@westbayberry/dg 2.2.0 → 2.3.0

package/dist/agents/claude-code.js

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { formatScreenedNote } from "../launcher/agent-check.js";
 import { dirExists, mergedJsonHook, LEGACY_AGENT_HOOK_SENTINEL } from "./persistence.js";
 const SIGNATURE = "hook-exec claude-code";
 function configPath(home) {
@@ -74,6 +75,15 @@ function parseInput(stdin) {
 // silent ({}) on allow so we never override the user's normal permission flow.
 function emitDecision(verdict) {
     if (verdict.decision === "allow") {
+        const note = verdict.screened ? formatScreenedNote(verdict.screened) : "";
+        if (note) {
+            return {
+                stdout: JSON.stringify({
+                    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: note },
+                }),
+                exitCode: 0,
+            };
+        }
         return { stdout: "{}", exitCode: 0 };
     }
     return {

package/dist/agents/codex.js

@@ -21,7 +21,7 @@ function emitDecision(verdict) {
         return { stdout: "", exitCode: 0 };
     }
     const reason = verdict.reason ?? "Dependency Guardian firewall";
-    const suffix = verdict.decision === "ask" ? " (flagged for review — run the install in a terminal to decide)" : "";
+    const suffix = verdict.decision === "ask" ? " (dg flagged this for human review — not auto-approved)" : "";
     return {
         stdout: JSON.stringify({ decision: "block", reason: `${reason}${suffix}` }),
         exitCode: 0,

package/dist/agents/cursor.js

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { formatScreenedNote } from "../launcher/agent-check.js";
 import { dirExists, mergedJsonHook, readSettings } from "./persistence.js";
 const SIGNATURE = "hook-exec cursor";
 function configPath(home) {
@@ -73,7 +74,11 @@ function parseInput(stdin) {
 }
 function emitDecision(verdict) {
     if (verdict.decision === "allow") {
-        return { stdout: JSON.stringify({ permission: "allow" }), exitCode: 0 };
+        const note = verdict.screened ? formatScreenedNote(verdict.screened) : "";
+        return {
+            stdout: JSON.stringify(note ? { permission: "allow", agent_message: note } : { permission: "allow" }),
+            exitCode: 0,
+        };
     }
     const reason = verdict.reason ?? "Dependency Guardian firewall";
     return {

package/dist/agents/gate-posture.js

@@ -0,0 +1,21 @@
+import { readServiceState } from "../service/state.js";
+export function readNetworkGatePosture(env = process.env) {
+    try {
+        const { state } = readServiceState(env);
+        if (state.running && state.proxy) {
+            return { live: true, proxyUrl: state.proxy.proxyUrl };
+        }
+    }
+    catch {
+        // fall through to the off posture; a missing/unreadable service state means
+        // the gate is not live, which is exactly what we report.
+    }
+    return { live: false };
+}
+export const GATE_OFF_COVERAGE_GAPS = [
+    "absolute-path installs (e.g. /usr/local/bin/npm install evil)",
+    "manifest-only installs (npm ci, npm install with no package named)",
+    "dynamically-built or stdin-fed commands the static parser defers on",
+    "recognized-but-unsupported managers (bun, deno, poetry, pdm)",
+];
+export const GATE_ENABLE_HINT = "dg setup --service --yes && dg service start";

package/dist/agents/persistence.js

@@ -81,12 +81,16 @@ async function recordHookEntry(ctx, legacySentinels, created) {
     for (const sentinel of legacySentinels) {
         await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel });
     }
+    // Preserve the dg-created provenance on re-apply: `created` is false the second
+    // time the hook is installed, but if dg created the file originally, uninstall
+    // must still remove it, so keep the marker.
+    const dgCreated = created || (await wasCreatedByDg(ctx));
     await recordCleanupEntry(ctx.paths, {
         kind: "agent-hook",
         path: ctx.settingsPath,
         mode: "mode1",
         sentinel: agentHookSentinel(ctx.agent),
-        ...(created ? { original: "dg-created" } : {}),
+        ...(dgCreated ? { original: "dg-created" } : {}),
     });
 }
 async function removeHookEntries(ctx, legacySentinels) {
@@ -95,6 +99,48 @@ async function removeHookEntries(ctx, legacySentinels) {
         await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel });
     }
 }
+function findHookCommand(node, signature) {
+    if (typeof node === "string") {
+        return node.includes(signature) ? node : null;
+    }
+    if (Array.isArray(node)) {
+        for (const value of node) {
+            const found = findHookCommand(value, signature);
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    if (node && typeof node === "object") {
+        for (const value of Object.values(node)) {
+            const found = findHookCommand(value, signature);
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    return null;
+}
+function hookResolvesCheck(settings, agent) {
+    const command = findHookCommand(settings, `hook-exec ${agent}`);
+    if (!command) {
+        return null;
+    }
+    const head = command.split(/\s+hook-exec\s+/)[0] ?? command;
+    const broken = head
+        .split(/\s+/)
+        .filter((token) => token.startsWith("/"))
+        .filter((token) => !existsSync(token));
+    return {
+        name: "hook command resolves",
+        ok: broken.length === 0,
+        detail: broken.length === 0
+            ? "dg path in the hook resolves"
+            : `hook references a missing path (${broken.join(", ")}); re-run 'dg agents on ${agent}'`,
+    };
+}
 export function mergedJsonHook(config) {
     const legacy = config.legacySentinels ?? [];
     return {
@@ -138,14 +184,22 @@ export function mergedJsonHook(config) {
             if (!present) {
                 return checks;
             }
+            let settings = null;
             let installed = false;
             try {
-                installed = config.isInstalled(readSettings(ctx.settingsPath).settings);
+                settings = readSettings(ctx.settingsPath).settings;
+                installed = config.isInstalled(settings);
             }
             catch {
                 installed = false;
             }
             checks.push({ name: config.checkName, ok: installed, detail: installed ? "installed" : "not installed" });
+            if (installed && settings) {
+                const resolves = hookResolvesCheck(settings, ctx.agent);
+                if (resolves) {
+                    checks.push(resolves);
+                }
+            }
             return checks;
         },
         reverseEntry(entry, removed, missing, warnings) {
@@ -227,6 +281,18 @@ export function ownedJsonHook(config) {
             }
             const installed = ownsFile(ctx.settingsPath);
             checks.push({ name: config.checkName, ok: installed, detail: installed ? "installed" : "present but not dg-owned" });
+            if (installed) {
+                try {
+                    const settings = JSON.parse(readFileSync(ctx.settingsPath, "utf8"));
+                    const resolves = hookResolvesCheck(settings, ctx.agent);
+                    if (resolves) {
+                        checks.push(resolves);
+                    }
+                }
+                catch {
+                    // unreadable file: the installed check already reflects the broken state
+                }
+            }
             return checks;
         },
         reverseEntry(entry, removed, missing, warnings) {

package/dist/agents/registry.js

@@ -37,9 +37,10 @@ export function defaultDgCommand(agent) {
     catch {
         // keep argv[1]; the hook still resolves via PATH as a fallback
     }
-    // Absolute node + script path so the agent's non-interactive subprocess
-    // can't lose it to a PATH change (the whole point of the hook).
-    return `${process.execPath} ${bin} ${agentHookSignature(agent)}`;
+    // Run the dg script via its own shebang rather than baking process.execPath:
+    // a version-pinned node path (e.g. .../Cellar/node/<ver>/bin/node) vanishes on
+    // a node upgrade and would silently disable the hook.
+    return `${bin} ${agentHookSignature(agent)}`;
 }
 export function resolveAgentHookContext(agent, options = {}) {
     const env = options.env ?? process.env;

package/dist/agents/routing.js

@@ -0,0 +1,118 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { buildAgentRoutingEnv } from "../launcher/env.js";
+import { readServiceState } from "../service/state.js";
+import { resolveDgPaths } from "../state/index.js";
+import { readSettings, writeSettingsAtomic } from "./persistence.js";
+import { getAgent } from "./registry.js";
+// The agent's install hook screens statically; this routes the agent's ACTUAL
+// fetches through dg's proxy so a wrapped/dynamic install (eval, $VAR, python -m
+// pip, …) the static hook can't decode is still screened at fetch time. Only
+// applied when `dg service` is running, so the proxy endpoint baked into the
+// agent's env is always live — never a dead HTTPS_PROXY that breaks installs.
+const CODEX_BEGIN = "# >>> dg routing >>>";
+const CODEX_END = "# <<< dg routing <<<";
+function backupPath(agent, env) {
+    return join(resolveDgPaths(env).stateDir, `routing-${agent}.json`);
+}
+export function resolveServiceRoutingEnv(env = process.env) {
+    const { state } = readServiceState(env);
+    if (!state.running || !state.proxy) {
+        return { error: "dg service is not running — run 'dg service start' so the proxy gate is live before routing agents through it" };
+    }
+    return { env: buildAgentRoutingEnv(state.proxy.proxyUrl, state.proxy.caPath), proxyUrl: state.proxy.proxyUrl };
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripCodexBlock(content) {
+    const block = new RegExp(`\\n?${escapeRegex(CODEX_BEGIN)}[\\s\\S]*?${escapeRegex(CODEX_END)}\\n?`, "g");
+    return content.replace(block, "\n").replace(/\n{3,}/g, "\n\n");
+}
+function applyClaudeRouting(settingsPath, routing, backup) {
+    const { settings } = readSettings(settingsPath);
+    const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
+    const prior = {};
+    for (const [k, v] of Object.entries(routing)) {
+        prior[k] = k in envObj ? String(envObj[k]) : null;
+        envObj[k] = v;
+    }
+    settings.env = envObj;
+    writeSettingsAtomic(settingsPath, settings);
+    mkdirSync(dirname(backup), { recursive: true, mode: 0o700 });
+    writeFileSync(backup, `${JSON.stringify({ kind: "claude-env", path: settingsPath, prior }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+}
+function removeClaudeRouting(settingsPath, backup) {
+    if (!existsSync(backup)) {
+        return;
+    }
+    let prior = {};
+    try {
+        prior = JSON.parse(readFileSync(backup, "utf8")).prior ?? {};
+    }
+    catch {
+        prior = {};
+    }
+    if (existsSync(settingsPath)) {
+        const { settings } = readSettings(settingsPath);
+        const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
+        for (const [k, v] of Object.entries(prior)) {
+            if (v === null) {
+                delete envObj[k];
+            }
+            else {
+                envObj[k] = v;
+            }
+        }
+        if (Object.keys(envObj).length === 0) {
+            delete settings.env;
+        }
+        else {
+            settings.env = envObj;
+        }
+        writeSettingsAtomic(settingsPath, settings);
+    }
+    rmSync(backup, { force: true });
+}
+function applyCodexRouting(configPath, routing) {
+    const content = existsSync(configPath) ? stripCodexBlock(readFileSync(configPath, "utf8")) : "";
+    if (/^\s*\[shell_environment_policy\]/m.test(content)) {
+        return { applied: false, detail: "~/.codex/config.toml already defines [shell_environment_policy] — add dg's proxy vars (HTTPS_PROXY, NODE_EXTRA_CA_CERTS, …) to its `set` table manually" };
+    }
+    const set = Object.entries(routing).map(([k, v]) => `${k} = ${JSON.stringify(v)}`).join(", ");
+    const block = `${CODEX_BEGIN}\n[shell_environment_policy]\nset = { ${set} }\n${CODEX_END}\n`;
+    const next = content === "" || content.endsWith("\n") ? `${content}${block}` : `${content}\n${block}`;
+    writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    return { applied: true, detail: configPath };
+}
+function removeCodexRouting(configPath) {
+    if (!existsSync(configPath)) {
+        return;
+    }
+    writeFileSync(configPath, stripCodexBlock(readFileSync(configPath, "utf8")), { encoding: "utf8" });
+}
+function codexConfigPath(home) {
+    return join(home, ".codex", "config.toml");
+}
+export function applyAgentRouting(agent, routing, home, env = process.env) {
+    if (agent === "codex") {
+        return applyCodexRouting(codexConfigPath(home), routing);
+    }
+    // Every other supported agent reads a JSON settings file with an `env` block.
+    applyClaudeRouting(getAgent(agent).configPath(home), routing, backupPath(agent, env));
+    return { applied: true, detail: getAgent(agent).configPath(home) };
+}
+export function removeAgentRouting(agent, home, env = process.env) {
+    if (agent === "codex") {
+        removeCodexRouting(codexConfigPath(home));
+        return;
+    }
+    removeClaudeRouting(getAgent(agent).configPath(home), backupPath(agent, env));
+}
+export function routingInstalled(agent, home, env = process.env) {
+    if (agent === "codex") {
+        const p = codexConfigPath(home);
+        return existsSync(p) && readFileSync(p, "utf8").includes(CODEX_BEGIN);
+    }
+    return existsSync(backupPath(agent, env));
+}

package/dist/agents/windsurf.js

@@ -64,7 +64,7 @@ function emitDecision(verdict) {
         return { stdout: "", exitCode: 0 };
     }
     const reason = verdict.reason ?? "Dependency Guardian firewall";
-    const suffix = verdict.decision === "ask" ? " (flagged for review — run the install in a terminal to decide)" : "";
+    const suffix = verdict.decision === "ask" ? " (dg flagged this for human review — not auto-approved)" : "";
     return { stdout: `${reason}${suffix}\n`, exitCode: 2 };
 }
 function probeHookSupport(home) {

package/dist/audit/rules.js

@@ -384,7 +384,7 @@ export const CONTENT_RULES = [
     {
         id: "db-connection-string",
         re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:@\s/]+:[^@\s/]+@[^/\s]+/u,
-        allow: /:\/\/[^:@/]+:(password|pass|user|example|changeme|xxx+|\*+)@|@(localhost|127\.0\.0\.1|example\.|host)/iu,
+        allow: /:\/\/[^:@/]+:(password|pass|user|example|changeme|xxx+|\*+)@|@(localhost|127\.0\.0\.1|example\.|host\b)/iu,
         category: "bundled-secret",
         severity: 4,
         title: "Database connection string with password embedded in a published file",
@@ -421,6 +421,10 @@ export const RISKY_SCRIPT_NAMES = [
     "preuninstall",
     "uninstall"
 ];
-export const DANGEROUS_SCRIPT_RE = /\|\s*(?:sh|bash|zsh)\b|\beval\s|node\s+-e\b|python[0-9.]*\s+-c\b|base64\s+-d|(?:curl|wget|fetch)\b[^\n]*\|\s*\w*sh\b/iu;
+// Best-effort heuristic on the LOCAL audit only; a public regex is evadable, so
+// the authoritative verdict is the behavioral scanner. Covers pipe-to-shell, eval,
+// node -e, python -c, base64 -d, curl|sh, AND download-then-execute where the fetch
+// is chained (&& / ;) to a shell or a freshly-downloaded file.
+export const DANGEROUS_SCRIPT_RE = /\|\s*(?:sh|bash|zsh)\b|\beval\s|node\s+-e\b|python[0-9.]*\s+-c\b|base64\s+-d|(?:curl|wget|fetch)\b[^\n]*\|\s*\w*sh\b|(?:curl|wget|fetch)\b[^\n]*(?:&&|;)\s*(?:sh|bash|zsh|source|\.\/)/iu;
 export const INVISIBLE_UNICODE_RE = /[\u200B-\u200F\u2060-\u2064\u202A-\u202E\u2066-\u2069\uFEFF]/u;
 export const BIDI_OVERRIDE_RE = /[\u202A-\u202E\u2066-\u2069]/u;

package/dist/auth/store.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
-import { loadUserConfig, saveUserConfig, withUserConfigLock } from "../config/settings.js";
+import { loadUserConfig, parseUrl, saveUserConfig, withUserConfigLock } from "../config/settings.js";
 import { resolveDgPaths } from "../state/index.js";
 import { envAuthToken } from "./env-token.js";
 export class AuthError extends Error {
@@ -24,6 +24,13 @@ export function readAuthState(env = process.env) {
         if (parsed.version !== 1 || !parsed.token || !parsed.apiBaseUrl || parsed.loggedInAt === undefined) {
             throw new AuthError("unsupported auth state");
         }
+        let apiBaseUrl;
+        try {
+            apiBaseUrl = parseUrl(parsed.apiBaseUrl);
+        }
+        catch {
+            throw new AuthError("auth state has an invalid api base URL; run 'dg login' again");
+        }
         const email = typeof parsed.email === "string" && parsed.email.length > 0 ? parsed.email : undefined;
         const tier = typeof parsed.tier === "string" && parsed.tier.length > 0 ? parsed.tier : undefined;
         const name = typeof parsed.name === "string" && parsed.name.length > 0 ? parsed.name : undefined;
@@ -31,7 +38,7 @@ export function readAuthState(env = process.env) {
             version: 1,
             token: parsed.token,
             tokenPreview: parsed.tokenPreview ?? redactToken(parsed.token),
-            apiBaseUrl: parsed.apiBaseUrl,
+            apiBaseUrl,
             orgId: parsed.orgId ?? "",
             loggedInAt: parsed.loggedInAt,
             ...(email ? { email } : {}),

package/dist/commands/agents.js

@@ -1,6 +1,8 @@
 import { homedir } from "node:os";
 import { AGENT_IDS, AGENTS, agentLabel, collectAgentOffers, getAgent, isAgentId, resolveAgentHookContext, } from "../agents/registry.js";
 import { AgentHookError } from "../agents/persistence.js";
+import { applyAgentRouting, removeAgentRouting, resolveServiceRoutingEnv, routingInstalled } from "../agents/routing.js";
+import { GATE_ENABLE_HINT, GATE_OFF_COVERAGE_GAPS, readNetworkGatePosture } from "../agents/gate-posture.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
 import { tildifyPath as tildify } from "../setup/plan.js";
@@ -101,6 +103,23 @@ function renderStatusCard(rows, theme) {
     lines.push("", `  ${muted("protect all:")} ${accent("dg agents on")} ${muted("·")} ${muted("remove:")} ${accent("dg agents off")}`, "");
     return lines.join("\n");
 }
+function gatePostureLines(env, theme) {
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const posture = readNetworkGatePosture(env);
+    if (posture.live) {
+        return [`  ${theme.paint("pass", "✓ network gate live")} ${muted(`at ${posture.proxyUrl} — installs are screened at fetch by artifact hash, however the command is written`)}`];
+    }
+    const lines = [
+        `  ${theme.paint("warn", "⚠ network gate OFF — static pre-screen only")}`,
+        `  ${muted("these are NOT screened until the gate is on:")}`,
+    ];
+    for (const gap of GATE_OFF_COVERAGE_GAPS) {
+        lines.push(`    ${muted(`· ${gap}`)}`);
+    }
+    lines.push(`  ${muted("enable full fetch-time screening:")} ${accent(GATE_ENABLE_HINT)}`);
+    return lines;
+}
 async function applyAgents(targets, env, home, theme, recordFixture) {
     const accent = (text) => theme.paint("accent", text);
     const muted = (text) => theme.paint("muted", text);
@@ -119,6 +138,16 @@ async function applyAgents(targets, env, home, theme, recordFixture) {
         try {
             await integration.apply({ ...ctx, dgCommand });
             lines.push(`  ${theme.paint("pass", `✓ ${integration.label} installs route through dg`)} ${muted(`(${tildify(ctx.settingsPath, home)})`)}`);
+            // When the persistent proxy is live, also route the agent's real fetches
+            // through it so a wrapped/dynamic install the static hook can't decode is
+            // still screened at fetch time.
+            const routing = resolveServiceRoutingEnv(env);
+            if (!("error" in routing)) {
+                const r = applyAgentRouting(agent, routing.env, home, env);
+                lines.push(r.applied
+                    ? `  ${muted("  ↳ fetches also routed through the live dg proxy (fetch-time screening)")}`
+                    : `  ${muted(`  ↳ routing skipped: ${r.detail}`)}`);
+            }
             if (integration.maturity === "unverified") {
                 lines.push(`  ${muted(`  hook installed from ${integration.label}'s documented schema; payload format not yet verified against a live ${integration.label} run`)}`);
             }
@@ -135,7 +164,7 @@ async function applyAgents(targets, env, home, theme, recordFixture) {
     if (lines.length === 0) {
         return { exitCode: 0, stdout: `  ${muted("No unprotected agents detected.")} ${muted("See")} ${accent("dg agents")}\n`, stderr: "" };
     }
-    lines.push(`  ${muted("Reverse:")} ${accent("dg agents off")}`);
+    lines.push("", ...gatePostureLines(env, theme), "", `  ${muted("Reverse:")} ${accent("dg agents off")}`);
     return { exitCode: failures > 0 && failures === targets.length ? 1 : 0, stdout: `${lines.join("\n")}\n`, stderr: "" };
 }
 async function removeAgents(targets, env, home, theme) {
@@ -146,6 +175,7 @@ async function removeAgents(targets, env, home, theme) {
         const ctx = resolveAgentHookContext(agent, { env, home });
         try {
             const result = await integration.remove(ctx);
+            removeAgentRouting(agent, home, env);
             lines.push(result.removed
                 ? `  ${theme.paint("pass", `✓ ${integration.label} hook removed`)} ${muted(`(${tildify(ctx.settingsPath, home)})`)}`
                 : `  ${muted(`· ${integration.label} — no dg hook was installed`)}`);
@@ -171,6 +201,20 @@ function checkAgents(targets, env, home) {
             lines.push(`  ${check.ok ? "✓" : "✗"} ${check.name}: ${check.detail}`);
             allOk = allOk && check.ok;
         }
+        const routed = routingInstalled(agent, home, env);
+        lines.push(`  ${routed ? "✓" : "·"} fetch-time routing: ${routed ? "installs routed through the dg proxy" : "not routed (start dg service, then re-run dg agents on)"}`);
+    }
+    const posture = readNetworkGatePosture(env);
+    lines.push("", "network gate:");
+    if (posture.live) {
+        lines.push(`  ✓ live at ${posture.proxyUrl} — installs screened at fetch by artifact hash, however the command is written`);
+    }
+    else {
+        lines.push("  ⚠ OFF — static pre-screen only. NOT screened until the gate is on:");
+        for (const gap of GATE_OFF_COVERAGE_GAPS) {
+            lines.push(`    · ${gap}`);
+        }
+        lines.push(`  enable: ${GATE_ENABLE_HINT}`);
     }
     return { exitCode: allOk ? 0 : 1, stdout: `${lines.join("\n")}\n`, stderr: "" };
 }

package/dist/commands/audit.js

@@ -131,6 +131,12 @@ export async function maybeAudit(args) {
             }
         }
     }
+    // Org policy must gate every upload, not just the consent prompt: a pre-granted
+    // consent (DG_AUDIT_UPLOAD=1 / config) must not transmit the tarball when the
+    // organization has disabled artifact upload.
+    if (decision.upload && (await teamPolicyBlocksUpload())) {
+        decision = { upload: false, reason: "deep audit upload is disabled by your organization's policy" };
+    }
     if (shouldLaunchAuditTui({ format: gathered.parsed.format, outputPath: gathered.parsed.outputPath })) {
         const uploadAbort = new AbortController();
         const deepPromise = decision.upload

package/dist/commands/setup.js

@@ -270,8 +270,7 @@ function renderSecurityNotesText(theme) {
         "",
         "  1. dg can make mistakes.",
         "     A PASS verdict does not guarantee a package is safe. You are",
-        "     responsible for what you install and should review new",
-        "     dependencies.",
+        "     responsible for what you install.",
         "",
         "  2. By continuing you confirm you have read and understand the",
         "     Terms of Service and Privacy Policy.",

package/dist/commands/uninstall.js

@@ -14,7 +14,8 @@ export const uninstallCommand = {
     ],
     examples: ["dg uninstall", "dg uninstall --yes --keep-config", "dg uninstall --all --yes"],
     details: [
-        "Removes only dg-owned writes (shims, shell-rc block, git hooks), tolerates missing or malformed state, runs twice safely, and preserves user content."
+        "Removes only dg-owned writes (shims, shell-rc block, git hooks), tolerates missing or malformed state, runs twice safely, and preserves user content.",
+        "Running 'npm uninstall -g @westbayberry/dg' on its own leaves these writes behind; the next npm or pip command then clears them automatically. Run this to remove everything immediately."
     ],
     handler: (context) => uninstallHandler(context.args)
 };

package/dist/config/settings.js

@@ -9,6 +9,8 @@ export const CONFIG_KEYS = Object.freeze([
     "policy.trustProjectAllowlists",
     "policy.allowForceOverride",
     "policy.scriptHardening",
+    "policy.shimFailClosed",
+    "policy.strictEgress",
     "scriptGate.mode",
     "scriptGate.observe",
     "gitHook.onWarn",
@@ -33,7 +35,9 @@ export const DEFAULT_CONFIG = Object.freeze({
         mode: "block",
         trustProjectAllowlists: false,
         allowForceOverride: true,
-        scriptHardening: false
+        scriptHardening: false,
+        shimFailClosed: false,
+        strictEgress: false
     },
     scriptGate: {
         mode: "observe",
@@ -48,7 +52,7 @@ export const DEFAULT_CONFIG = Object.freeze({
         npmAge: "",
         pypiAge: "",
         cargoAge: "",
-        onUnknown: "allow",
+        onUnknown: "block",
         exempt: ""
     },
     audit: {
@@ -106,6 +110,17 @@ export function updateUserConfig(apply, env = process.env) {
         return next;
     });
 }
+// Whether repo-supplied project overrides (allowlists, cooldown exemptions,
+// warn-decisions) are trusted wholesale. A corrupt config fails closed to
+// untrusted so a hostile repo can never relax screening by breaking the config.
+export function trustsProjectOverrides(env = process.env) {
+    try {
+        return loadUserConfig(env).policy.trustProjectAllowlists;
+    }
+    catch {
+        return false;
+    }
+}
 export function getConfigValue(config, key) {
     if (key === "api.baseUrl") {
         return config.api.baseUrl;
@@ -125,6 +140,12 @@ export function getConfigValue(config, key) {
     if (key === "policy.scriptHardening") {
         return String(config.policy.scriptHardening);
     }
+    if (key === "policy.shimFailClosed") {
+        return String(config.policy.shimFailClosed);
+    }
+    if (key === "policy.strictEgress") {
+        return String(config.policy.strictEgress);
+    }
     if (key === "scriptGate.mode") {
         return config.scriptGate.mode;
     }
@@ -160,6 +181,8 @@ export function getConfigValue(config, key) {
 export const ADVANCED_CONFIG_KEYS = new Set([
     "org.id",
     "policy.scriptHardening",
+    "policy.shimFailClosed",
+    "policy.strictEgress",
     "scriptGate.observe",
     "cooldown.npm.age",
     "cooldown.pypi.age",
@@ -206,6 +229,12 @@ export function setConfigValue(config, key, rawValue) {
     if (key === "policy.scriptHardening") {
         return withPolicyBoolean(config, "scriptHardening", rawValue);
     }
+    if (key === "policy.shimFailClosed") {
+        return withPolicyBoolean(config, "shimFailClosed", rawValue);
+    }
+    if (key === "policy.strictEgress") {
+        return withPolicyBoolean(config, "strictEgress", rawValue);
+    }
     if (key === "scriptGate.mode") {
         return {
             ...config,
@@ -300,7 +329,9 @@ function normalizeConfig(raw) {
             mode: parsePolicyMode(fieldString(policy, "policy.mode", "mode") ?? DEFAULT_CONFIG.policy.mode),
             trustProjectAllowlists: fieldBoolean(policy, "policy.trustProjectAllowlists", "trustProjectAllowlists") ?? DEFAULT_CONFIG.policy.trustProjectAllowlists,
             allowForceOverride: fieldBoolean(policy, "policy.allowForceOverride", "allowForceOverride") ?? DEFAULT_CONFIG.policy.allowForceOverride,
-            scriptHardening
+            scriptHardening,
+            shimFailClosed: fieldBoolean(policy, "policy.shimFailClosed", "shimFailClosed") ?? DEFAULT_CONFIG.policy.shimFailClosed,
+            strictEgress: fieldBoolean(policy, "policy.strictEgress", "strictEgress") ?? DEFAULT_CONFIG.policy.strictEgress
         },
         scriptGate: {
             mode: parseScriptGateMode(fieldString(scriptGate, "scriptGate.mode", "mode") ?? (scriptHardening ? "enforce" : DEFAULT_CONFIG.scriptGate.mode)),
@@ -452,7 +483,7 @@ function parseBoolean(value, field) {
     }
     throw new ConfigError(`${field} must be true or false`);
 }
-function parseUrl(value) {
+export function parseUrl(value) {
     const trimmed = value.trim();
     try {
         const url = new URL(trimmed);

package/dist/install-ui/LiveInstall.js

@@ -2,6 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, Text } from "ink";
 import InkSpinner from "ink-spinner";
 import { formatResetDate } from "./block-render.js";
+import { sanitizeLine } from "../security/sanitize.js";
 function packageCount(n) {
     return n === 1 ? "1 package" : `${n} packages`;
 }
@@ -15,7 +16,7 @@ export const LiveInstall = ({ view }) => {
                             ? "DG starting protection…"
                             : view.resolvedTotal !== undefined && view.total <= view.resolvedTotal
                                 ? `DG verifying ${view.total}/${view.resolvedTotal}…`
-                                : `DG verifying ${packageCount(view.total)}…`] }), view.current ? _jsxs(Text, { dimColor: true, children: ["  ", view.current] }) : null] }));
+                                : `DG verifying ${packageCount(view.total)}…`] }), view.current ? _jsxs(Text, { dimColor: true, children: ["  ", sanitizeLine(view.current)] }) : null] }));
     }
     if (view.total === 0 && !view.blocked) {
         return null;
@@ -30,7 +31,7 @@ export const LiveInstall = ({ view }) => {
     }
     const total = view.verified + view.flagged;
     if (view.flagged > 0) {
-        return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ["\u26A0  DG verified ", packageCount(total), " \u2014 ", view.flagged, " flagged"] }), (view.flaggedItems ?? []).map((item, index) => (_jsxs(Text, { dimColor: true, children: ["   ", item.packageName, "   ", item.reason] }, `${item.packageName}-${index}`)))] }));
+        return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ["\u26A0  DG verified ", packageCount(total), " \u2014 ", view.flagged, " flagged"] }), (view.flaggedItems ?? []).map((item, index) => (_jsxs(Text, { dimColor: true, children: ["   ", sanitizeLine(item.packageName), "   ", sanitizeLine(item.reason)] }, `${item.packageName}-${index}`)))] }));
     }
     return (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: "green", children: ["\u2713  DG verified ", packageCount(total), " \u2014 clean"] }) }));
 };