@westbayberry/dg 2.3.3 → 2.3.4

package/dist/scan-ui/shims.js

@@ -26,15 +26,15 @@ export function accountHeaderLine(usageTier, env = process.env) {
 export function effectiveScanAction(raw, effective, mode) {
     return mode === "strict" || effective === undefined ? raw : effective;
 }
-export function scanExitCode(action, mode) {
+export function verdictExitCode(action, failOn) {
+    if (action === "analysis_incomplete") {
+        return 4;
+    }
     if (action === "block") {
-        return 2;
+        return failOn === "never" ? 0 : 2;
     }
     if (action === "warn") {
-        return mode === "strict" ? 2 : 1;
-    }
-    if (action === "analysis_incomplete") {
-        return 4;
+        return failOn === "warn" ? 1 : 0;
     }
     return 0;
 }

package/dist/scripts/gate.js

@@ -1,7 +1,7 @@
 import { loadUserConfig } from "../config/settings.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { createTheme } from "../presentation/theme.js";
-import { loadDgFile, saveDgFile } from "../project/dgfile.js";
+import { dgFilePath, loadDgFile, saveDgFile, withDgFileLock } from "../project/dgfile.js";
 import { detectPnpmIgnoredBuilds, detectScriptWanters } from "./detect.js";
 export function evaluateScriptGate(wanters, approvals) {
     const approved = [];
@@ -49,33 +49,38 @@ export function applyScriptDecisions(file, decisions, now) {
     };
 }
 export function recordScriptObservations(options) {
-    const file = loadDgFile(options.projectDir);
-    if (!file.readable || (!file.exists && !options.createIfMissing) || options.wanters.length === 0) {
-        return { written: false, path: file.path };
+    if (options.wanters.length === 0) {
+        return { written: false, path: dgFilePath(options.projectDir) };
     }
-    const observed = { ...file.scriptApprovals.observed };
-    let changed = false;
-    for (const wanter of options.wanters) {
-        const existing = observed[wanter.name];
-        if (existing &&
-            existing.version === wanter.version &&
-            existing.scriptsHash === wanter.scriptsHash &&
-            sameHooks(existing.hooks, wanter.hooks)) {
-            continue;
+    return withDgFileLock(options.projectDir, options.env, () => {
+        const file = loadDgFile(options.projectDir);
+        if (!file.readable || (!file.exists && !options.createIfMissing)) {
+            return { written: false, path: file.path };
         }
-        observed[wanter.name] = {
-            version: wanter.version,
-            hooks: wanter.hooks,
-            scriptsHash: wanter.scriptsHash,
-            firstSeen: existing ? existing.firstSeen : options.now.toISOString()
-        };
-        changed = true;
-    }
-    if (!changed) {
-        return { written: false, path: file.path };
-    }
-    saveDgFile({ ...file, scriptApprovals: { ...file.scriptApprovals, observed } });
-    return { written: true, path: file.path };
+        const observed = { ...file.scriptApprovals.observed };
+        let changed = false;
+        for (const wanter of options.wanters) {
+            const existing = observed[wanter.name];
+            if (existing &&
+                existing.version === wanter.version &&
+                existing.scriptsHash === wanter.scriptsHash &&
+                sameHooks(existing.hooks, wanter.hooks)) {
+                continue;
+            }
+            observed[wanter.name] = {
+                version: wanter.version,
+                hooks: wanter.hooks,
+                scriptsHash: wanter.scriptsHash,
+                firstSeen: existing ? existing.firstSeen : options.now.toISOString()
+            };
+            changed = true;
+        }
+        if (!changed) {
+            return { written: false, path: file.path };
+        }
+        saveDgFile({ ...file, scriptApprovals: { ...file.scriptApprovals, observed } });
+        return { written: true, path: file.path };
+    });
 }
 function sameHooks(a, b) {
     return a.length === b.length && a.every((hook, index) => hook === b[index]);
@@ -86,11 +91,16 @@ export function hasExplicitScriptPreference(args, env) {
     }
     return env.npm_config_ignore_scripts !== undefined && env.npm_config_ignore_scripts !== "";
 }
+// Managers that honor `--ignore-scripts` (and the matching npm_config env key), so
+// enforce mode can actually suppress lifecycle scripts. pip/uv build sdists via
+// setup.py / PEP 517 backends and cargo runs build.rs with no equivalent flag —
+// they cannot be enforced this way and are surfaced by runScriptGateAfterInstall.
+const IGNORE_SCRIPTS_MANAGERS = new Set(["npm", "yarn", "pnpm"]);
 export function scriptGateInstallArgs(options) {
     if (options.mode !== "enforce") {
         return options.args;
     }
-    if (options.manager !== "npm" && options.manager !== "yarn") {
+    if (!IGNORE_SCRIPTS_MANAGERS.has(options.manager)) {
         return options.args;
     }
     if (hasExplicitScriptPreference(options.args, options.env)) {
@@ -99,7 +109,7 @@ export function scriptGateInstallArgs(options) {
     return [...options.args, "--ignore-scripts"];
 }
 export function scriptGateChildEnv(options) {
-    if (options.mode !== "enforce" || (options.manager !== "npm" && options.manager !== "yarn")) {
+    if (options.mode !== "enforce" || !IGNORE_SCRIPTS_MANAGERS.has(options.manager)) {
         return {};
     }
     if (hasExplicitScriptPreference(options.args, options.env)) {
@@ -125,6 +135,10 @@ export function scriptGateReportLine(options) {
     const noun = wanters.length === 1 ? "package ran" : "packages ran";
     return `\n  ${theme.paint("muted", `dg scripts: ${wanters.length} ${noun} install scripts (${formatNames(names)}) — observed, not blocked · silence: dg config set scriptGate.mode off`)}\n`;
 }
+function unsuppressableScriptNotice(manager) {
+    const theme = createTheme(resolvePresentation().color);
+    return `\n  ${theme.paint("muted", `dg scripts: enforce mode cannot suppress build/install scripts for ${manager} (no --ignore-scripts equivalent); they ran — review with dg scan`)}\n`;
+}
 function formatNames(names) {
     if (names.length <= REPORTED_NAME_LIMIT) {
         return names.join(", ");
@@ -139,17 +153,20 @@ const MUTATING_ACTIONS = {
 export function runScriptGateAfterInstall(options) {
     try {
         const classification = options.classification;
-        if (classification.kind !== "protected" || classification.ecosystem !== "javascript") {
-            return "";
-        }
-        const mutatingActions = MUTATING_ACTIONS[classification.manager];
-        if (!mutatingActions || !mutatingActions.has(classification.action)) {
+        if (classification.kind !== "protected") {
             return "";
         }
         const config = loadUserConfig(options.env ?? process.env);
         if (config.scriptGate.mode === "off") {
             return "";
         }
+        if (classification.ecosystem !== "javascript") {
+            return config.scriptGate.mode === "enforce" ? unsuppressableScriptNotice(classification.manager) : "";
+        }
+        const mutatingActions = MUTATING_ACTIONS[classification.manager];
+        if (!mutatingActions || !mutatingActions.has(classification.action)) {
+            return "";
+        }
         const projectDir = options.projectDir ?? process.cwd();
         if (classification.manager === "pnpm") {
             return scriptGateReportLine({ manager: "pnpm", pnpmIgnoredBuilds: detectPnpmIgnoredBuilds(projectDir) });
@@ -158,8 +175,9 @@ export function runScriptGateAfterInstall(options) {
         recordScriptObservations({
             projectDir,
             wanters,
-            createIfMissing: config.scriptGate.observe,
-            now: options.now ?? new Date()
+            createIfMissing: config.scriptGate.persistObservations,
+            now: options.now ?? new Date(),
+            env: options.env ?? process.env
         });
         return scriptGateReportLine({ manager: classification.manager, wanters });
     }

package/dist/security/csv.js

@@ -0,0 +1,9 @@
+// Single CSV-cell escaper for every exporter (SBOM, licenses, scan TUI) so the
+// formula-injection guard and the delimiter quoting can never drift apart again.
+// A cell whose first character is = + - @ (or TAB/CR) is run as a formula by
+// Excel / Google Sheets / LibreOffice on open, so prefix a sentinel apostrophe;
+// then quote for the CSV delimiter / quote / newline.
+export function csvCell(value) {
+    const guarded = /^[=+\-@\t\r]/u.test(value) ? `'${value}` : value;
+    return /[",\n\r]/u.test(guarded) ? `"${guarded.replace(/"/gu, "\"\"")}"` : guarded;
+}

package/dist/security/sanitize.js

@@ -1,11 +1,20 @@
 import { stripVTControlCharacters } from "node:util";
 const CTRL_KEEP_NEWLINE = /[\x00-\x08\x0B-\x1F\x7F-\x9F]/g;
 const CTRL_ALL = /[\x00-\x1F\x7F-\x9F]/g;
+// Invisible / zero-width / bidi-format Unicode (Trojan-Source + display spoofing):
+// these reorder or hide text on screen without changing its bytes, letting an
+// attacker-named package, license, or finding spoof what the terminal/report shows.
+// Covers zero-width (200B-200D), bidi marks (200E-200F), word-joiner + invisibles
+// (2060-2064), bidi-format overrides (202A-202E, 2066-2069), the Arabic letter mark
+// (061C), and the BOM (FEFF). Single source of truth — the audit detector re-exports
+// this so the strip set and the detect set cannot drift.
+export const INVISIBLE_UNICODE_RE = /[\u200B-\u200F\u2060-\u2064\u202A-\u202E\u2066-\u2069\u061C\uFEFF]/u;
+const INVISIBLE_GLOBAL = new RegExp(INVISIBLE_UNICODE_RE.source, "gu");
 export function sanitize(s) {
-    return stripVTControlCharacters(s).replace(CTRL_KEEP_NEWLINE, "");
+    return stripVTControlCharacters(s).replace(CTRL_KEEP_NEWLINE, "").replace(INVISIBLE_GLOBAL, "");
 }
 export function sanitizeLine(s) {
-    return stripVTControlCharacters(s).replace(/[\r\n]+/g, " ").replace(CTRL_ALL, "");
+    return stripVTControlCharacters(s).replace(/[\r\n]+/g, " ").replace(CTRL_ALL, "").replace(INVISIBLE_GLOBAL, "");
 }
 export function sanitizeDeep(value) {
     if (typeof value === "string") {

package/dist/service/state.js

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 import { loadUserConfig } from "../config/settings.js";
 import { applyTrustInstall, applyTrustUninstall, readCertificateFingerprints, readServiceTrustRecord, renderTrustStorePlanLines, resolveTrustInstallPlan, TrustStoreError, TrustToolMissingError, writeServiceTrustRecord } from "./trust-store.js";
 import { clearTrustRefreshError, readTrustRefreshError } from "./trust-refresh.js";
-import { acquireLockSync, cleanupSessionSync, createSessionSync, preserveCorruptCleanupRegistrySync, resolveDgPaths, CLEANUP_REGISTRY_LOCK } from "../state/index.js";
+import { acquireLockSync, acquireLockSyncWithRetry, cleanupSessionSync, createSessionSync, preserveCorruptCleanupRegistrySync, resolveDgPaths, CLEANUP_REGISTRY_LOCK } from "../state/index.js";
 export const SERVICE_SENTINEL = "dg-service-mode-v1";
 export const TRUST_SENTINEL = "dg-service-trust-v1";
 export const SERVICE_LOCK = "service-control";
@@ -196,7 +196,7 @@ export function startService(env, now = new Date()) {
             };
         }
         cleanupRuntime(paths, existingRuntime ?? current.proxy);
-        const runtime = startServiceProxyRuntime(paths, env ?? process.env, now);
+        const runtime = startServiceProxyRuntime(paths, env ?? process.env);
         const trustRemoval = removeTrustRecordIfDrifted(paths, current.trust, runtime, now);
         const state = {
             ...current,
@@ -255,7 +255,7 @@ export function restartService(env, now = new Date()) {
             throw new ServiceNotConfiguredError();
         }
         cleanupRuntime(paths, readRuntime(paths) ?? current.proxy);
-        const runtime = startServiceProxyRuntime(paths, env ?? process.env, now);
+        const runtime = startServiceProxyRuntime(paths, env ?? process.env);
         const trustRemoval = removeTrustRecordIfDrifted(paths, current.trust, runtime, now);
         const state = {
             ...current,
@@ -313,6 +313,20 @@ export function installServiceTrust(env, now = new Date()) {
             trustStoreOperation(() => applyTrustUninstall(existing));
         }
         const record = trustStoreOperation(() => applyTrustInstall(plan, now, TRUST_SENTINEL));
+        try {
+            writeServiceTrustRecord(paths.trustRecordPath, record);
+        }
+        catch (error) {
+            // The persisted record is what every uninstall path keys on to remove the CA;
+            // a failed write must not leave the OS trusting a CA dg can no longer find.
+            try {
+                applyTrustUninstall(record);
+            }
+            catch {
+                // rollback is best-effort; the original write failure is what propagates
+            }
+            throw error;
+        }
         clearTrustRefreshError(paths.serviceDir);
         const state = {
             ...current,
@@ -321,7 +335,6 @@ export function installServiceTrust(env, now = new Date()) {
             trustDrift: undefined,
             trustInstalledAt: current.trustInstalledAt ?? now.toISOString()
         };
-        writeServiceTrustRecord(paths.trustRecordPath, record);
         writeState(paths, state);
         writeLog(paths, "service.trust.installed", now);
         withRegistryLock(paths.paths, () => {
@@ -477,6 +490,21 @@ export function withServiceLock(paths, run) {
         lock.release();
     }
 }
+// Retry variant for callbacks that must NOT be dropped on transient contention —
+// e.g. the CA-rotation trust refresh, which silently breaks TLS interception if
+// it loses the lock and gives up.
+export function withServiceLockRetry(paths, run) {
+    const lock = acquireLockSyncWithRetry(paths.paths, SERVICE_LOCK, {
+        staleMs: SERVICE_LOCK_STALE_MS,
+        timeoutMs: 5_000
+    });
+    try {
+        return run();
+    }
+    finally {
+        lock.release();
+    }
+}
 function withRegistryLock(paths, run) {
     const lock = acquireLockSync(paths, CLEANUP_REGISTRY_LOCK, {
         staleMs: SERVICE_LOCK_STALE_MS
@@ -554,10 +582,13 @@ function withTrustRefreshError(paths, state) {
     if (!refreshError) {
         return state;
     }
+    // Surface the trust-refresh failure even when another lastError is already set
+    // (a `??` here would silently drop it — and a broken CA trust is exactly the
+    // failure the user must see to repair TLS interception).
+    const refreshMessage = `service CA trust refresh failed at ${refreshError.at}: ${refreshError.message}. Run 'dg service trust install --yes' to repair OS trust for the rotated CA.`;
     return {
         ...state,
-        lastError: state.lastError
-            ?? `service CA trust refresh failed at ${refreshError.at}: ${refreshError.message}. Run 'dg service trust install --yes' to repair OS trust for the rotated CA.`
+        lastError: state.lastError ? `${state.lastError}; ${refreshMessage}` : refreshMessage
     };
 }
 function runtimeHealth(runtime) {
@@ -567,35 +598,72 @@ function runtimeHealth(runtime) {
             reason: `recorded service worker pid ${runtime.pid} is not running`
         };
     }
-    if (!healthEndpointReachable(runtime.healthUrl)) {
-        return {
-            healthy: false,
-            reason: `health endpoint is unreachable at ${runtime.healthUrl}`
-        };
-    }
-    return {
-        healthy: true,
-        reason: undefined
-    };
+    return healthEndpointReachable(runtime);
 }
-function healthEndpointReachable(healthUrl) {
+function healthEndpointReachable(runtime) {
+    const expectedProxyPort = servicePortFromUrl(runtime.proxyUrl);
     const script = `
 const http = require("node:http");
 const https = require("node:https");
 const target = process.argv[1];
+const expectedPid = Number(process.argv[2]);
+const expectedProxyPort = Number(process.argv[3]);
 const client = target.startsWith("https:") ? https : http;
 const request = client.get(target, { timeout: 500 }, (response) => {
-  response.resume();
-  response.on("end", () => process.exit(response.statusCode === 200 ? 0 : 1));
+  if (response.statusCode !== 200) {
+    response.resume();
+    response.on("end", () => process.exit(1));
+    return;
+  }
+  let body = "";
+  response.setEncoding("utf8");
+  response.on("data", (chunk) => {
+    if (body.length < 65536) {
+      body += chunk;
+    }
+  });
+  response.on("end", () => {
+    try {
+      const parsed = JSON.parse(body);
+      const identified = parsed && parsed.ok === true && parsed.pid === expectedPid && parsed.proxyPort === expectedProxyPort;
+      process.exit(identified ? 0 : 2);
+    } catch {
+      process.exit(2);
+    }
+  });
 });
 request.on("timeout", () => request.destroy(new Error("timeout")));
 request.on("error", () => process.exit(1));
 `;
-    const result = spawnSync(process.execPath, ["-e", script, healthUrl], {
+    const result = spawnSync(process.execPath, ["-e", script, runtime.healthUrl, String(runtime.pid), String(expectedProxyPort)], {
         stdio: "ignore",
         timeout: 1_000
     });
-    return result.status === 0;
+    if (result.status === 0) {
+        return {
+            healthy: true,
+            reason: undefined
+        };
+    }
+    if (result.status === 2) {
+        return {
+            healthy: false,
+            reason: `health endpoint at ${runtime.healthUrl} did not identify the dg service worker (expected pid ${runtime.pid})`
+        };
+    }
+    return {
+        healthy: false,
+        reason: `health endpoint is unreachable at ${runtime.healthUrl}`
+    };
+}
+function servicePortFromUrl(url) {
+    try {
+        const { port } = new URL(url);
+        return port ? Number(port) : Number.NaN;
+    }
+    catch {
+        return Number.NaN;
+    }
 }
 function detectTrustDrift(trust, runtime) {
     if (!trust || !runtime?.caPath || !existsSync(runtime.caPath)) {
@@ -628,6 +696,15 @@ function removeTrustRecordIfDrifted(paths, trust, runtime, now) {
             message: undefined
         };
     }
+    if (drift.activeFingerprintSha256 === undefined) {
+        // The active CA is merely unreadable (a transient IO / restart race), not a
+        // confirmed mismatch — surface the message but do NOT tear down the user's OS
+        // trust, which would force a manual reinstall over a recoverable condition.
+        return {
+            removed: false,
+            message: drift.message
+        };
+    }
     trustStoreOperation(() => applyTrustUninstall(trust));
     removeFile(paths.trustRecordPath);
     withRegistryLock(paths.paths, () => {
@@ -639,8 +716,13 @@ function removeTrustRecordIfDrifted(paths, trust, runtime, now) {
         message: `${drift.message} The stale dg-owned trust record was removed during service restart.`
     };
 }
-function startServiceProxyRuntime(paths, env, now) {
-    const workerPath = env.DG_SERVICE_WORKER_PATH ?? fileURLToPath(new URL("./worker.js", import.meta.url));
+function startServiceProxyRuntime(paths, env) {
+    // DG_SERVICE_WORKER_PATH is a test seam (point at a stub worker). Honouring an
+    // arbitrary path from the ambient environment in production is an arbitrary-code
+    // -execution vector, so the override is accepted only under NODE_ENV=test.
+    const workerPath = env.NODE_ENV === "test" && env.DG_SERVICE_WORKER_PATH
+        ? env.DG_SERVICE_WORKER_PATH
+        : fileURLToPath(new URL("./worker.js", import.meta.url));
     if (!existsSync(workerPath)) {
         throw new ServiceProxyError("service proxy worker is unavailable until the CLI package is built");
     }
@@ -651,18 +733,23 @@ function startServiceProxyRuntime(paths, env, now) {
         mode: 0o600
     });
     const config = loadUserConfig(env);
+    const childEnv = {
+        ...env,
+        DG_SERVICE_CLASSIFICATION: JSON.stringify({
+            kind: "protected",
+            manager: "npm",
+            realBinaryName: "npm",
+            action: "service-proxy",
+            args: []
+        })
+    };
+    // The service worker gates every install for the daemon's lifetime; it must
+    // never inherit a --dg-force-install request from whatever environment happened
+    // to start the service, which would silently downgrade every block.
+    delete childEnv.DG_FORCE_OVERRIDE_REQUEST;
     const child = spawn(process.execPath, [workerPath, sessionBootstrapPath, config.api.baseUrl, paths.runtimePath], {
         detached: true,
-        env: {
-            ...env,
-            DG_SERVICE_CLASSIFICATION: JSON.stringify({
-                kind: "protected",
-                manager: "npm",
-                realBinaryName: "npm",
-                action: "service-proxy",
-                args: []
-            })
-        },
+        env: childEnv,
         stdio: "ignore"
     });
     child.unref();
@@ -674,7 +761,6 @@ function startServiceProxyRuntime(paths, env, now) {
         cleanupSessionSync(session);
         throw new ServiceProxyError("service proxy worker did not become healthy");
     }
-    void now;
     return runtime;
 }
 function waitForRuntime(paths, pid) {
@@ -823,9 +909,6 @@ function writeRegistry(paths, registry) {
 }
 function writeRegistryIfChanged(paths, registry, targets) {
     const next = removeRegistryTargets(registry, targets);
-    if (!existsSync(paths.cleanupRegistryPath) && registry.entries.length === next.entries.length) {
-        return;
-    }
     if (registry.entries.length === next.entries.length) {
         return;
     }

package/dist/service/trust-refresh.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { applyTrustInstall, applyTrustUninstall, readServiceTrustRecord, resolveTrustInstallPlan, writeServiceTrustRecord } from "./trust-store.js";
+import { applyTrustInstall, applyTrustUninstall, reconcileLinuxTrustStore, readServiceTrustRecord, resolveTrustInstallPlan, writeServiceTrustRecord } from "./trust-store.js";
 export const TRUST_REFRESH_ERROR_FILENAME = "trust-refresh-error.json";
 export function trustRefreshErrorPath(serviceDir) {
     return join(serviceDir, TRUST_REFRESH_ERROR_FILENAME);
@@ -58,6 +58,7 @@ function sweepStaleDgTrustFiles(provider, targetPath) {
     catch {
         return;
     }
+    let removedAny = false;
     for (const entry of entries) {
         if (!/^dependency-guardian-[0-9a-f]{16}\.(pem|crt)$/.test(entry)) {
             continue;
@@ -69,6 +70,16 @@ function sweepStaleDgTrustFiles(provider, targetPath) {
         rmSync(path, {
             force: true
         });
+        removedAny = true;
+    }
+    if (removedAny && provider === "linux-system-ca") {
+        try {
+            reconcileLinuxTrustStore();
+        }
+        catch {
+            // best-effort: the new cert is already installed+trusted; a failed reconcile
+            // only delays pruning the swept-out roots until the next rotation.
+        }
     }
 }
 function writeTrustRefreshError(serviceDir, error, now) {

package/dist/service/trust-store.js

@@ -1,6 +1,6 @@
 import { X509Certificate } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { writeJsonAtomic } from "../util/json-file.js";
@@ -92,6 +92,20 @@ export function renderTrustStorePlanLines(plan) {
     ];
     return plan.reason ? [...lines, `support note: ${plan.reason}`] : lines;
 }
+// Install ONLY the active (first) cert from the on-disk rotation bundle (which
+// holds new+previous certs). Copying the whole bundle would keep every rotated-out
+// CA trusted, defeating the ephemeral-CA model. Remove any existing target first
+// (rm does not follow a symlink) then create with O_EXCL so a pre-planted symlink
+// can't redirect this (root-privileged) write to an arbitrary path.
+function extractActiveCert(srcBundlePath) {
+    const bundle = readFileSync(srcBundlePath, "utf8");
+    const match = bundle.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----\s*/);
+    return match ? match[0] : bundle;
+}
+function installActiveCert(srcBundlePath, target) {
+    rmSync(target, { force: true });
+    writeFileSync(target, extractActiveCert(srcBundlePath), { mode: 0o644, flag: "wx" });
+}
 export function applyTrustInstall(plan, installedAt, sentinel) {
     if (!plan.supported || plan.provider === "unsupported") {
         throw new TrustStoreError(plan.reason ?? "Service trust-store installation is unsupported on this platform.");
@@ -101,17 +115,28 @@ export function applyTrustInstall(plan, installedAt, sentinel) {
             recursive: true,
             mode: 0o700
         });
-        copyFileSync(plan.caPath, plan.target);
+        installActiveCert(plan.caPath, plan.target);
     }
     else if (plan.provider === "darwin-user-keychain") {
-        runNativeCommand(plan.installCommand, "macOS user keychain trust installation failed");
+        // `security add-trusted-cert` on the multi-cert rotation bundle would trust
+        // EVERY rotated-out CA too, accumulating perpetual trusted roots. Materialize
+        // and trust ONLY the active cert (the command's last arg is the bundle path).
+        const dir = mkdtempSync(join(tmpdir(), "dg-trust-"));
+        const activeCertPath = join(dir, "active.pem");
+        try {
+            writeFileSync(activeCertPath, extractActiveCert(plan.caPath), { mode: 0o600 });
+            runNativeCommand([...plan.installCommand.slice(0, -1), activeCertPath], "macOS user keychain trust installation failed");
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
     }
     else {
         mkdirSync(dirname(plan.target), {
             recursive: true,
             mode: 0o755
         });
-        copyFileSync(plan.caPath, plan.target);
+        installActiveCert(plan.caPath, plan.target);
         try {
             runNativeCommand(["update-ca-certificates"], "Linux trust-store refresh failed");
         }
@@ -230,6 +255,12 @@ function normalizeFingerprint(value) {
 function isTrustStoreProvider(value) {
     return value === "darwin-user-keychain" || value === "linux-system-ca" || value === "file";
 }
+export function reconcileLinuxTrustStore() {
+    // Re-run update-ca-certificates so hashed symlinks / ca-certificates.crt entries
+    // for source files removed during a sweep are actually pruned (removing the .crt
+    // alone does not untrust the root until this runs).
+    runNativeCommand(["update-ca-certificates"], "Linux trust-store reconcile failed");
+}
 function runNativeCommand(command, failureMessage) {
     const [program, ...args] = command;
     if (!program) {

package/dist/service/worker.js

@@ -1,8 +1,9 @@
 import { createServer } from "node:http";
 import { readFileSync, rmSync, writeFileSync } from "node:fs";
 import { startProductionHttpProxy } from "../proxy/server.js";
-import { resolveServicePaths, TRUST_SENTINEL, withServiceLock } from "./state.js";
+import { resolveServicePaths, TRUST_SENTINEL, withServiceLockRetry } from "./state.js";
 import { refreshServiceTrustAfterCaRotation } from "./trust-refresh.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
 const sessionPath = process.argv[2];
 const apiBaseUrl = process.argv[3];
 const runtimePath = process.argv[4];
@@ -30,9 +31,6 @@ async function close() {
     });
     await Promise.all([proxy?.close(), closeHealthServer(healthServer)]);
 }
-process.stdin.on("end", () => {
-    close().finally(() => process.exit(0));
-});
 process.on("SIGTERM", () => {
     close().finally(() => process.exit(0));
 });
@@ -42,7 +40,7 @@ process.on("SIGINT", () => {
 function exitOnFatal(error) {
     const message = error instanceof Error ? error.message : String(error);
     try {
-        process.stderr.write(`dg service worker: unexpected error — ${message}\n`);
+        process.stderr.write(`dg service worker: unexpected error — ${redactSecrets(message)}\n`);
     }
     catch {
         // stderr is gone; nothing left to report to.
@@ -50,14 +48,14 @@ function exitOnFatal(error) {
     close().finally(() => process.exit(1));
 }
 process.on("uncaughtException", exitOnFatal);
-process.on("unhandledRejection", exitOnFatal);
+process.on("unhandledRejection", (reason) => exitOnFatal(reason));
 const servicePaths = resolveServicePaths(process.env);
 proxy = await startProductionHttpProxy({
     session,
     apiBaseUrl: requiredApiBaseUrl,
     classification,
     env: process.env,
-    onCaRotate: () => withServiceLock(servicePaths, () => refreshServiceTrustAfterCaRotation({
+    onCaRotate: () => withServiceLockRetry(servicePaths, () => refreshServiceTrustAfterCaRotation({
         serviceDir: servicePaths.serviceDir,
         trustRecordPath: servicePaths.trustRecordPath,
         sentinel: TRUST_SENTINEL,

package/dist/setup/git-hook.js

@@ -28,7 +28,7 @@ export function resolveGitRepo(options = {}) {
     const cwd = options.cwd ?? process.cwd();
     const inside = gitTrimmed(["rev-parse", "--is-inside-work-tree"], { cwd, env });
     if (inside !== "true") {
-        return { error: "not a git repository — run dg guard-commit inside a repo" };
+        return { error: "not a git repository — run dg commit-guard inside a repo" };
     }
     const root = gitTrimmed(["rev-parse", "--show-toplevel"], { cwd, env });
     if (!root) {
@@ -113,7 +113,7 @@ export function applyGitHook(context, now = new Date()) {
                 {
                     name: "hook-writable",
                     ok: false,
-                    detail: `${context.hookTarget} is a symlink; dg refuses to replace it — remove the link or point it at a real file, then re-run dg guard-commit`
+                    detail: `${context.hookTarget} is a symlink; dg refuses to replace it — remove the link or point it at a real file, then re-run dg commit-guard`
                 }
             ],
             active: false