@westbayberry/dg 2.1.0 → 2.2.0

package/dist/auth/store.js

@@ -26,6 +26,7 @@ export function readAuthState(env = process.env) {
         }
         const email = typeof parsed.email === "string" && parsed.email.length > 0 ? parsed.email : undefined;
         const tier = typeof parsed.tier === "string" && parsed.tier.length > 0 ? parsed.tier : undefined;
+        const name = typeof parsed.name === "string" && parsed.name.length > 0 ? parsed.name : undefined;
         return {
             version: 1,
             token: parsed.token,
@@ -34,7 +35,8 @@ export function readAuthState(env = process.env) {
             orgId: parsed.orgId ?? "",
             loggedInAt: parsed.loggedInAt,
             ...(email ? { email } : {}),
-            ...(tier ? { tier } : {})
+            ...(tier ? { tier } : {}),
+            ...(name ? { name } : {})
         };
     }
     catch (error) {
@@ -63,6 +65,7 @@ export function writeAuthState(options, env = process.env) {
     }
     const email = typeof options.email === "string" && options.email.length > 0 ? options.email : undefined;
     const tier = typeof options.tier === "string" && options.tier.length > 0 ? options.tier : undefined;
+    const name = typeof options.name === "string" && options.name.length > 0 ? options.name : undefined;
     return withUserConfigLock(env, () => {
         const config = loadUserConfig(env);
         const apiBaseUrl = options.apiBaseUrl ?? config.api.baseUrl;
@@ -75,7 +78,8 @@ export function writeAuthState(options, env = process.env) {
             orgId,
             loggedInAt: (options.now ?? new Date()).toISOString(),
             ...(email ? { email } : {}),
-            ...(tier ? { tier } : {})
+            ...(tier ? { tier } : {}),
+            ...(name ? { name } : {})
         };
         const paths = resolveDgPaths(env);
         writeJsonAtomic(authPath(paths), state);
@@ -120,7 +124,8 @@ export function authStatus(env = process.env) {
             apiBaseUrl: state.apiBaseUrl,
             orgId: state.orgId,
             ...(state.email ? { email: state.email } : {}),
-            ...(state.tier ? { tier: state.tier } : {})
+            ...(state.tier ? { tier: state.tier } : {}),
+            ...(state.name ? { name: state.name } : {})
         };
     }
     return {

package/dist/bin/dg.js

@@ -1,17 +1,7 @@
 #!/usr/bin/env node
 import { assertCurrentNode } from "../runtime/node-version.js";
-assertCurrentNode();
-const EXIT_TOOL_ERROR = 70;
-function exitOnFatal(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    try {
-        process.stderr.write(`dg: unexpected error — ${message}\nRun 'dg doctor' to check your installation; remove ~/.dg/config.json if it is corrupted.\n`);
-    }
-    catch {
-        // stderr is gone; nothing left to report to.
-    }
-    process.exit(EXIT_TOOL_ERROR);
-}
+await assertCurrentNode();
+const { exitOnFatal } = await import("../runtime/fatal.js");
 process.on("uncaughtException", (error) => {
     if (error.code === "EPIPE") {
         process.exit(process.exitCode ?? 0);
@@ -30,52 +20,69 @@ const { runCli, writeCliResult } = await import("../runtime/cli.js");
 const { maybeShowFirstRun } = await import("../runtime/first-run.js");
 const { maybePreflightInstallPrompt } = await import("../launcher/preflight-prompt.js");
 const args = process.argv.slice(2);
-maybeShowFirstRun(args);
-import("../state/index.js")
-    .then(({ pruneDeadSessionsSync, resolveDgPaths }) => {
-    pruneDeadSessionsSync(resolveDgPaths());
-})
-    .catch(() => { });
-const { maybeDeviceLogin } = await import("../auth/device-login.js");
-const { maybeVerifyPackage } = await import("../verify/package-check.js");
-const { maybeAudit } = await import("../commands/audit.js");
-const notHandled = { handled: false };
-const deviceLogin = await maybeDeviceLogin(args);
-const verifyPackage = deviceLogin.handled ? notHandled : await maybeVerifyPackage(args);
-const audit = deviceLogin.handled || verifyPackage.handled ? notHandled : await maybeAudit(args);
-if (deviceLogin.handled) {
-    writeCliResult(deviceLogin.result);
-}
-else if (verifyPackage.handled) {
-    writeCliResult(verifyPackage.result);
-}
-else if (audit.handled) {
-    writeCliResult(audit.result);
+const { maybeAgentHookExec } = await import("../launcher/agent-hook-exec.js");
+const agentHookExec = await maybeAgentHookExec(args);
+if (agentHookExec.handled) {
+    writeCliResult(agentHookExec.result);
 }
 else {
-    const preflight = await maybePreflightInstallPrompt(args, { decisionsCwd: process.cwd() });
-    if (preflight.handled) {
-        writeCliResult(preflight.result);
+    const { maybeOfferSetupWizard } = await import("../setup-ui/offer.js");
+    const wizardOffer = await maybeOfferSetupWizard(args);
+    if (wizardOffer.handled) {
+        writeCliResult(wizardOffer.result);
     }
     else {
-        const { maybeRunLiveInstall } = await import("../launcher/live-install.js");
-        const liveInstall = await maybeRunLiveInstall(args);
-        if (liveInstall.handled) {
-            writeCliResult(liveInstall.result);
+        if (wizardOffer.result.stderr) {
+            process.stderr.write(wizardOffer.result.stderr);
+        }
+        maybeShowFirstRun(args);
+        import("../state/index.js")
+            .then(({ pruneDeadSessionsSync, resolveDgPaths }) => {
+            pruneDeadSessionsSync(resolveDgPaths());
+        })
+            .catch(() => { });
+        const { maybeDeviceLogin } = await import("../auth/device-login.js");
+        const { maybeVerifyPackage } = await import("../verify/package-check.js");
+        const { maybeAudit } = await import("../commands/audit.js");
+        const notHandled = { handled: false };
+        const deviceLogin = await maybeDeviceLogin(args);
+        const verifyPackage = deviceLogin.handled ? notHandled : await maybeVerifyPackage(args);
+        const audit = deviceLogin.handled || verifyPackage.handled ? notHandled : await maybeAudit(args);
+        if (deviceLogin.handled) {
+            writeCliResult(deviceLogin.result);
+        }
+        else if (verifyPackage.handled) {
+            writeCliResult(verifyPackage.result);
+        }
+        else if (audit.handled) {
+            writeCliResult(audit.result);
         }
         else {
-            writeCliResult(await runCli(args));
+            const preflight = await maybePreflightInstallPrompt(args, { decisionsCwd: process.cwd() });
+            if (preflight.handled) {
+                writeCliResult(preflight.result);
+            }
+            else {
+                const { maybeRunLiveInstall } = await import("../launcher/live-install.js");
+                const liveInstall = await maybeRunLiveInstall(args);
+                if (liveInstall.handled) {
+                    writeCliResult(liveInstall.result);
+                }
+                else {
+                    writeCliResult(await runCli(args));
+                }
+            }
+        }
+        // The auth flows (browser login, paid-verify gate, deep audit upload) already
+        // tell the user exactly what to do; the throttled nudges would just be noise.
+        if (!deviceLogin.handled && !verifyPackage.handled && !audit.handled) {
+            try {
+                const { maybeShowNudges } = await import("../runtime/nudges.js");
+                maybeShowNudges(args);
+            }
+            catch {
+                // dg deleted its own files mid-run (uninstall of itself); nudges are cosmetic.
+            }
         }
-    }
-}
-// The auth flows (browser login, paid-verify gate, deep audit upload) already
-// tell the user exactly what to do; the throttled nudges would just be noise.
-if (!deviceLogin.handled && !verifyPackage.handled && !audit.handled) {
-    try {
-        const { maybeShowNudges } = await import("../runtime/nudges.js");
-        maybeShowNudges(args);
-    }
-    catch {
-        // dg deleted its own files mid-run (uninstall of itself); nudges are cosmetic.
     }
 }

package/dist/commands/agents.js

@@ -0,0 +1,231 @@
+import { homedir } from "node:os";
+import { AGENT_IDS, AGENTS, agentLabel, collectAgentOffers, getAgent, isAgentId, resolveAgentHookContext, } from "../agents/registry.js";
+import { AgentHookError } from "../agents/persistence.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+import { tildifyPath as tildify } from "../setup/plan.js";
+import { EXIT_USAGE } from "./types.js";
+const VERBS = ["on", "off", "--check", "--print"];
+const LEGACY_VERB_MAP = {
+    install: "on",
+    on: "on",
+    off: "off",
+    remove: "off",
+    uninstall: "off",
+    "--check": "--check",
+    "--print": "--print",
+};
+function parseAgentsArgs(args) {
+    if (args.length === 0) {
+        return { verb: "status", agents: [], recordFixture: false };
+    }
+    let rest = [...args];
+    let verb = null;
+    const first = rest[0] ?? "";
+    if (isAgentId(first)) {
+        const legacy = rest[1] ?? "install";
+        const mapped = LEGACY_VERB_MAP[legacy];
+        if (!mapped || rest.length > 3 || (rest.length === 3 && (rest[2] !== "--record-fixture" || mapped !== "on"))) {
+            return { error: `unknown subcommand '${rest[1] ?? ""}'. Use: dg agents [on|off|--check|--print] [agent]` };
+        }
+        return { verb: mapped, agents: [first], recordFixture: rest[2] === "--record-fixture" };
+    }
+    if (VERBS.includes(first)) {
+        verb = first;
+        rest = rest.slice(1);
+    }
+    else {
+        return { error: `unknown subcommand '${first}'. Use: dg agents [on|off|--check|--print] [agent]` };
+    }
+    const agents = [];
+    let recordFixture = false;
+    for (const arg of rest) {
+        if (arg === "--record-fixture") {
+            recordFixture = true;
+            continue;
+        }
+        if (!isAgentId(arg)) {
+            return { error: `unknown agent '${arg}'. Agents: ${AGENT_IDS.join(", ")}` };
+        }
+        agents.push(arg);
+    }
+    if (recordFixture && verb !== "on") {
+        return { error: "--record-fixture only applies to 'dg agents on'" };
+    }
+    return { verb, agents, recordFixture };
+}
+function agentRow(agent, home, env) {
+    const integration = AGENTS[agent];
+    if (!integration.detect(home)) {
+        return { agent, state: "not found", detail: "" };
+    }
+    const probe = integration.probeHookSupport(home);
+    if (!probe.supported) {
+        return { agent, state: "unsupported", detail: probe.detail };
+    }
+    const ctx = resolveAgentHookContext(agent, { env, home });
+    const hooked = integration.verify(ctx).find((check) => check.name === integration.isInstalledCheckName)?.ok ?? false;
+    if (hooked) {
+        return { agent, state: "protected", detail: tildify(ctx.settingsPath, home) };
+    }
+    return { agent, state: "detected", detail: `dg agents on ${agent}` };
+}
+function renderStatusCard(rows, theme) {
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const glyph = (state) => {
+        if (state === "protected") {
+            return theme.paint("pass", "✓");
+        }
+        if (state === "detected") {
+            return accent("·");
+        }
+        if (state === "unsupported") {
+            return theme.paint("warn", "✗");
+        }
+        return muted("–");
+    };
+    const labelWidth = Math.max(...rows.map((row) => agentLabel(row.agent).length));
+    const stateWidth = Math.max(...rows.map((row) => row.state.length));
+    const lines = [
+        "",
+        `  ${accent("AI agents")} ${muted("— installs route through dg before fetching")}`,
+        ""
+    ];
+    for (const row of rows) {
+        const label = agentLabel(row.agent).padEnd(labelWidth);
+        const state = row.state === "protected" ? theme.paint("pass", row.state.padEnd(stateWidth)) : muted(row.state.padEnd(stateWidth));
+        const detail = row.state === "detected" ? accent(row.detail) : muted(row.detail);
+        lines.push(`  ${glyph(row.state)} ${label}  ${state}  ${detail}`.trimEnd());
+    }
+    lines.push("", `  ${muted("protect all:")} ${accent("dg agents on")} ${muted("·")} ${muted("remove:")} ${accent("dg agents off")}`, "");
+    return lines.join("\n");
+}
+async function applyAgents(targets, env, home, theme, recordFixture) {
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const lines = [];
+    let failures = 0;
+    for (const agent of targets) {
+        const integration = AGENTS[agent];
+        const probe = integration.probeHookSupport(home);
+        if (!probe.supported) {
+            failures += 1;
+            lines.push(`  ${theme.paint("warn", `✗ ${integration.label}`)} ${muted(`— ${probe.detail}. The dg PATH shim still covers installs typed in its terminal.`)}`);
+            continue;
+        }
+        const ctx = resolveAgentHookContext(agent, { env, home });
+        const dgCommand = recordFixture ? `${ctx.dgCommand} --record-fixture` : ctx.dgCommand;
+        try {
+            await integration.apply({ ...ctx, dgCommand });
+            lines.push(`  ${theme.paint("pass", `✓ ${integration.label} installs route through dg`)} ${muted(`(${tildify(ctx.settingsPath, home)})`)}`);
+            if (integration.maturity === "unverified") {
+                lines.push(`  ${muted(`  hook installed from ${integration.label}'s documented schema; payload format not yet verified against a live ${integration.label} run`)}`);
+            }
+            if (integration.postInstallNote) {
+                lines.push(`  ${muted(`  ${integration.postInstallNote}`)}`);
+            }
+        }
+        catch (error) {
+            failures += 1;
+            const message = error instanceof AgentHookError ? error.message : error instanceof Error ? error.message : "agent hook error";
+            lines.push(`  ${theme.paint("warn", `✗ ${integration.label}`)} ${muted(`— ${message}`)}`);
+        }
+    }
+    if (lines.length === 0) {
+        return { exitCode: 0, stdout: `  ${muted("No unprotected agents detected.")} ${muted("See")} ${accent("dg agents")}\n`, stderr: "" };
+    }
+    lines.push(`  ${muted("Reverse:")} ${accent("dg agents off")}`);
+    return { exitCode: failures > 0 && failures === targets.length ? 1 : 0, stdout: `${lines.join("\n")}\n`, stderr: "" };
+}
+async function removeAgents(targets, env, home, theme) {
+    const muted = (text) => theme.paint("muted", text);
+    const lines = [];
+    for (const agent of targets) {
+        const integration = AGENTS[agent];
+        const ctx = resolveAgentHookContext(agent, { env, home });
+        try {
+            const result = await integration.remove(ctx);
+            lines.push(result.removed
+                ? `  ${theme.paint("pass", `✓ ${integration.label} hook removed`)} ${muted(`(${tildify(ctx.settingsPath, home)})`)}`
+                : `  ${muted(`· ${integration.label} — no dg hook was installed`)}`);
+        }
+        catch (error) {
+            const message = error instanceof AgentHookError ? error.message : error instanceof Error ? error.message : "agent hook error";
+            lines.push(`  ${theme.paint("warn", `✗ ${integration.label}`)} ${muted(`— ${message}`)}`);
+        }
+    }
+    if (lines.length === 0) {
+        lines.push(`  ${muted("No agent hooks to remove.")}`);
+    }
+    return { exitCode: 0, stdout: `${lines.join("\n")}\n`, stderr: "" };
+}
+function checkAgents(targets, env, home) {
+    const lines = [];
+    let allOk = true;
+    for (const agent of targets) {
+        const ctx = resolveAgentHookContext(agent, { env, home });
+        const checks = getAgent(agent).verify(ctx);
+        lines.push(`${agentLabel(agent)}:`);
+        for (const check of checks) {
+            lines.push(`  ${check.ok ? "✓" : "✗"} ${check.name}: ${check.detail}`);
+            allOk = allOk && check.ok;
+        }
+    }
+    return { exitCode: allOk ? 0 : 1, stdout: `${lines.join("\n")}\n`, stderr: "" };
+}
+function printAgents(targets, env, home) {
+    const lines = [];
+    for (const agent of targets) {
+        const integration = AGENTS[agent];
+        const ctx = resolveAgentHookContext(agent, { env, home });
+        const probe = integration.probeHookSupport(home);
+        lines.push(`dg agents on ${agent} would write a dg hook to:`, `  ${ctx.settingsPath}`, "running:", `  ${ctx.dgCommand}`, `probe: ${probe.supported ? "supported" : "unsupported"} — ${probe.detail}`, `Reverse with: dg agents off ${agent}  (or dg uninstall)`);
+    }
+    return { exitCode: 0, stdout: `${lines.join("\n")}\n`, stderr: "" };
+}
+export async function runAgentsCommand(args, env = process.env, home) {
+    const parsed = parseAgentsArgs(args);
+    if ("error" in parsed) {
+        return { exitCode: EXIT_USAGE, stdout: "", stderr: `dg agents: ${parsed.error}\n` };
+    }
+    const resolvedHome = home ?? env.HOME ?? homedir();
+    const theme = createTheme(resolvePresentation().color);
+    if (parsed.verb === "status") {
+        const rows = AGENT_IDS.map((agent) => agentRow(agent, resolvedHome, env));
+        return { exitCode: 0, stdout: `${renderStatusCard(rows, theme)}\n`, stderr: "" };
+    }
+    if (parsed.verb === "on") {
+        const targets = parsed.agents.length > 0 ? parsed.agents : collectAgentOffers({ env, home: resolvedHome }).map((offer) => offer.agent);
+        return applyAgents(targets, env, resolvedHome, theme, parsed.recordFixture);
+    }
+    if (parsed.verb === "off") {
+        const targets = parsed.agents.length > 0
+            ? parsed.agents
+            : AGENT_IDS.filter((agent) => agentRow(agent, resolvedHome, env).state === "protected");
+        return removeAgents(targets, env, resolvedHome, theme);
+    }
+    const targets = parsed.agents.length > 0
+        ? parsed.agents
+        : AGENT_IDS.filter((agent) => AGENTS[agent].detect(resolvedHome));
+    if (targets.length === 0) {
+        return { exitCode: 1, stdout: "", stderr: "dg agents: no AI agents detected on this machine.\n" };
+    }
+    return parsed.verb === "--check" ? checkAgents(targets, env, resolvedHome) : printAgents(targets, env, resolvedHome);
+}
+async function handle({ args }) {
+    return runAgentsCommand(args);
+}
+export const agentsCommand = {
+    name: "agents",
+    aliases: ["hook"],
+    summary: "Route AI coding agents' package installs through dg's firewall",
+    usage: "dg agents [on|off|--check|--print] [agent ...]",
+    details: [
+        "Bare 'dg agents' shows every supported agent and whether its installs are protected.",
+        "'dg agents on' installs a native pre-command hook into every detected agent (or name one, e.g. 'dg agents on claude-code') so the shell installs it runs are checked by dg and blocked before a malicious package is fetched. Reversible via 'dg agents off' or 'dg uninstall'.",
+    ],
+    args: [{ name: "agent", summary: AGENT_IDS.join(" | ") }],
+    examples: ["dg agents", "dg agents on", "dg agents on claude-code", "dg agents --check", "dg agents off"],
+    handler: handle,
+};

package/dist/commands/audit.js

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
+import { writeReportAtomic } from "../util/report-writer.js";
 import { EXIT_TOOL_ERROR, EXIT_USAGE_VERDICT } from "./types.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
@@ -34,6 +35,15 @@ export const auditCommand = {
     ],
     handler: (context) => runAuditCommand(context.args)
 };
+function privatePackageResult(scope) {
+    const theme = createTheme(resolvePresentation().color);
+    const name = typeof scope.packageJson?.name === "string" ? scope.packageJson.name : basename(scope.root);
+    return {
+        exitCode: 0,
+        stdout: `${theme.paint("pass", "✓")} ${name} is private — npm refuses to publish it, so there is nothing to audit ${theme.paint("muted", "(remove \"private\": true to audit it for publish)")}\n`,
+        stderr: ""
+    };
+}
 function gather(args) {
     const parsed = parseAuditArgs(args);
     if ("error" in parsed) {
@@ -43,6 +53,9 @@ function gather(args) {
     if ("error" in scope) {
         return { error: scope.error, usage: false };
     }
+    if (scope.ecosystem === "npm" && scope.packageJson?.private === true) {
+        return { privatePackage: scope };
+    }
     const set = scope.ecosystem === "pypi" ? pypiPublishSet(scope.root) : npmPublishSet(scope.root);
     const files = set.relPaths
         .map((relPath) => buildAuditFile(scope.root, relPath))
@@ -69,10 +82,10 @@ function finalize(gathered, deep) {
         deep
     };
     const theme = createTheme(resolvePresentation().color);
-    const rendered = parsed.format === "json" ? `${JSON.stringify(report, null, 2)}\n` : renderReport(report, theme);
+    const rendered = parsed.format === "json" ? `${JSON.stringify({ schemaVersion: 1, ...report }, null, 2)}\n` : renderReport(report, theme);
     if (parsed.outputPath) {
         try {
-            writeFileSync(resolve(parsed.outputPath), rendered, "utf8");
+            writeReportAtomic(resolve(parsed.outputPath), rendered);
         }
         catch (error) {
             return { exitCode: EXIT_TOOL_ERROR, stdout: "", stderr: `dg audit could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "write error"}\n` };
@@ -89,6 +102,9 @@ function runAuditCommand(args) {
     if ("error" in gathered) {
         return gatherError(gathered);
     }
+    if ("privatePackage" in gathered) {
+        return privatePackageResult(gathered.privatePackage);
+    }
     const decision = deepDecision(gathered.scope, gathered.parsed.local);
     return finalize(gathered, { ran: false, reason: decision.reason });
 }
@@ -104,6 +120,9 @@ export async function maybeAudit(args) {
     if ("error" in gathered) {
         return { handled: true, result: gatherError(gathered) };
     }
+    if ("privatePackage" in gathered) {
+        return { handled: true, result: privatePackageResult(gathered.privatePackage) };
+    }
     let decision = deepDecision(gathered.scope, gathered.parsed.local);
     if (!decision.upload && canPromptConsent(gathered)) {
         if (!(await teamPolicyBlocksUpload())) {

package/dist/commands/config.js

@@ -3,12 +3,15 @@ import { ConfigError, getConfigValue, isConfigKey, listConfig, loadUserConfig, s
 export const configCommand = {
     name: "config",
     summary: "Inspect or edit trusted dg configuration.",
-    usage: "dg config <get|set|unset|list> [key] [value] [--json]",
+    usage: "dg config <get|set|unset|list> [key] [value] [--json] [--all]",
     args: [
         { name: "<action>", summary: "list | get <key> | set <key> <value> | unset <key>." },
         { name: "[key]", summary: "e.g. policy.mode, gitHook.onWarn, cooldown.age, cooldown.exempt, api.baseUrl." }
     ],
-    flags: [{ flag: "--json", summary: "Machine-readable output for list/get." }],
+    flags: [
+        { flag: "--json", summary: "Machine-readable output for list/get." },
+        { flag: "--all", summary: "Include advanced keys in list (per-ecosystem cooldowns, internal flags)." }
+    ],
     examples: [
         "dg config list",
         "dg config get policy.mode",
@@ -26,7 +29,8 @@ export const configCommand = {
 };
 function configHandler(args) {
     const json = args.includes("--json");
-    const filtered = args.filter((arg) => arg !== "--json");
+    const all = args.includes("--all");
+    const filtered = args.filter((arg) => arg !== "--json" && arg !== "--all");
     const [action, key, value, extra] = filtered;
     if (!action || extra) {
         return usageError("expected get, set, unset, or list");
@@ -37,10 +41,10 @@ function configHandler(args) {
             if (key || value) {
                 return usageError("list does not accept a key or value");
             }
-            const entries = listConfig(config);
+            const entries = listConfig(config, all);
             return {
                 exitCode: 0,
-                stdout: json ? `${JSON.stringify(Object.fromEntries(entries.map((entry) => [entry.key, entry.value])), null, 2)}\n` : renderConfigList(entries),
+                stdout: json ? `${JSON.stringify(Object.fromEntries(entries.map((entry) => [entry.key, entry.value])), null, 2)}\n` : renderConfigList(entries, !all),
                 stderr: ""
             };
         }
@@ -93,8 +97,12 @@ function configHandler(args) {
         throw error;
     }
 }
-function renderConfigList(entries) {
-    return `${entries.map((entry) => `${entry.key}=${entry.value}`).join("\n")}\n`;
+function renderConfigList(entries, truncated) {
+    const lines = entries.map((entry) => `${entry.key}=${entry.value}`);
+    if (truncated) {
+        lines.push("(advanced keys hidden — dg config list --all)");
+    }
+    return `${lines.join("\n")}\n`;
 }
 function usageError(message) {
     return {