@westbayberry/dg 2.1.0 → 2.3.0

package/dist/agents/persistence.js

@@ -0,0 +1,351 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+import { readCleanupRegistry, recordCleanupEntry, removeCleanupEntry, } from "../state/index.js";
+export const LEGACY_AGENT_HOOK_SENTINEL = "dg-agent-hook-v1";
+export function agentHookSentinel(agent) {
+    return `${LEGACY_AGENT_HOOK_SENTINEL}:${agent}`;
+}
+export class AgentHookError extends Error {
+}
+export function dirExists(path) {
+    try {
+        return lstatSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function assertSafeNode(path, role) {
+    let stats;
+    try {
+        stats = lstatSync(path);
+    }
+    catch {
+        return;
+    }
+    if (stats.isSymbolicLink()) {
+        throw new AgentHookError(`${path} is a symlink; refusing to write through it. Edit the link target directly, then retry.`);
+    }
+    if (typeof process.getuid === "function" && stats.uid !== process.getuid()) {
+        throw new AgentHookError(`${path} (${role}) is owned by another user; refusing to write to it.`);
+    }
+    if ((stats.mode & 0o002) !== 0) {
+        throw new AgentHookError(`${path} (${role}) is world-writable; refusing to write to it. Tighten its permissions, then retry.`);
+    }
+}
+export function assertSafeWriteTarget(path) {
+    assertSafeNode(dirname(path), "directory");
+    assertSafeNode(path, "file");
+}
+export function readSettings(path) {
+    if (!existsSync(path)) {
+        return { settings: {}, existed: false };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new AgentHookError(`${path} is not valid JSON; refusing to modify it. Fix or remove it, then retry.`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new AgentHookError(`${path} is not a JSON object; refusing to modify it.`);
+    }
+    return { settings: parsed, existed: true };
+}
+export function writeSettingsAtomic(path, settings) {
+    mkdirSync(dirname(path), { recursive: true });
+    assertSafeWriteTarget(path);
+    const tmp = `${path}.dg-${randomBytes(6).toString("hex")}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    try {
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+async function wasCreatedByDg(ctx) {
+    try {
+        const reg = await readCleanupRegistry(ctx.paths);
+        return reg.entries.some((e) => e.kind === "agent-hook" && e.path === ctx.settingsPath && e.original === "dg-created");
+    }
+    catch {
+        return false;
+    }
+}
+async function recordHookEntry(ctx, legacySentinels, created) {
+    for (const sentinel of legacySentinels) {
+        await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel });
+    }
+    // Preserve the dg-created provenance on re-apply: `created` is false the second
+    // time the hook is installed, but if dg created the file originally, uninstall
+    // must still remove it, so keep the marker.
+    const dgCreated = created || (await wasCreatedByDg(ctx));
+    await recordCleanupEntry(ctx.paths, {
+        kind: "agent-hook",
+        path: ctx.settingsPath,
+        mode: "mode1",
+        sentinel: agentHookSentinel(ctx.agent),
+        ...(dgCreated ? { original: "dg-created" } : {}),
+    });
+}
+async function removeHookEntries(ctx, legacySentinels) {
+    await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel: agentHookSentinel(ctx.agent) });
+    for (const sentinel of legacySentinels) {
+        await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel });
+    }
+}
+function findHookCommand(node, signature) {
+    if (typeof node === "string") {
+        return node.includes(signature) ? node : null;
+    }
+    if (Array.isArray(node)) {
+        for (const value of node) {
+            const found = findHookCommand(value, signature);
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    if (node && typeof node === "object") {
+        for (const value of Object.values(node)) {
+            const found = findHookCommand(value, signature);
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    return null;
+}
+function hookResolvesCheck(settings, agent) {
+    const command = findHookCommand(settings, `hook-exec ${agent}`);
+    if (!command) {
+        return null;
+    }
+    const head = command.split(/\s+hook-exec\s+/)[0] ?? command;
+    const broken = head
+        .split(/\s+/)
+        .filter((token) => token.startsWith("/"))
+        .filter((token) => !existsSync(token));
+    return {
+        name: "hook command resolves",
+        ok: broken.length === 0,
+        detail: broken.length === 0
+            ? "dg path in the hook resolves"
+            : `hook references a missing path (${broken.join(", ")}); re-run 'dg agents on ${agent}'`,
+    };
+}
+export function mergedJsonHook(config) {
+    const legacy = config.legacySentinels ?? [];
+    return {
+        isInstalledCheckName: config.checkName,
+        async apply(ctx) {
+            const { settings, existed } = readSettings(ctx.settingsPath);
+            writeSettingsAtomic(ctx.settingsPath, config.insert(settings, ctx.dgCommand));
+            await recordHookEntry(ctx, legacy, !existed);
+            return { created: !existed };
+        },
+        async remove(ctx) {
+            let removed = false;
+            if (existsSync(ctx.settingsPath)) {
+                let settings = null;
+                try {
+                    settings = readSettings(ctx.settingsPath).settings;
+                }
+                catch {
+                    settings = null;
+                }
+                if (settings) {
+                    const result = config.remove(settings);
+                    if (result.changed) {
+                        removed = true;
+                        if (result.empty && (await wasCreatedByDg(ctx))) {
+                            rmSync(ctx.settingsPath, { force: true });
+                        }
+                        else {
+                            writeSettingsAtomic(ctx.settingsPath, result.settings);
+                        }
+                    }
+                }
+            }
+            await removeHookEntries(ctx, legacy);
+            return { removed };
+        },
+        verify(ctx) {
+            const checks = [];
+            const present = existsSync(ctx.settingsPath);
+            checks.push({ name: "settings file", ok: present, detail: present ? ctx.settingsPath : `${ctx.settingsPath} (absent)` });
+            if (!present) {
+                return checks;
+            }
+            let settings = null;
+            let installed = false;
+            try {
+                settings = readSettings(ctx.settingsPath).settings;
+                installed = config.isInstalled(settings);
+            }
+            catch {
+                installed = false;
+            }
+            checks.push({ name: config.checkName, ok: installed, detail: installed ? "installed" : "not installed" });
+            if (installed && settings) {
+                const resolves = hookResolvesCheck(settings, ctx.agent);
+                if (resolves) {
+                    checks.push(resolves);
+                }
+            }
+            return checks;
+        },
+        reverseEntry(entry, removed, missing, warnings) {
+            if (!existsSync(entry.path)) {
+                missing.push(entry.path);
+                return;
+            }
+            let settings;
+            try {
+                const parsed = JSON.parse(readFileSync(entry.path, "utf8"));
+                if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+                    warnings.push(`${entry.path}: not a JSON object; left untouched`);
+                    return;
+                }
+                settings = parsed;
+            }
+            catch {
+                warnings.push(`${entry.path}: unreadable JSON; left untouched`);
+                return;
+            }
+            const result = config.remove(settings);
+            if (!result.changed) {
+                missing.push(entry.path);
+                return;
+            }
+            if (result.empty && entry.original === "dg-created") {
+                rmSync(entry.path, { force: true });
+            }
+            else {
+                try {
+                    writeSettingsAtomic(entry.path, result.settings);
+                }
+                catch (error) {
+                    warnings.push(`${entry.path}: ${error instanceof Error ? error.message : "could not rewrite settings"}`);
+                    return;
+                }
+            }
+            removed.push(entry.path);
+        },
+    };
+}
+export function ownedJsonHook(config) {
+    const sentinel = agentHookSentinel(config.agent);
+    const ownsFile = (path) => {
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf8"));
+            return parsed?.dgSentinel === sentinel;
+        }
+        catch {
+            return false;
+        }
+    };
+    return {
+        isInstalledCheckName: config.checkName,
+        async apply(ctx) {
+            const existed = existsSync(ctx.settingsPath);
+            if (existed && !ownsFile(ctx.settingsPath)) {
+                throw new AgentHookError(`${ctx.settingsPath} already exists and was not written by dg; refusing to overwrite it. Merge the output of 'dg agents --print ${ctx.agent}' yourself, or remove the file and retry.`);
+            }
+            writeSettingsAtomic(ctx.settingsPath, { dgSentinel: sentinel, ...config.render(ctx.dgCommand) });
+            await recordHookEntry(ctx, [], !existed);
+            return { created: !existed };
+        },
+        async remove(ctx) {
+            let removed = false;
+            if (existsSync(ctx.settingsPath) && ownsFile(ctx.settingsPath)) {
+                rmSync(ctx.settingsPath, { force: true });
+                removed = true;
+            }
+            await removeHookEntries(ctx, []);
+            return { removed };
+        },
+        verify(ctx) {
+            const checks = [];
+            const present = existsSync(ctx.settingsPath);
+            checks.push({ name: "hook file", ok: present, detail: present ? ctx.settingsPath : `${ctx.settingsPath} (absent)` });
+            if (!present) {
+                return checks;
+            }
+            const installed = ownsFile(ctx.settingsPath);
+            checks.push({ name: config.checkName, ok: installed, detail: installed ? "installed" : "present but not dg-owned" });
+            if (installed) {
+                try {
+                    const settings = JSON.parse(readFileSync(ctx.settingsPath, "utf8"));
+                    const resolves = hookResolvesCheck(settings, ctx.agent);
+                    if (resolves) {
+                        checks.push(resolves);
+                    }
+                }
+                catch {
+                    // unreadable file: the installed check already reflects the broken state
+                }
+            }
+            return checks;
+        },
+        reverseEntry(entry, removed, missing, warnings) {
+            if (!existsSync(entry.path)) {
+                missing.push(entry.path);
+                return;
+            }
+            if (!ownsFile(entry.path)) {
+                warnings.push(`${entry.path}: not dg-owned; left untouched`);
+                return;
+            }
+            rmSync(entry.path, { force: true });
+            removed.push(entry.path);
+        },
+    };
+}
+function defaultExecVersion(binary, args) {
+    try {
+        const result = spawnSync(binary, [...args], { encoding: "utf8", timeout: 1500 });
+        if (result.status !== 0 || typeof result.stdout !== "string") {
+            return null;
+        }
+        return result.stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseSemver(text) {
+    const match = /(\d+)\.(\d+)(?:\.(\d+))?/.exec(text);
+    if (!match) {
+        return null;
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3] ?? "0")];
+}
+export function probeMinCliVersion(binary, minVersion, label, deps) {
+    const execVersion = deps?.execVersion ?? defaultExecVersion;
+    const output = execVersion(binary, ["--version"]);
+    if (!output) {
+        return { supported: false, detail: `cannot confirm ${label} >= ${minVersion} (the ${binary} CLI did not report a version)` };
+    }
+    const found = parseSemver(output);
+    const wanted = parseSemver(minVersion);
+    if (!found || !wanted) {
+        return { supported: false, detail: `cannot confirm ${label} >= ${minVersion} (unrecognized version '${output}')` };
+    }
+    for (let index = 0; index < 3; index += 1) {
+        if ((found[index] ?? 0) > (wanted[index] ?? 0)) {
+            break;
+        }
+        if ((found[index] ?? 0) < (wanted[index] ?? 0)) {
+            return { supported: false, detail: `${label} ${found.join(".")} is older than ${minVersion}, which added the hook dg needs` };
+        }
+    }
+    return { supported: true, detail: `${label} ${found.join(".")}` };
+}

package/dist/agents/registry.js

@@ -0,0 +1,128 @@
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolveDgPaths } from "../state/index.js";
+import { claudeCodeIntegration } from "./claude-code.js";
+import { codexIntegration } from "./codex.js";
+import { copilotCliIntegration } from "./copilot-cli.js";
+import { cursorIntegration } from "./cursor.js";
+import { geminiIntegration } from "./gemini.js";
+import { LEGACY_AGENT_HOOK_SENTINEL } from "./persistence.js";
+import { windsurfIntegration } from "./windsurf.js";
+export const AGENTS = {
+    "claude-code": claudeCodeIntegration,
+    codex: codexIntegration,
+    cursor: cursorIntegration,
+    "copilot-cli": copilotCliIntegration,
+    gemini: geminiIntegration,
+    windsurf: windsurfIntegration,
+};
+export const AGENT_IDS = Object.keys(AGENTS);
+export function isAgentId(value) {
+    return value in AGENTS;
+}
+export function getAgent(id) {
+    return AGENTS[id];
+}
+export function agentLabel(id) {
+    return isAgentId(id) ? AGENTS[id].label : id;
+}
+export function agentHookSignature(agent) {
+    return `hook-exec ${agent}`;
+}
+export function defaultDgCommand(agent) {
+    let bin = process.argv[1] ?? "dg";
+    try {
+        bin = realpathSync(bin);
+    }
+    catch {
+        // keep argv[1]; the hook still resolves via PATH as a fallback
+    }
+    // Run the dg script via its own shebang rather than baking process.execPath:
+    // a version-pinned node path (e.g. .../Cellar/node/<ver>/bin/node) vanishes on
+    // a node upgrade and would silently disable the hook.
+    return `${bin} ${agentHookSignature(agent)}`;
+}
+export function resolveAgentHookContext(agent, options = {}) {
+    const env = options.env ?? process.env;
+    const home = options.home ?? env.HOME ?? homedir();
+    return {
+        agent,
+        settingsPath: AGENTS[agent].configPath(home),
+        dgCommand: options.dgCommand ?? defaultDgCommand(agent),
+        paths: resolveDgPaths(env),
+    };
+}
+export function applyAgentHook(ctx) {
+    return AGENTS[ctx.agent].apply(ctx);
+}
+export function removeAgentHookForAgent(ctx) {
+    return AGENTS[ctx.agent].remove(ctx);
+}
+export function verifyAgentHook(ctx) {
+    return AGENTS[ctx.agent].verify(ctx);
+}
+function agentFromSentinel(sentinel) {
+    if (!sentinel || sentinel === LEGACY_AGENT_HOOK_SENTINEL) {
+        return "claude-code";
+    }
+    if (!sentinel.startsWith(`${LEGACY_AGENT_HOOK_SENTINEL}:`)) {
+        return null;
+    }
+    const id = sentinel.slice(LEGACY_AGENT_HOOK_SENTINEL.length + 1);
+    return isAgentId(id) ? id : null;
+}
+export function reverseAgentHookEntry(entry, removed, missing, warnings) {
+    const agent = agentFromSentinel(entry.sentinel);
+    if (!agent) {
+        warnings.push(`${entry.path}: unrecognized agent hook entry (${entry.sentinel ?? "no sentinel"}); left untouched`);
+        return;
+    }
+    AGENTS[agent].reverseEntry(entry, removed, missing, warnings);
+}
+export function collectAgentSkips(options) {
+    const skips = [];
+    const env = options?.env ?? process.env;
+    const home = options?.home ?? env.HOME ?? homedir();
+    for (const agent of AGENT_IDS) {
+        try {
+            const integration = AGENTS[agent];
+            if (!integration.detect(home)) {
+                continue;
+            }
+            const probe = integration.probeHookSupport(home);
+            if (!probe.supported) {
+                skips.push({ agent, label: integration.label, detail: probe.detail });
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return skips;
+}
+export function collectAgentOffers(options) {
+    const offers = [];
+    const env = options?.env ?? process.env;
+    const home = options?.home ?? env.HOME ?? homedir();
+    for (const agent of AGENT_IDS) {
+        try {
+            const integration = AGENTS[agent];
+            if (!integration.detect(home)) {
+                continue;
+            }
+            const probe = integration.probeHookSupport(home);
+            if (!probe.supported) {
+                continue;
+            }
+            const ctx = resolveAgentHookContext(agent, options ?? {});
+            const hooked = integration.verify(ctx).find((check) => check.name === integration.isInstalledCheckName)?.ok ?? false;
+            if (!hooked) {
+                offers.push({ agent, label: integration.label, ctx, probe });
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return offers;
+}

package/dist/agents/routing.js

@@ -0,0 +1,118 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { buildAgentRoutingEnv } from "../launcher/env.js";
+import { readServiceState } from "../service/state.js";
+import { resolveDgPaths } from "../state/index.js";
+import { readSettings, writeSettingsAtomic } from "./persistence.js";
+import { getAgent } from "./registry.js";
+// The agent's install hook screens statically; this routes the agent's ACTUAL
+// fetches through dg's proxy so a wrapped/dynamic install (eval, $VAR, python -m
+// pip, …) the static hook can't decode is still screened at fetch time. Only
+// applied when `dg service` is running, so the proxy endpoint baked into the
+// agent's env is always live — never a dead HTTPS_PROXY that breaks installs.
+const CODEX_BEGIN = "# >>> dg routing >>>";
+const CODEX_END = "# <<< dg routing <<<";
+function backupPath(agent, env) {
+    return join(resolveDgPaths(env).stateDir, `routing-${agent}.json`);
+}
+export function resolveServiceRoutingEnv(env = process.env) {
+    const { state } = readServiceState(env);
+    if (!state.running || !state.proxy) {
+        return { error: "dg service is not running — run 'dg service start' so the proxy gate is live before routing agents through it" };
+    }
+    return { env: buildAgentRoutingEnv(state.proxy.proxyUrl, state.proxy.caPath), proxyUrl: state.proxy.proxyUrl };
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripCodexBlock(content) {
+    const block = new RegExp(`\\n?${escapeRegex(CODEX_BEGIN)}[\\s\\S]*?${escapeRegex(CODEX_END)}\\n?`, "g");
+    return content.replace(block, "\n").replace(/\n{3,}/g, "\n\n");
+}
+function applyClaudeRouting(settingsPath, routing, backup) {
+    const { settings } = readSettings(settingsPath);
+    const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
+    const prior = {};
+    for (const [k, v] of Object.entries(routing)) {
+        prior[k] = k in envObj ? String(envObj[k]) : null;
+        envObj[k] = v;
+    }
+    settings.env = envObj;
+    writeSettingsAtomic(settingsPath, settings);
+    mkdirSync(dirname(backup), { recursive: true, mode: 0o700 });
+    writeFileSync(backup, `${JSON.stringify({ kind: "claude-env", path: settingsPath, prior }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+}
+function removeClaudeRouting(settingsPath, backup) {
+    if (!existsSync(backup)) {
+        return;
+    }
+    let prior = {};
+    try {
+        prior = JSON.parse(readFileSync(backup, "utf8")).prior ?? {};
+    }
+    catch {
+        prior = {};
+    }
+    if (existsSync(settingsPath)) {
+        const { settings } = readSettings(settingsPath);
+        const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
+        for (const [k, v] of Object.entries(prior)) {
+            if (v === null) {
+                delete envObj[k];
+            }
+            else {
+                envObj[k] = v;
+            }
+        }
+        if (Object.keys(envObj).length === 0) {
+            delete settings.env;
+        }
+        else {
+            settings.env = envObj;
+        }
+        writeSettingsAtomic(settingsPath, settings);
+    }
+    rmSync(backup, { force: true });
+}
+function applyCodexRouting(configPath, routing) {
+    const content = existsSync(configPath) ? stripCodexBlock(readFileSync(configPath, "utf8")) : "";
+    if (/^\s*\[shell_environment_policy\]/m.test(content)) {
+        return { applied: false, detail: "~/.codex/config.toml already defines [shell_environment_policy] — add dg's proxy vars (HTTPS_PROXY, NODE_EXTRA_CA_CERTS, …) to its `set` table manually" };
+    }
+    const set = Object.entries(routing).map(([k, v]) => `${k} = ${JSON.stringify(v)}`).join(", ");
+    const block = `${CODEX_BEGIN}\n[shell_environment_policy]\nset = { ${set} }\n${CODEX_END}\n`;
+    const next = content === "" || content.endsWith("\n") ? `${content}${block}` : `${content}\n${block}`;
+    writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    return { applied: true, detail: configPath };
+}
+function removeCodexRouting(configPath) {
+    if (!existsSync(configPath)) {
+        return;
+    }
+    writeFileSync(configPath, stripCodexBlock(readFileSync(configPath, "utf8")), { encoding: "utf8" });
+}
+function codexConfigPath(home) {
+    return join(home, ".codex", "config.toml");
+}
+export function applyAgentRouting(agent, routing, home, env = process.env) {
+    if (agent === "codex") {
+        return applyCodexRouting(codexConfigPath(home), routing);
+    }
+    // Every other supported agent reads a JSON settings file with an `env` block.
+    applyClaudeRouting(getAgent(agent).configPath(home), routing, backupPath(agent, env));
+    return { applied: true, detail: getAgent(agent).configPath(home) };
+}
+export function removeAgentRouting(agent, home, env = process.env) {
+    if (agent === "codex") {
+        removeCodexRouting(codexConfigPath(home));
+        return;
+    }
+    removeClaudeRouting(getAgent(agent).configPath(home), backupPath(agent, env));
+}
+export function routingInstalled(agent, home, env = process.env) {
+    if (agent === "codex") {
+        const p = codexConfigPath(home);
+        return existsSync(p) && readFileSync(p, "utf8").includes(CODEX_BEGIN);
+    }
+    return existsSync(backupPath(agent, env));
+}

package/dist/agents/types.js

@@ -0,0 +1 @@
+export {};

package/dist/agents/windsurf.js

@@ -0,0 +1,93 @@
+import { join } from "node:path";
+import { dirExists, mergedJsonHook } from "./persistence.js";
+const SIGNATURE = "hook-exec windsurf";
+function configPath(home) {
+    return join(home, ".codeium", "windsurf", "hooks.json");
+}
+function isDgEntry(entry) {
+    return (typeof entry === "object" &&
+        entry !== null &&
+        typeof entry.command === "string" &&
+        entry.command.includes(SIGNATURE));
+}
+function insertHook(settings, dgCommand) {
+    const next = { ...settings };
+    const hooks = typeof next.hooks === "object" && next.hooks !== null ? { ...next.hooks } : {};
+    const list = Array.isArray(hooks.pre_run_command) ? hooks.pre_run_command : [];
+    hooks.pre_run_command = [...list.filter((entry) => !isDgEntry(entry)), { command: dgCommand }];
+    next.hooks = hooks;
+    return next;
+}
+function removeHook(settings) {
+    const next = { ...settings };
+    if (typeof next.hooks !== "object" || next.hooks === null) {
+        return { settings: next, changed: false, empty: Object.keys(next).length === 0 };
+    }
+    const hooks = { ...next.hooks };
+    const list = Array.isArray(hooks.pre_run_command) ? hooks.pre_run_command : [];
+    const withoutDg = list.filter((entry) => !isDgEntry(entry));
+    const changed = withoutDg.length !== list.length;
+    if (withoutDg.length > 0) {
+        hooks.pre_run_command = withoutDg;
+    }
+    else {
+        delete hooks.pre_run_command;
+    }
+    if (Object.keys(hooks).length > 0) {
+        next.hooks = hooks;
+    }
+    else {
+        delete next.hooks;
+    }
+    return { settings: next, changed, empty: Object.keys(next).length === 0 };
+}
+function hasDgHook(settings) {
+    const hooks = settings.hooks?.pre_run_command;
+    return Array.isArray(hooks) && hooks.some((entry) => isDgEntry(entry));
+}
+function parseInput(stdin) {
+    try {
+        const obj = JSON.parse(stdin);
+        const command = obj.tool_info?.command_line;
+        if (typeof command !== "string") {
+            return null;
+        }
+        const cwd = obj.tool_info?.cwd;
+        return typeof cwd === "string" ? { command, cwd } : { command };
+    }
+    catch {
+        return null;
+    }
+}
+function emitDecision(verdict) {
+    if (verdict.decision === "allow") {
+        return { stdout: "", exitCode: 0 };
+    }
+    const reason = verdict.reason ?? "Dependency Guardian firewall";
+    const suffix = verdict.decision === "ask" ? " (dg flagged this for human review — not auto-approved)" : "";
+    return { stdout: `${reason}${suffix}\n`, exitCode: 2 };
+}
+function probeHookSupport(home) {
+    if (!dirExists(join(home, ".codeium", "windsurf"))) {
+        return { supported: false, detail: "~/.codeium/windsurf not found (is Windsurf installed?)" };
+    }
+    return { supported: true, detail: "Windsurf config directory found; dg cannot read the app version from disk" };
+}
+export const windsurfIntegration = {
+    id: "windsurf",
+    label: "Windsurf",
+    kind: "merged-json",
+    maturity: "unverified",
+    minVersion: null,
+    configPath,
+    detect: (home) => dirExists(join(home, ".codeium", "windsurf")),
+    probeHookSupport,
+    parseInput,
+    emitDecision,
+    ...mergedJsonHook({
+        checkName: "dg pre_run_command hook",
+        insert: insertHook,
+        remove: removeHook,
+        isInstalled: hasDgHook,
+    }),
+};