@primitive.ai/prim 0.1.0-alpha.60 → 0.1.0-alpha.62

package/dist/chunk-DA4BMHEB.js

@@ -0,0 +1,77 @@
+import {
+  analyzeShellTargets,
+  extractFileTargets
+} from "./chunk-GF5QII7T.js";
+import {
+  canonicalRepositoryPath
+} from "./chunk-XTNMSS4C.js";
+
+// src/hooks/file-refs.ts
+var MAX_PREFLIGHT_FILE_TARGETS = 25;
+function primitiveMetadataForResolution(resolution) {
+  const shouldAttach = resolution.fileRefs.length > 0 || resolution.rejected.length > 0 || resolution.targetsIncomplete || resolution.targetsTruncated || resolution.shellMutation !== void 0;
+  if (!shouldAttach) return;
+  return {
+    fileRefs: [...resolution.fileRefs],
+    ...resolution.rejected.length > 0 || resolution.targetsIncomplete ? { fileRefsIncomplete: true } : {},
+    ...resolution.targetsTruncated ? { fileRefsTruncated: true } : {},
+    ...resolution.shellMutation !== void 0 ? { shellMutation: resolution.shellMutation } : {}
+  };
+}
+function preserveHookFileMetadata(payload, resolution) {
+  const primitive = primitiveMetadataForResolution(resolution);
+  if (!primitive || !payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return payload;
+  }
+  return { ...payload, primitive };
+}
+function resolveHookFileRefs(args) {
+  const command = args.agent === "claude_code" && args.toolName === "Bash" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.command === "string" ? args.toolInput.command : void 0;
+  const shell = command === void 0 ? void 0 : analyzeShellTargets(command);
+  const shellMutation = shell?.mutation === "none" ? "none" : shell?.coverage === "complete" ? "resolved" : shell ? "unresolved" : void 0;
+  const readPath = args.agent === "claude_code" && args.toolName === "Read" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.file_path === "string" ? [args.toolInput.file_path] : void 0;
+  const nativeTargets = shell ? null : readPath ? { paths: readPath, complete: true } : extractFileTargets(args.toolName, args.toolInput, args.agent);
+  const rawPaths = shell ? shellMutation === "unresolved" ? [] : shell.paths : nativeTargets?.paths ?? [];
+  const uniqueRawPaths = Array.from(new Set(rawPaths));
+  const targetsTruncated = uniqueRawPaths.length > MAX_PREFLIGHT_FILE_TARGETS;
+  const fileRefs = /* @__PURE__ */ new Set();
+  const rejected = [];
+  for (const path of uniqueRawPaths.slice(0, MAX_PREFLIGHT_FILE_TARGETS)) {
+    const canonical = canonicalRepositoryPath(path, args.repository, args.cwd);
+    if (canonical.ok) fileRefs.add(canonical.file);
+    else rejected.push({ path, reason: canonical.reason });
+  }
+  return {
+    fileRefs: [...fileRefs],
+    rejected,
+    targetsIncomplete: nativeTargets?.complete === false,
+    targetsTruncated,
+    ...shellMutation ? { shellMutation: targetsTruncated ? "unresolved" : shellMutation } : {}
+  };
+}
+function enrichHookPayloadWithFileRefs(args) {
+  const toolName = typeof args.parsed.tool_name === "string" ? args.parsed.tool_name : "";
+  const resolution = resolveHookFileRefs({
+    toolName,
+    toolInput: args.parsed.tool_input,
+    agent: args.agent,
+    cwd: args.cwd,
+    repository: args.repository
+  });
+  const primitive = primitiveMetadataForResolution(resolution);
+  if (!primitive) return { parsed: args.parsed, resolution };
+  return {
+    parsed: {
+      ...args.parsed,
+      // An explicit empty list is authoritative when every exposed target was
+      // rejected. It prevents backend fallback to unsafe raw tool input.
+      primitive
+    },
+    resolution
+  };
+}
+
+export {
+  preserveHookFileMetadata,
+  enrichHookPayloadWithFileRefs
+};

package/dist/{chunk-B4SHJYIN.js → chunk-GF5QII7T.js}

@@ -1,15 +1,3 @@
-import {
-  DEFAULT_RULES,
-  scrub
-} from "./chunk-GUXBUBQ7.js";
-import {
-  canonicalGitRoot,
-  canonicalRepositoryPath
-} from "./chunk-LDQZASIF.js";
-import {
-  getClient
-} from "./chunk-I3HIPAIR.js";
-
 // src/hooks/pre-tool-use-scoring.ts
 import { isAbsolute, relative, sep } from "path";
 function anyUnverified(results) {
@@ -211,8 +199,84 @@ function demoteForMode(verdict, mode) {
   return verdict;
 }
 
-// src/hooks/preflight-v3.ts
-import { Buffer } from "buffer";
+// src/hooks/redact.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var DEFAULT_RULES = [
+  { pattern: /Bearer\s+[A-Za-z0-9._\-]+/g, reason: "bearer-token" },
+  { pattern: /sk-[A-Za-z0-9]{32,}/g, reason: "sk-api-key" },
+  {
+    pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g,
+    reason: "private-key"
+  },
+  { pattern: /xox[abprs]-[A-Za-z0-9-]{10,}/g, reason: "slack-token" },
+  { pattern: /ghp_[A-Za-z0-9]{36,}/g, reason: "github-pat" }
+];
+var MAX_SCRUB_LEN = 256e3;
+var WORKSPACE_FILE = ".prim/redaction.json";
+function debugRedaction(message, err) {
+  if (!process.env.PRIM_HOOK_DEBUG) {
+    return;
+  }
+  const detail = err instanceof Error ? err.message : String(err);
+  process.stderr.write(`[prim-hook] redaction: ${message}: ${detail}
+`);
+}
+function loadWorkspaceRules(cwd) {
+  const path = join(cwd, WORKSPACE_FILE);
+  if (!existsSync(path)) {
+    return [];
+  }
+  let cfg;
+  try {
+    cfg = JSON.parse(readFileSync(path, "utf-8"));
+  } catch (err) {
+    debugRedaction(`ignoring unparseable ${WORKSPACE_FILE}`, err);
+    return [];
+  }
+  if (!cfg.rules) {
+    return [];
+  }
+  const compiled = [];
+  for (const r of cfg.rules) {
+    try {
+      compiled.push({ pattern: new RegExp(r.pattern, r.flags ?? "g"), reason: r.reason });
+    } catch (err) {
+      debugRedaction(`skipping invalid redaction rule "${r.reason}"`, err);
+    }
+  }
+  return compiled;
+}
+function applyRules(input, rules) {
+  if (input.length > MAX_SCRUB_LEN) {
+    return "<REDACTED:oversized>";
+  }
+  let out = input;
+  for (const rule of rules) {
+    out = out.replace(rule.pattern, `<REDACTED:${rule.reason}>`);
+  }
+  return out;
+}
+function scrub(value, rules = DEFAULT_RULES) {
+  if (typeof value === "string") {
+    return applyRules(value, rules);
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => scrub(v, rules));
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = scrub(v, rules);
+    }
+    return out;
+  }
+  return value;
+}
+function scrubFromCwd(value, cwd) {
+  const rules = [...DEFAULT_RULES, ...loadWorkspaceRules(cwd)];
+  return scrub(value, rules);
+}
 
 // src/hooks/shell-targets.ts
 import { parse } from "unbash";
@@ -330,96 +394,6 @@ function analyzeShellTargets(source) {
   }
 }
 
-// src/hooks/preflight-v3.ts
-var PREFLIGHT_PROTOCOL_VERSION = 3;
-var PREFLIGHT_TIMEOUT_MS = 6500;
-var MAX_PREFLIGHT_PATHS = 32;
-var MAX_PROPOSAL_BYTES = 6144;
-function resolvePreflightTargets(args) {
-  let rawPaths;
-  let coverage = "complete";
-  let mutation = "present";
-  if (args.agent === "claude_code" && args.toolName === "Bash") {
-    const command = args.toolInput && typeof args.toolInput === "object" ? args.toolInput.command : void 0;
-    if (typeof command !== "string") {
-      return { paths: [], coverage: "unverified", mutation: "present" };
-    }
-    const shell = analyzeShellTargets(command);
-    rawPaths = shell.paths;
-    coverage = shell.coverage;
-    mutation = shell.mutation;
-  } else {
-    const extracted = extractFileTargets(args.toolName, args.toolInput, args.agent);
-    if (!extracted) return { paths: [], coverage: "complete", mutation: "none" };
-    rawPaths = extracted.paths;
-    if (!extracted.complete) coverage = "unverified";
-  }
-  const root = canonicalGitRoot(args.cwd);
-  const paths = /* @__PURE__ */ new Set();
-  for (const rawPath of rawPaths) {
-    const canonical = canonicalRepositoryPath(rawPath, args.cwd, root);
-    if (canonical) paths.add(canonical);
-    else coverage = "unverified";
-  }
-  const bounded = [...paths];
-  if (bounded.length > MAX_PREFLIGHT_PATHS) coverage = "unverified";
-  return { paths: bounded.slice(0, MAX_PREFLIGHT_PATHS), coverage, mutation };
-}
-function truncateUtf8(value, maxBytes) {
-  const encoded = Buffer.from(value);
-  if (encoded.byteLength <= maxBytes) return value;
-  return encoded.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD$/u, "");
-}
-function proposalFor(toolInput) {
-  const redacted = scrub(toolInput, DEFAULT_RULES);
-  return truncateUtf8(JSON.stringify(redacted) ?? "", MAX_PROPOSAL_BYTES);
-}
-function parsePreflightResponse(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const response = value;
-  const verdicts = /* @__PURE__ */ new Set(["allow", "warn", "ask", "block", "unavailable"]);
-  if (response.protocolVersion !== PREFLIGHT_PROTOCOL_VERSION || typeof response.verdict !== "string" || !verdicts.has(response.verdict) || typeof response.reasonCode !== "string" || typeof response.message !== "string" || !Array.isArray(response.conflicts) || !Array.isArray(response.bypassed)) {
-    return null;
-  }
-  return response;
-}
-async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS)) {
-  const response = await getClient().post("/api/cli/decisions/conflict-check", request, {
-    signal,
-    quietRefresh: true
-  });
-  return parsePreflightResponse(response);
-}
-function resultForPreflight(response) {
-  const verdict = response.verdict === "block" ? "deny" : response.verdict;
-  const safe = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-  const directives = response.conflicts.flatMap((value) => {
-    if (!value || typeof value !== "object") return [];
-    const { decisionId, shortId } = value;
-    const id = typeof shortId === "string" && safe.test(shortId) ? `dec_${shortId}` : typeof decisionId === "string" && safe.test(decisionId) ? decisionId : void 0;
-    return id ? [`To reconcile, run: prim reconcile ${id}`] : [];
-  });
-  const reason = [response.message, ...new Set(directives)].filter(Boolean).join("\n");
-  return {
-    verdict,
-    conflicts: response.conflicts,
-    reason,
-    additionalContext: ["warn", "ask", "block"].includes(response.verdict) ? reason : "",
-    truncated: false,
-    unavailable: response.verdict === "unavailable" ? response.message || response.reasonCode : void 0
-  };
-}
-function unverifiedResult(message) {
-  return {
-    verdict: "unavailable",
-    conflicts: [],
-    reason: "",
-    additionalContext: "",
-    truncated: false,
-    unavailable: message
-  };
-}
-
 export {
   buildHookOutput,
   buildCodexOutput,
@@ -427,12 +401,11 @@ export {
   failOpenCodex,
   buildHermesOutput,
   failOpenHermes,
+  extractFileTargets,
   readHookMode,
   demoteForMode,
-  PREFLIGHT_PROTOCOL_VERSION,
-  resolvePreflightTargets,
-  proposalFor,
-  requestPreflight,
-  resultForPreflight,
-  unverifiedResult
+  analyzeShellTargets,
+  DEFAULT_RULES,
+  scrub,
+  scrubFromCwd
 };

package/dist/{chunk-QY75BQMF.js → chunk-JQFN6LBO.js}

@@ -64,6 +64,13 @@ function stripControlChars(text) {
   }
   return out;
 }
+var MAX_HEALTH_ERROR_LENGTH = 240;
+function boundedHealthError(value) {
+  if (!value) return void 0;
+  const clean = stripControlChars(value).replace(/\s+/g, " ").trim();
+  if (!clean) return void 0;
+  return clean.length <= MAX_HEALTH_ERROR_LENGTH ? clean : `${clean.slice(0, MAX_HEALTH_ERROR_LENGTH - 1)}\u2026`;
+}
 function stripAnsi(text) {
   return text.replace(/\u001b\[[0-9;]*m/g, "");
 }
@@ -97,6 +104,7 @@ export {
   bold,
   colorForArea,
   stripControlChars,
+  boundedHealthError,
   stripAnsi,
   requireDurableIngestAcknowledgement
 };

package/dist/{chunk-YIMUIPMD.js → chunk-KBFFVYBC.js}

@@ -76,7 +76,13 @@ function commandMatchesBin(command, bin) {
 }
 
 // src/lib/bin-cache.ts
-var CACHED_BINS = ["prim", "prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+var CACHED_BINS = [
+  "prim",
+  "prim-hook",
+  "prim-pre-tool-use",
+  "prim-post-tool-use",
+  "prim-post-commit"
+];
 function binCacheDir() {
   const base = process.env.XDG_CACHE_HOME || join2(homedir(), ".cache");
   return join2(base, "prim", "bin");