@westbayberry/dg 1.3.2 → 2.0.0

package/dist/postinstall.mjs

@@ -1,731 +0,0 @@
-#!/usr/bin/env node
-// src/postinstall.ts
-import { homedir as homedir7, userInfo } from "node:os";
-
-// src/shims/install.ts
-import { homedir as homedir5 } from "node:os";
-import { join as join4, dirname as dirname2 } from "node:path";
-import { fileURLToPath } from "node:url";
-import { chmodSync, chownSync, existsSync as existsSync4, readdirSync, readFileSync as readFileSync3, statSync as statSync2, appendFileSync as appendFileSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-
-// src/paths.ts
-import { homedir } from "node:os";
-import { join, isAbsolute } from "node:path";
-var ROOT_DIR_NAME = "dg";
-function safeAbsolute(p, fallback) {
-  if (!p || typeof p !== "string") return fallback;
-  if (!isAbsolute(p)) return fallback;
-  return p;
-}
-function dgRoot() {
-  return join(homedir(), `.${ROOT_DIR_NAME}`);
-}
-function dgStateDir() {
-  const xdg = safeAbsolute(process.env.XDG_STATE_HOME, "");
-  if (xdg) return join(xdg, ROOT_DIR_NAME);
-  return join(dgRoot(), "state");
-}
-function dgStatePath(name) {
-  return join(dgStateDir(), name);
-}
-
-// src/shims/safe-fs.ts
-import { existsSync, lstatSync, mkdirSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, sep } from "node:path";
-import { homedir as homedir2 } from "node:os";
-var UnsafePathError = class extends Error {
-  constructor(message, path) {
-    super(message);
-    this.path = path;
-    this.name = "UnsafePathError";
-  }
-};
-function ensureUnderHome(target) {
-  const home = homedir2();
-  if (target !== home && !target.startsWith(home + sep)) {
-    throw new UnsafePathError(`refusing to operate on path outside $HOME: ${target}`, target);
-  }
-}
-function lstatNoSymlink(path) {
-  let st;
-  try {
-    st = lstatSync(path);
-  } catch (e) {
-    const code = e.code;
-    if (code === "ENOENT") return;
-    throw e;
-  }
-  if (st.isSymbolicLink()) {
-    throw new UnsafePathError(`refusing: ${path} is a symlink`, path);
-  }
-}
-function safeMkdirRecursive(target, mode = 493) {
-  ensureUnderHome(target);
-  const home = homedir2();
-  const rel = target.slice(home.length).split(sep).filter(Boolean);
-  let cur = home;
-  for (const segment of rel) {
-    cur = cur + sep + segment;
-    lstatNoSymlink(cur);
-    if (!existsSync(cur)) {
-      mkdirSync(cur, { mode });
-    }
-  }
-}
-function safeWriteFile(target, content, mode = 420) {
-  ensureUnderHome(target);
-  lstatNoSymlink(dirname(target));
-  lstatNoSymlink(target);
-  writeFileSync(target, content, { mode });
-}
-function atomicWriteFile(target, content, mode = 420) {
-  ensureUnderHome(target);
-  lstatNoSymlink(dirname(target));
-  lstatNoSymlink(target);
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync(tmp, content, { mode });
-  renameSync(tmp, target);
-}
-function isExecutable(path) {
-  try {
-    const st = statSync(path);
-    return st.isFile() && (st.mode & 73) !== 0;
-  } catch {
-    return false;
-  }
-}
-
-// src/shims/templates.ts
-var ECOSYSTEMS = [
-  "npm",
-  "pnpm",
-  "yarn",
-  "bun",
-  "pip",
-  "pip3",
-  "uv",
-  "pipx",
-  "conda",
-  "mamba"
-];
-var UNIX_SHIM_BODY = `#!/bin/sh
-nonce=$(cat "$HOME/.dg/state/shim-nonce" 2>/dev/null)
-if [ -n "\${DG_SHIM_ACTIVE:-}" ]; then
-  cleaned_path=$(printf '%s' "$PATH" | awk -v RS=':' -v ORS=':' '$0 != ENVIRON["HOME"]"/.dg/shims"' | sed 's/:$//')
-  # Only honor DG_SHIM_ACTIVE as the recursion guard when it equals the
-  # on-disk nonce \u2014 that is the value our own wrapper sets before running the
-  # real installer. A non-matching value was set outside dg (stale or a
-  # bypass attempt) and must NOT skip scanning.
-  if [ -n "$nonce" ] && [ "$DG_SHIM_ACTIVE" = "$nonce" ]; then
-    real_bin=$(PATH="$cleaned_path" command -v __ECOSYSTEM__)
-    if [ -n "$real_bin" ]; then
-      exec "$real_bin" "$@"
-    fi
-    echo "dg: real __ECOSYSTEM__ not found on PATH" >&2
-    exit 127
-  fi
-  if [ -z "$nonce" ]; then
-    echo "dg: shim nonce missing (reinstall dg) \u2014 cannot verify; passing through __ECOSYSTEM__ UNSCANNED." >&2
-    real_bin=$(PATH="$cleaned_path" command -v __ECOSYSTEM__)
-    if [ -n "$real_bin" ]; then exec "$real_bin" "$@"; fi
-    exit 127
-  fi
-  echo "dg: ignoring externally-set DG_SHIM_ACTIVE (nonce mismatch); scanning __ECOSYSTEM__." >&2
-fi
-dg_entry=$(cat "$HOME/.dg/state/dg-entry" 2>/dev/null)
-if [ -n "$dg_entry" ] && [ -x "$dg_entry" ]; then
-  DG_SHIM_ACTIVE="$nonce" DG_SHIM_PARENT_PATH="$PATH" exec "$dg_entry" __wrap __ECOSYSTEM__ "$@"
-fi
-cleaned_path=$(printf '%s' "$PATH" | awk -v RS=':' -v ORS=':' '$0 != ENVIRON["HOME"]"/.dg/shims"' | sed 's/:$//')
-dg_bin=$(PATH="$cleaned_path" command -v dg)
-if [ -n "$dg_bin" ]; then
-  DG_SHIM_ACTIVE="$nonce" DG_SHIM_PARENT_PATH="$PATH" exec "$dg_bin" __wrap __ECOSYSTEM__ "$@"
-fi
-real_bin=$(PATH="$cleaned_path" command -v __ECOSYSTEM__)
-if [ -n "$real_bin" ]; then
-  printf '%s dg unresolved; passthrough __ECOSYSTEM__\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)" >> "$HOME/.dg/state/bypass.log" 2>/dev/null
-  exec "$real_bin" "$@"
-fi
-echo "dg: neither dg nor real __ECOSYSTEM__ found on PATH" >&2
-exit 127
-`;
-var WINDOWS_SHIM_BODY = `@echo off
-setlocal enabledelayedexpansion
-set "DG_SHIM_NONCE="
-if exist "%USERPROFILE%\\.dg\\state\\shim-nonce" set /p DG_SHIM_NONCE=<"%USERPROFILE%\\.dg\\state\\shim-nonce"
-if not "%DG_SHIM_ACTIVE%"=="" (
-  set "_dg_realpath="
-  for /f "tokens=*" %%i in ('where __ECOSYSTEM__ 2^>nul') do (
-    echo %%i | findstr /v /c:"%USERPROFILE%\\.dg\\shims" >nul && (
-      if not defined _dg_realpath set "_dg_realpath=%%i"
-    )
-  )
-  rem Only honor DG_SHIM_ACTIVE as the recursion guard when it equals the nonce.
-  if "%DG_SHIM_ACTIVE%"=="!DG_SHIM_NONCE!" (
-    if defined _dg_realpath (
-      "!_dg_realpath!" %*
-      exit /b !errorlevel!
-    )
-    echo dg: real __ECOSYSTEM__ not found on PATH 1>&2
-    exit /b 127
-  )
-  if "!DG_SHIM_NONCE!"=="" (
-    echo dg: shim nonce missing ^(reinstall dg^) -- passing through __ECOSYSTEM__ UNSCANNED. 1>&2
-    if defined _dg_realpath (
-      "!_dg_realpath!" %*
-      exit /b !errorlevel!
-    )
-    exit /b 127
-  )
-  echo dg: ignoring externally-set DG_SHIM_ACTIVE ^(nonce mismatch^); scanning __ECOSYSTEM__. 1>&2
-)
-set "DG_ENTRY="
-if exist "%USERPROFILE%\\.dg\\state\\dg-entry" set /p DG_ENTRY=<"%USERPROFILE%\\.dg\\state\\dg-entry"
-set "DG_SHIM_ACTIVE=!DG_SHIM_NONCE!"
-set "DG_SHIM_PARENT_PATH=%PATH%"
-if defined DG_ENTRY (
-  if exist "!DG_ENTRY!" (
-    node "!DG_ENTRY!" __wrap __ECOSYSTEM__ %*
-    exit /b !errorlevel!
-  )
-)
-set "_dg_cli="
-for /f "tokens=*" %%i in ('where dg 2^>nul') do (
-  echo %%i | findstr /v /c:"%USERPROFILE%\\.dg\\shims" >nul && (
-    if not defined _dg_cli set "_dg_cli=%%i"
-  )
-)
-if defined _dg_cli (
-  "!_dg_cli!" __wrap __ECOSYSTEM__ %*
-  exit /b !errorlevel!
-)
-set "_dg_realpm="
-for /f "tokens=*" %%i in ('where __ECOSYSTEM__ 2^>nul') do (
-  echo %%i | findstr /v /c:"%USERPROFILE%\\.dg\\shims" >nul && (
-    if not defined _dg_realpm set "_dg_realpm=%%i"
-  )
-)
-if defined _dg_realpm (
-  >>"%USERPROFILE%\\.dg\\state\\bypass.log" echo dg unresolved; passthrough __ECOSYSTEM__
-  "!_dg_realpm!" %*
-  exit /b !errorlevel!
-)
-echo dg: neither dg nor real __ECOSYSTEM__ found on PATH 1>&2
-exit /b 127
-`;
-function renderShim(opts) {
-  const body = opts.platform === "windows" ? WINDOWS_SHIM_BODY : UNIX_SHIM_BODY;
-  return body.replace(/__ECOSYSTEM__/g, opts.ecosystem);
-}
-function shimFilename(ecosystem, platform) {
-  return platform === "windows" ? `${ecosystem}.cmd` : ecosystem;
-}
-
-// src/shims/rc-syntax.ts
-import { homedir as homedir3 } from "node:os";
-import { join as join2 } from "node:path";
-import { existsSync as existsSync2, readFileSync, lstatSync as lstatSync2, appendFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-var RC_SENTINEL_OPEN = "# >>> dg-managed >>>";
-var RC_SENTINEL_CLOSE = "# <<< dg-managed <<<";
-function expandHome(path) {
-  if (path.startsWith("~/")) return join2(homedir3(), path.slice(2));
-  return path;
-}
-function detectShellKind(envShell) {
-  const s = (envShell ?? "").toLowerCase();
-  if (s.includes("zsh")) return "zsh";
-  if (s.includes("fish")) return "fish";
-  if (s.includes("bash")) return "bash";
-  return "sh";
-}
-function rcCandidates(kind) {
-  const home = homedir3();
-  switch (kind) {
-    case "zsh":
-      return [join2(home, ".zshrc")];
-    case "bash":
-      return [join2(home, ".bashrc"), join2(home, ".bash_profile")];
-    case "fish":
-      return [join2(home, ".config", "fish", "config.fish")];
-    case "sh":
-      return [join2(home, ".profile")];
-  }
-}
-function pathSnippet(kind) {
-  if (kind === "fish") {
-    return 'set -gx PATH "$HOME/.dg/shims" $PATH';
-  }
-  return 'export PATH="$HOME/.dg/shims:$PATH"';
-}
-function appendSentinelBlock(rcPath, snippet) {
-  const resolved = expandHome(rcPath);
-  try {
-    ensureUnderHome(resolved);
-  } catch (e) {
-    return { status: "failed", path: resolved, reason: e.message };
-  }
-  try {
-    lstatNoSymlink(resolved);
-  } catch (e) {
-    if (e instanceof UnsafePathError) {
-      return { status: "failed", path: resolved, reason: e.message };
-    }
-  }
-  if (existsSync2(resolved)) {
-    const st = lstatSync2(resolved);
-    if (!st.isFile()) {
-      return { status: "failed", path: resolved, reason: "rc path is not a regular file" };
-    }
-    const existing = readFileSync(resolved, "utf-8");
-    if (existing.includes(RC_SENTINEL_OPEN)) {
-      return { status: "already-present", path: resolved };
-    }
-  }
-  const block = `
-${RC_SENTINEL_OPEN}
-${snippet}
-${RC_SENTINEL_CLOSE}
-`;
-  try {
-    if (existsSync2(resolved)) {
-      appendFileSync(resolved, block, { encoding: "utf-8" });
-    } else {
-      writeFileSync2(resolved, block, { encoding: "utf-8", mode: 420 });
-    }
-    return { status: "appended", path: resolved };
-  } catch (e) {
-    return { status: "failed", path: resolved, reason: e.message };
-  }
-}
-
-// src/shims/resolve.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
-import { join as join3, delimiter, sep as sep2 } from "node:path";
-import { homedir as homedir4 } from "node:os";
-var CACHE_PATH = () => dgStatePath("real-binaries.json");
-var NO_CACHE = /* @__PURE__ */ new Set(["pip", "pip3"]);
-function shimDir() {
-  return join3(homedir4(), ".dg", "shims");
-}
-function walkPathExcludingShimDir(name, extraExtensions = []) {
-  const raw = process.env.PATH ?? "/usr/bin:/bin";
-  const parts = raw.split(delimiter).filter(Boolean);
-  const shims = shimDir();
-  const exts = extraExtensions.length > 0 ? extraExtensions : platformExtensions();
-  for (const dir of parts) {
-    if (dir === shims || dir.startsWith(shims + sep2)) continue;
-    for (const ext of ["", ...exts]) {
-      const candidate = join3(dir, name + ext);
-      if (isExecutable(candidate)) return candidate;
-    }
-  }
-  return null;
-}
-function walkPath(name, extraExtensions) {
-  return walkPathExcludingShimDir(name, extraExtensions);
-}
-function platformExtensions() {
-  if (process.platform === "win32") return [".cmd", ".exe", ".bat"];
-  return [];
-}
-function readCache() {
-  try {
-    const raw = readFileSync2(CACHE_PATH(), "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) {
-      return parsed;
-    }
-  } catch {
-  }
-  return {};
-}
-function writeCache(cache) {
-  try {
-    atomicWriteFile(CACHE_PATH(), JSON.stringify(cache, null, 2), 420);
-  } catch {
-  }
-}
-function resolveRealBinary(ecosystem) {
-  const exts = platformExtensions();
-  if (NO_CACHE.has(ecosystem)) {
-    return walkPath(ecosystem, exts);
-  }
-  const cache = readCache();
-  const cached = cache[ecosystem];
-  if (cached && existsSync3(cached) && isExecutable(cached)) {
-    return cached;
-  }
-  const resolved = walkPath(ecosystem, exts);
-  if (resolved) {
-    cache[ecosystem] = resolved;
-    writeCache(cache);
-  } else if (cached) {
-    delete cache[ecosystem];
-    writeCache(cache);
-  }
-  return resolved;
-}
-function clearResolveCache() {
-  try {
-    atomicWriteFile(CACHE_PATH(), JSON.stringify({}, null, 2), 420);
-  } catch {
-  }
-}
-function realBinaryCachePath() {
-  return CACHE_PATH();
-}
-
-// src/shims/install.ts
-function currentDgEntry() {
-  try {
-    const entry = join4(dirname2(fileURLToPath(import.meta.url)), "index.mjs");
-    if (existsSync4(entry)) return entry;
-  } catch {
-  }
-  try {
-    return walkPathExcludingShimDir("dg");
-  } catch {
-    return null;
-  }
-}
-function chownIfNeeded(path, uid, gid) {
-  if (uid === void 0 || gid === void 0) return;
-  if (process.platform === "win32") return;
-  try {
-    chownSync(path, uid, gid);
-  } catch {
-  }
-}
-function persistWindowsPath(shimsDir, outcomes) {
-  if (process.platform !== "win32") return;
-  const currentPath = process.env.PATH ?? "";
-  if (currentPath.toLowerCase().includes(shimsDir.toLowerCase())) {
-    outcomes.push({ status: "already-present", path: "user PATH (HKCU\\Environment)" });
-    return;
-  }
-  try {
-    const result = spawnSync("setx", ["PATH", `${shimsDir};${currentPath}`], { stdio: ["ignore", "pipe", "pipe"] });
-    if (result.status === 0) {
-      outcomes.push({ status: "appended", path: "user PATH (HKCU\\Environment)" });
-    } else {
-      outcomes.push({
-        status: "failed",
-        path: "user PATH (HKCU\\Environment)",
-        reason: result.stderr.toString().trim() || `setx exited ${result.status}`
-      });
-    }
-  } catch (e) {
-    outcomes.push({
-      status: "failed",
-      path: "user PATH (HKCU\\Environment)",
-      reason: e.message
-    });
-  }
-}
-function updatePowerShellProfile(targetHome, shimsDir, outcomes) {
-  if (process.platform !== "win32") return;
-  const profilePath = join4(targetHome, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1");
-  if (!existsSync4(profilePath)) {
-    outcomes.push({ status: "already-present", path: profilePath });
-    return;
-  }
-  try {
-    const existing = readFileSync3(profilePath, "utf-8");
-    if (existing.includes(">>> dg-managed >>>")) {
-      outcomes.push({ status: "already-present", path: profilePath });
-      return;
-    }
-    const block = `
-# >>> dg-managed >>>
-$env:Path = "${shimsDir};$env:Path"
-# <<< dg-managed <<<
-`;
-    appendFileSync2(profilePath, block, { encoding: "utf-8" });
-    outcomes.push({ status: "appended", path: profilePath });
-  } catch (e) {
-    outcomes.push({ status: "failed", path: profilePath, reason: e.message });
-  }
-}
-function chownTreeIfNeeded(root, uid, gid) {
-  if (uid === void 0 || gid === void 0) return;
-  if (process.platform === "win32") return;
-  if (!existsSync4(root)) return;
-  chownIfNeeded(root, uid, gid);
-  try {
-    for (const entry of readdirSync(root)) {
-      const child = join4(root, entry);
-      const st = statSync2(child);
-      if (st.isDirectory()) {
-        chownTreeIfNeeded(child, uid, gid);
-      } else {
-        chownIfNeeded(child, uid, gid);
-      }
-    }
-  } catch {
-  }
-}
-function installShims(opts = {}) {
-  const targetHome = opts.targetHome ?? homedir5();
-  const platform = opts.platform ?? (process.platform === "win32" ? "windows" : "unix");
-  const dgRoot2 = join4(targetHome, ".dg");
-  const shimsDir = join4(targetHome, ".dg", "shims");
-  const stateDir = join4(targetHome, ".dg", "state");
-  safeMkdirRecursive(dgRoot2, 493);
-  safeMkdirRecursive(stateDir, 493);
-  safeMkdirRecursive(shimsDir, 493);
-  const nonce = randomBytes(16).toString("hex");
-  const noncePathResolved = join4(stateDir, "shim-nonce");
-  safeWriteFile(noncePathResolved, nonce, 384);
-  chownIfNeeded(noncePathResolved, opts.targetUid, opts.targetGid);
-  const dgEntry = currentDgEntry();
-  const dgEntryPathResolved = join4(stateDir, "dg-entry");
-  if (dgEntry) {
-    safeWriteFile(dgEntryPathResolved, dgEntry + "\n", 420);
-    chownIfNeeded(dgEntryPathResolved, opts.targetUid, opts.targetGid);
-  }
-  const shimsCreated = [];
-  for (const eco of ECOSYSTEMS) {
-    const filename = shimFilename(eco, platform);
-    const fullPath = join4(shimsDir, filename);
-    const body = renderShim({ ecosystem: eco, platform });
-    safeWriteFile(fullPath, body, platform === "windows" ? 420 : 493);
-    if (platform !== "windows") chmodSync(fullPath, 493);
-    chownIfNeeded(fullPath, opts.targetUid, opts.targetGid);
-    shimsCreated.push(filename);
-  }
-  if (opts.refreshTemplates) {
-    clearResolveCache();
-  }
-  const resolvedRealBinaries = {};
-  for (const eco of ["npm", "pnpm", "yarn", "bun", "uv", "pipx", "conda", "mamba"]) {
-    resolvedRealBinaries[eco] = resolveRealBinary(eco);
-  }
-  const cachePathResolved = realBinaryCachePath();
-  if (existsSync4(cachePathResolved)) {
-    chownIfNeeded(cachePathResolved, opts.targetUid, opts.targetGid);
-  }
-  const rcOutcomes = [];
-  if (!opts.skipRcEdit && platform !== "windows") {
-    const shellKind = detectShellKind(process.env.SHELL);
-    const snippet = pathSnippet(shellKind);
-    const candidates = rcCandidates(shellKind).map(
-      (p) => p.replace(homedir5(), targetHome)
-    );
-    for (const candidate of candidates) {
-      const outcome = appendSentinelBlock(candidate, snippet);
-      rcOutcomes.push(outcome);
-      if (outcome.status === "appended") {
-        chownIfNeeded(outcome.path, opts.targetUid, opts.targetGid);
-      }
-    }
-  }
-  if (!opts.skipRcEdit && platform === "windows") {
-    persistWindowsPath(shimsDir, rcOutcomes);
-    updatePowerShellProfile(targetHome, shimsDir, rcOutcomes);
-  }
-  const receipt = {
-    schemaVersion: 1,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    platform,
-    shimsDir,
-    shimsCreated,
-    rcOutcomes,
-    nonceFile: noncePathResolved,
-    cacheFile: cachePathResolved,
-    dgEntry: dgEntry ?? null,
-    nodeVersion: process.version,
-    dgVersion: process.env.DG_CLI_VERSION ?? "unknown"
-  };
-  const receiptResolved = join4(stateDir, "install-receipt.json");
-  safeWriteFile(receiptResolved, JSON.stringify(receipt, null, 2), 420);
-  chownIfNeeded(receiptResolved, opts.targetUid, opts.targetGid);
-  chownTreeIfNeeded(dgRoot2, opts.targetUid, opts.targetGid);
-  return {
-    shimsCreated,
-    rcOutcomes,
-    noncePath: noncePathResolved,
-    receiptPath: receiptResolved,
-    cachePath: cachePathResolved,
-    resolvedRealBinaries
-  };
-}
-
-// src/python-hook/install.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, unlinkSync as unlinkSync2, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
-import { dirname as dirname3, join as join5, resolve } from "node:path";
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { homedir as homedir6 } from "node:os";
-var SUPPORTED_PYTHON_VERSIONS = [
-  "python3.13",
-  "python3.12",
-  "python3.11",
-  "python3.10",
-  "python3.9",
-  "python3.8",
-  "python3"
-];
-function moduleAssetDir() {
-  const scriptPath = process.argv[1] ?? "";
-  const candidates = [
-    resolve(dirname3(scriptPath), "python-hook"),
-    resolve(dirname3(scriptPath), "..", "python-hook"),
-    resolve(dirname3(scriptPath), "src", "python-hook")
-  ];
-  for (const c of candidates) {
-    if (existsSync5(join5(c, "dg_pip_hook.py"))) return c;
-  }
-  return resolve(dirname3(scriptPath));
-}
-function probeUserSite(pythonName) {
-  try {
-    const result = spawnSync2(pythonName, ["-c", "import site; print(site.getusersitepackages())"], {
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 5e3
-    });
-    if (result.status !== 0) return null;
-    const out = result.stdout.toString().trim();
-    if (!out) return null;
-    const home = homedir6();
-    if (!out.startsWith(home)) return null;
-    return out;
-  } catch {
-    return null;
-  }
-}
-function installPythonHooks(opts = {}) {
-  const home = opts.targetHome ?? homedir6();
-  const assetDir = moduleAssetDir();
-  const hookPyPath = join5(assetDir, "dg_pip_hook.py");
-  const pthPath = join5(assetDir, "dg_pip_hook.pth");
-  if (!existsSync5(hookPyPath) || !existsSync5(pthPath)) {
-    return {
-      results: [{ pythonVersion: "(any)", userSite: "", status: "failed", reason: "hook asset files missing" }],
-      receiptPath: ""
-    };
-  }
-  const hookPy = readFileSync4(hookPyPath, "utf-8");
-  const pthFile = readFileSync4(pthPath, "utf-8");
-  const results = [];
-  const seenSites = /* @__PURE__ */ new Set();
-  for (const py of SUPPORTED_PYTHON_VERSIONS) {
-    const userSite = probeUserSite(py);
-    if (!userSite) {
-      continue;
-    }
-    if (seenSites.has(userSite)) {
-      continue;
-    }
-    seenSites.add(userSite);
-    try {
-      if (!userSite.startsWith(home)) {
-        results.push({ pythonVersion: py, userSite, status: "skipped", reason: "user-site outside $HOME" });
-        continue;
-      }
-      safeMkdirRecursive(userSite, 493);
-      safeWriteFile(join5(userSite, "dg_pip_hook.py"), hookPy, 420);
-      safeWriteFile(join5(userSite, "dg_pip_hook.pth"), pthFile, 420);
-      results.push({ pythonVersion: py, userSite, status: "installed" });
-    } catch (err) {
-      results.push({ pythonVersion: py, userSite, status: "failed", reason: err.message });
-    }
-  }
-  const receiptPath = dgStatePath("python-hook-receipt.json");
-  try {
-    safeWriteFile(
-      receiptPath,
-      JSON.stringify({ schemaVersion: 1, installedAt: (/* @__PURE__ */ new Date()).toISOString(), results }, null, 2),
-      420
-    );
-  } catch {
-  }
-  return { results, receiptPath };
-}
-
-// src/postinstall.ts
-function detectSudo() {
-  if (process.platform === "win32") return null;
-  const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-  if (uid !== 0) return null;
-  const sudoUser = process.env.SUDO_USER;
-  if (!sudoUser || sudoUser === "root") return null;
-  try {
-    const info = userInfo();
-    if (info.username === sudoUser) {
-      return { targetHome: info.homedir, targetUid: info.uid, targetGid: info.gid };
-    }
-  } catch {
-  }
-  const sudoUid = parseInt(process.env.SUDO_UID ?? "", 10);
-  const sudoGid = parseInt(process.env.SUDO_GID ?? "", 10);
-  if (!Number.isFinite(sudoUid) || !Number.isFinite(sudoGid)) return null;
-  const home = `/home/${sudoUser}`;
-  return { targetHome: home, targetUid: sudoUid, targetGid: sudoGid };
-}
-function shouldSkipSilently() {
-  if (process.env.DG_FORCE_POSTINSTALL === "1") return false;
-  const ciFlags = [
-    "CI",
-    "GITHUB_ACTIONS",
-    "GITLAB_CI",
-    "BUILDKITE",
-    "CIRCLECI",
-    "JENKINS_URL",
-    "DRONE",
-    "TRAVIS",
-    "TF_BUILD"
-  ];
-  for (const flag of ciFlags) {
-    if (process.env[flag] && process.env[flag] !== "false" && process.env[flag] !== "0") return true;
-  }
-  if (process.env.DG_NO_RC_EDIT === "1") return true;
-  return false;
-}
-function emit(msg) {
-  process.stderr.write(msg + "\n");
-}
-async function main() {
-  if (shouldSkipSilently()) return;
-  const sudo = process.platform === "win32" ? null : detectSudo();
-  const targetHome = sudo?.targetHome ?? homedir7();
-  const targetUid = sudo?.targetUid;
-  const targetGid = sudo?.targetGid;
-  try {
-    const result = installShims({ targetHome, targetUid, targetGid });
-    const rcAppended = result.rcOutcomes.filter((o) => o.status === "appended").map((o) => o.path);
-    const ecosystemsWired = result.shimsCreated.length;
-    let pythonVersions = [];
-    try {
-      const pyResult = installPythonHooks({ targetHome, uid: targetUid, gid: targetGid });
-      pythonVersions = pyResult.results.filter((r) => r.status === "installed").map((r) => r.pythonVersion);
-    } catch {
-    }
-    void ecosystemsWired;
-    const rcPath = rcAppended[0] ?? result.rcOutcomes.find((o) => o.status === "already-present")?.path ?? null;
-    const shimDir2 = `${targetHome}/.dg/shims`;
-    const activeNow = (process.env.PATH ?? "").split(":").includes(shimDir2);
-    emit("\u2713 Dependency Guardian installed.");
-    emit("\u2713 Wired: npm, pnpm, yarn, bun, pip, pip3, uv, pipx, conda, mamba.");
-    if (pythonVersions.length > 0) {
-      emit(`\u2713 python -m pip \u2014 wired on ${pythonVersions.join(", ")}.`);
-    }
-    if (rcPath) emit(`\u2713 Added ${shimDir2} to PATH in ${rcPath}.`);
-    emit("");
-    if (!activeNow) {
-      emit("  \u26A0 One more step \u2014 activate it in your shell:");
-      emit(rcPath ? `      source ${rcPath}      (or just open a new terminal)` : "      open a new terminal");
-      emit("    Until you do, installs in THIS shell still run unscanned.");
-      emit("");
-    }
-    emit("  Then:");
-    emit("    dg login      authenticate your account");
-    emit("    dg status     see what's protected (and if this shell is active)");
-    emit("    dg uninstall  remove everything");
-  } catch (err) {
-    emit("\u2139\uFE0F  Dependency Guardian installed.");
-    emit(`   Setup did not complete: ${err.message}`);
-    emit("   Reinstall with `npm install -g @westbayberry/dg` to retry.");
-  }
-}
-void main();