@primitive.ai/prim 0.1.0-alpha.34 → 0.1.0-alpha.35

package/dist/index.js

@@ -4,8 +4,9 @@ import {
   color,
   colorForArea,
   dim,
-  stripAnsi
-} from "./chunk-4QJOQIY6.js";
+  stripAnsi,
+  stripControlChars
+} from "./chunk-AAGJFO7C.js";
 import {
   checkAffectedDecisions,
   daemonOrDirectGet,
@@ -19,6 +20,11 @@ import {
   listFlushing,
   readMovesFromPath
 } from "./chunk-H4OR42TJ.js";
+import {
+  activateRepoBestEffort,
+  gitToplevel,
+  setRepoActive
+} from "./chunk-LUPD2JSH.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -36,12 +42,44 @@ import {
 } from "./chunk-UTKQTZHL.js";
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname7, resolve as resolve4 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname9, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
 
+// src/output.ts
+function printJson(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+
+// src/commands/activation.ts
+function applyActivation(active) {
+  const root = gitToplevel();
+  if (!root) {
+    process.stderr.write(
+      `[prim] not a git repository \u2014 run \`prim ${active ? "enable" : "disable"}\` inside a repo
+`
+    );
+    process.exit(1);
+  }
+  try {
+    setRepoActive(process.cwd(), active);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[prim] failed to set prim.active: ${detail}
+`);
+    process.exit(1);
+  }
+  process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+  printJson({ active, repo: root });
+}
+function registerActivationCommands(program2) {
+  program2.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action(() => applyActivation(true));
+  program2.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(() => applyActivation(false));
+}
+
 // src/commands/auth.ts
 import { exec } from "child_process";
 import { createHash, randomBytes } from "crypto";
@@ -50,16 +88,160 @@ import { createServer } from "http";
 import { platform } from "os";
 import { dirname } from "path";
 
-// src/output.ts
-function printJson(data) {
-  console.log(JSON.stringify(data, null, 2));
-}
+// src/commands/auth-pages.ts
+var FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="99.77 99.96 400.85 400.85" fill="currentColor">
+  <g>
+    <g>
+      <path d="M493.8,355.14c-9.16-6.69-36.52-22.75-55.41-31.94-20.92-10.19-59.12-26.94-71.36-30-1.09-.27-2.16-.41-3.19-.41-2.33,0-4.34.71-5.67,2-2.55,2.46-2.42,5.25-1.93,9.22.71,5.74,23.04,66.51,30.38,86.48l3.48,9.51c7.62,20.93,23.48,64.49,32.01,80.15,7.79,14.48,17.3,20.66,31.81,20.66h12.18c24.02,0,33.82-11.81,33.82-40.77l.26-87.05c0-11.21-2.06-14.69-6.38-17.85Z"/>
+      <path d="M405.18,113.07c-9.78,17.98-18.92,39.17-23.5,50.2-9.64,23.22-26.04,65.91-27.27,72.7l-.25,1.3c-.73,3.75-1.42,7.29.94,9.14,2.53,1.98,6.73.56,10.1-.58l1.08-.36c21.93-7.21,78.12-37.9,88.28-43.64l5.44-3.07c10.7-6.03,18.4-10.37,24.49-14.61,4.64-3.22,15.42-12.52,15.42-29.16l.21-22.17c.06-9.4-2.84-17.4-8.38-23.14-6.1-6.31-14.99-9.51-26.42-9.51l-40.49.02c-9.2,0-16.92,7.9-19.63,12.87Z"/>
+    </g>
+    <g>
+      <g>
+        <path d="M387.33,496.91c2.46-3.03,3.5-7.67,2.72-12.11-6.97-39.55-19.41-89.79-32.47-131.1-1.06-3.34-2.05-6.66-3.04-9.96l-.06-.2c-3.23-10.76-6.28-21.4-10.88-31.03l-.49-1.04c-1.48-3.17-3.01-6.45-7.55-6.7-.11,0-.23,0-.34,0-3.77,0-6.44,3.79-8.56,7.49-7.52,13.16-14.35,28.66-20.96,43.2h0s-2.58,5.69-2.58,5.69c-8.72,19.11-18.88,41.95-28.04,66.45l-9.41,25.16c-3.78,10.1-7.23,20.71-10.55,32.42-1.12,3.96-.67,7.72,1.29,10.57,1.63,2.36,4.86,4.91,8.13,4.91l115.07-.11c3.14,0,5.82-1.25,7.74-3.62Z"/>
+      </g>
+      <path d="M361.69,100.04h-86.95c-3.21-.01-5.95,1.24-7.71,3.52-1.81,2.34-2.41,5.61-1.65,8.96,1.6,7.02,15.48,35.97,21.37,48.1,7.81,16.07,27.58,54.75,38.81,71.76.32.48.65,1.04.99,1.62,1.73,2.95,3.48,5.91,7.12,5.56,3.84-.36,5.3-3.97,6.48-6.86.21-.51.4-.98.58-1.38,1.86-4.1,13.67-40.82,20.64-65.31,7.2-25.27,12.18-47.95,12.84-53.03.52-4.03-.14-7.16-1.97-9.31-2.05-2.4-5.59-3.62-10.55-3.62Z"/>
+    </g>
+  </g>
+  <g>
+    <path d="M298.79,268.76c-7.3-3.09-39.86-11.68-96.8-25.51-24.41-5.93-84.07-17.79-88.54-18.56-.63-.11-1.27-.16-1.9-.16-2.95,0-5.8,1.21-7.83,3.31-2.13,2.21-3.12,5.23-3.12,9.49v95.29c0,4.95.65,8.35,4.01,11.09,3.05,2.5,7.02,3.29,10.9,2.19,21.12-6.05,65.7-19.92,94.48-30.22,25.85-9.25,71.81-28.09,81.04-32.3,7.19-3.28,12.23-5.92,11.69-10.09-.32-2.51-2.32-3.85-3.94-4.54Z"/>
+    <path d="M447.09,228.98l-.66.27c-2.97,1.21-5.79,2.35-8.32,3.37-18.39,7.41-49.84,22.26-56.6,25.74l-1.74.89c-6.83,3.48-12.73,6.49-12.73,11.06,0,4.83,8.3,8.33,16.8,11.51.43.16,53.65,19.36,84.63,28.75l1.71.52c6.12,1.86,11.9,3.62,18.39,4.83,3.07.58,6.32-.29,8.68-2.31,2.18-1.87,3.37-4.51,3.37-7.44l-.03-84.37c0-2.55-1.04-4.89-2.92-6.58-1.78-1.6-4.21-2.52-6.66-2.52-.44,0-.88.03-1.32.09-4.06.56-27.25,9.98-42.59,16.21Z"/>
+  </g>
+  <g>
+    <path d="M199.41,487.9c11.63-15.23,42.48-59.57,55.71-81.4,25.25-41.68,55.4-93.54,58.65-100.9,2-4.51,1.9-6.61-.39-8.62-1.14-1.34-2.56-1.94-4.43-1.94-3.14,0-7.09,1.65-10.91,3.25l-.26.11c-.69.29-1.38.58-2.06.85-39.47,15.95-105.3,47.48-143.76,68.85l-4.64,2.57c-12.98,7.17-23.24,12.83-31.79,21.13-9.55,9.27-15.07,19.13-15.07,42.06l.1,27.6c.02,6.98.68,12.88,3.87,18.97,6.64,12.68,18.51,20.25,31.76,20.25l35.12-.14c15.31,0,22.31-5.06,28.12-12.66Z"/>
+    <g>
+      <path d="M100.86,166.89c0,11.82,6.85,17.37,8.95,18.79,5.81,3.92,37.07,18.76,68.66,30.25,28.43,10.35,107.26,35.67,125.35,36.95,2.87.22,5.62-.95,7.19-3.02,1.62-2.14,2.06-5.3,1.12-8.07-2.26-6.66-26.14-42.52-48.34-75.61-13.95-20.79-36.51-52.08-40.14-56.03l-.59-.64c-3.62-3.97-8.57-9.4-18.67-9.4l-72.02-.15c-17.35,0-30.26,13-31.39,31.62-.58,9.4-.44,15.56-.29,22.68l-.92.05.92-.02c.08,3.76.16,7.65.16,12.59Z"/>
+    </g>
+  </g>
+</svg>`;
+var WORDMARK_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="115 160 770 175" fill="currentColor">
+          <g>
+            <path d="M368.76,202.52h-35.98v96.31h12.86v-37.53h23.11c18.6,0,31.08-12.16,31.08-30.28,0-14.19-9.62-28.51-31.08-28.51ZM369.29,249.41h-23.66v-34.95h23.66c10.57,0,17.41,6.52,17.41,16.59,0,11.15-6.82,18.36-17.41,18.36Z"/>
+            <path d="M421.81,237.49v.02l-1.19-11.96h-10.37v73.28h12.74v-38.41c0-14.42,8.48-22.69,23.23-22.69h3.18v-12.6h-3.18c-11.23,0-19.45,4.17-24.42,12.36Z"/>
+            <rect x="463.25" y="225.55" width="12.74" height="73.28"/>
+            <path d="M576.17,223.94h-.02c-10.47,0-20.27,5.19-25.39,13.35-4.13-8.4-12.52-13.35-22.71-13.35-9.66,0-18.66,4.31-23.98,11.37l-.95-9.74h-10.37v73.28h12.74v-44.35c.14-11.48,8.44-19.19,20.66-19.19,9.14,0,14.84,5.8,14.84,15.1v48.44h12.6v-44.35c.14-11.48,8.44-19.19,20.66-19.19,9.14,0,14.84,5.8,14.84,15.1v48.44h12.74v-48.84c0-15.36-10.55-26.07-25.67-26.07Z"/>
+            <rect x="617.38" y="225.55" width="12.74" height="73.28"/>
+            <path d="M669.43,204.95h-12.72v20.62h-13.29v10.97h13.29v41.11c0,13.67,7.87,21.2,22.15,21.2h8.74v-10.97h-8.74c-6.24,0-9.42-3.44-9.42-10.23v-41.11h18.16v-10.97h-18.16v-20.62Z"/>
+            <rect x="702.48" y="225.55" width="12.74" height="73.28"/>
+            <polygon points="762.68 282.97 739.67 226.03 739.47 225.55 725.66 225.55 756.22 298.85 769 298.85 799.56 225.55 785.75 225.55 762.68 282.97"/>
+            <path d="M868.79,260.98l-.02-.02c-.4-23.19-12.99-37.04-33.66-37.04-23.88,0-34.75,19.97-34.75,38.53,0,22.29,14.84,37.87,36.1,37.87,16.39,0,28.67-9.46,32.03-24.7l.2-.91h-12.44l-.16.52c-2.84,8.92-9.8,13.85-19.61,13.85-13.49,0-22.39-9.26-23.33-24.24h55.65v-3.86ZM813.91,254c2.42-11.82,10.29-18.82,21.18-18.82s18.02,6.85,20.25,18.82h-41.43Z"/>
+            <path d="M469.7,199.68c-4.79,0-8.42,3.56-8.42,8.29s3.7,8.42,8.42,8.42,8.29-3.62,8.29-8.42-3.56-8.29-8.29-8.29Z"/>
+            <path d="M623.83,199.68c-4.79,0-8.42,3.56-8.42,8.29s3.7,8.42,8.42,8.42,8.29-3.62,8.29-8.42-3.56-8.29-8.29-8.29Z"/>
+            <path d="M708.91,199.68c-4.79,0-8.42,3.56-8.42,8.29s3.7,8.42,8.42,8.42,8.29-3.62,8.29-8.42-3.56-8.29-8.29-8.29Z"/>
+          </g>
+          <g>
+            <path d="M131.47,199.69c0,4.45,2.3,6.33,3.48,7.07,2.23,1.41,13.96,7.06,25.86,11.39,9.28,3.38,32.82,10.99,43.37,13.27,1.62.35,5.22,1.11,6.55-.5,1.33-1.61-.5-4.95-1.58-6.74-3.27-5.43-9.92-15.39-16.21-24.76-5.25-7.82-15.34-21.33-15.34-21.33-1.36-1.49-3.23-3.54-7.03-3.54l-28.33-.05c-5.96,0-10.78,4.83-10.78,10.78,0,0,0,.08,0,.22h0v14.08h0v.11Z"/>
+            <path d="M232.64,284.23c-2.77-10.24-9.15-29.14-9.73-30.42-.47-1.05-1.23-2.04-2.68-2.04-1.63,0-2.49,1.43-3.28,2.82-2.83,4.95-5.41,10.79-7.89,16.26h0s-.97,2.14-.97,2.14c-3.29,7.19-7.11,15.79-10.56,25.01l-3.54,9.47c-1.42,3.8-2.72,7.79-3.97,12.2-.42,1.49-.25,2.9.49,3.98.61.89,1.83,1.85,3.06,1.85l43.34-.04c1.18,0,2.19-.47,2.91-1.36.93-1.14,1.32-2.89,1.03-4.56-1.85-10.48-4.91-23.22-8.19-35.31Z"/>
+            <path d="M132.98,266.34c1.15.94,2.65,1.24,4.11.82,7.95-2.28,24.75-7.5,35.59-11.38,9.74-3.48,27.05-10.57,30.52-12.16,2.71-1.23,4.61-2.23,4.4-3.8-.12-.94-.87-1.45-1.48-1.71-2.75-1.16-15.01-4.4-36.46-9.6-9.2-2.23-32.27-7.05-34.06-7.05-1.11,0-2.19.45-2.95,1.25-.8.83-1.18,1.97-1.18,3.57v35.87c0,1.86.25,3.14,1.51,4.18Z"/>
+            <path d="M281.35,217.96c-.67-.6-1.59-.95-2.51-.95-.17,0-.33.01-.5.03-1.53.21-18.47,7.09-19.42,7.47-6.93,2.79-18.77,8.38-21.32,9.69,0,0-5.45,2.56-5.45,4.5,0,1.82,3.13,3.14,6.33,4.33.16.06,20.21,7.29,31.88,10.82l.64.2c2.3.7,4.48,1.36,6.93,1.82,1.16.22,2.38-.11,3.27-.87.82-.7,1.27-1.7,1.27-2.8v-31.76c-.01-.96-.4-1.84-1.11-2.48Z"/>
+            <path d="M280.06,270.67c-3.45-2.52-13.76-8.56-20.87-12.02-7.88-3.84-22.27-10.14-26.88-11.29-.41-.1-.81-.15-1.2-.15-.88,0-1.64.27-2.14.75-.96.93-.91,1.98-.73,3.47.27,2.16,8.68,25.04,11.44,32.55,0,0,10.15,27.85,13.37,33.75,2.93,5.45,6.52,7.77,11.98,7.77h6.64c5.96,0,10.78-4.83,10.78-10.78v-37.34c0-4.22-.77-5.53-2.4-6.72Z"/>
+            <path d="M227.72,228.15c-.03,1.15.92,2.07,2.06,2.09.01,0,.03,0,.04,0,.02,0,.03,0,.05-.01,1.23-.04,2.63-.5,2.63-.5,8.06-2.65,37.66-19.95,44.22-24.37,1.72-1.16,5.75-4.6,5.75-10.72v-9.37c0-5.95-4.83-10.78-10.78-10.78h-16.9c-3.38,0-6.22,2.91-7.22,4.74-3.59,6.61-6.96,14.39-8.64,18.45-3.55,8.53-8.86,22.45-10.79,28.55-.13.41-.41,1.49-.42,1.91Z"/>
+            <path d="M201.91,197.31c2.94,6.05,10.39,20.61,14.62,27.01.47.73,1.52,2.65,3.09,2.63,1.58-.02,2.58-2.92,2.63-3.04.7-1.54,5.09-14.96,7.72-24.17,2.71-9.51,4.54-17.99,4.89-20.37.24-1.6-.05-2.7-.74-3.51-.77-.9-2.11-1.36-3.97-1.36h-32.75c-1.21,0-2.24.47-2.9,1.33-.68.88-.91,2.11-.62,3.37.6,2.64,5.83,13.54,8.05,18.1Z"/>
+            <path d="M212.24,250.35c0-.96-.84-1.83-1.76-1.97-1.67-.24-3.97.79-5.47,1.31-14.87,6-39.66,17.87-54.15,25.92l-1.75.97c-4.89,2.7-8.75,4.83-11.97,7.96-3.6,3.49-5.68,7.2-5.68,15.83v14.35c0,5.95,4.83,10.78,10.78,10.78l15.9-.03c5.77,0,8.4-1.91,10.59-4.76,4.38-5.73,16-22.42,20.98-30.64,9.51-15.69,20.57-34.99,21.93-37.7.51-1.03.58-1.49.6-2.01Z"/>
+          </g>
+        </svg>`;
+var FAVICON_HREF = `data:image/svg+xml;base64,${Buffer.from(FAVICON_SVG).toString("base64")}`;
+function renderPage(o) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${o.docTitle}</title>
+    <link rel="icon" type="image/svg+xml" href="${FAVICON_HREF}" />
+    <style>
+      :root {
+        --inter-orange: #ff4f00;
+        --light-bg: #f5f5f5;
+        --black: #333333;
+        --hairline: rgba(0, 0, 0, 0.16);
+      }
+      *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+      html { -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; }
+      body {
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 32px;
+        background-color: var(--light-bg);
+        color: var(--black);
+        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+        line-height: 1.5;
+        overflow: hidden;
+      }
+      /* The brand frame: the homepage's inset rounded hero canvas, as a hairline. */
+      .frame {
+        position: fixed;
+        inset: 16px;
+        border: 1px solid var(--hairline);
+        border-radius: 24px;
+        pointer-events: none;
+        z-index: 1;
+      }
+      .card { position: relative; z-index: 2; width: 100%; max-width: 460px; text-align: center; }
+
+      .eyebrow {
+        font-family: ui-monospace, "SF Mono", "JetBrains Mono", Menlo, Consolas, monospace;
+        font-size: 11px; font-weight: 500; letter-spacing: 0.18em; text-transform: uppercase;
+        color: var(--inter-orange);
+      }
+      .title {
+        font-size: 30px; font-weight: 600; letter-spacing: -0.02em; line-height: 1.1;
+        margin: 14px 0 10px;
+      }
+      .subtitle {
+        font-size: 15px; color: rgba(0, 0, 0, 0.55);
+      }
+      .mark { margin-top: 40px; }
+      .mark svg { height: 22px; width: auto; color: rgba(0, 0, 0, 0.38); }
+
+      @media (max-width: 460px) {
+        .title { font-size: 26px; }
+        .frame { inset: 10px; border-radius: 18px; }
+      }
+    </style>
+  </head>
+  <body>
+    <div class="frame" aria-hidden="true"></div>
+    <main class="card">
+      <p class="eyebrow">${o.eyebrow}</p>
+      <h1 class="title">${o.title}</h1>
+      <p class="subtitle">${o.detail}</p>
+
+      <div class="mark" aria-hidden="true">
+        ${WORDMARK_SVG}
+      </div>
+    </main>
+  </body>
+</html>`;
+}
+var SUCCESS_HTML = renderPage({
+  docTitle: "Primitive \u2014 Authenticated",
+  eyebrow: "Authenticated",
+  title: "Authentication successful!",
+  detail: "You can close this tab."
+});
+var FAILURE_HTML = renderPage({
+  docTitle: "Primitive \u2014 Authentication failed",
+  eyebrow: "Error",
+  title: "Authentication failed.",
+  detail: "Return to your terminal for details."
+});
+var STATE_MISMATCH_HTML = renderPage({
+  docTitle: "Primitive \u2014 Authentication failed",
+  eyebrow: "Error",
+  title: "State mismatch. Authentication failed.",
+  detail: "Return to your terminal for details."
+});
 
 // src/commands/auth.ts
 var FILE_MODE = 384;
 var LOCALHOST = "127.0.0.1";
 var CALLBACK_PORT = 19876;
 var CALLBACK_TIMEOUT_MS = 12e4;
+var EXIT_OK = 0;
+var EXIT_FAIL = 1;
+var HTML_HEADERS = { "Content-Type": "text/html; charset=utf-8" };
 var BASE64_PLUS_RE = /\+/g;
 var BASE64_SLASH_RE = /\//g;
 var BASE64_PAD_RE = /=+$/;
@@ -83,6 +265,55 @@ function saveToken(token) {
   }
   writeFileSync(TOKEN_FILE_PATH, token, { mode: FILE_MODE });
 }
+function resolveCallbackPage(params, expectedState) {
+  if (params.get("state") !== expectedState) {
+    return {
+      status: 400,
+      html: STATE_MISMATCH_HTML,
+      result: {
+        authenticated: false,
+        error: "state_mismatch",
+        detail: "state mismatch on the OAuth callback"
+      }
+    };
+  }
+  const providerError = params.get("error");
+  if (providerError) {
+    return {
+      status: 400,
+      html: FAILURE_HTML,
+      result: {
+        authenticated: false,
+        error: providerError,
+        detail: params.get("error_description") ?? void 0
+      }
+    };
+  }
+  const code = params.get("code");
+  if (!code) {
+    return {
+      status: 400,
+      html: FAILURE_HTML,
+      result: {
+        authenticated: false,
+        error: "no_code",
+        detail: "No authorization code received"
+      }
+    };
+  }
+  return { status: 200, html: SUCCESS_HTML, result: { authenticated: true, code } };
+}
+function reportFailure(error, detail) {
+  const human = detail ? `${stripControlChars(error)}: ${stripControlChars(detail)}` : stripControlChars(error);
+  console.error(`Authentication failed: ${human}`);
+  console.log(JSON.stringify({ authenticated: false, error, detail }));
+  process.exitCode = EXIT_FAIL;
+}
+function reportSuccess() {
+  console.error(`Authenticated! Token saved to ${TOKEN_FILE_PATH}`);
+  console.log(JSON.stringify({ authenticated: true, tokenFile: TOKEN_FILE_PATH }));
+  process.exitCode = EXIT_OK;
+}
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage CLI authentication");
   auth.command("login").description("Authenticate via browser (WorkOS OAuth)").action(async () => {
@@ -92,15 +323,23 @@ function registerAuthCommands(program2) {
       const res = await fetch(`${siteUrl}/mcp/config`);
       config = await res.json();
     } catch {
-      console.error("Failed to fetch MCP config. Is the Convex backend running?");
-      process.exit(1);
+      reportFailure(
+        "config_fetch_failed",
+        "Failed to fetch MCP config. Is the Convex backend running?"
+      );
+      return;
     }
     if (!config.authorization_server || !config.client_id) {
-      console.error("MCP broker is not configured on the server.");
-      process.exit(1);
+      reportFailure("broker_not_configured", "MCP broker is not configured on the server.");
+      return;
     }
     const { verifier, challenge } = generatePkce();
     const state = base64url(randomBytes(16));
+    const redirectUri = `http://${LOCALHOST}:${CALLBACK_PORT}/callback`;
+    let settle;
+    const outcome = new Promise((resolve6) => {
+      settle = resolve6;
+    });
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", `http://${LOCALHOST}`);
       if (url.pathname !== "/callback") {
@@ -108,42 +347,35 @@ function registerAuthCommands(program2) {
         res.end("Not found");
         return;
       }
-      const code = url.searchParams.get("code");
-      const returnedState = url.searchParams.get("state");
-      if (returnedState !== state) {
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end("<h1>State mismatch. Authentication failed.</h1>");
-        server.close();
-        process.exit(1);
-      }
-      if (!code) {
-        const error = url.searchParams.get("error_description") ?? "No authorization code received";
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end(`<h1>Authentication failed: ${error}</h1>`);
-        server.close();
-        process.exit(1);
-      }
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<h1>Authentication successful!</h1><p>You can close this tab.</p>");
-      exchangeCode(siteUrl, code, verifier, `http://${LOCALHOST}:${port}/callback`).then((token) => {
-        saveToken(token);
-        console.error(`Authenticated! Token saved to ${TOKEN_FILE_PATH}`);
-        console.log(JSON.stringify({ authenticated: true, tokenFile: TOKEN_FILE_PATH }));
-        server.close();
-        process.exit(0);
-      }).catch((err) => {
-        console.error("Token exchange failed:", err);
-        server.close();
-        process.exit(1);
-      });
+      const page = resolveCallbackPage(url.searchParams, state);
+      res.writeHead(page.status, HTML_HEADERS);
+      res.end(page.html, () => settle(page.result));
     });
-    const port = await new Promise((resolve5) => {
-      server.listen(CALLBACK_PORT, LOCALHOST, () => {
-        const addr = server.address();
-        resolve5(typeof addr === "object" && addr ? addr.port : 0);
+    try {
+      await new Promise((resolve6, reject) => {
+        const onError = (err) => reject(err);
+        server.once("error", onError);
+        server.listen(CALLBACK_PORT, LOCALHOST, () => {
+          server.removeListener("error", onError);
+          resolve6();
+        });
       });
+    } catch (err) {
+      if (err instanceof Error && err.code === "EADDRINUSE") {
+        reportFailure(
+          "callback_port_in_use",
+          `Port ${CALLBACK_PORT} is in use \u2014 another 'prim auth login' may be running. Close it and retry.`
+        );
+      } else {
+        reportFailure(
+          "callback_bind_failed",
+          `Could not start the local callback server: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      return;
+    }
+    server.on("error", () => {
     });
-    const redirectUri = `http://${LOCALHOST}:${port}/callback`;
     const authorizeUrl = config.authorization_endpoint ?? "https://api.workos.com/user_management/authorize";
     const authUrl = new URL(authorizeUrl);
     authUrl.searchParams.set("client_id", config.client_id);
@@ -160,11 +392,24 @@ function registerAuthCommands(program2) {
 ${authUrl.toString()}
 `);
     console.error("Waiting for callback...");
-    setTimeout(() => {
-      console.error("Authentication timed out.");
-      server.close();
-      process.exit(1);
+    const timer = setTimeout(() => {
+      settle({ authenticated: false, error: "timeout", detail: "Authentication timed out." });
     }, CALLBACK_TIMEOUT_MS);
+    timer.unref();
+    const result = await outcome;
+    clearTimeout(timer);
+    server.close();
+    if (!result.authenticated) {
+      reportFailure(result.error, result.detail);
+      return;
+    }
+    try {
+      const token = await exchangeCode(siteUrl, result.code, verifier, redirectUri);
+      saveToken(token);
+      reportSuccess();
+    } catch (err) {
+      reportFailure("token_exchange_failed", err instanceof Error ? err.message : String(err));
+    }
   });
   auth.command("set-token <token>").description("Save a bearer token for authenticated CLI calls").action((token) => {
     saveToken(token);
@@ -282,7 +527,6 @@ async function exchangeCode(siteUrl, code, codeVerifier, redirectUri) {
 }
 
 // src/commands/claude-install.ts
-import { execSync } from "child_process";
 import {
   closeSync,
   existsSync as existsSync3,
@@ -376,14 +620,7 @@ var PRIM_BINS = [
 var JSON_INDENT = 2;
 var USER_SCOPE_PATH = join2(homedir(), ".claude", "settings.json");
 function projectRoot() {
-  try {
-    return execSync("git rev-parse --show-toplevel", {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return process.cwd();
-  }
+  return gitToplevel() ?? process.cwd();
 }
 var projectScopePath = () => join2(projectRoot(), ".claude", "settings.json");
 var CAPTURE_EVENTS = [
@@ -592,6 +829,9 @@ function performInstall(scope, force) {
   if (changed) {
     atomicWrite(path, after);
   }
+  if (scope === "project") {
+    activateRepoBestEffort(process.cwd());
+  }
   return {
     scope,
     path,
@@ -788,6 +1028,9 @@ function performInstall2(scope, force) {
   if (changed) {
     atomicWrite(path, after);
   }
+  if (scope === "project") {
+    activateRepoBestEffort(process.cwd());
+  }
   return resultFor(scope, path, after, changed);
 }
 function performUninstall2(scope) {
@@ -891,7 +1134,7 @@ var STATUS_PROBE_TIMEOUT_MS = 500;
 var READY_TIMEOUT_MS = 5e3;
 var READY_POLL_MS = 100;
 var READY_PROBE_TIMEOUT_MS = 250;
-var EXIT_OK = 0;
+var EXIT_OK2 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
 function readPidfile() {
@@ -924,8 +1167,8 @@ function clearStaleArtifacts() {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve5) => {
-    const timer = setTimeout(resolve5, ms);
+  return new Promise((resolve6) => {
+    const timer = setTimeout(resolve6, ms);
     timer.unref();
   });
 }
@@ -1051,9 +1294,9 @@ function classifyStatus(pidAlive, responding, snapshot, pid) {
     };
   }
   if (!snapshot) {
-    return { json: { running: true, responding: true }, exitCode: EXIT_OK };
+    return { json: { running: true, responding: true }, exitCode: EXIT_OK2 };
   }
-  return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK };
+  return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK2 };
 }
 async function daemonStatus() {
   const pid = readPidfile();
@@ -1080,7 +1323,7 @@ async function daemonStatus() {
     );
   }
   console.log(JSON.stringify(json, null, 2));
-  if (exitCode !== EXIT_OK && !process.exitCode) {
+  if (exitCode !== EXIT_OK2 && !process.exitCode) {
     process.exitCode = exitCode;
   }
 }
@@ -2385,9 +2628,10 @@ function registerHermesCommands(program2) {
 }
 
 // src/commands/hooks.ts
-import { execSync as execSync2 } from "child_process";
+import { execFileSync } from "child_process";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { resolve } from "path";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname5, join as join6, resolve } from "path";
 import { Option } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
@@ -2400,18 +2644,25 @@ function blockMarkers(spec) {
 }
 var PRIM_BLOCK_START = blockMarkers(PRE_COMMIT).start;
 var PRIM_BLOCK_END = blockMarkers(PRE_COMMIT).end;
+var PRIM_MANAGED_MARK = "prim-managed-hook";
+var PRIM_CREATED_MARK = "prim-created-hook";
 function hookShim(binName) {
   return `if command -v ${binName} >/dev/null 2>&1; then
-  ${binName}
+  ${binName} || true
 elif [ -f "./node_modules/.bin/${binName}" ]; then
-  ./node_modules/.bin/${binName}
+  ./node_modules/.bin/${binName} || true
 else
   npx --yes -p @primitive.ai/prim ${binName} 2>/dev/null || true
 fi`;
 }
+function gatedShim(binName) {
+  return `if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
+${hookShim(binName)}
+fi`;
+}
 function dotGitScript(spec) {
   return `#!/bin/sh
-# prim ${spec.hookName} hook \u2014 installed by: prim hooks install
+# prim ${spec.hookName} hook \u2014 installed by: prim hooks install (${PRIM_MANAGED_MARK})
 
 ${hookShim(spec.binName)}
 `;
@@ -2422,10 +2673,35 @@ function huskyBlock(spec) {
 ${hookShim(spec.binName)}
 ${end}`;
 }
+function gatedBlock(spec) {
+  const { start, end } = blockMarkers(spec);
+  return `${start}
+${gatedShim(spec.binName)}
+${end}`;
+}
+function mergePrimBlock(hookPath, block, binName) {
+  if (existsSync7(hookPath)) {
+    const existing = readFileSync6(hookPath, "utf-8");
+    if (containsPrimHook(existing, binName)) return false;
+    const separator = existing.endsWith("\n") ? "\n" : "\n\n";
+    writeFileSync4(hookPath, `${existing}${separator}${block}
+`, { mode: 493 });
+    return true;
+  }
+  mkdirSync5(dirname5(hookPath), { recursive: true });
+  writeFileSync4(hookPath, `#!/bin/sh
+# ${PRIM_CREATED_MARK}
+
+${block}
+`, { mode: 493 });
+  return true;
+}
 function getGitRoot() {
-  return execSync2("git rev-parse --show-toplevel", {
-    encoding: "utf-8"
-  }).trim();
+  const root = gitToplevel();
+  if (root === null) {
+    throw new Error("not a git repository (run inside a repo, or use --scope user)");
+  }
+  return root;
 }
 function detectHusky(gitRoot) {
   const huskyDir = resolve(gitRoot, ".husky");
@@ -2462,25 +2738,13 @@ async function askConfirmation(question) {
 }
 function installToHusky(gitRoot, spec = PRE_COMMIT) {
   const hookPath = resolve(gitRoot, ".husky", spec.hookName);
-  if (existsSync7(hookPath)) {
-    const existing = readFileSync6(hookPath, "utf-8");
-    if (containsPrimHook(existing, spec.binName)) {
-      console.log(`Prim ${spec.hookName} hook is already installed in .husky/${spec.hookName}.`);
-      return;
-    }
-    const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    writeFileSync4(hookPath, `${existing}${separator}${huskyBlock(spec)}
-`, {
-      mode: 493
-    });
+  const existed = existsSync7(hookPath);
+  const wrote = mergePrimBlock(hookPath, huskyBlock(spec), spec.binName);
+  if (!wrote) {
+    console.log(`Prim ${spec.hookName} hook is already installed in .husky/${spec.hookName}.`);
+  } else if (existed) {
     console.log(`Appended prim hook block to .husky/${spec.hookName}.`);
   } else {
-    writeFileSync4(hookPath, `#!/bin/sh
-
-${huskyBlock(spec)}
-`, {
-      mode: 493
-    });
     console.log(`Created .husky/${spec.hookName} with prim hook block.`);
   }
 }
@@ -2503,6 +2767,161 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
+var PRIM_GIT_HOOKS_DIR = join6(homedir5(), ".config", "prim", "git-hooks");
+function expandTilde(p) {
+  return p.startsWith("~/") ? join6(homedir5(), p.slice(2)) : p;
+}
+function isOurHooksDir(value) {
+  return value !== "" && expandTilde(value) === PRIM_GIT_HOOKS_DIR;
+}
+function gitConfigGet(level) {
+  try {
+    return execFileSync("git", ["config", level, "--get", "core.hooksPath"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+var PASSTHROUGH_HOOKS = [
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "post-rewrite",
+  "pre-auto-gc",
+  "push-to-checkout",
+  "sendemail-validate",
+  "reference-transaction",
+  "post-index-change"
+  // (fsmonitor-watchman is intentionally omitted — it's driven by core.fsmonitor
+  //  with a query protocol, not a lifecycle event, so a bare exec stub is wrong.)
+];
+function globalHookScript(spec) {
+  const chainExit = spec.hookName === "pre-commit" ? "|| exit $?" : "|| true";
+  return `#!/bin/sh
+# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
+# Install/uninstall: prim hooks install|uninstall --scope user
+# Runs prim only where activated \u2014 'prim enable' (this repo) or
+# 'git config --global prim.active true' (every repo). Chains to the repo's own
+# hook regardless, so inactive repos are unaffected.
+${gatedShim(spec.binName)}
+common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+repo_hook="$common_dir/hooks/${spec.hookName}"
+if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null; then
+  "$repo_hook" "$@" ${chainExit}
+fi
+exit 0
+`;
+}
+function passThroughScript(hookName) {
+  return `#!/bin/sh
+# prim pass-through hook (core.hooksPath) \u2014 managed by prim; do not edit.
+common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+repo_hook="$common_dir/hooks/${hookName}"
+[ -x "$repo_hook" ] && exec "$repo_hook" "$@"
+exit 0
+`;
+}
+function ownedHookNames() {
+  return [...HOOKS.map((s) => s.hookName), ...PASSTHROUGH_HOOKS];
+}
+function writeOwnHooks() {
+  if (!existsSync7(PRIM_GIT_HOOKS_DIR)) {
+    mkdirSync5(PRIM_GIT_HOOKS_DIR, { recursive: true });
+  }
+  for (const spec of HOOKS) {
+    writeFileSync4(resolve(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
+      mode: 493
+    });
+  }
+  for (const name of PASSTHROUGH_HOOKS) {
+    writeFileSync4(resolve(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
+  }
+}
+function appendPrimBlock(hookPath, spec) {
+  mergePrimBlock(hookPath, gatedBlock(spec), spec.binName);
+}
+function stripPrimBlock(hookPath, spec) {
+  if (!existsSync7(hookPath)) return;
+  const existing = readFileSync6(hookPath, "utf-8");
+  const primCreated = existing.includes(PRIM_CREATED_MARK);
+  const { start, end } = blockMarkers(spec);
+  const s = existing.indexOf(start);
+  const e = existing.indexOf(end);
+  if (s === -1 || e === -1) return;
+  const out = (existing.slice(0, s) + existing.slice(e + end.length)).replace(/\n{2,}$/, "\n");
+  const remainder = out.replaceAll("#!/bin/sh", "").replaceAll(`# ${PRIM_CREATED_MARK}`, "").trim();
+  if (primCreated && remainder === "") {
+    unlinkSync2(hookPath);
+    return;
+  }
+  writeFileSync4(hookPath, out, { mode: 493 });
+}
+function installGlobalHooks(opts = {}) {
+  const global = gitConfigGet("--global");
+  if (global === "") {
+    const system = gitConfigGet("--system");
+    if (system !== "" && !isOurHooksDir(system)) {
+      if (!opts.force) {
+        console.error(
+          `[prim] system core.hooksPath is set to ${system}; a --global set would override it, and prim chains only to .git/hooks (not a system dir), so those hooks would stop firing. Skipping \u2014 re-run with --force to override, or run per-repo \`prim hooks install\`.`
+        );
+        return false;
+      }
+      console.error(
+        `[prim] --force: overriding system core.hooksPath ${system}; its hooks will no longer fire (prim chains only to .git/hooks).`
+      );
+    }
+    writeOwnHooks();
+    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR]);
+    console.log(
+      `Installed prim global git hooks; set core.hooksPath to ${PRIM_GIT_HOOKS_DIR}. Repos are opt-in: run \`prim enable\` in each repo to capture, or \`git config --global prim.active true\` for all.`
+    );
+    return true;
+  }
+  if (isOurHooksDir(global)) {
+    writeOwnHooks();
+    console.log(`Prim global git hooks already active (${PRIM_GIT_HOOKS_DIR}); refreshed scripts.`);
+    return true;
+  }
+  const dir = expandTilde(global);
+  for (const spec of HOOKS) {
+    appendPrimBlock(resolve(dir, spec.hookName), spec);
+  }
+  console.log(
+    `Appended prim hooks into existing core.hooksPath dir ${global} (pointer unchanged).`
+  );
+  return true;
+}
+function uninstallGlobalHooks() {
+  const global = gitConfigGet("--global");
+  if (isOurHooksDir(global)) {
+    for (const name of ownedHookNames()) {
+      const p = resolve(PRIM_GIT_HOOKS_DIR, name);
+      if (existsSync7(p)) unlinkSync2(p);
+    }
+    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"]);
+    console.log("Removed prim global git hooks and unset core.hooksPath.");
+    return;
+  }
+  if (global !== "") {
+    const dir = expandTilde(global);
+    for (const spec of HOOKS) {
+      stripPrimBlock(resolve(dir, spec.hookName), spec);
+    }
+    console.log(`Removed the prim block from ${global} (left the dir and core.hooksPath intact).`);
+    return;
+  }
+  console.log("No prim global git hooks found.");
+}
 function installHooks(gitRoot, target) {
   for (const spec of HOOKS) {
     if (target === "husky") {
@@ -2511,6 +2930,7 @@ function installHooks(gitRoot, target) {
       installToDotGit(gitRoot, spec);
     }
   }
+  activateRepoBestEffort(gitRoot);
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
@@ -2521,36 +2941,58 @@ function registerHooksCommands(program2) {
       "husky",
       "git-hooks"
     ])
-  ).action(async (opts, command) => {
-    const globals = command.optsWithGlobals();
-    const nonInteractive = Boolean(
-      globals.nonInteractive || process.env.CI || process.env.PRIM_NON_INTERACTIVE
-    );
-    const gitRoot = getGitRoot();
-    if (opts.target === "husky") return installHooks(gitRoot, "husky");
-    if (opts.target === "git-hooks") return installHooks(gitRoot, "git-hooks");
-    if (detectHusky(gitRoot)) {
-      if (globals.yes) return installHooks(gitRoot, "husky");
-      if (nonInteractive) {
-        throw new Error(
-          "--non-interactive set, refusing to prompt for Husky-hook installation. Pass --yes to confirm or --target=git-hooks to choose."
-        );
+  ).addOption(
+    new Option(
+      "--scope <scope>",
+      "project (default, this repo) or user (a global core.hooksPath capturing every repo)"
+    ).choices(["project", "user"])
+  ).option("--force", "with --scope user, override a system-level core.hooksPath").action(
+    async (opts, command) => {
+      if (opts.scope === "user") {
+        installGlobalHooks({ force: opts.force });
+        return;
       }
-      if (!process.stdin.isTTY) {
-        console.error(
-          "Note: Husky detected but stdin is not a TTY \u2014 falling back to .git/hooks. Pass --yes for Husky or --non-interactive to fail fast."
-        );
-      } else if (await askConfirmation(
-        "Husky detected. Install prim hooks into .husky/ instead of .git/hooks/?"
-      )) {
-        return installHooks(gitRoot, "husky");
-      } else {
-        console.log("Falling back to .git/hooks install.");
+      const globals = command.optsWithGlobals();
+      const nonInteractive = Boolean(
+        globals.nonInteractive || process.env.CI || process.env.PRIM_NON_INTERACTIVE
+      );
+      const gitRoot = getGitRoot();
+      if (opts.target === "husky") return installHooks(gitRoot, "husky");
+      if (opts.target === "git-hooks") return installHooks(gitRoot, "git-hooks");
+      if (detectHusky(gitRoot)) {
+        if (globals.yes) return installHooks(gitRoot, "husky");
+        if (nonInteractive) {
+          throw new Error(
+            "--non-interactive set, refusing to prompt for Husky-hook installation. Pass --yes to confirm or --target=git-hooks to choose."
+          );
+        }
+        if (!process.stdin.isTTY) {
+          console.error(
+            "Note: Husky detected but stdin is not a TTY \u2014 falling back to .git/hooks. Pass --yes for Husky or --non-interactive to fail fast."
+          );
+        } else if (await askConfirmation(
+          "Husky detected. Install prim hooks into .husky/ instead of .git/hooks/?"
+        )) {
+          return installHooks(gitRoot, "husky");
+        } else {
+          console.log("Falling back to .git/hooks install.");
+        }
       }
+      installHooks(gitRoot, "git-hooks");
+    }
+  );
+  hooks.command("uninstall").description(
+    "Remove the prim git hooks (.git/hooks, or the global core.hooksPath with --scope user)"
+  ).addOption(
+    new Option(
+      "--scope <scope>",
+      "project (default, this repo) or user (global core.hooksPath)"
+    ).choices(["project", "user"])
+  ).action((opts) => {
+    if (opts.scope === "user") {
+      uninstallGlobalHooks();
+      return;
     }
-    installHooks(gitRoot, "git-hooks");
-  });
-  hooks.command("uninstall").description("Remove the prim git hooks (.git/hooks)").action(() => {
     const gitRoot = getGitRoot();
     for (const spec of HOOKS) {
       const hookPath = resolve(gitRoot, ".git", "hooks", spec.hookName);
@@ -2570,7 +3012,7 @@ function registerHooksCommands(program2) {
 
 // src/commands/moves.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/flusher.ts
 import { renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
@@ -2729,18 +3171,18 @@ function registerMovesCommands(program2) {
     }
   });
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
-    const dir = join6(process.cwd(), ".prim");
+    const dir = join7(process.cwd(), ".prim");
     if (!existsSync8(dir)) {
       mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
     }
-    const file = join6(process.cwd(), WORKSPACE_FILE);
+    const file = join7(process.cwd(), WORKSPACE_FILE);
     writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
       mode: FILE_MODE2
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
   moves.command("drop").description("Remove the .prim/workspace.json binding from the cwd").action(() => {
-    const file = join6(process.cwd(), WORKSPACE_FILE);
+    const file = join7(process.cwd(), WORKSPACE_FILE);
     if (!existsSync8(file)) {
       console.log("[prim] no workspace binding in cwd");
       return;
@@ -2751,7 +3193,7 @@ function registerMovesCommands(program2) {
 }
 
 // src/commands/reconcile.ts
-var EXIT_OK2 = 0;
+var EXIT_OK3 = 0;
 var EXIT_USAGE2 = 2;
 var EXIT_SERVER = 3;
 var HTTP_CLIENT_ERROR_MIN = 400;
@@ -2814,7 +3256,7 @@ async function performReconcile(idOrShortId, opts = {}) {
 `
     );
     console.log(JSON.stringify(response, null, 2));
-    process.exitCode = EXIT_OK2;
+    process.exitCode = EXIT_OK3;
     return;
   }
   process.stderr.write("[prim] reconcile: malformed server response\n");
@@ -2841,7 +3283,7 @@ import {
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var DIR_MODE2 = 448;
 var FILE_MODE3 = 384;
 function ensureDir() {
@@ -2850,7 +3292,7 @@ function ensureDir() {
   }
 }
 function markerPath(sessionId) {
-  return join7(SESSIONS_DIR, `${sessionId}.json`);
+  return join8(SESSIONS_DIR, `${sessionId}.json`);
 }
 function registerSessionCommands(program2) {
   const session = program2.command("session").description("Decision Event Pipeline \u2014 session binding markers");
@@ -2878,7 +3320,7 @@ function registerSessionCommands(program2) {
     for (const f of files) {
       const sessionId = f.replace(/\.json$/, "");
       try {
-        const m = JSON.parse(readFileSync7(join7(SESSIONS_DIR, f), "utf-8"));
+        const m = JSON.parse(readFileSync7(join8(SESSIONS_DIR, f), "utf-8"));
         console.log(`${sessionId}  org=${m.orgId}`);
       } catch {
       }
@@ -2897,6 +3339,8 @@ function registerSessionCommands(program2) {
 
 // src/commands/setup.ts
 import { spawnSync } from "child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join9 } from "path";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
 var SESSION_LABELS = {
@@ -2923,11 +3367,57 @@ function planSetupSteps(opts) {
       required: false
     });
   }
-  steps.push({ key: "hooks", label: "Git hooks", args: ["hooks", "install"], required: true });
-  const skillArgs = ["skill", "install", "--agent", opts.agent];
+  steps.push({
+    key: "hooks",
+    label: "Git hooks",
+    args: ["hooks", "install", ...scopeArgs],
+    required: true
+  });
+  const skillArgs = ["skill", "install", "--agent", opts.agent, ...scopeArgs];
   steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
+  if (opts.scope === "user") {
+    steps.push({ key: "enable", label: "Activate this repo", args: ["enable"], required: false });
+  }
+  return steps;
+}
+var CONFLICT_SESSION = "session";
+var CONFLICT_HOOKS = "hooks";
+var CONFLICT_SKILL = "skill";
+function planCleanupUninstalls(agent, conflicts) {
+  const steps = [];
+  if (conflicts.includes(CONFLICT_SESSION) && agent !== "hermes") {
+    steps.push([agent, "uninstall", "--scope", "project"]);
+  }
+  if (conflicts.includes(CONFLICT_HOOKS)) steps.push(["hooks", "uninstall"]);
+  if (conflicts.includes(CONFLICT_SKILL)) steps.push(["skill", "uninstall", "--agent", agent]);
   return steps;
 }
+function detectProjectConflicts(agent, run) {
+  const conflicts = [];
+  if (agent !== "hermes") {
+    try {
+      const parsed = JSON.parse(run([agent, "status"], true).stdout || "{}");
+      if (parsed.project?.gate || parsed.project?.capture) conflicts.push(CONFLICT_SESSION);
+    } catch {
+    }
+  }
+  try {
+    const root = gitToplevel();
+    const preCommit = root && join9(root, ".git", "hooks", "pre-commit");
+    if (preCommit && existsSync10(preCommit) && readFileSync8(preCommit, "utf-8").includes("prim-pre-commit")) {
+      conflicts.push(CONFLICT_HOOKS);
+    }
+  } catch {
+  }
+  try {
+    const parsed = JSON.parse(
+      run(["skill", "status", "--agent", agent, "--json"], true).stdout || "{}"
+    );
+    if (parsed.installed) conflicts.push(CONFLICT_SKILL);
+  } catch {
+  }
+  return conflicts;
+}
 function detectAgent(env) {
   if (env.HERMES_INTERACTIVE) {
     return "hermes";
@@ -2943,7 +3433,14 @@ function resolveAgent(agentFlag, env) {
 function registerSetupCommand(program2) {
   program2.command("setup").description(
     "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
-  ).option("--agent <agent>", "claude, codex, or hermes (auto-detected when omitted)").option("--scope <scope>", "project or user (session integration)", "project").option("--no-daemon", "skip starting the companion daemon").action((opts) => {
+  ).option("--agent <agent>", "claude, codex, or hermes (auto-detected when omitted)").option(
+    "--scope <scope>",
+    "user (default \u2014 install once for every repo) or project (this repo only)",
+    "user"
+  ).option(
+    "--migrate",
+    "with the default user scope, remove any project-scoped prim config in this repo (else just warn)"
+  ).option("--no-daemon", "skip starting the companion daemon").action((opts) => {
     const { agent: agentInput, detected } = resolveAgent(opts.agent, process.env);
     if (agentInput !== "claude" && agentInput !== "codex" && agentInput !== "hermes") {
       process.stderr.write(
@@ -2962,7 +3459,7 @@ function registerSetupCommand(program2) {
     const self = process.argv[1];
     const run = (args, capture = false) => {
       const r = spawnSync(process.execPath, [self, ...args], {
-        stdio: capture ? ["inherit", "pipe", "inherit"] : "inherit",
+        stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
         encoding: "utf-8"
       });
       return { code: r.status ?? 1, stdout: capture ? r.stdout ?? "" : "" };
@@ -2999,6 +3496,18 @@ function registerSetupCommand(program2) {
       const { code } = run(step.args);
       results[step.key] = code === 0 ? "ok" : step.required ? "failed" : "skipped";
     }
+    if (scope === "user") {
+      const conflicts = detectProjectConflicts(agent, run);
+      if (conflicts.length > 0 && opts.migrate) {
+        note(`migrate \xB7 removing project-scoped config (${conflicts.join(", ")})\u2026`);
+        const ok = planCleanupUninstalls(agent, conflicts).map((args) => run(args).code === 0).every(Boolean);
+        results.migrate = ok ? "ok" : "failed";
+      } else if (conflicts.length > 0) {
+        note(
+          `migrate \xB7 project-scoped prim config present in this repo (${conflicts.join(", ")}) \u2014 it will double-fire with the user-scope install. Re-run \`prim setup --migrate\` to remove it.`
+        );
+      }
+    }
     note("welcome");
     results.welcome = run(["welcome"]).code === 0 ? "ok" : "failed";
     const failed = Object.entries(results).filter(([, v]) => v === "failed").map(([k]) => k);
@@ -3013,17 +3522,116 @@ function registerSetupCommand(program2) {
 // src/commands/skill.ts
 import {
   closeSync as closeSync4,
-  existsSync as existsSync10,
+  existsSync as existsSync12,
   fsyncSync as fsyncSync3,
   openSync as openSync4,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync10,
   renameSync as renameSync4,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname5, resolve as resolve2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname7, join as join11, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 import { createPatch } from "diff";
-var __dirname = dirname5(fileURLToPath2(import.meta.url));
+
+// src/commands/claude-plugin.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync9, readdirSync as readdirSync2, rmSync as rmSync3, rmdirSync } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname6, join as join10, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var __dirname = dirname6(fileURLToPath2(import.meta.url));
+var PLUGIN_DESCRIPTION = "Primitive decision-graph guidance for the prim CLI \u2014 a model-invoked skill installed by prim skill install.";
+function resolvePluginDir(cwd, scope) {
+  if (scope && scope !== "user" && scope !== "project") {
+    console.error(`Unknown --scope "${scope}" (expected user or project)`);
+    return null;
+  }
+  const base = scope === "user" ? join10(homedir6(), ".claude") : join10(gitToplevel(cwd) ?? cwd, ".claude");
+  return join10(base, "skills", "prim");
+}
+function packageVersion() {
+  let dir = __dirname;
+  while (dir !== dirname6(dir)) {
+    const p = resolve2(dir, "package.json");
+    if (existsSync11(p)) return JSON.parse(readFileSync9(p, "utf-8")).version;
+    dir = dirname6(dir);
+  }
+  return "0.0.0";
+}
+function pluginManifest() {
+  const manifest = { name: "prim", description: PLUGIN_DESCRIPTION, version: packageVersion() };
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+function removeDirIfEmpty(dir) {
+  if (existsSync11(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
+}
+function pluginPaths(dir) {
+  return {
+    manifestPath: join10(dir, ".claude-plugin", "plugin.json"),
+    skillPath: join10(dir, "SKILL.md")
+  };
+}
+function installClaudePlugin(cwd, opts) {
+  const dir = resolvePluginDir(cwd, opts.scope);
+  if (dir === null) return 1;
+  const { manifestPath, skillPath } = pluginPaths(dir);
+  const manifest = pluginManifest();
+  const skill = loadSkill();
+  const manifestCurrent = existsSync11(manifestPath) ? readFileSync9(manifestPath, "utf-8") : null;
+  const skillCurrent = existsSync11(skillPath) ? readFileSync9(skillPath, "utf-8") : null;
+  if (manifestCurrent === manifest && skillCurrent === skill) {
+    console.log("No changes \u2014 prim skill plugin already up to date.");
+    return 0;
+  }
+  if (opts.dryRun) {
+    console.log(`Would write plugin to ${dir} (.claude-plugin/plugin.json + SKILL.md)`);
+    return 0;
+  }
+  mkdirSync8(join10(dir, ".claude-plugin"), { recursive: true });
+  atomicWrite2(manifestPath, manifest);
+  atomicWrite2(skillPath, skill);
+  console.log(`Installed prim skill plugin at ${dir}`);
+  console.log("Restart Claude Code or run /reload-plugins to load it.");
+  if (opts.scope !== "user") {
+    console.log("Project-scope plugins load only when Claude Code launches from this directory.");
+  }
+  return 0;
+}
+function uninstallClaudePlugin(cwd, opts) {
+  const dir = resolvePluginDir(cwd, opts.scope);
+  if (dir === null) return 1;
+  const { manifestPath, skillPath } = pluginPaths(dir);
+  if (!existsSync11(manifestPath) && !existsSync11(skillPath)) {
+    console.log(`prim skill plugin not present at ${dir}`);
+    return 0;
+  }
+  rmSync3(manifestPath, { force: true });
+  rmSync3(skillPath, { force: true });
+  removeDirIfEmpty(join10(dir, ".claude-plugin"));
+  removeDirIfEmpty(dir);
+  console.log(`Removed prim skill plugin from ${dir}`);
+  return 0;
+}
+function statusClaudePlugin(cwd, opts) {
+  const dir = resolvePluginDir(cwd, opts.scope);
+  if (dir === null) return 1;
+  const { skillPath } = pluginPaths(dir);
+  const installed = existsSync11(skillPath);
+  if (opts.json) {
+    printJson({ installed, target: dir });
+    return installed ? 0 : 1;
+  }
+  if (installed) {
+    console.log(`prim skill plugin installed at ${dir}`);
+    return 0;
+  }
+  console.log(`No prim skill plugin at ${dir}`);
+  return 1;
+}
+
+// src/commands/skill.ts
+var __dirname2 = dirname7(fileURLToPath3(import.meta.url));
 var SKILL_BEGIN = "<!-- BEGIN PRIM SKILL v1 -->";
 var SKILL_END = "<!-- END PRIM SKILL v1 -->";
 var TARGET_CANDIDATES = [
@@ -3040,17 +3648,25 @@ var AGENT_TARGET = {
   codex: "AGENTS.md",
   hermes: ".hermes.md"
 };
+function userTargetFor(agent) {
+  if (agent === "claude") return join11(homedir7(), ".claude", "CLAUDE.md");
+  if (agent === "codex") return join11(homedir7(), ".codex", "AGENTS.md");
+  if (agent === "hermes") {
+    return join11(process.env.HERMES_HOME ?? join11(homedir7(), ".hermes"), ".hermes.md");
+  }
+  return null;
+}
 function loadSkill() {
-  let dir = __dirname;
-  while (dir !== dirname5(dir)) {
-    const p = resolve2(dir, "SKILL.md");
-    if (existsSync10(p)) return readFileSync8(p, "utf-8");
-    dir = dirname5(dir);
+  let dir = __dirname2;
+  while (dir !== dirname7(dir)) {
+    const p = resolve3(dir, "SKILL.md");
+    if (existsSync12(p)) return readFileSync10(p, "utf-8");
+    dir = dirname7(dir);
   }
   throw new Error("SKILL.md not found in package");
 }
 function detectTargets(cwd) {
-  return TARGET_CANDIDATES.filter((p) => existsSync10(resolve2(cwd, p)));
+  return TARGET_CANDIDATES.filter((p) => existsSync12(resolve3(cwd, p)));
 }
 function detectNewline(content) {
   return content.includes("\r\n") ? "\r\n" : "\n";
@@ -3088,24 +3704,39 @@ function atomicWrite2(target, content) {
   renameSync4(tmp, target);
 }
 function resolveTarget(cwd, opts) {
-  if (opts.target) return resolve2(cwd, opts.target);
+  if (opts.scope && opts.scope !== "user" && opts.scope !== "project") {
+    console.error(`Unknown --scope "${opts.scope}" (expected user or project)`);
+    return null;
+  }
+  if (opts.target) return resolve3(cwd, opts.target);
+  if (opts.scope === "user") {
+    if (!opts.agent) {
+      console.error("--scope user requires --agent (claude, codex, or hermes)");
+      return null;
+    }
+    const userTarget = userTargetFor(opts.agent);
+    if (userTarget) return userTarget;
+    console.error(`Unknown --agent "${opts.agent}" (expected claude, codex, or hermes)`);
+    return null;
+  }
   if (opts.agent) {
     const mapped = AGENT_TARGET[opts.agent];
-    if (typeof mapped === "string") return resolve2(cwd, mapped);
+    if (typeof mapped === "string") return resolve3(cwd, mapped);
     console.error(`Unknown --agent "${opts.agent}" (expected claude, codex, or hermes)`);
     return null;
   }
   const matches = detectTargets(cwd);
-  if (matches.length === 0) return resolve2(cwd, DEFAULT_TARGET);
-  if (matches.length === 1) return resolve2(cwd, matches[0]);
+  if (matches.length === 0) return resolve3(cwd, DEFAULT_TARGET);
+  if (matches.length === 1) return resolve3(cwd, matches[0]);
   console.error("Multiple rules files detected. Use --target to disambiguate:");
   for (const m of matches) console.error(`  ${m}`);
   return null;
 }
 function runInstall(cwd, opts) {
+  if (opts.agent === "claude" && !opts.target) return installClaudePlugin(cwd, opts);
   const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  const existing = existsSync10(target) ? readFileSync8(target, "utf-8") : "";
+  const existing = existsSync12(target) ? readFileSync10(target, "utf-8") : "";
   const eol = existing ? detectNewline(existing) : "\n";
   const block = composeBlock(loadSkill(), eol);
   const next = applyBlock(existing, block, eol);
@@ -3122,13 +3753,14 @@ function runInstall(cwd, opts) {
   return 0;
 }
 function runUninstall(cwd, opts) {
+  if (opts.agent === "claude" && !opts.target) return uninstallClaudePlugin(cwd, opts);
   const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  if (!existsSync10(target)) {
+  if (!existsSync12(target)) {
     console.log(`Skill block not present at ${target}`);
     return 0;
   }
-  const existing = readFileSync8(target, "utf-8");
+  const existing = readFileSync10(target, "utf-8");
   const next = removeBlock(existing);
   if (next === null) {
     console.log(`Skill block not present at ${target}`);
@@ -3139,12 +3771,13 @@ function runUninstall(cwd, opts) {
   return 0;
 }
 function runStatus(cwd, opts) {
+  if (opts.agent === "claude" && !opts.target) return statusClaudePlugin(cwd, opts);
   const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  const fileExists = existsSync10(target);
+  const fileExists = existsSync12(target);
   let installed = false;
   if (fileExists) {
-    const content = readFileSync8(target, "utf-8");
+    const content = readFileSync10(target, "utf-8");
     installed = content.includes(SKILL_BEGIN) && content.includes(SKILL_END);
   }
   if (opts.json) {
@@ -3164,7 +3797,7 @@ function runStatus(cwd, opts) {
 }
 function registerSkillCommands(program2) {
   const skill = program2.command("skill").description("Manage the prim skill in your project rules file");
-  skill.command("install").description("Install the prim skill block into your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--dry-run", "Print a unified diff without writing").action((opts) => {
+  skill.command("install").description("Install the prim skill block into your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--scope <scope>", "project (default, this repo) or user (machine-global \u2014 every repo)").option("--dry-run", "Print a unified diff without writing").action((opts) => {
     try {
       process.exit(runInstall(process.cwd(), opts));
     } catch (err) {
@@ -3172,27 +3805,27 @@ function registerSkillCommands(program2) {
       process.exit(2);
     }
   });
-  skill.command("uninstall").description("Remove the prim skill block from your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").action((opts) => {
+  skill.command("uninstall").description("Remove the prim skill block from your project rules file").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--scope <scope>", "project (default, this repo) or user (machine-global \u2014 every repo)").action((opts) => {
     process.exit(runUninstall(process.cwd(), opts));
   });
-  skill.command("status").description("Report whether the prim skill block is installed").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--json", "Output as JSON").action((opts) => {
+  skill.command("status").description("Report whether the prim skill block is installed").option("--target <path>", "Path to the rules file (overrides auto-detection)").option("--agent <agent>", "claude, codex, or hermes (selects the default rules file)").option("--scope <scope>", "project (default, this repo) or user (machine-global \u2014 every repo)").option("--json", "Output as JSON").action((opts) => {
     process.exit(runStatus(process.cwd(), opts));
   });
 }
 
 // src/commands/statusline.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname6, resolve as resolve3 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname8, resolve as resolve4 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 var STATUSLINE_NAME_CAP = 3;
 function readPackageVersion() {
   try {
-    const here = dirname6(fileURLToPath3(import.meta.url));
-    const candidates = [resolve3(here, "../../package.json"), resolve3(here, "../package.json")];
+    const here = dirname8(fileURLToPath4(import.meta.url));
+    const candidates = [resolve4(here, "../../package.json"), resolve4(here, "../package.json")];
     for (const path of candidates) {
       try {
-        const pkg2 = JSON.parse(readFileSync9(path, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync11(path, "utf-8"));
         if (pkg2.version) {
           return pkg2.version;
         }
@@ -3257,6 +3890,7 @@ var REVERSE_PROMPT_LINES = [
   "to focus on those goals?"
 ];
 var REVERSE_PROMPT = REVERSE_PROMPT_LINES.join(" ");
+var REVERSE_PROMPT_TEMPLATE = "We're interested in learning your current goals, as well as what you're not focusing on to achieve those goals. We found the following:\n\n$FOUND_GOALS\n\nHow do these look to you? Would you like to change these goals?";
 var CALLOUT_TITLE = "Your turn";
 var CALLOUT_INDENT = "  ";
 function ruledQuestion(lines) {
@@ -3343,6 +3977,7 @@ function welcomeJson(state) {
       welcomed: true,
       org: "seed",
       reversePrompt: REVERSE_PROMPT,
+      reversePromptTemplate: REVERSE_PROMPT_TEMPLATE,
       recent: state.recent
     };
   }
@@ -3359,8 +3994,8 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
 }
 
 // src/index.ts
-var __dirname2 = dirname7(fileURLToPath4(import.meta.url));
-var pkg = JSON.parse(readFileSync10(resolve4(__dirname2, "../package.json"), "utf-8"));
+var __dirname3 = dirname9(fileURLToPath5(import.meta.url));
+var pkg = JSON.parse(readFileSync12(resolve5(__dirname3, "../package.json"), "utf-8"));
 updateNotifier({ pkg }).notify();
 var program = new Command();
 program.name("prim").description("CLI for Primitive's decision graph").version(pkg.version).option("-y, --yes", "auto-confirm prompts").option(
@@ -3369,6 +4004,7 @@ program.name("prim").description("CLI for Primitive's decision graph").version(p
 );
 registerAuthCommands(program);
 registerHooksCommands(program);
+registerActivationCommands(program);
 registerSkillCommands(program);
 registerMovesCommands(program);
 registerSessionCommands(program);