@primitive.ai/prim 0.1.0-alpha.31 → 0.1.0-alpha.33

package/dist/index.js

@@ -36,8 +36,8 @@ import {
 } from "./chunk-UTKQTZHL.js";
 
 // src/index.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname6, resolve as resolve4 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname7, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
@@ -342,6 +342,9 @@ function hookShimCommand(bin, args = "") {
   const invoke = (cmd) => args ? `${cmd} ${args}` : cmd;
   return `if command -v ${bin} >/dev/null 2>&1; then ${invoke(bin)}; elif [ -f "./node_modules/.bin/${bin}" ]; then ${invoke(`./node_modules/.bin/${bin}`)}; else ${invoke(`${NPX_FALLBACK} ${bin}`)}; fi`;
 }
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; export npm_config_fetch_retries=2 npm_config_fetch_retry_mintimeout=10000 npm_config_fetch_retry_maxtimeout=10000 npm_config_fetch_timeout=60000; printf '%s' "$payload" | { ${hookShimCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
+}
 function commandMatchesBin(command, bin) {
   if (!command) {
     return false;
@@ -395,12 +398,17 @@ var CAPTURE_EVENTS = [
 function makeRegistration(event, matcher, bin, args = "") {
   return { event, matcher, bin, command: hookShimCommand(bin, args) };
 }
+function makeDetachedRegistration(event, matcher, bin, args = "") {
+  return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
+}
 var REGISTRATIONS = [
-  ...CAPTURE_EVENTS.map((event) => makeRegistration(event, "*", CAPTURE_BIN)),
+  ...CAPTURE_EVENTS.map(
+    (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
+  ),
   makeRegistration("PreToolUse", "Edit|Write|MultiEdit", GATE_BIN),
   makeRegistration("PostToolUse", "Edit|Write|MultiEdit", POST_TOOL_USE_BIN),
   makeRegistration("SessionStart", "*", SESSION_START_BIN),
-  makeRegistration("SessionEnd", "*", SESSION_END_BIN)
+  makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
 ];
 var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
 var LEGACY_PRIM_PERMISSION_RULES = [
@@ -445,10 +453,9 @@ function stripCommand(list, bin) {
   return out;
 }
 function ensureRegistration(list, reg, force) {
-  const hasCanonical = list.some(
-    (e) => e.matcher === reg.matcher && e.hooks?.length === 1 && e.hooks[0].command === reg.command
-  );
-  if (hasCanonical && !force) {
+  const isCanonical = (e) => e.matcher === reg.matcher && e.hooks?.length === 1 && e.hooks[0].command === reg.command;
+  const hasStray = (e) => !isCanonical(e) && (e.hooks ?? []).some((h) => commandMatchesBin(h.command, reg.bin));
+  if (list.some(isCanonical) && !list.some(hasStray) && !force) {
     return list;
   }
   return [...stripCommand(list, reg.bin), canonicalEntry(reg)];
@@ -1371,6 +1378,8 @@ function authorLabel(row) {
       return "Your Claude Code";
     case "codex":
       return "Your Codex";
+    case "hermes":
+      return "Your Hermes";
     case "chat":
       return "Your chat";
     case "spec_edit":
@@ -1998,9 +2007,351 @@ function registerDoctorCommands(program2) {
   });
 }
 
+// src/commands/hermes-install.ts
+import {
+  chmodSync,
+  closeSync as closeSync3,
+  existsSync as existsSync6,
+  fsyncSync as fsyncSync2,
+  mkdirSync as mkdirSync4,
+  openSync as openSync3,
+  readFileSync as readFileSync5,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname4, join as join5 } from "path";
+import { Document, parseDocument, stringify } from "yaml";
+var CAPTURE_BIN3 = "prim-hook";
+var GATE_BIN3 = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN3 = "prim-post-tool-use";
+var SESSION_START_BIN3 = "prim-session-start";
+var SESSION_END_BIN2 = "prim-session-end";
+var HERMES_ARGS = "--agent hermes";
+var EDIT_MATCHER = "write_file|patch";
+var JSON_INDENT3 = 2;
+var SHIM_MODE = 493;
+var PRIM_BINS3 = [
+  CAPTURE_BIN3,
+  GATE_BIN3,
+  POST_TOOL_USE_BIN3,
+  SESSION_START_BIN3,
+  SESSION_END_BIN2
+];
+function hermesHome() {
+  return process.env.HERMES_HOME ?? join5(homedir4(), ".hermes");
+}
+function configPath() {
+  return join5(hermesHome(), "config.yaml");
+}
+function shimPath() {
+  return join5(hermesHome(), "agent-hooks", "prim-shim.sh");
+}
+var SHIM_SCRIPT = `#!/bin/sh
+# prim Hermes hook shim \u2014 managed by \`prim hermes install\`. Hermes runs hooks
+# with shell=False, so the PATH \u2192 local node_modules \u2192 npx @latest resolution a
+# shell does for the Claude Code / Codex installs lives here instead.
+bin="$1"
+shift
+if command -v "$bin" >/dev/null 2>&1; then
+  exec "$bin" "$@"
+fi
+if [ -x "./node_modules/.bin/$bin" ]; then
+  exec "./node_modules/.bin/$bin" "$@"
+fi
+exec npx --yes -p @primitive.ai/prim@latest "$bin" "$@"
+`;
+function commandFor(bin) {
+  return `"${shimPath()}" ${bin} ${HERMES_ARGS}`;
+}
+function commandUsesBin(command, bin) {
+  return new RegExp(`prim-shim\\.sh"?\\s+${bin}\\s`).test(command);
+}
+var CAPTURE_EVENTS2 = [
+  "on_session_start",
+  "pre_llm_call",
+  "pre_tool_call",
+  "post_tool_call",
+  "post_llm_call",
+  "on_session_end",
+  "subagent_stop"
+];
+var GATE_TIMEOUT_SECONDS = 10;
+var REGISTRATIONS2 = [
+  ...CAPTURE_EVENTS2.map((event) => ({ event, bin: CAPTURE_BIN3 })),
+  { event: "pre_tool_call", matcher: EDIT_MATCHER, bin: GATE_BIN3, timeout: GATE_TIMEOUT_SECONDS },
+  { event: "post_tool_call", matcher: EDIT_MATCHER, bin: POST_TOOL_USE_BIN3 },
+  { event: "on_session_start", bin: SESSION_START_BIN3 },
+  { event: "on_session_end", bin: SESSION_END_BIN2 }
+];
+function entryFor(reg) {
+  const command = commandFor(reg.bin);
+  const entry = reg.matcher ? { matcher: reg.matcher, command } : { command };
+  if (reg.timeout !== void 0) {
+    entry.timeout = reg.timeout;
+  }
+  return entry;
+}
+function stripBin(list, bin) {
+  return list.filter((e) => !commandUsesBin(e.command, bin));
+}
+function ensureReg(list, reg, force) {
+  const entry = entryFor(reg);
+  const present = list.some(
+    (e) => e.command === entry.command && (e.matcher ?? "") === (entry.matcher ?? "") && (e.timeout ?? null) === (entry.timeout ?? null)
+  );
+  if (present && !force) {
+    return list;
+  }
+  return [...stripBin(list, reg.bin), entry];
+}
+function applyInstall3(hooks, force) {
+  const next = { ...hooks };
+  for (const reg of REGISTRATIONS2) {
+    next[reg.event] = ensureReg(next[reg.event] ?? [], reg, force);
+  }
+  return next;
+}
+function applyUninstall3(hooks) {
+  const next = {};
+  for (const [event, list] of Object.entries(hooks)) {
+    let kept = list;
+    for (const bin of PRIM_BINS3) {
+      kept = stripBin(kept, bin);
+    }
+    if (kept.length > 0) {
+      next[event] = kept;
+    }
+  }
+  return next;
+}
+function isGateInstalled3(hooks) {
+  return (hooks.pre_tool_call ?? []).some((e) => commandUsesBin(e.command, GATE_BIN3));
+}
+function isCaptureInstalled(hooks) {
+  return CAPTURE_EVENTS2.some(
+    (event) => (hooks[event] ?? []).some((e) => commandUsesBin(e.command, CAPTURE_BIN3))
+  );
+}
+function readDoc(path) {
+  if (!existsSync6(path)) {
+    return new Document();
+  }
+  const raw = readFileSync5(path, "utf-8");
+  return raw.trim().length === 0 ? new Document() : parseDocument(raw);
+}
+function readHooks(doc) {
+  const root = doc.toJS();
+  const hooks = root?.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) {
+    return {};
+  }
+  const out = {};
+  for (const [event, list] of Object.entries(hooks)) {
+    if (!Array.isArray(list)) {
+      continue;
+    }
+    const entries = list.filter(
+      (e) => typeof e === "object" && e !== null && typeof e.command === "string"
+    );
+    if (entries.length > 0) {
+      out[event] = entries;
+    }
+  }
+  return out;
+}
+function locateHooksBlock(raw) {
+  const lines = raw.split("\n");
+  let offset = 0;
+  let start = -1;
+  let end = raw.length;
+  for (const line of lines) {
+    const lineStart = offset;
+    offset += line.length + 1;
+    if (start === -1) {
+      if (/^hooks:(\s|$)/.test(line)) {
+        start = lineStart;
+      }
+    } else if (/^\S/.test(line) && !line.startsWith("#")) {
+      end = lineStart;
+      break;
+    }
+  }
+  return start === -1 ? null : { start, end };
+}
+function serializeHooks(hooks) {
+  if (Object.keys(hooks).length === 0) {
+    return "";
+  }
+  return stringify({ hooks }, { lineWidth: 0 });
+}
+function spliceHooks(raw, hooks) {
+  const block = serializeHooks(hooks);
+  const loc = locateHooksBlock(raw);
+  if (loc) {
+    return raw.slice(0, loc.start) + block + raw.slice(loc.end);
+  }
+  if (block.length === 0) {
+    return raw;
+  }
+  const sep = raw.length === 0 || raw.endsWith("\n") ? "" : "\n";
+  return `${raw}${sep}${block}`;
+}
+function hasAutoAccept(raw) {
+  return /^hooks_auto_accept:/m.test(raw);
+}
+function setAutoAccept(raw) {
+  if (hasAutoAccept(raw)) {
+    return raw.replace(/^hooks_auto_accept:.*$/m, "hooks_auto_accept: true");
+  }
+  const sep = raw.length === 0 || raw.endsWith("\n") ? "" : "\n";
+  return `${raw}${sep}hooks_auto_accept: true
+`;
+}
+function atomicWriteFile(path, content) {
+  const dir = dirname4(path);
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  const tmp = `${path}.tmp.${String(process.pid)}`;
+  writeFileSync3(tmp, content, "utf-8");
+  const fd = openSync3(tmp, "r+");
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync3(fd);
+  }
+  renameSync2(tmp, path);
+}
+function mergeKeepsYamlValid(before, after) {
+  return parseDocument(after).errors.length <= parseDocument(before).errors.length;
+}
+function assertMergeValid(before, after) {
+  if (!mergeKeepsYamlValid(before, after)) {
+    console.error("[prim] aborted: the merge would introduce invalid YAML; config left unchanged");
+    process.exit(1);
+  }
+}
+function writeShim() {
+  const path = shimPath();
+  const dir = dirname4(path);
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  writeFileSync3(path, SHIM_SCRIPT, "utf-8");
+  chmodSync(path, SHIM_MODE);
+}
+function removeShim() {
+  rmSync2(shimPath(), { force: true });
+}
+function autoAcceptOf(raw) {
+  if (raw.trim().length === 0) {
+    return false;
+  }
+  return parseDocument(raw).toJS()?.hooks_auto_accept === true;
+}
+function readHooksFromRaw(raw) {
+  return readHooks(raw.trim().length > 0 ? parseDocument(raw) : new Document());
+}
+function performInstall3(opts) {
+  const path = configPath();
+  const raw = existsSync6(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = readHooksFromRaw(raw);
+  const desired = applyInstall3(existing, opts.force);
+  let next = raw;
+  if (JSON.stringify(existing) !== JSON.stringify(desired)) {
+    next = spliceHooks(next, desired);
+  }
+  if (opts.autoAccept) {
+    next = setAutoAccept(next);
+  }
+  writeShim();
+  const changed = next !== raw;
+  if (changed) {
+    assertMergeValid(raw, next);
+    atomicWriteFile(path, next);
+  }
+  return {
+    path,
+    gate: isGateInstalled3(desired),
+    capture: isCaptureInstalled(desired),
+    autoAccept: autoAcceptOf(next),
+    changed
+  };
+}
+function performUninstall3() {
+  const path = configPath();
+  if (!existsSync6(path)) {
+    removeShim();
+    return { path, gate: false, capture: false, autoAccept: false, changed: false };
+  }
+  const raw = readFileSync5(path, "utf-8");
+  const existing = readHooksFromRaw(raw);
+  const remaining = applyUninstall3(existing);
+  const next = JSON.stringify(existing) === JSON.stringify(remaining) ? raw : spliceHooks(raw, remaining);
+  const changed = next !== raw;
+  if (changed) {
+    assertMergeValid(raw, next);
+    atomicWriteFile(path, next);
+  }
+  removeShim();
+  return {
+    path,
+    gate: isGateInstalled3(remaining),
+    capture: isCaptureInstalled(remaining),
+    autoAccept: autoAcceptOf(next),
+    changed
+  };
+}
+function performStatus3() {
+  const path = configPath();
+  const hooks = existsSync6(path) ? readHooks(readDoc(path)) : {};
+  return { path, gate: isGateInstalled3(hooks), capture: isCaptureInstalled(hooks) };
+}
+var TRUST_NOTICE2 = "[prim] Hermes requires hook consent: it prompts once per (event, command) on a TTY and records approval in ~/.hermes/shell-hooks-allowlist.json. To pre-approve non-interactively, re-run with --auto-accept (sets hooks_auto_accept: true), export HERMES_ACCEPT_HOOKS=1, or start Hermes with `hermes --accept-hooks chat`. Until approved, the hooks will not fire.";
+function rejectProjectScope(scope) {
+  if (scope === "project") {
+    console.error(
+      "[prim] Hermes config is global-only (~/.hermes/config.yaml); --scope project is not supported."
+    );
+    process.exit(2);
+  }
+}
+function registerHermesCommands(program2) {
+  const hermes = program2.command("hermes").description("Manage the prim Hermes Agent integration (capture, gate, ingest, presence)");
+  hermes.command("install").description("Register the prim hooks in Hermes's ~/.hermes/config.yaml").option("--scope <scope>", "user (default; Hermes config is global-only)").option("--force", "Replace any drifted prim hook entries").option("--auto-accept", "Also set hooks_auto_accept: true so the hooks need no TTY consent").action((opts) => {
+    rejectProjectScope(opts.scope);
+    const result = performInstall3({
+      force: opts.force ?? false,
+      autoAccept: opts.autoAccept ?? false
+    });
+    console.error(
+      result.changed ? `[prim] Hermes integration installed at ${result.path}` : `[prim] Hermes integration already present at ${result.path} (no changes)`
+    );
+    console.error(TRUST_NOTICE2);
+    console.log(JSON.stringify(result, null, JSON_INDENT3));
+  });
+  hermes.command("uninstall").description("Remove all prim hooks from Hermes's ~/.hermes/config.yaml").action(() => {
+    const result = performUninstall3();
+    console.error(
+      result.changed ? `[prim] prim hooks removed from ${result.path}` : `[prim] no prim hooks to remove at ${result.path} (nothing changed)`
+    );
+    console.log(JSON.stringify(result, null, JSON_INDENT3));
+  });
+  hermes.command("status").description("Report whether each prim surface (gate, capture) is installed").action(() => {
+    const result = performStatus3();
+    const mark = (b) => b ? "\u2713" : "\u2717";
+    console.error(
+      `[prim] hermes: gate ${mark(result.gate)} \xB7 capture ${mark(result.capture)} (${result.path})`
+    );
+    console.log(JSON.stringify(result, null, JSON_INDENT3));
+  });
+}
+
 // src/commands/hooks.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
 import { resolve } from "path";
 import { Option } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
@@ -2043,13 +2394,13 @@ function getGitRoot() {
 }
 function detectHusky(gitRoot) {
   const huskyDir = resolve(gitRoot, ".husky");
-  if (!existsSync6(huskyDir)) return false;
-  if (existsSync6(resolve(huskyDir, "_"))) return true;
-  if (existsSync6(resolve(huskyDir, "pre-commit"))) return true;
+  if (!existsSync7(huskyDir)) return false;
+  if (existsSync7(resolve(huskyDir, "_"))) return true;
+  if (existsSync7(resolve(huskyDir, "pre-commit"))) return true;
   const pkgPath = resolve(gitRoot, "package.json");
-  if (existsSync6(pkgPath)) {
+  if (existsSync7(pkgPath)) {
     try {
-      const pkg2 = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync6(pkgPath, "utf-8"));
       const scripts = pkg2.scripts ?? {};
       if (/husky/i.test(scripts.prepare ?? "") || /husky/i.test(scripts.postinstall ?? "")) {
         return true;
@@ -2076,20 +2427,20 @@ async function askConfirmation(question) {
 }
 function installToHusky(gitRoot, spec = PRE_COMMIT) {
   const hookPath = resolve(gitRoot, ".husky", spec.hookName);
-  if (existsSync6(hookPath)) {
-    const existing = readFileSync5(hookPath, "utf-8");
+  if (existsSync7(hookPath)) {
+    const existing = readFileSync6(hookPath, "utf-8");
     if (containsPrimHook(existing, spec.binName)) {
       console.log(`Prim ${spec.hookName} hook is already installed in .husky/${spec.hookName}.`);
       return;
     }
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    writeFileSync3(hookPath, `${existing}${separator}${huskyBlock(spec)}
+    writeFileSync4(hookPath, `${existing}${separator}${huskyBlock(spec)}
 `, {
       mode: 493
     });
     console.log(`Appended prim hook block to .husky/${spec.hookName}.`);
   } else {
-    writeFileSync3(hookPath, `#!/bin/sh
+    writeFileSync4(hookPath, `#!/bin/sh
 
 ${huskyBlock(spec)}
 `, {
@@ -2101,11 +2452,11 @@ ${huskyBlock(spec)}
 function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   const hooksDir = resolve(gitRoot, ".git", "hooks");
   const hookPath = resolve(hooksDir, spec.hookName);
-  if (!existsSync6(hooksDir)) {
-    mkdirSync4(hooksDir, { recursive: true });
+  if (!existsSync7(hooksDir)) {
+    mkdirSync5(hooksDir, { recursive: true });
   }
-  if (existsSync6(hookPath)) {
-    const existing = readFileSync5(hookPath, "utf-8");
+  if (existsSync7(hookPath)) {
+    const existing = readFileSync6(hookPath, "utf-8");
     if (containsPrimHook(existing, spec.binName)) {
       console.log(`Prim ${spec.hookName} hook is already installed at ${hookPath}.`);
       return;
@@ -2114,7 +2465,7 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
     console.log("To replace it, run: prim hooks uninstall && prim hooks install");
     return;
   }
-  writeFileSync3(hookPath, dotGitScript(spec), { mode: 493 });
+  writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
 function installHooks(gitRoot, target) {
@@ -2168,11 +2519,11 @@ function registerHooksCommands(program2) {
     const gitRoot = getGitRoot();
     for (const spec of HOOKS) {
       const hookPath = resolve(gitRoot, ".git", "hooks", spec.hookName);
-      if (!existsSync6(hookPath)) {
+      if (!existsSync7(hookPath)) {
         console.log(`No ${spec.hookName} hook found.`);
         continue;
       }
-      if (containsPrimHook(readFileSync5(hookPath, "utf-8"), spec.binName)) {
+      if (containsPrimHook(readFileSync6(hookPath, "utf-8"), spec.binName)) {
         unlinkSync2(hookPath);
         console.log(`Removed ${spec.hookName} hook at ${hookPath}`);
       } else {
@@ -2183,11 +2534,11 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/moves.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 
 // src/flusher.ts
-import { renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
+import { renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
 var BATCH_SIZE = 500;
 var HTTP_TIMEOUT_MS = 1e4;
 var OPPORTUNISTIC_FLUSH_AFTER_MS = 6e4;
@@ -2219,7 +2570,7 @@ async function drainFlushingPath(flushingPath) {
 async function drainPath(path) {
   const tmpPath = `${path}.flushing.${String(Date.now())}.${String(process.pid)}`;
   try {
-    renameSync2(path, tmpPath);
+    renameSync3(path, tmpPath);
   } catch (err) {
     if (err.code === "ENOENT") {
       return 0;
@@ -2343,19 +2694,19 @@ function registerMovesCommands(program2) {
     }
   });
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
-    const dir = join5(process.cwd(), ".prim");
-    if (!existsSync7(dir)) {
-      mkdirSync5(dir, { recursive: true, mode: DIR_MODE });
+    const dir = join6(process.cwd(), ".prim");
+    if (!existsSync8(dir)) {
+      mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
     }
-    const file = join5(process.cwd(), WORKSPACE_FILE);
-    writeFileSync4(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
+    const file = join6(process.cwd(), WORKSPACE_FILE);
+    writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
       mode: FILE_MODE2
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
   moves.command("drop").description("Remove the .prim/workspace.json binding from the cwd").action(() => {
-    const file = join5(process.cwd(), WORKSPACE_FILE);
-    if (!existsSync7(file)) {
+    const file = join6(process.cwd(), WORKSPACE_FILE);
+    if (!existsSync8(file)) {
       console.log("[prim] no workspace binding in cwd");
       return;
     }
@@ -2448,23 +2799,23 @@ function registerReconcileCommands(program2) {
 
 // src/commands/session.ts
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync6,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync7,
   readdirSync,
   unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var DIR_MODE2 = 448;
 var FILE_MODE3 = 384;
 function ensureDir() {
-  if (!existsSync8(SESSIONS_DIR)) {
-    mkdirSync6(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
+  if (!existsSync9(SESSIONS_DIR)) {
+    mkdirSync7(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
   }
 }
 function markerPath(sessionId) {
-  return join6(SESSIONS_DIR, `${sessionId}.json`);
+  return join7(SESSIONS_DIR, `${sessionId}.json`);
 }
 function registerSessionCommands(program2) {
   const session = program2.command("session").description("Decision Event Pipeline \u2014 session binding markers");
@@ -2474,13 +2825,13 @@ function registerSessionCommands(program2) {
       orgId: opts.orgId,
       startedAt: Date.now()
     };
-    writeFileSync5(markerPath(sessionId), JSON.stringify(marker, null, 2), {
+    writeFileSync6(markerPath(sessionId), JSON.stringify(marker, null, 2), {
       mode: FILE_MODE3
     });
     console.log(`[prim] session ${sessionId} bound to org ${opts.orgId}`);
   });
   session.command("list").description("List active session markers").action(() => {
-    if (!existsSync8(SESSIONS_DIR)) {
+    if (!existsSync9(SESSIONS_DIR)) {
       console.log("[prim] no session markers");
       return;
     }
@@ -2492,7 +2843,7 @@ function registerSessionCommands(program2) {
     for (const f of files) {
       const sessionId = f.replace(/\.json$/, "");
       try {
-        const m = JSON.parse(readFileSync6(join6(SESSIONS_DIR, f), "utf-8"));
+        const m = JSON.parse(readFileSync7(join7(SESSIONS_DIR, f), "utf-8"));
         console.log(`${sessionId}  org=${m.orgId}`);
       } catch {
       }
@@ -2500,7 +2851,7 @@ function registerSessionCommands(program2) {
   });
   session.command("drop <sessionId>").description("Remove a session marker").action((sessionId) => {
     const p = markerPath(sessionId);
-    if (!existsSync8(p)) {
+    if (!existsSync9(p)) {
       console.log(`[prim] no marker for session ${sessionId}`);
       return;
     }
@@ -2513,13 +2864,19 @@ function registerSessionCommands(program2) {
 import { spawnSync } from "child_process";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
+var SESSION_LABELS = {
+  claude: "Claude Code integration",
+  codex: "Codex integration",
+  hermes: "Hermes integration"
+};
 function planSetupSteps(opts) {
   const scopeArgs = opts.scope === "user" ? ["--scope", "user"] : [];
+  const sessionArgs = opts.agent === "hermes" ? [opts.agent, "install"] : [opts.agent, "install", ...scopeArgs];
   const steps = [
     {
       key: "session",
-      label: opts.agent === "codex" ? "Codex integration" : "Claude Code integration",
-      args: [opts.agent, "install", ...scopeArgs],
+      label: SESSION_LABELS[opts.agent],
+      args: sessionArgs,
       required: true
     }
   ];
@@ -2532,16 +2889,32 @@ function planSetupSteps(opts) {
     });
   }
   steps.push({ key: "hooks", label: "Git hooks", args: ["hooks", "install"], required: true });
-  steps.push({ key: "skill", label: "Agent skill", args: ["skill", "install"], required: true });
+  const skillArgs = ["skill", "install", "--agent", opts.agent];
+  steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
   return steps;
 }
+function detectAgent(env) {
+  if (env.HERMES_INTERACTIVE) {
+    return "hermes";
+  }
+  return "claude";
+}
+function resolveAgent(agentFlag, env) {
+  if (agentFlag !== void 0) {
+    return { agent: agentFlag, detected: false };
+  }
+  return { agent: detectAgent(env), detected: true };
+}
 function registerSetupCommand(program2) {
   program2.command("setup").description(
     "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
-  ).option("--agent <agent>", "claude or codex", "claude").option("--scope <scope>", "project or user (session integration)", "project").option("--no-daemon", "skip starting the companion daemon").action((opts) => {
-    if (opts.agent !== "claude" && opts.agent !== "codex") {
-      process.stderr.write(`[prim] unknown --agent "${opts.agent}" (expected claude or codex)
-`);
+  ).option("--agent <agent>", "claude, codex, or hermes (auto-detected when omitted)").option("--scope <scope>", "project or user (session integration)", "project").option("--no-daemon", "skip starting the companion daemon").action((opts) => {
+    const { agent: agentInput, detected } = resolveAgent(opts.agent, process.env);
+    if (agentInput !== "claude" && agentInput !== "codex" && agentInput !== "hermes") {
+      process.stderr.write(
+        `[prim] unknown --agent "${agentInput}" (expected claude, codex, or hermes)
+`
+      );
       process.exit(EXIT_USAGE3);
     }
     if (opts.scope !== "project" && opts.scope !== "user") {
@@ -2549,7 +2922,7 @@ function registerSetupCommand(program2) {
 `);
       process.exit(EXIT_USAGE3);
     }
-    const agent = opts.agent;
+    const agent = agentInput;
     const scope = opts.scope;
     const self = process.argv[1];
     const run = (args, capture = false) => {
@@ -2571,6 +2944,9 @@ function registerSetupCommand(program2) {
         return false;
       }
     };
+    if (detected && agent !== "claude") {
+      note(`agent \xB7 detected ${agent} session (override with --agent <agent>)`);
+    }
     if (agent === "claude") {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
@@ -2601,39 +2977,45 @@ function registerSetupCommand(program2) {
 
 // src/commands/skill.ts
 import {
-  closeSync as closeSync3,
-  existsSync as existsSync9,
-  fsyncSync as fsyncSync2,
-  openSync as openSync3,
-  readFileSync as readFileSync7,
-  renameSync as renameSync3,
-  writeFileSync as writeFileSync6
+  closeSync as closeSync4,
+  existsSync as existsSync10,
+  fsyncSync as fsyncSync3,
+  openSync as openSync4,
+  readFileSync as readFileSync8,
+  renameSync as renameSync4,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname4, resolve as resolve2 } from "path";
+import { dirname as dirname5, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
-var __dirname = dirname4(fileURLToPath2(import.meta.url));
+var __dirname = dirname5(fileURLToPath2(import.meta.url));
 var SKILL_BEGIN = "<!-- BEGIN PRIM SKILL v1 -->";
 var SKILL_END = "<!-- END PRIM SKILL v1 -->";
 var TARGET_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
+  ".hermes.md",
   ".cursor/rules",
   ".windsurfrules",
   ".github/instructions/primitive.md"
 ];
 var DEFAULT_TARGET = "CLAUDE.md";
+var AGENT_TARGET = {
+  claude: "CLAUDE.md",
+  codex: "AGENTS.md",
+  hermes: ".hermes.md"
+};
 function loadSkill() {
   let dir = __dirname;
-  while (dir !== dirname4(dir)) {
+  while (dir !== dirname5(dir)) {
     const p = resolve2(dir, "SKILL.md");
-    if (existsSync9(p)) return readFileSync7(p, "utf-8");
-    dir = dirname4(dir);
+    if (existsSync10(p)) return readFileSync8(p, "utf-8");
+    dir = dirname5(dir);
   }
   throw new Error("SKILL.md not found in package");
 }
 function detectTargets(cwd) {
-  return TARGET_CANDIDATES.filter((p) => existsSync9(resolve2(cwd, p)));
+  return TARGET_CANDIDATES.filter((p) => existsSync10(resolve2(cwd, p)));
 }
 function detectNewline(content) {
   return content.includes("\r\n") ? "\r\n" : "\n";
@@ -2661,17 +3043,23 @@ function removeBlock(existing) {
 }
 function atomicWrite2(target, content) {
   const tmp = `${target}.tmp`;
-  writeFileSync6(tmp, content);
-  const fd = openSync3(tmp, "r+");
+  writeFileSync7(tmp, content);
+  const fd = openSync4(tmp, "r+");
   try {
-    fsyncSync2(fd);
+    fsyncSync3(fd);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
-  renameSync3(tmp, target);
+  renameSync4(tmp, target);
 }
-function resolveTarget(cwd, override) {
-  if (override) return resolve2(cwd, override);
+function resolveTarget(cwd, opts) {
+  if (opts.target) return resolve2(cwd, opts.target);
+  if (opts.agent) {
+    const mapped = AGENT_TARGET[opts.agent];
+    if (typeof mapped === "string") return resolve2(cwd, mapped);
+    console.error(`Unknown --agent "${opts.agent}" (expected claude, codex, or hermes)`);
+    return null;
+  }
   const matches = detectTargets(cwd);
   if (matches.length === 0) return resolve2(cwd, DEFAULT_TARGET);
   if (matches.length === 1) return resolve2(cwd, matches[0]);
@@ -2680,9 +3068,9 @@ function resolveTarget(cwd, override) {
   return null;
 }
 function runInstall(cwd, opts) {
-  const target = resolveTarget(cwd, opts.target);
+  const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  const existing = existsSync9(target) ? readFileSync7(target, "utf-8") : "";
+  const existing = existsSync10(target) ? readFileSync8(target, "utf-8") : "";
   const eol = existing ? detectNewline(existing) : "\n";
   const block = composeBlock(loadSkill(), eol);
   const next = applyBlock(existing, block, eol);
@@ -2699,13 +3087,13 @@ function runInstall(cwd, opts) {
   return 0;
 }
 function runUninstall(cwd, opts) {
-  const target = resolveTarget(cwd, opts.target);
+  const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  if (!existsSync9(target)) {
+  if (!existsSync10(target)) {
     console.log(`Skill block not present at ${target}`);
     return 0;
   }
-  const existing = readFileSync7(target, "utf-8");
+  const existing = readFileSync8(target, "utf-8");
   const next = removeBlock(existing);
   if (next === null) {
     console.log(`Skill block not present at ${target}`);
@@ -2716,12 +3104,12 @@ function runUninstall(cwd, opts) {
   return 0;
 }
 function runStatus(cwd, opts) {
-  const target = resolveTarget(cwd, opts.target);
+  const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  const fileExists = existsSync9(target);
+  const fileExists = existsSync10(target);
   let installed = false;
   if (fileExists) {
-    const content = readFileSync7(target, "utf-8");
+    const content = readFileSync8(target, "utf-8");
     installed = content.includes(SKILL_BEGIN) && content.includes(SKILL_END);
   }
   if (opts.json) {
@@ -2741,7 +3129,7 @@ function runStatus(cwd, opts) {
 }
 function registerSkillCommands(program2) {
   const skill = program2.command("skill").description("Manage the prim skill in your project rules file");
-  skill.command("install").description("Install the prim skill block into your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--dry-run", "Print a unified diff without writing").action((opts) => {
+  skill.command("install").description("Install the prim skill block into your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--dry-run", "Print a unified diff without writing").action((opts) => {
     try {
       process.exit(runInstall(process.cwd(), opts));
     } catch (err) {
@@ -2749,27 +3137,27 @@ function registerSkillCommands(program2) {
       process.exit(2);
     }
   });
-  skill.command("uninstall").description("Remove the prim skill block from your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").action((opts) => {
+  skill.command("uninstall").description("Remove the prim skill block from your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").action((opts) => {
     process.exit(runUninstall(process.cwd(), opts));
   });
-  skill.command("status").description("Report whether the prim skill block is installed").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--json", "Output as JSON").action((opts) => {
+  skill.command("status").description("Report whether the prim skill block is installed").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--json", "Output as JSON").action((opts) => {
     process.exit(runStatus(process.cwd(), opts));
   });
 }
 
 // src/commands/statusline.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname5, resolve as resolve3 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname6, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 var STATUSLINE_NAME_CAP = 3;
 function readPackageVersion() {
   try {
-    const here = dirname5(fileURLToPath3(import.meta.url));
+    const here = dirname6(fileURLToPath3(import.meta.url));
     const candidates = [resolve3(here, "../../package.json"), resolve3(here, "../package.json")];
     for (const path of candidates) {
       try {
-        const pkg2 = JSON.parse(readFileSync8(path, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync9(path, "utf-8"));
         if (pkg2.version) {
           return pkg2.version;
         }
@@ -2936,8 +3324,8 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
 }
 
 // src/index.ts
-var __dirname2 = dirname6(fileURLToPath4(import.meta.url));
-var pkg = JSON.parse(readFileSync9(resolve4(__dirname2, "../package.json"), "utf-8"));
+var __dirname2 = dirname7(fileURLToPath4(import.meta.url));
+var pkg = JSON.parse(readFileSync10(resolve4(__dirname2, "../package.json"), "utf-8"));
 updateNotifier({ pkg }).notify();
 var program = new Command();
 program.name("prim").description("CLI for Primitive's decision graph").version(pkg.version).option("-y, --yes", "auto-confirm prompts").option(
@@ -2952,6 +3340,7 @@ registerSessionCommands(program);
 registerDecisionsCommands(program);
 registerClaudeCommands(program);
 registerCodexCommands(program);
+registerHermesCommands(program);
 registerDaemonCommands(program);
 registerDoctorCommands(program);
 registerReconcileCommands(program);