@westbayberry/dg 2.2.0 → 2.3.0

package/dist/proxy/metadata-map.js

@@ -1,5 +1,16 @@
 import { createHash } from "node:crypto";
 import { brotliDecompressSync, gunzipSync, inflateRawSync, inflateSync } from "node:zlib";
+// decodeURIComponent throws on malformed percent-encoding (e.g. a stray % in a
+// registry href); fall back to the raw value so one bad entry cannot throw out of
+// the whole metadata-extraction pass and drop every identity.
+function safeDecodeUriComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
 export function extractRegistryMetadataIdentities(metadataUrl, response) {
     const decoded = { headers: response.headers, body: decodeContentEncoding(response.headers, response.body) };
     // PyPI Simple index (PEP 503 HTML or PEP 691 JSON) — the pip/uv/pipx flow.
@@ -18,6 +29,9 @@ export function extractRegistryMetadataIdentities(metadataUrl, response) {
         ...extractPypiIdentities(metadataUrl, parsed)
     ];
 }
+// A MITM'd registry can return a tiny gzip/brotli body that expands to gigabytes;
+// cap the decoded size so a decompression bomb cannot exhaust proxy memory.
+const MAX_METADATA_DECODED_BYTES = 32 * 1024 * 1024;
 // Content-Encoding lists encodings in the order they were applied; decode in
 // reverse. Any unknown token or decode failure returns the body untouched so
 // the response falls back to artifact handling instead of crashing the proxy.
@@ -27,21 +41,22 @@ function decodeContentEncoding(headers, body) {
         .split(",")
         .map((token) => token.trim().toLowerCase())
         .filter((token) => token.length > 0 && token !== "identity");
+    const cap = { maxOutputLength: MAX_METADATA_DECODED_BYTES };
     let decoded = body;
     for (const encoding of encodings.reverse()) {
         try {
             if (encoding === "gzip" || encoding === "x-gzip") {
-                decoded = gunzipSync(decoded);
+                decoded = gunzipSync(decoded, cap);
             }
             else if (encoding === "br") {
-                decoded = brotliDecompressSync(decoded);
+                decoded = brotliDecompressSync(decoded, cap);
             }
             else if (encoding === "deflate") {
                 try {
-                    decoded = inflateSync(decoded);
+                    decoded = inflateSync(decoded, cap);
                 }
                 catch {
-                    decoded = inflateRawSync(decoded);
+                    decoded = inflateRawSync(decoded, cap);
                 }
             }
             else {
@@ -65,7 +80,8 @@ function decodeContentEncoding(headers, body) {
 export function isRegistryIndexRequest(url) {
     return (isPypiSimpleIndexUrl(url) ||
         /\/pypi\/[^/]+\/json\/?$/i.test(url.pathname) ||
-        /\.metadata$/i.test(url.pathname) ||
+        // PEP 658 sidecar: only `<wheel|sdist>.metadata`, not any path ending .metadata
+        /\.(whl|tar\.gz|tgz|zip)\.metadata$/i.test(url.pathname) ||
         /^\/-\//.test(url.pathname));
 }
 function isPypiSimpleIndexUrl(url) {
@@ -103,7 +119,7 @@ function extractPypiSimpleIdentities(metadataUrl, response) {
         catch {
             continue;
         }
-        const file = entry.filename ?? decodeURIComponent(absolute.pathname.split("/").filter(Boolean).at(-1) ?? "");
+        const file = entry.filename ?? safeDecodeUriComponent(absolute.pathname.split("/").filter(Boolean).at(-1) ?? "");
         const parsed = parsePypiArtifactFilename(file);
         if (!parsed) {
             continue;
@@ -239,7 +255,7 @@ function extractPypiIdentities(metadataUrl, parsed) {
 function fallbackIdentity(artifactUrl, classification) {
     const ecosystem = ecosystemForManager(classification.manager);
     const parsed = ecosystem === "pypi"
-        ? parsePypiArtifactFilename(decodeURIComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "")) ?? parsePackageVersionFromUrl(artifactUrl)
+        ? parsePypiArtifactFilename(safeDecodeUriComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "")) ?? parsePackageVersionFromUrl(artifactUrl)
         : ecosystem === "cargo"
             ? parseCargoArtifactUrl(artifactUrl) ?? parsePackageVersionFromUrl(artifactUrl)
             : parsePackageVersionFromUrl(artifactUrl);
@@ -261,11 +277,11 @@ function parseCargoArtifactUrl(artifactUrl) {
     const downloadMatch = /^\/(?:api\/v1\/)?crates\/([^/]+)\/([^/]+)\/download\/?$/.exec(artifactUrl.pathname);
     if (downloadMatch && downloadMatch[1] && downloadMatch[2]) {
         return {
-            name: decodeURIComponent(downloadMatch[1]),
-            version: decodeURIComponent(downloadMatch[2])
+            name: safeDecodeUriComponent(downloadMatch[1]),
+            version: safeDecodeUriComponent(downloadMatch[2])
         };
     }
-    const file = decodeURIComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "");
+    const file = safeDecodeUriComponent(artifactUrl.pathname.split("/").filter(Boolean).at(-1) ?? "");
     if (/\.crate$/i.test(file)) {
         const stem = file.slice(0, -".crate".length);
         const match = /^(.+)-(\d[0-9A-Za-z.+-]*)$/.exec(stem);
@@ -276,7 +292,7 @@ function parseCargoArtifactUrl(artifactUrl) {
     return null;
 }
 function parsePackageVersionFromUrl(artifactUrl) {
-    const parts = artifactUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+    const parts = artifactUrl.pathname.split("/").filter(Boolean).map((part) => safeDecodeUriComponent(part));
     const file = parts.at(-1) ?? artifactUrl.hostname;
     const npmPackage = npmPackageFromTarballPath(parts);
     const packageName = npmPackage ?? parts.at(-2) ?? file.replace(/\.(?:tgz|tar\.gz|zip|whl)$/i, "");
@@ -338,14 +354,14 @@ function parseNpmPackageSpec(spec) {
     return { name, version };
 }
 function packageNameFromNpmMetadataPath(metadataUrl) {
-    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => safeDecodeUriComponent(part));
     if (parts[0]?.startsWith("@") && parts[1]) {
         return `${parts[0]}/${parts[1]}`;
     }
     return parts[0] ?? metadataUrl.hostname;
 }
 function packageNameFromPypiMetadataPath(metadataUrl) {
-    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+    const parts = metadataUrl.pathname.split("/").filter(Boolean).map((part) => safeDecodeUriComponent(part));
     const projectIndex = parts.findIndex((part) => part.toLowerCase() === "pypi");
     return parts[projectIndex + 1] ?? parts[0] ?? metadataUrl.hostname;
 }

package/dist/proxy/server.js

@@ -7,6 +7,7 @@ import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { connect } from "node:net";
+import { lookup as dnsLookup } from "node:dns";
 import { createSecureContext, createServer as createTlsServer, connect as tlsConnect, rootCertificates } from "node:tls";
 import { createEphemeralCertificateAuthority } from "./ca.js";
 import { shouldMitmHost } from "./classify-host.js";
@@ -180,6 +181,16 @@ async function handleConnectRequest(request, clientSocket, head, options, state,
         return;
     }
     if (!shouldMitmHost(target.hostname, options.env)) {
+        if (strictEgressEnabled(options.env)) {
+            recordDecision(options, state, {
+                verdict: "block",
+                packageName: target.hostname,
+                cause: "policy",
+                reason: `strict egress: refusing to tunnel to un-screened host ${target.hostname} (add it to DG_PROXY_MITM_HOSTS to screen it, or disable policy.strictEgress)`
+            });
+            clientSocket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+            return;
+        }
         state.events = [...state.events, `tunnel:${redactSecrets(authorityFor(target))}`];
         writeProxyState(options.session, state);
         await blindTunnel(clientSocket, head, target, options, activeSockets);
@@ -210,6 +221,18 @@ const STREAMING_DISABLED = Number.POSITIVE_INFINITY;
 // or mixes TLS trust. Purely transport-level — no effect on what gets verified.
 const upstreamHttpAgent = new HttpAgent({ keepAlive: true, maxSockets: 64, scheduling: "fifo" });
 const upstreamHttpsAgent = new HttpsAgent({ keepAlive: true, maxSockets: 64, scheduling: "fifo" });
+// Opt-in (policy.strictEgress, default off): a CONNECT to a host dg doesn't MITM
+// is blind-tunnelled, so its artifacts arrive unscanned. Managed/CI environments
+// can fail those closed instead. A corrupt config reads as off so a broken config
+// never blocks installs that the default would have allowed.
+function strictEgressEnabled(env) {
+    try {
+        return loadUserConfig(env).policy.strictEgress;
+    }
+    catch {
+        return false;
+    }
+}
 function streamThresholdBytes(env) {
     const raw = env.DG_STREAM_THRESHOLD_BYTES;
     if (raw === undefined || raw === "") {
@@ -396,18 +419,95 @@ function isRedirectStatus(statusCode) {
 // only string-matches the dotted-decimal form silently lets the cloud-metadata
 // IP through as "public". Recover the embedded IPv4 (both forms) before
 // classifying so the IPv4 ranges below cover the mapped address too.
+function hextetsToIpv4(hi, lo) {
+    const h = parseInt(hi, 16);
+    const l = parseInt(lo, 16);
+    return `${(h >> 8) & 0xff}.${h & 0xff}.${(l >> 8) & 0xff}.${l & 0xff}`;
+}
+// Recover an IPv4 address embedded in an IPv6 literal so the IPv4 ranges below
+// also cover it. Covers IPv4-mapped (::ffff:), IPv4-compatible (::), 6to4
+// (2002::/16), and NAT64 (64:ff9b::/96) — each a way to smuggle 169.254.169.254
+// past a guard that only string-matches the dotted-decimal form.
 function recoverIpv4MappedHost(host) {
-    const dotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
-    if (dotted?.[1]) {
-        return dotted[1];
+    const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (mappedDotted?.[1])
+        return mappedDotted[1];
+    const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (mappedHex?.[1] && mappedHex[2])
+        return hextetsToIpv4(mappedHex[1], mappedHex[2]);
+    const compatDotted = /^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (compatDotted?.[1])
+        return compatDotted[1];
+    const compatHex = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (compatHex?.[1] && compatHex[2])
+        return hextetsToIpv4(compatHex[1], compatHex[2]);
+    const sixToFour = /^2002:([0-9a-f]{1,4}):([0-9a-f]{1,4}):/i.exec(host);
+    if (sixToFour?.[1] && sixToFour[2])
+        return hextetsToIpv4(sixToFour[1], sixToFour[2]);
+    const nat64Dotted = /^64:ff9b::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (nat64Dotted?.[1])
+        return nat64Dotted[1];
+    const nat64Hex = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (nat64Hex?.[1] && nat64Hex[2])
+        return hextetsToIpv4(nat64Hex[1], nat64Hex[2]);
+    return host;
+}
+// Block a RESOLVED address (the actual connect target), so a public hostname
+// whose A/AAAA record points at an internal/metadata IP — DNS-rebinding SSRF —
+// is refused at connect time, not just literal-IP targets.
+export function isBlockedResolvedIp(ip) {
+    const host = recoverIpv4MappedHost(ip.toLowerCase().replace(/^\[/, "").replace(/\]$/, ""));
+    if (host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
     }
-    const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
-    if (hex?.[1] && hex?.[2]) {
-        const hi = parseInt(hex[1], 16);
-        const lo = parseInt(hex[2], 16);
-        return `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    if (isPrivateIpv4(host)) {
+        return true;
     }
-    return host;
+    return /^(fe80|f[cd][0-9a-f]{2}):/.test(host);
+}
+function guardedLookup(hostname, options, callback) {
+    const opts = typeof options === "object" && options !== null ? options : {};
+    dnsLookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, "", 0);
+            return;
+        }
+        const list = addresses;
+        const blocked = list.find((entry) => isBlockedResolvedIp(entry.address));
+        if (blocked) {
+            callback(new Error(`refusing to connect to ${hostname}: resolves to blocked address ${blocked.address}`), "", 0);
+            return;
+        }
+        if (opts.all === true) {
+            callback(null, list);
+            return;
+        }
+        const first = list[0];
+        if (!first) {
+            callback(new Error(`no address found for ${hostname}`), "", 0);
+            return;
+        }
+        callback(null, first.address, first.family);
+    });
+}
+// The resolved-IP guard exists for DNS rebinding — a PUBLIC hostname whose A/AAAA
+// record points at an internal IP. It must not fire for: an explicitly-configured
+// private registry (DG_PRIVATE_REGISTRY_HOSTS) whose name legitimately resolves to
+// a private IP; a test host-map target; or a target that is ALREADY a private/
+// loopback literal (the user/test pointed there directly — not rebinding, and the
+// link-local/metadata literal is still blocked at the artifact path).
+function lookupForTarget(target, env) {
+    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    if (hostMatchesList(target.hostname, env.DG_PRIVATE_REGISTRY_HOSTS ?? "")) {
+        return undefined;
+    }
+    if (testUpstreamHostMap(env).has(host)) {
+        return undefined;
+    }
+    if (isPrivateNetworkHost(target)) {
+        return undefined;
+    }
+    return guardedLookup;
 }
 function isPrivateIpv4(host) {
     return (/^(127|10|0)\./.test(host) ||
@@ -598,7 +698,7 @@ async function blindTunnel(clientSocket, head, target, options, activeSockets) {
     const upstreamProxy = selectUpstreamProxy(target, options.env);
     const upstreamSocket = upstreamProxy
         ? await connectViaUpstreamProxy(target, upstreamProxy)
-        : await connectDirect(target);
+        : await connectDirect(target, options.env);
     trackSocket(activeSockets, upstreamSocket);
     clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     if (head.length > 0) {
@@ -673,9 +773,9 @@ function parseConnectTarget(authority) {
         return null;
     }
 }
-function connectDirect(target) {
+function connectDirect(target, env = process.env) {
     return new Promise((resolve, reject) => {
-        const socket = connect(Number(target.port || "443"), upstreamHostname(target));
+        const socket = connect({ port: Number(target.port || "443"), host: upstreamHostname(target, env), lookup: lookupForTarget(target, env) });
         socket.once("connect", () => resolve(socket));
         socket.once("error", reject);
     });
@@ -720,6 +820,7 @@ function fetchUpstream(request, target, env) {
             path: `${target.pathname}${target.search}`,
             method: request.method,
             agent: upstreamHttpAgent,
+            lookup: lookupForTarget(target, env),
             headers: stripProxyHopHeaders(request.headers)
         }, (upstreamResponse) => {
             collectBounded(upstreamResponse, { label: target.toString() })
@@ -783,6 +884,7 @@ function fetchHttpsDirect(request, target, env) {
             path: `${target.pathname}${target.search}`,
             method: request.method,
             agent: upstreamHttpsAgent,
+            lookup: lookupForTarget(target, env),
             headers: upstreamRequestHeaders(request, target),
             ...upstreamTlsOptions(env)
         }, (upstreamResponse) => {
@@ -915,8 +1017,14 @@ function headerLines(key, value) {
     }
     return [`${key}: ${value}`];
 }
-function upstreamTlsOptions(env) {
-    const caPath = env.DG_UPSTREAM_CA_CERT ?? env.NODE_EXTRA_CA_CERTS;
+export function upstreamTlsOptions(env) {
+    // Trust an extra upstream CA only from DG_UPSTREAM_CA_CERT — an explicit,
+    // dg-specific knob for corporate TLS-intercepting proxies / private mirrors.
+    // The ambient NODE_EXTRA_CA_CERTS is deliberately NOT honored here: dg's own
+    // agent routing sets that variable to dg's MITM CA for the CLIENT side, so
+    // re-consuming it as an UPSTREAM trust anchor would let any process that can
+    // set it MITM the real registry through dg's proxy.
+    const caPath = env.DG_UPSTREAM_CA_CERT;
     if (!caPath) {
         return {};
     }
@@ -1100,6 +1208,14 @@ function preverifiedVerdict(options, target, streamedSha256, identity) {
     if (!entry.cooldownEvaluated && resolveCooldownRequest(options, identity) !== undefined) {
         return null;
     }
+    if (!entry.scannedSha256) {
+        // No byte-level fingerprint to cross-check against the streamed artifact, so
+        // a preverified pass/warn can't prove the downloaded bytes match what was
+        // screened (a metadata-only preflight, or a registry swap between preflight
+        // and fetch). Fall through to a real scan of the streamed bytes — TOCTOU
+        // defense — rather than honoring the verdict for whatever now arrives.
+        return null;
+    }
     return normalizeVerdict({
         verdict: entry.action,
         cause: entry.action,

package/dist/runtime/first-run.js

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { dgVersion } from "../commands/version.js";
 import { isCiEnv } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
-import { sweepLegacyPythonHooks } from "../setup/plan.js";
+import { refreshSetupOnUpgrade, sweepLegacyPythonHooks } from "../setup/plan.js";
 import { resolveDgPaths } from "../state/index.js";
 const SKIP_COMMANDS = new Set([
     "help",
@@ -42,6 +42,7 @@ export function sweepLegacyHooksOnVersionChange(env = process.env, version = dgV
             return false;
         }
         sweepLegacyPythonHooks(resolveDgPaths(env).homeDir, [], []);
+        refreshSetupOnUpgrade(env);
         mkdirSync(dirname(marker), { recursive: true, mode: 0o700 });
         writeFileSync(marker, `${version}\n`, { encoding: "utf8", mode: 0o600 });
         return true;

package/dist/sbom-ui/inventory.js

@@ -95,7 +95,11 @@ export function emptyFilterMessage(filter, query, phase, tally, scanError) {
     return "no components";
 }
 function csvCell(value) {
-    return /[",\n\r]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
+    // Neutralize spreadsheet formula injection: a cell starting with = + - @ (or
+    // tab/CR) is interpreted as a formula by Excel/Sheets, letting an attacker-named
+    // dependency run on open. Prefix a sentinel apostrophe so it is treated as text.
+    const guarded = /^[=+\-@\t\r]/.test(value) ? `'${value}` : value;
+    return /[",\n\r]/.test(guarded) ? `"${guarded.replace(/"/g, '""')}"` : guarded;
 }
 export function componentsCsv(rows) {
     const lines = ["name,version,ecosystem,license,verdict"];

package/dist/scan/staged.js

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createTheme } from "../presentation/theme.js";
 import { resolvePresentation } from "../presentation/mode.js";
-import { loadUserConfig } from "../config/settings.js";
+import { DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
 import { offerRememberSync } from "../decisions/remember-prompt.js";
 import { packageKey } from "../decisions/apply.js";
 import { loadDgFile, resolveAcceptedBy, warnUnreadableDgFile } from "../project/dgfile.js";
@@ -78,9 +78,10 @@ export function runStagedScan(options) {
     if (!root) {
         return notARepoResult();
     }
+    const onIncomplete = gitHookOnIncomplete(env);
     const lockfiles = stagedLockfilePaths(cwd, env);
     if (lockfiles === null) {
-        return failOpen(theme, "could not read staged changes");
+        return failOpen(theme, "could not read staged changes", onIncomplete);
     }
     const scoped = scopeStagedPaths(lockfiles, root, cwd, options.targetPath ?? null);
     if (scoped === null) {
@@ -97,11 +98,11 @@ export function runStagedScan(options) {
     const { dir, count } = materializeStaged(scoped, cwd, env);
     try {
         if (count === 0) {
-            return failOpen(theme, "could not read the staged lockfile contents");
+            return failOpen(theme, "could not read the staged lockfile contents", onIncomplete);
         }
         const report = tryScannerScan(dir, emptyLocalReport(dir), env, usableDgFile);
         if (!report || !report.scanner) {
-            return failOpen(theme, "could not reach the scanner");
+            return failOpen(theme, "could not reach the scanner", onIncomplete);
         }
         return decideStagedVerdict(report, env, options.hook, usableDgFile ? { root, file: usableDgFile } : undefined);
     }
@@ -168,7 +169,7 @@ export function decideStagedVerdict(report, env = process.env, hook = false, dec
         return { exitCode: 2, stdout: "", stderr: renderBlock(report.findings, theme) };
     }
     if (action === "error" || action === "unknown") {
-        return scannerUnavailable(theme);
+        return scannerUnavailable(theme, config.gitHook.onIncomplete);
     }
     if (action === "warn") {
         if (acknowledgedCount > 0 && effective === "pass") {
@@ -279,14 +280,36 @@ function incompleteNotice(theme, blocked) {
     }
     return `${head} ${theme.paint("muted", "— proceeding")}\n`;
 }
-function failOpen(theme, reason) {
+function gitHookOnIncomplete(env) {
+    try {
+        return loadUserConfig(env).gitHook.onIncomplete;
+    }
+    catch {
+        return DEFAULT_CONFIG.gitHook.onIncomplete;
+    }
+}
+function failOpen(theme, reason, onIncomplete) {
+    if (onIncomplete === "block") {
+        return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify (${reason}) — commit blocked (gitHook.onIncomplete=block). Use`)} ${theme.paint("accent", "git commit --no-verify")} ${theme.paint("muted", "to override.")}\n`
+        };
+    }
     return {
         exitCode: 0,
         stdout: "",
-        stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify (${reason}) — commit allowed`)}\n`
+        stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify (${reason}) — commit allowed (gitHook.onIncomplete=allow)`)}\n`
     };
 }
-function scannerUnavailable(theme) {
+function scannerUnavailable(theme, onIncomplete) {
+    if (onIncomplete === "block") {
+        return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `  ${theme.paint("unknown", "?")} ${theme.paint("muted", "dg: scanner unavailable — staged changes not verified; commit blocked (gitHook.onIncomplete=block). Use")} ${theme.paint("accent", "git commit --no-verify")} ${theme.paint("muted", "to override.")}\n`
+        };
+    }
     return {
         exitCode: 0,
         stdout: "",

package/dist/scan-ui/hooks/useScan.js

@@ -160,7 +160,10 @@ async function scanProjects(projects, dispatch, signal) {
         const firstFailure = outcomes.find((outcome) => "error" in outcome);
         if (responses.length > 0) {
             const merged = mergeAnalyzeResponses(responses);
-            const base = firstFailure && merged.action === "pass" ? { ...merged, action: "analysis_incomplete" } : merged;
+            // A failed ecosystem means its verdict is unknown; escalate anything short of
+            // a confirmed block to analysis_incomplete so a warn from the succeeded
+            // ecosystem does not present as the whole verdict while the other is unscanned.
+            const base = firstFailure && merged.action !== "block" ? { ...merged, action: "analysis_incomplete" } : merged;
             const ecoByKey = new Map();
             for (const [ecosystem, packages] of entries) {
                 for (const pkg of packages) {

package/dist/security/sanitize.js

@@ -1,10 +1,15 @@
 import { stripVTControlCharacters } from "node:util";
+const CTRL_KEEP_NEWLINE = /[\x00-\x08\x0B-\x1F\x7F-\x9F]/g;
+const CTRL_ALL = /[\x00-\x1F\x7F-\x9F]/g;
 export function sanitize(s) {
-    return stripVTControlCharacters(s);
+    return stripVTControlCharacters(s).replace(CTRL_KEEP_NEWLINE, "");
+}
+export function sanitizeLine(s) {
+    return stripVTControlCharacters(s).replace(/[\r\n]+/g, " ").replace(CTRL_ALL, "");
 }
 export function sanitizeDeep(value) {
     if (typeof value === "string") {
-        return stripVTControlCharacters(value);
+        return sanitize(value);
     }
     if (value === null || value === undefined) {
         return value;
@@ -16,8 +21,7 @@ export function sanitizeDeep(value) {
         const src = value;
         const out = {};
         for (const k of Object.keys(src)) {
-            const cleanKey = stripVTControlCharacters(k);
-            out[cleanKey] = sanitizeDeep(src[k]);
+            out[sanitizeLine(k)] = sanitizeDeep(src[k]);
         }
         return out;
     }

package/dist/service/state.js

@@ -466,7 +466,7 @@ function trustStoreOperation(operation) {
         throw error;
     }
 }
-function withServiceLock(paths, run) {
+export function withServiceLock(paths, run) {
     const lock = acquireLockSync(paths.paths, SERVICE_LOCK, {
         staleMs: SERVICE_LOCK_STALE_MS
     });

package/dist/service/trust-store.js

@@ -1,8 +1,9 @@
 import { X509Certificate } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { writeJsonAtomic } from "../util/json-file.js";
 export class TrustStoreError extends Error {
     constructor(message) {
         super(message);
@@ -191,14 +192,9 @@ export function readCertificateFingerprints(path) {
     return readCertificateInfo(path);
 }
 export function writeServiceTrustRecord(path, record) {
-    mkdirSync(dirname(path), {
-        recursive: true,
-        mode: 0o700
-    });
-    writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600
-    });
+    // Atomic write so a torn write can't drop the trustInstalled state while the OS
+    // still trusts the CA.
+    writeJsonAtomic(path, record, { fileMode: 0o600, dirMode: 0o700 });
 }
 function readCertificateInfo(path) {
     try {

package/dist/service/worker.js

@@ -1,7 +1,7 @@
 import { createServer } from "node:http";
 import { readFileSync, rmSync, writeFileSync } from "node:fs";
 import { startProductionHttpProxy } from "../proxy/server.js";
-import { resolveServicePaths, TRUST_SENTINEL } from "./state.js";
+import { resolveServicePaths, TRUST_SENTINEL, withServiceLock } from "./state.js";
 import { refreshServiceTrustAfterCaRotation } from "./trust-refresh.js";
 const sessionPath = process.argv[2];
 const apiBaseUrl = process.argv[3];
@@ -57,13 +57,13 @@ proxy = await startProductionHttpProxy({
     apiBaseUrl: requiredApiBaseUrl,
     classification,
     env: process.env,
-    onCaRotate: () => refreshServiceTrustAfterCaRotation({
+    onCaRotate: () => withServiceLock(servicePaths, () => refreshServiceTrustAfterCaRotation({
         serviceDir: servicePaths.serviceDir,
         trustRecordPath: servicePaths.trustRecordPath,
         sentinel: TRUST_SENTINEL,
         caPath: session.files.ca,
         env: process.env
-    })
+    }))
 });
 healthServer = await startHealthServer(proxy.port);
 const healthAddress = healthServer.address();