@primitive.ai/prim 0.1.0-alpha.35 → 0.1.0-alpha.37

package/README.md

@@ -1,13 +1,19 @@
 # @primitive.ai/prim
 
 The official CLI for [Primitive](https://getprimitive.ai)'s **decision graph**. It
-passively captures the decisions your team makes while coding, gates edits that
-conflict with prior team decisions, and reports team presence — from the command
-line and via session + git hooks.
+passively captures the decisions your team makes while coding and reports team
+presence — from the command line and via session + git hooks.
 
 > [!WARNING]
 > This project is in **alpha**. Commands and APIs may change between releases.
 
+> [!NOTE]
+> **Conflict Gates** check each edit against the decision graph and surface any
+> load-bearing decision it conflicts with; their **Enforcement** tier blocks or pauses
+> a conflicting edit until you reconcile and retry. Conflict Gates are **not currently
+> enabled** — automatic decision capture runs regardless. To enable them for your team,
+> contact **support@getprimitive.ai**.
+
 ## Installation
 
 Requires Node.js 20+.
@@ -37,7 +43,7 @@ Or run the steps individually:
 # 1. Authenticate via browser (WorkOS OAuth)
 prim auth login
 
-# 2. Wire the session hooks (decision capture + conflict gate + presence)
+# 2. Wire the session hooks (decision capture + presence)
 prim claude install        # or: prim codex install / prim hermes install
 
 # 3. Start the companion daemon (latency + team presence)
@@ -94,7 +100,7 @@ prim auth status             # Check authentication status
 ### Session integration
 
 Wires the agent's session hooks so the decisions you make are captured into the
-graph, conflicting edits are gated, and presence is reported. Each hook
+graph, and presence is reported. Each hook
 self-resolves the CLI at run time (PATH, then a local install, then
 `npx --yes @latest`), so it keeps working with no global install.
 
@@ -147,9 +153,12 @@ would create a cycle (exit 2); an unresolved id exits 4.
 ### Reconcile
 
 ```bash
-prim reconcile <id>    # Mint a single-use bypass for a decision a gate flagged
+prim reconcile <id>    # Mint a single-use bypass for a decision Conflict Gates flagged
 ```
 
+Part of Conflict Gates **Enforcement**, which is not currently enabled (see the note
+at the top). Contact support@getprimitive.ai to enable it.
+
 ### Hooks
 
 ```bash

package/SKILL.md

@@ -9,9 +9,9 @@ description: Use the prim CLI for Primitive's decision graph — passive decisio
 
 ## Mental model
 
-As your team codes, prim passively captures the **decisions** you make -- which library, which pattern, which config value -- into a queryable graph, and links them: a decision can depend on earlier decisions (auto-linked from shared files, or related by hand — see *Relate decisions*) and reference the files it touched. When a later change conflicts with a load-bearing prior decision, prim **gates** the edit and surfaces the decision for review.
+As your team codes, prim passively captures the **decisions** you make -- which library, which pattern, which config value -- into a queryable graph, and links them: a decision can depend on earlier decisions (auto-linked from shared files, or related by hand — see *Relate decisions*) and reference the files it touched. **Conflict Gates** can check a later change against that graph and surface any load-bearing decision it conflicts with; with **Enforcement**, prim blocks the edit until you reconcile the decision and retry. Conflict Gates are **not currently enabled** — capture runs regardless. To enable them for your team, contact support@getprimitive.ai.
 
-You never invoke capture. It runs automatically through the session hooks installed by `npx --yes @primitive.ai/prim claude install` (Claude Code), `npx --yes @primitive.ai/prim codex install` (Codex), or `npx --yes @primitive.ai/prim hermes install` (Hermes). Your job is to **respond** to the gate, **read** the graph before load-bearing edits, and **answer** the occasional rationale confirmation.
+You never invoke capture. It runs automatically through the session hooks installed by `npx --yes @primitive.ai/prim claude install` (Claude Code), `npx --yes @primitive.ai/prim codex install` (Codex), or `npx --yes @primitive.ai/prim hermes install` (Hermes). Your job is to **read** the graph before load-bearing edits and **answer** the occasional rationale confirmation. (Responding to Conflict Gates applies only once Enforcement is enabled — see below.)
 
 ## Auth
 
@@ -29,17 +29,19 @@ The CLI auto-refreshes a still-valid session from the stored refresh token (proa
 
 1. Every command accepts `--help`. When unsure of flags, run `npx --yes @primitive.ai/prim <cmd> --help` rather than guessing.
 2. The CLI prints API errors as one-liners to stderr and exits non-zero. Treat any non-zero exit as actionable. If auth-related, re-check `auth status`.
-3. `<idOrShortId>` arguments accept either a full decision ID or the short ID shown in feeds and gate reasons.
+3. `<idOrShortId>` arguments accept either a full decision ID or the short ID shown in feeds (and gate reasons, when Conflict Gates are enabled).
 
-## Heed the conflict gate
+## Conflict Gates & Enforcement (not currently enabled)
 
-Before an edit (Claude Code: Edit/Write/MultiEdit; Codex: apply_patch; Hermes: write_file/patch) a PreToolUse hook scores the target file against the graph:
+**Conflict Gates** check each edit against the decision graph before it lands and surface any load-bearing decision it conflicts with. Their **Enforcement** tier goes further -- a conflicting edit is blocked (or paused for confirmation) until you reconcile the decision and retry. **Conflict Gates are not currently enabled** — automatic decision capture (above) runs regardless. To enable Conflict Gates and Enforcement for your team, contact support@getprimitive.ai.
+
+When Enforcement is enabled, before an edit (Claude Code: Edit/Write/MultiEdit; Codex: apply_patch; Hermes: write_file/patch) a PreToolUse hook scores the target file against the graph:
 
 - **deny** -- the edit is blocked: it conflicts with a load-bearing prior decision. Don't fight it. Read the reason line; it names the decision id. If you genuinely intend to override that decision, run `npx --yes @primitive.ai/prim reconcile dec_<shortId>`, then retry the edit once. Otherwise choose an approach that respects the decision.
 - **warn / additional context** -- the edit proceeds, but a relevant prior decision is surfaced. Read it. On Codex a would-be `ask` is delivered as allow-plus-context (Codex can't pause mid-tool), so that context is your only signal -- read it before continuing. Hermes has no soft-confirm tier, so a would-be `ask` arrives as a **deny** carrying the same reconcile directive: reconcile and retry, or set `PRIM_HOOK_MODE=warn` to downgrade it to context-only.
 - **"decision check skipped / not verified" or "... partial / truncated"** -- the check could not fully run. Treat constraints as UNKNOWN, not clear; never read silence as approval.
 
-The gate fail-opens on its *own* infrastructure errors (no daemon, network blip, org-unbound token) -- a setup problem never blocks your edit. That is exactly why an "unavailable" note matters: it is the honest signal that the check, not your edit, is what failed.
+When enabled, the gate fail-opens on its *own* infrastructure errors (no daemon, network blip, org-unbound token) -- a setup problem would not block your edit. That is why an "unavailable" note would matter: it is the honest signal that the check, not your edit, is what failed.
 
 ## Read the graph before large or load-bearing edits
 
@@ -49,6 +51,8 @@ The gate fail-opens on its *own* infrastructure errors (no daemon, network blip,
 
 ## Reconcile and the verdict footer
 
+Reconcile and the verdict footer are part of Conflict Gates **Enforcement**, which is **not currently enabled** (contact support@getprimitive.ai to turn it on); the `reconcile` command stays available regardless. When Enforcement is on:
+
 `npx --yes @primitive.ai/prim reconcile <idOrShortId>` mints a single-use bypass for the named decision -- it prints `[prim] reconcile bypass issued for dec_<short> (expires in ...)` to STDERR, with the bypass JSON on STDOUT. Your *next* edit to the governed file then goes through, and on that edit prim prints a verdict footer to STDERR -- confirmation the override was recorded, not silently dropped:
 
 ```
@@ -75,7 +79,7 @@ Capture is automatic for the decisions you *make while coding*. When the user in
 npx --yes @primitive.ai/prim decisions create --intent "Adopt prosemirror-collab over Yjs" --area data --rationale "Server-authoritative ordering" --alternatives "Yjs,Automerge"
 ```
 
-Only `--intent` is required. Optional: `--kind` (change|exploration|task_execution|unclear, default change), `--rationale`, `--area`, `--decided`, `--alternatives` (comma-separated), `--confidence` (high|medium|low, default high), `--reversibility` (high|low, default high), and `--files` (comma-separated repo-relative paths the decision governs — pass these to make the conflict gate fire on later edits to those files, same path form as `decisions check`). STDOUT is the created identity `{ decisionId, shortId, createdAt }`; STDERR prints `[prim] created dec_<short>.` — pass that `dec_<short>` straight into `decisions show` / `cascade` / `confirm`. Author on the user's behalf only when they ask for a decision to be recorded; don't narrate your own routine edits into the graph (the hooks already do that).
+Only `--intent` is required. Optional: `--kind` (change|exploration|task_execution|unclear, default change), `--rationale`, `--area`, `--decided`, `--alternatives` (comma-separated), `--confidence` (high|medium|low, default high), `--reversibility` (high|low, default high), and `--files` (comma-separated repo-relative paths the decision governs — these are the files Conflict Gates would check on later edits, same path form as `decisions check`; Conflict Gates are not currently enabled). STDOUT is the created identity `{ decisionId, shortId, createdAt }`; STDERR prints `[prim] created dec_<short>.` — pass that `dec_<short>` straight into `decisions show` / `cascade` / `confirm`. Author on the user's behalf only when they ask for a decision to be recorded; don't narrate your own routine edits into the graph (the hooks already do that).
 
 ## Relate decisions (link / unlink)
 
@@ -116,14 +120,14 @@ npx --yes @primitive.ai/prim hooks uninstall
 
 Under `CI=1` (or with `--non-interactive`), `hooks install` fails fast in a Husky repo unless `--yes` or `--target` is set; the error names both escapes. `hooks uninstall` only removes the `.git/hooks` copies — if a hook was installed into `.husky/`, remove the prim block from that file manually. To suppress the hooks for one commit, use `git commit --no-verify`.
 
-These git hooks are separate from the **session hooks** (`claude install` / `codex install` / `hermes install`) that drive in-session capture and the conflict gate.
+These git hooks are separate from the **session hooks** (`claude install` / `codex install` / `hermes install`) that drive in-session capture (and Conflict Gates, when enabled).
 
 ## Output formats
 
 The CLI keeps STDOUT machine-readable and STDERR human-readable. The `decisions` and `reconcile` commands **always** emit a single JSON document on STDOUT — no flag needed; pipe straight to `jq`. The `decisions` commands have **no** `--json` flag and reject one; `reconcile` accepts a reserved no-op `--json`. `auth status` and `skill status` default to human-readable STDOUT and take `--json` to switch to JSON.
 
 - **STDOUT is machine-readable** — JSON (one document per invocation). `decisions` reads project lean shapes, not raw rows.
-- **STDERR is human-readable** — a verdict-first line, plus the gate/verdict-footer/presence notes.
+- **STDERR is human-readable** — a verdict-first line, plus presence notes (and, when Conflict Gates are enabled, the gate/verdict-footer notes).
 - **Exit code is authoritative** where it carries meaning — `auth status` exits 0 when authenticated; `decisions show`/`cascade`/`confirm` exit non-zero (e.g. 4 not-found) on a missing or unauthorized id.
 
 Examples:
@@ -135,12 +139,12 @@ Examples:
 
 ## Pitfalls
 
-- **An "unavailable" / "not verified" gate or check is not an all-clear.** Treat constraints as UNKNOWN and proceed deliberately; never read the silence as approval.
-- **A `deny` means a real prior decision conflicts.** Reconcile only when you genuinely intend to override it; otherwise pick an approach that respects it.
+- **An "unavailable" / "not verified" decision check is not an all-clear.** Treat constraints as UNKNOWN and proceed deliberately; never read the silence as approval — the same holds for Conflict Gates once enabled.
+- **When Enforcement is enabled, a `deny` means a real prior decision conflicts.** Reconcile only when you genuinely intend to override it; otherwise pick an approach that respects it.
 - **Reconcile bypasses are single-use and short-lived.** One bypass clears your *next* edit to the governed file; it is not a standing override.
 - **Capture of your coding activity is automatic, never manual.** If decisions aren't showing up, check that the session hooks are installed (`claude status` / `codex status` / `hermes status`) and the daemon is running — don't try to inject moves by hand. (Deliberately *authoring* a decision the user asks you to record is a separate, supported path — `decisions create`, above.)
 - **Don't fabricate rationale on a confirmation.** If you don't know why a decision was made, say so rather than guessing.
 
 ## After each task
 
-If the conflict gate denied or warned you, report which decision(s) it named and whether you reconciled. If you read the graph before a load-bearing change, note what you found so the user can verify in the dashboard.
+If Conflict Gates are enabled and one denied or warned you, report which decision(s) it named and whether you reconciled. If you read the graph before a load-bearing change, note what you found so the user can verify in the dashboard.

package/dist/chunk-HSZPTVKU.js

@@ -0,0 +1,113 @@
+// src/lib/bin-cache.ts
+import { chmodSync, mkdirSync, renameSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/lib/bin-path.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, isAbsolute, join } from "path";
+import { fileURLToPath } from "url";
+var PKG_NAME = "@primitive.ai/prim";
+var ROOT_WALK_LIMIT = 6;
+var NPX_FALLBACK = `npx --yes -p ${PKG_NAME}@latest`;
+var BIN_CACHE_DIR_SH = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
+var BIN_CACHE_TTL_MIN_DEFAULT = 1440;
+var resolvedRoot;
+function locateRoot() {
+  if (resolvedRoot !== void 0) {
+    return resolvedRoot;
+  }
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
+    const manifestPath = join(dir, "package.json");
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+        if (manifest.name === PKG_NAME && manifest.bin) {
+          resolvedRoot = { dir, bin: manifest.bin };
+          return resolvedRoot;
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  resolvedRoot = null;
+  return resolvedRoot;
+}
+function binFile(bin) {
+  const root = locateRoot();
+  const rel = root?.bin[bin];
+  if (!root || !rel) {
+    return null;
+  }
+  return isAbsolute(rel) ? rel : join(root.dir, rel);
+}
+function hookShimCommand(bin, args = "", opts = {}) {
+  const invoke = (cmd) => args ? `${cmd} ${args}` : cmd;
+  const ladder = `if command -v ${bin} >/dev/null 2>&1; then ${invoke(bin)}; elif [ -f "./node_modules/.bin/${bin}" ]; then ${invoke(`./node_modules/.bin/${bin}`)}; else ${invoke(`${NPX_FALLBACK} ${bin}`)}; fi`;
+  if (opts.cacheRead === false) {
+    return ladder;
+  }
+  const execArgs = args ? ` ${args}` : "";
+  const cacheBranch = `d="${BIN_CACHE_DIR_SH}"; if [ "\${PRIM_BIN_CACHE:-1}" != "0" ] && [ -f "$d/${bin}" ] && [ -f "$d/node" ] && [ -n "$(find "$d/${bin}" -mmin "-\${PRIM_BIN_CACHE_TTL_MIN:-${BIN_CACHE_TTL_MIN_DEFAULT}}" 2>/dev/null)" ]; then n=$(cat "$d/node"); p=$(cat "$d/${bin}"); if [ -x "$n" ] && [ -f "$p" ]; then export PRIM_BIN_CACHE_HIT=1; exec "$n" "$p"${execArgs}; fi; fi; `;
+  return cacheBranch + ladder;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; export npm_config_fetch_retries=2 npm_config_fetch_retry_mintimeout=10000 npm_config_fetch_retry_maxtimeout=10000 npm_config_fetch_timeout=60000; printf '%s' "$payload" | { ${hookShimCommand(bin, args, { cacheRead: false })}; }; } </dev/null >/dev/null 2>&1 &`;
+}
+function commandMatchesBin(command, bin) {
+  if (!command) {
+    return false;
+  }
+  const c = command.trim();
+  if (c === bin || c.startsWith(`${bin} `)) {
+    return true;
+  }
+  return c.includes(`command -v ${bin} `);
+}
+
+// src/lib/bin-cache.ts
+var CACHED_BINS = ["prim", "prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+function binCacheDir() {
+  const base = process.env.XDG_CACHE_HOME || join2(homedir(), ".cache");
+  return join2(base, "prim", "bin");
+}
+function writeAtomic(path, content) {
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, content, { mode: 384 });
+  renameSync(tmp, path);
+}
+function warmBinCache() {
+  try {
+    if (process.env.PRIM_BIN_CACHE_HIT) {
+      return;
+    }
+    if (process.env.PRIM_BIN_CACHE === "0") {
+      return;
+    }
+    const dir = binCacheDir();
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+    writeAtomic(join2(dir, "node"), process.execPath);
+    for (const bin of CACHED_BINS) {
+      const file = binFile(bin);
+      if (file) {
+        writeAtomic(join2(dir, bin), file);
+      }
+    }
+  } catch {
+  }
+}
+
+export {
+  binFile,
+  hookShimCommand,
+  detachedHookShimCommand,
+  commandMatchesBin,
+  warmBinCache
+};

package/dist/hooks/post-tool-use.js

@@ -12,6 +12,9 @@ import {
 import {
   isRepoActiveForCapture
 } from "../chunk-LUPD2JSH.js";
+import {
+  warmBinCache
+} from "../chunk-HSZPTVKU.js";
 import {
   getClient
 } from "../chunk-26VA3ADF.js";
@@ -100,6 +103,7 @@ async function ingestMove(move) {
   );
 }
 async function main() {
+  warmBinCache();
   const agent = parseAgent(process.argv);
   let raw;
   try {

package/dist/hooks/pre-tool-use.js

@@ -2,6 +2,9 @@
 import {
   isRepoActiveForCapture
 } from "../chunk-LUPD2JSH.js";
+import {
+  warmBinCache
+} from "../chunk-HSZPTVKU.js";
 import {
   getClient,
   getSiteUrl
@@ -262,6 +265,7 @@ async function checkOneFile(file) {
   );
 }
 async function main() {
+  warmBinCache();
   let raw;
   try {
     raw = await readStdin();

package/dist/hooks/prim-hook.js

@@ -13,6 +13,9 @@ import {
 import {
   isRepoActiveForCapture
 } from "../chunk-LUPD2JSH.js";
+import {
+  warmBinCache
+} from "../chunk-HSZPTVKU.js";
 import "../chunk-26VA3ADF.js";
 import {
   normalizeEnvelope,
@@ -41,6 +44,7 @@ function spawnBackgroundFlush() {
   }).unref();
 }
 try {
+  warmBinCache();
   const agent = parseAgent(process.argv);
   const raw = readFileSync(0, "utf-8");
   const parsed = normalizeEnvelope(JSON.parse(raw), agent);

package/dist/hooks/session-start.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  warmBinCache
+} from "../chunk-HSZPTVKU.js";
 import {
   getSiteUrl
 } from "../chunk-26VA3ADF.js";
@@ -45,6 +48,7 @@ function emit(additionalContext) {
 `);
 }
 async function main() {
+  warmBinCache();
   const agent = parseAgent(process.argv);
   let raw;
   try {

package/dist/index.js

@@ -25,6 +25,13 @@ import {
   gitToplevel,
   setRepoActive
 } from "./chunk-LUPD2JSH.js";
+import {
+  binFile,
+  commandMatchesBin,
+  detachedHookShimCommand,
+  hookShimCommand,
+  warmBinCache
+} from "./chunk-HSZPTVKU.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -42,9 +49,9 @@ import {
 } from "./chunk-UTKQTZHL.js";
 
 // src/index.ts
-import { readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname9, resolve as resolve5 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname8, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
 
@@ -529,78 +536,16 @@ async function exchangeCode(siteUrl, code, codeVerifier, redirectUri) {
 // src/commands/claude-install.ts
 import {
   closeSync,
-  existsSync as existsSync3,
+  existsSync as existsSync2,
   fsyncSync,
   mkdirSync as mkdirSync2,
   openSync,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync2,
   renameSync,
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname3, join as join2 } from "path";
-
-// src/lib/bin-path.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, join } from "path";
-import { fileURLToPath } from "url";
-var PKG_NAME = "@primitive.ai/prim";
-var ROOT_WALK_LIMIT = 6;
-var NPX_FALLBACK = `npx --yes -p ${PKG_NAME}@latest`;
-var resolvedRoot;
-function locateRoot() {
-  if (resolvedRoot !== void 0) {
-    return resolvedRoot;
-  }
-  let dir = dirname2(fileURLToPath(import.meta.url));
-  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
-    const manifestPath = join(dir, "package.json");
-    if (existsSync2(manifestPath)) {
-      try {
-        const manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
-        if (manifest.name === PKG_NAME && manifest.bin) {
-          resolvedRoot = { dir, bin: manifest.bin };
-          return resolvedRoot;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
-  }
-  resolvedRoot = null;
-  return resolvedRoot;
-}
-function binFile(bin) {
-  const root = locateRoot();
-  const rel = root?.bin[bin];
-  if (!root || !rel) {
-    return null;
-  }
-  return isAbsolute(rel) ? rel : join(root.dir, rel);
-}
-function hookShimCommand(bin, args = "") {
-  const invoke = (cmd) => args ? `${cmd} ${args}` : cmd;
-  return `if command -v ${bin} >/dev/null 2>&1; then ${invoke(bin)}; elif [ -f "./node_modules/.bin/${bin}" ]; then ${invoke(`./node_modules/.bin/${bin}`)}; else ${invoke(`${NPX_FALLBACK} ${bin}`)}; fi`;
-}
-function detachedHookShimCommand(bin, args = "") {
-  return `payload=$(cat); { trap '' HUP; export npm_config_fetch_retries=2 npm_config_fetch_retry_mintimeout=10000 npm_config_fetch_retry_maxtimeout=10000 npm_config_fetch_timeout=60000; printf '%s' "$payload" | { ${hookShimCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
-}
-function commandMatchesBin(command, bin) {
-  if (!command) {
-    return false;
-  }
-  const c = command.trim();
-  if (c === bin || c.startsWith(`${bin} `)) {
-    return true;
-  }
-  return c.includes(`command -v ${bin} `);
-}
-
-// src/commands/claude-install.ts
+import { dirname as dirname2, join } from "path";
 var CAPTURE_BIN = "prim-hook";
 var GATE_BIN = "prim-pre-tool-use";
 var POST_TOOL_USE_BIN = "prim-post-tool-use";
@@ -618,11 +563,11 @@ var PRIM_BINS = [
   SESSION_END_BIN
 ];
 var JSON_INDENT = 2;
-var USER_SCOPE_PATH = join2(homedir(), ".claude", "settings.json");
+var USER_SCOPE_PATH = join(homedir(), ".claude", "settings.json");
 function projectRoot() {
   return gitToplevel() ?? process.cwd();
 }
-var projectScopePath = () => join2(projectRoot(), ".claude", "settings.json");
+var projectScopePath = () => join(projectRoot(), ".claude", "settings.json");
 var CAPTURE_EVENTS = [
   "SessionStart",
   "UserPromptSubmit",
@@ -632,8 +577,8 @@ var CAPTURE_EVENTS = [
   "SessionEnd",
   "SubagentStop"
 ];
-function makeRegistration(event, matcher, bin, args = "") {
-  return { event, matcher, bin, command: hookShimCommand(bin, args) };
+function makeRegistration(event, matcher, bin, args = "", opts = {}) {
+  return { event, matcher, bin, command: hookShimCommand(bin, args, opts) };
 }
 function makeDetachedRegistration(event, matcher, bin, args = "") {
   return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
@@ -644,7 +589,9 @@ var REGISTRATIONS = [
   ),
   makeRegistration("PreToolUse", "Edit|Write|MultiEdit", GATE_BIN),
   makeRegistration("PostToolUse", "Edit|Write|MultiEdit", POST_TOOL_USE_BIN),
-  makeRegistration("SessionStart", "*", SESSION_START_BIN),
+  // Bare ladder (no branch-0): SessionStart must re-resolve @latest each session
+  // to refresh the bin cache the other hooks read. See lib/bin-cache.ts.
+  makeRegistration("SessionStart", "*", SESSION_START_BIN, "", { cacheRead: false }),
   makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
 ];
 var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
@@ -662,10 +609,10 @@ function settingsPathFor(scope) {
   return scope === "user" ? USER_SCOPE_PATH : projectScopePath();
 }
 function readSettings(path) {
-  if (!existsSync3(path)) {
+  if (!existsSync2(path)) {
     return {};
   }
-  const raw = readFileSync3(path, "utf-8");
+  const raw = readFileSync2(path, "utf-8");
   try {
     return JSON.parse(raw);
   } catch (err) {
@@ -806,8 +753,8 @@ function isGateInstalled(settings) {
   return (settings.hooks?.PreToolUse ?? []).some((e) => entryHasCommand(e, GATE_BIN));
 }
 function atomicWrite(path, content) {
-  const dir = dirname3(path);
-  if (!existsSync3(dir)) {
+  const dir = dirname2(path);
+  if (!existsSync2(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
   const tmp = `${path}.tmp.${String(Date.now())}`;
@@ -955,7 +902,7 @@ ${line("project", result.project)}`);
 
 // src/commands/codex-install.ts
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 var CAPTURE_BIN2 = "prim-hook";
 var GATE_BIN2 = "prim-pre-tool-use";
 var POST_TOOL_USE_BIN2 = "prim-post-tool-use";
@@ -975,10 +922,12 @@ var CODEX_REGISTRATIONS = [
   ...CODEX_CAPTURE_EVENTS.map((event) => makeRegistration(event, "*", CAPTURE_BIN2, CODEX_ARGS)),
   makeRegistration("PreToolUse", "apply_patch", GATE_BIN2, CODEX_ARGS),
   makeRegistration("PostToolUse", "apply_patch", POST_TOOL_USE_BIN2, CODEX_ARGS),
-  makeRegistration("SessionStart", "*", SESSION_START_BIN2, CODEX_ARGS)
+  // Bare ladder (no branch-0): SessionStart re-resolves @latest each session to
+  // refresh the bin cache the other hooks read. See lib/bin-cache.ts.
+  makeRegistration("SessionStart", "*", SESSION_START_BIN2, CODEX_ARGS, { cacheRead: false })
 ];
-var USER_SCOPE_PATH2 = join3(homedir2(), ".codex", "hooks.json");
-var projectScopePath2 = () => join3(projectRoot(), ".codex", "hooks.json");
+var USER_SCOPE_PATH2 = join2(homedir2(), ".codex", "hooks.json");
+var projectScopePath2 = () => join2(projectRoot(), ".codex", "hooks.json");
 function settingsPathFor2(scope) {
   return scope === "user" ? USER_SCOPE_PATH2 : projectScopePath2();
 }
@@ -1102,9 +1051,9 @@ ${line("project", result.project)}`);
 
 // src/commands/daemon.ts
 import { spawn } from "child_process";
-import { closeSync as closeSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, unlinkSync } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync3, unlinkSync } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 
 // src/lib/presence.ts
 function formatTeammates(names, cap) {
@@ -1122,10 +1071,10 @@ function formatTeammates(names, cap) {
 
 // src/commands/daemon.ts
 var DAEMON_BIN = "prim-daemon-server";
-var CONFIG_DIR = join4(homedir3(), ".config", "prim");
-var PID_PATH = join4(CONFIG_DIR, "daemon.pid");
-var SOCK_PATH = join4(CONFIG_DIR, "sock");
-var LOG_PATH = join4(CONFIG_DIR, "daemon.log");
+var CONFIG_DIR = join3(homedir3(), ".config", "prim");
+var PID_PATH = join3(CONFIG_DIR, "daemon.pid");
+var SOCK_PATH = join3(CONFIG_DIR, "sock");
+var LOG_PATH = join3(CONFIG_DIR, "daemon.log");
 var CONFIG_DIR_MODE = 448;
 var LOG_FILE_MODE = 384;
 var STOP_TIMEOUT_MS = 5e3;
@@ -1138,10 +1087,10 @@ var EXIT_OK2 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
 function readPidfile() {
-  if (!existsSync4(PID_PATH)) {
+  if (!existsSync3(PID_PATH)) {
     return null;
   }
-  const raw = readFileSync4(PID_PATH, "utf-8").trim();
+  const raw = readFileSync3(PID_PATH, "utf-8").trim();
   const pid = Number(raw);
   if (!Number.isInteger(pid) || pid <= 0) {
     return null;
@@ -1177,10 +1126,10 @@ function spawnDaemon(options) {
   return file ? spawn(process.execPath, [file], options) : spawn(DAEMON_BIN, [], options);
 }
 function openDaemonLog(configDir = CONFIG_DIR) {
-  if (!existsSync4(configDir)) {
+  if (!existsSync3(configDir)) {
     mkdirSync3(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
   }
-  return openSync2(join4(configDir, "daemon.log"), "a", LOG_FILE_MODE);
+  return openSync2(join3(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
 async function waitForReady() {
   const deadline = Date.now() + READY_TIMEOUT_MS;
@@ -2105,7 +2054,7 @@ function registerDecisionsCommands(program2) {
     "Functional area (auth, data, infra, ui, api, billing, mobile, docs, testing)"
   ).option("--decided <items>", "Comma-separated option(s) chosen").option("--alternatives <items>", "Comma-separated options considered but rejected").option("--confidence <level>", "high | medium | low (default high)").option("--reversibility <level>", "high | low (default high)").option(
     "--files <paths>",
-    "Comma-separated repo-relative paths this decision governs (gates edits to them)"
+    "Comma-separated repo-relative paths this decision governs (the files Conflict Gates would check \u2014 not currently enabled)"
   ).action(async (opts) => {
     const request = {
       intent: opts.intent,
@@ -2171,7 +2120,7 @@ function registerDecisionsCommands(program2) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 var DAEMON_PROBE_TIMEOUT_MS = 500;
 var CONNECTIVITY_TIMEOUT_MS = 3e3;
 var MS_PER_SECOND = 1e3;
@@ -2189,7 +2138,7 @@ function checkAuth() {
     return { name: "auth", status: "fail", detail: "no token \u2014 run `prim auth login`" };
   }
   const expiresAt = getTokenExpiresAt();
-  const hasRefresh = existsSync5(REFRESH_TOKEN_PATH);
+  const hasRefresh = existsSync4(REFRESH_TOKEN_PATH);
   if (expiresAt !== void 0 && Date.now() >= expiresAt) {
     return hasRefresh ? { name: "auth", status: "warn", detail: "access token expired (refresh available)" } : {
       name: "auth",
@@ -2289,17 +2238,17 @@ function registerDoctorCommands(program2) {
 import {
   chmodSync,
   closeSync as closeSync3,
-  existsSync as existsSync6,
+  existsSync as existsSync5,
   fsyncSync as fsyncSync2,
   mkdirSync as mkdirSync4,
   openSync as openSync3,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync4,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { Document, parseDocument, stringify } from "yaml";
 var CAPTURE_BIN3 = "prim-hook";
 var GATE_BIN3 = "prim-pre-tool-use";
@@ -2318,13 +2267,13 @@ var PRIM_BINS3 = [
   SESSION_END_BIN2
 ];
 function hermesHome() {
-  return process.env.HERMES_HOME ?? join5(homedir4(), ".hermes");
+  return process.env.HERMES_HOME ?? join4(homedir4(), ".hermes");
 }
 function configPath() {
-  return join5(hermesHome(), "config.yaml");
+  return join4(hermesHome(), "config.yaml");
 }
 function shimPath() {
-  return join5(hermesHome(), "agent-hooks", "prim-shim.sh");
+  return join4(hermesHome(), "agent-hooks", "prim-shim.sh");
 }
 var SHIM_SCRIPT = `#!/bin/sh
 # prim Hermes hook shim \u2014 managed by \`prim hermes install\`. Hermes runs hooks
@@ -2413,10 +2362,10 @@ function isCaptureInstalled(hooks) {
   );
 }
 function readDoc(path) {
-  if (!existsSync6(path)) {
+  if (!existsSync5(path)) {
     return new Document();
   }
-  const raw = readFileSync5(path, "utf-8");
+  const raw = readFileSync4(path, "utf-8");
   return raw.trim().length === 0 ? new Document() : parseDocument(raw);
 }
 function readHooks(doc) {
@@ -2488,8 +2437,8 @@ function setAutoAccept(raw) {
 `;
 }
 function atomicWriteFile(path, content) {
-  const dir = dirname4(path);
-  if (!existsSync6(dir)) {
+  const dir = dirname3(path);
+  if (!existsSync5(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
   const tmp = `${path}.tmp.${String(process.pid)}`;
@@ -2513,8 +2462,8 @@ function assertMergeValid(before, after) {
 }
 function writeShim() {
   const path = shimPath();
-  const dir = dirname4(path);
-  if (!existsSync6(dir)) {
+  const dir = dirname3(path);
+  if (!existsSync5(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
   writeFileSync3(path, SHIM_SCRIPT, "utf-8");
@@ -2534,7 +2483,7 @@ function readHooksFromRaw(raw) {
 }
 function performInstall3(opts) {
   const path = configPath();
-  const raw = existsSync6(path) ? readFileSync5(path, "utf-8") : "";
+  const raw = existsSync5(path) ? readFileSync4(path, "utf-8") : "";
   const existing = readHooksFromRaw(raw);
   const desired = applyInstall3(existing, opts.force);
   let next = raw;
@@ -2560,11 +2509,11 @@ function performInstall3(opts) {
 }
 function performUninstall3() {
   const path = configPath();
-  if (!existsSync6(path)) {
+  if (!existsSync5(path)) {
     removeShim();
     return { path, gate: false, capture: false, autoAccept: false, changed: false };
   }
-  const raw = readFileSync5(path, "utf-8");
+  const raw = readFileSync4(path, "utf-8");
   const existing = readHooksFromRaw(raw);
   const remaining = applyUninstall3(existing);
   const next = JSON.stringify(existing) === JSON.stringify(remaining) ? raw : spliceHooks(raw, remaining);
@@ -2584,7 +2533,7 @@ function performUninstall3() {
 }
 function performStatus3() {
   const path = configPath();
-  const hooks = existsSync6(path) ? readHooks(readDoc(path)) : {};
+  const hooks = existsSync5(path) ? readHooks(readDoc(path)) : {};
   return { path, gate: isGateInstalled3(hooks), capture: isCaptureInstalled(hooks) };
 }
 var TRUST_NOTICE2 = "[prim] Hermes requires hook consent: it prompts once per (event, command) on a TTY and records approval in ~/.hermes/shell-hooks-allowlist.json. To pre-approve non-interactively, re-run with --auto-accept (sets hooks_auto_accept: true), export HERMES_ACCEPT_HOOKS=1, or start Hermes with `hermes --accept-hooks chat`. Until approved, the hooks will not fire.";
@@ -2629,9 +2578,9 @@ function registerHermesCommands(program2) {
 
 // src/commands/hooks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname5, join as join6, resolve } from "path";
+import { dirname as dirname4, join as join5, resolve } from "path";
 import { Option } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
@@ -2680,15 +2629,15 @@ ${gatedShim(spec.binName)}
 ${end}`;
 }
 function mergePrimBlock(hookPath, block, binName) {
-  if (existsSync7(hookPath)) {
-    const existing = readFileSync6(hookPath, "utf-8");
+  if (existsSync6(hookPath)) {
+    const existing = readFileSync5(hookPath, "utf-8");
     if (containsPrimHook(existing, binName)) return false;
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
     writeFileSync4(hookPath, `${existing}${separator}${block}
 `, { mode: 493 });
     return true;
   }
-  mkdirSync5(dirname5(hookPath), { recursive: true });
+  mkdirSync5(dirname4(hookPath), { recursive: true });
   writeFileSync4(hookPath, `#!/bin/sh
 # ${PRIM_CREATED_MARK}
 
@@ -2705,13 +2654,13 @@ function getGitRoot() {
 }
 function detectHusky(gitRoot) {
   const huskyDir = resolve(gitRoot, ".husky");
-  if (!existsSync7(huskyDir)) return false;
-  if (existsSync7(resolve(huskyDir, "_"))) return true;
-  if (existsSync7(resolve(huskyDir, "pre-commit"))) return true;
+  if (!existsSync6(huskyDir)) return false;
+  if (existsSync6(resolve(huskyDir, "_"))) return true;
+  if (existsSync6(resolve(huskyDir, "pre-commit"))) return true;
   const pkgPath = resolve(gitRoot, "package.json");
-  if (existsSync7(pkgPath)) {
+  if (existsSync6(pkgPath)) {
     try {
-      const pkg2 = JSON.parse(readFileSync6(pkgPath, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync5(pkgPath, "utf-8"));
       const scripts = pkg2.scripts ?? {};
       if (/husky/i.test(scripts.prepare ?? "") || /husky/i.test(scripts.postinstall ?? "")) {
         return true;
@@ -2738,7 +2687,7 @@ async function askConfirmation(question) {
 }
 function installToHusky(gitRoot, spec = PRE_COMMIT) {
   const hookPath = resolve(gitRoot, ".husky", spec.hookName);
-  const existed = existsSync7(hookPath);
+  const existed = existsSync6(hookPath);
   const wrote = mergePrimBlock(hookPath, huskyBlock(spec), spec.binName);
   if (!wrote) {
     console.log(`Prim ${spec.hookName} hook is already installed in .husky/${spec.hookName}.`);
@@ -2751,11 +2700,11 @@ function installToHusky(gitRoot, spec = PRE_COMMIT) {
 function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   const hooksDir = resolve(gitRoot, ".git", "hooks");
   const hookPath = resolve(hooksDir, spec.hookName);
-  if (!existsSync7(hooksDir)) {
+  if (!existsSync6(hooksDir)) {
     mkdirSync5(hooksDir, { recursive: true });
   }
-  if (existsSync7(hookPath)) {
-    const existing = readFileSync6(hookPath, "utf-8");
+  if (existsSync6(hookPath)) {
+    const existing = readFileSync5(hookPath, "utf-8");
     if (containsPrimHook(existing, spec.binName)) {
       console.log(`Prim ${spec.hookName} hook is already installed at ${hookPath}.`);
       return;
@@ -2767,9 +2716,9 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
-var PRIM_GIT_HOOKS_DIR = join6(homedir5(), ".config", "prim", "git-hooks");
+var PRIM_GIT_HOOKS_DIR = join5(homedir5(), ".config", "prim", "git-hooks");
 function expandTilde(p) {
-  return p.startsWith("~/") ? join6(homedir5(), p.slice(2)) : p;
+  return p.startsWith("~/") ? join5(homedir5(), p.slice(2)) : p;
 }
 function isOurHooksDir(value) {
   return value !== "" && expandTilde(value) === PRIM_GIT_HOOKS_DIR;
@@ -2834,7 +2783,7 @@ function ownedHookNames() {
   return [...HOOKS.map((s) => s.hookName), ...PASSTHROUGH_HOOKS];
 }
 function writeOwnHooks() {
-  if (!existsSync7(PRIM_GIT_HOOKS_DIR)) {
+  if (!existsSync6(PRIM_GIT_HOOKS_DIR)) {
     mkdirSync5(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
@@ -2850,8 +2799,8 @@ function appendPrimBlock(hookPath, spec) {
   mergePrimBlock(hookPath, gatedBlock(spec), spec.binName);
 }
 function stripPrimBlock(hookPath, spec) {
-  if (!existsSync7(hookPath)) return;
-  const existing = readFileSync6(hookPath, "utf-8");
+  if (!existsSync6(hookPath)) return;
+  const existing = readFileSync5(hookPath, "utf-8");
   const primCreated = existing.includes(PRIM_CREATED_MARK);
   const { start, end } = blockMarkers(spec);
   const s = existing.indexOf(start);
@@ -2906,7 +2855,7 @@ function uninstallGlobalHooks() {
   if (isOurHooksDir(global)) {
     for (const name of ownedHookNames()) {
       const p = resolve(PRIM_GIT_HOOKS_DIR, name);
-      if (existsSync7(p)) unlinkSync2(p);
+      if (existsSync6(p)) unlinkSync2(p);
     }
     execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"]);
     console.log("Removed prim global git hooks and unset core.hooksPath.");
@@ -2996,11 +2945,11 @@ function registerHooksCommands(program2) {
     const gitRoot = getGitRoot();
     for (const spec of HOOKS) {
       const hookPath = resolve(gitRoot, ".git", "hooks", spec.hookName);
-      if (!existsSync7(hookPath)) {
+      if (!existsSync6(hookPath)) {
         console.log(`No ${spec.hookName} hook found.`);
         continue;
       }
-      if (containsPrimHook(readFileSync6(hookPath, "utf-8"), spec.binName)) {
+      if (containsPrimHook(readFileSync5(hookPath, "utf-8"), spec.binName)) {
         unlinkSync2(hookPath);
         console.log(`Removed ${spec.hookName} hook at ${hookPath}`);
       } else {
@@ -3011,8 +2960,8 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/moves.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 
 // src/flusher.ts
 import { renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
@@ -3171,19 +3120,19 @@ function registerMovesCommands(program2) {
     }
   });
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
-    const dir = join7(process.cwd(), ".prim");
-    if (!existsSync8(dir)) {
+    const dir = join6(process.cwd(), ".prim");
+    if (!existsSync7(dir)) {
       mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
     }
-    const file = join7(process.cwd(), WORKSPACE_FILE);
+    const file = join6(process.cwd(), WORKSPACE_FILE);
     writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
       mode: FILE_MODE2
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
   moves.command("drop").description("Remove the .prim/workspace.json binding from the cwd").action(() => {
-    const file = join7(process.cwd(), WORKSPACE_FILE);
-    if (!existsSync8(file)) {
+    const file = join6(process.cwd(), WORKSPACE_FILE);
+    if (!existsSync7(file)) {
       console.log("[prim] no workspace binding in cwd");
       return;
     }
@@ -3265,7 +3214,7 @@ async function performReconcile(idOrShortId, opts = {}) {
 }
 function registerReconcileCommands(program2) {
   program2.command("reconcile <idOrShortId>").description(
-    "Issue a single-use bypass for a flagged decision (used by the cooperative reconcile loop)"
+    "Issue a single-use bypass for a decision flagged by Conflict Gates Enforcement (not currently enabled)"
   ).option(
     "--flag <conflictFlagId>",
     "Specific flag id to bind the bypass to (default: the decision's latest unack'd flag)"
@@ -3276,23 +3225,23 @@ function registerReconcileCommands(program2) {
 
 // src/commands/session.ts
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync6,
   readdirSync,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 var DIR_MODE2 = 448;
 var FILE_MODE3 = 384;
 function ensureDir() {
-  if (!existsSync9(SESSIONS_DIR)) {
+  if (!existsSync8(SESSIONS_DIR)) {
     mkdirSync7(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
   }
 }
 function markerPath(sessionId) {
-  return join8(SESSIONS_DIR, `${sessionId}.json`);
+  return join7(SESSIONS_DIR, `${sessionId}.json`);
 }
 function registerSessionCommands(program2) {
   const session = program2.command("session").description("Decision Event Pipeline \u2014 session binding markers");
@@ -3308,7 +3257,7 @@ function registerSessionCommands(program2) {
     console.log(`[prim] session ${sessionId} bound to org ${opts.orgId}`);
   });
   session.command("list").description("List active session markers").action(() => {
-    if (!existsSync9(SESSIONS_DIR)) {
+    if (!existsSync8(SESSIONS_DIR)) {
       console.log("[prim] no session markers");
       return;
     }
@@ -3320,7 +3269,7 @@ function registerSessionCommands(program2) {
     for (const f of files) {
       const sessionId = f.replace(/\.json$/, "");
       try {
-        const m = JSON.parse(readFileSync7(join8(SESSIONS_DIR, f), "utf-8"));
+        const m = JSON.parse(readFileSync6(join7(SESSIONS_DIR, f), "utf-8"));
         console.log(`${sessionId}  org=${m.orgId}`);
       } catch {
       }
@@ -3328,7 +3277,7 @@ function registerSessionCommands(program2) {
   });
   session.command("drop <sessionId>").description("Remove a session marker").action((sessionId) => {
     const p = markerPath(sessionId);
-    if (!existsSync9(p)) {
+    if (!existsSync8(p)) {
       console.log(`[prim] no marker for session ${sessionId}`);
       return;
     }
@@ -3339,8 +3288,8 @@ function registerSessionCommands(program2) {
 
 // src/commands/setup.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
 var SESSION_LABELS = {
@@ -3403,8 +3352,8 @@ function detectProjectConflicts(agent, run) {
   }
   try {
     const root = gitToplevel();
-    const preCommit = root && join9(root, ".git", "hooks", "pre-commit");
-    if (preCommit && existsSync10(preCommit) && readFileSync8(preCommit, "utf-8").includes("prim-pre-commit")) {
+    const preCommit = root && join8(root, ".git", "hooks", "pre-commit");
+    if (preCommit && existsSync9(preCommit) && readFileSync7(preCommit, "utf-8").includes("prim-pre-commit")) {
       conflicts.push(CONFLICT_HOOKS);
     }
   } catch {
@@ -3522,39 +3471,39 @@ function registerSetupCommand(program2) {
 // src/commands/skill.ts
 import {
   closeSync as closeSync4,
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   fsyncSync as fsyncSync3,
   openSync as openSync4,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync9,
   renameSync as renameSync4,
   writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname7, join as join11, resolve as resolve3 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname6, join as join10, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
 
 // src/commands/claude-plugin.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync9, readdirSync as readdirSync2, rmSync as rmSync3, rmdirSync } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync8, readdirSync as readdirSync2, rmSync as rmSync3, rmdirSync } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join10, resolve as resolve2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-var __dirname = dirname6(fileURLToPath2(import.meta.url));
+import { dirname as dirname5, join as join9, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+var __dirname = dirname5(fileURLToPath(import.meta.url));
 var PLUGIN_DESCRIPTION = "Primitive decision-graph guidance for the prim CLI \u2014 a model-invoked skill installed by prim skill install.";
 function resolvePluginDir(cwd, scope) {
   if (scope && scope !== "user" && scope !== "project") {
     console.error(`Unknown --scope "${scope}" (expected user or project)`);
     return null;
   }
-  const base = scope === "user" ? join10(homedir6(), ".claude") : join10(gitToplevel(cwd) ?? cwd, ".claude");
-  return join10(base, "skills", "prim");
+  const base = scope === "user" ? join9(homedir6(), ".claude") : join9(gitToplevel(cwd) ?? cwd, ".claude");
+  return join9(base, "skills", "prim");
 }
 function packageVersion() {
   let dir = __dirname;
-  while (dir !== dirname6(dir)) {
+  while (dir !== dirname5(dir)) {
     const p = resolve2(dir, "package.json");
-    if (existsSync11(p)) return JSON.parse(readFileSync9(p, "utf-8")).version;
-    dir = dirname6(dir);
+    if (existsSync10(p)) return JSON.parse(readFileSync8(p, "utf-8")).version;
+    dir = dirname5(dir);
   }
   return "0.0.0";
 }
@@ -3564,12 +3513,12 @@ function pluginManifest() {
 `;
 }
 function removeDirIfEmpty(dir) {
-  if (existsSync11(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
+  if (existsSync10(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
 }
 function pluginPaths(dir) {
   return {
-    manifestPath: join10(dir, ".claude-plugin", "plugin.json"),
-    skillPath: join10(dir, "SKILL.md")
+    manifestPath: join9(dir, ".claude-plugin", "plugin.json"),
+    skillPath: join9(dir, "SKILL.md")
   };
 }
 function installClaudePlugin(cwd, opts) {
@@ -3578,8 +3527,8 @@ function installClaudePlugin(cwd, opts) {
   const { manifestPath, skillPath } = pluginPaths(dir);
   const manifest = pluginManifest();
   const skill = loadSkill();
-  const manifestCurrent = existsSync11(manifestPath) ? readFileSync9(manifestPath, "utf-8") : null;
-  const skillCurrent = existsSync11(skillPath) ? readFileSync9(skillPath, "utf-8") : null;
+  const manifestCurrent = existsSync10(manifestPath) ? readFileSync8(manifestPath, "utf-8") : null;
+  const skillCurrent = existsSync10(skillPath) ? readFileSync8(skillPath, "utf-8") : null;
   if (manifestCurrent === manifest && skillCurrent === skill) {
     console.log("No changes \u2014 prim skill plugin already up to date.");
     return 0;
@@ -3588,7 +3537,7 @@ function installClaudePlugin(cwd, opts) {
     console.log(`Would write plugin to ${dir} (.claude-plugin/plugin.json + SKILL.md)`);
     return 0;
   }
-  mkdirSync8(join10(dir, ".claude-plugin"), { recursive: true });
+  mkdirSync8(join9(dir, ".claude-plugin"), { recursive: true });
   atomicWrite2(manifestPath, manifest);
   atomicWrite2(skillPath, skill);
   console.log(`Installed prim skill plugin at ${dir}`);
@@ -3602,13 +3551,13 @@ function uninstallClaudePlugin(cwd, opts) {
   const dir = resolvePluginDir(cwd, opts.scope);
   if (dir === null) return 1;
   const { manifestPath, skillPath } = pluginPaths(dir);
-  if (!existsSync11(manifestPath) && !existsSync11(skillPath)) {
+  if (!existsSync10(manifestPath) && !existsSync10(skillPath)) {
     console.log(`prim skill plugin not present at ${dir}`);
     return 0;
   }
   rmSync3(manifestPath, { force: true });
   rmSync3(skillPath, { force: true });
-  removeDirIfEmpty(join10(dir, ".claude-plugin"));
+  removeDirIfEmpty(join9(dir, ".claude-plugin"));
   removeDirIfEmpty(dir);
   console.log(`Removed prim skill plugin from ${dir}`);
   return 0;
@@ -3617,7 +3566,7 @@ function statusClaudePlugin(cwd, opts) {
   const dir = resolvePluginDir(cwd, opts.scope);
   if (dir === null) return 1;
   const { skillPath } = pluginPaths(dir);
-  const installed = existsSync11(skillPath);
+  const installed = existsSync10(skillPath);
   if (opts.json) {
     printJson({ installed, target: dir });
     return installed ? 0 : 1;
@@ -3631,7 +3580,7 @@ function statusClaudePlugin(cwd, opts) {
 }
 
 // src/commands/skill.ts
-var __dirname2 = dirname7(fileURLToPath3(import.meta.url));
+var __dirname2 = dirname6(fileURLToPath2(import.meta.url));
 var SKILL_BEGIN = "<!-- BEGIN PRIM SKILL v1 -->";
 var SKILL_END = "<!-- END PRIM SKILL v1 -->";
 var TARGET_CANDIDATES = [
@@ -3649,24 +3598,24 @@ var AGENT_TARGET = {
   hermes: ".hermes.md"
 };
 function userTargetFor(agent) {
-  if (agent === "claude") return join11(homedir7(), ".claude", "CLAUDE.md");
-  if (agent === "codex") return join11(homedir7(), ".codex", "AGENTS.md");
+  if (agent === "claude") return join10(homedir7(), ".claude", "CLAUDE.md");
+  if (agent === "codex") return join10(homedir7(), ".codex", "AGENTS.md");
   if (agent === "hermes") {
-    return join11(process.env.HERMES_HOME ?? join11(homedir7(), ".hermes"), ".hermes.md");
+    return join10(process.env.HERMES_HOME ?? join10(homedir7(), ".hermes"), ".hermes.md");
   }
   return null;
 }
 function loadSkill() {
   let dir = __dirname2;
-  while (dir !== dirname7(dir)) {
+  while (dir !== dirname6(dir)) {
     const p = resolve3(dir, "SKILL.md");
-    if (existsSync12(p)) return readFileSync10(p, "utf-8");
-    dir = dirname7(dir);
+    if (existsSync11(p)) return readFileSync9(p, "utf-8");
+    dir = dirname6(dir);
   }
   throw new Error("SKILL.md not found in package");
 }
 function detectTargets(cwd) {
-  return TARGET_CANDIDATES.filter((p) => existsSync12(resolve3(cwd, p)));
+  return TARGET_CANDIDATES.filter((p) => existsSync11(resolve3(cwd, p)));
 }
 function detectNewline(content) {
   return content.includes("\r\n") ? "\r\n" : "\n";
@@ -3736,7 +3685,7 @@ function runInstall(cwd, opts) {
   if (opts.agent === "claude" && !opts.target) return installClaudePlugin(cwd, opts);
   const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  const existing = existsSync12(target) ? readFileSync10(target, "utf-8") : "";
+  const existing = existsSync11(target) ? readFileSync9(target, "utf-8") : "";
   const eol = existing ? detectNewline(existing) : "\n";
   const block = composeBlock(loadSkill(), eol);
   const next = applyBlock(existing, block, eol);
@@ -3756,11 +3705,11 @@ function runUninstall(cwd, opts) {
   if (opts.agent === "claude" && !opts.target) return uninstallClaudePlugin(cwd, opts);
   const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  if (!existsSync12(target)) {
+  if (!existsSync11(target)) {
     console.log(`Skill block not present at ${target}`);
     return 0;
   }
-  const existing = readFileSync10(target, "utf-8");
+  const existing = readFileSync9(target, "utf-8");
   const next = removeBlock(existing);
   if (next === null) {
     console.log(`Skill block not present at ${target}`);
@@ -3774,10 +3723,10 @@ function runStatus(cwd, opts) {
   if (opts.agent === "claude" && !opts.target) return statusClaudePlugin(cwd, opts);
   const target = resolveTarget(cwd, opts);
   if (target === null) return 1;
-  const fileExists = existsSync12(target);
+  const fileExists = existsSync11(target);
   let installed = false;
   if (fileExists) {
-    const content = readFileSync10(target, "utf-8");
+    const content = readFileSync9(target, "utf-8");
     installed = content.includes(SKILL_BEGIN) && content.includes(SKILL_END);
   }
   if (opts.json) {
@@ -3814,18 +3763,18 @@ function registerSkillCommands(program2) {
 }
 
 // src/commands/statusline.ts
-import { readFileSync as readFileSync11 } from "fs";
-import { dirname as dirname8, resolve as resolve4 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname7, resolve as resolve4 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 var STATUSLINE_NAME_CAP = 3;
 function readPackageVersion() {
   try {
-    const here = dirname8(fileURLToPath4(import.meta.url));
+    const here = dirname7(fileURLToPath3(import.meta.url));
     const candidates = [resolve4(here, "../../package.json"), resolve4(here, "../package.json")];
     for (const path of candidates) {
       try {
-        const pkg2 = JSON.parse(readFileSync11(path, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync10(path, "utf-8"));
         if (pkg2.version) {
           return pkg2.version;
         }
@@ -3874,6 +3823,7 @@ async function renderStatusline() {
 function registerStatuslineCommands(program2) {
   program2.command("statusline").description("Render the Claude Code statusLine for the prim companion daemon").action(async () => {
     try {
+      warmBinCache();
       const line = await renderStatusline();
       process.stdout.write(line);
     } catch {
@@ -3925,14 +3875,13 @@ function formatWelcome(state) {
     bold(color("Welcome to Primitive", "green")),
     "",
     "Primitive captures the decisions your team makes while coding into a",
-    "shared graph \u2014 and flags edits that conflict with earlier ones before",
-    "they land.",
+    "shared graph \u2014 automatically, as you work.",
     "",
     bold("How it works"),
     bullet("Capture is automatic \u2014 keep coding; your decisions are recorded for you."),
-    bullet("The conflict gate has your back: when an edit conflicts with a"),
-    "    load-bearing decision, prim surfaces it. Run `prim reconcile dec_<id>` to clear",
-    "    that decision and retry.",
+    bullet("Conflict Gates (with Enforcement) flag or block edits that conflict"),
+    "    with a load-bearing decision \u2014 not currently enabled. Contact",
+    "    support@getprimitive.ai to turn them on for your team.",
     bullet('Occasional yes/no prompts confirm the "why" behind a decision \u2014'),
     "    answering keeps the graph trustworthy.",
     ""
@@ -3994,8 +3943,8 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
 }
 
 // src/index.ts
-var __dirname3 = dirname9(fileURLToPath5(import.meta.url));
-var pkg = JSON.parse(readFileSync12(resolve5(__dirname3, "../package.json"), "utf-8"));
+var __dirname3 = dirname8(fileURLToPath4(import.meta.url));
+var pkg = JSON.parse(readFileSync11(resolve5(__dirname3, "../package.json"), "utf-8"));
 updateNotifier({ pkg }).notify();
 var program = new Command();
 program.name("prim").description("CLI for Primitive's decision graph").version(pkg.version).option("-y, --yes", "auto-confirm prompts").option(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.35",
+  "version": "0.1.0-alpha.37",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",