@westbayberry/dg 2.3.3 → 2.3.4

package/dist/scan/discovery.js

@@ -49,6 +49,7 @@ export function scanProject(options = {}) {
     });
     return {
         target: displayPath(cwd, absoluteTarget),
+        targetDir: displayPath(cwd, root),
         status,
         projects,
         findings,
@@ -257,17 +258,27 @@ function dependencyFindings(manifest, manifestPath, project) {
 }
 function dependencySpecifierSeverity(specifier) {
     const normalized = specifier.trim().toLowerCase();
-    if (normalized.startsWith("http://")
-        || normalized.startsWith("https://")
-        || normalized.startsWith("git+")
-        || normalized.startsWith("git://")
-        || normalized.startsWith("ssh://")
-        || normalized.startsWith("github:")) {
+    // git-based and ssh specifiers (github:, git+https, git+ssh, ssh://) are a
+    // common, legitimate way to pin private forks. They are unscanned, so surface
+    // them as a warn rather than failing CI — a repo full of internal git deps
+    // would otherwise hit a block on every run. (git+ over plaintext http is a
+    // genuine MITM risk and is still blocked below.)
+    if (normalized.startsWith("git+http://") || normalized.startsWith("git+git://")) {
         return "block";
     }
-    if (normalized.startsWith("file:")) {
+    if (normalized.startsWith("git+")
+        || normalized.startsWith("ssh://")
+        || normalized.startsWith("github:")
+        || normalized.startsWith("file:")) {
         return "warn";
     }
+    // Plaintext transport, or a raw tarball pinned to an arbitrary host: unscanned
+    // and registry-bypassing, so block.
+    if (normalized.startsWith("http://")
+        || normalized.startsWith("https://")
+        || normalized.startsWith("git://")) {
+        return "block";
+    }
     return null;
 }
 function dependencyCount(manifest) {

package/dist/scan/installed.js

@@ -0,0 +1,202 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { basename, join } from "node:path";
+function add(acc, ecosystem, name, version, origin) {
+    if (!name || !version)
+        return;
+    const key = `${ecosystem}:${name}@${version}`;
+    if (acc.seen.has(key))
+        return;
+    acc.seen.add(key);
+    const list = acc.byEcosystem.get(ecosystem) ?? [];
+    list.push({ name, version });
+    acc.byEcosystem.set(ecosystem, list);
+    acc.origins.set(key, origin);
+}
+function readDirentsSafe(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+}
+// PEP 503 normalization so a venv's `Foo_Bar` matches the registry's `foo-bar`.
+function normalizePypiName(name) {
+    return name.toLowerCase().replace(/[-_.]+/g, "-");
+}
+function parseMetadataHeaders(text) {
+    let name = null;
+    let version = null;
+    for (const raw of text.split(/\r?\n/u)) {
+        if (raw.trim() === "")
+            break; // RFC822 headers end at the first blank line
+        if (name === null && raw.startsWith("Name:"))
+            name = raw.slice(5).trim();
+        else if (version === null && raw.startsWith("Version:"))
+            version = raw.slice(8).trim();
+        if (name !== null && version !== null)
+            break;
+    }
+    return name && version ? { name: normalizePypiName(name), version } : null;
+}
+const SUBTREE_MAX_DEPTH = 8;
+const SUBTREE_PRUNED_DIRS = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    "vendor",
+    "__pycache__",
+    "target",
+    "coverage",
+]);
+function discoverEnvironmentDirs(root) {
+    const venvs = [];
+    const nodeModules = [];
+    const visit = (dir, depth) => {
+        if (depth > SUBTREE_MAX_DEPTH)
+            return;
+        for (const entry of readDirentsSafe(dir)) {
+            if (!entry.isDirectory())
+                continue;
+            const child = join(dir, entry.name);
+            if (entry.name === "node_modules") {
+                nodeModules.push(child);
+                continue;
+            }
+            if (SUBTREE_PRUNED_DIRS.has(entry.name))
+                continue;
+            if (existsSync(join(child, "pyvenv.cfg"))) {
+                venvs.push(child);
+                continue;
+            }
+            visit(child, depth + 1);
+        }
+    };
+    visit(root, 0);
+    return { venvs, nodeModules };
+}
+function sitePackagesDirs(prefix) {
+    const out = [];
+    for (const entry of readDirentsSafe(join(prefix, "lib"))) {
+        if (entry.isDirectory() && entry.name.startsWith("python")) {
+            out.push(join(prefix, "lib", entry.name, "site-packages"));
+        }
+    }
+    out.push(join(prefix, "Lib", "site-packages")); // Windows layout
+    return out.filter(existsSync);
+}
+function pythonEnvironmentRoots(env, subtreeVenvs) {
+    const roots = new Set(subtreeVenvs);
+    if (env.VIRTUAL_ENV && existsSync(join(env.VIRTUAL_ENV, "pyvenv.cfg")))
+        roots.add(env.VIRTUAL_ENV);
+    if (env.CONDA_PREFIX && sitePackagesDirs(env.CONDA_PREFIX).length > 0)
+        roots.add(env.CONDA_PREFIX);
+    return [...roots];
+}
+function collectPython(env, subtreeVenvs, acc) {
+    for (const prefix of pythonEnvironmentRoots(env, subtreeVenvs)) {
+        for (const siteDir of sitePackagesDirs(prefix)) {
+            let found = false;
+            for (const entry of readDirentsSafe(siteDir)) {
+                if (!entry.isDirectory())
+                    continue;
+                const metaPath = entry.name.endsWith(".dist-info")
+                    ? join(siteDir, entry.name, "METADATA")
+                    : entry.name.endsWith(".egg-info")
+                        ? join(siteDir, entry.name, "PKG-INFO")
+                        : null;
+                if (!metaPath || !existsSync(metaPath))
+                    continue;
+                let parsed = null;
+                try {
+                    parsed = parseMetadataHeaders(readFileSync(metaPath, "utf8"));
+                }
+                catch {
+                    parsed = null;
+                }
+                if (parsed) {
+                    add(acc, "pypi", parsed.name, parsed.version, `${basename(prefix)} (installed)`);
+                    found = true;
+                }
+            }
+            if (found)
+                acc.sources.add(`${basename(prefix)}/${basename(siteDir)} (pypi)`);
+        }
+    }
+}
+const NODE_MODULES_MAX_DEPTH = 8;
+const NODE_MODULES_ORIGIN = "node_modules (installed)";
+const NODE_MODULES_SOURCE = "node_modules (npm)";
+const PNPM_ORIGIN = "node_modules/.pnpm (installed)";
+const PNPM_SOURCE = "node_modules/.pnpm (npm)";
+function readPackageJson(dir) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function collectNodeModules(nodeModulesDir, acc, depth) {
+    if (depth > NODE_MODULES_MAX_DEPTH)
+        return;
+    for (const entry of readDirentsSafe(nodeModulesDir)) {
+        if (!entry.isDirectory() || entry.name === ".bin" || entry.name === ".cache")
+            continue;
+        if (entry.name === ".pnpm") {
+            collectPnpmStore(join(nodeModulesDir, entry.name), acc);
+            continue;
+        }
+        if (entry.name.startsWith("@")) {
+            for (const scoped of readDirentsSafe(join(nodeModulesDir, entry.name))) {
+                if (scoped.isDirectory()) {
+                    collectNodePackage(join(nodeModulesDir, entry.name, scoped.name), acc, depth, NODE_MODULES_ORIGIN, NODE_MODULES_SOURCE);
+                }
+            }
+            continue;
+        }
+        if (entry.name.startsWith("."))
+            continue;
+        collectNodePackage(join(nodeModulesDir, entry.name), acc, depth, NODE_MODULES_ORIGIN, NODE_MODULES_SOURCE);
+    }
+}
+function collectPnpmStore(storeDir, acc) {
+    for (const entry of readDirentsSafe(storeDir)) {
+        if (!entry.isDirectory())
+            continue;
+        const inner = join(storeDir, entry.name, "node_modules");
+        for (const pkgEntry of readDirentsSafe(inner)) {
+            if (!pkgEntry.isDirectory() || pkgEntry.name === ".bin")
+                continue;
+            if (pkgEntry.name.startsWith("@")) {
+                for (const scoped of readDirentsSafe(join(inner, pkgEntry.name))) {
+                    if (scoped.isDirectory()) {
+                        collectNodePackage(join(inner, pkgEntry.name, scoped.name), acc, 0, PNPM_ORIGIN, PNPM_SOURCE);
+                    }
+                }
+                continue;
+            }
+            collectNodePackage(join(inner, pkgEntry.name), acc, 0, PNPM_ORIGIN, PNPM_SOURCE);
+        }
+    }
+}
+function collectNodePackage(packageDir, acc, depth, origin, source) {
+    const pkg = readPackageJson(packageDir);
+    if (pkg && typeof pkg.name === "string" && typeof pkg.version === "string") {
+        add(acc, "npm", pkg.name, pkg.version, origin);
+        acc.sources.add(source);
+    }
+    const nested = join(packageDir, "node_modules");
+    if (existsSync(nested))
+        collectNodeModules(nested, acc, depth + 1);
+}
+export function discoverInstalledPackages(root, env = process.env) {
+    const acc = { byEcosystem: new Map(), origins: new Map(), seen: new Set(), sources: new Set() };
+    const { venvs, nodeModules } = discoverEnvironmentDirs(root);
+    collectPython(env, venvs, acc);
+    for (const dir of nodeModules)
+        collectNodeModules(dir, acc, 0);
+    return { byEcosystem: acc.byEcosystem, origins: acc.origins, sources: [...acc.sources] };
+}

package/dist/scan/manifest-coverage.js

@@ -0,0 +1,128 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { gitIgnoredDirectories } from "./discovery.js";
+const IGNORED_DIRECTORIES = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    "vendor",
+    "__pycache__",
+    ".venv",
+    "venv",
+    "target",
+    "coverage",
+    ".cache",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".ruff_cache",
+    ".idea",
+    ".vscode"
+]);
+const MAX_DISCOVERY_DEPTH = 12;
+const NPM_LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml"];
+const PYPI_LOCKFILES = ["requirements.txt", "Pipfile.lock", "poetry.lock", "uv.lock"];
+const PYPI_MANIFEST_MARKERS = [
+    { file: "pyproject.toml", declares: pyprojectDeclaresDeps },
+    { file: "Pipfile", declares: (text) => /^\s*\[(?:dev-)?packages\]/mu.test(text) },
+    { file: "setup.cfg", declares: (text) => /install_requires\s*=/u.test(text) },
+    { file: "setup.py", declares: (text) => /install_requires\s*=/u.test(text) },
+    { file: "environment.yml", declares: (text) => /^\s*dependencies\s*:/mu.test(text) },
+    { file: "environment.yaml", declares: (text) => /^\s*dependencies\s*:/mu.test(text) }
+];
+function pyprojectDeclaresDeps(text) {
+    return /^\s*dependencies\s*=/mu.test(text)
+        || /\[tool\.poetry\.dependencies\]/u.test(text)
+        || /\[build-system\]/u.test(text)
+        || /\[project\.optional-dependencies\]/u.test(text);
+}
+function readDirents(directory) {
+    try {
+        return readdirSync(directory, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+}
+function readTextSafe(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function npmDeclaredCount(path) {
+    const text = readTextSafe(path);
+    if (text === null) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        let count = 0;
+        for (const section of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+            const deps = parsed[section];
+            if (deps && typeof deps === "object" && !Array.isArray(deps)) {
+                count += Object.keys(deps).length;
+            }
+        }
+        return count;
+    }
+    catch {
+        return null;
+    }
+}
+// A directory that declares dependencies in a manifest but ships no lockfile for
+// that ecosystem cannot be version-resolved, so the scanner never sees those
+// packages. Surfacing the manifest turns that silent "nothing to scan" into an
+// actionable nudge (generate a lockfile) instead of a false all-clear.
+export function detectUnlockedManifests(root) {
+    const found = [];
+    const gitIgnored = gitIgnoredDirectories(root);
+    walk(root, 0);
+    return found;
+    function walk(directory, depth) {
+        if (depth > MAX_DISCOVERY_DEPTH) {
+            return;
+        }
+        const entries = readDirents(directory);
+        const names = new Set(entries.filter((entry) => entry.isFile()).map((entry) => entry.name));
+        if (names.has("package.json") && !NPM_LOCKFILES.some((lock) => names.has(lock))) {
+            const declaredCount = npmDeclaredCount(join(directory, "package.json"));
+            if (declaredCount === null || declaredCount > 0) {
+                found.push({ file: "package.json", location: displayFile(root, directory, "package.json"), ecosystem: "npm", declaredCount });
+            }
+        }
+        if (!PYPI_LOCKFILES.some((lock) => names.has(lock))) {
+            for (const marker of PYPI_MANIFEST_MARKERS) {
+                if (!names.has(marker.file)) {
+                    continue;
+                }
+                const text = readTextSafe(join(directory, marker.file));
+                if (text !== null && marker.declares(text)) {
+                    found.push({ file: marker.file, location: displayFile(root, directory, marker.file), ecosystem: "pypi", declaredCount: null });
+                    break;
+                }
+            }
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory() &&
+                !IGNORED_DIRECTORIES.has(entry.name) &&
+                !gitIgnored.has(join(directory, entry.name))) {
+                walk(join(directory, entry.name), depth + 1);
+            }
+        }
+    }
+}
+function displayFile(root, directory, file) {
+    const rel = relative(root, directory);
+    return rel.length === 0 ? file : `${rel.split(/[\\/]/u).join("/")}/${file}`;
+}
+export function unlockedManifestNotice(manifests) {
+    if (manifests.length === 0) {
+        return null;
+    }
+    const sample = manifests.slice(0, 6).map((manifest) => manifest.location).join(", ");
+    const more = manifests.length > 6 ? `, plus ${manifests.length - 6} more` : "";
+    return `Declared dependencies without a lockfile — not verified: ${sample}${more}. Generate a lockfile (npm install, uv lock, poetry lock, or pip freeze > requirements.txt) so dg can resolve and scan them.`;
+}

package/dist/scan/render.js

@@ -1,18 +1,82 @@
 import { createTheme } from "../presentation/theme.js";
 import { packagePageUrl } from "../presentation/package-page.js";
+import { safeVersionLine } from "../presentation/safe-version.js";
+import { automationCategory, findingFingerprint, sarifLocationEntry } from "../presentation/sarif.js";
 import { sanitizeDeep } from "../security/sanitize.js";
 const DETAIL_PROJECT_LIMIT = 8;
 const CLEAN_PROJECT_PREVIEW_LIMIT = 5;
 const FINDING_GROUP_PREVIEW_LIMIT = 3;
-const SCAN_STATUS_ROLE = {
+const DISPLAY_STATUS_ROLE = {
     pass: "pass",
     warn: "warn",
     block: "block",
     unknown: "unknown",
+    analysis_incomplete: "unknown",
     error: "block"
 };
 export function displayScanStatus(report) {
-    return report.scannerError && report.status === "unknown" ? "analysis_incomplete" : report.status;
+    if (report.scanner && report.decisions && !report.scannerError) {
+        return applyLocalFindingEscalation(report.decisions.effectiveAction, report.findings);
+    }
+    if (report.status === "unknown" && (report.scannerError || report.scanner?.action === "analysis_incomplete")) {
+        return "analysis_incomplete";
+    }
+    return report.status;
+}
+// The canonical scanner verdict (pass | warn | block | error), independent of any
+// --fail-on policy gating applied to the exit code. Consumers like the GitHub
+// Action read this from runs[0].properties.dgVerdict so they report the real
+// verdict instead of inferring it from a policy-suppressed exit status.
+export function sarifVerdict(report) {
+    if (report.scanner) {
+        const action = report.decisions?.effectiveAction ?? report.scanner.action;
+        if (action === "block" || action === "warn" || action === "pass") {
+            return action;
+        }
+        return "error";
+    }
+    if (report.status === "block" || report.status === "warn" || report.status === "pass") {
+        return report.status;
+    }
+    return "error";
+}
+// Root-manifest heuristics (http:/file: deps, install lifecycle scripts) are
+// signals the server scan never receives, so they must be able to escalate the
+// verdict on their own — a lockfile must never mask a local block.
+export function applyLocalFindingEscalation(base, findings) {
+    const active = findings.filter((finding) => !finding.acknowledged);
+    if (active.some((finding) => finding.severity === "block")) {
+        return "block";
+    }
+    if (base !== "pass") {
+        return base;
+    }
+    return active.some((finding) => finding.severity === "warn") ? "warn" : "pass";
+}
+const UNSCANNED_REASON_LABELS = {
+    unpinned: "declared without a pinned version",
+    "off-registry": "resolved from an unexpected host",
+    git: "git or ssh source (not fetched from a registry)",
+    "direct-url": "direct URL artifact",
+    "unsupported-ecosystem": "ecosystem not yet analyzed by the scanner",
+    "index-override": "custom package index override"
+};
+function unscannedLines(unscanned, theme) {
+    const role = unscanned.escalating > 0 ? "unknown" : "warn";
+    const head = unscanned.escalating > 0
+        ? `${unscanned.total} package${unscanned.total === 1 ? "" : "s"} could not be verified (${unscanned.escalating} left the verdict incomplete)`
+        : `${unscanned.total} package${unscanned.total === 1 ? "" : "s"} not sent to the scanner`;
+    const lines = [theme.paint(role, `Not scanned: ${head}`)];
+    for (const [reason, count] of Object.entries(unscanned.byReason)) {
+        lines.push(`  ${count} ${UNSCANNED_REASON_LABELS[reason] ?? reason}`);
+    }
+    for (const pkg of unscanned.sample.slice(0, 5)) {
+        lines.push(`    ${pkg.name}  (${pkg.location})`);
+    }
+    if (unscanned.byReason.unpinned) {
+        lines.push("  Pin versions (e.g. requests==2.31.0) or install first so dg can resolve and verify them.");
+    }
+    return lines;
 }
 const SCANNER_SKIP_MESSAGES = {
     no_lockfile: "no lockfile found — server verification skipped (local heuristics only)",
@@ -56,6 +120,10 @@ export function renderTextReport(rawReport, terminalWidth = terminalWidthFromEnv
         lines.push(SCANNER_SKIP_MESSAGES[scannerNotice]);
         lines.push("");
     }
+    if (report.unscanned) {
+        lines.push(...unscannedLines(report.unscanned, theme));
+        lines.push("");
+    }
     if (report.projects.length === 0 && report.errors.length === 0 && !report.scanner && !report.scannerError) {
         lines.push("No supported project manifests found.");
     }
@@ -98,12 +166,29 @@ export function renderTextReport(rawReport, terminalWidth = terminalWidthFromEnv
             lines.push("");
         }
     }
+    lines.push(...safeVersionLines(report, theme));
     lines.push(...packagePageLines(report, theme));
     for (const error of report.errors) {
         lines.push(...wrapLine(`ERROR ${error.location}: `, error.message, width));
     }
     return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
 }
+function safeVersionLines(report, theme) {
+    const lines = [];
+    const seen = new Set();
+    for (const pkg of report.scanner?.packages ?? []) {
+        if (!pkg.safeVersion)
+            continue;
+        const key = `${pkg.name}@${pkg.version}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        lines.push(...safeVersionLine(pkg, theme, pkg.ecosystem));
+    }
+    if (lines.length === 0)
+        return [];
+    return ["Nearest versions dg doesn't flag:", ...lines, ""];
+}
 function packagePageLines(report, theme) {
     const urls = [];
     const seen = new Set();
@@ -129,14 +214,8 @@ function provenanceDowngradeLines(packages, theme) {
         .map((pkg) => theme.paint("warn", `Provenance downgrades: ${pkg.name}@${pkg.version} (was attested at ${pkg.provenance.downgrade.fromVersion})`));
 }
 function paintEffectiveStatus(report, theme) {
-    if (report.scanner && report.decisions && !report.scannerError) {
-        const action = report.decisions.effectiveAction;
-        if (action === "analysis_incomplete") {
-            return theme.paint("unknown", "analysis_incomplete");
-        }
-        return theme.paint(SCAN_STATUS_ROLE[action], action);
-    }
-    return theme.paint(SCAN_STATUS_ROLE[report.status], displayScanStatus(report));
+    const status = displayScanStatus(report);
+    return theme.paint(DISPLAY_STATUS_ROLE[status] ?? "unknown", status);
 }
 function formatProject(project, width) {
     const lines = [];
@@ -155,10 +234,14 @@ function formatProject(project, width) {
     }
     return lines;
 }
-export function renderJsonReport(report, scannerUnavailable = false, nothingToScan = false) {
+export function renderJsonReport(rawReport, scannerUnavailable = false, nothingToScan = false) {
+    // Strip control bytes from attacker-influenced fields (names, findings) the
+    // same way the text renderer does, so JSON consumers / log viewers are safe.
+    const report = sanitizeDeep(rawReport);
     return `${JSON.stringify({ schemaVersion: 1, ...report, status: nothingToScan ? "nothing_to_scan" : displayScanStatus(report), scannerUnavailable }, null, 2)}\n`;
 }
-export function renderSarifReport(report) {
+export function renderSarifReport(rawReport) {
+    const report = sanitizeDeep(rawReport);
     const rules = uniqueFindings(report.findings).map((finding) => ({
         id: finding.id,
         name: finding.title,
@@ -184,40 +267,42 @@ export function renderSarifReport(report) {
                         rules
                     }
                 },
-                results: report.findings.map((finding) => ({
-                    ruleId: finding.id,
-                    level: finding.severity === "block" ? "error" : "warning",
-                    message: {
-                        text: finding.message
-                    },
-                    locations: [
-                        {
-                            physicalLocation: {
-                                artifactLocation: {
-                                    uri: artifactUri(finding.location)
-                                }
+                automationDetails: {
+                    id: automationCategory(report.target)
+                },
+                properties: {
+                    dgVerdict: sarifVerdict(report)
+                },
+                results: report.findings.map((finding) => {
+                    return {
+                        ruleId: finding.id,
+                        level: finding.severity === "block" ? "error" : "warning",
+                        message: {
+                            text: finding.message
+                        },
+                        partialFingerprints: {
+                            dgFindingHash: findingFingerprint(`${finding.id}${finding.project}${finding.location}`)
+                        },
+                        locations: [
+                            sarifLocationEntry(finding.location, finding.manifestPath ?? report.projects[0]?.manifestPath, report.targetDir ?? report.target)
+                        ],
+                        ...(finding.acknowledged
+                            ? {
+                                suppressions: [
+                                    {
+                                        kind: "external",
+                                        justification: finding.acknowledged.reason || `accepted by ${finding.acknowledged.by}`
+                                    }
+                                ]
                             }
-                        }
-                    ],
-                    ...(finding.acknowledged
-                        ? {
-                            suppressions: [
-                                {
-                                    kind: "external",
-                                    justification: finding.acknowledged.reason || `accepted by ${finding.acknowledged.by}`
-                                }
-                            ]
-                        }
-                        : {})
-                }))
+                            : {})
+                    };
+                })
             }
         ]
     };
     return `${JSON.stringify(sarif, null, 2)}\n`;
 }
-function artifactUri(location) {
-    return location.replace(/:\d+$/u, "");
-}
 function uniqueFindings(findings) {
     const seen = new Set();
     const unique = [];