@primitive.ai/prim 0.1.0-alpha.67 → 0.1.0-alpha.69

package/dist/statusline-main.js

@@ -3,73 +3,396 @@
 // src/commands/statusline.ts
 import { readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname5, resolve as resolve3 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath } from "url";
 
 // src/client.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash2 } from "crypto";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3 } from "fs";
+import { dirname as dirname3 } from "path";
+
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
 import {
-  chmodSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
   renameSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync2
+  rmSync,
+  writeFileSync
 } from "fs";
+import { dirname } from "path";
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/paths.ts
 import { homedir } from "os";
-import { dirname as dirname2, join as join2, resolve } from "path";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/lib/workos-connect.ts
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_URL_LENGTH = 2048;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
+  }
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+  }
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  return issuer;
+}
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+  }
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
+  }
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
+}
+
+// src/lib/credentials.ts
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+        return void 0;
+      }
+    }
+    return { token: stored, source: "token_file" };
+  }
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
+}
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
+  }
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
+  }
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
+}
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
+  }
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
+    }
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+}
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+  }
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
 
 // src/lib/file-lock.ts
 import { randomBytes } from "crypto";
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 
-// src/client.ts
-var DEFAULT_API_URL = "https://api.getprimitive.ai";
-function loadEnvFile(cwd = process.cwd()) {
-  const envVars = {};
-  for (const file of [".env.local", ".env"]) {
-    const filePath = resolve(cwd, file);
-    if (!existsSync2(filePath)) continue;
-    const content = readFileSync2(filePath, "utf-8");
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eqIdx = trimmed.indexOf("=");
-      if (eqIdx === -1) continue;
-      envVars[trimmed.slice(0, eqIdx).trim()] = trimmed.slice(eqIdx + 1).trim();
+// src/lib/terminal-safe.ts
+function replaceIsolatedSurrogates(value) {
+  let out = "";
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        out += value[index] + value[index + 1];
+        index += 1;
+      } else {
+        out += "\uFFFD";
+      }
+    } else if (unit >= 56320 && unit <= 57343) {
+      out += "\uFFFD";
+    } else {
+      out += value[index];
     }
   }
-  return envVars;
+  return out;
+}
+function isUnsafeTerminalCodePoint(point) {
+  const c0OrC1 = point <= 31 || point >= 127 && point <= 159;
+  const bidiOrZeroWidth = point === 173 || // soft hyphen
+  point === 1564 || // Arabic letter mark
+  point === 6158 || // Mongolian vowel separator
+  point >= 8203 && point <= 8207 || // zero-width + directional marks
+  point >= 8234 && point <= 8238 || // bidi embeddings/overrides
+  point >= 8288 && point <= 8303 || // word joiner + bidi isolates/controls
+  point >= 65529 && point <= 65531 || // interlinear annotation controls
+  point === 65279 || // zero-width no-break space / BOM
+  point >= 917504 && point <= 917631;
+  return c0OrC1 || bidiOrZeroWidth;
+}
+function terminalSafeText(value) {
+  return Array.from(replaceIsolatedSurrogates(value)).filter((character) => !isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0)).join("");
 }
-var TOKEN_FILE_PATH = join2(homedir(), ".config", "prim", "token");
-var REFRESH_TOKEN_PATH = join2(dirname2(TOKEN_FILE_PATH), "refresh_token");
-var TOKEN_EXPIRES_PATH = join2(dirname2(TOKEN_FILE_PATH), "token_expires_at");
-var TERMINAL_REFRESH_PATH = join2(dirname2(TOKEN_FILE_PATH), "refresh_terminal");
-var CREDENTIAL_LOCK_PATH = join2(dirname2(TOKEN_FILE_PATH), "credentials.lock");
+var stripControlChars = terminalSafeText;
+
+// src/client.ts
+var DEFAULT_API_URL = "https://api.getprimitive.ai";
 function getSiteUrl() {
-  return getSiteUrlForCwd(process.cwd(), process.env.PRIM_API_URL);
+  return getSiteUrlForEnvironment(process.env.PRIM_API_URL);
 }
-function getSiteUrlForCwd(cwd, primApiUrl) {
-  if (primApiUrl) return primApiUrl;
-  return loadEnvFile(cwd).PRIM_API_URL ?? DEFAULT_API_URL;
+function getSiteUrlForEnvironment(primApiUrl) {
+  return primApiUrl?.trim() || DEFAULT_API_URL;
 }
+var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
 
 // src/daemon/client.ts
 import { createConnection } from "net";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-var SOCK_PATH = join3(homedir2(), ".config", "prim", "sock");
+import { join as join5 } from "path";
+
+// src/daemon/principal.ts
+import { createHash as createHash3 } from "crypto";
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join5(primConfigDirectory(), "sock");
 var DEFAULT_TIMEOUT_MS = 250;
 var nextRequestId = 1;
 function daemonRequest(method, params = {}, opts = {}) {
   const id = nextRequestId++;
-  const request = { id, method, params };
+  const caller = resolveDaemonPrincipal();
+  const request = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   return new Promise((resolve4) => {
     let settled = false;
     let socket;
-    let buffer = "";
+    let buffer = Buffer.alloc(0);
     const settle = (value) => {
       if (settled) {
         return;
@@ -106,15 +429,20 @@ function daemonRequest(method, params = {}, opts = {}) {
       }
     });
     socket.on("data", (chunk) => {
-      buffer += chunk.toString("utf-8");
-      const newlineIdx = buffer.indexOf("\n");
+      buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
       if (newlineIdx === -1) {
         return;
       }
-      const line = buffer.slice(0, newlineIdx);
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
       try {
-        const res = JSON.parse(line);
-        if (res.id !== id) {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
           clearTimeout(timer);
           settle(null);
           return;
@@ -137,16 +465,18 @@ function daemonRequest(method, params = {}, opts = {}) {
 
 // src/lib/activation.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join6 } from "path";
 
 // src/lib/git.ts
 import { execFileSync } from "child_process";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { lstatSync, realpathSync } from "fs";
-import { basename, dirname as dirname3, isAbsolute, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "path";
 var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
 function gitToplevel(cwd) {
   try {
     return execFileSync("git", ["rev-parse", "--show-toplevel"], {
@@ -159,10 +489,41 @@ function gitToplevel(cwd) {
     return null;
   }
 }
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
 
 // src/lib/activation.ts
 var PRIM_ACTIVE_KEY = "prim.active";
+var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
+var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
 var GIT_TIMEOUT_MS2 = 1e3;
+var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
 var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
 function repoActiveFlag(cwd) {
@@ -180,14 +541,45 @@ function repoActiveFlag(cwd) {
     return void 0;
   }
 }
+function isValidRepoSyncId(value) {
+  return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
+}
+function localGitConfigValue(cwd, key) {
+  try {
+    const value = execFileSync2("git", ["config", "--local", "--get", key], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function repoSyncId(cwd) {
+  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  if (!isValidRepoSyncId(value)) return void 0;
+  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
+  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
+}
+function repositoryBindingState(cwd) {
+  const rawId = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  const marker = localGitConfigValue(cwd, PRIM_REPO_BINDING_STATE_KEY);
+  if (rawId !== void 0 && !isValidRepoSyncId(rawId)) return "invalid";
+  if (marker === "unbound" || marker === "invalid") return marker;
+  if (marker === "connected") return repoSyncId(cwd) ? "connected" : "invalid";
+  if (marker !== void 0) return "invalid";
+  return rawId === void 0 ? "unbound" : repoSyncId(cwd) ? void 0 : "unbound";
+}
 function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
-  if (root === null || root === homedir3()) return false;
+  if (root === null || root === homedir2()) return false;
   for (const rel of PROJECT_INSTALL_FILES) {
-    const path = join4(root, rel);
+    const path = join6(root, rel);
     if (existsSync3(path)) {
       try {
-        const content = readFileSync3(path, "utf-8");
+        const content = readFileSync4(path, "utf-8");
         if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
       } catch {
       }
@@ -205,30 +597,6 @@ function decisionIngestionStatus(cwd) {
   return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
 }
 
-// src/lib/bin-cache.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
-
-// src/lib/bin-path.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5 } from "path";
-import { fileURLToPath } from "url";
-var PKG_NAME = "@primitive.ai/prim";
-var NPX_FALLBACK = `npx --yes -p ${PKG_NAME}@latest`;
-
-// src/lib/ansi.ts
-function stripControlChars(text) {
-  let out = "";
-  for (const ch of text) {
-    const code = ch.codePointAt(0) ?? 0;
-    if (code > 31 && !(code >= 127 && code <= 159)) {
-      out += ch;
-    }
-  }
-  return out;
-}
-
 // src/lib/presence.ts
 var DECISION_ORIGIN = "https://app.getprimitive.ai";
 function validDecisionUrl(value) {
@@ -245,9 +613,12 @@ function validDecisionUrl(value) {
     return void 0;
   }
 }
-function decisionLink(label, decisionUrl) {
+function decisionLink(label, decisionUrl, plain) {
   const url = validDecisionUrl(decisionUrl);
-  return url ? `\x1B]8;;${url}\x07\x1B[34;4m${label}\x1B[0m\x1B]8;;\x07` : label;
+  if (plain || !url) {
+    return label;
+  }
+  return `\x1B]8;;${url}\x07\x1B[34;4m${label}\x1B[0m\x1B]8;;\x07`;
 }
 function formatLabeled(labels, cap) {
   if (labels === void 0) {
@@ -264,48 +635,61 @@ function formatLabeled(labels, cap) {
 function formatTeammates(names, cap) {
   return formatLabeled(names?.map(stripControlChars), cap);
 }
-function formatTeammatesWithArea(teammates, cap) {
+function formatTeammatesWithArea(teammates, cap, plainLinks = false) {
   return formatLabeled(
     teammates?.map((t) => {
       const name = stripControlChars(t.name);
       const area = stripControlChars(t.area ?? "").trim();
       const label = area ? `${name} - ${area}` : name;
-      return decisionLink(label, t.decisionUrl);
+      return decisionLink(label, t.decisionUrl, plainLinks);
     }),
     cap
   );
 }
 
 // src/lib/statusline-render.ts
+function repositoryBindingDiagnosticLabel(state) {
+  if (state === "unbound") return "repository: unbound (enforcement not evaluating)";
+  if (state === "invalid") return "repository binding: invalid (run `prim doctor`)";
+  return void 0;
+}
 var STATUSLINE_NAME_CAP = 3;
-function formatStatusline(version, snapshot, resolveIngestionStatus) {
+function formatStatusline(version, snapshot, resolveIngestionStatus, options = {}) {
+  const ingestionSuffix = (status) => status === void 0 ? "" : ` \xB7 Decision ingestion ${status}`;
+  const ingestionStatus = snapshot === null || snapshot.healthy === false ? options.includeIngestionWhenUnavailable ? resolveIngestionStatus() : void 0 : resolveIngestionStatus();
+  if (snapshot?.healthy === false && snapshot.needsReauth) {
+    return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`${ingestionSuffix(ingestionStatus)})`;
+  }
+  const repositoryLabel = repositoryBindingDiagnosticLabel(
+    snapshot !== null && snapshot.healthy !== false || options.includeIngestionWhenUnavailable === true ? options.resolveRepositoryBindingState?.() : void 0
+  );
+  const repositorySuffix = repositoryLabel ? ` \xB7 ${repositoryLabel}` : "";
   if (!snapshot) {
-    return `primitive ${version} (daemon: down)`;
+    return `primitive ${version} (daemon: down${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
   }
   if (snapshot.healthy === false) {
-    if (snapshot.needsReauth) {
-      return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`)`;
-    }
     if (snapshot.ingestion?.healthy === false) {
       const pending = snapshot.ingestion.pendingCount;
       const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
-      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""})`;
+      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""}${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
     }
     if (snapshot.heartbeat?.healthy === false) {
-      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable)`;
+      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
     }
-    return `primitive ${version} (daemon: starting)`;
+    return `primitive ${version} (daemon: starting${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
   }
-  const ingestionStatus = resolveIngestionStatus();
   if (snapshot.envMismatch) {
-    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: other env)`;
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 presence: other env)`;
+  }
+  if (snapshot.principalMismatch) {
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 presence: other account)`;
   }
   if (snapshot.presenceStale) {
-    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 presence: stale)`;
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 presence: stale)`;
   }
   let team;
   if (snapshot.onlineTeammates !== void 0) {
-    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP)}`;
+    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP, options.plainLinks === true)}`;
   } else if (snapshot.onlineNames !== void 0) {
     team = `team: ${formatTeammates(snapshot.onlineNames, STATUSLINE_NAME_CAP)}`;
   } else if (typeof snapshot.onlineCount === "number") {
@@ -313,14 +697,14 @@ function formatStatusline(version, snapshot, resolveIngestionStatus) {
   } else {
     team = "team: \u2014";
   }
-  return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus} \xB7 ${team})`;
+  return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 ${team})`;
 }
 
 // src/commands/statusline.ts
 var STATUSLINE_TIMEOUT_MS = 200;
 function readPackageVersion() {
   try {
-    const here = dirname5(fileURLToPath2(import.meta.url));
+    const here = dirname5(fileURLToPath(import.meta.url));
     const candidates = [
       // Schema-v2 runtimes staged a manifest beside this standalone bundle.
       // Keep resolving it while those legacy launchers transition to schema v3.
@@ -349,6 +733,12 @@ function debug(msg) {
 }
 async function renderStatusline() {
   const version = readPackageVersion();
+  const cwd = process.cwd();
+  let ingestion;
+  const resolveIngestion = () => {
+    ingestion ??= decisionIngestionStatus(cwd);
+    return ingestion;
+  };
   const snapshot = await daemonRequest(
     "status_snapshot",
     // callerEnv lets the daemon withhold presence when it is bound to a different
@@ -359,7 +749,9 @@ async function renderStatusline() {
   if (!snapshot) {
     debug("daemon snapshot missing");
   }
-  return formatStatusline(version, snapshot, () => decisionIngestionStatus(process.cwd()));
+  return formatStatusline(version, snapshot, resolveIngestion, {
+    resolveRepositoryBindingState: () => resolveIngestion() === "enabled" ? repositoryBindingState(cwd) : void 0
+  });
 }
 
 // src/statusline-main.ts