@westbayberry/dg 2.1.0 → 2.2.0

package/dist/commands/sbom.js

@@ -0,0 +1,206 @@
+import { createHash, randomUUID } from "node:crypto";
+import { basename, resolve } from "node:path";
+import { writeReportAtomic } from "../util/report-writer.js";
+import { discoverScanProjects, SBOM_LOCKFILE_ECOSYSTEMS } from "../scan/collect.js";
+import { buildCycloneDxSbom, collectSbomComponents, readRootComponent } from "../sbom/cyclonedx.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
+import { buildSbomRows } from "../sbom-ui/inventory.js";
+import { launchSbomTui, shouldLaunchSbomTui } from "../sbom-ui/launch.js";
+import { dgVersion } from "./version.js";
+import { EXIT_TOOL_ERROR, EXIT_USAGE } from "./types.js";
+export const sbomCommand = {
+    name: "sbom",
+    summary: "Inventory the project's dependencies as a CycloneDX 1.5 software bill of materials.",
+    usage: "dg sbom [path] [--output <path>] [--reproducible]",
+    args: [{ name: "[path]", summary: "Project directory to inventory (default: current directory)." }],
+    flags: [
+        { flag: "--output", value: "<path>", summary: "Write the document to a file without opening the interactive view (alias -o)." },
+        { flag: "--json", summary: "Print the raw CycloneDX document to stdout instead of the interactive view." },
+        { flag: "--reproducible", summary: "Byte-stable output: derive the serial number from the components and drop the timestamp (honors SOURCE_DATE_EPOCH)." }
+    ],
+    examples: ["dg sbom", "dg sbom -o sbom.cdx.json", "dg sbom --json | cyclonedx validate", "dg sbom --reproducible"],
+    details: [
+        "Reads the project's lockfiles and inventories every resolved dependency as a CycloneDX 1.5 component with its purl, license, and integrity hash.",
+        "In a terminal it opens an interactive view: the inventory appears immediately, then dg's scanner runs over the npm and PyPI components and fills in a BLOCK/WARN/PASS verdict per package — malware, provenance downgrades, and cooldown — while cargo stays inventory only. Browse with the arrow keys, search with /, filter with f, and press w to write the document. Signing in unlocks verdicts; without it the view shows the inventory alone.",
+        "Piped, with -o, or with --json it stays offline and prints the raw CycloneDX document so you can attach it to a release or feed any CycloneDX-aware tool — no scan, no account needed. Use --reproducible (or set SOURCE_DATE_EPOCH) for identical bytes across runs so a committed SBOM diffs cleanly."
+    ],
+    handler: (context) => runSbomCommand(context)
+};
+export function runSbomCommand(context, cwd = process.cwd(), now = new Date(), env = process.env) {
+    const parsed = parseArgs(context.args);
+    if ("error" in parsed) {
+        return { exitCode: EXIT_USAGE, stdout: "", stderr: `dg sbom: ${parsed.error}. Usage: ${sbomCommand.usage}\n` };
+    }
+    const root = resolve(cwd, parsed.targetPath ?? ".");
+    const projects = discoverScanProjects(root, SBOM_LOCKFILE_ECOSYSTEMS);
+    const { components, dropped } = collectSbomComponents(projects);
+    const rootComponent = readRootComponent(root);
+    const reproducible = parsed.reproducible || env.SOURCE_DATE_EPOCH !== undefined;
+    const bom = buildCycloneDxSbom(components, {
+        ...timestampOption(reproducible, now, env),
+        serialNumber: "urn:uuid:00000000-0000-0000-0000-000000000000",
+        toolVersion: dgVersion(),
+        ...(rootComponent.component ? { rootComponent: rootComponent.component } : {})
+    });
+    const finalBom = {
+        ...bom,
+        serialNumber: reproducible ? deterministicSerialNumber(bom) : `urn:uuid:${randomUUID()}`
+    };
+    const document = `${JSON.stringify(finalBom, null, 2)}\n`;
+    const notes = [];
+    if (components.length === 0) {
+        notes.push(`dg sbom: no resolvable dependencies found under ${root} — emitting an empty SBOM.`);
+    }
+    if (dropped.length > 0) {
+        notes.push(`dg sbom: omitted ${dropped.length} dependency(ies) without a pinned version (${formatDropped(dropped)}). Pin them (e.g. name==version) to include them.`);
+    }
+    if (rootComponent.malformed) {
+        notes.push(`dg sbom: ${root}/package.json could not be parsed — the SBOM has no named subject component.`);
+    }
+    const stderr = notes.length > 0 ? `${notes.join("\n")}\n` : "";
+    if (parsed.outputPath) {
+        try {
+            writeReportAtomic(resolve(cwd, parsed.outputPath), document);
+        }
+        catch (error) {
+            return { exitCode: EXIT_TOOL_ERROR, stdout: "", stderr: `dg sbom: could not write ${parsed.outputPath}: ${error instanceof Error ? error.message : "unknown write error"}\n` };
+        }
+        return { exitCode: 0, stdout: `Wrote CycloneDX SBOM (${components.length} components) to ${parsed.outputPath}\n`, stderr };
+    }
+    const presentation = resolvePresentation();
+    if (parsed.json || !presentation.isTTY) {
+        return { exitCode: 0, stdout: document, stderr };
+    }
+    const subject = finalBom.metadata.component
+        ? `${finalBom.metadata.component.name}${finalBom.metadata.component.version ? `@${finalBom.metadata.component.version}` : ""}`
+        : basename(root) || ".";
+    if (shouldLaunchSbomTui({ json: parsed.json, outputPath: parsed.outputPath })) {
+        void launchSbomTui({ rows: buildSbomRows(components), dropped, subject, document, env, cwd }).then(() => process.exit(typeof process.exitCode === "number" ? process.exitCode : 0), (error) => {
+            process.stderr.write(`dg sbom view failed: ${error instanceof Error ? error.message : "unknown error"}\n`);
+            process.exit(1);
+        });
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    return { exitCode: 0, stdout: renderSbomSummary(finalBom, dropped, subject, createTheme(presentation.color)), stderr };
+}
+const ANSI_PATTERN = /\x1b\[[0-9;]*m/gu;
+function visibleWidth(text) {
+    return text.replace(ANSI_PATTERN, "").length;
+}
+export function renderSbomSummary(bom, dropped, subject, theme, terminalWidth = process.stdout.columns ?? 100) {
+    const components = bom.components;
+    const total = components.length;
+    const count = (prefix) => components.filter((c) => c["bom-ref"].startsWith(prefix)).length;
+    const ecosystems = [["npm", count("pkg:npm/")], ["pypi", count("pkg:pypi/")], ["cargo", count("pkg:cargo/")]]
+        .filter(([, n]) => n > 0)
+        .sort((a, b) => b[1] - a[1]);
+    const withLicense = components.filter((c) => c.licenses && c.licenses.length > 0).length;
+    const withHash = components.filter((c) => c.hashes && c.hashes.length > 0).length;
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const warn = (text) => theme.paint("warn", text);
+    const denomWidth = String(total).length;
+    const license = { label: "License", covered: withLicense, deficit: total - withLicense, gap: "unknown" };
+    const integrity = { label: "Integrity", covered: withHash, deficit: total - withHash, gap: "no checksum" };
+    const gapWidth = Math.max(1, String(license.deficit).length, String(integrity.deficit).length);
+    const gapClause = (q) => (q.deficit > 0 ? `${String(q.deficit).padStart(gapWidth)} ${q.gap}` : "");
+    const clauseWidth = Math.max(gapClause(license).length, gapClause(integrity).length);
+    const qualityRow = (q) => {
+        const clause = gapClause(q);
+        const painted = clause ? warn(clause) : "";
+        const fraction = muted(`${String(q.covered).padStart(denomWidth)} / ${total} covered`);
+        return `${muted(q.label.padEnd(10))}${painted}${" ".repeat(clauseWidth - clause.length)}   ${fraction}`;
+    };
+    const breakdown = ecosystems.map(([name, n]) => `${n} ${name}`).join(muted(" · "));
+    const rows = [
+        `${accent(String(total))} ${total === 1 ? "component" : "components"}${breakdown ? `   ${muted(breakdown)}` : ""}`,
+        "",
+        qualityRow(license),
+        qualityRow(integrity),
+        ...(dropped.length > 0
+            ? [`${muted("Omitted".padEnd(10))}${warn(`${String(dropped.length).padStart(gapWidth)} unpinned`)}${muted(", left out of the document")}`]
+            : []),
+        "",
+        muted(`CycloneDX 1.5 · ${subject} · inventory only`)
+    ];
+    const inner = Math.min(Math.max(0, ...rows.map(visibleWidth)), Math.max(24, terminalWidth - 4));
+    const bar = muted("─".repeat(inner + 2));
+    const side = muted("│");
+    const boxed = [
+        `${muted("╭")}${bar}${muted("╮")}`,
+        ...rows.map((row) => `${side} ${row}${" ".repeat(Math.max(0, inner - visibleWidth(row)))} ${side}`),
+        `${muted("╰")}${bar}${muted("╯")}`
+    ];
+    const footer = [
+        `  ${muted("→ write it:")} dg sbom -o sbom.cdx.json  ${muted("· --json prints it")}`,
+        `  ${accent("dg scan")} ${muted("for BLOCK / WARN / PASS verdicts")}`
+    ];
+    return `${[...boxed, ...footer].join("\n")}\n`;
+}
+function timestampOption(reproducible, now, env) {
+    if (!reproducible) {
+        return { timestamp: now.toISOString() };
+    }
+    const epoch = env.SOURCE_DATE_EPOCH;
+    if (epoch !== undefined && /^\d+$/.test(epoch.trim())) {
+        const date = new Date(Number.parseInt(epoch.trim(), 10) * 1000);
+        const iso = Number.isFinite(date.getTime()) ? date.toISOString() : "";
+        if (/^\d{4}-/u.test(iso)) {
+            return { timestamp: iso };
+        }
+    }
+    return {};
+}
+function deterministicSerialNumber(bom) {
+    const hex = createHash("sha256").update(JSON.stringify(bom.components)).digest("hex");
+    const version = `4${hex.slice(13, 16)}`;
+    const variantNibble = ((Number.parseInt(hex.slice(16, 17) || "0", 16) & 0x3) | 0x8).toString(16);
+    const variant = `${variantNibble}${hex.slice(17, 20)}`;
+    return `urn:uuid:${hex.slice(0, 8)}-${hex.slice(8, 12)}-${version}-${variant}-${hex.slice(20, 32)}`;
+}
+function formatDropped(dropped) {
+    const shown = dropped.slice(0, 5).join(", ");
+    return dropped.length > 5 ? `${shown}, +${dropped.length - 5} more` : shown;
+}
+function parseArgs(args) {
+    let targetPath = null;
+    let outputPath = null;
+    let reproducible = false;
+    let json = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === undefined) {
+            continue;
+        }
+        if (arg === "--output" || arg === "-o") {
+            const value = args[i + 1];
+            if (value === undefined || value.startsWith("-")) {
+                return { error: `${arg} needs a path` };
+            }
+            outputPath = value;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith("--output=")) {
+            outputPath = arg.slice("--output=".length);
+            continue;
+        }
+        if (arg === "--reproducible") {
+            reproducible = true;
+            continue;
+        }
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg.startsWith("-")) {
+            return { error: `unknown flag '${arg}'` };
+        }
+        if (targetPath !== null) {
+            return { error: `unexpected argument '${arg}'` };
+        }
+        targetPath = arg;
+    }
+    return { targetPath, outputPath, reproducible, json };
+}

package/dist/commands/scan.js

@@ -13,7 +13,7 @@ export const scanCommand = {
     ],
     examples: ["dg scan", "dg scan ./packages/api", "dg scan --json -o scan.json", "dg scan --staged"],
     details: [
-        "Reads lockfiles, scores each dependency through the scanner, and never changes project files. In a terminal it opens the full-screen results browser; piped or with --json/--sarif it prints machine output. Exit codes: 0 clean, 1 warn, 2 block, 4 analysis incomplete, 64 usage error."
+        "Reads lockfiles, scores each dependency through the scanner, and never changes project files. In a terminal it opens the full-screen results browser; piped or with --json/--sarif it prints machine output. Exit codes: 0 clean, 1 warn, 2 block, 4 analysis incomplete, 10 nothing to scan, 64 usage error."
     ],
     handler: runScanCommand
 };

package/dist/commands/service.js

@@ -2,6 +2,8 @@ import { EXIT_UNAVAILABLE, EXIT_USAGE } from "./types.js";
 import { renderCommandHelp } from "./help.js";
 import { buildServiceUninstallPlan, buildTrustInstallPlan, buildTrustUninstallPlan, installServiceTrust, readServiceState, renderServicePlan, resolveServicePaths, restartService, ServiceNotConfiguredError, ServiceProxyError, ServiceTrustStoreError, ServiceTrustToolMissingError, startService, stopService, uninstallService, uninstallServiceTrust } from "../service/state.js";
 import { LockBusyError } from "../state/locks.js";
+import { resolvePresentation } from "../presentation/mode.js";
+import { createTheme } from "../presentation/theme.js";
 const trustCommand = {
     name: "trust",
     summary: "Manage explicit service-mode trust installation.",
@@ -208,10 +210,12 @@ function mutationPlanWrites(action) {
 function serviceMutation(action, run) {
     try {
         const result = run();
+        const theme = createTheme(resolvePresentation().color);
         const changed = result.changed ? actionPastTense(action) : `already ${action === "start" ? "running" : "stopped"}`;
+        const detail = result.state.running && result.state.proxy ? ` ${theme.paint("muted", `at ${result.state.proxy.proxyUrl}`)}` : "";
         return {
             exitCode: 0,
-            stdout: `Dependency Guardian service ${changed}.\n${renderServiceStatus(result.state)}`,
+            stdout: `${theme.paint("pass", "✓")} Service ${changed}${detail} ${theme.paint("muted", "· dg service status")}\n`,
             stderr: ""
         };
     }
@@ -399,20 +403,34 @@ function parseJsonArgs(command, args) {
     };
 }
 function renderServiceStatus(state) {
+    const theme = createTheme(resolvePresentation().color);
+    const pass = (text) => `${theme.paint("pass", "✓")} ${text}`;
+    const warn = (text) => `${theme.paint("warn", "⚠")} ${text}`;
+    const configured = state.configured
+        ? pass("yes")
+        : warn(`no — run ${theme.paint("accent", "dg setup --service --yes")}`);
+    const running = state.running && state.proxy
+        ? pass(`yes ${theme.paint("muted", `(${state.proxy.proxyUrl})`)}`)
+        : warn(state.configured ? `no — run ${theme.paint("accent", "dg service start")}` : "no");
+    const trust = state.trust
+        ? pass(`${state.trust.provider} ${theme.paint("muted", `(${state.trust.fingerprintSha256.slice(0, 12)}…)`)}`)
+        : warn(`not installed — run ${theme.paint("accent", "dg service trust install --yes")}`);
     const lines = [
-        "Dependency Guardian service status",
+        "Dependency Guardian service",
         "",
-        `configured: ${state.configured ? "yes" : "no"}`,
-        `running: ${state.running ? "yes" : "no"}`,
-        `trust installed: ${state.trustInstalled ? "yes" : "no"}`,
-        `trust provider: ${state.trust ? state.trust.provider : "not installed"}`,
-        `trust fingerprint: ${state.trust ? state.trust.fingerprintSha256 : "not installed"}`,
-        `trust drift: ${state.trustDrift ? state.trustDrift.message : "none"}`,
-        `service proxy: ${state.proxy ? state.proxy.proxyUrl : "not running"}`,
-        `health endpoint: ${state.proxy ? state.proxy.healthUrl : "not running"}`,
-        `last error: ${state.lastError ?? "none"}`,
-        `policy synced: ${state.policySyncedAt ?? "never"}`
+        `  Configured   ${configured}`,
+        `  Running      ${running}`,
+        `  Trust        ${trust}`
     ];
+    if (state.trustDrift) {
+        lines.push(`  Trust drift  ${warn(state.trustDrift.message)}`);
+    }
+    lines.push(`  Policy sync  ${state.policySyncedAt ? pass(state.policySyncedAt) : theme.paint("muted", "never")}`);
+    if (state.lastError) {
+        lines.push(`  Last error   ${warn(state.lastError)}`);
+    }
+    lines.push("");
+    lines.push(`Full diagnostics: ${theme.paint("accent", "dg service doctor")}`);
     return `${lines.join("\n")}\n`;
 }
 function serviceStatusJson(state) {
@@ -503,10 +521,11 @@ function actionPastTense(action) {
     return "restarted";
 }
 function serviceNotConfiguredResult() {
+    const theme = createTheme(resolvePresentation().color);
     return {
         exitCode: EXIT_USAGE,
         stdout: "",
-        stderr: "dg service is not configured. Run 'dg setup --service --yes' first; no service or trust state was changed.\n"
+        stderr: `${theme.paint("warn", "dg service is not configured")} — run ${theme.paint("accent", "dg setup --service --yes")} first ${theme.paint("muted", "(no service or trust state was changed)")}\n`
     };
 }
 function trustStoreFailureResult(planText, action, message) {

package/dist/commands/setup.js

@@ -1,34 +1,40 @@
 import { EXIT_UNAVAILABLE, EXIT_USAGE } from "./types.js";
 import { LockBusyError } from "../state/index.js";
-import { activationCommand as shellActivationCommand, applySetupPlanWithLock, buildSetupPlan, renderSetupPlan } from "../setup/plan.js";
+import { activationCommand as shellActivationCommand, applySetupPlanWithLock, buildSetupPlan, renderSetupPlan, tildifyPath as tildify } from "../setup/plan.js";
+import { activateShell, activationOffer } from "../setup/activate-shell.js";
 import { buildServiceSetupPlan, configureService, renderServicePlan } from "../service/state.js";
 import { optionalSupportGate } from "../setup/optional-support.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { closeSync, openSync, readSync } from "node:fs";
-import { homedir } from "node:os";
 import { authStatus } from "../auth/store.js";
+import { resolveWebBase } from "../auth/device-login.js";
+import { applyAgentHook, collectAgentOffers } from "../agents/registry.js";
+import { applyGitHook, commitGuardOffer } from "../setup/git-hook.js";
+import { markSecurityNotesShown, securityNotesShown } from "../setup-ui/gate.js";
 export const setupCommand = {
     name: "setup",
-    summary: "Protect plain npm/pip/yarn installs (no dg prefix needed).",
-    usage: "dg setup [--print] [--yes] [--shell <auto|zsh|bash|fish>] [--service]",
+    summary: "Protect this machine — shell installs, AI-agent installs, and a repo's commits.",
+    usage: "dg setup [--print] [--yes] [--agents] [--guard-commit] [--shell <auto|zsh|bash|fish>] [--service]",
     flags: [
         { flag: "--print", summary: "Preview the exact write plan and change nothing." },
-        { flag: "--yes", summary: "Apply without the interactive prompt (required when non-interactive)." },
+        { flag: "--yes", summary: "Apply the shell firewall only, without prompts (add --agents / --guard-commit to opt in the rest)." },
+        { flag: "--agents", summary: "With --yes: also route every detected AI agent's installs through dg." },
+        { flag: "--guard-commit", summary: "With --yes: also scan this repo's commits (per-repo)." },
         { flag: "--shell", value: "<auto|zsh|bash|fish>", summary: "Target shell rc to write (default: auto-detect)." },
         { flag: "--service", summary: "Set up service mode (Pro/Team; persistent proxy + managed CA)." }
     ],
-    examples: ["dg setup --print", "dg setup --yes", "dg setup --shell zsh --yes"],
+    examples: ["dg setup", "dg setup --print", "dg setup --yes --agents", "dg setup --shell zsh --yes"],
     details: [
-        "In a terminal, shows what it writes and asks before applying, then reloads your shell. Use --yes to apply non-interactively and --print to preview only.",
-        "Writes only dg-owned reversible files and repairs setup drift; undo with dg uninstall. The per-repo git pre-commit hook is separate — see dg guard-commit."
+        "In a terminal it shows one consent screen listing everything it will protect — your shell's installs plus every detected AI agent, with the exact files it writes — and applies them on a single yes. Commits in the current repo are a separate per-repo question.",
+        "Non-interactively, --yes applies just the shell firewall; add --agents and/or --guard-commit to opt those in. --print previews. Writes only dg-owned reversible files; undo it all with dg uninstall."
     ],
     handler: (context) => setupHandler(context.args)
 };
 const WINDOWS_UNSUPPORTED = "dg setup (automatic interception) does not support Windows yet.\n" +
     "You can still protect installs on Windows: prefix the command with dg,\n" +
     "for example `dg pip install <pkg>` or `dg npm install <pkg>`.\n";
-function setupHandler(args) {
+async function setupHandler(args) {
     const parsed = parseSetupArgs(args);
     if ("error" in parsed) {
         return {
@@ -54,12 +60,16 @@ function setupHandler(args) {
     if (parsed.printOnly) {
         return {
             exitCode: 0,
-            stdout: renderedPlan,
+            stdout: `${renderedPlan}${printableSurfaceOffers()}`,
             stderr: ""
         };
     }
     if (!parsed.yes) {
         if (isInteractive()) {
+            if (resolvePresentation().mode === "rich") {
+                const { runSetupWizard } = await import("../setup-ui/wizard.js");
+                return runSetupWizard(plan, { autoActivate: true });
+            }
             return runInteractiveSetup(plan);
         }
         return {
@@ -81,23 +91,34 @@ function setupHandler(args) {
         }
         throw error;
     }
+    const extra = await applyRequestedSurfaces(parsed);
+    const theme = createTheme(resolvePresentation().color);
     return {
         exitCode: 0,
-        stdout: `${renderedPlan}\nSet up — active in new terminals. Activate this shell now: ${activationCommand(plan)}\n`,
+        stdout: `${theme.paint("pass", "✓")} Setup complete — active in new terminals ${theme.paint("muted", `(wrote ${tildify(plan.shimDir)} and ${tildify(plan.rcPath)}; details: dg doctor)`)}\n${extra}Activate this shell now: ${theme.paint("accent", activationCommand(plan))}\n`,
         stderr: ""
     };
 }
 function isInteractive() {
     return Boolean(process.stdin.isTTY && process.stderr.isTTY);
 }
-function runInteractiveSetup(plan) {
+async function runInteractiveSetup(plan) {
     const theme = createTheme(resolvePresentation().color);
     const accent = (text) => theme.paint("accent", text);
     const muted = (text) => theme.paint("muted", text);
     const err = process.stderr;
-    err.write(`\n  Scans ${accent("npm")}/${accent("pip")}/${accent("yarn")}/${muted("…")} installs automatically — no ${accent("dg")} prefix.\n`);
-    err.write(`  ${muted("Writes")} ${accent(tildify(plan.rcPath))}${muted(".")} ${muted("Reversible with")} ${accent("dg uninstall")}${muted(".")}\n\n`);
-    const answer = promptYesNoSync(`  ${accent("Proceed?")}`, theme);
+    const agents = collectAgentOffers();
+    const repo = commitGuardOffer();
+    if (!securityNotesShown()) {
+        err.write(renderSecurityNotesText(theme));
+        err.write(`  ${muted("Press Enter to agree")} `);
+        if (readLineFromTty() !== null) {
+            markSecurityNotesShown();
+        }
+        err.write("\n");
+    }
+    err.write(renderConsentScreen(consentSurfaces(plan, agents, repo !== null), theme));
+    const answer = promptYesNoSync(`  ${accent("Protect installs on this machine?")}`, theme, true);
     if (answer === "no-tty") {
         return {
             exitCode: EXIT_USAGE,
@@ -121,21 +142,152 @@ function runInteractiveSetup(plan) {
         }
         throw error;
     }
-    err.write(`\n  ${theme.paint("pass", "✓ set up — active in new terminals")}\n`);
-    err.write(`  ${muted("Activate this shell now:")}  ${accent(activationCommand(plan))}\n`);
+    err.write(`\n  ${theme.paint("pass", "✓ shell installs protected — active in new terminals")}\n`);
+    await applyAgentOffers(agents, theme, err);
+    promptCommitSurface(repo, theme, err);
+    return finishWithActivation(plan, theme, err);
+}
+export function consentSurfaces(plan, agents, repoOffered) {
+    const surfaces = [
+        { label: "shell installs", detail: `writes ${tildify(plan.rcPath)}`, deferred: false }
+    ];
+    for (const offer of agents) {
+        surfaces.push({ label: `${offer.label} installs`, detail: `writes ${tildify(offer.ctx.settingsPath)}`, deferred: false });
+    }
+    if (repoOffered) {
+        surfaces.push({ label: "commits in this repo", detail: "asked separately", deferred: true });
+    }
+    return surfaces;
+}
+export function renderConsentScreen(surfaces, theme) {
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const width = Math.max(...surfaces.map((surface) => surface.label.length));
+    const lines = [
+        "",
+        `  Scans ${accent("npm")}/${accent("pip")}/${accent("yarn")}/${muted("…")} installs automatically — no ${accent("dg")} prefix.`,
+        `  ${muted("Reversible with")} ${accent("dg uninstall")}${muted(".")}`,
+        "",
+        `  ${muted("Sets up:")}`
+    ];
+    for (const surface of surfaces) {
+        const label = surface.label.padEnd(width);
+        lines.push(surface.deferred ? `    ${muted(label)}  ${muted(surface.detail)}` : `    ${accent(label)}  ${muted(surface.detail)}`);
+    }
+    lines.push("", "");
+    return lines.join("\n");
+}
+function finishWithActivation(plan, theme, err) {
+    const offer = activationOffer();
+    if (offer === "none") {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    if (offer === "prompt" && promptYesNoSync(`\n  ${accent("Activate in this terminal now?")}`, theme, true) === "yes") {
+        err.write(`  ${muted("Starting a protected shell — type")} ${accent("exit")} ${muted("to return to your previous one.")}\n`);
+        return { exitCode: activateShell(), stdout: "", stderr: "" };
+    }
+    err.write(`\n  ${muted("Activate this shell now:")}  ${accent(activationCommand(plan))}\n`);
     return { exitCode: 0, stdout: "", stderr: "" };
 }
+async function applyAgentOffers(offers, theme, err) {
+    const muted = (text) => theme.paint("muted", text);
+    for (const offer of offers) {
+        try {
+            await applyAgentHook(offer.ctx);
+            err.write(`  ${theme.paint("pass", `✓ ${offer.label} installs route through dg`)} ${muted(`(${tildify(offer.ctx.settingsPath)})`)}\n`);
+        }
+        catch (error) {
+            err.write(`  ${theme.paint("warn", `✗ ${offer.label}`)} ${muted(`— ${error instanceof Error ? error.message : "unknown error"}`)}\n`);
+        }
+    }
+}
+function promptCommitSurface(repo, theme, err) {
+    if (!repo) {
+        return;
+    }
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    err.write(`\n  ${muted("This is a git repo. Scan its commits before they land?")}\n`);
+    if (promptYesNoSync(`  ${accent("Guard commits in this repo?")}`, theme, false) !== "yes") {
+        return;
+    }
+    try {
+        applyGitHook(repo);
+        err.write(`  ${theme.paint("pass", "✓ commits in this repo are now scanned")}\n`);
+    }
+    catch (error) {
+        err.write(`  ${theme.paint("warn", `✗ commits in this repo`)} ${muted(`— ${error instanceof Error ? error.message : "unknown error"}`)}\n`);
+    }
+}
+async function applyRequestedSurfaces(parsed) {
+    const lines = [];
+    if (parsed.agents) {
+        for (const offer of collectAgentOffers()) {
+            try {
+                await applyAgentHook(offer.ctx);
+                lines.push(`${offer.label} installs now route through dg (${tildify(offer.ctx.settingsPath)}).`);
+            }
+            catch (error) {
+                lines.push(`could not hook ${offer.label}: ${error instanceof Error ? error.message : "unknown error"}`);
+            }
+        }
+    }
+    if (parsed.guardCommit) {
+        const repo = commitGuardOffer();
+        if (repo) {
+            try {
+                applyGitHook(repo);
+                lines.push("commits in this repo are now scanned.");
+            }
+            catch (error) {
+                lines.push(`could not install the commit guard: ${error instanceof Error ? error.message : "unknown error"}`);
+            }
+        }
+    }
+    return lines.length > 0 ? `${lines.join("\n")}\n` : "";
+}
+function printableSurfaceOffers() {
+    const lines = [];
+    for (const offer of collectAgentOffers()) {
+        lines.push(`would offer: route ${offer.label} installs through dg (--agents)`);
+    }
+    if (commitGuardOffer()) {
+        lines.push("would offer: scan this repo's commits (--guard-commit)");
+    }
+    return lines.length > 0 ? `\n${lines.join("\n")}\n` : "";
+}
 function activationCommand(plan) {
     return shellActivationCommand(plan.shell, tildify(plan.rcPath));
 }
-function promptYesNoSync(question, theme) {
-    process.stderr.write(`${question} ${theme.paint("muted", "[y/N]")} `);
+function renderSecurityNotesText(theme) {
+    const muted = (text) => theme.paint("muted", text);
+    const webBase = resolveWebBase(process.env);
+    return [
+        "",
+        `  ${theme.paint("accent", "Security notes")}`,
+        "",
+        "  1. dg can make mistakes.",
+        "     A PASS verdict does not guarantee a package is safe. You are",
+        "     responsible for what you install and should review new",
+        "     dependencies.",
+        "",
+        "  2. By continuing you confirm you have read and understand the",
+        "     Terms of Service and Privacy Policy.",
+        `     ${muted(`${webBase}/terms`)}`,
+        `     ${muted(`${webBase}/privacy`)}`,
+        "",
+        ""
+    ].join("\n");
+}
+function readLineFromTty() {
     let tty;
     try {
         tty = openSync("/dev/tty", "rs");
     }
     catch {
-        return "no-tty";
+        return null;
     }
     try {
         const byte = Buffer.alloc(1);
@@ -160,22 +312,31 @@ function promptYesNoSync(question, theme) {
             }
             answer += char;
         }
-        const normalized = answer.trim().toLowerCase();
-        return normalized === "y" || normalized === "yes" ? "yes" : "no";
+        return answer;
     }
     finally {
         closeSync(tty);
     }
 }
-function tildify(path) {
-    const home = homedir();
-    return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+function promptYesNoSync(question, theme, defaultYes = false) {
+    process.stderr.write(`${question} ${theme.paint("muted", defaultYes ? "[Y/n]" : "[y/N]")} `);
+    const answer = readLineFromTty();
+    if (answer === null) {
+        return "no-tty";
+    }
+    const normalized = answer.trim().toLowerCase();
+    if (normalized === "") {
+        return defaultYes ? "yes" : "no";
+    }
+    return normalized === "y" || normalized === "yes" ? "yes" : "no";
 }
 function parseSetupArgs(args) {
     let printOnly = false;
     let yes = false;
     let shell = "auto";
     let service = false;
+    let agents = false;
+    let guardCommit = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === "--print") {
@@ -187,6 +348,12 @@ function parseSetupArgs(args) {
         else if (arg === "--service") {
             service = true;
         }
+        else if (arg === "--agents") {
+            agents = true;
+        }
+        else if (arg === "--guard-commit") {
+            guardCommit = true;
+        }
         else if (arg === "--python-hook" || arg?.startsWith("--python-hook=")) {
             return {
                 exitCode: EXIT_UNAVAILABLE,
@@ -251,7 +418,9 @@ function parseSetupArgs(args) {
         printOnly,
         yes,
         shell,
-        service
+        service,
+        agents,
+        guardCommit
     };
 }
 function parseShell(value) {
@@ -270,10 +439,11 @@ function serviceSetupHandler(parsed) {
         };
     }
     if (!authStatus().authenticated) {
+        const theme = createTheme(resolvePresentation().color);
         return {
             exitCode: EXIT_UNAVAILABLE,
             stdout: "",
-            stderr: "dg setup --service is a Pro or Team feature. Run 'dg login' to connect a paid account, then 'dg setup --service'. See https://westbayberry.com/pricing\n"
+            stderr: `${theme.paint("warn", "dg setup --service is a Pro or Team feature")} — ${theme.paint("accent", "dg login")} ${theme.paint("muted", "with a paid account, then re-run")} ${theme.paint("muted", "· westbayberry.com/pricing")}\n`
         };
     }
     if (!parsed.yes) {

package/dist/commands/types.js

@@ -1,5 +1,6 @@
 export const EXIT_USAGE = 2;
 export const EXIT_USAGE_VERDICT = 64;
+export const EXIT_ANALYSIS_INCOMPLETE = 4;
 export const EXIT_NOTHING_TO_SCAN = 10;
 export const EXIT_UNAVAILABLE = 69;
 export const EXIT_TOOL_ERROR = 70;