@westbayberry/dg 2.3.3 → 2.3.4

package/dist/scan/scanner-report.js

@@ -1,11 +1,14 @@
 import { spawnSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { applyDecisions, packageKey } from "../decisions/apply.js";
 import { sanitize } from "../security/sanitize.js";
-import { collectScanPackages, discoverScanProjects } from "./collect.js";
+import { collectScanPackages, discoverScanProjects, mergeInstalledPackages } from "./collect.js";
+import { discoverInstalledPackages } from "./installed.js";
+import { applyLocalFindingEscalation } from "./render.js";
+import { ESCALATING_SKIP_REASONS } from "./types.js";
 const WORKER_TIMEOUT_BASE_MS = 180_000;
 const SERVER_PER_PACKAGE_WORST_CASE_MS = 660_000;
 const SERVER_SCAN_CONCURRENCY = 64;
@@ -13,16 +16,39 @@ const WORKER_MAX_BUFFER = 64 * 1024 * 1024;
 export function scanWorkerTimeoutMs(packageCount) {
     return WORKER_TIMEOUT_BASE_MS + packageCount * Math.ceil(SERVER_PER_PACKAGE_WORST_CASE_MS / SERVER_SCAN_CONCURRENCY);
 }
-export function runScannerScan(targetPath, localReport, env = process.env, decisionsFile = null) {
-    const projects = discoverScanProjects(resolve(targetPath));
-    if (projects.length === 0) {
+// Stable identity of the resolved dependency tree — sorted `eco:name@version`
+// keys hashed. `dg scan --install-origin` sends it so the server bills the tree
+// once per user per month rather than on every reinstall.
+function computeTreeHash(groups) {
+    const keys = [];
+    for (const group of groups) {
+        for (const pkg of group.packages) {
+            keys.push(`${group.ecosystem}:${pkg.name}@${pkg.version}`);
+        }
+    }
+    keys.sort();
+    return createHash("sha256").update(keys.join("\n")).digest("hex");
+}
+export function runScannerScan(targetPath, localReport, env = process.env, decisionsFile = null, installOrigin = false) {
+    const root = resolve(targetPath);
+    const projects = discoverScanProjects(root);
+    const installed = discoverInstalledPackages(root, env);
+    const installedTotal = [...installed.byEcosystem.values()].reduce((sum, list) => sum + list.length, 0);
+    if (projects.length === 0 && installedTotal === 0) {
         return { kind: "skipped", reason: "no_lockfiles" };
     }
-    const collected = collectScanPackages(projects);
+    const collected = mergeInstalledPackages(collectScanPackages(projects), installed);
     const groups = [...collected.byEcosystem.entries()].map(([ecosystem, packages]) => ({ ecosystem, packages }));
     const total = groups.reduce((sum, group) => sum + group.packages.length, 0);
     if (total === 0) {
-        if (collected.skipped > 0) {
+        // A lockfile that resolves to only workspace/local links (or a package from an
+        // ecosystem the analyzer does not cover, or a bare index directive) is a clean
+        // no-op, not a parse failure. Everything else that dropped a package —
+        // git/direct-url specs, unpinned or off-registry entries, real parse errors —
+        // still fails closed so an unverifiable artifact can't slip through as a
+        // benign skip.
+        const benignSkips = collected.skippedPackages.filter((pkg) => isBenignSkip(pkg.reason)).length;
+        if (collected.skipped > benignSkips) {
             return { kind: "failed", error: lockfileParseError(projects, collected) };
         }
         return { kind: "skipped", reason: "no_packages" };
@@ -37,11 +63,12 @@ export function runScannerScan(targetPath, localReport, env = process.env, decis
             error: { kind: "worker", message: "scanner worker is missing — reinstall @westbayberry/dg" }
         };
     }
+    const installTreeHash = installOrigin ? computeTreeHash(groups) : null;
     const timeoutMs = scanWorkerTimeoutMs(total);
     const worker = spawnSync(process.execPath, [workerPath], {
         encoding: "utf8",
         env,
-        input: JSON.stringify({ scanId: randomUUID(), groups }),
+        input: JSON.stringify({ scanId: randomUUID(), groups, ...(installTreeHash ? { installTreeHash } : {}) }),
         maxBuffer: WORKER_MAX_BUFFER,
         timeout: timeoutMs
     });
@@ -65,12 +92,51 @@ export function runScannerScan(targetPath, localReport, env = process.env, decis
             ecosystems.set(packageKey(pkg.name, pkg.version), group.ecosystem);
         }
     }
-    const report = buildScannerReport(localReport, response, total, ecosystems);
+    const report = withUnscanned(buildScannerReport(localReport, response, total, ecosystems, collected.origins), collected.skippedPackages);
     if (!decisionsFile?.readable) {
         return { kind: "report", report };
     }
     return { kind: "report", report: annotateReportWithDecisions(report, decisionsFile, ecosystems) };
 }
+function isBenignSkip(reason) {
+    return reason === "workspace" || reason === "local";
+}
+export function summarizeUnscanned(skippedPackages) {
+    if (!skippedPackages || skippedPackages.length === 0) {
+        return undefined;
+    }
+    const surfaced = skippedPackages.filter((pkg) => !isBenignSkip(pkg.reason));
+    if (surfaced.length === 0) {
+        return undefined;
+    }
+    const byReason = {};
+    let escalating = 0;
+    for (const pkg of surfaced) {
+        byReason[pkg.reason] = (byReason[pkg.reason] ?? 0) + 1;
+        if (ESCALATING_SKIP_REASONS.has(pkg.reason)) {
+            escalating += 1;
+        }
+    }
+    return { total: surfaced.length, escalating, byReason, sample: surfaced.slice(0, 20) };
+}
+// An escalating skip means a package that should have been verified was dropped,
+// so a passing scan is downgraded to analysis_incomplete rather than reading clean.
+export function withUnscanned(report, skippedPackages) {
+    const unscanned = summarizeUnscanned(skippedPackages);
+    if (!unscanned) {
+        return report;
+    }
+    const hasLocalBlock = report.findings.some((finding) => finding.severity === "block" && !finding.acknowledged);
+    if (unscanned.escalating > 0 && report.scanner && report.scanner.action !== "block" && !hasLocalBlock) {
+        return {
+            ...report,
+            status: "unknown",
+            scanner: { ...report.scanner, action: "analysis_incomplete" },
+            unscanned
+        };
+    }
+    return { ...report, unscanned };
+}
 export function tryScannerScan(targetPath, localReport, env = process.env, decisionsFile = null) {
     const outcome = runScannerScan(targetPath, localReport, env, decisionsFile);
     return outcome.kind === "report" ? outcome.report : null;
@@ -143,22 +209,24 @@ function lockfileParseError(projects, collected) {
             : `found ${projects.length} lockfile${projects.length === 1 ? "" : "s"} (${lockfiles}) but no packages could be parsed`
     };
 }
-export function buildScannerReport(localReport, response, analyzedCount, ecosystems) {
-    const packages = ecosystems
-        ? response.packages.map((pkg) => {
-            const ecosystem = ecosystems.get(packageKey(pkg.name, pkg.version));
-            return ecosystem ? { ...pkg, ecosystem } : pkg;
-        })
-        : response.packages;
-    const findings = packages
+export function buildScannerReport(localReport, response, analyzedCount, ecosystems, origins) {
+    const packages = response.packages.map((pkg) => {
+        const ecosystem = pkg.ecosystem ?? ecosystems?.get(packageKey(pkg.name, pkg.version));
+        return ecosystem ? { ...pkg, ecosystem } : pkg;
+    });
+    const scannerFindings = packages
         .filter((pkg) => (pkg.action ?? "pass") !== "pass")
-        .map((pkg) => scannerFinding(pkg));
+        .map((pkg) => scannerFinding(pkg, origins));
+    const scannerLocations = new Set(scannerFindings.map((finding) => finding.location));
+    const localFindings = localReport.findings.filter((finding) => !scannerLocations.has(finding.location));
+    const findings = [...localFindings, ...scannerFindings];
     const warnCount = findings.filter((finding) => finding.severity === "warn").length;
     const blockCount = findings.filter((finding) => finding.severity === "block").length;
     return {
         target: localReport.target,
-        status: statusFromAction(response.action),
-        projects: localReport.projects.map((project) => ({ ...project, findings: [] })),
+        ...(localReport.targetDir !== undefined ? { targetDir: localReport.targetDir } : {}),
+        status: statusFromAction(applyLocalFindingEscalation(response.action, findings)),
+        projects: localReport.projects,
         findings,
         errors: localReport.errors,
         summary: {
@@ -172,16 +240,18 @@ export function buildScannerReport(localReport, response, analyzedCount, ecosyst
         scanner: { ...response, packages }
     };
 }
-function scannerFinding(pkg) {
+function scannerFinding(pkg, origins) {
     const action = pkg.action ?? "pass";
     const top = pkg.findings[0];
+    const manifestPath = pkg.ecosystem ? origins?.get(`${pkg.ecosystem}:${pkg.name}@${pkg.version}`) : undefined;
     return {
         id: top?.category ?? top?.id ?? "scanner-finding",
         severity: action === "block" ? "block" : "warn",
         title: top?.title ?? pkg.reasons[0] ?? `scanner ${action} verdict`,
         message: pkg.reasons.join("; ") || top?.title || `scanner returned ${action} (score ${pkg.score})`,
         project: "",
-        location: `${pkg.name}@${pkg.version}`
+        location: `${pkg.name}@${pkg.version}`,
+        ...(manifestPath ? { manifestPath } : {})
     };
 }
 function statusFromAction(action) {

package/dist/scan/staged.js

@@ -7,6 +7,7 @@ import { DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
 import { offerRememberSync } from "../decisions/remember-prompt.js";
 import { packageKey } from "../decisions/apply.js";
 import { loadDgFile, resolveAcceptedBy, warnUnreadableDgFile } from "../project/dgfile.js";
+import { gateProjectDecisions } from "../project/override-trust.js";
 import { gitSync, gitTrimmed } from "../util/git.js";
 import { promptYesNo } from "../util/tty-prompt.js";
 import { GUARD_SELFTEST_ENV } from "../setup/git-hook.js";
@@ -30,6 +31,15 @@ function emptyLocalReport(target) {
         }
     };
 }
+const DEPENDENCY_MANIFEST_NAMES = new Set([
+    "package.json",
+    "pyproject.toml",
+    "Pipfile",
+    "setup.cfg",
+    "setup.py",
+    "environment.yml",
+    "environment.yaml"
+]);
 export function stagedLockfilePaths(cwd, env) {
     const diff = gitSync(["diff", "--cached", "--name-only", "--diff-filter=ACMR", "-z"], { cwd, env });
     if (!diff.ok) {
@@ -37,6 +47,13 @@ export function stagedLockfilePaths(cwd, env) {
     }
     return diff.stdout.split("\0").filter(Boolean).filter((path) => isLockfileName(basename(path)));
 }
+export function stagedDependencyManifestPaths(cwd, env) {
+    const diff = gitSync(["diff", "--cached", "--name-only", "--diff-filter=ACMR", "-z"], { cwd, env });
+    if (!diff.ok) {
+        return [];
+    }
+    return diff.stdout.split("\0").filter(Boolean).filter((path) => DEPENDENCY_MANIFEST_NAMES.has(basename(path)));
+}
 export function scopeStagedPaths(paths, root, cwd, targetPath) {
     if (!targetPath) {
         return [...paths];
@@ -53,18 +70,42 @@ export function scopeStagedPaths(paths, root, cwd, targetPath) {
 }
 export function materializeStaged(relPaths, cwd, env) {
     const dir = mkdtempSync(join(tmpdir(), "dg-staged-"));
-    let count = 0;
-    for (const relative of relPaths) {
-        const blob = gitSync(["show", `:${relative}`], { cwd, env });
-        if (!blob.ok) {
-            continue;
+    try {
+        let count = 0;
+        for (const relative of relPaths) {
+            const blob = gitSync(["show", `:${relative}`], { cwd, env });
+            if (!blob.ok) {
+                continue;
+            }
+            const destination = join(dir, relative);
+            mkdirSync(dirname(destination), { recursive: true });
+            writeFileSync(destination, blob.stdout, "utf8");
+            count += 1;
         }
-        const destination = join(dir, relative);
-        mkdirSync(dirname(destination), { recursive: true });
-        writeFileSync(destination, blob.stdout, "utf8");
-        count += 1;
+        return { dir, count };
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
     }
-    return { dir, count };
+}
+// Ctrl-C during the scan (realistic on a slow pre-commit guard) would otherwise
+// skip the try/finally and leak the materialized temp dir. Mirror the proxy
+// path's signal handling: remove the dir then exit with the signal's code.
+function installTempDirSignalCleanup(dir) {
+    const registrations = ["SIGINT", "SIGTERM"].map((signal) => {
+        const handler = () => {
+            rmSync(dir, { recursive: true, force: true });
+            process.exit(signal === "SIGINT" ? 130 : 143);
+        };
+        process.once(signal, handler);
+        return { handler, signal };
+    });
+    return () => {
+        for (const registration of registrations) {
+            process.off(registration.signal, registration.handler);
+        }
+    };
 }
 export function runStagedScan(options) {
     const env = options.env ?? process.env;
@@ -72,7 +113,7 @@ export function runStagedScan(options) {
     const theme = createTheme(resolvePresentation().color);
     // git exports GIT_INDEX_FILE to real pre-commit runs; its absence separates dg's hook self-test from a user commit that inherited the env var.
     if (options.hook && env[GUARD_SELFTEST_ENV] === "1" && env.GIT_INDEX_FILE === undefined) {
-        return { exitCode: 2, stdout: "", stderr: "dg guard-commit self-test: synthetic block (exit 2)\n" };
+        return { exitCode: 2, stdout: "", stderr: "dg commit-guard self-test: synthetic block (exit 2)\n" };
     }
     const root = gitTrimmed(["rev-parse", "--show-toplevel"], { cwd, env });
     if (!root) {
@@ -88,14 +129,15 @@ export function runStagedScan(options) {
         return outsideRepoResult(options.targetPath ?? "");
     }
     if (scoped.length === 0) {
-        return { exitCode: 0, stdout: "", stderr: "" };
+        return { exitCode: 0, stdout: "", stderr: stagedManifestNotice(cwd, env, theme) };
     }
     const dgFile = options.useDecisions === false ? null : loadDgFile(root);
     if (dgFile) {
         warnUnreadableDgFile(dgFile);
     }
-    const usableDgFile = dgFile?.readable ? dgFile : null;
+    const usableDgFile = dgFile?.readable ? gateProjectDecisions(dgFile, root, env) : null;
     const { dir, count } = materializeStaged(scoped, cwd, env);
+    const removeSignalCleanup = installTempDirSignalCleanup(dir);
     try {
         if (count === 0) {
             return failOpen(theme, "could not read the staged lockfile contents", onIncomplete);
@@ -107,6 +149,7 @@ export function runStagedScan(options) {
         return decideStagedVerdict(report, env, options.hook, usableDgFile ? { root, file: usableDgFile } : undefined);
     }
     finally {
+        removeSignalCleanup();
         rmSync(dir, { recursive: true, force: true });
     }
 }
@@ -134,16 +177,26 @@ export function stagedScanReport(options) {
         warnUnreadableDgFile(dgFile);
     }
     const { dir, count } = materializeStaged(scoped, cwd, env);
+    const removeSignalCleanup = installTempDirSignalCleanup(dir);
     try {
         if (count === 0) {
             return { report: base, outcome: { kind: "failed", error: { kind: "worker", message: "could not read the staged lockfile contents" } } };
         }
-        return { report: base, outcome: runScannerScan(dir, base, env, dgFile?.readable ? dgFile : null) };
+        return { report: base, outcome: runScannerScan(dir, base, env, dgFile?.readable ? gateProjectDecisions(dgFile, root, env) : null) };
     }
     finally {
+        removeSignalCleanup();
         rmSync(dir, { recursive: true, force: true });
     }
 }
+function stagedManifestNotice(cwd, env, theme) {
+    const manifests = stagedDependencyManifestPaths(cwd, env);
+    if (manifests.length === 0) {
+        return "";
+    }
+    const sample = manifests.slice(0, 3).join(", ");
+    return `  ${theme.paint("unknown", "?")} ${theme.paint("muted", `DG could not verify staged dependency manifest${manifests.length === 1 ? "" : "s"} (${sample}) — no lockfile staged. Commit a lockfile so dg can resolve and scan the declared versions.`)}\n`;
+}
 function safeRealpath(path) {
     try {
         return realpathSync(path);
@@ -220,7 +273,7 @@ export function stagedRememberOffer(report, decisionContext, env) {
             file: decisionContext.file,
             packages,
             acceptedBy: resolveAcceptedBy(decisionContext.root, env),
-            surface: "guard-commit",
+            surface: "commit-guard",
             env,
             ...(decisionContext.prompts ? { prompts: decisionContext.prompts } : {})
         });

package/dist/scan/types.js

@@ -1 +1,7 @@
-export {};
+// An unpinned entry has no resolvable version to verify, so it escalates a scan
+// to analysis_incomplete. Other reasons are surfaced without failing the verdict:
+// git/direct-url are screened by the proxy at install time, and workspace/local
+// are not published artifacts.
+export const ESCALATING_SKIP_REASONS = new Set([
+    "unpinned"
+]);

package/dist/scan-ui/LegacyApp.js

@@ -10,7 +10,7 @@ import { ErrorView } from "./components/ErrorView.js";
 import { ProjectSelector } from "./components/ProjectSelector.js";
 import { SetupBanner } from "./components/SetupBanner.js";
 import { useResizeRepaint } from "./hooks/useResizeRepaint.js";
-import { effectiveScanAction, scanExitCode } from "./shims.js";
+import { effectiveScanAction, verdictExitCode } from "./shims.js";
 import { leaveTui, showCursor, tuiIsActive } from "./alt-screen.js";
 import { formatResetDate } from "../install-ui/block-render.js";
 import { accountHeaderLine } from "./shims.js";
@@ -29,7 +29,7 @@ export const App = ({ config, setupIssues = [], initialView, updateAvailable })
     useEffect(() => () => leaveAltScreen(), [leaveAltScreen]);
     const handleResultsExit = useCallback(() => {
         if (state.phase === "results") {
-            process.exitCode = scanExitCode(effectiveScanAction(state.result.action, state.decisions?.effectiveAction, config.mode), config.mode);
+            process.exitCode = verdictExitCode(effectiveScanAction(state.result.action, state.decisions?.effectiveAction, config.mode), config.failOn ?? "block");
         }
         leaveAltScreen();
         exit();
@@ -61,7 +61,7 @@ export const App = ({ config, setupIssues = [], initialView, updateAvailable })
         // not only when the user dismisses the view — a piped/killed/non-TTY exit
         // must still carry the right code (an unverified scan is never a silent 0).
         if (state.phase === "results") {
-            process.exitCode = scanExitCode(effectiveScanAction(state.result.action, state.decisions?.effectiveAction, config.mode), config.mode);
+            process.exitCode = verdictExitCode(effectiveScanAction(state.result.action, state.decisions?.effectiveAction, config.mode), config.failOn ?? "block");
         }
     }, [state, config, exitWithMessage]);
     useInput((input, key) => {

package/dist/scan-ui/components/InteractiveResultsView.js

@@ -6,6 +6,7 @@ import { ExportDialog, loginRequiredToast } from "../../export-ui/ExportDialog.j
 import { resolvePresentation } from "../../presentation/mode.js";
 import { createTheme } from "../../presentation/theme.js";
 import { packagePageUrl } from "../../presentation/package-page.js";
+import { csvCell as csvEscape } from "../../security/csv.js";
 import { accountHeaderLine, isLoggedIn } from "../shims.js";
 import { packageKey } from "../../decisions/apply.js";
 import { ScoreHeader, COMPACT_ROWS, LOGO_MIN_COLS } from "./ScoreHeader.js";
@@ -242,7 +243,10 @@ function buildDetailLines(group, safeVersion, maxWidth) {
         lines.push(_jsxs(Text, { children: [chalk.dim("Recommendation:"), " ", chalk.cyan(truncate(rep.recommendation, maxWidth - 18))] }, "recommendation"));
     }
     if (safeVersion) {
-        lines.push(_jsx(Text, { children: chalk.green(`Safe version: ${rep.name}@${safeVersion}`) }, "safe"));
+        const sep = rep.ecosystem === "pypi" ? "==" : "@";
+        const note = safeVersion.crossesMajor ? "crosses major, may break" : "same major";
+        const text = `dg doesn't flag ${rep.name}${sep}${safeVersion.version} (${safeVersion.direction} · ${note})`;
+        lines.push(_jsx(Text, { children: safeVersion.crossesMajor ? chalk.yellow(text) : chalk.green(text) }, "safe"));
     }
     return lines;
 }
@@ -430,7 +434,6 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
         return {
             ...summary,
             packages: result.packages,
-            safeVersions: result.safeVersions,
             licenses: licenseGroups.map((g) => ({
                 spdx: g.spdx,
                 riskCategory: g.risk,
@@ -439,10 +442,10 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
             })),
         };
     };
-    const csvCell = (v) => {
-        const s = v === null || v === undefined ? "" : String(v);
-        return /[",\n\r]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
-    };
+    const csvCell = (v) => csvEscape(v === null || v === undefined ? "" : String(v));
+    // Escape Markdown table metacharacters so an attacker-named package can't forge
+    // a row/column or break the heading structure of an exported report.
+    const mdCell = (v) => String(v ?? "").replace(/\|/gu, "\\|").replace(/[\r\n]+/gu, " ");
     const formatExport = (payload, scope, format) => {
         if (format === "json") {
             return { body: JSON.stringify(payload, null, 2) + "\n", ext: "json" };
@@ -510,13 +513,13 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
             const renderPkgRows = (rows) => {
                 lines.push("## Packages", "", "| Name | Version | Score | License |", "|---|---|---|---|");
                 for (const r of rows)
-                    lines.push(`| ${r.name} | ${r.version} | ${r.score} | ${r.license ?? "—"} |`);
+                    lines.push(`| ${mdCell(r.name)} | ${mdCell(r.version)} | ${r.score} | ${mdCell(r.license ?? "—")} |`);
                 lines.push("");
             };
             const renderLicRows = (rows) => {
                 lines.push("## Licenses", "", "| License | Risk | Count |", "|---|---|---|");
                 for (const r of rows)
-                    lines.push(`| ${r.spdx} | ${r.riskCategory} | ${r.count} |`);
+                    lines.push(`| ${mdCell(r.spdx)} | ${mdCell(r.riskCategory)} | ${r.count} |`);
                 lines.push("");
             };
             if (scope === "summary") {
@@ -541,10 +544,10 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
             }
             else if (scope === "current-license") {
                 const r = payload;
-                lines.push(`## ${r.spdx}  ·  ${r.riskCategory}  ·  ${r.count} packages`, "");
+                lines.push(`## ${mdCell(r.spdx)}  ·  ${mdCell(r.riskCategory)}  ·  ${r.count} packages`, "");
                 lines.push("| Name | Version | Score |", "|---|---|---|");
                 for (const p of r.packages)
-                    lines.push(`| ${p.name} | ${p.version} | ${p.score} |`);
+                    lines.push(`| ${mdCell(p.name)} | ${mdCell(p.version)} | ${p.score} |`);
             }
             else if (scope === "findings") {
                 const rows = payload;
@@ -553,9 +556,9 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
                 }
                 else {
                     for (const r of rows) {
-                        lines.push(`### ${r.name}@${r.version}  ·  ${r.action.toUpperCase()}  ·  score ${r.score}`);
+                        lines.push(`### ${mdCell(r.name)}@${mdCell(r.version)}  ·  ${mdCell(r.action.toUpperCase())}  ·  score ${r.score}`);
                         for (const f of r.findings)
-                            lines.push(`- sev ${f.severity}: ${f.title ?? "(hidden)"}`);
+                            lines.push(`- sev ${f.severity}: ${mdCell(f.title ?? "(hidden)")}`);
                         lines.push("");
                     }
                 }
@@ -693,8 +696,8 @@ export const InteractiveResultsView = ({ result, config: _config, durationMs, on
     const detailLines = useMemo(() => {
         if (!detailGroup)
             return [];
-        return buildDetailLines(detailGroup, result.safeVersions[firstPackage(detailGroup).name], innerWidth);
-    }, [detailGroup, result.safeVersions, innerWidth]);
+        return buildDetailLines(detailGroup, firstPackage(detailGroup).safeVersion, innerWidth);
+    }, [detailGroup, innerWidth]);
     const detailContentRows = Math.max(3, termRows - DETAIL_PANE_CHROME);
     const getLevel = (idx) => {
         return view.expandedKey !== null && groups[idx]?.key === view.expandedKey ? view.expandLevel : null;

package/dist/scan-ui/hooks/useScan.js

@@ -3,7 +3,11 @@ import { useReducer, useEffect, useRef, useCallback, useState } from "react";
 import { analyzePackages, AnalyzeError, mergeAnalyzeResponses } from "../../api/analyze.js";
 import { applyDecisions, packageKey } from "../../decisions/apply.js";
 import { findProjectRoot, loadDgFile } from "../../project/dgfile.js";
-import { collectScanPackages, discoverScanProjectsAsync } from "../../scan/collect.js";
+import { gateProjectDecisions } from "../../project/override-trust.js";
+import { collectScanPackages, discoverScanProjectsAsync, mergeInstalledPackages } from "../../scan/collect.js";
+import { summarizeUnscanned } from "../../scan/scanner-report.js";
+import { detectUnlockedManifests, unlockedManifestNotice } from "../../scan/manifest-coverage.js";
+import { discoverInstalledPackages } from "../../scan/installed.js";
 function reducer(_state, action) {
     switch (action.type) {
         case "PROJECTS_FOUND":
@@ -46,6 +50,7 @@ export function useScan(config) {
         abortRef.current = new AbortController();
     }
     const [multiProjects, setMultiProjects] = useState(null);
+    const installedRef = useRef(null);
     useEffect(() => () => abortRef.current?.abort(), []);
     useEffect(() => {
         if (started.current) {
@@ -53,12 +58,20 @@ export function useScan(config) {
         }
         started.current = true;
         void (async () => {
-            const discovered = await discoverScanProjectsAsync(process.cwd(), (progress) => {
+            const root = process.cwd();
+            const discovered = await discoverScanProjectsAsync(root, (progress) => {
                 dispatch({ type: "DISCOVERY_PROGRESS", path: progress.path, found: progress.found });
             });
             const projects = discovered.filter((project) => project.ecosystem === "npm" || project.ecosystem === "pypi");
-            if (projects.length === 0) {
-                dispatch({ type: "DISCOVERY_EMPTY", message: "No dependency lockfiles found." });
+            const installed = discoverInstalledPackages(root, process.env);
+            installedRef.current = installed;
+            const installedTotal = [...installed.byEcosystem.values()].reduce((sum, list) => sum + list.length, 0);
+            if (projects.length === 0 && installedTotal === 0) {
+                const manifestNotice = unlockedManifestNotice(detectUnlockedManifests(root));
+                dispatch({
+                    type: "DISCOVERY_EMPTY",
+                    message: manifestNotice ?? "No dependencies found — no lockfiles, manifests, or installed packages here."
+                });
                 return;
             }
             if (projects.length > 1) {
@@ -66,11 +79,11 @@ export function useScan(config) {
                 dispatch({ type: "PROJECTS_FOUND", projects });
                 return;
             }
-            await scanProjects(projects, dispatch, abortRef.current?.signal);
+            await scanProjects(projects, installed, dispatch, abortRef.current?.signal);
         })();
     }, [config]);
     const scanSelectedProjects = useCallback((projects) => {
-        void scanProjects(projects, dispatch, abortRef.current?.signal);
+        void scanProjects(projects, installedRef.current, dispatch, abortRef.current?.signal);
     }, []);
     const restartSelection = useCallback(() => {
         if (multiProjects) {
@@ -89,10 +102,13 @@ function computeProjectDecisions(result, entries) {
         if (!root) {
             return undefined;
         }
-        const file = loadDgFile(root);
-        if (!file.readable) {
+        const loaded = loadDgFile(root);
+        if (!loaded.readable) {
             return undefined;
         }
+        // Gate decisions through the trust check so a hostile repo's dg.json can't
+        // suppress a warn in the scan TUI that it did not author on this machine.
+        const file = gateProjectDecisions(loaded, root, process.env);
         const ecosystems = new Map();
         for (const [ecosystem, packages] of entries) {
             for (const pkg of packages) {
@@ -105,17 +121,24 @@ function computeProjectDecisions(result, entries) {
         return undefined;
     }
 }
-async function scanProjects(projects, dispatch, signal) {
+function emptyScanMessage(skipped) {
+    if (skipped > 0) {
+        return `No packages to scan — found ${skipped} declared ${skipped === 1 ? "entry" : "entries"} with no pinned version. Pin them (e.g. requests==2.31.0) or run \`pip freeze > requirements.txt\`.`;
+    }
+    return "No packages to scan.";
+}
+async function scanProjects(projects, installed, dispatch, signal) {
     const startMs = Date.now();
     let skipped = 0;
     let total = 0;
     try {
-        const collected = collectScanPackages(projects);
+        const lockfilePackages = collectScanPackages(projects);
+        const collected = installed ? mergeInstalledPackages(lockfilePackages, installed) : lockfilePackages;
         skipped = collected.skipped;
         const entries = [...collected.byEcosystem.entries()];
         total = entries.reduce((sum, [, list]) => sum + list.length, 0);
         if (total === 0) {
-            dispatch({ type: "DISCOVERY_EMPTY", message: "No packages to scan." });
+            dispatch({ type: "DISCOVERY_EMPTY", message: emptyScanMessage(skipped) });
             return;
         }
         dispatch({ type: "DISCOVERY_COMPLETE", total });
@@ -170,8 +193,11 @@ async function scanProjects(projects, dispatch, signal) {
                     ecoByKey.set(packageKey(pkg.name, pkg.version), ecosystem);
                 }
             }
+            const unscanned = summarizeUnscanned(collected.skippedPackages);
+            const escalated = unscanned !== undefined && unscanned.escalating > 0 && base.action !== "block";
             const result = {
                 ...base,
+                ...(escalated ? { action: "analysis_incomplete" } : {}),
                 packages: base.packages.map((pkg) => {
                     const ecosystem = ecoByKey.get(packageKey(pkg.name, pkg.version));
                     return ecosystem ? { ...pkg, ecosystem } : pkg;

package/dist/scan-ui/launch.js

@@ -17,7 +17,7 @@ export function shouldLaunchScanTui(options) {
     }
     return resolvePresentation().mode === "rich";
 }
-export async function launchScanTui(initialView = "results") {
+export async function launchScanTui(initialView = "results", failOn = "block") {
     const ci = process.env.CI;
     const ciCleared = ci === "" || ci === "0" || ci === "false";
     if (ciCleared) {
@@ -29,7 +29,7 @@ export async function launchScanTui(initialView = "results") {
         import("./LegacyApp.js")
     ]);
     const mode = loadUserConfig().policy.mode;
-    const config = { mode };
+    const config = { mode, failOn: mode === "strict" ? "warn" : failOn };
     const update = pendingUpdate();
     const updateAvailable = update
         ? `Update available: ${update.current} → ${update.latest} · run dg update`

package/dist/scan-ui/logo.js

@@ -33,7 +33,9 @@ function fillCircle(grid, cx, cy, r, type) {
 const LOGO_DATA = (() => {
     const W = 22, H = 28;
     const grid = Array.from({ length: H }, () => Array(W).fill(0));
-    const cx = 11, cy = 14, R = 10;
+    // R<10: the even-width grid has no integer center, so R=10 lands the 0° node
+    // on the last column and clips its right half, skewing the logo left.
+    const cx = 11, cy = 14, R = 9;
     const angles = [270, 315, 0, 45, 90, 135, 180, 225];
     const nodes = angles.map(a => {
         const rad = a * Math.PI / 180;
@@ -70,7 +72,9 @@ export function renderLogo(action) {
     const colors = {
         1: chalk.dim,
         2: chalk.white,
-        3: (s) => chalk.bold.white(s),
+        // Brightness, not bold: terminals faux-bold braille by double-striking the
+        // glyph shifted right, which smears full cells (⣿) into the next column.
+        3: chalk.whiteBright,
         4: action === "block" ? chalk.red
             : action === "warn" ? chalk.yellow
                 : action === "analysis_incomplete" ? chalk.cyan