options.mode !== "enforce") {
+        return options.args;
+    }
+    if (options.manager !== "npm" && options.manager !== "yarn") {
+        return options.args;
+    }
+    if (hasExplicitScriptPreference(options.args, options.env)) {
+        return options.args;
+    }
+    return [...options.args, "--ignore-scripts"];
+}
+export function scriptGateChildEnv(options) {
+    if (options.mode !== "enforce" || (options.manager !== "npm" && options.manager !== "yarn")) {
+        return {};
+    }
+    if (hasExplicitScriptPreference(options.args, options.env)) {
+        return {};
+    }
+    return { npm_config_ignore_scripts: "true" };
+}
+const REPORTED_NAME_LIMIT = 6;
+export function scriptGateReportLine(options) {
+    const theme = createTheme(resolvePresentation().color);
+    if (options.manager === "pnpm") {
+        const ignored = options.pnpmIgnoredBuilds ?? [];
+        if (ignored.length === 0) {
+            return "";
+        }
+        return `\n  ${theme.paint("muted", `dg scripts: pnpm natively blocked install scripts for ${formatNames(ignored)} — review with 'pnpm approve-builds'`)}\n`;
+    }
+    const wanters = options.wanters ?? [];
+    if (wanters.length === 0) {
+        return "";
+    }
+    const names = wanters.map((wanter) => (wanter.version ? `${wanter.name}@${wanter.version}` : wanter.name));
+    const noun = wanters.length === 1 ? "package ran" : "packages ran";
+    return `\n  ${theme.paint("muted", `dg scripts: ${wanters.length} ${noun} install scripts (${formatNames(names)}) — per-package approvals are coming; see 'dg explain script-gate'`)}\n`;
+}
+function formatNames(names) {
+    if (names.length <= REPORTED_NAME_LIMIT) {
+        return names.join(", ");
+    }
+    return `${names.slice(0, REPORTED_NAME_LIMIT).join(", ")}, +${names.length - REPORTED_NAME_LIMIT} more`;
+}
+const MUTATING_ACTIONS = {
+    npm: new Set(["install", "i", "ci", "add", "update", "dedupe"]),
+    yarn: new Set(["add", "install", "upgrade"]),
+    pnpm: new Set(["install", "i", "add", "update"])
+};
+export function runScriptGateAfterInstall(options) {
+    try {
+        const classification = options.classification;
+        if (classification.kind !== "protected" || classification.ecosystem !== "javascript") {
+            return "";
+        }
+        const mutatingActions = MUTATING_ACTIONS[classification.manager];
+        if (!mutatingActions || !mutatingActions.has(classification.action)) {
+            return "";
+        }
+        const config = loadUserConfig(options.env ?? process.env);
+        if (config.scriptGate.mode === "off") {
+            return "";
+        }
+        const projectDir = options.projectDir ?? process.cwd();
+        if (classification.manager === "pnpm") {
+            return scriptGateReportLine({ manager: "pnpm", pnpmIgnoredBuilds: detectPnpmIgnoredBuilds(projectDir) });
+        }
+        const wanters = detectScriptWanters(projectDir);
+        recordScriptObservations({
+            projectDir,
+            wanters,
+            createIfMissing: config.scriptGate.observe,
+            now: options.now ?? new Date()
+        });
+        return scriptGateReportLine({ manager: classification.manager, wanters });
+    }
+    catch {
+        // observing must never fail or block an install that already succeeded
+        return "";
+    }
+}

package/dist/scripts/rebuild.js

@@ -0,0 +1,28 @@
+export const ROOT_LIFECYCLE_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
+export function buildScriptRebuildPlan(manager, packages, includeRootLifecycle) {
+    const binaryName = manager === "pnpm" ? "pnpm" : "npm";
+    const commands = [];
+    if (packages.length > 0) {
+        commands.push(binaryName === "pnpm" ? ["rebuild", ...packages] : ["rebuild", ...packages, "--foreground-scripts"]);
+    }
+    if (includeRootLifecycle && binaryName === "npm") {
+        for (const hook of ROOT_LIFECYCLE_HOOKS) {
+            commands.push(["run", "--if-present", hook]);
+        }
+    }
+    return { binaryName, commands };
+}
+export async function runScriptRebuild(options) {
+    const failures = [];
+    let exitCode = 0;
+    for (const args of options.plan.commands) {
+        const result = await options.spawner({ binary: options.binaryPath, args, env: options.env });
+        if (result.exitCode !== 0) {
+            failures.push({ args, exitCode: result.exitCode });
+            if (exitCode === 0) {
+                exitCode = result.exitCode;
+            }
+        }
+    }
+    return { exitCode, failures };
+}