@westbayberry/dg 2.0.11 → 2.2.0

package/dist/scan-ui/components/ProgressBar.js

@@ -4,11 +4,7 @@ import { Text, Box } from "ink";
 import InkSpinner from "ink-spinner";
 import chalk from "chalk";
 import { useTerminalSize } from "../hooks/useTerminalSize.js";
-// Measured ETA: extrapolates remaining time from the throughput observed so far.
-// `value` and `total` are the same numbers the bar renders; `elapsedSeconds` is
-// the wall-clock since the bar mounted. Returns null fields when there's not
-// enough signal yet (value == 0 or elapsed == 0) so the UI can show
-// "calculating…" instead of a misleading number.
+// Null fields until value/elapsed are non-zero so the UI shows "calculating…".
 export function computeEta(value, total, elapsedSeconds) {
     if (value <= 0 || elapsedSeconds <= 0 || total <= 0) {
         return { remainingSeconds: null, ratePerSec: null };
@@ -68,17 +64,10 @@ export const ProgressBar = ({ value, total, label, }) => {
         timeInfo = `${formatTime(elapsed)} elapsed · ~${formatTime(eta.remainingSeconds)} left${rateInline}`;
     }
     const counter = `${value}/${total}  ${percent}%`;
-    // Width thresholds:
-    //   < 30 cols → compact: counter only, no bar (bar would soft-wrap and
-    //               break Ink's line-count tracker, leaving stale lines
-    //               above on the next redraw).
-    //   30-59     → narrow bar (no elapsed-time tail beside the spinner).
-    //   >= 60     → full bar + tail.
+    // Below 30 cols the bar would soft-wrap and break Ink's line-count
+    // tracker, leaving stale lines above on the next redraw.
     const compact = termWidth < 30;
     const narrow = !compact && termWidth < 60;
-    // Reserve: 4 indent + counter length + 2 padding. Floor at 6 cols so
-    // even on a borderline-narrow terminal we draw SOMETHING; if there's
-    // no room at all we fall through to compact mode above.
     const barWidth = Math.max(6, termWidth - counter.length - 8);
     const fraction = total > 0 ? Math.min(1, value / total) : 0;
     const filled = Math.round(fraction * barWidth);

package/dist/scan-ui/components/ProjectSelector.js

@@ -42,7 +42,7 @@ export const ProjectSelector = ({ projects, onConfirm, onCancel, userStatus }) =
         }
     });
     const ecosystemLabel = (eco) => eco === "npm" ? chalk.magenta("npm") : chalk.blue("pip");
-    return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, children: [_jsxs(Text, { children: [chalk.bold("Dependency Guardian"), "  ", userStatus ? chalk.dim(userStatus) : ""] }), _jsx(Text, { children: "" }), _jsxs(Text, { bold: true, children: ["Found ", projects.length, " project", projects.length !== 1 ? "s" : ""] }), _jsx(Text, { children: "" }), projects.map((proj, i) => {
+    return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, children: [_jsxs(Text, { children: [chalk.bold("Dependency Guardian"), "  ", userStatus ?? ""] }), _jsx(Text, { children: "" }), _jsxs(Text, { bold: true, children: ["Found ", projects.length, " project", projects.length !== 1 ? "s" : ""] }), _jsx(Text, { children: "" }), projects.map((proj, i) => {
                 const isCursor = i === cursor;
                 const isSelected = selected.has(i);
                 const prefix = isCursor ? chalk.cyan("\u258C") : " ";

package/dist/scan-ui/components/ScoreHeader.js

@@ -13,10 +13,9 @@ function scoreColor(score, action) {
                 chalk.green.bold;
     return colorFn(String(score));
 }
-export const ScoreHeader = ({ score, action, total, flagged, clean, userStatus, scanUsage, usageNearLimit, }) => {
+export const ScoreHeader = ({ score, action, compact, total, flagged, clean, userStatus, scanUsage, usageNearLimit, }) => {
     const logo = renderLogo(action);
-    const { cols, rows } = useTerminalSize();
-    const compact = rows < COMPACT_ROWS;
+    const { cols } = useTerminalSize();
     const showLogo = cols >= LOGO_MIN_COLS && !compact;
     return (_jsx(Box, { flexDirection: "column", borderStyle: "round", borderColor: action === "block" ? "red" : action === "warn" ? "yellow" : action === "analysis_incomplete" ? "cyan" : "green", paddingLeft: 1, paddingRight: 1, width: "100%", children: _jsxs(Box, { flexDirection: "row", children: [_jsxs(Box, { flexDirection: "column", flexGrow: 1, children: [_jsxs(Text, { bold: true, children: ["Dependency Guardian  ", userStatus ?? ""] }), !compact && _jsx(Text, { children: " " }), _jsxs(Text, { children: [chalk.dim("Score"), "  ", scoreColor(score, action)] }), total !== undefined && (_jsxs(_Fragment, { children: [!compact && _jsx(Text, { children: " " }), _jsxs(Text, { children: [chalk.dim(`${total} package${total !== 1 ? "s" : ""} scanned`), flagged !== undefined && flagged > 0 ? (_jsxs(_Fragment, { children: ["    ", chalk.yellow(`${flagged} flagged`), "    ", chalk.green(`${clean ?? 0} clean`)] })) : (_jsxs(_Fragment, { children: ["    ", chalk.green("all clean")] }))] }), scanUsage && (usageNearLimit
                                     ? _jsxs(Text, { color: "yellow", children: [scanUsage, "  \u2191 Pro: westbayberry.com/pricing"] })

package/dist/scan-ui/components/SetupBanner.js

@@ -1,11 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, Text } from "ink";
-// Visible alert shown above the scan results when the user's DG setup has
-// gaps — missing api key, missing pre-commit hook, etc. Renders nothing
-// when issues is empty so it's free to drop in unconditionally.
-//
-// Yellow border, single line per issue, fix command in cyan so the user
-// can copy-paste it.
 export const SetupBanner = ({ issues }) => {
     if (issues.length === 0)
         return null;

package/dist/scan-ui/format-helpers.js

@@ -1,7 +1,6 @@
+import chalk from "chalk";
+import { sanitize } from "../security/sanitize.js";
 export const USAGE_NEAR_LIMIT_RATIO = 0.8;
-// Renders the monthly package-usage readout shown on every scan. `nearLimit`
-// drives the dim → yellow + upgrade-nudge escalation; it's only ever true for
-// a finite limit at/above 80% used.
 export function formatUsage(usage) {
     const used = usage.used.toLocaleString();
     if (usage.limit === null) {
@@ -12,11 +11,68 @@ export function formatUsage(usage) {
         nearLimit: usage.used / usage.limit >= USAGE_NEAR_LIMIT_RATIO,
     };
 }
+export function formatAccountStatus(tier, loggedIn, name) {
+    const cleaned = sanitize(tier).trim().slice(0, 24).toLowerCase();
+    const label = cleaned ? cleaned.charAt(0).toUpperCase() + cleaned.slice(1) : loggedIn ? "Account" : "Free";
+    if (!loggedIn) {
+        return `${chalk.dim(`${label} · `)}${chalk.cyan.bold("dg login")}`;
+    }
+    const plan = (cleaned === "free" ? chalk.yellow : chalk.green)(`${label} plan`);
+    const who = name ? sanitize(name).trim().slice(0, 40) : "";
+    return who ? `${chalk.dim(`${who} · `)}${plan}` : plan;
+}
+function isWideCodePoint(cp) {
+    return (cp >= 0x1100 &&
+        (cp <= 0x115f ||
+            cp === 0x2329 ||
+            cp === 0x232a ||
+            (cp >= 0x2e80 && cp <= 0xa4cf && cp !== 0x303f) ||
+            (cp >= 0xac00 && cp <= 0xd7a3) ||
+            (cp >= 0xf900 && cp <= 0xfaff) ||
+            (cp >= 0xfe10 && cp <= 0xfe19) ||
+            (cp >= 0xfe30 && cp <= 0xfe6b) ||
+            (cp >= 0xff00 && cp <= 0xff60) ||
+            (cp >= 0xffe0 && cp <= 0xffe6) ||
+            (cp >= 0x1f300 && cp <= 0x1f64f) ||
+            (cp >= 0x1f900 && cp <= 0x1f9ff) ||
+            (cp >= 0x20000 && cp <= 0x3fffd)));
+}
+function isZeroWidthCodePoint(cp) {
+    return ((cp >= 0x0300 && cp <= 0x036f) ||
+        (cp >= 0x1ab0 && cp <= 0x1aff) ||
+        (cp >= 0x20d0 && cp <= 0x20ff) ||
+        (cp >= 0xfe00 && cp <= 0xfe0f) ||
+        (cp >= 0x200b && cp <= 0x200f) ||
+        cp === 0xfeff);
+}
+function codePointWidth(cp) {
+    if (isZeroWidthCodePoint(cp))
+        return 0;
+    return isWideCodePoint(cp) ? 2 : 1;
+}
+export function displayWidth(s) {
+    let width = 0;
+    for (const ch of s) {
+        width += codePointWidth(ch.codePointAt(0) ?? 0);
+    }
+    return width;
+}
 export function pad(s, len) {
-    return s + " ".repeat(Math.max(0, len - s.length));
+    return s + " ".repeat(Math.max(0, len - displayWidth(s)));
 }
 export function truncate(s, max) {
-    return s.length <= max ? s : s.slice(0, max - 1) + "…";
+    if (displayWidth(s) <= max)
+        return s;
+    let out = "";
+    let width = 0;
+    for (const ch of s) {
+        const w = codePointWidth(ch.codePointAt(0) ?? 0);
+        if (width + w > max - 1)
+            break;
+        out += ch;
+        width += w;
+    }
+    return out + "…";
 }
 export function groupPackages(packages, keyBy = "name") {
     const map = new Map();

package/dist/scan-ui/hooks/useResizeRepaint.js

@@ -0,0 +1,25 @@
+import { useEffect, useState } from "react";
+import { useStdout } from "ink";
+import { CLEAR_HOME } from "../alt-screen.js";
+// Ink skips repainting when output matches its memoized last frame, so a bare
+// screen clear on resize leaves the TUI blank until the next state change.
+// useStdout().write is the only public path that erases and repaints the
+// memoized frame unconditionally; CLEAR_HOME first wipes resize artifacts.
+export function useResizeRepaint() {
+    const { stdout, write } = useStdout();
+    const [resizes, setResizes] = useState(0);
+    useEffect(() => {
+        const handle = () => setResizes((count) => count + 1);
+        stdout.setMaxListeners(stdout.getMaxListeners() + 1);
+        stdout.on("resize", handle);
+        return () => {
+            stdout.off("resize", handle);
+            stdout.setMaxListeners(Math.max(0, stdout.getMaxListeners() - 1));
+        };
+    }, [stdout]);
+    useEffect(() => {
+        if (resizes === 0)
+            return;
+        write(CLEAR_HOME);
+    }, [resizes, write]);
+}

package/dist/scan-ui/hooks/useScan.js

@@ -1,6 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { useReducer, useEffect, useRef, useCallback, useState } from "react";
 import { analyzePackages, AnalyzeError, mergeAnalyzeResponses } from "../../api/analyze.js";
+import { applyDecisions, packageKey } from "../../decisions/apply.js";
+import { findProjectRoot, loadDgFile } from "../../project/dgfile.js";
 import { collectScanPackages, discoverScanProjectsAsync } from "../../scan/collect.js";
 function reducer(_state, action) {
     switch (action.type) {
@@ -21,7 +23,8 @@ function reducer(_state, action) {
                 result: action.result,
                 durationMs: action.durationMs,
                 skippedCount: action.skippedCount,
-                ...(action.discoveredTotal !== undefined ? { discoveredTotal: action.discoveredTotal } : {})
+                ...(action.discoveredTotal !== undefined ? { discoveredTotal: action.discoveredTotal } : {}),
+                ...(action.decisions !== undefined ? { decisions: action.decisions } : {})
             };
         case "ERROR":
             return { phase: "error", error: action.error };
@@ -50,9 +53,10 @@ export function useScan(config) {
         }
         started.current = true;
         void (async () => {
-            const projects = await discoverScanProjectsAsync(process.cwd(), (progress) => {
+            const discovered = await discoverScanProjectsAsync(process.cwd(), (progress) => {
                 dispatch({ type: "DISCOVERY_PROGRESS", path: progress.path, found: progress.found });
             });
+            const projects = discovered.filter((project) => project.ecosystem === "npm" || project.ecosystem === "pypi");
             if (projects.length === 0) {
                 dispatch({ type: "DISCOVERY_EMPTY", message: "No dependency lockfiles found." });
                 return;
@@ -79,6 +83,28 @@ export function useScan(config) {
         restartSelection: multiProjects ? restartSelection : null
     };
 }
+function computeProjectDecisions(result, entries) {
+    try {
+        const root = findProjectRoot(process.cwd());
+        if (!root) {
+            return undefined;
+        }
+        const file = loadDgFile(root);
+        if (!file.readable) {
+            return undefined;
+        }
+        const ecosystems = new Map();
+        for (const [ecosystem, packages] of entries) {
+            for (const pkg of packages) {
+                ecosystems.set(packageKey(pkg.name, pkg.version), ecosystem);
+            }
+        }
+        return applyDecisions(result.packages, (pkg) => ecosystems.get(packageKey(pkg.name, pkg.version)), file, result.action);
+    }
+    catch {
+        return undefined;
+    }
+}
 async function scanProjects(projects, dispatch, signal) {
     const startMs = Date.now();
     let skipped = 0;
@@ -134,12 +160,28 @@ async function scanProjects(projects, dispatch, signal) {
         const firstFailure = outcomes.find((outcome) => "error" in outcome);
         if (responses.length > 0) {
             const merged = mergeAnalyzeResponses(responses);
+            const base = firstFailure && merged.action === "pass" ? { ...merged, action: "analysis_incomplete" } : merged;
+            const ecoByKey = new Map();
+            for (const [ecosystem, packages] of entries) {
+                for (const pkg of packages) {
+                    ecoByKey.set(packageKey(pkg.name, pkg.version), ecosystem);
+                }
+            }
+            const result = {
+                ...base,
+                packages: base.packages.map((pkg) => {
+                    const ecosystem = ecoByKey.get(packageKey(pkg.name, pkg.version));
+                    return ecosystem ? { ...pkg, ecosystem } : pkg;
+                })
+            };
+            const decisions = computeProjectDecisions(result, entries);
             dispatch({
                 type: "SCAN_COMPLETE",
-                result: firstFailure && merged.action === "pass" ? { ...merged, action: "analysis_incomplete" } : merged,
+                result,
                 durationMs: Date.now() - startMs,
                 skippedCount: skipped,
-                discoveredTotal: total
+                discoveredTotal: total,
+                ...(decisions ? { decisions } : {})
             });
             return;
         }

package/dist/scan-ui/launch.js

@@ -12,11 +12,15 @@ export function shouldLaunchScanTui(options) {
     if (process.env.TERM === "dumb") {
         return false;
     }
+    if (!process.stdin.isTTY) {
+        return false;
+    }
     return resolvePresentation().mode === "rich";
 }
 export async function launchScanTui(initialView = "results") {
     const ci = process.env.CI;
-    if (ci === "" || ci === "0" || ci === "false") {
+    const ciCleared = ci === "" || ci === "0" || ci === "false";
+    if (ciCleared) {
         delete process.env.CI;
     }
     const [{ render }, react, app] = await Promise.all([
@@ -32,13 +36,12 @@ export async function launchScanTui(initialView = "results") {
         : undefined;
     enterTui();
     const instance = render(react.default.createElement(app.App, { config, initialView, updateAvailable }), { exitOnCtrlC: true });
-    const clearStaleFrameOnResize = () => instance.clear();
-    process.stdout.on("resize", clearStaleFrameOnResize);
     try {
         await instance.waitUntilExit();
     }
     finally {
-        process.stdout.off("resize", clearStaleFrameOnResize);
+        if (ciCleared)
+            process.env.CI = ci;
         leaveTui();
     }
 }

package/dist/scan-ui/shims.js

@@ -1,4 +1,5 @@
 import { authStatus } from "../auth/store.js";
+import { formatAccountStatus } from "./format-helpers.js";
 export function isLoggedIn() {
     try {
         return authStatus().authenticated;
@@ -7,14 +8,23 @@ export function isLoggedIn() {
         return false;
     }
 }
-export function getStoredApiKey() {
+export function accountHeaderLine(usageTier, env = process.env) {
+    let loggedIn = false;
+    let name;
+    let storedTier;
     try {
-        const status = authStatus();
-        return status.authenticated ? status.tokenPreview : null;
+        const status = authStatus(env);
+        loggedIn = status.authenticated;
+        name = status.name ?? status.email;
+        storedTier = status.tier;
     }
     catch {
-        return null;
+        loggedIn = false;
     }
+    return formatAccountStatus(usageTier ?? storedTier ?? "", loggedIn, name);
+}
+export function effectiveScanAction(raw, effective, mode) {
+    return mode === "strict" || effective === undefined ? raw : effective;
 }
 export function scanExitCode(action, mode) {
     if (action === "block") {

package/dist/scripts/detect.js

@@ -0,0 +1,158 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+const LIFECYCLE_HOOKS = ["preinstall", "install", "postinstall"];
+export function computeScriptsHash(scripts, hasGyp) {
+    const canonical = JSON.stringify({
+        preinstall: lifecycleCommand(scripts, "preinstall"),
+        install: lifecycleCommand(scripts, "install"),
+        postinstall: lifecycleCommand(scripts, "postinstall"),
+        gyp: hasGyp
+    });
+    return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+export function detectScriptWanters(projectDir) {
+    const nodeModules = join(projectDir, "node_modules");
+    const fromLockfile = wantersFromHiddenLockfile(projectDir, nodeModules);
+    const wanters = fromLockfile ?? wantersFromWalk(nodeModules);
+    const byName = new Map();
+    for (const wanter of wanters) {
+        if (!byName.has(wanter.name)) {
+            byName.set(wanter.name, wanter);
+        }
+    }
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+export function detectPnpmIgnoredBuilds(projectDir) {
+    const modulesYamlPath = join(projectDir, "node_modules", ".modules.yaml");
+    let content;
+    try {
+        content = readFileSync(modulesYamlPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split("\n");
+    const startIndex = lines.findIndex((line) => /^ignoredBuilds:/.test(line));
+    if (startIndex === -1) {
+        return [];
+    }
+    const startLine = lines[startIndex] ?? "";
+    if (/\[\s*\]\s*$/.test(startLine)) {
+        return [];
+    }
+    const names = [];
+    for (const line of lines.slice(startIndex + 1)) {
+        const match = /^\s+-\s+(.+?)\s*$/.exec(line);
+        if (!match || !match[1]) {
+            break;
+        }
+        names.push(stripYamlQuotes(match[1]));
+    }
+    return names;
+}
+function stripYamlQuotes(value) {
+    if (value.length >= 2 && ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"')))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+function wantersFromHiddenLockfile(projectDir, nodeModules) {
+    const lockfilePath = join(nodeModules, ".package-lock.json");
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(lockfilePath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!isPlainObject(parsed) || !isPlainObject(parsed.packages)) {
+        return null;
+    }
+    const wanters = [];
+    for (const [packagePath, entry] of Object.entries(parsed.packages)) {
+        if (!isPlainObject(entry) || entry.hasInstallScript !== true || !packagePath.startsWith("node_modules/")) {
+            continue;
+        }
+        const manifestDir = resolve(projectDir, packagePath);
+        const containment = relative(resolve(nodeModules), manifestDir);
+        if (containment === "" || containment.startsWith("..") || isAbsolute(containment)) {
+            continue;
+        }
+        const wanter = wanterFromManifestDir(manifestDir);
+        if (wanter) {
+            wanters.push(wanter);
+        }
+    }
+    return wanters;
+}
+function wantersFromWalk(nodeModules) {
+    const wanters = [];
+    for (const dir of packageDirs(nodeModules)) {
+        const wanter = wanterFromManifestDir(dir);
+        if (wanter) {
+            wanters.push(wanter);
+        }
+    }
+    return wanters;
+}
+function packageDirs(nodeModules) {
+    const dirs = [];
+    for (const entry of safeReaddir(nodeModules)) {
+        if (entry.startsWith(".")) {
+            continue;
+        }
+        if (entry.startsWith("@")) {
+            for (const scoped of safeReaddir(join(nodeModules, entry))) {
+                if (!scoped.startsWith(".")) {
+                    dirs.push(join(nodeModules, entry, scoped));
+                }
+            }
+            continue;
+        }
+        dirs.push(join(nodeModules, entry));
+    }
+    return dirs;
+}
+function wanterFromManifestDir(dir) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!isPlainObject(manifest) || typeof manifest.name !== "string" || manifest.name.length === 0) {
+        return null;
+    }
+    const scripts = isPlainObject(manifest.scripts) ? manifest.scripts : {};
+    const hasGyp = existsSync(join(dir, "binding.gyp"));
+    const hooks = LIFECYCLE_HOOKS.filter((hook) => typeof lifecycleCommand(scripts, hook) === "string");
+    if (hasGyp) {
+        hooks.push("gyp");
+    }
+    if (hooks.length === 0) {
+        return null;
+    }
+    return {
+        name: manifest.name,
+        version: typeof manifest.version === "string" ? manifest.version : "",
+        hooks,
+        scriptsHash: computeScriptsHash(scripts, hasGyp)
+    };
+}
+function lifecycleCommand(scripts, hook) {
+    const command = scripts[hook];
+    return typeof command === "string" && command.length > 0 ? command : null;
+}
+function safeReaddir(dir) {
+    try {
+        return readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/scripts/gate.js

@@ -0,0 +1,170 @@
+import { loadUserConfig } from "../config/settings.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+import { loadDgFile, saveDgFile } from "../project/dgfile.js";
+import { detectPnpmIgnoredBuilds, detectScriptWanters } from "./detect.js";
+export function evaluateScriptGate(wanters, approvals) {
+    const approved = [];
+    const denied = [];
+    const pending = [];
+    const drifted = [];
+    for (const wanter of wanters) {
+        const entry = approvals[wanter.name];
+        if (!entry) {
+            pending.push(wanter);
+            continue;
+        }
+        if (entry.scriptsHash !== wanter.scriptsHash) {
+            drifted.push({ wanter, priorHash: entry.scriptsHash });
+            continue;
+        }
+        if (entry.decision === "allow") {
+            approved.push(wanter);
+        }
+        else {
+            denied.push(wanter);
+        }
+    }
+    return { approved, denied, pending, drifted };
+}
+export function applyScriptDecisions(file, decisions, now) {
+    if (decisions.length === 0) {
+        return file;
+    }
+    const npm = { ...file.scriptApprovals.npm };
+    for (const input of decisions) {
+        npm[input.wanter.name] = {
+            decision: input.decision,
+            scriptsHash: input.wanter.scriptsHash,
+            hooks: input.wanter.hooks,
+            ...(input.wanter.version ? { approvedVersion: input.wanter.version } : {}),
+            ...(input.reason ? { reason: input.reason } : {}),
+            approvedAt: now.toISOString(),
+            provenance: input.provenance ?? "prompt"
+        };
+    }
+    return {
+        ...file,
+        scriptApprovals: { ...file.scriptApprovals, npm }
+    };
+}
+export function recordScriptObservations(options) {
+    const file = loadDgFile(options.projectDir);
+    if (!file.readable || (!file.exists && !options.createIfMissing) || options.wanters.length === 0) {
+        return { written: false, path: file.path };
+    }
+    const observed = { ...file.scriptApprovals.observed };
+    let changed = false;
+    for (const wanter of options.wanters) {
+        const existing = observed[wanter.name];
+        if (existing &&
+            existing.version === wanter.version &&
+            existing.scriptsHash === wanter.scriptsHash &&
+            sameHooks(existing.hooks, wanter.hooks)) {
+            continue;
+        }
+        observed[wanter.name] = {
+            version: wanter.version,
+            hooks: wanter.hooks,
+            scriptsHash: wanter.scriptsHash,
+            firstSeen: existing ? existing.firstSeen : options.now.toISOString()
+        };
+        changed = true;
+    }
+    if (!changed) {
+        return { written: false, path: file.path };
+    }
+    saveDgFile({ ...file, scriptApprovals: { ...file.scriptApprovals, observed } });
+    return { written: true, path: file.path };
+}
+function sameHooks(a, b) {
+    return a.length === b.length && a.every((hook, index) => hook === b[index]);
+}
+export function hasExplicitScriptPreference(args, env) {
+    if (args.some((arg) => arg === "--ignore-scripts" || arg.startsWith("--ignore-scripts="))) {
+        return true;
+    }
+    return env.npm_config_ignore_scripts !== undefined && env.npm_config_ignore_scripts !== "";
+}
+export function scriptGateInstallArgs(options) {
+    if (options.mode !== "enforce") {
+        return options.args;
+    }
+    if (options.manager !== "npm" && options.manager !== "yarn") {
+        return options.args;
+    }
+    if (hasExplicitScriptPreference(options.args, options.env)) {
+        return options.args;
+    }
+    return [...options.args, "--ignore-scripts"];
+}
+export function scriptGateChildEnv(options) {
+    if (options.mode !== "enforce" || (options.manager !== "npm" && options.manager !== "yarn")) {
+        return {};
+    }
+    if (hasExplicitScriptPreference(options.args, options.env)) {
+        return {};
+    }
+    return { npm_config_ignore_scripts: "true" };
+}
+const REPORTED_NAME_LIMIT = 6;
+export function scriptGateReportLine(options) {
+    const theme = createTheme(resolvePresentation().color);
+    if (options.manager === "pnpm") {
+        const ignored = options.pnpmIgnoredBuilds ?? [];
+        if (ignored.length === 0) {
+            return "";
+        }
+        return `\n  ${theme.paint("muted", `dg scripts: pnpm natively blocked install scripts for ${formatNames(ignored)} — review with 'pnpm approve-builds'`)}\n`;
+    }
+    const wanters = options.wanters ?? [];
+    if (wanters.length === 0) {
+        return "";
+    }
+    const names = wanters.map((wanter) => (wanter.version ? `${wanter.name}@${wanter.version}` : wanter.name));
+    const noun = wanters.length === 1 ? "package ran" : "packages ran";
+    return `\n  ${theme.paint("muted", `dg scripts: ${wanters.length} ${noun} install scripts (${formatNames(names)}) — observed, not blocked · silence: dg config set scriptGate.mode off`)}\n`;
+}
+function formatNames(names) {
+    if (names.length <= REPORTED_NAME_LIMIT) {
+        return names.join(", ");
+    }
+    return `${names.slice(0, REPORTED_NAME_LIMIT).join(", ")}, +${names.length - REPORTED_NAME_LIMIT} more`;
+}
+const MUTATING_ACTIONS = {
+    npm: new Set(["install", "i", "ci", "add", "update", "dedupe"]),
+    yarn: new Set(["add", "install", "upgrade"]),
+    pnpm: new Set(["install", "i", "add", "update"])
+};
+export function runScriptGateAfterInstall(options) {
+    try {
+        const classification = options.classification;
+        if (classification.kind !== "protected" || classification.ecosystem !== "javascript") {
+            return "";
+        }
+        const mutatingActions = MUTATING_ACTIONS[classification.manager];
+        if (!mutatingActions || !mutatingActions.has(classification.action)) {
+            return "";
+        }
+        const config = loadUserConfig(options.env ?? process.env);
+        if (config.scriptGate.mode === "off") {
+            return "";
+        }
+        const projectDir = options.projectDir ?? process.cwd();
+        if (classification.manager === "pnpm") {
+            return scriptGateReportLine({ manager: "pnpm", pnpmIgnoredBuilds: detectPnpmIgnoredBuilds(projectDir) });
+        }
+        const wanters = detectScriptWanters(projectDir);
+        recordScriptObservations({
+            projectDir,
+            wanters,
+            createIfMissing: config.scriptGate.observe,
+            now: options.now ?? new Date()
+        });
+        return scriptGateReportLine({ manager: classification.manager, wanters });
+    }
+    catch {
+        // observing must never fail or block an install that already succeeded
+        return "";
+    }
+}