@westbayberry/dg 2.3.2 → 2.3.4

package/dist/commands/setup.js

@@ -15,19 +15,19 @@ import { markSecurityNotesShown, securityNotesShown } from "../setup-ui/gate.js"
 export const setupCommand = {
     name: "setup",
     summary: "Protect this machine — shell installs, AI-agent installs, and a repo's commits.",
-    usage: "dg setup [--print] [--yes] [--agents] [--guard-commit] [--shell <auto|zsh|bash|fish>] [--service]",
+    usage: "dg setup [--print] [--yes] [--agents] [--commit-guard] [--shell <auto|zsh|bash|fish>] [--service]",
     flags: [
         { flag: "--print", summary: "Preview the exact write plan and change nothing." },
-        { flag: "--yes", summary: "Apply the shell firewall only, without prompts (add --agents / --guard-commit to opt in the rest)." },
+        { flag: "--yes", summary: "Apply the shell firewall only, without prompts (add --agents / --commit-guard to opt in the rest)." },
         { flag: "--agents", summary: "With --yes: also route every detected AI agent's installs through dg." },
-        { flag: "--guard-commit", summary: "With --yes: also scan this repo's commits (per-repo)." },
+        { flag: "--commit-guard", summary: "With --yes: also scan this repo's commits (per-repo)." },
         { flag: "--shell", value: "<auto|zsh|bash|fish>", summary: "Target shell rc to write (default: auto-detect)." },
-        { flag: "--service", summary: "Set up service mode (Pro/Team; persistent proxy + managed CA)." }
+        { flag: "--service", summary: "Set up service mode (Pro/Team; long-running local proxy for this login session + managed CA)." }
     ],
     examples: ["dg setup", "dg setup --print", "dg setup --yes --agents", "dg setup --shell zsh --yes"],
     details: [
         "In a terminal it shows one consent screen listing everything it will protect — your shell's installs plus every detected AI agent, with the exact files it writes — and applies them on a single yes. Commits in the current repo are a separate per-repo question.",
-        "Non-interactively, --yes applies just the shell firewall; add --agents and/or --guard-commit to opt those in. --print previews. Writes only dg-owned reversible files; undo it all with dg uninstall."
+        "Non-interactively, --yes applies just the shell firewall; add --agents and/or --commit-guard to opt those in. --print previews. Writes only dg-owned reversible files; undo it all with dg uninstall."
     ],
     handler: (context) => setupHandler(context.args)
 };
@@ -234,7 +234,7 @@ async function applyRequestedSurfaces(parsed) {
             }
         }
     }
-    if (parsed.guardCommit) {
+    if (parsed.commitGuard) {
         const repo = commitGuardOffer();
         if (repo) {
             try {
@@ -254,7 +254,7 @@ function printableSurfaceOffers() {
         lines.push(`would offer: route ${offer.label} installs through dg (--agents)`);
     }
     if (commitGuardOffer()) {
-        lines.push("would offer: scan this repo's commits (--guard-commit)");
+        lines.push("would offer: scan this repo's commits (--commit-guard)");
     }
     return lines.length > 0 ? `\n${lines.join("\n")}\n` : "";
 }
@@ -335,7 +335,7 @@ function parseSetupArgs(args) {
     let shell = "auto";
     let service = false;
     let agents = false;
-    let guardCommit = false;
+    let commitGuard = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === "--print") {
@@ -350,8 +350,8 @@ function parseSetupArgs(args) {
         else if (arg === "--agents") {
             agents = true;
         }
-        else if (arg === "--guard-commit") {
-            guardCommit = true;
+        else if (arg === "--commit-guard") {
+            commitGuard = true;
         }
         else if (arg === "--python-hook" || arg?.startsWith("--python-hook=")) {
             return {
@@ -362,7 +362,7 @@ function parseSetupArgs(args) {
         else if (arg === "--git-hooks") {
             return {
                 exitCode: EXIT_USAGE,
-                error: "dg setup --git-hooks moved — run 'dg guard-commit' inside the repo you want to protect.\n"
+                error: "dg setup --git-hooks moved — run 'dg commit-guard' inside the repo you want to protect.\n"
             };
         }
         else if (arg === "--shell") {
@@ -419,7 +419,7 @@ function parseSetupArgs(args) {
         shell,
         service,
         agents,
-        guardCommit
+        commitGuard
     };
 }
 function parseShell(value) {

package/dist/commands/status.js

@@ -64,7 +64,7 @@ async function buildStatusReport(io) {
 async function fetchStatusUsage(connected, io) {
     const token = connected ? resolveStatusToken() : undefined;
     if (!token) {
-        return { state: "anonymous" };
+        return { state: "signed-out" };
     }
     const account = await fetchAccountStatus(token, process.env, io.fetchImpl ?? fetch, io.usageTimeoutMs ?? STATUS_USAGE_TIMEOUT_MS);
     if (!account || account.scansUsed === null) {
@@ -131,7 +131,7 @@ function renderStatus(report, theme) {
     return `${lines.join("\n")}\n`;
 }
 function usageLine(report, theme) {
-    if (report.usage.state === "anonymous") {
+    if (report.usage.state === "signed-out") {
         return theme.paint("muted", "sign in to see usage");
     }
     if (report.usage.state === "unavailable") {
@@ -147,7 +147,7 @@ function commitGuardLine(state, theme) {
         return `${theme.paint("pass", "✓")} this repo's commits are scanned`;
     }
     if (state === "dead") {
-        return `${theme.paint("warn", "⚠")} installed but git isn't using it — run ${theme.paint("accent", "dg guard-commit --check")}`;
+        return `${theme.paint("warn", "⚠")} installed but git isn't using it — run ${theme.paint("accent", "dg commit-guard --check")}`;
     }
-    return `${theme.paint("warn", "⚠")} off — run ${theme.paint("accent", "dg guard-commit")}`;
+    return `${theme.paint("warn", "⚠")} off — run ${theme.paint("accent", "dg commit-guard")}`;
 }

package/dist/commands/uninstall.js

@@ -8,7 +8,7 @@ export const uninstallCommand = {
     usage: "dg uninstall [--yes] [--service] [--all] [--keep-config]",
     flags: [
         { flag: "--yes", summary: "Remove without the confirmation prompt." },
-        { flag: "--keep-config", summary: "Keep ~/.dg config and cache." },
+        { flag: "--keep-config", summary: "Keep the saved login too (the default removes it; config.json is kept either way unless --all)." },
         { flag: "--all", summary: "Also remove the config directory — a full wipe." },
         { flag: "--service", summary: "Reverse only service-mode writes." }
     ],

package/dist/commands/update.js

@@ -1,7 +1,24 @@
 import { spawnSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { toolInvocation } from "../util/external-tool.js";
+import { resolveDgPaths } from "../state/index.js";
 import { EXIT_USAGE } from "./types.js";
 import { dgVersion } from "./version.js";
+// `dg update` only prints the npm command; the user runs the upgrade manually,
+// during which dg is briefly unavailable. Drop a freshness-stamped sentinel the
+// shim's fail-open self-cleanup honors (15-min window) so a slow `npm install -g`
+// is not mistaken for an uninstall and self-cleaned mid-upgrade.
+function markUpgradeWindow() {
+    try {
+        const dgHome = join(resolveDgPaths().homeDir, ".dg");
+        mkdirSync(dgHome, { recursive: true, mode: 0o700 });
+        writeFileSync(join(dgHome, ".upgrading"), "", { encoding: "utf8", mode: 0o600 });
+    }
+    catch {
+        // best-effort: a missing sentinel only restores the prior 60s-debounce behavior
+    }
+}
 const PACKAGE_NAME = "@westbayberry/dg";
 const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/u;
 export const updateCommand = {
@@ -24,6 +41,9 @@ function runUpdateCommand(args, commandName) {
     }
     const latestVersion = readLatestVersion();
     const report = buildUpdateReport(latestVersion);
+    if (report.updateCommand) {
+        markUpgradeWindow();
+    }
     if (parsed.format === "json") {
         return {
             exitCode: report.status === "unknown" ? 1 : 0,

package/dist/commands/verify.js

@@ -1,4 +1,4 @@
-import { EXIT_ANALYSIS_INCOMPLETE, EXIT_UNAVAILABLE, EXIT_USAGE_VERDICT } from "./types.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_TOOL_ERROR, EXIT_UNAVAILABLE, EXIT_USAGE_VERDICT } from "./types.js";
 import { writeFileSync } from "node:fs";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
@@ -22,8 +22,8 @@ export const verifyCommand = {
     ],
     examples: ["dg verify npm:react", "dg verify pypi:requests@2.31.0", "dg verify ./pkg.tgz --verbose", "dg verify package-lock.json --json"],
     details: [
-        "dg verify npm:react (or pypi:requests, with an optional @version — defaults to latest) runs a real scanner check on a published package before you install it. Signed-out runs show the verdict and top reasons; dg login unlocks full findings, license info, --json, and --output.",
-        "Local paths, workspaces, tgz/zip/wheel artifacts, and lockfiles are verified offline as advisory preflight (free); proxy enforcement remains authoritative for network artifact fetches."
+        "dg verify npm:react (or pypi:requests, with an optional @version — defaults to latest) runs a real scanner check on a published package before you install it. Registry checks require sign-in — run dg login.",
+        "Local paths, workspaces, tgz/zip/wheel artifacts, and lockfiles are verified offline as advisory preflight (no account needed); proxy enforcement remains authoritative for network artifact fetches."
     ],
     handler: (context) => {
         const parsed = parseVerifyArgs(context.args);
@@ -52,7 +52,7 @@ export const verifyCommand = {
             }
             catch (error) {
                 return {
-                    exitCode: EXIT_ANALYSIS_INCOMPLETE,
+                    exitCode: EXIT_TOOL_ERROR,
                     stdout: "",
                     stderr: `dg verify could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
                 };

package/dist/config/settings.js

@@ -11,8 +11,10 @@ export const CONFIG_KEYS = Object.freeze([
     "policy.scriptHardening",
     "policy.shimFailClosed",
     "policy.strictEgress",
+    "policy.allowNonVendorApiHost",
+    "policy.provenanceDowngrade",
     "scriptGate.mode",
-    "scriptGate.observe",
+    "scriptGate.persistObservations",
     "gitHook.onWarn",
     "gitHook.onIncomplete",
     "cooldown.age",
@@ -37,11 +39,13 @@ export const DEFAULT_CONFIG = Object.freeze({
         allowForceOverride: true,
         scriptHardening: false,
         shimFailClosed: false,
-        strictEgress: false
+        strictEgress: false,
+        allowNonVendorApiHost: false,
+        provenanceDowngrade: "off"
     },
     scriptGate: {
         mode: "observe",
-        observe: false
+        persistObservations: false
     },
     gitHook: {
         onWarn: "prompt",
@@ -146,11 +150,17 @@ export function getConfigValue(config, key) {
     if (key === "policy.strictEgress") {
         return String(config.policy.strictEgress);
     }
+    if (key === "policy.allowNonVendorApiHost") {
+        return String(config.policy.allowNonVendorApiHost);
+    }
+    if (key === "policy.provenanceDowngrade") {
+        return config.policy.provenanceDowngrade;
+    }
     if (key === "scriptGate.mode") {
         return config.scriptGate.mode;
     }
-    if (key === "scriptGate.observe") {
-        return String(config.scriptGate.observe);
+    if (key === "scriptGate.persistObservations") {
+        return String(config.scriptGate.persistObservations);
     }
     if (key === "gitHook.onWarn") {
         return config.gitHook.onWarn;
@@ -183,7 +193,8 @@ export const ADVANCED_CONFIG_KEYS = new Set([
     "policy.scriptHardening",
     "policy.shimFailClosed",
     "policy.strictEgress",
-    "scriptGate.observe",
+    "policy.provenanceDowngrade",
+    "scriptGate.persistObservations",
     "cooldown.npm.age",
     "cooldown.pypi.age",
     "cooldown.cargo.age"
@@ -199,7 +210,7 @@ export function setConfigValue(config, key, rawValue) {
         return {
             ...config,
             api: {
-                baseUrl: parseUrl(rawValue)
+                baseUrl: assertVendorApiBaseUrl(parseUrl(rawValue), config.policy.allowNonVendorApiHost)
             }
         };
     }
@@ -235,6 +246,25 @@ export function setConfigValue(config, key, rawValue) {
     if (key === "policy.strictEgress") {
         return withPolicyBoolean(config, "strictEgress", rawValue);
     }
+    if (key === "policy.allowNonVendorApiHost") {
+        const next = withPolicyBoolean(config, "allowNonVendorApiHost", rawValue);
+        if (!next.policy.allowNonVendorApiHost) {
+            const host = new URL(next.api.baseUrl).hostname;
+            if (!isVendorApiHost(host)) {
+                throw new ConfigError(`cannot disable policy.allowNonVendorApiHost while api.baseUrl points at the self-hosted host ${host}; reset api.baseUrl to a vendor host (or unset it) first`);
+            }
+        }
+        return next;
+    }
+    if (key === "policy.provenanceDowngrade") {
+        return {
+            ...config,
+            policy: {
+                ...config.policy,
+                provenanceDowngrade: parseProvenanceDowngradeMode(rawValue)
+            }
+        };
+    }
     if (key === "scriptGate.mode") {
         return {
             ...config,
@@ -244,12 +274,12 @@ export function setConfigValue(config, key, rawValue) {
             }
         };
     }
-    if (key === "scriptGate.observe") {
+    if (key === "scriptGate.persistObservations") {
         return {
             ...config,
             scriptGate: {
                 ...config.scriptGate,
-                observe: parseBoolean(rawValue, key)
+                persistObservations: parseBoolean(rawValue, key)
             }
         };
     }
@@ -317,7 +347,7 @@ function normalizeConfig(raw) {
     const cooldown = fieldObject(raw, "cooldown");
     const audit = fieldObject(raw, "audit");
     const scriptHardening = fieldBoolean(policy, "policy.scriptHardening", "scriptHardening") ?? DEFAULT_CONFIG.policy.scriptHardening;
-    return {
+    const normalized = {
         version: 1,
         api: {
             baseUrl: parseUrl(fieldString(api, "api.baseUrl", "baseUrl") ?? DEFAULT_CONFIG.api.baseUrl)
@@ -331,11 +361,15 @@ function normalizeConfig(raw) {
             allowForceOverride: fieldBoolean(policy, "policy.allowForceOverride", "allowForceOverride") ?? DEFAULT_CONFIG.policy.allowForceOverride,
             scriptHardening,
             shimFailClosed: fieldBoolean(policy, "policy.shimFailClosed", "shimFailClosed") ?? DEFAULT_CONFIG.policy.shimFailClosed,
-            strictEgress: fieldBoolean(policy, "policy.strictEgress", "strictEgress") ?? DEFAULT_CONFIG.policy.strictEgress
+            strictEgress: fieldBoolean(policy, "policy.strictEgress", "strictEgress") ?? DEFAULT_CONFIG.policy.strictEgress,
+            allowNonVendorApiHost: fieldBoolean(policy, "policy.allowNonVendorApiHost", "allowNonVendorApiHost") ?? DEFAULT_CONFIG.policy.allowNonVendorApiHost,
+            provenanceDowngrade: parseProvenanceDowngradeMode(fieldString(policy, "policy.provenanceDowngrade", "provenanceDowngrade") ?? DEFAULT_CONFIG.policy.provenanceDowngrade)
         },
         scriptGate: {
             mode: parseScriptGateMode(fieldString(scriptGate, "scriptGate.mode", "mode") ?? (scriptHardening ? "enforce" : DEFAULT_CONFIG.scriptGate.mode)),
-            observe: fieldBoolean(scriptGate, "scriptGate.observe", "observe") ?? DEFAULT_CONFIG.scriptGate.observe
+            persistObservations: fieldBoolean(scriptGate, "scriptGate.persistObservations", "persistObservations") ??
+                fieldBoolean(scriptGate, "scriptGate.observe", "observe") ??
+                DEFAULT_CONFIG.scriptGate.persistObservations
         },
         gitHook: {
             onWarn: parseOnWarn(fieldString(gitHook, "gitHook.onWarn", "onWarn") ?? DEFAULT_CONFIG.gitHook.onWarn),
@@ -353,6 +387,8 @@ function normalizeConfig(raw) {
             upload: fieldBoolean(audit, "audit.upload", "upload") ?? DEFAULT_CONFIG.audit.upload
         }
     };
+    assertVendorApiBaseUrl(normalized.api.baseUrl, normalized.policy.allowNonVendorApiHost);
+    return normalized;
 }
 function fieldObject(root, field) {
     const value = root[field];
@@ -417,6 +453,12 @@ function parsePolicyMode(value) {
     }
     throw new ConfigError("policy.mode must be one of: off, warn, block, strict");
 }
+function parseProvenanceDowngradeMode(value) {
+    if (value === "off" || value === "warn" || value === "block") {
+        return value;
+    }
+    throw new ConfigError("policy.provenanceDowngrade must be one of: off, warn, block");
+}
 function parseScriptGateMode(value) {
     if (value === "observe" || value === "enforce" || value === "off") {
         return value;
@@ -500,3 +542,30 @@ export function parseUrl(value) {
         throw new ConfigError("api.baseUrl must be an absolute URL");
     }
 }
+// The vendor API host the CLI ships to — derived from the default so there is one
+// source of truth, never a duplicated literal. localhost stays usable for dev.
+export const VENDOR_API_HOST = new URL(DEFAULT_CONFIG.api.baseUrl).hostname;
+export function isVendorApiHost(host) {
+    return host === VENDOR_API_HOST || host === "localhost" || host === "127.0.0.1";
+}
+// The CLI attaches a Bearer token to and trusts scan verdicts from this base URL,
+// so a non-vendor host (a tampered config / auth file, an env-set login base, an
+// unpinned MITM) would leak the token and could return action:pass for malware.
+// Refuse it unless the operator opted into a self-hosted API in their own global
+// config (policy.allowNonVendorApiHost) — a project/repo cannot set that field.
+export function assertVendorApiBaseUrl(baseUrl, allowNonVendor) {
+    if (allowNonVendor) {
+        return baseUrl;
+    }
+    let host;
+    try {
+        host = new URL(baseUrl).hostname;
+    }
+    catch {
+        throw new ConfigError("api.baseUrl must be an absolute URL");
+    }
+    if (!isVendorApiHost(host)) {
+        throw new ConfigError(`api.baseUrl host ${host} is not a Dependency Guardian vendor host; set policy.allowNonVendorApiHost=true to use a self-hosted API`);
+    }
+    return baseUrl;
+}

package/dist/export-ui/ExportDialog.js

@@ -6,7 +6,7 @@ import { existsSync, readdirSync } from "node:fs";
 import { basename, join, resolve, sep } from "node:path";
 import { exportDestinations, resolveExportPath, userHomeDir, writeReportAtomic } from "../util/report-writer.js";
 export function loginRequiredToast() {
-    return `${chalk.yellow("Sign in to export:")} ${chalk.cyan.bold("dg login")} ${chalk.dim("(free account)")}`;
+    return `${chalk.yellow("Sign in to export:")} ${chalk.cyan.bold("dg login")}`;
 }
 const PATH_DISPLAY_MAX = 48;
 function cursorBeforeExtension(name) {

package/dist/gate/cooldown-request.js

@@ -0,0 +1,22 @@
+import { cooldownRequestParam, isCooldownExemptByDgFile } from "../policy/cooldown.js";
+import { DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
+export function resolveCooldownRequest(options, identity) {
+    if (identity.ecosystem === "unknown" || identity.version === "unknown") {
+        return undefined;
+    }
+    if (isCooldownExemptByDgFile(identity.name, identity.ecosystem, options.cooldownExemptions ?? [])) {
+        return undefined;
+    }
+    // A corrupt user config must not silently disable the cooldown gate — fall back
+    // to defaults (24h age + onUnknown=block) so the gate still applies, consistent
+    // with the rest of the policy stack. undefined stays reserved for the legitimate
+    // disabled/exempt cases cooldownRequestParam itself returns.
+    let config;
+    try {
+        config = loadUserConfig(options.env);
+    }
+    catch {
+        config = DEFAULT_CONFIG;
+    }
+    return cooldownRequestParam(config, options.env, identity.ecosystem, identity.name);
+}

package/dist/gate/egress-guard.js

@@ -0,0 +1,185 @@
+import { lookup as dnsLookup } from "node:dns";
+import { hostMatchesList, testUpstreamHostMap } from "./host-match.js";
+// Node's WHATWG URL parser canonicalizes an IPv4-mapped IPv6 literal to the hex
+// hextet form ([::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]), so a guard that
+// only string-matches the dotted-decimal form silently lets the cloud-metadata
+// IP through as "public". Recover the embedded IPv4 (both forms) before
+// classifying so the IPv4 ranges below cover the mapped address too.
+function hextetsToIpv4(hi, lo) {
+    const h = parseInt(hi, 16);
+    const l = parseInt(lo, 16);
+    return `${(h >> 8) & 0xff}.${h & 0xff}.${(l >> 8) & 0xff}.${l & 0xff}`;
+}
+// Recover an IPv4 address embedded in an IPv6 literal so the IPv4 ranges below
+// also cover it. Covers IPv4-mapped (::ffff:), IPv4-compatible (::), 6to4
+// (2002::/16), and NAT64 (64:ff9b::/96) — each a way to smuggle 169.254.169.254
+// past a guard that only string-matches the dotted-decimal form.
+function recoverIpv4MappedHost(host) {
+    const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (mappedDotted?.[1])
+        return mappedDotted[1];
+    const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (mappedHex?.[1] && mappedHex[2])
+        return hextetsToIpv4(mappedHex[1], mappedHex[2]);
+    const compatDotted = /^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (compatDotted?.[1])
+        return compatDotted[1];
+    const compatHex = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (compatHex?.[1] && compatHex[2])
+        return hextetsToIpv4(compatHex[1], compatHex[2]);
+    const sixToFour = /^2002:([0-9a-f]{1,4}):([0-9a-f]{1,4}):/i.exec(host);
+    if (sixToFour?.[1] && sixToFour[2])
+        return hextetsToIpv4(sixToFour[1], sixToFour[2]);
+    const nat64Dotted = /^64:ff9b::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(host);
+    if (nat64Dotted?.[1])
+        return nat64Dotted[1];
+    const nat64Hex = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+    if (nat64Hex?.[1] && nat64Hex[2])
+        return hextetsToIpv4(nat64Hex[1], nat64Hex[2]);
+    return host;
+}
+// Block a RESOLVED address (the actual connect target), so a public hostname
+// whose A/AAAA record points at an internal/metadata IP — DNS-rebinding SSRF —
+// is refused at connect time, not just literal-IP targets.
+export function isBlockedResolvedIp(ip) {
+    const host = recoverIpv4MappedHost(ip.toLowerCase().replace(/^\[/, "").replace(/\]$/, ""));
+    if (host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
+    }
+    if (isPrivateIpv4(host)) {
+        return true;
+    }
+    return /^(fe80|f[cd][0-9a-f]{2}|ff[0-9a-f]{2}):/.test(host);
+}
+function guardedLookup(hostname, options, callback) {
+    const opts = typeof options === "object" && options !== null ? options : {};
+    dnsLookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, "", 0);
+            return;
+        }
+        const list = addresses;
+        const blocked = list.find((entry) => isBlockedResolvedIp(entry.address));
+        if (blocked) {
+            callback(new Error(`refusing to connect to ${hostname}: resolves to blocked address ${blocked.address}. If this is a private/tailnet registry you trust, add its host to DG_PRIVATE_REGISTRY_HOSTS.`), "", 0);
+            return;
+        }
+        if (opts.all === true) {
+            callback(null, list);
+            return;
+        }
+        const first = list[0];
+        if (!first) {
+            callback(new Error(`no address found for ${hostname}`), "", 0);
+            return;
+        }
+        callback(null, first.address, first.family);
+    });
+}
+// The resolved-IP guard exists for DNS rebinding — a PUBLIC hostname whose A/AAAA
+// record points at an internal IP. It must not fire for: an explicitly-configured
+// private registry (DG_PRIVATE_REGISTRY_HOSTS) whose name legitimately resolves to
+// a private IP; a test host-map target; or a target that is ALREADY a private/
+// loopback literal (the user/test pointed there directly — not rebinding, and the
+// link-local/metadata literal is still blocked at the artifact path).
+export function lookupForTarget(target, env) {
+    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    if (hostMatchesList(target.hostname, env.DG_PRIVATE_REGISTRY_HOSTS ?? "")) {
+        return undefined;
+    }
+    if (testUpstreamHostMap(env).has(host)) {
+        return undefined;
+    }
+    if (isPrivateNetworkHost(target)) {
+        return undefined;
+    }
+    return guardedLookup;
+}
+// The direct connect paths run the resolve-and-classify rebind guard via
+// lookupForTarget's custom lookup. When an upstream HTTP/HTTPS proxy is used the
+// proxy resolves the target itself, so that guard never runs — pre-resolve here
+// and refuse a public target that resolves into a blocked range, mirroring the
+// same exemptions (private registry / test host-map / already-private literal).
+// Best-effort: a resolution failure surfaces later as the real connect error.
+export async function assertTargetEgressAllowed(target, env) {
+    if (lookupForTarget(target, env) === undefined) {
+        return;
+    }
+    const host = target.hostname.replace(/^\[(.*)\]$/, "$1");
+    const addresses = await new Promise((resolve) => {
+        dnsLookup(host, { all: true }, (err, list) => {
+            resolve(err ? [] : list);
+        });
+    });
+    const blocked = addresses.find((entry) => isBlockedResolvedIp(entry.address));
+    if (blocked) {
+        throw new Error(`refusing to connect to ${host} via the upstream proxy: resolves to blocked address ${blocked.address}. If this is a private/tailnet registry you trust, add its host to DG_PRIVATE_REGISTRY_HOSTS.`);
+    }
+}
+// Non-globally-routable / special-purpose IPv4 ranges. None is ever a legitimate
+// public registry, so a public hostname resolving into one is SSRF, and a direct
+// literal target there is the user's own choice (handled by the callers). Covers
+// RFC1918 + loopback + link-local + CGNAT, plus the special-purpose ranges that
+// are still connectable: 198.18/15 benchmarking, 192.0.0/24 IETF, the TEST-NET
+// documentation blocks, and multicast / reserved 224.0.0.0/3 (224-255).
+function isPrivateIpv4(host) {
+    return (/^(127|10|0)\./.test(host) ||
+        /^192\.168\./.test(host) ||
+        /^169\.254\./.test(host) ||
+        /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host) ||
+        /^100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\./.test(host) ||
+        /^198\.1[89]\./.test(host) ||
+        /^192\.0\.0\./.test(host) ||
+        /^192\.0\.2\./.test(host) ||
+        /^198\.51\.100\./.test(host) ||
+        /^203\.0\.113\./.test(host) ||
+        /^(22[4-9]|23[0-9]|24[0-9]|25[0-5])\./.test(host));
+}
+export function isPrivateNetworkHost(url) {
+    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    const host = recoverIpv4MappedHost(raw);
+    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || host === "::" || host === "::1") {
+        return true;
+    }
+    if (isPrivateIpv4(host)) {
+        return true;
+    }
+    return /^(fe80|f[cd][0-9a-f]{2}|ff[0-9a-f]{2}):/.test(host);
+}
+// Zero-expand a compressed IPv6 literal to its eight bare-hextet form so an
+// exact metadata-address compare matches regardless of "::" placement. Returns
+// the input unchanged for anything that is not a plain IPv6 literal.
+function normalizeIpv6(host) {
+    if (host.includes(".") || !host.includes(":") || !/^[0-9a-f:]+$/i.test(host)) {
+        return host;
+    }
+    const sides = host.split("::");
+    if (sides.length > 2) {
+        return host;
+    }
+    const head = sides[0] ? sides[0].split(":") : [];
+    const tail = sides.length === 2 && sides[1] ? sides[1].split(":") : [];
+    let parts;
+    if (sides.length === 2) {
+        const missing = 8 - head.length - tail.length;
+        if (missing < 0)
+            return host;
+        parts = [...head, ...Array(missing).fill("0"), ...tail];
+    }
+    else {
+        parts = head;
+    }
+    if (parts.length !== 8) {
+        return host;
+    }
+    return parts.map((part) => parseInt(part, 16).toString(16)).join(":");
+}
+// The AWS IPv6 IMDS endpoint is a ULA (fd00::/8), so it is not caught by the
+// fe80 link-local check; match the exact metadata literal only — broadening to
+// all of fd00::/8 would refuse legitimate private/tailnet registries.
+const IPV6_METADATA_HOST = "fd00:ec2:0:0:0:0:0:254";
+export function isLinkLocalHost(url) {
+    const raw = url.hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    const host = recoverIpv4MappedHost(raw);
+    return /^169\.254\./.test(host) || /^fe80:/.test(host) || normalizeIpv6(host) === IPV6_METADATA_HOST;
+}

package/dist/gate/host-match.js

@@ -0,0 +1,48 @@
+export function hostMatchesList(host, rawList) {
+    const normalized = normalizeHost(host);
+    return rawList.split(",").map((entry) => entry.trim()).filter(Boolean).some((pattern) => hostMatchesPattern(normalized, pattern));
+}
+function hostMatchesPattern(host, pattern) {
+    const normalized = normalizeHost(pattern);
+    if (normalized.startsWith("*.")) {
+        const suffix = normalized.slice(1);
+        return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === normalized;
+}
+function normalizeHost(host) {
+    return host.replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "").toLowerCase();
+}
+export function testUpstreamHostMap(env) {
+    if (env.NODE_ENV !== "test") {
+        return new Map();
+    }
+    const entries = (env.DG_TEST_UPSTREAM_HOST_MAP ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => {
+        const separator = entry.indexOf("=");
+        if (separator <= 0) {
+            return null;
+        }
+        const target = entry.slice(separator + 1);
+        // The seam only exists to point a public host at a LOOPBACK mock in tests.
+        // Refusing any non-loopback target stops an attacker who can set
+        // NODE_ENV=test from redirecting a registry fetch to an external/internal
+        // host (SSRF) and from disabling the egress DNS guard for it.
+        if (!isLoopbackHost(target)) {
+            return null;
+        }
+        return [entry.slice(0, separator), target];
+    })
+        .filter((entry) => entry !== null);
+    return new Map(entries);
+}
+export function isLoopbackHost(value) {
+    const host = normalizeHost(value);
+    // Only the 127.0.0.0/8 IPv4 literal range is loopback — anchor to a full dotted
+    // quad so a hostname like 127.evil.com (which resolves anywhere) is NOT treated
+    // as loopback and cannot slip past the SSRF confinement.
+    return host === "localhost" || host === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}(?::\d+)?$/.test(host);
+}