@primitive.ai/prim 0.1.0-alpha.61 → 0.1.0-alpha.62

package/dist/index.js

@@ -26,15 +26,21 @@ import {
 import {
   bindRepository,
   compareSemver,
+  ensureEffectivePostCommitHook,
+  ensurePostCommitHookAtPath,
+  inspectEffectivePostCommitHook,
+  postCommitHookBlock,
   printJson,
-  registerSkillCommands
-} from "./chunk-N4R7EXZT.js";
+  registerSkillCommands,
+  uninstallPostCommitHookAtPath,
+  uninstallProjectPostCommitHook
+} from "./chunk-LOGW54W5.js";
 import {
   fetchFeedbackCapability
 } from "./chunk-R4CUX6FY.js";
 import {
   inspectWorkspaceId
-} from "./chunk-IMAIBPUC.js";
+} from "./chunk-UVIWZWM6.js";
 import {
   binFile,
   commandMatchesBin,
@@ -42,16 +48,17 @@ import {
   packageVersion,
   pinnedHookCommand,
   warmBinCache
-} from "./chunk-YIMUIPMD.js";
+} from "./chunk-KBFFVYBC.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
   decisionIngestionStatus,
   gitToplevel,
   isRepoActiveForCapture,
+  isValidRepoSyncId,
   repoSyncId,
   setRepoActive
-} from "./chunk-LDQZASIF.js";
+} from "./chunk-XTNMSS4C.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -91,17 +98,19 @@ async function applyActivation(active) {
   }
   try {
     let bound;
+    let postCommitHook;
     if (active) {
+      postCommitHook = ensureEffectivePostCommitHook(root).path;
       bound = await bindRepository(root);
     }
     setRepoActive(root, active);
     process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
 `);
-    printJson({ active, repo: root, ...bound });
+    printJson({ active, repo: root, ...bound, ...postCommitHook ? { postCommitHook } : {} });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `[prim] failed to ${active ? "bind and enable" : "disable"} prim: ${detail}
+      `[prim] failed to ${active ? "cover, bind, and enable" : "disable"} prim: ${detail}
 `
     );
     process.exit(1);
@@ -3848,6 +3857,46 @@ function checkWorkspaceIdentity() {
       };
   }
 }
+function classifyRepositoryBinding(value) {
+  return isValidRepoSyncId(value) ? {
+    name: "repo-binding",
+    status: "ok",
+    detail: "valid local repository binding ready"
+  } : {
+    name: "repo-binding",
+    status: "fail",
+    detail: "missing or invalid local prim.repoSyncId \u2014 run `prim enable`"
+  };
+}
+function checkRepositoryBinding() {
+  return classifyRepositoryBinding(repoSyncId(process.cwd()));
+}
+function classifyPostCommitHook(inspection) {
+  if (inspection.covered) {
+    return {
+      name: "post-commit",
+      status: "ok",
+      detail: `effective and executable \xB7 ${inspection.kind} \xB7 ${inspection.hookPath}`
+    };
+  }
+  return {
+    name: "post-commit",
+    status: "fail",
+    detail: `${inspection.reason ?? "uncovered"} \xB7 ${inspection.hookPath}`
+  };
+}
+function checkPostCommitHook() {
+  try {
+    return classifyPostCommitHook(inspectEffectivePostCommitHook());
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      name: "post-commit",
+      status: /not a git repository/iu.test(detail) ? "warn" : "fail",
+      detail: detail.slice(0, 120)
+    };
+  }
+}
 function checkFeedbackHooks() {
   try {
     const status = performStatus();
@@ -3877,6 +3926,9 @@ function parseMovesStatus(value) {
   if (status.captureState !== "enabled" && status.captureState !== "disabled" || !nullableNumber(status.latestIngestAt) || !nullableNumber(status.latestClassificationAt) || !nullableNumber(status.highWaterMark) || typeof status.pendingSessionCount !== "number" || !Number.isInteger(status.pendingSessionCount) || status.pendingSessionCount < 0 || typeof status.sampled !== "boolean") {
     throw new Error("moves status returned an invalid response");
   }
+  if (status.oldestPendingAt !== void 0 && !nullableNumber(status.oldestPendingAt) || status.oldestPendingAgeMs !== void 0 && !nullableNumber(status.oldestPendingAgeMs) || typeof status.oldestPendingAgeMs === "number" && status.oldestPendingAgeMs < 0 || status.pendingCommitCorrelationCount !== void 0 && (!Number.isInteger(status.pendingCommitCorrelationCount) || status.pendingCommitCorrelationCount < 0)) {
+    throw new Error("moves status returned invalid pending-age fields");
+  }
   return status;
 }
 function classifyMovesStatus(status) {
@@ -3887,10 +3939,11 @@ function classifyMovesStatus(status) {
   };
   let classification;
   if (status.pendingSessionCount > 0) {
+    const oldest = typeof status.oldestPendingAgeMs === "number" ? ` \xB7 oldest ${String(Math.round(status.oldestPendingAgeMs / MS_PER_SECOND))}s` : typeof status.oldestPendingAt === "number" ? ` \xB7 oldest ${String(Math.max(0, Math.round((Date.now() - status.oldestPendingAt) / MS_PER_SECOND)))}s` : "";
     classification = {
       name: "classification",
       status: "warn",
-      detail: `${String(status.pendingSessionCount)} session(s) pending${status.sampled ? " in a bounded sample" : ""}`
+      detail: `${String(status.pendingSessionCount)} session(s) pending${oldest}${status.sampled ? " in a bounded sample" : ""}`
     };
   } else if (status.sampled) {
     classification = {
@@ -3905,7 +3958,16 @@ function classifyMovesStatus(status) {
       detail: status.latestClassificationAt === null ? "no sessions awaiting classification" : `caught up \xB7 last ${new Date(status.latestClassificationAt).toISOString()}`
     };
   }
-  return [capture, classification];
+  const correlation = status.pendingCommitCorrelationCount === void 0 ? void 0 : status.pendingCommitCorrelationCount > 0 ? {
+    name: "commit-correlation",
+    status: "warn",
+    detail: `${String(status.pendingCommitCorrelationCount)} commit(s) awaiting evidence correlation`
+  } : {
+    name: "commit-correlation",
+    status: "ok",
+    detail: "caught up"
+  };
+  return correlation ? [capture, classification, correlation] : [capture, classification];
 }
 async function checkBackend() {
   try {
@@ -3954,6 +4016,8 @@ async function collectChecks() {
     checkStranded(),
     checkFeedbackHooks(),
     checkWorkspaceIdentity(),
+    checkRepositoryBinding(),
+    checkPostCommitHook(),
     ...backend,
     await checkFeedbackCapability()
   ];
@@ -4337,6 +4401,7 @@ import { Option as Option2 } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
 var HOOKS = [PRE_COMMIT, POST_COMMIT];
+var GIT_TIMEOUT_MS = 1e3;
 function blockMarkers(spec) {
   return {
     start: `# >>> prim ${spec.hookName} hook >>>`,
@@ -4363,12 +4428,14 @@ ${hookShim(spec.binName)}
 `;
 }
 function huskyBlock(spec) {
+  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${hookShim(spec.binName)}
 ${end}`;
 }
 function gatedBlock(spec) {
+  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${gatedShim(spec.binName)}
@@ -4377,6 +4444,21 @@ ${end}`;
 function mergePrimBlock(hookPath, block, binName) {
   if (existsSync7(hookPath)) {
     const existing = readFileSync6(hookPath, "utf-8");
+    const start = block.slice(0, block.indexOf("\n"));
+    const end = block.slice(block.lastIndexOf("\n") + 1);
+    const starts = existing.split(start).length - 1;
+    const ends = existing.split(end).length - 1;
+    if (starts !== 0 || ends !== 0) {
+      if (starts !== 1 || ends !== 1 || existing.indexOf(end) < existing.indexOf(start)) {
+        throw new Error(`malformed Prim hook markers in ${hookPath}`);
+      }
+      const from = existing.indexOf(start);
+      const through = existing.indexOf(end) + end.length;
+      const refreshed = existing.slice(0, from) + block + existing.slice(through);
+      if (refreshed === existing) return false;
+      writeFileSync4(hookPath, refreshed, { mode: 493 });
+      return true;
+    }
     if (containsPrimHook(existing, binName)) return false;
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
     writeFileSync4(hookPath, `${existing}${separator}${block}
@@ -4432,7 +4514,7 @@ function installToHusky(gitRoot, spec = PRE_COMMIT) {
   }
 }
 function installToDotGit(gitRoot, spec = PRE_COMMIT) {
-  const hooksDir = resolve2(gitRoot, ".git", "hooks");
+  const hooksDir = projectHooksDir(gitRoot);
   const hookPath = resolve2(hooksDir, spec.hookName);
   if (!existsSync7(hooksDir)) {
     mkdirSync5(hooksDir, { recursive: true });
@@ -4450,6 +4532,18 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
+function projectHooksDir(gitRoot) {
+  const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
+    cwd: gitRoot,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: GIT_TIMEOUT_MS
+  }).trim();
+  if (commonDir === "") {
+    throw new Error("git returned an empty common directory");
+  }
+  return resolve2(gitRoot, commonDir, "hooks");
+}
 var PRIM_GIT_HOOKS_DIR = join6(homedir6(), ".config", "prim", "git-hooks");
 function expandTilde(p) {
   return p.startsWith("~/") ? join6(homedir6(), p.slice(2)) : p;
@@ -4461,7 +4555,8 @@ function gitConfigGet(level) {
   try {
     return execFileSync("git", ["config", level, "--get", "core.hooksPath"], {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
     }).trim();
   } catch {
     return "";
@@ -4489,14 +4584,18 @@ var PASSTHROUGH_HOOKS = [
 ];
 function globalHookScript(spec) {
   const chainExit = spec.hookName === "pre-commit" ? "|| exit $?" : "|| true";
+  const invocation = spec.hookName === POST_COMMIT.hookName ? postCommitHookBlock() : gatedShim(spec.binName);
+  const beforeComments = spec.hookName === POST_COMMIT.hookName ? `${invocation}
+` : "";
+  const afterComments = spec.hookName === POST_COMMIT.hookName ? "" : `${invocation}
+`;
   return `#!/bin/sh
-# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
+${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
 # Install/uninstall: prim hooks install|uninstall --scope user
 # Runs prim only where activated \u2014 'prim enable' (this repo) or
 # 'git config --global prim.active true' (every repo). Chains to the repo's own
 # hook regardless, so inactive repos are unaffected.
-${gatedShim(spec.binName)}
-common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+${afterComments}common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
 repo_hook="$common_dir/hooks/${spec.hookName}"
 if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null; then
   "$repo_hook" "$@" ${chainExit}
@@ -4521,18 +4620,29 @@ function writeOwnHooks() {
     mkdirSync5(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
-    writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
-      mode: 493
-    });
+    const path = resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName);
+    if (spec.hookName === POST_COMMIT.hookName) {
+      ensurePostCommitHookAtPath(path, globalHookScript(spec));
+    } else {
+      writeFileSync4(path, globalHookScript(spec), { mode: 493 });
+    }
   }
   for (const name of PASSTHROUGH_HOOKS) {
     writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
   }
 }
 function appendPrimBlock(hookPath, spec) {
+  if (spec.hookName === POST_COMMIT.hookName) {
+    ensurePostCommitHookAtPath(hookPath);
+    return;
+  }
   mergePrimBlock(hookPath, gatedBlock(spec), spec.binName);
 }
 function stripPrimBlock(hookPath, spec) {
+  if (spec.hookName === POST_COMMIT.hookName) {
+    uninstallPostCommitHookAtPath(hookPath);
+    return;
+  }
   if (!existsSync7(hookPath)) return;
   const existing = readFileSync6(hookPath, "utf-8");
   const primCreated = existing.includes(PRIM_CREATED_MARK);
@@ -4564,7 +4674,10 @@ function installGlobalHooks(opts = {}) {
       );
     }
     writeOwnHooks();
-    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR]);
+    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR], {
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS
+    });
     console.log(
       `Installed prim global git hooks; set core.hooksPath to ${PRIM_GIT_HOOKS_DIR}. Repos are opt-in: run \`prim enable\` in each repo to capture, or \`git config --global prim.active true\` for all.`
     );
@@ -4591,7 +4704,10 @@ function uninstallGlobalHooks() {
       const p = resolve2(PRIM_GIT_HOOKS_DIR, name);
       if (existsSync7(p)) unlinkSync2(p);
     }
-    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"]);
+    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"], {
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS
+    });
     console.log("Removed prim global git hooks and unset core.hooksPath.");
     return;
   }
@@ -4606,13 +4722,17 @@ function uninstallGlobalHooks() {
   console.log("No prim global git hooks found.");
 }
 function installHooks(gitRoot, target) {
-  for (const spec of HOOKS) {
+  for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
     if (target === "husky") {
       installToHusky(gitRoot, spec);
     } else {
       installToDotGit(gitRoot, spec);
     }
   }
+  const postCommit = ensureEffectivePostCommitHook(gitRoot);
+  console.log(
+    `${postCommit.changed ? "Installed" : "Refreshed"} effective post-commit hook at ${postCommit.path}.`
+  );
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
@@ -4674,8 +4794,9 @@ function registerHooksCommands(program2) {
       return;
     }
     const gitRoot = getGitRoot();
-    for (const spec of HOOKS) {
-      const hookPath = resolve2(gitRoot, ".git", "hooks", spec.hookName);
+    const hooksDir = projectHooksDir(gitRoot);
+    for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
+      const hookPath = resolve2(hooksDir, spec.hookName);
       if (!existsSync7(hookPath)) {
         console.log(`No ${spec.hookName} hook found.`);
         continue;
@@ -4687,6 +4808,14 @@ function registerHooksCommands(program2) {
         console.log(`Left ${spec.hookName} hook at ${hookPath} untouched (not a prim hook).`);
       }
     }
+    const postCommit = uninstallProjectPostCommitHook(gitRoot);
+    if (!postCommit.changed) {
+      console.log(`No Prim post-commit block found at ${postCommit.path}.`);
+    } else if (postCommit.removedFile) {
+      console.log(`Removed Prim-created post-commit hook at ${postCommit.path}.`);
+    } else {
+      console.log(`Removed the Prim post-commit block from ${postCommit.path}.`);
+    }
   });
 }
 
@@ -5130,12 +5259,6 @@ function planSetupSteps(opts) {
       args: ["daemon", "start"],
       required: true
     });
-    steps.push({
-      key: "health",
-      label: "Capture health",
-      args: ["doctor"],
-      required: true
-    });
   } else {
     steps.push({
       key: "daemon-opt-out",
@@ -5154,10 +5277,18 @@ function planSetupSteps(opts) {
   steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
   steps.push({
     key: "enable",
-    label: "Bind and activate this repo",
+    label: "Activate this repo",
     args: ["enable"],
     required: true
   });
+  if (opts.daemon) {
+    steps.push({
+      key: "health",
+      label: "Capture health",
+      args: ["doctor"],
+      required: true
+    });
+  }
   return steps;
 }
 var CONFLICT_SESSION = "session";
@@ -5295,7 +5426,10 @@ function registerSetupCommand(program2, dependencies = {}) {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
     }
-    for (const step of planSetupSteps({ agent, daemon: opts.daemon, scope })) {
+    const setupSteps = planSetupSteps({ agent, daemon: opts.daemon, scope });
+    for (const step of setupSteps.filter(
+      (candidate) => candidate.key !== "enable" && candidate.key !== "health"
+    )) {
       note(`${step.label} \xB7 installing\u2026`);
       const { code } = run(step.args);
       results[step.key] = code === 0 ? "ok" : step.required ? "failed" : "skipped";
@@ -5312,6 +5446,18 @@ function registerSetupCommand(program2, dependencies = {}) {
         );
       }
     }
+    const enableStep = setupSteps.find((candidate) => candidate.key === "enable");
+    if (enableStep) {
+      note(`${enableStep.label} \xB7 installing\u2026`);
+      const { code } = run(enableStep.args);
+      results[enableStep.key] = code === 0 ? "ok" : enableStep.required ? "failed" : "skipped";
+    }
+    const healthStep = setupSteps.find((candidate) => candidate.key === "health");
+    if (healthStep) {
+      note(`${healthStep.label} \xB7 verifying\u2026`);
+      const { code } = run(healthStep.args);
+      results[healthStep.key] = code === 0 ? "ok" : healthStep.required ? "failed" : "skipped";
+    }
     note("welcome");
     results.welcome = run(["welcome", "--agent", agent]).code === 0 ? "ok" : "failed";
     const failed = Object.entries(results).filter(([, v]) => v === "failed").map(([k]) => k);

package/dist/statusline-main.js

@@ -140,14 +140,17 @@ import { join as join4 } from "path";
 
 // src/lib/git.ts
 import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import { lstatSync, realpathSync } from "fs";
 import { basename, dirname as dirname3, isAbsolute, relative, resolve as resolve2, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
 function gitToplevel(cwd) {
   try {
     return execFileSync("git", ["rev-parse", "--show-toplevel"], {
       cwd,
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
     }).trim();
   } catch {
     return null;
@@ -156,6 +159,7 @@ function gitToplevel(cwd) {
 
 // src/lib/activation.ts
 var PRIM_ACTIVE_KEY = "prim.active";
+var GIT_TIMEOUT_MS2 = 1e3;
 var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
 var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
 function repoActiveFlag(cwd) {
@@ -163,7 +167,8 @@ function repoActiveFlag(cwd) {
     const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
       cwd,
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
     }).trim();
     if (value === "true") return "true";
     if (value === "false") return "false";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.61",
+  "version": "0.1.0-alpha.62",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",

package/dist/chunk-GUXBUBQ7.js

@@ -1,84 +0,0 @@
-// src/hooks/redact.ts
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-var DEFAULT_RULES = [
-  { pattern: /Bearer\s+[A-Za-z0-9._\-]+/g, reason: "bearer-token" },
-  { pattern: /sk-[A-Za-z0-9]{32,}/g, reason: "sk-api-key" },
-  {
-    pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g,
-    reason: "private-key"
-  },
-  { pattern: /xox[abprs]-[A-Za-z0-9-]{10,}/g, reason: "slack-token" },
-  { pattern: /ghp_[A-Za-z0-9]{36,}/g, reason: "github-pat" }
-];
-var MAX_SCRUB_LEN = 256e3;
-var WORKSPACE_FILE = ".prim/redaction.json";
-function debugRedaction(message, err) {
-  if (!process.env.PRIM_HOOK_DEBUG) {
-    return;
-  }
-  const detail = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`[prim-hook] redaction: ${message}: ${detail}
-`);
-}
-function loadWorkspaceRules(cwd) {
-  const path = join(cwd, WORKSPACE_FILE);
-  if (!existsSync(path)) {
-    return [];
-  }
-  let cfg;
-  try {
-    cfg = JSON.parse(readFileSync(path, "utf-8"));
-  } catch (err) {
-    debugRedaction(`ignoring unparseable ${WORKSPACE_FILE}`, err);
-    return [];
-  }
-  if (!cfg.rules) {
-    return [];
-  }
-  const compiled = [];
-  for (const r of cfg.rules) {
-    try {
-      compiled.push({ pattern: new RegExp(r.pattern, r.flags ?? "g"), reason: r.reason });
-    } catch (err) {
-      debugRedaction(`skipping invalid redaction rule "${r.reason}"`, err);
-    }
-  }
-  return compiled;
-}
-function applyRules(input, rules) {
-  if (input.length > MAX_SCRUB_LEN) {
-    return "<REDACTED:oversized>";
-  }
-  let out = input;
-  for (const rule of rules) {
-    out = out.replace(rule.pattern, `<REDACTED:${rule.reason}>`);
-  }
-  return out;
-}
-function scrub(value, rules = DEFAULT_RULES) {
-  if (typeof value === "string") {
-    return applyRules(value, rules);
-  }
-  if (Array.isArray(value)) {
-    return value.map((v) => scrub(v, rules));
-  }
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = scrub(v, rules);
-    }
-    return out;
-  }
-  return value;
-}
-function scrubFromCwd(value, cwd) {
-  const rules = [...DEFAULT_RULES, ...loadWorkspaceRules(cwd)];
-  return scrub(value, rules);
-}
-
-export {
-  DEFAULT_RULES,
-  scrub,
-  scrubFromCwd
-};