@westbayberry/dg 2.1.0 → 2.3.0

package/dist/api/analyze.js

@@ -328,7 +328,7 @@ function normalizeAction(action) {
     if (action === "block" || action === "warn" || action === "analysis_incomplete" || action === "pass") {
         return action;
     }
-    return "pass";
+    return "analysis_incomplete";
 }
 export function mergeAnalyzeResponses(responses) {
     const first = responses[0];

package/dist/audit/detectors.js

@@ -133,17 +133,6 @@ function contentChecks(file, push) {
 }
 function structuralProjectChecks(context, push) {
     if (context.ecosystem === "npm" && context.packageJson) {
-        if (context.packageJson.private === true) {
-            push({
-                id: "publishing-private",
-                category: "structural",
-                severity: 4,
-                title: "Package is marked private but is being audited for publish",
-                recommendation: "A private package being published is almost always a mistake — remove \"private\" or do not publish.",
-                location: "package.json",
-                evidence: "\"private\": true"
-            });
-        }
         if (!context.hasFilesAllowlist) {
             push({
                 id: "no-files-allowlist",

package/dist/audit/events.js

@@ -1,33 +1,17 @@
 import { appendFileSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { authStatus } from "../auth/store.js";
-import { loadUserConfig } from "../config/settings.js";
 import { resolveDgPaths } from "../state/index.js";
 export function auditLogPath(paths) {
     return join(paths.stateDir, "audit.jsonl");
 }
-export function webhookOutboxPath(paths) {
-    return join(paths.stateDir, "webhooks.jsonl");
-}
 export function recordAuditEvent(event, env = process.env) {
-    const paths = resolveDgPaths(env);
-    appendJsonLine(auditLogPath(paths), event);
-}
-export function emitWebhookEvent(event, env = process.env) {
-    const config = loadUserConfig(env);
-    const status = authStatus(env);
-    if (!config.webhooks.enabled || !status.authenticated) {
+    try {
+        appendJsonLine(auditLogPath(resolveDgPaths(env)), event);
+        return true;
+    }
+    catch {
         return false;
     }
-    const paths = resolveDgPaths(env);
-    appendJsonLine(webhookOutboxPath(paths), {
-        ...event,
-        auth: {
-            source: status.source,
-            token: status.tokenPreview
-        }
-    });
-    return true;
 }
 function appendJsonLine(path, value) {
     mkdirSync(dirname(path), {

package/dist/audit/rules.js

@@ -384,7 +384,7 @@ export const CONTENT_RULES = [
     {
         id: "db-connection-string",
         re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:@\s/]+:[^@\s/]+@[^/\s]+/u,
-        allow: /:\/\/[^:@/]+:(password|pass|user|example|changeme|xxx+|\*+)@|@(localhost|127\.0\.0\.1|example\.|host)/iu,
+        allow: /:\/\/[^:@/]+:(password|pass|user|example|changeme|xxx+|\*+)@|@(localhost|127\.0\.0\.1|example\.|host\b)/iu,
         category: "bundled-secret",
         severity: 4,
         title: "Database connection string with password embedded in a published file",
@@ -421,6 +421,10 @@ export const RISKY_SCRIPT_NAMES = [
     "preuninstall",
     "uninstall"
 ];
-export const DANGEROUS_SCRIPT_RE = /\|\s*(?:sh|bash|zsh)\b|\beval\s|node\s+-e\b|python[0-9.]*\s+-c\b|base64\s+-d|(?:curl|wget|fetch)\b[^\n]*\|\s*\w*sh\b/iu;
+// Best-effort heuristic on the LOCAL audit only; a public regex is evadable, so
+// the authoritative verdict is the behavioral scanner. Covers pipe-to-shell, eval,
+// node -e, python -c, base64 -d, curl|sh, AND download-then-execute where the fetch
+// is chained (&& / ;) to a shell or a freshly-downloaded file.
+export const DANGEROUS_SCRIPT_RE = /\|\s*(?:sh|bash|zsh)\b|\beval\s|node\s+-e\b|python[0-9.]*\s+-c\b|base64\s+-d|(?:curl|wget|fetch)\b[^\n]*\|\s*\w*sh\b|(?:curl|wget|fetch)\b[^\n]*(?:&&|;)\s*(?:sh|bash|zsh|source|\.\/)/iu;
 export const INVISIBLE_UNICODE_RE = /[\u200B-\u200F\u2060-\u2064\u202A-\u202E\u2066-\u2069\uFEFF]/u;
 export const BIDI_OVERRIDE_RE = /[\u202A-\u202E\u2066-\u2069]/u;

package/dist/audit-ui/AuditApp.js

@@ -3,8 +3,10 @@ import { useCallback, useEffect, useState } from "react";
 import { Box, useApp } from "ink";
 import { combineAction, auditExitCode, displayTarget } from "../commands/audit.js";
 import { AuditResultsView } from "./components/AuditResultsView.js";
+import { useResizeRepaint } from "../scan-ui/hooks/useResizeRepaint.js";
 export const AuditApp = ({ gathered, initialDeep, deepPromise, onExitCode }) => {
     const { exit } = useApp();
+    useResizeRepaint();
     const [deep, setDeep] = useState(initialDeep);
     useEffect(() => {
         if (!deepPromise)

package/dist/audit-ui/components/AuditResultsView.js

@@ -1,9 +1,7 @@
-import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
-import { useMemo, useRef, useState } from "react";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { Box, Text, useInput } from "ink";
 import chalk from "chalk";
-import { writeFileSync } from "node:fs";
-import { resolve as resolvePath } from "node:path";
 import { findingLocation } from "../../audit/detectors.js";
 import { isLoggedIn } from "../../scan-ui/shims.js";
 import { clearScreen } from "../../scan-ui/alt-screen.js";
@@ -12,7 +10,10 @@ import { pad, truncate } from "../../scan-ui/format-helpers.js";
 import { AuditHeader } from "./AuditHeader.js";
 import { DeepStatusRow } from "./DeepStatusRow.js";
 import { countSummary, severityGlyph, severityRole } from "../format.js";
-import { buildExport, exportFilename } from "../export.js";
+import { buildExport } from "../export.js";
+import { ExportDialog, loginRequiredToast } from "../../export-ui/ExportDialog.js";
+import { resolvePresentation } from "../../presentation/mode.js";
+import { createTheme } from "../../presentation/theme.js";
 const ROLE_PAINT = {
     block: chalk.red,
     warn: chalk.yellow,
@@ -23,6 +24,11 @@ function glyphPaint(severity) {
 }
 const FIXED_CHROME = 12;
 const EXPAND_CHROME = 10;
+const EXPORT_FORMATS = [
+    { format: "json", label: "JSON" },
+    { format: "md", label: "Markdown" },
+    { format: "txt", label: "Plain text" }
+];
 export const AuditResultsView = ({ findings, action, artifact, ecosystem, target, fileCount, publishSetSource, deep, onExit }) => {
     const { rows: termRows, cols: termCols } = useTerminalSize();
     const [cursor, setCursor] = useState(0);
@@ -36,17 +42,22 @@ export const AuditResultsView = ({ findings, action, artifact, ecosystem, target
     const [showHelp, setShowHelp] = useState(false);
     const showHelpRef = useRef(showHelp);
     showHelpRef.current = showHelp;
-    const [exportMenu, setExportMenu] = useState(null);
-    const exportMenuRef = useRef(exportMenu);
-    exportMenuRef.current = exportMenu;
+    const [exportDialog, setExportDialog] = useState(null);
+    const exportDialogRef = useRef(exportDialog);
+    exportDialogRef.current = exportDialog;
+    const theme = useMemo(() => createTheme(resolvePresentation().color), []);
     const [exportMsg, setExportMsg] = useState(null);
     const exportTimer = useRef(null);
-    const showExportMsg = (message) => {
-        setExportMsg(message);
+    const showExportMsg = (text, tone = "ok") => {
+        setExportMsg({ text, tone });
         if (exportTimer.current)
             clearTimeout(exportTimer.current);
         exportTimer.current = setTimeout(() => setExportMsg(null), 4000);
     };
+    useEffect(() => () => {
+        if (exportTimer.current)
+            clearTimeout(exportTimer.current);
+    }, []);
     const filtered = useMemo(() => {
         if (!searchQuery)
             return findings;
@@ -88,70 +99,40 @@ export const AuditResultsView = ({ findings, action, artifact, ecosystem, target
             setViewport(clamped - listRows + 1);
         }
     };
-    const runExport = (format) => {
+    const openExport = () => {
         if (!isLoggedIn()) {
-            showExportMsg("Export requires `dg login` (free account)");
+            showExportMsg(loginRequiredToast(), "nudge");
             return;
         }
-        try {
-            const input = {
-                target,
-                artifact,
-                ecosystem,
-                action,
-                fileCount,
-                publishSetSource,
-                findings,
-                deep: deep ?? { ran: false, reason: "deep behavioral scan did not run" }
-            };
-            const { body, ext } = buildExport(input, format);
-            const filename = exportFilename(ext);
-            writeFileSync(resolvePath(process.cwd(), filename), body, "utf-8");
-            showExportMsg(`✓ Exported to ${filename}`);
-        }
-        catch (error) {
-            showExportMsg(`Export failed: ${error.message}`);
-        }
+        const input = {
+            target,
+            artifact,
+            ecosystem,
+            action,
+            fileCount,
+            publishSetSource,
+            findings,
+            deep: deep ?? { ran: false, reason: "deep behavioral scan did not run" }
+        };
+        setExportDialog(EXPORT_FORMATS.map(({ format, label }) => ({
+            label,
+            defaultName: `dg-audit.${format}`,
+            render: () => buildExport(input, format).body
+        })));
+    };
+    const handleExportDone = (result) => {
+        setExportDialog(null);
+        clearScreen();
+        if (result === null)
+            return;
+        if ("path" in result)
+            showExportMsg(`✓ Exported to ${result.path}`);
+        else
+            showExportMsg(`Export failed: ${result.error}`, "error");
     };
     useInput((input, key) => {
-        if (exportMenuRef.current) {
-            const menu = exportMenuRef.current;
-            const FORMATS = ["json", "md", "txt"];
-            const move = (cur, dir) => {
-                const i = FORMATS.indexOf(cur);
-                return FORMATS[Math.max(0, Math.min(FORMATS.length - 1, i + dir))] ?? cur;
-            };
-            if (key.escape) {
-                setExportMenu(null);
-                return;
-            }
-            if (input === "q") {
-                setExportMenu(null);
-                return;
-            }
-            if (key.return) {
-                const format = menu.format;
-                setExportMenu(null);
-                clearScreen();
-                runExport(format);
-                return;
-            }
-            if (key.tab || key.leftArrow || key.rightArrow) {
-                setExportMenu({ ...menu, activeRow: menu.activeRow === "scope" ? "format" : "scope" });
-                return;
-            }
-            if (key.upArrow || input === "k") {
-                if (menu.activeRow === "format")
-                    setExportMenu({ ...menu, format: move(menu.format, -1) });
-                return;
-            }
-            if (key.downArrow || input === "j") {
-                if (menu.activeRow === "format")
-                    setExportMenu({ ...menu, format: move(menu.format, 1) });
-                return;
-            }
+        if (exportDialogRef.current)
             return;
-        }
         if (showHelpRef.current) {
             if (input === "?" || key.escape)
                 setShowHelp(false);
@@ -219,11 +200,7 @@ export const AuditResultsView = ({ findings, action, artifact, ecosystem, target
                 return;
             }
             if (input === "e") {
-                if (!isLoggedIn()) {
-                    showExportMsg("Export requires `dg login` (free account)");
-                    return;
-                }
-                setExportMenu({ format: "json", activeRow: "scope" });
+                openExport();
                 return;
             }
             return;
@@ -233,11 +210,7 @@ export const AuditResultsView = ({ findings, action, artifact, ecosystem, target
             return;
         }
         if (input === "e") {
-            if (!isLoggedIn()) {
-                showExportMsg("Export requires `dg login` (free account)");
-                return;
-            }
-            setExportMenu({ format: "json", activeRow: "scope" });
+            openExport();
             return;
         }
         if (input === "q") {
@@ -269,19 +242,9 @@ export const AuditResultsView = ({ findings, action, artifact, ecosystem, target
         }
         else if (input === "/")
             setSearchMode(true);
-    });
-    if (exportMenu) {
-        const FORMATS_RENDER = [
-            { value: "json", label: "JSON" },
-            { value: "md", label: "Markdown" },
-            { value: "txt", label: "Plain text" }
-        ];
-        const renderColumn = (title, isActive, rows) => (_jsxs(Box, { flexDirection: "column", marginRight: 4, children: [_jsxs(Text, { children: [isActive ? chalk.cyan("▌ ") : "  ", isActive ? chalk.bold(title) : chalk.dim(title)] }), rows] }));
-        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(AuditHeader, { action: action, artifact: artifact, ecosystem: ecosystem, countSummary: countSummary(findings), fileCount: fileCount, fallback: publishSetSource === "fallback" }), _jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, children: [_jsx(Text, { bold: true, children: "Export" }), _jsx(Text, { children: "" }), _jsxs(Box, { flexDirection: "row", children: [renderColumn("What", exportMenu.activeRow === "scope", (_jsxs(Box, { children: [_jsx(Box, { width: 5, flexShrink: 0, children: _jsxs(Text, { children: ["   ", exportMenu.activeRow === "scope" ? chalk.cyan("●") : chalk.green("●")] }) }), _jsx(Text, { children: chalk.bold("Findings") })] }))), renderColumn("Format", exportMenu.activeRow === "format", (_jsx(_Fragment, { children: FORMATS_RENDER.map((r) => {
-                                        const selected = r.value === exportMenu.format;
-                                        const bullet = selected ? (exportMenu.activeRow === "format" ? chalk.cyan("●") : chalk.green("●")) : chalk.dim("○");
-                                        return (_jsxs(Box, { children: [_jsx(Box, { width: 5, flexShrink: 0, children: _jsxs(Text, { children: ["   ", bullet] }) }), _jsx(Text, { children: selected ? chalk.bold(r.label) : r.label })] }, r.value));
-                                    }) })))] })] }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), _jsxs(Text, { children: [" ", chalk.bold.cyan("↑↓"), " ", chalk.dim("scroll"), "   ", chalk.bold.cyan("←→/Tab"), " ", chalk.dim("switch row"), "   ", chalk.bold.cyan("⏎"), " ", chalk.dim("export"), "   ", chalk.bold.cyan("Esc"), " ", chalk.dim("cancel")] })] }));
+    }, { isActive: exportDialog === null });
+    if (exportDialog) {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(AuditHeader, { action: action, artifact: artifact, ecosystem: ecosystem, countSummary: countSummary(findings), fileCount: fileCount, fallback: publishSetSource === "fallback" }), _jsx(ExportDialog, { options: exportDialog, theme: theme, cwd: process.cwd(), onDone: handleExportDone })] }));
     }
     if (showHelp) {
         return (_jsxs(Box, { flexDirection: "column", children: [_jsx(AuditHeader, { action: action, artifact: artifact, ecosystem: ecosystem, countSummary: countSummary(findings), fileCount: fileCount, fallback: publishSetSource === "fallback" }), _jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, width: "100%", children: [_jsx(Text, { bold: true, children: "Keyboard Shortcuts" }), _jsx(Text, { children: "" }), _jsx(Text, { bold: true, children: " Navigation" }), _jsxs(Text, { children: ["   ", chalk.cyan("↑ k"), "     ", chalk.dim("Move up")] }), _jsxs(Text, { children: ["   ", chalk.cyan("↓ j"), "     ", chalk.dim("Move down")] }), _jsxs(Text, { children: ["   ", chalk.cyan("g"), "       ", chalk.dim("Jump to top")] }), _jsxs(Text, { children: ["   ", chalk.cyan("G"), "       ", chalk.dim("Jump to bottom")] }), _jsxs(Text, { children: ["   ", chalk.cyan("PgUp"), "    ", chalk.dim("Page up")] }), _jsxs(Text, { children: ["   ", chalk.cyan("PgDn"), "    ", chalk.dim("Page down")] }), _jsx(Text, { children: "" }), _jsx(Text, { bold: true, children: " Actions" }), _jsxs(Text, { children: ["   ", chalk.cyan("⏎"), "       ", chalk.dim("Expand / collapse finding (evidence + recommendation)")] }), _jsxs(Text, { children: ["   ", chalk.cyan("/"), "       ", chalk.dim("Search findings")] }), _jsxs(Text, { children: ["   ", chalk.cyan("e"), "       ", chalk.dim("Export menu — Findings as JSON / Markdown / text")] }), _jsxs(Text, { children: ["   ", chalk.cyan("q"), "       ", chalk.dim("Quit")] }), _jsx(Text, { children: "" }), _jsxs(Text, { dimColor: true, children: [" Press ", chalk.bold.cyan("?"), " or ", chalk.bold.cyan("Esc"), " to close"] })] })] }));
@@ -303,5 +266,5 @@ export const AuditResultsView = ({ findings, action, artifact, ecosystem, target
                             return (_jsxs(Text, { backgroundColor: "#1a1a2e", children: [chalk.cyan("▌"), " ", paint(glyph), " ", chalk.bold(loc), chalk.dim(title)] }, `${finding.id}|${finding.location}`));
                         }
                         return (_jsxs(Text, { children: ["  ", paint(glyph), " ", loc, chalk.dim(title)] }, `${finding.id}|${finding.location}`));
-                    }), belowCount > 0 && _jsxs(Text, { dimColor: true, children: [chalk.cyan(" ↓"), " ", belowCount, " more below"] }), expanded && focused && (_jsxs(Box, { flexDirection: "column", marginTop: 1, marginLeft: 4, children: [_jsxs(Text, { bold: true, children: [findingLocation(focused), chalk.dim(" — "), focused.title] }), expandLines.slice(expandScroll, expandScroll + expandViewportRows).map((line, i) => (_jsx(Text, { children: line }, i))), expandLines.length > expandViewportRows && (_jsx(Text, { dimColor: true, children: `  ${expandScroll + 1}-${Math.min(expandScroll + expandViewportRows, expandLines.length)} / ${expandLines.length}  (Esc collapse)` }))] }))] }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), _jsx(DeepStatusRow, { deep: deep }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("█"), "   ", chalk.dim("Esc clear · Enter confirm")] })) : (_jsxs(Text, { children: [" ", filtered.length > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("↑↓"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("⏎"), " ", chalk.dim(expanded ? "collapse" : "expand"), "   ", chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", chalk.bold.cyan("?"), " ", chalk.dim("help"), "   ", chalk.bold.cyan("q"), " ", chalk.dim("quit"), exportMsg && _jsxs(_Fragment, { children: ["   ", chalk.green(exportMsg)] })] }))] }));
+                    }), belowCount > 0 && _jsxs(Text, { dimColor: true, children: [chalk.cyan(" ↓"), " ", belowCount, " more below"] }), expanded && focused && (_jsxs(Box, { flexDirection: "column", marginTop: 1, marginLeft: 4, children: [_jsxs(Text, { bold: true, children: [findingLocation(focused), chalk.dim(" — "), focused.title] }), expandLines.slice(expandScroll, expandScroll + expandViewportRows).map((line, i) => (_jsx(Text, { children: line }, i))), expandLines.length > expandViewportRows && (_jsx(Text, { dimColor: true, children: `  ${expandScroll + 1}-${Math.min(expandScroll + expandViewportRows, expandLines.length)} / ${expandLines.length}  (Esc collapse)` }))] }))] }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), _jsx(DeepStatusRow, { deep: deep }), _jsx(Text, { dimColor: true, children: chalk.dim("─".repeat(Math.max(20, termCols - 4))) }), searchMode ? (_jsxs(Text, { children: [" ", chalk.bold.cyan("/"), " ", searchQuery, chalk.cyan("█"), "   ", chalk.dim("Esc clear · Enter confirm")] })) : (_jsxs(Text, { children: [" ", filtered.length > 0 && (_jsxs(_Fragment, { children: [chalk.bold.cyan("↑↓"), " ", chalk.dim("navigate"), "   ", chalk.bold.cyan("⏎"), " ", chalk.dim(expanded ? "collapse" : "expand"), "   ", chalk.bold.cyan("/"), " ", chalk.dim("search"), "   "] })), chalk.bold.cyan("e"), " ", chalk.dim("export"), "   ", chalk.bold.cyan("?"), " ", chalk.dim("help"), "   ", chalk.bold.cyan("q"), " ", chalk.dim("quit"), exportMsg && _jsxs(_Fragment, { children: ["   ", exportMsg.tone === "nudge" ? exportMsg.text : (exportMsg.tone === "error" ? chalk.red : chalk.green)(exportMsg.text)] })] }))] }));
 };

package/dist/audit-ui/export.js

@@ -78,7 +78,3 @@ export function buildExport(input, format) {
         return { body: buildMd(input), ext: "md" };
     return { body: buildTxt(input), ext: "txt" };
 }
-export function exportFilename(format, now = new Date()) {
-    const ts = now.toISOString().replace(/[:T]/g, "-").replace(/\..*$/, "");
-    return `dg-audit-${ts}-findings.${format}`;
-}

package/dist/audit-ui/format.js

@@ -17,9 +17,6 @@ export function severityRole(severity) {
 export function verdictGlyph(action) {
     return action === "block" ? "✘" : action === "warn" ? WARN_GLYPH : "✓";
 }
-export function verdictRole(action) {
-    return action;
-}
 export function countSummary(findings) {
     const blocking = findings.filter((finding) => finding.severity >= 4).length;
     const warnings = findings.filter((finding) => finding.severity === 3).length;

package/dist/audit-ui/launch.js

@@ -3,11 +3,18 @@ export function shouldLaunchAuditTui(options) {
     if (options.format !== "text" || options.outputPath) {
         return false;
     }
+    if (process.env.TERM === "dumb") {
+        return false;
+    }
+    if (!process.stdin.isTTY) {
+        return false;
+    }
     return resolvePresentation().mode === "rich";
 }
 export async function launchAuditTui(props) {
     const ci = process.env.CI;
-    if (ci === "" || ci === "0" || ci === "false") {
+    const ciCleared = ci === "" || ci === "0" || ci === "false";
+    if (ciCleared) {
         delete process.env.CI;
     }
     const [{ render }, react, app, altScreen] = await Promise.all([
@@ -28,6 +35,8 @@ export async function launchAuditTui(props) {
         await instance.waitUntilExit();
     }
     finally {
+        if (ciCleared)
+            process.env.CI = ci;
         altScreen.leaveTui();
     }
     return exitCode;

package/dist/auth/device-login.js

@@ -191,6 +191,7 @@ export async function fetchAccountStatus(token, env, fetchImpl, timeoutMs = 5_00
         const body = (await response.json());
         return {
             tier: typeof body.tier === "string" && body.tier.length > 0 ? body.tier.toLowerCase() : null,
+            name: typeof body.name === "string" && body.name.trim().length > 0 ? body.name.trim() : null,
             scansUsed: typeof body.scansUsed === "number" && Number.isFinite(body.scansUsed) ? body.scansUsed : null,
             scansLimit: typeof body.scansLimit === "number" && Number.isFinite(body.scansLimit) ? body.scansLimit : null
         };
@@ -202,9 +203,6 @@ export async function fetchAccountStatus(token, env, fetchImpl, timeoutMs = 5_00
         clearTimeout(timer);
     }
 }
-export async function fetchAccountTier(token, env, fetchImpl) {
-    return (await fetchAccountStatus(token, env, fetchImpl))?.tier ?? null;
-}
 export async function runDeviceLogin(io = {}) {
     const env = io.env ?? process.env;
     const fetchImpl = io.fetchImpl ?? fetch;
@@ -236,8 +234,9 @@ export async function runDeviceLogin(io = {}) {
     for (;;) {
         const result = await pollAuthSession(webBase, session.sessionId, fetchImpl);
         if (result.status === "complete" && result.apiKey) {
-            const tier = await fetchAccountTier(result.apiKey, env, fetchImpl);
-            writeAuthState({ token: result.apiKey, email: result.email, tier: tier ?? undefined });
+            const account = await fetchAccountStatus(result.apiKey, env, fetchImpl);
+            const tier = account?.tier ?? null;
+            writeAuthState({ token: result.apiKey, email: result.email, tier: tier ?? undefined, name: account?.name ?? undefined });
             const who = result.email ? ` as ${result.email}` : "";
             return {
                 exitCode: 0,

package/dist/auth/login-app.js

@@ -3,10 +3,10 @@ import { useEffect, useRef, useState } from "react";
 import { Box, Text, useApp, useInput } from "ink";
 import { Spinner } from "../scan-ui/components/Spinner.js";
 import { displayTier, writeAuthState } from "./store.js";
-import { POLL_INTERVAL_MS, POLL_TIMEOUT_MS, createAuthSession, fetchAccountTier, openBrowser, pollAuthSession, resolveWebBase } from "./device-login.js";
+import { POLL_INTERVAL_MS, POLL_TIMEOUT_MS, createAuthSession, fetchAccountStatus, openBrowser, pollAuthSession, resolveWebBase } from "./device-login.js";
 const SUCCESS_MIN_MS = 600;
 const SUCCESS_MAX_MS = 2500;
-function useLogin(webBase, env) {
+export function useLogin(webBase, env) {
     const [state, setState] = useState({ phase: "creating", verifyUrl: "", email: "", plan: "", message: "" });
     const sessionId = useRef("");
     const started = useRef(false);
@@ -58,12 +58,12 @@ function useLogin(webBase, env) {
                     const email = result.email ?? "";
                     writeAuthState({ token: apiKey, email: result.email });
                     setState((prev) => ({ ...prev, phase: "success", email }));
-                    void fetchAccountTier(apiKey, env, fetch)
-                        .then((tier) => {
-                        if (tier) {
-                            writeAuthState({ token: apiKey, email: result.email, tier });
+                    void fetchAccountStatus(apiKey, env, fetch)
+                        .then((account) => {
+                        if (account?.tier) {
+                            writeAuthState({ token: apiKey, email: result.email, tier: account.tier, name: account.name ?? undefined });
                             if (!cancelled.current) {
-                                setState((prev) => ({ ...prev, plan: tier }));
+                                setState((prev) => ({ ...prev, plan: account.tier ?? "" }));
                             }
                         }
                     })

package/dist/auth/store.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
-import { loadUserConfig, saveUserConfig, withUserConfigLock } from "../config/settings.js";
+import { loadUserConfig, parseUrl, saveUserConfig, withUserConfigLock } from "../config/settings.js";
 import { resolveDgPaths } from "../state/index.js";
 import { envAuthToken } from "./env-token.js";
 export class AuthError extends Error {
@@ -24,17 +24,26 @@ export function readAuthState(env = process.env) {
         if (parsed.version !== 1 || !parsed.token || !parsed.apiBaseUrl || parsed.loggedInAt === undefined) {
             throw new AuthError("unsupported auth state");
         }
+        let apiBaseUrl;
+        try {
+            apiBaseUrl = parseUrl(parsed.apiBaseUrl);
+        }
+        catch {
+            throw new AuthError("auth state has an invalid api base URL; run 'dg login' again");
+        }
         const email = typeof parsed.email === "string" && parsed.email.length > 0 ? parsed.email : undefined;
         const tier = typeof parsed.tier === "string" && parsed.tier.length > 0 ? parsed.tier : undefined;
+        const name = typeof parsed.name === "string" && parsed.name.length > 0 ? parsed.name : undefined;
         return {
             version: 1,
             token: parsed.token,
             tokenPreview: parsed.tokenPreview ?? redactToken(parsed.token),
-            apiBaseUrl: parsed.apiBaseUrl,
+            apiBaseUrl,
             orgId: parsed.orgId ?? "",
             loggedInAt: parsed.loggedInAt,
             ...(email ? { email } : {}),
-            ...(tier ? { tier } : {})
+            ...(tier ? { tier } : {}),
+            ...(name ? { name } : {})
         };
     }
     catch (error) {
@@ -63,6 +72,7 @@ export function writeAuthState(options, env = process.env) {
     }
     const email = typeof options.email === "string" && options.email.length > 0 ? options.email : undefined;
     const tier = typeof options.tier === "string" && options.tier.length > 0 ? options.tier : undefined;
+    const name = typeof options.name === "string" && options.name.length > 0 ? options.name : undefined;
     return withUserConfigLock(env, () => {
         const config = loadUserConfig(env);
         const apiBaseUrl = options.apiBaseUrl ?? config.api.baseUrl;
@@ -75,7 +85,8 @@ export function writeAuthState(options, env = process.env) {
             orgId,
             loggedInAt: (options.now ?? new Date()).toISOString(),
             ...(email ? { email } : {}),
-            ...(tier ? { tier } : {})
+            ...(tier ? { tier } : {}),
+            ...(name ? { name } : {})
         };
         const paths = resolveDgPaths(env);
         writeJsonAtomic(authPath(paths), state);
@@ -120,7 +131,8 @@ export function authStatus(env = process.env) {
             apiBaseUrl: state.apiBaseUrl,
             orgId: state.orgId,
             ...(state.email ? { email: state.email } : {}),
-            ...(state.tier ? { tier: state.tier } : {})
+            ...(state.tier ? { tier: state.tier } : {}),
+            ...(state.name ? { name: state.name } : {})
         };
     }
     return {

package/dist/bin/dg.js

@@ -1,17 +1,7 @@
 #!/usr/bin/env node
 import { assertCurrentNode } from "../runtime/node-version.js";
-assertCurrentNode();
-const EXIT_TOOL_ERROR = 70;
-function exitOnFatal(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    try {
-        process.stderr.write(`dg: unexpected error — ${message}\nRun 'dg doctor' to check your installation; remove ~/.dg/config.json if it is corrupted.\n`);
-    }
-    catch {
-        // stderr is gone; nothing left to report to.
-    }
-    process.exit(EXIT_TOOL_ERROR);
-}
+await assertCurrentNode();
+const { exitOnFatal } = await import("../runtime/fatal.js");
 process.on("uncaughtException", (error) => {
     if (error.code === "EPIPE") {
         process.exit(process.exitCode ?? 0);
@@ -30,52 +20,69 @@ const { runCli, writeCliResult } = await import("../runtime/cli.js");
 const { maybeShowFirstRun } = await import("../runtime/first-run.js");
 const { maybePreflightInstallPrompt } = await import("../launcher/preflight-prompt.js");
 const args = process.argv.slice(2);
-maybeShowFirstRun(args);
-import("../state/index.js")
-    .then(({ pruneDeadSessionsSync, resolveDgPaths }) => {
-    pruneDeadSessionsSync(resolveDgPaths());
-})
-    .catch(() => { });
-const { maybeDeviceLogin } = await import("../auth/device-login.js");
-const { maybeVerifyPackage } = await import("../verify/package-check.js");
-const { maybeAudit } = await import("../commands/audit.js");
-const notHandled = { handled: false };
-const deviceLogin = await maybeDeviceLogin(args);
-const verifyPackage = deviceLogin.handled ? notHandled : await maybeVerifyPackage(args);
-const audit = deviceLogin.handled || verifyPackage.handled ? notHandled : await maybeAudit(args);
-if (deviceLogin.handled) {
-    writeCliResult(deviceLogin.result);
-}
-else if (verifyPackage.handled) {
-    writeCliResult(verifyPackage.result);
-}
-else if (audit.handled) {
-    writeCliResult(audit.result);
+const { maybeAgentHookExec } = await import("../launcher/agent-hook-exec.js");
+const agentHookExec = await maybeAgentHookExec(args);
+if (agentHookExec.handled) {
+    writeCliResult(agentHookExec.result);
 }
 else {
-    const preflight = await maybePreflightInstallPrompt(args, { decisionsCwd: process.cwd() });
-    if (preflight.handled) {
-        writeCliResult(preflight.result);
+    const { maybeOfferSetupWizard } = await import("../setup-ui/offer.js");
+    const wizardOffer = await maybeOfferSetupWizard(args);
+    if (wizardOffer.handled) {
+        writeCliResult(wizardOffer.result);
     }
     else {
-        const { maybeRunLiveInstall } = await import("../launcher/live-install.js");
-        const liveInstall = await maybeRunLiveInstall(args);
-        if (liveInstall.handled) {
-            writeCliResult(liveInstall.result);
+        if (wizardOffer.result.stderr) {
+            process.stderr.write(wizardOffer.result.stderr);
+        }
+        maybeShowFirstRun(args);
+        import("../state/index.js")
+            .then(({ pruneDeadSessionsSync, resolveDgPaths }) => {
+            pruneDeadSessionsSync(resolveDgPaths());
+        })
+            .catch(() => { });
+        const { maybeDeviceLogin } = await import("../auth/device-login.js");
+        const { maybeVerifyPackage } = await import("../verify/package-check.js");
+        const { maybeAudit } = await import("../commands/audit.js");
+        const notHandled = { handled: false };
+        const deviceLogin = await maybeDeviceLogin(args);
+        const verifyPackage = deviceLogin.handled ? notHandled : await maybeVerifyPackage(args);
+        const audit = deviceLogin.handled || verifyPackage.handled ? notHandled : await maybeAudit(args);
+        if (deviceLogin.handled) {
+            writeCliResult(deviceLogin.result);
+        }
+        else if (verifyPackage.handled) {
+            writeCliResult(verifyPackage.result);
+        }
+        else if (audit.handled) {
+            writeCliResult(audit.result);
         }
         else {
-            writeCliResult(await runCli(args));
+            const preflight = await maybePreflightInstallPrompt(args, { decisionsCwd: process.cwd() });
+            if (preflight.handled) {
+                writeCliResult(preflight.result);
+            }
+            else {
+                const { maybeRunLiveInstall } = await import("../launcher/live-install.js");
+                const liveInstall = await maybeRunLiveInstall(args);
+                if (liveInstall.handled) {
+                    writeCliResult(liveInstall.result);
+                }
+                else {
+                    writeCliResult(await runCli(args));
+                }
+            }
+        }
+        // The auth flows (browser login, paid-verify gate, deep audit upload) already
+        // tell the user exactly what to do; the throttled nudges would just be noise.
+        if (!deviceLogin.handled && !verifyPackage.handled && !audit.handled) {
+            try {
+                const { maybeShowNudges } = await import("../runtime/nudges.js");
+                maybeShowNudges(args);
+            }
+            catch {
+                // dg deleted its own files mid-run (uninstall of itself); nudges are cosmetic.
+            }
         }
-    }
-}
-// The auth flows (browser login, paid-verify gate, deep audit upload) already
-// tell the user exactly what to do; the throttled nudges would just be noise.
-if (!deviceLogin.handled && !verifyPackage.handled && !audit.handled) {
-    try {
-        const { maybeShowNudges } = await import("../runtime/nudges.js");
-        maybeShowNudges(args);
-    }
-    catch {
-        // dg deleted its own files mid-run (uninstall of itself); nudges are cosmetic.
     }
 }