@westbayberry/dg 2.3.2 → 2.3.4

package/dist/bin/dg.js

@@ -8,7 +8,7 @@ process.on("uncaughtException", (error) => {
     }
     exitOnFatal(error);
 });
-process.on("unhandledRejection", exitOnFatal);
+process.on("unhandledRejection", (reason) => exitOnFatal(reason));
 process.stdout.on("error", (error) => {
     if (error.code === "EPIPE") {
         process.exit(process.exitCode ?? 0);

package/dist/commands/audit.js

@@ -4,8 +4,9 @@ import { writeReportAtomic } from "../util/report-writer.js";
 import { EXIT_TOOL_ERROR, EXIT_USAGE_VERDICT } from "./types.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
-import { actionForFindings, detectFindings, findingLocation } from "../audit/detectors.js";
+import { actionForFindings, detectFindings, findingEvidenceSafe, findingLocation, findingTitleSafe } from "../audit/detectors.js";
 import { buildAuditFile } from "../publish-set/collect.js";
+import { sanitizeLine } from "../security/sanitize.js";
 import { npmPublishSet } from "../publish-set/npm.js";
 import { pypiPublishSet } from "../publish-set/pypi.js";
 import { deepDecision, runDeepUpload, consentGiven, deepSummary, teamPolicyBlocksUpload } from "../audit/deep.js";
@@ -33,11 +34,11 @@ export const auditCommand = {
         "Audits exactly what you're about to publish — the resolved publish set of one package, never the whole repo.",
         "Basic checks run 100% locally and never upload anything. If you're on a paid plan (and your org allows it), it also runs a deep behavioral scan of your package on the scanner; raw bytes are never retained. Exit codes: 0 clean (warn counts as clean under the default --fail-on block), 1 warn with --fail-on warn, 2 block, 3 deep audit required but unavailable (--require-deep), 4 analysis incomplete, 64 usage error."
     ],
-    handler: (context) => runAuditCommand(context.args)
+    handler: async (context) => (await maybeAudit(["audit", ...context.args])).result
 };
 function privatePackageResult(scope) {
     const theme = createTheme(resolvePresentation().color);
-    const name = typeof scope.packageJson?.name === "string" ? scope.packageJson.name : basename(scope.root);
+    const name = sanitizeLine(typeof scope.packageJson?.name === "string" ? scope.packageJson.name : basename(scope.root));
     return {
         exitCode: 0,
         stdout: `${theme.paint("pass", "✓")} ${name} is private — npm refuses to publish it, so there is nothing to audit ${theme.paint("muted", "(remove \"private\": true to audit it for publish)")}\n`,
@@ -97,17 +98,6 @@ function finalize(gathered, deep) {
 function gatherError(gathered) {
     return gathered.usage ? usageError(gathered.error) : { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg audit: ${gathered.error}.\n` };
 }
-function runAuditCommand(args) {
-    const gathered = gather(args);
-    if ("error" in gathered) {
-        return gatherError(gathered);
-    }
-    if ("privatePackage" in gathered) {
-        return privatePackageResult(gathered.privatePackage);
-    }
-    const decision = deepDecision(gathered.scope, gathered.parsed.local);
-    return finalize(gathered, { ran: false, reason: decision.reason });
-}
 export async function maybeAudit(args) {
     if (args[0] !== "audit") {
         return { handled: false, result: { exitCode: 0, stdout: "", stderr: "" } };
@@ -234,15 +224,17 @@ function resolveScope(target) {
         const packageJson = safeReadJson(resolve(root, "package.json"));
         const name = packageJson && typeof packageJson.name === "string" ? packageJson.name : basename(root);
         const version = packageJson && typeof packageJson.version === "string" ? packageJson.version : "(unknown)";
-        return { root, ecosystem: "npm", packageJson, artifact: `${name}@${version}` };
+        // name/version are free-text from a (possibly hostile) package.json rendered
+        // into the header and report; strip control bytes so they cannot inject ANSI.
+        return { root, ecosystem: "npm", packageJson, artifact: sanitizeLine(`${name}@${version}`) };
     }
     if (existsSync(resolve(root, "pyproject.toml")) || existsSync(resolve(root, "setup.py")) || existsSync(resolve(root, "setup.cfg"))) {
-        return { root, ecosystem: "pypi", packageJson: null, artifact: basename(root) };
+        return { root, ecosystem: "pypi", packageJson: null, artifact: sanitizeLine(basename(root)) };
     }
     if (existsSync(resolve(root, "Cargo.toml"))) {
-        return { root, ecosystem: "cargo", packageJson: null, artifact: basename(root) };
+        return { root, ecosystem: "cargo", packageJson: null, artifact: sanitizeLine(basename(root)) };
     }
-    return { root, ecosystem: "unknown", packageJson: null, artifact: basename(root) };
+    return { root, ecosystem: "unknown", packageJson: null, artifact: sanitizeLine(basename(root)) };
 }
 function findPackageRoot(start) {
     let current = start;
@@ -292,9 +284,9 @@ function renderReport(report, theme) {
                 ? theme.paint("warn", WARN_GLYPH)
                 : theme.paint("muted", "·");
         lines.push(`  ${tag} ${accent(findingLocation(finding))}`);
-        lines.push(`     ${finding.title}`);
+        lines.push(`     ${findingTitleSafe(finding)}`);
         if (finding.evidence && finding.evidence !== `path: ${finding.location}` && finding.evidence !== finding.location) {
-            lines.push(`     ${muted(finding.evidence)}`);
+            lines.push(`     ${muted(findingEvidenceSafe(finding))}`);
         }
         lines.push(`     ${accent("→")} ${finding.recommendation}`);
         lines.push("");

package/dist/commands/{guard-commit.js → commit-guard.js}

@@ -3,17 +3,17 @@ import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { promptYesNo } from "../util/tty-prompt.js";
 import { applyGitHook, gitHookState, planGitHook, removeGitHookForRepo, resolveGitRepo, verifyGitHook } from "../setup/git-hook.js";
-export const guardCommitCommand = {
-    name: "guard-commit",
+export const commitGuardCommand = {
+    name: "commit-guard",
     summary: "Scan staged dependencies before every commit in this repo.",
-    usage: "dg guard-commit [off | --check | --print] [--yes]",
+    usage: "dg commit-guard [off | --check | --print] [--yes]",
     args: [{ name: "[off]", summary: "Remove the hook and restore any hook it chained (alias remove/uninstall)." }],
     flags: [
         { flag: "--check", summary: "Verify the hook is installed and will actually fire." },
         { flag: "--print", summary: "Preview what it will write, change nothing." },
         { flag: "--yes", summary: "Install without the confirmation prompt (alias -y)." }
     ],
-    examples: ["dg guard-commit", "dg guard-commit --check", "dg guard-commit off"],
+    examples: ["dg commit-guard", "dg commit-guard --check", "dg commit-guard off"],
     details: [
         "Installs a git pre-commit hook that scans staged lockfile changes and blocks a commit that would add a malicious dependency. Override a block with 'git commit --no-verify'.",
         "It resolves the real hooks directory (honouring core.hooksPath/husky and worktrees) and chains any existing pre-commit hook. Tune behaviour with the gitHook.onWarn / gitHook.onIncomplete config keys."
@@ -53,13 +53,13 @@ function run(context) {
         return {
             exitCode: EXIT_USAGE,
             stdout: "",
-            stderr: `dg guard-commit: ${parsed.error}. Usage: ${guardCommitCommand.usage}\n`
+            stderr: `dg commit-guard: ${parsed.error}. Usage: ${commitGuardCommand.usage}\n`
         };
     }
     const theme = createTheme(resolvePresentation().color);
     const repo = resolveGitRepo();
     if ("error" in repo) {
-        return { exitCode: EXIT_USAGE, stdout: "", stderr: `dg guard-commit: ${repo.error}.\n` };
+        return { exitCode: EXIT_USAGE, stdout: "", stderr: `dg commit-guard: ${repo.error}.\n` };
     }
     if (parsed.off) {
         return remove(repo, theme);
@@ -82,7 +82,7 @@ function install(repo, theme, yes) {
         if (plan.willChain) {
             err.write(`  ${muted("Your existing pre-commit hook will be kept and run after dg.")}\n`);
         }
-        err.write(`  ${muted("Reversible with")} ${accent("dg guard-commit off")}${muted(".")}\n\n`);
+        err.write(`  ${muted("Reversible with")} ${accent("dg commit-guard off")}${muted(".")}\n\n`);
         const proceed = promptYesNo(`  ${accent("Proceed?")}`, true);
         if (proceed === false) {
             return { exitCode: 0, stdout: "", stderr: `  ${muted("cancelled — nothing written")}\n` };
@@ -107,7 +107,7 @@ function check(repo, theme) {
         return {
             exitCode: 1,
             stdout: "",
-            stderr: `  ${theme.paint("warn", "⚠")} not set up in this repo — run ${theme.paint("accent", "dg guard-commit")}\n`
+            stderr: `  ${theme.paint("warn", "⚠")} not set up in this repo — run ${theme.paint("accent", "dg commit-guard")}\n`
         };
     }
     const checks = verifyGitHook(repo);
@@ -120,9 +120,9 @@ function check(repo, theme) {
 function print(repo) {
     const plan = planGitHook(repo);
     const lines = [
-        "dg guard-commit write plan",
+        "dg commit-guard write plan",
         "",
-        "No files are changed until you run dg guard-commit.",
+        "No files are changed until you run dg commit-guard.",
         `- write pre-commit hook: ${plan.context.hookTarget}`
     ];
     if (plan.willChain) {
@@ -131,7 +131,7 @@ function print(repo) {
     else if (plan.state === "managed") {
         lines.push("- (a dg hook is already installed; it will be refreshed)");
     }
-    lines.push("- record it for 'dg guard-commit off' / 'dg uninstall'");
+    lines.push("- record it for 'dg commit-guard off' / 'dg uninstall'");
     return { exitCode: 0, stdout: `${lines.join("\n")}\n`, stderr: "" };
 }
 function remove(repo, theme) {
@@ -140,7 +140,7 @@ function remove(repo, theme) {
         return {
             exitCode: 0,
             stdout: "",
-            stderr: `  ${theme.paint("muted", "no dg guard-commit hook in this repo")}\n`
+            stderr: `  ${theme.paint("muted", "no dg commit-guard hook in this repo")}\n`
         };
     }
     const restored = result.removed.some((path) => path.includes(".dg-chained-"));

package/dist/commands/cooldown.js

@@ -4,6 +4,7 @@ import { canonicalCooldownName } from "../policy/pypi-name.js";
 import { ConfigError, loadUserConfig, setConfigValue, updateUserConfig } from "../config/settings.js";
 import { appendCooldownExemptions, cooldownExemptionActive, CooldownExemptionCapError, findProjectRoot, loadDgFile, mutateDgFile, removeCooldownExemptions, resolveAcceptedBy } from "../project/dgfile.js";
 import { EXIT_USAGE } from "./types.js";
+import { sanitizeLine } from "../security/sanitize.js";
 export const cooldownCommand = {
     name: "cooldown",
     summary: "Hold new releases for a window before they can install, with per-package exemptions.",
@@ -342,7 +343,7 @@ function listExemptions(cwd, env, json, now) {
     }
     const rows = file.cooldownExemptions.map((e) => [
         `${e.ecosystem}:${e.name}`,
-        e.reason || "-",
+        sanitizeLine(e.reason) || "-",
         e.acceptedBy || "-",
         e.acceptedAt.slice(0, 10) || "-",
         e.expiresAt ? formatExpiryDisplay(e.expiresAt, e.acceptedAt) : "-",

package/dist/commands/decisions.js

@@ -1,5 +1,6 @@
 import { recordDecisionEvents } from "../decisions/remember-prompt.js";
 import { packageKey } from "../decisions/apply.js";
+import { sanitizeLine } from "../security/sanitize.js";
 import { findProjectRoot, loadDgFile, mutateDgFile, removeDecisions } from "../project/dgfile.js";
 import { EXIT_USAGE } from "./types.js";
 export const decisionsCommand = {
@@ -63,11 +64,11 @@ function listDecisions(cwd, env, json) {
     }
     const rows = file.decisions.map((entry) => [
         entry.id.slice(0, 8),
-        `${entry.ecosystem}:${entry.name}@${scopeLabel(entry)}`,
+        `${entry.ecosystem}:${sanitizeLine(entry.name)}@${scopeLabel(entry)}`,
         findingsLabel(entry),
-        entry.acceptedBy,
-        entry.acceptedAt.slice(0, 10) || "-",
-        entry.expiresAt ? entry.expiresAt.slice(0, 10) : "-",
+        sanitizeLine(entry.acceptedBy),
+        sanitizeLine(entry.acceptedAt).slice(0, 10) || "-",
+        entry.expiresAt ? sanitizeLine(entry.expiresAt).slice(0, 10) : "-",
         isExpired(entry) ? "expired" : "active"
     ]);
     const header = ["ID", "PACKAGE", "ACCEPTED FINDINGS", "BY", "WHEN", "EXPIRES", "STATUS"];
@@ -103,7 +104,7 @@ function revokeDecisions(selector, cwd, env) {
         return { exitCode: 1, stdout: "", stderr: `dg decisions: nothing matches '${selector}' in ${located.file.path}.\n` };
     }
     recordDecisionEvents("decision.revoked", matched.map((entry) => `${entry.ecosystem}:${packageKey(entry.name, scopeLabel(entry))}`), `revoked via dg decisions (${selector})`, env);
-    const lines = matched.map((entry) => `Revoked ${entry.ecosystem}:${entry.name}@${scopeLabel(entry)} (${entry.id.slice(0, 8)}) — the warn will surface again.`);
+    const lines = matched.map((entry) => `Revoked ${entry.ecosystem}:${sanitizeLine(entry.name)}@${scopeLabel(entry)} (${entry.id.slice(0, 8)}) — the warn will surface again.`);
     return { exitCode: 0, stdout: `${lines.join("\n")}\n`, stderr: "" };
 }
 function locateDgFile(cwd, env) {
@@ -133,10 +134,10 @@ function matchesSelector(entry, selector) {
     return entry.name === selector;
 }
 function scopeLabel(entry) {
-    return entry.scope.kind === "exact" ? entry.scope.version : "*";
+    return entry.scope.kind === "exact" ? sanitizeLine(entry.scope.version) : "*";
 }
 function findingsLabel(entry) {
-    const pairs = Object.entries(entry.findings).map(([category, severity]) => `${category}:${severity}`);
+    const pairs = Object.entries(entry.findings).map(([category, severity]) => `${sanitizeLine(category)}:${severity}`);
     return pairs.length > 0 ? pairs.sort().join(",") : "(action-only warn)";
 }
 function isExpired(entry) {

package/dist/commands/help.js

@@ -1,6 +1,7 @@
+import { optionalPackageManagerNames } from "../setup/optional-support.js";
 const PRODUCT_DESCRIPTION = "Dependency Guardian";
-const COMMON_COMMANDS = ["scan", "verify", "audit", "licenses", "setup", "guard-commit", "doctor", "login"];
-const GLOBAL_FLAGS_FOOTER = "Global: --help/-h · --version/-v · --json (where supported) · --no-color / --force-color (also NO_COLOR, FORCE_COLOR).";
+const COMMON_COMMANDS = ["scan", "verify", "audit", "licenses", "setup", "commit-guard", "doctor", "login"];
+const GLOBAL_FLAGS_FOOTER = "Global: --help/-h · --version/-v";
 function isWrapper(command) {
     return command.summary.includes("prefix-mode routing");
 }
@@ -37,7 +38,14 @@ export function renderRootHelp(version, commands, options = {}) {
     for (const command of standalone) {
         lines.push(`  ${command.name.padEnd(14)} ${command.summary}`);
     }
-    lines.push("", "Package-manager prefix mode (run any through dg):", `  ${wrappers.map((command) => command.name).join(", ")}`);
+    const gated = new Set(optionalPackageManagerNames());
+    const wrapperNames = wrappers.map((command) => command.name);
+    const claimed = wrapperNames.filter((name) => !gated.has(name));
+    const gatedNames = wrapperNames.filter((name) => gated.has(name));
+    lines.push("", "Package-manager prefix mode (run any through dg):", `  ${claimed.join(", ")}`);
+    if (gatedNames.length > 0) {
+        lines.push("", "Gated (refuse with exit 69 until their support gate ships):", `  ${gatedNames.join(", ")}`);
+    }
     lines.push("", "Run 'dg <command> --help' for that command's flags and examples.", GLOBAL_FLAGS_FOOTER);
     return `${lines.join("\n")}\n`;
 }

package/dist/commands/licenses.js

@@ -4,7 +4,9 @@ import { writeReportAtomic } from "../util/report-writer.js";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 import { scanProject } from "../scan/discovery.js";
 import { isSupportedLockfilePath, verifyLockfile } from "../verify/preflight.js";
-import { EXIT_ANALYSIS_INCOMPLETE, EXIT_USAGE_VERDICT } from "./types.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_TOOL_ERROR, EXIT_USAGE_VERDICT } from "./types.js";
+import { sanitizeLine } from "../security/sanitize.js";
+import { csvCell } from "../security/csv.js";
 const LICENSE_RISKS = [
     "network-copyleft",
     "no-license",
@@ -40,7 +42,7 @@ export const licensesCommand = {
     examples: ["dg licenses", "dg licenses --markdown -o licenses.md", "dg licenses --fail-on strong-copyleft,network-copyleft"],
     details: [
         "Reports project and lockfile license metadata without running package managers or package code.",
-        "License exports support text, JSON, CSV, and Markdown. Exit codes: 0 pass, 2 policy block, 4 report error, 64 usage error."
+        "License exports support text, JSON, CSV, and Markdown. Exit codes: 0 pass, 2 policy block, 4 analysis incomplete, 64 usage error, 70 write error."
     ],
     handler: (context) => runLicensesCommand(context.args)
 };
@@ -92,7 +94,7 @@ async function runLicensesCommand(args) {
         }
         catch (error) {
             return {
-                exitCode: EXIT_ANALYSIS_INCOMPLETE,
+                exitCode: EXIT_TOOL_ERROR,
                 stdout: "",
                 stderr: `dg licenses could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
             };
@@ -406,10 +408,20 @@ function dedupeEntries(entries) {
     const seen = new Set();
     const deduped = [];
     for (const entry of entries) {
-        const key = `${entry.ecosystem}|${entry.name}|${entry.version ?? ""}|${entry.license ?? ""}|${entry.source}|${entry.location}`;
+        // name / version / license / location come from untrusted lockfiles &
+        // manifests and are rendered to the terminal and md/csv exports — strip
+        // control bytes here, the single point every entry passes through.
+        const clean = {
+            ...entry,
+            name: sanitizeLine(entry.name),
+            ...(entry.version != null ? { version: sanitizeLine(entry.version) } : {}),
+            ...(entry.license != null ? { license: sanitizeLine(entry.license) } : {}),
+            location: sanitizeLine(entry.location)
+        };
+        const key = `${clean.ecosystem}|${clean.name}|${clean.version ?? ""}|${clean.license ?? ""}|${clean.source}|${clean.location}`;
         if (!seen.has(key)) {
             seen.add(key);
-            deduped.push(entry);
+            deduped.push(clean);
         }
     }
     return deduped.sort((left, right) => `${left.ecosystem}:${left.name}`.localeCompare(`${right.ecosystem}:${right.name}`));
@@ -428,9 +440,6 @@ function displayPath(root, path) {
     const display = relativePath.length === 0 ? "." : relativePath;
     return display.split(sep).join("/");
 }
-function csvCell(value) {
-    return /[",\n\r]/u.test(value) ? `"${value.replace(/"/gu, "\"\"")}"` : value;
-}
 function markdownCell(value) {
     return value.replace(/\|/gu, "\\|");
 }

package/dist/commands/login.js

@@ -1,22 +1,26 @@
+import { readFileSync } from "node:fs";
 import { EXIT_TOOL_ERROR, EXIT_USAGE } from "./types.js";
 import { AuthError, writeAuthState } from "../auth/store.js";
 import { ConfigError, loadUserConfig } from "../config/settings.js";
+import { envAuthToken } from "../auth/env-token.js";
 export const loginCommand = {
     name: "login",
     summary: "Authenticate this machine with Dependency Guardian.",
-    usage: "dg login [--token <token>]",
+    usage: "dg login [--token <token> | --token-stdin]",
     flags: [
-        { flag: "--token", value: "<token>", summary: "Authenticate with an API key instead of the browser (for CI/headless)." }
+        { flag: "--token", value: "<token>", summary: "Authenticate with an API key instead of the browser (for CI/headless)." },
+        { flag: "--token-stdin", summary: "Read the API key from stdin, keeping it out of the process list." }
     ],
-    examples: ["dg login", "dg login --token dg_live_…", "DG_API_TOKEN=dg_live_… dg login"],
+    examples: ["dg login", "dg login --token-stdin", "DG_API_TOKEN=dg_live_… dg login"],
     details: [
         "In a terminal, 'dg login' opens your browser to sign in — no token to copy.",
-        "For CI and headless shells, pass --token <key> or set the DG_API_TOKEN environment variable instead.",
+        "For CI and headless shells, set DG_API_TOKEN (or DG_API_KEY) before running 'dg login', pipe the key to --token-stdin, or pass --token <key>.",
+        "Prefer the environment variable or --token-stdin: a key passed as --token <key> is visible to other users in the process list.",
         "Stores dg-owned auth state under the user config directory; never executes project-local code or weakens install enforcement."
     ],
     handler: (context) => loginHandler(context.args)
 };
-function loginHandler(args) {
+export function loginHandler(args, env = process.env, readStdin = readStdinSync) {
     const parsed = parseLoginArgs(args);
     if ("error" in parsed) {
         return {
@@ -25,17 +29,25 @@ function loginHandler(args) {
             stderr: `dg login: ${parsed.error}. Run 'dg login --help'.\n`
         };
     }
+    const resolved = resolveToken(parsed, env, readStdin);
+    if ("error" in resolved) {
+        return {
+            exitCode: EXIT_USAGE,
+            stdout: "",
+            stderr: `dg login: ${resolved.error}. Run 'dg login --help'.\n`
+        };
+    }
     try {
-        const config = loadUserConfig();
+        const config = loadUserConfig(env);
         const state = writeAuthState({
-            token: parsed.token,
+            token: resolved.token,
             apiBaseUrl: config.api.baseUrl,
             orgId: config.org.id
-        });
+        }, env);
         return {
             exitCode: 0,
             stdout: `Logged in to ${state.apiBaseUrl}${state.orgId ? ` for org ${state.orgId}` : ""} with token ${state.tokenPreview}\n`,
-            stderr: ""
+            stderr: resolved.source === "env" ? "Using the API key from DG_API_TOKEN/DG_API_KEY in the environment.\n" : ""
         };
     }
     catch (error) {
@@ -53,16 +65,34 @@ function loginHandler(args) {
         };
     }
 }
+function resolveToken(parsed, env, readStdin) {
+    if (parsed.fromStdin) {
+        const token = readStdin().trim();
+        if (!token) {
+            return { error: "no API key was provided on stdin" };
+        }
+        return { token, source: "stdin" };
+    }
+    if (parsed.token !== undefined) {
+        return { token: parsed.token, source: "flag" };
+    }
+    const fromEnv = envAuthToken(env);
+    if (fromEnv) {
+        return { token: fromEnv, source: "env" };
+    }
+    return {
+        error: "run 'dg login' in a terminal to sign in via your browser, or set DG_API_TOKEN / pipe the key to 'dg login --token-stdin' / pass 'dg login --token <key>' for CI"
+    };
+}
 function parseLoginArgs(args) {
-    let token = "";
+    let token;
+    let fromStdin = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === "--token") {
             const value = args[index + 1];
             if (!value) {
-                return {
-                    error: "--token requires a value"
-                };
+                return { error: "--token requires a value" };
             }
             token = value;
             index += 1;
@@ -70,10 +100,11 @@ function parseLoginArgs(args) {
         else if (arg?.startsWith("--token=")) {
             token = arg.slice("--token=".length);
         }
+        else if (arg === "--token-stdin") {
+            fromStdin = true;
+        }
         else if (arg?.startsWith("-")) {
-            return {
-                error: `unknown option '${arg}'`
-            };
+            return { error: `unknown option '${arg}'` };
         }
         else {
             return {
@@ -81,10 +112,16 @@ function parseLoginArgs(args) {
             };
         }
     }
-    if (!token) {
-        return {
-            error: "run 'dg login' in a terminal to sign in via your browser, or pass --token <key> (or set DG_API_TOKEN) for CI"
-        };
+    if (token !== undefined && fromStdin) {
+        return { error: "--token and --token-stdin cannot be combined" };
+    }
+    return fromStdin ? { fromStdin: true } : token !== undefined ? { token } : {};
+}
+function readStdinSync() {
+    try {
+        return readFileSync(0, "utf8");
+    }
+    catch {
+        return "";
     }
-    return { token };
 }

package/dist/commands/router.js

@@ -3,7 +3,7 @@ import { auditCommand } from "./audit.js";
 import { cooldownCommand } from "./cooldown.js";
 import { decisionsCommand } from "./decisions.js";
 import { doctorCommand } from "./doctor.js";
-import { guardCommitCommand } from "./guard-commit.js";
+import { commitGuardCommand } from "./commit-guard.js";
 import { agentsCommand } from "./agents.js";
 import { renderCommandHelp, renderRootHelp } from "./help.js";
 import { licensesCommand } from "./licenses.js";
@@ -11,6 +11,7 @@ import { sbomCommand } from "./sbom.js";
 import { loginCommand } from "./login.js";
 import { logoutCommand } from "./logout.js";
 import { packageManagerCommands } from "./wrap.js";
+import { isSupportedPackageManager, normalizeManagerName } from "../launcher/classify.js";
 import { scanCommand } from "./scan.js";
 import { serviceCommand } from "./service.js";
 import { setupCommand } from "./setup.js";
@@ -26,7 +27,7 @@ export const commandCatalog = [
     sbomCommand,
     verifyCommand,
     setupCommand,
-    guardCommitCommand,
+    commitGuardCommand,
     agentsCommand,
     decisionsCommand,
     cooldownCommand,
@@ -79,6 +80,15 @@ export async function routeCommand(args) {
     }
     const command = commandCatalog.find((candidate) => candidate.name === commandName || candidate.aliases?.includes(commandName));
     if (!command) {
+        // The pip3 shim execs `dg pip3`, but the wrap catalog holds only canonical
+        // names; fold as the classifier does so `dg pip3 …` reaches the pip manager.
+        const normalizedManager = normalizeManagerName(commandName);
+        if (normalizedManager !== commandName && isSupportedPackageManager(normalizedManager)) {
+            const managerCommand = commandCatalog.find((candidate) => candidate.name === normalizedManager);
+            if (managerCommand) {
+                return managerCommand.handler({ commandPath: [normalizedManager], args: rest });
+            }
+        }
         const suggestion = closestCommand(commandName, commandNames());
         const hint = suggestion ? ` Did you mean '${suggestion}'?` : "";
         return {

package/dist/commands/sbom.js

@@ -2,7 +2,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { basename, resolve } from "node:path";
 import { writeReportAtomic } from "../util/report-writer.js";
 import { discoverScanProjects, SBOM_LOCKFILE_ECOSYSTEMS } from "../scan/collect.js";
-import { buildCycloneDxSbom, collectSbomComponents, readRootComponent } from "../sbom/cyclonedx.js";
+import { bomRefOf, buildCycloneDxSbom, collectSbomComponents, readRootComponent } from "../sbom/cyclonedx.js";
+import { buildDependencyGraph, SBOM_ROOT_REF } from "../sbom/graph.js";
+import { sanitizeLine } from "../security/sanitize.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { buildSbomRows } from "../sbom-ui/inventory.js";
@@ -17,12 +19,12 @@ export const sbomCommand = {
     flags: [
         { flag: "--output", value: "<path>", summary: "Write the document to a file without opening the interactive view (alias -o)." },
         { flag: "--json", summary: "Print the raw CycloneDX document to stdout instead of the interactive view." },
-        { flag: "--reproducible", summary: "Byte-stable output: derive the serial number from the components and drop the timestamp (honors SOURCE_DATE_EPOCH)." }
+        { flag: "--reproducible", summary: "Byte-stable output: derive the serial number from the components and pin the timestamp to SOURCE_DATE_EPOCH (or drop it when that is unset)." }
     ],
     examples: ["dg sbom", "dg sbom -o sbom.cdx.json", "dg sbom --json | cyclonedx validate", "dg sbom --reproducible"],
     details: [
-        "Reads the project's lockfiles and inventories every resolved dependency as a CycloneDX 1.5 component with its purl, license, and integrity hash.",
-        "In a terminal it opens an interactive view: the inventory appears immediately, then dg's scanner runs over the npm and PyPI components and fills in a BLOCK/WARN/PASS verdict per package — malware, provenance downgrades, and cooldown — while cargo stays inventory only. Browse with the arrow keys, search with /, filter with f, and press w to write the document. Signing in unlocks verdicts; without it the view shows the inventory alone.",
+        "Reads the project's lockfiles and inventories each resolved dependency as a CycloneDX 1.5 component with its purl, plus the declared license and integrity hash when the lockfile records them. npm and Cargo lockfiles also yield the dependency graph (which package pulls in which); unpinned dependencies are reported on stderr and left out.",
+        "In a terminal it opens an interactive view: the inventory appears immediately, then dg's scanner runs over the npm and PyPI components and fills in a BLOCK/WARN/PASS verdict per package — malware, provenance downgrades, and cooldown — while cargo stays inventory only. Browse with the arrow keys, search with /, filter with f, and press e to export the document. Signing in unlocks verdicts; without it the view shows the inventory alone.",
         "Piped, with -o, or with --json it stays offline and prints the raw CycloneDX document so you can attach it to a release or feed any CycloneDX-aware tool — no scan, no account needed. Use --reproducible (or set SOURCE_DATE_EPOCH) for identical bytes across runs so a committed SBOM diffs cleanly."
     ],
     handler: (context) => runSbomCommand(context)
@@ -37,11 +39,24 @@ export function runSbomCommand(context, cwd = process.cwd(), now = new Date(), e
     const { components, dropped } = collectSbomComponents(projects);
     const rootComponent = readRootComponent(root);
     const reproducible = parsed.reproducible || env.SOURCE_DATE_EPOCH !== undefined;
+    const componentRefs = new Set(components.map((component) => bomRefOf(component)));
+    const dependencies = buildDependencyGraph(projects, componentRefs);
+    const graphable = projects.length > 0 &&
+        projects.every((project) => project.depFile === "package-lock.json" ||
+            project.depFile === "npm-shrinkwrap.json" ||
+            project.depFile === "Cargo.lock");
+    const completeness = dropped.length === 0 && graphable && dependencies.length > 0 ? "complete" : "incomplete";
+    const rootSubject = rootComponent.component ??
+        (dependencies.some((dependency) => dependency.ref === SBOM_ROOT_REF)
+            ? { name: sanitizeLine(basename(root)) || "root" }
+            : undefined);
     const bom = buildCycloneDxSbom(components, {
         ...timestampOption(reproducible, now, env),
         serialNumber: "urn:uuid:00000000-0000-0000-0000-000000000000",
         toolVersion: dgVersion(),
-        ...(rootComponent.component ? { rootComponent: rootComponent.component } : {})
+        dependencies,
+        completeness,
+        ...(rootSubject ? { rootComponent: rootSubject } : {})
     });
     const finalBom = {
         ...bom,

package/dist/commands/scan.js

@@ -2,18 +2,19 @@ import { runScanCommand } from "../scan/command.js";
 export const scanCommand = {
     name: "scan",
     summary: "Scan a project and show Dependency Guardian findings.",
-    usage: "dg scan [path] [--json|--sarif] [--output <path>]",
+    usage: "dg scan [path] [--json|--sarif] [--output <path>] [--fail-on <block|warn|never>]",
     args: [{ name: "[path]", summary: "Project directory or a package.json to scan (default: current directory)." }],
     flags: [
         { flag: "--json", summary: "Machine-readable JSON report." },
         { flag: "--sarif", summary: "SARIF report for code-scanning tools." },
         { flag: "--output", value: "<path>", summary: "Write the report to a file instead of stdout (alias -o)." },
-        { flag: "--staged", summary: "Scan only the git-staged lockfile changes (what dg guard-commit runs)." },
+        { flag: "--fail-on", value: "<block|warn|never>", summary: "Exit non-zero at or above this level (default: block; never suppresses block/warn exit codes, but analysis-incomplete still exits 4)." },
+        { flag: "--staged", summary: "Scan only the git-staged lockfile changes (what dg commit-guard runs)." },
         { flag: "--no-decisions", summary: "Ignore acceptances remembered in dg.json (see dg decisions)." }
     ],
-    examples: ["dg scan", "dg scan ./packages/api", "dg scan --json -o scan.json", "dg scan --staged"],
+    examples: ["dg scan", "dg scan ./packages/api", "dg scan --json -o scan.json", "dg scan --sarif -o scan.sarif --fail-on never"],
     details: [
-        "Reads lockfiles, scores each dependency through the scanner, and never changes project files. In a terminal it opens the full-screen results browser; piped or with --json/--sarif it prints machine output. Exit codes: 0 clean, 1 warn, 2 block, 4 analysis incomplete, 10 nothing to scan, 64 usage error."
+        "Reads lockfiles, scores each dependency through the scanner, and never changes project files. Requires sign-in — run dg login. In a terminal it opens the full-screen results browser; piped or with --json/--sarif it prints machine output. Exit codes: 0 clean (warn counts as clean under the default --fail-on block), 1 warn with --fail-on warn, 2 block, 4 analysis incomplete, 10 nothing to scan, 64 usage error. Use --fail-on never so a block or warn verdict exits 0; analysis-incomplete (4), nothing-to-scan (10), and a rejected key (64) still exit non-zero, so a broken scan fails loudly instead of uploading an empty report. Add if: always() to the SARIF-upload step so it runs even when dg exits non-zero."
     ],
     handler: runScanCommand
 };

package/dist/commands/service.js

@@ -497,7 +497,7 @@ function serviceDoctorChecks(state) {
         {
             name: "service-proxy",
             status: state.running && state.proxy ? "pass" : state.lastError?.startsWith("stale service runtime state") ? "fail" : "warn",
-            message: state.running && state.proxy ? `Persistent service proxy listening at ${state.proxy.proxyUrl}` : state.lastError ?? "Service proxy is not running"
+            message: state.running && state.proxy ? `Service proxy listening at ${state.proxy.proxyUrl} for this login session (not restarted after reboot or logout)` : state.lastError ?? "Service proxy is not running"
         },
         {
             name: "health-endpoint",