@primitive.ai/prim 0.1.0-alpha.63 → 0.1.0-alpha.65

package/README.md

@@ -71,12 +71,13 @@ so the agent runs it directly — instead of fetching a doc and executing a comm
 it, which an auto-mode safety classifier blocks as untrusted-origin code:
 
 ```text
-Install the Primitive CLI: run `npx --yes @primitive.ai/prim@latest setup` and surface its output. It's an agent-first CLI — drive it yourself, don't hand the command back to me. The only thing I'll do is click "Authorize" in the browser if it asks. When it finishes, show me the welcome.
+Install the Primitive CLI and activate passive decision capture for this repository: run `npx --yes @primitive.ai/prim@latest setup` and surface its output. Drive it yourself; I'll only click Authorize in the browser. This request authorizes setup's built-in activation of this repository and an idempotent retry of that step, but not activation in another repository or creation of a Decision. If enable or health fails, surface the actual error; do not claim fresh activation approval is required. Then show me the welcome.
 ```
 
-That single command runs the whole install in one process (auth → session hooks →
-daemon → git hooks → skill → welcome). The detailed step-by-step the agent follows —
-and the manual fallback — live in [`setup.md`](./setup.md).
+That single command runs the whole install and current-repository activation in one
+process (auth → session hooks → daemon → git hooks → skill → welcome). The detailed
+step-by-step the agent follows — and the manual fallback — live in
+[`setup.md`](./setup.md).
 
 ## Commands
 

package/dist/{chunk-QGVHLP5J.js → chunk-5CKL5EYQ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-UVIWZWM6.js";
 import {
   isValidRepoSyncId
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 
 // src/hooks/prim-hook-core.ts
 import { createHash, randomUUID } from "crypto";
@@ -15,15 +15,61 @@ var AGENT_ENVELOPE_VERSION = 3;
 var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
 
 // src/hooks/prim-hook-core.ts
+var CORRELATED_TOOL_EVENTS = /* @__PURE__ */ new Set([
+  "PostToolUse",
+  "PostToolUseFailure",
+  "post_tool_call",
+  "post_approval_response"
+]);
 function postToolInvocationId(parsed, agent) {
-  if (parsed.hook_event_name !== "PostToolUse") return void 0;
+  if (typeof parsed.hook_event_name !== "string" || !CORRELATED_TOOL_EVENTS.has(parsed.hook_event_name)) {
+    return void 0;
+  }
   const raw = agent === "hermes" ? parsed.extra?.tool_call_id : parsed.tool_use_id;
   return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
+function lowerString(value) {
+  return typeof value === "string" ? value.toLowerCase() : void 0;
+}
+function toolOutcomeFor(parsed, agent) {
+  const event = parsed.hook_event_name;
+  if (agent === "claude_code") {
+    if (event === "PostToolUseFailure") {
+      return parsed.is_interrupt === true ? "interrupted" : "failed";
+    }
+    return event === "PostToolUse" ? "succeeded" : void 0;
+  }
+  if (agent === "codex") {
+    return event === "PostToolUse" ? "returned" : void 0;
+  }
+  const extra = parsed.extra;
+  if (event === "post_approval_response") {
+    const choice = lowerString(extra?.choice);
+    return (choice === "deny" || choice === "smart_deny" || choice === "timeout") && postToolInvocationId(parsed, agent) ? "prevented" : void 0;
+  }
+  if (event !== "PostToolUse" && event !== "post_tool_call") {
+    return void 0;
+  }
+  const status = lowerString(extra?.status);
+  if (status === "ok" || status === "success") {
+    return "succeeded";
+  }
+  if (status === "error" || status === "timeout") {
+    return "failed";
+  }
+  if (status === "cancelled") {
+    return "interrupted";
+  }
+  if (status === "blocked") {
+    return "prevented";
+  }
+  return "unknown";
+}
 function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, repository, invocationId) {
   const sessionId = parsed.session_id ?? "";
   const eventType = parsed.hook_event_name ?? "unknown";
-  const moveId = eventType === "PostToolUse" && sessionId && invocationId ? `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}` : randomUUID();
+  const toolOutcome = toolOutcomeFor(parsed, agent);
+  const moveId = CORRELATED_TOOL_EVENTS.has(eventType) && sessionId && invocationId ? `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}` : randomUUID();
   return {
     moveId,
     capturedAt: Date.now(),
@@ -45,7 +91,8 @@ function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, reposito
     },
     envelopeVersion: AGENT_ENVELOPE_VERSION,
     producer: agent,
-    ...invocationId ? { invocationId } : {}
+    ...invocationId ? { invocationId } : {},
+    ...toolOutcome ? { toolOutcome } : {}
   };
 }
 var MAX_CLASSIFIER_ID_CHARS = 256;
@@ -63,17 +110,18 @@ function commitAttributionFromEnvironment(env, workspaceId) {
   return candidates.length === 1 ? candidates[0] : void 0;
 }
 function toCommitMove(commit, cliVersion, cwd, context = {}) {
-  const { repository, repoFullName, repoSyncId, workspaceId, attribution } = context;
+  const { repository, repoFullName, repoSyncId, workspaceId, attribution, capturedAt } = context;
   const validatedRepoSyncId = isValidRepoSyncId(repoSyncId) ? repoSyncId : void 0;
   const validatedWorkspaceId = workspaceId && isCanonicalWorkspaceId(workspaceId) ? workspaceId : void 0;
   const validatedAttribution = validatedWorkspaceId ? attribution : void 0;
+  const validatedCapturedAt = typeof capturedAt === "number" && Number.isSafeInteger(capturedAt) && capturedAt > 0 ? capturedAt : Date.now();
   const fullSha = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(commit.sha);
   const moveId = validatedRepoSyncId && validatedWorkspaceId && fullSha ? `commit:v2:${createHash("sha256").update(
     JSON.stringify(["commit:v2", validatedRepoSyncId, validatedWorkspaceId, commit.sha])
   ).digest("hex")}` : `commit:v2:unscoped:${randomUUID()}`;
   const base = {
     moveId,
-    capturedAt: Date.now(),
+    capturedAt: validatedCapturedAt,
     sessionId: validatedAttribution?.sessionId ?? "",
     eventType: "git.commit",
     payload: {
@@ -110,6 +158,7 @@ function shouldFlushAfter(eventType) {
 
 export {
   postToolInvocationId,
+  toolOutcomeFor,
   toMove,
   commitAttributionFromEnvironment,
   toCommitMove,

package/dist/{chunk-DA4BMHEB.js → chunk-BDGQEJA5.js}

@@ -1,10 +1,10 @@
 import {
   analyzeShellTargets,
   extractFileTargets
-} from "./chunk-GF5QII7T.js";
+} from "./chunk-G5D3FF3D.js";
 import {
   canonicalRepositoryPath
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 
 // src/hooks/file-refs.ts
 var MAX_PREFLIGHT_FILE_TARGETS = 25;
@@ -26,7 +26,7 @@ function preserveHookFileMetadata(payload, resolution) {
   return { ...payload, primitive };
 }
 function resolveHookFileRefs(args) {
-  const command = args.agent === "claude_code" && args.toolName === "Bash" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.command === "string" ? args.toolInput.command : void 0;
+  const command = (args.agent === "claude_code" || args.agent === "codex") && args.toolName === "Bash" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.command === "string" ? args.toolInput.command : void 0;
   const shell = command === void 0 ? void 0 : analyzeShellTargets(command);
   const shellMutation = shell?.mutation === "none" ? "none" : shell?.coverage === "complete" ? "resolved" : shell ? "unresolved" : void 0;
   const readPath = args.agent === "claude_code" && args.toolName === "Read" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.file_path === "string" ? [args.toolInput.file_path] : void 0;

package/dist/{chunk-WNIY6Z6N.js → chunk-CPHJUQNE.js}

@@ -1,10 +1,12 @@
 import {
+  clearRepoSyncId,
   gitToplevel,
   githubRepositoryFullName,
   isValidRepoSyncId,
   setRepoSyncId
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 import {
+  HttpError,
   getClient,
   withFileLock
 } from "./chunk-CPX3BUOC.js";
@@ -649,6 +651,7 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   case "$prim_commit_sha" in *[!0-9a-f]*|"") prim_commit_sha= ;; esac
   case "\${#prim_commit_sha}" in 40|64) ;; *) prim_commit_sha= ;; esac
   if [ -n "$prim_commit_sha" ]; then
+    prim_commit_observed_file=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_commit_observed_file=
     prim_commit_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_commit_branch=
     prim_cache_dir="\${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin"
     prim_post_commit_ran=0
@@ -656,18 +659,23 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
       prim_node=$(cat "$prim_cache_dir/node")
       prim_entry=$(cat "$prim_cache_dir/prim-post-commit")
       if [ -x "$prim_node" ] && [ -f "$prim_entry" ]; then
-        ( trap '' HUP; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch"; "$prim_node" "$prim_entry" ) </dev/null >/dev/null 2>&1 &
+        ( trap '' HUP; trap 'if [ -n "$prim_commit_observed_file" ]; then rm -f "$prim_commit_observed_file"; fi' 0; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch" PRIM_COMMIT_OBSERVED_FILE="$prim_commit_observed_file"; "$prim_node" "$prim_entry" ) </dev/null >/dev/null 2>&1 &
         prim_post_commit_ran=1
       fi
     fi
     if [ "$prim_post_commit_ran" -eq 0 ]; then
       if [ -x "./node_modules/.bin/prim-post-commit" ]; then
-        ( trap '' HUP; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch"; ./node_modules/.bin/prim-post-commit ) </dev/null >/dev/null 2>&1 &
+        ( trap '' HUP; trap 'if [ -n "$prim_commit_observed_file" ]; then rm -f "$prim_commit_observed_file"; fi' 0; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch" PRIM_COMMIT_OBSERVED_FILE="$prim_commit_observed_file"; ./node_modules/.bin/prim-post-commit ) </dev/null >/dev/null 2>&1 &
+        prim_post_commit_ran=1
       elif command -v npx >/dev/null 2>&1; then
-        ( trap '' HUP; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch"; npx --yes -p @primitive.ai/prim@latest prim-post-commit ) </dev/null >/dev/null 2>&1 &
+        ( trap '' HUP; trap 'if [ -n "$prim_commit_observed_file" ]; then rm -f "$prim_commit_observed_file"; fi' 0; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch" PRIM_COMMIT_OBSERVED_FILE="$prim_commit_observed_file"; npx --yes -p @primitive.ai/prim@latest prim-post-commit ) </dev/null >/dev/null 2>&1 &
+        prim_post_commit_ran=1
       fi
     fi
-    unset prim_cache_dir prim_post_commit_ran prim_node prim_entry prim_commit_branch
+    if [ "$prim_post_commit_ran" -eq 0 ] && [ -n "$prim_commit_observed_file" ]; then
+      rm -f "$prim_commit_observed_file"
+    fi
+    unset prim_cache_dir prim_post_commit_ran prim_node prim_entry prim_commit_branch prim_commit_observed_file
   fi
   unset prim_commit_sha
 fi
@@ -1211,21 +1219,37 @@ function uninstallPostCommitHookAtPath(hookPath) {
 }
 
 // src/lib/repository-binding.ts
-async function bindRepository(root, options) {
+async function resolveRepositoryBinding(root, options) {
   const repositoryFullName = githubRepositoryFullName(root);
   if (!repositoryFullName) {
     throw new Error("origin must be a GitHub HTTPS/SSH remote in owner/name form");
   }
-  const response = await getClient().post(
-    "/api/cli/repositories/bind",
-    { repositoryFullName },
-    options
-  );
+  let response;
+  try {
+    response = await getClient().post(
+      "/api/cli/repositories/bind",
+      { repositoryFullName },
+      options
+    );
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404) {
+      return { status: "pending", repositoryFullName };
+    }
+    throw error;
+  }
   if (!isValidRepoSyncId(response.repoSyncId)) {
     throw new Error("server returned no repository binding");
   }
-  setRepoSyncId(root, response.repoSyncId);
-  return { repoSyncId: response.repoSyncId, repositoryFullName };
+  return { status: "connected", repoSyncId: response.repoSyncId, repositoryFullName };
+}
+async function bindRepository(root, options) {
+  const binding = await resolveRepositoryBinding(root, options);
+  if (binding.status === "connected") {
+    setRepoSyncId(root, binding.repoSyncId);
+  } else {
+    clearRepoSyncId(root);
+  }
+  return binding;
 }
 
 export {
@@ -1235,6 +1259,7 @@ export {
   inspectEffectivePostCommitHook,
   uninstallProjectPostCommitHook,
   uninstallPostCommitHookAtPath,
+  resolveRepositoryBinding,
   bindRepository,
   printJson,
   compareSemver,