@westbayberry/dg 2.0.6 → 2.0.8

package/dist/install-ui/prompt.js

@@ -6,16 +6,19 @@ export function defaultPromptIo() {
         isTTY: Boolean(process.stdin.isTTY && process.stderr.isTTY)
     };
 }
-export async function promptYesNo(question, io) {
+export async function promptYesNo(question, io, defaultYes = false) {
     if (!io.isTTY) {
         return false;
     }
     const rl = createInterface({ input: io.input, output: io.output });
     try {
         const answer = await new Promise((resolve) => {
-            rl.question(`${question} [y/N] `, resolve);
+            rl.question(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"} `, resolve);
         });
         const normalized = answer.trim().toLowerCase();
+        if (normalized === "") {
+            return defaultYes;
+        }
         return normalized === "y" || normalized === "yes";
     }
     finally {

package/dist/launcher/install-preflight.js

@@ -0,0 +1,89 @@
+import { spawn } from "node:child_process";
+import { analyzePackages } from "../api/analyze.js";
+import { defaultPromptIo, promptYesNo } from "../install-ui/prompt.js";
+import { parsePipReportInstallSet } from "./pip-report.js";
+const PROCEED = { proceed: true };
+function resolvePipInstallSet(binary, args, env) {
+    if (!binary)
+        return Promise.resolve(undefined);
+    return new Promise((resolve) => {
+        let stdout = "";
+        let settled = false;
+        let timer;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            resolve(value);
+        };
+        let child;
+        try {
+            child = spawn(binary, [...args, "--dry-run", "--report", "-", "--quiet"], {
+                env,
+                stdio: ["ignore", "pipe", "ignore"]
+            });
+        }
+        catch {
+            finish(undefined);
+            return;
+        }
+        timer = setTimeout(() => {
+            try {
+                child.kill();
+            }
+            catch { /* already exited */ }
+            finish(undefined);
+        }, 30_000);
+        child.stdout?.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        child.on("error", () => finish(undefined));
+        child.on("close", (code) => finish(code === 0 ? parsePipReportInstallSet(stdout) : undefined));
+    });
+}
+function findingSummary(pkg) {
+    return pkg.reasons[0] ?? pkg.findings[0]?.title ?? pkg.findings[0]?.id ?? "flagged";
+}
+function renderPreflight(flagged, out) {
+    const blocks = flagged.filter((pkg) => pkg.action === "block").length;
+    const noun = flagged.length === 1 ? "package" : "packages";
+    const tail = blocks > 0 ? ` (${blocks} blocked)` : "";
+    out.write(`\n  DG flagged ${flagged.length} ${noun} before install${tail}:\n`);
+    for (const pkg of flagged) {
+        const tag = pkg.action === "block" ? "block" : "warn";
+        out.write(`    ${pkg.name}@${pkg.version}   ${tag}   ${findingSummary(pkg)}\n`);
+    }
+    out.write("\n");
+}
+export async function runInstallPreflight(manager, binary, childArgs, env) {
+    if (manager !== "pip" || !binary) {
+        return PROCEED;
+    }
+    const set = await resolvePipInstallSet(binary, childArgs, env);
+    if (!set || set.length === 0) {
+        return PROCEED;
+    }
+    let verdicts;
+    try {
+        verdicts = await analyzePackages(set.map((pkg) => ({ name: pkg.name, version: pkg.version })), { ecosystem: "pypi", env });
+    }
+    catch {
+        return PROCEED;
+    }
+    return decideFromVerdicts(verdicts.packages, defaultPromptIo());
+}
+export async function decideFromVerdicts(packages, io) {
+    const flagged = packages.filter((pkg) => pkg.action === "warn" || pkg.action === "block");
+    if (flagged.length === 0 || !io.isTTY) {
+        return PROCEED;
+    }
+    renderPreflight(flagged, io.output);
+    const hasBlock = flagged.some((pkg) => pkg.action === "block");
+    const accepted = hasBlock
+        ? await promptYesNo("  Override and install anyway?", io, false)
+        : await promptYesNo("  Proceed?", io, true);
+    if (!accepted) {
+        return { proceed: false };
+    }
+    return hasBlock ? { proceed: true, forceOverride: { force: true } } : PROCEED;
+}

package/dist/launcher/live-install.js

@@ -1,4 +1,5 @@
-import { createLaunchPlan, runWithProductionProxyLive } from "./run.js";
+import { createLaunchPlan, runWithProductionProxyLive, EXIT_INSTALL_BLOCKED } from "./run.js";
+import { runInstallPreflight } from "./install-preflight.js";
 import { isSupportedPackageManager } from "./classify.js";
 import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
 const FALL_THROUGH = { handled: false };
@@ -16,9 +17,17 @@ export async function maybeRunLiveInstall(args, options = {}) {
     if (plan.classification.kind !== "protected" || !plan.realBinary.path) {
         return FALL_THROUGH;
     }
+    let effectiveOverride = forceOverride;
+    if (!forceOverride) {
+        const preflight = await runInstallPreflight(manager, plan.realBinary.path, childArgs, env);
+        if (!preflight.proceed) {
+            return { handled: true, result: { exitCode: EXIT_INSTALL_BLOCKED, stdout: "", stderr: "  Install cancelled.\n" } };
+        }
+        effectiveOverride = preflight.forceOverride;
+    }
     const runOptions = {
         env,
-        ...(forceOverride ? { forceOverride } : {})
+        ...(effectiveOverride ? { forceOverride: effectiveOverride } : {})
     };
     const { renderLiveInstall } = await import("../install-ui/live-install-app.js");
     try {

package/dist/launcher/pip-report.js

@@ -1,4 +1,4 @@
-export function parsePipReportInstallCount(stdout) {
+function parseInstallArray(stdout) {
     const trimmed = stdout.trim();
     if (!trimmed)
         return undefined;
@@ -10,7 +10,7 @@ export function parsePipReportInstallCount(stdout) {
         try {
             const parsed = JSON.parse(candidate);
             if (Array.isArray(parsed.install)) {
-                return parsed.install.length;
+                return parsed.install;
             }
         }
         catch {
@@ -19,3 +19,19 @@ export function parsePipReportInstallCount(stdout) {
     }
     return undefined;
 }
+export function parsePipReportInstallCount(stdout) {
+    return parseInstallArray(stdout)?.length;
+}
+export function parsePipReportInstallSet(stdout) {
+    const install = parseInstallArray(stdout);
+    if (!install)
+        return undefined;
+    const set = [];
+    for (const entry of install) {
+        const metadata = entry.metadata;
+        if (metadata && typeof metadata.name === "string" && typeof metadata.version === "string") {
+            set.push({ name: metadata.name, version: metadata.version });
+        }
+    }
+    return set;
+}

package/dist/proxy/server.js

@@ -792,7 +792,7 @@ function scanTarballUploadPolicy(env) {
     };
 }
 function installVerdictTimeoutMs(env) {
-    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 180_000);
+    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 240_000);
 }
 function parsePositiveInteger(value, fallback) {
     if (!value) {

package/dist/scan-ui/components/InteractiveResultsView.js

@@ -1088,7 +1088,7 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
             const dpAbove = dpScroll;
             const dpBelow = Math.max(0, detailLines.length - dpScroll - detailContentRows);
             const dpVisible = detailLines.slice(dpScroll, dpScroll + detailContentRows);
-            return (_jsxs(Box, { flexDirection: "column", children: [_jsx(ScoreHeader, { score: result.score, action: result.action, total: total, flagged: flagged.length, clean: clean.length, userStatus: userStatus, scanUsage: scanUsage, usageNearLimit: usageNearLimit }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsxs(Text, { bold: true, children: [groupNames(dpGroup), dpRep.license ? chalk.dim(" \u00B7 ") + (dpRep.license.riskCategory === "permissive" ? chalk.green(dpRep.license.spdx ?? dpRep.license.raw ?? "") : dpRep.license.riskCategory === "no-license" || dpRep.license.riskCategory === "network-copyleft" ? chalk.red(dpRep.license.spdx ?? dpRep.license.raw ?? "No license") : chalk.yellow(dpRep.license.spdx ?? dpRep.license.raw ?? "")) : ""] }), _jsx(Text, { children: dpColor(`score ${dpRep.score}`) })] }), dpAbove > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2191"), " ", dpAbove, " more above"] })), _jsx(Box, { flexDirection: "column", marginLeft: 2, children: dpVisible }), dpBelow > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", dpBelow, " more below"] }))] }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), _jsx(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed with score 0`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] }) }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Text, { children: [" ", chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("scroll"), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   ", chalk.bold.cyan("q"), " ", chalk.dim("quit")] })] }));
+            return (_jsxs(Box, { flexDirection: "column", children: [_jsx(ScoreHeader, { score: result.score, action: result.action, total: total, flagged: flagged.length, clean: clean.length, userStatus: userStatus, scanUsage: scanUsage, usageNearLimit: usageNearLimit }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsxs(Text, { bold: true, children: [groupNames(dpGroup), dpRep.license ? chalk.dim(" \u00B7 ") + (dpRep.license.riskCategory === "permissive" ? chalk.green(dpRep.license.spdx ?? dpRep.license.raw ?? "") : dpRep.license.riskCategory === "no-license" || dpRep.license.riskCategory === "network-copyleft" ? chalk.red(dpRep.license.spdx ?? dpRep.license.raw ?? "No license") : chalk.yellow(dpRep.license.spdx ?? dpRep.license.raw ?? "")) : ""] }), _jsx(Text, { children: dpColor(`score ${dpRep.score}`) })] }), dpAbove > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2191"), " ", dpAbove, " more above"] })), _jsx(Box, { flexDirection: "column", marginLeft: 2, children: dpVisible }), dpBelow > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", dpBelow, " more below"] }))] }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), _jsx(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] }) }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Text, { children: [" ", chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("scroll"), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   ", chalk.bold.cyan("q"), " ", chalk.dim("quit")] })] }));
         }
     }
     // ── List mode ──
@@ -1108,7 +1108,7 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
                                             : chalk.yellow;
                                 const arrow = level === "summary" ? "\u25BE" : "\u25B8"; // ▾ expanded, ▸ collapsed
                                 return (_jsxs(Box, { flexDirection: "column", children: [isCursor ? (_jsxs(Text, { backgroundColor: "#1a1a2e", children: [chalk.cyan("\u258C"), " ", chalk.cyan(arrow), " ", ` `, color(pad(label, 8)), chalk.bold(pad(truncate(names, nameCol - 2), nameCol)), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3)), "  "] })) : (_jsxs(Text, { children: [`  ${chalk.dim(arrow)}  `, color(pad(label, 8)), pad(truncate(names, nameCol - 2), nameCol), lcColor(pad(lcStr, lcCol)), color(scoreStr.padStart(3))] })), level === "summary" && (_jsx(FindingsSummary, { group: group, maxWidth: innerWidth - 8, maxLines: globalIdx === view.expandedIndex ? animVisibleLines : undefined }))] }, group.key));
-                            }), belowCount > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", belowCount, " more below"] }))] })] })), searchQuery && groups.length === 0 && (_jsx(Text, { dimColor: true, children: `  No flagged packages match "${searchQuery}"` })), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [discoveredTotal !== undefined && discoveredTotal > total && (_jsxs(Text, { dimColor: true, children: ["Scanned ", total, " of ", discoveredTotal, " packages"] })), _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed with score 0`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] })] }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("\u2588"), "   ", chalk.dim("Esc clear")] })) : (_jsxs(Text, { children: [" ", allGroupCount > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("\u23CE"), " ", chalk.dim("expand"), "   ", chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("l"), " ", chalk.dim("licenses"), "   ", chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", onBack && _jsxs(_Fragment, { children: [chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   "] }), chalk.bold.cyan("q"), " ", chalk.dim("quit"), "   ", chalk.dim("\u00B7 Ctrl+C or q to exit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] }))] }));
+                            }), belowCount > 0 && (_jsxs(Text, { dimColor: true, children: [chalk.cyan(" \u2193"), " ", belowCount, " more below"] }))] })] })), searchQuery && groups.length === 0 && (_jsx(Text, { dimColor: true, children: `  No flagged packages match "${searchQuery}"` })), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), _jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingRight: 1, width: "100%", children: [discoveredTotal !== undefined && discoveredTotal > total && (_jsxs(Text, { dimColor: true, children: ["Scanned ", total, " of ", discoveredTotal, " packages"] })), _jsxs(Box, { justifyContent: "space-between", children: [clean.length > 0 ? (_jsxs(Text, { children: [chalk.green("\u2713"), " ", chalk.green.bold(String(clean.length)), " ", chalk.dim(`package${clean.length !== 1 ? "s" : ""} passed`), " ", chalk.dim(`\u00b7 ${(durationMs / 1000).toFixed(1)}s`)] })) : (_jsxs(Text, { dimColor: true, children: [(durationMs / 1000).toFixed(1), "s"] })), result.freeScansRemaining !== undefined && (_jsx(Text, { dimColor: true, children: "Free tier \u00B7 dg login for higher scan limits" }))] })] }), _jsx(Text, { dimColor: true, children: chalk.dim("\u2500".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("\u2588"), "   ", chalk.dim("Esc clear")] })) : (_jsxs(Text, { children: [" ", allGroupCount > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("\u2191\u2193"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("\u23CE"), " ", chalk.dim("expand"), "   ", chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("l"), " ", chalk.dim("licenses"), "   ", chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", onBack && _jsxs(_Fragment, { children: [chalk.bold.cyan("Esc"), " ", chalk.dim("back"), "   "] }), chalk.bold.cyan("q"), " ", chalk.dim("quit"), "   ", chalk.dim("\u00B7 Ctrl+C or q to exit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] }))] }));
 };
 const T = {
     branch: chalk.dim("\u251C\u2500\u2500"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "Dependency Guardian supply-chain firewall CLI",
   "type": "module",
   "bin": {