@westbayberry/dg 2.3.3 → 2.3.4

package/dist/agents/routing.js

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { buildAgentRoutingEnv } from "../launcher/env.js";
 import { readServiceState } from "../service/state.js";
 import { resolveDgPaths } from "../state/index.js";
-import { readSettings, writeSettingsAtomic } from "./persistence.js";
+import { readSettings, writeSettingsAtomic, writeFileAtomicSafe } from "./persistence.js";
 import { getAgent } from "./registry.js";
 // The agent's install hook screens statically; this routes the agent's ACTUAL
 // fetches through dg's proxy so a wrapped/dynamic install (eval, $VAR, python -m
@@ -29,30 +29,47 @@ function stripCodexBlock(content) {
     const block = new RegExp(`\\n?${escapeRegex(CODEX_BEGIN)}[\\s\\S]*?${escapeRegex(CODEX_END)}\\n?`, "g");
     return content.replace(block, "\n").replace(/\n{3,}/g, "\n\n");
 }
+function loadBackupPrior(backup) {
+    if (!existsSync(backup)) {
+        return {};
+    }
+    try {
+        return JSON.parse(readFileSync(backup, "utf8")).prior ?? {};
+    }
+    catch {
+        return {};
+    }
+}
 function applyClaudeRouting(settingsPath, routing, backup) {
     const { settings } = readSettings(settingsPath);
     const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
-    const prior = {};
+    // The backup must hold the user's PRE-dg values so removal can restore them. On
+    // a re-apply the `k in prior` guard preserves the snapshot captured on first
+    // apply, so dg's own values are never recorded as the user's prior. We only
+    // collapse a value that exactly equals what dg is writing now — never one that
+    // merely *looks* like dg's (a loopback host), which would silently delete the
+    // user's own local proxy / CA on `dg agents off`.
+    const prior = loadBackupPrior(backup);
     for (const [k, v] of Object.entries(routing)) {
-        prior[k] = k in envObj ? String(envObj[k]) : null;
+        if (!(k in prior)) {
+            const current = k in envObj ? String(envObj[k]) : null;
+            prior[k] = current === v ? null : current;
+        }
         envObj[k] = v;
     }
-    settings.env = envObj;
-    writeSettingsAtomic(settingsPath, settings);
+    // Write the restore backup BEFORE mutating the agent settings: an IO failure on
+    // the settings write then leaves a recoverable state, never settings routed
+    // through dg with no backup to undo them.
     mkdirSync(dirname(backup), { recursive: true, mode: 0o700 });
     writeFileSync(backup, `${JSON.stringify({ kind: "claude-env", path: settingsPath, prior }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    settings.env = envObj;
+    writeSettingsAtomic(settingsPath, settings);
 }
 function removeClaudeRouting(settingsPath, backup) {
     if (!existsSync(backup)) {
         return;
     }
-    let prior = {};
-    try {
-        prior = JSON.parse(readFileSync(backup, "utf8")).prior ?? {};
-    }
-    catch {
-        prior = {};
-    }
+    const prior = loadBackupPrior(backup);
     if (existsSync(settingsPath)) {
         const { settings } = readSettings(settingsPath);
         const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
@@ -82,14 +99,14 @@ function applyCodexRouting(configPath, routing) {
     const set = Object.entries(routing).map(([k, v]) => `${k} = ${JSON.stringify(v)}`).join(", ");
     const block = `${CODEX_BEGIN}\n[shell_environment_policy]\nset = { ${set} }\n${CODEX_END}\n`;
     const next = content === "" || content.endsWith("\n") ? `${content}${block}` : `${content}\n${block}`;
-    writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    writeFileAtomicSafe(configPath, next);
     return { applied: true, detail: configPath };
 }
 function removeCodexRouting(configPath) {
     if (!existsSync(configPath)) {
         return;
     }
-    writeFileSync(configPath, stripCodexBlock(readFileSync(configPath, "utf8")), { encoding: "utf8" });
+    writeFileAtomicSafe(configPath, stripCodexBlock(readFileSync(configPath, "utf8")));
 }
 function codexConfigPath(home) {
     return join(home, ".codex", "config.toml");

package/dist/api/analyze.js

@@ -1,11 +1,8 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { readAuthStateOrWarn } from "../auth/store.js";
 import { envAuthToken } from "../auth/env-token.js";
-import { loadUserConfig } from "../config/settings.js";
+import { assertVendorApiBaseUrl, loadUserConfig } from "../config/settings.js";
 import { sanitize, sanitizeResponse } from "../security/sanitize.js";
-import { resolveDgPaths } from "../state/index.js";
 import { dgVersion } from "../commands/version.js";
 export class AnalyzeError extends Error {
     statusCode;
@@ -95,16 +92,19 @@ const DEFAULT_TIMEOUT_MS = 180_000;
 const BATCH_CONCURRENCY = Math.max(1, Number(process.env.DG_ANALYZE_CONCURRENCY) || 4);
 export async function analyzePackages(packages, options) {
     const env = options.env ?? process.env;
+    if (options.bill === false || (options.publicFallback && !resolveToken(env))) {
+        return analyzePublicVerdicts(packages, options, env);
+    }
     const baseUrl = resolveApiBaseUrl(env);
     const context = {
         url: `${baseUrl}${ANALYZE_PATHS[options.ecosystem]}`,
         token: resolveToken(env),
-        deviceId: getOrCreateDeviceId(env),
         scanId: options.scanId ?? randomUUID(),
         fetchImpl: options.fetchImpl ?? fetch,
         timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
         ...(options.signal ? { signal: options.signal } : {}),
-        ...(options.cooldown ? { cooldown: options.cooldown } : {})
+        ...(options.cooldown ? { cooldown: options.cooldown } : {}),
+        ...(options.installTreeHash ? { installTreeHash: options.installTreeHash } : {})
     };
     const total = packages.length;
     const batches = [];
@@ -138,7 +138,107 @@ export async function analyzePackages(packages, options) {
     };
     const workers = Math.min(BATCH_CONCURRENCY, Math.max(1, batches.length));
     await Promise.all(Array.from({ length: workers }, () => runWorker()));
-    return mergeAnalyzeResponses(responses);
+    const merged = mergeAnalyzeResponses(responses);
+    // Tag every result with the ecosystem this call resolved, so consumers can tell
+    // a name@version apart across ecosystems (the authed batch response omits it).
+    return {
+        ...merged,
+        packages: merged.packages.map((pkg) => (pkg.ecosystem ? pkg : { ...pkg, ecosystem: options.ecosystem }))
+    };
+}
+const PUBLIC_VERDICT_PATH = "/v1/install-verdict";
+// Account-free per-package verdict path for the install-time firewall when no
+// API token is present. The authed batch endpoints require a Bearer key, but
+// the firewall must keep blocking known-malicious packages for signed-out
+// users, so each package is resolved through the public install-verdict
+// endpoint (the same verdict the package pages show) and reshaped into the
+// AnalyzeResponse the firewall callers already consume.
+async function analyzePublicVerdicts(packages, options, env) {
+    const url = `${resolveApiBaseUrl(env)}${PUBLIC_VERDICT_PATH}`;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const total = packages.length;
+    options.onProgress?.({ done: 0, total, batchIndex: 0, batchCount: 1 });
+    const results = new Array(packages.length);
+    let done = 0;
+    let cursor = 0;
+    const runWorker = async () => {
+        for (let i = cursor++; i < packages.length; i = cursor++) {
+            const entry = packages[i];
+            if (!entry)
+                continue;
+            results[i] = await fetchPublicVerdict(url, options.ecosystem, entry, fetchImpl, timeoutMs, options);
+            done += 1;
+            options.onProgress?.({ done, total, batchIndex: 0, batchCount: 1 });
+        }
+    };
+    const workers = Math.min(BATCH_CONCURRENCY, Math.max(1, packages.length));
+    await Promise.all(Array.from({ length: workers }, () => runWorker()));
+    const rank = { pass: 0, analysis_incomplete: 1, warn: 2, block: 3 };
+    let action = "pass";
+    for (const pkg of results) {
+        const a = pkg.action ?? "analysis_incomplete";
+        if (rank[a] > rank[action])
+            action = a;
+    }
+    return { score: 0, action, packages: results, durationMs: 0 };
+}
+async function fetchPublicVerdict(url, ecosystem, entry, fetchImpl, timeoutMs, options) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const onAbort = () => controller.abort();
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    if (options.signal?.aborted) {
+        controller.abort();
+    }
+    try {
+        const response = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-Dg-Version": dgVersion()
+            },
+            body: JSON.stringify({
+                ecosystem,
+                name: entry.name,
+                version: entry.version,
+                ...(options.cooldown ? { cooldown: options.cooldown } : {})
+            }),
+            signal: controller.signal
+        });
+        if (!response.ok) {
+            const body = await response.json().catch(() => undefined);
+            throw analyzeErrorFromResponse(response.status, body);
+        }
+        const payload = await response.json().catch(() => {
+            throw new AnalyzeError("scanner returned an unreadable response", response.status, undefined, "invalid_response");
+        });
+        return publicVerdictToPackage(ecosystem, entry, payload);
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onAbort);
+    }
+}
+function publicVerdictToPackage(ecosystem, entry, payload) {
+    const v = (payload && typeof payload === "object" ? payload : {});
+    const action = v.cause === "analysis-incomplete"
+        ? "analysis_incomplete"
+        : normalizeAction(v.verdict);
+    const reason = typeof v.reason === "string" && v.reason.length > 0 ? sanitize(v.reason) : undefined;
+    return {
+        name: entry.name,
+        version: entry.version,
+        score: 0,
+        action,
+        findings: [],
+        reasons: reason ? [reason] : [],
+        ...(reason ? { recommendation: reason } : {}),
+        cached: false,
+        ecosystem,
+        ...(typeof v.scannedSha256 === "string" ? { artifactSha256: v.scannedSha256 } : {}),
+        ...(v.provenance && typeof v.provenance === "object" ? { provenance: v.provenance } : {})
+    };
 }
 const MAX_BATCH_ATTEMPTS = 3;
 async function analyzeBatchWithRetry(context, batch, onBatchProgress) {
@@ -179,7 +279,7 @@ function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function analyzeBatch(context, batch, onBatchProgress) {
-    const { url, token, deviceId, scanId, fetchImpl, timeoutMs, signal, cooldown } = context;
+    const { url, token, scanId, fetchImpl, timeoutMs, signal, cooldown, installTreeHash } = context;
     const controller = new AbortController();
     let timedOut = false;
     let silenceTimer;
@@ -202,9 +302,9 @@ async function analyzeBatch(context, batch, onBatchProgress) {
             headers: {
                 "Content-Type": "application/json",
                 "Accept": "application/x-ndjson",
-                "X-Device-Id": deviceId,
                 "X-Scan-Id": scanId,
                 "X-Dg-Version": dgVersion(),
+                ...(installTreeHash ? { "X-Install-Tree-Hash": installTreeHash } : {}),
                 ...(token ? { Authorization: `Bearer ${token}` } : {})
             },
             body: JSON.stringify({
@@ -255,6 +355,7 @@ function analyzeErrorFromResponse(status, body) {
     }
     return probe;
 }
+const MAX_STREAM_LINE_BYTES = 32 * 1024 * 1024;
 async function consumeAnalyzeStream(body, onBatchProgress, onActivity) {
     const reader = body.getReader();
     const decoder = new TextDecoder();
@@ -293,6 +394,11 @@ async function consumeAnalyzeStream(body, onBatchProgress, onActivity) {
                 handleLine(buffer.slice(0, newline).trim());
                 buffer = buffer.slice(newline + 1);
             }
+            // A newline-less / header-less stream would grow the buffer without bound;
+            // a single NDJSON event is never this large, so cap it and fail closed.
+            if (buffer.length > MAX_STREAM_LINE_BYTES) {
+                throw new AnalyzeError("scanner stream line exceeded the size limit", 0);
+            }
         }
         handleLine(buffer.trim());
     }
@@ -316,9 +422,9 @@ export function normalizeAnalyzeResponse(raw) {
             ...entry,
             action: entry.action === undefined ? undefined : normalizeAction(entry.action),
             findings: Array.isArray(entry.findings) ? entry.findings : [],
-            reasons: Array.isArray(entry.reasons) ? entry.reasons : []
+            reasons: Array.isArray(entry.reasons) ? entry.reasons : [],
+            safeVersion: normalizeSafeVersion(entry.safeVersion)
         })),
-        safeVersions: candidate.safeVersions ?? {},
         durationMs: typeof candidate.durationMs === "number" ? candidate.durationMs : 0,
         ...(candidate.freeScansRemaining !== undefined ? { freeScansRemaining: candidate.freeScansRemaining } : {}),
         ...(candidate.usage !== undefined ? { usage: candidate.usage } : {})
@@ -330,6 +436,16 @@ function normalizeAction(action) {
     }
     return "analysis_incomplete";
 }
+function normalizeSafeVersion(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const v = value;
+    if (typeof v.version !== "string" || v.version.length === 0)
+        return undefined;
+    if (v.direction !== "upgrade" && v.direction !== "downgrade")
+        return undefined;
+    return { version: sanitize(v.version), direction: v.direction, crossesMajor: v.crossesMajor === true };
+}
 export function mergeAnalyzeResponses(responses) {
     const first = responses[0];
     if (!first) {
@@ -337,7 +453,6 @@ export function mergeAnalyzeResponses(responses) {
             score: 0,
             action: "pass",
             packages: [],
-            safeVersions: {},
             durationMs: 0
         };
     }
@@ -354,7 +469,6 @@ export function mergeAnalyzeResponses(responses) {
         score: Math.max(merged.score, next.score),
         action: rank[next.action] > rank[merged.action] ? next.action : merged.action,
         packages: [...merged.packages, ...next.packages],
-        safeVersions: { ...merged.safeVersions, ...next.safeVersions },
         durationMs: merged.durationMs + next.durationMs,
         ...(next.freeScansRemaining !== undefined
             ? { freeScansRemaining: next.freeScansRemaining }
@@ -365,38 +479,21 @@ export function mergeAnalyzeResponses(responses) {
     }));
 }
 function resolveApiBaseUrl(env) {
-    const auth = readAuthStateOrWarn(env);
-    if (auth?.apiBaseUrl) {
-        return auth.apiBaseUrl;
-    }
-    return loadUserConfig(env).api.baseUrl;
+    const config = loadUserConfig(env);
+    // An env-provided token (resolveToken prefers it) belongs to the endpoint
+    // config points at, NOT the apiBaseUrl pinned in auth.json — which may be a
+    // different instance from a prior `dg login`. Pairing an env token with the
+    // file-pinned URL would send that credential to the wrong host. The file's
+    // apiBaseUrl is honored only when the file token is the one in use.
+    const baseUrl = envAuthToken(env)
+        ? config.api.baseUrl
+        : readAuthStateOrWarn(env)?.apiBaseUrl ?? config.api.baseUrl;
+    return assertVendorApiBaseUrl(baseUrl, config.policy.allowNonVendorApiHost);
 }
 function resolveToken(env) {
     return envAuthToken(env) ?? readAuthStateOrWarn(env)?.token;
 }
 export function identityHeaders(env) {
-    const headers = { "X-Device-Id": getOrCreateDeviceId(env) };
     const token = resolveToken(env);
-    if (token) {
-        headers.Authorization = `Bearer ${token}`;
-    }
-    return headers;
-}
-function getOrCreateDeviceId(env) {
-    const path = join(resolveDgPaths(env).stateDir, "device-id");
-    try {
-        if (existsSync(path)) {
-            const existing = readFileSync(path, "utf8").trim();
-            if (existing) {
-                return existing;
-            }
-        }
-        const id = randomUUID();
-        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-        writeFileSync(path, `${id}\n`, { encoding: "utf8", mode: 0o600 });
-        return id;
-    }
-    catch {
-        return "anonymous";
-    }
+    return token ? { Authorization: `Bearer ${token}` } : {};
 }

package/dist/audit/deep.js

@@ -2,6 +2,7 @@ import { authStatus, readAuthState } from "../auth/store.js";
 import { envAuthToken } from "../auth/env-token.js";
 import { loadUserConfig } from "../config/settings.js";
 import { packNpmArtifact } from "../publish-set/pack.js";
+import { sanitize } from "../security/sanitize.js";
 export function deepDecision(scope, local, env = process.env) {
     if (local) {
         return { upload: false, reason: "local mode (--local)" };
@@ -99,7 +100,7 @@ export async function runDeepUpload(scope, packageJson, deps = {}) {
     const body = await safeJson(response);
     const verdict = body?.verdict;
     if (verdict === "pass" || verdict === "warn" || verdict === "block") {
-        return { ran: true, action: verdict, reason: typeof body?.reason === "string" ? body.reason : `behavioral verdict: ${verdict}` };
+        return { ran: true, action: verdict, reason: typeof body?.reason === "string" ? sanitize(body.reason) : `behavioral verdict: ${verdict}` };
     }
     return { ran: true, action: "analysis_incomplete", reason: "scanner returned an incomplete verdict" };
 }

package/dist/audit/detectors.js

@@ -1,6 +1,17 @@
 import { BIDI_OVERRIDE_RE, CONTENT_RULES, DANGEROUS_SCRIPT_RE, FILENAME_RULES, INVISIBLE_UNICODE_RE, RISKY_SCRIPT_NAMES } from "./rules.js";
+import { sanitizeLine } from "../security/sanitize.js";
+// Untrusted audit strings (file paths, titles built from package.json script
+// keys, evidence snippets) reach the terminal and exported md/txt — strip
+// control bytes at the shared accessors so a hostile repo cannot inject ANSI/OSC
+// or forge table rows.
 export function findingLocation(finding) {
-    return finding.line ? `${finding.location}:${finding.line}` : finding.location;
+    return sanitizeLine(finding.line ? `${finding.location}:${finding.line}` : finding.location);
+}
+export function findingTitleSafe(finding) {
+    return sanitizeLine(finding.title);
+}
+export function findingEvidenceSafe(finding) {
+    return sanitizeLine(finding.evidence);
 }
 function lineAt(body, index) {
     let line = 1;
@@ -21,7 +32,17 @@ export function detectFindings(files, context) {
             return;
         }
         seen.add(key);
-        findings.push(finding);
+        // Sanitize at the single point findings leave the detector layer so EVERY
+        // consumer (the TUI, the text report, the md/txt/JSON export) is safe — these
+        // strings embed package.json script keys and file content, which a hostile
+        // repo can fill with ANSI/OSC control sequences.
+        findings.push({
+            ...finding,
+            title: sanitizeLine(finding.title),
+            recommendation: sanitizeLine(finding.recommendation),
+            evidence: sanitizeLine(finding.evidence),
+            location: sanitizeLine(finding.location),
+        });
     };
     for (const file of files) {
         structuralFileChecks(file, push);

package/dist/audit/rules.js

@@ -426,5 +426,8 @@ export const RISKY_SCRIPT_NAMES = [
 // node -e, python -c, base64 -d, curl|sh, AND download-then-execute where the fetch
 // is chained (&& / ;) to a shell or a freshly-downloaded file.
 export const DANGEROUS_SCRIPT_RE = /\|\s*(?:sh|bash|zsh)\b|\beval\s|node\s+-e\b|python[0-9.]*\s+-c\b|base64\s+-d|(?:curl|wget|fetch)\b[^\n]*\|\s*\w*sh\b|(?:curl|wget|fetch)\b[^\n]*(?:&&|;)\s*(?:sh|bash|zsh|source|\.\/)/iu;
-export const INVISIBLE_UNICODE_RE = /[\u200B-\u200F\u2060-\u2064\u202A-\u202E\u2066-\u2069\uFEFF]/u;
+// Single source of truth lives in security/sanitize.ts (the strip set the
+// sanitizers apply); re-exported here so the audit detector's invisible-char
+// check and the strip set can never drift apart.
+export { INVISIBLE_UNICODE_RE } from "../security/sanitize.js";
 export const BIDI_OVERRIDE_RE = /[\u202A-\u202E\u2066-\u2069]/u;

package/dist/audit-ui/export.js

@@ -1,4 +1,5 @@
-import { findingLocation } from "../audit/detectors.js";
+import { findingEvidenceSafe, findingLocation, findingTitleSafe } from "../audit/detectors.js";
+import { sanitizeLine } from "../security/sanitize.js";
 import { deepSummary } from "../audit/deep.js";
 import { severityKind, WARN_GLYPH } from "./format.js";
 function countSummaryLine(findings) {
@@ -43,7 +44,7 @@ function buildMd(input) {
     for (const finding of input.findings) {
         const kind = severityKind(finding.severity);
         const sev = kind === "block" ? "BLOCK" : kind === "warn" ? "WARN" : "NOTE";
-        const cell = (value) => value.replace(/\|/g, "\\|").replace(/\n/g, " ");
+        const cell = (value) => sanitizeLine(value).replace(/\|/g, "\\|");
         lines.push(`| ${sev} | ${cell(findingLocation(finding))} | ${cell(finding.title)} | ${cell(finding.evidence)} | ${cell(finding.recommendation)} |`);
     }
     lines.push("");
@@ -61,9 +62,9 @@ function buildTxt(input) {
         const kind = severityKind(finding.severity);
         const tag = kind === "block" ? "✘" : kind === "warn" ? WARN_GLYPH : "·";
         lines.push(`  ${tag} ${findingLocation(finding)}`);
-        lines.push(`     ${finding.title}`);
+        lines.push(`     ${findingTitleSafe(finding)}`);
         if (finding.evidence && finding.evidence !== `path: ${finding.location}` && finding.evidence !== finding.location) {
-            lines.push(`     ${finding.evidence}`);
+            lines.push(`     ${findingEvidenceSafe(finding)}`);
         }
         lines.push(`     → ${finding.recommendation}`);
         lines.push("");

package/dist/auth/device-login.js

@@ -1,19 +1,36 @@
 import { spawn } from "node:child_process";
 import { closeSync, openSync, readSync } from "node:fs";
 import { displayTier, writeAuthState } from "./store.js";
-import { loadUserConfig } from "../config/settings.js";
+import { loadUserConfig, VENDOR_API_HOST } from "../config/settings.js";
 import { createTheme } from "../presentation/theme.js";
 import { resolvePresentation } from "../presentation/mode.js";
 const DEFAULT_WEB_BASE = "https://westbayberry.com";
 export const POLL_INTERVAL_MS = 2000;
 export const POLL_TIMEOUT_MS = 5 * 60_000;
+const VENDOR_WEB_HOST = VENDOR_API_HOST.replace(/^api\./, "");
+function isVendorWebHost(host) {
+    return host === VENDOR_WEB_HOST || host.endsWith(`.${VENDOR_WEB_HOST}`) || host === "localhost" || host === "127.0.0.1";
+}
+function allowsNonVendorHost(env) {
+    try {
+        return loadUserConfig(env).policy.allowNonVendorApiHost;
+    }
+    catch {
+        return false;
+    }
+}
 export function resolveWebBase(env) {
     const override = env.DG_AUTH_BASE;
     if (override) {
         try {
             const url = new URL(override);
             const localhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
-            if (url.protocol === "https:" || (url.protocol === "http:" && localhost)) {
+            // The login browser opens this base and the polled token is stored as the
+            // user's credential, so an attacker-set DG_AUTH_BASE would harvest it. Pin
+            // it to the vendor web host (or localhost) unless the operator opted into a
+            // self-hosted host in their own global config — same anchor as the api pin.
+            if ((url.protocol === "https:" || (url.protocol === "http:" && localhost))
+                && (isVendorWebHost(url.hostname) || allowsNonVendorHost(env))) {
                 return override.replace(/\/$/, "");
             }
         }
@@ -43,8 +60,9 @@ export function assertTrustedVerifyUrl(verifyUrl, webBase) {
     catch {
         throw new Error("login server returned an invalid verify URL");
     }
-    if (verify.protocol !== "https:" && verify.protocol !== "http:") {
-        throw new Error("login server returned an unsupported verify URL");
+    const isLocalhost = verify.hostname === "localhost" || verify.hostname === "127.0.0.1";
+    if (verify.protocol !== "https:" && !(verify.protocol === "http:" && isLocalhost)) {
+        throw new Error("login server returned an insecure verify URL (https required)");
     }
     const baseHost = new URL(webBase).hostname;
     if (!isSameOrSubdomain(verify.hostname, baseHost)) {
@@ -136,13 +154,16 @@ export function openBrowser(url) {
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+// Returns true only when the user actually pressed Enter on the controlling
+// terminal. A false return (no /dev/tty, or EOF) means we could NOT confirm, so
+// the caller must not auto-open a browser on the user's behalf.
 function waitForEnter() {
     let tty;
     try {
         tty = openSync("/dev/tty", "rs");
     }
     catch {
-        return;
+        return false;
     }
     try {
         const byte = Buffer.alloc(1);
@@ -155,14 +176,14 @@ function waitForEnter() {
                 if (error.code === "EAGAIN") {
                     continue;
                 }
-                break;
+                return false;
             }
             if (read === 0) {
-                break;
+                return false;
             }
             const char = byte.toString("utf8");
             if (char === "\n" || char === "\r") {
-                break;
+                return true;
             }
         }
     }
@@ -226,9 +247,10 @@ export async function runDeviceLogin(io = {}) {
             stderr: `dg login: ${error instanceof Error ? error.message : "could not start login"}.\n`
         };
     }
-    stderr.write(`\n  Sign in at:\n  ${accent(session.verifyUrl)}\n\n  ${muted("Press Enter to open it in your browser…")}`);
-    confirm();
-    open(session.verifyUrl);
+    stderr.write(`\n  Sign in at:\n  ${accent(session.verifyUrl)}\n\n  ${muted("Press Enter to open it in your browser, or open the link above yourself…")}`);
+    if (confirm()) {
+        open(session.verifyUrl);
+    }
     stderr.write(`\n  ${muted("Waiting for you to approve in the browser…")}\n\n`);
     const deadline = now() + POLL_TIMEOUT_MS;
     for (;;) {

package/dist/auth/login-app.js

@@ -9,7 +9,8 @@ const SUCCESS_MAX_MS = 2500;
 export function useLogin(webBase, env) {
     const [state, setState] = useState({ phase: "creating", verifyUrl: "", email: "", plan: "", message: "" });
     const sessionId = useRef("");
-    const started = useRef(false);
+    const verifyUrl = useRef("");
+    const pollStarted = useRef(false);
     const cancelled = useRef(false);
     const tierSettled = useRef(false);
     const pollTimer = useRef(undefined);
@@ -20,6 +21,7 @@ export function useLogin(webBase, env) {
             if (sessionCancelled)
                 return;
             sessionId.current = session.sessionId;
+            verifyUrl.current = session.verifyUrl;
             setState((prev) => ({ ...prev, phase: "ready", verifyUrl: session.verifyUrl }));
         })
             .catch((error) => {
@@ -41,12 +43,12 @@ export function useLogin(webBase, env) {
             }
         };
     }, []);
-    const openAndPoll = () => {
-        if (started.current)
+    // Polling starts as soon as the session is ready, so signing in works whether
+    // the user lets us open the browser (Enter) or opens the link themselves.
+    useEffect(() => {
+        if (state.phase !== "ready" || pollStarted.current)
             return;
-        started.current = true;
-        openBrowser(state.verifyUrl);
-        setState((prev) => ({ ...prev, phase: "waiting" }));
+        pollStarted.current = true;
         void (async () => {
             const deadline = Date.now() + POLL_TIMEOUT_MS;
             while (!cancelled.current) {
@@ -85,11 +87,16 @@ export function useLogin(webBase, env) {
                 });
             }
         })();
+    }, [state.phase, webBase, env]);
+    const openInBrowser = () => {
+        if (verifyUrl.current) {
+            openBrowser(verifyUrl.current);
+        }
     };
-    return { state, tierSettled, openAndPoll };
+    return { state, tierSettled, openInBrowser };
 }
 const LoginApp = ({ webBase, env }) => {
-    const { state, tierSettled, openAndPoll } = useLogin(webBase, env);
+    const { state, tierSettled, openInBrowser } = useLogin(webBase, env);
     const { exit } = useApp();
     useEffect(() => {
         if (state.phase === "expired" || state.phase === "error") {
@@ -122,7 +129,7 @@ const LoginApp = ({ webBase, env }) => {
     }, [state.phase, exit, tierSettled]);
     useInput((_input, key) => {
         if (state.phase === "ready" && key.return) {
-            openAndPoll();
+            openInBrowser();
         }
         else if (state.phase === "success") {
             exit();
@@ -132,9 +139,7 @@ const LoginApp = ({ webBase, env }) => {
         case "creating":
             return (_jsx(Box, { paddingLeft: 1, paddingTop: 1, children: _jsx(Spinner, { label: "Creating login session\u2026" }) }));
         case "ready":
-            return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingTop: 1, children: [_jsx(Text, { children: "Sign in at:" }), _jsx(Text, { color: "cyan", children: state.verifyUrl }), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Press Enter to open it in your browser\u2026" })] }));
-        case "waiting":
-            return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingTop: 1, children: [_jsx(Text, { children: "Sign in at:" }), _jsx(Text, { color: "cyan", children: state.verifyUrl }), _jsx(Text, { children: " " }), _jsx(Spinner, { label: "Waiting for you to approve in the browser\u2026" })] }));
+            return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingTop: 1, children: [_jsx(Text, { children: "Sign in at:" }), _jsx(Text, { color: "cyan", children: state.verifyUrl }), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Press Enter to open it in your browser, or open the link yourself." }), _jsx(Text, { children: " " }), _jsx(Spinner, { label: "Waiting for you to approve\u2026" })] }));
         case "success":
             return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingTop: 1, children: [_jsxs(Text, { color: "green", bold: true, children: ["\u2713 Logged in", state.email ? ` as ${state.email}` : "", state.plan ? ` (${displayTier(state.plan)} plan)` : ""] }), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Run `dg scan` to check your dependencies." })] }));
         case "expired":