@westbayberry/dg 2.1.0 → 2.3.0

package/dist/scan/discovery.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
+import { resolveToolPath } from "../util/external-tool.js";
 const IGNORED_DIRECTORIES = new Set([
     ".git",
     ".hg",
@@ -113,8 +114,12 @@ export function gitIgnoredDirectories(root) {
     return ignored;
 }
 function insideGitWorkTree(root) {
+    const git = resolveToolPath("git");
+    if (!git) {
+        return false;
+    }
     try {
-        const out = execFileSync("git", ["-C", root, "rev-parse", "--is-inside-work-tree"], {
+        const out = execFileSync(git, ["-C", root, "rev-parse", "--is-inside-work-tree"], {
             encoding: "utf8",
             timeout: 3000,
             stdio: ["ignore", "pipe", "ignore"]
@@ -126,8 +131,12 @@ function insideGitWorkTree(root) {
     }
 }
 function checkIgnoreBatch(root, directories) {
+    const git = resolveToolPath("git");
+    if (!git) {
+        return new Set();
+    }
     try {
-        const out = execFileSync("git", ["-C", root, "check-ignore", "--stdin", "-z"], {
+        const out = execFileSync(git, ["-C", root, "check-ignore", "--stdin", "-z"], {
             input: directories.join("\0"),
             encoding: "utf8",
             timeout: 5000,

package/dist/scan/render.js

@@ -1,4 +1,6 @@
 import { createTheme } from "../presentation/theme.js";
+import { packagePageUrl } from "../presentation/package-page.js";
+import { sanitizeDeep } from "../security/sanitize.js";
 const DETAIL_PROJECT_LIMIT = 8;
 const CLEAN_PROJECT_PREVIEW_LIMIT = 5;
 const FINDING_GROUP_PREVIEW_LIMIT = 3;
@@ -16,7 +18,8 @@ const SCANNER_SKIP_MESSAGES = {
     no_lockfile: "no lockfile found — server verification skipped (local heuristics only)",
     empty_lockfile: "lockfile contains no scannable packages — server verification skipped (local heuristics only)"
 };
-export function renderTextReport(report, terminalWidth = terminalWidthFromEnv(), theme = createTheme(false), scannerNotice) {
+export function renderTextReport(rawReport, terminalWidth = terminalWidthFromEnv(), theme = createTheme(false), scannerNotice) {
+    const report = sanitizeDeep(rawReport);
     const width = Math.max(48, Math.min(terminalWidth, 140));
     const cleanProjects = report.projects.filter((project) => project.findings.length === 0);
     const findingProjects = report.projects.filter((project) => project.findings.length > 0);
@@ -95,11 +98,31 @@ export function renderTextReport(report, terminalWidth = terminalWidthFromEnv(),
             lines.push("");
         }
     }
+    lines.push(...packagePageLines(report, theme));
     for (const error of report.errors) {
         lines.push(...wrapLine(`ERROR ${error.location}: `, error.message, width));
     }
     return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
 }
+function packagePageLines(report, theme) {
+    const urls = [];
+    const seen = new Set();
+    for (const pkg of report.scanner?.packages ?? []) {
+        const action = pkg.action ?? "pass";
+        if (action !== "block" && action !== "warn") {
+            continue;
+        }
+        const url = packagePageUrl(pkg.ecosystem ?? "", pkg.name);
+        if (url && !seen.has(url)) {
+            seen.add(url);
+            urls.push(url);
+        }
+    }
+    if (urls.length === 0) {
+        return [];
+    }
+    return ["Full report for each flagged package:", ...urls.map((url) => `  ${theme.paint("muted", url)}`), ""];
+}
 function provenanceDowngradeLines(packages, theme) {
     return packages
         .filter((pkg) => pkg.provenance?.downgrade)
@@ -132,8 +155,8 @@ function formatProject(project, width) {
     }
     return lines;
 }
-export function renderJsonReport(report, scannerUnavailable = false) {
-    return `${JSON.stringify({ ...report, status: displayScanStatus(report), scannerUnavailable }, null, 2)}\n`;
+export function renderJsonReport(report, scannerUnavailable = false, nothingToScan = false) {
+    return `${JSON.stringify({ schemaVersion: 1, ...report, status: nothingToScan ? "nothing_to_scan" : displayScanStatus(report), scannerUnavailable }, null, 2)}\n`;
 }
 export function renderSarifReport(report) {
     const rules = uniqueFindings(report.findings).map((finding) => ({
@@ -281,7 +304,8 @@ function wrapLine(prefix, text, width) {
     return lines.map((line, index) => `${index === 0 ? prefix : continuation}${line}`);
 }
 function terminalWidthFromEnv() {
-    const value = process.env.DG_TEST_TERMINAL_WIDTH ?? String(process.stdout.columns ?? 100);
+    const override = process.env.NODE_ENV === "test" ? process.env.DG_TEST_TERMINAL_WIDTH : undefined;
+    const value = override ?? String(process.stdout.columns ?? 100);
     const parsed = Number.parseInt(value, 10);
     return Number.isFinite(parsed) ? parsed : 100;
 }

package/dist/scan/scanner-report.js

@@ -59,16 +59,16 @@ export function runScannerScan(targetPath, localReport, env = process.env, decis
             error: { kind: "invalid_response", message: "scanner worker returned unreadable output" }
         };
     }
-    const report = buildScannerReport(localReport, response, total);
-    if (!decisionsFile?.readable) {
-        return { kind: "report", report };
-    }
     const ecosystems = new Map();
     for (const group of groups) {
         for (const pkg of group.packages) {
             ecosystems.set(packageKey(pkg.name, pkg.version), group.ecosystem);
         }
     }
+    const report = buildScannerReport(localReport, response, total, ecosystems);
+    if (!decisionsFile?.readable) {
+        return { kind: "report", report };
+    }
     return { kind: "report", report: annotateReportWithDecisions(report, decisionsFile, ecosystems) };
 }
 export function tryScannerScan(targetPath, localReport, env = process.env, decisionsFile = null) {
@@ -130,9 +130,9 @@ function parseWorkerError(stdout) {
     return null;
 }
 function lockfileParseError(projects, collected) {
-    const parseErrors = collected.parseErrors ?? [];
+    const parseErrors = collected.parseErrors;
     const detail = parseErrors
-        .map((entry) => [entry.path, entry.message].filter(Boolean).join(": "))
+        .map((entry) => [entry.file, entry.reason].filter(Boolean).join(": "))
         .filter((line) => line.length > 0)
         .join("; ");
     const lockfiles = [...new Set(projects.map((project) => project.depFile))].join(", ");
@@ -143,8 +143,14 @@ function lockfileParseError(projects, collected) {
             : `found ${projects.length} lockfile${projects.length === 1 ? "" : "s"} (${lockfiles}) but no packages could be parsed`
     };
 }
-export function buildScannerReport(localReport, response, analyzedCount) {
-    const findings = response.packages
+export function buildScannerReport(localReport, response, analyzedCount, ecosystems) {
+    const packages = ecosystems
+        ? response.packages.map((pkg) => {
+            const ecosystem = ecosystems.get(packageKey(pkg.name, pkg.version));
+            return ecosystem ? { ...pkg, ecosystem } : pkg;
+        })
+        : response.packages;
+    const findings = packages
         .filter((pkg) => (pkg.action ?? "pass") !== "pass")
         .map((pkg) => scannerFinding(pkg));
     const warnCount = findings.filter((finding) => finding.severity === "warn").length;
@@ -163,7 +169,7 @@ export function buildScannerReport(localReport, response, analyzedCount) {
             blockCount,
             errorCount: localReport.summary.errorCount
         },
-        scanner: response
+        scanner: { ...response, packages }
     };
 }
 function scannerFinding(pkg) {

package/dist/scan/staged.js

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createTheme } from "../presentation/theme.js";
 import { resolvePresentation } from "../presentation/mode.js";
-import { loadUserConfig } from "../config/settings.js";
+import { DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
 import { offerRememberSync } from "../decisions/remember-prompt.js";
 import { packageKey } from "../decisions/apply.js";
 import { loadDgFile, resolveAcceptedBy, warnUnreadableDgFile } from "../project/dgfile.js";
@@ -70,16 +70,18 @@ export function runStagedScan(options) {
     const env = options.env ?? process.env;
     const cwd = options.cwd ?? process.cwd();
     const theme = createTheme(resolvePresentation().color);
-    if (env[GUARD_SELFTEST_ENV] === "1") {
+    // git exports GIT_INDEX_FILE to real pre-commit runs; its absence separates dg's hook self-test from a user commit that inherited the env var.
+    if (options.hook && env[GUARD_SELFTEST_ENV] === "1" && env.GIT_INDEX_FILE === undefined) {
         return { exitCode: 2, stdout: "", stderr: "dg guard-commit self-test: synthetic block (exit 2)\n" };
     }
     const root = gitTrimmed(["rev-parse", "--show-toplevel"], { cwd, env });
     if (!root) {
         return notARepoResult();
     }
+    const onIncomplete = gitHookOnIncomplete(env);
     const lockfiles = stagedLockfilePaths(cwd, env);
     if (lockfiles === null) {
-        return failOpen(theme, "could not read staged changes");
+        return failOpen(theme, "could not read staged changes", onIncomplete);
     }
     const scoped = scopeStagedPaths(lockfiles, root, cwd, options.targetPath ?? null);
     if (scoped === null) {
@@ -96,11 +98,11 @@ export function runStagedScan(options) {
     const { dir, count } = materializeStaged(scoped, cwd, env);
     try {
         if (count === 0) {
-            return failOpen(theme, "could not read the staged lockfile contents");
+            return failOpen(theme, "could not read the staged lockfile contents", onIncomplete);
         }
         const report = tryScannerScan(dir, emptyLocalReport(dir), env, usableDgFile);
         if (!report || !report.scanner) {
-            return failOpen(theme, "could not reach the scanner");
+            return failOpen(theme, "could not reach the scanner", onIncomplete);
         }
         return decideStagedVerdict(report, env, options.hook, usableDgFile ? { root, file: usableDgFile } : undefined);
     }
@@ -167,7 +169,7 @@ export function decideStagedVerdict(report, env = process.env, hook = false, dec
         return { exitCode: 2, stdout: "", stderr: renderBlock(report.findings, theme) };
     }
     if (action === "error" || action === "unknown") {
-        return scannerUnavailable(theme);
+        return scannerUnavailable(theme, config.gitHook.onIncomplete);
     }
     if (action === "warn") {
         if (acknowledgedCount > 0 && effective === "pass") {
@@ -278,14 +280,36 @@ function incompleteNotice(theme, blocked) {
     }
     return `${head} ${theme.paint("muted", "— proceeding")}\n`;
 }
-function failOpen(theme, reason) {
+function gitHookOnIncomplete(env) {
+    try {
+        return loadUserConfig(env).gitHook.onIncomplete;
+    }
+    catch {
+        return DEFAULT_CONFIG.gitHook.onIncomplete;
+    }
+}
+function failOpen(theme, reason, onIncomplete) {
+    if (onIncomplete === "block") {
+        return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify (${reason}) — commit blocked (gitHook.onIncomplete=block). Use`)} ${theme.paint("accent", "git commit --no-verify")} ${theme.paint("muted", "to override.")}\n`
+        };
+    }
     return {
         exitCode: 0,
         stdout: "",
-        stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify (${reason}) — commit allowed`)}\n`
+        stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify (${reason}) — commit allowed (gitHook.onIncomplete=allow)`)}\n`
     };
 }
-function scannerUnavailable(theme) {
+function scannerUnavailable(theme, onIncomplete) {
+    if (onIncomplete === "block") {
+        return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", "dg: scanner unavailable — staged changes not verified; commit blocked (gitHook.onIncomplete=block). Use")} ${theme.paint("accent", "git commit --no-verify")} ${theme.paint("muted", "to override.")}\n`
+        };
+    }
     return {
         exitCode: 0,
         stdout: "",

package/dist/scan-ui/LegacyApp.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useCallback } from "react";
 import { Box, Text, useApp, useInput } from "ink";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_NOTHING_TO_SCAN } from "../commands/types.js";
 import { useScan } from "./hooks/useScan.js";
 import { Spinner } from "./components/Spinner.js";
 import { ProgressBar } from "./components/ProgressBar.js";
@@ -8,14 +9,15 @@ import { InteractiveResultsView } from "./components/InteractiveResultsView.js";
 import { ErrorView } from "./components/ErrorView.js";
 import { ProjectSelector } from "./components/ProjectSelector.js";
 import { SetupBanner } from "./components/SetupBanner.js";
-import { useTerminalSize } from "./hooks/useTerminalSize.js";
+import { useResizeRepaint } from "./hooks/useResizeRepaint.js";
 import { effectiveScanAction, scanExitCode } from "./shims.js";
 import { leaveTui, showCursor, tuiIsActive } from "./alt-screen.js";
 import { formatResetDate } from "../install-ui/block-render.js";
-export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialView, updateAvailable }) => {
+import { accountHeaderLine } from "./shims.js";
+export const App = ({ config, setupIssues = [], initialView, updateAvailable }) => {
     const { state, scanSelectedProjects, restartSelection } = useScan(config);
     const { exit } = useApp();
-    useTerminalSize();
+    useResizeRepaint();
     const leaveAltScreen = useCallback(() => {
         if (tuiIsActive()) {
             leaveTui();
@@ -33,9 +35,6 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
         exit();
     }, [state, config, exit, leaveAltScreen]);
     // Exit alt screen BEFORE writing messages so they appear on the main screen.
-    // `delayMs` keeps the alt-screen panel visible for that long before tearing
-    // down (default 0 — fire-and-exit). Used by the free_cap_reached path to
-    // give the free_cap_reached path time to read the "sign in to unlock" panel.
     const exitWithMessage = useCallback((message, exitCode, delayMs = 0) => {
         process.exitCode = exitCode;
         if (delayMs === 0) {
@@ -51,11 +50,11 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
     }, [exit, leaveAltScreen]);
     useEffect(() => {
         if (state.phase === "empty") {
-            const timer = exitWithMessage(`${state.message}\n`, 0);
+            const timer = exitWithMessage(`${state.message}\n`, EXIT_NOTHING_TO_SCAN);
             return () => clearTimeout(timer);
         }
         if (state.phase === "error") {
-            const timer = exitWithMessage(`Error: ${state.error.message}\n`, 3);
+            const timer = exitWithMessage(`Error: ${state.error.message}\n`, EXIT_ANALYSIS_INCOMPLETE);
             return () => clearTimeout(timer);
         }
         // Reflect the verdict in the process exit code as soon as results render,
@@ -91,13 +90,13 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
                 return _jsx(Spinner, { label: `Found ${state.found} · ${path}` });
             }
             case "selecting":
-                return (_jsx(ProjectSelector, { projects: state.projects, onConfirm: scanSelectedProjects, onCancel: () => { process.exitCode = 0; leaveAltScreen(); exit(); }, userStatus: userStatus }));
+                return (_jsx(ProjectSelector, { projects: state.projects, onConfirm: scanSelectedProjects, onCancel: () => { process.exitCode = 0; leaveAltScreen(); exit(); }, userStatus: accountHeaderLine() }));
             case "scanning":
                 return (_jsx(ProgressBar, { value: state.done, total: state.total, label: state.batchCount > 1 && state.batchIndex >= 1
                         ? `batch ${state.batchIndex}/${state.batchCount}`
                         : undefined }));
             case "results":
-                return (_jsx(InteractiveResultsView, { result: state.result, config: config, durationMs: state.durationMs, onExit: handleResultsExit, onBack: restartSelection ?? undefined, discoveredTotal: state.discoveredTotal, userStatus: userStatus, scanUsage: scanUsage, initialView: initialView, decisions: state.decisions }));
+                return (_jsx(InteractiveResultsView, { result: state.result, config: config, durationMs: state.durationMs, onExit: handleResultsExit, onBack: restartSelection ?? undefined, discoveredTotal: state.discoveredTotal, initialView: initialView, decisions: state.decisions }));
             case "empty":
                 return _jsx(Text, { dimColor: true, children: state.message });
             case "error":
@@ -107,9 +106,6 @@ export const App = ({ config, userStatus, scanUsage, setupIssues = [], initialVi
             }
         }
     })();
-    // Show the setup banner above the results — but not during empty/error/
-    // free_cap_reached phases where it would compete with the message the user
-    // actually needs to read.
     const showBanner = state.phase === "selecting" &&
         setupIssues.length > 0;
     // Results fill the terminal height exactly; an extra line there overflows the alt screen.

package/dist/scan-ui/alt-screen.js

@@ -5,10 +5,12 @@ const HIDE_CURSOR = `${ESC}[?25l`;
 const SHOW_CURSOR = `${ESC}[?25h`;
 const MOUSE_1000_OFF = `${ESC}[?1000l`;
 const MOUSE_1003_OFF = `${ESC}[?1003l`;
-const CLEAR_HOME = `${ESC}[2J${ESC}[H`;
+export const CLEAR_HOME = `${ESC}[2J${ESC}[H`;
 const CLEAR_LINE = `\r${ESC}[2K`;
 const TITLE = "Dependency Guardian";
 const TITLE_OSC = `${ESC}]0;${TITLE}\x07`;
+const TITLE_PUSH = `${ESC}[22;0t`;
+const TITLE_POP = `${ESC}[23;0t`;
 let tuiActive = false;
 let tuiHandle = null;
 let signalRegistrations = [];
@@ -43,7 +45,7 @@ function removeRestoreHandlers() {
 export function enterTui() {
     if (!process.stdout.isTTY || tuiActive)
         return;
-    process.stdout.write(CLEAR_LINE + ALT_SCREEN_ON + HIDE_CURSOR + MOUSE_1000_OFF + MOUSE_1003_OFF + CLEAR_HOME + TITLE_OSC);
+    process.stdout.write(CLEAR_LINE + ALT_SCREEN_ON + HIDE_CURSOR + MOUSE_1000_OFF + MOUSE_1003_OFF + CLEAR_HOME + TITLE_PUSH + TITLE_OSC);
     tuiActive = true;
     installRestoreHandlers();
     if (!tuiHandle)
@@ -56,7 +58,7 @@ export function leaveTui() {
         clearInterval(tuiHandle);
         tuiHandle = null;
     }
-    process.stdout.write(MOUSE_1003_OFF + MOUSE_1000_OFF + SHOW_CURSOR + ALT_SCREEN_OFF);
+    process.stdout.write(MOUSE_1003_OFF + MOUSE_1000_OFF + SHOW_CURSOR + ALT_SCREEN_OFF + TITLE_POP);
     tuiActive = false;
     removeRestoreHandlers();
 }
@@ -65,11 +67,6 @@ export function clearScreen() {
         return;
     process.stdout.write(CLEAR_HOME);
 }
-export function hideCursor() {
-    if (!process.stdout.isTTY)
-        return;
-    process.stdout.write(HIDE_CURSOR);
-}
 export function showCursor() {
     if (!process.stdout.isTTY)
         return;