@westbayberry/dg 2.3.3 → 2.3.4

package/dist/origin/cargo-config.js

@@ -0,0 +1,12 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+// Materialise a throwaway CARGO_HOME config that replaces crates-io with the
+// local origin's sparse endpoint. cargo has no env var to override the default
+// registry, so this is the only way to route it env-only — the user's real
+// ~/.cargo/config.toml is never touched.
+export function writeCargoOriginConfig(cargoHome, originUrl) {
+    mkdirSync(cargoHome, { recursive: true });
+    const sparse = `sparse+${originUrl.endsWith("/") ? originUrl : `${originUrl}/`}`;
+    const config = `[source.crates-io]\nreplace-with = "dg-origin"\n\n[source.dg-origin]\nregistry = "${sparse}"\n`;
+    writeFileSync(join(cargoHome, "config.toml"), config, { encoding: "utf8", mode: 0o600 });
+}

package/dist/origin/gate-mode.js

@@ -0,0 +1,7 @@
+// The kill-switch: revert to the proxy door without a re-publish. Kept for at
+// least one release so an installed base can fall back if the origin path
+// regresses. It disables the ORIGIN, not the gate — the proxy still screens.
+export function isRegistryGateDisabled(env) {
+    const raw = env.DG_DISABLE_REGISTRY_GATE;
+    return raw === "1" || raw === "true";
+}

package/dist/origin/platform-paths.js

@@ -0,0 +1,14 @@
+import { join } from "node:path";
+export function originPlatform(platform = process.platform) {
+    return platform === "win32" ? "win32" : "posix";
+}
+// pip reads %APPDATA%\pip\pip.ini on Windows; dg never writes it (env-only via
+// PIP_INDEX_URL/PIP_TRUSTED_HOST), but doctor needs the path to detect a
+// conflicting user config that would out-rank the env.
+export function pipUserConfigPath(env, platform = originPlatform()) {
+    if (platform === "win32") {
+        const base = env.APPDATA ?? join(env.USERPROFILE ?? "", "AppData", "Roaming");
+        return join(base, "pip", "pip.ini");
+    }
+    return join(env.HOME ?? "", ".config", "pip", "pip.conf");
+}

package/dist/origin/precedence.js

@@ -0,0 +1,345 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { pipUserConfigPath } from "./platform-paths.js";
+import { readPipRequirementSpecs } from "../launcher/manifest-screen.js";
+// CLI flags that point a manager at a different registry/index than the env var
+// the origin sets. A CLI value out-ranks env for every manager, so any of these
+// means the origin is not actually in front of (some of) the fetches.
+const OVERRIDE_FLAGS = {
+    javascript: new Set(["--registry"]),
+    python: new Set(["--index-url", "-i", "--extra-index-url", "--index", "--default-index", "--find-links", "-f"]),
+    // cargo --config can inline a `source.crates-io.replace-with` (or point at a
+    // config file) that redirects the crates-io source past the origin door.
+    rust: new Set(["--registry", "--index", "--config"]),
+    gated: new Set()
+};
+// pip/uv (optparse) cluster short flags and may glue a value flag's value onto
+// the token: `-ihttps://evil`, `-vi https://evil` (=`-v -i …`), `-vihttps://evil`.
+// A value flag can sit anywhere in the cluster, so scan each two-char short flag
+// and return the first override before the rest is read as its value. Over-
+// detecting only routes the install to the proxy door (which gates all
+// transport), so a false match is safe. optparse also accepts an unambiguous
+// prefix of a long option (`--index-u` => `--index-url`); treat any `--` token
+// that prefixes an override flag as that flag so the abbreviation can't slip by.
+function overrideFlagToken(arg, flags) {
+    if (/^-[a-zA-Z]/.test(arg) && !arg.startsWith("--") && arg.length > 2) {
+        for (let i = 1; i < arg.length; i++) {
+            const short = `-${arg[i]}`;
+            if (flags.has(short)) {
+                return short;
+            }
+        }
+    }
+    const head = arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
+    if (head.startsWith("--") && head.length > 2 && !flags.has(head)) {
+        for (const flag of flags) {
+            if (flag.startsWith("--") && flag.startsWith(head)) {
+                return flag;
+            }
+        }
+    }
+    return head;
+}
+export function resolveOriginPrecedence(classification, env, cwd) {
+    const overrides = [];
+    let active = true;
+    const flags = OVERRIDE_FLAGS[classification.ecosystem];
+    for (const arg of classification.args) {
+        const flag = overrideFlagToken(arg, flags);
+        if (flags.has(flag)) {
+            overrides.push(`command-line ${flag}`);
+            active = false;
+        }
+        else if (classification.ecosystem === "javascript" && /^--@[^:=\s]+:registry$/.test(flag)) {
+            // `--@scope:registry=URL` points that scope at its own upstream the origin
+            // does not front; fall back to the proxy door, which gates all transport.
+            overrides.push(`command-line ${flag} routes a scope to its own registry`);
+            active = false;
+        }
+        else if (classification.ecosystem === "javascript" && /^--config\.(@[^:=\s]+:)?registry$/.test(flag)) {
+            // pnpm `--config.registry=URL` / `--config.@scope:registry=URL` sets the
+            // registry the same as the npm config key.
+            overrides.push(`command-line ${flag} overrides the registry`);
+            active = false;
+        }
+    }
+    if (classification.ecosystem === "javascript") {
+        for (const scope of scopedNpmRegistries(env, cwd)) {
+            overrides.push(`${scope} routes to its own registry (not gated by dg)`);
+        }
+    }
+    // The origin door points pip/uv at the loopback index via env, but pip also
+    // MERGES extra-index-url / find-links and a non-default index-url from its
+    // config file (pip.conf), which the env does not override. Detect those so the
+    // install falls back to the proxy door instead of fetching from an un-fronted
+    // source while dg reports the gate active.
+    if (classification.ecosystem === "python") {
+        for (const reason of pipConfigIndexes(env, cwd)) {
+            overrides.push(reason);
+            active = false;
+        }
+        // pip also honors --index-url / --extra-index-url / -f declared INSIDE a
+        // requirements/constraints file (and any nested -r/-c include). Reuse the
+        // static hook's include-walk so the runtime gate sees the same in-file index
+        // directives and falls back to the proxy door instead of fetching un-fronted.
+        const requirementIndexes = readPipRequirementSpecs(classification.args, cwd)?.alternateIndexes ?? [];
+        for (const idx of requirementIndexes) {
+            if (isNonDefaultPythonIndex(idx)) {
+                overrides.push(`requirements-file index ${idx} (origin fronts the public index only)`);
+                active = false;
+            }
+        }
+    }
+    // cargo merges config from the project `.cargo/config.toml` (walking up from
+    // cwd) and the user CARGO_HOME, with the project file out-ranking the throwaway
+    // CARGO_HOME the origin door writes. A `[source.crates-io] replace-with` there
+    // shadows the dg-origin source, so the crates install un-gated — detect it and
+    // fall back to the proxy door.
+    if (classification.ecosystem === "rust") {
+        for (const reason of cargoConfigOverride(env, cwd)) {
+            overrides.push(reason);
+            active = false;
+        }
+        for (const reason of cargoEnvOverride(env)) {
+            overrides.push(reason);
+            active = false;
+        }
+    }
+    // The origin chains only to the PUBLIC default registry/index. A configured
+    // custom primary upstream (corporate Nexus/Verdaccio, a private index) is one
+    // the origin cannot front correctly, so it counts as an override and the proxy
+    // door — which intercepts any upstream at the transport layer — takes over.
+    const customUpstream = nonDefaultPrimaryUpstream(classification, env, cwd);
+    if (customUpstream) {
+        overrides.push(customUpstream);
+        active = false;
+    }
+    // An EXTRA index sits alongside the primary one the origin fronts; pip/uv query
+    // it directly, so any package it serves is fetched un-gated. The origin cannot
+    // front it, so the proxy door (which intercepts all transport) takes over.
+    for (const extra of extraPythonIndexes(classification, env)) {
+        overrides.push(extra);
+        active = false;
+    }
+    return { active, overrides };
+}
+function extraPythonIndexes(classification, env) {
+    if (classification.ecosystem !== "python") {
+        return [];
+    }
+    const found = [];
+    for (const key of ["PIP_EXTRA_INDEX_URL", "PIP_FIND_LINKS", "UV_EXTRA_INDEX_URL", "UV_INDEX", "UV_FIND_LINKS"]) {
+        const value = env[key]?.trim();
+        if (value) {
+            found.push(`${key} adds a package source the origin does not front`);
+        }
+    }
+    return found;
+}
+function nonDefaultPrimaryUpstream(classification, env, cwd) {
+    if (classification.ecosystem === "javascript") {
+        const registry = env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY ?? npmrcPrimaryRegistry(env, cwd);
+        if (registry && !isHost(registry, "registry.npmjs.org")) {
+            return `non-default npm registry ${registry} (origin fronts the public registry only)`;
+        }
+    }
+    if (classification.ecosystem === "python") {
+        const index = env.PIP_INDEX_URL ?? env.UV_DEFAULT_INDEX ?? env.UV_INDEX_URL;
+        if (index && !isHost(index, "pypi.org")) {
+            return `non-default python index ${index} (origin fronts the public index only)`;
+        }
+    }
+    return null;
+}
+function npmrcPrimaryRegistry(env, cwd) {
+    for (const file of [join(cwd, ".npmrc"), join(env.HOME ?? "", ".npmrc")]) {
+        for (const line of readLines(file)) {
+            const match = /^\s*registry\s*=\s*(\S+)/.exec(line);
+            if (match?.[1]) {
+                return match[1];
+            }
+        }
+    }
+    return undefined;
+}
+function isNonDefaultPythonIndex(value) {
+    try {
+        const host = new URL(value).hostname;
+        return host !== "pypi.org" && host !== "files.pythonhosted.org";
+    }
+    catch {
+        // A bare/relative local path (`--find-links ./wheels`) is not an un-fronted
+        // remote index, so it does not force a fallback.
+        return false;
+    }
+}
+function isHost(url, host) {
+    try {
+        return new URL(url).hostname === host;
+    }
+    catch {
+        return false;
+    }
+}
+function scopedNpmRegistries(env, cwd) {
+    const scopes = new Set();
+    for (const file of [join(cwd, ".npmrc"), join(env.HOME ?? "", ".npmrc")]) {
+        for (const line of readLines(file)) {
+            const match = /^\s*(@[^:=\s]+):registry\s*=/.exec(line);
+            if (match?.[1]) {
+                scopes.add(match[1]);
+            }
+        }
+    }
+    // npm/pnpm also accept a scoped registry from the environment
+    // (npm_config_@scope:registry); that scope resolves to its own upstream, which
+    // the origin does not front.
+    for (const key of Object.keys(env)) {
+        const match = /^npm_config_(@[^:=\s]+):registry$/i.exec(key);
+        if (match?.[1] && (env[key] ?? "").trim()) {
+            scopes.add(match[1]);
+        }
+    }
+    return [...scopes];
+}
+// pip.conf (INI): index-url to a non-pypi host, or any extra-index-url /
+// find-links, is a package source the origin does not front.
+function pipConfigIndexes(env, cwd) {
+    const out = [];
+    const home = env.HOME ?? "";
+    const venv = env.VIRTUAL_ENV;
+    // pip's full config search chain — global, user (XDG + legacy), and the active
+    // virtualenv's site config. An extra-index-url in ANY of these is merged into
+    // the install, so all must be checked or a config-file index slips the gate.
+    const files = [
+        env.PIP_CONFIG_FILE,
+        "/etc/pip.conf",
+        "/etc/xdg/pip/pip.conf",
+        pipUserConfigPath(env),
+        home ? join(home, ".pip", "pip.conf") : undefined,
+        venv ? join(venv, "pip.conf") : undefined,
+        join(cwd, "pip.conf"),
+    ].filter((f) => Boolean(f));
+    for (const file of files) {
+        let section = "";
+        for (const raw of readLines(file)) {
+            const line = raw.trim();
+            if (line.startsWith("#") || line.startsWith(";")) {
+                continue;
+            }
+            const sec = /^\[([^\]]+)\]/.exec(line);
+            if (sec) {
+                section = sec[1] ?? "";
+                continue;
+            }
+            if (section !== "global" && section !== "install") {
+                continue;
+            }
+            const kv = /^(index-url|extra-index-url|find-links)\s*[=:]\s*(\S.*)$/.exec(line);
+            if (!kv) {
+                continue;
+            }
+            const value = (kv[2] ?? "").trim();
+            if (kv[1] === "index-url") {
+                if (!isHost(value, "pypi.org")) {
+                    out.push(`pip.conf index-url ${value} (origin fronts the public index only)`);
+                }
+            }
+            else {
+                out.push(`pip.conf ${kv[1]} adds a package source the origin does not front`);
+            }
+        }
+    }
+    return out;
+}
+function normalizeTomlKey(s) {
+    return s
+        .split(".")
+        .map((seg) => seg.trim().replace(/^["']|["']$/g, "").trim())
+        .join(".");
+}
+// cargo source/registry redirection in a config file out-ranks the throwaway
+// CARGO_HOME the origin door writes, so a `replace-with` (or a direct crates-io
+// registry override) means the origin is shadowed. cargo accepts the redirection
+// in several equivalent TOML spellings (header table, dotted key under a parent
+// table, fully-qualified top-level key, inline table, whitespace-padded header);
+// normalize each assignment to its fully-qualified key so every spelling is seen.
+function cargoConfigOverride(env, cwd) {
+    const files = [];
+    let dir = cwd;
+    for (let depth = 0; depth < 40; depth += 1) {
+        files.push(join(dir, ".cargo", "config.toml"), join(dir, ".cargo", "config"));
+        const parent = dirname(dir);
+        if (parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    const cargoHome = env.CARGO_HOME && env.CARGO_HOME.length > 0 ? env.CARGO_HOME : join(env.HOME ?? "", ".cargo");
+    files.push(join(cargoHome, "config.toml"), join(cargoHome, "config"));
+    for (const file of files) {
+        let section = "";
+        for (const raw of readLines(file)) {
+            const line = raw.trim();
+            if (line.startsWith("#") || line.length === 0) {
+                continue;
+            }
+            const sec = /^\[([^\]]+)\]/.exec(line);
+            if (sec) {
+                section = normalizeTomlKey(sec[1] ?? "");
+                continue;
+            }
+            const eq = line.indexOf("=");
+            if (eq < 0) {
+                continue;
+            }
+            const lhs = line.slice(0, eq);
+            const rhs = line.slice(eq + 1);
+            const fqKey = normalizeTomlKey(section ? `${section}.${lhs}` : lhs);
+            if (fqKey === "source.crates-io.replace-with") {
+                return [`cargo config ${file} replaces the crates-io source (origin door shadowed)`];
+            }
+            if (fqKey === "source.crates-io.registry") {
+                return [`cargo config ${file} overrides the crates-io registry`];
+            }
+            if (fqKey === "registries.crates-io.index") {
+                return [`cargo config ${file} overrides the crates-io index`];
+            }
+            // Inline-table assignment to the table itself: `crates-io = { replace-with = … }`.
+            if (fqKey === "source.crates-io" && /\breplace-with\s*=/.test(rhs)) {
+                return [`cargo config ${file} replaces the crates-io source (origin door shadowed)`];
+            }
+            if (fqKey === "source.crates-io" && /\bregistry\s*=/.test(rhs)) {
+                return [`cargo config ${file} overrides the crates-io registry`];
+            }
+            if (fqKey === "registries.crates-io" && /\bindex\s*=/.test(rhs)) {
+                return [`cargo config ${file} overrides the crates-io index`];
+            }
+        }
+    }
+    return [];
+}
+// cargo also accepts registry redirection through env vars (CARGO_REGISTRY_DEFAULT,
+// CARGO_SOURCE_CRATES_IO_REPLACE_WITH, CARGO_REGISTRIES_CRATES_IO_INDEX), which the
+// throwaway CARGO_HOME config cannot win against.
+function cargoEnvOverride(env) {
+    const out = [];
+    if (env.CARGO_REGISTRY_DEFAULT && env.CARGO_REGISTRY_DEFAULT.trim()) {
+        out.push("CARGO_REGISTRY_DEFAULT overrides the default registry");
+    }
+    if (env.CARGO_SOURCE_CRATES_IO_REPLACE_WITH && env.CARGO_SOURCE_CRATES_IO_REPLACE_WITH.trim()) {
+        out.push("CARGO_SOURCE_CRATES_IO_REPLACE_WITH replaces the crates-io source");
+    }
+    if (env.CARGO_REGISTRIES_CRATES_IO_INDEX && env.CARGO_REGISTRIES_CRATES_IO_INDEX.trim()) {
+        out.push("CARGO_REGISTRIES_CRATES_IO_INDEX overrides the crates-io index");
+    }
+    return out;
+}
+function readLines(file) {
+    try {
+        return readFileSync(file, "utf8").split("\n");
+    }
+    catch {
+        return [];
+    }
+}