@westbayberry/dg 2.3.2 → 2.3.4

package/README.md

@@ -6,9 +6,16 @@
 
 Dependency Guardian is a supply-chain firewall for npm and PyPI. The `dg` CLI
 checks a package against the scanner before its code can run, so a malicious
-install is blocked before its install scripts execute, not flagged afterward.
-It scans published package artifacts from the registry; your source code stays
-on your machine.
+install is blocked before its install scripts execute, not flagged afterward. It
+scans published package artifacts from the registry; your source code stays on
+your machine.
+
+Built by Mckeane McBrearty at WestBayBerry, open source under Apache-2.0.
+Releases publish from GitHub Actions through npm's Trusted Publisher OIDC, never
+from a personal machine. The scanner's findings land in the OpenSSF
+malicious-packages database, including a 37-package React Native campaign from
+the npm account `sproger` that had gone unreported for over a year (OSSF PR
+#1322).
 
 ## Install
 
@@ -16,41 +23,26 @@ on your machine.
 npm install -g @westbayberry/dg
 ```
 
-Requires Node.js >= 22.14. Installing the package adds only the `dg` binary and
-runs no install lifecycle scripts of its own. The published tarball ships an
+Requires Node.js >= 22.14. The install adds only the `dg` binary and runs no
+lifecycle scripts of its own. The published tarball ships an
 `npm-shrinkwrap.json`, so every install resolves the exact dependency tree the
 release was audited with. Nothing touches your shell until you run `dg setup`.
 
 ## Quickstart
 
-Audit the project in the current directory:
-
 ```bash
-dg scan
+dg login      # free account
+dg scan       # audit the current project's lockfiles
 ```
 
-`dg scan` reads your lockfiles, asks the scanner for a verdict on each
-dependency, and opens a full-screen results browser in an interactive terminal
-(plain text or machine output otherwise). It installs nothing and runs no
-package scripts. Exit code 0 means the project is clean, 2 means a block-level
-package was found.
-
-## Verdicts
-
-Every result is one of three states the scanner returns: **PASS** (verified),
-**WARN** (flagged, review advised), or **BLOCK** (refused). The exit code
-follows the verdict.
-
-**The server is the verdict source.** For registry checks and the install
-firewall the scanner returns the verdict and the CLI displays it; the CLI never
-derives a verdict from a local score. If the scanner is unreachable, `dg scan`
-falls back to local heuristics and marks the report (`scannerUnavailable` in
-JSON output) rather than passing silently.
+`dg scan` reads your lockfiles and asks the scanner for a verdict on each
+dependency. It installs nothing and runs no package scripts. Exit `0` is clean,
+`2` means a block-level package was found.
 
 ## The install firewall
 
-Prefix any install command with `dg` and the package is checked before its
-bytes reach your package manager:
+Prefix any install command with `dg` and the package is checked before its bytes
+reach your package manager:
 
 ```bash
 dg npm install lodash
@@ -59,219 +51,115 @@ dg pip install requests
 dg cargo add serde
 ```
 
-The prefix starts a local proxy for just that command, hashes each artifact as
-it downloads, asks the scanner for a verdict, and refuses a blocked package
-before delivery. Supported prefixes include npm, npx, pnpm, pnpx, Yarn classic,
-pip, pipx, uv, uvx, and cargo. A block exits 2 and prints the override command;
-a warn prompts `Proceed? [y/N]` (default No) in a terminal.
+It proxies just that command, hashes each artifact as it downloads, and refuses
+a blocked one before delivery. Supported prefixes: npm, npx, pnpm, pnpx, Yarn
+classic, pip, pipx, uv, uvx, and cargo. To protect bare `npm install` /
+`pip install` and your AI coding agents too, run `dg setup` (one consent screen,
+reversible with `dg uninstall`).
 
-To protect bare commands too, run `dg setup`. It shows one consent screen
-listing exactly what it writes, then installs reversible, user-local shims so
-plain `npm install` and `pip install` are scanned automatically, plus a native
-hook in each AI coding agent it detects. Undo all of it with `dg uninstall`.
+## Common commands
 
-## Command reference
-
-Run `dg <command> --help` for full flags and examples, or `dg --help-all` for
-the complete list. The exhaustive reference lives at
+| Command | What it does |
+| --- | --- |
+| `dg scan [path]` | Audit a project's lockfiles for malicious dependencies |
+| `dg verify npm:react@18` | Check a published package before you install it |
+| `dg sbom [path]` | CycloneDX 1.5 SBOM for the resolved tree |
+| `dg licenses [path]` | SPDX license report grouped by risk |
+| `dg audit [path]` | Pre-publish check of a package of your own |
+| `dg agents` | Route AI coding agents' installs through the firewall |
+| `dg setup` / `dg uninstall` | Install or remove the shell and agent hooks |
+| `dg doctor` | Diagnose setup, PATH, auth, and service state |
+
+Run `dg <command> --help` for flags, or `dg --help-all` for the complete list.
+The full reference is at
 [westbayberry.com/docs/cli-reference](https://westbayberry.com/docs/cli-reference).
 
-### dg scan [path]
-
-Audits the project's lockfiles for the path (current directory by default).
-Read-only: it never installs, runs package scripts, or changes setup state.
-Reads `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`,
-`pnpm-lock.yaml`, `requirements.txt`, `poetry.lock`, `Pipfile.lock`, and
-`uv.lock`, including nested projects in a monorepo.
-
-- Flags: `--staged`, `--json`, `--sarif`, `--output <file>`, `--no-decisions`.
-- Exit codes: 0 pass, 1 warn (strict mode upgrades warn to 2), 2 block,
-  4 analysis incomplete, 10 nothing to scan. JSON output carries a
-  `schemaVersion` field and sets `scannerUnavailable` when the scanner could
-  not be reached.
+## Verdicts and exit codes
 
-### dg sbom [path]
+Every result is one of three states the scanner returns: **PASS**, **WARN**, or
+**BLOCK**, and the exit code follows it. The server is the verdict source. The
+CLI never derives one from a local score, and if the scanner is unreachable it
+marks the report rather than passing silently.
 
-Inventories the resolved dependency tree as a CycloneDX 1.5 software bill of
-materials, with purl, license, and integrity hash per component. Reads the same
-lockfiles as `dg scan` plus `Cargo.lock`. In a terminal it streams
-BLOCK/WARN/PASS verdicts for npm and PyPI components when signed in; cargo stays
-inventory only. Piped, with `--output` (alias `-o`), or with `--json` it stays
-offline and prints the raw CycloneDX document.
-
-- Flags: `--output <path>` / `-o`, `--json`, `--reproducible` (byte-stable
-  output; honors `SOURCE_DATE_EPOCH`).
-
-### dg verify &lt;registry:package[@version] | path | lockfile&gt;
-
-Runs a real scanner check on a published package before you install it. Name
-the registry, `npm:react` or `pypi:requests`, with an optional `@version`
-(latest by default). Works signed out with a free verdict summary (the verdict,
-top reasons, provenance, and the package page link); signing in unlocks the
-full reason list, license info, `--json`, and `--output`. Verifying a local
-path, lockfile, or tarball stays free and offline.
-
-### dg licenses [path]
-
-SPDX license report for the dependency tree, grouped by risk. Use `--csv` or
-`--markdown` for CI artifacts and `--fail-on <risk>[,<risk>]` to exit non-zero
-when a dependency carries a named license-risk tier.
-
-### dg audit [path]
-
-Pre-publish check of a package of your own.
-Inspects exactly the resolved publish set of one package, never the whole repo.
-Basic checks run 100% locally and upload nothing: leaked secrets and keys,
-credential files, source maps, `.git`, terraform state, risky lifecycle
-scripts, and a missing `files` allowlist. On a paid plan, and if your org allows
-it, it also runs a deep behavioral scan: a packed copy is uploaded with no
-lifecycle scripts run, raw bytes are never retained, and only the verdict and
-redacted findings reach your dashboard.
+## Exit codes
 
-- Flags: `--local` (skip the upload), `--require-deep` (fail when deep can't
-  run), `--fail-on warn`.
-- Exit codes: 0 clean, 1 warn (with `--fail-on warn`), 2 block, 3 deep required
-  but unavailable, 4 analysis incomplete.
+The stable exit codes are `0` pass, `1` warn, `2` block,
+`4` analysis incomplete, `10` nothing to scan, and `70` unexpected CLI error.
+Some commands return `64` when a command unavailable or gated on this platform
+is requested. Machine-readable output includes a `schemaVersion` field so CI
+parsers can pin a contract.
 
-### dg setup
+### dg sbom
 
-Installs the shell shims so bare `npm install` / `pip install` are scanned, and
-the agent hooks, behind one consent screen. `--print` previews the exact write
-plan and changes nothing; `--yes` applies just the shell shims non-interactively
-(add `--agents` or `--guard-commit` for the others). Everything it writes is
-dg-owned and reversible with `dg uninstall`.
+`dg sbom [path]` inventories the resolved dependency tree as CycloneDX 1.5.
+Interactive terminals can show scanner verdicts for npm and PyPI components;
+`--json` or `--output` writes the raw SBOM for CI.
 
-### dg guard-commit
+### dg audit
 
-Installs a per-repo git pre-commit hook that scans the staged lockfile changes
-and blocks a commit that would add a malicious dependency. It chains any
-existing pre-commit hook and self-checks that git will fire it. Reverse with
-`dg guard-commit off`. `git commit --no-verify` is the override.
+`dg audit [path]` is a pre-publish check for a package of your own. Inspects exactly the resolved publish set of one package, never the whole repo. Basic checks run 100% locally. On paid plans, and only when enabled, deep behavioral
+analysis uploads a packed copy for scanning; raw bytes are not retained, and
+only verdict metadata plus redacted findings reach your dashboard.
 
 ### dg agents
 
-Routes AI coding agents' installs through the firewall with a native
-pre-command hook in each agent's own config, so a malicious or unresolvable
-package is blocked before it is fetched. Supported: Claude Code, Codex CLI,
-Cursor, Gemini CLI, GitHub Copilot CLI, and Windsurf. Bare `dg agents` lists
-each agent and whether it is protected; `dg agents on` hooks every detected
-agent (or one, `dg agents on claude-code`); `dg agents --check` verifies the
-wiring; `dg agents off` removes it. `dg hook claude-code` keeps working as an
-alias.
+`dg agents` installs or checks native pre-command hooks for supported AI coding
+agents so their package-manager calls route through the same install firewall.
+Run `dg agents --check` in CI or a workstation audit to verify the wiring.
 
-### dg decisions &lt;list | revoke&gt;
+### dg decisions
 
-Warn-level findings you accept at an install prompt or commit guard can be
-remembered in a committable `dg.json` at the project root, so repeat runs only
-surface new problems. A new finding category, a severity escalation, or a block
-always resurfaces; blocks can never be acknowledged away. `dg decisions list`
-shows what the project accepted; `dg decisions revoke` removes an entry.
+`dg decisions list` shows remembered warn-level decisions for the current
+project. `dg decisions revoke` removes one. Blocks can never be acknowledged
+away.
 
-### dg cooldown [&lt;age&gt; | off]
+### dg cooldown
 
-Quarantines new installs of a registry release younger than `cooldown.age`
-(default `24h`), since most malicious releases are caught within their first
-day. Change it with `dg cooldown 7d` or disable it with `dg cooldown off`.
-Lockfile scans are never failed by cooldown; packages you already depend on get
-a display annotation only. `dg cooldown exempt <name>` records a shareable
-exemption in `dg.json`.
+`dg cooldown` shows the effective new-release quarantine and exemptions.
+`dg cooldown exempt <name>` records a project exemption in `dg.json`; user-level
+`cooldown.exempt` applies everywhere.
 
-### dg config &lt;get | set | unset | list&gt;
+## In CI
 
-Views or edits user-global configuration in `~/.dg/config.json`. The everyday
-key is `policy.mode` (`off`, `warn`, `block` the default, or `strict`), which
-sets how a flagged package is handled. There is no detection-tuning knob;
-`policy.mode` changes only how a flagged package is handled, not what the
-scanner looks for.
+Set `DG_API_KEY` (a `dg_live_*` key from Settings -> CI keys) and run `dg scan`.
+The CLI auto-detects CI and switches to non-interactive output; add
+`--sarif -o dg.sarif` to write findings for upload. On GitHub, the
+[GitHub App](https://westbayberry.com/docs#github-app) is the zero-config path
+and posts a PR status check.
 
-### dg login / dg logout --yes
+## Privacy
 
-`dg login` signs in via your browser and links this machine to your account;
-`dg login --token dg_live_...` authenticates CI without the browser flow.
-Scanning works without an account. `dg logout --yes` removes the saved token
-from this machine (the token stays valid until you revoke it from the
-dashboard).
-
-### dg doctor
-
-Checks runtime, auth, API, policy, setup shims, PATH precedence, real-binary
-resolution, stale state, and service state. Every non-pass line ends with the
-exact fix command. `--json` for machine output.
-
-### dg service
-
-Service mode runs a persistent local proxy plus a managed certificate authority
-so installs are scanned continuously, for CI runners and private registries
-where a per-command proxy is not enough. A paid feature; run `dg login` first,
-then `dg service start`. Fully reversible with `dg uninstall --service`.
-
-### dg update
-
-Checks whether a newer CLI version is published and prints the exact
-`npm install -g` command to run. It never installs anything and never mutates
-the installed package; you run the printed command yourself. Alias: `dg upgrade`.
-
-### dg uninstall
-
-Removes registered dg-owned setup and service writes, state, cache, sessions,
-shims, and shell-rc sentinel blocks while preserving unrelated user content.
-Run it before `npm uninstall -g @westbayberry/dg`.
-
-## Exit codes
-
-Stable, so CI and shells can read them directly:
-
-| Code | Meaning |
-| --- | --- |
-| `0` | Clean. The requested action is allowed. |
-| `1` | Warn-level result (strict policy upgrades this to `2`). |
-| `2` | Block: a block-level package, a denied install, or an unknown command. |
-| `3` | `dg audit --require-deep` ran but the deep scan was unavailable. |
-| `4` | Analysis incomplete; not a clean pass. |
-| `10` | `dg scan` found nothing to scan. |
-| `64` | A usage error (bad flags or arguments). |
-| `69` | A command unavailable or gated on this platform, or a signed-out `dg verify` asking for `--json`/`--output`. |
-| `70` | Internal tool error (for example, a report file could not be written). |
-| `130` / `143` | Interrupted by SIGINT (Ctrl-C) or SIGTERM. |
+No telemetry, no crash reporter, no analytics. The CLI talks to the network only
+when a command needs it: scanning sends package names and versions from your
+lockfiles, and the scanner pulls the artifacts itself; the firewall sends each
+artifact's name, version, and SHA-256. Your source never leaves your machine.
+Detail: [westbayberry.com/docs/telemetry](https://westbayberry.com/docs/telemetry).
 
 ## What dg sends to the API
 
-The CLI sends no telemetry: no crash reporter and no analytics endpoint. It
-talks to the network only when a command needs it.
-
-- **Scanning** sends package names and pinned versions from your lockfiles to
-  the scan API, which pulls the actual package artifacts from the public
-  registry on its side. Your source never leaves your machine.
-- **The install firewall** asks the server for a verdict on each artifact as it
-  downloads: name, version, ecosystem, registry host, download URL, and the
-  artifact's SHA-256.
-- **Deep audit** (`dg audit`, opt-in, paid) uploads a packed copy of your own
-  package to `/v1/scan-tarball`; raw bytes are never retained.
-- **Version check** queries the public npm registry for `@westbayberry/dg` at
-  most once a day in an interactive terminal. Set `CI=1` to skip it.
+Authenticated scans send `DG_API_KEY` with package names, versions, ecosystem,
+registry host, lockfile integrity, and artifact hashes where available. Install
+firewall calls send the public package identity and artifact hash needed for a
+verdict. Source files, local paths, stack traces, and crash reports are not sent.
 
-Authenticate CI with `DG_API_KEY` (a `dg_live_*` or `dg_test_*` key;
-`DG_API_TOKEN` is an accepted alias). Full detail:
-[westbayberry.com/docs/telemetry](https://westbayberry.com/docs/telemetry).
-
-## Use in CI
+## Development
 
 ```bash
-npm install -g @westbayberry/dg
-export DG_API_KEY="dg_live_..."   # from Settings -> CI keys
-dg scan
+git clone https://github.com/WestBayBerry/DG_CLI.git
+cd DG_CLI
+npm install
+npm run build
+npm test
 ```
 
-A non-zero exit means a block-level finding; wire that into your pipeline's
-pass/fail. The CLI auto-detects CI and switches to non-interactive output; pass
-`--json` or `--sarif` when a parser reads stdout. On GitHub, the
-[GitHub App](https://westbayberry.com/docs#github-app) is the simpler path and
-posts a required PR status check.
+Requires Node.js >= 22.14. Run the built CLI from source with
+`node dist/bin/dg.js --help`, and `npm run check` for typecheck, lint, and
+format checks. Issues and pull requests are welcome.
 
 ## Documentation
 
 - [Getting started](https://westbayberry.com/docs)
-- [CLI reference](https://westbayberry.com/docs/cli-reference)
+- [CLI reference](https://westbayberry.com/docs/cli-reference): every command, flag, and exit code
 - [Blocking behavior](https://westbayberry.com/docs/blocking)
 - [Integrations](https://westbayberry.com/docs/integrations)
 - [Telemetry](https://westbayberry.com/docs/telemetry)
@@ -284,5 +172,4 @@ rather than a public issue.
 
 ## License
 
-Apache-2.0. See [LICENSE](./LICENSE). Issues and pull requests are welcome at
-[github.com/WestBayBerry/DG_CLI](https://github.com/WestBayBerry/DG_CLI).
+Apache-2.0. See [LICENSE](./LICENSE).

package/dist/agents/copilot-cli.js

@@ -81,10 +81,15 @@ function emitDecision(verdict) {
     if (verdict.decision === "allow") {
         return { stdout: "{}", exitCode: 0 };
     }
+    // Copilot's permissionDecision has no safe human-review value, so a defer
+    // ("ask") hardens to "deny" rather than riding through as an unrecognized
+    // decision the host may auto-approve — matches codex/gemini/windsurf.
+    const suffix = verdict.decision === "ask" ? " (dg flagged this for human review — not auto-approved)" : "";
+    const reason = `${verdict.reason ?? "Dependency Guardian firewall"}${suffix}`;
     return {
         stdout: JSON.stringify({
-            permissionDecision: verdict.decision,
-            ...(verdict.reason ? { permissionDecisionReason: verdict.reason } : {}),
+            permissionDecision: "deny",
+            permissionDecisionReason: reason,
         }),
         exitCode: 0,
     };

package/dist/agents/persistence.js

@@ -1,6 +1,7 @@
 import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { dirname } from "node:path";
+import { homedir } from "node:os";
+import { dirname, sep } from "node:path";
 import { randomBytes } from "node:crypto";
 import { readCleanupRegistry, recordCleanupEntry, removeCleanupEntry, } from "../state/index.js";
 export const LEGACY_AGENT_HOOK_SENTINEL = "dg-agent-hook-v1";
@@ -35,6 +36,33 @@ function assertSafeNode(path, role) {
         throw new AgentHookError(`${path} (${role}) is world-writable; refusing to write to it. Tighten its permissions, then retry.`);
     }
 }
+// The recursive mkdir below follows a symlinked INTERMEDIATE component (e.g. a
+// pre-planted ~/.codeium for the 2-deep windsurf config) before the leaf+parent
+// safety check runs, redirecting the write outside the user tree. Reject any
+// symlink component strictly BELOW the user's home — anchored at homedir() so a
+// legitimately symlinked / networked home is not flagged.
+function assertNoSymlinkBelowHome(target) {
+    const home = homedir();
+    if (!home) {
+        return;
+    }
+    let dir = dirname(target);
+    let prev = "";
+    while (dir !== prev && dir.startsWith(`${home}${sep}`)) {
+        try {
+            if (lstatSync(dir).isSymbolicLink()) {
+                throw new AgentHookError(`${dir} is a symlink; refusing to create or write through it. Replace it with a real directory, then retry.`);
+            }
+        }
+        catch (error) {
+            if (error instanceof AgentHookError) {
+                throw error;
+            }
+        }
+        prev = dir;
+        dir = dirname(dir);
+    }
+}
 export function assertSafeWriteTarget(path) {
     assertSafeNode(dirname(path), "directory");
     assertSafeNode(path, "file");
@@ -55,11 +83,14 @@ export function readSettings(path) {
     }
     return { settings: parsed, existed: true };
 }
-export function writeSettingsAtomic(path, settings) {
+export function writeFileAtomicSafe(path, content) {
+    // BEFORE the recursive mkdir (which would follow a symlinked intermediate),
+    // reject any symlink component below home; then validate the leaf + parent.
+    assertNoSymlinkBelowHome(path);
     mkdirSync(dirname(path), { recursive: true });
     assertSafeWriteTarget(path);
     const tmp = `${path}.dg-${randomBytes(6).toString("hex")}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    writeFileSync(tmp, content, { mode: 0o600, flag: "wx" });
     try {
         renameSync(tmp, path);
     }
@@ -68,6 +99,9 @@ export function writeSettingsAtomic(path, settings) {
         throw error;
     }
 }
+export function writeSettingsAtomic(path, settings) {
+    writeFileAtomicSafe(path, `${JSON.stringify(settings, null, 2)}\n`);
+}
 async function wasCreatedByDg(ctx) {
     try {
         const reg = await readCleanupRegistry(ctx.paths);
@@ -99,13 +133,18 @@ async function removeHookEntries(ctx, legacySentinels) {
         await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel });
     }
 }
-function findHookCommand(node, signature) {
+function findHookCommand(node, signature, depth = 0) {
+    // Bound the recursion so a deeply-nested (hand-crafted or corrupt) settings
+    // file can't blow the stack and crash the status/verify command.
+    if (depth > 512) {
+        return null;
+    }
     if (typeof node === "string") {
         return node.includes(signature) ? node : null;
     }
     if (Array.isArray(node)) {
         for (const value of node) {
-            const found = findHookCommand(value, signature);
+            const found = findHookCommand(value, signature, depth + 1);
             if (found) {
                 return found;
             }
@@ -114,7 +153,7 @@ function findHookCommand(node, signature) {
     }
     if (node && typeof node === "object") {
         for (const value of Object.values(node)) {
-            const found = findHookCommand(value, signature);
+            const found = findHookCommand(value, signature, depth + 1);
             if (found) {
                 return found;
             }
@@ -123,14 +162,50 @@ function findHookCommand(node, signature) {
     }
     return null;
 }
+// Tokenize a rendered hook-command head, honoring the surrounding quotes
+// defaultDgCommand adds around the absolute dg path. Without this the leading
+// `"` keeps every token from matching startsWith("/"), so the broken-path check
+// silently always passes.
+function shellHeadTokens(head) {
+    const tokens = [];
+    const s = head.trim();
+    let i = 0;
+    while (i < s.length) {
+        while (i < s.length && /\s/.test(s[i] ?? "")) {
+            i += 1;
+        }
+        if (i >= s.length) {
+            break;
+        }
+        const quote = s[i];
+        if (quote === '"' || quote === "'") {
+            const end = s.indexOf(quote, i + 1);
+            if (end < 0) {
+                tokens.push(s.slice(i + 1));
+                break;
+            }
+            const inner = s.slice(i + 1, end);
+            tokens.push(quote === '"' ? inner.replace(/\\(["\\$`])/g, "$1") : inner);
+            i = end + 1;
+        }
+        else {
+            let j = i;
+            while (j < s.length && !/\s/.test(s[j] ?? "")) {
+                j += 1;
+            }
+            tokens.push(s.slice(i, j));
+            i = j;
+        }
+    }
+    return tokens;
+}
 function hookResolvesCheck(settings, agent) {
     const command = findHookCommand(settings, `hook-exec ${agent}`);
     if (!command) {
         return null;
     }
     const head = command.split(/\s+hook-exec\s+/)[0] ?? command;
-    const broken = head
-        .split(/\s+/)
+    const broken = shellHeadTokens(head)
         .filter((token) => token.startsWith("/"))
         .filter((token) => !existsSync(token));
     return {

package/dist/agents/registry.js

@@ -1,5 +1,6 @@
 import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
+import { escapeDoubleQuotedSh } from "../util/sh-escape.js";
 import { resolveDgPaths } from "../state/index.js";
 import { claudeCodeIntegration } from "./claude-code.js";
 import { codexIntegration } from "./codex.js";
@@ -39,8 +40,10 @@ export function defaultDgCommand(agent) {
     }
     // Run the dg script via its own shebang rather than baking process.execPath:
     // a version-pinned node path (e.g. .../Cellar/node/<ver>/bin/node) vanishes on
-    // a node upgrade and would silently disable the hook.
-    return `${bin} ${agentHookSignature(agent)}`;
+    // a node upgrade and would silently disable the hook. Quote the path — the
+    // agent runs this string through a shell, so a space or shell metachar in the
+    // install path would otherwise word-split or command-substitute.
+    return `"${escapeDoubleQuotedSh(bin)}" ${agentHookSignature(agent)}`;
 }
 export function resolveAgentHookContext(agent, options = {}) {
     const env = options.env ?? process.env;

package/dist/agents/routing.js

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { buildAgentRoutingEnv } from "../launcher/env.js";
 import { readServiceState } from "../service/state.js";
 import { resolveDgPaths } from "../state/index.js";
-import { readSettings, writeSettingsAtomic } from "./persistence.js";
+import { readSettings, writeSettingsAtomic, writeFileAtomicSafe } from "./persistence.js";
 import { getAgent } from "./registry.js";
 // The agent's install hook screens statically; this routes the agent's ACTUAL
 // fetches through dg's proxy so a wrapped/dynamic install (eval, $VAR, python -m
@@ -29,30 +29,47 @@ function stripCodexBlock(content) {
     const block = new RegExp(`\\n?${escapeRegex(CODEX_BEGIN)}[\\s\\S]*?${escapeRegex(CODEX_END)}\\n?`, "g");
     return content.replace(block, "\n").replace(/\n{3,}/g, "\n\n");
 }
+function loadBackupPrior(backup) {
+    if (!existsSync(backup)) {
+        return {};
+    }
+    try {
+        return JSON.parse(readFileSync(backup, "utf8")).prior ?? {};
+    }
+    catch {
+        return {};
+    }
+}
 function applyClaudeRouting(settingsPath, routing, backup) {
     const { settings } = readSettings(settingsPath);
     const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
-    const prior = {};
+    // The backup must hold the user's PRE-dg values so removal can restore them. On
+    // a re-apply the `k in prior` guard preserves the snapshot captured on first
+    // apply, so dg's own values are never recorded as the user's prior. We only
+    // collapse a value that exactly equals what dg is writing now — never one that
+    // merely *looks* like dg's (a loopback host), which would silently delete the
+    // user's own local proxy / CA on `dg agents off`.
+    const prior = loadBackupPrior(backup);
     for (const [k, v] of Object.entries(routing)) {
-        prior[k] = k in envObj ? String(envObj[k]) : null;
+        if (!(k in prior)) {
+            const current = k in envObj ? String(envObj[k]) : null;
+            prior[k] = current === v ? null : current;
+        }
         envObj[k] = v;
     }
-    settings.env = envObj;
-    writeSettingsAtomic(settingsPath, settings);
+    // Write the restore backup BEFORE mutating the agent settings: an IO failure on
+    // the settings write then leaves a recoverable state, never settings routed
+    // through dg with no backup to undo them.
     mkdirSync(dirname(backup), { recursive: true, mode: 0o700 });
     writeFileSync(backup, `${JSON.stringify({ kind: "claude-env", path: settingsPath, prior }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    settings.env = envObj;
+    writeSettingsAtomic(settingsPath, settings);
 }
 function removeClaudeRouting(settingsPath, backup) {
     if (!existsSync(backup)) {
         return;
     }
-    let prior = {};
-    try {
-        prior = JSON.parse(readFileSync(backup, "utf8")).prior ?? {};
-    }
-    catch {
-        prior = {};
-    }
+    const prior = loadBackupPrior(backup);
     if (existsSync(settingsPath)) {
         const { settings } = readSettings(settingsPath);
         const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
@@ -82,14 +99,14 @@ function applyCodexRouting(configPath, routing) {
     const set = Object.entries(routing).map(([k, v]) => `${k} = ${JSON.stringify(v)}`).join(", ");
     const block = `${CODEX_BEGIN}\n[shell_environment_policy]\nset = { ${set} }\n${CODEX_END}\n`;
     const next = content === "" || content.endsWith("\n") ? `${content}${block}` : `${content}\n${block}`;
-    writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    writeFileAtomicSafe(configPath, next);
     return { applied: true, detail: configPath };
 }
 function removeCodexRouting(configPath) {
     if (!existsSync(configPath)) {
         return;
     }
-    writeFileSync(configPath, stripCodexBlock(readFileSync(configPath, "utf8")), { encoding: "utf8" });
+    writeFileAtomicSafe(configPath, stripCodexBlock(readFileSync(configPath, "utf8")));
 }
 function codexConfigPath(home) {
     return join(home, ".codex", "config.toml");