@westbayberry/dg 1.1.3 → 1.1.5

package/dist/index.mjs

@@ -1801,70 +1801,50 @@ __export(paths_exports, {
   dgCachePath: () => dgCachePath,
   dgConfigDir: () => dgConfigDir,
   dgConfigPath: () => dgConfigPath,
-  dgMigrationBreadcrumb: () => dgMigrationBreadcrumb,
-  dgMigrationLock: () => dgMigrationLock,
   dgPaths: () => dgPaths,
   dgReadme: () => dgReadme,
   dgRoot: () => dgRoot,
   dgStateDir: () => dgStateDir,
-  dgStatePath: () => dgStatePath,
-  legacyPaths: () => legacyPaths
+  dgStatePath: () => dgStatePath
 });
 import { homedir } from "node:os";
-import { join as join2, isAbsolute } from "node:path";
+import { join, isAbsolute } from "node:path";
 function safeAbsolute(p, fallback) {
   if (!p || typeof p !== "string") return fallback;
   if (!isAbsolute(p)) return fallback;
   return p;
 }
 function dgRoot() {
-  return join2(homedir(), `.${ROOT_DIR_NAME}`);
+  return join(homedir(), `.${ROOT_DIR_NAME}`);
 }
 function dgConfigDir() {
   const xdg = safeAbsolute(process.env.XDG_CONFIG_HOME, "");
-  if (xdg) return join2(xdg, ROOT_DIR_NAME);
+  if (xdg) return join(xdg, ROOT_DIR_NAME);
   return dgRoot();
 }
 function dgCacheDir() {
   const explicit = safeAbsolute(process.env.DG_CACHE_DIR, "");
   if (explicit) return explicit;
   const xdg = safeAbsolute(process.env.XDG_CACHE_HOME, "");
-  if (xdg) return join2(xdg, ROOT_DIR_NAME);
-  return join2(dgRoot(), "cache");
+  if (xdg) return join(xdg, ROOT_DIR_NAME);
+  return join(dgRoot(), "cache");
 }
 function dgStateDir() {
   const xdg = safeAbsolute(process.env.XDG_STATE_HOME, "");
-  if (xdg) return join2(xdg, ROOT_DIR_NAME);
-  return join2(dgRoot(), "state");
+  if (xdg) return join(xdg, ROOT_DIR_NAME);
+  return join(dgRoot(), "state");
 }
 function dgConfigPath() {
-  return join2(dgConfigDir(), "config.json");
+  return join(dgConfigDir(), "config.json");
 }
 function dgCachePath(name) {
-  return join2(dgCacheDir(), name);
+  return join(dgCacheDir(), name);
 }
 function dgStatePath(name) {
-  return join2(dgStateDir(), name);
-}
-function dgMigrationBreadcrumb() {
-  return join2(dgRoot(), ".migrated-from-v1");
-}
-function dgMigrationLock() {
-  return join2(dgRoot(), ".migration.lock");
+  return join(dgStateDir(), name);
 }
 function dgReadme() {
-  return join2(dgRoot(), "README.txt");
-}
-function legacyPaths() {
-  const home = homedir();
-  const depGuardianDir = join2(home, ".dependency-guardian");
-  return {
-    dgrc: join2(home, ".dgrc.json"),
-    cacheDir: depGuardianDir,
-    updateCheck: join2(home, ".dg-update-check.json"),
-    aliasesShOld: join2(depGuardianDir, "aliases.sh"),
-    depGuardianDir
-  };
+  return join(dgRoot(), "README.txt");
 }
 function dgPaths() {
   return {
@@ -1876,9 +1856,7 @@ function dgPaths() {
     updateCheck: dgCachePath("update-check.json"),
     aliasesSh: dgStatePath("aliases.sh"),
     hooksRegistry: dgStatePath("hooks-installed.json"),
-    readme: dgReadme(),
-    migrationBreadcrumb: dgMigrationBreadcrumb(),
-    migrationLock: dgMigrationLock()
+    readme: dgReadme()
   };
 }
 var ROOT_DIR_NAME;
@@ -2519,7 +2497,7 @@ __export(config_exports, {
 });
 import { parseArgs } from "node:util";
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
-import { join as join3, dirname as dirname2 } from "node:path";
+import { join as join2, dirname as dirname2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function levenshtein(a, b) {
   if (a === b) return 0;
@@ -2560,28 +2538,24 @@ function warnUnknownDgrcKeys(parsed, source) {
   }
 }
 function loadDgrc() {
-  const cwdPath = join3(process.cwd(), ".dgrc.json");
+  const cwdPath = join2(process.cwd(), ".dgrc.json");
   const homePath = dgConfigPath();
-  const legacyHomePath = legacyPaths().dgrc;
   let config = {};
-  const sources = [homePath, legacyHomePath].filter((p, i, arr) => arr.indexOf(p) === i);
-  for (const src of sources) {
-    if (!existsSync2(src)) continue;
+  if (existsSync2(homePath)) {
     try {
-      const data = JSON.parse(readFileSync2(src, "utf-8"));
-      warnUnknownDgrcKeys(data, src);
+      const data = JSON.parse(readFileSync2(homePath, "utf-8"));
+      warnUnknownDgrcKeys(data, homePath);
       const filtered = {};
       for (const k of KNOWN_DGRC_KEYS) {
         if (k in data) filtered[k] = data[k];
       }
       config = filtered;
-      break;
     } catch {
-      process.stderr.write(`Warning: Failed to parse ${src}, ignoring.
+      process.stderr.write(`Warning: Failed to parse ${homePath}, ignoring.
 `);
     }
   }
-  if (cwdPath !== homePath && cwdPath !== legacyHomePath && existsSync2(cwdPath) && process.env.DG_QUIET !== "1") {
+  if (cwdPath !== homePath && existsSync2(cwdPath) && process.env.DG_QUIET !== "1") {
     process.stderr.write(
       `dg: note: ./.dgrc.json is ignored (repo-controlled config is no longer honored). Use ~/.dg/.dgrc.json, env vars (DG_MODE, DG_API_URL), or CLI flags.
 `
@@ -2619,7 +2593,7 @@ function getVersion() {
   try {
     const thisDir = dirname2(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
-      readFileSync2(join3(thisDir, "..", "package.json"), "utf-8")
+      readFileSync2(join2(thisDir, "..", "package.json"), "utf-8")
     );
     return pkg.version ?? "1.0.0";
   } catch {
@@ -3067,8 +3041,8 @@ var init_terminal_state = __esm({
 });
 
 // src/shims/safe-fs.ts
-import { existsSync as existsSync5, lstatSync as lstatSync3, mkdirSync as mkdirSync4, renameSync, statSync as statSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname5, sep } from "node:path";
+import { existsSync as existsSync4, lstatSync as lstatSync3, mkdirSync as mkdirSync3, renameSync, statSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, sep } from "node:path";
 import { homedir as homedir2 } from "node:os";
 function ensureUnderHome(target) {
   const home = homedir2();
@@ -3097,28 +3071,28 @@ function safeMkdirRecursive(target, mode = 493) {
   for (const segment of rel) {
     cur = cur + sep + segment;
     lstatNoSymlink(cur);
-    if (!existsSync5(cur)) {
-      mkdirSync4(cur, { mode });
+    if (!existsSync4(cur)) {
+      mkdirSync3(cur, { mode });
     }
   }
 }
 function safeWriteFile(target, content, mode = 420) {
   ensureUnderHome(target);
-  lstatNoSymlink(dirname5(target));
+  lstatNoSymlink(dirname4(target));
   lstatNoSymlink(target);
-  writeFileSync4(target, content, { mode });
+  writeFileSync3(target, content, { mode });
 }
 function atomicWriteFile(target, content, mode = 420) {
   ensureUnderHome(target);
-  lstatNoSymlink(dirname5(target));
+  lstatNoSymlink(dirname4(target));
   lstatNoSymlink(target);
   const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync4(tmp, content, { mode });
+  writeFileSync3(tmp, content, { mode });
   renameSync(tmp, target);
 }
 function isExecutable(path2) {
   try {
-    const st = statSync2(path2);
+    const st = statSync(path2);
     return st.isFile() && (st.mode & 73) !== 0;
   } catch {
     return false;
@@ -3132,7 +3106,7 @@ function safeUnlink(target) {
     if (e instanceof UnsafePathError) throw e;
   }
   try {
-    unlinkSync4(target);
+    unlinkSync3(target);
   } catch (e) {
     const code = e.code;
     if (code !== "ENOENT") throw e;
@@ -3261,10 +3235,10 @@ exit /b 127
 
 // src/shims/rc-syntax.ts
 import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
-import { existsSync as existsSync6, readFileSync as readFileSync5, lstatSync as lstatSync4, appendFileSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join3 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, lstatSync as lstatSync4, appendFileSync, writeFileSync as writeFileSync4 } from "node:fs";
 function expandHome(path2) {
-  if (path2.startsWith("~/")) return join4(homedir3(), path2.slice(2));
+  if (path2.startsWith("~/")) return join3(homedir3(), path2.slice(2));
   return path2;
 }
 function detectShellKind(envShell) {
@@ -3278,13 +3252,13 @@ function rcCandidates(kind) {
   const home = homedir3();
   switch (kind) {
     case "zsh":
-      return [join4(home, ".zshrc")];
+      return [join3(home, ".zshrc")];
     case "bash":
-      return [join4(home, ".bashrc"), join4(home, ".bash_profile")];
+      return [join3(home, ".bashrc"), join3(home, ".bash_profile")];
     case "fish":
-      return [join4(home, ".config", "fish", "config.fish")];
+      return [join3(home, ".config", "fish", "config.fish")];
     case "sh":
-      return [join4(home, ".profile")];
+      return [join3(home, ".profile")];
   }
 }
 function pathSnippet(kind) {
@@ -3307,12 +3281,12 @@ function appendSentinelBlock(rcPath, snippet) {
       return { status: "failed", path: resolved, reason: e.message };
     }
   }
-  if (existsSync6(resolved)) {
+  if (existsSync5(resolved)) {
     const st = lstatSync4(resolved);
     if (!st.isFile()) {
       return { status: "failed", path: resolved, reason: "rc path is not a regular file" };
     }
-    const existing = readFileSync5(resolved, "utf-8");
+    const existing = readFileSync4(resolved, "utf-8");
     if (existing.includes(RC_SENTINEL_OPEN)) {
       return { status: "already-present", path: resolved };
     }
@@ -3323,10 +3297,10 @@ ${snippet}
 ${RC_SENTINEL_CLOSE}
 `;
   try {
-    if (existsSync6(resolved)) {
+    if (existsSync5(resolved)) {
       appendFileSync(resolved, block, { encoding: "utf-8" });
     } else {
-      writeFileSync5(resolved, block, { encoding: "utf-8", mode: 420 });
+      writeFileSync4(resolved, block, { encoding: "utf-8", mode: 420 });
     }
     return { status: "appended", path: resolved };
   } catch (e) {
@@ -3340,7 +3314,7 @@ function stripSentinelBlock(rcPath) {
   } catch (e) {
     return { status: "failed", path: resolved, reason: e.message };
   }
-  if (!existsSync6(resolved)) {
+  if (!existsSync5(resolved)) {
     return { status: "already-present", path: resolved };
   }
   try {
@@ -3350,7 +3324,7 @@ function stripSentinelBlock(rcPath) {
       return { status: "failed", path: resolved, reason: e.message };
     }
   }
-  const original = readFileSync5(resolved, "utf-8");
+  const original = readFileSync4(resolved, "utf-8");
   if (!original.includes(RC_SENTINEL_OPEN)) {
     return { status: "already-present", path: resolved };
   }
@@ -3377,7 +3351,7 @@ function stripSentinelBlock(rcPath) {
   if (original.endsWith("\n") && !result.endsWith("\n")) result += "\n";
   if (!original.endsWith("\n") && result.endsWith("\n")) result = result.slice(0, -1);
   try {
-    writeFileSync5(resolved, result, { encoding: "utf-8" });
+    writeFileSync4(resolved, result, { encoding: "utf-8" });
     return { status: "appended", path: resolved };
   } catch (e) {
     return { status: "failed", path: resolved, reason: e.message };
@@ -3401,11 +3375,11 @@ __export(resolve_exports, {
   resolveRealBinary: () => resolveRealBinary,
   walkPathExcludingShimDir: () => walkPathExcludingShimDir
 });
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
-import { join as join5, delimiter, sep as sep2 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
+import { join as join4, delimiter, sep as sep2 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function shimDir() {
-  return join5(homedir4(), ".dg", "shims");
+  return join4(homedir4(), ".dg", "shims");
 }
 function walkPathExcludingShimDir(name, extraExtensions = []) {
   const raw = process.env.PATH ?? "/usr/bin:/bin";
@@ -3415,7 +3389,7 @@ function walkPathExcludingShimDir(name, extraExtensions = []) {
   for (const dir of parts) {
     if (dir === shims || dir.startsWith(shims + sep2)) continue;
     for (const ext of ["", ...exts]) {
-      const candidate = join5(dir, name + ext);
+      const candidate = join4(dir, name + ext);
       if (isExecutable(candidate)) return candidate;
     }
   }
@@ -3430,7 +3404,7 @@ function platformExtensions() {
 }
 function readCache2() {
   try {
-    const raw = readFileSync6(CACHE_PATH(), "utf-8");
+    const raw = readFileSync5(CACHE_PATH(), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null) {
       return parsed;
@@ -3452,7 +3426,7 @@ function resolveRealBinary(ecosystem) {
   }
   const cache3 = readCache2();
   const cached = cache3[ecosystem];
-  if (cached && existsSync7(cached) && isExecutable(cached)) {
+  if (cached && existsSync6(cached) && isExecutable(cached)) {
     return cached;
   }
   const resolved = walkPath(ecosystem, exts);
@@ -3499,13 +3473,13 @@ __export(install_exports, {
   uninstallShims: () => uninstallShims
 });
 import { homedir as homedir5 } from "node:os";
-import { join as join6, dirname as dirname6 } from "node:path";
+import { join as join5, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { chmodSync as chmodSync4, chownSync, existsSync as existsSync8, readdirSync, readFileSync as readFileSync7, statSync as statSync3, appendFileSync as appendFileSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync3, chownSync, existsSync as existsSync7, readdirSync, readFileSync as readFileSync6, statSync as statSync2, appendFileSync as appendFileSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 function dgShimDir() {
-  return join6(homedir5(), ".dg", "shims");
+  return join5(homedir5(), ".dg", "shims");
 }
 function noncePath() {
   return dgStatePath("shim-nonce");
@@ -3517,12 +3491,12 @@ function bypassLogPath() {
   return dgStatePath("bypass.log");
 }
 function dgEntryStatePath(targetHome) {
-  return join6(targetHome, ".dg", "state", "dg-entry");
+  return join5(targetHome, ".dg", "state", "dg-entry");
 }
 function currentDgEntry() {
   try {
-    const entry = join6(dirname6(fileURLToPath2(import.meta.url)), "index.mjs");
-    if (existsSync8(entry)) return entry;
+    const entry = join5(dirname5(fileURLToPath2(import.meta.url)), "index.mjs");
+    if (existsSync7(entry)) return entry;
   } catch {
   }
   try {
@@ -3538,18 +3512,18 @@ function ensureDgEntryRecorded(targetHome = homedir5()) {
     const path2 = dgEntryStatePath(targetHome);
     let existing = null;
     try {
-      existing = readFileSync7(path2, "utf-8").trim();
+      existing = readFileSync6(path2, "utf-8").trim();
     } catch {
     }
     if (existing === entry) return;
-    safeMkdirRecursive(dirname6(path2), 493);
+    safeMkdirRecursive(dirname5(path2), 493);
     safeWriteFile(path2, entry + "\n", 420);
   } catch {
   }
 }
 function readNonce() {
   try {
-    const raw = readFileSync7(noncePath(), "utf-8").trim();
+    const raw = readFileSync6(noncePath(), "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -3591,13 +3565,13 @@ function persistWindowsPath(shimsDir, outcomes) {
 }
 function updatePowerShellProfile(targetHome, shimsDir, outcomes) {
   if (process.platform !== "win32") return;
-  const profilePath = join6(targetHome, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1");
-  if (!existsSync8(profilePath)) {
+  const profilePath = join5(targetHome, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1");
+  if (!existsSync7(profilePath)) {
     outcomes.push({ status: "already-present", path: profilePath });
     return;
   }
   try {
-    const existing = readFileSync7(profilePath, "utf-8");
+    const existing = readFileSync6(profilePath, "utf-8");
     if (existing.includes(">>> dg-managed >>>")) {
       outcomes.push({ status: "already-present", path: profilePath });
       return;
@@ -3616,12 +3590,12 @@ $env:Path = "${shimsDir};$env:Path"
 function chownTreeIfNeeded(root, uid, gid) {
   if (uid === void 0 || gid === void 0) return;
   if (process.platform === "win32") return;
-  if (!existsSync8(root)) return;
+  if (!existsSync7(root)) return;
   chownIfNeeded(root, uid, gid);
   try {
     for (const entry of readdirSync(root)) {
-      const child = join6(root, entry);
-      const st = statSync3(child);
+      const child = join5(root, entry);
+      const st = statSync2(child);
       if (st.isDirectory()) {
         chownTreeIfNeeded(child, uid, gid);
       } else {
@@ -3634,18 +3608,18 @@ function chownTreeIfNeeded(root, uid, gid) {
 function installShims(opts = {}) {
   const targetHome = opts.targetHome ?? homedir5();
   const platform3 = opts.platform ?? (process.platform === "win32" ? "windows" : "unix");
-  const dgRoot2 = join6(targetHome, ".dg");
-  const shimsDir = join6(targetHome, ".dg", "shims");
-  const stateDir = join6(targetHome, ".dg", "state");
+  const dgRoot2 = join5(targetHome, ".dg");
+  const shimsDir = join5(targetHome, ".dg", "shims");
+  const stateDir = join5(targetHome, ".dg", "state");
   safeMkdirRecursive(dgRoot2, 493);
   safeMkdirRecursive(stateDir, 493);
   safeMkdirRecursive(shimsDir, 493);
   const nonce = randomBytes(16).toString("hex");
-  const noncePathResolved = join6(stateDir, "shim-nonce");
+  const noncePathResolved = join5(stateDir, "shim-nonce");
   safeWriteFile(noncePathResolved, nonce, 384);
   chownIfNeeded(noncePathResolved, opts.targetUid, opts.targetGid);
   const dgEntry = currentDgEntry();
-  const dgEntryPathResolved = join6(stateDir, "dg-entry");
+  const dgEntryPathResolved = join5(stateDir, "dg-entry");
   if (dgEntry) {
     safeWriteFile(dgEntryPathResolved, dgEntry + "\n", 420);
     chownIfNeeded(dgEntryPathResolved, opts.targetUid, opts.targetGid);
@@ -3653,10 +3627,10 @@ function installShims(opts = {}) {
   const shimsCreated = [];
   for (const eco of ECOSYSTEMS) {
     const filename = shimFilename(eco, platform3);
-    const fullPath = join6(shimsDir, filename);
+    const fullPath = join5(shimsDir, filename);
     const body = renderShim({ ecosystem: eco, platform: platform3 });
     safeWriteFile(fullPath, body, platform3 === "windows" ? 420 : 493);
-    if (platform3 !== "windows") chmodSync4(fullPath, 493);
+    if (platform3 !== "windows") chmodSync3(fullPath, 493);
     chownIfNeeded(fullPath, opts.targetUid, opts.targetGid);
     shimsCreated.push(filename);
   }
@@ -3668,7 +3642,7 @@ function installShims(opts = {}) {
     resolvedRealBinaries[eco] = resolveRealBinary(eco);
   }
   const cachePathResolved = realBinaryCachePath();
-  if (existsSync8(cachePathResolved)) {
+  if (existsSync7(cachePathResolved)) {
     chownIfNeeded(cachePathResolved, opts.targetUid, opts.targetGid);
   }
   const rcOutcomes = [];
@@ -3703,7 +3677,7 @@ function installShims(opts = {}) {
     nodeVersion: process.version,
     dgVersion: process.env.DG_CLI_VERSION ?? "unknown"
   };
-  const receiptResolved = join6(stateDir, "install-receipt.json");
+  const receiptResolved = join5(stateDir, "install-receipt.json");
   safeWriteFile(receiptResolved, JSON.stringify(receipt, null, 2), 420);
   chownIfNeeded(receiptResolved, opts.targetUid, opts.targetGid);
   chownTreeIfNeeded(dgRoot2, opts.targetUid, opts.targetGid);
@@ -3719,31 +3693,31 @@ function installShims(opts = {}) {
 function uninstallShims(opts = {}) {
   const targetHome = opts.targetHome ?? homedir5();
   const platform3 = opts.platform ?? (process.platform === "win32" ? "windows" : "unix");
-  const shimsDir = join6(targetHome, ".dg", "shims");
-  const stateDir = join6(targetHome, ".dg", "state");
+  const shimsDir = join5(targetHome, ".dg", "shims");
+  const stateDir = join5(targetHome, ".dg", "state");
   const shimsRemoved = [];
-  if (existsSync8(shimsDir)) {
+  if (existsSync7(shimsDir)) {
     for (const eco of ECOSYSTEMS) {
       const filename = shimFilename(eco, platform3);
-      const fullPath = join6(shimsDir, filename);
-      if (existsSync8(fullPath)) {
+      const fullPath = join5(shimsDir, filename);
+      if (existsSync7(fullPath)) {
         safeUnlink(fullPath);
         shimsRemoved.push(filename);
       }
     }
   }
   const stateFiles = [
-    join6(stateDir, "shim-nonce"),
-    join6(stateDir, "dg-entry"),
-    join6(stateDir, "install-receipt.json"),
-    join6(stateDir, "real-binaries.json"),
-    join6(stateDir, "bypass.log"),
-    join6(stateDir, "wiring-hint-shown"),
-    join6(stateDir, "first-run-shown")
+    join5(stateDir, "shim-nonce"),
+    join5(stateDir, "dg-entry"),
+    join5(stateDir, "install-receipt.json"),
+    join5(stateDir, "real-binaries.json"),
+    join5(stateDir, "bypass.log"),
+    join5(stateDir, "wiring-hint-shown"),
+    join5(stateDir, "first-run-shown")
   ];
   const stateFilesRemoved = [];
   for (const f of stateFiles) {
-    if (existsSync8(f)) {
+    if (existsSync7(f)) {
       safeUnlink(f);
       stateFilesRemoved.push(f);
     }
@@ -3763,7 +3737,7 @@ function uninstallShims(opts = {}) {
 }
 function revertWindowsPath(targetHome, outcomes) {
   if (process.platform !== "win32") return;
-  const shimsDir = join6(targetHome, ".dg", "shims");
+  const shimsDir = join5(targetHome, ".dg", "shims");
   const currentPath = process.env.PATH ?? "";
   if (!currentPath.toLowerCase().includes(shimsDir.toLowerCase())) {
     outcomes.push({ status: "already-present", path: "user PATH (HKCU\\Environment)" });
@@ -3787,19 +3761,19 @@ function revertWindowsPath(targetHome, outcomes) {
 }
 function revertPowerShellProfile(targetHome, outcomes) {
   if (process.platform !== "win32") return;
-  const profilePath = join6(targetHome, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1");
-  if (!existsSync8(profilePath)) {
+  const profilePath = join5(targetHome, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1");
+  if (!existsSync7(profilePath)) {
     outcomes.push({ status: "already-present", path: profilePath });
     return;
   }
   try {
-    const existing = readFileSync7(profilePath, "utf-8");
+    const existing = readFileSync6(profilePath, "utf-8");
     if (!existing.includes(">>> dg-managed >>>")) {
       outcomes.push({ status: "already-present", path: profilePath });
       return;
     }
     const stripped = existing.replace(/\n?# >>> dg-managed >>>[\s\S]*?# <<< dg-managed <<<\n?/g, "");
-    writeFileSync6(profilePath, stripped, "utf-8");
+    writeFileSync5(profilePath, stripped, "utf-8");
     outcomes.push({ status: "appended", path: profilePath });
   } catch (e) {
     outcomes.push({ status: "failed", path: profilePath, reason: e.message });
@@ -4020,8 +3994,8 @@ var first_run_exports = {};
 __export(first_run_exports, {
   maybeShowWelcomePanel: () => maybeShowWelcomePanel
 });
-import { existsSync as existsSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { existsSync as existsSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
 function welcomeShownPath() {
   return dgStatePath("first-run-shown");
 }
@@ -4031,8 +4005,8 @@ function installReceiptPath2() {
 async function maybeShowWelcomePanel(opts) {
   if (SKIP_LIST.has(opts.rawCommand)) return;
   if (!opts.isInteractive) return;
-  if (existsSync9(welcomeShownPath())) return;
-  if (!existsSync9(installReceiptPath2())) return;
+  if (existsSync8(welcomeShownPath())) return;
+  if (!existsSync8(installReceiptPath2())) return;
   try {
     const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     const lines = [
@@ -4049,8 +4023,8 @@ async function maybeShowWelcomePanel(opts) {
     ];
     process.stderr.write(lines.join("\n"));
     try {
-      mkdirSync5(dirname7(welcomeShownPath()), { recursive: true });
-      writeFileSync7(welcomeShownPath(), (/* @__PURE__ */ new Date()).toISOString(), { encoding: "utf-8", mode: 420 });
+      mkdirSync4(dirname6(welcomeShownPath()), { recursive: true });
+      writeFileSync6(welcomeShownPath(), (/* @__PURE__ */ new Date()).toISOString(), { encoding: "utf-8", mode: 420 });
     } catch {
     }
   } catch {
@@ -39227,13 +39201,13 @@ var celebrate_exports = {};
 __export(celebrate_exports, {
   celebrateFirstLoginIfNew: () => celebrateFirstLoginIfNew
 });
-import { existsSync as existsSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync6 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
+import { existsSync as existsSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 function celebratedMarker() {
   return dgStatePath("login-celebrated");
 }
 function shouldCelebrate() {
-  if (existsSync11(celebratedMarker())) return false;
+  if (existsSync10(celebratedMarker())) return false;
   if (process.env.CI === "1" || process.env.CI === "true") return false;
   if (process.env.DG_NO_CELEBRATE === "1") return false;
   if (!process.stderr.isTTY) return false;
@@ -39241,8 +39215,8 @@ function shouldCelebrate() {
 }
 function writeCelebratedMarker() {
   try {
-    mkdirSync6(dirname8(celebratedMarker()), { recursive: true });
-    writeFileSync8(celebratedMarker(), (/* @__PURE__ */ new Date()).toISOString(), { encoding: "utf-8", mode: 420 });
+    mkdirSync5(dirname7(celebratedMarker()), { recursive: true });
+    writeFileSync7(celebratedMarker(), (/* @__PURE__ */ new Date()).toISOString(), { encoding: "utf-8", mode: 420 });
   } catch {
   }
 }
@@ -41487,7 +41461,7 @@ function mergeResponses(results) {
   const anyBlock = results.some((r) => r.action === "block");
   const anyWarn = results.some((r) => r.action === "warn");
   const anyIncomplete = results.some((r) => r.action === "analysis_incomplete") || allPackages.some((p) => Array.isArray(p.findings) && p.findings.some((f) => f.id === "analysis_incomplete"));
-  const action = maxScore >= 70 || anyBlock ? "block" : maxScore >= 60 || anyWarn ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
+  const action = anyBlock ? "block" : anyWarn ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
   const safeVersions = {};
   for (const r of results) {
     Object.assign(safeVersions, r.safeVersions);
@@ -42290,25 +42264,25 @@ var init_parse_package_json = __esm({
 });
 
 // src/lockfile/index.ts
-import { readFileSync as readFileSync9, existsSync as existsSync12, statSync as statSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { readFileSync as readFileSync8, existsSync as existsSync11, statSync as statSync3 } from "node:fs";
+import { join as join6 } from "node:path";
 function readFileSafe(path2) {
-  const size = statSync4(path2).size;
+  const size = statSync3(path2).size;
   if (size > MAX_LOCKFILE_BYTES) {
     throw new Error(`Lockfile too large (${(size / 1024 / 1024).toFixed(0)} MB, max 50 MB): ${path2}`);
   }
-  return readFileSync9(path2, "utf-8");
+  return readFileSync8(path2, "utf-8");
 }
 function discoverChanges(cwd2, config) {
   if (config.workspace) {
-    cwd2 = join7(cwd2, config.workspace);
+    cwd2 = join6(cwd2, config.workspace);
   }
   const lockfileInfo = findLockfile(cwd2);
   const pythonDepFiles = ["requirements.txt", "Pipfile.lock", "poetry.lock", "uv.lock"];
   let pythonPackages = [];
   const pythonSkipped = [];
   for (const pyFile of pythonDepFiles) {
-    if (existsSync12(join7(cwd2, pyFile))) {
+    if (existsSync11(join6(cwd2, pyFile))) {
       const pyPkgs = parsePythonDepFile(cwd2, pyFile);
       for (const p of pyPkgs) {
         if (p.version === "latest") {
@@ -42342,7 +42316,7 @@ function discoverChanges(cwd2, config) {
   const headParsed = parseLockfileByType(headContent, lockfileInfo.type);
   const directDeps = getDirectDeps(cwd2);
   if (config.baseLockfile) {
-    if (!existsSync12(config.baseLockfile)) {
+    if (!existsSync11(config.baseLockfile)) {
       throw new Error(`Base lockfile not found: ${config.baseLockfile}`);
     }
     const baseContent = readFileSafe(config.baseLockfile);
@@ -42367,8 +42341,8 @@ function discoverChanges(cwd2, config) {
         skipped: [...diff2.skipped, ...pythonSkipped]
       };
     }
-    const pkgJsonPath = join7(cwd2, "package.json");
-    if (existsSync12(pkgJsonPath)) {
+    const pkgJsonPath = join6(cwd2, "package.json");
+    if (existsSync11(pkgJsonPath)) {
       const headPkgJson = readFileSafe(pkgJsonPath);
       const basePkgJson = getGitBaseFile(cwd2, "package.json");
       if (basePkgJson !== null) {
@@ -42418,8 +42392,8 @@ function findLockfile(cwd2) {
     ["pnpm-lock.yaml", "pnpm"]
   ];
   for (const [name, type] of candidates) {
-    const p = join7(cwd2, name);
-    if (existsSync12(p)) return { path: p, type };
+    const p = join6(cwd2, name);
+    if (existsSync11(p)) return { path: p, type };
   }
   return null;
 }
@@ -42435,7 +42409,7 @@ function parseLockfileByType(content, type) {
 }
 function getDirectDeps(cwd2) {
   try {
-    const content = readFileSafe(join7(cwd2, "package.json"));
+    const content = readFileSafe(join6(cwd2, "package.json"));
     const pkg = JSON.parse(content);
     return /* @__PURE__ */ new Set([
       ...Object.keys(pkg.dependencies ?? {}),
@@ -42496,7 +42470,7 @@ function toPackageInput(change) {
   };
 }
 function parsePythonDepFile(projectDir, depFile) {
-  const content = readFileSafe(join7(projectDir, depFile));
+  const content = readFileSafe(join6(projectDir, depFile));
   if (depFile === "Pipfile.lock") {
     try {
       const parsed = JSON.parse(content);
@@ -42634,8 +42608,8 @@ var init_wrapper_shared = __esm({
 
 // src/commands/npm-wrapper.ts
 import { spawn as spawn2 } from "node:child_process";
-import { readFileSync as readFileSync10, existsSync as existsSync13, mkdtempSync, writeFileSync as writeFileSync9, rmSync as rmSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync9, existsSync as existsSync12, mkdtempSync, writeFileSync as writeFileSync8, rmSync } from "node:fs";
+import { join as join7 } from "node:path";
 import { tmpdir } from "node:os";
 function realNpmBinary() {
   const real = resolveRealBinary("npm");
@@ -42821,9 +42795,9 @@ async function resolveTreeNpm(specs) {
   if (safe.length === 0) {
     return { packages: [], ok: false, errorMessage: "all specs were flag-shaped (refused)" };
   }
-  const dir = mkdtempSync(join8(tmpdir(), "dg-resolve-"));
+  const dir = mkdtempSync(join7(tmpdir(), "dg-resolve-"));
   try {
-    writeFileSync9(join8(dir, "package.json"), '{"name":"_dg_resolve","version":"1.0.0","private":true}');
+    writeFileSync8(join7(dir, "package.json"), '{"name":"_dg_resolve","version":"1.0.0","private":true}');
     const stdout = await new Promise((resolve3) => {
       const child = spawn2(
         realNpmBinary(),
@@ -42882,7 +42856,7 @@ async function resolveTreeNpm(specs) {
     return { packages: [], ok: false, errorMessage: e.message };
   } finally {
     try {
-      rmSync2(dir, { recursive: true, force: true });
+      rmSync(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -42903,10 +42877,10 @@ function pinTopLevelArgs(rawArgs, userSpecs, tree) {
   });
 }
 function readLockfilePins(cwd2) {
-  const lockPath = join8(cwd2, "package-lock.json");
-  if (!existsSync13(lockPath)) return null;
+  const lockPath = join7(cwd2, "package-lock.json");
+  if (!existsSync12(lockPath)) return null;
   try {
-    const lock = JSON.parse(readFileSync10(lockPath, "utf-8"));
+    const lock = JSON.parse(readFileSync9(lockPath, "utf-8"));
     const pins = /* @__PURE__ */ new Map();
     const root = lock.packages?.[""] ?? {};
     const directDeps = /* @__PURE__ */ new Set([
@@ -42933,10 +42907,10 @@ function readBareInstallPackages(cwd2) {
   return readBareInstallPackagesTyped(cwd2).map((s) => s.spec);
 }
 function readBareInstallPackagesTyped(cwd2) {
-  const pkgPath = join8(cwd2, "package.json");
-  if (!existsSync13(pkgPath)) return [];
+  const pkgPath = join7(cwd2, "package.json");
+  if (!existsSync12(pkgPath)) return [];
   try {
-    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
     const lockPins = readLockfilePins(cwd2) ?? /* @__PURE__ */ new Map();
     const out = [];
     const addOne = (name, range) => {
@@ -42986,7 +42960,7 @@ var init_npm_wrapper = __esm({
 
 // src/commands/pip-wrapper.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 function parsePipArgs(args) {
   const { filtered, dgForce, dgForceReason, dgNoScripts } = stripDgFlags(args);
   const command = filtered[0] ?? "";
@@ -43046,7 +43020,7 @@ function parseRequirementsFile(filePath) {
   return parseRequirementsFileInternal(filePath, /* @__PURE__ */ new Set());
 }
 function parseRequirementsFileInternal(filePath, visited) {
-  if (!existsSync14(filePath)) return [];
+  if (!existsSync13(filePath)) return [];
   let absPath;
   try {
     absPath = __require("node:path").resolve(filePath);
@@ -43550,8 +43524,8 @@ var FileSavePrompt_exports = {};
 __export(FileSavePrompt_exports, {
   FileSavePrompt: () => FileSavePrompt
 });
-import { existsSync as existsSync15, readdirSync as readdirSync2, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname9, join as join9 } from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync2, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname8, join as join8 } from "node:path";
 function listDirectory(dir) {
   try {
     const raw = readdirSync2(dir, { withFileTypes: true });
@@ -43559,7 +43533,7 @@ function listDirectory(dir) {
       if (a.isDirectory !== b.isDirectory) return a.isDirectory ? -1 : 1;
       return a.name.localeCompare(b.name);
     });
-    if (dirname9(dir) !== dir) {
+    if (dirname8(dir) !== dir) {
       entries.unshift({ name: "..", isDirectory: true });
     }
     return entries;
@@ -43654,13 +43628,13 @@ var init_FileSavePrompt = __esm({
         if (state.focus === "filename") {
           if (key.return) {
             const fullName = ensureJsonExtension(state.filename);
-            const fullPath = join9(state.directory, fullName);
-            if (!state.confirmOverwrite && existsSync15(fullPath)) {
+            const fullPath = join8(state.directory, fullName);
+            if (!state.confirmOverwrite && existsSync14(fullPath)) {
               dispatch({ type: "CONFIRM_OVERWRITE" });
               return;
             }
             try {
-              writeFileSync10(fullPath, json + "\n");
+              writeFileSync9(fullPath, json + "\n");
             } catch (err) {
               const msg = err instanceof Error ? err.message : String(err);
               dispatch({ type: "SET_ERROR", error: `Write failed: ${msg}` });
@@ -43914,7 +43888,7 @@ __export(walker_exports, {
   discoverProjectsAsync: () => discoverProjectsAsync
 });
 import { readdir, lstat } from "node:fs/promises";
-import { join as join10, relative } from "node:path";
+import { join as join9, relative } from "node:path";
 async function discoverProjectsAsync(root, opts = {}) {
   const queue = [{ dir: root, depth: 0 }];
   const projects = [];
@@ -43967,7 +43941,7 @@ async function scanDir(dir, depth, _root) {
   for (const lockfile of NPM_LOCKFILES) {
     const e = byName.get(lockfile);
     if (e && e.isFile() && !e.isSymbolicLink()) {
-      const lockPath = join10(dir, lockfile);
+      const lockPath = join9(dir, lockfile);
       if (await isSafeRegularFile(lockPath)) {
         lockfileHits.push({ dir, lockPath, depFile: lockfile, isNpm: true });
       }
@@ -43977,7 +43951,7 @@ async function scanDir(dir, depth, _root) {
   for (const depFile of PYTHON_DEPFILES) {
     const e = byName.get(depFile);
     if (e && e.isFile() && !e.isSymbolicLink()) {
-      const lockPath = join10(dir, depFile);
+      const lockPath = join9(dir, depFile);
       if (await isSafeRegularFile(lockPath)) {
         lockfileHits.push({ dir, lockPath, depFile, isNpm: false });
       }
@@ -43988,7 +43962,7 @@ async function scanDir(dir, depth, _root) {
     for (const e of entries) {
       if (!e.isDirectory() || e.isSymbolicLink()) continue;
       if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
-      subdirs.push({ dir: join10(dir, e.name), depth: depth + 1 });
+      subdirs.push({ dir: join9(dir, e.name), depth: depth + 1 });
     }
   }
   return { subdirs, lockfileHits };
@@ -44080,8 +44054,10 @@ async function scanProjectAtPath(cwd2, config, onProgress) {
       };
     }
     const maxScore = allPackages.length > 0 ? Math.max(0, ...allPackages.map((p) => p.score)) : 0;
+    const anyBlock = responses.some((r) => r.action === "block") || allPackages.some((p) => p.action === "block");
+    const anyWarn = responses.some((r) => r.action === "warn") || allPackages.some((p) => p.action === "warn");
     const anyIncomplete = responses.some((r) => r.action === "analysis_incomplete") || allPackages.some((p) => Array.isArray(p.findings) && p.findings.some((f) => f?.id === "analysis_incomplete"));
-    const action = maxScore >= 70 ? "block" : maxScore >= 60 ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
+    const action = anyBlock ? "block" : anyWarn ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
     const safeVersions = {};
     for (const r of responses) Object.assign(safeVersions, r.safeVersions);
     const totalDuration = elapsedMs();
@@ -44207,8 +44183,10 @@ async function scanConsolidated(projectPaths, config, onProgress) {
       };
     }
     const maxScore = allPackages.length > 0 ? Math.max(0, ...allPackages.map((p) => p.score)) : 0;
+    const anyBlock = responses.some((r) => r.action === "block") || allPackages.some((p) => p.action === "block");
+    const anyWarn = responses.some((r) => r.action === "warn") || allPackages.some((p) => p.action === "warn");
     const anyIncomplete = responses.some((r) => r.action === "analysis_incomplete") || allPackages.some((p) => Array.isArray(p.findings) && p.findings.some((f) => f?.id === "analysis_incomplete"));
-    const action = maxScore >= 70 ? "block" : maxScore >= 60 ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
+    const action = anyBlock ? "block" : anyWarn ? "warn" : anyIncomplete ? "analysis_incomplete" : "pass";
     const safeVersions = {};
     for (const r of responses) Object.assign(safeVersions, r.safeVersions);
     const totalDuration = elapsedMs();
@@ -44275,8 +44253,8 @@ __export(allowlist_exports, {
   loadAllowlist: () => loadAllowlist,
   validateAllowlist: () => validateAllowlist
 });
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
-import { join as join11, dirname as dirname10 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
+import { join as join10, dirname as dirname9 } from "node:path";
 function isExpired(expires) {
   if (!expires) return false;
   const date = new Date(expires);
@@ -44286,9 +44264,9 @@ function isExpired(expires) {
 function findAllowlistFile(startDir) {
   let dir = startDir;
   for (let i = 0; i < 32; i++) {
-    const candidate = join11(dir, ALLOWLIST_FILENAME);
-    if (existsSync16(candidate)) return candidate;
-    const parent = dirname10(dir);
+    const candidate = join10(dir, ALLOWLIST_FILENAME);
+    if (existsSync15(candidate)) return candidate;
+    const parent = dirname9(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -44397,7 +44375,7 @@ function loadAllowlist(cwd2) {
   if (!path2) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync11(path2, "utf-8"));
+    raw = JSON.parse(readFileSync10(path2, "utf-8"));
   } catch (e) {
     process.stderr.write(
       `dg: .dg-allowlist.json at ${path2} is not valid JSON (${e.message}). Ignoring.
@@ -44428,18 +44406,8 @@ function packageMatches(entry, pkg, apiKind) {
   if (entry.version && entry.version !== pkg.version) return false;
   return true;
 }
-function derivePackageActionFromFindings(pkg) {
-  const findings = pkg.findings ?? [];
-  if (findings.length === 0) return "pass";
-  const maxSev = findings.reduce((m, f) => Math.max(m, f.severity ?? 0), 0);
-  if (maxSev >= 4) return "block";
-  if (maxSev >= 2) return "warn";
-  return "pass";
-}
 function derivePackageAction(pkg) {
-  if (pkg.action === "block" || pkg.action === "warn" || pkg.action === "pass") return pkg.action;
-  if (pkg.score >= 70) return "block";
-  if (pkg.score >= 60) return "warn";
+  if (pkg.action === "block" || pkg.action === "warn") return pkg.action;
   return "pass";
 }
 function overallAction(packages) {
@@ -44501,7 +44469,8 @@ function applyAllowlist(allowlist, result, apiKind) {
     const globallySupressed = findings.filter((f) => activeGlobalRules[findingRuleId(f)] !== void 0);
     suppressedCount += globallySupressed.length;
     findings = findings.filter((f) => activeGlobalRules[findingRuleId(f)] === void 0);
-    const action = findings.length !== originalCount ? derivePackageActionFromFindings({ ...pkg, findings }) : pkg.action ?? derivePackageAction(pkg);
+    const fullyAllowlisted = originalCount > 0 && findings.length === 0;
+    const action = fullyAllowlisted ? "pass" : pkg.action ?? "pass";
     return { ...pkg, findings, action };
   });
   const newAction = overallAction(filteredPackages);
@@ -44547,7 +44516,29 @@ function findingFingerprint(pkg, f) {
 function buildSarif(response, opts = {}) {
   const ruleMap = /* @__PURE__ */ new Map();
   const results = [];
+  const INCOMPLETE_RULE = "dg.analysis_incomplete";
   for (const pkg of response.packages) {
+    if (pkg.action === "analysis_incomplete") {
+      if (!ruleMap.has(INCOMPLETE_RULE)) {
+        ruleMap.set(INCOMPLETE_RULE, {
+          id: INCOMPLETE_RULE,
+          name: INCOMPLETE_RULE,
+          shortDescription: { text: "Package could not be fully analyzed \u2014 treat as unverified" },
+          defaultConfiguration: { level: "warning" }
+        });
+      }
+      results.push({
+        ruleId: INCOMPLETE_RULE,
+        level: "warning",
+        message: { text: `${pkg.name} ${pkg.version}: analysis incomplete \u2014 the scanner could not fully evaluate this package. Treat as unverified, not safe.` },
+        locations: [{
+          physicalLocation: {
+            artifactLocation: { uri: opts.lockfileUri ?? `dg:${pkg.name}@${pkg.version}` }
+          }
+        }],
+        partialFingerprints: { dg_finding: `${pkg.name}@${pkg.version}#${INCOMPLETE_RULE}`.slice(0, 240) }
+      });
+    }
     const findings = pkg.findings ?? [];
     for (const f of findings) {
       const id = findingId(f);
@@ -44686,8 +44677,8 @@ __export(audit_dispatcher_exports, {
   recordBypassLocally: () => recordBypassLocally,
   shouldFireAudit: () => shouldFireAudit
 });
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync7, existsSync as existsSync17 } from "node:fs";
-import { dirname as dirname11 } from "node:path";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync6, existsSync as existsSync16 } from "node:fs";
+import { dirname as dirname10 } from "node:path";
 function _setPolicyFetcherForTests(fn) {
   _policyOverride = fn;
 }
@@ -44736,8 +44727,8 @@ function bypassLogPath2() {
 function recordBypassLocally(record) {
   try {
     const path2 = bypassLogPath2();
-    const dir = dirname11(path2);
-    if (!existsSync17(dir)) mkdirSync7(dir, { recursive: true, mode: 448 });
+    const dir = dirname10(path2);
+    if (!existsSync16(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
     const full = {
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       cwd: record.cwd ?? process.cwd(),
@@ -44800,8 +44791,8 @@ __export(static_output_exports, {
   runStaticPip: () => runStaticPip,
   scanExitCode: () => scanExitCode
 });
-import { writeFileSync as writeFileSync11, readFileSync as readFileSync12, existsSync as existsSync18, mkdirSync as mkdirSync8, lstatSync as lstatSync5 } from "node:fs";
-import { resolve as resolvePath, dirname as dirname12 } from "node:path";
+import { writeFileSync as writeFileSync10, readFileSync as readFileSync11, existsSync as existsSync17, mkdirSync as mkdirSync7, lstatSync as lstatSync5 } from "node:fs";
+import { resolve as resolvePath, dirname as dirname11 } from "node:path";
 function note(config, text) {
   if (config.quiet) return;
   process.stderr.write(text);
@@ -44821,12 +44812,12 @@ function wrapperPackagesFromResult(result, topLevelNames) {
 }
 function loadPackageLockJson(cwd2 = process.cwd()) {
   const path2 = resolvePath(cwd2, "package-lock.json");
-  if (!existsSync18(path2)) return null;
+  if (!existsSync17(path2)) return null;
   try {
     const st = lstatSync5(path2);
     if (!st.isFile()) return null;
     if (st.size > MAX_PACKAGE_LOCK_BYTES) return null;
-    return JSON.parse(readFileSync12(path2, "utf8"));
+    return JSON.parse(readFileSync11(path2, "utf8"));
   } catch {
     return null;
   }
@@ -44834,7 +44825,7 @@ function loadPackageLockJson(cwd2 = process.cwd()) {
 function writeJsonFile(filepath, json) {
   const resolved = resolvePath(filepath);
   try {
-    writeFileSync11(resolved, json + "\n");
+    writeFileSync10(resolved, json + "\n");
     process.stderr.write(import_chalk5.default.green(`  \u2713 Saved to ${resolved}
 
 `));
@@ -44919,11 +44910,11 @@ function printTrialBanner(result, config) {
   if (process.env.CI === "1" || process.env.CI === "true") return;
   try {
     const stampPath = dgStatePath("trial-banner");
-    const lastMs = existsSync18(stampPath) ? Number(readFileSync12(stampPath, "utf-8").trim()) || 0 : 0;
+    const lastMs = existsSync17(stampPath) ? Number(readFileSync11(stampPath, "utf-8").trim()) || 0 : 0;
     const now = Date.now();
     if (now - lastMs < NUDGE_INTERVAL_MS) return;
-    mkdirSync8(dirname12(stampPath), { recursive: true, mode: 448 });
-    writeFileSync11(stampPath, String(now) + "\n", { mode: 384 });
+    mkdirSync7(dirname11(stampPath), { recursive: true, mode: 448 });
+    writeFileSync10(stampPath, String(now) + "\n", { mode: 384 });
   } catch {
     return;
   }
@@ -44972,6 +44963,7 @@ function handleFreeCapReached2(error, jsonMode = false) {
 function actionColor(action) {
   if (action === "block") return import_chalk5.default.red;
   if (action === "warn") return import_chalk5.default.yellow;
+  if (action === "analysis_incomplete") return import_chalk5.default.cyan;
   return import_chalk5.default.green;
 }
 function actionBadge(pkg) {
@@ -44980,15 +44972,16 @@ function actionBadge(pkg) {
   if (a === "warn") return { label: "Warn", color: import_chalk5.default.yellow };
   if (a === "pass") return { label: "Pass", color: import_chalk5.default.green };
   if (a === "analysis_incomplete") return { label: "Unknown", color: import_chalk5.default.cyan };
-  if (pkg.score >= 70) return { label: "Block", color: import_chalk5.default.red };
-  if (pkg.score >= 60) return { label: "Warn", color: import_chalk5.default.yellow };
   return { label: "Pass", color: import_chalk5.default.green };
 }
 function isBlocked(p) {
-  return p.action === "block" || p.action === void 0 && p.score >= 70;
+  return p.action === "block";
 }
 function isWarned(p) {
-  return p.action === "warn" || p.action === void 0 && p.score >= 60 && p.score < 70;
+  return p.action === "warn";
+}
+function isIncomplete(p) {
+  return p.action === "analysis_incomplete";
 }
 function renderResultClean(result, _config) {
   const lines = [];
@@ -45001,7 +44994,8 @@ function renderResultClean(result, _config) {
   }
   const blocked = result.packages.filter(isBlocked);
   const warned = result.packages.filter(isWarned);
-  if (result.action === "pass" && blocked.length === 0 && warned.length === 0) {
+  const incomplete = result.packages.filter(isIncomplete);
+  if (result.action === "pass" && blocked.length === 0 && warned.length === 0 && incomplete.length === 0) {
     lines.push("");
     lines.push(`  ${import_chalk5.default.green("\u2713")} ${import_chalk5.default.bold("Dependency Guardian")} checked ${total} package${total !== 1 ? "s" : ""}. ${import_chalk5.default.green("No risky behavior found.")}`);
     if (result.durationMs) {
@@ -45010,11 +45004,18 @@ function renderResultClean(result, _config) {
     lines.push("");
     return lines.join("\n");
   }
-  const headerColor = result.action === "block" ? import_chalk5.default.red : import_chalk5.default.yellow;
-  const headerLabel = result.action === "block" ? "BLOCK" : "WARN";
+  const headerLabel = result.action === "block" ? "BLOCK" : result.action === "warn" ? "WARN" : result.action === "analysis_incomplete" ? "UNKNOWN" : "PASS";
+  const headerColor = actionColor(result.action);
+  const cleanCount = total - blocked.length - warned.length - incomplete.length;
+  const countParts = [
+    `${blocked.length} block`,
+    `${warned.length} warn`,
+    ...incomplete.length > 0 ? [`${incomplete.length} unknown`] : [],
+    `${cleanCount} clean`
+  ];
   lines.push("");
   lines.push(`  ${headerColor(import_chalk5.default.bold(headerLabel))}  ${import_chalk5.default.bold("Dependency Guardian")} ${import_chalk5.default.dim(`(score ${result.score})`)}`);
-  lines.push(`  ${import_chalk5.default.dim(`${total} package${total !== 1 ? "s" : ""} scanned \xB7 ${blocked.length} block \xB7 ${warned.length} warn \xB7 ${total - blocked.length - warned.length} clean`)}`);
+  lines.push(`  ${import_chalk5.default.dim(`${total} package${total !== 1 ? "s" : ""} scanned \xB7 ${countParts.join(" \xB7 ")}`)}`);
   lines.push("");
   const showFirst = (pkgs, color, label) => {
     if (pkgs.length === 0) return;
@@ -45030,10 +45031,13 @@ function renderResultClean(result, _config) {
   };
   showFirst(blocked, import_chalk5.default.red, "Blocked");
   showFirst(warned, import_chalk5.default.yellow, "Warnings");
+  showFirst(incomplete, import_chalk5.default.cyan, "Could not analyze");
   if (result.action === "block") {
     lines.push(`  ${import_chalk5.default.dim("Next step:")} review the findings above, then either pin a safe version or use ${import_chalk5.default.bold("--dg-force")} to bypass.`);
   } else if (result.action === "warn") {
     lines.push(`  ${import_chalk5.default.dim("Next step:")} review the warnings; install proceeds unless you set ${import_chalk5.default.bold("--mode block")}.`);
+  } else if (result.action === "analysis_incomplete") {
+    lines.push(`  ${import_chalk5.default.dim("Next step:")} one or more packages could not be fully analyzed \u2014 treat as unverified, not safe. Re-run to retry.`);
   }
   lines.push("");
   return lines.join("\n");
@@ -45052,13 +45056,21 @@ function renderResultDetails(result, _config) {
   lines.push("");
   const blocked = result.packages.filter(isBlocked);
   const warned = result.packages.filter(isWarned);
-  const passWithScore = result.packages.filter((p) => p.score > 0 && p.score < 60);
-  const clean = result.packages.filter((p) => p.score === 0);
+  const incomplete = result.packages.filter(isIncomplete);
+  const rest = result.packages.filter((p) => !isBlocked(p) && !isWarned(p) && !isIncomplete(p));
+  const passWithScore = rest.filter((p) => p.score > 0 && p.score < 60);
+  const clean = rest.filter((p) => p.score === 0);
   const total = result.packages.length;
   const needsAttention = blocked.length + warned.length;
-  if (needsAttention > 0) {
+  if (needsAttention > 0 || incomplete.length > 0) {
+    const segs = [
+      import_chalk5.default.red(`${blocked.length} block`),
+      import_chalk5.default.yellow(`${warned.length} warn`),
+      ...incomplete.length > 0 ? [import_chalk5.default.cyan(`${incomplete.length} unknown`)] : [],
+      import_chalk5.default.green(`${clean.length + passWithScore.length} pass`)
+    ];
     lines.push(
-      `  ${total} package${total !== 1 ? "s" : ""} scanned ${import_chalk5.default.dim("\u2502")} ${import_chalk5.default.red(`${blocked.length} block`)} ${import_chalk5.default.dim("\u2502")} ${import_chalk5.default.yellow(`${warned.length} warn`)} ${import_chalk5.default.dim("\u2502")} ${import_chalk5.default.green(`${clean.length + passWithScore.length} pass`)}`
+      `  ${total} package${total !== 1 ? "s" : ""} scanned ${import_chalk5.default.dim("\u2502")} ${segs.join(` ${import_chalk5.default.dim("\u2502")} `)}`
     );
   } else {
     lines.push(
@@ -45071,8 +45083,8 @@ function renderResultDetails(result, _config) {
     lines.push("");
     return lines.join("\n");
   }
-  if (needsAttention > 0) {
-    const groups = groupPackages([...blocked, ...warned]);
+  if (needsAttention > 0 || incomplete.length > 0) {
+    const groups = groupPackages([...blocked, ...warned, ...incomplete]);
     lines.push(`  ${import_chalk5.default.bold("Needs Attention")}`);
     lines.push(`  ${import_chalk5.default.dim("\u2500".repeat(60))}`);
     for (const group of groups) {
@@ -45254,8 +45266,8 @@ async function runStatic(config) {
     const sarif = emitSarif2(result, {});
     const outputPath = config.outputFile;
     if (outputPath) {
-      const { writeFileSync: writeFileSync16 } = await import("node:fs");
-      writeFileSync16(outputPath, sarif);
+      const { writeFileSync: writeFileSync15 } = await import("node:fs");
+      writeFileSync15(outputPath, sarif);
       process.stderr.write(import_chalk5.default.green(`  \u2713 Wrote SARIF to ${outputPath}
 `));
     } else {
@@ -46016,13 +46028,13 @@ __export(status_exports, {
   collectStatusSnapshot: () => collectStatusSnapshot,
   handleStatusCommand: () => handleStatusCommand
 });
-import { existsSync as existsSync19, readFileSync as readFileSync13 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
+import { join as join11 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 function readPythonReceipt() {
   try {
-    const { readFileSync: readFileSync18 } = __require("node:fs");
-    const receipt = JSON.parse(readFileSync18(dgStatePath("python-hook-receipt.json"), "utf-8"));
+    const { readFileSync: readFileSync17 } = __require("node:fs");
+    const receipt = JSON.parse(readFileSync17(dgStatePath("python-hook-receipt.json"), "utf-8"));
     const rows = receipt?.results ?? [];
     return rows.map((r) => ({ pythonVersion: r.pythonVersion, status: r.status, reason: r.reason }));
   } catch {
@@ -46065,12 +46077,12 @@ async function collectStatusSnapshot(cliVersion2) {
       authPart.reachable = false;
     }
   }
-  const shimDir2 = join12(homedir6(), ".dg", "shims");
+  const shimDir2 = join11(homedir6(), ".dg", "shims");
   const shimRows = ECOSYSTEMS.map((eco) => {
     const filename = process.platform === "win32" ? `${eco}.cmd` : eco;
     return {
       ecosystem: eco,
-      shimPresent: existsSync19(join12(shimDir2, filename))
+      shimPresent: existsSync18(join11(shimDir2, filename))
     };
   });
   const engineResolvable = isEngineResolvable();
@@ -46078,11 +46090,11 @@ async function collectStatusSnapshot(cliVersion2) {
   const cwd2 = process.cwd();
   const hookPart = { installed: false };
   try {
-    const { existsSync: ex, readFileSync: readFileSync18 } = await import("node:fs");
-    const candidates = [join12(cwd2, ".husky", "pre-commit"), join12(cwd2, ".git", "hooks", "pre-commit")];
+    const { existsSync: ex, readFileSync: readFileSync17 } = await import("node:fs");
+    const candidates = [join11(cwd2, ".husky", "pre-commit"), join11(cwd2, ".git", "hooks", "pre-commit")];
     for (const p of candidates) {
       if (ex(p)) {
-        const content = readFileSync18(p, "utf-8");
+        const content = readFileSync17(p, "utf-8");
         if (content.includes("dependency-guardian")) {
           hookPart.installed = true;
           break;
@@ -46113,8 +46125,8 @@ async function collectStatusSnapshot(cliVersion2) {
 }
 function isEngineResolvable() {
   try {
-    const recorded = readFileSync13(join12(homedir6(), ".dg", "state", "dg-entry"), "utf-8").trim();
-    if (recorded && existsSync19(recorded)) return true;
+    const recorded = readFileSync12(join11(homedir6(), ".dg", "state", "dg-entry"), "utf-8").trim();
+    if (recorded && existsSync18(recorded)) return true;
   } catch {
   }
   try {
@@ -46591,16 +46603,15 @@ var InteractiveResultsView_exports = {};
 __export(InteractiveResultsView_exports, {
   InteractiveResultsView: () => InteractiveResultsView
 });
-import { writeFileSync as writeFileSync12 } from "node:fs";
+import { writeFileSync as writeFileSync11 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function groupPackages2(packages) {
   return groupPackages(packages, "fingerprint");
 }
-function actionBadge2(score) {
-  if (score >= 70)
-    return { label: "Block", color: import_chalk9.default.red };
-  if (score >= 60)
-    return { label: "Warn", color: import_chalk9.default.yellow };
+function actionBadge2(action) {
+  if (action === "block") return { label: "Block", color: import_chalk9.default.red };
+  if (action === "warn") return { label: "Warn", color: import_chalk9.default.yellow };
+  if (action === "analysis_incomplete") return { label: "Unknown", color: import_chalk9.default.cyan };
   return { label: "Pass", color: import_chalk9.default.green };
 }
 function findingsSummaryHeight(group) {
@@ -46797,11 +46808,11 @@ var init_InteractiveResultsView = __esm({
       const scanUsage = usageDisplay ? usageDisplay.text : result.freeScansRemaining !== void 0 ? `${result.freeScansRemaining.toLocaleString()} packages left` : scanUsageProp;
       const usageNearLimit = usageDisplay?.nearLimit ?? false;
       const flagged = (0, import_react30.useMemo)(
-        () => result.packages.filter((p) => p.score > 0),
+        () => result.packages.filter((p) => p.score > 0 || p.action === "analysis_incomplete"),
         [result.packages]
       );
       const clean = (0, import_react30.useMemo)(
-        () => result.packages.filter((p) => p.score === 0),
+        () => result.packages.filter((p) => p.score === 0 && p.action !== "analysis_incomplete"),
         [result.packages]
       );
       const total = result.packages.length;
@@ -46859,8 +46870,8 @@ var init_InteractiveResultsView = __esm({
         setExportMenu({ scope: defaultScope, format: "json", activeRow: "scope" });
       };
       const buildExportPayload = (scope, currentLicenseIdx) => {
-        const blocked = result.packages.filter((p) => p.score >= 70);
-        const warned = result.packages.filter((p) => p.score >= 60 && p.score < 70);
+        const blocked = result.packages.filter((p) => p.action === "block");
+        const warned = result.packages.filter((p) => p.action === "warn");
         const cleanPkgs = result.packages.filter((p) => p.score === 0);
         const passWithScore = result.packages.filter((p) => p.score > 0 && p.score < 60);
         const summary = {
@@ -46907,7 +46918,7 @@ var init_InteractiveResultsView = __esm({
             name: p.name,
             version: p.version,
             score: p.score,
-            action: p.score >= 70 ? "block" : "warn",
+            action: p.action,
             findings: p.findings.map((f) => ({
               severity: f.severity,
               category: f.category ?? null,
@@ -47098,7 +47109,7 @@ var init_InteractiveResultsView = __esm({
           const scopeTag = scope === "current-license" && currentLicenseIdx !== null ? `${(licenseGroups[currentLicenseIdx]?.spdx ?? "license").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 32)}` : scope;
           const filename = `dg-scan-${ts}-${scopeTag}.${ext}`;
           const path2 = resolvePath2(process.cwd(), filename);
-          writeFileSync12(path2, body, "utf-8");
+          writeFileSync11(path2, body, "utf-8");
           showExportMsg(`\u2713 Exported to ${filename}`);
         } catch (e) {
           showExportMsg(`Export failed: ${e.message}`);
@@ -47883,7 +47894,7 @@ var init_InteractiveResultsView = __esm({
           setDetailPane(null);
         } else {
           const dpRep = dpGroup.packages[0];
-          const { color: dpColor } = actionBadge2(dpRep.score);
+          const { color: dpColor } = actionBadge2(dpRep.action);
           const dpScroll = detailPane.scroll;
           const dpAbove = dpScroll;
           const dpBelow = Math.max(0, detailLines.length - dpScroll - detailContentRows);
@@ -48016,7 +48027,7 @@ var init_InteractiveResultsView = __esm({
                   const isCursor = globalIdx === clampedCursor;
                   const level = getLevel(globalIdx);
                   const rep = group.packages[0];
-                  const { label, color } = actionBadge2(rep.score);
+                  const { label, color } = actionBadge2(rep.action);
                   const names = groupNames(group);
                   const scoreStr = String(rep.score);
                   const lcInfo = rep.license;
@@ -48502,8 +48513,8 @@ __export(publish_check_exports, {
   summarize: () => summarize
 });
 import { spawn as spawn4 } from "node:child_process";
-import { readFileSync as readFileSync14, existsSync as existsSync20, readdirSync as readdirSync3 } from "node:fs";
-import { join as join13, basename as basename2 } from "node:path";
+import { readFileSync as readFileSync13, existsSync as existsSync19, readdirSync as readdirSync3 } from "node:fs";
+import { join as join12, basename as basename2 } from "node:path";
 import { createGunzip } from "node:zlib";
 import { createReadStream } from "node:fs";
 function sanitizeSnippet(s, max = 40) {
@@ -48550,7 +48561,7 @@ async function npmPackDryRun(cwd2 = process.cwd()) {
         }));
         let packageJson;
         try {
-          const raw = readFileSync14(join13(cwd2, "package.json"), "utf-8");
+          const raw = readFileSync13(join12(cwd2, "package.json"), "utf-8");
           packageJson = JSON.parse(raw);
         } catch {
         }
@@ -48562,9 +48573,9 @@ async function npmPackDryRun(cwd2 = process.cwd()) {
   });
 }
 function findPypiArtifacts(cwd2 = process.cwd()) {
-  const dist = join13(cwd2, "dist");
-  if (!existsSync20(dist)) return [];
-  return readdirSync3(dist).filter((f) => f.endsWith(".tar.gz") || f.endsWith(".whl")).map((f) => join13(dist, f));
+  const dist = join12(cwd2, "dist");
+  if (!existsSync19(dist)) return [];
+  return readdirSync3(dist).filter((f) => f.endsWith(".tar.gz") || f.endsWith(".whl")).map((f) => join12(dist, f));
 }
 function scanPayload(files) {
   const findings = [];
@@ -48638,7 +48649,7 @@ async function runNpmPublishCheck(cwd2 = process.cwd()) {
   const payload = pack.files.map((f) => ({
     path: f.path,
     size: f.size,
-    read: () => readFileSync14(join13(cwd2, f.path))
+    read: () => readFileSync13(join12(cwd2, f.path))
   }));
   const findings = scanPayload(payload);
   const scripts = pack.packageJson?.scripts ?? {};
@@ -48886,8 +48897,8 @@ var init_publish_check = __esm({
 });
 
 // src/state/hooks_registry.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync13, chmodSync as chmodSync5 } from "node:fs";
-import { dirname as dirname13, isAbsolute as isAbsolute2, normalize as normalize2 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync12, chmodSync as chmodSync4 } from "node:fs";
+import { dirname as dirname12, isAbsolute as isAbsolute2, normalize as normalize2 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 function registryPath() {
   return dgStatePath("hooks-installed.json");
@@ -48929,10 +48940,10 @@ function validateEntry(raw) {
 }
 function readRegistry() {
   const path2 = registryPath();
-  if (!existsSync21(path2)) return [];
+  if (!existsSync20(path2)) return [];
   let raw;
   try {
-    raw = readFileSync15(path2, "utf-8");
+    raw = readFileSync14(path2, "utf-8");
   } catch {
     return [];
   }
@@ -48954,12 +48965,12 @@ function readRegistry() {
 }
 function writeRegistry(entries) {
   const path2 = registryPath();
-  const parent = dirname13(path2);
-  if (!existsSync21(parent)) mkdirSync9(parent, { recursive: true, mode: 448 });
+  const parent = dirname12(path2);
+  if (!existsSync20(parent)) mkdirSync8(parent, { recursive: true, mode: 448 });
   const payload = { version: 1, entries };
-  writeFileSync13(path2, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  writeFileSync12(path2, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    chmodSync5(path2, 384);
+    chmodSync4(path2, 384);
   } catch {
   }
 }
@@ -49005,20 +49016,20 @@ __export(hook_exports, {
 });
 import { createHash } from "node:crypto";
 import {
-  existsSync as existsSync22,
+  existsSync as existsSync21,
   lstatSync as lstatSync6,
-  readFileSync as readFileSync16,
-  writeFileSync as writeFileSync14,
-  mkdirSync as mkdirSync10,
-  chmodSync as chmodSync6,
-  unlinkSync as unlinkSync5
+  readFileSync as readFileSync15,
+  writeFileSync as writeFileSync13,
+  mkdirSync as mkdirSync9,
+  chmodSync as chmodSync5,
+  unlinkSync as unlinkSync4
 } from "node:fs";
-import { join as join14, dirname as dirname14, resolve as resolvePath3, isAbsolute as isAbsolute3 } from "node:path";
+import { join as join13, dirname as dirname13, resolve as resolvePath3, isAbsolute as isAbsolute3 } from "node:path";
 function hashRepoPath(repoPath) {
   return createHash("sha256").update(repoPath).digest("hex");
 }
 function assertSafeWriteTarget(target) {
-  const parent = dirname14(target);
+  const parent = dirname13(target);
   try {
     const parentStat = lstatSync6(parent);
     if (parentStat.isSymbolicLink()) {
@@ -49046,7 +49057,7 @@ function assertSafeWriteTarget(target) {
 }
 function safeWriteFileSync(target, content) {
   assertSafeWriteTarget(target);
-  writeFileSync14(target, content);
+  writeFileSync13(target, content);
 }
 function findHooksDir() {
   try {
@@ -49064,13 +49075,13 @@ function findRepoRoot() {
 }
 function detectHookFramework(repoRoot) {
   const root = repoRoot ?? findRepoRoot();
-  const huskyHook = join14(root, ".husky", "pre-commit");
-  const lefthookConfig = join14(root, "lefthook.yml");
-  const lefthookConfigYaml = join14(root, "lefthook.yaml");
+  const huskyHook = join13(root, ".husky", "pre-commit");
+  const lefthookConfig = join13(root, "lefthook.yml");
+  const lefthookConfigYaml = join13(root, "lefthook.yaml");
   const hooksDir = findHooksDir();
-  const bareHook = join14(hooksDir, "pre-commit");
-  if (existsSync22(huskyHook)) {
-    const content = readFileSync16(huskyHook, "utf-8");
+  const bareHook = join13(hooksDir, "pre-commit");
+  if (existsSync21(huskyHook)) {
+    const content = readFileSync15(huskyHook, "utf-8");
     return {
       framework: "husky",
       targetFile: huskyHook,
@@ -49078,8 +49089,8 @@ function detectHookFramework(repoRoot) {
     };
   }
   for (const cfg of [lefthookConfig, lefthookConfigYaml]) {
-    if (existsSync22(cfg)) {
-      const content = readFileSync16(cfg, "utf-8");
+    if (existsSync21(cfg)) {
+      const content = readFileSync15(cfg, "utf-8");
       const installed2 = /^\s+dependency-guardian\s*:/m.test(content);
       return {
         framework: "lefthook",
@@ -49089,8 +49100,8 @@ function detectHookFramework(repoRoot) {
     }
   }
   let installed = false;
-  if (existsSync22(bareHook)) {
-    installed = readFileSync16(bareHook, "utf-8").includes(HOOK_MARKER);
+  if (existsSync21(bareHook)) {
+    installed = readFileSync15(bareHook, "utf-8").includes(HOOK_MARKER);
   }
   return {
     framework: "bare",
@@ -49099,12 +49110,12 @@ function detectHookFramework(repoRoot) {
   };
 }
 function verifyHookInstalled(info) {
-  if (!existsSync22(info.targetFile)) {
+  if (!existsSync21(info.targetFile)) {
     return { ok: false, reason: `hook file missing: ${info.targetFile}` };
   }
   let content;
   try {
-    content = readFileSync16(info.targetFile, "utf-8");
+    content = readFileSync15(info.targetFile, "utf-8");
   } catch (e) {
     return { ok: false, reason: `cannot read ${info.targetFile}: ${e.message}` };
   }
@@ -49142,7 +49153,7 @@ ${HUSKY_SNIPPET}`;
 
 ${LEFTHOOK_ENTRY}`;
     case "bare":
-      if (existsSync22(info.targetFile)) {
+      if (existsSync21(info.targetFile)) {
         return `Will append to existing hook at ${info.targetFile}:
 ${HOOK_SECTION}`;
       }
@@ -49151,21 +49162,21 @@ ${HOOK_SCRIPT}`;
   }
 }
 function installHuskyHook(targetFile) {
-  const existing = readFileSync16(targetFile, "utf-8");
+  const existing = readFileSync15(targetFile, "utf-8");
   if (existing.includes(HOOK_MARKER)) {
     process.stderr.write("  Hook already installed in Husky.\n");
     return;
   }
   safeWriteFileSync(targetFile, existing.trimEnd() + "\n" + HUSKY_SNIPPET);
   try {
-    chmodSync6(targetFile, 493);
+    chmodSync5(targetFile, 493);
   } catch {
   }
   process.stderr.write(`  Appended Dependency Guardian to ${targetFile}
 `);
 }
 function installLefthookHook(targetFile) {
-  const existing = readFileSync16(targetFile, "utf-8");
+  const existing = readFileSync15(targetFile, "utf-8");
   if (/^\s+dependency-guardian\s*:/m.test(existing)) {
     process.stderr.write("  Hook already installed in lefthook.\n");
     return;
@@ -49197,16 +49208,16 @@ function installLefthookHook(targetFile) {
 `);
 }
 function installBareHook(targetFile) {
-  const hooksDir = dirname14(targetFile);
-  mkdirSync10(hooksDir, { recursive: true });
-  if (existsSync22(targetFile)) {
-    const existing = readFileSync16(targetFile, "utf-8");
+  const hooksDir = dirname13(targetFile);
+  mkdirSync9(hooksDir, { recursive: true });
+  if (existsSync21(targetFile)) {
+    const existing = readFileSync15(targetFile, "utf-8");
     if (existing.includes(HOOK_MARKER)) {
       process.stderr.write("  Hook already installed.\n");
       return;
     }
     safeWriteFileSync(targetFile, existing.trimEnd() + "\n" + HOOK_SECTION);
-    chmodSync6(targetFile, 493);
+    chmodSync5(targetFile, 493);
     process.stderr.write(
       `  Appended Dependency Guardian hook to existing ${targetFile}
 `
@@ -49214,7 +49225,7 @@ function installBareHook(targetFile) {
     return;
   }
   safeWriteFileSync(targetFile, HOOK_SCRIPT);
-  chmodSync6(targetFile, 493);
+  chmodSync5(targetFile, 493);
   process.stderr.write(`  Installed git pre-commit hook at ${targetFile}
 `);
 }
@@ -49257,10 +49268,10 @@ async function installHook() {
   }
 }
 function stripDgFromHookFile(hookPath, framework, repoPath) {
-  if (!existsSync22(hookPath)) {
+  if (!existsSync21(hookPath)) {
     return { status: "not-found", hookPath, repoPath };
   }
-  const content = readFileSync16(hookPath, "utf-8");
+  const content = readFileSync15(hookPath, "utf-8");
   if (framework === "lefthook") {
     if (!/^\s+dependency-guardian\s*:/m.test(content)) {
       return { status: "not-found", hookPath, repoPath };
@@ -49277,7 +49288,7 @@ function stripDgFromHookFile(hookPath, framework, repoPath) {
     return { status: "not-found", hookPath, repoPath };
   }
   if (framework === "bare" && content.trimStart().startsWith("#!/bin/sh\n" + HOOK_MARKER)) {
-    unlinkSync5(hookPath);
+    unlinkSync4(hookPath);
     removeEntry(repoPath, hookPath);
     return { status: "removed", hookPath, repoPath };
   }
@@ -49290,7 +49301,7 @@ function stripDgFromHookFile(hookPath, framework, repoPath) {
   const after = content.slice(endIdx + MARKER_END.length).trimStart();
   const remaining = (before + (after ? "\n" + after : "")).trimEnd() + "\n";
   if (remaining.trim() === "" || remaining.trim() === "#!/bin/sh") {
-    unlinkSync5(hookPath);
+    unlinkSync4(hookPath);
   } else {
     safeWriteFileSync(hookPath, remaining);
   }
@@ -49300,10 +49311,10 @@ function stripDgFromHookFile(hookPath, framework, repoPath) {
 function uninstallHookFromRepo(repoRootOverride) {
   const root = repoRootOverride ?? findRepoRoot();
   const hooksDir = findHooksDir();
-  const hookPath = join14(hooksDir, "pre-commit");
-  const huskyPath = join14(root, ".husky", "pre-commit");
-  if (existsSync22(huskyPath)) {
-    const content2 = readFileSync16(huskyPath, "utf-8");
+  const hookPath = join13(hooksDir, "pre-commit");
+  const huskyPath = join13(root, ".husky", "pre-commit");
+  if (existsSync21(huskyPath)) {
+    const content2 = readFileSync15(huskyPath, "utf-8");
     if (content2.includes(HOOK_MARKER)) {
       const startIdx2 = content2.indexOf(MARKER_START);
       const endIdx2 = content2.indexOf(MARKER_END);
@@ -49317,9 +49328,9 @@ function uninstallHookFromRepo(repoRootOverride) {
       }
     }
   }
-  for (const cfg of [join14(root, "lefthook.yml"), join14(root, "lefthook.yaml")]) {
-    if (!existsSync22(cfg)) continue;
-    const content2 = readFileSync16(cfg, "utf-8");
+  for (const cfg of [join13(root, "lefthook.yml"), join13(root, "lefthook.yaml")]) {
+    if (!existsSync21(cfg)) continue;
+    const content2 = readFileSync15(cfg, "utf-8");
     if (/^\s+dependency-guardian\s*:/m.test(content2)) {
       const stripped = content2.replace(
         /^\s+dependency-guardian\s*:\s*\n(?:\s{6,}.*\n)+/gm,
@@ -49330,15 +49341,15 @@ function uninstallHookFromRepo(repoRootOverride) {
       return { status: "removed", hookPath: cfg, repoPath: root };
     }
   }
-  if (!existsSync22(hookPath)) {
+  if (!existsSync21(hookPath)) {
     return { status: "not-found", hookPath, repoPath: root };
   }
-  const content = readFileSync16(hookPath, "utf-8");
+  const content = readFileSync15(hookPath, "utf-8");
   if (!content.includes(HOOK_MARKER)) {
     return { status: "not-found", hookPath, repoPath: root };
   }
   if (content.trimStart().startsWith("#!/bin/sh\n" + HOOK_MARKER)) {
-    unlinkSync5(hookPath);
+    unlinkSync4(hookPath);
     removeEntry(root, hookPath);
     return { status: "removed", hookPath, repoPath: root };
   }
@@ -49352,7 +49363,7 @@ function uninstallHookFromRepo(repoRootOverride) {
     removeEntry(root, hookPath);
     return { status: "removed", hookPath, repoPath: root };
   }
-  unlinkSync5(hookPath);
+  unlinkSync4(hookPath);
   removeEntry(root, hookPath);
   return { status: "removed", hookPath, repoPath: root };
 }
@@ -49506,7 +49517,7 @@ __export(update_exports, {
   runUpdate: () => runUpdate
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync, constants as constants2, realpathSync, unlinkSync as unlinkSync6 } from "node:fs";
+import { accessSync, constants as constants2, realpathSync, unlinkSync as unlinkSync5 } from "node:fs";
 import { sep as sep3 } from "node:path";
 function parseUpdateArgs(args) {
   return {
@@ -49617,7 +49628,7 @@ function printUpgradeCommand(latest, kind) {
 }
 function invalidateUpdateCache() {
   try {
-    unlinkSync6(dgCachePath("update-check.json"));
+    unlinkSync5(dgCachePath("update-check.json"));
   } catch {
   }
 }
@@ -49767,8 +49778,8 @@ var init_update = __esm({
 });
 
 // src/python-hook/install.ts
-import { existsSync as existsSync23, readFileSync as readFileSync17, unlinkSync as unlinkSync7, readdirSync as readdirSync4, statSync as statSync5 } from "node:fs";
-import { dirname as dirname15, join as join15, resolve } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync16, unlinkSync as unlinkSync6, readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
+import { dirname as dirname14, join as join14, resolve } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { homedir as homedir8 } from "node:os";
 function probeUserSite(pythonName) {
@@ -49792,8 +49803,8 @@ function uninstallPythonHooks(_opts = {}) {
   const removed = [];
   let receipt = null;
   try {
-    if (existsSync23(receiptPath)) {
-      receipt = JSON.parse(readFileSync17(receiptPath, "utf-8"));
+    if (existsSync22(receiptPath)) {
+      receipt = JSON.parse(readFileSync16(receiptPath, "utf-8"));
     }
   } catch {
     receipt = null;
@@ -49811,9 +49822,9 @@ function uninstallPythonHooks(_opts = {}) {
   }
   for (const site of sites) {
     for (const filename of ["dg_pip_hook.py", "dg_pip_hook.pth"]) {
-      const full = join15(site, filename);
+      const full = join14(site, filename);
       try {
-        if (existsSync23(full)) {
+        if (existsSync22(full)) {
           safeUnlink(full);
           removed.push(full);
         }
@@ -49821,13 +49832,13 @@ function uninstallPythonHooks(_opts = {}) {
       }
     }
     try {
-      const pyCache = join15(site, "__pycache__");
-      if (existsSync23(pyCache) && statSync5(pyCache).isDirectory()) {
+      const pyCache = join14(site, "__pycache__");
+      if (existsSync22(pyCache) && statSync4(pyCache).isDirectory()) {
         for (const f of readdirSync4(pyCache)) {
           if (f.startsWith("dg_pip_hook.")) {
             try {
-              safeUnlink(join15(pyCache, f));
-              removed.push(join15(pyCache, f));
+              safeUnlink(join14(pyCache, f));
+              removed.push(join14(pyCache, f));
             } catch {
             }
           }
@@ -49837,8 +49848,8 @@ function uninstallPythonHooks(_opts = {}) {
     }
   }
   try {
-    if (existsSync23(receiptPath)) {
-      unlinkSync7(receiptPath);
+    if (existsSync22(receiptPath)) {
+      unlinkSync6(receiptPath);
     }
   } catch {
   }
@@ -49869,7 +49880,7 @@ __export(uninstall_exports, {
   parseUninstallArgs: () => parseUninstallArgs,
   runUninstall: () => runUninstall
 });
-import { existsSync as existsSync24, rmSync as rmSync3, unlinkSync as unlinkSync8, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync23, rmSync as rmSync2, unlinkSync as unlinkSync7 } from "node:fs";
 function parseUninstallArgs(args) {
   return {
     assumeYes: args.includes("--yes") || args.includes("-y"),
@@ -49880,21 +49891,18 @@ function parseUninstallArgs(args) {
 }
 function safeExists(p) {
   try {
-    return existsSync24(p);
+    return existsSync23(p);
   } catch {
     return false;
   }
 }
 function buildPlan(opts) {
   const p = dgPaths();
-  const legacy = legacyPaths();
   const plan = {
     configFiles: [],
     cacheDir: null,
     stateDir: null,
     rootDir: null,
-    legacyFiles: [],
-    legacyDirs: [],
     hooks: [],
     rcCleanup: false
   };
@@ -49903,10 +49911,6 @@ function buildPlan(opts) {
     if (safeExists(p.cacheDir)) plan.cacheDir = p.cacheDir;
     if (safeExists(p.stateDir)) plan.stateDir = p.stateDir;
     if (safeExists(p.root)) plan.rootDir = p.root;
-    for (const f of [legacy.dgrc, legacy.updateCheck]) {
-      if (safeExists(f)) plan.legacyFiles.push(f);
-    }
-    if (safeExists(legacy.cacheDir)) plan.legacyDirs.push(legacy.cacheDir);
     if (!opts.keepHooks) {
       plan.hooks = listEntries();
     }
@@ -49930,10 +49934,6 @@ function printPlan(plan, opts) {
     process.stderr.write(`    ${plan.rootDir}/ (entire tree)
 `);
   }
-  for (const f of plan.legacyFiles) process.stderr.write(`    ${f}  (legacy)
-`);
-  for (const d of plan.legacyDirs) process.stderr.write(`    ${d}/  (legacy)
-`);
   if (plan.hooks.length > 0) {
     process.stderr.write(`    pre-commit hooks in ${plan.hooks.length} repo(s):
 `);
@@ -49996,7 +49996,7 @@ async function revokeApiKey(apiKey) {
 }
 function rmFile(path2) {
   try {
-    unlinkSync8(path2);
+    unlinkSync7(path2);
     return { ok: true };
   } catch (e) {
     const code = e.code;
@@ -50006,20 +50006,12 @@ function rmFile(path2) {
 }
 function rmTree(path2) {
   try {
-    rmSync3(path2, { recursive: true, force: true });
+    rmSync2(path2, { recursive: true, force: true });
     return { ok: true };
   } catch (e) {
     return { ok: false, reason: e.message };
   }
 }
-function isWritableTarget(path2) {
-  try {
-    const st = statSync6(path2);
-    return st.isDirectory() || st.isFile();
-  } catch {
-    return false;
-  }
-}
 async function runUninstall(args) {
   if (args.includes("--help") || args.includes("-h")) {
     process.stdout.write(USAGE5);
@@ -50065,7 +50057,7 @@ async function runUninstall(args) {
   }
   if (!opts.keepHooks && !opts.soft) {
     for (const h of plan.hooks) {
-      if (!existsSync24(h.repoPath)) {
+      if (!existsSync23(h.repoPath)) {
         process.stderr.write(import_chalk11.default.dim(`  \xB7 ${h.repoPath} no longer exists \u2014 skipping registered hook
 `));
         continue;
@@ -50131,22 +50123,6 @@ async function runUninstall(args) {
 `);
     }
   } else {
-    for (const f of plan.legacyFiles) {
-      if (!isWritableTarget(f)) continue;
-      const r = rmFile(f);
-      if (r.ok) process.stderr.write(import_chalk11.default.green("  \u2713 ") + `Removed ${f}
-`);
-      else process.stderr.write(import_chalk11.default.red("  \u2718 ") + `${f}: ${r.reason}
-`);
-    }
-    for (const d of plan.legacyDirs) {
-      if (!isWritableTarget(d)) continue;
-      const r = rmTree(d);
-      if (r.ok) process.stderr.write(import_chalk11.default.green("  \u2713 ") + `Removed ${d}
-`);
-      else process.stderr.write(import_chalk11.default.red("  \u2718 ") + `${d}: ${r.reason}
-`);
-    }
     if (plan.rootDir) {
       const r = rmTree(plan.rootDir);
       if (r.ok) process.stderr.write(import_chalk11.default.green("  \u2713 ") + `Removed ${plan.rootDir}
@@ -50196,9 +50172,6 @@ var init_uninstall = __esm({
 
   Removes:
     ~/.dg/        (config + cache + state + hooks registry)
-    ~/.dgrc.json                   (legacy, if still present)
-    ~/.dg/                         (legacy, if still present)
-    ~/.dg-update-check.json        (legacy, if still present)
     every per-repo pre-commit hook installed via 'dg hook install'
     the dg sentinel block in your shell rc files
 
@@ -50215,7 +50188,7 @@ var verify_exports = {};
 __export(verify_exports, {
   handleVerifyCommand: () => handleVerifyCommand
 });
-import { writeFileSync as writeFileSync15 } from "node:fs";
+import { writeFileSync as writeFileSync14 } from "node:fs";
 function detectEcosystem(spec) {
   if (/[<>=!~]=?|~=/.test(spec)) return "pypi";
   if (spec.startsWith("@")) return "npm";
@@ -50330,7 +50303,7 @@ async function callApi(packages, ecosystem, config) {
 }
 function writeOutput(content, outputPath) {
   if (outputPath) {
-    writeFileSync15(outputPath, content);
+    writeFileSync14(outputPath, content);
     process.stderr.write(import_chalk12.default.green(`  \u2713 Wrote ${content.length} bytes to ${outputPath}
 `));
   } else {
@@ -50749,7 +50722,6 @@ async function scanProjects(projects, config, dispatch) {
       dispatch({ type: "DISCOVERY_EMPTY", message: "No packages to scan." });
       return;
     }
-    const startMs = Date.now();
     const results = [];
     let completed = 0;
     if (npmPackages.length > 0) {
@@ -50776,18 +50748,7 @@ async function scanProjects(projects, config, dispatch) {
       });
       results.push(pypiResult);
     }
-    const allPackages = results.flatMap((r) => r.packages);
-    const maxScore = Math.max(0, ...allPackages.map((p) => p.score));
-    const action = maxScore >= 70 ? "block" : maxScore >= 60 ? "warn" : "pass";
-    const safeVersions = {};
-    for (const r of results) Object.assign(safeVersions, r.safeVersions);
-    const merged = {
-      score: maxScore,
-      action,
-      packages: allPackages,
-      safeVersions,
-      durationMs: Date.now() - startMs
-    };
+    const merged = mergeResponses(results);
     dispatch({ type: "SCAN_COMPLETE", result: merged, durationMs: merged.durationMs, skippedCount: 0, discoveredTotal });
   } catch (error) {
     if (error instanceof FreeCapReachedError) {
@@ -51333,8 +51294,8 @@ __export(ink_controls_exports, {
   setInkClear: () => setInkClear,
   setInkInstance: () => setInkInstance
 });
-import { resolve as resolve2, dirname as dirname16 } from "node:path";
-import { existsSync as existsSync25 } from "node:fs";
+import { resolve as resolve2, dirname as dirname15 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
 function locateInkInstancesPath() {
   let cur;
   try {
@@ -51344,13 +51305,13 @@ function locateInkInstancesPath() {
   }
   while (cur && cur !== "/" && cur !== ".") {
     const candidate = resolve2(cur, "node_modules", "ink", "build", "instances.js");
-    if (existsSync25(candidate)) return candidate;
-    const parent = dirname16(cur);
+    if (existsSync24(candidate)) return candidate;
+    const parent = dirname15(cur);
     if (parent === cur) break;
     cur = parent;
   }
   const cwdCandidate = resolve2(process.cwd(), "node_modules", "ink", "build", "instances.js");
-  if (existsSync25(cwdCandidate)) return cwdCandidate;
+  if (existsSync24(cwdCandidate)) return cwdCandidate;
   return null;
 }
 async function initInkInstances() {
@@ -51842,9 +51803,10 @@ function severityColor(sev) {
   if (sev >= 2) return import_chalk16.default.dim;
   return import_chalk16.default.dim;
 }
-function actionBadge3(score) {
-  if (score >= 70) return { label: "BLOCK", color: import_chalk16.default.red };
-  if (score >= 60) return { label: "WARN", color: import_chalk16.default.yellow };
+function actionBadge3(action) {
+  if (action === "block") return { label: "BLOCK", color: import_chalk16.default.red };
+  if (action === "warn") return { label: "WARN", color: import_chalk16.default.yellow };
+  if (action === "analysis_incomplete") return { label: "UNKNOWN", color: import_chalk16.default.cyan };
   return { label: "PASS", color: import_chalk16.default.green };
 }
 var import_chalk16, import_jsx_runtime15, SEVERITY_LABELS2, EVIDENCE_LIMIT2, ResultsView;
@@ -51870,8 +51832,8 @@ var init_ResultsView = __esm({
       config: _config,
       durationMs
     }) => {
-      const flagged = result.packages.filter((p) => p.score > 0);
-      const clean = result.packages.filter((p) => p.score === 0);
+      const flagged = result.packages.filter((p) => p.score > 0 || p.action === "analysis_incomplete");
+      const clean = result.packages.filter((p) => p.score === 0 && p.action !== "analysis_incomplete");
       const total = result.packages.length;
       const groups = groupPackages(flagged);
       return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Box_default, { flexDirection: "column", paddingLeft: 2, children: [
@@ -51896,7 +51858,7 @@ var init_ResultsView = __esm({
           /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Text, { dimColor: true, children: "\u2500".repeat(60) }),
           groups.map((group) => {
             const rep = group.packages[0];
-            const { label, color } = actionBadge3(rep.score);
+            const { label, color } = actionBadge3(rep.action);
             const names = group.packages.length === 1 ? rep.name : group.packages.length <= 3 ? group.packages.map((p) => p.name).join(", ") : `${group.packages[0].name} + ${group.packages.length - 1} similar`;
             return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(Text, { children: [
               "  ",
@@ -52026,13 +51988,15 @@ function reasonTag(pkg) {
 function countSummary(result) {
   let block = 0;
   let warn = 0;
+  let unknown = 0;
   let clean = 0;
   for (const p of result.packages) {
-    if (p.score >= 70) block++;
-    else if (p.score >= 60) warn++;
+    if (p.action === "block") block++;
+    else if (p.action === "warn") warn++;
+    else if (p.action === "analysis_incomplete") unknown++;
     else clean++;
   }
-  return { block, warn, clean };
+  return { block, warn, unknown, clean };
 }
 var import_jsx_runtime17, WrapperVerdictLine;
 var init_WrapperVerdictLine = __esm({
@@ -52103,6 +52067,7 @@ var init_WrapperVerdictLine = __esm({
       const parts = [];
       if (counts.block > 0) parts.push(`${counts.block} block`);
       if (counts.warn > 0) parts.push(`${counts.warn} warn`);
+      if (counts.unknown > 0) parts.push(`${counts.unknown} unknown`);
       if (counts.clean > 0) parts.push(`${counts.clean} clean`);
       return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Box_default, { flexDirection: "row", children: [
         /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Text, { color, children: [
@@ -53158,253 +53123,10 @@ function closestCommand(input, commands) {
   return bestDist <= 3 ? best : null;
 }
 
-// src/migrate.ts
-init_paths();
-import {
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync3,
-  copyFileSync,
-  unlinkSync as unlinkSync3,
-  rmSync,
-  chmodSync as chmodSync3,
-  statSync,
-  openSync as openSync2,
-  closeSync as closeSync2,
-  constants as fsConstants2
-} from "node:fs";
-import { dirname as dirname4 } from "node:path";
-var README = `dependency-guardian \u2014 local state for the dg CLI.
-
-  config.json                 your account + preferences (mode 0600)
-  cache/update-check.json     latest-version probe (24h TTL)
-  state/aliases.sh            optional shell aliases (npm/pip wrappers)
-  state/auth-status.json      60s cache of /v1/auth/status
-  state/trial-banner          throttle stamp for the trial nudge
-  state/bypass-log.jsonl      append-only log of install-wrapper bypasses
-  state/hooks-installed.json  registry of git hooks dg installed
-
-To remove everything dg has written to your machine, run:
-  dg uninstall
-
-This directory is created and managed by the dg CLI. Safe to delete.
-`;
-function ensureDir(path2, mode) {
-  if (!existsSync4(path2)) {
-    mkdirSync3(path2, { recursive: true, mode });
-  }
-  try {
-    chmodSync3(path2, mode);
-  } catch {
-  }
-}
-function moveFile(from, to, mode) {
-  const parent = dirname4(to);
-  ensureDir(parent, 448);
-  copyFileSync(from, to);
-  try {
-    chmodSync3(to, mode);
-  } catch {
-  }
-  if (statSync(to).size !== statSync(from).size) {
-    throw new Error(`size mismatch after copy: ${from} -> ${to}`);
-  }
-  unlinkSync3(from);
-}
-function isPidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    const code = e.code;
-    return code === "EPERM";
-  }
-}
-var LOCK_STALE_MS = 6e4;
-function acquireLock(lockPath) {
-  ensureDir(dirname4(lockPath), 448);
-  if (existsSync4(lockPath)) {
-    let stale = false;
-    try {
-      const raw = readFileSync4(lockPath, "utf-8").trim();
-      const data = JSON.parse(raw);
-      const age = Date.now() - (data.at ?? 0);
-      const dead = !isPidAlive(data.pid ?? 0);
-      stale = dead || age > LOCK_STALE_MS;
-    } catch {
-      stale = true;
-    }
-    if (!stale) return "held";
-    try {
-      unlinkSync3(lockPath);
-    } catch {
-    }
-  }
-  let fd;
-  try {
-    fd = openSync2(lockPath, fsConstants2.O_CREAT | fsConstants2.O_EXCL | fsConstants2.O_WRONLY, 384);
-  } catch {
-    return "stale-held";
-  }
-  try {
-    writeFileSync3(lockPath, JSON.stringify({ pid: process.pid, at: Date.now() }) + "\n");
-  } catch {
-  }
-  return { fd, lockPath };
-}
-function releaseLock(state) {
-  if (state.fd !== null) {
-    try {
-      closeSync2(state.fd);
-    } catch {
-    }
-  }
-  try {
-    unlinkSync3(state.lockPath);
-  } catch {
-  }
-}
-function rollback(moves) {
-  for (const m of moves) {
-    try {
-      if (existsSync4(m.to) && !existsSync4(m.from)) {
-        copyFileSync(m.to, m.from);
-        unlinkSync3(m.to);
-      }
-    } catch {
-    }
-  }
-}
-function detectLegacy() {
-  const legacy = legacyPaths();
-  return existsSync4(legacy.dgrc) || existsSync4(legacy.updateCheck) || existsSync4(legacy.aliasesShOld) || existsSync4(legacy.depGuardianDir);
-}
-function validateLegacyConfig(path2) {
-  let raw;
-  try {
-    const st = statSync(path2);
-    if (!st.isFile()) return { ok: false, reason: "not a regular file" };
-    if (st.size > 1e6) return { ok: false, reason: `file too large (${st.size} bytes)` };
-    raw = readFileSync4(path2, "utf-8");
-  } catch (e) {
-    return { ok: false, reason: e.message };
-  }
-  let parsed;
-  try {
-    const stripped = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
-    parsed = JSON.parse(stripped);
-  } catch (e) {
-    return { ok: false, reason: `invalid JSON: ${e.message}` };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { ok: false, reason: "config root is not an object" };
-  }
-  return { ok: true, data: parsed };
-}
-function runMigrationIfNeeded() {
-  const p = dgPaths();
-  if (existsSync4(p.migrationBreadcrumb)) {
-    return { status: "no-op" };
-  }
-  if (!detectLegacy()) {
-    return { status: "no-op" };
-  }
-  ensureDir(p.root, 448);
-  const lock = acquireLock(p.migrationLock);
-  if (lock === "held" || lock === "stale-held") {
-    return { status: "skipped", reason: "another dg process is migrating" };
-  }
-  const legacy = legacyPaths();
-  const moves = [];
-  let movedCount = 0;
-  try {
-    if (existsSync4(legacy.dgrc)) {
-      const validation = validateLegacyConfig(legacy.dgrc);
-      if (!validation.ok) {
-        releaseLock(lock);
-        return {
-          status: "failed",
-          reason: `~/.dgrc.json could not be read (${validation.reason}). Fix or remove the file and re-run dg.`
-        };
-      }
-      ensureDir(p.configDir, 448);
-      writeFileSync3(p.config, JSON.stringify(validation.data, null, 2) + "\n", { mode: 384 });
-      try {
-        chmodSync3(p.config, 384);
-      } catch {
-      }
-      try {
-        unlinkSync3(legacy.dgrc);
-      } catch {
-      }
-      moves.push({ from: legacy.dgrc, to: p.config });
-      movedCount++;
-    }
-    ensureDir(p.cacheDir, 448);
-    if (existsSync4(legacy.updateCheck)) {
-      moveFile(legacy.updateCheck, p.updateCheck, 384);
-      moves.push({ from: legacy.updateCheck, to: p.updateCheck });
-      movedCount++;
-    }
-    ensureDir(p.stateDir, 448);
-    if (existsSync4(legacy.aliasesShOld)) {
-      moveFile(legacy.aliasesShOld, p.aliasesSh, 420);
-      moves.push({ from: legacy.aliasesShOld, to: p.aliasesSh });
-      movedCount++;
-    }
-    if (existsSync4(legacy.depGuardianDir) && legacy.depGuardianDir !== p.root) {
-      const candidates = [
-        { from: join(legacy.depGuardianDir, "config.json"), to: p.config, mode: 384 },
-        { from: join(legacy.depGuardianDir, "cache", "update-check.json"), to: p.updateCheck, mode: 384 },
-        { from: join(legacy.depGuardianDir, "state", "aliases.sh"), to: p.aliasesSh, mode: 420 },
-        { from: join(legacy.depGuardianDir, "state", "hooks-installed.json"), to: p.hooksRegistry, mode: 384 },
-        { from: join(legacy.depGuardianDir, "aliases.sh"), to: p.aliasesSh, mode: 420 }
-      ];
-      for (const c of candidates) {
-        if (existsSync4(c.from) && !existsSync4(c.to)) {
-          moveFile(c.from, c.to, c.mode);
-          moves.push({ from: c.from, to: c.to });
-          movedCount++;
-        }
-      }
-      try {
-        rmSync(legacy.depGuardianDir, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    try {
-      if (existsSync4(legacy.cacheDir) && legacy.cacheDir !== p.root) {
-        rmSync(legacy.cacheDir, { recursive: true, force: true });
-      }
-    } catch {
-    }
-    try {
-      writeFileSync3(p.readme, README, { mode: 420 });
-    } catch {
-    }
-    writeFileSync3(p.migrationBreadcrumb, (/* @__PURE__ */ new Date()).toISOString() + "\n", { mode: 384 });
-    releaseLock(lock);
-    if (process.stderr.isTTY) {
-      process.stderr.write(
-        `dg: reorganized local state into ${p.root} (one-time, ${movedCount} file${movedCount === 1 ? "" : "s"}; see README inside).
-`
-      );
-    }
-    return { status: "migrated", movedCount };
-  } catch (e) {
-    rollback(moves);
-    releaseLock(lock);
-    return { status: "failed", reason: e.message };
-  }
-}
-
 // src/bin.ts
 init_terminal_state();
 var CLI_VERSION = getVersion();
 initTelemetry(CLI_VERSION);
-runMigrationIfNeeded();
 function setProcessTitle(title) {
   try {
     process.title = title;
@@ -53436,15 +53158,15 @@ async function maybeShowWiringHint(rawCommand) {
   const SKIP = /* @__PURE__ */ new Set(["uninstall", "__wrap", "version", "--version", "-v", "help", "--help", "-h"]);
   if (SKIP.has(rawCommand)) return;
   try {
-    const { existsSync: existsSync26 } = await import("node:fs");
-    const { join: join16 } = await import("node:path");
+    const { existsSync: existsSync25 } = await import("node:fs");
+    const { join: join15 } = await import("node:path");
     const { homedir: homedir9 } = await import("node:os");
     const { dgStatePath: dgStatePath2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
-    const receiptPath = join16(homedir9(), ".dg", "state", "install-receipt.json");
-    const shimPath = join16(homedir9(), ".dg", "shims", "npm");
+    const receiptPath = join15(homedir9(), ".dg", "state", "install-receipt.json");
+    const shimPath = join15(homedir9(), ".dg", "shims", "npm");
     const hintMarker = dgStatePath2("wiring-hint-shown");
-    if (existsSync26(receiptPath) || existsSync26(shimPath)) return;
-    if (existsSync26(hintMarker)) return;
+    if (existsSync25(receiptPath) || existsSync25(shimPath)) return;
+    if (existsSync25(hintMarker)) return;
     const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     process.stderr.write(
       `
@@ -53454,10 +53176,10 @@ async function maybeShowWiringHint(rawCommand) {
 `
     );
     try {
-      const { writeFileSync: writeFileSync16, mkdirSync: mkdirSync11 } = await import("node:fs");
-      const { dirname: dirname17 } = await import("node:path");
-      mkdirSync11(dirname17(hintMarker), { recursive: true });
-      writeFileSync16(hintMarker, (/* @__PURE__ */ new Date()).toISOString());
+      const { writeFileSync: writeFileSync15, mkdirSync: mkdirSync10 } = await import("node:fs");
+      const { dirname: dirname16 } = await import("node:path");
+      mkdirSync10(dirname16(hintMarker), { recursive: true });
+      writeFileSync15(hintMarker, (/* @__PURE__ */ new Date()).toISOString());
     } catch {
     }
   } catch {
@@ -53591,11 +53313,11 @@ async function main() {
       if (v === "npm" || v === "pypi") ecosystem = v;
     }
     const { runNpmPublishCheck: runNpmPublishCheck2, runPypiPublishCheck: runPypiPublishCheck2, renderPublishCheckResult: renderPublishCheckResult2 } = await Promise.resolve().then(() => (init_publish_check(), publish_check_exports));
-    const { existsSync: existsSync26 } = await import("node:fs");
-    const { join: join16 } = await import("node:path");
+    const { existsSync: existsSync25 } = await import("node:fs");
+    const { join: join15 } = await import("node:path");
     if (ecosystem === "auto") {
-      if (existsSync26(join16(process.cwd(), "package.json"))) ecosystem = "npm";
-      else if (existsSync26(join16(process.cwd(), "pyproject.toml")) || existsSync26(join16(process.cwd(), "setup.py"))) ecosystem = "pypi";
+      if (existsSync25(join15(process.cwd(), "package.json"))) ecosystem = "npm";
+      else if (existsSync25(join15(process.cwd(), "pyproject.toml")) || existsSync25(join15(process.cwd(), "setup.py"))) ecosystem = "pypi";
       else {
         process.stderr.write("\n  publish-check: no package.json, pyproject.toml, or setup.py in current directory.\n  Pass --ecosystem npm|pypi explicitly if your project layout differs.\n\n");
         process.exit(3);