@primitive.ai/prim 0.1.0-alpha.60 → 0.1.0-alpha.62

package/dist/index.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import {
   bold,
+  boundedHealthError,
   color,
   colorForArea,
   dim,
   requireDurableIngestAcknowledgement,
   stripAnsi,
   stripControlChars
-} from "./chunk-QY75BQMF.js";
+} from "./chunk-JQFN6LBO.js";
 import {
   checkAffectedDecisions,
   daemonOrDirectGet,
@@ -24,15 +25,22 @@ import {
 } from "./chunk-S4LFRVGD.js";
 import {
   bindRepository,
+  compareSemver,
+  ensureEffectivePostCommitHook,
+  ensurePostCommitHookAtPath,
+  inspectEffectivePostCommitHook,
+  postCommitHookBlock,
   printJson,
-  registerSkillCommands
-} from "./chunk-MZQO7K2P.js";
+  registerSkillCommands,
+  uninstallPostCommitHookAtPath,
+  uninstallProjectPostCommitHook
+} from "./chunk-LOGW54W5.js";
 import {
   fetchFeedbackCapability
 } from "./chunk-R4CUX6FY.js";
 import {
   inspectWorkspaceId
-} from "./chunk-IMAIBPUC.js";
+} from "./chunk-UVIWZWM6.js";
 import {
   binFile,
   commandMatchesBin,
@@ -40,16 +48,17 @@ import {
   packageVersion,
   pinnedHookCommand,
   warmBinCache
-} from "./chunk-YIMUIPMD.js";
+} from "./chunk-KBFFVYBC.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
   decisionIngestionStatus,
   gitToplevel,
   isRepoActiveForCapture,
+  isValidRepoSyncId,
   repoSyncId,
   setRepoActive
-} from "./chunk-LDQZASIF.js";
+} from "./chunk-XTNMSS4C.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -89,17 +98,19 @@ async function applyActivation(active) {
   }
   try {
     let bound;
+    let postCommitHook;
     if (active) {
+      postCommitHook = ensureEffectivePostCommitHook(root).path;
       bound = await bindRepository(root);
     }
     setRepoActive(root, active);
     process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
 `);
-    printJson({ active, repo: root, ...bound });
+    printJson({ active, repo: root, ...bound, ...postCommitHook ? { postCommitHook } : {} });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `[prim] failed to ${active ? "bind and enable" : "disable"} prim: ${detail}
+      `[prim] failed to ${active ? "cover, bind, and enable" : "disable"} prim: ${detail}
 `
     );
     process.exit(1);
@@ -636,28 +647,58 @@ import { dirname as dirname2, join as join2 } from "path";
 import { spawnSync } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import {
+  constants,
+  accessSync,
   chmodSync,
   copyFileSync,
   existsSync as existsSync2,
   mkdirSync,
   mkdtempSync,
   readFileSync as readFileSync2,
+  realpathSync,
   renameSync,
   rmSync,
   symlinkSync,
   writeFileSync
 } from "fs";
 import { homedir } from "os";
-import { dirname, isAbsolute, join, resolve } from "path";
+import { basename, dirname, isAbsolute, join, resolve } from "path";
+
+// src/daemon/env-binding.ts
+function normalizeApiUrl(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+
+// src/daemon/launchd.ts
 var LAUNCHD_LABEL = "ai.getprimitive.prim-daemon";
-var RUNTIME_SCHEMA_VERSION = 1;
+var RUNTIME_SCHEMA_VERSION = 2;
 var RUNTIME_DIR_MODE = 448;
 var RUNTIME_FILE_MODE = 384;
 var RUNTIME_LAUNCHER_MODE = 448;
 var PLIST_FILE_MODE = 384;
-var READY_TIMEOUT_MS = 15e3;
+var LAUNCHER_SCHEMA_VERSION = 1;
+var TRANSITION_TIMEOUT_MS = 15e3;
+var COMMAND_TIMEOUT_MS = 5e3;
 var READY_POLL_MS = 100;
 var READY_PROBE_TIMEOUT_MS = 250;
+var RETRY_MAX_MS = 500;
+var SERVICE_NOT_FOUND = 113;
+var TRANSITION_IN_PROGRESS = 5;
+var OUTPUT_LIMIT = 4096;
+var LaunchctlError = class extends Error {
+  status;
+  timedOut;
+  constructor(operation, result) {
+    const stdout = result.stdout.slice(0, OUTPUT_LIMIT);
+    const stderr = result.stderr.slice(0, OUTPUT_LIMIT);
+    const raw = stderr.trim() || stdout.trim() || `exit ${String(result.status)}`;
+    const detail = raw.replace(/\n?Try re-running the command as root for richer errors\.?/giu, "").trim() || `exit ${String(result.status)}`;
+    super(`launchctl ${operation} failed: ${detail}`);
+    this.name = "LaunchctlError";
+    this.status = result.status;
+    this.timedOut = result.timedOut === true;
+  }
+};
 function xdgDataHome(options) {
   const home = options.homeDir ?? homedir();
   const configured = (options.env ?? process.env).XDG_DATA_HOME;
@@ -672,14 +713,22 @@ function runtimePaths(options = {}) {
     runtimeDir,
     releasesDir: join(runtimeDir, "releases"),
     currentLink,
-    daemonEntry: join(currentLink, "prim-daemon-server"),
-    statuslineEntry: join(currentLink, "prim-statusline"),
     statuslineLauncher: join(runtimeDir, "prim-statusline"),
-    manifestPath: join(currentLink, "manifest.json"),
     disabledMarker: join(dataDir, "daemon.disabled"),
     lifecycleLockDir: join(dataDir, "daemon.lifecycle.lock")
   };
 }
+function daemonControlPaths(options = {}) {
+  const configDir = join(options.homeDir ?? homedir(), ".config", "prim");
+  const legacy = runtimePaths(options);
+  return {
+    launcher: join(configDir, `prim-daemon-launcher-v${LAUNCHER_SCHEMA_VERSION}`),
+    disabledMarker: join(configDir, "daemon.disabled"),
+    lifecycleLockDir: join(configDir, "daemon.lifecycle.lock"),
+    legacyDisabledMarker: legacy.disabledMarker,
+    legacyLifecycleLockDir: legacy.lifecycleLockDir
+  };
+}
 function findPackageVersion(entryFile) {
   let dir = dirname(resolve(entryFile));
   for (let depth = 0; depth < 6; depth++) {
@@ -702,7 +751,7 @@ function findPackageVersion(entryFile) {
 function readRuntimeManifest(path) {
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    if (parsed.schemaVersion !== RUNTIME_SCHEMA_VERSION || typeof parsed.version !== "string" || typeof parsed.nodePath !== "string" || parsed.daemonFile !== "prim-daemon-server") {
+    if (parsed.schemaVersion !== RUNTIME_SCHEMA_VERSION || typeof parsed.version !== "string" || typeof parsed.nodePath !== "string" || parsed.daemonFile !== "prim-daemon-server" || typeof parsed.daemonSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(parsed.daemonSha256) || parsed.statuslineFile !== void 0 && parsed.statuslineFile !== "prim-statusline" || parsed.statuslineFile === void 0 !== (parsed.statuslineSha256 === void 0) || parsed.statuslineSha256 !== void 0 && !/^[a-f0-9]{64}$/u.test(parsed.statuslineSha256)) {
       return null;
     }
     return parsed;
@@ -710,10 +759,18 @@ function readRuntimeManifest(path) {
     return null;
   }
 }
-function sameRuntime(current, desired, paths) {
-  return Boolean(
-    current && current.version === desired.version && current.nodePath === desired.nodePath && current.statuslineFile === desired.statuslineFile && existsSync2(paths.daemonEntry) && (desired.statuslineFile === void 0 || existsSync2(paths.statuslineEntry))
-  );
+function sameRuntime(current, desired, daemonPath, statuslinePath) {
+  if (!current || current.version !== desired.version || current.nodePath !== desired.nodePath || current.daemonSha256 !== desired.daemonSha256 || current.statuslineFile !== desired.statuslineFile || current.statuslineSha256 !== desired.statuslineSha256) {
+    return false;
+  }
+  try {
+    return sha256File(daemonPath) === desired.daemonSha256 && (desired.statuslineSha256 === void 0 || sha256File(statuslinePath) === desired.statuslineSha256);
+  } catch {
+    return false;
+  }
+}
+function sha256File(path) {
+  return createHash2("sha256").update(readFileSync2(path)).digest("hex");
 }
 function atomicSymlink(target, linkPath) {
   const tempLink = `${linkPath}.tmp-${process.pid}-${createHash2("sha256").update(`${target}\0${Date.now()}\0${Math.random()}`).digest("hex").slice(0, 12)}`;
@@ -740,35 +797,60 @@ function stageRuntime(options = {}) {
     version,
     nodePath,
     daemonFile: "prim-daemon-server",
-    ...statuslineSource ? { statuslineFile: "prim-statusline" } : {},
+    daemonSha256: sha256File(daemonSource),
+    ...statuslineSource ? {
+      statuslineFile: "prim-statusline",
+      statuslineSha256: sha256File(statuslineSource)
+    } : {},
     stagedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
-  const current = readRuntimeManifest(paths.manifestPath);
-  if (sameRuntime(current, desired, paths)) {
-    if (current?.statuslineFile) {
+  let currentRelease = null;
+  try {
+    currentRelease = realpathSync(paths.currentLink);
+  } catch {
+  }
+  const current = currentRelease ? readRuntimeManifest(join(currentRelease, "manifest.json")) : null;
+  const currentDaemon = currentRelease ? join(currentRelease, desired.daemonFile) : "";
+  const currentStatusline = currentRelease ? join(currentRelease, "prim-statusline") : "";
+  if (currentRelease && sameRuntime(current, desired, currentDaemon, currentStatusline)) {
+    const manifest = current;
+    const statuslinePath = manifest.statuslineFile ? currentStatusline : void 0;
+    if (statuslinePath) {
       atomicWrite(
         paths.statuslineLauncher,
-        statuslineLauncherContent(paths, current.nodePath),
+        statuslineLauncherContent(statuslinePath, manifest.nodePath),
         RUNTIME_LAUNCHER_MODE
       );
     } else {
       rmSync(paths.statuslineLauncher, { force: true });
     }
-    return { changed: false, manifest: current, paths };
+    return {
+      changed: false,
+      manifest,
+      paths,
+      daemonPath: currentDaemon
+    };
   }
   mkdirSync(paths.releasesDir, { recursive: true, mode: RUNTIME_DIR_MODE });
   chmodSync(paths.runtimeDir, RUNTIME_DIR_MODE);
   chmodSync(paths.releasesDir, RUNTIME_DIR_MODE);
   const stagingDir = mkdtempSync(join(paths.releasesDir, ".stage-"));
   chmodSync(stagingDir, RUNTIME_DIR_MODE);
+  let releaseDir;
   try {
     const daemonTarget = join(stagingDir, desired.daemonFile);
     copyFileSync(daemonSource, daemonTarget);
     chmodSync(daemonTarget, RUNTIME_FILE_MODE);
+    if (sha256File(daemonTarget) !== desired.daemonSha256) {
+      throw new Error("cannot stage runtime: daemon bundle changed while it was copied");
+    }
     if (statuslineSource && desired.statuslineFile) {
       const statuslineTarget = join(stagingDir, desired.statuslineFile);
       copyFileSync(statuslineSource, statuslineTarget);
       chmodSync(statuslineTarget, RUNTIME_FILE_MODE);
+      if (sha256File(statuslineTarget) !== desired.statuslineSha256) {
+        throw new Error("cannot stage runtime: statusline bundle changed while it was copied");
+      }
     }
     const manifestTarget = join(stagingDir, "manifest.json");
     writeFileSync(manifestTarget, `${JSON.stringify(desired, null, 2)}
@@ -780,13 +862,15 @@ function stageRuntime(options = {}) {
     const releaseName = `release-${createHash2("sha256").update(
       `${version}\0${nodePath}\0${desired.statuslineFile ?? ""}\0${desired.stagedAt}\0${process.pid}\0${Math.random()}`
     ).digest("hex").slice(0, 16)}`;
-    const releaseDir = join(paths.releasesDir, releaseName);
+    releaseDir = join(paths.releasesDir, releaseName);
     renameSync(stagingDir, releaseDir);
+    releaseDir = realpathSync(releaseDir);
     atomicSymlink(join("releases", releaseName), paths.currentLink);
     if (desired.statuslineFile) {
+      const statuslinePath = join(releaseDir, desired.statuslineFile);
       atomicWrite(
         paths.statuslineLauncher,
-        statuslineLauncherContent(paths, desired.nodePath),
+        statuslineLauncherContent(statuslinePath, desired.nodePath),
         RUNTIME_LAUNCHER_MODE
       );
     } else {
@@ -796,36 +880,91 @@ function stageRuntime(options = {}) {
     rmSync(stagingDir, { recursive: true, force: true });
     throw error;
   }
-  return { changed: true, manifest: desired, paths };
+  return {
+    changed: true,
+    manifest: desired,
+    paths,
+    daemonPath: join(releaseDir, desired.daemonFile)
+  };
 }
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
-function statuslineLauncherContent(paths, nodePath) {
+function statuslineLauncherContent(statuslinePath, nodePath) {
   return `#!/bin/sh
-exec ${shellQuote(nodePath)} ${shellQuote(paths.statuslineEntry)}
+exec ${shellQuote(nodePath)} ${shellQuote(statuslinePath)}
 `;
 }
 function runtimeStatuslineCommand(options = {}) {
   return shellQuote(runtimePaths(options).statuslineLauncher);
 }
+function generateDaemonLauncher(config) {
+  const apiUrl = config.apiUrl ? normalizeApiUrl(config.apiUrl) || void 0 : void 0;
+  const metadata = {
+    schemaVersion: LAUNCHER_SCHEMA_VERSION,
+    nodePath: config.nodePath,
+    daemonPath: config.daemonPath,
+    runtimeVersion: config.runtimeVersion,
+    apiUrl: apiUrl ?? null
+  };
+  const revision = createHash2("sha256").update(JSON.stringify(metadata)).digest("hex");
+  const encoded = Buffer.from(JSON.stringify({ ...metadata, revision })).toString("base64url");
+  return {
+    revision,
+    content: `#!/bin/sh
+# prim-daemon-launcher: ${encoded}
+export PRIM_RUNTIME_VERSION=${shellQuote(config.runtimeVersion)}
+export PRIM_LAUNCH_REVISION=${shellQuote(revision)}
+${apiUrl ? `export PRIM_API_URL=${shellQuote(apiUrl)}` : "unset PRIM_API_URL"}
+exec ${shellQuote(config.nodePath)} ${shellQuote(config.daemonPath)}
+`
+  };
+}
+function readDaemonLauncher(path) {
+  try {
+    const content = readFileSync2(path, "utf8");
+    const encoded = /^# prim-daemon-launcher: ([A-Za-z0-9_-]+)$/mu.exec(content)?.[1];
+    if (!encoded) return null;
+    const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (value.schemaVersion !== LAUNCHER_SCHEMA_VERSION || typeof value.nodePath !== "string" || typeof value.daemonPath !== "string" || typeof value.runtimeVersion !== "string" || value.apiUrl !== null && typeof value.apiUrl !== "string" || typeof value.revision !== "string") {
+      return null;
+    }
+    const config = {
+      nodePath: value.nodePath,
+      daemonPath: value.daemonPath,
+      runtimeVersion: value.runtimeVersion,
+      ...value.apiUrl === null ? {} : { apiUrl: value.apiUrl }
+    };
+    const expected = generateDaemonLauncher(config);
+    return expected.revision === value.revision && expected.content === content ? config : null;
+  } catch {
+    return null;
+  }
+}
+function readUsableDaemonConfig(path) {
+  const config = readDaemonLauncher(path);
+  if (!config) return null;
+  const manifest = readRuntimeManifest(join(dirname(config.daemonPath), "manifest.json"));
+  try {
+    accessSync(config.nodePath, constants.X_OK);
+    return manifest?.version === config.runtimeVersion && manifest.nodePath === config.nodePath && manifest.daemonSha256 === sha256File(config.daemonPath) ? config : null;
+  } catch {
+    return null;
+  }
+}
 function xmlEscape(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
 function generateLaunchAgentPlist(config) {
-  const apiUrl = config.apiUrl ? `
-      <key>PRIM_API_URL</key>
-      <string>${xmlEscape(config.apiUrl)}</string>` : "";
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${LAUNCHD_LABEL}</string>
+  <string>${xmlEscape(config.label ?? LAUNCHD_LABEL)}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${xmlEscape(config.nodePath)}</string>
-    <string>${xmlEscape(config.daemonPath)}</string>
+    <string>${xmlEscape(config.launcherPath)}</string>
   </array>
   <key>RunAtLoad</key>
   <true/>
@@ -835,6 +974,8 @@ function generateLaunchAgentPlist(config) {
   <integer>10</integer>
   <key>ProcessType</key>
   <string>Background</string>
+  <key>ExitTimeOut</key>
+  <integer>5</integer>
   <key>Umask</key>
   <integer>63</integer>
   <key>WorkingDirectory</key>
@@ -843,11 +984,6 @@ function generateLaunchAgentPlist(config) {
   <string>${xmlEscape(config.logPath)}</string>
   <key>StandardErrorPath</key>
   <string>${xmlEscape(config.logPath)}</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PRIM_RUNTIME_VERSION</key>
-    <string>${xmlEscape(config.runtimeVersion)}</string>${apiUrl}
-  </dict>
 </dict>
 </plist>
 `;
@@ -855,45 +991,57 @@ function generateLaunchAgentPlist(config) {
 function launchdPaths(options = {}) {
   const home = options.homeDir ?? homedir();
   const uid = options.uid ?? process.getuid?.();
+  const label = options.label ?? LAUNCHD_LABEL;
   if (uid === void 0) throw new Error("cannot determine uid for launchd user domain");
   return {
     domainTarget: `gui/${uid}`,
-    serviceTarget: `gui/${uid}/${LAUNCHD_LABEL}`,
-    plistPath: join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`),
+    serviceTarget: `gui/${uid}/${label}`,
+    plistPath: join(home, "Library", "LaunchAgents", `${label}.plist`),
     logPath: join(home, ".config", "prim", "daemon.log")
   };
 }
-var runLaunchctl = (args) => {
-  const result = spawnSync("/bin/launchctl", args, { encoding: "utf8" });
+var runLaunchctl = (args, timeoutMs2 = COMMAND_TIMEOUT_MS) => {
+  const result = spawnSync("/bin/launchctl", args, { encoding: "utf8", timeout: timeoutMs2 });
+  const error = result.error;
   return {
     status: result.status,
     stdout: result.stdout ?? "",
-    stderr: result.error?.message ?? result.stderr ?? ""
+    stderr: error?.message ?? result.stderr ?? "",
+    timedOut: error?.code === "ETIMEDOUT"
   };
 };
 function parseLaunchdService(result) {
-  if (result.status !== 0) return { loaded: false };
+  if (result.status === SERVICE_NOT_FOUND) return { loaded: false };
+  if (result.status !== 0) throw new LaunchctlError("print", result);
   const state = /^\s*state = (.+?)\s*$/m.exec(result.stdout)?.[1];
   const rawPid = /^\s*pid = (\d+)\s*$/m.exec(result.stdout)?.[1];
+  const program2 = /^\s*program = (.+?)\s*$/m.exec(result.stdout)?.[1];
+  if (!program2) throw new Error("launchctl print did not report the registered program");
   const pid = rawPid ? Number(rawPid) : void 0;
-  return { loaded: true, state, pid, raw: result.stdout };
+  return { loaded: true, state, pid, program: program2 };
 }
 function getLaunchdService(options = {}) {
-  const paths = launchdPaths(options);
-  return parseLaunchdService((options.runner ?? runLaunchctl)(["print", paths.serviceTarget]));
+  return parseLaunchdService(
+    (options.runner ?? runLaunchctl)(
+      ["print", launchdPaths(options).serviceTarget],
+      options.timeoutMs ?? COMMAND_TIMEOUT_MS
+    )
+  );
 }
-function atomicWrite(path, content, mode) {
+function atomicWrite(path, content, mode, validate) {
   try {
     if (readFileSync2(path, "utf8") === content) {
       chmodSync(path, mode);
+      validate?.(path, COMMAND_TIMEOUT_MS);
       return false;
     }
   } catch {
   }
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname(path), { recursive: true, mode: RUNTIME_DIR_MODE });
   const temp = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temp, content, { encoding: "utf8", mode, flag: "wx" });
   try {
+    validate?.(temp, COMMAND_TIMEOUT_MS);
     renameSync(temp, path);
   } catch (error) {
     rmSync(temp, { force: true });
@@ -901,20 +1049,25 @@ function atomicWrite(path, content, mode) {
   }
   return true;
 }
-function launchctlOrThrow(runner, args, operation) {
-  const result = runner(args);
-  if (result.status !== 0) {
-    const detail = result.stderr.trim() || result.stdout.trim() || `exit ${String(result.status)}`;
-    throw new Error(`launchctl ${operation} failed: ${detail}`);
-  }
-  return result;
-}
 function defaultSleep(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
-async function identifyDaemon(timeoutMs) {
-  const snapshot = await daemonRequest("status_snapshot", {}, { timeoutMs });
-  return typeof snapshot?.pid === "number" ? snapshot.pid : null;
+function validatePlist(path, timeoutMs2) {
+  if (process.platform !== "darwin") return;
+  const result = spawnSync("/usr/bin/plutil", ["-lint", path], {
+    encoding: "utf8",
+    timeout: timeoutMs2
+  });
+  if (result.status !== 0) {
+    throw new Error(
+      `invalid launchd plist: ${result.error?.message ?? result.stderr?.trim() ?? result.stdout?.trim() ?? `exit ${String(result.status)}`}`
+    );
+  }
+}
+async function inspectDaemon(timeoutMs2) {
+  const value = await daemonRequest("status_snapshot", {}, { timeoutMs: timeoutMs2 });
+  if (!value || !Number.isInteger(value.pid) || (value.pid ?? 0) <= 0) return null;
+  return value;
 }
 function processIsAlive(pid) {
   try {
@@ -924,11 +1077,31 @@ function processIsAlive(pid) {
     return error.code === "EPERM";
   }
 }
+function canonicalProspectivePath(path) {
+  const suffix = [];
+  let ancestor = resolve(path);
+  while (!existsSync2(ancestor)) {
+    const parent = dirname(ancestor);
+    if (parent === ancestor) return resolve(path);
+    suffix.unshift(basename(ancestor));
+    ancestor = parent;
+  }
+  try {
+    return join(realpathSync(ancestor), ...suffix);
+  } catch {
+    return resolve(path);
+  }
+}
 async function withDaemonLifecycleLock(operation, options = {}) {
-  const lockDir = runtimePaths(options).lifecycleLockDir;
-  return withFileLock(lockDir, operation, options.lifecycleLock);
+  const paths = daemonControlPaths(options);
+  const sameLock = canonicalProspectivePath(paths.lifecycleLockDir) === canonicalProspectivePath(paths.legacyLifecycleLockDir);
+  return withFileLock(
+    paths.lifecycleLockDir,
+    () => sameLock ? operation() : withFileLock(paths.legacyLifecycleLockDir, operation, options.lifecycleLock),
+    options.lifecycleLock
+  );
 }
-async function stopVerifiedLegacyDaemon(homeDir) {
+async function stopVerifiedLegacyDaemon(homeDir, deadlineMs, nowMs, sleep2) {
   const pidPath = join(homeDir, ".config", "prim", "daemon.pid");
   let pid;
   try {
@@ -936,122 +1109,314 @@ async function stopVerifiedLegacyDaemon(homeDir) {
   } catch {
     throw new Error("an unsupervised daemon answered, but it has no verifiable pidfile");
   }
-  const snapshot = await daemonRequest("status_snapshot", {}, { timeoutMs: 500 });
+  if (nowMs() >= deadlineMs) throw new Error("legacy verification exceeded the lifecycle deadline");
+  const snapshot = await daemonRequest(
+    "status_snapshot",
+    {},
+    {
+      timeoutMs: timeoutMs(nowMs, deadlineMs, 500)
+    }
+  );
   if (!Number.isInteger(pid) || pid <= 0 || !processIsAlive(pid) || snapshot?.pid !== pid) {
     throw new Error("refusing to signal an unsupervised daemon whose pid cannot be verified");
   }
+  if (nowMs() >= deadlineMs) throw new Error("legacy verification exceeded the lifecycle deadline");
   process.kill(pid, "SIGTERM");
-  const deadline = Date.now() + 5e3;
-  while (Date.now() < deadline && processIsAlive(pid)) {
-    await defaultSleep(100);
+  while (nowMs() < deadlineMs && processIsAlive(pid)) {
+    await sleep2(Math.min(READY_POLL_MS, deadlineMs - nowMs()));
   }
   if (processIsAlive(pid)) {
-    throw new Error(`verified legacy daemon pid=${pid} did not stop within 5000ms`);
+    throw new Error(`verified legacy daemon pid=${pid} did not stop before the lifecycle deadline`);
   }
   return true;
 }
-async function waitForReady(probe, sleep2) {
-  const deadline = Date.now() + READY_TIMEOUT_MS;
-  while (Date.now() < deadline) {
-    if (await probe(READY_PROBE_TIMEOUT_MS)) return true;
-    await sleep2(READY_POLL_MS);
+function timeoutMs(nowMs, deadlineMs, cap = COMMAND_TIMEOUT_MS) {
+  return Math.max(1, Math.min(cap, Math.ceil(deadlineMs - nowMs())));
+}
+function desiredDaemonIsRunning(transition, observed) {
+  const { service, identity } = observed;
+  return Boolean(
+    service.loaded && service.program === transition.launcherPath && service.pid !== void 0 && identity?.pid === service.pid && identity.version === transition.version && identity.launchRevision === transition.revision
+  );
+}
+function getService(transition) {
+  return parseLaunchdService(
+    transition.runner(
+      ["print", transition.paths.serviceTarget],
+      timeoutMs(transition.nowMs, transition.deadlineMs)
+    )
+  );
+}
+async function observe(transition) {
+  const service = getService(transition);
+  const identity = service.loaded && service.program === transition.launcherPath ? await transition.inspect(
+    timeoutMs(transition.nowMs, transition.deadlineMs, READY_PROBE_TIMEOUT_MS)
+  ) : null;
+  return { service, identity };
+}
+async function tryObserve(transition) {
+  try {
+    return await observe(transition);
+  } catch (error) {
+    if (!(error instanceof LaunchctlError)) throw error;
+    return null;
+  }
+}
+async function bootstrap(transition, oldProgram) {
+  let retryMs = READY_POLL_MS;
+  let lastError = null;
+  while (transition.nowMs() < transition.deadlineMs) {
+    const result = transition.runner(
+      ["bootstrap", transition.paths.domainTarget, transition.paths.plistPath],
+      timeoutMs(transition.nowMs, transition.deadlineMs)
+    );
+    if (result.status === 0) return;
+    const error = new LaunchctlError("bootstrap", result);
+    lastError = error;
+    const observed = await tryObserve(transition);
+    const retryable = error.status === TRANSITION_IN_PROGRESS || error.timedOut;
+    if (observed?.service.loaded) {
+      if (observed.service.program === transition.launcherPath) {
+        if (desiredDaemonIsRunning(transition, observed)) return;
+        if (retryable) return;
+      } else if (observed.service.program !== oldProgram) {
+        throw new Error(
+          `refusing to replace unexpected launchd program ${observed.service.program}`
+        );
+      }
+    }
+    if (!retryable) throw error;
+    const remaining = transition.deadlineMs - transition.nowMs();
+    if (remaining <= 0) break;
+    await transition.sleep(Math.min(retryMs, remaining));
+    retryMs = Math.min(retryMs * 2, RETRY_MAX_MS);
+  }
+  throw new Error(
+    `launchctl bootstrap did not converge within ${TRANSITION_TIMEOUT_MS}ms${lastError ? `: ${lastError.message}` : ""}`
+  );
+}
+async function reloadDefinition(transition, oldProgram) {
+  const result = transition.runner(
+    ["bootout", transition.paths.serviceTarget],
+    timeoutMs(transition.nowMs, transition.deadlineMs)
+  );
+  if (result.status !== 0) {
+    const error = new LaunchctlError("bootout", result);
+    const observed = await tryObserve(transition);
+    const retryable = error.status === TRANSITION_IN_PROGRESS || error.timedOut;
+    if (observed?.service.loaded) {
+      if (observed.service.program === transition.launcherPath) {
+        if (desiredDaemonIsRunning(transition, observed)) return;
+        if (retryable) return;
+      }
+      if (observed.service.program !== oldProgram || !retryable) throw error;
+    } else if (!observed && !retryable) {
+      throw error;
+    }
+  }
+  await bootstrap(transition, oldProgram);
+}
+async function waitForDesired(transition, repairMismatch = false) {
+  let observed = { service: { loaded: false }, identity: null };
+  let repaired = false;
+  do {
+    const current = await tryObserve(transition);
+    if (current) {
+      observed = current;
+      if (desiredDaemonIsRunning(transition, observed)) return observed;
+      if (observed.service.loaded && observed.service.program !== transition.launcherPath) {
+        throw new Error(`launchd registered unexpected program ${observed.service.program}`);
+      }
+      if (repairMismatch && !repaired && observed.service.loaded && observed.service.program === transition.launcherPath && observed.identity) {
+        repaired = true;
+        await kickstart(transition);
+      }
+    }
+    const remaining = transition.deadlineMs - transition.nowMs();
+    if (remaining <= 0) break;
+    await transition.sleep(Math.min(READY_POLL_MS, remaining));
+  } while (transition.nowMs() < transition.deadlineMs);
+  return observed;
+}
+async function kickstart(transition) {
+  const result = transition.runner(
+    ["kickstart", "-k", transition.paths.serviceTarget],
+    timeoutMs(transition.nowMs, transition.deadlineMs)
+  );
+  if (result.status === 0) return;
+  const error = new LaunchctlError("kickstart", result);
+  const observed = await tryObserve(transition);
+  if (observed && desiredDaemonIsRunning(transition, observed)) return;
+  if (!error.timedOut) throw error;
+  const ready = await waitForDesired(transition);
+  if (!desiredDaemonIsRunning(transition, ready)) throw error;
+}
+async function waitForAbsence(context) {
+  let lastError = null;
+  while (context.nowMs() < context.deadlineMs) {
+    try {
+      const service = getLaunchdService({
+        ...context.options,
+        runner: context.runner,
+        timeoutMs: timeoutMs(context.nowMs, context.deadlineMs)
+      });
+      if (!service.loaded) {
+        const identity = await context.inspect(
+          timeoutMs(context.nowMs, context.deadlineMs, READY_PROBE_TIMEOUT_MS)
+        );
+        const socketReleased = context.previousPid === void 0 || identity?.pid !== context.previousPid;
+        const processExited = context.previousPid === void 0 || !processIsAlive(context.previousPid);
+        if (socketReleased && processExited) return;
+      }
+    } catch (error) {
+      if (!(error instanceof LaunchctlError)) throw error;
+      lastError = error;
+    }
+    const remaining = context.deadlineMs - context.nowMs();
+    if (remaining <= 0) break;
+    await context.sleep(Math.min(READY_POLL_MS, remaining));
   }
-  return probe(READY_PROBE_TIMEOUT_MS);
+  throw new Error(
+    `launchctl bootout did not converge within ${TRANSITION_TIMEOUT_MS}ms${lastError ? `: ${lastError.message}` : ""}`
+  );
 }
 function daemonExplicitlyDisabled(options = {}) {
-  return existsSync2(runtimePaths(options).disabledMarker);
+  const paths = daemonControlPaths(options);
+  return existsSync2(paths.disabledMarker) || existsSync2(paths.legacyDisabledMarker);
 }
 function setDaemonExplicitlyDisabled(disabled, options = {}) {
-  const marker = runtimePaths(options).disabledMarker;
+  const paths = daemonControlPaths(options);
   if (!disabled) {
-    rmSync(marker, { force: true });
+    rmSync(paths.disabledMarker, { force: true });
+    rmSync(paths.legacyDisabledMarker, { force: true });
     return;
   }
-  mkdirSync(dirname(marker), { recursive: true, mode: RUNTIME_DIR_MODE });
-  writeFileSync(marker, "disabled by `prim daemon stop`\n", {
-    encoding: "utf8",
-    mode: RUNTIME_FILE_MODE
-  });
-  chmodSync(marker, RUNTIME_FILE_MODE);
+  const content = "disabled by `prim daemon stop`\n";
+  if (paths.legacyDisabledMarker !== paths.disabledMarker) {
+    atomicWrite(paths.legacyDisabledMarker, content, RUNTIME_FILE_MODE);
+  }
+  atomicWrite(paths.disabledMarker, content, RUNTIME_FILE_MODE);
 }
 async function ensureMacDaemon(options = {}) {
   return withDaemonLifecycleLock(() => ensureMacDaemonLocked(options), options);
 }
 async function ensureMacDaemonLocked(options) {
+  const runner = options.runner ?? runLaunchctl;
+  let service = getLaunchdService({ ...options, runner });
   if (!options.explicitlyStarted && daemonExplicitlyDisabled(options)) {
+    const control2 = daemonControlPaths(options);
+    if (!existsSync2(control2.disabledMarker)) {
+      atomicWrite(control2.disabledMarker, "disabled by `prim daemon stop`\n", RUNTIME_FILE_MODE);
+    }
     return {
       state: "disabled",
       action: "none",
       runtimeChanged: false,
       plistChanged: false,
       responding: false,
-      service: getLaunchdService(options)
+      service
     };
   }
   if (options.explicitlyStarted) setDaemonExplicitlyDisabled(false, options);
-  const runtime = stageRuntime(options);
+  const control = daemonControlPaths(options);
+  const requestedSource = options.daemonSource ?? binFile("prim-daemon-server");
+  if (!options.version && !requestedSource) {
+    throw new Error("cannot determine runtime version: daemon is unavailable");
+  }
+  const requestedVersion = options.version ?? findPackageVersion(requestedSource);
+  const selected = options.explicitlyStarted ? null : readDaemonLauncher(control.launcher);
+  const precedence = selected ? compareSemver(selected.runtimeVersion, requestedVersion) : null;
+  const retainSelected = selected !== null && (precedence === 1 || precedence === void 0 && selected.runtimeVersion !== requestedVersion);
+  let runtime;
+  let daemonConfig;
+  const configuredApiUrl = (options.env ?? process.env).PRIM_API_URL;
+  const apiUrl = configuredApiUrl ? normalizeApiUrl(configuredApiUrl) || void 0 : void 0;
+  if (retainSelected && selected) {
+    const usable = readUsableDaemonConfig(control.launcher);
+    if (!usable) {
+      throw new Error(
+        `selected daemon runtime ${selected.runtimeVersion} is unavailable or corrupt; refusing automatic downgrade to ${requestedVersion}`
+      );
+    }
+    daemonConfig = {
+      nodePath: usable.nodePath,
+      daemonPath: usable.daemonPath,
+      runtimeVersion: usable.runtimeVersion,
+      ...apiUrl ? { apiUrl } : {}
+    };
+  } else {
+    runtime = stageRuntime({ ...options, version: requestedVersion });
+    daemonConfig = {
+      nodePath: runtime.manifest.nodePath,
+      daemonPath: runtime.daemonPath,
+      runtimeVersion: runtime.manifest.version,
+      ...apiUrl ? { apiUrl } : {}
+    };
+  }
   const servicePaths = launchdPaths(options);
   mkdirSync(dirname(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
   writeFileSync(servicePaths.logPath, "", { mode: RUNTIME_FILE_MODE, flag: "a" });
   chmodSync(servicePaths.logPath, RUNTIME_FILE_MODE);
+  const launcher = generateDaemonLauncher(daemonConfig);
+  atomicWrite(control.launcher, launcher.content, RUNTIME_LAUNCHER_MODE);
   const plist = generateLaunchAgentPlist({
-    nodePath: runtime.manifest.nodePath,
-    daemonPath: runtime.paths.daemonEntry,
-    runtimeVersion: runtime.manifest.version,
+    launcherPath: control.launcher,
     logPath: servicePaths.logPath,
     workingDirectory: options.homeDir ?? homedir(),
-    apiUrl: (options.env ?? process.env).PRIM_API_URL
+    label: options.label
   });
-  const plistChanged = atomicWrite(servicePaths.plistPath, plist, PLIST_FILE_MODE);
-  const runner = options.runner ?? runLaunchctl;
-  let service = getLaunchdService({ ...options, runner });
+  const plistChanged = atomicWrite(
+    servicePaths.plistPath,
+    plist,
+    PLIST_FILE_MODE,
+    options.validatePlist ?? validatePlist
+  );
+  const sleep2 = options.sleep ?? defaultSleep;
+  const nowMs = options.nowMs ?? performance.now.bind(performance);
+  const deadlineMs = nowMs() + TRANSITION_TIMEOUT_MS;
+  const inspect = options.inspectDaemon ?? inspectDaemon;
+  const transition = {
+    paths: servicePaths,
+    runner,
+    inspect,
+    sleep: sleep2,
+    nowMs,
+    deadlineMs,
+    launcherPath: control.launcher,
+    version: daemonConfig.runtimeVersion,
+    revision: launcher.revision
+  };
+  const migrateLegacy = options.migrateLegacy ?? (() => stopVerifiedLegacyDaemon(options.homeDir ?? homedir(), deadlineMs, nowMs, sleep2));
   let action = "none";
-  if (service.loaded && plistChanged) {
-    launchctlOrThrow(runner, ["bootout", servicePaths.serviceTarget], "bootout");
-    launchctlOrThrow(
-      runner,
-      ["bootstrap", servicePaths.domainTarget, servicePaths.plistPath],
-      "bootstrap"
-    );
-    action = "reload";
-  } else if (!service.loaded) {
-    if (await (options.probe ?? daemonIsLive)(READY_PROBE_TIMEOUT_MS)) {
-      await (options.migrateLegacy ?? (() => stopVerifiedLegacyDaemon(options.homeDir ?? homedir())))();
+  const observed = await observe(transition);
+  service = observed.service;
+  if (!service.loaded) {
+    if (await inspect(timeoutMs(nowMs, deadlineMs, READY_PROBE_TIMEOUT_MS))) {
+      await migrateLegacy();
     }
-    launchctlOrThrow(
-      runner,
-      ["bootstrap", servicePaths.domainTarget, servicePaths.plistPath],
-      "bootstrap"
-    );
+    await bootstrap(transition);
     action = "bootstrap";
-  } else {
-    const healthy = await (options.probe ?? daemonIsLive)(READY_PROBE_TIMEOUT_MS);
-    const socketPid2 = healthy ? await (options.identify ?? identifyDaemon)(READY_PROBE_TIMEOUT_MS) : null;
-    const ownsSocket = service.pid !== void 0 && socketPid2 !== null && service.pid === socketPid2;
-    if (healthy && socketPid2 !== null && !ownsSocket) {
-      await (options.migrateLegacy ?? (() => stopVerifiedLegacyDaemon(options.homeDir ?? homedir())))();
-    }
-    if (runtime.changed || options.forceRestart || !healthy || !ownsSocket) {
-      launchctlOrThrow(runner, ["kickstart", "-k", servicePaths.serviceTarget], "kickstart");
-      action = "kickstart";
-    }
-  }
-  const responding = await waitForReady(
-    options.probe ?? daemonIsLive,
-    options.sleep ?? defaultSleep
-  );
-  service = getLaunchdService({ ...options, runner });
-  const socketPid = responding ? await (options.identify ?? identifyDaemon)(READY_PROBE_TIMEOUT_MS) : null;
-  const running = responding && service.loaded && service.pid !== void 0 && socketPid !== null && service.pid === socketPid;
+  } else if (service.program !== control.launcher) {
+    if (!service.program) throw new Error("launchd did not report the registered program");
+    await reloadDefinition(transition, service.program);
+    action = "reload";
+  } else if (options.forceRestart || !desiredDaemonIsRunning(transition, observed)) {
+    await kickstart(transition);
+    action = "kickstart";
+  }
+  const ready = await waitForDesired(transition, action === "bootstrap" || action === "reload");
+  service = ready.service;
+  const responding = ready.identity !== null;
+  const running = desiredDaemonIsRunning(transition, ready);
   return {
     state: running ? "running" : "unhealthy",
     action,
-    runtimeChanged: runtime.changed,
+    runtimeChanged: runtime?.changed ?? false,
     plistChanged,
     responding,
-    ...socketPid === null ? {} : { socketPid },
+    ...ready.identity ? { socketPid: ready.identity.pid } : {},
     service,
-    runtime
+    ...runtime ? { runtime } : {}
   };
 }
 async function bootoutMacDaemon(options = {}) {
@@ -1060,14 +1425,39 @@ async function bootoutMacDaemon(options = {}) {
 async function bootoutMacDaemonLocked(options) {
   setDaemonExplicitlyDisabled(true, options);
   const runner = options.runner ?? runLaunchctl;
+  const inspect = options.inspectDaemon ?? inspectDaemon;
+  const sleep2 = options.sleep ?? defaultSleep;
+  const nowMs = options.nowMs ?? performance.now.bind(performance);
+  const deadlineMs = nowMs() + TRANSITION_TIMEOUT_MS;
   const paths = launchdPaths(options);
+  const migrateLegacy = options.migrateLegacy ?? (() => stopVerifiedLegacyDaemon(options.homeDir ?? homedir(), deadlineMs, nowMs, sleep2));
   const service = getLaunchdService({ ...options, runner });
-  if (service.loaded) {
-    launchctlOrThrow(runner, ["bootout", paths.serviceTarget], "bootout");
-    return { wasLoaded: true, legacyStopped: false, service };
+  const wasLoaded = service.loaded;
+  if (wasLoaded) {
+    const result = runner(["bootout", paths.serviceTarget], timeoutMs(nowMs, deadlineMs));
+    if (result.status !== 0) {
+      const error = new LaunchctlError("bootout", result);
+      const after = getLaunchdService({
+        ...options,
+        runner,
+        timeoutMs: timeoutMs(nowMs, deadlineMs)
+      });
+      if (!error.timedOut && error.status !== TRANSITION_IN_PROGRESS && after.loaded) {
+        throw error;
+      }
+    }
+    await waitForAbsence({
+      options,
+      runner,
+      inspect,
+      sleep: sleep2,
+      nowMs,
+      deadlineMs,
+      previousPid: service.pid
+    });
   }
-  const legacyStopped = await (options.probe ?? daemonIsLive)(READY_PROBE_TIMEOUT_MS) ? await (options.migrateLegacy ?? (() => stopVerifiedLegacyDaemon(options.homeDir ?? homedir())))() : false;
-  return { wasLoaded: false, legacyStopped, service };
+  const legacyStopped = await inspect(timeoutMs(nowMs, deadlineMs, READY_PROBE_TIMEOUT_MS)) ? await migrateLegacy() : false;
+  return { wasLoaded, legacyStopped, service };
 }
 
 // src/commands/claude-install.ts
@@ -1703,7 +2093,7 @@ var LOG_FILE_MODE = 384;
 var STOP_TIMEOUT_MS = 5e3;
 var STOP_POLL_MS = 100;
 var STATUS_PROBE_TIMEOUT_MS = 500;
-var READY_TIMEOUT_MS2 = 5e3;
+var READY_TIMEOUT_MS = 5e3;
 var READY_POLL_MS2 = 100;
 var READY_PROBE_TIMEOUT_MS2 = 250;
 var HEALTHY_TIMEOUT_MS = 3e4;
@@ -1717,13 +2107,6 @@ function formatDaemonLifecycleMessage(message, decisionIngestion) {
 function formatCurrentDaemonLifecycleMessage(message) {
   return formatDaemonLifecycleMessage(message, decisionIngestionStatus(process.cwd()));
 }
-var MAX_HEALTH_ERROR_LENGTH = 240;
-function boundedHealthError(value) {
-  if (!value) return void 0;
-  const clean = stripControlChars(value).replace(/\s+/g, " ").trim();
-  if (!clean) return void 0;
-  return clean.length <= MAX_HEALTH_ERROR_LENGTH ? clean : `${clean.slice(0, MAX_HEALTH_ERROR_LENGTH - 1)}\u2026`;
-}
 function daemonDegradedReason(snapshot) {
   if (!snapshot || snapshot.healthy !== false) return void 0;
   if (snapshot.needsReauth) {
@@ -1783,8 +2166,8 @@ function openDaemonLog(configDir = CONFIG_DIR) {
   }
   return openSync2(join4(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
-async function waitForReady2() {
-  const deadline = Date.now() + READY_TIMEOUT_MS2;
+async function waitForReady() {
+  const deadline = Date.now() + READY_TIMEOUT_MS;
   while (Date.now() < deadline) {
     if (await daemonIsLive(READY_PROBE_TIMEOUT_MS2)) {
       return true;
@@ -1888,7 +2271,7 @@ async function detachedDaemonStart(opts) {
   if (logFd !== void 0) {
     closeSync2(logFd);
   }
-  const live = await waitForReady2();
+  const live = await waitForReady();
   if (live) {
     const after = readPidfile();
     process.stderr.write(
@@ -1899,7 +2282,7 @@ async function detachedDaemonStart(opts) {
     return;
   }
   process.stderr.write(
-    `[prim] \u2717 daemon start: spawned but the socket did not respond within ${READY_TIMEOUT_MS2}ms (check that \`${DAEMON_BIN}\` resolves, and see ${LOG_PATH})
+    `[prim] \u2717 daemon start: spawned but the socket did not respond within ${READY_TIMEOUT_MS}ms (check that \`${DAEMON_BIN}\` resolves, and see ${LOG_PATH})
 `
   );
   console.log(JSON.stringify({ started: false }, null, 2));
@@ -1981,8 +2364,9 @@ async function macDaemonStart(forceRestart = false) {
   const healthy = daemonStartIsHealthy(serviceReady, snapshot, expectedVersion);
   if (healthy) {
     const verb = result.action === "none" ? "already running" : "started";
+    const servicePid = result.service.loaded ? result.service.pid : void 0;
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ${verb} under launchd (pid=${snapshot?.pid ?? result.service.pid ?? "?"})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ${verb} under launchd (pid=${snapshot?.pid ?? servicePid ?? "?"})`)}
 `
     );
   } else {
@@ -1999,7 +2383,7 @@ async function macDaemonStart(forceRestart = false) {
         started: healthy,
         supervised: true,
         action: result.action,
-        pid: snapshot?.pid ?? result.service.pid,
+        pid: snapshot?.pid ?? (result.service.loaded ? result.service.pid : void 0),
         loaded: result.service.loaded,
         responding: result.responding,
         healthy,
@@ -2071,6 +2455,19 @@ function classifyStatus(pidAlive, responding, snapshot, pid) {
   return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK2 };
 }
 function classifyLaunchdStatus(service, responding, snapshot, disabled) {
+  if (!service) {
+    return {
+      json: {
+        running: responding,
+        responding,
+        supervised: true,
+        state: "unknown",
+        disabled,
+        ...snapshot ?? {}
+      },
+      exitCode: EXIT_BOOTING
+    };
+  }
   if (!service.loaded) {
     if (responding) {
       return {
@@ -2198,7 +2595,13 @@ async function detachedDaemonStatus() {
   }
 }
 async function macDaemonStatus() {
-  const service = getLaunchdService();
+  let service;
+  let launchdError;
+  try {
+    service = getLaunchdService();
+  } catch (error) {
+    launchdError = error;
+  }
   const responding = await daemonIsLive(STATUS_PROBE_TIMEOUT_MS);
   const snapshot = responding ? await daemonRequest(
     "status_snapshot",
@@ -2207,7 +2610,13 @@ async function macDaemonStatus() {
   ) : null;
   const disabled = daemonExplicitlyDisabled();
   const { json, exitCode } = classifyLaunchdStatus(service, responding, snapshot, disabled);
-  if (!service.loaded && responding) {
+  if (!service) {
+    const detail = boundedHealthError(
+      launchdError instanceof Error ? launchdError.message : String(launchdError)
+    );
+    process.stderr.write(`[prim] \u2717 launchd status unavailable${detail ? `: ${detail}` : ""}
+`);
+  } else if (!service.loaded && responding) {
     process.stderr.write(
       `[prim] \u25CC daemon pid=${snapshot?.pid ?? "?"} is live but not supervised by launchd
 `
@@ -3347,8 +3756,13 @@ async function checkDaemon() {
   if (process.platform === "darwin") {
     try {
       service = getLaunchdService();
-    } catch {
-      service = { loaded: false };
+    } catch (error) {
+      const detail = boundedHealthError(error instanceof Error ? error.message : String(error));
+      return {
+        name: "daemon",
+        status: "fail",
+        detail: `launchd status unavailable${detail ? `: ${detail}` : ""}`
+      };
     }
   }
   const snapshot = await daemonRequest(
@@ -3443,6 +3857,46 @@ function checkWorkspaceIdentity() {
       };
   }
 }
+function classifyRepositoryBinding(value) {
+  return isValidRepoSyncId(value) ? {
+    name: "repo-binding",
+    status: "ok",
+    detail: "valid local repository binding ready"
+  } : {
+    name: "repo-binding",
+    status: "fail",
+    detail: "missing or invalid local prim.repoSyncId \u2014 run `prim enable`"
+  };
+}
+function checkRepositoryBinding() {
+  return classifyRepositoryBinding(repoSyncId(process.cwd()));
+}
+function classifyPostCommitHook(inspection) {
+  if (inspection.covered) {
+    return {
+      name: "post-commit",
+      status: "ok",
+      detail: `effective and executable \xB7 ${inspection.kind} \xB7 ${inspection.hookPath}`
+    };
+  }
+  return {
+    name: "post-commit",
+    status: "fail",
+    detail: `${inspection.reason ?? "uncovered"} \xB7 ${inspection.hookPath}`
+  };
+}
+function checkPostCommitHook() {
+  try {
+    return classifyPostCommitHook(inspectEffectivePostCommitHook());
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      name: "post-commit",
+      status: /not a git repository/iu.test(detail) ? "warn" : "fail",
+      detail: detail.slice(0, 120)
+    };
+  }
+}
 function checkFeedbackHooks() {
   try {
     const status = performStatus();
@@ -3472,6 +3926,9 @@ function parseMovesStatus(value) {
   if (status.captureState !== "enabled" && status.captureState !== "disabled" || !nullableNumber(status.latestIngestAt) || !nullableNumber(status.latestClassificationAt) || !nullableNumber(status.highWaterMark) || typeof status.pendingSessionCount !== "number" || !Number.isInteger(status.pendingSessionCount) || status.pendingSessionCount < 0 || typeof status.sampled !== "boolean") {
     throw new Error("moves status returned an invalid response");
   }
+  if (status.oldestPendingAt !== void 0 && !nullableNumber(status.oldestPendingAt) || status.oldestPendingAgeMs !== void 0 && !nullableNumber(status.oldestPendingAgeMs) || typeof status.oldestPendingAgeMs === "number" && status.oldestPendingAgeMs < 0 || status.pendingCommitCorrelationCount !== void 0 && (!Number.isInteger(status.pendingCommitCorrelationCount) || status.pendingCommitCorrelationCount < 0)) {
+    throw new Error("moves status returned invalid pending-age fields");
+  }
   return status;
 }
 function classifyMovesStatus(status) {
@@ -3482,10 +3939,11 @@ function classifyMovesStatus(status) {
   };
   let classification;
   if (status.pendingSessionCount > 0) {
+    const oldest = typeof status.oldestPendingAgeMs === "number" ? ` \xB7 oldest ${String(Math.round(status.oldestPendingAgeMs / MS_PER_SECOND))}s` : typeof status.oldestPendingAt === "number" ? ` \xB7 oldest ${String(Math.max(0, Math.round((Date.now() - status.oldestPendingAt) / MS_PER_SECOND)))}s` : "";
     classification = {
       name: "classification",
       status: "warn",
-      detail: `${String(status.pendingSessionCount)} session(s) pending${status.sampled ? " in a bounded sample" : ""}`
+      detail: `${String(status.pendingSessionCount)} session(s) pending${oldest}${status.sampled ? " in a bounded sample" : ""}`
     };
   } else if (status.sampled) {
     classification = {
@@ -3500,7 +3958,16 @@ function classifyMovesStatus(status) {
       detail: status.latestClassificationAt === null ? "no sessions awaiting classification" : `caught up \xB7 last ${new Date(status.latestClassificationAt).toISOString()}`
     };
   }
-  return [capture, classification];
+  const correlation = status.pendingCommitCorrelationCount === void 0 ? void 0 : status.pendingCommitCorrelationCount > 0 ? {
+    name: "commit-correlation",
+    status: "warn",
+    detail: `${String(status.pendingCommitCorrelationCount)} commit(s) awaiting evidence correlation`
+  } : {
+    name: "commit-correlation",
+    status: "ok",
+    detail: "caught up"
+  };
+  return correlation ? [capture, classification, correlation] : [capture, classification];
 }
 async function checkBackend() {
   try {
@@ -3549,6 +4016,8 @@ async function collectChecks() {
     checkStranded(),
     checkFeedbackHooks(),
     checkWorkspaceIdentity(),
+    checkRepositoryBinding(),
+    checkPostCommitHook(),
     ...backend,
     await checkFeedbackCapability()
   ];
@@ -3932,6 +4401,7 @@ import { Option as Option2 } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
 var HOOKS = [PRE_COMMIT, POST_COMMIT];
+var GIT_TIMEOUT_MS = 1e3;
 function blockMarkers(spec) {
   return {
     start: `# >>> prim ${spec.hookName} hook >>>`,
@@ -3958,12 +4428,14 @@ ${hookShim(spec.binName)}
 `;
 }
 function huskyBlock(spec) {
+  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${hookShim(spec.binName)}
 ${end}`;
 }
 function gatedBlock(spec) {
+  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${gatedShim(spec.binName)}
@@ -3972,6 +4444,21 @@ ${end}`;
 function mergePrimBlock(hookPath, block, binName) {
   if (existsSync7(hookPath)) {
     const existing = readFileSync6(hookPath, "utf-8");
+    const start = block.slice(0, block.indexOf("\n"));
+    const end = block.slice(block.lastIndexOf("\n") + 1);
+    const starts = existing.split(start).length - 1;
+    const ends = existing.split(end).length - 1;
+    if (starts !== 0 || ends !== 0) {
+      if (starts !== 1 || ends !== 1 || existing.indexOf(end) < existing.indexOf(start)) {
+        throw new Error(`malformed Prim hook markers in ${hookPath}`);
+      }
+      const from = existing.indexOf(start);
+      const through = existing.indexOf(end) + end.length;
+      const refreshed = existing.slice(0, from) + block + existing.slice(through);
+      if (refreshed === existing) return false;
+      writeFileSync4(hookPath, refreshed, { mode: 493 });
+      return true;
+    }
     if (containsPrimHook(existing, binName)) return false;
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
     writeFileSync4(hookPath, `${existing}${separator}${block}
@@ -4027,7 +4514,7 @@ function installToHusky(gitRoot, spec = PRE_COMMIT) {
   }
 }
 function installToDotGit(gitRoot, spec = PRE_COMMIT) {
-  const hooksDir = resolve2(gitRoot, ".git", "hooks");
+  const hooksDir = projectHooksDir(gitRoot);
   const hookPath = resolve2(hooksDir, spec.hookName);
   if (!existsSync7(hooksDir)) {
     mkdirSync5(hooksDir, { recursive: true });
@@ -4045,6 +4532,18 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
+function projectHooksDir(gitRoot) {
+  const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
+    cwd: gitRoot,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: GIT_TIMEOUT_MS
+  }).trim();
+  if (commonDir === "") {
+    throw new Error("git returned an empty common directory");
+  }
+  return resolve2(gitRoot, commonDir, "hooks");
+}
 var PRIM_GIT_HOOKS_DIR = join6(homedir6(), ".config", "prim", "git-hooks");
 function expandTilde(p) {
   return p.startsWith("~/") ? join6(homedir6(), p.slice(2)) : p;
@@ -4056,7 +4555,8 @@ function gitConfigGet(level) {
   try {
     return execFileSync("git", ["config", level, "--get", "core.hooksPath"], {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
     }).trim();
   } catch {
     return "";
@@ -4084,14 +4584,18 @@ var PASSTHROUGH_HOOKS = [
 ];
 function globalHookScript(spec) {
   const chainExit = spec.hookName === "pre-commit" ? "|| exit $?" : "|| true";
+  const invocation = spec.hookName === POST_COMMIT.hookName ? postCommitHookBlock() : gatedShim(spec.binName);
+  const beforeComments = spec.hookName === POST_COMMIT.hookName ? `${invocation}
+` : "";
+  const afterComments = spec.hookName === POST_COMMIT.hookName ? "" : `${invocation}
+`;
   return `#!/bin/sh
-# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
+${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
 # Install/uninstall: prim hooks install|uninstall --scope user
 # Runs prim only where activated \u2014 'prim enable' (this repo) or
 # 'git config --global prim.active true' (every repo). Chains to the repo's own
 # hook regardless, so inactive repos are unaffected.
-${gatedShim(spec.binName)}
-common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+${afterComments}common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
 repo_hook="$common_dir/hooks/${spec.hookName}"
 if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null; then
   "$repo_hook" "$@" ${chainExit}
@@ -4116,18 +4620,29 @@ function writeOwnHooks() {
     mkdirSync5(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
-    writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
-      mode: 493
-    });
+    const path = resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName);
+    if (spec.hookName === POST_COMMIT.hookName) {
+      ensurePostCommitHookAtPath(path, globalHookScript(spec));
+    } else {
+      writeFileSync4(path, globalHookScript(spec), { mode: 493 });
+    }
   }
   for (const name of PASSTHROUGH_HOOKS) {
     writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
   }
 }
 function appendPrimBlock(hookPath, spec) {
+  if (spec.hookName === POST_COMMIT.hookName) {
+    ensurePostCommitHookAtPath(hookPath);
+    return;
+  }
   mergePrimBlock(hookPath, gatedBlock(spec), spec.binName);
 }
 function stripPrimBlock(hookPath, spec) {
+  if (spec.hookName === POST_COMMIT.hookName) {
+    uninstallPostCommitHookAtPath(hookPath);
+    return;
+  }
   if (!existsSync7(hookPath)) return;
   const existing = readFileSync6(hookPath, "utf-8");
   const primCreated = existing.includes(PRIM_CREATED_MARK);
@@ -4159,7 +4674,10 @@ function installGlobalHooks(opts = {}) {
       );
     }
     writeOwnHooks();
-    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR]);
+    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR], {
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS
+    });
     console.log(
       `Installed prim global git hooks; set core.hooksPath to ${PRIM_GIT_HOOKS_DIR}. Repos are opt-in: run \`prim enable\` in each repo to capture, or \`git config --global prim.active true\` for all.`
     );
@@ -4186,7 +4704,10 @@ function uninstallGlobalHooks() {
       const p = resolve2(PRIM_GIT_HOOKS_DIR, name);
       if (existsSync7(p)) unlinkSync2(p);
     }
-    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"]);
+    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"], {
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS
+    });
     console.log("Removed prim global git hooks and unset core.hooksPath.");
     return;
   }
@@ -4201,13 +4722,17 @@ function uninstallGlobalHooks() {
   console.log("No prim global git hooks found.");
 }
 function installHooks(gitRoot, target) {
-  for (const spec of HOOKS) {
+  for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
     if (target === "husky") {
       installToHusky(gitRoot, spec);
     } else {
       installToDotGit(gitRoot, spec);
     }
   }
+  const postCommit = ensureEffectivePostCommitHook(gitRoot);
+  console.log(
+    `${postCommit.changed ? "Installed" : "Refreshed"} effective post-commit hook at ${postCommit.path}.`
+  );
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
@@ -4269,8 +4794,9 @@ function registerHooksCommands(program2) {
       return;
     }
     const gitRoot = getGitRoot();
-    for (const spec of HOOKS) {
-      const hookPath = resolve2(gitRoot, ".git", "hooks", spec.hookName);
+    const hooksDir = projectHooksDir(gitRoot);
+    for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
+      const hookPath = resolve2(hooksDir, spec.hookName);
       if (!existsSync7(hookPath)) {
         console.log(`No ${spec.hookName} hook found.`);
         continue;
@@ -4282,6 +4808,14 @@ function registerHooksCommands(program2) {
         console.log(`Left ${spec.hookName} hook at ${hookPath} untouched (not a prim hook).`);
       }
     }
+    const postCommit = uninstallProjectPostCommitHook(gitRoot);
+    if (!postCommit.changed) {
+      console.log(`No Prim post-commit block found at ${postCommit.path}.`);
+    } else if (postCommit.removedFile) {
+      console.log(`Removed Prim-created post-commit hook at ${postCommit.path}.`);
+    } else {
+      console.log(`Removed the Prim post-commit block from ${postCommit.path}.`);
+    }
   });
 }
 
@@ -4725,12 +5259,6 @@ function planSetupSteps(opts) {
       args: ["daemon", "start"],
       required: true
     });
-    steps.push({
-      key: "health",
-      label: "Capture health",
-      args: ["doctor"],
-      required: true
-    });
   } else {
     steps.push({
       key: "daemon-opt-out",
@@ -4749,10 +5277,18 @@ function planSetupSteps(opts) {
   steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
   steps.push({
     key: "enable",
-    label: "Bind and activate this repo",
+    label: "Activate this repo",
     args: ["enable"],
     required: true
   });
+  if (opts.daemon) {
+    steps.push({
+      key: "health",
+      label: "Capture health",
+      args: ["doctor"],
+      required: true
+    });
+  }
   return steps;
 }
 var CONFLICT_SESSION = "session";
@@ -4890,7 +5426,10 @@ function registerSetupCommand(program2, dependencies = {}) {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
     }
-    for (const step of planSetupSteps({ agent, daemon: opts.daemon, scope })) {
+    const setupSteps = planSetupSteps({ agent, daemon: opts.daemon, scope });
+    for (const step of setupSteps.filter(
+      (candidate) => candidate.key !== "enable" && candidate.key !== "health"
+    )) {
       note(`${step.label} \xB7 installing\u2026`);
       const { code } = run(step.args);
       results[step.key] = code === 0 ? "ok" : step.required ? "failed" : "skipped";
@@ -4907,6 +5446,18 @@ function registerSetupCommand(program2, dependencies = {}) {
         );
       }
     }
+    const enableStep = setupSteps.find((candidate) => candidate.key === "enable");
+    if (enableStep) {
+      note(`${enableStep.label} \xB7 installing\u2026`);
+      const { code } = run(enableStep.args);
+      results[enableStep.key] = code === 0 ? "ok" : enableStep.required ? "failed" : "skipped";
+    }
+    const healthStep = setupSteps.find((candidate) => candidate.key === "health");
+    if (healthStep) {
+      note(`${healthStep.label} \xB7 verifying\u2026`);
+      const { code } = run(healthStep.args);
+      results[healthStep.key] = code === 0 ? "ok" : healthStep.required ? "failed" : "skipped";
+    }
     note("welcome");
     results.welcome = run(["welcome", "--agent", agent]).code === 0 ? "ok" : "failed";
     const failed = Object.entries(results).filter(([, v]) => v === "failed").map(([k]) => k);