sentinello 3.0.0 → 3.0.1

package/README.md

@@ -76,12 +76,16 @@ Run `sentinello --help` for the full list. The ones people reach for:
 | `--fail-on <level>` | exit 2 when matched, for CI |
 | `--out <file\|->` | where the advisory goes |
 | `--json` | machine-readable output |
-| `-y, --yes` | accept the first-run download without asking |
+| `-y, --yes` | accept the first-run download without asking. Required on a non-TTY |
 | `--offline` | use the cache as-is, no network |
 | `--doctor` | cache status, resolved settings, and what was skipped and why |
 
-Exit codes: `0` completed, `1` a scan or configuration error, `2` the `--fail-on` threshold was met.
-Findings alone are not a failure.
+Exit codes: `0` completed, `1` a scan or configuration error — including a `--fail-on` run that could
+not consult one of its sources, `2` the `--fail-on` threshold was met. Findings alone are not a failure.
+
+In CI, pass both: `npx --yes sentinello --yes --fail-on high`. The first `--yes` answers npm's own
+"Ok to proceed?" prompt for an uncached package; the second accepts the first-run advisory download,
+which is refused on a non-interactive terminal.
 
 ## Requires
 

package/dist/cli.cjs

@@ -6,6 +6,8 @@ var path = require('path');
 var child_process = require('child_process');
 var fs = require('fs');
 var crypto = require('crypto');
+var http = require('http');
+var https = require('https');
 var os = require('os');
 var zlib = require('zlib');
 var promises$2 = require('stream/promises');
@@ -3725,9 +3727,9 @@ var require_stream_duplex = __commonJS({
     module2.exports = Duplex;
     var util = Object.create(require_util());
     util.inherits = require_inherits();
-    var Readable2 = require_stream_readable();
+    var Readable = require_stream_readable();
     var Writable = require_stream_writable();
-    util.inherits(Duplex, Readable2);
+    util.inherits(Duplex, Readable);
     {
       keys = objectKeys(Writable.prototype);
       for (v = 0; v < keys.length; v++) {
@@ -3740,7 +3742,7 @@ var require_stream_duplex = __commonJS({
     var v;
     function Duplex(options) {
       if (!(this instanceof Duplex)) return new Duplex(options);
-      Readable2.call(this, options);
+      Readable.call(this, options);
       Writable.call(this, options);
       if (options && options.readable === false) this.readable = false;
       if (options && options.writable === false) this.writable = false;
@@ -4028,10 +4030,10 @@ var require_string_decoder = __commonJS({
 var require_stream_readable = __commonJS({
   "../../node_modules/.pnpm/readable-stream@2.3.8/node_modules/readable-stream/lib/_stream_readable.js"(exports2, module2) {
     var pna = require_process_nextick_args();
-    module2.exports = Readable2;
+    module2.exports = Readable;
     var isArray = require_isarray();
     var Duplex;
-    Readable2.ReadableState = ReadableState;
+    Readable.ReadableState = ReadableState;
     __require("events").EventEmitter;
     var EElistenerCount = function(emitter, type2) {
       return emitter.listeners(type2).length;
@@ -4059,7 +4061,7 @@ var require_stream_readable = __commonJS({
     var BufferList = require_BufferList();
     var destroyImpl = require_destroy();
     var StringDecoder;
-    util.inherits(Readable2, Stream);
+    util.inherits(Readable, Stream);
     var kProxyEvents = ["error", "close", "destroy", "pause", "resume"];
     function prependListener(emitter, event, fn) {
       if (typeof emitter.prependListener === "function") return emitter.prependListener(event, fn);
@@ -4105,9 +4107,9 @@ var require_stream_readable = __commonJS({
         this.encoding = options.encoding;
       }
     }
-    function Readable2(options) {
+    function Readable(options) {
       Duplex = Duplex || require_stream_duplex();
-      if (!(this instanceof Readable2)) return new Readable2(options);
+      if (!(this instanceof Readable)) return new Readable(options);
       this._readableState = new ReadableState(options, this);
       this.readable = true;
       if (options) {
@@ -4116,7 +4118,7 @@ var require_stream_readable = __commonJS({
       }
       Stream.call(this);
     }
-    Object.defineProperty(Readable2.prototype, "destroyed", {
+    Object.defineProperty(Readable.prototype, "destroyed", {
       get: function() {
         if (this._readableState === void 0) {
           return false;
@@ -4130,13 +4132,13 @@ var require_stream_readable = __commonJS({
         this._readableState.destroyed = value;
       }
     });
-    Readable2.prototype.destroy = destroyImpl.destroy;
-    Readable2.prototype._undestroy = destroyImpl.undestroy;
-    Readable2.prototype._destroy = function(err, cb) {
+    Readable.prototype.destroy = destroyImpl.destroy;
+    Readable.prototype._undestroy = destroyImpl.undestroy;
+    Readable.prototype._destroy = function(err, cb) {
       this.push(null);
       cb(err);
     };
-    Readable2.prototype.push = function(chunk, encoding) {
+    Readable.prototype.push = function(chunk, encoding) {
       var state = this._readableState;
       var skipChunkCheck;
       if (!state.objectMode) {
@@ -4153,7 +4155,7 @@ var require_stream_readable = __commonJS({
       }
       return readableAddChunk(this, chunk, encoding, false, skipChunkCheck);
     };
-    Readable2.prototype.unshift = function(chunk) {
+    Readable.prototype.unshift = function(chunk) {
       return readableAddChunk(this, chunk, null, true, false);
     };
     function readableAddChunk(stream, chunk, encoding, addToFront, skipChunkCheck) {
@@ -4213,10 +4215,10 @@ var require_stream_readable = __commonJS({
     function needMoreData(state) {
       return !state.ended && (state.needReadable || state.length < state.highWaterMark || state.length === 0);
     }
-    Readable2.prototype.isPaused = function() {
+    Readable.prototype.isPaused = function() {
       return this._readableState.flowing === false;
     };
-    Readable2.prototype.setEncoding = function(enc) {
+    Readable.prototype.setEncoding = function(enc) {
       if (!StringDecoder) StringDecoder = require_string_decoder().StringDecoder;
       this._readableState.decoder = new StringDecoder(enc);
       this._readableState.encoding = enc;
@@ -4252,7 +4254,7 @@ var require_stream_readable = __commonJS({
       }
       return state.length;
     }
-    Readable2.prototype.read = function(n) {
+    Readable.prototype.read = function(n) {
       debug("read", n);
       n = parseInt(n, 10);
       var state = this._readableState;
@@ -4347,10 +4349,10 @@ var require_stream_readable = __commonJS({
       }
       state.readingMore = false;
     }
-    Readable2.prototype._read = function(n) {
+    Readable.prototype._read = function(n) {
       this.emit("error", new Error("_read() is not implemented"));
     };
-    Readable2.prototype.pipe = function(dest, pipeOpts) {
+    Readable.prototype.pipe = function(dest, pipeOpts) {
       var src = this;
       var state = this._readableState;
       switch (state.pipesCount) {
@@ -4455,7 +4457,7 @@ var require_stream_readable = __commonJS({
         }
       };
     }
-    Readable2.prototype.unpipe = function(dest) {
+    Readable.prototype.unpipe = function(dest) {
       var state = this._readableState;
       var unpipeInfo = { hasUnpiped: false };
       if (state.pipesCount === 0) return this;
@@ -4487,7 +4489,7 @@ var require_stream_readable = __commonJS({
       dest.emit("unpipe", this, unpipeInfo);
       return this;
     };
-    Readable2.prototype.on = function(ev, fn) {
+    Readable.prototype.on = function(ev, fn) {
       var res = Stream.prototype.on.call(this, ev, fn);
       if (ev === "data") {
         if (this._readableState.flowing !== false) this.resume();
@@ -4505,12 +4507,12 @@ var require_stream_readable = __commonJS({
       }
       return res;
     };
-    Readable2.prototype.addListener = Readable2.prototype.on;
+    Readable.prototype.addListener = Readable.prototype.on;
     function nReadingNextTick(self2) {
       debug("readable nexttick read 0");
       self2.read(0);
     }
-    Readable2.prototype.resume = function() {
+    Readable.prototype.resume = function() {
       var state = this._readableState;
       if (!state.flowing) {
         debug("resume");
@@ -4536,7 +4538,7 @@ var require_stream_readable = __commonJS({
       flow(stream);
       if (state.flowing && !state.reading) stream.read(0);
     }
-    Readable2.prototype.pause = function() {
+    Readable.prototype.pause = function() {
       debug("call pause flowing=%j", this._readableState.flowing);
       if (false !== this._readableState.flowing) {
         debug("pause");
@@ -4551,7 +4553,7 @@ var require_stream_readable = __commonJS({
       while (state.flowing && stream.read() !== null) {
       }
     }
-    Readable2.prototype.wrap = function(stream) {
+    Readable.prototype.wrap = function(stream) {
       var _this = this;
       var state = this._readableState;
       var paused = false;
@@ -4595,7 +4597,7 @@ var require_stream_readable = __commonJS({
       };
       return this;
     };
-    Object.defineProperty(Readable2.prototype, "readableHighWaterMark", {
+    Object.defineProperty(Readable.prototype, "readableHighWaterMark", {
       // making it explicit this property is not enumerable
       // because otherwise some prototype manipulation in
       // userland will fail
@@ -4604,7 +4606,7 @@ var require_stream_readable = __commonJS({
         return this._readableState.highWaterMark;
       }
     });
-    Readable2._fromList = fromList;
+    Readable._fromList = fromList;
     function fromList(n, state) {
       if (state.length === 0) return null;
       var ret2;
@@ -13117,6 +13119,15 @@ function compareSeverity(a, b) {
 function meetsSeverityFloor(severity, floor) {
   return severityWeight(severity) >= severityWeight(floor);
 }
+var SOURCE_UNAVAILABLE_REASON_CODES = [
+  "osv_db_not_seeded",
+  "osv_db_unavailable",
+  "gemnasium_db_not_seeded",
+  "gemnasium_db_unavailable"
+];
+function isSourceUnavailableReason(code) {
+  return SOURCE_UNAVAILABLE_REASON_CODES.includes(code);
+}
 
 // ../../packages/core/src/advisory-rows.ts
 var OSV_NORMALIZER_VERSION = 3;
@@ -33206,288 +33217,6 @@ function reconcileAgainstReported(findings, reportedByPackage) {
 // ../../packages/scanners/src/index.ts
 var registry2 = /* @__PURE__ */ new Map();
 registry2.set(npmAuditPlugin.name, npmAuditPlugin);
-var CACHE_SCHEMA_VERSION = 1;
-function emptyMeta() {
-  return { schemaVersion: CACHE_SCHEMA_VERSION, sources: { osv: {}, gemnasium: {} } };
-}
-function resolveCacheDir(override) {
-  if (override && override.trim().length > 0) return path.resolve(override.trim());
-  const fromEnv = process.env.SENTINELLO_CACHE_DIR;
-  if (fromEnv && fromEnv.trim().length > 0) return path.resolve(fromEnv.trim());
-  const xdg = process.env.XDG_CACHE_HOME;
-  if (xdg && xdg.trim().length > 0) return path.join(path.resolve(xdg.trim()), "sentinello");
-  return path.join(os.homedir(), ".cache", "sentinello");
-}
-function advisoryFilePath(cacheDir, source, ecosystem) {
-  const slug = ecosystem.replace(/[^a-zA-Z0-9._-]+/g, "-");
-  return path.join(cacheDir, source + "-" + slug + ".ndjson.gz");
-}
-function metaPath(cacheDir) {
-  return path.join(cacheDir, "meta.json");
-}
-async function ensureCacheDir(cacheDir) {
-  await promises.mkdir(cacheDir, { recursive: true });
-}
-async function readCacheMeta(cacheDir) {
-  let text;
-  try {
-    text = await promises.readFile(metaPath(cacheDir), "utf8");
-  } catch {
-    return emptyMeta();
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    return emptyMeta();
-  }
-  if (!parsed || typeof parsed !== "object") return emptyMeta();
-  const meta3 = parsed;
-  if (meta3.schemaVersion !== CACHE_SCHEMA_VERSION) return emptyMeta();
-  const sources = meta3.sources;
-  if (!sources || typeof sources !== "object") return emptyMeta();
-  return {
-    schemaVersion: CACHE_SCHEMA_VERSION,
-    sources: {
-      osv: sources.osv ?? {},
-      gemnasium: sources.gemnasium ?? {}
-    }
-  };
-}
-async function writeCacheMeta(cacheDir, meta3) {
-  await ensureCacheDir(cacheDir);
-  const target = metaPath(cacheDir);
-  const tmp = target + ".tmp";
-  await promises.writeFile(tmp, JSON.stringify(meta3, null, 4) + "\n", "utf8");
-  await promises.rename(tmp, target);
-}
-function getSourceState(meta3, source, ecosystem) {
-  return meta3.sources[source][ecosystem] ?? null;
-}
-function setSourceState(meta3, source, ecosystem, state) {
-  meta3.sources[source][ecosystem] = state;
-}
-function isSeeded(meta3, source, ecosystem, normalizerVersion) {
-  const state = getSourceState(meta3, source, ecosystem);
-  if (!state) return false;
-  return state.normalizerVersion === normalizerVersion && state.recordCount > 0;
-}
-async function tryAcquireLock(cacheDir) {
-  await ensureCacheDir(cacheDir);
-  const path$1 = path.join(cacheDir, ".lock");
-  try {
-    await promises.writeFile(path$1, String(process.pid), { flag: "wx" });
-  } catch {
-    if (await isStaleLock(path$1)) {
-      await promises.rm(path$1, { force: true });
-      return await tryAcquireLock(cacheDir);
-    }
-    return null;
-  }
-  async function release() {
-    await promises.rm(path$1, { force: true });
-  }
-  return { release };
-}
-var LOCK_STALE_MS = 30 * 60 * 1e3;
-async function isStaleLock(path) {
-  try {
-    const info = await promises.stat(path);
-    return Date.now() - info.mtimeMs > LOCK_STALE_MS;
-  } catch {
-    return false;
-  }
-}
-var FIELD_SEPARATOR = "	";
-var LINE_SEPARATOR = "\n";
-function encodeRow(row) {
-  const name = row.packageName.replace(/[\t\n\r]/g, "");
-  const id = row.advisoryId.replace(/[\t\n\r]/g, "");
-  return name + FIELD_SEPARATOR + id + FIELD_SEPARATOR + JSON.stringify(row);
-}
-function createRowWriter(path) {
-  const tmpPath = path + ".tmp";
-  const source = new stream.PassThrough();
-  const gzip = zlib.createGzip();
-  const done = promises$2.pipeline(source, gzip, fs.createWriteStream(tmpPath));
-  let rowCount = 0;
-  let failed = null;
-  done.catch(function capture(err) {
-    failed = err instanceof Error ? err : new Error(String(err));
-  });
-  async function push(chunk, added) {
-    if (failed) throw failed;
-    rowCount += added;
-    if (!source.write(chunk)) {
-      await new Promise(function waitForDrain(resolve5) {
-        source.once("drain", resolve5);
-      });
-    }
-  }
-  async function write(rows) {
-    if (rows.length === 0) return;
-    await push(rows.map(encodeRow).join(LINE_SEPARATOR) + LINE_SEPARATOR, rows.length);
-  }
-  async function writeRaw(lines) {
-    if (lines.length === 0) return;
-    await push(lines.join(LINE_SEPARATOR) + LINE_SEPARATOR, lines.length);
-  }
-  async function commit() {
-    source.end();
-    await done;
-    await promises.rename(tmpPath, path);
-    return rowCount;
-  }
-  async function abort() {
-    source.destroy();
-    try {
-      await done;
-    } catch {
-    }
-    await promises.rm(tmpPath, { force: true });
-  }
-  return { write, writeRaw, commit, abort };
-}
-async function readRowsForPackages(path, packageNames) {
-  const out = /* @__PURE__ */ new Map();
-  if (packageNames.size === 0) return out;
-  let raw;
-  try {
-    raw = await promises.readFile(path);
-  } catch {
-    return out;
-  }
-  const text = zlib.gunzipSync(raw).toString("utf8");
-  let offset = 0;
-  while (offset < text.length) {
-    let end = text.indexOf(LINE_SEPARATOR, offset);
-    if (end === -1) end = text.length;
-    const nameEnd = text.indexOf(FIELD_SEPARATOR, offset);
-    if (nameEnd === -1 || nameEnd > end) {
-      offset = end + 1;
-      continue;
-    }
-    const name = text.slice(offset, nameEnd);
-    if (packageNames.has(name)) {
-      const idEnd = text.indexOf(FIELD_SEPARATOR, nameEnd + 1);
-      if (idEnd !== -1 && idEnd < end) {
-        const parsed = safeParse3(text.slice(idEnd + 1, end));
-        if (parsed) {
-          const list = out.get(name);
-          if (list) {
-            list.push(parsed);
-          } else {
-            out.set(name, [parsed]);
-          }
-        }
-      }
-    }
-    offset = end + 1;
-  }
-  return out;
-}
-async function rewriteRows(path, input) {
-  let surviving = [];
-  try {
-    const raw = await promises.readFile(path);
-    const text = zlib.gunzipSync(raw).toString("utf8");
-    for (const line of text.split(LINE_SEPARATOR)) {
-      if (line.length === 0) continue;
-      const nameEnd = line.indexOf(FIELD_SEPARATOR);
-      if (nameEnd === -1) continue;
-      const idEnd = line.indexOf(FIELD_SEPARATOR, nameEnd + 1);
-      if (idEnd === -1) continue;
-      const advisoryId = line.slice(nameEnd + 1, idEnd);
-      if (input.dropAdvisoryIds.has(advisoryId)) continue;
-      surviving.push(line);
-    }
-  } catch {
-    surviving = [];
-  }
-  const writer = createRowWriter(path);
-  try {
-    const CHUNK = 5e3;
-    for (let i = 0; i < surviving.length; i += CHUNK) {
-      await writer.writeRaw(surviving.slice(i, i + CHUNK));
-    }
-    await writer.write(input.append);
-    return await writer.commit();
-  } catch (err) {
-    await writer.abort();
-    throw err;
-  }
-}
-async function countRows(path) {
-  try {
-    const raw = await promises.readFile(path);
-    const text = zlib.gunzipSync(raw).toString("utf8");
-    let count = 0;
-    let offset = 0;
-    for (; ; ) {
-      const next = text.indexOf(LINE_SEPARATOR, offset);
-      if (next === -1) break;
-      count++;
-      offset = next + 1;
-    }
-    return count;
-  } catch {
-    return 0;
-  }
-}
-function safeParse3(json3) {
-  try {
-    return JSON.parse(json3);
-  } catch {
-    return null;
-  }
-}
-
-// src/cache/lookup.ts
-async function loadCacheForPackages(cacheDir, ecosystem, packageNames, sources) {
-  const wanted = new Set(packageNames);
-  const osv = /* @__PURE__ */ new Map();
-  const gemnasium = /* @__PURE__ */ new Map();
-  if (sources.includes("osv")) {
-    const rows = await readRowsForPackages(advisoryFilePath(cacheDir, "osv", ecosystem), wanted);
-    for (const [name, list] of rows.entries()) {
-      osv.set(name, list.map(toOsvAdvisory));
-    }
-  }
-  if (sources.includes("gemnasium")) {
-    const rows = await readRowsForPackages(advisoryFilePath(cacheDir, "gemnasium", ecosystem), wanted);
-    for (const [name, list] of rows.entries()) {
-      gemnasium.set(name, list.map(toGemnasiumAdvisory));
-    }
-  }
-  return { osv, gemnasium };
-}
-function cacheEcosystemKey(ecosystem) {
-  const def = getEcosystem(ecosystem);
-  return def ? def.osvEcosystem : ecosystem;
-}
-function toOsvAdvisory(row) {
-  return {
-    advisoryId: row.advisoryId,
-    aliases: row.aliases,
-    ranges: row.ranges,
-    versions: row.versions,
-    severity: row.severity,
-    summary: row.summary,
-    url: row.url,
-    malicious: row.malicious
-  };
-}
-function toGemnasiumAdvisory(row) {
-  return {
-    advisoryId: row.advisoryId,
-    aliases: row.aliases,
-    ranges: row.ranges,
-    versions: row.versions,
-    severity: row.severity,
-    summary: row.summary,
-    url: row.url
-  };
-}
 
 // ../../packages/feeds/src/osv/feed.ts
 var import_unzipper = __toESM(require_unzip2());
@@ -33521,8 +33250,8 @@ function isSlowTransientStatus(status) {
 var FAST_MAX_ATTEMPTS = 4;
 var RETRY_BASE_MS = 1e3;
 var RETRY_FACTOR = 3;
-var DEFAULT_RETRY_WAIT_MS = 18e4;
-var SLOW_RETRY_WAITS_MS = [45e3, 6e4, 75e3];
+var DEFAULT_RETRY_WAIT_MS = 15e3;
+var SLOW_RETRY_WAITS_MS = [2e3, 5e3, 8e3];
 function delay(ms) {
   return new Promise(function schedule(resolve5) {
     setTimeout(resolve5, ms);
@@ -33532,7 +33261,7 @@ function retryBudgetMs(options) {
   if (options && typeof options.retryWaitMs === "number" && options.retryWaitMs >= 0) return options.retryWaitMs;
   return DEFAULT_RETRY_WAIT_MS;
 }
-async function fetchWithRetry(url2, init, options, timeoutMs) {
+async function withRetry(describe3, perform, discard, options, timeoutMs) {
   const budgetMs = retryBudgetMs(options);
   const startedAt = Date.now();
   let lastStatus;
@@ -33541,19 +33270,19 @@ async function fetchWithRetry(url2, init, options, timeoutMs) {
   let slowAttempts = 0;
   for (; ; ) {
     attempt++;
-    const response = await fetch(url2, { ...init, signal: signalFor(options, timeoutMs) });
+    const response = await perform(signalFor(options, timeoutMs));
     const slow = isSlowTransientStatus(response.status);
     if (!slow && !isFastTransientStatus(response.status)) return response;
     lastStatus = response.status;
-    if (response.body) await response.body.cancel();
+    await discard(response);
     if (options && options.abortSignal && options.abortSignal.aborted) break;
     if (slow) {
-      const elapsedMs = Date.now() - startedAt;
-      if (elapsedMs >= budgetMs) break;
+      const elapsedMs2 = Date.now() - startedAt;
+      if (elapsedMs2 >= budgetMs) break;
       const nominalMs = SLOW_RETRY_WAITS_MS[Math.min(slowAttempts, SLOW_RETRY_WAITS_MS.length - 1)];
-      const waitMs = Math.min(nominalMs, budgetMs - elapsedMs);
+      const waitMs = Math.min(nominalMs, budgetMs - elapsedMs2);
       slowAttempts++;
-      if (options && options.onRetry) options.onRetry({ status: lastStatus, attempt, waitMs, elapsedMs, budgetMs });
+      if (options && options.onRetry) options.onRetry({ status: lastStatus, attempt, waitMs, elapsedMs: elapsedMs2, budgetMs });
       await delay(waitMs);
       continue;
     }
@@ -33561,11 +33290,50 @@ async function fetchWithRetry(url2, init, options, timeoutMs) {
     if (fastAttempts >= FAST_MAX_ATTEMPTS) break;
     await delay(RETRY_BASE_MS * Math.pow(RETRY_FACTOR, fastAttempts - 1));
   }
-  throw new Error(describeMethod(init) + " " + url2 + " failed: HTTP " + lastStatus + " after " + attempt + " attempts");
+  const elapsedMs = Date.now() - startedAt;
+  throw new Error(
+    describe3 + " failed: HTTP " + lastStatus + " after " + attempt + " attempts over " + Math.round(elapsedMs / 1e3) + "s"
+  );
+}
+async function fetchWithRetry(url2, init, options, timeoutMs) {
+  return await withRetry(
+    describeMethod(init) + " " + url2,
+    function perform(signal) {
+      return fetch(url2, { ...init, signal });
+    },
+    async function discard(response) {
+      if (response.body) await response.body.cancel();
+    },
+    options,
+    timeoutMs
+  );
 }
 function describeMethod(init) {
   return typeof init.method === "string" && init.method.length > 0 ? init.method : "GET";
 }
+var MAX_REDIRECTS = 5;
+function openRawStream(url2, signal, redirectsLeft) {
+  return new Promise(function attempt(resolve5, reject) {
+    const target = new URL(url2);
+    const send = target.protocol === "http:" ? http.request : https.request;
+    const request = send(target, { method: "GET", headers: baseHeaders(), signal, agent: false }, function onResponse(response) {
+      const status = response.statusCode;
+      const location = response.headers.location;
+      if (status >= 300 && status < 400 && location) {
+        response.resume();
+        if (redirectsLeft <= 0) {
+          reject(new Error("GET " + url2 + " exceeded " + MAX_REDIRECTS + " redirects"));
+          return;
+        }
+        resolve5(openRawStream(new URL(location, target).toString(), signal, redirectsLeft - 1));
+        return;
+      }
+      resolve5({ status, headers: response.headers, stream: response });
+    });
+    request.on("error", reject);
+    request.end();
+  });
+}
 async function getTextConditional(url2, etag, options) {
   const headers = baseHeaders();
   if (etag) headers["If-None-Match"] = etag;
@@ -33609,21 +33377,33 @@ async function headFile(url2, options) {
   };
 }
 async function openDownloadStream(url2, onProgress, options) {
-  const response = await fetchWithRetry(url2, { headers: baseHeaders() }, options, DOWNLOAD_TIMEOUT_MS);
-  if (!response.ok) throw new Error("GET " + url2 + " failed: HTTP " + response.status);
-  if (!response.body) throw new Error("GET " + url2 + " returned no body");
-  const rawLength = response.headers.get("content-length");
-  const parsedLength = rawLength === null ? NaN : Number(rawLength);
+  const response = await withRetry(
+    "GET " + url2,
+    function perform(signal) {
+      return openRawStream(url2, signal, MAX_REDIRECTS);
+    },
+    function discard(raw) {
+      raw.stream.resume();
+    },
+    options,
+    DOWNLOAD_TIMEOUT_MS
+  );
+  if (response.status < 200 || response.status >= 300) {
+    response.stream.resume();
+    throw new Error("GET " + url2 + " failed: HTTP " + response.status);
+  }
+  const rawLength = response.headers["content-length"];
+  const parsedLength = rawLength === void 0 ? NaN : Number(rawLength);
   const contentLength = Number.isFinite(parsedLength) ? parsedLength : null;
-  const stream$1 = stream.Readable.fromWeb(response.body);
+  const stream = response.stream;
   if (onProgress) {
     let bytesRead = 0;
-    stream$1.on("data", function countChunk(chunk) {
+    stream.on("data", function countChunk(chunk) {
       bytesRead += chunk.length;
       onProgress(bytesRead, contentLength);
     });
   }
-  return { stream: stream$1, contentLength, lastModified: response.headers.get("last-modified") };
+  return { stream, contentLength, lastModified: response.headers["last-modified"] ?? null };
 }
 
 // ../../packages/feeds/src/osv/normalize.ts
@@ -33768,24 +33548,28 @@ async function* streamOsvSeed(ecosystem, onProgress, options) {
   const abortSignal = options && options.abortSignal;
   let batch = [];
   const zip = download.stream.pipe(import_unzipper.default.Parse({ forceStream: true }));
-  for await (const entry of zip) {
-    if (abortSignal && abortSignal.aborted) {
-      entry.autodrain();
-      throw new Error("aborted");
-    }
-    if (entry.type !== "File" || !String(entry.path).endsWith(".json")) {
-      entry.autodrain();
-      continue;
+  try {
+    for await (const entry of zip) {
+      if (abortSignal && abortSignal.aborted) {
+        entry.autodrain();
+        throw new Error("aborted");
+      }
+      if (entry.type !== "File" || !String(entry.path).endsWith(".json")) {
+        entry.autodrain();
+        continue;
+      }
+      const content = await entry.buffer();
+      for (const row of parseSeedEntry(content, ecosystem)) batch.push(row);
+      if (batch.length >= BATCH_SIZE) {
+        yield { rows: batch, lastModified: download.lastModified };
+        batch = [];
+      }
     }
-    const content = await entry.buffer();
-    for (const row of parseSeedEntry(content, ecosystem)) batch.push(row);
-    if (batch.length >= BATCH_SIZE) {
+    if (batch.length > 0) {
       yield { rows: batch, lastModified: download.lastModified };
-      batch = [];
     }
-  }
-  if (batch.length > 0) {
-    yield { rows: batch, lastModified: download.lastModified };
+  } finally {
+    download.stream.destroy();
   }
 }
 async function fetchOsvChangedIds(ecosystem, cursorMs, etag, options) {
@@ -34073,23 +33857,28 @@ function nonEmpty(s) {
 }
 
 // ../../packages/feeds/src/gemnasium/feed.ts
-var DEFAULT_ARCHIVE_URL = "https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/archive/master/gemnasium-db-master.zip";
 var DEFAULT_API_BASE = "https://gitlab.com/api/v4/projects/gitlab-org%2Fsecurity-products%2Fgemnasium-db";
 var DEFAULT_REF = "master";
 var BATCH_SIZE2 = 2e3;
 var GEMNASIUM_COMPARE_MAX_FILES = 1e3;
-function archiveUrl() {
+function archiveOverride() {
   const fromEnv = process.env.SENTINELLO_GEMNASIUM_FEED_URL;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();
-  return DEFAULT_ARCHIVE_URL;
+  return null;
 }
 function apiBase() {
   const fromEnv = process.env.SENTINELLO_GEMNASIUM_API_URL;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();
   return DEFAULT_API_BASE;
 }
+function archiveUrl(ref) {
+  const override = archiveOverride();
+  if (override) return override;
+  return apiBase() + "/repository/archive.zip?sha=" + encodeURIComponent(ref ?? DEFAULT_REF);
+}
 function gemnasiumFeedDisabled() {
-  return archiveUrl().toLowerCase() === "off";
+  const override = archiveOverride();
+  return override !== null && override.toLowerCase() === "off";
 }
 var PACKAGE_TYPE_TO_ECOSYSTEM = (function buildMap() {
   const map3 = {};
@@ -34163,30 +33952,34 @@ function advisoryIdFromPath(path) {
   const id = dot > 0 ? file2.slice(0, dot) : file2;
   return id.length > 0 ? id : null;
 }
-async function* streamGemnasiumArchive(onProgress, options) {
-  const download = await openDownloadStream(archiveUrl(), onProgress, options);
+async function* streamGemnasiumArchive(ref, onProgress, options) {
+  const download = await openDownloadStream(archiveUrl(ref), onProgress, options);
   const abortSignal = options && options.abortSignal;
   let batch = [];
   const zip = download.stream.pipe(import_unzipper2.default.Parse({ forceStream: true }));
-  for await (const entry of zip) {
-    if (abortSignal && abortSignal.aborted) {
-      entry.autodrain();
-      throw new Error("aborted");
-    }
-    const cell = advisoryPathEcosystem(String(entry.path), 1);
-    if (entry.type !== "File" || !cell) {
-      entry.autodrain();
-      continue;
+  try {
+    for await (const entry of zip) {
+      if (abortSignal && abortSignal.aborted) {
+        entry.autodrain();
+        throw new Error("aborted");
+      }
+      const cell = advisoryPathEcosystem(String(entry.path), 1);
+      if (entry.type !== "File" || !cell) {
+        entry.autodrain();
+        continue;
+      }
+      const content = await entry.buffer();
+      for (const row of parseAdvisoryYaml(content, cell)) batch.push(row);
+      if (batch.length >= BATCH_SIZE2) {
+        yield { rows: batch, lastModified: download.lastModified };
+        batch = [];
+      }
     }
-    const content = await entry.buffer();
-    for (const row of parseAdvisoryYaml(content, cell)) batch.push(row);
-    if (batch.length >= BATCH_SIZE2) {
+    if (batch.length > 0) {
       yield { rows: batch, lastModified: download.lastModified };
-      batch = [];
     }
-  }
-  if (batch.length > 0) {
-    yield { rows: batch, lastModified: download.lastModified };
+  } finally {
+    download.stream.destroy();
   }
 }
 function parseAdvisoryYaml(content, cell) {
@@ -34198,6 +33991,288 @@ function parseAdvisoryYaml(content, cell) {
   }
   return normalizeGemnasiumRecord(parsed, cell.ecosystem, cell.slugPrefix);
 }
+var CACHE_SCHEMA_VERSION = 1;
+function emptyMeta() {
+  return { schemaVersion: CACHE_SCHEMA_VERSION, sources: { osv: {}, gemnasium: {} } };
+}
+function resolveCacheDir(override) {
+  if (override && override.trim().length > 0) return path.resolve(override.trim());
+  const fromEnv = process.env.SENTINELLO_CACHE_DIR;
+  if (fromEnv && fromEnv.trim().length > 0) return path.resolve(fromEnv.trim());
+  const xdg = process.env.XDG_CACHE_HOME;
+  if (xdg && xdg.trim().length > 0) return path.join(path.resolve(xdg.trim()), "sentinello");
+  return path.join(os.homedir(), ".cache", "sentinello");
+}
+function advisoryFilePath(cacheDir, source, ecosystem) {
+  const slug = ecosystem.replace(/[^a-zA-Z0-9._-]+/g, "-");
+  return path.join(cacheDir, source + "-" + slug + ".ndjson.gz");
+}
+function metaPath(cacheDir) {
+  return path.join(cacheDir, "meta.json");
+}
+async function ensureCacheDir(cacheDir) {
+  await promises.mkdir(cacheDir, { recursive: true });
+}
+async function readCacheMeta(cacheDir) {
+  let text;
+  try {
+    text = await promises.readFile(metaPath(cacheDir), "utf8");
+  } catch {
+    return emptyMeta();
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return emptyMeta();
+  }
+  if (!parsed || typeof parsed !== "object") return emptyMeta();
+  const meta3 = parsed;
+  if (meta3.schemaVersion !== CACHE_SCHEMA_VERSION) return emptyMeta();
+  const sources = meta3.sources;
+  if (!sources || typeof sources !== "object") return emptyMeta();
+  return {
+    schemaVersion: CACHE_SCHEMA_VERSION,
+    sources: {
+      osv: sources.osv ?? {},
+      gemnasium: sources.gemnasium ?? {}
+    }
+  };
+}
+async function writeCacheMeta(cacheDir, meta3) {
+  await ensureCacheDir(cacheDir);
+  const target = metaPath(cacheDir);
+  const tmp = target + ".tmp";
+  await promises.writeFile(tmp, JSON.stringify(meta3, null, 4) + "\n", "utf8");
+  await promises.rename(tmp, target);
+}
+function getSourceState(meta3, source, ecosystem) {
+  return meta3.sources[source][ecosystem] ?? null;
+}
+function setSourceState(meta3, source, ecosystem, state) {
+  meta3.sources[source][ecosystem] = state;
+}
+function isSeeded(meta3, source, ecosystem, normalizerVersion) {
+  const state = getSourceState(meta3, source, ecosystem);
+  if (!state) return false;
+  return state.normalizerVersion === normalizerVersion && state.recordCount > 0;
+}
+async function tryAcquireLock(cacheDir) {
+  await ensureCacheDir(cacheDir);
+  const path$1 = path.join(cacheDir, ".lock");
+  try {
+    await promises.writeFile(path$1, String(process.pid), { flag: "wx" });
+  } catch {
+    if (await isStaleLock(path$1)) {
+      await promises.rm(path$1, { force: true });
+      return await tryAcquireLock(cacheDir);
+    }
+    return null;
+  }
+  async function release() {
+    await promises.rm(path$1, { force: true });
+  }
+  return { release };
+}
+var LOCK_STALE_MS = 30 * 60 * 1e3;
+async function isStaleLock(path) {
+  try {
+    const info = await promises.stat(path);
+    return Date.now() - info.mtimeMs > LOCK_STALE_MS;
+  } catch {
+    return false;
+  }
+}
+var FIELD_SEPARATOR = "	";
+var LINE_SEPARATOR = "\n";
+function encodeRow(row) {
+  const name = row.packageName.replace(/[\t\n\r]/g, "");
+  const id = row.advisoryId.replace(/[\t\n\r]/g, "");
+  return name + FIELD_SEPARATOR + id + FIELD_SEPARATOR + JSON.stringify(row);
+}
+function createRowWriter(path) {
+  const tmpPath = path + ".tmp";
+  const source = new stream.PassThrough();
+  const gzip = zlib.createGzip();
+  const done = promises$2.pipeline(source, gzip, fs.createWriteStream(tmpPath));
+  let rowCount = 0;
+  let failed = null;
+  done.catch(function capture(err) {
+    failed = err instanceof Error ? err : new Error(String(err));
+  });
+  async function push(chunk, added) {
+    if (failed) throw failed;
+    rowCount += added;
+    if (!source.write(chunk)) {
+      await new Promise(function waitForDrain(resolve5) {
+        source.once("drain", resolve5);
+      });
+    }
+  }
+  async function write(rows) {
+    if (rows.length === 0) return;
+    await push(rows.map(encodeRow).join(LINE_SEPARATOR) + LINE_SEPARATOR, rows.length);
+  }
+  async function writeRaw(lines) {
+    if (lines.length === 0) return;
+    await push(lines.join(LINE_SEPARATOR) + LINE_SEPARATOR, lines.length);
+  }
+  async function commit() {
+    source.end();
+    await done;
+    await promises.rename(tmpPath, path);
+    return rowCount;
+  }
+  async function abort() {
+    source.destroy();
+    try {
+      await done;
+    } catch {
+    }
+    await promises.rm(tmpPath, { force: true });
+  }
+  return { write, writeRaw, commit, abort };
+}
+async function readRowsForPackages(path, packageNames) {
+  const out = /* @__PURE__ */ new Map();
+  if (packageNames.size === 0) return out;
+  let raw;
+  try {
+    raw = await promises.readFile(path);
+  } catch {
+    return out;
+  }
+  const text = zlib.gunzipSync(raw).toString("utf8");
+  let offset = 0;
+  while (offset < text.length) {
+    let end = text.indexOf(LINE_SEPARATOR, offset);
+    if (end === -1) end = text.length;
+    const nameEnd = text.indexOf(FIELD_SEPARATOR, offset);
+    if (nameEnd === -1 || nameEnd > end) {
+      offset = end + 1;
+      continue;
+    }
+    const name = text.slice(offset, nameEnd);
+    if (packageNames.has(name)) {
+      const idEnd = text.indexOf(FIELD_SEPARATOR, nameEnd + 1);
+      if (idEnd !== -1 && idEnd < end) {
+        const parsed = safeParse3(text.slice(idEnd + 1, end));
+        if (parsed) {
+          const list = out.get(name);
+          if (list) {
+            list.push(parsed);
+          } else {
+            out.set(name, [parsed]);
+          }
+        }
+      }
+    }
+    offset = end + 1;
+  }
+  return out;
+}
+async function rewriteRows(path, input) {
+  let surviving = [];
+  try {
+    const raw = await promises.readFile(path);
+    const text = zlib.gunzipSync(raw).toString("utf8");
+    for (const line of text.split(LINE_SEPARATOR)) {
+      if (line.length === 0) continue;
+      const nameEnd = line.indexOf(FIELD_SEPARATOR);
+      if (nameEnd === -1) continue;
+      const idEnd = line.indexOf(FIELD_SEPARATOR, nameEnd + 1);
+      if (idEnd === -1) continue;
+      const advisoryId = line.slice(nameEnd + 1, idEnd);
+      if (input.dropAdvisoryIds.has(advisoryId)) continue;
+      surviving.push(line);
+    }
+  } catch {
+    surviving = [];
+  }
+  const writer = createRowWriter(path);
+  try {
+    const CHUNK = 5e3;
+    for (let i = 0; i < surviving.length; i += CHUNK) {
+      await writer.writeRaw(surviving.slice(i, i + CHUNK));
+    }
+    await writer.write(input.append);
+    return await writer.commit();
+  } catch (err) {
+    await writer.abort();
+    throw err;
+  }
+}
+async function countRows(path) {
+  try {
+    const raw = await promises.readFile(path);
+    const text = zlib.gunzipSync(raw).toString("utf8");
+    let count = 0;
+    let offset = 0;
+    for (; ; ) {
+      const next = text.indexOf(LINE_SEPARATOR, offset);
+      if (next === -1) break;
+      count++;
+      offset = next + 1;
+    }
+    return count;
+  } catch {
+    return 0;
+  }
+}
+function safeParse3(json3) {
+  try {
+    return JSON.parse(json3);
+  } catch {
+    return null;
+  }
+}
+
+// src/cache/lookup.ts
+async function loadCacheForPackages(cacheDir, ecosystem, packageNames, sources) {
+  const wanted = new Set(packageNames);
+  const osv = /* @__PURE__ */ new Map();
+  const gemnasium = /* @__PURE__ */ new Map();
+  if (sources.includes("osv")) {
+    const rows = await readRowsForPackages(advisoryFilePath(cacheDir, "osv", ecosystem), wanted);
+    for (const [name, list] of rows.entries()) {
+      osv.set(name, list.map(toOsvAdvisory));
+    }
+  }
+  if (sources.includes("gemnasium")) {
+    const rows = await readRowsForPackages(advisoryFilePath(cacheDir, "gemnasium", ecosystem), wanted);
+    for (const [name, list] of rows.entries()) {
+      gemnasium.set(name, list.map(toGemnasiumAdvisory));
+    }
+  }
+  return { osv, gemnasium };
+}
+function cacheEcosystemKey(ecosystem) {
+  const def = getEcosystem(ecosystem);
+  return def ? def.osvEcosystem : ecosystem;
+}
+function toOsvAdvisory(row) {
+  return {
+    advisoryId: row.advisoryId,
+    aliases: row.aliases,
+    ranges: row.ranges,
+    versions: row.versions,
+    severity: row.severity,
+    summary: row.summary,
+    url: row.url,
+    malicious: row.malicious
+  };
+}
+function toGemnasiumAdvisory(row) {
+  return {
+    advisoryId: row.advisoryId,
+    aliases: row.aliases,
+    ranges: row.ranges,
+    versions: row.versions,
+    severity: row.severity,
+    summary: row.summary,
+    url: row.url
+  };
+}
 
 // src/cache/sync.ts
 async function planSync(options) {
@@ -34388,7 +34463,7 @@ async function seedGemnasium(options, meta3, item) {
   const writer = createRowWriter(path);
   let rowCount;
   try {
-    for await (const batch of streamGemnasiumArchive(progressFor(options, item), fetchOptionsFor(options, item))) {
+    for await (const batch of streamGemnasiumArchive(headSha, progressFor(options, item), fetchOptionsFor(options, item))) {
       const rows = batch.rows.filter(function forEcosystem(row) {
         return row.ecosystem === item.ecosystem;
       });
@@ -34847,6 +34922,13 @@ function renderJson(summary, options, generatedAt) {
     findings: summary.findings
   }, null, 2) + "\n";
 }
+function hasUnavailableSource(summary) {
+  return summary.projects.some(function projectLostASource(project) {
+    return project.unauditable.some(function lost(entry) {
+      return isSourceUnavailableReason(entry.reasonCode);
+    });
+  });
+}
 function shouldFail(summary, failOn) {
   if (failOn === "none") return false;
   if (failOn === "any") return summary.totalFindings > 0;
@@ -34994,7 +35076,7 @@ var SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
 function formatBytes(bytes, estimated = false) {
   if (bytes === null) return "unknown size";
   const prefix = estimated ? "~" : "";
-  if (bytes < 1024) return prefix + bytes + " B";
+  if (bytes < 1024) return prefix + Math.round(bytes) + " B";
   const mib = bytes / (1024 * 1024);
   if (mib < 1) return prefix + (bytes / 1024).toFixed(0) + " KB";
   if (mib < 1024) return prefix + mib.toFixed(1) + " MB";
@@ -35083,9 +35165,34 @@ function createUi(options) {
       rl.close();
     }
   }
-  function seedDeclined() {
+  function sourcesSwitchedOff(sources) {
+    const names = sources.map(sourceLabel).join(", ");
+    write("    " + c.dim + "\xB7 " + names + " switched off and never seeded \u2014 not scanned" + c.reset);
+  }
+  async function confirmRetry(failed) {
+    if (!interactive || !process.stdin.isTTY || !process.stderr.isTTY) return false;
+    const names = failed.map(function label(outcome) {
+      return sourceLabel(outcome.source);
+    }).join(", ");
+    write("");
+    write("  " + c.yellow + names + " could not be downloaded." + c.reset);
+    write("  " + c.dim + "The scan can continue without it, but anything only that source knows about" + c.reset);
+    write("  " + c.dim + "will be missing from the report." + c.reset);
+    const rl = promises$1.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+      const answer = await rl.question("  Try the download again? " + c.dim + "[Y/n]" + c.reset + " ");
+      const normalized = answer.trim().toLowerCase();
+      return normalized === "" || normalized === "y" || normalized === "yes";
+    } finally {
+      rl.close();
+    }
+  }
+  function seedDeclined(gated) {
     write("");
     write("  " + c.dim + "Skipped. Run again and accept, or pass --yes, to enable the advisory sources." + c.reset);
+    if (gated) {
+      write("  " + c.yellow + "--fail-on cannot be evaluated without them; exiting non-zero rather than reporting clean." + c.reset);
+    }
     write("");
   }
   function offlineNotice() {
@@ -35177,9 +35284,25 @@ function createUi(options) {
     }
     write(line);
   }
+  function lostSourceLines(runSummary) {
+    const seen = /* @__PURE__ */ new Map();
+    for (const project of runSummary.projects) {
+      for (const entry of project.unauditable) {
+        if (!isSourceUnavailableReason(entry.reasonCode)) continue;
+        if (seen.has(entry.scanner)) continue;
+        seen.set(entry.scanner, entry.errorText || entry.reasonCode);
+      }
+    }
+    return Array.from(seen, function line([scanner, why]) {
+      return sourceLabel(scanner) + c.dim + "  " + why + c.reset;
+    });
+  }
   function summary(runSummary, destination) {
     write("");
-    if (runSummary.totalFindings === 0) {
+    const lost = lostSourceLines(runSummary);
+    if (runSummary.totalFindings === 0 && lost.length > 0) {
+      write("  " + c.yellow + c.bold + "No findings \u2014 but not everything could be checked." + c.reset);
+    } else if (runSummary.totalFindings === 0) {
       write("  " + c.green + c.bold + "No findings." + c.reset + c.dim + "  " + runSummary.projects.length + " project" + (runSummary.projects.length === 1 ? "" : "s") + " clean." + c.reset);
     } else {
       const parts = [];
@@ -35200,6 +35323,13 @@ function createUi(options) {
         write("    " + project.relPath.padEnd(38).slice(0, 38) + "  " + breakdown);
       }
     }
+    if (lost.length > 0) {
+      write("");
+      for (const line of lost) write("    " + c.yellow + "!" + c.reset + " " + line);
+      if (options.failOn !== "none") {
+        write("    " + c.dim + "--fail-on cannot be honoured by a scan that lost a source; exiting non-zero." + c.reset);
+      }
+    }
     write("");
     if (destination) {
       write("  " + c.bold + "Advisory written to" + c.reset + " " + destination);
@@ -35220,6 +35350,8 @@ function createUi(options) {
     discovered,
     noProjects,
     confirmSeed,
+    confirmRetry,
+    sourcesSwitchedOff,
     seedDeclined,
     offlineNotice,
     syncStatus,
@@ -35236,8 +35368,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.0.0".length > 0) {
-    return "3.0.0";
+  if ("3.0.1".length > 0) {
+    return "3.0.1";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();
@@ -35270,10 +35402,10 @@ SOURCES
   --offline             Skip the freshness check and use the cached data as-is.
   --cache-dir <path>    Where the advisory cache lives.
                         Default: $XDG_CACHE_HOME/sentinello or ~/.cache/sentinello.
-  --feed-wait <secs>    How long to keep waiting out a feed that declines a download
-                        and clears on its own. GitLab does this to the gemnasium
-                        archive for a minute or two at a time. Default: 180.
-                        0 gives up on the first refusal, leaving that source unseeded.
+  --feed-wait <secs>    How long to keep retrying a feed that declines a download.
+                        Default: 15 \u2014 short, because a declined download is offered
+                        as a retry rather than waited out. 0 gives up on the first
+                        refusal, leaving that source unseeded.
 
 OUTPUT
   --out <file|->        Write the advisory to a file, or "-" for stdout. With "-" the
@@ -35290,7 +35422,10 @@ OUTPUT
 BEHAVIOUR
   --fail-on <level>     Exit 2 when a finding at this severity or above exists.
                         A severity, "any", or "none". Default: none.
-  -y, --yes             Accept every prompt, including the first-run download.
+  -y, --yes             Accept every prompt, including the first-run download. Required on a
+                        non-TTY: without it the download is refused, and under --fail-on
+                        that refusal exits 1 rather than reporting a clean scan. npx has a
+                        separate prompt of its own: in CI use  npx --yes sentinello --yes
   --doctor              Print cache status, resolved settings, and detected projects.
   -q, --quiet           Suppress the human-readable output.
   --verbose             List every directory skipped by an ignore rule.
@@ -35300,7 +35435,8 @@ BEHAVIOUR
 
 EXIT CODES
   0  completed (findings alone are not a failure)
-  1  a scan or configuration error
+  1  a scan or configuration error, or a --fail-on run that lost an advisory source
+     (a gate cannot be honoured by a scan that could not consult its sources)
   2  the --fail-on threshold was met
 
 CONFIG
@@ -35446,35 +35582,50 @@ async function runScan(options, cacheDir, ui) {
     ui.noProjects(skipped);
     return EXIT_OK;
   }
-  if (!options.offline && options.sources.length > 0) {
-    const plan = await planSync({ cacheDir, sources: options.sources, ecosystem: DEFAULT_ECOSYSTEM });
+  const sources = enabledSources(options.sources, await readCacheMeta(cacheDir));
+  const switchedOff = options.sources.filter(function isOff(source) {
+    return !sources.includes(source);
+  });
+  if (switchedOff.length > 0) ui.sourcesSwitchedOff(switchedOff);
+  if (!options.offline && sources.length > 0) {
+    const plan = await planSync({ cacheDir, sources, ecosystem: DEFAULT_ECOSYSTEM });
     if (plan.needsConsent && !options.assumeYes) {
       const approved = await ui.confirmSeed(plan);
       if (!approved) {
-        ui.seedDeclined();
-        return EXIT_OK;
+        const gated = options.failOn !== "none";
+        ui.seedDeclined(gated);
+        return gated ? EXIT_ERROR : EXIT_OK;
       }
     }
-    const outcomes = await runSync({
+    const syncOptions = {
       cacheDir,
-      sources: options.sources,
+      sources,
       ecosystem: DEFAULT_ECOSYSTEM,
       retryWaitMs: retryWaitMsFor(options.feedWaitSeconds),
       onProgress: ui.syncProgress,
       onRetry: ui.syncRetry,
       onStatus: ui.syncStatus
-    }, plan);
+    };
+    let outcomes = await runSync(syncOptions, plan);
     ui.syncDone(outcomes);
+    for (; ; ) {
+      const failed = failedItems(plan, outcomes);
+      if (failed.length === 0) break;
+      const approved = await ui.confirmRetry(outcomes.filter(isErrorOutcome));
+      if (!approved) break;
+      outcomes = await runSync(syncOptions, { items: failed, seedBytes: 0, needsConsent: false });
+      ui.syncDone(outcomes);
+    }
   } else if (options.offline) {
     ui.offlineNotice();
   }
   const resolved = await resolveProjects(projects);
   const packageNames = collectPackageNames(resolved);
-  const cache = await loadCacheForPackages(cacheDir, DEFAULT_ECOSYSTEM, packageNames, options.sources);
+  const cache = await loadCacheForPackages(cacheDir, DEFAULT_ECOSYSTEM, packageNames, sources);
   const meta3 = await readCacheMeta(cacheDir);
   const setup = {
     cacheDir,
-    sources: options.sources,
+    sources,
     ecosystem: DEFAULT_ECOSYSTEM,
     includeNpmAudit: options.includeNpmAudit,
     seeded: {
@@ -35508,8 +35659,33 @@ async function runScan(options, cacheDir, ui) {
   }
   ui.summary(summary, destination);
   if (shouldFail(summary, options.failOn)) return EXIT_THRESHOLD;
+  if (options.failOn !== "none" && hasUnavailableSource(summary)) return EXIT_ERROR;
   return EXIT_OK;
 }
+function feedSwitchedOff(source) {
+  if (source === "osv") return osvFeedDisabled();
+  return gemnasiumFeedDisabled();
+}
+function normalizerVersionFor(source) {
+  if (source === "osv") return OSV_NORMALIZER_VERSION;
+  return GEMNASIUM_NORMALIZER_VERSION;
+}
+function enabledSources(sources, meta3) {
+  return sources.filter(function isUsable(source) {
+    if (!feedSwitchedOff(source)) return true;
+    return isSeeded(meta3, source, DEFAULT_ECOSYSTEM, normalizerVersionFor(source));
+  });
+}
+function isErrorOutcome(outcome) {
+  return outcome.status === "error";
+}
+function failedItems(plan, outcomes) {
+  return plan.items.filter(function wasError(item) {
+    return outcomes.some(function matches(outcome) {
+      return outcome.status === "error" && outcome.source === item.source && outcome.ecosystem === item.ecosystem;
+    });
+  });
+}
 function retryWaitMsFor(feedWaitSeconds) {
   if (feedWaitSeconds === null) return void 0;
   return feedWaitSeconds * 1e3;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.0.0",
+    "version": "3.0.1",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [