@westbayberry/dg 2.0.11 → 2.2.0

package/package.json

@@ -1,7 +1,15 @@
 {
   "name": "@westbayberry/dg",
-  "version": "2.0.11",
+  "version": "2.2.0",
   "description": "Dependency Guardian supply-chain firewall CLI",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WestBayBerry/DG_CLI.git"
+  },
+  "bugs": {
+    "url": "https://github.com/WestBayBerry/DG_CLI/issues"
+  },
+  "homepage": "https://github.com/WestBayBerry/DG_CLI#readme",
   "type": "module",
   "bin": {
     "dg": "./dist/bin/dg.js"
@@ -9,14 +17,16 @@
   "files": [
     "dist",
     "LICENSE",
-    "NOTICE",
-    "package.json"
+    "package.json",
+    "npm-shrinkwrap.json"
   ],
   "engines": {
     "node": ">=22.14.0"
   },
   "scripts": {
     "build": "node build.mjs",
+    "prepack": "node scripts/sync-shrinkwrap.mjs",
+    "postpack": "node scripts/sync-shrinkwrap.mjs restore",
     "test": "vitest run",
     "test:unit": "vitest run test/unit",
     "test:integration": "vitest run test/integration",
@@ -26,11 +36,7 @@
     "check:package": "node scripts/check-package-contract.mjs",
     "check:tarball": "node scripts/check-tarball.mjs",
     "check:legacy": "node scripts/check-legacy-absence.mjs",
-    "check:architecture-cracks": "node scripts/validate-architecture-crack-closure.mjs",
-    "check:release-docs": "node scripts/check-release-docs.mjs",
-    "check:plan-coverage": "node scripts/validate-plan-coverage.mjs",
-    "check:adversarial-plan": "node scripts/validate-adversarial-validation-plan.mjs",
-    "check": "npm run typecheck && npm run lint && npm run format:check && npm run check:package && npm run check:legacy && npm run check:release-docs && npm run check:plan-coverage && npm run check:adversarial-plan && npm run build && npm run test && npm run check:tarball && npm run check:architecture-cracks"
+    "check": "npm run typecheck && npm run lint && npm run format:check && npm run check:package && npm run check:legacy && npm run build && npm run test && npm run check:tarball"
   },
   "devDependencies": {
     "@types/node": "22.15.30",

package/NOTICE

@@ -1,5 +0,0 @@
-Dependency Guardian dg CLI
-Copyright 2026 WestBayBerry
-
-This product is licensed under the Apache License, Version 2.0.
-See the LICENSE file for the full license text.

package/dist/commands/completion.js

@@ -1,116 +0,0 @@
-import { commandCatalog } from "./router.js";
-import { packageManagerCommandNames } from "./wrap.js";
-import { EXIT_USAGE } from "./types.js";
-const SHELLS = ["bash", "zsh", "fish"];
-const COMMON_FLAGS = ["--help", "--version", "--json", "--sarif", "--output", "--yes", "--check", "--staged", "--dg-force-install"];
-const FISH_FLAG_DESCRIPTIONS = {
-    "--help": "Show help",
-    "--version": "Show version",
-    "--json": "Write JSON output",
-    "--sarif": "Write SARIF output",
-    "--output": "Write report to file",
-    "--yes": "Apply a confirmed mutation",
-    "--check": "Report without mutating",
-    "--staged": "Limit to staged files",
-    "--dg-force-install": "Install despite a block, where policy allows"
-};
-function completionCommands() {
-    const names = new Set(packageManagerCommandNames);
-    for (const command of commandCatalog) {
-        names.add(command.name);
-        for (const alias of command.aliases ?? []) {
-            names.add(alias);
-        }
-    }
-    return [...names];
-}
-export const completionCommand = {
-    name: "completion",
-    summary: "Print shell completion for bash, zsh, or fish.",
-    usage: "dg completion <bash|zsh|fish>",
-    args: [{ name: "<shell>", summary: "bash, zsh, or fish." }],
-    examples: [
-        "dg completion bash > ~/.local/share/bash-completion/completions/dg",
-        "dg completion zsh > ~/.zfunc/_dg",
-        "dg completion fish > ~/.config/fish/completions/dg.fish"
-    ],
-    details: ["Prints a completion script to stdout without changing shell files."],
-    handler: (context) => completionHandler(context.args)
-};
-function completionHandler(args) {
-    const [shell, ...rest] = args;
-    if (!shell || rest.length > 0 || !isSupportedShell(shell)) {
-        return {
-            exitCode: EXIT_USAGE,
-            stdout: "",
-            stderr: "dg completion: expected one shell: bash, zsh, or fish.\n"
-        };
-    }
-    return {
-        exitCode: 0,
-        stdout: renderCompletion(shell),
-        stderr: ""
-    };
-}
-function isSupportedShell(value) {
-    return SHELLS.includes(value);
-}
-function renderCompletion(shell) {
-    const commandList = completionCommands();
-    const commands = commandList.join(" ");
-    const flags = COMMON_FLAGS.join(" ");
-    if (shell === "bash") {
-        return `# dg bash completion
-_dg_completion() {
-  local cur prev
-  COMPREPLY=()
-  cur="\${COMP_WORDS[COMP_CWORD]}"
-  prev="\${COMP_WORDS[COMP_CWORD-1]}"
-  if [ "$prev" = "completion" ]; then
-    COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
-    return 0
-  fi
-  if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "${commands}" -- "$cur") )
-    return 0
-  fi
-  COMPREPLY=( $(compgen -W "${flags}" -- "$cur") )
-}
-complete -F _dg_completion dg
-`;
-    }
-    if (shell === "zsh") {
-        return `#compdef dg
-_dg() {
-  local -a commands flags shells
-  commands=(${commandList.map((command) => escapeZsh(command)).join(" ")})
-  flags=(${COMMON_FLAGS.map((flag) => escapeZsh(flag)).join(" ")})
-  shells=(bash zsh fish)
-  if [[ "$words[2]" == "completion" ]]; then
-    compadd "$@" -- "$shells[@]"
-    return
-  fi
-  if [[ "$CURRENT" -eq 2 ]]; then
-    compadd "$@" -- "$commands[@]"
-    return
-  fi
-  compadd "$@" -- "$flags[@]"
-}
-_dg "$@"
-`;
-    }
-    const fishFlagLines = COMMON_FLAGS.map((flag) => {
-        const option = flag.replace(/^--/u, "");
-        const requiresArg = flag === "--output" ? " -r" : "";
-        const description = FISH_FLAG_DESCRIPTIONS[flag] ?? option;
-        return `complete -c dg -f -l ${option}${requiresArg} -d '${description}'`;
-    }).join("\n");
-    return `# dg fish completion
-complete -c dg -f -n '__fish_is_first_arg' -a '${commands}' -d 'Dependency Guardian command'
-complete -c dg -f -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish' -d 'Shell'
-${fishFlagLines}
-`;
-}
-function escapeZsh(value) {
-    return value.replace(/([\\[\]{}()$`"'\s])/gu, "\\$1");
-}

package/dist/commands/explain.js

@@ -1,232 +0,0 @@
-import { EXIT_USAGE } from "./types.js";
-import { closestCommand } from "./suggest.js";
-export const EXPLANATIONS = {
-    "npm-lifecycle-script": {
-        what: "The package declares an install lifecycle script (preinstall/install/postinstall/prepare) that runs arbitrary code on your machine during 'npm install'.",
-        next: "Review the script in the package source. Prefer a version without install scripts, or install with --ignore-scripts."
-    },
-    "unverified-network-dependency": {
-        what: "A dependency is fetched from a raw URL (http/git) instead of the registry, so it has no registry identity or integrity to verify.",
-        next: "Pin the dependency to a registry version, or run 'dg verify <url>' before installing."
-    },
-    "local-artifact-dependency": {
-        what: "A dependency points at a local file path; its contents are whatever is on disk and are not registry-verified.",
-        next: "Run 'dg verify <path>' on the artifact, or replace it with a registry version."
-    },
-    malware: {
-        what: "The scanner confirmed this package version contains malicious code (for example credential theft or a backdoor).",
-        next: "Do not install it. Remove the dependency or pin a known-safe version; the dashboard link in the block shows the evidence."
-    },
-    policy: {
-        what: "Your organization or local policy denies this package, independent of a malware verdict.",
-        next: "Pick a compliant alternative, or ask your policy admin to allow it."
-    },
-    license: {
-        what: "The package license violates your license policy (for example a copyleft license your policy denies).",
-        next: "Replace the dependency, or update the license policy if the obligation is acceptable."
-    },
-    "hash-mismatch": {
-        what: "The downloaded artifact's hash does not match the artifact the scanner verified, which can indicate a tampered mirror or cache.",
-        next: "Clear your package cache and retry. If it persists, do not install and report it."
-    },
-    "private-upload-disabled": {
-        what: "The artifact comes from a private registry and private-artifact scanning is disabled, so the scanner never saw its contents.",
-        next: "Enable private artifact scanning (DG_SCAN_TARBALL_UPLOAD) or verify the artifact out of band."
-    },
-    "api-unavailable": {
-        what: "The scanner could not be reached, so no verdict exists for this install; policy decided fail-open or fail-closed.",
-        next: "Run 'dg doctor' and 'dg login' to check connectivity, then retry or re-check with 'dg verify'."
-    },
-    "quota-exceeded": {
-        what: "You've used your plan's monthly scan allowance, so this install could not be verified — it was blocked rather than installed unverified.",
-        next: "Upgrade your plan at westbayberry.com/pricing, or wait for your monthly limit to reset."
-    },
-    "api-timeout": {
-        what: "The scanner did not answer within the verdict timeout, so no verdict exists for this install.",
-        next: "Retry; if it persists, run 'dg doctor' to check connectivity."
-    },
-    "registry-timeout": {
-        what: "The upstream package registry did not respond, so the artifact was never fetched or verified.",
-        next: "Check the registry status and retry."
-    },
-    "analysis-incomplete": {
-        what: "The scanner analyzed only part of this package; the unanalyzed remainder is unverified, not safe.",
-        next: "Retry later, or override with --dg-force-install only if you accept the risk."
-    },
-    "unsupported-manager": {
-        what: "This package manager is gated in this dg build, so installs through it are not protected.",
-        next: "Use a supported manager through dg (npm, pnpm, yarn, pip, pipx, uv, uvx, cargo)."
-    },
-    "proxy-setup-failure": {
-        what: "dg's per-install enforcement proxy could not start, so protected installs fail closed rather than run unverified.",
-        next: "Run 'dg doctor' for the failing check, then retry."
-    },
-    "needs-login": {
-        what: "This install needed a verdict that requires an authenticated account, so it was blocked rather than installed unverified.",
-        next: "Run 'dg login', then retry the install."
-    },
-    lifecycle: {
-        what: "The scanner flagged an install lifecycle script (preinstall/install/postinstall) that runs arbitrary code during install.",
-        next: "Review the script in the package source, or install with --ignore-scripts."
-    },
-    "install-script": {
-        what: "The scanner found an install-time script in this package that executes code on your machine during install.",
-        next: "Review the script before installing; prefer a version without install scripts."
-    },
-    "archive-path-traversal": {
-        what: "The package archive contains an entry whose path escapes the extraction directory, a classic overwrite attack.",
-        next: "Do not install it; report the package and pin a known-safe version."
-    },
-    "archive-path-too-long": {
-        what: "The package archive contains an entry path long enough to break extraction or smuggle content past tooling.",
-        next: "Treat the artifact as untrusted and verify it out of band."
-    },
-    "archive-size-limit": {
-        what: "The package archive expands past dg's size limit, so its contents were not fully verified (possible zip bomb).",
-        next: "Verify the artifact out of band before trusting it."
-    },
-    "encrypted-archive-entry": {
-        what: "The package archive contains an encrypted entry dg cannot inspect, so part of the package is unverified.",
-        next: "Treat it as unverified; ask the publisher why the archive is encrypted."
-    },
-    "zip-data-descriptor": {
-        what: "The package archive uses zip data descriptors that can make different tools see different contents.",
-        next: "Verify the artifact out of band before trusting it."
-    },
-    "license-policy-denied": {
-        what: "The dependency's license is denied by your license policy.",
-        next: "Replace the dependency, or update the policy if the obligation is acceptable."
-    },
-    "lockfile-url-fallback": {
-        what: "A lockfile entry resolves to a raw URL instead of a registry version, so it has no registry identity to verify.",
-        next: "Re-pin the dependency to a registry version and regenerate the lockfile."
-    },
-    "unverified-lockfile-url": {
-        what: "A lockfile entry downloads from a URL the scanner could not verify against a registry artifact.",
-        next: "Pin a registry version, or run 'dg verify <url>' before installing."
-    },
-    "unverified-network-spec": {
-        what: "A dependency spec points at a raw http/git source instead of the registry, so its contents are unverified.",
-        next: "Pin the dependency to a registry version, or run 'dg verify <url>' first."
-    },
-    "unpinned-package-spec": {
-        what: "A dependency spec has no pinned version, so installs can silently pull a different artifact than was reviewed.",
-        next: "Pin an exact version (or use a lockfile) and re-run the scan."
-    },
-    "unsupported-package-spec": {
-        what: "A dependency spec uses a form dg cannot resolve to a registry artifact, so it was not verified.",
-        next: "Rewrite the spec as a registry name@version, or verify the artifact out of band."
-    },
-    "malformed-lockfile": {
-        what: "A lockfile could not be parsed, so the packages it pins were not verified.",
-        next: "Regenerate the lockfile with your package manager and re-run the scan."
-    },
-    "malformed-package-manifest": {
-        what: "A package manifest could not be parsed, so its dependencies were not verified.",
-        next: "Fix the manifest syntax and re-run the scan."
-    },
-    "missing-artifact-integrity": {
-        what: "A lockfile entry has no integrity hash, so the downloaded artifact cannot be checked against what was reviewed.",
-        next: "Regenerate the lockfile so every entry carries an integrity hash."
-    },
-    "credential-file": {
-        what: "Your publish set includes a credentials file (for example .npmrc, .netrc, or cloud keys) that would ship to the registry.",
-        next: "Remove the file from the publish set and rotate any leaked credential."
-    },
-    "private-key": {
-        what: "Your publish set includes a private key file that would become public on publish.",
-        next: "Remove it from the publish set and rotate the key."
-    },
-    "bundled-secret": {
-        what: "A file in your publish set contains what looks like a live secret (API key, token, or password).",
-        next: "Remove or redact the secret, rotate it, and re-run 'dg audit'."
-    },
-    "scm-leakage": {
-        what: "Your publish set includes version-control internals (for example a .git directory) that leak history and remotes.",
-        next: "Exclude the directory via the files allowlist or an ignore file."
-    },
-    "ci-config": {
-        what: "Your publish set includes CI configuration that often references internal infrastructure and secrets.",
-        next: "Exclude it from the publish set unless consumers need it."
-    },
-    "iac-secret": {
-        what: "Your publish set includes infrastructure-as-code state or vaults (for example tfstate) that commonly embed secrets.",
-        next: "Remove the file and rotate anything it contains."
-    },
-    "source-map": {
-        what: "Your publish set includes source maps that expose your original source to every consumer.",
-        next: "Exclude .map files from the publish set unless that is intended."
-    },
-    "build-artifact": {
-        what: "Your publish set includes build or coverage output that bloats the package and can leak internal paths.",
-        next: "Exclude the directory via the files allowlist."
-    },
-    "editor-os-junk": {
-        what: "Your publish set includes editor or OS junk files (for example .DS_Store or editor swap files).",
-        next: "Exclude them; they add noise and can leak local paths."
-    },
-    "data-dump": {
-        what: "Your publish set includes database dumps, logs, or captures that frequently contain real user data.",
-        next: "Remove the file and check whether the data requires disclosure."
-    },
-    "internal-leak": {
-        what: "Your publish set includes files that look internal-only (for example memory dumps or HAR captures).",
-        next: "Remove them from the publish set before publishing."
-    },
-    "lifecycle-risk": {
-        what: "Your package declares install lifecycle scripts that will run arbitrary code on every consumer's machine.",
-        next: "Drop the script if possible; consumers increasingly refuse install scripts."
-    },
-    structural: {
-        what: "The publish set has a structural problem (for example no files allowlist or a symlink escaping the package root).",
-        next: "Fix the structure so the publish set is exactly what you reviewed."
-    },
-    "pem-private-key": {
-        what: "A PEM-encoded private key is inside your publish set and would become public on publish.",
-        next: "Remove it from the publish set and rotate the key."
-    },
-    "no-files-allowlist": {
-        what: "package.json has no files allowlist, so npm publishes nearly everything in the directory by default.",
-        next: "Add a files allowlist so the publish set is explicit."
-    }
-};
-export const explainCommand = {
-    name: "explain",
-    summary: "Explain a dg finding or block cause and what to do about it.",
-    usage: "dg explain <finding-or-cause-id>",
-    args: [{ name: "<id>", summary: "A finding id or block cause (see the list below)." }],
-    examples: ["dg explain malware", "dg explain quota-exceeded"],
-    details: [
-        `Known ids: ${Object.keys(EXPLANATIONS).sort().join(", ")}`
-    ],
-    handler: (context) => runExplain(context.args)
-};
-function runExplain(args) {
-    const id = args[0];
-    if (!id || args.length > 1) {
-        return {
-            exitCode: EXIT_USAGE,
-            stdout: "",
-            stderr: "dg explain: expected exactly one finding or cause id. Run 'dg explain --help'.\n"
-        };
-    }
-    const normalized = id.toLowerCase().replaceAll("_", "-");
-    const explanation = EXPLANATIONS[id] ?? EXPLANATIONS[normalized];
-    if (!explanation) {
-        const suggestion = closestCommand(normalized, Object.keys(EXPLANATIONS));
-        const hint = suggestion ? `Did you mean '${suggestion}'? ` : "";
-        return {
-            exitCode: 0,
-            stdout: `${id}\n\n` +
-                `dg has no local entry for '${id}'. ${hint}` +
-                "Scanner finding ids evolve faster than this glossary, so the id may still be real.\n\n" +
-                `Next: open the affected package's page on westbayberry.com — its findings list shows the evidence and remediation for '${id}'.\n`,
-            stderr: ""
-        };
-    }
-    return {
-        exitCode: 0,
-        stdout: `${id}\n\n${explanation.what}\n\nNext: ${explanation.next}\n`,
-        stderr: ""
-    };
-}

package/dist/commands/unavailable.js

@@ -1,11 +0,0 @@
-import { EXIT_UNAVAILABLE } from "./types.js";
-export function unavailableCommand(feature, nextStep) {
-    return (context) => {
-        const invoked = ["dg", ...context.commandPath, ...context.args].join(" ");
-        return {
-            exitCode: EXIT_UNAVAILABLE,
-            stdout: "",
-            stderr: `${invoked} is not available in this CLI build. ${feature}. ${nextStep}\n`
-        };
-    };
-}

package/dist/telemetry/events.js

@@ -1,40 +0,0 @@
-import { appendFileSync, mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { loadUserConfig } from "../config/settings.js";
-import { resolveDgPaths } from "../state/index.js";
-const ALLOWED_ATTRIBUTE_KEYS = new Set(["command", "exitCode", "policyMode", "decision", "packageCount", "authenticated"]);
-export function telemetryLogPath(paths) {
-    return join(paths.stateDir, "telemetry.jsonl");
-}
-export function buildTelemetryEvent(type, attributes, now = new Date()) {
-    return {
-        type,
-        createdAt: now.toISOString(),
-        attributes: sanitizeTelemetryAttributes(attributes)
-    };
-}
-export function recordTelemetryEvent(event, env = process.env) {
-    const config = loadUserConfig(env);
-    if (!config.telemetry.enabled) {
-        return false;
-    }
-    const path = telemetryLogPath(resolveDgPaths(env));
-    mkdirSync(dirname(path), {
-        recursive: true,
-        mode: 0o700
-    });
-    appendFileSync(path, `${JSON.stringify(event)}\n`, {
-        encoding: "utf8",
-        mode: 0o600
-    });
-    return true;
-}
-function sanitizeTelemetryAttributes(attributes) {
-    const sanitized = {};
-    for (const [key, value] of Object.entries(attributes)) {
-        if (ALLOWED_ATTRIBUTE_KEYS.has(key)) {
-            sanitized[key] = value;
-        }
-    }
-    return sanitized;
-}