@westbayberry/dg 2.1.0 → 2.3.0

package/dist/proxy/worker.js

@@ -2,6 +2,7 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { startProductionHttpProxy } from "./server.js";
 import { parseForceOverrideRequest } from "./enforcement.js";
 import { cleanupSessionSync } from "../state/index.js";
+import { COOLDOWN_EXEMPTIONS_ENV, loadCooldownExemptionsFile } from "./cooldown-exemptions-file.js";
 const PARENT_POLL_MS = 500;
 const sessionPath = process.argv[2];
 const apiBaseUrl = process.argv[3];
@@ -13,6 +14,7 @@ if (!sessionPath || !apiBaseUrl || !classificationJson) {
 const session = JSON.parse(readFileSync(sessionPath, "utf8"));
 const classification = JSON.parse(classificationJson);
 const forceOverride = parseForceOverrideRequest(process.env.DG_FORCE_OVERRIDE_REQUEST);
+const cooldownExemptions = loadCooldownExemptionsFile(process.env[COOLDOWN_EXEMPTIONS_ENV]);
 writeFileSync(session.files.pid, `${process.pid}\n`, {
     encoding: "utf8",
     mode: 0o600
@@ -30,6 +32,18 @@ async function close() {
 function shutdown() {
     close().finally(() => process.exit(0));
 }
+function exitOnFatal(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+        process.stderr.write(`dg proxy worker: unexpected error — ${message}\n`);
+    }
+    catch {
+        // stderr is gone; nothing left to report to.
+    }
+    close().finally(() => process.exit(1));
+}
+process.on("uncaughtException", exitOnFatal);
+process.on("unhandledRejection", exitOnFatal);
 process.stdin.resume();
 process.stdin.on("end", shutdown);
 process.stdin.on("error", shutdown);
@@ -46,6 +60,7 @@ handle = await startProductionHttpProxy({
     apiBaseUrl,
     classification,
     env: process.env,
-    ...(forceOverride ? { forceOverride } : {})
+    ...(forceOverride ? { forceOverride } : {}),
+    ...(cooldownExemptions.length > 0 ? { cooldownExemptions } : {})
 });
 process.stdout.write(`ready ${handle.port}\n`);

package/dist/publish-set/collect.js

@@ -1,5 +1,5 @@
 import { lstatSync, readFileSync, readlinkSync, realpathSync } from "node:fs";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { isAbsolute, relative, resolve, sep } from "node:path";
 export function buildAuditFile(root, relPath) {
     const absolute = resolve(root, relPath);
     let stat;
@@ -46,6 +46,3 @@ export function toDisplay(relPath) {
     const normalized = relative(".", relPath) || relPath;
     return normalized.split(sep).join("/");
 }
-export function joinRel(dir, name) {
-    return toDisplay(join(dir, name));
-}

package/dist/publish-set/npm.js

@@ -1,11 +1,9 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { toolInvocation } from "../util/external-tool.js";
 import { toDisplay } from "./collect.js";
 import { noExecPackEnv } from "./no-exec-shell.js";
-export function npmExecutable(platform = process.platform) {
-    return platform === "win32" ? "npm.cmd" : "npm";
-}
 const DEFAULT_EXCLUDED_DIRS = new Set([
     "node_modules",
     ".git",
@@ -46,15 +44,20 @@ function npmHasAllowlist(root) {
     }
 }
 function npmPackList(root, env) {
+    const invocation = toolInvocation("npm", ["pack", "--dry-run", "--json", "--ignore-scripts"], env);
+    if (!invocation) {
+        return null;
+    }
     const shell = noExecPackEnv(env);
     let result;
     try {
-        result = spawnSync(npmExecutable(), ["pack", "--dry-run", "--json", "--ignore-scripts"], {
+        result = spawnSync(invocation.command, [...invocation.args], {
             cwd: root,
             env: shell.env,
             encoding: "utf8",
             timeout: 60_000,
-            maxBuffer: 64 * 1024 * 1024
+            maxBuffer: 64 * 1024 * 1024,
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments
         });
     }
     finally {

package/dist/publish-set/pack.js

@@ -3,18 +3,24 @@ import { createHash } from "node:crypto";
 import { mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { npmExecutable } from "./npm.js";
+import { toolInvocation } from "../util/external-tool.js";
 import { noExecPackEnv } from "./no-exec-shell.js";
 export function packNpmArtifact(root, env = process.env) {
     const dest = mkdtempSync(join(tmpdir(), "dg-audit-pack-"));
+    const invocation = toolInvocation("npm", ["pack", "--ignore-scripts", "--pack-destination", dest], env);
+    if (!invocation) {
+        rmSync(dest, { recursive: true, force: true });
+        return { error: "npm executable not found on PATH" };
+    }
     const shell = noExecPackEnv(env);
     try {
-        const result = spawnSync(npmExecutable(), ["pack", "--ignore-scripts", "--pack-destination", dest], {
+        const result = spawnSync(invocation.command, [...invocation.args], {
             cwd: root,
             env: shell.env,
             encoding: "utf8",
             timeout: 120_000,
-            maxBuffer: 8 * 1024 * 1024
+            maxBuffer: 8 * 1024 * 1024,
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments
         });
         if (result.status !== 0) {
             return { error: result.stderr ? result.stderr.trim().split("\n").pop() ?? "npm pack failed" : "npm pack failed" };

package/dist/runtime/cli.js

@@ -1,8 +1,4 @@
-import { writeFileSync } from "node:fs";
 import { routeCommand } from "../commands/router.js";
-if (process.env.NODE_ENV === "test" && process.env.DG_TEST_RUNTIME_SENTINEL) {
-    writeFileSync(process.env.DG_TEST_RUNTIME_SENTINEL, "loaded\n", "utf8");
-}
 export function runCli(args) {
     return routeCommand(args);
 }

package/dist/runtime/fatal.js

@@ -0,0 +1,31 @@
+import { EXIT_TOOL_ERROR } from "../commands/types.js";
+import { leaveTui, tuiIsActive } from "../scan-ui/alt-screen.js";
+const defaultIo = {
+    writeStderr: (text) => {
+        process.stderr.write(text);
+    },
+    exit: (code) => {
+        process.exit(code);
+    },
+    tuiIsActive,
+    leaveTui
+};
+// Anything written while the alt screen is active is discarded when the exit handler restores the main screen.
+export function exitOnFatal(error, io = defaultIo) {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+        if (io.tuiIsActive()) {
+            io.leaveTui();
+        }
+    }
+    catch {
+        // screen restore must never mask the fatal report
+    }
+    try {
+        io.writeStderr(`dg: unexpected error — ${message}\nRun 'dg doctor' to check your installation; remove ~/.dg/config.json if it is corrupted.\n`);
+    }
+    catch {
+        // stderr is gone; nothing left to report to.
+    }
+    io.exit(EXIT_TOOL_ERROR);
+}

package/dist/runtime/first-run.js

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { dgVersion } from "../commands/version.js";
 import { isCiEnv } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
-import { sweepLegacyPythonHooks } from "../setup/plan.js";
+import { refreshSetupOnUpgrade, sweepLegacyPythonHooks } from "../setup/plan.js";
 import { resolveDgPaths } from "../state/index.js";
 const SKIP_COMMANDS = new Set([
     "help",
@@ -13,14 +13,13 @@ const SKIP_COMMANDS = new Set([
     "version",
     "--version",
     "-v",
-    "completion",
     "login",
     "logout",
     "update",
     "upgrade",
     "uninstall"
 ]);
-const MACHINE_OUTPUT_FLAGS = new Set([
+export const MACHINE_OUTPUT_FLAGS = new Set([
     "--json",
     "--sarif",
     "--csv",
@@ -43,6 +42,7 @@ export function sweepLegacyHooksOnVersionChange(env = process.env, version = dgV
             return false;
         }
         sweepLegacyPythonHooks(resolveDgPaths(env).homeDir, [], []);
+        refreshSetupOnUpgrade(env);
         mkdirSync(dirname(marker), { recursive: true, mode: 0o700 });
         writeFileSync(marker, `${version}\n`, { encoding: "utf8", mode: 0o600 });
         return true;
@@ -51,6 +51,16 @@ export function sweepLegacyHooksOnVersionChange(env = process.env, version = dgV
         return false;
     }
 }
+export function markFirstRunShown(env = process.env, now = new Date()) {
+    try {
+        const marker = firstRunMarkerPath(env);
+        mkdirSync(dirname(marker), { recursive: true, mode: 0o700 });
+        writeFileSync(marker, `${now.toISOString()}\n`, { encoding: "utf8", mode: 0o600 });
+    }
+    catch {
+        return;
+    }
+}
 export function maybeShowFirstRun(args, options = {}) {
     const env = options.env ?? process.env;
     const stderr = options.stderr ?? process.stderr;
@@ -75,17 +85,9 @@ export function maybeShowFirstRun(args, options = {}) {
         `  ${theme.paint("muted", "dg npm install / dg pip install scan packages before they run.")}`,
         `  ${theme.paint("muted", "Run")} ${command_("dg setup")} ${theme.paint("muted", "once to protect bare npm/pip installs too.")}`,
         "",
-        `  Next: ${command_("dg login")} to connect your account.`,
-        "",
         ""
     ];
     stderr.write(lines.join("\n"));
-    try {
-        mkdirSync(dirname(marker), { recursive: true, mode: 0o700 });
-        writeFileSync(marker, `${new Date().toISOString()}\n`, { encoding: "utf8", mode: 0o600 });
-    }
-    catch {
-        return true;
-    }
+    markFirstRunShown(env);
     return true;
 }

package/dist/runtime/node-version.js

@@ -46,13 +46,50 @@ export function currentNodeVersion() {
     }
     return process.version;
 }
-export function assertCurrentNode() {
+// The shims exec dg unconditionally; a hard exit on old Node would brick every shimmed manager.
+export async function resolveShimFallback(env = process.env, argv = process.argv) {
+    if (!env.DG_SHIM_ACTIVE) {
+        return null;
+    }
+    const manager = argv[2];
+    if (!manager) {
+        return null;
+    }
     try {
-        assertSupportedNode(currentNodeVersion());
+        const { resolveRealBinary } = await import("../launcher/resolve-real-binary.js");
+        const binary = resolveRealBinary({ name: manager, env }).path;
+        if (!binary) {
+            return null;
+        }
+        return {
+            binary,
+            args: argv.slice(3),
+            warning: `dg: protection inactive — dg requires Node.js >=22.14.0 but found ${currentNodeVersion()}; running ${manager} unprotected\n`
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function assertCurrentNode() {
+    const version = currentNodeVersion();
+    if (isSupportedNode(version)) {
+        return;
     }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`${message}\n`);
-        process.exit(1);
+    const fallback = await resolveShimFallback();
+    if (fallback) {
+        process.stderr.write(fallback.warning);
+        const [{ spawnSync }, { resolveSpawnInvocation }] = await Promise.all([
+            import("node:child_process"),
+            import("../launcher/spawn-invocation.js")
+        ]);
+        const invocation = resolveSpawnInvocation(fallback.binary, fallback.args);
+        const result = spawnSync(invocation.command, [...invocation.args], {
+            stdio: "inherit",
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments
+        });
+        process.exit(result.status ?? 1);
     }
+    process.stderr.write(`dg requires Node.js >=22.14.0. Current runtime is ${version}. Upgrade Node before running dg.\n`);
+    process.exit(1);
 }

package/dist/runtime/nudges.js

@@ -10,6 +10,7 @@ const UPDATE_THROTTLE_MS = 24 * 60 * 60 * 1000;
 const LOGIN_THROTTLE_MS = 7 * 24 * 60 * 60 * 1000;
 const LATEST_LOOKUP_TIMEOUT_MS = 1500;
 const SKIP_COMMANDS = new Set([
+    "",
     "help",
     "--help",
     "-h",
@@ -17,14 +18,15 @@ const SKIP_COMMANDS = new Set([
     "version",
     "--version",
     "-v",
-    "completion",
     "login",
     "logout",
+    "setup",
     "update",
     "upgrade",
     "uninstall",
     "scan",
-    "licenses"
+    "licenses",
+    "sbom"
 ]);
 export function nudgeStatePath(env = process.env) {
     return join(resolveDgPaths(env).stateDir, "nudges.json");
@@ -68,6 +70,37 @@ export function maybeShowNudges(args, options = {}) {
         writeState(statePath, state);
     }
 }
+export function maybeSetupNudge(manager, options = {}) {
+    const env = options.env ?? process.env;
+    if (!(options.stderrIsTTY ?? process.stderr.isTTY)) {
+        return "";
+    }
+    if (isCiEnv(env)) {
+        return "";
+    }
+    if (env.DG_SHIM_ACTIVE) {
+        return "";
+    }
+    const paths = resolveDgPaths(env);
+    if (existsSync(join(paths.homeDir, ".dg", "shims", manager))) {
+        return "";
+    }
+    const statePath = nudgeStatePath(env);
+    const state = readState(statePath);
+    if (state.setupNudgedAt) {
+        return "";
+    }
+    state.setupNudgedAt = (options.now ?? new Date()).toISOString();
+    writeState(statePath, state);
+    const theme = createTheme(true);
+    return `\n  ${theme.paint("muted", "Make this automatic —")} ${theme.paint("accent", "dg setup")} ${theme.paint("muted", "protects every install, no prefix.")}\n`;
+}
+export function recordLoginNudge(env = process.env, now = new Date()) {
+    const statePath = nudgeStatePath(env);
+    const state = readState(statePath);
+    state.loginNudgedAt = now.toISOString();
+    writeState(statePath, state);
+}
 export function pendingUpdate(env = process.env) {
     const latest = readState(nudgeStatePath(env)).updateLatest;
     if (!latest || compareVersions(latest, dgVersion()) <= 0) {

package/dist/sbom/cyclonedx.js

@@ -0,0 +1,211 @@
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { parseLockfilePackages } from "../verify/preflight.js";
+import { normalizePypiName } from "../policy/cooldown.js";
+export function collectSbomComponents(projects) {
+    const seen = new Set();
+    const droppedSeen = new Set();
+    const components = [];
+    const dropped = [];
+    for (const project of projects) {
+        const parsed = parseLockfilePackages(join(project.path, project.depFile));
+        for (const identity of parsed.packages) {
+            if (identity.ecosystem === "unknown" || !identity.version) {
+                const label = `${identity.ecosystem}:${identity.name}`;
+                if (identity.name.length > 0 && !droppedSeen.has(label)) {
+                    droppedSeen.add(label);
+                    dropped.push(label);
+                }
+                continue;
+            }
+            const component = { ...identity, version: identity.version };
+            const key = canonicalKey(component);
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            components.push(component);
+        }
+    }
+    return { components, dropped };
+}
+export function readRootComponent(root) {
+    const manifest = join(root, "package.json");
+    if (!existsSync(manifest)) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+        if (typeof parsed.name !== "string" || parsed.name.length === 0) {
+            return {};
+        }
+        return { component: { name: parsed.name, ...(typeof parsed.version === "string" ? { version: parsed.version } : {}) } };
+    }
+    catch {
+        return { malformed: true };
+    }
+}
+export function buildCycloneDxSbom(components, opts) {
+    const byRef = new Map();
+    for (const component of components) {
+        const mapped = toCycloneDxComponent(component);
+        if (!byRef.has(mapped["bom-ref"])) {
+            byRef.set(mapped["bom-ref"], mapped);
+        }
+    }
+    const mapped = [...byRef.values()].sort((a, b) => compareCodePoints(a["bom-ref"], b["bom-ref"]));
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        serialNumber: opts.serialNumber,
+        version: 1,
+        metadata: {
+            ...(opts.timestamp ? { timestamp: opts.timestamp } : {}),
+            tools: [{ vendor: "WestBayBerry", name: "dg", version: opts.toolVersion }],
+            ...(opts.rootComponent
+                ? {
+                    component: {
+                        type: "application",
+                        "bom-ref": "root",
+                        name: opts.rootComponent.name,
+                        ...(opts.rootComponent.version ? { version: opts.rootComponent.version } : {})
+                    }
+                }
+                : {})
+        },
+        components: mapped
+    };
+}
+function compareCodePoints(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+export function bomRefOf(component) {
+    return purlFor(component) ?? `${component.ecosystem}:${component.name}@${component.version}`;
+}
+function canonicalKey(component) {
+    const name = canonicalPurlName(component.ecosystem, component.name);
+    return `${component.ecosystem}:${name}@${component.version}`;
+}
+function canonicalPurlName(ecosystem, name) {
+    if (ecosystem === "pypi") {
+        return normalizePypiName(name);
+    }
+    if (ecosystem === "npm") {
+        return name.toLowerCase();
+    }
+    return name;
+}
+// The declared license string is emitted verbatim as a CycloneDX `license.name`,
+// which is always schema-valid for any free text. We deliberately do NOT classify
+// it into the SPDX `expression` form: correctly distinguishing a valid SPDX
+// expression from free text requires validating operands against the SPDX license
+// registry, and any heuristic shortcut emits schema-invalid expressions for some
+// inputs (unbalanced parens, operator-only strings, unregistered ids).
+function toCycloneDxComponent(component) {
+    const purl = purlFor(component);
+    const hashes = hashesFor(component.integrity);
+    const license = component.license?.trim();
+    const licenses = license ? [{ license: { name: license } }] : undefined;
+    return {
+        type: "library",
+        "bom-ref": bomRefOf(component),
+        name: component.name,
+        version: component.version,
+        ...(purl ? { purl } : {}),
+        ...(licenses ? { licenses } : {}),
+        ...(hashes.length > 0 ? { hashes } : {})
+    };
+}
+export function purlFor(component) {
+    const version = encodeURIComponent(component.version);
+    if (component.ecosystem === "npm") {
+        const lower = component.name.toLowerCase();
+        if (lower.startsWith("@") && lower.includes("/")) {
+            const slash = lower.indexOf("/");
+            const scope = lower.slice(1, slash);
+            const bare = lower.slice(slash + 1);
+            return `pkg:npm/%40${encodeURIComponent(scope)}/${encodeURIComponent(bare)}@${version}`;
+        }
+        return `pkg:npm/${encodeURIComponent(lower)}@${version}`;
+    }
+    if (component.ecosystem === "pypi") {
+        return `pkg:pypi/${encodeURIComponent(normalizePypiName(component.name))}@${version}`;
+    }
+    if (component.ecosystem === "cargo") {
+        const base = `pkg:cargo/${encodeURIComponent(component.name.toLowerCase())}@${version}`;
+        const repository = cargoAlternateRegistry(component.resolvedUrl);
+        return repository ? `${base}?repository_url=${encodeURIComponent(repository)}` : base;
+    }
+    return null;
+}
+function cargoAlternateRegistry(source) {
+    if (!source || (!source.startsWith("registry+") && !source.startsWith("sparse+"))) {
+        return null;
+    }
+    const url = source.replace(/^registry\+/u, "").replace(/^sparse\+/u, "");
+    if (/(?:^|\/\/)(?:github\.com\/rust-lang\/crates\.io-index|index\.crates\.io)/u.test(url)) {
+        return null;
+    }
+    return url;
+}
+const SRI_ALG_BYTES = {
+    sha1: { alg: "SHA-1", bytes: 20 },
+    sha256: { alg: "SHA-256", bytes: 32 },
+    sha384: { alg: "SHA-384", bytes: 48 },
+    sha512: { alg: "SHA-512", bytes: 64 }
+};
+export function hashesFor(integrity) {
+    if (!integrity) {
+        return [];
+    }
+    const hashes = [];
+    for (const token of integrity.trim().split(/\s+/)) {
+        const sri = /^(sha1|sha256|sha384|sha512)-([^?]+)/u.exec(token);
+        if (sri && sri[1] && sri[2]) {
+            const spec = SRI_ALG_BYTES[sri[1]];
+            const hex = base64ToHex(sri[2]);
+            if (spec && hex && hex.length === spec.bytes * 2) {
+                hashes.push({ alg: spec.alg, content: hex });
+            }
+            continue;
+        }
+        const hex = /^(sha1|sha256|sha384|sha512|md5):([0-9a-fA-F]+)$/u.exec(token);
+        if (hex && hex[1] && hex[2]) {
+            const spec = SRI_ALG_BYTES[hex[1]];
+            if (spec && hex[2].length === spec.bytes * 2) {
+                hashes.push({ alg: spec.alg, content: hex[2].toLowerCase() });
+            }
+            continue;
+        }
+        const berry = /^[0-9a-z]+\/([0-9a-f]{40,128})$/iu.exec(token);
+        if (berry && berry[1]) {
+            const content = berry[1].toLowerCase();
+            const alg = SHA_HEX_LENGTHS[content.length];
+            if (alg) {
+                hashes.push({ alg, content });
+            }
+            continue;
+        }
+        const bareHex = /^[0-9a-f]{40,128}$/iu.exec(token);
+        if (bareHex) {
+            const content = token.toLowerCase();
+            const alg = SHA_HEX_LENGTHS[content.length];
+            if (alg) {
+                hashes.push({ alg, content });
+            }
+        }
+    }
+    return hashes;
+}
+const SHA_HEX_LENGTHS = { 40: "SHA-1", 64: "SHA-256", 96: "SHA-384", 128: "SHA-512" };
+function base64ToHex(value) {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {
+        return null;
+    }
+    try {
+        return Buffer.from(value, "base64").toString("hex");
+    }
+    catch {
+        return null;
+    }
+}