@primitive.ai/prim 0.1.0-alpha.67 → 0.1.0-alpha.69

package/README.md

@@ -94,6 +94,23 @@ Orchestrates auth → session hooks → supervised daemon → capture-health gat
 re-running each underlying command so every step behaves exactly as if run by
 hand (including the browser login). Idempotent — safe to re-run.
 
+### Uninstall
+
+```bash
+prim uninstall
+```
+
+Stops the companion daemon, removes the current repository's Prim-owned agent
+and Git-hook surfaces when run inside a Git repository, removes the user-scoped
+Claude, Codex, Hermes, and Git-hook surfaces, then deletes only schema-valid
+Prim runtime bytes. Foreign configuration is retained; ambiguous ownership
+makes the command fail closed and retain the runtimes. If a removal races or
+fails after one runtime changes, its JSON result reports each runtime's exact
+state so rerunning can safely finish cleanup. Authentication,
+undelivered journals, repository bindings, and agent skill guidance are kept.
+Use `prim skill uninstall --agent <claude|codex|hermes> --scope <project|user>`
+when you also want to remove a known skill target.
+
 ### Auth
 
 ```bash
@@ -101,8 +118,23 @@ prim auth login              # Authenticate via browser
 prim auth set-token <token>  # Save a bearer token (e.g. for CI)
 prim auth clear              # Remove saved tokens
 prim auth status             # Check authentication status
+prim auth api-keys mint --name <name> [--expires-at <epoch-ms>] # Mint a user key; secret prints once
+prim auth api-keys list [--limit <count>] [--after <api-key-id>] # List user-key metadata
+prim auth api-keys revoke <api-key-id> # Revoke a user key
+```
+
+### GitHub
+
+```bash
+prim github connect              # Install or reuse the Primitive GitHub App for this checkout
+prim github connect --no-browser # Print the installation URL without opening it
 ```
 
+The command first reuses existing repository access. When access is missing, it creates a
+server-owned GitHub App installation intent, opens its installation URL unless browser opening is
+suppressed, polls the same intent, then verifies and persists this checkout's binding. A completed
+installation without admin access to this repository remains truthfully unbound.
+
 ### Session integration
 
 Wires the agent's session hooks so the decisions you make are captured into the
@@ -145,13 +177,19 @@ unless Prim's global `--yes` is present.
 #### Claude decision feedback
 
 Claude Code receives eventual, human-visible feedback when automatic capture
-creates an accepted `change` Decision. A later Claude `Stop` or fresh
+creates a `change` Decision. A later Claude `Stop` or fresh
 `SessionStart` in the same Git worktree can display:
 
 ```text
 [prim] response → created Decision (dec_a1b2c3d4): Use the stable API (https://app.getprimitive.ai/decisions/r571n1dqjdrtyxxpf0fnzee4gn8aed6q)
 ```
 
+An author-private draft uses an actionable publish prompt instead:
+
+```text
+[prim] publish this Decision draft (dec_a1b2c3d4)? Use the stable API (https://app.getprimitive.ai/decisions/r571n1dqjdrtyxxpf0fnzee4gn8aed6q) Run `prim decisions publish decision-full-1` to share it with your team.
+```
+
 This is a hook `systemMessage` for the person using Claude Code; it is not
 injected into the model's context. Delivery is at-least-once at the stdout
 handoff boundary: prim acknowledges only after writing the hook response, so a

package/SKILL.md

@@ -20,7 +20,7 @@ Run `npx --yes @primitive.ai/prim auth status` first. It exits **0 if authentica
 Three ways to authenticate, in priority order:
 
 1. **`PRIM_TOKEN` environment variable** -- preferred for agents and CI. Set it before invoking prim and you're done; no interactive flow, no token files.
-2. **`npx --yes @primitive.ai/prim auth set-token <token>`** -- saves a bearer token to `~/.config/prim/token`. Use when the user has a long-lived token in hand.
+2. **`npx --yes @primitive.ai/prim auth set-token <token>`** -- saves a bearer token in Primitive's config directory (`PRIM_CONFIG_DIR`, then `$XDG_CONFIG_HOME/prim`, default `~/.config/prim`). Use when the user has a long-lived token in hand.
 3. **`npx --yes @primitive.ai/prim auth login`** -- opens a browser via WorkOS OAuth. **Drive this yourself; do not hand it to the user.** It blocks up to 2 minutes waiting for approval -- that wait is expected, not a failure. The user's only action is clicking "Authorize". Run it in the background, surface the authorize URL it prints on STDERR so the user can click it if the browser didn't open, then poll `auth status` until it exits 0. If it times out before they click, run it again -- never fall back to asking them to run it.
 
 The CLI auto-refreshes a still-valid session from the stored refresh token (proactively ~60s before expiry, and again on a 401), so a short access-token "expires in 2m" is normal -- not a reason to re-authenticate or warn the user. Only an absent refresh token, or an explicit `Authentication expired. Run prim auth login to re-authenticate.`, warrants a re-login -- which you then drive yourself, per the above. Relay that message if it appears.

package/dist/{chunk-XPVNH3J6.js → chunk-2KW7DVFJ.js}

@@ -1,34 +1,68 @@
 import {
-  clearRepoSyncId,
+  binFile,
+  compareSemver,
+  pinnedNpxCommand
+} from "./chunk-4A2XB2PC.js";
+import {
   gitToplevel,
   githubRepositoryFullName,
   isValidRepoSyncId,
-  setRepoSyncId
-} from "./chunk-TDRXHBEX.js";
+  setRepoSyncId,
+  setRepositoryBindingState
+} from "./chunk-TJTVHDJ5.js";
 import {
   HttpError,
+  atomicWriteFile,
   getClient,
   withFileLock
-} from "./chunk-RTLFE6EZ.js";
+} from "./chunk-Z7YPFWAZ.js";
+
+// src/lib/bin-cache.ts
+import { chmodSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var GIT_HOOK_CACHE_SHELL_DIR = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
+var GIT_HOOK_CACHE_TTL_MINUTES = 1440;
+var GIT_HOOK_CACHED_BINS = ["prim-post-commit", "prim-post-rewrite"];
+function binCacheDir() {
+  const base = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
+  return join(base, "prim", "bin");
+}
+function writeAtomic(path, content) {
+  atomicWriteFile(path, content, { mode: 384 });
+}
+function warmBinCache() {
+  try {
+    if (process.env.PRIM_BIN_CACHE === "0") {
+      return;
+    }
+    const dir = binCacheDir();
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+    writeAtomic(join(dir, "node"), process.execPath);
+    for (const bin of GIT_HOOK_CACHED_BINS) {
+      const file = binFile(bin);
+      if (file) {
+        writeAtomic(join(dir, bin), file);
+      }
+    }
+  } catch {
+  }
+}
 
 // src/commands/skill.ts
-import { randomUUID } from "crypto";
 import {
   constants as constants2,
   closeSync as closeSync2,
   existsSync as existsSync2,
   fstatSync as fstatSync2,
-  fsyncSync,
   lstatSync as lstatSync2,
   openSync as openSync2,
   readFileSync as readFileSync2,
-  readSync as readSync2,
-  renameSync,
-  rmSync as rmSync2,
-  writeFileSync
+  readSync as readSync2
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
 import { parse as parseYaml2 } from "yaml";
@@ -46,7 +80,7 @@ import {
   existsSync,
   fstatSync,
   lstatSync,
-  mkdirSync,
+  mkdirSync as mkdirSync2,
   openSync,
   readFileSync,
   readSync,
@@ -55,49 +89,10 @@ import {
   rmSync,
   rmdirSync
 } from "fs";
-import { homedir } from "os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname, isAbsolute, join as join2, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { parse as parseYaml } from "yaml";
-
-// src/lib/semver.ts
-function parseSemver(value) {
-  if (typeof value !== "string" || value.length > 256) return;
-  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(
-    value
-  );
-  if (!match) return;
-  const prerelease = match[4]?.split(".") ?? [];
-  if (prerelease.some((part) => /^\d+$/u.test(part) && part.length > 1 && part.startsWith("0"))) {
-    return;
-  }
-  return { core: [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])], prerelease };
-}
-function compareSemver(left, right) {
-  const a = parseSemver(left);
-  const b = parseSemver(right);
-  if (!a || !b) return;
-  for (let i = 0; i < a.core.length; i += 1) {
-    if (a.core[i] !== b.core[i]) return a.core[i] < b.core[i] ? -1 : 1;
-  }
-  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
-    return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
-  }
-  for (let i = 0; i < Math.max(a.prerelease.length, b.prerelease.length); i += 1) {
-    const x = a.prerelease[i];
-    const y = b.prerelease[i];
-    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
-    if (x === y) continue;
-    const xNumeric = /^\d+$/u.test(x);
-    const yNumeric = /^\d+$/u.test(y);
-    if (xNumeric && yNumeric) return BigInt(x) < BigInt(y) ? -1 : 1;
-    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1;
-    return x < y ? -1 : 1;
-  }
-  return 0;
-}
-
-// src/commands/claude-plugin.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var PLUGIN_DESCRIPTION = "Primitive decision-graph guidance for the prim CLI \u2014 a model-invoked skill installed by prim skill install.";
 var MAX_MANIFEST_BYTES = 64 * 1024;
@@ -105,8 +100,8 @@ var MAX_SKILL_BYTES = 1024 * 1024;
 var REFRESH_LOCK_TIMEOUT_MS = 150;
 var REFRESH_LOCK_POLL_MS = 10;
 function pluginDirFor(cwd, scope) {
-  const base = scope === "user" ? join(homedir(), ".claude") : join(gitToplevel(cwd) ?? cwd, ".claude");
-  return join(base, "skills", "prim");
+  const base = scope === "user" ? join2(homedir2(), ".claude") : join2(gitToplevel(cwd) ?? cwd, ".claude");
+  return join2(base, "skills", "prim");
 }
 function resolvePluginDir(cwd, scope) {
   if (scope && scope !== "user" && scope !== "project") {
@@ -138,8 +133,8 @@ function removeDirIfEmpty(dir) {
 }
 function pluginPaths(dir) {
   return {
-    manifestPath: join(dir, ".claude-plugin", "plugin.json"),
-    skillPath: join(dir, "SKILL.md")
+    manifestPath: join2(dir, ".claude-plugin", "plugin.json"),
+    skillPath: join2(dir, "SKILL.md")
   };
 }
 function pathIsInside(root, path) {
@@ -204,9 +199,9 @@ function inspectRecognizedInstallation(paths, projectRoot) {
   };
 }
 function refreshLockDir(physicalPluginDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
+  const cacheRoot = process.env.XDG_CACHE_HOME || join2(homedir2(), ".cache");
   const identity = createHash("sha256").update(physicalPluginDir).digest("hex");
-  return join(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
+  return join2(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
 }
 async function refreshClaudePlugins(cwd, options = {}) {
   const result = { installed: 0, refreshed: 0 };
@@ -214,7 +209,7 @@ async function refreshClaudePlugins(cwd, options = {}) {
   if (options.includeProject !== false) {
     const projectRoot = options.projectRoot ?? gitToplevel(cwd);
     if (projectRoot !== null && isAbsolute(projectRoot)) {
-      candidates.push({ dir: join(projectRoot, ".claude", "skills", "prim"), projectRoot });
+      candidates.push({ dir: join2(projectRoot, ".claude", "skills", "prim"), projectRoot });
     }
   }
   candidates.push({ dir: pluginDirFor(cwd, "user") });
@@ -290,7 +285,7 @@ function installClaudePlugin(cwd, opts) {
     console.log(`Would write plugin to ${dir} (.claude-plugin/plugin.json + SKILL.md)`);
     return 0;
   }
-  mkdirSync(join(dir, ".claude-plugin"), { recursive: true });
+  mkdirSync2(join2(dir, ".claude-plugin"), { recursive: true });
   atomicWrite(manifestPath, manifest);
   atomicWrite(skillPath, skill);
   console.log(`Installed prim skill plugin at ${dir}`);
@@ -310,7 +305,7 @@ function uninstallClaudePlugin(cwd, opts) {
   }
   rmSync(manifestPath, { force: true });
   rmSync(skillPath, { force: true });
-  removeDirIfEmpty(join(dir, ".claude-plugin"));
+  removeDirIfEmpty(join2(dir, ".claude-plugin"));
   removeDirIfEmpty(dir);
   console.log(`Removed prim skill plugin from ${dir}`);
   return 0;
@@ -365,10 +360,10 @@ function readCodexGuidance(path) {
   }
 }
 function effectiveCodexGuidance(scope) {
-  const override = readCodexGuidance(join2(scope, "AGENTS.override.md"));
+  const override = readCodexGuidance(join3(scope, "AGENTS.override.md"));
   if (override === null) return null;
   if (override !== void 0 && override.toString("utf8").trim().length > 0) return override;
-  const base = readCodexGuidance(join2(scope, "AGENTS.md"));
+  const base = readCodexGuidance(join3(scope, "AGENTS.md"));
   return base ?? null;
 }
 function hasUsablePrimBlock(content, visibleBytes) {
@@ -391,7 +386,7 @@ function hasUsablePrimBlock(content, visibleBytes) {
 }
 function hasUsableCodexGuidance(projectRoot) {
   try {
-    const codexHome = process.env.CODEX_HOME?.trim() ? resolve2(process.env.CODEX_HOME) : join2(homedir2(), ".codex");
+    const codexHome = process.env.CODEX_HOME?.trim() ? resolve2(process.env.CODEX_HOME) : join3(homedir3(), ".codex");
     const scopes = [
       { path: codexHome, visibleBytes: CODEX_GUIDANCE_LIMIT_BYTES },
       { path: projectRoot, visibleBytes: CODEX_DEFAULT_PROJECT_GUIDANCE_BYTES }
@@ -419,10 +414,10 @@ var AGENT_TARGET = {
   hermes: ".hermes.md"
 };
 function userTargetFor(agent) {
-  if (agent === "claude") return join2(homedir2(), ".claude", "CLAUDE.md");
-  if (agent === "codex") return join2(homedir2(), ".codex", "AGENTS.md");
+  if (agent === "claude") return join3(homedir3(), ".claude", "CLAUDE.md");
+  if (agent === "codex") return join3(homedir3(), ".codex", "AGENTS.md");
   if (agent === "hermes") {
-    return join2(process.env.HERMES_HOME ?? join2(homedir2(), ".hermes"), ".hermes.md");
+    return join3(process.env.HERMES_HOME ?? join3(homedir3(), ".hermes"), ".hermes.md");
   }
   return null;
 }
@@ -463,27 +458,7 @@ function removeBlock(existing) {
   return out.replace(/(\r?\n){2,}$/, "$1");
 }
 function atomicWrite(target, content) {
-  const tmp = `${target}.${randomUUID()}.tmp`;
-  let temporaryCreated = false;
-  try {
-    const fd = openSync2(tmp, "wx");
-    temporaryCreated = true;
-    try {
-      writeFileSync(fd, content);
-      fsyncSync(fd);
-    } finally {
-      closeSync2(fd);
-    }
-    renameSync(tmp, target);
-  } catch (error) {
-    if (temporaryCreated) {
-      try {
-        rmSync2(tmp, { force: true });
-      } catch {
-      }
-    }
-    throw error;
-  }
+  atomicWriteFile(target, content);
 }
 function resolveTarget(cwd, opts) {
   if (opts.scope && opts.scope !== "user" && opts.scope !== "project") {
@@ -597,20 +572,20 @@ function registerSkillCommands(program) {
 
 // src/lib/post-commit-hook.ts
 import { execFileSync } from "child_process";
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID } from "crypto";
 import {
   constants as constants3,
   closeSync as closeSync3,
   existsSync as existsSync3,
   fchmodSync,
-  fsyncSync as fsyncSync2,
+  fsyncSync,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   openSync as openSync3,
   readFileSync as readFileSync3,
-  renameSync as renameSync2,
+  renameSync,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync
 } from "fs";
 import { basename, dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
 var PRIM_POST_COMMIT_BLOCK_START = "# >>> prim post-commit hook >>>";
@@ -656,9 +631,9 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   if [ -n "$prim_commit_sha" ]; then
     prim_commit_observed_file=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_commit_observed_file=
     prim_commit_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_commit_branch=
-    prim_cache_dir="\${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin"
+    prim_cache_dir="${GIT_HOOK_CACHE_SHELL_DIR}"
     prim_post_commit_ran=0
-    if [ "\${PRIM_BIN_CACHE:-1}" != "0" ] && [ -f "$prim_cache_dir/prim-post-commit" ] && [ -f "$prim_cache_dir/node" ] && [ -n "$(find "$prim_cache_dir/prim-post-commit" -mmin "-\${PRIM_BIN_CACHE_TTL_MIN:-1440}" 2>/dev/null)" ]; then
+    if [ "\${PRIM_BIN_CACHE:-1}" != "0" ] && [ -f "$prim_cache_dir/prim-post-commit" ] && [ -f "$prim_cache_dir/node" ] && [ -n "$(find "$prim_cache_dir/prim-post-commit" -mmin "-\${PRIM_BIN_CACHE_TTL_MIN:-${GIT_HOOK_CACHE_TTL_MINUTES}}" 2>/dev/null)" ]; then
       prim_node=$(cat "$prim_cache_dir/node")
       prim_entry=$(cat "$prim_cache_dir/prim-post-commit")
       if [ -x "$prim_node" ] && [ -f "$prim_entry" ]; then
@@ -666,14 +641,9 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
         prim_post_commit_ran=1
       fi
     fi
-    if [ "$prim_post_commit_ran" -eq 0 ]; then
-      if [ -x "./node_modules/.bin/prim-post-commit" ]; then
-        ( trap '' HUP; trap 'if [ -n "$prim_commit_observed_file" ]; then rm -f "$prim_commit_observed_file"; fi' 0; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch" PRIM_COMMIT_OBSERVED_FILE="$prim_commit_observed_file"; ./node_modules/.bin/prim-post-commit ) </dev/null >/dev/null 2>&1 &
-        prim_post_commit_ran=1
-      elif command -v npx >/dev/null 2>&1; then
-        ( trap '' HUP; trap 'if [ -n "$prim_commit_observed_file" ]; then rm -f "$prim_commit_observed_file"; fi' 0; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch" PRIM_COMMIT_OBSERVED_FILE="$prim_commit_observed_file"; npx --yes -p @primitive.ai/prim@latest prim-post-commit ) </dev/null >/dev/null 2>&1 &
-        prim_post_commit_ran=1
-      fi
+    if [ "$prim_post_commit_ran" -eq 0 ] && command -v npx >/dev/null 2>&1; then
+      ( trap '' HUP; trap 'if [ -n "$prim_commit_observed_file" ]; then rm -f "$prim_commit_observed_file"; fi' 0; export PRIM_COMMIT_SHA="$prim_commit_sha" PRIM_COMMIT_BRANCH="$prim_commit_branch" PRIM_COMMIT_OBSERVED_FILE="$prim_commit_observed_file"; ${pinnedNpxCommand("prim-post-commit")} ) </dev/null >/dev/null 2>&1 &
+      prim_post_commit_ran=1
     fi
     if [ "$prim_post_commit_ran" -eq 0 ] && [ -n "$prim_commit_observed_file" ]; then
       rm -f "$prim_commit_observed_file"
@@ -701,9 +671,9 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
       if cat > "$prim_rewrite_pairs_file"; then
         exec < "$prim_rewrite_pairs_file"
         prim_rewrite_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_rewrite_branch=
-        prim_cache_dir="\${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin"
+        prim_cache_dir="${GIT_HOOK_CACHE_SHELL_DIR}"
         prim_post_rewrite_ran=0
-        if [ "\${PRIM_BIN_CACHE:-1}" != "0" ] && [ -f "$prim_cache_dir/prim-post-rewrite" ] && [ -f "$prim_cache_dir/node" ] && [ -n "$(find "$prim_cache_dir/prim-post-rewrite" -mmin "-\${PRIM_BIN_CACHE_TTL_MIN:-1440}" 2>/dev/null)" ]; then
+        if [ "\${PRIM_BIN_CACHE:-1}" != "0" ] && [ -f "$prim_cache_dir/prim-post-rewrite" ] && [ -f "$prim_cache_dir/node" ] && [ -n "$(find "$prim_cache_dir/prim-post-rewrite" -mmin "-\${PRIM_BIN_CACHE_TTL_MIN:-${GIT_HOOK_CACHE_TTL_MINUTES}}" 2>/dev/null)" ]; then
           prim_node=$(cat "$prim_cache_dir/node")
           prim_entry=$(cat "$prim_cache_dir/prim-post-rewrite")
           if [ -x "$prim_node" ] && [ -f "$prim_entry" ]; then
@@ -711,14 +681,9 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
             prim_post_rewrite_ran=1
           fi
         fi
-        if [ "$prim_post_rewrite_ran" -eq 0 ]; then
-          if [ -x "./node_modules/.bin/prim-post-rewrite" ]; then
-            ( trap '' HUP; trap 'if [ -n "$prim_rewrite_pairs_file" ]; then rm -f "$prim_rewrite_pairs_file"; fi' 0; export PRIM_REWRITE_SOURCE="$prim_rewrite_source" PRIM_REWRITE_BRANCH="$prim_rewrite_branch" PRIM_REWRITE_PAIRS_FILE="$prim_rewrite_pairs_file"; ./node_modules/.bin/prim-post-rewrite ) </dev/null >/dev/null 2>&1 &
-            prim_post_rewrite_ran=1
-          elif command -v npx >/dev/null 2>&1; then
-            ( trap '' HUP; trap 'if [ -n "$prim_rewrite_pairs_file" ]; then rm -f "$prim_rewrite_pairs_file"; fi' 0; export PRIM_REWRITE_SOURCE="$prim_rewrite_source" PRIM_REWRITE_BRANCH="$prim_rewrite_branch" PRIM_REWRITE_PAIRS_FILE="$prim_rewrite_pairs_file"; npx --yes -p @primitive.ai/prim@latest prim-post-rewrite ) </dev/null >/dev/null 2>&1 &
-            prim_post_rewrite_ran=1
-          fi
+        if [ "$prim_post_rewrite_ran" -eq 0 ] && command -v npx >/dev/null 2>&1; then
+          ( trap '' HUP; trap 'if [ -n "$prim_rewrite_pairs_file" ]; then rm -f "$prim_rewrite_pairs_file"; fi' 0; export PRIM_REWRITE_SOURCE="$prim_rewrite_source" PRIM_REWRITE_BRANCH="$prim_rewrite_branch" PRIM_REWRITE_PAIRS_FILE="$prim_rewrite_pairs_file"; ${pinnedNpxCommand("prim-post-rewrite")} ) </dev/null >/dev/null 2>&1 &
+          prim_post_rewrite_ran=1
         fi
         if [ "$prim_post_rewrite_ran" -eq 0 ]; then
           rm -f "$prim_rewrite_pairs_file"
@@ -1026,10 +991,10 @@ function assertTargetUnchanged(path, expected, spec, stat) {
 }
 function rewriteHookAtomically(path, next, expected, spec, stat) {
   const parent = dirname3(path);
-  mkdirSync2(parent, { recursive: true });
+  mkdirSync3(parent, { recursive: true });
   const temporary = resolve3(
     parent,
-    `.${basename(path)}.prim-${String(process.pid)}-${randomUUID2()}.tmp`
+    `.${basename(path)}.prim-${String(process.pid)}-${randomUUID()}.tmp`
   );
   let fd;
   try {
@@ -1038,13 +1003,13 @@ function rewriteHookAtomically(path, next, expected, spec, stat) {
       constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY | constants3.O_NOFOLLOW,
       stat?.mode ?? 493
     );
-    writeFileSync2(fd, next);
+    writeFileSync(fd, next);
     fchmodSync(fd, (stat?.mode ?? 493) & 4095);
-    fsyncSync2(fd);
+    fsyncSync(fd);
     closeSync3(fd);
     fd = void 0;
     assertTargetUnchanged(path, expected, spec, stat);
-    renameSync2(temporary, path);
+    renameSync(temporary, path);
   } finally {
     if (fd !== void 0) {
       try {
@@ -1353,40 +1318,66 @@ function uninstallPostRewriteHookAtPath(hookPath) {
 }
 
 // src/lib/repository-binding.ts
-async function resolveRepositoryBinding(root, options) {
+var InvalidRepositoryBindingResponseError = class extends Error {
+};
+async function resolveRepositoryBindingWithClient(root, client, options) {
   const repositoryFullName = githubRepositoryFullName(root);
   if (!repositoryFullName) {
     throw new Error("origin must be a GitHub HTTPS/SSH remote in owner/name form");
   }
   let response;
   try {
-    response = await getClient().post(
+    response = await client.post(
       "/api/cli/repositories/bind",
       { repositoryFullName },
       options
     );
   } catch (error) {
     if (error instanceof HttpError && error.status === 404) {
-      return { status: "pending", repositoryFullName };
+      return { status: "unbound", repositoryFullName };
     }
     throw error;
   }
   if (!isValidRepoSyncId(response.repoSyncId)) {
-    throw new Error("server returned no repository binding");
+    throw new InvalidRepositoryBindingResponseError(
+      "server returned an invalid repository binding"
+    );
   }
   return { status: "connected", repoSyncId: response.repoSyncId, repositoryFullName };
 }
-async function bindRepository(root, options) {
-  const binding = await resolveRepositoryBinding(root, options);
+async function resolveRepositoryBinding(root, options) {
+  return resolveRepositoryBindingWithClient(root, getClient(), options);
+}
+function persistRepositoryBinding(root, binding) {
   if (binding.status === "connected") {
-    setRepoSyncId(root, binding.repoSyncId);
-  } else {
-    clearRepoSyncId(root);
+    setRepoSyncId(root, binding.repoSyncId, binding.repositoryFullName);
+    setRepositoryBindingState(root, "connected");
+    return;
   }
+  setRepositoryBindingState(root, "unbound");
+}
+async function bindRepositoryWithClient(root, client, options) {
+  let binding;
+  try {
+    binding = await resolveRepositoryBindingWithClient(root, client, options);
+  } catch (error) {
+    if (error instanceof InvalidRepositoryBindingResponseError) {
+      try {
+        setRepositoryBindingState(root, "invalid");
+      } catch {
+      }
+    }
+    throw error;
+  }
+  persistRepositoryBinding(root, binding);
   return binding;
 }
+async function bindRepository(root, options) {
+  return bindRepositoryWithClient(root, getClient(), options);
+}
 
 export {
+  warmBinCache,
   postCommitHookBlock,
   postRewriteHookBlock,
   ensureEffectivePostCommitHook,
@@ -1400,9 +1391,9 @@ export {
   uninstallPostCommitHookAtPath,
   uninstallPostRewriteHookAtPath,
   resolveRepositoryBinding,
+  bindRepositoryWithClient,
   bindRepository,
   printJson,
-  compareSemver,
   refreshClaudePlugins,
   hasUsableCodexGuidance,
   registerSkillCommands