@westbayberry/dg 2.1.0 → 2.2.0

package/dist/setup/git-hook.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { isAbsolute, join, resolve, sep } from "node:path";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { randomBytes } from "node:crypto";
 import { acquireLockSync, CLEANUP_REGISTRY_LOCK, resolveDgPaths } from "../state/index.js";
+import { resolveToolPath } from "../util/external-tool.js";
 import { gitTrimmed } from "../util/git.js";
 import { GUARD_HOOK_SENTINEL, SETUP_UNINSTALL_LOCK, SETUP_UNINSTALL_LOCK_STALE_MS, chainedHookOriginal, guardHookScript, mergeRegistry, readRegistry, reverseGitHookEntry, writeRegistry } from "./plan.js";
 export { GUARD_HOOK_SENTINEL } from "./plan.js";
@@ -84,7 +85,40 @@ function registryOriginal(context) {
     const entry = readRegistry(context.paths).registry.entries.find((candidate) => candidate.kind === "git-hook" && candidate.owner === "dg" && candidate.path === context.hookTarget);
     return entry?.original ?? null;
 }
+function isSymlinkPath(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function writeHookAtomic(target, content) {
+    const tmp = join(dirname(target), `.pre-commit.dg-${randomBytes(6).toString("hex")}.tmp`);
+    writeFileSync(tmp, content, { encoding: "utf8", mode: 0o755, flag: "wx" });
+    try {
+        renameSync(tmp, target);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
 export function applyGitHook(context, now = new Date()) {
+    if (gitHookState(context) !== "foreign" && isSymlinkPath(context.hookTarget)) {
+        return {
+            hookTarget: context.hookTarget,
+            chainedOriginal: null,
+            checks: [
+                {
+                    name: "hook-writable",
+                    ok: false,
+                    detail: `${context.hookTarget} is a symlink; dg refuses to replace it — remove the link or point it at a real file, then re-run dg guard-commit`
+                }
+            ],
+            active: false
+        };
+    }
     const lock = acquireLockSync(context.paths, SETUP_UNINSTALL_LOCK, { staleMs: SETUP_UNINSTALL_LOCK_STALE_MS });
     let chainedOriginal = null;
     try {
@@ -98,7 +132,7 @@ export function applyGitHook(context, now = new Date()) {
         else if (state === "managed") {
             chainedOriginal = chainedHookOriginal(hookText(context.hookTarget)) ?? registryOriginal(context);
         }
-        writeFileSync(context.hookTarget, guardHookScript(context.dgPath, chainedOriginal), { encoding: "utf8", mode: 0o755 });
+        writeHookAtomic(context.hookTarget, guardHookScript(context.dgPath, chainedOriginal));
         chmodSync(context.hookTarget, 0o755);
         const entry = {
             kind: "git-hook",
@@ -176,7 +210,11 @@ function runSelfTest(context) {
     if (!existsSync(context.hookTarget) || !isManaged(context.hookTarget)) {
         return { ok: false, detail: "no dg hook to exercise" };
     }
-    const result = spawnSync("sh", [context.hookTarget], {
+    const sh = resolveToolPath("sh", context.env);
+    if (!sh) {
+        return { ok: false, detail: "sh not found on PATH; hook not exercised" };
+    }
+    const result = spawnSync(sh, [context.hookTarget], {
         cwd: context.root,
         env: { ...context.env, [GUARD_SELFTEST_ENV]: "1" },
         encoding: "utf8",
@@ -219,6 +257,13 @@ export function gitHookStatusState(options = {}) {
     const installedHere = registry.entries.some((entry) => entry.kind === "git-hook" && entry.owner === "dg" && isUnderRoot(entry.path, context.root));
     return installedHere ? "dead" : "off";
 }
+export function commitGuardOffer(options = {}) {
+    const resolved = resolveGitRepo(options);
+    if ("error" in resolved) {
+        return null;
+    }
+    return gitHookStatusState(options) === "off" ? resolved : null;
+}
 export function removeGitHookForRepo(context) {
     const lock = acquireLockSync(context.paths, SETUP_UNINSTALL_LOCK, { staleMs: SETUP_UNINSTALL_LOCK_STALE_MS });
     const removed = [];

package/dist/setup/plan.js

@@ -1,7 +1,10 @@
-import { accessSync, constants, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, constants, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve, sep } from "node:path";
 import { chmodSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { homedir } from "node:os";
 import { createTheme } from "../presentation/theme.js";
+import { reverseAgentHookEntry } from "../agents/registry.js";
 import { acquireLockSync, findStaleSessionsSync, preserveCorruptCleanupRegistrySync, resolveDgPaths, sweepStaleSessionsSync, CLEANUP_REGISTRY_LOCK } from "../state/index.js";
 import { currentNodeVersion, isSupportedNode } from "../runtime/node-version.js";
 import { dgVersion } from "../commands/version.js";
@@ -28,6 +31,7 @@ const LEGACY_RC_CANDIDATES = [".zshrc", ".bashrc", ".bash_profile", ".profile",
 const LEGACY_PYTHON_HOOK_PY = "dg_pip_hook.py";
 const LEGACY_PYTHON_HOOK_PTH = "dg_pip_hook.pth";
 const LEGACY_PYTHON_HOOK_MARKER = "Dependency Guardian pip-install interceptor";
+const LEGACY_PYTHON_HOOK_PTH_MARKER = "import dg_pip_hook";
 export const SETUP_UNINSTALL_LOCK = "setup-uninstall";
 export const SETUP_UNINSTALL_LOCK_STALE_MS = 30 * 60 * 1000;
 export const STALE_SESSION_OLDER_THAN_MS = 24 * 60 * 60 * 1000;
@@ -44,7 +48,6 @@ const DOCTOR_GROUP_BY_NAME = {
     config: "setup",
     policy: "setup",
     "script-gate": "setup",
-    telemetry: "setup",
     shims: "setup",
     "shell-rc": "setup",
     "python-hook-drift": "setup",
@@ -64,7 +67,6 @@ const DOCTOR_FIX_BY_NAME = {
     "cleanup-registry-stale-entries": "re-run dg setup to refresh",
     config: "fix or remove ~/.dg, then re-run dg setup",
     policy: "fix ~/.dg config",
-    telemetry: "fix ~/.dg config",
     shims: "dg setup",
     "shell-rc": "dg setup",
     "python-hook-drift": "dg uninstall, or re-run dg setup, to remove the stale pip hook",
@@ -156,7 +158,7 @@ export function applySetupPlan(plan, now = new Date()) {
         recursive: true,
         mode: 0o700
     });
-    writeFileSync(plan.rcPath, withRcBlock(readText(plan.rcPath), plan), "utf8");
+    writeRcFileAtomic(plan.rcPath, withRcBlock(readText(plan.rcPath), plan));
     entries.push(cleanupEntry("rc", plan.rcPath, "mode1", now, RC_SENTINEL));
     sweepLegacyPythonHooks(plan.paths.homeDir, [], []);
     const registry = withRegistryLock(plan.paths, () => {
@@ -213,6 +215,9 @@ export function uninstallSetup(options) {
             else if (entry.kind === "git-hook") {
                 reverseGitHookEntry(entry, removed, missing, warnings);
             }
+            else if (entry.kind === "agent-hook") {
+                reverseAgentHookEntry(entry, removed, missing, warnings);
+            }
         }
         sweepLegacyRcBlocks(paths.homeDir, removed, warnings);
         sweepLegacyPythonHooks(paths.homeDir, removed, warnings);
@@ -278,7 +283,6 @@ export function doctorReport(options = {}) {
     checks.push(authCheck(env));
     checks.push(policyCheck(env));
     checks.push(scriptGateCheck(env));
-    checks.push(telemetryCheck(env));
     const missingShims = SHIM_COMMANDS.filter((command) => !validShim(join(shimDir, command), command));
     checks.push({
         name: "shims",
@@ -568,6 +572,9 @@ function shellRcPath(homeDir, shell) {
     }
     return join(homeDir, ".zshrc");
 }
+export function tildifyPath(path, home = homedir()) {
+    return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+}
 export function activationCommand(shell, rcDisplay) {
     if (shell === "fish") {
         return `source ${rcDisplay}`;
@@ -647,6 +654,26 @@ function fishRcBlock(shimDir) {
 function stripRcBlock(existing) {
     return stripRcBlockDetailed(existing).content;
 }
+function writeRcFileAtomic(rcPath, content) {
+    let target = rcPath;
+    let mode = 0o644;
+    try {
+        target = realpathSync(rcPath);
+        mode = statSync(target).mode & 0o7777;
+    }
+    catch {
+        // no existing file: write a fresh rc at the requested path
+    }
+    const tempPath = join(dirname(target), `.${basename(target)}.dg-${randomBytes(6).toString("hex")}.tmp`);
+    writeFileSync(tempPath, content, { encoding: "utf8", mode, flag: "wx" });
+    try {
+        renameSync(tempPath, target);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
+}
 // An unterminated begin marker must never strip to EOF: only lines verifiably
 // written by dg are removed, so user content below a stale marker survives.
 function stripRcBlockDetailed(existing) {
@@ -696,7 +723,7 @@ function sweepLegacyRcBlocks(homeDir, removed, warnings) {
             continue;
         }
         try {
-            writeFileSync(rcPath, next, "utf8");
+            writeRcFileAtomic(rcPath, next);
             removed.push(`${rcPath} (legacy dg block)`);
         }
         catch (error) {
@@ -704,19 +731,23 @@ function sweepLegacyRcBlocks(homeDir, removed, warnings) {
         }
     }
 }
+function isLegacyPthHook(pthPath) {
+    const content = readText(pthPath);
+    return content.includes(LEGACY_PYTHON_HOOK_PTH_MARKER) || content.includes(LEGACY_PYTHON_HOOK_MARKER);
+}
 export function legacyPythonHookSites(homeDir) {
-    return candidateSitePackagesDirs(homeDir).filter((dir) => existsSync(join(dir, LEGACY_PYTHON_HOOK_PTH)) || readText(join(dir, LEGACY_PYTHON_HOOK_PY)).includes(LEGACY_PYTHON_HOOK_MARKER));
+    return candidateSitePackagesDirs(homeDir).filter((dir) => isLegacyPthHook(join(dir, LEGACY_PYTHON_HOOK_PTH)) || readText(join(dir, LEGACY_PYTHON_HOOK_PY)).includes(LEGACY_PYTHON_HOOK_MARKER));
 }
 export function sweepLegacyPythonHooks(homeDir, removed, warnings) {
     for (const dir of candidateSitePackagesDirs(homeDir)) {
         const pyPath = join(dir, LEGACY_PYTHON_HOOK_PY);
         const pthPath = join(dir, LEGACY_PYTHON_HOOK_PTH);
         const pyIsHook = readText(pyPath).includes(LEGACY_PYTHON_HOOK_MARKER);
-        const pthPresent = existsSync(pthPath);
-        if (!pyIsHook && !pthPresent) {
+        const pthIsHook = isLegacyPthHook(pthPath);
+        if (!pyIsHook && !pthIsHook) {
             continue;
         }
-        if (pthPresent) {
+        if (pthIsHook) {
             removePythonHookFile(pthPath, removed, warnings);
         }
         if (pyIsHook) {
@@ -873,7 +904,7 @@ function dgPathCheck(env) {
     };
 }
 function currentDgBinaryPath(env) {
-    const explicit = env.DG_TEST_CURRENT_DG_PATH;
+    const explicit = env.NODE_ENV === "test" ? env.DG_TEST_CURRENT_DG_PATH : undefined;
     if (explicit) {
         return explicit;
     }
@@ -1136,34 +1167,24 @@ function scriptGateCheck(env) {
         };
     }
 }
-function telemetryCheck(env) {
-    try {
-        const config = loadUserConfig(env);
-        return {
-            name: "telemetry",
-            status: "pass",
-            message: config.telemetry.enabled ? "Telemetry is enabled with minimized event fields" : "Telemetry is disabled"
-        };
-    }
-    catch (error) {
-        return {
-            name: "telemetry",
-            status: "fail",
-            message: error instanceof ConfigError ? error.message : "Unable to read telemetry config"
-        };
-    }
-}
 export function writeRegistry(paths, registry) {
     mkdirSync(dirname(paths.cleanupRegistryPath), {
         recursive: true,
         mode: 0o700
     });
-    const tempPath = `${paths.cleanupRegistryPath}.${process.pid}.tmp`;
+    const tempPath = `${paths.cleanupRegistryPath}.${randomBytes(6).toString("hex")}.tmp`;
     writeFileSync(tempPath, `${JSON.stringify(registry, null, 2)}\n`, {
         encoding: "utf8",
-        mode: 0o600
+        mode: 0o600,
+        flag: "wx"
     });
-    renameSync(tempPath, paths.cleanupRegistryPath);
+    try {
+        renameSync(tempPath, paths.cleanupRegistryPath);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
 }
 function withRegistryLock(paths, action) {
     const lock = acquireLockSync(paths, CLEANUP_REGISTRY_LOCK, {
@@ -1204,7 +1225,13 @@ function removeRcBlock(entry, removed, missing, warnings) {
         return;
     }
     const stripped = stripRcBlockDetailed(existing);
-    writeFileSync(entry.path, stripped.content, "utf8");
+    try {
+        writeRcFileAtomic(entry.path, stripped.content);
+    }
+    catch (error) {
+        warnings.push(`could not rewrite shell rc ${entry.path}: ${error instanceof Error ? error.message : "write error"}`);
+        return;
+    }
     if (stripped.repairedLines.length > 0) {
         warnings.push(`repaired an unterminated dg block in ${entry.path}: removed only dg-written lines (${stripped.repairedLines.join(", ")})`);
     }
@@ -1214,28 +1241,35 @@ function removeRcBlock(entry, removed, missing, warnings) {
 // a one-line notice and lets the commit (and any chained hook) proceed instead
 // of blocking every commit with exit 127.
 export function guardHookScript(dgPath, chainedOriginal) {
+    const dg = escapeDoubleQuotedSh(dgPath);
     const lines = [
         "#!/bin/sh",
         `# ${GUARD_HOOK_SENTINEL}`,
-        `if command -v "${dgPath}" >/dev/null 2>&1; then`,
-        `  "${dgPath}" scan --staged --hook || exit $?`,
+        `if command -v "${dg}" >/dev/null 2>&1; then`,
+        `  "${dg}" scan --staged --hook || exit $?`,
         "else",
-        `  echo "dg: pre-commit scan skipped (dg not runnable at ${dgPath}); commit allowed" >&2`,
+        `  echo "dg: pre-commit scan skipped (dg not runnable at ${dg}); commit allowed" >&2`,
         "fi"
     ];
     if (chainedOriginal) {
-        lines.push(`[ -x "${chainedOriginal}" ] && exec "${chainedOriginal}" "$@"`);
+        const chained = escapeDoubleQuotedSh(chainedOriginal);
+        lines.push(`[ -x "${chained}" ] && exec "${chained}" "$@"`);
     }
     lines.push("exit 0");
     return `${lines.join("\n")}\n`;
 }
+function unescapeDoubleQuotedSh(value) {
+    return value.replace(/\\([\\"$`])/g, "$1");
+}
 export function chainedHookOriginal(content) {
-    return content.match(/^\[ -x "(.+)" \] && exec "\1" "\$@"$/m)?.[1] ?? null;
+    const matched = content.match(/^\[ -x "(.+)" \] && exec "\1" "\$@"$/m)?.[1];
+    return matched ? unescapeDoubleQuotedSh(matched) : null;
 }
 export function guardHookDgPath(content) {
-    return (content.match(/^if command -v "(.+)" >\/dev\/null 2>&1; then$/m)?.[1] ??
+    const matched = content.match(/^if command -v "(.+)" >\/dev\/null 2>&1; then$/m)?.[1] ??
         content.match(/^"(.+)" scan --staged --hook/m)?.[1] ??
-        null);
+        null;
+    return matched ? unescapeDoubleQuotedSh(matched) : null;
 }
 function commitGuardCheck(registry, env) {
     const hooks = registry.entries.filter((entry) => entry.owner === "dg" && entry.kind === "git-hook");

package/dist/setup-ui/gate.js

@@ -0,0 +1,39 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isCiEnv } from "../presentation/mode.js";
+import { resolveDgPaths } from "../state/index.js";
+export function setupApplied(env = process.env) {
+    return existsSync(join(resolveDgPaths(env).homeDir, ".dg", "shims", "npm"));
+}
+export function securityNotesMarkerPath(env = process.env) {
+    return join(resolveDgPaths(env).stateDir, "security-notes-shown");
+}
+export function wizardSkippedMarkerPath(env = process.env) {
+    return join(resolveDgPaths(env).stateDir, "setup-wizard-skipped");
+}
+export function securityNotesShown(env = process.env) {
+    return existsSync(securityNotesMarkerPath(env));
+}
+export function markSecurityNotesShown(env = process.env, now = new Date()) {
+    writeMarker(securityNotesMarkerPath(env), now);
+}
+export function markWizardSkipped(env = process.env, now = new Date()) {
+    writeMarker(wizardSkippedMarkerPath(env), now);
+}
+export function shouldOfferSetupWizard(env = process.env, stdin = process.stdin, stderr = process.stderr) {
+    return (process.platform !== "win32" &&
+        Boolean(stdin.isTTY) &&
+        Boolean(stderr.isTTY) &&
+        !isCiEnv(env) &&
+        !setupApplied(env) &&
+        !existsSync(wizardSkippedMarkerPath(env)));
+}
+function writeMarker(path, now) {
+    try {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        writeFileSync(path, `${now.toISOString()}\n`, { encoding: "utf8", mode: 0o600 });
+    }
+    catch {
+        return;
+    }
+}

package/dist/setup-ui/offer.js

@@ -0,0 +1,42 @@
+import { resolvePresentation } from "../presentation/mode.js";
+import { MACHINE_OUTPUT_FLAGS } from "../runtime/first-run.js";
+import { buildSetupPlan } from "../setup/plan.js";
+import { shouldOfferSetupWizard } from "./gate.js";
+const SKIP_COMMANDS = new Set([
+    "help",
+    "--help",
+    "-h",
+    "--help-all",
+    "help-all",
+    "version",
+    "--version",
+    "-v",
+    "login",
+    "logout",
+    "setup",
+    "update",
+    "upgrade",
+    "uninstall"
+]);
+const NOT_RUN = { handled: false, result: { exitCode: 0, stdout: "", stderr: "" } };
+export async function maybeOfferSetupWizard(args, options = {}) {
+    const env = options.env ?? process.env;
+    const command = args[0] ?? "";
+    if (command && SKIP_COMMANDS.has(command)) {
+        return NOT_RUN;
+    }
+    if (args.some((arg) => MACHINE_OUTPUT_FLAGS.has(arg))) {
+        return NOT_RUN;
+    }
+    if (!shouldOfferSetupWizard(env, options.stdin ?? process.stdin, options.stderr ?? process.stderr)) {
+        return NOT_RUN;
+    }
+    const rich = options.richMode ?? resolvePresentation().mode === "rich";
+    if (!rich) {
+        return NOT_RUN;
+    }
+    const plan = buildSetupPlan({ shell: "auto" });
+    const runWizard = options.runWizard ?? (await import("./wizard.js")).runSetupWizard;
+    const result = await runWizard(plan, { env, autoActivate: args.length === 0 });
+    return { handled: args.length === 0, result };
+}

package/dist/setup-ui/selector.js

@@ -0,0 +1,27 @@
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { useState } from "react";
+import { Box, Text, useInput } from "ink";
+export const Selector = ({ options, onSelect, onCancel }) => {
+    const [cursor, setCursor] = useState(0);
+    useInput((input, key) => {
+        if (key.upArrow || input === "k") {
+            setCursor((c) => Math.max(0, c - 1));
+        }
+        else if (key.downArrow || input === "j") {
+            setCursor((c) => Math.min(options.length - 1, c + 1));
+        }
+        else if (key.return) {
+            onSelect(cursor);
+        }
+        else if (key.escape) {
+            onCancel();
+        }
+        else if (/^[1-9]$/.test(input)) {
+            const index = Number(input) - 1;
+            if (index < options.length) {
+                onSelect(index);
+            }
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", children: [options.map((option, i) => (_jsxs(Text, { ...(i === cursor ? { color: "cyan" } : {}), children: [i === cursor ? "❯" : " ", " ", i + 1, ". ", option.label] }, i))), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Enter to confirm \u00B7 arrows or number keys to choose \u00B7 Esc to skip" })] }));
+};

package/dist/setup-ui/tasks.js

@@ -0,0 +1,56 @@
+import { LockBusyError } from "../state/index.js";
+import { applyGitHook } from "../setup/git-hook.js";
+import { applySetupPlanWithLock } from "../setup/plan.js";
+import { applyAgentHook } from "../agents/registry.js";
+export function buildWizardTasks(plan, agents) {
+    const tasks = [
+        {
+            label: "shell installs route through dg",
+            run: async () => {
+                try {
+                    applySetupPlanWithLock(plan);
+                    return { ok: true };
+                }
+                catch (error) {
+                    if (error instanceof LockBusyError) {
+                        return {
+                            ok: false,
+                            fatal: true,
+                            detail: `dg setup cannot apply while another setup or uninstall is running: ${error.path}`
+                        };
+                    }
+                    throw error;
+                }
+            }
+        }
+    ];
+    for (const offer of agents) {
+        tasks.push({
+            label: `${offer.label} installs route through dg`,
+            run: async () => {
+                try {
+                    await applyAgentHook(offer.ctx);
+                    return { ok: true };
+                }
+                catch (error) {
+                    return { ok: false, detail: error instanceof Error ? error.message : "unknown error" };
+                }
+            }
+        });
+    }
+    return tasks;
+}
+export function buildCommitGuardTask(repo) {
+    return {
+        label: "commits in this repo are scanned",
+        run: async () => {
+            try {
+                applyGitHook(repo);
+                return { ok: true };
+            }
+            catch (error) {
+                return { ok: false, detail: error instanceof Error ? error.message : "unknown error" };
+            }
+        }
+    };
+}