@westbayberry/dg 2.3.2 → 2.3.4

package/dist/launcher/agent-hook-exec.js

@@ -3,13 +3,20 @@ import { runAgentHookExec } from "./agent-hook-io.js";
 import { getAgent, isAgentId } from "../agents/registry.js";
 import { resolveDgPaths } from "../state/index.js";
 import { writeJsonAtomic } from "../util/json-file.js";
+const MAX_HOOK_STDIN_BYTES = 8 * 1024 * 1024;
 async function readStdin(stream = process.stdin) {
     if (stream.isTTY) {
         return "";
     }
     const chunks = [];
+    let total = 0;
     for await (const chunk of stream) {
-        chunks.push(chunk);
+        const buffer = chunk;
+        total += buffer.length;
+        if (total > MAX_HOOK_STDIN_BYTES) {
+            throw new Error(`hook stdin exceeded ${MAX_HOOK_STDIN_BYTES} bytes`);
+        }
+        chunks.push(buffer);
     }
     return Buffer.concat(chunks).toString("utf8");
 }

package/dist/launcher/agent-hook-io.js

@@ -1,6 +1,7 @@
 import { agentCheckCommand, ESCALATE, formatScreenedNote } from "./agent-check.js";
 import { getAgent } from "../agents/registry.js";
 import { redactSecrets } from "./output-redaction.js";
+import { maybeUpdateNudge } from "../runtime/nudges.js";
 export async function runAgentHookExec(agent, stdin, deps = {}) {
     const integration = getAgent(agent);
     const parsed = integration.parseInput(stdin);
@@ -27,13 +28,14 @@ export async function runAgentHookExec(agent, stdin, deps = {}) {
         verdict = { decision: "deny", reason: `dg hook: the firewall check failed, so the install is blocked. ${ESCALATE}` };
     }
     const emitted = integration.emitDecision(verdict);
-    const stderr = allowStderr(verdict);
+    const stderr = allowStderr(verdict, deps.env);
     return { stdout: emitted.stdout, stderr, exitCode: emitted.exitCode };
 }
-function allowStderr(verdict) {
+function allowStderr(verdict, env) {
     if (verdict.decision !== "allow") {
         return `  ${redactSecrets(verdict.reason ?? "DG firewall")}\n`;
     }
     const note = verdict.screened ? formatScreenedNote(verdict.screened) : "";
-    return note ? `  ${redactSecrets(note)}\n` : "";
+    const noteLine = note ? `  ${redactSecrets(note)}\n` : "";
+    return noteLine + maybeUpdateNudge(env ? { env } : {});
 }

package/dist/launcher/classify.js

@@ -1,17 +1,35 @@
 import { optionalPackageManagerNames, optionalSupportGate } from "../setup/optional-support.js";
 const supportedManagers = ["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pipx", "uv", "uvx", "cargo"];
 const gatedManagers = optionalPackageManagerNames();
-const jsProtected = new Set(["install", "i", "ci", "add", "update", "dedupe", "exec", "create"]);
-const pnpmProtected = new Set(["install", "i", "add", "update", "dlx", "exec", "create"]);
-const yarnProtected = new Set(["add", "install", "upgrade", "dlx", "create"]);
+// npm resolves many spellings to the same fetch/run command via its cmd-list.js
+// alias table — `x`=exec (remote fetch-and-run, like npx), `in`/`ins`/`isntall`/…
+// =install, `it`=install-test, `cit`/`sit`=install-ci-test, `ic`=ci, `up`=update.
+// Each fetches or runs package code, so each must gate exactly like its canonical
+// verb; otherwise `npm x evil` / `npm in evil` install ungated. Spelled out (not
+// abbrev-derived) so the gate set stays reviewable; classify-aliases.test.ts pins
+// it against npm's own table.
+const jsProtected = new Set([
+    "install", "i", "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall",
+    "ci", "ic", "clean-install", "install-clean", "isntall-clean",
+    "install-test", "it",
+    "install-ci-test", "cit", "sit", "clean-install-test",
+    "add", "update", "up", "upgrade", "udpate", "dedupe", "ddp",
+    "exec", "x", "create",
+]);
+const pnpmProtected = new Set(["install", "i", "add", "update", "up", "upgrade", "dlx", "fetch", "exec", "create"]);
+const yarnProtected = new Set(["add", "install", "up", "upgrade", "dlx", "create"]);
 const pipProtected = new Set(["install", "download", "wheel"]);
-const pipxProtected = new Set(["install", "upgrade", "inject", "run"]);
+// `upgrade-all`/`reinstall`/`reinstall-all`/`install-all` each re-fetch and run
+// package code just like `upgrade`/`install`; without them the `-all` and
+// `reinstall` forms slip past as passthrough (the prefix gap that let
+// `pipx upgrade` gate but `pipx upgrade-all` install unscanned).
+const pipxProtected = new Set(["install", "install-all", "upgrade", "upgrade-all", "reinstall", "reinstall-all", "inject", "run"]);
 const uvProtected = new Set(["add", "sync"]);
 // Only the dependency-set-changing verbs. `build`/`test`/`run`/`check` compile
 // local code (the npm `run`/`build` analog, which is passthrough) and crates are
 // not analyzable yet, so gating them just interrupts every Rust build with no
 // screening value.
-const cargoProtected = new Set(["add", "install", "fetch", "update"]);
+const cargoProtected = new Set(["add", "install", "fetch", "update", "binstall"]);
 const passthrough = new Set(["help", "--help", "-h", "version", "--version", "-v", "list", "ls", "show", "freeze"]);
 // Recognized read-only / local / script subcommands across the managers. Used
 // only to locate the real subcommand when a global value-flag puts a non-verb
@@ -29,20 +47,44 @@ const READ_ONLY_VERBS = new Set([
     "logout", "login", "adduser", "owner", "set", "init", "licenses",
     "freeze", "check", "uninstall", "debug", "hash", "inspect", "index", "tree", "lock", "venv", "export", "python", "self",
 ]);
-function findAction(args, protectedCommands) {
-    let firstPositional;
-    for (const arg of args) {
-        if (arg.startsWith("-")) {
+// Verbs/subcommands that always indicate a uv install/fetch path — the guard set
+// for uv so positional resolution never skips over a real install token.
+const UV_GUARD = new Set(["pip", "tool", "run", "build", "add", "sync", "install", "upgrade", "download", "wheel"]);
+// Positional (non-flag) tokens, with each flag's value argument skipped so a
+// flag VALUE can't masquerade as the subcommand/verb (`npm --user-agent run
+// install x`, `uv --cache-dir /tmp tool install x`). We conservatively treat
+// EVERY non-attached flag as potentially value-consuming rather than maintain a
+// per-manager flag allowlist (which always drifts and re-opens the bypass). Two
+// invariants keep this fail-closed: never skip a token that is itself a protected
+// (install) command, and never skip another flag — so a misjudged boolean flag
+// can at worst over-screen the rare `<flag> run <install-named-script>` form, it
+// can never wave a real install through.
+function positionalArgs(args, protectedCommands) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === undefined) {
             continue;
         }
-        if (firstPositional === undefined) {
-            firstPositional = arg;
+        if (a.startsWith("-")) {
+            const next = args[i + 1];
+            if (!a.includes("=") && next !== undefined && !next.startsWith("-") && !protectedCommands.has(next)) {
+                i++;
+            }
+            continue;
         }
-        if (protectedCommands.has(arg) || READ_ONLY_VERBS.has(arg)) {
-            return arg;
+        out.push(a);
+    }
+    return out;
+}
+function findAction(args, protectedCommands) {
+    const positionals = positionalArgs(args, protectedCommands);
+    for (const token of positionals) {
+        if (protectedCommands.has(token) || READ_ONLY_VERBS.has(token)) {
+            return token;
         }
     }
-    return firstPositional ?? "";
+    return positionals[0] ?? "";
 }
 // pip3, pip3.12, python3, python3.11 are the canonical install commands on
 // macOS/Homebrew and many Linux distros (see BINARY_FALLBACKS in
@@ -51,8 +93,16 @@ function findAction(args, protectedCommands) {
 // through to a silent allow. `pipx`/`pipenv` are left untouched — only a bare
 // numeric/dotted version suffix is stripped.
 export function normalizeManagerName(name) {
-    const m = /^(pip|python)(\d+(?:\.\d+)*)?$/.exec(name);
-    return m && m[1] ? m[1] : name;
+    // The OS resolves a binary name case-insensitively on macOS, so `NPM`/`Pip3`
+    // run the real lowercase manager; fold the head toward the lowercase manager
+    // tables (the single source of truth) or it short-circuits to an unscreened
+    // ALLOW. Only the manager head is folded — package names keep their case.
+    // On Windows the manager is invoked through a launcher with an executable
+    // extension (npm.cmd, pnpm.cmd, yarn.cmd, pip.exe); strip it or the head never
+    // matches the manager tables and short-circuits to an unscreened ALLOW.
+    const lower = name.toLowerCase().replace(/\.(?:cmd|exe|bat|ps1)$/, "");
+    const m = /^(pip|python)(\d+(?:\.\d+)*)?$/.exec(lower);
+    return m && m[1] ? m[1] : lower;
 }
 export function packageManagerNames() {
     return [...supportedManagers, ...gatedManagers];
@@ -79,7 +129,7 @@ export function classifyPackageManagerInvocation(rawManager, args) {
         // dependency; classify it protected rather than passthrough. Read-only
         // version/help invocations stay passthrough.
         const readOnlyFlag = args.some((a) => a === "--version" || a === "-v" || a === "--help" || a === "-h");
-        if (firstCommand(args) === "" && !readOnlyFlag) {
+        if (positionalArgs(args, yarnProtected).length === 0 && !readOnlyFlag) {
             return protectedClassification("yarn", args, "yarn", "bare yarn installs all lockfile dependencies");
         }
         return classifyByCommand(manager, args, "yarn", yarnProtected, "Yarn classic install/fetch command", "javascript");
@@ -119,17 +169,25 @@ function classifyByCommand(manager, args, realBinaryName, protectedCommands, pro
     };
 }
 function classifyUv(args) {
-    const action = firstCommand(args);
-    if (action === "pip" && pipProtected.has(args[1] ?? "")) {
-        return protectedClassification("uv", args, "uv", "uv pip install/fetch command");
+    // Skip value-flags so a flag value can't masquerade as the subcommand/verb
+    // (`uv --cache-dir /tmp tool install x`, `uv -q tool install x`).
+    const positionals = positionalArgs(args, UV_GUARD);
+    const action = positionals[0] ?? "";
+    const subVerb = positionals[1] ?? "";
+    // `uv pip sync` installs/removes packages to match a requirements set — a
+    // uv-only verb regular pip lacks, so it isn't in pipProtected — and must gate
+    // like `uv pip install`.
+    if (action === "pip" && (pipProtected.has(subVerb) || subVerb === "sync")) {
+        return protectedClassification("uv", args, "uv", "uv pip install/sync/fetch command");
     }
-    if (action === "tool" && ["run", "install", "upgrade"].includes(args[1] ?? "")) {
+    if (action === "tool" && ["run", "install", "upgrade"].includes(subVerb)) {
         return protectedClassification("uv", args, "uv", "uv tool run/install/upgrade fetches package artifacts");
     }
-    if (action === "run" && uvRunFetchesPackage(args)) {
-        // `uv run --with <pkg> …` fetches <pkg> from PyPI and runs it: a real
-        // fetch-and-execute path that the bare `run` verb otherwise waves through.
-        return protectedClassification("uv", args, "uv", "uv run --with fetches and runs a package");
+    if (action === "run" && !uvRunSkipsDependencyFetch(args)) {
+        return protectedClassification("uv", args, "uv", "uv run syncs project/script dependencies from PyPI before executing");
+    }
+    if (action === "build" && !uvArgPresent(args, "--no-build-isolation")) {
+        return protectedClassification("uv", args, "uv", "uv build fetches PEP 517 build backends into an isolated environment");
     }
     if (uvProtected.has(action)) {
         return protectedClassification("uv", args, "uv", "uv install/fetch command");
@@ -181,5 +239,31 @@ function initFetchesPackage(action, args, protectedCommands) {
     return args.slice(commandIndex + 1).some((arg) => arg !== "--" && !arg.startsWith("-"));
 }
 export function uvRunFetchesPackage(args) {
-    return args.some((a) => a === "--with" || a === "--with-editable" || a === "--with-requirements" || a.startsWith("--with="));
+    // uv accepts the glued `--flag=value` form for every long flag, so the
+    // attached spellings must gate exactly like the space-separated ones or
+    // `uv run --with-requirements=evil.txt cmd` fetches and runs unscanned.
+    return args.some((a) => a === "--with" ||
+        a.startsWith("--with=") ||
+        a === "--with-editable" ||
+        a.startsWith("--with-editable=") ||
+        a === "--with-requirements" ||
+        a.startsWith("--with-requirements="));
+}
+function uvArgPresent(args, flag) {
+    return args.some((a) => a === flag || a.startsWith(`${flag}=`));
+}
+// `uv run` syncs the project's declared dependencies (pyproject.toml/uv.lock) and
+// any PEP 723 inline-script deps from PyPI before executing, so it is protected by
+// default. `--no-sync` alone still lets the project load; only dropping the project
+// too (`--no-project`) removes the last sync path, and `--offline` forbids any
+// fetch outright. An explicit `--with`/`--script` names remote deps that those
+// suppressors do not cover, so it stays gated regardless.
+export function uvRunSkipsDependencyFetch(args) {
+    if (uvArgPresent(args, "--script") || uvRunFetchesPackage(args)) {
+        return false;
+    }
+    if (uvArgPresent(args, "--offline")) {
+        return true;
+    }
+    return uvArgPresent(args, "--no-sync") && uvArgPresent(args, "--no-project");
 }

package/dist/launcher/env.js

@@ -1,4 +1,4 @@
-import { dirname } from "node:path";
+import { dirname, join } from "node:path";
 import { proxyUrlWithAuth, readProxyAuthToken } from "../proxy/auth.js";
 // The client read timeout must exceed the proxy's per-artifact verdict ceiling
 // (DG_INSTALL_VERDICT_TIMEOUT_MS, default 240s) plus download headroom, so the
@@ -50,6 +50,85 @@ export function buildAgentRoutingEnv(proxyUrl, caPath) {
         CARGO_HTTP_CAINFO: caPath,
     };
 }
+// Point a manager at the local registry origin, env-only — never the user's
+// real ~/.npmrc / pip.conf / ~/.cargo/config.toml. npm keeps dist.tarball
+// canonical and disables host rewriting so committed lockfiles stay portable
+// (the tarball is gated by the proxy tier — the npm hybrid the P0 spike settled);
+// pip/uv get the loopback simple index; cargo routes through a throwaway
+// CARGO_HOME whose config.toml is written separately.
+export function buildRegistryOriginEnv(options) {
+    const env = scrubChildSecrets({ ...options.baseEnv, DG_REGISTRY_ORIGIN_ACTIVE: "1" });
+    const noProxy = "127.0.0.1,localhost";
+    env.NO_PROXY = noProxy;
+    env.no_proxy = noProxy;
+    const origin = ensureTrailingSlash(options.originUrl);
+    const host = new URL(options.originUrl).hostname;
+    if (["npm", "npx", "pnpm", "pnpx", "yarn"].includes(options.manager)) {
+        env.npm_config_registry = origin;
+        env.npm_config_replace_registry_host = "never";
+        if (options.manager === "yarn") {
+            env.YARN_NPM_REGISTRY_SERVER = options.originUrl;
+        }
+    }
+    else if (options.manager === "pip" || options.manager === "pipx") {
+        env.PIP_INDEX_URL = `${origin}simple/`;
+        env.PIP_TRUSTED_HOST = host;
+        scrubSupplementaryIndexes(env);
+    }
+    else if (options.manager === "uv" || options.manager === "uvx") {
+        env.UV_DEFAULT_INDEX = `${origin}simple/`;
+        scrubSupplementaryIndexes(env);
+    }
+    else if (options.cargoHome) {
+        env.CARGO_HOME = options.cargoHome;
+    }
+    applyCacheBust(env, options.manager, options.cacheDir);
+    return env;
+}
+function ensureTrailingSlash(url) {
+    return url.endsWith("/") ? url : `${url}/`;
+}
+// Precedence already steers an install with a supplementary index to the proxy
+// door, but when the origin door IS used the pip/uv child must fetch ONLY from the
+// origin — drop any inherited extra-index / find-links source so a precedence gap
+// can never leave a second, un-fronted package source active. Defense in depth.
+function scrubSupplementaryIndexes(env) {
+    for (const key of ["PIP_EXTRA_INDEX_URL", "PIP_FIND_LINKS", "UV_EXTRA_INDEX_URL", "UV_INDEX", "UV_FIND_LINKS"]) {
+        delete env[key];
+    }
+}
+// A warm package-manager cache serves an artifact with no network, skipping
+// whichever door is active, so both env builders force a re-fetch through a
+// throwaway cache (or PIP_NO_CACHE_DIR / UV_NO_CACHE where the manager has no
+// redirectable cache dir). Shared so the proxy and origin paths cannot drift.
+function applyCacheBust(env, manager, cacheDir) {
+    if (manager === "pip" || manager === "pipx") {
+        env.PIP_NO_CACHE_DIR = "1";
+    }
+    if (manager === "uv" || manager === "uvx") {
+        env.UV_NO_CACHE = "1";
+    }
+    if (!cacheDir) {
+        return;
+    }
+    if (["npm", "npx", "pnpm", "pnpx", "yarn"].includes(manager)) {
+        env.npm_config_cache = cacheDir;
+        if (manager === "pnpm" || manager === "pnpx") {
+            // pnpm links packages from a global content-addressable store, not the
+            // npm cache; a package already in the user's ~/.pnpm-store installs with
+            // zero network and skips the origin entirely. Point the store at a
+            // dg-owned dir so every package is fetched (and gated) at least once.
+            env.npm_config_store_dir = join(cacheDir, "pnpm-store");
+        }
+        if (manager === "yarn") {
+            env.YARN_CACHE_FOLDER = cacheDir;
+            env.YARN_GLOBAL_FOLDER = cacheDir;
+        }
+    }
+    if (manager === "cargo") {
+        env.CARGO_HOME = cacheDir;
+    }
+}
 export function buildProxyChildEnv(options) {
     const authToken = readProxyAuthToken(dirname(options.caBundlePath));
     const proxyUrl = authToken ? proxyUrlWithAuth(options.proxyUrl, authToken) : options.proxyUrl;
@@ -88,16 +167,7 @@ export function buildProxyChildEnv(options) {
             env.YARN_HTTPS_PROXY = proxyUrl;
             env.YARN_HTTPS_CA_FILE_PATH = options.caBundlePath;
         }
-        if (options.cacheDir) {
-            env.npm_config_cache = options.cacheDir;
-            if (options.manager === "yarn") {
-                // Both: YARN_CACHE_FOLDER is Berry's per-project cache, but Berry 2+
-                // defaults to a shared global cache (~/.yarn/berry) that a warm install
-                // serves from without ever fetching, so redirect that too.
-                env.YARN_CACHE_FOLDER = options.cacheDir;
-                env.YARN_GLOBAL_FOLDER = options.cacheDir;
-            }
-        }
+        applyCacheBust(env, options.manager, options.cacheDir);
         return env;
     }
     if (options.manager === "pip" || options.manager === "pipx") {
@@ -105,8 +175,8 @@ export function buildProxyChildEnv(options) {
         env.https_proxy = proxyUrl;
         env.REQUESTS_CA_BUNDLE = options.caBundlePath;
         env.PIP_CERT = options.caBundlePath;
-        env.PIP_NO_CACHE_DIR = "1";
         env.PIP_DEFAULT_TIMEOUT = String(readTimeoutSeconds);
+        applyCacheBust(env, options.manager, options.cacheDir);
         return env;
     }
     if (options.manager === "uv" || options.manager === "uvx") {
@@ -114,8 +184,8 @@ export function buildProxyChildEnv(options) {
         env.HTTPS_PROXY = proxyUrl;
         env.ALL_PROXY = proxyUrl;
         env.SSL_CERT_FILE = options.caBundlePath;
-        env.UV_NO_CACHE = "1";
         env.UV_HTTP_TIMEOUT = String(readTimeoutSeconds);
+        applyCacheBust(env, options.manager, options.cacheDir);
         return env;
     }
     env.HTTPS_PROXY = proxyUrl;
@@ -123,10 +193,6 @@ export function buildProxyChildEnv(options) {
     env.http_proxy = proxyUrl;
     env.CARGO_HTTP_CAINFO = options.caBundlePath;
     env.CARGO_HTTP_TIMEOUT = String(readTimeoutSeconds);
-    if (options.cacheDir) {
-        // cargo serves a cached crate from ~/.cargo with zero network, skipping the
-        // firewall; pointing CARGO_HOME at the throwaway dir forces a re-fetch.
-        env.CARGO_HOME = options.cacheDir;
-    }
+    applyCacheBust(env, options.manager, options.cacheDir);
     return env;
 }

package/dist/launcher/install-preflight.js

@@ -11,6 +11,7 @@ import { cooldownRequestParam, formatCooldownDuration, formatPackageAge, isCoold
 import { findProjectRoot, loadDgFile, resolveAcceptedBy, warnUnreadableDgFile } from "../project/dgfile.js";
 import { parsePipReportInstallCount, parsePipReportInstallSet } from "./pip-report.js";
 import { resolveSpawnInvocation } from "./spawn-invocation.js";
+import { scrubChildSecrets } from "./env.js";
 export function resolvePreflightCooldown(env, ecosystem) {
     // A corrupt user config must not silently disable the cooldown gate; fall back
     // to defaults so any env-configured cooldown is still applied.
@@ -54,6 +55,10 @@ export function resolvePreflightDecisions(ecosystem, cwd, env = process.env) {
 }
 const PROCEED = { proceed: true };
 const UNRESOLVED = { set: undefined, count: undefined };
+// pip controls the --report shape, but a hostile index can inflate it; cap the
+// captured bytes so the preflight degrades to the per-artifact proxy path rather
+// than buffering an unbounded report on the dev/CI machine.
+const MAX_PIP_REPORT_BYTES = 16 * 1024 * 1024;
 const approvedFlagRanks = new Map();
 const pipResolutions = new Map();
 export function resetInstallPreflightSession() {
@@ -108,8 +113,12 @@ function resolvePipInstallSet(binary, args, env) {
         let child;
         try {
             const invocation = resolveSpawnInvocation(binary, [...args, "--dry-run", "--report", "-", "--quiet"]);
+            // pip's dry-run resolve builds sdists without a wheel / PEP 658 metadata,
+            // invoking arbitrary PEP 517 build backends from the package being resolved.
+            // Scrub the dg credential first — the same protection every other spawn path
+            // applies — so DG_API_KEY/DG_API_TOKEN never reaches untrusted build code.
             child = spawn(invocation.command, [...invocation.args], {
-                env,
+                env: scrubChildSecrets({ ...env }),
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsVerbatimArguments: invocation.windowsVerbatimArguments
             });
@@ -125,7 +134,21 @@ function resolvePipInstallSet(binary, args, env) {
             catch { /* already exited */ }
             finish(UNRESOLVED);
         }, pipResolveTimeoutMs(env));
-        child.stdout?.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        let stdoutBytes = 0;
+        child.stdout?.on("data", (chunk) => {
+            if (settled)
+                return;
+            stdoutBytes += chunk.length;
+            if (stdoutBytes > MAX_PIP_REPORT_BYTES) {
+                try {
+                    child.kill();
+                }
+                catch { /* already exited */ }
+                finish(UNRESOLVED);
+                return;
+            }
+            stdout += chunk.toString("utf8");
+        });
         child.on("error", () => finish(UNRESOLVED));
         child.on("close", (code) => finish(code === 0
             ? { set: parsePipReportInstallSet(stdout), count: parsePipReportInstallCount(stdout) }
@@ -197,7 +220,7 @@ export async function runInstallPreflight(manager, binary, childArgs, env, cwd =
     const cooldownContext = resolvePreflightCooldown(env, "pypi");
     let verdicts;
     try {
-        verdicts = await analyzePackages(set.map((pkg) => ({ name: pkg.name, version: pkg.version })), { ecosystem: "pypi", env, ...(cooldownContext ? { cooldown: cooldownContext.param } : {}) });
+        verdicts = await analyzePackages(set.map((pkg) => ({ name: pkg.name, version: pkg.version })), { ecosystem: "pypi", env, publicFallback: true, ...(cooldownContext ? { cooldown: cooldownContext.param } : {}) });
     }
     catch {
         process.stderr.write("  dg: pre-install check unavailable — verifying during install instead\n");

package/dist/launcher/live-install.js

@@ -1,8 +1,9 @@
-import { createLaunchPlan, prepareProxyWorker, runWithProductionProxyLive, EXIT_INSTALL_BLOCKED } from "./run.js";
+import { createLaunchPlan, prepareProxyWorker, runWithProductionProxyLive, meterInstallTree, EXIT_INSTALL_BLOCKED } from "./run.js";
 import { runInstallPreflight } from "./install-preflight.js";
 import { isSupportedPackageManager, normalizeManagerName } from "./classify.js";
 import { isCiEnv, resolvePresentation } from "../presentation/mode.js";
 import { startPrepSpinner } from "../install-ui/prep-spinner.js";
+import { redactSecrets } from "./output-redaction.js";
 const FALL_THROUGH = { handled: false };
 export async function maybeRunLiveInstall(args, options = {}) {
     const env = options.env ?? process.env;
@@ -52,6 +53,7 @@ export async function maybeRunLiveInstall(args, options = {}) {
     try {
         const { renderLiveInstall } = await appLoading;
         const result = await renderLiveInstall((onView) => runWithProductionProxyLive(plan, childArgs, runOptions, onView, prepared));
+        meterInstallTree(plan, runOptions, result.exitCode);
         return { handled: true, result };
     }
     catch (error) {
@@ -61,7 +63,7 @@ export async function maybeRunLiveInstall(args, options = {}) {
             result: {
                 exitCode: 1,
                 stdout: "",
-                stderr: `dg protection failed: ${error instanceof Error ? error.message : "unknown error"}\n`
+                stderr: `dg protection failed: ${redactSecrets(error instanceof Error ? error.message : "unknown error")}\n`
             }
         };
     }

package/dist/launcher/manifest-screen.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { isAbsolute, join } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 // A bare `npm install` resolves the whole dependency tree, but enumerating every
 // transitive package in the hook would blow its time budget — that breadth is
 // the runtime network gate's job. The static hook screens the DIRECT
@@ -8,6 +8,9 @@ import { isAbsolute, join } from "node:path";
 // instead of silently passing.
 const MAX_MANIFEST_SPECS = 100;
 const MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
+// Cap the requirements include graph so a deep / fan-out `-r` chain defers rather
+// than walking unbounded inside the hook's time budget.
+const MAX_MANIFEST_FILES = 50;
 function readBoundedFile(path) {
     try {
         if (statSync(path).size > MAX_MANIFEST_BYTES) {
@@ -130,15 +133,51 @@ export function readPipRequirementSpecs(args, cwd) {
         else if (a.startsWith("-r=")) {
             files.push(a.slice("-r=".length));
         }
+        else if (a.startsWith("-r") && a.length > 2) {
+            // pip accepts the glued short form `-rrequirements.txt`.
+            files.push(a.slice(2));
+        }
     }
     if (files.length === 0) {
         return null;
     }
     const specs = [];
     const seen = new Set();
+    const alternateIndexes = [];
     let truncated = false;
-    for (const file of files) {
-        const path = isAbsolute(file) ? file : join(cwd, file);
+    // pip resolves a nested `-r`/`-c` include relative to the directory of the file
+    // that contains it; a command-line file is relative to cwd. Walk the include
+    // graph (cycle-guarded, depth-capped) so a `requirements.txt` whose only line
+    // is `-r evil.txt` does not pass clean with the pinned packages unscreened.
+    const visited = new Set();
+    const queue = files.map((file) => ({ file, base: cwd }));
+    let filesProcessed = 0;
+    outer: while (queue.length > 0) {
+        const next = queue.shift();
+        if (next === undefined) {
+            break;
+        }
+        if (next.file.includes("://")) {
+            // A remote -r URL the static hook cannot read; defer.
+            truncated = true;
+            continue;
+        }
+        const path = isAbsolute(next.file) ? next.file : resolve(next.base, next.file);
+        const rel = relative(cwd, path);
+        if (rel.startsWith("..") || isAbsolute(rel)) {
+            // A -r target outside the project root is not ours to open. Defer the
+            // install (truncated) rather than read an arbitrary path or pass clean.
+            truncated = true;
+            continue;
+        }
+        if (visited.has(path)) {
+            continue;
+        }
+        visited.add(path);
+        if (++filesProcessed > MAX_MANIFEST_FILES) {
+            truncated = true;
+            break;
+        }
         if (!existsSync(path)) {
             // A missing requirements file means the install will fail anyway — nothing
             // to screen, and no reason to nag the user. Leave it alone.
@@ -152,20 +191,62 @@ export function readPipRequirementSpecs(args, cwd) {
             continue;
         }
         for (const line of raw.split(/\r?\n/)) {
+            const include = parseRequirementInclude(line);
+            if (include !== null) {
+                queue.push({ file: include, base: dirname(path) });
+                continue;
+            }
+            const index = parseRequirementIndexDirective(line);
+            if (index !== null) {
+                alternateIndexes.push(index);
+                continue;
+            }
             const spec = parseRequirementLine(line);
             if (!spec || seen.has(spec.name)) {
                 continue;
             }
             if (specs.length >= MAX_MANIFEST_SPECS) {
                 truncated = true;
-                break;
+                break outer;
             }
             seen.add(spec.name);
             specs.push(spec);
         }
     }
-    if (specs.length === 0) {
-        return truncated ? { specs, truncated } : null;
+    const indexes = alternateIndexes.length > 0 ? alternateIndexes : undefined;
+    if (specs.length === 0 && !truncated && !indexes) {
+        return null;
+    }
+    return { specs, truncated, ...(indexes ? { alternateIndexes: indexes } : {}) };
+}
+// An index / find-links directive declared inside a requirements/constraints
+// file. pip honors `--index-url` / `--extra-index-url` / `-i` / `-f` /
+// `--find-links` there, so the static screen must surface them the same as the
+// command-line forms or a hostile in-file index passes clean.
+function parseRequirementIndexDirective(line) {
+    const stripped = line.split(/(?<!\\)#/)[0]?.trim() ?? "";
+    const spaced = /^(?:-i|--index-url|--extra-index-url|-f|--find-links)[=\s]+(\S.*)$/.exec(stripped);
+    if (spaced && spaced[1]) {
+        return spaced[1].trim();
     }
-    return { specs, truncated };
+    const glued = /^-([if])(\S.+)$/.exec(stripped);
+    if (glued && glued[2] && glued[2][0] !== "=") {
+        return glued[2].trim();
+    }
+    return null;
+}
+// A nested `-r FILE` / `--requirement FILE` / `-c FILE` / `--constraint FILE`
+// include line; pip reads its pins, so the static hook must follow it too.
+function parseRequirementInclude(line) {
+    const stripped = line.split(/(?<!\\)#/)[0]?.trim() ?? "";
+    const spaced = /^(?:-r|--requirement|-c|--constraint)[=\s]+(\S.*)$/.exec(stripped);
+    if (spaced && spaced[1]) {
+        return spaced[1].trim();
+    }
+    // Glued short form: -rnested.txt / -cconstraints.txt
+    const glued = /^-([rc])(\S.+)$/.exec(stripped);
+    if (glued && glued[2] && glued[2][0] !== "=") {
+        return glued[2].trim();
+    }
+    return null;
 }