@westbayberry/dg 2.3.2 → 2.3.4

package/dist/standalone/uninstall.mjs

@@ -3,6 +3,20 @@ var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
+// dist.next/presentation/theme.js
+var init_theme = __esm({
+  "dist.next/presentation/theme.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/util/sh-escape.js
+var init_sh_escape = __esm({
+  "dist.next/util/sh-escape.js"() {
+    "use strict";
+  }
+});
+
 // dist.next/state/store.js
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
@@ -62,8 +76,9 @@ var init_store = __esm({
 });
 
 // dist.next/state/locks.js
-import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { mkdir as mkdir2, open, readFile as readFile2, rename as rename2, rm as rm2, stat } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { closeSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { link, mkdir as mkdir2, open, readFile as readFile2, rename as rename2, rm as rm2, stat } from "node:fs/promises";
 import { join } from "node:path";
 function isErrno(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
@@ -75,25 +90,33 @@ async function acquireLock(paths, name, options = {}) {
     mode: 448
   });
   const path = join(paths.locksDir, `${name}.lock`);
-  await removeStaleLock(path, options);
-  let handle;
-  try {
-    handle = await open(path, "wx", 384);
-  } catch (error) {
-    if (isErrno(error, "EEXIST")) {
-      throw new LockBusyError(path);
-    }
-    throw error;
-  }
-  const metadata = {
-    pid: process.pid,
-    acquiredAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString()
-  };
+  const reclaim = await acquireReclaimLock(path);
   try {
-    await handle.writeFile(`${JSON.stringify(metadata)}
+    await removeStaleLock(path, options);
+    const metadata = {
+      pid: process.pid,
+      acquiredAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString()
+    };
+    const tmpPath = `${path}.new-${process.pid}-${++createCounter}`;
+    const handle = await open(tmpPath, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify(metadata)}
 `, "utf8");
+    } finally {
+      await handle.close();
+    }
+    try {
+      await link(tmpPath, path);
+    } catch (error) {
+      await rm2(tmpPath, { force: true });
+      if (isErrno(error, "EEXIST")) {
+        throw new LockBusyError(path);
+      }
+      throw error;
+    }
+    await rm2(tmpPath, { force: true });
   } finally {
-    await handle.close();
+    await releaseReclaimLock(path, reclaim);
   }
   return {
     name,
@@ -112,25 +135,33 @@ function acquireLockSync(paths, name, options = {}) {
     mode: 448
   });
   const path = join(paths.locksDir, `${name}.lock`);
-  removeStaleLockSync(path, options);
-  let fd;
+  const reclaim = acquireReclaimLockSync(path);
   try {
-    fd = openSync(path, "wx", 384);
-  } catch (error) {
-    if (isErrno(error, "EEXIST")) {
-      throw new LockBusyError(path);
-    }
-    throw error;
-  }
-  const metadata = {
-    pid: process.pid,
-    acquiredAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString()
-  };
-  try {
-    writeFileSync(fd, `${JSON.stringify(metadata)}
+    removeStaleLockSync(path, options);
+    const metadata = {
+      pid: process.pid,
+      acquiredAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString()
+    };
+    const tmpPath = `${path}.new-${process.pid}-${++createCounter}`;
+    const fd = openSync(tmpPath, "wx", 384);
+    try {
+      writeFileSync(fd, `${JSON.stringify(metadata)}
 `, "utf8");
+    } finally {
+      closeSync(fd);
+    }
+    try {
+      linkSync(tmpPath, path);
+    } catch (error) {
+      rmSync(tmpPath, { force: true });
+      if (isErrno(error, "EEXIST")) {
+        throw new LockBusyError(path);
+      }
+      throw error;
+    }
+    rmSync(tmpPath, { force: true });
   } finally {
-    closeSync(fd);
+    releaseReclaimLockSync(path, reclaim);
   }
   return {
     name,
@@ -142,6 +173,26 @@ function acquireLockSync(paths, name, options = {}) {
     }
   };
 }
+async function acquireLockWithRetry(paths, name, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 5e3);
+  const acquireOptions = {
+    ...options.staleMs !== void 0 ? { staleMs: options.staleMs } : {},
+    ...options.now !== void 0 ? { now: options.now } : {}
+  };
+  for (; ; ) {
+    try {
+      return await acquireLock(paths, name, acquireOptions);
+    } catch (error) {
+      if (!(error instanceof LockBusyError) || Date.now() + LOCK_RETRY_DELAY_MS > deadline) {
+        throw error;
+      }
+      await new Promise((resolve2) => {
+        const timer = setTimeout(resolve2, LOCK_RETRY_DELAY_MS);
+        timer.unref?.();
+      });
+    }
+  }
+}
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -172,6 +223,10 @@ async function removeStaleLock(path, options) {
     }
     content = null;
   }
+  if (content !== null && content.trim() === "") {
+    await takeoverLock(path);
+    return;
+  }
   const holder = content === null ? "unknown" : holderStateFromContent(content);
   if (holder === "alive") {
     return;
@@ -208,6 +263,10 @@ function removeStaleLockSync(path, options) {
     }
     content = null;
   }
+  if (content !== null && content.trim() === "") {
+    takeoverLockSync(path);
+    return;
+  }
   const holder = content === null ? "unknown" : holderStateFromContent(content);
   if (holder === "alive") {
     return;
@@ -262,17 +321,141 @@ function takeoverLockSync(path) {
     force: true
   });
 }
+function reclaimLockPath(path) {
+  return `${path}.takeover`;
+}
+function reclaimToken() {
+  return `${process.pid}-${++reclaimCounter}-${randomBytes(8).toString("hex")}`;
+}
+function acquireReclaimLockSync(path) {
+  const metaPath = reclaimLockPath(path);
+  const token = reclaimToken();
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const fd = openSync(metaPath, "wx", 384);
+      writeFileSync(fd, token, "utf8");
+      return { fd, token };
+    } catch (error) {
+      if (!isErrno(error, "EEXIST")) {
+        throw error;
+      }
+      if (!reclaimStaleMetaLockSync(metaPath)) {
+        throw new LockBusyError(path);
+      }
+    }
+  }
+  throw new LockBusyError(path);
+}
+function reclaimStaleMetaLockSync(metaPath) {
+  let details;
+  try {
+    details = statSync(metaPath);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) {
+      return true;
+    }
+    throw error;
+  }
+  if (Date.now() - details.mtimeMs < META_LOCK_STALE_MS) {
+    return false;
+  }
+  const stalePath = `${metaPath}.stale-${process.pid}-${++takeoverCounter}`;
+  try {
+    renameSync(metaPath, stalePath);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) {
+      return true;
+    }
+    throw error;
+  }
+  rmSync(stalePath, { force: true });
+  return true;
+}
+function releaseReclaimLockSync(path, reclaim) {
+  closeSync(reclaim.fd);
+  ownerCheckedRemoveSync(reclaimLockPath(path), reclaim.token);
+}
+function ownerCheckedRemoveSync(metaPath, token) {
+  let content;
+  try {
+    content = readFileSync(metaPath, "utf8");
+  } catch {
+    return;
+  }
+  if (content === token) {
+    rmSync(metaPath, { force: true });
+  }
+}
+async function acquireReclaimLock(path) {
+  const metaPath = reclaimLockPath(path);
+  const token = reclaimToken();
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const handle = await open(metaPath, "wx", 384);
+      await handle.writeFile(token, "utf8");
+      return { handle, token };
+    } catch (error) {
+      if (!isErrno(error, "EEXIST")) {
+        throw error;
+      }
+      if (!await reclaimStaleMetaLock(metaPath)) {
+        throw new LockBusyError(path);
+      }
+    }
+  }
+  throw new LockBusyError(path);
+}
+async function reclaimStaleMetaLock(metaPath) {
+  let details;
+  try {
+    details = await stat(metaPath);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) {
+      return true;
+    }
+    throw error;
+  }
+  if (Date.now() - details.mtimeMs < META_LOCK_STALE_MS) {
+    return false;
+  }
+  const stalePath = `${metaPath}.stale-${process.pid}-${++takeoverCounter}`;
+  try {
+    await rename2(metaPath, stalePath);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) {
+      return true;
+    }
+    throw error;
+  }
+  await rm2(stalePath, { force: true });
+  return true;
+}
+async function releaseReclaimLock(path, reclaim) {
+  await reclaim.handle.close();
+  const metaPath = reclaimLockPath(path);
+  let content;
+  try {
+    content = await readFile2(metaPath, "utf8");
+  } catch {
+    return;
+  }
+  if (content === reclaim.token) {
+    await rm2(metaPath, { force: true });
+  }
+}
 function assertLockName(name) {
   if (!/^[a-z][a-z0-9-]{0,63}$/.test(name)) {
     throw new Error(`Invalid dg lock name: ${name}`);
   }
 }
-var CLEANUP_REGISTRY_LOCK, takeoverCounter, LockBusyError;
+var CLEANUP_REGISTRY_LOCK, takeoverCounter, createCounter, reclaimCounter, LockBusyError, LOCK_RETRY_DELAY_MS, META_LOCK_STALE_MS;
 var init_locks = __esm({
   "dist.next/state/locks.js"() {
     "use strict";
     CLEANUP_REGISTRY_LOCK = "cleanup-registry";
     takeoverCounter = 0;
+    createCounter = 0;
+    reclaimCounter = 0;
     LockBusyError = class extends Error {
       path;
       constructor(path) {
@@ -281,6 +464,8 @@ var init_locks = __esm({
         this.name = "LockBusyError";
       }
     };
+    LOCK_RETRY_DELAY_MS = 25;
+    META_LOCK_STALE_MS = 3e3;
   }
 });
 
@@ -321,7 +506,10 @@ async function writeCleanupRegistry(paths, registry) {
   await writeJsonFileAtomic(paths.cleanupRegistryPath, registry);
 }
 async function recordCleanupEntry(paths, entry) {
-  const lock = await acquireLock(paths, CLEANUP_REGISTRY_LOCK);
+  const lock = await acquireLockWithRetry(paths, CLEANUP_REGISTRY_LOCK, {
+    staleMs: CLEANUP_REGISTRY_LOCK_STALE_MS,
+    timeoutMs: CLEANUP_REGISTRY_LOCK_TIMEOUT_MS
+  });
   try {
     const { registry } = await loadCleanupRegistry(paths);
     const nextEntry = {
@@ -341,7 +529,10 @@ async function recordCleanupEntry(paths, entry) {
   }
 }
 async function removeCleanupEntry(paths, target) {
-  const lock = await acquireLock(paths, CLEANUP_REGISTRY_LOCK);
+  const lock = await acquireLockWithRetry(paths, CLEANUP_REGISTRY_LOCK, {
+    staleMs: CLEANUP_REGISTRY_LOCK_STALE_MS,
+    timeoutMs: CLEANUP_REGISTRY_LOCK_TIMEOUT_MS
+  });
   try {
     const { registry } = await loadCleanupRegistry(paths);
     const next = {
@@ -390,11 +581,14 @@ function isEnoent(error) {
 function sameRegistryTarget(left, right) {
   return left.kind === right.kind && left.path === right.path && left.sentinel === right.sentinel;
 }
+var CLEANUP_REGISTRY_LOCK_STALE_MS, CLEANUP_REGISTRY_LOCK_TIMEOUT_MS;
 var init_cleanup_registry = __esm({
   "dist.next/state/cleanup-registry.js"() {
     "use strict";
     init_store();
     init_locks();
+    CLEANUP_REGISTRY_LOCK_STALE_MS = 30 * 60 * 1e3;
+    CLEANUP_REGISTRY_LOCK_TIMEOUT_MS = 5e3;
   }
 });
 
@@ -442,6 +636,7 @@ var init_cooldown_held = __esm({
   "dist.next/state/cooldown-held.js"() {
     "use strict";
     init_json_file();
+    init_locks();
     init_paths();
     UNKNOWN_ELIGIBILITY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
   }
@@ -480,7 +675,7 @@ function findStaleSessionsSync(paths, options) {
       }
       throw error;
     }
-    if (now - details.mtimeMs >= options.olderThanMs) {
+    if (now - details.mtimeMs >= options.olderThanMs && !sessionWorkerAlive(dir)) {
       stale.push(entry.name);
     }
   }
@@ -488,6 +683,16 @@ function findStaleSessionsSync(paths, options) {
     stale
   };
 }
+function sessionWorkerAlive(dir) {
+  let raw;
+  try {
+    raw = readFileSync2(join3(dir, "pid"), "utf8");
+  } catch {
+    return false;
+  }
+  const pid = Number.parseInt(raw.trim(), 10);
+  return Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);
+}
 function sweepStaleSessionsSync(paths, options) {
   const report = findStaleSessionsSync(paths, options);
   for (const id of report.stale) {
@@ -530,7 +735,7 @@ var init_state = __esm({
 });
 
 // dist.next/config/settings.js
-var CONFIG_KEYS, DEFAULT_CONFIG;
+var CONFIG_KEYS, DEFAULT_CONFIG, VENDOR_API_HOST;
 var init_settings = __esm({
   "dist.next/config/settings.js"() {
     "use strict";
@@ -545,8 +750,10 @@ var init_settings = __esm({
       "policy.scriptHardening",
       "policy.shimFailClosed",
       "policy.strictEgress",
+      "policy.allowNonVendorApiHost",
+      "policy.provenanceDowngrade",
       "scriptGate.mode",
-      "scriptGate.observe",
+      "scriptGate.persistObservations",
       "gitHook.onWarn",
       "gitHook.onIncomplete",
       "cooldown.age",
@@ -571,11 +778,13 @@ var init_settings = __esm({
         allowForceOverride: true,
         scriptHardening: false,
         shimFailClosed: false,
-        strictEgress: false
+        strictEgress: false,
+        allowNonVendorApiHost: false,
+        provenanceDowngrade: "off"
       },
       scriptGate: {
         mode: "observe",
-        observe: false
+        persistObservations: false
       },
       gitHook: {
         onWarn: "prompt",
@@ -593,182 +802,401 @@ var init_settings = __esm({
         upload: false
       }
     });
+    VENDOR_API_HOST = new URL(DEFAULT_CONFIG.api.baseUrl).hostname;
   }
 });
 
-// dist.next/launcher/resolve-real-binary.js
-var init_resolve_real_binary = __esm({
-  "dist.next/launcher/resolve-real-binary.js"() {
+// dist.next/security/sanitize.js
+import { stripVTControlCharacters } from "node:util";
+function sanitizeLine(s) {
+  return stripVTControlCharacters(s).replace(/[\r\n]+/g, " ").replace(CTRL_ALL, "").replace(INVISIBLE_GLOBAL, "");
+}
+var CTRL_ALL, INVISIBLE_UNICODE_RE, INVISIBLE_GLOBAL;
+var init_sanitize = __esm({
+  "dist.next/security/sanitize.js"() {
     "use strict";
-    init_state();
+    CTRL_ALL = /[\x00-\x1F\x7F-\x9F]/g;
+    INVISIBLE_UNICODE_RE = /[\u200B-\u200F\u2060-\u2064\u202A-\u202E\u2066-\u2069\u061C\uFEFF]/u;
+    INVISIBLE_GLOBAL = new RegExp(INVISIBLE_UNICODE_RE.source, "gu");
   }
 });
 
-// dist.next/launcher/spawn-invocation.js
-var init_spawn_invocation = __esm({
-  "dist.next/launcher/spawn-invocation.js"() {
+// dist.next/auth/env-token.js
+var init_env_token = __esm({
+  "dist.next/auth/env-token.js"() {
     "use strict";
   }
 });
 
-// dist.next/service/trust-store.js
-var init_trust_store = __esm({
-  "dist.next/service/trust-store.js"() {
+// dist.next/auth/store.js
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename, dirname as dirname2, join as join4 } from "node:path";
+function authPath(paths) {
+  return join4(paths.configDir, "auth.json");
+}
+function clearAuthState(env = process.env) {
+  const path = authPath(resolveDgPaths(env));
+  sweepOrphanAuthTemps(path);
+  if (!existsSync(path)) {
+    return false;
+  }
+  unlinkSync(path);
+  return true;
+}
+function sweepOrphanAuthTemps(path) {
+  const dir = dirname2(path);
+  const base = basename(path);
+  const pattern = new RegExp(`^${base.replace(/[.]/g, "\\.")}\\.\\d+\\.[0-9a-f-]{36}\\.tmp$`);
+  try {
+    for (const entry of readdirSync2(dir)) {
+      if (pattern.test(entry)) {
+        try {
+          unlinkSync(join4(dir, entry));
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+var init_store2 = __esm({
+  "dist.next/auth/store.js"() {
     "use strict";
-    init_json_file();
+    init_settings();
+    init_state();
+    init_sanitize();
+    init_env_token();
   }
 });
 
-// dist.next/service/trust-refresh.js
-var init_trust_refresh = __esm({
-  "dist.next/service/trust-refresh.js"() {
+// dist.next/commands/version.js
+var init_version = __esm({
+  "dist.next/commands/version.js"() {
     "use strict";
-    init_trust_store();
   }
 });
 
-// dist.next/service/state.js
-var SERVICE_LOCK_STALE_MS;
-var init_state2 = __esm({
-  "dist.next/service/state.js"() {
+// dist.next/api/analyze.js
+var BATCH_CONCURRENCY, MAX_STREAM_LINE_BYTES;
+var init_analyze = __esm({
+  "dist.next/api/analyze.js"() {
     "use strict";
+    init_store2();
+    init_env_token();
     init_settings();
-    init_trust_store();
-    init_trust_refresh();
-    init_state();
-    SERVICE_LOCK_STALE_MS = 30 * 60 * 1e3;
+    init_sanitize();
+    init_version();
+    BATCH_CONCURRENCY = Math.max(1, Number(process.env.DG_ANALYZE_CONCURRENCY) || 4);
+    MAX_STREAM_LINE_BYTES = 32 * 1024 * 1024;
   }
 });
 
-// dist.next/setup/uninstall-standalone.js
-import { rmSync as rmSync5 } from "node:fs";
-import { join as join11 } from "node:path";
-
-// dist.next/setup/plan.js
-import { accessSync, constants, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, realpathSync, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename, delimiter, dirname as dirname3, join as join10, resolve, sep } from "node:path";
-import { randomBytes as randomBytes2 } from "node:crypto";
-
-// dist.next/agents/registry.js
-init_state();
-
-// dist.next/agents/claude-code.js
-import { join as join4 } from "node:path";
-
-// dist.next/auth/store.js
-init_settings();
-init_state();
-
-// dist.next/api/analyze.js
-init_settings();
-
-// dist.next/security/sanitize.js
-import { stripVTControlCharacters } from "node:util";
-var CTRL_ALL = /[\x00-\x1F\x7F-\x9F]/g;
-function sanitizeLine(s) {
-  return stripVTControlCharacters(s).replace(/[\r\n]+/g, " ").replace(CTRL_ALL, "");
-}
-
-// dist.next/api/analyze.js
-init_state();
-var BATCH_CONCURRENCY = Math.max(1, Number(process.env.DG_ANALYZE_CONCURRENCY) || 4);
-
 // dist.next/setup/optional-support.js
-var OPTIONAL_SUPPORT_GATES = Object.freeze([
-  {
-    id: "windows",
-    label: "Windows support",
-    kind: "platform",
-    status: "unclaimed",
-    message: "Windows support is gated in this release; use dg prefix mode from a supported POSIX shell or run 'dg --help' for supported commands"
-  },
-  {
-    id: "python-hook",
-    label: "Python .pth hook",
-    kind: "hook",
-    status: "unclaimed",
-    message: "Python .pth hook support is gated in this release; use 'dg pip ...', 'dg pipx ...', 'dg uv ...', or 'dg uvx ...' prefix mode instead"
-  },
-  {
-    id: "bun",
-    label: "Bun and bunx",
-    kind: "package-manager",
-    status: "unclaimed",
-    standaloneCommand: true,
-    message: "Bun support is gated in this release; use 'dg npm ...', 'dg pnpm ...', or 'dg yarn ...' for supported JavaScript installs"
-  },
-  {
-    id: "yarn-berry",
-    label: "Yarn Berry",
-    kind: "package-manager",
-    status: "unclaimed",
-    standaloneCommand: false,
-    message: "Yarn Berry support is gated in this release; use Yarn classic through 'dg yarn ...' or another supported prefix manager"
-  },
-  {
-    id: "conda",
-    label: "Conda",
-    kind: "package-manager",
-    status: "unclaimed",
-    standaloneCommand: true,
-    message: "Conda support is gated in this release; use 'dg pip ...' or 'dg uv ...' for supported Python package installs"
-  },
-  {
-    id: "mamba",
-    label: "Mamba",
-    kind: "package-manager",
-    status: "unclaimed",
-    standaloneCommand: true,
-    message: "Mamba support is gated in this release; use 'dg pip ...' or 'dg uv ...' for supported Python package installs"
-  }
-]);
 function optionalPackageManagerNames() {
   return OPTIONAL_SUPPORT_GATES.filter((gate) => gate.kind === "package-manager" && gate.standaloneCommand === true).map((gate) => gate.id);
 }
+var OPTIONAL_SUPPORT_GATES;
+var init_optional_support = __esm({
+  "dist.next/setup/optional-support.js"() {
+    "use strict";
+    OPTIONAL_SUPPORT_GATES = Object.freeze([
+      {
+        id: "windows",
+        label: "Windows support",
+        kind: "platform",
+        status: "unclaimed",
+        message: "Windows support is gated in this release; use dg prefix mode from a supported POSIX shell or run 'dg --help' for supported commands"
+      },
+      {
+        id: "python-hook",
+        label: "Python .pth hook",
+        kind: "hook",
+        status: "unclaimed",
+        message: "Python .pth hook support is gated in this release; use 'dg pip ...', 'dg pipx ...', 'dg uv ...', or 'dg uvx ...' prefix mode instead"
+      },
+      {
+        id: "bun",
+        label: "Bun and bunx",
+        kind: "package-manager",
+        status: "unclaimed",
+        standaloneCommand: true,
+        message: "Bun support is gated in this release; use 'dg npm ...', 'dg pnpm ...', or 'dg yarn ...' for supported JavaScript installs"
+      },
+      {
+        id: "yarn-berry",
+        label: "Yarn Berry",
+        kind: "package-manager",
+        status: "unclaimed",
+        standaloneCommand: false,
+        message: "Yarn Berry support is gated in this release; use Yarn classic through 'dg yarn ...' or another supported prefix manager"
+      },
+      {
+        id: "conda",
+        label: "Conda",
+        kind: "package-manager",
+        status: "unclaimed",
+        standaloneCommand: true,
+        message: "Conda support is gated in this release; use 'dg pip ...' or 'dg uv ...' for supported Python package installs"
+      },
+      {
+        id: "mamba",
+        label: "Mamba",
+        kind: "package-manager",
+        status: "unclaimed",
+        standaloneCommand: true,
+        message: "Mamba support is gated in this release; use 'dg pip ...' or 'dg uv ...' for supported Python package installs"
+      }
+    ]);
+  }
+});
 
 // dist.next/launcher/classify.js
-var gatedManagers = optionalPackageManagerNames();
+var gatedManagers;
+var init_classify = __esm({
+  "dist.next/launcher/classify.js"() {
+    "use strict";
+    init_optional_support();
+    gatedManagers = optionalPackageManagerNames();
+  }
+});
 
-// dist.next/verify/preflight.js
-init_settings();
+// dist.next/presentation/provenance.js
+var init_provenance = __esm({
+  "dist.next/presentation/provenance.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/presentation/safe-version.js
+var init_safe_version = __esm({
+  "dist.next/presentation/safe-version.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/presentation/package-page.js
+var init_package_page = __esm({
+  "dist.next/presentation/package-page.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/presentation/mode.js
+var init_mode = __esm({
+  "dist.next/presentation/mode.js"() {
+    "use strict";
+  }
+});
 
 // dist.next/audit/events.js
-init_state();
+var init_events = __esm({
+  "dist.next/audit/events.js"() {
+    "use strict";
+    init_state();
+  }
+});
 
 // dist.next/policy/evaluate.js
-init_settings();
+var init_evaluate = __esm({
+  "dist.next/policy/evaluate.js"() {
+    "use strict";
+    init_events();
+    init_settings();
+  }
+});
 
 // dist.next/verify/preflight.js
-var MAX_LOCKFILE_BYTES = 64 * 1024 * 1024;
+var MAX_LOCKFILE_BYTES;
+var init_preflight = __esm({
+  "dist.next/verify/preflight.js"() {
+    "use strict";
+    init_settings();
+    init_evaluate();
+    MAX_LOCKFILE_BYTES = 64 * 1024 * 1024;
+  }
+});
 
-// dist.next/policy/cooldown.js
-init_settings();
+// dist.next/commands/types.js
+var init_types = __esm({
+  "dist.next/commands/types.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/verify/package-check.js
+var init_package_check = __esm({
+  "dist.next/verify/package-check.js"() {
+    "use strict";
+    init_analyze();
+    init_theme();
+    init_provenance();
+    init_safe_version();
+    init_package_page();
+    init_mode();
+    init_preflight();
+    init_store2();
+    init_types();
+  }
+});
+
+// dist.next/decisions/apply.js
+var init_apply = __esm({
+  "dist.next/decisions/apply.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/launcher/resolve-real-binary.js
+var init_resolve_real_binary = __esm({
+  "dist.next/launcher/resolve-real-binary.js"() {
+    "use strict";
+    init_state();
+  }
+});
+
+// dist.next/launcher/spawn-invocation.js
+var init_spawn_invocation = __esm({
+  "dist.next/launcher/spawn-invocation.js"() {
+    "use strict";
+  }
+});
 
 // dist.next/util/external-tool.js
-init_resolve_real_binary();
-init_spawn_invocation();
+var init_external_tool = __esm({
+  "dist.next/util/external-tool.js"() {
+    "use strict";
+    init_resolve_real_binary();
+    init_spawn_invocation();
+  }
+});
 
 // dist.next/util/git.js
-var DEFAULT_MAX_BUFFER = 256 * 1024 * 1024;
+var DEFAULT_MAX_BUFFER;
+var init_git = __esm({
+  "dist.next/util/git.js"() {
+    "use strict";
+    init_external_tool();
+    DEFAULT_MAX_BUFFER = 256 * 1024 * 1024;
+  }
+});
 
-// dist.next/project/dgfile.js
-init_json_file();
-init_state();
+// dist.next/policy/pypi-name.js
+var init_pypi_name = __esm({
+  "dist.next/policy/pypi-name.js"() {
+    "use strict";
+  }
+});
 
 // dist.next/project/override-trust.js
-init_state();
+var init_override_trust = __esm({
+  "dist.next/project/override-trust.js"() {
+    "use strict";
+    init_state();
+    init_settings();
+  }
+});
 
-// dist.next/launcher/install-preflight.js
-init_settings();
+// dist.next/project/dgfile.js
+var init_dgfile = __esm({
+  "dist.next/project/dgfile.js"() {
+    "use strict";
+    init_git();
+    init_json_file();
+    init_pypi_name();
+    init_state();
+    init_override_trust();
+    init_sanitize();
+  }
+});
+
+// dist.next/policy/cooldown.js
+var init_cooldown = __esm({
+  "dist.next/policy/cooldown.js"() {
+    "use strict";
+    init_settings();
+    init_dgfile();
+    init_pypi_name();
+  }
+});
+
+// dist.next/install-ui/prompt.js
+var init_prompt = __esm({
+  "dist.next/install-ui/prompt.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/util/tty-prompt.js
+var init_tty_prompt = __esm({
+  "dist.next/util/tty-prompt.js"() {
+    "use strict";
+  }
+});
 
 // dist.next/decisions/remember-prompt.js
-init_settings();
+var init_remember_prompt = __esm({
+  "dist.next/decisions/remember-prompt.js"() {
+    "use strict";
+    init_events();
+    init_settings();
+    init_prompt();
+    init_dgfile();
+    init_tty_prompt();
+    init_apply();
+  }
+});
+
+// dist.next/launcher/pip-report.js
+var init_pip_report = __esm({
+  "dist.next/launcher/pip-report.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/proxy/auth.js
+var init_auth = __esm({
+  "dist.next/proxy/auth.js"() {
+    "use strict";
+  }
+});
+
+// dist.next/launcher/env.js
+var init_env = __esm({
+  "dist.next/launcher/env.js"() {
+    "use strict";
+    init_auth();
+  }
+});
 
 // dist.next/launcher/install-preflight.js
-init_spawn_invocation();
+var MAX_PIP_REPORT_BYTES;
+var init_install_preflight = __esm({
+  "dist.next/launcher/install-preflight.js"() {
+    "use strict";
+    init_analyze();
+    init_settings();
+    init_override_trust();
+    init_apply();
+    init_remember_prompt();
+    init_provenance();
+    init_prompt();
+    init_cooldown();
+    init_dgfile();
+    init_pip_report();
+    init_spawn_invocation();
+    init_env();
+    MAX_PIP_REPORT_BYTES = 16 * 1024 * 1024;
+  }
+});
 
 // dist.next/launcher/manifest-screen.js
-var MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
+var MAX_MANIFEST_BYTES;
+var init_manifest_screen = __esm({
+  "dist.next/launcher/manifest-screen.js"() {
+    "use strict";
+    MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
+  }
+});
 
 // dist.next/launcher/agent-check.js
 function formatScreenedNote(screened) {
@@ -779,19 +1207,32 @@ function formatScreenedNote(screened) {
   const noun = screened.length === 1 ? "package" : "packages";
   return sanitizeLine(`dg pre-screened the requested ${noun}: ${items} \u2014 no known issues (dependencies are screened at install time)`);
 }
+var SHELL_EXEC, HEREDOC_EXEC_HEADS;
+var init_agent_check = __esm({
+  "dist.next/launcher/agent-check.js"() {
+    "use strict";
+    init_analyze();
+    init_classify();
+    init_package_check();
+    init_apply();
+    init_cooldown();
+    init_install_preflight();
+    init_sanitize();
+    init_manifest_screen();
+    SHELL_EXEC = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ash", "ksh", "mksh", "fish", "script"]);
+    HEREDOC_EXEC_HEADS = /* @__PURE__ */ new Set([...SHELL_EXEC, "eval", "source", "."]);
+  }
+});
 
 // dist.next/agents/persistence.js
-init_state();
-import { existsSync, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { dirname as dirname2 } from "node:path";
-import { randomBytes } from "node:crypto";
-var LEGACY_AGENT_HOOK_SENTINEL = "dg-agent-hook-v1";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname3, sep } from "node:path";
+import { randomBytes as randomBytes2 } from "node:crypto";
 function agentHookSentinel(agent) {
   return `${LEGACY_AGENT_HOOK_SENTINEL}:${agent}`;
 }
-var AgentHookError = class extends Error {
-};
 function dirExists(path) {
   try {
     return lstatSync(path).isDirectory();
@@ -816,17 +1257,38 @@ function assertSafeNode(path, role) {
     throw new AgentHookError(`${path} (${role}) is world-writable; refusing to write to it. Tighten its permissions, then retry.`);
   }
 }
+function assertNoSymlinkBelowHome(target) {
+  const home = homedir2();
+  if (!home) {
+    return;
+  }
+  let dir = dirname3(target);
+  let prev = "";
+  while (dir !== prev && dir.startsWith(`${home}${sep}`)) {
+    try {
+      if (lstatSync(dir).isSymbolicLink()) {
+        throw new AgentHookError(`${dir} is a symlink; refusing to create or write through it. Replace it with a real directory, then retry.`);
+      }
+    } catch (error) {
+      if (error instanceof AgentHookError) {
+        throw error;
+      }
+    }
+    prev = dir;
+    dir = dirname3(dir);
+  }
+}
 function assertSafeWriteTarget(path) {
-  assertSafeNode(dirname2(path), "directory");
+  assertSafeNode(dirname3(path), "directory");
   assertSafeNode(path, "file");
 }
 function readSettings(path) {
-  if (!existsSync(path)) {
+  if (!existsSync2(path)) {
     return { settings: {}, existed: false };
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(path, "utf8"));
+    parsed = JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     throw new AgentHookError(`${path} is not valid JSON; refusing to modify it. Fix or remove it, then retry.`);
   }
@@ -835,19 +1297,23 @@ function readSettings(path) {
   }
   return { settings: parsed, existed: true };
 }
-function writeSettingsAtomic(path, settings) {
-  mkdirSync3(dirname2(path), { recursive: true });
+function writeFileAtomicSafe(path, content) {
+  assertNoSymlinkBelowHome(path);
+  mkdirSync4(dirname3(path), { recursive: true });
   assertSafeWriteTarget(path);
-  const tmp = `${path}.dg-${randomBytes(6).toString("hex")}.tmp`;
-  writeFileSync2(tmp, `${JSON.stringify(settings, null, 2)}
-`, { mode: 384, flag: "wx" });
+  const tmp = `${path}.dg-${randomBytes2(6).toString("hex")}.tmp`;
+  writeFileSync3(tmp, content, { mode: 384, flag: "wx" });
   try {
-    renameSync3(tmp, path);
+    renameSync4(tmp, path);
   } catch (error) {
-    rmSync3(tmp, { force: true });
+    rmSync4(tmp, { force: true });
     throw error;
   }
 }
+function writeSettingsAtomic(path, settings) {
+  writeFileAtomicSafe(path, `${JSON.stringify(settings, null, 2)}
+`);
+}
 async function wasCreatedByDg(ctx) {
   try {
     const reg = await readCleanupRegistry(ctx.paths);
@@ -875,13 +1341,16 @@ async function removeHookEntries(ctx, legacySentinels) {
     await removeCleanupEntry(ctx.paths, { kind: "agent-hook", path: ctx.settingsPath, sentinel });
   }
 }
-function findHookCommand(node, signature) {
+function findHookCommand(node, signature, depth = 0) {
+  if (depth > 512) {
+    return null;
+  }
   if (typeof node === "string") {
     return node.includes(signature) ? node : null;
   }
   if (Array.isArray(node)) {
     for (const value of node) {
-      const found = findHookCommand(value, signature);
+      const found = findHookCommand(value, signature, depth + 1);
       if (found) {
         return found;
       }
@@ -890,7 +1359,7 @@ function findHookCommand(node, signature) {
   }
   if (node && typeof node === "object") {
     for (const value of Object.values(node)) {
-      const found = findHookCommand(value, signature);
+      const found = findHookCommand(value, signature, depth + 1);
       if (found) {
         return found;
       }
@@ -899,13 +1368,45 @@ function findHookCommand(node, signature) {
   }
   return null;
 }
+function shellHeadTokens(head) {
+  const tokens = [];
+  const s = head.trim();
+  let i = 0;
+  while (i < s.length) {
+    while (i < s.length && /\s/.test(s[i] ?? "")) {
+      i += 1;
+    }
+    if (i >= s.length) {
+      break;
+    }
+    const quote = s[i];
+    if (quote === '"' || quote === "'") {
+      const end = s.indexOf(quote, i + 1);
+      if (end < 0) {
+        tokens.push(s.slice(i + 1));
+        break;
+      }
+      const inner = s.slice(i + 1, end);
+      tokens.push(quote === '"' ? inner.replace(/\\(["\\$`])/g, "$1") : inner);
+      i = end + 1;
+    } else {
+      let j = i;
+      while (j < s.length && !/\s/.test(s[j] ?? "")) {
+        j += 1;
+      }
+      tokens.push(s.slice(i, j));
+      i = j;
+    }
+  }
+  return tokens;
+}
 function hookResolvesCheck(settings, agent) {
   const command = findHookCommand(settings, `hook-exec ${agent}`);
   if (!command) {
     return null;
   }
   const head = command.split(/\s+hook-exec\s+/)[0] ?? command;
-  const broken = head.split(/\s+/).filter((token) => token.startsWith("/")).filter((token) => !existsSync(token));
+  const broken = shellHeadTokens(head).filter((token) => token.startsWith("/")).filter((token) => !existsSync2(token));
   return {
     name: "hook command resolves",
     ok: broken.length === 0,
@@ -924,7 +1425,7 @@ function mergedJsonHook(config) {
     },
     async remove(ctx) {
       let removed = false;
-      if (existsSync(ctx.settingsPath)) {
+      if (existsSync2(ctx.settingsPath)) {
         let settings = null;
         try {
           settings = readSettings(ctx.settingsPath).settings;
@@ -936,7 +1437,7 @@ function mergedJsonHook(config) {
           if (result.changed) {
             removed = true;
             if (result.empty && await wasCreatedByDg(ctx)) {
-              rmSync3(ctx.settingsPath, { force: true });
+              rmSync4(ctx.settingsPath, { force: true });
             } else {
               writeSettingsAtomic(ctx.settingsPath, result.settings);
             }
@@ -948,7 +1449,7 @@ function mergedJsonHook(config) {
     },
     verify(ctx) {
       const checks = [];
-      const present = existsSync(ctx.settingsPath);
+      const present = existsSync2(ctx.settingsPath);
       checks.push({ name: "settings file", ok: present, detail: present ? ctx.settingsPath : `${ctx.settingsPath} (absent)` });
       if (!present) {
         return checks;
@@ -971,13 +1472,13 @@ function mergedJsonHook(config) {
       return checks;
     },
     reverseEntry(entry, removed, missing, warnings) {
-      if (!existsSync(entry.path)) {
+      if (!existsSync2(entry.path)) {
         missing.push(entry.path);
         return;
       }
       let settings;
       try {
-        const parsed = JSON.parse(readFileSync3(entry.path, "utf8"));
+        const parsed = JSON.parse(readFileSync4(entry.path, "utf8"));
         if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
           warnings.push(`${entry.path}: not a JSON object; left untouched`);
           return;
@@ -993,7 +1494,7 @@ function mergedJsonHook(config) {
         return;
       }
       if (result.empty && entry.original === "dg-created") {
-        rmSync3(entry.path, { force: true });
+        rmSync4(entry.path, { force: true });
       } else {
         try {
           writeSettingsAtomic(entry.path, result.settings);
@@ -1010,7 +1511,7 @@ function ownedJsonHook(config) {
   const sentinel = agentHookSentinel(config.agent);
   const ownsFile = (path) => {
     try {
-      const parsed = JSON.parse(readFileSync3(path, "utf8"));
+      const parsed = JSON.parse(readFileSync4(path, "utf8"));
       return parsed?.dgSentinel === sentinel;
     } catch {
       return false;
@@ -1019,7 +1520,7 @@ function ownedJsonHook(config) {
   return {
     isInstalledCheckName: config.checkName,
     async apply(ctx) {
-      const existed = existsSync(ctx.settingsPath);
+      const existed = existsSync2(ctx.settingsPath);
       if (existed && !ownsFile(ctx.settingsPath)) {
         throw new AgentHookError(`${ctx.settingsPath} already exists and was not written by dg; refusing to overwrite it. Merge the output of 'dg agents --print ${ctx.agent}' yourself, or remove the file and retry.`);
       }
@@ -1029,8 +1530,8 @@ function ownedJsonHook(config) {
     },
     async remove(ctx) {
       let removed = false;
-      if (existsSync(ctx.settingsPath) && ownsFile(ctx.settingsPath)) {
-        rmSync3(ctx.settingsPath, { force: true });
+      if (existsSync2(ctx.settingsPath) && ownsFile(ctx.settingsPath)) {
+        rmSync4(ctx.settingsPath, { force: true });
         removed = true;
       }
       await removeHookEntries(ctx, []);
@@ -1038,7 +1539,7 @@ function ownedJsonHook(config) {
     },
     verify(ctx) {
       const checks = [];
-      const present = existsSync(ctx.settingsPath);
+      const present = existsSync2(ctx.settingsPath);
       checks.push({ name: "hook file", ok: present, detail: present ? ctx.settingsPath : `${ctx.settingsPath} (absent)` });
       if (!present) {
         return checks;
@@ -1047,7 +1548,7 @@ function ownedJsonHook(config) {
       checks.push({ name: config.checkName, ok: installed, detail: installed ? "installed" : "present but not dg-owned" });
       if (installed) {
         try {
-          const settings = JSON.parse(readFileSync3(ctx.settingsPath, "utf8"));
+          const settings = JSON.parse(readFileSync4(ctx.settingsPath, "utf8"));
           const resolves = hookResolvesCheck(settings, ctx.agent);
           if (resolves) {
             checks.push(resolves);
@@ -1058,7 +1559,7 @@ function ownedJsonHook(config) {
       return checks;
     },
     reverseEntry(entry, removed, missing, warnings) {
-      if (!existsSync(entry.path)) {
+      if (!existsSync2(entry.path)) {
         missing.push(entry.path);
         return;
       }
@@ -1066,7 +1567,7 @@ function ownedJsonHook(config) {
         warnings.push(`${entry.path}: not dg-owned; left untouched`);
         return;
       }
-      rmSync3(entry.path, { force: true });
+      rmSync4(entry.path, { force: true });
       removed.push(entry.path);
     }
   };
@@ -1110,11 +1611,21 @@ function probeMinCliVersion(binary, minVersion, label, deps) {
   }
   return { supported: true, detail: `${label} ${found.join(".")}` };
 }
+var LEGACY_AGENT_HOOK_SENTINEL, AgentHookError;
+var init_persistence = __esm({
+  "dist.next/agents/persistence.js"() {
+    "use strict";
+    init_state();
+    LEGACY_AGENT_HOOK_SENTINEL = "dg-agent-hook-v1";
+    AgentHookError = class extends Error {
+    };
+  }
+});
 
 // dist.next/agents/claude-code.js
-var SIGNATURE = "hook-exec claude-code";
+import { join as join5 } from "node:path";
 function configPath(home) {
-  return join4(home, ".claude", "settings.json");
+  return join5(home, ".claude", "settings.json");
 }
 function isDgGroup(group) {
   if (typeof group !== "object" || group === null) {
@@ -1198,33 +1709,42 @@ function emitDecision(verdict) {
     exitCode: 0
   };
 }
-var claudeCodeIntegration = {
-  id: "claude-code",
-  label: "Claude Code",
-  kind: "merged-json",
-  maturity: "verified",
-  minVersion: null,
-  configPath,
-  detect: (home) => dirExists(join4(home, ".claude")),
-  probeHookSupport: (home) => ({
-    supported: true,
-    detail: dirExists(join4(home, ".claude")) ? "Claude Code settings directory found" : "settings hooks are supported by every Claude Code version; ~/.claude will be created"
-  }),
-  parseInput,
-  emitDecision,
-  ...mergedJsonHook({
-    checkName: "dg PreToolUse hook",
-    legacySentinels: [LEGACY_AGENT_HOOK_SENTINEL],
-    insert: insertDgHook,
-    remove: removeDgHook,
-    isInstalled: hasDgHook
-  })
-};
+var SIGNATURE, claudeCodeIntegration;
+var init_claude_code = __esm({
+  "dist.next/agents/claude-code.js"() {
+    "use strict";
+    init_agent_check();
+    init_persistence();
+    SIGNATURE = "hook-exec claude-code";
+    claudeCodeIntegration = {
+      id: "claude-code",
+      label: "Claude Code",
+      kind: "merged-json",
+      maturity: "verified",
+      minVersion: null,
+      configPath,
+      detect: (home) => dirExists(join5(home, ".claude")),
+      probeHookSupport: (home) => ({
+        supported: true,
+        detail: dirExists(join5(home, ".claude")) ? "Claude Code settings directory found" : "settings hooks are supported by every Claude Code version; ~/.claude will be created"
+      }),
+      parseInput,
+      emitDecision,
+      ...mergedJsonHook({
+        checkName: "dg PreToolUse hook",
+        legacySentinels: [LEGACY_AGENT_HOOK_SENTINEL],
+        insert: insertDgHook,
+        remove: removeDgHook,
+        isInstalled: hasDgHook
+      })
+    };
+  }
+});
 
 // dist.next/agents/codex.js
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 function configPath2(home) {
-  return join5(home, ".codex", "hooks.json");
+  return join6(home, ".codex", "hooks.json");
 }
 function parseInput2(stdin) {
   try {
@@ -1262,35 +1782,41 @@ function renderHookFile(dgCommand) {
   };
 }
 function probeHookSupport(home, deps) {
-  if (!dirExists(join5(home, ".codex"))) {
+  if (!dirExists(join6(home, ".codex"))) {
     return { supported: false, detail: "~/.codex not found (is Codex CLI installed?)" };
   }
   return probeMinCliVersion("codex", "0.124.0", "Codex CLI", deps);
 }
-var codexIntegration = {
-  id: "codex",
-  label: "Codex CLI",
-  kind: "owned-json",
-  maturity: "verified",
-  minVersion: "0.124.0",
-  postInstallNote: "Codex asks to trust new hooks: approve the dg hook when Codex prompts on its next start.",
-  configPath: configPath2,
-  detect: (home) => dirExists(join5(home, ".codex")),
-  probeHookSupport,
-  parseInput: parseInput2,
-  emitDecision: emitDecision2,
-  ...ownedJsonHook({
-    agent: "codex",
-    checkName: "dg PreToolUse hook",
-    render: renderHookFile
-  })
-};
+var codexIntegration;
+var init_codex = __esm({
+  "dist.next/agents/codex.js"() {
+    "use strict";
+    init_persistence();
+    codexIntegration = {
+      id: "codex",
+      label: "Codex CLI",
+      kind: "owned-json",
+      maturity: "verified",
+      minVersion: "0.124.0",
+      postInstallNote: "Codex asks to trust new hooks: approve the dg hook when Codex prompts on its next start.",
+      configPath: configPath2,
+      detect: (home) => dirExists(join6(home, ".codex")),
+      probeHookSupport,
+      parseInput: parseInput2,
+      emitDecision: emitDecision2,
+      ...ownedJsonHook({
+        agent: "codex",
+        checkName: "dg PreToolUse hook",
+        render: renderHookFile
+      })
+    };
+  }
+});
 
 // dist.next/agents/copilot-cli.js
-import { join as join6 } from "node:path";
-var SIGNATURE2 = "hook-exec copilot-cli";
+import { join as join7 } from "node:path";
 function configPath3(home) {
-  return join6(home, ".copilot", "settings.json");
+  return join7(home, ".copilot", "settings.json");
 }
 function isDgEntry(entry) {
   return typeof entry === "object" && entry !== null && typeof entry.command === "string" && entry.command.includes(SIGNATURE2);
@@ -1359,44 +1885,53 @@ function emitDecision3(verdict) {
   if (verdict.decision === "allow") {
     return { stdout: "{}", exitCode: 0 };
   }
+  const suffix = verdict.decision === "ask" ? " (dg flagged this for human review \u2014 not auto-approved)" : "";
+  const reason = `${verdict.reason ?? "Dependency Guardian firewall"}${suffix}`;
   return {
     stdout: JSON.stringify({
-      permissionDecision: verdict.decision,
-      ...verdict.reason ? { permissionDecisionReason: verdict.reason } : {}
+      permissionDecision: "deny",
+      permissionDecisionReason: reason
     }),
     exitCode: 0
   };
 }
 function probeHookSupport2(home, deps) {
-  if (!dirExists(join6(home, ".copilot"))) {
+  if (!dirExists(join7(home, ".copilot"))) {
     return { supported: false, detail: "~/.copilot not found (is GitHub Copilot CLI installed?)" };
   }
   return probeMinCliVersion("copilot", "1.0.61", "GitHub Copilot CLI", deps);
 }
-var copilotCliIntegration = {
-  id: "copilot-cli",
-  label: "GitHub Copilot CLI",
-  kind: "merged-json",
-  maturity: "verified",
-  minVersion: "1.0.61",
-  configPath: configPath3,
-  detect: (home) => dirExists(join6(home, ".copilot")),
-  probeHookSupport: probeHookSupport2,
-  parseInput: parseInput3,
-  emitDecision: emitDecision3,
-  ...mergedJsonHook({
-    checkName: "dg preToolUse hook",
-    insert: insertDgHook2,
-    remove: removeDgHook2,
-    isInstalled: hasDgHook2
-  })
-};
+var SIGNATURE2, copilotCliIntegration;
+var init_copilot_cli = __esm({
+  "dist.next/agents/copilot-cli.js"() {
+    "use strict";
+    init_persistence();
+    SIGNATURE2 = "hook-exec copilot-cli";
+    copilotCliIntegration = {
+      id: "copilot-cli",
+      label: "GitHub Copilot CLI",
+      kind: "merged-json",
+      maturity: "verified",
+      minVersion: "1.0.61",
+      configPath: configPath3,
+      detect: (home) => dirExists(join7(home, ".copilot")),
+      probeHookSupport: probeHookSupport2,
+      parseInput: parseInput3,
+      emitDecision: emitDecision3,
+      ...mergedJsonHook({
+        checkName: "dg preToolUse hook",
+        insert: insertDgHook2,
+        remove: removeDgHook2,
+        isInstalled: hasDgHook2
+      })
+    };
+  }
+});
 
 // dist.next/agents/cursor.js
-import { join as join7 } from "node:path";
-var SIGNATURE3 = "hook-exec cursor";
+import { join as join8 } from "node:path";
 function configPath4(home) {
-  return join7(home, ".cursor", "hooks.json");
+  return join8(home, ".cursor", "hooks.json");
 }
 function isDgEntry2(entry) {
   return typeof entry === "object" && entry !== null && typeof entry.command === "string" && entry.command.includes(SIGNATURE3);
@@ -1474,7 +2009,7 @@ function emitDecision4(verdict) {
   };
 }
 function probeHookSupport3(home) {
-  if (!dirExists(join7(home, ".cursor"))) {
+  if (!dirExists(join8(home, ".cursor"))) {
     return { supported: false, detail: "~/.cursor not found (is Cursor installed?)" };
   }
   try {
@@ -1484,30 +2019,38 @@ function probeHookSupport3(home) {
   }
   return { supported: true, detail: "requires Cursor 1.7+; dg cannot read your Cursor version from disk" };
 }
-var cursorIntegration = {
-  id: "cursor",
-  label: "Cursor",
-  kind: "merged-json",
-  maturity: "verified",
-  minVersion: "1.7",
-  configPath: configPath4,
-  detect: (home) => dirExists(join7(home, ".cursor")),
-  probeHookSupport: probeHookSupport3,
-  parseInput: parseInput4,
-  emitDecision: emitDecision4,
-  ...mergedJsonHook({
-    checkName: "dg beforeShellExecution hook",
-    insert: insertHook,
-    remove: removeHook,
-    isInstalled: hasDgHook3
-  })
-};
+var SIGNATURE3, cursorIntegration;
+var init_cursor = __esm({
+  "dist.next/agents/cursor.js"() {
+    "use strict";
+    init_agent_check();
+    init_persistence();
+    SIGNATURE3 = "hook-exec cursor";
+    cursorIntegration = {
+      id: "cursor",
+      label: "Cursor",
+      kind: "merged-json",
+      maturity: "verified",
+      minVersion: "1.7",
+      configPath: configPath4,
+      detect: (home) => dirExists(join8(home, ".cursor")),
+      probeHookSupport: probeHookSupport3,
+      parseInput: parseInput4,
+      emitDecision: emitDecision4,
+      ...mergedJsonHook({
+        checkName: "dg beforeShellExecution hook",
+        insert: insertHook,
+        remove: removeHook,
+        isInstalled: hasDgHook3
+      })
+    };
+  }
+});
 
 // dist.next/agents/gemini.js
-import { join as join8 } from "node:path";
-var SIGNATURE4 = "hook-exec gemini";
+import { join as join9 } from "node:path";
 function configPath5(home) {
-  return join8(home, ".gemini", "settings.json");
+  return join9(home, ".gemini", "settings.json");
 }
 function isDgGroup2(group) {
   if (typeof group !== "object" || group === null) {
@@ -1578,35 +2121,42 @@ function emitDecision5(verdict) {
   };
 }
 function probeHookSupport4(home, deps) {
-  if (!dirExists(join8(home, ".gemini"))) {
+  if (!dirExists(join9(home, ".gemini"))) {
     return { supported: false, detail: "~/.gemini not found (is Gemini CLI installed?)" };
   }
   return probeMinCliVersion("gemini", "0.26.0", "Gemini CLI", deps);
 }
-var geminiIntegration = {
-  id: "gemini",
-  label: "Gemini CLI",
-  kind: "merged-json",
-  maturity: "verified",
-  minVersion: "0.26.0",
-  configPath: configPath5,
-  detect: (home) => dirExists(join8(home, ".gemini")),
-  probeHookSupport: probeHookSupport4,
-  parseInput: parseInput5,
-  emitDecision: emitDecision5,
-  ...mergedJsonHook({
-    checkName: "dg BeforeTool hook",
-    insert: insertHook2,
-    remove: removeHook2,
-    isInstalled: hasDgHook4
-  })
-};
+var SIGNATURE4, geminiIntegration;
+var init_gemini = __esm({
+  "dist.next/agents/gemini.js"() {
+    "use strict";
+    init_persistence();
+    SIGNATURE4 = "hook-exec gemini";
+    geminiIntegration = {
+      id: "gemini",
+      label: "Gemini CLI",
+      kind: "merged-json",
+      maturity: "verified",
+      minVersion: "0.26.0",
+      configPath: configPath5,
+      detect: (home) => dirExists(join9(home, ".gemini")),
+      probeHookSupport: probeHookSupport4,
+      parseInput: parseInput5,
+      emitDecision: emitDecision5,
+      ...mergedJsonHook({
+        checkName: "dg BeforeTool hook",
+        insert: insertHook2,
+        remove: removeHook2,
+        isInstalled: hasDgHook4
+      })
+    };
+  }
+});
 
 // dist.next/agents/windsurf.js
-import { join as join9 } from "node:path";
-var SIGNATURE5 = "hook-exec windsurf";
+import { join as join10 } from "node:path";
 function configPath6(home) {
-  return join9(home, ".codeium", "windsurf", "hooks.json");
+  return join10(home, ".codeium", "windsurf", "hooks.json");
 }
 function isDgEntry3(entry) {
   return typeof entry === "object" && entry !== null && typeof entry.command === "string" && entry.command.includes(SIGNATURE5);
@@ -1667,43 +2217,48 @@ function emitDecision6(verdict) {
 `, exitCode: 2 };
 }
 function probeHookSupport5(home) {
-  if (!dirExists(join9(home, ".codeium", "windsurf"))) {
+  if (!dirExists(join10(home, ".codeium", "windsurf"))) {
     return { supported: false, detail: "~/.codeium/windsurf not found (is Windsurf installed?)" };
   }
   return { supported: true, detail: "Windsurf config directory found; dg cannot read the app version from disk" };
 }
-var windsurfIntegration = {
-  id: "windsurf",
-  label: "Windsurf",
-  kind: "merged-json",
-  maturity: "unverified",
-  minVersion: null,
-  configPath: configPath6,
-  detect: (home) => dirExists(join9(home, ".codeium", "windsurf")),
-  probeHookSupport: probeHookSupport5,
-  parseInput: parseInput6,
-  emitDecision: emitDecision6,
-  ...mergedJsonHook({
-    checkName: "dg pre_run_command hook",
-    insert: insertHook3,
-    remove: removeHook3,
-    isInstalled: hasDgHook5
-  })
-};
+var SIGNATURE5, windsurfIntegration;
+var init_windsurf = __esm({
+  "dist.next/agents/windsurf.js"() {
+    "use strict";
+    init_persistence();
+    SIGNATURE5 = "hook-exec windsurf";
+    windsurfIntegration = {
+      id: "windsurf",
+      label: "Windsurf",
+      kind: "merged-json",
+      maturity: "unverified",
+      minVersion: null,
+      configPath: configPath6,
+      detect: (home) => dirExists(join10(home, ".codeium", "windsurf")),
+      probeHookSupport: probeHookSupport5,
+      parseInput: parseInput6,
+      emitDecision: emitDecision6,
+      ...mergedJsonHook({
+        checkName: "dg pre_run_command hook",
+        insert: insertHook3,
+        remove: removeHook3,
+        isInstalled: hasDgHook5
+      })
+    };
+  }
+});
 
 // dist.next/agents/registry.js
-var AGENTS = {
-  "claude-code": claudeCodeIntegration,
-  codex: codexIntegration,
-  cursor: cursorIntegration,
-  "copilot-cli": copilotCliIntegration,
-  gemini: geminiIntegration,
-  windsurf: windsurfIntegration
-};
-var AGENT_IDS = Object.keys(AGENTS);
 function isAgentId(value) {
   return value in AGENTS;
 }
+function getAgent(id) {
+  return AGENTS[id];
+}
+function agentLabel(id) {
+  return isAgentId(id) ? AGENTS[id].label : id;
+}
 function agentFromSentinel(sentinel) {
   if (!sentinel || sentinel === LEGACY_AGENT_HOOK_SENTINEL) {
     return "claude-code";
@@ -1722,6 +2277,151 @@ function reverseAgentHookEntry(entry, removed, missing, warnings) {
   }
   AGENTS[agent].reverseEntry(entry, removed, missing, warnings);
 }
+var AGENTS, AGENT_IDS;
+var init_registry = __esm({
+  "dist.next/agents/registry.js"() {
+    "use strict";
+    init_sh_escape();
+    init_state();
+    init_claude_code();
+    init_codex();
+    init_copilot_cli();
+    init_cursor();
+    init_gemini();
+    init_persistence();
+    init_windsurf();
+    AGENTS = {
+      "claude-code": claudeCodeIntegration,
+      codex: codexIntegration,
+      cursor: cursorIntegration,
+      "copilot-cli": copilotCliIntegration,
+      gemini: geminiIntegration,
+      windsurf: windsurfIntegration
+    };
+    AGENT_IDS = Object.keys(AGENTS);
+  }
+});
+
+// dist.next/service/trust-store.js
+var init_trust_store = __esm({
+  "dist.next/service/trust-store.js"() {
+    "use strict";
+    init_json_file();
+  }
+});
+
+// dist.next/service/trust-refresh.js
+var init_trust_refresh = __esm({
+  "dist.next/service/trust-refresh.js"() {
+    "use strict";
+    init_trust_store();
+  }
+});
+
+// dist.next/service/state.js
+var SERVICE_LOCK_STALE_MS;
+var init_state2 = __esm({
+  "dist.next/service/state.js"() {
+    "use strict";
+    init_settings();
+    init_trust_store();
+    init_trust_refresh();
+    init_state();
+    SERVICE_LOCK_STALE_MS = 30 * 60 * 1e3;
+  }
+});
+
+// dist.next/setup/uninstall-standalone.js
+import { rmSync as rmSync7 } from "node:fs";
+import { join as join13 } from "node:path";
+
+// dist.next/setup/plan.js
+import { accessSync, constants, copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync6, realpathSync, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename as basename2, delimiter, dirname as dirname5, join as join12, resolve, sep as sep2 } from "node:path";
+import { randomBytes as randomBytes3 } from "node:crypto";
+init_theme();
+init_registry();
+
+// dist.next/agents/routing.js
+init_env();
+init_state2();
+init_state();
+init_persistence();
+init_registry();
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join11 } from "node:path";
+var CODEX_BEGIN = "# >>> dg routing >>>";
+var CODEX_END = "# <<< dg routing <<<";
+function backupPath(agent, env) {
+  return join11(resolveDgPaths(env).stateDir, `routing-${agent}.json`);
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripCodexBlock(content) {
+  const block = new RegExp(`\\n?${escapeRegex(CODEX_BEGIN)}[\\s\\S]*?${escapeRegex(CODEX_END)}\\n?`, "g");
+  return content.replace(block, "\n").replace(/\n{3,}/g, "\n\n");
+}
+function loadBackupPrior(backup) {
+  if (!existsSync3(backup)) {
+    return {};
+  }
+  try {
+    return JSON.parse(readFileSync5(backup, "utf8")).prior ?? {};
+  } catch {
+    return {};
+  }
+}
+function removeClaudeRouting(settingsPath, backup) {
+  if (!existsSync3(backup)) {
+    return;
+  }
+  const prior = loadBackupPrior(backup);
+  if (existsSync3(settingsPath)) {
+    const { settings } = readSettings(settingsPath);
+    const envObj = typeof settings.env === "object" && settings.env !== null ? { ...settings.env } : {};
+    for (const [k, v] of Object.entries(prior)) {
+      if (v === null) {
+        delete envObj[k];
+      } else {
+        envObj[k] = v;
+      }
+    }
+    if (Object.keys(envObj).length === 0) {
+      delete settings.env;
+    } else {
+      settings.env = envObj;
+    }
+    writeSettingsAtomic(settingsPath, settings);
+  }
+  rmSync5(backup, { force: true });
+}
+function removeCodexRouting(configPath7) {
+  if (!existsSync3(configPath7)) {
+    return;
+  }
+  writeFileAtomicSafe(configPath7, stripCodexBlock(readFileSync5(configPath7, "utf8")));
+}
+function codexConfigPath(home) {
+  return join11(home, ".codex", "config.toml");
+}
+function removeAgentRouting(agent, home, env = process.env) {
+  if (agent === "codex") {
+    removeCodexRouting(codexConfigPath(home));
+    return;
+  }
+  removeClaudeRouting(getAgent(agent).configPath(home), backupPath(agent, env));
+}
+function routingInstalled(agent, home, env = process.env) {
+  if (agent === "codex") {
+    const p = codexConfigPath(home);
+    return existsSync3(p) && readFileSync5(p, "utf8").includes(CODEX_BEGIN);
+  }
+  return existsSync3(backupPath(agent, env));
+}
+
+// dist.next/setup/plan.js
+init_sh_escape();
 
 // dist.next/agents/gate-posture.js
 init_state2();
@@ -1737,9 +2437,22 @@ var MINIMUM_NODE = Object.freeze({
 });
 
 // dist.next/setup/plan.js
+init_version();
+
+// dist.next/commands/update.js
+init_external_tool();
+init_state();
+init_types();
+init_version();
+
+// dist.next/setup/plan.js
+init_store2();
 init_settings();
+init_cooldown();
 init_resolve_real_binary();
+init_classify();
 init_state2();
+init_optional_support();
 var SHIM_COMMANDS = Object.freeze(["npm", "npx", "pnpm", "pnpx", "yarn", "pip", "pip3", "pipx", "uv", "uvx", "cargo"]);
 var SHIM_SENTINEL = "dg-shim-v1";
 var RC_SENTINEL = "dg-shell-rc-v1";
@@ -1750,7 +2463,7 @@ var RC_END = "# <<< dg setup <<<";
 var LEGACY_RC_MARKERS = [
   { begin: "# >>> dg-managed >>>", end: "# <<< dg-managed <<<" }
 ];
-var LEGACY_RC_CANDIDATES = [".zshrc", ".bashrc", ".bash_profile", ".profile", join10(".config", "fish", "config.fish")];
+var LEGACY_RC_CANDIDATES = [".zshrc", ".bashrc", ".bash_profile", ".profile", join12(".config", "fish", "config.fish")];
 var LEGACY_PYTHON_HOOK_PY = "dg_pip_hook.py";
 var LEGACY_PYTHON_HOOK_PTH = "dg_pip_hook.pth";
 var LEGACY_PYTHON_HOOK_MARKER = "Dependency Guardian pip-install interceptor";
@@ -1760,8 +2473,8 @@ var SETUP_UNINSTALL_LOCK_STALE_MS = 30 * 60 * 1e3;
 var STALE_SESSION_OLDER_THAN_MS = 24 * 60 * 60 * 1e3;
 function uninstallSetup(options) {
   const paths = resolveDgPaths(options.env ?? process.env);
-  const hadCacheDirBeforeLock = existsSync2(paths.cacheDir);
-  const hadStateDirBeforeLock = existsSync2(paths.stateDir);
+  const hadCacheDirBeforeLock = existsSync4(paths.cacheDir);
+  const hadStateDirBeforeLock = existsSync4(paths.stateDir);
   const lock = acquireLockSync(paths, SETUP_UNINSTALL_LOCK, {
     staleMs: SETUP_UNINSTALL_LOCK_STALE_MS
   });
@@ -1792,6 +2505,17 @@ function uninstallSetup(options) {
     }
     sweepLegacyRcBlocks(paths.homeDir, removed, warnings);
     sweepLegacyPythonHooks(paths.homeDir, removed, warnings);
+    const uninstallEnv = options.env ?? process.env;
+    for (const agent of AGENT_IDS) {
+      try {
+        if (routingInstalled(agent, paths.homeDir, uninstallEnv)) {
+          removeAgentRouting(agent, paths.homeDir, uninstallEnv);
+          removed.push(`agent routing (${agentLabel(agent)})`);
+        }
+      } catch (err) {
+        warnings.push(`could not remove ${agentLabel(agent)} routing: ${err.message}`);
+      }
+    }
     if (!options.all && !registryRead.malformed && options.keepConfig) {
       writeRegistryWithLock(paths, {
         version: 1,
@@ -1804,6 +2528,9 @@ function uninstallSetup(options) {
     if (!options.keepConfig && hadStateDirBeforeLock) {
       removeDirectory(paths.stateDir, removed, missing);
     }
+    if (!options.all && !options.keepConfig && clearAuthState(uninstallEnv)) {
+      removed.push(authPath(paths));
+    }
     if (options.all) {
       removeDirectory(paths.configDir, removed, missing);
     }
@@ -1822,15 +2549,15 @@ function writeRcFileAtomic(rcPath, content) {
   let mode = 420;
   try {
     target = realpathSync(rcPath);
-    mode = statSync3(target).mode & 4095;
+    mode = statSync4(target).mode & 4095;
   } catch {
   }
-  const tempPath = join10(dirname3(target), `.${basename(target)}.dg-${randomBytes2(6).toString("hex")}.tmp`);
-  writeFileSync3(tempPath, content, { encoding: "utf8", mode, flag: "wx" });
+  const tempPath = join12(dirname5(target), `.${basename2(target)}.dg-${randomBytes3(6).toString("hex")}.tmp`);
+  writeFileSync5(tempPath, content, { encoding: "utf8", mode, flag: "wx" });
   try {
-    renameSync4(tempPath, target);
+    renameSync5(tempPath, target);
   } catch (error) {
-    rmSync4(tempPath, { force: true });
+    rmSync6(tempPath, { force: true });
     throw error;
   }
 }
@@ -1839,7 +2566,7 @@ function stripRcBlockDetailed(existing) {
   const repairedLines = [];
   for (; ; ) {
     const lines = content.split("\n");
-    const begin = lines.indexOf(RC_BEGIN);
+    const begin = lines.findIndex((line) => line.replace(/\r$/, "") === RC_BEGIN);
     if (begin === -1) {
       break;
     }
@@ -1854,14 +2581,15 @@ function stripRcBlockDetailed(existing) {
   return { content, repairedLines };
 }
 function rcPairPattern(begin, end) {
-  return new RegExp(`${escapeRegex(begin)}\\n(?:(?!${escapeRegex(begin)})[\\s\\S])*?${escapeRegex(end)}\\n?`, "g");
+  return new RegExp(`${escapeRegex2(begin)}\\r?\\n(?:(?!${escapeRegex2(begin)})[\\s\\S])*?${escapeRegex2(end)}\\r?\\n?`, "g");
 }
 function isDgWrittenRcLine(line) {
-  return line === RC_END || line.startsWith("# dg-") || line.includes(RC_SHIM_HELPER) || line.includes(`${sep}.dg${sep}shims`);
+  const trimmed = line.replace(/\r$/, "");
+  return trimmed === RC_END || trimmed.startsWith("# dg-") || trimmed.includes(RC_SHIM_HELPER) || trimmed.includes(`${sep2}.dg${sep2}shims`);
 }
 function sweepLegacyRcBlocks(homeDir, removed, warnings) {
   for (const rel of LEGACY_RC_CANDIDATES) {
-    const rcPath = join10(homeDir, rel);
+    const rcPath = join12(homeDir, rel);
     const existing = readText(rcPath);
     if (!existing) {
       continue;
@@ -1894,8 +2622,8 @@ function isLegacyPthHook(pthPath) {
 }
 function sweepLegacyPythonHooks(homeDir, removed, warnings) {
   for (const dir of candidateSitePackagesDirs(homeDir)) {
-    const pyPath = join10(dir, LEGACY_PYTHON_HOOK_PY);
-    const pthPath = join10(dir, LEGACY_PYTHON_HOOK_PTH);
+    const pyPath = join12(dir, LEGACY_PYTHON_HOOK_PY);
+    const pthPath = join12(dir, LEGACY_PYTHON_HOOK_PTH);
     const pyIsHook = readText(pyPath).includes(LEGACY_PYTHON_HOOK_MARKER);
     const pthIsHook = isLegacyPthHook(pthPath);
     if (!pyIsHook && !pthIsHook) {
@@ -1911,7 +2639,7 @@ function sweepLegacyPythonHooks(homeDir, removed, warnings) {
 }
 function removePythonHookFile(path, removed, warnings) {
   try {
-    rmSync4(path, { force: true });
+    rmSync6(path, { force: true });
     removed.push(`${path} (legacy dg pip hook)`);
   } catch (error) {
     warnings.push(`could not remove legacy dg pip hook ${path}: ${error instanceof Error ? error.message : "remove error"}`);
@@ -1919,26 +2647,26 @@ function removePythonHookFile(path, removed, warnings) {
 }
 function candidateSitePackagesDirs(homeDir) {
   const dirs = [];
-  for (const version of safeReaddir(join10(homeDir, "Library", "Python"))) {
-    dirs.push(join10(homeDir, "Library", "Python", version, "lib", "python", "site-packages"));
+  for (const version of safeReaddir(join12(homeDir, "Library", "Python"))) {
+    dirs.push(join12(homeDir, "Library", "Python", version, "lib", "python", "site-packages"));
   }
-  for (const entry of safeReaddir(join10(homeDir, ".local", "lib"))) {
+  for (const entry of safeReaddir(join12(homeDir, ".local", "lib"))) {
     if (entry.startsWith("python")) {
-      dirs.push(join10(homeDir, ".local", "lib", entry, "site-packages"));
+      dirs.push(join12(homeDir, ".local", "lib", entry, "site-packages"));
     }
   }
   return dirs;
 }
 function safeReaddir(dir) {
   try {
-    return readdirSync2(dir);
+    return readdirSync3(dir);
   } catch {
     return [];
   }
 }
 function readRegistry(paths) {
   try {
-    if (!existsSync2(paths.cleanupRegistryPath)) {
+    if (!existsSync4(paths.cleanupRegistryPath)) {
       return {
         registry: {
           version: 1,
@@ -1947,7 +2675,7 @@ function readRegistry(paths) {
         malformed: false
       };
     }
-    const registry = JSON.parse(readFileSync4(paths.cleanupRegistryPath, "utf8"));
+    const registry = JSON.parse(readFileSync6(paths.cleanupRegistryPath, "utf8"));
     if (registry.version !== 1 || !Array.isArray(registry.entries)) {
       throw new Error("unsupported cleanup registry");
     }
@@ -1968,21 +2696,21 @@ function readRegistry(paths) {
   }
 }
 function writeRegistry(paths, registry) {
-  mkdirSync4(dirname3(paths.cleanupRegistryPath), {
+  mkdirSync6(dirname5(paths.cleanupRegistryPath), {
     recursive: true,
     mode: 448
   });
-  const tempPath = `${paths.cleanupRegistryPath}.${randomBytes2(6).toString("hex")}.tmp`;
-  writeFileSync3(tempPath, `${JSON.stringify(registry, null, 2)}
+  const tempPath = `${paths.cleanupRegistryPath}.${randomBytes3(6).toString("hex")}.tmp`;
+  writeFileSync5(tempPath, `${JSON.stringify(registry, null, 2)}
 `, {
     encoding: "utf8",
     mode: 384,
     flag: "wx"
   });
   try {
-    renameSync4(tempPath, paths.cleanupRegistryPath);
+    renameSync5(tempPath, paths.cleanupRegistryPath);
   } catch (error) {
-    rmSync4(tempPath, { force: true });
+    rmSync6(tempPath, { force: true });
     throw error;
   }
 }
@@ -2000,15 +2728,15 @@ function writeRegistryWithLock(paths, registry) {
   withRegistryLock(paths, () => writeRegistry(paths, registry));
 }
 function removeShim(entry, removed, missing, warnings) {
-  if (!existsSync2(entry.path)) {
+  if (!existsSync4(entry.path)) {
     missing.push(entry.path);
     return;
   }
-  if (!validShim(entry.path, basename(entry.path))) {
+  if (!validShim(entry.path, basename2(entry.path))) {
     warnings.push(`refused to remove drifted shim: ${entry.path}`);
     return;
   }
-  rmSync4(entry.path, {
+  rmSync6(entry.path, {
     force: true
   });
   removed.push(entry.path);
@@ -2038,11 +2766,11 @@ function removeRcBlock(entry, removed, missing, warnings) {
 function reverseGitHookEntry(entry, removed, missing, warnings) {
   const sentinel = entry.sentinel ?? GUARD_HOOK_SENTINEL;
   let ownsTarget = false;
-  if (!existsSync2(entry.path)) {
+  if (!existsSync4(entry.path)) {
     missing.push(entry.path);
     ownsTarget = true;
   } else if (readText(entry.path).split("\n", 2)[1]?.includes(sentinel)) {
-    rmSync4(entry.path, { force: true });
+    rmSync6(entry.path, { force: true });
     removed.push(entry.path);
     ownsTarget = true;
   } else {
@@ -2052,9 +2780,9 @@ function reverseGitHookEntry(entry, removed, missing, warnings) {
     return;
   }
   if (entry.original) {
-    if (existsSync2(entry.original)) {
+    if (existsSync4(entry.original)) {
       try {
-        renameSync4(entry.original, entry.path);
+        renameSync5(entry.original, entry.path);
         removed.push(entry.original);
       } catch (error) {
         warnings.push(`could not restore chained hook ${entry.original}: ${error instanceof Error ? error.message : "unknown error"}`);
@@ -2065,18 +2793,18 @@ function reverseGitHookEntry(entry, removed, missing, warnings) {
   }
 }
 function removeDirectory(path, removed, missing) {
-  if (!existsSync2(path)) {
+  if (!existsSync4(path)) {
     missing.push(path);
     return;
   }
-  rmSync4(path, {
+  rmSync6(path, {
     force: true,
     recursive: true
   });
   removed.push(path);
 }
 function validShim(path, command) {
-  if (!existsSync2(path)) {
+  if (!existsSync4(path)) {
     return false;
   }
   return isValidShimSource(readText(path), command);
@@ -2089,12 +2817,12 @@ function isValidShimSource(content, command) {
 }
 function readText(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return "";
   }
 }
-function escapeRegex(value) {
+function escapeRegex2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -2103,7 +2831,7 @@ init_state();
 function run() {
   const quiet = process.argv.includes("--quiet");
   try {
-    const result = uninstallSetup({ keepConfig: false, all: true });
+    const result = uninstallSetup({ keepConfig: true, all: false });
     if (!quiet) {
       process.stderr.write(`Dependency Guardian cleaned up ${result.removed.length} leftover item(s) after the package was removed.
 `);
@@ -2115,7 +2843,7 @@ function run() {
     }
   }
   try {
-    rmSync5(join11(resolveDgPaths().homeDir, ".dg"), { recursive: true, force: true });
+    rmSync7(join13(resolveDgPaths().homeDir, ".dg", "shims"), { recursive: true, force: true });
   } catch {
     return;
   }