@westbayberry/dg 2.1.0 → 2.3.0

package/dist/scan-ui/components/ProgressBar.js

@@ -4,11 +4,7 @@ import { Text, Box } from "ink";
 import InkSpinner from "ink-spinner";
 import chalk from "chalk";
 import { useTerminalSize } from "../hooks/useTerminalSize.js";
-// Measured ETA: extrapolates remaining time from the throughput observed so far.
-// `value` and `total` are the same numbers the bar renders; `elapsedSeconds` is
-// the wall-clock since the bar mounted. Returns null fields when there's not
-// enough signal yet (value == 0 or elapsed == 0) so the UI can show
-// "calculating…" instead of a misleading number.
+// Null fields until value/elapsed are non-zero so the UI shows "calculating…".
 export function computeEta(value, total, elapsedSeconds) {
     if (value <= 0 || elapsedSeconds <= 0 || total <= 0) {
         return { remainingSeconds: null, ratePerSec: null };
@@ -68,17 +64,10 @@ export const ProgressBar = ({ value, total, label, }) => {
         timeInfo = `${formatTime(elapsed)} elapsed · ~${formatTime(eta.remainingSeconds)} left${rateInline}`;
     }
     const counter = `${value}/${total}  ${percent}%`;
-    // Width thresholds:
-    //   < 30 cols → compact: counter only, no bar (bar would soft-wrap and
-    //               break Ink's line-count tracker, leaving stale lines
-    //               above on the next redraw).
-    //   30-59     → narrow bar (no elapsed-time tail beside the spinner).
-    //   >= 60     → full bar + tail.
+    // Below 30 cols the bar would soft-wrap and break Ink's line-count
+    // tracker, leaving stale lines above on the next redraw.
     const compact = termWidth < 30;
     const narrow = !compact && termWidth < 60;
-    // Reserve: 4 indent + counter length + 2 padding. Floor at 6 cols so
-    // even on a borderline-narrow terminal we draw SOMETHING; if there's
-    // no room at all we fall through to compact mode above.
     const barWidth = Math.max(6, termWidth - counter.length - 8);
     const fraction = total > 0 ? Math.min(1, value / total) : 0;
     const filled = Math.round(fraction * barWidth);

package/dist/scan-ui/components/ProjectSelector.js

@@ -42,7 +42,7 @@ export const ProjectSelector = ({ projects, onConfirm, onCancel, userStatus }) =
         }
     });
     const ecosystemLabel = (eco) => eco === "npm" ? chalk.magenta("npm") : chalk.blue("pip");
-    return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, children: [_jsxs(Text, { children: [chalk.bold("Dependency Guardian"), "  ", userStatus ? chalk.dim(userStatus) : ""] }), _jsx(Text, { children: "" }), _jsxs(Text, { bold: true, children: ["Found ", projects.length, " project", projects.length !== 1 ? "s" : ""] }), _jsx(Text, { children: "" }), projects.map((proj, i) => {
+    return (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, children: [_jsxs(Text, { children: [chalk.bold("Dependency Guardian"), "  ", userStatus ?? ""] }), _jsx(Text, { children: "" }), _jsxs(Text, { bold: true, children: ["Found ", projects.length, " project", projects.length !== 1 ? "s" : ""] }), _jsx(Text, { children: "" }), projects.map((proj, i) => {
                 const isCursor = i === cursor;
                 const isSelected = selected.has(i);
                 const prefix = isCursor ? chalk.cyan("\u258C") : " ";

package/dist/scan-ui/components/ScoreHeader.js

@@ -13,10 +13,9 @@ function scoreColor(score, action) {
                 chalk.green.bold;
     return colorFn(String(score));
 }
-export const ScoreHeader = ({ score, action, total, flagged, clean, userStatus, scanUsage, usageNearLimit, }) => {
+export const ScoreHeader = ({ score, action, compact, total, flagged, clean, userStatus, scanUsage, usageNearLimit, }) => {
     const logo = renderLogo(action);
-    const { cols, rows } = useTerminalSize();
-    const compact = rows < COMPACT_ROWS;
+    const { cols } = useTerminalSize();
     const showLogo = cols >= LOGO_MIN_COLS && !compact;
     return (_jsx(Box, { flexDirection: "column", borderStyle: "round", borderColor: action === "block" ? "red" : action === "warn" ? "yellow" : action === "analysis_incomplete" ? "cyan" : "green", paddingLeft: 1, paddingRight: 1, width: "100%", children: _jsxs(Box, { flexDirection: "row", children: [_jsxs(Box, { flexDirection: "column", flexGrow: 1, children: [_jsxs(Text, { bold: true, children: ["Dependency Guardian  ", userStatus ?? ""] }), !compact && _jsx(Text, { children: " " }), _jsxs(Text, { children: [chalk.dim("Score"), "  ", scoreColor(score, action)] }), total !== undefined && (_jsxs(_Fragment, { children: [!compact && _jsx(Text, { children: " " }), _jsxs(Text, { children: [chalk.dim(`${total} package${total !== 1 ? "s" : ""} scanned`), flagged !== undefined && flagged > 0 ? (_jsxs(_Fragment, { children: ["    ", chalk.yellow(`${flagged} flagged`), "    ", chalk.green(`${clean ?? 0} clean`)] })) : (_jsxs(_Fragment, { children: ["    ", chalk.green("all clean")] }))] }), scanUsage && (usageNearLimit
                                     ? _jsxs(Text, { color: "yellow", children: [scanUsage, "  \u2191 Pro: westbayberry.com/pricing"] })

package/dist/scan-ui/components/SetupBanner.js

@@ -1,11 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, Text } from "ink";
-// Visible alert shown above the scan results when the user's DG setup has
-// gaps — missing api key, missing pre-commit hook, etc. Renders nothing
-// when issues is empty so it's free to drop in unconditionally.
-//
-// Yellow border, single line per issue, fix command in cyan so the user
-// can copy-paste it.
 export const SetupBanner = ({ issues }) => {
     if (issues.length === 0)
         return null;

package/dist/scan-ui/format-helpers.js

@@ -1,7 +1,6 @@
+import chalk from "chalk";
+import { sanitize } from "../security/sanitize.js";
 export const USAGE_NEAR_LIMIT_RATIO = 0.8;
-// Renders the monthly package-usage readout shown on every scan. `nearLimit`
-// drives the dim → yellow + upgrade-nudge escalation; it's only ever true for
-// a finite limit at/above 80% used.
 export function formatUsage(usage) {
     const used = usage.used.toLocaleString();
     if (usage.limit === null) {
@@ -12,11 +11,68 @@ export function formatUsage(usage) {
         nearLimit: usage.used / usage.limit >= USAGE_NEAR_LIMIT_RATIO,
     };
 }
+export function formatAccountStatus(tier, loggedIn, name) {
+    const cleaned = sanitize(tier).trim().slice(0, 24).toLowerCase();
+    const label = cleaned ? cleaned.charAt(0).toUpperCase() + cleaned.slice(1) : loggedIn ? "Account" : "Free";
+    if (!loggedIn) {
+        return `${chalk.dim(`${label} · `)}${chalk.cyan.bold("dg login")}`;
+    }
+    const plan = (cleaned === "free" ? chalk.yellow : chalk.green)(`${label} plan`);
+    const who = name ? sanitize(name).trim().slice(0, 40) : "";
+    return who ? `${chalk.dim(`${who} · `)}${plan}` : plan;
+}
+function isWideCodePoint(cp) {
+    return (cp >= 0x1100 &&
+        (cp <= 0x115f ||
+            cp === 0x2329 ||
+            cp === 0x232a ||
+            (cp >= 0x2e80 && cp <= 0xa4cf && cp !== 0x303f) ||
+            (cp >= 0xac00 && cp <= 0xd7a3) ||
+            (cp >= 0xf900 && cp <= 0xfaff) ||
+            (cp >= 0xfe10 && cp <= 0xfe19) ||
+            (cp >= 0xfe30 && cp <= 0xfe6b) ||
+            (cp >= 0xff00 && cp <= 0xff60) ||
+            (cp >= 0xffe0 && cp <= 0xffe6) ||
+            (cp >= 0x1f300 && cp <= 0x1f64f) ||
+            (cp >= 0x1f900 && cp <= 0x1f9ff) ||
+            (cp >= 0x20000 && cp <= 0x3fffd)));
+}
+function isZeroWidthCodePoint(cp) {
+    return ((cp >= 0x0300 && cp <= 0x036f) ||
+        (cp >= 0x1ab0 && cp <= 0x1aff) ||
+        (cp >= 0x20d0 && cp <= 0x20ff) ||
+        (cp >= 0xfe00 && cp <= 0xfe0f) ||
+        (cp >= 0x200b && cp <= 0x200f) ||
+        cp === 0xfeff);
+}
+function codePointWidth(cp) {
+    if (isZeroWidthCodePoint(cp))
+        return 0;
+    return isWideCodePoint(cp) ? 2 : 1;
+}
+export function displayWidth(s) {
+    let width = 0;
+    for (const ch of s) {
+        width += codePointWidth(ch.codePointAt(0) ?? 0);
+    }
+    return width;
+}
 export function pad(s, len) {
-    return s + " ".repeat(Math.max(0, len - s.length));
+    return s + " ".repeat(Math.max(0, len - displayWidth(s)));
 }
 export function truncate(s, max) {
-    return s.length <= max ? s : s.slice(0, max - 1) + "…";
+    if (displayWidth(s) <= max)
+        return s;
+    let out = "";
+    let width = 0;
+    for (const ch of s) {
+        const w = codePointWidth(ch.codePointAt(0) ?? 0);
+        if (width + w > max - 1)
+            break;
+        out += ch;
+        width += w;
+    }
+    return out + "…";
 }
 export function groupPackages(packages, keyBy = "name") {
     const map = new Map();

package/dist/scan-ui/hooks/useResizeRepaint.js

@@ -0,0 +1,25 @@
+import { useEffect, useState } from "react";
+import { useStdout } from "ink";
+import { CLEAR_HOME } from "../alt-screen.js";
+// Ink skips repainting when output matches its memoized last frame, so a bare
+// screen clear on resize leaves the TUI blank until the next state change.
+// useStdout().write is the only public path that erases and repaints the
+// memoized frame unconditionally; CLEAR_HOME first wipes resize artifacts.
+export function useResizeRepaint() {
+    const { stdout, write } = useStdout();
+    const [resizes, setResizes] = useState(0);
+    useEffect(() => {
+        const handle = () => setResizes((count) => count + 1);
+        stdout.setMaxListeners(stdout.getMaxListeners() + 1);
+        stdout.on("resize", handle);
+        return () => {
+            stdout.off("resize", handle);
+            stdout.setMaxListeners(Math.max(0, stdout.getMaxListeners() - 1));
+        };
+    }, [stdout]);
+    useEffect(() => {
+        if (resizes === 0)
+            return;
+        write(CLEAR_HOME);
+    }, [resizes, write]);
+}

package/dist/scan-ui/hooks/useScan.js

@@ -53,9 +53,10 @@ export function useScan(config) {
         }
         started.current = true;
         void (async () => {
-            const projects = await discoverScanProjectsAsync(process.cwd(), (progress) => {
+            const discovered = await discoverScanProjectsAsync(process.cwd(), (progress) => {
                 dispatch({ type: "DISCOVERY_PROGRESS", path: progress.path, found: progress.found });
             });
+            const projects = discovered.filter((project) => project.ecosystem === "npm" || project.ecosystem === "pypi");
             if (projects.length === 0) {
                 dispatch({ type: "DISCOVERY_EMPTY", message: "No dependency lockfiles found." });
                 return;
@@ -159,7 +160,23 @@ async function scanProjects(projects, dispatch, signal) {
         const firstFailure = outcomes.find((outcome) => "error" in outcome);
         if (responses.length > 0) {
             const merged = mergeAnalyzeResponses(responses);
-            const result = firstFailure && merged.action === "pass" ? { ...merged, action: "analysis_incomplete" } : merged;
+            // A failed ecosystem means its verdict is unknown; escalate anything short of
+            // a confirmed block to analysis_incomplete so a warn from the succeeded
+            // ecosystem does not present as the whole verdict while the other is unscanned.
+            const base = firstFailure && merged.action !== "block" ? { ...merged, action: "analysis_incomplete" } : merged;
+            const ecoByKey = new Map();
+            for (const [ecosystem, packages] of entries) {
+                for (const pkg of packages) {
+                    ecoByKey.set(packageKey(pkg.name, pkg.version), ecosystem);
+                }
+            }
+            const result = {
+                ...base,
+                packages: base.packages.map((pkg) => {
+                    const ecosystem = ecoByKey.get(packageKey(pkg.name, pkg.version));
+                    return ecosystem ? { ...pkg, ecosystem } : pkg;
+                })
+            };
             const decisions = computeProjectDecisions(result, entries);
             dispatch({
                 type: "SCAN_COMPLETE",

package/dist/scan-ui/launch.js

@@ -12,11 +12,15 @@ export function shouldLaunchScanTui(options) {
     if (process.env.TERM === "dumb") {
         return false;
     }
+    if (!process.stdin.isTTY) {
+        return false;
+    }
     return resolvePresentation().mode === "rich";
 }
 export async function launchScanTui(initialView = "results") {
     const ci = process.env.CI;
-    if (ci === "" || ci === "0" || ci === "false") {
+    const ciCleared = ci === "" || ci === "0" || ci === "false";
+    if (ciCleared) {
         delete process.env.CI;
     }
     const [{ render }, react, app] = await Promise.all([
@@ -32,13 +36,12 @@ export async function launchScanTui(initialView = "results") {
         : undefined;
     enterTui();
     const instance = render(react.default.createElement(app.App, { config, initialView, updateAvailable }), { exitOnCtrlC: true });
-    const clearStaleFrameOnResize = () => instance.clear();
-    process.stdout.on("resize", clearStaleFrameOnResize);
     try {
         await instance.waitUntilExit();
     }
     finally {
-        process.stdout.off("resize", clearStaleFrameOnResize);
+        if (ciCleared)
+            process.env.CI = ci;
         leaveTui();
     }
 }

package/dist/scan-ui/shims.js

@@ -1,4 +1,5 @@
 import { authStatus } from "../auth/store.js";
+import { formatAccountStatus } from "./format-helpers.js";
 export function isLoggedIn() {
     try {
         return authStatus().authenticated;
@@ -7,14 +8,20 @@ export function isLoggedIn() {
         return false;
     }
 }
-export function getStoredApiKey() {
+export function accountHeaderLine(usageTier, env = process.env) {
+    let loggedIn = false;
+    let name;
+    let storedTier;
     try {
-        const status = authStatus();
-        return status.authenticated ? status.tokenPreview : null;
+        const status = authStatus(env);
+        loggedIn = status.authenticated;
+        name = status.name ?? status.email;
+        storedTier = status.tier;
     }
     catch {
-        return null;
+        loggedIn = false;
     }
+    return formatAccountStatus(usageTier ?? storedTier ?? "", loggedIn, name);
 }
 export function effectiveScanAction(raw, effective, mode) {
     return mode === "strict" || effective === undefined ? raw : effective;

package/dist/scripts/detect.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join, relative, resolve } from "node:path";
 const LIFECYCLE_HOOKS = ["preinstall", "install", "postinstall"];
 export function computeScriptsHash(scripts, hasGyp) {
     const canonical = JSON.stringify({
@@ -74,7 +74,12 @@ function wantersFromHiddenLockfile(projectDir, nodeModules) {
         if (!isPlainObject(entry) || entry.hasInstallScript !== true || !packagePath.startsWith("node_modules/")) {
             continue;
         }
-        const wanter = wanterFromManifestDir(join(projectDir, packagePath));
+        const manifestDir = resolve(projectDir, packagePath);
+        const containment = relative(resolve(nodeModules), manifestDir);
+        if (containment === "" || containment.startsWith("..") || isAbsolute(containment)) {
+            continue;
+        }
+        const wanter = wanterFromManifestDir(manifestDir);
         if (wanter) {
             wanters.push(wanter);
         }

package/dist/scripts/gate.js

@@ -123,7 +123,7 @@ export function scriptGateReportLine(options) {
     }
     const names = wanters.map((wanter) => (wanter.version ? `${wanter.name}@${wanter.version}` : wanter.name));
     const noun = wanters.length === 1 ? "package ran" : "packages ran";
-    return `\n  ${theme.paint("muted", `dg scripts: ${wanters.length} ${noun} install scripts (${formatNames(names)}) — per-package approvals are coming; see 'dg explain script-gate'`)}\n`;
+    return `\n  ${theme.paint("muted", `dg scripts: ${wanters.length} ${noun} install scripts (${formatNames(names)}) — observed, not blocked · silence: dg config set scriptGate.mode off`)}\n`;
 }
 function formatNames(names) {
     if (names.length <= REPORTED_NAME_LIMIT) {

package/dist/security/sanitize.js

@@ -1,10 +1,15 @@
 import { stripVTControlCharacters } from "node:util";
+const CTRL_KEEP_NEWLINE = /[\x00-\x08\x0B-\x1F\x7F-\x9F]/g;
+const CTRL_ALL = /[\x00-\x1F\x7F-\x9F]/g;
 export function sanitize(s) {
-    return stripVTControlCharacters(s);
+    return stripVTControlCharacters(s).replace(CTRL_KEEP_NEWLINE, "");
+}
+export function sanitizeLine(s) {
+    return stripVTControlCharacters(s).replace(/[\r\n]+/g, " ").replace(CTRL_ALL, "");
 }
 export function sanitizeDeep(value) {
     if (typeof value === "string") {
-        return stripVTControlCharacters(value);
+        return sanitize(value);
     }
     if (value === null || value === undefined) {
         return value;
@@ -16,8 +21,7 @@ export function sanitizeDeep(value) {
         const src = value;
         const out = {};
         for (const k of Object.keys(src)) {
-            const cleanKey = stripVTControlCharacters(k);
-            out[cleanKey] = sanitizeDeep(src[k]);
+            out[sanitizeLine(k)] = sanitizeDeep(src[k]);
         }
         return out;
     }

package/dist/service/state.js

@@ -1,10 +1,11 @@
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, relative } from "node:path";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { loadUserConfig } from "../config/settings.js";
 import { applyTrustInstall, applyTrustUninstall, readCertificateFingerprints, readServiceTrustRecord, renderTrustStorePlanLines, resolveTrustInstallPlan, TrustStoreError, TrustToolMissingError, writeServiceTrustRecord } from "./trust-store.js";
+import { clearTrustRefreshError, readTrustRefreshError } from "./trust-refresh.js";
 import { acquireLockSync, cleanupSessionSync, createSessionSync, preserveCorruptCleanupRegistrySync, resolveDgPaths, CLEANUP_REGISTRY_LOCK } from "../state/index.js";
 export const SERVICE_SENTINEL = "dg-service-mode-v1";
 export const TRUST_SENTINEL = "dg-service-trust-v1";
@@ -292,6 +293,7 @@ export function installServiceTrust(env, now = new Date()) {
         const plan = trustStoreOperation(() => resolveTrustInstallPlan(runtime.caPath, env ?? process.env));
         const existing = readServiceTrustRecord(paths.trustRecordPath, TRUST_SENTINEL);
         if (existing && existing.fingerprintSha256 === plan.fingerprintSha256 && existing.provider === plan.provider && existing.target === plan.target) {
+            clearTrustRefreshError(paths.serviceDir);
             const state = {
                 ...current,
                 trustInstalled: true,
@@ -311,6 +313,7 @@ export function installServiceTrust(env, now = new Date()) {
             trustStoreOperation(() => applyTrustUninstall(existing));
         }
         const record = trustStoreOperation(() => applyTrustInstall(plan, now, TRUST_SENTINEL));
+        clearTrustRefreshError(paths.serviceDir);
         const state = {
             ...current,
             trustInstalled: true,
@@ -339,6 +342,7 @@ export function uninstallServiceTrust(env, now = new Date()) {
         if (record) {
             trustStoreOperation(() => applyTrustUninstall(record));
         }
+        clearTrustRefreshError(paths.serviceDir);
         const removedTrust = removeFile(paths.trustRecordPath);
         if (!current.configured && !removedTrust) {
             return {
@@ -462,7 +466,7 @@ function trustStoreOperation(operation) {
         throw error;
     }
 }
-function withServiceLock(paths, run) {
+export function withServiceLock(paths, run) {
     const lock = acquireLockSync(paths.paths, SERVICE_LOCK, {
         staleMs: SERVICE_LOCK_STALE_MS
     });
@@ -518,31 +522,42 @@ function readState(paths) {
 function applyRuntimeDiagnostics(paths, state) {
     const runtime = readRuntime(paths) ?? state.proxy;
     if (!runtime) {
-        return state;
+        return withTrustRefreshError(paths, state);
     }
     const drift = detectTrustDrift(state.trust, runtime);
     if (!state.running) {
-        return {
+        return withTrustRefreshError(paths, {
             ...state,
             proxy: runtime,
             trustDrift: drift,
             lastError: "stale service runtime state: runtime file exists while service is stopped"
-        };
+        });
     }
     const health = runtimeHealth(runtime);
     if (!health.healthy) {
-        return {
+        return withTrustRefreshError(paths, {
             ...state,
             running: false,
             proxy: runtime,
             trustDrift: drift,
             lastError: `stale service runtime state: ${health.reason}`
-        };
+        });
     }
-    return {
+    return withTrustRefreshError(paths, {
         ...state,
         proxy: runtime,
         trustDrift: drift
+    });
+}
+function withTrustRefreshError(paths, state) {
+    const refreshError = readTrustRefreshError(paths.serviceDir);
+    if (!refreshError) {
+        return state;
+    }
+    return {
+        ...state,
+        lastError: state.lastError
+            ?? `service CA trust refresh failed at ${refreshError.at}: ${refreshError.message}. Run 'dg service trust install --yes' to repair OS trust for the rotated CA.`
     };
 }
 function runtimeHealth(runtime) {
@@ -711,7 +726,7 @@ function cleanupRuntime(paths, runtime) {
     if (runtime?.pid && processIsAlive(runtime.pid)) {
         killProcess(runtime.pid);
     }
-    if (runtime?.sessionDir && runtime.sessionDir.startsWith(paths.paths.sessionsDir)) {
+    if (runtime?.sessionDir && isContainedIn(paths.paths.sessionsDir, runtime.sessionDir)) {
         rmSync(runtime.sessionDir, {
             force: true,
             recursive: true
@@ -719,6 +734,10 @@ function cleanupRuntime(paths, runtime) {
     }
     removeFile(paths.runtimePath);
 }
+function isContainedIn(parent, child) {
+    const related = relative(parent, child);
+    return related.length > 0 && !related.startsWith("..") && !isAbsolute(related);
+}
 function processIsAlive(pid) {
     if (pid <= 0) {
         return false;

package/dist/service/trust-refresh.js

@@ -0,0 +1,92 @@
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { applyTrustInstall, applyTrustUninstall, readServiceTrustRecord, resolveTrustInstallPlan, writeServiceTrustRecord } from "./trust-store.js";
+export const TRUST_REFRESH_ERROR_FILENAME = "trust-refresh-error.json";
+export function trustRefreshErrorPath(serviceDir) {
+    return join(serviceDir, TRUST_REFRESH_ERROR_FILENAME);
+}
+export function readTrustRefreshError(serviceDir) {
+    try {
+        const path = trustRefreshErrorPath(serviceDir);
+        if (!existsSync(path)) {
+            return undefined;
+        }
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof parsed.at !== "string" || typeof parsed.message !== "string") {
+            return undefined;
+        }
+        return {
+            at: parsed.at,
+            message: parsed.message
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function clearTrustRefreshError(serviceDir) {
+    rmSync(trustRefreshErrorPath(serviceDir), {
+        force: true
+    });
+}
+export function refreshServiceTrustAfterCaRotation(options) {
+    const record = readServiceTrustRecord(options.trustRecordPath, options.sentinel);
+    if (!record) {
+        return;
+    }
+    try {
+        const plan = resolveTrustInstallPlan(options.caPath, options.env);
+        applyTrustUninstall(record);
+        const next = applyTrustInstall(plan, options.now ?? new Date(), options.sentinel);
+        sweepStaleDgTrustFiles(next.provider, next.target);
+        writeServiceTrustRecord(options.trustRecordPath, next);
+        clearTrustRefreshError(options.serviceDir);
+    }
+    catch (error) {
+        writeTrustRefreshError(options.serviceDir, error, options.now ?? new Date());
+    }
+}
+function sweepStaleDgTrustFiles(provider, targetPath) {
+    if (provider === "darwin-user-keychain") {
+        return;
+    }
+    const dir = dirname(targetPath);
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!/^dependency-guardian-[0-9a-f]{16}\.(pem|crt)$/.test(entry)) {
+            continue;
+        }
+        const path = join(dir, entry);
+        if (path === targetPath) {
+            continue;
+        }
+        rmSync(path, {
+            force: true
+        });
+    }
+}
+function writeTrustRefreshError(serviceDir, error, now) {
+    try {
+        mkdirSync(serviceDir, {
+            recursive: true,
+            mode: 0o700
+        });
+        const record = {
+            at: now.toISOString(),
+            message: error instanceof Error ? error.message : String(error)
+        };
+        writeFileSync(trustRefreshErrorPath(serviceDir), `${JSON.stringify(record, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o600
+        });
+    }
+    catch {
+        return;
+    }
+}

package/dist/service/trust-store.js

@@ -1,8 +1,9 @@
 import { X509Certificate } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { writeJsonAtomic } from "../util/json-file.js";
 export class TrustStoreError extends Error {
     constructor(message) {
         super(message);
@@ -191,14 +192,9 @@ export function readCertificateFingerprints(path) {
     return readCertificateInfo(path);
 }
 export function writeServiceTrustRecord(path, record) {
-    mkdirSync(dirname(path), {
-        recursive: true,
-        mode: 0o700
-    });
-    writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600
-    });
+    // Atomic write so a torn write can't drop the trustInstalled state while the OS
+    // still trusts the CA.
+    writeJsonAtomic(path, record, { fileMode: 0o600, dirMode: 0o700 });
 }
 function readCertificateInfo(path) {
     try {

package/dist/service/worker.js

@@ -1,6 +1,8 @@
 import { createServer } from "node:http";
 import { readFileSync, rmSync, writeFileSync } from "node:fs";
 import { startProductionHttpProxy } from "../proxy/server.js";
+import { resolveServicePaths, TRUST_SENTINEL, withServiceLock } from "./state.js";
+import { refreshServiceTrustAfterCaRotation } from "./trust-refresh.js";
 const sessionPath = process.argv[2];
 const apiBaseUrl = process.argv[3];
 const runtimePath = process.argv[4];
@@ -37,11 +39,31 @@ process.on("SIGTERM", () => {
 process.on("SIGINT", () => {
     close().finally(() => process.exit(0));
 });
+function exitOnFatal(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+        process.stderr.write(`dg service worker: unexpected error — ${message}\n`);
+    }
+    catch {
+        // stderr is gone; nothing left to report to.
+    }
+    close().finally(() => process.exit(1));
+}
+process.on("uncaughtException", exitOnFatal);
+process.on("unhandledRejection", exitOnFatal);
+const servicePaths = resolveServicePaths(process.env);
 proxy = await startProductionHttpProxy({
     session,
     apiBaseUrl: requiredApiBaseUrl,
     classification,
-    env: process.env
+    env: process.env,
+    onCaRotate: () => withServiceLock(servicePaths, () => refreshServiceTrustAfterCaRotation({
+        serviceDir: servicePaths.serviceDir,
+        trustRecordPath: servicePaths.trustRecordPath,
+        sentinel: TRUST_SENTINEL,
+        caPath: session.files.ca,
+        env: process.env
+    }))
 });
 healthServer = await startHealthServer(proxy.port);
 const healthAddress = healthServer.address();

package/dist/setup/activate-shell.js

@@ -0,0 +1,28 @@
+import { spawnSync } from "node:child_process";
+import { basename } from "node:path";
+import { isCiEnv } from "../presentation/mode.js";
+export function activationOffer(options = {}) {
+    const env = options.env ?? process.env;
+    if (env.DG_ACTIVATED_SHELL) {
+        return "none";
+    }
+    const stdin = options.stdin ?? process.stdin;
+    const stdout = options.stdout ?? process.stdout;
+    if (!stdin.isTTY || !stdout.isTTY || isCiEnv(env)) {
+        return "hint";
+    }
+    return "prompt";
+}
+// dg cannot mutate the parent shell's environment, so activation nests a protected interactive child shell.
+export function activateShell(options = {}) {
+    const env = options.env ?? process.env;
+    const spawner = options.spawner ?? defaultShellSpawner;
+    const binary = env.SHELL || "/bin/sh";
+    const name = basename(binary);
+    return spawner({
+        binary,
+        args: name === "bash" || name === "zsh" ? ["-i"] : [],
+        env: { ...env, DG_ACTIVATED_SHELL: "1" }
+    });
+}
+const defaultShellSpawner = (request) => spawnSync(request.binary, request.args, { stdio: "inherit", env: request.env }).status ?? 0;