@westbayberry/dg 2.3.2 → 2.3.4

package/dist/proxy/upstream-proxy.js

@@ -22,13 +22,32 @@ export function selectUpstreamProxy(target, env) {
         redactedUrl: redactSecrets(url.toString())
     };
 }
+// A stalled upstream proxy (TCP connect or CONNECT response never completing)
+// would otherwise hang the whole install with no bound; cap the handshake.
+const CONNECT_HANDSHAKE_TIMEOUT_MS = 30_000;
 export function connectViaUpstreamProxy(target, upstream, extraHeaders = []) {
     return new Promise((resolve, reject) => {
         const socket = connect(Number(upstream.url.port || "80"), upstream.url.hostname);
         const chunks = [];
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            reject(new Error("upstream proxy CONNECT handshake timed out"));
+        }, CONNECT_HANDSHAKE_TIMEOUT_MS);
+        timer.unref?.();
+        const settle = (action) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            action();
+        };
         const fail = (error) => {
             socket.destroy();
-            reject(error);
+            settle(() => reject(error));
         };
         socket.once("error", fail);
         socket.once("connect", () => {
@@ -50,7 +69,7 @@ export function connectViaUpstreamProxy(target, upstream, extraHeaders = []) {
             if (buffered.length > 64 * 1024) {
                 socket.off("data", onData);
                 socket.destroy();
-                reject(new Error("upstream proxy CONNECT response exceeded the 64KiB header limit"));
+                settle(() => reject(new Error("upstream proxy CONNECT response exceeded the 64KiB header limit")));
                 return;
             }
             const headerEnd = buffered.indexOf("\r\n\r\n");
@@ -63,13 +82,13 @@ export function connectViaUpstreamProxy(target, upstream, extraHeaders = []) {
             const statusLine = buffered.subarray(0, headerEnd).toString("latin1").split("\r\n")[0] ?? "";
             if (!/^HTTP\/1\.[01] 2\d\d\b/.test(statusLine)) {
                 socket.destroy();
-                reject(new Error(`upstream proxy CONNECT failed: ${statusLine}`));
+                settle(() => reject(new Error(`upstream proxy CONNECT failed: ${statusLine}`)));
                 return;
             }
             if (head.length > 0) {
                 socket.unshift(head);
             }
-            resolve(socket);
+            settle(() => resolve(socket));
         });
     });
 }

package/dist/proxy/worker.js

@@ -3,6 +3,7 @@ import { startProductionHttpProxy } from "./server.js";
 import { parseForceOverrideRequest } from "./enforcement.js";
 import { cleanupSessionSync } from "../state/index.js";
 import { COOLDOWN_EXEMPTIONS_ENV, loadCooldownExemptionsFile } from "./cooldown-exemptions-file.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
 const PARENT_POLL_MS = 500;
 const sessionPath = process.argv[2];
 const apiBaseUrl = process.argv[3];
@@ -35,7 +36,7 @@ function shutdown() {
 function exitOnFatal(error) {
     const message = error instanceof Error ? error.message : String(error);
     try {
-        process.stderr.write(`dg proxy worker: unexpected error — ${message}\n`);
+        process.stderr.write(`dg proxy worker: unexpected error — ${redactSecrets(message)}\n`);
     }
     catch {
         // stderr is gone; nothing left to report to.
@@ -43,7 +44,7 @@ function exitOnFatal(error) {
     close().finally(() => process.exit(1));
 }
 process.on("uncaughtException", exitOnFatal);
-process.on("unhandledRejection", exitOnFatal);
+process.on("unhandledRejection", (reason) => exitOnFatal(reason));
 process.stdin.resume();
 process.stdin.on("end", shutdown);
 process.stdin.on("error", shutdown);

package/dist/publish-set/collect.js

@@ -33,6 +33,12 @@ export function buildAuditFile(root, relPath) {
         symlinkEscapes,
         mode: stat.mode,
         read: () => {
+            // A symlink whose target escapes the package root would, if read, leak an
+            // arbitrary host file (e.g. /etc/passwd) into the audit — and into any
+            // redacted excerpt shown. Flag it, never follow it.
+            if (isSymlink && symlinkEscapes) {
+                return null;
+            }
             try {
                 return readFileSync(absolute);
             }

package/dist/runtime/fatal.js

@@ -1,5 +1,6 @@
 import { EXIT_TOOL_ERROR } from "../commands/types.js";
 import { leaveTui, tuiIsActive } from "../scan-ui/alt-screen.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
 const defaultIo = {
     writeStderr: (text) => {
         process.stderr.write(text);
@@ -22,7 +23,7 @@ export function exitOnFatal(error, io = defaultIo) {
         // screen restore must never mask the fatal report
     }
     try {
-        io.writeStderr(`dg: unexpected error — ${message}\nRun 'dg doctor' to check your installation; remove ~/.dg/config.json if it is corrupted.\n`);
+        io.writeStderr(`dg: unexpected error — ${redactSecrets(message)}\nRun 'dg doctor' to check your installation; remove ~/.dg/config.json if it is corrupted.\n`);
     }
     catch {
         // stderr is gone; nothing left to report to.

package/dist/runtime/first-run.js

@@ -42,7 +42,11 @@ export function sweepLegacyHooksOnVersionChange(env = process.env, version = dgV
             return false;
         }
         sweepLegacyPythonHooks(resolveDgPaths(env).homeDir, [], []);
-        refreshSetupOnUpgrade(env);
+        if (refreshSetupOnUpgrade(env) === "lock-busy") {
+            // Don't record this version as refreshed; retry on the next run once the
+            // setup lock is free, so a momentary contention can't skip the upgrade.
+            return false;
+        }
         mkdirSync(dirname(marker), { recursive: true, mode: 0o700 });
         writeFileSync(marker, `${version}\n`, { encoding: "utf8", mode: 0o600 });
         return true;

package/dist/runtime/node-version.js

@@ -71,11 +71,62 @@ export async function resolveShimFallback(env = process.env, argv = process.argv
         return null;
     }
 }
+// An agent invokes `dg hook-exec <agent>` directly (no shim), so the shim
+// fallback never applies. Exiting 1 with empty stdout reads as ALLOW to the
+// agents we integrate, which would let an install run unscanned on an old-Node
+// shell. Emit this agent's deny shape instead, so the firewall fails CLOSED.
+export async function agentHookNodeGuardDeny(version, argv = process.argv) {
+    if (argv[2] !== "hook-exec") {
+        return null;
+    }
+    const agent = argv[3];
+    const blockedStderr = `dg hook: Node ${version} is below the required >=22.14.0; install blocked\n`;
+    try {
+        const [{ isAgentId, getAgent }, { ESCALATE }] = await Promise.all([
+            import("../agents/registry.js"),
+            import("../launcher/agent-check.js")
+        ]);
+        if (agent && isAgentId(agent)) {
+            const emitted = getAgent(agent).emitDecision({
+                decision: "deny",
+                reason: `dg cannot run the install firewall on Node ${version} (requires >=22.14.0), so the install is blocked. Upgrade Node, then retry. ${ESCALATE}`
+            });
+            return {
+                stdout: emitted.stdout,
+                stderr: blockedStderr,
+                exitCode: emitted.exitCode || 2
+            };
+        }
+        return {
+            stdout: "",
+            stderr: `dg hook-exec: Node ${version} is below >=22.14.0 and agent '${agent ?? ""}' is unknown; install blocked under the firewall — upgrade Node and dg\n`,
+            exitCode: 2
+        };
+    }
+    catch {
+        // The agent modules failed to load on this runtime. Still refuse: a non-zero
+        // exit with a block payload keeps the hook fail-closed rather than letting an
+        // unhandled rejection surface as a silent allow.
+        return {
+            stdout: JSON.stringify({ decision: "block", reason: `dg requires Node.js >=22.14.0; install blocked on Node ${version}` }),
+            stderr: blockedStderr,
+            exitCode: 2
+        };
+    }
+}
 export async function assertCurrentNode() {
     const version = currentNodeVersion();
     if (isSupportedNode(version)) {
         return;
     }
+    const hookDeny = await agentHookNodeGuardDeny(version);
+    if (hookDeny) {
+        if (hookDeny.stdout) {
+            process.stdout.write(hookDeny.stdout);
+        }
+        process.stderr.write(hookDeny.stderr);
+        process.exit(hookDeny.exitCode);
+    }
     const fallback = await resolveShimFallback();
     if (fallback) {
         process.stderr.write(fallback.warning);

package/dist/runtime/nudges.js

@@ -7,6 +7,7 @@ import { isCiEnv } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { resolveDgPaths } from "../state/index.js";
 const UPDATE_THROTTLE_MS = 24 * 60 * 60 * 1000;
+const UPDATE_FAILURE_BACKOFF_MS = 5 * 60 * 1000;
 const LOGIN_THROTTLE_MS = 7 * 24 * 60 * 60 * 1000;
 const LATEST_LOOKUP_TIMEOUT_MS = 1500;
 const SKIP_COMMANDS = new Set([
@@ -47,16 +48,21 @@ export function maybeShowNudges(args, options = {}) {
     const theme = createTheme(true);
     const lines = [];
     let stateChanged = false;
-    if (due(state.updateCheckedAt, UPDATE_THROTTLE_MS, now)) {
+    if (due(state.updateCheckedAt, UPDATE_THROTTLE_MS, now) && due(state.updateCheckFailedAt, UPDATE_FAILURE_BACKOFF_MS, now)) {
         const latest = readLatestVersion(LATEST_LOOKUP_TIMEOUT_MS);
         if (latest) {
             state.updateCheckedAt = now.toISOString();
+            delete state.updateCheckFailedAt;
             state.updateLatest = latest;
             stateChanged = true;
             if (compareVersions(latest, dgVersion()) > 0) {
                 lines.push(`${theme.paint("warn", "⚠")} ${theme.paint("muted", `Update available: ${dgVersion()} → ${latest}. Run`)} ${theme.paint("accent", "dg update")}${theme.paint("muted", ".")}`);
             }
         }
+        else {
+            state.updateCheckFailedAt = now.toISOString();
+            stateChanged = true;
+        }
     }
     if (due(state.loginNudgedAt, LOGIN_THROTTLE_MS, now) && !isAuthenticated(env)) {
         state.loginNudgedAt = now.toISOString();
@@ -108,6 +114,26 @@ export function pendingUpdate(env = process.env) {
     }
     return { current: dgVersion(), latest };
 }
+// Surface the cached pending update on a non-TTY path (agent hook, install
+// wrapper) where maybeShowNudges' live lookup never runs. Reads the cache only —
+// no network — and throttles to once per window so it doesn't print on every
+// screened command. Returns "" when there's nothing to show.
+export function maybeUpdateNudge(options = {}) {
+    const env = options.env ?? process.env;
+    const now = options.now ?? new Date();
+    const update = pendingUpdate(env);
+    if (!update) {
+        return "";
+    }
+    const statePath = nudgeStatePath(env);
+    const state = readState(statePath);
+    if (!due(state.updateNudgedAt, UPDATE_THROTTLE_MS, now)) {
+        return "";
+    }
+    state.updateNudgedAt = now.toISOString();
+    writeState(statePath, state);
+    return `\n  dg ${update.current} → ${update.latest} available — run dg update\n`;
+}
 function isAuthenticated(env) {
     try {
         return authStatus(env).authenticated;

package/dist/sbom/cyclonedx.js

@@ -1,7 +1,9 @@
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { parseLockfilePackages } from "../verify/preflight.js";
+import { sanitizeLine } from "../security/sanitize.js";
 import { normalizePypiName } from "../policy/cooldown.js";
+import { canonicalSpdxId } from "./spdx.js";
 export function collectSbomComponents(projects) {
     const seen = new Set();
     const droppedSeen = new Set();
@@ -11,7 +13,7 @@ export function collectSbomComponents(projects) {
         const parsed = parseLockfilePackages(join(project.path, project.depFile));
         for (const identity of parsed.packages) {
             if (identity.ecosystem === "unknown" || !identity.version) {
-                const label = `${identity.ecosystem}:${identity.name}`;
+                const label = sanitizeLine(`${identity.ecosystem}:${identity.name}`);
                 if (identity.name.length > 0 && !droppedSeen.has(label)) {
                     droppedSeen.add(label);
                     dropped.push(label);
@@ -30,21 +32,76 @@ export function collectSbomComponents(projects) {
     return { components, dropped };
 }
 export function readRootComponent(root) {
+    return npmRootComponent(root) ?? cargoRootComponent(root) ?? pyprojectRootComponent(root) ?? {};
+}
+// name/version reach the SBOM summary subject on the terminal; strip control bytes
+// so a hostile repo manifest can't inject ANSI into the rendered subject line.
+function npmRootComponent(root) {
     const manifest = join(root, "package.json");
     if (!existsSync(manifest)) {
-        return {};
+        return null;
     }
     try {
         const parsed = JSON.parse(readFileSync(manifest, "utf8"));
         if (typeof parsed.name !== "string" || parsed.name.length === 0) {
             return {};
         }
-        return { component: { name: parsed.name, ...(typeof parsed.version === "string" ? { version: parsed.version } : {}) } };
+        return {
+            component: {
+                name: sanitizeLine(parsed.name),
+                ecosystem: "npm",
+                ...(typeof parsed.version === "string" ? { version: sanitizeLine(parsed.version) } : {}),
+                ...(typeof parsed.license === "string" && parsed.license.length > 0 ? { license: parsed.license } : {})
+            }
+        };
     }
     catch {
         return { malformed: true };
     }
 }
+function cargoRootComponent(root) {
+    return tomlManifestComponent(join(root, "Cargo.toml"), "package", "cargo");
+}
+function pyprojectRootComponent(root) {
+    const manifest = join(root, "pyproject.toml");
+    if (!existsSync(manifest)) {
+        return null;
+    }
+    return tomlManifestComponent(manifest, "project", "pypi") ?? tomlManifestComponent(manifest, "tool.poetry", "pypi");
+}
+function tomlManifestComponent(manifest, table, ecosystem) {
+    if (!existsSync(manifest)) {
+        return null;
+    }
+    let section;
+    try {
+        section = tomlTable(readFileSync(manifest, "utf8"), table);
+    }
+    catch {
+        return null;
+    }
+    const name = section ? tomlField(section, "name") : null;
+    if (!section || !name) {
+        return null;
+    }
+    const version = tomlField(section, "version");
+    const license = tomlField(section, "license");
+    return {
+        component: {
+            name: sanitizeLine(name),
+            ecosystem,
+            ...(version ? { version: sanitizeLine(version) } : {}),
+            ...(license ? { license } : {})
+        }
+    };
+}
+function tomlTable(text, table) {
+    const escaped = table.replace(/[.]/gu, "\\.");
+    return new RegExp(`^\\s*\\[${escaped}\\]([\\s\\S]*?)(?=^\\s*\\[|$)`, "mu").exec(text)?.[1] ?? null;
+}
+function tomlField(section, key) {
+    return new RegExp(`^\\s*${key}\\s*=\\s*"([^"]*)"`, "mu").exec(section)?.[1] ?? null;
+}
 export function buildCycloneDxSbom(components, opts) {
     const byRef = new Map();
     for (const component of components) {
@@ -54,26 +111,36 @@ export function buildCycloneDxSbom(components, opts) {
         }
     }
     const mapped = [...byRef.values()].sort((a, b) => compareCodePoints(a["bom-ref"], b["bom-ref"]));
+    const dependencies = opts.dependencies ?? [];
     return {
+        $schema: "http://cyclonedx.org/schema/bom-1.5.schema.json",
         bomFormat: "CycloneDX",
         specVersion: "1.5",
         serialNumber: opts.serialNumber,
         version: 1,
         metadata: {
             ...(opts.timestamp ? { timestamp: opts.timestamp } : {}),
+            lifecycles: [{ phase: "build" }],
             tools: [{ vendor: "WestBayBerry", name: "dg", version: opts.toolVersion }],
-            ...(opts.rootComponent
-                ? {
-                    component: {
-                        type: "application",
-                        "bom-ref": "root",
-                        name: opts.rootComponent.name,
-                        ...(opts.rootComponent.version ? { version: opts.rootComponent.version } : {})
-                    }
-                }
-                : {})
+            authors: [{ name: "dg (WestBayBerry)" }],
+            supplier: { name: "WestBayBerry", url: ["https://westbayberry.com"] },
+            ...(opts.rootComponent ? { component: rootComponentOf(opts.rootComponent) } : {})
         },
-        components: mapped
+        components: mapped,
+        ...(dependencies.length > 0 ? { dependencies } : {}),
+        ...(opts.completeness ? { compositions: [{ aggregate: opts.completeness }] } : {})
+    };
+}
+function rootComponentOf(root) {
+    const purl = root.ecosystem && root.version ? purlForParts(root.ecosystem, root.name, root.version, null) : null;
+    const licenses = licensesFor(root.license);
+    return {
+        type: "application",
+        "bom-ref": "root",
+        name: root.name,
+        ...(root.version ? { version: root.version } : {}),
+        ...(purl ? { purl } : {}),
+        ...(licenses ? { licenses } : {})
     };
 }
 function compareCodePoints(a, b) {
@@ -95,31 +162,51 @@ function canonicalPurlName(ecosystem, name) {
     }
     return name;
 }
-// The declared license string is emitted verbatim as a CycloneDX `license.name`,
-// which is always schema-valid for any free text. We deliberately do NOT classify
-// it into the SPDX `expression` form: correctly distinguishing a valid SPDX
-// expression from free text requires validating operands against the SPDX license
-// registry, and any heuristic shortcut emits schema-invalid expressions for some
-// inputs (unbalanced parens, operator-only strings, unregistered ids).
 function toCycloneDxComponent(component) {
     const purl = purlFor(component);
     const hashes = hashesFor(component.integrity);
-    const license = component.license?.trim();
-    const licenses = license ? [{ license: { name: license } }] : undefined;
+    const licenses = licensesFor(component.license);
+    const externalReferences = distributionReference(component.resolvedUrl);
     return {
         type: "library",
         "bom-ref": bomRefOf(component),
-        name: component.name,
-        version: component.version,
+        name: sanitizeLine(component.name),
+        version: sanitizeLine(component.version),
         ...(purl ? { purl } : {}),
         ...(licenses ? { licenses } : {}),
-        ...(hashes.length > 0 ? { hashes } : {})
+        ...(hashes.length > 0 ? { hashes } : {}),
+        ...(externalReferences ? { externalReferences } : {})
     };
 }
+// An exact-match SPDX id becomes the machine-readable license.id; everything else
+// stays free-text license.name. A compound expression is never synthesized: only
+// validating operands against the SPDX registry avoids emitting an invalid id, so
+// the conservative id-or-name split keeps every license object schema-valid. name
+// is lockfile-controlled so it is sanitized; a promoted id is from our allowlist.
+function licensesFor(declared) {
+    const license = declared?.trim();
+    if (!license) {
+        return undefined;
+    }
+    const id = canonicalSpdxId(license);
+    return id ? [{ license: { id } }] : [{ license: { name: sanitizeLine(license) } }];
+}
+function distributionReference(resolvedUrl) {
+    if (!resolvedUrl || !/^https?:\/\//iu.test(resolvedUrl)) {
+        return undefined;
+    }
+    return [{ type: "distribution", url: sanitizeLine(resolvedUrl) }];
+}
 export function purlFor(component) {
-    const version = encodeURIComponent(component.version);
-    if (component.ecosystem === "npm") {
-        const lower = component.name.toLowerCase();
+    return purlForParts(component.ecosystem, component.name, component.version, component.resolvedUrl);
+}
+export function componentRef(parts) {
+    return purlForParts(parts.ecosystem, parts.name, parts.version, parts.resolvedUrl ?? null) ?? `${parts.ecosystem}:${parts.name}@${parts.version}`;
+}
+function purlForParts(ecosystem, name, rawVersion, resolvedUrl) {
+    const version = encodeURIComponent(rawVersion);
+    if (ecosystem === "npm") {
+        const lower = name.toLowerCase();
         if (lower.startsWith("@") && lower.includes("/")) {
             const slash = lower.indexOf("/");
             const scope = lower.slice(1, slash);
@@ -128,12 +215,12 @@ export function purlFor(component) {
         }
         return `pkg:npm/${encodeURIComponent(lower)}@${version}`;
     }
-    if (component.ecosystem === "pypi") {
-        return `pkg:pypi/${encodeURIComponent(normalizePypiName(component.name))}@${version}`;
+    if (ecosystem === "pypi") {
+        return `pkg:pypi/${encodeURIComponent(normalizePypiName(name))}@${version}`;
     }
-    if (component.ecosystem === "cargo") {
-        const base = `pkg:cargo/${encodeURIComponent(component.name.toLowerCase())}@${version}`;
-        const repository = cargoAlternateRegistry(component.resolvedUrl);
+    if (ecosystem === "cargo") {
+        const base = `pkg:cargo/${encodeURIComponent(name.toLowerCase())}@${version}`;
+        const repository = cargoAlternateRegistry(resolvedUrl);
         return repository ? `${base}?repository_url=${encodeURIComponent(repository)}` : base;
     }
     return null;