@westbayberry/dg 2.0.11 → 2.2.0

package/dist/launcher/agent-check.js

@@ -0,0 +1,466 @@
+import { analyzePackages, AnalyzeError } from "../api/analyze.js";
+import { classifyPackageManagerInvocation, isSupportedPackageManager, packageManagerNames, } from "./classify.js";
+import { resolveLatest } from "../verify/package-check.js";
+import { matchDecision } from "../decisions/apply.js";
+import { isCooldownExempt, isCooldownExemptByDgFile } from "../policy/cooldown.js";
+import { resolvePreflightCooldown, resolvePreflightDecisions } from "./install-preflight.js";
+const ALLOW = { decision: "allow" };
+// Flags that consume the following token as their value, so it must not be
+// mistaken for a package name (the `-r requirements.txt` trap).
+const PIP_VALUE_FLAGS = new Set([
+    "-r", "--requirement", "-c", "--constraint", "-e", "--editable", "-i", "--index-url",
+    "--extra-index-url", "-f", "--find-links", "-t", "--target", "--platform",
+    "--python-version", "--implementation", "--abi", "--prefix", "--root", "--no-binary",
+    "--only-binary", "--progress-bar",
+]);
+const NPM_VALUE_FLAGS = new Set(["--registry", "--prefix", "-C", "--workspace", "-w", "--tag", "--otp"]);
+function analyzeEcosystem(eco) {
+    if (eco === "javascript")
+        return "npm";
+    if (eco === "python")
+        return "pypi";
+    return null;
+}
+function splitSegments(line) {
+    return line.split(/&&|\|\||[;|&\n\r]/).map((s) => s.trim()).filter(Boolean);
+}
+function substitutionBodies(line) {
+    const bodies = [];
+    const patterns = [/\$\(([^)]*)\)/g, /`([^`]*)`/g];
+    for (const pattern of patterns) {
+        let m;
+        while ((m = pattern.exec(line)) !== null) {
+            const body = (m[1] ?? "").trim();
+            if (body) {
+                bodies.push(body);
+            }
+        }
+    }
+    return bodies;
+}
+function collectSegments(line) {
+    const texts = [];
+    const pending = [line];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current === undefined || texts.includes(current)) {
+            continue;
+        }
+        texts.push(current);
+        pending.push(...substitutionBodies(current));
+    }
+    const segments = [];
+    for (const segment of texts.flatMap(splitSegments)) {
+        if (!segments.includes(segment)) {
+            segments.push(segment);
+        }
+    }
+    return segments;
+}
+const ANSI_C_ESCAPES = {
+    n: "\n", t: "\t", r: "\r", a: "\x07", b: "\b", f: "\f", v: "\v",
+    "\\": "\\", "'": "'", '"': '"', "?": "?", e: "\x1b", E: "\x1b",
+};
+function decodeAnsiC(body) {
+    let out = "";
+    let i = 0;
+    while (i < body.length) {
+        const c = body[i] ?? "";
+        if (c !== "\\" || i + 1 >= body.length) {
+            out += c;
+            i += 1;
+            continue;
+        }
+        const next = body[i + 1] ?? "";
+        if (next === "x") {
+            const m = /^[0-9a-fA-F]{1,2}/.exec(body.slice(i + 2));
+            if (m) {
+                out += String.fromCharCode(parseInt(m[0], 16));
+                i += 2 + m[0].length;
+                continue;
+            }
+        }
+        if (next === "u" || next === "U") {
+            const m = new RegExp(`^[0-9a-fA-F]{1,${next === "u" ? 4 : 8}}`).exec(body.slice(i + 2));
+            if (m) {
+                out += String.fromCodePoint(parseInt(m[0], 16));
+                i += 2 + m[0].length;
+                continue;
+            }
+        }
+        if (next >= "0" && next <= "7") {
+            const m = /^[0-7]{1,3}/.exec(body.slice(i + 1));
+            if (m) {
+                out += String.fromCharCode(parseInt(m[0], 8) & 0xff);
+                i += 1 + m[0].length;
+                continue;
+            }
+        }
+        out += next in ANSI_C_ESCAPES ? ANSI_C_ESCAPES[next] : next;
+        i += 2;
+    }
+    return out;
+}
+// A POSIX-style word splitter that performs quote removal, escape processing,
+// ANSI-C ($'…') decoding, and adjacent-fragment joining the way the executing
+// shell would, so quote/backslash obfuscation (np""m, n"p"m, i"n"stall, np\m,
+// $'\x69'nstall) collapses to the real command before classification.
+function lexSegment(segment) {
+    const tokens = [];
+    let cur = "";
+    let started = false;
+    let i = 0;
+    const n = segment.length;
+    const flush = () => {
+        if (started) {
+            tokens.push(cur);
+            cur = "";
+            started = false;
+        }
+    };
+    while (i < n) {
+        const ch = segment[i] ?? "";
+        if (ch === " " || ch === "\t") {
+            flush();
+            i += 1;
+            continue;
+        }
+        if (ch === "#" && !started) {
+            break;
+        }
+        if (ch === "'") {
+            started = true;
+            i += 1;
+            let closed = false;
+            while (i < n) {
+                if (segment[i] === "'") {
+                    closed = true;
+                    i += 1;
+                    break;
+                }
+                cur += segment[i];
+                i += 1;
+            }
+            if (!closed) {
+                flush();
+                return { tokens, ok: false };
+            }
+            continue;
+        }
+        if (ch === '"') {
+            started = true;
+            i += 1;
+            let closed = false;
+            while (i < n) {
+                const c = segment[i] ?? "";
+                if (c === '"') {
+                    closed = true;
+                    i += 1;
+                    break;
+                }
+                if (c === "\\" && i + 1 < n) {
+                    const nx = segment[i + 1] ?? "";
+                    if (nx === '"' || nx === "\\" || nx === "`" || nx === "$" || nx === "\n") {
+                        cur += nx;
+                        i += 2;
+                        continue;
+                    }
+                    cur += c;
+                    i += 1;
+                    continue;
+                }
+                cur += c;
+                i += 1;
+            }
+            if (!closed) {
+                flush();
+                return { tokens, ok: false };
+            }
+            continue;
+        }
+        if (ch === "$" && segment[i + 1] === "'") {
+            started = true;
+            i += 2;
+            let closed = false;
+            let body = "";
+            while (i < n) {
+                const c = segment[i] ?? "";
+                if (c === "\\" && i + 1 < n) {
+                    body += c + (segment[i + 1] ?? "");
+                    i += 2;
+                    continue;
+                }
+                if (c === "'") {
+                    closed = true;
+                    i += 1;
+                    break;
+                }
+                body += c;
+                i += 1;
+            }
+            if (!closed) {
+                flush();
+                return { tokens, ok: false };
+            }
+            cur += decodeAnsiC(body);
+            continue;
+        }
+        if (ch === "\\") {
+            if (i + 1 < n) {
+                cur += segment[i + 1];
+                started = true;
+                i += 2;
+                continue;
+            }
+            flush();
+            return { tokens, ok: false };
+        }
+        cur += ch;
+        started = true;
+        i += 1;
+    }
+    flush();
+    return { tokens, ok: true };
+}
+const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const WRAPPER_COMMANDS = new Set(["sudo", "command", "exec", "env", "nice", "nohup", "time", "xargs"]);
+function commandBasename(token) {
+    const slash = token.lastIndexOf("/");
+    return slash === -1 ? token : token.slice(slash + 1);
+}
+function commandTokens(segment) {
+    const lexed = lexSegment(segment);
+    let tokens = lexed.tokens;
+    for (;;) {
+        while (tokens.length > 0 && ENV_ASSIGNMENT.test(tokens[0] ?? "")) {
+            tokens = tokens.slice(1);
+        }
+        const head = tokens[0];
+        if (head === undefined || !WRAPPER_COMMANDS.has(commandBasename(head))) {
+            return { tokens, ok: lexed.ok };
+        }
+        tokens = tokens.slice(1);
+        while (tokens.length > 0 && (tokens[0] ?? "").startsWith("-")) {
+            tokens = tokens.slice(1);
+        }
+    }
+}
+function parseSpecToken(eco, token) {
+    if (eco === "npm") {
+        const at = token.lastIndexOf("@");
+        if (at > 0) {
+            return { name: token.slice(0, at), version: token.slice(at + 1) || null };
+        }
+        return { name: token, version: null };
+    }
+    // pypi: only an exact `name==version` is a pinned version; ranges are unpinned.
+    const exact = /^([A-Za-z0-9._-]+)==([^,;\s]+)$/.exec(token);
+    if (exact && exact[1] && exact[2]) {
+        return { name: exact[1], version: exact[2] };
+    }
+    const ranged = /^([A-Za-z0-9._-]+)\s*(?:===|>=|<=|~=|!=|<|>)/.exec(token);
+    if (ranged && ranged[1]) {
+        return { name: ranged[1], version: null };
+    }
+    return { name: token, version: null };
+}
+function isLocalSpecToken(t) {
+    return (t.startsWith(".") ||
+        t.startsWith("/") ||
+        t.startsWith("file:") ||
+        t.startsWith("link:") ||
+        t.startsWith("workspace:"));
+}
+function extractSpecs(manager, eco, rawArgs) {
+    const valueFlags = eco === "pypi" ? PIP_VALUE_FLAGS : NPM_VALUE_FLAGS;
+    const noVerb = manager === "npx" || manager === "pnpx" || manager === "uvx";
+    const positionals = [];
+    let seenVerb = noVerb;
+    for (let i = 0; i < rawArgs.length; i += 1) {
+        const a = rawArgs[i];
+        if (a === undefined) {
+            continue;
+        }
+        if (a.startsWith("-")) {
+            if (valueFlags.has(a)) {
+                i += 1;
+            }
+            continue;
+        }
+        if (!seenVerb) {
+            seenVerb = true;
+            continue;
+        }
+        positionals.push(a);
+    }
+    const tokens = noVerb ? positionals.slice(0, 1) : positionals;
+    const specs = [];
+    const remoteUnverifiable = [];
+    for (const t of tokens) {
+        if (t.length === 0) {
+            continue;
+        }
+        if (t.includes("://") || t.startsWith("git+")) {
+            remoteUnverifiable.push(t);
+            continue;
+        }
+        if (isLocalSpecToken(t)) {
+            continue;
+        }
+        const spec = parseSpecToken(eco, t);
+        if (spec.name.length > 0) {
+            specs.push(spec);
+        }
+    }
+    return { specs, remoteUnverifiable };
+}
+function normalizeName(eco, name) {
+    const lower = name.toLowerCase();
+    return eco === "pypi" ? lower.replace(/[._-]+/g, "-") : lower;
+}
+function quarantined(pkg, ctx, eco, dgExemptions = []) {
+    if (!ctx || !pkg.cooldown)
+        return false;
+    if (isCooldownExempt(pkg.name, ctx.exempt, eco) || isCooldownExemptByDgFile(pkg.name, eco, dgExemptions)) {
+        return false;
+    }
+    return (pkg.cooldown.status === "quarantine" ||
+        (pkg.cooldown.status === "unknown" && ctx.param.onUnknown === "block"));
+}
+function whyFor(pkg, action) {
+    if (action === "cooldown") {
+        return "release too new (cooldown)";
+    }
+    return pkg.reasons[0] ?? pkg.findings[0]?.title ?? pkg.findings[0]?.id ?? String(action);
+}
+function combinePackages(verdicts) {
+    if (verdicts.length === 0) {
+        return ALLOW;
+    }
+    const blocking = verdicts.filter((v) => v.action === "block" || v.action === "cooldown" || v.action === "analysis_incomplete");
+    if (blocking.length > 0) {
+        const list = blocking.map((v) => `${v.name}@${v.version} (${v.action}: ${v.why})`).join("; ");
+        return { decision: "deny", reason: `DG blocked install — ${list}`, packages: verdicts };
+    }
+    const list = verdicts.map((v) => `${v.name}@${v.version} (${v.why})`).join("; ");
+    return { decision: "ask", reason: `DG flagged for review — ${list}`, packages: verdicts };
+}
+function combine(results) {
+    return results.find((v) => v.decision === "deny") ?? results.find((v) => v.decision === "ask") ?? ALLOW;
+}
+async function checkSegment(segment, env, cwd, fetchImpl) {
+    const { tokens, ok } = commandTokens(segment);
+    const manager = commandBasename(tokens[0] ?? "");
+    if (!manager || !packageManagerNames().includes(manager) || !isSupportedPackageManager(manager)) {
+        return ALLOW;
+    }
+    if (!ok) {
+        // Head is a package manager but the segment could not be parsed safely
+        // (unbalanced quote / trailing escape). Never wave it through.
+        return { decision: "ask", reason: `dg could not safely parse this ${manager} command; proceed only if you trust it` };
+    }
+    const args = tokens.slice(1);
+    const classification = classifyPackageManagerInvocation(manager, args);
+    if (classification.kind !== "protected") {
+        return ALLOW;
+    }
+    const eco = analyzeEcosystem(classification.ecosystem);
+    if (eco === null) {
+        return { decision: "ask", reason: `dg cannot yet verify ${manager} packages; proceed manually if you trust them` };
+    }
+    const { specs, remoteUnverifiable } = extractSpecs(manager, eco, args);
+    const unverifiable = remoteUnverifiable.length > 0
+        ? {
+            decision: "ask",
+            reason: `dg cannot verify non-registry source${remoteUnverifiable.length > 1 ? "s" : ""}: ${remoteUnverifiable.join(", ")}; proceed only if you trust ${remoteUnverifiable.length > 1 ? "them" : "it"}`,
+        }
+        : null;
+    if (specs.length === 0) {
+        return unverifiable ?? ALLOW;
+    }
+    const resolved = [];
+    for (const spec of specs) {
+        let version = spec.version;
+        if (!version) {
+            version = await resolveLatest(eco, spec.name, fetchImpl);
+            if (!version) {
+                return {
+                    decision: "deny",
+                    reason: `could not resolve a version to verify ${spec.name} on ${eco}; refusing under the firewall`,
+                };
+            }
+        }
+        resolved.push({ name: spec.name, version });
+    }
+    const cooldown = resolvePreflightCooldown(env, eco);
+    let decisions;
+    try {
+        decisions = resolvePreflightDecisions(eco, cwd, env);
+    }
+    catch {
+        decisions = null;
+    }
+    let response;
+    try {
+        response = await analyzePackages(resolved, {
+            ecosystem: eco,
+            env,
+            fetchImpl,
+            ...(cooldown ? { cooldown: cooldown.param } : {}),
+        });
+    }
+    catch (error) {
+        const message = error instanceof AnalyzeError ? error.message : "the dg scanner could not be reached";
+        return {
+            decision: "deny",
+            reason: `could not verify ${resolved.map((r) => r.name).join(", ")}: ${message}; blocked under the firewall (disable: dg hook <agent> off)`,
+        };
+    }
+    const verdicts = [];
+    for (const pkg of response.packages) {
+        const isQuar = quarantined(pkg, cooldown, eco, decisions?.file.cooldownExemptions ?? []);
+        // A per-package result with no action is a coverage gap, not a clean pass:
+        // treat it as analysis_incomplete (blocking) so the firewall fails closed.
+        let action = isQuar && pkg.action !== "block" ? "cooldown" : pkg.action ?? "analysis_incomplete";
+        if (action === "warn" &&
+            decisions &&
+            matchDecision(pkg, decisions.ecosystem, decisions.file.decisions).acknowledged) {
+            action = "pass";
+        }
+        if (action !== "pass") {
+            verdicts.push({ name: pkg.name, version: pkg.version, action, why: whyFor(pkg, action) });
+        }
+    }
+    // Every requested spec must come back with a verdict. A package the scanner
+    // omitted (partial/truncated/tampered response) must not be silently allowed.
+    const returned = new Set(response.packages.map((p) => normalizeName(eco, p.name)));
+    for (const spec of resolved) {
+        if (!returned.has(normalizeName(eco, spec.name))) {
+            verdicts.push({
+                name: spec.name,
+                version: spec.version,
+                action: "analysis_incomplete",
+                why: "scanner returned no verdict for this package",
+            });
+        }
+    }
+    const base = combinePackages(verdicts);
+    if (unverifiable && base.decision === "allow") {
+        return unverifiable;
+    }
+    return base;
+}
+export async function agentCheckCommand(input) {
+    const env = input.env ?? process.env;
+    const cwd = input.cwd ?? process.cwd();
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const segments = collectSegments(input.commandLine);
+    if (segments.length === 0) {
+        return ALLOW;
+    }
+    const results = [];
+    for (const seg of segments) {
+        results.push(await checkSegment(seg, env, cwd, fetchImpl));
+    }
+    return combine(results);
+}

package/dist/launcher/agent-hook-exec.js

@@ -0,0 +1,70 @@
+import { join } from "node:path";
+import { runAgentHookExec } from "./agent-hook-io.js";
+import { getAgent, isAgentId } from "../agents/registry.js";
+import { resolveDgPaths } from "../state/index.js";
+import { writeJsonAtomic } from "../util/json-file.js";
+async function readStdin(stream = process.stdin) {
+    if (stream.isTTY) {
+        return "";
+    }
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function recordFixture(agent, stdin) {
+    const path = join(resolveDgPaths().stateDir, "fixtures", `${agent}-${Date.now()}.json`);
+    writeJsonAtomic(path, { agent, capturedAt: new Date().toISOString(), stdin });
+    return path;
+}
+// Short-circuited before any banner/nudge so stdout carries only the decision
+// JSON the agent parses.
+export async function maybeAgentHookExec(args, opts = {}) {
+    const noop = { exitCode: 0, stdout: "", stderr: "" };
+    if (args[0] !== "hook-exec") {
+        return { handled: false, result: noop };
+    }
+    const agent = args[1];
+    if (!agent || !isAgentId(agent)) {
+        // Unknown agent (e.g. a hook written by a newer dg, run by an older one):
+        // fail closed. We can't emit this agent's allow shape, and a non-zero exit
+        // with no decision blocks across the agents we support, so an out-of-date
+        // dg refuses the install with a clear message rather than waving it through.
+        return {
+            handled: true,
+            result: {
+                exitCode: 2,
+                stdout: "",
+                stderr: `dg hook-exec: unknown agent '${agent ?? ""}' — blocked under the firewall; update dg (npm i -g @westbayberry/dg) or run 'dg agents off'\n`
+            }
+        };
+    }
+    let stdin;
+    try {
+        stdin = await readStdin(opts.stdin);
+    }
+    catch {
+        // A stdin stream error must not escape to the fatal handler (exit 70 with
+        // empty stdout reads as allow to every agent). Emit this agent's deny shape.
+        const emitted = getAgent(agent).emitDecision({
+            decision: "deny",
+            reason: "dg hook: could not read the tool payload from stdin; blocked under the firewall",
+        });
+        return {
+            handled: true,
+            result: { exitCode: emitted.exitCode || 2, stdout: emitted.stdout, stderr: "dg hook: stdin read error\n" },
+        };
+    }
+    let fixtureNote = "";
+    if (args[2] === "--record-fixture") {
+        try {
+            fixtureNote = `dg hook-exec: recorded fixture ${recordFixture(agent, stdin)}\n`;
+        }
+        catch {
+            fixtureNote = "dg hook-exec: could not record the fixture\n";
+        }
+    }
+    const result = await runAgentHookExec(agent, stdin);
+    return { handled: true, result: { exitCode: result.exitCode, stdout: result.stdout, stderr: `${fixtureNote}${result.stderr}` } };
+}

package/dist/launcher/agent-hook-io.js

@@ -0,0 +1,31 @@
+import { agentCheckCommand } from "./agent-check.js";
+import { getAgent } from "../agents/registry.js";
+export async function runAgentHookExec(agent, stdin, deps = {}) {
+    const integration = getAgent(agent);
+    const parsed = integration.parseInput(stdin);
+    if (!parsed) {
+        // Unreadable payload -> fail closed (deny) so a malformed hook input can
+        // never slip an install through unverified.
+        const verdict = { decision: "deny", reason: "dg hook: could not read the tool command; blocked under the firewall" };
+        const emitted = integration.emitDecision(verdict);
+        return { stdout: emitted.stdout, stderr: "dg hook: malformed hook payload\n", exitCode: emitted.exitCode };
+    }
+    let verdict;
+    try {
+        verdict = await agentCheckCommand({
+            commandLine: parsed.command,
+            ...(parsed.cwd ? { cwd: parsed.cwd } : {}),
+            ...(deps.env ? { env: deps.env } : {}),
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+        });
+    }
+    catch {
+        // Any failure computing the verdict must fail closed: an unhandled throw
+        // would otherwise exit non-zero with no decision, which most agents read
+        // as allow.
+        verdict = { decision: "deny", reason: "dg hook: firewall check failed; blocked under the firewall (disable: dg agents off)" };
+    }
+    const emitted = integration.emitDecision(verdict);
+    const stderr = verdict.decision === "allow" ? "" : `  ${verdict.reason ?? "DG firewall"}\n`;
+    return { stdout: emitted.stdout, stderr, exitCode: emitted.exitCode };
+}

package/dist/launcher/cargo-cache.js

@@ -0,0 +1,40 @@
+import { existsSync, lstatSync, mkdirSync, symlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const PRESERVED_ENTRIES = ["config.toml", "config", "credentials.toml", "credentials"];
+export function userCargoHome(env) {
+    const explicit = env.CARGO_HOME?.trim();
+    return explicit ? explicit : join(homedir(), ".cargo");
+}
+// Cargo keeps registry config and auth tokens (config.toml / credentials.toml)
+// inside CARGO_HOME, next to the crate cache. dg redirects CARGO_HOME to an empty
+// per-session dir so cached crates re-fetch through the firewall, which would also
+// hide a private-registry user's config and tokens — so link those back in.
+export function prepareCargoHome(cacheDir, source) {
+    mkdirSync(cacheDir, { recursive: true });
+    const linked = [];
+    for (const name of PRESERVED_ENTRIES) {
+        const target = join(source, name);
+        const link = join(cacheDir, name);
+        if (!existsSync(target) || pathPresent(link)) {
+            continue;
+        }
+        try {
+            symlinkSync(target, link);
+            linked.push(name);
+        }
+        catch {
+            continue;
+        }
+    }
+    return linked;
+}
+function pathPresent(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/launcher/classify.js

@@ -1,9 +1,9 @@
 import { optionalPackageManagerNames, optionalSupportGate } from "../setup/optional-support.js";
 const supportedManagers = ["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pipx", "uv", "uvx", "cargo"];
 const gatedManagers = optionalPackageManagerNames();
-const jsProtected = new Set(["install", "i", "ci", "add", "update", "dedupe", "exec"]);
-const pnpmProtected = new Set(["install", "i", "add", "update", "dlx", "exec"]);
-const yarnProtected = new Set(["add", "install", "upgrade", "dlx"]);
+const jsProtected = new Set(["install", "i", "ci", "add", "update", "dedupe", "exec", "create"]);
+const pnpmProtected = new Set(["install", "i", "add", "update", "dlx", "exec", "create"]);
+const yarnProtected = new Set(["add", "install", "upgrade", "dlx", "create"]);
 const pipProtected = new Set(["install", "download", "wheel"]);
 const pipxProtected = new Set(["install", "upgrade", "inject", "run"]);
 const uvProtected = new Set(["add", "sync"]);
@@ -44,7 +44,7 @@ export function classifyPackageManagerInvocation(manager, args) {
 }
 function classifyByCommand(manager, args, realBinaryName, protectedCommands, protectedReason, ecosystem) {
     const action = firstCommand(args);
-    if (protectedCommands.has(action) || containsFetchSpec(args)) {
+    if (protectedCommands.has(action) || containsFetchSpec(args) || initFetchesPackage(action, args, protectedCommands)) {
         return {
             manager,
             ecosystem,
@@ -70,8 +70,8 @@ function classifyUv(args) {
     if (action === "pip" && pipProtected.has(args[1] ?? "")) {
         return protectedClassification("uv", args, "uv", "uv pip install/fetch command");
     }
-    if (action === "tool" && args[1] === "run") {
-        return protectedClassification("uv", args, "uv", "uv tool run fetches package artifacts");
+    if (action === "tool" && ["run", "install", "upgrade"].includes(args[1] ?? "")) {
+        return protectedClassification("uv", args, "uv", "uv tool run/install/upgrade fetches package artifacts");
     }
     if (uvProtected.has(action) || containsFetchSpec(args)) {
         return protectedClassification("uv", args, "uv", "uv install/fetch command");
@@ -111,6 +111,17 @@ function unsupportedClassification(manager, args) {
 function firstCommand(args) {
     return args.find((arg) => !arg.startsWith("-")) ?? "";
 }
+// `npm/pnpm/yarn init <initializer>` aliases to fetching and running
+// create-<initializer>, the same as the `create` form; bare `init` / `init -y`
+// is a local scaffold with no fetch. Gated to the JS managers (their protected
+// set carries "create"); cargo/pip `init` are local-only.
+function initFetchesPackage(action, args, protectedCommands) {
+    if (action !== "init" || !protectedCommands.has("create")) {
+        return false;
+    }
+    const commandIndex = args.findIndex((arg) => !arg.startsWith("-"));
+    return args.slice(commandIndex + 1).some((arg) => arg !== "--" && !arg.startsWith("-"));
+}
 function containsFetchSpec(args) {
     return args.some((arg) => /^https?:\/\//.test(arg) || /^git\+https?:\/\//.test(arg) || /\.t(ar\.)?gz(?:$|[#?])/.test(arg));
 }