@westbayberry/dg 2.1.0 → 2.3.0

package/dist/commands/update.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
-import { npmExecutable } from "../publish-set/npm.js";
+import { toolInvocation } from "../util/external-tool.js";
 import { EXIT_USAGE } from "./types.js";
 import { dgVersion } from "./version.js";
 const PACKAGE_NAME = "@westbayberry/dg";
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/u;
 export const updateCommand = {
     name: "update",
     summary: "Check for dg CLI updates.",
@@ -26,7 +27,7 @@ function runUpdateCommand(args, commandName) {
     if (parsed.format === "json") {
         return {
             exitCode: report.status === "unknown" ? 1 : 0,
-            stdout: `${JSON.stringify(report, null, 2)}\n`,
+            stdout: `${JSON.stringify({ schemaVersion: 1, ...report }, null, 2)}\n`,
             stderr: ""
         };
     }
@@ -62,17 +63,22 @@ function parseUpdateArgs(args) {
     };
 }
 export function readLatestVersion(timeoutMs = 5000) {
-    const injected = process.env.DG_UPDATE_LATEST_VERSION;
+    const injected = process.env.NODE_ENV === "test" ? process.env.DG_UPDATE_LATEST_VERSION : undefined;
     if (injected) {
-        return injected;
+        return validVersion(injected);
     }
-    const result = spawnSync(npmExecutable(), ["view", PACKAGE_NAME, "version", "--json"], {
+    const invocation = toolInvocation("npm", ["view", PACKAGE_NAME, "version", "--json"]);
+    if (!invocation) {
+        return null;
+    }
+    const result = spawnSync(invocation.command, [...invocation.args], {
         encoding: "utf8",
         env: {
             ...process.env,
             npm_config_ignore_scripts: "true"
         },
-        timeout: timeoutMs
+        timeout: timeoutMs,
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments
     });
     if (result.status !== 0) {
         return null;
@@ -83,12 +89,15 @@ export function readLatestVersion(timeoutMs = 5000) {
     }
     try {
         const parsed = JSON.parse(raw);
-        return typeof parsed === "string" ? parsed : null;
+        return typeof parsed === "string" ? validVersion(parsed) : null;
     }
     catch {
-        return raw.replace(/^"|"$/gu, "");
+        return validVersion(raw.replace(/^"|"$/gu, ""));
     }
 }
+function validVersion(value) {
+    return VERSION_PATTERN.test(value) ? value : null;
+}
 function buildUpdateReport(latestVersion) {
     if (!latestVersion) {
         return {

package/dist/commands/verify.js

@@ -1,4 +1,4 @@
-import { EXIT_UNAVAILABLE, EXIT_USAGE } from "./types.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_UNAVAILABLE, EXIT_USAGE_VERDICT } from "./types.js";
 import { writeFileSync } from "node:fs";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
@@ -22,14 +22,14 @@ export const verifyCommand = {
     ],
     examples: ["dg verify npm:react", "dg verify pypi:requests@2.31.0", "dg verify ./pkg.tgz --verbose", "dg verify package-lock.json --json"],
     details: [
-        "dg verify npm:react (or pypi:requests, with an optional @version — defaults to latest) runs a real scanner check on a published package before you install it. This is a Pro/Team feature and requires dg login.",
+        "dg verify npm:react (or pypi:requests, with an optional @version — defaults to latest) runs a real scanner check on a published package before you install it. Signed-out runs show the verdict and top reasons; dg login unlocks full findings, license info, --json, and --output.",
         "Local paths, workspaces, tgz/zip/wheel artifacts, and lockfiles are verified offline as advisory preflight (free); proxy enforcement remains authoritative for network artifact fetches."
     ],
     handler: (context) => {
         const parsed = parseVerifyArgs(context.args);
         if ("error" in parsed) {
             return {
-                exitCode: EXIT_USAGE,
+                exitCode: EXIT_USAGE_VERDICT,
                 stdout: "",
                 stderr: `dg verify: ${parsed.error}. Usage: dg verify <spec|path|lockfile> [--verbose] [--json|--sarif] [--output <path>]\n`
             };
@@ -52,7 +52,7 @@ export const verifyCommand = {
             }
             catch (error) {
                 return {
-                    exitCode: 1,
+                    exitCode: EXIT_ANALYSIS_INCOMPLETE,
                     stdout: "",
                     stderr: `dg verify could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
                 };
@@ -147,5 +147,8 @@ function exitCodeForReport(report) {
     if (report.status === "block") {
         return 2;
     }
-    return report.status === "warn" || report.status === "error" ? 1 : 0;
+    if (report.status === "error") {
+        return EXIT_ANALYSIS_INCOMPLETE;
+    }
+    return report.status === "warn" ? 1 : 0;
 }

package/dist/config/settings.js

@@ -9,6 +9,8 @@ export const CONFIG_KEYS = Object.freeze([
     "policy.trustProjectAllowlists",
     "policy.allowForceOverride",
     "policy.scriptHardening",
+    "policy.shimFailClosed",
+    "policy.strictEgress",
     "scriptGate.mode",
     "scriptGate.observe",
     "gitHook.onWarn",
@@ -19,9 +21,7 @@ export const CONFIG_KEYS = Object.freeze([
     "cooldown.cargo.age",
     "cooldown.onUnknown",
     "cooldown.exempt",
-    "audit.upload",
-    "telemetry.enabled",
-    "webhooks.enabled"
+    "audit.upload"
 ]);
 export const DEFAULT_CONFIG = Object.freeze({
     version: 1,
@@ -35,7 +35,9 @@ export const DEFAULT_CONFIG = Object.freeze({
         mode: "block",
         trustProjectAllowlists: false,
         allowForceOverride: true,
-        scriptHardening: false
+        scriptHardening: false,
+        shimFailClosed: false,
+        strictEgress: false
     },
     scriptGate: {
         mode: "observe",
@@ -50,17 +52,11 @@ export const DEFAULT_CONFIG = Object.freeze({
         npmAge: "",
         pypiAge: "",
         cargoAge: "",
-        onUnknown: "allow",
+        onUnknown: "block",
         exempt: ""
     },
     audit: {
         upload: false
-    },
-    telemetry: {
-        enabled: false
-    },
-    webhooks: {
-        enabled: true
     }
 });
 export class ConfigError extends Error {
@@ -114,6 +110,17 @@ export function updateUserConfig(apply, env = process.env) {
         return next;
     });
 }
+// Whether repo-supplied project overrides (allowlists, cooldown exemptions,
+// warn-decisions) are trusted wholesale. A corrupt config fails closed to
+// untrusted so a hostile repo can never relax screening by breaking the config.
+export function trustsProjectOverrides(env = process.env) {
+    try {
+        return loadUserConfig(env).policy.trustProjectAllowlists;
+    }
+    catch {
+        return false;
+    }
+}
 export function getConfigValue(config, key) {
     if (key === "api.baseUrl") {
         return config.api.baseUrl;
@@ -133,6 +140,12 @@ export function getConfigValue(config, key) {
     if (key === "policy.scriptHardening") {
         return String(config.policy.scriptHardening);
     }
+    if (key === "policy.shimFailClosed") {
+        return String(config.policy.shimFailClosed);
+    }
+    if (key === "policy.strictEgress") {
+        return String(config.policy.strictEgress);
+    }
     if (key === "scriptGate.mode") {
         return config.scriptGate.mode;
     }
@@ -163,16 +176,20 @@ export function getConfigValue(config, key) {
     if (key === "cooldown.exempt") {
         return config.cooldown.exempt;
     }
-    if (key === "audit.upload") {
-        return String(config.audit.upload);
-    }
-    if (key === "telemetry.enabled") {
-        return String(config.telemetry.enabled);
-    }
-    return String(config.webhooks.enabled);
+    return String(config.audit.upload);
 }
-export function listConfig(config) {
-    return CONFIG_KEYS.map((key) => ({
+export const ADVANCED_CONFIG_KEYS = new Set([
+    "org.id",
+    "policy.scriptHardening",
+    "policy.shimFailClosed",
+    "policy.strictEgress",
+    "scriptGate.observe",
+    "cooldown.npm.age",
+    "cooldown.pypi.age",
+    "cooldown.cargo.age"
+]);
+export function listConfig(config, includeAdvanced = false) {
+    return CONFIG_KEYS.filter((key) => includeAdvanced || !ADVANCED_CONFIG_KEYS.has(key)).map((key) => ({
         key,
         value: getConfigValue(config, key)
     }));
@@ -212,6 +229,12 @@ export function setConfigValue(config, key, rawValue) {
     if (key === "policy.scriptHardening") {
         return withPolicyBoolean(config, "scriptHardening", rawValue);
     }
+    if (key === "policy.shimFailClosed") {
+        return withPolicyBoolean(config, "shimFailClosed", rawValue);
+    }
+    if (key === "policy.strictEgress") {
+        return withPolicyBoolean(config, "strictEgress", rawValue);
+    }
     if (key === "scriptGate.mode") {
         return {
             ...config,
@@ -266,26 +289,10 @@ export function setConfigValue(config, key, rawValue) {
     if (key === "cooldown.exempt") {
         return withCooldown(config, { exempt: parseCooldownExempt(rawValue) });
     }
-    if (key === "audit.upload") {
-        return {
-            ...config,
-            audit: {
-                upload: parseBoolean(rawValue, key)
-            }
-        };
-    }
-    if (key === "telemetry.enabled") {
-        return {
-            ...config,
-            telemetry: {
-                enabled: parseBoolean(rawValue, key)
-            }
-        };
-    }
     return {
         ...config,
-        webhooks: {
-            enabled: parseBoolean(rawValue, key)
+        audit: {
+            upload: parseBoolean(rawValue, key)
         }
     };
 }
@@ -309,8 +316,6 @@ function normalizeConfig(raw) {
     const gitHook = fieldObject(raw, "gitHook");
     const cooldown = fieldObject(raw, "cooldown");
     const audit = fieldObject(raw, "audit");
-    const telemetry = fieldObject(raw, "telemetry");
-    const webhooks = fieldObject(raw, "webhooks");
     const scriptHardening = fieldBoolean(policy, "policy.scriptHardening", "scriptHardening") ?? DEFAULT_CONFIG.policy.scriptHardening;
     return {
         version: 1,
@@ -324,7 +329,9 @@ function normalizeConfig(raw) {
             mode: parsePolicyMode(fieldString(policy, "policy.mode", "mode") ?? DEFAULT_CONFIG.policy.mode),
             trustProjectAllowlists: fieldBoolean(policy, "policy.trustProjectAllowlists", "trustProjectAllowlists") ?? DEFAULT_CONFIG.policy.trustProjectAllowlists,
             allowForceOverride: fieldBoolean(policy, "policy.allowForceOverride", "allowForceOverride") ?? DEFAULT_CONFIG.policy.allowForceOverride,
-            scriptHardening
+            scriptHardening,
+            shimFailClosed: fieldBoolean(policy, "policy.shimFailClosed", "shimFailClosed") ?? DEFAULT_CONFIG.policy.shimFailClosed,
+            strictEgress: fieldBoolean(policy, "policy.strictEgress", "strictEgress") ?? DEFAULT_CONFIG.policy.strictEgress
         },
         scriptGate: {
             mode: parseScriptGateMode(fieldString(scriptGate, "scriptGate.mode", "mode") ?? (scriptHardening ? "enforce" : DEFAULT_CONFIG.scriptGate.mode)),
@@ -344,12 +351,6 @@ function normalizeConfig(raw) {
         },
         audit: {
             upload: fieldBoolean(audit, "audit.upload", "upload") ?? DEFAULT_CONFIG.audit.upload
-        },
-        telemetry: {
-            enabled: fieldBoolean(telemetry, "telemetry.enabled", "enabled") ?? DEFAULT_CONFIG.telemetry.enabled
-        },
-        webhooks: {
-            enabled: fieldBoolean(webhooks, "webhooks.enabled", "enabled") ?? DEFAULT_CONFIG.webhooks.enabled
         }
     };
 }
@@ -482,7 +483,7 @@ function parseBoolean(value, field) {
     }
     throw new ConfigError(`${field} must be true or false`);
 }
-function parseUrl(value) {
+export function parseUrl(value) {
     const trimmed = value.trim();
     try {
         const url = new URL(trimmed);

package/dist/decisions/remember-prompt.js

@@ -1,7 +1,8 @@
-import { emitWebhookEvent, recordAuditEvent } from "../audit/events.js";
+import { recordAuditEvent } from "../audit/events.js";
 import { loadUserConfig } from "../config/settings.js";
 import { promptText, promptYesNo } from "../install-ui/prompt.js";
-import { appendDecisions, saveDgFile } from "../project/dgfile.js";
+import { dirname } from "node:path";
+import { appendDecisions, mutateDgFile } from "../project/dgfile.js";
 import { promptLine as ttyPromptLine, promptYesNo as ttyPromptYesNo } from "../util/tty-prompt.js";
 import { findingFingerprint, packageKey } from "./apply.js";
 const defaultSyncPrompts = {
@@ -67,7 +68,7 @@ export function persistRemembered(file, packages, options) {
         reason: options.reason,
         acceptedBy: options.acceptedBy
     }));
-    saveDgFile(appendDecisions(file, additions));
+    mutateDgFile(dirname(file.path), options.env, (current) => appendDecisions(current, additions));
     recordDecisionEvents("decision.accepted", packages.map((pkg) => `${pkg.ecosystem}:${packageKey(pkg.name, pkg.version)}`), options.reason, options.env);
 }
 export function recordDecisionEvents(type, packageNames, reason, env) {
@@ -86,12 +87,6 @@ export function recordDecisionEvents(type, packageNames, reason, env) {
             policyMode,
             createdAt: new Date().toISOString()
         };
-        try {
-            recordAuditEvent(event, env);
-            emitWebhookEvent(event, env);
-        }
-        catch {
-            // audit trail is best-effort; the decision write already succeeded
-        }
+        recordAuditEvent(event, env);
     }
 }

package/dist/export-ui/ExportDialog.js

@@ -0,0 +1,198 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useMemo, useState } from "react";
+import { Box, Text, useInput } from "ink";
+import chalk from "chalk";
+import { existsSync, readdirSync } from "node:fs";
+import { basename, join, resolve, sep } from "node:path";
+import { exportDestinations, resolveExportPath, userHomeDir, writeReportAtomic } from "../util/report-writer.js";
+export function loginRequiredToast() {
+    return `${chalk.yellow("Sign in to export:")} ${chalk.cyan.bold("dg login")} ${chalk.dim("(free account)")}`;
+}
+const PATH_DISPLAY_MAX = 48;
+function cursorBeforeExtension(name) {
+    const slash = name.lastIndexOf("/");
+    const dot = name.indexOf(".", slash + 2);
+    return dot > slash + 1 ? dot : name.length;
+}
+function fieldFor(name) {
+    return { value: name, cursor: cursorBeforeExtension(name) };
+}
+function abbreviateHome(dir, home) {
+    if (dir === home)
+        return "~";
+    if (dir.startsWith(home + sep))
+        return `~${dir.slice(home.length)}`;
+    return dir;
+}
+function truncatePath(text) {
+    if (text.length <= PATH_DISPLAY_MAX)
+        return text;
+    return `…${text.slice(text.length - PATH_DISPLAY_MAX + 1)}`;
+}
+function prefillFor(dir, cwd, home, filename) {
+    if (resolve(dir) === resolve(cwd))
+        return filename;
+    if (dir === home)
+        return `~/${filename}`;
+    if (dir.startsWith(home + sep))
+        return `~${dir.slice(home.length)}/${filename}`;
+    return join(dir, filename);
+}
+function completePath(value, cwd) {
+    const slash = value.lastIndexOf("/");
+    const dir = slash < 0 ? "" : value.slice(0, slash + 1);
+    const fragment = slash < 0 ? value : value.slice(slash + 1);
+    let entries;
+    try {
+        entries = readdirSync(resolveExportPath(dir === "" ? "." : dir, cwd), { withFileTypes: true })
+            .map((entry) => ({ name: entry.name, isDir: entry.isDirectory() }));
+    }
+    catch {
+        return value;
+    }
+    const match = entries
+        .filter((entry) => entry.name.toLowerCase().startsWith(fragment.toLowerCase()))
+        .sort((a, b) => (a.isDir === b.isDir ? a.name.localeCompare(b.name) : a.isDir ? -1 : 1))[0];
+    if (!match)
+        return value;
+    return `${dir}${match.name}${match.isDir ? "/" : ""}`;
+}
+export const ExportDialog = ({ options, theme, cwd, onDone, env = process.env }) => {
+    const multi = options.length > 1;
+    const [stage, setStage] = useState(multi ? "format" : "dest");
+    const [selected, setSelected] = useState(0);
+    const [destIndex, setDestIndex] = useState(0);
+    const [field, setField] = useState({ value: "", cursor: 0 });
+    const home = useMemo(() => userHomeDir(env), [env]);
+    const destinations = useMemo(() => exportDestinations(cwd, env), [cwd, env]);
+    const option = options[selected];
+    const filename = basename(option?.defaultName ?? "");
+    const rowCount = destinations.length + 1;
+    const writeTo = (target) => {
+        if (!option)
+            return;
+        try {
+            writeReportAtomic(target, option.render());
+            onDone({ path: target });
+        }
+        catch (error) {
+            onDone({ error: error instanceof Error ? error.message : "write failed" });
+        }
+    };
+    const openEditor = (dest) => {
+        const prefill = dest ? prefillFor(dest.dir, cwd, home, filename) : filename;
+        setField(fieldFor(prefill));
+        setStage("path");
+    };
+    const insertAtCursor = (text) => {
+        setField((f) => ({ value: f.value.slice(0, f.cursor) + text + f.value.slice(f.cursor), cursor: f.cursor + text.length }));
+    };
+    const moveCursor = (to) => {
+        setField((f) => ({ ...f, cursor: Math.max(0, Math.min(f.value.length, to(f))) }));
+    };
+    useInput((input, key) => {
+        if (stage === "format") {
+            if (key.escape || input === "q") {
+                onDone(null);
+                return;
+            }
+            if (key.return) {
+                setStage("dest");
+                return;
+            }
+            if (key.upArrow || input === "k") {
+                setSelected((s) => Math.max(0, s - 1));
+                return;
+            }
+            if (key.downArrow || input === "j") {
+                setSelected((s) => Math.min(options.length - 1, s + 1));
+                return;
+            }
+            return;
+        }
+        if (stage === "dest") {
+            if (key.escape) {
+                if (multi)
+                    setStage("format");
+                else
+                    onDone(null);
+                return;
+            }
+            if (input === "t") {
+                openEditor(destinations[destIndex]);
+                return;
+            }
+            if (key.upArrow || input === "k") {
+                setDestIndex((d) => Math.max(0, d - 1));
+                return;
+            }
+            if (key.downArrow || input === "j") {
+                setDestIndex((d) => Math.min(rowCount - 1, d + 1));
+                return;
+            }
+            if (key.return) {
+                const dest = destinations[destIndex];
+                if (dest)
+                    writeTo(join(dest.dir, filename));
+                else
+                    openEditor(destinations[destIndex - 1] ?? destinations[0]);
+            }
+            return;
+        }
+        if (key.escape) {
+            setStage("dest");
+            return;
+        }
+        if (key.return) {
+            const trimmed = field.value.trim();
+            if (trimmed.length > 0)
+                writeTo(resolveExportPath(trimmed, cwd));
+            return;
+        }
+        if (key.tab) {
+            setField((f) => fieldFor(completePath(f.value, cwd)));
+            return;
+        }
+        if (key.leftArrow) {
+            moveCursor((f) => f.cursor - 1);
+            return;
+        }
+        if (key.rightArrow) {
+            moveCursor((f) => f.cursor + 1);
+            return;
+        }
+        if (key.ctrl && input === "a") {
+            moveCursor(() => 0);
+            return;
+        }
+        if (key.ctrl && input === "e") {
+            moveCursor((f) => f.value.length);
+            return;
+        }
+        if (key.delete || key.backspace) {
+            setField((f) => (f.cursor === 0 ? f : { value: f.value.slice(0, f.cursor - 1) + f.value.slice(f.cursor), cursor: f.cursor - 1 }));
+            return;
+        }
+        if (input && !key.ctrl && !key.meta && /^[\x20-\x7e]+$/.test(input)) {
+            insertAtCursor(input);
+        }
+    });
+    const target = field.value.trim().length > 0 ? resolveExportPath(field.value, cwd) : null;
+    const targetExists = target !== null && existsSync(target);
+    const beforeCursor = field.value.slice(0, field.cursor);
+    const atCursor = field.value.charAt(field.cursor);
+    const afterCursor = field.value.slice(field.cursor + 1);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, children: [_jsx(Text, { bold: true, children: "Export" }), _jsx(Text, { children: "" }), stage === "format" && options.map((opt, idx) => {
+                        const isSelected = idx === selected;
+                        return (_jsxs(Box, { children: [_jsx(Box, { width: 5, flexShrink: 0, children: _jsxs(Text, { children: ["   ", isSelected ? chalk.cyan("●") : chalk.dim("○")] }) }), _jsx(Box, { flexShrink: 1, children: _jsx(Text, { wrap: "truncate-end", children: isSelected ? chalk.bold(opt.label) : opt.label }) })] }, opt.label));
+                    }), stage === "dest" && (_jsxs(_Fragment, { children: [destinations.map((dest, idx) => {
+                                const isSelected = idx === destIndex;
+                                const replaces = existsSync(join(dest.dir, filename));
+                                const shown = truncatePath(`${abbreviateHome(dest.dir, home)}/${filename}`.replace(/\/+/g, "/"));
+                                return (_jsxs(Box, { children: [_jsx(Box, { width: 3, flexShrink: 0, children: _jsxs(Text, { children: [" ", isSelected ? chalk.cyan("▸") : " "] }) }), _jsx(Box, { width: 14, flexShrink: 0, children: _jsx(Text, { children: isSelected ? chalk.bold(dest.label) : dest.label }) }), _jsx(Box, { flexShrink: 1, children: _jsxs(Text, { wrap: "truncate-start", children: [theme.paint("muted", shown), replaces ? theme.paint("warn", " (replaces)") : ""] }) })] }, dest.label));
+                            }), _jsxs(Box, { children: [_jsx(Box, { width: 3, flexShrink: 0, children: _jsxs(Text, { children: [" ", destIndex === destinations.length ? chalk.cyan("▸") : " "] }) }), _jsx(Box, { flexShrink: 1, children: _jsx(Text, { children: destIndex === destinations.length ? chalk.bold("Type a path…") : theme.paint("muted", "Type a path…") }) })] })] })), stage === "path" && (_jsxs(_Fragment, { children: [option && _jsx(Text, { dimColor: true, wrap: "truncate-end", children: option.label }), _jsxs(Text, { wrap: "truncate-start", children: [chalk.cyan("▌ "), chalk.bold("Save as"), "  ", beforeCursor, atCursor === "" ? chalk.cyan("█") : chalk.inverse(atCursor) + afterCursor] }), _jsx(Text, { wrap: "truncate-start", children: target === null
+                                    ? theme.paint("muted", "enter a file name")
+                                    : targetExists
+                                        ? theme.paint("warn", `${target} exists — Enter overwrites`)
+                                        : theme.paint("muted", `→ ${target}`) })] }))] }), _jsxs(Text, { children: [" ", stage === "format" ? (_jsxs(_Fragment, { children: [chalk.bold.cyan("↑↓"), " ", chalk.dim("choose"), "   ", chalk.bold.cyan("⏎"), " ", chalk.dim("next"), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("cancel")] })) : stage === "dest" ? (_jsxs(_Fragment, { children: [chalk.bold.cyan("↑↓"), " ", chalk.dim("choose"), "   ", chalk.bold.cyan("⏎"), " ", chalk.dim(`save ${filename}`), "   ", chalk.bold.cyan("t"), " ", chalk.dim("type path"), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim(multi ? "back" : "cancel")] })) : (_jsxs(_Fragment, { children: [chalk.bold.cyan("⏎"), " ", chalk.dim("save"), "   ", chalk.bold.cyan("Tab"), " ", chalk.dim("complete"), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("back")] }))] })] }));
+};

package/dist/install-ui/LiveInstall.js

@@ -2,6 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, Text } from "ink";
 import InkSpinner from "ink-spinner";
 import { formatResetDate } from "./block-render.js";
+import { sanitizeLine } from "../security/sanitize.js";
 function packageCount(n) {
     return n === 1 ? "1 package" : `${n} packages`;
 }
@@ -13,9 +14,9 @@ export const LiveInstall = ({ view }) => {
     if (view.phase === "scanning") {
         return (_jsxs(Box, { paddingX: 1, children: [_jsx(Text, { color: "cyan", children: _jsx(InkSpinner, { type: "dots" }) }), _jsxs(Text, { children: [" ", view.total === 0
                             ? "DG starting protection…"
-                            : view.resolvedTotal !== undefined
-                                ? `DG verifying ${view.total}/${Math.max(view.total, view.resolvedTotal)}…`
-                                : `DG verifying ${packageCount(view.total)}…`] }), view.current ? _jsxs(Text, { dimColor: true, children: ["  ", view.current] }) : null] }));
+                            : view.resolvedTotal !== undefined && view.total <= view.resolvedTotal
+                                ? `DG verifying ${view.total}/${view.resolvedTotal}…`
+                                : `DG verifying ${packageCount(view.total)}…`] }), view.current ? _jsxs(Text, { dimColor: true, children: ["  ", sanitizeLine(view.current)] }) : null] }));
     }
     if (view.total === 0 && !view.blocked) {
         return null;
@@ -30,7 +31,7 @@ export const LiveInstall = ({ view }) => {
     }
     const total = view.verified + view.flagged;
     if (view.flagged > 0) {
-        return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ["\u26A0  DG verified ", packageCount(total), " \u2014 ", view.flagged, " flagged"] }), (view.flaggedItems ?? []).map((item, index) => (_jsxs(Text, { dimColor: true, children: ["   ", item.packageName, "   ", item.reason] }, `${item.packageName}-${index}`)))] }));
+        return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ["\u26A0  DG verified ", packageCount(total), " \u2014 ", view.flagged, " flagged"] }), (view.flaggedItems ?? []).map((item, index) => (_jsxs(Text, { dimColor: true, children: ["   ", sanitizeLine(item.packageName), "   ", sanitizeLine(item.reason)] }, `${item.packageName}-${index}`)))] }));
     }
     return (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: "green", children: ["\u2713  DG verified ", packageCount(total), " \u2014 clean"] }) }));
 };

package/dist/install-ui/block-render.js

@@ -1,4 +1,5 @@
 import { formatCooldownDuration, formatPackageAge } from "../policy/cooldown.js";
+import { sanitizeLine } from "../security/sanitize.js";
 const VERIFIED_BAD = new Set([
     "malware",
     "policy",
@@ -32,7 +33,7 @@ const NEXT_STEP = {
     "private-upload-disabled": "Enable private artifact scanning to verify this package.",
     "needs-login": "Run 'dg login' (free) to check packages from the registry before they install.",
     "quota-exceeded": "Upgrade your plan or wait for your monthly limit to reset. See westbayberry.com/pricing.",
-    cooldown: "Wait for the cooldown, pin an older version, or exempt it: dg config set cooldown.exempt <name>"
+    cooldown: "Wait it out (see holds: dg cooldown), pin an older version, or exempt it: dg cooldown exempt <name>"
 };
 function cooldownDetailLine(cooldown) {
     const window = formatCooldownDuration(cooldown.requiredDays);
@@ -53,9 +54,9 @@ export function describeBlockedInstall(decision) {
         : "Re-check later with 'dg verify', or override if you accept the risk.";
     return {
         kind: verifiedBad ? "blocked" : "unverified",
-        packageName: decision.packageName,
+        packageName: sanitizeLine(decision.packageName),
         headline: HEADLINES[decision.cause],
-        reason: decision.reason,
+        reason: sanitizeLine(decision.reason),
         cause: decision.cause,
         ...(decision.resetsAt ? { resetsAt: decision.resetsAt } : {}),
         ...(nextStep ? { nextStep } : {}),
@@ -63,27 +64,30 @@ export function describeBlockedInstall(decision) {
     };
 }
 export function describeFlaggedWarn(decision) {
+    const packageName = sanitizeLine(decision.packageName);
     if (decision.cause === "quota-exceeded") {
-        return { packageName: decision.packageName, reason: "installed unverified (over quota)" };
+        return { packageName, reason: "installed unverified (over quota)" };
     }
     if (decision.forceOverride?.allowed) {
-        return { packageName: decision.packageName, reason: "installed despite block (--dg-force-install)" };
+        return { packageName, reason: "installed despite block (--dg-force-install)" };
     }
-    return { packageName: decision.packageName, reason: decision.reason };
+    return { packageName, reason: sanitizeLine(decision.reason) };
 }
 export function renderInstallDecision(decision) {
+    const packageName = sanitizeLine(decision.packageName);
+    const reason = sanitizeLine(decision.reason);
     if (decision.action === "pass") {
-        return `✓ DG verified ${decision.packageName} — clean\n`;
+        return `✓ DG verified ${packageName} — clean\n`;
     }
     if (decision.action === "warn") {
         if (decision.cause === "quota-exceeded") {
             const reset = formatResetDate(decision.resetsAt);
-            return `⚠ Over quota — installed ${decision.packageName} unverified${reset ? ` (resets ${reset})` : ""}\n`;
+            return `⚠ Over quota — installed ${packageName} unverified${reset ? ` (resets ${reset})` : ""}\n`;
         }
         if (decision.forceOverride?.allowed) {
-            return `⚠ DG override — installing ${decision.packageName} despite block (--dg-force-install)\n`;
+            return `⚠ DG override — installing ${packageName} despite block (--dg-force-install)\n`;
         }
-        return `⚠ DG flagged ${decision.packageName} (warn) — ${decision.reason}\n`;
+        return `⚠ DG flagged ${packageName} (warn) — ${reason}\n`;
     }
     if (decision.cause === "quota-exceeded") {
         const reset = formatResetDate(decision.resetsAt);
@@ -98,15 +102,15 @@ export function renderInstallDecision(decision) {
         verifiedBad
             ? `✘ DG blocked install — ${headline}`
             : decision.cause === "cooldown"
-                ? `? DG quarantined ${decision.packageName} — ${headline}`
-                : `? DG could not verify ${decision.packageName} — ${headline}`,
-        `  ${decision.packageName}   ${decision.reason}`
+                ? `? DG quarantined ${packageName} — ${headline}`
+                : `? DG could not verify ${packageName} — ${headline}`,
+        `  ${packageName}   ${reason}`
     ];
     if (decision.cause === "cooldown" && decision.cooldown) {
         lines.push(`  ${cooldownDetailLine(decision.cooldown)}`);
     }
     if (decision.dashboardUrl) {
-        lines.push(`  Evidence: ${decision.dashboardUrl}`);
+        lines.push(`  Evidence: ${sanitizeLine(decision.dashboardUrl)}`);
     }
     if (decision.unauthenticated && decision.cause !== "needs-login") {
         lines.push("  Auth: local policy only (run 'dg login' for full coverage)");