@primitive.ai/prim 0.1.0-alpha.61 → 0.1.0-alpha.62

package/dist/hooks/pre-tool-use.js

@@ -1,34 +1,126 @@
 #!/usr/bin/env node
 import {
-  PREFLIGHT_PROTOCOL_VERSION,
+  DEFAULT_RULES,
+  analyzeShellTargets,
   buildCodexOutput,
   buildHermesOutput,
   buildHookOutput,
   demoteForMode,
+  extractFileTargets,
   failOpenCodex,
   failOpenHermes,
   failOpenOutput,
-  proposalFor,
   readHookMode,
-  requestPreflight,
-  resolvePreflightTargets,
-  resultForPreflight,
-  unverifiedResult
-} from "../chunk-B4SHJYIN.js";
-import "../chunk-GUXBUBQ7.js";
+  scrub
+} from "../chunk-GF5QII7T.js";
 import {
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
+  canonicalGitRoot,
+  canonicalRepositoryPath,
   isRepoActive,
   repoSyncId
-} from "../chunk-LDQZASIF.js";
-import "../chunk-I3HIPAIR.js";
+} from "../chunk-XTNMSS4C.js";
+import {
+  getClient
+} from "../chunk-I3HIPAIR.js";
 import {
   normalizeEnvelope,
   parseAgent
 } from "../chunk-TCDUH7AN.js";
 
+// src/hooks/preflight-v3.ts
+import { Buffer as Buffer2 } from "buffer";
+var PREFLIGHT_PROTOCOL_VERSION = 3;
+var PREFLIGHT_TIMEOUT_MS = 6500;
+var MAX_PREFLIGHT_PATHS = 32;
+var MAX_PROPOSAL_BYTES = 6144;
+function resolvePreflightTargets(args) {
+  let rawPaths;
+  let coverage = "complete";
+  let mutation = "present";
+  if (args.agent === "claude_code" && args.toolName === "Bash") {
+    const command = args.toolInput && typeof args.toolInput === "object" ? args.toolInput.command : void 0;
+    if (typeof command !== "string") {
+      return { paths: [], coverage: "unverified", mutation: "present" };
+    }
+    const shell = analyzeShellTargets(command);
+    rawPaths = shell.paths;
+    coverage = shell.coverage;
+    mutation = shell.mutation;
+  } else {
+    const extracted = extractFileTargets(args.toolName, args.toolInput, args.agent);
+    if (!extracted) return { paths: [], coverage: "complete", mutation: "none" };
+    rawPaths = extracted.paths;
+    if (!extracted.complete) coverage = "unverified";
+  }
+  const root = canonicalGitRoot(args.cwd);
+  const paths = /* @__PURE__ */ new Set();
+  for (const rawPath of rawPaths) {
+    const canonical = canonicalRepositoryPath(rawPath, args.cwd, root);
+    if (canonical) paths.add(canonical);
+    else coverage = "unverified";
+  }
+  const bounded = [...paths];
+  if (bounded.length > MAX_PREFLIGHT_PATHS) coverage = "unverified";
+  return { paths: bounded.slice(0, MAX_PREFLIGHT_PATHS), coverage, mutation };
+}
+function truncateUtf8(value, maxBytes) {
+  const encoded = Buffer2.from(value);
+  if (encoded.byteLength <= maxBytes) return value;
+  return encoded.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD$/u, "");
+}
+function proposalFor(toolInput) {
+  const redacted = scrub(toolInput, DEFAULT_RULES);
+  return truncateUtf8(JSON.stringify(redacted) ?? "", MAX_PROPOSAL_BYTES);
+}
+function parsePreflightResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const response = value;
+  const verdicts = /* @__PURE__ */ new Set(["allow", "warn", "ask", "block", "unavailable"]);
+  if (response.protocolVersion !== PREFLIGHT_PROTOCOL_VERSION || typeof response.verdict !== "string" || !verdicts.has(response.verdict) || typeof response.reasonCode !== "string" || typeof response.message !== "string" || !Array.isArray(response.conflicts) || !Array.isArray(response.bypassed)) {
+    return null;
+  }
+  return response;
+}
+async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS)) {
+  const response = await getClient().post("/api/cli/decisions/conflict-check", request, {
+    signal,
+    quietRefresh: true
+  });
+  return parsePreflightResponse(response);
+}
+function resultForPreflight(response) {
+  const verdict = response.verdict === "block" ? "deny" : response.verdict;
+  const safe = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+  const directives = response.conflicts.flatMap((value) => {
+    if (!value || typeof value !== "object") return [];
+    const { decisionId, shortId } = value;
+    const id = typeof shortId === "string" && safe.test(shortId) ? `dec_${shortId}` : typeof decisionId === "string" && safe.test(decisionId) ? decisionId : void 0;
+    return id ? [`To reconcile, run: prim reconcile ${id}`] : [];
+  });
+  const reason = [response.message, ...new Set(directives)].filter(Boolean).join("\n");
+  return {
+    verdict,
+    conflicts: response.conflicts,
+    reason,
+    additionalContext: ["warn", "ask", "block"].includes(response.verdict) ? reason : "",
+    truncated: false,
+    unavailable: response.verdict === "unavailable" ? response.message || response.reasonCode : void 0
+  };
+}
+function unverifiedResult(message) {
+  return {
+    verdict: "unavailable",
+    conflicts: [],
+    reason: "",
+    additionalContext: "",
+    truncated: false,
+    unavailable: message
+  };
+}
+
 // src/hooks/pre-tool-use.ts
 var STDIN_TIMEOUT_MS = 1e3;
 async function readStdin() {

package/dist/hooks/prim-hook.js

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
+import {
+  enrichHookPayloadWithFileRefs,
+  preserveHookFileMetadata
+} from "../chunk-DA4BMHEB.js";
 import {
   postToolInvocationId,
   shouldFlushAfter,
   toMove
-} from "../chunk-YDBZTFW5.js";
+} from "../chunk-QGVHLP5J.js";
 import {
   appendMove,
   resolveOrg
 } from "../chunk-S4LFRVGD.js";
 import {
   scrubFromCwd
-} from "../chunk-GUXBUBQ7.js";
+} from "../chunk-GF5QII7T.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -23,13 +27,15 @@ import {
 } from "../chunk-R4CUX6FY.js";
 import {
   getOrCreateWorkspaceId
-} from "../chunk-IMAIBPUC.js";
+} from "../chunk-UVIWZWM6.js";
 import {
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
-  isRepoActiveForCapture
-} from "../chunk-LDQZASIF.js";
+  isRepoActiveForCapture,
+  repoSyncId,
+  resolveRepositoryContext
+} from "../chunk-XTNMSS4C.js";
 import "../chunk-I3HIPAIR.js";
 import {
   normalizeEnvelope,
@@ -90,10 +96,25 @@ async function main() {
   }
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+  const resolvedRepository = resolveRepositoryContext(cwd);
+  const repository = resolvedRepository ? { ...resolvedRepository, repoSyncId: repoSyncId(cwd) } : null;
   try {
-    const invocationId = postToolInvocationId(parsed, agent);
-    const base = toMove(parsed, resolveCliVersion(), agent, workspaceId, invocationId);
-    const move = { ...base, payload: scrubFromCwd(parsed, cwd) };
+    const enrichment = repository ? enrichHookPayloadWithFileRefs({ parsed, agent, cwd, repository }) : void 0;
+    const enriched = enrichment?.parsed ?? parsed;
+    const invocationId = postToolInvocationId(enriched, agent);
+    const base = toMove(
+      enriched,
+      resolveCliVersion(),
+      agent,
+      workspaceId,
+      repository,
+      invocationId
+    );
+    const scrubbed = scrubFromCwd(enriched, cwd);
+    const move = {
+      ...base,
+      payload: enrichment ? preserveHookFileMetadata(scrubbed, enrichment.resolution) : scrubbed
+    };
     const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
     appendMove(move, orgId);
     if (shouldFlushAfter(move.eventType)) {

package/dist/hooks/session-start.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import {
   bindRepository,
+  ensureEffectivePostCommitHook,
   hasUsableCodexGuidance,
   refreshClaudePlugins
-} from "../chunk-N4R7EXZT.js";
+} from "../chunk-LOGW54W5.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -16,16 +17,18 @@ import {
 } from "../chunk-R4CUX6FY.js";
 import {
   getOrCreateWorkspaceId
-} from "../chunk-IMAIBPUC.js";
+} from "../chunk-UVIWZWM6.js";
 import {
   binFile,
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
   gitToplevel,
   isRepoActiveForCapture,
-  repoSyncId
-} from "../chunk-LDQZASIF.js";
+  repoActiveFlag,
+  repoSyncId,
+  setRepoActive
+} from "../chunk-XTNMSS4C.js";
 import {
   getSiteUrl,
   isSessionEnded
@@ -81,6 +84,20 @@ async function activeProjectRoot(cwd) {
   try {
     const root = gitToplevel(cwd);
     if (!root || !isRepoActiveForCapture(cwd)) return null;
+    let shellGateActive = repoActiveFlag(root) === "true";
+    if (!shellGateActive) {
+      try {
+        setRepoActive(root, true);
+        shellGateActive = true;
+      } catch {
+      }
+    }
+    if (shellGateActive) {
+      try {
+        ensureEffectivePostCommitHook(root);
+      } catch {
+      }
+    }
     if (!repoSyncId(root)) {
       try {
         await bindRepository(root, {