@westbayberry/dg 2.1.0 → 2.3.0

package/dist/proxy/server.js

@@ -1,26 +1,34 @@
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
-import { BufferBudgetError, collectBounded } from "./buffer-budget.js";
+import { BufferBudgetError, collectBounded, maxArtifactBytes } from "./buffer-budget.js";
 import { readFileSync } from "node:fs";
-import { createServer, request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
+import { Agent as HttpAgent, createServer, request as httpRequest } from "node:http";
+import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { connect } from "node:net";
-import { createSecureContext, createServer as createTlsServer, connect as tlsConnect } from "node:tls";
+import { lookup as dnsLookup } from "node:dns";
+import { createSecureContext, createServer as createTlsServer, connect as tlsConnect, rootCertificates } from "node:tls";
 import { createEphemeralCertificateAuthority } from "./ca.js";
 import { shouldMitmHost } from "./classify-host.js";
-import { enforceProtectedInstall } from "./enforcement.js";
-import { cooldownRequestParam } from "../policy/cooldown.js";
+import { generateProxyAuthToken, proxyAuthorizationValue, verifyProxyAuthorization, writeProxyAuthToken } from "./auth.js";
+import { enforceProtectedInstall, noteEnforcementSideEffectFailure } from "./enforcement.js";
+import { cooldownRequestParam, isCooldownExemptByDgFile } from "../policy/cooldown.js";
 import { loadUserConfig } from "../config/settings.js";
 import { artifactDisplayName, artifactUrlHash, extractRegistryMetadataIdentities, isRegistryIndexRequest, resolveArtifactIdentity } from "./metadata-map.js";
+import { loadPreverifiedMap, preverifiedKey } from "./preverified.js";
 import { authorityFor, connectViaUpstreamProxy, selectUpstreamProxy } from "./upstream-proxy.js";
 import { redactSecrets } from "../launcher/output-redaction.js";
+import { sanitize } from "../security/sanitize.js";
 import { envAuthToken } from "../auth/env-token.js";
 import { identityHeaders } from "../api/analyze.js";
 import { dgVersion } from "../commands/version.js";
+import { recordHeldPackage } from "../state/index.js";
 export async function startProductionHttpProxy(options) {
-    const ca = createEphemeralCertificateAuthority(options.session.files.ca);
+    const onCaRotate = options.onCaRotate;
+    const ca = createEphemeralCertificateAuthority(options.session.files.ca, onCaRotate ? { onRotate: (caCertPem) => safeCaRotateCallback(onCaRotate, caCertPem) } : {});
+    const authToken = generateProxyAuthToken();
+    writeProxyAuthToken(options.session.dir, authToken);
     const state = {
         ready: false,
         port: 0,
@@ -32,6 +40,10 @@ export async function startProductionHttpProxy(options) {
     };
     const activeSockets = new Set();
     const server = createServer((request, response) => {
+        if (!verifyProxyAuthorization(headerValue(request.headers["proxy-authorization"]), authToken)) {
+            sendProxyAuthRequired(response);
+            return;
+        }
         handleProxyRequest(request, response, options, state).catch((error) => {
             const decision = recordDecision(options, state, {
                 verdict: "block",
@@ -45,6 +57,10 @@ export async function startProductionHttpProxy(options) {
     server.on("connection", (socket) => trackSocket(activeSockets, socket));
     server.on("connect", (request, socket, head) => {
         const clientSocket = socket;
+        if (!verifyProxyAuthorization(headerValue(request.headers["proxy-authorization"]), authToken)) {
+            clientSocket.end("HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm=\"dg\"\r\nConnection: close\r\n\r\n");
+            return;
+        }
         handleConnectRequest(request, clientSocket, head, options, state, ca, activeSockets).catch((error) => {
             const decision = recordDecision(options, state, {
                 verdict: "block",
@@ -65,9 +81,27 @@ export async function startProductionHttpProxy(options) {
     writeProxyState(options.session, state);
     return {
         port: address.port,
+        proxyAuthorization: proxyAuthorizationValue(authToken),
         close: () => closeServer(server, activeSockets)
     };
 }
+function safeCaRotateCallback(onCaRotate, caCertPem) {
+    try {
+        onCaRotate(caCertPem);
+    }
+    catch (error) {
+        noteEnforcementSideEffectFailure(error);
+    }
+}
+function sendProxyAuthRequired(response) {
+    const body = "Dependency Guardian proxy requires the per-session credential issued to the wrapped package manager.\n";
+    response.writeHead(407, {
+        "Proxy-Authenticate": "Basic realm=\"dg\"",
+        "Content-Type": "text/plain; charset=utf-8",
+        "Content-Length": Buffer.byteLength(body)
+    });
+    response.end(body);
+}
 export function readProxySessionState(session) {
     try {
         const parsed = JSON.parse(readFileSync(session.files.proxy, "utf8"));
@@ -136,7 +170,27 @@ async function handleConnectRequest(request, clientSocket, head, options, state,
         clientSocket.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
         return;
     }
+    if (isLinkLocalHost(target)) {
+        recordDecision(options, state, {
+            verdict: "block",
+            packageName: target.hostname,
+            cause: "policy",
+            reason: `refusing CONNECT to link-local/metadata address ${target.hostname}`
+        });
+        clientSocket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+        return;
+    }
     if (!shouldMitmHost(target.hostname, options.env)) {
+        if (strictEgressEnabled(options.env)) {
+            recordDecision(options, state, {
+                verdict: "block",
+                packageName: target.hostname,
+                cause: "policy",
+                reason: `strict egress: refusing to tunnel to un-screened host ${target.hostname} (add it to DG_PROXY_MITM_HOSTS to screen it, or disable policy.strictEgress)`
+            });
+            clientSocket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+            return;
+        }
         state.events = [...state.events, `tunnel:${redactSecrets(authorityFor(target))}`];
         writeProxyState(options.session, state);
         await blindTunnel(clientSocket, head, target, options, activeSockets);
@@ -147,22 +201,337 @@ async function handleConnectRequest(request, clientSocket, head, options, state,
     await mitmTunnel(clientSocket, head, target, options, state, ca, activeSockets);
 }
 const REDIRECT_LIMIT = 5;
+// Streaming tail-hold: an OPT-IN fast path for artifacts so large their raw
+// download alone would outlast the client read timeout. It streams bytes while
+// hashing and withholds only the final TAIL bytes until the verdict arrives —
+// so on a block the client receives most of the (unverified) artifact and is
+// relied on to reject the truncated body via its own size/integrity checks.
+// That is a weaker guarantee than the default buffered path, which delivers
+// ZERO bytes until a pass verdict. It is therefore DISABLED by default; the
+// preferred fix for a slow verify is a generous client read timeout (set in
+// buildProxyChildEnv), which keeps the strong buffered guarantee. Enable only
+// for genuinely huge artifacts via DG_STREAM_THRESHOLD_BYTES=<bytes>.
+const STREAM_TAIL_BYTES = 64 * 1024;
+const STREAMING_DISABLED = Number.POSITIVE_INFINITY;
+// A package install fetches dozens-to-hundreds of artifacts from the same few
+// registry hosts. Without connection reuse each is a fresh TCP+TLS handshake
+// (~100-250ms to registry.npmjs.org); keep-alive agents pool sockets per host
+// so an N-tarball install pays one handshake, not N. Reuse is keyed by the full
+// connection option-set (host, port, TLS params), so this never crosses hosts
+// or mixes TLS trust. Purely transport-level — no effect on what gets verified.
+const upstreamHttpAgent = new HttpAgent({ keepAlive: true, maxSockets: 64, scheduling: "fifo" });
+const upstreamHttpsAgent = new HttpsAgent({ keepAlive: true, maxSockets: 64, scheduling: "fifo" });
+// Opt-in (policy.strictEgress, default off): a CONNECT to a host dg doesn't MITM
+// is blind-tunnelled, so its artifacts arrive unscanned. Managed/CI environments
+// can fail those closed instead. A corrupt config reads as off so a broken config
+// never blocks installs that the default would have allowed.
+function strictEgressEnabled(env) {
+    try {
+        return loadUserConfig(env).policy.strictEgress;
+    }
+    catch {
+        return false;
+    }
+}
+function streamThresholdBytes(env) {
+    const raw = env.DG_STREAM_THRESHOLD_BYTES;
+    if (raw === undefined || raw === "") {
+        return STREAMING_DISABLED;
+    }
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : STREAMING_DISABLED;
+}
+function canStreamTarget(target, options) {
+    if (selectUpstreamProxy(target, options.env)) {
+        return false;
+    }
+    if (isRegistryIndexRequest(target)) {
+        return false;
+    }
+    return !hostMatchesList(target.hostname, options.env.DG_PRIVATE_REGISTRY_HOSTS ?? "");
+}
+function shouldStreamArtifactResponse(live, env) {
+    if (live.statusCode < 200 || live.statusCode >= 300 || live.statusCode === 206) {
+        return false;
+    }
+    const contentType = headerValue(live.headers["content-type"]) ?? "";
+    if (/\bjson\b/i.test(contentType)) {
+        return false;
+    }
+    const contentLength = Number(headerValue(live.headers["content-length"]) ?? "");
+    return Number.isFinite(contentLength) && contentLength > streamThresholdBytes(env);
+}
+async function fetchUpstreamHeadersFollowingRedirects(request, target, env) {
+    let current = target;
+    let live = await fetchUpstreamHeaders(request, current, env);
+    for (let hop = 0; isRedirectStatus(live.statusCode); hop += 1) {
+        live.stream.resume();
+        if (hop >= REDIRECT_LIMIT) {
+            throw new Error(`registry redirect chain exceeded ${REDIRECT_LIMIT} hops for ${current.host}`);
+        }
+        const location = headerValue(live.headers.location);
+        if (!location) {
+            throw new Error(`registry returned a ${live.statusCode} redirect with no Location header for ${current.host}`);
+        }
+        const next = new URL(location, current);
+        if (next.protocol !== "http:" && next.protocol !== "https:") {
+            throw new Error(`registry redirected to unsupported protocol ${next.protocol}`);
+        }
+        if (isPrivateNetworkHost(next) && !isPrivateNetworkHost(target)) {
+            throw new Error(`registry redirected a public artifact request into a private address (${next.hostname})`);
+        }
+        live = await fetchUpstreamHeaders(syntheticGetRequest(redirectHopHeaders(request, current, next)), next, env);
+        current = next;
+    }
+    return live;
+}
+function fetchUpstreamHeaders(request, target, env) {
+    return new Promise((resolve, reject) => {
+        const isHttps = target.protocol === "https:";
+        const requester = isHttps ? httpsRequest : httpRequest;
+        let liveStream = null;
+        const upstream = requester({
+            hostname: upstreamHostname(target, env),
+            port: target.port ? Number(target.port) : isHttps ? 443 : 80,
+            path: `${target.pathname}${target.search}`,
+            method: request.method,
+            agent: isHttps ? upstreamHttpsAgent : upstreamHttpAgent,
+            headers: isHttps ? upstreamRequestHeaders(request, target) : stripProxyHopHeaders(request.headers),
+            ...(isHttps ? upstreamTlsOptions(env) : {})
+        }, (upstreamResponse) => {
+            liveStream = upstreamResponse;
+            resolve({
+                statusCode: upstreamResponse.statusCode ?? 502,
+                headers: responseHeaders(upstreamResponse),
+                stream: upstreamResponse
+            });
+        });
+        applyUpstreamTimeBudget(upstream, target, env, (error) => {
+            liveStream?.destroy(error);
+            reject(error);
+        });
+        upstream.on("error", reject);
+        request.on("data", (chunk) => upstream.write(chunk));
+        request.on("end", () => upstream.end());
+        request.on("error", reject);
+        request.once("close", () => {
+            if (!request.complete) {
+                upstream.destroy();
+            }
+        });
+    });
+}
+async function streamArtifactWithTailHold(response, target, options, state, live) {
+    const identityResolution = resolveArtifactIdentity(target, state.identities, options.classification);
+    if (identityResolution.kind === "ambiguous") {
+        live.stream.destroy();
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: identityResolution.packageName,
+            cause: "policy",
+            reason: identityResolution.reason
+        });
+        sendBlocked(response, decision);
+        return;
+    }
+    const identity = identityResolution.identity;
+    const inflightName = artifactDisplayName(identity);
+    state.inflight = [...state.inflight, inflightName];
+    writeProxyState(options.session, state);
+    const limit = maxArtifactBytes(options.env);
+    const hash = createHash("sha256");
+    const tail = [];
+    let tailSize = 0;
+    let total = 0;
+    response.writeHead(live.statusCode, live.headers);
+    response.once("close", () => {
+        if (!response.writableEnded) {
+            live.stream.destroy();
+        }
+    });
+    const finishInflight = () => {
+        state.inflight = removeFirst(state.inflight, inflightName);
+    };
+    try {
+        await new Promise((resolve, reject) => {
+            live.stream.on("data", (chunk) => {
+                total += chunk.length;
+                if (total > limit) {
+                    reject(new BufferBudgetError(`artifact exceeded the ${limit}-byte streaming budget for ${target.host}`));
+                    return;
+                }
+                hash.update(chunk);
+                tail.push(chunk);
+                tailSize += chunk.length;
+                while (tail.length > 1 && tailSize - (tail[0]?.length ?? 0) >= STREAM_TAIL_BYTES) {
+                    const released = tail.shift();
+                    if (released) {
+                        tailSize -= released.length;
+                        response.write(released);
+                    }
+                }
+            });
+            live.stream.once("end", () => resolve());
+            live.stream.once("error", reject);
+        });
+    }
+    catch (error) {
+        finishInflight();
+        live.stream.destroy();
+        recordDecision(options, state, {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: error instanceof BufferBudgetError ? "proxy-setup-failure" : "registry-timeout",
+            reason: error instanceof Error ? error.message : "registry stream failed"
+        });
+        response.destroy();
+        return;
+    }
+    const sha256 = hash.digest("hex");
+    state.hashes = [...state.hashes, {
+            url: redactSecrets(target.toString()),
+            sha256,
+            identity
+        }];
+    writeProxyState(options.session, state);
+    const verdict = await lookupVerdict(options, target, sha256, { statusCode: live.statusCode, headers: live.headers }, identity).catch((error) => ({
+        verdict: "block",
+        packageName: artifactDisplayName(identity),
+        cause: "api-timeout",
+        reason: error instanceof Error ? error.message : "Dependency Guardian API verdict lookup failed"
+    }));
+    finishInflight();
+    const decision = recordDecision(options, state, verdict);
+    if (decision.action === "block") {
+        response.destroy();
+        return;
+    }
+    for (const chunk of tail) {
+        response.write(chunk);
+    }
+    response.end();
+}
 function isRedirectStatus(statusCode) {
     return [301, 302, 303, 307, 308].includes(statusCode);
 }
-function isPrivateNetworkHost(url) {
-    const host = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
-    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "::" || host === "::1") {
+// Node's WHATWG URL parser canonicalizes an IPv4-mapped IPv6 literal to the hex
+// hextet form ([::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]), so a guard that
+// only string-matches the dotted-decimal form silently lets the cloud-metadata
+// IP through as "public". Recover the embedded IPv4 (both forms) before
+// classifying so the IPv4 ranges below cover the mapped address too.
+function hextetsToIpv4(hi, lo) {
+    const h = parseInt(hi, 16);
+    const l = parseInt(lo, 16);
+    return `${(h >> 8) & 0xff}.${h & 0xff}.${(l >> 8) & 0xff}.${l & 0xff}`;
+}
+// Recover an IPv4 address embedded in an IPv6 literal so the IPv4 ranges below
+// also cover it. Covers IPv4-mapped (::ffff:), IPv4-compatible (::), 6to4
+// (2002::/16), and NAT64 (64:ff9b::/96) — each a way to smuggle 169.254.169.254
+// past a guard that only string-matches the dotted-decimal form.
+function recoverIpv4MappedHost(host) {
+    const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (mappedDotted?.[1])
+        return mappedDotted[1];
+    const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (mappedHex?.[1] && mappedHex[2])
+        return hextetsToIpv4(mappedHex[1], mappedHex[2]);
+    const compatDotted = /^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (compatDotted?.[1])
+        return compatDotted[1];
+    const compatHex = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (compatHex?.[1] && compatHex[2])
+        return hextetsToIpv4(compatHex[1], compatHex[2]);
+    const sixToFour = /^2002:([0-9a-f]{1,4}):([0-9a-f]{1,4}):/i.exec(host);
+    if (sixToFour?.[1] && sixToFour[2])
+        return hextetsToIpv4(sixToFour[1], sixToFour[2]);
+    const nat64Dotted = /^64:ff9b::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (nat64Dotted?.[1])
+        return nat64Dotted[1];
+    const nat64Hex = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (nat64Hex?.[1] && nat64Hex[2])
+        return hextetsToIpv4(nat64Hex[1], nat64Hex[2]);
+    return host;
+}
+// Block a RESOLVED address (the actual connect target), so a public hostname
+// whose A/AAAA record points at an internal/metadata IP — DNS-rebinding SSRF —
+// is refused at connect time, not just literal-IP targets.
+export function isBlockedResolvedIp(ip) {
+    const host = recoverIpv4MappedHost(ip.toLowerCase().replace(/^\[/, "").replace(/\]$/, ""));
+    if (host === "0.0.0.0" || host === "::" || host === "::1") {
         return true;
     }
-    if (/^(127|10|0)\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host) || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host)) {
+    if (isPrivateIpv4(host)) {
         return true;
     }
-    if (/^::ffff:(127|10|0)\./.test(host) || /^::ffff:192\.168\./.test(host) || /^::ffff:169\.254\./.test(host) || /^::ffff:172\.(1[6-9]|2[0-9]|3[01])\./.test(host)) {
+    return /^(fe80|f[cd][0-9a-f]{2}):/.test(host);
+}
+function guardedLookup(hostname, options, callback) {
+    const opts = typeof options === "object" && options !== null ? options : {};
+    dnsLookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, "", 0);
+            return;
+        }
+        const list = addresses;
+        const blocked = list.find((entry) => isBlockedResolvedIp(entry.address));
+        if (blocked) {
+            callback(new Error(`refusing to connect to ${hostname}: resolves to blocked address ${blocked.address}`), "", 0);
+            return;
+        }
+        if (opts.all === true) {
+            callback(null, list);
+            return;
+        }
+        const first = list[0];
+        if (!first) {
+            callback(new Error(`no address found for ${hostname}`), "", 0);
+            return;
+        }
+        callback(null, first.address, first.family);
+    });
+}
+// The resolved-IP guard exists for DNS rebinding — a PUBLIC hostname whose A/AAAA
+// record points at an internal IP. It must not fire for: an explicitly-configured
+// private registry (DG_PRIVATE_REGISTRY_HOSTS) whose name legitimately resolves to
+// a private IP; a test host-map target; or a target that is ALREADY a private/
+// loopback literal (the user/test pointed there directly — not rebinding, and the
+// link-local/metadata literal is still blocked at the artifact path).
+function lookupForTarget(target, env) {
+    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    if (hostMatchesList(target.hostname, env.DG_PRIVATE_REGISTRY_HOSTS ?? "")) {
+        return undefined;
+    }
+    if (testUpstreamHostMap(env).has(host)) {
+        return undefined;
+    }
+    if (isPrivateNetworkHost(target)) {
+        return undefined;
+    }
+    return guardedLookup;
+}
+function isPrivateIpv4(host) {
+    return (/^(127|10|0)\./.test(host) ||
+        /^192\.168\./.test(host) ||
+        /^169\.254\./.test(host) ||
+        /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host) ||
+        /^100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\./.test(host));
+}
+export function isPrivateNetworkHost(url) {
+    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    const host = recoverIpv4MappedHost(raw);
+    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
+    }
+    if (isPrivateIpv4(host)) {
         return true;
     }
     return /^(fe80|f[cd][0-9a-f]{2}):/.test(host);
 }
+export function isLinkLocalHost(url) {
+    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    const host = recoverIpv4MappedHost(raw);
+    return /^169\.254\./.test(host) || /^fe80:/.test(host);
+}
 function syntheticGetRequest(headers) {
     const request = new EventEmitter();
     request.method = "GET";
@@ -204,12 +573,40 @@ async function fetchUpstreamFollowingRedirects(request, target, env) {
 }
 const ARTIFACT_CONDITIONAL_HEADERS = ["range", "if-range", "if-none-match", "if-modified-since"];
 async function handleArtifactRequest(request, response, target, options, state) {
+    if (isLinkLocalHost(target)) {
+        const decision = recordDecision(options, state, {
+            verdict: "block",
+            packageName: packageNameFromUrl(target),
+            cause: "policy",
+            reason: `refusing to fetch from link-local/metadata address ${target.hostname}`
+        });
+        sendBlocked(response, decision);
+        return;
+    }
     if (!isRegistryIndexRequest(target)) {
         for (const header of ARTIFACT_CONDITIONAL_HEADERS) {
             delete request.headers[header];
         }
     }
-    const upstream = await fetchUpstreamFollowingRedirects(request, target, options.env).catch((error) => {
+    let upstream;
+    try {
+        if (canStreamTarget(target, options)) {
+            const live = await fetchUpstreamHeadersFollowingRedirects(request, target, options.env);
+            if (shouldStreamArtifactResponse(live, options.env)) {
+                await streamArtifactWithTailHold(response, target, options, state, live);
+                return;
+            }
+            upstream = {
+                statusCode: live.statusCode,
+                headers: live.headers,
+                body: await collectBounded(live.stream, { label: target.toString() })
+            };
+        }
+        else {
+            upstream = await fetchUpstreamFollowingRedirects(request, target, options.env);
+        }
+    }
+    catch (error) {
         const message = error instanceof Error ? error.message : "registry request failed";
         const decision = recordDecision(options, state, {
             verdict: "block",
@@ -218,8 +615,8 @@ async function handleArtifactRequest(request, response, target, options, state)
             reason: message
         });
         sendBlocked(response, decision);
-        return null;
-    });
+        return;
+    }
     if (!upstream) {
         return;
     }
@@ -289,7 +686,7 @@ async function handleArtifactRequest(request, response, target, options, state)
         reason: error instanceof Error ? error.message : "Dependency Guardian API verdict lookup failed"
     }));
     state.inflight = removeFirst(state.inflight, inflightName);
-    const decision = recordDecision(options, state, verdict);
+    const decision = recordDecision(options, state, verdict, identity.identity);
     if (decision.action === "block") {
         sendBlocked(response, decision);
         return;
@@ -301,7 +698,7 @@ async function blindTunnel(clientSocket, head, target, options, activeSockets) {
     const upstreamProxy = selectUpstreamProxy(target, options.env);
     const upstreamSocket = upstreamProxy
         ? await connectViaUpstreamProxy(target, upstreamProxy)
-        : await connectDirect(target);
+        : await connectDirect(target, options.env);
     trackSocket(activeSockets, upstreamSocket);
     clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     if (head.length > 0) {
@@ -376,9 +773,9 @@ function parseConnectTarget(authority) {
         return null;
     }
 }
-function connectDirect(target) {
+function connectDirect(target, env = process.env) {
     return new Promise((resolve, reject) => {
-        const socket = connect(Number(target.port || "443"), upstreamHostname(target));
+        const socket = connect({ port: Number(target.port || "443"), host: upstreamHostname(target, env), lookup: lookupForTarget(target, env) });
         socket.once("connect", () => resolve(socket));
         socket.once("error", reject);
     });
@@ -388,6 +785,9 @@ function upstreamHostname(target, env = process.env) {
     return testUpstreamHostMap(env).get(hostname) ?? hostname;
 }
 function testUpstreamHostMap(env) {
+    if (env.NODE_ENV !== "test") {
+        return new Map();
+    }
     const entries = (env.DG_TEST_UPSTREAM_HOST_MAP ?? "")
         .split(",")
         .map((entry) => entry.trim())
@@ -405,7 +805,7 @@ function testUpstreamHostMap(env) {
 function fetchUpstream(request, target, env) {
     const upstreamProxy = selectUpstreamProxy(target, env);
     if (upstreamProxy && target.protocol === "http:") {
-        return fetchHttpViaProxy(request, target, upstreamProxy);
+        return fetchHttpViaProxy(request, target, upstreamProxy, env);
     }
     if (upstreamProxy && target.protocol === "https:") {
         return fetchHttpsViaProxy(request, target, upstreamProxy, env);
@@ -419,7 +819,9 @@ function fetchUpstream(request, target, env) {
             port: target.port ? Number(target.port) : 80,
             path: `${target.pathname}${target.search}`,
             method: request.method,
-            headers: request.headers
+            agent: upstreamHttpAgent,
+            lookup: lookupForTarget(target, env),
+            headers: stripProxyHopHeaders(request.headers)
         }, (upstreamResponse) => {
             collectBounded(upstreamResponse, { label: target.toString() })
                 .then((body) => resolve({
@@ -429,6 +831,7 @@ function fetchUpstream(request, target, env) {
             }))
                 .catch(reject);
         });
+        applyUpstreamTimeBudget(upstream, target, env, reject);
         upstream.on("error", reject);
         request.on("data", (chunk) => upstream.write(chunk));
         request.on("end", () => upstream.end());
@@ -440,10 +843,10 @@ function fetchUpstream(request, target, env) {
         });
     });
 }
-function fetchHttpViaProxy(request, target, upstreamProxy) {
+function fetchHttpViaProxy(request, target, upstreamProxy, env) {
     return new Promise((resolve, reject) => {
         const headers = {
-            ...request.headers,
+            ...stripProxyHopHeaders(request.headers),
             ...(upstreamProxy.authorizationHeader ? { "Proxy-Authorization": upstreamProxy.authorizationHeader } : {})
         };
         const upstream = httpRequest({
@@ -461,6 +864,7 @@ function fetchHttpViaProxy(request, target, upstreamProxy) {
             }))
                 .catch(reject);
         });
+        applyUpstreamTimeBudget(upstream, target, env, reject);
         upstream.on("error", reject);
         request.on("data", (chunk) => upstream.write(chunk));
         request.on("end", () => upstream.end());
@@ -479,6 +883,8 @@ function fetchHttpsDirect(request, target, env) {
             port: target.port ? Number(target.port) : 443,
             path: `${target.pathname}${target.search}`,
             method: request.method,
+            agent: upstreamHttpsAgent,
+            lookup: lookupForTarget(target, env),
             headers: upstreamRequestHeaders(request, target),
             ...upstreamTlsOptions(env)
         }, (upstreamResponse) => {
@@ -490,6 +896,7 @@ function fetchHttpsDirect(request, target, env) {
             }))
                 .catch(reject);
         });
+        applyUpstreamTimeBudget(upstream, target, env, reject);
         upstream.on("error", reject);
         request.on("data", (chunk) => upstream.write(chunk));
         request.on("end", () => upstream.end());
@@ -516,9 +923,35 @@ function connectTlsOverSocket(socket, target, env) {
             ALPNProtocols: ["http/1.1"],
             ...upstreamTlsOptions(env)
         }, () => resolve(tlsSocket));
+        applyUpstreamTimeBudget(tlsSocket, target, env);
         tlsSocket.once("error", reject);
     });
 }
+function upstreamIdleTimeoutMs(env) {
+    return parsePositiveInteger(env.DG_UPSTREAM_IDLE_TIMEOUT_MS, 30_000);
+}
+function upstreamTotalTimeoutMs(env) {
+    return parsePositiveInteger(env.DG_UPSTREAM_TOTAL_TIMEOUT_MS, 600_000);
+}
+function applyUpstreamTimeBudget(upstream, target, env, onTimeout) {
+    const idleMs = upstreamIdleTimeoutMs(env);
+    const totalMs = upstreamTotalTimeoutMs(env);
+    const expire = (detail) => {
+        const error = new Error(`upstream registry request for ${target.host} timed out: ${detail}`);
+        onTimeout?.(error);
+        upstream.destroy(error);
+    };
+    upstream.setTimeout(idleMs, () => expire(`no data for ${idleMs}ms`));
+    const totalTimer = setTimeout(() => expire(`exceeded the ${totalMs}ms total budget`), totalMs);
+    totalTimer.unref();
+    upstream.once("close", () => clearTimeout(totalTimer));
+}
+function stripProxyHopHeaders(headers) {
+    const stripped = { ...headers };
+    delete stripped["proxy-authorization"];
+    delete stripped["proxy-connection"];
+    return stripped;
+}
 function writeRawHttpRequest(tlsSocket, request, target, requestBody) {
     return new Promise((resolve, reject) => {
         collectBounded(tlsSocket, { label: target.toString() }).then(resolve).catch(reject);
@@ -584,14 +1017,20 @@ function headerLines(key, value) {
     }
     return [`${key}: ${value}`];
 }
-function upstreamTlsOptions(env) {
-    const caPath = env.DG_UPSTREAM_CA_CERT ?? env.NODE_EXTRA_CA_CERTS;
+export function upstreamTlsOptions(env) {
+    // Trust an extra upstream CA only from DG_UPSTREAM_CA_CERT — an explicit,
+    // dg-specific knob for corporate TLS-intercepting proxies / private mirrors.
+    // The ambient NODE_EXTRA_CA_CERTS is deliberately NOT honored here: dg's own
+    // agent routing sets that variable to dg's MITM CA for the CLIENT side, so
+    // re-consuming it as an UPSTREAM trust anchor would let any process that can
+    // set it MITM the real registry through dg's proxy.
+    const caPath = env.DG_UPSTREAM_CA_CERT;
     if (!caPath) {
         return {};
     }
     try {
         return {
-            ca: readFileSync(caPath, "utf8")
+            ca: [...rootCertificates, readFileSync(caPath, "utf8")]
         };
     }
     catch {
@@ -627,7 +1066,11 @@ async function lookupVerdict(options, target, sha256, upstream, identity) {
     if (shouldUseScanTarball(options, target, identity)) {
         return lookupScanTarballVerdict(options, target, sha256, upstream, identity);
     }
-    const cooldown = resolveCooldownRequest(options.env, identity);
+    const preverified = preverifiedVerdict(options, target, sha256, identity);
+    if (preverified) {
+        return preverified;
+    }
+    const cooldown = resolveCooldownRequest(options, identity);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), options.verdictTimeoutMs ?? installVerdictTimeoutMs(options.env));
     try {
@@ -641,7 +1084,7 @@ async function lookupVerdict(options, target, sha256, upstream, identity) {
             body: JSON.stringify({
                 manager: options.classification.manager,
                 action: options.classification.action,
-                url: target.toString(),
+                url: redactSecrets(target.toString()),
                 artifactUrlHash: artifactUrlHash(target),
                 ecosystem: identity.ecosystem,
                 name: identity.name,
@@ -662,7 +1105,7 @@ async function lookupVerdict(options, target, sha256, upstream, identity) {
                 packageName: artifactDisplayName(identity),
                 cause: "quota-exceeded",
                 reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset.",
-                ...(typeof body.resetsAt === "string" ? { resetsAt: body.resetsAt } : {}),
+                ...(typeof body.resetsAt === "string" ? { resetsAt: sanitize(body.resetsAt) } : {}),
                 quotaBehavior: body.quotaBehavior === "pass" ? "pass" : "block"
             };
         }
@@ -748,6 +1191,39 @@ async function lookupScanTarballVerdict(options, target, sha256, upstream, ident
         clearTimeout(timeout);
     }
 }
+// A preflight batch-analyze already verdicted this exact name@version (and the
+// user accepted any warns), so a per-artifact API round-trip would re-answer
+// the same question. Trust it only when the identity came from registry
+// metadata and the preflight applied the same cooldown gate the proxy would;
+// the synthesized verdict goes through normalizeVerdict so the scanned-SHA
+// cross-check blocks tampered bytes exactly like a server response would.
+function preverifiedVerdict(options, target, streamedSha256, identity) {
+    if (identity.sourceKind !== "registry-metadata") {
+        return null;
+    }
+    const entry = loadPreverifiedMap(options.session.dir).get(preverifiedKey(identity.ecosystem, identity.name, identity.version));
+    if (!entry) {
+        return null;
+    }
+    if (!entry.cooldownEvaluated && resolveCooldownRequest(options, identity) !== undefined) {
+        return null;
+    }
+    if (!entry.scannedSha256) {
+        // No byte-level fingerprint to cross-check against the streamed artifact, so
+        // a preverified pass/warn can't prove the downloaded bytes match what was
+        // screened (a metadata-only preflight, or a registry swap between preflight
+        // and fetch). Fall through to a real scan of the streamed bytes — TOCTOU
+        // defense — rather than honoring the verdict for whatever now arrives.
+        return null;
+    }
+    return normalizeVerdict({
+        verdict: entry.action,
+        cause: entry.action,
+        packageName: `${identity.name}@${identity.version}`,
+        reason: entry.reason ?? (entry.action === "pass" ? "verified before install" : "flagged for review"),
+        ...(entry.scannedSha256 ? { scannedSha256: entry.scannedSha256 } : {})
+    }, target, identity, streamedSha256);
+}
 function normalizeVerdict(value, target, identity, streamedSha256) {
     if (!isRecord(value)) {
         throw new Error("Dependency Guardian API returned a malformed verdict");
@@ -767,22 +1243,38 @@ function normalizeVerdict(value, target, identity, streamedSha256) {
     }
     const cause = typeof value.cause === "string" ? value.cause : undefined;
     const cooldown = parseCooldownInfo(value.cooldown);
+    const dashboardUrl = safeDashboardUrl(value.dashboardUrl);
     return {
         verdict,
-        packageName: typeof value.packageName === "string" ? value.packageName : artifactDisplayName(identity) || packageNameFromUrl(target),
+        packageName: typeof value.packageName === "string" ? sanitize(value.packageName) : artifactDisplayName(identity) || packageNameFromUrl(target),
         ...(isProxyCause(cause) ? { cause } : {}),
-        reason: typeof value.reason === "string" ? value.reason : `API verdict ${verdict}`,
-        ...(typeof value.dashboardUrl === "string" ? { dashboardUrl: value.dashboardUrl } : {}),
+        reason: typeof value.reason === "string" ? sanitize(value.reason) : `API verdict ${verdict}`,
+        ...(dashboardUrl ? { dashboardUrl } : {}),
         ...(value.unauthenticated === true ? { unauthenticated: true } : {}),
         ...(cooldown ? { cooldown } : {})
     };
 }
-function resolveCooldownRequest(env, identity) {
+function safeDashboardUrl(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    try {
+        const url = new URL(sanitize(value));
+        return url.protocol === "https:" ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function resolveCooldownRequest(options, identity) {
     if (identity.ecosystem === "unknown" || identity.version === "unknown") {
         return undefined;
     }
+    if (isCooldownExemptByDgFile(identity.name, identity.ecosystem, options.cooldownExemptions ?? [])) {
+        return undefined;
+    }
     try {
-        return cooldownRequestParam(loadUserConfig(env), env, identity.ecosystem, identity.name);
+        return cooldownRequestParam(loadUserConfig(options.env), options.env, identity.ecosystem, identity.name);
     }
     catch {
         return undefined;
@@ -795,8 +1287,8 @@ function parseCooldownInfo(value) {
     return {
         requiredDays: value.requiredDays,
         ...(typeof value.ageDays === "number" && Number.isFinite(value.ageDays) ? { ageDays: value.ageDays } : {}),
-        ...(typeof value.publishedAt === "string" ? { publishedAt: value.publishedAt } : {}),
-        ...(typeof value.eligibleAt === "string" ? { eligibleAt: value.eligibleAt } : {})
+        ...(typeof value.publishedAt === "string" ? { publishedAt: sanitize(value.publishedAt) } : {}),
+        ...(typeof value.eligibleAt === "string" ? { eligibleAt: sanitize(value.eligibleAt) } : {})
     };
 }
 function normalizeScanTarballVerdict(value, target, identity, streamedSha256) {
@@ -857,7 +1349,7 @@ function mergeIdentities(existing, next) {
     }
     return merged;
 }
-function recordDecision(options, state, verdict) {
+function recordDecision(options, state, verdict, identity) {
     const decision = enforceProtectedInstall({
         classification: options.classification,
         env: options.env,
@@ -867,10 +1359,28 @@ function recordDecision(options, state, verdict) {
     state.decisions = [...state.decisions, decision];
     state.events = [...state.events, `${decision.action}:${decision.cause}:${redactSecrets(decision.packageName)}`];
     writeProxyState(options.session, state);
+    if (identity && decision.action === "block" && decision.cause === "cooldown" && decision.cooldown) {
+        try {
+            recordHeldPackage({
+                ecosystem: identity.ecosystem,
+                name: identity.name,
+                version: identity.version,
+                requiredDays: decision.cooldown.requiredDays,
+                ...(decision.cooldown.ageDays !== undefined ? { ageDays: decision.cooldown.ageDays } : {}),
+                ...(decision.cooldown.publishedAt ? { publishedAt: decision.cooldown.publishedAt } : {}),
+                ...(decision.cooldown.eligibleAt ? { eligibleAt: decision.cooldown.eligibleAt } : {}),
+                manager: options.classification.manager
+            }, options.env);
+        }
+        catch (error) {
+            noteEnforcementSideEffectFailure(error);
+        }
+    }
     return decision;
 }
 function sendBlocked(response, decision) {
-    const body = `Dependency Guardian blocked ${redactSecrets(decision.packageName)}: ${redactSecrets(decision.reason)}\n`;
+    const breadcrumb = decision.cause === "cooldown" ? " · holds: dg cooldown" : "";
+    const body = `Dependency Guardian blocked ${redactSecrets(decision.packageName)}: ${redactSecrets(decision.reason)}${breadcrumb}\n`;
     response.writeHead(403, {
         "Content-Type": "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(body)
@@ -903,24 +1413,29 @@ function packageNameFromUrl(url) {
     return name ? decodeURIComponent(name) : url.hostname;
 }
 function writeProxyState(session, state) {
-    mkdirSync(dirname(session.files.proxy), {
-        recursive: true,
-        mode: 0o700
-    });
-    const tempPath = `${session.files.proxy}.${process.pid}.${process.hrtime.bigint().toString(36)}.tmp`;
     try {
-        writeFileSync(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: 0o600
+        mkdirSync(dirname(session.files.proxy), {
+            recursive: true,
+            mode: 0o700
         });
-        renameSync(tempPath, session.files.proxy);
+        const tempPath = `${session.files.proxy}.${process.pid}.${process.hrtime.bigint().toString(36)}.tmp`;
+        try {
+            writeFileSync(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
+                encoding: "utf8",
+                flag: "wx",
+                mode: 0o600
+            });
+            renameSync(tempPath, session.files.proxy);
+        }
+        catch (error) {
+            rmSync(tempPath, {
+                force: true
+            });
+            throw error;
+        }
     }
     catch (error) {
-        rmSync(tempPath, {
-            force: true
-        });
-        throw error;
+        noteEnforcementSideEffectFailure(error);
     }
 }
 function removeFirst(items, value) {
@@ -933,7 +1448,7 @@ function removeFirst(items, value) {
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
-function isProxyCause(value) {
+export function isProxyCause(value) {
     return [
         "pass",
         "warn",