@westbayberry/dg 2.1.0 → 2.3.0

package/dist/launcher/agent-hook-exec.js

@@ -0,0 +1,70 @@
+import { join } from "node:path";
+import { runAgentHookExec } from "./agent-hook-io.js";
+import { getAgent, isAgentId } from "../agents/registry.js";
+import { resolveDgPaths } from "../state/index.js";
+import { writeJsonAtomic } from "../util/json-file.js";
+async function readStdin(stream = process.stdin) {
+    if (stream.isTTY) {
+        return "";
+    }
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function recordFixture(agent, stdin) {
+    const path = join(resolveDgPaths().stateDir, "fixtures", `${agent}-${Date.now()}.json`);
+    writeJsonAtomic(path, { agent, capturedAt: new Date().toISOString(), stdin });
+    return path;
+}
+// Short-circuited before any banner/nudge so stdout carries only the decision
+// JSON the agent parses.
+export async function maybeAgentHookExec(args, opts = {}) {
+    const noop = { exitCode: 0, stdout: "", stderr: "" };
+    if (args[0] !== "hook-exec") {
+        return { handled: false, result: noop };
+    }
+    const agent = args[1];
+    if (!agent || !isAgentId(agent)) {
+        // Unknown agent (e.g. a hook written by a newer dg, run by an older one):
+        // fail closed. We can't emit this agent's allow shape, and a non-zero exit
+        // with no decision blocks across the agents we support, so an out-of-date
+        // dg refuses the install with a clear message rather than waving it through.
+        return {
+            handled: true,
+            result: {
+                exitCode: 2,
+                stdout: "",
+                stderr: `dg hook-exec: unknown agent '${agent ?? ""}' — blocked under the firewall; update dg (npm i -g @westbayberry/dg)\n`
+            }
+        };
+    }
+    let stdin;
+    try {
+        stdin = await readStdin(opts.stdin);
+    }
+    catch {
+        // A stdin stream error must not escape to the fatal handler (exit 70 with
+        // empty stdout reads as allow to every agent). Emit this agent's deny shape.
+        const emitted = getAgent(agent).emitDecision({
+            decision: "deny",
+            reason: "dg hook: could not read the tool payload from stdin; blocked under the firewall",
+        });
+        return {
+            handled: true,
+            result: { exitCode: emitted.exitCode || 2, stdout: emitted.stdout, stderr: "dg hook: stdin read error\n" },
+        };
+    }
+    let fixtureNote = "";
+    if (args[2] === "--record-fixture") {
+        try {
+            fixtureNote = `dg hook-exec: recorded fixture ${recordFixture(agent, stdin)}\n`;
+        }
+        catch {
+            fixtureNote = "dg hook-exec: could not record the fixture\n";
+        }
+    }
+    const result = await runAgentHookExec(agent, stdin);
+    return { handled: true, result: { exitCode: result.exitCode, stdout: result.stdout, stderr: `${fixtureNote}${result.stderr}` } };
+}

package/dist/launcher/agent-hook-io.js

@@ -0,0 +1,39 @@
+import { agentCheckCommand, ESCALATE, formatScreenedNote } from "./agent-check.js";
+import { getAgent } from "../agents/registry.js";
+import { redactSecrets } from "./output-redaction.js";
+export async function runAgentHookExec(agent, stdin, deps = {}) {
+    const integration = getAgent(agent);
+    const parsed = integration.parseInput(stdin);
+    if (!parsed) {
+        // Unreadable payload -> fail closed (deny) so a malformed hook input can
+        // never slip an install through unverified.
+        const verdict = { decision: "deny", reason: `dg hook: could not read the tool command, so the install is blocked. ${ESCALATE}` };
+        const emitted = integration.emitDecision(verdict);
+        return { stdout: emitted.stdout, stderr: "dg hook: malformed hook payload\n", exitCode: emitted.exitCode };
+    }
+    let verdict;
+    try {
+        verdict = await agentCheckCommand({
+            commandLine: parsed.command,
+            ...(parsed.cwd ? { cwd: parsed.cwd } : {}),
+            ...(deps.env ? { env: deps.env } : {}),
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+        });
+    }
+    catch {
+        // Any failure computing the verdict must fail closed: an unhandled throw
+        // would otherwise exit non-zero with no decision, which most agents read
+        // as allow.
+        verdict = { decision: "deny", reason: `dg hook: the firewall check failed, so the install is blocked. ${ESCALATE}` };
+    }
+    const emitted = integration.emitDecision(verdict);
+    const stderr = allowStderr(verdict);
+    return { stdout: emitted.stdout, stderr, exitCode: emitted.exitCode };
+}
+function allowStderr(verdict) {
+    if (verdict.decision !== "allow") {
+        return `  ${redactSecrets(verdict.reason ?? "DG firewall")}\n`;
+    }
+    const note = verdict.screened ? formatScreenedNote(verdict.screened) : "";
+    return note ? `  ${redactSecrets(note)}\n` : "";
+}

package/dist/launcher/cargo-cache.js

@@ -0,0 +1,40 @@
+import { existsSync, lstatSync, mkdirSync, symlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const PRESERVED_ENTRIES = ["config.toml", "config", "credentials.toml", "credentials"];
+export function userCargoHome(env) {
+    const explicit = env.CARGO_HOME?.trim();
+    return explicit ? explicit : join(homedir(), ".cargo");
+}
+// Cargo keeps registry config and auth tokens (config.toml / credentials.toml)
+// inside CARGO_HOME, next to the crate cache. dg redirects CARGO_HOME to an empty
+// per-session dir so cached crates re-fetch through the firewall, which would also
+// hide a private-registry user's config and tokens — so link those back in.
+export function prepareCargoHome(cacheDir, source) {
+    mkdirSync(cacheDir, { recursive: true });
+    const linked = [];
+    for (const name of PRESERVED_ENTRIES) {
+        const target = join(source, name);
+        const link = join(cacheDir, name);
+        if (!existsSync(target) || pathPresent(link)) {
+            continue;
+        }
+        try {
+            symlinkSync(target, link);
+            linked.push(name);
+        }
+        catch {
+            continue;
+        }
+    }
+    return linked;
+}
+function pathPresent(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/launcher/classify.js

@@ -1,21 +1,32 @@
 import { optionalPackageManagerNames, optionalSupportGate } from "../setup/optional-support.js";
 const supportedManagers = ["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pipx", "uv", "uvx", "cargo"];
 const gatedManagers = optionalPackageManagerNames();
-const jsProtected = new Set(["install", "i", "ci", "add", "update", "dedupe", "exec"]);
-const pnpmProtected = new Set(["install", "i", "add", "update", "dlx", "exec"]);
-const yarnProtected = new Set(["add", "install", "upgrade", "dlx"]);
+const jsProtected = new Set(["install", "i", "ci", "add", "update", "dedupe", "exec", "create"]);
+const pnpmProtected = new Set(["install", "i", "add", "update", "dlx", "exec", "create"]);
+const yarnProtected = new Set(["add", "install", "upgrade", "dlx", "create"]);
 const pipProtected = new Set(["install", "download", "wheel"]);
 const pipxProtected = new Set(["install", "upgrade", "inject", "run"]);
 const uvProtected = new Set(["add", "sync"]);
 const cargoProtected = new Set(["add", "install", "fetch", "update", "build", "test", "check", "run"]);
 const passthrough = new Set(["help", "--help", "-h", "version", "--version", "-v", "list", "ls", "show", "freeze"]);
+// pip3, pip3.12, python3, python3.11 are the canonical install commands on
+// macOS/Homebrew and many Linux distros (see BINARY_FALLBACKS in
+// resolve-real-binary.ts). The classifier keys on the base name, so a
+// version-suffixed spelling must normalize back to pip/python or it falls
+// through to a silent allow. `pipx`/`pipenv` are left untouched — only a bare
+// numeric/dotted version suffix is stripped.
+export function normalizeManagerName(name) {
+    const m = /^(pip|python)(\d+(?:\.\d+)*)?$/.exec(name);
+    return m && m[1] ? m[1] : name;
+}
 export function packageManagerNames() {
     return [...supportedManagers, ...gatedManagers];
 }
 export function isSupportedPackageManager(manager) {
     return supportedManagers.includes(manager);
 }
-export function classifyPackageManagerInvocation(manager, args) {
+export function classifyPackageManagerInvocation(rawManager, args) {
+    const manager = normalizeManagerName(rawManager);
     if (!isSupportedPackageManager(manager)) {
         return unsupportedClassification(manager, args);
     }
@@ -29,6 +40,13 @@ export function classifyPackageManagerInvocation(manager, args) {
         return classifyByCommand(manager, args, "pnpm", pnpmProtected, "pnpm install/fetch command", "javascript");
     }
     if (manager === "yarn") {
+        // A bare `yarn` (no sub-command) runs `yarn install`, fetching every lockfile
+        // dependency; classify it protected rather than passthrough. Read-only
+        // version/help invocations stay passthrough.
+        const readOnlyFlag = args.some((a) => a === "--version" || a === "-v" || a === "--help" || a === "-h");
+        if (firstCommand(args) === "" && !readOnlyFlag) {
+            return protectedClassification("yarn", args, "yarn", "bare yarn installs all lockfile dependencies");
+        }
         return classifyByCommand(manager, args, "yarn", yarnProtected, "Yarn classic install/fetch command", "javascript");
     }
     if (manager === "pip") {
@@ -44,7 +62,7 @@ export function classifyPackageManagerInvocation(manager, args) {
 }
 function classifyByCommand(manager, args, realBinaryName, protectedCommands, protectedReason, ecosystem) {
     const action = firstCommand(args);
-    if (protectedCommands.has(action) || containsFetchSpec(args)) {
+    if (protectedCommands.has(action) || containsFetchSpec(args) || initFetchesPackage(action, args, protectedCommands)) {
         return {
             manager,
             ecosystem,
@@ -70,8 +88,13 @@ function classifyUv(args) {
     if (action === "pip" && pipProtected.has(args[1] ?? "")) {
         return protectedClassification("uv", args, "uv", "uv pip install/fetch command");
     }
-    if (action === "tool" && args[1] === "run") {
-        return protectedClassification("uv", args, "uv", "uv tool run fetches package artifacts");
+    if (action === "tool" && ["run", "install", "upgrade"].includes(args[1] ?? "")) {
+        return protectedClassification("uv", args, "uv", "uv tool run/install/upgrade fetches package artifacts");
+    }
+    if (action === "run" && uvRunFetchesPackage(args)) {
+        // `uv run --with <pkg> …` fetches <pkg> from PyPI and runs it: a real
+        // fetch-and-execute path that the bare `run` verb otherwise waves through.
+        return protectedClassification("uv", args, "uv", "uv run --with fetches and runs a package");
     }
     if (uvProtected.has(action) || containsFetchSpec(args)) {
         return protectedClassification("uv", args, "uv", "uv install/fetch command");
@@ -111,6 +134,20 @@ function unsupportedClassification(manager, args) {
 function firstCommand(args) {
     return args.find((arg) => !arg.startsWith("-")) ?? "";
 }
+// `npm/pnpm/yarn init <initializer>` aliases to fetching and running
+// create-<initializer>, the same as the `create` form; bare `init` / `init -y`
+// is a local scaffold with no fetch. Gated to the JS managers (their protected
+// set carries "create"); cargo/pip `init` are local-only.
+function initFetchesPackage(action, args, protectedCommands) {
+    if (action !== "init" || !protectedCommands.has("create")) {
+        return false;
+    }
+    const commandIndex = args.findIndex((arg) => !arg.startsWith("-"));
+    return args.slice(commandIndex + 1).some((arg) => arg !== "--" && !arg.startsWith("-"));
+}
+export function uvRunFetchesPackage(args) {
+    return args.some((a) => a === "--with" || a === "--with-editable" || a === "--with-requirements" || a.startsWith("--with="));
+}
 function containsFetchSpec(args) {
     return args.some((arg) => /^https?:\/\//.test(arg) || /^git\+https?:\/\//.test(arg) || /\.t(ar\.)?gz(?:$|[#?])/.test(arg));
 }

package/dist/launcher/env.js

@@ -1,53 +1,132 @@
+import { dirname } from "node:path";
+import { proxyUrlWithAuth, readProxyAuthToken } from "../proxy/auth.js";
+// The client read timeout must exceed the proxy's per-artifact verdict ceiling
+// (DG_INSTALL_VERDICT_TIMEOUT_MS, default 240s) plus download headroom, so the
+// package manager never gives up on a legitimately-slow verify. Overridable for
+// constrained environments via DG_CLIENT_READ_TIMEOUT_S.
+function clientReadTimeoutSeconds(env) {
+    const override = Number(env.DG_CLIENT_READ_TIMEOUT_S);
+    if (Number.isFinite(override) && override > 0) {
+        return Math.ceil(override);
+    }
+    const verdictMs = Number(env.DG_INSTALL_VERDICT_TIMEOUT_MS);
+    const verdictSeconds = Number.isFinite(verdictMs) && verdictMs > 0 ? verdictMs / 1000 : 240;
+    return Math.ceil(verdictSeconds + 60);
+}
+// The wrapped package manager and every lifecycle/postinstall script it runs are
+// untrusted. The dg account credential must never reach them; only the trusted
+// proxy worker (which makes the authenticated API calls) keeps it. Applied on
+// EVERY spawn path, not just the proxy one.
+export function scrubChildSecrets(env) {
+    delete env.DG_API_KEY;
+    delete env.DG_API_TOKEN;
+    return env;
+}
+// The union of proxy-routing vars for an AGENT environment. Unlike a single
+// wrapped install, an agent runs arbitrary package managers, so every manager's
+// proxy + CA var is set at once (npm/node, pip, uv, cargo), plus DG_PROXY_ACTIVE
+// so the install-hook pre-screen defers statically-undecidable commands to the
+// proxy. Every value is a literal (the proxy URL, the CA path) — no shell
+// expansion — so it is safe to drop into an agent's settings `env` block.
+export function buildAgentRoutingEnv(proxyUrl, caPath) {
+    const authToken = readProxyAuthToken(dirname(caPath));
+    const url = authToken ? proxyUrlWithAuth(proxyUrl, authToken) : proxyUrl;
+    const noProxy = "127.0.0.1,localhost";
+    return {
+        DG_PROXY_ACTIVE: "1",
+        NO_PROXY: noProxy,
+        no_proxy: noProxy,
+        HTTP_PROXY: url,
+        HTTPS_PROXY: url,
+        http_proxy: url,
+        https_proxy: url,
+        ALL_PROXY: url,
+        npm_config_proxy: url,
+        npm_config_https_proxy: url,
+        NODE_EXTRA_CA_CERTS: caPath,
+        REQUESTS_CA_BUNDLE: caPath,
+        PIP_CERT: caPath,
+        SSL_CERT_FILE: caPath,
+        CARGO_HTTP_CAINFO: caPath,
+    };
+}
 export function buildProxyChildEnv(options) {
-    const env = {
+    const authToken = readProxyAuthToken(dirname(options.caBundlePath));
+    const proxyUrl = authToken ? proxyUrlWithAuth(options.proxyUrl, authToken) : options.proxyUrl;
+    const env = scrubChildSecrets({
         ...options.baseEnv,
         DG_PROXY_ACTIVE: "1"
-    };
-    const noProxy = mergeNoProxy(options.baseEnv.NO_PROXY ?? options.baseEnv.no_proxy, options.noProxyHosts ?? ["127.0.0.1", "localhost"]);
+    });
+    // dg fully controls NO_PROXY (loopback only). An inherited NO_PROXY that names
+    // the registry (or a `*`/`.org` glob) would route the manager straight past the
+    // firewall, so the inherited value is dropped, not merged.
+    const noProxy = (options.noProxyHosts ?? ["127.0.0.1", "localhost"]).join(",");
+    env.NO_PROXY = noProxy;
+    env.no_proxy = noProxy;
+    const readTimeoutSeconds = clientReadTimeoutSeconds(options.baseEnv);
     if (["npm", "npx", "pnpm", "pnpx", "yarn"].includes(options.manager)) {
-        env.HTTP_PROXY = options.proxyUrl;
-        env.HTTPS_PROXY = options.proxyUrl;
-        env.npm_config_proxy = options.proxyUrl;
-        env.npm_config_https_proxy = options.proxyUrl;
-        env.NO_PROXY = noProxy;
+        env.HTTP_PROXY = proxyUrl;
+        env.HTTPS_PROXY = proxyUrl;
+        env.npm_config_proxy = proxyUrl;
+        env.npm_config_https_proxy = proxyUrl;
         env.NODE_EXTRA_CA_CERTS = options.caBundlePath;
+        // The proxy withholds every artifact byte until its verdict resolves, so the
+        // package manager sees no response data until then. Its own network read
+        // timeout must outlast the proxy's worst-case verdict wait or it aborts a
+        // legitimate install mid-verify (pip's 15s default is what made large cold
+        // installs fail). Set it explicitly so a user-lowered global config can't
+        // undercut the proxy.
+        env.npm_config_fetch_timeout = String(readTimeoutSeconds * 1000);
+        if (options.manager === "yarn") {
+            env.YARN_NETWORK_TIMEOUT = String(readTimeoutSeconds * 1000);
+        }
+        if (options.manager === "yarn") {
+            // Yarn Berry (2+) ignores HTTP(S)_PROXY/npm_config_*; without its own
+            // proxy + CA config it fetches straight from the registry, bypassing the
+            // firewall. Classic Yarn ignores these YARN_ vars, so set them for both.
+            env.YARN_HTTP_PROXY = proxyUrl;
+            env.YARN_HTTPS_PROXY = proxyUrl;
+            env.YARN_HTTPS_CA_FILE_PATH = options.caBundlePath;
+        }
         if (options.cacheDir) {
             env.npm_config_cache = options.cacheDir;
             if (options.manager === "yarn") {
+                // Both: YARN_CACHE_FOLDER is Berry's per-project cache, but Berry 2+
+                // defaults to a shared global cache (~/.yarn/berry) that a warm install
+                // serves from without ever fetching, so redirect that too.
                 env.YARN_CACHE_FOLDER = options.cacheDir;
+                env.YARN_GLOBAL_FOLDER = options.cacheDir;
             }
         }
         return env;
     }
     if (options.manager === "pip" || options.manager === "pipx") {
-        env.http_proxy = options.proxyUrl;
-        env.https_proxy = options.proxyUrl;
-        env.no_proxy = noProxy;
+        env.http_proxy = proxyUrl;
+        env.https_proxy = proxyUrl;
         env.REQUESTS_CA_BUNDLE = options.caBundlePath;
         env.PIP_CERT = options.caBundlePath;
         env.PIP_NO_CACHE_DIR = "1";
+        env.PIP_DEFAULT_TIMEOUT = String(readTimeoutSeconds);
         return env;
     }
     if (options.manager === "uv" || options.manager === "uvx") {
-        env.HTTP_PROXY = options.proxyUrl;
-        env.HTTPS_PROXY = options.proxyUrl;
-        env.ALL_PROXY = options.proxyUrl;
-        env.NO_PROXY = noProxy;
+        env.HTTP_PROXY = proxyUrl;
+        env.HTTPS_PROXY = proxyUrl;
+        env.ALL_PROXY = proxyUrl;
         env.SSL_CERT_FILE = options.caBundlePath;
         env.UV_NO_CACHE = "1";
+        env.UV_HTTP_TIMEOUT = String(readTimeoutSeconds);
         return env;
     }
-    env.HTTPS_PROXY = options.proxyUrl;
-    env.https_proxy = options.proxyUrl;
-    env.http_proxy = options.proxyUrl;
-    env.NO_PROXY = noProxy;
+    env.HTTPS_PROXY = proxyUrl;
+    env.https_proxy = proxyUrl;
+    env.http_proxy = proxyUrl;
     env.CARGO_HTTP_CAINFO = options.caBundlePath;
-    return env;
-}
-function mergeNoProxy(existing, required) {
-    const values = new Set((existing ?? "").split(",").map((part) => part.trim()).filter(Boolean));
-    for (const host of required) {
-        values.add(host);
+    env.CARGO_HTTP_TIMEOUT = String(readTimeoutSeconds);
+    if (options.cacheDir) {
+        // cargo serves a cached crate from ~/.cargo with zero network, skipping the
+        // firewall; pointing CARGO_HOME at the throwaway dir forces a re-fetch.
+        env.CARGO_HOME = options.cacheDir;
     }
-    return [...values].join(",");
+    return env;
 }

package/dist/launcher/install-preflight.js

@@ -1,29 +1,35 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 import { analyzePackages } from "../api/analyze.js";
-import { loadUserConfig } from "../config/settings.js";
+import { DEFAULT_CONFIG, loadUserConfig, trustsProjectOverrides } from "../config/settings.js";
+import { honoredOverrides } from "../project/override-trust.js";
 import { matchDecision, packageKey } from "../decisions/apply.js";
 import { offerRememberOnIo } from "../decisions/remember-prompt.js";
 import { provenanceDowngradeLine } from "../presentation/provenance.js";
 import { defaultPromptIo } from "../install-ui/prompt.js";
-import { cooldownRequestParam, formatCooldownDuration, formatPackageAge, isCooldownExempt } from "../policy/cooldown.js";
+import { cooldownRequestParam, formatCooldownDuration, formatPackageAge, isCooldownExempt, isCooldownExemptByDgFile } from "../policy/cooldown.js";
 import { findProjectRoot, loadDgFile, resolveAcceptedBy, warnUnreadableDgFile } from "../project/dgfile.js";
 import { parsePipReportInstallCount, parsePipReportInstallSet } from "./pip-report.js";
-export function resolvePreflightCooldown(env) {
+import { resolveSpawnInvocation } from "./spawn-invocation.js";
+export function resolvePreflightCooldown(env, ecosystem) {
+    // A corrupt user config must not silently disable the cooldown gate; fall back
+    // to defaults so any env-configured cooldown is still applied.
+    let config;
     try {
-        const config = loadUserConfig(env);
-        const param = cooldownRequestParam(config, env, "pypi", "");
-        return param ? { param, exempt: config.cooldown.exempt } : undefined;
+        config = loadUserConfig(env);
     }
     catch {
-        return undefined;
+        config = DEFAULT_CONFIG;
     }
+    const param = cooldownRequestParam(config, env, ecosystem, "");
+    return param ? { param, exempt: config.cooldown.exempt, ecosystem } : undefined;
 }
-function isQuarantined(pkg, context) {
+function isQuarantined(pkg, context, dgExemptions = []) {
     if (!context || !pkg.cooldown) {
         return false;
     }
-    if (isCooldownExempt(pkg.name, context.exempt, "pypi")) {
+    if (isCooldownExempt(pkg.name, context.exempt, context.ecosystem)
+        || isCooldownExemptByDgFile(pkg.name, context.ecosystem, dgExemptions)) {
         return false;
     }
     return pkg.cooldown.status === "quarantine"
@@ -39,7 +45,12 @@ export function resolvePreflightDecisions(ecosystem, cwd, env = process.env) {
     if (!file.readable) {
         return null;
     }
-    return { root, file, ecosystem, env };
+    const honored = honoredOverrides(file, root, env, trustsProjectOverrides(env));
+    if (honored.droppedExemptions > 0 || honored.droppedDecisions > 0) {
+        process.stderr.write(`dg: ignoring ${honored.droppedExemptions} cooldown exemption(s) and ${honored.droppedDecisions} decision(s) in ${file.path} not authored on this machine — re-add with 'dg cooldown add' / 'dg decisions', or 'dg config set policy.trustProjectAllowlists true' to trust this repo\n`);
+    }
+    const gatedFile = { ...file, cooldownExemptions: honored.exemptions, decisions: honored.decisions };
+    return { root, file: gatedFile, ecosystem, env };
 }
 const PROCEED = { proceed: true };
 const UNRESOLVED = { set: undefined, count: undefined };
@@ -70,6 +81,15 @@ export function cachedPipResolution(binary, args) {
 function pipResolutionKey(binary, args) {
     return JSON.stringify([binary, ...args]);
 }
+// pip's dry-run resolve downloads sdists/wheels it cannot get PEP 658
+// metadata for, so big dependency trees legitimately take minutes on a cold
+// pip cache. A short timeout here silently skips the preflight (and with it
+// the batched analyze + preverified handoff), pushing every package onto the
+// slow per-artifact verdict path.
+function pipResolveTimeoutMs(env) {
+    const raw = Number(env.DG_PIP_RESOLVE_TIMEOUT_MS);
+    return Number.isFinite(raw) && raw > 0 ? raw : 120_000;
+}
 function resolvePipInstallSet(binary, args, env) {
     if (!binary)
         return Promise.resolve(UNRESOLVED);
@@ -87,9 +107,11 @@ function resolvePipInstallSet(binary, args, env) {
         };
         let child;
         try {
-            child = spawn(binary, [...args, "--dry-run", "--report", "-", "--quiet"], {
+            const invocation = resolveSpawnInvocation(binary, [...args, "--dry-run", "--report", "-", "--quiet"]);
+            child = spawn(invocation.command, [...invocation.args], {
                 env,
-                stdio: ["ignore", "pipe", "ignore"]
+                stdio: ["ignore", "pipe", "ignore"],
+                windowsVerbatimArguments: invocation.windowsVerbatimArguments
             });
         }
         catch {
@@ -102,7 +124,7 @@ function resolvePipInstallSet(binary, args, env) {
             }
             catch { /* already exited */ }
             finish(UNRESOLVED);
-        }, 30_000);
+        }, pipResolveTimeoutMs(env));
         child.stdout?.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
         child.on("error", () => finish(UNRESOLVED));
         child.on("close", (code) => finish(code === 0
@@ -154,7 +176,7 @@ export function renderProvenanceDowngrades(packages, out) {
         out.write(`  ⚠ ${pkg.name}@${pkg.version}: ${line} (display only, verdict unchanged)\n`);
     }
 }
-export async function runInstallPreflight(manager, binary, childArgs, env, cwd = process.cwd()) {
+export async function runInstallPreflight(manager, binary, childArgs, env, cwd = process.cwd(), beforeInteraction) {
     if (manager !== "pip" || !binary) {
         return PROCEED;
     }
@@ -165,18 +187,42 @@ export async function runInstallPreflight(manager, binary, childArgs, env, cwd =
         pipResolutions.set(key, resolution);
     }
     const set = resolution.set;
-    if (!set || set.length === 0) {
+    if (!set) {
+        process.stderr.write("  dg: could not resolve the install set ahead of time — verifying during install instead\n");
+        return PROCEED;
+    }
+    if (set.length === 0) {
         return PROCEED;
     }
-    const cooldownContext = resolvePreflightCooldown(env);
+    const cooldownContext = resolvePreflightCooldown(env, "pypi");
     let verdicts;
     try {
         verdicts = await analyzePackages(set.map((pkg) => ({ name: pkg.name, version: pkg.version })), { ecosystem: "pypi", env, ...(cooldownContext ? { cooldown: cooldownContext.param } : {}) });
     }
     catch {
+        process.stderr.write("  dg: pre-install check unavailable — verifying during install instead\n");
         return PROCEED;
     }
-    return decideFromVerdicts(verdicts.packages, defaultPromptIo(), cooldownContext, resolvePreflightDecisions("pypi", cwd, env));
+    beforeInteraction?.();
+    const decision = await decideFromVerdicts(verdicts.packages, defaultPromptIo(), cooldownContext, resolvePreflightDecisions("pypi", cwd, env));
+    if (!decision.proceed || decision.forceOverride) {
+        return decision;
+    }
+    const preverified = preverifiedEntries(verdicts.packages, cooldownContext !== undefined);
+    return preverified.length > 0 ? { ...decision, preverified } : decision;
+}
+export function preverifiedEntries(packages, cooldownRequested) {
+    return packages
+        .filter((pkg) => pkg.action === "pass" || pkg.action === "warn")
+        .map((pkg) => ({
+        ecosystem: "pypi",
+        name: pkg.name,
+        version: pkg.version,
+        action: pkg.action,
+        ...(pkg.reasons[0] ? { reason: pkg.reasons[0] } : {}),
+        ...(typeof pkg.artifactSha256 === "string" && pkg.artifactSha256.length > 0 ? { scannedSha256: pkg.artifactSha256 } : {}),
+        cooldownEvaluated: cooldownRequested && pkg.cooldown !== undefined
+    }));
 }
 export async function decideFromVerdicts(packages, io, cooldownContext, decisions = null) {
     if (io.isTTY) {
@@ -185,7 +231,7 @@ export async function decideFromVerdicts(packages, io, cooldownContext, decision
     const covered = [];
     const entries = packages
         .map((pkg) => {
-        const viaCooldown = isQuarantined(pkg, cooldownContext) && pkg.action !== "block";
+        const viaCooldown = isQuarantined(pkg, cooldownContext, decisions?.file.cooldownExemptions ?? []) && pkg.action !== "block";
         const action = viaCooldown ? "block" : pkg.action ?? "pass";
         return { pkg, action, viaCooldown };
     })

package/dist/launcher/live-install.js

@@ -1,15 +1,17 @@
-import { createLaunchPlan, runWithProductionProxyLive, EXIT_INSTALL_BLOCKED } from "./run.js";
+import { createLaunchPlan, prepareProxyWorker, runWithProductionProxyLive, EXIT_INSTALL_BLOCKED } from "./run.js";
 import { runInstallPreflight } from "./install-preflight.js";
-import { isSupportedPackageManager } from "./classify.js";
+import { isSupportedPackageManager, normalizeManagerName } from "./classify.js";
 import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
+import { startPrepSpinner } from "../install-ui/prep-spinner.js";
 const FALL_THROUGH = { handled: false };
 export async function maybeRunLiveInstall(args, options = {}) {
     const env = options.env ?? process.env;
     if (!process.stdout.isTTY || isCiEnv(env) || resolvePresentation().mode !== "rich") {
         return FALL_THROUGH;
     }
-    const [manager, ...rest] = args;
-    if (!manager || !isSupportedPackageManager(manager)) {
+    const [rawManager, ...rest] = args;
+    const manager = normalizeManagerName(rawManager ?? "");
+    if (!rawManager || !isSupportedPackageManager(manager)) {
         return FALL_THROUGH;
     }
     const { childArgs, forceOverride } = stripControlArgs(rest);
@@ -17,24 +19,43 @@ export async function maybeRunLiveInstall(args, options = {}) {
     if (plan.classification.kind !== "protected" || !plan.realBinary.path) {
         return FALL_THROUGH;
     }
+    const appLoading = import("../install-ui/live-install-app.js");
+    appLoading.catch(() => undefined);
+    let prepared = forceOverride ? undefined : prepareProxyWorker(plan.classification, env);
     let effectiveOverride = forceOverride;
+    let preverified;
     if (!forceOverride) {
-        const preflight = await runInstallPreflight(manager, plan.realBinary.path, childArgs, env);
+        const spinner = startPrepSpinner("DG preparing…");
+        let preflight;
+        try {
+            preflight = await runInstallPreflight(manager, plan.realBinary.path, childArgs, env, process.cwd(), spinner.stop);
+        }
+        finally {
+            spinner.stop();
+        }
         if (!preflight.proceed) {
+            prepared?.discard();
             return { handled: true, result: { exitCode: EXIT_INSTALL_BLOCKED, stdout: "", stderr: "  Install cancelled.\n" } };
         }
         effectiveOverride = preflight.forceOverride;
+        preverified = preflight.preverified;
+        if (effectiveOverride) {
+            prepared?.discard();
+            prepared = undefined;
+        }
     }
     const runOptions = {
         env,
-        ...(effectiveOverride ? { forceOverride: effectiveOverride } : {})
+        ...(effectiveOverride ? { forceOverride: effectiveOverride } : {}),
+        ...(preverified && preverified.length > 0 && !effectiveOverride ? { preverified } : {})
     };
-    const { renderLiveInstall } = await import("../install-ui/live-install-app.js");
     try {
-        const result = await renderLiveInstall((onView) => runWithProductionProxyLive(plan, childArgs, runOptions, onView));
+        const { renderLiveInstall } = await appLoading;
+        const result = await renderLiveInstall((onView) => runWithProductionProxyLive(plan, childArgs, runOptions, onView, prepared));
         return { handled: true, result };
     }
     catch (error) {
+        prepared?.discard();
         return {
             handled: true,
             result: {