@westbayberry/dg 1.0.62 → 1.0.63

package/dist/index.mjs

@@ -1589,6 +1589,49 @@ var require_source = __commonJS({
 
 // src/telemetry.ts
 import { platform, arch } from "node:os";
+function telemetryEnabled() {
+  return process.env.DG_TELEMETRY === "1";
+}
+function classifyError(err) {
+  const m = (err.message || err.name || "").toLowerCase();
+  if (/http (5\d\d)/.test(m)) {
+    const code = m.match(/http (5\d\d)/)?.[1];
+    return `http_${code ?? "5xx"}`;
+  }
+  if (/timeout|timed out|etimedout/.test(m)) return "network_timeout";
+  if (/socket hang up|econnreset/.test(m)) return "network_reset";
+  if (/enotfound|getaddrinfo/.test(m)) return "dns_failure";
+  if (/certificate|cert_|self.signed/.test(m)) return "tls_failure";
+  if (/econnrefused/.test(m)) return "connection_refused";
+  if (/network|fetch failed/.test(m)) return "network_other";
+  if (/permission denied|eacces/.test(m)) return "permission";
+  if (/enospc/.test(m)) return "disk_full";
+  if (/json|syntax|unexpected token/.test(m)) return "parse_error";
+  if (err.name && err.name !== "Error") return `runtime_${err.name.toLowerCase()}`;
+  return "runtime_error";
+}
+function sendCrashEvent(err, ctx) {
+  if (!telemetryEnabled()) return;
+  const apiUrl = process.env.DG_API_URL || "https://api.westbayberry.com";
+  const body = JSON.stringify({
+    error_class: classifyError(err),
+    dg_version: cliVersion || "unknown",
+    node_version: process.version,
+    os_arch: `${platform()} ${arch()}`,
+    command: (process.argv[2] || "unknown").slice(0, 32),
+    batch_size: ctx?.packageCount,
+    duration_ms: void 0
+  });
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), 2e3);
+  fetch(`${apiUrl}/v1/cli/error`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "User-Agent": `dg-cli/${cliVersion}` },
+    body,
+    signal: ctrl.signal
+  }).catch(() => {
+  }).finally(() => clearTimeout(t));
+}
 function initTelemetry(version) {
   if (initialized) return;
   initialized = true;
@@ -1656,17 +1699,42 @@ function buildIssueUrl(error, ctx) {
   });
   return `${GH_ISSUE_URL}?${params.toString()}`;
 }
+function suggestionForClass(klass) {
+  if (klass.startsWith("http_5")) return "Try again in a moment.";
+  if (klass === "network_timeout") return "Try again \u2014 the request timed out.";
+  if (klass === "network_reset" || klass === "connection_refused") return "Try again \u2014 connection was reset.";
+  if (klass === "dns_failure") return "Check your network connection.";
+  if (klass === "tls_failure") return "Check your network's TLS / certificate settings.";
+  if (klass === "permission") return "Check file permissions for the working directory.";
+  if (klass === "disk_full") return "Free up disk space and try again.";
+  if (klass === "parse_error") return "Re-run with DG_DEBUG=1 for details.";
+  return "Re-run with DG_DEBUG=1 for details.";
+}
 function captureError(error, context) {
   try {
     const err = error instanceof Error ? error : new Error(String(error));
+    sendCrashEvent(err, context);
     const chalk18 = chalkOrPlain();
     const debug = process.env.DG_DEBUG === "1";
+    const klass = classifyError(err);
+    if (!debug) {
+      const summary = redact(err.message || err.name).slice(0, 120);
+      process.stderr.write(
+        "\n  " + chalk18.red.bold("\u2718 dg crashed: ") + chalk18.red(summary) + "\n"
+      );
+      process.stderr.write(
+        "  " + chalk18.dim(suggestionForClass(klass)) + "\n\n"
+      );
+      process.exitCode = 1;
+      return;
+    }
     const cmd = process.argv.slice(2).join(" ") || "(none)";
     process.stderr.write("\n" + chalk18.dim(SEPARATOR) + "\n\n");
     process.stderr.write(
       "  " + chalk18.red.bold("\u2718 dg crashed: ") + chalk18.red(redact(err.message || err.name)) + "\n\n"
     );
     const rows = [
+      ["Class", klass],
       ["Where", context?.command ?? "(unknown)"],
       ["CLI", `dg-cli@${cliVersion || "unknown"}`],
       ["Node", `${process.version}   ${platform()} ${arch()}`],
@@ -1677,22 +1745,16 @@ function captureError(error, context) {
       process.stderr.write("  " + chalk18.dim(k.padEnd(labelW)) + v + "\n");
     }
     process.stderr.write("\n");
-    const frames = trimStack(err.stack, debug);
+    const frames = trimStack(err.stack, true);
     if (frames.length > 0) {
       process.stderr.write("  " + chalk18.dim("Top of stack:") + "\n");
       for (const f of frames) process.stderr.write("    " + chalk18.dim(f) + "\n");
-      if (!debug && (err.stack?.split("\n").length ?? 0) > frames.length + 1) {
-        process.stderr.write("    " + chalk18.dim("\u2026 (set DG_DEBUG=1 for the full stack)") + "\n");
-      }
       process.stderr.write("\n");
     }
     if (!suppressNudge()) {
       const url = buildIssueUrl(err, context);
-      process.stderr.write("  " + chalk18.dim("Looks like a bug?") + "\n");
+      process.stderr.write("  " + chalk18.dim("File an issue:") + "\n");
       process.stderr.write("    " + chalk18.cyan(url) + "\n");
-      process.stderr.write(
-        "    " + chalk18.dim("(version, command, and a redacted stack are pre-filled.") + "\n    " + chalk18.dim(" Nothing sent automatically.)") + "\n"
-      );
     }
     process.stderr.write("\n" + chalk18.dim(SEPARATOR) + "\n\n");
     process.exitCode = 1;
@@ -1782,8 +1844,6 @@ function legacyPaths() {
   return {
     dgrc: join2(home, ".dgrc.json"),
     cacheDir: depGuardianDir,
-    cacheSqlite: join2(home, ".dg", "cache.sqlite"),
-    routingHint: join2(home, ".dg", "scan-routing-hint.json"),
     updateCheck: join2(home, ".dg-update-check.json"),
     trialBannerOld: join2(depGuardianDir, "last-trial-banner"),
     aliasesShOld: join2(depGuardianDir, "aliases.sh"),
@@ -1797,9 +1857,7 @@ function dgPaths() {
     cacheDir: dgCacheDir(),
     stateDir: dgStateDir(),
     config: dgConfigPath(),
-    cacheSqlite: dgCachePath("scans.sqlite"),
     updateCheck: dgCachePath("update-check.json"),
-    routingHint: dgCachePath("routing-hint.json"),
     trialBanner: dgStatePath("trial-banner"),
     aliasesSh: dgStatePath("aliases.sh"),
     hooksRegistry: dgStatePath("hooks-installed.json"),
@@ -2278,6 +2336,12 @@ function recordTermsAccepted() {
   data.termsAcceptedAt = now;
   data.privacyAcceptedAt = now;
   writeDgrc(data);
+  const verify = readConfig();
+  if (typeof verify.termsAcceptedAt !== "string" || typeof verify.privacyAcceptedAt !== "string") {
+    throw new Error(
+      `wrote ${configPath()} but read-back did not contain termsAcceptedAt/privacyAcceptedAt \u2014 check that the file is on a writable filesystem and not shadowed by a cloud-sync conflict copy`
+    );
+  }
 }
 function getStackPreference() {
   const data = readConfig();
@@ -2464,18 +2528,11 @@ function loadDgrc() {
 `);
     }
   }
-  if (existsSync2(cwdPath) && cwdPath !== homePath && cwdPath !== legacyHomePath) {
-    try {
-      const cwd2 = JSON.parse(readFileSync2(cwdPath, "utf-8"));
-      warnUnknownDgrcKeys(cwd2, cwdPath);
-      for (const k of KNOWN_DGRC_KEYS) {
-        if (k === "apiKey" || k === "apiUrl") continue;
-        if (k in cwd2) config[k] = cwd2[k];
-      }
-    } catch {
-      process.stderr.write(`Warning: Failed to parse ${cwdPath}, ignoring.
-`);
-    }
+  if (cwdPath !== homePath && cwdPath !== legacyHomePath && existsSync2(cwdPath) && process.env.DG_QUIET !== "1") {
+    process.stderr.write(
+      `dg: note: ./.dgrc.json is ignored (repo-controlled config is no longer honored). Use ~/.dg/.dgrc.json, env vars (DG_MODE, DG_API_URL), or CLI flags.
+`
+    );
   }
   return config;
 }
@@ -2646,7 +2703,7 @@ var init_config = __esm({
     dg pip install <pkg>    Same, for pip
     dg hook install         Block risky lockfile changes at commit time
     dg login / dg logout    Manage authentication
-    dg update               Check for and install the latest dg version
+    dg update               Upgrade dg to the latest version
     dg uninstall            Remove everything dg has written locally
 
   Common flags:
@@ -2683,7 +2740,7 @@ var init_config = __esm({
     uninstall       Remove every file dg has written locally (config, cache,
                     hooks across repos, shell-rc lines)
     status          Show coverage overview (auth, protect, hook, npm/pip, update)
-    update          Check for and install the latest version
+    update          Upgrade dg (detects npm/pnpm/yarn/bun; --print to dry-run)
     wrap            Show instructions to alias npm to dg (manual)
     help            Show short help (\`dg --help-all\` for this view)
     version         Show version number
@@ -2726,6 +2783,7 @@ var init_config = __esm({
     1  warn    \u2014 Risks detected (advisory)
     2  block   \u2014 High-risk packages detected (or scan refused in block mode)
     3  error   \u2014 Internal error (API failure, config error)
+    4  analysis_incomplete \u2014 Some packages could not be fully analyzed
 
   What dg actually does:
     - \`dg npm install foo\` resolves the FULL dependency tree via
@@ -3177,15 +3235,29 @@ var init_npm_wrapper = __esm({
 });
 
 // src/update-check.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
-import { execFileSync } from "node:child_process";
 function cacheFile() {
   return dgCachePath("update-check.json");
 }
 function readCache() {
+  const path2 = cacheFile();
+  let stat = null;
+  try {
+    stat = lstatSync2(path2, { throwIfNoEntry: false }) ?? null;
+  } catch {
+    return null;
+  }
+  if (!stat) return null;
+  if (!stat.isFile() || stat.size > MAX_CACHE_BYTES) {
+    try {
+      unlinkSync2(path2);
+    } catch {
+    }
+    return null;
+  }
   try {
-    const raw = readFileSync4(cacheFile(), "utf-8");
+    const raw = readFileSync4(path2, "utf-8");
     const data = JSON.parse(raw);
     if (typeof data.latest === "string" && typeof data.checkedAt === "number") {
       return data;
@@ -3199,7 +3271,9 @@ function writeCache(entry) {
     const path2 = cacheFile();
     const parent = dirname3(path2);
     if (!existsSync4(parent)) mkdirSync2(parent, { recursive: true, mode: 448 });
-    writeFileSync3(path2, JSON.stringify(entry), "utf-8");
+    const serialized = JSON.stringify(entry);
+    if (serialized.length > MAX_CACHE_BYTES) return;
+    writeFileSync3(path2, serialized, { encoding: "utf-8", mode: 384 });
   } catch {
   }
 }
@@ -3259,47 +3333,14 @@ async function checkForUpdate(currentVersion) {
   }
   return null;
 }
-async function runUpdate(currentVersion) {
-  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
-  process.stderr.write(chalk18.dim("  Checking for updates...\n"));
-  const latest = await fetchLatestVersion();
-  if (!latest) {
-    process.stderr.write(chalk18.red("  Could not reach npm registry.\n"));
-    process.exit(1);
-  }
-  if (!isNewer(latest, currentVersion)) {
-    process.stderr.write(
-      chalk18.green(`  Already on latest version (${currentVersion}).
-`)
-    );
-    return;
-  }
-  process.stderr.write(chalk18.dim(`  Installing ${PKG_NAME}@${latest}...
-`));
-  try {
-    execFileSync("npm", ["install", "-g", `${PKG_NAME}@${latest}`], { stdio: "inherit" });
-    writeCache({ latest, checkedAt: Date.now() });
-    process.stderr.write(
-      chalk18.green(`
-  Updated ${currentVersion} \u2192 ${latest}
-`)
-    );
-  } catch {
-    process.stderr.write(
-      chalk18.red(`
-  Update failed. Try manually: npm i -g ${PKG_NAME}@${latest}
-`)
-    );
-    process.exit(1);
-  }
-}
-var PKG_NAME, CHECK_INTERVAL_MS;
+var PKG_NAME, CHECK_INTERVAL_MS, MAX_CACHE_BYTES;
 var init_update_check = __esm({
   "src/update-check.ts"() {
     "use strict";
     init_paths();
     PKG_NAME = "@westbayberry/dg";
     CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+    MAX_CACHE_BYTES = 64 * 1024;
   }
 });
 
@@ -37562,6 +37603,45 @@ var init_walker = __esm({
   }
 });
 
+// src/security/safe_git.ts
+import { execFileSync } from "node:child_process";
+function safeGit(args, opts) {
+  return execFileSync("git", [...HARDENING_ARGS, ...args], {
+    ...opts,
+    encoding: "utf-8",
+    stdio: opts.stdio ?? ["pipe", "pipe", "pipe"],
+    env: { ...process.env, ...HARDENING_ENV, ...opts.env ?? {} }
+  });
+}
+var HARDENING_ARGS, HARDENING_ENV;
+var init_safe_git = __esm({
+  "src/security/safe_git.ts"() {
+    "use strict";
+    HARDENING_ARGS = [
+      "-c",
+      "core.fsmonitor=",
+      "-c",
+      "core.hooksPath=/dev/null",
+      "-c",
+      "core.editor=true",
+      "-c",
+      "core.pager=cat",
+      "-c",
+      "core.sshCommand=false",
+      "-c",
+      "protocol.allow=user"
+    ];
+    HARDENING_ENV = {
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      GIT_ASKPASS: "true",
+      SSH_ASKPASS: "true",
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_CONFIG_GLOBAL: "/dev/null"
+    };
+  }
+});
+
 // src/state/hooks_registry.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5, chmodSync as chmodSync3 } from "node:fs";
 import { dirname as dirname5, isAbsolute as isAbsolute2, normalize } from "node:path";
@@ -37680,21 +37760,20 @@ __export(hook_exports, {
   uninstallHookFromRepo: () => uninstallHookFromRepo,
   verifyHookInstalled: () => verifyHookInstalled
 });
-import { execFileSync as execFileSync2 } from "node:child_process";
 import {
   existsSync as existsSync8,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   readFileSync as readFileSync8,
   writeFileSync as writeFileSync6,
   mkdirSync as mkdirSync5,
   chmodSync as chmodSync4,
-  unlinkSync as unlinkSync3
+  unlinkSync as unlinkSync4
 } from "node:fs";
 import { join as join6, dirname as dirname6, resolve as resolvePath, isAbsolute as isAbsolute3 } from "node:path";
 function assertSafeWriteTarget(target) {
   const parent = dirname6(target);
   try {
-    const parentStat = lstatSync2(parent);
+    const parentStat = lstatSync3(parent);
     if (parentStat.isSymbolicLink()) {
       throw new Error(
         `refusing to write to ${target}: parent dir ${parent} is a symlink (possible path-traversal attack)`
@@ -37706,7 +37785,7 @@ function assertSafeWriteTarget(target) {
     }
   }
   try {
-    const targetStat = lstatSync2(target);
+    const targetStat = lstatSync3(target);
     if (targetStat.isSymbolicLink()) {
       throw new Error(
         `refusing to write to ${target}: target is a symlink (possible path-traversal attack)`
@@ -37724,20 +37803,14 @@ function safeWriteFileSync(target, content) {
 }
 function findHooksDir() {
   try {
-    return execFileSync2("git", ["rev-parse", "--git-path", "hooks"], {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    return safeGit(["rev-parse", "--git-path", "hooks"], { cwd: process.cwd() }).trim();
   } catch {
     throw new Error("Not a git repository. Run this from inside a git project.");
   }
 }
 function findRepoRoot() {
   try {
-    return execFileSync2("git", ["rev-parse", "--show-toplevel"], {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    return safeGit(["rev-parse", "--show-toplevel"], { cwd: process.cwd() }).trim();
   } catch {
     throw new Error("Not a git repository. Run this from inside a git project.");
   }
@@ -37799,7 +37872,7 @@ function verifyHookInstalled(info) {
   }
   if (info.framework === "bare" || info.framework === "husky") {
     try {
-      const mode = lstatSync2(info.targetFile).mode & 511;
+      const mode = lstatSync3(info.targetFile).mode & 511;
       if ((mode & 73) === 0) {
         return { ok: false, reason: `hook is not executable (mode ${mode.toString(8)})` };
       }
@@ -37951,7 +38024,7 @@ function stripDgFromHookFile(hookPath, framework, repoPath) {
     return { status: "not-found", hookPath, repoPath };
   }
   if (framework === "bare" && content.trimStart().startsWith("#!/bin/sh\n" + HOOK_MARKER)) {
-    unlinkSync3(hookPath);
+    unlinkSync4(hookPath);
     removeEntry(repoPath, hookPath);
     return { status: "removed", hookPath, repoPath };
   }
@@ -37964,7 +38037,7 @@ function stripDgFromHookFile(hookPath, framework, repoPath) {
   const after = content.slice(endIdx + MARKER_END.length).trimStart();
   const remaining = (before + (after ? "\n" + after : "")).trimEnd() + "\n";
   if (remaining.trim() === "" || remaining.trim() === "#!/bin/sh") {
-    unlinkSync3(hookPath);
+    unlinkSync4(hookPath);
   } else {
     safeWriteFileSync(hookPath, remaining);
   }
@@ -38012,7 +38085,7 @@ function uninstallHookFromRepo(repoRootOverride) {
     return { status: "not-found", hookPath, repoPath: root };
   }
   if (content.trimStart().startsWith("#!/bin/sh\n" + HOOK_MARKER)) {
-    unlinkSync3(hookPath);
+    unlinkSync4(hookPath);
     removeEntry(root, hookPath);
     return { status: "removed", hookPath, repoPath: root };
   }
@@ -38026,7 +38099,7 @@ function uninstallHookFromRepo(repoRootOverride) {
     removeEntry(root, hookPath);
     return { status: "removed", hookPath, repoPath: root };
   }
-  unlinkSync3(hookPath);
+  unlinkSync4(hookPath);
   removeEntry(root, hookPath);
   return { status: "removed", hookPath, repoPath: root };
 }
@@ -38079,6 +38152,7 @@ var HOOK_MARKER, MARKER_START, MARKER_END, LEFTHOOK_MARKER, HOOK_SCRIPT, HOOK_SE
 var init_hook = __esm({
   "src/commands/hook.ts"() {
     "use strict";
+    init_safe_git();
     init_hooks_registry();
     HOOK_MARKER = "# dependency-guardian-hook";
     MARKER_START = "# dependency-guardian-hook-start";
@@ -38167,6 +38241,41 @@ ${MARKER_END}
   }
 });
 
+// src/security/sanitize.ts
+import { stripVTControlCharacters } from "node:util";
+function sanitize(s) {
+  return stripVTControlCharacters(s);
+}
+function sanitizeDeep(value) {
+  if (typeof value === "string") {
+    return stripVTControlCharacters(value);
+  }
+  if (value === null || value === void 0) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => sanitizeDeep(v));
+  }
+  if (typeof value === "object") {
+    const src = value;
+    const out = {};
+    for (const k of Object.keys(src)) {
+      const cleanKey = stripVTControlCharacters(k);
+      out[cleanKey] = sanitizeDeep(src[k]);
+    }
+    return out;
+  }
+  return value;
+}
+function sanitizeResponse(response) {
+  return sanitizeDeep(response);
+}
+var init_sanitize = __esm({
+  "src/security/sanitize.ts"() {
+    "use strict";
+  }
+});
+
 // src/lockfile/parse_package_lock.ts
 function addLockfileEntry(packages, name, entry) {
   const existing = packages.get(name);
@@ -38276,17 +38385,31 @@ var init_parse_package_lock = __esm({
 });
 
 // src/lockfile/parse_yarn_lock.ts
+function parseEntryKey(firstSpec) {
+  const npmAliasIdx = firstSpec.indexOf("@npm:");
+  if (npmAliasIdx > 0) {
+    const alias = firstSpec.slice(0, npmAliasIdx);
+    const realSpec = firstSpec.slice(npmAliasIdx + "@npm:".length);
+    const atIdx2 = realSpec.startsWith("@") ? realSpec.indexOf("@", 1) : realSpec.indexOf("@");
+    const name = atIdx2 > 0 ? realSpec.slice(0, atIdx2) : realSpec;
+    return { name: name || null, alias: alias || void 0 };
+  }
+  const atIdx = firstSpec.startsWith("@") ? firstSpec.indexOf("@", 1) : firstSpec.indexOf("@");
+  return { name: atIdx > 0 ? firstSpec.slice(0, atIdx) : null };
+}
 function parseYarnLock(content) {
   const packages = /* @__PURE__ */ new Map();
   const lines = content.split("\n");
   let currentName = null;
+  let currentAlias = void 0;
   let currentEntry = {};
   const flush2 = () => {
     if (currentName && currentEntry.version) {
       addLockfileEntry(packages, currentName, {
         version: currentEntry.version,
         resolved: currentEntry.resolved,
-        integrity: currentEntry.integrity
+        integrity: currentEntry.integrity,
+        alias: currentAlias
       });
     }
   };
@@ -38294,6 +38417,7 @@ function parseYarnLock(content) {
     if (line.startsWith("#") || line.trim() === "") {
       flush2();
       currentName = null;
+      currentAlias = void 0;
       currentEntry = {};
       continue;
     }
@@ -38301,8 +38425,9 @@ function parseYarnLock(content) {
       flush2();
       const raw = line.slice(0, -1);
       const firstSpec = raw.split(",")[0].trim().replace(/^"/, "").replace(/"$/, "");
-      const atIdx = firstSpec.startsWith("@") ? firstSpec.indexOf("@", 1) : firstSpec.indexOf("@");
-      currentName = atIdx > 0 ? firstSpec.slice(0, atIdx) : null;
+      const parsed = parseEntryKey(firstSpec);
+      currentName = parsed.name;
+      currentAlias = parsed.alias;
       currentEntry = {};
       continue;
     }
@@ -38388,7 +38513,8 @@ function diffLockfiles(base, head, maxPackages, directDeps) {
         oldVersion,
         newVersion: headEntry.version,
         isDirect: directDeps?.has(name) ?? false,
-        isDev: headEntry.dev ?? false
+        isDev: headEntry.dev ?? false,
+        alias: headEntry.alias
       });
     }
   }
@@ -38453,7 +38579,6 @@ var init_parse_package_json = __esm({
 });
 
 // src/lockfile/index.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync9, existsSync as existsSync9, statSync as statSync2 } from "node:fs";
 import { join as join7 } from "node:path";
 function readFileSafe(path2) {
@@ -38475,7 +38600,12 @@ function discoverChanges(cwd2, config) {
       const pyPkgs = parsePythonDepFile(cwd2, pyFile);
       for (const p of pyPkgs) {
         if (p.version === "latest") continue;
-        pythonPackages.push({ name: p.name, version: p.version, previousVersion: null, isNew: true });
+        pythonPackages.push({
+          name: sanitize(p.name),
+          version: sanitize(p.version),
+          previousVersion: null,
+          isNew: true
+        });
       }
       break;
     }
@@ -38556,8 +38686,8 @@ function discoverChanges(cwd2, config) {
         continue;
       }
       packages.push({
-        name,
-        version: entry.version,
+        name: sanitize(name),
+        version: sanitize(entry.version),
         previousVersion: null,
         isNew: true
       });
@@ -38602,21 +38732,13 @@ function getDirectDeps(cwd2) {
 }
 function getDefaultBranch(cwd2) {
   try {
-    const ref = execFileSync3("git", ["symbolic-ref", "refs/remotes/origin/HEAD"], {
-      cwd: cwd2,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    const ref = safeGit(["symbolic-ref", "refs/remotes/origin/HEAD"], { cwd: cwd2 }).trim();
     const branch = ref.replace(/^refs\/remotes\/origin\//, "");
     if (branch) return branch;
   } catch {
   }
   try {
-    execFileSync3("git", ["rev-parse", "--verify", "refs/remotes/origin/master"], {
-      cwd: cwd2,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
+    safeGit(["rev-parse", "--verify", "refs/remotes/origin/master"], { cwd: cwd2 });
     return "master";
   } catch {
   }
@@ -38625,19 +38747,11 @@ function getDefaultBranch(cwd2) {
 function getGitBaseLockfile(cwd2) {
   try {
     const defaultBranch = getDefaultBranch(cwd2);
-    const mergeBase = execFileSync3("git", ["merge-base", "HEAD", defaultBranch], {
-      cwd: cwd2,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    const mergeBase = safeGit(["merge-base", "HEAD", defaultBranch], { cwd: cwd2 }).trim();
     if (!mergeBase) return null;
     for (const name of ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]) {
       try {
-        return execFileSync3("git", ["show", `${mergeBase}:${name}`], {
-          cwd: cwd2,
-          encoding: "utf-8",
-          stdio: ["pipe", "pipe", "pipe"]
-        });
+        return safeGit(["show", `${mergeBase}:${name}`], { cwd: cwd2 });
       } catch {
         continue;
       }
@@ -38650,27 +38764,20 @@ function getGitBaseLockfile(cwd2) {
 function getGitBaseFile(cwd2, filename) {
   try {
     const defaultBranch = getDefaultBranch(cwd2);
-    const mergeBase = execFileSync3("git", ["merge-base", "HEAD", defaultBranch], {
-      cwd: cwd2,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    const mergeBase = safeGit(["merge-base", "HEAD", defaultBranch], { cwd: cwd2 }).trim();
     if (!mergeBase) return null;
-    return execFileSync3("git", ["show", `${mergeBase}:${filename}`], {
-      cwd: cwd2,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
+    return safeGit(["show", `${mergeBase}:${filename}`], { cwd: cwd2 });
   } catch {
     return null;
   }
 }
 function toPackageInput(change) {
   return {
-    name: change.name,
-    version: change.newVersion,
-    previousVersion: change.oldVersion,
-    isNew: change.oldVersion === null
+    name: sanitize(change.name),
+    version: sanitize(change.newVersion),
+    previousVersion: change.oldVersion === null ? null : sanitize(change.oldVersion),
+    isNew: change.oldVersion === null,
+    alias: change.alias ? sanitize(change.alias) : void 0
   };
 }
 function parsePythonDepFile(projectDir, depFile) {
@@ -38727,6 +38834,8 @@ var MAX_LOCKFILE_BYTES, SELF_PACKAGE;
 var init_lockfile = __esm({
   "src/lockfile/index.ts"() {
     "use strict";
+    init_safe_git();
+    init_sanitize();
     init_parse_package_lock();
     init_parse_yarn_lock();
     init_parse_pnpm_lock();
@@ -38737,44 +38846,6 @@ var init_lockfile = __esm({
   }
 });
 
-// src/security/sanitize.ts
-import { stripVTControlCharacters } from "node:util";
-function sanitize(s) {
-  return stripVTControlCharacters(s);
-}
-function sanitizeFinding(f) {
-  const result = { severity: f.severity };
-  if (f.category !== void 0) result.category = sanitize(f.category);
-  if (f.title !== void 0) result.title = sanitize(f.title);
-  if (f.evidence !== void 0) result.evidence = f.evidence.map(sanitize);
-  return result;
-}
-function sanitizeResponse(response) {
-  const packages = response.packages.map((pkg) => ({
-    name: sanitize(pkg.name),
-    version: sanitize(pkg.version),
-    score: pkg.score,
-    findings: (pkg.findings ?? []).map(sanitizeFinding),
-    reasons: (pkg.reasons ?? []).map(sanitize),
-    recommendation: pkg.recommendation ? sanitize(pkg.recommendation) : void 0,
-    cached: pkg.cached,
-    license: pkg.license
-  }));
-  return {
-    score: response.score,
-    action: response.action,
-    packages,
-    safeVersions: response.safeVersions,
-    durationMs: response.durationMs,
-    trialScansRemaining: response.trialScansRemaining
-  };
-}
-var init_sanitize = __esm({
-  "src/security/sanitize.ts"() {
-    "use strict";
-  }
-});
-
 // src/api/client.ts
 var client_exports = {};
 __export(client_exports, {
@@ -38984,6 +39055,27 @@ function formatApiErrorMessage(status, rawBody, config) {
   }
   return `API returned ${status}: ${truncated}`;
 }
+async function readBoundedJson(response) {
+  const cl = response.headers?.get?.("content-length");
+  if (cl) {
+    const n = Number(cl);
+    if (Number.isFinite(n) && n > MAX_RESPONSE_BYTES) {
+      throw new APIError("API response exceeded size limit", 502, "");
+    }
+  }
+  if (typeof response.text === "function") {
+    const text = await response.text();
+    if (text.length > MAX_RESPONSE_BYTES) {
+      throw new APIError("API response exceeded size limit", 502, "");
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new APIError("Invalid JSON in API response", 502, "");
+    }
+  }
+  return await response.json();
+}
 async function callAnalyzeBatch(packages, config, onPackageProgress) {
   const url = `${config.apiUrl}/v1/analyze`;
   const payload = {
@@ -39047,7 +39139,7 @@ async function callAnalyzeBatch(packages, config, onPackageProgress) {
   if (contentType.includes("application/x-ndjson")) {
     return readNdjsonAnalyzeResponse(response, onPackageProgress);
   }
-  const raw = await response.json();
+  const raw = await readBoundedJson(response);
   if (!raw || typeof raw.score !== "number" || !Array.isArray(raw.packages)) {
     throw new APIError("Invalid API response format", 0, "");
   }
@@ -39060,8 +39152,12 @@ async function readNdjsonAnalyzeResponse(response, onPackageProgress) {
   }
   const decoder = new TextDecoder();
   let buf = "";
+  let totalBytes = 0;
   let finalPayload = null;
   const processLine = (raw) => {
+    if (raw.length > MAX_NDJSON_LINE_BYTES) {
+      throw new APIError("API response line exceeded size limit", 502, "");
+    }
     const line = raw.trim();
     if (!line) return;
     let event;
@@ -39087,21 +39183,47 @@ async function readNdjsonAnalyzeResponse(response, onPackageProgress) {
         break;
       case "error": {
         const sc = typeof event.statusCode === "number" ? event.statusCode : 500;
-        const msg = typeof event.error === "string" ? event.error : "Streaming scan failed";
-        throw new APIError(msg, sc, JSON.stringify(event));
+        const msg = sanitize(typeof event.error === "string" ? event.error : "Streaming scan failed");
+        throw new APIError(msg, sc, "");
       }
       case "started":
         break;
     }
   };
-  const iterable = response.body;
-  for await (const chunk of iterable) {
-    buf += decoder.decode(chunk, { stream: true });
-    let idx;
-    while ((idx = buf.indexOf("\n")) !== -1) {
-      const line = buf.slice(0, idx);
-      buf = buf.slice(idx + 1);
-      processLine(line);
+  const reader = response.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        totalBytes += value.byteLength;
+        if (totalBytes > MAX_RESPONSE_BYTES) {
+          try {
+            await reader.cancel();
+          } catch {
+          }
+          throw new APIError("API response exceeded size limit", 502, "");
+        }
+        buf += decoder.decode(value, { stream: true });
+        let idx;
+        while ((idx = buf.indexOf("\n")) !== -1) {
+          const line = buf.slice(0, idx);
+          buf = buf.slice(idx + 1);
+          processLine(line);
+        }
+        if (buf.length > MAX_NDJSON_LINE_BYTES) {
+          try {
+            await reader.cancel();
+          } catch {
+          }
+          throw new APIError("API response line exceeded size limit", 502, "");
+        }
+      }
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
     }
   }
   buf += decoder.decode();
@@ -39205,7 +39327,7 @@ async function callPyPIBatch(packages, config) {
       body
     );
   }
-  const raw = await response.json();
+  const raw = await readBoundedJson(response);
   if (!raw || typeof raw.score !== "number" || !Array.isArray(raw.packages)) {
     throw new APIError("Invalid API response format", 0, "");
   }
@@ -39250,7 +39372,7 @@ async function fetchLicensesBatchAt(endpoint, packages, config) {
     const body = await response.text();
     throw new APIError(formatApiErrorMessage(response.status, body, config), response.status, body);
   }
-  const data = await response.json();
+  const data = await readBoundedJson(response);
   if (!Array.isArray(data.packages)) {
     throw new APIError("Invalid licenses response payload", 0, "");
   }
@@ -39290,7 +39412,7 @@ function fetchLicenses(packages, config, onBatchComplete) {
 function fetchPyPILicenses(packages, config, onBatchComplete) {
   return batchLicenseFetch("/v1/pypi/licenses", packages, config, onBatchComplete);
 }
-var APIError, TrialExhaustedError, ClientOutdatedError, BATCH_SIZE, ANON_BATCH_SIZE, MAX_RETRIES, RETRY_DELAY_MS, DEFAULT_BATCH_CONCURRENCY, _currentScanId, BatchPoolPartialError, LICENSE_BATCH_SIZE;
+var APIError, TrialExhaustedError, ClientOutdatedError, BATCH_SIZE, ANON_BATCH_SIZE, MAX_RETRIES, RETRY_DELAY_MS, MAX_RESPONSE_BYTES, MAX_NDJSON_LINE_BYTES, DEFAULT_BATCH_CONCURRENCY, _currentScanId, BatchPoolPartialError, LICENSE_BATCH_SIZE;
 var init_client = __esm({
   "src/api/client.ts"() {
     "use strict";
@@ -39328,6 +39450,8 @@ var init_client = __esm({
     ANON_BATCH_SIZE = 200;
     MAX_RETRIES = 2;
     RETRY_DELAY_MS = 5e3;
+    MAX_RESPONSE_BYTES = 50 * 1024 * 1024;
+    MAX_NDJSON_LINE_BYTES = 4 * 1024 * 1024;
     DEFAULT_BATCH_CONCURRENCY = 4;
     _currentScanId = "";
     BatchPoolPartialError = class extends Error {
@@ -39366,28 +39490,29 @@ async function scanProjectAtPath(cwd2, config, onProgress) {
         result: EMPTY_OK_RESULT(elapsedMs())
       };
     }
+    let npmDone = 0;
+    let pyDone = 0;
+    const reportProgress = onProgress ? (current) => onProgress({ done: npmDone + pyDone, total: totalDiscovered, current }) : void 0;
+    const npmPromise = npmPackages.length > 0 ? callAnalyzeAPI(
+      npmPackages,
+      config,
+      reportProgress ? (done, _total, currentBatch) => {
+        npmDone = done;
+        reportProgress(currentBatch ?? []);
+      } : void 0
+    ) : Promise.resolve(null);
+    const pyPromise = pyPackages.length > 0 ? callPyPIAnalyzeAPI(
+      pyPackages,
+      config,
+      reportProgress ? (done) => {
+        pyDone = done;
+        reportProgress([]);
+      } : void 0
+    ) : Promise.resolve(null);
+    const [npmResp, pyResp] = await Promise.all([npmPromise, pyPromise]);
     const responses = [];
-    let cumulativeDone = 0;
-    if (npmPackages.length > 0) {
-      const npmOnProgress = onProgress ? (done, _total, currentBatch) => {
-        onProgress({
-          done: cumulativeDone + done,
-          total: totalDiscovered,
-          current: currentBatch ?? []
-        });
-      } : void 0;
-      const npmResp = await callAnalyzeAPI(npmPackages, config, npmOnProgress);
-      responses.push(npmResp);
-      cumulativeDone += npmPackages.length;
-    }
-    if (pyPackages.length > 0) {
-      const pyOnProgress = onProgress ? (done, _total) => {
-        onProgress({ done: cumulativeDone + done, total: totalDiscovered, current: [] });
-      } : void 0;
-      const pyResp = await callPyPIAnalyzeAPI(pyPackages, config, pyOnProgress);
-      responses.push(pyResp);
-      cumulativeDone += pyPackages.length;
-    }
+    if (npmResp) responses.push(npmResp);
+    if (pyResp) responses.push(pyResp);
     const allPackages = responses.flatMap((r) => r.packages);
     if (allPackages.length === 0) {
       const elapsed = elapsedMs();
@@ -39475,7 +39600,7 @@ __export(protect_exports, {
   stripAliasSourceFromRc: () => stripAliasSourceFromRc,
   suggestedShellRc: () => suggestedShellRc
 });
-import { existsSync as existsSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, mkdirSync as mkdirSync6, lstatSync as lstatSync3, appendFileSync } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync7, unlinkSync as unlinkSync5, mkdirSync as mkdirSync6, lstatSync as lstatSync4, appendFileSync } from "node:fs";
 import { join as join8, dirname as dirname7 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 function aliasFile() {
@@ -39483,7 +39608,7 @@ function aliasFile() {
 }
 function safeIsRegularFile(path2) {
   try {
-    const st = lstatSync3(path2);
+    const st = lstatSync4(path2);
     return st.isFile() && !st.isSymbolicLink();
   } catch {
     return false;
@@ -39492,7 +39617,7 @@ function safeIsRegularFile(path2) {
 function safeWriteFileSync2(target, content, mode = 420) {
   const parent = dirname7(target);
   try {
-    const parentStat = lstatSync3(parent);
+    const parentStat = lstatSync4(parent);
     if (parentStat.isSymbolicLink()) {
       throw new Error(`refusing to write to ${target}: parent dir is a symlink`);
     }
@@ -39500,7 +39625,7 @@ function safeWriteFileSync2(target, content, mode = 420) {
     if (e instanceof Error && e.message.startsWith("refusing")) throw e;
   }
   try {
-    const st = lstatSync3(target);
+    const st = lstatSync4(target);
     if (st.isSymbolicLink()) {
       throw new Error(`refusing to write to ${target}: target is a symlink`);
     }
@@ -39545,7 +39670,7 @@ function appendAliasSourceToRc(rcPathRaw, sourceLine, opts = {}) {
   try {
     const parent = dirname7(rcPath);
     if (existsSync10(parent)) {
-      const parentStat = lstatSync3(parent);
+      const parentStat = lstatSync4(parent);
       if (parentStat.isSymbolicLink()) {
         return { status: "failed", rcPath, reason: "parent directory is a symlink" };
       }
@@ -39556,7 +39681,7 @@ function appendAliasSourceToRc(rcPathRaw, sourceLine, opts = {}) {
   if (existsSync10(rcPath)) {
     let st;
     try {
-      st = lstatSync3(rcPath);
+      st = lstatSync4(rcPath);
     } catch (e) {
       return { status: "failed", rcPath, reason: e.message };
     }
@@ -39720,23 +39845,24 @@ async function runProtectInit(cwd2, opts = {}) {
   process.stderr.write(import_chalk4.default.dim(`    Mode: ${cfg.mode}${cfg.strict ? " \xB7 strict" : ""}
 `));
   process.stderr.write("\n");
-  if (!opts.noShell) {
-    try {
-      const path2 = writeAliasSnippet();
-      process.stderr.write(import_chalk4.default.bold("  Optional \u2014 alias npm/pip to route through DG:\n"));
-      process.stderr.write(import_chalk4.default.dim(`    Wrote ${path2}.
+  let aliasPath = null;
+  try {
+    aliasPath = writeAliasSnippet();
+  } catch (e) {
+    process.stderr.write(import_chalk4.default.yellow(`  Could not write alias snippet: ${e.message}
 `));
-      process.stderr.write("    Add this line to your shell rc (zshrc/bashrc/profile):\n\n");
-      process.stderr.write(import_chalk4.default.cyan(`      source ${path2}
-
+  }
+  if (!opts.noShell && aliasPath) {
+    process.stderr.write(import_chalk4.default.bold("  Optional \u2014 alias npm/pip to route through DG:\n"));
+    process.stderr.write(import_chalk4.default.dim(`    Wrote ${aliasPath}.
 `));
-      process.stderr.write(import_chalk4.default.dim("    Then reload your shell. `npm install` and `pip install` will\n"));
-      process.stderr.write(import_chalk4.default.dim("    be scanned automatically. To turn this off, remove the line.\n"));
-      process.stderr.write(import_chalk4.default.dim("    To turn off DG protection entirely, run `dg protect off`.\n\n"));
-    } catch (e) {
-      process.stderr.write(import_chalk4.default.yellow(`  Could not write alias snippet: ${e.message}
+    process.stderr.write("    Add this line to your shell rc (zshrc/bashrc/profile):\n\n");
+    process.stderr.write(import_chalk4.default.cyan(`      source ${aliasPath}
+
 `));
-    }
+    process.stderr.write(import_chalk4.default.dim("    Then reload your shell. `npm install` and `pip install` will\n"));
+    process.stderr.write(import_chalk4.default.dim("    be scanned automatically. To turn this off, remove the line.\n"));
+    process.stderr.write(import_chalk4.default.dim("    To turn off DG protection entirely, run `dg protect off`.\n\n"));
   }
   return 0;
 }
@@ -39767,7 +39893,7 @@ async function runProtectOff(cwd2, opts = {}) {
   void cwd2;
   if (opts.removeShell && aliasSnippetExists()) {
     try {
-      unlinkSync4(aliasFile());
+      unlinkSync5(aliasFile());
       process.stderr.write(import_chalk4.default.green("  \u2713 ") + `Removed ${aliasFile()}
 `);
       removed += 1;
@@ -40277,94 +40403,46 @@ function useInit(opts = {}) {
     try {
       const config = parseConfig([process.argv[0] ?? "node", "init", "--scan-all"], false);
       const projects = state.projects.length > 0 ? state.projects : [{ path: opts.cwd ?? process.cwd() }];
-      const npmPackages = [];
-      const pypiPackages = [];
-      const seenNpm = /* @__PURE__ */ new Set();
-      const seenPy = /* @__PURE__ */ new Set();
-      for (const proj of projects) {
-        const isFoundProject = proj.ecosystem !== void 0;
-        const eco = isFoundProject ? proj.ecosystem : null;
-        if (eco === "pypi") {
-          try {
-            for (const pkg of parsePythonDepFile(proj.path, proj.depFile)) {
-              const key = `${pkg.name}@${pkg.version}`;
-              if (!seenPy.has(key)) {
-                seenPy.add(key);
-                pypiPackages.push(pkg);
-              }
-            }
-          } catch {
-          }
-          continue;
-        }
+      const allOutcomes = [];
+      const perProject = /* @__PURE__ */ new Map();
+      for (let i = 0; i < projects.length; i++) {
+        const proj = projects[i];
+        let total = 0;
         try {
           const d = discoverChanges(proj.path, config);
-          for (const pkg of d.packages) {
-            const key = `${pkg.name}@${pkg.version}`;
-            if (!seenNpm.has(key)) {
-              seenNpm.add(key);
-              npmPackages.push(pkg);
-            }
-          }
-          for (const pkg of d.pythonPackages ?? []) {
-            const key = `${pkg.name}@${pkg.version}`;
-            if (!seenPy.has(key)) {
-              seenPy.add(key);
-              pypiPackages.push(pkg);
-            }
-          }
+          total = d.packages.length + (d.pythonPackages?.length ?? 0);
         } catch {
         }
+        perProject.set(i, { done: 0, total });
       }
-      const totalUnique = npmPackages.length + pypiPackages.length;
-      dispatch({ type: "scan_progress", progress: { done: 0, total: totalUnique, current: [] } });
-      const startMs = Date.now();
-      const responses = [];
-      let cumulativeDone = 0;
-      try {
-        if (npmPackages.length > 0) {
-          const npmResp = await callAnalyzeAPI(npmPackages, config, (done, _t, currentBatch) => {
-            dispatch({
-              type: "scan_progress",
-              progress: {
-                done: Math.min(cumulativeDone + done, totalUnique),
-                total: totalUnique,
-                current: currentBatch ?? []
-              }
-            });
-          });
-          responses.push(npmResp);
-          cumulativeDone += npmPackages.length;
-        }
-        if (pypiPackages.length > 0) {
-          const pyResp = await callPyPIAnalyzeAPI(pypiPackages, config, (done) => {
-            dispatch({
-              type: "scan_progress",
-              progress: {
-                done: Math.min(cumulativeDone + done, totalUnique),
-                total: totalUnique,
-                current: []
-              }
-            });
-          });
-          responses.push(pyResp);
-          cumulativeDone += pypiPackages.length;
+      const aggregate = (current) => {
+        let done = 0;
+        let total = 0;
+        for (const v of perProject.values()) {
+          done += v.done;
+          total += v.total;
         }
-      } catch (e) {
-        dispatch({
-          type: "scan_done",
-          outcome: {
-            status: "error",
-            result: null,
-            error: e instanceof Error ? e : new Error(String(e))
-          }
+        return { done, total, current };
+      };
+      dispatch({ type: "scan_progress", progress: aggregate([]) });
+      for (let i = 0; i < projects.length; i++) {
+        const proj = projects[i];
+        if (process.env.DG_DEBUG_WIZARD) process.stderr.write(`[wizard] scanning ${proj.path}
+`);
+        const seeded = perProject.get(i);
+        const outcome = await scanFn(proj.path, config, (p) => {
+          const total = seeded?.total ?? p.total;
+          perProject.set(i, { done: Math.min(p.done, total), total });
+          dispatch({ type: "scan_progress", progress: aggregate(p.current) });
         });
-        return;
+        if (process.env.DG_DEBUG_WIZARD) process.stderr.write(`[wizard] scan done ${proj.path} status=${outcome.status}
+`);
+        allOutcomes.push(outcome);
       }
       const allPackages = [];
       const seen = /* @__PURE__ */ new Set();
-      for (const r of responses) {
-        for (const pkg of r.packages) {
+      for (const outcome of allOutcomes) {
+        for (const pkg of outcome.result?.result.packages ?? []) {
           const key = `${pkg.name}@${pkg.version}`;
           if (seen.has(key)) continue;
           seen.add(key);
@@ -40372,22 +40450,42 @@ function useInit(opts = {}) {
         }
       }
       const totalScanned = seen.size;
-      const totalDuration = Date.now() - startMs;
+      const totalDuration = allOutcomes.reduce(
+        (sum, o) => sum + (o.result?.durationMs ?? 0),
+        0
+      );
       const maxScore = allPackages.length > 0 ? Math.max(0, ...allPackages.map((p) => p.score)) : 0;
-      const action = maxScore >= 70 ? "block" : maxScore >= 60 ? "warn" : "pass";
+      const anyBlock = allPackages.some(
+        (p) => p.action === "block"
+      );
+      const anyWarn = allPackages.some(
+        (p) => p.action === "warn"
+      );
+      const anyIncomplete = allPackages.some(
+        (p) => p.action === "analysis_incomplete"
+      );
+      const action = anyBlock ? "block" : anyWarn ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
       if (totalScanned === 0) {
-        dispatch({
-          type: "scan_done",
-          outcome: {
-            status: totalUnique === 0 ? "no_packages" : "api_returned_empty",
-            result: {
-              result: { score: 0, action: "pass", packages: [], safeVersions: {}, durationMs: totalDuration },
-              durationMs: totalDuration,
-              scannedCount: 0,
-              skippedCount: 0
+        const errOutcome = allOutcomes.find((o) => o.status === "error");
+        const emptyApiOutcome = allOutcomes.find((o) => o.status === "api_returned_empty");
+        const trialOutcome = allOutcomes.find((o) => o.status === "trial_exhausted");
+        const meaningful = errOutcome ?? emptyApiOutcome ?? trialOutcome;
+        if (meaningful) {
+          dispatch({ type: "scan_done", outcome: meaningful });
+        } else {
+          dispatch({
+            type: "scan_done",
+            outcome: {
+              status: "no_packages",
+              result: {
+                result: { score: 0, action: "pass", packages: [], safeVersions: {}, durationMs: totalDuration },
+                durationMs: totalDuration,
+                scannedCount: 0,
+                skippedCount: 0
+              }
             }
-          }
-        });
+          });
+        }
       } else {
         dispatch({
           type: "scan_done",
@@ -40455,7 +40553,6 @@ var init_useInit = __esm({
     init_hook();
     init_scan();
     init_lockfile();
-    init_client();
     init_config();
     init_protect();
     PROJECT_MARKERS = [
@@ -40586,6 +40683,38 @@ var init_useLogin = __esm({
   }
 });
 
+// src/ui/hooks/useTerminalSize.ts
+function useTerminalSize() {
+  const { stdout } = use_stdout_default();
+  const [size, setSize] = (0, import_react24.useState)({
+    rows: stdout?.rows ?? process.stdout.rows ?? 24,
+    cols: stdout?.columns ?? process.stdout.columns ?? 80
+  });
+  (0, import_react24.useEffect)(() => {
+    const handle = () => {
+      setSize({
+        rows: process.stdout.rows ?? 24,
+        cols: process.stdout.columns ?? 80
+      });
+    };
+    process.stdout.setMaxListeners(process.stdout.getMaxListeners() + 1);
+    process.stdout.on("resize", handle);
+    return () => {
+      process.stdout.off("resize", handle);
+      process.stdout.setMaxListeners(Math.max(0, process.stdout.getMaxListeners() - 1));
+    };
+  }, []);
+  return size;
+}
+var import_react24;
+var init_useTerminalSize = __esm({
+  async "src/ui/hooks/useTerminalSize.ts"() {
+    "use strict";
+    import_react24 = __toESM(require_react());
+    await init_build2();
+  }
+});
+
 // src/ui/ink-controls.ts
 var ink_controls_exports = {};
 __export(ink_controls_exports, {
@@ -40593,6 +40722,7 @@ __export(ink_controls_exports, {
   clearInkOutput: () => clearInkOutput,
   forceFullRedraw: () => forceFullRedraw,
   initInkInstances: () => initInkInstances,
+  patchInkLogForAbsolutePositioning: () => patchInkLogForAbsolutePositioning,
   resetInkClear: () => resetInkClear,
   setInkClear: () => setInkClear,
   setInkInstance: () => setInkInstance
@@ -40648,6 +40778,25 @@ function forceFullRedraw() {
   if (wrapper) wrapper.clear();
   resetRealInkLastOutput();
 }
+function makeAbsoluteLog(stdout) {
+  const log = ((str) => {
+    stdout.write("\x1B[H\x1B[J" + str + "\n");
+  });
+  log.clear = () => {
+    stdout.write("\x1B[H\x1B[J");
+  };
+  log.done = () => {
+  };
+  return log;
+}
+function patchInkLogForAbsolutePositioning() {
+  if (!realInstances) return;
+  const real = realInstances.get(process.stdout);
+  if (!real) return;
+  const newLog = makeAbsoluteLog(process.stdout);
+  real.log = newLog;
+  real.throttledLog = newLog;
+}
 function resetInkClear() {
   wrapper = null;
 }
@@ -40663,41 +40812,6 @@ var init_ink_controls = __esm({
   }
 });
 
-// src/ui/hooks/useTerminalSize.ts
-function useTerminalSize() {
-  const { stdout } = use_stdout_default();
-  const [size, setSize] = (0, import_react24.useState)({
-    rows: stdout?.rows ?? process.stdout.rows ?? 24,
-    cols: stdout?.columns ?? process.stdout.columns ?? 80
-  });
-  (0, import_react24.useEffect)(() => {
-    const handle = () => {
-      clearScreen();
-      forceFullRedraw();
-      const rows = process.stdout.rows ?? 24;
-      const cols = process.stdout.columns ?? 80;
-      setSize({ rows, cols });
-    };
-    process.stdout.setMaxListeners(process.stdout.getMaxListeners() + 1);
-    process.stdout.on("resize", handle);
-    return () => {
-      process.stdout.off("resize", handle);
-      process.stdout.setMaxListeners(Math.max(0, process.stdout.getMaxListeners() - 1));
-    };
-  }, []);
-  return size;
-}
-var import_react24;
-var init_useTerminalSize = __esm({
-  async "src/ui/hooks/useTerminalSize.ts"() {
-    "use strict";
-    import_react24 = __toESM(require_react());
-    await init_build2();
-    init_terminal_state();
-    init_ink_controls();
-  }
-});
-
 // node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS({
   "node_modules/cli-spinners/spinners.json"(exports, module) {
@@ -45236,6 +45350,10 @@ __export(terms_gate_exports, {
   gateOrExit: () => gateOrExit
 });
 import * as readline from "node:readline";
+function previewInput(raw) {
+  const trimmed = raw.length > 80 ? raw.slice(0, 80) + "\u2026" : raw;
+  return JSON.stringify(trimmed);
+}
 async function ensureTermsAccepted() {
   if (hasAcceptedTerms()) return { accepted: true };
   if (process.env.DG_ACCEPT_TERMS === "1") {
@@ -45251,6 +45369,7 @@ async function ensureTermsAccepted() {
       import_chalk6.default.dim(
         `
   Accepted Terms + Privacy via DG_ACCEPT_TERMS=1.
+  Saved to ${dgConfigPath()}.
   ${TERMS_URL} \xB7 ${PRIVACY_URL}
 
 `
@@ -45262,13 +45381,8 @@ async function ensureTermsAccepted() {
     process.stderr.write(
       "\n" + import_chalk6.default.bold("  Terms of Service + Privacy Policy\n\n") + "  Dependency Guardian sends your lockfile package names + versions\n  to api.westbayberry.com to scan them. To use this CLI, you must\n  accept:\n\n    \xB7 " + import_chalk6.default.cyan(TERMS_URL) + "\n    \xB7 " + import_chalk6.default.cyan(PRIVACY_URL) + "\n\n  Type " + import_chalk6.default.bold("agree") + " to accept, anything else to cancel: "
     );
-    const answer = await new Promise((resolve2) => {
-      const rl = readline.createInterface({ input: process.stdin });
-      rl.once("line", (line) => {
-        rl.close();
-        resolve2(line.trim().toLowerCase());
-      });
-    });
+    const raw = await readOneLine();
+    const answer = raw.trim().toLowerCase();
     if (answer === "agree") {
       try {
         recordTermsAccepted();
@@ -45278,10 +45392,17 @@ async function ensureTermsAccepted() {
           reason: `Could not record terms acceptance: ${e.message}`
         };
       }
-      process.stderr.write(import_chalk6.default.green("\n  Accepted. Continuing.\n\n"));
+      process.stderr.write(
+        import_chalk6.default.green("\n  Accepted. ") + import_chalk6.default.dim(`Saved to ${dgConfigPath()}.
+
+`)
+      );
       return { accepted: true };
     }
-    return { accepted: false, reason: "Declined at prompt." };
+    return {
+      accepted: false,
+      reason: `Declined at prompt (received ${previewInput(raw)}; the prompt accepts only the exact word "agree").`
+    };
   }
   return {
     accepted: false,
@@ -45292,6 +45413,21 @@ async function ensureTermsAccepted() {
     \xB7 Privacy: ${PRIVACY_URL}`
   };
 }
+async function readOneLine() {
+  const wasPaused = process.stdin.isPaused();
+  if (wasPaused) process.stdin.resume();
+  try {
+    return await new Promise((resolve2) => {
+      const rl = readline.createInterface({ input: process.stdin, terminal: false });
+      rl.once("line", (line) => {
+        rl.close();
+        resolve2(line);
+      });
+    });
+  } finally {
+    if (wasPaused) process.stdin.pause();
+  }
+}
 async function gateOrExit() {
   const result = await ensureTermsAccepted();
   if (!result.accepted) {
@@ -45305,6 +45441,7 @@ var init_terms_gate = __esm({
     "use strict";
     import_chalk6 = __toESM(require_source());
     init_auth();
+    init_paths();
     TERMS_URL = "https://westbayberry.com/terms";
     PRIVACY_URL = "https://westbayberry.com/privacy";
   }
@@ -45384,7 +45521,6 @@ var init_LoginApp = __esm({
               "Logged in as ",
               state.email
             ] }),
-            /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Text, { dimColor: true, children: "Credentials saved." }),
             /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Text, { children: " " }),
             /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)(Text, { children: [
               "Run ",
@@ -45700,8 +45836,8 @@ function compareVer(a, b) {
   }
   return 0;
 }
-async function pipSupportsDryRunReport() {
-  const v = await pipVersion();
+async function pipSupportsDryRunReport(knownVersion) {
+  const v = knownVersion === void 0 ? await pipVersion() : knownVersion;
   if (!v) return { ok: false, version: null, reason: "pip not found" };
   if (compareVer(v, "23.0") < 0) {
     return { ok: false, version: v, reason: `pip ${v} < 23.0; needs upgrade for transitive scan` };
@@ -46023,7 +46159,7 @@ function reducer3(state, action) {
     case "MOVE_BROWSER": {
       let viewport = state.browserViewport;
       if (action.cursor < viewport) viewport = action.cursor;
-      if (action.cursor >= viewport + VISIBLE_ROWS) viewport = action.cursor - VISIBLE_ROWS + 1;
+      if (action.cursor >= viewport + action.visibleRows) viewport = action.cursor - action.visibleRows + 1;
       return { ...state, browserCursor: action.cursor, browserViewport: viewport };
     }
     case "FOCUS":
@@ -46045,6 +46181,7 @@ var init_FileSavePrompt = __esm({
     import_react30 = __toESM(require_react());
     await init_build2();
     import_chalk7 = __toESM(require_source());
+    await init_useTerminalSize();
     import_jsx_runtime8 = __toESM(require_jsx_runtime());
     VISIBLE_ROWS = 15;
     FileSavePrompt = ({
@@ -46076,9 +46213,11 @@ var init_FileSavePrompt = __esm({
         const q = state.filterText.toLowerCase();
         return dirs.filter((e) => e.name.toLowerCase().includes(q));
       }, [state.entries, state.filterText]);
+      const { rows: termRows } = useTerminalSize();
+      const visibleRows = Math.max(5, Math.min(VISIBLE_ROWS, termRows - 10));
       const visibleEntries = filteredEntries.slice(
         state.browserViewport,
-        state.browserViewport + VISIBLE_ROWS
+        state.browserViewport + visibleRows
       );
       use_input_default((input, key) => {
         if (key.escape) {
@@ -46131,7 +46270,7 @@ var init_FileSavePrompt = __esm({
         }
         if (key.upArrow) {
           if (state.browserCursor > 0) {
-            dispatch({ type: "MOVE_BROWSER", cursor: state.browserCursor - 1 });
+            dispatch({ type: "MOVE_BROWSER", cursor: state.browserCursor - 1, visibleRows });
           } else {
             dispatch({ type: "FOCUS", target: "filename" });
           }
@@ -46145,7 +46284,7 @@ var init_FileSavePrompt = __esm({
           return;
         }
         if (key.downArrow) {
-          dispatch({ type: "MOVE_BROWSER", cursor: clamp(state.browserCursor + 1, 0, filteredEntries.length - 1) });
+          dispatch({ type: "MOVE_BROWSER", cursor: clamp(state.browserCursor + 1, 0, filteredEntries.length - 1), visibleRows });
           return;
         }
         if (key.return) {
@@ -46167,11 +46306,7 @@ var init_FileSavePrompt = __esm({
       const filenameDisplay = state.filename.slice(0, state.cursorPos) + (state.focus === "filename" ? import_chalk7.default.inverse(state.filename[state.cursorPos] || " ") : "") + state.filename.slice(state.cursorPos + 1);
       const shortDir = state.directory.replace(process.env.HOME || "", "~");
       return /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 1, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { children: [
-          import_chalk7.default.cyan("\u25C6"),
-          " ",
-          import_chalk7.default.bold("Save Scan Results")
-        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { children: import_chalk7.default.bold("Save Scan Results") }),
         /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { children: [
           "Score: ",
           import_chalk7.default.bold(String(score)),
@@ -46204,9 +46339,9 @@ var init_FileSavePrompt = __esm({
             name
           ] }, `${entry.name}-${i}`);
         }),
-        filteredEntries.length > VISIBLE_ROWS && /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { dimColor: true, children: [
+        filteredEntries.length > visibleRows && /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { dimColor: true, children: [
           "  ",
-          import_chalk7.default.dim(`\u2191\u2193 ${filteredEntries.length - VISIBLE_ROWS} more`)
+          import_chalk7.default.dim(`\u2191\u2193 ${filteredEntries.length - visibleRows} more`)
         ] }),
         /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Text, { children: "" }),
         state.filterText && /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(Text, { dimColor: true, children: [
@@ -46372,13 +46507,13 @@ __export(static_output_exports, {
   runStaticNpm: () => runStaticNpm,
   runStaticPip: () => runStaticPip
 });
-import { writeFileSync as writeFileSync9, readFileSync as readFileSync11, existsSync as existsSync15, mkdirSync as mkdirSync8, lstatSync as lstatSync4 } from "node:fs";
+import { writeFileSync as writeFileSync9, readFileSync as readFileSync11, existsSync as existsSync15, mkdirSync as mkdirSync8, lstatSync as lstatSync5 } from "node:fs";
 import { resolve as resolvePath2, dirname as dirname11 } from "node:path";
 function loadPackageLockJson(cwd2 = process.cwd()) {
   const path2 = resolvePath2(cwd2, "package-lock.json");
   if (!existsSync15(path2)) return null;
   try {
-    const st = lstatSync4(path2);
+    const st = lstatSync5(path2);
     if (!st.isFile()) return null;
     if (st.size > MAX_PACKAGE_LOCK_BYTES) return null;
     return JSON.parse(readFileSync11(path2, "utf8"));
@@ -46464,7 +46599,7 @@ function printTrialBanner(result, config) {
     const now = Date.now();
     if (now - lastMs < NUDGE_INTERVAL_MS) return;
     mkdirSync8(dirname11(stampPath), { recursive: true, mode: 448 });
-    writeFileSync9(stampPath, String(now) + "\n");
+    writeFileSync9(stampPath, String(now) + "\n", { mode: 384 });
   } catch {
     return;
   }
@@ -46532,11 +46667,22 @@ function groupPackages(packages) {
   }
   return [...map.values()].map((pkgs) => ({ packages: pkgs, key: pkgs[0].name })).sort((a, b) => b.packages[0].score - a.packages[0].score);
 }
-function actionBadge(score) {
-  if (score >= 70) return { label: "Block", color: import_chalk8.default.red };
-  if (score >= 60) return { label: "Warn", color: import_chalk8.default.yellow };
+function actionBadge(pkg) {
+  const a = pkg.action;
+  if (a === "block") return { label: "Block", color: import_chalk8.default.red };
+  if (a === "warn") return { label: "Warn", color: import_chalk8.default.yellow };
+  if (a === "pass") return { label: "Pass", color: import_chalk8.default.green };
+  if (a === "analysis_incomplete") return { label: "Unknown", color: import_chalk8.default.cyan };
+  if (pkg.score >= 70) return { label: "Block", color: import_chalk8.default.red };
+  if (pkg.score >= 60) return { label: "Warn", color: import_chalk8.default.yellow };
   return { label: "Pass", color: import_chalk8.default.green };
 }
+function isBlocked(p) {
+  return p.action === "block" || p.action === void 0 && p.score >= 70;
+}
+function isWarned(p) {
+  return p.action === "warn" || p.action === void 0 && p.score >= 60 && p.score < 70;
+}
 function renderResultClean(result, _config) {
   const lines = [];
   const total = result.packages.length;
@@ -46546,8 +46692,8 @@ function renderResultClean(result, _config) {
     lines.push("");
     return lines.join("\n");
   }
-  const blocked = result.packages.filter((p) => p.score >= 70);
-  const warned = result.packages.filter((p) => p.score >= 60 && p.score < 70);
+  const blocked = result.packages.filter(isBlocked);
+  const warned = result.packages.filter(isWarned);
   if (result.action === "pass" && blocked.length === 0 && warned.length === 0) {
     lines.push("");
     lines.push(`  ${import_chalk8.default.green("\u2713")} ${import_chalk8.default.bold("Dependency Guardian")} checked ${total} package${total !== 1 ? "s" : ""}. ${import_chalk8.default.green("No risky behavior found.")}`);
@@ -46597,8 +46743,8 @@ function renderResultDetails(result, _config) {
     )}${colorAction(actionStr)}`
   );
   lines.push("");
-  const blocked = result.packages.filter((p) => p.score >= 70);
-  const warned = result.packages.filter((p) => p.score >= 60 && p.score < 70);
+  const blocked = result.packages.filter(isBlocked);
+  const warned = result.packages.filter(isWarned);
   const passWithScore = result.packages.filter((p) => p.score > 0 && p.score < 60);
   const clean = result.packages.filter((p) => p.score === 0);
   const total = result.packages.length;
@@ -46640,7 +46786,7 @@ function renderResultDetails(result, _config) {
     lines.push(`  ${import_chalk8.default.dim("\u2500".repeat(60))}`);
     for (const group of groups) {
       const rep = group.packages[0];
-      const { label, color } = actionBadge(rep.score);
+      const { label, color } = actionBadge(rep);
       const names = group.packages.length === 1 ? rep.name : group.packages.length <= 3 ? group.packages.map((p) => p.name).join(", ") : `${group.packages[0].name} + ${group.packages.length - 1} similar`;
       const lcInfo = rep.license;
       const lcStr = lcInfo ? truncate(lcInfo.spdx ?? lcInfo.raw ?? "", 14) : "";
@@ -46691,7 +46837,9 @@ async function runStatic(config) {
   dbg(`api=${config.apiUrl}`);
   process.stderr.write(import_chalk8.default.dim("  Discovering package changes...\n"));
   const { discoverProjectsAsync: discoverProjectsAsync2 } = await Promise.resolve().then(() => (init_walker(), walker_exports));
+  const tDiscStart = Date.now();
   const subProjects = await discoverProjectsAsync2(process.cwd());
+  if (process.env.DG_PERF) console.error(`[CLI-PERF] walker: ${Date.now() - tDiscStart}ms \u2014 ${subProjects.length} projects`);
   let discovery;
   if (subProjects.length > 1) {
     const totalPkgs = subProjects.reduce((s, p) => s + p.packageCount, 0);
@@ -46709,6 +46857,7 @@ async function runStatic(config) {
     const allNpmPkgs = [];
     const allPyPkgs = [];
     const seen = /* @__PURE__ */ new Set();
+    const tParseStart = Date.now();
     for (const proj of subProjects) {
       try {
         const projDisc = discoverChanges(proj.path, config);
@@ -46733,6 +46882,7 @@ async function runStatic(config) {
       process.stderr.write(import_chalk8.default.dim("  No package changes detected across projects.\n"));
       process.exit(0);
     }
+    if (process.env.DG_PERF) console.error(`[CLI-PERF] parse + dedupe: ${Date.now() - tParseStart}ms \u2014 ${allNpmPkgs.length} npm + ${allPyPkgs.length} pypi`);
     discovery = {
       packages: allNpmPkgs,
       pythonPackages: allPyPkgs,
@@ -47392,7 +47542,8 @@ async function runStaticLogin() {
         process.stderr.write(
           import_chalk8.default.green(`
   Logged in as ${result.email ?? "unknown"}
-`) + import_chalk8.default.dim("  Credentials saved.\n\n")
+
+`)
         );
         return;
       }
@@ -47498,11 +47649,11 @@ async function handleStatusCommand(cliVersion2) {
   let hookLine = "no pre-commit hook \u2014 `dg hook install` to gate commits";
   let hookOk = false;
   try {
-    const { existsSync: existsSync20, readFileSync: readFileSync13 } = await import("node:fs");
+    const { existsSync: existsSync19, readFileSync: readFileSync13 } = await import("node:fs");
     const { join: join13 } = await import("node:path");
     const candidates = [join13(cwd2, ".husky", "pre-commit"), join13(cwd2, ".git", "hooks", "pre-commit")];
     for (const path2 of candidates) {
-      if (existsSync20(path2)) {
+      if (existsSync19(path2)) {
         const content = readFileSync13(path2, "utf-8");
         if (content.includes("dependency-guardian")) {
           hookLine = `installed in ${path2}`;
@@ -47532,17 +47683,19 @@ async function handleStatusCommand(cliVersion2) {
   } catch {
   }
   try {
-    const { execFileSync: execFileSync5 } = await import("node:child_process");
-    const npmV = (() => {
-      try {
-        return execFileSync5("npm", ["--version"], { encoding: "utf-8", timeout: 5e3 }).trim();
-      } catch {
-        return null;
-      }
-    })();
+    const { execFileSync: execFileSync2 } = await import("node:child_process");
     const { pipVersion: pipVersion2, pipSupportsDryRunReport: pipSupportsDryRunReport2 } = await Promise.resolve().then(() => (init_pip_wrapper(), pip_wrapper_exports));
-    const pipV = await pipVersion2();
-    const pipProbe = pipV ? await pipSupportsDryRunReport2() : null;
+    const [npmV, pipV] = await Promise.all([
+      Promise.resolve().then(() => {
+        try {
+          return execFileSync2("npm", ["--version"], { encoding: "utf-8", timeout: 5e3 }).trim();
+        } catch {
+          return null;
+        }
+      }),
+      pipVersion2()
+    ]);
+    const pipProbe = pipV ? await pipSupportsDryRunReport2(pipV) : null;
     const npmLine = npmV ? `npm ${npmV} (transitive scan supported)` : "npm not found on PATH";
     const npmGlyph = npmV ? chalk18.green("\u2713") : chalk18.yellow("\xB7");
     process.stderr.write(`  ${npmGlyph} ${chalk18.bold("npm")}      ` + chalk18.dim(npmLine + "\n"));
@@ -47588,7 +47741,10 @@ function licenseSummary(results) {
   return [...byRisk.entries()].map(([risk, count]) => ({ risk, count })).sort(riskOrder);
 }
 function csvCell(v) {
-  const s = v === null || v === void 0 ? "" : String(v);
+  let s = v === null || v === void 0 ? "" : String(v);
+  if (s.length > 0 && CSV_FORMULA_PREFIXES.has(s[0])) {
+    s = "'" + s;
+  }
   if (/[",\n]/.test(s)) return `"${s.replace(/"/g, '""')}"`;
   return s;
 }
@@ -47654,12 +47810,13 @@ function formatLicensesText(results) {
   }
   return lines.join("\n");
 }
-var import_chalk9, SINK_RANKS;
+var import_chalk9, SINK_RANKS, CSV_FORMULA_PREFIXES;
 var init_license_export = __esm({
   "src/formatters/license-export.ts"() {
     "use strict";
     import_chalk9 = __toESM(require_source());
     SINK_RANKS = { "no-license": 2, unknown: 1 };
+    CSV_FORMULA_PREFIXES = /* @__PURE__ */ new Set(["=", "+", "-", "@", "	", "\r"]);
   }
 });
 
@@ -47679,7 +47836,7 @@ function renderLicenseSummary(entries, maxCols) {
     if (ra !== rb) return ra - rb;
     return b.count - a.count;
   });
-  const sep2 = import_chalk10.default.dim(" \xB7 ");
+  const sep3 = import_chalk10.default.dim(" \xB7 ");
   const segments = [];
   let used = "Licenses  ".length;
   let dropped = 0;
@@ -47694,8 +47851,8 @@ function renderLicenseSummary(entries, maxCols) {
     segments.push(colorForRisk(e.risk)(label));
     used += segLen;
   }
-  let line = `${import_chalk10.default.dim("Licenses")}  ${segments.join(sep2)}`;
-  if (dropped > 0) line += `${sep2}${import_chalk10.default.dim(`+${dropped} more`)}`;
+  let line = `${import_chalk10.default.dim("Licenses")}  ${segments.join(sep3)}`;
+  if (dropped > 0) line += `${sep3}${import_chalk10.default.dim(`+${dropped} more`)}`;
   return line;
 }
 function scoreColor(score, action) {
@@ -47755,6 +47912,7 @@ var init_ScoreHeader = __esm({
     "use strict";
     await init_build2();
     import_chalk10 = __toESM(require_source());
+    await init_useTerminalSize();
     import_jsx_runtime9 = __toESM(require_jsx_runtime());
     LICENSE_RISK_LABELS = {
       permissive: "permissive",
@@ -47817,7 +47975,7 @@ var init_ScoreHeader = __esm({
       licenseSummary: licenseSummary2
     }) => {
       const logo = renderLogo(action);
-      const cols = process.stdout.columns ?? 80;
+      const { cols } = useTerminalSize();
       const showLogo = cols >= 60;
       const licenseLine2 = licenseSummary2 && licenseSummary2.length > 0 ? renderLicenseSummary(licenseSummary2, showLogo ? cols - 16 : cols) : "";
       return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
@@ -47832,8 +47990,7 @@ var init_ScoreHeader = __esm({
           children: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { flexDirection: "row", children: [
             /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Box_default, { flexDirection: "column", flexGrow: 1, children: [
               /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Text, { bold: true, children: [
-                import_chalk10.default.cyan("\u25C6"),
-                " Dependency Guardian  ",
+                "Dependency Guardian  ",
                 userStatus ? import_chalk10.default.dim(userStatus) : ""
               ] }),
               /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(Text, { children: " " }),
@@ -47988,16 +48145,19 @@ function groupRowHeight(group, level, safeVersions) {
   if (level === "summary") return 1 + findingsSummaryHeight(group);
   return 1 + findingsDetailHeight(group, safeVersions);
 }
+function nameVer(p) {
+  return p.version ? `${p.name}@${p.version}` : p.name;
+}
 function groupNames(group) {
-  if (group.packages.length === 1) return group.packages[0].name;
+  if (group.packages.length === 1) return nameVer(group.packages[0]);
   if (group.packages.length <= 3)
-    return group.packages.map((p) => p.name).join(", ");
-  return `${group.packages[0].name} + ${group.packages.length - 1} similar`;
+    return group.packages.map(nameVer).join(", ");
+  return `${nameVer(group.packages[0])} + ${group.packages.length - 1} similar`;
 }
 function affectsLine(group) {
-  const names = group.packages.map((p) => p.name);
-  if (names.length <= 5) return names.join(", ");
-  return names.slice(0, 5).join(", ") + ` + ${names.length - 5} more`;
+  const labels = group.packages.map(nameVer);
+  if (labels.length <= 5) return labels.join(", ");
+  return labels.slice(0, 5).join(", ") + ` + ${labels.length - 5} more`;
 }
 function buildDetailLines(group, safeVersion, maxWidth) {
   const rep = group.packages[0];
@@ -48789,27 +48949,28 @@ var init_InteractiveResultsView = __esm({
       const clampedCursor = groups.length > 0 ? Math.min(view.cursor, groups.length - 1) : 0;
       if (exportMenu) {
         const SCOPES_RENDER = [
-          { value: "all", label: "All", hint: "everything: summary + every package + every license" },
-          { value: "summary", label: "Summary", hint: "score + counts only \u2014 one short object" },
-          { value: "packages", label: "Packages", hint: "flat list of name, version, score, license" },
-          { value: "licenses", label: "Licenses", hint: "license groups with packages-per-license" },
-          { value: "findings", label: "Findings (warn+block)", hint: "only warn/block packages with finding metadata" }
+          { value: "all", label: "All" },
+          { value: "summary", label: "Summary" },
+          { value: "packages", label: "Packages" },
+          { value: "licenses", label: "Licenses" },
+          { value: "findings", label: "Findings (warn+block)" }
         ];
         if (licenseDetailIdxRef.current !== null) {
           const focus = licenseGroups[licenseDetailIdxRef.current];
           SCOPES_RENDER.push({
             value: "current-license",
-            label: `Current license (${focus?.spdx ?? "\u2014"})`,
-            hint: `only the ${focus?.count ?? 0} packages under this license`
+            label: `Current license (${focus?.spdx ?? "\u2014"})`
           });
         }
         const FORMATS_RENDER = [
-          { value: "json", label: "JSON", hint: "structured, exact data \u2014 best for tooling" },
-          { value: "csv", label: "CSV", hint: "spreadsheet-friendly tabular rows" },
-          { value: "md", label: "Markdown", hint: "headings + tables \u2014 drop into a PR or doc" },
-          { value: "txt", label: "Plain text", hint: "human-readable copy-paste" }
+          { value: "json", label: "JSON" },
+          { value: "csv", label: "CSV" },
+          { value: "md", label: "Markdown" },
+          { value: "txt", label: "Plain text" }
         ];
-        const renderRow = (title, rows, current, isActive) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", marginBottom: 1, children: [
+        const stackedLayout = termCols < 80;
+        const colWidth = stackedLayout ? void 0 : Math.max(24, Math.floor((termCols - 8) / 2));
+        const renderColumn = (title, rows, current, isActive) => /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", width: colWidth, flexShrink: 1, marginBottom: stackedLayout ? 1 : 0, children: [
           /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
             isActive ? import_chalk11.default.cyan("\u258C ") : "  ",
             isActive ? import_chalk11.default.bold(title) : import_chalk11.default.dim(title)
@@ -48819,12 +48980,11 @@ var init_InteractiveResultsView = __esm({
             const bullet = selected ? isActive ? import_chalk11.default.cyan("\u25CF") : import_chalk11.default.green("\u25CF") : import_chalk11.default.dim("\u25CB");
             const text = selected ? import_chalk11.default.bold(r.label) : r.label;
             return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { children: [
-              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: 5, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: 5, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
                 "   ",
                 bullet
               ] }) }),
-              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: 26, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: text }) }),
-              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: r.hint })
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { flexShrink: 1, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { wrap: "truncate-end", children: text }) })
             ] }, r.value);
           })
         ] });
@@ -48842,15 +49002,13 @@ var init_InteractiveResultsView = __esm({
               licenseSummary: licenseSummary2
             }
           ),
-          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, width: "100%", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { bold: true, children: [
-              import_chalk11.default.cyan("\u25C6"),
-              " Export ",
-              import_chalk11.default.dim("(pick what to export and which format)")
-            ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: "Export" }),
             /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
-            renderRow("What", SCOPES_RENDER, exportMenu.scope, exportMenu.activeRow === "scope"),
-            renderRow("Format", FORMATS_RENDER, exportMenu.format, exportMenu.activeRow === "format")
+            /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: stackedLayout ? "column" : "row", children: [
+              renderColumn("What", SCOPES_RENDER, exportMenu.scope, exportMenu.activeRow === "scope"),
+              renderColumn("Format", FORMATS_RENDER, exportMenu.format, exportMenu.activeRow === "format")
+            ] })
           ] }),
           /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: import_chalk11.default.dim("\u2500".repeat(Math.max(20, termCols - 4))) }),
           /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
@@ -48899,10 +49057,7 @@ var init_InteractiveResultsView = __esm({
               paddingRight: 2,
               width: "100%",
               children: [
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { bold: true, children: [
-                  import_chalk11.default.cyan("\u25C6"),
-                  " Keyboard Shortcuts"
-                ] }),
+                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: "Keyboard Shortcuts" }),
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: " Navigation" }),
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { children: [
@@ -49042,11 +49197,7 @@ var init_InteractiveResultsView = __esm({
             ),
             /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, width: "100%", children: [
               /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { children: [
-                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { bold: true, children: [
-                  import_chalk11.default.cyan("\u25C6"),
-                  " ",
-                  color(g.spdx)
-                ] }),
+                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { bold: true, children: color(g.spdx) }),
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { dimColor: true, children: [
                   "  \xB7  ",
                   g.risk,
@@ -49157,17 +49308,17 @@ var init_InteractiveResultsView = __esm({
               width: "100%",
               children: [
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { bold: true, children: [
-                  import_chalk11.default.cyan("\u25C6"),
-                  " Licenses ",
+                  "Licenses",
+                  " ",
                   import_chalk11.default.dim(`(${licenseGroups.length} unique across ${totalCount} packages)`)
                 ] }),
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: "" }),
                 /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Box_default, { children: [
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: 2, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: " " }) }),
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: spdxCol, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "SPDX" }) }),
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: riskCol, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "Risk" }) }),
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: countCol, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "Count" }) }),
-                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: barCol, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "Share" }) })
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: 2, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { children: " " }) }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: spdxCol, flexShrink: 1, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "SPDX" }) }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: riskCol, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "Risk" }) }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: countCol, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "Count" }) }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box_default, { width: barCol, flexShrink: 1, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: "Share" }) })
                 ] }),
                 hiddenAbove > 0 && /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { dimColor: true, children: `  \u2191 ${hiddenAbove} more above` }),
                 licenseGroups.slice(top, bottom).map((g, i) => {
@@ -50239,110 +50390,273 @@ var init_publish_check = __esm({
   }
 });
 
-// src/commands/cleanup.ts
-var cleanup_exports = {};
-__export(cleanup_exports, {
-  handleCleanupCommand: () => handleCleanupCommand,
-  runCleanup: () => runCleanup
+// src/commands/update.ts
+var update_exports = {};
+__export(update_exports, {
+  detectInstaller: () => detectInstaller,
+  handleUpdateCommand: () => handleUpdateCommand,
+  installPrefix: () => installPrefix,
+  parseUpdateArgs: () => parseUpdateArgs,
+  runUpdate: () => runUpdate
 });
-import { existsSync as existsSync17, unlinkSync as unlinkSync5 } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { accessSync, constants as constants2, realpathSync, unlinkSync as unlinkSync6 } from "node:fs";
+import { sep as sep2 } from "node:path";
+function parseUpdateArgs(args) {
+  return {
+    assumeYes: args.includes("--yes") || args.includes("-y"),
+    printOnly: args.includes("--print") || args.includes("--dry-run")
+  };
+}
+function detectInstaller(binPath) {
+  let resolved;
+  try {
+    resolved = realpathSync(binPath);
+  } catch {
+    return null;
+  }
+  const norm = resolved.split(sep2).join("/");
+  if (norm.includes("/pnpm/") || norm.includes("/.pnpm/") || process.env.PNPM_HOME && resolved.startsWith(process.env.PNPM_HOME)) {
+    return {
+      kind: "pnpm",
+      binary: "pnpm",
+      args: (pkg) => ["add", "-g", pkg]
+    };
+  }
+  if (norm.includes("/.bun/") || norm.includes("/bun/install/") || process.env.BUN_INSTALL && resolved.startsWith(process.env.BUN_INSTALL)) {
+    return {
+      kind: "bun",
+      binary: "bun",
+      args: (pkg) => ["add", "-g", pkg]
+    };
+  }
+  if (norm.includes("/.yarn/") || norm.includes("/yarn/global/")) {
+    return {
+      kind: "yarn",
+      binary: "yarn",
+      args: (pkg) => ["global", "add", pkg]
+    };
+  }
+  if (norm.includes("/node_modules/")) {
+    return {
+      kind: "npm",
+      binary: "npm",
+      args: (pkg) => ["install", "-g", pkg]
+    };
+  }
+  return null;
+}
+function installPrefix(resolvedBinPath) {
+  const norm = resolvedBinPath.split(sep2).join("/");
+  const idx = norm.indexOf("/node_modules/");
+  if (idx < 0) return null;
+  return resolvedBinPath.slice(0, idx);
+}
+function canWrite(path2) {
+  try {
+    accessSync(path2, constants2.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function fetchLatest() {
+  try {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS);
+    const res = await fetch(
+      `https://registry.npmjs.org/${encodeURIComponent(PKG_NAME2)}/latest`,
+      { headers: { Accept: "application/json" }, signal: ctl.signal }
+    );
+    clearTimeout(timer);
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data.version === "string" ? data.version : null;
+  } catch {
+    return null;
+  }
+}
 async function confirm(prompt) {
+  if (!process.stdin.isTTY) return false;
   process.stderr.write(prompt);
   return new Promise((resolve2) => {
     let buf = "";
     const onData = (chunk) => {
       buf += chunk.toString("utf8");
       const idx = buf.indexOf("\n");
-      if (idx >= 0) {
-        process.stdin.off("data", onData);
-        const answer = buf.slice(0, idx).trim().toLowerCase();
-        resolve2(answer === "y" || answer === "yes");
-      }
+      if (idx < 0) return;
+      process.stdin.off("data", onData);
+      const ans = buf.slice(0, idx).trim().toLowerCase();
+      resolve2(ans === "y" || ans === "yes");
     };
     process.stdin.on("data", onData);
   });
 }
-async function revokeKey(apiKey) {
+function printUpgradeCommand(latest, kind) {
+  const cmd = (() => {
+    switch (kind) {
+      case "pnpm":
+        return `pnpm add -g ${PKG_NAME2}@${latest}`;
+      case "yarn":
+        return `yarn global add ${PKG_NAME2}@${latest}`;
+      case "bun":
+        return `bun add -g ${PKG_NAME2}@${latest}`;
+      default:
+        return `npm install -g ${PKG_NAME2}@${latest}`;
+    }
+  })();
+  process.stderr.write(`  Run:  ${import_chalk12.default.cyan(cmd)}
+
+`);
+}
+function invalidateUpdateCache() {
   try {
-    const config = parseConfig(process.argv, false);
-    const resp = await fetch(`${config.apiUrl}/v1/auth/revoke`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(5e3)
-    });
-    return resp.ok;
+    unlinkSync6(dgCachePath("update-check.json"));
   } catch {
-    return false;
   }
 }
-async function runCleanup(opts = {}) {
-  const configPath2 = dgConfigPath();
-  const legacyDgrc = legacyPaths().dgrc;
-  process.stderr.write(import_chalk12.default.bold("\n  Dependency Guardian cleanup\n\n"));
-  process.stderr.write(import_chalk12.default.dim("  Note: `dg cleanup` is deprecated. Use `dg uninstall` for a full removal\n"));
-  process.stderr.write(import_chalk12.default.dim("  that also strips per-repo git hooks and shell-rc lines.\n\n"));
-  process.stderr.write("  This will:\n");
-  process.stderr.write("    1. Revoke this device's API key on the server\n");
-  process.stderr.write(`    2. Remove ${configPath2}
+async function runUpdate(args, currentVersion) {
+  if (args.includes("--help") || args.includes("-h")) {
+    process.stdout.write(USAGE4);
+    return 0;
+  }
+  const opts = parseUpdateArgs(args);
+  process.stderr.write(import_chalk12.default.dim("  Checking npm registry...\n"));
+  const latest = await fetchLatest();
+  if (!latest) {
+    process.stderr.write(import_chalk12.default.red("  Could not reach npm registry.\n"));
+    return 1;
+  }
+  if (!isNewer(latest, currentVersion)) {
+    process.stderr.write(
+      import_chalk12.default.green(`  Already on latest version (${currentVersion}).
+`)
+    );
+    invalidateUpdateCache();
+    return 0;
+  }
+  process.stderr.write(
+    `
+  ${import_chalk12.default.bold("Update available:")} ${currentVersion} ${import_chalk12.default.dim("\u2192")} ${import_chalk12.default.cyan(latest)}
+`
+  );
+  const installer = detectInstaller(process.argv[1] ?? "");
+  if (!installer || opts.printOnly) {
+    printUpgradeCommand(latest, installer?.kind ?? null);
+    return 0;
+  }
+  let resolvedBin;
+  try {
+    resolvedBin = realpathSync(process.argv[1]);
+  } catch {
+    printUpgradeCommand(latest, installer.kind);
+    return 0;
+  }
+  if (process.platform === "win32") {
+    process.stderr.write(
+      import_chalk12.default.dim("  Detected installer: ") + import_chalk12.default.bold(installer.kind) + "\n"
+    );
+    process.stderr.write(
+      import_chalk12.default.yellow("  Auto-upgrade not supported on Windows \u2014 run the command below.\n")
+    );
+    printUpgradeCommand(latest, installer.kind);
+    return 0;
+  }
+  if (installer.kind === "npm") {
+    const prefix = installPrefix(resolvedBin);
+    if (prefix && !canWrite(prefix)) {
+      process.stderr.write(
+        import_chalk12.default.dim("  Detected installer: ") + import_chalk12.default.bold("npm") + import_chalk12.default.dim(` (prefix: ${prefix})
+`)
+      );
+      process.stderr.write(
+        import_chalk12.default.yellow("  Prefix is not writable \u2014 needs elevated permissions.\n")
+      );
+      process.stderr.write(`  Run:  ${import_chalk12.default.cyan(`sudo npm install -g ${PKG_NAME2}@${latest}`)}
+
 `);
-  process.stderr.write("    3. Remove the shell-alias snippet\n\n");
-  process.stderr.write(import_chalk12.default.dim("  Git pre-commit hooks in your projects are NOT removed.\n"));
-  process.stderr.write(import_chalk12.default.dim("  Run `dg uninstall` to remove every dg artifact, or `dg hook uninstall`\n"));
-  process.stderr.write(import_chalk12.default.dim("  per repo to remove just the pre-commit hooks.\n\n"));
+      return 0;
+    }
+  }
+  process.stderr.write(
+    import_chalk12.default.dim("  Detected installer: ") + import_chalk12.default.bold(installer.kind) + "\n"
+  );
+  const fullCmd = `${installer.binary} ${installer.args(`${PKG_NAME2}@${latest}`).join(" ")}`;
+  process.stderr.write(import_chalk12.default.dim(`  Command: ${fullCmd}
+
+`));
   if (!opts.assumeYes) {
     if (!process.stdin.isTTY) {
-      process.stderr.write(import_chalk12.default.yellow("  Non-interactive shell \u2014 pass --yes to confirm without prompting.\n\n"));
+      process.stderr.write(
+        import_chalk12.default.yellow("  Non-interactive shell \u2014 pass --yes to proceed, or copy the command above.\n\n")
+      );
       return 1;
     }
-    const ok = await confirm("  Continue? [y/N] ");
+    const ok = await confirm("  Proceed? [y/N] ");
+    process.stderr.write("\n");
     if (!ok) {
-      process.stderr.write(import_chalk12.default.dim("\n  Cancelled. Nothing changed.\n\n"));
+      process.stderr.write(import_chalk12.default.dim("  Cancelled.\n\n"));
       return 0;
     }
-    process.stderr.write("\n");
   }
-  const apiKey = getStoredApiKey();
-  if (apiKey) {
-    const revoked = await revokeKey(apiKey);
-    if (revoked) {
-      process.stderr.write(import_chalk12.default.green("  \u2713 ") + "Revoked API key on the server\n");
-    } else {
-      process.stderr.write(import_chalk12.default.yellow("  \u26A0 ") + "Couldn't reach server to revoke key \u2014 local cleanup continues\n");
-    }
-  } else {
-    process.stderr.write(import_chalk12.default.dim("  \xB7 No saved API key found\n"));
+  const result = spawnSync(
+    installer.binary,
+    installer.args(`${PKG_NAME2}@${latest}`),
+    { stdio: "inherit" }
+  );
+  if (result.error && result.error.code === "ENOENT") {
+    process.stderr.write(
+      import_chalk12.default.red(`
+  Installer not found in PATH: ${installer.binary}
+`)
+    );
+    printUpgradeCommand(latest, installer.kind);
+    return 1;
   }
-  for (const p of [configPath2, legacyDgrc]) {
-    if (existsSync17(p)) {
-      try {
-        unlinkSync5(p);
-        process.stderr.write(import_chalk12.default.green("  \u2713 ") + `Removed ${p}
-`);
-      } catch (e) {
-        process.stderr.write(import_chalk12.default.red("  \u2718 ") + `Couldn't remove ${p}: ${e.message}
-`);
-      }
-    }
+  if (result.status !== 0) {
+    process.stderr.write(
+      import_chalk12.default.red(`
+  Upgrade failed (${installer.binary} exited ${result.status ?? "with signal"}).
+`)
+    );
+    return result.status ?? 1;
   }
-  process.stderr.write("\n");
-  await runProtectOff(process.cwd(), { removeShell: true });
-  process.stderr.write(import_chalk12.default.bold("  Cleanup complete.\n\n"));
-  process.stderr.write("  Next: " + import_chalk12.default.bold.cyan("npm uninstall -g @westbayberry/dg") + "\n\n");
+  invalidateUpdateCache();
+  process.stderr.write(
+    "\n" + import_chalk12.default.bold.green(`  Updated to ${latest}.
+`) + import_chalk12.default.dim("  Re-run any in-progress dg commands to pick up the new version.\n\n")
+  );
   return 0;
 }
-async function handleCleanupCommand(args) {
-  const assumeYes = args.includes("--yes") || args.includes("-y");
-  return runCleanup({ assumeYes });
+function handleUpdateCommand(args, currentVersion) {
+  return runUpdate(args, currentVersion);
 }
-var import_chalk12;
-var init_cleanup = __esm({
-  "src/commands/cleanup.ts"() {
+var import_chalk12, PKG_NAME2, FETCH_TIMEOUT_MS, USAGE4;
+var init_update = __esm({
+  "src/commands/update.ts"() {
     "use strict";
     import_chalk12 = __toESM(require_source());
-    init_protect();
-    init_auth();
-    init_config();
     init_paths();
+    init_update_check();
+    PKG_NAME2 = "@westbayberry/dg";
+    FETCH_TIMEOUT_MS = 5e3;
+    USAGE4 = `
+  dg update \u2014 upgrade dg to the latest version
+
+  Detects the package manager dg was installed with (npm / pnpm / yarn / bun)
+  and runs the matching global-upgrade command. Falls back to printing the
+  command on Windows or when the installer can't be detected.
+
+  Usage:
+    dg update [options]
+
+  Options:
+    --yes, -y    Skip the confirmation prompt
+    --print      Show the upgrade command without running it
+    --dry-run    Alias for --print
+    --help, -h   Show this help
+
+`;
   }
 });
 
@@ -50353,7 +50667,7 @@ __export(uninstall_exports, {
   parseUninstallArgs: () => parseUninstallArgs,
   runUninstall: () => runUninstall
 });
-import { existsSync as existsSync18, rmSync as rmSync3, unlinkSync as unlinkSync6, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync17, rmSync as rmSync3, unlinkSync as unlinkSync7, statSync as statSync5 } from "node:fs";
 function parseUninstallArgs(args) {
   return {
     assumeYes: args.includes("--yes") || args.includes("-y"),
@@ -50364,7 +50678,7 @@ function parseUninstallArgs(args) {
 }
 function safeExists(p) {
   try {
-    return existsSync18(p);
+    return existsSync17(p);
   } catch {
     return false;
   }
@@ -50480,7 +50794,7 @@ async function revokeApiKey(apiKey) {
 }
 function rmFile(path2) {
   try {
-    unlinkSync6(path2);
+    unlinkSync7(path2);
     return { ok: true };
   } catch (e) {
     const code = e.code;
@@ -50506,7 +50820,7 @@ function isWritableTarget(path2) {
 }
 async function runUninstall(args) {
   if (args.includes("--help") || args.includes("-h")) {
-    process.stdout.write(USAGE4);
+    process.stdout.write(USAGE5);
     return 0;
   }
   const opts = parseUninstallArgs(args);
@@ -50544,7 +50858,7 @@ async function runUninstall(args) {
   }
   if (!opts.keepHooks && !opts.soft) {
     for (const h of plan.hooks) {
-      if (!existsSync18(h.repoPath)) {
+      if (!existsSync17(h.repoPath)) {
         process.stderr.write(import_chalk13.default.dim(`  \xB7 ${h.repoPath} no longer exists \u2014 skipping registered hook
 `));
         continue;
@@ -50630,7 +50944,7 @@ async function runUninstall(args) {
 function handleUninstallCommand(args) {
   return runUninstall(args);
 }
-var import_chalk13, REVOKE_TIMEOUT_MS, USAGE4;
+var import_chalk13, REVOKE_TIMEOUT_MS, USAGE5;
 var init_uninstall = __esm({
   "src/commands/uninstall.ts"() {
     "use strict";
@@ -50642,7 +50956,7 @@ var init_uninstall = __esm({
     init_auth();
     init_config();
     REVOKE_TIMEOUT_MS = 5e3;
-    USAGE4 = `
+    USAGE5 = `
   dg uninstall \u2014 remove every file dg has written locally
 
   Usage:
@@ -50678,10 +50992,9 @@ __export(init_exports, {
   parseInitArgs: () => parseInitArgs,
   runInit: () => runInit2
 });
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync18 } from "node:fs";
 import { join as join12 } from "node:path";
 import * as readline2 from "node:readline";
-import { execFileSync as execFileSync4 } from "node:child_process";
 function parseInitArgs(args) {
   const opts = {
     assumeYes: false,
@@ -50730,23 +51043,20 @@ async function confirm3(prompt, defaultYes, assumeYes) {
   });
 }
 function detectEcosystem(cwd2) {
-  const npm = existsSync19(join12(cwd2, "package.json")) || existsSync19(join12(cwd2, "package-lock.json")) || existsSync19(join12(cwd2, "pnpm-lock.yaml")) || existsSync19(join12(cwd2, "yarn.lock"));
-  const pypi = existsSync19(join12(cwd2, "pyproject.toml")) || existsSync19(join12(cwd2, "setup.py")) || existsSync19(join12(cwd2, "requirements.txt")) || existsSync19(join12(cwd2, "Pipfile")) || existsSync19(join12(cwd2, "poetry.lock"));
+  const npm = existsSync18(join12(cwd2, "package.json")) || existsSync18(join12(cwd2, "package-lock.json")) || existsSync18(join12(cwd2, "pnpm-lock.yaml")) || existsSync18(join12(cwd2, "yarn.lock"));
+  const pypi = existsSync18(join12(cwd2, "pyproject.toml")) || existsSync18(join12(cwd2, "setup.py")) || existsSync18(join12(cwd2, "requirements.txt")) || existsSync18(join12(cwd2, "Pipfile")) || existsSync18(join12(cwd2, "poetry.lock"));
   return { npm, pypi };
 }
 function findRepoRootOrNull(cwd2) {
   try {
-    return execFileSync4("git", ["-C", cwd2, "rev-parse", "--show-toplevel"], {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    return safeGit(["rev-parse", "--show-toplevel"], { cwd: cwd2 }).trim();
   } catch {
     return null;
   }
 }
 async function runInit2(args) {
   if (args.includes("--help") || args.includes("-h")) {
-    process.stdout.write(USAGE5);
+    process.stdout.write(USAGE6);
     return 0;
   }
   const opts = parseInitArgs(args);
@@ -50974,7 +51284,7 @@ async function runInit2(args) {
 function handleInitCommand(args) {
   return runInit2(args);
 }
-var import_chalk14, USAGE5;
+var import_chalk14, USAGE6;
 var init_init = __esm({
   "src/commands/init.ts"() {
     "use strict";
@@ -50984,7 +51294,8 @@ var init_init = __esm({
     init_hooks_registry();
     init_protect();
     init_paths();
-    USAGE5 = `
+    init_safe_git();
+    USAGE6 = `
   dg init \u2014 fast per-project setup
 
   Usage:
@@ -51410,10 +51721,12 @@ var init_ProjectSelector = __esm({
     await init_build2();
     import_chalk17 = __toESM(require_source());
     init_sanitize();
+    await init_useTerminalSize();
     import_jsx_runtime13 = __toESM(require_jsx_runtime());
     ProjectSelector = ({ projects, onConfirm, onCancel, userStatus }) => {
       const [cursor, setCursor] = (0, import_react35.useState)(0);
       const [selected, setSelected] = (0, import_react35.useState)(() => new Set(projects.map((_, i) => i)));
+      const { cols: termCols } = useTerminalSize();
       use_input_default((input, key) => {
         if (key.upArrow) {
           setCursor((c) => Math.max(0, c - 1));
@@ -51441,8 +51754,6 @@ var init_ProjectSelector = __esm({
       const ecosystemLabel = (eco) => eco === "npm" ? import_chalk17.default.magenta("npm") : import_chalk17.default.blue("pip");
       return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 1, children: [
         /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { children: [
-          import_chalk17.default.cyan("\u25C6"),
-          " ",
           import_chalk17.default.bold("Dependency Guardian"),
           "  ",
           userStatus ? import_chalk17.default.dim(userStatus) : ""
@@ -51460,8 +51771,20 @@ var init_ProjectSelector = __esm({
           const isSelected = selected.has(i);
           const prefix = isCursor ? import_chalk17.default.cyan("\u258C") : " ";
           const check = isSelected ? import_chalk17.default.green("\u25C9") : import_chalk17.default.dim("\u25CB");
-          const line = `${prefix}${check}  ${sanitize(proj.relativePath).padEnd(40)} ${ecosystemLabel(proj.ecosystem).padEnd(5)} ${proj.packageCount} packages`;
-          return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { backgroundColor: isCursor ? "#1a1a2e" : void 0, children: line }, i);
+          const ecoCount = `${ecosystemLabel(proj.ecosystem)} ${proj.packageCount} packages`;
+          const ecoCountPlainLen = `${proj.ecosystem} ${proj.packageCount} packages`.length;
+          const fixedPrefixLen = 4;
+          const pathColWidth = Math.max(20, termCols - fixedPrefixLen - ecoCountPlainLen - 3);
+          const path2 = sanitize(proj.relativePath);
+          const pathTruncated = path2.length > pathColWidth ? path2.slice(0, Math.max(1, pathColWidth - 1)) + "\u2026" : path2.padEnd(pathColWidth);
+          return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { backgroundColor: isCursor ? "#1a1a2e" : void 0, wrap: "truncate-end", children: [
+            prefix,
+            check,
+            "  ",
+            pathTruncated,
+            " ",
+            ecoCount
+          ] }, i);
         }),
         /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { children: "" }),
         /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { dimColor: true, children: selected.size === 0 ? import_chalk17.default.yellow("Select at least 1 project to scan") : `${selected.size} of ${projects.length} selected` }),
@@ -51507,7 +51830,7 @@ var init_SetupBanner = __esm({
           paddingRight: 1,
           width: "100%",
           children: [
-            /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Text, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Text, { wrap: "truncate-end", children: [
               /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Text, { color: "yellow", bold: true, children: "! Setup incomplete" }),
               /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Text, { dimColor: true, children: [
                 " \u2014 ",
@@ -51515,7 +51838,7 @@ var init_SetupBanner = __esm({
                 " you haven't set up yet"
               ] })
             ] }),
-            issues.map((issue) => /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Text, { children: [
+            issues.map((issue) => /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Text, { wrap: "truncate-end", children: [
               /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Text, { dimColor: true, children: "  \xB7 " }),
               issue.label,
               /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Text, { dimColor: true, children: " \u2192 " }),
@@ -51625,7 +51948,7 @@ var init_App2 = __esm({
           return () => clearTimeout(timer);
         }
         if (state.phase === "trial_exhausted") {
-          let msg = "You've used your 5 free anonymous scans. Run `dg login` to create a free account and continue scanning.\n";
+          let msg = "You've used your 5 free anonymous scans. Run `dg login` to access Dependency Guardian for free.\n";
           try {
             if (getStoredApiKey()) {
               msg = "Your session expired. Run `dg logout` then `dg login` to re-authenticate.\n";
@@ -51708,28 +52031,10 @@ var init_App2 = __esm({
               ] })
             ] }) : /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(import_jsx_runtime15.Fragment, { children: [
               /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { color: "yellow", bold: true, children: "You've used your 5 free anonymous scans." }),
-              /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { children: " " }),
-              /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { children: "Sign in (free, 10 seconds) to unlock:" }),
-              /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Text, { children: [
-                "  ",
-                /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { color: "green", children: "\u2713" }),
-                " unlimited scans"
-              ] }),
-              /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Text, { children: [
-                "  ",
-                /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { color: "green", children: "\u2713" }),
-                " scan history + saved reports"
-              ] }),
-              /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Text, { children: [
-                "  ",
-                /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { color: "green", children: "\u2713" }),
-                " GitHub App for team / PR scanning"
-              ] }),
-              /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { children: " " }),
               /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Text, { children: [
                 "Run ",
                 /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
-                " when you're ready."
+                " to access Dependency Guardian for free."
               ] })
             ] }) });
           }
@@ -52656,7 +52961,7 @@ import {
   readFileSync as readFileSync5,
   writeFileSync as writeFileSync4,
   copyFileSync,
-  unlinkSync as unlinkSync2,
+  unlinkSync as unlinkSync3,
   rmSync as rmSync2,
   chmodSync as chmodSync2,
   statSync,
@@ -52667,12 +52972,12 @@ import {
 import { dirname as dirname4 } from "node:path";
 var README = `dependency-guardian \u2014 local state for the dg CLI.
 
-  config.json          your account + preferences (mode 0600)
-  cache/scans.sqlite   24h package-scan cache
-  cache/update-check.json  latest-version probe (24h TTL)
-  cache/routing-hint.json  scan-routing hint
-  state/aliases.sh         optional shell aliases (npm/pip wrappers)
-  state/trial-banner       throttle stamp for the trial nudge
+  config.json                 your account + preferences (mode 0600)
+  cache/update-check.json     latest-version probe (24h TTL)
+  state/aliases.sh            optional shell aliases (npm/pip wrappers)
+  state/auth-status.json      60s cache of /v1/auth/status
+  state/trial-banner          throttle stamp for the trial nudge
+  state/bypass-log.jsonl      append-only log of install-wrapper bypasses
   state/hooks-installed.json  registry of git hooks dg installed
 
 To remove everything dg has written to your machine, run:
@@ -52700,7 +53005,7 @@ function moveFile(from, to, mode) {
   if (statSync(to).size !== statSync(from).size) {
     throw new Error(`size mismatch after copy: ${from} -> ${to}`);
   }
-  unlinkSync2(from);
+  unlinkSync3(from);
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -52728,7 +53033,7 @@ function acquireLock(lockPath) {
     }
     if (!stale) return "held";
     try {
-      unlinkSync2(lockPath);
+      unlinkSync3(lockPath);
     } catch {
     }
   }
@@ -52752,7 +53057,7 @@ function releaseLock(state) {
     }
   }
   try {
-    unlinkSync2(state.lockPath);
+    unlinkSync3(state.lockPath);
   } catch {
   }
 }
@@ -52761,7 +53066,7 @@ function rollback(moves) {
     try {
       if (existsSync5(m.to) && !existsSync5(m.from)) {
         copyFileSync(m.to, m.from);
-        unlinkSync2(m.to);
+        unlinkSync3(m.to);
       }
     } catch {
     }
@@ -52769,7 +53074,7 @@ function rollback(moves) {
 }
 function detectLegacy() {
   const legacy = legacyPaths();
-  return existsSync5(legacy.dgrc) || existsSync5(legacy.cacheSqlite) || existsSync5(legacy.routingHint) || existsSync5(legacy.updateCheck) || existsSync5(legacy.trialBannerOld) || existsSync5(legacy.aliasesShOld) || existsSync5(legacy.depGuardianDir);
+  return existsSync5(legacy.dgrc) || existsSync5(legacy.updateCheck) || existsSync5(legacy.trialBannerOld) || existsSync5(legacy.aliasesShOld) || existsSync5(legacy.depGuardianDir);
 }
 function validateLegacyConfig(path2) {
   let raw;
@@ -52826,23 +53131,13 @@ function runMigrationIfNeeded() {
       } catch {
       }
       try {
-        unlinkSync2(legacy.dgrc);
+        unlinkSync3(legacy.dgrc);
       } catch {
       }
       moves.push({ from: legacy.dgrc, to: p.config });
       movedCount++;
     }
     ensureDir(p.cacheDir, 448);
-    if (existsSync5(legacy.cacheSqlite)) {
-      moveFile(legacy.cacheSqlite, p.cacheSqlite, 384);
-      moves.push({ from: legacy.cacheSqlite, to: p.cacheSqlite });
-      movedCount++;
-    }
-    if (existsSync5(legacy.routingHint)) {
-      moveFile(legacy.routingHint, p.routingHint, 384);
-      moves.push({ from: legacy.routingHint, to: p.routingHint });
-      movedCount++;
-    }
     if (existsSync5(legacy.updateCheck)) {
       moveFile(legacy.updateCheck, p.updateCheck, 384);
       moves.push({ from: legacy.updateCheck, to: p.updateCheck });
@@ -52862,9 +53157,7 @@ function runMigrationIfNeeded() {
     if (existsSync5(legacy.depGuardianDir) && legacy.depGuardianDir !== p.root) {
       const candidates = [
         { from: join(legacy.depGuardianDir, "config.json"), to: p.config, mode: 384 },
-        { from: join(legacy.depGuardianDir, "cache", "scans.sqlite"), to: p.cacheSqlite, mode: 384 },
         { from: join(legacy.depGuardianDir, "cache", "update-check.json"), to: p.updateCheck, mode: 384 },
-        { from: join(legacy.depGuardianDir, "cache", "routing-hint.json"), to: p.routingHint, mode: 384 },
         { from: join(legacy.depGuardianDir, "state", "aliases.sh"), to: p.aliasesSh, mode: 420 },
         { from: join(legacy.depGuardianDir, "state", "trial-banner"), to: p.trialBanner, mode: 384 },
         { from: join(legacy.depGuardianDir, "state", "hooks-installed.json"), to: p.hooksRegistry, mode: 384 },
@@ -52941,8 +53234,8 @@ var isInteractive = process.stdout.isTTY === true && !process.env.CI && !process
 async function main() {
   const rawCommand = process.argv[2];
   if (!rawCommand || rawCommand === "help" || rawCommand === "--help" || rawCommand === "-h") {
-    const { USAGE: USAGE6 } = await Promise.resolve().then(() => (init_config(), config_exports));
-    process.stdout.write(USAGE6);
+    const { USAGE: USAGE7 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    process.stdout.write(USAGE7);
     return;
   }
   if (rawCommand === "--help-all" || rawCommand === "help-all") {
@@ -52955,7 +53248,7 @@ async function main() {
 `);
     return;
   }
-  const KNOWN_COMMANDS = ["init", "scan", "licenses", "npm", "pip", "wrap", "login", "logout", "status", "hook", "update", "help", "version", "protect", "publish-check", "cleanup", "uninstall"];
+  const KNOWN_COMMANDS = ["init", "scan", "licenses", "npm", "pip", "wrap", "login", "logout", "status", "hook", "update", "help", "version", "protect", "publish-check", "uninstall"];
   if (rawCommand && !rawCommand.startsWith("-") && !KNOWN_COMMANDS.includes(rawCommand)) {
     const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
     const best = closestCommand(rawCommand, KNOWN_COMMANDS);
@@ -53019,11 +53312,11 @@ async function main() {
       if (v === "npm" || v === "pypi") ecosystem = v;
     }
     const { runNpmPublishCheck: runNpmPublishCheck2, runPypiPublishCheck: runPypiPublishCheck2, renderPublishCheckResult: renderPublishCheckResult2 } = await Promise.resolve().then(() => (init_publish_check(), publish_check_exports));
-    const { existsSync: existsSync20 } = await import("node:fs");
+    const { existsSync: existsSync19 } = await import("node:fs");
     const { join: join13 } = await import("node:path");
     if (ecosystem === "auto") {
-      if (existsSync20(join13(process.cwd(), "package.json"))) ecosystem = "npm";
-      else if (existsSync20(join13(process.cwd(), "pyproject.toml")) || existsSync20(join13(process.cwd(), "setup.py"))) ecosystem = "pypi";
+      if (existsSync19(join13(process.cwd(), "package.json"))) ecosystem = "npm";
+      else if (existsSync19(join13(process.cwd(), "pyproject.toml")) || existsSync19(join13(process.cwd(), "setup.py"))) ecosystem = "pypi";
       else {
         process.stderr.write("\n  publish-check: no package.json, pyproject.toml, or setup.py in current directory.\n  Pass --ecosystem npm|pypi explicitly if your project layout differs.\n\n");
         process.exit(3);
@@ -53084,12 +53377,8 @@ async function main() {
     return;
   }
   if (rawCommand === "update") {
-    await runUpdate(CLI_VERSION);
-    return;
-  }
-  if (rawCommand === "cleanup") {
-    const { handleCleanupCommand: handleCleanupCommand2 } = await Promise.resolve().then(() => (init_cleanup(), cleanup_exports));
-    const code = await handleCleanupCommand2(process.argv.slice(3));
+    const { handleUpdateCommand: handleUpdateCommand2 } = await Promise.resolve().then(() => (init_update(), update_exports));
+    const code = await handleUpdateCommand2(process.argv.slice(3), CLI_VERSION);
     process.exit(code);
   }
   if (rawCommand === "uninstall") {
@@ -53213,10 +53502,11 @@ async function main() {
       const { render: render3 } = await init_build2().then(() => build_exports);
       const React23 = await Promise.resolve().then(() => __toESM(require_react()));
       const { App: App3 } = await init_App2().then(() => App_exports);
-      const { setInkInstance: setInkInstance2, resetInkClear: resetInkClear2, initInkInstances: initInkInstances2 } = await Promise.resolve().then(() => (init_ink_controls(), ink_controls_exports));
+      const { setInkInstance: setInkInstance2, resetInkClear: resetInkClear2, initInkInstances: initInkInstances2, patchInkLogForAbsolutePositioning: patchInkLogForAbsolutePositioning2 } = await Promise.resolve().then(() => (init_ink_controls(), ink_controls_exports));
       await initInkInstances2();
       const inst = render3(React23.createElement(App3, { config, userStatus, scanUsage, setupIssues }));
       setInkInstance2(inst);
+      patchInkLogForAbsolutePositioning2();
       try {
         await inst.waitUntilExit();
       } finally {