@primitive.ai/prim 0.1.0-alpha.63 → 0.1.0-alpha.65

package/dist/{chunk-KBFFVYBC.js → chunk-LNU44OJV.js}

@@ -1,8 +1,3 @@
-// src/lib/bin-cache.ts
-import { chmodSync, mkdirSync, renameSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
-
 // src/lib/bin-path.ts
 import { existsSync, readFileSync } from "fs";
 import { dirname, isAbsolute, join } from "path";
@@ -76,6 +71,9 @@ function commandMatchesBin(command, bin) {
 }
 
 // src/lib/bin-cache.ts
+import { chmodSync, mkdirSync, renameSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
 var CACHED_BINS = [
   "prim",
   "prim-hook",

package/dist/{chunk-XTNMSS4C.js → chunk-TDRXHBEX.js}

@@ -241,6 +241,20 @@ function setRepoSyncId(cwd, value) {
     timeout: GIT_TIMEOUT_MS2
   });
 }
+function clearRepoSyncId(cwd) {
+  try {
+    execFileSync2("git", ["config", "--local", "--unset-all", PRIM_REPO_SYNC_ID_KEY], {
+      cwd,
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS2
+    });
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "status" in error && error.status === 5) {
+      return;
+    }
+    throw error;
+  }
+}
 function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
   if (root === null || root === homedir()) return false;
@@ -278,6 +292,7 @@ export {
   isValidRepoSyncId,
   repoSyncId,
   setRepoSyncId,
+  clearRepoSyncId,
   isRepoActiveForCapture,
   decisionIngestionStatus
 };

package/dist/hooks/post-commit.js

@@ -2,7 +2,7 @@
 import {
   commitAttributionFromEnvironment,
   toCommitMove
-} from "../chunk-QGVHLP5J.js";
+} from "../chunk-5CKL5EYQ.js";
 import {
   appendMove,
   resolveOrg
@@ -15,17 +15,35 @@ import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import "../chunk-CPX3BUOC.js";
 
 // src/hooks/post-commit.ts
 import { execFileSync, spawn } from "child_process";
-import { readFileSync } from "fs";
-import { dirname, join } from "path";
+import { lstatSync, readFileSync } from "fs";
+import { basename, dirname, isAbsolute, join } from "path";
 import { fileURLToPath } from "url";
 var here = dirname(fileURLToPath(import.meta.url));
 var GIT_TIMEOUT_MS = 1e3;
 var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+var OBSERVATION_MARKER_RE = /^prim-post-commit-observed\.[A-Za-z0-9]+$/u;
+var MAX_OBSERVATION_MARKER_AGE_MS = 10 * 60 * 1e3;
+var MAX_OBSERVATION_MARKER_FUTURE_SKEW_MS = 5e3;
+function capturedAtFromLauncher(env = process.env, now = Date.now()) {
+  const path = env.PRIM_COMMIT_OBSERVED_FILE;
+  if (!path || !isAbsolute(path) || !OBSERVATION_MARKER_RE.test(basename(path))) return;
+  try {
+    const stat = lstatSync(path);
+    const capturedAt = Math.trunc(stat.mtimeMs);
+    const uid = process.getuid?.();
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== 0 || stat.nlink !== 1 || (stat.mode & 63) !== 0 || uid !== void 0 && stat.uid !== uid || !Number.isSafeInteger(capturedAt) || capturedAt <= 0 || capturedAt < now - MAX_OBSERVATION_MARKER_AGE_MS || capturedAt > now + MAX_OBSERVATION_MARKER_FUTURE_SKEW_MS) {
+      return;
+    }
+    return capturedAt;
+  } catch {
+    return;
+  }
+}
 function gitText(args) {
   try {
     return execFileSync("git", args, {
@@ -117,6 +135,10 @@ function runPostCommit() {
   if (!isRepoActiveForCapture(cwd)) {
     return;
   }
+  const capturedAt = capturedAtFromLauncher();
+  if (process.env.PRIM_COMMIT_OBSERVED_FILE !== void 0 && capturedAt === void 0) {
+    return;
+  }
   const commit = readCommit();
   if (commit) {
     const repository = resolveRepositoryContext(cwd);
@@ -128,7 +150,8 @@ function runPostCommit() {
       repoFullName: githubRepositoryFullName(cwd) ?? void 0,
       repoSyncId: repoSyncId(cwd),
       workspaceId,
-      attribution
+      attribution,
+      ...capturedAt === void 0 ? {} : { capturedAt }
     });
     const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd });
     appendMove(move, orgId);
@@ -148,5 +171,6 @@ if (!process.env.VITEST) {
   process.exit(0);
 }
 export {
+  capturedAtFromLauncher,
   runPostCommit
 };

package/dist/hooks/post-tool-use.js

@@ -7,29 +7,30 @@ import {
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
-} from "../chunk-DA4BMHEB.js";
+} from "../chunk-BDGQEJA5.js";
 import {
   postToolInvocationId,
-  toMove
-} from "../chunk-QGVHLP5J.js";
+  toMove,
+  toolOutcomeFor
+} from "../chunk-5CKL5EYQ.js";
 import {
   appendMove,
   resolveOrg
 } from "../chunk-HIMWM526.js";
 import {
   scrubFromCwd
-} from "../chunk-GF5QII7T.js";
+} from "../chunk-G5D3FF3D.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
 import {
   warmBinCache
-} from "../chunk-KBFFVYBC.js";
+} from "../chunk-LNU44OJV.js";
 import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import {
   getClient
 } from "../chunk-CPX3BUOC.js";
@@ -74,7 +75,7 @@ function isVerdictFooterContext(value) {
 // src/hooks/post-tool-use.ts
 var STDIN_TIMEOUT_MS = 1e3;
 var EDITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"]);
-var CODEX_EDITING_TOOLS = /* @__PURE__ */ new Set(["apply_patch"]);
+var CODEX_EDITING_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "Bash"]);
 var HERMES_EDITING_TOOLS = /* @__PURE__ */ new Set(["write_file", "patch"]);
 function editingToolsFor(agent) {
   if (agent === "codex") {
@@ -137,17 +138,27 @@ async function main() {
     emit();
     return;
   }
-  const envelope = parsed;
-  if (envelope.hook_event_name !== "PostToolUse") {
+  let envelope = parsed;
+  const isToolResult = envelope.hook_event_name === "PostToolUse" || agent === "claude_code" && envelope.hook_event_name === "PostToolUseFailure";
+  const isHermesDenial = agent === "hermes" && envelope.hook_event_name === "post_approval_response" && toolOutcomeFor(parsed, agent) === "prevented";
+  if (!isToolResult && !isHermesDenial) {
+    emit();
+    return;
+  }
+  const invocationId = postToolInvocationId(parsed, agent);
+  if (isHermesDenial && !invocationId) {
     emit();
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
-  const editingTools = editingToolsFor(agent);
-  if (!editingTools.has(toolName)) {
+  if (!isHermesDenial && !editingToolsFor(agent).has(toolName)) {
     emit();
     return;
   }
+  if (isHermesDenial && (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) && typeof envelope.extra?.session_key === "string" && envelope.extra.session_key.length > 0) {
+    parsed = { ...parsed, session_id: envelope.extra.session_key };
+    envelope = parsed;
+  }
   if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) {
     emit();
     return;
@@ -170,18 +181,19 @@ async function main() {
     repository
   });
   const { resolution } = enrichment;
-  if (resolution.shellMutation === "none") {
-    emit();
-    return;
-  }
-  if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
-    emit();
-    return;
+  if (!isHermesDenial) {
+    if (resolution.shellMutation === "none") {
+      emit();
+      return;
+    }
+    if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
+      emit();
+      return;
+    }
   }
   const enriched = enrichment.parsed;
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
-  const invocationId = postToolInvocationId(enriched, agent);
   const base = toMove(enriched, resolveCliVersion(), agent, workspaceId, repository, invocationId);
   const scrubbed = scrubFromCwd(enriched, cwd);
   const move = {

package/dist/hooks/pre-tool-use.js

@@ -12,16 +12,17 @@ import {
   failOpenOutput,
   readHookMode,
   scrub
-} from "../chunk-GF5QII7T.js";
+} from "../chunk-G5D3FF3D.js";
 import {
+  packageVersion,
   warmBinCache
-} from "../chunk-KBFFVYBC.js";
+} from "../chunk-LNU44OJV.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
   isRepoActive,
   repoSyncId
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import {
   getClient
 } from "../chunk-CPX3BUOC.js";
@@ -36,6 +37,11 @@ var PREFLIGHT_PROTOCOL_VERSION = 3;
 var PREFLIGHT_TIMEOUT_MS = 6500;
 var MAX_PREFLIGHT_PATHS = 32;
 var MAX_PROPOSAL_BYTES = 6144;
+var MAX_CLIENT_VERSION_CHARS = 32;
+var CLIENT_VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+function boundedClientVersion(raw) {
+  return typeof raw === "string" && raw.length <= MAX_CLIENT_VERSION_CHARS && CLIENT_VERSION_RE.test(raw) ? raw : "unknown";
+}
 function resolvePreflightTargets(args) {
   let rawPaths;
   let coverage = "complete";
@@ -224,6 +230,8 @@ async function main() {
   const request = {
     protocolVersion: PREFLIGHT_PROTOCOL_VERSION,
     agent,
+    clientMode: mode,
+    clientVersion: boundedClientVersion(packageVersion()),
     sessionId,
     invocationId: callId,
     repoSyncId: binding,

package/dist/hooks/prim-hook.js

@@ -2,19 +2,19 @@
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
-} from "../chunk-DA4BMHEB.js";
+} from "../chunk-BDGQEJA5.js";
 import {
   postToolInvocationId,
   shouldFlushAfter,
   toMove
-} from "../chunk-QGVHLP5J.js";
+} from "../chunk-5CKL5EYQ.js";
 import {
   appendMove,
   resolveOrg
 } from "../chunk-HIMWM526.js";
 import {
   scrubFromCwd
-} from "../chunk-GF5QII7T.js";
+} from "../chunk-G5D3FF3D.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -30,12 +30,12 @@ import {
 } from "../chunk-UVIWZWM6.js";
 import {
   warmBinCache
-} from "../chunk-KBFFVYBC.js";
+} from "../chunk-LNU44OJV.js";
 import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import "../chunk-CPX3BUOC.js";
 import {
   normalizeEnvelope,

package/dist/hooks/session-start.js

@@ -4,7 +4,7 @@ import {
   ensureEffectivePostCommitHook,
   hasUsableCodexGuidance,
   refreshClaudePlugins
-} from "../chunk-WNIY6Z6N.js";
+} from "../chunk-CPHJUQNE.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -21,14 +21,13 @@ import {
 import {
   binFile,
   warmBinCache
-} from "../chunk-KBFFVYBC.js";
+} from "../chunk-LNU44OJV.js";
 import {
   gitToplevel,
   isRepoActiveForCapture,
   repoActiveFlag,
-  repoSyncId,
   setRepoActive
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import {
   getSiteUrl,
   isSessionEnded
@@ -102,14 +101,12 @@ async function activeProjectRoot(cwd) {
       } catch {
       }
     }
-    if (!repoSyncId(root)) {
-      try {
-        await bindRepository(root, {
-          signal: AbortSignal.timeout(REPOSITORY_BIND_TIMEOUT_MS),
-          quietRefresh: true
-        });
-      } catch {
-      }
+    try {
+      await bindRepository(root, {
+        signal: AbortSignal.timeout(REPOSITORY_BIND_TIMEOUT_MS),
+        quietRefresh: true
+      });
+    } catch {
     }
     return root;
   } catch {

package/dist/index.js

@@ -32,9 +32,10 @@ import {
   postCommitHookBlock,
   printJson,
   registerSkillCommands,
+  resolveRepositoryBinding,
   uninstallPostCommitHookAtPath,
   uninstallProjectPostCommitHook
-} from "./chunk-WNIY6Z6N.js";
+} from "./chunk-CPHJUQNE.js";
 import {
   fetchFeedbackCapability
 } from "./chunk-KHZNYEUV.js";
@@ -48,7 +49,7 @@ import {
   packageVersion,
   pinnedHookCommand,
   warmBinCache
-} from "./chunk-KBFFVYBC.js";
+} from "./chunk-LNU44OJV.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
@@ -58,7 +59,7 @@ import {
   isValidRepoSyncId,
   repoSyncId,
   setRepoActive
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -96,22 +97,48 @@ async function applyActivation(active) {
     );
     process.exit(1);
   }
+  let phase = active ? "post-commit hook coverage" : "local deactivation";
   try {
-    let bound;
+    let binding;
     let postCommitHook;
     if (active) {
       postCommitHook = ensureEffectivePostCommitHook(root).path;
-      bound = await bindRepository(root);
+      phase = "repository binding";
+      binding = await bindRepository(root);
+      phase = "local activation";
     }
     setRepoActive(root, active);
     await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
-    process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+    if (binding?.status === "pending") {
+      process.stderr.write(`[prim] Prim is enabled locally in ${root}
 `);
-    printJson({ active, repo: root, ...bound, ...postCommitHook ? { postCommitHook } : {} });
+      process.stderr.write(
+        `[prim] repository ${binding.repositoryFullName} is not connected to Primitive; Moves still ingest into the team graph without repository-specific file attribution, Conflict Gate verification, or commit correlation
+`
+      );
+      process.stderr.write(
+        `[prim] ask an organization owner or administrator to grant Primitive's GitHub App access to this repository through Primitive's GitHub App onboarding; binding retries automatically at the next agent SessionStart
+`
+      );
+    } else {
+      process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+    }
+    printJson({
+      active,
+      repo: root,
+      ...binding ? {
+        bindingStatus: binding.status,
+        repositoryFullName: binding.repositoryFullName,
+        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
+      } : {},
+      ...postCommitHook ? { postCommitHook } : {}
+    });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `[prim] failed to ${active ? "cover, bind, and enable" : "disable"} prim: ${detail}
+      active ? `[prim] failed to enable prim during ${phase}: ${detail}
+` : `[prim] failed to disable prim: ${detail}
 `
     );
     process.exit(1);
@@ -1473,6 +1500,7 @@ var CAPTURE_EVENTS = [
   "UserPromptSubmit",
   "PreToolUse",
   "PostToolUse",
+  "PostToolUseFailure",
   "Stop",
   "SessionEnd",
   "SubagentStop"
@@ -1494,6 +1522,11 @@ var REGISTRATIONS = [
   ),
   makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
   makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
+  makeRegistration(
+    "PostToolUseFailure",
+    "Edit|Write|MultiEdit|NotebookEdit|Bash",
+    POST_TOOL_USE_BIN
+  ),
   makeRegistration("SessionStart", "*", SESSION_START_BIN),
   makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
 ];
@@ -1875,6 +1908,8 @@ var GATE_BIN2 = "prim-pre-tool-use";
 var POST_TOOL_USE_BIN2 = "prim-post-tool-use";
 var SESSION_START_BIN2 = "prim-session-start";
 var CODEX_ARGS = "--agent codex";
+var CODEX_EDIT_MATCHER = "apply_patch";
+var CODEX_POST_TOOL_MATCHER = "apply_patch|Bash";
 var JSON_INDENT2 = 2;
 var CODEX_CAPTURE_EVENTS = [
   "SessionStart",
@@ -1887,8 +1922,8 @@ var CODEX_CAPTURE_EVENTS = [
 var PRIM_BINS2 = [CAPTURE_BIN2, GATE_BIN2, POST_TOOL_USE_BIN2, SESSION_START_BIN2];
 var CODEX_REGISTRATIONS = [
   ...CODEX_CAPTURE_EVENTS.map((event) => makeRegistration(event, "*", CAPTURE_BIN2, CODEX_ARGS)),
-  makeRegistration("PreToolUse", "apply_patch", GATE_BIN2, CODEX_ARGS),
-  makeRegistration("PostToolUse", "apply_patch", POST_TOOL_USE_BIN2, CODEX_ARGS),
+  makeRegistration("PreToolUse", CODEX_EDIT_MATCHER, GATE_BIN2, CODEX_ARGS),
+  makeRegistration("PostToolUse", CODEX_POST_TOOL_MATCHER, POST_TOOL_USE_BIN2, CODEX_ARGS),
   makeRegistration("SessionStart", "*", SESSION_START_BIN2, CODEX_ARGS)
 ];
 var USER_SCOPE_PATH2 = join3(homedir3(), ".codex", "hooks.json");
@@ -3908,19 +3943,66 @@ function checkWorkspaceIdentity() {
       };
   }
 }
-function classifyRepositoryBinding(value) {
-  return isValidRepoSyncId(value) ? {
+function classifyRepositoryBinding(value, current, active) {
+  if (current.status === "pending") {
+    if (value !== void 0) {
+      return {
+        name: "repo-binding",
+        status: "fail",
+        detail: `local repository binding is stale for ${current.repositoryFullName} \u2014 run \`prim enable\``
+      };
+    }
+    if (!active) {
+      return {
+        name: "repo-binding",
+        status: "fail",
+        detail: "passive capture is inactive \u2014 run `prim enable`"
+      };
+    }
+    return {
+      name: "repo-binding",
+      status: "warn",
+      detail: `${current.repositoryFullName} is not connected to Primitive \u2014 local capture is active, but file scoping, Conflict Gate verification, and commit correlation are unavailable; ask an organization owner/admin to grant the Primitive GitHub App access (retried automatically next SessionStart)`
+    };
+  }
+  if (!isValidRepoSyncId(value)) {
+    return {
+      name: "repo-binding",
+      status: "fail",
+      detail: "missing or invalid local prim.repoSyncId \u2014 run `prim enable`"
+    };
+  }
+  if (value !== current.repoSyncId) {
+    return {
+      name: "repo-binding",
+      status: "fail",
+      detail: "local repository binding is stale for the current origin \u2014 run `prim enable`"
+    };
+  }
+  return {
     name: "repo-binding",
     status: "ok",
-    detail: "valid local repository binding ready"
-  } : {
-    name: "repo-binding",
-    status: "fail",
-    detail: "missing or invalid local prim.repoSyncId \u2014 run `prim enable`"
+    detail: "local repository binding matches the current server binding"
   };
 }
-function checkRepositoryBinding() {
-  return classifyRepositoryBinding(repoSyncId(process.cwd()));
+async function checkRepositoryBinding() {
+  const root = process.cwd();
+  const local = repoSyncId(root);
+  try {
+    const current = await resolveRepositoryBinding(root, {
+      signal: AbortSignal.timeout(CONNECTIVITY_TIMEOUT_MS),
+      quietRefresh: true
+    });
+    return classifyRepositoryBinding(local, current, isRepoActiveForCapture(root));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const detail = boundedHealthError(`could not verify the current repository binding \u2014 ${message}`) ?? "could not verify the current repository binding";
+    return {
+      name: "repo-binding",
+      status: "fail",
+      detail
+    };
+  }
 }
 function classifyPostCommitHook(inspection) {
   if (inspection.covered) {
@@ -4067,7 +4149,7 @@ async function collectChecks() {
     checkStranded(),
     checkFeedbackHooks(),
     checkWorkspaceIdentity(),
-    checkRepositoryBinding(),
+    await checkRepositoryBinding(),
     checkPostCommitHook(),
     ...backend,
     await checkFeedbackCapability()
@@ -4176,6 +4258,7 @@ var REGISTRATIONS2 = [
   ...CAPTURE_EVENTS2.map((event) => ({ event, bin: CAPTURE_BIN3 })),
   { event: "pre_tool_call", matcher: EDIT_MATCHER, bin: GATE_BIN3, timeout: GATE_TIMEOUT_SECONDS },
   { event: "post_tool_call", matcher: EDIT_MATCHER, bin: POST_TOOL_USE_BIN3 },
+  { event: "post_approval_response", bin: POST_TOOL_USE_BIN3 },
   { event: "on_session_start", bin: SESSION_START_BIN3 },
   { event: "on_session_end", bin: SESSION_END_BIN2 }
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.63",
+  "version": "0.1.0-alpha.65",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",