@westbayberry/dg 2.0.4 → 2.0.6

package/LICENSE

@@ -1 +1,201 @@
-UNLICENSED
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a
+      fee for, acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend,
+      and hold each Contributor harmless for any liability incurred by,
+      or claims asserted against, such Contributor by reason of your
+      accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 WestBayBerry
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/NOTICE

@@ -1 +1,5 @@
 Dependency Guardian dg CLI
+Copyright 2026 WestBayBerry
+
+This product is licensed under the Apache License, Version 2.0.
+See the LICENSE file for the full license text.

package/dist/api/analyze.js

@@ -6,6 +6,7 @@ import { envAuthToken } from "../auth/env-token.js";
 import { loadUserConfig } from "../config/settings.js";
 import { sanitize, sanitizeResponse } from "../security/sanitize.js";
 import { resolveDgPaths } from "../state/index.js";
+import { dgVersion } from "../commands/version.js";
 export class AnalyzeError extends Error {
     statusCode;
     body;
@@ -22,6 +23,7 @@ const ANALYZE_PATHS = {
 };
 const BATCH_SIZE = 200;
 const DEFAULT_TIMEOUT_MS = 180_000;
+const BATCH_CONCURRENCY = Math.max(1, Number(process.env.DG_ANALYZE_CONCURRENCY) || 4);
 export async function analyzePackages(packages, options) {
     const env = options.env ?? process.env;
     const fetchImpl = options.fetchImpl ?? fetch;
@@ -29,22 +31,47 @@ export async function analyzePackages(packages, options) {
     const token = resolveToken(env);
     const deviceId = getOrCreateDeviceId(env);
     const url = `${baseUrl}${ANALYZE_PATHS[options.ecosystem]}`;
-    options.onProgress?.(0, packages.length, []);
-    const responses = [];
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const total = packages.length;
+    const batches = [];
     for (let index = 0; index < packages.length; index += BATCH_SIZE) {
-        const batch = packages.slice(index, index + BATCH_SIZE);
-        options.onProgress?.(index, packages.length, batch.map((entry) => entry.name));
-        responses.push(await analyzeBatchWithRetry(url, batch, token, deviceId, fetchImpl, options.timeoutMs ?? DEFAULT_TIMEOUT_MS));
-        options.onProgress?.(Math.min(index + batch.length, packages.length), packages.length, batch.map((entry) => entry.name));
+        batches.push(packages.slice(index, index + BATCH_SIZE));
     }
+    const batchCount = Math.max(1, batches.length);
+    options.onProgress?.({ done: 0, total, batchIndex: 0, batchCount });
+    const perBatchDone = new Array(batches.length).fill(0);
+    const responses = new Array(batches.length);
+    let batchesFinished = 0;
+    const reportProgress = () => {
+        const done = perBatchDone.reduce((sum, n) => sum + n, 0);
+        options.onProgress?.({ done, total, batchIndex: batchesFinished, batchCount });
+    };
+    let cursor = 0;
+    const runWorker = async () => {
+        for (let i = cursor++; i < batches.length; i = cursor++) {
+            const batch = batches[i];
+            if (!batch)
+                continue;
+            const response = await analyzeBatchWithRetry(url, batch, token, deviceId, fetchImpl, timeoutMs, (batchDone) => {
+                perBatchDone[i] = Math.min(batchDone, batch.length);
+                reportProgress();
+            });
+            perBatchDone[i] = batch.length;
+            batchesFinished += 1;
+            responses[i] = response;
+            reportProgress();
+        }
+    };
+    const workers = Math.min(BATCH_CONCURRENCY, Math.max(1, batches.length));
+    await Promise.all(Array.from({ length: workers }, () => runWorker()));
     return mergeAnalyzeResponses(responses);
 }
 const MAX_BATCH_ATTEMPTS = 3;
-async function analyzeBatchWithRetry(url, batch, token, deviceId, fetchImpl, timeoutMs) {
+async function analyzeBatchWithRetry(url, batch, token, deviceId, fetchImpl, timeoutMs, onBatchProgress) {
     let lastError;
     for (let attempt = 1; attempt <= MAX_BATCH_ATTEMPTS; attempt += 1) {
         try {
-            return await analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs);
+            return await analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs, onBatchProgress);
         }
         catch (error) {
             lastError = error;
@@ -77,7 +104,7 @@ function isRetryableAnalyzeError(error) {
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs) {
+async function analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs, onBatchProgress) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -85,7 +112,9 @@ async function analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
+                "Accept": "application/x-ndjson",
                 "X-Device-Id": deviceId,
+                "X-Dg-Version": dgVersion(),
                 ...(token ? { Authorization: `Bearer ${token}` } : {})
             },
             body: JSON.stringify({
@@ -100,6 +129,11 @@ async function analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs) {
                 : `scanner returned ${response.status}`;
             throw new AnalyzeError(serverMessage, response.status, body);
         }
+        const headers = response.headers;
+        const contentType = headers?.get("content-type") ?? "";
+        if (contentType.includes("application/x-ndjson") && response.body) {
+            return await consumeAnalyzeStream(response.body, onBatchProgress);
+        }
         return normalizeAnalyzeResponse(await response.json());
     }
     catch (error) {
@@ -112,6 +146,54 @@ async function analyzeBatch(url, batch, token, deviceId, fetchImpl, timeoutMs) {
         clearTimeout(timeout);
     }
 }
+async function consumeAnalyzeStream(body, onBatchProgress) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let result;
+    const handleLine = (line) => {
+        if (!line)
+            return;
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (event.type === "progress" || event.type === "cache_hit") {
+            if (typeof event.done === "number")
+                onBatchProgress(event.done);
+        }
+        else if (event.type === "error") {
+            throw new AnalyzeError(typeof event.error === "string" ? sanitize(event.error) : `scanner returned ${event.statusCode ?? 500}`, typeof event.statusCode === "number" ? event.statusCode : 0, event);
+        }
+        else if (event.type === "result") {
+            result = normalizeAnalyzeResponse(event.payload);
+        }
+    };
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            let newline;
+            while ((newline = buffer.indexOf("\n")) >= 0) {
+                handleLine(buffer.slice(0, newline).trim());
+                buffer = buffer.slice(newline + 1);
+            }
+        }
+        handleLine(buffer.trim());
+    }
+    finally {
+        reader.cancel().catch(() => undefined);
+    }
+    if (!result) {
+        throw new AnalyzeError("scanner stream ended without a result", 0);
+    }
+    return result;
+}
 export function normalizeAnalyzeResponse(raw) {
     const candidate = raw;
     if (!candidate || typeof candidate.score !== "number" || !Array.isArray(candidate.packages)) {

package/dist/commands/setup.js

@@ -25,7 +25,9 @@ export const setupCommand = {
     ],
     handler: (context) => setupHandler(context.args)
 };
-const WINDOWS_UNSUPPORTED = "dg setup does not support Windows yet — Linux and macOS only.\n";
+const WINDOWS_UNSUPPORTED = "dg setup (automatic interception) does not support Windows yet.\n" +
+    "You can still protect installs on Windows: prefix the command with dg,\n" +
+    "for example `dg pip install <pkg>` or `dg npm install <pkg>`.\n";
 function setupHandler(args) {
     const parsed = parseSetupArgs(args);
     if ("error" in parsed) {

package/dist/commands/status.js

@@ -2,7 +2,7 @@ import { authStatus, displayTier } from "../auth/store.js";
 import { loadUserConfig } from "../config/settings.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
-import { doctorReport } from "../setup/plan.js";
+import { currentShellActivation, doctorReport } from "../setup/plan.js";
 import { gitHookStatusState } from "../setup/git-hook.js";
 import { EXIT_USAGE } from "./types.js";
 export const statusCommand = {
@@ -48,7 +48,8 @@ function buildStatusReport() {
     const policy = loadUserConfig().policy;
     return {
         account: auth,
-        protection: { shims: checkPassed("shims"), path: checkPassed("path") },
+        protection: { shims: checkPassed("shims"), path: checkPassed("path"), configured: checkPassed("shell-rc") },
+        reloadHint: currentShellActivation(),
         commitGuard: safeCommitGuard(),
         policy: { mode: policy.mode, trustProjectAllowlists: policy.trustProjectAllowlists }
     };
@@ -83,8 +84,8 @@ function renderStatus(report, theme) {
         : `${theme.paint("warn", "⚠")} not connected — run ${theme.paint("accent", "dg login")}`;
     const bare = report.protection.shims && report.protection.path
         ? `${theme.paint("pass", "✓")} bare npm/pip installs are protected`
-        : report.protection.shims
-            ? `${theme.paint("warn", "⚠")} set up — active in new terminals (or prefix commands with ${theme.paint("accent", "dg")})`
+        : report.protection.shims && report.protection.configured
+            ? `${theme.paint("muted", "○")} configured — run ${theme.paint("accent", report.reloadHint)} to activate this shell ${theme.paint("muted", "(already active in new terminals)")}`
             : `${theme.paint("warn", "⚠")} not set up — run ${theme.paint("accent", "dg setup")}, or prefix commands with ${theme.paint("accent", "dg")}`;
     const lines = [
         "Dependency Guardian status",

package/dist/install-ui/LiveInstall.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, Text } from "ink";
 import InkSpinner from "ink-spinner";
+import { formatResetDate } from "./block-render.js";
 function packageCount(n) {
     return n === 1 ? "1 package" : `${n} packages`;
 }
@@ -10,15 +11,26 @@ function rule() {
 }
 export const LiveInstall = ({ view }) => {
     if (view.phase === "scanning") {
-        return (_jsxs(Box, { paddingX: 1, children: [_jsx(Text, { color: "cyan", children: _jsx(InkSpinner, { type: "dots" }) }), _jsxs(Text, { children: [" ", view.total === 0 ? "DG starting protection…" : `DG verifying ${packageCount(view.total)}…`] }), view.current ? _jsxs(Text, { dimColor: true, children: ["  ", view.current] }) : null] }));
+        return (_jsxs(Box, { paddingX: 1, children: [_jsx(Text, { color: "cyan", children: _jsx(InkSpinner, { type: "dots" }) }), _jsxs(Text, { children: [" ", view.total === 0
+                            ? "DG starting protection…"
+                            : view.resolvedTotal !== undefined
+                                ? `DG verifying ${view.total}/${Math.max(view.total, view.resolvedTotal)}…`
+                                : `DG verifying ${packageCount(view.total)}…`] }), view.current ? _jsxs(Text, { dimColor: true, children: ["  ", view.current] }) : null] }));
     }
     if (view.total === 0 && !view.blocked) {
         return null;
     }
     if (view.blocked) {
         const blocked = view.blocked;
+        if (blocked.cause === "quota-exceeded") {
+            const reset = formatResetDate(blocked.resetsAt);
+            return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Text, { color: "gray", children: rule() }), _jsxs(Text, { color: "yellow", children: ["Quota hit", reset ? ` — resets ${reset}` : ""] }), _jsxs(Text, { dimColor: true, children: ["   ", "Override:  ", blocked.override ?? "--dg-force-install"] })] }));
+        }
         return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Text, { color: "gray", children: rule() }), blocked.kind === "blocked" ? (_jsxs(Text, { color: "red", children: ["\u2718  DG blocked install \u2014 ", blocked.headline] })) : (_jsxs(Text, { color: "yellow", children: ["?  DG could not verify ", blocked.packageName, " \u2014 ", blocked.headline] })), _jsxs(Text, { children: ["   ", blocked.packageName, "   ", blocked.reason] }), blocked.override ? _jsxs(Text, { dimColor: true, children: ["   ", "Override: ", blocked.override] }) : null, blocked.nextStep ? _jsxs(Text, { dimColor: true, children: ["   ", "Next: ", blocked.nextStep] }) : null] }));
     }
     const total = view.verified + view.flagged;
-    return (_jsx(Box, { paddingX: 1, children: view.flagged > 0 ? (_jsxs(Text, { color: "yellow", children: ["\u26A0  DG verified ", packageCount(total), " \u2014 ", view.flagged, " flagged"] })) : (_jsxs(Text, { color: "green", children: ["\u2713  DG verified ", packageCount(total), " \u2014 clean"] })) }));
+    if (view.flagged > 0) {
+        return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ["\u26A0  DG verified ", packageCount(total), " \u2014 ", view.flagged, " flagged"] }), (view.flaggedItems ?? []).map((item, index) => (_jsxs(Text, { dimColor: true, children: ["   ", item.packageName, "   ", item.reason] }, `${item.packageName}-${index}`)))] }));
+    }
+    return (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: "green", children: ["\u2713  DG verified ", packageCount(total), " \u2014 clean"] }) }));
 };

package/dist/install-ui/block-render.js

@@ -44,20 +44,42 @@ export function describeBlockedInstall(decision) {
         packageName: decision.packageName,
         headline: HEADLINES[decision.cause],
         reason: decision.reason,
+        cause: decision.cause,
+        ...(decision.resetsAt ? { resetsAt: decision.resetsAt } : {}),
         ...(nextStep ? { nextStep } : {}),
         ...(verifiedBad ? {} : { override })
     };
 }
+export function describeFlaggedWarn(decision) {
+    if (decision.cause === "quota-exceeded") {
+        return { packageName: decision.packageName, reason: "installed unverified (over quota)" };
+    }
+    if (decision.forceOverride?.allowed) {
+        return { packageName: decision.packageName, reason: "installed despite block (--dg-force-install)" };
+    }
+    return { packageName: decision.packageName, reason: decision.reason };
+}
 export function renderInstallDecision(decision) {
     if (decision.action === "pass") {
         return `✓ DG verified ${decision.packageName} — clean\n`;
     }
     if (decision.action === "warn") {
+        if (decision.cause === "quota-exceeded") {
+            const reset = formatResetDate(decision.resetsAt);
+            return `⚠ Over quota — installed ${decision.packageName} unverified${reset ? ` (resets ${reset})` : ""}\n`;
+        }
         if (decision.forceOverride?.allowed) {
             return `⚠ DG override — installing ${decision.packageName} despite block (--dg-force-install)\n`;
         }
         return `⚠ DG flagged ${decision.packageName} (warn) — ${decision.reason}\n`;
     }
+    if (decision.cause === "quota-exceeded") {
+        const reset = formatResetDate(decision.resetsAt);
+        const override = decision.forceOverride && !decision.forceOverride.allowed
+            ? "Override:  not allowed by your policy"
+            : "Override:  --dg-force-install";
+        return `Quota hit${reset ? ` — resets ${reset}` : ""}\n${override}\n`;
+    }
     const verifiedBad = VERIFIED_BAD.has(decision.cause);
     const headline = HEADLINES[decision.cause];
     const lines = [
@@ -83,3 +105,11 @@ export function renderInstallDecision(decision) {
     }
     return `${lines.join("\n")}\n`;
 }
+export function formatResetDate(iso) {
+    if (!iso)
+        return undefined;
+    const date = new Date(iso);
+    if (Number.isNaN(date.getTime()))
+        return undefined;
+    return `${String(date.getUTCMonth() + 1).padStart(2, "0")}/${String(date.getUTCDate()).padStart(2, "0")}`;
+}

package/dist/launcher/pip-report.js

@@ -0,0 +1,21 @@
+export function parsePipReportInstallCount(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return undefined;
+    const candidates = [trimmed];
+    const brace = trimmed.indexOf("{");
+    if (brace > 0)
+        candidates.push(trimmed.slice(brace));
+    for (const candidate of candidates) {
+        try {
+            const parsed = JSON.parse(candidate);
+            if (Array.isArray(parsed.install)) {
+                return parsed.install.length;
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}

package/dist/launcher/run.js

@@ -4,13 +4,15 @@ import { constants as osConstants } from "node:os";
 import { fileURLToPath } from "node:url";
 import { EXIT_UNAVAILABLE } from "../commands/types.js";
 import { loadUserConfig } from "../config/settings.js";
-import { describeBlockedInstall, renderInstallDecision } from "../install-ui/block-render.js";
+import { describeBlockedInstall, describeFlaggedWarn, renderInstallDecision } from "../install-ui/block-render.js";
 import { enforceProtectedInstall } from "../proxy/enforcement.js";
-import { isCiEnv } from "../presentation/mode.js";
+import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
 import { readProxySessionState } from "../proxy/server.js";
 import { cleanupSessionSync, createSessionSync, resolveDgPaths } from "../state/index.js";
 import { classifyPackageManagerInvocation } from "./classify.js";
 import { buildProxyChildEnv } from "./env.js";
+import { parsePipReportInstallCount } from "./pip-report.js";
 import { createStreamRedactor, redactSecrets } from "./output-redaction.js";
 import { resolveRealBinary } from "./resolve-real-binary.js";
 export const EXIT_INSTALL_BLOCKED = 2;
@@ -122,7 +124,7 @@ async function runWithProductionProxy(plan, args, options) {
             return {
                 exitCode: EXIT_INSTALL_BLOCKED,
                 stdout: streamedOut(child.stdout, options),
-                stderr: `${streamedErr(child.stderr, options)}${cacheOnlyNotice(plan.classification.manager)}`
+                stderr: `${streamedErr(child.stderr, options)}${cacheOnlyNotice(installOutcome(child.stdout).length > 0)}`
             };
         }
         return {
@@ -136,9 +138,11 @@ async function runWithProductionProxy(plan, args, options) {
         stopProxyWorker(proxy);
     }
 }
-export function deriveLiveView(state, phase) {
+export function deriveLiveView(state, phase, resolvedTotal) {
     const verified = state.decisions.filter((decision) => decision.action === "pass").length;
-    const flagged = state.decisions.filter((decision) => decision.action === "warn").length;
+    const warnDecisions = state.decisions.filter((decision) => decision.action === "warn");
+    const flagged = warnDecisions.length;
+    const flaggedItems = warnDecisions.map(describeFlaggedWarn);
     const blocked = state.decisions.find((decision) => decision.action === "block");
     const current = state.inflight[state.inflight.length - 1];
     return {
@@ -146,10 +150,51 @@ export function deriveLiveView(state, phase) {
         total: state.decisions.length + state.inflight.length,
         verified,
         flagged,
+        ...(flaggedItems.length > 0 ? { flaggedItems } : {}),
+        ...(resolvedTotal !== undefined ? { resolvedTotal } : {}),
         ...(current ? { current } : {}),
         ...(blocked ? { blocked: describeBlockedInstall(blocked) } : {})
     };
 }
+function resolvePipInstallTotal(binary, args, env, register) {
+    if (!binary)
+        return Promise.resolve(undefined);
+    return new Promise((resolve) => {
+        let stdout = "";
+        let settled = false;
+        let timer;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            resolve(value);
+        };
+        let child;
+        try {
+            child = spawn(binary, [...args, "--dry-run", "--report", "-", "--quiet"], {
+                env,
+                stdio: ["ignore", "pipe", "ignore"]
+            });
+        }
+        catch {
+            finish(undefined);
+            return;
+        }
+        register(child);
+        timer = setTimeout(() => {
+            try {
+                child.kill();
+            }
+            catch { /* already exited */ }
+            finish(undefined);
+        }, 30_000);
+        child.stdout?.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        child.on("error", () => finish(undefined));
+        child.on("close", (code) => finish(code === 0 ? parsePipReportInstallCount(stdout) : undefined));
+    });
+}
 export async function runWithProductionProxyLive(plan, args, options, onView) {
     if (options.onStdout || options.onStderr) {
         throw new Error("live install mode renders its own UI and owns the terminal; streaming output callbacks are not supported");
@@ -169,8 +214,15 @@ export async function runWithProductionProxyLive(plan, args, options, onView) {
             cacheDir: `${proxy.session.dir}/pm-cache`
         });
         const spawner = options.spawner ?? defaultSpawner;
+        let resolvedTotal;
+        let dryRunChild;
+        if (plan.classification.manager === "pip") {
+            void resolvePipInstallTotal(plan.realBinary.path ?? "", args, childEnv, (child) => { dryRunChild = child; })
+                .then((count) => { resolvedTotal = count; })
+                .catch(() => undefined);
+        }
         const poll = setInterval(() => {
-            onView(deriveLiveView(readProxySessionState(proxy.session), "scanning"));
+            onView(deriveLiveView(readProxySessionState(proxy.session), "scanning", resolvedTotal));
         }, 90);
         let finished;
         try {
@@ -182,9 +234,15 @@ export async function runWithProductionProxyLive(plan, args, options, onView) {
         }
         finally {
             clearInterval(poll);
+            if (dryRunChild) {
+                try {
+                    dryRunChild.kill();
+                }
+                catch { /* already exited */ }
+            }
         }
         const proxyState = readProxySessionState(proxy.session);
-        onView(deriveLiveView(proxyState, "done"));
+        onView(deriveLiveView(proxyState, "done", resolvedTotal));
         if (proxyState.decisions.some((decision) => decision.action === "block")) {
             return { exitCode: EXIT_INSTALL_BLOCKED, stdout: "", stderr: "" };
         }
@@ -196,7 +254,8 @@ export async function runWithProductionProxyLive(plan, args, options, onView) {
                     stderr: `${finished.stderr}\n  ? dg did not check this install — ${plan.classification.manager} exited with an error before any package was fetched.\n`
                 };
             }
-            return { exitCode: EXIT_INSTALL_BLOCKED, stdout: installOutcome(finished.stdout), stderr: cacheOnlyNotice(plan.classification.manager) };
+            const outcome = installOutcome(finished.stdout);
+            return { exitCode: EXIT_INSTALL_BLOCKED, stdout: outcome, stderr: cacheOnlyNotice(outcome.length > 0) };
         }
         return { exitCode: finished.exitCode, stdout: installOutcome(finished.stdout), stderr: "" };
     }
@@ -205,8 +264,10 @@ export async function runWithProductionProxyLive(plan, args, options, onView) {
         stopProxyWorker(proxy);
     }
 }
-function cacheOnlyNotice(manager) {
-    return `  ? dg could not verify this install — no download reached the firewall.\n  ${manager} used a local cache or file, or the packages were already installed, so nothing was fetched to check. The install itself ran; these are not covered by per-command protection. Run 'dg scan' to verify your installed packages.\n`;
+function cacheOnlyNotice(installedFresh) {
+    const theme = createTheme(resolvePresentation().color);
+    const reason = installedFresh ? "used a saved copy" : "already installed";
+    return `\n  ${theme.paint("muted", `– Nothing was downloaded, so nothing to verify (${reason}). Run dg scan to check installed packages.`)}\n`;
 }
 function installOutcome(stdout) {
     const lines = stdout.split("\n").filter((line) => /^Successfully installed /.test(line) ||

package/dist/proxy/enforcement.js

@@ -33,6 +33,9 @@ export function enforceProtectedInstall(request) {
         policyMode: policy.mode,
         reason: proxyVerdict.reason ?? evaluation.reason
     }, proxyVerdict);
+    if (baseDecision.cause === "quota-exceeded" && proxyVerdict.quotaBehavior === "pass") {
+        return { ...baseDecision, action: "warn", reason: "over monthly quota — installed unverified per your dashboard setting" };
+    }
     if (baseDecision.action !== "block") {
         return baseDecision;
     }
@@ -97,6 +100,8 @@ function withOptionalDecisionFields(decision, verdict) {
     return {
         ...decision,
         ...(verdict.dashboardUrl ? { dashboardUrl: verdict.dashboardUrl } : {}),
-        ...(verdict.unauthenticated ? { unauthenticated: true } : {})
+        ...(verdict.unauthenticated ? { unauthenticated: true } : {}),
+        ...(verdict.resetsAt ? { resetsAt: verdict.resetsAt } : {}),
+        ...(verdict.quotaBehavior ? { quotaBehavior: verdict.quotaBehavior } : {})
     };
 }

package/dist/proxy/server.js

@@ -16,6 +16,7 @@ import { authorityFor, connectViaUpstreamProxy, selectUpstreamProxy } from "./up
 import { redactSecrets } from "../launcher/output-redaction.js";
 import { envAuthToken } from "../auth/env-token.js";
 import { identityHeaders } from "../api/analyze.js";
+import { dgVersion } from "../commands/version.js";
 export async function startProductionHttpProxy(options) {
     const ca = createEphemeralCertificateAuthority(options.session.files.ca);
     const state = {
@@ -631,6 +632,7 @@ async function lookupVerdict(options, target, sha256, upstream, identity) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
+                "X-Dg-Version": dgVersion(),
                 ...identityHeaders(options.env)
             },
             body: JSON.stringify({
@@ -650,11 +652,14 @@ async function lookupVerdict(options, target, sha256, upstream, identity) {
             signal: controller.signal
         });
         if (response.status === 402 || response.status === 429) {
+            const body = (await response.json().catch(() => ({})));
             return {
                 verdict: "block",
                 packageName: artifactDisplayName(identity),
                 cause: "quota-exceeded",
-                reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset."
+                reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset.",
+                ...(typeof body.resetsAt === "string" ? { resetsAt: body.resetsAt } : {}),
+                quotaBehavior: body.quotaBehavior === "pass" ? "pass" : "block"
             };
         }
         if (response.status === 401) {
@@ -787,7 +792,7 @@ function scanTarballUploadPolicy(env) {
     };
 }
 function installVerdictTimeoutMs(env) {
-    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 30_000);
+    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 180_000);
 }
 function parsePositiveInteger(value, fallback) {
     if (!value) {

package/dist/scan-ui/LegacyApp.js

@@ -12,6 +12,7 @@ import { SetupBanner } from "./components/SetupBanner.js";
 import { useTerminalSize } from "./hooks/useTerminalSize.js";
 import { scanExitCode } from "./shims.js";
 import { enterTui, leaveTui, showCursor } from "./alt-screen.js";
+import { formatResetDate } from "../install-ui/block-render.js";
 export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialView }) => {
     const { state, scanSelectedProjects, restartSelection } = useScan(config);
     const { exit } = useApp();
@@ -128,8 +129,8 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
             case "selecting":
                 return (_jsx(ProjectSelector, { projects: state.projects, onConfirm: scanSelectedProjects, onCancel: () => { process.exitCode = 0; leaveAltScreen(); exit(); }, userStatus: userStatus }));
             case "scanning":
-                return (_jsx(ProgressBar, { value: state.done, total: state.total, label: state.currentBatch.length > 0
-                        ? state.currentBatch[state.currentBatch.length - 1]
+                return (_jsx(ProgressBar, { value: state.done, total: state.total, label: state.batchCount > 1 && state.batchIndex >= 1
+                        ? `batch ${state.batchIndex}/${state.batchCount}`
                         : undefined }));
             case "results":
                 return (_jsx(InteractiveResultsView, { result: state.result, config: config, durationMs: state.durationMs, onExit: handleResultsExit, onBack: restartSelection ?? undefined, discoveredTotal: state.discoveredTotal, userStatus: userStatus, scanUsage: scanUsage, initialView: initialView }));
@@ -143,7 +144,7 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
                     hasKey = !!getStoredApiKey();
                 }
                 catch { /* ignore — best-effort */ }
-                return (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [hasKey ? (_jsxs(_Fragment, { children: [_jsx(Text, { color: "yellow", bold: true, children: "Your session expired." }), _jsx(Text, { children: " " }), _jsxs(Text, { children: ["Run ", _jsx(Text, { color: "cyan", bold: true, children: "dg logout" }), " then ", _jsx(Text, { color: "cyan", bold: true, children: "dg login" }), " to re-authenticate."] })] })) : state.capReason === "prefix_cap" ? (_jsxs(_Fragment, { children: [_jsx(Text, { color: "yellow", bold: true, children: "Too many anonymous devices from your network this month." }), _jsxs(Text, { children: ["Sign in with ", _jsx(Text, { color: "cyan", bold: true, children: "dg login" }), " to keep scanning."] })] })) : (_jsxs(_Fragment, { children: [_jsxs(Text, { color: "yellow", bold: true, children: ["Free monthly limit reached (", state.scansUsed.toLocaleString(), "/", state.maxScans.toLocaleString(), " packages)."] }), _jsxs(Text, { children: ["Upgrade to Pro with ", _jsx(Text, { color: "cyan", bold: true, children: "dg upgrade" }), " for 250k packages/month."] })] })), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "[q] quit" })] }));
+                return (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [hasKey ? (_jsxs(_Fragment, { children: [_jsx(Text, { color: "yellow", bold: true, children: "Your session expired." }), _jsx(Text, { children: " " }), _jsxs(Text, { children: ["Run ", _jsx(Text, { color: "cyan", bold: true, children: "dg logout" }), " then ", _jsx(Text, { color: "cyan", bold: true, children: "dg login" }), " to re-authenticate."] })] })) : state.capReason === "prefix_cap" ? (_jsxs(_Fragment, { children: [_jsx(Text, { color: "yellow", bold: true, children: "Too many anonymous devices from your network this month." }), _jsxs(Text, { children: ["Sign in with ", _jsx(Text, { color: "cyan", bold: true, children: "dg login" }), " to keep scanning."] })] })) : (_jsxs(_Fragment, { children: [_jsxs(Text, { color: "yellow", bold: true, children: ["Free monthly limit reached (", state.scansUsed.toLocaleString(), "/", state.maxScans.toLocaleString(), " packages)."] }), formatResetDate(state.resetsAt) ? _jsxs(Text, { dimColor: true, children: ["Resets ", formatResetDate(state.resetsAt), "."] }) : null, _jsxs(Text, { children: ["Upgrade to Pro with ", _jsx(Text, { color: "cyan", bold: true, children: "dg upgrade" }), " for 250k packages/month."] })] })), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "[q] quit" })] }));
             }
         }
     })();

package/dist/scan-ui/components/InteractiveResultsView.js

@@ -47,7 +47,7 @@ function isYankedIncomplete(pkg) {
 }
 export function packageBadge(pkg) {
     if (isYankedIncomplete(pkg))
-        return { label: "Removed", color: chalk.yellow };
+        return { label: "Unverified", color: chalk.yellow };
     return actionBadge(pkg.action);
 }
 const EVIDENCE_LIMIT = 2;
@@ -855,6 +855,10 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
             }
             else if (key.return) {
                 setSearchMode(false);
+                if (groups.length === 0) {
+                    setSearchQuery("");
+                    dispatchView({ type: "MOVE", cursor: 0, viewport: 0 });
+                }
             }
             else if (key.backspace || key.delete) {
                 setSearchQuery(prev => prev.slice(0, -1));
@@ -1104,7 +1108,7 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
                                             : chalk.yellow;
                                 const arrow = level === "summary" ? "\u25BE" : "\u25B8"; // ▾ expanded, ▸ collapsed
                                 return (_jsxs(Box, { flexDirection: "column", children: [isCursor ? (_jsxs(Text, { backgroundColor: "#1a1a2e", children: [chalk.cyan("\u258C"), " ", chalk.cyan(arrow), " ", ` `, color(pad(label, 8)), chalk.bold(pad(truncate(names, nameCol - 2), nameCol)), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3)), "  "] })) : (_jsxs(Text, { children: [`  ${chalk.dim(arrow)}  `, color(pad(label, 8)), pad(truncate(names, nameCol - 2), nameCol), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3))] })), level === "summary" && (_jsx(FindingsSummary, { group: group, maxWidth: innerWidth - 8, maxLines: globalIdx === view.expandedIndex ? animVisibleLines : undefined }))] }, group.key));
-                            }), belowCount > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", belowCount, " more below"] }))] })] })), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [discoveredTotal !== undefined && discoveredTotal > total && (_jsxs(Text, { dimColor: true, children: ["Scanned ", total, " of ", discoveredTotal, " packages"] })), _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed with score 0`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] })] }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("\u2588"), "   ", chalk.dim("Esc clear")] })) : (_jsxs(Text, { children: [" ", groups.length > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("\u23CE"), " ", chalk.dim("expand"), "   ", chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("l"), " ", chalk.dim("licenses"), "   ", chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", onBack && _jsxs(_Fragment, { children: [chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   "] }), chalk.bold.cyan("q"), " ", chalk.dim("quit"), "   ", chalk.dim("\u00B7 Ctrl+C or q to exit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] }))] }));
+                            }), belowCount > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", belowCount, " more below"] }))] })] })), searchQuery && groups.length === 0 && (_jsx(Text, { dimColor: true, children: `  No flagged packages match "${searchQuery}"` })), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [discoveredTotal !== undefined && discoveredTotal > total && (_jsxs(Text, { dimColor: true, children: ["Scanned ", total, " of ", discoveredTotal, " packages"] })), _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed with score 0`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] })] }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("\u2588"), "   ", chalk.dim("Esc clear")] })) : (_jsxs(Text, { children: [" ", allGroupCount > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("\u23CE"), " ", chalk.dim("expand"), "   ", chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("l"), " ", chalk.dim("licenses"), "   ", chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", onBack && _jsxs(_Fragment, { children: [chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   "] }), chalk.bold.cyan("q"), " ", chalk.dim("quit"), "   ", chalk.dim("\u00B7 Ctrl+C or q to exit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] }))] }));
 };
 const T = {
     branch: chalk.dim("\u251C\u2500\u2500"),

package/dist/scan-ui/format-helpers.js

@@ -21,9 +21,10 @@ export function truncate(s, max) {
 export function groupPackages(packages, keyBy = "name") {
     const map = new Map();
     for (const pkg of packages) {
+        const action = pkg.action ?? "pass";
         const fingerprint = pkg.findings.length === 0
-            ? `__clean_${pkg.score}`
-            : pkg.findings
+            ? `${action}|${pkg.name}@${pkg.version ?? ""}|score:${pkg.score}`
+            : `${action}|` + pkg.findings
                 .map((f) => `${f.category ?? ""}:${f.severity}`)
                 .sort()
                 .join("|") + `|score:${pkg.score}`;

package/dist/scan-ui/hooks/useScan.js

@@ -9,11 +9,11 @@ function reducer(_state, action) {
         case "DISCOVERY_PROGRESS":
             return { phase: "discovering", path: action.path, found: action.found };
         case "DISCOVERY_COMPLETE":
-            return { phase: "scanning", done: 0, total: action.total, currentBatch: [] };
+            return { phase: "scanning", done: 0, total: action.total, batchIndex: 0, batchCount: 1 };
         case "DISCOVERY_EMPTY":
             return { phase: "empty", message: action.message };
         case "SCAN_PROGRESS":
-            return { phase: "scanning", done: action.done, total: action.total, currentBatch: action.currentBatch };
+            return { phase: "scanning", done: action.done, total: action.total, batchIndex: action.batchIndex, batchCount: action.batchCount };
         case "SCAN_COMPLETE":
             return {
                 phase: "results",
@@ -25,7 +25,13 @@ function reducer(_state, action) {
         case "ERROR":
             return { phase: "error", error: action.error };
         case "FREE_CAP_REACHED":
-            return { phase: "free_cap_reached", scansUsed: action.scansUsed, maxScans: action.maxScans, capReason: action.capReason };
+            return {
+                phase: "free_cap_reached",
+                scansUsed: action.scansUsed,
+                maxScans: action.maxScans,
+                capReason: action.capReason,
+                ...(action.resetsAt ? { resetsAt: action.resetsAt } : {})
+            };
     }
 }
 export function useScan(config) {
@@ -83,8 +89,8 @@ async function scanProjects(projects, dispatch) {
             const base = completed;
             responses.push(await analyzePackages(packages, {
                 ecosystem,
-                onProgress: (done, _ecosystemTotal, currentBatch) => {
-                    dispatch({ type: "SCAN_PROGRESS", done: base + done, total, currentBatch: [...currentBatch] });
+                onProgress: (progress) => {
+                    dispatch({ type: "SCAN_PROGRESS", done: base + progress.done, total, batchIndex: progress.batchIndex, batchCount: progress.batchCount });
                 }
             }));
             completed = base + packages.length;
@@ -104,7 +110,8 @@ async function scanProjects(projects, dispatch) {
                 type: "FREE_CAP_REACHED",
                 scansUsed: body.scansUsed ?? 0,
                 maxScans: body.maxScans ?? 0,
-                capReason: body.reason === "prefix_cap" ? "prefix_cap" : "monthly_limit"
+                capReason: body.reason === "prefix_cap" ? "prefix_cap" : "monthly_limit",
+                ...(typeof body.resetsAt === "string" ? { resetsAt: body.resetsAt } : {})
             });
             return;
         }

package/dist/setup/plan.js

@@ -844,7 +844,7 @@ function pathPrecedenceCheck(env, shimDir, functionsPresent) {
         message: `${shimDir} precedes the real package-manager directories on PATH`
     };
 }
-function currentShellActivation(env) {
+export function currentShellActivation(env = process.env) {
     const shell = resolveShell("auto", env);
     const homeDir = resolveDgPaths(env).homeDir;
     const rcPath = shellRcPath(homeDir, shell);

package/dist/verify/preflight.js

@@ -245,44 +245,73 @@ function parsePackageLock(text) {
         return [malformedLockfileObservation("package-lock.json", new Error("root must be an object"))];
     }
     const observations = [];
-    const packages = isRecord(parsed.packages) ? parsed.packages : {};
-    for (const [path, rawPackage] of Object.entries(packages)) {
-        if (path.length === 0 || !isRecord(rawPackage)) {
-            continue;
-        }
-        const name = typeof rawPackage.name === "string" ? rawPackage.name : packageNameFromNodeModulesPath(path);
-        const version = typeof rawPackage.version === "string" ? rawPackage.version : null;
-        if (!name) {
-            continue;
+    if (isRecord(parsed.packages)) {
+        for (const [path, rawPackage] of Object.entries(parsed.packages)) {
+            if (path.length === 0 || !isRecord(rawPackage) || rawPackage.link === true) {
+                continue;
+            }
+            const declaredName = typeof rawPackage.name === "string" ? rawPackage.name : packageNameFromNodeModulesPath(path);
+            const alias = npmAliasVersion(stringOrNull(rawPackage.version));
+            const name = alias?.name ?? declaredName;
+            const version = alias?.version ?? (typeof rawPackage.version === "string" ? rawPackage.version : null);
+            if (!name) {
+                continue;
+            }
+            observations.push(lockfileObservation({
+                ecosystem: "npm",
+                name,
+                version,
+                requested: path,
+                sourceKind: "lockfile",
+                resolvedUrl: stringOrNull(rawPackage.resolved),
+                integrity: stringOrNull(rawPackage.integrity),
+                license: stringOrNull(rawPackage.license)
+            }));
         }
-        observations.push(lockfileObservation({
-            ecosystem: "npm",
-            name,
-            version,
-            requested: path,
-            sourceKind: "lockfile",
-            resolvedUrl: stringOrNull(rawPackage.resolved),
-            integrity: stringOrNull(rawPackage.integrity),
-            license: stringOrNull(rawPackage.license)
-        }));
+        return observations;
     }
-    const dependencies = isRecord(parsed.dependencies) ? parsed.dependencies : {};
+    if (isRecord(parsed.dependencies)) {
+        walkLegacyDependencies(parsed.dependencies, observations, new Set());
+    }
+    return observations;
+}
+function walkLegacyDependencies(dependencies, observations, seen) {
     for (const [name, rawPackage] of Object.entries(dependencies)) {
-        if (!isRecord(rawPackage) || observations.some((observation) => observation.identity.name === name)) {
+        if (!isRecord(rawPackage) || rawPackage.bundled === true) {
             continue;
         }
-        observations.push(lockfileObservation({
-            ecosystem: "npm",
-            name,
-            version: stringOrNull(rawPackage.version),
-            requested: name,
-            sourceKind: "lockfile",
-            resolvedUrl: stringOrNull(rawPackage.resolved),
-            integrity: stringOrNull(rawPackage.integrity),
-            license: stringOrNull(rawPackage.license)
-        }));
+        const alias = npmAliasVersion(stringOrNull(rawPackage.version));
+        const resolvedName = alias?.name ?? name;
+        const version = alias?.version ?? stringOrNull(rawPackage.version);
+        const key = `${resolvedName}@${version ?? ""}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            observations.push(lockfileObservation({
+                ecosystem: "npm",
+                name: resolvedName,
+                version,
+                requested: name,
+                sourceKind: "lockfile",
+                resolvedUrl: stringOrNull(rawPackage.resolved),
+                integrity: stringOrNull(rawPackage.integrity),
+                license: stringOrNull(rawPackage.license)
+            }));
+        }
+        if (isRecord(rawPackage.dependencies)) {
+            walkLegacyDependencies(rawPackage.dependencies, observations, seen);
+        }
     }
-    return observations;
+}
+function npmAliasVersion(version) {
+    if (!version || !version.startsWith("npm:")) {
+        return null;
+    }
+    const spec = version.slice(4);
+    const at = spec.startsWith("@") ? spec.indexOf("@", 1) : spec.indexOf("@");
+    if (at <= 0) {
+        return { name: spec, version: null };
+    }
+    return { name: spec.slice(0, at), version: spec.slice(at + 1) || null };
 }
 function parseYarnLock(text) {
     const observations = [];
@@ -293,22 +322,23 @@ function parseYarnLock(text) {
         if (!header) {
             continue;
         }
+        if (header.startsWith("#") || header === "__metadata") {
+            continue;
+        }
         const requested = header.split(",")[0]?.trim().replace(/^"|"$/gu, "") ?? header;
         const name = packageNameFromYarnDescriptor(requested);
-        if (!name) {
+        const version = quotedValue(lines, "version");
+        if (!name || !version) {
             continue;
         }
-        const version = quotedValue(lines, "version");
-        const resolvedUrl = quotedValue(lines, "resolved");
-        const integrity = quotedValue(lines, "integrity");
         observations.push(lockfileObservation({
             ecosystem: "npm",
             name,
             version,
             requested,
             sourceKind: "lockfile",
-            resolvedUrl,
-            integrity,
+            resolvedUrl: quotedValue(lines, "resolved"),
+            integrity: quotedValue(lines, "integrity") ?? quotedValue(lines, "checksum"),
             license: null
         }));
     }
@@ -317,23 +347,33 @@ function parseYarnLock(text) {
 function parsePnpmLock(text) {
     const observations = [];
     const lines = text.split(/\r?\n/u);
+    let inPackages = false;
     let current = null;
+    const flush = () => {
+        if (current) {
+            observations.push(lockfileObservation(current));
+            current = null;
+        }
+    };
     for (const line of lines) {
-        const packageMatch = /^\s{2}['"]?(?:\/)?((?:@[^/\s]+\/)?[^@\s:'"]+)@([^:\s'"]+)['"]?:\s*$/u.exec(line);
-        if (packageMatch?.[1] && packageMatch[2]) {
-            if (current) {
-                observations.push(lockfileObservation(current));
-            }
-            current = {
-                ecosystem: "npm",
-                name: packageMatch[1],
-                version: packageMatch[2],
-                requested: `${packageMatch[1]}@${packageMatch[2]}`,
-                sourceKind: "lockfile",
-                resolvedUrl: null,
-                integrity: null,
-                license: null
-            };
+        const sectionMatch = /^([A-Za-z][\w-]*):\s*$/u.exec(line);
+        if (sectionMatch) {
+            flush();
+            // The `snapshots:` section keys the resolved peer graph, e.g.
+            // `eslint-utils@4.9.1(eslint@9.39.4)` — the peer suffix is not a real
+            // registry version, so scanning it yields a false "removed from
+            // registry" verdict. `packages:` is the canonical inventory (carries
+            // integrity); take identity only from there.
+            inPackages = sectionMatch[1] === "packages";
+            continue;
+        }
+        if (!inPackages) {
+            continue;
+        }
+        const keyMatch = /^\s{2}(\S.*?):\s*$/u.exec(line);
+        if (keyMatch?.[1]) {
+            flush();
+            current = parsePnpmPackageKey(keyMatch[1]);
             continue;
         }
         if (!current) {
@@ -354,24 +394,69 @@ function parsePnpmLock(text) {
             };
         }
     }
-    if (current) {
-        observations.push(lockfileObservation(current));
-    }
+    flush();
     return observations;
 }
+function parsePnpmPackageKey(rawKey) {
+    const key = stripQuotes(rawKey.trim());
+    if (/(?:file|link|workspace|git\+|git:|https?):/u.test(key)) {
+        return null;
+    }
+    const hadSlash = key.startsWith("/");
+    const body = hadSlash ? key.slice(1) : key;
+    let name = null;
+    let version = null;
+    if (hadSlash) {
+        // lockfileVersion 5.x keys are /<name>/<version>[_peer]; the version
+        // follows the final slash and the name may itself be scoped (two slashes).
+        const lastSlash = body.lastIndexOf("/");
+        if (lastSlash > 0) {
+            name = body.slice(0, lastSlash);
+            version = stripPnpmPeerSuffix(body.slice(lastSlash + 1));
+        }
+    }
+    else {
+        const atForm = /^((?:@[^/\s]+\/)?[^@\s]+)@(.+)$/u.exec(body);
+        if (atForm?.[1] && atForm[2]) {
+            name = atForm[1];
+            version = stripPnpmPeerSuffix(atForm[2]);
+        }
+    }
+    if (!name || !version) {
+        return null;
+    }
+    return {
+        ecosystem: "npm",
+        name,
+        version,
+        requested: `${name}@${version}`,
+        sourceKind: "lockfile",
+        resolvedUrl: null,
+        integrity: null,
+        license: null
+    };
+}
+function stripPnpmPeerSuffix(version) {
+    const peerStart = version.search(/[(_]/u);
+    return peerStart === -1 ? version : version.slice(0, peerStart);
+}
 function parseRequirements(text) {
-    return text.split(/\r?\n/u)
-        .map((line) => line.trim())
-        .filter((line) => line.length > 0 && !line.startsWith("#"))
-        .map((line) => {
-        if (REMOTE_SPEC_PREFIXES.some((prefix) => line.toLowerCase().startsWith(prefix))) {
-            return packageObservation({
+    const observations = [];
+    for (const logical of joinRequirementContinuations(text.split(/\r?\n/u))) {
+        const line = logical.trim();
+        if (line.length === 0 || line.startsWith("#")) {
+            continue;
+        }
+        const editable = /^(?:-e|--editable)[=\s]+(.+)$/u.exec(line);
+        const target = (editable?.[1] ?? line).trim();
+        if (REMOTE_SPEC_PREFIXES.some((prefix) => target.toLowerCase().startsWith(prefix))) {
+            observations.push(packageObservation({
                 ecosystem: "pypi",
-                name: line,
+                name: target,
                 version: null,
                 requested: line,
                 sourceKind: "lockfile-url-fallback",
-                resolvedUrl: line,
+                resolvedUrl: target,
                 integrity: null,
                 license: null
             }, "block", {
@@ -379,15 +464,20 @@ function parseRequirements(text) {
                 title: "Lockfile URL fallback identity",
                 message: "lockfile entry uses a URL without package identity or hash metadata",
                 location: line
-            });
+            }));
+            continue;
         }
-        const hash = /--hash=([A-Za-z0-9:-]+)/u.exec(line)?.[1] ?? null;
-        const cleanLine = line.replace(/\s+--hash=[^\s]+/gu, "");
-        const match = /^([A-Za-z0-9_.-]+)(?:==([^;\s]+))?/u.exec(cleanLine);
+        if (line.startsWith("-") || /^\.{0,2}\//u.test(target)) {
+            continue;
+        }
+        const hash = /--hash=([A-Za-z0-9:_-]+)/u.exec(line)?.[1] ?? null;
+        const requirement = line.replace(/\s*--hash=[^\s]+/gu, "").trim();
+        const match = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?(?:\s*==\s*([^;\s]+))?/u.exec(requirement);
         if (!match?.[1]) {
-            return blockedUnknownSpec(line);
+            observations.push(blockedUnknownSpec(line));
+            continue;
         }
-        return lockfileObservation({
+        observations.push(lockfileObservation({
             ecosystem: "pypi",
             name: match[1],
             version: match[2] ?? null,
@@ -396,8 +486,25 @@ function parseRequirements(text) {
             resolvedUrl: null,
             integrity: hash,
             license: null
-        });
-    });
+        }));
+    }
+    return observations;
+}
+function joinRequirementContinuations(lines) {
+    const joined = [];
+    let buffer = "";
+    for (const line of lines) {
+        if (line.endsWith("\\")) {
+            buffer += `${line.slice(0, -1)} `;
+            continue;
+        }
+        joined.push(buffer + line);
+        buffer = "";
+    }
+    if (buffer.length > 0) {
+        joined.push(buffer);
+    }
+    return joined;
 }
 function parseCargoLock(text) {
     return lockBlocks(text, "[[package]]").map((block) => {
@@ -426,7 +533,7 @@ function parsePoetryLock(text) {
             requested: `${name}==${version ?? "unknown"}`,
             sourceKind: "lockfile",
             resolvedUrl: null,
-            integrity: null,
+            integrity: /hash\s*=\s*"([^"]+)"/u.exec(block)?.[1] ?? null,
             license: tomlString(block, "license")
         });
     }).filter((observation) => observation.identity.name !== "unknown");
@@ -588,7 +695,8 @@ function isExactVersion(version) {
 }
 function isSupportedIntegrity(value) {
     return /^(?:sha256|sha384|sha512)-[A-Za-z0-9+/=]+$/u.test(value)
-        || /^(?:sha256:)?[a-f0-9]{64}$/iu.test(value);
+        || /^(?:sha256:)?[a-f0-9]{64}$/iu.test(value)
+        || /^[0-9a-f]+\/[0-9a-f]{64,}$/iu.test(value);
 }
 function isUnsafeResolvedUrl(value) {
     const lower = value.toLowerCase();
@@ -657,13 +765,18 @@ function packageNameFromNodeModulesPath(path) {
     return first;
 }
 function packageNameFromYarnDescriptor(descriptor) {
-    const value = descriptor.startsWith("@") ? descriptor.slice(1) : descriptor;
-    const index = value.lastIndexOf("@");
-    const name = descriptor.startsWith("@") ? `@${value.slice(0, index)}` : value.slice(0, index);
-    return name || null;
+    const scoped = descriptor.startsWith("@");
+    const body = scoped ? descriptor.slice(1) : descriptor;
+    const at = body.indexOf("@");
+    const name = at === -1 ? descriptor : scoped ? `@${body.slice(0, at)}` : body.slice(0, at);
+    const spec = at === -1 ? "" : body.slice(at + 1);
+    // npm: alias descriptors (`alias@npm:real-pkg@range`) resolve to the alias
+    // target — that is the registry artifact actually fetched and scanned.
+    const alias = /^npm:((?:@[^/\s]+\/)?[^@\s]+)@/u.exec(spec);
+    return alias?.[1] ?? (name || null);
 }
 function quotedValue(lines, key) {
-    const pattern = new RegExp(`^\\s*${key}\\s+\"?([^\"\\n]+)\"?\\s*$`, "u");
+    const pattern = new RegExp(`^\\s*${key}:?\\s+"?([^"\\n]+?)"?\\s*$`, "u");
     for (const line of lines) {
         const match = pattern.exec(line);
         if (match?.[1]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "Dependency Guardian supply-chain firewall CLI",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
     "typescript": "5.8.3",
     "vitest": "3.1.4"
   },
-  "license": "UNLICENSED",
+  "license": "Apache-2.0",
   "private": false,
   "dependencies": {
     "chalk": "4.1.2",