@primitive.ai/prim 0.1.0-alpha.61 → 0.1.0-alpha.63

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-YITJ2H3B.js";
+} from "./chunk-WS3MCNFD.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
@@ -22,19 +22,25 @@ import {
   listFlushing,
   pendingJournalStats,
   readMovesFromPath
-} from "./chunk-S4LFRVGD.js";
+} from "./chunk-HIMWM526.js";
 import {
   bindRepository,
   compareSemver,
+  ensureEffectivePostCommitHook,
+  ensurePostCommitHookAtPath,
+  inspectEffectivePostCommitHook,
+  postCommitHookBlock,
   printJson,
-  registerSkillCommands
-} from "./chunk-N4R7EXZT.js";
+  registerSkillCommands,
+  uninstallPostCommitHookAtPath,
+  uninstallProjectPostCommitHook
+} from "./chunk-WNIY6Z6N.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-R4CUX6FY.js";
+} from "./chunk-KHZNYEUV.js";
 import {
   inspectWorkspaceId
-} from "./chunk-IMAIBPUC.js";
+} from "./chunk-UVIWZWM6.js";
 import {
   binFile,
   commandMatchesBin,
@@ -42,16 +48,17 @@ import {
   packageVersion,
   pinnedHookCommand,
   warmBinCache
-} from "./chunk-YIMUIPMD.js";
+} from "./chunk-KBFFVYBC.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
   decisionIngestionStatus,
   gitToplevel,
   isRepoActiveForCapture,
+  isValidRepoSyncId,
   repoSyncId,
   setRepoActive
-} from "./chunk-LDQZASIF.js";
+} from "./chunk-XTNMSS4C.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -66,7 +73,7 @@ import {
   resolveAuthCredential,
   setStoredToken,
   withFileLock
-} from "./chunk-I3HIPAIR.js";
+} from "./chunk-CPX3BUOC.js";
 import {
   daemonIsLive,
   daemonRequest
@@ -91,17 +98,20 @@ async function applyActivation(active) {
   }
   try {
     let bound;
+    let postCommitHook;
     if (active) {
+      postCommitHook = ensureEffectivePostCommitHook(root).path;
       bound = await bindRepository(root);
     }
     setRepoActive(root, active);
+    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
     process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
 `);
-    printJson({ active, repo: root, ...bound });
+    printJson({ active, repo: root, ...bound, ...postCommitHook ? { postCommitHook } : {} });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `[prim] failed to ${active ? "bind and enable" : "disable"} prim: ${detail}
+      `[prim] failed to ${active ? "cover, bind, and enable" : "disable"} prim: ${detail}
 `
     );
     process.exit(1);
@@ -662,7 +672,7 @@ function normalizeApiUrl(url) {
 
 // src/daemon/launchd.ts
 var LAUNCHD_LABEL = "ai.getprimitive.prim-daemon";
-var RUNTIME_SCHEMA_VERSION = 2;
+var RUNTIME_SCHEMA_VERSION = 3;
 var RUNTIME_DIR_MODE = 448;
 var RUNTIME_FILE_MODE = 384;
 var RUNTIME_LAUNCHER_MODE = 448;
@@ -742,7 +752,7 @@ function findPackageVersion(entryFile) {
 function readRuntimeManifest(path) {
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    if (parsed.schemaVersion !== RUNTIME_SCHEMA_VERSION || typeof parsed.version !== "string" || typeof parsed.nodePath !== "string" || parsed.daemonFile !== "prim-daemon-server" || typeof parsed.daemonSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(parsed.daemonSha256) || parsed.statuslineFile !== void 0 && parsed.statuslineFile !== "prim-statusline" || parsed.statuslineFile === void 0 !== (parsed.statuslineSha256 === void 0) || parsed.statuslineSha256 !== void 0 && !/^[a-f0-9]{64}$/u.test(parsed.statuslineSha256)) {
+    if (parsed.schemaVersion !== RUNTIME_SCHEMA_VERSION || typeof parsed.version !== "string" || typeof parsed.nodePath !== "string" || parsed.daemonFile !== "prim-daemon-server" || typeof parsed.daemonSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(parsed.daemonSha256)) {
       return null;
     }
     return parsed;
@@ -750,12 +760,12 @@ function readRuntimeManifest(path) {
     return null;
   }
 }
-function sameRuntime(current, desired, daemonPath, statuslinePath) {
-  if (!current || current.version !== desired.version || current.nodePath !== desired.nodePath || current.daemonSha256 !== desired.daemonSha256 || current.statuslineFile !== desired.statuslineFile || current.statuslineSha256 !== desired.statuslineSha256) {
+function sameRuntime(current, desired, daemonPath) {
+  if (!current || current.version !== desired.version || current.nodePath !== desired.nodePath || current.daemonSha256 !== desired.daemonSha256) {
     return false;
   }
   try {
-    return sha256File(daemonPath) === desired.daemonSha256 && (desired.statuslineSha256 === void 0 || sha256File(statuslinePath) === desired.statuslineSha256);
+    return sha256File(daemonPath) === desired.daemonSha256;
   } catch {
     return false;
   }
@@ -779,8 +789,6 @@ function stageRuntime(options = {}) {
   if (!daemonSource || !existsSync2(daemonSource)) {
     throw new Error("cannot stage runtime: prim-daemon-server bundle is unavailable");
   }
-  const configuredStatusline = options.statuslineSource === void 0 ? binFile("prim-statusline") : options.statuslineSource;
-  const statuslineSource = configuredStatusline && existsSync2(configuredStatusline) ? configuredStatusline : null;
   const nodePath = resolve(options.nodePath ?? process.execPath);
   const version = options.version ?? findPackageVersion(daemonSource);
   const desired = {
@@ -789,10 +797,6 @@ function stageRuntime(options = {}) {
     nodePath,
     daemonFile: "prim-daemon-server",
     daemonSha256: sha256File(daemonSource),
-    ...statuslineSource ? {
-      statuslineFile: "prim-statusline",
-      statuslineSha256: sha256File(statuslineSource)
-    } : {},
     stagedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
   let currentRelease = null;
@@ -802,19 +806,13 @@ function stageRuntime(options = {}) {
   }
   const current = currentRelease ? readRuntimeManifest(join(currentRelease, "manifest.json")) : null;
   const currentDaemon = currentRelease ? join(currentRelease, desired.daemonFile) : "";
-  const currentStatusline = currentRelease ? join(currentRelease, "prim-statusline") : "";
-  if (currentRelease && sameRuntime(current, desired, currentDaemon, currentStatusline)) {
+  if (currentRelease && sameRuntime(current, desired, currentDaemon)) {
     const manifest = current;
-    const statuslinePath = manifest.statuslineFile ? currentStatusline : void 0;
-    if (statuslinePath) {
-      atomicWrite(
-        paths.statuslineLauncher,
-        statuslineLauncherContent(statuslinePath, manifest.nodePath),
-        RUNTIME_LAUNCHER_MODE
-      );
-    } else {
-      rmSync(paths.statuslineLauncher, { force: true });
-    }
+    atomicWrite(
+      paths.statuslineLauncher,
+      statuslineLauncherContent(manifest.version, options.homeDir),
+      RUNTIME_LAUNCHER_MODE
+    );
     return {
       changed: false,
       manifest,
@@ -835,14 +833,6 @@ function stageRuntime(options = {}) {
     if (sha256File(daemonTarget) !== desired.daemonSha256) {
       throw new Error("cannot stage runtime: daemon bundle changed while it was copied");
     }
-    if (statuslineSource && desired.statuslineFile) {
-      const statuslineTarget = join(stagingDir, desired.statuslineFile);
-      copyFileSync(statuslineSource, statuslineTarget);
-      chmodSync(statuslineTarget, RUNTIME_FILE_MODE);
-      if (sha256File(statuslineTarget) !== desired.statuslineSha256) {
-        throw new Error("cannot stage runtime: statusline bundle changed while it was copied");
-      }
-    }
     const manifestTarget = join(stagingDir, "manifest.json");
     writeFileSync(manifestTarget, `${JSON.stringify(desired, null, 2)}
 `, {
@@ -850,23 +840,16 @@ function stageRuntime(options = {}) {
       mode: RUNTIME_FILE_MODE,
       flag: "wx"
     });
-    const releaseName = `release-${createHash2("sha256").update(
-      `${version}\0${nodePath}\0${desired.statuslineFile ?? ""}\0${desired.stagedAt}\0${process.pid}\0${Math.random()}`
-    ).digest("hex").slice(0, 16)}`;
+    const releaseName = `release-${createHash2("sha256").update(`${version}\0${nodePath}\0${desired.stagedAt}\0${process.pid}\0${Math.random()}`).digest("hex").slice(0, 16)}`;
     releaseDir = join(paths.releasesDir, releaseName);
     renameSync(stagingDir, releaseDir);
     releaseDir = realpathSync(releaseDir);
     atomicSymlink(join("releases", releaseName), paths.currentLink);
-    if (desired.statuslineFile) {
-      const statuslinePath = join(releaseDir, desired.statuslineFile);
-      atomicWrite(
-        paths.statuslineLauncher,
-        statuslineLauncherContent(statuslinePath, desired.nodePath),
-        RUNTIME_LAUNCHER_MODE
-      );
-    } else {
-      rmSync(paths.statuslineLauncher, { force: true });
-    }
+    atomicWrite(
+      paths.statuslineLauncher,
+      statuslineLauncherContent(desired.version, options.homeDir),
+      RUNTIME_LAUNCHER_MODE
+    );
   } catch (error) {
     rmSync(stagingDir, { recursive: true, force: true });
     throw error;
@@ -881,9 +864,20 @@ function stageRuntime(options = {}) {
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
-function statuslineLauncherContent(statuslinePath, nodePath) {
+function statuslineLauncherContent(version, homeDir = homedir()) {
+  const socketPath = join(homeDir, ".config", "prim", "sock");
+  const fallback = `primitive ${version} (daemon: down)`;
   return `#!/bin/sh
-exec ${shellQuote(nodePath)} ${shellQuote(statuslinePath)}
+response=$(
+  printf 'prim-statusline-v1\\000%s\\000%s\\000' "\${PWD:-/}" "\${PRIM_API_URL:-}" |
+    /usr/bin/nc -U -w 1 ${shellQuote(socketPath)} 2>/dev/null
+)
+status=$?
+if [ "$status" -eq 0 ] && [ -n "$response" ]; then
+  printf '%s' "$response"
+else
+  printf '%s' ${shellQuote(fallback)}
+fi
 `;
 }
 function runtimeStatuslineCommand(options = {}) {
@@ -1719,10 +1713,7 @@ function performInstall(scope, force) {
   let statuslineCommand = STATUSLINE_COMMAND;
   if (!blockedByUserStatusline && process.platform === "darwin" && (!before.statusLine || isPrimStatusLine(before))) {
     try {
-      const runtime = stageRuntime();
-      if (!runtime.manifest.statuslineFile) {
-        throw new Error("standalone prim-statusline entry is unavailable");
-      }
+      stageRuntime();
       statuslineCommand = runtimeStatuslineCommand();
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
@@ -2021,10 +2012,74 @@ ${line("project", result.project)}`);
 }
 
 // src/commands/daemon.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { closeSync as closeSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, unlinkSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
+import { Option } from "commander";
+
+// src/daemon/latest-bootstrap.ts
+import { spawn } from "child_process";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
+var LATEST_BOOTSTRAP_TIMEOUT_MS = 45e3;
+var LATEST_BOOTSTRAP_LOCK_NAME = "daemon-latest.lock";
+async function runLatestEnsure(options) {
+  const env = {
+    ...options.env ?? process.env,
+    npm_config_prefer_online: "true",
+    npm_config_fetch_retries: "1",
+    npm_config_fetch_retry_mintimeout: "1000",
+    npm_config_fetch_retry_maxtimeout: "5000",
+    npm_config_fetch_timeout: "15000"
+  };
+  return await new Promise((resolve5) => {
+    let settled = false;
+    let child;
+    try {
+      child = (options.spawnProcess ?? spawn)(
+        "npx",
+        ["--yes", "--prefer-online", "-p", "@primitive.ai/prim@latest", "prim", "daemon", "ensure"],
+        { env, stdio: "ignore" }
+      );
+    } catch {
+      resolve5(false);
+      return;
+    }
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(false);
+    }, options.timeoutMs ?? LATEST_BOOTSTRAP_TIMEOUT_MS);
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve5(result);
+    };
+    timer.unref();
+    child.once("error", () => finish(false));
+    child.once("exit", (code) => finish(code === 0));
+  });
+}
+async function runLatestDaemonBootstrap(ensureCurrent, options = {}) {
+  const lockPath = options.lockPath ?? join4(options.homeDir ?? homedir4(), ".config", "prim", LATEST_BOOTSTRAP_LOCK_NAME);
+  try {
+    return await withFileLock(
+      lockPath,
+      async () => {
+        const current = await ensureCurrent();
+        if (current.disabled) return true;
+        return await runLatestEnsure(options);
+      },
+      // A concurrent SessionStart already owns the complete bootstrap. Do not
+      // queue another npm lookup behind it; the short window only permits one
+      // retry after recovering a stale lock.
+      { timeoutMs: 100, pollMs: 25 }
+    );
+  } catch {
+    return false;
+  }
+}
 
 // src/lib/presence.ts
 var DECISION_ORIGIN = "https://app.getprimitive.ai";
@@ -2075,10 +2130,10 @@ function formatTeammatesWithArea(teammates, cap) {
 
 // src/commands/daemon.ts
 var DAEMON_BIN = "prim-daemon-server";
-var CONFIG_DIR = join4(homedir4(), ".config", "prim");
-var PID_PATH = join4(CONFIG_DIR, "daemon.pid");
-var SOCK_PATH = join4(CONFIG_DIR, "sock");
-var LOG_PATH = join4(CONFIG_DIR, "daemon.log");
+var CONFIG_DIR = join5(homedir5(), ".config", "prim");
+var PID_PATH = join5(CONFIG_DIR, "daemon.pid");
+var SOCK_PATH = join5(CONFIG_DIR, "sock");
+var LOG_PATH = join5(CONFIG_DIR, "daemon.log");
 var CONFIG_DIR_MODE = 448;
 var LOG_FILE_MODE = 384;
 var STOP_TIMEOUT_MS = 5e3;
@@ -2149,13 +2204,13 @@ function sleep(ms) {
 }
 function spawnDaemon(options) {
   const file = binFile(DAEMON_BIN);
-  return file ? spawn(process.execPath, [file], options) : spawn(DAEMON_BIN, [], options);
+  return file ? spawn2(process.execPath, [file], options) : spawn2(DAEMON_BIN, [], options);
 }
 function openDaemonLog(configDir = CONFIG_DIR) {
   if (!existsSync4(configDir)) {
     mkdirSync3(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
   }
-  return openSync2(join4(configDir, "daemon.log"), "a", LOG_FILE_MODE);
+  return openSync2(join5(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
 async function waitForReady() {
   const deadline = Date.now() + READY_TIMEOUT_MS;
@@ -2667,7 +2722,7 @@ async function daemonEnsure() {
       process.stderr.write("[prim] daemon remains explicitly disabled\n");
       console.log(JSON.stringify({ ensured: false, disabled: true, supervised: false }, null, 2));
     }
-    return;
+    return { disabled };
   }
   const result = await ensureMacDaemon();
   if (result.state === "disabled") {
@@ -2694,6 +2749,7 @@ async function daemonEnsure() {
       2
     )
   );
+  return { disabled: result.state === "disabled" };
 }
 function registerDaemonCommands(program2) {
   const daemon = program2.command("daemon").description("Manage the prim companion daemon (latency unlock + presence + broadcast)");
@@ -2709,13 +2765,17 @@ function registerDaemonCommands(program2) {
   daemon.command("restart").description("Restart the daemon and clear any explicit disable marker").option("--foreground", "Restart in the foreground").action(async (opts) => {
     await daemonRestart(opts);
   });
-  daemon.command("ensure").description("Idempotently install, upgrade, and heal the daemon unless explicitly disabled").action(async () => {
+  daemon.command("ensure").description("Idempotently install, upgrade, and heal the daemon unless explicitly disabled").addOption(new Option("--latest-bootstrap").hideHelp()).action(async (opts) => {
+    if (opts.latestBootstrap) {
+      await runLatestDaemonBootstrap(daemonEnsure);
+      return;
+    }
     await daemonEnsure();
   });
 }
 
 // src/commands/decisions.ts
-import { Option } from "commander";
+import { Option as Option2 } from "commander";
 
 // src/decisions/cascade-renderer.ts
 var DEPENDENTS_INLINE_LIMIT = 5;
@@ -3517,7 +3577,7 @@ function registerDecisionsCommands(program2) {
     }
   });
   decisions.command("create").description("Record a decision directly with its explicit user or agent origin").requiredOption("--intent <text>", "What was decided (required)").addOption(
-    new Option(
+    new Option2(
       "--attribution <origin>",
       "Who originated the exact choice: user | agent (required)"
     ).choices(["user", "agent"]).makeOptionMandatory()
@@ -3848,6 +3908,46 @@ function checkWorkspaceIdentity() {
       };
   }
 }
+function classifyRepositoryBinding(value) {
+  return isValidRepoSyncId(value) ? {
+    name: "repo-binding",
+    status: "ok",
+    detail: "valid local repository binding ready"
+  } : {
+    name: "repo-binding",
+    status: "fail",
+    detail: "missing or invalid local prim.repoSyncId \u2014 run `prim enable`"
+  };
+}
+function checkRepositoryBinding() {
+  return classifyRepositoryBinding(repoSyncId(process.cwd()));
+}
+function classifyPostCommitHook(inspection) {
+  if (inspection.covered) {
+    return {
+      name: "post-commit",
+      status: "ok",
+      detail: `effective and executable \xB7 ${inspection.kind} \xB7 ${inspection.hookPath}`
+    };
+  }
+  return {
+    name: "post-commit",
+    status: "fail",
+    detail: `${inspection.reason ?? "uncovered"} \xB7 ${inspection.hookPath}`
+  };
+}
+function checkPostCommitHook() {
+  try {
+    return classifyPostCommitHook(inspectEffectivePostCommitHook());
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      name: "post-commit",
+      status: /not a git repository/iu.test(detail) ? "warn" : "fail",
+      detail: detail.slice(0, 120)
+    };
+  }
+}
 function checkFeedbackHooks() {
   try {
     const status = performStatus();
@@ -3877,6 +3977,9 @@ function parseMovesStatus(value) {
   if (status.captureState !== "enabled" && status.captureState !== "disabled" || !nullableNumber(status.latestIngestAt) || !nullableNumber(status.latestClassificationAt) || !nullableNumber(status.highWaterMark) || typeof status.pendingSessionCount !== "number" || !Number.isInteger(status.pendingSessionCount) || status.pendingSessionCount < 0 || typeof status.sampled !== "boolean") {
     throw new Error("moves status returned an invalid response");
   }
+  if (status.oldestPendingAt !== void 0 && !nullableNumber(status.oldestPendingAt) || status.oldestPendingAgeMs !== void 0 && !nullableNumber(status.oldestPendingAgeMs) || typeof status.oldestPendingAgeMs === "number" && status.oldestPendingAgeMs < 0 || status.pendingCommitCorrelationCount !== void 0 && (!Number.isInteger(status.pendingCommitCorrelationCount) || status.pendingCommitCorrelationCount < 0)) {
+    throw new Error("moves status returned invalid pending-age fields");
+  }
   return status;
 }
 function classifyMovesStatus(status) {
@@ -3887,10 +3990,11 @@ function classifyMovesStatus(status) {
   };
   let classification;
   if (status.pendingSessionCount > 0) {
+    const oldest = typeof status.oldestPendingAgeMs === "number" ? ` \xB7 oldest ${String(Math.round(status.oldestPendingAgeMs / MS_PER_SECOND))}s` : typeof status.oldestPendingAt === "number" ? ` \xB7 oldest ${String(Math.max(0, Math.round((Date.now() - status.oldestPendingAt) / MS_PER_SECOND)))}s` : "";
     classification = {
       name: "classification",
       status: "warn",
-      detail: `${String(status.pendingSessionCount)} session(s) pending${status.sampled ? " in a bounded sample" : ""}`
+      detail: `${String(status.pendingSessionCount)} session(s) pending${oldest}${status.sampled ? " in a bounded sample" : ""}`
     };
   } else if (status.sampled) {
     classification = {
@@ -3905,7 +4009,16 @@ function classifyMovesStatus(status) {
       detail: status.latestClassificationAt === null ? "no sessions awaiting classification" : `caught up \xB7 last ${new Date(status.latestClassificationAt).toISOString()}`
     };
   }
-  return [capture, classification];
+  const correlation = status.pendingCommitCorrelationCount === void 0 ? void 0 : status.pendingCommitCorrelationCount > 0 ? {
+    name: "commit-correlation",
+    status: "warn",
+    detail: `${String(status.pendingCommitCorrelationCount)} commit(s) awaiting evidence correlation`
+  } : {
+    name: "commit-correlation",
+    status: "ok",
+    detail: "caught up"
+  };
+  return correlation ? [capture, classification, correlation] : [capture, classification];
 }
 async function checkBackend() {
   try {
@@ -3954,6 +4067,8 @@ async function collectChecks() {
     checkStranded(),
     checkFeedbackHooks(),
     checkWorkspaceIdentity(),
+    checkRepositoryBinding(),
+    checkPostCommitHook(),
     ...backend,
     await checkFeedbackCapability()
   ];
@@ -3997,8 +4112,8 @@ import {
   rmSync as rmSync2,
   writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname3, join as join6 } from "path";
 import { Document, parseDocument, stringify } from "yaml";
 var CAPTURE_BIN3 = "prim-hook";
 var GATE_BIN3 = "prim-pre-tool-use";
@@ -4023,13 +4138,13 @@ var PINNED_CASES = PRIM_BINS3.map((bin) => {
     ;;`;
 }).join("\n");
 function hermesHome() {
-  return process.env.HERMES_HOME ?? join5(homedir5(), ".hermes");
+  return process.env.HERMES_HOME ?? join6(homedir6(), ".hermes");
 }
 function configPath() {
-  return join5(hermesHome(), "config.yaml");
+  return join6(hermesHome(), "config.yaml");
 }
 function shimPath() {
-  return join5(hermesHome(), "agent-hooks", "prim-shim.sh");
+  return join6(hermesHome(), "agent-hooks", "prim-shim.sh");
 }
 var SHIM_SCRIPT = `#!/bin/sh
 # prim Hermes hook shim \u2014 managed by \`prim hermes install\`. Hermes runs hooks
@@ -4331,12 +4446,13 @@ function registerHermesCommands(program2) {
 // src/commands/hooks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname4, join as join6, resolve as resolve2 } from "path";
-import { Option as Option2 } from "commander";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname4, join as join7, resolve as resolve2 } from "path";
+import { Option as Option3 } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
 var HOOKS = [PRE_COMMIT, POST_COMMIT];
+var GIT_TIMEOUT_MS = 1e3;
 function blockMarkers(spec) {
   return {
     start: `# >>> prim ${spec.hookName} hook >>>`,
@@ -4363,12 +4479,14 @@ ${hookShim(spec.binName)}
 `;
 }
 function huskyBlock(spec) {
+  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${hookShim(spec.binName)}
 ${end}`;
 }
 function gatedBlock(spec) {
+  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${gatedShim(spec.binName)}
@@ -4377,6 +4495,21 @@ ${end}`;
 function mergePrimBlock(hookPath, block, binName) {
   if (existsSync7(hookPath)) {
     const existing = readFileSync6(hookPath, "utf-8");
+    const start = block.slice(0, block.indexOf("\n"));
+    const end = block.slice(block.lastIndexOf("\n") + 1);
+    const starts = existing.split(start).length - 1;
+    const ends = existing.split(end).length - 1;
+    if (starts !== 0 || ends !== 0) {
+      if (starts !== 1 || ends !== 1 || existing.indexOf(end) < existing.indexOf(start)) {
+        throw new Error(`malformed Prim hook markers in ${hookPath}`);
+      }
+      const from = existing.indexOf(start);
+      const through = existing.indexOf(end) + end.length;
+      const refreshed = existing.slice(0, from) + block + existing.slice(through);
+      if (refreshed === existing) return false;
+      writeFileSync4(hookPath, refreshed, { mode: 493 });
+      return true;
+    }
     if (containsPrimHook(existing, binName)) return false;
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
     writeFileSync4(hookPath, `${existing}${separator}${block}
@@ -4432,7 +4565,7 @@ function installToHusky(gitRoot, spec = PRE_COMMIT) {
   }
 }
 function installToDotGit(gitRoot, spec = PRE_COMMIT) {
-  const hooksDir = resolve2(gitRoot, ".git", "hooks");
+  const hooksDir = projectHooksDir(gitRoot);
   const hookPath = resolve2(hooksDir, spec.hookName);
   if (!existsSync7(hooksDir)) {
     mkdirSync5(hooksDir, { recursive: true });
@@ -4450,9 +4583,21 @@ function installToDotGit(gitRoot, spec = PRE_COMMIT) {
   writeFileSync4(hookPath, dotGitScript(spec), { mode: 493 });
   console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
 }
-var PRIM_GIT_HOOKS_DIR = join6(homedir6(), ".config", "prim", "git-hooks");
+function projectHooksDir(gitRoot) {
+  const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
+    cwd: gitRoot,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: GIT_TIMEOUT_MS
+  }).trim();
+  if (commonDir === "") {
+    throw new Error("git returned an empty common directory");
+  }
+  return resolve2(gitRoot, commonDir, "hooks");
+}
+var PRIM_GIT_HOOKS_DIR = join7(homedir7(), ".config", "prim", "git-hooks");
 function expandTilde(p) {
-  return p.startsWith("~/") ? join6(homedir6(), p.slice(2)) : p;
+  return p.startsWith("~/") ? join7(homedir7(), p.slice(2)) : p;
 }
 function isOurHooksDir(value) {
   return value !== "" && expandTilde(value) === PRIM_GIT_HOOKS_DIR;
@@ -4461,7 +4606,8 @@ function gitConfigGet(level) {
   try {
     return execFileSync("git", ["config", level, "--get", "core.hooksPath"], {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
     }).trim();
   } catch {
     return "";
@@ -4489,14 +4635,18 @@ var PASSTHROUGH_HOOKS = [
 ];
 function globalHookScript(spec) {
   const chainExit = spec.hookName === "pre-commit" ? "|| exit $?" : "|| true";
+  const invocation = spec.hookName === POST_COMMIT.hookName ? postCommitHookBlock() : gatedShim(spec.binName);
+  const beforeComments = spec.hookName === POST_COMMIT.hookName ? `${invocation}
+` : "";
+  const afterComments = spec.hookName === POST_COMMIT.hookName ? "" : `${invocation}
+`;
   return `#!/bin/sh
-# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
+${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
 # Install/uninstall: prim hooks install|uninstall --scope user
 # Runs prim only where activated \u2014 'prim enable' (this repo) or
 # 'git config --global prim.active true' (every repo). Chains to the repo's own
 # hook regardless, so inactive repos are unaffected.
-${gatedShim(spec.binName)}
-common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+${afterComments}common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
 repo_hook="$common_dir/hooks/${spec.hookName}"
 if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null; then
   "$repo_hook" "$@" ${chainExit}
@@ -4521,18 +4671,29 @@ function writeOwnHooks() {
     mkdirSync5(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
-    writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
-      mode: 493
-    });
+    const path = resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName);
+    if (spec.hookName === POST_COMMIT.hookName) {
+      ensurePostCommitHookAtPath(path, globalHookScript(spec));
+    } else {
+      writeFileSync4(path, globalHookScript(spec), { mode: 493 });
+    }
   }
   for (const name of PASSTHROUGH_HOOKS) {
     writeFileSync4(resolve2(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
   }
 }
 function appendPrimBlock(hookPath, spec) {
+  if (spec.hookName === POST_COMMIT.hookName) {
+    ensurePostCommitHookAtPath(hookPath);
+    return;
+  }
   mergePrimBlock(hookPath, gatedBlock(spec), spec.binName);
 }
 function stripPrimBlock(hookPath, spec) {
+  if (spec.hookName === POST_COMMIT.hookName) {
+    uninstallPostCommitHookAtPath(hookPath);
+    return;
+  }
   if (!existsSync7(hookPath)) return;
   const existing = readFileSync6(hookPath, "utf-8");
   const primCreated = existing.includes(PRIM_CREATED_MARK);
@@ -4564,7 +4725,10 @@ function installGlobalHooks(opts = {}) {
       );
     }
     writeOwnHooks();
-    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR]);
+    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR], {
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS
+    });
     console.log(
       `Installed prim global git hooks; set core.hooksPath to ${PRIM_GIT_HOOKS_DIR}. Repos are opt-in: run \`prim enable\` in each repo to capture, or \`git config --global prim.active true\` for all.`
     );
@@ -4591,7 +4755,10 @@ function uninstallGlobalHooks() {
       const p = resolve2(PRIM_GIT_HOOKS_DIR, name);
       if (existsSync7(p)) unlinkSync2(p);
     }
-    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"]);
+    execFileSync("git", ["config", "--global", "--unset", "core.hooksPath"], {
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS
+    });
     console.log("Removed prim global git hooks and unset core.hooksPath.");
     return;
   }
@@ -4606,25 +4773,29 @@ function uninstallGlobalHooks() {
   console.log("No prim global git hooks found.");
 }
 function installHooks(gitRoot, target) {
-  for (const spec of HOOKS) {
+  for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
     if (target === "husky") {
       installToHusky(gitRoot, spec);
     } else {
       installToDotGit(gitRoot, spec);
     }
   }
+  const postCommit = ensureEffectivePostCommitHook(gitRoot);
+  console.log(
+    `${postCommit.changed ? "Installed" : "Refreshed"} effective post-commit hook at ${postCommit.path}.`
+  );
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
   hooks.command("install").description(
     "Install the prim git hooks \u2014 pre-commit + post-commit (auto-detects Husky; use --target to override)"
   ).addOption(
-    new Option2("--target <where>", "install destination; bypasses Husky detection").choices([
+    new Option3("--target <where>", "install destination; bypasses Husky detection").choices([
       "husky",
       "git-hooks"
     ])
   ).addOption(
-    new Option2(
+    new Option3(
       "--scope <scope>",
       "project (default, this repo) or user (a global core.hooksPath capturing every repo)"
     ).choices(["project", "user"])
@@ -4664,7 +4835,7 @@ function registerHooksCommands(program2) {
   hooks.command("uninstall").description(
     "Remove the prim git hooks (.git/hooks, or the global core.hooksPath with --scope user)"
   ).addOption(
-    new Option2(
+    new Option3(
       "--scope <scope>",
       "project (default, this repo) or user (global core.hooksPath)"
     ).choices(["project", "user"])
@@ -4674,8 +4845,9 @@ function registerHooksCommands(program2) {
       return;
     }
     const gitRoot = getGitRoot();
-    for (const spec of HOOKS) {
-      const hookPath = resolve2(gitRoot, ".git", "hooks", spec.hookName);
+    const hooksDir = projectHooksDir(gitRoot);
+    for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
+      const hookPath = resolve2(hooksDir, spec.hookName);
       if (!existsSync7(hookPath)) {
         console.log(`No ${spec.hookName} hook found.`);
         continue;
@@ -4687,16 +4859,24 @@ function registerHooksCommands(program2) {
         console.log(`Left ${spec.hookName} hook at ${hookPath} untouched (not a prim hook).`);
       }
     }
+    const postCommit = uninstallProjectPostCommitHook(gitRoot);
+    if (!postCommit.changed) {
+      console.log(`No Prim post-commit block found at ${postCommit.path}.`);
+    } else if (postCommit.removedFile) {
+      console.log(`Removed Prim-created post-commit hook at ${postCommit.path}.`);
+    } else {
+      console.log(`Removed the Prim post-commit block from ${postCommit.path}.`);
+    }
   });
 }
 
 // src/commands/moves.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/flusher.ts
 import { createReadStream, renameSync as renameSync4, unlinkSync as unlinkSync3 } from "fs";
-import { dirname as dirname5, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 import { createInterface } from "readline";
 var BATCH_SIZE = 500;
 var HTTP_TIMEOUT_MS = 1e4;
@@ -4820,7 +5000,7 @@ async function flushOnce() {
   return { flushed: total };
 }
 var flushInFlight;
-var FLUSH_LOCK_PATH = join7(dirname5(JOURNAL_DIR), ".flush.lock");
+var FLUSH_LOCK_PATH = join8(dirname5(JOURNAL_DIR), ".flush.lock");
 var FLUSH_LOCK_TIMEOUT_MS = 250;
 function isFlushLockContended(error) {
   return error instanceof Error && error.message.startsWith("timed out waiting for file lock");
@@ -4937,18 +5117,18 @@ function registerMovesCommands(program2) {
     }
   });
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
-    const dir = join8(process.cwd(), ".prim");
+    const dir = join9(process.cwd(), ".prim");
     if (!existsSync8(dir)) {
       mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
     }
-    const file = join8(process.cwd(), WORKSPACE_FILE);
+    const file = join9(process.cwd(), WORKSPACE_FILE);
     writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
       mode: FILE_MODE
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
   moves.command("drop").description("Remove the .prim/workspace.json binding from the cwd").action(() => {
-    const file = join8(process.cwd(), WORKSPACE_FILE);
+    const file = join9(process.cwd(), WORKSPACE_FILE);
     if (!existsSync8(file)) {
       console.log("[prim] no workspace binding in cwd");
       return;
@@ -5047,7 +5227,7 @@ import {
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var DIR_MODE2 = 448;
 var FILE_MODE2 = 384;
 function ensureDir() {
@@ -5056,7 +5236,7 @@ function ensureDir() {
   }
 }
 function markerPath(sessionId) {
-  return join9(SESSIONS_DIR, `${sessionId}.json`);
+  return join10(SESSIONS_DIR, `${sessionId}.json`);
 }
 function registerSessionCommands(program2) {
   const session = program2.command("session").description("Decision Event Pipeline \u2014 session binding markers");
@@ -5084,7 +5264,7 @@ function registerSessionCommands(program2) {
     for (const f of files) {
       const sessionId = f.replace(/\.json$/, "");
       try {
-        const m = JSON.parse(readFileSync7(join9(SESSIONS_DIR, f), "utf-8"));
+        const m = JSON.parse(readFileSync7(join10(SESSIONS_DIR, f), "utf-8"));
         console.log(`${sessionId}  org=${m.orgId}`);
       } catch {
       }
@@ -5104,7 +5284,7 @@ function registerSessionCommands(program2) {
 // src/commands/setup.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
 var SESSION_LABELS = {
@@ -5130,12 +5310,6 @@ function planSetupSteps(opts) {
       args: ["daemon", "start"],
       required: true
     });
-    steps.push({
-      key: "health",
-      label: "Capture health",
-      args: ["doctor"],
-      required: true
-    });
   } else {
     steps.push({
       key: "daemon-opt-out",
@@ -5154,10 +5328,18 @@ function planSetupSteps(opts) {
   steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
   steps.push({
     key: "enable",
-    label: "Bind and activate this repo",
+    label: "Activate this repo",
     args: ["enable"],
     required: true
   });
+  if (opts.daemon) {
+    steps.push({
+      key: "health",
+      label: "Capture health",
+      args: ["doctor"],
+      required: true
+    });
+  }
   return steps;
 }
 var CONFLICT_SESSION = "session";
@@ -5183,7 +5365,7 @@ function detectProjectConflicts(agent, run) {
   }
   try {
     const root = gitToplevel();
-    const preCommit = root && join10(root, ".git", "hooks", "pre-commit");
+    const preCommit = root && join11(root, ".git", "hooks", "pre-commit");
     if (preCommit && existsSync10(preCommit) && readFileSync8(preCommit, "utf-8").includes("prim-pre-commit")) {
       conflicts.push(CONFLICT_HOOKS);
     }
@@ -5295,7 +5477,10 @@ function registerSetupCommand(program2, dependencies = {}) {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
     }
-    for (const step of planSetupSteps({ agent, daemon: opts.daemon, scope })) {
+    const setupSteps = planSetupSteps({ agent, daemon: opts.daemon, scope });
+    for (const step of setupSteps.filter(
+      (candidate) => candidate.key !== "enable" && candidate.key !== "health"
+    )) {
       note(`${step.label} \xB7 installing\u2026`);
       const { code } = run(step.args);
       results[step.key] = code === 0 ? "ok" : step.required ? "failed" : "skipped";
@@ -5312,6 +5497,18 @@ function registerSetupCommand(program2, dependencies = {}) {
         );
       }
     }
+    const enableStep = setupSteps.find((candidate) => candidate.key === "enable");
+    if (enableStep) {
+      note(`${enableStep.label} \xB7 installing\u2026`);
+      const { code } = run(enableStep.args);
+      results[enableStep.key] = code === 0 ? "ok" : enableStep.required ? "failed" : "skipped";
+    }
+    const healthStep = setupSteps.find((candidate) => candidate.key === "health");
+    if (healthStep) {
+      note(`${healthStep.label} \xB7 verifying\u2026`);
+      const { code } = run(healthStep.args);
+      results[healthStep.key] = code === 0 ? "ok" : healthStep.required ? "failed" : "skipped";
+    }
     note("welcome");
     results.welcome = run(["welcome", "--agent", agent]).code === 0 ? "ok" : "failed";
     const failed = Object.entries(results).filter(([, v]) => v === "failed").map(([k]) => k);
@@ -5327,14 +5524,55 @@ function registerSetupCommand(program2, dependencies = {}) {
 import { readFileSync as readFileSync9 } from "fs";
 import { dirname as dirname6, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
-var STATUSLINE_TIMEOUT_MS = 200;
+
+// src/lib/statusline-render.ts
 var STATUSLINE_NAME_CAP = 3;
+function formatStatusline(version, snapshot, resolveIngestionStatus) {
+  if (!snapshot) {
+    return `primitive ${version} (daemon: down)`;
+  }
+  if (snapshot.healthy === false) {
+    if (snapshot.needsReauth) {
+      return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`)`;
+    }
+    if (snapshot.ingestion?.healthy === false) {
+      const pending = snapshot.ingestion.pendingCount;
+      const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
+      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""})`;
+    }
+    if (snapshot.heartbeat?.healthy === false) {
+      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable)`;
+    }
+    return `primitive ${version} (daemon: starting)`;
+  }
+  const ingestionStatus = resolveIngestionStatus();
+  if (snapshot.envMismatch) {
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: other env)`;
+  }
+  if (snapshot.presenceStale) {
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: stale)`;
+  }
+  let team;
+  if (snapshot.onlineTeammates !== void 0) {
+    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP)}`;
+  } else if (snapshot.onlineNames !== void 0) {
+    team = `team: ${formatTeammates(snapshot.onlineNames, STATUSLINE_NAME_CAP)}`;
+  } else if (typeof snapshot.onlineCount === "number") {
+    team = `team: ${String(snapshot.onlineCount)} online`;
+  } else {
+    team = "team: \u2014";
+  }
+  return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 ${team})`;
+}
+
+// src/commands/statusline.ts
+var STATUSLINE_TIMEOUT_MS = 200;
 function readPackageVersion() {
   try {
     const here = dirname6(fileURLToPath(import.meta.url));
     const candidates = [
-      // The supervised runtime stages a tiny manifest beside the standalone
-      // statusline bundle, so it remains versioned without loading the package.
+      // Schema-v2 runtimes staged a manifest beside this standalone bundle.
+      // Keep resolving it while those legacy launchers transition to schema v3.
       resolve3(here, "manifest.json"),
       resolve3(here, "../../package.json"),
       resolve3(here, "../package.json")
@@ -5369,40 +5607,8 @@ async function renderStatusline() {
   );
   if (!snapshot) {
     debug("daemon snapshot missing");
-    return `primitive ${version} (daemon: down)`;
-  }
-  if (snapshot.healthy === false) {
-    if (snapshot.needsReauth) {
-      return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`)`;
-    }
-    if (snapshot.ingestion?.healthy === false) {
-      const pending = snapshot.ingestion.pendingCount;
-      const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
-      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""})`;
-    }
-    if (snapshot.heartbeat?.healthy === false) {
-      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable)`;
-    }
-    return `primitive ${version} (daemon: starting)`;
-  }
-  const ingestionStatus = decisionIngestionStatus(process.cwd());
-  if (snapshot.envMismatch) {
-    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: other env)`;
-  }
-  if (snapshot.presenceStale) {
-    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: stale)`;
   }
-  let team;
-  if (snapshot.onlineTeammates !== void 0) {
-    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP)}`;
-  } else if (snapshot.onlineNames !== void 0) {
-    team = `team: ${formatTeammates(snapshot.onlineNames, STATUSLINE_NAME_CAP)}`;
-  } else if (typeof snapshot.onlineCount === "number") {
-    team = `team: ${String(snapshot.onlineCount)} online`;
-  } else {
-    team = "team: \u2014";
-  }
-  return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 ${team})`;
+  return formatStatusline(version, snapshot, () => decisionIngestionStatus(process.cwd()));
 }
 function registerStatuslineCommands(program2) {
   program2.command("statusline").description("Render the Claude Code statusLine for the prim companion daemon").action(async () => {