@westbayberry/dg 2.1.0 → 2.3.0

package/dist/project/dgfile.js

@@ -4,12 +4,50 @@ import { userInfo } from "node:os";
 import { join } from "node:path";
 import { gitTrimmed } from "../util/git.js";
 import { writeJsonAtomic } from "../util/json-file.js";
+import { canonicalCooldownName } from "../policy/pypi-name.js";
+import { acquireLockSyncWithRetry, resolveDgPaths } from "../state/index.js";
+import { stampAuthoredEntries } from "./override-trust.js";
+const DG_FILE_LOCK_STALE_MS = 10_000;
+const DG_FILE_LOCK_TIMEOUT_MS = 5_000;
+export function withDgFileLock(root, env, action) {
+    const name = `dgfile-${createHash("sha1").update(root).digest("hex").slice(0, 16)}`;
+    const lock = acquireLockSyncWithRetry(resolveDgPaths(env), name, {
+        staleMs: DG_FILE_LOCK_STALE_MS,
+        timeoutMs: DG_FILE_LOCK_TIMEOUT_MS
+    });
+    try {
+        return action();
+    }
+    finally {
+        lock.release();
+    }
+}
+// Serialized read-modify-write: re-reads dg.json under the lock so a concurrent
+// cooldown/decisions writer can never clobber the other's section.
+export function mutateDgFile(root, env, mutate) {
+    return withDgFileLock(root, env, () => {
+        const file = loadDgFile(root);
+        if (!file.readable) {
+            throw new Error(`refusing to rewrite ${file.path}: ${file.failure ?? "unreadable"}`);
+        }
+        const next = stampAuthoredEntries(mutate(file), file, root, env);
+        saveDgFile(next);
+        return next;
+    });
+}
+function canonicalExemptionName(ecosystem, name) {
+    return canonicalCooldownName(ecosystem, name);
+}
+export class CooldownExemptionCapError extends Error {
+}
 export const DG_FILE_NAME = "dg.json";
 export const DECISION_ENTRY_CAP = 500;
+export const COOLDOWN_EXEMPTION_CAP = 500;
 export const DECISION_REASON_MAX = 500;
-const KNOWN_TOP_LEVEL_KEYS = new Set(["version", "scriptApprovals", "decisions"]);
+const KNOWN_TOP_LEVEL_KEYS = new Set(["version", "scriptApprovals", "decisions", "cooldownExemptions"]);
 const KNOWN_SCRIPT_APPROVAL_KEYS = new Set(["npm", "observed"]);
 const SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "gyp"];
+const UNSAFE_OBJECT_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 export function dgFilePath(root) {
     return join(root, DG_FILE_NAME);
 }
@@ -22,7 +60,7 @@ export function findProjectRoot(cwd, env = process.env) {
     }
 }
 export function emptyDgFile(path) {
-    return { path, exists: false, readable: true, raw: {}, decisions: [], scriptApprovals: emptyScriptApprovals() };
+    return { path, exists: false, readable: true, raw: {}, decisions: [], cooldownExemptions: [], scriptApprovals: emptyScriptApprovals() };
 }
 export function loadDgFile(root) {
     const path = dgFilePath(root);
@@ -61,6 +99,20 @@ export function loadDgFile(root) {
             decisions.push(parsed);
         }
     }
+    const exemptionsRaw = raw.cooldownExemptions;
+    if (exemptionsRaw !== undefined && !Array.isArray(exemptionsRaw)) {
+        return failOpen(path, "cooldownExemptions must be an array");
+    }
+    if (Array.isArray(exemptionsRaw) && exemptionsRaw.length > COOLDOWN_EXEMPTION_CAP) {
+        return failOpen(path, `more than ${COOLDOWN_EXEMPTION_CAP} cooldownExemptions`);
+    }
+    const cooldownExemptions = [];
+    for (const entry of Array.isArray(exemptionsRaw) ? exemptionsRaw : []) {
+        const parsed = parseCooldownExemption(entry);
+        if (parsed) {
+            cooldownExemptions.push(parsed);
+        }
+    }
     const approvals = approvalsRaw ?? {};
     return {
         path,
@@ -68,6 +120,7 @@ export function loadDgFile(root) {
         readable: true,
         raw,
         decisions,
+        cooldownExemptions,
         scriptApprovals: {
             npm: parseEntryMap(approvals.npm, parseApprovalEntry),
             observed: parseEntryMap(approvals.observed, parseObservedEntry),
@@ -92,6 +145,85 @@ export function appendDecisions(file, additions, now = new Date()) {
 export function removeDecisions(file, ids) {
     return { ...file, decisions: file.decisions.filter((entry) => !ids.has(entry.id)) };
 }
+export function appendCooldownExemptions(file, additions, now = new Date()) {
+    const canonicalAll = additions.map((a) => ({ ...a, name: canonicalExemptionName(a.ecosystem, a.name) }));
+    const canonical = [...new Map(canonicalAll.map((a) => [`${a.ecosystem}:${a.name}`, a])).values()];
+    const priorExtra = new Map(file.cooldownExemptions.map((e) => [`${e.ecosystem}:${e.name}`, e.extra]));
+    const keep = file.cooldownExemptions.filter((e) => !canonical.some((a) => a.ecosystem === e.ecosystem && a.name === e.name));
+    const added = canonical.map((a) => {
+        const carried = priorExtra.get(`${a.ecosystem}:${a.name}`);
+        return {
+            ...a,
+            reason: a.reason.slice(0, DECISION_REASON_MAX),
+            acceptedAt: a.acceptedAt ?? now.toISOString(),
+            ...(carried !== undefined ? { extra: carried } : {})
+        };
+    });
+    const next = [...keep, ...added];
+    if (next.length > COOLDOWN_EXEMPTION_CAP) {
+        const live = next.filter((e) => cooldownExemptionActive(e, now));
+        if (live.length > COOLDOWN_EXEMPTION_CAP) {
+            throw new CooldownExemptionCapError(`cooldown exemptions would exceed the ${COOLDOWN_EXEMPTION_CAP} cap; run 'dg cooldown prune' or remove some with 'dg cooldown rm'`);
+        }
+        return { ...file, cooldownExemptions: live };
+    }
+    return { ...file, cooldownExemptions: next };
+}
+export function removeCooldownExemptions(file, predicate) {
+    return { ...file, cooldownExemptions: file.cooldownExemptions.filter((e) => !predicate(e)) };
+}
+// Active when there is no expiry, or the expiry parses to a future instant. A
+// present-but-unparseable expiry fails CLOSED (treated as expired) so a typo'd
+// date can never become a permanent cooldown bypass.
+export function cooldownExemptionActive(e, now = new Date()) {
+    if (!e.expiresAt) {
+        return true;
+    }
+    const expiry = Date.parse(e.expiresAt);
+    return Number.isFinite(expiry) && expiry > now.getTime();
+}
+function serializeCooldownExemption(e) {
+    return {
+        ...e.extra,
+        ecosystem: e.ecosystem,
+        name: e.name,
+        reason: e.reason,
+        acceptedBy: e.acceptedBy,
+        acceptedAt: e.acceptedAt,
+        ...(e.expiresAt ? { expiresAt: e.expiresAt } : {})
+    };
+}
+const EXEMPTION_FIELDS = new Set(["ecosystem", "name", "reason", "acceptedBy", "acceptedAt", "expiresAt"]);
+export function parseCooldownExemption(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const ecosystem = value.ecosystem;
+    if (ecosystem !== "npm" && ecosystem !== "pypi" && ecosystem !== "cargo") {
+        return null;
+    }
+    const rawName = value.name;
+    if (typeof rawName !== "string" || rawName.length === 0 || /[\u0000-\u001f\u007f\s*]/u.test(rawName)) {
+        return null;
+    }
+    const name = canonicalExemptionName(ecosystem, rawName);
+    const extra = {};
+    for (const [key, field] of Object.entries(value)) {
+        if (!EXEMPTION_FIELDS.has(key) && !UNSAFE_OBJECT_KEYS.has(key)) {
+            extra[key] = field;
+        }
+    }
+    const expiresAt = value.expiresAt;
+    return {
+        ecosystem,
+        name,
+        reason: typeof value.reason === "string" ? value.reason.slice(0, DECISION_REASON_MAX) : "",
+        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? value.acceptedBy : "unknown",
+        acceptedAt: typeof value.acceptedAt === "string" ? value.acceptedAt : "",
+        ...(typeof expiresAt === "string" ? { expiresAt } : {}),
+        ...(Object.keys(extra).length > 0 ? { extra } : {})
+    };
+}
 export function saveDgFile(file) {
     if (!file.readable) {
         throw new Error(`refusing to rewrite ${file.path}: ${file.failure ?? "unreadable"}`);
@@ -100,6 +232,9 @@ export function saveDgFile(file) {
     if (file.decisions.length > 0) {
         top.decisions = file.decisions.map(serializeDecisionEntry);
     }
+    if (file.cooldownExemptions.length > 0) {
+        top.cooldownExemptions = file.cooldownExemptions.map(serializeCooldownExemption);
+    }
     const approvals = { ...file.scriptApprovals.unknownKeys };
     if (Object.keys(file.scriptApprovals.npm).length > 0) {
         approvals.npm = sortedRecord(file.scriptApprovals.npm);
@@ -174,7 +309,7 @@ function parseDecisionEntry(value) {
     }
     const extra = {};
     for (const [key, field] of Object.entries(value)) {
-        if (!ENTRY_FIELDS.has(key)) {
+        if (!ENTRY_FIELDS.has(key) && !UNSAFE_OBJECT_KEYS.has(key)) {
             extra[key] = field;
         }
     }
@@ -215,7 +350,9 @@ function parseFindings(value) {
         if (typeof severity !== "number" || !Number.isInteger(severity) || severity < 1 || severity > 5) {
             return null;
         }
-        findings[category] = severity;
+        if (!UNSAFE_OBJECT_KEYS.has(category)) {
+            findings[category] = severity;
+        }
     }
     return findings;
 }
@@ -228,6 +365,9 @@ function parseEntryMap(raw, parseEntry) {
     }
     const entries = {};
     for (const [name, value] of Object.entries(raw)) {
+        if (UNSAFE_OBJECT_KEYS.has(name)) {
+            continue;
+        }
         const parsed = parseEntry(value);
         if (parsed !== null) {
             entries[name] = parsed;
@@ -290,7 +430,7 @@ function sortedRecord(record) {
 function unknownKeysOf(raw, known) {
     const unknown = {};
     for (const [key, value] of Object.entries(raw)) {
-        if (!known.has(key)) {
+        if (!known.has(key) && !UNSAFE_OBJECT_KEYS.has(key)) {
             unknown[key] = value;
         }
     }
@@ -303,5 +443,5 @@ function emptyScriptApprovals() {
     return { npm: {}, observed: {}, unknownKeys: {} };
 }
 function failOpen(path, failure) {
-    return { path, exists: true, readable: false, failure, raw: {}, decisions: [], scriptApprovals: emptyScriptApprovals() };
+    return { path, exists: true, readable: false, failure, raw: {}, decisions: [], cooldownExemptions: [], scriptApprovals: emptyScriptApprovals() };
 }

package/dist/proxy/auth.js

@@ -0,0 +1,42 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export const PROXY_AUTH_TOKEN_FILENAME = "proxy-auth-token";
+export const PROXY_AUTH_USER = "dg";
+export function generateProxyAuthToken() {
+    return randomBytes(32).toString("hex");
+}
+export function proxyAuthTokenPath(sessionDir) {
+    return join(sessionDir, PROXY_AUTH_TOKEN_FILENAME);
+}
+export function writeProxyAuthToken(sessionDir, token) {
+    writeFileSync(proxyAuthTokenPath(sessionDir), `${token}\n`, {
+        encoding: "utf8",
+        mode: 0o600
+    });
+}
+export function readProxyAuthToken(sessionDir) {
+    try {
+        const token = readFileSync(proxyAuthTokenPath(sessionDir), "utf8").trim();
+        return token.length > 0 ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function proxyUrlWithAuth(proxyUrl, token) {
+    const url = new URL(proxyUrl);
+    return `${url.protocol}//${PROXY_AUTH_USER}:${token}@${url.host}`;
+}
+export function proxyAuthorizationValue(token) {
+    return `Basic ${Buffer.from(`${PROXY_AUTH_USER}:${token}`, "utf8").toString("base64")}`;
+}
+export function verifyProxyAuthorization(header, token) {
+    if (typeof header !== "string" || header.length === 0) {
+        return false;
+    }
+    return timingSafeEqual(digest(header), digest(proxyAuthorizationValue(token)));
+}
+function digest(value) {
+    return createHash("sha256").update(value, "utf8").digest();
+}

package/dist/proxy/ca.js

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { generateKeyPairSync, randomBytes } from "node:crypto";
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { isIP } from "node:net";
@@ -17,6 +17,12 @@ export function createEphemeralCertificateAuthority(caPath, options = {}) {
         }
         active = issueAuthority(caPath, lifetimeMs, now(), active.certPem);
         leafs.clear();
+        try {
+            options.onRotate?.(active.certPem);
+        }
+        catch {
+            return;
+        }
     };
     setInterval(rotateIfDue, ROTATION_CHECK_INTERVAL_MS).unref();
     return {
@@ -37,11 +43,24 @@ export function createEphemeralCertificateAuthority(caPath, options = {}) {
         }
     };
 }
-function issueAuthority(caPath, lifetimeMs, nowMs, previousCertPem) {
-    const keys = forge.pki.rsa.generateKeyPair({
-        bits: 2048,
-        workers: -1
+// node:crypto keygen piped into forge via PEM so keygen never falls back to forge's pure-JS path.
+function generateRsaKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+        modulusLength: 2048
     });
+    return {
+        privateKey: forge.pki.privateKeyFromPem(privateKey.export({
+            type: "pkcs8",
+            format: "pem"
+        }).toString()),
+        publicKey: forge.pki.publicKeyFromPem(publicKey.export({
+            type: "spki",
+            format: "pem"
+        }).toString())
+    };
+}
+function issueAuthority(caPath, lifetimeMs, nowMs, previousCertPem) {
+    const keys = generateRsaKeyPair();
     const cert = forge.pki.createCertificate();
     cert.publicKey = keys.publicKey;
     cert.serialNumber = serialNumber();
@@ -65,6 +84,10 @@ function issueAuthority(caPath, lifetimeMs, nowMs, previousCertPem) {
             cRLSign: true,
             critical: true
         },
+        {
+            name: "extKeyUsage",
+            serverAuth: true
+        },
         {
             name: "subjectKeyIdentifier"
         }
@@ -102,10 +125,7 @@ function writeCaBundleAtomic(caPath, bundle) {
     }
 }
 function createLeafCertificate(host, issuer, lifetimeMs, nowMs) {
-    const keys = forge.pki.rsa.generateKeyPair({
-        bits: 2048,
-        workers: -1
-    });
+    const keys = generateRsaKeyPair();
     const cert = forge.pki.createCertificate();
     cert.publicKey = keys.publicKey;
     cert.serialNumber = serialNumber();

package/dist/proxy/cooldown-exemptions-file.js

@@ -0,0 +1,33 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseCooldownExemption } from "../project/dgfile.js";
+export const COOLDOWN_EXEMPTIONS_FILE = "cooldown-exemptions.json";
+export const COOLDOWN_EXEMPTIONS_ENV = "DG_PROXY_COOLDOWN_EXEMPTIONS_FILE";
+export function writeCooldownExemptionsFile(sessionDir, exemptions) {
+    if (exemptions.length === 0) {
+        return {};
+    }
+    try {
+        const path = join(sessionDir, COOLDOWN_EXEMPTIONS_FILE);
+        writeFileSync(path, JSON.stringify(exemptions), { encoding: "utf8", mode: 0o600 });
+        return { [COOLDOWN_EXEMPTIONS_ENV]: path };
+    }
+    catch {
+        return {};
+    }
+}
+export function loadCooldownExemptionsFile(path) {
+    if (!path) {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!Array.isArray(parsed)) {
+            return [];
+        }
+        return parsed.map((entry) => parseCooldownExemption(entry)).filter((entry) => entry !== null);
+    }
+    catch {
+        return [];
+    }
+}

package/dist/proxy/enforcement.js

@@ -1,5 +1,5 @@
 import { recordAuditEvent } from "../audit/events.js";
-import { loadUserConfig } from "../config/settings.js";
+import { DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
 import { applyForceOverride, evaluatePackagePolicy, resolveEffectivePolicy } from "../policy/evaluate.js";
 export function parseForceOverrideRequest(raw) {
     if (!raw) {
@@ -16,8 +16,31 @@ export function parseForceOverrideRequest(raw) {
         return undefined;
     }
 }
+let sideEffectFailureNoticed = false;
+export function noteEnforcementSideEffectFailure(error) {
+    if (sideEffectFailureNoticed) {
+        return;
+    }
+    sideEffectFailureNoticed = true;
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+        process.stderr.write(`dg: local state read/write failed (${message}); the install decision is still enforced.\n`);
+    }
+    catch {
+        return;
+    }
+}
+function loadUserConfigOrDefault(env) {
+    try {
+        return loadUserConfig(env);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+        return DEFAULT_CONFIG;
+    }
+}
 export function enforceProtectedInstall(request) {
-    const userConfig = request.userConfig ?? loadUserConfig(request.env);
+    const userConfig = request.userConfig ?? loadUserConfigOrDefault(request.env);
     const policy = resolveEffectivePolicy({ userConfig });
     const proxyVerdict = request.proxyVerdict ?? failClosedVerdict(request.classification);
     const packageName = proxyVerdict.packageName ?? derivePackageName(request.classification);
@@ -39,13 +62,24 @@ export function enforceProtectedInstall(request) {
     if (baseDecision.action !== "block") {
         return baseDecision;
     }
-    const force = applyForceOverride({
-        packageName,
-        currentAction: "block",
-        force: request.forceOverride?.force ?? false,
-        policy,
-        ...(request.now ? { now: request.now } : {})
-    }, request.env);
+    let force;
+    try {
+        force = applyForceOverride({
+            packageName,
+            currentAction: "block",
+            force: request.forceOverride?.force ?? false,
+            policy,
+            ...(request.now ? { now: request.now } : {})
+        }, request.env);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+        force = {
+            allowed: false,
+            reason: "force override is unavailable because dg local state could not be read or written",
+            auditRecorded: false
+        };
+    }
     if (force.allowed) {
         return {
             ...baseDecision,
@@ -57,13 +91,18 @@ export function enforceProtectedInstall(request) {
             }
         };
     }
-    recordAuditEvent({
-        type: "install.blocked",
-        packageName,
-        reason: baseDecision.reason,
-        policyMode: policy.mode,
-        createdAt: (request.now ?? new Date()).toISOString()
-    }, request.env);
+    try {
+        recordAuditEvent({
+            type: "install.blocked",
+            packageName,
+            reason: baseDecision.reason,
+            policyMode: policy.mode,
+            createdAt: (request.now ?? new Date()).toISOString()
+        }, request.env);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+    }
     if (!request.forceOverride?.force) {
         return baseDecision;
     }

package/dist/proxy/metadata-map.js

@@ -1,13 +1,26 @@
 import { createHash } from "node:crypto";
+import { brotliDecompressSync, gunzipSync, inflateRawSync, inflateSync } from "node:zlib";
+// decodeURIComponent throws on malformed percent-encoding (e.g. a stray % in a
+// registry href); fall back to the raw value so one bad entry cannot throw out of
+// the whole metadata-extraction pass and drop every identity.
+function safeDecodeUriComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
 export function extractRegistryMetadataIdentities(metadataUrl, response) {
+    const decoded = { headers: response.headers, body: decodeContentEncoding(response.headers, response.body) };
     // PyPI Simple index (PEP 503 HTML or PEP 691 JSON) — the pip/uv/pipx flow.
     if (isPypiSimpleIndexUrl(metadataUrl)) {
-        return extractPypiSimpleIdentities(metadataUrl, response);
+        return extractPypiSimpleIdentities(metadataUrl, decoded);
     }
-    if (!looksLikeJson(response.headers["content-type"])) {
+    if (!looksLikeJson(decoded.headers["content-type"])) {
         return [];
     }
-    const parsed = parseJson(response.body);
+    const parsed = parseJson(decoded.body);
     if (!isRecord(parsed)) {
         return [];
     }
@@ -16,6 +29,46 @@ export function extractRegistryMetadataIdentities(metadataUrl, response) {
         ...extractPypiIdentities(metadataUrl, parsed)
     ];
 }
+// A MITM'd registry can return a tiny gzip/brotli body that expands to gigabytes;
+// cap the decoded size so a decompression bomb cannot exhaust proxy memory.
+const MAX_METADATA_DECODED_BYTES = 32 * 1024 * 1024;
+// Content-Encoding lists encodings in the order they were applied; decode in
+// reverse. Any unknown token or decode failure returns the body untouched so
+// the response falls back to artifact handling instead of crashing the proxy.
+function decodeContentEncoding(headers, body) {
+    const raw = headers["content-encoding"];
+    const encodings = (Array.isArray(raw) ? raw.join(",") : String(raw ?? ""))
+        .split(",")
+        .map((token) => token.trim().toLowerCase())
+        .filter((token) => token.length > 0 && token !== "identity");
+    const cap = { maxOutputLength: MAX_METADATA_DECODED_BYTES };
+    let decoded = body;
+    for (const encoding of encodings.reverse()) {
+        try {
+            if (encoding === "gzip" || encoding === "x-gzip") {
+                decoded = gunzipSync(decoded, cap);
+            }
+            else if (encoding === "br") {
+                decoded = brotliDecompressSync(decoded, cap);
+            }
+            else if (encoding === "deflate") {
+                try {
+                    decoded = inflateSync(decoded, cap);
+                }
+                catch {
+                    decoded = inflateRawSync(decoded, cap);
+                }
+            }
+            else {
+                return body;
+            }
+        }
+        catch {
+            return body;
+        }
+    }
+    return decoded;
+}
 // A registry INDEX/metadata request (not an artifact download). These must be
 // passed through untouched — never verified as a package — so e.g. pip's
 // `pypi.org/simple/<pkg>/` index is not mistaken for a package named "simple".
@@ -27,7 +80,8 @@ export function extractRegistryMetadataIdentities(metadataUrl, response) {
 export function isRegistryIndexRequest(url) {
     return (isPypiSimpleIndexUrl(url) ||
         /\/pypi\/[^/]+\/json\/?$/i.test(url.pathname) ||
-        /\.metadata$/i.test(url.pathname) ||
+        // PEP 658 sidecar: only `<wheel|sdist>.metadata`, not any path ending .metadata
+        /\.(whl|tar\.gz|tgz|zip)\.metadata$/i.test(url.pathname) ||
         /^\/-\//.test(url.pathname));
 }
 function isPypiSimpleIndexUrl(url) {
@@ -65,7 +119,7 @@ function extractPypiSimpleIdentities(metadataUrl, response) {
         catch {
             continue;
         }
-        const file = entry.filename ?? decodeURIComponent(absolute.pathname.split("/").filter(Boolean).at(-1) ?? "");
+        const file = entry.filename ?? safeDecodeUriComponent(absolute.pathname.split("/").filter(Boolean).at(-1) ?? "");
         const parsed = parsePypiArtifactFilename(file);
         if (!parsed) {
             continue;
@@ -201,7 +255,7 @@ function extractPypiIdentities(metadataUrl, parsed) {
 function fallbackIdentity(artifactUrl, classification) {
     const ecosystem = ecosystemForManager(classification.manager);
     const parsed = ecosystem === "pypi"
-        ? parsePypiArtifactFilename(decodeURIComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "")) ?? parsePackageVersionFromUrl(artifactUrl)
+        ? parsePypiArtifactFilename(safeDecodeUriComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "")) ?? parsePackageVersionFromUrl(artifactUrl)
         : ecosystem === "cargo"
             ? parseCargoArtifactUrl(artifactUrl) ?? parsePackageVersionFromUrl(artifactUrl)
             : parsePackageVersionFromUrl(artifactUrl);
@@ -223,11 +277,11 @@ function parseCargoArtifactUrl(artifactUrl) {
     const downloadMatch = /^\/(?:api\/v1\/)?crates\/([^/]+)\/([^/]+)\/download\/?$/.exec(artifactUrl.pathname);
     if (downloadMatch && downloadMatch[1] && downloadMatch[2]) {
         return {
-            name: decodeURIComponent(downloadMatch[1]),
-            version: decodeURIComponent(downloadMatch[2])
+            name: safeDecodeUriComponent(downloadMatch[1]),
+            version: safeDecodeUriComponent(downloadMatch[2])
         };
     }
-    const file = decodeURIComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "");
+    const file = safeDecodeUriComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "");
     if (/\.crate$/i.test(file)) {
         const stem = file.slice(0, -".crate".length);
         const match = /^(.+)-(\d[0-9A-Za-z.+-]*)$/.exec(stem);
@@ -238,7 +292,7 @@ function parseCargoArtifactUrl(artifactUrl) {
     return null;
 }
 function parsePackageVersionFromUrl(artifactUrl) {
-    const parts = artifactUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+    const parts = artifactUrl.pathname.split("/").filter(Boolean).map((part) => safeDecodeUriComponent(part));
     const file = parts.at(-1) ?? artifactUrl.hostname;
     const npmPackage = npmPackageFromTarballPath(parts);
     const packageName = npmPackage ?? parts.at(-2) ?? file.replace(/\.(?:tgz|tar\.gz|zip|whl)$/i, "");
@@ -300,14 +354,14 @@ function parseNpmPackageSpec(spec) {
     return { name, version };
 }
 function packageNameFromNpmMetadataPath(metadataUrl) {
-    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => safeDecodeUriComponent(part));
     if (parts[0]?.startsWith("@") && parts[1]) {
         return `${parts[0]}/${parts[1]}`;
     }
     return parts[0] ?? metadataUrl.hostname;
 }
 function packageNameFromPypiMetadataPath(metadataUrl) {
-    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => safeDecodeUriComponent(part));
     const projectIndex = parts.findIndex((part) => part.toLowerCase() === "pypi");
     return parts[projectIndex + 1] ?? parts[0] ?? metadataUrl.hostname;
 }

package/dist/proxy/preverified.js

@@ -0,0 +1,55 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const PREVERIFIED_FILE = "preverified.json";
+export function preverifiedKey(ecosystem, name, version) {
+    const canonicalName = ecosystem === "pypi" ? name.toLowerCase().replace(/[-_.]+/g, "-") : name;
+    return `${ecosystem}:${canonicalName}@${version}`;
+}
+export function writePreverifiedFile(sessionDir, entries) {
+    writeFileSync(join(sessionDir, PREVERIFIED_FILE), `${JSON.stringify(entries)}\n`, {
+        encoding: "utf8",
+        mode: 0o600
+    });
+}
+let loaded = null;
+export function loadPreverifiedMap(sessionDir) {
+    if (loaded?.dir === sessionDir) {
+        return loaded.map;
+    }
+    const path = join(sessionDir, PREVERIFIED_FILE);
+    if (!existsSync(path)) {
+        return new Map();
+    }
+    const map = new Map();
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (Array.isArray(parsed)) {
+            for (const entry of parsed) {
+                if (isPreverifiedEntry(entry)) {
+                    map.set(preverifiedKey(entry.ecosystem, entry.name, entry.version), entry);
+                }
+            }
+        }
+    }
+    catch {
+        return new Map();
+    }
+    loaded = { dir: sessionDir, map };
+    return map;
+}
+export function resetPreverifiedCache() {
+    loaded = null;
+}
+function isPreverifiedEntry(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const entry = value;
+    return ((entry.ecosystem === "npm" || entry.ecosystem === "pypi") &&
+        typeof entry.name === "string" && entry.name.length > 0 &&
+        typeof entry.version === "string" && entry.version.length > 0 &&
+        (entry.action === "pass" || entry.action === "warn") &&
+        (entry.reason === undefined || typeof entry.reason === "string") &&
+        (entry.scannedSha256 === undefined || typeof entry.scannedSha256 === "string") &&
+        typeof entry.cooldownEvaluated === "boolean");
+}