@westbayberry/dg 2.3.3 → 2.3.4

package/dist/sbom/graph.js

@@ -0,0 +1,236 @@
+import { join } from "node:path";
+import { readFileSync } from "node:fs";
+import { componentRef } from "./cyclonedx.js";
+export const SBOM_ROOT_REF = "root";
+export function buildDependencyGraph(projects, componentRefs) {
+    const edges = new Map();
+    for (const project of projects) {
+        let text;
+        try {
+            text = readFileSync(join(project.path, project.depFile), "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (project.depFile === "package-lock.json" || project.depFile === "npm-shrinkwrap.json") {
+            collectNpmEdges(text, componentRefs, edges);
+        }
+        else if (project.depFile === "Cargo.lock") {
+            collectCargoEdges(text, componentRefs, edges);
+        }
+    }
+    const dependencies = [];
+    for (const [ref, dependsOn] of edges) {
+        if (ref !== SBOM_ROOT_REF && !componentRefs.has(ref)) {
+            continue;
+        }
+        dependencies.push({ ref, dependsOn: [...dependsOn].sort(compareCodePoints) });
+    }
+    return dependencies.sort((a, b) => compareCodePoints(a.ref, b.ref));
+}
+function record(edges, from, to) {
+    if (from === to) {
+        return;
+    }
+    const set = edges.get(from) ?? new Set();
+    set.add(to);
+    edges.set(from, set);
+}
+function ensureNode(edges, ref) {
+    if (!edges.has(ref)) {
+        edges.set(ref, new Set());
+    }
+}
+const NPM_DEPENDENCY_SECTIONS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+function collectNpmEdges(text, componentRefs, edges) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return;
+    }
+    if (!isRecord(parsed) || !isRecord(parsed.packages)) {
+        return;
+    }
+    const packages = parsed.packages;
+    for (const [path, entry] of Object.entries(packages)) {
+        if (!isRecord(entry) || entry.link === true) {
+            continue;
+        }
+        if (path.length > 0 && !path.includes("node_modules")) {
+            continue;
+        }
+        const fromRef = path.length === 0 ? SBOM_ROOT_REF : npmEntryRef(path, entry, componentRefs);
+        if (fromRef === null) {
+            continue;
+        }
+        ensureNode(edges, fromRef);
+        for (const depName of npmDeclaredDeps(entry)) {
+            const targetPath = resolveNpmDep(packages, path, depName);
+            if (targetPath === null) {
+                continue;
+            }
+            const targetEntry = packages[targetPath];
+            if (!isRecord(targetEntry)) {
+                continue;
+            }
+            const targetRef = npmEntryRef(targetPath, targetEntry, componentRefs);
+            if (targetRef !== null) {
+                record(edges, fromRef, targetRef);
+            }
+        }
+    }
+}
+function npmDeclaredDeps(entry) {
+    const names = new Set();
+    for (const section of NPM_DEPENDENCY_SECTIONS) {
+        const deps = entry[section];
+        if (isRecord(deps)) {
+            for (const name of Object.keys(deps)) {
+                names.add(name);
+            }
+        }
+    }
+    return [...names];
+}
+function resolveNpmDep(packages, fromPath, depName) {
+    let scope = fromPath;
+    for (;;) {
+        const candidate = scope.length === 0 ? `node_modules/${depName}` : `${scope}/node_modules/${depName}`;
+        if (Object.prototype.hasOwnProperty.call(packages, candidate)) {
+            return candidate;
+        }
+        if (scope.length === 0) {
+            return null;
+        }
+        const cut = scope.lastIndexOf("/node_modules/");
+        scope = cut === -1 ? "" : scope.slice(0, cut);
+    }
+}
+function npmEntryRef(path, entry, componentRefs) {
+    const declaredName = typeof entry.name === "string" ? entry.name : nameFromNodeModulesPath(path);
+    const alias = npmAliasVersion(typeof entry.version === "string" ? entry.version : null);
+    const name = alias?.name ?? declaredName;
+    const version = alias?.version ?? (typeof entry.version === "string" ? entry.version : null);
+    if (!name || !version) {
+        return null;
+    }
+    const ref = componentRef({ ecosystem: "npm", name, version });
+    return componentRefs.has(ref) ? ref : null;
+}
+function nameFromNodeModulesPath(path) {
+    const marker = path.lastIndexOf("node_modules/");
+    if (marker === -1) {
+        return null;
+    }
+    const tail = path.slice(marker + "node_modules/".length);
+    return tail.length > 0 ? tail : null;
+}
+function npmAliasVersion(version) {
+    if (!version || !version.startsWith("npm:")) {
+        return null;
+    }
+    const spec = version.slice("npm:".length);
+    const at = spec.lastIndexOf("@");
+    if (at <= 0) {
+        return null;
+    }
+    return { name: spec.slice(0, at), version: spec.slice(at + 1) || null };
+}
+function collectCargoEdges(text, componentRefs, edges) {
+    const byName = new Map();
+    const packages = [];
+    const rootDeps = [];
+    for (const block of cargoPackageBlocks(text)) {
+        const name = tomlValue(block, "name");
+        const version = tomlValue(block, "version");
+        if (!name || !version) {
+            continue;
+        }
+        const source = tomlValue(block, "source");
+        const deps = tomlArray(block, "dependencies");
+        if (source === null) {
+            rootDeps.push(deps);
+            continue;
+        }
+        const ref = componentRef({ ecosystem: "cargo", name, version, resolvedUrl: source });
+        const list = byName.get(name) ?? [];
+        list.push({ version, ref });
+        byName.set(name, list);
+        packages.push({ ref, deps });
+    }
+    for (const pkg of packages) {
+        if (!componentRefs.has(pkg.ref)) {
+            continue;
+        }
+        ensureNode(edges, pkg.ref);
+        for (const dep of pkg.deps) {
+            const targetRef = resolveCargoDep(byName, dep);
+            if (targetRef && componentRefs.has(targetRef)) {
+                record(edges, pkg.ref, targetRef);
+            }
+        }
+    }
+    if (rootDeps.length === 1 && rootDeps[0]) {
+        ensureNode(edges, SBOM_ROOT_REF);
+        for (const dep of rootDeps[0]) {
+            const targetRef = resolveCargoDep(byName, dep);
+            if (targetRef && componentRefs.has(targetRef)) {
+                record(edges, SBOM_ROOT_REF, targetRef);
+            }
+        }
+    }
+}
+function resolveCargoDep(byName, dep) {
+    const parts = dep.trim().split(/\s+/u);
+    const name = parts[0];
+    if (!name) {
+        return null;
+    }
+    const candidates = byName.get(name);
+    if (!candidates || candidates.length === 0) {
+        return null;
+    }
+    const wantedVersion = parts[1];
+    if (wantedVersion) {
+        return candidates.find((candidate) => candidate.version === wantedVersion)?.ref ?? null;
+    }
+    return candidates.length === 1 && candidates[0] ? candidates[0].ref : null;
+}
+function cargoPackageBlocks(text) {
+    const blocks = [];
+    const segments = text.split(/^\s*\[\[package\]\]\s*$/mu);
+    for (let i = 1; i < segments.length; i += 1) {
+        const segment = segments[i];
+        if (segment === undefined) {
+            continue;
+        }
+        const end = segment.search(/^\s*\[/mu);
+        blocks.push(end === -1 ? segment : segment.slice(0, end));
+    }
+    return blocks;
+}
+function tomlValue(block, key) {
+    const match = new RegExp(`^\\s*${key}\\s*=\\s*"([^"]*)"`, "mu").exec(block);
+    return match?.[1] ?? null;
+}
+function tomlArray(block, key) {
+    const match = new RegExp(`^\\s*${key}\\s*=\\s*\\[([\\s\\S]*?)\\]`, "mu").exec(block);
+    if (!match || match[1] === undefined) {
+        return [];
+    }
+    const values = [];
+    for (const item of match[1].matchAll(/"([^"]*)"/gu)) {
+        if (item[1] !== undefined) {
+            values.push(item[1]);
+        }
+    }
+    return values;
+}
+function compareCodePoints(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/sbom/spdx.js

@@ -0,0 +1,53 @@
+const CANONICAL_SPDX_IDS = [
+    "0BSD",
+    "AGPL-3.0-only",
+    "AGPL-3.0-or-later",
+    "Apache-1.1",
+    "Apache-2.0",
+    "Artistic-2.0",
+    "Beerware",
+    "BlueOak-1.0.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSD-3-Clause-Clear",
+    "BSL-1.0",
+    "CC-BY-4.0",
+    "CC-BY-SA-4.0",
+    "CC0-1.0",
+    "CDDL-1.0",
+    "CDDL-1.1",
+    "EPL-1.0",
+    "EPL-2.0",
+    "EUPL-1.1",
+    "EUPL-1.2",
+    "GPL-2.0-only",
+    "GPL-2.0-or-later",
+    "GPL-3.0-only",
+    "GPL-3.0-or-later",
+    "ISC",
+    "LGPL-2.0-only",
+    "LGPL-2.0-or-later",
+    "LGPL-2.1-only",
+    "LGPL-2.1-or-later",
+    "LGPL-3.0-only",
+    "LGPL-3.0-or-later",
+    "MIT",
+    "MIT-0",
+    "MPL-1.1",
+    "MPL-2.0",
+    "MS-PL",
+    "MS-RL",
+    "NCSA",
+    "OFL-1.1",
+    "PostgreSQL",
+    "Python-2.0",
+    "Ruby",
+    "Unicode-DFS-2016",
+    "Unlicense",
+    "WTFPL",
+    "Zlib"
+];
+const BY_LOWERCASE = new Map(CANONICAL_SPDX_IDS.map((id) => [id.toLowerCase(), id]));
+export function canonicalSpdxId(declared) {
+    return BY_LOWERCASE.get(declared.trim().toLowerCase()) ?? null;
+}

package/dist/sbom-ui/SbomApp.js

@@ -16,8 +16,9 @@ const HEADER_LINES = 9;
 const FOOTER_LINES = 2;
 const COUNTER_LINE = 1;
 const SAFETY_LINE = 1;
+const RULE_LINES = 2;
 const FILTER_CYCLE = ["all", "risky", "unlicensed"];
-const FILTER_LABEL = { all: "all", risky: "risky", unlicensed: "unlicensed", unpinned: "unpinned" };
+const FILTER_LABEL = { all: "all", risky: "risky", unlicensed: "unlicensed" };
 function ecosystemCounts(rows) {
     const counts = new Map();
     for (const row of rows) {
@@ -150,9 +151,10 @@ export const SbomApp = ({ store, document, cwd }) => {
             openExport();
         }
     });
-    const listHeight = Math.max(3, termRows - HEADER_LINES - FOOTER_LINES - COUNTER_LINE - SAFETY_LINE);
+    const listHeight = Math.max(3, termRows - HEADER_LINES - FOOTER_LINES - COUNTER_LINE - SAFETY_LINE - RULE_LINES);
+    const rule = chalk.dim("─".repeat(Math.max(20, termCols - 4)));
     if (exportDialog) {
         return (_jsxs(Box, { flexDirection: "column", children: [_jsx(SbomHeader, { total: view.rows.length, ecosystems: ecosystemCounts(view.rows), phase: view.phase, tally: tally, scannable: view.scannable, scanProgress: view.scanProgress, scanError: view.scanError, usage: view.usage, subject: view.subject, cargoCount: cargoCount }), _jsx(ExportDialog, { options: exportDialog, theme: theme, cwd: cwd, onDone: handleExportDone })] }));
     }
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(SbomHeader, { total: view.rows.length, ecosystems: ecosystemCounts(view.rows), phase: view.phase, tally: tally, scannable: view.scannable, scanProgress: view.scanProgress, scanError: view.scanError, usage: view.usage, subject: view.subject, cargoCount: cargoCount }), _jsx(SbomList, { rows: visible, selected: clamped, height: listHeight, width: termCols, emptyMessage: emptyFilterMessage(filter, query, view.phase, tally, view.scanError) }), _jsxs(Box, { paddingLeft: 1, flexDirection: "column", children: [toast ? _jsx(Text, { children: toast }) : null, searching ? (_jsxs(Text, { children: [chalk.cyan("/"), query, chalk.dim("   esc to clear")] })) : query ? (_jsxs(Text, { children: [chalk.cyan("/"), query, chalk.dim(`   ${visible.length} of ${view.rows.length} components   esc clear   q quit`)] })) : (_jsxs(Text, { children: [chalk.dim("↑↓ move   / search   f "), chalk.dim(`filter: ${FILTER_LABEL[filter]}`), chalk.dim("   "), chalk.bold("e"), chalk.dim(" export   q quit")] }))] })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(SbomHeader, { total: view.rows.length, ecosystems: ecosystemCounts(view.rows), phase: view.phase, tally: tally, scannable: view.scannable, scanProgress: view.scanProgress, scanError: view.scanError, usage: view.usage, subject: view.subject, cargoCount: cargoCount }), _jsx(Text, { dimColor: true, children: rule }), _jsx(SbomList, { rows: visible, selected: clamped, height: listHeight, width: termCols, emptyMessage: emptyFilterMessage(filter, query, view.phase, tally, view.scanError) }), _jsx(Text, { dimColor: true, children: rule }), _jsxs(Box, { paddingLeft: 1, flexDirection: "column", children: [toast ? _jsx(Text, { children: toast }) : null, searching ? (_jsxs(Text, { children: [chalk.cyan("/"), query, chalk.dim("   esc to clear")] })) : query ? (_jsxs(Text, { children: [chalk.cyan("/"), query, chalk.dim(`   ${visible.length} of ${view.rows.length} components   esc clear   q quit`)] })) : (_jsxs(Text, { children: [chalk.dim("↑↓ move   / search   f "), chalk.dim(`filter: ${FILTER_LABEL[filter]}`), chalk.dim("   "), chalk.bold("e"), chalk.dim(" export   q quit")] }))] })] }));
 };

package/dist/sbom-ui/inventory.js

@@ -1,3 +1,5 @@
+import { sanitizeLine } from "../security/sanitize.js";
+import { csvCell } from "../security/csv.js";
 const ROW_ECOSYSTEMS = { npm: "npm", pypi: "pypi", cargo: "cargo" };
 export function rowKey(ecosystem, name, version) {
     return `${ecosystem}:${name.toLowerCase()}@${version}`;
@@ -6,12 +8,15 @@ export function buildSbomRows(components) {
     return components
         .map((component) => {
         const ecosystem = ROW_ECOSYSTEMS[component.ecosystem] ?? "other";
+        // Lockfile-declared name/version/license are attacker-controlled and reach
+        // the terminal (TUI rows, summary) + exports; strip control bytes here so
+        // every downstream renderer is safe without re-remembering to.
         return {
             key: rowKey(ecosystem, component.name, component.version),
-            name: component.name,
-            version: component.version,
+            name: sanitizeLine(component.name),
+            version: sanitizeLine(component.version),
             ecosystem,
-            license: component.license ?? null,
+            license: component.license != null ? sanitizeLine(component.license) : null,
             hasHash: component.integrity != null && component.integrity.length > 0,
             scannable: ecosystem === "npm" || ecosystem === "pypi"
         };
@@ -94,13 +99,6 @@ export function emptyFilterMessage(filter, query, phase, tally, scanError) {
     }
     return "no components";
 }
-function csvCell(value) {
-    // Neutralize spreadsheet formula injection: a cell starting with = + - @ (or
-    // tab/CR) is interpreted as a formula by Excel/Sheets, letting an attacker-named
-    // dependency run on open. Prefix a sentinel apostrophe so it is treated as text.
-    const guarded = /^[=+\-@\t\r]/.test(value) ? `'${value}` : value;
-    return /[",\n\r]/.test(guarded) ? `"${guarded.replace(/"/g, '""')}"` : guarded;
-}
 export function componentsCsv(rows) {
     const lines = ["name,version,ecosystem,license,verdict"];
     for (const row of rows) {

package/dist/scan/analyze-worker.js

@@ -20,7 +20,9 @@ async function main() {
         }
         responses.push(await analyzePackages(group.packages, {
             ecosystem: group.ecosystem,
-            ...(payload.scanId ? { scanId: payload.scanId } : {})
+            publicFallback: true,
+            ...(payload.scanId ? { scanId: payload.scanId } : {}),
+            ...(payload.installTreeHash ? { installTreeHash: payload.installTreeHash } : {})
         }));
     }
     process.stdout.write(JSON.stringify(mergeAnalyzeResponses(responses)));

package/dist/scan/collect.js

@@ -29,9 +29,15 @@ const IGNORED_DIRECTORIES = new Set([
     ".venv",
     "venv",
     "target",
-    "coverage"
+    "coverage",
+    ".cache",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".ruff_cache",
+    ".idea",
+    ".vscode"
 ]);
-const MAX_DISCOVERY_DEPTH = 8;
+const MAX_DISCOVERY_DEPTH = 12;
 function readDirents(directory) {
     try {
         return readdirSync(directory, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
@@ -40,16 +46,14 @@ function readDirents(directory) {
         return [];
     }
 }
+// Every lockfile in a directory is scanned, not just the first per ecosystem:
+// side-by-side lockfiles can resolve to different trees, and the collector dedups
+// by name@version, so a package unique to a non-primary lockfile is not dropped.
 function lockfilesPerEcosystem(entries, ecosystems) {
     const matches = [];
-    const claimed = new Set();
     for (const [lockfile, ecosystem] of Object.entries(ecosystems)) {
-        if (claimed.has(ecosystem)) {
-            continue;
-        }
         if (entries.some((entry) => entry.name === lockfile && entry.isFile())) {
             matches.push([lockfile, ecosystem]);
-            claimed.add(ecosystem);
         }
     }
     return matches;
@@ -127,8 +131,31 @@ function yieldToEventLoop() {
 function countLockfilePackages(lockfilePath) {
     return parseLockfilePackages(lockfilePath).packages.length;
 }
+export function mergeInstalledPackages(collected, installed) {
+    const byEcosystem = new Map([...collected.byEcosystem].map(([eco, list]) => [eco, [...list]]));
+    const origins = new Map(collected.origins);
+    const seen = new Set();
+    for (const [eco, list] of byEcosystem) {
+        for (const pkg of list)
+            seen.add(`${eco}:${pkg.name}@${pkg.version}`);
+    }
+    for (const [eco, list] of installed.byEcosystem) {
+        for (const pkg of list) {
+            const key = `${eco}:${pkg.name}@${pkg.version}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const arr = byEcosystem.get(eco) ?? [];
+            arr.push(pkg);
+            byEcosystem.set(eco, arr);
+            origins.set(key, installed.origins.get(key) ?? "installed");
+        }
+    }
+    return { ...collected, byEcosystem, origins };
+}
 export function collectScanPackages(projects) {
     const byEcosystem = new Map();
+    const origins = new Map();
     const seen = new Set();
     const skippedPackages = [];
     const parseErrors = [];
@@ -149,10 +176,12 @@ export function collectScanPackages(projects) {
         }
         for (const identity of parsed.packages) {
             if (identity.ecosystem !== "npm" && identity.ecosystem !== "pypi") {
+                skippedPackages.push({ name: identity.name, reason: "unsupported-ecosystem", location: `${depFilePath}: ${identity.requested}` });
                 skipped += 1;
                 continue;
             }
             if (!identity.version) {
+                skippedPackages.push({ name: identity.name, reason: "unpinned", location: `${depFilePath}: ${identity.requested}` });
                 skipped += 1;
                 continue;
             }
@@ -164,7 +193,8 @@ export function collectScanPackages(projects) {
             const list = byEcosystem.get(identity.ecosystem) ?? [];
             list.push({ name: identity.name, version: identity.version });
             byEcosystem.set(identity.ecosystem, list);
+            origins.set(`${identity.ecosystem}:${identity.name}@${identity.version}`, depFilePath);
         }
     }
-    return { byEcosystem, skipped, skippedPackages, parseErrors };
+    return { byEcosystem, origins, skipped, skippedPackages, parseErrors };
 }

package/dist/scan/command.js

@@ -2,21 +2,39 @@ import { statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { writeReportAtomic } from "../util/report-writer.js";
 import { findProjectRoot, loadDgFile, warnUnreadableDgFile } from "../project/dgfile.js";
+import { gateProjectDecisions } from "../project/override-trust.js";
 import { scanProject } from "./discovery.js";
-import { renderJsonReport, renderSarifReport, renderTextReport } from "./render.js";
+import { applyLocalFindingEscalation, renderJsonReport, renderSarifReport, renderTextReport } from "./render.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { launchScanTui, shouldLaunchScanTui } from "../scan-ui/launch.js";
 import { runScannerScan } from "./scanner-report.js";
+import { detectUnlockedManifests, unlockedManifestNotice } from "./manifest-coverage.js";
 import { runStagedScan, stagedScanReport } from "./staged.js";
-import { scanExitCode } from "../scan-ui/shims.js";
-import { loadUserConfig } from "../config/settings.js";
-import { EXIT_ANALYSIS_INCOMPLETE, EXIT_NOTHING_TO_SCAN, EXIT_USAGE_VERDICT } from "../commands/types.js";
+import { verdictExitCode } from "../scan-ui/shims.js";
+import { authStatus } from "../auth/store.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_NOTHING_TO_SCAN, EXIT_TOOL_ERROR, EXIT_USAGE_VERDICT } from "../commands/types.js";
 export function runScanCommand(context) {
     const parsed = parseScanArgs(context.args);
     if ("error" in parsed) {
         return usageError(parsed.error);
     }
+    // The interactive project scan is the product and requires sign-in. The
+    // staged path (dg commit-guard) is automated protection like the install
+    // firewall, so it stays account-free and resolves verdicts through the public
+    // endpoint when signed out.
+    if (!parsed.staged && !authStatus(process.env).authenticated) {
+        // The install-origin metering scan runs detached after an install; with no
+        // signed-in key there is nothing to bill, so exit quietly instead of nagging.
+        if (parsed.installOrigin) {
+            return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        return {
+            exitCode: EXIT_USAGE_VERDICT,
+            stdout: "",
+            stderr: "Sign in to run dg scan. Run `dg login`.\n"
+        };
+    }
     const stagedTarget = parsed.sawTarget ? parsed.targetPath : null;
     const machineOutput = parsed.format !== "text" || parsed.outputPath !== null;
     if (parsed.staged && !machineOutput) {
@@ -33,12 +51,13 @@ export function runScanCommand(context) {
         outcome = staged.outcome;
     }
     else {
-        if (shouldLaunchScanTui({
-            targetPath: parsed.targetPath,
-            format: parsed.format,
-            outputPath: parsed.outputPath ?? undefined
-        })) {
-            void launchScanTui().catch((error) => {
+        if (!parsed.installOrigin &&
+            shouldLaunchScanTui({
+                targetPath: parsed.targetPath,
+                format: parsed.format,
+                outputPath: parsed.outputPath ?? undefined
+            })) {
+            void launchScanTui("results", parsed.failOn).catch((error) => {
                 process.stderr.write(`dg scan TUI failed: ${error instanceof Error ? error.message : "unknown error"}\n`);
                 process.exitCode = 1;
             });
@@ -60,7 +79,7 @@ export function runScanCommand(context) {
                 stderr: `dg scan failed: ${error instanceof Error ? error.message : "unknown scan error"}\n`
             };
         }
-        outcome = runScannerScan(parsed.targetPath, report, process.env, parsed.noDecisions ? null : loadScanDecisions(parsed.targetPath));
+        outcome = runScannerScan(parsed.targetPath, report, process.env, parsed.noDecisions ? null : loadScanDecisions(parsed.targetPath), parsed.installOrigin);
     }
     if (outcome.kind === "report") {
         report = outcome.report;
@@ -75,15 +94,23 @@ export function runScanCommand(context) {
         !report.scannerError &&
         report.summary.projectCount === 0 &&
         report.summary.errorCount === 0;
-    const exitCode = nothingToScan ? EXIT_NOTHING_TO_SCAN : exitCodeForReport(report);
+    const exitCode = nothingToScan ? EXIT_NOTHING_TO_SCAN : exitCodeForReport(report, parsed.failOn);
+    // With no server verdict, name any dependency manifest that lacks a lockfile so
+    // the run is not a silent "nothing to scan".
+    const manifestNotice = !report.scanner && !report.scannerError
+        ? unlockedManifestNotice(detectUnlockedManifests(resolve(parsed.targetPath)))
+        : null;
     const rendered = renderReport(report, parsed.format, scannerUnavailable, skipNotice, nothingToScan);
     if (parsed.outputPath) {
         try {
             writeReportAtomic(resolve(parsed.outputPath), rendered);
         }
         catch (error) {
+            // A write failure is a tool error, not an incomplete analysis — match dg
+            // sbom/audit (EXIT_TOOL_ERROR) so a consumer can tell "couldn't produce the
+            // report" apart from "couldn't reach the scanner".
             return {
-                exitCode: EXIT_ANALYSIS_INCOMPLETE,
+                exitCode: EXIT_TOOL_ERROR,
                 stdout: "",
                 stderr: `dg scan could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
             };
@@ -91,13 +118,15 @@ export function runScanCommand(context) {
         return {
             exitCode,
             stdout: `Wrote ${parsed.format} scan report to ${parsed.outputPath}\n`,
-            stderr: ""
+            // Surface a degraded scan (e.g. a rejected key) even when writing to a file,
+            // so the failure isn't silent in --json/--sarif mode.
+            stderr: report.scannerError ? `dg scan: server scan failed: ${report.scannerError.message}\n` : ""
         };
     }
     return {
         exitCode,
         stdout: rendered,
-        stderr: ""
+        stderr: manifestNotice ? `${manifestNotice}\n` : ""
     };
 }
 function parseScanArgs(args) {
@@ -108,6 +137,8 @@ function parseScanArgs(args) {
     let staged = false;
     let hook = false;
     let noDecisions = false;
+    let failOn = "block";
+    let installOrigin = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (!arg) {
@@ -117,6 +148,10 @@ function parseScanArgs(args) {
             staged = true;
             continue;
         }
+        if (arg === "--install-origin") {
+            installOrigin = true;
+            continue;
+        }
         if (arg === "--hook") {
             hook = true;
             continue;
@@ -148,6 +183,14 @@ function parseScanArgs(args) {
             index += 1;
             continue;
         }
+        if (arg === "--fail-on" || arg.startsWith("--fail-on=")) {
+            const value = arg === "--fail-on" ? args[(index += 1)] : arg.slice("--fail-on=".length);
+            if (value !== "block" && value !== "warn" && value !== "never") {
+                return { error: "--fail-on requires 'block', 'warn', or 'never'" };
+            }
+            failOn = value;
+            continue;
+        }
         if (arg.startsWith("-")) {
             return { error: `unknown option '${arg}'` };
         }
@@ -164,14 +207,16 @@ function parseScanArgs(args) {
         sawTarget,
         staged,
         hook,
-        noDecisions
+        noDecisions,
+        failOn,
+        installOrigin
     };
 }
 function usageError(message) {
     return {
         exitCode: EXIT_USAGE_VERDICT,
         stdout: "",
-        stderr: `dg scan: ${message}. Usage: dg scan [path] [--json|--sarif] [--output <path>] [--no-decisions]\n`
+        stderr: `dg scan: ${message}. Usage: dg scan [path] [--json|--sarif] [--output <path>] [--fail-on <block|warn|never>] [--no-decisions]\n`
     };
 }
 function loadScanDecisions(targetPath, env = process.env) {
@@ -190,7 +235,9 @@ function loadScanDecisions(targetPath, env = process.env) {
     }
     const file = loadDgFile(root);
     warnUnreadableDgFile(file);
-    return file.readable ? file : null;
+    // Gate decisions/exemptions through the trust check so a cloned hostile repo's
+    // dg.json cannot suppress a warn it did not author on this machine.
+    return file.readable ? gateProjectDecisions(file, root, env) : null;
 }
 function degradeReport(report, error) {
     const status = report.status === "block" || report.status === "warn" ? report.status : "unknown";
@@ -214,20 +261,23 @@ function renderReport(report, format, scannerUnavailable, skipNotice, nothingToS
     }
     return renderTextReport(report, undefined, createTheme(resolvePresentation().color), skipNotice);
 }
-function exitCodeForReport(report) {
+function exitCodeForReport(report, failOn) {
     if (report.scanner) {
-        const mode = loadUserConfig().policy.mode;
-        const action = mode === "strict" ? report.scanner.action : report.decisions?.effectiveAction ?? report.scanner.action;
-        return scanExitCode(action, mode);
+        const action = report.decisions?.effectiveAction ?? report.scanner.action;
+        return verdictExitCode(applyLocalFindingEscalation(action, report.findings), failOn);
     }
-    if (report.status === "block") {
-        return 2;
+    if (report.status === "block" || report.status === "warn") {
+        return verdictExitCode(report.status, failOn);
     }
-    if (report.status === "warn") {
-        return 1;
+    // A 401 is a permanent configuration error (a rejected/expired key), not a
+    // transient outage — surface it as a usage error so CI fails closed rather than
+    // passing green the way analysis-incomplete (4) does under a fail-open policy. A
+    // 403 can be edge/proxy/WAF-injected and transient, so leave it to the 4 path.
+    if (report.scannerError?.kind === "auth" && report.scannerError.statusCode === 401) {
+        return EXIT_USAGE_VERDICT;
     }
     if (report.status === "error" || report.status === "unknown") {
         return 4;
     }
-    return 0;
+    return verdictExitCode(report.status, failOn);
 }