@primitive.ai/prim 0.1.0-alpha.23 → 0.1.0-alpha.25

package/README.md

@@ -24,6 +24,15 @@ npx @primitive.ai/prim
 
 ## Quick Start
 
+One command does the whole install — auth, session hooks, daemon, git hooks,
+skill, and the welcome:
+
+```bash
+prim setup                 # add --agent codex for Codex, --no-daemon to skip the daemon
+```
+
+Or run the steps individually:
+
 ```bash
 # 1. Authenticate via browser (WorkOS OAuth)
 prim auth login
@@ -38,10 +47,27 @@ prim daemon start
 prim hooks install
 ```
 
-An AI coding agent can drive the entire setup itself — see [`setup.md`](./setup.md).
+`prim claude install` also writes a scoped `Bash(npx --yes @primitive.ai/prim:*)`
+allow-rule into `.claude/settings.json` (covering both the `@latest` onboarding form
+and the bare day-to-day form), so an agent's prim calls don't stall on a permission
+prompt.
+
+An AI coding agent can drive the setup itself — see [`setup.md`](./setup.md).
 
 ## Commands
 
+### Setup
+
+```bash
+prim setup                   # Run the whole install in one shot
+prim setup --agent codex     # Same, for OpenAI Codex
+prim setup --no-daemon       # Skip the companion daemon
+```
+
+Orchestrates auth → session hooks → daemon → git hooks → skill → welcome,
+re-running each underlying command so every step behaves exactly as if run by
+hand (including the browser login). Idempotent — safe to re-run.
+
 ### Auth
 
 ```bash

package/dist/index.js

@@ -401,6 +401,12 @@ var REGISTRATIONS = [
   makeRegistration("SessionStart", "*", SESSION_START_BIN),
   makeRegistration("SessionEnd", "*", SESSION_END_BIN)
 ];
+var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim:*)";
+var LEGACY_PRIM_PERMISSION_RULES = ["Bash(npx --yes @primitive.ai/prim@latest:*)"];
+var ALL_PRIM_PERMISSION_RULES = /* @__PURE__ */ new Set([
+  PRIM_PERMISSION_RULE,
+  ...LEGACY_PRIM_PERMISSION_RULES
+]);
 function settingsPathFor(scope) {
   return scope === "user" ? USER_SCOPE_PATH : projectScopePath();
 }
@@ -463,12 +469,36 @@ function applyStatusLine(settings) {
     }
   };
 }
+function applyPermissions(settings) {
+  const permissions = settings.permissions ?? {};
+  const allow = permissions.allow ?? [];
+  const withoutPrim = allow.filter((rule) => !ALL_PRIM_PERMISSION_RULES.has(rule));
+  const nextAllow = [...withoutPrim, PRIM_PERMISSION_RULE];
+  const unchanged = allow.length === nextAllow.length && allow.every((rule, i) => rule === nextAllow[i]);
+  if (unchanged) {
+    return settings;
+  }
+  return { ...settings, permissions: { ...permissions, allow: nextAllow } };
+}
+function removePrimPermission(settings) {
+  const permissions = settings.permissions;
+  if (!permissions?.allow?.some((rule) => ALL_PRIM_PERMISSION_RULES.has(rule))) {
+    return settings;
+  }
+  const allow = permissions.allow.filter((rule) => !ALL_PRIM_PERMISSION_RULES.has(rule));
+  const nextPermissions = {
+    ...permissions,
+    allow: allow.length > 0 ? allow : void 0
+  };
+  const hasOtherPerms = Object.values(nextPermissions).some((v) => v !== void 0);
+  return { ...settings, permissions: hasOtherPerms ? nextPermissions : void 0 };
+}
 function applyInstall(settings, options = {}) {
   const hooks = { ...settings.hooks ?? {} };
   for (const reg of REGISTRATIONS) {
     hooks[reg.event] = ensureRegistration(hooks[reg.event] ?? [], reg, options.force ?? false);
   }
-  return applyStatusLine({ ...settings, hooks });
+  return applyPermissions(applyStatusLine({ ...settings, hooks }));
 }
 function applyUninstall(settings) {
   const source = settings.hooks ?? {};
@@ -486,7 +516,7 @@ function applyUninstall(settings) {
   if (isPrimStatusLine(next)) {
     next.statusLine = void 0;
   }
-  return next;
+  return removePrimPermission(next);
 }
 function captureInstalled(settings) {
   return CAPTURE_EVENTS.some(
@@ -2231,6 +2261,92 @@ function registerSessionCommands(program2) {
   });
 }
 
+// src/commands/setup.ts
+import { spawnSync } from "child_process";
+var EXIT_INCOMPLETE = 1;
+var EXIT_USAGE3 = 2;
+function planSetupSteps(opts) {
+  const scopeArgs = opts.scope === "user" ? ["--scope", "user"] : [];
+  const steps = [
+    {
+      key: "session",
+      label: opts.agent === "codex" ? "Codex integration" : "Claude Code integration",
+      args: [opts.agent, "install", ...scopeArgs],
+      required: true
+    }
+  ];
+  if (opts.daemon) {
+    steps.push({
+      key: "daemon",
+      label: "Companion daemon",
+      args: ["daemon", "start"],
+      required: false
+    });
+  }
+  steps.push({ key: "hooks", label: "Git hooks", args: ["hooks", "install"], required: true });
+  steps.push({ key: "skill", label: "Agent skill", args: ["skill", "install"], required: true });
+  return steps;
+}
+function registerSetupCommand(program2) {
+  program2.command("setup").description(
+    "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
+  ).option("--agent <agent>", "claude or codex", "claude").option("--scope <scope>", "project or user (session integration)", "project").option("--no-daemon", "skip starting the companion daemon").action((opts) => {
+    if (opts.agent !== "claude" && opts.agent !== "codex") {
+      process.stderr.write(`[prim] unknown --agent "${opts.agent}" (expected claude or codex)
+`);
+      process.exit(EXIT_USAGE3);
+    }
+    if (opts.scope !== "project" && opts.scope !== "user") {
+      process.stderr.write(`[prim] unknown --scope "${opts.scope}" (expected project or user)
+`);
+      process.exit(EXIT_USAGE3);
+    }
+    const agent = opts.agent;
+    const scope = opts.scope;
+    const self = process.argv[1];
+    const run = (args, capture = false) => {
+      const r = spawnSync(process.execPath, [self, ...args], {
+        stdio: capture ? ["inherit", "pipe", "inherit"] : "inherit",
+        encoding: "utf-8"
+      });
+      return { code: r.status ?? 1, stdout: capture ? r.stdout ?? "" : "" };
+    };
+    const results = {};
+    const note = (msg) => {
+      process.stderr.write(`[prim] ${msg}
+`);
+    };
+    const isAuthed = (json) => {
+      try {
+        return JSON.parse(json || "{}").authenticated === true;
+      } catch {
+        return false;
+      }
+    };
+    if (isAuthed(run(["auth", "status", "--json"], true).stdout)) {
+      note("auth \xB7 already authenticated");
+      results.auth = "ok";
+    } else {
+      note("auth \xB7 opening browser to authenticate\u2026");
+      run(["auth", "login"]);
+      results.auth = isAuthed(run(["auth", "status", "--json"], true).stdout) ? "ok" : "failed";
+    }
+    for (const step of planSetupSteps({ agent, daemon: opts.daemon, scope })) {
+      note(`${step.label} \xB7 installing\u2026`);
+      const { code } = run(step.args);
+      results[step.key] = code === 0 ? "ok" : step.required ? "failed" : "skipped";
+    }
+    note("welcome");
+    results.welcome = run(["welcome"]).code === 0 ? "ok" : "failed";
+    const failed = Object.entries(results).filter(([, v]) => v === "failed").map(([k]) => k);
+    const trail = Object.entries(results).map(([k, v]) => `${k}:${v}`).join(" \xB7 ");
+    note(
+      `setup ${failed.length === 0 ? "complete" : `incomplete (failed: ${failed.join(", ")})`} \u2014 ${trail}`
+    );
+    process.exit(failed.length === 0 ? 0 : EXIT_INCOMPLETE);
+  });
+}
+
 // src/commands/skill.ts
 import {
   closeSync as closeSync2,
@@ -2583,6 +2699,7 @@ registerDaemonCommands(program);
 registerReconcileCommands(program);
 registerStatuslineCommands(program);
 registerWelcomeCommand(program);
+registerSetupCommand(program);
 process.on("unhandledRejection", (err) => {
   const msg = err instanceof Error ? err.message : String(err);
   console.error(msg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.23",
+  "version": "0.1.0-alpha.25",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",