@primitive.ai/prim 0.1.0-alpha.31 → 0.1.0-alpha.32

package/README.md

@@ -28,7 +28,7 @@ One command does the whole install — auth, session hooks, daemon, git hooks,
 skill, and the welcome:
 
 ```bash
-prim setup                 # add --agent codex for Codex, --no-daemon to skip the daemon
+prim setup                 # add --agent codex or --agent hermes, --no-daemon to skip the daemon
 ```
 
 Or run the steps individually:
@@ -38,7 +38,7 @@ Or run the steps individually:
 prim auth login
 
 # 2. Wire the session hooks (decision capture + conflict gate + presence)
-prim claude install        # or: prim codex install
+prim claude install        # or: prim codex install / prim hermes install
 
 # 3. Start the companion daemon (latency + team presence)
 prim daemon start
@@ -74,6 +74,7 @@ and the manual fallback — live in [`setup.md`](./setup.md).
 ```bash
 prim setup                   # Run the whole install in one shot
 prim setup --agent codex     # Same, for OpenAI Codex
+prim setup --agent hermes    # Same, for Hermes Agent (global-only config)
 prim setup --no-daemon       # Skip the companion daemon
 ```
 
@@ -99,12 +100,16 @@ self-resolves the CLI at run time (PATH, then a local install, then
 
 Installs into the current project by default — the repo's `.claude/settings.json`
 / `.codex/hooks.json`, resolved from the git root (so any subdirectory works);
-pass `--scope user` to install machine-wide.
+pass `--scope user` to install machine-wide. Hermes is the exception: it reads
+shell hooks only from the global `~/.hermes/config.yaml`, so `prim hermes install`
+is always user-scoped — and prim merges in place, leaving the rest of that file
+(providers, models, your own hooks) untouched.
 
 ```bash
 prim claude install                # Install Claude Code hooks (project scope; uninstall / status)
 prim claude install --scope user   # Install machine-wide instead
 prim codex install                 # Install OpenAI Codex hooks (project scope)
+prim hermes install                # Install Hermes Agent hooks (global ~/.hermes/config.yaml)
 ```
 
 ### Daemon

package/SKILL.md

@@ -11,7 +11,7 @@ description: Use the prim CLI for Primitive's decision graph — passive decisio
 
 As your team codes, prim passively captures the **decisions** you make -- which library, which pattern, which config value -- into a queryable graph, and links them: a decision can depend on earlier decisions (auto-linked from shared files, or related by hand — see *Relate decisions*) and reference the files it touched. When a later change conflicts with a load-bearing prior decision, prim **gates** the edit and surfaces the decision for review.
 
-You never invoke capture. It runs automatically through the session hooks installed by `npx --yes @primitive.ai/prim claude install` (Claude Code) or `npx --yes @primitive.ai/prim codex install` (Codex). Your job is to **respond** to the gate, **read** the graph before load-bearing edits, and **answer** the occasional rationale confirmation.
+You never invoke capture. It runs automatically through the session hooks installed by `npx --yes @primitive.ai/prim claude install` (Claude Code), `npx --yes @primitive.ai/prim codex install` (Codex), or `npx --yes @primitive.ai/prim hermes install` (Hermes). Your job is to **respond** to the gate, **read** the graph before load-bearing edits, and **answer** the occasional rationale confirmation.
 
 ## Auth
 
@@ -33,10 +33,10 @@ The CLI auto-refreshes a still-valid session from the stored refresh token (proa
 
 ## Heed the conflict gate
 
-Before an edit (Claude Code: Edit/Write/MultiEdit; Codex: apply_patch) a PreToolUse hook scores the target file against the graph:
+Before an edit (Claude Code: Edit/Write/MultiEdit; Codex: apply_patch; Hermes: write_file/patch) a PreToolUse hook scores the target file against the graph:
 
 - **deny** -- the edit is blocked: it conflicts with a load-bearing prior decision. Don't fight it. Read the reason line; it names the decision id. If you genuinely intend to override that decision, run `npx --yes @primitive.ai/prim reconcile dec_<shortId>`, then retry the edit once. Otherwise choose an approach that respects the decision.
-- **warn / additional context** -- the edit proceeds, but a relevant prior decision is surfaced. Read it. On Codex a would-be `ask` is delivered as allow-plus-context (Codex can't pause mid-tool), so that context is your only signal -- read it before continuing.
+- **warn / additional context** -- the edit proceeds, but a relevant prior decision is surfaced. Read it. On Codex a would-be `ask` is delivered as allow-plus-context (Codex can't pause mid-tool), so that context is your only signal -- read it before continuing. Hermes has no soft-confirm tier, so a would-be `ask` arrives as a **deny** carrying the same reconcile directive: reconcile and retry, or set `PRIM_HOOK_MODE=warn` to downgrade it to context-only.
 - **"decision check skipped / not verified" or "... partial / truncated"** -- the check could not fully run. Treat constraints as UNKNOWN, not clear; never read silence as approval.
 
 The gate fail-opens on its *own* infrastructure errors (no daemon, network blip, org-unbound token) -- a setup problem never blocks your edit. That is exactly why an "unavailable" note matters: it is the honest signal that the check, not your edit, is what failed.
@@ -44,7 +44,7 @@ The gate fail-opens on its *own* infrastructure errors (no daemon, network blip,
 ## Read the graph before large or load-bearing edits
 
 - `npx --yes @primitive.ai/prim decisions check --files "src/a.ts,src/b.ts"` -- which active decisions reference the files you're about to touch (comma-separated paths, one `--files` value). Run it before a big change.
-- `npx --yes @primitive.ai/prim decisions recent` -- the team's recent decisions, each row badged by author and agent (`Your Claude Code` / `Your Codex`); `--limit <n>` and `--since <dur>` narrow it.
+- `npx --yes @primitive.ai/prim decisions recent` -- the team's recent decisions, each row badged by author and agent (`Your Claude Code` / `Your Codex` / `Your Hermes`); `--limit <n>` and `--since <dur>` narrow it.
 - `npx --yes @primitive.ai/prim decisions show <idOrShortId>` and `npx --yes @primitive.ai/prim decisions cascade <idOrShortId>` -- full detail, and the downstream blast radius a change would disturb.
 
 ## Reconcile and the verdict footer
@@ -116,7 +116,7 @@ npx --yes @primitive.ai/prim hooks uninstall
 
 Under `CI=1` (or with `--non-interactive`), `hooks install` fails fast in a Husky repo unless `--yes` or `--target` is set; the error names both escapes. `hooks uninstall` only removes the `.git/hooks` copies — if a hook was installed into `.husky/`, remove the prim block from that file manually. To suppress the hooks for one commit, use `git commit --no-verify`.
 
-These git hooks are separate from the **session hooks** (`claude install` / `codex install`) that drive in-session capture and the conflict gate.
+These git hooks are separate from the **session hooks** (`claude install` / `codex install` / `hermes install`) that drive in-session capture and the conflict gate.
 
 ## Output formats
 
@@ -137,7 +137,7 @@ Examples:
 - **An "unavailable" / "not verified" gate or check is not an all-clear.** Treat constraints as UNKNOWN and proceed deliberately; never read the silence as approval.
 - **A `deny` means a real prior decision conflicts.** Reconcile only when you genuinely intend to override it; otherwise pick an approach that respects it.
 - **Reconcile bypasses are single-use and short-lived.** One bypass clears your *next* edit to the governed file; it is not a standing override.
-- **Capture of your coding activity is automatic, never manual.** If decisions aren't showing up, check that the session hooks are installed (`claude status` / `codex status`) and the daemon is running — don't try to inject moves by hand. (Deliberately *authoring* a decision the user asks you to record is a separate, supported path — `decisions create`, above.)
+- **Capture of your coding activity is automatic, never manual.** If decisions aren't showing up, check that the session hooks are installed (`claude status` / `codex status` / `hermes status`) and the daemon is running — don't try to inject moves by hand. (Deliberately *authoring* a decision the user asks you to record is a separate, supported path — `decisions create`, above.)
 - **Don't fabricate rationale on a confirmation.** If you don't know why a decision was made, say so rather than guessing.
 
 ## After each task

package/dist/{chunk-7GHOFNJ2.js → chunk-S2O4P4A3.js}

@@ -19,10 +19,10 @@ function toMove(parsed, cliVersion, agent = "claude_code") {
       osPlatform: platform()
     },
     envelopeVersion: ENVELOPE_VERSION,
-    // Stamp the producer only for Codex; Claude Code moves omit it (the
-    // backend defaults an absent value to "claude_code"), keeping the
-    // Claude wire shape byte-identical.
-    ...agent === "codex" ? { producer: "codex" } : {}
+    // Stamp the producer for non-Claude agents (codex, hermes); Claude Code
+    // moves omit it (the backend defaults an absent value to "claude_code"),
+    // keeping the Claude wire shape byte-identical.
+    ...agent === "claude_code" ? {} : { producer: agent }
   };
 }
 function toCommitMove(commit, cliVersion, cwd) {

package/dist/chunk-TCDUH7AN.js

@@ -0,0 +1,35 @@
+// src/hooks/agent.ts
+function parseAgent(argv) {
+  const i = argv.indexOf("--agent");
+  const value = i !== -1 ? argv[i + 1] : void 0;
+  if (value === "codex" || value === "hermes") {
+    return value;
+  }
+  return "claude_code";
+}
+
+// src/hooks/normalize.ts
+var HERMES_EVENT_MAP = {
+  on_session_start: "SessionStart",
+  on_session_end: "SessionEnd",
+  pre_llm_call: "UserPromptSubmit",
+  post_llm_call: "Stop",
+  pre_tool_call: "PreToolUse",
+  post_tool_call: "PostToolUse",
+  subagent_stop: "SubagentStop"
+};
+function normalizeEnvelope(parsed, agent) {
+  if (agent !== "hermes") {
+    return parsed;
+  }
+  const raw = parsed.hook_event_name;
+  if (typeof raw === "string" && raw in HERMES_EVENT_MAP) {
+    return { ...parsed, hook_event_name: HERMES_EVENT_MAP[raw] };
+  }
+  return parsed;
+}
+
+export {
+  parseAgent,
+  normalizeEnvelope
+};

package/dist/hooks/post-commit.js

@@ -5,7 +5,7 @@ import {
 } from "../chunk-H4OR42TJ.js";
 import {
   toCommitMove
-} from "../chunk-7GHOFNJ2.js";
+} from "../chunk-S2O4P4A3.js";
 import "../chunk-26VA3ADF.js";
 
 // src/hooks/post-commit.ts

package/dist/hooks/post-tool-use.js

@@ -8,13 +8,14 @@ import {
 } from "../chunk-6LAQVM26.js";
 import {
   toMove
-} from "../chunk-7GHOFNJ2.js";
-import {
-  parseAgent
-} from "../chunk-7YRBACIE.js";
+} from "../chunk-S2O4P4A3.js";
 import {
   getClient
 } from "../chunk-26VA3ADF.js";
+import {
+  normalizeEnvelope,
+  parseAgent
+} from "../chunk-TCDUH7AN.js";
 
 // src/hooks/post-tool-use.ts
 import { readFileSync } from "fs";
@@ -42,6 +43,16 @@ var STDIN_TIMEOUT_MS = 1e3;
 var INGEST_TIMEOUT_MS = 4e3;
 var EDITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit"]);
 var CODEX_EDITING_TOOLS = /* @__PURE__ */ new Set(["apply_patch"]);
+var HERMES_EDITING_TOOLS = /* @__PURE__ */ new Set(["write_file", "patch"]);
+function editingToolsFor(agent) {
+  if (agent === "codex") {
+    return CODEX_EDITING_TOOLS;
+  }
+  if (agent === "hermes") {
+    return HERMES_EDITING_TOOLS;
+  }
+  return EDITING_TOOLS;
+}
 var here = dirname(fileURLToPath(import.meta.url));
 function resolveCliVersion() {
   try {
@@ -86,6 +97,7 @@ async function ingestMove(move) {
   );
 }
 async function main() {
+  const agent = parseAgent(process.argv);
   let raw;
   try {
     raw = await readStdin();
@@ -95,7 +107,7 @@ async function main() {
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = normalizeEnvelope(JSON.parse(raw), agent);
   } catch {
     emit();
     return;
@@ -106,8 +118,7 @@ async function main() {
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
-  const agent = parseAgent(process.argv);
-  const editingTools = agent === "codex" ? CODEX_EDITING_TOOLS : EDITING_TOOLS;
+  const editingTools = editingToolsFor(agent);
   if (!editingTools.has(toolName)) {
     emit();
     return;

package/dist/hooks/pre-tool-use.js

@@ -1,7 +1,4 @@
 #!/usr/bin/env node
-import {
-  parseAgent
-} from "../chunk-7YRBACIE.js";
 import {
   getClient,
   getSiteUrl
@@ -9,6 +6,10 @@ import {
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";
+import {
+  normalizeEnvelope,
+  parseAgent
+} from "../chunk-TCDUH7AN.js";
 
 // src/hooks/pre-tool-use-scoring.ts
 import { isAbsolute, relative, sep } from "path";
@@ -47,7 +48,7 @@ function unverifiedNote(results) {
   }
   return causes.map((c) => `[primitive] ${c}`).join("\n");
 }
-function buildHookOutput(aggregate, results, agent = "claude_code") {
+function buildHookOutput(aggregate, results, agent2 = "claude_code") {
   if (aggregate === "deny") {
     const reason = results.filter((r) => r.verdict === "deny").map((r) => r.reason).filter((s) => s.length > 0).join("\n\n") || "[primitive] conflict detected (no detail available)";
     return {
@@ -58,7 +59,7 @@ function buildHookOutput(aggregate, results, agent = "claude_code") {
       }
     };
   }
-  if (agent === "codex" && aggregate === "ask") {
+  if (agent2 === "codex" && aggregate === "ask") {
     const reason = results.filter((r) => r.verdict === "ask" || r.verdict === "deny").map((r) => r.reason).filter((s) => s.length > 0).join("\n\n");
     const context = results.map((r) => r.additionalContext).filter((s) => s.length > 0).join("\n");
     const merged = [reason, context].filter((s) => s.length > 0).join("\n\n");
@@ -113,8 +114,21 @@ function failOpenOutput() {
     }
   };
 }
+function buildHermesOutput(aggregate, results) {
+  if (aggregate !== "deny" && aggregate !== "ask") {
+    return {};
+  }
+  const reason = results.filter((r) => r.verdict === "deny" || r.verdict === "ask").map((r) => r.reason).filter((s) => s.length > 0).join("\n\n");
+  const directive = results.map((r) => r.additionalContext).filter((s) => s.length > 0).join("\n");
+  const message = [reason, directive].filter((s) => s.length > 0).join("\n\n") || "[primitive] conflict detected (no detail available)";
+  return { action: "block", message };
+}
+function failOpenHermes() {
+  return {};
+}
 var SUPPORTED_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit"]);
 var APPLY_PATCH_FILE_RE = /^\*\*\* (?:Update|Add|Delete) File: (?<path>.+)$/;
+var MOVE_FILE_RE = /^\*\*\* Move File:\s*(?<src>.+?)\s*->\s*(?<dst>.+?)\s*$/;
 var LINE_SPLIT_RE = /\r?\n/;
 function parseApplyPatchPaths(command) {
   const paths = /* @__PURE__ */ new Set();
@@ -122,6 +136,14 @@ function parseApplyPatchPaths(command) {
     const path = APPLY_PATCH_FILE_RE.exec(line)?.groups?.path?.trim();
     if (path) {
       paths.add(path);
+      continue;
+    }
+    const move = MOVE_FILE_RE.exec(line)?.groups;
+    if (move?.src) {
+      paths.add(move.src.trim());
+      if (move.dst) {
+        paths.add(move.dst.trim());
+      }
     }
   }
   return Array.from(paths);
@@ -136,10 +158,27 @@ function extractCodexFilePaths(toolName, toolInput) {
   const command = toolInput.command;
   return typeof command === "string" ? parseApplyPatchPaths(command) : [];
 }
-function extractFilePaths(toolName, toolInput, agent = "claude_code") {
-  if (agent === "codex") {
+var HERMES_EDITING_TOOLS = /* @__PURE__ */ new Set(["write_file", "patch"]);
+function extractHermesFilePaths(toolName, toolInput) {
+  if (!HERMES_EDITING_TOOLS.has(toolName)) {
+    return [];
+  }
+  if (!toolInput || typeof toolInput !== "object") {
+    return [];
+  }
+  const input = toolInput;
+  if (toolName === "patch" && input.mode === "patch") {
+    return typeof input.patch === "string" ? parseApplyPatchPaths(input.patch) : [];
+  }
+  return typeof input.path === "string" && input.path.length > 0 ? [input.path] : [];
+}
+function extractFilePaths(toolName, toolInput, agent2 = "claude_code") {
+  if (agent2 === "codex") {
     return extractCodexFilePaths(toolName, toolInput);
   }
+  if (agent2 === "hermes") {
+    return extractHermesFilePaths(toolName, toolInput);
+  }
   if (!SUPPORTED_TOOLS.has(toolName)) {
     return [];
   }
@@ -193,10 +232,14 @@ async function readStdin() {
     });
   });
 }
+var agent = parseAgent(process.argv);
 function emit(output) {
   process.stdout.write(`${JSON.stringify(output)}
 `);
 }
+function failOpen() {
+  return agent === "hermes" ? failOpenHermes() : failOpenOutput();
+}
 async function checkOneFile(file) {
   const fromDaemon = await daemonRequest(
     "conflict_check",
@@ -220,47 +263,51 @@ async function main() {
   try {
     raw = await readStdin();
   } catch {
-    emit(failOpenOutput());
+    emit(failOpen());
     return;
   }
   let envelope;
   try {
-    envelope = JSON.parse(raw);
+    envelope = normalizeEnvelope(
+      JSON.parse(raw),
+      agent
+    );
   } catch {
-    emit(failOpenOutput());
+    emit(failOpen());
     return;
   }
   if (envelope.hook_event_name !== "PreToolUse") {
-    emit(failOpenOutput());
+    emit(failOpen());
     return;
   }
   const env = process.env;
   const mode = readHookMode(env);
   if (mode === "off") {
-    emit(failOpenOutput());
+    emit(failOpen());
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
   const cwd = typeof envelope.cwd === "string" && envelope.cwd.length > 0 ? envelope.cwd : process.cwd();
-  const agent = parseAgent(process.argv);
   const files = extractFilePaths(toolName, envelope.tool_input, agent).map(
     (f) => toRepoRelative(f, cwd)
   );
   if (files.length === 0) {
-    emit(failOpenOutput());
+    emit(failOpen());
     return;
   }
   let results;
   try {
     results = await Promise.all(files.map((f) => checkOneFile(f)));
   } catch {
-    emit(failOpenOutput());
+    emit(failOpen());
     return;
   }
   const rawAggregate = aggregateCheckResults(results);
   const aggregate = demoteForMode(rawAggregate, mode);
-  emit(buildHookOutput(aggregate, results, agent));
+  emit(
+    agent === "hermes" ? buildHermesOutput(aggregate, results) : buildHookOutput(aggregate, results, agent)
+  );
 }
 main().catch(() => {
-  emit(failOpenOutput());
+  emit(failOpen());
 });

package/dist/hooks/prim-hook.js

@@ -9,11 +9,12 @@ import {
 import {
   shouldFlushAfter,
   toMove
-} from "../chunk-7GHOFNJ2.js";
+} from "../chunk-S2O4P4A3.js";
+import "../chunk-26VA3ADF.js";
 import {
+  normalizeEnvelope,
   parseAgent
-} from "../chunk-7YRBACIE.js";
-import "../chunk-26VA3ADF.js";
+} from "../chunk-TCDUH7AN.js";
 
 // src/hooks/prim-hook.ts
 import { spawn } from "child_process";
@@ -37,10 +38,11 @@ function spawnBackgroundFlush() {
   }).unref();
 }
 try {
+  const agent = parseAgent(process.argv);
   const raw = readFileSync(0, "utf-8");
-  const parsed = JSON.parse(raw);
+  const parsed = normalizeEnvelope(JSON.parse(raw), agent);
   const cwd = parsed.cwd ?? process.cwd();
-  const base = toMove(parsed, resolveCliVersion(), parseAgent(process.argv));
+  const base = toMove(parsed, resolveCliVersion(), agent);
   const move = { ...base, payload: scrubFromCwd(parsed, cwd) };
   const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
   appendMove(move, orgId);

package/dist/hooks/session-end.js

@@ -2,6 +2,10 @@
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";
+import {
+  normalizeEnvelope,
+  parseAgent
+} from "../chunk-TCDUH7AN.js";
 
 // src/hooks/session-end.ts
 var STDIN_TIMEOUT_MS = 1e3;
@@ -27,6 +31,7 @@ function emit() {
   process.stdout.write("{}\n");
 }
 async function main() {
+  const agent = parseAgent(process.argv);
   let raw;
   try {
     raw = await readStdin();
@@ -36,7 +41,10 @@ async function main() {
   }
   let envelope;
   try {
-    envelope = JSON.parse(raw);
+    envelope = normalizeEnvelope(
+      JSON.parse(raw),
+      agent
+    );
   } catch {
     emit();
     return;

package/dist/hooks/session-start.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
-import {
-  parseAgent
-} from "../chunk-7YRBACIE.js";
 import {
   getSiteUrl
 } from "../chunk-26VA3ADF.js";
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";
+import {
+  normalizeEnvelope,
+  parseAgent
+} from "../chunk-TCDUH7AN.js";
 
 // src/hooks/session-start.ts
 var STDIN_TIMEOUT_MS = 1e3;
@@ -44,6 +45,7 @@ function emit(additionalContext) {
 `);
 }
 async function main() {
+  const agent = parseAgent(process.argv);
   let raw;
   try {
     raw = await readStdin();
@@ -53,7 +55,10 @@ async function main() {
   }
   let envelope;
   try {
-    envelope = JSON.parse(raw);
+    envelope = normalizeEnvelope(
+      JSON.parse(raw),
+      agent
+    );
   } catch {
     emit();
     return;
@@ -71,7 +76,7 @@ async function main() {
     { sessionId: envelope.session_id },
     { timeoutMs: DAEMON_TIMEOUT_MS }
   );
-  if (parseAgent(process.argv) === "codex") {
+  if (agent === "codex") {
     const snapshot = await daemonRequest(
       "status_snapshot",
       // callerEnv: a cross-env daemon withholds onlineCount, so a prod Codex

package/dist/index.js

@@ -36,8 +36,8 @@ import {
 } from "./chunk-UTKQTZHL.js";
 
 // src/index.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname6, resolve as resolve4 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname7, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
@@ -1371,6 +1371,8 @@ function authorLabel(row) {
       return "Your Claude Code";
     case "codex":
       return "Your Codex";
+    case "hermes":
+      return "Your Hermes";
     case "chat":
       return "Your chat";
     case "spec_edit":
@@ -1998,9 +2000,351 @@ function registerDoctorCommands(program2) {
   });
 }
 
+// src/commands/hermes-install.ts
+import {
+  chmodSync,
+  closeSync as closeSync3,
+  existsSync as existsSync6,
+  fsyncSync as fsyncSync2,
+  mkdirSync as mkdirSync4,
+  openSync as openSync3,
+  readFileSync as readFileSync5,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname4, join as join5 } from "path";
+import { Document, parseDocument, stringify } from "yaml";
+var CAPTURE_BIN3 = "prim-hook";
+var GATE_BIN3 = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN3 = "prim-post-tool-use";
+var SESSION_START_BIN3 = "prim-session-start";
+var SESSION_END_BIN2 = "prim-session-end";
+var HERMES_ARGS = "--agent hermes";
+var EDIT_MATCHER = "write_file|patch";
+var JSON_INDENT3 = 2;
+var SHIM_MODE = 493;
+var PRIM_BINS3 = [
+  CAPTURE_BIN3,
+  GATE_BIN3,
+  POST_TOOL_USE_BIN3,
+  SESSION_START_BIN3,
+  SESSION_END_BIN2
+];
+function hermesHome() {
+  return process.env.HERMES_HOME ?? join5(homedir4(), ".hermes");
+}
+function configPath() {
+  return join5(hermesHome(), "config.yaml");
+}
+function shimPath() {
+  return join5(hermesHome(), "agent-hooks", "prim-shim.sh");
+}
+var SHIM_SCRIPT = `#!/bin/sh
+# prim Hermes hook shim \u2014 managed by \`prim hermes install\`. Hermes runs hooks
+# with shell=False, so the PATH \u2192 local node_modules \u2192 npx @latest resolution a
+# shell does for the Claude Code / Codex installs lives here instead.
+bin="$1"
+shift
+if command -v "$bin" >/dev/null 2>&1; then
+  exec "$bin" "$@"
+fi
+if [ -x "./node_modules/.bin/$bin" ]; then
+  exec "./node_modules/.bin/$bin" "$@"
+fi
+exec npx --yes -p @primitive.ai/prim@latest "$bin" "$@"
+`;
+function commandFor(bin) {
+  return `"${shimPath()}" ${bin} ${HERMES_ARGS}`;
+}
+function commandUsesBin(command, bin) {
+  return new RegExp(`prim-shim\\.sh"?\\s+${bin}\\s`).test(command);
+}
+var CAPTURE_EVENTS2 = [
+  "on_session_start",
+  "pre_llm_call",
+  "pre_tool_call",
+  "post_tool_call",
+  "post_llm_call",
+  "on_session_end",
+  "subagent_stop"
+];
+var GATE_TIMEOUT_SECONDS = 10;
+var REGISTRATIONS2 = [
+  ...CAPTURE_EVENTS2.map((event) => ({ event, bin: CAPTURE_BIN3 })),
+  { event: "pre_tool_call", matcher: EDIT_MATCHER, bin: GATE_BIN3, timeout: GATE_TIMEOUT_SECONDS },
+  { event: "post_tool_call", matcher: EDIT_MATCHER, bin: POST_TOOL_USE_BIN3 },
+  { event: "on_session_start", bin: SESSION_START_BIN3 },
+  { event: "on_session_end", bin: SESSION_END_BIN2 }
+];
+function entryFor(reg) {
+  const command = commandFor(reg.bin);
+  const entry = reg.matcher ? { matcher: reg.matcher, command } : { command };
+  if (reg.timeout !== void 0) {
+    entry.timeout = reg.timeout;
+  }
+  return entry;
+}
+function stripBin(list, bin) {
+  return list.filter((e) => !commandUsesBin(e.command, bin));
+}
+function ensureReg(list, reg, force) {
+  const entry = entryFor(reg);
+  const present = list.some(
+    (e) => e.command === entry.command && (e.matcher ?? "") === (entry.matcher ?? "") && (e.timeout ?? null) === (entry.timeout ?? null)
+  );
+  if (present && !force) {
+    return list;
+  }
+  return [...stripBin(list, reg.bin), entry];
+}
+function applyInstall3(hooks, force) {
+  const next = { ...hooks };
+  for (const reg of REGISTRATIONS2) {
+    next[reg.event] = ensureReg(next[reg.event] ?? [], reg, force);
+  }
+  return next;
+}
+function applyUninstall3(hooks) {
+  const next = {};
+  for (const [event, list] of Object.entries(hooks)) {
+    let kept = list;
+    for (const bin of PRIM_BINS3) {
+      kept = stripBin(kept, bin);
+    }
+    if (kept.length > 0) {
+      next[event] = kept;
+    }
+  }
+  return next;
+}
+function isGateInstalled3(hooks) {
+  return (hooks.pre_tool_call ?? []).some((e) => commandUsesBin(e.command, GATE_BIN3));
+}
+function isCaptureInstalled(hooks) {
+  return CAPTURE_EVENTS2.some(
+    (event) => (hooks[event] ?? []).some((e) => commandUsesBin(e.command, CAPTURE_BIN3))
+  );
+}
+function readDoc(path) {
+  if (!existsSync6(path)) {
+    return new Document();
+  }
+  const raw = readFileSync5(path, "utf-8");
+  return raw.trim().length === 0 ? new Document() : parseDocument(raw);
+}
+function readHooks(doc) {
+  const root = doc.toJS();
+  const hooks = root?.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) {
+    return {};
+  }
+  const out = {};
+  for (const [event, list] of Object.entries(hooks)) {
+    if (!Array.isArray(list)) {
+      continue;
+    }
+    const entries = list.filter(
+      (e) => typeof e === "object" && e !== null && typeof e.command === "string"
+    );
+    if (entries.length > 0) {
+      out[event] = entries;
+    }
+  }
+  return out;
+}
+function locateHooksBlock(raw) {
+  const lines = raw.split("\n");
+  let offset = 0;
+  let start = -1;
+  let end = raw.length;
+  for (const line of lines) {
+    const lineStart = offset;
+    offset += line.length + 1;
+    if (start === -1) {
+      if (/^hooks:(\s|$)/.test(line)) {
+        start = lineStart;
+      }
+    } else if (/^\S/.test(line) && !line.startsWith("#")) {
+      end = lineStart;
+      break;
+    }
+  }
+  return start === -1 ? null : { start, end };
+}
+function serializeHooks(hooks) {
+  if (Object.keys(hooks).length === 0) {
+    return "";
+  }
+  return stringify({ hooks }, { lineWidth: 0 });
+}
+function spliceHooks(raw, hooks) {
+  const block = serializeHooks(hooks);
+  const loc = locateHooksBlock(raw);
+  if (loc) {
+    return raw.slice(0, loc.start) + block + raw.slice(loc.end);
+  }
+  if (block.length === 0) {
+    return raw;
+  }
+  const sep = raw.length === 0 || raw.endsWith("\n") ? "" : "\n";
+  return `${raw}${sep}${block}`;
+}
+function hasAutoAccept(raw) {
+  return /^hooks_auto_accept:/m.test(raw);
+}
+function setAutoAccept(raw) {
+  if (hasAutoAccept(raw)) {
+    return raw.replace(/^hooks_auto_accept:.*$/m, "hooks_auto_accept: true");
+  }
+  const sep = raw.length === 0 || raw.endsWith("\n") ? "" : "\n";
+  return `${raw}${sep}hooks_auto_accept: true
+`;
+}
+function atomicWriteFile(path, content) {
+  const dir = dirname4(path);
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  const tmp = `${path}.tmp.${String(process.pid)}`;
+  writeFileSync3(tmp, content, "utf-8");
+  const fd = openSync3(tmp, "r+");
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync3(fd);
+  }
+  renameSync2(tmp, path);
+}
+function mergeKeepsYamlValid(before, after) {
+  return parseDocument(after).errors.length <= parseDocument(before).errors.length;
+}
+function assertMergeValid(before, after) {
+  if (!mergeKeepsYamlValid(before, after)) {
+    console.error("[prim] aborted: the merge would introduce invalid YAML; config left unchanged");
+    process.exit(1);
+  }
+}
+function writeShim() {
+  const path = shimPath();
+  const dir = dirname4(path);
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  writeFileSync3(path, SHIM_SCRIPT, "utf-8");
+  chmodSync(path, SHIM_MODE);
+}
+function removeShim() {
+  rmSync2(shimPath(), { force: true });
+}
+function autoAcceptOf(raw) {
+  if (raw.trim().length === 0) {
+    return false;
+  }
+  return parseDocument(raw).toJS()?.hooks_auto_accept === true;
+}
+function readHooksFromRaw(raw) {
+  return readHooks(raw.trim().length > 0 ? parseDocument(raw) : new Document());
+}
+function performInstall3(opts) {
+  const path = configPath();
+  const raw = existsSync6(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = readHooksFromRaw(raw);
+  const desired = applyInstall3(existing, opts.force);
+  let next = raw;
+  if (JSON.stringify(existing) !== JSON.stringify(desired)) {
+    next = spliceHooks(next, desired);
+  }
+  if (opts.autoAccept) {
+    next = setAutoAccept(next);
+  }
+  writeShim();
+  const changed = next !== raw;
+  if (changed) {
+    assertMergeValid(raw, next);
+    atomicWriteFile(path, next);
+  }
+  return {
+    path,
+    gate: isGateInstalled3(desired),
+    capture: isCaptureInstalled(desired),
+    autoAccept: autoAcceptOf(next),
+    changed
+  };
+}
+function performUninstall3() {
+  const path = configPath();
+  if (!existsSync6(path)) {
+    removeShim();
+    return { path, gate: false, capture: false, autoAccept: false, changed: false };
+  }
+  const raw = readFileSync5(path, "utf-8");
+  const existing = readHooksFromRaw(raw);
+  const remaining = applyUninstall3(existing);
+  const next = JSON.stringify(existing) === JSON.stringify(remaining) ? raw : spliceHooks(raw, remaining);
+  const changed = next !== raw;
+  if (changed) {
+    assertMergeValid(raw, next);
+    atomicWriteFile(path, next);
+  }
+  removeShim();
+  return {
+    path,
+    gate: isGateInstalled3(remaining),
+    capture: isCaptureInstalled(remaining),
+    autoAccept: autoAcceptOf(next),
+    changed
+  };
+}
+function performStatus3() {
+  const path = configPath();
+  const hooks = existsSync6(path) ? readHooks(readDoc(path)) : {};
+  return { path, gate: isGateInstalled3(hooks), capture: isCaptureInstalled(hooks) };
+}
+var TRUST_NOTICE2 = "[prim] Hermes requires hook consent: it prompts once per (event, command) on a TTY and records approval in ~/.hermes/shell-hooks-allowlist.json. To pre-approve non-interactively, re-run with --auto-accept (sets hooks_auto_accept: true), export HERMES_ACCEPT_HOOKS=1, or start Hermes with `hermes --accept-hooks chat`. Until approved, the hooks will not fire.";
+function rejectProjectScope(scope) {
+  if (scope === "project") {
+    console.error(
+      "[prim] Hermes config is global-only (~/.hermes/config.yaml); --scope project is not supported."
+    );
+    process.exit(2);
+  }
+}
+function registerHermesCommands(program2) {
+  const hermes = program2.command("hermes").description("Manage the prim Hermes Agent integration (capture, gate, ingest, presence)");
+  hermes.command("install").description("Register the prim hooks in Hermes's ~/.hermes/config.yaml").option("--scope <scope>", "user (default; Hermes config is global-only)").option("--force", "Replace any drifted prim hook entries").option("--auto-accept", "Also set hooks_auto_accept: true so the hooks need no TTY consent").action((opts) => {
+    rejectProjectScope(opts.scope);
+    const result = performInstall3({
+      force: opts.force ?? false,
+      autoAccept: opts.autoAccept ?? false
+    });
+    console.error(
+      result.changed ? `[prim] Hermes integration installed at ${result.path}` : `[prim] Hermes integration already present at ${result.path} (no changes)`
+    );
+    console.error(TRUST_NOTICE2);
+    console.log(JSON.stringify(result, null, JSON_INDENT3));
+  });
+  hermes.command("uninstall").description("Remove all prim hooks from Hermes's ~/.hermes/config.yaml").action(() => {
+    const result = performUninstall3();
+    console.error(
+      result.changed ? `[prim] prim hooks removed from ${result.path}` : `[prim] no prim hooks to remove at ${result.path} (nothing changed)`
+    );
+    console.log(JSON.stringify(result, null, JSON_INDENT3));
+  });
+  hermes.command("status").description("Report whether each prim surface (gate, capture) is installed").action(() => {
+    const result = performStatus3();
+    const mark = (b) => b ? "\u2713" : "\u2717";
+    console.error(
+      `[prim] hermes: gate ${mark(result.gate)} \xB7 capture ${mark(result.capture)} (${result.path})`
+    );
+    console.log(JSON.stringify(result, null, JSON_INDENT3));
+  });
+}
+
 // src/commands/hooks.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
 import { resolve } from "path";
 import { Option } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
@@ -2043,13 +2387,13 @@ function getGitRoot() {
 }
 function detectHusky(gitRoot) {
   const huskyDir = resolve(gitRoot, ".husky");
-  if (!existsSync6(huskyDir)) return false;
-  if (existsSync6(resolve(huskyDir, "_"))) return true;
-  if (existsSync6(resolve(huskyDir, "pre-commit"))) return true;
+  if (!existsSync7(huskyDir)) return false;
+  if (existsSync7(resolve(huskyDir, "_"))) return true;
+  if (existsSync7(resolve(huskyDir, "pre-commit"))) return true;
   const pkgPath = resolve(gitRoot, "package.json");
-  if (existsSync6(pkgPath)) {
+  if (existsSync7(pkgPath)) {
     try {
-      const pkg2 = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync6(pkgPath, "utf-8"));
       const scripts = pkg2.scripts ?? {};
       if (/husky/i.test(scripts.prepare ?? "") || /husky/i.test(scripts.postinstall ?? "")) {
         return true;
@@ -2076,20 +2420,20 @@ async function askConfirmation(question) {
 }
 function installToHusky(gitRoot, spec = PRE_COMMIT) {
   const hookPath = resolve(gitRoot, ".husky", spec.hookName);
-  if (existsSync6(hookPath)) {
-    const existing = readFileSync5(hookPath, "utf-8");
+  if (existsSync7(hookPath)) {
+    const existing = readFileSync6(hookPath, "utf-8");
     if (containsPrimHook(existing, spec.binName)) {
       console.log(`Prim ${spec.hookName} hook is already installed in .husky/${spec.hookName}.`);
       return;
     }
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    writeFileSync3(hookPath, `${existing}${separator}${huskyBlock(spec)}
+    writeFileSync4(hookPath, `${existing}${separator}${huskyBlock(spec)}
 `, {
       mode: 493
     });
     console.log(`Appended prim hook block to .husky/${spec.hookName}.`);
   } else {
-    writeFileSync3(hookPath, `#!/bin/sh
+    writeFileSync4(hookPath, `#!/bin/sh
 
 ${huskyBlock(spec)}
 `, {
@@ -2101,11 +2445,11 @@ ${huskyBlock(spec)}
 function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   const hooksDir = resolve(gitRoot, ".git", "hooks");
   const hookPath = resolve(hooksDir, spec.hookName);
-  if (!existsSync6(hooksDir)) {
-    mkdirSync4(hooksDir, { recursive: true });
+  if (!existsSync7(hooksDir)) {
+    mkdirSync5(hooksDir, { recursive: true });
   }
-  if (existsSync6(hookPath)) {
-    const existing = readFileSync5(hookPath, "utf-8");
+  if (existsSync7(hookPath)) {
+    const existing = readFileSync6(hookPath, "utf-8");
     if (containsPrimHook(existing, spec.binName)) {
       console.log(`Prim ${spec.hookName} hook is already installed at ${hookPath}.`);
       return;
@@ -2114,7 +2458,7 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
     console.log("To replace it, run: prim hooks uninstall && prim hooks install");
     return;
   }
-  writeFileSync3(hookPath, dotGitScript(spec), { mode: 493 });
+  writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
 function installHooks(gitRoot, target) {
@@ -2168,11 +2512,11 @@ function registerHooksCommands(program2) {
     const gitRoot = getGitRoot();
     for (const spec of HOOKS) {
       const hookPath = resolve(gitRoot, ".git", "hooks", spec.hookName);
-      if (!existsSync6(hookPath)) {
+      if (!existsSync7(hookPath)) {
         console.log(`No ${spec.hookName} hook found.`);
         continue;
       }
-      if (containsPrimHook(readFileSync5(hookPath, "utf-8"), spec.binName)) {
+      if (containsPrimHook(readFileSync6(hookPath, "utf-8"), spec.binName)) {
         unlinkSync2(hookPath);
         console.log(`Removed ${spec.hookName} hook at ${hookPath}`);
       } else {
@@ -2183,11 +2527,11 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/moves.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 
 // src/flusher.ts
-import { renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
+import { renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
 var BATCH_SIZE = 500;
 var HTTP_TIMEOUT_MS = 1e4;
 var OPPORTUNISTIC_FLUSH_AFTER_MS = 6e4;
@@ -2219,7 +2563,7 @@ async function drainFlushingPath(flushingPath) {
 async function drainPath(path) {
   const tmpPath = `${path}.flushing.${String(Date.now())}.${String(process.pid)}`;
   try {
-    renameSync2(path, tmpPath);
+    renameSync3(path, tmpPath);
   } catch (err) {
     if (err.code === "ENOENT") {
       return 0;
@@ -2343,19 +2687,19 @@ function registerMovesCommands(program2) {
     }
   });
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
-    const dir = join5(process.cwd(), ".prim");
-    if (!existsSync7(dir)) {
-      mkdirSync5(dir, { recursive: true, mode: DIR_MODE });
+    const dir = join6(process.cwd(), ".prim");
+    if (!existsSync8(dir)) {
+      mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
     }
-    const file = join5(process.cwd(), WORKSPACE_FILE);
-    writeFileSync4(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
+    const file = join6(process.cwd(), WORKSPACE_FILE);
+    writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
       mode: FILE_MODE2
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
   moves.command("drop").description("Remove the .prim/workspace.json binding from the cwd").action(() => {
-    const file = join5(process.cwd(), WORKSPACE_FILE);
-    if (!existsSync7(file)) {
+    const file = join6(process.cwd(), WORKSPACE_FILE);
+    if (!existsSync8(file)) {
       console.log("[prim] no workspace binding in cwd");
       return;
     }
@@ -2448,23 +2792,23 @@ function registerReconcileCommands(program2) {
 
 // src/commands/session.ts
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync6,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync7,
   readdirSync,
   unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var DIR_MODE2 = 448;
 var FILE_MODE3 = 384;
 function ensureDir() {
-  if (!existsSync8(SESSIONS_DIR)) {
-    mkdirSync6(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
+  if (!existsSync9(SESSIONS_DIR)) {
+    mkdirSync7(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
   }
 }
 function markerPath(sessionId) {
-  return join6(SESSIONS_DIR, `${sessionId}.json`);
+  return join7(SESSIONS_DIR, `${sessionId}.json`);
 }
 function registerSessionCommands(program2) {
   const session = program2.command("session").description("Decision Event Pipeline \u2014 session binding markers");
@@ -2474,13 +2818,13 @@ function registerSessionCommands(program2) {
       orgId: opts.orgId,
       startedAt: Date.now()
     };
-    writeFileSync5(markerPath(sessionId), JSON.stringify(marker, null, 2), {
+    writeFileSync6(markerPath(sessionId), JSON.stringify(marker, null, 2), {
       mode: FILE_MODE3
     });
     console.log(`[prim] session ${sessionId} bound to org ${opts.orgId}`);
   });
   session.command("list").description("List active session markers").action(() => {
-    if (!existsSync8(SESSIONS_DIR)) {
+    if (!existsSync9(SESSIONS_DIR)) {
       console.log("[prim] no session markers");
       return;
     }
@@ -2492,7 +2836,7 @@ function registerSessionCommands(program2) {
     for (const f of files) {
       const sessionId = f.replace(/\.json$/, "");
       try {
-        const m = JSON.parse(readFileSync6(join6(SESSIONS_DIR, f), "utf-8"));
+        const m = JSON.parse(readFileSync7(join7(SESSIONS_DIR, f), "utf-8"));
         console.log(`${sessionId}  org=${m.orgId}`);
       } catch {
       }
@@ -2500,7 +2844,7 @@ function registerSessionCommands(program2) {
   });
   session.command("drop <sessionId>").description("Remove a session marker").action((sessionId) => {
     const p = markerPath(sessionId);
-    if (!existsSync8(p)) {
+    if (!existsSync9(p)) {
       console.log(`[prim] no marker for session ${sessionId}`);
       return;
     }
@@ -2513,13 +2857,19 @@ function registerSessionCommands(program2) {
 import { spawnSync } from "child_process";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
+var SESSION_LABELS = {
+  claude: "Claude Code integration",
+  codex: "Codex integration",
+  hermes: "Hermes integration"
+};
 function planSetupSteps(opts) {
   const scopeArgs = opts.scope === "user" ? ["--scope", "user"] : [];
+  const sessionArgs = opts.agent === "hermes" ? [opts.agent, "install"] : [opts.agent, "install", ...scopeArgs];
   const steps = [
     {
       key: "session",
-      label: opts.agent === "codex" ? "Codex integration" : "Claude Code integration",
-      args: [opts.agent, "install", ...scopeArgs],
+      label: SESSION_LABELS[opts.agent],
+      args: sessionArgs,
       required: true
     }
   ];
@@ -2532,16 +2882,32 @@ function planSetupSteps(opts) {
     });
   }
   steps.push({ key: "hooks", label: "Git hooks", args: ["hooks", "install"], required: true });
-  steps.push({ key: "skill", label: "Agent skill", args: ["skill", "install"], required: true });
+  const skillArgs = opts.agent === "hermes" ? ["skill", "install", "--target", ".hermes.md"] : ["skill", "install"];
+  steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
   return steps;
 }
+function detectAgent(env) {
+  if (env.HERMES_INTERACTIVE) {
+    return "hermes";
+  }
+  return "claude";
+}
+function resolveAgent(agentFlag, env) {
+  if (agentFlag !== void 0) {
+    return { agent: agentFlag, detected: false };
+  }
+  return { agent: detectAgent(env), detected: true };
+}
 function registerSetupCommand(program2) {
   program2.command("setup").description(
     "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
-  ).option("--agent <agent>", "claude or codex", "claude").option("--scope <scope>", "project or user (session integration)", "project").option("--no-daemon", "skip starting the companion daemon").action((opts) => {
-    if (opts.agent !== "claude" && opts.agent !== "codex") {
-      process.stderr.write(`[prim] unknown --agent "${opts.agent}" (expected claude or codex)
-`);
+  ).option("--agent <agent>", "claude, codex, or hermes (auto-detected when omitted)").option("--scope <scope>", "project or user (session integration)", "project").option("--no-daemon", "skip starting the companion daemon").action((opts) => {
+    const { agent: agentInput, detected } = resolveAgent(opts.agent, process.env);
+    if (agentInput !== "claude" && agentInput !== "codex" && agentInput !== "hermes") {
+      process.stderr.write(
+        `[prim] unknown --agent "${agentInput}" (expected claude, codex, or hermes)
+`
+      );
       process.exit(EXIT_USAGE3);
     }
     if (opts.scope !== "project" && opts.scope !== "user") {
@@ -2549,7 +2915,7 @@ function registerSetupCommand(program2) {
 `);
       process.exit(EXIT_USAGE3);
     }
-    const agent = opts.agent;
+    const agent = agentInput;
     const scope = opts.scope;
     const self = process.argv[1];
     const run = (args, capture = false) => {
@@ -2571,6 +2937,9 @@ function registerSetupCommand(program2) {
         return false;
       }
     };
+    if (detected && agent !== "claude") {
+      note(`agent \xB7 detected ${agent} session (override with --agent <agent>)`);
+    }
     if (agent === "claude") {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
@@ -2601,23 +2970,24 @@ function registerSetupCommand(program2) {
 
 // src/commands/skill.ts
 import {
-  closeSync as closeSync3,
-  existsSync as existsSync9,
-  fsyncSync as fsyncSync2,
-  openSync as openSync3,
-  readFileSync as readFileSync7,
-  renameSync as renameSync3,
-  writeFileSync as writeFileSync6
+  closeSync as closeSync4,
+  existsSync as existsSync10,
+  fsyncSync as fsyncSync3,
+  openSync as openSync4,
+  readFileSync as readFileSync8,
+  renameSync as renameSync4,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname4, resolve as resolve2 } from "path";
+import { dirname as dirname5, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
-var __dirname = dirname4(fileURLToPath2(import.meta.url));
+var __dirname = dirname5(fileURLToPath2(import.meta.url));
 var SKILL_BEGIN = "<!-- BEGIN PRIM SKILL v1 -->";
 var SKILL_END = "<!-- END PRIM SKILL v1 -->";
 var TARGET_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
+  ".hermes.md",
   ".cursor/rules",
   ".windsurfrules",
   ".github/instructions/primitive.md"
@@ -2625,15 +2995,15 @@ var TARGET_CANDIDATES = [
 var DEFAULT_TARGET = "CLAUDE.md";
 function loadSkill() {
   let dir = __dirname;
-  while (dir !== dirname4(dir)) {
+  while (dir !== dirname5(dir)) {
     const p = resolve2(dir, "SKILL.md");
-    if (existsSync9(p)) return readFileSync7(p, "utf-8");
-    dir = dirname4(dir);
+    if (existsSync10(p)) return readFileSync8(p, "utf-8");
+    dir = dirname5(dir);
   }
   throw new Error("SKILL.md not found in package");
 }
 function detectTargets(cwd) {
-  return TARGET_CANDIDATES.filter((p) => existsSync9(resolve2(cwd, p)));
+  return TARGET_CANDIDATES.filter((p) => existsSync10(resolve2(cwd, p)));
 }
 function detectNewline(content) {
   return content.includes("\r\n") ? "\r\n" : "\n";
@@ -2661,14 +3031,14 @@ function removeBlock(existing) {
 }
 function atomicWrite2(target, content) {
   const tmp = `${target}.tmp`;
-  writeFileSync6(tmp, content);
-  const fd = openSync3(tmp, "r+");
+  writeFileSync7(tmp, content);
+  const fd = openSync4(tmp, "r+");
   try {
-    fsyncSync2(fd);
+    fsyncSync3(fd);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
-  renameSync3(tmp, target);
+  renameSync4(tmp, target);
 }
 function resolveTarget(cwd, override) {
   if (override) return resolve2(cwd, override);
@@ -2682,7 +3052,7 @@ function resolveTarget(cwd, override) {
 function runInstall(cwd, opts) {
   const target = resolveTarget(cwd, opts.target);
   if (target === null) return 1;
-  const existing = existsSync9(target) ? readFileSync7(target, "utf-8") : "";
+  const existing = existsSync10(target) ? readFileSync8(target, "utf-8") : "";
   const eol = existing ? detectNewline(existing) : "\n";
   const block = composeBlock(loadSkill(), eol);
   const next = applyBlock(existing, block, eol);
@@ -2701,11 +3071,11 @@ function runInstall(cwd, opts) {
 function runUninstall(cwd, opts) {
   const target = resolveTarget(cwd, opts.target);
   if (target === null) return 1;
-  if (!existsSync9(target)) {
+  if (!existsSync10(target)) {
     console.log(`Skill block not present at ${target}`);
     return 0;
   }
-  const existing = readFileSync7(target, "utf-8");
+  const existing = readFileSync8(target, "utf-8");
   const next = removeBlock(existing);
   if (next === null) {
     console.log(`Skill block not present at ${target}`);
@@ -2718,10 +3088,10 @@ function runUninstall(cwd, opts) {
 function runStatus(cwd, opts) {
   const target = resolveTarget(cwd, opts.target);
   if (target === null) return 1;
-  const fileExists = existsSync9(target);
+  const fileExists = existsSync10(target);
   let installed = false;
   if (fileExists) {
-    const content = readFileSync7(target, "utf-8");
+    const content = readFileSync8(target, "utf-8");
     installed = content.includes(SKILL_BEGIN) && content.includes(SKILL_END);
   }
   if (opts.json) {
@@ -2758,18 +3128,18 @@ function registerSkillCommands(program2) {
 }
 
 // src/commands/statusline.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname5, resolve as resolve3 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname6, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 var STATUSLINE_NAME_CAP = 3;
 function readPackageVersion() {
   try {
-    const here = dirname5(fileURLToPath3(import.meta.url));
+    const here = dirname6(fileURLToPath3(import.meta.url));
     const candidates = [resolve3(here, "../../package.json"), resolve3(here, "../package.json")];
     for (const path of candidates) {
       try {
-        const pkg2 = JSON.parse(readFileSync8(path, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync9(path, "utf-8"));
         if (pkg2.version) {
           return pkg2.version;
         }
@@ -2936,8 +3306,8 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
 }
 
 // src/index.ts
-var __dirname2 = dirname6(fileURLToPath4(import.meta.url));
-var pkg = JSON.parse(readFileSync9(resolve4(__dirname2, "../package.json"), "utf-8"));
+var __dirname2 = dirname7(fileURLToPath4(import.meta.url));
+var pkg = JSON.parse(readFileSync10(resolve4(__dirname2, "../package.json"), "utf-8"));
 updateNotifier({ pkg }).notify();
 var program = new Command();
 program.name("prim").description("CLI for Primitive's decision graph").version(pkg.version).option("-y, --yes", "auto-confirm prompts").option(
@@ -2952,6 +3322,7 @@ registerSessionCommands(program);
 registerDecisionsCommands(program);
 registerClaudeCommands(program);
 registerCodexCommands(program);
+registerHermesCommands(program);
 registerDaemonCommands(program);
 registerDoctorCommands(program);
 registerReconcileCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.31",
+  "version": "0.1.0-alpha.32",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",
@@ -61,7 +61,8 @@
   "dependencies": {
     "commander": "^12.1.0",
     "diff": "^5.2.0",
-    "update-notifier": "^7.3.1"
+    "update-notifier": "^7.3.1",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.0",

package/dist/chunk-7YRBACIE.js

@@ -1,9 +0,0 @@
-// src/hooks/agent.ts
-function parseAgent(argv) {
-  const i = argv.indexOf("--agent");
-  return i !== -1 && argv[i + 1] === "codex" ? "codex" : "claude_code";
-}
-
-export {
-  parseAgent
-};