@westbayberry/dg 2.0.7 → 2.0.8

package/dist/install-ui/prompt.js

@@ -6,16 +6,19 @@ export function defaultPromptIo() {
         isTTY: Boolean(process.stdin.isTTY && process.stderr.isTTY)
     };
 }
-export async function promptYesNo(question, io) {
+export async function promptYesNo(question, io, defaultYes = false) {
     if (!io.isTTY) {
         return false;
     }
     const rl = createInterface({ input: io.input, output: io.output });
     try {
         const answer = await new Promise((resolve) => {
-            rl.question(`${question} [y/N] `, resolve);
+            rl.question(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"} `, resolve);
         });
         const normalized = answer.trim().toLowerCase();
+        if (normalized === "") {
+            return defaultYes;
+        }
         return normalized === "y" || normalized === "yes";
     }
     finally {

package/dist/launcher/install-preflight.js

@@ -0,0 +1,89 @@
+import { spawn } from "node:child_process";
+import { analyzePackages } from "../api/analyze.js";
+import { defaultPromptIo, promptYesNo } from "../install-ui/prompt.js";
+import { parsePipReportInstallSet } from "./pip-report.js";
+const PROCEED = { proceed: true };
+function resolvePipInstallSet(binary, args, env) {
+    if (!binary)
+        return Promise.resolve(undefined);
+    return new Promise((resolve) => {
+        let stdout = "";
+        let settled = false;
+        let timer;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            resolve(value);
+        };
+        let child;
+        try {
+            child = spawn(binary, [...args, "--dry-run", "--report", "-", "--quiet"], {
+                env,
+                stdio: ["ignore", "pipe", "ignore"]
+            });
+        }
+        catch {
+            finish(undefined);
+            return;
+        }
+        timer = setTimeout(() => {
+            try {
+                child.kill();
+            }
+            catch { /* already exited */ }
+            finish(undefined);
+        }, 30_000);
+        child.stdout?.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        child.on("error", () => finish(undefined));
+        child.on("close", (code) => finish(code === 0 ? parsePipReportInstallSet(stdout) : undefined));
+    });
+}
+function findingSummary(pkg) {
+    return pkg.reasons[0] ?? pkg.findings[0]?.title ?? pkg.findings[0]?.id ?? "flagged";
+}
+function renderPreflight(flagged, out) {
+    const blocks = flagged.filter((pkg) => pkg.action === "block").length;
+    const noun = flagged.length === 1 ? "package" : "packages";
+    const tail = blocks > 0 ? ` (${blocks} blocked)` : "";
+    out.write(`\n  DG flagged ${flagged.length} ${noun} before install${tail}:\n`);
+    for (const pkg of flagged) {
+        const tag = pkg.action === "block" ? "block" : "warn";
+        out.write(`    ${pkg.name}@${pkg.version}   ${tag}   ${findingSummary(pkg)}\n`);
+    }
+    out.write("\n");
+}
+export async function runInstallPreflight(manager, binary, childArgs, env) {
+    if (manager !== "pip" || !binary) {
+        return PROCEED;
+    }
+    const set = await resolvePipInstallSet(binary, childArgs, env);
+    if (!set || set.length === 0) {
+        return PROCEED;
+    }
+    let verdicts;
+    try {
+        verdicts = await analyzePackages(set.map((pkg) => ({ name: pkg.name, version: pkg.version })), { ecosystem: "pypi", env });
+    }
+    catch {
+        return PROCEED;
+    }
+    return decideFromVerdicts(verdicts.packages, defaultPromptIo());
+}
+export async function decideFromVerdicts(packages, io) {
+    const flagged = packages.filter((pkg) => pkg.action === "warn" || pkg.action === "block");
+    if (flagged.length === 0 || !io.isTTY) {
+        return PROCEED;
+    }
+    renderPreflight(flagged, io.output);
+    const hasBlock = flagged.some((pkg) => pkg.action === "block");
+    const accepted = hasBlock
+        ? await promptYesNo("  Override and install anyway?", io, false)
+        : await promptYesNo("  Proceed?", io, true);
+    if (!accepted) {
+        return { proceed: false };
+    }
+    return hasBlock ? { proceed: true, forceOverride: { force: true } } : PROCEED;
+}

package/dist/launcher/live-install.js

@@ -1,4 +1,5 @@
-import { createLaunchPlan, runWithProductionProxyLive } from "./run.js";
+import { createLaunchPlan, runWithProductionProxyLive, EXIT_INSTALL_BLOCKED } from "./run.js";
+import { runInstallPreflight } from "./install-preflight.js";
 import { isSupportedPackageManager } from "./classify.js";
 import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
 const FALL_THROUGH = { handled: false };
@@ -16,9 +17,17 @@ export async function maybeRunLiveInstall(args, options = {}) {
     if (plan.classification.kind !== "protected" || !plan.realBinary.path) {
         return FALL_THROUGH;
     }
+    let effectiveOverride = forceOverride;
+    if (!forceOverride) {
+        const preflight = await runInstallPreflight(manager, plan.realBinary.path, childArgs, env);
+        if (!preflight.proceed) {
+            return { handled: true, result: { exitCode: EXIT_INSTALL_BLOCKED, stdout: "", stderr: "  Install cancelled.\n" } };
+        }
+        effectiveOverride = preflight.forceOverride;
+    }
     const runOptions = {
         env,
-        ...(forceOverride ? { forceOverride } : {})
+        ...(effectiveOverride ? { forceOverride: effectiveOverride } : {})
     };
     const { renderLiveInstall } = await import("../install-ui/live-install-app.js");
     try {

package/dist/launcher/pip-report.js

@@ -1,4 +1,4 @@
-export function parsePipReportInstallCount(stdout) {
+function parseInstallArray(stdout) {
     const trimmed = stdout.trim();
     if (!trimmed)
         return undefined;
@@ -10,7 +10,7 @@ export function parsePipReportInstallCount(stdout) {
         try {
             const parsed = JSON.parse(candidate);
             if (Array.isArray(parsed.install)) {
-                return parsed.install.length;
+                return parsed.install;
             }
         }
         catch {
@@ -19,3 +19,19 @@ export function parsePipReportInstallCount(stdout) {
     }
     return undefined;
 }
+export function parsePipReportInstallCount(stdout) {
+    return parseInstallArray(stdout)?.length;
+}
+export function parsePipReportInstallSet(stdout) {
+    const install = parseInstallArray(stdout);
+    if (!install)
+        return undefined;
+    const set = [];
+    for (const entry of install) {
+        const metadata = entry.metadata;
+        if (metadata && typeof metadata.name === "string" && typeof metadata.version === "string") {
+            set.push({ name: metadata.name, version: metadata.version });
+        }
+    }
+    return set;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Dependency Guardian supply-chain firewall CLI",
   "type": "module",
   "bin": {