@westbayberry/dg 2.0.3 → 2.0.4

package/dist/setup/plan.js

@@ -14,6 +14,8 @@ import { OPTIONAL_SUPPORT_GATES } from "./optional-support.js";
 export const SHIM_COMMANDS = Object.freeze(["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pipx", "uv", "uvx", "cargo"]);
 export const SHIM_SENTINEL = "dg-shim-v1";
 export const RC_SENTINEL = "dg-shell-rc-v1";
+export const RC_FUNCTIONS_SENTINEL = "dg-shim-functions-v1";
+const RC_SHIM_HELPER = "__dg_shim";
 export const GUARD_HOOK_SENTINEL = "dg-git-hook-v1";
 export const RC_BEGIN = "# >>> dg setup >>>";
 export const RC_END = "# <<< dg setup <<<";
@@ -273,6 +275,7 @@ export function doctorReport(options = {}) {
     });
     const rcEntries = registryRead.registry.entries.filter((entry) => entry.owner === "dg" && entry.kind === "rc");
     const missingRc = rcEntries.filter((entry) => !readText(entry.path).includes(RC_SENTINEL));
+    const functionsPresent = rcEntries.some((entry) => readText(entry.path).includes(RC_FUNCTIONS_SENTINEL));
     checks.push({
         name: "shell-rc",
         status: rcEntries.length > 0 && missingRc.length === 0 ? "pass" : "warn",
@@ -286,7 +289,7 @@ export function doctorReport(options = {}) {
             ? "No legacy dg pip hooks in user site-packages"
             : `Legacy dg pip hooks break pip in: ${staleHookSites.join(", ")}`
     });
-    checks.push(pathPrecedenceCheck(env, shimDir));
+    checks.push(pathPrecedenceCheck(env, shimDir, functionsPresent));
     checks.push({
         name: "stale-sessions",
         status: staleSessions.length === 0 ? "pass" : "warn",
@@ -510,11 +513,20 @@ function withRcBlock(existing, plan) {
     const prefix = withoutExisting.length > 0 && !withoutExisting.endsWith("\n") ? `${withoutExisting}\n` : withoutExisting;
     return `${prefix}${block}`;
 }
+// The PATH export covers child processes that inherit it; the shell functions
+// win even when a virtualenv prepends its own bin ahead of the shim dir, since
+// a function is resolved before PATH. Each delegates to the fail-open shim and
+// falls back to the real command if the shim is gone.
 function posixRcBlock(shimDir) {
-    return `${RC_BEGIN}\n# ${RC_SENTINEL}\nexport PATH="${escapeDoubleQuotedSh(shimDir)}:$PATH"\n${RC_END}\n`;
+    const dir = escapeDoubleQuotedSh(shimDir);
+    const helper = `${RC_SHIM_HELPER}() { local __dg_c="$1"; shift; if [ -x "${dir}/$__dg_c" ]; then "${dir}/$__dg_c" "$@"; else command "$__dg_c" "$@"; fi; }`;
+    const fns = SHIM_COMMANDS.map((command) => `${command}() { ${RC_SHIM_HELPER} ${command} "$@"; }`).join("\n");
+    return `${RC_BEGIN}\n# ${RC_SENTINEL}\n# ${RC_FUNCTIONS_SENTINEL}\nexport PATH="${dir}:$PATH"\n${helper}\n${fns}\n${RC_END}\n`;
 }
 function fishRcBlock(shimDir) {
-    return `${RC_BEGIN}\n# ${RC_SENTINEL}\nfish_add_path -p "${escapeDoubleQuotedFish(shimDir)}"\n${RC_END}\n`;
+    const dir = escapeDoubleQuotedFish(shimDir);
+    const fns = SHIM_COMMANDS.map((command) => `function ${command}; if test -x "${dir}/${command}"; "${dir}/${command}" $argv; else; command ${command} $argv; end; end`).join("\n");
+    return `${RC_BEGIN}\n# ${RC_SENTINEL}\n# ${RC_FUNCTIONS_SENTINEL}\nfish_add_path -p "${dir}"\n${fns}\n${RC_END}\n`;
 }
 function stripRcBlock(existing) {
     const pattern = new RegExp(`${escapeRegex(RC_BEGIN)}\\n[\\s\\S]*?${escapeRegex(RC_END)}\\n?`, "g");
@@ -778,7 +790,7 @@ function serviceCheck(env) {
         message: `Service mode is running at ${state.proxy.proxyUrl}; trust installed: ${state.trustInstalled ? "yes" : "no"}`
     };
 }
-function pathPrecedenceCheck(env, shimDir) {
+function pathPrecedenceCheck(env, shimDir, functionsPresent) {
     const pathEntries = (env.PATH ?? "").split(delimiter).filter(Boolean);
     const shimIndex = pathEntries.indexOf(shimDir);
     const activateFix = `activate this shell: ${currentShellActivation(env)} — or open a new terminal`;
@@ -812,11 +824,18 @@ function pathPrecedenceCheck(env, shimDir) {
         };
     }
     if (offender) {
+        if (functionsPresent) {
+            return {
+                name: "path",
+                status: "pass",
+                message: `${offender.dir} resolves ${offender.command} first (e.g. an active virtualenv); dg shell functions intercept bare installs regardless`
+            };
+        }
         return {
             name: "path",
             status: "warn",
             message: `${shimDir} is on PATH but ${offender.dir} resolves ${offender.command} first`,
-            fix: activateFix
+            fix: `re-run dg setup to intercept inside virtualenvs — or ${activateFix}`
         };
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@westbayberry/dg",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Dependency Guardian supply-chain firewall CLI",
   "type": "module",
   "bin": {