@westbayberry/dg 2.1.0 → 2.3.0

package/dist/agents/codex.js

@@ -0,0 +1,65 @@
+import { join } from "node:path";
+import { dirExists, ownedJsonHook, probeMinCliVersion } from "./persistence.js";
+function configPath(home) {
+    return join(home, ".codex", "hooks.json");
+}
+function parseInput(stdin) {
+    try {
+        const obj = JSON.parse(stdin);
+        const command = obj.tool_input?.command;
+        if (typeof command !== "string") {
+            return null;
+        }
+        return typeof obj.cwd === "string" ? { command, cwd: obj.cwd } : { command };
+    }
+    catch {
+        return null;
+    }
+}
+function emitDecision(verdict) {
+    if (verdict.decision === "allow") {
+        return { stdout: "", exitCode: 0 };
+    }
+    const reason = verdict.reason ?? "Dependency Guardian firewall";
+    const suffix = verdict.decision === "ask" ? " (dg flagged this for human review — not auto-approved)" : "";
+    return {
+        stdout: JSON.stringify({ decision: "block", reason: `${reason}${suffix}` }),
+        exitCode: 0,
+    };
+}
+function renderHookFile(dgCommand) {
+    return {
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: "Bash",
+                    hooks: [{ type: "command", command: dgCommand, timeout: 60, statusMessage: "Dependency Guardian install check" }],
+                },
+            ],
+        },
+    };
+}
+function probeHookSupport(home, deps) {
+    if (!dirExists(join(home, ".codex"))) {
+        return { supported: false, detail: "~/.codex not found (is Codex CLI installed?)" };
+    }
+    return probeMinCliVersion("codex", "0.124.0", "Codex CLI", deps);
+}
+export const codexIntegration = {
+    id: "codex",
+    label: "Codex CLI",
+    kind: "owned-json",
+    maturity: "verified",
+    minVersion: "0.124.0",
+    postInstallNote: "Codex asks to trust new hooks: approve the dg hook when Codex prompts on its next start.",
+    configPath,
+    detect: (home) => dirExists(join(home, ".codex")),
+    probeHookSupport,
+    parseInput,
+    emitDecision,
+    ...ownedJsonHook({
+        agent: "codex",
+        checkName: "dg PreToolUse hook",
+        render: renderHookFile,
+    }),
+};

package/dist/agents/copilot-cli.js

@@ -0,0 +1,115 @@
+import { join } from "node:path";
+import { dirExists, mergedJsonHook, probeMinCliVersion } from "./persistence.js";
+const SIGNATURE = "hook-exec copilot-cli";
+function configPath(home) {
+    return join(home, ".copilot", "settings.json");
+}
+function isDgEntry(entry) {
+    return (typeof entry === "object" &&
+        entry !== null &&
+        typeof entry.command === "string" &&
+        entry.command.includes(SIGNATURE));
+}
+// Native camelCase event contract (PascalCase keys switch copilot into its
+// VS Code snake_case compat mode, a different payload shape). toolName for
+// the shell tool is "bash" — the UI's "shell" label is display-only.
+function dgEntry(dgCommand) {
+    return { type: "command", matcher: "bash", command: dgCommand, timeoutSec: 60 };
+}
+export function insertDgHook(settings, dgCommand) {
+    const next = { ...settings };
+    const hooks = typeof next.hooks === "object" && next.hooks !== null ? { ...next.hooks } : {};
+    const pre = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
+    hooks.preToolUse = [...pre.filter((e) => !isDgEntry(e)), dgEntry(dgCommand)];
+    next.hooks = hooks;
+    return next;
+}
+export function removeDgHook(settings) {
+    const next = { ...settings };
+    if (typeof next.hooks !== "object" || next.hooks === null) {
+        return { settings: next, changed: false, empty: Object.keys(next).length === 0 };
+    }
+    const hooks = { ...next.hooks };
+    const pre = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
+    const withoutDg = pre.filter((e) => !isDgEntry(e));
+    const changed = withoutDg.length !== pre.length;
+    if (withoutDg.length > 0) {
+        hooks.preToolUse = withoutDg;
+    }
+    else {
+        delete hooks.preToolUse;
+    }
+    if (Object.keys(hooks).length > 0) {
+        next.hooks = hooks;
+    }
+    else {
+        delete next.hooks;
+    }
+    return { settings: next, changed, empty: Object.keys(next).length === 0 };
+}
+function hasDgHook(settings) {
+    const hooks = settings.hooks?.preToolUse;
+    return Array.isArray(hooks) && hooks.some((e) => isDgEntry(e));
+}
+function toolArgsObject(raw) {
+    if (typeof raw === "string") {
+        try {
+            const parsed = JSON.parse(raw);
+            return typeof parsed === "object" && parsed !== null ? parsed : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return typeof raw === "object" && raw !== null ? raw : null;
+}
+function parseInput(stdin) {
+    try {
+        const obj = JSON.parse(stdin);
+        const args = toolArgsObject(obj.toolArgs);
+        const command = args?.command;
+        if (typeof command !== "string") {
+            return null;
+        }
+        return typeof obj.cwd === "string" ? { command, cwd: obj.cwd } : { command };
+    }
+    catch {
+        return null;
+    }
+}
+function emitDecision(verdict) {
+    if (verdict.decision === "allow") {
+        return { stdout: "{}", exitCode: 0 };
+    }
+    return {
+        stdout: JSON.stringify({
+            permissionDecision: verdict.decision,
+            ...(verdict.reason ? { permissionDecisionReason: verdict.reason } : {}),
+        }),
+        exitCode: 0,
+    };
+}
+function probeHookSupport(home, deps) {
+    if (!dirExists(join(home, ".copilot"))) {
+        return { supported: false, detail: "~/.copilot not found (is GitHub Copilot CLI installed?)" };
+    }
+    return probeMinCliVersion("copilot", "1.0.61", "GitHub Copilot CLI", deps);
+}
+export const copilotCliIntegration = {
+    id: "copilot-cli",
+    label: "GitHub Copilot CLI",
+    kind: "merged-json",
+    maturity: "verified",
+    minVersion: "1.0.61",
+    configPath,
+    detect: (home) => dirExists(join(home, ".copilot")),
+    probeHookSupport,
+    parseInput,
+    emitDecision,
+    ...mergedJsonHook({
+        checkName: "dg preToolUse hook",
+        insert: insertDgHook,
+        remove: removeDgHook,
+        isInstalled: hasDgHook,
+    }),
+};

package/dist/agents/cursor.js

@@ -0,0 +1,118 @@
+import { join } from "node:path";
+import { formatScreenedNote } from "../launcher/agent-check.js";
+import { dirExists, mergedJsonHook, readSettings } from "./persistence.js";
+const SIGNATURE = "hook-exec cursor";
+function configPath(home) {
+    return join(home, ".cursor", "hooks.json");
+}
+function isDgEntry(entry) {
+    return (typeof entry === "object" &&
+        entry !== null &&
+        typeof entry.command === "string" &&
+        entry.command.includes(SIGNATURE));
+}
+function hookList(settings) {
+    const hooks = settings.hooks;
+    if (typeof hooks !== "object" || hooks === null) {
+        return [];
+    }
+    const list = hooks.beforeShellExecution;
+    return Array.isArray(list) ? list : [];
+}
+function insertHook(settings, dgCommand) {
+    const next = { ...settings };
+    const hooks = typeof next.hooks === "object" && next.hooks !== null ? { ...next.hooks } : {};
+    const list = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
+    hooks.beforeShellExecution = [...list.filter((entry) => !isDgEntry(entry)), { command: dgCommand }];
+    next.hooks = hooks;
+    if (next.version === undefined) {
+        next.version = 1;
+    }
+    return next;
+}
+function effectivelyEmpty(obj) {
+    const keys = Object.keys(obj);
+    return keys.length === 0 || (keys.length === 1 && keys[0] === "version");
+}
+function removeHook(settings) {
+    const next = { ...settings };
+    if (typeof next.hooks !== "object" || next.hooks === null) {
+        return { settings: next, changed: false, empty: effectivelyEmpty(next) };
+    }
+    const hooks = { ...next.hooks };
+    const list = Array.isArray(hooks.beforeShellExecution) ? hooks.beforeShellExecution : [];
+    const withoutDg = list.filter((entry) => !isDgEntry(entry));
+    const changed = withoutDg.length !== list.length;
+    if (withoutDg.length > 0) {
+        hooks.beforeShellExecution = withoutDg;
+    }
+    else {
+        delete hooks.beforeShellExecution;
+    }
+    if (Object.keys(hooks).length > 0) {
+        next.hooks = hooks;
+    }
+    else {
+        delete next.hooks;
+    }
+    return { settings: next, changed, empty: effectivelyEmpty(next) };
+}
+function hasDgHook(settings) {
+    return hookList(settings).some((entry) => isDgEntry(entry));
+}
+function parseInput(stdin) {
+    try {
+        const obj = JSON.parse(stdin);
+        if (typeof obj.command !== "string") {
+            return null;
+        }
+        return typeof obj.cwd === "string" ? { command: obj.command, cwd: obj.cwd } : { command: obj.command };
+    }
+    catch {
+        return null;
+    }
+}
+function emitDecision(verdict) {
+    if (verdict.decision === "allow") {
+        const note = verdict.screened ? formatScreenedNote(verdict.screened) : "";
+        return {
+            stdout: JSON.stringify(note ? { permission: "allow", agent_message: note } : { permission: "allow" }),
+            exitCode: 0,
+        };
+    }
+    const reason = verdict.reason ?? "Dependency Guardian firewall";
+    return {
+        stdout: JSON.stringify({ permission: verdict.decision, user_message: reason, agent_message: reason }),
+        exitCode: 0,
+    };
+}
+function probeHookSupport(home) {
+    if (!dirExists(join(home, ".cursor"))) {
+        return { supported: false, detail: "~/.cursor not found (is Cursor installed?)" };
+    }
+    try {
+        readSettings(configPath(home));
+    }
+    catch {
+        return { supported: false, detail: `${configPath(home)} exists but is not a JSON object dg can merge into` };
+    }
+    return { supported: true, detail: "requires Cursor 1.7+; dg cannot read your Cursor version from disk" };
+}
+export const cursorIntegration = {
+    id: "cursor",
+    label: "Cursor",
+    kind: "merged-json",
+    maturity: "verified",
+    minVersion: "1.7",
+    configPath,
+    detect: (home) => dirExists(join(home, ".cursor")),
+    probeHookSupport,
+    parseInput,
+    emitDecision,
+    ...mergedJsonHook({
+        checkName: "dg beforeShellExecution hook",
+        insert: insertHook,
+        remove: removeHook,
+        isInstalled: hasDgHook,
+    }),
+};

package/dist/agents/gate-posture.js

@@ -0,0 +1,21 @@
+import { readServiceState } from "../service/state.js";
+export function readNetworkGatePosture(env = process.env) {
+    try {
+        const { state } = readServiceState(env);
+        if (state.running && state.proxy) {
+            return { live: true, proxyUrl: state.proxy.proxyUrl };
+        }
+    }
+    catch {
+        // fall through to the off posture; a missing/unreadable service state means
+        // the gate is not live, which is exactly what we report.
+    }
+    return { live: false };
+}
+export const GATE_OFF_COVERAGE_GAPS = [
+    "absolute-path installs (e.g. /usr/local/bin/npm install evil)",
+    "manifest-only installs (npm ci, npm install with no package named)",
+    "dynamically-built or stdin-fed commands the static parser defers on",
+    "recognized-but-unsupported managers (bun, deno, poetry, pdm)",
+];
+export const GATE_ENABLE_HINT = "dg setup --service --yes && dg service start";

package/dist/agents/gemini.js

@@ -0,0 +1,107 @@
+import { join } from "node:path";
+import { dirExists, mergedJsonHook, probeMinCliVersion } from "./persistence.js";
+const SIGNATURE = "hook-exec gemini";
+function configPath(home) {
+    return join(home, ".gemini", "settings.json");
+}
+function isDgGroup(group) {
+    if (typeof group !== "object" || group === null) {
+        return false;
+    }
+    const hooks = group.hooks;
+    if (!Array.isArray(hooks)) {
+        return false;
+    }
+    return hooks.some((h) => typeof h === "object" &&
+        h !== null &&
+        typeof h.command === "string" &&
+        h.command.includes(SIGNATURE));
+}
+// No timeout field: gemini reads it in MILLISECONDS (default 60000); the
+// Claude-style seconds value 60 made gemini kill the hook at 60ms and run
+// the command ungated (gemini fails open on hook timeout).
+function dgGroup(dgCommand) {
+    return { matcher: "run_shell_command", hooks: [{ type: "command", command: dgCommand }] };
+}
+function insertHook(settings, dgCommand) {
+    const next = { ...settings };
+    const hooks = typeof next.hooks === "object" && next.hooks !== null ? { ...next.hooks } : {};
+    const pre = Array.isArray(hooks.BeforeTool) ? hooks.BeforeTool : [];
+    hooks.BeforeTool = [...pre.filter((g) => !isDgGroup(g)), dgGroup(dgCommand)];
+    next.hooks = hooks;
+    return next;
+}
+function removeHook(settings) {
+    const next = { ...settings };
+    if (typeof next.hooks !== "object" || next.hooks === null) {
+        return { settings: next, changed: false, empty: Object.keys(next).length === 0 };
+    }
+    const hooks = { ...next.hooks };
+    const pre = Array.isArray(hooks.BeforeTool) ? hooks.BeforeTool : [];
+    const withoutDg = pre.filter((g) => !isDgGroup(g));
+    const changed = withoutDg.length !== pre.length;
+    if (withoutDg.length > 0) {
+        hooks.BeforeTool = withoutDg;
+    }
+    else {
+        delete hooks.BeforeTool;
+    }
+    if (Object.keys(hooks).length > 0) {
+        next.hooks = hooks;
+    }
+    else {
+        delete next.hooks;
+    }
+    return { settings: next, changed, empty: Object.keys(next).length === 0 };
+}
+function hasDgHook(settings) {
+    const hooks = settings.hooks?.BeforeTool;
+    return Array.isArray(hooks) && hooks.some((g) => isDgGroup(g));
+}
+function parseInput(stdin) {
+    try {
+        const obj = JSON.parse(stdin);
+        const command = obj.tool_args?.command ?? obj.tool_input?.command;
+        if (typeof command !== "string") {
+            return null;
+        }
+        return typeof obj.cwd === "string" ? { command, cwd: obj.cwd } : { command };
+    }
+    catch {
+        return null;
+    }
+}
+function emitDecision(verdict) {
+    if (verdict.decision === "allow") {
+        return { stdout: "{}", exitCode: 0 };
+    }
+    const reason = verdict.reason ?? "Dependency Guardian firewall";
+    return {
+        stdout: JSON.stringify({ decision: "block", reason }),
+        exitCode: 0,
+    };
+}
+function probeHookSupport(home, deps) {
+    if (!dirExists(join(home, ".gemini"))) {
+        return { supported: false, detail: "~/.gemini not found (is Gemini CLI installed?)" };
+    }
+    return probeMinCliVersion("gemini", "0.26.0", "Gemini CLI", deps);
+}
+export const geminiIntegration = {
+    id: "gemini",
+    label: "Gemini CLI",
+    kind: "merged-json",
+    maturity: "verified",
+    minVersion: "0.26.0",
+    configPath,
+    detect: (home) => dirExists(join(home, ".gemini")),
+    probeHookSupport,
+    parseInput,
+    emitDecision,
+    ...mergedJsonHook({
+        checkName: "dg BeforeTool hook",
+        insert: insertHook,
+        remove: removeHook,
+        isInstalled: hasDgHook,
+    }),
+};