@westbayberry/dg 2.1.0 → 2.3.0

package/dist/sbom-ui/SbomApp.js

@@ -0,0 +1,158 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import { Box, Text, useApp, useInput } from "ink";
+import chalk from "chalk";
+import { useTerminalSize } from "../scan-ui/hooks/useTerminalSize.js";
+import { useResizeRepaint } from "../scan-ui/hooks/useResizeRepaint.js";
+import { leaveTui, showCursor, tuiIsActive } from "../scan-ui/alt-screen.js";
+import { SbomHeader } from "./components/SbomHeader.js";
+import { SbomList } from "./components/SbomList.js";
+import { componentsCsv, componentsMarkdown, emptyFilterMessage, filterRows, tallyVerdicts } from "./inventory.js";
+import { ExportDialog, loginRequiredToast } from "../export-ui/ExportDialog.js";
+import { isLoggedIn } from "../scan-ui/shims.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+const HEADER_LINES = 9;
+const FOOTER_LINES = 2;
+const COUNTER_LINE = 1;
+const SAFETY_LINE = 1;
+const FILTER_CYCLE = ["all", "risky", "unlicensed"];
+const FILTER_LABEL = { all: "all", risky: "risky", unlicensed: "unlicensed", unpinned: "unpinned" };
+function ecosystemCounts(rows) {
+    const counts = new Map();
+    for (const row of rows) {
+        counts.set(row.ecosystem, (counts.get(row.ecosystem) ?? 0) + 1);
+    }
+    return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}
+export const SbomApp = ({ store, document, cwd }) => {
+    const view = useSyncExternalStore(store.subscribe, store.get, store.get);
+    const { exit } = useApp();
+    const { rows: termRows, cols: termCols } = useTerminalSize();
+    useResizeRepaint();
+    const [selected, setSelected] = useState(0);
+    const [filter, setFilter] = useState("all");
+    const [query, setQuery] = useState("");
+    const [searching, setSearching] = useState(false);
+    const [exportDialog, setExportDialog] = useState(null);
+    const [toast, setToast] = useState(null);
+    const toastTimer = useRef(null);
+    const theme = useMemo(() => createTheme(resolvePresentation().color), []);
+    const showToast = useCallback((message) => {
+        setToast(message);
+        if (toastTimer.current) {
+            clearTimeout(toastTimer.current);
+        }
+        toastTimer.current = setTimeout(() => setToast(null), 4000);
+    }, []);
+    const leaveAltScreen = useCallback(() => {
+        if (tuiIsActive()) {
+            leaveTui();
+        }
+        else {
+            showCursor();
+        }
+    }, []);
+    useEffect(() => () => leaveAltScreen(), [leaveAltScreen]);
+    useEffect(() => () => {
+        if (toastTimer.current) {
+            clearTimeout(toastTimer.current);
+        }
+    }, []);
+    const visible = filterRows(view.rows, filter, query);
+    const clamped = Math.min(selected, Math.max(0, visible.length - 1));
+    const tally = tallyVerdicts(view.rows);
+    const cargoCount = view.rows.filter((row) => row.ecosystem === "cargo").length;
+    const quit = useCallback(() => {
+        process.exitCode = 0;
+        leaveAltScreen();
+        exit();
+    }, [exit, leaveAltScreen]);
+    const openExport = useCallback(() => {
+        if (!isLoggedIn()) {
+            showToast(loginRequiredToast());
+            return;
+        }
+        setToast(null);
+        setExportDialog([
+            { label: "CycloneDX JSON", defaultName: "sbom.cdx.json", render: () => document },
+            { label: "Components CSV", defaultName: "sbom-components.csv", render: () => componentsCsv(view.rows) },
+            { label: "Components Markdown", defaultName: "sbom-components.md", render: () => componentsMarkdown(view.rows) }
+        ]);
+    }, [document, view.rows, showToast]);
+    const handleExportDone = useCallback((result) => {
+        setExportDialog(null);
+        if (result === null)
+            return;
+        showToast("path" in result ? chalk.green(`✓ exported ${result.path}`) : chalk.red(`export failed: ${result.error}`));
+    }, [showToast]);
+    useInput((input, key) => {
+        if (exportDialog)
+            return;
+        if (searching) {
+            if (key.escape) {
+                setSearching(false);
+                setQuery("");
+                setSelected(0);
+                return;
+            }
+            if (key.return) {
+                setSearching(false);
+                return;
+            }
+            if (key.backspace || key.delete) {
+                setQuery((q) => q.slice(0, -1));
+                return;
+            }
+            if (input && !key.ctrl && !key.meta && !key.upArrow && !key.downArrow && /^[\x20-\x7e]+$/.test(input)) {
+                setQuery((q) => q + input);
+                setSelected(0);
+            }
+            return;
+        }
+        if (key.escape && query) {
+            setQuery("");
+            setSelected(0);
+            return;
+        }
+        if (input === "q" || key.escape) {
+            quit();
+            return;
+        }
+        if (input === "j" || key.downArrow) {
+            setSelected((s) => Math.min(s + 1, Math.max(0, visible.length - 1)));
+            return;
+        }
+        if (input === "k" || key.upArrow) {
+            setSelected((s) => Math.max(0, s - 1));
+            return;
+        }
+        if (input === "g") {
+            setSelected(0);
+            return;
+        }
+        if (input === "G") {
+            setSelected(Math.max(0, visible.length - 1));
+            return;
+        }
+        if (input === "/") {
+            setSearching(true);
+            setToast(null);
+            return;
+        }
+        if (input === "f") {
+            const next = FILTER_CYCLE[(FILTER_CYCLE.indexOf(filter) + 1) % FILTER_CYCLE.length] ?? "all";
+            setFilter(next);
+            setSelected(0);
+            return;
+        }
+        if (input === "e") {
+            openExport();
+        }
+    });
+    const listHeight = Math.max(3, termRows - HEADER_LINES - FOOTER_LINES - COUNTER_LINE - SAFETY_LINE);
+    if (exportDialog) {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(SbomHeader, { total: view.rows.length, ecosystems: ecosystemCounts(view.rows), phase: view.phase, tally: tally, scannable: view.scannable, scanProgress: view.scanProgress, scanError: view.scanError, usage: view.usage, subject: view.subject, cargoCount: cargoCount }), _jsx(ExportDialog, { options: exportDialog, theme: theme, cwd: cwd, onDone: handleExportDone })] }));
+    }
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(SbomHeader, { total: view.rows.length, ecosystems: ecosystemCounts(view.rows), phase: view.phase, tally: tally, scannable: view.scannable, scanProgress: view.scanProgress, scanError: view.scanError, usage: view.usage, subject: view.subject, cargoCount: cargoCount }), _jsx(SbomList, { rows: visible, selected: clamped, height: listHeight, width: termCols, emptyMessage: emptyFilterMessage(filter, query, view.phase, tally, view.scanError) }), _jsxs(Box, { paddingLeft: 1, flexDirection: "column", children: [toast ? _jsx(Text, { children: toast }) : null, searching ? (_jsxs(Text, { children: [chalk.cyan("/"), query, chalk.dim("   esc to clear")] })) : query ? (_jsxs(Text, { children: [chalk.cyan("/"), query, chalk.dim(`   ${visible.length} of ${view.rows.length} components   esc clear   q quit`)] })) : (_jsxs(Text, { children: [chalk.dim("↑↓ move   / search   f "), chalk.dim(`filter: ${FILTER_LABEL[filter]}`), chalk.dim("   "), chalk.bold("e"), chalk.dim(" export   q quit")] }))] })] }));
+};

package/dist/sbom-ui/components/SbomHeader.js

@@ -0,0 +1,32 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Box, Text } from "ink";
+import chalk from "chalk";
+import { renderLogo } from "../../scan-ui/logo.js";
+import { useTerminalSize } from "../../scan-ui/hooks/useTerminalSize.js";
+const LOGO_MIN_COLS = 76;
+const LOGO_MIN_ROWS = 16;
+function logoAction(phase, tally, scanError) {
+    if (phase !== "done" || scanError) {
+        return "analysis_incomplete";
+    }
+    if (tally.block > 0)
+        return "block";
+    if (tally.warn > 0)
+        return "warn";
+    if (tally.scanned > 0)
+        return "pass";
+    return "analysis_incomplete";
+}
+function verdictLine(tally, scanError) {
+    if (scanError) {
+        return _jsx(Text, { children: chalk.dim(scanError) });
+    }
+    return (_jsxs(Text, { children: [tally.block > 0 ? chalk.red.bold(`${tally.block} BLOCK`) : chalk.dim("0 BLOCK"), chalk.dim("  ·  "), tally.warn > 0 ? chalk.yellow(`${tally.warn} WARN`) : chalk.dim("0 WARN"), chalk.dim("  ·  "), chalk.dim(`${tally.pass} PASS`)] }));
+}
+export const SbomHeader = ({ total, ecosystems, phase, tally, scannable, scanProgress, scanError, usage, subject, cargoCount }) => {
+    const { cols, rows } = useTerminalSize();
+    const breakdown = ecosystems.map(([name, count]) => `${count} ${name}`).join(chalk.dim(" · "));
+    const logo = renderLogo(logoAction(phase, tally, scanError));
+    const showLogo = cols >= LOGO_MIN_COLS && rows >= LOGO_MIN_ROWS;
+    return (_jsx(Box, { flexDirection: "column", borderStyle: "round", borderColor: "gray", paddingLeft: 1, paddingRight: 1, children: _jsxs(Box, { flexDirection: "row", children: [_jsxs(Box, { flexDirection: "column", flexGrow: 1, children: [_jsxs(Text, { children: [chalk.bold("Dependency Guardian"), chalk.dim("  ·  SBOM")] }), _jsx(Text, { children: " " }), _jsxs(Text, { children: [chalk.bold(String(total)), " ", total === 1 ? "component" : "components", "   ", chalk.dim(breakdown)] }), phase === "inventory" ? null : (_jsxs(_Fragment, { children: [phase === "scanning" && !scanError ? (_jsxs(Text, { children: [chalk.cyan(`scanning ${scanProgress} / ${scannable}`), chalk.dim("  npm + pypi")] })) : (verdictLine(tally, scanError)), cargoCount > 0 ? _jsx(Text, { children: chalk.dim(`${cargoCount} cargo: inventory only, not verdict-checked`) }) : null] })), _jsx(Text, { children: " " }), _jsx(Text, { children: chalk.dim(`CycloneDX 1.5 · ${subject}${usage ? ` · ${usage.used.toLocaleString()}${usage.limit === null ? "" : ` / ${usage.limit.toLocaleString()}`} scanned this month` : ""}`) })] }), showLogo ? (_jsx(Box, { flexDirection: "column", marginLeft: 2, children: logo.map((line, index) => (_jsx(Text, { children: line }, index))) })) : null] }) }));
+};

package/dist/sbom-ui/components/SbomList.js

@@ -0,0 +1,52 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Text } from "ink";
+import chalk from "chalk";
+import { pad, truncate } from "../../scan-ui/format-helpers.js";
+export function verdictGlyph(row) {
+    if (!row.scannable) {
+        return chalk.dim("·");
+    }
+    if (!row.verdict) {
+        return chalk.dim("…");
+    }
+    switch (row.verdict.action) {
+        case "block":
+            return chalk.red.bold("✘");
+        case "warn":
+            return chalk.yellow("⚠");
+        case "pass":
+            return chalk.green("✓");
+        default:
+            return chalk.cyan("?");
+    }
+}
+function windowStart(selected, count, height) {
+    if (count <= height) {
+        return 0;
+    }
+    const half = Math.floor(height / 2);
+    return Math.min(Math.max(0, selected - half), count - height);
+}
+export const SbomList = ({ rows, selected, height, width, emptyMessage }) => {
+    if (rows.length === 0) {
+        return (_jsx(Box, { paddingLeft: 1, children: _jsx(Text, { children: chalk.dim(emptyMessage) }) }));
+    }
+    const ecoWidth = 6;
+    const licenseWidth = Math.min(20, Math.max(10, Math.floor(width * 0.22)));
+    const hashWidth = 11;
+    const nameWidth = Math.max(12, width - 2 - 2 - ecoWidth - 1 - licenseWidth - 1 - hashWidth - 2);
+    const start = windowStart(selected, rows.length, height);
+    const shown = rows.slice(start, start + height);
+    return (_jsxs(Box, { flexDirection: "column", children: [shown.map((row, index) => {
+                const isSelected = start + index === selected;
+                const cursor = isSelected ? chalk.cyan("›") : " ";
+                const id = truncate(`${row.name}@${row.version}`, nameWidth);
+                const name = isSelected ? chalk.bold(pad(id, nameWidth)) : pad(id, nameWidth);
+                const eco = chalk.dim(pad(row.ecosystem, ecoWidth));
+                const license = row.license
+                    ? chalk.dim(pad(truncate(row.license, licenseWidth), licenseWidth))
+                    : chalk.yellow(pad("no license", licenseWidth));
+                const hash = row.hasHash ? chalk.dim(pad("checksum", hashWidth)) : chalk.yellow(pad("no checksum", hashWidth));
+                return (_jsxs(Text, { children: [cursor, " ", verdictGlyph(row), " ", name, " ", eco, " ", license, " ", hash] }, row.key));
+            }), rows.length > height ? (_jsx(Text, { children: chalk.dim(`  ${start + 1}–${Math.min(start + height, rows.length)} of ${rows.length}`) })) : null] }));
+};

package/dist/sbom-ui/inventory.js

@@ -0,0 +1,132 @@
+const ROW_ECOSYSTEMS = { npm: "npm", pypi: "pypi", cargo: "cargo" };
+export function rowKey(ecosystem, name, version) {
+    return `${ecosystem}:${name.toLowerCase()}@${version}`;
+}
+export function buildSbomRows(components) {
+    return components
+        .map((component) => {
+        const ecosystem = ROW_ECOSYSTEMS[component.ecosystem] ?? "other";
+        return {
+            key: rowKey(ecosystem, component.name, component.version),
+            name: component.name,
+            version: component.version,
+            ecosystem,
+            license: component.license ?? null,
+            hasHash: component.integrity != null && component.integrity.length > 0,
+            scannable: ecosystem === "npm" || ecosystem === "pypi"
+        };
+    })
+        .sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version));
+}
+export function verdictFromResult(result) {
+    if (!result.action) {
+        return undefined;
+    }
+    const reason = result.provenance?.downgrade
+        ? "provenance downgraded"
+        : result.cooldown?.status === "quarantine"
+            ? "in cooldown"
+            : result.reasons[0] ?? (result.action === "block" ? "malware" : result.action === "warn" ? "flagged" : "clean");
+    return {
+        action: result.action,
+        reason,
+        ...(result.provenance?.downgrade ? { provenanceFrom: result.provenance.downgrade.fromVersion } : {}),
+        ...(result.cooldown?.ageDays !== undefined ? { cooldownAgeDays: result.cooldown.ageDays } : {})
+    };
+}
+export function mergeVerdicts(rows, ecosystem, results) {
+    const byKey = new Map();
+    for (const result of results) {
+        const verdict = verdictFromResult(result);
+        if (verdict) {
+            byKey.set(rowKey(ecosystem, result.name, result.version), verdict);
+        }
+    }
+    if (byKey.size === 0) {
+        return rows;
+    }
+    return rows.map((row) => {
+        const verdict = byKey.get(row.key);
+        return verdict ? { ...row, verdict } : row;
+    });
+}
+const VERDICT_RANK = { block: 0, warn: 1, analysis_incomplete: 2, pass: 3 };
+export function filterRows(rows, filter, query) {
+    const needle = query.trim().toLowerCase();
+    const matched = rows.filter((row) => {
+        if (needle && !row.name.toLowerCase().includes(needle)) {
+            return false;
+        }
+        if (filter === "risky") {
+            return row.verdict?.action === "block" || row.verdict?.action === "warn";
+        }
+        if (filter === "unlicensed") {
+            return row.license === null;
+        }
+        return true;
+    });
+    if (filter === "risky") {
+        return matched
+            .slice()
+            .sort((a, b) => (VERDICT_RANK[a.verdict.action] - VERDICT_RANK[b.verdict.action]) || a.name.localeCompare(b.name));
+    }
+    return matched;
+}
+export function emptyFilterMessage(filter, query, phase, tally, scanError) {
+    const trimmed = query.trim();
+    if (trimmed) {
+        return `no components match "${trimmed}"`;
+    }
+    if (filter === "risky") {
+        if (phase === "scanning") {
+            return "scanning… nothing flagged yet";
+        }
+        if (scanError) {
+            return scanError;
+        }
+        if (tally.scanned === 0) {
+            return "no components were verdict-checked";
+        }
+        return "nothing flagged — no malware, downgrades, or cooldowns";
+    }
+    if (filter === "unlicensed") {
+        return "every component declares a license";
+    }
+    return "no components";
+}
+function csvCell(value) {
+    // Neutralize spreadsheet formula injection: a cell starting with = + - @ (or
+    // tab/CR) is interpreted as a formula by Excel/Sheets, letting an attacker-named
+    // dependency run on open. Prefix a sentinel apostrophe so it is treated as text.
+    const guarded = /^[=+\-@\t\r]/.test(value) ? `'${value}` : value;
+    return /[",\n\r]/.test(guarded) ? `"${guarded.replace(/"/g, '""')}"` : guarded;
+}
+export function componentsCsv(rows) {
+    const lines = ["name,version,ecosystem,license,verdict"];
+    for (const row of rows) {
+        lines.push([row.name, row.version, row.ecosystem, row.license ?? "", row.verdict?.action ?? ""].map(csvCell).join(","));
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function componentsMarkdown(rows) {
+    const cell = (value) => value.replace(/\|/g, "\\|");
+    const lines = ["| Name | Version | Ecosystem | License | Verdict |", "|---|---|---|---|---|"];
+    for (const row of rows) {
+        lines.push(`| ${cell(row.name)} | ${cell(row.version)} | ${row.ecosystem} | ${cell(row.license ?? "—")} | ${row.verdict?.action ?? ""} |`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function tallyVerdicts(rows) {
+    let block = 0;
+    let warn = 0;
+    let pass = 0;
+    for (const row of rows) {
+        if (row.verdict?.action === "block")
+            block += 1;
+        else if (row.verdict?.action === "warn")
+            warn += 1;
+        else if (row.verdict?.action === "pass")
+            pass += 1;
+    }
+    return { block, warn, pass, scanned: block + warn + pass };
+}

package/dist/sbom-ui/launch.js

@@ -0,0 +1,51 @@
+import { resolvePresentation } from "../presentation/mode.js";
+import { createSbomStore } from "./store.js";
+import { runSbomScan } from "./run.js";
+export function shouldLaunchSbomTui(options) {
+    if (options.json || options.outputPath) {
+        return false;
+    }
+    if (process.env.TERM === "dumb") {
+        return false;
+    }
+    if (!process.stdin.isTTY) {
+        return false;
+    }
+    return resolvePresentation().mode === "rich";
+}
+export async function launchSbomTui(payload) {
+    const ci = process.env.CI;
+    const ciCleared = ci === "" || ci === "0" || ci === "false";
+    if (ciCleared) {
+        delete process.env.CI;
+    }
+    const [{ render }, react, app, altScreen] = await Promise.all([
+        import("ink"),
+        import("react"),
+        import("./SbomApp.js"),
+        import("../scan-ui/alt-screen.js")
+    ]);
+    const store = createSbomStore({
+        phase: "inventory",
+        rows: payload.rows,
+        subject: payload.subject,
+        dropped: payload.dropped,
+        scannable: payload.rows.filter((row) => row.scannable).length,
+        scanProgress: 0,
+        scanError: null,
+        usage: null
+    });
+    const controller = new AbortController();
+    altScreen.enterTui();
+    try {
+        const instance = render(react.default.createElement(app.SbomApp, { store, document: payload.document, cwd: payload.cwd }), { exitOnCtrlC: true });
+        void runSbomScan(store, payload.env, controller.signal);
+        await instance.waitUntilExit();
+    }
+    finally {
+        if (ciCleared)
+            process.env.CI = ci;
+        controller.abort();
+        altScreen.leaveTui();
+    }
+}

package/dist/sbom-ui/run.js

@@ -0,0 +1,55 @@
+import { AnalyzeError, analyzePackages } from "../api/analyze.js";
+import { mergeVerdicts } from "./inventory.js";
+const SCAN_ECOSYSTEMS = ["npm", "pypi"];
+export async function runSbomScan(store, env, signal) {
+    const scannable = store.get().rows.filter((row) => row.scannable);
+    if (scannable.length === 0) {
+        store.update({ phase: "done" });
+        return;
+    }
+    store.update({ phase: "scanning", scannable: scannable.length, scanProgress: 0 });
+    let completed = 0;
+    try {
+        for (const ecosystem of SCAN_ECOSYSTEMS) {
+            const inputs = scannable.filter((row) => row.ecosystem === ecosystem).map((row) => ({ name: row.name, version: row.version }));
+            if (inputs.length === 0) {
+                continue;
+            }
+            const base = completed;
+            const response = await analyzePackages(inputs, {
+                ecosystem,
+                env,
+                ...(signal ? { signal } : {}),
+                onProgress: (progress) => store.update({ scanProgress: base + progress.done })
+            });
+            completed += inputs.length;
+            store.update({
+                rows: mergeVerdicts(store.get().rows, ecosystem, response.packages),
+                scanProgress: completed,
+                ...(response.usage ? { usage: response.usage } : {})
+            });
+        }
+        store.update({ phase: "done" });
+    }
+    catch (error) {
+        store.update({
+            phase: "done",
+            scanError: error instanceof AnalyzeError ? failOpenReason(error.code) : error instanceof Error ? error.message : "verdict scan failed"
+        });
+    }
+}
+function failOpenReason(code) {
+    switch (code) {
+        case "auth":
+            return "sign in with dg login to see verdicts";
+        case "quota_exceeded":
+            return "scan quota reached — showing inventory only";
+        case "rate_limited":
+            return "rate limited — showing inventory only";
+        case "network":
+        case "timeout":
+            return "offline — showing inventory only";
+        default:
+            return "scanner unavailable — showing inventory only";
+    }
+}

package/dist/sbom-ui/store.js

@@ -0,0 +1,26 @@
+export function createSbomStore(initial) {
+    let view = initial;
+    const listeners = new Set();
+    const emit = () => {
+        for (const listener of listeners) {
+            listener();
+        }
+    };
+    return {
+        get: () => view,
+        set: (next) => {
+            view = next;
+            emit();
+        },
+        update: (patch) => {
+            view = { ...view, ...patch };
+            emit();
+        },
+        subscribe: (listener) => {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        }
+    };
+}

package/dist/scan/collect.js

@@ -12,6 +12,10 @@ export const LOCKFILE_ECOSYSTEMS = {
     "uv.lock": "pypi",
     "requirements.txt": "pypi"
 };
+export const SBOM_LOCKFILE_ECOSYSTEMS = {
+    ...LOCKFILE_ECOSYSTEMS,
+    "Cargo.lock": "cargo"
+};
 export function isLockfileName(name) {
     return Object.prototype.hasOwnProperty.call(LOCKFILE_ECOSYSTEMS, name);
 }
@@ -30,16 +34,16 @@ const IGNORED_DIRECTORIES = new Set([
 const MAX_DISCOVERY_DEPTH = 8;
 function readDirents(directory) {
     try {
-        return readdirSync(directory, { withFileTypes: true });
+        return readdirSync(directory, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     }
     catch {
         return [];
     }
 }
-function lockfilesPerEcosystem(entries) {
+function lockfilesPerEcosystem(entries, ecosystems) {
     const matches = [];
     const claimed = new Set();
-    for (const [lockfile, ecosystem] of Object.entries(LOCKFILE_ECOSYSTEMS)) {
+    for (const [lockfile, ecosystem] of Object.entries(ecosystems)) {
         if (claimed.has(ecosystem)) {
             continue;
         }
@@ -56,7 +60,7 @@ function shouldDescend(entry, directory, gitIgnored) {
         !entry.name.startsWith(".") &&
         !gitIgnored.has(join(directory, entry.name)));
 }
-export function discoverScanProjects(root) {
+export function discoverScanProjects(root, ecosystems = LOCKFILE_ECOSYSTEMS) {
     const projects = [];
     const gitIgnored = gitIgnoredDirectories(root);
     walk(root, 0);
@@ -66,7 +70,7 @@ export function discoverScanProjects(root) {
             return;
         }
         const entries = readDirents(directory);
-        for (const [depFile, ecosystem] of lockfilesPerEcosystem(entries)) {
+        for (const [depFile, ecosystem] of lockfilesPerEcosystem(entries, ecosystems)) {
             projects.push({
                 path: directory,
                 relativePath: relative(root, directory) || ".",
@@ -97,7 +101,7 @@ export async function discoverScanProjectsAsync(root, onProgress) {
             lastYield = Date.now();
         }
         const entries = readDirents(directory);
-        for (const [depFile, ecosystem] of lockfilesPerEcosystem(entries)) {
+        for (const [depFile, ecosystem] of lockfilesPerEcosystem(entries, LOCKFILE_ECOSYSTEMS)) {
             const relativePath = relative(root, directory) || ".";
             projects.push({
                 path: directory,

package/dist/scan/command.js

@@ -1,5 +1,6 @@
-import { statSync, writeFileSync } from "node:fs";
+import { statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
+import { writeReportAtomic } from "../util/report-writer.js";
 import { findProjectRoot, loadDgFile, warnUnreadableDgFile } from "../project/dgfile.js";
 import { scanProject } from "./discovery.js";
 import { renderJsonReport, renderSarifReport, renderTextReport } from "./render.js";
@@ -10,7 +11,7 @@ import { runScannerScan } from "./scanner-report.js";
 import { runStagedScan, stagedScanReport } from "./staged.js";
 import { scanExitCode } from "../scan-ui/shims.js";
 import { loadUserConfig } from "../config/settings.js";
-import { EXIT_USAGE_VERDICT } from "../commands/types.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_NOTHING_TO_SCAN, EXIT_USAGE_VERDICT } from "../commands/types.js";
 export function runScanCommand(context) {
     const parsed = parseScanArgs(context.args);
     if ("error" in parsed) {
@@ -54,7 +55,7 @@ export function runScanCommand(context) {
         }
         catch (error) {
             return {
-                exitCode: 1,
+                exitCode: EXIT_ANALYSIS_INCOMPLETE,
                 stdout: "",
                 stderr: `dg scan failed: ${error instanceof Error ? error.message : "unknown scan error"}\n`
             };
@@ -69,26 +70,32 @@ export function runScanCommand(context) {
     }
     const skipNotice = skipNoticeFor(outcome, report);
     const scannerUnavailable = !report.scanner && report.summary.projectCount > 0;
-    const rendered = renderReport(report, parsed.format, scannerUnavailable, skipNotice);
+    const nothingToScan = !parsed.staged &&
+        !report.scanner &&
+        !report.scannerError &&
+        report.summary.projectCount === 0 &&
+        report.summary.errorCount === 0;
+    const exitCode = nothingToScan ? EXIT_NOTHING_TO_SCAN : exitCodeForReport(report);
+    const rendered = renderReport(report, parsed.format, scannerUnavailable, skipNotice, nothingToScan);
     if (parsed.outputPath) {
         try {
-            writeFileSync(resolve(parsed.outputPath), rendered, "utf8");
+            writeReportAtomic(resolve(parsed.outputPath), rendered);
         }
         catch (error) {
             return {
-                exitCode: 1,
+                exitCode: EXIT_ANALYSIS_INCOMPLETE,
                 stdout: "",
                 stderr: `dg scan could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
             };
         }
         return {
-            exitCode: exitCodeForReport(report),
+            exitCode,
             stdout: `Wrote ${parsed.format} scan report to ${parsed.outputPath}\n`,
             stderr: ""
         };
     }
     return {
-        exitCode: exitCodeForReport(report),
+        exitCode,
         stdout: rendered,
         stderr: ""
     };
@@ -198,9 +205,9 @@ function skipNoticeFor(outcome, report) {
     }
     return "empty_lockfile";
 }
-function renderReport(report, format, scannerUnavailable, skipNotice) {
+function renderReport(report, format, scannerUnavailable, skipNotice, nothingToScan) {
     if (format === "json") {
-        return renderJsonReport(report, scannerUnavailable);
+        return renderJsonReport(report, scannerUnavailable, nothingToScan);
     }
     if (format === "sarif") {
         return renderSarifReport(report);