@westbayberry/dg 2.3.3 → 2.3.4

package/dist/origin/worker.js

@@ -0,0 +1,116 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { startOriginServer } from "./server.js";
+import { cleanupSessionSync } from "../state/index.js";
+import { COOLDOWN_EXEMPTIONS_ENV, loadCooldownExemptionsFile } from "../proxy/cooldown-exemptions-file.js";
+import { isLoopbackHost } from "../gate/host-match.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
+const PARENT_POLL_MS = 500;
+const sessionPath = process.argv[2];
+const apiBaseUrl = process.argv[3];
+const classificationJson = process.env.DG_ORIGIN_CLASSIFICATION;
+if (!sessionPath || !apiBaseUrl || !classificationJson) {
+    process.stderr.write("dg origin worker missing startup arguments\n");
+    process.exit(1);
+}
+const session = JSON.parse(readFileSync(sessionPath, "utf8"));
+const classification = JSON.parse(classificationJson);
+const cooldownExemptions = loadCooldownExemptionsFile(process.env[COOLDOWN_EXEMPTIONS_ENV]);
+writeFileSync(session.files.pid, `${process.pid}\n`, { encoding: "utf8", mode: 0o600 });
+function ecosystemFor(manager) {
+    if (manager === "pip" || manager === "pipx" || manager === "uv" || manager === "uvx") {
+        return "pypi";
+    }
+    if (manager === "cargo") {
+        return "cargo";
+    }
+    return "npm";
+}
+let handle = null;
+let closed = false;
+async function close() {
+    if (closed) {
+        return;
+    }
+    closed = true;
+    await handle?.close();
+    cleanupSessionSync(session);
+}
+function shutdown() {
+    close().finally(() => process.exit(0));
+}
+function exitOnFatal(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+        process.stderr.write(`dg origin worker: unexpected error — ${redactSecrets(message)}\n`);
+    }
+    catch {
+        // stderr is gone; nothing left to report to.
+    }
+    close().finally(() => process.exit(1));
+}
+process.on("uncaughtException", exitOnFatal);
+process.on("unhandledRejection", (reason) => exitOnFatal(reason));
+process.stdin.resume();
+process.stdin.on("end", shutdown);
+process.stdin.on("error", shutdown);
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);
+const parentWatch = setInterval(() => {
+    if (process.ppid === 1) {
+        shutdown();
+    }
+}, PARENT_POLL_MS);
+parentWatch.unref();
+// DG_ORIGIN_UPSTREAMS lets a hermetic test point the origin at a fake registry
+// instead of the public one; absent, the origin chains to the real upstream.
+function parseUpstreams(raw) {
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null) {
+            return undefined;
+        }
+        const record = parsed;
+        // Every override target must be loopback, so a NODE_ENV=test env can only
+        // chain the origin at a local mock — never at an external/internal host.
+        for (const value of Object.values(record)) {
+            if (typeof value !== "string" || !upstreamIsLoopback(value)) {
+                return undefined;
+            }
+        }
+        return record;
+    }
+    catch {
+        return undefined;
+    }
+}
+function upstreamIsLoopback(value) {
+    try {
+        return isLoopbackHost(new URL(value).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+// DG_ORIGIN_UPSTREAMS is a hermetic-test seam that redirects the upstream registry
+// at a fake server; honouring it in production would let an ambient environment
+// redirect every fetch, so it is read only under NODE_ENV=test.
+const upstreamsOverride = process.env.NODE_ENV === "test" ? parseUpstreams(process.env.DG_ORIGIN_UPSTREAMS) : undefined;
+handle = await startOriginServer({
+    ecosystem: ecosystemFor(classification.manager),
+    npmTarballStrategy: "loopback",
+    cacheDir: join(session.dir, "origin-cache"),
+    stateFile: session.files.proxy,
+    ...(upstreamsOverride ? { upstreams: upstreamsOverride } : {}),
+    gate: {
+        session,
+        apiBaseUrl,
+        classification,
+        env: process.env,
+        ...(cooldownExemptions.length > 0 ? { cooldownExemptions } : {})
+    }
+});
+process.stdout.write(`ready ${handle.port}\n`);

package/dist/presentation/package-page.js

@@ -5,5 +5,25 @@ export function packagePageUrl(ecosystem, name) {
     if (ecosystem !== "npm" && ecosystem !== "pypi") {
         return null;
     }
-    return `${SITE}/${ecosystem}/${name}`;
+    // Encode the name so a package whose name carries URL-significant characters
+    // (?, #, %, space, …) can't redirect or malform the link, while preserving the
+    // `@` and the single `/` of a scoped npm name that the site's /<path:name>
+    // route expects. Legit registry names have none of the encoded characters, so
+    // this only matters for a hostile lockfile-declared name.
+    if (ecosystem === "npm" && name.startsWith("@")) {
+        const slash = name.indexOf("/");
+        if (slash <= 1) {
+            return null;
+        }
+        const scope = name.slice(1, slash);
+        const pkg = name.slice(slash + 1);
+        if (!pkg || pkg.includes("/")) {
+            return null;
+        }
+        return `${SITE}/${ecosystem}/@${encodeURIComponent(scope)}/${encodeURIComponent(pkg)}`;
+    }
+    if (name.includes("/")) {
+        return null;
+    }
+    return `${SITE}/${ecosystem}/${encodeURIComponent(name)}`;
 }

package/dist/presentation/safe-version.js

@@ -0,0 +1,11 @@
+function spec(name, version, ecosystem) {
+    return `${name}${ecosystem === "pypi" ? "==" : "@"}${version}`;
+}
+export function safeVersionLine(result, theme, ecosystem) {
+    const sv = result.safeVersion;
+    if (!sv)
+        return [];
+    const note = sv.crossesMajor ? "crosses major, may break" : "same major";
+    const text = `→ dg doesn't flag ${spec(result.name, sv.version, ecosystem ?? result.ecosystem)} (${sv.direction} · ${note})`;
+    return [`  ${theme.paint(sv.crossesMajor ? "warn" : "pass", text)}`];
+}

package/dist/presentation/sarif.js

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+// Resolve a finding's opaque `location` string into SARIF coordinates so code
+// scanning can map the alert to a real file (and annotate PRs):
+//   "package.json:dependencies.left-pad" -> { uri: "package.json", logicalName: "dependencies.left-pad" }
+//   "requirements.txt:42"                -> { uri: "requirements.txt", line: 42 }
+//   "left-pad@1.3.0"                     -> { logicalName: "left-pad@1.3.0" }   (no source file; caller may supply a manifest uri)
+//   "https://registry/x.tgz"             -> { uri: "https://registry/x.tgz" }
+export function resolveSarifLocation(location) {
+    if (/^https?:\/\//iu.test(location)) {
+        return { uri: location };
+    }
+    const numeric = /^(.*):(\d+)$/u.exec(location);
+    if (numeric && numeric[1] && numeric[2] !== undefined) {
+        const line = Number.parseInt(numeric[2], 10);
+        // SARIF 2.1.0 requires region.startLine >= 1; a 0 line degrades to a file ref.
+        return line >= 1 ? { uri: numeric[1], line } : { uri: numeric[1] };
+    }
+    const colon = location.lastIndexOf(":");
+    if (colon > 0) {
+        const suffix = location.slice(colon + 1);
+        // Split a `<manifest>:<section>.<name>` locator, but not a Windows drive
+        // letter or any colon whose suffix carries a path separator.
+        if (suffix.length > 0 && !/[/\\]/u.test(suffix)) {
+            return { uri: location.slice(0, colon), logicalName: suffix };
+        }
+    }
+    if (location.includes("@")) {
+        return { logicalName: location };
+    }
+    return { uri: location };
+}
+// Code Scanning de-duplicates alerts by this category, so a monorepo package or a
+// matrix leg gets its own stable id instead of overwriting the other legs' alerts.
+// `..` segments are rewritten to `up` rather than stripped so that two targets
+// that differ only in how far they escape the cwd (../api vs ../../api) keep
+// distinct categories and don't silently overwrite each other.
+export function automationCategory(target) {
+    const normalized = target
+        .replace(/\\/gu, "/")
+        .replace(/\/+/gu, "/")
+        .replace(/^\.\//u, "")
+        .replace(/(^|\/)\.\.(?=\/|$)/gu, "$1up")
+        .replace(/^\/+/u, "")
+        .replace(/\/+$/u, "")
+        .replace(/\s/gu, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`)
+        .replace(/^\.$/u, "");
+    return `dependency-guardian/${normalized || "root"}/`;
+}
+export function findingFingerprint(identity) {
+    return createHash("sha256").update(identity).digest("hex").slice(0, 16);
+}
+function firstNonEmpty(...values) {
+    for (const value of values) {
+        if (typeof value === "string" && value.length > 0) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function withPrefix(uri, pathPrefix) {
+    if (!uri || !pathPrefix || pathPrefix === ".") {
+        return uri;
+    }
+    if (/^([a-z][a-z0-9+.-]*:\/\/|\/)/iu.test(uri)) {
+        return uri;
+    }
+    // A target outside the code-scanning checkout root has no repo-relative uri, so
+    // emit the bare finding uri rather than fabricate a pseudo-relative path that
+    // resolves to no file. Only a single leading `./` is stripped; an absolute or
+    // `../`-escaping prefix bails.
+    const normalized = pathPrefix.replace(/^\.\/+/u, "").replace(/\/+$/u, "");
+    if (normalized === "" || normalized.startsWith("/") || normalized === ".." || normalized.startsWith("../")) {
+        return uri;
+    }
+    return `${normalized}/${uri}`;
+}
+function targetAnchor(pathPrefix) {
+    if (!pathPrefix) {
+        return undefined;
+    }
+    const normalized = pathPrefix.replace(/^\.\/+/u, "").replace(/\/+$/u, "");
+    if (normalized === "" || normalized.startsWith("/") || normalized === ".." || normalized.startsWith("../")) {
+        return undefined;
+    }
+    return normalized;
+}
+// Build a SARIF location entry from a finding's opaque location, falling back to a
+// manifest uri (so a server verdict on a package still anchors to a real file).
+// pathPrefix is the scan target's path relative to the working dir; relative uris
+// are prefixed with it so they resolve from the repo root code scanning expects.
+// A physicalLocation with a non-empty uri is an invariant: code scanning requires
+// one to render an alert and rejects an empty uri, so when nothing resolves we
+// anchor to the manifest/target fallback (or repo root) rather than emit a
+// logical-only or empty-uri result.
+export function sarifLocationEntry(location, fallbackUri, pathPrefix) {
+    const resolved = resolveSarifLocation(location);
+    const base = firstNonEmpty(resolved.uri, fallbackUri);
+    const prefixed = withPrefix(base, pathPrefix);
+    const uri = firstNonEmpty(prefixed, targetAnchor(pathPrefix)) ?? ".";
+    const physicalLocation = {
+        artifactLocation: { uri },
+        ...(resolved.line !== undefined ? { region: { startLine: resolved.line } } : {})
+    };
+    const logicalLocations = resolved.logicalName ? [{ fullyQualifiedName: resolved.logicalName }] : undefined;
+    return {
+        physicalLocation,
+        ...(logicalLocations ? { logicalLocations } : {})
+    };
+}

package/dist/project/dgfile.js

@@ -7,6 +7,7 @@ import { writeJsonAtomic } from "../util/json-file.js";
 import { canonicalCooldownName } from "../policy/pypi-name.js";
 import { acquireLockSyncWithRetry, resolveDgPaths } from "../state/index.js";
 import { stampAuthoredEntries } from "./override-trust.js";
+import { sanitize, sanitizeLine } from "../security/sanitize.js";
 const DG_FILE_LOCK_STALE_MS = 10_000;
 const DG_FILE_LOCK_TIMEOUT_MS = 5_000;
 export function withDgFileLock(root, env, action) {
@@ -133,14 +134,43 @@ export function warnUnreadableDgFile(file, write = (line) => process.stderr.writ
         write(`dg: ignoring decisions in ${file.path} — ${file.failure ?? "unreadable"} (no warnings suppressed)\n`);
     }
 }
+function decisionDedupeKey(d) {
+    const scope = d.scope.kind === "exact" ? `exact:${d.scope.version}` : "any";
+    const findings = Object.keys(d.findings)
+        .sort()
+        .map((key) => `${key}=${d.findings[key]}`)
+        .join(",");
+    return [d.ecosystem, d.name, scope, findings].join("\u0000");
+}
+// Enforce DECISION_ENTRY_CAP on the write path so re-remembering can never grow
+// dg.json past the point where loadDgFile fails it closed (and bricks every later
+// `dg decisions` invocation). Re-accepting the same warn replaces its prior entry
+// rather than appending a duplicate, and a genuinely full list evicts oldest-first.
 export function appendDecisions(file, additions, now = new Date()) {
     const added = additions.map((decision) => ({
         ...decision,
         id: randomUUID(),
-        reason: decision.reason.slice(0, DECISION_REASON_MAX),
-        acceptedAt: decision.acceptedAt ?? now.toISOString()
+        // Sanitize the user-controlled fields at WRITE time exactly as the parser
+        // does at read time, so the override-trust tag (stamped over these bytes
+        // below) matches what verification recomputes after a parse — otherwise a
+        // reason containing a CR/control char silently desyncs and drops the waiver.
+        reason: sanitize(decision.reason).slice(0, DECISION_REASON_MAX),
+        acceptedBy: sanitizeLine(decision.acceptedBy),
+        acceptedAt: sanitizeLine(decision.acceptedAt ?? now.toISOString())
     }));
-    return { ...file, decisions: [...file.decisions, ...added] };
+    const canonical = [...new Map(added.map((d) => [decisionDedupeKey(d), d])).values()];
+    const addedKeys = new Set(canonical.map(decisionDedupeKey));
+    const priorExtra = new Map(file.decisions.map((d) => [decisionDedupeKey(d), d.extra]));
+    const keep = file.decisions.filter((d) => !addedKeys.has(decisionDedupeKey(d)));
+    const merged = canonical.map((d) => {
+        const carried = priorExtra.get(decisionDedupeKey(d));
+        return carried !== undefined ? { ...d, extra: carried } : d;
+    });
+    const next = [...keep, ...merged];
+    return {
+        ...file,
+        decisions: next.length > DECISION_ENTRY_CAP ? next.slice(next.length - DECISION_ENTRY_CAP) : next
+    };
 }
 export function removeDecisions(file, ids) {
     return { ...file, decisions: file.decisions.filter((entry) => !ids.has(entry.id)) };
@@ -154,8 +184,9 @@ export function appendCooldownExemptions(file, additions, now = new Date()) {
         const carried = priorExtra.get(`${a.ecosystem}:${a.name}`);
         return {
             ...a,
-            reason: a.reason.slice(0, DECISION_REASON_MAX),
-            acceptedAt: a.acceptedAt ?? now.toISOString(),
+            reason: sanitize(a.reason).slice(0, DECISION_REASON_MAX),
+            acceptedBy: sanitizeLine(a.acceptedBy),
+            acceptedAt: sanitizeLine(a.acceptedAt ?? now.toISOString()),
             ...(carried !== undefined ? { extra: carried } : {})
         };
     });
@@ -217,10 +248,10 @@ export function parseCooldownExemption(value) {
     return {
         ecosystem,
         name,
-        reason: typeof value.reason === "string" ? value.reason.slice(0, DECISION_REASON_MAX) : "",
-        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? value.acceptedBy : "unknown",
-        acceptedAt: typeof value.acceptedAt === "string" ? value.acceptedAt : "",
-        ...(typeof expiresAt === "string" ? { expiresAt } : {}),
+        reason: typeof value.reason === "string" ? sanitize(value.reason).slice(0, DECISION_REASON_MAX) : "",
+        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? sanitizeLine(value.acceptedBy) : "unknown",
+        acceptedAt: typeof value.acceptedAt === "string" ? sanitizeLine(value.acceptedAt) : "",
+        ...(typeof expiresAt === "string" ? { expiresAt: sanitizeLine(expiresAt) } : {}),
         ...(Object.keys(extra).length > 0 ? { extra } : {})
     };
 }
@@ -313,16 +344,22 @@ function parseDecisionEntry(value) {
             extra[key] = field;
         }
     }
+    // Sanitize at the trust boundary: a cloned repo's dg.json is attacker-controlled,
+    // and these fields reach several terminal renderers (dg decisions, dg cooldown,
+    // the install-preflight "previously accepted" notice). sanitizeLine strips
+    // ANSI/OSC/control/invisible bytes; sanitize keeps a legit multi-line reason's
+    // newlines. This is a no-op on legitimate values, so it does not perturb the
+    // override-trust HMAC (which binds these same fields and is verified post-parse).
     return {
-        id: typeof value.id === "string" && value.id.length > 0 ? value.id : derivedEntryId(value),
+        id: typeof value.id === "string" && value.id.length > 0 ? sanitizeLine(value.id) : derivedEntryId(value),
         ecosystem,
-        name,
+        name: sanitizeLine(name),
         scope,
         findings,
-        reason: typeof value.reason === "string" ? value.reason.slice(0, DECISION_REASON_MAX) : "",
-        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? value.acceptedBy : "unknown",
-        acceptedAt: typeof value.acceptedAt === "string" ? value.acceptedAt : "",
-        ...(typeof expiresAt === "string" ? { expiresAt } : {}),
+        reason: typeof value.reason === "string" ? sanitize(value.reason).slice(0, DECISION_REASON_MAX) : "",
+        acceptedBy: typeof value.acceptedBy === "string" && value.acceptedBy.length > 0 ? sanitizeLine(value.acceptedBy) : "unknown",
+        acceptedAt: typeof value.acceptedAt === "string" ? sanitizeLine(value.acceptedAt) : "",
+        ...(typeof expiresAt === "string" ? { expiresAt: sanitizeLine(expiresAt) } : {}),
         ...(Object.keys(extra).length > 0 ? { extra } : {})
     };
 }
@@ -334,7 +371,7 @@ function parseScope(value) {
         return { kind: "any" };
     }
     if (value.kind === "exact" && typeof value.version === "string" && value.version.length > 0) {
-        return { kind: "exact", version: value.version };
+        return { kind: "exact", version: sanitizeLine(value.version) };
     }
     return null;
 }
@@ -351,7 +388,7 @@ function parseFindings(value) {
             return null;
         }
         if (!UNSAFE_OBJECT_KEYS.has(category)) {
-            findings[category] = severity;
+            findings[sanitizeLine(category)] = severity;
         }
     }
     return findings;

package/dist/proxy/enforcement.js

@@ -59,8 +59,9 @@ export function enforceProtectedInstall(request) {
     if (baseDecision.cause === "quota-exceeded" && proxyVerdict.quotaBehavior === "pass") {
         return { ...baseDecision, action: "warn", reason: "over monthly quota — installed unverified per your dashboard setting" };
     }
-    if (baseDecision.action !== "block") {
-        return baseDecision;
+    const decision = applyProvenanceDowngrade(baseDecision, proxyVerdict, userConfig.policy.provenanceDowngrade);
+    if (decision.action !== "block") {
+        return decision;
     }
     let force;
     try {
@@ -82,7 +83,7 @@ export function enforceProtectedInstall(request) {
     }
     if (force.allowed) {
         return {
-            ...baseDecision,
+            ...decision,
             action: "warn",
             reason: `force override allowed: ${force.reason}`,
             forceOverride: {
@@ -95,7 +96,7 @@ export function enforceProtectedInstall(request) {
         recordAuditEvent({
             type: "install.blocked",
             packageName,
-            reason: baseDecision.reason,
+            reason: decision.reason,
             policyMode: policy.mode,
             createdAt: (request.now ?? new Date()).toISOString()
         }, request.env);
@@ -104,16 +105,34 @@ export function enforceProtectedInstall(request) {
         noteEnforcementSideEffectFailure(error);
     }
     if (!request.forceOverride?.force) {
-        return baseDecision;
+        return decision;
     }
     return {
-        ...baseDecision,
+        ...decision,
         forceOverride: {
             allowed: false,
             reason: force.reason
         }
     };
 }
+// A provenance downgrade — a version that previously carried an attestation no
+// longer does — is the actionable supply-chain signal. Escalation only: it never
+// downgrades an existing block, and it is opt-in (policy.provenanceDowngrade,
+// default off) so it cannot surprise-break installs of never-attested packages.
+function applyProvenanceDowngrade(decision, verdict, mode) {
+    const downgrade = verdict.provenance?.downgrade;
+    if (!downgrade || mode === "off" || decision.action === "block") {
+        return decision;
+    }
+    const reason = `provenance downgrade: ${downgrade.fromVersion} was attested, this version is not`;
+    if (mode === "block") {
+        return { ...decision, action: "block", cause: "policy", reason };
+    }
+    if (decision.action === "pass") {
+        return { ...decision, action: "warn", cause: "policy", reason };
+    }
+    return decision;
+}
 function failClosedVerdict(classification) {
     return {
         verdict: "block",
@@ -180,6 +199,7 @@ function withOptionalDecisionFields(decision, verdict) {
         ...(verdict.unauthenticated ? { unauthenticated: true } : {}),
         ...(verdict.resetsAt ? { resetsAt: verdict.resetsAt } : {}),
         ...(verdict.quotaBehavior ? { quotaBehavior: verdict.quotaBehavior } : {}),
-        ...(verdict.cooldown ? { cooldown: verdict.cooldown } : {})
+        ...(verdict.cooldown ? { cooldown: verdict.cooldown } : {}),
+        ...(verdict.provenance ? { provenance: verdict.provenance } : {})
     };
 }

package/dist/proxy/metadata-map.js

@@ -3,7 +3,7 @@ import { brotliDecompressSync, gunzipSync, inflateRawSync, inflateSync } from "n
 // decodeURIComponent throws on malformed percent-encoding (e.g. a stray % in a
 // registry href); fall back to the raw value so one bad entry cannot throw out of
 // the whole metadata-extraction pass and drop every identity.
-function safeDecodeUriComponent(value) {
+export function safeDecodeUriComponent(value) {
     try {
         return decodeURIComponent(value);
     }
@@ -11,6 +11,16 @@ function safeDecodeUriComponent(value) {
         return value;
     }
 }
+// A registry-controlled href can be malformed; resolving it must not throw out of
+// the extractor and wrongly block the install. Skip the bad entry instead.
+function safeResolveUrl(href, base) {
+    try {
+        return new URL(href, base);
+    }
+    catch {
+        return null;
+    }
+}
 export function extractRegistryMetadataIdentities(metadataUrl, response) {
     const decoded = { headers: response.headers, body: decodeContentEncoding(response.headers, response.body) };
     // PyPI Simple index (PEP 503 HTML or PEP 691 JSON) — the pip/uv/pipx flow.
@@ -203,7 +213,13 @@ export function artifactUrlKey(value) {
     return url.toString();
 }
 function extractNpmIdentities(metadataUrl, parsed) {
-    const packageName = typeof parsed.name === "string" ? parsed.name : packageNameFromNpmMetadataPath(metadataUrl);
+    // Bind the name to the requested URL path, not the registry-controlled JSON, so
+    // a hostile/compromised upstream can't relabel a package to dodge name-based
+    // policy (cooldown, known-bad). Fall back to JSON only when the path has no name.
+    const urlName = packageNameFromNpmMetadataPath(metadataUrl);
+    const packageName = urlName !== metadataUrl.hostname
+        ? urlName
+        : (typeof parsed.name === "string" ? parsed.name : urlName);
     const versions = isRecord(parsed.versions) ? parsed.versions : {};
     const identities = [];
     for (const [version, rawVersion] of Object.entries(versions)) {
@@ -214,12 +230,16 @@ function extractNpmIdentities(metadataUrl, parsed) {
         if (typeof dist.tarball !== "string" || dist.tarball.length === 0) {
             continue;
         }
+        const tarball = safeResolveUrl(dist.tarball, metadataUrl);
+        if (!tarball) {
+            continue;
+        }
         identities.push({
             ecosystem: "npm",
             name: packageName,
             version,
             registryHost: metadataUrl.hostname,
-            tarballUrl: artifactUrlKey(new URL(dist.tarball, metadataUrl)),
+            tarballUrl: artifactUrlKey(tarball),
             sourceKind: "registry-metadata"
         });
     }
@@ -227,9 +247,11 @@ function extractNpmIdentities(metadataUrl, parsed) {
 }
 function extractPypiIdentities(metadataUrl, parsed) {
     const info = isRecord(parsed.info) ? parsed.info : {};
-    const packageName = typeof info.name === "string" && info.name.length > 0
-        ? info.name
-        : packageNameFromPypiMetadataPath(metadataUrl);
+    // Bind to the requested URL path over the registry-controlled JSON name.
+    const urlName = packageNameFromPypiMetadataPath(metadataUrl);
+    const packageName = urlName !== metadataUrl.hostname
+        ? urlName
+        : (typeof info.name === "string" && info.name.length > 0 ? info.name : urlName);
     const releases = isRecord(parsed.releases) ? parsed.releases : {};
     const identities = [];
     for (const [version, rawFiles] of Object.entries(releases)) {
@@ -240,12 +262,16 @@ function extractPypiIdentities(metadataUrl, parsed) {
             if (!isRecord(rawFile) || typeof rawFile.url !== "string" || rawFile.url.length === 0) {
                 continue;
             }
+            const fileUrl = safeResolveUrl(rawFile.url, metadataUrl);
+            if (!fileUrl) {
+                continue;
+            }
             identities.push({
                 ecosystem: "pypi",
                 name: packageName,
                 version,
                 registryHost: metadataUrl.hostname,
-                tarballUrl: artifactUrlKey(new URL(rawFile.url, metadataUrl)),
+                tarballUrl: artifactUrlKey(fileUrl),
                 sourceKind: "registry-metadata"
             });
         }

package/dist/proxy/preverified.js

@@ -37,9 +37,6 @@ export function loadPreverifiedMap(sessionDir) {
     loaded = { dir: sessionDir, map };
     return map;
 }
-export function resetPreverifiedCache() {
-    loaded = null;
-}
 function isPreverifiedEntry(value) {
     if (typeof value !== "object" || value === null) {
         return false;