@primitive.ai/prim 0.1.0-alpha.65 → 0.1.0-alpha.67

package/dist/index.js

@@ -1,4 +1,23 @@
 #!/usr/bin/env node
+import {
+  bindRepository,
+  compareSemver,
+  ensureEffectivePostCommitHook,
+  ensureEffectivePostRewriteHook,
+  ensurePostCommitHookAtPath,
+  ensurePostRewriteHookAtPath,
+  inspectEffectivePostCommitHook,
+  inspectEffectivePostRewriteHook,
+  postCommitHookBlock,
+  postRewriteHookBlock,
+  printJson,
+  registerSkillCommands,
+  resolveRepositoryBinding,
+  uninstallPostCommitHookAtPath,
+  uninstallPostRewriteHookAtPath,
+  uninstallProjectPostCommitHook,
+  uninstallProjectPostRewriteHook
+} from "./chunk-XPVNH3J6.js";
 import {
   bold,
   boundedHealthError,
@@ -13,7 +32,10 @@ import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-WS3MCNFD.js";
+} from "./chunk-XUAP572Z.js";
+import {
+  fetchFeedbackCapability
+} from "./chunk-U6L2RU67.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
@@ -22,23 +44,7 @@ import {
   listFlushing,
   pendingJournalStats,
   readMovesFromPath
-} from "./chunk-HIMWM526.js";
-import {
-  bindRepository,
-  compareSemver,
-  ensureEffectivePostCommitHook,
-  ensurePostCommitHookAtPath,
-  inspectEffectivePostCommitHook,
-  postCommitHookBlock,
-  printJson,
-  registerSkillCommands,
-  resolveRepositoryBinding,
-  uninstallPostCommitHookAtPath,
-  uninstallProjectPostCommitHook
-} from "./chunk-CPHJUQNE.js";
-import {
-  fetchFeedbackCapability
-} from "./chunk-KHZNYEUV.js";
+} from "./chunk-UN5O5SYG.js";
 import {
   inspectWorkspaceId
 } from "./chunk-UVIWZWM6.js";
@@ -49,7 +55,7 @@ import {
   packageVersion,
   pinnedHookCommand,
   warmBinCache
-} from "./chunk-LNU44OJV.js";
+} from "./chunk-CZ24W5QU.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
@@ -74,7 +80,7 @@ import {
   resolveAuthCredential,
   setStoredToken,
   withFileLock
-} from "./chunk-CPX3BUOC.js";
+} from "./chunk-RTLFE6EZ.js";
 import {
   daemonIsLive,
   daemonRequest
@@ -101,8 +107,16 @@ async function applyActivation(active) {
   try {
     let binding;
     let postCommitHook;
+    let postRewriteHook;
     if (active) {
       postCommitHook = ensureEffectivePostCommitHook(root).path;
+      try {
+        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
+`);
+      }
       phase = "repository binding";
       binding = await bindRepository(root);
       phase = "local activation";
@@ -132,7 +146,8 @@ async function applyActivation(active) {
         repositoryFullName: binding.repositoryFullName,
         ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
       } : {},
-      ...postCommitHook ? { postCommitHook } : {}
+      ...postCommitHook ? { postCommitHook } : {},
+      ...postRewriteHook ? { postRewriteHook } : {}
     });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -3379,6 +3394,537 @@ function formatRelateJson(result) {
   return JSON.stringify(result.outcome, null, 2);
 }
 
+// src/decisions/repairs.ts
+var REPAIRS_TIMEOUT_MS = 1e4;
+var MAX_REPAIR_LIST_PAGES = 100;
+var MAX_REPAIR_DECISIONS_FOR_CONFIRM = 25;
+var MAX_REPAIRS_PER_PAGE = 10;
+var MAX_CURSOR_LENGTH = 4096;
+var MAX_INTENT_LENGTH = 1e3;
+var MAX_SIGNALS = 8;
+var MAX_SIGNAL_LENGTH = 160;
+var SHA_RE = /^[0-9a-f]{40}$/u;
+var SHA_INPUT_RE = /^[0-9a-f]{40}$/iu;
+var REVIEW_TOKEN_RE = /^[0-9a-f]{64}$/u;
+var REVIEW_TOKEN_INPUT_RE = /^[0-9a-f]{64}$/iu;
+var REPO_FULL_NAME_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+$/u;
+var REVIEWED_CONFIRM_WIRE_ACTION = "confirm_reviewed_v2";
+var LEGACY_REPAIR_BODY_ERROR = "Body requires id, action (confirm or reject), and expectedProposedSha";
+var LEGACY_CONFIRM_PROTOCOL_ERROR = "Reviewed confirmation protocol required; legacy action confirm is not supported";
+var defaultDeps6 = { getClient };
+var RepairProposalNotFoundError = class extends Error {
+  constructor(proposalId) {
+    super(`Commit repair proposal not found: ${oneLine(proposalId)}`);
+    this.name = "RepairProposalNotFoundError";
+  }
+};
+var RepairAuthorizationError = class extends Error {
+  constructor() {
+    super(
+      "Not authorized to review commit repairs; active organization membership and current repository authorization are required"
+    );
+    this.name = "RepairAuthorizationError";
+  }
+};
+var RepairListContractError = class extends Error {
+  constructor(detail) {
+    super(`Commit repair response violated the reviewed CLI contract: ${oneLine(detail)}`);
+    this.name = "RepairListContractError";
+  }
+};
+var RepairEndpointVersionError = class extends Error {
+  constructor() {
+    super(
+      "The selected server must be upgraded for the reviewed commit-repair contract; nothing was confirmed or queued (client/server version skew)"
+    );
+    this.name = "RepairEndpointVersionError";
+  }
+};
+var RepairResolutionInputError = class extends Error {
+  constructor(detail) {
+    super(`Invalid commit repair resolution: ${oneLine(detail)}`);
+    this.name = "RepairResolutionInputError";
+  }
+};
+function contractError(path, detail) {
+  throw new RepairListContractError(`${path} ${detail}`);
+}
+function asRecord(value, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    contractError(path, "must be an object");
+  }
+  return value;
+}
+function assertKeys(record, path, required, optional = []) {
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  const missing = required.find((key) => !Object.hasOwn(record, key));
+  if (missing !== void 0) contractError(path, `is missing ${missing}`);
+  const extra = Object.keys(record).find((key) => !allowed.has(key));
+  if (extra !== void 0) contractError(path, `contains unexpected field ${extra}`);
+}
+function asString(value, path, options) {
+  if (typeof value !== "string") contractError(path, "must be a string");
+  if (options.nonempty && value.length === 0) contractError(path, "must not be empty");
+  if (value.length > options.max) contractError(path, "exceeds its length bound");
+  return value;
+}
+function asTimestamp(value, path) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    contractError(path, "must be a non-negative safe integer timestamp");
+  }
+  return value;
+}
+function asCount(value, path) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    contractError(path, "must be a non-negative safe integer");
+  }
+  return value;
+}
+function asBoolean(value, path) {
+  if (typeof value !== "boolean") contractError(path, "must be a boolean");
+  return value;
+}
+function asSha(value, path) {
+  const sha = asString(value, path, { max: 40, nonempty: true });
+  if (!SHA_RE.test(sha)) contractError(path, "must be a canonical lowercase Git commit SHA");
+  return sha;
+}
+function optionalString(record, key, path, max) {
+  if (!Object.hasOwn(record, key)) return void 0;
+  return asString(record[key], `${path}.${key}`, { max, nonempty: true });
+}
+function parseProposal(value, path) {
+  const record = asRecord(value, path);
+  assertKeys(
+    record,
+    path,
+    ["_id", "repoFullName", "deadCommitSha", "status", "signals", "lastEvaluatedAt"],
+    ["proposedSha", "proposedTier", "nextEvaluateAt"]
+  );
+  const repoFullName = asString(record.repoFullName, `${path}.repoFullName`, {
+    max: 200,
+    nonempty: true
+  });
+  if (!REPO_FULL_NAME_RE.test(repoFullName)) {
+    contractError(`${path}.repoFullName`, "must be canonical owner/repository syntax");
+  }
+  const status = record.status;
+  if (status !== "proposed" && status !== "confirmed" && status !== "verification_failed") {
+    contractError(`${path}.status`, "is not a review-visible proposal status");
+  }
+  if (!Array.isArray(record.signals) || record.signals.length > MAX_SIGNALS) {
+    contractError(`${path}.signals`, "must be a bounded array");
+  }
+  const signals = record.signals.map(
+    (signal, index) => asString(signal, `${path}.signals[${String(index)}]`, {
+      max: MAX_SIGNAL_LENGTH,
+      nonempty: true
+    })
+  );
+  const proposedSha = Object.hasOwn(record, "proposedSha") ? asSha(record.proposedSha, `${path}.proposedSha`) : void 0;
+  let proposedTier;
+  if (Object.hasOwn(record, "proposedTier")) {
+    if (record.proposedTier !== "exact_patch_body" && record.proposedTier !== "exact_file_set") {
+      contractError(`${path}.proposedTier`, "is not a supported match tier");
+    }
+    proposedTier = record.proposedTier;
+  }
+  const nextEvaluateAt = Object.hasOwn(record, "nextEvaluateAt") ? asTimestamp(record.nextEvaluateAt, `${path}.nextEvaluateAt`) : void 0;
+  return {
+    _id: asString(record._id, `${path}._id`, { max: 256, nonempty: true }),
+    repoFullName,
+    deadCommitSha: asSha(record.deadCommitSha, `${path}.deadCommitSha`),
+    status,
+    proposedSha,
+    proposedTier,
+    signals,
+    lastEvaluatedAt: asTimestamp(record.lastEvaluatedAt, `${path}.lastEvaluatedAt`),
+    nextEvaluateAt
+  };
+}
+function parseDecision(value, path) {
+  const record = asRecord(value, path);
+  assertKeys(record, path, ["_id", "intent", "status", "intentTruncated"], ["shortId"]);
+  const status = record.status;
+  if (status !== "provisional" && status !== "abandoned") {
+    contractError(`${path}.status`, "is not a repairable decision status");
+  }
+  return {
+    _id: asString(record._id, `${path}._id`, { max: 256, nonempty: true }),
+    shortId: optionalString(record, "shortId", path, 128),
+    intent: asString(record.intent, `${path}.intent`, { max: MAX_INTENT_LENGTH }),
+    status,
+    intentTruncated: asBoolean(record.intentTruncated, `${path}.intentTruncated`)
+  };
+}
+function parseListItem(value, path) {
+  const record = asRecord(value, path);
+  assertKeys(record, path, [
+    "proposal",
+    "decisions",
+    "affectedDecisionCount",
+    "decisionsTruncated",
+    "reviewToken"
+  ]);
+  if (!Array.isArray(record.decisions) || record.decisions.length > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
+    contractError(`${path}.decisions`, "must be a bounded array");
+  }
+  const decisions = record.decisions.map(
+    (decision, index) => parseDecision(decision, `${path}.decisions[${String(index)}]`)
+  );
+  const proposal = parseProposal(record.proposal, `${path}.proposal`);
+  const decisionsTruncated = asBoolean(record.decisionsTruncated, `${path}.decisionsTruncated`);
+  const affectedDecisionCount = record.affectedDecisionCount === null ? null : asCount(record.affectedDecisionCount, `${path}.affectedDecisionCount`);
+  let reviewToken;
+  if (record.reviewToken === null) {
+    reviewToken = null;
+  } else {
+    reviewToken = asString(record.reviewToken, `${path}.reviewToken`, {
+      max: 64,
+      nonempty: true
+    });
+    if (!REVIEW_TOKEN_RE.test(reviewToken)) {
+      contractError(`${path}.reviewToken`, "must be a canonical lowercase SHA-256 token");
+    }
+  }
+  if (!decisionsTruncated && affectedDecisionCount === null) {
+    contractError(path, "cannot claim a complete decision list with an unknown count");
+  }
+  if (!decisionsTruncated && affectedDecisionCount !== decisions.length) {
+    contractError(path, "has a complete decision count that does not match its projection");
+  }
+  if (decisionsTruncated && affectedDecisionCount !== null && affectedDecisionCount <= decisions.length) {
+    contractError(path, "claims truncation without a larger affected-decision count");
+  }
+  if (decisionsTruncated && reviewToken !== null) {
+    contractError(path, "must not expose a review token for a truncated decision set");
+  }
+  if (reviewToken !== null && (proposal.proposedSha === void 0 || proposal.proposedTier === void 0 || proposal.proposedSha === proposal.deadCommitSha)) {
+    contractError(path, "must not expose a review token without a valid replacement candidate");
+  }
+  return {
+    proposal,
+    decisions,
+    affectedDecisionCount,
+    decisionsTruncated,
+    reviewToken
+  };
+}
+function parseListPage(value, pageNumber) {
+  const path = `page ${String(pageNumber)}`;
+  const record = asRecord(value, path);
+  assertKeys(record, path, ["repairs", "isDone", "nextCursor", "truncated"]);
+  if (!Array.isArray(record.repairs) || record.repairs.length > MAX_REPAIRS_PER_PAGE) {
+    contractError(`${path}.repairs`, "must be a bounded array");
+  }
+  const isDone = asBoolean(record.isDone, `${path}.isDone`);
+  const truncated = asBoolean(record.truncated, `${path}.truncated`);
+  if (truncated === isDone) contractError(path, "has inconsistent isDone/truncated flags");
+  let nextCursor;
+  if (record.nextCursor === null) {
+    nextCursor = null;
+  } else {
+    nextCursor = asString(record.nextCursor, `${path}.nextCursor`, {
+      max: MAX_CURSOR_LENGTH,
+      nonempty: true
+    });
+  }
+  if (isDone && nextCursor !== null) contractError(path, "is done but includes a next cursor");
+  if (!isDone && nextCursor === null) contractError(path, "is incomplete without a next cursor");
+  return {
+    repairs: record.repairs.map(
+      (item, index) => parseListItem(item, `${path}.repairs[${String(index)}]`)
+    ),
+    isDone,
+    nextCursor,
+    truncated
+  };
+}
+function effectivePageLimit(deps) {
+  if (deps.maxPages === void 0) return MAX_REPAIR_LIST_PAGES;
+  if (!Number.isSafeInteger(deps.maxPages) || deps.maxPages < 1) {
+    throw new RepairListContractError("configured page limit must be a positive safe integer");
+  }
+  return Math.min(deps.maxPages, MAX_REPAIR_LIST_PAGES);
+}
+function listPath(cursor) {
+  if (cursor === null) return "/api/cli/decisions/repairs";
+  const search = new URLSearchParams({ cursor });
+  return `/api/cli/decisions/repairs?${search.toString()}`;
+}
+async function fetchRepairsWithClient(client, deps) {
+  const repairs = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  const seenProposalIds = /* @__PURE__ */ new Set();
+  const pageLimit = effectivePageLimit(deps);
+  let cursor = null;
+  for (let pageNumber = 1; pageNumber <= pageLimit; pageNumber += 1) {
+    let rawPage;
+    try {
+      rawPage = await client.get(listPath(cursor), {
+        signal: AbortSignal.timeout(REPAIRS_TIMEOUT_MS)
+      });
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 403) {
+        throw new RepairAuthorizationError();
+      }
+      if (error instanceof HttpError && error.status === 404) {
+        throw new RepairEndpointVersionError();
+      }
+      throw error;
+    }
+    const page = parseListPage(rawPage, pageNumber);
+    for (const item of page.repairs) {
+      if (seenProposalIds.has(item.proposal._id)) {
+        contractError(`page ${String(pageNumber)}`, "repeats a proposal from an earlier page");
+      }
+      seenProposalIds.add(item.proposal._id);
+      repairs.push(item);
+    }
+    if (page.isDone) {
+      return { repairs, isDone: true, nextCursor: null, truncated: false };
+    }
+    const nextCursor = page.nextCursor;
+    if (nextCursor === null)
+      contractError(`page ${String(pageNumber)}`, "has no continuation cursor");
+    if (nextCursor === cursor || seenCursors.has(nextCursor)) {
+      contractError(`page ${String(pageNumber)}`, "has a repeated or non-advancing cursor");
+    }
+    seenCursors.add(nextCursor);
+    cursor = nextCursor;
+  }
+  throw new RepairListContractError(
+    `pagination did not finish within ${String(pageLimit)} page(s); no partial result was emitted`
+  );
+}
+async function fetchRepairs(deps = defaultDeps6) {
+  return fetchRepairsWithClient(deps.getClient(), deps);
+}
+function normalizedResolutionInput(proposalId, expectedProposedSha) {
+  if (proposalId.length === 0 || proposalId.length > 256) {
+    throw new RepairResolutionInputError("proposal ID must be a non-empty bounded string");
+  }
+  if (!SHA_INPUT_RE.test(expectedProposedSha)) {
+    throw new RepairResolutionInputError("expected proposed SHA must be a 40-character Git SHA");
+  }
+  return { proposalId, expectedProposedSha: expectedProposedSha.toLowerCase() };
+}
+function parseResolutionOutcome(value, action) {
+  const record = asRecord(value, "resolution response");
+  const allowed = action === "confirm" ? ["confirmed", "already_applied", "disabled", "no_op", "stale"] : ["rejected", "already_applied", "no_op", "stale"];
+  if (record.status === "backoff") {
+    assertKeys(record, "resolution response", ["status", "retryAt"]);
+    if (action !== "confirm") {
+      contractError("resolution response.status", "backoff is impossible for reject");
+    }
+    return {
+      status: "backoff",
+      retryAt: asTimestamp(record.retryAt, "resolution response.retryAt")
+    };
+  }
+  assertKeys(record, "resolution response", ["status"]);
+  if (typeof record.status !== "string" || !allowed.includes(record.status)) {
+    contractError("resolution response.status", "is not a supported outcome");
+  }
+  return { status: record.status };
+}
+function normalizedReviewToken(value) {
+  if (value === void 0 || !REVIEW_TOKEN_INPUT_RE.test(value)) {
+    throw new RepairResolutionInputError(
+      "confirm requires --review-token with the 64-character token from the reviewed list"
+    );
+  }
+  return value.toLowerCase();
+}
+function parseConflictOutcome(value, action) {
+  const record = asRecord(value, "resolution conflict response");
+  assertKeys(record, "resolution conflict response", ["status"]);
+  if (action !== "confirm") {
+    contractError(
+      "resolution conflict response.status",
+      "a review conflict is impossible for reject"
+    );
+  }
+  if (record.status !== "review_too_large" && record.status !== "stale_review") {
+    contractError("resolution conflict response.status", "is not a supported 409 outcome");
+  }
+  return { status: record.status };
+}
+async function resolveRepair(proposalId, expectedProposedSha, action, expectedReviewToken, deps = defaultDeps6) {
+  const normalized = normalizedResolutionInput(proposalId, expectedProposedSha);
+  const reviewToken = action === "confirm" ? normalizedReviewToken(expectedReviewToken) : void 0;
+  if (action === "reject" && expectedReviewToken !== void 0) {
+    throw new RepairResolutionInputError("--review-token is valid only with confirm");
+  }
+  const client = deps.getClient();
+  const wireAction = action === "confirm" ? REVIEWED_CONFIRM_WIRE_ACTION : "reject";
+  try {
+    const rawOutcome = await client.post(
+      "/api/cli/decisions/repairs/resolve",
+      {
+        id: normalized.proposalId,
+        action: wireAction,
+        expectedProposedSha: normalized.expectedProposedSha,
+        ...reviewToken === void 0 ? {} : { expectedReviewToken: reviewToken }
+      },
+      { signal: AbortSignal.timeout(REPAIRS_TIMEOUT_MS) }
+    );
+    return {
+      proposalId: normalized.proposalId,
+      action,
+      outcome: parseResolutionOutcome(rawOutcome, action)
+    };
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404 && error.message === "Repair proposal not found") {
+      throw new RepairProposalNotFoundError(normalized.proposalId);
+    }
+    if (error instanceof HttpError && error.status === 404) {
+      throw new RepairEndpointVersionError();
+    }
+    if (error instanceof HttpError && error.status === 403) {
+      throw new RepairAuthorizationError();
+    }
+    if (action === "confirm" && error instanceof HttpError && error.status === 400 && (error.message === LEGACY_REPAIR_BODY_ERROR || error.message === LEGACY_CONFIRM_PROTOCOL_ERROR)) {
+      throw new RepairEndpointVersionError();
+    }
+    if (error instanceof HttpError && error.status === 409) {
+      return {
+        proposalId: normalized.proposalId,
+        action,
+        outcome: parseConflictOutcome(error.body, action)
+      };
+    }
+    throw error;
+  }
+}
+function shortSha(sha) {
+  return sha === void 0 ? "(missing)" : sha.slice(0, 12);
+}
+function tierLabel(tier) {
+  if (tier === "exact_patch_body") return "exact patch body";
+  if (tier === "exact_file_set") return "exact file set";
+  return "match tier missing";
+}
+function oneLine(value) {
+  return stripControlChars(value.replace(/\s+/gu, " ")).trim();
+}
+function timestampLabel(value) {
+  const timestamp = new Date(value);
+  return Number.isNaN(timestamp.getTime()) ? String(value) : `${timestamp.toISOString()} (${String(value)})`;
+}
+function reviewLabel(item) {
+  if (item.affectedDecisionCount === null) {
+    return `showing ${String(item.decisions.length)}; total unknown; confirmation disabled`;
+  }
+  if (item.decisionsTruncated) {
+    return `showing ${String(item.decisions.length)} of ${String(item.affectedDecisionCount)}; confirmation disabled`;
+  }
+  if (item.affectedDecisionCount > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
+    return `${String(item.affectedDecisionCount)} affected; exceeds CLI review limit ${String(MAX_REPAIR_DECISIONS_FOR_CONFIRM)}; confirmation disabled`;
+  }
+  if (item.affectedDecisionCount === 0) {
+    return "0 affected; confirmation disabled";
+  }
+  return `${String(item.affectedDecisionCount)} affected; complete`;
+}
+function canRenderConfirm(item) {
+  return item.proposal.proposedSha !== void 0 && !item.decisionsTruncated && item.affectedDecisionCount !== null && item.affectedDecisionCount > 0 && item.affectedDecisionCount <= MAX_REPAIR_DECISIONS_FOR_CONFIRM && item.reviewToken !== null;
+}
+function shellArg(value) {
+  if (/^[a-zA-Z0-9_./:@%+=,-]+$/u.test(value)) return value;
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function proposalReviewLabel(item) {
+  if (item.proposal.status === "confirmed") {
+    return canRenderConfirm(item) ? "already confirmed; a guarded application retry may be requested when eligible" : "already confirmed; a guarded retry is currently unavailable";
+  }
+  if (item.proposal.status === "verification_failed") {
+    return canRenderConfirm(item) ? "prior verification failed; eligible for a fresh confirmation" : "prior verification failed; confirmation is currently unavailable";
+  }
+  return canRenderConfirm(item) ? "awaiting operator review" : "awaiting review; confirmation is currently unavailable";
+}
+function formatRepairsHuman(result) {
+  if (result.repairs.length === 0) {
+    return "[prim] decision repairs \xB7 0 review-visible proposals \xB7 complete paginated scan";
+  }
+  const lines = [
+    `[prim] decision repairs \xB7 ${String(result.repairs.length)} review-visible proposal(s) \xB7 complete paginated scan`
+  ];
+  for (const item of result.repairs) {
+    const { proposal, decisions } = item;
+    const renderedProposalId = oneLine(proposal._id);
+    lines.push(
+      `  ${renderedProposalId} [${proposal.status}] \xB7 ${oneLine(proposal.repoFullName)} \xB7 ${shortSha(proposal.deadCommitSha)} -> ${shortSha(proposal.proposedSha)} \xB7 ${tierLabel(proposal.proposedTier)}`,
+      `    review state: ${proposalReviewLabel(item)}`
+    );
+    if (proposal.signals.length > 0) {
+      lines.push(`    signals: ${proposal.signals.map(oneLine).join("; ")}`);
+    }
+    if (proposal.nextEvaluateAt !== void 0) {
+      lines.push(`    next proposal evaluation: ${timestampLabel(proposal.nextEvaluateAt)}`);
+    }
+    lines.push(`    decisions (${reviewLabel(item)}):`);
+    for (const decision of decisions) {
+      const id = renderIdentifier({
+        shortId: decision.shortId === void 0 ? void 0 : oneLine(decision.shortId),
+        id: oneLine(decision._id)
+      });
+      const truncation = decision.intentTruncated ? " [intent truncated]" : "";
+      lines.push(`      - ${id} [${decision.status}] ${oneLine(decision.intent)}${truncation}`);
+    }
+    if (canRenderConfirm(item) && proposal.status === "proposed") {
+      lines.push(
+        `    confirm: prim decisions repairs confirm ${shellArg(renderedProposalId)} ${proposal.proposedSha} --review-token ${item.reviewToken}`
+      );
+    }
+    if (canRenderConfirm(item) && proposal.status === "verification_failed") {
+      lines.push(
+        `    retry verification: prim decisions repairs confirm ${shellArg(renderedProposalId)} ${proposal.proposedSha} --review-token ${item.reviewToken}`
+      );
+    }
+    if (canRenderConfirm(item) && proposal.status === "confirmed") {
+      lines.push(
+        `    guarded retry confirmation: prim decisions repairs confirm ${shellArg(renderedProposalId)} ${proposal.proposedSha} --review-token ${item.reviewToken}`
+      );
+    }
+    if (proposal.proposedSha !== void 0) {
+      lines.push(
+        `    reject:  prim decisions repairs reject ${shellArg(renderedProposalId)} ${proposal.proposedSha}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function formatRepairsJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+function formatRepairResolutionHuman(result) {
+  const proposalId = oneLine(result.proposalId);
+  switch (result.outcome.status) {
+    case "confirmed":
+      return `[prim] repair ${proposalId} confirmed; fresh landing verification queued. No Decision was changed by this response.`;
+    case "rejected":
+      return `[prim] repair ${proposalId} rejected.`;
+    case "already_applied":
+      return `[prim] repair ${proposalId} was already applied; nothing to change.`;
+    case "backoff":
+      return `[prim] repair ${proposalId} is in application retry backoff; nothing changed. Retry at ${timestampLabel(result.outcome.retryAt)}.`;
+    case "disabled":
+      return `[prim] repair ${proposalId} was not confirmed because repair application is disabled; nothing changed.`;
+    case "review_too_large":
+      return `[prim] repair ${proposalId} was refused because its complete review exceeds the safe bound; nothing changed.`;
+    case "stale_review":
+      return `[prim] repair ${proposalId} changed after review; re-list and review the current decision set before confirming with its new token. Nothing changed.`;
+    case "stale":
+      return `[prim] repair ${proposalId} has a different proposed SHA; refresh the repair list before acting. Nothing changed.`;
+    case "no_op":
+      return `[prim] repair ${proposalId} cannot be ${result.action === "confirm" ? "confirmed" : "rejected"} in its current state; nothing changed.`;
+  }
+}
+function formatRepairResolutionJson(result) {
+  return JSON.stringify(result.outcome, null, 2);
+}
+
 // src/decisions/show.ts
 var NOT_FOUND_RE4 = /not found/i;
 function colorStatus(status) {
@@ -3391,14 +3937,14 @@ function colorStatus(status) {
   return color(status, "gray");
 }
 var SHOW_TIMEOUT_MS = 1e4;
-var defaultDeps6 = { getClient };
+var defaultDeps7 = { getClient };
 var DecisionNotFoundError = class extends Error {
   constructor(idOrShortId) {
     super(`Decision not found: ${idOrShortId}`);
     this.name = "DecisionNotFoundError";
   }
 };
-async function fetchShow(idOrShortId, deps = defaultDeps6) {
+async function fetchShow(idOrShortId, deps = defaultDeps7) {
   const params = new URLSearchParams({ id: idOrShortId });
   const client = deps.getClient();
   try {
@@ -3532,7 +4078,33 @@ async function askConfirmation(question, output = process.stdout) {
 
 // src/commands/decisions.ts
 var EXIT_NOT_FOUND = 4;
+var EXIT_FAILURE = 1;
 var EXIT_USAGE = 2;
+function handleRepairCommandError(error) {
+  if (error instanceof RepairProposalNotFoundError) {
+    console.error(`[prim] ${error.message}`);
+    process.exitCode = EXIT_NOT_FOUND;
+    return true;
+  }
+  if (error instanceof RepairResolutionInputError) {
+    console.error(`[prim] ${error.message}`);
+    process.exitCode = EXIT_USAGE;
+    return true;
+  }
+  if (error instanceof RepairAuthorizationError || error instanceof HttpError && error.status === 403) {
+    console.error(
+      `[prim] ${error instanceof RepairAuthorizationError ? error.message : "Not authorized to review commit repairs; active organization membership and current repository authorization are required"}`
+    );
+    process.exitCode = EXIT_FAILURE;
+    return true;
+  }
+  if (error instanceof RepairEndpointVersionError || error instanceof RepairListContractError) {
+    console.error(`[prim] ${error.message}`);
+    process.exitCode = EXIT_FAILURE;
+    return true;
+  }
+  return false;
+}
 var CREATE_INACTIVE_PROMPT = "[prim] Decision ingestion is disabled here. Create this one Decision without enabling passive ingestion?";
 var CREATE_INACTIVE_APPROVED = "[prim] one-time Decision creation approved; passive ingestion remains disabled here";
 var CREATE_INACTIVE_REJECTED = "[prim] decision not created: Decision ingestion is disabled here; rerun with prim's --yes to approve this one Decision, or run `prim enable` in a Git project";
@@ -3611,6 +4183,46 @@ function registerDecisionsCommands(program2) {
       throw err;
     }
   });
+  const repairs = decisions.command("repairs").description("Review human-gated commit rewrite repair proposals").action(runRepairsList);
+  async function runRepairsList() {
+    try {
+      const result = await fetchRepairs();
+      console.error(formatRepairsHuman(result));
+      console.log(formatRepairsJson(result));
+    } catch (error) {
+      if (handleRepairCommandError(error)) return;
+      throw error;
+    }
+  }
+  repairs.command("list").description("List review-visible commit rewrite repair proposals").action(runRepairsList);
+  const registerRepairResolution = (action) => {
+    const resolution = repairs.command(`${action} <proposalId> <proposedSha>`).description(
+      action === "confirm" ? "Confirm the exact reviewed decision set and queue fresh landing verification" : "Reject a proposal and remember its proposed SHA"
+    );
+    if (action === "confirm") {
+      resolution.option(
+        "--review-token <token>",
+        "64-character token printed with the complete reviewed decision set (required)"
+      );
+    }
+    resolution.action(
+      async (proposalId, proposedSha, options) => {
+        try {
+          const result = await resolveRepair(proposalId, proposedSha, action, options.reviewToken);
+          console.error(formatRepairResolutionHuman(result));
+          console.log(formatRepairResolutionJson(result));
+          if (result.outcome.status === "review_too_large" || result.outcome.status === "stale_review") {
+            process.exitCode = EXIT_USAGE;
+          }
+        } catch (error) {
+          if (handleRepairCommandError(error)) return;
+          throw error;
+        }
+      }
+    );
+  };
+  registerRepairResolution("confirm");
+  registerRepairResolution("reject");
   decisions.command("create").description("Record a decision directly with its explicit user or agent origin").requiredOption("--intent <text>", "What was decided (required)").addOption(
     new Option2(
       "--attribution <origin>",
@@ -4004,27 +4616,27 @@ async function checkRepositoryBinding() {
     };
   }
 }
-function classifyPostCommitHook(inspection) {
+function classifyManagedHook(hookName, inspection) {
   if (inspection.covered) {
     return {
-      name: "post-commit",
+      name: hookName,
       status: "ok",
       detail: `effective and executable \xB7 ${inspection.kind} \xB7 ${inspection.hookPath}`
     };
   }
   return {
-    name: "post-commit",
+    name: hookName,
     status: "fail",
     detail: `${inspection.reason ?? "uncovered"} \xB7 ${inspection.hookPath}`
   };
 }
-function checkPostCommitHook() {
+function checkManagedHook(hookName, inspect) {
   try {
-    return classifyPostCommitHook(inspectEffectivePostCommitHook());
+    return classifyManagedHook(hookName, inspect());
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     return {
-      name: "post-commit",
+      name: hookName,
       status: /not a git repository/iu.test(detail) ? "warn" : "fail",
       detail: detail.slice(0, 120)
     };
@@ -4150,7 +4762,8 @@ async function collectChecks() {
     checkFeedbackHooks(),
     checkWorkspaceIdentity(),
     await checkRepositoryBinding(),
-    checkPostCommitHook(),
+    checkManagedHook("post-commit", inspectEffectivePostCommitHook),
+    checkManagedHook("post-rewrite", inspectEffectivePostRewriteHook),
     ...backend,
     await checkFeedbackCapability()
   ];
@@ -4534,7 +5147,8 @@ import { dirname as dirname4, join as join7, resolve as resolve2 } from "path";
 import { Option as Option3 } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
-var HOOKS = [PRE_COMMIT, POST_COMMIT];
+var POST_REWRITE = { hookName: "post-rewrite", binName: "prim-post-rewrite" };
+var HOOKS = [PRE_COMMIT, POST_COMMIT, POST_REWRITE];
 var GIT_TIMEOUT_MS = 1e3;
 function blockMarkers(spec) {
   return {
@@ -4563,6 +5177,7 @@ ${hookShim(spec.binName)}
 }
 function huskyBlock(spec) {
   if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
+  if (spec.hookName === POST_REWRITE.hookName) return postRewriteHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${hookShim(spec.binName)}
@@ -4570,6 +5185,7 @@ ${end}`;
 }
 function gatedBlock(spec) {
   if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
+  if (spec.hookName === POST_REWRITE.hookName) return postRewriteHookBlock();
   const { start, end } = blockMarkers(spec);
   return `${start}
 ${gatedShim(spec.binName)}
@@ -4707,7 +5323,6 @@ var PASSTHROUGH_HOOKS = [
   "post-checkout",
   "post-merge",
   "pre-push",
-  "post-rewrite",
   "pre-auto-gc",
   "push-to-checkout",
   "sendemail-validate",
@@ -4717,11 +5332,13 @@ var PASSTHROUGH_HOOKS = [
   //  with a query protocol, not a lifecycle event, so a bare exec stub is wrong.)
 ];
 function globalHookScript(spec) {
-  const chainExit = spec.hookName === "pre-commit" ? "|| exit $?" : "|| true";
-  const invocation = spec.hookName === POST_COMMIT.hookName ? postCommitHookBlock() : gatedShim(spec.binName);
-  const beforeComments = spec.hookName === POST_COMMIT.hookName ? `${invocation}
+  const chainExit = spec.hookName === PRE_COMMIT.hookName ? "|| exit $?" : "|| true";
+  const managedBlock = spec.hookName === POST_COMMIT.hookName ? postCommitHookBlock() : spec.hookName === POST_REWRITE.hookName ? postRewriteHookBlock() : void 0;
+  const invocation = managedBlock ?? gatedShim(spec.binName);
+  const managedRepoGuard = managedBlock ? ` && ! grep -Fq '${blockMarkers(spec).start}' "$repo_hook" 2>/dev/null` : "";
+  const beforeComments = managedBlock ? `${invocation}
 ` : "";
-  const afterComments = spec.hookName === POST_COMMIT.hookName ? "" : `${invocation}
+  const afterComments = managedBlock ? "" : `${invocation}
 `;
   return `#!/bin/sh
 ${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
@@ -4731,7 +5348,7 @@ ${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 man
 # hook regardless, so inactive repos are unaffected.
 ${afterComments}common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
 repo_hook="$common_dir/hooks/${spec.hookName}"
-if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null; then
+if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null${managedRepoGuard}; then
   "$repo_hook" "$@" ${chainExit}
 fi
 exit 0
@@ -4757,6 +5374,8 @@ function writeOwnHooks() {
     const path = resolve2(PRIM_GIT_HOOKS_DIR, spec.hookName);
     if (spec.hookName === POST_COMMIT.hookName) {
       ensurePostCommitHookAtPath(path, globalHookScript(spec));
+    } else if (spec.hookName === POST_REWRITE.hookName) {
+      writeFileSync4(path, globalHookScript(spec), { mode: 493 });
     } else {
       writeFileSync4(path, globalHookScript(spec), { mode: 493 });
     }
@@ -4770,6 +5389,10 @@ function appendPrimBlock(hookPath, spec) {
     ensurePostCommitHookAtPath(hookPath);
     return;
   }
+  if (spec.hookName === POST_REWRITE.hookName) {
+    ensurePostRewriteHookAtPath(hookPath);
+    return;
+  }
   mergePrimBlock(hookPath, gatedBlock(spec), spec.binName);
 }
 function stripPrimBlock(hookPath, spec) {
@@ -4777,6 +5400,10 @@ function stripPrimBlock(hookPath, spec) {
     uninstallPostCommitHookAtPath(hookPath);
     return;
   }
+  if (spec.hookName === POST_REWRITE.hookName) {
+    uninstallPostRewriteHookAtPath(hookPath);
+    return;
+  }
   if (!existsSync7(hookPath)) return;
   const existing = readFileSync6(hookPath, "utf-8");
   const primCreated = existing.includes(PRIM_CREATED_MARK);
@@ -4856,22 +5483,29 @@ function uninstallGlobalHooks() {
   console.log("No prim global git hooks found.");
 }
 function installHooks(gitRoot, target) {
-  for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
-    if (target === "husky") {
-      installToHusky(gitRoot, spec);
-    } else {
-      installToDotGit(gitRoot, spec);
-    }
+  if (target === "husky") {
+    installToHusky(gitRoot, PRE_COMMIT);
+  } else {
+    installToDotGit(gitRoot, PRE_COMMIT);
   }
   const postCommit = ensureEffectivePostCommitHook(gitRoot);
   console.log(
     `${postCommit.changed ? "Installed" : "Refreshed"} effective post-commit hook at ${postCommit.path}.`
   );
+  try {
+    const postRewrite = ensureEffectivePostRewriteHook(gitRoot);
+    console.log(
+      `${postRewrite.changed ? "Installed" : "Refreshed"} effective post-rewrite hook at ${postRewrite.path}.`
+    );
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    console.error(`[prim] post-rewrite hook coverage is degraded: ${detail}`);
+  }
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
   hooks.command("install").description(
-    "Install the prim git hooks \u2014 pre-commit + post-commit (auto-detects Husky; use --target to override)"
+    "Install the prim git hooks \u2014 pre-commit + post-commit + post-rewrite (auto-detects Husky; use --target to override)"
   ).addOption(
     new Option3("--target <where>", "install destination; bypasses Husky detection").choices([
       "husky",
@@ -4929,27 +5563,30 @@ function registerHooksCommands(program2) {
     }
     const gitRoot = getGitRoot();
     const hooksDir = projectHooksDir(gitRoot);
-    for (const spec of HOOKS.filter((candidate) => candidate !== POST_COMMIT)) {
-      const hookPath = resolve2(hooksDir, spec.hookName);
-      if (!existsSync7(hookPath)) {
-        console.log(`No ${spec.hookName} hook found.`);
-        continue;
-      }
-      if (containsPrimHook(readFileSync6(hookPath, "utf-8"), spec.binName)) {
-        unlinkSync2(hookPath);
-        console.log(`Removed ${spec.hookName} hook at ${hookPath}`);
+    const preCommitPath = resolve2(hooksDir, PRE_COMMIT.hookName);
+    if (!existsSync7(preCommitPath)) {
+      console.log(`No ${PRE_COMMIT.hookName} hook found.`);
+    } else if (containsPrimHook(readFileSync6(preCommitPath, "utf-8"), PRE_COMMIT.binName)) {
+      unlinkSync2(preCommitPath);
+      console.log(`Removed ${PRE_COMMIT.hookName} hook at ${preCommitPath}`);
+    } else {
+      console.log(
+        `Left ${PRE_COMMIT.hookName} hook at ${preCommitPath} untouched (not a prim hook).`
+      );
+    }
+    for (const [hookName, uninstall] of [
+      [POST_COMMIT.hookName, uninstallProjectPostCommitHook],
+      [POST_REWRITE.hookName, uninstallProjectPostRewriteHook]
+    ]) {
+      const result = uninstall(gitRoot);
+      if (!result.changed) {
+        console.log(`No Prim ${hookName} block found at ${result.path}.`);
+      } else if (result.removedFile) {
+        console.log(`Removed Prim-created ${hookName} hook at ${result.path}.`);
       } else {
-        console.log(`Left ${spec.hookName} hook at ${hookPath} untouched (not a prim hook).`);
+        console.log(`Removed the Prim ${hookName} block from ${result.path}.`);
       }
     }
-    const postCommit = uninstallProjectPostCommitHook(gitRoot);
-    if (!postCommit.changed) {
-      console.log(`No Prim post-commit block found at ${postCommit.path}.`);
-    } else if (postCommit.removedFile) {
-      console.log(`Removed Prim-created post-commit hook at ${postCommit.path}.`);
-    } else {
-      console.log(`Removed the Prim post-commit block from ${postCommit.path}.`);
-    }
   });
 }