@westbayberry/dg 2.0.11 → 2.2.0

package/dist/scan/command.js

@@ -1,5 +1,7 @@
-import { writeFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { writeReportAtomic } from "../util/report-writer.js";
+import { findProjectRoot, loadDgFile, warnUnreadableDgFile } from "../project/dgfile.js";
 import { scanProject } from "./discovery.js";
 import { renderJsonReport, renderSarifReport, renderTextReport } from "./render.js";
 import { resolvePresentation } from "../presentation/mode.js";
@@ -9,7 +11,7 @@ import { runScannerScan } from "./scanner-report.js";
 import { runStagedScan, stagedScanReport } from "./staged.js";
 import { scanExitCode } from "../scan-ui/shims.js";
 import { loadUserConfig } from "../config/settings.js";
-import { EXIT_USAGE_VERDICT } from "../commands/types.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_NOTHING_TO_SCAN, EXIT_USAGE_VERDICT } from "../commands/types.js";
 export function runScanCommand(context) {
     const parsed = parseScanArgs(context.args);
     if ("error" in parsed) {
@@ -18,12 +20,12 @@ export function runScanCommand(context) {
     const stagedTarget = parsed.sawTarget ? parsed.targetPath : null;
     const machineOutput = parsed.format !== "text" || parsed.outputPath !== null;
     if (parsed.staged && !machineOutput) {
-        return runStagedScan({ hook: parsed.hook, targetPath: stagedTarget });
+        return runStagedScan({ hook: parsed.hook, targetPath: stagedTarget, useDecisions: !parsed.noDecisions });
     }
     let report;
     let outcome;
     if (parsed.staged) {
-        const staged = stagedScanReport({ targetPath: stagedTarget });
+        const staged = stagedScanReport({ targetPath: stagedTarget, useDecisions: !parsed.noDecisions });
         if ("result" in staged) {
             return staged.result;
         }
@@ -53,12 +55,12 @@ export function runScanCommand(context) {
         }
         catch (error) {
             return {
-                exitCode: 1,
+                exitCode: EXIT_ANALYSIS_INCOMPLETE,
                 stdout: "",
                 stderr: `dg scan failed: ${error instanceof Error ? error.message : "unknown scan error"}\n`
             };
         }
-        outcome = runScannerScan(parsed.targetPath, report);
+        outcome = runScannerScan(parsed.targetPath, report, process.env, parsed.noDecisions ? null : loadScanDecisions(parsed.targetPath));
     }
     if (outcome.kind === "report") {
         report = outcome.report;
@@ -68,26 +70,32 @@ export function runScanCommand(context) {
     }
     const skipNotice = skipNoticeFor(outcome, report);
     const scannerUnavailable = !report.scanner && report.summary.projectCount > 0;
-    const rendered = renderReport(report, parsed.format, scannerUnavailable, skipNotice);
+    const nothingToScan = !parsed.staged &&
+        !report.scanner &&
+        !report.scannerError &&
+        report.summary.projectCount === 0 &&
+        report.summary.errorCount === 0;
+    const exitCode = nothingToScan ? EXIT_NOTHING_TO_SCAN : exitCodeForReport(report);
+    const rendered = renderReport(report, parsed.format, scannerUnavailable, skipNotice, nothingToScan);
     if (parsed.outputPath) {
         try {
-            writeFileSync(resolve(parsed.outputPath), rendered, "utf8");
+            writeReportAtomic(resolve(parsed.outputPath), rendered);
         }
         catch (error) {
             return {
-                exitCode: 1,
+                exitCode: EXIT_ANALYSIS_INCOMPLETE,
                 stdout: "",
                 stderr: `dg scan could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
             };
         }
         return {
-            exitCode: exitCodeForReport(report),
+            exitCode,
             stdout: `Wrote ${parsed.format} scan report to ${parsed.outputPath}\n`,
             stderr: ""
         };
     }
     return {
-        exitCode: exitCodeForReport(report),
+        exitCode,
         stdout: rendered,
         stderr: ""
     };
@@ -99,6 +107,7 @@ function parseScanArgs(args) {
     let sawTarget = false;
     let staged = false;
     let hook = false;
+    let noDecisions = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (!arg) {
@@ -112,6 +121,10 @@ function parseScanArgs(args) {
             hook = true;
             continue;
         }
+        if (arg === "--no-decisions") {
+            noDecisions = true;
+            continue;
+        }
         if (arg === "--json") {
             if (format !== "text") {
                 return { error: "choose only one output format" };
@@ -150,16 +163,35 @@ function parseScanArgs(args) {
         targetPath,
         sawTarget,
         staged,
-        hook
+        hook,
+        noDecisions
     };
 }
 function usageError(message) {
     return {
         exitCode: EXIT_USAGE_VERDICT,
         stdout: "",
-        stderr: `dg scan: ${message}. Usage: dg scan [path] [--json|--sarif] [--output <path>]\n`
+        stderr: `dg scan: ${message}. Usage: dg scan [path] [--json|--sarif] [--output <path>] [--no-decisions]\n`
     };
 }
+function loadScanDecisions(targetPath, env = process.env) {
+    let dir = resolve(targetPath);
+    try {
+        if (!statSync(dir).isDirectory()) {
+            dir = dirname(dir);
+        }
+    }
+    catch {
+        return null;
+    }
+    const root = findProjectRoot(dir, env);
+    if (!root) {
+        return null;
+    }
+    const file = loadDgFile(root);
+    warnUnreadableDgFile(file);
+    return file.readable ? file : null;
+}
 function degradeReport(report, error) {
     const status = report.status === "block" || report.status === "warn" ? report.status : "unknown";
     return { ...report, status, scannerError: error };
@@ -173,9 +205,9 @@ function skipNoticeFor(outcome, report) {
     }
     return "empty_lockfile";
 }
-function renderReport(report, format, scannerUnavailable, skipNotice) {
+function renderReport(report, format, scannerUnavailable, skipNotice, nothingToScan) {
     if (format === "json") {
-        return renderJsonReport(report, scannerUnavailable);
+        return renderJsonReport(report, scannerUnavailable, nothingToScan);
     }
     if (format === "sarif") {
         return renderSarifReport(report);
@@ -184,7 +216,9 @@ function renderReport(report, format, scannerUnavailable, skipNotice) {
 }
 function exitCodeForReport(report) {
     if (report.scanner) {
-        return scanExitCode(report.scanner.action, loadUserConfig().policy.mode);
+        const mode = loadUserConfig().policy.mode;
+        const action = mode === "strict" ? report.scanner.action : report.decisions?.effectiveAction ?? report.scanner.action;
+        return scanExitCode(action, mode);
     }
     if (report.status === "block") {
         return 2;

package/dist/scan/discovery.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
+import { resolveToolPath } from "../util/external-tool.js";
 const IGNORED_DIRECTORIES = new Set([
     ".git",
     ".hg",
@@ -113,8 +114,12 @@ export function gitIgnoredDirectories(root) {
     return ignored;
 }
 function insideGitWorkTree(root) {
+    const git = resolveToolPath("git");
+    if (!git) {
+        return false;
+    }
     try {
-        const out = execFileSync("git", ["-C", root, "rev-parse", "--is-inside-work-tree"], {
+        const out = execFileSync(git, ["-C", root, "rev-parse", "--is-inside-work-tree"], {
             encoding: "utf8",
             timeout: 3000,
             stdio: ["ignore", "pipe", "ignore"]
@@ -126,8 +131,12 @@ function insideGitWorkTree(root) {
     }
 }
 function checkIgnoreBatch(root, directories) {
+    const git = resolveToolPath("git");
+    if (!git) {
+        return new Set();
+    }
     try {
-        const out = execFileSync("git", ["-C", root, "check-ignore", "--stdin", "-z"], {
+        const out = execFileSync(git, ["-C", root, "check-ignore", "--stdin", "-z"], {
             input: directories.join("\0"),
             encoding: "utf8",
             timeout: 5000,

package/dist/scan/render.js

@@ -1,4 +1,6 @@
 import { createTheme } from "../presentation/theme.js";
+import { packagePageUrl } from "../presentation/package-page.js";
+import { sanitizeDeep } from "../security/sanitize.js";
 const DETAIL_PROJECT_LIMIT = 8;
 const CLEAN_PROJECT_PREVIEW_LIMIT = 5;
 const FINDING_GROUP_PREVIEW_LIMIT = 3;
@@ -16,22 +18,29 @@ const SCANNER_SKIP_MESSAGES = {
     no_lockfile: "no lockfile found — server verification skipped (local heuristics only)",
     empty_lockfile: "lockfile contains no scannable packages — server verification skipped (local heuristics only)"
 };
-export function renderTextReport(report, terminalWidth = terminalWidthFromEnv(), theme = createTheme(false), scannerNotice) {
+export function renderTextReport(rawReport, terminalWidth = terminalWidthFromEnv(), theme = createTheme(false), scannerNotice) {
+    const report = sanitizeDeep(rawReport);
     const width = Math.max(48, Math.min(terminalWidth, 140));
     const cleanProjects = report.projects.filter((project) => project.findings.length === 0);
     const findingProjects = report.projects.filter((project) => project.findings.length > 0);
     const shouldCollapseProjects = report.projects.length > DETAIL_PROJECT_LIMIT;
+    const acknowledgedCount = report.decisions?.acknowledgedCount ?? 0;
+    const activeFindings = report.findings.filter((finding) => !finding.acknowledged);
     const lines = [
         "Dependency Guardian scan",
         `Target: ${report.target}`,
         `Scanning: checked ${report.summary.projectCount} project manifest${report.summary.projectCount === 1 ? "" : "s"}.`,
-        `Status: ${theme.paint(SCAN_STATUS_ROLE[report.status], displayScanStatus(report))}`,
+        `Status: ${paintEffectiveStatus(report, theme)}`,
         `Projects: ${report.summary.projectCount}`,
         `Dependencies: ${report.summary.dependencyCount}`,
-        `Findings: ${report.summary.findingCount} (${report.summary.warnCount} warn, ${report.summary.blockCount} block)`,
+        `Findings: ${report.summary.findingCount} (${report.summary.warnCount} warn, ${report.summary.blockCount} block)${acknowledgedCount > 0 ? ` · ${acknowledgedCount} acknowledged` : ""}`,
+        ...(acknowledgedCount > 0
+            ? [`Acknowledged: ${acknowledgedCount} warn verdict${acknowledgedCount === 1 ? "" : "s"} accepted in dg.json — run 'dg decisions' to review`]
+            : []),
         ...(report.scanner
             ? [`Scanner: score ${report.scanner.score}, ${report.scanner.packages.length} packages verified`]
             : []),
+        ...(report.scanner ? provenanceDowngradeLines(report.scanner.packages, theme) : []),
         ""
     ];
     if (report.scannerError) {
@@ -52,7 +61,7 @@ export function renderTextReport(report, terminalWidth = terminalWidthFromEnv(),
     }
     if (findingProjects.length > 0) {
         lines.push("Finding groups:");
-        for (const group of groupFindings(report.findings)) {
+        for (const group of groupFindings(activeFindings)) {
             const severityLabel = theme.paint(group.severity === "block" ? "block" : "warn", group.severity.toUpperCase());
             lines.push(`  ${severityLabel} ${group.id}: ${group.count} finding${group.count === 1 ? "" : "s"} across ${group.projectCount} project${group.projectCount === 1 ? "" : "s"}`);
             for (const finding of group.examples) {
@@ -89,11 +98,46 @@ export function renderTextReport(report, terminalWidth = terminalWidthFromEnv(),
             lines.push("");
         }
     }
+    lines.push(...packagePageLines(report, theme));
     for (const error of report.errors) {
         lines.push(...wrapLine(`ERROR ${error.location}: `, error.message, width));
     }
     return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
 }
+function packagePageLines(report, theme) {
+    const urls = [];
+    const seen = new Set();
+    for (const pkg of report.scanner?.packages ?? []) {
+        const action = pkg.action ?? "pass";
+        if (action !== "block" && action !== "warn") {
+            continue;
+        }
+        const url = packagePageUrl(pkg.ecosystem ?? "", pkg.name);
+        if (url && !seen.has(url)) {
+            seen.add(url);
+            urls.push(url);
+        }
+    }
+    if (urls.length === 0) {
+        return [];
+    }
+    return ["Full report for each flagged package:", ...urls.map((url) => `  ${theme.paint("muted", url)}`), ""];
+}
+function provenanceDowngradeLines(packages, theme) {
+    return packages
+        .filter((pkg) => pkg.provenance?.downgrade)
+        .map((pkg) => theme.paint("warn", `Provenance downgrades: ${pkg.name}@${pkg.version} (was attested at ${pkg.provenance.downgrade.fromVersion})`));
+}
+function paintEffectiveStatus(report, theme) {
+    if (report.scanner && report.decisions && !report.scannerError) {
+        const action = report.decisions.effectiveAction;
+        if (action === "analysis_incomplete") {
+            return theme.paint("unknown", "analysis_incomplete");
+        }
+        return theme.paint(SCAN_STATUS_ROLE[action], action);
+    }
+    return theme.paint(SCAN_STATUS_ROLE[report.status], displayScanStatus(report));
+}
 function formatProject(project, width) {
     const lines = [];
     const version = project.version ? `@${project.version}` : "";
@@ -111,8 +155,8 @@ function formatProject(project, width) {
     }
     return lines;
 }
-export function renderJsonReport(report, scannerUnavailable = false) {
-    return `${JSON.stringify({ ...report, status: displayScanStatus(report), scannerUnavailable }, null, 2)}\n`;
+export function renderJsonReport(report, scannerUnavailable = false, nothingToScan = false) {
+    return `${JSON.stringify({ schemaVersion: 1, ...report, status: nothingToScan ? "nothing_to_scan" : displayScanStatus(report), scannerUnavailable }, null, 2)}\n`;
 }
 export function renderSarifReport(report) {
     const rules = uniqueFindings(report.findings).map((finding) => ({
@@ -154,7 +198,17 @@ export function renderSarifReport(report) {
                                 }
                             }
                         }
-                    ]
+                    ],
+                    ...(finding.acknowledged
+                        ? {
+                            suppressions: [
+                                {
+                                    kind: "external",
+                                    justification: finding.acknowledged.reason || `accepted by ${finding.acknowledged.by}`
+                                }
+                            ]
+                        }
+                        : {})
                 }))
             }
         ]
@@ -250,7 +304,8 @@ function wrapLine(prefix, text, width) {
     return lines.map((line, index) => `${index === 0 ? prefix : continuation}${line}`);
 }
 function terminalWidthFromEnv() {
-    const value = process.env.DG_TEST_TERMINAL_WIDTH ?? String(process.stdout.columns ?? 100);
+    const override = process.env.NODE_ENV === "test" ? process.env.DG_TEST_TERMINAL_WIDTH : undefined;
+    const value = override ?? String(process.stdout.columns ?? 100);
     const parsed = Number.parseInt(value, 10);
     return Number.isFinite(parsed) ? parsed : 100;
 }

package/dist/scan/scanner-report.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { applyDecisions, packageKey } from "../decisions/apply.js";
 import { sanitize } from "../security/sanitize.js";
 import { collectScanPackages, discoverScanProjects } from "./collect.js";
 const WORKER_TIMEOUT_BASE_MS = 180_000;
@@ -12,7 +13,7 @@ const WORKER_MAX_BUFFER = 64 * 1024 * 1024;
 export function scanWorkerTimeoutMs(packageCount) {
     return WORKER_TIMEOUT_BASE_MS + packageCount * Math.ceil(SERVER_PER_PACKAGE_WORST_CASE_MS / SERVER_SCAN_CONCURRENCY);
 }
-export function runScannerScan(targetPath, localReport, env = process.env) {
+export function runScannerScan(targetPath, localReport, env = process.env, decisionsFile = null) {
     const projects = discoverScanProjects(resolve(targetPath));
     if (projects.length === 0) {
         return { kind: "skipped", reason: "no_lockfiles" };
@@ -58,12 +59,38 @@ export function runScannerScan(targetPath, localReport, env = process.env) {
             error: { kind: "invalid_response", message: "scanner worker returned unreadable output" }
         };
     }
-    return { kind: "report", report: buildScannerReport(localReport, response, total) };
+    const ecosystems = new Map();
+    for (const group of groups) {
+        for (const pkg of group.packages) {
+            ecosystems.set(packageKey(pkg.name, pkg.version), group.ecosystem);
+        }
+    }
+    const report = buildScannerReport(localReport, response, total, ecosystems);
+    if (!decisionsFile?.readable) {
+        return { kind: "report", report };
+    }
+    return { kind: "report", report: annotateReportWithDecisions(report, decisionsFile, ecosystems) };
 }
-export function tryScannerScan(targetPath, localReport, env = process.env) {
-    const outcome = runScannerScan(targetPath, localReport, env);
+export function tryScannerScan(targetPath, localReport, env = process.env, decisionsFile = null) {
+    const outcome = runScannerScan(targetPath, localReport, env, decisionsFile);
     return outcome.kind === "report" ? outcome.report : null;
 }
+export function annotateReportWithDecisions(report, decisionsFile, ecosystems) {
+    if (!report.scanner || !decisionsFile.readable) {
+        return report;
+    }
+    const applied = applyDecisions(report.scanner.packages, (pkg) => ecosystems.get(packageKey(pkg.name, pkg.version)), decisionsFile, report.scanner.action);
+    const findings = report.findings.map((finding) => {
+        const acknowledged = applied.packages[finding.location]?.acknowledged;
+        return acknowledged && finding.severity === "warn" ? { ...finding, acknowledged } : finding;
+    });
+    return {
+        ...report,
+        findings,
+        summary: { ...report.summary, acknowledgedCount: applied.acknowledgedCount },
+        decisions: applied
+    };
+}
 export function workerFailure(worker, timeoutMs, packageCount) {
     if (worker.error?.code === "ETIMEDOUT") {
         return {
@@ -103,9 +130,9 @@ function parseWorkerError(stdout) {
     return null;
 }
 function lockfileParseError(projects, collected) {
-    const parseErrors = collected.parseErrors ?? [];
+    const parseErrors = collected.parseErrors;
     const detail = parseErrors
-        .map((entry) => [entry.path, entry.message].filter(Boolean).join(": "))
+        .map((entry) => [entry.file, entry.reason].filter(Boolean).join(": "))
         .filter((line) => line.length > 0)
         .join("; ");
     const lockfiles = [...new Set(projects.map((project) => project.depFile))].join(", ");
@@ -116,8 +143,14 @@ function lockfileParseError(projects, collected) {
             : `found ${projects.length} lockfile${projects.length === 1 ? "" : "s"} (${lockfiles}) but no packages could be parsed`
     };
 }
-export function buildScannerReport(localReport, response, analyzedCount) {
-    const findings = response.packages
+export function buildScannerReport(localReport, response, analyzedCount, ecosystems) {
+    const packages = ecosystems
+        ? response.packages.map((pkg) => {
+            const ecosystem = ecosystems.get(packageKey(pkg.name, pkg.version));
+            return ecosystem ? { ...pkg, ecosystem } : pkg;
+        })
+        : response.packages;
+    const findings = packages
         .filter((pkg) => (pkg.action ?? "pass") !== "pass")
         .map((pkg) => scannerFinding(pkg));
     const warnCount = findings.filter((finding) => finding.severity === "warn").length;
@@ -136,7 +169,7 @@ export function buildScannerReport(localReport, response, analyzedCount) {
             blockCount,
             errorCount: localReport.summary.errorCount
         },
-        scanner: response
+        scanner: { ...response, packages }
     };
 }
 function scannerFinding(pkg) {

package/dist/scan/staged.js

@@ -4,6 +4,9 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "nod
 import { createTheme } from "../presentation/theme.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { loadUserConfig } from "../config/settings.js";
+import { offerRememberSync } from "../decisions/remember-prompt.js";
+import { packageKey } from "../decisions/apply.js";
+import { loadDgFile, resolveAcceptedBy, warnUnreadableDgFile } from "../project/dgfile.js";
 import { gitSync, gitTrimmed } from "../util/git.js";
 import { promptYesNo } from "../util/tty-prompt.js";
 import { GUARD_SELFTEST_ENV } from "../setup/git-hook.js";
@@ -67,7 +70,8 @@ export function runStagedScan(options) {
     const env = options.env ?? process.env;
     const cwd = options.cwd ?? process.cwd();
     const theme = createTheme(resolvePresentation().color);
-    if (env[GUARD_SELFTEST_ENV] === "1") {
+    // git exports GIT_INDEX_FILE to real pre-commit runs; its absence separates dg's hook self-test from a user commit that inherited the env var.
+    if (options.hook && env[GUARD_SELFTEST_ENV] === "1" && env.GIT_INDEX_FILE === undefined) {
         return { exitCode: 2, stdout: "", stderr: "dg guard-commit self-test: synthetic block (exit 2)\n" };
     }
     const root = gitTrimmed(["rev-parse", "--show-toplevel"], { cwd, env });
@@ -85,16 +89,21 @@ export function runStagedScan(options) {
     if (scoped.length === 0) {
         return { exitCode: 0, stdout: "", stderr: "" };
     }
+    const dgFile = options.useDecisions === false ? null : loadDgFile(root);
+    if (dgFile) {
+        warnUnreadableDgFile(dgFile);
+    }
+    const usableDgFile = dgFile?.readable ? dgFile : null;
     const { dir, count } = materializeStaged(scoped, cwd, env);
     try {
         if (count === 0) {
             return failOpen(theme, "could not read the staged lockfile contents");
         }
-        const report = tryScannerScan(dir, emptyLocalReport(dir), env);
+        const report = tryScannerScan(dir, emptyLocalReport(dir), env, usableDgFile);
         if (!report || !report.scanner) {
             return failOpen(theme, "could not reach the scanner");
         }
-        return decideStagedVerdict(report, env, options.hook);
+        return decideStagedVerdict(report, env, options.hook, usableDgFile ? { root, file: usableDgFile } : undefined);
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -119,12 +128,16 @@ export function stagedScanReport(options) {
     if (scoped.length === 0) {
         return { report: base, outcome: { kind: "skipped", reason: "no_lockfiles" } };
     }
+    const dgFile = options.useDecisions === false ? null : loadDgFile(root);
+    if (dgFile) {
+        warnUnreadableDgFile(dgFile);
+    }
     const { dir, count } = materializeStaged(scoped, cwd, env);
     try {
         if (count === 0) {
             return { report: base, outcome: { kind: "failed", error: { kind: "worker", message: "could not read the staged lockfile contents" } } };
         }
-        return { report: base, outcome: runScannerScan(dir, base, env) };
+        return { report: base, outcome: runScannerScan(dir, base, env, dgFile?.readable ? dgFile : null) };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -144,11 +157,13 @@ function notARepoResult() {
 function outsideRepoResult(targetPath) {
     return { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg scan --staged: ${targetPath} is outside this repository.\n` };
 }
-export function decideStagedVerdict(report, env = process.env, hook = false) {
+export function decideStagedVerdict(report, env = process.env, hook = false, decisionContext) {
     const theme = createTheme(resolvePresentation().color);
     const action = report.scanner?.action ?? report.status;
     const config = loadUserConfig(env);
     const count = report.summary.dependencyCount;
+    const effective = config.policy.mode === "strict" ? action : report.decisions?.effectiveAction ?? action;
+    const acknowledgedCount = report.decisions?.acknowledgedCount ?? 0;
     if (action === "block") {
         return { exitCode: 2, stdout: "", stderr: renderBlock(report.findings, theme) };
     }
@@ -156,17 +171,61 @@ export function decideStagedVerdict(report, env = process.env, hook = false) {
         return scannerUnavailable(theme);
     }
     if (action === "warn") {
-        return decideWarn(report.findings, theme, config.gitHook.onWarn, config.policy.mode, hook);
+        if (acknowledgedCount > 0 && effective === "pass") {
+            return {
+                exitCode: 0,
+                stdout: "",
+                stderr: `  ${theme.paint("pass", "✓")} ${theme.paint("muted", `DG verified ${count} staged package${count === 1 ? "" : "s"} — ${acknowledgedCount} warning${acknowledgedCount === 1 ? "" : "s"} previously accepted (dg.json)`)}\n`
+            };
+        }
+        if (acknowledgedCount > 0 && effective === "analysis_incomplete") {
+            return decideIncomplete(config.gitHook.onIncomplete, theme);
+        }
+        const activeFindings = report.findings.filter((finding) => !finding.acknowledged);
+        return decideWarn(activeFindings, theme, config.gitHook.onWarn, config.policy.mode, hook, stagedRememberOffer(report, decisionContext, env));
     }
     if (action === "analysis_incomplete") {
-        if (config.gitHook.onIncomplete === "block") {
-            return { exitCode: 1, stdout: "", stderr: incompleteNotice(theme, true) };
-        }
-        return { exitCode: 0, stdout: "", stderr: incompleteNotice(theme, false) };
+        return decideIncomplete(config.gitHook.onIncomplete, theme);
     }
     return { exitCode: 0, stdout: "", stderr: `  ${theme.paint("pass", "✓")} ${theme.paint("muted", `DG verified ${count} staged package${count === 1 ? "" : "s"} — clean`)}\n` };
 }
-function decideWarn(findings, theme, onWarn, policyMode, hook) {
+function decideIncomplete(onIncomplete, theme) {
+    if (onIncomplete === "block") {
+        return { exitCode: 1, stdout: "", stderr: incompleteNotice(theme, true) };
+    }
+    return { exitCode: 0, stdout: "", stderr: incompleteNotice(theme, false) };
+}
+export function stagedRememberOffer(report, decisionContext, env) {
+    if (!decisionContext || !report.scanner || !report.decisions) {
+        return undefined;
+    }
+    const annotations = report.decisions.packages;
+    const packages = [];
+    for (const pkg of report.scanner.packages) {
+        if ((pkg.action ?? "pass") !== "warn") {
+            continue;
+        }
+        const annotation = annotations[packageKey(pkg.name, pkg.version)];
+        if (!annotation || annotation.acknowledged) {
+            continue;
+        }
+        packages.push({ ecosystem: annotation.ecosystem, name: pkg.name, version: pkg.version, findings: pkg.findings });
+    }
+    if (packages.length === 0) {
+        return undefined;
+    }
+    return () => {
+        offerRememberSync({
+            file: decisionContext.file,
+            packages,
+            acceptedBy: resolveAcceptedBy(decisionContext.root, env),
+            surface: "guard-commit",
+            env,
+            ...(decisionContext.prompts ? { prompts: decisionContext.prompts } : {})
+        });
+    };
+}
+function decideWarn(findings, theme, onWarn, policyMode, hook, onAccepted) {
     const summary = warnSummary(findings, theme);
     if (onWarn === "allow") {
         return { exitCode: 0, stdout: "", stderr: `${summary}  ${theme.paint("muted", "proceeding (gitHook.onWarn=allow)")}\n` };
@@ -183,6 +242,7 @@ function decideWarn(findings, theme, onWarn, policyMode, hook) {
         return { exitCode: 1, stdout: "", stderr: `${summary}  ${theme.paint("muted", `commit blocked (no terminal; policy ${policyMode}). Use`)} ${theme.paint("accent", "git commit --no-verify")} ${theme.paint("muted", "to override.")}\n` };
     }
     if (answer) {
+        onAccepted?.();
         return { exitCode: 0, stdout: "", stderr: "" };
     }
     return { exitCode: 1, stdout: "", stderr: `  ${theme.paint("muted", "Nothing was committed.")}\n` };