@westbayberry/dg 2.0.11 → 2.2.0

package/dist/project/dgfile.js

@@ -0,0 +1,446 @@
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { gitTrimmed } from "../util/git.js";
+import { writeJsonAtomic } from "../util/json-file.js";
+import { canonicalCooldownName } from "../policy/pypi-name.js";
+import { acquireLockSyncWithRetry, resolveDgPaths } from "../state/index.js";
+const DG_FILE_LOCK_STALE_MS = 10_000;
+const DG_FILE_LOCK_TIMEOUT_MS = 5_000;
+export function withDgFileLock(root, env, action) {
+    const name = `dgfile-${createHash("sha1").update(root).digest("hex").slice(0, 16)}`;
+    const lock = acquireLockSyncWithRetry(resolveDgPaths(env), name, {
+        staleMs: DG_FILE_LOCK_STALE_MS,
+        timeoutMs: DG_FILE_LOCK_TIMEOUT_MS
+    });
+    try {
+        return action();
+    }
+    finally {
+        lock.release();
+    }
+}
+// Serialized read-modify-write: re-reads dg.json under the lock so a concurrent
+// cooldown/decisions writer can never clobber the other's section.
+export function mutateDgFile(root, env, mutate) {
+    return withDgFileLock(root, env, () => {
+        const file = loadDgFile(root);
+        if (!file.readable) {
+            throw new Error(`refusing to rewrite ${file.path}: ${file.failure ?? "unreadable"}`);
+        }
+        const next = mutate(file);
+        saveDgFile(next);
+        return next;
+    });
+}
+function canonicalExemptionName(ecosystem, name) {
+    return canonicalCooldownName(ecosystem, name);
+}
+export class CooldownExemptionCapError extends Error {
+}
+export const DG_FILE_NAME = "dg.json";
+export const DECISION_ENTRY_CAP = 500;
+export const COOLDOWN_EXEMPTION_CAP = 500;
+export const DECISION_REASON_MAX = 500;
+const KNOWN_TOP_LEVEL_KEYS = new Set(["version", "scriptApprovals", "decisions", "cooldownExemptions"]);
+const KNOWN_SCRIPT_APPROVAL_KEYS = new Set(["npm", "observed"]);
+const SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "gyp"];
+const UNSAFE_OBJECT_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+export function dgFilePath(root) {
+    return join(root, DG_FILE_NAME);
+}
+export function findProjectRoot(cwd, env = process.env) {
+    try {
+        return gitTrimmed(["rev-parse", "--show-toplevel"], { cwd, env });
+    }
+    catch {
+        return null;
+    }
+}
+export function emptyDgFile(path) {
+    return { path, exists: false, readable: true, raw: {}, decisions: [], cooldownExemptions: [], scriptApprovals: emptyScriptApprovals() };
+}
+export function loadDgFile(root) {
+    const path = dgFilePath(root);
+    if (!existsSync(path)) {
+        return emptyDgFile(path);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        return failOpen(path, `malformed JSON (${error instanceof Error ? error.message : "parse error"})`);
+    }
+    if (!isPlainObject(raw)) {
+        return failOpen(path, "top level must be a JSON object");
+    }
+    if (raw.version !== undefined && raw.version !== 1) {
+        return failOpen(path, `unsupported dg.json version ${String(raw.version)}`);
+    }
+    const listed = raw.decisions;
+    if (listed !== undefined && !Array.isArray(listed)) {
+        return failOpen(path, "decisions must be an array");
+    }
+    const entries = Array.isArray(listed) ? listed : [];
+    if (entries.length > DECISION_ENTRY_CAP) {
+        return failOpen(path, `more than ${DECISION_ENTRY_CAP} decisions`);
+    }
+    const approvalsRaw = raw.scriptApprovals;
+    if (approvalsRaw !== undefined && !isPlainObject(approvalsRaw)) {
+        return failOpen(path, "scriptApprovals must be an object");
+    }
+    const decisions = [];
+    for (const entry of entries) {
+        const parsed = parseDecisionEntry(entry);
+        if (parsed) {
+            decisions.push(parsed);
+        }
+    }
+    const exemptionsRaw = raw.cooldownExemptions;
+    if (exemptionsRaw !== undefined && !Array.isArray(exemptionsRaw)) {
+        return failOpen(path, "cooldownExemptions must be an array");
+    }
+    if (Array.isArray(exemptionsRaw) && exemptionsRaw.length > COOLDOWN_EXEMPTION_CAP) {
+        return failOpen(path, `more than ${COOLDOWN_EXEMPTION_CAP} cooldownExemptions`);
+    }
+    const cooldownExemptions = [];
+    for (const entry of Array.isArray(exemptionsRaw) ? exemptionsRaw : []) {
+        const parsed = parseCooldownExemption(entry);
+        if (parsed) {
+            cooldownExemptions.push(parsed);
+        }
+    }
+    const approvals = approvalsRaw ?? {};
+    return {
+        path,
+        exists: true,
+        readable: true,
+        raw,
+        decisions,
+        cooldownExemptions,
+        scriptApprovals: {
+            npm: parseEntryMap(approvals.npm, parseApprovalEntry),
+            observed: parseEntryMap(approvals.observed, parseObservedEntry),
+            unknownKeys: unknownKeysOf(approvals, KNOWN_SCRIPT_APPROVAL_KEYS)
+        }
+    };
+}
+export function warnUnreadableDgFile(file, write = (line) => process.stderr.write(line)) {
+    if (!file.readable) {
+        write(`dg: ignoring decisions in ${file.path} — ${file.failure ?? "unreadable"} (no warnings suppressed)\n`);
+    }
+}
+export function appendDecisions(file, additions, now = new Date()) {
+    const added = additions.map((decision) => ({
+        ...decision,
+        id: randomUUID(),
+        reason: decision.reason.slice(0, DECISION_REASON_MAX),
+        acceptedAt: decision.acceptedAt ?? now.toISOString()
+    }));
+    return { ...file, decisions: [...file.decisions, ...added] };
+}
+export function removeDecisions(file, ids) {
+    return { ...file, decisions: file.decisions.filter((entry) => !ids.has(entry.id)) };
+}
+export function appendCooldownExemptions(file, additions, now = new Date()) {
+    const canonicalAll = additions.map((a) => ({ ...a, name: canonicalExemptionName(a.ecosystem, a.name) }));
+    const canonical = [...new Map(canonicalAll.map((a) => [`${a.ecosystem}:${a.name}`, a])).values()];
+    const priorExtra = new Map(file.cooldownExemptions.map((e) => [`${e.ecosystem}:${e.name}`, e.extra]));
+    const keep = file.cooldownExemptions.filter((e) => !canonical.some((a) => a.ecosystem === e.ecosystem && a.name === e.name));
+    const added = canonical.map((a) => {
+        const carried = priorExtra.get(`${a.ecosystem}:${a.name}`);
+        return {
+            ...a,
+            reason: a.reason.slice(0, DECISION_REASON_MAX),
+            acceptedAt: a.acceptedAt ?? now.toISOString(),
+            ...(carried !== undefined ? { extra: carried } : {})
+        };
+    });
+    const next = [...keep, ...added];
+    if (next.length > COOLDOWN_EXEMPTION_CAP) {
+        const live = next.filter((e) => cooldownExemptionActive(e, now));
+        if (live.length > COOLDOWN_EXEMPTION_CAP) {
+            throw new CooldownExemptionCapError(`cooldown exemptions would exceed the ${COOLDOWN_EXEMPTION_CAP} cap; run 'dg cooldown prune' or remove some with 'dg cooldown rm'`);
+        }
+        return { ...file, cooldownExemptions: live };
+    }
+    return { ...file, cooldownExemptions: next };
+}
+export function removeCooldownExemptions(file, predicate) {
+    return { ...file, cooldownExemptions: file.cooldownExemptions.filter((e) => !predicate(e)) };
+}
+// Active when there is no expiry, or the expiry parses to a future instant. A
+// present-but-unparseable expiry fails CLOSED (treated as expired) so a typo'd
+// date can never become a permanent cooldown bypass.
+export function cooldownExemptionActive(e, now = new Date()) {
+    if (!e.expiresAt) {
+        return true;
+    }
+    const expiry = Date.parse(e.expiresAt);
+    return Number.isFinite(expiry) && expiry > now.getTime();
+}
+function serializeCooldownExemption(e) {
+    return {
+        ...e.extra,
+        ecosystem: e.ecosystem,
+        name: e.name,
+        reason: e.reason,
+        acceptedBy: e.acceptedBy,
+        acceptedAt: e.acceptedAt,
+        ...(e.expiresAt ? { expiresAt: e.expiresAt } : {})
+    };
+}
+const EXEMPTION_FIELDS = new Set(["ecosystem", "name", "reason", "acceptedBy", "acceptedAt", "expiresAt"]);
+export function parseCooldownExemption(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const ecosystem = value.ecosystem;
+    if (ecosystem !== "npm" && ecosystem !== "pypi" && ecosystem !== "cargo") {
+        return null;
+    }
+    const rawName = value.name;
+    if (typeof rawName !== "string" || rawName.length === 0 || /[\u0000-\u001f\u007f\s*]/u.test(rawName)) {
+        return null;
+    }
+    const name = canonicalExemptionName(ecosystem, rawName);
+    const extra = {};
+    for (const [key, field] of Object.entries(value)) {
+        if (!EXEMPTION_FIELDS.has(key) && !UNSAFE_OBJECT_KEYS.has(key)) {
+            extra[key] = field;
+        }
+    }
+    const expiresAt = value.expiresAt;
+    return {
+        ecosystem,
+        name,
+        reason: typeof value.reason === "string" ? value.reason.slice(0, DECISION_REASON_MAX) : "",
+        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? value.acceptedBy : "unknown",
+        acceptedAt: typeof value.acceptedAt === "string" ? value.acceptedAt : "",
+        ...(typeof expiresAt === "string" ? { expiresAt } : {}),
+        ...(Object.keys(extra).length > 0 ? { extra } : {})
+    };
+}
+export function saveDgFile(file) {
+    if (!file.readable) {
+        throw new Error(`refusing to rewrite ${file.path}: ${file.failure ?? "unreadable"}`);
+    }
+    const top = unknownKeysOf(file.raw, KNOWN_TOP_LEVEL_KEYS);
+    if (file.decisions.length > 0) {
+        top.decisions = file.decisions.map(serializeDecisionEntry);
+    }
+    if (file.cooldownExemptions.length > 0) {
+        top.cooldownExemptions = file.cooldownExemptions.map(serializeCooldownExemption);
+    }
+    const approvals = { ...file.scriptApprovals.unknownKeys };
+    if (Object.keys(file.scriptApprovals.npm).length > 0) {
+        approvals.npm = sortedRecord(file.scriptApprovals.npm);
+    }
+    if (Object.keys(file.scriptApprovals.observed).length > 0) {
+        approvals.observed = sortedRecord(file.scriptApprovals.observed);
+    }
+    if (Object.keys(approvals).length > 0) {
+        top.scriptApprovals = sortedRecord(approvals);
+    }
+    const ordered = { version: 1 };
+    for (const key of Object.keys(top).sort()) {
+        ordered[key] = top[key];
+    }
+    writeJsonAtomic(file.path, ordered, { fileMode: 0o644, dirMode: 0o755 });
+}
+export function resolveAcceptedBy(cwd, env = process.env) {
+    try {
+        const email = gitTrimmed(["config", "user.email"], { cwd, env });
+        if (email) {
+            return email;
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return "unknown";
+    }
+}
+function serializeDecisionEntry(entry) {
+    return {
+        ...entry.extra,
+        id: entry.id,
+        ecosystem: entry.ecosystem,
+        name: entry.name,
+        scope: entry.scope.kind === "exact" ? { kind: "exact", version: entry.scope.version } : { kind: "any" },
+        findings: entry.findings,
+        reason: entry.reason,
+        acceptedBy: entry.acceptedBy,
+        acceptedAt: entry.acceptedAt,
+        ...(entry.expiresAt ? { expiresAt: entry.expiresAt } : {})
+    };
+}
+const ENTRY_FIELDS = new Set(["id", "ecosystem", "name", "scope", "findings", "reason", "acceptedBy", "acceptedAt", "expiresAt"]);
+function parseDecisionEntry(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const ecosystem = value.ecosystem;
+    if (ecosystem !== "npm" && ecosystem !== "pypi") {
+        return null;
+    }
+    const name = value.name;
+    if (typeof name !== "string" || name.length === 0) {
+        return null;
+    }
+    const scope = parseScope(value.scope);
+    if (!scope) {
+        return null;
+    }
+    const findings = parseFindings(value.findings);
+    if (!findings) {
+        return null;
+    }
+    const expiresAt = value.expiresAt;
+    if (expiresAt !== undefined && typeof expiresAt !== "string") {
+        return null;
+    }
+    const extra = {};
+    for (const [key, field] of Object.entries(value)) {
+        if (!ENTRY_FIELDS.has(key) && !UNSAFE_OBJECT_KEYS.has(key)) {
+            extra[key] = field;
+        }
+    }
+    return {
+        id: typeof value.id === "string" && value.id.length > 0 ? value.id : derivedEntryId(value),
+        ecosystem,
+        name,
+        scope,
+        findings,
+        reason: typeof value.reason === "string" ? value.reason.slice(0, DECISION_REASON_MAX) : "",
+        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? value.acceptedBy : "unknown",
+        acceptedAt: typeof value.acceptedAt === "string" ? value.acceptedAt : "",
+        ...(typeof expiresAt === "string" ? { expiresAt } : {}),
+        ...(Object.keys(extra).length > 0 ? { extra } : {})
+    };
+}
+function parseScope(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    if (value.kind === "any") {
+        return { kind: "any" };
+    }
+    if (value.kind === "exact" && typeof value.version === "string" && value.version.length > 0) {
+        return { kind: "exact", version: value.version };
+    }
+    return null;
+}
+function parseFindings(value) {
+    if (value === undefined) {
+        return {};
+    }
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const findings = {};
+    for (const [category, severity] of Object.entries(value)) {
+        if (typeof severity !== "number" || !Number.isInteger(severity) || severity < 1 || severity > 5) {
+            return null;
+        }
+        if (!UNSAFE_OBJECT_KEYS.has(category)) {
+            findings[category] = severity;
+        }
+    }
+    return findings;
+}
+function derivedEntryId(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 12);
+}
+function parseEntryMap(raw, parseEntry) {
+    if (!isPlainObject(raw)) {
+        return {};
+    }
+    const entries = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (UNSAFE_OBJECT_KEYS.has(name)) {
+            continue;
+        }
+        const parsed = parseEntry(value);
+        if (parsed !== null) {
+            entries[name] = parsed;
+        }
+    }
+    return entries;
+}
+function parseApprovalEntry(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const decision = value.decision;
+    if (decision !== "allow" && decision !== "deny") {
+        return null;
+    }
+    if (typeof value.scriptsHash !== "string" || typeof value.approvedAt !== "string") {
+        return null;
+    }
+    const provenance = value.provenance;
+    if (provenance !== "prompt" && provenance !== "command" && provenance !== "imported-pnpm") {
+        return null;
+    }
+    return {
+        decision,
+        scriptsHash: value.scriptsHash,
+        hooks: parseHooks(value.hooks),
+        ...(typeof value.approvedVersion === "string" ? { approvedVersion: value.approvedVersion } : {}),
+        ...(typeof value.reason === "string" ? { reason: value.reason } : {}),
+        approvedAt: value.approvedAt,
+        provenance
+    };
+}
+function parseObservedEntry(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    if (typeof value.version !== "string" || typeof value.scriptsHash !== "string" || typeof value.firstSeen !== "string") {
+        return null;
+    }
+    return {
+        version: value.version,
+        hooks: parseHooks(value.hooks),
+        scriptsHash: value.scriptsHash,
+        firstSeen: value.firstSeen
+    };
+}
+function parseHooks(raw) {
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    return SCRIPT_HOOKS.filter((hook) => raw.includes(hook));
+}
+function sortedRecord(record) {
+    const sorted = {};
+    for (const key of Object.keys(record).sort()) {
+        sorted[key] = record[key];
+    }
+    return sorted;
+}
+function unknownKeysOf(raw, known) {
+    const unknown = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (!known.has(key) && !UNSAFE_OBJECT_KEYS.has(key)) {
+            unknown[key] = value;
+        }
+    }
+    return unknown;
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function emptyScriptApprovals() {
+    return { npm: {}, observed: {}, unknownKeys: {} };
+}
+function failOpen(path, failure) {
+    return { path, exists: true, readable: false, failure, raw: {}, decisions: [], cooldownExemptions: [], scriptApprovals: emptyScriptApprovals() };
+}

package/dist/proxy/auth.js

@@ -0,0 +1,42 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export const PROXY_AUTH_TOKEN_FILENAME = "proxy-auth-token";
+export const PROXY_AUTH_USER = "dg";
+export function generateProxyAuthToken() {
+    return randomBytes(32).toString("hex");
+}
+export function proxyAuthTokenPath(sessionDir) {
+    return join(sessionDir, PROXY_AUTH_TOKEN_FILENAME);
+}
+export function writeProxyAuthToken(sessionDir, token) {
+    writeFileSync(proxyAuthTokenPath(sessionDir), `${token}\n`, {
+        encoding: "utf8",
+        mode: 0o600
+    });
+}
+export function readProxyAuthToken(sessionDir) {
+    try {
+        const token = readFileSync(proxyAuthTokenPath(sessionDir), "utf8").trim();
+        return token.length > 0 ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function proxyUrlWithAuth(proxyUrl, token) {
+    const url = new URL(proxyUrl);
+    return `${url.protocol}//${PROXY_AUTH_USER}:${token}@${url.host}`;
+}
+export function proxyAuthorizationValue(token) {
+    return `Basic ${Buffer.from(`${PROXY_AUTH_USER}:${token}`, "utf8").toString("base64")}`;
+}
+export function verifyProxyAuthorization(header, token) {
+    if (typeof header !== "string" || header.length === 0) {
+        return false;
+    }
+    return timingSafeEqual(digest(header), digest(proxyAuthorizationValue(token)));
+}
+function digest(value) {
+    return createHash("sha256").update(value, "utf8").digest();
+}

package/dist/proxy/ca.js

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { generateKeyPairSync, randomBytes } from "node:crypto";
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { isIP } from "node:net";
@@ -17,6 +17,12 @@ export function createEphemeralCertificateAuthority(caPath, options = {}) {
         }
         active = issueAuthority(caPath, lifetimeMs, now(), active.certPem);
         leafs.clear();
+        try {
+            options.onRotate?.(active.certPem);
+        }
+        catch {
+            return;
+        }
     };
     setInterval(rotateIfDue, ROTATION_CHECK_INTERVAL_MS).unref();
     return {
@@ -37,11 +43,24 @@ export function createEphemeralCertificateAuthority(caPath, options = {}) {
         }
     };
 }
-function issueAuthority(caPath, lifetimeMs, nowMs, previousCertPem) {
-    const keys = forge.pki.rsa.generateKeyPair({
-        bits: 2048,
-        workers: -1
+// node:crypto keygen piped into forge via PEM so keygen never falls back to forge's pure-JS path.
+function generateRsaKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+        modulusLength: 2048
     });
+    return {
+        privateKey: forge.pki.privateKeyFromPem(privateKey.export({
+            type: "pkcs8",
+            format: "pem"
+        }).toString()),
+        publicKey: forge.pki.publicKeyFromPem(publicKey.export({
+            type: "spki",
+            format: "pem"
+        }).toString())
+    };
+}
+function issueAuthority(caPath, lifetimeMs, nowMs, previousCertPem) {
+    const keys = generateRsaKeyPair();
     const cert = forge.pki.createCertificate();
     cert.publicKey = keys.publicKey;
     cert.serialNumber = serialNumber();
@@ -65,6 +84,10 @@ function issueAuthority(caPath, lifetimeMs, nowMs, previousCertPem) {
             cRLSign: true,
             critical: true
         },
+        {
+            name: "extKeyUsage",
+            serverAuth: true
+        },
         {
             name: "subjectKeyIdentifier"
         }
@@ -102,10 +125,7 @@ function writeCaBundleAtomic(caPath, bundle) {
     }
 }
 function createLeafCertificate(host, issuer, lifetimeMs, nowMs) {
-    const keys = forge.pki.rsa.generateKeyPair({
-        bits: 2048,
-        workers: -1
-    });
+    const keys = generateRsaKeyPair();
     const cert = forge.pki.createCertificate();
     cert.publicKey = keys.publicKey;
     cert.serialNumber = serialNumber();

package/dist/proxy/cooldown-exemptions-file.js

@@ -0,0 +1,33 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseCooldownExemption } from "../project/dgfile.js";
+export const COOLDOWN_EXEMPTIONS_FILE = "cooldown-exemptions.json";
+export const COOLDOWN_EXEMPTIONS_ENV = "DG_PROXY_COOLDOWN_EXEMPTIONS_FILE";
+export function writeCooldownExemptionsFile(sessionDir, exemptions) {
+    if (exemptions.length === 0) {
+        return {};
+    }
+    try {
+        const path = join(sessionDir, COOLDOWN_EXEMPTIONS_FILE);
+        writeFileSync(path, JSON.stringify(exemptions), { encoding: "utf8", mode: 0o600 });
+        return { [COOLDOWN_EXEMPTIONS_ENV]: path };
+    }
+    catch {
+        return {};
+    }
+}
+export function loadCooldownExemptionsFile(path) {
+    if (!path) {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!Array.isArray(parsed)) {
+            return [];
+        }
+        return parsed.map((entry) => parseCooldownExemption(entry)).filter((entry) => entry !== null);
+    }
+    catch {
+        return [];
+    }
+}

package/dist/proxy/enforcement.js

@@ -1,5 +1,5 @@
 import { recordAuditEvent } from "../audit/events.js";
-import { loadUserConfig } from "../config/settings.js";
+import { DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
 import { applyForceOverride, evaluatePackagePolicy, resolveEffectivePolicy } from "../policy/evaluate.js";
 export function parseForceOverrideRequest(raw) {
     if (!raw) {
@@ -16,8 +16,31 @@ export function parseForceOverrideRequest(raw) {
         return undefined;
     }
 }
+let sideEffectFailureNoticed = false;
+export function noteEnforcementSideEffectFailure(error) {
+    if (sideEffectFailureNoticed) {
+        return;
+    }
+    sideEffectFailureNoticed = true;
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+        process.stderr.write(`dg: local state read/write failed (${message}); the install decision is still enforced.\n`);
+    }
+    catch {
+        return;
+    }
+}
+function loadUserConfigOrDefault(env) {
+    try {
+        return loadUserConfig(env);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+        return DEFAULT_CONFIG;
+    }
+}
 export function enforceProtectedInstall(request) {
-    const userConfig = request.userConfig ?? loadUserConfig(request.env);
+    const userConfig = request.userConfig ?? loadUserConfigOrDefault(request.env);
     const policy = resolveEffectivePolicy({ userConfig });
     const proxyVerdict = request.proxyVerdict ?? failClosedVerdict(request.classification);
     const packageName = proxyVerdict.packageName ?? derivePackageName(request.classification);
@@ -39,13 +62,24 @@ export function enforceProtectedInstall(request) {
     if (baseDecision.action !== "block") {
         return baseDecision;
     }
-    const force = applyForceOverride({
-        packageName,
-        currentAction: "block",
-        force: request.forceOverride?.force ?? false,
-        policy,
-        ...(request.now ? { now: request.now } : {})
-    }, request.env);
+    let force;
+    try {
+        force = applyForceOverride({
+            packageName,
+            currentAction: "block",
+            force: request.forceOverride?.force ?? false,
+            policy,
+            ...(request.now ? { now: request.now } : {})
+        }, request.env);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+        force = {
+            allowed: false,
+            reason: "force override is unavailable because dg local state could not be read or written",
+            auditRecorded: false
+        };
+    }
     if (force.allowed) {
         return {
             ...baseDecision,
@@ -57,13 +91,18 @@ export function enforceProtectedInstall(request) {
             }
         };
     }
-    recordAuditEvent({
-        type: "install.blocked",
-        packageName,
-        reason: baseDecision.reason,
-        policyMode: policy.mode,
-        createdAt: (request.now ?? new Date()).toISOString()
-    }, request.env);
+    try {
+        recordAuditEvent({
+            type: "install.blocked",
+            packageName,
+            reason: baseDecision.reason,
+            policyMode: policy.mode,
+            createdAt: (request.now ?? new Date()).toISOString()
+        }, request.env);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+    }
     if (!request.forceOverride?.force) {
         return baseDecision;
     }
@@ -140,6 +179,7 @@ function withOptionalDecisionFields(decision, verdict) {
         ...(verdict.dashboardUrl ? { dashboardUrl: verdict.dashboardUrl } : {}),
         ...(verdict.unauthenticated ? { unauthenticated: true } : {}),
         ...(verdict.resetsAt ? { resetsAt: verdict.resetsAt } : {}),
-        ...(verdict.quotaBehavior ? { quotaBehavior: verdict.quotaBehavior } : {})
+        ...(verdict.quotaBehavior ? { quotaBehavior: verdict.quotaBehavior } : {}),
+        ...(verdict.cooldown ? { cooldown: verdict.cooldown } : {})
     };
 }