@westbayberry/dg 2.1.0 → 2.2.0

package/dist/setup-ui/wizard.js

@@ -0,0 +1,225 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from "react";
+import { Box, Text, useApp, useInput } from "ink";
+import { Spinner } from "../scan-ui/components/Spinner.js";
+import { renderLogo } from "../scan-ui/logo.js";
+import { enterTui, leaveTui } from "../scan-ui/alt-screen.js";
+import { dgVersion } from "../commands/version.js";
+import { authStatus, displayTier } from "../auth/store.js";
+import { resolveWebBase } from "../auth/device-login.js";
+import { useLogin } from "../auth/login-app.js";
+import { collectAgentOffers, collectAgentSkips } from "../agents/registry.js";
+import { markFirstRunShown } from "../runtime/first-run.js";
+import { recordLoginNudge } from "../runtime/nudges.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+import { activateShell, activationOffer } from "../setup/activate-shell.js";
+import { commitGuardOffer } from "../setup/git-hook.js";
+import { activationCommand, tildifyPath } from "../setup/plan.js";
+import { markSecurityNotesShown, markWizardSkipped, securityNotesShown } from "./gate.js";
+import { Selector } from "./selector.js";
+import { buildCommitGuardTask, buildWizardTasks } from "./tasks.js";
+export function protectsSentence(agentLabels) {
+    if (agentLabels.length === 0) {
+        return "Protects npm and pip installs in your shell.";
+    }
+    if (agentLabels.length === 1) {
+        return `Protects npm and pip installs in your shell and in ${agentLabels[0]}.`;
+    }
+    return `Protects npm and pip installs in your shell and in ${agentLabels.slice(0, -1).join(", ")} and ${agentLabels[agentLabels.length - 1]}.`;
+}
+const Header = ({ version }) => (_jsxs(Box, { flexDirection: "column", children: [renderLogo("pass").map((line, i) => (_jsx(Text, { children: line }, i))), _jsx(Text, { children: " " }), _jsxs(Text, { bold: true, children: ["Dependency Guardian v", version] }), _jsx(Text, { children: " " })] }));
+const LoginFlow = ({ webBase, env, onDone }) => {
+    const { state, openAndPoll } = useLogin(webBase, env);
+    useEffect(() => {
+        if (state.phase === "ready") {
+            openAndPoll();
+        }
+    }, [state.phase, openAndPoll]);
+    useInput((_input, key) => {
+        if (key.return && (state.phase === "success" || state.phase === "expired" || state.phase === "error")) {
+            onDone(state.phase === "success" ? state.email : "");
+        }
+        else if (key.escape) {
+            onDone("");
+        }
+    });
+    switch (state.phase) {
+        case "creating":
+            return _jsx(Spinner, { label: "Creating login session\u2026" });
+        case "ready":
+        case "waiting":
+            return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "Sign in at:" }), _jsx(Text, { color: "cyan", children: state.verifyUrl }), _jsx(Text, { children: " " }), _jsx(Spinner, { label: "Waiting for you to approve in the browser\u2026" }), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Esc to skip" })] }));
+        case "success":
+            return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { color: "green", bold: true, children: ["\u2713 Logged in", state.email ? ` as ${state.email}` : "", state.plan ? ` (${displayTier(state.plan)} plan)` : ""] }), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Login successful. Press Enter to continue\u2026" })] }));
+        case "expired":
+        case "error":
+            return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: "yellow", children: state.phase === "expired" ? "That login link expired." : `Login failed: ${state.message}.` }), _jsx(Text, { dimColor: true, children: "You can run dg login later. Press Enter to continue\u2026" })] }));
+    }
+};
+function hyperlink(label, url) {
+    return `\u001B]8;;${url}\u0007${label}\u001B]8;;\u0007`;
+}
+const NotesStep = ({ termsUrl, privacyUrl, onAgree }) => {
+    useInput((_input, key) => {
+        if (key.return) {
+            onAgree();
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Security notes" }), _jsx(Text, { children: " " }), _jsx(Text, { children: "1. dg can make mistakes." }), _jsx(Text, { children: "   A PASS verdict does not guarantee a package is safe. You are" }), _jsx(Text, { children: "   responsible for what you install and should review new" }), _jsx(Text, { children: "   dependencies." }), _jsx(Text, { children: " " }), _jsx(Text, { children: "2. By continuing you confirm you have read and understand the" }), _jsxs(Text, { children: ["   ", _jsx(Text, { color: "cyan", children: hyperlink("Terms of Service", termsUrl) }), " and ", _jsx(Text, { color: "cyan", children: hyperlink("Privacy Policy", privacyUrl) }), "."] }), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Press Enter to agree" })] }));
+};
+export const SetupWizardApp = (props) => {
+    const { exit } = useApp();
+    const [step, setStep] = useState(props.loginNeeded ? "login" : props.notesNeeded ? "notes" : "choose");
+    const [results, setResults] = useState([]);
+    const [running, setRunning] = useState(null);
+    const [fatalDetail, setFatalDetail] = useState("");
+    const [email, setEmail] = useState(props.authedEmail);
+    const emailRef = useRef(props.authedEmail);
+    const applyStarted = useRef(false);
+    const Login = props.LoginFlowComponent ?? LoginFlow;
+    const afterLogin = () => {
+        setStep(props.notesNeeded ? "notes" : "choose");
+    };
+    useInput((_input, key) => {
+        if (key.return) {
+            exit();
+        }
+    }, { isActive: step === "done" });
+    useEffect(() => {
+        if (step !== "declined" && step !== "fatal") {
+            return undefined;
+        }
+        const timer = setTimeout(() => exit(), 30);
+        return () => clearTimeout(timer);
+    }, [step, exit]);
+    useEffect(() => {
+        if (step !== "applying" || applyStarted.current) {
+            return undefined;
+        }
+        applyStarted.current = true;
+        let cancelled = false;
+        void (async () => {
+            const completed = [];
+            for (const task of props.tasks) {
+                if (cancelled) {
+                    return;
+                }
+                setRunning(task.label);
+                await new Promise((resolve) => setImmediate(resolve));
+                let result;
+                try {
+                    result = await task.run();
+                }
+                catch (error) {
+                    result = { ok: false, fatal: true, detail: error instanceof Error ? error.message : "unknown error" };
+                }
+                if (cancelled) {
+                    return;
+                }
+                const line = { label: task.label, ok: result.ok, detail: result.detail };
+                completed.push(line);
+                setResults((prev) => [...prev, line]);
+                if (result.fatal) {
+                    setRunning(null);
+                    setFatalDetail(result.detail ?? "");
+                    props.onOutcome({ kind: "fatal", detail: result.detail ?? "" });
+                    setStep("fatal");
+                    return;
+                }
+            }
+            setRunning(null);
+            props.onOutcome({ kind: "done", email: emailRef.current, results: completed });
+            setStep("done");
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [step, props]);
+    return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, paddingTop: 1, children: [_jsx(Header, { version: props.version }), step === "login" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Connect your account" }), _jsx(Text, { children: " " }), _jsx(Selector, { options: [{ label: "Connect in your browser" }, { label: "Skip for now" }], onSelect: (index) => {
+                            if (index === 0) {
+                                setStep("login-flow");
+                            }
+                            else {
+                                props.onLoginSkipped();
+                                afterLogin();
+                            }
+                        }, onCancel: () => {
+                            props.onLoginSkipped();
+                            afterLogin();
+                        } })] })), step === "login-flow" && (_jsx(Login, { webBase: props.webBase, env: props.env, onDone: (loggedInEmail) => {
+                    if (loggedInEmail) {
+                        setEmail(loggedInEmail);
+                        emailRef.current = loggedInEmail;
+                    }
+                    else {
+                        props.onLoginSkipped();
+                    }
+                    afterLogin();
+                } })), step === "notes" && (_jsx(NotesStep, { termsUrl: `${props.webBase}/terms`, privacyUrl: `${props.webBase}/privacy`, onAgree: () => {
+                    props.onNotesAgreed();
+                    setStep("choose");
+                } })), step === "choose" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Use recommended settings?" }), _jsx(Text, { children: " " }), _jsx(Text, { children: props.sentence }), props.guardsRepo && _jsx(Text, { children: "Also scans this repo's commits before they land." }), props.skips.map((skip) => (_jsxs(Text, { dimColor: true, children: [skip.label, " found but skipped \u2014 ", skip.detail] }, skip.label))), _jsx(Text, { children: " " }), _jsx(Selector, { options: [{ label: "Yes, use recommended settings" }, { label: "No, maybe later with dg setup" }], onSelect: (index) => {
+                            if (index === 0) {
+                                setStep("applying");
+                            }
+                            else {
+                                props.onOutcome({ kind: "declined" });
+                                setStep("declined");
+                            }
+                        }, onCancel: () => {
+                            props.onOutcome({ kind: "declined" });
+                            setStep("declined");
+                        } })] })), (step === "applying" || step === "done" || step === "fatal") && (_jsxs(Box, { flexDirection: "column", children: [results.map((line) => (_jsxs(Text, { color: line.ok ? "green" : "yellow", children: [line.ok ? "✓" : "✗", " ", line.label, !line.ok && line.detail ? ` — ${line.detail}` : ""] }, line.label))), running !== null && _jsx(Spinner, { label: running }), step === "fatal" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: " " }), _jsx(Text, { color: "red", children: fatalDetail })] })), step === "done" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: " " }), _jsxs(Text, { children: [_jsx(Text, { color: "green", bold: true, children: "\u2713 Setup complete." }), " ", "Activate now: ", _jsx(Text, { bold: true, children: props.activateHint })] }), email ? _jsxs(Text, { dimColor: true, children: ["Logged in as ", email] }) : null, _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Press Enter to continue\u2026" })] }))] })), step === "declined" && _jsx(Text, { dimColor: true, children: "Run dg setup any time to turn this on." })] }));
+};
+export async function runSetupWizard(plan, options = {}) {
+    const env = options.env ?? process.env;
+    const ci = process.env.CI;
+    if (ci === "" || ci === "0" || ci === "false") {
+        delete process.env.CI;
+    }
+    const agents = collectAgentOffers();
+    const repo = commitGuardOffer();
+    const auth = authStatus(env);
+    const state = { outcome: null };
+    const tasks = buildWizardTasks(plan, agents);
+    if (repo) {
+        tasks.push(buildCommitGuardTask(repo));
+    }
+    const { render } = await import("ink");
+    enterTui();
+    const instance = render(_jsx(SetupWizardApp, { version: dgVersion(), notesNeeded: !securityNotesShown(env), loginNeeded: !auth.authenticated, authedEmail: auth.email ?? "", sentence: protectsSentence(agents.map((offer) => offer.label)), guardsRepo: repo !== null, skips: collectAgentSkips(), tasks: tasks, webBase: resolveWebBase(env), env: env, activateHint: activationCommand(plan.shell, tildifyPath(plan.rcPath)), onNotesAgreed: () => markSecurityNotesShown(env), onLoginSkipped: () => recordLoginNudge(env), onOutcome: (outcome) => {
+            state.outcome = outcome;
+        } }), { exitOnCtrlC: true });
+    await instance.waitUntilExit();
+    leaveTui();
+    const theme = createTheme(resolvePresentation().color);
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const outcome = state.outcome;
+    if (outcome === null) {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    if (outcome.kind === "declined") {
+        markWizardSkipped(env);
+        markFirstRunShown(env);
+        return { exitCode: 0, stdout: "", stderr: `  ${muted("Run")} ${accent("dg setup")} ${muted("any time to turn this on.")}\n` };
+    }
+    if (outcome.kind === "fatal") {
+        return { exitCode: 1, stdout: "", stderr: `  ${outcome.detail}\n` };
+    }
+    markFirstRunShown(env);
+    const lines = outcome.results.map((line) => line.ok
+        ? `  ${theme.paint("pass", `✓ ${line.label}`)}`
+        : `  ${theme.paint("warn", `✗ ${line.label}`)}${line.detail ? ` ${muted(`— ${line.detail}`)}` : ""}`);
+    lines.push(`  ${theme.paint("pass", "✓ dg setup complete — installs are protected in new terminals.")}`);
+    if (outcome.email) {
+        lines.push(`  ${muted(`Logged in as ${outcome.email}`)}`);
+    }
+    if (options.autoActivate && activationOffer() === "prompt") {
+        process.stderr.write(`${lines.join("\n")}\n  ${muted("Starting a protected shell — type")} ${accent("exit")} ${muted("to return to your previous one.")}\n`);
+        return { exitCode: activateShell(), stdout: "", stderr: "" };
+    }
+    lines.push(`  ${muted("Activate now:")} ${accent(activationCommand(plan.shell, tildifyPath(plan.rcPath)))}`);
+    return { exitCode: 0, stdout: "", stderr: `${lines.join("\n")}\n` };
+}

package/dist/state/cooldown-held.js

@@ -0,0 +1,66 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonAtomic } from "../util/json-file.js";
+import { resolveDgPaths } from "./paths.js";
+export const HELD_PACKAGES_CAP = 500;
+export const UNKNOWN_ELIGIBILITY_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export function heldPackagesPath(env = process.env) {
+    return join(resolveDgPaths(env).stateDir, "cooldown-held.json");
+}
+function heldKey(entry) {
+    return `${entry.ecosystem}:${entry.name}@${entry.version}`;
+}
+function readDocument(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || parsed.schemaVersion !== 1 || !Array.isArray(parsed.entries)) {
+            return [];
+        }
+        return parsed.entries.filter((entry) => !!entry
+            && typeof entry.ecosystem === "string"
+            && typeof entry.name === "string"
+            && typeof entry.version === "string"
+            && typeof entry.requiredDays === "number"
+            && typeof entry.firstSeenAt === "string"
+            && typeof entry.lastSeenAt === "string");
+    }
+    catch {
+        return [];
+    }
+}
+function prune(entries, now) {
+    return entries.filter((entry) => {
+        const eligible = entry.eligibleAt ? Date.parse(entry.eligibleAt) : Number.NaN;
+        if (Number.isFinite(eligible)) {
+            return eligible > now.getTime();
+        }
+        const lastSeen = Date.parse(entry.lastSeenAt);
+        return Number.isFinite(lastSeen) && now.getTime() - lastSeen <= UNKNOWN_ELIGIBILITY_TTL_MS;
+    });
+}
+export function readHeldPackages(env = process.env, now = new Date()) {
+    return prune(readDocument(heldPackagesPath(env)), now);
+}
+export function recordHeldPackage(entry, env = process.env, now = new Date()) {
+    const path = heldPackagesPath(env);
+    const nowIso = now.toISOString();
+    const existing = prune(readDocument(path), now);
+    const key = heldKey(entry);
+    const previous = existing.find((candidate) => heldKey(candidate) === key);
+    const updated = {
+        ...entry,
+        firstSeenAt: previous?.firstSeenAt ?? nowIso,
+        lastSeenAt: nowIso
+    };
+    const merged = [...existing.filter((candidate) => heldKey(candidate) !== key), updated]
+        .sort((left, right) => right.lastSeenAt.localeCompare(left.lastSeenAt))
+        .slice(0, HELD_PACKAGES_CAP);
+    writeJsonAtomic(path, { schemaVersion: 1, entries: merged });
+}

package/dist/state/index.js

@@ -1,4 +1,5 @@
 export * from "./cleanup-registry.js";
+export * from "./cooldown-held.js";
 export * from "./locks.js";
 export * from "./paths.js";
 export * from "./sessions.js";

package/dist/state/locks.js

@@ -17,7 +17,8 @@ export class LockBusyError extends Error {
 export async function acquireLock(paths, name, options = {}) {
     assertLockName(name);
     await mkdir(paths.locksDir, {
-        recursive: true
+        recursive: true,
+        mode: 0o700
     });
     const path = join(paths.locksDir, `${name}.lock`);
     await removeStaleLock(path, options);
@@ -54,7 +55,8 @@ export async function acquireLock(paths, name, options = {}) {
 export function acquireLockSync(paths, name, options = {}) {
     assertLockName(name);
     mkdirSync(paths.locksDir, {
-        recursive: true
+        recursive: true,
+        mode: 0o700
     });
     const path = join(paths.locksDir, `${name}.lock`);
     removeStaleLockSync(path, options);

package/dist/state/store.js

@@ -26,7 +26,8 @@ export async function readJsonFile(path, fallback) {
 }
 export async function writeJsonFileAtomic(path, value) {
     await mkdir(dirname(path), {
-        recursive: true
+        recursive: true,
+        mode: 0o700
     });
     const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
     const payload = `${JSON.stringify(value, null, 2)}\n`;

package/dist/util/external-tool.js

@@ -0,0 +1,25 @@
+import { resolveRealBinary } from "../launcher/resolve-real-binary.js";
+import { resolveSpawnInvocation } from "../launcher/spawn-invocation.js";
+const toolPathCache = new Map();
+// Windows resolves bare command names against the child cwd before PATH,
+// and dg routinely runs with cwd inside untrusted trees; external tools
+// must always spawn from an absolute PATH-resolved location. Callers may
+// pass a minimal child env; resolution then falls back to the parent PATH.
+export function resolveToolPath(name, env = process.env) {
+    const searchEnv = env.PATH ? env : { ...env, PATH: process.env.PATH };
+    const key = `${name} ${searchEnv.PATH ?? ""}`;
+    const cached = toolPathCache.get(key);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const path = resolveRealBinary({ name, env: searchEnv }).path;
+    toolPathCache.set(key, path);
+    return path;
+}
+export function toolInvocation(name, args, env = process.env) {
+    const path = resolveToolPath(name, env);
+    if (!path) {
+        return null;
+    }
+    return resolveSpawnInvocation(path, args);
+}

package/dist/util/git.js

@@ -1,11 +1,18 @@
 import { spawnSync } from "node:child_process";
+import { toolInvocation } from "./external-tool.js";
 const DEFAULT_MAX_BUFFER = 256 * 1024 * 1024;
 export function gitSync(args, options) {
-    const result = spawnSync("git", [...args], {
+    const env = options.env ?? process.env;
+    const invocation = toolInvocation("git", args, env);
+    if (!invocation) {
+        return { ok: false, code: null, stdout: "", stderr: "git executable not found on PATH" };
+    }
+    const result = spawnSync(invocation.command, [...invocation.args], {
         cwd: options.cwd,
-        env: options.env ?? process.env,
+        env,
         encoding: "utf8",
-        maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER
+        maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER,
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments
     });
     return {
         ok: result.status === 0,

package/dist/util/report-writer.js

@@ -0,0 +1,57 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+export function writeReportAtomic(outputPath, contents) {
+    const directory = dirname(outputPath);
+    mkdirSync(directory, { recursive: true });
+    const temporaryPath = `${outputPath}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporaryPath, contents, { encoding: "utf8", flag: "wx" });
+        renameSync(temporaryPath, outputPath);
+    }
+    catch (error) {
+        rmSync(temporaryPath, { force: true });
+        throw error;
+    }
+}
+export function resolveExportPath(input, cwd) {
+    const trimmed = input.trim();
+    if (trimmed === "~" || trimmed.startsWith("~/")) {
+        return resolve(homedir(), trimmed.slice(2));
+    }
+    return resolve(cwd, trimmed);
+}
+function isDirectory(path) {
+    try {
+        return statSync(path, { throwIfNoEntry: false })?.isDirectory() ?? false;
+    }
+    catch {
+        return false;
+    }
+}
+export function userHomeDir(env = process.env) {
+    return env.HOME && isAbsolute(env.HOME) ? env.HOME : homedir();
+}
+export function exportDestinations(cwd, env = process.env) {
+    const home = userHomeDir(env);
+    const candidates = [{ label: "This folder", dir: cwd }];
+    for (const name of ["Downloads", "Desktop"]) {
+        const dir = join(home, name);
+        if (isDirectory(dir)) {
+            candidates.push({ label: name, dir });
+        }
+    }
+    candidates.push({ label: "Home", dir: home });
+    const seen = new Set();
+    const out = [];
+    for (const candidate of candidates) {
+        const key = resolve(candidate.dir);
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        out.push(candidate);
+    }
+    return out;
+}