@westbayberry/dg 2.0.11 → 2.2.0

package/dist/commands/logout.js

@@ -3,9 +3,9 @@ import { clearAuthState } from "../auth/store.js";
 export const logoutCommand = {
     name: "logout",
     summary: "Remove local Dependency Guardian authentication.",
-    usage: "dg logout [--yes]",
-    flags: [{ flag: "--yes", summary: "Required confirmation flag; logout removes the local token only when it is passed." }],
-    details: ["Removes dg-owned auth material without deleting unrelated user content."],
+    usage: "dg logout",
+    flags: [{ flag: "--yes", summary: "Accepted for scripts; logout no longer needs confirmation." }],
+    details: ["Removes the dg-owned local auth token only. Config and setup files are not changed; log back in with dg login."],
     handler: (context) => logoutHandler(context.args)
 };
 function logoutHandler(args, env = process.env) {
@@ -17,13 +17,6 @@ function logoutHandler(args, env = process.env) {
             stderr: `dg logout: unknown option '${unknown}'. Run 'dg logout --help'.\n`
         };
     }
-    if (!args.includes("--yes")) {
-        return {
-            exitCode: EXIT_USAGE,
-            stdout: "This removes the dg-owned local auth token only. Config and setup files are not changed.\n",
-            stderr: "dg logout requires --yes to confirm.\n"
-        };
-    }
     let removed;
     try {
         removed = clearAuthState();
@@ -35,7 +28,7 @@ function logoutHandler(args, env = process.env) {
             stderr: `dg logout: could not remove the local auth token: ${error instanceof Error ? error.message : "unknown error"}\n`
         };
     }
-    const lines = [removed ? "Removed local dg auth token." : "No local dg auth token was present."];
+    const lines = [removed ? "Logged out." : "Already logged out."];
     const activeEnvVars = ["DG_API_KEY", "DG_API_TOKEN"].filter((name) => env[name]);
     if (activeEnvVars.length > 0) {
         lines.push(`${activeEnvVars.join(" and ")} ${activeEnvVars.length === 1 ? "is" : "are"} still set, so env-var auth remains active (file token removed only).`);

package/dist/commands/router.js

@@ -1,11 +1,13 @@
 import { configCommand } from "./config.js";
-import { completionCommand } from "./completion.js";
 import { auditCommand } from "./audit.js";
+import { cooldownCommand } from "./cooldown.js";
+import { decisionsCommand } from "./decisions.js";
 import { doctorCommand } from "./doctor.js";
-import { explainCommand } from "./explain.js";
 import { guardCommitCommand } from "./guard-commit.js";
+import { agentsCommand } from "./agents.js";
 import { renderCommandHelp, renderRootHelp } from "./help.js";
 import { licensesCommand } from "./licenses.js";
+import { sbomCommand } from "./sbom.js";
 import { loginCommand } from "./login.js";
 import { logoutCommand } from "./logout.js";
 import { packageManagerCommands } from "./wrap.js";
@@ -21,18 +23,20 @@ import { verifyCommand } from "./verify.js";
 import { dgVersion, versionResult } from "./version.js";
 export const commandCatalog = [
     scanCommand,
+    sbomCommand,
     verifyCommand,
     setupCommand,
     guardCommitCommand,
+    agentsCommand,
+    decisionsCommand,
+    cooldownCommand,
     uninstallCommand,
     doctorCommand,
     statusCommand,
     ...packageManagerCommands(),
     loginCommand,
     logoutCommand,
-    explainCommand,
     configCommand,
-    completionCommand,
     licensesCommand,
     auditCommand,
     updateCommand,

package/dist/commands/sbom.js

@@ -0,0 +1,206 @@
+import { createHash, randomUUID } from "node:crypto";
+import { basename, resolve } from "node:path";
+import { writeReportAtomic } from "../util/report-writer.js";
+import { discoverScanProjects, SBOM_LOCKFILE_ECOSYSTEMS } from "../scan/collect.js";
+import { buildCycloneDxSbom, collectSbomComponents, readRootComponent } from "../sbom/cyclonedx.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+import { buildSbomRows } from "../sbom-ui/inventory.js";
+import { launchSbomTui, shouldLaunchSbomTui } from "../sbom-ui/launch.js";
+import { dgVersion } from "./version.js";
+import { EXIT_TOOL_ERROR, EXIT_USAGE } from "./types.js";
+export const sbomCommand = {
+    name: "sbom",
+    summary: "Inventory the project's dependencies as a CycloneDX 1.5 software bill of materials.",
+    usage: "dg sbom [path] [--output <path>] [--reproducible]",
+    args: [{ name: "[path]", summary: "Project directory to inventory (default: current directory)." }],
+    flags: [
+        { flag: "--output", value: "<path>", summary: "Write the document to a file without opening the interactive view (alias -o)." },
+        { flag: "--json", summary: "Print the raw CycloneDX document to stdout instead of the interactive view." },
+        { flag: "--reproducible", summary: "Byte-stable output: derive the serial number from the components and drop the timestamp (honors SOURCE_DATE_EPOCH)." }
+    ],
+    examples: ["dg sbom", "dg sbom -o sbom.cdx.json", "dg sbom --json | cyclonedx validate", "dg sbom --reproducible"],
+    details: [
+        "Reads the project's lockfiles and inventories every resolved dependency as a CycloneDX 1.5 component with its purl, license, and integrity hash.",
+        "In a terminal it opens an interactive view: the inventory appears immediately, then dg's scanner runs over the npm and PyPI components and fills in a BLOCK/WARN/PASS verdict per package — malware, provenance downgrades, and cooldown — while cargo stays inventory only. Browse with the arrow keys, search with /, filter with f, and press w to write the document. Signing in unlocks verdicts; without it the view shows the inventory alone.",
+        "Piped, with -o, or with --json it stays offline and prints the raw CycloneDX document so you can attach it to a release or feed any CycloneDX-aware tool — no scan, no account needed. Use --reproducible (or set SOURCE_DATE_EPOCH) for identical bytes across runs so a committed SBOM diffs cleanly."
+    ],
+    handler: (context) => runSbomCommand(context)
+};
+export function runSbomCommand(context, cwd = process.cwd(), now = new Date(), env = process.env) {
+    const parsed = parseArgs(context.args);
+    if ("error" in parsed) {
+        return { exitCode: EXIT_USAGE, stdout: "", stderr: `dg sbom: ${parsed.error}. Usage: ${sbomCommand.usage}\n` };
+    }
+    const root = resolve(cwd, parsed.targetPath ?? ".");
+    const projects = discoverScanProjects(root, SBOM_LOCKFILE_ECOSYSTEMS);
+    const { components, dropped } = collectSbomComponents(projects);
+    const rootComponent = readRootComponent(root);
+    const reproducible = parsed.reproducible || env.SOURCE_DATE_EPOCH !== undefined;
+    const bom = buildCycloneDxSbom(components, {
+        ...timestampOption(reproducible, now, env),
+        serialNumber: "urn:uuid:00000000-0000-0000-0000-000000000000",
+        toolVersion: dgVersion(),
+        ...(rootComponent.component ? { rootComponent: rootComponent.component } : {})
+    });
+    const finalBom = {
+        ...bom,
+        serialNumber: reproducible ? deterministicSerialNumber(bom) : `urn:uuid:${randomUUID()}`
+    };
+    const document = `${JSON.stringify(finalBom, null, 2)}\n`;
+    const notes = [];
+    if (components.length === 0) {
+        notes.push(`dg sbom: no resolvable dependencies found under ${root} — emitting an empty SBOM.`);
+    }
+    if (dropped.length > 0) {
+        notes.push(`dg sbom: omitted ${dropped.length} dependency(ies) without a pinned version (${formatDropped(dropped)}). Pin them (e.g. name==version) to include them.`);
+    }
+    if (rootComponent.malformed) {
+        notes.push(`dg sbom: ${root}/package.json could not be parsed — the SBOM has no named subject component.`);
+    }
+    const stderr = notes.length > 0 ? `${notes.join("\n")}\n` : "";
+    if (parsed.outputPath) {
+        try {
+            writeReportAtomic(resolve(cwd, parsed.outputPath), document);
+        }
+        catch (error) {
+            return { exitCode: EXIT_TOOL_ERROR, stdout: "", stderr: `dg sbom: could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n` };
+        }
+        return { exitCode: 0, stdout: `Wrote CycloneDX SBOM (${components.length} components) to ${parsed.outputPath}\n`, stderr };
+    }
+    const presentation = resolvePresentation();
+    if (parsed.json || !presentation.isTTY) {
+        return { exitCode: 0, stdout: document, stderr };
+    }
+    const subject = finalBom.metadata.component
+        ? `${finalBom.metadata.component.name}${finalBom.metadata.component.version ? `@${finalBom.metadata.component.version}` : ""}`
+        : basename(root) || ".";
+    if (shouldLaunchSbomTui({ json: parsed.json, outputPath: parsed.outputPath })) {
+        void launchSbomTui({ rows: buildSbomRows(components), dropped, subject, document, env, cwd }).then(() => process.exit(typeof process.exitCode === "number" ? process.exitCode : 0), (error) => {
+            process.stderr.write(`dg sbom view failed: ${error instanceof Error ? error.message : "unknown error"}\n`);
+            process.exit(1);
+        });
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    return { exitCode: 0, stdout: renderSbomSummary(finalBom, dropped, subject, createTheme(presentation.color)), stderr };
+}
+const ANSI_PATTERN = /\x1b\[[0-9;]*m/gu;
+function visibleWidth(text) {
+    return text.replace(ANSI_PATTERN, "").length;
+}
+export function renderSbomSummary(bom, dropped, subject, theme, terminalWidth = process.stdout.columns ?? 100) {
+    const components = bom.components;
+    const total = components.length;
+    const count = (prefix) => components.filter((c) => c["bom-ref"].startsWith(prefix)).length;
+    const ecosystems = [["npm", count("pkg:npm/")], ["pypi", count("pkg:pypi/")], ["cargo", count("pkg:cargo/")]]
+        .filter(([, n]) => n > 0)
+        .sort((a, b) => b[1] - a[1]);
+    const withLicense = components.filter((c) => c.licenses && c.licenses.length > 0).length;
+    const withHash = components.filter((c) => c.hashes && c.hashes.length > 0).length;
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const warn = (text) => theme.paint("warn", text);
+    const denomWidth = String(total).length;
+    const license = { label: "License", covered: withLicense, deficit: total - withLicense, gap: "unknown" };
+    const integrity = { label: "Integrity", covered: withHash, deficit: total - withHash, gap: "no checksum" };
+    const gapWidth = Math.max(1, String(license.deficit).length, String(integrity.deficit).length);
+    const gapClause = (q) => (q.deficit > 0 ? `${String(q.deficit).padStart(gapWidth)} ${q.gap}` : "");
+    const clauseWidth = Math.max(gapClause(license).length, gapClause(integrity).length);
+    const qualityRow = (q) => {
+        const clause = gapClause(q);
+        const painted = clause ? warn(clause) : "";
+        const fraction = muted(`${String(q.covered).padStart(denomWidth)} / ${total} covered`);
+        return `${muted(q.label.padEnd(10))}${painted}${" ".repeat(clauseWidth - clause.length)}   ${fraction}`;
+    };
+    const breakdown = ecosystems.map(([name, n]) => `${n} ${name}`).join(muted(" · "));
+    const rows = [
+        `${accent(String(total))} ${total === 1 ? "component" : "components"}${breakdown ? `   ${muted(breakdown)}` : ""}`,
+        "",
+        qualityRow(license),
+        qualityRow(integrity),
+        ...(dropped.length > 0
+            ? [`${muted("Omitted".padEnd(10))}${warn(`${String(dropped.length).padStart(gapWidth)} unpinned`)}${muted(", left out of the document")}`]
+            : []),
+        "",
+        muted(`CycloneDX 1.5 · ${subject} · inventory only`)
+    ];
+    const inner = Math.min(Math.max(0, ...rows.map(visibleWidth)), Math.max(24, terminalWidth - 4));
+    const bar = muted("─".repeat(inner + 2));
+    const side = muted("│");
+    const boxed = [
+        `${muted("╭")}${bar}${muted("╮")}`,
+        ...rows.map((row) => `${side} ${row}${" ".repeat(Math.max(0, inner - visibleWidth(row)))} ${side}`),
+        `${muted("╰")}${bar}${muted("╯")}`
+    ];
+    const footer = [
+        `  ${muted("→ write it:")} dg sbom -o sbom.cdx.json  ${muted("· --json prints it")}`,
+        `  ${accent("dg scan")} ${muted("for BLOCK / WARN / PASS verdicts")}`
+    ];
+    return `${[...boxed, ...footer].join("\n")}\n`;
+}
+function timestampOption(reproducible, now, env) {
+    if (!reproducible) {
+        return { timestamp: now.toISOString() };
+    }
+    const epoch = env.SOURCE_DATE_EPOCH;
+    if (epoch !== undefined && /^\d+$/.test(epoch.trim())) {
+        const date = new Date(Number.parseInt(epoch.trim(), 10) * 1000);
+        const iso = Number.isFinite(date.getTime()) ? date.toISOString() : "";
+        if (/^\d{4}-/u.test(iso)) {
+            return { timestamp: iso };
+        }
+    }
+    return {};
+}
+function deterministicSerialNumber(bom) {
+    const hex = createHash("sha256").update(JSON.stringify(bom.components)).digest("hex");
+    const version = `4${hex.slice(13, 16)}`;
+    const variantNibble = ((Number.parseInt(hex.slice(16, 17) || "0", 16) & 0x3) | 0x8).toString(16);
+    const variant = `${variantNibble}${hex.slice(17, 20)}`;
+    return `urn:uuid:${hex.slice(0, 8)}-${hex.slice(8, 12)}-${version}-${variant}-${hex.slice(20, 32)}`;
+}
+function formatDropped(dropped) {
+    const shown = dropped.slice(0, 5).join(", ");
+    return dropped.length > 5 ? `${shown}, +${dropped.length - 5} more` : shown;
+}
+function parseArgs(args) {
+    let targetPath = null;
+    let outputPath = null;
+    let reproducible = false;
+    let json = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === undefined) {
+            continue;
+        }
+        if (arg === "--output" || arg === "-o") {
+            const value = args[i + 1];
+            if (value === undefined || value.startsWith("-")) {
+                return { error: `${arg} needs a path` };
+            }
+            outputPath = value;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith("--output=")) {
+            outputPath = arg.slice("--output=".length);
+            continue;
+        }
+        if (arg === "--reproducible") {
+            reproducible = true;
+            continue;
+        }
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg.startsWith("-")) {
+            return { error: `unknown flag '${arg}'` };
+        }
+        if (targetPath !== null) {
+            return { error: `unexpected argument '${arg}'` };
+        }
+        targetPath = arg;
+    }
+    return { targetPath, outputPath, reproducible, json };
+}

package/dist/commands/scan.js

@@ -8,11 +8,12 @@ export const scanCommand = {
         { flag: "--json", summary: "Machine-readable JSON report." },
         { flag: "--sarif", summary: "SARIF report for code-scanning tools." },
         { flag: "--output", value: "<path>", summary: "Write the report to a file instead of stdout (alias -o)." },
-        { flag: "--staged", summary: "Scan only the git-staged lockfile changes (what dg guard-commit runs)." }
+        { flag: "--staged", summary: "Scan only the git-staged lockfile changes (what dg guard-commit runs)." },
+        { flag: "--no-decisions", summary: "Ignore acceptances remembered in dg.json (see dg decisions)." }
     ],
     examples: ["dg scan", "dg scan ./packages/api", "dg scan --json -o scan.json", "dg scan --staged"],
     details: [
-        "Reads lockfiles, scores each dependency through the scanner, and never changes project files. In a terminal it opens the full-screen results browser; piped or with --json/--sarif it prints machine output. Exit codes: 0 clean, 1 warn, 2 block, 4 analysis incomplete, 64 usage error."
+        "Reads lockfiles, scores each dependency through the scanner, and never changes project files. In a terminal it opens the full-screen results browser; piped or with --json/--sarif it prints machine output. Exit codes: 0 clean, 1 warn, 2 block, 4 analysis incomplete, 10 nothing to scan, 64 usage error."
     ],
     handler: runScanCommand
 };

package/dist/commands/service.js

@@ -2,6 +2,8 @@ import { EXIT_UNAVAILABLE, EXIT_USAGE } from "./types.js";
 import { renderCommandHelp } from "./help.js";
 import { buildServiceUninstallPlan, buildTrustInstallPlan, buildTrustUninstallPlan, installServiceTrust, readServiceState, renderServicePlan, resolveServicePaths, restartService, ServiceNotConfiguredError, ServiceProxyError, ServiceTrustStoreError, ServiceTrustToolMissingError, startService, stopService, uninstallService, uninstallServiceTrust } from "../service/state.js";
 import { LockBusyError } from "../state/locks.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
 const trustCommand = {
     name: "trust",
     summary: "Manage explicit service-mode trust installation.",
@@ -208,10 +210,12 @@ function mutationPlanWrites(action) {
 function serviceMutation(action, run) {
     try {
         const result = run();
+        const theme = createTheme(resolvePresentation().color);
         const changed = result.changed ? actionPastTense(action) : `already ${action === "start" ? "running" : "stopped"}`;
+        const detail = result.state.running && result.state.proxy ? ` ${theme.paint("muted", `at ${result.state.proxy.proxyUrl}`)}` : "";
         return {
             exitCode: 0,
-            stdout: `Dependency Guardian service ${changed}.\n${renderServiceStatus(result.state)}`,
+            stdout: `${theme.paint("pass", "✓")} Service ${changed}${detail} ${theme.paint("muted", "· dg service status")}\n`,
             stderr: ""
         };
     }
@@ -399,20 +403,34 @@ function parseJsonArgs(command, args) {
     };
 }
 function renderServiceStatus(state) {
+    const theme = createTheme(resolvePresentation().color);
+    const pass = (text) => `${theme.paint("pass", "✓")} ${text}`;
+    const warn = (text) => `${theme.paint("warn", "⚠")} ${text}`;
+    const configured = state.configured
+        ? pass("yes")
+        : warn(`no — run ${theme.paint("accent", "dg setup --service --yes")}`);
+    const running = state.running && state.proxy
+        ? pass(`yes ${theme.paint("muted", `(${state.proxy.proxyUrl})`)}`)
+        : warn(state.configured ? `no — run ${theme.paint("accent", "dg service start")}` : "no");
+    const trust = state.trust
+        ? pass(`${state.trust.provider} ${theme.paint("muted", `(${state.trust.fingerprintSha256.slice(0, 12)}…)`)}`)
+        : warn(`not installed — run ${theme.paint("accent", "dg service trust install --yes")}`);
     const lines = [
-        "Dependency Guardian service status",
+        "Dependency Guardian service",
         "",
-        `configured: ${state.configured ? "yes" : "no"}`,
-        `running: ${state.running ? "yes" : "no"}`,
-        `trust installed: ${state.trustInstalled ? "yes" : "no"}`,
-        `trust provider: ${state.trust ? state.trust.provider : "not installed"}`,
-        `trust fingerprint: ${state.trust ? state.trust.fingerprintSha256 : "not installed"}`,
-        `trust drift: ${state.trustDrift ? state.trustDrift.message : "none"}`,
-        `service proxy: ${state.proxy ? state.proxy.proxyUrl : "not running"}`,
-        `health endpoint: ${state.proxy ? state.proxy.healthUrl : "not running"}`,
-        `last error: ${state.lastError ?? "none"}`,
-        `policy synced: ${state.policySyncedAt ?? "never"}`
+        `  Configured   ${configured}`,
+        `  Running      ${running}`,
+        `  Trust        ${trust}`
     ];
+    if (state.trustDrift) {
+        lines.push(`  Trust drift  ${warn(state.trustDrift.message)}`);
+    }
+    lines.push(`  Policy sync  ${state.policySyncedAt ? pass(state.policySyncedAt) : theme.paint("muted", "never")}`);
+    if (state.lastError) {
+        lines.push(`  Last error   ${warn(state.lastError)}`);
+    }
+    lines.push("");
+    lines.push(`Full diagnostics: ${theme.paint("accent", "dg service doctor")}`);
     return `${lines.join("\n")}\n`;
 }
 function serviceStatusJson(state) {
@@ -503,10 +521,11 @@ function actionPastTense(action) {
     return "restarted";
 }
 function serviceNotConfiguredResult() {
+    const theme = createTheme(resolvePresentation().color);
     return {
         exitCode: EXIT_USAGE,
         stdout: "",
-        stderr: "dg service is not configured. Run 'dg setup --service --yes' first; no service or trust state was changed.\n"
+        stderr: `${theme.paint("warn", "dg service is not configured")} — run ${theme.paint("accent", "dg setup --service --yes")} first ${theme.paint("muted", "(no service or trust state was changed)")}\n`
     };
 }
 function trustStoreFailureResult(planText, action, message) {