@primitive.ai/prim 0.1.0-alpha.56 → 0.1.0-alpha.57

package/dist/index.js

@@ -25,7 +25,7 @@ import {
 import {
   printJson,
   registerSkillCommands
-} from "./chunk-ROL7SDXX.js";
+} from "./chunk-GQURYENF.js";
 import {
   fetchFeedbackCapability
 } from "./chunk-WELBNODJ.js";
@@ -36,16 +36,21 @@ import {
   binFile,
   commandMatchesBin,
   detachedHookShimCommand,
-  hookShimCommand,
+  packageVersion,
+  pinnedHookCommand,
   warmBinCache
-} from "./chunk-HSZPTVKU.js";
+} from "./chunk-YIMUIPMD.js";
 import {
-  activateRepoBestEffort,
+  canonicalGitRoot,
+  canonicalRepositoryPath,
   decisionIngestionStatus,
   gitToplevel,
+  githubRepositoryFullName,
   isRepoActiveForCapture,
-  setRepoActive
-} from "./chunk-R5ZJRSLV.js";
+  repoSyncId,
+  setRepoActive,
+  setRepoSyncId
+} from "./chunk-LDQZASIF.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -74,7 +79,7 @@ import { Command } from "commander";
 import updateNotifier from "update-notifier";
 
 // src/commands/activation.ts
-function applyActivation(active) {
+async function applyActivation(active) {
   const root = gitToplevel();
   if (!root) {
     process.stderr.write(
@@ -84,16 +89,33 @@ function applyActivation(active) {
     process.exit(1);
   }
   try {
-    setRepoActive(process.cwd(), active);
+    let bound;
+    if (active) {
+      const repositoryFullName = githubRepositoryFullName(root);
+      if (!repositoryFullName) {
+        throw new Error("origin must be a GitHub HTTPS/SSH remote in owner/name form");
+      }
+      const response = await getClient().post("/api/cli/repositories/bind", {
+        repositoryFullName
+      });
+      if (typeof response.repoSyncId !== "string" || response.repoSyncId.length === 0) {
+        throw new Error("server returned no repository binding");
+      }
+      setRepoSyncId(root, response.repoSyncId);
+      bound = { repoSyncId: response.repoSyncId, repositoryFullName };
+    }
+    setRepoActive(root, active);
+    process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+    printJson({ active, repo: root, ...bound });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`[prim] failed to set prim.active: ${detail}
-`);
+    process.stderr.write(
+      `[prim] failed to ${active ? "bind and enable" : "disable"} prim: ${detail}
+`
+    );
     process.exit(1);
   }
-  process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
-`);
-  printJson({ active, repo: root });
 }
 function registerActivationCommands(program2) {
   program2.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action(() => applyActivation(true));
@@ -1068,7 +1090,7 @@ var SESSION_START_BIN = "prim-session-start";
 var SESSION_END_BIN = "prim-session-end";
 var STATUSLINE_BIN = "prim";
 var STATUSLINE_ARGS = "statusline";
-var STATUSLINE_COMMAND = hookShimCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
+var STATUSLINE_COMMAND = pinnedHookCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
 var STATUSLINE_REFRESH_SECONDS = 5;
 var PRIM_BINS = [
   CAPTURE_BIN,
@@ -1092,8 +1114,13 @@ var CAPTURE_EVENTS = [
   "SessionEnd",
   "SubagentStop"
 ];
-function makeRegistration(event, matcher, bin, args = "", opts = {}) {
-  return { event, matcher, bin, command: hookShimCommand(bin, args, opts) };
+function makeRegistration(event, matcher, bin, args = "") {
+  return {
+    event,
+    matcher,
+    bin,
+    command: pinnedHookCommand(bin, args)
+  };
 }
 function makeDetachedRegistration(event, matcher, bin, args = "") {
   return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
@@ -1102,11 +1129,9 @@ var REGISTRATIONS = [
   ...CAPTURE_EVENTS.map(
     (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
   ),
-  makeRegistration("PreToolUse", "Edit|Write|MultiEdit", GATE_BIN),
-  makeRegistration("PostToolUse", "Edit|Write|MultiEdit", POST_TOOL_USE_BIN),
-  // Bare ladder (no branch-0): SessionStart must re-resolve @latest each session
-  // to refresh the bin cache the other hooks read. See lib/bin-cache.ts.
-  makeRegistration("SessionStart", "*", SESSION_START_BIN, "", { cacheRead: false }),
+  makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
+  makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
+  makeRegistration("SessionStart", "*", SESSION_START_BIN),
   makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
 ];
 var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
@@ -1347,9 +1372,6 @@ function performInstall(scope, force) {
   if (changed) {
     atomicWrite2(path, after);
   }
-  if (scope === "project") {
-    activateRepoBestEffort(process.cwd());
-  }
   return {
     scope,
     path,
@@ -1507,9 +1529,7 @@ var CODEX_REGISTRATIONS = [
   ...CODEX_CAPTURE_EVENTS.map((event) => makeRegistration(event, "*", CAPTURE_BIN2, CODEX_ARGS)),
   makeRegistration("PreToolUse", "apply_patch", GATE_BIN2, CODEX_ARGS),
   makeRegistration("PostToolUse", "apply_patch", POST_TOOL_USE_BIN2, CODEX_ARGS),
-  // Bare ladder (no branch-0): SessionStart re-resolves @latest each session to
-  // refresh the bin cache the other hooks read. See lib/bin-cache.ts.
-  makeRegistration("SessionStart", "*", SESSION_START_BIN2, CODEX_ARGS, { cacheRead: false })
+  makeRegistration("SessionStart", "*", SESSION_START_BIN2, CODEX_ARGS)
 ];
 var USER_SCOPE_PATH2 = join3(homedir3(), ".codex", "hooks.json");
 var projectScopePath2 = () => join3(projectRoot(), ".codex", "hooks.json");
@@ -1562,9 +1582,6 @@ function performInstall2(scope, force) {
   if (changed) {
     atomicWrite2(path, after);
   }
-  if (scope === "project") {
-    activateRepoBestEffort(process.cwd());
-  }
   return resultFor(scope, path, after, changed);
 }
 function performUninstall2(scope) {
@@ -2775,7 +2792,9 @@ function toRequestBody(request) {
     alternatives: request.alternatives,
     confidence: request.confidence,
     reversibility: request.reversibility,
-    files: request.files
+    files: request.files,
+    protocolVersion: request.protocolVersion,
+    repoSyncId: request.repoSyncId
   };
   const body = {};
   for (const [key, value] of Object.entries(candidate)) {
@@ -3115,10 +3134,29 @@ function registerDecisionsCommands(program2) {
   ).option("--kind <kind>", "change | exploration | task_execution | unclear (default change)").option("--rationale <text>", "Why the decision was made").option(
     "--area <area>",
     "Functional area (auth, data, infra, ui, api, billing, mobile, docs, testing)"
-  ).option("--decided <items>", "Comma-separated option(s) chosen").option("--alternatives <items>", "Comma-separated options considered but rejected").option("--confidence <level>", "high | medium | low (default high)").option("--reversibility <level>", "high | low (default high)").option(
-    "--files <paths>",
-    "Comma-separated repo-relative paths this decision governs (the files Conflict Gates would check \u2014 not currently enabled)"
-  ).action(async (opts, command) => {
+  ).option("--decided <items>", "Comma-separated option(s) chosen").option("--alternatives <items>", "Comma-separated options considered but rejected").option("--confidence <level>", "high | medium | low (default high)").option("--reversibility <level>", "high | low (default high)").option("--files <paths>", "Comma-separated exact repo-relative paths this decision governs").action(async (opts, command) => {
+    const requestedFiles = splitList(opts.files);
+    let explicitScope = {};
+    if (requestedFiles.length > 0) {
+      const binding = repoSyncId(process.cwd());
+      const root = canonicalGitRoot(process.cwd());
+      const canonical = requestedFiles.map(
+        (path) => canonicalRepositoryPath(path, root ?? process.cwd(), root)
+      );
+      if (!binding || canonical.some((path) => !path)) {
+        console.error(
+          "[prim] scoped decision rejected: run `prim enable` and provide exact in-repository file paths"
+        );
+        console.log(JSON.stringify({ ok: false, error: "invalid_repository_scope" }, null, 2));
+        process.exitCode = EXIT_USAGE;
+        return;
+      }
+      explicitScope = {
+        protocolVersion: 3,
+        repoSyncId: binding,
+        files: canonical
+      };
+    }
     if (!isRepoActiveForCapture(process.cwd())) {
       const globals = command.optsWithGlobals();
       const nonInteractive = isNonInteractive(globals);
@@ -3141,7 +3179,7 @@ function registerDecisionsCommands(program2) {
       alternatives: splitList(opts.alternatives),
       confidence: opts.confidence,
       reversibility: opts.reversibility,
-      files: splitList(opts.files)
+      ...explicitScope
     };
     try {
       const outcome = await fetchCreate(request);
@@ -3562,13 +3600,19 @@ var HERMES_ARGS = "--agent hermes";
 var EDIT_MATCHER = "write_file|patch";
 var JSON_INDENT3 = 2;
 var SHIM_MODE = 493;
-var PRIM_BINS3 = [
-  CAPTURE_BIN3,
-  GATE_BIN3,
-  POST_TOOL_USE_BIN3,
-  SESSION_START_BIN3,
-  SESSION_END_BIN2
-];
+var PRIM_BINS3 = [CAPTURE_BIN3, GATE_BIN3, POST_TOOL_USE_BIN3, SESSION_START_BIN3, SESSION_END_BIN2];
+var PINNED_VERSION = packageVersion();
+if (!PINNED_VERSION) throw new Error("cannot determine Primitive package version");
+var sh = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
+var PINNED_NODE = sh(process.execPath);
+var PINNED_CASES = PRIM_BINS3.map((bin) => {
+  const file = binFile(bin);
+  if (!file) throw new Error(`cannot locate Primitive hook binary: ${bin}`);
+  return `  ${bin})
+    if [ -x ${PINNED_NODE} ] && [ -f ${sh(file)} ]; then exec ${PINNED_NODE} ${sh(file)} "$@"; fi
+    exec npx --yes -p @primitive.ai/prim@${PINNED_VERSION} "$bin" "$@"
+    ;;`;
+}).join("\n");
 function hermesHome() {
   return process.env.HERMES_HOME ?? join5(homedir5(), ".hermes");
 }
@@ -3580,17 +3624,13 @@ function shimPath() {
 }
 var SHIM_SCRIPT = `#!/bin/sh
 # prim Hermes hook shim \u2014 managed by \`prim hermes install\`. Hermes runs hooks
-# with shell=False, so the PATH \u2192 local node_modules \u2192 npx @latest resolution a
-# shell does for the Claude Code / Codex installs lives here instead.
+# with shell=False, so exact package entrypoints are selected here.
 bin="$1"
 shift
-if command -v "$bin" >/dev/null 2>&1; then
-  exec "$bin" "$@"
-fi
-if [ -x "./node_modules/.bin/$bin" ]; then
-  exec "./node_modules/.bin/$bin" "$@"
-fi
-exec npx --yes -p @primitive.ai/prim@latest "$bin" "$@"
+case "$bin" in
+${PINNED_CASES}
+esac
+exit 64
 `;
 function commandFor(bin) {
   return `"${shimPath()}" ${bin} ${HERMES_ARGS}`;
@@ -3899,13 +3939,7 @@ var PRIM_BLOCK_END = blockMarkers(PRE_COMMIT).end;
 var PRIM_MANAGED_MARK = "prim-managed-hook";
 var PRIM_CREATED_MARK = "prim-created-hook";
 function hookShim(binName) {
-  return `if command -v ${binName} >/dev/null 2>&1; then
-  ${binName} || true
-elif [ -f "./node_modules/.bin/${binName}" ]; then
-  ./node_modules/.bin/${binName} || true
-else
-  npx --yes -p @primitive.ai/prim ${binName} 2>/dev/null || true
-fi`;
+  return `{ ${pinnedHookCommand(binName)}; } || true`;
 }
 function gatedShim(binName) {
   return `if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
@@ -4170,7 +4204,6 @@ function installHooks(gitRoot, target) {
       installToDotGit(gitRoot, spec);
     }
   }
-  activateRepoBestEffort(gitRoot);
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
@@ -4712,9 +4745,12 @@ function planSetupSteps(opts) {
   });
   const skillArgs = ["skill", "install", "--agent", opts.agent, ...scopeArgs];
   steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
-  if (opts.scope === "user") {
-    steps.push({ key: "enable", label: "Activate this repo", args: ["enable"], required: false });
-  }
+  steps.push({
+    key: "enable",
+    label: "Bind and activate this repo",
+    args: ["enable"],
+    required: true
+  });
   return steps;
 }
 var CONFLICT_SESSION = "session";

package/dist/statusline-main.js

@@ -2,7 +2,7 @@
 
 // src/commands/statusline.ts
 import { readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname4, resolve as resolve2 } from "path";
+import { dirname as dirname5, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/client.ts
@@ -63,7 +63,7 @@ function daemonRequest(method, params = {}, opts = {}) {
   const id = nextRequestId++;
   const request = { id, method, params };
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let settled = false;
     let socket;
     let buffer = "";
@@ -78,7 +78,7 @@ function daemonRequest(method, params = {}, opts = {}) {
         } catch {
         }
       }
-      resolve3(value);
+      resolve4(value);
     };
     const timer = setTimeout(() => settle(null), timeoutMs);
     timer.unref();
@@ -140,6 +140,8 @@ import { join as join4 } from "path";
 
 // src/lib/git.ts
 import { execFileSync } from "child_process";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname as dirname3, isAbsolute, relative, resolve as resolve2, sep } from "path";
 function gitToplevel(cwd) {
   try {
     return execFileSync("git", ["rev-parse", "--show-toplevel"], {
@@ -202,7 +204,7 @@ import { join as join6 } from "path";
 
 // src/lib/bin-path.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3, isAbsolute, join as join5 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 var PKG_NAME = "@primitive.ai/prim";
 var NPX_FALLBACK = `npx --yes -p ${PKG_NAME}@latest`;
@@ -271,13 +273,13 @@ var STATUSLINE_TIMEOUT_MS = 200;
 var STATUSLINE_NAME_CAP = 3;
 function readPackageVersion() {
   try {
-    const here = dirname4(fileURLToPath2(import.meta.url));
+    const here = dirname5(fileURLToPath2(import.meta.url));
     const candidates = [
       // The supervised runtime stages a tiny manifest beside the standalone
       // statusline bundle, so it remains versioned without loading the package.
-      resolve2(here, "manifest.json"),
-      resolve2(here, "../../package.json"),
-      resolve2(here, "../package.json")
+      resolve3(here, "manifest.json"),
+      resolve3(here, "../../package.json"),
+      resolve3(here, "../package.json")
     ];
     for (const path of candidates) {
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.56",
+  "version": "0.1.0-alpha.57",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",
@@ -62,6 +62,7 @@
   "dependencies": {
     "commander": "^12.1.0",
     "diff": "^5.2.0",
+    "unbash": "4.0.3",
     "update-notifier": "^7.3.1",
     "yaml": "^2.9.0"
   },

package/dist/chunk-R5ZJRSLV.js

@@ -1,82 +0,0 @@
-// src/lib/activation.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-
-// src/lib/git.ts
-import { execFileSync } from "child_process";
-function gitToplevel(cwd) {
-  try {
-    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-
-// src/lib/activation.ts
-var PRIM_ACTIVE_KEY = "prim.active";
-var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
-var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
-function repoActiveFlag(cwd) {
-  try {
-    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (value === "true") return "true";
-    if (value === "false") return "false";
-    return void 0;
-  } catch {
-    return void 0;
-  }
-}
-function setRepoActive(cwd, active) {
-  execFileSync2("git", ["config", "--local", PRIM_ACTIVE_KEY, active ? "true" : "false"], {
-    cwd,
-    stdio: ["ignore", "ignore", "pipe"]
-  });
-}
-function activateRepoBestEffort(cwd) {
-  try {
-    setRepoActive(cwd, true);
-  } catch {
-  }
-}
-function hasProjectPrimInstall(cwd) {
-  const root = gitToplevel(cwd);
-  if (root === null || root === homedir()) return false;
-  for (const rel of PROJECT_INSTALL_FILES) {
-    const path = join(root, rel);
-    if (existsSync(path)) {
-      try {
-        const content = readFileSync(path, "utf-8");
-        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
-      } catch {
-      }
-    }
-  }
-  return false;
-}
-function isRepoActiveForCapture(cwd) {
-  const flag = repoActiveFlag(cwd);
-  if (flag === "true") return true;
-  if (flag === "false") return false;
-  return hasProjectPrimInstall(cwd);
-}
-function decisionIngestionStatus(cwd) {
-  return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
-}
-
-export {
-  gitToplevel,
-  setRepoActive,
-  activateRepoBestEffort,
-  isRepoActiveForCapture,
-  decisionIngestionStatus
-};