@westbayberry/dg 2.1.0 → 2.3.0

package/dist/setup/git-hook.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { isAbsolute, join, resolve, sep } from "node:path";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { randomBytes } from "node:crypto";
 import { acquireLockSync, CLEANUP_REGISTRY_LOCK, resolveDgPaths } from "../state/index.js";
+import { resolveToolPath } from "../util/external-tool.js";
 import { gitTrimmed } from "../util/git.js";
 import { GUARD_HOOK_SENTINEL, SETUP_UNINSTALL_LOCK, SETUP_UNINSTALL_LOCK_STALE_MS, chainedHookOriginal, guardHookScript, mergeRegistry, readRegistry, reverseGitHookEntry, writeRegistry } from "./plan.js";
 export { GUARD_HOOK_SENTINEL } from "./plan.js";
@@ -84,7 +85,40 @@ function registryOriginal(context) {
     const entry = readRegistry(context.paths).registry.entries.find((candidate) => candidate.kind === "git-hook" && candidate.owner === "dg" && candidate.path === context.hookTarget);
     return entry?.original ?? null;
 }
+function isSymlinkPath(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function writeHookAtomic(target, content) {
+    const tmp = join(dirname(target), `.pre-commit.dg-${randomBytes(6).toString("hex")}.tmp`);
+    writeFileSync(tmp, content, { encoding: "utf8", mode: 0o755, flag: "wx" });
+    try {
+        renameSync(tmp, target);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
 export function applyGitHook(context, now = new Date()) {
+    if (gitHookState(context) !== "foreign" && isSymlinkPath(context.hookTarget)) {
+        return {
+            hookTarget: context.hookTarget,
+            chainedOriginal: null,
+            checks: [
+                {
+                    name: "hook-writable",
+                    ok: false,
+                    detail: `${context.hookTarget} is a symlink; dg refuses to replace it — remove the link or point it at a real file, then re-run dg guard-commit`
+                }
+            ],
+            active: false
+        };
+    }
     const lock = acquireLockSync(context.paths, SETUP_UNINSTALL_LOCK, { staleMs: SETUP_UNINSTALL_LOCK_STALE_MS });
     let chainedOriginal = null;
     try {
@@ -98,7 +132,7 @@ export function applyGitHook(context, now = new Date()) {
         else if (state === "managed") {
             chainedOriginal = chainedHookOriginal(hookText(context.hookTarget)) ?? registryOriginal(context);
         }
-        writeFileSync(context.hookTarget, guardHookScript(context.dgPath, chainedOriginal), { encoding: "utf8", mode: 0o755 });
+        writeHookAtomic(context.hookTarget, guardHookScript(context.dgPath, chainedOriginal));
         chmodSync(context.hookTarget, 0o755);
         const entry = {
             kind: "git-hook",
@@ -176,7 +210,11 @@ function runSelfTest(context) {
     if (!existsSync(context.hookTarget) || !isManaged(context.hookTarget)) {
         return { ok: false, detail: "no dg hook to exercise" };
     }
-    const result = spawnSync("sh", [context.hookTarget], {
+    const sh = resolveToolPath("sh", context.env);
+    if (!sh) {
+        return { ok: false, detail: "sh not found on PATH; hook not exercised" };
+    }
+    const result = spawnSync(sh, [context.hookTarget], {
         cwd: context.root,
         env: { ...context.env, [GUARD_SELFTEST_ENV]: "1" },
         encoding: "utf8",
@@ -219,6 +257,13 @@ export function gitHookStatusState(options = {}) {
     const installedHere = registry.entries.some((entry) => entry.kind === "git-hook" && entry.owner === "dg" && isUnderRoot(entry.path, context.root));
     return installedHere ? "dead" : "off";
 }
+export function commitGuardOffer(options = {}) {
+    const resolved = resolveGitRepo(options);
+    if ("error" in resolved) {
+        return null;
+    }
+    return gitHookStatusState(options) === "off" ? resolved : null;
+}
 export function removeGitHookForRepo(context) {
     const lock = acquireLockSync(context.paths, SETUP_UNINSTALL_LOCK, { staleMs: SETUP_UNINSTALL_LOCK_STALE_MS });
     const removed = [];

package/dist/setup/plan.js

@@ -1,19 +1,24 @@
-import { accessSync, constants, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, constants, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve, sep } from "node:path";
 import { chmodSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { randomBytes } from "node:crypto";
+import { homedir } from "node:os";
 import { createTheme } from "../presentation/theme.js";
+import { AGENTS, AGENT_IDS, agentLabel, resolveAgentHookContext, reverseAgentHookEntry } from "../agents/registry.js";
+import { GATE_ENABLE_HINT, readNetworkGatePosture } from "../agents/gate-posture.js";
 import { acquireLockSync, findStaleSessionsSync, preserveCorruptCleanupRegistrySync, resolveDgPaths, sweepStaleSessionsSync, CLEANUP_REGISTRY_LOCK } from "../state/index.js";
 import { currentNodeVersion, isSupportedNode } from "../runtime/node-version.js";
 import { dgVersion } from "../commands/version.js";
 import { compareVersions, readLatestVersion } from "../commands/update.js";
 import { AuthError, authStatus, displayTier, readAuthState } from "../auth/store.js";
-import { ConfigError, loadUserConfig } from "../config/settings.js";
+import { ConfigError, DEFAULT_CONFIG, loadUserConfig } from "../config/settings.js";
 import { describeCooldownSettings } from "../policy/cooldown.js";
 import { resolveRealBinary } from "../launcher/resolve-real-binary.js";
 import { packageManagerNames } from "../launcher/classify.js";
 import { readServiceState } from "../service/state.js";
 import { OPTIONAL_SUPPORT_GATES } from "./optional-support.js";
-export const SHIM_COMMANDS = Object.freeze(["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pipx", "uv", "uvx", "cargo"]);
+export const SHIM_COMMANDS = Object.freeze(["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pip3", "pipx", "uv", "uvx", "cargo"]);
 export const SHIM_SENTINEL = "dg-shim-v1";
 export const RC_SENTINEL = "dg-shell-rc-v1";
 export const RC_FUNCTIONS_SENTINEL = "dg-shim-functions-v1";
@@ -28,9 +33,18 @@ const LEGACY_RC_CANDIDATES = [".zshrc", ".bashrc", ".bash_profile", ".profile",
 const LEGACY_PYTHON_HOOK_PY = "dg_pip_hook.py";
 const LEGACY_PYTHON_HOOK_PTH = "dg_pip_hook.pth";
 const LEGACY_PYTHON_HOOK_MARKER = "Dependency Guardian pip-install interceptor";
+const LEGACY_PYTHON_HOOK_PTH_MARKER = "import dg_pip_hook";
 export const SETUP_UNINSTALL_LOCK = "setup-uninstall";
 export const SETUP_UNINSTALL_LOCK_STALE_MS = 30 * 60 * 1000;
 export const STALE_SESSION_OLDER_THAN_MS = 24 * 60 * 60 * 1000;
+function readShimFailClosed(env) {
+    try {
+        return loadUserConfig(env).policy.shimFailClosed;
+    }
+    catch {
+        return false;
+    }
+}
 const DOCTOR_GROUP_BY_NAME = {
     node: "environment",
     package: "environment",
@@ -44,7 +58,6 @@ const DOCTOR_GROUP_BY_NAME = {
     config: "setup",
     policy: "setup",
     "script-gate": "setup",
-    telemetry: "setup",
     shims: "setup",
     "shell-rc": "setup",
     "python-hook-drift": "setup",
@@ -53,6 +66,7 @@ const DOCTOR_GROUP_BY_NAME = {
     "commit-guard": "setup",
     "stale-sessions": "setup",
     service: "setup",
+    "agent-gate": "setup",
     auth: "account",
     api: "account"
 };
@@ -64,7 +78,6 @@ const DOCTOR_FIX_BY_NAME = {
     "cleanup-registry-stale-entries": "re-run dg setup to refresh",
     config: "fix or remove ~/.dg, then re-run dg setup",
     policy: "fix ~/.dg config",
-    telemetry: "fix ~/.dg config",
     shims: "dg setup",
     "shell-rc": "dg setup",
     "python-hook-drift": "dg uninstall, or re-run dg setup, to remove the stale pip hook",
@@ -100,6 +113,7 @@ export function buildSetupPlan(options) {
         shell,
         shimDir,
         rcPath,
+        failClosed: readShimFailClosed(env),
         writes: [
             {
                 kind: "directory",
@@ -145,18 +159,19 @@ export function applySetupPlan(plan, now = new Date()) {
     });
     for (const command of SHIM_COMMANDS) {
         const path = join(plan.shimDir, command);
-        writeFileSync(path, shimSource(command), {
+        writeFileSync(path, shimSource(command, { failClosed: plan.failClosed }), {
             encoding: "utf8",
             mode: 0o755
         });
         chmodSync(path, 0o755);
         entries.push(cleanupEntry("shim", path, "mode1", now, SHIM_SENTINEL));
     }
+    installStandaloneUninstaller(plan.paths.homeDir);
     mkdirSync(dirname(plan.rcPath), {
         recursive: true,
         mode: 0o700
     });
-    writeFileSync(plan.rcPath, withRcBlock(readText(plan.rcPath), plan), "utf8");
+    writeRcFileAtomic(plan.rcPath, withRcBlock(readText(plan.rcPath), plan));
     entries.push(cleanupEntry("rc", plan.rcPath, "mode1", now, RC_SENTINEL));
     sweepLegacyPythonHooks(plan.paths.homeDir, [], []);
     const registry = withRegistryLock(plan.paths, () => {
@@ -180,6 +195,45 @@ export function applySetupPlanWithLock(plan, now = new Date()) {
         lock.release();
     }
 }
+// Shims written by a dg that predates the self-cleaning template carry no
+// auto-cleanup, so a plain `npm uninstall -g` leaves them stranded forever.
+// Rewriting the installed shims and reinstalling the standalone uninstaller on
+// the first run after a version bump propagates the current template to setups
+// created by older releases.
+export function refreshSetupOnUpgrade(env = process.env) {
+    const paths = resolveDgPaths(env);
+    const shimDir = join(paths.homeDir, ".dg", "shims");
+    if (!isShimFile(join(shimDir, "npm"))) {
+        return false;
+    }
+    const failClosed = readShimFailClosed(env);
+    try {
+        const lock = acquireLockSync(paths, SETUP_UNINSTALL_LOCK, {
+            staleMs: SETUP_UNINSTALL_LOCK_STALE_MS
+        });
+        try {
+            for (const command of SHIM_COMMANDS) {
+                const shimPath = join(shimDir, command);
+                if (!isShimFile(shimPath)) {
+                    continue;
+                }
+                writeFileSync(shimPath, shimSource(command, { failClosed }), {
+                    encoding: "utf8",
+                    mode: 0o755
+                });
+                chmodSync(shimPath, 0o755);
+            }
+            installStandaloneUninstaller(paths.homeDir);
+        }
+        finally {
+            lock.release();
+        }
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
 export function uninstallSetup(options) {
     const paths = resolveDgPaths(options.env ?? process.env);
     const hadCacheDirBeforeLock = existsSync(paths.cacheDir);
@@ -213,6 +267,9 @@ export function uninstallSetup(options) {
             else if (entry.kind === "git-hook") {
                 reverseGitHookEntry(entry, removed, missing, warnings);
             }
+            else if (entry.kind === "agent-hook") {
+                reverseAgentHookEntry(entry, removed, missing, warnings);
+            }
         }
         sweepLegacyRcBlocks(paths.homeDir, removed, warnings);
         sweepLegacyPythonHooks(paths.homeDir, removed, warnings);
@@ -278,7 +335,6 @@ export function doctorReport(options = {}) {
     checks.push(authCheck(env));
     checks.push(policyCheck(env));
     checks.push(scriptGateCheck(env));
-    checks.push(telemetryCheck(env));
     const missingShims = SHIM_COMMANDS.filter((command) => !validShim(join(shimDir, command), command));
     checks.push({
         name: "shims",
@@ -324,6 +380,7 @@ export function doctorReport(options = {}) {
     });
     checks.push(...unavailableDoctorChecks());
     checks.push(serviceCheck(env));
+    checks.push(agentGateCheck(env, paths.homeDir));
     return {
         version: dgVersion(),
         checks: checks.map(enrichDoctorCheck)
@@ -568,6 +625,9 @@ function shellRcPath(homeDir, shell) {
     }
     return join(homeDir, ".zshrc");
 }
+export function tildifyPath(path, home = homedir()) {
+    return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
+}
 export function activationCommand(shell, rcDisplay) {
     if (shell === "fish") {
         return `source ${rcDisplay}`;
@@ -589,10 +649,10 @@ function reloadInstructions(shell) {
 // The baked absolute dg path stops a PATH-shadowing dg from hijacking the shim;
 // the fallbacks make it fail open — a removed or moved dg (uninstall, mid-upgrade)
 // runs the real manager instead of bricking it.
-export function shimSource(command) {
+export function shimSource(command, options = {}) {
     const dg = escapeDoubleQuotedSh(dgEntrypoint());
     const nonce = '"${DG_SHIM_ACTIVE:+$DG_SHIM_ACTIVE,}' + `${command}:$$"`;
-    return [
+    const head = [
         "#!/bin/sh",
         `# ${SHIM_SENTINEL}`,
         `if [ -x "${dg}" ]; then`,
@@ -603,6 +663,27 @@ export function shimSource(command) {
         `dg_bin=$(PATH="$dg_path" command -v dg 2>/dev/null)`,
         `if [ -n "$dg_bin" ]; then`,
         `  DG_SHIM_ACTIVE=${nonce} exec "$dg_bin" ${command} "$@"`,
+        "fi"
+    ];
+    // dg is gone from this machine. fail-closed (managed/CI) refuses the command
+    // so an unscanned install can't slip through; the operator removes the guard
+    // explicitly via `dg uninstall` while dg is present. fail-open (default)
+    // self-cleans dg's footprint and falls back to the real binary, because a
+    // plain `npm uninstall -g dg` cannot run cleanup and must not brick npm.
+    const failClosedTail = [
+        `echo "dg: install firewall required by policy (policy.shimFailClosed) but dg is unavailable; refusing to run ${command}" >&2`,
+        `echo "dg: reinstall dg, or run 'dg uninstall' while dg is present, to remove this guard" >&2`,
+        "exit 127",
+        ""
+    ];
+    const failOpenTail = [
+        `dg_home=$(dirname "$shim_dir")`,
+        `if [ -f "$dg_home/uninstall.mjs" ] && command -v node >/dev/null 2>&1; then`,
+        `  ( sleep 10`,
+        `    if [ ! -x "${dg}" ] && ! PATH="$dg_path" command -v dg >/dev/null 2>&1; then`,
+        `      node "$dg_home/uninstall.mjs" --quiet >/dev/null 2>&1`,
+        `    fi`,
+        `  ) >/dev/null 2>&1 &`,
         "fi",
         `real_bin=$(PATH="$dg_path" command -v ${command} 2>/dev/null)`,
         `if [ -n "$real_bin" ]; then`,
@@ -611,7 +692,8 @@ export function shimSource(command) {
         `echo "dg: protection unavailable and no real ${command} found on PATH" >&2`,
         "exit 127",
         ""
-    ].join("\n");
+    ];
+    return [...head, ...(options.failClosed ? failClosedTail : failOpenTail)].join("\n");
 }
 function escapeDoubleQuotedSh(value) {
     return value.replace(/[\\"$`]/g, "\\$&");
@@ -623,6 +705,25 @@ function dgEntrypoint() {
     const argv1 = process.argv[1];
     return argv1 ? resolve(argv1) : "dg";
 }
+function standaloneUninstallerSource() {
+    try {
+        return fileURLToPath(new URL("../standalone/uninstall.mjs", import.meta.url));
+    }
+    catch {
+        return undefined;
+    }
+}
+function installStandaloneUninstaller(homeDir) {
+    const source = standaloneUninstallerSource();
+    if (!source || !existsSync(source)) {
+        return;
+    }
+    const dgRoot = join(homeDir, ".dg");
+    mkdirSync(dgRoot, { recursive: true, mode: 0o700 });
+    const dest = join(dgRoot, "uninstall.mjs");
+    copyFileSync(source, dest);
+    chmodSync(dest, 0o600);
+}
 function withRcBlock(existing, plan) {
     const withoutExisting = stripRcBlock(existing);
     const block = plan.shell === "fish" ? fishRcBlock(plan.shimDir) : posixRcBlock(plan.shimDir);
@@ -647,6 +748,26 @@ function fishRcBlock(shimDir) {
 function stripRcBlock(existing) {
     return stripRcBlockDetailed(existing).content;
 }
+function writeRcFileAtomic(rcPath, content) {
+    let target = rcPath;
+    let mode = 0o644;
+    try {
+        target = realpathSync(rcPath);
+        mode = statSync(target).mode & 0o7777;
+    }
+    catch {
+        // no existing file: write a fresh rc at the requested path
+    }
+    const tempPath = join(dirname(target), `.${basename(target)}.dg-${randomBytes(6).toString("hex")}.tmp`);
+    writeFileSync(tempPath, content, { encoding: "utf8", mode, flag: "wx" });
+    try {
+        renameSync(tempPath, target);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
+}
 // An unterminated begin marker must never strip to EOF: only lines verifiably
 // written by dg are removed, so user content below a stale marker survives.
 function stripRcBlockDetailed(existing) {
@@ -696,7 +817,7 @@ function sweepLegacyRcBlocks(homeDir, removed, warnings) {
             continue;
         }
         try {
-            writeFileSync(rcPath, next, "utf8");
+            writeRcFileAtomic(rcPath, next);
             removed.push(`${rcPath} (legacy dg block)`);
         }
         catch (error) {
@@ -704,19 +825,23 @@ function sweepLegacyRcBlocks(homeDir, removed, warnings) {
         }
     }
 }
+function isLegacyPthHook(pthPath) {
+    const content = readText(pthPath);
+    return content.includes(LEGACY_PYTHON_HOOK_PTH_MARKER) || content.includes(LEGACY_PYTHON_HOOK_MARKER);
+}
 export function legacyPythonHookSites(homeDir) {
-    return candidateSitePackagesDirs(homeDir).filter((dir) => existsSync(join(dir, LEGACY_PYTHON_HOOK_PTH)) || readText(join(dir, LEGACY_PYTHON_HOOK_PY)).includes(LEGACY_PYTHON_HOOK_MARKER));
+    return candidateSitePackagesDirs(homeDir).filter((dir) => isLegacyPthHook(join(dir, LEGACY_PYTHON_HOOK_PTH)) || readText(join(dir, LEGACY_PYTHON_HOOK_PY)).includes(LEGACY_PYTHON_HOOK_MARKER));
 }
 export function sweepLegacyPythonHooks(homeDir, removed, warnings) {
     for (const dir of candidateSitePackagesDirs(homeDir)) {
         const pyPath = join(dir, LEGACY_PYTHON_HOOK_PY);
         const pthPath = join(dir, LEGACY_PYTHON_HOOK_PTH);
         const pyIsHook = readText(pyPath).includes(LEGACY_PYTHON_HOOK_MARKER);
-        const pthPresent = existsSync(pthPath);
-        if (!pyIsHook && !pthPresent) {
+        const pthIsHook = isLegacyPthHook(pthPath);
+        if (!pyIsHook && !pthIsHook) {
             continue;
         }
-        if (pthPresent) {
+        if (pthIsHook) {
             removePythonHookFile(pthPath, removed, warnings);
         }
         if (pyIsHook) {
@@ -815,7 +940,19 @@ function configCheck(paths, env) {
     }
     try {
         accessSync(paths.configDir, constants.R_OK);
-        loadUserConfig(env);
+        const config = loadUserConfig(env);
+        if (config.api.baseUrl !== DEFAULT_CONFIG.api.baseUrl) {
+            // The verdict API is the firewall's source of truth. A non-default
+            // endpoint is legitimate for enterprise self-host, but a silent repoint
+            // is also how an attacker would make every verdict come back clean, so
+            // surface it on the standard health check rather than trusting it quietly.
+            return {
+                name: "config",
+                status: "warn",
+                message: `dg is fetching verdicts from a non-default API endpoint: ${config.api.baseUrl} (default ${DEFAULT_CONFIG.api.baseUrl})`,
+                fix: `if you did not set this, your verdict source may be tampered — restore with: dg config set api.baseUrl ${DEFAULT_CONFIG.api.baseUrl}`
+            };
+        }
         return {
             name: "config",
             status: "pass",
@@ -873,7 +1010,7 @@ function dgPathCheck(env) {
     };
 }
 function currentDgBinaryPath(env) {
-    const explicit = env.DG_TEST_CURRENT_DG_PATH;
+    const explicit = env.NODE_ENV === "test" ? env.DG_TEST_CURRENT_DG_PATH : undefined;
     if (explicit) {
         return explicit;
     }
@@ -931,6 +1068,45 @@ function serviceCheck(env) {
         message: `Service mode is running at ${state.proxy.proxyUrl}; trust installed: ${state.trustInstalled ? "yes" : "no"}`
     };
 }
+function hookedAgentLabels(env, home) {
+    const labels = [];
+    for (const agent of AGENT_IDS) {
+        const integration = AGENTS[agent];
+        if (!integration.detect(home)) {
+            continue;
+        }
+        const ctx = resolveAgentHookContext(agent, { env, home });
+        const hooked = integration.verify(ctx).find((check) => check.name === integration.isInstalledCheckName)?.ok ?? false;
+        if (hooked) {
+            labels.push(agentLabel(agent));
+        }
+    }
+    return labels;
+}
+function agentGateCheck(env, home) {
+    const hooked = hookedAgentLabels(env, home);
+    if (hooked.length === 0) {
+        return {
+            name: "agent-gate",
+            status: "unavailable",
+            message: "No AI agent has the dg install hook; run 'dg agents on' to protect agent-run installs"
+        };
+    }
+    const posture = readNetworkGatePosture(env);
+    if (posture.live) {
+        return {
+            name: "agent-gate",
+            status: "pass",
+            message: `${hooked.join(", ")} hooked; network gate live at ${posture.proxyUrl} (installs screened at fetch by artifact hash)`
+        };
+    }
+    return {
+        name: "agent-gate",
+        status: "warn",
+        message: `${hooked.join(", ")} hooked but the fetch-time network gate is OFF — static pre-screen only; absolute-path, manifest-only, dynamic, and unsupported-manager installs are NOT screened`,
+        fix: GATE_ENABLE_HINT
+    };
+}
 function pathPrecedenceCheck(env, shimDir, functionsPresent) {
     const pathEntries = (env.PATH ?? "").split(delimiter).filter(Boolean);
     const shimIndex = pathEntries.indexOf(shimDir);
@@ -1117,9 +1293,8 @@ function scriptGateCheck(env) {
         if (mode === "enforce") {
             return {
                 name: "script-gate",
-                status: "warn",
-                message: "scriptGate.mode is enforce, but this dg release observes only — installs report script-running packages without blocking",
-                fix: "enforcement ships in an upcoming release; dg config set scriptGate.mode observe clears this warning"
+                status: "pass",
+                message: "Install-script gate enforces: protected npm/yarn installs run with --ignore-scripts so packages cannot run lifecycle scripts (pnpm blocks them natively)"
             };
         }
         return {
@@ -1136,34 +1311,24 @@ function scriptGateCheck(env) {
         };
     }
 }
-function telemetryCheck(env) {
-    try {
-        const config = loadUserConfig(env);
-        return {
-            name: "telemetry",
-            status: "pass",
-            message: config.telemetry.enabled ? "Telemetry is enabled with minimized event fields" : "Telemetry is disabled"
-        };
-    }
-    catch (error) {
-        return {
-            name: "telemetry",
-            status: "fail",
-            message: error instanceof ConfigError ? error.message : "Unable to read telemetry config"
-        };
-    }
-}
 export function writeRegistry(paths, registry) {
     mkdirSync(dirname(paths.cleanupRegistryPath), {
         recursive: true,
         mode: 0o700
     });
-    const tempPath = `${paths.cleanupRegistryPath}.${process.pid}.tmp`;
+    const tempPath = `${paths.cleanupRegistryPath}.${randomBytes(6).toString("hex")}.tmp`;
     writeFileSync(tempPath, `${JSON.stringify(registry, null, 2)}\n`, {
         encoding: "utf8",
-        mode: 0o600
+        mode: 0o600,
+        flag: "wx"
     });
-    renameSync(tempPath, paths.cleanupRegistryPath);
+    try {
+        renameSync(tempPath, paths.cleanupRegistryPath);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
 }
 function withRegistryLock(paths, action) {
     const lock = acquireLockSync(paths, CLEANUP_REGISTRY_LOCK, {
@@ -1204,7 +1369,13 @@ function removeRcBlock(entry, removed, missing, warnings) {
         return;
     }
     const stripped = stripRcBlockDetailed(existing);
-    writeFileSync(entry.path, stripped.content, "utf8");
+    try {
+        writeRcFileAtomic(entry.path, stripped.content);
+    }
+    catch (error) {
+        warnings.push(`could not rewrite shell rc ${entry.path}: ${error instanceof Error ? error.message : "write error"}`);
+        return;
+    }
     if (stripped.repairedLines.length > 0) {
         warnings.push(`repaired an unterminated dg block in ${entry.path}: removed only dg-written lines (${stripped.repairedLines.join(", ")})`);
     }
@@ -1214,28 +1385,35 @@ function removeRcBlock(entry, removed, missing, warnings) {
 // a one-line notice and lets the commit (and any chained hook) proceed instead
 // of blocking every commit with exit 127.
 export function guardHookScript(dgPath, chainedOriginal) {
+    const dg = escapeDoubleQuotedSh(dgPath);
     const lines = [
         "#!/bin/sh",
         `# ${GUARD_HOOK_SENTINEL}`,
-        `if command -v "${dgPath}" >/dev/null 2>&1; then`,
-        `  "${dgPath}" scan --staged --hook || exit $?`,
+        `if command -v "${dg}" >/dev/null 2>&1; then`,
+        `  "${dg}" scan --staged --hook || exit $?`,
         "else",
-        `  echo "dg: pre-commit scan skipped (dg not runnable at ${dgPath}); commit allowed" >&2`,
+        `  echo "dg: pre-commit scan skipped (dg not runnable at ${dg}); commit allowed" >&2`,
         "fi"
     ];
     if (chainedOriginal) {
-        lines.push(`[ -x "${chainedOriginal}" ] && exec "${chainedOriginal}" "$@"`);
+        const chained = escapeDoubleQuotedSh(chainedOriginal);
+        lines.push(`[ -x "${chained}" ] && exec "${chained}" "$@"`);
     }
     lines.push("exit 0");
     return `${lines.join("\n")}\n`;
 }
+function unescapeDoubleQuotedSh(value) {
+    return value.replace(/\\([\\"$`])/g, "$1");
+}
 export function chainedHookOriginal(content) {
-    return content.match(/^\[ -x "(.+)" \] && exec "\1" "\$@"$/m)?.[1] ?? null;
+    const matched = content.match(/^\[ -x "(.+)" \] && exec "\1" "\$@"$/m)?.[1];
+    return matched ? unescapeDoubleQuotedSh(matched) : null;
 }
 export function guardHookDgPath(content) {
-    return (content.match(/^if command -v "(.+)" >\/dev\/null 2>&1; then$/m)?.[1] ??
+    const matched = content.match(/^if command -v "(.+)" >\/dev\/null 2>&1; then$/m)?.[1] ??
         content.match(/^"(.+)" scan --staged --hook/m)?.[1] ??
-        null);
+        null;
+    return matched ? unescapeDoubleQuotedSh(matched) : null;
 }
 function commitGuardCheck(registry, env) {
     const hooks = registry.entries.filter((entry) => entry.owner === "dg" && entry.kind === "git-hook");

package/dist/setup/uninstall-standalone.js

@@ -0,0 +1,25 @@
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+import { uninstallSetup } from "./plan.js";
+import { LockBusyError, resolveDgPaths } from "../state/index.js";
+function run() {
+    const quiet = process.argv.includes("--quiet");
+    try {
+        const result = uninstallSetup({ keepConfig: false, all: true });
+        if (!quiet) {
+            process.stderr.write(`Dependency Guardian cleaned up ${result.removed.length} leftover item(s) after the package was removed.\n`);
+        }
+    }
+    catch (error) {
+        if (!quiet && !(error instanceof LockBusyError)) {
+            process.stderr.write(`dg self-cleanup could not finish: ${error.message}\n`);
+        }
+    }
+    try {
+        rmSync(join(resolveDgPaths().homeDir, ".dg"), { recursive: true, force: true });
+    }
+    catch {
+        return;
+    }
+}
+run();

package/dist/setup-ui/gate.js

@@ -0,0 +1,39 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isCiEnv } from "../presentation/mode.js";
+import { resolveDgPaths } from "../state/index.js";
+export function setupApplied(env = process.env) {
+    return existsSync(join(resolveDgPaths(env).homeDir, ".dg", "shims", "npm"));
+}
+export function securityNotesMarkerPath(env = process.env) {
+    return join(resolveDgPaths(env).stateDir, "security-notes-shown");
+}
+export function wizardSkippedMarkerPath(env = process.env) {
+    return join(resolveDgPaths(env).stateDir, "setup-wizard-skipped");
+}
+export function securityNotesShown(env = process.env) {
+    return existsSync(securityNotesMarkerPath(env));
+}
+export function markSecurityNotesShown(env = process.env, now = new Date()) {
+    writeMarker(securityNotesMarkerPath(env), now);
+}
+export function markWizardSkipped(env = process.env, now = new Date()) {
+    writeMarker(wizardSkippedMarkerPath(env), now);
+}
+export function shouldOfferSetupWizard(env = process.env, stdin = process.stdin, stderr = process.stderr) {
+    return (process.platform !== "win32" &&
+        Boolean(stdin.isTTY) &&
+        Boolean(stderr.isTTY) &&
+        !isCiEnv(env) &&
+        !setupApplied(env) &&
+        !existsSync(wizardSkippedMarkerPath(env)));
+}
+function writeMarker(path, now) {
+    try {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        writeFileSync(path, `${now.toISOString()}\n`, { encoding: "utf8", mode: 0o600 });
+    }
+    catch {
+        return;
+    }
+}