@primitive.ai/prim 0.1.0-alpha.56 → 0.1.0-alpha.58

package/README.md

@@ -9,10 +9,9 @@ presence — from the command line and via session + git hooks.
 
 > [!NOTE]
 > **Conflict Gates** check each edit against the decision graph and surface any
-> load-bearing decision it conflicts with; their **Enforcement** tier blocks or pauses
-> a conflicting edit until you reconcile and retry. Conflict Gates are **not currently
-> enabled** — automatic decision capture in active repos runs regardless. To enable them
-> for your team, contact **support@getprimitive.ai**.
+> load-bearing decision it conflicts with. When **Enforcement** is enabled for your
+> organization, gates can warn, pause, or block a conflicting edit until you reconcile
+> the decision and retry. Automatic decision capture in active repositories is separate.
 
 ## Installation
 
@@ -197,7 +196,7 @@ installation.
 ### Daemon
 
 A supervised long-lived companion process that continuously drains captured
-Moves, accelerates in-session decision checks, and powers the "team: N online"
+Moves, accelerates decision-graph reads, and powers the "team: N online"
 presence count. `prim setup` requires it to become healthy unless the explicit
 `--no-daemon` opt-out is supplied; hooks still fail soft if it later degrades.
 
@@ -249,8 +248,8 @@ would create a cycle (exit 2); an unresolved id exits 4.
 prim reconcile <id>    # Mint a single-use bypass for a decision Conflict Gates flagged
 ```
 
-Part of Conflict Gates **Enforcement**, which is not currently enabled (see the note
-at the top). Contact support@getprimitive.ai to enable it.
+When Conflict Gates **Enforcement** is enabled for your organization, this command
+authorizes one retry for the named decision.
 
 ### Hooks
 

package/SKILL.md

@@ -9,7 +9,7 @@ description: Use the prim CLI for Primitive’s decision graph. MUST INVOKE befo
 
 ## Mental model
 
-In an active repo, prim passively captures the **decisions** your team makes -- which library, which pattern, which config value -- into a queryable graph, and links them: a decision can depend on earlier decisions (auto-linked from shared files, or related by hand — see *Relate decisions*) and reference the files it touched. **Conflict Gates** can check a later change against that graph and surface any load-bearing decision it conflicts with; with **Enforcement**, prim blocks the edit until you reconcile the decision and retry. Conflict Gates are **not currently enabled** — capture in active repos runs regardless. To enable them for your team, contact support@getprimitive.ai.
+In an active repo, prim passively captures the **decisions** your team makes -- which library, which pattern, which config value -- into a queryable graph, and links them: a decision can depend on earlier decisions (auto-linked from shared files, or related by hand — see *Relate decisions*) and reference the files it touched. **Conflict Gates** can check a later change against that graph and surface any load-bearing decision it conflicts with. When **Enforcement** is enabled for an organization, prim can warn, pause, or block the edit until you reconcile the decision and retry. Capture in active repos runs independently.
 
 Low-level capture runs automatically in active repos through the session hooks installed by `npx --yes @primitive.ai/prim claude install` (Claude Code), `npx --yes @primitive.ai/prim codex install` (Codex), or `npx --yes @primitive.ai/prim hermes install` (Hermes). An inactive repo is not passively captured. Deliberately record higher-order forks in the road through `prim decisions create` as described below. Your job is also to **read** the graph before load-bearing edits and **answer** the occasional rationale confirmation. (Responding to Conflict Gates applies only once Enforcement is enabled — see below.)
 
@@ -32,17 +32,17 @@ The CLI auto-refreshes a still-valid session from the stored refresh token (proa
 3. `<idOrShortId>` arguments accept either a full decision ID or the short ID shown in feeds (and gate reasons, when Conflict Gates are enabled).
 4. In `npx --yes @primitive.ai/prim ...`, `npx --yes` is npm's flag and only skips npm's package-install confirmation. It is not user consent for a Primitive action. Prim's global flag appears after the package name: `npx --yes @primitive.ai/prim --yes ...`.
 
-## Conflict Gates & Enforcement (not currently enabled)
+## Conflict Gates & Enforcement
 
-**Conflict Gates** check each edit against the decision graph before it lands and surface any load-bearing decision it conflicts with. Their **Enforcement** tier goes further -- a conflicting edit is blocked (or paused for confirmation) until you reconcile the decision and retry. **Conflict Gates are not currently enabled** — automatic decision capture in active repos (above) runs regardless. To enable Conflict Gates and Enforcement for your team, contact support@getprimitive.ai.
+**Conflict Gates** check each edit against the decision graph before it lands and surface any load-bearing decision it conflicts with. When **Enforcement** is enabled for an organization, a conflicting edit can be warned, blocked, or paused for confirmation until you reconcile the decision and retry. Automatic decision capture in active repos (above) runs independently.
 
 When Enforcement is enabled, before an edit (Claude Code: Edit/Write/MultiEdit; Codex: apply_patch; Hermes: write_file/patch) a PreToolUse hook scores the target file against the graph:
 
 - **deny** -- the edit is blocked: it conflicts with a load-bearing prior decision. Don't fight it. Read the reason line; it names the decision id. If you genuinely intend to override that decision, run `npx --yes @primitive.ai/prim reconcile dec_<shortId>`, then retry the edit once. Otherwise choose an approach that respects the decision.
-- **warn / additional context** -- the edit proceeds, but a relevant prior decision is surfaced. Read it. On Codex a would-be `ask` is delivered as allow-plus-context (Codex can't pause mid-tool), so that context is your only signal -- read it before continuing. Hermes has no soft-confirm tier, so a would-be `ask` arrives as a **deny** carrying the same reconcile directive: reconcile and retry, or set `PRIM_HOOK_MODE=warn` to downgrade it to context-only.
+- **warn / additional context** -- the edit proceeds, but a relevant prior decision is surfaced. Read it. Codex cannot pause mid-tool, so a would-be `ask` arrives as a **deny** carrying the reconcile directive. Hermes also has no soft-confirm tier, so a would-be `ask` arrives as a **deny** carrying the same directive: reconcile and retry, or set `PRIM_HOOK_MODE=warn` to downgrade it to context-only.
 - **"decision check skipped / not verified" or "... partial / truncated"** -- the check could not fully run. Treat constraints as UNKNOWN, not clear; never read silence as approval.
 
-When enabled, the gate fail-opens on its *own* infrastructure errors (no daemon, network blip, org-unbound token) -- a setup problem would not block your edit. That is why an "unavailable" note would matter: it is the honest signal that the check, not your edit, is what failed.
+When enabled, the gate sends its preflight check directly to Primitive and fail-opens on infrastructure errors (for example, a network failure or org-unbound token) -- a service problem would not block your edit. That is why an "unavailable" note matters: it is the honest signal that the check, not your edit, is what failed.
 
 ## Read the graph before large or load-bearing edits
 
@@ -56,7 +56,7 @@ Then tailor the delivery to this requester, not a generic reader. Take your cues
 
 ## Reconcile and the verdict footer
 
-Reconcile and the verdict footer are part of Conflict Gates **Enforcement**, which is **not currently enabled** (contact support@getprimitive.ai to turn it on); the `reconcile` command stays available regardless. When Enforcement is on:
+Reconcile and the verdict footer are part of Conflict Gates **Enforcement**; the `reconcile` command stays available regardless. When Enforcement is enabled for your organization:
 
 `npx --yes @primitive.ai/prim reconcile <idOrShortId>` mints a single-use bypass for the named decision -- it prints `[prim] reconcile bypass issued for dec_<short> (expires in ...)` to STDERR, with the bypass JSON on STDOUT. Your *next* edit to the governed file then goes through, and on that edit prim prints a verdict footer to STDERR -- confirmation the override was recorded, not silently dropped:
 
@@ -107,7 +107,7 @@ an explicit local `prim.active=false` is always inactive. Every
 
 - An explicit request to record or create that Decision is approval for that one
   invocation; do not ask redundantly.
-- For a proactively identified Decision, present the proposed intent and supported
+- For a proactively identified Decision, present the proposed decision and supported
   rationale — folding the single rationale question into the same prompt when none
   was found — then wait for approval before creating it. A previous approval never
   carries forward to another Decision.
@@ -144,25 +144,15 @@ Treat changes to shared agent instructions and standards—such as `AGENTS.md`,
 
 Apply the same attention during non-code deliberation: planning or “grill me” workflows, spec refinement, behavior design, PR planning or review, and conversations imported from Granola or other connected sources. These workflows can settle important forks before any code changes. Accumulate the confirmed decisions and record them at a natural phase or task boundary; do not interrupt or call Primitive after every answer.
 
-### Onboarding: propose decisions from shared repository memory
+### Onboarding: seed the graph from memory, one proposal at a time
 
-When onboarding or `prim welcome` reports `"org": "seed"`, complete this procedure before falling back to the open goals question. Do not treat memory already loaded into the conversation as a substitute for the repository scan. This is a separate decision-proposal pass: do not present repository rules as the user's stated goals or insert them into `$FOUND_GOALS`.
+When onboarding or `prim welcome` reports `"org": "seed"`, seed the viewer's graph by proposing decisions mined from memory. There is no open goals question: the proposals are the whole seeding pass. Propose **one decision per message**, wait for the user's verdict, and only then present the next — never present the candidates as a batch.
 
-1. From the repository root, discover every Git-tracked shared memory or agent-instruction file with:
-
-   ```
-   git ls-files -- \
-     'MEMORY.md' ':(glob)**/MEMORY.md' \
-     'AGENTS.md' ':(glob)**/AGENTS.md' \
-     'CLAUDE.md' ':(glob)**/CLAUDE.md'
-   ```
-
-2. Read every path returned before selecting candidates. Never automatically read an untracked or gitignored memory file; use one only when the user explicitly asks to promote it to the team's Primitive graph.
-3. Extract at most three explicit, durable positions that appear to remain in force. A candidate must state a genuine fork in the road—such as a goal, priority, principle, invariant, constraint, default, commitment, tradeoff, or exception. Do not infer decisions from code, repository structure, or unstated implications. Do not bulk-import the documents.
-4. Run `npx --yes @primitive.ai/prim decisions recent --limit 20` and omit candidates equivalent to existing decisions. If the result is unavailable or too incomplete to rule out a duplicate confidently, do not propose the uncertain candidate; explain the limitation.
-5. Present the remaining candidates as proposed decisions. For each one, include the proposed intent, the source path, and only rationale or alternatives explicitly supported by that source; when a source yields no rationale, ask for the why in the same approval prompt. Ask the user to approve or revise the proposals before creating them; do not silently attribute a historical repository decision to the onboarding user.
-
-If the scan returns no matching files or no eligible candidates, say so briefly and continue with the normal open onboarding question. Never invent a proposal to fill the gap.
+1. Gather candidates from the repo's Git-tracked shared memory and agent-instruction files (`git ls-files -- 'MEMORY.md' ':(glob)**/MEMORY.md' 'AGENTS.md' ':(glob)**/AGENTS.md' 'CLAUDE.md' ':(glob)**/CLAUDE.md'` from the repository root; read every path returned) and from your own memory and conversation context — positions the user has already *stated*; the setup guide names each agent's memory surface. Never automatically read an untracked, gitignored, or un-shared memory source; use one only when the user explicitly asks to promote it. Only their words count: never infer a position from the repo's code or history, and never invent one they didn't state.
+2. A candidate must state an explicit, durable position that appears to remain in force — a genuine fork in the road such as a goal, priority, principle, invariant, constraint, default, commitment, tradeoff, or exception. Do not infer decisions from code, repository structure, or unstated implications, and do not bulk-import the documents. The personal-environment exclusion above applies: never propose a position that binds no teammate.
+3. Run `npx --yes @primitive.ai/prim decisions recent --limit 20` and drop candidates equivalent to existing decisions. If the result is unavailable or too incomplete to rule out a duplicate confidently, drop the uncertain candidate; explain the limitation.
+4. Propose the strongest candidates one at a time — **at most six in total**, fewer when the material runs out (never invent a proposal to fill the quota), stopping early if the user declines to continue. Each proposal carries the proposed decision, its source (file path or the stated context), and only rationale or alternatives explicitly supported by that source; when the source yields no rationale, fold the single rationale question into the same prompt. In this and any user-facing presentation, label the position **Decision**, never "Intent" — intent is `--intent` flag vocabulary, not user copy — and label the rejected options **Alternatives rejected**, never "alternatives considered". Make clear, at least on the first proposal, that approved decisions join the team's shared decision graph, visible to any teammates — not a private list. Ask the user to approve, revise, or reject it — do not silently attribute a historical repository position to the onboarding user — and create each approved decision (per the wording and flag rules below) before presenting the next.
+5. After the final proposal's verdict — or immediately, when there are no viable candidates (say so briefly) — close with the standing guidance from welcome's STDOUT `seedGuidance` field: the user can tell their agent to add any decision to the Primitive decision graph at any time; otherwise, once the agent's prim hooks are active, Primitive passively captures decisions in the background while they work; and other repositories are captured only after `prim enable` is run in each. On an older CLI without that field, state those three points yourself.
 
 Outside onboarding, before creating a proactively identified decision, read recent decisions to avoid duplicating an existing position:
 
@@ -173,22 +163,22 @@ npx --yes @primitive.ai/prim decisions recent --limit 20
 If an equivalent decision is already present, do not create or suggest it again. After this duplicate check—or after the user confirms an onboarding proposal—author the decision directly. If the repo is inactive, that confirmation authorizes Prim's `--yes` only for the approved create:
 
 ```
-npx --yes @primitive.ai/prim decisions create --intent "Adopt prosemirror-collab over Yjs" --attribution user --area data --rationale "Server-authoritative ordering" --alternatives "Yjs,Automerge" --decided "Collaborative editing state syncs through prosemirror-collab","The server is the single authority for step ordering"
+npx --yes @primitive.ai/prim decisions create --intent "Adopt prosemirror-collab over Yjs" --attribution user --area data --rationale "Server-authoritative ordering" --alternatives "Yjs" --alternatives "Automerge" --decided "Collaborative editing state syncs through prosemirror-collab" --decided "The server is the single authority for step ordering"
 ```
 
 Inactive-repo form after approval:
 
 ```
-npx --yes @primitive.ai/prim --yes decisions create --intent "Adopt prosemirror-collab over Yjs" --attribution user --area data --rationale "Server-authoritative ordering" --alternatives "Yjs,Automerge" --decided "Collaborative editing state syncs through prosemirror-collab","The server is the single authority for step ordering"
+npx --yes @primitive.ai/prim --yes decisions create --intent "Adopt prosemirror-collab over Yjs" --attribution user --area data --rationale "Server-authoritative ordering" --alternatives "Yjs" --alternatives "Automerge" --decided "Collaborative editing state syncs through prosemirror-collab" --decided "The server is the single authority for step ordering"
 ```
 
 Both `--intent` and `--attribution` are required. Set `--attribution user` only when the person directly stated, selected, or confirmed the exact recorded choice. Set `--attribution agent` when you introduced that exact choice while pursuing a broader request. A broad task prompt, implementation permission, or assignment of responsibility does not turn your implementation choice into a user Decision. If the origin is ambiguous, ask the person to confirm the exact choice before creating it; after confirmation, use `user`. Never guess attribution.
 
 Word `--intent` as a short sentence-case normative headline — ideally 4–12 words, no terminal period — stating the standing constraint future work must follow, not a report of the action taken: "Consume AADT and safety data from street_export, not gps_probes_osm", never "Migrate AADT and safety data managers off gps_probes_osm". A one-time-action verb (Migrate, Backfill, Publish) headlines a task execution: restate the ongoing constraint the action implies, and when none exists, do not record a decision at all. Make the intent self-contained for a reader who wasn't in the session — name the release, artifact, or system explicitly, and state what a referenced change does rather than citing a PR or ticket number, which is itself session context; "limit this release" and "keep the GitHub surface (PR 1102)" are failures. Carry one governing decision per intent — a reader of the intent alone must see which option is now in force. Expand every binding specific the choice adopts — scope boundaries, defaults, invariants, schema or API shapes, exceptions, required mechanisms — into `--decided`, and move non-binding reasoning into `--rationale`; a paragraph-length intent that inlines its constraints and reasons is a failure.
 
-Other flags: `--kind` (change|exploration|task_execution|unclear, default change), `--rationale` (required by the recording policy above — the CLI accepts its absence, but only for the declined/unanswered fallback), `--area` (a single short lowercase noun — `auth`, `billing`, `infra`), `--decided`, `--alternatives`, `--confidence` (high|medium|low, default high), `--reversibility` (high|low, default high), and `--files` (comma-separated repo-relative paths the decision governs — these are the files Conflict Gates would check on later edits, same path form as `decisions check`; Conflict Gates are not currently enabled). Omit `--files` for broad directions that should not immediately participate in file-based Conflict Gates. STDOUT is the created identity `{ decisionId, shortId, createdAt }`; STDERR prints `[prim] created dec_<short>.` — pass that `dec_<short>` straight into `decisions show` / `cascade` / `confirm`.
+Other flags: `--kind` (change|exploration|task_execution|unclear, default change), `--rationale` (required by the recording policy above — the CLI accepts its absence, but only for the declined/unanswered fallback), `--area` (a single short lowercase noun — `auth`, `billing`, `infra`), `--decided`, `--alternatives`, `--confidence` (high|medium|low, default high), `--reversibility` (high|low, default high), and `--files` (comma-separated repo-relative paths the decision governs — these are the files Conflict Gates check on later edits when Enforcement is enabled, in the same path form as `decisions check`). Omit `--files` for broad directions that should not immediately participate in file-based Conflict Gates. STDOUT is the created identity `{ decisionId, shortId, createdAt }`; STDERR prints `[prim] created dec_<short>.` — pass that `dec_<short>` straight into `decisions show` / `cascade` / `confirm`.
 
-`--decided` carries the enforceable detail as standalone bullets — one per independently adopted constraint, the core choice first, with exact names and values. Each bullet states what must remain true and makes sense by itself: never narrate the session ("Chose to document the behavior" is a failure) and never pack independent rules into one semicolon-delimited entry. `--alternatives` takes one concise entry per option actually considered and rejected; omitting it when none were named is normal. Both flags split their value on commas with no escape, so keep each entry comma-free — rephrase around colons, dashes, or "and".
+`--decided` carries the enforceable detail as standalone bullets — one per independently adopted constraint, the core choice first, with exact names and values. Each bullet states what must remain true and makes sense by itself: never narrate the session ("Chose to document the behavior" is a failure) and never pack independent rules into one semicolon-delimited entry. `--alternatives` takes one concise entry per option actually considered and rejected; omitting it when none were named is normal. The decision's own negation is never an alternative — restating the prohibited or displaced behavior adds nothing; list only options a source or the conversation actually names as considered. Both flags are repeatable: pass one entry per flag occurrence, verbatim — repeat `--decided` for each bullet and `--alternatives` for each option. Values are never split on commas, so write entries as natural prose; a repeated flag, not a delimiter, is what separates entries.
 
 ### Inferred decisions: finish first, then optionally ask once
 

package/dist/{chunk-6LAQVM26.js → chunk-GUXBUBQ7.js}

@@ -78,5 +78,7 @@ function scrubFromCwd(value, cwd) {
 }
 
 export {
+  DEFAULT_RULES,
+  scrub,
   scrubFromCwd
 };

package/dist/{chunk-DWDEQRWN.js → chunk-I3HIPAIR.js}

@@ -1,17 +1,3 @@
-// src/client.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  renameSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, join as join2, resolve } from "path";
-
 // src/lib/file-lock.ts
 import { randomBytes } from "crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
@@ -150,6 +136,18 @@ async function withFileLock(lockDir, operation, options = {}) {
 }
 
 // src/client.ts
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir } from "os";
+import { dirname as dirname2, join as join2, resolve } from "path";
 var CONFIG_DIR_MODE = 448;
 var CREDENTIAL_FILE_MODE = 384;
 var REFRESH_THRESHOLD_MS = 6e4;

package/dist/chunk-LDQZASIF.js

@@ -0,0 +1,166 @@
+// src/lib/activation.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || parts.some((part) => !part || part !== part.trim())) return null;
+  return `${parts[0]}/${parts[1]}`;
+}
+function canonicalGitRoot(cwd) {
+  try {
+    const top = gitToplevel(cwd);
+    return top ? realpathSync.native(top) : null;
+  } catch {
+    return null;
+  }
+}
+function canonicalRepositoryPath(filePath, cwd, repositoryRoot = canonicalGitRoot(cwd)) {
+  if (!repositoryRoot || !filePath || [...filePath].some((char) => char < " " || char === "\x7F" || "~*?[]{}$`\\".includes(char)))
+    return null;
+  const absolute = resolve(cwd, filePath);
+  let target;
+  try {
+    const stat = lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    target = realpathSync.native(absolute);
+  } catch (error) {
+    if (!(error instanceof Error) || error.code !== "ENOENT") {
+      return null;
+    }
+    try {
+      const parent = realpathSync.native(dirname(absolute));
+      if (!lstatSync(parent).isDirectory()) return null;
+      target = resolve(parent, basename(absolute));
+    } catch {
+      return null;
+    }
+  }
+  const rel = relative(repositoryRoot, target);
+  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return null;
+  }
+  return sep === "/" ? rel : rel.split(sep).join("/");
+}
+
+// src/lib/activation.ts
+var PRIM_ACTIVE_KEY = "prim.active";
+var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
+var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+function repoActiveFlag(cwd) {
+  try {
+    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (value === "true") return "true";
+    if (value === "false") return "false";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRepoActive(cwd) {
+  return repoActiveFlag(cwd) === "true";
+}
+function setRepoActive(cwd, active) {
+  execFileSync2("git", ["config", "--local", PRIM_ACTIVE_KEY, active ? "true" : "false"], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"]
+  });
+}
+function repoSyncId(cwd) {
+  try {
+    return execFileSync2("git", ["config", "--local", "--get", PRIM_REPO_SYNC_ID_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function setRepoSyncId(cwd, value) {
+  if (!value || value.includes("\0") || value.includes("\n")) {
+    throw new Error("invalid repository binding returned by server");
+  }
+  execFileSync2("git", ["config", "--local", PRIM_REPO_SYNC_ID_KEY, value], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"]
+  });
+}
+function hasProjectPrimInstall(cwd) {
+  const root = gitToplevel(cwd);
+  if (root === null || root === homedir()) return false;
+  for (const rel of PROJECT_INSTALL_FILES) {
+    const path = join(root, rel);
+    if (existsSync(path)) {
+      try {
+        const content = readFileSync(path, "utf-8");
+        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function isRepoActiveForCapture(cwd) {
+  const flag = repoActiveFlag(cwd);
+  if (flag === "true") return true;
+  if (flag === "false") return false;
+  return hasProjectPrimInstall(cwd);
+}
+function decisionIngestionStatus(cwd) {
+  return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
+}
+
+export {
+  gitToplevel,
+  githubRepositoryFullName,
+  canonicalGitRoot,
+  canonicalRepositoryPath,
+  isRepoActive,
+  setRepoActive,
+  repoSyncId,
+  setRepoSyncId,
+  isRepoActiveForCapture,
+  decisionIngestionStatus
+};

package/dist/{chunk-WELBNODJ.js → chunk-R4CUX6FY.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-DWDEQRWN.js";
+} from "./chunk-I3HIPAIR.js";
 
 // src/decisions/feedback.ts
 var FEEDBACK_PROTOCOL_VERSION = 1;

package/dist/{chunk-BOTKPLTI.js → chunk-S4LFRVGD.js}

@@ -1,6 +1,6 @@
 import {
   getSiteUrl
-} from "./chunk-DWDEQRWN.js";
+} from "./chunk-I3HIPAIR.js";
 
 // src/journal.ts
 import {

package/dist/{chunk-ROL7SDXX.js → chunk-UBEBEBLM.js}

@@ -1,9 +1,9 @@
 import {
   gitToplevel
-} from "./chunk-R5ZJRSLV.js";
+} from "./chunk-LDQZASIF.js";
 import {
   withFileLock
-} from "./chunk-DWDEQRWN.js";
+} from "./chunk-I3HIPAIR.js";
 
 // src/commands/skill.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-F5QCFBJ6.js → chunk-YDBZTFW5.js}

@@ -1,40 +1,38 @@
 // src/hooks/prim-hook-core.ts
-import { randomUUID } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import { platform } from "os";
 
 // src/protocol/move.ts
 var LEGACY_ENVELOPE_VERSION = 1;
-var AGENT_ENVELOPE_VERSION = 2;
+var AGENT_ENVELOPE_VERSION = 3;
 var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
-function withAgentProvenance(move, producer, workspaceId) {
-  return {
-    ...move,
-    env: { ...move.env, workspaceId },
-    envelopeVersion: AGENT_ENVELOPE_VERSION,
-    producer
-  };
-}
 
 // src/hooks/prim-hook-core.ts
-function toMove(parsed, cliVersion, agent = "claude_code", workspaceId) {
-  const move = {
-    moveId: randomUUID(),
+function postToolInvocationId(parsed, agent) {
+  if (parsed.hook_event_name !== "PostToolUse") return void 0;
+  const raw = agent === "hermes" ? parsed.extra?.tool_call_id : parsed.tool_use_id;
+  return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, invocationId) {
+  const sessionId = parsed.session_id ?? "";
+  const eventType = parsed.hook_event_name ?? "unknown";
+  const moveId = eventType === "PostToolUse" && sessionId && invocationId ? `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}` : randomUUID();
+  return {
+    moveId,
     capturedAt: Date.now(),
-    sessionId: parsed.session_id ?? "",
-    eventType: parsed.hook_event_name ?? "unknown",
+    sessionId,
+    eventType,
     payload: parsed,
     env: {
       cwd: parsed.cwd ?? process.cwd(),
       cliVersion,
-      osPlatform: platform()
+      osPlatform: platform(),
+      ...workspaceId ? { workspaceId } : {}
     },
-    envelopeVersion: ENVELOPE_VERSION,
-    // Stamp the producer for non-Claude agents (codex, hermes); Claude Code
-    // moves omit it (the backend defaults an absent value to "claude_code"),
-    // keeping the Claude wire shape byte-identical.
-    ...agent === "claude_code" ? {} : { producer: agent }
+    envelopeVersion: AGENT_ENVELOPE_VERSION,
+    producer: agent,
+    ...invocationId ? { invocationId } : {}
   };
-  return workspaceId ? withAgentProvenance(move, agent, workspaceId) : move;
 }
 function toCommitMove(commit, cliVersion, cwd) {
   return {
@@ -62,6 +60,7 @@ function shouldFlushAfter(eventType) {
 }
 
 export {
+  postToolInvocationId,
   toMove,
   toCommitMove,
   shouldFlushAfter

package/dist/{chunk-HSZPTVKU.js → chunk-YIMUIPMD.js}

@@ -10,8 +10,6 @@ import { fileURLToPath } from "url";
 var PKG_NAME = "@primitive.ai/prim";
 var ROOT_WALK_LIMIT = 6;
 var NPX_FALLBACK = `npx --yes -p ${PKG_NAME}@latest`;
-var BIN_CACHE_DIR_SH = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
-var BIN_CACHE_TTL_MIN_DEFAULT = 1440;
 var resolvedRoot;
 function locateRoot() {
   if (resolvedRoot !== void 0) {
@@ -24,7 +22,7 @@ function locateRoot() {
       try {
         const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
         if (manifest.name === PKG_NAME && manifest.bin) {
-          resolvedRoot = { dir, bin: manifest.bin };
+          resolvedRoot = { dir, version: manifest.version, bin: manifest.bin };
           return resolvedRoot;
         }
       } catch {
@@ -47,18 +45,23 @@ function binFile(bin) {
   }
   return isAbsolute(rel) ? rel : join(root.dir, rel);
 }
-function hookShimCommand(bin, args = "", opts = {}) {
-  const invoke = (cmd) => args ? `${cmd} ${args}` : cmd;
-  const ladder = `if command -v ${bin} >/dev/null 2>&1; then ${invoke(bin)}; elif [ -f "./node_modules/.bin/${bin}" ]; then ${invoke(`./node_modules/.bin/${bin}`)}; else ${invoke(`${NPX_FALLBACK} ${bin}`)}; fi`;
-  if (opts.cacheRead === false) {
-    return ladder;
-  }
-  const execArgs = args ? ` ${args}` : "";
-  const cacheBranch = `d="${BIN_CACHE_DIR_SH}"; if [ "\${PRIM_BIN_CACHE:-1}" != "0" ] && [ -f "$d/${bin}" ] && [ -f "$d/node" ] && [ -n "$(find "$d/${bin}" -mmin "-\${PRIM_BIN_CACHE_TTL_MIN:-${BIN_CACHE_TTL_MIN_DEFAULT}}" 2>/dev/null)" ]; then n=$(cat "$d/node"); p=$(cat "$d/${bin}"); if [ -x "$n" ] && [ -f "$p" ]; then export PRIM_BIN_CACHE_HIT=1; exec "$n" "$p"${execArgs}; fi; fi; `;
-  return cacheBranch + ladder;
+function packageVersion() {
+  return locateRoot()?.version ?? null;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function pinnedHookCommand(bin, args = "") {
+  const version = packageVersion();
+  if (!version) throw new Error("cannot determine Primitive package version");
+  const suffix = args ? ` ${args}` : "";
+  const fallback = `npx --yes -p ${PKG_NAME}@${version} ${bin}${suffix}`;
+  const file = binFile(bin);
+  if (!file) return fallback;
+  return `if [ -x ${shellQuote(process.execPath)} ] && [ -f ${shellQuote(file)} ]; then ${shellQuote(process.execPath)} ${shellQuote(file)}${suffix}; else ${fallback}; fi`;
 }
 function detachedHookShimCommand(bin, args = "") {
-  return `payload=$(cat); { trap '' HUP; export npm_config_fetch_retries=2 npm_config_fetch_retry_mintimeout=10000 npm_config_fetch_retry_maxtimeout=10000 npm_config_fetch_timeout=60000; printf '%s' "$payload" | { ${hookShimCommand(bin, args, { cacheRead: false })}; }; } </dev/null >/dev/null 2>&1 &`;
+  return `payload=$(cat); { trap '' HUP; export npm_config_fetch_retries=2 npm_config_fetch_retry_mintimeout=10000 npm_config_fetch_retry_maxtimeout=10000 npm_config_fetch_timeout=60000; printf '%s' "$payload" | { ${pinnedHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
 }
 function commandMatchesBin(command, bin) {
   if (!command) {
@@ -68,7 +71,8 @@ function commandMatchesBin(command, bin) {
   if (c === bin || c.startsWith(`${bin} `)) {
     return true;
   }
-  return c.includes(`command -v ${bin} `);
+  const exactBin = new RegExp(`(?:^|\\s)${bin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s|;|$)`);
+  return c.includes(`command -v ${bin} `) || c.includes(`-p ${PKG_NAME}@`) && exactBin.test(c);
 }
 
 // src/lib/bin-cache.ts
@@ -106,7 +110,8 @@ function warmBinCache() {
 
 export {
   binFile,
-  hookShimCommand,
+  packageVersion,
+  pinnedHookCommand,
   detachedHookShimCommand,
   commandMatchesBin,
   warmBinCache

package/dist/{chunk-VDLAAUWV.js → chunk-YITJ2H3B.js}

@@ -1,7 +1,7 @@
 import {
   getClient,
   getSiteUrl
-} from "./chunk-DWDEQRWN.js";
+} from "./chunk-I3HIPAIR.js";
 import {
   daemonRequest
 } from "./chunk-UTKQTZHL.js";