@primitive.ai/prim 0.1.0-alpha.44 → 0.1.0-alpha.46

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-BSZGI5RL.js";
+} from "./chunk-Z4VI6TNX.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
@@ -21,10 +21,10 @@ import {
   listFlushing,
   pendingJournalStats,
   readMovesFromPath
-} from "./chunk-OKUXEBPT.js";
+} from "./chunk-ESLX7ISX.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-UISU3A7W.js";
+} from "./chunk-JT4Q333I.js";
 import {
   inspectWorkspaceId
 } from "./chunk-IMAIBPUC.js";
@@ -41,14 +41,18 @@ import {
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
-  TOKEN_EXPIRES_PATH,
   TOKEN_FILE_PATH,
-  getAuthToken,
+  clearStoredCredentials,
+  commitCredentials,
   getClient,
   getSiteUrl,
   getTokenExpiresAt,
-  saveTokenExpiry
-} from "./chunk-W6PAKEDO.js";
+  isSessionEnded,
+  refreshToken,
+  resolveAuthCredential,
+  setStoredToken,
+  withFileLock
+} from "./chunk-VQ2ZV2D5.js";
 import {
   daemonIsLive,
   daemonRequest
@@ -56,7 +60,7 @@ import {
 
 // src/index.ts
 import { readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname9, resolve as resolve6 } from "path";
+import { dirname as dirname8, resolve as resolve6 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
@@ -96,10 +100,9 @@ function registerActivationCommands(program2) {
 // src/commands/auth.ts
 import { exec } from "child_process";
 import { createHash, randomBytes } from "crypto";
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 import { createServer } from "http";
 import { platform } from "os";
-import { dirname } from "path";
 
 // src/commands/auth-pages.ts
 var FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="99.77 99.96 400.85 400.85" fill="currentColor">
@@ -248,12 +251,13 @@ var STATE_MISMATCH_HTML = renderPage({
 });
 
 // src/commands/auth.ts
-var FILE_MODE = 384;
 var LOCALHOST = "127.0.0.1";
 var CALLBACK_PORT = 19876;
 var CALLBACK_TIMEOUT_MS = 12e4;
 var EXIT_OK = 0;
 var EXIT_FAIL = 1;
+var EXIT_UNREACHABLE = 2;
+var AUTH_PROBE_TIMEOUT_MS = 1e4;
 var HTML_HEADERS = { "Content-Type": "text/html; charset=utf-8" };
 var BASE64_PLUS_RE = /\+/g;
 var BASE64_SLASH_RE = /\//g;
@@ -271,13 +275,6 @@ function openBrowser(url) {
   const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
   exec(`${cmd} "${url}"`);
 }
-function saveToken(token) {
-  const dir = dirname(TOKEN_FILE_PATH);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  writeFileSync(TOKEN_FILE_PATH, token, { mode: FILE_MODE });
-}
 function resolveCallbackPage(params, expectedState) {
   if (params.get("state") !== expectedState) {
     return {
@@ -327,6 +324,123 @@ function reportSuccess() {
   console.log(JSON.stringify({ authenticated: true, tokenFile: TOKEN_FILE_PATH }));
   process.exitCode = EXIT_OK;
 }
+function hasStoredRefreshToken() {
+  if (!existsSync(REFRESH_TOKEN_PATH)) return false;
+  try {
+    return readFileSync(REFRESH_TOKEN_PATH, "utf-8").trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+function authStatusResult(status, reason, source, refreshTokenPresent) {
+  const expiresAt = source === "token_file" ? getTokenExpiresAt() : void 0;
+  const expiresInMs = expiresAt === void 0 ? null : expiresAt - Date.now();
+  return {
+    authenticated: status === "valid",
+    status,
+    reason,
+    tokenFile: source === "token_file" ? TOKEN_FILE_PATH : null,
+    accessTokenExpiresInMs: expiresInMs,
+    accessTokenExpired: expiresInMs !== null && expiresInMs <= 0,
+    refreshTokenPresent,
+    warnings: source === "token_file" && !refreshTokenPresent ? ["no refresh token"] : []
+  };
+}
+async function verifyAuthStatus() {
+  const credential = resolveAuthCredential();
+  if (!credential) {
+    return authStatusResult("invalid", "missing_credentials", void 0, false);
+  }
+  const storedCredential = credential.source === "token_file";
+  const refreshPresent = storedCredential && hasStoredRefreshToken();
+  let accessToken = credential.token;
+  if (refreshPresent) {
+    try {
+      const refreshed = await refreshToken({
+        force: true,
+        signal: AbortSignal.timeout(AUTH_PROBE_TIMEOUT_MS)
+      });
+      if (!refreshed) {
+        const rejected = isSessionEnded();
+        return authStatusResult(
+          rejected ? "invalid" : "unreachable",
+          rejected ? "refresh_rejected" : "verification_unavailable",
+          credential.source,
+          true
+        );
+      }
+      accessToken = refreshed;
+    } catch {
+      const rejected = isSessionEnded();
+      return authStatusResult(
+        rejected ? "invalid" : "unreachable",
+        rejected ? "refresh_rejected" : "verification_unavailable",
+        credential.source,
+        true
+      );
+    }
+  }
+  try {
+    const response = await fetch(`${getSiteUrl()}/api/cli/auth/status`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(AUTH_PROBE_TIMEOUT_MS)
+    });
+    if (response.ok) {
+      return authStatusResult("valid", "verified", credential.source, refreshPresent);
+    }
+    if (response.status === 401 || response.status === 403) {
+      return authStatusResult("invalid", "access_rejected", credential.source, refreshPresent);
+    }
+    return authStatusResult(
+      "unreachable",
+      "verification_unavailable",
+      credential.source,
+      refreshPresent
+    );
+  } catch {
+    return authStatusResult(
+      "unreachable",
+      "verification_unavailable",
+      credential.source,
+      refreshPresent
+    );
+  }
+}
+function authStatusExitCode(status) {
+  if (status === "valid") return EXIT_OK;
+  return status === "invalid" ? EXIT_FAIL : EXIT_UNREACHABLE;
+}
+function writeHumanAuthStatus(result) {
+  if (result.status === "invalid") {
+    const detail = result.reason === "refresh_rejected" ? "The saved session was rejected." : result.reason === "access_rejected" ? "The selected access token was rejected." : "No credentials were found.";
+    console.log(`${detail} Run \`prim auth login\` to authenticate.`);
+    return;
+  }
+  if (result.status === "unreachable") {
+    console.log("Authentication could not be verified. Credentials were retained.");
+    return;
+  }
+  console.log("Authenticated (verified).");
+  if (result.tokenFile) {
+    console.log(`Token file: ${result.tokenFile}`);
+  } else {
+    console.log("Token source: fixed environment credential");
+  }
+  if (result.accessTokenExpiresInMs === null) {
+    console.log("Access token expiry: unknown (no metadata)");
+  } else if (result.accessTokenExpiresInMs <= 0) {
+    console.log("Access token: expired");
+  } else {
+    const minutes = Math.floor(result.accessTokenExpiresInMs / 6e4);
+    const seconds = Math.floor(result.accessTokenExpiresInMs % 6e4 / 1e3);
+    console.log(`Access token expires in: ${minutes}m ${seconds}s`);
+  }
+  console.log(
+    `Refresh token: ${result.tokenFile ? result.refreshTokenPresent ? "present" : "missing" : "not applicable"}`
+  );
+  for (const warning of result.warnings) console.log(`Warning: ${warning}`);
+}
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage CLI authentication");
   auth.command("login").description("Authenticate via browser (WorkOS OAuth)").action(async () => {
@@ -417,27 +531,28 @@ ${authUrl.toString()}
       return;
     }
     try {
-      const token = await exchangeCode(siteUrl, result.code, verifier, redirectUri);
-      saveToken(token);
+      const tokens = await exchangeCode(siteUrl, result.code, verifier, redirectUri);
+      await commitCredentials(tokens);
       reportSuccess();
     } catch (err) {
       reportFailure("token_exchange_failed", err instanceof Error ? err.message : String(err));
     }
   });
-  auth.command("set-token <token>").description("Save a bearer token for authenticated CLI calls").action((token) => {
-    saveToken(token);
+  auth.command("set-token <token>").description("Save a bearer token for authenticated CLI calls").action(async (token) => {
+    await setStoredToken(token);
     console.log(`Token saved to ${TOKEN_FILE_PATH}`);
   });
   auth.command("clear").description("Remove the saved authentication token").action(async () => {
-    if (existsSync(REFRESH_TOKEN_PATH)) {
-      const refreshTokenValue = readFileSync(REFRESH_TOKEN_PATH, "utf-8").trim();
-      if (refreshTokenValue) {
+    const removed = await clearStoredCredentials({
+      beforeClear: async (refreshTokenValue) => {
+        if (!refreshTokenValue) return;
         try {
           const siteUrl = getSiteUrl();
           const res = await fetch(`${siteUrl}/mcp/broker/revoke`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ refresh_token: refreshTokenValue })
+            body: JSON.stringify({ refresh_token: refreshTokenValue }),
+            signal: AbortSignal.timeout(AUTH_PROBE_TIMEOUT_MS)
           });
           if (res.ok) {
             console.log("Server token revoked.");
@@ -451,62 +566,18 @@ ${authUrl.toString()}
           console.warn("Could not reach server for revocation \u2014 clearing local files anyway.");
         }
       }
-    }
-    let removed = false;
-    for (const filePath of [TOKEN_FILE_PATH, REFRESH_TOKEN_PATH, TOKEN_EXPIRES_PATH]) {
-      if (existsSync(filePath)) {
-        rmSync(filePath);
-        removed = true;
-      }
-    }
+    });
     if (removed) {
       console.log("Local tokens removed.");
     } else {
       console.log("No saved tokens found.");
     }
   });
-  auth.command("status").description("Check authentication status and token expiry").option("--json", "Output as JSON").action((opts) => {
-    const token = getAuthToken();
-    if (opts.json) {
-      const expiresAt2 = getTokenExpiresAt();
-      const expiresInMs = expiresAt2 ? expiresAt2 - Date.now() : null;
-      const refreshPresent = existsSync(REFRESH_TOKEN_PATH);
-      printJson({
-        authenticated: !!token,
-        tokenFile: token ? TOKEN_FILE_PATH : null,
-        accessTokenExpiresInMs: expiresInMs,
-        accessTokenExpired: expiresInMs !== null && expiresInMs <= 0,
-        refreshTokenPresent: refreshPresent,
-        warnings: !token || refreshPresent ? [] : ["no refresh token"]
-      });
-      process.exit(token ? 0 : 1);
-    }
-    if (!token) {
-      console.log("Not authenticated. Run `prim auth login` to authenticate.");
-      process.exit(1);
-    }
-    console.log("Authenticated.");
-    console.log(`Token file: ${TOKEN_FILE_PATH}`);
-    const expiresAt = getTokenExpiresAt();
-    if (expiresAt) {
-      const remaining = expiresAt - Date.now();
-      if (remaining <= 0) {
-        console.log("Access token: expired");
-      } else {
-        const minutes = Math.floor(remaining / 6e4);
-        const seconds = Math.floor(remaining % 6e4 / 1e3);
-        console.log(`Access token expires in: ${minutes}m ${seconds}s`);
-      }
-    } else {
-      console.log("Access token expiry: unknown (no metadata)");
-    }
-    const hasRefresh = existsSync(REFRESH_TOKEN_PATH);
-    console.log(`Refresh token: ${hasRefresh ? "present" : "missing"}`);
-    if (!hasRefresh) {
-      console.log(
-        "Warning: No refresh token. Re-run `prim auth login` when access token expires."
-      );
-    }
+  auth.command("status").description("Check authentication status and token expiry").option("--json", "Output as JSON").action(async (opts) => {
+    const result = await verifyAuthStatus();
+    if (opts.json) printJson(result);
+    else writeHumanAuthStatus(result);
+    process.exit(authStatusExitCode(result.status));
   });
 }
 async function exchangeCode(siteUrl, code, codeVerifier, redirectUri) {
@@ -524,19 +595,14 @@ async function exchangeCode(siteUrl, code, codeVerifier, redirectUri) {
     throw new Error(`Token exchange failed (${response.status}): ${body}`);
   }
   const data = await response.json();
-  if (!data.access_token) {
-    throw new Error("No access token in response");
+  if (!data.access_token || !data.refresh_token) {
+    throw new Error("Token exchange did not return a complete credential pair");
   }
-  if (data.refresh_token) {
-    const refreshPath = TOKEN_FILE_PATH.replace("/token", "/refresh_token");
-    const dir = dirname(refreshPath);
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
-    }
-    writeFileSync(refreshPath, data.refresh_token, { mode: FILE_MODE });
-  }
-  saveTokenExpiry(data.access_token, data.expires_in);
-  return data.access_token;
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in
+  };
 }
 
 // src/commands/claude-install.ts
@@ -544,14 +610,14 @@ import {
   closeSync,
   existsSync as existsSync3,
   fsyncSync,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync2,
   openSync,
   readFileSync as readFileSync3,
   renameSync as renameSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync2
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join2 } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 
 // src/daemon/launchd.ts
 import { spawnSync } from "child_process";
@@ -560,17 +626,16 @@ import {
   chmodSync,
   copyFileSync,
   existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   mkdtempSync,
   readFileSync as readFileSync2,
   renameSync,
-  rmSync as rmSync2,
-  statSync,
+  rmSync,
   symlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync
 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname2, isAbsolute, join, resolve } from "path";
+import { dirname, isAbsolute, join, resolve } from "path";
 var LAUNCHD_LABEL = "ai.getprimitive.prim-daemon";
 var RUNTIME_SCHEMA_VERSION = 1;
 var RUNTIME_DIR_MODE = 448;
@@ -580,9 +645,6 @@ var PLIST_FILE_MODE = 384;
 var READY_TIMEOUT_MS = 15e3;
 var READY_POLL_MS = 100;
 var READY_PROBE_TIMEOUT_MS = 250;
-var LIFECYCLE_LOCK_TIMEOUT_MS = 3e4;
-var LIFECYCLE_LOCK_POLL_MS = 50;
-var LIFECYCLE_LOCK_INIT_GRACE_MS = 2e3;
 function xdgDataHome(options) {
   const home = options.homeDir ?? homedir();
   const configured = (options.env ?? process.env).XDG_DATA_HOME;
@@ -606,7 +668,7 @@ function runtimePaths(options = {}) {
   };
 }
 function findPackageVersion(entryFile) {
-  let dir = dirname2(resolve(entryFile));
+  let dir = dirname(resolve(entryFile));
   for (let depth = 0; depth < 6; depth++) {
     const packagePath = join(dir, "package.json");
     if (existsSync2(packagePath)) {
@@ -618,7 +680,7 @@ function findPackageVersion(entryFile) {
       } catch {
       }
     }
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -646,7 +708,7 @@ function atomicSymlink(target, linkPath) {
   try {
     renameSync(tempLink, linkPath);
   } catch (error) {
-    rmSync2(tempLink, { force: true });
+    rmSync(tempLink, { force: true });
     throw error;
   }
 }
@@ -677,11 +739,11 @@ function stageRuntime(options = {}) {
         RUNTIME_LAUNCHER_MODE
       );
     } else {
-      rmSync2(paths.statuslineLauncher, { force: true });
+      rmSync(paths.statuslineLauncher, { force: true });
     }
     return { changed: false, manifest: current, paths };
   }
-  mkdirSync2(paths.releasesDir, { recursive: true, mode: RUNTIME_DIR_MODE });
+  mkdirSync(paths.releasesDir, { recursive: true, mode: RUNTIME_DIR_MODE });
   chmodSync(paths.runtimeDir, RUNTIME_DIR_MODE);
   chmodSync(paths.releasesDir, RUNTIME_DIR_MODE);
   const stagingDir = mkdtempSync(join(paths.releasesDir, ".stage-"));
@@ -696,7 +758,7 @@ function stageRuntime(options = {}) {
       chmodSync(statuslineTarget, RUNTIME_FILE_MODE);
     }
     const manifestTarget = join(stagingDir, "manifest.json");
-    writeFileSync2(manifestTarget, `${JSON.stringify(desired, null, 2)}
+    writeFileSync(manifestTarget, `${JSON.stringify(desired, null, 2)}
 `, {
       encoding: "utf8",
       mode: RUNTIME_FILE_MODE,
@@ -715,10 +777,10 @@ function stageRuntime(options = {}) {
         RUNTIME_LAUNCHER_MODE
       );
     } else {
-      rmSync2(paths.statuslineLauncher, { force: true });
+      rmSync(paths.statuslineLauncher, { force: true });
     }
   } catch (error) {
-    rmSync2(stagingDir, { recursive: true, force: true });
+    rmSync(stagingDir, { recursive: true, force: true });
     throw error;
   }
   return { changed: true, manifest: desired, paths };
@@ -815,13 +877,13 @@ function atomicWrite(path, content, mode) {
     }
   } catch {
   }
-  mkdirSync2(dirname2(path), { recursive: true });
+  mkdirSync(dirname(path), { recursive: true });
   const temp = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync2(temp, content, { encoding: "utf8", mode, flag: "wx" });
+  writeFileSync(temp, content, { encoding: "utf8", mode, flag: "wx" });
   try {
     renameSync(temp, path);
   } catch (error) {
-    rmSync2(temp, { force: true });
+    rmSync(temp, { force: true });
     throw error;
   }
   return true;
@@ -849,95 +911,9 @@ function processIsAlive(pid) {
     return error.code === "EPERM";
   }
 }
-function lifecycleOwnerPath(lockDir) {
-  return join(lockDir, "owner.json");
-}
-function readLifecycleOwner(lockDir) {
-  try {
-    const owner = JSON.parse(
-      readFileSync2(lifecycleOwnerPath(lockDir), "utf8")
-    );
-    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
-      return null;
-    }
-    return owner;
-  } catch {
-    return null;
-  }
-}
-function sameLifecycleOwner(a, b) {
-  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
-}
-function tryTakeLifecycleLock(lockDir, now) {
-  try {
-    mkdirSync2(lockDir, { mode: RUNTIME_DIR_MODE });
-  } catch (error) {
-    if (error.code === "EEXIST") return null;
-    throw error;
-  }
-  const owner = {
-    pid: process.pid,
-    nonce: createHash2("sha256").update(`${process.pid}\0${now}\0${Math.random()}`).digest("hex"),
-    createdAt: now
-  };
-  try {
-    writeFileSync2(lifecycleOwnerPath(lockDir), `${JSON.stringify(owner)}
-`, {
-      encoding: "utf8",
-      mode: RUNTIME_FILE_MODE,
-      flag: "wx"
-    });
-    return owner;
-  } catch (error) {
-    rmSync2(lockDir, { recursive: true, force: true });
-    throw error;
-  }
-}
-function recoverStaleLifecycleLock(lockDir, now, alive) {
-  const owner = readLifecycleOwner(lockDir);
-  if (owner) {
-    if (alive(owner.pid)) return false;
-    if (!sameLifecycleOwner(readLifecycleOwner(lockDir), owner)) return false;
-    rmSync2(lockDir, { recursive: true, force: true });
-    return true;
-  }
-  try {
-    const before = statSync(lockDir).mtimeMs;
-    if (now - before < LIFECYCLE_LOCK_INIT_GRACE_MS) return false;
-    if (readLifecycleOwner(lockDir)) return false;
-    if (statSync(lockDir).mtimeMs !== before) return false;
-    rmSync2(lockDir, { recursive: true, force: true });
-    return true;
-  } catch {
-    return true;
-  }
-}
 async function withDaemonLifecycleLock(operation, options = {}) {
   const lockDir = runtimePaths(options).lifecycleLockDir;
-  mkdirSync2(dirname2(lockDir), { recursive: true, mode: RUNTIME_DIR_MODE });
-  const control = options.lifecycleLock;
-  const nowMs = control?.nowMs ?? Date.now;
-  const sleepFor = control?.sleep ?? defaultSleep;
-  const alive = control?.processAlive ?? processIsAlive;
-  const deadline = nowMs() + (control?.timeoutMs ?? LIFECYCLE_LOCK_TIMEOUT_MS);
-  let owner = null;
-  while (!owner) {
-    const now = nowMs();
-    owner = tryTakeLifecycleLock(lockDir, now);
-    if (owner) break;
-    recoverStaleLifecycleLock(lockDir, now, alive);
-    if (now >= deadline) {
-      throw new Error(`timed out waiting for daemon lifecycle lock ${lockDir}`);
-    }
-    await sleepFor(control?.pollMs ?? LIFECYCLE_LOCK_POLL_MS);
-  }
-  try {
-    return await operation();
-  } finally {
-    if (sameLifecycleOwner(readLifecycleOwner(lockDir), owner)) {
-      rmSync2(lockDir, { recursive: true, force: true });
-    }
-  }
+  return withFileLock(lockDir, operation, options.lifecycleLock);
 }
 async function stopVerifiedLegacyDaemon(homeDir) {
   const pidPath = join(homeDir, ".config", "prim", "daemon.pid");
@@ -975,11 +951,11 @@ function daemonExplicitlyDisabled(options = {}) {
 function setDaemonExplicitlyDisabled(disabled, options = {}) {
   const marker = runtimePaths(options).disabledMarker;
   if (!disabled) {
-    rmSync2(marker, { force: true });
+    rmSync(marker, { force: true });
     return;
   }
-  mkdirSync2(dirname2(marker), { recursive: true, mode: RUNTIME_DIR_MODE });
-  writeFileSync2(marker, "disabled by `prim daemon stop`\n", {
+  mkdirSync(dirname(marker), { recursive: true, mode: RUNTIME_DIR_MODE });
+  writeFileSync(marker, "disabled by `prim daemon stop`\n", {
     encoding: "utf8",
     mode: RUNTIME_FILE_MODE
   });
@@ -1002,8 +978,8 @@ async function ensureMacDaemonLocked(options) {
   if (options.explicitlyStarted) setDaemonExplicitlyDisabled(false, options);
   const runtime = stageRuntime(options);
   const servicePaths = launchdPaths(options);
-  mkdirSync2(dirname2(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
-  writeFileSync2(servicePaths.logPath, "", { mode: RUNTIME_FILE_MODE, flag: "a" });
+  mkdirSync(dirname(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
+  writeFileSync(servicePaths.logPath, "", { mode: RUNTIME_FILE_MODE, flag: "a" });
   chmodSync(servicePaths.logPath, RUNTIME_FILE_MODE);
   const plist = generateLaunchAgentPlist({
     nodePath: runtime.manifest.nodePath,
@@ -1318,12 +1294,12 @@ function isGateInstalled(settings) {
   return (settings.hooks?.PreToolUse ?? []).some((e) => entryHasCommand(e, GATE_BIN));
 }
 function atomicWrite2(path, content) {
-  const dir = dirname3(path);
+  const dir = dirname2(path);
   if (!existsSync3(dir)) {
-    mkdirSync3(dir, { recursive: true });
+    mkdirSync2(dir, { recursive: true });
   }
   const tmp = `${path}.tmp.${String(Date.now())}`;
-  writeFileSync3(tmp, `${JSON.stringify(content, null, JSON_INDENT)}
+  writeFileSync2(tmp, `${JSON.stringify(content, null, JSON_INDENT)}
 `, "utf-8");
   const fd = openSync(tmp, "r+");
   try {
@@ -1657,7 +1633,7 @@ ${line("project", result.project)}`);
 
 // src/commands/daemon.ts
 import { spawn } from "child_process";
-import { closeSync as closeSync2, existsSync as existsSync4, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync4, unlinkSync } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, unlinkSync } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
 
@@ -1727,6 +1703,30 @@ var HEALTHY_POLL_MS = 250;
 var EXIT_OK2 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
+var MAX_HEALTH_ERROR_LENGTH = 240;
+function boundedHealthError(value) {
+  if (!value) return void 0;
+  const clean = stripControlChars(value).replace(/\s+/g, " ").trim();
+  if (!clean) return void 0;
+  return clean.length <= MAX_HEALTH_ERROR_LENGTH ? clean : `${clean.slice(0, MAX_HEALTH_ERROR_LENGTH - 1)}\u2026`;
+}
+function daemonDegradedReason(snapshot) {
+  if (!snapshot || snapshot.healthy !== false) return void 0;
+  if (snapshot.needsReauth) {
+    return "authentication requires `prim auth login`";
+  }
+  if (snapshot.heartbeat?.healthy === false) {
+    const detail = boundedHealthError(snapshot.heartbeat.lastError);
+    return `heartbeat unhealthy${detail ? `: ${detail}` : ""}`;
+  }
+  if (snapshot.ingestion?.healthy === false) {
+    const detail = boundedHealthError(snapshot.ingestion.lastError);
+    const pending = snapshot.ingestion.pendingCount;
+    const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
+    return `ingestion unhealthy${typeof pending === "number" ? ` (${qualifier}${String(pending)} pending)` : ""}${detail ? `: ${detail}` : ""}`;
+  }
+  return "health checks have not recovered";
+}
 function readPidfile() {
   if (!existsSync4(PID_PATH)) {
     return null;
@@ -1765,7 +1765,7 @@ function spawnDaemon(options) {
 }
 function openDaemonLog(configDir = CONFIG_DIR) {
   if (!existsSync4(configDir)) {
-    mkdirSync4(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
+    mkdirSync3(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
   }
   return openSync2(join4(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
@@ -1805,6 +1805,15 @@ async function verifiedPid(existing) {
 function daemonStartIsHealthy(serviceReady, snapshot, expectedVersion) {
   return serviceReady && snapshot?.healthy === true && expectedVersion !== void 0 && snapshot.version === expectedVersion;
 }
+function daemonStartHealthFields(healthy, snapshot) {
+  if (healthy) return {};
+  return {
+    state: "degraded",
+    needsReauth: snapshot?.needsReauth === true,
+    heartbeat: snapshot?.heartbeat ?? null,
+    ingestion: snapshot?.ingestion ?? null
+  };
+}
 async function detachedDaemonStart(opts) {
   const existing = readPidfile();
   if (existing?.alive) {
@@ -1961,8 +1970,9 @@ async function macDaemonStart(forceRestart = false) {
 `
     );
   } else {
+    const reason = daemonDegradedReason(snapshot);
     process.stderr.write(
-      `[prim] \u2717 launchd daemon did not reach healthy heartbeat + ingestion state (see ${LOG_PATH})
+      `[prim] \u2717 launchd daemon did not reach healthy heartbeat + ingestion state${reason ? ` \xB7 ${reason}` : ""} (see ${LOG_PATH})
 `
     );
     if (!process.exitCode) process.exitCode = EXIT_NOT_RUNNING;
@@ -1977,6 +1987,7 @@ async function macDaemonStart(forceRestart = false) {
         loaded: result.service.loaded,
         responding: result.responding,
         healthy,
+        ...daemonStartHealthFields(healthy, snapshot),
         version: snapshot?.version,
         expectedVersion
       },
@@ -2138,8 +2149,9 @@ function writeLiveSnapshot(snapshot, supervised = false) {
   }
   const team = snapshot.onlineNames !== void 0 ? ` \xB7 team: ${formatTeammates(snapshot.onlineNames, Number.POSITIVE_INFINITY)}` : "";
   if (snapshot.healthy === false) {
+    const reason = daemonDegradedReason(snapshot);
     process.stderr.write(
-      `[prim] \u2717 daemon unhealthy${supervised ? " under launchd" : ""} \xB7 pid=${snapshot.pid}${team}
+      `[prim] \u2717 daemon unhealthy${supervised ? " under launchd" : ""} \xB7 pid=${snapshot.pid}${team}${reason ? ` \xB7 ${reason}` : ""}
 `
     );
     return;
@@ -3147,12 +3159,13 @@ function classifyDoctor(checks) {
     exitCode: status === "fail" ? EXIT_UNHEALTHY : 0
   };
 }
-function checkAuth() {
-  if (!getAuthToken()) {
+function classifyAuthCredential(credential, expiresAt, hasRefresh) {
+  if (!credential) {
     return { name: "auth", status: "fail", detail: "no token \u2014 run `prim auth login`" };
   }
-  const expiresAt = getTokenExpiresAt();
-  const hasRefresh = existsSync5(REFRESH_TOKEN_PATH);
+  if (credential.source !== "token_file") {
+    return { name: "auth", status: "ok", detail: "valid fixed bearer credential" };
+  }
   if (expiresAt !== void 0 && Date.now() >= expiresAt) {
     return hasRefresh ? { name: "auth", status: "warn", detail: "access token expired (refresh available)" } : {
       name: "auth",
@@ -3166,6 +3179,15 @@ function checkAuth() {
   const detail = expiresAt !== void 0 ? `valid (${String(Math.round((expiresAt - Date.now()) / MS_PER_SECOND))}s left)` : "valid";
   return { name: "auth", status: "ok", detail };
 }
+function checkAuth() {
+  const credential = resolveAuthCredential();
+  const storedCredential = credential?.source === "token_file";
+  return classifyAuthCredential(
+    credential,
+    storedCredential ? getTokenExpiresAt() : void 0,
+    storedCredential && existsSync5(REFRESH_TOKEN_PATH)
+  );
+}
 function classifyDaemonHealth(snapshot, options = {}) {
   if (options.disabled) {
     return {
@@ -3195,6 +3217,13 @@ function classifyDaemonHealth(snapshot, options = {}) {
       detail: `launchd does not own the daemon socket (launchd ${String(options.service.pid ?? "none")} \xB7 socket ${String(snapshot.pid ?? "none")})`
     };
   }
+  if (snapshot.needsReauth) {
+    return {
+      name: "daemon",
+      status: "fail",
+      detail: "authentication ended \u2014 run `prim auth login`"
+    };
+  }
   if (!snapshot.heartbeat?.healthy) {
     return {
       name: "daemon",
@@ -3463,15 +3492,15 @@ import {
   closeSync as closeSync3,
   existsSync as existsSync6,
   fsyncSync as fsyncSync2,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   openSync as openSync3,
   readFileSync as readFileSync5,
   renameSync as renameSync3,
-  rmSync as rmSync3,
-  writeFileSync as writeFileSync4
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { Document, parseDocument, stringify } from "yaml";
 var CAPTURE_BIN3 = "prim-hook";
 var GATE_BIN3 = "prim-pre-tool-use";
@@ -3660,12 +3689,12 @@ function setAutoAccept(raw) {
 `;
 }
 function atomicWriteFile(path, content) {
-  const dir = dirname4(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir)) {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
   }
   const tmp = `${path}.tmp.${String(process.pid)}`;
-  writeFileSync4(tmp, content, "utf-8");
+  writeFileSync3(tmp, content, "utf-8");
   const fd = openSync3(tmp, "r+");
   try {
     fsyncSync2(fd);
@@ -3685,15 +3714,15 @@ function assertMergeValid(before, after) {
 }
 function writeShim() {
   const path = shimPath();
-  const dir = dirname4(path);
+  const dir = dirname3(path);
   if (!existsSync6(dir)) {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
   }
-  writeFileSync4(path, SHIM_SCRIPT, "utf-8");
+  writeFileSync3(path, SHIM_SCRIPT, "utf-8");
   chmodSync2(path, SHIM_MODE);
 }
 function removeShim() {
-  rmSync3(shimPath(), { force: true });
+  rmSync2(shimPath(), { force: true });
 }
 function autoAcceptOf(raw) {
   if (raw.trim().length === 0) {
@@ -3801,9 +3830,9 @@ function registerHermesCommands(program2) {
 
 // src/commands/hooks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname5, join as join6, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolve2 } from "path";
 import { Option } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
@@ -3856,12 +3885,12 @@ function mergePrimBlock(hookPath, block, binName) {
     const existing = readFileSync6(hookPath, "utf-8");
     if (containsPrimHook(existing, binName)) return false;
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    writeFileSync5(hookPath, `${existing}${separator}${block}
+    writeFileSync4(hookPath, `${existing}${separator}${block}
 `, { mode: 493 });
     return true;
   }
-  mkdirSync6(dirname5(hookPath), { recursive: true });
-  writeFileSync5(hookPath, `#!/bin/sh
+  mkdirSync5(dirname4(hookPath), { recursive: true });
+  writeFileSync4(hookPath, `#!/bin/sh
 # ${PRIM_CREATED_MARK}
 
 ${block}
@@ -3924,7 +3953,7 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   const hooksDir = resolve2(gitRoot, ".git", "hooks");
   const hookPath = resolve2(hooksDir, spec.hookName);
   if (!existsSync7(hooksDir)) {
-    mkdirSync6(hooksDir, { recursive: true });
+    mkdirSync5(hooksDir, { recursive: true });
   }
   if (existsSync7(hookPath)) {
     const existing = readFileSync6(hookPath, "utf-8");
@@ -3936,7 +3965,7 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
     console.log("To replace it, run: prim hooks uninstall && prim hooks install");
     return;
   }
-  writeFileSync5(hookPath, dotGitScript(spec), { mode: 493 });
+  writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
 var PRIM_GIT_HOOKS_DIR = join6(homedir6(), ".config", "prim", "git-hooks");
@@ -4007,15 +4036,15 @@ function ownedHookNames() {
 }
 function writeOwnHooks() {
   if (!existsSync7(PRIM_GIT_HOOKS_DIR)) {
-    mkdirSync6(PRIM_GIT_HOOKS_DIR, { recursive: true });
+    mkdirSync5(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
-    writeFileSync5(resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
+    writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
       mode: 493
     });
   }
   for (const name of PASSTHROUGH_HOOKS) {
-    writeFileSync5(resolve2(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
+    writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
   }
 }
 function appendPrimBlock(hookPath, spec) {
@@ -4035,7 +4064,7 @@ function stripPrimBlock(hookPath, spec) {
     unlinkSync2(hookPath);
     return;
   }
-  writeFileSync5(hookPath, out, { mode: 493 });
+  writeFileSync4(hookPath, out, { mode: 493 });
 }
 function installGlobalHooks(opts = {}) {
   const global = gitConfigGet("--global");
@@ -4183,7 +4212,7 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/moves.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, unlinkSync as unlinkSync4, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
 import { join as join7 } from "path";
 
 // src/flusher.ts
@@ -4348,7 +4377,7 @@ var EVENT_COL_WIDTH = 20;
 var BUCKET_COL_WIDTH = 20;
 var TAIL_BUCKET_COL_WIDTH = 12;
 var DIR_MODE = 448;
-var FILE_MODE2 = 384;
+var FILE_MODE = 384;
 var WORKSPACE_FILE = ".prim/workspace.json";
 function registerMovesCommands(program2) {
   const moves = program2.command("moves").description("Decision Event Pipeline \u2014 local journal");
@@ -4414,11 +4443,11 @@ function registerMovesCommands(program2) {
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
     const dir = join7(process.cwd(), ".prim");
     if (!existsSync8(dir)) {
-      mkdirSync7(dir, { recursive: true, mode: DIR_MODE });
+      mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
     }
     const file = join7(process.cwd(), WORKSPACE_FILE);
-    writeFileSync6(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
-      mode: FILE_MODE2
+    writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
+      mode: FILE_MODE
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
@@ -4518,18 +4547,18 @@ function registerReconcileCommands(program2) {
 // src/commands/session.ts
 import {
   existsSync as existsSync9,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync7,
   readFileSync as readFileSync7,
   readdirSync,
   unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync6
 } from "fs";
 import { join as join8 } from "path";
 var DIR_MODE2 = 448;
-var FILE_MODE3 = 384;
+var FILE_MODE2 = 384;
 function ensureDir() {
   if (!existsSync9(SESSIONS_DIR)) {
-    mkdirSync8(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
+    mkdirSync7(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
   }
 }
 function markerPath(sessionId) {
@@ -4543,8 +4572,8 @@ function registerSessionCommands(program2) {
       orgId: opts.orgId,
       startedAt: Date.now()
     };
-    writeFileSync7(markerPath(sessionId), JSON.stringify(marker, null, 2), {
-      mode: FILE_MODE3
+    writeFileSync6(markerPath(sessionId), JSON.stringify(marker, null, 2), {
+      mode: FILE_MODE2
     });
     console.log(`[prim] session ${sessionId} bound to org ${opts.orgId}`);
   });
@@ -4684,7 +4713,17 @@ function resolveAgent(agentFlag, env) {
   }
   return { agent: detectAgent(env), detected: true };
 }
-function registerSetupCommand(program2) {
+function parseSetupAuthStatus(result) {
+  try {
+    const parsed = JSON.parse(result.stdout || "{}");
+    if (parsed.status === "valid" || parsed.authenticated === true) return "valid";
+    if (parsed.status === "unreachable") return "unreachable";
+    if (parsed.status === "invalid") return "invalid";
+  } catch {
+  }
+  return result.code === EXIT_USAGE3 ? "unreachable" : "invalid";
+}
+function registerSetupCommand(program2, dependencies = {}) {
   program2.command("setup").description(
     "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
   ).option("--agent <agent>", "claude, codex, or hermes (auto-detected when omitted)").option(
@@ -4701,50 +4740,64 @@ function registerSetupCommand(program2) {
         `[prim] unknown --agent "${agentInput}" (expected claude, codex, or hermes)
 `
       );
-      process.exit(EXIT_USAGE3);
+      (dependencies.exit ?? process.exit)(EXIT_USAGE3);
+      return;
     }
     if (opts.scope !== "project" && opts.scope !== "user") {
       process.stderr.write(`[prim] unknown --scope "${opts.scope}" (expected project or user)
 `);
-      process.exit(EXIT_USAGE3);
+      (dependencies.exit ?? process.exit)(EXIT_USAGE3);
+      return;
     }
     const agent = agentInput;
     const scope = opts.scope;
     const self = process.argv[1];
-    const run = (args, capture = false) => {
+    const run = dependencies.run ?? ((args, capture = false) => {
       const r = spawnSync2(process.execPath, [self, ...args], {
         stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
         encoding: "utf-8"
       });
       return { code: r.status ?? 1, stdout: capture ? r.stdout ?? "" : "" };
-    };
+    });
     const results = {};
-    const note = (msg) => {
+    const note = dependencies.note ?? ((msg) => {
       process.stderr.write(`[prim] ${msg}
 `);
-    };
-    const isAuthed = (json) => {
-      try {
-        return JSON.parse(json || "{}").authenticated === true;
-      } catch {
-        return false;
-      }
-    };
+    });
+    const exit = dependencies.exit ?? process.exit;
     if (detected && agent !== "claude") {
       note(`agent \xB7 detected ${agent} session (override with --agent <agent>)`);
     }
+    let authStatus = parseSetupAuthStatus(run(["auth", "status", "--json"], true));
+    if (authStatus === "unreachable") {
+      note("auth \xB7 verification unavailable; no setup changes were made");
+      exit(EXIT_USAGE3);
+      return;
+    }
+    if (authStatus === "invalid") {
+      note("auth \xB7 opening browser to authenticate\u2026");
+      const login = run(["auth", "login"]);
+      if (login.code !== 0) {
+        note("auth \xB7 login failed; no integration changes were made");
+        exit(EXIT_INCOMPLETE);
+        return;
+      }
+      authStatus = parseSetupAuthStatus(run(["auth", "status", "--json"], true));
+      if (authStatus !== "valid") {
+        note(
+          authStatus === "unreachable" ? "auth \xB7 login completed but verification is unavailable; no integration changes were made" : "auth \xB7 login did not produce valid credentials; no integration changes were made"
+        );
+        exit(authStatus === "unreachable" ? EXIT_USAGE3 : EXIT_INCOMPLETE);
+        return;
+      }
+    } else {
+      note("auth \xB7 already authenticated");
+    }
+    results.auth = "ok";
     if (agent === "claude") {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
     }
-    if (isAuthed(run(["auth", "status", "--json"], true).stdout)) {
-      note("auth \xB7 already authenticated");
-      results.auth = "ok";
-    } else {
-      note("auth \xB7 opening browser to authenticate\u2026");
-      run(["auth", "login"]);
-      results.auth = isAuthed(run(["auth", "status", "--json"], true).stdout) ? "ok" : "failed";
-    }
     for (const step of planSetupSteps({ agent, daemon: opts.daemon, scope })) {
       note(`${step.label} \xB7 installing\u2026`);
       const { code } = run(step.args);
@@ -4769,7 +4822,7 @@ function registerSetupCommand(program2) {
     note(
       `setup ${failed.length === 0 ? "complete" : `incomplete (failed: ${failed.join(", ")})`} \u2014 ${trail}`
     );
-    process.exit(failed.length === 0 ? 0 : EXIT_INCOMPLETE);
+    exit(failed.length === 0 ? 0 : EXIT_INCOMPLETE);
   });
 }
 
@@ -4781,19 +4834,19 @@ import {
   openSync as openSync4,
   readFileSync as readFileSync10,
   renameSync as renameSync5,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname7, join as join11, resolve as resolve4 } from "path";
+import { dirname as dirname6, join as join11, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
 
 // src/commands/claude-plugin.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync9, readdirSync as readdirSync2, rmSync as rmSync4, rmdirSync } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync9, readdirSync as readdirSync2, rmSync as rmSync3, rmdirSync } from "fs";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname6, join as join10, resolve as resolve3 } from "path";
+import { dirname as dirname5, join as join10, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
-var __dirname = dirname6(fileURLToPath(import.meta.url));
+var __dirname = dirname5(fileURLToPath(import.meta.url));
 var PLUGIN_DESCRIPTION = "Primitive decision-graph guidance for the prim CLI \u2014 a model-invoked skill installed by prim skill install.";
 function resolvePluginDir(cwd, scope) {
   if (scope && scope !== "user" && scope !== "project") {
@@ -4805,10 +4858,10 @@ function resolvePluginDir(cwd, scope) {
 }
 function packageVersion() {
   let dir = __dirname;
-  while (dir !== dirname6(dir)) {
+  while (dir !== dirname5(dir)) {
     const p = resolve3(dir, "package.json");
     if (existsSync11(p)) return JSON.parse(readFileSync9(p, "utf-8")).version;
-    dir = dirname6(dir);
+    dir = dirname5(dir);
   }
   return "0.0.0";
 }
@@ -4842,7 +4895,7 @@ function installClaudePlugin(cwd, opts) {
     console.log(`Would write plugin to ${dir} (.claude-plugin/plugin.json + SKILL.md)`);
     return 0;
   }
-  mkdirSync9(join10(dir, ".claude-plugin"), { recursive: true });
+  mkdirSync8(join10(dir, ".claude-plugin"), { recursive: true });
   atomicWrite3(manifestPath, manifest);
   atomicWrite3(skillPath, skill);
   console.log(`Installed prim skill plugin at ${dir}`);
@@ -4860,8 +4913,8 @@ function uninstallClaudePlugin(cwd, opts) {
     console.log(`prim skill plugin not present at ${dir}`);
     return 0;
   }
-  rmSync4(manifestPath, { force: true });
-  rmSync4(skillPath, { force: true });
+  rmSync3(manifestPath, { force: true });
+  rmSync3(skillPath, { force: true });
   removeDirIfEmpty(join10(dir, ".claude-plugin"));
   removeDirIfEmpty(dir);
   console.log(`Removed prim skill plugin from ${dir}`);
@@ -4885,7 +4938,7 @@ function statusClaudePlugin(cwd, opts) {
 }
 
 // src/commands/skill.ts
-var __dirname2 = dirname7(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname6(fileURLToPath2(import.meta.url));
 var SKILL_BEGIN = "<!-- BEGIN PRIM SKILL v1 -->";
 var SKILL_END = "<!-- END PRIM SKILL v1 -->";
 var TARGET_CANDIDATES = [
@@ -4912,10 +4965,10 @@ function userTargetFor(agent) {
 }
 function loadSkill() {
   let dir = __dirname2;
-  while (dir !== dirname7(dir)) {
+  while (dir !== dirname6(dir)) {
     const p = resolve4(dir, "SKILL.md");
     if (existsSync12(p)) return readFileSync10(p, "utf-8");
-    dir = dirname7(dir);
+    dir = dirname6(dir);
   }
   throw new Error("SKILL.md not found in package");
 }
@@ -4948,7 +5001,7 @@ function removeBlock(existing) {
 }
 function atomicWrite3(target, content) {
   const tmp = `${target}.tmp`;
-  writeFileSync8(tmp, content);
+  writeFileSync7(tmp, content);
   const fd = openSync4(tmp, "r+");
   try {
     fsyncSync3(fd);
@@ -5069,13 +5122,13 @@ function registerSkillCommands(program2) {
 
 // src/commands/statusline.ts
 import { readFileSync as readFileSync11 } from "fs";
-import { dirname as dirname8, resolve as resolve5 } from "path";
+import { dirname as dirname7, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 var STATUSLINE_NAME_CAP = 3;
 function readPackageVersion() {
   try {
-    const here = dirname8(fileURLToPath3(import.meta.url));
+    const here = dirname7(fileURLToPath3(import.meta.url));
     const candidates = [
       // The supervised runtime stages a tiny manifest beside the standalone
       // statusline bundle, so it remains versioned without loading the package.
@@ -5268,7 +5321,7 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
 }
 
 // src/index.ts
-var __dirname3 = dirname9(fileURLToPath4(import.meta.url));
+var __dirname3 = dirname8(fileURLToPath4(import.meta.url));
 var pkg = JSON.parse(readFileSync12(resolve6(__dirname3, "../package.json"), "utf-8"));
 updateNotifier({ pkg }).notify();
 var program = new Command();