@primitive.ai/prim 0.1.0-alpha.61 → 0.1.0-alpha.63

package/dist/hooks/post-commit.js

@@ -1,44 +1,100 @@
 #!/usr/bin/env node
 import {
+  commitAttributionFromEnvironment,
   toCommitMove
-} from "../chunk-YDBZTFW5.js";
+} from "../chunk-QGVHLP5J.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-S4LFRVGD.js";
+} from "../chunk-HIMWM526.js";
 import {
-  isRepoActiveForCapture
-} from "../chunk-LDQZASIF.js";
-import "../chunk-I3HIPAIR.js";
+  getOrCreateWorkspaceId
+} from "../chunk-UVIWZWM6.js";
+import {
+  githubRepositoryFullName,
+  isRepoActiveForCapture,
+  repoSyncId,
+  resolveRepositoryContext
+} from "../chunk-XTNMSS4C.js";
+import "../chunk-CPX3BUOC.js";
 
 // src/hooks/post-commit.ts
-import { execSync, spawn } from "child_process";
+import { execFileSync, spawn } from "child_process";
 import { readFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 var here = dirname(fileURLToPath(import.meta.url));
-function git(args) {
+var GIT_TIMEOUT_MS = 1e3;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+function gitText(args) {
   try {
-    return execSync(`git ${args}`, {
+    return execFileSync("git", args, {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
     }).trim();
   } catch {
     return;
   }
 }
+function gitBytes(args) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "buffer",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    });
+  } catch {
+    return;
+  }
+}
+function parseNulPaths(value) {
+  if (value.length === 0) return { files: [], complete: true };
+  const chunks = [];
+  let start = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    if (value[i] !== 0) continue;
+    chunks.push(value.subarray(start, i));
+    start = i + 1;
+  }
+  if (start !== value.length || chunks.some((chunk) => chunk.length === 0)) {
+    return { files: [], complete: false };
+  }
+  const files = [];
+  for (const chunk of chunks) {
+    const file = chunk.toString("utf8");
+    if (!Buffer.from(file, "utf8").equals(chunk)) {
+      return { files: [], complete: false };
+    }
+    files.push(file);
+  }
+  return { files: [...new Set(files)], complete: true };
+}
 function readCommit() {
-  const sha = git("rev-parse HEAD");
-  if (!sha) {
+  const snapshotProvided = process.env.PRIM_COMMIT_SHA !== void 0;
+  const sha = snapshotProvided ? process.env.PRIM_COMMIT_SHA : gitText(["rev-parse", "HEAD"]);
+  if (!sha || !FULL_SHA_RE.test(sha)) {
     return null;
   }
-  const branch = git("rev-parse --abbrev-ref HEAD");
-  const files = (git("diff-tree --no-commit-id --name-only -r -m --root HEAD") ?? "").split("\n").filter((f) => f.length > 0);
+  const rawBranch = process.env.PRIM_COMMIT_BRANCH !== void 0 ? process.env.PRIM_COMMIT_BRANCH : gitText(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = rawBranch && rawBranch === rawBranch.trim() && ![...rawBranch].some((char) => char < " " || char === "\x7F") ? rawBranch : void 0;
+  const rawFiles = gitBytes([
+    "diff-tree",
+    "--no-commit-id",
+    "--name-only",
+    "-z",
+    "-r",
+    "-m",
+    "--root",
+    sha
+  ]);
+  const { files, complete } = rawFiles === void 0 ? { files: [], complete: false } : parseNulPaths(rawFiles);
   return {
     sha,
-    parentSha: git("rev-parse --verify --quiet HEAD^") || void 0,
+    parentSha: gitText(["rev-parse", "--verify", "--quiet", `${sha}^`]) || void 0,
     branch: branch && branch !== "HEAD" ? branch : void 0,
-    files
+    files,
+    filesComplete: complete
   };
 }
 function resolveCliVersion() {
@@ -57,14 +113,24 @@ function spawnBackgroundFlush() {
   }).unref();
 }
 function runPostCommit() {
-  const cwd = git("rev-parse --show-toplevel") ?? process.cwd();
+  const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
   if (!isRepoActiveForCapture(cwd)) {
     return;
   }
   const commit = readCommit();
   if (commit) {
-    const move = toCommitMove(commit, resolveCliVersion(), cwd);
-    const { orgId } = resolveOrg({ sessionId: "", cwd });
+    const repository = resolveRepositoryContext(cwd);
+    const identity = getOrCreateWorkspaceId(cwd);
+    const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+    const attribution = commitAttributionFromEnvironment(process.env, workspaceId);
+    const move = toCommitMove(commit, resolveCliVersion(), cwd, {
+      repository,
+      repoFullName: githubRepositoryFullName(cwd) ?? void 0,
+      repoSyncId: repoSyncId(cwd),
+      workspaceId,
+      attribution
+    });
+    const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd });
     appendMove(move, orgId);
     spawnBackgroundFlush();
   }

package/dist/hooks/post-tool-use.js

@@ -5,32 +5,34 @@ import {
   requireDurableIngestAcknowledgement
 } from "../chunk-JQFN6LBO.js";
 import {
-  resolvePreflightTargets
-} from "../chunk-B4SHJYIN.js";
+  enrichHookPayloadWithFileRefs,
+  preserveHookFileMetadata
+} from "../chunk-DA4BMHEB.js";
 import {
   postToolInvocationId,
   toMove
-} from "../chunk-YDBZTFW5.js";
+} from "../chunk-QGVHLP5J.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-S4LFRVGD.js";
+} from "../chunk-HIMWM526.js";
 import {
   scrubFromCwd
-} from "../chunk-GUXBUBQ7.js";
+} from "../chunk-GF5QII7T.js";
 import {
   getOrCreateWorkspaceId
-} from "../chunk-IMAIBPUC.js";
+} from "../chunk-UVIWZWM6.js";
 import {
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
-  isRepoActive,
-  repoSyncId
-} from "../chunk-LDQZASIF.js";
+  isRepoActiveForCapture,
+  repoSyncId,
+  resolveRepositoryContext
+} from "../chunk-XTNMSS4C.js";
 import {
   getClient
-} from "../chunk-I3HIPAIR.js";
+} from "../chunk-CPX3BUOC.js";
 import {
   normalizeEnvelope,
   parseAgent
@@ -151,27 +153,41 @@ async function main() {
     return;
   }
   const cwd = parsed.cwd ?? process.cwd();
-  if (!isRepoActive(cwd) || !repoSyncId(cwd)) {
+  if (!isRepoActiveForCapture(cwd)) {
     emit();
     return;
   }
-  if (agent === "claude_code") {
-    const targets = resolvePreflightTargets({
-      toolName,
-      toolInput: envelope.tool_input,
-      agent,
-      cwd
-    });
-    if (targets.mutation === "none") {
-      emit();
-      return;
-    }
+  const resolvedRepository = resolveRepositoryContext(cwd);
+  if (!resolvedRepository) {
+    emit();
+    return;
+  }
+  const repository = { ...resolvedRepository, repoSyncId: repoSyncId(cwd) };
+  const enrichment = enrichHookPayloadWithFileRefs({
+    parsed,
+    agent,
+    cwd,
+    repository
+  });
+  const { resolution } = enrichment;
+  if (resolution.shellMutation === "none") {
+    emit();
+    return;
+  }
+  if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
+    emit();
+    return;
   }
+  const enriched = enrichment.parsed;
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
-  const invocationId = postToolInvocationId(parsed, agent);
-  const base = toMove(parsed, resolveCliVersion(), agent, workspaceId, invocationId);
-  const move = { ...base, payload: scrubFromCwd(parsed, cwd) };
+  const invocationId = postToolInvocationId(enriched, agent);
+  const base = toMove(enriched, resolveCliVersion(), agent, workspaceId, repository, invocationId);
+  const scrubbed = scrubFromCwd(enriched, cwd);
+  const move = {
+    ...base,
+    payload: preserveHookFileMetadata(scrubbed, resolution)
+  };
   const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
   try {
     const result = await deliverPostToolMove(move, orgId);

package/dist/hooks/pre-commit.js

@@ -2,8 +2,8 @@
 import {
   checkAffectedDecisions,
   formatDecisionsWarning
-} from "../chunk-YITJ2H3B.js";
-import "../chunk-I3HIPAIR.js";
+} from "../chunk-WS3MCNFD.js";
+import "../chunk-CPX3BUOC.js";
 import "../chunk-UTKQTZHL.js";
 
 // src/hooks/pre-commit.ts

package/dist/hooks/pre-tool-use.js

@@ -1,34 +1,126 @@
 #!/usr/bin/env node
 import {
-  PREFLIGHT_PROTOCOL_VERSION,
+  DEFAULT_RULES,
+  analyzeShellTargets,
   buildCodexOutput,
   buildHermesOutput,
   buildHookOutput,
   demoteForMode,
+  extractFileTargets,
   failOpenCodex,
   failOpenHermes,
   failOpenOutput,
-  proposalFor,
   readHookMode,
-  requestPreflight,
-  resolvePreflightTargets,
-  resultForPreflight,
-  unverifiedResult
-} from "../chunk-B4SHJYIN.js";
-import "../chunk-GUXBUBQ7.js";
+  scrub
+} from "../chunk-GF5QII7T.js";
 import {
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
+  canonicalGitRoot,
+  canonicalRepositoryPath,
   isRepoActive,
   repoSyncId
-} from "../chunk-LDQZASIF.js";
-import "../chunk-I3HIPAIR.js";
+} from "../chunk-XTNMSS4C.js";
+import {
+  getClient
+} from "../chunk-CPX3BUOC.js";
 import {
   normalizeEnvelope,
   parseAgent
 } from "../chunk-TCDUH7AN.js";
 
+// src/hooks/preflight-v3.ts
+import { Buffer as Buffer2 } from "buffer";
+var PREFLIGHT_PROTOCOL_VERSION = 3;
+var PREFLIGHT_TIMEOUT_MS = 6500;
+var MAX_PREFLIGHT_PATHS = 32;
+var MAX_PROPOSAL_BYTES = 6144;
+function resolvePreflightTargets(args) {
+  let rawPaths;
+  let coverage = "complete";
+  let mutation = "present";
+  if (args.agent === "claude_code" && args.toolName === "Bash") {
+    const command = args.toolInput && typeof args.toolInput === "object" ? args.toolInput.command : void 0;
+    if (typeof command !== "string") {
+      return { paths: [], coverage: "unverified", mutation: "present" };
+    }
+    const shell = analyzeShellTargets(command);
+    rawPaths = shell.paths;
+    coverage = shell.coverage;
+    mutation = shell.mutation;
+  } else {
+    const extracted = extractFileTargets(args.toolName, args.toolInput, args.agent);
+    if (!extracted) return { paths: [], coverage: "complete", mutation: "none" };
+    rawPaths = extracted.paths;
+    if (!extracted.complete) coverage = "unverified";
+  }
+  const root = canonicalGitRoot(args.cwd);
+  const paths = /* @__PURE__ */ new Set();
+  for (const rawPath of rawPaths) {
+    const canonical = canonicalRepositoryPath(rawPath, args.cwd, root);
+    if (canonical) paths.add(canonical);
+    else coverage = "unverified";
+  }
+  const bounded = [...paths];
+  if (bounded.length > MAX_PREFLIGHT_PATHS) coverage = "unverified";
+  return { paths: bounded.slice(0, MAX_PREFLIGHT_PATHS), coverage, mutation };
+}
+function truncateUtf8(value, maxBytes) {
+  const encoded = Buffer2.from(value);
+  if (encoded.byteLength <= maxBytes) return value;
+  return encoded.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD$/u, "");
+}
+function proposalFor(toolInput) {
+  const redacted = scrub(toolInput, DEFAULT_RULES);
+  return truncateUtf8(JSON.stringify(redacted) ?? "", MAX_PROPOSAL_BYTES);
+}
+function parsePreflightResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const response = value;
+  const verdicts = /* @__PURE__ */ new Set(["allow", "warn", "ask", "block", "unavailable"]);
+  if (response.protocolVersion !== PREFLIGHT_PROTOCOL_VERSION || typeof response.verdict !== "string" || !verdicts.has(response.verdict) || typeof response.reasonCode !== "string" || typeof response.message !== "string" || !Array.isArray(response.conflicts) || !Array.isArray(response.bypassed)) {
+    return null;
+  }
+  return response;
+}
+async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS)) {
+  const response = await getClient().post("/api/cli/decisions/conflict-check", request, {
+    signal,
+    quietRefresh: true
+  });
+  return parsePreflightResponse(response);
+}
+function resultForPreflight(response) {
+  const verdict = response.verdict === "block" ? "deny" : response.verdict;
+  const safe = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+  const directives = response.conflicts.flatMap((value) => {
+    if (!value || typeof value !== "object") return [];
+    const { decisionId, shortId } = value;
+    const id = typeof shortId === "string" && safe.test(shortId) ? `dec_${shortId}` : typeof decisionId === "string" && safe.test(decisionId) ? decisionId : void 0;
+    return id ? [`To reconcile, run: prim reconcile ${id}`] : [];
+  });
+  const reason = [response.message, ...new Set(directives)].filter(Boolean).join("\n");
+  return {
+    verdict,
+    conflicts: response.conflicts,
+    reason,
+    additionalContext: ["warn", "ask", "block"].includes(response.verdict) ? reason : "",
+    truncated: false,
+    unavailable: response.verdict === "unavailable" ? response.message || response.reasonCode : void 0
+  };
+}
+function unverifiedResult(message) {
+  return {
+    verdict: "unavailable",
+    conflicts: [],
+    reason: "",
+    additionalContext: "",
+    truncated: false,
+    unavailable: message
+  };
+}
+
 // src/hooks/pre-tool-use.ts
 var STDIN_TIMEOUT_MS = 1e3;
 async function readStdin() {

package/dist/hooks/prim-hook.js

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
+import {
+  enrichHookPayloadWithFileRefs,
+  preserveHookFileMetadata
+} from "../chunk-DA4BMHEB.js";
 import {
   postToolInvocationId,
   shouldFlushAfter,
   toMove
-} from "../chunk-YDBZTFW5.js";
+} from "../chunk-QGVHLP5J.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-S4LFRVGD.js";
+} from "../chunk-HIMWM526.js";
 import {
   scrubFromCwd
-} from "../chunk-GUXBUBQ7.js";
+} from "../chunk-GF5QII7T.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -20,17 +24,19 @@ import {
   acknowledgeDecisionFeedback,
   leaseDecisionFeedback,
   renderFeedback
-} from "../chunk-R4CUX6FY.js";
+} from "../chunk-KHZNYEUV.js";
 import {
   getOrCreateWorkspaceId
-} from "../chunk-IMAIBPUC.js";
+} from "../chunk-UVIWZWM6.js";
 import {
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
-  isRepoActiveForCapture
-} from "../chunk-LDQZASIF.js";
-import "../chunk-I3HIPAIR.js";
+  isRepoActiveForCapture,
+  repoSyncId,
+  resolveRepositoryContext
+} from "../chunk-XTNMSS4C.js";
+import "../chunk-CPX3BUOC.js";
 import {
   normalizeEnvelope,
   parseAgent
@@ -90,10 +96,25 @@ async function main() {
   }
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+  const resolvedRepository = resolveRepositoryContext(cwd);
+  const repository = resolvedRepository ? { ...resolvedRepository, repoSyncId: repoSyncId(cwd) } : null;
   try {
-    const invocationId = postToolInvocationId(parsed, agent);
-    const base = toMove(parsed, resolveCliVersion(), agent, workspaceId, invocationId);
-    const move = { ...base, payload: scrubFromCwd(parsed, cwd) };
+    const enrichment = repository ? enrichHookPayloadWithFileRefs({ parsed, agent, cwd, repository }) : void 0;
+    const enriched = enrichment?.parsed ?? parsed;
+    const invocationId = postToolInvocationId(enriched, agent);
+    const base = toMove(
+      enriched,
+      resolveCliVersion(),
+      agent,
+      workspaceId,
+      repository,
+      invocationId
+    );
+    const scrubbed = scrubFromCwd(enriched, cwd);
+    const move = {
+      ...base,
+      payload: enrichment ? preserveHookFileMetadata(scrubbed, enrichment.resolution) : scrubbed
+    };
     const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
     appendMove(move, orgId);
     if (shouldFlushAfter(move.eventType)) {

package/dist/hooks/session-start.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import {
   bindRepository,
+  ensureEffectivePostCommitHook,
   hasUsableCodexGuidance,
   refreshClaudePlugins
-} from "../chunk-N4R7EXZT.js";
+} from "../chunk-WNIY6Z6N.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -13,23 +14,25 @@ import {
   acknowledgeDecisionFeedback,
   leaseDecisionFeedback,
   renderFeedback
-} from "../chunk-R4CUX6FY.js";
+} from "../chunk-KHZNYEUV.js";
 import {
   getOrCreateWorkspaceId
-} from "../chunk-IMAIBPUC.js";
+} from "../chunk-UVIWZWM6.js";
 import {
   binFile,
   warmBinCache
-} from "../chunk-YIMUIPMD.js";
+} from "../chunk-KBFFVYBC.js";
 import {
   gitToplevel,
   isRepoActiveForCapture,
-  repoSyncId
-} from "../chunk-LDQZASIF.js";
+  repoActiveFlag,
+  repoSyncId,
+  setRepoActive
+} from "../chunk-XTNMSS4C.js";
 import {
   getSiteUrl,
   isSessionEnded
-} from "../chunk-I3HIPAIR.js";
+} from "../chunk-CPX3BUOC.js";
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";
@@ -46,9 +49,13 @@ function kickDaemonEnsure(options = {}) {
     return false;
   }
   try {
+    const args = [primEntry, "daemon", "ensure"];
+    if ((options.platform ?? process.platform) === "darwin") {
+      args.push("--latest-bootstrap");
+    }
     const child = (options.spawnProcess ?? spawn)(
       options.nodeEntry ?? process.execPath,
-      [primEntry, "daemon", "ensure"],
+      args,
       { detached: true, stdio: "ignore" }
     );
     child.unref();
@@ -81,6 +88,20 @@ async function activeProjectRoot(cwd) {
   try {
     const root = gitToplevel(cwd);
     if (!root || !isRepoActiveForCapture(cwd)) return null;
+    let shellGateActive = repoActiveFlag(root) === "true";
+    if (!shellGateActive) {
+      try {
+        setRepoActive(root, true);
+        shellGateActive = true;
+      } catch {
+      }
+    }
+    if (shellGateActive) {
+      try {
+        ensureEffectivePostCommitHook(root);
+      } catch {
+      }
+    }
     if (!repoSyncId(root)) {
       try {
         await bindRepository(root, {