@westbayberry/dg 2.0.11 → 2.2.0

package/dist/config/settings.js

@@ -1,6 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonAtomic } from "../util/json-file.js";
 import { acquireLockSyncWithRetry, resolveDgPaths } from "../state/index.js";
 export const CONFIG_KEYS = Object.freeze([
     "api.baseUrl",
@@ -9,11 +9,17 @@ export const CONFIG_KEYS = Object.freeze([
     "policy.trustProjectAllowlists",
     "policy.allowForceOverride",
     "policy.scriptHardening",
+    "scriptGate.mode",
+    "scriptGate.observe",
     "gitHook.onWarn",
     "gitHook.onIncomplete",
-    "audit.upload",
-    "telemetry.enabled",
-    "webhooks.enabled"
+    "cooldown.age",
+    "cooldown.npm.age",
+    "cooldown.pypi.age",
+    "cooldown.cargo.age",
+    "cooldown.onUnknown",
+    "cooldown.exempt",
+    "audit.upload"
 ]);
 export const DEFAULT_CONFIG = Object.freeze({
     version: 1,
@@ -29,18 +35,24 @@ export const DEFAULT_CONFIG = Object.freeze({
         allowForceOverride: true,
         scriptHardening: false
     },
+    scriptGate: {
+        mode: "observe",
+        observe: false
+    },
     gitHook: {
         onWarn: "prompt",
         onIncomplete: "allow"
     },
+    cooldown: {
+        age: "24h",
+        npmAge: "",
+        pypiAge: "",
+        cargoAge: "",
+        onUnknown: "allow",
+        exempt: ""
+    },
     audit: {
         upload: false
-    },
-    telemetry: {
-        enabled: false
-    },
-    webhooks: {
-        enabled: true
     }
 });
 export class ConfigError extends Error {
@@ -113,22 +125,48 @@ export function getConfigValue(config, key) {
     if (key === "policy.scriptHardening") {
         return String(config.policy.scriptHardening);
     }
+    if (key === "scriptGate.mode") {
+        return config.scriptGate.mode;
+    }
+    if (key === "scriptGate.observe") {
+        return String(config.scriptGate.observe);
+    }
     if (key === "gitHook.onWarn") {
         return config.gitHook.onWarn;
     }
     if (key === "gitHook.onIncomplete") {
         return config.gitHook.onIncomplete;
     }
-    if (key === "audit.upload") {
-        return String(config.audit.upload);
+    if (key === "cooldown.age") {
+        return config.cooldown.age;
+    }
+    if (key === "cooldown.npm.age") {
+        return config.cooldown.npmAge;
+    }
+    if (key === "cooldown.pypi.age") {
+        return config.cooldown.pypiAge;
+    }
+    if (key === "cooldown.cargo.age") {
+        return config.cooldown.cargoAge;
     }
-    if (key === "telemetry.enabled") {
-        return String(config.telemetry.enabled);
+    if (key === "cooldown.onUnknown") {
+        return config.cooldown.onUnknown;
     }
-    return String(config.webhooks.enabled);
+    if (key === "cooldown.exempt") {
+        return config.cooldown.exempt;
+    }
+    return String(config.audit.upload);
 }
-export function listConfig(config) {
-    return CONFIG_KEYS.map((key) => ({
+export const ADVANCED_CONFIG_KEYS = new Set([
+    "org.id",
+    "policy.scriptHardening",
+    "scriptGate.observe",
+    "cooldown.npm.age",
+    "cooldown.pypi.age",
+    "cooldown.cargo.age"
+]);
+export function listConfig(config, includeAdvanced = false) {
+    return CONFIG_KEYS.filter((key) => includeAdvanced || !ADVANCED_CONFIG_KEYS.has(key)).map((key) => ({
         key,
         value: getConfigValue(config, key)
     }));
@@ -168,44 +206,64 @@ export function setConfigValue(config, key, rawValue) {
     if (key === "policy.scriptHardening") {
         return withPolicyBoolean(config, "scriptHardening", rawValue);
     }
-    if (key === "gitHook.onWarn") {
+    if (key === "scriptGate.mode") {
         return {
             ...config,
-            gitHook: {
-                ...config.gitHook,
-                onWarn: parseOnWarn(rawValue)
+            scriptGate: {
+                ...config.scriptGate,
+                mode: parseScriptGateMode(rawValue)
             }
         };
     }
-    if (key === "gitHook.onIncomplete") {
+    if (key === "scriptGate.observe") {
         return {
             ...config,
-            gitHook: {
-                ...config.gitHook,
-                onIncomplete: parseOnIncomplete(rawValue)
+            scriptGate: {
+                ...config.scriptGate,
+                observe: parseBoolean(rawValue, key)
             }
         };
     }
-    if (key === "audit.upload") {
+    if (key === "gitHook.onWarn") {
         return {
             ...config,
-            audit: {
-                upload: parseBoolean(rawValue, key)
+            gitHook: {
+                ...config.gitHook,
+                onWarn: parseOnWarn(rawValue)
             }
         };
     }
-    if (key === "telemetry.enabled") {
+    if (key === "gitHook.onIncomplete") {
         return {
             ...config,
-            telemetry: {
-                enabled: parseBoolean(rawValue, key)
+            gitHook: {
+                ...config.gitHook,
+                onIncomplete: parseOnIncomplete(rawValue)
             }
         };
     }
+    if (key === "cooldown.age") {
+        return withCooldown(config, { age: parseCooldownAge(rawValue, key, false) });
+    }
+    if (key === "cooldown.npm.age") {
+        return withCooldown(config, { npmAge: parseCooldownAge(rawValue, key, true) });
+    }
+    if (key === "cooldown.pypi.age") {
+        return withCooldown(config, { pypiAge: parseCooldownAge(rawValue, key, true) });
+    }
+    if (key === "cooldown.cargo.age") {
+        return withCooldown(config, { cargoAge: parseCooldownAge(rawValue, key, true) });
+    }
+    if (key === "cooldown.onUnknown") {
+        return withCooldown(config, { onUnknown: parseCooldownOnUnknown(rawValue) });
+    }
+    if (key === "cooldown.exempt") {
+        return withCooldown(config, { exempt: parseCooldownExempt(rawValue) });
+    }
     return {
         ...config,
-        webhooks: {
-            enabled: parseBoolean(rawValue, key)
+        audit: {
+            upload: parseBoolean(rawValue, key)
         }
     };
 }
@@ -225,10 +283,11 @@ function normalizeConfig(raw) {
     const api = fieldObject(raw, "api");
     const org = fieldObject(raw, "org");
     const policy = fieldObject(raw, "policy");
+    const scriptGate = fieldObject(raw, "scriptGate");
     const gitHook = fieldObject(raw, "gitHook");
+    const cooldown = fieldObject(raw, "cooldown");
     const audit = fieldObject(raw, "audit");
-    const telemetry = fieldObject(raw, "telemetry");
-    const webhooks = fieldObject(raw, "webhooks");
+    const scriptHardening = fieldBoolean(policy, "policy.scriptHardening", "scriptHardening") ?? DEFAULT_CONFIG.policy.scriptHardening;
     return {
         version: 1,
         api: {
@@ -241,20 +300,26 @@ function normalizeConfig(raw) {
             mode: parsePolicyMode(fieldString(policy, "policy.mode", "mode") ?? DEFAULT_CONFIG.policy.mode),
             trustProjectAllowlists: fieldBoolean(policy, "policy.trustProjectAllowlists", "trustProjectAllowlists") ?? DEFAULT_CONFIG.policy.trustProjectAllowlists,
             allowForceOverride: fieldBoolean(policy, "policy.allowForceOverride", "allowForceOverride") ?? DEFAULT_CONFIG.policy.allowForceOverride,
-            scriptHardening: fieldBoolean(policy, "policy.scriptHardening", "scriptHardening") ?? DEFAULT_CONFIG.policy.scriptHardening
+            scriptHardening
+        },
+        scriptGate: {
+            mode: parseScriptGateMode(fieldString(scriptGate, "scriptGate.mode", "mode") ?? (scriptHardening ? "enforce" : DEFAULT_CONFIG.scriptGate.mode)),
+            observe: fieldBoolean(scriptGate, "scriptGate.observe", "observe") ?? DEFAULT_CONFIG.scriptGate.observe
         },
         gitHook: {
             onWarn: parseOnWarn(fieldString(gitHook, "gitHook.onWarn", "onWarn") ?? DEFAULT_CONFIG.gitHook.onWarn),
             onIncomplete: parseOnIncomplete(fieldString(gitHook, "gitHook.onIncomplete", "onIncomplete") ?? DEFAULT_CONFIG.gitHook.onIncomplete)
         },
+        cooldown: {
+            age: parseCooldownAge(fieldString(cooldown, "cooldown.age", "age") ?? DEFAULT_CONFIG.cooldown.age, "cooldown.age", false),
+            npmAge: parseCooldownAge(fieldString(cooldown, "cooldown.npm.age", "npmAge") ?? DEFAULT_CONFIG.cooldown.npmAge, "cooldown.npm.age", true),
+            pypiAge: parseCooldownAge(fieldString(cooldown, "cooldown.pypi.age", "pypiAge") ?? DEFAULT_CONFIG.cooldown.pypiAge, "cooldown.pypi.age", true),
+            cargoAge: parseCooldownAge(fieldString(cooldown, "cooldown.cargo.age", "cargoAge") ?? DEFAULT_CONFIG.cooldown.cargoAge, "cooldown.cargo.age", true),
+            onUnknown: parseCooldownOnUnknown(fieldString(cooldown, "cooldown.onUnknown", "onUnknown") ?? DEFAULT_CONFIG.cooldown.onUnknown),
+            exempt: parseCooldownExempt(fieldString(cooldown, "cooldown.exempt", "exempt") ?? DEFAULT_CONFIG.cooldown.exempt)
+        },
         audit: {
             upload: fieldBoolean(audit, "audit.upload", "upload") ?? DEFAULT_CONFIG.audit.upload
-        },
-        telemetry: {
-            enabled: fieldBoolean(telemetry, "telemetry.enabled", "enabled") ?? DEFAULT_CONFIG.telemetry.enabled
-        },
-        webhooks: {
-            enabled: fieldBoolean(webhooks, "webhooks.enabled", "enabled") ?? DEFAULT_CONFIG.webhooks.enabled
         }
     };
 }
@@ -321,6 +386,12 @@ function parsePolicyMode(value) {
     }
     throw new ConfigError("policy.mode must be one of: off, warn, block, strict");
 }
+function parseScriptGateMode(value) {
+    if (value === "observe" || value === "enforce" || value === "off") {
+        return value;
+    }
+    throw new ConfigError("scriptGate.mode must be one of: observe, enforce, off");
+}
 function parseOnWarn(value) {
     if (value === "prompt" || value === "allow" || value === "block") {
         return value;
@@ -333,6 +404,45 @@ function parseOnIncomplete(value) {
     }
     throw new ConfigError("gitHook.onIncomplete must be one of: allow, block");
 }
+const COOLDOWN_AGE_RE = /^([1-9]\d{0,3})(h|d)$/;
+const COOLDOWN_EXEMPT_ENTRY_RE = /^[@A-Za-z0-9][@A-Za-z0-9._/-]*\*?$/;
+export function parseCooldownAge(value, field, allowEmpty) {
+    const trimmed = value.trim();
+    if (trimmed === "" && allowEmpty) {
+        return "";
+    }
+    if (trimmed === "0" || trimmed === "off") {
+        return "0";
+    }
+    if (COOLDOWN_AGE_RE.test(trimmed)) {
+        return trimmed;
+    }
+    throw new ConfigError(`${field} must be a duration like 24h or 7d, or 0 to disable${allowEmpty ? ", or empty to inherit cooldown.age" : ""}`);
+}
+function parseCooldownOnUnknown(value) {
+    if (value === "allow" || value === "block") {
+        return value;
+    }
+    throw new ConfigError("cooldown.onUnknown must be one of: allow, block");
+}
+function parseCooldownExempt(value) {
+    const entries = value.split(",").map((entry) => entry.trim()).filter(Boolean);
+    for (const entry of entries) {
+        if (!COOLDOWN_EXEMPT_ENTRY_RE.test(entry)) {
+            throw new ConfigError(`cooldown.exempt entry '${entry}' is not a valid package name or pattern (use names or globs like @org/*)`);
+        }
+    }
+    return entries.join(",");
+}
+function withCooldown(config, patch) {
+    return {
+        ...config,
+        cooldown: {
+            ...config.cooldown,
+            ...patch
+        }
+    };
+}
 function parseBoolean(value, field) {
     if (value === "true") {
         return true;
@@ -359,24 +469,3 @@ function parseUrl(value) {
         throw new ConfigError("api.baseUrl must be an absolute URL");
     }
 }
-function writeJsonAtomic(path, value) {
-    mkdirSync(dirname(path), {
-        recursive: true,
-        mode: 0o700
-    });
-    const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
-    try {
-        writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: 0o600
-        });
-        renameSync(tempPath, path);
-    }
-    catch (error) {
-        rmSync(tempPath, {
-            force: true
-        });
-        throw error;
-    }
-}

package/dist/decisions/apply.js

@@ -0,0 +1,128 @@
+export function packageKey(name, version) {
+    return `${name}@${version}`;
+}
+export function findingCategory(finding) {
+    return finding.category ?? finding.id ?? "unknown";
+}
+export function findingFingerprint(findings) {
+    const fingerprint = {};
+    for (const finding of findings) {
+        const category = findingCategory(finding);
+        fingerprint[category] = Math.max(fingerprint[category] ?? 0, finding.severity);
+    }
+    return fingerprint;
+}
+export function matchDecision(pkg, ecosystem, entries, now = new Date()) {
+    if ((pkg.action ?? "pass") !== "warn") {
+        return { acknowledged: false };
+    }
+    const fingerprint = findingFingerprint(pkg.findings);
+    let nearestUncovered;
+    for (const entry of entries) {
+        if (entry.ecosystem !== ecosystem || entry.name !== pkg.name) {
+            continue;
+        }
+        if (!scopeMatches(entry, pkg.version)) {
+            continue;
+        }
+        if (isExpired(entry, now)) {
+            continue;
+        }
+        const uncovered = uncoveredFindings(fingerprint, entry.findings);
+        if (uncovered.length === 0) {
+            return { acknowledged: true, entry };
+        }
+        if (!nearestUncovered || uncovered.length < nearestUncovered.length) {
+            nearestUncovered = uncovered;
+        }
+    }
+    return nearestUncovered ? { acknowledged: false, newFindings: nearestUncovered } : { acknowledged: false };
+}
+export function applyDecisions(packages, ecosystemOf, file, rawAction, now = new Date()) {
+    const annotations = {};
+    let acknowledgedCount = 0;
+    let worst = 0;
+    for (const pkg of packages) {
+        const action = pkg.action ?? "pass";
+        if (action === "pass") {
+            continue;
+        }
+        const ecosystem = ecosystemOf(pkg);
+        if (!ecosystem) {
+            worst = Math.max(worst, actionSeverity(action));
+            continue;
+        }
+        const match = file.readable ? matchDecision(pkg, ecosystem, file.decisions, now) : { acknowledged: false };
+        const key = packageKey(pkg.name, pkg.version);
+        if (match.acknowledged) {
+            acknowledgedCount += 1;
+            annotations[key] = {
+                ecosystem,
+                acknowledged: {
+                    decisionId: match.entry.id,
+                    by: match.entry.acceptedBy,
+                    at: match.entry.acceptedAt,
+                    reason: match.entry.reason
+                }
+            };
+        }
+        else {
+            annotations[key] = {
+                ecosystem,
+                ...(match.newFindings ? { newFindings: match.newFindings } : {})
+            };
+            worst = Math.max(worst, actionSeverity(action));
+        }
+    }
+    const effectiveAction = acknowledgedCount === 0 || worst >= actionSeverity(rawAction) ? rawAction : actionFromSeverity(worst);
+    return {
+        file: file.path,
+        acknowledgedCount,
+        effectiveAction,
+        packages: annotations
+    };
+}
+const ACTION_SEVERITY = {
+    pass: 0,
+    analysis_incomplete: 1,
+    warn: 2,
+    block: 3
+};
+function actionSeverity(action) {
+    return ACTION_SEVERITY[action] ?? 0;
+}
+function actionFromSeverity(severity) {
+    if (severity >= 3) {
+        return "block";
+    }
+    if (severity === 2) {
+        return "warn";
+    }
+    if (severity === 1) {
+        return "analysis_incomplete";
+    }
+    return "pass";
+}
+function scopeMatches(entry, version) {
+    if (entry.scope.kind === "any") {
+        return true;
+    }
+    return entry.scope.version === version;
+}
+function isExpired(entry, now) {
+    if (!entry.expiresAt) {
+        return false;
+    }
+    const expiry = Date.parse(entry.expiresAt);
+    return !Number.isFinite(expiry) || expiry <= now.getTime();
+}
+function uncoveredFindings(fingerprint, accepted) {
+    const uncovered = [];
+    for (const [category, severity] of Object.entries(fingerprint)) {
+        const acceptedSeverity = accepted[category];
+        if (acceptedSeverity === undefined || severity > acceptedSeverity) {
+            uncovered.push(`${category}:${severity}`);
+        }
+    }
+    return uncovered.sort();
+}

package/dist/decisions/remember-prompt.js

@@ -0,0 +1,92 @@
+import { recordAuditEvent } from "../audit/events.js";
+import { loadUserConfig } from "../config/settings.js";
+import { promptText, promptYesNo } from "../install-ui/prompt.js";
+import { dirname } from "node:path";
+import { appendDecisions, mutateDgFile } from "../project/dgfile.js";
+import { promptLine as ttyPromptLine, promptYesNo as ttyPromptYesNo } from "../util/tty-prompt.js";
+import { findingFingerprint, packageKey } from "./apply.js";
+const defaultSyncPrompts = {
+    yesNo: (question, defaultYes) => ttyPromptYesNo(question, defaultYes),
+    line: (question) => ttyPromptLine(question),
+    write: (text) => process.stderr.write(text)
+};
+export async function offerRememberOnIo(options) {
+    const { io, file, packages } = options;
+    if (!io.isTTY || !file.readable || packages.length === 0) {
+        return false;
+    }
+    const choice = (await promptText("  Remember this acceptance? [v] this version / [o] just once: ", io)).trim().toLowerCase();
+    if (choice !== "v" && choice !== "version") {
+        return false;
+    }
+    if (!file.exists) {
+        const create = await promptYesNo(`  Create ${file.path}?`, io, false);
+        if (!create) {
+            return false;
+        }
+    }
+    const reason = (await promptText("  Reason (Enter to skip): ", io)).trim();
+    persistRemembered(file, packages, {
+        reason: reason || `accepted at ${options.surface}`,
+        acceptedBy: options.acceptedBy,
+        env: options.env ?? process.env
+    });
+    io.output.write(`  ✓ remembered in ${file.path} — review with 'dg decisions'\n`);
+    return true;
+}
+export function offerRememberSync(options) {
+    const { file, packages } = options;
+    const prompts = options.prompts ?? defaultSyncPrompts;
+    if (!file.readable || packages.length === 0) {
+        return false;
+    }
+    const remember = prompts.yesNo("  Remember this acceptance in dg.json for future commits?", false);
+    if (remember !== true) {
+        return false;
+    }
+    if (!file.exists) {
+        const create = prompts.yesNo(`  Create ${file.path}?`, false);
+        if (create !== true) {
+            return false;
+        }
+    }
+    const reason = (prompts.line("  Reason (Enter to skip): ") ?? "").trim();
+    persistRemembered(file, packages, {
+        reason: reason || `accepted at ${options.surface}`,
+        acceptedBy: options.acceptedBy,
+        env: options.env ?? process.env
+    });
+    prompts.write(`  ✓ remembered in ${file.path} — review with 'dg decisions'\n`);
+    return true;
+}
+export function persistRemembered(file, packages, options) {
+    const additions = packages.map((pkg) => ({
+        ecosystem: pkg.ecosystem,
+        name: pkg.name,
+        scope: { kind: "exact", version: pkg.version },
+        findings: findingFingerprint(pkg.findings),
+        reason: options.reason,
+        acceptedBy: options.acceptedBy
+    }));
+    mutateDgFile(dirname(file.path), options.env, (current) => appendDecisions(current, additions));
+    recordDecisionEvents("decision.accepted", packages.map((pkg) => `${pkg.ecosystem}:${packageKey(pkg.name, pkg.version)}`), options.reason, options.env);
+}
+export function recordDecisionEvents(type, packageNames, reason, env) {
+    let policyMode = "unknown";
+    try {
+        policyMode = loadUserConfig(env).policy.mode;
+    }
+    catch {
+        // a corrupt user config must not block recording the decision trail
+    }
+    for (const packageName of packageNames) {
+        const event = {
+            type,
+            packageName,
+            reason,
+            policyMode,
+            createdAt: new Date().toISOString()
+        };
+        recordAuditEvent(event, env);
+    }
+}