@primitive.ai/prim 0.1.0-alpha.67 → 0.1.0-alpha.69

package/dist/hooks/post-commit.js

@@ -2,21 +2,24 @@
 import {
   commitAttributionFromEnvironment,
   toCommitMove
-} from "../chunk-CPSE3Y3T.js";
+} from "../chunk-H64F6QHV.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-UN5O5SYG.js";
+} from "../chunk-YWO7O6QG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
+import "../chunk-FI3LIRCB.js";
+import "../chunk-LEMX3IOG.js";
 import {
   githubRepositoryFullName,
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-TDRXHBEX.js";
-import "../chunk-RTLFE6EZ.js";
+} from "../chunk-TJTVHDJ5.js";
+import "../chunk-Z7YPFWAZ.js";
+import "../chunk-3EEFL6NJ.js";
 
 // src/hooks/post-commit.ts
 import { execFileSync, spawn } from "child_process";

package/dist/hooks/post-rewrite.js

@@ -2,21 +2,24 @@
 import {
   canonicalRewritePairs,
   toRewriteMove
-} from "../chunk-CPSE3Y3T.js";
+} from "../chunk-H64F6QHV.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-UN5O5SYG.js";
+} from "../chunk-YWO7O6QG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
+import "../chunk-FI3LIRCB.js";
+import "../chunk-LEMX3IOG.js";
 import {
   githubRepositoryFullName,
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-TDRXHBEX.js";
-import "../chunk-RTLFE6EZ.js";
+} from "../chunk-TJTVHDJ5.js";
+import "../chunk-Z7YPFWAZ.js";
+import "../chunk-3EEFL6NJ.js";
 
 // src/hooks/post-rewrite.ts
 import { execFileSync, spawn } from "child_process";

package/dist/hooks/post-tool-use.js

@@ -1,43 +1,51 @@
 #!/usr/bin/env node
 import {
-  bold,
-  color,
   requireDurableIngestAcknowledgement
-} from "../chunk-JQFN6LBO.js";
+} from "../chunk-XGADQPCI.js";
 import {
   enrichHookPayloadWithFileRefs,
   preserveHookFileMetadata
-} from "../chunk-BDGQEJA5.js";
+} from "../chunk-ZOSNEO5N.js";
 import {
   postToolInvocationId,
   toMove,
   toolOutcomeFor
-} from "../chunk-CPSE3Y3T.js";
+} from "../chunk-H64F6QHV.js";
 import {
   appendMove,
   resolveOrg
-} from "../chunk-UN5O5SYG.js";
+} from "../chunk-YWO7O6QG.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-UVIWZWM6.js";
+import "../chunk-BQUJ4AFJ.js";
+import {
+  appendCodexContext,
+  prepareCodexContext
+} from "../chunk-KKP2NYZ3.js";
+import "../chunk-4A2XB2PC.js";
 import {
   scrubFromCwd
-} from "../chunk-G5D3FF3D.js";
+} from "../chunk-FI3LIRCB.js";
 import {
-  warmBinCache
-} from "../chunk-CZ24W5QU.js";
+  bold,
+  color
+} from "../chunk-LEMX3IOG.js";
 import {
   isRepoActiveForCapture,
   repoSyncId,
   resolveRepositoryContext
-} from "../chunk-TDRXHBEX.js";
+} from "../chunk-TJTVHDJ5.js";
 import {
-  getClient
-} from "../chunk-RTLFE6EZ.js";
+  getClient,
+  terminalSafeLine
+} from "../chunk-Z7YPFWAZ.js";
 import {
   normalizeEnvelope,
   parseAgent
-} from "../chunk-TCDUH7AN.js";
+} from "../chunk-WB7AUZ4C.js";
+import "../chunk-CUE2LKLR.js";
+import "../chunk-3EEFL6NJ.js";
 
 // src/hooks/post-tool-use.ts
 import { readFileSync } from "fs";
@@ -61,7 +69,7 @@ function renderVerdictFooter(ctx) {
   const successPrefix = color("\u2713 Conflict caught before merge", "green");
   const savedCount = `${String(ctx.decisionsSaved)}${ctx.decisionsSavedTruncated ? "+" : ""}`;
   const savedFragment = `${savedCount} decisions saved`;
-  const intentFragment = `${bold(ctx.author)}'s intent preserved`;
+  const intentFragment = `${bold(terminalSafeLine(ctx.author))}'s intent preserved`;
   return `${successPrefix} \xB7 ${savedFragment} \xB7 ${intentFragment}`;
 }
 function isVerdictFooterContext(value) {
@@ -112,8 +120,19 @@ function readStdin() {
     });
   });
 }
-function emit() {
-  process.stdout.write("{}\n");
+async function emit(output = {}) {
+  return await new Promise((resolve) => {
+    try {
+      process.stdout.write(`${JSON.stringify(output)}
+`, (error) => resolve(!error));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function emitWithAcknowledgment(output, acknowledge) {
+  const handedOff = await emit(output);
+  await acknowledge?.(handedOff);
 }
 function debug(msg) {
   if (process.env.PRIM_HOOK_VERBOSE === "1") {
@@ -122,37 +141,36 @@ function debug(msg) {
   }
 }
 async function main() {
-  warmBinCache();
   const agent = parseAgent(process.argv);
   let raw;
   try {
     raw = await readStdin();
   } catch {
-    emit();
+    await emit();
     return;
   }
   let parsed;
   try {
     parsed = normalizeEnvelope(JSON.parse(raw), agent);
   } catch {
-    emit();
+    await emit();
     return;
   }
   let envelope = parsed;
   const isToolResult = envelope.hook_event_name === "PostToolUse" || agent === "claude_code" && envelope.hook_event_name === "PostToolUseFailure";
   const isHermesDenial = agent === "hermes" && envelope.hook_event_name === "post_approval_response" && toolOutcomeFor(parsed, agent) === "prevented";
   if (!isToolResult && !isHermesDenial) {
-    emit();
+    await emit();
     return;
   }
   const invocationId = postToolInvocationId(parsed, agent);
   if (isHermesDenial && !invocationId) {
-    emit();
+    await emit();
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
   if (!isHermesDenial && !editingToolsFor(agent).has(toolName)) {
-    emit();
+    await emit();
     return;
   }
   if (isHermesDenial && (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) && typeof envelope.extra?.session_key === "string" && envelope.extra.session_key.length > 0) {
@@ -160,17 +178,17 @@ async function main() {
     envelope = parsed;
   }
   if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) {
-    emit();
+    await emit();
     return;
   }
   const cwd = parsed.cwd ?? process.cwd();
   if (!isRepoActiveForCapture(cwd)) {
-    emit();
+    await emit();
     return;
   }
   const resolvedRepository = resolveRepositoryContext(cwd);
   if (!resolvedRepository) {
-    emit();
+    await emit();
     return;
   }
   const repository = { ...resolvedRepository, repoSyncId: repoSyncId(cwd) };
@@ -183,11 +201,11 @@ async function main() {
   const { resolution } = enrichment;
   if (!isHermesDenial) {
     if (resolution.shellMutation === "none") {
-      emit();
+      await emit();
       return;
     }
     if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
-      emit();
+      await emit();
       return;
     }
   }
@@ -195,24 +213,38 @@ async function main() {
   const identity = getOrCreateWorkspaceId(cwd);
   const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
   const base = toMove(enriched, resolveCliVersion(), agent, workspaceId, repository, invocationId);
-  const scrubbed = scrubFromCwd(enriched, cwd);
+  const scrubbed = await scrubFromCwd(enriched, cwd);
   const move = {
     ...base,
     payload: preserveHookFileMetadata(scrubbed, resolution)
   };
-  const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd: move.env.cwd });
+  const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd });
+  let verdictFooter = false;
   try {
     const result = await deliverPostToolMove(move, orgId);
     debug(`durably ingested ${move.moveId} (${toolName})`);
     if (isVerdictFooterContext(result.verdictFooter)) {
+      verdictFooter = true;
       process.stderr.write(`${renderVerdictFooter(result.verdictFooter)}
 `);
     }
   } catch (err) {
     debug(`ingest failed: ${err instanceof Error ? err.message : String(err)}`);
   }
-  emit();
+  if (agent === "codex" && verdictFooter) {
+    try {
+      const context = await prepareCodexContext({
+        cwd,
+        sessionId: envelope.session_id,
+        includeDigest: false
+      });
+      await emitWithAcknowledgment(appendCodexContext({}, context.context), context.acknowledge);
+      return;
+    } catch {
+    }
+  }
+  await emit();
 }
-main().catch(() => {
-  emit();
+main().catch(async () => {
+  await emit();
 });

package/dist/hooks/pre-commit.js

@@ -2,9 +2,10 @@
 import {
   checkAffectedDecisions,
   formatDecisionsWarning
-} from "../chunk-XUAP572Z.js";
-import "../chunk-RTLFE6EZ.js";
-import "../chunk-UTKQTZHL.js";
+} from "../chunk-RO3F6JYV.js";
+import "../chunk-Z7YPFWAZ.js";
+import "../chunk-CUE2LKLR.js";
+import "../chunk-3EEFL6NJ.js";
 
 // src/hooks/pre-commit.ts
 import { execSync } from "child_process";

package/dist/hooks/pre-tool-use.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import {
-  DEFAULT_RULES,
   analyzeShellTargets,
   buildCodexOutput,
   buildHermesOutput,
@@ -10,26 +9,38 @@ import {
   failOpenCodex,
   failOpenHermes,
   failOpenOutput,
-  readHookMode,
+  readHookMode
+} from "../chunk-BQUJ4AFJ.js";
+import {
+  appendCodexContext,
+  hasVisibleCodexMessage,
+  prepareCodexContext
+} from "../chunk-KKP2NYZ3.js";
+import {
+  packageVersion
+} from "../chunk-4A2XB2PC.js";
+import {
+  DEFAULT_RULES,
   scrub
-} from "../chunk-G5D3FF3D.js";
+} from "../chunk-FI3LIRCB.js";
 import {
-  packageVersion,
-  warmBinCache
-} from "../chunk-CZ24W5QU.js";
+  boundedHealthError
+} from "../chunk-LEMX3IOG.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
   isRepoActive,
   repoSyncId
-} from "../chunk-TDRXHBEX.js";
+} from "../chunk-TJTVHDJ5.js";
 import {
   getClient
-} from "../chunk-RTLFE6EZ.js";
+} from "../chunk-Z7YPFWAZ.js";
 import {
   normalizeEnvelope,
   parseAgent
-} from "../chunk-TCDUH7AN.js";
+} from "../chunk-WB7AUZ4C.js";
+import "../chunk-CUE2LKLR.js";
+import "../chunk-3EEFL6NJ.js";
 
 // src/hooks/preflight-v3.ts
 import { Buffer as Buffer2 } from "buffer";
@@ -39,6 +50,9 @@ var MAX_PREFLIGHT_PATHS = 32;
 var MAX_PROPOSAL_BYTES = 6144;
 var MAX_CLIENT_VERSION_CHARS = 32;
 var CLIENT_VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+var MAX_DECISION_DISCLOSURES = 16;
+var DISCLOSED_DECISION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+var DISCLOSED_DECISION_SHORT_ID_RE = /^[0-9a-f]{8}$/u;
 function boundedClientVersion(raw) {
   return typeof raw === "string" && raw.length <= MAX_CLIENT_VERSION_CHARS && CLIENT_VERSION_RE.test(raw) ? raw : "unknown";
 }
@@ -88,8 +102,26 @@ function parsePreflightResponse(value) {
   if (response.protocolVersion !== PREFLIGHT_PROTOCOL_VERSION || typeof response.verdict !== "string" || !verdicts.has(response.verdict) || typeof response.reasonCode !== "string" || typeof response.message !== "string" || !Array.isArray(response.conflicts) || !Array.isArray(response.bypassed)) {
     return null;
   }
+  const disclosures = response.decisionDisclosures;
+  if (disclosures !== void 0) {
+    if (!Array.isArray(disclosures) || disclosures.length === 0 || disclosures.length > MAX_DECISION_DISCLOSURES) {
+      return null;
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const value2 of disclosures) {
+      if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return null;
+      const disclosure = value2;
+      if (Object.keys(disclosure).length !== 3 || !Object.hasOwn(disclosure, "decisionId") || !Object.hasOwn(disclosure, "shortId") || !Object.hasOwn(disclosure, "participation") || typeof disclosure.decisionId !== "string" || !DISCLOSED_DECISION_ID_RE.test(disclosure.decisionId) || typeof disclosure.shortId !== "string" || !DISCLOSED_DECISION_SHORT_ID_RE.test(disclosure.shortId) || disclosure.participation !== "candidate" && disclosure.participation !== "reconcile_bypass" || seen.has(disclosure.decisionId)) {
+        return null;
+      }
+      seen.add(disclosure.decisionId);
+    }
+  }
   return response;
 }
+function decisionDisclosureContext(response) {
+  return response.decisionDisclosures?.map(({ decisionId }) => `[primitive] hidden Decision: prim decisions show ${decisionId}`).join("\n") ?? "";
+}
 async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS)) {
   const response = await getClient().post("/api/cli/decisions/conflict-check", request, {
     signal,
@@ -99,6 +131,8 @@ async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_
 }
 function resultForPreflight(response) {
   const verdict = response.verdict === "block" ? "deny" : response.verdict;
+  const message = boundedHealthError(response.message) ?? "";
+  const unavailable = message || boundedHealthError(response.reasonCode);
   const safe = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
   const directives = response.conflicts.flatMap((value) => {
     if (!value || typeof value !== "object") return [];
@@ -106,14 +140,15 @@ function resultForPreflight(response) {
     const id = typeof shortId === "string" && safe.test(shortId) ? `dec_${shortId}` : typeof decisionId === "string" && safe.test(decisionId) ? decisionId : void 0;
     return id ? [`To reconcile, run: prim reconcile ${id}`] : [];
   });
-  const reason = [response.message, ...new Set(directives)].filter(Boolean).join("\n");
+  const reason = [message, ...new Set(directives)].filter(Boolean).join("\n");
+  const disclosureContext = decisionDisclosureContext(response);
   return {
     verdict,
     conflicts: response.conflicts,
     reason,
-    additionalContext: ["warn", "ask", "block"].includes(response.verdict) ? reason : "",
+    additionalContext: disclosureContext || (["warn", "ask", "block"].includes(response.verdict) ? reason : ""),
     truncated: false,
-    unavailable: response.verdict === "unavailable" ? response.message || response.reasonCode : void 0
+    unavailable: response.verdict === "unavailable" ? unavailable : void 0
   };
 }
 function unverifiedResult(message) {
@@ -147,9 +182,19 @@ async function readStdin() {
   });
 }
 var agent = parseAgent(process.argv);
-function emit(output) {
-  process.stdout.write(`${JSON.stringify(output)}
-`);
+async function emit(output) {
+  return await new Promise((resolve) => {
+    try {
+      process.stdout.write(`${JSON.stringify(output)}
+`, (error) => resolve(!error));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function emitWithAcknowledgment(output, acknowledge) {
+  const handedOff = await emit(output);
+  await acknowledge?.(handedOff);
 }
 function failOpen() {
   if (agent === "hermes") return failOpenHermes();
@@ -159,25 +204,48 @@ function invocationId(envelope) {
   const value = agent === "hermes" ? envelope.extra?.tool_call_id : envelope.tool_use_id;
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function emitUnverified(message) {
+function hermesAdvisory(result, aggregate) {
+  const parts = [];
+  if (aggregate === "warn") parts.push(result.reason);
+  if (result.verdict === "unavailable") {
+    parts.push(result.unavailable ?? result.reason);
+  }
+  if (result.additionalContext && result.additionalContext !== result.reason) {
+    parts.push(result.additionalContext);
+  }
+  const message = [...new Set(parts.filter(Boolean))].join("\n");
+  return message.startsWith("[primitive]") ? message : message ? `[primitive] ${message}` : "";
+}
+async function emitUnverified(message, envelope) {
   const result = unverifiedResult(message);
   if (agent === "hermes") {
     process.stderr.write(`[primitive] ${message}
 `);
-    emit(failOpenHermes());
+    await emit(failOpenHermes());
   } else {
-    emit(
-      agent === "codex" ? buildCodexOutput("allow", [result]) : buildHookOutput("allow", [result])
-    );
+    let output = agent === "codex" ? buildCodexOutput("allow", [result]) : buildHookOutput("allow", [result]);
+    if (agent === "codex" && typeof envelope?.session_id === "string" && envelope.session_id) {
+      try {
+        const context = await prepareCodexContext({
+          cwd: envelope.cwd ?? process.cwd(),
+          sessionId: envelope.session_id,
+          includeDigest: false
+        });
+        output = appendCodexContext(output, context.context);
+        await emitWithAcknowledgment(output, context.acknowledge);
+        return;
+      } catch {
+      }
+    }
+    await emit(output);
   }
 }
 async function main() {
-  warmBinCache();
   let raw;
   try {
     raw = await readStdin();
   } catch {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   let envelope;
@@ -187,17 +255,17 @@ async function main() {
       agent
     );
   } catch {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   if (envelope.hook_event_name !== "PreToolUse") {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   const env = process.env;
   const mode = readHookMode(env);
   if (mode === "off") {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
@@ -209,22 +277,25 @@ async function main() {
     cwd
   });
   if (targets.mutation === "none") {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   if (!isRepoActive(cwd)) {
-    emit(failOpen());
+    await emit(failOpen());
     return;
   }
   if (targets.paths.length === 0) {
-    emitUnverified("mutation targets could not be determined; enforcement not verified");
+    await emitUnverified(
+      "mutation targets could not be determined; enforcement not verified",
+      envelope
+    );
     return;
   }
   const binding = repoSyncId(cwd);
   const sessionId = envelope.session_id;
   const callId = invocationId(envelope);
   if (!binding || typeof sessionId !== "string" || !sessionId || !callId) {
-    emitUnverified("repository binding or tool invocation identity is unavailable");
+    await emitUnverified("repository binding or tool invocation identity is unavailable", envelope);
     return;
   }
   const request = {
@@ -243,26 +314,35 @@ async function main() {
   try {
     const response = await requestPreflight(request);
     if (!response) {
-      emitUnverified("enforcement service returned an incompatible response");
+      await emitUnverified("enforcement service returned an incompatible response", envelope);
       return;
     }
     result = resultForPreflight(response);
   } catch {
-    emitUnverified("enforcement service unavailable; change was not verified");
+    await emitUnverified("enforcement service unavailable; change was not verified", envelope);
     return;
   }
   const aggregate = demoteForMode(
     result.verdict === "unavailable" ? "allow" : result.verdict,
     mode
   );
-  if (agent === "hermes" && (aggregate === "warn" || result.verdict === "unavailable")) {
-    process.stderr.write(`[primitive] ${result.reason || result.unavailable}
+  if (agent === "hermes" && aggregate !== "deny" && aggregate !== "ask") {
+    const advisory = hermesAdvisory(result, aggregate);
+    if (advisory) process.stderr.write(`${advisory}
 `);
   }
-  emit(
-    agent === "hermes" ? buildHermesOutput(aggregate, [result]) : agent === "codex" ? buildCodexOutput(aggregate, [result]) : buildHookOutput(aggregate, [result])
-  );
+  let output = agent === "hermes" ? buildHermesOutput(aggregate, [result]) : agent === "codex" ? buildCodexOutput(aggregate, [result]) : buildHookOutput(aggregate, [result]);
+  if (agent === "codex" && hasVisibleCodexMessage(output) && typeof sessionId === "string" && sessionId.length > 0) {
+    try {
+      const context = await prepareCodexContext({ cwd, sessionId, includeDigest: false });
+      output = appendCodexContext(output, context.context);
+      await emitWithAcknowledgment(output, context.acknowledge);
+      return;
+    } catch {
+    }
+  }
+  await emit(output);
 }
-main().catch(() => {
-  emit(failOpen());
+main().catch(async () => {
+  await emit(failOpen());
 });