@primitive.ai/prim 0.1.0-alpha.61 → 0.1.0-alpha.62

package/dist/chunk-QGVHLP5J.js

@@ -0,0 +1,117 @@
+import {
+  isCanonicalWorkspaceId
+} from "./chunk-UVIWZWM6.js";
+import {
+  isValidRepoSyncId
+} from "./chunk-XTNMSS4C.js";
+
+// src/hooks/prim-hook-core.ts
+import { createHash, randomUUID } from "crypto";
+import { platform } from "os";
+
+// src/protocol/move.ts
+var LEGACY_ENVELOPE_VERSION = 1;
+var AGENT_ENVELOPE_VERSION = 3;
+var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
+
+// src/hooks/prim-hook-core.ts
+function postToolInvocationId(parsed, agent) {
+  if (parsed.hook_event_name !== "PostToolUse") return void 0;
+  const raw = agent === "hermes" ? parsed.extra?.tool_call_id : parsed.tool_use_id;
+  return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, repository, invocationId) {
+  const sessionId = parsed.session_id ?? "";
+  const eventType = parsed.hook_event_name ?? "unknown";
+  const moveId = eventType === "PostToolUse" && sessionId && invocationId ? `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}` : randomUUID();
+  return {
+    moveId,
+    capturedAt: Date.now(),
+    sessionId,
+    eventType,
+    payload: parsed,
+    env: {
+      cwd: parsed.cwd ?? process.cwd(),
+      cliVersion,
+      osPlatform: platform(),
+      ...repository ? {
+        repoRoot: repository.repoRoot,
+        repoKey: repository.repoKey,
+        gitRoot: repository.repoRoot,
+        repoFullName: repository.repoFullName,
+        repoSyncId: repository.repoSyncId
+      } : {},
+      ...workspaceId ? { workspaceId } : {}
+    },
+    envelopeVersion: AGENT_ENVELOPE_VERSION,
+    producer: agent,
+    ...invocationId ? { invocationId } : {}
+  };
+}
+var MAX_CLASSIFIER_ID_CHARS = 256;
+var INVALID_CLASSIFIER_ID_RE = /[\u0000-\u001f\u007f\uD800-\uDFFF]/u;
+function validSessionHint(value) {
+  return typeof value === "string" && value.trim().length > 0 && value === value.trim() && value.length <= MAX_CLASSIFIER_ID_CHARS && !INVALID_CLASSIFIER_ID_RE.test(value);
+}
+function commitAttributionFromEnvironment(env, workspaceId) {
+  if (env.HERMES_INTERACTIVE) return void 0;
+  if (!workspaceId || !isCanonicalWorkspaceId(workspaceId)) return void 0;
+  const candidates = [
+    validSessionHint(env.CLAUDE_CODE_SESSION_ID) ? { sessionId: env.CLAUDE_CODE_SESSION_ID, producer: "claude_code" } : void 0,
+    validSessionHint(env.CODEX_THREAD_ID) ? { sessionId: env.CODEX_THREAD_ID, producer: "codex" } : void 0
+  ].filter((candidate) => candidate !== void 0);
+  return candidates.length === 1 ? candidates[0] : void 0;
+}
+function toCommitMove(commit, cliVersion, cwd, context = {}) {
+  const { repository, repoFullName, repoSyncId, workspaceId, attribution } = context;
+  const validatedRepoSyncId = isValidRepoSyncId(repoSyncId) ? repoSyncId : void 0;
+  const validatedWorkspaceId = workspaceId && isCanonicalWorkspaceId(workspaceId) ? workspaceId : void 0;
+  const validatedAttribution = validatedWorkspaceId ? attribution : void 0;
+  const fullSha = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(commit.sha);
+  const moveId = validatedRepoSyncId && validatedWorkspaceId && fullSha ? `commit:v2:${createHash("sha256").update(
+    JSON.stringify(["commit:v2", validatedRepoSyncId, validatedWorkspaceId, commit.sha])
+  ).digest("hex")}` : `commit:v2:unscoped:${randomUUID()}`;
+  const base = {
+    moveId,
+    capturedAt: Date.now(),
+    sessionId: validatedAttribution?.sessionId ?? "",
+    eventType: "git.commit",
+    payload: {
+      kind: "git.commit",
+      sha: commit.sha,
+      parentSha: commit.parentSha,
+      branch: commit.branch,
+      changedFiles: commit.files,
+      changedFilesComplete: commit.filesComplete
+    },
+    env: {
+      cwd,
+      cliVersion,
+      osPlatform: platform(),
+      ...repository ? {
+        repoRoot: repository.repoRoot,
+        repoKey: repository.repoKey,
+        gitRoot: repository.repoRoot
+      } : {},
+      ...repoFullName ? { repoFullName } : {},
+      ...validatedRepoSyncId ? { repoSyncId: validatedRepoSyncId } : {},
+      ...validatedWorkspaceId ? { workspaceId: validatedWorkspaceId } : {}
+    }
+  };
+  return validatedAttribution ? {
+    ...base,
+    envelopeVersion: AGENT_ENVELOPE_VERSION,
+    producer: validatedAttribution.producer
+  } : { ...base, envelopeVersion: ENVELOPE_VERSION };
+}
+function shouldFlushAfter(eventType) {
+  return eventType === "SessionEnd";
+}
+
+export {
+  postToolInvocationId,
+  toMove,
+  commitAttributionFromEnvironment,
+  toCommitMove,
+  shouldFlushAfter
+};

package/dist/{chunk-IMAIBPUC.js → chunk-UVIWZWM6.js}

@@ -205,6 +205,7 @@ function errorCode(error) {
 }
 
 export {
+  isCanonicalWorkspaceId,
   inspectWorkspaceId,
   getOrCreateWorkspaceId
 };

package/dist/chunk-XTNMSS4C.js

@@ -0,0 +1,283 @@
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || parts.some((part) => !part || part !== part.trim())) return null;
+  return `${parts[0]}/${parts[1]}`;
+}
+function canonicalGitRoot(cwd) {
+  try {
+    const top = gitToplevel(cwd);
+    return top ? realpathSync.native(top) : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync.native(top);
+  } catch {
+    repoRoot = resolve(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+function nearestExistingAncestor(path) {
+  const suffix = [];
+  let cursor = path;
+  while (true) {
+    try {
+      lstatSync(cursor);
+      break;
+    } catch (error) {
+      const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+      const parent = dirname(cursor);
+      if (parent === cursor) return null;
+      suffix.unshift(cursor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
+      cursor = parent;
+    }
+  }
+  try {
+    return { real: realpathSync.native(cursor), suffix };
+  } catch {
+    return null;
+  }
+}
+function canonicalRepositoryPathScoped(filePath, context, baseDir) {
+  if (!filePath || filePath !== filePath.trim() || filePath.includes("\0")) {
+    return { ok: false, reason: "invalid_path" };
+  }
+  const absolute = resolve(baseDir, filePath);
+  const resolved = nearestExistingAncestor(absolute);
+  if (!resolved) return { ok: false, reason: "invalid_path" };
+  const target = resolve(resolved.real, ...resolved.suffix);
+  const rel = relative(context.repoRoot, target);
+  if (!rel || rel === ".") return { ok: false, reason: "invalid_path" };
+  if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return { ok: false, reason: "outside_repository" };
+  }
+  return { ok: true, file: sep === "/" ? rel : rel.split(sep).join("/") };
+}
+function canonicalRepositoryPathLegacy(filePath, cwd, repositoryRoot = canonicalGitRoot(cwd)) {
+  if (!repositoryRoot || !filePath || [...filePath].some((char) => char < " " || char === "\x7F" || "~*?[]{}$`\\".includes(char)))
+    return null;
+  const absolute = resolve(cwd, filePath);
+  let target;
+  try {
+    const stat = lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    target = realpathSync.native(absolute);
+  } catch (error) {
+    if (!(error instanceof Error) || error.code !== "ENOENT") {
+      return null;
+    }
+    try {
+      const parent = realpathSync.native(dirname(absolute));
+      if (!lstatSync(parent).isDirectory()) return null;
+      target = resolve(parent, basename(absolute));
+    } catch {
+      return null;
+    }
+  }
+  const rel = relative(repositoryRoot, target);
+  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return null;
+  }
+  return sep === "/" ? rel : rel.split(sep).join("/");
+}
+function canonicalRepositoryPath(filePath, contextOrCwd, baseDirOrRoot) {
+  if (typeof contextOrCwd === "string") {
+    return canonicalRepositoryPathLegacy(filePath, contextOrCwd, baseDirOrRoot);
+  }
+  return canonicalRepositoryPathScoped(
+    filePath,
+    contextOrCwd,
+    baseDirOrRoot ?? contextOrCwd.repoRoot
+  );
+}
+
+// src/lib/activation.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var PRIM_ACTIVE_KEY = "prim.active";
+var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var GIT_TIMEOUT_MS2 = 1e3;
+var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
+var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+function repoActiveFlag(cwd) {
+  try {
+    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    if (value === "true") return "true";
+    if (value === "false") return "false";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRepoActive(cwd) {
+  return repoActiveFlag(cwd) === "true";
+}
+function setRepoActive(cwd, active) {
+  execFileSync2("git", ["config", "--local", PRIM_ACTIVE_KEY, active ? "true" : "false"], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function isValidRepoSyncId(value) {
+  return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
+}
+function repoSyncId(cwd) {
+  try {
+    const value = execFileSync2("git", ["config", "--local", "--get", PRIM_REPO_SYNC_ID_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    return isValidRepoSyncId(value) ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function setRepoSyncId(cwd, value) {
+  if (!isValidRepoSyncId(value)) {
+    throw new Error("invalid repository binding returned by server");
+  }
+  execFileSync2("git", ["config", "--local", PRIM_REPO_SYNC_ID_KEY, value], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function hasProjectPrimInstall(cwd) {
+  const root = gitToplevel(cwd);
+  if (root === null || root === homedir()) return false;
+  for (const rel of PROJECT_INSTALL_FILES) {
+    const path = join(root, rel);
+    if (existsSync(path)) {
+      try {
+        const content = readFileSync(path, "utf-8");
+        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function isRepoActiveForCapture(cwd) {
+  const flag = repoActiveFlag(cwd);
+  if (flag === "true") return true;
+  if (flag === "false") return false;
+  return hasProjectPrimInstall(cwd);
+}
+function decisionIngestionStatus(cwd) {
+  return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
+}
+
+export {
+  gitToplevel,
+  githubRepositoryFullName,
+  canonicalGitRoot,
+  resolveRepositoryContext,
+  canonicalRepositoryPath,
+  repoActiveFlag,
+  isRepoActive,
+  setRepoActive,
+  isValidRepoSyncId,
+  repoSyncId,
+  setRepoSyncId,
+  isRepoActiveForCapture,
+  decisionIngestionStatus
+};

package/dist/hooks/post-commit.js

@@ -1,44 +1,100 @@
 #!/usr/bin/env node
 import {
+  commitAttributionFromEnvironment,
   toCommitMove
-} from "../chunk-YDBZTFW5.js";
+} from "../chunk-QGVHLP5J.js";
 import {
   appendMove,
   resolveOrg
 } from "../chunk-S4LFRVGD.js";
 import {
-  isRepoActiveForCapture
-} from "../chunk-LDQZASIF.js";
+  getOrCreateWorkspaceId
+} from "../chunk-UVIWZWM6.js";
+import {
+  githubRepositoryFullName,
+  isRepoActiveForCapture,
+  repoSyncId,
+  resolveRepositoryContext
+} from "../chunk-XTNMSS4C.js";
 import "../chunk-I3HIPAIR.js";
 
 // src/hooks/post-commit.ts
-import { execSync, spawn } from "child_process";
+import { execFileSync, spawn } from "child_process";
 import { readFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 var here = dirname(fileURLToPath(import.meta.url));
-function git(args) {
+var GIT_TIMEOUT_MS = 1e3;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+function gitText(args) {
   try {
-    return execSync(`git ${args}`, {
+    return execFileSync("git", args, {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
     }).trim();
   } catch {
     return;
   }
 }
+function gitBytes(args) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "buffer",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    });
+  } catch {
+    return;
+  }
+}
+function parseNulPaths(value) {
+  if (value.length === 0) return { files: [], complete: true };
+  const chunks = [];
+  let start = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    if (value[i] !== 0) continue;
+    chunks.push(value.subarray(start, i));
+    start = i + 1;
+  }
+  if (start !== value.length || chunks.some((chunk) => chunk.length === 0)) {
+    return { files: [], complete: false };
+  }
+  const files = [];
+  for (const chunk of chunks) {
+    const file = chunk.toString("utf8");
+    if (!Buffer.from(file, "utf8").equals(chunk)) {
+      return { files: [], complete: false };
+    }
+    files.push(file);
+  }
+  return { files: [...new Set(files)], complete: true };
+}
 function readCommit() {
-  const sha = git("rev-parse HEAD");
-  if (!sha) {
+  const snapshotProvided = process.env.PRIM_COMMIT_SHA !== void 0;
+  const sha = snapshotProvided ? process.env.PRIM_COMMIT_SHA : gitText(["rev-parse", "HEAD"]);
+  if (!sha || !FULL_SHA_RE.test(sha)) {
     return null;
   }
-  const branch = git("rev-parse --abbrev-ref HEAD");
-  const files = (git("diff-tree --no-commit-id --name-only -r -m --root HEAD") ?? "").split("\n").filter((f) => f.length > 0);
+  const rawBranch = process.env.PRIM_COMMIT_BRANCH !== void 0 ? process.env.PRIM_COMMIT_BRANCH : gitText(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = rawBranch && rawBranch === rawBranch.trim() && ![...rawBranch].some((char) => char < " " || char === "\x7F") ? rawBranch : void 0;
+  const rawFiles = gitBytes([
+    "diff-tree",
+    "--no-commit-id",
+    "--name-only",
+    "-z",
+    "-r",
+    "-m",
+    "--root",
+    sha
+  ]);
+  const { files, complete } = rawFiles === void 0 ? { files: [], complete: false } : parseNulPaths(rawFiles);
   return {
     sha,
-    parentSha: git("rev-parse --verify --quiet HEAD^") || void 0,
+    parentSha: gitText(["rev-parse", "--verify", "--quiet", `${sha}^`]) || void 0,
     branch: branch && branch !== "HEAD" ? branch : void 0,
-    files
+    files,
+    filesComplete: complete
   };
 }
 function resolveCliVersion() {
@@ -57,14 +113,24 @@ function spawnBackgroundFlush() {
   }).unref();
 }
 function runPostCommit() {
-  const cwd = git("rev-parse --show-toplevel") ?? process.cwd();
+  const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
   if (!isRepoActiveForCapture(cwd)) {
     return;
   }
   const commit = readCommit();
   if (commit) {
-    const move = toCommitMove(commit, resolveCliVersion(), cwd);
-    const { orgId } = resolveOrg({ sessionId: "", cwd });
+    const repository = resolveRepositoryContext(cwd);
+    const identity = getOrCreateWorkspaceId(cwd);
+    const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+    const attribution = commitAttributionFromEnvironment(process.env, workspaceId);
+    const move = toCommitMove(commit, resolveCliVersion(), cwd, {
+      repository,
+      repoFullName: githubRepositoryFullName(cwd) ?? void 0,
+      repoSyncId: repoSyncId(cwd),
+      workspaceId,
+      attribution
+    });
+    const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd });
     appendMove(move, orgId);
     spawnBackgroundFlush();
   }

package/dist/hooks/post-tool-use.js

@@ -5,29 +5,31 @@ import {
   requireDurableIngestAcknowledgement
 } from "../chunk-JQFN6LBO.js";
 import {
-  resolvePreflightTargets
-} from "../chunk-B4SHJYIN.js";
+  enrichHookPayloadWithFileRefs,
+  preserveHookFileMetadata
+} from "../chunk-DA4BMHEB.js";
 import {
   postToolInvocationId,
   toMove
-} from "../chunk-YDBZTFW5.js";
+} from "../chunk-QGVHLP5J.js";
 import {
   appendMove,
   resolveOrg
 } from "../chunk-S4LFRVGD.js";
 import {
   scrubFromCwd
-} from "../chunk-GUXBUBQ7.js";
+} from "../chunk-GF5QII7T.js";
 import {
   getOrCreateWorkspaceId
-} from "../chunk-IMAIBPUC.js";
+} from "../chunk-UVIWZWM6.js";
 import {
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
-  isRepoActive,
-  repoSyncId
-} from "../chunk-LDQZASIF.js";
+  isRepoActiveForCapture,
+  repoSyncId,
+  resolveRepositoryContext
+} from "../chunk-XTNMSS4C.js";
 import {
   getClient
 } from "../chunk-I3HIPAIR.js";
@@ -151,27 +153,41 @@ async function main() {
     return;
   }
   const cwd = parsed.cwd ?? process.cwd();
-  if (!isRepoActive(cwd) || !repoSyncId(cwd)) {
+  if (!isRepoActiveForCapture(cwd)) {
     emit();
     return;
   }
-  if (agent === "claude_code") {
-    const targets = resolvePreflightTargets({
-      toolName,
-      toolInput: envelope.tool_input,
-      agent,
-      cwd
-    });
-    if (targets.mutation === "none") {
-      emit();
-      return;
-    }
+  const resolvedRepository = resolveRepositoryContext(cwd);
+  if (!resolvedRepository) {
+    emit();
+    return;
+  }
+  const repository = { ...resolvedRepository, repoSyncId: repoSyncId(cwd) };
+  const enrichment = enrichHookPayloadWithFileRefs({
+    parsed,
+    agent,
+    cwd,
+    repository
+  });
+  const { resolution } = enrichment;
+  if (resolution.shellMutation === "none") {
+    emit();
+    return;
+  }
+  if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
+    emit();
+    return;
   }
+  const enriched = enrichment.parsed;
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
-  const invocationId = postToolInvocationId(parsed, agent);
-  const base = toMove(parsed, resolveCliVersion(), agent, workspaceId, invocationId);
-  const move = { ...base, payload: scrubFromCwd(parsed, cwd) };
+  const invocationId = postToolInvocationId(enriched, agent);
+  const base = toMove(enriched, resolveCliVersion(), agent, workspaceId, repository, invocationId);
+  const scrubbed = scrubFromCwd(enriched, cwd);
+  const move = {
+    ...base,
+    payload: preserveHookFileMetadata(scrubbed, resolution)
+  };
   const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
   try {
     const result = await deliverPostToolMove(move, orgId);