@primitive.ai/prim 0.1.0-alpha.56 → 0.1.0-alpha.58

package/dist/chunk-YWJHWGXH.js

@@ -0,0 +1,438 @@
+import {
+  DEFAULT_RULES,
+  scrub
+} from "./chunk-GUXBUBQ7.js";
+import {
+  canonicalGitRoot,
+  canonicalRepositoryPath
+} from "./chunk-LDQZASIF.js";
+import {
+  getClient
+} from "./chunk-I3HIPAIR.js";
+
+// src/hooks/pre-tool-use-scoring.ts
+import { isAbsolute, relative, sep } from "path";
+function anyUnverified(results) {
+  return results.some((r) => r.verdict === "unavailable" || r.truncated);
+}
+function unverifiedNote(results) {
+  const causes = [];
+  const unavailable = results.find((r) => r.verdict === "unavailable");
+  if (unavailable) {
+    causes.push(
+      unavailable.unavailable ? `decision check skipped \u2014 ${unavailable.unavailable}` : "decision check skipped \u2014 not verified"
+    );
+  }
+  if (results.some((r) => r.truncated)) {
+    causes.push("decision check partial \u2014 conflict set truncated (per-file cap hit)");
+  }
+  return causes.map((c) => `[primitive] ${c}`).join("\n");
+}
+function blockingReason(results) {
+  const parts = results.filter((result) => result.verdict === "ask" || result.verdict === "deny").flatMap((result) => [result.reason, result.additionalContext]).filter((value) => value.length > 0);
+  return [...new Set(parts)].join("\n\n") || "[primitive] conflict detected (no detail available)";
+}
+function advisoryNote(aggregate, results) {
+  const details = results.flatMap((result) => [
+    ...aggregate === "warn" ? [result.reason] : [],
+    result.additionalContext
+  ]);
+  if (anyUnverified(results)) details.push(unverifiedNote(results));
+  return [...new Set(details.filter((value) => value.length > 0))].join("\n\n");
+}
+function buildHookOutput(aggregate, results) {
+  if (aggregate === "deny" || aggregate === "ask") {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: aggregate,
+        permissionDecisionReason: blockingReason(results)
+      }
+    };
+  }
+  const notes = advisoryNote(aggregate, results);
+  if (notes.length > 0) {
+    return {
+      systemMessage: notes,
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        additionalContext: notes
+      }
+    };
+  }
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow"
+    }
+  };
+}
+function buildCodexOutput(aggregate, results) {
+  if (aggregate === "deny" || aggregate === "ask") {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: blockingReason(results)
+      }
+    };
+  }
+  const notes = advisoryNote(aggregate, results);
+  return notes ? {
+    systemMessage: notes,
+    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: notes }
+  } : {};
+}
+function failOpenOutput() {
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow"
+    }
+  };
+}
+function failOpenCodex() {
+  return {};
+}
+function buildHermesOutput(aggregate, results) {
+  if (aggregate !== "deny" && aggregate !== "ask") {
+    return {};
+  }
+  const reason = results.filter((r) => r.verdict === "deny" || r.verdict === "ask").map((r) => r.reason).filter((s) => s.length > 0).join("\n\n");
+  const directive = results.map((r) => r.additionalContext).filter((s) => s.length > 0 && s !== reason).join("\n");
+  const message = [reason, directive].filter((s) => s.length > 0).join("\n\n") || "[primitive] conflict detected (no detail available)";
+  return { action: "block", message };
+}
+function failOpenHermes() {
+  return {};
+}
+var SUPPORTED_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var APPLY_PATCH_FILE_RE = /^\*\*\* (?:Update|Add|Delete) File: (?<path>.+)$/;
+var MOVE_FILE_RE = /^\*\*\* Move File:\s*(?<src>.+?)\s*->\s*(?<dst>.+?)\s*$/;
+var MOVE_TO_RE = /^\*\*\* Move to: (?<dst>.+)$/;
+var LINE_SPLIT_RE = /\r?\n/;
+function parseApplyPatchTargets(command) {
+  const paths = /* @__PURE__ */ new Set();
+  let activeUpdate = false;
+  let complete = true;
+  for (const line of command.split(LINE_SPLIT_RE)) {
+    const path = APPLY_PATCH_FILE_RE.exec(line)?.groups?.path;
+    if (path) {
+      paths.add(path);
+      activeUpdate = line.startsWith("*** Update File:");
+      continue;
+    }
+    const moveTo = MOVE_TO_RE.exec(line)?.groups?.dst;
+    if (moveTo) {
+      if (activeUpdate) paths.add(moveTo);
+      else complete = false;
+      activeUpdate = false;
+      continue;
+    }
+    const move = MOVE_FILE_RE.exec(line)?.groups;
+    if (move?.src) {
+      paths.add(move.src);
+      if (move.dst) {
+        paths.add(move.dst);
+      }
+      activeUpdate = false;
+      continue;
+    }
+    if (line === "*** Begin Patch" || line === "*** End Patch") activeUpdate = false;
+    else if (line.startsWith("*** ")) complete = false;
+  }
+  return { paths: [...paths], complete: complete && paths.size > 0 };
+}
+function extractCodexFileTargets(toolName, toolInput) {
+  if (toolName !== "apply_patch") {
+    return null;
+  }
+  if (!toolInput || typeof toolInput !== "object") {
+    return { paths: [], complete: false };
+  }
+  const command = toolInput.command;
+  return typeof command === "string" ? parseApplyPatchTargets(command) : { paths: [], complete: false };
+}
+var HERMES_EDITING_TOOLS = /* @__PURE__ */ new Set(["write_file", "patch"]);
+function extractHermesFileTargets(toolName, toolInput) {
+  if (!HERMES_EDITING_TOOLS.has(toolName)) {
+    return null;
+  }
+  if (!toolInput || typeof toolInput !== "object") {
+    return { paths: [], complete: false };
+  }
+  const input = toolInput;
+  if (toolName === "patch" && input.mode === "patch") {
+    return typeof input.patch === "string" ? parseApplyPatchTargets(input.patch) : { paths: [], complete: false };
+  }
+  const paths = typeof input.path === "string" && input.path.length > 0 ? [input.path] : [];
+  const mode = input.mode;
+  return { paths, complete: paths.length > 0 && (mode === void 0 || mode === "replace") };
+}
+function extractFileTargets(toolName, toolInput, agent = "claude_code") {
+  if (agent === "codex") {
+    return extractCodexFileTargets(toolName, toolInput);
+  }
+  if (agent === "hermes") {
+    return extractHermesFileTargets(toolName, toolInput);
+  }
+  if (!SUPPORTED_TOOLS.has(toolName)) {
+    return null;
+  }
+  if (!toolInput || typeof toolInput !== "object") {
+    return { paths: [], complete: false };
+  }
+  const input = toolInput;
+  if (toolName === "NotebookEdit") {
+    const paths2 = typeof input.notebook_path === "string" && input.notebook_path.length > 0 ? [input.notebook_path] : [];
+    return { paths: paths2, complete: paths2.length > 0 };
+  }
+  const paths = typeof input.file_path === "string" && input.file_path.length > 0 ? [input.file_path] : [];
+  return { paths, complete: paths.length > 0 };
+}
+function readHookMode(env) {
+  if (env.PRIM_BYPASS === "1" || env.PRIM_BYPASS === "true") {
+    return "off";
+  }
+  const mode = env.PRIM_HOOK_MODE;
+  if (mode === "off" || mode === "warn") {
+    return mode;
+  }
+  return "block";
+}
+function demoteForMode(verdict, mode) {
+  if (mode === "off") {
+    return "allow";
+  }
+  if (mode === "warn" && (verdict === "ask" || verdict === "deny")) {
+    return "warn";
+  }
+  return verdict;
+}
+
+// src/hooks/preflight-v3.ts
+import { Buffer } from "buffer";
+
+// src/hooks/shell-targets.ts
+import { parse } from "unbash";
+var OUTPUT_REDIRECTS = /* @__PURE__ */ new Set([">", ">>", ">|", "&>", "&>>"]);
+var READ_ONLY_COMMANDS = new Set(": cat echo false printf pwd test true [".split(" "));
+var SINKS = /* @__PURE__ */ new Set(["/dev/null", "/dev/stdout", "/dev/stderr"]);
+var STATIC_PARTS = /* @__PURE__ */ new Set(["Literal", "SingleQuoted", "AnsiCQuoted"]);
+function staticPart(part) {
+  return STATIC_PARTS.has(part.type) || part.type === "DoubleQuoted" && part.parts.every(staticPart);
+}
+function staticWord(word) {
+  if (!word || !word.value || word.value.includes("\0") || word.value.includes("\n")) return;
+  if (word.parts ? !word.parts.every(staticPart) : word.value.startsWith("~") || /[*?\[$`]/.test(word.text))
+    return;
+  return word.value;
+}
+function unknown(state) {
+  state.complete = false;
+  state.mutation = true;
+}
+function recordTarget(word, state) {
+  const path = staticWord(word);
+  if (path === "-" || path && (SINKS.has(path) || path.startsWith("/dev/fd/"))) return;
+  state.mutation = true;
+  if (path) state.paths.add(path);
+  else state.complete = false;
+}
+function visitRedirect(redirect, state) {
+  const target = staticWord(redirect.target);
+  if (redirect.operator === ">&" && (target === "-" || /^\d+$/.test(target ?? ""))) return;
+  if (OUTPUT_REDIRECTS.has(redirect.operator) || redirect.operator === ">&")
+    recordTarget(redirect.target, state);
+  else unknown(state);
+}
+function operands(words, short = "", long = /* @__PURE__ */ new Set()) {
+  const result = [];
+  let optionsEnded = false;
+  for (const word of words) {
+    const value = staticWord(word);
+    if (value === void 0) return;
+    if (optionsEnded || value === "-" || !value.startsWith("-")) result.push(value);
+    else if (value === "--") optionsEnded = true;
+    else if (value.startsWith("--") ? !long.has(value) : [...value.slice(1)].some((c) => !short.includes(c)))
+      return;
+  }
+  return result;
+}
+function visitCommand(command, state) {
+  for (const redirect of command.redirects) visitRedirect(redirect, state);
+  const name = staticWord(command.name);
+  if (!name || name.includes("/") || command.suffix.some((word) => !staticWord(word))) {
+    unknown(state);
+  } else if (!READ_ONLY_COMMANDS.has(name)) {
+    state.mutation = true;
+    let targets;
+    if (name === "tee") {
+      targets = operands(command.suffix, "ai", /* @__PURE__ */ new Set(["--append", "--ignore-interrupts"]));
+    } else if (name === "touch") {
+      targets = operands(command.suffix);
+    } else if (name === "rm") {
+      targets = operands(
+        command.suffix,
+        "fivI",
+        /* @__PURE__ */ new Set(["--force", "--interactive", "--interactive=once", "--verbose"])
+      );
+    } else if (name === "cp" || name === "mv") {
+      const pair = operands(command.suffix);
+      if (pair?.length === 2) targets = name === "cp" ? [pair[1]] : pair;
+    }
+    if (!targets?.length) state.complete = false;
+    else for (const target of targets) state.paths.add(target);
+  }
+  visitNested([command.name, command.prefix, command.suffix, command.redirects], state);
+}
+var CONTAINERS = /* @__PURE__ */ new Set(["Script", "Pipeline", "AndOr", "CompoundList"]);
+function visitNested(value, state) {
+  if (Array.isArray(value)) {
+    for (const child of value) visitNested(child, state);
+  } else if (value && typeof value === "object") {
+    const child = value;
+    if (child.type === "Command") {
+      visitCommand(child, state);
+    } else if (child.type === "Statement") {
+      visitStatement(child, state);
+    } else if ("parts" in child) {
+      for (const part of value.parts ?? []) visitNested(part, state);
+    } else {
+      const node = typeof child.type === "string" && "pos" in child && "end" in child;
+      if (node && !CONTAINERS.has(child.type)) unknown(state);
+      if (child.type === "Function") return;
+      for (const nested of Object.values(child)) visitNested(nested, state);
+    }
+  }
+}
+function visitStatement(statement, state) {
+  if (statement.background) unknown(state);
+  for (const redirect of statement.redirects) visitRedirect(redirect, state);
+  visitNested([statement.redirects, statement.command], state);
+}
+function analyzeShellTargets(source) {
+  if (!source.trim())
+    return { paths: [], coverage: "complete", mutation: "none" };
+  try {
+    const script = parse(source);
+    const state = { paths: /* @__PURE__ */ new Set(), complete: !script.errors?.length, mutation: false };
+    for (const statement of script.commands) visitStatement(statement, state);
+    if (script.errors?.length) state.mutation = true;
+    return {
+      paths: [...state.paths],
+      coverage: state.complete ? "complete" : "unverified",
+      mutation: state.mutation ? "present" : "none"
+    };
+  } catch {
+    return { paths: [], coverage: "unverified", mutation: "present" };
+  }
+}
+
+// src/hooks/preflight-v3.ts
+var PREFLIGHT_PROTOCOL_VERSION = 3;
+var PREFLIGHT_TIMEOUT_MS = 4500;
+var MAX_PREFLIGHT_PATHS = 32;
+var MAX_PROPOSAL_BYTES = 6144;
+function resolvePreflightTargets(args) {
+  let rawPaths;
+  let coverage = "complete";
+  let mutation = "present";
+  if (args.agent === "claude_code" && args.toolName === "Bash") {
+    const command = args.toolInput && typeof args.toolInput === "object" ? args.toolInput.command : void 0;
+    if (typeof command !== "string") {
+      return { paths: [], coverage: "unverified", mutation: "present" };
+    }
+    const shell = analyzeShellTargets(command);
+    rawPaths = shell.paths;
+    coverage = shell.coverage;
+    mutation = shell.mutation;
+  } else {
+    const extracted = extractFileTargets(args.toolName, args.toolInput, args.agent);
+    if (!extracted) return { paths: [], coverage: "complete", mutation: "none" };
+    rawPaths = extracted.paths;
+    if (!extracted.complete) coverage = "unverified";
+  }
+  const root = canonicalGitRoot(args.cwd);
+  const paths = /* @__PURE__ */ new Set();
+  for (const rawPath of rawPaths) {
+    const canonical = canonicalRepositoryPath(rawPath, args.cwd, root);
+    if (canonical) paths.add(canonical);
+    else coverage = "unverified";
+  }
+  const bounded = [...paths];
+  if (bounded.length > MAX_PREFLIGHT_PATHS) coverage = "unverified";
+  return { paths: bounded.slice(0, MAX_PREFLIGHT_PATHS), coverage, mutation };
+}
+function truncateUtf8(value, maxBytes) {
+  const encoded = Buffer.from(value);
+  if (encoded.byteLength <= maxBytes) return value;
+  return encoded.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD$/u, "");
+}
+function proposalFor(toolInput) {
+  const redacted = scrub(toolInput, DEFAULT_RULES);
+  return truncateUtf8(JSON.stringify(redacted) ?? "", MAX_PROPOSAL_BYTES);
+}
+function parsePreflightResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const response = value;
+  const verdicts = /* @__PURE__ */ new Set(["allow", "warn", "ask", "block", "unavailable"]);
+  if (response.protocolVersion !== PREFLIGHT_PROTOCOL_VERSION || typeof response.verdict !== "string" || !verdicts.has(response.verdict) || typeof response.reasonCode !== "string" || typeof response.message !== "string" || !Array.isArray(response.conflicts) || !Array.isArray(response.bypassed)) {
+    return null;
+  }
+  return response;
+}
+async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS)) {
+  const response = await getClient().post("/api/cli/decisions/conflict-check", request, {
+    signal,
+    quietRefresh: true
+  });
+  return parsePreflightResponse(response);
+}
+function resultForPreflight(response) {
+  const verdict = response.verdict === "block" ? "deny" : response.verdict;
+  const safe = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+  const directives = response.conflicts.flatMap((value) => {
+    if (!value || typeof value !== "object") return [];
+    const { decisionId, shortId } = value;
+    const id = typeof shortId === "string" && safe.test(shortId) ? `dec_${shortId}` : typeof decisionId === "string" && safe.test(decisionId) ? decisionId : void 0;
+    return id ? [`To reconcile, run: prim reconcile ${id}`] : [];
+  });
+  const reason = [response.message, ...new Set(directives)].filter(Boolean).join("\n");
+  return {
+    verdict,
+    conflicts: response.conflicts,
+    reason,
+    additionalContext: ["warn", "ask", "block"].includes(response.verdict) ? reason : "",
+    truncated: false,
+    unavailable: response.verdict === "unavailable" ? response.message || response.reasonCode : void 0
+  };
+}
+function unverifiedResult(message) {
+  return {
+    verdict: "unavailable",
+    conflicts: [],
+    reason: "",
+    additionalContext: "",
+    truncated: false,
+    unavailable: message
+  };
+}
+
+export {
+  buildHookOutput,
+  buildCodexOutput,
+  failOpenOutput,
+  failOpenCodex,
+  buildHermesOutput,
+  failOpenHermes,
+  readHookMode,
+  demoteForMode,
+  PREFLIGHT_PROTOCOL_VERSION,
+  resolvePreflightTargets,
+  proposalFor,
+  requestPreflight,
+  resultForPreflight,
+  unverifiedResult
+};

package/dist/daemon/server.js

@@ -1486,13 +1486,6 @@ async function runIngestionLoop() {
     scheduleIngestion(delay);
   }
 }
-async function handleConflictCheck(params) {
-  assertCallerEnvMatches(params.callerEnv, getSiteUrl());
-  if (typeof params.file !== "string") {
-    throw new Error("conflict_check requires `file: string`");
-  }
-  return await client.post("/api/cli/decisions/conflict-check", { file: params.file });
-}
 function pathParam(params) {
   if (typeof params.path !== "string" || !params.path.startsWith("/api/cli/")) {
     throw new Error("proxy request requires `path: string` under /api/cli/");
@@ -1555,10 +1548,6 @@ async function dispatchRequest(req) {
   const id = req.id;
   try {
     switch (req.method) {
-      case "conflict_check": {
-        const result = await handleConflictCheck(req.params ?? {});
-        return { id, ok: true, result };
-      }
       case "decisions_recent": {
         const result = await proxyGet(req.params ?? {}, "/api/cli/decisions/recent");
         return { id, ok: true, result };

package/dist/hooks/post-commit.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   toCommitMove
-} from "../chunk-F5QCFBJ6.js";
+} from "../chunk-YDBZTFW5.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-BOTKPLTI.js";
+} from "../chunk-S4LFRVGD.js";
 import {
   isRepoActiveForCapture
-} from "../chunk-R5ZJRSLV.js";
-import "../chunk-DWDEQRWN.js";
+} from "../chunk-LDQZASIF.js";
+import "../chunk-I3HIPAIR.js";
 
 // src/hooks/post-commit.ts
 import { execSync, spawn } from "child_process";

package/dist/hooks/post-tool-use.js

@@ -5,27 +5,32 @@ import {
   requireDurableIngestAcknowledgement
 } from "../chunk-QY75BQMF.js";
 import {
-  scrubFromCwd
-} from "../chunk-6LAQVM26.js";
+  resolvePreflightTargets
+} from "../chunk-YWJHWGXH.js";
 import {
+  postToolInvocationId,
   toMove
-} from "../chunk-F5QCFBJ6.js";
+} from "../chunk-YDBZTFW5.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-BOTKPLTI.js";
+} from "../chunk-S4LFRVGD.js";
+import {
+  scrubFromCwd
+} from "../chunk-GUXBUBQ7.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-IMAIBPUC.js";
 import {
   warmBinCache
-} from "../chunk-HSZPTVKU.js";
+} from "../chunk-YIMUIPMD.js";
 import {
-  isRepoActiveForCapture
-} from "../chunk-R5ZJRSLV.js";
+  isRepoActive,
+  repoSyncId
+} from "../chunk-LDQZASIF.js";
 import {
   getClient
-} from "../chunk-DWDEQRWN.js";
+} from "../chunk-I3HIPAIR.js";
 import {
   normalizeEnvelope,
   parseAgent
@@ -66,7 +71,7 @@ function isVerdictFooterContext(value) {
 
 // src/hooks/post-tool-use.ts
 var STDIN_TIMEOUT_MS = 1e3;
-var EDITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit"]);
+var EDITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"]);
 var CODEX_EDITING_TOOLS = /* @__PURE__ */ new Set(["apply_patch"]);
 var HERMES_EDITING_TOOLS = /* @__PURE__ */ new Set(["write_file", "patch"]);
 function editingToolsFor(agent) {
@@ -146,13 +151,26 @@ async function main() {
     return;
   }
   const cwd = parsed.cwd ?? process.cwd();
-  if (!isRepoActiveForCapture(cwd)) {
+  if (!isRepoActive(cwd) || !repoSyncId(cwd)) {
     emit();
     return;
   }
+  if (agent === "claude_code") {
+    const targets = resolvePreflightTargets({
+      toolName,
+      toolInput: envelope.tool_input,
+      agent,
+      cwd
+    });
+    if (targets.mutation === "none") {
+      emit();
+      return;
+    }
+  }
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
-  const base = toMove(parsed, resolveCliVersion(), agent, workspaceId);
+  const invocationId = postToolInvocationId(parsed, agent);
+  const base = toMove(parsed, resolveCliVersion(), agent, workspaceId, invocationId);
   const move = { ...base, payload: scrubFromCwd(parsed, cwd) };
   const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
   try {

package/dist/hooks/pre-commit.js

@@ -2,8 +2,8 @@
 import {
   checkAffectedDecisions,
   formatDecisionsWarning
-} from "../chunk-VDLAAUWV.js";
-import "../chunk-DWDEQRWN.js";
+} from "../chunk-YITJ2H3B.js";
+import "../chunk-I3HIPAIR.js";
 import "../chunk-UTKQTZHL.js";
 
 // src/hooks/pre-commit.ts