@westbayberry/dg 2.0.3 → 2.0.5

package/dist/api/analyze.js

@@ -6,6 +6,7 @@ import { envAuthToken } from "../auth/env-token.js";
 import { loadUserConfig } from "../config/settings.js";
 import { sanitize, sanitizeResponse } from "../security/sanitize.js";
 import { resolveDgPaths } from "../state/index.js";
+import { dgVersion } from "../commands/version.js";
 export class AnalyzeError extends Error {
     statusCode;
     body;
@@ -29,13 +30,15 @@ export async function analyzePackages(packages, options) {
     const token = resolveToken(env);
     const deviceId = getOrCreateDeviceId(env);
     const url = `${baseUrl}${ANALYZE_PATHS[options.ecosystem]}`;
-    options.onProgress?.(0, packages.length, []);
+    const batchCount = Math.max(1, Math.ceil(packages.length / BATCH_SIZE));
+    options.onProgress?.({ done: 0, total: packages.length, batchIndex: 0, batchCount });
     const responses = [];
     for (let index = 0; index < packages.length; index += BATCH_SIZE) {
         const batch = packages.slice(index, index + BATCH_SIZE);
-        options.onProgress?.(index, packages.length, batch.map((entry) => entry.name));
+        const batchIndex = Math.floor(index / BATCH_SIZE) + 1;
+        options.onProgress?.({ done: index, total: packages.length, batchIndex, batchCount });
         responses.push(await analyzeBatchWithRetry(url, batch, token, deviceId, fetchImpl, options.timeoutMs ?? DEFAULT_TIMEOUT_MS));
-        options.onProgress?.(Math.min(index + batch.length, packages.length), packages.length, batch.map((entry) => entry.name));
+        options.onProgress?.({ done: Math.min(index + batch.length, packages.length), total: packages.length, batchIndex, batchCount });
     }
     return mergeAnalyzeResponses(responses);
 }
@@ -86,6 +89,7 @@ async function analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs) {
             headers: {
                 "Content-Type": "application/json",
                 "X-Device-Id": deviceId,
+                "X-Dg-Version": dgVersion(),
                 ...(token ? { Authorization: `Bearer ${token}` } : {})
             },
             body: JSON.stringify({

package/dist/scan-ui/LegacyApp.js

@@ -128,8 +128,8 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
             case "selecting":
                 return (_jsx(ProjectSelector, { projects: state.projects, onConfirm: scanSelectedProjects, onCancel: () => { process.exitCode = 0; leaveAltScreen(); exit(); }, userStatus: userStatus }));
             case "scanning":
-                return (_jsx(ProgressBar, { value: state.done, total: state.total, label: state.currentBatch.length > 0
-                        ? state.currentBatch[state.currentBatch.length - 1]
+                return (_jsx(ProgressBar, { value: state.done, total: state.total, label: state.batchCount > 1 && state.batchIndex >= 1
+                        ? `batch ${state.batchIndex}/${state.batchCount}`
                         : undefined }));
             case "results":
                 return (_jsx(InteractiveResultsView, { result: state.result, config: config, durationMs: state.durationMs, onExit: handleResultsExit, onBack: restartSelection ?? undefined, discoveredTotal: state.discoveredTotal, userStatus: userStatus, scanUsage: scanUsage, initialView: initialView }));

package/dist/scan-ui/components/InteractiveResultsView.js

@@ -47,7 +47,7 @@ function isYankedIncomplete(pkg) {
 }
 export function packageBadge(pkg) {
     if (isYankedIncomplete(pkg))
-        return { label: "Removed", color: chalk.yellow };
+        return { label: "Unverified", color: chalk.yellow };
     return actionBadge(pkg.action);
 }
 const EVIDENCE_LIMIT = 2;

package/dist/scan-ui/format-helpers.js

@@ -21,9 +21,10 @@ export function truncate(s, max) {
 export function groupPackages(packages, keyBy = "name") {
     const map = new Map();
     for (const pkg of packages) {
+        const action = pkg.action ?? "pass";
         const fingerprint = pkg.findings.length === 0
-            ? `__clean_${pkg.score}`
-            : pkg.findings
+            ? `${action}|${pkg.name}@${pkg.version ?? ""}|score:${pkg.score}`
+            : `${action}|` + pkg.findings
                 .map((f) => `${f.category ?? ""}:${f.severity}`)
                 .sort()
                 .join("|") + `|score:${pkg.score}`;

package/dist/scan-ui/hooks/useScan.js

@@ -9,11 +9,11 @@ function reducer(_state, action) {
         case "DISCOVERY_PROGRESS":
             return { phase: "discovering", path: action.path, found: action.found };
         case "DISCOVERY_COMPLETE":
-            return { phase: "scanning", done: 0, total: action.total, currentBatch: [] };
+            return { phase: "scanning", done: 0, total: action.total, batchIndex: 0, batchCount: 1 };
         case "DISCOVERY_EMPTY":
             return { phase: "empty", message: action.message };
         case "SCAN_PROGRESS":
-            return { phase: "scanning", done: action.done, total: action.total, currentBatch: action.currentBatch };
+            return { phase: "scanning", done: action.done, total: action.total, batchIndex: action.batchIndex, batchCount: action.batchCount };
         case "SCAN_COMPLETE":
             return {
                 phase: "results",
@@ -83,8 +83,8 @@ async function scanProjects(projects, dispatch) {
             const base = completed;
             responses.push(await analyzePackages(packages, {
                 ecosystem,
-                onProgress: (done, _ecosystemTotal, currentBatch) => {
-                    dispatch({ type: "SCAN_PROGRESS", done: base + done, total, currentBatch: [...currentBatch] });
+                onProgress: (progress) => {
+                    dispatch({ type: "SCAN_PROGRESS", done: base + progress.done, total, batchIndex: progress.batchIndex, batchCount: progress.batchCount });
                 }
             }));
             completed = base + packages.length;

package/dist/setup/plan.js

@@ -14,6 +14,8 @@ import { OPTIONAL_SUPPORT_GATES } from "./optional-support.js";
 export const SHIM_COMMANDS = Object.freeze(["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pipx", "uv", "uvx", "cargo"]);
 export const SHIM_SENTINEL = "dg-shim-v1";
 export const RC_SENTINEL = "dg-shell-rc-v1";
+export const RC_FUNCTIONS_SENTINEL = "dg-shim-functions-v1";
+const RC_SHIM_HELPER = "__dg_shim";
 export const GUARD_HOOK_SENTINEL = "dg-git-hook-v1";
 export const RC_BEGIN = "# >>> dg setup >>>";
 export const RC_END = "# <<< dg setup <<<";
@@ -273,6 +275,7 @@ export function doctorReport(options = {}) {
     });
     const rcEntries = registryRead.registry.entries.filter((entry) => entry.owner === "dg" && entry.kind === "rc");
     const missingRc = rcEntries.filter((entry) => !readText(entry.path).includes(RC_SENTINEL));
+    const functionsPresent = rcEntries.some((entry) => readText(entry.path).includes(RC_FUNCTIONS_SENTINEL));
     checks.push({
         name: "shell-rc",
         status: rcEntries.length > 0 && missingRc.length === 0 ? "pass" : "warn",
@@ -286,7 +289,7 @@ export function doctorReport(options = {}) {
             ? "No legacy dg pip hooks in user site-packages"
             : `Legacy dg pip hooks break pip in: ${staleHookSites.join(", ")}`
     });
-    checks.push(pathPrecedenceCheck(env, shimDir));
+    checks.push(pathPrecedenceCheck(env, shimDir, functionsPresent));
     checks.push({
         name: "stale-sessions",
         status: staleSessions.length === 0 ? "pass" : "warn",
@@ -510,11 +513,20 @@ function withRcBlock(existing, plan) {
     const prefix = withoutExisting.length > 0 && !withoutExisting.endsWith("\n") ? `${withoutExisting}\n` : withoutExisting;
     return `${prefix}${block}`;
 }
+// The PATH export covers child processes that inherit it; the shell functions
+// win even when a virtualenv prepends its own bin ahead of the shim dir, since
+// a function is resolved before PATH. Each delegates to the fail-open shim and
+// falls back to the real command if the shim is gone.
 function posixRcBlock(shimDir) {
-    return `${RC_BEGIN}\n# ${RC_SENTINEL}\nexport PATH="${escapeDoubleQuotedSh(shimDir)}:$PATH"\n${RC_END}\n`;
+    const dir = escapeDoubleQuotedSh(shimDir);
+    const helper = `${RC_SHIM_HELPER}() { local __dg_c="$1"; shift; if [ -x "${dir}/$__dg_c" ]; then "${dir}/$__dg_c" "$@"; else command "$__dg_c" "$@"; fi; }`;
+    const fns = SHIM_COMMANDS.map((command) => `${command}() { ${RC_SHIM_HELPER} ${command} "$@"; }`).join("\n");
+    return `${RC_BEGIN}\n# ${RC_SENTINEL}\n# ${RC_FUNCTIONS_SENTINEL}\nexport PATH="${dir}:$PATH"\n${helper}\n${fns}\n${RC_END}\n`;
 }
 function fishRcBlock(shimDir) {
-    return `${RC_BEGIN}\n# ${RC_SENTINEL}\nfish_add_path -p "${escapeDoubleQuotedFish(shimDir)}"\n${RC_END}\n`;
+    const dir = escapeDoubleQuotedFish(shimDir);
+    const fns = SHIM_COMMANDS.map((command) => `function ${command}; if test -x "${dir}/${command}"; "${dir}/${command}" $argv; else; command ${command} $argv; end; end`).join("\n");
+    return `${RC_BEGIN}\n# ${RC_SENTINEL}\n# ${RC_FUNCTIONS_SENTINEL}\nfish_add_path -p "${dir}"\n${fns}\n${RC_END}\n`;
 }
 function stripRcBlock(existing) {
     const pattern = new RegExp(`${escapeRegex(RC_BEGIN)}\\n[\\s\\S]*?${escapeRegex(RC_END)}\\n?`, "g");
@@ -778,7 +790,7 @@ function serviceCheck(env) {
         message: `Service mode is running at ${state.proxy.proxyUrl}; trust installed: ${state.trustInstalled ? "yes" : "no"}`
     };
 }
-function pathPrecedenceCheck(env, shimDir) {
+function pathPrecedenceCheck(env, shimDir, functionsPresent) {
     const pathEntries = (env.PATH ?? "").split(delimiter).filter(Boolean);
     const shimIndex = pathEntries.indexOf(shimDir);
     const activateFix = `activate this shell: ${currentShellActivation(env)} — or open a new terminal`;
@@ -812,11 +824,18 @@ function pathPrecedenceCheck(env, shimDir) {
         };
     }
     if (offender) {
+        if (functionsPresent) {
+            return {
+                name: "path",
+                status: "pass",
+                message: `${offender.dir} resolves ${offender.command} first (e.g. an active virtualenv); dg shell functions intercept bare installs regardless`
+            };
+        }
         return {
             name: "path",
             status: "warn",
             message: `${shimDir} is on PATH but ${offender.dir} resolves ${offender.command} first`,
-            fix: activateFix
+            fix: `re-run dg setup to intercept inside virtualenvs — or ${activateFix}`
         };
     }
     return {

package/dist/verify/preflight.js

@@ -245,44 +245,73 @@ function parsePackageLock(text) {
         return [malformedLockfileObservation("package-lock.json", new Error("root must be an object"))];
     }
     const observations = [];
-    const packages = isRecord(parsed.packages) ? parsed.packages : {};
-    for (const [path, rawPackage] of Object.entries(packages)) {
-        if (path.length === 0 || !isRecord(rawPackage)) {
-            continue;
-        }
-        const name = typeof rawPackage.name === "string" ? rawPackage.name : packageNameFromNodeModulesPath(path);
-        const version = typeof rawPackage.version === "string" ? rawPackage.version : null;
-        if (!name) {
-            continue;
+    if (isRecord(parsed.packages)) {
+        for (const [path, rawPackage] of Object.entries(parsed.packages)) {
+            if (path.length === 0 || !isRecord(rawPackage) || rawPackage.link === true) {
+                continue;
+            }
+            const declaredName = typeof rawPackage.name === "string" ? rawPackage.name : packageNameFromNodeModulesPath(path);
+            const alias = npmAliasVersion(stringOrNull(rawPackage.version));
+            const name = alias?.name ?? declaredName;
+            const version = alias?.version ?? (typeof rawPackage.version === "string" ? rawPackage.version : null);
+            if (!name) {
+                continue;
+            }
+            observations.push(lockfileObservation({
+                ecosystem: "npm",
+                name,
+                version,
+                requested: path,
+                sourceKind: "lockfile",
+                resolvedUrl: stringOrNull(rawPackage.resolved),
+                integrity: stringOrNull(rawPackage.integrity),
+                license: stringOrNull(rawPackage.license)
+            }));
         }
-        observations.push(lockfileObservation({
-            ecosystem: "npm",
-            name,
-            version,
-            requested: path,
-            sourceKind: "lockfile",
-            resolvedUrl: stringOrNull(rawPackage.resolved),
-            integrity: stringOrNull(rawPackage.integrity),
-            license: stringOrNull(rawPackage.license)
-        }));
+        return observations;
     }
-    const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
+    if (isRecord(parsed.dependencies)) {
+        walkLegacyDependencies(parsed.dependencies, observations, new Set());
+    }
+    return observations;
+}
+function walkLegacyDependencies(dependencies, observations, seen) {
     for (const [name, rawPackage] of Object.entries(dependencies)) {
-        if (!isRecord(rawPackage) || observations.some((observation) => observation.identity.name === name)) {
+        if (!isRecord(rawPackage) || rawPackage.bundled === true) {
             continue;
         }
-        observations.push(lockfileObservation({
-            ecosystem: "npm",
-            name,
-            version: stringOrNull(rawPackage.version),
-            requested: name,
-            sourceKind: "lockfile",
-            resolvedUrl: stringOrNull(rawPackage.resolved),
-            integrity: stringOrNull(rawPackage.integrity),
-            license: stringOrNull(rawPackage.license)
-        }));
+        const alias = npmAliasVersion(stringOrNull(rawPackage.version));
+        const resolvedName = alias?.name ?? name;
+        const version = alias?.version ?? stringOrNull(rawPackage.version);
+        const key = `${resolvedName}@${version ?? ""}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            observations.push(lockfileObservation({
+                ecosystem: "npm",
+                name: resolvedName,
+                version,
+                requested: name,
+                sourceKind: "lockfile",
+                resolvedUrl: stringOrNull(rawPackage.resolved),
+                integrity: stringOrNull(rawPackage.integrity),
+                license: stringOrNull(rawPackage.license)
+            }));
+        }
+        if (isRecord(rawPackage.dependencies)) {
+            walkLegacyDependencies(rawPackage.dependencies, observations, seen);
+        }
     }
-    return observations;
+}
+function npmAliasVersion(version) {
+    if (!version || !version.startsWith("npm:")) {
+        return null;
+    }
+    const spec = version.slice(4);
+    const at = spec.startsWith("@") ? spec.indexOf("@", 1) : spec.indexOf("@");
+    if (at <= 0) {
+        return { name: spec, version: null };
+    }
+    return { name: spec.slice(0, at), version: spec.slice(at + 1) || null };
 }
 function parseYarnLock(text) {
     const observations = [];
@@ -293,22 +322,23 @@ function parseYarnLock(text) {
         if (!header) {
             continue;
         }
+        if (header.startsWith("#") || header === "__metadata") {
+            continue;
+        }
         const requested = header.split(",")[0]?.trim().replace(/^"|"$/gu, "") ?? header;
         const name = packageNameFromYarnDescriptor(requested);
-        if (!name) {
+        const version = quotedValue(lines, "version");
+        if (!name || !version) {
             continue;
         }
-        const version = quotedValue(lines, "version");
-        const resolvedUrl = quotedValue(lines, "resolved");
-        const integrity = quotedValue(lines, "integrity");
         observations.push(lockfileObservation({
             ecosystem: "npm",
             name,
             version,
             requested,
             sourceKind: "lockfile",
-            resolvedUrl,
-            integrity,
+            resolvedUrl: quotedValue(lines, "resolved"),
+            integrity: quotedValue(lines, "integrity") ?? quotedValue(lines, "checksum"),
             license: null
         }));
     }
@@ -317,23 +347,33 @@ function parseYarnLock(text) {
 function parsePnpmLock(text) {
     const observations = [];
     const lines = text.split(/\r?\n/u);
+    let inPackages = false;
     let current = null;
+    const flush = () => {
+        if (current) {
+            observations.push(lockfileObservation(current));
+            current = null;
+        }
+    };
     for (const line of lines) {
-        const packageMatch = /^\s{2}['"]?(?:\/)?((?:@[^/\s]+\/)?[^@\s:'"]+)@([^:\s'"]+)['"]?:\s*$/u.exec(line);
-        if (packageMatch?.[1] && packageMatch[2]) {
-            if (current) {
-                observations.push(lockfileObservation(current));
-            }
-            current = {
-                ecosystem: "npm",
-                name: packageMatch[1],
-                version: packageMatch[2],
-                requested: `${packageMatch[1]}@${packageMatch[2]}`,
-                sourceKind: "lockfile",
-                resolvedUrl: null,
-                integrity: null,
-                license: null
-            };
+        const sectionMatch = /^([A-Za-z][\w-]*):\s*$/u.exec(line);
+        if (sectionMatch) {
+            flush();
+            // The `snapshots:` section keys the resolved peer graph, e.g.
+            // `eslint-utils@4.9.1(eslint@9.39.4)` — the peer suffix is not a real
+            // registry version, so scanning it yields a false "removed from
+            // registry" verdict. `packages:` is the canonical inventory (carries
+            // integrity); take identity only from there.
+            inPackages = sectionMatch[1] === "packages";
+            continue;
+        }
+        if (!inPackages) {
+            continue;
+        }
+        const keyMatch = /^\s{2}(\S.*?):\s*$/u.exec(line);
+        if (keyMatch?.[1]) {
+            flush();
+            current = parsePnpmPackageKey(keyMatch[1]);
             continue;
         }
         if (!current) {
@@ -354,24 +394,69 @@ function parsePnpmLock(text) {
             };
         }
     }
-    if (current) {
-        observations.push(lockfileObservation(current));
-    }
+    flush();
     return observations;
 }
+function parsePnpmPackageKey(rawKey) {
+    const key = stripQuotes(rawKey.trim());
+    if (/(?:file|link|workspace|git\+|git:|https?):/u.test(key)) {
+        return null;
+    }
+    const hadSlash = key.startsWith("/");
+    const body = hadSlash ? key.slice(1) : key;
+    let name = null;
+    let version = null;
+    if (hadSlash) {
+        // lockfileVersion 5.x keys are /<name>/<version>[_peer]; the version
+        // follows the final slash and the name may itself be scoped (two slashes).
+        const lastSlash = body.lastIndexOf("/");
+        if (lastSlash > 0) {
+            name = body.slice(0, lastSlash);
+            version = stripPnpmPeerSuffix(body.slice(lastSlash + 1));
+        }
+    }
+    else {
+        const atForm = /^((?:@[^/\s]+\/)?[^@\s]+)@(.+)$/u.exec(body);
+        if (atForm?.[1] && atForm[2]) {
+            name = atForm[1];
+            version = stripPnpmPeerSuffix(atForm[2]);
+        }
+    }
+    if (!name || !version) {
+        return null;
+    }
+    return {
+        ecosystem: "npm",
+        name,
+        version,
+        requested: `${name}@${version}`,
+        sourceKind: "lockfile",
+        resolvedUrl: null,
+        integrity: null,
+        license: null
+    };
+}
+function stripPnpmPeerSuffix(version) {
+    const peerStart = version.search(/[(_]/u);
+    return peerStart === -1 ? version : version.slice(0, peerStart);
+}
 function parseRequirements(text) {
-    return text.split(/\r?\n/u)
-        .map((line) => line.trim())
-        .filter((line) => line.length > 0 && !line.startsWith("#"))
-        .map((line) => {
-        if (REMOTE_SPEC_PREFIXES.some((prefix) => line.toLowerCase().startsWith(prefix))) {
-            return packageObservation({
+    const observations = [];
+    for (const logical of joinRequirementContinuations(text.split(/\r?\n/u))) {
+        const line = logical.trim();
+        if (line.length === 0 || line.startsWith("#")) {
+            continue;
+        }
+        const editable = /^(?:-e|--editable)[=\s]+(.+)$/u.exec(line);
+        const target = (editable?.[1] ?? line).trim();
+        if (REMOTE_SPEC_PREFIXES.some((prefix) => target.toLowerCase().startsWith(prefix))) {
+            observations.push(packageObservation({
                 ecosystem: "pypi",
-                name: line,
+                name: target,
                 version: null,
                 requested: line,
                 sourceKind: "lockfile-url-fallback",
-                resolvedUrl: line,
+                resolvedUrl: target,
                 integrity: null,
                 license: null
             }, "block", {
@@ -379,15 +464,20 @@ function parseRequirements(text) {
                 title: "Lockfile URL fallback identity",
                 message: "lockfile entry uses a URL without package identity or hash metadata",
                 location: line
-            });
+            }));
+            continue;
         }
-        const hash = /--hash=([A-Za-z0-9:-]+)/u.exec(line)?.[1] ?? null;
-        const cleanLine = line.replace(/\s+--hash=[^\s]+/gu, "");
-        const match = /^([A-Za-z0-9_.-]+)(?:==([^;\s]+))?/u.exec(cleanLine);
+        if (line.startsWith("-") || /^\.{0,2}\//u.test(target)) {
+            continue;
+        }
+        const hash = /--hash=([A-Za-z0-9:_-]+)/u.exec(line)?.[1] ?? null;
+        const requirement = line.replace(/\s*--hash=[^\s]+/gu, "").trim();
+        const match = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?(?:\s*==\s*([^;\s]+))?/u.exec(requirement);
         if (!match?.[1]) {
-            return blockedUnknownSpec(line);
+            observations.push(blockedUnknownSpec(line));
+            continue;
         }
-        return lockfileObservation({
+        observations.push(lockfileObservation({
             ecosystem: "pypi",
             name: match[1],
             version: match[2] ?? null,
@@ -396,8 +486,25 @@ function parseRequirements(text) {
             resolvedUrl: null,
             integrity: hash,
             license: null
-        });
-    });
+        }));
+    }
+    return observations;
+}
+function joinRequirementContinuations(lines) {
+    const joined = [];
+    let buffer = "";
+    for (const line of lines) {
+        if (line.endsWith("\\")) {
+            buffer += `${line.slice(0, -1)} `;
+            continue;
+        }
+        joined.push(buffer + line);
+        buffer = "";
+    }
+    if (buffer.length > 0) {
+        joined.push(buffer);
+    }
+    return joined;
 }
 function parseCargoLock(text) {
     return lockBlocks(text, "[[package]]").map((block) => {
@@ -426,7 +533,7 @@ function parsePoetryLock(text) {
             requested: `${name}==${version ?? "unknown"}`,
             sourceKind: "lockfile",
             resolvedUrl: null,
-            integrity: null,
+            integrity: /hash\s*=\s*"([^"]+)"/u.exec(block)?.[1] ?? null,
             license: tomlString(block, "license")
         });
     }).filter((observation) => observation.identity.name !== "unknown");
@@ -588,7 +695,8 @@ function isExactVersion(version) {
 }
 function isSupportedIntegrity(value) {
     return /^(?:sha256|sha384|sha512)-[A-Za-z0-9+/=]+$/u.test(value)
-        || /^(?:sha256:)?[a-f0-9]{64}$/iu.test(value);
+        || /^(?:sha256:)?[a-f0-9]{64}$/iu.test(value)
+        || /^[0-9a-f]+\/[0-9a-f]{64,}$/iu.test(value);
 }
 function isUnsafeResolvedUrl(value) {
     const lower = value.toLowerCase();
@@ -657,13 +765,18 @@ function packageNameFromNodeModulesPath(path) {
     return first;
 }
 function packageNameFromYarnDescriptor(descriptor) {
-    const value = descriptor.startsWith("@") ? descriptor.slice(1) : descriptor;
-    const index = value.lastIndexOf("@");
-    const name = descriptor.startsWith("@") ? `@${value.slice(0, index)}` : value.slice(0, index);
-    return name || null;
+    const scoped = descriptor.startsWith("@");
+    const body = scoped ? descriptor.slice(1) : descriptor;
+    const at = body.indexOf("@");
+    const name = at === -1 ? descriptor : scoped ? `@${body.slice(0, at)}` : body.slice(0, at);
+    const spec = at === -1 ? "" : body.slice(at + 1);
+    // npm: alias descriptors (`alias@npm:real-pkg@range`) resolve to the alias
+    // target — that is the registry artifact actually fetched and scanned.
+    const alias = /^npm:((?:@[^/\s]+\/)?[^@\s]+)@/u.exec(spec);
+    return alias?.[1] ?? (name || null);
 }
 function quotedValue(lines, key) {
-    const pattern = new RegExp(`^\\s*${key}\\s+\"?([^\"\\n]+)\"?\\s*$`, "u");
+    const pattern = new RegExp(`^\\s*${key}:?\\s+"?([^"\\n]+?)"?\\s*$`, "u");
     for (const line of lines) {
         const match = pattern.exec(line);
         if (match?.[1]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "description": "Dependency Guardian supply-chain firewall CLI",
   "type": "module",
   "bin": {