@westbayberry/dg 2.3.2 → 2.3.4

package/dist/verify/package-check.js

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { analyzePackages, AnalyzeError } from "../api/analyze.js";
 import { createTheme } from "../presentation/theme.js";
 import { provenanceLabel, provenanceDowngradeLine } from "../presentation/provenance.js";
+import { safeVersionLine } from "../presentation/safe-version.js";
 import { packagePageUrl } from "../presentation/package-page.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { isRemotePackageSpec, isSupportedLockfilePath } from "./preflight.js";
@@ -27,17 +28,23 @@ function parseSpec(target) {
     if (!rest) {
         return { error: `missing package name. ${DEEP_VERIFY_HINT}` };
     }
-    const separator = ecosystem === "pypi" ? "==" : "@";
-    const at = ecosystem === "npm" ? rest.lastIndexOf("@") : rest.indexOf("==");
-    if (ecosystem === "npm" && (at <= 0)) {
-        return { ecosystem, name: rest, version: null };
-    }
-    if (ecosystem === "pypi" && at < 0) {
+    if (ecosystem === "npm") {
+        const at = rest.lastIndexOf("@");
+        if (at <= 0) {
+            return { ecosystem, name: rest, version: null };
+        }
+        return { ecosystem, name: rest.slice(0, at), version: rest.slice(at + 1).trim() || null };
+    }
+    // PyPI names contain no '@' or '=='; accept either the registry-style '@' the
+    // help advertises or the PEP 508 '==' pin, whichever comes first.
+    const eq = rest.indexOf("==");
+    const at = rest.indexOf("@");
+    const cut = eq >= 0 && (at < 0 || eq < at) ? eq : at;
+    if (cut <= 0) {
         return { ecosystem, name: rest, version: null };
     }
-    const name = rest.slice(0, at);
-    const version = rest.slice(at + separator.length).trim() || null;
-    return { ecosystem, name, version };
+    const version = rest.slice(cut + (cut === eq ? 2 : 1)).trim() || null;
+    return { ecosystem, name: rest.slice(0, cut), version };
 }
 export async function resolveLatest(ecosystem, name, fetchImpl) {
     try {
@@ -77,8 +84,7 @@ function provenanceLines(version, result, theme, withPredicate) {
 function reasonGlyph(action, theme) {
     return action === "block" ? theme.paint("block", "✘") : action === "warn" ? theme.paint("warn", "⚠") : theme.paint("muted", "·");
 }
-function renderResult(spec, version, result, theme, verbose) {
-    const action = result.action ?? "pass";
+function renderResult(spec, version, result, action, theme, verbose) {
     const badge = theme.badge(action);
     const lines = [`${badge}  ${result.name}@${version} (${spec.ecosystem})  ${theme.paint("muted", `score ${result.score}`)}`];
     lines.push(...provenanceLines(version, result, theme, verbose));
@@ -100,40 +106,13 @@ function renderResult(spec, version, result, theme, verbose) {
     if (result.recommendation) {
         lines.push(`  ${theme.paint("muted", result.recommendation)}`);
     }
+    lines.push(...safeVersionLine(result, theme, spec.ecosystem));
     const page = packagePageUrl(spec.ecosystem, result.name);
     if (page) {
         lines.push(`  ${theme.paint("muted", `→ ${page}`)}`);
     }
     return `${lines.join("\n")}\n`;
 }
-const FREE_REASON_CAP = 3;
-const FREE_SCANS_FOOTER_THRESHOLD = 5_000;
-function renderFreeResult(spec, version, result, theme, freeScansRemaining) {
-    const action = result.action ?? "pass";
-    const lines = [`${theme.badge(action)}  ${result.name}@${version} (${spec.ecosystem})`];
-    lines.push(...provenanceLines(version, result, theme, false));
-    if (action === "pass") {
-        lines.push(`  ${theme.paint("muted", result.reasons[0] ?? "no risk signals")}`);
-    }
-    else {
-        const reasons = result.reasons.slice(0, FREE_REASON_CAP);
-        for (const reason of reasons) {
-            lines.push(`  ${reasonGlyph(action, theme)} ${reason}`);
-        }
-        if (result.reasons.length > reasons.length) {
-            lines.push(`  ${theme.paint("muted", `… ${result.reasons.length - reasons.length} more — sign in to see all:`)} ${theme.paint("accent", "dg login")}`);
-        }
-    }
-    const page = packagePageUrl(spec.ecosystem, result.name);
-    if (page) {
-        lines.push(`  ${theme.paint("muted", `→ ${page}`)}`);
-    }
-    lines.push(`  ${theme.paint("muted", "full findings, license, JSON output:")} ${theme.paint("accent", "dg login")}`);
-    if (freeScansRemaining !== undefined && freeScansRemaining < FREE_SCANS_FOOTER_THRESHOLD) {
-        lines.push(`  ${theme.paint("muted", `${freeScansRemaining.toLocaleString()} free package checks left this month`)}`);
-    }
-    return `${lines.join("\n")}\n`;
-}
 function encodeNpmPackagePath(name) {
     return name.split("/").map((segment) => encodeURIComponent(segment)).join("%2f");
 }
@@ -155,12 +134,12 @@ export async function runPackageCheck(target, io = {}, options = {}) {
     const accent = (text) => theme.paint("accent", text);
     const muted = (text) => theme.paint("muted", text);
     const authenticated = authStatus(io.env).authenticated;
-    if (!authenticated && (options.format === "json" || options.outputPath)) {
+    if (!authenticated) {
         return {
             exitCode: EXIT_UNAVAILABLE,
             stdout: "",
-            stderr: `\n  ${theme.paint("warn", "⚠")} ${muted("--json and --output for registry checks require sign-in.")}\n` +
-                `  ${accent("dg login")}${muted("  ·  see plans at")} ${accent("westbayberry.com/pricing")}\n\n`
+            stderr: `\n  ${theme.paint("warn", "⚠")} ${muted("Sign in to run dg verify.")}\n` +
+                `  ${muted("Run")} ${accent("dg login")}\n\n`
         };
     }
     const parsed = parseSpec(target);
@@ -186,7 +165,6 @@ export async function runPackageCheck(target, io = {}, options = {}) {
         }
     }
     let result;
-    let freeScansRemaining;
     try {
         const response = await analyzePackages([{ name: parsed.name, version }], {
             ecosystem: parsed.ecosystem,
@@ -194,7 +172,6 @@ export async function runPackageCheck(target, io = {}, options = {}) {
             ...(io.env ? { env: io.env } : {})
         });
         result = response.packages.find((entry) => entry.name === parsed.name) ?? response.packages[0];
-        freeScansRemaining = response.freeScansRemaining;
     }
     catch (error) {
         if (error instanceof AnalyzeError && error.code === "quota_exceeded") {
@@ -225,11 +202,10 @@ export async function runPackageCheck(target, io = {}, options = {}) {
             reasons: result.reasons,
             findings: result.findings,
             ...(result.provenance ? { provenance: result.provenance } : {}),
-            ...(result.recommendation ? { recommendation: result.recommendation } : {})
+            ...(result.recommendation ? { recommendation: result.recommendation } : {}),
+            ...(result.safeVersion ? { safeVersion: result.safeVersion } : {})
         }, null, 2)}\n`
-        : authenticated
-            ? renderResult(parsed, version, result, theme, options.verbose ?? false)
-            : renderFreeResult(parsed, version, result, theme, freeScansRemaining);
+        : renderResult(parsed, version, result, action, theme, options.verbose ?? false);
     if (options.outputPath) {
         try {
             writeFileSync(resolve(options.outputPath), rendered, "utf8");
@@ -262,6 +238,7 @@ export async function maybeVerifyPackage(args) {
     let outputPath = null;
     let outputFlagMissingPath;
     let target;
+    let extraPositional;
     let unknownFlag;
     for (let index = 0; index < rest.length; index += 1) {
         const arg = rest[index];
@@ -290,8 +267,11 @@ export async function maybeVerifyPackage(args) {
         else if (arg.startsWith("-")) {
             unknownFlag = unknownFlag ?? arg;
         }
+        else if (target === undefined) {
+            target = arg;
+        }
         else {
-            target = target ?? arg;
+            extraPositional = extraPositional ?? arg;
         }
     }
     if (!target) {
@@ -315,6 +295,12 @@ export async function maybeVerifyPackage(args) {
             result: { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: unknown option '${unknownFlag}'. Run 'dg verify --help'.\n` }
         };
     }
+    if (extraPositional) {
+        return {
+            handled: true,
+            result: { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: unexpected argument '${extraPositional}' — verify accepts one target. Run 'dg verify --help'.\n` }
+        };
+    }
     if (sarif) {
         return {
             handled: true,

package/dist/verify/preflight.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { loadUserConfig } from "../config/settings.js";
 import { evaluatePackagePolicy, resolveEffectivePolicy } from "../policy/evaluate.js";
 const LOCKFILE_NAMES = new Set([
@@ -124,6 +124,7 @@ export function parseLockfilePackages(targetPath) {
     }
     const context = createParseContext(fileName, absoluteTarget);
     const observations = parseLockfile(text, context);
+    recordBlockedObservationSkips(observations, context);
     return {
         packages: observations
             .filter((observation) => observation.verdict !== "block" && observation.identity.sourceKind === "lockfile")
@@ -132,24 +133,49 @@ export function parseLockfilePackages(targetPath) {
         parseError: context.errors[0] ?? null
     };
 }
+// A block-verdict entry is excluded from the scannable set; without an itemized
+// skip it would vanish from the scan with no verdict and no notice. Record one for
+// each blocked entry the per-parser path did not already skip.
+function recordBlockedObservationSkips(observations, context) {
+    const alreadySkipped = new Set(context.skipped.map((skip) => skip.location));
+    for (const observation of observations) {
+        if (observation.verdict !== "block" || observation.identity.ecosystem === "unknown") {
+            continue;
+        }
+        const location = observation.identity.requested;
+        if (alreadySkipped.has(location)) {
+            continue;
+        }
+        alreadySkipped.add(location);
+        recordSkip(context, packageDisplayName(observation.identity), blockedObservationReason(observation.identity), location);
+    }
+}
+function blockedObservationReason(identity) {
+    if (identity.resolvedUrl && isUnsafeResolvedUrl(identity.resolvedUrl)) {
+        return "git";
+    }
+    // Off-registry hosts and URL fallbacks are labeled direct-url, as the per-parser skip path already does.
+    return "direct-url";
+}
 function createParseContext(fileName, filePath) {
     return {
         fileName,
         filePath,
-        registryHosts: expectedRegistryHosts(fileName, filePath),
+        registryHosts: expectedRegistryHosts(fileName),
         skipped: [],
         errors: []
     };
 }
-function expectedRegistryHosts(fileName, filePath) {
+// Only the canonical public registries are trusted here. A repo-local .npmrc is
+// attacker-controlled in a cloned repo, so it must not widen this allowlist (a
+// hostile repo must never relax screening); legit private registries are fronted
+// by the proxy door at transport time, not blessed by a static preflight.
+function expectedRegistryHosts(fileName) {
     const hosts = new Set();
     if (NPM_LOCKFILE_NAMES.has(fileName)) {
         for (const host of DEFAULT_NPM_REGISTRY_HOSTS) {
             hosts.add(host);
         }
-        for (const host of npmrcRegistryHosts(filePath)) {
-            hosts.add(host);
-        }
     }
     else if (PYPI_LOCKFILE_NAMES.has(fileName)) {
         for (const host of DEFAULT_PYPI_REGISTRY_HOSTS) {
@@ -158,32 +184,6 @@ function expectedRegistryHosts(fileName, filePath) {
     }
     return hosts;
 }
-function npmrcRegistryHosts(lockfilePath) {
-    if (!lockfilePath) {
-        return [];
-    }
-    let text;
-    try {
-        text = readLockfileText(join(dirname(lockfilePath), ".npmrc"));
-    }
-    catch {
-        return [];
-    }
-    const hosts = [];
-    for (const line of text.split(/\r?\n/u)) {
-        const value = /^\s*(?:@[^=\s:]+:)?registry\s*=\s*(\S+)/u.exec(line)?.[1];
-        if (!value) {
-            continue;
-        }
-        try {
-            hosts.push(new URL(value).hostname.toLowerCase());
-        }
-        catch {
-            continue;
-        }
-    }
-    return hosts;
-}
 function untrustedResolvedHost(value, context) {
     if (context.registryHosts.size === 0 || !/^https?:\/\//iu.test(value)) {
         return null;
@@ -478,8 +478,13 @@ function npmAliasVersion(version) {
     }
     return { name: spec.slice(0, at), version: spec.slice(at + 1) || null };
 }
-function parseYarnLock(text, context) {
+function parseYarnLock(rawText, context) {
     const observations = [];
+    // The block-split lookahead matches a header terminated by ":\n"; a yarn.lock
+    // written with CRLF endings terminates headers with ":\r\n", so without this
+    // normalization the whole file collapses to one unparsed block and every
+    // package silently vanishes.
+    const text = rawText.replace(/\r\n/gu, "\n");
     const blocks = text.split(/\n(?=(?:"?@?[^"\s].*"?):\n)/u);
     for (const block of blocks) {
         const lines = block.split(/\r?\n/u);
@@ -688,6 +693,27 @@ function collectRequirements(text, baseDir, state, context, observations) {
             recordSkip(context, target, "local", line);
             continue;
         }
+        const indexOverride = /^(?:-i|--index-url|--extra-index-url|--find-links)[=\s]+(\S+)/u.exec(line);
+        if (indexOverride?.[1]) {
+            const indexUrl = indexOverride[1];
+            recordSkip(context, indexUrl, "index-override", line);
+            observations.push(packageObservation({
+                ecosystem: "pypi",
+                name: indexUrl,
+                version: null,
+                requested: line,
+                sourceKind: "lockfile-url-fallback",
+                resolvedUrl: indexUrl,
+                integrity: null,
+                license: null
+            }, "warn", {
+                id: "unverified-package-index",
+                title: "Unverified package index override",
+                message: `requirements resolve from '${indexUrl}', a non-default index that dg does not verify against the canonical registry`,
+                location: line
+            }));
+            continue;
+        }
         if (line.startsWith("-")) {
             continue;
         }

package/dist/verify/render.js

@@ -1,5 +1,6 @@
 import { createTheme } from "../presentation/theme.js";
 import { packagePageUrl } from "../presentation/package-page.js";
+import { automationCategory, findingFingerprint, sarifLocationEntry } from "../presentation/sarif.js";
 import { sanitizeDeep } from "../security/sanitize.js";
 const STATUS_ROLE = {
     pass: "pass",
@@ -160,30 +161,28 @@ export function renderVerifySarif(report) {
                         rules
                     }
                 },
+                automationDetails: {
+                    id: automationCategory(report.target)
+                },
+                properties: {
+                    dgVerdict: report.status
+                },
                 results: report.findings.map((finding) => ({
                     ruleId: finding.id,
                     level: finding.severity === "block" ? "error" : "warning",
                     message: {
                         text: finding.message
                     },
-                    locations: [
-                        {
-                            physicalLocation: {
-                                artifactLocation: {
-                                    uri: artifactUri(finding.location)
-                                }
-                            }
-                        }
-                    ]
+                    partialFingerprints: {
+                        dgFindingHash: findingFingerprint(`${finding.id} ${finding.location}`)
+                    },
+                    locations: [sarifLocationEntry(finding.location, report.target)]
                 }))
             }
         ]
     };
     return `${JSON.stringify(sarif, null, 2)}\n`;
 }
-function artifactUri(location) {
-    return location.replace(/:\d+$/, "");
-}
 function uniqueFindings(findings) {
     const seen = new Set();
     const unique = [];