@westbayberry/dg 2.2.0 → 2.3.1

package/dist/launcher/classify.js

@@ -9,13 +9,24 @@ const pipxProtected = new Set(["install", "upgrade", "inject", "run"]);
 const uvProtected = new Set(["add", "sync"]);
 const cargoProtected = new Set(["add", "install", "fetch", "update", "build", "test", "check", "run"]);
 const passthrough = new Set(["help", "--help", "-h", "version", "--version", "-v", "list", "ls", "show", "freeze"]);
+// pip3, pip3.12, python3, python3.11 are the canonical install commands on
+// macOS/Homebrew and many Linux distros (see BINARY_FALLBACKS in
+// resolve-real-binary.ts). The classifier keys on the base name, so a
+// version-suffixed spelling must normalize back to pip/python or it falls
+// through to a silent allow. `pipx`/`pipenv` are left untouched — only a bare
+// numeric/dotted version suffix is stripped.
+export function normalizeManagerName(name) {
+    const m = /^(pip|python)(\d+(?:\.\d+)*)?$/.exec(name);
+    return m && m[1] ? m[1] : name;
+}
 export function packageManagerNames() {
     return [...supportedManagers, ...gatedManagers];
 }
 export function isSupportedPackageManager(manager) {
     return supportedManagers.includes(manager);
 }
-export function classifyPackageManagerInvocation(manager, args) {
+export function classifyPackageManagerInvocation(rawManager, args) {
+    const manager = normalizeManagerName(rawManager);
     if (!isSupportedPackageManager(manager)) {
         return unsupportedClassification(manager, args);
     }
@@ -29,6 +40,13 @@ export function classifyPackageManagerInvocation(manager, args) {
         return classifyByCommand(manager, args, "pnpm", pnpmProtected, "pnpm install/fetch command", "javascript");
     }
     if (manager === "yarn") {
+        // A bare `yarn` (no sub-command) runs `yarn install`, fetching every lockfile
+        // dependency; classify it protected rather than passthrough. Read-only
+        // version/help invocations stay passthrough.
+        const readOnlyFlag = args.some((a) => a === "--version" || a === "-v" || a === "--help" || a === "-h");
+        if (firstCommand(args) === "" && !readOnlyFlag) {
+            return protectedClassification("yarn", args, "yarn", "bare yarn installs all lockfile dependencies");
+        }
         return classifyByCommand(manager, args, "yarn", yarnProtected, "Yarn classic install/fetch command", "javascript");
     }
     if (manager === "pip") {
@@ -73,6 +91,11 @@ function classifyUv(args) {
     if (action === "tool" && ["run", "install", "upgrade"].includes(args[1] ?? "")) {
         return protectedClassification("uv", args, "uv", "uv tool run/install/upgrade fetches package artifacts");
     }
+    if (action === "run" && uvRunFetchesPackage(args)) {
+        // `uv run --with <pkg> …` fetches <pkg> from PyPI and runs it: a real
+        // fetch-and-execute path that the bare `run` verb otherwise waves through.
+        return protectedClassification("uv", args, "uv", "uv run --with fetches and runs a package");
+    }
     if (uvProtected.has(action) || containsFetchSpec(args)) {
         return protectedClassification("uv", args, "uv", "uv install/fetch command");
     }
@@ -122,6 +145,9 @@ function initFetchesPackage(action, args, protectedCommands) {
     const commandIndex = args.findIndex((arg) => !arg.startsWith("-"));
     return args.slice(commandIndex + 1).some((arg) => arg !== "--" && !arg.startsWith("-"));
 }
+export function uvRunFetchesPackage(args) {
+    return args.some((a) => a === "--with" || a === "--with-editable" || a === "--with-requirements" || a.startsWith("--with="));
+}
 function containsFetchSpec(args) {
     return args.some((arg) => /^https?:\/\//.test(arg) || /^git\+https?:\/\//.test(arg) || /\.t(ar\.)?gz(?:$|[#?])/.test(arg));
 }

package/dist/launcher/env.js

@@ -13,18 +13,50 @@ function clientReadTimeoutSeconds(env) {
     const verdictSeconds = Number.isFinite(verdictMs) && verdictMs > 0 ? verdictMs / 1000 : 240;
     return Math.ceil(verdictSeconds + 60);
 }
+// The wrapped package manager and every lifecycle/postinstall script it runs are
+// untrusted. The dg account credential must never reach them; only the trusted
+// proxy worker (which makes the authenticated API calls) keeps it. Applied on
+// EVERY spawn path, not just the proxy one.
+export function scrubChildSecrets(env) {
+    delete env.DG_API_KEY;
+    delete env.DG_API_TOKEN;
+    return env;
+}
+// The union of proxy-routing vars for an AGENT environment. Unlike a single
+// wrapped install, an agent runs arbitrary package managers, so every manager's
+// proxy + CA var is set at once (npm/node, pip, uv, cargo), plus DG_PROXY_ACTIVE
+// so the install-hook pre-screen defers statically-undecidable commands to the
+// proxy. Every value is a literal (the proxy URL, the CA path) — no shell
+// expansion — so it is safe to drop into an agent's settings `env` block.
+export function buildAgentRoutingEnv(proxyUrl, caPath) {
+    const authToken = readProxyAuthToken(dirname(caPath));
+    const url = authToken ? proxyUrlWithAuth(proxyUrl, authToken) : proxyUrl;
+    const noProxy = "127.0.0.1,localhost";
+    return {
+        DG_PROXY_ACTIVE: "1",
+        NO_PROXY: noProxy,
+        no_proxy: noProxy,
+        HTTP_PROXY: url,
+        HTTPS_PROXY: url,
+        http_proxy: url,
+        https_proxy: url,
+        ALL_PROXY: url,
+        npm_config_proxy: url,
+        npm_config_https_proxy: url,
+        NODE_EXTRA_CA_CERTS: caPath,
+        REQUESTS_CA_BUNDLE: caPath,
+        PIP_CERT: caPath,
+        SSL_CERT_FILE: caPath,
+        CARGO_HTTP_CAINFO: caPath,
+    };
+}
 export function buildProxyChildEnv(options) {
     const authToken = readProxyAuthToken(dirname(options.caBundlePath));
     const proxyUrl = authToken ? proxyUrlWithAuth(options.proxyUrl, authToken) : options.proxyUrl;
-    const env = {
+    const env = scrubChildSecrets({
         ...options.baseEnv,
         DG_PROXY_ACTIVE: "1"
-    };
-    // The wrapped package manager and every lifecycle/postinstall script it runs
-    // are untrusted. The dg account credential must never reach them; only the
-    // trusted proxy worker (which makes the authenticated API calls) keeps it.
-    delete env.DG_API_KEY;
-    delete env.DG_API_TOKEN;
+    });
     // dg fully controls NO_PROXY (loopback only). An inherited NO_PROXY that names
     // the registry (or a `*`/`.org` glob) would route the manager straight past the
     // firewall, so the inherited value is dropped, not merged.

package/dist/launcher/install-preflight.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 import { analyzePackages } from "../api/analyze.js";
-import { loadUserConfig } from "../config/settings.js";
+import { DEFAULT_CONFIG, loadUserConfig, trustsProjectOverrides } from "../config/settings.js";
+import { honoredOverrides } from "../project/override-trust.js";
 import { matchDecision, packageKey } from "../decisions/apply.js";
 import { offerRememberOnIo } from "../decisions/remember-prompt.js";
 import { provenanceDowngradeLine } from "../presentation/provenance.js";
@@ -11,14 +12,17 @@ import { findProjectRoot, loadDgFile, resolveAcceptedBy, warnUnreadableDgFile }
 import { parsePipReportInstallCount, parsePipReportInstallSet } from "./pip-report.js";
 import { resolveSpawnInvocation } from "./spawn-invocation.js";
 export function resolvePreflightCooldown(env, ecosystem) {
+    // A corrupt user config must not silently disable the cooldown gate; fall back
+    // to defaults so any env-configured cooldown is still applied.
+    let config;
     try {
-        const config = loadUserConfig(env);
-        const param = cooldownRequestParam(config, env, ecosystem, "");
-        return param ? { param, exempt: config.cooldown.exempt, ecosystem } : undefined;
+        config = loadUserConfig(env);
     }
     catch {
-        return undefined;
+        config = DEFAULT_CONFIG;
     }
+    const param = cooldownRequestParam(config, env, ecosystem, "");
+    return param ? { param, exempt: config.cooldown.exempt, ecosystem } : undefined;
 }
 function isQuarantined(pkg, context, dgExemptions = []) {
     if (!context || !pkg.cooldown) {
@@ -41,7 +45,12 @@ export function resolvePreflightDecisions(ecosystem, cwd, env = process.env) {
     if (!file.readable) {
         return null;
     }
-    return { root, file, ecosystem, env };
+    const honored = honoredOverrides(file, root, env, trustsProjectOverrides(env));
+    if (honored.droppedExemptions > 0 || honored.droppedDecisions > 0) {
+        process.stderr.write(`dg: ignoring ${honored.droppedExemptions} cooldown exemption(s) and ${honored.droppedDecisions} decision(s) in ${file.path} not authored on this machine — re-add with 'dg cooldown add' / 'dg decisions', or 'dg config set policy.trustProjectAllowlists true' to trust this repo\n`);
+    }
+    const gatedFile = { ...file, cooldownExemptions: honored.exemptions, decisions: honored.decisions };
+    return { root, file: gatedFile, ecosystem, env };
 }
 const PROCEED = { proceed: true };
 const UNRESOLVED = { set: undefined, count: undefined };

package/dist/launcher/live-install.js

@@ -1,6 +1,6 @@
 import { createLaunchPlan, prepareProxyWorker, runWithProductionProxyLive, EXIT_INSTALL_BLOCKED } from "./run.js";
 import { runInstallPreflight } from "./install-preflight.js";
-import { isSupportedPackageManager } from "./classify.js";
+import { isSupportedPackageManager, normalizeManagerName } from "./classify.js";
 import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
 import { startPrepSpinner } from "../install-ui/prep-spinner.js";
 const FALL_THROUGH = { handled: false };
@@ -9,8 +9,9 @@ export async function maybeRunLiveInstall(args, options = {}) {
     if (!process.stdout.isTTY || isCiEnv(env) || resolvePresentation().mode !== "rich") {
         return FALL_THROUGH;
     }
-    const [manager, ...rest] = args;
-    if (!manager || !isSupportedPackageManager(manager)) {
+    const [rawManager, ...rest] = args;
+    const manager = normalizeManagerName(rawManager ?? "");
+    if (!rawManager || !isSupportedPackageManager(manager)) {
         return FALL_THROUGH;
     }
     const { childArgs, forceOverride } = stripControlArgs(rest);

package/dist/launcher/manifest-screen.js

@@ -0,0 +1,171 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+// A bare `npm install` resolves the whole dependency tree, but enumerating every
+// transitive package in the hook would blow its time budget — that breadth is
+// the runtime network gate's job. The static hook screens the DIRECT
+// dependencies declared in the manifest, which is where a cloned hostile repo
+// plants a malicious package, and caps the count so a giant manifest defers
+// instead of silently passing.
+const MAX_MANIFEST_SPECS = 100;
+const MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
+function readBoundedFile(path) {
+    try {
+        if (statSync(path).size > MAX_MANIFEST_BYTES) {
+            return null;
+        }
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null ? value : {};
+}
+// package-lock v2/v3 keys direct deps as "node_modules/<name>"; v1 nests them
+// under `dependencies`. Either way, pinning to the lock means the version we
+// screen is the version that installs.
+function lockfileVersions(cwd) {
+    const out = new Map();
+    for (const file of ["package-lock.json", "npm-shrinkwrap.json"]) {
+        const raw = readBoundedFile(join(cwd, file));
+        if (!raw) {
+            continue;
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            const packages = asRecord(parsed.packages);
+            for (const [key, meta] of Object.entries(packages)) {
+                if (key.startsWith("node_modules/")) {
+                    const version = asRecord(meta).version;
+                    if (typeof version === "string") {
+                        out.set(key.slice("node_modules/".length), version);
+                    }
+                }
+            }
+            const deps = asRecord(parsed.dependencies);
+            for (const [name, meta] of Object.entries(deps)) {
+                const version = asRecord(meta).version;
+                if (typeof version === "string" && !out.has(name)) {
+                    out.set(name, version);
+                }
+            }
+        }
+        catch {
+            // Unparsable lockfile: fall back to range resolution, don't crash.
+        }
+        if (out.size > 0) {
+            break;
+        }
+    }
+    return out;
+}
+export function readNpmManifestSpecs(cwd) {
+    const raw = readBoundedFile(join(cwd, "package.json"));
+    if (!raw) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const names = [];
+    const seen = new Set();
+    for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+        for (const name of Object.keys(asRecord(parsed[field]))) {
+            if (!seen.has(name)) {
+                seen.add(name);
+                names.push(name);
+            }
+        }
+    }
+    if (names.length === 0) {
+        return null;
+    }
+    const truncated = names.length > MAX_MANIFEST_SPECS;
+    const locks = lockfileVersions(cwd);
+    const specs = names.slice(0, MAX_MANIFEST_SPECS).map((name) => ({ name, version: locks.get(name) ?? null }));
+    return { specs, truncated };
+}
+function parseRequirementLine(line) {
+    const stripped = line.split(/(?<!\\)#/)[0]?.trim() ?? "";
+    if (stripped.length === 0 || stripped.startsWith("-")) {
+        return null;
+    }
+    // Drop environment markers (`; python_version < "3.9"`) and inline options.
+    const core = (stripped.split(";")[0] ?? "").trim();
+    if (core.length === 0 || core.includes("://") || core.startsWith("git+")) {
+        return null;
+    }
+    const exact = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?==([^,;\s]+)$/.exec(core);
+    if (exact && exact[1] && exact[2]) {
+        return { name: exact[1], version: exact[2] };
+    }
+    const ranged = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?\s*(?:===|>=|<=|~=|!=|<|>|$)/.exec(core);
+    if (ranged && ranged[1]) {
+        return { name: ranged[1], version: null };
+    }
+    return null;
+}
+export function readPipRequirementSpecs(args, cwd) {
+    const files = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === undefined) {
+            continue;
+        }
+        if (a === "-r" || a === "--requirement") {
+            const v = args[i + 1];
+            i += 1;
+            if (v !== undefined) {
+                files.push(v);
+            }
+        }
+        else if (a.startsWith("--requirement=")) {
+            files.push(a.slice("--requirement=".length));
+        }
+        else if (a.startsWith("-r=")) {
+            files.push(a.slice("-r=".length));
+        }
+    }
+    if (files.length === 0) {
+        return null;
+    }
+    const specs = [];
+    const seen = new Set();
+    let truncated = false;
+    for (const file of files) {
+        const path = isAbsolute(file) ? file : join(cwd, file);
+        if (!existsSync(path)) {
+            // A missing requirements file means the install will fail anyway — nothing
+            // to screen, and no reason to nag the user. Leave it alone.
+            continue;
+        }
+        const raw = readBoundedFile(path);
+        if (!raw) {
+            // The file exists but we could not read it (oversized / permissions) — that
+            // is a real unscreened install, so defer rather than pass it clean.
+            truncated = true;
+            continue;
+        }
+        for (const line of raw.split(/\r?\n/)) {
+            const spec = parseRequirementLine(line);
+            if (!spec || seen.has(spec.name)) {
+                continue;
+            }
+            if (specs.length >= MAX_MANIFEST_SPECS) {
+                truncated = true;
+                break;
+            }
+            seen.add(spec.name);
+            specs.push(spec);
+        }
+    }
+    if (specs.length === 0) {
+        return truncated ? { specs, truncated } : null;
+    }
+    return { specs, truncated };
+}

package/dist/launcher/output-redaction.js

@@ -7,7 +7,10 @@ const npmrcAuthPattern = /(_authToken|_auth|_password)\s*=\s*("[^"]*"|[^\s;,]+)/
 const jsonSecretPattern = /("[A-Za-z0-9_.$-]*(?:secret[_-]key|access[_-]key|api[_-]key|token|password|secret)"\s*:\s*)"(?:[^"\\]|\\.)*"/gi;
 const bearerPattern = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/g;
 // Bare tokens (not in URL userinfo or KEY=value form), by their published shape.
-const knownTokenShapePattern = /\b(npm_[A-Za-z0-9]{36}|gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255}|pypi-[A-Za-z0-9_-]{20,}|glpat-[A-Za-z0-9_-]{20,}|hf_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|sk_(?:live|test)_[A-Za-z0-9]{20,}|rk_live_[A-Za-z0-9]{20,}|sk-(?:proj-)?[A-Za-z0-9_-]{20,}|xox[abdeprs]-[A-Za-z0-9-]{10,})\b/g;
+// Alnum-only look-around instead of \b so a fixed-length token immediately
+// adjacent to an underscore-word (e.g. npm_<36>_ci) is still redacted — \b fails
+// there because the boundary would fall between two word characters.
+const knownTokenShapePattern = /(?<![A-Za-z0-9])(npm_[A-Za-z0-9]{36}|gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255}|pypi-[A-Za-z0-9_-]{20,}|glpat-[A-Za-z0-9_-]{20,}|hf_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|sk_(?:live|test)_[A-Za-z0-9]{20,}|rk_live_[A-Za-z0-9]{20,}|sk-(?:proj-)?[A-Za-z0-9_-]{20,}|xox[abdeprs]-[A-Za-z0-9-]{10,})(?![A-Za-z0-9])/g;
 export function redactSecrets(text) {
     return text
         .replace(credentialUrlPattern, "$1<redacted>@")

package/dist/launcher/preflight-prompt.js

@@ -7,7 +7,7 @@ import { defaultPromptIo } from "../install-ui/prompt.js";
 import { normalizePypiName } from "../policy/pypi-name.js";
 import { resolveAcceptedBy } from "../project/dgfile.js";
 import { enforceProtectedInstall } from "../proxy/enforcement.js";
-import { classifyPackageManagerInvocation, isSupportedPackageManager } from "./classify.js";
+import { classifyPackageManagerInvocation, isSupportedPackageManager, normalizeManagerName } from "./classify.js";
 import { actionRank, promptPreflightYesNo, recordPreflightApprovals, renderCoveredWarns, renderProvenanceDowngrades, resolvePreflightDecisions } from "./install-preflight.js";
 import { redactSecrets } from "./output-redaction.js";
 import { startPrepSpinner } from "../install-ui/prep-spinner.js";
@@ -26,8 +26,9 @@ export async function maybePreflightInstallPrompt(args, options = {}) {
     if (!io.isTTY || isCiEnv(env)) {
         return FALL_THROUGH;
     }
-    const [manager, ...rest] = args;
-    if (!manager || !isSupportedPackageManager(manager)) {
+    const [rawManager, ...rest] = args;
+    const manager = normalizeManagerName(rawManager ?? "");
+    if (!rawManager || !isSupportedPackageManager(manager)) {
         return FALL_THROUGH;
     }
     const ecosystem = ECOSYSTEM_BY_MANAGER[manager];

package/dist/launcher/run.js

@@ -3,8 +3,9 @@ import { existsSync, writeFileSync } from "node:fs";
 import { constants as osConstants } from "node:os";
 import { fileURLToPath } from "node:url";
 import { EXIT_UNAVAILABLE } from "../commands/types.js";
-import { loadUserConfig } from "../config/settings.js";
+import { loadUserConfig, trustsProjectOverrides } from "../config/settings.js";
 import { findProjectRoot, loadDgFile } from "../project/dgfile.js";
+import { honoredOverrides } from "../project/override-trust.js";
 import { writeCooldownExemptionsFile } from "../proxy/cooldown-exemptions-file.js";
 import { writePreverifiedFile } from "../proxy/preverified.js";
 import { describeBlockedInstall, describeFlaggedWarn, renderInstallDecision } from "../install-ui/block-render.js";
@@ -13,21 +14,66 @@ import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
 import { maybeSetupNudge } from "../runtime/nudges.js";
 import { createTheme } from "../presentation/theme.js";
 import { readProxySessionState } from "../proxy/server.js";
+import { readServiceState } from "../service/state.js";
 import { cleanupSessionSync, createSessionSync, resolveDgPaths } from "../state/index.js";
 import { classifyPackageManagerInvocation } from "./classify.js";
-import { buildProxyChildEnv } from "./env.js";
+import { buildProxyChildEnv, scrubChildSecrets } from "./env.js";
 import { prepareCargoHome, userCargoHome } from "./cargo-cache.js";
 import { cachedPipResolution } from "./install-preflight.js";
 import { createStreamRedactor, redactSecrets } from "./output-redaction.js";
 import { resolveSpawnInvocation } from "./spawn-invocation.js";
 import { resolveRealBinary } from "./resolve-real-binary.js";
-import { runScriptGateAfterInstall } from "../scripts/gate.js";
+import { runScriptGateAfterInstall, scriptGateChildEnv, scriptGateInstallArgs } from "../scripts/gate.js";
 export const EXIT_INSTALL_BLOCKED = 2;
 export { resolveSpawnInvocation } from "./spawn-invocation.js";
 export function shimDepth(env) {
     const parsed = Number.parseInt(env.DG_SHIM_DEPTH ?? "", 10);
     return Number.isInteger(parsed) && parsed > 0 ? parsed : 0;
 }
+// A genuine parent dg proxy sets DG_PROXY_ACTIVE=1 and routes the child through a
+// loopback proxy URL that carries the proxy's auth token (buildProxyChildEnv ->
+// proxyUrlWithAuth). All of these must hold for a nested invocation to safely run
+// the real package manager directly (its traffic still flows through the live
+// parent proxy). DG_PROXY_ACTIVE + a bare loopback URL are both forgeable, so:
+//  - the URL must carry a dg auth token (a forged HTTPS_PROXY=http://127.0.0.1:1
+//    with no credential is rejected), and
+//  - when a persistent dg service is the parent (the agent-routing case), the URL
+//    must match that live service's proxy, so a forged token cannot impersonate it.
+// If neither matches, we start our own verifying proxy rather than trust the env.
+export function inheritedDgProxyActive(env) {
+    if (env.DG_PROXY_ACTIVE !== "1") {
+        return false;
+    }
+    const proxyUrl = env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy;
+    if (!proxyUrl) {
+        return false;
+    }
+    let url;
+    try {
+        url = new URL(proxyUrl);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.replace(/^\[(.*)\]$/, "$1");
+    if (host !== "127.0.0.1" && host !== "::1" && host !== "localhost") {
+        return false;
+    }
+    if (!url.username && !url.password) {
+        return false;
+    }
+    try {
+        const { state } = readServiceState(env);
+        if (state.running && state.proxy) {
+            const live = new URL(state.proxy.proxyUrl);
+            return live.hostname.replace(/^\[(.*)\]$/, "$1") === host && live.port === url.port;
+        }
+    }
+    catch {
+        // No readable service state — fall through to the session-proxy path below.
+    }
+    return true;
+}
 export function rootUnprotectedNotice(env, uid = process.getuid?.()) {
     if (uid !== 0) {
         return "";
@@ -59,11 +105,11 @@ export function createLaunchPlan(manager, args, env = process.env) {
         classification,
         realBinary,
         startsProxy: classification.kind === "protected",
-        childEnv: {
+        childEnv: scrubChildSecrets({
             ...env,
             DG_SHIM_ACTIVE: shimNonce(manager, env),
             DG_SHIM_DEPTH: String(shimDepth(env) + 1)
-        }
+        })
     };
 }
 export async function runPackageManager(manager, args, options = {}) {
@@ -84,15 +130,20 @@ export async function runPackageManager(manager, args, options = {}) {
             stderr: `dg: ${manager} shim exec loop detected (DG_SHIM_DEPTH=${depth}) — refusing to re-enter\n`
         };
     }
-    if (depth === 1 && plan.startsProxy) {
-        const child = await spawnPackageManager(plan, args, options);
-        return {
-            exitCode: child.exitCode,
-            stdout: streamedOut(child.stdout, options),
-            stderr: `dg: re-entered through its own shim — running the real ${plan.classification.realBinaryName} directly\n${streamedErr(child.stderr, options)}`
-        };
-    }
     if (plan.startsProxy) {
+        // Reuse a parent dg proxy ONLY when one is genuinely live in this environment
+        // (the parent set DG_PROXY_ACTIVE and a loopback proxy URL). An env var such as
+        // a forged or stale DG_SHIM_DEPTH must never be what decides to skip
+        // verification: if no live dg proxy is detected, start one rather than run the
+        // install unproxied. DG_SHIM_DEPTH is only the >=2 infinite-recursion backstop.
+        if (inheritedDgProxyActive(options.env ?? process.env)) {
+            const child = await spawnPackageManager(plan, args, options);
+            return {
+                exitCode: child.exitCode,
+                stdout: streamedOut(child.stdout, options),
+                stderr: `dg: re-entered through its own shim — running the real ${plan.classification.realBinaryName} directly\n${streamedErr(child.stderr, options)}`
+            };
+        }
         if (!options.proxyVerdict) {
             return runWithProductionProxy(plan, args, options);
         }
@@ -271,6 +322,7 @@ export async function runWithProductionProxyLive(plan, args, options, onView, pr
             cacheDir: prepareProxyCacheDir(plan.classification.manager, proxy.session.dir, env)
         });
         const spawner = options.spawner ?? defaultSpawner;
+        const hardened = applyScriptGateHardening(plan, args, childEnv, env);
         const resolvedTotal = plan.classification.manager === "pip" ? cachedPipResolution(plan.realBinary.path ?? "", args)?.count : undefined;
         const poll = setInterval(() => {
             onView(deriveLiveView(readProxySessionState(proxy.session), "scanning", resolvedTotal));
@@ -279,8 +331,8 @@ export async function runWithProductionProxyLive(plan, args, options, onView, pr
         try {
             finished = await spawner({
                 binary: plan.realBinary.path ?? "",
-                args,
-                env: childEnv
+                args: hardened.args,
+                env: hardened.env
             });
         }
         finally {
@@ -326,6 +378,22 @@ function installOutcome(stdout) {
         /^(added|changed|removed|updated) \d/.test(line.trim()));
     return lines.length > 0 ? `${lines.join("\n")}\n` : "";
 }
+// scriptGate.mode === "enforce" is applied HERE, at the spawn boundary: it
+// rewrites the install args (--ignore-scripts) and child env
+// (npm_config_ignore_scripts) for npm/yarn so a reputation-clean package can't
+// run a lifecycle script. observe/off leave the install untouched. Without this
+// the mode setting was inert — the verdict screens what is fetched, this gates
+// what the fetched package is allowed to execute.
+function applyScriptGateHardening(plan, args, childEnv, configEnv) {
+    const mode = loadUserConfig(configEnv).scriptGate.mode;
+    const manager = plan.classification.manager;
+    const hardenedArgs = scriptGateInstallArgs({ mode, manager, args, env: childEnv });
+    const gateEnv = scriptGateChildEnv({ mode, manager, args, env: childEnv });
+    return {
+        args: hardenedArgs,
+        env: Object.keys(gateEnv).length > 0 ? { ...childEnv, ...gateEnv } : childEnv
+    };
+}
 async function spawnPackageManager(plan, args, options) {
     if (!plan.realBinary.path) {
         return {
@@ -335,10 +403,11 @@ async function spawnPackageManager(plan, args, options) {
         };
     }
     const spawner = options.spawner ?? defaultSpawner;
+    const hardened = applyScriptGateHardening(plan, args, plan.childEnv, options.env ?? process.env);
     return spawner({
         binary: plan.realBinary.path,
-        args,
-        env: plan.childEnv,
+        args: hardened.args,
+        env: hardened.env,
         onStdout: options.onStdout,
         onStderr: options.onStderr
     });
@@ -410,7 +479,10 @@ export function loadProjectCooldownExemptions(env, cwd = process.cwd()) {
             return [];
         }
         const file = loadDgFile(root);
-        return file.readable ? file.cooldownExemptions : [];
+        if (!file.readable) {
+            return [];
+        }
+        return honoredOverrides(file, root, env, trustsProjectOverrides(env)).exemptions;
     }
     catch {
         return [];

package/dist/project/dgfile.js

@@ -6,6 +6,7 @@ import { gitTrimmed } from "../util/git.js";
 import { writeJsonAtomic } from "../util/json-file.js";
 import { canonicalCooldownName } from "../policy/pypi-name.js";
 import { acquireLockSyncWithRetry, resolveDgPaths } from "../state/index.js";
+import { stampAuthoredEntries } from "./override-trust.js";
 const DG_FILE_LOCK_STALE_MS = 10_000;
 const DG_FILE_LOCK_TIMEOUT_MS = 5_000;
 export function withDgFileLock(root, env, action) {
@@ -29,7 +30,7 @@ export function mutateDgFile(root, env, mutate) {
         if (!file.readable) {
             throw new Error(`refusing to rewrite ${file.path}: ${file.failure ?? "unreadable"}`);
         }
-        const next = mutate(file);
+        const next = stampAuthoredEntries(mutate(file), file, root, env);
         saveDgFile(next);
         return next;
     });