@primitive.ai/prim 0.1.0-alpha.64 → 0.1.0-alpha.65

package/README.md

@@ -71,12 +71,13 @@ so the agent runs it directly — instead of fetching a doc and executing a comm
 it, which an auto-mode safety classifier blocks as untrusted-origin code:
 
 ```text
-Install the Primitive CLI: run `npx --yes @primitive.ai/prim@latest setup` and surface its output. It's an agent-first CLI — drive it yourself, don't hand the command back to me. The only thing I'll do is click "Authorize" in the browser if it asks. When it finishes, show me the welcome.
+Install the Primitive CLI and activate passive decision capture for this repository: run `npx --yes @primitive.ai/prim@latest setup` and surface its output. Drive it yourself; I'll only click Authorize in the browser. This request authorizes setup's built-in activation of this repository and an idempotent retry of that step, but not activation in another repository or creation of a Decision. If enable or health fails, surface the actual error; do not claim fresh activation approval is required. Then show me the welcome.
 ```
 
-That single command runs the whole install in one process (auth → session hooks →
-daemon → git hooks → skill → welcome). The detailed step-by-step the agent follows —
-and the manual fallback — live in [`setup.md`](./setup.md).
+That single command runs the whole install and current-repository activation in one
+process (auth → session hooks → daemon → git hooks → skill → welcome). The detailed
+step-by-step the agent follows — and the manual fallback — live in
+[`setup.md`](./setup.md).
 
 ## Commands
 

package/dist/{chunk-7X7SFOPJ.js → chunk-5CKL5EYQ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-UVIWZWM6.js";
 import {
   isValidRepoSyncId
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 
 // src/hooks/prim-hook-core.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-VYGY3OOX.js → chunk-BDGQEJA5.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-G5D3FF3D.js";
 import {
   canonicalRepositoryPath
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 
 // src/hooks/file-refs.ts
 var MAX_PREFLIGHT_FILE_TARGETS = 25;

package/dist/{chunk-MCPHIB4W.js → chunk-CPHJUQNE.js}

@@ -1,10 +1,12 @@
 import {
+  clearRepoSyncId,
   gitToplevel,
   githubRepositoryFullName,
   isValidRepoSyncId,
   setRepoSyncId
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 import {
+  HttpError,
   getClient,
   withFileLock
 } from "./chunk-CPX3BUOC.js";
@@ -1222,19 +1224,31 @@ async function resolveRepositoryBinding(root, options) {
   if (!repositoryFullName) {
     throw new Error("origin must be a GitHub HTTPS/SSH remote in owner/name form");
   }
-  const response = await getClient().post(
-    "/api/cli/repositories/bind",
-    { repositoryFullName },
-    options
-  );
+  let response;
+  try {
+    response = await getClient().post(
+      "/api/cli/repositories/bind",
+      { repositoryFullName },
+      options
+    );
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404) {
+      return { status: "pending", repositoryFullName };
+    }
+    throw error;
+  }
   if (!isValidRepoSyncId(response.repoSyncId)) {
     throw new Error("server returned no repository binding");
   }
-  return { repoSyncId: response.repoSyncId, repositoryFullName };
+  return { status: "connected", repoSyncId: response.repoSyncId, repositoryFullName };
 }
 async function bindRepository(root, options) {
   const binding = await resolveRepositoryBinding(root, options);
-  setRepoSyncId(root, binding.repoSyncId);
+  if (binding.status === "connected") {
+    setRepoSyncId(root, binding.repoSyncId);
+  } else {
+    clearRepoSyncId(root);
+  }
   return binding;
 }
 

package/dist/{chunk-XTNMSS4C.js → chunk-TDRXHBEX.js}

@@ -241,6 +241,20 @@ function setRepoSyncId(cwd, value) {
     timeout: GIT_TIMEOUT_MS2
   });
 }
+function clearRepoSyncId(cwd) {
+  try {
+    execFileSync2("git", ["config", "--local", "--unset-all", PRIM_REPO_SYNC_ID_KEY], {
+      cwd,
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: GIT_TIMEOUT_MS2
+    });
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "status" in error && error.status === 5) {
+      return;
+    }
+    throw error;
+  }
+}
 function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
   if (root === null || root === homedir()) return false;
@@ -278,6 +292,7 @@ export {
   isValidRepoSyncId,
   repoSyncId,
   setRepoSyncId,
+  clearRepoSyncId,
   isRepoActiveForCapture,
   decisionIngestionStatus
 };

package/dist/hooks/post-commit.js

@@ -2,7 +2,7 @@
 import {
   commitAttributionFromEnvironment,
   toCommitMove
-} from "../chunk-7X7SFOPJ.js";
+} from "../chunk-5CKL5EYQ.js";
 import {
   appendMove,
   resolveOrg
@@ -15,7 +15,7 @@ import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import "../chunk-CPX3BUOC.js";
 
 // src/hooks/post-commit.ts

package/dist/hooks/post-tool-use.js

@@ -7,12 +7,12 @@ import {
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
-} from "../chunk-VYGY3OOX.js";
+} from "../chunk-BDGQEJA5.js";
 import {
   postToolInvocationId,
   toMove,
   toolOutcomeFor
-} from "../chunk-7X7SFOPJ.js";
+} from "../chunk-5CKL5EYQ.js";
 import {
   appendMove,
   resolveOrg
@@ -30,7 +30,7 @@ import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import {
   getClient
 } from "../chunk-CPX3BUOC.js";

package/dist/hooks/pre-tool-use.js

@@ -22,7 +22,7 @@ import {
   canonicalRepositoryPath,
   isRepoActive,
   repoSyncId
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import {
   getClient
 } from "../chunk-CPX3BUOC.js";

package/dist/hooks/prim-hook.js

@@ -2,12 +2,12 @@
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
-} from "../chunk-VYGY3OOX.js";
+} from "../chunk-BDGQEJA5.js";
 import {
   postToolInvocationId,
   shouldFlushAfter,
   toMove
-} from "../chunk-7X7SFOPJ.js";
+} from "../chunk-5CKL5EYQ.js";
 import {
   appendMove,
   resolveOrg
@@ -35,7 +35,7 @@ import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import "../chunk-CPX3BUOC.js";
 import {
   normalizeEnvelope,

package/dist/hooks/session-start.js

@@ -4,7 +4,7 @@ import {
   ensureEffectivePostCommitHook,
   hasUsableCodexGuidance,
   refreshClaudePlugins
-} from "../chunk-MCPHIB4W.js";
+} from "../chunk-CPHJUQNE.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -27,7 +27,7 @@ import {
   isRepoActiveForCapture,
   repoActiveFlag,
   setRepoActive
-} from "../chunk-XTNMSS4C.js";
+} from "../chunk-TDRXHBEX.js";
 import {
   getSiteUrl,
   isSessionEnded

package/dist/index.js

@@ -35,7 +35,7 @@ import {
   resolveRepositoryBinding,
   uninstallPostCommitHookAtPath,
   uninstallProjectPostCommitHook
-} from "./chunk-MCPHIB4W.js";
+} from "./chunk-CPHJUQNE.js";
 import {
   fetchFeedbackCapability
 } from "./chunk-KHZNYEUV.js";
@@ -59,7 +59,7 @@ import {
   isValidRepoSyncId,
   repoSyncId,
   setRepoActive
-} from "./chunk-XTNMSS4C.js";
+} from "./chunk-TDRXHBEX.js";
 import {
   HttpError,
   REFRESH_TOKEN_PATH,
@@ -97,22 +97,48 @@ async function applyActivation(active) {
     );
     process.exit(1);
   }
+  let phase = active ? "post-commit hook coverage" : "local deactivation";
   try {
-    let bound;
+    let binding;
     let postCommitHook;
     if (active) {
       postCommitHook = ensureEffectivePostCommitHook(root).path;
-      bound = await bindRepository(root);
+      phase = "repository binding";
+      binding = await bindRepository(root);
+      phase = "local activation";
     }
     setRepoActive(root, active);
     await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
-    process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+    if (binding?.status === "pending") {
+      process.stderr.write(`[prim] Prim is enabled locally in ${root}
 `);
-    printJson({ active, repo: root, ...bound, ...postCommitHook ? { postCommitHook } : {} });
+      process.stderr.write(
+        `[prim] repository ${binding.repositoryFullName} is not connected to Primitive; Moves still ingest into the team graph without repository-specific file attribution, Conflict Gate verification, or commit correlation
+`
+      );
+      process.stderr.write(
+        `[prim] ask an organization owner or administrator to grant Primitive's GitHub App access to this repository through Primitive's GitHub App onboarding; binding retries automatically at the next agent SessionStart
+`
+      );
+    } else {
+      process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+    }
+    printJson({
+      active,
+      repo: root,
+      ...binding ? {
+        bindingStatus: binding.status,
+        repositoryFullName: binding.repositoryFullName,
+        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
+      } : {},
+      ...postCommitHook ? { postCommitHook } : {}
+    });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     process.stderr.write(
-      `[prim] failed to ${active ? "cover, bind, and enable" : "disable"} prim: ${detail}
+      active ? `[prim] failed to enable prim during ${phase}: ${detail}
+` : `[prim] failed to disable prim: ${detail}
 `
     );
     process.exit(1);
@@ -3917,7 +3943,28 @@ function checkWorkspaceIdentity() {
       };
   }
 }
-function classifyRepositoryBinding(value, currentServerValue) {
+function classifyRepositoryBinding(value, current, active) {
+  if (current.status === "pending") {
+    if (value !== void 0) {
+      return {
+        name: "repo-binding",
+        status: "fail",
+        detail: `local repository binding is stale for ${current.repositoryFullName} \u2014 run \`prim enable\``
+      };
+    }
+    if (!active) {
+      return {
+        name: "repo-binding",
+        status: "fail",
+        detail: "passive capture is inactive \u2014 run `prim enable`"
+      };
+    }
+    return {
+      name: "repo-binding",
+      status: "warn",
+      detail: `${current.repositoryFullName} is not connected to Primitive \u2014 local capture is active, but file scoping, Conflict Gate verification, and commit correlation are unavailable; ask an organization owner/admin to grant the Primitive GitHub App access (retried automatically next SessionStart)`
+    };
+  }
   if (!isValidRepoSyncId(value)) {
     return {
       name: "repo-binding",
@@ -3925,7 +3972,7 @@ function classifyRepositoryBinding(value, currentServerValue) {
       detail: "missing or invalid local prim.repoSyncId \u2014 run `prim enable`"
     };
   }
-  if (currentServerValue !== void 0 && value !== currentServerValue) {
+  if (value !== current.repoSyncId) {
     return {
       name: "repo-binding",
       status: "fail",
@@ -3935,26 +3982,25 @@ function classifyRepositoryBinding(value, currentServerValue) {
   return {
     name: "repo-binding",
     status: "ok",
-    detail: currentServerValue === void 0 ? "valid local repository binding ready" : "local repository binding matches the current server binding"
+    detail: "local repository binding matches the current server binding"
   };
 }
 async function checkRepositoryBinding() {
   const root = process.cwd();
   const local = repoSyncId(root);
-  const localCheck = classifyRepositoryBinding(local);
-  if (localCheck.status === "fail") return localCheck;
   try {
     const current = await resolveRepositoryBinding(root, {
       signal: AbortSignal.timeout(CONNECTIVITY_TIMEOUT_MS),
       quietRefresh: true
     });
-    return classifyRepositoryBinding(local, current.repoSyncId);
+    return classifyRepositoryBinding(local, current, isRepoActiveForCapture(root));
   } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
+    const message = error instanceof Error ? error.message : String(error);
+    const detail = boundedHealthError(`could not verify the current repository binding \u2014 ${message}`) ?? "could not verify the current repository binding";
     return {
       name: "repo-binding",
       status: "fail",
-      detail: `could not verify the current repository binding \u2014 ${detail.slice(0, 80)}`
+      detail
     };
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.64",
+  "version": "0.1.0-alpha.65",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",