@primitive.ai/prim 0.1.0-alpha.66 → 0.1.0-alpha.67

package/dist/{chunk-CPX3BUOC.js → chunk-RTLFE6EZ.js}

@@ -422,10 +422,12 @@ function refreshToken(options = {}) {
 }
 var HttpError = class extends Error {
   status;
-  constructor(status, message) {
+  body;
+  constructor(status, message, body) {
     super(message);
     this.name = "HttpError";
     this.status = status;
+    this.body = body;
   }
 };
 var _cachedCredential;
@@ -486,7 +488,9 @@ async function request(method, path, body, options) {
       throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
     }
     const errorBody = await response.json().catch(() => null);
-    throw new HttpError(response.status, errorBody?.error ?? `HTTP ${response.status}`);
+    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
+    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
+    throw new HttpError(response.status, message, errorBody);
   }
   return response.json();
 }

package/dist/{chunk-KHZNYEUV.js → chunk-U6L2RU67.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-CPX3BUOC.js";
+} from "./chunk-RTLFE6EZ.js";
 
 // src/decisions/feedback.ts
 var FEEDBACK_PROTOCOL_VERSION = 1;

package/dist/{chunk-HIMWM526.js → chunk-UN5O5SYG.js}

@@ -1,6 +1,6 @@
 import {
   getSiteUrl
-} from "./chunk-CPX3BUOC.js";
+} from "./chunk-RTLFE6EZ.js";
 
 // src/journal.ts
 import {

package/dist/{chunk-DR66XM5L.js → chunk-XPVNH3J6.js}

@@ -9,7 +9,7 @@ import {
   HttpError,
   getClient,
   withFileLock
-} from "./chunk-CPX3BUOC.js";
+} from "./chunk-RTLFE6EZ.js";
 
 // src/commands/skill.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-WS3MCNFD.js → chunk-XUAP572Z.js}

@@ -1,7 +1,7 @@
 import {
   getClient,
   getSiteUrl
-} from "./chunk-CPX3BUOC.js";
+} from "./chunk-RTLFE6EZ.js";
 import {
   daemonRequest
 } from "./chunk-UTKQTZHL.js";

package/dist/daemon/server.js

@@ -394,10 +394,12 @@ function refreshToken(options = {}) {
 }
 var HttpError = class extends Error {
   status;
-  constructor(status, message) {
+  body;
+  constructor(status, message, body) {
     super(message);
     this.name = "HttpError";
     this.status = status;
+    this.body = body;
   }
 };
 var _cachedCredential;
@@ -458,7 +460,9 @@ async function request(method, path, body, options) {
       throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
     }
     const errorBody = await response.json().catch(() => null);
-    throw new HttpError(response.status, errorBody?.error ?? `HTTP ${response.status}`);
+    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
+    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
+    throw new HttpError(response.status, message, errorBody);
   }
   return response.json();
 }

package/dist/hooks/post-commit.js

@@ -6,7 +6,7 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-HIMWM526.js";
+} from "../chunk-UN5O5SYG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
@@ -16,7 +16,7 @@ import {
   repoSyncId,
   resolveRepositoryContext
 } from "../chunk-TDRXHBEX.js";
-import "../chunk-CPX3BUOC.js";
+import "../chunk-RTLFE6EZ.js";
 
 // src/hooks/post-commit.ts
 import { execFileSync, spawn } from "child_process";

package/dist/hooks/post-rewrite.js

@@ -6,7 +6,7 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-HIMWM526.js";
+} from "../chunk-UN5O5SYG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
@@ -16,7 +16,7 @@ import {
   repoSyncId,
   resolveRepositoryContext
 } from "../chunk-TDRXHBEX.js";
-import "../chunk-CPX3BUOC.js";
+import "../chunk-RTLFE6EZ.js";
 
 // src/hooks/post-rewrite.ts
 import { execFileSync, spawn } from "child_process";

package/dist/hooks/post-tool-use.js

@@ -16,7 +16,7 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-HIMWM526.js";
+} from "../chunk-UN5O5SYG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
@@ -33,7 +33,7 @@ import {
 } from "../chunk-TDRXHBEX.js";
 import {
   getClient
-} from "../chunk-CPX3BUOC.js";
+} from "../chunk-RTLFE6EZ.js";
 import {
   normalizeEnvelope,
   parseAgent

package/dist/hooks/pre-commit.js

@@ -2,8 +2,8 @@
 import {
   checkAffectedDecisions,
   formatDecisionsWarning
-} from "../chunk-WS3MCNFD.js";
-import "../chunk-CPX3BUOC.js";
+} from "../chunk-XUAP572Z.js";
+import "../chunk-RTLFE6EZ.js";
 import "../chunk-UTKQTZHL.js";
 
 // src/hooks/pre-commit.ts

package/dist/hooks/pre-tool-use.js

@@ -25,7 +25,7 @@ import {
 } from "../chunk-TDRXHBEX.js";
 import {
   getClient
-} from "../chunk-CPX3BUOC.js";
+} from "../chunk-RTLFE6EZ.js";
 import {
   normalizeEnvelope,
   parseAgent

package/dist/hooks/prim-hook.js

@@ -8,7 +8,7 @@ import {
   acknowledgeDecisionFeedback,
   leaseDecisionFeedback,
   renderFeedback
-} from "../chunk-KHZNYEUV.js";
+} from "../chunk-U6L2RU67.js";
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
@@ -21,7 +21,7 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-HIMWM526.js";
+} from "../chunk-UN5O5SYG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
@@ -36,7 +36,7 @@ import {
   repoSyncId,
   resolveRepositoryContext
 } from "../chunk-TDRXHBEX.js";
-import "../chunk-CPX3BUOC.js";
+import "../chunk-RTLFE6EZ.js";
 import {
   normalizeEnvelope,
   parseAgent

package/dist/hooks/session-start.js

@@ -5,7 +5,7 @@ import {
   ensureEffectivePostRewriteHook,
   hasUsableCodexGuidance,
   refreshClaudePlugins
-} from "../chunk-DR66XM5L.js";
+} from "../chunk-XPVNH3J6.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -15,7 +15,7 @@ import {
   acknowledgeDecisionFeedback,
   leaseDecisionFeedback,
   renderFeedback
-} from "../chunk-KHZNYEUV.js";
+} from "../chunk-U6L2RU67.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
@@ -32,7 +32,7 @@ import {
 import {
   getSiteUrl,
   isSessionEnded
-} from "../chunk-CPX3BUOC.js";
+} from "../chunk-RTLFE6EZ.js";
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   uninstallPostRewriteHookAtPath,
   uninstallProjectPostCommitHook,
   uninstallProjectPostRewriteHook
-} from "./chunk-DR66XM5L.js";
+} from "./chunk-XPVNH3J6.js";
 import {
   bold,
   boundedHealthError,
@@ -32,10 +32,10 @@ import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-WS3MCNFD.js";
+} from "./chunk-XUAP572Z.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-KHZNYEUV.js";
+} from "./chunk-U6L2RU67.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
@@ -44,7 +44,7 @@ import {
   listFlushing,
   pendingJournalStats,
   readMovesFromPath
-} from "./chunk-HIMWM526.js";
+} from "./chunk-UN5O5SYG.js";
 import {
   inspectWorkspaceId
 } from "./chunk-UVIWZWM6.js";
@@ -80,7 +80,7 @@ import {
   resolveAuthCredential,
   setStoredToken,
   withFileLock
-} from "./chunk-CPX3BUOC.js";
+} from "./chunk-RTLFE6EZ.js";
 import {
   daemonIsLive,
   daemonRequest
@@ -3394,6 +3394,537 @@ function formatRelateJson(result) {
   return JSON.stringify(result.outcome, null, 2);
 }
 
+// src/decisions/repairs.ts
+var REPAIRS_TIMEOUT_MS = 1e4;
+var MAX_REPAIR_LIST_PAGES = 100;
+var MAX_REPAIR_DECISIONS_FOR_CONFIRM = 25;
+var MAX_REPAIRS_PER_PAGE = 10;
+var MAX_CURSOR_LENGTH = 4096;
+var MAX_INTENT_LENGTH = 1e3;
+var MAX_SIGNALS = 8;
+var MAX_SIGNAL_LENGTH = 160;
+var SHA_RE = /^[0-9a-f]{40}$/u;
+var SHA_INPUT_RE = /^[0-9a-f]{40}$/iu;
+var REVIEW_TOKEN_RE = /^[0-9a-f]{64}$/u;
+var REVIEW_TOKEN_INPUT_RE = /^[0-9a-f]{64}$/iu;
+var REPO_FULL_NAME_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+$/u;
+var REVIEWED_CONFIRM_WIRE_ACTION = "confirm_reviewed_v2";
+var LEGACY_REPAIR_BODY_ERROR = "Body requires id, action (confirm or reject), and expectedProposedSha";
+var LEGACY_CONFIRM_PROTOCOL_ERROR = "Reviewed confirmation protocol required; legacy action confirm is not supported";
+var defaultDeps6 = { getClient };
+var RepairProposalNotFoundError = class extends Error {
+  constructor(proposalId) {
+    super(`Commit repair proposal not found: ${oneLine(proposalId)}`);
+    this.name = "RepairProposalNotFoundError";
+  }
+};
+var RepairAuthorizationError = class extends Error {
+  constructor() {
+    super(
+      "Not authorized to review commit repairs; active organization membership and current repository authorization are required"
+    );
+    this.name = "RepairAuthorizationError";
+  }
+};
+var RepairListContractError = class extends Error {
+  constructor(detail) {
+    super(`Commit repair response violated the reviewed CLI contract: ${oneLine(detail)}`);
+    this.name = "RepairListContractError";
+  }
+};
+var RepairEndpointVersionError = class extends Error {
+  constructor() {
+    super(
+      "The selected server must be upgraded for the reviewed commit-repair contract; nothing was confirmed or queued (client/server version skew)"
+    );
+    this.name = "RepairEndpointVersionError";
+  }
+};
+var RepairResolutionInputError = class extends Error {
+  constructor(detail) {
+    super(`Invalid commit repair resolution: ${oneLine(detail)}`);
+    this.name = "RepairResolutionInputError";
+  }
+};
+function contractError(path, detail) {
+  throw new RepairListContractError(`${path} ${detail}`);
+}
+function asRecord(value, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    contractError(path, "must be an object");
+  }
+  return value;
+}
+function assertKeys(record, path, required, optional = []) {
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  const missing = required.find((key) => !Object.hasOwn(record, key));
+  if (missing !== void 0) contractError(path, `is missing ${missing}`);
+  const extra = Object.keys(record).find((key) => !allowed.has(key));
+  if (extra !== void 0) contractError(path, `contains unexpected field ${extra}`);
+}
+function asString(value, path, options) {
+  if (typeof value !== "string") contractError(path, "must be a string");
+  if (options.nonempty && value.length === 0) contractError(path, "must not be empty");
+  if (value.length > options.max) contractError(path, "exceeds its length bound");
+  return value;
+}
+function asTimestamp(value, path) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    contractError(path, "must be a non-negative safe integer timestamp");
+  }
+  return value;
+}
+function asCount(value, path) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    contractError(path, "must be a non-negative safe integer");
+  }
+  return value;
+}
+function asBoolean(value, path) {
+  if (typeof value !== "boolean") contractError(path, "must be a boolean");
+  return value;
+}
+function asSha(value, path) {
+  const sha = asString(value, path, { max: 40, nonempty: true });
+  if (!SHA_RE.test(sha)) contractError(path, "must be a canonical lowercase Git commit SHA");
+  return sha;
+}
+function optionalString(record, key, path, max) {
+  if (!Object.hasOwn(record, key)) return void 0;
+  return asString(record[key], `${path}.${key}`, { max, nonempty: true });
+}
+function parseProposal(value, path) {
+  const record = asRecord(value, path);
+  assertKeys(
+    record,
+    path,
+    ["_id", "repoFullName", "deadCommitSha", "status", "signals", "lastEvaluatedAt"],
+    ["proposedSha", "proposedTier", "nextEvaluateAt"]
+  );
+  const repoFullName = asString(record.repoFullName, `${path}.repoFullName`, {
+    max: 200,
+    nonempty: true
+  });
+  if (!REPO_FULL_NAME_RE.test(repoFullName)) {
+    contractError(`${path}.repoFullName`, "must be canonical owner/repository syntax");
+  }
+  const status = record.status;
+  if (status !== "proposed" && status !== "confirmed" && status !== "verification_failed") {
+    contractError(`${path}.status`, "is not a review-visible proposal status");
+  }
+  if (!Array.isArray(record.signals) || record.signals.length > MAX_SIGNALS) {
+    contractError(`${path}.signals`, "must be a bounded array");
+  }
+  const signals = record.signals.map(
+    (signal, index) => asString(signal, `${path}.signals[${String(index)}]`, {
+      max: MAX_SIGNAL_LENGTH,
+      nonempty: true
+    })
+  );
+  const proposedSha = Object.hasOwn(record, "proposedSha") ? asSha(record.proposedSha, `${path}.proposedSha`) : void 0;
+  let proposedTier;
+  if (Object.hasOwn(record, "proposedTier")) {
+    if (record.proposedTier !== "exact_patch_body" && record.proposedTier !== "exact_file_set") {
+      contractError(`${path}.proposedTier`, "is not a supported match tier");
+    }
+    proposedTier = record.proposedTier;
+  }
+  const nextEvaluateAt = Object.hasOwn(record, "nextEvaluateAt") ? asTimestamp(record.nextEvaluateAt, `${path}.nextEvaluateAt`) : void 0;
+  return {
+    _id: asString(record._id, `${path}._id`, { max: 256, nonempty: true }),
+    repoFullName,
+    deadCommitSha: asSha(record.deadCommitSha, `${path}.deadCommitSha`),
+    status,
+    proposedSha,
+    proposedTier,
+    signals,
+    lastEvaluatedAt: asTimestamp(record.lastEvaluatedAt, `${path}.lastEvaluatedAt`),
+    nextEvaluateAt
+  };
+}
+function parseDecision(value, path) {
+  const record = asRecord(value, path);
+  assertKeys(record, path, ["_id", "intent", "status", "intentTruncated"], ["shortId"]);
+  const status = record.status;
+  if (status !== "provisional" && status !== "abandoned") {
+    contractError(`${path}.status`, "is not a repairable decision status");
+  }
+  return {
+    _id: asString(record._id, `${path}._id`, { max: 256, nonempty: true }),
+    shortId: optionalString(record, "shortId", path, 128),
+    intent: asString(record.intent, `${path}.intent`, { max: MAX_INTENT_LENGTH }),
+    status,
+    intentTruncated: asBoolean(record.intentTruncated, `${path}.intentTruncated`)
+  };
+}
+function parseListItem(value, path) {
+  const record = asRecord(value, path);
+  assertKeys(record, path, [
+    "proposal",
+    "decisions",
+    "affectedDecisionCount",
+    "decisionsTruncated",
+    "reviewToken"
+  ]);
+  if (!Array.isArray(record.decisions) || record.decisions.length > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
+    contractError(`${path}.decisions`, "must be a bounded array");
+  }
+  const decisions = record.decisions.map(
+    (decision, index) => parseDecision(decision, `${path}.decisions[${String(index)}]`)
+  );
+  const proposal = parseProposal(record.proposal, `${path}.proposal`);
+  const decisionsTruncated = asBoolean(record.decisionsTruncated, `${path}.decisionsTruncated`);
+  const affectedDecisionCount = record.affectedDecisionCount === null ? null : asCount(record.affectedDecisionCount, `${path}.affectedDecisionCount`);
+  let reviewToken;
+  if (record.reviewToken === null) {
+    reviewToken = null;
+  } else {
+    reviewToken = asString(record.reviewToken, `${path}.reviewToken`, {
+      max: 64,
+      nonempty: true
+    });
+    if (!REVIEW_TOKEN_RE.test(reviewToken)) {
+      contractError(`${path}.reviewToken`, "must be a canonical lowercase SHA-256 token");
+    }
+  }
+  if (!decisionsTruncated && affectedDecisionCount === null) {
+    contractError(path, "cannot claim a complete decision list with an unknown count");
+  }
+  if (!decisionsTruncated && affectedDecisionCount !== decisions.length) {
+    contractError(path, "has a complete decision count that does not match its projection");
+  }
+  if (decisionsTruncated && affectedDecisionCount !== null && affectedDecisionCount <= decisions.length) {
+    contractError(path, "claims truncation without a larger affected-decision count");
+  }
+  if (decisionsTruncated && reviewToken !== null) {
+    contractError(path, "must not expose a review token for a truncated decision set");
+  }
+  if (reviewToken !== null && (proposal.proposedSha === void 0 || proposal.proposedTier === void 0 || proposal.proposedSha === proposal.deadCommitSha)) {
+    contractError(path, "must not expose a review token without a valid replacement candidate");
+  }
+  return {
+    proposal,
+    decisions,
+    affectedDecisionCount,
+    decisionsTruncated,
+    reviewToken
+  };
+}
+function parseListPage(value, pageNumber) {
+  const path = `page ${String(pageNumber)}`;
+  const record = asRecord(value, path);
+  assertKeys(record, path, ["repairs", "isDone", "nextCursor", "truncated"]);
+  if (!Array.isArray(record.repairs) || record.repairs.length > MAX_REPAIRS_PER_PAGE) {
+    contractError(`${path}.repairs`, "must be a bounded array");
+  }
+  const isDone = asBoolean(record.isDone, `${path}.isDone`);
+  const truncated = asBoolean(record.truncated, `${path}.truncated`);
+  if (truncated === isDone) contractError(path, "has inconsistent isDone/truncated flags");
+  let nextCursor;
+  if (record.nextCursor === null) {
+    nextCursor = null;
+  } else {
+    nextCursor = asString(record.nextCursor, `${path}.nextCursor`, {
+      max: MAX_CURSOR_LENGTH,
+      nonempty: true
+    });
+  }
+  if (isDone && nextCursor !== null) contractError(path, "is done but includes a next cursor");
+  if (!isDone && nextCursor === null) contractError(path, "is incomplete without a next cursor");
+  return {
+    repairs: record.repairs.map(
+      (item, index) => parseListItem(item, `${path}.repairs[${String(index)}]`)
+    ),
+    isDone,
+    nextCursor,
+    truncated
+  };
+}
+function effectivePageLimit(deps) {
+  if (deps.maxPages === void 0) return MAX_REPAIR_LIST_PAGES;
+  if (!Number.isSafeInteger(deps.maxPages) || deps.maxPages < 1) {
+    throw new RepairListContractError("configured page limit must be a positive safe integer");
+  }
+  return Math.min(deps.maxPages, MAX_REPAIR_LIST_PAGES);
+}
+function listPath(cursor) {
+  if (cursor === null) return "/api/cli/decisions/repairs";
+  const search = new URLSearchParams({ cursor });
+  return `/api/cli/decisions/repairs?${search.toString()}`;
+}
+async function fetchRepairsWithClient(client, deps) {
+  const repairs = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  const seenProposalIds = /* @__PURE__ */ new Set();
+  const pageLimit = effectivePageLimit(deps);
+  let cursor = null;
+  for (let pageNumber = 1; pageNumber <= pageLimit; pageNumber += 1) {
+    let rawPage;
+    try {
+      rawPage = await client.get(listPath(cursor), {
+        signal: AbortSignal.timeout(REPAIRS_TIMEOUT_MS)
+      });
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 403) {
+        throw new RepairAuthorizationError();
+      }
+      if (error instanceof HttpError && error.status === 404) {
+        throw new RepairEndpointVersionError();
+      }
+      throw error;
+    }
+    const page = parseListPage(rawPage, pageNumber);
+    for (const item of page.repairs) {
+      if (seenProposalIds.has(item.proposal._id)) {
+        contractError(`page ${String(pageNumber)}`, "repeats a proposal from an earlier page");
+      }
+      seenProposalIds.add(item.proposal._id);
+      repairs.push(item);
+    }
+    if (page.isDone) {
+      return { repairs, isDone: true, nextCursor: null, truncated: false };
+    }
+    const nextCursor = page.nextCursor;
+    if (nextCursor === null)
+      contractError(`page ${String(pageNumber)}`, "has no continuation cursor");
+    if (nextCursor === cursor || seenCursors.has(nextCursor)) {
+      contractError(`page ${String(pageNumber)}`, "has a repeated or non-advancing cursor");
+    }
+    seenCursors.add(nextCursor);
+    cursor = nextCursor;
+  }
+  throw new RepairListContractError(
+    `pagination did not finish within ${String(pageLimit)} page(s); no partial result was emitted`
+  );
+}
+async function fetchRepairs(deps = defaultDeps6) {
+  return fetchRepairsWithClient(deps.getClient(), deps);
+}
+function normalizedResolutionInput(proposalId, expectedProposedSha) {
+  if (proposalId.length === 0 || proposalId.length > 256) {
+    throw new RepairResolutionInputError("proposal ID must be a non-empty bounded string");
+  }
+  if (!SHA_INPUT_RE.test(expectedProposedSha)) {
+    throw new RepairResolutionInputError("expected proposed SHA must be a 40-character Git SHA");
+  }
+  return { proposalId, expectedProposedSha: expectedProposedSha.toLowerCase() };
+}
+function parseResolutionOutcome(value, action) {
+  const record = asRecord(value, "resolution response");
+  const allowed = action === "confirm" ? ["confirmed", "already_applied", "disabled", "no_op", "stale"] : ["rejected", "already_applied", "no_op", "stale"];
+  if (record.status === "backoff") {
+    assertKeys(record, "resolution response", ["status", "retryAt"]);
+    if (action !== "confirm") {
+      contractError("resolution response.status", "backoff is impossible for reject");
+    }
+    return {
+      status: "backoff",
+      retryAt: asTimestamp(record.retryAt, "resolution response.retryAt")
+    };
+  }
+  assertKeys(record, "resolution response", ["status"]);
+  if (typeof record.status !== "string" || !allowed.includes(record.status)) {
+    contractError("resolution response.status", "is not a supported outcome");
+  }
+  return { status: record.status };
+}
+function normalizedReviewToken(value) {
+  if (value === void 0 || !REVIEW_TOKEN_INPUT_RE.test(value)) {
+    throw new RepairResolutionInputError(
+      "confirm requires --review-token with the 64-character token from the reviewed list"
+    );
+  }
+  return value.toLowerCase();
+}
+function parseConflictOutcome(value, action) {
+  const record = asRecord(value, "resolution conflict response");
+  assertKeys(record, "resolution conflict response", ["status"]);
+  if (action !== "confirm") {
+    contractError(
+      "resolution conflict response.status",
+      "a review conflict is impossible for reject"
+    );
+  }
+  if (record.status !== "review_too_large" && record.status !== "stale_review") {
+    contractError("resolution conflict response.status", "is not a supported 409 outcome");
+  }
+  return { status: record.status };
+}
+async function resolveRepair(proposalId, expectedProposedSha, action, expectedReviewToken, deps = defaultDeps6) {
+  const normalized = normalizedResolutionInput(proposalId, expectedProposedSha);
+  const reviewToken = action === "confirm" ? normalizedReviewToken(expectedReviewToken) : void 0;
+  if (action === "reject" && expectedReviewToken !== void 0) {
+    throw new RepairResolutionInputError("--review-token is valid only with confirm");
+  }
+  const client = deps.getClient();
+  const wireAction = action === "confirm" ? REVIEWED_CONFIRM_WIRE_ACTION : "reject";
+  try {
+    const rawOutcome = await client.post(
+      "/api/cli/decisions/repairs/resolve",
+      {
+        id: normalized.proposalId,
+        action: wireAction,
+        expectedProposedSha: normalized.expectedProposedSha,
+        ...reviewToken === void 0 ? {} : { expectedReviewToken: reviewToken }
+      },
+      { signal: AbortSignal.timeout(REPAIRS_TIMEOUT_MS) }
+    );
+    return {
+      proposalId: normalized.proposalId,
+      action,
+      outcome: parseResolutionOutcome(rawOutcome, action)
+    };
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404 && error.message === "Repair proposal not found") {
+      throw new RepairProposalNotFoundError(normalized.proposalId);
+    }
+    if (error instanceof HttpError && error.status === 404) {
+      throw new RepairEndpointVersionError();
+    }
+    if (error instanceof HttpError && error.status === 403) {
+      throw new RepairAuthorizationError();
+    }
+    if (action === "confirm" && error instanceof HttpError && error.status === 400 && (error.message === LEGACY_REPAIR_BODY_ERROR || error.message === LEGACY_CONFIRM_PROTOCOL_ERROR)) {
+      throw new RepairEndpointVersionError();
+    }
+    if (error instanceof HttpError && error.status === 409) {
+      return {
+        proposalId: normalized.proposalId,
+        action,
+        outcome: parseConflictOutcome(error.body, action)
+      };
+    }
+    throw error;
+  }
+}
+function shortSha(sha) {
+  return sha === void 0 ? "(missing)" : sha.slice(0, 12);
+}
+function tierLabel(tier) {
+  if (tier === "exact_patch_body") return "exact patch body";
+  if (tier === "exact_file_set") return "exact file set";
+  return "match tier missing";
+}
+function oneLine(value) {
+  return stripControlChars(value.replace(/\s+/gu, " ")).trim();
+}
+function timestampLabel(value) {
+  const timestamp = new Date(value);
+  return Number.isNaN(timestamp.getTime()) ? String(value) : `${timestamp.toISOString()} (${String(value)})`;
+}
+function reviewLabel(item) {
+  if (item.affectedDecisionCount === null) {
+    return `showing ${String(item.decisions.length)}; total unknown; confirmation disabled`;
+  }
+  if (item.decisionsTruncated) {
+    return `showing ${String(item.decisions.length)} of ${String(item.affectedDecisionCount)}; confirmation disabled`;
+  }
+  if (item.affectedDecisionCount > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
+    return `${String(item.affectedDecisionCount)} affected; exceeds CLI review limit ${String(MAX_REPAIR_DECISIONS_FOR_CONFIRM)}; confirmation disabled`;
+  }
+  if (item.affectedDecisionCount === 0) {
+    return "0 affected; confirmation disabled";
+  }
+  return `${String(item.affectedDecisionCount)} affected; complete`;
+}
+function canRenderConfirm(item) {
+  return item.proposal.proposedSha !== void 0 && !item.decisionsTruncated && item.affectedDecisionCount !== null && item.affectedDecisionCount > 0 && item.affectedDecisionCount <= MAX_REPAIR_DECISIONS_FOR_CONFIRM && item.reviewToken !== null;
+}
+function shellArg(value) {
+  if (/^[a-zA-Z0-9_./:@%+=,-]+$/u.test(value)) return value;
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function proposalReviewLabel(item) {
+  if (item.proposal.status === "confirmed") {
+    return canRenderConfirm(item) ? "already confirmed; a guarded application retry may be requested when eligible" : "already confirmed; a guarded retry is currently unavailable";
+  }
+  if (item.proposal.status === "verification_failed") {
+    return canRenderConfirm(item) ? "prior verification failed; eligible for a fresh confirmation" : "prior verification failed; confirmation is currently unavailable";
+  }
+  return canRenderConfirm(item) ? "awaiting operator review" : "awaiting review; confirmation is currently unavailable";
+}
+function formatRepairsHuman(result) {
+  if (result.repairs.length === 0) {
+    return "[prim] decision repairs \xB7 0 review-visible proposals \xB7 complete paginated scan";
+  }
+  const lines = [
+    `[prim] decision repairs \xB7 ${String(result.repairs.length)} review-visible proposal(s) \xB7 complete paginated scan`
+  ];
+  for (const item of result.repairs) {
+    const { proposal, decisions } = item;
+    const renderedProposalId = oneLine(proposal._id);
+    lines.push(
+      `  ${renderedProposalId} [${proposal.status}] \xB7 ${oneLine(proposal.repoFullName)} \xB7 ${shortSha(proposal.deadCommitSha)} -> ${shortSha(proposal.proposedSha)} \xB7 ${tierLabel(proposal.proposedTier)}`,
+      `    review state: ${proposalReviewLabel(item)}`
+    );
+    if (proposal.signals.length > 0) {
+      lines.push(`    signals: ${proposal.signals.map(oneLine).join("; ")}`);
+    }
+    if (proposal.nextEvaluateAt !== void 0) {
+      lines.push(`    next proposal evaluation: ${timestampLabel(proposal.nextEvaluateAt)}`);
+    }
+    lines.push(`    decisions (${reviewLabel(item)}):`);
+    for (const decision of decisions) {
+      const id = renderIdentifier({
+        shortId: decision.shortId === void 0 ? void 0 : oneLine(decision.shortId),
+        id: oneLine(decision._id)
+      });
+      const truncation = decision.intentTruncated ? " [intent truncated]" : "";
+      lines.push(`      - ${id} [${decision.status}] ${oneLine(decision.intent)}${truncation}`);
+    }
+    if (canRenderConfirm(item) && proposal.status === "proposed") {
+      lines.push(
+        `    confirm: prim decisions repairs confirm ${shellArg(renderedProposalId)} ${proposal.proposedSha} --review-token ${item.reviewToken}`
+      );
+    }
+    if (canRenderConfirm(item) && proposal.status === "verification_failed") {
+      lines.push(
+        `    retry verification: prim decisions repairs confirm ${shellArg(renderedProposalId)} ${proposal.proposedSha} --review-token ${item.reviewToken}`
+      );
+    }
+    if (canRenderConfirm(item) && proposal.status === "confirmed") {
+      lines.push(
+        `    guarded retry confirmation: prim decisions repairs confirm ${shellArg(renderedProposalId)} ${proposal.proposedSha} --review-token ${item.reviewToken}`
+      );
+    }
+    if (proposal.proposedSha !== void 0) {
+      lines.push(
+        `    reject:  prim decisions repairs reject ${shellArg(renderedProposalId)} ${proposal.proposedSha}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function formatRepairsJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+function formatRepairResolutionHuman(result) {
+  const proposalId = oneLine(result.proposalId);
+  switch (result.outcome.status) {
+    case "confirmed":
+      return `[prim] repair ${proposalId} confirmed; fresh landing verification queued. No Decision was changed by this response.`;
+    case "rejected":
+      return `[prim] repair ${proposalId} rejected.`;
+    case "already_applied":
+      return `[prim] repair ${proposalId} was already applied; nothing to change.`;
+    case "backoff":
+      return `[prim] repair ${proposalId} is in application retry backoff; nothing changed. Retry at ${timestampLabel(result.outcome.retryAt)}.`;
+    case "disabled":
+      return `[prim] repair ${proposalId} was not confirmed because repair application is disabled; nothing changed.`;
+    case "review_too_large":
+      return `[prim] repair ${proposalId} was refused because its complete review exceeds the safe bound; nothing changed.`;
+    case "stale_review":
+      return `[prim] repair ${proposalId} changed after review; re-list and review the current decision set before confirming with its new token. Nothing changed.`;
+    case "stale":
+      return `[prim] repair ${proposalId} has a different proposed SHA; refresh the repair list before acting. Nothing changed.`;
+    case "no_op":
+      return `[prim] repair ${proposalId} cannot be ${result.action === "confirm" ? "confirmed" : "rejected"} in its current state; nothing changed.`;
+  }
+}
+function formatRepairResolutionJson(result) {
+  return JSON.stringify(result.outcome, null, 2);
+}
+
 // src/decisions/show.ts
 var NOT_FOUND_RE4 = /not found/i;
 function colorStatus(status) {
@@ -3406,14 +3937,14 @@ function colorStatus(status) {
   return color(status, "gray");
 }
 var SHOW_TIMEOUT_MS = 1e4;
-var defaultDeps6 = { getClient };
+var defaultDeps7 = { getClient };
 var DecisionNotFoundError = class extends Error {
   constructor(idOrShortId) {
     super(`Decision not found: ${idOrShortId}`);
     this.name = "DecisionNotFoundError";
   }
 };
-async function fetchShow(idOrShortId, deps = defaultDeps6) {
+async function fetchShow(idOrShortId, deps = defaultDeps7) {
   const params = new URLSearchParams({ id: idOrShortId });
   const client = deps.getClient();
   try {
@@ -3547,7 +4078,33 @@ async function askConfirmation(question, output = process.stdout) {
 
 // src/commands/decisions.ts
 var EXIT_NOT_FOUND = 4;
+var EXIT_FAILURE = 1;
 var EXIT_USAGE = 2;
+function handleRepairCommandError(error) {
+  if (error instanceof RepairProposalNotFoundError) {
+    console.error(`[prim] ${error.message}`);
+    process.exitCode = EXIT_NOT_FOUND;
+    return true;
+  }
+  if (error instanceof RepairResolutionInputError) {
+    console.error(`[prim] ${error.message}`);
+    process.exitCode = EXIT_USAGE;
+    return true;
+  }
+  if (error instanceof RepairAuthorizationError || error instanceof HttpError && error.status === 403) {
+    console.error(
+      `[prim] ${error instanceof RepairAuthorizationError ? error.message : "Not authorized to review commit repairs; active organization membership and current repository authorization are required"}`
+    );
+    process.exitCode = EXIT_FAILURE;
+    return true;
+  }
+  if (error instanceof RepairEndpointVersionError || error instanceof RepairListContractError) {
+    console.error(`[prim] ${error.message}`);
+    process.exitCode = EXIT_FAILURE;
+    return true;
+  }
+  return false;
+}
 var CREATE_INACTIVE_PROMPT = "[prim] Decision ingestion is disabled here. Create this one Decision without enabling passive ingestion?";
 var CREATE_INACTIVE_APPROVED = "[prim] one-time Decision creation approved; passive ingestion remains disabled here";
 var CREATE_INACTIVE_REJECTED = "[prim] decision not created: Decision ingestion is disabled here; rerun with prim's --yes to approve this one Decision, or run `prim enable` in a Git project";
@@ -3626,6 +4183,46 @@ function registerDecisionsCommands(program2) {
       throw err;
     }
   });
+  const repairs = decisions.command("repairs").description("Review human-gated commit rewrite repair proposals").action(runRepairsList);
+  async function runRepairsList() {
+    try {
+      const result = await fetchRepairs();
+      console.error(formatRepairsHuman(result));
+      console.log(formatRepairsJson(result));
+    } catch (error) {
+      if (handleRepairCommandError(error)) return;
+      throw error;
+    }
+  }
+  repairs.command("list").description("List review-visible commit rewrite repair proposals").action(runRepairsList);
+  const registerRepairResolution = (action) => {
+    const resolution = repairs.command(`${action} <proposalId> <proposedSha>`).description(
+      action === "confirm" ? "Confirm the exact reviewed decision set and queue fresh landing verification" : "Reject a proposal and remember its proposed SHA"
+    );
+    if (action === "confirm") {
+      resolution.option(
+        "--review-token <token>",
+        "64-character token printed with the complete reviewed decision set (required)"
+      );
+    }
+    resolution.action(
+      async (proposalId, proposedSha, options) => {
+        try {
+          const result = await resolveRepair(proposalId, proposedSha, action, options.reviewToken);
+          console.error(formatRepairResolutionHuman(result));
+          console.log(formatRepairResolutionJson(result));
+          if (result.outcome.status === "review_too_large" || result.outcome.status === "stale_review") {
+            process.exitCode = EXIT_USAGE;
+          }
+        } catch (error) {
+          if (handleRepairCommandError(error)) return;
+          throw error;
+        }
+      }
+    );
+  };
+  registerRepairResolution("confirm");
+  registerRepairResolution("reject");
   decisions.command("create").description("Record a decision directly with its explicit user or agent origin").requiredOption("--intent <text>", "What was decided (required)").addOption(
     new Option2(
       "--attribution <origin>",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.66",
+  "version": "0.1.0-alpha.67",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",