@westbayberry/dg 2.0.11 → 2.2.0

package/dist/commands/setup.js

@@ -1,34 +1,40 @@
 import { EXIT_UNAVAILABLE, EXIT_USAGE } from "./types.js";
 import { LockBusyError } from "../state/index.js";
-import { activationCommand as shellActivationCommand, applySetupPlanWithLock, buildSetupPlan, renderSetupPlan } from "../setup/plan.js";
+import { activationCommand as shellActivationCommand, applySetupPlanWithLock, buildSetupPlan, renderSetupPlan, tildifyPath as tildify } from "../setup/plan.js";
+import { activateShell, activationOffer } from "../setup/activate-shell.js";
 import { buildServiceSetupPlan, configureService, renderServicePlan } from "../service/state.js";
 import { optionalSupportGate } from "../setup/optional-support.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { closeSync, openSync, readSync } from "node:fs";
-import { homedir } from "node:os";
 import { authStatus } from "../auth/store.js";
+import { resolveWebBase } from "../auth/device-login.js";
+import { applyAgentHook, collectAgentOffers } from "../agents/registry.js";
+import { applyGitHook, commitGuardOffer } from "../setup/git-hook.js";
+import { markSecurityNotesShown, securityNotesShown } from "../setup-ui/gate.js";
 export const setupCommand = {
     name: "setup",
-    summary: "Protect plain npm/pip/yarn installs (no dg prefix needed).",
-    usage: "dg setup [--print] [--yes] [--shell <auto|zsh|bash|fish>] [--service]",
+    summary: "Protect this machine — shell installs, AI-agent installs, and a repo's commits.",
+    usage: "dg setup [--print] [--yes] [--agents] [--guard-commit] [--shell <auto|zsh|bash|fish>] [--service]",
     flags: [
         { flag: "--print", summary: "Preview the exact write plan and change nothing." },
-        { flag: "--yes", summary: "Apply without the interactive prompt (required when non-interactive)." },
+        { flag: "--yes", summary: "Apply the shell firewall only, without prompts (add --agents / --guard-commit to opt in the rest)." },
+        { flag: "--agents", summary: "With --yes: also route every detected AI agent's installs through dg." },
+        { flag: "--guard-commit", summary: "With --yes: also scan this repo's commits (per-repo)." },
         { flag: "--shell", value: "<auto|zsh|bash|fish>", summary: "Target shell rc to write (default: auto-detect)." },
         { flag: "--service", summary: "Set up service mode (Pro/Team; persistent proxy + managed CA)." }
     ],
-    examples: ["dg setup --print", "dg setup --yes", "dg setup --shell zsh --yes"],
+    examples: ["dg setup", "dg setup --print", "dg setup --yes --agents", "dg setup --shell zsh --yes"],
     details: [
-        "In a terminal, shows what it writes and asks before applying, then reloads your shell. Use --yes to apply non-interactively and --print to preview only.",
-        "Writes only dg-owned reversible files and repairs setup drift; undo with dg uninstall. The per-repo git pre-commit hook is separate — see dg guard-commit."
+        "In a terminal it shows one consent screen listing everything it will protect — your shell's installs plus every detected AI agent, with the exact files it writes — and applies them on a single yes. Commits in the current repo are a separate per-repo question.",
+        "Non-interactively, --yes applies just the shell firewall; add --agents and/or --guard-commit to opt those in. --print previews. Writes only dg-owned reversible files; undo it all with dg uninstall."
     ],
     handler: (context) => setupHandler(context.args)
 };
 const WINDOWS_UNSUPPORTED = "dg setup (automatic interception) does not support Windows yet.\n" +
     "You can still protect installs on Windows: prefix the command with dg,\n" +
     "for example `dg pip install <pkg>` or `dg npm install <pkg>`.\n";
-function setupHandler(args) {
+async function setupHandler(args) {
     const parsed = parseSetupArgs(args);
     if ("error" in parsed) {
         return {
@@ -54,12 +60,16 @@ function setupHandler(args) {
     if (parsed.printOnly) {
         return {
             exitCode: 0,
-            stdout: renderedPlan,
+            stdout: `${renderedPlan}${printableSurfaceOffers()}`,
             stderr: ""
         };
     }
     if (!parsed.yes) {
         if (isInteractive()) {
+            if (resolvePresentation().mode === "rich") {
+                const { runSetupWizard } = await import("../setup-ui/wizard.js");
+                return runSetupWizard(plan, { autoActivate: true });
+            }
             return runInteractiveSetup(plan);
         }
         return {
@@ -81,23 +91,34 @@ function setupHandler(args) {
         }
         throw error;
     }
+    const extra = await applyRequestedSurfaces(parsed);
+    const theme = createTheme(resolvePresentation().color);
     return {
         exitCode: 0,
-        stdout: `${renderedPlan}\nSet up — active in new terminals. Activate this shell now: ${activationCommand(plan)}\n`,
+        stdout: `${theme.paint("pass", "✓")} Setup complete — active in new terminals ${theme.paint("muted", `(wrote ${tildify(plan.shimDir)} and ${tildify(plan.rcPath)}; details: dg doctor)`)}\n${extra}Activate this shell now: ${theme.paint("accent", activationCommand(plan))}\n`,
         stderr: ""
     };
 }
 function isInteractive() {
     return Boolean(process.stdin.isTTY && process.stderr.isTTY);
 }
-function runInteractiveSetup(plan) {
+async function runInteractiveSetup(plan) {
     const theme = createTheme(resolvePresentation().color);
     const accent = (text) => theme.paint("accent", text);
     const muted = (text) => theme.paint("muted", text);
     const err = process.stderr;
-    err.write(`\n  Scans ${accent("npm")}/${accent("pip")}/${accent("yarn")}/${muted("…")} installs automatically — no ${accent("dg")} prefix.\n`);
-    err.write(`  ${muted("Writes")} ${accent(tildify(plan.rcPath))}${muted(".")} ${muted("Reversible with")} ${accent("dg uninstall")}${muted(".")}\n\n`);
-    const answer = promptYesNoSync(`  ${accent("Proceed?")}`, theme);
+    const agents = collectAgentOffers();
+    const repo = commitGuardOffer();
+    if (!securityNotesShown()) {
+        err.write(renderSecurityNotesText(theme));
+        err.write(`  ${muted("Press Enter to agree")} `);
+        if (readLineFromTty() !== null) {
+            markSecurityNotesShown();
+        }
+        err.write("\n");
+    }
+    err.write(renderConsentScreen(consentSurfaces(plan, agents, repo !== null), theme));
+    const answer = promptYesNoSync(`  ${accent("Protect installs on this machine?")}`, theme, true);
     if (answer === "no-tty") {
         return {
             exitCode: EXIT_USAGE,
@@ -121,21 +142,152 @@ function runInteractiveSetup(plan) {
         }
         throw error;
     }
-    err.write(`\n  ${theme.paint("pass", "✓ set up — active in new terminals")}\n`);
-    err.write(`  ${muted("Activate this shell now:")}  ${accent(activationCommand(plan))}\n`);
+    err.write(`\n  ${theme.paint("pass", "✓ shell installs protected — active in new terminals")}\n`);
+    await applyAgentOffers(agents, theme, err);
+    promptCommitSurface(repo, theme, err);
+    return finishWithActivation(plan, theme, err);
+}
+export function consentSurfaces(plan, agents, repoOffered) {
+    const surfaces = [
+        { label: "shell installs", detail: `writes ${tildify(plan.rcPath)}`, deferred: false }
+    ];
+    for (const offer of agents) {
+        surfaces.push({ label: `${offer.label} installs`, detail: `writes ${tildify(offer.ctx.settingsPath)}`, deferred: false });
+    }
+    if (repoOffered) {
+        surfaces.push({ label: "commits in this repo", detail: "asked separately", deferred: true });
+    }
+    return surfaces;
+}
+export function renderConsentScreen(surfaces, theme) {
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const width = Math.max(...surfaces.map((surface) => surface.label.length));
+    const lines = [
+        "",
+        `  Scans ${accent("npm")}/${accent("pip")}/${accent("yarn")}/${muted("…")} installs automatically — no ${accent("dg")} prefix.`,
+        `  ${muted("Reversible with")} ${accent("dg uninstall")}${muted(".")}`,
+        "",
+        `  ${muted("Sets up:")}`
+    ];
+    for (const surface of surfaces) {
+        const label = surface.label.padEnd(width);
+        lines.push(surface.deferred ? `    ${muted(label)}  ${muted(surface.detail)}` : `    ${accent(label)}  ${muted(surface.detail)}`);
+    }
+    lines.push("", "");
+    return lines.join("\n");
+}
+function finishWithActivation(plan, theme, err) {
+    const offer = activationOffer();
+    if (offer === "none") {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    if (offer === "prompt" && promptYesNoSync(`\n  ${accent("Activate in this terminal now?")}`, theme, true) === "yes") {
+        err.write(`  ${muted("Starting a protected shell — type")} ${accent("exit")} ${muted("to return to your previous one.")}\n`);
+        return { exitCode: activateShell(), stdout: "", stderr: "" };
+    }
+    err.write(`\n  ${muted("Activate this shell now:")}  ${accent(activationCommand(plan))}\n`);
     return { exitCode: 0, stdout: "", stderr: "" };
 }
+async function applyAgentOffers(offers, theme, err) {
+    const muted = (text) => theme.paint("muted", text);
+    for (const offer of offers) {
+        try {
+            await applyAgentHook(offer.ctx);
+            err.write(`  ${theme.paint("pass", `✓ ${offer.label} installs route through dg`)} ${muted(`(${tildify(offer.ctx.settingsPath)})`)}\n`);
+        }
+        catch (error) {
+            err.write(`  ${theme.paint("warn", `✗ ${offer.label}`)} ${muted(`— ${error instanceof Error ? error.message : "unknown error"}`)}\n`);
+        }
+    }
+}
+function promptCommitSurface(repo, theme, err) {
+    if (!repo) {
+        return;
+    }
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    err.write(`\n  ${muted("This is a git repo. Scan its commits before they land?")}\n`);
+    if (promptYesNoSync(`  ${accent("Guard commits in this repo?")}`, theme, false) !== "yes") {
+        return;
+    }
+    try {
+        applyGitHook(repo);
+        err.write(`  ${theme.paint("pass", "✓ commits in this repo are now scanned")}\n`);
+    }
+    catch (error) {
+        err.write(`  ${theme.paint("warn", `✗ commits in this repo`)} ${muted(`— ${error instanceof Error ? error.message : "unknown error"}`)}\n`);
+    }
+}
+async function applyRequestedSurfaces(parsed) {
+    const lines = [];
+    if (parsed.agents) {
+        for (const offer of collectAgentOffers()) {
+            try {
+                await applyAgentHook(offer.ctx);
+                lines.push(`${offer.label} installs now route through dg (${tildify(offer.ctx.settingsPath)}).`);
+            }
+            catch (error) {
+                lines.push(`could not hook ${offer.label}: ${error instanceof Error ? error.message : "unknown error"}`);
+            }
+        }
+    }
+    if (parsed.guardCommit) {
+        const repo = commitGuardOffer();
+        if (repo) {
+            try {
+                applyGitHook(repo);
+                lines.push("commits in this repo are now scanned.");
+            }
+            catch (error) {
+                lines.push(`could not install the commit guard: ${error instanceof Error ? error.message : "unknown error"}`);
+            }
+        }
+    }
+    return lines.length > 0 ? `${lines.join("\n")}\n` : "";
+}
+function printableSurfaceOffers() {
+    const lines = [];
+    for (const offer of collectAgentOffers()) {
+        lines.push(`would offer: route ${offer.label} installs through dg (--agents)`);
+    }
+    if (commitGuardOffer()) {
+        lines.push("would offer: scan this repo's commits (--guard-commit)");
+    }
+    return lines.length > 0 ? `\n${lines.join("\n")}\n` : "";
+}
 function activationCommand(plan) {
     return shellActivationCommand(plan.shell, tildify(plan.rcPath));
 }
-function promptYesNoSync(question, theme) {
-    process.stderr.write(`${question} ${theme.paint("muted", "[y/N]")} `);
+function renderSecurityNotesText(theme) {
+    const muted = (text) => theme.paint("muted", text);
+    const webBase = resolveWebBase(process.env);
+    return [
+        "",
+        `  ${theme.paint("accent", "Security notes")}`,
+        "",
+        "  1. dg can make mistakes.",
+        "     A PASS verdict does not guarantee a package is safe. You are",
+        "     responsible for what you install and should review new",
+        "     dependencies.",
+        "",
+        "  2. By continuing you confirm you have read and understand the",
+        "     Terms of Service and Privacy Policy.",
+        `     ${muted(`${webBase}/terms`)}`,
+        `     ${muted(`${webBase}/privacy`)}`,
+        "",
+        ""
+    ].join("\n");
+}
+function readLineFromTty() {
     let tty;
     try {
         tty = openSync("/dev/tty", "rs");
     }
     catch {
-        return "no-tty";
+        return null;
     }
     try {
         const byte = Buffer.alloc(1);
@@ -160,22 +312,31 @@ function promptYesNoSync(question, theme) {
             }
             answer += char;
         }
-        const normalized = answer.trim().toLowerCase();
-        return normalized === "y" || normalized === "yes" ? "yes" : "no";
+        return answer;
     }
     finally {
         closeSync(tty);
     }
 }
-function tildify(path) {
-    const home = homedir();
-    return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+function promptYesNoSync(question, theme, defaultYes = false) {
+    process.stderr.write(`${question} ${theme.paint("muted", defaultYes ? "[Y/n]" : "[y/N]")} `);
+    const answer = readLineFromTty();
+    if (answer === null) {
+        return "no-tty";
+    }
+    const normalized = answer.trim().toLowerCase();
+    if (normalized === "") {
+        return defaultYes ? "yes" : "no";
+    }
+    return normalized === "y" || normalized === "yes" ? "yes" : "no";
 }
 function parseSetupArgs(args) {
     let printOnly = false;
     let yes = false;
     let shell = "auto";
     let service = false;
+    let agents = false;
+    let guardCommit = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === "--print") {
@@ -187,6 +348,12 @@ function parseSetupArgs(args) {
         else if (arg === "--service") {
             service = true;
         }
+        else if (arg === "--agents") {
+            agents = true;
+        }
+        else if (arg === "--guard-commit") {
+            guardCommit = true;
+        }
         else if (arg === "--python-hook" || arg?.startsWith("--python-hook=")) {
             return {
                 exitCode: EXIT_UNAVAILABLE,
@@ -251,7 +418,9 @@ function parseSetupArgs(args) {
         printOnly,
         yes,
         shell,
-        service
+        service,
+        agents,
+        guardCommit
     };
 }
 function parseShell(value) {
@@ -270,10 +439,11 @@ function serviceSetupHandler(parsed) {
         };
     }
     if (!authStatus().authenticated) {
+        const theme = createTheme(resolvePresentation().color);
         return {
             exitCode: EXIT_UNAVAILABLE,
             stdout: "",
-            stderr: "dg setup --service is a Pro or Team feature. Run 'dg login' to connect a paid account, then 'dg setup --service'. See https://westbayberry.com/pricing\n"
+            stderr: `${theme.paint("warn", "dg setup --service is a Pro or Team feature")} — ${theme.paint("accent", "dg login")} ${theme.paint("muted", "with a paid account, then re-run")} ${theme.paint("muted", "· westbayberry.com/pricing")}\n`
         };
     }
     if (!parsed.yes) {

package/dist/commands/status.js

@@ -3,6 +3,7 @@ import { envAuthToken } from "../auth/env-token.js";
 import { fetchAccountStatus } from "../auth/device-login.js";
 import { formatUsage } from "../scan-ui/format-helpers.js";
 import { loadUserConfig } from "../config/settings.js";
+import { describeCooldownSettings } from "../policy/cooldown.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { currentShellActivation, doctorReport } from "../setup/plan.js";
@@ -49,14 +50,15 @@ async function buildStatusReport(io) {
     const checks = doctorReport().checks;
     const checkPassed = (name) => checks.find((check) => check.name === name)?.status === "pass";
     const auth = safeAuthStatus();
-    const policy = loadUserConfig().policy;
+    const config = loadUserConfig();
     return {
         account: auth,
         usage: await fetchStatusUsage(auth.connected, io),
         protection: { shims: checkPassed("shims"), path: checkPassed("path"), configured: checkPassed("shell-rc") },
         reloadHint: currentShellActivation(),
         commitGuard: safeCommitGuard(),
-        policy: { mode: policy.mode, trustProjectAllowlists: policy.trustProjectAllowlists }
+        policy: { mode: config.policy.mode, trustProjectAllowlists: config.policy.trustProjectAllowlists },
+        cooldown: describeCooldownSettings(config, process.env)
     };
 }
 async function fetchStatusUsage(connected, io) {
@@ -123,6 +125,7 @@ function renderStatus(report, theme) {
         lines.push(`  Commit guard ${guard}`);
     }
     lines.push(`  Policy       ${report.policy.mode} mode; project allowlists ${report.policy.trustProjectAllowlists ? "trusted" : "untrusted"}`);
+    lines.push(`  Cooldown     ${report.cooldown === "off" ? "off — new releases install immediately" : `${report.cooldown} release-age gate on new installs`}`);
     lines.push("");
     lines.push(`Full diagnostics: ${theme.paint("accent", "dg doctor")}`);
     return `${lines.join("\n")}\n`;

package/dist/commands/types.js

@@ -1,5 +1,6 @@
 export const EXIT_USAGE = 2;
 export const EXIT_USAGE_VERDICT = 64;
+export const EXIT_ANALYSIS_INCOMPLETE = 4;
 export const EXIT_NOTHING_TO_SCAN = 10;
 export const EXIT_UNAVAILABLE = 69;
 export const EXIT_TOOL_ERROR = 70;

package/dist/commands/update.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
-import { npmExecutable } from "../publish-set/npm.js";
+import { toolInvocation } from "../util/external-tool.js";
 import { EXIT_USAGE } from "./types.js";
 import { dgVersion } from "./version.js";
 const PACKAGE_NAME = "@westbayberry/dg";
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/u;
 export const updateCommand = {
     name: "update",
     summary: "Check for dg CLI updates.",
@@ -26,7 +27,7 @@ function runUpdateCommand(args, commandName) {
     if (parsed.format === "json") {
         return {
             exitCode: report.status === "unknown" ? 1 : 0,
-            stdout: `${JSON.stringify(report, null, 2)}\n`,
+            stdout: `${JSON.stringify({ schemaVersion: 1, ...report }, null, 2)}\n`,
             stderr: ""
         };
     }
@@ -62,17 +63,22 @@ function parseUpdateArgs(args) {
     };
 }
 export function readLatestVersion(timeoutMs = 5000) {
-    const injected = process.env.DG_UPDATE_LATEST_VERSION;
+    const injected = process.env.NODE_ENV === "test" ? process.env.DG_UPDATE_LATEST_VERSION : undefined;
     if (injected) {
-        return injected;
+        return validVersion(injected);
     }
-    const result = spawnSync(npmExecutable(), ["view", PACKAGE_NAME, "version", "--json"], {
+    const invocation = toolInvocation("npm", ["view", PACKAGE_NAME, "version", "--json"]);
+    if (!invocation) {
+        return null;
+    }
+    const result = spawnSync(invocation.command, [...invocation.args], {
         encoding: "utf8",
         env: {
             ...process.env,
             npm_config_ignore_scripts: "true"
         },
-        timeout: timeoutMs
+        timeout: timeoutMs,
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments
     });
     if (result.status !== 0) {
         return null;
@@ -83,12 +89,15 @@ export function readLatestVersion(timeoutMs = 5000) {
     }
     try {
         const parsed = JSON.parse(raw);
-        return typeof parsed === "string" ? parsed : null;
+        return typeof parsed === "string" ? validVersion(parsed) : null;
     }
     catch {
-        return raw.replace(/^"|"$/gu, "");
+        return validVersion(raw.replace(/^"|"$/gu, ""));
     }
 }
+function validVersion(value) {
+    return VERSION_PATTERN.test(value) ? value : null;
+}
 function buildUpdateReport(latestVersion) {
     if (!latestVersion) {
         return {

package/dist/commands/verify.js

@@ -1,4 +1,4 @@
-import { EXIT_UNAVAILABLE, EXIT_USAGE } from "./types.js";
+import { EXIT_ANALYSIS_INCOMPLETE, EXIT_UNAVAILABLE, EXIT_USAGE_VERDICT } from "./types.js";
 import { writeFileSync } from "node:fs";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
@@ -22,14 +22,14 @@ export const verifyCommand = {
     ],
     examples: ["dg verify npm:react", "dg verify pypi:requests@2.31.0", "dg verify ./pkg.tgz --verbose", "dg verify package-lock.json --json"],
     details: [
-        "dg verify npm:react (or pypi:requests, with an optional @version — defaults to latest) runs a real scanner check on a published package before you install it. This is a Pro/Team feature and requires dg login.",
+        "dg verify npm:react (or pypi:requests, with an optional @version — defaults to latest) runs a real scanner check on a published package before you install it. Signed-out runs show the verdict and top reasons; dg login unlocks full findings, license info, --json, and --output.",
         "Local paths, workspaces, tgz/zip/wheel artifacts, and lockfiles are verified offline as advisory preflight (free); proxy enforcement remains authoritative for network artifact fetches."
     ],
     handler: (context) => {
         const parsed = parseVerifyArgs(context.args);
         if ("error" in parsed) {
             return {
-                exitCode: EXIT_USAGE,
+                exitCode: EXIT_USAGE_VERDICT,
                 stdout: "",
                 stderr: `dg verify: ${parsed.error}. Usage: dg verify <spec|path|lockfile> [--verbose] [--json|--sarif] [--output <path>]\n`
             };
@@ -52,7 +52,7 @@ export const verifyCommand = {
             }
             catch (error) {
                 return {
-                    exitCode: 1,
+                    exitCode: EXIT_ANALYSIS_INCOMPLETE,
                     stdout: "",
                     stderr: `dg verify could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n`
                 };
@@ -147,5 +147,8 @@ function exitCodeForReport(report) {
     if (report.status === "block") {
         return 2;
     }
-    return report.status === "warn" || report.status === "error" ? 1 : 0;
+    if (report.status === "error") {
+        return EXIT_ANALYSIS_INCOMPLETE;
+    }
+    return report.status === "warn" ? 1 : 0;
 }